Linux · medium · Access, hardening & packages

"NO_PUBKEY" or "repository is not signed" — package updates refuse to run

The repository's signing key is missing, expired, or stored in a way the package manager no longer accepts.

What you see

apt update or dnf fails on one repository with a signature error, and every subsequent install refuses to proceed.

What is actually wrong

A rotated repository key, an expired one, or a key added with the deprecated apt-key mechanism that current releases no longer read.

Codes and articles

NO_PUBKEYThe following signatures couldn't be verifiedrepository is not signedGPG check FAILEDapt-key is deprecated

Fixes (2)

Install the key the modern way

Root shell20 minutesmedium riskreversible

apt reports NO_PUBKEY or an unsigned repository.

Identify which repository is failing and what key it wants.
Shell
```
sudo apt update 2>&1 | grep -E 'NO_PUBKEY|not signed|GPG error'
```
Get the key from the vendor's own HTTPS site — not from a keyserver, and not from a random search result.
Shell
```
curl -fsSL https://download.example.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/example-archive-keyring.gpg
```
This key decides which packages your machine will trust to install as root. Fetching it over HTTPS from the vendor is the only step that makes the whole signature mechanism worth anything — a key from an unverified source verifies nothing.
Point the source at that specific keyring rather than trusting it globally.
Shell
```
echo 'deb [signed-by=/usr/share/keyrings/example-archive-keyring.gpg] https://download.example.com/apt stable main' | sudo tee /etc/apt/sources.list.d/example.list
```
signed-by scopes the key to one repository. A key in the global trusted set can sign packages for every repository on the machine, which is exactly what the deprecation of apt-key was about.
Never use [trusted=yes] to silence this — it disables verification for that repository entirely.
Update and confirm.
Shell
```
sudo apt update
```

Confirm it workedapt update completes with no GPG errors.

Shell

sudo apt update 2>&1 | tail -5

If you need to undo itRemove the keyring file and the sources list entry.

Import the key for the RHEL family

Root shell20 minutesmedium riskreversible

dnf reports a failed GPG check.

See which repository and which key.

Shell

sudo dnf repolist -v | grep -E 'Repo-id|Repo-gpgkey'grep -r gpgkey /etc/yum.repos.d/

Import the key from the vendor's HTTPS location.

Shell

sudo rpm --import https://download.example.com/RPM-GPG-KEY-example

Check the fingerprint against what the vendor publishes before trusting it.
Shell
```
rpm -qa gpg-pubkey* --qf '%{summary} %{version}-%{release}\n'
```
Clear the metadata cache, which can hold the failed state.
Shell
```
sudo dnf clean allsudo dnf makecache
```
Do not set gpgcheck=0 in the repository file. It removes the guarantee that the packages came from the vendor at all.

Confirm it workeddnf check-update runs without a GPG error.

Shell

sudo dnf check-update | head

If you need to undo itsudo rpm -e gpg-pubkey-<id> removes an imported key.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.