How to trust a apt repository : Debian apt-get update error public key is not available: NO_PUBKEY <id>

Question

Trying to update some repositories on Debian Etch installation and getting the following errors from running "apt-get update"

W: GPG error: http://www.debian-multimedia.org etch Release: The following signatures couldn't be verified because teh public key is not available: NO_PUBKEY 07DC563D1F41B907
W: You may want to run apt-get update to correct these problems

The irony of it instructing me to run apt-get update is a nice kicker...

Solution 1

I found several posts telling me to run several gpg commands, but they didn't solve the problem because of two things. First, I was missing the debian-keyring package on my system and second I was using an invalid keyserver. Try different keyservers if you're getting timeouts!

Thus, the way I fixed it was:

apt-get install debian-keyring
gpg --keyserver pgp.mit.edu --recv-keys 1F41B907
gpg --armor --export 1F41B907 | apt-key add -

Then running a new "apt-get update" worked flawlessly!

Solution 2

I had the same problem of "gpg: keyserver timed out" with a couple of different servers. Finally, it turned out that I didn't need to do that manually at all. On a Debian system, the simple solution which fixed it was just (as root or precede with sudo):

aptitude install debian-archive-keyring

In case it is some other keyring you need, check out

apt-cache search keyring | grep debian

My squeeze system shows all these:

debian-archive-keyring       - GnuPG archive keys of the Debian archive
debian-edu-archive-keyring   - GnuPG archive keys of the Debian Edu archive
debian-keyring               - GnuPG keys of Debian Developers
debian-ports-archive-keyring - GnuPG archive keys of the debian-ports archive
emdebian-archive-keyring     - GnuPG archive keys for the emdebian repository

Comments

[user3075901]

How did you find out you had to use 1F41B907 from 07DC563D1F41B907?

[Roland Ewald]

Just tried it out, 07DC563D1F41B907 should work as well (i.e., the server knows this). BTW on more recent Ubuntu setups, try the commands described here: answers.launchpad.net/ubuntu/+source/apt/+question/118944

[Nathanael Weiss]

Nice and simple. Just what I was looking for.

[deed02392]

It's the fingerprint of the key, i.e. the last 8 characters. Look closely! :P

[Gonçalo Ribeiro]

A more direct way to do this would be to apt-key adv --keyserver pgp.mit.edu --recv-keys 07DC563D1F41B907. The adv command passes the other options to GPG.

[Sultanen]

@GonçaloRibeiro Thanks!

[fabatera]

How do you know which "other keyring you need"?

[mivk]

@fabatera : it would depend on the package you want to install. But if you cannot find out from the package's documentation, you could always try to just install them all.