2

This question arose with Xubuntu 22.04 in preparation for Xubuntu 24.04:

After reading the security warnings about apt-key, I first fixed it for the last package for which I stored the package signing key in /etc/apt/trusted.gpg with the command apt-key - which is deprecated. Fixing this involved deleting the key from /etc/apt/trusted.gpg (using apt-key del <key-ID>), downloading it again using secure connection from the package maintainers into a (binary, non-armored) *.gpg file into /etc/apt/keyrings/ and building the bridge between the package and the downloaded signing key with a .list file in /etc/apt/sources.list.d. - The s at the end of https or hkps secures against a MIM attack!

I then looked to see if there were other candidates of this vulnerability. I found

/etc/apt/trusted.gpg.d/atareao-ubuntu-atareao.gpg (belonging to touchpad-indicator) and /etc/apt/trusted.gpg.d/giuspen-ubuntu-ppa.gpg (belonging to x-tile)

Unfortunately, I found no note how I had installed touchpad-indicator. But I found a note about the latter: It was the command

sudo add-apt-repository ppa:giuspen/ppa

Does sudo add-apt-repository have any side effects on gpg-keys automatically being stored in /etc/apt/trusted.gpg or in a file inside of /etc/apt/trusted.gpg.d?

Improve this question
4
  • 1
    What version of Ubuntu are you using?
    – David DE
    Commented Aug 4 at 12:42
  • It si on Xubuntu 22.04 if that matters. I am preparing for 24.04 where apt-key is told to be limited to apt-key del <key ID>.
    – Adalbert Hanßen
    Commented Aug 4 at 14:29
  • I think this post should be split into two questions: what add-apt-repository does is completely independent of where the keys for some random software can be downloaded from
    – muru
    Commented Aug 4 at 15:38
  • The question has been edited: the second part has been moved to askubuntu.com/questions/1522464/….
    – Adalbert Hanßen
    Commented Aug 4 at 16:35

2 Answers 2

Reset to default
3

According to this post on the Ubuntu Discourse (linked from the 23.10 release notes), newer versions neatly sidestep the whole keyring location issue by putting the keys directly in deb822-formatted sources files:

In previous versions of Ubuntu, PPAs were managed through a traditional .list file located at /etc/apt/sources.list.d/, accompanied by a gpg keyring at /etc/apt/trusted.gpg.d.

However, starting with version 23.10, we have introduced a new approach. PPAs are now added as deb822-formatted .sources files, where the keys are directly embedded into the file’s Signed-By field. This change offers several key advantages:

  • Removal of a repository also removes its associated key.
  • Establishes a 1:1 relationship between the PPA and its key:
    • The key is dedicated to the specific PPA and cannot be used for other repositories (unlike the old trusted.gpg.d, which was a global store for all sources).
    • Other keys cannot be utilized to sign the PPA.

This commit titled v0.99.37 seems to have implemented the change:

Notes:
      [ Nick Rosbrook ]
      * Enable deb822 support for PPAs, with GPG key embedded in .sources file.
      [ Julian Andres Klode ]
      * Minor tweaks to the deb822 PPA support
Improve this answer
2
  • I only recently understood the trusted.gpg or trusted.gpg.d problem and how to fix it with .list files and signed-by. That's outdated again. After all, it makes sense to specify the keys directly in the new .sources definitions and also in the armored format and also with the download source. Fundamental changes are imminent and I am curious to see how the transition between the LTS versions will work and whether this will be automatic. It remained unanswered, whether apt-add-repository brought the infamous trusted key rings into play up to and including release 23.10.
    – Adalbert Hanßen
    Commented Aug 5 at 8:08
  • @AdalbertHanßenlet me quote the relevant bits from the Discourse post once again: "In previous versions of Ubuntu, PPAs were ... accompanied by a gpg keyring at /etc/apt/trusted.gpg.d." And since this change is in 23.10, obviously this excludes 23.10 itself.
    – muru
    Commented Aug 5 at 8:23
0

I executed these commands in a terminal:

sudo apt-key del A3D8A366869FE2DC5FFD79C36A9653F936FD5529 # previous key id of atareao
sudo add-apt-repository --remove ppa:atareao/atareao      # remove it
sudo apt update                                           # make it happen
sudo add-apt-repository ppa:atareao/atareao               # add it again
sudo apt update                                           # make it happen
apt-key list                                              # what has happened in trusted?

Among other keys this one reappeared in /etc/apt/trusted.gpg.d:

/etc/apt/trusted.gpg.d/atareao-ubuntu-atareao.gpg
-------------------------------------------------
pub   rsa4096 2024-05-02 [SC]
      24D6 ECA2 F050 3C89 698F  2260 2540 2D50 9B04 2DD9

But this time with another fingerprint than before. The new fingerprint matches the one shown on this website under the headline "Technical details about this PPA".

My conclusion: In Xubuntu 22.04 LTS apt-add-reposity automatically downloads and adds the signing key for the repository into the infamous and ill-reputed keyring /etc/apt/trusted.gpg. Hopefully it does it with a safe connection. – On Xubuntu 24.04 this is different, see in the answer above. I have not yet been able to test it with 24.04 LTS.

Further finding: apt-add-reposity also creates for ppa:atareao/atareao the file /etc/apt/sources.list.d/atareao-ubuntu-atareao-jammy.list. It one does not use the signed-by mechanism (which would become necessary if the key were stored e.g. in /etc/apt/keyrings/Launchpad-atareao.gpg).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .