NO_PUBKEY Error for Third-Party apt Repository

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

apt update fails repository signature validation and blocks secure package installs.

Environment & Reproduction

Ubuntu 18.04 with external repositories added without proper keyring configuration.

Root Cause Analysis

Repository signing key is missing, expired, or not linked via signed-by keyring.

Quick Triage

Identify failing repository and key ID from apt output.

Step-by-Step Diagnosis

Review source entries, keyring files, and key expiration state for trust path validation.

Solution – Primary Fix

Install correct vendor key into a dedicated keyring and update repository signed-by config.

Solution – Alternative Approaches

Disable unneeded repositories or mirror trusted packages internally.

Verification & Acceptance Criteria

apt update completes with valid signatures and no NO_PUBKEY errors.

Rollback Plan

Revert repository and keyring changes if package source integrity cannot be confirmed.

Prevention & Hardening

Track key expiry, rotate keys proactively, and avoid legacy apt-key workflows.

Related Errors & Cross-Refs

The following signatures could not be verified, EXPKEYSIG, and repository not signed.

Related tutorial: View the step-by-step tutorial for Ubuntu 18.04 LTS.

View all Ubuntu 18.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian and Ubuntu secure apt guidance for repository signing and key management.