The Debian apt system is awesome - it makes it incredibly easy to install new software onto a Debian box. It’s Achilles heel is the central repositories that host all the software packages. Making the whole world rely on just a couple of repository servers makes those servers very important, and means that when bad data gets into those servers, it causes problems for people all over the world.
There appears to be a recurring problem with at least some of the Debian repositories whereby the packages they offer aren’t signed, which causes the installer to hang at 5% on the “Select and Install Software” screen:
If you flip over to a virtual terminal (Alt-F2 and hit enter) and take a look at /var/log/syslog, you can see that the installer is waiting for interactive input from the user. The problem is that there is no way for the user to supply that input as the prompt doesn’t come up through the debian-installer interface:
I saw this problem the first time last weekend, and wasted hours trying to figure out what I’d changed in my preseed file that had caused the installer to hang. Eventually I found the prompt in the syslog, and found that adding the debian-installer/allow_unauthenticated boot parameter works around the issue.
The problem has just started happening again - right now I’m using mirror.aarnet.edu.au, and last weekend I found that 3 or 4 of the Australian mirrors had this problem. Last time the problem went away on the Monday, so perhaps there is some sync process updating these mirrors with bad *.debs which a human is fixing when they come into work on Monday?