How to Fix ‘GPG Error: The Following Signatures Couldn’t Be Verified’ in Ubuntu

When running sudo apt update on Ubuntu, encountering the terminal warning W: GPG error: [Repository URL] InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY [Key-ID] prevents the Advanced Package Tool (APT) from validating repository integrity. Because modern Debian and Ubuntu distributions enforce strict cryptographic signature verification to protect systems against malicious package tampering, APT flags unsigned or unverified archives as untrusted and refuses to download updates from them. Resolving this error involves retrieving the missing public signing key from authoritative keyservers and importing it using modern, secure trusted.gpg.d keyring standards.

Why GPG Verification Errors Occur in Ubuntu

Every official and third-party software repository signs its package index files (InRelease or Release.gpg) with a private cryptographic key. When your system synchronises package lists, APT hashes the release manifest and verifies the signature using the corresponding public key stored in your local GPG keyring. If a repository rotates its signing keys, if you add a new PPA without importing its certificate, or if an outdated system key was deprecated, APT cannot verify authenticity and raises the NO_PUBKEY error code.

Common triggers of GPG verification errors include:

• Missing Public Keys Following PPA Addition: Manually appending repository URLs to /etc/apt/sources.list without executing key importing steps. For repository fetch issues, see our guide on fixing Failed to Download Repository Information in Ubuntu.
• Deprecation of apt-key: Ubuntu 22.04 LTS and 24.04 LTS deprecating the legacy apt-key add command, which stored all keys in a single insecure global /etc/apt/trusted.gpg keyring. For package status errors, see our guide on fixing dpkg error parsing file status in Ubuntu.
• Key Expiration and Security Rotation: Maintainers of third-party software (such as Google Chrome, Spotify, or NodeSource) publishing updated keys when older certificates expire.
• Firewall or Network Proxy Blocking Port 11371: Strict corporate firewalls intercepting standard HKP keyserver traffic during key downloads.

Keyring Architecture	Storage Location	Current Security Status
Legacy Global Keyring (apt-key)	/etc/apt/trusted.gpg	Deprecated (Permits any key to sign any package)
Modern Shared Directory	/etc/apt/trusted.gpg.d/*.gpg	Standard supported format (Independent key files)
Scoped Dedicated Keyring (Best Practice)	/etc/apt/keyrings/*.gpg	Recommended (Key strictly scoped to specific repository line)

Method 1: Import the Missing Public Key Directly via Keyserver

The fastest way to resolve a specific NO_PUBKEY error is querying Ubuntu’s official keyserver over secure HTTPS and placing the armored key directly into /etc/apt/trusted.gpg.d/.

1. Observe the exact 16-character or 8-character hexadecimal Key ID displayed in the terminal error (e.g., NO_PUBKEY 7EA0A9C3F273FCD8).
2. Open your terminal (Ctrl + Alt + T) and execute the key import command:
   sudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/imported-key.gpg --keyserver keyserver.ubuntu.com --recv-keys [KEY-ID]
   (Replace [KEY-ID] with the exact hexadecimal string from your error message).
3. If the keyserver connection times out due to firewall restrictions, force the download over standard HTTPS port 443:
   sudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/imported-key.gpg --keyserver hkps://keyserver.ubuntu.com:443 --recv-keys [KEY-ID]
4. Update your package lists:
   sudo apt update

Method 2: Use Modern Keyring Storage (/etc/apt/keyrings)

Modern Debian and Ubuntu security guidelines recommend placing repository keys into /etc/apt/keyrings/ and referencing the key explicitly inside the .sources file.

1. Ensure the dedicated keyrings directory exists with proper permissions:
   sudo install -m 0755 -d /etc/apt/keyrings
2. Download and dearomor the repository’s official ASCII-armored key directly into the folder:
   curl -fsSL [Key-URL] | sudo gpg --dearmor -o /etc/apt/keyrings/[repo-name].gpg
   (Example for Docker: curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg).
3. Reference the key file directly in the repository source line using the signed-by tag:
   deb [arch=amd64 signed-by=/etc/apt/keyrings/[repo-name].gpg] https://repo.example.com/ubuntu $(lsb_release -cs) stable
4. Run sudo apt update to verify that the cryptographic signature resolves cleanly.

Method 3: Batch Import All Missing APT Keys via One-Liner

If your system returns multiple NO_PUBKEY warnings across several third-party repositories simultaneously, you can parse and import all missing keys in a single automated command.

1. Open your terminal.
2. Execute the following combined pipe to extract all missing keys from apt-get update output and import them automatically:
   sudo apt-get update 2>&1 | sed -ne "s?^.*[[:space:]]NO_PUBKEY[[:space:]]{1,}([0-9A-F]{16}).*$?\1?p" | sort -u | xargs -r -n 1 sudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/batch-keys.gpg --keyserver hkps://keyserver.ubuntu.com:443 --recv-keys
3. Wait for the command to finish querying the keyserver for each identified key ID.
4. Execute sudo apt update. All repositories will now report valid cryptographic signatures.

Method 4: Re-install the Ubuntu Archive Keyring Package

If GPG errors occur when updating core official Ubuntu repositories (such as archive.ubuntu.com or security.ubuntu.com), your local master distribution keyring is corrupted.

1. Reinstall the official master distribution keyring:
   sudo apt-get install --reinstall ubuntu-keyring
2. Ensure that file permissions on the trusted keyring directories are globally readable:
   sudo chmod 644 /etc/apt/trusted.gpg.d/*.gpg
3. Rerun sudo apt update to confirm the core signatures pass verification.

Method 5: Remove Obsolete or Abandoned Repository Sources

If a third-party project has been archived, discontinued, or abandoned by its author, its signing keys may no longer exist on public keyservers.

1. Navigate to the software sources directory:
   cd /etc/apt/sources.list.d/
2. List all active third-party repository definition files:
   ls -l
3. Identify the .list or .sources file matching the failing repository.
4. Remove the abandoned repository file:
   sudo rm [abandoned-repository].list
5. Run sudo apt update. The error will disappear, allowing your package manager to function cleanly.