[Bug 24061] Re: GPG error with apt-get/aptitude/update-manager behind proxy (BADSIG 40976EAF437D05B5)

[David Kalnischkies]

The idea is that even if the signature can't be checked (= key is not in
the keyring) that we still use the Release file to decide which files to
download (e.g. pdiffs/translations available?) and use the Hashsums for
checking. The later doesn't provide a good trust path, but playing man-
in-the-middle is a bit harder this way and we can detect download
failures. The commits adding this should have some more reasons for it
included (i don't have the source handy currently for quoting)

So what we should do is discard the (In)Release file in some cases (bad
signature) and keep it in others (key not in keyring).

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to update-manager in Ubuntu.
https://bugs.launchpad.net/bugs/24061

Title:
  GPG error with apt-get/aptitude/update-manager behind proxy (BADSIG
  40976EAF437D05B5)

Status in “apt” package in Ubuntu:
  Triaged
Status in “update-manager” package in Ubuntu:
  Won't Fix

Bug description:
  I keep getting this when i launch the update manager.

  W: GPG error: http://archive.ubuntu.com breezy-updates Release: The following
  signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic
  Signing Key <ftpmaster at ubuntu.com>

  How can I fix it?

  ***********
  WORKAROUND:
  ----------
  Run the following commands(saves a backup of the old lists and creates a new lists folder) and the BADSIG error does not occur :

  $ cd /var/lib/apt
  $ sudo mv lists lists.old
  $ sudo mkdir -p lists/partial
  $ sudo apt-get update

  ***********

  comment from Rolf Leggewie: This is due to cache inconsistencies and
  thus is not necessarily a bug in Ubuntu at all.  But I hope the fine
  devs can find a way to better deal with broken proxies.  This is a
  very visible issue, a large number of internet connections are behind
  proxies and the users cannot do anything about it.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/24061/+subscriptions