Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171577 > unrolled thread

Security Updates

Back to article view | Back to linux.debian.user

Contents

  Security Updates Larry Dighera <LDighera@att.net> - 2016-08-30 22:00 +0200
    Re: Security Updates Tim McDonough <tmcdonough@gmail.com> - 2016-08-30 22:30 +0200
      Re: Security Updates Cindy-Sue Causey <butterflybytes@gmail.com> - 2016-08-30 23:00 +0200
    Re: Security Updates "Andrew M.A. Cater" <amacater@galactic.demon.co.uk> - 2016-08-30 22:50 +0200
      Re: Security Updates "Andrew M.A. Cater" <amacater@galactic.demon.co.uk> - 2016-08-31 15:30 +0200
        Re: Security Updates Larry Dighera <LDighera@att.net> - 2016-08-31 17:20 +0200
          Re: Security Updates Greg Wooledge <wooledg@eeg.ccf.org> - 2016-08-31 17:30 +0200
          Re: Security Updates Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-31 17:40 +0200
          Re: Security Updates Charlie Kravetz <cjk@teamcharliesangels.com> - 2016-08-31 19:10 +0200
    Re: Security Updates Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-30 23:20 +0200
    Re: Security Updates Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-31 11:40 +0200
      Re: Security Updates Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-31 15:20 +0200
        Re: Security Updates Mark Fletcher <mark27q1@gmail.com> - 2016-08-31 16:40 +0200
        Re: Security Updates Larry Dighera <LDighera@att.net> - 2016-08-31 17:40 +0200
    Re: Security Updates Darac Marjal <mailinglist@darac.org.uk> - 2016-08-31 15:50 +0200
      Re: Security Updates Larry Dighera <LDighera@att.net> - 2016-08-31 19:40 +0200

#171577 — Security Updates

This page <https://www.debian.org/releases/stable/errata> states:

    "If you use APT, add the following line to /etc/apt/sources.list to be able
    to access the latest security updates:

    deb http://security.debian.org/ jessie/updates main contrib non-free

    After that, run apt-get update followed by apt-get upgrade."

Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running Debian
Jessie results in an error message indicating that the public key is not found.
It also finds two libraries that require updating that are not found when the
above mentioned /etc/apt/sources.list entry is removed.

  1.  What do I need to do to prevent the error message?

  2.  As there are other security related URLs (doubtless, as
  distributed/released) that are checked during apt-get update, is the
  recommended additional entry advisable/useful for this platform?

[toc] | [next] | [standalone]

#171581

[Multipart message — attachments visible in raw view] — view raw

Your Raspberry Pi is most likely running Raspbian and not Debian.
Raspbian's updates must be ported by their development team when Debian
releases them. At one time they claimed the lag was about a half day to a
day behind being released by Debian.

Tim

On Tue, Aug 30, 2016 at 2:58 PM, Larry Dighera <LDighera@att.net> wrote:

>
> This page <https://www.debian.org/releases/stable/errata> states:
>
>     "If you use APT, add the following line to /etc/apt/sources.list to be
> able
>     to access the latest security updates:
>
>     deb http://security.debian.org/ jessie/updates main contrib non-free
>
>     After that, run apt-get update followed by apt-get upgrade."
>
> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running
> Debian
> Jessie results in an error message indicating that the public key is not
> found.
> It also finds two libraries that require updating that are not found when
> the
> above mentioned /etc/apt/sources.list entry is removed.
>
>   1.  What do I need to do to prevent the error message?
>
>   2.  As there are other security related URLs (doubtless, as
>   distributed/released) that are checked during apt-get update, is the
>   recommended additional entry advisable/useful for this platform?
>
>

[toc] | [prev] | [next] | [standalone]

#171584

On 8/30/16, Tim McDonough <tmcdonough@gmail.com> wrote:
>
> On Tue, Aug 30, 2016 at 2:58 PM, Larry Dighera <LDighera@att.net> wrote:
>>
>> This page <https://www.debian.org/releases/stable/errata> states:
>>
>>     "If you use APT, add the following line to /etc/apt/sources.list to
>> be
>> able
>>     to access the latest security updates:
>>
>>     deb http://security.debian.org/ jessie/updates main contrib non-free
>>
>>     After that, run apt-get update followed by apt-get upgrade."
>>
>> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running
>> Debian
>> Jessie results in an error message indicating that the public key is not
>> found.
>> It also finds two libraries that require updating that are not found when
>> the
>> above mentioned /etc/apt/sources.list entry is removed.
>>
>>   1.  What do I need to do to prevent the error message?
>>
>>   2.  As there are other security related URLs (doubtless, as
>>   distributed/released) that are checked during apt-get update, is the
>>   recommended additional entry advisable/useful for this platform?
>
> Your Raspberry Pi is most likely running Raspbian and not Debian.
> Raspbian's updates must be ported by their development team when Debian
> releases them. At one time they claimed the lag was about a half day to a
> day behind being released by Debian.


Don't know if it applies here, but the mention of "Raspbian" triggered
the thought that Raspbian gets a few mentions over at the Debian-ARM
list:

https://lists.debian.org/debian-arm/

I accidentally joined their list quite a while back while mistaking it
for AMD64 (was a cognitive mixup thing). They're interesting over
there and figure I might play with something like that some day so I'm
still lurking in the background. :)

Just thinking out loud.

Cindy :)

-- 
Cindy-Sue Causey
Talking Rock, Pickens County, Georgia, USA

* runs with duct tape *

[toc] | [prev] | [next] | [standalone]

#171583

On Tue, Aug 30, 2016 at 12:58:47PM -0700, Larry Dighera wrote:
> 
> This page <https://www.debian.org/releases/stable/errata> states:
> 
>     "If you use APT, add the following line to /etc/apt/sources.list to be able
>     to access the latest security updates:
> 
>     deb http://security.debian.org/ jessie/updates main contrib non-free
> 
>     After that, run apt-get update followed by apt-get upgrade."
> 
> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running Debian
> Jessie results in an error message indicating that the public key is not found.
> It also finds two libraries that require updating that are not found when the
> above mentioned /etc/apt/sources.list entry is removed.
> 
>   1.  What do I need to do to prevent the error message?
> 
>   2.  As there are other security related URLs (doubtless, as
>   distributed/released) that are checked during apt-get update, is the
>   recommended additional entry advisable/useful for this platform?

Debian or Raspbian?

If Raspbian - that's based very closely on Debian but isn't strictly Debian.

Mixing the two might not be a good idea since there will probably be incompatibilities at some level.

There is a port of pure Debian to the Pi 2 - look on the Debian wiki - but no one has yet done this for the Pi 3 as far as I know.

[The original Pi required different compilation options to cope with floating point "stuff" which rendered Debian incompatible:
Raspbian is a re-compilation to suit the Raspberry Pi. Pi 2 is ARM v7 with hardware floating point. Pi 3 is 64 bit core (so arm64 would work if
the Pi folk hadn't put in 32 bit glue logic or thereabouts). There are also issues with the way of loading the operating system, initialising video
and non-free firmware which can cause problems.]

All the best,

AndyC

[toc] | [prev] | [next] | [standalone]

#171609

On Wed, Aug 31, 2016 at 06:04:34AM -0700, Larry Dighera wrote:
> On Tue, 30 Aug 2016 20:44:27 +0000, "Andrew M.A. Cater"
> <amacater@galactic.demon.co.uk> wrote:
> 
> >On Tue, Aug 30, 2016 at 12:58:47PM -0700, Larry Dighera wrote:
> >> 
> >> This page <https://www.debian.org/releases/stable/errata> states:
> >> 
> >>     "If you use APT, add the following line to /etc/apt/sources.list to be able
> >>     to access the latest security updates:
> >> 
> >>     deb http://security.debian.org/ jessie/updates main contrib non-free
> >> 
> >>     After that, run apt-get update followed by apt-get upgrade."
> >> 
> >> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running Debian
> >> Jessie results in an error message indicating that the public key is not found.
> >> It also finds two libraries that require updating that are not found when the
> >> above mentioned /etc/apt/sources.list entry is removed.
> >> 
> >>   1.  What do I need to do to prevent the error message?
> >> 
> >>   2.  As there are other security related URLs (doubtless, as
> >>   distributed/released) that are checked during apt-get update, is the
> >>   recommended additional entry advisable/useful for this platform?
> >
> >Debian or Raspbian?
> >
> >If Raspbian - that's based very closely on Debian but isn't strictly Debian.
> >
> >Mixing the two might not be a good idea since there will probably be incompatibilities at some level.
> >
> >There is a port of pure Debian to the Pi 2 - look on the Debian wiki - but no one has yet done this for the Pi 3 as far as I know.
> >
> >[The original Pi required different compilation options to cope with floating point "stuff" which rendered Debian incompatible:
> >Raspbian is a re-compilation to suit the Raspberry Pi. Pi 2 is ARM v7 with hardware floating point. Pi 3 is 64 bit core (so arm64 would work if
> >the Pi folk hadn't put in 32 bit glue logic or thereabouts). There are also issues with the way of loading the operating system, initialising video
> >and non-free firmware which can cause problems.]
> >
> >All the best,
> >
> >AndyC
> 
> 
> 
> Hello Andy,
> 
> I thought I made it clear that the OS was Debian Jessie.  It was installed from
> the NOOBS release: <https://www.raspberrypi.org/downloads/noobs/>.  As you can
> see from this article
> <https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>, Debian Jessie was
> released for the Raspberry Pi platform almost a year ago, September 2015.  
> 
> Have you any insight into how to overcome the ;public key not found; error
> message adding that security repository to the apt list, as stated on the
> Debian.org web site, may be resolved?
> 
> Thank you for your response.
> 
> Best regards,
> Larry
>

Hi Larry, 

That's Raspbian - NOOBS installs Raspbian.

As Lisi Reisz has stated to you in another email: Raspbian handle their own security updates.

If you want to add the keys to the Debian security updates repository you can use an apt-key add command and the key available from http://ftp-master.debian.org/keys.html
[The main archive signing key is also used to sign the security updates].

Be aware that you might create problems for yourself.

You may well want to look at the Debian Administrators handbook - you can try apt-get install debian-handbook if the package is also available for Raspbian.

Hope this helps,

Al the very best,

AndyC 

[Copying to the list as this may be of more use more widely]

[toc] | [prev] | [next] | [standalone]

#171623

On Wed, 31 Aug 2016 13:28:21 +0000, "Andrew M.A. Cater"
<amacater@galactic.demon.co.uk> wrote:

>On Wed, Aug 31, 2016 at 06:04:34AM -0700, Larry Dighera wrote:
>> On Tue, 30 Aug 2016 20:44:27 +0000, "Andrew M.A. Cater"
>> <amacater@galactic.demon.co.uk> wrote:
>> 
>> >On Tue, Aug 30, 2016 at 12:58:47PM -0700, Larry Dighera wrote:
>> >> 
>> >> This page <https://www.debian.org/releases/stable/errata> states:
>> >> 
>> >>     "If you use APT, add the following line to /etc/apt/sources.list to be able
>> >>     to access the latest security updates:
>> >> 
>> >>     deb http://security.debian.org/ jessie/updates main contrib non-free
>> >> 
>> >>     After that, run apt-get update followed by apt-get upgrade."
>> >> 
>> >> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running Debian
>> >> Jessie results in an error message indicating that the public key is not found.
>> >> It also finds two libraries that require updating that are not found when the
>> >> above mentioned /etc/apt/sources.list entry is removed.
>> >> 
>> >>   1.  What do I need to do to prevent the error message?
>> >> 
>> >>   2.  As there are other security related URLs (doubtless, as
>> >>   distributed/released) that are checked during apt-get update, is the
>> >>   recommended additional entry advisable/useful for this platform?
>> >
>> >Debian or Raspbian?
>> >
>> >If Raspbian - that's based very closely on Debian but isn't strictly Debian.
>> >
>> >Mixing the two might not be a good idea since there will probably be incompatibilities at some level.
>> >
>> >There is a port of pure Debian to the Pi 2 - look on the Debian wiki - but no one has yet done this for the Pi 3 as far as I know.
>> >
>> >[The original Pi required different compilation options to cope with floating point "stuff" which rendered Debian incompatible:
>> >Raspbian is a re-compilation to suit the Raspberry Pi. Pi 2 is ARM v7 with hardware floating point. Pi 3 is 64 bit core (so arm64 would work if
>> >the Pi folk hadn't put in 32 bit glue logic or thereabouts). There are also issues with the way of loading the operating system, initialising video
>> >and non-free firmware which can cause problems.]
>> >
>> >All the best,
>> >
>> >AndyC
>> 
>> 
>> 
>> Hello Andy,
>> 
>> I thought I made it clear that the OS was Debian Jessie.  It was installed from
>> the NOOBS release: <https://www.raspberrypi.org/downloads/noobs/>.  As you can
>> see from this article
>> <https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>, Debian Jessie was
>> released for the Raspberry Pi platform almost a year ago, September 2015.  
>> 
>> Have you any insight into how to overcome the ;public key not found; error
>> message adding that security repository to the apt list, as stated on the
>> Debian.org web site, may be resolved?
>> 
>> Thank you for your response.
>> 
>> Best regards,
>> Larry
>>
>
>Hi Larry, 
>
>That's Raspbian - NOOBS installs Raspbian.
>
>As Lisi Reisz has stated to you in another email: Raspbian handle their own security updates.
>
>If you want to add the keys to the Debian security updates repository you can use an apt-key add command and the key available from http://ftp-master.debian.org/keys.html
>[The main archive signing key is also used to sign the security updates].
>
>Be aware that you might create problems for yourself.
>
>You may well want to look at the Debian Administrators handbook - you can try apt-get install debian-handbook if the package is also available for Raspbian.
>
>Hope this helps,
>
>Al the very best,
>
>AndyC 
>
>[Copying to the list as this may be of more use more widely]


Hello Andy,

Have you even looked at the information here:
<https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>?  After reading
that announcement, how can you continue to insist that I am not running Debian
Jessie?  

I appreciate your pointer to adding keys to the Debian security updates
repository with apt-key add.  I will look into that, however if it were
necessary for me to do that manually, I would have expected the
<https://www.debian.org/releases/stable/errata> page to have mentioned it
explicitly.  Perhaps I expect too much...

I find the stability of the Debian APT system to be one of the most valuable
aspects of Debian Linux, compared to other less stable distributions I have
encountered over the years.  So I am wary of doing anything to break it, even
if it proffered on a Debian web page, as you cautioned.  

Thank you for sharing your knowledge.

Best regards,
Larry

[toc] | [prev] | [next] | [standalone]

#171624

On Wed, Aug 31, 2016 at 08:16:45AM -0700, Larry Dighera wrote:
> Have you even looked at the information here:
> <https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>?  After reading
> that announcement, how can you continue to insist that I am not running Debian
> Jessie?  

1) It's not on a Debian web site.  It's on someone else's web site.
   Imagine if I posted a link from www.microsoft.com that said
   "Debian is on the decline; switch to Windows 10".  Would you
   consider that an authoritative statement about Debian?

2) It says "The Raspbian operating system is based on Debian Linux,
   and the different versions of Debian are named after characters
   from the Toy Story films. Recent versions of Raspbian have
   been based on Debian Wheezy (the penguin who's lost his squeaker
   in Toy Story 2), but Raspbian has now been updated to the new
   stable version of Debian, which is called Jessie."

Note that it says "based on Debian".  It isn't Debian.  It's a derivative.

Attempting to use security packages from Debian on a derivative system
(which is *not* Debian) may not work properly.  To get the correct
security packages for your system, you need to talk to the Raspbian folks,
not the Debian folks.

[toc] | [prev] | [next] | [standalone]

#171626

On Wednesday 31 August 2016 16:16:45 Larry Dighera wrote:
> Have you even looked at the information here:
> <https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>?  After reading
> that announcement, how can you continue to insist that I am not running
> Debian Jessie?

That page (URL) confirms what most of us have suspected all along.  You are 
running Raspbian Jessie, not Debian Jessie.  It says:  
<quote>/blog/*****raspbian*****-jessie-is-here</quote>  (my stars)

Lisi

[toc] | [prev] | [next] | [standalone]

#171639

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Wed, 31 Aug 2016 08:16:45 -0700
Larry Dighera <LDighera@att.net> wrote:

>On Wed, 31 Aug 2016 13:28:21 +0000, "Andrew M.A. Cater"
><amacater@galactic.demon.co.uk> wrote:
>
>>On Wed, Aug 31, 2016 at 06:04:34AM -0700, Larry Dighera wrote:  
>>> On Tue, 30 Aug 2016 20:44:27 +0000, "Andrew M.A. Cater"
>>> <amacater@galactic.demon.co.uk> wrote:
>>>   
>>> >On Tue, Aug 30, 2016 at 12:58:47PM -0700, Larry Dighera wrote:  
>>> >> 
>>> >> This page <https://www.debian.org/releases/stable/errata> states:
>>> >> 
>>> >>     "If you use APT, add the following line to /etc/apt/sources.list to be able
>>> >>     to access the latest security updates:
>>> >> 
>>> >>     deb http://security.debian.org/ jessie/updates main contrib non-free
>>> >> 
>>> >>     After that, run apt-get update followed by apt-get upgrade."
>>> >> 
>>> >> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running Debian
>>> >> Jessie results in an error message indicating that the public key is not found.
>>> >> It also finds two libraries that require updating that are not found when the
>>> >> above mentioned /etc/apt/sources.list entry is removed.
>>> >> 
>>> >>   1.  What do I need to do to prevent the error message?
>>> >> 
>>> >>   2.  As there are other security related URLs (doubtless, as
>>> >>   distributed/released) that are checked during apt-get update, is the
>>> >>   recommended additional entry advisable/useful for this platform?  
>>> >
>>> >Debian or Raspbian?
>>> >
>>> >If Raspbian - that's based very closely on Debian but isn't strictly Debian.
>>> >
>>> >Mixing the two might not be a good idea since there will probably be incompatibilities at some level.
>>> >
>>> >There is a port of pure Debian to the Pi 2 - look on the Debian wiki - but no one has yet done this for the Pi 3 as far as I know.
>>> >
>>> >[The original Pi required different compilation options to cope with floating point "stuff" which rendered Debian incompatible:
>>> >Raspbian is a re-compilation to suit the Raspberry Pi. Pi 2 is ARM v7 with hardware floating point. Pi 3 is 64 bit core (so arm64 would work if
>>> >the Pi folk hadn't put in 32 bit glue logic or thereabouts). There are also issues with the way of loading the operating system, initialising video
>>> >and non-free firmware which can cause problems.]
>>> >
>>> >All the best,
>>> >
>>> >AndyC  
>>> 
>>> 
>>> 
>>> Hello Andy,
>>> 
>>> I thought I made it clear that the OS was Debian Jessie.  It was installed from
>>> the NOOBS release: <https://www.raspberrypi.org/downloads/noobs/>.  As you can
>>> see from this article
>>> <https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>, Debian Jessie was
>>> released for the Raspberry Pi platform almost a year ago, September 2015.  
>>> 
>>> Have you any insight into how to overcome the ;public key not found; error
>>> message adding that security repository to the apt list, as stated on the
>>> Debian.org web site, may be resolved?
>>> 
>>> Thank you for your response.
>>> 
>>> Best regards,
>>> Larry
>>>  
>>
>>Hi Larry, 
>>
>>That's Raspbian - NOOBS installs Raspbian.
>>
>>As Lisi Reisz has stated to you in another email: Raspbian handle their own security updates.
>>
>>If you want to add the keys to the Debian security updates repository you can use an apt-key add command and the key available from http://ftp-master.debian.org/keys.html
>>[The main archive signing key is also used to sign the security updates].
>>
>>Be aware that you might create problems for yourself.
>>
>>You may well want to look at the Debian Administrators handbook - you can try apt-get install debian-handbook if the package is also available for Raspbian.
>>
>>Hope this helps,
>>
>>Al the very best,
>>
>>AndyC 
>>
>>[Copying to the list as this may be of more use more widely]  
>
>
>Hello Andy,
>
>Have you even looked at the information here:
><https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>?  After reading
>that announcement, how can you continue to insist that I am not running Debian
>Jessie?  
>
>I appreciate your pointer to adding keys to the Debian security updates
>repository with apt-key add.  I will look into that, however if it were
>necessary for me to do that manually, I would have expected the
><https://www.debian.org/releases/stable/errata> page to have mentioned it
>explicitly.  Perhaps I expect too much...
>
>I find the stability of the Debian APT system to be one of the most valuable
>aspects of Debian Linux, compared to other less stable distributions I have
>encountered over the years.  So I am wary of doing anything to break it, even
>if it proffered on a Debian web page, as you cautioned.  
>
>Thank you for sharing your knowledge.
>
>Best regards,
>Larry
>

/etc/apt/sources.list for Debian Jessie for the raspberry pi:
deb http://mirrordirector.raspbian.org/raspbian/ stable main contrib
non-free rpi

/etc/apt/sources.list for Debian Jessie:
deb http://httpredir.debian.org/debian jessie main

One glance tells me that my two computers are not running exactly the
same debian jessie.



- -- 
Charlie Kravetz
Linux Registered User Number 425914
[http://linuxcounter.net/user/425914.html]
Never let anyone steal your DREAM.   [http://keepingdreams.com]
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJXxwf6AAoJEIqui46mydCA/O0H+gOpp1PrRhAMZC4Wq7aVstBX
/V5k5bOQBhXgD+iK81IVdX4JfvXWJz1+SKoq0wj1fI8MmqbqmW1pf2RibiSg8F3j
OviRd6+UQKcSnvZyUvt4nPMP5Jcah+tVpI4VSW3x7ePAG6x3BdA6CUtqXy+tBBHa
SAaKHK3MiSb5ABxRrzW2STZUcCgk9RFu11tM3N9GilBfWeiL2P1TbsNmNgPYoqDq
e5/TCTDhY+Wiy31iLg9a2/015/O7Ol4HD5NyK/wvGea/knkVHygCO9xcIqyxbgxh
B8vSzO8IYa33z+WU0cVIUDCf9QpEQ/2xBHaxGn3XK+nGsAArA/F0oWw2EzppMZ4=
=C4s/
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#171586

On Tuesday 30 August 2016 20:58:47 Larry Dighera wrote:
> This page <https://www.debian.org/releases/stable/errata> states:
>
>     "If you use APT, add the following line to /etc/apt/sources.list to be
> able to access the latest security updates:
>
>     deb http://security.debian.org/ jessie/updates main contrib non-free
>
>     After that, run apt-get update followed by apt-get upgrade."
>
> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running
> Debian Jessie results in an error message indicating that the public key is
> not found. It also finds two libraries that require updating that are not
> found when the above mentioned /etc/apt/sources.list entry is removed.
>
>   1.  What do I need to do to prevent the error message?
>
>   2.  As there are other security related URLs (doubtless, as
>   distributed/released) that are checked during apt-get update, is the
>   recommended additional entry advisable/useful for this platform?

What is the whole of your sources.list?

Lisi

[toc] | [prev] | [next] | [standalone]

#171602

Since you are not replying to anyhting, you may not be subscribed, so here is 
what I said again:

On Tuesday 30 August 2016 20:58:47 Larry Dighera wrote:
> This page <https://www.debian.org/releases/stable/errata> states:
>
>     "If you use APT, add the following line to /etc/apt/sources.list to be
> able to access the latest security updates:
>
>     deb http://security.debian.org/ jessie/updates main contrib non-free
>
>     After that, run apt-get update followed by apt-get upgrade."
>
> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running
> Debian Jessie results in an error message indicating that the public key is
> not found. It also finds two libraries that require updating that are not
> found when the above mentioned /etc/apt/sources.list entry is removed.
>
>   1.  What do I need to do to prevent the error message?
>
>   2.  As there are other security related URLs (doubtless, as
>   distributed/released) that are checked during apt-get update, is the
>   recommended additional entry advisable/useful for this platform?

What is the whole of your sources.list?

Lisi

Like other respondents I suspect that you are using Raspbian not Debian.  Your 
sources list will tell me/us, or guide us ot teh problem if it is not that.

[toc] | [prev] | [next] | [standalone]

#171607

On Wednesday 31 August 2016 10:39:53 Lisi Reisz wrote:
> Since you are not replying to anyhting, you may not be subscribed,

I had a reply off list that said that Larry is not replying to our questions 
because he considers them irrelevant to his original question.

Lisi

> so here 
> is what I said again:
>
> On Tuesday 30 August 2016 20:58:47 Larry Dighera wrote:
> > This page <https://www.debian.org/releases/stable/errata> states:
> >
> >     "If you use APT, add the following line to /etc/apt/sources.list to
> > be able to access the latest security updates:
> >
> >     deb http://security.debian.org/ jessie/updates main contrib non-free
> >
> >     After that, run apt-get update followed by apt-get upgrade."
> >
> > Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running
> > Debian Jessie results in an error message indicating that the public key
> > is not found. It also finds two libraries that require updating that are
> > not found when the above mentioned /etc/apt/sources.list entry is
> > removed.
> >
> >   1.  What do I need to do to prevent the error message?
> >
> >   2.  As there are other security related URLs (doubtless, as
> >   distributed/released) that are checked during apt-get update, is the
> >   recommended additional entry advisable/useful for this platform?
>
> What is the whole of your sources.list?
>
> Lisi
>
> Like other respondents I suspect that you are using Raspbian not Debian. 
> Your sources list will tell me/us, or guide us ot teh problem if it is not
> that.

[toc] | [prev] | [next] | [standalone]

#171618

[Multipart message — attachments visible in raw view] — view raw

On Wed, Aug 31, 2016 at 10:18 PM Lisi Reisz <lisi.reisz@gmail.com> wrote:

> On Wednesday 31 August 2016 10:39:53 Lisi Reisz wrote:
> > Since you are not replying to anyhting, you may not be subscribed,
>
> I had a reply off list that said that Larry is not replying to our
> questions
> because he considers them irrelevant to his original question.
>
> Lisi
>
>
Thus demonstrating the pitfalls of assuming one knows more / is a better
judge of relevance than the people one is seeking help from...!

Mark

[toc] | [prev] | [next] | [standalone]

#171628

On Wed, 31 Aug 2016 14:19:15 +0100, Lisi Reisz <lisi.reisz@gmail.com> wrote:

>On Wednesday 31 August 2016 10:39:53 Lisi Reisz wrote:
>> Since you are not replying to anyhting, you may not be subscribed,
>
>I had a reply off list that said that Larry is not replying to our questions 
>because he considers them irrelevant to his original question.
>
>Lisi


Of course, that is not what I said at all.  

Here is a copy of the message I sent to Lisi:

-------------------------------------------------------------------------
To: Lisi Reisz <lisi.reisz@gmail.com>
Subject: Re: Security Updates
From: Larry Dighera <LDighera@att.net>
Date: Wed, 31 Aug 2016 06:09:27 -0700

On Wed, 31 Aug 2016 10:39:53 +0100, Lisi Reisz <lisi.reisz@gmail.com> wrote:

>Since you are not replying to anyhting, you may not be subscribed, so here is 
>what I said again:
>
>On Tuesday 30 August 2016 20:58:47 Larry Dighera wrote:
>> This page <https://www.debian.org/releases/stable/errata> states:
>>
>>     "If you use APT, add the following line to /etc/apt/sources.list to be
>> able to access the latest security updates:
>>
>>     deb http://security.debian.org/ jessie/updates main contrib non-free
>>
>>     After that, run apt-get update followed by apt-get upgrade."
>>
>> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running
>> Debian Jessie results in an error message indicating that the public key is
>> not found. It also finds two libraries that require updating that are not
>> found when the above mentioned /etc/apt/sources.list entry is removed.
>>
>>   1.  What do I need to do to prevent the error message?
>>
>>   2.  As there are other security related URLs (doubtless, as
>>   distributed/released) that are checked during apt-get update, is the
>>   recommended additional entry advisable/useful for this platform?
>
>What is the whole of your sources.list?
>
>Lisi
>
>Like other respondents I suspect that you are using Raspbian not Debian.  Your 
>sources list will tell me/us, or guide us ot teh problem if it is not that.


I'm sorry.  I didn't find your question relevant to my question about the
Debian.org web site providing instructions that produce error messages, and
politely ignored it.  
---------------------------------------------------------------------------


For those who may be following this message thread, here is the output from
'apt-get update' with the offending 'deb-src
http://archive.raspbian.org/raspbian/ jessie main contrib non-free rpi
' entry edited into the /etc/apt/sources.list as instructed on this page:
<https://www.debian.org/releases/stable/errata>:

-----------------------------------------------------------------------------
Get:1 http://security.debian.org jessie/updates InRelease [63.1 kB]
Hit http://mirrordirector.raspbian.org jessie InRelease
Hit http://archive.raspberrypi.org jessie InRelease
Ign http://security.debian.org jessie/updates InRelease
Hit http://mirrordirector.raspbian.org jessie/main armhf Packages
Ign http://linux.teamviewer.com stable InRelease
Get:2 http://security.debian.org jessie/updates/main armhf Packages [292 kB]
Hit http://archive.raspberrypi.org jessie/main armhf Packages
Ign http://linux.teamviewer.com preview InRelease
Hit http://mirrordirector.raspbian.org jessie/contrib armhf Packages
Hit http://archive.raspberrypi.org jessie/ui armhf Packages
Hit http://mirrordirector.raspbian.org jessie/non-free armhf Packages
Get:3 http://security.debian.org jessie/updates/contrib armhf Packages [1,138
B]
Hit http://linux.teamviewer.com stable Release.gpg
Hit http://mirrordirector.raspbian.org jessie/rpi armhf Packages
Get:4 http://security.debian.org jessie/updates/non-free armhf Packages [14 B]
Get:5 http://security.debian.org jessie/updates/contrib Translation-en [1,211
B]
Hit http://linux.teamviewer.com stable Release
Hit http://linux.teamviewer.com preview Release.gpg
Get:6 http://security.debian.org jessie/updates/main Translation-en [161 kB]
Hit http://linux.teamviewer.com stable/main armhf Packages
Get:7 http://security.debian.org jessie/updates/non-free Translation-en [14 B]
Hit http://linux.teamviewer.com preview Release
Hit http://linux.teamviewer.com preview/main armhf Packages
Ign http://security.debian.org jessie/updates/contrib Translation-en_GB
Ign http://security.debian.org jessie/updates/main Translation-en_GB
Ign http://security.debian.org jessie/updates/non-free Translation-en_GB
Ign http://archive.raspberrypi.org jessie/main Translation-en_GB
Ign http://archive.raspberrypi.org jessie/main Translation-en
Ign http://archive.raspberrypi.org jessie/ui Translation-en_GB
Ign http://archive.raspberrypi.org jessie/ui Translation-en
Ign http://linux.teamviewer.com stable/main Translation-en_GB
Ign http://linux.teamviewer.com stable/main Translation-en
Ign http://linux.teamviewer.com preview/main Translation-en_GB
Ign http://linux.teamviewer.com preview/main Translation-en
Ign http://mirrordirector.raspbian.org jessie/contrib Translation-en_GB
Ign http://mirrordirector.raspbian.org jessie/contrib Translation-en
Ign http://mirrordirector.raspbian.org jessie/main Translation-en_GB
Ign http://mirrordirector.raspbian.org jessie/main Translation-en
Ign http://mirrordirector.raspbian.org jessie/non-free Translation-en_GB
Ign http://mirrordirector.raspbian.org jessie/non-free Translation-en
Ign http://mirrordirector.raspbian.org jessie/rpi Translation-en_GB
Ign http://mirrordirector.raspbian.org jessie/rpi Translation-en
Fetched 518 kB in 8s (60.0 kB/s)
Reading package lists...
W: GPG error: http://security.debian.org jessie/updates InRelease: The ollowing
signatures couldn't be verified because the public key is not available:
NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY 8B48AD6246925553
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be upgraded:
  libldap-2.4-2 linux-libc-dev
2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,201 kB of archives.
After this operation, 50.2 kB disk space will be freed.
--------------------------------------------------------------------------

[toc] | [prev] | [next] | [standalone]

#171610

[Multipart message — attachments visible in raw view] — view raw

On Tue, Aug 30, 2016 at 12:58:47PM -0700, Larry Dighera wrote:
>
>This page <https://www.debian.org/releases/stable/errata> states:
>
>    "If you use APT, add the following line to /etc/apt/sources.list to be able
>    to access the latest security updates:
>
>    deb http://security.debian.org/ jessie/updates main contrib non-free
>
>    After that, run apt-get update followed by apt-get upgrade."
>
>Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running Debian
>Jessie results in an error message indicating that the public key is not found.
>It also finds two libraries that require updating that are not found when the
>above mentioned /etc/apt/sources.list entry is removed.

As other people are discussing how to avoid the problems, let me have a 
go at answering your questions directly.

>
>  1.  What do I need to do to prevent the error message?

Check that "debian-archive-keyring" is installed. If that is showing as 
untrusted as well, then read https://ftp-master.debian.org/keys.html.  
Note the warning at the top, though: "Please note that the details here 
are for information only, you should not rely on them and use other ways 
to verify them."

>
>  2.  As there are other security related URLs (doubtless, as
>  distributed/released) that are checked during apt-get update, is the
>  recommended additional entry advisable/useful for this platform?

If you're running Debian, then that line should provide all the security 
updates you require. If you've added other repositories, though (PPAs, 
for example, or if you're using a debian-derived distribution such as 
Ubuntu, Mint, Devuan etc), then you should consult THOSE projects 
individually to see if they provide security updates (they may simply 
provide a rolling "bleeding edge" update model instead).

>

-- 
For more information, please reread.

[toc] | [prev] | [next] | [standalone]

#171640

Hello Paul,

Thank you for your kind response to my inquiry.

My comments in-line below:


On Wed, 31 Aug 2016 14:48:36 +0100, Darac Marjal <mailinglist@darac.org.uk>
wrote:

>On Tue, Aug 30, 2016 at 12:58:47PM -0700, Larry Dighera wrote:
>>
>>This page <https://www.debian.org/releases/stable/errata> states:
>>
>>    "If you use APT, add the following line to /etc/apt/sources.list to be able
>>    to access the latest security updates:
>>
>>    deb http://security.debian.org/ jessie/updates main contrib non-free
>>
>>    After that, run apt-get update followed by apt-get upgrade."
>>
>>Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running Debian
>>Jessie results in an error message indicating that the public key is not found.
>>It also finds two libraries that require updating that are not found when the
>>above mentioned /etc/apt/sources.list entry is removed.
>
>As other people are discussing how to avoid the problems, let me have a 
>go at answering your questions directly.
>
>>
>>  1.  What do I need to do to prevent the error message?
>
>Check that "debian-archive-keyring" is installed. 
>

    # apt-get -s install debian-archive-keyring
    Reading package lists... Done
    Building dependency tree
    Reading state information... Done
    Note, selecting 'raspbian-archive-keyring' instead of
    'debian-archive-keyring'
    raspbian-archive-keyring is already the newest version.
    0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Hmmm...  I didn't expect that.  Now I am confused.  I don't recall where I got
the notion that I was running Debian Jessie as opposed to Raspbian Jessie.  I
suppose it was from this link:
<https://www.raspberrypi.org/blog/raspbian-jessie-is-here/> where it is stated:

    "Raspbian has now been updated to the new stable version of Debian, which
    is called Jessie."

I guess I failed to make the distinction between Raspbian Jessie and Debian
Jessie.  Me culpa.

>
>If that is showing as untrusted as well, then read https://ftp-master.debian.org/keys.html.  
>Note the warning at the top, though: "Please note that the details here 
>are for information only, you should not rely on them and use other ways 
>to verify them."
>

I don't know if it's "showing as un-trusted," but I'm beginning to suspect my
confusion between Raspbian Jessie and Debian Jessie is the source of the issue
I experienced.  

Here is the output from os-release and uname:

     # cat ../usr/lib/os-release
    PRETTY_NAME="Raspbian GNU/Linux 8 (jessie)"
    NAME="Raspbian GNU/Linux"
    VERSION_ID="8"
    VERSION="8 (jessie)"
    ID=raspbian
    ID_LIKE=debian
    HOME_URL="http://www.raspbian.org/"
    SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
    BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"
    
    
     # uname -a
    Linux raspberrypi3 4.4.13-v7+ #894 SMP Mon Jun 13 13:13:27 BST 2016 armv7l
    GNU/Linux
    
I guess that puts a stake in the heart of this apparent non-issue. 

>
>>
>>  2.  As there are other security related URLs (doubtless, as
>>  distributed/released) that are checked during apt-get update, is the
>>  recommended additional entry advisable/useful for this platform?
>
>If you're running Debian, then that line should provide all the security 
>updates you require. If you've added other repositories, though (PPAs, 
>for example, or if you're using a debian-derived distribution such as 
>Ubuntu, Mint, Devuan etc), then you should consult THOSE projects 
>individually to see if they provide security updates (they may simply 
>provide a rolling "bleeding edge" update model instead).
>

Apparently Raspbian Jessie is "a debian-derived distribution," and not Debian
Jessie as I erroneously believed until your assistance enlightened me.

I'll have to presume the default Raspbian Jessie apt sources repositories
provide the intended security robustness, despite the possible security issues
in libldap-2.4-2 and linux-libc-dev packages that came to light when I ran
apt-get update with the "deb http://security.debian.org/ jessie/updates main
contrib non-free" entry in my /etc/apt/sources.list.

As you suggested, I'll take this discussion to raspbian.org, and see if they
can shed some light on the possible security issues in the libldap-2.4-2 and
linux-libc-dev packages.

I am grateful your thoughtful and sagacious support, and the education I
received as a result.  It's always good to grok truth.  :-)

Best regards,
Larry

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web