Unfortunately the three prominent threads on the Arduino forum on this topic are closed, so their good but incomplete information is baked in time:
So let me add a bit more useful information in the hope it permeates.
Device signature = 0x000000
Means the MCU did not respond with a signature. There is a very thin chance that's because it reported all zeros when asked for a signature, but a much higher chance that it did not respond at all. Correct signature bytes are found here (eg. ATmega328P = 0x1E950F) and crucially, all Atmel microcontrollers have one.
Further, the error:
avrdude: Device signature = 0x000000
avrdude: Yikes! Invalid device signature.
will occur if you're using ArduinoISP to flash a target Arduino and the target is not physically connected. So it really is an "all bets are off" message that doesn't pinpoint any particular cause. To troubleshoot, checking wiring if a good first step.
Do not, on the other hand, concern yourself with the external clock signal. In contrast to some guides, the ATmega328P at least comes factory configured to use an internal RC oscillator, so even a correctly connected crystal or resonator on the XTAL
pins will not show any activity until the first successful flash.