apt update fails with NO_PUBKEY after release upgrade

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Package index refresh fails because a repository signing key is missing.

Environment & Reproduction

apt update prints NO_PUBKEY, InRelease signature errors, and skipped repository warnings.

Root Cause Analysis

Run apt update, inspect /etc/apt/sources.list.d, and check keyring files in /etc/apt/keyrings.

Quick Triage

Third-party source lists still point to old key URLs or deprecated apt-key workflow.

Step-by-Step Diagnosis

Import the correct vendor key into /etc/apt/keyrings and reference it with signed-by in the repo entry.

Solution – Primary Fix

Confirm apt update completes without GPG errors and apt policy shows expected origins.

Solution – Alternative Approaches

Track repository key expiration dates and keep source definitions under configuration management.

Verification & Acceptance Criteria

Disable the problematic third-party list file and rerun apt update to restore package operations.

Rollback Plan

Use Ansible apt_repository with signed-by to standardize keyring placement.

Prevention & Hardening

apt update; apt policy; ls -l /etc/apt/keyrings; grep -R signed-by /etc/apt/sources.list*

Related Errors & Cross-Refs

Provide failing repository URL, key fingerprint, and full apt output to platform support.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu 26.04 expects modern keyring usage instead of legacy apt-key trust store updates.