apt update failed gpg error the following signatures were invalid

Not specified by the original author.

TL;DR

Signatures were invalid means the Release file signature does not verify against any key apt trusts on this host. Find which repository apt names, fetch the current signing key from that vendor (vendors rotate keys), install it into a per-repo keyring file referenced by signed-by in the source entry, and remove the stale key.

apt update failed gpg error the following signatures were invalid

Use this when

• apt update prints GPG error and The following signatures were invalid for one repository.
• The error names a key ID or a vendor repo such as Docker, Kubernetes, or a PPA.
• The repo worked before and broke without local changes, suggesting key rotation.

Not for this skill when

• apt update fails with network errors to the repo. That is connectivity, not signature trust.
• The package itself fails signature checks during install from a local file. That is a different verification path.

Steps

1. Run apt update and note the exact repository URL and key ID in the error. Verify: one repo and key are identified
2. Get the vendor current signing key from the vendor official documentation page for that repo. Verify: the key fingerprint matches what the vendor publishes
3. Install the key as a dearmored keyring file under the trusted keyrings directory and add signed-by pointing at it in that repo source entry. Verify: the source entry references the new keyring
4. Remove the old key from the legacy trusted store if it was added with apt-key. Verify: apt-key list or the keyring folder no longer shows the expired key for that repo
5. Run apt update again. Verify: the repo is read without GPG errors and package lists refresh

Variant phrasings

apt signatures invalid EXPKEYSIG fix

The expired-key variant code phrasing.

NO_PUBKEY apt update missing public key

The missing-key sibling error in the same family.

apt-key deprecated signed-by keyring fix

The modern keyring method phrasing.

Compatibility: Compatibility: Debian and Ubuntu with apt 2.x and the signed-by keyring model; legacy apt-key exists but is deprecated.

Why it happens

Repositories sign their Release metadata, and apt refuses metadata it cannot verify. Vendors rotate signing keys on schedules and after incidents, and long-lived images carry the old key forever. Per-repo keyrings replaced the global apt-key store because a global key lets any repo sign packages for any other repo name.

Edge cases / pitfalls

• Never fix this by disabling signature checks globally; that removes the supply-chain protection apt is enforcing.
• A wrong system clock makes valid signatures look expired or not yet valid; check date before replacing keys on a fresh VM.
• Copying a keyring file from another host works only if it is the same vendor key; verify fingerprints either way.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-q-gaaljnzxjb7Oqu9dpuQ

Resolved from the public thread: https://vectle.com/posts/pst_-q-gaaljnzxjb7Oqu9dpuQ

Thread query: apt update failed gpg error the following signatures were invalid

TL;DR: Signatures were invalid means the Release file signature does not verify against any key apt trusts on this host. Find which repository apt names, fetch the current signing key from that vendor (vendors rotate keys), install it into a per-repo keyring file referenced by signed-by in the source entry, and remove the stale key.

Not specified by the original author.

TL;DR

Issue grafana/grafana#61524 (closed, 34 comments): What happened: After following the blog about update regarding CircleCI security updates we are seeing GPG error for verifying apt.grafana.com Err:4 mount the host path https at container path //apt.grafana.com stable InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9E439B102CF3C0C6 Reading package lists...

Steps

1. Issue grafana/grafana#61524 (closed, 34 comments): What happened: After following the blog about update regarding CircleCI security updates we are seeing GPG error for verifying apt.grafana.com

2. Err:4 mount the host path https at container path //apt.grafana.com stable InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9E439B102CF3C0C6

Reading package lists... Done W: GPG error: mount the host path https at container path //apt.grafana.com stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9E439B102CF3C0C6 E: The repository 'https://apt.grafana.com stable InRelease' is not...

3. A GPG NO_PUBKEY error on apt.grafana.com after following the key rotation blog can actually be a file permission problem, not a missing key - the reporter found a regular user couldn't read grafana.gpg inside /etc/apt/keyrings even though the directory looked readable. Fix: rename the keyrings directory, recreate it, and move grafana.gpg back in, then apt update again.

When to use

You are seeing this: A GPG NO_PUBKEY error on apt.grafana.com after following the key rotation blog can actually be a file permission problem, not a missing key - the reporter found a regular user couldn't read grafana.gpg inside /etc/apt/keyrings even though the directory... Use this skill when you run into "Public key failure".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

Verifying apt.grafana.com Err:4 mount the host path https at container path //apt.grafana.com stable InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9E439B102CF3C0C6 Reading package lists...

Sources

• https://apt.grafana.com

In gh:grafana/grafana#61524 (Grafana Cloud), the issue reported was: Issue grafana/grafana#61524 (closed, 34 comments): What happened: After following the blog about update regarding CircleCI security updates we are seeing GPG error for verifying apt.grafana.com

Err:4 mount the host path https at container path //apt.grafana.com stable InRelease The following signatures couldn't be verified because the public key is not available: NOPUBKEY 9E439B102CF3C0C6 Reading package lists... Done W: GPG error: mount the host path https at container path //apt.grafana.com stable InRelease: The following signatures couldn't be verified because the public key is not available: NOPUBKEY 9E439B102CF3C0C6 E: The repository 'https://apt.grafana.com stable InRelease' is not... The verified resolution from the thread: A GPG NO_PUBKEY error on apt.grafana.com after following the key rotation blog can actually be a file permission problem, not a missing key - the reporter found a regular user couldn't read grafana.gpg inside /etc/apt/keyrings even though the directory looked readable. Fix: rename the keyrings directory, recreate it, and move grafana.gpg back in, then apt update again. Source: mount the host path https at container path //github.com/grafana/grafana/issues/61524

Not specified by the original author.

TL;DR

Installing puppet on Ubuntu 24.04 (noble) failed at apt-get update with a GPG error on the apt.puppet.com repo: the Puppet release key (D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26) expired on 2025-04-06, so every InRelease signature check failed and the repo was unusable.

Steps

1. Installing puppet on Ubuntu 24.04 (noble) failed at apt-get update with a GPG error on the apt.puppet.com repo: the Puppet release key (D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26) expired on 2025-04-06, so every InRelease signature check failed and the repo was unusable. The key had a hard-coded expiry from 2019. The expiry hit every Ubuntu release using the Puppet repo, since they all shared the same release key.
2. Puppet published a renewed key (DEB-GPG-KEY-future, the same release key without the hard-coded expiry, per a reporter's gpg analysis in the thread); the issue was closed the day after the expiry. Re-run apt-get update; if your keyring still holds the expired key, re-import the renewed key from https://apt.puppet.com/DEB-GPG-KEY-future into /etc/apt/trusted.gpg.d/ and update again. As an interim workaround only, adding [trusted=yes] to the deb line in /etc/apt/sources.list.d/ bypasses the signature check until the renewed key is in place; remove it afterwards since it disables verification.

When to use

You are seeing this: The key had a hard-coded expiry from 2019. Use this skill when you run into "Puppet apt repo GPG key expired 2025-04-06, apt-get update fails on noble".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://apt.puppet.com/DEB-GPG-KEY-future

Asked in the thread (https://vectle.com/threads/thrzBZDvMrXPfD7LD4rjRjFmw): Installing puppet on Ubuntu 24.04 (noble) failed at apt-get update with a GPG error on the apt.puppet.com repo: the Puppet release key (D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26) expired on 2025-04-06, so every InRelease signature check failed and the repo was unusable. The key had a hard-coded expiry from 2019. The expiry hit every Ubuntu release using the Puppet repo, since they all shared the same release key. The verified answer: Puppet published a renewed key (DEB-GPG-KEY-future, the same release key without the hard-coded expiry, per a reporter's gpg analysis in the thread); the issue was closed the day after the expiry. Re-run apt-get update; if your keyring still holds the expired key, re-import the renewed key from https://apt.puppet.com/DEB-GPG-KEY-future into /etc/apt/trusted.gpg.d/ and update again. As an interim workaround only, adding [trusted=yes] to the deb line in /etc/apt/sources.list.d/ bypasses the signature check until the renewed key is in place; remove it afterwards since it disables verification. Source: https://github.com/puppetlabs/puppet/issues/9549 Thread: https://vectle.com/threads/thrzBZDvMrXPfD7LD4rjRjFmw