Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I added some extra repositories with the Software Sources program. But when I reload the package database, I get an error like the following:

W: GPG error: trusty InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8BAF9A6F

I know I can fix it using apt-key in a terminal, according to the official Ubuntu documentation. But I would have liked to do it graphically. Is there a mean not to open a terminal?

share|improve this question
Related: – Wilf Jul 19 '15 at 20:46

10 Answers 10

up vote 102 down vote accepted

By far the simplest way to handle this now is with Y-PPA-Manager (which now integrates the launchpad-getkeys script with a graphical interface).

  1. To install it, first add the webupd8 repository for this program:

    sudo add-apt-repository ppa:webupd8team/y-ppa-manager
  2. Update your software list and install Y-PPA-Manager:

    sudo apt-get update
    sudo apt-get install y-ppa-manager
  3. Run y-ppa-manager (i.e. type y-ppa-manager then press enter key).

  4. When the main y-ppa-manager window appears, click on "Advanced."

  5. From the list of advanced tasks, select "Try to import all missing GPG keys" and click OK.

    You're done! As the warning dialog says when you start the operation, it may take quite a while (about 2 minutes for me) depending on how many PPA's you have and the speed of your connection.

share|improve this answer
The first reply that actually answers the question properly : how to do it via a gui and not the terminal. – comrademike Dec 4 '13 at 18:15
fyi, while adding the repo it outputs the link for more information. – Elijah Lynn Sep 3 '14 at 14:55
Not really useful in a webserver, as this installs X11. Don't use this method if you're on a server edition, check karthick87's answer! – Aprendiz Feb 11 at 20:13
sudo apt-get update produces error: W: GPG error: trusty InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 089EBE08314DF160 – Mitch Apr 3 at 18:40

Execute the following commands in terminal

sudo apt-key adv --keyserver --recv-keys <PUBKEY>

where <PUBKEY> is your missing public key for repository, e.g. 8BAF9A6F.

Then update

sudo apt-get update
share|improve this answer
man how to reverse this command it make a lot of Ign and didn't work see this : – Black Block Feb 19 '12 at 13:29
@Naruto That's normal. It means that list hasn't changed on the server. – hexafraction Aug 10 '12 at 15:50
You can simply pass NO_PUBKEY value as keys parameter. for example GPG error[...]NO_PUBKEY 3766223989993A70 => sudo apt-key adv --keyserver --recv-keys 3766223989993A70 – S.M.Mousavi Feb 19 '14 at 19:40
8BAF9A6F <-- where did you get that number? – Olivier Lalonde Mar 9 '14 at 12:49
The number 8BAF9... is what you see in the original error. It would be something like NO_PUBKEY 8BAF... – Alex Oct 10 '14 at 19:56

You need to get and import the key.

To get the key from a PPA, visit the PPA's Launchpad page. On every PPA page at Launchpad you will find this link (2), after clicking on 'Technical details about this PPA' (1):

Follow it and click on the key ID link (3):

Save the page, this is your key file.

Now it's time to import it:

  • Applications > Software Center,
  • Edit > Software sources...,
  • Enter your password,
  • Go to the Authentication tab and click on Import Key File..., finally
  • Select the saved key file and click on OK.

That's it.

share|improve this answer
Don't lost your time, see the answer bellow. – Felipe Micaroni Lalli Oct 17 '11 at 9:06
@FelipeMicaroniLalli, the question was how to add a pubkey using the GUI, not the terminal, so this answer was perfect. – Christopher Woods Jul 30 '13 at 14:24
It's much easier and faster now to do this with y-ppa-manager (also a gui application). See my answer below. – monotasker Dec 4 '13 at 15:53
OK, but what if the repository is not an ubuntu ppa. E.g. Intel run their own repository for video hardware drivers at – mc0e May 20 '15 at 15:39
Great step-by-step guide, thanks very much! really helpful for some one who failed to add key via apt-key. – Roy Ling Nov 10 '15 at 1:35

It happens when you don't have a suitable public key for a repository.

To solve this problem use this command:

gpg --keyserver hkp:// --recv 9BDB3D89CE49EC21

which retrieves the key from ubuntu key server. And then this:

gpg --export --armor 9BDB3D89CE49EC21 | sudo apt-key add -

which adds the key to apt trusted keys.

The solution can be found here & here & here.

share|improve this answer
If the hkp:// is not working use this server. – RajaRaviVarma Oct 30 '13 at 10:06

apt can only handle 40 keys in /etc/apt/trusted.gpg.d . 41 keys and you will get the GPG error "no public key found" even if you go through all the steps to add the missing key(s).

Check to see if there are any unused keys in this file from ppa(s) you no longer use. If all are in use, consider removing some ppa(s) along with the corresponding keyfiles in /etc/apt/trusted.gpg.d

Furthermore, using

sudo apt-key adv

Is considered a security risk and is not recommended as you are "undermining the whole security concept as this is not a secure way of recieving keys for various reasons (like: hkp is a plaintext protocol, short and even long keyids can be forged, …)".

I believe the correct way to add missing keys (for example 1ABC2D34EF56GH78) is

gpg --keyserver hkp:// --recv 1ABC2D34EF56GH78
gpg --export --armor 1ABC2D34EF56GH78 | sudo apt-key add -
share|improve this answer
I found it easier to just delete all keys from /etc/apt/trusted.gpg.d and then proceed to accepted answer – janot Feb 8 '15 at 18:22

There is a tiny script packaged in the WebUpd8 PPA which I'll link as a single .deb download so you don't have to add the whole PPA - which automatically imports all missing GPG keys.

Download and install Launchpad-getkeys (ignore the ~natty in its version, it works with all Ubuntu versions from Karmic all the way to Oneiric). Once installed, open a terminal and type:

sudo launchpad-getkeys

If you're behind a proxy, things are a bit more complicated so see this for more info

share|improve this answer
It is indeed the way I do now, since I saw this program presented on your website. Nevertheless, the aim of the question was to know how to do it in a graphical way. – Agmenor Jun 5 '11 at 22:34
The launchpad-getkeys script is now integrated into the program Y-PPA-manager. – monotasker Dec 4 '13 at 15:41

I faced the same issue while installing Heroku. The link below solved my problem -

After fixing the NO_PUBKEY issue, the below issue remained

W: GPG error: x ./ Release: The following signatures were invalid: BADSIG C927EBE00F1B0520 Heroku Release Engineering <>

To fix it I executed the following commands in terminal:

sudo -i  
apt-get clean  
cd /var/lib/apt  
mv lists lists.old  
mkdir -p lists/partial  
apt-get clean  
apt-get update  

Source - Link to solve it

share|improve this answer

More generally, the following method should work for every repository. First of all search, with eventual help of a search engine, for a text on the program provider's website looking like the following:

Version: GnuPG v1.4.1 (GNU/Linux)

Such a text is for example displayed on Copy the passage, paste it in an empty file that you create on your desktop. This results in the key file.

Then continue with the importation of the key:

  • Applications > Sofware Center
  • Edit > Sofware sources..., enter password
  • Authentication tab, click on 'Import Key File...'
  • Select the saved key file and click on 'Ok'.

You may now remove the previously created key file.

share|improve this answer

Good! I finaly found the way!

I've tested all method's to fix GPG error NO_PUBKEY and nothing working for me.

I've deleted the entire contents of the folder /etc/apt/trusted.gpg.d

cd /etc/apt/trusted.gpg.d
sudo rm -R *
sudo apt-get update

And I use the Y-PPA-Manager method because I'm too lazy to create all pubkey's manually (too many):

run sudo apt-get update again and finaly all work great now! Tanks!

Based Source : post #17 on

share|improve this answer

I had the same problem with DynDNS's Updater client.

Turns out it was just expired keys.

Reinstalling the software (downloading a new .deb from the website, then using Software Centre to reinstall) fixed the problem.

Error message for reference:

W: GPG error: stable/ Release: The following signatures were invalid: KEYEXPIRED 141943.......
share|improve this answer

protected by jokerdino Dec 4 '13 at 18:09

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.