Error Updating from such repository cannot be done securly

Question

I'm trying to do sudo apt update, but I'm getting this error

Reading package lists... Done
E: The repository 'http://ppa.launchpad.net/elementary-os/stable/ubuntu xenial Release' does not have a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details. E: The repository 'http://ppa.launchpad.net/elementary-os/os-patches/ubuntu xenial Release' does not have a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details.

Is there anything wrong? I followed this instruction to install dotnet sdk but after trying to install the package failed with the error message Cannot find the package I deleted the source file of DotNet and then I get another error message after doing sudo apt update but solved it after following this instruction and dowing sudo rm /var/lib/apt/lists/* -vf
Now, I'm stuck with this error. My /etc/apt/sources.list.d/ folder contains only the following files:

• appcenter.list
• elementary.list
• patches.list

My Sources.list is:

# deb cdrom:[elementary OS 0.4.1 _Loki_ - Stable amd64 (20170814)]/ xenial contrib main non-free

# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://us.archive.ubuntu.com/ubuntu/ xenial main restricted
# deb-src http://sy.archive.ubuntu.com/ubuntu/ xenial main restricted

## Major bug fix updates produced after the final release of the
## distribution.
deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main restricted
# deb-src http://sy.archive.ubuntu.com/ubuntu/ xenial-updates main restricted

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ xenial universe
# deb-src http://sy.archive.ubuntu.com/ubuntu/ xenial universe
deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates universe
# deb-src http://sy.archive.ubuntu.com/ubuntu/ xenial-updates universe

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu 
## team, and may not be under a free licence. Please satisfy yourself as to 
## your rights to use the software. Also, please note that software in 
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://us.archive.ubuntu.com/ubuntu/ xenial multiverse
# deb-src http://sy.archive.ubuntu.com/ubuntu/ xenial multiverse
deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates multiverse
# deb-src http://sy.archive.ubuntu.com/ubuntu/ xenial-updates multiverse

## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
deb http://us.archive.ubuntu.com/ubuntu/ xenial-backports main restricted universe multiverse
# deb-src http://sy.archive.ubuntu.com/ubuntu/ xenial-backports main restricted universe multiverse

## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
# deb http://archive.canonical.com/ubuntu xenial partner
# deb-src http://archive.canonical.com/ubuntu xenial partner

deb http://security.ubuntu.com/ubuntu xenial-security main restricted
# deb-src http://security.ubuntu.com/ubuntu xenial-security main restricted
deb http://security.ubuntu.com/ubuntu xenial-security universe
# deb-src http://security.ubuntu.com/ubuntu xenial-security universe
deb http://security.ubuntu.com/ubuntu xenial-security multiverse
# deb-src http://security.ubuntu.com/ubuntu xenial-security multiverse

Answer 1

I have solved this problem after doing:

sudo rm /var/lib/apt/lists/lock

I genuinely have no idea why! I'm going to install Arch instead of keep using Elementary OS

Answer 2

For posterity, the answer to the original question is provided below.

While for the OP, it might be worth pointing out that the error message correlates with a lack of (or of updated) security certificates on your system when referencing "release files". The links provided, however, were regarding issues with using apt-get or apt when updating that were due to access errors.

If you feel overcoming this issue was challenging, you'll certainly be frustrated if opting to move over to Arch instead, Just as a heads up, Arch is more of a customizable, minimalistic OS to the point where users are practically creating their own custom version of it when building/creating/installing, sometimes requiring a deeper understanding of kernels, system/kernel modules, etc. and is not as simple and straightforward as maybe Elementary is for the average user. But, I digress.

Three Methods of Resolving the "Updating from repository can't be done securely" Issue

For those coming across this and/or have a similar issue, there are a few ways to resolve this:

1. The Straightforward, Easiest, Most Secure, and Probably Recommended Method

apt sees the repository as being insecure because of it's lack of awareness of the repository's certificates or the certificates or outdated and unusable. Replacing or updating those certificates will prevent this error from displaying.

The simplest way to do that is to install ca-certificates

sudo apt install ca-certificates

# Or, if it is already installed, you may want tot try updating it with
sudo apt install --only-upgrade ca-certificates
# Or
sudo apt install --reinstall ca-certificates

After updating the certificates on your system, apt should be able to recognize them as being secure.

However, if you can't run apt install properly because of the error and therefore the package cannot be found for some reason, you can try one of the other 2 methods temporarily to allow briefly the usage of apt and then install ca-certificates as mentioned above, before undoing the changes that were made.

2. The Quick Fix, Less Secure, But Gets You Up-and-Running Method

You can force apt to overlook the fact that it can't review/confirm the repository certificates by modifying your source.list to include [trusted=yes] for each repository listed that mention this error.

Depending on which list contains the repository, you'll need to open and edit one of the listed files using your preferred text editor. Either:

• /etc/apt/sources.list (most common) or,
• /etc/apt/sources.list.d/elementary.list (as applies to the OP specifically) or,
• /etc/apt/sources.list.d/patches.list (usually if manually added and the file was named this way)

In case of confusion, the latter two options only apply if the entries mentioned below were not appended directly to your sources.list file. And, as an example For the ones mentioned above in the OP, it will look something like this after modifying the lines containing the repository source URL:

# Entry might be found in elementary.list
deb-src [trusted=yes] http://ppa.launchpad.net/elementary-os/stable/ubuntu xenial main

# Entry might be found in patches.list
deb-src [trusted=yes] http://ppa.launchpad.net/elementary-os/os-patches/ubuntu  xenial main

This will allow you to avoid the issue altogether but is essentially telling apt not to bother checking the certificates and no updates are made to /etc/ssl/certs/ca-certificates.crt which can pose as a security threat. However, this method is the quickest way to get you up in running if you have issues using method #1.

3. The Power Overwhelming, Not Recommended, For Special Uses Cases Method

This last and final method is the least secure and completely disables apt's OCSP verification and is not for the standard use-case of a home user.

Modify the configuration for apt to disable verification:

# Using a text editor
sudo nano /etc/apt/apt.conf.d/99verify-peer.conf

# Change the following line from 'true' to 'false' in the conf file
# or add the line if it is not there
Acquire { https::Verify-Peer false }

# this can also be done using a simple `touch` & 'echo' 
touch /etc/apt/apt.conf.d/99verify-peer.conf && \
echo >>/etc/apt/apt.conf.d/99verify-peer.conf "Acquire { https::Verify-Peer false }"

# or similarly with a 'cat' piped to 'tee -a' command
cat "Acquire { https::Verify-Peer false }" | tee -a /etc/apt/apt.conf.d/99verify-peer.conf

This might be applicable to very specific situations such as using a VM behind a proxy that results in certificate verification issues even though they've been updated and otherwise opens the repository list up completely. Noting that, Method #2 can be specified to repositories you recognize the URL for rather than skipping any sort of check at all.

This, like Method #2, may be used as a temporary solution to run update and update ca-certificate with the implied understanding that you've verified all the repositories in your repository list are all trusted sources as running apt update under this method will allow file updates from every repository that's been added to the system and may result in conflicting packages or displaying incompatible software. Use with discretion is advised.

Extra Fixes & Other Considerations

Though the above 3 methods cover most situations, there are some rather rare and unique cases that might be resolved by one of the following, but is either not generally recommended, or generally doesn't apply to most common reasons for the errors appearing but may be worth mentioning in case they might help. Try also:

• Ensuring the date and time are set correctly (time mismatch sometimes results in false positives
• replacing the 'https://' with 'http://' for the specified repository URL listed in your sources.list
• clearing the cache with sudo apt clean then running update
• Check AppCenter for any pending updates and allow them to update first (For non-Elementary OS users, this would apply to Software Update, for example)
• Check your network connection if running a VM, it may have TLS/SSL connection issues when running as a bridged connection rather than NAT
• Check file permissions for the certificates file/directories/sub-directories i.e. /etc/ssl, /etc/ssl/certs, and /etc/ssl/certs/ca-certificates.crt ensuring they're set to something like 0755

Technical Resources

• apt man page
• apt-transport man page
• source.list man page
• apt.conf man page
• apt_auth.conf man page