On Ubuntu 22.04, add an external APT archive by storing the provider’s public signing key in a dedicated keyring, binding that key with signed-by in a repository-specific source file, and running sudo apt update. Use the provider’s exact Ubuntu 22.04 instructions for the key URL, archive URL, jammy suite, and components. Do not substitute a Debian suite, another Ubuntu release, or an unverified key.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you are configuring
APT downloads repository metadata and packages, then verifies their signatures before accepting them. An external repository therefore needs two matching pieces of configuration:
As an Amazon Associate I earn from qualifying purchases.
- A public key that can verify signatures made by the repository owner.
- A source entry that tells APT where the archive is and which keyring is allowed to authenticate it.
The signed-by option connects those pieces. Instead of making a key trusted for every APT archive, it limits that key to the repository entry where it is named. This makes the arrangement easier to audit and reduces the consequences of trusting a key that should authenticate only one archive.
For a manually managed archive, put the key in /etc/apt/keyrings. A keyring delivered and maintained by a Debian package belongs in /usr/share/keyrings. In either location, the file must be readable by APT’s unprivileged _apt user.
#1 Best Overall
Before you add the repository
- Confirm that the provider explicitly supports Ubuntu 22.04, also called Jammy.
- Copy the provider’s official public-key URL, repository URL, suite, and components exactly. A typical Jammy suite is
jammy, but use the value the provider publishes. - Find the provider’s published fingerprint, preferably in documentation and an independent channel. A key copied from a forum or an unrelated repository is not a safe substitute.
- Check whether the provider supplies an archive-keyring package. Such a package can deliver future signing-key rotations through APT after the initial trust bootstrap.
- Decide whether the provider supplies an ASCII-armored key, normally ending in
.asc, or a binary keyring, commonly ending in.gpgor.pgp.
How to add an external APT repository on Ubuntu 22.04
1. Create the dedicated keyring directory
For an operator-managed key, create the recommended directory and give the directory ordinary read and traversal permissions:
sudo install -d -m 0755 /etc/apt/keyringsDo not put a manually maintained key in a global trust location simply because it is convenient. A repository-specific keyring in /etc/apt/keyrings makes the relationship visible in the source entry.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Download the provider’s public key
Use the download command and URL from the provider’s Ubuntu 22.04 instructions. The following form saves an armored key temporarily; set KEY_URL to that exact official URL before running it:
sudo wget -O /tmp/vendor.asc "$KEY_URL"Downloading to a temporary file lets you inspect the key before installing it. If the provider publishes a binary keyring and documents that format, save it directly with a .gpg or .pgp name instead. Never change the URL to a key belonging to another release or product.
3. Check the key fingerprint before trusting it
Display the fingerprint from the downloaded key:
gpg --show-keys --fingerprint /tmp/vendor.ascCompare the complete fingerprint with the value published by the repository owner or confirmed through an independent channel. Names and email addresses in a key are not enough to establish identity; the fingerprint is the value you should match. If it does not match, stop, remove the temporary file, and obtain the correct key from the provider.
4. Convert an armored key to a binary keyring
Ubuntu’s guidance for the traditional .list source-file format used by Ubuntu 22.04 and earlier supports a de-armored binary key. Convert the verified armored file as follows:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo gpg --dearmor --yes -o /etc/apt/keyrings/vendor-archive-keyring.gpg /tmp/vendor.ascMake the resulting keyring readable by APT:
sudo chmod 0644 /etc/apt/keyrings/vendor-archive-keyring.gpgIf the provider already gave you a verified binary keyring, do not dearmor it again. Install or copy that file into the chosen keyring directory and apply a readable mode. A permission-restricted key can work for your interactive account while failing when APT drops privileges to _apt.
5. Create a repository-specific source file
Ubuntu’s external-archive convention is a separate file under /etc/apt/sources.list.d/. Use a name that identifies the provider and ends in .list. This example follows the documented syntax; replace the archive URL and components with the provider’s exact values:
echo 'deb [signed-by=/etc/apt/keyrings/vendor-archive-keyring.gpg] https://vendor.example/ubuntu jammy main' | sudo tee /etc/apt/sources.list.d/vendor.listThe important parts are:
debselects binary packages.signed-by=/etc/apt/keyrings/vendor-archive-keyring.gpgnames one absolute keyring path for this archive.https://vendor.example/ubuntuis the repository’s base URL in the example, not a URL to guess for a real provider.jammyis Ubuntu 22.04’s suite. Use it only when the provider specifies it.mainis a component. Some providers publish different components or several components; copy their list exactly.
The keyring path in the source entry must exactly match the file you installed. A spelling difference, a moved file, or a second source line referring to a different keyring can prevent authentication.
6. Refresh APT metadata
Run an update immediately after adding or changing the source:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo apt updateRead the complete output. A successful update should fetch metadata from the new archive without signature, suite, or permission errors. Do not proceed to install packages while APT reports that the archive cannot be authenticated. Fix the source, key, URL, or permissions first, then run sudo apt update again.
7. Install the provider’s keyring package when one is supplied
Some repository owners publish an ARCHIVE-KEYRING package. Ubuntu recommends this model because later signing-key changes can then be distributed through the package manager. The trust sequence matters:
- Bootstrap the repository with the provider’s documented key and a working
signed-byentry. - Run
sudo apt updateand verify that signatures are accepted. - Install the provider’s keyring package using the package name and instructions it publishes.
- Follow the provider’s documented transition instructions if the package installs a new keyring or changes the source entry.
Do not install an unverified keyring package merely to silence an error. The initial key and source must be correct before APT can safely deliver updates to the trust configuration.
A complete Jammy configuration pattern
The following sequence shows the relationship between the files and commands without inventing a provider’s real key URL. Set KEY_URL to the official URL supplied for Ubuntu 22.04, and adjust the archive URL and components to the provider’s documentation:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →sudo install -d -m 0755 /etc/apt/keyrings
sudo wget -O /tmp/vendor.asc "$KEY_URL"
gpg --show-keys --fingerprint /tmp/vendor.asc
sudo gpg --dearmor --yes -o /etc/apt/keyrings/vendor-archive-keyring.gpg /tmp/vendor.asc
sudo chmod 0644 /etc/apt/keyrings/vendor-archive-keyring.gpg
echo 'deb [signed-by=/etc/apt/keyrings/vendor-archive-keyring.gpg] https://vendor.example/ubuntu jammy main' | sudo tee /etc/apt/sources.list.d/vendor.list
sudo apt updateIn a real installation, the fingerprint check is a decision point, not a command to skip. Continue only when the displayed fingerprint is the one the repository owner has published.
Where should the GPG key go?
| Keyring location | Use it when | Management model | Required condition |
|---|---|---|---|
/etc/apt/keyrings |
You download and maintain the key yourself. | Operator-managed configuration. | The key file and every parent directory must be readable or traversable by _apt. |
/usr/share/keyrings |
A Debian package installs and updates the keyring. | Package-managed configuration. | The source entry must point to the exact installed file, with permissions that allow APT to read it. |
Both locations are recommended for repository-specific keyrings. The distinction is ownership: do not place a manually maintained key where a package is expected to manage it, and do not edit a package-managed key behind the package manager’s back.
Why use signed-by instead of a global APT key?
Without a repository-specific binding, a key placed in a global APT trust collection can potentially authenticate packages from more archives than intended. signed-by changes the trust scope: APT uses the named keyring, or the fingerprints selected from it, for that source entry.
This does not make an unverified key safe. It only narrows where a trusted key can be used. You still need to obtain the key from the repository owner, verify its fingerprint, use the provider’s current key, and keep the keyring readable by APT.
Recommended Free Tools
Rank #4
Do not copy a key from a forum, reuse a key belonging to a different repository, or silently replace jammy with another distribution name to make an installation appear to work. A signature from the wrong key or metadata for the wrong suite is a configuration failure, not a warning to ignore.
Manual source files versus add-apt-repository
For a conventional external archive, a manually managed .list file plus signed-by gives you explicit control over the URL, suite, components, keyring path, and future auditing. Ubuntu 22.04’s add-apt-repository utility is convenient for PPAs and can write a complete source entry to /etc/apt/sources.list or /etc/apt/sources.list.d/. Its documented PPA workflow also downloads the PPA’s public key into APT’s keyring.
| Situation | Prefer | Reason |
|---|---|---|
| A vendor gives an HTTPS archive, a signing-key URL, and a keyring package. | Manual .list entry with signed-by. |
You can bind exactly one archive to its dedicated key and follow the vendor’s rotation instructions. |
| You are adding a Launchpad PPA supported by the utility. | add-apt-repository, following the PPA’s Ubuntu 22.04 instructions. |
The utility is designed to add the PPA source and retrieve its public key. |
| You need a source entry whose suite or components are unusual. | Manual file. | You can inspect and edit every field instead of accepting an automatically generated line. |
| The provider changes its signing key through a package. | Provider’s keyring package after bootstrap. | APT can receive subsequent key updates through the package-managed keyring. |
Whichever method you choose, inspect the resulting source files and remove duplicate entries for the same archive. Two entries with different Signed-By values are a common cause of update failures.
Troubleshooting APT and GPG errors
NO_PUBKEY or signature verification failure
APT cannot find a key that matches the archive signature, or the key it found is not the one that signed the metadata. Check all of these in order:
- Confirm that the downloaded key came from the provider’s current official URL.
- Compare its full fingerprint with the provider’s published fingerprint.
- If the source is a Jammy
.listentry and the download was armored, confirm that you rangpg --dearmor. - Check that the file named after
signed-by=exists at exactly that path. - Make sure the source entry points to the repository’s current suite and archive URL.
- Run
sudo apt updateagain after every correction.
Do not “fix” NO_PUBKEY by importing an arbitrary key into a global trust store. That hides the relationship between the archive and its key and can trust the wrong signer.
“Conflicting values set for option Signed-By”
This means APT found more than one source line for the same archive, but the lines name different keyrings or fingerprints. Search both the main file and the snippets directory:
Best Value
grep -R "vendor.example/ubuntu" /etc/apt/sources.list /etc/apt/sources.list.d/Keep one authoritative entry and one intended keyring. Remove or edit stale duplicate lines, then run sudo apt update. If a provider has intentionally changed its key, follow its migration instructions rather than choosing one of two entries arbitrarily.
The repository has no Jammy suite
Stop and read the provider’s compatibility guidance. A repository that publishes only another Ubuntu release or a Debian suite is not made compatible by changing its suite name in your file. Using the wrong suite can produce missing packages, dependency conflicts, or metadata that was never tested for Ubuntu 22.04.
Permission denied or unreadable keyring
Check the keyring and its parent directories:
ls -ld /etc/apt /etc/apt/keyrings
ls -l /etc/apt/keyrings/vendor-archive-keyring.gpgThe _apt user needs to traverse the directories and read the keyring. A directory mode such as 0755 and a key-file mode such as 0644 are typical for a non-secret public key, provided your system’s security policy permits them. Correct the path or permissions, then rerun sudo apt update.
APT still shows stale metadata
APT does not automatically reread a changed source or keyring at every later command. Run sudo apt update after each source-file or keyring change. If the output still references an old URL or suite, inspect every file under /etc/apt/sources.list.d/ and the main /etc/apt/sources.list for a leftover entry.
The URL is reachable but metadata is rejected
Network reachability is not authentication. A reachable server can still return metadata for the wrong suite, an unsigned archive, or content signed by a different key. Compare the source line with the provider’s Ubuntu 22.04 instructions and verify the key fingerprint; do not bypass signature checking.
Maintaining the repository safely
- Keep the source file’s suite and components aligned with the provider’s current Jammy documentation.
- Watch for provider notices about signing-key rotation. A changed key should be installed through the provider’s documented migration or keyring package, not an improvised replacement.
- Keep only the keyrings and source entries you still use. An abandoned external archive remains an unnecessary trust relationship.
- After editing either the keyring or source file, run
sudo apt updateand resolve every authentication error before installing or upgrading packages. - Record which repository owns each keyring file. Clear naming such as
vendor-archive-keyring.gpgmakes later audits and cleanup safer than a generic filename.
Removing an external archive
When you no longer need an archive, remove or disable its source file and remove its dedicated manually managed keyring only after confirming that no remaining source entry refers to it:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchessudo rm /etc/apt/sources.list.d/vendor.list
sudo rm /etc/apt/keyrings/vendor-archive-keyring.gpg
sudo apt updateIf the keyring was installed by a package, let that package manage its files and follow the provider’s uninstall instructions instead of deleting files underneath the package manager. Removing the source stops future metadata retrieval; it does not automatically remove packages already installed from that archive.
Quick Recap
Quick verification checklist
- The repository owner explicitly supports Ubuntu 22.04 (Jammy).
- The key came from the owner’s official URL and its full fingerprint was checked.
- An armored key was converted to a binary keyring for the Jammy
.listentry. - The keyring is in
/etc/apt/keyringsor, when package-managed,/usr/share/keyrings. - The source file is under
/etc/apt/sources.list.d/and uses an absolutesigned-bypath. - The URL, suite, and components exactly match the provider’s instructions.
- The keyring can be read by
_apt. sudo apt updatecompletes without signature, suite, URL, or permission errors.- Any provider-supplied archive-keyring package is installed only after the initial trust bootstrap succeeds.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
