BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>

[Heinrich Schuchardt]

Updating Jammy fails with:

Get:2 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Err:2 http://archive.ubuntu.com/ubuntu jammy InRelease
  The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>

[Heinrich Schuchardt (xypron)]

The problem has reoccurred today. Shouldn't archives be signed at all times?

[Heinrich Schuchardt (xypron)]

This is what resolved the problem for me:

$ sudo -s
# apt-get clean
# cd /var/lib/apt
# mv lists lists.old
# mkdir -p lists/partial
# apt-get clean
# apt-get update

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jan Evert van Grootheest (j-e-van-grootheest)]

The workaround of Heinrich, above, does not resolve the issue for me.

[Jan Evert van Grootheest (j-e-van-grootheest)]

Hmm, I did find what was causing it. I had a proxy configured for apt pointing at apt-cacher-ng on a local system.
When I removed the proxy from the configuration, apt had no issues downloading lists.

[Jan Evert van Grootheest (j-e-van-grootheest)]

Just for completeness, apt-cacher version 3.7.4-1build1 on a Ubuntu 22.04 system.

[EchoPouet (arnaudmoura)]

I have a Dockerfile to test this issue. In the Docker image have this issue after install git package.

Dockerfile use with Docker v20.10.20 :
FROM ubuntu:22.04

RUN apt-get update && apt-get upgrade --yes && apt-get install --yes \
    curl

RUN apt-get install --yes \
    git

I created container from this image and I have this error:
/# apt install
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@9f96e185ff6a:/# apt update
Get:1 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [114 kB]
Err:1 http://archive.ubuntu.com/ubuntu jammy InRelease
  The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
Get:3 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [99.8 kB]
Hit:4 http://security.ubuntu.com/ubuntu jammy-security InRelease
Fetched 484 kB in 0s (1135 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://archive.ubuntu.com/ubuntu jammy InRelease: The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/jammy/InRelease The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: Some index files failed to download. They have been ignored, or old ones used instead.

[EchoPouet (arnaudmoura)]

To fix this issue I add option --no-install-recommends.

Dockerfile use with Docker v20.10.20 :
FROM ubuntu:22.04

RUN apt-get update && apt-get upgrade --yes && apt-get install --yes \
curl

RUN apt-get install --yes --no-install-recommends \
git

[Alex Lane (modem7)]

What fixed it for me was to remove my apt-cacher-ng container + cache, then re-add it.

This resolved the issue on multiple servers.

[Brian Candler (b-candler)]

I got the same error, also going via apt-cacher-ng:

$ sudo apt-get update
Hit:1 http://gb.archive.ubuntu.com/ubuntu jammy InRelease
Get:2 http://gb.archive.ubuntu.com/ubuntu jammy-updates InRelease [114 kB]
Get:3 http://gb.archive.ubuntu.com/ubuntu jammy-backports InRelease [99.8 kB]
Hit:4 https://ppa.launchpadcontent.net/gns3/ppa/ubuntu jammy InRelease
Hit:5 https://download.docker.com/linux/ubuntu jammy InRelease
Get:6 http://gb.archive.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Err:2 http://gb.archive.ubuntu.com/ubuntu jammy-updates InRelease
  The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
Hit:7 https://packagecloud.io/netdata/netdata/ubuntu jammy InRelease
Hit:8 https://packagecloud.io/netdata/netdata-repoconfig/ubuntu jammy InRelease
Hit:9 https://apt.syncthing.net syncthing InRelease
Fetched 324 kB in 2s (148 kB/s)
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://gb.archive.ubuntu.com/ubuntu jammy-updates InRelease: The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: Failed to fetch http://gb.archive.ubuntu.com/ubuntu/dists/jammy-updates/InRelease The following signatures were invalid: BADSIG 871920D1991BC93C Ubuntu Archive Automatic Signing Key (2018) <email address hidden>
W: Some index files failed to download. They have been ignored, or old ones used instead.

Note that in my case the error was for "jammy-updates".

The solution for me was:

$ sudo rm -rf /var/cache/apt-cacher-ng/uburep/dists/jammy-updates/

Then:

$ sudo apt-get update
Hit:1 http://gb.archive.ubuntu.com/ubuntu jammy InRelease
Get:2 http://gb.archive.ubuntu.com/ubuntu jammy-backports InRelease [99.8 kB]
Get:3 http://gb.archive.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Get:4 http://gb.archive.ubuntu.com/ubuntu jammy-updates InRelease [114 kB]
Hit:5 https://ppa.launchpadcontent.net/gns3/ppa/ubuntu jammy InRelease
Hit:6 https://download.docker.com/linux/ubuntu jammy InRelease
Hit:7 https://apt.syncthing.net syncthing InRelease
Get:8 http://gb.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages [795 kB]
Get:9 http://gb.archive.ubuntu.com/ubuntu jammy-updates/main Translation-en [177 kB]
Get:10 http://gb.archive.ubuntu.com/ubuntu jammy-updates/restricted amd64 Packages [521 kB]
Get:11 http://gb.archive.ubuntu.com/ubuntu jammy-updates/restricted Translation-en [79.7 kB]
Hit:12 https://packagecloud.io/netdata/netdata/ubuntu jammy InRelease
Hit:13 https://packagecloud.io/netdata/netdata-repoconfig/ubuntu jammy InRelease
Fetched 1,897 kB in 2s (938 kB/s)
Reading package lists... Done
$

Hence getting into this bad state looks like some internal problem with apt-cacher-ng.