Upgrade Signing Key Is Invalid

Discussions related to using VirtualBox on Linux hosts.
ZenGuy
Posts: 11
Joined: 27. Mar 2008, 05:36

Upgrade Signing Key Is Invalid

Post by ZenGuy »

I'm having problems upgrading my existing Vbox 2.0.6 version to the latest release.

I'm currently running a stock version of Ubuntu Intrepid Ibex 8.10. My VBox installations have been upgraded from previous versions.

I when I upgraded to Vbox 2.0.6, I installed the Sun upgrade key, modified the sources.list and from that point forward I receive the following message when doing an apt-get update:
W: GPG error: http://download.virtualbox.org intrepid Release: The following signatures were invalid: BADSIG DCF9F87B6DFBCBAE Sun Microsystems, Inc. (xVM VirtualBox archive signing key) <info@virtualbox.org>
W: You may want to run apt-get update to correct these problems
Apt-get update doesn't do anything except produce the error above. I've tried manually deleting (via apt-key del) and reinstalling the key from the Sun site, and still have the same problem.

Am I missing something simple here?

Thanks.
Sasquatch
Volunteer
Posts: 17798
Joined: 17. Mar 2008, 13:41
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows XP, Windows 7, Linux
Location: /dev/random

Post by Sasquatch »

You did follow exactly what is noted on the website? If so, it should not give the error. Maybe you have a duplicate key. Check that with Synaptic (or Adept if you use KDE). You can usually ignore it, unless you don't get any header updates from the repo.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
ZenGuy
Posts: 11
Joined: 27. Mar 2008, 05:36

Post by ZenGuy »

Yes, I followed the instructions exactly. I did the all-in-one get/add statement, and when that didn't work I deleted the key and downloaded the asc file from the link then added it manually.

There is only one Sun key that appears when I do an "apt-key list" listed below:
pub 1024D/6DFBCBAE 2008-07-14
uid Sun Microsystems, Inc. (xVM VirtualBox archive signing key) <info@virtualbox.org>
sub 2048g/78A86EAF 2008-07-14
lizard

Re: Upgrade Signing Key Is Invalid

Post by lizard »

the key is still invalid ... (!)
"just ignore it" makes is useless ;)

W: GPG error: http://download.virtualbox.org intrepid Release: The following signatures were invalid: BADSIG DCF9F87B6DFBCBAE Sun Microsystems, Inc. (xVM VirtualBox archive signing key) <info@virtualbox.org>
frank
Oracle Corporation
Posts: 3362
Joined: 7. Jun 2007, 09:11
Primary OS: Debian Sid
VBox Version: PUEL
Guest OSses: Linux, Windows
Location: Dresden, Germany
Contact:

Re: Upgrade Signing Key Is Invalid

Post by frank »

ZenGuy, we get such reports from time to time but in really every case it was something wrong on the users side. I've read reports from users reporting that this problem goes away after updating his release to the latest and greatest up-to-date packages.

lizard, can you identify yourself? I'm a bit worried that you seem to be not part of the regular user database.
p2k
Posts: 2
Joined: 26. Mar 2009, 08:44
Primary OS: Ubuntu 8.10
VBox Version: PUEL
Guest OSses: Debian/Ubuntu/Windows

Re: Upgrade Signing Key Is Invalid

Post by p2k »

Hi Frank,

I am on Ubuntu 8.10 and have the same problem since march 23rd 10:08 AM, date at which the entire debian repository tree seems to have been last updated:

Code: Select all

$ cat /etc/apt/sources.list.d/virtualbox.list 
deb http://download.virtualbox.org/virtualbox/debian intrepid non-free

$ sudo apt-get update
[...]
W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used.GPG error: http://download.virtualbox.org intrepid Release: The following signatures were invalid: BADSIG DCF9F87B6DFBCBAE Sun Microsystems, Inc. (xVM VirtualBox archive signing key) <info@virtualbox.org>

W: Failed to fetch http://download.virtualbox.org/virtualbox/debian/dists/intrepid/Release  

W: Some index files failed to download, they have been ignored, or old ones used instead.
W: You may want to run apt-get update to correct these problems

Code: Select all

$ sudo apt-key list
[...]
pub   1024D/6DFBCBAE 2008-07-14
uid                  Sun Microsystems, Inc. (xVM VirtualBox archive signing key) <info@virtualbox.org>
sub   2048g/78A86EAF 2008-07-14
I have even removed the key then re-added it but it didn't change anything :

Code: Select all

$ sudo apt-key del 6DFBCBAE
$ wget -q --no-cache http://download.virtualbox.org/virtualbox/debian/sun_vbox.asc -O- | sudo apt-key add -
OK
Any idea ?

Best regards,
Patrick.
p2k
Posts: 2
Joined: 26. Mar 2009, 08:44
Primary OS: Ubuntu 8.10
VBox Version: PUEL
Guest OSses: Debian/Ubuntu/Windows

Re: Upgrade Signing Key Is Invalid

Post by p2k »

Alright, I just managed to resolve it.

I commented out the following line in /etc/apt/sources.list.d/virtualbox.list :

Code: Select all

deb http://download.virtualbox.org/virtualbox/debian intrepid non-free
then done an apt-get update that went fine, then uncommented the deb line.
And now, apt-get updates are OK.

Indeed a (strange) problem on the user side...

Best regards,
Patrick.
codenosher
Posts: 2
Joined: 9. Apr 2009, 17:00
Primary OS: Ubuntu 8.10
VBox Version: OSE Debian
Guest OSses: XP

Re: Upgrade Signing Key Is Invalid

Post by codenosher »

Same problem, followed the same steps. I wish mine would have 'fixed itself'.

Some background. I upgraded from Ubuntu 7.10 to 8.04, no problems with VBox. Then upgraded from 8.04 to 8.10. Now I get the following error:

"Failed to create VirtualBox COM object."

Other postings say just re-install. I tried to do a reinstall through aptitude, but I cleaned out the apt cache prior to the upgrade. So, now I'm trying to update my packages and re-install, but I can't due to the "signatures were invalid: NODATA 2" error.

I thought about pulling down the .deb and running it manually. Will that screw up my current vm?

Here's what I've done...

source.list:
deb http://download.virtualbox.org/virtualbox/debian intrepid non-free

Code: Select all

sudo apt-key list:
pub   1024D/6DFBCBAE 2008-07-14
uid                  Sun Microsystems, Inc. (xVM VirtualBox archive signing key) <info@virtualbox.org>
sub   2048g/78A86EAF 2008-07-14
I've updated without vbox in the source list and no key. Added vbox back to the source.list, re-ran the key setup just as posted:

Code: Select all

sudo wget -q --no-cache http://download.virtualbox.org/virtualbox/debian/sun_vbox.asc -O- | sudo apt-key add -
I've updated with apt-get and aptitude, both give the same error. Here's some output from aptitude:

Code: Select all

sudo aptitude update
Get:1 http://download.virtualbox.org intrepid Release.gpg [197B]    
Ign http://download.virtualbox.org intrepid/non-free Translation-en_US                      
Ign http://ppa.launchpad.net intrepid Release.gpg                    
Get:2 http://ubuntu.mirror.ac.za intrepid Release.gpg [189B]         
Get:3 http://download.virtualbox.org intrepid Release [3456B]            
Ign http://download.virtualbox.org intrepid Release                       
Ign http://ppa.launchpad.net intrepid/main Translation-en_US         
Hit http://download.virtualbox.org intrepid/non-free Packages        
Get:4 http://ppa.launchpad.net intrepid Release [27.6kB]             
Ign http://ubuntu.mirror.ac.za intrepid/main Translation-en_US
Ign http://ppa.launchpad.net intrepid/main Packages
Ign http://ubuntu.mirror.ac.za intrepid/restricted Translation-en_US
Ign http://ppa.launchpad.net intrepid/main Sources                    
Ign http://ubuntu.mirror.ac.za intrepid/universe Translation-en_US
Hit http://ppa.launchpad.net intrepid/main Packages                                                                           
Ign http://ubuntu.mirror.ac.za intrepid/multiverse Translation-en_US                                                          
Hit http://ppa.launchpad.net intrepid/main Sources                                           
<snip>
Fetched 577B in 1min26s (7B/s)
Reading package lists... Done
W: GPG error: http://download.virtualbox.org intrepid Release: The following signatures were invalid: NODATA 2
W: You may want to run apt-get update to correct these problems
You say it's always user error. Please tell me what I've done wrong.
ZenGuy
Posts: 11
Joined: 27. Mar 2008, 05:36

Re: Upgrade Signing Key Is Invalid

Post by ZenGuy »

It all fairness,this might be an Ubuntu bug. I saw similar behavior with another application on Ubuntu.

To get this working on my machine, I had to give up on having synaptic do the upgrade for a release. I pulled down the lated DEB from the Virtualbox site and installed it. After that, the VB repo appeared to be working correctly.

If you are already running the current release and want to get rid of the upgrade error every time the Update Manger runs, go into Syaptic - Settings - Repositories - Third Party Software
and uncheck out the VB repo for the time being. You can re-enable it after you do your next VB DEB install. (You might have to modify it if you have moved to Jaunty by then.)
codenosher
Posts: 2
Joined: 9. Apr 2009, 17:00
Primary OS: Ubuntu 8.10
VBox Version: OSE Debian
Guest OSses: XP

Re: Upgrade Signing Key Is Invalid

Post by codenosher »

Not sure why, but, I still get the same error, but when I check aptitude the packages are available. I was able to select them and upgrade.

This happened on two different machines. The exact same errors, the exact same behavior then the exact same success.

So, just because it says it fails don't believe it!

BTW, I like the new Vbox look. I can't wait to see if the graphics accel really works. Can I play Windows games now?
ZenGuy
Posts: 11
Joined: 27. Mar 2008, 05:36

Re: Upgrade Signing Key Is Invalid

Post by ZenGuy »

Ok, this is a Ubuntu bug. Here's the fix:

When you do an update, you will get an error message about the key being invalid. I don't know if there are different keys for different releases, but for me the problem key number was DCF9F87B6DFBCBAE. Run the following two lines of code and it should fix the issue. If you have a different key number in your Update Manager error then substitute your key in both lines.


gpg --keyserver subkeys.pgp.net --recv DCF9F87B6DFBCBAE
gpg --export --armor DCF9F87B6DFBCBAE | sudo apt-key add -
jtniehof
Posts: 5
Joined: 7. May 2008, 02:26

Re: Upgrade Signing Key Is Invalid

Post by jtniehof »

Clearing out the apt lists, as described in this mailing list post, did the trick for me.

Since it was working fine until 3.0 was released, I suspect there may be a problem in pdiff somewhere.
jtniehof
Posts: 5
Joined: 7. May 2008, 02:26

Re: Upgrade Signing Key Is Invalid

Post by jtniehof »

jtniehof wrote:Clearing out the apt lists, as described in this mailing list post, did the trick for me.
And it stopped working when 3.0.4 was released. I removed the VirtualBox sources and signing keys, removed all the list files, apt-get update, re-added the VirtualBox sources and signing keys, removed all the list files, apt-get update...still get the error.
xiff
Posts: 1
Joined: 9. Aug 2009, 09:13
Primary OS: Ubuntu 8.04
VBox Version: OSE Debian
Guest OSses: Gentoo

Re: Upgrade Signing Key Is Invalid

Post by xiff »

I had the same problem with 3.0.4.
Try co clear stale files in /var/lib/apt/lists/partial/

Code: Select all

sudo rm -f /var/lib/apt/lists/partial/*
It was the solution in my case.
growlf
Posts: 1
Joined: 10. Nov 2009, 07:59
Primary OS: Ubuntu other
VBox Version: OSE Debian
Guest OSses: Windows *, Ubuntu 8-9

Re: Upgrade Signing Key Is Invalid

Post by growlf »

ZenGuy wrote: gpg --keyserver subkeys.pgp.net --recv DCF9F87B6DFBCBAE
gpg --export --armor DCF9F87B6DFBCBAE | sudo apt-key add -
Interesting thing... I just had the same issue and attempted the solution given here - and it could not download the key it seems...

So, having tried everything else and with no luck so far, I dropped my firewall momentarily on a wild hair and bingo! Key downloaded, apt played nice and everything updated. What port do I need to open if not HTTP or FTP (which are already allowed out) for gpg to receive the key correctly?
Post Reply