☰

带有错误签名的包在第二次尝试时被安装：怎么办？

tag-icon • tag-icon apt security gnupg
带有错误签名的包在第二次尝试时被安装：怎么办？

我执行了我的日常sudo apt-get update && sudo apt-get upgrade命令，并在访问 Google Chrome 时收到一个严重的签名错误：

Fetched 2178 kB in 2s (981 kB/s)
Reading package lists... Done
W: GPG error: http://dl.google.com stable Release: The following signatures were invalid: BADSIG A040830F7FAC5991 Google, Inc. Linux Package Signing Key <[email protected]>
WARNING: The following packages cannot be authenticated!
  google-chrome-stable
Install these packages without verification? [y/N] N
E: Some packages could not be authenticated

在搜索 Ask Ubuntu 后，我发现了这个问题，它告诉我执行apt-key update。执行后得到的结果如下：

[Gx1sptDTDa] $ sudo apt-key update
gpg: key 437D05B5: "Ubuntu Archive Automatic Signing Key <[email protected]>" not changed
gpg: key FBB75451: "Ubuntu CD Image Automatic Signing Key <[email protected]>" not changed
gpg: key C0B21F32: "Ubuntu Archive Automatic Signing Key (2012) <[email protected]>" not changed
gpg: key EFE21092: "Ubuntu CD Image Automatic Signing Key (2012) <[email protected]>" not changed
gpg: Total number processed: 4
gpg:              unchanged: 4

所以，在我看来好像什么都没有更新；没有新的密钥，对吗？

那么，为什么 apt 在以下尝试中没有抱怨：

[Gx1sptDTDa] $ sudo apt-get update && sudo apt-get upgrade           
Ign http://dl.google.com stable InRelease                                  
Get:1 http://dl.google.com stable Release.gpg [198 B]                          
Get:2 http://dl.google.com stable/main i386 Packages [1210 B]                  
Fetched 1408 B in 1s (758 B/s)
Reading package lists... Done
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  bind9-host dkms dnsutils gir1.2-gtk-3.0 gir1.2-javascriptcoregtk-3.0
  gir1.2-webkit-3.0 google-chrome-stable libbind9-90 libdns100 libgail-3-0
  libgtk-3-0 libgtk-3-bin libgtk-3-common libisc95 libisccc90 libisccfg90
  libjasper1 libjavascriptcoregtk-1.0-0 libjavascriptcoregtk-3.0-0
  liblightdm-gobject-1-0 liblwres90 libplymouth2 libsepol1 libwebkitgtk-1.0-0
  libwebkitgtk-1.0-common libwebkitgtk-3.0-0 libwebkitgtk-3.0-common lightdm
  plymouth plymouth-label plymouth-theme-ubuntu-logo
  plymouth-theme-ubuntu-text xserver-common xserver-xorg-core
  34 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
  Need to get 71,4 MB of archives.
  After this operation, 2910 kB disk space will be freed.
  Do you want to continue? [Y/n] y

看起来它确实从 google 密钥服务器下载了一些新东西，并且确实安装了。所以我的问题是：它到底做了什么apt-key update？

答案1

apt-key update没有做任何事情。apt-get update做了。请注意以下几行：

Get:1 http://dl.google.com stable Release.gpg [198 B]                          
Get:2 http://dl.google.com stable/main i386 Packages [1210 B]

apt已找到更新的软件包信息，此信息现在与 的新版本相匹配google-chrome-stable。如何apt在没有运行的情况下下载新软件包update对我来说一直是个谜。

相关内容