Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I frequently cross this issue, and always have to google for an answer. Does anyone have a permanent fix for BADSIG errors from apt-get?

W: GPG error: http://download.virtualbox.org lucid Release: The following signatures were invalid: BADSIG 54422A4B98AB5139 Oracle Corporation (VirtualBox archive signing key)

share|improve this question
    
Are you using apt-cacher-ng? –  lfaraone Aug 10 '10 at 21:17
3  
It is important that you understand what are GPG signatures on APT used for, the GPG signature validates that the repository contains packages provided from a trusted source. It ensures both integrity and authenticity. Every time you add a new repository from some provider you will need to add it's GPG key. –  João Pinto Aug 10 '10 at 22:03
    
follow the example in the link - replace the example code in the linked answer with the BADSIG codes in your question. –  fossfreedom Oct 7 '11 at 17:13
    
fossfreedom, I couldn't get that solution to work on my system. Kept getting "--keyserver" was not understood. The solution offered by Dr.Ubuntu below worked for me. –  Dirk Oct 27 '11 at 16:57
    
Have a look also here askubuntu.com/questions/67594/… I think the commands you are using are correct, your just not using the correct key. –  Bruno Pereira Dec 9 '11 at 14:29

6 Answers 6

up vote 45 down vote accepted

The important part of your error message is the following in bold:

W: GPG error: http://download.virtualbox.org lucid Release: The following signatures were invalid: BADSIG 54422A4B98AB5139 Oracle Corporation (VirtualBox archive signing key)

Copy the stuff in bold and then open a terminal and type:

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 54422A4B98AB5139

i.e. paste using SHIFT + INS the number you have copied - 54422A4B98AB5139

You'll have to enter your password, the key will be downloaded and integrated.

share|improve this answer
1  
my error was related to a bad repo, not just the key missing ... however your answer is likely valid for 99% of the cases –  Casey Aug 19 '10 at 1:56
2  
+1 because that's quite a useful thing to know how to do. However, it did not fix my problem. –  Kazark Dec 29 '11 at 20:13
17  
Has this actually worked for anyone? –  Jjed Mar 15 '12 at 4:43
4  
BADSIG is different than NO_PUBKEY. For BADSIG the answer below solved it. I'm not sure how I ended up in this situation, but I had BADSIG on 5 different PPAs even after importing the keys. –  mfisch May 21 '12 at 4:02
12  
I believe this could be very dangerous in a situation where somebody is trying to do something nasty (man in the middle attack for example). Don't just add keys from error messages. Only add keys you trust. –  gertvdijk Jan 28 '13 at 16:41

Here's the (easiest) solution:

Type the following commands in the Terminal:

$ sudo -i
# apt-get clean
# cd /var/lib/apt
# mv lists lists.old
# mkdir -p lists/partial
# apt-get clean
# apt-get update

Credits: ubuntugeek.com

Edit:

If the error occurs again (maybe after a few days/months), open Nautilus as root > navigate to var/lib/apt > delete the "lists.old" folder > then open the "lists" folder and delete the "partial" folder. Now, execute the aforementioned commands again.

share|improve this answer
9  
This solves the more common error for me--updating through an Internet connection with a proxy (WiFi "cafe" that requires web logon) which corrupts some of my lists if I get logged off or forget to log on during an update. –  hobs Jan 1 '12 at 23:03
3  
What would the actual error be if qbi's answer doesn't help but this does? –  ArtOfCode Feb 1 '12 at 7:02
    
It also happens to me because of: WiFi "cafe" that requires web logon –  Postadelmaga Aug 8 '12 at 11:08
3  
I wish the OP would check this as the answer! –  HDave Jul 24 '13 at 16:03
    
@ArtOfCode: the error is exactly the same. This answer helped me, but on the web you only find the method that qbi points out and that you can find everywhere on the web. –  0xC0000022L Oct 15 '13 at 7:09

Try deleting the key

sudo apt-key del 16126D3A3E5C1192

then updating the repository

sudo apt-get update

You should get a NO_PUBKEY error instead of a BADSIG error and

sudo apt-key finger

should not find the key (called "Ubuntu Extras Archive Automatic Signing Key")

Now add the key

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 16126D3A3E5C1192

The result of apt-key finger should have

pub   1024D/3E5C1192 2010-09-20
      Key fingerprint = C474 15DF F48C 0964 5B78  6094 1612 6D3A 3E5C 1192
uid                  Ubuntu Extras Archive Automatic Signing Key <ftpmaster@ubuntu.com>

If that does not work, try

apt-get clean            # Remove cached packages
cd /var/lib/apt
mv lists lists.old       # Backup mirror info
mkdir -p lists/partial   # Recreate directory structure
apt-get clean
apt-get update           # Fetch mirror info

Source: this ubuntu forums thread

share|improve this answer

Another easier way to resolve BADSIG GPG errors is via a software called Y PPA manager

sudo add-apt-repository ppa:webupd8team/y-ppa-manager
sudo apt-get update
sudo apt-get install y-ppa-manager

Click on Advanced
enter image description here

And then select Fix all GPG Badsig errors
enter image description here

share|improve this answer

If you still have this error after adding the key try:

  1. goto your apt-cacher-ng cache directory, and delete the virtualbox entry:

    cd /var/cache/apt-cacher-ng
    sudo rm -rf download.virtualbox.org
    
share|improve this answer

Found another server that we could use:

gpg --keyserver hkp://subkeys.pgp.net --recv-keys [YOURKEYINQUESTION]
gpg --armor --export [YOURKEYINQUESTION] | sudo apt-key add -
share|improve this answer

protected by Community Sep 3 '12 at 16:02

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.