MySQL Bugs: #120305: Ubuntu 24.04 Noble: fresh install with mysql-apt-config fails apt update with NO

Bug #120305	Ubuntu 24.04 Noble: fresh install with mysql-apt-config fails apt update with NO_PUBKEY 9D769D5183E7DDC8
Submitted:	21 Apr 2:16	Modified:	24 Apr 23:24
Reporter:	Robert Shemer	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Package Repos	Severity:	S1 (Critical)
Version:	8.4	OS:	Ubuntu (24.04 Noble cloud image)
Assigned to:	Balasubramanian Kandasamy	CPU Architecture:	Any

Description:
Fresh installs of MySQL 8.4 from the MySQL apt repo are failing due to a signature validation error, even when the repo and key are configured via mysql-apt-config per documentation at https://dev.mysql.com/doc/mysql-apt-repo-quick-guide/en/#apt-repo-setup.  This error is occurring globally on all of our MySQL 8.4 servers.

The specific apt error references a key ID that is not listed in the public index at https://repo.mysql.com/, and does not match the latest key documented at https://dev.mysql.com/doc/refman/8.4/en/checking-gpg-signature.html:

Err:3 http://repo.mysql.com/apt/ubuntu noble InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D769D5183E7DDC8
Reading package lists... Done
W: GPG error: http://repo.mysql.com/apt/ubuntu noble InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D769D5183E7DDC8

According to documentation the latest key is B7B3B788A8D3785C.  Expected behavior is that the repo should pass signature validation with the latest key and apt update should proceed without error.  Reference: https://dev.mysql.com/doc/refman/8.4/en/checking-gpg-signature.html

How to repeat:
Download and install mysql-apt-config from the MySQL downloads page, then run apt update:

root@zbxmysqltest:~# wget https://dev.mysql.com/get/mysql-apt-config_0.8.36-1_all.deb

...

Connecting to repo.mysql.com (repo.mysql.com)|23.204.217.108|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 18128 (18K) [application/x-debian-package]
Saving to: ‘mysql-apt-config_0.8.36-1_all.deb’

mysql-apt-config_0.8.36-1_all.deb                                                   

2026-04-21 00:59:51 (128 MB/s) - ‘mysql-apt-config_0.8.36-1_all.deb’ saved [18128/18128]

root@zbxmysqltest:/etc/apt/sources.list.d# dpkg -i /root/mysql-apt-config_0.8.36-1_all.deb 
(Reading database ... 106635 files and directories currently installed.)
Preparing to unpack .../mysql-apt-config_0.8.36-1_all.deb ...
Unpacking mysql-apt-config (0.8.36-1) over (0.8.36-1) ...
Setting up mysql-apt-config (0.8.36-1) ...

root@zbxmysqltest:/etc/apt/sources.list.d# cat mysql.list 
### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# You may comment out entries below, but any other modifications may be lost.
# Use command 'dpkg-reconfigure mysql-apt-config' as root for modifications.
deb [signed-by=/usr/share/keyrings/mysql-apt-config.gpg] http://repo.mysql.com/apt/ubuntu/ noble mysql-apt-config
deb [signed-by=/usr/share/keyrings/mysql-apt-config.gpg] http://repo.mysql.com/apt/ubuntu/ noble mysql-8.4-lts
deb [signed-by=/usr/share/keyrings/mysql-apt-config.gpg] http://repo.mysql.com/apt/ubuntu/ noble mysql-tools
deb-src [signed-by=/usr/share/keyrings/mysql-apt-config.gpg] http://repo.mysql.com/apt/ubuntu/ noble mysql-8.4-lts

root@zbxmysqltest:/etc/apt/sources.list.d# gpg --show-keys --with-fingerprint /usr/share/keyrings/mysql-apt-config.gpg 
pub   rsa4096 2023-10-23 [SC] [expires: 2027-10-23]
      BCA4 3417 C3B4 85DD 128E  C6D4 B7B3 B788 A8D3 785C
uid                      MySQL Release Engineering <mysql-build@oss.oracle.com>
sub   rsa4096 2023-10-23 [E] [expires: 2027-10-23]

root@zbxmysqltest:/etc/apt/sources.list.d# apt update
Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease
Hit:2 http://archive.ubuntu.com/ubuntu noble-updates InRelease             
Get:3 http://repo.mysql.com/apt/ubuntu noble InRelease [25.1 kB]                                 
Hit:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease                                             
Hit:5 http://security.ubuntu.com/ubuntu noble-security InRelease                                             
Err:3 http://repo.mysql.com/apt/ubuntu noble InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D769D5183E7DDC8
Reading package lists... Done
W: GPG error: http://repo.mysql.com/apt/ubuntu noble InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D769D5183E7DDC8
E: The repository 'http://repo.mysql.com/apt/ubuntu noble InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Suggested fix:
The MySQL apt repo should be signed with key B7B3B788A8D3785C per documentation: https://dev.mysql.com/doc/refman/8.4/en/checking-gpg-signature.html

We are also getting this for Debian bookworm.

The repo signing key has not been published. Its not in RPM-GPG-KEY-mysql-* URLs, not in mysql-apt-config packages, not on any keyserver.

Debian bookworm

Err:1 http://repo.mysql.com/apt/debian bookworm InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D769D5183E7DDC8
Reading package lists... Done
W: GPG error: http://repo.mysql.com/apt/debian bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D769D5183E7DDC8

Same issue with every ubuntu 24.04 server

W: GPG-Fehler: http://repo.mysql.com/apt/ubuntu noble InRelease: Die folgenden Signaturen konnten nicht überprüft werden, weil ihr öffentlicher Schlüssel nicht verfügbar ist: NO_PUBKEY 9D769D5183E7DDC8
E: Das Depot »http://repo.mysql.com/apt/ubuntu noble InRelease« ist nicht signiert.
N: Eine Aktualisierung von solch einem Depot kann nicht auf eine sichere Art durchgeführt werden, daher ist es standardmäßig deaktiviert.
N: Weitere Details zur Erzeugung von Paketdepots sowie zu deren Benutzerkonfiguration finden Sie in der Handbuchseite apt-secure(8).

So there is actually no workaround?

Thanks for the bug report. We are working on it.

It looks like the distribution key was overwritten, which caused this issue. We have now repopulated the APT repository.

Could you please check again ?

Debian 12 bookworm

OK !

After the first successful update and package installation, I decided to do it again 

apt update

And here's the result.

Err:1 http://repo.mysql.com/apt/debian bookworm InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B7B3B788A8D3785C
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://repo.mysql.com/apt/debian bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B7B3B788A8D3785C
W: Failed to fetch http://repo.mysql.com/apt/debian/dists/bookworm/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B7B3B788A8D3785C
W: Some index files failed to download. They have been ignored, or old ones used instead.

We have rebuilt mysql-apt-config (0.8.39) to remove the offending key and published it. 

It should work fine now. Thanks!

Feedback received. Closing the bug.

Confirmed existing installs with manual repository config are able to pull from the apt repo once more using the latest key, and new installs via mysql-apt-config are now working as expected.  Thanks for the help!