https://www.techtarget.com/searchsecurity/tutorial/Update-Kali-Linux-to-the-latest-software-repository-key
Two key benefits of open source software are how relatively easy it is for developers to modify code and how quickly users can acquire the updated applications. Unfortunately, this approach also leaves software vulnerable to malicious tampering and untested updates.
To combat this problem, vendors use a public-private key pair to digitally sign software repositories, thereby mitigating unauthorized code changes. This is an essential part of application security for all Linux users.
The process of digitally signing the repository looks like this:
In April 2025, the maintainers of Kali Linux -- a popular distro focused on security auditing and penetration testing -- lost access to the signing key used to guarantee the authenticity of software in the Kali repositories. The team generated a new key pair, but existing Kali installations that relied on the older key received errors anytime users tried to install or update their software.
As a result, users must download a new Kali Linux repository key before they can properly manage applications on their Kali installation.
Let's look at how to identify if your Kali instance needs a new key and, if so, how to update it.
Identifying whether your Kali Linux installation needs a new key is pretty straightforward. If you installed Kali before April 2025, you likely have the outdated key. Because the key is incorrect, you will see one of the following errors when attempting to install or update software from the Kali repositories:
You could also see errors if you run automated scripts or tasks to update the system. Check for these errors in the /var/log directory or wherever the automation software stores its log files.
You might run into these errors in the following situations:
Users with Kali Linux 2025.1c or newer already have the new key, and no action is needed.
Note, you might have more Kali Linux installations around than you realize. It's a common version of the OS for administrators, developers and security professionals to experiment with. Check the following systems for Kali Linux installations that might contain the old key:
Kali Linux is less likely to be used as a server OS or installed on standard user computers. It's a specialized Linux distribution most often used by security professionals.
The fix is to download the new Kali Linux repository key and add it to the Kali Linux distribution's keyring. Accomplish this with the following command:
sudo wget https://archive.kali.org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg
If you prefer to use curl instead of wget to download the key, type:
sudo curl https://archive.kali.org/archive-keyring.gpg -o /usr/share/keyrings/kali-archive-keyring.gpg
The process is quick. Once you complete it, update the system using the standard apt-get commands. This can take several minutes if you haven't updated the installation in a while. You can also install any new software you need from the Kali repositories.
$ sudo apt-get update
$ sudo apt-get install nmap
The updates and installations will proceed as normal. The key-checking process is automated; you won't need to run additional commands.
If you want to view the keyring, type the following command:
gpg --no-default-keyring --keyring /usr/share/keyrings/kali-archive-keyring.gpg -k
Updating the key will have no other effect on your system.
Digitally signing software and software repositories is critical to system security. It is equally crucial that end users keep their OSes and applications up to date. Integrate the following best practices into your Linux software management process:
Digitally signed software is a critical part of the application distribution infrastructure. Security and Linux admins must understand the role it plays in ensuring tamper-free and trusted software.
Kali Linux users tend to be particularly cautious and aware of such security practices. Update the key on your Linux systems immediately so that you can keep the OS and applications current with security fixes and feature enhancements.
Be aware that Kali Linux is not the only distribution or software source that faces this challenge. You could run into this problem with other vendors, so be on the lookout for similar errors. If you encounter them, you now have the knowledge you need to address the issue.
Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to Informa TechTarget, The New Stack and CompTIA Blogs.
23 Jun 2025