How to fix W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: NO_PUBKEY in APT

APTINTERMEDIATEMEDIUMUpdated May 28, 2026· 866 views

APT shows this warning when it cannot verify a repository's GPG signature, usually due to a missing, expired, or rotated signing key, or a wrong system clock. The repo is skipped until fixed.

Quick fix

Fixes W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: NO_PUBKEY

sudo apt update
  1. Run apt update to read the full error messages
  2. Verify your system date and time are correct
  3. Identify which repository is failing
  4. Reinstall system keyrings for official repositories
apt — error
sudo apt update
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: NO_PUBKEY

What this error means

The "An error occurred during the signature verification" warning indicates that APT could not verify the cryptographic signature of one or more repositories during `apt update`. APT uses GPG (GNU Privacy Guard) keys to confirm that package metadata is authentic and has not been tampered with in transit. When APT refreshes your package lists, it downloads each repository's `Release` file along with a detached signature (`Release.gpg`) or an inline-signed `InRelease` file. APT then checks that signature against the public key declared for that repository. If the matching key is missing, expired, or no longer trusted, verification fails and APT refuses to use the freshly downloaded metadata. The message means APT will fall back to the previously cached package lists for that repository instead of the new ones. The system keeps working, but you may miss security updates and new package versions from the affected repository, so the underlying key problem should be resolved rather than ignored.

Typical symptoms

  • Warning messages starting with 'W: An error occurred during the signature verification' when running apt update
  • Some repositories show 'not updated' status in the update output
  • Package lists appear outdated despite running apt update
  • Specific repositories are skipped during package updates
  • You see messages like 'EXPKEYSIG' (key expired) or 'NO_PUBKEY' (public key missing)
  • Errors mention specific GPG key IDs you don't recognize

Common causes

  1. The GPG public key for a repository is missing from the keyring referenced by its source entry
  2. A repository's signing key has expired and the maintainer hasn't published an updated key
  3. A repository rotated its signing key and the old key is no longer valid
  4. The system clock is set to the wrong date/time, causing 'Release file is not valid yet' or signature validation failures
  5. The repository was added without installing its corresponding GPG key into /usr/share/keyrings or /etc/apt/keyrings
  6. A key was installed with the now-removed apt-key tool, so it is no longer present on Ubuntu 22.04+/24.04 or Debian 12+
  7. Network or proxy issues (including SSL inspection) prevent APT from downloading the Release/InRelease files or reaching a keyserver
  8. Corrupted files in /var/lib/apt/lists cause validation to fail

How to fix "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: NO_PUBKEY"

1Run apt update to read the full error messages

First, capture the exact error so you know which repository and key are involved:

bash
sudo apt update

Read the output carefully. APT usually names the repository URL and the missing/expired key ID, for example:

bash
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used.
W: ... NO_PUBKEY B7B3B788A8D3785C

Note the key ID and the repository URL or .list/.sources filename mentioned — you will use them in the next steps.

2Verify your system date and time are correct

GPG signatures and APT Release files have validity windows. A badly wrong clock makes valid signatures look expired or not-yet-valid:

bash
# Check current date/time and sync status
timedatectl status

If the date is clearly wrong (off by days or years), enable automatic synchronization:

bash
sudo timedatectl set-ntp true

If the machine has no network time source, set it manually (use your real current time):

bash
sudo timedatectl set-time "2026-05-29 14:30:00"

Then re-run sudo apt update.

3Identify which repository is failing

Match the failing URL from the error to a source entry on disk:

bash
# Newer deb822-style sources
ls /etc/apt/sources.list.d/
grep -R "" /etc/apt/sources.list.d/ 2>/dev/null

# Classic one-line sources
cat /etc/apt/sources.list

Decide whether the failing repo is an official Debian/Ubuntu archive (fix via keyrings in step 4) or a third-party/PPA repo (fix via the signed-by method in step 5). If you no longer need the repo at all, see step 6.

4Reinstall system keyrings for official repositories

If the failing repository is an official Ubuntu or Debian archive, the distribution keyring package usually fixes it:

bash
# Ubuntu official archives
sudo apt install --reinstall ubuntu-keyring

# Debian official archives
sudo apt install --reinstall debian-archive-keyring

These packages install the maintained keys into /usr/share/keyrings/, which the official source entries reference. Then refresh:

bash
sudo apt update

If apt install itself cannot run because the keyring repo is the one failing, download the matching .deb for your release from the distribution's website on a trusted machine and install it with sudo dpkg -i <file>.deb.

5Install or refresh a third-party key using the signed-by method

For PPAs and third-party repositories, install the key as a dearmored file and point the source at it with Signed-By. Do NOT use apt-key — it is deprecated and has been removed in Ubuntu 22.04+ / Debian 12+, so it no longer works there.

Download the publisher's key (use the exact URL from the repository's official instructions) and convert it to a keyring file:

bash
sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://example.com/repo/key.asc \
  | sudo gpg --dearmor -o /etc/apt/keyrings/example.gpg

Then reference that keyring from the source entry.

For a deb822 .sources file (/etc/apt/sources.list.d/example.sources):

bash
Types: deb
URIs: https://example.com/repo/ubuntu
Suites: jammy
Components: main
Signed-By: /etc/apt/keyrings/example.gpg

Or for a classic one-line entry in /etc/apt/sources.list.d/example.list:

bash
deb [signed-by=/etc/apt/keyrings/example.gpg] https://example.com/repo/ubuntu jammy main

If you only have a key ID (not a download URL), fetch it from a keyserver into the keyring file:

bash
sudo gpg --no-default-keyring \
  --keyring /etc/apt/keyrings/example.gpg \
  --keyserver hkps://keyserver.ubuntu.com \
  --recv-keys B7B3B788A8D3785C

Verify the key fingerprint against the publisher's documentation before trusting it, then run sudo apt update.

6Remove a repository you no longer need

If a repository keeps failing and you do not need its packages, removing it lets apt update finish cleanly:

bash
# Inspect the entry first so you know what you are removing
cat /etc/apt/sources.list.d/problematic-repo.list

# Remove the dedicated source file
sudo rm /etc/apt/sources.list.d/problematic-repo.list

If the entry lives in the main file, comment it out instead of deleting blindly:

bash
sudo nano /etc/apt/sources.list
# Prefix the offending 'deb'/'deb-src' line with '#'

Then run sudo apt update. You can re-add the repository later with a correct key using the signed-by method in step 5.

7Clear the package list cache and retry

Corrupted files in the APT lists directory can cause persistent verification failures. Clearing them forces a clean re-download and re-verification:

bash
sudo rm -rf /var/lib/apt/lists/*
sudo mkdir -p /var/lib/apt/lists/partial
sudo apt update

This is non-destructive (it only removes cached metadata, not installed packages) but the first update afterwards will be slower because all lists are fetched again.

Advanced notes

apt-key is removed, not just deprecated: Older guides tell you to run apt-key add or apt-key adv --recv-keys. Avoid this. apt-key was deprecated in Debian 9 / Ubuntu 16.04 and the binary has been removed in Ubuntu 22.04+ and Debian 12+, where the command simply does not exist. Keys it previously added to /etc/trusted.gpg are also no longer consulted by default for new-style sources. Always install keys as dearmored files under /etc/apt/keyrings/ (or /usr/share/keyrings/ for packaged keys) and reference them with Signed-By / [signed-by=...].

Per-repository trust with signed-by: Scoping each key to the repository that needs it (via Signed-By) is more secure than a global trusted keyring, because a third-party key can then only validate its own repository rather than every source on the system.

Keyserver alternatives: keyserver.ubuntu.com is a load-balanced pool. If it times out, prefer hkps://keyserver.ubuntu.com (TLS) and only fall back to other pools if necessary. Always verify the retrieved key's fingerprint against the publisher's documentation before using it.

Mixing Debian and Ubuntu: If you intentionally use Debian repositories on Ubuntu (or vice versa), install both debian-archive-keyring and ubuntu-keyring, since each provides different signing keys.

Key rotation: Distributions and large third-party repos rotate signing keys periodically. If a previously working repo suddenly reports an unknown key, check the project's official announcements for the new key rather than disabling verification.

Proxies and SSL inspection: Behind a corporate proxy that intercepts TLS, APT may fail to fetch Release/InRelease files. Configure the proxy for APT in /etc/apt/apt.conf.d/proxy.conf:\n\n

bash
\nAcquire::http::Proxy \"http://proxy.company.com:8080\";\nAcquire::https::Proxy \"http://proxy.company.com:8080\";\n

\n\nOffline systems: To install a key on a machine with no keyserver access, export it on a connected, trusted machine and copy the dearmored keyring across — never re-enable apt-key for this:\n\n

bash
\n# On a connected, trusted machine\ngpg --export B7B3B788A8D3785C | gpg --dearmor > example.gpg\n

\n\nTransfer example.gpg to the offline machine, place it in /etc/apt/keyrings/, and reference it with Signed-By in the relevant source entry.

Date-validation workaround (discouraged): As a strictly temporary measure while diagnosing a genuine clock or stale-Release problem, you can tell APT to ignore the Release file's validity window:\n\n

bash
\nsudo apt -o Acquire::Check-Valid-Until=false update\n

\n\nThis weakens protection against replay/rollback attacks, so never make it permanent or apply it system-wide — fix the clock (step 2) or the upstream key instead.

Frequently asked questions

What does "W: An error occurred during the signature verification. The repository" mean?
The "An error occurred during the signature verification" warning indicates that APT could not verify the cryptographic signature of one or more repositories during apt update. APT uses GPG (GNU Privacy Guard) keys to confirm that package metadata is authentic and has not been tampered with in transit. gpg) or an inline-signed InRelease file.
How do I fix "W: An error occurred during the signature verification. The repository"?
APT shows this warning when it cannot verify a repository's GPG signature, usually due to a missing, expired, or rotated signing key, or a wrong system clock. The repo is skipped until fixed.
What causes "W: An error occurred during the signature verification. The repository"?
The GPG public key for a repository is missing from the keyring referenced by its source entry A repository's signing key has expired and the maintainer hasn't published an updated key A repository rotated its signing key and the old key is no longer valid
Is the "W: An error occurred during the signature verification. The repository" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading