How to fix APT error public key is not available (NO PUBKEY)

If you use the APT package repositories (for Debian, Ubuntu and similar distributions), you might run into the following error:

root@debian:~# apt-get update
[...]
Err:2 https://repos.influxdata.com/debian stable InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
Err:3 https://repos.influxdata.com/debian bullseye InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
Fetched 54.6 kB in 1s (90.1 kB/s)
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://repos.influxdata.com/debian stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://repos.influxdata.com/debian bullseye InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
W: Failed to fetch https://repos.influxdata.com/debian/dists/stable/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
W: Failed to fetch https://repos.influxdata.com/debian/dists/bullseye/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
W: Some index files failed to download. They have been ignored, or old ones used instead.

In this situation, there are errors when APT tried to update the InfluxDB repositories.

The error message differs from the expired key error (The following signatures were invalid: EXPKEYSIG) and hints that the public key, used by the repository, is not available on the local system.

Where is the current repo config and key?

The repository configuration can either be found in /etc/apt/sources.list or – better – in a separate file under /etc/apt/sources.list.d/.

root@debian:~# cat /etc/apt/sources.list.d/influxdb.list 
deb https://repos.influxdata.com/debian bullseye stable

This repo definition does not show which public key to use (usually defined by a signed-by hint).

In such a case, APT is looking for keys inside the file /etc/apt/trusted.gpg and in the directory /etc/apt/trusted.gpg.d/. This path is the default location for keys which were added using apt-key add (the legacy way of adding repository keys). The installed keys can be shown using apt-key list:

root@debian:~# apt-key list
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
/etc/apt/trusted.gpg
--------------------
[...]
/etc/apt/trusted.gpg.d/influxdata-archive_compat.gpg
----------------------------------------------------
pub   rsa4096 2023-01-18 [SC] [expires: 2026-01-17]
      9D53 9D90 D332 8DC7 D6C8  D3B9 D8FF 8E1F 7DF8 B07E
uid           [ unknown] InfluxData Package Signing Key <[email protected]>

And here it is: The previously installed public key from the InfluxDB repositories (and it is going to expire soon, in one week!).

What changed?

The APT error from the beginning shows us, that this installed key (9D539D90D332…) is no longer referred to from the repository. So what has changed?

Good repository administrators inform on the repository URL when keys are renewed or exchanged. This is also true for the InfluxDB repositories:

NOTICE 2026-01-06: InfluxData updated its signing subkey. For details, see our blog post.

The new key to use is the influxdata-archive-key:

root@debian:~# mkdir -p /etc/apt/keyrings/
root@debian:~# wget -q -O - https://repos.influxdata.com/influxdata-archive.key | gpg --dearmor > /etc/apt/keyrings/influxdb.gpg

Now define the new InfluxDB repository:

root@debian:~# echo 'deb [signed-by=/etc/apt/keyrings/influxdb.gpg] https://repos.influxdata.com/debian stable main' | sudo tee /etc/apt/sources.list.d/influxdata.list

Compared to the previous repository (in /etc/apt/sources.list.d/influxdb.list), there is a slight change. The InfluxDB repository now refers to "stable" for all Debian releases.

This means the old definition can be removed:

root@debian:~# rm /etc/apt/sources.list.d/influxdb.list

APT repository update working again

Now that the repository definition and the new key were installed, we can run apt update (similar to apt-get update) again and this time there are no errors anymore:

root@debian:~# apt update
Hit:1 https://repos.influxdata.com/debian stable InRelease
[...]
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
1 package can be upgraded. Run 'apt list --upgradable' to see it.