apt-key deprecation warning when updating system: "Key is stored in legacy trusted.gpg keyring"

Question

Recently I've noticed some issues when running apt where the system will warn me of a keyring deprecation:

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
8 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: https://packages.microsoft.com/repos/edge/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: https://download.sublimetext.com/apt/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

This doesn't stop me from performing the update, but I would much rather not see this when updating my system. How are we supposed to store trusted GPG keys going forward?

Does this answer your question? What commands (exactly) should replace the deprecated apt-key? — OrangeDog, Commented Mar 20, 2022 at 15:29
After frustration that Ubuntu would change its GPG tools and cause everyone to have to deal with this, entering asinine commands to fix, which didnt work for me to even just remove the key: sudo apt-key del <last 8 chars from sudo apt-key list | grep -i -C 5 <pgk> >, it seems that removing the package and the source file grep <pkg> /etc/apt/sources.list.d/* and reinstalling worked. apt purge <pkg> might remove the sources file, but likely also config files. — alchemy, Commented Apr 12, 2023 at 2:17
doing sudo apt remove sublime-text and removing all the the sources files, followed by sudo apt update; sudo apt install sublime-text did not fix the problem for me. I guess it is not important. — tobi delbruck, Commented Jan 25 at 7:30

GAD3R · Accepted Answer · 2023-12-28 22:01:19Z

One way to resolve this is to export the GPG key from the deprecated keyring and store it in /usr/share/keyrings. Fortunately, it's not too difficult:

Open Terminal (if it's not already open)

List existing keys:

$ sudo apt-key list
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2017-05-08 [SCEA]
      1EDD E2CD FC02 5D17 F6DA  9EC0 ADAE 6AD2 8A8F 901A
uid           [ unknown] Sublime HQ Pty Ltd <[email protected]>
sub   rsa4096 2017-05-08 [S]

pub   rsa2048 2015-10-28 [SC]
      BC52 8686 B50D 79E3 39D3  721C EB3E 94AD BE12 29CF
uid           [ unknown] Microsoft (Release signing) <[email protected]>

From here, we can export a key:

sudo apt-key export BE1229CF | sudo gpg --dearmor -o /usr/share/keyrings/microsoft.gpg

^{Note: The BE1229CF value comes from the last 8 characters of the pub code.}

The following message will likely appear:

Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).

Now we can update our apt source file for the repository (e.g., /etc/apt/sources.list.d/microsoft.list), adding a signed-by tag:
```
deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/edge/ stable main
```

Update apt to confirm the message is gone:

sudo apt update
...
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up-to-date.
W: https://download.sublimetext.com/apt/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Remove the original signature:
```
sudo apt-key del BE1229CF
```

This can be done with each of the warning messages. Once done, apt will no longer complain.

Related Q&A: What commands (exactly) should replace the deprecated apt-key? — Artur Meinild, Commented Mar 20, 2022 at 13:36
You should use /usr/share/keyrings, not /etc/apt/keyrings - wiki.debian.org/DebianRepository/UseThirdParty — OrangeDog, Commented Mar 20, 2022 at 15:28
regarding: Note: The BE1229CF value comes from the last 8 characters of the pub code. — can you elaborate more, the "BE1229CF" is clearly not anywhere on screen here. You did some bit operations to get this value or what? — Martin Mucha, Commented May 12, 2022 at 12:29
@MartinMucha take a look at the code block in item 1. You'll see BE12 29CF on the second-last line. That's where it comes from 👍🏻 — matigo, Commented May 12, 2022 at 13:17
what if an app automatically configures the .list file, thus reverting the changes each time? For example, this warning is found inside the slack.list file: ### THIS FILE IS AUTOMATICALLY CONFIGURED ### # You may comment out this entry, but any other modifications may be lost. How does one get around this corner case, i.e. making sure the signed-by addition is kept and not reverted by the apt source maintainer? — dimisjim, Commented Aug 13, 2022 at 9:39

Zanna · Accepted Answer · 2022-05-16 17:34:33Z

187

try this

cd /etc/apt
sudo cp trusted.gpg trusted.gpg.d

edited May 16, 2022 at 17:34

Zanna♦

71.2k59 gold badges222 silver badges330 bronze badges

answered May 14, 2022 at 6:51

Mahmoud

2,0471 gold badge3 silver badges3 bronze badges

26

For reviewers: this makes sense because /etc/apt/trusted.gpg is the old form of one singular keyring. In the modern apt, each keyring is stored individually in /etc/apt/trusted.gpg.d. Moving the legacy database into /etc/apt/trusted.gpg.d/ is the workaround to readding repositories manually and having apt update the key storage automatically. This is one workaround, though it's not the best nor most APT-preferred solution it is a solution nonetheless.
– Thomas Ward ♦
Commented May 16, 2022 at 14:37
2

Two first time posters have commented (as answers) that this worked for them. This post should not be deleted. I am up voting this answer on the behalf of the two new users.
– user68186
Commented May 16, 2022 at 15:41
15

The fact that something works does not equal that it is a good or viable solution. Depending on which keys are stored inside trusted.gpg, this could potentially be a security breach.
– Artur Meinild
Commented May 16, 2022 at 15:46
4

Ubuntu 22.04. Worked for me as well. Thanks..
– sundowatch
Commented Jul 17, 2022 at 7:52
2

I opted for a symbolic link in case more keys are added to trusted.gpg later: sudo ln -s ../trusted.gpg /etc/apt/trusted.gpg.d/
– Jayen
Commented Jun 22, 2023 at 4:29

| Show 6 more comments

heynnema · Accepted Answer · 2022-05-22 13:58:45Z

The easy way to fix these warning messages generated by sudo apt update...

W: https://linux.teamviewer.com/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://apt.keepsolid.com/ubuntu/dists/groovy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://linux.dropbox.com/ubuntu/dists/disco/Release.gpg: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.virtualbox.org/virtualbox/debian/dists/hirsute/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.opensuse.org/repositories/home:/IBBoard:/cawbird/xUbuntu_22.04/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/solaar-unifying/stable/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/yannubuntu/boot-repair/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Note: These warning messages can be generated by any enabled repo or ppa in Software & Updates "Other Software" tab.

Example fix:

For this warning message with sudo apt update...

W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

We look in sudo apt-key list and find this entry for xbmc...

pub   rsa1024 2009-01-20 [SC]
      1897 01DA 570C 56B9 488E  F60A 6D97 5C47 91E7 EE5E
uid           [ unknown] Launchpad PPA for XBMC for Linux

Then we convert this entry to a .gpg file, using the last 8 numeric characters from above...

sudo apt-key export 91E7EE5E | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/team-xbmc.gpg

Repeat the above commands for each warning message generated by sudo apt update.

Note: Partially taken from the accepted answers here and here.

I like this answer better as it puts the keys in /etc/apt/trusted.gpg.d/ — Tod Thomson, Commented Oct 9, 2022 at 1:33
+1 for me; the top two answers fail on my Linux Mint Vanessa system with zsh: bad pattern: [arch=amd64 — AlMo320, Commented Oct 20, 2022 at 19:56
Thank you for this. Makes me wonder why there's no official tool that does that. It seems they attempted to target a security vulnerability, yet failed miserably in providing an easy way to actually implement it in existing installations. — TheMechanic, Commented Feb 19, 2023 at 20:30
@PeterKrauss As it says in the answer, issue a sudo apt-key list command, and use the last 8 characters of the output... "91E7 EE5E" with no spaces. — heynnema, Commented Mar 19, 2023 at 3:18

DiRaOL · Accepted Answer · 2022-06-07 22:03:17Z

8

Considering all the good suggestions provided, I've crafted a helper oneliner to automate the process for all keys:

sudo apt-key list 2>&1 | grep -E '(trusted.gpg.d)' -A 3 | grep -v '^\-\-' | grep -v '^pub ' | sed 's@.*/trusted.gpg.d/\(.*\)@\1@g' | awk 'NR%2{printf "%s ",$0;next;}1' | awk '{print "sudo apt-key export "$10$11" | sudo gpg --dearmour -o /usr/share/keyrings/"$1}' | xargs -I{} eval("{}")

answered Jun 7, 2022 at 22:03

DiRaOL

811 silver badge1 bronze badge

Thanks, but gives me an error: bash: syntax error near unexpected token (' it seems some warning output is in the way, so I could still use it by dropping the final | xargs and then copy-pasting output manually.
– Epskampie
Commented Jun 8, 2022 at 12:23
4

Works for me, but I need to change a little bit: sudo apt-key list 2>&1 | grep -E '\/(trusted.gpg.d)' -A 3 | grep -v '^\-\-' | grep -v '^pub ' | /bin/sed 's@.*/trusted.gpg.d/$.*$@\1@g' | /bin/awk 'NR%2{printf "%s ",$0;next;}1' | /bin/awk '{print "sudo apt-key export "$10$11" | sudo gpg --dearmour -o /usr/share/keyrings/"$1}' | xargs -I'{}' bash -c "eval '{}'". On first grep, you need to use regex '\/(trusted.gpg.d)' instead, either match with warning message. At the end, I need to change xargs execute.
– Bernardo Loureiro
Commented Jun 29, 2022 at 14:41
1

thanks for this! my pass: sudo apt-key list | sudo awk -v n=4 'n==3{k=$(NF-1)$NF;cmd="apt-key export "k"|gpg --dearmour -o "d;print cmd;system(cmd)}/^\/.*\/trusted\.gpg\.d\//{d=$1;n=0}{n++}'
– keithpjolley
Commented Aug 31, 2022 at 20:10

Add a comment |

isaaclw · Accepted Answer · 2023-08-22 18:38:35Z

There is no need to edit sources.list if you use the apt/trust.gpg.d/ folder and you're on debian.

Follow the other steps to get the key id:

$ apt-key list
/etc/apt/trusted.gpg
--------------------
pub   rsa2048 2012-04-01 [SC]                                                                                                                                  
      A0DA 38D0 D76E 8B5D 6388  7281 9165 938D 90FD DD2E        
uid           [ unknown] Mike Thompson (Raspberry Pi Debian armhf ARMv6+VFP) <[email protected]>                                                            
sub   rsa2048 2012-04-01 [E]

And then run:

apt-key export 90FDDD2E | sudo tee /etc/apt/trusted.gpg.d/raspberry.debian.armhf.asc

You can delete the trust.gpg file, but the errors go away without deleting it.

it werks on Ubuntu 22.04. Exporting directly to /etc/apt/trusted.gpg.d seems to be the correct solution. — Salman Siddiqui, Commented May 1 at 19:06

Sarthak Tiwari · Accepted Answer · 2022-11-10 19:53:42Z

0

I solved it with some commands like below.

gpg --refresh-keys

this will update all the key resolve the problem

edited Nov 10, 2022 at 19:53

Sarthak Tiwari

811 silver badge6 bronze badges

answered May 26, 2022 at 15:19

Zidan Rahmandani

333 bronze badges

''' for KEY in $( \ apt-key --keyring /etc/apt/trusted.gpg list \ | grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})" \ | tr -d " " \ | grep -E "([0-9A-F]){8}\b" \ ); do K=${KEY:(-8)} apt-key export $K \ | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg done '''
– Muhammad Irfan Aslam
Commented Jan 18, 2023 at 10:26
6

This did not work for me, Ubuntu 22.04.1 LTS, Jammy
– M.K
Commented Feb 8, 2023 at 13:37
1

Didn't work for me in Kali 2022.4
– J. Scott Elblein
Commented Feb 24, 2023 at 2:17
The command in the comment by Muhammad is from here. Those "" are not part of it so the command starts with for KEY and ends with done. It solved the problem for me.
– mYnDstrEAm
Commented Apr 8 at 16:02

Add a comment |

M.K · Accepted Answer · 2023-02-08 13:46:13Z

0

In my case, solutions above did not work. Maybe it's because it is a specific case. The warning:

9 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: https://packages.cloud.google.com/apt/dists/coral-cloud-stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: https://packages.cloud.google.com/apt/dists/coral-edgetpu-stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

This fixed it for me:

wget -O- https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo tee /etc/apt/trusted.gpg.d/coral-edgetpu.gpg

answered Feb 8, 2023 at 13:46

M.K

1178 bronze badges

What does that do? Can you give a more general solution? I have the same proble with other programs.
– cipricus
Commented Jun 24, 2023 at 12:04
I guess it's a way of adding third party libraries in an updated way. These 2 references might help! ref1 and ref2 @cipricus
– M.K
Commented Jun 24, 2023 at 15:11

Add a comment |

Erotemic · Accepted Answer · 2024-04-18 16:13:29Z

I've taken the answer from @DiRaOL and converted it to a Python script, which I find to be much more readable (albeit longer) than using awk.

import subprocess
import re
from collections import defaultdict
import pathlib
# List all apt-keys
proc = subprocess.Popen(
    'sudo apt-key list',
    shell=True,
    stdout=subprocess.PIPE,
    stderr=subprocess.PIPE)
stdout, stderr = proc.communicate()

# Build a regex that matches a 20 byte hex string
key_pat_part = '  *'.join(['[A-F0-9]{4}'] * 10)
gpg_pat = re.compile(' *' + key_pat_part)

# Parse stdout to map filenames to keys
lines = stdout.decode('utf8').split(chr(10))
current_fpath = None
path_to_keys = defaultdict(list)
for line in lines:
    if set(line) == '-':
        current_fpath = None
    if line.startswith('/etc/apt/trusted'):
        current_fpath = line
    if gpg_pat.match(line):
        key = line.replace(' ', '')
        path_to_keys[current_fpath].append(key)

# Build commands to export to the keyrings path and execute them
keyrings_dpath = pathlib.Path('/usr/share/keyrings/')
for fpath, keys in path_to_keys.items():
    if 'trusted.gpg.d' in fpath:
        assert len(keys) == 1
        key_tail = keys[0][-8:]
        old_fpath = pathlib.Path(fpath)
        new_fpath = keyrings_dpath / old_fpath.name
        if not new_fpath.exists():
            command = f'sudo apt-key export {key_tail} | sudo gpg --dearmour -o {new_fpath}'
            subprocess.check_output(command, shell=True)

I've also written this such that the above command can be wrapped in:

python -c " if 1:
    <the code>
"

and executed in bash.

Stack Exchange Network

apt-key deprecation warning when updating system: "Key is stored in legacy trusted.gpg keyring"

8 Answers 8

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
apt
21.10
keyrings
.

Linked

Hot Network Questions

apt-key deprecation warning when updating system: "Key is stored in legacy trusted.gpg keyring"

8 Answers 8

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged apt21.10keyrings.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
apt
21.10
keyrings
.