packaging/linux/deb: apt-key is deprecated
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- PR merge metrics
- PR metrics pending
Description
I recently added warnings for keys in trusted.gpg to APT, they'll ship in Debian 12 and Ubuntu 22.04:
```
W: http://prerelease.keybase.io/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
```
apt-key has been deprecated for a couple years now. Please consider installing a keyring file into /usr/share/keyrings instead (directly in the deb, not in postinst), and then create a sources.list.d/keybase.list referencing that with signed-by.
```
deb [signed-by=/usr/share/keyrings/keybase-keyring.gpg] http://prerelease.keybase.io/deb stable main
```
Alternatively, you can drop the key into trusted.gpg and not use signed-by, as chrome does at the moment:
https://chromium.googlesource.com/chromium/src/+/117cfd4c6a3aa57c93590042b2347ade68f83808%5E%21/
This has the added complexity of needing to base64 encode the key in the postinst, is less safe, and awkward.
Support for apt-key will be removed from development releases starting next month.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in packaging/linux/deb and locate the deb contents and postinst handling for the APT key. Compare the requested /usr/share/keyrings keyring and sources.list.d/keybase.list signed-by approach with the current package, then verify installation without the apt-key deprecation warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- debian, linux
- Domain
- build-system, operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100