How to fix E: The repository 'URL' is not signed in APT

When you run sudo apt update, look for the error output that mentions the repository URL and may include a NO_PUBKEY error with a key ID (a long hexadecimal string).

Example:

W: GPG error: http://repository.example.com focal Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1234567890ABCDEF

Note the key ID (in this example: 1234567890ABCDEF). If the output doesn't show NO_PUBKEY, the repository's source list entry may need investigation.

The recommended approach for modern systems is to import the key directly to the repository's keyring file instead of the deprecated apt-key method.

First, retrieve the key from a keyserver:

sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys YOUR_KEY_ID

Replace YOUR_KEY_ID with the actual key ID from the error message. Then export it to a dedicated keyring file:

sudo gpg --export YOUR_KEY_ID | sudo tee /etc/apt/trusted.gpg.d/repository-name.gpg > /dev/null

Replace repository-name with a descriptive name for the repository. Finally, update your package lists:

sudo apt update

This method keeps each repository's keys separate and secure.

Some repositories provide a Signed-By directive that you can add to your sources list. Edit your repository file:

sudo nano /etc/apt/sources.list.d/repository-name.list

Update the line to include the GPG key URL:

deb [signed-by=/etc/apt/trusted.gpg.d/repository-name.gpg] http://repository.url jammy main

Then download and install the key:

sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys YOUR_KEY_ID
sudo gpg --export YOUR_KEY_ID | sudo tee /etc/apt/trusted.gpg.d/repository-name.gpg > /dev/null
sudo apt update

This approach is more secure because it ties the key directly to the repository entry.

After importing the key, verify that the error is resolved:

sudo apt update

You should see output indicating that the repository was processed successfully. Look for lines like:

Get:XX http://repository.example.com focal Release [XXX B]
Get:XX http://repository.example.com focal Release.gpg [XXX B]

If you still see errors, double-check the key ID and ensure the keyserver is reachable.

If the error is from an official Debian or Ubuntu repository, the issue may be that your system's archive keyring is outdated. Update the keyring package:

sudo apt install debian-archive-keyring
# OR for Ubuntu
sudo apt install ubuntu-archive-keyring

This installs the latest official signing keys for repository authentication.

If you absolutely need to proceed temporarily while troubleshooting, you can install packages without GPG verification using:

sudo apt-get install -y package-name --allow-unauthenticated

Or for a full update:

sudo apt-get update --allow-insecure-repositories

Warning: This bypasses security checks. Use only temporarily for troubleshooting, never as a permanent solution. Always import the GPG key instead (steps 2-4 above).