Comment 20 for bug 24234

I don't have an patch but here is some of what I did to further investigate the problem and got a successful update:-

0. apt-get update reported this error -
W: GPG error: http://security.ubuntu.com breezy-security Release: The following signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key <email address hidden>
W: You may want to run apt-get update to correct these problems

1. Downloaded Release and Release.gpg from http://security.ubuntu.com/ubuntu/dists/breezy-security/

2. sudo apt-key del 0x437D05B5

3. sudo apt-key update
gpg: key 437D05B5: public key “Ubuntu Archive Automatic Signing Key <email address hidden>” imported
gpg: key FBB75451: “Ubuntu CD Image Automatic Signing Key <email address hidden>” not changed
gpg: Total number processed: 2
gpg: imported: 1
gpg: unchanged: 1
gpg: no ultimately trusted keys found

4. Checked keys and found that gpg thought they were ultimately trusted
$ sudo gpg --keyring /etc/apt/trusted.gpg --edit-key 0x437D05B5
gpg (GnuPG) 1.4.1; Copyright (C) 2005 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

pub 1024D/437D05B5 created: 2004-09-12 expires: never usage: CS
                     trust: ultimate validity: ultimate
sub 2048g/79164387 created: 2004-09-12 expires: never usage: E
[ultimate] (1). Ubuntu Archive Automatic Signing Key <email address hidden>

5. Tried apt-get update with same result;

6. gpg likes the key and the signature:-

gpg --keyring /etc/apt/trusted.gpg --verify ~/Release.gpg ~/Release
gpg: Signature made Sat 04 Feb 2006 05:11:37 EST using DSA key ID 437D05B5
gpg: Good signature from “Ubuntu Archive Automatic Signing Key <email address hidden>”

7. Verified breezy-updates/Release as well - OK

8. Looked a bit closer (strace on the execve args to gpgv called from apt-get) and looked the contents of /var/lib/apt/lists/partial/security.ubuntu.com_ubuntu_dists_breezy-security_Release.gpg and var/lib/apt/lists/security.ubuntu.com_ubun
tu_dists_breezy-security_Release Which differed markedly!

9. Moved them out and ran a successful apt-get update.

Perhaps if apt-get flushed the Release and gpg files every time, would that fix/mask the problem? I got the apt sources last night. Might peer a little closer.