Error cdrom entry in /etc/apt/sources.list when installing .deb package on live system

[od4knb]

Problem

When booting from [linuxmint-22.3-cinnamon-64bit.iso], using a Ventoy 1.1.12 boot loader, I try to install the current Mozilla Firefox browser (150.0~build1 on 2026-04-28) using the following command sequence:

sudo install -d -m 0755 /etc/apt/keyrings && \
wget -q https://packages.mozilla.org/apt/repo-signing-key.gpg -O- | sudo tee /etc/apt/keyrings/packages.mozilla.org.asc > /dev/null && \
echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" | sudo tee /etc/apt/sources.list.d/mozilla.list > /dev/null && \
echo -e "Package: *\nPin: origin packages.mozilla.org\nPin-Priority: 1000\n" | sudo tee /etc/apt/preferences.d/mozilla && \
sudo apt-get update && sudo apt-get install -y firefox

the following error messages are shown:

E: The repository 'cdrom://Linux Mint 22.3 _Zena_ - Release amd64 20260108 noble Release' does not have a Release file.
E: The repository 'https://packages.mozilla.org/apt mozilla InRelease' is not signed.

[FAILED] Result: Firefox is not updated.

🛈 This problem only occurs, when booting [linuxmint-22.3-cinnamon-64bit.iso] as a live system (using a Ventoy boot loader e.g.). When you boot an installed Linux Mint Cinnamon 22.3 OS, it works flawlessly.

Important notice

This is a known issue, which @clefebvre has indicated as a "papercut bug".

Please note, that people with certain professions, always boot from an .iso file, not from an installed OS, to minimize the chances of infecting the system. For example: a forensic investigator, that has to investigate unsafe websites. Also people living in "unfree" countries, (should) boot from an .iso file, to prevent leaving traces.

Because of this, I think it's important that this problem will be solved.
I think, the community would be very thankful to @clefebvre, if he would solve this problem.

Investigation

Boot from [linuxmint-22.3-cinnamon-64bit.iso], using a Ventoy 1.1.12 boot loader (live system)

• issue command:

sudo install -d -m 0755 /etc/apt/keyrings && \
wget -q https://packages.mozilla.org/apt/repo-signing-key.gpg -O- | sudo tee /etc/apt/keyrings/packages.mozilla.org.asc > /dev/null && \
echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" | sudo tee /etc/apt/sources.list.d/mozilla.list > /dev/null && \
echo -e "Package: *\nPin: origin packages.mozilla.org\nPin-Priority: 1000\n" | sudo tee /etc/apt/preferences.d/mozilla && \
sudo apt-get update && sudo apt-get install -y firefox

• relevant output:

E: The repository 'cdrom://Linux Mint 22.3 _Zena_ - Release amd64 20260108 noble Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
N: Skipping acquire of configured file 'main/binary-i386/Packages' as repository 'https://dl.google.com/linux/chrome-stable/deb stable InRelease' doesn't support architecture 'i386'
W: GPG error: https://packages.mozilla.org/apt mozilla InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C0BA5CE6DC6315A3
E: The repository 'https://packages.mozilla.org/apt mozilla InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

• remark: "E:" = Error, "N:" = Notification, "W:" = Warning
• [FAILED] result: Firefox is not updated

Boot a Linux Mint 22.3 Cinnamon amd64 installation, installed on HDD

• note: the Linux Mint installer has editted the "/etc/apt/sources.list" file, it now contains:

#deb cdrom:[Linux Mint 22.3 _Zena_ - Release amd64 20260108]/ noble contrib main

# This system was installed using small removable media
# (e.g. netinst, live or single CD). The matching "deb cdrom"
# entries were disabled at the end of the installation process.
# For information about how to configure apt package sources,
# see the sources.list(5) manual.

• issue the following command sequence:

sudo install -d -m 0755 /etc/apt/keyrings && \
wget -q https://packages.mozilla.org/apt/repo-signing-key.gpg -O- | sudo tee /etc/apt/keyrings/packages.mozilla.org.asc > /dev/null && \
echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" | sudo tee /etc/apt/sources.list.d/mozilla.list > /dev/null && \
echo -e "Package: *\nPin: origin packages.mozilla.org\nPin-Priority: 1000\n" | sudo tee /etc/apt/preferences.d/mozilla && \
sudo apt-get update && sudo apt-get install -y firefox

• [SUCCESS] result: Firefox is updated correctly

Boot Ubuntu Cinnamon 25.10 amd64 from .iso file (live system)

• remark: this is in no way a commercial for Ubuntu Cinnamon, as it has several issues. It doesn't provide auto-mount for USB flash drives, for example. It's just a comparison.
• check: the "/etc/apt/sources.list" file contains:

# Ubuntu sources have moved to the /etc/apt/sources.list.d/ubuntu.sources
# file, which uses the deb822 format. Use deb822-formatted .sources files
# to manage package sources in the /etc/apt/sources.list.d/ directory.
# See the sources.list(5) manual page for details.

• remark: there's no "cdrom:" entry present
• check: the "/etc/apt/sources.list.d/ubuntu.sources" file contains:

<comments removed>
Types: deb
URIs: http://archive.ubuntu.com/ubuntu/
Suites: resolute resolute-updates resolute-backports
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

<comments removed>
Types: deb
URIs: http://security.ubuntu.com/ubuntu/
Suites: resolute-security
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

• check: the "/etc/apt/sources.list.d/cdrom.sources" file contains:

Types: deb
URIs: file:///cdrom
Suites: resolute
Components: restricted main universe
Check-Date: no
Signed-By:
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 <PGP key removed>
 -----END PGP PUBLIC KEY BLOCK-----

• issue command sequence:

sudo install -d -m 0755 /etc/apt/keyrings && \
wget -q https://packages.mozilla.org/apt/repo-signing-key.gpg -O- | sudo tee /etc/apt/keyrings/packages.mozilla.org.asc > /dev/null && \
echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" | sudo tee /etc/apt/sources.list.d/mozilla.list > /dev/null && \
echo -e "Package: *\nPin: origin packages.mozilla.org\nPin-Priority: 1000\n" | sudo tee /etc/apt/preferences.d/mozilla && \
sudo apt-get update && sudo apt-get install -y firefox

• output:

N: Some sources can be modernized. Run 'apt modernize-sources' to do so.
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Solving dependencies... Done
The following packages will be DOWNGRADED:
  firefox
0 upgraded, 0 newly installed, 1 downgraded, 0 to remove and 375 not upgraded.
E: Packages were downgraded and -y was used without --allow-downgrades.

• [FAILED] result: Firefox is not updated
• 🖓 again: this is in no way a commercial for Ubuntu Cinnamon :-(

Solution

🛈 This solution is only relevant, when booting from the [linuxmint-22.3-cinnamon-64bit.iso] file (live system). It's not relevant when you boot an installed Linux Mint OS.

Solution by @billyswong:

replace "deb cdrom:" by "deb [trusted=yes arch=amd64] cdrom:" in the "/etc/apt/sources.list" file

• issue the following command sequence:

sudo sed -i "s/deb\x20cdrom\x3A/deb\x20\\x5Btrusted\x3Dyes\x20arch\x3Damd64\\x5D\x20cdrom\x3A/g" "/etc/apt/sources.list" && \
sudo install -d -m 0755 /etc/apt/keyrings && \
wget -q https://packages.mozilla.org/apt/repo-signing-key.gpg -O- | sudo tee /etc/apt/keyrings/packages.mozilla.org.asc > /dev/null && \
echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" | sudo tee /etc/apt/sources.list.d/mozilla.list > /dev/null && \
echo -e "Package: *\nPin: origin packages.mozilla.org\nPin-Priority: 1000\n" | sudo tee /etc/apt/preferences.d/mozilla && \
sudo apt-get update && sudo apt-get install -y firefox

• relevant output:

N: Skipping acquire of configured file 'main/binary-i386/Packages' as repository 'https://dl.google.com/linux/chrome-stable/deb stable InRelease' doesn't support architecture 'i386'
The following packages will be upgraded:
  firefox
1 upgraded, 0 newly installed, 0 to remove and 339 not upgraded.
Get:1 https://packages.mozilla.org/apt mozilla/main amd64 firefox amd64 150.0~build1 [86.1 MB]

• remark: "N:" = Notification
• [SUCCESS] result: Firefox is updated successfully

System

System:
  Host: mint Kernel: 6.14.0-37-generic arch: x86_64 bits: 64 compiler: gcc
    v: 13.3.0 clocksource: tsc avail: hpet,acpi_pm
    parameters: BOOT_IMAGE=/casper/vmlinuz boot=casper
    initrd=/casper/initrd.lz uuid=6e72f523-dc09-4880-8910-93ffa64401c5
    username=mint hostname=mint quiet splash --
  Desktop: Cinnamon v: 6.6.4 tk: GTK v: 3.24.41 wm: Muffin v: 6.6.1 tools:
    avail: cinnamon-screensaver vt: 7 dm: LightDM v: 1.30.0
    Distro: Linux Mint 22.3 Zena base: Ubuntu 24.04 noble

Packages

firefox-locale-de/now 146.0.1+linuxmint1+zena amd64 [installed,upgradable to: 150.0+linuxmint1+zena]
firefox-locale-en/now 146.0.1+linuxmint1+zena amd64 [installed,upgradable to: 150.0+linuxmint1+zena]
firefox-locale-es/now 146.0.1+linuxmint1+zena amd64 [installed,upgradable to: 150.0+linuxmint1+zena]
firefox-locale-fr/now 146.0.1+linuxmint1+zena amd64 [installed,upgradable to: 150.0+linuxmint1+zena]
firefox-locale-it/now 146.0.1+linuxmint1+zena amd64 [installed,upgradable to: 150.0+linuxmint1+zena]
firefox-locale-nl/now 146.0.1+linuxmint1+zena amd64 [installed,upgradable to: 150.0+linuxmint1+zena]
firefox-locale-pt/now 146.0.1+linuxmint1+zena amd64 [installed,upgradable to: 150.0+linuxmint1+zena]
firefox-locale-ru/now 146.0.1+linuxmint1+zena amd64 [installed,upgradable to: 150.0+linuxmint1+zena]
firefox/mozilla,now 150.0~build1 amd64 [installed]