Fix GPG NO_PUBKEY Error on Ubuntu & Debian

When This Error Hits

You're adding a new software repository to Ubuntu 22.04 or Debian 12. Maybe you're setting up Microsoft's VS Code repo, or adding a third-party package source for Docker or PostgreSQL. You run sudo apt update and BAM — a red error:

W: GPG error: https://packages.microsoft.com/repos/code stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EB3E94ADBE1229CF

You wonder if your internet is broken or you messed something up. Don't worry, this is super common. I've seen this hundreds of times on forums.

Why It Happens

Here's the simple version. APT wants to make sure the packages you download come from who they say they come from. So it checks a digital signature (the GPG key) against a public key stored on your system. When you add a new repository, APT doesn't have that public key yet — so it throws NO_PUBKEY. The fix is to download the missing public key and add it to your trusted keys.

How to Fix It

You got two ways. The first one uses apt-key, which works on older systems (Ubuntu 20.04 and before). The second uses a newer method for Ubuntu 22.04+ and Debian 12. I'll show both, but skip apt-key if you're on recent systems — it's deprecated.

Method 1: Using apt-key (Quick but Deprecated)

1. Copy the error key — in my example it's EB3E94ADBE1229CF. Yours will be different.
2. Run this command:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys EB3E94ADBE1229CF
Then run sudo apt update again. Error should be gone.

Works fine, but apt-key is considered old. Newer distros warn you about it. Use method 2 if you care about following best practices.

Method 2: Using gpg and /etc/apt/keyrings (Modern Way)

1. First, create a keyrings directory if it doesn't exist:

sudo mkdir -p /etc/apt/keyrings
Download the key. Replace the key ID with yours:
sudo gpg --homedir /tmp --keyserver keyserver.ubuntu.com --recv-keys EB3E94ADBE1229CF
Export it to a file in the keyrings directory:
sudo gpg --homedir /tmp --export EB3E94ADBE1229CF | sudo tee /etc/apt/keyrings/microsoft.gpg > /dev/null
Now you need to update the repository's source file to point to this key. For example, if your repo is in /etc/apt/sources.list.d/vscode.list, edit it and change the line to include the signed-by option:
deb [signed-by=/etc/apt/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/code stable main
Clean up the temp GPG home:
sudo rm -rf /tmp/gnupg
Run sudo apt update — it should work now.

What If It Still Fails?

Sometimes the issue is the keyserver itself. The default keyserver (keyserver.ubuntu.com) can be flaky. Try using hkp://keys.gnupg.net instead. Or use a different server like keyserver.pgp.com.

Another thing: make sure the key ID is correct. GPG error messages show 16-character hex strings. Copy the whole thing exactly, no extra spaces.

If you're behind a corporate firewall, the keyserver might be blocked. In that case download the key directly from the repo owner's website. For example, Microsoft publishes their key on their docs page. Then import it manually:

sudo gpg --dearmor < downloaded-key.asc | sudo tee /etc/apt/keyrings/microsoft.gpg
Last resort: if you're absolutely sure the repo is safe (like from a trusted company), you can temporarily bypass the check with --allow-unauthenticated — but I don't recommend it for daily use. It disables all security checks.

My Take
I prefer the modern method with keyrings. It's cleaner and your system stays secure. The apt-key approach works but the command is being phased out. If you're setting up a new server in 2025, use method 2. It takes two more steps but it's the right way.