Solved: GitHub CLI GPG Error (NO_PUBKEY 23F3D4EA75716059)

I encountered an issue with the GitHub CLI repository. The GPG key had either expired or changed, leading to a signature verification failure.

The Error

W: GPG error: https://cli.github.com/packages stable InRelease: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY 23F3D4EA75716059 E: The repository ‘https://cli.github.com/packages stable InRelease’ is not signed.

The Solution

To fix this, we need to re-import the official GitHub CLI keyring and update the source list to use the signed-by option. This is the modern, more secure way to handle third-party repositories compared to the deprecated apt-key.

Run the following command chain:

# 1. Download the keyring and save it to the dedicated keyrings directory
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg

# 2. Ensure the file has the correct permissions
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg

# 3. Update the source list to reference that specific keyring
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null

# 4. Update and Install
sudo apt update
sudo apt install gh -y

Why this works

By using signed-by, we tell APT exactly which GPG key it should use to verify only that specific repository. This prevents a compromised key from one repository being used to sign malicious packages in another.

The Result: A Clean Update

After applying the fixes, my apt update output returned to normal:

Hit:1 http://security.debian.org/debian-security bullseye-security InRelease
Hit:2 http://deb.debian.org/debian bullseye InRelease
Hit:3 https://archive.debian.org/debian bullseye-backports InRelease
Get:7 https://cli.github.com/packages stable InRelease [3,917 B]
Reading package lists... Done
Building dependency tree... Don

Summary

If you get a NO_PUBKEY error, re-import the key into /usr/share/keyrings/ and use the signed-by flag in your sources list.