131

Recently I've noticed some issues when running apt where the system will warn me of a keyring deprecation:

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
8 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: https://packages.microsoft.com/repos/edge/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: https://download.sublimetext.com/apt/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

This doesn't stop me from performing the update, but I would much rather not see this when updating my system. How are we supposed to store trusted GPG keys going forward?

Improve this question
2

6 Answers 6

Reset to default
184

One way to resolve this is to export the GPG key from the deprecated keyring and store it in /usr/share/keyrings. Fortunately, it's not too difficult:

  1. Open Terminal (if it's not already open)

  2. List existing keys:

    $ sudo apt-key list
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2017-05-08 [SCEA]
      1EDD E2CD FC02 5D17 F6DA  9EC0 ADAE 6AD2 8A8F 901A
uid           [ unknown] Sublime HQ Pty Ltd <support@sublimetext.com>
sub   rsa4096 2017-05-08 [S]

pub   rsa2048 2015-10-28 [SC]
      BC52 8686 B50D 79E3 39D3  721C EB3E 94AD BE12 29CF
uid           [ unknown] Microsoft (Release signing) <gpgsecurity@microsoft.com>

  3. From here, we can export a key:

    sudo apt-key export BE1229CF | sudo gpg --dearmour -o /usr/share/keyrings/microsoft.gpg

    Note: The BE1229CF value comes from the last 8 characters of the pub code.

    The following message will likely appear:

    Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).

  4. Now we can update our apt source file for the repository (e.g., /etc/apt/sources.list.d/microsoft.list), adding a signed-by tag:

    deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/edge/ stable main

  5. Update apt to confirm the message is gone:

    sudo apt update
...
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up-to-date.
W: https://download.sublimetext.com/apt/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

  6. Remove the original signature:

    sudo apt-key del BE1229CF

This can be done with each of the warning messages. Once done, apt will no longer complain.

Improve this answer
17
  • 6
    Related Q&A: What commands (exactly) should replace the deprecated apt-key?
    – Artur Meinild
    Mar 20, 2022 at 13:36
  • 1
    @ArturMeinild this is good to know 👍🏻
    – matigo
    Mar 20, 2022 at 14:07
  • 7
    You should use /usr/share/keyrings, not /etc/apt/keyrings - wiki.debian.org/DebianRepository/UseThirdParty
    – OrangeDog
    Mar 20, 2022 at 15:28
  • 5
    regarding: Note: The BE1229CF value comes from the last 8 characters of the pub code. — can you elaborate more, the "BE1229CF" is clearly not anywhere on screen here. You did some bit operations to get this value or what?
    – Martin Mucha
    May 12, 2022 at 12:29
  • 2
    what if an app automatically configures the .list file, thus reverting the changes each time? For example, this warning is found inside the slack.list file: ### THIS FILE IS AUTOMATICALLY CONFIGURED ### # You may comment out this entry, but any other modifications may be lost. How does one get around this corner case, i.e. making sure the signed-by addition is kept and not reverted by the apt source maintainer?
    – dimisjim
    Aug 13, 2022 at 9:39
108

try this

cd /etc/apt
sudo cp trusted.gpg trusted.gpg.d
Improve this answer
7
  • 16
    For reviewers: this makes sense because /etc/apt/trusted.gpg is the old form of one singular keyring. In the modern apt, each keyring is stored individually in /etc/apt/trusted.gpg.d. Moving the legacy database into /etc/apt/trusted.gpg.d/ is the workaround to readding repositories manually and having apt update the key storage automatically. This is one workaround, though it's not the best nor most APT-preferred solution it is a solution nonetheless.
    – Thomas Ward ♦
    May 16, 2022 at 14:37
  • 1
    Two first time posters have commented (as answers) that this worked for them. This post should not be deleted. I am up voting this answer on the behalf of the two new users.
    – user68186
    May 16, 2022 at 15:41
  • 10
    The fact that something works does not equal that it is a good or viable solution. Depending on which keys are stored inside trusted.gpg, this could potentially be a security breach.
    – Artur Meinild
    May 16, 2022 at 15:46
  • 2
    Ubuntu 22.04. Worked for me as well. Thanks..
    – sundowatch
    Jul 17, 2022 at 7:52
  • 1
    folder trusted.gpg.d is supposed to have one key per file, is it not? apt does not manipulate the copied file in any way. apt-key list still prints the warning too, even though I moved the file and it is recognized. Also cp makes two copies of the same file.
    – Валерий Заподовников
    Feb 17 at 17:23
27

The easy way to fix these warning messages generated by sudo apt update...

W: https://linux.teamviewer.com/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://apt.keepsolid.com/ubuntu/dists/groovy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://linux.dropbox.com/ubuntu/dists/disco/Release.gpg: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.virtualbox.org/virtualbox/debian/dists/hirsute/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.opensuse.org/repositories/home:/IBBoard:/cawbird/xUbuntu_22.04/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/solaar-unifying/stable/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/yannubuntu/boot-repair/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Note: These warning messages can be generated by any enabled repo or ppa in Software & Updates "Other Software" tab.

Example fix:

For this warning message with sudo apt update...

W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

We look in sudo apt-key list and find this entry for xbmc...

pub   rsa1024 2009-01-20 [SC]
      1897 01DA 570C 56B9 488E  F60A 6D97 5C47 91E7 EE5E
uid           [ unknown] Launchpad PPA for XBMC for Linux

Then we convert this entry to a .gpg file, using the last 8 numeric characters from above...

sudo apt-key export 91E7EE5E | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/team-xbmc.gpg

Repeat the above commands for each warning message generated by sudo apt update.

Note: Partially taken from the accepted answers here and here.

Improve this answer
5
  • 1
    I like this answer better as it puts the keys in /etc/apt/trusted.gpg.d/
    – Tod Thomson
    Oct 9, 2022 at 1:33
  • 1
    +1 for me; the top two answers fail on my Linux Mint Vanessa system with zsh: bad pattern: [arch=amd64
    – AlMo320
    Oct 20, 2022 at 19:56
  • Thank you for this. Makes me wonder why there's no official tool that does that. It seems they attempted to target a security vulnerability, yet failed miserably in providing an easy way to actually implement it in existing installations.
    – TheMechanic
    Feb 19 at 20:30
  • How to generate the magic "91E7EE5E" code??
    – Peter Krauss
    Mar 18 at 22:00
  • @PeterKrauss As it says in the answer, issue a sudo apt-key list command, and use the last 8 characters of the output... "91E7 EE5E" with no spaces.
    – heynnema
    Mar 19 at 3:18
5

Considering all the good suggestions provided, I've crafted a helper oneliner to automate the process for all keys:

sudo apt-key list 2>&1 | grep -E '(trusted.gpg.d)' -A 3 | grep -v '^\-\-' | grep -v '^pub ' | sed 's@.*/trusted.gpg.d/\(.*\)@\1@g' | awk 'NR%2{printf "%s ",$0;next;}1' | awk '{print "sudo apt-key export "$10$11" | sudo gpg --dearmour -o /usr/share/keyrings/"$1}' | xargs -I{} eval("{}")
Improve this answer
3
  • Thanks, but gives me an error: bash: syntax error near unexpected token (' it seems some warning output is in the way, so I could still use it by dropping the final | xargs and then copy-pasting output manually.
    – Epskampie
    Jun 8, 2022 at 12:23
  • 1
    Works for me, but I need to change a little bit: sudo apt-key list 2>&1 | grep -E '\/(trusted.gpg.d)' -A 3 | grep -v '^\-\-' | grep -v '^pub ' | /bin/sed 's@.*/trusted.gpg.d/\(.*\)@\1@g' | /bin/awk 'NR%2{printf "%s ",$0;next;}1' | /bin/awk '{print "sudo apt-key export "$10$11" | sudo gpg --dearmour -o /usr/share/keyrings/"$1}' | xargs -I'{}' bash -c "eval '{}'". On first grep, you need to use regex '\/(trusted.gpg.d)' instead, either match with warning message. At the end, I need to change xargs execute.
    – Bernardo Loureiro
    Jun 29, 2022 at 14:41
  • 1
    thanks for this! my pass: sudo apt-key list | sudo awk -v n=4 'n==3{k=$(NF-1)$NF;cmd="apt-key export "k"|gpg --dearmour -o "d;print cmd;system(cmd)}/^\/.*\/trusted\.gpg\.d\//{d=$1;n=0}{n++}'
    – keithpjolley
    Aug 31, 2022 at 20:10
2

I solved it with some commands like below.

gpg --refresh-keys

this will update all the key resolve the problem

Improve this answer
3
  • ''' for KEY in $( \ apt-key --keyring /etc/apt/trusted.gpg list \ | grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})" \ | tr -d " " \ | grep -E "([0-9A-F]){8}\b" \ ); do K=${KEY:(-8)} apt-key export $K \ | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg done '''
    – Muhammad Irfan Aslam
    Jan 18 at 10:26
  • This did not work for me, Ubuntu 22.04.1 LTS, Jammy
    – M.K
    Feb 8 at 13:37
  • Didn't work for me in Kali 2022.4
    – J. Scott Elblein
    Feb 24 at 2:17
0

In my case, solutions above did not work. Maybe it's because it is a specific case. The warning:

9 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: https://packages.cloud.google.com/apt/dists/coral-cloud-stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: https://packages.cloud.google.com/apt/dists/coral-edgetpu-stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

This fixed it for me:

wget -O- https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo tee /etc/apt/trusted.gpg.d/coral-edgetpu.gpg
Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.