I am facing a problem now when I do the following command on debian version 9.13: sudo apt-get update I get this error:

Fetched 21.6 kB in 0s (34.9 kB/s)
Reading package lists... Done
W: GPG error: http://repo.mysql.com/apt/debian stretch InRelease: The following signatures 
couldn't be verified because the public key is not available: NO_PUBKEY 8C718D3B5072E1F5
W: The repository 'http://repo.mysql.com/apt/debian stretch InRelease' is not signed.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous 
to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Well, this key I deleted because it has expired. I downloaded the new key from mysql.this is my apt-key list:

apt-key list

apt-key list 2

But so far I am unable to run the update command and this error still appears to me every time. Note that I made all possible attempts but failed. Is there anyone who can help me solve this problem, especially since it is specific to the web hosting server, please?

New contributor
Tarek Hussien is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

2 Answers 2


Copy this gpg key into mysql_pubkey.asc file then run:

gpg --import mysql_pubkey.asc
gpg --fingerprint 5072E1F5

See MySQL documentation: Signature Checking Using GnuPG


apt-key is deprecated. Normally apt-get would warn that you still have a key stored in /etc/apt/trusted.gpg. Your screenshots show that MySQL key is the only one stored there. I don't see the warning in your apt-get output, but I would try to follow the advice from the deprecation section of apt-key manpage:

Except for using apt-key del in maintainer scripts, the use of apt-key is deprecated. This section shows how to replace existing use of apt-key. If your existing use of apt-key add looks like this:
wget -qO- https://myrepo.example/myrepo.asc | sudo apt-key add -
Then you can directly replace this with (though note the recommendation below):
wget -qO- https://myrepo.example/myrepo.asc | sudo tee /etc/apt/trusted.gpg.d/myrepo.asc
Make sure to use the "asc" extension for ASCII armored keys and the "gpg" extension for the binary OpenPGP format (also known as "GPG key public ring"). The binary OpenPGP format works for all apt versions, while the ASCII armored format works for apt version >= 1.4.
Recommended: Instead of placing keys into the /etc/apt/trusted.gpg.d directory, you can place them anywhere on your filesystem by using the Signed-By option in your sources.list and pointing to the filename of the key. See sources.list(5) for details. Since APT 2.4, /etc/apt/keyrings is provided as the recommended location for keys not managed by packages. When using a deb822-style sources.list, and with apt version >= 2.4, the Signed-By option can also be used to include the full ASCII armored keyring directly in the sources.list without an additional file.

  • So, my friends, what is the solution, please? I don't know exactly what to do May 15 at 17:16
  • @Stewart You can grab the key using apt-key because the key has been removed from the server.
    – GAD3R
    May 15 at 21:08

Your Answer

Tarek Hussien is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.