PKCS#7 signature not signed with a trusted key

Default User

unread,

Mar 14, 2019, 12:30:05 PM3/14/19

to

Hello . . .

I am running Debian Unstable, x86, up to date.

Last night, I did an update as usual. Several packages were updated, including updating the kernel from linux-image-4.19.0-3-amd64 to linux-image-4.19.0-4-amd64.

Then I rebooted. During the reboot process this message appeared, line after line, on the monitor:

PKCS#7 signature not signed with a trusted key

Otherwise the boot process completed as usual. I then did sudo dmesg. Among the usual entries, the same message was displayed (in red letters!) at least 100 times.

So I then rebooted again, this time into linux-image-4.19.0-3-amd64, and reinstalled linux-image-4.19.0-4-amd64:

sudo apt remove --purge linux-image-4.19.0-4-amd64

sudo aptitude install linux-image-4.19.0-4-amd64

and rebooted. No difference.

Notes:

I have not added or removed any hardware.

When I boot into linux-image-4.19.0-3-amd64, I do NOT get this message.

doofus@doofus:~$ dpkg -l | grep linux-image | awk '{print$2}'

linux-image-4.19.0-2-amd64

linux-image-4.19.0-3-amd64

linux-image-4.19.0-4-amd64

sudo apt-key list seems to show the same entries as before (but I'm not sure if I should post the contents on a public mail list).

sudo apt-key update seems to be deprecated.

I did some research, but did not find anything really helpful. And when dealing with the kernel and with (possible) key signing issues, I don't want to make things worse by just experimenting at random.

Has anyone else seen this?

What other information might be helpful?

Sven Joachim

unread,

Mar 14, 2019, 1:40:06 PM3/14/19

to

On 2019-03-14 12:24 -0400, Default User wrote:

> Hello . . .
>
> I am running Debian Unstable, x86, up to date.
>
> Last night, I did an update as usual. Several packages were updated,
> including updating the kernel from linux-image-4.19.0-3-amd64
> to linux-image-4.19.0-4-amd64.
>
> Then I rebooted. During the reboot process this message appeared, line
> after line, on the monitor:
>
> PKCS#7 signature not signed with a trusted key
>
> Otherwise the boot process completed as usual. I then did sudo dmesg.
> Among the usual entries, the same message was displayed (in red letters!)
> at least 100 times.

Huh, indeed. I would have suggested to file a bug report, but there is
one already: https://bugs.debian.org/924574.

Cheers,
Sven

Default User

unread,

Mar 14, 2019, 2:10:04 PM3/14/19

to

Sven, thanks for the pointer.

I thought I checked for bug reports last night (it was late, I was tired), and nothing from apt-listbugs.

I was busy today, so didn't check until I just saw your reply.

I'm relieved that it wasn't "just me".

Miguel A. Vallejo

unread,

Mar 18, 2019, 9:00:04 AM3/18/19

to

Yesterday the kernel was upgraded to 4.19.0-4 (4.19.28-2) and the
problem disappeared.

Default User

unread,

Mar 18, 2019, 11:00:04 AM3/18/19

to

On Mon, Mar 18, 2019 at 8:52 AM Miguel A. Vallejo <ea4...@gmail.com> wrote:

Yesterday the kernel was upgraded to 4.19.0-4 (4.19.28-2) and the
problem disappeared.

Miguel, thanks for the heads-up! Kernel 4.19.0-4 (4.19.28-2) does seem to work okay.

However, I must note that if I hadn't seen the post from Miguel I would not have known that the new kernel version was there. I was actually thinking it would be 4.19.0-5 (4.19.28-2), or even 5.0.2-1.

Updating as normal didn't let me know:

doofus@doofus:~$ sudo aptitude -Pvvv update

Hit http://ftp.us.debian.org/debian unstable InRelease

Current status: 0 (+0) broken, 0 (+0) upgradable, 58940 (+0) new.

(Perhaps because I did:

sudo aptitude purge linux-image-4.19.0-4-amd64

as soon as I saw the original problem?)

As of now, I still get:

doofus@doofus:~$ sudo aptitude search linux-image

i A linux-image-4.19.0-2-amd64 - Linux 4.19 for 64-bit PCs (signed)

i A linux-image-4.19.0-3-amd64 - Linux 4.19 for 64-bit PCs (signed)

i linux-image-4.19.0-4-amd64 - Linux 4.19 for 64-bit PCs (signed)

p linux-image-4.19.0-4-amd64-dbg - Debug symbols for linux-image-4.19.0-4-amd64

p linux-image-4.19.0-4-amd64-unsigned - Linux 4.19 for 64-bit PCs

p linux-image-4.19.0-4-cloud-amd64 - Linux 4.19 for x86-64 cloud (signed)

p linux-image-4.19.0-4-cloud-amd64-dbg - Debug symbols for linux-image-4.19.0-4-cloud-amd64

p linux-image-4.19.0-4-cloud-amd64-unsigned - Linux 4.19 for x86-64 cloud

p linux-image-4.19.0-4-rt-amd64 - Linux 4.19 for 64-bit PCs, PREEMPT_RT (signed)

p linux-image-4.19.0-4-rt-amd64-dbg - Debug symbols for linux-image-4.19.0-4-rt-amd64

p linux-image-4.19.0-4-rt-amd64-unsigned - Linux 4.19 for 64-bit PCs, PREEMPT_RT

p linux-image-amd64 - Linux for 64-bit PCs (meta-package)

p linux-image-amd64-dbg - Debugging symbols for Linux amd64 configuration (meta-

p linux-image-amd64-signed-template - Template for signed linux-image packages for amd64

p linux-image-cloud-amd64 - Linux for x86-64 cloud (meta-package)

p linux-image-cloud-amd64-dbg - Debugging symbols for Linux cloud-amd64 configuration

p linux-image-rt-amd64 - Linux for 64-bit PCs (meta-package), PREEMPT_RT

p linux-image-rt-amd64-dbg - Debugging symbols for Linux rt-amd64 configuration (me

And:

doofus@doofus:~$ sudo aptitude search linux-image-4.19.0-4-amd64

i linux-image-4.19.0-4-amd64 - Linux 4.19 for 64-bit PCs (signed)

p linux-image-4.19.0-4-amd64-dbg - Debug symbols for linux-image-4.19.0-4-amd64

p linux-image-4.19.0-4-amd64-unsigned - Linux 4.19 for 64-bit PCs

It might have been better to name the new version 4.19.0-5?

But, checking further, synaptic did show 4.19.28-2 (upstream version number?) if you look closely. And The Debian packages page shows the new version also.

So, I think it would really be nice if the apt system would be more helpful in situations like this.

End of complaint.