My spamassassin updates daily by running sa-update. Recently, I’ve been getting failure notices that mirror spamassassin.kluge.net was no longer available. This was because of a known bug, apparantly. So, I deleted the MIRROR.BY file and ran sa-update again.
This caused problem number two: GPG key verification failed. This was also a known issue, so I had to do:
wget http://spamassassin.apache.org/updates/GPG.KEY sa-update --import GPG.KEY
And then everything was OK again.