122

I just upgraded from Ubuntu 21.10 to 22.04.

sudo apt update ends with the following warnings...

W: https://linux.teamviewer.com/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://apt.keepsolid.com/ubuntu/dists/groovy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://linux.dropbox.com/ubuntu/dists/disco/Release.gpg: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.virtualbox.org/virtualbox/debian/dists/hirsute/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.opensuse.org/repositories/home:/IBBoard:/cawbird/xUbuntu_22.04/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/solaar-unifying/stable/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/yannubuntu/boot-repair/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Synaptic shows the same warnings on a reload.

Reviewing man apt-key doesn't clarify this for me.

I think this is because Ubuntu 22.04 has transitioned from using /etc/apt/trusted.gpg to using individual .gpg files located in /etc/apt/trusted.gpg.d.

Can these keys be converted from one to the other, or must I delete these keys and reimport them?

7

7 Answers 7

Reset to default
195

The easy way to fix these warning messages generated by sudo apt update...

W: https://linux.teamviewer.com/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://apt.keepsolid.com/ubuntu/dists/groovy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://linux.dropbox.com/ubuntu/dists/disco/Release.gpg: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.virtualbox.org/virtualbox/debian/dists/hirsute/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.opensuse.org/repositories/home:/IBBoard:/cawbird/xUbuntu_22.04/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/solaar-unifying/stable/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/yannubuntu/boot-repair/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Note: These warning messages can be generated by any enabled repo or ppa in Software & Updates "Other Software" tab.

Example fix:

For this warning message with sudo apt update...

W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

We look in sudo apt-key list and find this entry for xbmc...

pub   rsa1024 2009-01-20 [SC]
      1897 01DA 570C 56B9 488E  F60A 6D97 5C47 91E7 EE5E
uid           [ unknown] Launchpad PPA for XBMC for Linux

Then we convert this entry to a .gpg file, using the last 8 numeric characters from above...

sudo apt-key export 91E7EE5E | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/team-xbmc.gpg

Optionally you can remove the deprecated key from /etc/apt/trusted.gpg by running:

sudo apt-key --keyring /etc/apt/trusted.gpg del 91E7EE5E

Repeat the above commands for each warning message generated by sudo apt update.

Note: Partially taken from the accepted answers here and here.

22
  • 4
    That's the answer i was looking for. Thanks!
    – YourHelper
    Commented May 25, 2022 at 18:32
  • 1
    I tried different way to achieve this, and this is the easier way. I got a warning (Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).), but the .gpg file was created.
    – avpaderno
    Commented Jul 8, 2022 at 8:48
  • 1
    @Evi1M4chine The problem with the automated way (besides the fact that it uses a ~50 character bash script from an unknown author) is that it exports ALL of the entries in trusted.gpg, and many aren't needed. My way only exports the NEEDED entries.
    – heynnema
    Commented Aug 11, 2022 at 16:45
  • 2
    @heynnema: Btw, the exact reason I was looking for a script was, because your way made it extremely cumbersome to find which ones were actually needed. So while your intention was undoubtedly good, one ended up writing a loop to do it to all of them anyway. ^^
    – anon
    Commented Aug 13, 2022 at 11:27
  • 1
    If you get a Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)). gpg: WARNING: nothing exported gpg: no valid OpenPGP data found. error is because the hash needs to be written in a single bloc.
    – David Beauchemin
    Commented Sep 22, 2022 at 16:15
140

Came across this problem after moving to Ubuntu 22.04 and wanted to add my solution. I had a lot of keys that needed to be updated/converted. This is not an optimal solution, but works well.

This solution is specific to Ubuntu 22.04, with bash 5.2.16. Other distributions and versions may not work.

A one-liner to convert all those deprecated keys to the new format.

PLEASE TAKE THE TIME TO UNDERSTAND WHAT YOU’RE DOING HERE BEFORE RUNNING IT!! Also make sure your bash is not too old. My bash version: GNU bash, version 5.1.16(1)-release (x86_64-pc-linux-gnu)

for KEY in $(apt-key --keyring /etc/apt/trusted.gpg list | grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})" | tr -d " " | grep -E "([0-9A-F]){8}\b" ); do K=${KEY:(-8)}; apt-key export $K | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg; done

And for those that want something more readable....

for KEY in $( \
    apt-key --keyring /etc/apt/trusted.gpg list \
    | grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})" \
    | tr -d " " \
    | grep -E "([0-9A-F]){8}\b" \
); do
    K=${KEY:(-8)}
    apt-key export $K \
    | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg
done

Explanation:

  1. Retrieve the list of known keys:

    apt-key list

  2. Find all groupings of hexadecimal characters that have 1 or 2 spaces in front of them, and are 4 characters long. Get the collection of those that have 10 groupings per line. This provides the full key signature.

    grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})"

  3. Trim away (delete) all spaces on each line found, so that key signature is unbroken by white space:

    tr -d " "

  4. Grab the last 8 characters of each line:

    grep -E "([0-9A-F]){8}\b"

    Now we have a collection of key suffixes, each 8 characters in length.

  5. Cycle through each key suffix, placing the current suffix in the KEY variable:

    for KEY in $(…); do

  6. Assign the last 8 characters to the variable K:

    K=${KEY:(-8)};

  7. Export the key that matches the signature in K and pass/pipe it to gpg to properly store it:

    apt-key export $K | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg

  8. Loop until all keys are processed.

    done

  9. Enjoy no more deprecation warnings.

Special thanks to heynnema whose solution is at the core of this.

10
  • 10
    Not sure why this doesn't have more upvotes... It works like a charm.
    – dentex
    Commented Aug 7, 2022 at 19:03
  • THIS is how to do this!
    – anon
    Commented Aug 11, 2022 at 16:05
  • 1
    Note that the “not optimal” part probably refers to this ”polluting” the key new directory with these keys, which stay there even if they are replaced (leading to duplicates) or even revoked (e.g. due to being compromised). So once every ppa has caught up, this needs to be cleaned up again! (rm -f /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-*.gpg)
    – anon
    Commented Aug 11, 2022 at 16:28
  • Simply amazing! Thanks!
    – TheodorosPloumis
    Commented Sep 8, 2022 at 15:43
  • 1
    I confirm functionality also on Linux Mint 21 (bash version 5.1.16(1)). Thank you, good job.
    – Martin Osusky
    Commented Dec 11, 2022 at 12:20
34

What worked for me was:

mv /etc/apt/trusted.gpg /etc/apt/trusted.gpg.d/
8
  • 1
    This worked for me as well. Plus, I had difficulties with the chosen answer as it was so complex but doing this one worked and was easy. I'm on Linux Mint (Vanessa)
    – Barra
    Commented Aug 9, 2022 at 16:27
  • This didn't resolve the issue in Mint vanessa, I had to go to the sources list and remove the problem ones
    – Alkanshel
    Commented Aug 10, 2022 at 0:56
  • This worked for me on Mint21. I laboriously followed the complicated instructions of the top-rated answer, but was eventually stymied by some kind of "syntax error" (to do with the teamviewer key being differently structured/stored, I think). To be on the safe side I did a full system backup with fsarchiver before running the single-line solution given here. But everything looks fine after rebooting, TY
    – FumbleFingers
    Commented Sep 15, 2022 at 13:55
  • 1
    Worked on Mint 21 :-)
    – c05772
    Commented Oct 27, 2022 at 21:54
  • 2
    How about softlinking it instead of moving it, for added compatibility?
    – anon
    Commented Nov 24, 2022 at 13:18
8

I modified the @Frank's function to remove the key from the legacy trusted.gpg to avoid duplication.

function apt-key-migrate {
    typeset key="$1"
    typeset dest="$2"

    if [ -z "$key" ] || [ -z "$dest" ];
    then
        echo "Usage: apt-key-migrate <key> <destination>"
        return 1
    fi

    sudo apt-key --keyring /etc/apt/trusted.gpg export $key | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/$dest.gpg
    test -s "/etc/apt/trusted.gpg.d/$dest.gpg" && sudo apt-key --keyring /etc/apt/trusted.gpg del $key
}
6

I've turned @heynnema's answer into a function, which you can place under .bashrc for convenience. This takes two arguments: the key (last 8 characters) and the destination filename for the output GPG file.

function apt-key-migrate {
  typeset key="$1"
  typeset dest="$2"

  if [ -z "$key" ] || [ -z "$dest" ];
  then
    echo "Usage: apt-key-migrate <key> <destination>"
    return 1
  fi

  sudo apt-key export $key | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/$dest.gpg
}

Example: apt-key-migrate 91E7EE5E team-xbmc

3

apt-key is deprecated and shall be replaced on the long run on Ubuntu 22.04.

When you need it, you may delete existing key with:

apt-key list

and

apt-key del YOUR-KEY

Import your key with command like:

curl https://yourrepo.com/repo.key | gpg --dearmor | sudo dd of=/usr/local/share/keyrings/your-repo.gpg

Add the signature to /etc/apt/sources.list.d/your.list

deb [signed-by=/usr/local/share/keyrings/your-repo.gpg]  https://yourepo./ubuntu jammy main

More details on the manual:
link

Good details here as well: link

1
  • 1
    My answer is much easier. It doesn't require any deletions, curls, and any .list file edits.
    – heynnema
    Commented Jun 16, 2022 at 13:19
2

Solved for my scenario. I have a native OS ubuntu 22 running in a Lenonvo L570 laptop. The OS has been migrated in the following way: Ubuntu 18 with Windows partition, Ubuntu 20 manually removed windows partition and cleaned up, ubuntu 22 wizard upgrade and added the windows partition as an extra partition for movies and pictures.

My error was due to a virtual box gpg key

W: https://download.virtualbox.org/virtualbox/debian/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

to ressolve it i did

  • back up the key
sudo cp /etc/apt/trusted.gpg /etc/apt/trusted.gpg.bk
  • based on answers above
sudo mv /etc/apt/trusted.gpg /etc/apt/trusted.gpg.d/
  • update packages
sudo apt update
Hit:2 https://dl.winehq.org/wine-builds/ubuntu jammy InRelease                                                                    
Hit:3 https://downloads.1password.com/linux/debian/amd64 stable InRelease                                                         
Hit:4 https://download.virtualbox.org/virtualbox/debian jammy InRelease                                                           
Hit:5 https://download.docker.com/linux/ubuntu jammy InRelease                                                                    
Hit:6 http://dl.google.com/linux/chrome/deb stable InRelease                                                                      
Hit:7 http://archive.ubuntu.com/ubuntu jammy InRelease                                                                            
Hit:8 http://dl.google.com/linux/earth/deb stable InRelease                                                                  
Hit:9 http://archive.ubuntu.com/ubuntu jammy-updates InRelease                                                               
Get:10 https://packages.microsoft.com/repos/edge stable InRelease [3,590 B]
Get:1 https://packages.microsoft.com/repos/code stable InRelease [3,590 B]        
Hit:11 http://archive.ubuntu.com/ubuntu jammy-backports InRelease                
Hit:12 https://ppa.launchpadcontent.net/danielrichter2007/grub-customizer/ubuntu jammy InRelease
Hit:13 http://archive.ubuntu.com/ubuntu jammy-security InRelease
Fetched 7,180 B in 2s (4,495 B/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .