signing key incorrectly added using apt-key add instead of being dropped in trusted.gpg.d
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
The package should not be using apt-key add to add keys, but drop a key file in trusted.gpg.d. We APT developers seem to be very bad at getting people to stop using apt-key, arguably we should have added stronger deprecation messages.
Anyway, you should drop a .gpg blob into your directory somewhere and copy it to trusted.gpg.d, and use apt-key del to remove the key from trusted.gpg. Or base64 encode it and decode it, or just drop the ASCII-encoded version with .asc extension (but this only works with APT 1.4 and newer).
Expect the current way to break by 2022 (well, it's even not correctly working right now - you don't depend on gnupg, but apt-key add is not functional without it).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the package installation script that invokes apt-key add and inspect how the signing key is bundled and installed. Replace the current key installation path with trusted.gpg.d handling, remove the old key from trusted.gpg, and verify installation works without an implicit gnupg dependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100