Install fails due to GPG key not found

[eddy-geek]

On running sudo apt-get update, the following occurs:

Reading package lists... Done

W: GPG error: https://deb.nodesource.com/node_10.x cosmic InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1655A0AB68576280

This can be fixed with:

curl --silent https://deb.nodesource.com/gpgkey/nodesource.gpg.key | sudo apt-key add -

This could be integrated in the manual instructions & the one-line setup script.

[chrislea]

That's already noted in both the manual installation instructions and the setup script. Hope this helps.

[700software]

That link is out of date. I think @chrislea is referring to: https://github.com/nodesource/distributions/blob/0a7ddca803e0f8a4908bbd8142ba863aca2e1274/deb/setup_10.x#L278

[suntong]

I'm still getting the above problem:

$ curl -sL https://deb.nodesource.com/setup_14.x | sudo -E bash -

## Installing the NodeSource Node.js 14.x repo...

## Confirming "buster" is supported...

+ curl -sLf -o /dev/null 'https://deb.nodesource.com/node_14.x/dists/buster/Release'

## Adding the NodeSource signing key to your keyring...

+ curl -s https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | tee /usr/share/keyrings/nodesource.gpg >/dev/null

## Creating apt sources list file for the NodeSource Node.js 14.x repo...

+ echo 'deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_14.x buster main' > /etc/apt/sources.list.d/nodesource.list
+ echo 'deb-src [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_14.x buster main' >> /etc/apt/sources.list.d/nodesource.list

## Running `apt-get update` for you...

+ apt-get update
Hit:1 http://ftp.debian.org/debian buster-backports InRelease
. . .
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1655A0AB68576280
Reading package lists... Done                                                                                                                                 
W: GPG error: https://deb.nodesource.com/node_14.x buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1655A0AB68576280
E: The repository 'https://deb.nodesource.com/node_14.x buster InRelease' is not signed.


$ curl --silent https://deb.nodesource.com/gpgkey/nodesource.gpg.key | sudo apt-key add -
OK

$ sudo apt update
Hit:1 http://deb.debian.org/debian buster InRelease
Hit:2 http://deb.debian.org/debian buster-updates InRelease                      
Hit:3 http://security.debian.org/debian-security buster/updates InRelease        
Hit:4 http://ftp.debian.org/debian buster-backports InRelease                                     
Hit:5 http://deb.debian.org/debian bullseye InRelease                                             
Hit:6 http://deb.debian.org/debian bullseye-updates InRelease               
Hit:7 http://ftp.debian.org/debian bullseye-backports InRelease             
Get:8 https://deb.nodesource.com/node_14.x buster InRelease [4584 B]        
Err:8 https://deb.nodesource.com/node_14.x buster InRelease                                                                                                  
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1655A0AB68576280
Reading package lists... Done                                                                                                                                
W: GPG error: https://deb.nodesource.com/node_14.x buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 1655A0AB68576280
E: The repository 'https://deb.nodesource.com/node_14.x buster InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

$ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 10 (buster)
Release:        10
Codename:       buster

How to fix the problem? thx

PS. The machine is WSL within Win10 accessing Internet behind corp man-in-the-middle (MitM) firewall.

[geonanorch]

I have the same issue: started with a fresh Debian 11.0 image, ran the nodesource_setup.sh script and got exactly the error reported in the previous comment by @suntong...

I verified that the key was properly installed by the script:

# gpg --no-default-keyring --keyring /usr/share/keyrings/nodesource.gpg --list-keys
gpg: directory '/root/.gnupg' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
/usr/share/keyrings/nodesource.gpg
----------------------------------
pub   rsa4096 2014-06-13 [SC]
      9FD3B784BC1C6FC31A8A0A1C1655A0AB68576280
uid           [ unknown] NodeSource <[email protected]>
sub   rsa4096 2014-06-13 [E]

And the APT setup seems fine as well:

# cat /etc/apt/sources.list.d/nodesource.list
deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_14.x bullseye main
deb-src [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_14.x bullseye main

I suggest a reopen.

WORKAROUND: edit nodesource.list above and add allow-insecure=yes:

deb [ signed-by=/usr/share/keyrings/nodesource.gpg allow-insecure=yes ] https://deb.nodesource.com/node_14.x bullseye main
deb-src [ signed-by=/usr/share/keyrings/nodesource.gpg allow-insecure=yes ] https://deb.nodesource.com/node_14.x bullseye main

[jimhonetech]

also having same problem, verified key exists like geonanorch going to try his workaround

[dieulot]

The correct (not insecure) solution has been posted in another issue: https://github.com/nodesource/distributions/issues/1181#issuecomment-809163621

chmod +r "/usr/share/keyrings/nodesource.gpg"

(I had the same problem on Debian 11. This issue (#785) is the first result on Google for that error.)

[jmanteigueiro]

chmod +r "/usr/share/keyrings/nodesource.gpg"

This was the solution for me as well, but +r did not work.

I had to use chmod 644

[geonanorch]

something is missing in that command, probably chmod a+r /usr/share/keyrings/nodesource.gpg was meant.

[suntong]

This was the solution for me as well, but +r did not work.

Confirmed. Should be chmod a+r.

[imran-vz]

I was facing this issue when I cancelled the installation process in progress. Deleting /etc/apt/sources.list.d/nodesource.list and running the install script again worked.

[nrdvana]

Please add the chmod a+r to the official instructions. I just wasted an hour on this.

[netik]

You can also add the key from ubuntu...

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1655A0AB68576280

[baozitao]

@

I was facing this issue when I cancelled the installation process in progress. Deleting /etc/apt/sources.list.d/nodesource.list and running the install script again worked.

good job, it worked!!

[jotakar]

Hi, I have a similar issue. I can add the repository but I cannot use it. I got installed nodejs always. I do: curl -fsSL https://deb.nodesource.com/setup_16.x | bash - I get :

## Installing the NodeSource Node.js 14.x repo...

## Populating apt-get cache...

+ apt-get update
Obj:1 http://security.debian.org/debian-security bullseye-security InRelease
Obj:2 http://deb.debian.org/debian bullseye InRelease                                                                     
Obj:3 http://deb.debian.org/debian bullseye-updates InRelease                                                             
Obj:4 https://dl.yarnpkg.com/debian stable InRelease                                                
Obj:5 https://deb.nodesource.com/node_14.x bullseye InRelease             
Leyendo lista de paquetes... Hecho

## Confirming "bullseye" is supported...

+ curl -sLf -o /dev/null 'https://deb.nodesource.com/node_14.x/dists/bullseye/Release'

## Adding the NodeSource signing key to your keyring...

+ curl -s https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | tee /usr/share/keyrings/nodesource.gpg >/dev/null

## Creating apt sources list file for the NodeSource Node.js 14.x repo...

+ echo 'deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_14.x bullseye main' > /etc/apt/sources.list.d/nodesource.list
+ echo 'deb-src [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_14.x bullseye main' >> /etc/apt/sources.list.d/nodesource.list

## Running `apt-get update` for you...

+ apt-get update
Obj:1 http://security.debian.org/debian-security bullseye-security InRelease
Obj:2 http://deb.debian.org/debian bullseye InRelease                                                                      
Obj:3 http://deb.debian.org/debian bullseye-updates InRelease                                                              
Obj:4 https://deb.nodesource.com/node_14.x bullseye InRelease                                                              
Obj:5 https://dl.yarnpkg.com/debian stable InRelease                                             
Leyendo lista de paquetes... Hecho

## Run `sudo apt-get install -y nodejs` to install Node.js 14.x and npm
## You may also need development tools to build native addons:
     sudo apt-get install gcc g++ make
## To install the Yarn package manager, run:
     curl -sL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor | sudo tee /usr/share/keyrings/yarnkey.gpg >/dev/null
     echo "deb [signed-by=/usr/share/keyrings/yarnkey.gpg] https://dl.yarnpkg.com/debian stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
     sudo apt-get update && sudo apt-get install yarn`

No error. And the file nodesource.list is in the sources.list.d folder. But when I write apt-cache policy nodejs

I get following result

nodejs:  

  Instalados: (ninguno)  

  Candidato:  12.22.12~dfsg-1~deb11u1  

  Tabla de versión:  

     12.22.12~dfsg-1~deb11u1 500  

        500 http://security.debian.org/debian-security bullseye-security/main i386 Packages  

     12.22.5~dfsg-2~11u1 500  

        500 http://deb.debian.org/debian bullseye/main i386 Packages  `  

So it looks like it doesn't read the nodesource.list repository!!, is the source disabled? how to enable? Where is the error? Thanks

[JesusPaz]

the necessary line has already been added to the documentation #1494