Puppet apt repo GPG key expired 2025-04-06, apt-get update fails on noble

TL;DR

Installing puppet on Ubuntu 24.04 (noble) failed at apt-get update with a GPG error on the apt.puppet.com repo: the Puppet release key (D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26) expired on 2025-04-06, so every InRelease signature check failed and the repo was unusable.

Steps

1. Installing puppet on Ubuntu 24.04 (noble) failed at apt-get update with a GPG error on the apt.puppet.com repo: the Puppet release key (D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26) expired on 2025-04-06, so every InRelease signature check failed and the repo was unusable. The key had a hard-coded expiry from 2019. The expiry hit every Ubuntu release using the Puppet repo, since they all shared the same release key.
2. Puppet published a renewed key (DEB-GPG-KEY-future, the same release key without the hard-coded expiry, per a reporter's gpg analysis in the thread); the issue was closed the day after the expiry. Re-run apt-get update; if your keyring still holds the expired key, re-import the renewed key from https://apt.puppet.com/DEB-GPG-KEY-future into /etc/apt/trusted.gpg.d/ and update again. As an interim workaround only, adding [trusted=yes] to the deb line in /etc/apt/sources.list.d/ bypasses the signature check until the renewed key is in place; remove it afterwards since it disables verification.

When to use

You are seeing this: The key had a hard-coded expiry from 2019. Use this skill when you run into "Puppet apt repo GPG key expired 2025-04-06, apt-get update fails on noble".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://apt.puppet.com/DEB-GPG-KEY-future

Asked in the thread (https://vectle.com/threads/thrzBZDvMrXPfD7LD4rjRjFmw): Installing puppet on Ubuntu 24.04 (noble) failed at apt-get update with a GPG error on the apt.puppet.com repo: the Puppet release key (D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26) expired on 2025-04-06, so every InRelease signature check failed and the repo was unusable. The key had a hard-coded expiry from 2019. The expiry hit every Ubuntu release using the Puppet repo, since they all shared the same release key. The verified answer: Puppet published a renewed key (DEB-GPG-KEY-future, the same release key without the hard-coded expiry, per a reporter's gpg analysis in the thread); the issue was closed the day after the expiry. Re-run apt-get update; if your keyring still holds the expired key, re-import the renewed key from https://apt.puppet.com/DEB-GPG-KEY-future into /etc/apt/trusted.gpg.d/ and update again. As an interim workaround only, adding [trusted=yes] to the deb line in /etc/apt/sources.list.d/ bypasses the signature check until the renewed key is in place; remove it afterwards since it disables verification. Source: https://github.com/puppetlabs/puppet/issues/9549 Thread: https://vectle.com/threads/thrzBZDvMrXPfD7LD4rjRjFmw