Ubuntu 22.04 LTS – apt update fails with missing GPG key – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

apt refuses repository metadata and blocks package updates due to key trust failure.

Environment & Reproduction

Occurs after adding external repositories without valid keyring configuration on Jammy.

Root Cause Analysis

Repository signing keys are missing, expired, or not referenced via signed-by in sources.

Quick Triage

Find failing source entries and verify keyring files in /etc/apt/keyrings.

Step-by-Step Diagnosis

Correlate apt error output to repository entries and inspect key usage policy.

Solution – Primary Fix

Install the correct keyring and use signed-by in repository definitions.

Solution – Alternative Approaches

Disable or remove untrusted third-party repositories pending validation.

Verification & Acceptance Criteria

apt update completes without NO_PUBKEY, weak signature, or unsigned repository warnings.

Rollback Plan

Revert newly added source entries and keyring files if provenance checks fail.

Prevention & Hardening

Use per-repository keyrings and retire legacy apt-key workflows across all systems.

Related Errors & Cross-Refs

Related issues include certificate trust failures and repository metadata mismatch alerts.

Related tutorial: View the step-by-step tutorial for Ubuntu 22.04 LTS.

View all Ubuntu 22.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu secure apt repository signing and key management recommendations for Jammy hosts.