Package signing keys
medium on-server
What it inspects
On Debian and Ubuntu, how many files are in /etc/apt/trusted.gpg.d/; one or more passes. If that directory is empty or missing, it counts the `gpg-pubkey` packages in the rpm database: one or more passes and zero fails. If neither query gives a number, the check is skipped. On releases that keep archive keys as Signed-By keyrings in /usr/share/keyrings (Ubuntu 24.04 and later, Debian 13), /etc/apt/trusted.gpg.d may be empty, so this FAIL can be a scanner limitation there; `apt-get update` completing with no NO_PUBKEY or signature errors is the real confirmation.
Why it matters
Package signatures are how your system knows an update really came from your distribution. Without the signing keys, either every installation fails or someone turns signature checking off, and then a tampered mirror or network attacker can hand you a malicious package. Restoring the keys keeps signature verification working.
How to verify
# Debian/Ubuntu:
ls /etc/apt/trusted.gpg.d/
# RHEL family:
rpm -qa gpg-pubkey
How to fix
Debian/Ubuntu: reinstall the distribution keyring package. RHEL family: import the signing keys that installed packages ship in /etc/pki/rpm-gpg.
Restore the distribution signing keys
Debian / Ubuntu
# Restores the distribution's archive signing keys from the keyring package that ships them.
# Other Debian derivatives are left alone: install the keyring package your distribution documents.
# Releases that keep archive keys as Signed-By keyrings in /usr/share/keyrings (Ubuntu 24.04+, Debian 13) may have
# nothing in /etc/apt/trusted.gpg.d, so this FAIL can be a scanner limitation there. The real confirmation is that
# `apt-get update` completes with no NO_PUBKEY or signature errors.
. /etc/os-release
case "$ID" in
ubuntu) pkg=ubuntu-keyring ;;
debian) pkg=debian-archive-keyring ;;
*) pkg="" ;;
esac
if [ -n "$pkg" ]; then
apt-get update
apt-get install -y --reinstall "$pkg"
else
echo "Unknown distribution ($ID): reinstall your distribution's keyring package by hand"
fi
ls /etc/apt/trusted.gpg.d/
RHEL / Rocky / Alma / Fedora
# Imports the signing keys that installed packages (the distro's *-gpg-keys / release packages) put in
# /etc/pki/rpm-gpg. Files that no installed package owns are skipped, so a planted file is never trusted.
# Review the list afterwards: `rpm -qa gpg-pubkey` and, per key, `rpm -qi gpg-pubkey-<id>`.
# Some releases also ship keys this rpm cannot read yet (e.g. Rocky 9's V6 post-quantum key): those are reported and skipped.
for k in /etc/pki/rpm-gpg/RPM-GPG-KEY-*; do
if [ -f "$k" ] && rpm -qf "$k" >/dev/null 2>&1; then
rpm --import "$k" || echo "skipped $k: this rpm could not import it (newer key format?)"
fi
done
rpm -qa gpg-pubkey