Yep, it looks like the GitLab GPG signing key has expired.

So you were on the right track. That thread looks relevant, but the specific post you link to looks like GPG keys for GitLab runners (rather than for apt). You may need to run that too (I know almost nothing about GitLab itself) but on face value, I'm not sure it's related

Anyway, before i answer your questions, it's worth noting that by default, we follow best practice for third party apt repos. So the key is stored outside the "normal" /etc/apt/trusted.gpg (or /etc/apt/trusted.gpg.d), in a root-owned location (so only root can change it) /usr/share/keyrings.

If you have a look at our default GitLab sources.list file (gitlab-ce.list) you'll see that the lines that matter (start with 'deb') it includes a bit that looks like this: '[signed-by=/usr/share/keyrings/gitlab-ce.gpg]'. That is the part that locks the GitLab repo to only use that key (and no other repos can use that key). It's an additional security measure. It's probably unlikely that GitLab will get hacked and/or push malicious packages, but it's not that much extra work, so IMO it's worth doing. Please note though that it doesn't protect against an actual malicious GitLab package, but it removes any opportunity for the GitLab key top be used to authenticate packages from somewhere else (or some other key to authenticate GitLab packages). So it's not really necessary, but is best practice.

So how you proceed from here will depend on how your GitLab apt config is set up and/or how you want it set up. If your install doesn't store it's key in /usr/share/keyrings (and include the 'signed-by' bit) then it's super easy to update the key. If you have a keypath specified with 'signed-by' it's a little different, but not really that hard. And if you don't already have it set up, you can if you wish. FWIW it looks like GitLab have updated their instructions to also cover the more secure use of keys.

So if you aren't already using the more secure method, and want to, then hopefully I've already provided enough hints to get you going (if not, please ask). If you just want to get it working, here is a code snippet that should update the key for you:

# search source.list files for lines that include 'packages.gitlab.com', then extracts the key path (if specified)
key=$(sed -En "/packages.gitlab.com/ s|^.*\[.*signed-by=([-/a-z]*).gpg.*|\1.gpg|p" /etc/apt/sources.list.d/* | head -1)
if [[ -f "$key" ]]; then
    # if the key file exists download it and overwirte the old key
    curl -s "https://packages.gitlab.com/gpg.key" | gpg --dearmor > $key
else
    # if there is no key file, just delete the key from the main keyring and add the new one
    apt-key del 3F01618A51312F3F
    curl -s "https://packages.gitlab.com/gpg.key" | apt-key add -
    apt-key list 3F01618A51312F3F
fi

Hopefully that should do the trick and now apt update should work...! If it doesn't please share the output of these:

grep -R packages.gitlab.com /etc/apt/sources.list*
ls -la /usr/share/keyrings

For what it's worth, it does look like you already have the latest Gitlab package installed. You just need to update the key so that you can get future updates.

You're most welcome. Glad to hear you're up and running again! :)