To add an external APT repository on Ubuntu 22.04 (Jammy), download the repository owner’s official signing key, convert it to a binary keyring, store it in /etc/apt/keyrings or /usr/share/keyrings, reference that key with signed-by in a file under /etc/apt/sources.list.d/, and run sudo apt update. Do not install packages until the update completes without signature, suite, or connectivity errors.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This per-repository trust model replaces the broad trust formerly associated with a global keyring. The source line, keyring path, Ubuntu suite, and components must all match the provider’s Ubuntu 22.04 instructions.
As an Amazon Associate I earn from qualifying purchases.
What you need before adding the repository
Use the repository owner’s documentation as the authority for four values: the public-key URL, the repository URL, the distribution suite, and the components. For Ubuntu 22.04, the suite is normally jammy, but a provider may document a different compatibility rule. Never change a missing or unsupported Jammy suite to a Debian release or another Ubuntu codename merely to make an entry look valid.
- An Ubuntu 22.04 system with administrator access through
sudo. - The provider’s current public-key URL and fingerprint-verification instructions.
- The exact repository URL, suite, and components supplied for Jammy.
- Network access to download the key and repository metadata.
Third-party signing keys are a trust decision. Confirm the fingerprint in the provider’s documentation or through another independent channel before allowing APT to use the key. Do not copy a key from a forum, reuse a key belonging to an unrelated archive, or accept a signature failure as harmless.
#1 Best Overall
Where APT stores repository keys
Use a dedicated keyring instead of placing every external key in one global trust location. Operator-managed keyrings belong in /etc/apt/keyrings; keyrings delivered and maintained by a package belong in /usr/share/keyrings. The file must be readable by APT’s unprivileged _apt user.
| Situation | Recommended directory | Who maintains the keyring |
|---|---|---|
| You download and manage the key yourself | /etc/apt/keyrings |
You or your system administrators |
| The repository provides a keyring package | /usr/share/keyrings |
The package supplied by the repository |
Give each archive its own descriptive filename, such as vendor-archive-keyring.gpg. A separate file makes it clear which key authenticates which source and simplifies key rotation or removal.
Step-by-step: add an external repository with GPG
1. Confirm the provider’s Ubuntu 22.04 values
Write down the documented key URL, repository URL, suite, and components before editing APT. A provider might publish a line using jammy main, or it might require additional components. Copy those values exactly. The illustrative repository URL below is the one-line pattern; replace it with the provider’s documented URL when configuring a real archive.
deb [signed-by=/etc/apt/keyrings/vendor-archive-keyring.gpg] https://vendor.example/ubuntu jammy mainThe bracketed option, URL, suite, and component list are all part of the configuration. A correct key with a wrong suite still produces an unusable repository.
2. Create the operator-managed keyring directory
On a standard Jammy installation, create the directory with permissions that allow APT to traverse and read it:
sudo install -d -m 0755 /etc/apt/keyringsIf the directory already exists, this command leaves its contents in place while ensuring the directory itself is present. Keep the keyring file readable by _apt; overly restrictive permissions can make an otherwise valid source fail during metadata downloads.
Recommended Free Tools
3. Download the official public key
Set KEY_URL to the key URL published by the repository owner. Download to a temporary file first so you can inspect the key before installing it:
export KEY_URL='the-provider-key-url-from-its-documentation'
curl --fail --location "$KEY_URL" --output /tmp/vendor-archive.ascIf the provider documents wget instead, the equivalent form is:
wget --output-document=/tmp/vendor-archive.asc "$KEY_URL"These commands intentionally fail on an HTTP error. A downloaded HTML error page is not a signing key and should never be passed to APT.
4. Check the key and its fingerprint
Display the key’s identity and fingerprint before converting or installing it:
Free tools Windows power users keep installed
One-click scans. No signup required.
gpg --show-keys --fingerprint /tmp/vendor-archive.ascCompare the complete fingerprint with the value published by the repository owner or confirmed through an independent channel. The key’s name alone is not sufficient proof of identity. If the fingerprint differs, stop and obtain the correct key.
5. Convert an armored key to a binary keyring
Ubuntu’s guidance distinguishes ASCII-armored files, commonly ending in .asc, from binary keyrings, commonly ending in .gpg or .pgp. The .list source-file format used by Ubuntu 22.04 and earlier is documented with a de-armored binary key. Convert the inspected file into the keyring directory:
sudo gpg --dearmor --yes
--output /etc/apt/keyrings/vendor-archive-keyring.gpg
/tmp/vendor-archive.ascIf the provider already supplies a binary keyring, install that file at the documented path instead of de-armoring it a second time. Do not rename an armored file to .gpg and assume its format has changed; conversion is what produces the binary keyring.
6. Ensure APT can read the keyring
Make the keyring world-readable while keeping ownership under system control:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sudo chmod 0644 /etc/apt/keyrings/vendor-archive-keyring.gpgThe important requirement is readability by _apt. If your provider’s instructions specify a different safe ownership or mode, follow those instructions as long as APT can read the file.
7. Create a repository-specific source file
Ubuntu’s external-repository convention is a separate file under /etc/apt/sources.list.d/. Choose a lower-case descriptive name ending in .list:
sudo sh -c 'printf "%sn" "deb [signed-by=/etc/apt/keyrings/vendor-archive-keyring.gpg] https://vendor.example/ubuntu jammy main" > /etc/apt/sources.list.d/vendor.list'Replace the example URL and component list with the exact values supplied for Ubuntu 22.04. The signed-by path must be absolute and must exactly match the keyring file you installed. If the provider gives several components, keep them on the same source line unless its instructions specify separate entries.
8. Refresh repository metadata
Run an update immediately after adding or changing a source or keyring:
sudo apt updateAPT should be able to retrieve the archive’s metadata and verify its signatures. Read every warning and error. Authentication failures, an incorrect suite, an unreachable repository, and a key mismatch are configuration problems to resolve before installing packages from the archive.
9. Install a provider keyring package when one is offered
Some repositories publish an ARCHIVE-KEYRING package. Ubuntu recommends this approach because future signing-key changes can then be delivered through APT. Bootstrap trust with the documented public key first, run apt update, and install the provider’s keyring package only after that initial trust path succeeds. Do not install an unverified keyring package merely to silence a signature error.
Understanding the key formats used by Jammy
An ASCII-armored key is text that can be inspected and commonly uses an .asc suffix. A de-armored keyring is binary data, commonly named with .gpg or .pgp. The filename alone does not determine the format: changing .asc to .gpg does not convert anything. Use gpg --dearmor when the provider supplies armor, and point signed-by to the resulting binary file.
Keeping the original download in /tmp lets you inspect its fingerprint and discard it after conversion. The installed keyring should have a stable path under one of the APT keyring directories. If a provider publishes both formats, follow its Ubuntu 22.04 example for the .list method and use the binary keyring unless the provider explicitly documents another supported arrangement.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Reading and auditing a source entry
A traditional source entry starts with deb, followed by optional bracketed settings, the repository URL, a suite, and one or more components. In the example, jammy identifies Ubuntu 22.04 and main is the component. Every token must come from the provider’s Jammy instructions. A typo in the host, suite, or component can lead to a 404 response or to metadata for a different distribution.
Keep one authoritative entry for each archive. Duplicate lines in the main /etc/apt/sources.list and in files under /etc/apt/sources.list.d/ can make APT see conflicting Signed-By values. A descriptive filename also helps administrators identify the source during audits, upgrades, and incident response.
Why the signed-by option matters
Signed-By tells APT to authenticate a particular source with a specified keyring (or specified fingerprint) rather than accepting any key in a broad global trust set. Binding the source to /etc/apt/keyrings/vendor-archive-keyring.gpg limits that key’s intended use to the archive described by the source entry.
This arrangement is easier to audit: the source file identifies the archive, the option names the keyring, and the keyring contains the public key used for signature verification. It also reduces the chance that a key imported for one external archive can authenticate packages from another archive.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not use the old pattern of importing every third-party key into a global APT keyring. If you are maintaining an existing system, migrate each source to a dedicated keyring and an explicit signed-by option rather than adding more keys to the global store.
Rank #4
Manual .list file or add-apt-repository?
Both approaches can add a source, but they serve different situations. A manually managed file gives you direct control over the source line and keyring association, which is generally the clearest choice for a normal external archive.
| Approach | Where it writes | Key handling described for Jammy | Best fit |
|---|---|---|---|
Manual source file with signed-by |
/etc/apt/sources.list.d/ (or the main sources file) |
You choose a dedicated keyring and bind it to one archive | Vendor archives where you have an official key URL and explicit repository values |
add-apt-repository |
/etc/apt/sources.list or /etc/apt/sources.list.d/ |
For a PPA, its public key is downloaded into APT’s keyring | PPAs and workflows supported directly by the utility |
For an ordinary external archive, inspect what add-apt-repository would create before relying on it. If it leaves a source without the repository-specific signed-by association you require, use the manual method. Consider how the archive handles key rotation: a provider-supplied keyring package is easier to maintain than a key you must replace manually, while a manually managed file makes the trust boundary explicit.
Fix common apt update errors
NO_PUBKEY or signature verification failed
- Confirm that the key came from the repository owner’s current official URL.
- Check the fingerprint again with
gpg --show-keys --fingerprint. - For a Jammy
.listentry, make sure an armored key was converted withgpg --dearmor. - Check that the source’s
signed-bypath exactly matches the installed filename. - Run
sudo apt updateagain after correcting the key or source.
“Conflicting values set for option Signed-By”
APT has found duplicate entries for the same archive with different keyring settings. Search both /etc/apt/sources.list and every file in /etc/apt/sources.list.d/. Remove or disable the stale duplicate, keep one authoritative source line, and associate it with one intended keyring. Run sudo apt update after the cleanup.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe repository has no Jammy suite
Stop rather than substituting another distribution name. Follow the provider’s compatibility guidance for Ubuntu 22.04. A repository built for a different Ubuntu release or for Debian may have incompatible packages and metadata even if APT accepts the text of the source line.
Permission denied while reading the keyring
Check that the directory is searchable and the keyring is readable by _apt:
ls -ld /etc/apt/keyrings
ls -l /etc/apt/keyrings/vendor-archive-keyring.gpgCorrect the mode if necessary, then rerun sudo apt update. Keep the keyring in one of the recommended directories and avoid pointing signed-by at a temporary file under a private home directory.
Metadata remains stale after a change
APT does not automatically reread a modified source or keyring until you refresh its package lists. Run sudo apt update after every source-line, suite, component, or keyring change. If the command reports an error, fix that error before using the new repository.
The key download produced an unexpected file
Inspect the temporary download before conversion. A proxy error page, login page, or redirect to an HTML document is not a valid OpenPGP key. Use curl --fail --location or wget as documented, verify the fingerprint, and download again from the provider’s official URL if the content is not a key.
Removing or disabling the repository safely
Disable it temporarily
Rename the source file so it no longer ends in .list, or edit the file and comment out its deb line. Then run:
Best Value
sudo apt updateDisabling the source stops future metadata downloads from that archive without deleting the keyring. This is useful when diagnosing a failing archive or waiting for a provider to publish Jammy metadata.
Remove it permanently
- Delete the repository-specific file from
/etc/apt/sources.list.d/, or remove its line from the main sources file. - Run
sudo apt updateand confirm that APT no longer contacts the archive. - Delete the dedicated keyring only when no remaining source entry references it.
Removing a source does not automatically remove packages that were already installed from it. Package removal or replacement is a separate administrative decision.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Operational checklist
- Use the provider’s official key URL, repository URL, suite, and components.
- Use
jammyonly when the provider documents Ubuntu 22.04 support with that suite. - Store administrator-managed keys in
/etc/apt/keyrings; use/usr/share/keyringsfor package-managed keyrings. - Verify the complete key fingerprint before trusting the key.
- Convert an ASCII-armored key to a binary
.gpgkeyring for a Jammy.listsource. - Make the keyring readable by
_apt. - Use one repository-specific source file and an absolute
signed-bypath. - Run
sudo apt updateafter every configuration change. - Resolve signature, suite, duplicate-entry, and permission errors before installing packages.
- Install a provider’s archive-keyring package after the initial trust bootstrap when one is available.
Bottom line
A secure Ubuntu 22.04 external repository setup is a matched set: the provider’s verified key, a readable dedicated keyring, a Jammy-compatible source line, and an explicit signed-by association. Once sudo apt update completes without errors, APT can authenticate that archive without granting its key unnecessary authority over other repositories.
Frequently Asked Questions
How do I add an external APT repository on Ubuntu 22.04?
Confirm the provider’s Jammy URL, suite, components, and key fingerprint; create /etc/apt/keyrings; download and verify the key; de-armour it to a binary keyring; create a .list file with an absolute signed-by path; then run sudo apt update.
Where should I put a GPG key for APT?
Put a key you manage in /etc/apt/keyrings. Use /usr/share/keyrings when a package supplies and maintains the keyring. In either case, the file and its parent directory must be readable and searchable by APT’s _apt user.
Why does apt update report NO_PUBKEY?
APT cannot find the public key needed for that archive’s signature. Verify that you downloaded the current official key, checked its complete fingerprint, converted an armored key with gpg --dearmor, and used the exact same absolute path in signed-by.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCan I use an armored .asc file directly with a Jammy .list entry?
Ubuntu’s documented Jammy .list workflow uses a de-armored binary keyring. Convert the armored file with gpg --dearmor and reference the resulting .gpg or .pgp file.
Should I change jammy to Debian or another Ubuntu release if the repository has no Jammy directory?
No. Stop and follow the provider’s compatibility guidance. Substituting a Debian suite or another Ubuntu codename can produce incompatible metadata and packages even if APT accepts the source-line syntax.
What causes “Conflicting values set for option Signed-By”?
The same archive appears in more than one source file with different keyring settings. Check /etc/apt/sources.list and all files in /etc/apt/sources.list.d/, remove the stale duplicate, retain one source line, and update again.
Is add-apt-repository better than a manual source file?
It is convenient for PPAs and can write to the main sources file or the .d directory, downloading a PPA key into APT’s keyring. For a normal vendor archive, a manual .list file makes the dedicated keyring and signed-by trust boundary explicit.
When should I install a repository’s archive-keyring package?
Install it only after the initial trust bootstrap succeeds: verify the official key, configure the source, and complete sudo apt update first. The package can then deliver future signing-key updates through APT.
The Bottom Line
Use the provider’s exact Jammy instructions, verify the key fingerprint, store a readable dedicated binary keyring, bind it with signed-by, and run sudo apt update. Resolve every signature, suite, duplicate-entry, and permission error before installing software.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
