How apt uses Release.gpg and to add gpg key in debian ( NO_PUBKEY / GPG error )

[oio11]

W: GPG error: http://ftp.us.debian.org testing Release:
 The following signatures  couldn't be verified because
 the public key is not available: NO_PUBKEY NNNNNNNNNNNNNNNN

How to find and add a key

The debian-archive-keyring package is used to distribute keys to apt. Upgrades to this package can add (or remove) gpg keys for the main Debian archive.

For other archives, there is not yet a standard location where you can find the key for a given apt repository. There's a rough standard of putting the key up on the web page for the repository or as a file in the repository itself, but no real standard, so you might have to hunt for it.

The current and the retired Debian archive "signing" keys are available from https://ftp-master.debian.org/keys.html.

gpg itself has a standard way to distribute keys, using a keyserver that gpg can download a key from and add it to its keyring. For example:

 

###  gpg --keyserver subkeys.pgp.net --recv-keys NNNNNNNN

###  gpg -a --export NNNNNNNN | sudo apt-key add -

http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg

http://wiki.debian.org/SecureApt#How_to_find_and_add_a_key