How to fix E: The repository 'URL' is not signed in APT

APTBEGINNERMEDIUMUpdated Oct 19, 2026· 1,402 views

The "repository is not signed" error occurs when APT cannot authenticate packages from a third-party repository because it lacks the required GPG public key. Fix it by importing the missing GPG key or trusting the repository.

Quick fix

Fixes E: The repository 'URL' is not signed

W: GPG error: http://repository.example.com focal Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1234567890ABCDEF
  1. Identify the missing GPG key from the error message
  2. Import the GPG key using the modern method (Ubuntu 20.04+ / Debian 11+)
  3. Add the GPG key URL directly in the repository source list (alternative modern method)
  4. Verify the fix by running apt update
apt — error
W: GPG error: http://repository.example.com focal Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1234567890ABCDEF
E: The repository 'URL' is not signed

What this error means

When you add a third-party repository to your Debian or Ubuntu system, APT uses cryptographic GPG keys to verify that packages are authentic and haven't been tampered with. If the repository's public key isn't in your system's trusted keyring, APT refuses to download packages from it as a security measure. This error typically appears when: - You added a PPA or custom repository without adding its GPG key - The repository's signing key has been rotated and your system hasn't been updated - The key is expired or no longer trusted APT treats unsigned repositories as a security risk by default, which protects your system from potentially malicious packages.

Typical symptoms

  • apt update fails with 'repository is not signed' error message
  • Cannot install or update packages from the problematic repository
  • Warning messages about signatures that couldn't be verified
  • NO_PUBKEY error showing in the output with a hexadecimal key ID
  • System blocks unsigned repository even with other valid repositories present

Common causes

  1. Repository GPG key was never added when the repository was first installed
  2. The repository signing key has expired or been revoked
  3. The GPG key was removed from the system or not properly imported
  4. Migrating to a new Ubuntu/Debian version where the key is no longer trusted
  5. The repository server changed its signing key without updating downstream systems

How to fix "E: The repository 'URL' is not signed"

1Identify the missing GPG key from the error message

When you run sudo apt update, look for the error output that mentions the repository URL and may include a NO_PUBKEY error with a key ID (a long hexadecimal string).

Example:

bash
W: GPG error: http://repository.example.com focal Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1234567890ABCDEF

Note the key ID (in this example: 1234567890ABCDEF). If the output doesn't show NO_PUBKEY, the repository's source list entry may need investigation.

2Import the GPG key using the modern method (Ubuntu 20.04+ / Debian 11+)

The recommended approach for modern systems is to import the key directly to the repository's keyring file instead of the deprecated apt-key method.

First, retrieve the key from a keyserver:

bash
sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys YOUR_KEY_ID

Replace YOUR_KEY_ID with the actual key ID from the error message. Then export it to a dedicated keyring file:

bash
sudo gpg --export YOUR_KEY_ID | sudo tee /etc/apt/trusted.gpg.d/repository-name.gpg > /dev/null

Replace repository-name with a descriptive name for the repository. Finally, update your package lists:

bash
sudo apt update

This method keeps each repository's keys separate and secure.

3Add the GPG key URL directly in the repository source list (alternative modern method)

Some repositories provide a Signed-By directive that you can add to your sources list. Edit your repository file:

bash
sudo nano /etc/apt/sources.list.d/repository-name.list

Update the line to include the GPG key URL:

bash
deb [signed-by=/etc/apt/trusted.gpg.d/repository-name.gpg] http://repository.url jammy main

Then download and install the key:

bash
sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys YOUR_KEY_ID
sudo gpg --export YOUR_KEY_ID | sudo tee /etc/apt/trusted.gpg.d/repository-name.gpg > /dev/null
sudo apt update

This approach is more secure because it ties the key directly to the repository entry.

4Verify the fix by running apt update

After importing the key, verify that the error is resolved:

bash
sudo apt update

You should see output indicating that the repository was processed successfully. Look for lines like:

bash
Get:XX http://repository.example.com focal Release [XXX B]
Get:XX http://repository.example.com focal Release.gpg [XXX B]

If you still see errors, double-check the key ID and ensure the keyserver is reachable.

5Update archive keyrings for official Debian/Ubuntu repositories

If the error is from an official Debian or Ubuntu repository, the issue may be that your system's archive keyring is outdated. Update the keyring package:

bash
sudo apt install debian-archive-keyring
# OR for Ubuntu
sudo apt install ubuntu-archive-keyring

This installs the latest official signing keys for repository authentication.

6Temporary workaround: Allow insecure repositories (not recommended)

If you absolutely need to proceed temporarily while troubleshooting, you can install packages without GPG verification using:

bash
sudo apt-get install -y package-name --allow-unauthenticated

Or for a full update:

bash
sudo apt-get update --allow-insecure-repositories

Warning: This bypasses security checks. Use only temporarily for troubleshooting, never as a permanent solution. Always import the GPG key instead (steps 2-4 above).

Advanced notes

APT Trusted Key Storage: Modern Debian/Ubuntu (11+) stores individual repository keys in /etc/apt/trusted.gpg.d/ instead of the deprecated /etc/apt/trusted.gpg file. This per-repository approach is more secure and maintainable.

Keyserver Selection: The hkp://keyserver.ubuntu.com:80 keyserver is commonly used but may occasionally be unavailable. Alternatives include pgp.mit.edu or keys.openpgp.org. If one fails, try another.

Expired Keys: Some repositories use keys that expire. If importing a key still doesn't work, check if the key has expired. You may need to remove the old key and import a newer one, or contact the repository maintainer.

SELinux/AppArmor: On systems with mandatory access controls (SELinux on Fedora/RHEL, AppArmor on Ubuntu/Debian), ensure the keyring files have correct permissions (644) and ownership (root:root).

CI/CD Environments: In automated deployments, consider adding the GPG key during container/VM setup or using repository mirrors that don't require additional key verification.

Frequently asked questions

What does "E: The repository 'URL' is not signed" mean?
When you add a third-party repository to your Debian or Ubuntu system, APT uses cryptographic GPG keys to verify that packages are authentic and haven't been tampered with. If the repository's public key isn't in your system's trusted keyring, APT refuses to download packages from it as a security measure. This error typically appears when: - You added a PPA or custom repository without adding its GPG key - The repository's signing key has been rotated and your system hasn't been updated - The key is expired or no longer trusted APT treats unsigned repositories as a security risk by default, which protects your system from potentially malicious packages.
How do I fix "E: The repository 'URL' is not signed"?
The "repository is not signed" error occurs when APT cannot authenticate packages from a third-party repository because it lacks the required GPG public key. Fix it by importing the missing GPG key or trusting the repository.
What causes "E: The repository 'URL' is not signed"?
Repository GPG key was never added when the repository was first installed The repository signing key has expired or been revoked The GPG key was removed from the system or not properly imported
Is the "E: The repository 'URL' is not signed" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading