NO_PUBKEY on apt update even though I installed the SDODS key

Asked 19 Aug 2026780 views3 answers

7votes

Key is installed, source is added, and apt still will not verify the index:

text

W: GPG error: https://sdods.com/apt stable InRelease: The following signatures couldn't be verified
because the public key is not available: NO_PUBKEY BED37DAF83087449
E: The repository 'https://sdods.com/apt stable InRelease' is not signed.

I saved the key into /usr/share/keyrings/ and the file is definitely there. What am I missing?

install linux

asked by Chandra Pillai873 · 19 Aug 2026

3 answers

11votes✓
Accepted answer
And if you used apt-key add from an older guide, that is the other cause. It is deprecated, and a key in the legacy global keyring is not consulted for a source that names signed-by. The two mechanisms do not see each other.
The full sequence, in the order it has to happen:
bash
```
curl -fsSL https://sdods.com/apt/sdods-archive-keyring.gpg | sudo tee /usr/share/keyrings/sdods-archive-keyring.gpg > /dev/null
```
bash
```
echo "deb [signed-by=/usr/share/keyrings/sdods-archive-keyring.gpg] https://sdods.com/apt stable main" | sudo tee /etc/apt/sources.list.d/sdods.list
```
bash
```
sudo apt update
```
The fingerprint is published at https://sdods.com/apt/ so you can check the key you installed is the one signing the repository, which is worth doing once.
answered by Daniel Oyelaranmaintainer24,177 · 19 Aug 2026
8votes
Almost certainly the format. apt reads binary keyrings from that directory, and an ASCII-armoured key saved there fails with an error that blames the signature rather than the format — which is exactly the message you have.
The published key is already in the binary form, so fetch that one rather than converting anything:
bash
```
curl -fsSL https://sdods.com/apt/sdods-archive-keyring.gpg | sudo tee /usr/share/keyrings/sdods-archive-keyring.gpg > /dev/null
```
Then check your source line actually points signed-by at that exact path — a typo there produces the same NO_PUBKEY, because apt is looking in a keyring that does not exist.
answered by Lars Vinter276 · 19 Aug 2026
3votes
Whatever you do, do not reach for [trusted=yes] to get past it. That disables signature checking for that source, and it is a very sticky line to leave in a sources file on a machine that installs other things.
answered by Bruno Teixeira694 · 24 Aug 2026

Have the same question?

Ask it with the command you ran and the output you got, and it will be answered here.

Ask a question

NO_PUBKEY on apt update even though I installed the SDODS key

3 answers

Related