The most common cause for apt-get update failures on Kali Linux is an expired or missing repository signing key. Modern versions of Debian and Kali have deprecated the apt-key tool, meaning you must now manage keys via files in the /etc/apt/trusted.gpg.d/ directory. Reinstalling the kali-archive-keyring package usually resolves this issue immediately without needing manual key downloads.
Understanding the Error Context
When you runsudo apt-get update and encounter errors such as NO_PUBKEY or messages stating that a repository cannot be authenticated, it indicates that the system no longer trusts the GPG key used to sign the packages in the Kali repositories. This often happens after a major version upgrade, if the kali-archive-keyring package was accidentally removed, or if the system clock is incorrect, causing signature validation to fail.
It is critical to note that older tutorials may suggest using apt-key adv --keyserver ... to fix these issues. This approach is obsolete and will not work on current releases of Kali Linux (based on Debian 11 "Bullseye" or newer). The apt-key command has been removed from modern APT versions because managing keys globally was considered a security risk. Instead, keys must be stored as individual .gpg files in trusted directories. Attempting to use legacy methods can lead to further configuration errors or a broken package manager state.
Checking Your Kali Version
Before applying fixes, verify which version of Kali you are running. Open your terminal and execute:cat /etc/os-releaseVERSION_ID field. If you are on version 2023.x or later, you are definitely using a modern release where apt-key is unavailable. If you are on an extremely old version (like Kali 2019.x), upgrading is strongly recommended, as those versions are no longer supported and may have complex dependency issues that are difficult to resolve manually.
Solution 1: Reinstall the Keyring Package
The primary and most reliable solution is to ensure the official Kali archive keyring is correctly installed and up to date. This package contains the necessary public keys that allow APT to verify the integrity of packages downloaded from the official Kali repositories. Follow these steps carefully:- Update the package list cache: Even if the update failed, try to refresh the local cache by running
sudo apt update. Ignore any errors for a moment; we need to access the package database. - Reinstall the keyring: Execute the following command to force reinstall the keyring package:
sudo apt install --reinstall kali-archive-keyring- Verify the installation: After the command completes, run
sudo apt-get updateagain. If the keys were the problem, the update should now proceed without authentication errors.
Solution 2: Verify Repository Sources
If reinstalling the keyring does not solve the problem, the issue may lie in your sources list configuration. The file/etc/apt/sources.list defines where APT looks for software. In modern Kali, this file is often minimal, with most configurations handled via the kali.list file in /etc/apt/sources.list.d/.
Check if your sources list points to a valid mirror. You can view the active sources by running:
cat /etc/apt/sources.list.d/kali.listdeb http://http.kali.org/kali kali-rolling main non-free contrib. If you see references to old codenames like kali-2021.1, they must be changed to kali-rolling. Using specific point-release names in the rolling distribution can cause mismatches and update failures.
If you recently added third-party repositories, ensure their GPG keys are also placed in /etc/apt/trusted.gpg.d/. For example, if you added a custom repo, download its public key and save it as a .asc or .gpg file in that directory.
Handling Broken Dependencies
Sometimes, a failed update leaves the package database in an inconsistent state. If you see errors related todpkg or half-installed packages, you should clean up the state before retrying. Run the following commands in sequence:
sudo dpkg --configure -a
sudo apt --fix-broken install
sudo apt-get updateapt-get update from completing successfully.
Solution 3: Check System Clock and Network
GPG signature verification relies heavily on timestamps. If your system clock is significantly off—either ahead or behind—the digital signatures may appear invalid even if the keys are correct. Ensure your NTP service is running and synchronized. On Kali, this is typically managed bysystemd-timesyncd.
You can check the time synchronization status with:
timedatectl statussudo systemctl enable systemd-timesyncd
sudo systemctl start systemd-timesyncd8.8.8.8, temporarily to rule out DNS-related resolution issues.
For more advanced troubleshooting involving package manager corruption, you might need to address deeper system errors. See Fixing E: Sub-process /usr/bin/dpkg returned an error code (1) on Kali Linux for guidance on resolving low-level dpkg conflicts that can stem from interrupted updates.
Frequently Asked Questions
Why did my apt-get update stop working after a reboot?
This usually indicates that the system clock drifted during shutdown or that a background service failed to initialize properly. Check your hardware clock battery if the time resets frequently, and ensure thatsystemd-timesyncd is enabled to maintain accurate time upon boot.
Can I manually add a GPG key using wget?
While you can download a key file usingwget, you cannot use apt-key to import it. Instead, you must place the downloaded key file directly into the /etc/apt/trusted.gpg.d/ directory. APT will automatically recognize any GPG key stored in this folder as trusted for all repositories.
What should I do if I get a 404 Not Found error?
A 404 error means the requested package or metadata file does not exist at the specified URL. This often happens if you are using an outdated mirror or if the repository structure has changed. Switching to the mainhttp.kali.org mirror and ensuring you are using kali-rolling in your sources list typically resolves this issue.
Is it safe to ignore NO_PUBKEY errors?
No, ignoring these errors is a significant security risk. It allows APT to install packages without verifying their authenticity, potentially exposing your system to tampered or malicious software. Always resolve key errors by installing the proper keyring package or adding the correct public key to the trusted directory.How do I reset my apt configuration to defaults?
If your configuration is severely corrupted, you can back up your current sources list and restore the default one. Move your existingsources.list and kali.list files to a backup location, then recreate them with the standard Kali rolling repository lines. This forces APT to start fresh with known-good settings.