What is the easiest way to resolve apt-get BADSIG GPG errors?

Question

I frequently cross this issue, and always have to google for an answer. Does anyone have a permanent fix for BADSIG errors from apt-get?

W: GPG error: http://download.virtualbox.org lucid Release: The following signatures were invalid: BADSIG 54422A4B98AB5139 Oracle Corporation (VirtualBox archive signing key)

Answer 1

Here's the (easiest) solution:

Type the following commands in the Terminal:

$ sudo -i
# apt-get clean
# cd /var/lib/apt
# mv lists lists.old
# mkdir -p lists/partial
# apt-get clean
# apt-get update

Credits: ubuntugeek.com

Edit:

If the error occurs again (maybe after a few days/months), open Nautilus as root > navigate to var/lib/apt > delete the "lists.old" folder > then open the "lists" folder and delete the "partial" folder. Now, execute the aforementioned commands again.

Answer 2

The important part of your error message is the following in bold:

W: GPG error: http://download.virtualbox.org lucid Release: The following signatures were invalid: BADSIG 54422A4B98AB5139 Oracle Corporation (VirtualBox archive signing key)

Copy the stuff in bold and then open a terminal and type:

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 54422A4B98AB5139

i.e. paste using SHIFT + INS the number you have copied - 54422A4B98AB5139

You'll have to enter your password, the key will be downloaded and integrated.

Answer 3

Try deleting the key

sudo apt-key del 16126D3A3E5C1192

then updating the repository

sudo apt-get update

You should get a NO_PUBKEY error instead of a BADSIG error and

sudo apt-key finger

should not find the key (called "Ubuntu Extras Archive Automatic Signing Key")

Now add the key

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 16126D3A3E5C1192

The result of apt-key finger should have

pub   1024D/3E5C1192 2010-09-20
      Key fingerprint = C474 15DF F48C 0964 5B78  6094 1612 6D3A 3E5C 1192
uid                  Ubuntu Extras Archive Automatic Signing Key <ftpmaster@ubuntu.com>

---

If that does not work, try

apt-get clean            # Remove cached packages
cd /var/lib/apt
mv lists lists.old       # Backup mirror info
mkdir -p lists/partial   # Recreate directory structure
apt-get clean
apt-get update           # Fetch mirror info

Source: this ubuntu forums thread

Answer 4

Another easier way to resolve BADSIG GPG errors is via a software called Y PPA manager

sudo add-apt-repository ppa:webupd8team/y-ppa-manager
sudo apt-get update
sudo apt-get install y-ppa-manager

Click on Advanced

And then select Fix all GPG Badsig errors

Answer 5

If you still have this error after adding the key try:

1. goto your apt-cacher-ng cache directory, and delete the virtualbox entry:

   cd /var/cache/apt-cacher-ng
   sudo rm -rf download.virtualbox.org
   

Answer 6

Found another server that we could use:

gpg --keyserver hkp://subkeys.pgp.net --recv-keys [YOURKEYINQUESTION]
gpg --armor --export [YOURKEYINQUESTION] | sudo apt-key add -