Fix Common APT Errors on Ubuntu and Debian VPS

Sooner or later, apt update on your VPS Linux Infrawire fails with a wall of red text: a missing GPG key, a repository that no longer exists, or a lock that never goes away. Each error has a clear cause and a short fix.

This guide walks through the most frequent problems on Ubuntu 24.04 and Debian 12, from the least to the most invasive fix.

📋 Prerequisites

A VPS running Ubuntu 24.04 or Debian 12
Root SSH access (IP and root password are available in your client area)
Basic command-line knowledge

1. Locate the sources first

Before fixing anything, know where your repositories are defined:

Bash
1cat /etc/os-release
2cat /etc/apt/sources.list
3ls -l /etc/apt/sources.list.d/
4apt update 2>&1 | grep -E '^(Err|W:|E:)'

On Ubuntu 24.04 the main repositories live in /etc/apt/sources.list.d/ubuntu.sources, written in the deb822 format (.sources files). Debian 12 still uses the classic one-line format in /etc/apt/sources.list, and both formats work side by side.

Bash
1# Example of a deb822 entry (Ubuntu 24.04)
2Types: deb
3URIs: http://archive.ubuntu.com/ubuntu/
4Suites: noble noble-updates noble-backports
5Components: main restricted universe multiverse
6Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

2. Lock errors and interrupted dpkg

The message Could not get lock /var/lib/dpkg/lock-frontend means another process is using apt, very often unattended-upgrades just after boot. Check before doing anything:

Bash
1ps aux | grep -E 'apt|dpkg|unattended' | grep -v grep
2lsof /var/lib/dpkg/lock-frontend

If a process is running, wait a few minutes. Delete a lock file only when nothing holds it (risky if you are wrong), then repair the interrupted state:

Bash
1rm -f /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock
2dpkg --configure -a
3apt --fix-broken install

dpkg was interrupted, you must manually run 'dpkg --configure -a' is solved by exactly that first command.

3. NO_PUBKEY and missing GPG keys

The error The following signatures couldn't be verified because the public key is not available: NO_PUBKEY ABCD1234 means a third-party repository has no trusted key. Do not use the deprecated apt-key: store the key in /etc/apt/keyrings/ and reference it with signed-by.

Bash
1install -d -m 0755 /etc/apt/keyrings
2curl -fsSL https://example.com/repo/key.gpg | gpg --dearmor -o /etc/apt/keyrings/example.gpg
3chmod 644 /etc/apt/keyrings/example.gpg
4
5echo 'deb [signed-by=/etc/apt/keyrings/example.gpg] https://example.com/repo stable main' > /etc/apt/sources.list.d/example.list
6apt update

Use the key URL given in the official documentation of the software, and install curl gnupg first if they are missing. If the error concerns the Ubuntu or Debian archive itself, reinstall the keyring package: apt install --reinstall ubuntu-keyring or debian-archive-keyring.

4. Broken third-party repositories

An error like 404 Not Found or does not have a Release file on a PPA or vendor repository usually means it stopped supporting your release. Disable it rather than deleting it:

Bash
1# Classic .list file: rename it
2mv /etc/apt/sources.list.d/broken.list /etc/apt/sources.list.d/broken.list.disabled
3
4# deb822 .sources file: add this line inside the stanza
5Enabled: no

Then run apt update again. The error disappears, and packages already installed keep working.

5. Clock errors: Release file not valid yet

Release file for ... is not valid yet (invalid for another 3h 12min) means the system clock is behind the repository timestamp. Check and resynchronise:

Bash
1timedatectl
2timedatectl set-ntp true
3systemctl restart systemd-timesyncd

If systemd-timesyncd is not installed (some minimal Debian images), use apt install -y chrony instead.

6. End-of-life releases

When a release reaches end of life, its packages are moved and apt update returns 404 or no longer has a Release file. For a non-LTS Ubuntu release, point the sources to the archive of old releases:

Bash
1sed -i 's|http://archive.ubuntu.com/ubuntu|http://old-releases.ubuntu.com/ubuntu|g; s|http://security.ubuntu.com/ubuntu|http://old-releases.ubuntu.com/ubuntu|g' /etc/apt/sources.list /etc/apt/sources.list.d/*.sources 2>/dev/null
2apt update

For an old Debian release, use http://archive.debian.org/debian and the security line must be removed. Treat an EOL system as a stopgap: it no longer receives security fixes, so plan an upgrade to a supported release.

7. Verify

Bash
1apt update
2apt upgrade --dry-run
3apt-get check

apt update must finish without Err or E: lines, and apt-get check must print nothing.

🛠️ Troubleshooting

The lock comes back on every attempt: unattended-upgrades is probably running. Check systemctl status unattended-upgrades and wait for it to finish.

Conflicting values set for option Signed-By: the same repository is declared twice with different keys. Search with grep -r example.com /etc/apt/ and keep a single entry.

apt --fix-broken install fails on a package script: read the last error lines, then try dpkg --remove --force-remove-reinstreq PACKAGE followed by a normal reinstall.

✅ Your package manager is healthy again: updates and installs work without errors!