Ubuntu 18.04 LTS – apt update fails with NO_PUBKEY for third-party repository – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

apt update fails with NO_PUBKEY and security updates are delayed.

Environment & Reproduction

Ubuntu 20.04 host with third-party sources in /etc/apt/sources.list.d.

Root Cause Analysis

Repository signing key is missing, expired, or mapped to the wrong signed-by path.

Quick Triage

Run apt update and capture the fingerprint shown in the NO_PUBKEY output.

Step-by-Step Diagnosis

Compare source list signed-by directives with actual keyring files under /usr/share/keyrings.

Solution – Primary Fix

Import the vendor key with gpg –dearmor, update signed-by, then rerun apt update.

Solution – Alternative Approaches

Disable the third-party repository temporarily and patch from official focal repositories.

Verification & Acceptance Criteria

apt update completes without GPG errors and repository metadata is trusted.

Rollback Plan

Remove the added keyring and source entry, then rerun apt update.

Prevention & Hardening

Use per-repo keyrings and monitor key expiration dates proactively.

Automate patch management and compliance across your fleet with our DevOps services.

Related Errors & Cross-Refs

EXPKEYSIG and signature verification errors indicate related trust-chain issues.

Related tutorial: View the step-by-step tutorial for Ubuntu 18.04 LTS.

View all Ubuntu 18.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu apt-secure and signed-by repository configuration guidance.