Subject: Security Updates

From: Larry Dighera <[email-masked]>
Date: Tue, 30 Aug 2016 12:58:47 -0700

This page <https://www.debian.org/releases/stable/errata> states:

    "If you use APT, add the following line to /etc/apt/sources.list to be able
    to access the latest security updates:

    deb http://security.debian.org/ jessie/updates main contrib non-free

    After that, run apt-get update followed by apt-get upgrade."

Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running Debian
Jessie results in an error message indicating that the public key is not found.
It also finds two libraries that require updating that are not found when the
above mentioned /etc/apt/sources.list entry is removed.

  1.  What do I need to do to prevent the error message?

  2.  As there are other security related URLs (doubtless, as
  distributed/released) that are checked during apt-get update, is the
  recommended additional entry advisable/useful for this platform?

---

From: Darac Marjal <[email-masked]>
Date: Wed, 31 Aug 2016 14:48:36 +0100

>above mentioned /etc/apt/sources.list entry is removed.

As other people are discussing how to avoid the problems, let me have a 
go at answering your questions directly.

>  1.  What do I need to do to prevent the error message?

Check that "debian-archive-keyring" is installed. If that is showing as 
untrusted as well, then read https://ftp-master.debian.org/keys.html.  
Note the warning at the top, though: "Please note that the details here 
are for information only, you should not rely on them and use other ways 
to verify them."

>  recommended additional entry advisable/useful for this platform?

If you're running Debian, then that line should provide all the security 
updates you require. If you've added other repositories, though (PPAs, 
for example, or if you're using a debian-derived distribution such as 
Ubuntu, Mint, Devuan etc), then you should consult THOSE projects 
individually to see if they provide security updates (they may simply 
provide a rolling "bleeding edge" update model instead).

-- 
For more information, please reread.

---

From: Larry Dighera <[email-masked]>
Date: Wed, 31 Aug 2016 10:37:11 -0700

Hello Paul,

Thank you for your kind response to my inquiry.

My comments in-line below:

On Wed, 31 Aug 2016 14:48:36 +0100, Darac Marjal <[email-masked]>
wrote:

>Check that "debian-archive-keyring" is installed. 
>

    # apt-get -s install debian-archive-keyring
    Reading package lists... Done
    Building dependency tree
    Reading state information... Done
    Note, selecting 'raspbian-archive-keyring' instead of
    'debian-archive-keyring'
    raspbian-archive-keyring is already the newest version.
    0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Hmmm...  I didn't expect that.  Now I am confused.  I don't recall where I got
the notion that I was running Debian Jessie as opposed to Raspbian Jessie.  I
suppose it was from this link:
<https://www.raspberrypi.org/blog/raspbian-jessie-is-here/> where it is stated:

    "Raspbian has now been updated to the new stable version of Debian, which
    is called Jessie."

I guess I failed to make the distinction between Raspbian Jessie and Debian
Jessie.  Me culpa.

>
>If that is showing as untrusted as well, then read https://ftp-master.debian.org/keys.html.  

I don't know if it's "showing as un-trusted," but I'm beginning to suspect my
confusion between Raspbian Jessie and Debian Jessie is the source of the issue
I experienced.  

Here is the output from os-release and uname:

     # cat ../usr/lib/os-release
    PRETTY_NAME="Raspbian GNU/Linux 8 (jessie)"
    NAME="Raspbian GNU/Linux"
    VERSION_ID="8"
    VERSION="8 (jessie)"
    ID=raspbian
    ID_LIKE=debian
    HOME_URL="http://www.raspbian.org/"
    SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
    BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"

     # uname -a
    Linux raspberrypi3 4.4.13-v7+ #894 SMP Mon Jun 13 13:13:27 BST 2016 armv7l
    GNU/Linux
    
I guess that puts a stake in the heart of this apparent non-issue. 

>provide a rolling "bleeding edge" update model instead).

Apparently Raspbian Jessie is "a debian-derived distribution," and not Debian
Jessie as I erroneously believed until your assistance enlightened me.

I'll have to presume the default Raspbian Jessie apt sources repositories
provide the intended security robustness, despite the possible security issues
in libldap-2.4-2 and linux-libc-dev packages that came to light when I ran
apt-get update with the "deb http://security.debian.org/ jessie/updates main
contrib non-free" entry in my /etc/apt/sources.list.

As you suggested, I'll take this discussion to raspbian.org, and see if they
can shed some light on the possible security issues in the libldap-2.4-2 and
linux-libc-dev packages.

I am grateful your thoughtful and sagacious support, and the education I
received as a result.  It's always good to grok truth.  :-)

Best regards,
Larry

---

From: Lisi Reisz <[email-masked]>
Date: Wed, 31 Aug 2016 10:39:53 +0100

Since you are not replying to anyhting, you may not be subscribed, so here is 
what I said again:

On Tuesday 30 August 2016 20:58:47 Larry Dighera wrote:
>     "If you use APT, add the following line to /etc/apt/sources.list to be
> able to access the latest security updates:
>
> Adding that entry to /etc/apt/sources.list on the Raspberry Pi3 running
> Debian Jessie results in an error message indicating that the public key is
> not found. It also finds two libraries that require updating that are not
> found when the above mentioned /etc/apt/sources.list entry is removed.
>

What is the whole of your sources.list?

Lisi

Like other respondents I suspect that you are using Raspbian not Debian.  Your 
sources list will tell me/us, or guide us ot teh problem if it is not that.

---

From: Lisi Reisz <[email-masked]>
Date: Wed, 31 Aug 2016 14:19:15 +0100

On Wednesday 31 August 2016 10:39:53 Lisi Reisz wrote:
> Since you are not replying to anyhting, you may not be subscribed,

I had a reply off list that said that Larry is not replying to our questions 
because he considers them irrelevant to his original question.

Lisi

> so here 
> is what I said again:
> >     "If you use APT, add the following line to /etc/apt/sources.list to
> > be able to access the latest security updates:
> >
> > Debian Jessie results in an error message indicating that the public key
> > is not found. It also finds two libraries that require updating that are
> > not found when the above mentioned /etc/apt/sources.list entry is
> > removed.
> >
> Like other respondents I suspect that you are using Raspbian not Debian. 
> Your sources list will tell me/us, or guide us ot teh problem if it is not
> that.

---

From: Larry Dighera <[email-masked]>
Date: Wed, 31 Aug 2016 08:38:12 -0700

>because he considers them irrelevant to his original question.

Of course, that is not what I said at all.  

Here is a copy of the message I sent to Lisi:

-------------------------------------------------------------------------
To: Lisi Reisz <[email-masked]>
Subject: Re: Security Updates
From: Larry Dighera <[email-masked]>
Date: Wed, 31 Aug 2016 06:09:27 -0700

>sources list will tell me/us, or guide us ot teh problem if it is not that.

I'm sorry.  I didn't find your question relevant to my question about the
Debian.org web site providing instructions that produce error messages, and
politely ignored it.  
---------------------------------------------------------------------------

For those who may be following this message thread, here is the output from
'apt-get update' with the offending 'deb-src
http://archive.raspbian.org/raspbian/ jessie main contrib non-free rpi
' entry edited into the /etc/apt/sources.list as instructed on this page:
<https://www.debian.org/releases/stable/errata>:

-----------------------------------------------------------------------------
Get:1 http://security.debian.org jessie/updates InRelease [63.1 kB]
Hit http://mirrordirector.raspbian.org jessie InRelease
Hit http://archive.raspberrypi.org jessie InRelease
Ign http://security.debian.org jessie/updates InRelease
Hit http://mirrordirector.raspbian.org jessie/main armhf Packages
Ign http://linux.teamviewer.com stable InRelease
Get:2 http://security.debian.org jessie/updates/main armhf Packages [292 kB]
Hit http://archive.raspberrypi.org jessie/main armhf Packages
Ign http://linux.teamviewer.com preview InRelease
Hit http://mirrordirector.raspbian.org jessie/contrib armhf Packages
Hit http://archive.raspberrypi.org jessie/ui armhf Packages
Hit http://mirrordirector.raspbian.org jessie/non-free armhf Packages
Get:3 http://security.debian.org jessie/updates/contrib armhf Packages [1,138
B]
Hit http://linux.teamviewer.com stable Release.gpg
Hit http://mirrordirector.raspbian.org jessie/rpi armhf Packages
Get:4 http://security.debian.org jessie/updates/non-free armhf Packages [14 B]
Get:5 http://security.debian.org jessie/updates/contrib Translation-en [1,211
B]
Hit http://linux.teamviewer.com stable Release
Hit http://linux.teamviewer.com preview Release.gpg
Get:6 http://security.debian.org jessie/updates/main Translation-en [161 kB]
Hit http://linux.teamviewer.com stable/main armhf Packages
Get:7 http://security.debian.org jessie/updates/non-free Translation-en [14 B]
Hit http://linux.teamviewer.com preview Release
Hit http://linux.teamviewer.com preview/main armhf Packages
Ign http://security.debian.org jessie/updates/contrib Translation-en_GB
Ign http://security.debian.org jessie/updates/main Translation-en_GB
Ign http://security.debian.org jessie/updates/non-free Translation-en_GB
Ign http://archive.raspberrypi.org jessie/main Translation-en_GB
Ign http://archive.raspberrypi.org jessie/main Translation-en
Ign http://archive.raspberrypi.org jessie/ui Translation-en_GB
Ign http://archive.raspberrypi.org jessie/ui Translation-en
Ign http://linux.teamviewer.com stable/main Translation-en_GB
Ign http://linux.teamviewer.com stable/main Translation-en
Ign http://linux.teamviewer.com preview/main Translation-en_GB
Ign http://linux.teamviewer.com preview/main Translation-en
Ign http://mirrordirector.raspbian.org jessie/contrib Translation-en_GB
Ign http://mirrordirector.raspbian.org jessie/contrib Translation-en
Ign http://mirrordirector.raspbian.org jessie/main Translation-en_GB
Ign http://mirrordirector.raspbian.org jessie/main Translation-en
Ign http://mirrordirector.raspbian.org jessie/non-free Translation-en_GB
Ign http://mirrordirector.raspbian.org jessie/non-free Translation-en
Ign http://mirrordirector.raspbian.org jessie/rpi Translation-en_GB
Ign http://mirrordirector.raspbian.org jessie/rpi Translation-en
Fetched 518 kB in 8s (60.0 kB/s)
Reading package lists...
W: GPG error: http://security.debian.org jessie/updates InRelease: The ollowing
signatures couldn't be verified because the public key is not available:
NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY 8B48AD6246925553
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be upgraded:
  libldap-2.4-2 linux-libc-dev
2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,201 kB of archives.
After this operation, 50.2 kB disk space will be freed.
--------------------------------------------------------------------------

---

From: Mark Fletcher <[email-masked]>
Date: Wed, 31 Aug 2016 14:34:50 +0000

> because he considers them irrelevant to his original question.
Thus demonstrating the pitfalls of assuming one knows more / is a better
judge of relevance than the people one is seeking help from...!

Mark

---

From: Lisi Reisz <[email-masked]>
Date: Tue, 30 Aug 2016 22:13:49 +0100

Lisi

---

From: "Andrew M.A. Cater" <[email-masked]>
Date: Tue, 30 Aug 2016 20:44:27 +0000

>   recommended additional entry advisable/useful for this platform?

Debian or Raspbian?

If Raspbian - that's based very closely on Debian but isn't strictly Debian.

Mixing the two might not be a good idea since there will probably be incompatibilities at some level.

There is a port of pure Debian to the Pi 2 - look on the Debian wiki - but no one has yet done this for the Pi 3 as far as I know.

[The original Pi required different compilation options to cope with floating point "stuff" which rendered Debian incompatible:
Raspbian is a re-compilation to suit the Raspberry Pi. Pi 2 is ARM v7 with hardware floating point. Pi 3 is 64 bit core (so arm64 would work if
the Pi folk hadn't put in 32 bit glue logic or thereabouts). There are also issues with the way of loading the operating system, initialising video
and non-free firmware which can cause problems.]

All the best,

AndyC

---

From: "Andrew M.A. Cater" <[email-masked]>
Date: Wed, 31 Aug 2016 13:28:21 +0000

On Wed, Aug 31, 2016 at 06:04:34AM -0700, Larry Dighera wrote:
> On Tue, 30 Aug 2016 20:44:27 +0000, "Andrew M.A. Cater"
> <[email-masked]> wrote:
> 
> Hello Andy,
> I thought I made it clear that the OS was Debian Jessie.  It was installed from
> the NOOBS release: <https://www.raspberrypi.org/downloads/noobs/>.  As you can
> see from this article
> <https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>, Debian Jessie was
> released for the Raspberry Pi platform almost a year ago, September 2015.  
> 
> Have you any insight into how to overcome the ;public key not found; error
> message adding that security repository to the apt list, as stated on the
> Debian.org web site, may be resolved?
> 
> Thank you for your response.
> 
> Best regards,
> Larry
>

Hi Larry, 

That's Raspbian - NOOBS installs Raspbian.

As Lisi Reisz has stated to you in another email: Raspbian handle their own security updates.

If you want to add the keys to the Debian security updates repository you can use an apt-key add command and the key available from http://ftp-master.debian.org/keys.html
[The main archive signing key is also used to sign the security updates].

Be aware that you might create problems for yourself.

You may well want to look at the Debian Administrators handbook - you can try apt-get install debian-handbook if the package is also available for Raspbian.

Hope this helps,

Al the very best,

AndyC 

[Copying to the list as this may be of more use more widely]

---

From: Larry Dighera <[email-masked]>
Date: Wed, 31 Aug 2016 08:16:45 -0700

Hello Andy,

Have you even looked at the information here:
<https://www.raspberrypi.org/blog/raspbian-jessie-is-here/>?  After reading
that announcement, how can you continue to insist that I am not running Debian
Jessie?  

I appreciate your pointer to adding keys to the Debian security updates
repository with apt-key add.  I will look into that, however if it were
necessary for me to do that manually, I would have expected the
<https://www.debian.org/releases/stable/errata> page to have mentioned it
explicitly.  Perhaps I expect too much...

I find the stability of the Debian APT system to be one of the most valuable
aspects of Debian Linux, compared to other less stable distributions I have
encountered over the years.  So I am wary of doing anything to break it, even
if it proffered on a Debian web page, as you cautioned.  

Thank you for sharing your knowledge.

Best regards,
Larry

---

From: Charlie Kravetz <[email-masked]>
Date: Wed, 31 Aug 2016 09:38:18 -0700

On Wed, 31 Aug 2016 08:16:45 -0700

>Thank you for sharing your knowledge.

/etc/apt/sources.list for Debian Jessie for the raspberry pi:
deb http://mirrordirector.raspbian.org/raspbian/ stable main contrib
non-free rpi

/etc/apt/sources.list for Debian Jessie:
deb http://httpredir.debian.org/debian jessie main

One glance tells me that my two computers are not running exactly the
same debian jessie.

- -- 
Charlie Kravetz
Linux Registered User Number 425914
[http://linuxcounter.net/user/425914.html]
Never let anyone steal your DREAM.   [http://keepingdreams.com]

---

From: Lisi Reisz <[email-masked]>
Date: Wed, 31 Aug 2016 16:34:41 +0100

On Wednesday 31 August 2016 16:16:45 Larry Dighera wrote:
> that announcement, how can you continue to insist that I am not running
> Debian Jessie?

That page (URL) confirms what most of us have suspected all along.  You are 
running Raspbian Jessie, not Debian Jessie.  It says:  
<quote>/blog/*****raspbian*****-jessie-is-here</quote>  (my stars)

Lisi

---

From: Greg Wooledge <[email-masked]>
Date: Wed, 31 Aug 2016 11:29:35 -0400

> that announcement, how can you continue to insist that I am not running Debian

1) It's not on a Debian web site.  It's on someone else's web site.
   Imagine if I posted a link from www.microsoft.com that said
   "Debian is on the decline; switch to Windows 10".  Would you
   consider that an authoritative statement about Debian?

2) It says "The Raspbian operating system is based on Debian Linux,
   and the different versions of Debian are named after characters
   from the Toy Story films. Recent versions of Raspbian have
   been based on Debian Wheezy (the penguin who's lost his squeaker
   in Toy Story 2), but Raspbian has now been updated to the new
   stable version of Debian, which is called Jessie."

Note that it says "based on Debian".  It isn't Debian.  It's a derivative.

Attempting to use security packages from Debian on a derivative system
(which is *not* Debian) may not work properly.  To get the correct
security packages for your system, you need to talk to the Raspbian folks,
not the Debian folks.

---

From: Tim McDonough <[email-masked]>
Date: Tue, 30 Aug 2016 15:24:12 -0500

Your Raspberry Pi is most likely running Raspbian and not Debian.
Raspbian's updates must be ported by their development team when Debian
releases them. At one time they claimed the lag was about a half day to a
day behind being released by Debian.

Tim

On Tue, Aug 30, 2016 at 2:58 PM, Larry Dighera <[email-masked]> wrote:

> Debian

---

From: Cindy-Sue Causey <[email-masked]>
Date: Tue, 30 Aug 2016 16:52:42 -0400

On 8/30/16, Tim McDonough <[email-masked]> wrote:
>> be

Don't know if it applies here, but the mention of "Raspbian" triggered
the thought that Raspbian gets a few mentions over at the Debian-ARM
list:

https://lists.debian.org/debian-arm/

I accidentally joined their list quite a while back while mistaking it
for AMD64 (was a cognitive mixup thing). They're interesting over
there and figure I might play with something like that some day so I'm
still lurking in the background. :)

Just thinking out loud.

Cindy :)

-- 
Cindy-Sue Causey
Talking Rock, Pickens County, Georgia, USA

* runs with duct tape *