So I have this going on:

# apt-get update
Get:1 http://ftp.us.debian.org etch Release.gpg [1032B]                     
Hit http://ftp.us.debian.org etch Release                                        
(...bunch more of this elided...)
Hit http://ftp.us.debian.org etch/contrib Sources
Fetched 68.8kB in 1s (37.4kB/s)
Reading package lists... Done
W: There is no public key available for the following key IDs:
W: GPG error: http://ftp.us.debian.org etch Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9AA38DCD55BE302B
W: You may want to run apt-get update to correct these problems

Apparently I can't run apt-get update because of a problem that apt-get wants me to run apt-get update to fix, which is displeasing. How do I correct this?

5 Answers 5


Try doing this and running apt-get again:

apt-key update

apt-key is a program that is used to manage a keyring of gpg keys for secure apt. The keyring is kept in the file /etc/apt/trusted.gpg (not to be confused with the related but not very interesting /etc/apt/trustdb.gpg). apt-key can be used to show the keys in the keyring, and to add or remove a key.

Further info on the Debian wiki: http://wiki.debian.org/SecureApt

If that doesn't work, try:

gpg --keyserver wwwkeys.eu.pgp.net --recv-keys 9AA38DCD55BE302B
apt-key add /root/.gnupg/pubring.gpg
apt-get update 
  • Tried it; no change. :(
    – chaos
    Jun 5, 2009 at 18:53
  • 5
    apt-key update only does something if the package debian-archive-keyring is installed. It's not needed in general, the package installation updates APT's keyring automatically. The second suggestion is not very safe as you don't verify that the key belong to the Debian project. You should really check its signatures before enabling it. Furthermore adding the whole keyring is bad, you only want the newly downloaded key so “gpg --export 9AA38DCD55BE302B | apt-key add -” would have been better... Jun 6, 2009 at 10:56

or do a sudo apt-get install debian-archive-keyring first.

after that you can continue a normaly

  • This solved the problem for me on an ancient Etch server, with repository definitions pointing to archive.debian.org/debian Nov 20, 2011 at 23:57
  • Can confirm this works on old etch on ppc
    – Ross W
    Oct 15, 2013 at 22:25

To ensure the origin of package that you download, APT will want to verify the signatures of the Release file. If it can't verify it, it will complain with the message that you saw. In that case, you have to install the corresponding GPG key so that APT can verify the file properly. Unfortunately you should not blindly download any key as you really want to allow only trusted keys that are owned by the repository owner. Thus you must download it in a way that ensures its origin, and simply downloading it with gpg --recv-key doesn't ensure that.

Installing a new key is done with apt-key add <key-file>. Most non-official repositories provide you the key on their website and give you instructions like this (the URL differs of course) :

wget -O - http://ftp-master.debian.org/keys/archive-key-5.0.asc | sudo apt-key add -

In the case of an official Debian mirror, you should automatically have the right key installed, it's contained in the package debian-archive-keyring and its configuration activates the keys automatically. So ensure you have it installed, and ensure it's up-to-date:

apt-get install debian-archive-keyring

If you don't trust your mirror, you can also install it only after having installed the right key with the previous method, I actually gave the URL of the official key that you needed.

For more infos about how the Debian Archive Keys are handled you can check http://ftp-master.debian.org/keys.html.


I had the same problem on Juanty 9.04 64 bit. Tried several suggestions but this did the trick :

wget -O - http://ftp-master.debian.org/keys/archive-key-5.0.asc | sudo apt-key add -

The do :

sudo apt-get update




I had this problem due to a transparent proxy giving me an old version of the GPG key, I solved it by using wget to force the proxy to get a new version, e.g.

wget --no-cache -O /tmp/Z http://security.debian.org/dists/lenny/updates/Release.gpg
wget --no-cache -O /tmp/Z2 http://security.debian.org/dists/lenny/updates/Release

so I'd hope that in your case the following commands would solve it:-

wget --no-cache -O /tmp/Z http://ftp.us.debian.org/dists/etch/Release.gpg
wget --no-cache -O /tmp/Z2 http://ftp.us.debian.org/dists/etch/Release

Obviously we are so far past Etch that this is no longer the case, but I'm documenting it here in case it helps someone out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .