Fix "The following signatures couldn't be verified because the public key is not available: NO_PUBKEY"

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://vendor.example/key.asc | sudo tee /etc/apt/keyrings/vendor.asc > /dev/null
# then add  Signed-By: /etc/apt/keyrings/vendor.asc  to that repository's .sources file
sudo apt update

What the error means

During sudo apt update you see:

W: GPG error: https://download.example.com/linux/ubuntu resolute InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7EA0A9C3F273FCD8
E: The repository 'https://download.example.com/linux/ubuntu resolute InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.

Newer apt (3.x, used by Debian 13 and Ubuntu 26.04) verifies signatures with Sequoia's sqv and words the same problem differently:

Err:5 https://download.example.com/linux/ubuntu resolute InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key 9DC858229FC7DD38854AE2D88D81803C0EBFCD88, which is needed to verify signature.

Every repository signs its index (InRelease or Release.gpg). apt checks that signature against the key that the sources entry trusts. If that key is not on your system, apt refuses to use the repository, so packages from it stay old or appear as "Unable to locate package". The hex string is the key ID or fingerprint that is missing.

Why apt-key no longer works

For years tutorials said sudo apt-key adv --keyserver ... --recv-keys ID. That put every key into one global keyring trusted for every repository, so a key for a small third-party repo could also sign fake Ubuntu packages. apt deprecated it, warned with Key is stored in legacy trusted.gpg keyring, and Ubuntu 26.04 no longer ships apt-key at all (apt-key: command not found). The modern model is one key file per repository, referenced by signed-by.

Cause 1: a third-party repository was added without its key

The most common case: you added a repo line by hand or from an old guide. Fix it in three steps.

1. Save the key to /etc/apt/keyrings

Use the key URL from the vendor's official instructions:

sudo install -d -m 0755 /etc/apt/keyrings
# armored key, keep as .asc
curl -fsSL https://vendor.example/key.asc | sudo tee /etc/apt/keyrings/vendor.asc > /dev/null
# or convert to a binary keyring
curl -fsSL https://vendor.example/key.asc | sudo gpg --dearmor -o /etc/apt/keyrings/vendor.gpg
sudo chmod 644 /etc/apt/keyrings/vendor.*

If the vendor only gives a key ID for a keyserver, fetch it into a file instead of the global keyring:

# use a throwaway GnuPG home so nothing lands in your personal keyring
export GNUPGHOME=$(mktemp -d)
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 7EA0A9C3F273FCD8
gpg --export 7EA0A9C3F273FCD8 | sudo tee /etc/apt/keyrings/vendor.gpg > /dev/null
rm -rf "$GNUPGHOME"; unset GNUPGHOME

Exporting with gpg --export matters: a keyring created directly with --keyring is in GnuPG's newer keybox format, which apt cannot read.

2. Reference it from the sources entry

deb822 format, for example /etc/apt/sources.list.d/vendor.sources:

Types: deb
URIs: https://download.example.com/linux/ubuntu
Suites: resolute
Components: stable
Architectures: amd64
Signed-By: /etc/apt/keyrings/vendor.gpg

Or one-line format in /etc/apt/sources.list.d/vendor.list:

deb [arch=amd64 signed-by=/etc/apt/keyrings/vendor.gpg] https://download.example.com/linux/ubuntu resolute stable

3. Update

sudo apt update

This is the pattern Docker, Microsoft, Google, Mozilla and most other vendors now document; the Docker install guide walks through a real example.

Cause 2: a PPA key is missing

PPAs added by copying a line rather than with add-apt-repository have no key. Remove the hand-made entry and add the PPA properly, which writes a .sources file with the key embedded:

sudo rm /etc/apt/sources.list.d/OLD-PPA-FILE.list
sudo add-apt-repository ppa:owner/name
sudo apt update

Cause 3: the repository rotated or expired its key

If the repo worked before, the vendor probably published a new key. The message may also read EXPKEYSIG or KEYEXPIRED. Download the current key from the vendor's instructions and overwrite the old file in /etc/apt/keyrings/. Many vendors ship a *-keyring or *-archive-keyring package that updates the key automatically; install it if offered.

For the official archives, reinstall the keyring package: sudo apt install --reinstall ubuntu-keyring or debian-archive-keyring. If those are too old to verify the archive (common when upgrading an old install), download the current keyring .deb from packages.debian.org or packages.ubuntu.com and install it with sudo apt install ./file.deb.

Cause 4: the key is in the legacy keyring

On systems upgraded from older releases, keys may still sit in /etc/apt/trusted.gpg or /etc/apt/trusted.gpg.d/, and the sources entry has no signed-by. Move the key to a dedicated file and reference it:

gpg --no-default-keyring --keyring /etc/apt/trusted.gpg --list-keys
gpg --no-default-keyring --keyring /etc/apt/trusted.gpg --export 7EA0A9C3F273FCD8 | sudo tee /etc/apt/keyrings/vendor.gpg > /dev/null

Then add Signed-By: /etc/apt/keyrings/vendor.gpg to that repository's entry and run sudo apt update.

What not to do

Also avoid piping a key URL from a forum post into your keyring. Get the key URL or fingerprint from the project's own documentation and compare the fingerprint with gpg --show-keys /etc/apt/keyrings/vendor.gpg.

Distro notes and prevention

• Ubuntu 26.04 and 24.04: official sources in ubuntu.sources already use Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg. Follow the same pattern for every extra repo.
• Debian 13: identical approach; the official key is /usr/share/keyrings/debian-archive-keyring.gpg.
• Linux Mint 22.3: Software Sources has a "Maintenance" option to fix missing keys for PPAs. Third-party repos need the manual method above.
• Fedora, openSUSE: keys are listed per repo with gpgkey= and imported when first used; sudo rpm --import URL imports one manually. On Arch, the equivalent problem is covered in pacman "invalid or corrupted package (PGP signature)".
• Remove repositories you no longer use; stale ones are where expired keys come from. If the repo itself is gone, you will see "does not have a Release file" instead.

Frequently asked questions