apt-key Deprecation / Apt 2.2 changes

[Patrick]

@torjunkie

curl -s URL

better:

Secure Command Line / Scurl

@torjunkie

cat URL.pub | sudo gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/NAME.gpg --import

Not good since it skips gpg fingerprint verification.

@torjunkie

authorize the user _apt :

sudo chown _apt /etc/apt/trusted.gpg.d/NAME.gpg

Not required. For comparison:

ls -la /etc/apt/trusted.gpg.d/

Files there are all owned by user root and group root and world readable.

@Patrick

APT folder /etc/apt/trusted.gpg.d support ascii armored gpg keys since Debian bullseye. This will simplify everything discussed here.

Meaning whatever the key format .asc or .gpg.

sudo cp /path/to/gpg-public-key.asc /etc/apt/trusted.gpg.d/

No more gpg or apt-key required on the command line.

However, actually folder /usr/share/keyrings/ and signed-by should be used. See:

APT repository signing keys per APT sources.list - signed-by

Documentation [and repository-dist package] should be changed to the following style: example, file: /etc/apt/sources.list.d/docker.list contents: deb [signed-by=/usr/share/keyrings/docker.gpg] tor+https://download.docker.com/linux/debian bullseye stable New signed-by method: APT signing keys should be stored in folder /usr/share/keyrings/ instead of /etc/apt/trusted.gpg.d. By using /usr/share/keyrings/ these keys as far as I understand aren’t used for anything - unless a file in folde…

Does that make sense?