keybase / keybase/client

packaging/linux/deb: apt-key is deprecated

Open
#24,856 19 comments 25 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

I recently added warnings for keys in trusted.gpg to APT, they'll ship in Debian 12 and Ubuntu 22.04:

```
W: http://prerelease.keybase.io/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
```

apt-key has been deprecated for a couple years now. Please consider installing a keyring file into /usr/share/keyrings instead (directly in the deb, not in postinst), and then create a sources.list.d/keybase.list referencing that with signed-by.

```
deb [signed-by=/usr/share/keyrings/keybase-keyring.gpg] http://prerelease.keybase.io/deb stable main
```

Alternatively, you can drop the key into trusted.gpg and not use signed-by, as chrome does at the moment:
https://chromium.googlesource.com/chromium/src/+/117cfd4c6a3aa57c93590042b2347ade68f83808%5E%21/

This has the added complexity of needing to base64 encode the key in the postinst, is less safe, and awkward.

Support for apt-key will be removed from development releases starting next month.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in packaging/linux/deb and locate the deb contents and postinst handling for the APT key. Compare the requested /usr/share/keyrings keyring and sources.list.d/keybase.list signed-by approach with the current package, then verify installation without the apt-key deprecation warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
debian, linux
Domain
build-system, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.