While I'm looking at aptitude, it seems worth mentioning a problem I've
been seeing since Etch was released: that is 'aptitude update' downloads
the updated package lists (or not, if they haven't changed), and then
reports that the GPG signature on something (that is not clearly
identified) is invalid. On every occasion, the solution is simply to
rerun 'aptitude update', which then completes successfully.

I remember seeing someone post (can't find it now) that they thought
this was due to an incorrect/inconsistent repository, and that the rerun
works because it picks up a different repository machine in some kind of
DNS round-robin server cluster.

If that's the case, why hasn't the repository error been corrected by now ?

Here's an instance from 22.Nov.2007 :

ETCHBOX:/etc/apt# aptitude update
Get:1 http://security.debian.org etch/updates Release.gpg [189B]
Get:2 http://security.debian.org etch/updates Release [22.5kB]
Get:3 http://ftp.de.debian.org etch Release.gpg [378B]
Hit http://ftp.de.debian.org etch Release
Ign http://security.debian.org etch/updates Release
Ign http://security.debian.org etch/updates/main Packages/DiffIndex
Ign http://ftp.de.debian.org etch/main Packages/DiffIndex
Ign http://security.debian.org etch/updates/contrib Packages/DiffIndex
Get:4 http://security.debian.org etch/updates/main Packages [216kB]
Hit http://ftp.de.debian.org etch/main Packages
Hit http://security.debian.org etch/updates/contrib Packages
Fetched 238kB in 1s (200kB/s)
Reading package lists... Done
W: GPG error: http://security.debian.org etch/updates Release: The
following signatures were invalid: BADSIG A70DAF536070D3A1 Debian
Archive Automatic Signing Key (4.0/etch) <ftpmaster@debian.org>
W: You may want to run apt-get update to correct these problems

ETCHBOX:/etc/apt# aptitude update
Get:1 http://security.debian.org etch/updates Release.gpg [189B]
Get:2 http://ftp.de.debian.org etch Release.gpg [378B]
Hit http://security.debian.org etch/updates Release
Hit http://ftp.de.debian.org etch Release
Ign http://security.debian.org etch/updates/main Packages/DiffIndex
Ign http://security.debian.org etch/updates/contrib Packages/DiffIndex
Ign http://ftp.de.debian.org etch/main Packages/DiffIndex
Hit http://security.debian.org etch/updates/main Packages
Hit http://ftp.de.debian.org etch/main Packages
Hit http://security.debian.org etch/updates/contrib Packages
Fetched 190B in 0s (522B/s)
Reading package lists... Done

Anyone got any clues about this ?
Does anyone else see the syndrome ?

Cheers,
Nick Boyce
--
'If you don't pray in my school, I won't think in your church'


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Fri, Dec 14, 2007 at 02:28:29AM +0000, Nick wrote:
> While I'm looking at aptitude, it seems worth mentioning a problem I've
> been seeing since Etch was released: that is 'aptitude update' downloads
> the updated package lists (or not, if they haven't changed), and then
> reports that the GPG signature on something (that is not clearly
> identified) is invalid. On every occasion, the solution is simply to
> rerun 'aptitude update', which then completes successfully.
>
> I remember seeing someone post (can't find it now) that they thought
> this was due to an incorrect/inconsistent repository, and that the rerun
> works because it picks up a different repository machine in some kind of
> DNS round-robin server cluster.
>
> If that's the case, why hasn't the repository error been corrected by now ?

[snip aptitude output]

> Anyone got any clues about this ?
> Does anyone else see the syndrome ?

I've seen a lot of these the last few months with ftp.ro.debian.org
Because the server was down for a few days I switched to
ftp.at.debian.org and all my problems are gone.

Regards,
Andrei
--
If you can't explain it simply, you don't understand it well enough.
(Albert Einstein)