Debian 13 – apt update shows NO_PUBKEY and rejects repository signatures

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Repository updates fail with NO_PUBKEY, preventing patching and package deployment.

Environment & Reproduction

Common after adding third-party repositories without keyring integration.

Root Cause Analysis

The required GPG key is missing, expired, or not referenced via signed-by in repository definitions.

Quick Triage

Identify the failing repository entry and missing fingerprint.

Step-by-Step Diagnosis

Match apt errors to source entries and existing keyring files.

Solution – Primary Fix

Install the correct vendor key into /etc/apt/keyrings and update source entries.

Solution – Alternative Approaches

Disable the untrusted repository until key validation is complete.

Verification & Acceptance Criteria

apt update succeeds with no signature or key trust warnings.

Rollback Plan

Remove incorrect keyring files and restore previous repository config backups.

Prevention & Hardening

Require signed-by usage and fingerprint documentation for all external repositories.

Related Errors & Cross-Refs

Related messages include EXPKEYSIG, BADSIG, and repository is not signed.

Related tutorial: View the step-by-step tutorial for Debian 13.

View all Debian 13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian apt-key deprecation and apt-secure references.