gpg: command not found and gpg No public key: How to Install GnuPG and Import a Signing Key

Applies to: GnuPG 2.4 on Ubuntu 26.04 LTS, Debian 13, Rocky Linux 10, AlmaLinux 9, Fedora 44 and Alpine 3.24; GnuPG 2.5 from Homebrew on macOS

gpg: command not found means GnuPG is not installed. Minimal server and container images leave it out. Install it with sudo apt install gnupg on Ubuntu and Debian or sudo dnf install gnupg2 on Rocky Linux, AlmaLinux and Fedora. The second common error, gpg: Can't check signature: No public key, means gpg works but you have not yet imported the key that made the signature.

1. Install gpg

On a fresh Ubuntu 26.04 or Debian 13 system:

$ gpg --version
bash: gpg: command not found

The Ubuntu image only has gpgv, a small tool that APT uses to check package signatures; the Debian 13 image had neither. Install the full suite:

sudo apt update
sudo apt install gnupg
gpg --version

gpg (GnuPG) 2.4.8

Install gnupg, not just the gpg package. With gpg alone, fetching keys from a keyserver fails because the network helper is missing:

gpg: error running '/usr/bin/dirmngr': probably not installed
gpg: failed to start dirmngr '/usr/bin/dirmngr': Configuration error
gpg: can't connect to the dirmngr: Configuration error
gpg: keyserver receive failed: No dirmngr

On other systems:

• Rocky Linux 10, AlmaLinux, RHEL, Fedora: sudo dnf install gnupg2. The package is called gnupg2, but the command is gpg (gpg2 is a link to it). AlmaLinux 9 and Fedora 44 images already had it; the Rocky Linux 10 container image did not.
• Alpine: apk add gnupg.
• macOS: the terminal says zsh: command not found: gpg. Install it with Homebrew: brew install gnupg.
• Windows: the gpg command comes with Gpg4win.

If gpg is installed but a script still says “not found”, check where it is with command -v gpg (usually /usr/bin/gpg) and use that full path in the script.

2. Fix “Can’t check signature: No public key”

Here we verify the nginx 1.30.5 source download against its signature file:

$ gpg --verify nginx-1.30.5.tar.gz.asc nginx-1.30.5.tar.gz
gpg: Signature made Tue Sep 15 13:28:48 2026 UTC
gpg:                using RSA key D6786CE303D9A9022998DC6CC8464D549AF75C0A
gpg:                issuer "s.kandaurov@f5.com"
gpg: Can't check signature: No public key

gpg tells you which key it needs (the 40-character fingerprint) and who issued it. Get that key in one of two ways.

From the project’s own website (best, because you choose the source). nginx publishes its signing keys on its PGP keys page:

curl -s https://nginx.org/keys/pluknet.key | gpg --import

gpg: key C8464D549AF75C0A: public key "Sergey Kandaurov <s.kandaurov@f5.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

From a keyserver, by fingerprint:

gpg --recv-keys D6786CE303D9A9022998DC6CC8464D549AF75C0A

GnuPG 2.4 uses hkps://keys.openpgp.org by default. For this key it answered gpg: keyserver receive failed: No data, which means that server does not have it. Another keyserver did:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys D6786CE303D9A9022998DC6CC8464D549AF75C0A

Before you trust the key, compare its fingerprint with the one the project publishes:

$ gpg --fingerprint s.kandaurov@f5.com
pub   rsa4096 2022-05-18 [SC]
      D678 6CE3 03D9 A902 2998  DC6C C846 4D54 9AF7 5C0A
uid           [ unknown] Sergey Kandaurov <s.kandaurov@f5.com>

3. Verify again and read the result

$ gpg --verify nginx-1.30.5.tar.gz.asc nginx-1.30.5.tar.gz
gpg: Good signature from "Sergey Kandaurov <s.kandaurov@f5.com>" [unknown]
gpg: WARNING: The key's User ID is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: D678 6CE3 03D9 A902 2998  DC6C C846 4D54 9AF7 5C0A

• Good signature: the file is exactly what the key holder signed. This is what you need.
• The WARNING is normal for a key you just imported. gpg only means you have not personally certified the key. Checking the fingerprint against the project’s website is the practical answer.
• BAD signature: the file was changed or damaged. We added one byte to the download and got gpg: BAD signature from "Sergey Kandaurov ...". Delete it and download it again from the official site.

Always give both files: the signature first, then the download. If a project publishes only a checksum and no signature, compare the SHA256 sum instead, see verify files with a checksum.

Related: APT repository key errors

Errors about missing keys when you run apt update come from APT, not from your gpg keyring. The repository key has to be saved in /etc/apt/keyrings/ and named in the repository entry with signed-by. See add and remove repositories on Ubuntu and, as a worked example, install Docker from the official repository.

Official documentation: gpg(1) manual and nginx PGP public keys.