APT disables a repository when it cannot verify the archive metadata it needs to download packages safely. The message is not a prompt to bypass a warning. It tells you to identify the failing source, then remove it, correct it, or install the repository’s current signing key from its official instructions.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
Read the error above the notice
Run the update again and read the repository URL plus the line immediately before this notice. APT usually names the failure, such as a missing Release file, an unsupported distribution codename, an expired signature, or NO_PUBKEY followed by a key ID.
sudo apt update
Keep the complete URL and error text. The notice alone does not say whether the repository is obsolete, configured for the wrong release, or missing its signing key.
Why APT blocks the repository
APT verifies repository Release metadata before it trusts package indexes from that source. A missing Release file means the configured suite is not published at that location. A signature failure means APT cannot verify the metadata with a trusted key.
That distinction matters. Installing with allow-unauthenticated, adding trusted=yes, or allowing insecure repositories suppresses the protection instead of repairing the source, so do not use those settings for a normal package source.
Find the source file that defines the repository
APT sources can live in the main sources.list file or in separate list and deb822 source files under sources.list.d. List the configured entries before changing anything.
grep -R --line-number --no-messages -E '^[[:space:]]*(deb|Types:)' /etc/apt/sources.list /etc/apt/sources.list.d
Match the URL from apt update to the reported filename. A source can be a one-line .list entry or a deb822 .sources file, so edit the file that contains the failing URL rather than assuming every source belongs in one location.
If you need a refresher on safely navigating configuration files, use the Linux command line guide and the overview of the Linux file system. Changes under etc require administrative access, so the guide to Linux users and permissions explains why a normal account cannot save them.
Choose the repair that matches the error
Choose one repair from the message APT printed rather than adding a trust override.
The repository is no longer needed
Disable or remove the source entry, then run apt update again. This is the safest repair for an old test repository, a removed application, or a source you do not recognize.
Delete only the entry that contains the failing URL. The Linux package management guide explains how repositories fit into package installation and updates.
Leave the distribution’s own sources alone unless their official support instructions identify a required change.
The Release file is missing
Check the vendor’s repository documentation for your exact Debian or Ubuntu release. A missing Release file commonly means the source uses an old codename, points at a retired repository, or targets a distribution version the vendor does not support.
Replace the line only with the current entry published by that vendor. Do not change the URL to an archive mirror or another release codename unless the distribution or vendor documentation explicitly supports that path.
A repository URL that merely responds in a browser is not enough for APT.
APT reports NO_PUBKEY or an invalid signature
Get the repository key and source entry from the software vendor’s current installation page. Modern APT source entries can use signed-by to bind one repository to a specific keyring, which avoids trusting that key for every configured source.
Do not copy a key from a forum post or add it globally with apt-key. When a vendor supplies a key download, inspect the HTTPS URL before using a tool such as wget to retrieve it, then follow the vendor’s documented signed-by path.
The source entry and its signing key must come from the same repository owner.
Verify the repair without weakening APT
After each targeted change, run the update and confirm that APT completes without the repository security notice or a GPG or Release-file error for that source.
sudo apt update
When another source fails, diagnose that URL independently. A successful update does not permit installation from an unsigned source.
When the source is part of an unsupported system release
An end-of-life Ubuntu or Debian release may no longer have repository metadata at its former address. Check your distribution’s supported upgrade path, then move to a supported release rather than keeping an insecure repository enabled.
Keep every package source both reachable and authenticated so APT can protect the package indexes your system uses.