Example threads. These questions and answers were written by the SDODS team to document real problems and how to fix them. The people named are illustrative, not real users. Questions asked on this site are marked new.
Key is installed, source is added, and apt still will not verify the index:
W: GPG error: https://sdods.com/apt stable InRelease: The following signatures couldn't be verified
because the public key is not available: NO_PUBKEY BED37DAF83087449
E: The repository 'https://sdods.com/apt stable InRelease' is not signed.I saved the key into /usr/share/keyrings/ and the file is definitely there. What am I missing?
Accepted answer
And if you used apt-key add from an older guide, that is the other cause. It is deprecated, and a key in the legacy global keyring is not consulted for a source that names signed-by. The two mechanisms do not see each other.
The full sequence, in the order it has to happen:
curl -fsSL https://sdods.com/apt/sdods-archive-keyring.gpg | sudo tee /usr/share/keyrings/sdods-archive-keyring.gpg > /dev/nullecho "deb [signed-by=/usr/share/keyrings/sdods-archive-keyring.gpg] https://sdods.com/apt stable main" | sudo tee /etc/apt/sources.list.d/sdods.listsudo apt updateThe fingerprint is published at https://sdods.com/apt/ so you can check the key you installed is the one signing the repository, which is worth doing once.
Almost certainly the format. apt reads binary keyrings from that directory, and an ASCII-armoured key saved there fails with an error that blames the signature rather than the format — which is exactly the message you have.
The published key is already in the binary form, so fetch that one rather than converting anything:
curl -fsSL https://sdods.com/apt/sdods-archive-keyring.gpg | sudo tee /usr/share/keyrings/sdods-archive-keyring.gpg > /dev/nullThen check your source line actually points signed-by at that exact path — a typo there produces the same NO_PUBKEY, because apt is looking in a keyring that does not exist.
Whatever you do, do not reach for [trusted=yes] to get past it. That disables signature checking for that source, and it is a very sticky line to leave in a sources file on a machine that installs other things.
Have a different question? Ask it.