Ubuntu 24.04 LTS APT NO_PUBKEY Signature Verification Failure

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

APT rejects repository metadata and blocks package installs or updates.

Environment & Reproduction

Often triggered after adding third-party repositories.

sudo apt update

Root Cause Analysis

Missing or outdated signing keys prevent Release signature verification.

Quick Triage

Identify failing repository and key fingerprint.

grep -R '^deb ' /etc/apt/sources.list /etc/apt/sources.list.d

Step-by-Step Diagnosis

Check keyring files and source entries using `signed-by`.

ls -l /etc/apt/keyrings && sudo cat /etc/apt/sources.list.d/*.list

Solution – Primary Fix

Install the vendor key as a dearmored keyring and update sources accordingly.

curl -fsSL  | sudo gpg --dearmor -o /etc/apt/keyrings/vendor.gpg && sudo apt update

Solution – Alternative Approaches

Disable the repository until its official key distribution is confirmed.

Verification & Acceptance Criteria

`apt update` completes with no NO_PUBKEY or unsigned repository errors.

Rollback Plan

Revert source list changes and remove incorrect keyring files.

Prevention & Hardening

Require explicit `signed-by` usage for all external repositories.

Related Errors & Cross-Refs

Related to expired keys, key rotation drift, and `InRelease` signature mismatch.

Related tutorial: View the step-by-step tutorial for Ubuntu 24.04 LTS.

View all Ubuntu 24.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu secure APT repository key management docs.