I don't need the key in my server's keyring anymore. Is it possible to remove it? I added the key using this command:

 curl http://repo.varnish-cache.org/debian/GPG-key.txt | apt-key add -

Thanks for helping

  • I found this question useful because currently Ubuntu 18.04 GUI called Software & Updates-->Authentication don't seem to work (it can't remove any trusted software key). Instead, the cli cmds given below had to be used. – Sun Bear Aug 19 at 8:07

First you need to find the key id of the key you added. Do this by the command:

sudo apt-key list

It will list all the keys that you have, with each entry looking like this:

pub   1024R/B455BEF0 2010-07-29
uid                  Launchpad clicompanion-nightlies

Once you have figured out which key to remove, use the command sudo apt-key del <keyid> where <keyid> is replaced with the actual keyid of the key you want to remove from your keyring.

$ sudo apt-key del B455BEF0
$ apt-key list | grep clicompan
  • @Raymond No problemo :) – Nitin Venkatesh Feb 24 '12 at 20:15
  • 1
    Ah I see the unique Id is on the line labelled pub, not the line labelled uid. – ctrl-alt-delor Jun 21 '16 at 7:59
  • 6
    on ubuntu 16.10 results seems a little different : pub rsa4096 2012-05-11 [SC] 8439 .... uid .... – mxdsp Nov 6 '16 at 16:17
  • Looks like this needs to be updated for 18.04 – kennyB Feb 16 at 0:12
  • After deleting the key, I encountered a new problem The following signatures couldn't be verified because the public key is not available: NO_PUBKEY, what should I do next ? – Corey Aug 27 at 3:10

On 16.10 the short key id is no longer shown when you use the list command, but it is actually the last 8 characters of the long hex.

So for example the key id for the following key

pub   rsa4096 2012-05-11 [SC]
      8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092
uid           [ unknown] Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>

The key id will be EFE21092

  • 17
    Very helpful, thank you. This is extremely unhelpful UX. – SColvin May 18 '17 at 11:27
  • 11
    @SColvin you can just do sudo apt-key del "8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092" and I think it is safer to use the whole fingerprint, the keyid could have duplicates (at least when you use PGP for emails, I read you should share your whole fingerprint and not just the keyid). – baptx Dec 2 '17 at 12:14
  • 1
    Very helpful, very true also for 17.10! – Hartmut P. Apr 13 '18 at 21:15
  • 2
    And for 18.04.1. – Russ Bateman Oct 3 '18 at 20:45
  • Thank you. Awful design decision. – Brian Smith Mar 25 at 19:54

I made a short script to make things easier and using a string instead of the id.

You can use my script if the key contains a unique string you know.
e.g. in my case for webmin

pub   1024D/11F63C51 2002-02-28
uid                  Jamie Cameron <jcameron@webmin.com>
sub   1024g/1B24BE83 2002-02-28

I'm sure only the webmin key on my system has jcameron than I use this script to remove the according key.

I saved it as ~/removeAptKey

and run it as

sudo ./removeAptKey jcameron

The ouput should be something like

KEYID: 11F63C51

Here is my script:


function printKeys(){
    echo "Installed keys are"
    echo ""
    sudo apt-key list

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root" 1>&2
   exit 1

if [[ $# -eq 0 ]]
    echo "No key name provided"
    exit 1


sudo apt-key list | grep "${UNIQUE}" -B 1 > result.temp

LENGTH=$(cat result.temp | wc -l)

if [[ ${LENGTH} -gt 2 ]]
    echo "Attention you found more than 1 key. Use a more specific string."
    exit 2

if [[ ${LENGTH} != 2 ]]
    echo "Key not found. Doing nothing."
    exit 3

KEYID=$(cat result.temp | grep 'pub' | cut -d " " -f 4 | cut -d "/" -f 2)
echo "KEYID: "$KEYID

apt-key del ${KEYID}

rm result.temp

First I get the upper two lines of my key's block:

  • sudo apt-key list: lists the apt keys as usual
  • grep '${UNIQUE}' -B 1: take only the line containing the unique key string jcameron and -B 1 the line before
  • > result.temp: Save it in a file (which is later removed)

If this returns exactly 2 lines (-> got exactly 1 key) I move on:

  • grep 'pub': Now take only the line with the pup key id
  • cut -d " " -f 4: take the 4th word of that line (the first is pub than come two spaces, than the string we are after ``)
  • cut -d "/" -f 2: take only the part after /

And finally delete this key and cleanup

  • apt-key del ${KEYID} (in my case 11F63C51)
  • rm result.temp: don't need this file anymore
  • I ran this without a parameter and it just wiped out all my keys. ;( – Gabriel Fair Dec 21 '18 at 23:11
  • If anyone else has their keys wipped, I was able to fix it by following these instructions: askubuntu.com/a/145933/13693 – Gabriel Fair Dec 22 '18 at 2:29
  • Hu? How did this happen? It should exit with an "No key name provided" if there was no parameter.. – derHugo Dec 22 '18 at 10:49
  • @derHugo not sure but could it be that the # in that if clause is the culprit? – defuzed Apr 9 at 15:51
  • @defuzed if you mean $# then no. It returns the amount of given parameters. – derHugo Apr 9 at 17:51

I know I might be late, but just wanted to share this one-line command to achieve this.

NOTE: This will only work if the output is an unique key.

Ubuntu versions up to 16.04 (UPDATED 2018-12-22):

apt-key del $(apt-key list | awk 'NR=='$(apt-key list | grep --line-number --regexp "FOOBAR" | cut --fields 1 --delimiter ":")'{print;exit}' | awk '{print $2}' | cut --fields 2 --delimiter "/")

where FOOBAR is the UID name.

Ubuntu versions from 16.10:

apt-key del $(apt-key list | awk 'NR=='`expr $(apt-key list | grep --line-number --regexp "FOOBAR" | cut --fields 1 --delimiter ":") - 1`'{print;exit}')

where FOOBAR is the UID name.

  • 1
    I'm not sure why, but I got an error when I tried to run the 16.04 command you provided. awk: line 1: syntax error at or near { But the angle braces match, so I'm not sure why this doesn't work – Gabriel Fair Dec 21 '18 at 22:45
  • @GabrielFair Thanks for noticing, back in june it has been working (I copy-pasted it from my console) but now seems that has been updated and the apt-key list format has changed. Now it seems to be working again. (EDIT: Remember to run this as superuser) – David Tabernero M. Dec 22 '18 at 0:47

protected by Community Dec 21 '17 at 7:13

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.