Debian 12 – apt update shows NO_PUBKEY and rejects repository signatures

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Package metadata cannot be trusted, so updates and installs are blocked.

Environment & Reproduction

Common after adding third-party repos without properly configured keyrings.

Root Cause Analysis

Missing, expired, or misreferenced repository signing keys cause trust verification failure.

Quick Triage

Identify failing repository and the missing key fingerprint from apt output.

Step-by-Step Diagnosis

Map NO_PUBKEY output to source entries and keyring files.
– shell: `grep -R ^deb /etc/apt/sources.list* /etc/apt/sources.list.d`
– python: `python3 -c “import pathlib; print([str(p) for p in pathlib.Path(‘/etc/apt/keyrings’).glob(‘*’)])”`
– perl: `perl -e ‘print q{Check signed-by paths and fingerprints}’`

Solution – Primary Fix

Install the correct vendor key and update source entries to use signed-by.
– shell: `sudo apt update`
– python: `python3 -c “import subprocess; print(subprocess.getoutput(‘sudo apt update 2>&1 | tail -n 30’))”`
– perl: `perl -e ‘print q{Validate key fingerprint from vendor docs}’`

Solution – Alternative Approaches

Disable the untrusted repository until key validation and governance review are complete.

Verification & Acceptance Criteria

apt update succeeds without NO_PUBKEY, BADSIG, or repository-not-signed messages.

Rollback Plan

Remove incorrect key files and restore known-good repository definitions from backup.

Prevention & Hardening

Require signed-by and key fingerprint tracking for every external repository.

Related Errors & Cross-Refs

Related to EXPKEYSIG, BADSIG, and apt-secure trust failures.

Related tutorial: View the step-by-step tutorial for debian-12.

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian apt-key deprecation and apt-secure key management guides.