I installed the SARE rule updates channel into a nightly sa-update routine yesterday, and noticed today that the rules didn’t appear to be getting used. I had misread the docs initially it turns out - you must use the updates.spamassassin.org channel if you plan to use any other channels since SA expects to find all rules in one location.

When I tried adding the default channel tonight I was getting the following error tonight while setting up sa-update:

error: GPG validation failed!
The update downloaded successfully, but it was not signed with a trusted GPG
key. Instead, it was signed with the following keys:

24F434CE

Perhaps you need to import the channel's GPG key? For example:

wget http://spamassassin.apache.org/updates/GPG.KEY
gpg --import GPG.KEY

After poking around for a bit I found the last line of the message is misleading - you actually want to run sa-update --import GPG.KEY after downloading it.