Error during apt-get update: Signature verification failed (screen recording)

Resolving the "GPG error: public key is not available" during apt-get update on Ubuntu requires importing the missing signing key into the trusted APT keyring. The modern, non-deprecated approach involves downloading the specific key ID and placing it in /etc/apt/trusted.gpg.d/ or configuring the repository source to use a dedicated keyring file with the signed-by option. This ensures package integrity verification succeeds without relying on legacy methods.

Understanding the GPG Signature Error

When you run sudo apt-get update, the Advanced Package Tool (APT) verifies the authenticity of software repositories using GNU Privacy Guard (GPG). Each repository publishes a Release file signed by a private key, which corresponds to a public key stored on your system. If the public key for a specific repository is missing from your local keyring, APT cannot verify that the package list has not been tampered with. Consequently, it halts the process and displays an error similar to:

W: GPG error: http://in.archive.ubuntu.com/ubuntu jammy InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 4097BB3211F92394
E: The repository 'http://in.archive.ubuntu.com/ubuntu jammy InRelease' is not signed.

This issue frequently arises after a fresh installation, when switching between different Ubuntu versions (such as moving from Jammy Jellyfish to Kinetic Kudu), or when adding third-party Personal Package Archives (PPAs) that require manual key management. It is critical to address this promptly because running updates with unverified sources poses a significant security risk, potentially exposing your system to malicious code.

Step-by-Step Solution: Importing the Missing Key

The most reliable fix for the error cited above involves fetching the missing public key directly from Ubuntu's keyserver and storing it in the appropriate directory. We will use the key ID provided in the error message: 4097BB3211F92394. Note that you should always replace this ID with the one specific to your error log. First, open your terminal. You need to download the key using gpg and convert it into a format that APT can read. Execute the following command to fetch the key from the Ubuntu keyserver and save it to the trusted keyring directory:

sudo gpg --keyserver keyserver.ubuntu.com --recv-keys 4097BB3211F92394
sudo gpg --export --armor 4097BB3211F92394 | sudo tee /etc/apt/trusted.gpg.d/ubuntu-archive-keyring.gpg

In this sequence, the first command retrieves the key from the remote server. The second command exports the key in ASCII armor format and pipes it into a new file within /etc/apt/trusted.gpg.d/. This directory is automatically scanned by APT for trusted keys. By saving it here, you avoid modifying the main global keyring, keeping your system configuration cleaner and more modular. After executing these commands, you must refresh your package lists to apply the changes. Run:

sudo apt-get update

If the import was successful, the previous warning about the missing signature should disappear, and the update process will complete normally.

Alternative Approach: Using Signed-By in Sources List

While importing into the global trusted keyring works, the modern best practice for managing repositories, especially PPAs, is to use the signed-by option in the sources.list file or files within /etc/apt/sources.list.d/. This method restricts the key usage to only the specific repository, enhancing security by preventing key reuse across unrelated packages. To implement this, you would typically create a separate keyring file for the repository. For example, if you are dealing with a specific PPA, you might save its key to /usr/share/keyrings/ppa-name.gpg. Then, modify the corresponding .list file to include the [signed-by=/usr/share/keyrings/ppa-name.gpg] tag in the deb line. However, for standard Ubuntu archive errors like the one described, the /etc/apt/trusted.gpg.d/ method is sufficient and less prone to syntax errors in source definitions. For users encountering similar issues on different Ubuntu versions, such as kernel update errors in Ubuntu 23.10 or WSL-specific update failures, the underlying principle remains the same: ensuring the cryptographic keys match the repository metadata. See our guide on Ubuntu 23.10: Error Updating Kernel for context on version-specific repository quirks. Additionally, if you are managing multiple PPAs, understanding how to handle purge errors is essential, as detailed in Fixing PPA Purge Errors in Ubuntu.

Troubleshooting Common Variations

Sometimes, the error persists even after importing the key. This can happen due to network proxies blocking the keyserver, incorrect key IDs, or cached data in APT. 1. Verify the Key ID: Double-check the key ID in the error message. Ensure there are no typos. The ID is usually 8 hexadecimal characters long, but sometimes longer strings appear; use the full string if provided. 2. Check Network Connectivity: Ensure your system can reach keyserver.ubuntu.com. If you are behind a corporate firewall, you may need to configure gpg to use a proxy or use an alternative keyserver like hkps://keys.openpgp.org. 3. Clear APT Cache: Occasionally, corrupted cache files can cause persistent errors. You can clean the cache with sudo apt-get clean and then retry the update. 4. Check System Date: An incorrect system date can cause SSL/GPG verification failures because certificates appear expired or not yet valid. Verify your date and time settings using timedatectl. If you are experiencing unmet dependencies alongside this issue, it may indicate a broader repository mismatch. Refer to Solving Ubuntu Unmet Dependencies Error for comprehensive strategies on resolving dependency conflicts that often accompany signature failures.

Frequently Asked Questions

Is it safe to ignore the GPG error and force update?

No, ignoring signature verification is highly unsafe as it disables the check for package integrity. You should never use flags like --allow-unauthenticated unless you are absolutely certain of the source's trustworthiness, which is rare for official archives. Always resolve the key issue to maintain system security.

Why does this error happen on a fresh Ubuntu install?

This typically occurs if the initial setup did not fully complete the keyring initialization, or if you manually edited sources.list before installing the necessary ubuntu-keyring package. It can also happen if you are using a minimal installation that lacks default repository configurations.

How do I find the correct keyserver URL?

The primary keyserver for Ubuntu is keyserver.ubuntu.com. Other reliable options include hkps://keys.openpgp.org or pgp.mit.edu. If one server is unreachable, try another, but ensure they host the Ubuntu project keys.

Can I remove the key and re-add it?

Yes, if you suspect the imported key is corrupted, you can delete the file in /etc/apt/trusted.gpg.d/ associated with that key and re-run the import command. This ensures a clean slate for the cryptographic verification process.

What if the error mentions a different repository like Launchpad?

If the error originates from a PPA hosted on Launchpad, the key management process is similar but the key ID will belong to the specific PPA maintainer. You should consult the PPA's documentation for the exact import command, as they often provide a snippet tailored to their specific key.