This error occurs when APT package manager fails to verify the cryptographic signature of a repository's Release file. The signature verification failure indicates that either the repository's GPG key has changed, your local package lists are corrupted, or there's a network issue during verification.
The BADSIG (Bad Signature) error means that APT has detected a mismatch between the cryptographic signature of a package repository's Release file and the expected signature from the repository's GPG key. Each repository signs its packages with a private GPG key, and APT verifies these signatures using the corresponding public key stored in your system's keyring. When the signature fails verification, it indicates either a legitimate change in the repository's signing key, corruption in your local package metadata, or a compromise in the delivery of the package data.
This is the most common and effective fix. The corrupted cached package lists are often the culprit:
sudo apt-get clean
cd /var/lib/apt
sudo mv lists lists.old
sudo mkdir -p lists/partial
sudo apt-get updateThis sequence removes the corrupted package lists and allows apt to re-download fresh, valid ones.
Check your APT sources to ensure the repository URL hasn't been replaced with a malicious or broken mirror:
sudo nano /etc/apt/sources.listAlso check the sources.list.d directory:
ls /etc/apt/sources.list.d/If you see an unfamiliar repository causing the error, comment it out by adding a # at the beginning of its line.
Extract the key ID from the BADSIG error message (the hexadecimal number), then re-import it:
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys <KEY_ID>Replace <KEY_ID> with the actual ID from your error message. For example:
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 648ACFD622F3D138Then try updating again:
sudo apt-get updateIf the error is from a third-party PPA, disable it temporarily, update, then re-enable it:
# Disable the PPA by renaming its config file
sudo mv /etc/apt/sources.list.d/ppa-name.list /etc/apt/sources.list.d/ppa-name.list.off
# Update to forget the source
sudo apt-get update
# Re-enable the PPA
sudo mv /etc/apt/sources.list.d/ppa-name.list.off /etc/apt/sources.list.d/ppa-name.list
# Update again
sudo apt-get updateOr use ppa-purge to completely remove a PPA:
sudo apt-get install ppa-purge
sudo ppa-purge ppa:user/ppa-nameIf you're behind a corporate proxy or firewall, ensure it's not intercepting repository downloads:
# Test connectivity to a repository
curl -I http://archive.ubuntu.com/ubuntu/ReleaseIf using a proxy, verify your APT proxy configuration:
sudo nano /etc/apt/apt.conf.d/proxy.confAdd or verify your proxy settings:
Acquire::http::Proxy "http://proxy-address:port";If the proxy is the issue, you may need to contact your IT team or bypass it if possible.
For Ubuntu 18.04 and older: The apt-key command used above is deprecated in newer Ubuntu versions. If you're using Ubuntu 20.04+, consider using the newer method:
wget -O- https://keyserver.ubuntu.com/pks/lookup?op=get&search=<KEY_ID> | sudo gpg --dearmor -o /usr/share/keyrings/repository-name.gpgThen update your sources.list to reference the keyring:
deb [signed-by=/usr/share/keyrings/repository-name.gpg] http://repository.url/ focal mainFor apt-cacher-ng users: If you use apt-cacher-ng (a local apt caching proxy), clear its cache:
sudo /etc/init.d/apt-cacher-ng stop
sudo rm -rf /var/cache/apt-cacher-ng/*
sudo /etc/init.d/apt-cacher-ng start
sudo apt-get updateSystem clock issues: Rarely, if your system clock is significantly out of sync with the repository's certificates, GPG verification can fail. Ensure your system time is correct:
date
sudo timedatectl set-ntp trueE: Could not connect to proxy server
Could not connect to proxy server
E: Package 'package:i386' has no installation candidate
How to fix "Package package:i386 has no installation candidate" in apt
E: The value 'value' is invalid for APT::Default-Release
How to fix invalid APT::Default-Release value in APT
dpkg: error: unable to create new file 'path': Permission denied
How to fix dpkg permission denied errors in APT
subprocess installed post-removal script returned error exit status 1
How to fix "subprocess installed post-removal script returned error exit status 1" in APT