Debian 9 – apt update shows NO_PUBKEY and rejects repository signatures

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Repository refresh fails with key trust errors, blocking updates and package deployment.

Environment & Reproduction

Common after adding third-party repositories without valid keyring integration.

# Capture baseline
cat /etc/debian_version
apt-cache policy | sed -n 1,40p
ls -l /etc/apt/trusted.gpg.d
grep -R ^deb /etc/apt/sources.list*

Root Cause Analysis

The signing key is missing, expired, or not referenced correctly for the configured source entry.

Quick Triage

Identify the failing repository and the exact missing key fingerprint.

# Quick triage
apt-get update 2>&1 | tee /tmp/apt_update_152.log
awk /NO_PUBKEY/ /tmp/apt_update_152.log
apt-key list 2>/dev/null | sed -n 1,80p

Step-by-Step Diagnosis

Map the key error to source entries and verify key expiration or trust path issues.

# Detailed diagnosis
grep -R ^deb /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null
apt-key finger 2>/dev/null | sed -n 1,120p
apt-cache policy

Solution – Primary Fix

Install the correct vendor key and update source configuration to use trusted signing.

# Primary fix
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 
sudo apt-get clean
sudo apt-get update

Solution – Alternative Approaches

Temporarily disable untrusted repositories until key provenance is validated.

# Alternatives
sudo sed -i s/^deb/# deb/ /etc/apt/sources.list.d/*.list
sudo apt-get update

Verification & Acceptance Criteria

No NO_PUBKEY, BADSIG, or EXPKEYSIG errors remain during apt update.

# Verify
apt-get update
apt-cache policy | sed -n 1,80p

Rollback Plan

Remove newly imported keys and restore previous source files if trust model is incorrect.

# Rollback
sudo apt-key del 
sudo apt-get clean
sudo apt-get update

Prevention & Hardening

Track repository fingerprints and approval records for every external package source.

# Hardening
apt-key finger 2>/dev/null > /var/tmp/apt-keys.baseline
grep -R ^deb /etc/apt/sources.list* > /var/tmp/apt-sources.baseline

Related Errors & Cross-Refs

Related errors include repository is not signed, signature verification failed, and invalid key expiry.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian apt-secure documentation and apt-key deprecation migration notes.