186

Recently I've noticed some issues when running apt where the system will warn me of a keyring deprecation:

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
8 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: https://packages.microsoft.com/repos/edge/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: https://download.sublimetext.com/apt/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

This doesn't stop me from performing the update, but I would much rather not see this when updating my system. How are we supposed to store trusted GPG keys going forward?

4
  • 1
    Does this answer your question? What commands (exactly) should replace the deprecated apt-key?
    – OrangeDog
    Mar 20, 2022 at 15:29
  • After frustration that Ubuntu would change its GPG tools and cause everyone to have to deal with this, entering asinine commands to fix, which didnt work for me to even just remove the key: sudo apt-key del <last 8 chars from sudo apt-key list | grep -i -C 5 <pgk> >, it seems that removing the package and the source file grep <pkg> /etc/apt/sources.list.d/* and reinstalling worked. apt purge <pkg> might remove the sources file, but likely also config files.
    – alchemy
    Apr 12, 2023 at 2:17
  • doing sudo apt remove sublime-text and removing all the the sources files, followed by sudo apt update; sudo apt install sublime-text did not fix the problem for me. I guess it is not important. Jan 25 at 7:30

8 Answers 8

260

One way to resolve this is to export the GPG key from the deprecated keyring and store it in /usr/share/keyrings. Fortunately, it's not too difficult:

  1. Open Terminal (if it's not already open)

  2. List existing keys:

    $ sudo apt-key list
    Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
    /etc/apt/trusted.gpg
    --------------------
    pub   rsa4096 2017-05-08 [SCEA]
          1EDD E2CD FC02 5D17 F6DA  9EC0 ADAE 6AD2 8A8F 901A
    uid           [ unknown] Sublime HQ Pty Ltd <[email protected]>
    sub   rsa4096 2017-05-08 [S]
    
    pub   rsa2048 2015-10-28 [SC]
          BC52 8686 B50D 79E3 39D3  721C EB3E 94AD BE12 29CF
    uid           [ unknown] Microsoft (Release signing) <[email protected]>
    
  3. From here, we can export a key:

    sudo apt-key export BE1229CF | sudo gpg --dearmor -o /usr/share/keyrings/microsoft.gpg
    

    Note: The BE1229CF value comes from the last 8 characters of the pub code.

    The following message will likely appear:

    Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
    
  4. Now we can update our apt source file for the repository (e.g., /etc/apt/sources.list.d/microsoft.list), adding a signed-by tag:

    deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/edge/ stable main
    
  5. Update apt to confirm the message is gone:

    sudo apt update
    ...
    Reading package lists... Done
    Building dependency tree... Done
    Reading state information... Done
    All packages are up-to-date.
    W: https://download.sublimetext.com/apt/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
    
  6. Remove the original signature:

    sudo apt-key del BE1229CF
    

This can be done with each of the warning messages. Once done, apt will no longer complain.

23
  • 8
  • 7
    You should use /usr/share/keyrings, not /etc/apt/keyrings - wiki.debian.org/DebianRepository/UseThirdParty
    – OrangeDog
    Mar 20, 2022 at 15:28
  • 6
    regarding: Note: The BE1229CF value comes from the last 8 characters of the pub code. — can you elaborate more, the "BE1229CF" is clearly not anywhere on screen here. You did some bit operations to get this value or what? May 12, 2022 at 12:29
  • 3
    @MartinMucha take a look at the code block in item 1. You'll see BE12 29CF on the second-last line. That's where it comes from 👍🏻
    – matigo
    May 12, 2022 at 13:17
  • 2
    what if an app automatically configures the .list file, thus reverting the changes each time? For example, this warning is found inside the slack.list file: ### THIS FILE IS AUTOMATICALLY CONFIGURED ### # You may comment out this entry, but any other modifications may be lost. How does one get around this corner case, i.e. making sure the signed-by addition is kept and not reverted by the apt source maintainer?
    – dimisjim
    Aug 13, 2022 at 9:39
171

try this

cd /etc/apt
sudo cp trusted.gpg trusted.gpg.d
11
  • 23
    For reviewers: this makes sense because /etc/apt/trusted.gpg is the old form of one singular keyring. In the modern apt, each keyring is stored individually in /etc/apt/trusted.gpg.d. Moving the legacy database into /etc/apt/trusted.gpg.d/ is the workaround to readding repositories manually and having apt update the key storage automatically. This is one workaround, though it's not the best nor most APT-preferred solution it is a solution nonetheless.
    – Thomas Ward
    May 16, 2022 at 14:37
  • 2
    Two first time posters have commented (as answers) that this worked for them. This post should not be deleted. I am up voting this answer on the behalf of the two new users.
    – user68186
    May 16, 2022 at 15:41
  • 14
    The fact that something works does not equal that it is a good or viable solution. Depending on which keys are stored inside trusted.gpg, this could potentially be a security breach. May 16, 2022 at 15:46
  • 4
    Ubuntu 22.04. Worked for me as well. Thanks..
    – sundowatch
    Jul 17, 2022 at 7:52
  • 2
    I opted for a symbolic link in case more keys are added to trusted.gpg later: sudo ln -s ../trusted.gpg /etc/apt/trusted.gpg.d/
    – Jayen
    Jun 22, 2023 at 4:29
43

The easy way to fix these warning messages generated by sudo apt update...

W: https://linux.teamviewer.com/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://apt.keepsolid.com/ubuntu/dists/groovy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://linux.dropbox.com/ubuntu/dists/disco/Release.gpg: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.virtualbox.org/virtualbox/debian/dists/hirsute/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.opensuse.org/repositories/home:/IBBoard:/cawbird/xUbuntu_22.04/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/solaar-unifying/stable/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/yannubuntu/boot-repair/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Note: These warning messages can be generated by any enabled repo or ppa in Software & Updates "Other Software" tab.

Example fix:


For this warning message with sudo apt update...

W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

We look in sudo apt-key list and find this entry for xbmc...

pub   rsa1024 2009-01-20 [SC]
      1897 01DA 570C 56B9 488E  F60A 6D97 5C47 91E7 EE5E
uid           [ unknown] Launchpad PPA for XBMC for Linux

Then we convert this entry to a .gpg file, using the last 8 numeric characters from above...

sudo apt-key export 91E7EE5E | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/team-xbmc.gpg

Repeat the above commands for each warning message generated by sudo apt update.

Note: Partially taken from the accepted answers here and here.

5
  • 1
    I like this answer better as it puts the keys in /etc/apt/trusted.gpg.d/ Oct 9, 2022 at 1:33
  • 1
    +1 for me; the top two answers fail on my Linux Mint Vanessa system with zsh: bad pattern: [arch=amd64
    – AlMo320
    Oct 20, 2022 at 19:56
  • Thank you for this. Makes me wonder why there's no official tool that does that. It seems they attempted to target a security vulnerability, yet failed miserably in providing an easy way to actually implement it in existing installations. Feb 19, 2023 at 20:30
  • How to generate the magic "91E7EE5E" code?? Mar 18, 2023 at 22:00
  • 1
    @PeterKrauss As it says in the answer, issue a sudo apt-key list command, and use the last 8 characters of the output... "91E7 EE5E" with no spaces.
    – heynnema
    Mar 19, 2023 at 3:18
7

Considering all the good suggestions provided, I've crafted a helper oneliner to automate the process for all keys:

sudo apt-key list 2>&1 | grep -E '(trusted.gpg.d)' -A 3 | grep -v '^\-\-' | grep -v '^pub ' | sed 's@.*/trusted.gpg.d/\(.*\)@\1@g' | awk 'NR%2{printf "%s ",$0;next;}1' | awk '{print "sudo apt-key export "$10$11" | sudo gpg --dearmour -o /usr/share/keyrings/"$1}' | xargs -I{} eval("{}")
3
  • Thanks, but gives me an error: bash: syntax error near unexpected token (' it seems some warning output is in the way, so I could still use it by dropping the final | xargs and then copy-pasting output manually.
    – Epskampie
    Jun 8, 2022 at 12:23
  • 4
    Works for me, but I need to change a little bit: sudo apt-key list 2>&1 | grep -E '\/(trusted.gpg.d)' -A 3 | grep -v '^\-\-' | grep -v '^pub ' | /bin/sed 's@.*/trusted.gpg.d/\(.*\)@\1@g' | /bin/awk 'NR%2{printf "%s ",$0;next;}1' | /bin/awk '{print "sudo apt-key export "$10$11" | sudo gpg --dearmour -o /usr/share/keyrings/"$1}' | xargs -I'{}' bash -c "eval '{}'". On first grep, you need to use regex '\/(trusted.gpg.d)' instead, either match with warning message. At the end, I need to change xargs execute. Jun 29, 2022 at 14:41
  • 1
    thanks for this! my pass: sudo apt-key list | sudo awk -v n=4 'n==3{k=$(NF-1)$NF;cmd="apt-key export "k"|gpg --dearmour -o "d;print cmd;system(cmd)}/^\/.*\/trusted\.gpg\.d\//{d=$1;n=0}{n++}' Aug 31, 2022 at 20:10
1

I solved it with some commands like below.

gpg --refresh-keys

this will update all the key resolve the problem

4
  • ''' for KEY in $( \ apt-key --keyring /etc/apt/trusted.gpg list \ | grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})" \ | tr -d " " \ | grep -E "([0-9A-F]){8}\b" \ ); do K=${KEY:(-8)} apt-key export $K \ | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg done ''' Jan 18, 2023 at 10:26
  • 5
    This did not work for me, Ubuntu 22.04.1 LTS, Jammy
    – M.K
    Feb 8, 2023 at 13:37
  • 1
    Didn't work for me in Kali 2022.4 Feb 24, 2023 at 2:17
  • The command in the comment by Muhammad is from here. Those "" are not part of it so the command starts with for KEY and ends with done. It solved the problem for me.
    – mYnDstrEAm
    Apr 8 at 16:02
1

There is no need to edit sources.list if you use the apt/trust.gpg.d/ folder and you're on debian.

Follow the other steps to get the key id:

$ apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa2048 2012-04-01 [SC]                                                                                                                                  
      A0DA 38D0 D76E 8B5D 6388  7281 9165 938D 90FD DD2E        
uid           [ unknown] Mike Thompson (Raspberry Pi Debian armhf ARMv6+VFP) <[email protected]>                                                            
sub   rsa2048 2012-04-01 [E]

And then run:

apt-key export 90FDDD2E | sudo tee /etc/apt/trusted.gpg.d/raspberry.debian.armhf.asc

You can delete the trust.gpg file, but the errors go away without deleting it.

0

In my case, solutions above did not work. Maybe it's because it is a specific case. The warning:

9 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: https://packages.cloud.google.com/apt/dists/coral-cloud-stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: https://packages.cloud.google.com/apt/dists/coral-edgetpu-stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

This fixed it for me:

wget -O- https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo tee /etc/apt/trusted.gpg.d/coral-edgetpu.gpg
2
  • What does that do? Can you give a more general solution? I have the same proble with other programs.
    – cipricus
    Jun 24, 2023 at 12:04
  • I guess it's a way of adding third party libraries in an updated way. These 2 references might help! ref1 and ref2 @cipricus
    – M.K
    Jun 24, 2023 at 15:11
0

I've taken the answer from @DiRaOL and converted it to a Python script, which I find to be much more readable (albeit longer) than using awk.

import subprocess
import re
from collections import defaultdict
import pathlib
# List all apt-keys
proc = subprocess.Popen(
    'sudo apt-key list',
    shell=True,
    stdout=subprocess.PIPE,
    stderr=subprocess.PIPE)
stdout, stderr = proc.communicate()

# Build a regex that matches a 20 byte hex string
key_pat_part = '  *'.join(['[A-F0-9]{4}'] * 10)
gpg_pat = re.compile(' *' + key_pat_part)

# Parse stdout to map filenames to keys
lines = stdout.decode('utf8').split(chr(10))
current_fpath = None
path_to_keys = defaultdict(list)
for line in lines:
    if set(line) == '-':
        current_fpath = None
    if line.startswith('/etc/apt/trusted'):
        current_fpath = line
    if gpg_pat.match(line):
        key = line.replace(' ', '')
        path_to_keys[current_fpath].append(key)

# Build commands to export to the keyrings path and execute them
keyrings_dpath = pathlib.Path('/usr/share/keyrings/')
for fpath, keys in path_to_keys.items():
    if 'trusted.gpg.d' in fpath:
        assert len(keys) == 1
        key_tail = keys[0][-8:]
        old_fpath = pathlib.Path(fpath)
        new_fpath = keyrings_dpath / old_fpath.name
        if not new_fpath.exists():
            command = f'sudo apt-key export {key_tail} | sudo gpg --dearmour -o {new_fpath}'
            subprocess.check_output(command, shell=True)

I've also written this such that the above command can be wrapped in:

python -c " if 1:
    <the code>
"

and executed in bash.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .