what causes this error by `apt-get update`

Question

What causes this error when sudo apt-get update is issued?

W: GPG error: http://download.virtualbox.org trusty InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 54422A4B98AB5139

Sequence of events:

Install 14.04 (trusty), install VirtualBox from Ubuntu Software Centre and find it does not work, un-install VirtualBox using Ubuntu Software Centre, install from virtualbox.org using the Debian instructions at the link, issue apt-get update.

virtualbox.org, Instructions for Debian

Edit: There has been a response that suggests that this question is answered at a certain link. I read the answers at the link. This question is different. At the link we see how to resolve the error. This question is different because it asks for the cause. It does not ask for a resolution. This is my response to the link above about the "easiest way to resolve". I will check the comments and revise this edit if necessary.

possible duplicate of What is the easiest way to resolve apt-get BADSIG GPG errors? — dobey, Sep 27 '15 at 00:13
For some reason, the URL for the key doesn't resolve using wget. I have provided an alternate method for adding the key in this situation. — mchid, Sep 27 '15 at 00:54
I prefer to fix things but I prefer to know why errors occurred before fixing. — H2ONaCl, Sep 27 '15 at 01:18
possible duplicate of How do I fix the GPG error "NO_PUBKEY"? — mchid, Sep 27 '15 at 01:19

score 8 · Accepted Answer · edited Apr 13 '17 at 12:24

Whenever we add a repository for installing packages we also need a GPG key used by apt to authenticate packages for security reasons.

When adding a Launchpad hosted PPA this key will automatically be downloaded to use. So we do not have to do anything in addition.

This is different when adding an external repository such as the Oracle repository for Virtual Box. We then have to manually download and add the signing key. To do this the following steps are involved:

add the repository to our sources
download the GPG key
add this key for authentication
update our apt cache
install the desired software package

There are many different ways to achieve this, from command line or with graphical tools which I will not further elaborate here.

For adding the key there is a single-line command from the Virtual Box download page which always had worked for me:

wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | sudo apt-key add -

Without obtaining and adding the key, I was able to install and run VirtualBox. Obtaining and adding the key eliminated the error message from apt-get update. — H2ONaCl, Sep 28 '15 at 18:51
In case the solution yields the gpg: no valid OpenPGP data found error, adding a timeout can help wget -T 10 ... — user101, May 19 '20 at 17:35

mchid · Answer 2 · 2015-09-27T01:13:51.543

The problem is that the command provided by the virtualbox website suggests adding the key using a command that simply will not work and also doesn't provide any error as to why.

Running the commands individually instead of in their piped form revealed there is what appears to be a DNS problem with wget. Here's the error I received:

user@computer:~$ wget https://www.virtualbox.org/download/oracle_vbox.asc
--2015-09-26 21:11:57--  https://www.virtualbox.org/download/oracle_vbox.asc
Resolving www.virtualbox.org (www.virtualbox.org)... failed: Temporary failure in name resolution.
wget: unable to resolve host address ‘www.virtualbox.org’

Use aria2 instead (aria2 is way more advanced and reliable than wget anyhow but that's another discussion).

Because there is a DNS problem when using wget, I suggest using aria2 to download the key instead.

First, install aria2:

sudo apt-get install aria2

Then, run the following command to add the key:

aria2c https://www.virtualbox.org/download/oracle_vbox.asc; sudo apt-key add oracle_vbox.asc; rm oracle_vbox.asc

Finally, you should be able to run the following without issue:

sudo apt-get update

The following is an example of what you should see if adding the key is successful. Most importantly, it should say (OK):download completed. and OK on the last two lines respectively.

Download Results:
gid   |stat|avg speed  |path/URI
======+====+===========+=======================================================
cff9ac|OK  |    33KiB/s|/home/H2ONaCl/oracle_vbox.asc.1

Status Legend:
(OK):download completed.
OK

Please post any errors.

score 0 · Answer 3 · edited Sep 27 '15 at 01:37

0

It was probably because the part of the instructions at virtualbox.org that instructed to

sudo apt-key add oracle_vbox.asc

was not performed.

There was no intention to use HTTPS so that command was skipped. VirtualBox installed successfully without use of apt-key add. It was probably a less secure way to install.

edited Sep 27 '15 at 01:37

mchid

43,546
8
97
150

answered Sep 27 '15 at 01:14

H2ONaCl

9,693

what causes this error by `apt-get update`

3 Answers3