E: Conflicting values set for option Signed-By regarding source https://download.docker.com/linux/ubuntu/ noble: /usr/share/keyrings/docker-archive-keyring.gpg != /etc/apt/keyrings/docker.asc means the same repository is listed twice with two different key files. Keep one of the two lines and remove the other; in the test that brought the update back.

In the test the repository was set up twice, in two list files with two key paths. Find both lines with grep -r on the repository address, decide which key file you keep, and move the other list file away.

The error

$ echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable' > /etc/apt/sources.list.d/docker.list
exit code: 0
$ echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu noble stable' > /etc/apt/sources.list.d/docker-ce.list
exit code: 0
$ apt-get update
E: Conflicting values set for option Signed-By regarding source https://download.docker.com/linux/ubuntu/ noble: /usr/share/keyrings/docker-archive-keyring.gpg != /etc/apt/keyrings/docker.asc
E: The list of sources could not be read.
exit code: 100

It also blocked installing a package that has nothing to do with Docker:

$ apt-get install -y jq
E: Conflicting values set for option Signed-By regarding source https://download.docker.com/linux/ubuntu/ noble: /usr/share/keyrings/docker-archive-keyring.gpg != /etc/apt/keyrings/docker.asc
E: The list of sources could not be read.
exit code: 100

Why it happens

Two files described the same source, the same address and the same release noble, and each named a different keyring in signed-by=. apt refused to choose between them and printed both paths with != between them. Neither run printed a Hit: or Get: line: the update and an unrelated install of jq failed alike, each with the same two E: lines and exit code 100.

Note that the second path, /usr/share/keyrings/docker-archive-keyring.gpg, did not even exist in the container (an ls -l run after the fix printed No such file or directory for it and listed /etc/apt/keyrings/docker.asc at 3817 bytes). The message is about the two values disagreeing, not about a missing file.

The fix

$ grep -r download.docker.com /etc/apt/sources.list.d
/etc/apt/sources.list.d/docker-ce.list:deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu noble stable
/etc/apt/sources.list.d/docker.list:deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable
exit code: 0
$ mv /etc/apt/sources.list.d/docker-ce.list /root/docker-ce.list.off
exit code: 0
$ apt-get update
Get:1 https://download.docker.com/linux/ubuntu noble InRelease [48.5 kB]
Get:2 https://download.docker.com/linux/ubuntu noble/stable amd64 Packages [89.1 kB]
Hit:3 http://archive.ubuntu.com/ubuntu noble InRelease
...
Reading package lists...
exit code: 0

grep found the two files. The one kept was docker.list, whose key file had been downloaded to /etc/apt/keyrings/docker.asc in the same test; the other was moved to /root. The update then fetched the Docker feed and returned 0. Keep the line whose key file exists on your machine (in this test an ls -l run afterwards confirmed which one that was), or download the key again for the one you keep, as in the NO_PUBKEY post.

How it was reproduced

The capture was made in an ubuntu:24.04 container (Ubuntu 24.04.5 LTS, apt 2.8.3, curl installed beforehand) on Docker Engine 29.9.3, standing in for Ubuntu in WSL. As root, Docker's key was saved to /etc/apt/keyrings/docker.asc, two list files for Docker's noble stable feed were written with different signed-by= paths, the update and an install of jq were run, then one file was moved away and the update was run again.

Frequently asked

How do I fix 'Conflicting values set for option Signed-By'?
Find both lines with grep -r on the repository address under /etc/apt/sources.list.d and keep one. In the test moving docker-ce.list away made apt-get update return 0.
Why does apt-get install fail with a Signed-By error?
In the test apt could not read its list files while the conflict stood, so apt-get install -y jq failed with the same two E: lines and exit code 100.
Which signed-by line should I keep?
Keep the one whose key file exists. In the test docker.list pointed at /etc/apt/keyrings/docker.asc, which had been downloaded, and that line updated cleanly.

More decoded errors in the Fixes category. A source repeated without a signed-by conflict gives a warning instead; see configured multiple times.