This APT error occurs when the package manager detects that a repository lacks proper security credentials (GPG signatures or Release files). APT disables the repository by default to prevent installing unsigned or unverified packages, protecting your system from potentially compromised software.
When you add a repository to your system, APT requires it to have cryptographic signatures that verify the authenticity and integrity of packages. This error means APT found a repository without proper signatures or without a valid Release file that confirms the repository is trustworthy. APT prevents you from updating from this source to avoid installing potentially malicious or compromised packages. This is a security-first approach to protect your Linux system.
Run the following command to see which repository is causing the issue:
sudo apt updateLook for the error message which will show the repository URL. For example:
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.Note the repository URL mentioned in the output.
The safest approach is to remove the repository entirely if you don't need it. First, list the contents of the sources directory:
ls -la /etc/apt/sources.list.d/Find the file containing the problematic repository and remove it:
sudo rm /etc/apt/sources.list.d/repository-name.listFor example, if the problematic repository is in a file called example.list:
sudo rm /etc/apt/sources.list.d/example.listThen run sudo apt update again to verify the error is gone.
If you need to keep the repository, you can mark it as trusted by editing its configuration. Edit the file in /etc/apt/sources.list.d/ or /etc/apt/sources.list:
sudo nano /etc/apt/sources.listFind the problematic repository line (starting with deb) and add [trusted=yes] after deb. For example, change:
deb http://ppa.launchpad.net/example/ppa/ubuntu focal mainTo:
deb [trusted=yes] http://ppa.launchpad.net/example/ppa/ubuntu focal mainSave the file (Ctrl+O, Enter, Ctrl+X in nano) and run:
sudo apt updateWARNING: Only use [trusted=yes] for repositories you trust. This bypasses GPG signature verification.
If the repository is legitimate, the repository maintainer should provide a GPG key. Once you have the key URL, import it:
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEY_IDOr import from a URL:
wget -qO - https://example.com/KEY.gpg | sudo apt-key add -After importing the key, run:
sudo apt updateThe repository should now work without the security warning.
This error represents APT's secure-by-default behavior introduced to prevent package tampering attacks. Unsigned repositories are disabled to protect against man-in-the-middle (MITM) attacks where an attacker could intercept package downloads and replace them with malicious versions. On Ubuntu/Debian systems with apt version 2.1+, this behavior is stricter. If you're using a legitimate but unsigned repository, prefer option 3 (removing it entirely) or working with the maintainer to add GPG signatures. Using [trusted=yes] should only be done for repositories you have verified are legitimate. For custom or internal repositories, generate your own GPG keypair and sign your packages properly.
E: Could not connect to proxy server
Could not connect to proxy server
E: Package 'package:i386' has no installation candidate
How to fix "Package package:i386 has no installation candidate" in apt
E: The value 'value' is invalid for APT::Default-Release
How to fix invalid APT::Default-Release value in APT
dpkg: error: unable to create new file 'path': Permission denied
How to fix dpkg permission denied errors in APT
subprocess installed post-removal script returned error exit status 1
How to fix "subprocess installed post-removal script returned error exit status 1" in APT