How to fix W: GPG error: URL Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY in APT

APTBEGINNERMEDIUMUpdated Dec 29, 2025· 327 views

The apt package manager cannot verify packages from a repository because the GPG public key is missing from your system. This occurs when adding third-party repositories without properly adding their signing keys. Adding the missing key resolves the issue and allows secure package installation.

Quick fix

Fixes W: GPG error: URL Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY

sudo apt update
  1. Identify the missing key ID from the error message
  2. Import the GPG key using the modern method (Ubuntu 20.04+ / Debian 11+)
  3. Alternative: Use the traditional apt-key method (older systems)
  4. Verify the key was imported successfully
apt — error
sudo apt update
W: GPG error: URL Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY

What this error means

APT uses GPG (GNU Privacy Guard) cryptographic keys to verify that packages come from legitimate sources and haven't been tampered with. When you add a third-party repository (PPA or external source) to your system, you must also add its public GPG key so apt can verify package signatures. The "NO_PUBKEY" error means apt found a repository configured to use a specific key ID, but that key is not installed on your system. Without the key, apt cannot verify package authenticity and refuses to install packages as a security precaution. The W: prefix indicates this is a warning, not a fatal error—apt will still continue but won't use packages from that repository.

Typical symptoms

  • apt update shows "W: GPG error" warnings with NO_PUBKEY followed by a hexadecimal key ID
  • Packages from third-party repositories fail to install
  • apt update completes but skips repositories with GPG verification failures
  • Apt refuses to install updates from PPAs without the keys
  • Upgrade commands skip repositories that have GPG key issues

Common causes

  1. Added a third-party repository (PPA) without importing its GPG signing key
  2. The repository's signing key was rotated or updated, but your system has an outdated key or no key
  3. Manually added a .list entry in /etc/apt/sources.list.d/ without adding the corresponding GPG key
  4. The GPG key server was unreachable during initial repository setup
  5. Repository maintainer changed the signing key and didn't provide migration instructions
  6. Upgrading from an older Ubuntu/Debian version where the repository key was already present but is no longer valid

How to fix "W: GPG error: URL Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY"

1Identify the missing key ID from the error message

When you run sudo apt update, look for the GPG error line that shows "NO_PUBKEY" followed by a 16-character hexadecimal string. This is the key ID you need to import:

bash
sudo apt update

Example output:

bash
W: GPG error: https://ppa.launchpad.net/some-ppa Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 40976EAF437D05B5

In this example, 40976EAF437D05B5 is the key ID you need to import.

2Import the GPG key using the modern method (Ubuntu 20.04+ / Debian 11+)

For newer systems, use gpg to retrieve and export the key directly to the trusted keyrings directory:

bash
sudo gpg --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5
sudo gpg --export 40976EAF437D05B5 | sudo tee /etc/apt/trusted.gpg.d/imported-key.gpg > /dev/null

Replace 40976EAF437D05B5 with your actual key ID. Replace imported-key.gpg with a descriptive name if you prefer (e.g., launchpad-ppa-key.gpg).

This method stores each repository's key separately in /etc/apt/trusted.gpg.d/, which is more secure than the deprecated apt-key approach.

3Alternative: Use the traditional apt-key method (older systems)

If you're on Ubuntu 18.04 or Debian 10, you can use the apt-key command directly:

bash
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5

Note: This method is deprecated but still works on older systems. If you see a warning about apt-key being deprecated, it's safe to ignore it for quick fixes on older distributions.

4Verify the key was imported successfully

List the imported keys to confirm the key ID is now installed:

bash
sudo apt-key list

Or for the modern method, check the trusted.gpg.d directory:

bash
ls -la /etc/apt/trusted.gpg.d/

You should see the key ID listed with the repository information.

5Run apt update to verify the fix

After importing the key, run apt update again to verify the GPG error is resolved:

bash
sudo apt update

The error message should no longer appear for that repository. The command will complete successfully with that repository's packages now available for installation.

Advanced notes

If the key import fails with "No public key found," the keyserver may be temporarily unavailable. Try an alternative keyserver like hkp://keyserver.ubuntu.com:80 or wait a few minutes before retrying. For custom PPAs, check the PPA's documentation or GitHub repository for the correct key ID or setup instructions, as some maintainers provide alternative key distribution methods. If you trust the repository but want to disable GPG verification temporarily, you can add [signed-by=/path/to/key.gpg] directly in the .sources file (modern apt format) to associate a specific key with a specific repository, providing fine-grained control over which repositories require signature verification.

Frequently asked questions

What does "W: GPG error: URL Release: The following signatures couldn't be verifi" mean?
APT uses GPG (GNU Privacy Guard) cryptographic keys to verify that packages come from legitimate sources and haven't been tampered with. When you add a third-party repository (PPA or external source) to your system, you must also add its public GPG key so apt can verify package signatures. The "NO_PUBKEY" error means apt found a repository configured to use a specific key ID, but that key is not installed on your system.
How do I fix "W: GPG error: URL Release: The following signatures couldn't be verifi"?
The apt package manager cannot verify packages from a repository because the GPG public key is missing from your system. This occurs when adding third-party repositories without properly adding their signing keys. Adding the missing key resolves the issue and allows secure package installation.
What causes "W: GPG error: URL Release: The following signatures couldn't be verifi"?
Added a third-party repository (PPA) without importing its GPG signing key The repository's signing key was rotated or updated, but your system has an outdated key or no key Manually added a .list entry in /etc/apt/sources.list.d/ without adding the corresponding GPG key
Is the "W: GPG error: URL Release: The following signatures couldn't be verifi" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading