Fix GPG Key Expired Error on Ubuntu/Debian

You're running apt update on Ubuntu 22.04 or Debian 11, and you get something like:

W: GPG error: http://example.com/ubuntu jammy InRelease: The following signatures were invalid: EXPKEYSIG ABCDEF1234567890

Or maybe just a NO_PUBKEY error that points to a key that's expired. This usually happens after a system that's been offline for a while, or a third-party repo like Docker, Google Chrome, or Microsoft that updated their signing key. The culprit here is almost always a repo key that has an expiration date, and that date has passed. apt is strict — it won't trust a key that's expired, even if nothing else is wrong.

Root cause

GPG keys have expiration dates baked in. When a key expires, apt sees it as invalid. The repo maintainer should have updated the key before it expired, but sometimes they don't, or your system has an old copy. You need to replace the expired key with the current one from the repo provider.

Fix: Replace the expired GPG key

Don't bother with apt-key adv --keyserver commands — they're deprecated and often fail because keyservers are flaky. The modern way is to download the key directly from the repo's website and store it in /usr/share/keyrings/ or /etc/apt/trusted.gpg.d/.

Identify the expired key ID. Look at the error message. It says EXPKEYSIG ABCDEF1234567890. That hex string is the key ID. Write it down.
Remove the old expired key.
```
sudo apt-key del ABCDEF1234567890
```
Or if you're using a keyring file (modern approach), delete the file:
```
sudo rm /etc/apt/trusted.gpg.d/repo-name.gpg
```

Get the new key from the repo provider. For example, for Docker:

sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /usr/share/keyrings/docker-archive-keyring.gpg

For Google Chrome:

wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg

Update the repo's sources list entry to point to the new keyring (if needed). Open /etc/apt/sources.list.d/repo.list and add [signed-by=/usr/share/keyrings/repo-keyring.gpg] to the line. Example:
```
deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu jammy stable
```
Run apt update — it should work now.
```
sudo apt update
```

If it still fails

Check three things:

Is the new key actually imported? Run gpg --show-keys /usr/share/keyrings/repo-keyring.gpg and check its expiration date.
Did you update the sources.list entry? Without signed-by, apt ignores the keyring file and falls back to the old trust store.
Is the repo still maintained? Some repos die off. If the provider stopped supporting your OS version, you'll need to remove the repo entirely.

One last thing: if you're on an old Ubuntu LTS (18.04 or older), apt-key is still the default, but you should migrate to keyring files. The old apt-key add command is deprecated and will break in upcoming releases.