apt-cacher-ng corrupt/bad files on 22.04

[Mike Bernson]

I have about a number of containers that are running ubuntu using lxc-start (not lxcd) and
use apt-cache-ng to keep down the amount of network data I need to download.

apt-cacher-ng work without a problem on 20.04. I updated to the cache container to 22.04
and started having problem.

I have had to go to the maintenanace page a number of time because client get the follow error:
Err:5 http://security.ubuntu.com/ubuntu jammy-security InRelease
  The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>

I uncheck "Stop the work on errors during index update step"

I then check every thing under "Scan and semi-automatic expiration" and run a scan
it then finds a number (160 list time) file the are corrupt and need to be delete.

I then delete the files and thing work again for some time and then have to redo the process again because the error show up again,

Here is /etc/apt/apt.conf.d/02proxy
root@mike-think:/etc/apt/apt.conf.d# cat 02proxy
Acquire::http { Proxy "http://cache:3142"; };
root@mike-think:/etc/apt/apt.conf.d#

Here is the output from a client:

root@mike-think:~# apt-get update
Hit:1 http://dl.google.com/linux/chrome/deb stable InRelease
Hit:2 http://archive.ubuntu.com/ubuntu jammy InRelease
Ign:3 http://us.archive.ubuntu.com/ubuntu jammy InRelease
Hit:4 http://apt.puppetlabs.com jammy InRelease
Get:5 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Hit:6 http://ppa.launchpad.net/jonathonf/zfs/ubuntu jammy InRelease
Hit:7 http://download.virtualbox.org/virtualbox/debian jammy InRelease
Get:8 http://us.archive.ubuntu.com/ubuntu jammy-updates InRelease [114 kB]
Get:9 http://us.archive.ubuntu.com/ubuntu jammy-backports InRelease [99.8 kB]
Err:5 http://security.ubuntu.com/ubuntu jammy-security InRelease
  The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
Hit:3 http://us.archive.ubuntu.com/ubuntu jammy InRelease
Err:8 http://us.archive.ubuntu.com/ubuntu jammy-updates InRelease
  The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
Err:9 http://us.archive.ubuntu.com/ubuntu jammy-backports InRelease
  The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
Fetched 324 kB in 2s (207 kB/s)
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://security.ubuntu.com/ubuntu jammy-security InRelease: The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://us.archive.ubuntu.com/ubuntu jammy-updates InRelease: The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://us.archive.ubuntu.com/ubuntu jammy-backports InRelease: The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: Failed to fetch http://us.archive.ubuntu.com/ubuntu/dists/jammy-updates/InRelease The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: Failed to fetch http://us.archive.ubuntu.com/ubuntu/dists/jammy-backports/InRelease The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: Failed to fetch http://security.ubuntu.com/ubuntu/dists/jammy-security/InRelease The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: Some index files failed to download. They have been ignored, or old ones used instead.
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@mike-think:~#

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: apt-cacher-ng 3.7.4-1build1
ProcVersionSignature: Ubuntu 5.15.0-52.58-generic 5.15.60
Uname: Linux 5.15.0-52-generic x86_64
NonfreeKernelModules: cpuid tls veth nf_tables libcrc32c nfnetlink bridge stp llc binfmt_misc intel_powerclamp ipmi_ssif coretemp zfs kvm_intel zunicode kvm zzstd crct10dif_pclmul zlua zavl ghash_clmulni_intel icp aesni_intel crypto_simd zcommon cryptd znvpair spl intel_cstate at24 ast drm_vram_helper drm_ttm_helper ttm input_leds joydev drm_kms_helper cec rc_core fb_sys_fops syscopyarea acpi_ipmi sysfillrect sysimgblt ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel lp parport ramoops reed_solomon pstore_blk pstore_zone efi_pstore drm nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables x_tables autofs4 uas usb_storage igb hid_generic gpio_ich ahci xhci_pci i2c_algo_bit usbhid i2c_i801 crc32_pclmul hid lpc_ich i2c_smbus libahci i2c_ismt dca xhci_pci_renesas
ApportVersion: 2.20.11-0ubuntu82.2
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Mon Dec 5 17:38:52 2022
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: apt-cacher-ng
UpgradeStatus: No upgrade log present (probably fresh install)
mtime.conffile..etc.apt-cacher-ng.security.conf: 2015-09-12T16:54:06

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[pqwoerituytrueiwoq (pqwoerituytrueiwoq)]

Can we get this marked as a security issue as this issue prevents a deployment from getting security updates?

i have found if i disable my apt-cache-ng proxy setting on a client and run apt get update then enable the proxy the visible issue disappears for a while

[Jim Grace (jim-jmgrace)]

Is there a acng.conf setting or other workaround until a fix is available?

I have multiple clients failing with this issue now and removing/re-installing apt-cacher-ng or manually running the Apt-Cacher NG maintenance tasks to cleanup the cache isn't a good option either.

Thanks,

[Brian Candler (b-candler)]

The following fixes it for me:

rm -rf /var/cache/apt-cacher-ng/uburep

Looks like some cached package index is in a broken state.

[Alexander Hess (hessmikey)]

A more straight forward workaround would be to remove the related InRelease from the cache.

Run the scan with the following options:

Force the download of index files (even having fresh ones)
Ignore the threshold that aborts early when there is probably not much to do
Validate by file name AND file directory (use with care),

Once the scan is complete select show more / cleanup at the bottom.

Then check the boxes for corresponding InRelease

In this example it would be:
security.ubuntu.com/ubuntu/dists/jammy-security/InRelease
uburep/dists/jammy-updates/InRelease
uburep/dists/jammy-backports/InRelease

Click Delete selected files

Now you should be able to run apt-get update successfully on the systems that use the cacher.