Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)

Question

I just upgraded from Ubuntu 21.10 to 22.04.

sudo apt update ends with the following warnings...

W: https://linux.teamviewer.com/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://apt.keepsolid.com/ubuntu/dists/groovy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://linux.dropbox.com/ubuntu/dists/disco/Release.gpg: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.virtualbox.org/virtualbox/debian/dists/hirsute/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.opensuse.org/repositories/home:/IBBoard:/cawbird/xUbuntu_22.04/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/solaar-unifying/stable/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/yannubuntu/boot-repair/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Synaptic shows the same warnings on a reload.

Reviewing man apt-key doesn't clarify this for me.

I think this is because Ubuntu 22.04 has transitioned from using /etc/apt/trusted.gpg to using individual .gpg files located in /etc/apt/trusted.gpg.d.

Can these keys be converted from one to the other, or must I delete these keys and reimport them?

@ChanganAuto Thanks for the lead! It's a lot to digest. Don't know why the upgrade didn't take care of that for me... it's going to cause problems for a lot of users. — heynnema, Commented May 10, 2022 at 16:01
Does this answer your question? apt-key deprecation warning when updating system — starbeamrainbowlabs, Commented May 20, 2022 at 23:19
@starbeamrainbowlabs Thanks for the lead! Please see my simplified answer, below. — heynnema, Commented May 21, 2022 at 1:24

Ivan Gabriele · Accepted Answer · 2022-09-19 09:35:58Z

The easy way to fix these warning messages generated by sudo apt update...

W: https://linux.teamviewer.com/deb/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://apt.keepsolid.com/ubuntu/dists/groovy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://linux.dropbox.com/ubuntu/dists/disco/Release.gpg: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.virtualbox.org/virtualbox/debian/dists/hirsute/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://download.opensuse.org/repositories/home:/IBBoard:/cawbird/xUbuntu_22.04/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/solaar-unifying/stable/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
W: http://ppa.launchpad.net/yannubuntu/boot-repair/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

Note: These warning messages can be generated by any enabled repo or ppa in Software & Updates "Other Software" tab.

Example fix:

For this warning message with sudo apt update...

W: http://ppa.launchpad.net/team-xbmc/ppa/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

We look in sudo apt-key list and find this entry for xbmc...

pub   rsa1024 2009-01-20 [SC]
      1897 01DA 570C 56B9 488E  F60A 6D97 5C47 91E7 EE5E
uid           [ unknown] Launchpad PPA for XBMC for Linux

Then we convert this entry to a .gpg file, using the last 8 numeric characters from above...

sudo apt-key export 91E7EE5E | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/team-xbmc.gpg

Optionally you can remove the deprecated key from /etc/apt/trusted.gpg by running:

sudo apt-key --keyring /etc/apt/trusted.gpg del 91E7EE5E

Repeat the above commands for each warning message generated by sudo apt update.

Note: Partially taken from the accepted answers here and here.

I tried different way to achieve this, and this is the easier way. I got a warning (Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).), but the .gpg file was created. — avpaderno, Commented Jul 8, 2022 at 8:48
@Evi1M4chine The problem with the automated way (besides the fact that it uses a ~50 character bash script from an unknown author) is that it exports ALL of the entries in trusted.gpg, and many aren't needed. My way only exports the NEEDED entries. — heynnema, Commented Aug 11, 2022 at 16:45
@heynnema: Btw, the exact reason I was looking for a script was, because your way made it extremely cumbersome to find which ones were actually needed. So while your intention was undoubtedly good, one ended up writing a loop to do it to all of them anyway. ^^ — anon, Commented Aug 13, 2022 at 11:27
If you get a Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)). gpg: WARNING: nothing exported gpg: no valid OpenPGP data found. error is because the hash needs to be written in a single bloc. — David Beauchemin, Commented Sep 22, 2022 at 16:15

nickspoon · Accepted Answer · 2023-01-09 11:41:12Z

Came across this problem after moving to Ubuntu 22.04 and wanted to add my solution. I had a lot of keys that needed to be updated/converted. This is not an optimal solution, but works well.

This solution is specific to Ubuntu 22.04, with bash 5.2.16. Other distributions and versions may not work.

A one-liner to convert all those deprecated keys to the new format.

PLEASE TAKE THE TIME TO UNDERSTAND WHAT YOU’RE DOING HERE BEFORE RUNNING IT!! Also make sure your bash is not too old. My bash version: GNU bash, version 5.1.16(1)-release (x86_64-pc-linux-gnu)

for KEY in $(apt-key --keyring /etc/apt/trusted.gpg list | grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})" | tr -d " " | grep -E "([0-9A-F]){8}\b" ); do K=${KEY:(-8)}; apt-key export $K | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg; done

And for those that want something more readable....

for KEY in $( \
    apt-key --keyring /etc/apt/trusted.gpg list \
    | grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})" \
    | tr -d " " \
    | grep -E "([0-9A-F]){8}\b" \
); do
    K=${KEY:(-8)}
    apt-key export $K \
    | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg
done

Explanation:

Retrieve the list of known keys:
```
apt-key list
```
Find all groupings of hexadecimal characters that have 1 or 2 spaces in front of them, and are 4 characters long. Get the collection of those that have 10 groupings per line. This provides the full key signature.
```
grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})"
```
Trim away (delete) all spaces on each line found, so that key signature is unbroken by white space:
```
tr -d " "
```
Grab the last 8 characters of each line:
```
grep -E "([0-9A-F]){8}\b"
```
Now we have a collection of key suffixes, each 8 characters in length.
Cycle through each key suffix, placing the current suffix in the KEY variable:
```
for KEY in $(…); do
```
Assign the last 8 characters to the variable K:
```
K=${KEY:(-8)};
```

Export the key that matches the signature in K and pass/pipe it to gpg to properly store it:

apt-key export $K | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-$K.gpg

Loop until all keys are processed.
```
done
```
Enjoy no more deprecation warnings.

Special thanks to heynnema whose solution is at the core of this.

Not sure why this doesn't have more upvotes... It works like a charm. — dentex, Commented Aug 7, 2022 at 19:03
Note that the “not optimal” part probably refers to this ”polluting” the key new directory with these keys, which stay there even if they are replaced (leading to duplicates) or even revoked (e.g. due to being compromised). So once every ppa has caught up, this needs to be cleaned up again! (rm -f /etc/apt/trusted.gpg.d/imported-from-trusted-gpg-*.gpg) — anon, Commented Aug 11, 2022 at 16:28
I confirm functionality also on Linux Mint 21 (bash version 5.1.16(1)). Thank you, good job. — Martin Osusky, Commented Dec 11, 2022 at 12:20

mykahveli · Accepted Answer · 2022-06-20 11:58:14Z

34

What worked for me was:

mv /etc/apt/trusted.gpg /etc/apt/trusted.gpg.d/

answered Jun 20, 2022 at 11:58

mykahveli

4413 silver badges4 bronze badges

1

This worked for me as well. Plus, I had difficulties with the chosen answer as it was so complex but doing this one worked and was easy. I'm on Linux Mint (Vanessa)
– Barra
Commented Aug 9, 2022 at 16:27
This didn't resolve the issue in Mint vanessa, I had to go to the sources list and remove the problem ones
– Alkanshel
Commented Aug 10, 2022 at 0:56
This worked for me on Mint21. I laboriously followed the complicated instructions of the top-rated answer, but was eventually stymied by some kind of "syntax error" (to do with the teamviewer key being differently structured/stored, I think). To be on the safe side I did a full system backup with fsarchiver before running the single-line solution given here. But everything looks fine after rebooting, TY
– FumbleFingers
Commented Sep 15, 2022 at 13:55
1

Worked on Mint 21 :-)
– c05772
Commented Oct 27, 2022 at 21:54
2

How about softlinking it instead of moving it, for added compatibility?
– anon
Commented Nov 24, 2022 at 13:18

| Show 3 more comments

CAAHS · Accepted Answer · 2023-12-07 17:25:38Z

8

I modified the @Frank's function to remove the key from the legacy trusted.gpg to avoid duplication.

function apt-key-migrate {
    typeset key="$1"
    typeset dest="$2"

    if [ -z "$key" ] || [ -z "$dest" ];
    then
        echo "Usage: apt-key-migrate <key> <destination>"
        return 1
    fi

    sudo apt-key --keyring /etc/apt/trusted.gpg export $key | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/$dest.gpg
    test -s "/etc/apt/trusted.gpg.d/$dest.gpg" && sudo apt-key --keyring /etc/apt/trusted.gpg del $key
}

edited Dec 7, 2023 at 17:25

CAAHS

1415 bronze badges

answered Aug 31, 2022 at 8:27

brvoisin

811 silver badge2 bronze badges

Add a comment |

Francis Fajardo · Accepted Answer · 2022-08-03 07:24:53Z

I've turned @heynnema's answer into a function, which you can place under .bashrc for convenience. This takes two arguments: the key (last 8 characters) and the destination filename for the output GPG file.

function apt-key-migrate {
  typeset key="$1"
  typeset dest="$2"

  if [ -z "$key" ] || [ -z "$dest" ];
  then
    echo "Usage: apt-key-migrate <key> <destination>"
    return 1
  fi

  sudo apt-key export $key | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/$dest.gpg
}

Example: apt-key-migrate 91E7EE5E team-xbmc

frank_108 · Accepted Answer · 2022-06-16 06:57:26Z

3

apt-key is deprecated and shall be replaced on the long run on Ubuntu 22.04.

When you need it, you may delete existing key with:

apt-key list

and

apt-key del YOUR-KEY

Import your key with command like:

curl https://yourrepo.com/repo.key | gpg --dearmor | sudo dd of=/usr/local/share/keyrings/your-repo.gpg

Add the signature to /etc/apt/sources.list.d/your.list

deb [signed-by=/usr/local/share/keyrings/your-repo.gpg]  https://yourepo./ubuntu jammy main

More details on the manual:
link

Good details here as well: link

answered Jun 16, 2022 at 6:57

frank_108

3011 gold badge2 silver badges6 bronze badges

1

My answer is much easier. It doesn't require any deletions, curls, and any .list file edits.
– heynnema
Commented Jun 16, 2022 at 13:19

Add a comment |

Andre Leon Rangel · Accepted Answer · 2024-04-27 01:49:40Z

Solved for my scenario. I have a native OS ubuntu 22 running in a Lenonvo L570 laptop. The OS has been migrated in the following way: Ubuntu 18 with Windows partition, Ubuntu 20 manually removed windows partition and cleaned up, ubuntu 22 wizard upgrade and added the windows partition as an extra partition for movies and pictures.

My error was due to a virtual box gpg key

W: https://download.virtualbox.org/virtualbox/debian/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

to ressolve it i did

back up the key

sudo cp /etc/apt/trusted.gpg /etc/apt/trusted.gpg.bk

based on answers above

sudo mv /etc/apt/trusted.gpg /etc/apt/trusted.gpg.d/

update packages

sudo apt update
Hit:2 https://dl.winehq.org/wine-builds/ubuntu jammy InRelease                                                                    
Hit:3 https://downloads.1password.com/linux/debian/amd64 stable InRelease                                                         
Hit:4 https://download.virtualbox.org/virtualbox/debian jammy InRelease                                                           
Hit:5 https://download.docker.com/linux/ubuntu jammy InRelease                                                                    
Hit:6 http://dl.google.com/linux/chrome/deb stable InRelease                                                                      
Hit:7 http://archive.ubuntu.com/ubuntu jammy InRelease                                                                            
Hit:8 http://dl.google.com/linux/earth/deb stable InRelease                                                                  
Hit:9 http://archive.ubuntu.com/ubuntu jammy-updates InRelease                                                               
Get:10 https://packages.microsoft.com/repos/edge stable InRelease [3,590 B]
Get:1 https://packages.microsoft.com/repos/code stable InRelease [3,590 B]        
Hit:11 http://archive.ubuntu.com/ubuntu jammy-backports InRelease                
Hit:12 https://ppa.launchpadcontent.net/danielrichter2007/grub-customizer/ubuntu jammy InRelease
Hit:13 http://archive.ubuntu.com/ubuntu jammy-security InRelease
Fetched 7,180 B in 2s (4,495 B/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done

Her0n-Hardy · Accepted Answer · 2024-09-12 16:58:59Z

Thanks to heynnema's solution to remove deprecated trusted keys stored in legacy trusted.gpg keyring one at a time and JDMcMillian's approach using a loop to iterate through them, I wrote a small bash script combining both ideas to remove deprecated trusted keys stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg) after they have been converted to the new format that uses individual .gpg files located in /etc/apt/trusted.gpg.d

#!/bin/bash

# Script to remove deprecated trusted keys stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg) after converting them to the new format that uses individual .gpg files located in /etc/apt/trusted.gpg.d
# Source reference https://askubuntu.com/questions/1407632/key-is-stored-in-legacy-trusted-gpg-keyring-etc-apt-trusted-gpg

while true; do
    echo "========================================================================="
    read -p "Have you converted all deprecated trusted keys stored in legacy trusted.gpg keyring to the new format? (Y/N)" yn
    case $yn in
        [Yy]* ) echo "REMOVING deprecated trusted keys stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)"; 
                break;;
        [Nn]* ) echo "FIRST please convert all deprecated trusted keys stored in legacy trusted.gpg keyring to the new format";
                echo "EXITING"
                exit 1;
                break;;
        * ) echo "Please answer Y or N.";;
    esac
done



# One liner below
for KEY in $(apt-key --keyring /etc/apt/trusted.gpg list | grep -E "(([ ]{1,2}(([0-9A-F]{4}))){10})" | tr -d " " | grep -E "([0-9A-F]){8}\b" ); do K=${KEY:(-8)}; sudo apt-key --keyring /etc/apt/trusted.gpg del $K; done

Stack Exchange Network

Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)

8 Answers 8

A one-liner to convert all those deprecated keys to the new format.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
gnupg
22.04
keyrings
.

Linked

Hot Network Questions

Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)

8 Answers 8

A one-liner to convert all those deprecated keys to the new format.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged gnupg22.04keyrings.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
gnupg
22.04
keyrings
.