Foreword: we are using Spacewalk to distribute some internal packages to Ubuntu systems via a private repository, thus necessitating the self-signing. Unfortunately Spacewalk doesn't handle the signing portion of this yet, so it has to be done manually.

We are having issues with apt stating that signatures are invalid for the Release files::

# apt update  
Apt-Spacewalk: Updating sources.list  
Ign:1 spacewalk://spacewalk.server extras-ubuntu InRelease  
Reading package lists... Done  
W: GPG error: spacewalk://spacewalk.server extras-ubuntu Release: 
The following signatures were invalid: 41CDF527725B5CD68EA405AA27D22AF72385D175  

The key is imported to apt-key

# apt-key list
pub   rsa2048 2018-03-23 [SC]
       41CD F527 725B 5CD6 8EA4  05AA 27D2 2AF7 2385 D175
uid           [ unknown] Spacewalk (For GPG signing APT repos) <nobody@nowhere>

And the Release file is, in fact, signed with the correct key:

# gpg -k
pub   2048R/2385D175 2018-03-23
uid                  Spacewalk (For GPG signing APT repos) <nobody@nowhere>

# gpg ./Release.gpg
Detached signature.
Please enter name of data file: Release
gpg: Signature made Fri 23 Mar 2018 10:43:50 AM EDT using RSA key ID 2385D175
gpg: Good signature from "Spacewalk (For GPG signing APT repos) <nobody@nowhere>"

What is the cause of this invalid signature error and how can we fix it? We strictly followed the instructions on http://www.devops-blog.net/spacewalk/gpg-signing-apt-repository-in-spacewalk so everything seems like it should work, but it doesn't.


I was running into the same issue on a local Debian 9 repo, not Spacewalk specific. Tracked it down to:

  • Needed SHA-256 for the key
  • Using "signed-by" to the gpg key in the sources.list
  • Device public key could not be ASCII, must be binary

Figured it out by reading the documentation Instructions to connect to a third-party repository

  • 1
    Welcome to Ask Ubuntu! ;-) I recommend editing this answer to expand it with specific details about how to do this. (See also How do I write a good answer? for general advice about what sorts of answers are considered most valuable on Ask Ubuntu.) Keep up the good work! – Fabby Nov 29 '18 at 22:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.