Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead

ONLINECAST

2 min read

·

05-10-2024

10

0

Share

The End of an Era: Moving Away from apt-key and Embracing trusted.gpg.d

The Problem: You're trying to install a package on your Debian-based Linux system (like Ubuntu or Mint), but you encounter a warning message: "Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead."

Simplified: The apt-key command, which you might have used to add and manage GPG keys for software repositories, is no longer the recommended way. There's a newer, more secure method called trusted.gpg.d to handle this.

The Scenario:

Imagine you're installing a new application, and its instructions require you to add a GPG key to your system to verify the software's authenticity. You've always used apt-key add <key-file> in the past, but now you get that dreaded warning.

# Old way - using apt-key
sudo apt-key add <key-file> 

Why the Change?

trusted.gpg.d is a more secure and flexible approach to managing GPG keys for your system. Here's why:

• Security: trusted.gpg.d isolates GPG keys into individual files within the /etc/apt/trusted.gpg.d directory. This improves security by preventing accidental deletion or modification of the entire keyring, which could happen with apt-key.
• Flexibility: Each GPG key file in trusted.gpg.d can be managed independently, allowing you to easily add, remove, or update keys for specific repositories.
• Simplified Management: The apt package manager automatically handles the necessary key management within trusted.gpg.d, eliminating the need for manual intervention with apt-key.

How to Migrate from apt-key to trusted.gpg.d:

1. Identify the key: Determine which GPG key you need to add. You can usually find it on the software repository's website or in the installation instructions.

2. Download the key: Download the GPG key file, typically in .asc or .gpg format.

3. Create a Keyring File: Create a new file in /etc/apt/trusted.gpg.d with a descriptive name. For example:

   sudo touch /etc/apt/trusted.gpg.d/your_repository_name.gpg
   

4. Import the Key: Import the downloaded key file into the newly created keyring file:

   sudo gpg --import <downloaded-key-file> > /etc/apt/trusted.gpg.d/your_repository_name.gpg
   

   Replace <downloaded-key-file> with the actual path to your downloaded key file.

Example:

Let's say you're adding the GPG key for the "MyAwesomeRepo" repository. Here's the process:

1. Download: wget https://myawesomerepo.com/MyAwesomeRepo.gpg
2. Create: sudo touch /etc/apt/trusted.gpg.d/myawesomerepo.gpg
3. Import: sudo gpg --import MyAwesomeRepo.gpg > /etc/apt/trusted.gpg.d/myawesomerepo.gpg

Additional Tips:

• Verification: After importing the key, verify its authenticity by checking its fingerprint and comparing it to the information provided on the repository's website.
• Clean up: You can safely remove the downloaded GPG key file after importing it into trusted.gpg.d.
• Legacy Support: If you're still running older versions of Debian-based systems, you might need to manually update your apt package manager to ensure compatibility with trusted.gpg.d.

Conclusion:

Switching from apt-key to trusted.gpg.d is a straightforward process and brings significant benefits in terms of security, flexibility, and ease of management. By adopting this modern approach, you can ensure that your system's software repositories are properly secured and efficiently managed.

Further Resources:

• Ubuntu Documentation: https://help.ubuntu.com/lts/serverguide/apt.html
• Debian Wiki: https://wiki.debian.org/SecureApt