tlmgr: unexpected return value from verify_checksum: -5

In case the issue is not due to tlcontrib, running update-tlmgr-latest.sh solves the problem. Kudos to Norbert Preining for the answer on the TeX Live list! I record here the required steps for posterity.

In case you don't have it, retrieve the script:

wget http://mirror.ctan.org/systems/texlive/tlnet/update-tlmgr-latest.sh

Check if you can run kpsewhich from sudo:

sudo kpsewhich --var-value=SELFAUTOPARENT

If yes, go to the last step. If not, check that the TeXLive path is in your PATH

echo $PATH

If not, add it with

 PATH="/path/to//texlive/:$PATH"

Finally, run the script (make it executable with chmod +x)

sudo env PATH="$PATH" ./update-tlmgr-latest.sh

The env option passes to sudo the PATH already available to the user, without the need to change the PATH of the root user. The output should look like

Verifying archive integrity... All good.
Uncompressing TeX Live Manager Updater  100%  
./runme.sh: updating in /usr/local/texlive/2019...
./runme.sh: tlmgr version says this is TeX Live 2019,
./runme.sh: and this updater script created: Mon Apr  6 15:37:42 CEST 2020.
./runme.sh: proceeding with tlmgr update.
./runme.sh: updating /usr/local/texlive/2019/bin/x86_64-linux ...
./runme.sh: /opt/texbin/tlmgr including objects: master/tlpkg/tlpobj/texlive.infra.tlpobj master/tlpkg/tlpobj/texlive.infra.x86_64-linux.tlpobj
D:appending to package log file: /usr/local/texlive/2019/texmf-var/web2c/tlmgr.log
D:tlmgr:main: ::tldownload_server hash:: {enabled:1,errorcount:0,initcount:0,initcout:1,ua:LWP::UserAgent=HASH(0x564b37fdb010)}
D:setup_programs: preferring system versions
D:program curl found in path
D:program wget found in path
D:program lz4 not usable from path
D:(unix) trying to set up lz4, default /usr/local/texlive/2019/tlpkg/installer/lz4/lz4.x86_64-linux, arg --version
D: Using shipped /usr/local/texlive/2019/tlpkg/installer/lz4/lz4.x86_64-linux for lz4 (tested).
D:program gzip found in path
D:program xz found in path
./runme.sh: done.

The return value of -5 means that signature verification for a repository has failed. There is currently a bug in tlmgr that prevents a sensible error message from being printed, but this is being worked on and should be fixed soon:

https://tug.org/pipermail/tex-live/2020-February/044775.html

The most recent incarnation of this problem stems from the fact that the signing key for the tlcontrib repository expired. You can check whether you have tlcontrib enabled by using

$ tlmgr repository list
List of repositories (with tags if set):
    http://contrib.texlive.info/current (tlcontrib)
    http://mirror.ctan.org/systems/texlive/tlnet (main)

The maintainer of tlcontrib (Norbert Preining) has set his PGP key to expire every year, such that if the key were compromised it would become useless eventually. To update to the latest key, just execute the key import that you also executed when you first installed tlcontrib again:

$ curl -fsSL https://www.preining.info/rsa.asc | tlmgr key add -

While still waiting for an official fix, the quickest way to get around this issue is to disable verification of downloads using the verify-repo argument.

Example:

tlmgr install lm-math --verify-repo=none

I can confirm that this works with texlive 2019 under Ubuntu 20.04.

Note: Default texlive version on Ubuntu 20.04 is 2019. Either you should (manually) upgrade to 2020, or make sure your repository is 2019, and not the CTAN default which is 2020.

Here is an official 2019 repository, and you can add it by:

tlmgr option repository http://ftp.math.utah.edu/pub/tex/historic/systems/texlive/2019/tlnet-final