Download PGP Keys with Apt-key

This page used to show apt-key adv --keyserver keyserver.ubuntu.com --recv-keys <ID>, the one-liner that fetched a repository’s signing key into apt’s single trusted keyring. That design was the problem: a key in trusted.gpg could sign any repository, so a compromised PPA key could serve you a fake libc6. apt 2.2 (Debian 11, Ubuntu 22.04) deprecated apt-key with a warning on every call, and apt 3.x (Ubuntu 26.04) removed it altogether. The replacement is one keyring file per repository, referenced from that repository’s source entry, and it takes about as many keystrokes.

1. Put the key in /etc/apt/keyrings

Most vendors publish the key at a URL. Download it into a binary keyring (--dearmor converts the ASCII-armored form apt cannot read):

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

If all you have is a key ID on a keyserver, the 2009 use case, fetch it with gpg into your own keyring and export it as a file:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 871920D1991BC93C
gpg --export 871920D1991BC93C | sudo tee /etc/apt/keyrings/example.gpg > /dev/null

Check whose key you just trusted before going further:

gpg --no-default-keyring --keyring /etc/apt/keyrings/docker.gpg --list-keys

uid           [ unknown] Docker Release (CE deb) <docker@docker.com>

2. Point the repository at that key

The DEB822 format (.sources files) is the current one and has a Signed-By: field for exactly this:

sudo tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Signed-By: /etc/apt/keyrings/docker.gpg
EOF

The old one-line .list format still works on every supported release with the same key in brackets:

deb [signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu noble stable

3. Update and confirm

sudo apt-get update
apt-cache policy docker-ce

Get:1 https://download.docker.com/linux/ubuntu resolute InRelease [32.5 kB]
Get:3 https://download.docker.com/linux/ubuntu resolute/stable amd64 Packages [34.9 kB]
docker-ce:
  Installed: (none)
  Candidate: 5:29.9.1-1~ubuntu.26.04~resolute

No NO_PUBKEY error and a candidate version means the key, the file and the suite line up. The key is now trusted for this repository only.

PPAs

For Launchpad PPAs you still do not do any of this by hand: sudo add-apt-repository ppa:owner/name (package software-properties-common) downloads the PPA’s key into /etc/apt/keyrings and writes the .sources file itself.

Clean up old apt-key keys

On 22.04 and 24.04, apt-key list shows keys still sitting in the legacy keyring; each one is trusted for every repository until you move it. Export it to a file as above, add Signed-By, then sudo apt-key del <ID>. On 26.04 the command is gone, and leftover /etc/apt/trusted.gpg entries are simply ignored, which is why a repository that “used to work” starts failing with NO_PUBKEY after the upgrade.

When adding third party software repositories to your APT sources list, you can easily download a referenced PGP key to your APT keyring using the advanced options of the apt-key utility.

For example, if you are adding a third party repository that references the PGP key ID of 6E80C6B7, the following will work as long as the key has been uploaded to a keyserver.

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6E80C6B7

gpg: requesting key 6E80C6B7 from hkp server keyserver.ubuntu.com

gpg: key 6E80C6B7: public key "Launchpad PPA for Banshee Team" imported

gpg: no ultimately trusted keys found

gpg: Total number processed: 1

gpg: imported: 1 (RSA: 1)

Typically, instructions on adding repositories give readers a two or three step process that involves apt-key reading a key from a text file or piped from a wget command. The above just cuts all that nonsense out.

The **apt-key** man page is a bit bare, but there are a few other options you might find interesting that are only mentioned in the commands help output.

apt-key

Usage: apt-key [command] [arguments]
Manage apt's list of trusted keys
apt-key add - add the key contained in ('-' for stdin)

apt-key del - remove the key

apt-key export - output the key

apt-key exportall - output all trusted keys

apt-key update - update keys using the keyring package

apt-key net-update - update keys using the network

apt-key list - list keys

apt-key finger - list fingerprints

apt-key adv - pass advanced options to gpg (download key)