Invalid GPG signature - what to do about it?

If you still have that script, or know where to find it, we can check what it did in your system. You can use something like pastebin to share plain text; just copy and paste. If the script is too large and exceeds pastebin's limit, you can use something like ffsend (choose an instance here) or Wormhole, instead.

Removing the repository effectively makes the system forget where to go look for updates, so yes, that would be a problem. However, when the GPG key is missing or invalid, it won't download anything from that location anyway.
Your options are to either replace the repository, the GPG key, or both. In either case, you need to know where you got it from in the first place, since that's where they usually include information about how to install it again.
If I had to do it myself I would use this, but please double check yourself:

But before you attempt that, you need to remove the current reference to the repository as well as the GPG key. Most likely, you can find the repository in a dedicated file under /etc/apt/sources.list.d. The GPG key will also be in its own dedicated file, either under /etc/apt/keyrings, /etc/apt/trusted.gpg.d or /usr/share/keyrings.

Once you have found those files, delete them. Then, follow the instructions from the link above to re-install the repository.

1 Like