MongoDB.live, free & fully virtual. June 9th - 10th. Register Now MongoDB.live, free & fully virtual. June 9th - 10th. Register Now

"MongoDB 4.0 Release Signing Key" is a BADSIG

I’m having problems with updating apt repo lists on ubuntu 16.04.

Following the instructions at https://docs.mongodb.com/v4.0/tutorial/install-mongodb-on-ubuntu/ was working, but now apt-get update fails with this error:

Get:9 https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/4.0/multiverse arm64 Packages [12.5 kB]
Err:9 https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/4.0/multiverse arm64 Packages
  Hash Sum mismatch
...
Reading package lists... Done
W: GPG error: https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/4.0 Release: The following signatures were invalid: BADSIG 68818C72E52529D4 MongoDB 4.0 Release Signing Key <packaging@mongodb.com>
W: The repository 'https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/4.0 Release' is not signed.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Failed to fetch https://repo.mongodb.org/apt/ubuntu/dists/xenial/mongodb-org/4.0/multiverse/binary-arm64/Packages.gz  Hash Sum mismatch
E: Some index files failed to download. They have been ignored, or old ones used instead.

apt-key list shows this:

root@738176871bfd:/# apt-key list
/etc/apt/trusted.gpg
--------------------
pub   1024D/437D05B5 2004-09-12
uid                  Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>
sub   2048g/79164387 2004-09-12

pub   4096R/C0B21F32 2012-05-11
uid                  Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>

pub   4096R/EFE21092 2012-05-11
uid                  Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>

pub   1024D/FBB75451 2004-12-30
uid                  Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>

pub   4096R/E52529D4 2018-04-18 [expires: 2023-04-17]
uid                  MongoDB 4.0 Release Signing Key <packaging@mongodb.com>

I get the same key with both
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 9DA31620334BD75D9DCB49F368818C72E52529D4
and
curl -fsSL https://www.mongodb.org/static/pgp/server-4.0.asc

Is there a problem with the repo?

Thanks,
David

2 Likes