How to fix W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: NO_PUBKEY in APT

First, capture the exact error so you know which repository and key are involved:

sudo apt update

Read the output carefully. APT usually names the repository URL and the missing/expired key ID, for example:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used.
W: ... NO_PUBKEY B7B3B788A8D3785C

Note the key ID and the repository URL or .list/.sources filename mentioned — you will use them in the next steps.

GPG signatures and APT Release files have validity windows. A badly wrong clock makes valid signatures look expired or not-yet-valid:

# Check current date/time and sync status
timedatectl status

If the date is clearly wrong (off by days or years), enable automatic synchronization:

sudo timedatectl set-ntp true

If the machine has no network time source, set it manually (use your real current time):

sudo timedatectl set-time "2026-05-29 14:30:00"

Then re-run sudo apt update.

Match the failing URL from the error to a source entry on disk:

# Newer deb822-style sources
ls /etc/apt/sources.list.d/
grep -R "" /etc/apt/sources.list.d/ 2>/dev/null

# Classic one-line sources
cat /etc/apt/sources.list

Decide whether the failing repo is an official Debian/Ubuntu archive (fix via keyrings in step 4) or a third-party/PPA repo (fix via the signed-by method in step 5). If you no longer need the repo at all, see step 6.

If the failing repository is an official Ubuntu or Debian archive, the distribution keyring package usually fixes it:

# Ubuntu official archives
sudo apt install --reinstall ubuntu-keyring

# Debian official archives
sudo apt install --reinstall debian-archive-keyring

These packages install the maintained keys into /usr/share/keyrings/, which the official source entries reference. Then refresh:

sudo apt update

If apt install itself cannot run because the keyring repo is the one failing, download the matching .deb for your release from the distribution's website on a trusted machine and install it with sudo dpkg -i <file>.deb.

For PPAs and third-party repositories, install the key as a dearmored file and point the source at it with Signed-By. Do NOT use apt-key — it is deprecated and has been removed in Ubuntu 22.04+ / Debian 12+, so it no longer works there.

Download the publisher's key (use the exact URL from the repository's official instructions) and convert it to a keyring file:

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://example.com/repo/key.asc \
  | sudo gpg --dearmor -o /etc/apt/keyrings/example.gpg

Then reference that keyring from the source entry.

For a deb822 .sources file (/etc/apt/sources.list.d/example.sources):

Types: deb
URIs: https://example.com/repo/ubuntu
Suites: jammy
Components: main
Signed-By: /etc/apt/keyrings/example.gpg

Or for a classic one-line entry in /etc/apt/sources.list.d/example.list:

deb [signed-by=/etc/apt/keyrings/example.gpg] https://example.com/repo/ubuntu jammy main

If you only have a key ID (not a download URL), fetch it from a keyserver into the keyring file:

sudo gpg --no-default-keyring \
  --keyring /etc/apt/keyrings/example.gpg \
  --keyserver hkps://keyserver.ubuntu.com \
  --recv-keys B7B3B788A8D3785C

Verify the key fingerprint against the publisher's documentation before trusting it, then run sudo apt update.

If a repository keeps failing and you do not need its packages, removing it lets apt update finish cleanly:

# Inspect the entry first so you know what you are removing
cat /etc/apt/sources.list.d/problematic-repo.list

# Remove the dedicated source file
sudo rm /etc/apt/sources.list.d/problematic-repo.list

If the entry lives in the main file, comment it out instead of deleting blindly:

sudo nano /etc/apt/sources.list
# Prefix the offending 'deb'/'deb-src' line with '#'

Then run sudo apt update. You can re-add the repository later with a correct key using the signed-by method in step 5.

Corrupted files in the APT lists directory can cause persistent verification failures. Clearing them forces a clean re-download and re-verification:

sudo rm -rf /var/lib/apt/lists/*
sudo mkdir -p /var/lib/apt/lists/partial
sudo apt update

This is non-destructive (it only removes cached metadata, not installed packages) but the first update afterwards will be slower because all lists are fetched again.