Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have this going on:

# apt-get update
Get:1 etch Release.gpg [1032B]                     
Hit etch Release                                        
(...bunch more of this elided...)
Hit etch/contrib Sources
Fetched 68.8kB in 1s (37.4kB/s)
Reading package lists... Done
W: There is no public key available for the following key IDs:
W: GPG error: etch Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9AA38DCD55BE302B
W: You may want to run apt-get update to correct these problems

Apparently I can't run apt-get update because of a problem that apt-get wants me to run apt-get update to fix, which is displeasing. How do I correct this?

share|improve this question
up vote 15 down vote accepted

Try doing this and running apt-get again:

apt-key update

apt-key is a program that is used to manage a keyring of gpg keys for secure apt. The keyring is kept in the file /etc/apt/trusted.gpg (not to be confused with the related but not very interesting /etc/apt/trustdb.gpg). apt-key can be used to show the keys in the keyring, and to add or remove a key.

Further info on the Debian wiki:

If that doesn't work, try:

gpg --keyserver --recv-keys 9AA38DCD55BE302B
apt-key add /root/.gnupg/pubring.gpg
apt-get update
share|improve this answer
Tried it; no change. :( – chaos Jun 5 '09 at 18:53
Second option did it. Thanks! – chaos Jun 5 '09 at 19:00
apt-key update only does something if the package debian-archive-keyring is installed. It's not needed in general, the package installation updates APT's keyring automatically. The second suggestion is not very safe as you don't verify that the key belong to the Debian project. You should really check its signatures before enabling it. Furthermore adding the whole keyring is bad, you only want the newly downloaded key so “gpg --export 9AA38DCD55BE302B | apt-key add -” would have been better... – Raphaël Hertzog Jun 6 '09 at 10:56

or do a sudo apt-get install debian-archive-keyring first.

after that you can continue a normaly

share|improve this answer
This solved the problem for me on an ancient Etch server, with repository definitions pointing to – Amos Shapira Nov 20 '11 at 23:57
Can confirm this works on old etch on ppc – Ross W Oct 15 '13 at 22:25

To ensure the origin of package that you download, APT will want to verify the signatures of the Release file. If it can't verify it, it will complain with the message that you saw. In that case, you have to install the corresponding GPG key so that APT can verify the file properly. Unfortunately you should not blindly download any key as you really want to allow only trusted keys that are owned by the repository owner. Thus you must download it in a way that ensures its origin, and simply downloading it with gpg --recv-key doesn't ensure that.

Installing a new key is done with apt-key add <key-file>. Most non-official repositories provide you the key on their website and give you instructions like this (the URL differs of course) :

wget -O - | sudo apt-key add -

In the case of an official Debian mirror, you should automatically have the right key installed, it's contained in the package debian-archive-keyring and its configuration activates the keys automatically. So ensure you have it installed, and ensure it's up-to-date:

apt-get install debian-archive-keyring

If you don't trust your mirror, you can also install it only after having installed the right key with the previous method, I actually gave the URL of the official key that you needed.

For more infos about how the Debian Archive Keys are handled you can check

share|improve this answer

I had the same problem on Juanty 9.04 64 bit. Tried several suggestions but this did the trick :

wget -O - | sudo apt-key add -

The do :

sudo apt-get update



share|improve this answer

I had this problem due to a transparent proxy giving me an old version of the GPG key, I solved it by using wget to force the proxy to get a new version, e.g.

wget --no-cache -O /tmp/Z
wget --no-cache -O /tmp/Z2

so I'd hope that in your case the following commands would solve it:-

wget --no-cache -O /tmp/Z
wget --no-cache -O /tmp/Z2

Obviously we are so far past Etch that this is no longer the case, but I'm documenting it here in case it helps someone out.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.