All of the key-servers I visit are timing out. I need to install packages without checking the signatures of the public keys. Is there a way to bypass all the signature checks/ignore all of the signature errors or fool apt into thinking the signature passed?

I am very well aware it is dangerous to do this

  • 1
    Normally you would install the key locally at the same time as you add a repository, so why do you need to access the key-servers?
    – JanC
    Nov 1, 2011 at 11:45

6 Answers 6


Pass the --allow-unauthenticated option to apt-get as in:

sudo apt-get --allow-unauthenticated upgrade

From tha manual page of apt-get:

Ignore if packages can't be authenticated and don't prompt about it. This is useful for tools like pbuilder. Configuration Item: APT::Get::AllowUnauthenticated.

You can make this setting permanent by using your own config file at /etc/apt/apt.conf.d/ dir. The filename can be 99myown and it may contain this line:

APT::Get::AllowUnauthenticated "true";

In this way, you don't need to use the option every time you want to install software. Note: I do not recommend setting this option by default, it bypasses signature checks that could allow an adversary to compromise your computer.

  • 15
    For info: This work with apt-get but not with the plain apt command. Nov 21, 2016 at 13:38
  • 15
    Ubuntu 16.0 LTS. This doesn't work / has zero effect on anything
    – wvxvw
    Jan 2, 2019 at 9:47
  • 1
    Doesn't work on debian 10 either, see the answer below with Acquire:: Jul 23, 2021 at 1:40

If you are trying to get a package from a repository where they packaged the keys and include them within the repository and no where else, it can be very annoying to download and install the key/keyring package using dpkg, and very difficult to do so in an easily scriptable and repeatable manner.

The below script is not recommended if you can install the keys from a keyserver or download them from a trusted source via https, but if you don't have ANY other way, you can use this.

echo "deb http://your.repo.domain/repository/ $(lsb_release -c -s) universe" | sudo tee /etc/apt/sources.list.d/your-repo-name.list

sudo apt -o Acquire::AllowInsecureRepositories=true \
-o Acquire::AllowDowngradeToInsecureRepositories=true \

## if the 'apt update' above fails it is likely due to previously
## having the GPG key and repository on the system, you can clean
## out the old lists with `sudo rm /var/lib/apt/lists/your.repo.domain*`

apt-get -o APT::Get::AllowUnauthenticated=true install repo-keyring-pkgname

## If you ever run `sudo apt-key del your-repos-keyID`
## you may have to `sudo apt remove --purge repo-keyring-pkgname`
## Update should run without the GPG warnings now that the key is installed

apt-get update
apt-get install somepkg-from-repo

I originally put this together because i3 in their sur5r repo does this, but then I found out their keys are in the keyserver.ubuntu.com list, so I can just sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E3CA1A89941C42E6 and avoid all the extra package hassles.

  • Came here because of the i3 issue - sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E3CA1A89941C42E6 solved it! Thanks a lot! Apr 28, 2018 at 9:42
  • This is the only answer that will do for repositories which do not sign their keys. Feb 11, 2022 at 21:46

I ran in the same problem with an old debian server. I could not event make an

apt-get update

which gave me the following error :

E: Release file expired, ignoring http://archive.debian.org/debian/dists/squeeze-lts/Release (invalid since 1183d 0h 2min 51s)

Finally The solution was to add this :

Acquire::Check-Valid-Until false;

to /etc/apt/apt.conf (create it if it does not exist). After this, the error became a simple warning.

I Guess it might work on ubuntu too.

Please note that it is partially unsafe but still safer than disabling signature checks.

  • If it is that unsafe, then I suggest you don't post it at all. Jun 11, 2019 at 17:49
  • 11
    The safe way to do this is to upgrade the distro. In some complicated customer cases, you have no way to upgrade. And since the whole question is started with this disclaimer : 'I am very well aware it is dangerous to do this' i thought my contribution was appropriated. If not, i can remove it.
    – Gnusam
    Jun 12, 2019 at 9:01
  • 4
    This is an entirely appropriate solution.
    – Ken Sharp
    Dec 11, 2021 at 23:24
  • 1
    There is nothing wrong with forcing expired keys to continue to work. Expiration does not mean that keys were compromised. Only that somebody forgot to update them. But you still get signature checks.
    – Mitar
    Apr 28, 2023 at 16:28
  • 2
    This is less unsafe than disabling key checks. repos don't turn into a pumpkin at midnight. There's vast differences between the security posture of key expiry, key revoked, and key not in keyring. Browser behaviour teaches the wrong trust policy because browser trust policy is very broken.
    – Wil
    Aug 4, 2023 at 21:51

Maybe you can try to create the file /etc/apt/apt.conf (it will be read if you create it) and insert this code:

APT{Ignore {"gpg-pubkey"; }};
  • 6
    It doesn't work for me. But works when I added APT { Get { AllowUnauthenticated "1"; }; };
    – php-coder
    Apr 17, 2013 at 10:59
  • 1
    ubuntu 16.0 LTS: has no effect on whatever apt-get does.
    – wvxvw
    Jan 2, 2019 at 9:47

Create /etc/apt/apt.conf.d/99allow_unauth with this content:

APT { Get { AllowUnauthenticated "1"; }; };

Thanks to php-coder's comment.

Using this syntax in your sources.list file might also help:

deb [ allow-insecure=yes ] http...
  • 1
    It did not work on Ubuntu 22.04 Nov 16, 2022 at 13:31
  • You probably want [ trusted=yes ] in newer releases
    – Ken Sharp
    Feb 7 at 1:02

after keep trying around, this helps finally. Force update from unsigned repository

From newer versions of Ubuntu, instead of --allow-unauthenticated, --allow-insecure-repositories can be used.

In order to perform an update the command would be this

sudo apt-get update --allow-insecure-repositories

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .