# U24.04 adding public key manually **URL:** \ **Category:** Plex Media Server\ **Tags:** server-linux\ **Created:** [August 16, 2024, 3:10am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402 "2024-08-16T03:10:02Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![clpoo](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@clpoo](https://forums.plex.tv/u/clpoo)\ **Post date:** [August 16, 2024, 3:10am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/1 "2024-08-16T03:10:02Z")
I recently updated to Ubuntu 24.04 over an existing Plex install, then added the file /etc/apt/sources.list.d/plexmediaserver.sources . On trying sudo apt update, terminal returns “Err:1 [https://downloads.plex.tv/repo/deb](https://downloads.plex.tv/repo/deb) public InRelease The following signatures couldn’t be verified because the public key is not available: NO\_PUBKEY 97203C7B3ADCA79D” “W: GPG error: [https://downloads.plex.tv/repo/deb](https://downloads.plex.tv/repo/deb) public InRelease: The following signatures couldn’t be verified because the public key is not available: NO\_PUBKEY 97203C7B3ADCA79D E: The repository ‘[https://downloads.plex.tv/repo/deb](https://downloads.plex.tv/repo/deb) public InRelease’ is not signed. N: Updating from such a repository can’t be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details. N: Missing Signed-By in the sources.list(5) entry for ‘[https://downloads.plex.tv/repo/deb](https://downloads.plex.tv/repo/deb)’” I tried adding the public key from the guide [https://support.plex.tv/articles/235974187-enable-repository-updating-for-supported-linux-server-distributions/](https://support.plex.tv/articles/235974187-enable-repository-updating-for-supported-linux-server-distributions/) without much luck. Any tips to add the public key manually in Ubuntu 24.04? Looks like its done differently now. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [August 16, 2024, 3:26am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/2 "2024-08-16T03:26:58Z")
Engineering is trying to fix it. There is a new certificate. The installer knows this. The new build system is unable to sign the package correctly with that new key. This is what Engineering is trying to fix. If you want to install the key yourself (try it) [https://downloads.plex.tv/plex-keys/PlexSign.key](https://downloads.plex.tv/plex-keys/PlexSign.key) ---
**Author:** ![clpoo](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@clpoo](https://forums.plex.tv/u/clpoo)\ **Post date:** [August 16, 2024, 3:37am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/3 "2024-08-16T03:37:42Z")
Thanks ChuckPa, I gave it a go, threw an error. “The information in this key has not yet been verified” Ill try some more later and keep monitoring this thread. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [August 16, 2024, 4:00am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/4 "2024-08-16T04:00:55Z")
I presume you did the apt key add ? I’ve not done it in a while, (none of my installations stay around long enough haha) ---
**Author:** ![clpoo](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@clpoo](https://forums.plex.tv/u/clpoo)\ **Post date:** [August 16, 2024, 4:09am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/5 "2024-08-16T04:09:33Z")
Apparently its deprecated in 24.04, Ive trawled a few threads on it and my head hurts lol ---
**Author:** ![clpoo](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@clpoo](https://forums.plex.tv/u/clpoo)\ **Post date:** [August 17, 2024, 1:30am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/6 "2024-08-17T01:30:57Z")
> [@ChuckPa](#): > > [https://downloads.plex.tv/plex-keys/PlexSign.key](https://downloads.plex.tv/plex-keys/PlexSign.key) I read [https://www.linuxuprising.com/2021/01/apt-key-is-deprecated-how-to-add.html](https://www.linuxuprising.com/2021/01/apt-key-is-deprecated-how-to-add.html) Looks like its an ascii armoured key so I ran > wget -O- [https://downloads.plex.tv/plex-keys/PlexSign.key](https://downloads.plex.tv/plex-keys/PlexSign.key) | gpg --dearmor | sudo tee /usr/share/keyrings/plexmediaserver.gpg Terminal returned a page of symbols but it didn’t fix the issue, maybe I missed something in the code. I found [ubuntu - Running “apt-get update” returns an error “apt-secure(8)” - Super User](https://superuser.com/questions/1290764/running-apt-get-update-returns-an-error-apt-secure8) then resorted to the files GUI. Opened: > /etc/apt/sources.list which opened the Software & Updates window with an “Import key file” button. The key file was accepted. 😀 This is different to the system trust window that opens if I double click the downloaded PlexSign.key, where trying to import the key was unsuccessful. Ran sudo apt update, now I get > W: [https://downloads.plex.tv/repo/deb/dists/public/InRelease:](https://downloads.plex.tv/repo/deb/dists/public/InRelease:) Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details Looks like the key is stored now, I’ll keep trying until there’s a Plex update to see if it works. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [August 17, 2024, 4:01am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/7 "2024-08-17T04:01:55Z")
You should also, unless they’ve removed it completely, be able to use `apt-key` to import the key. From there, apt will use that key when downloading packages. Do remember, engineering is having trouble getting packages signed properly during the build. ---
**Author:** ![mcattle](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/mcattle/32/247977_2.png) [@mcattle](https://forums.plex.tv/u/mcattle)\ **Post date:** [October 4, 2024, 9:38pm UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/8 "2024-10-04T21:38:42Z")
For what its worth, this command appeared to work for me, and now I don’t get the legacy keyring warning: ```bash wget https://downloads.plex.tv/plex-keys/PlexSign.key -O /usr/share/keyrings/plex-archive-keyring.key ``` ---
**Author:** ![\_david](https://avatars.discourse-cdn.com/v4/letter/_/ecae2f/32.png) [@\_david](https://forums.plex.tv/u/_david)\ **Post date:** [November 8, 2024, 6:56am UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/9 "2024-11-08T06:56:02Z")
I haven’t been able to `apt-update` for a few months now. I’m getting this when I try: ```auto Err:5 https://downloads.plex.tv/repo/deb public InRelease The following signatures were invalid: ERRSIG 97203C7B3ADCA79D ``` I don’t think it’s on my side since when I try to verify it manually I get the same error: ```auto $ cd /tmp $ curl -s https://downloads.plex.tv/plex-keys/PlexSign.key | gpg -o plexkey.gpg --dearmor $ curl -s https://downloads.plex.tv/repo/deb/dists/public/InRelease | gpgv --verbose --keyring ./plexkey.gpg gpgv: Signature made Thu Oct 24 09:35:30 2024 -07:00 gpgv: using RSA key 97203C7B3ADCA79D gpgv: Can't check signature: Bad public key Signing key on CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D is not bound: gpgv: error: No binding signature at time 2024-10-24T16:35:30Z gpgv: because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance gpgv: because: SHA1 is not considered secure since 2023-02-01T00:00:00Z ``` When I try the same thing with debian’s keys: ```auto $ curl -s https://ftp-master.debian.org/keys/archive-key-11.asc | gpg -o archive-key-11.gpg --dearmor $ curl -s https://ftp-master.debian.org/keys/archive-key-12.asc | gpg -o archive-key-12.gpg --dearmor $ curl -s https://deb.debian.org/debian/dists/testing/InRelease | gpgv --keyring ./archive-key-11.gpg --keyring ./archive-key-12.gpg InRelease-debian-testing gpgv: Signature made Thu Nov 7 18:14:02 2024 -08:00 gpgv: using RSA key A7236886F3CCCAAD148A27F80E98404D386FA1D9 gpgv: Good signature from "Debian Archive Automatic Signing Key (11/bullseye) " gpgv: Signature made Thu Nov 7 18:14:06 2024 -08:00 gpgv: using RSA key 4CB50190207B4758A3F73A796ED0E7B82643E131 gpgv: Good signature from "Debian Archive Automatic Signing Key (12/bookworm) " ``` It looks like that last line of the error is the important one: ```auto gpgv: because: SHA1 is not considered secure since 2023-02-01T00:00:00Z ``` Testing this further: ```auto $ gpg -vv < archive-key-11.gpg 2>&1 | grep "digest algo" digest algo 10, begin of digest 14 ae digest algo 10, begin of digest 69 f8 digest algo 10, begin of digest 42 67 digest algo 10, begin of digest 37 c1 digest algo 10, begin of digest 1b 10 digest algo 10, begin of digest a3 9a digest algo 10, begin of digest 34 89 digest algo 10, begin of digest 85 52 digest algo 10, begin of digest d5 61 digest algo 10, begin of digest 16 d2 digest algo 10, begin of digest a7 77 digest algo 10, begin of digest 58 e0 subpkt 32 len 563 (signature: v4, class 0x19, algo 1, digest algo 10) $ gpg -vv < plexkey.gpg 2>&1 | grep "digest algo" digest algo 2, begin of digest 90 2f digest algo 2, begin of digest b5 3a ``` Debian’s (working) key uses digest algorithm 10 and Plex’s (failing) key uses digest algorithm 2. Checking against [OpenPGP Hash Algorithms](https://www.iana.org/assignments/openpgp/openpgp.xml#openpgp-hash-algorithms) we can see that `10` is “SHA2-512” and `2` is “SHA-1”. That matches the error that `gpgv` is emitting. Interestingly, the InRelease signature from Plex appears to be using SHA2-256: ```auto $ curl -s https://downloads.plex.tv/repo/deb/dists/public/InRelease | gpg -vv 2>&1 | grep "digest algo" digest algo 8, begin of digest d1 f9 ``` I don’t actually know all that much about GPG but maybe just re-self-signing the key with SHA2-512 would make it work (without needing to create a brand new key)? ---
**Author:** ![Grigsie](https://avatars.discourse-cdn.com/v4/letter/g/da6949/32.png) [@Grigsie](https://forums.plex.tv/u/Grigsie)\ **Post date:** [November 27, 2024, 7:11pm UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/10 "2024-11-27T19:11:02Z")
I’m getting the same error, has anyone been able to fix this yet? ---
**Author:** ![system](https://global.discourse-cdn.com/plex/original/3X/2/a/2acb9765406f63293d357b4ec509ec39aa28f2ad.png) [@system](https://forums.plex.tv/u/system)\ **Post date:** [February 25, 2025, 7:11pm UTC](https://forums.plex.tv/t/u24-04-adding-public-key-manually/885402/11 "2025-02-25T19:11:52Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.