Let's say you want to add
docker's repo key (an ASCII-armored key):
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
| sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
If you're not sure if the key is ASCII-armored:
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | file -
/dev/stdin: PGP public key block Public-Key (old)
For a non-armored key the output will be along the lines of:
/dev/stdin: OpenPGP Public Key Version 4, Created ..., RSA (Encrypt or Sign, 4096 bits); User ID; Signature; OpenPGP Certificate
And to add it you need:
$ sudo curl -fsSL https://... -o /etc/apt/keyrings/NAME.gpg
More on it can be found here. But it suggests to install keys to
/usr/share/keyrings, which is the location for package maintainers. More on it below.
apt < 2.4.0 you need to create
/etc/apt/keyrings before adding the key (Debian link):
apt (2.4.0) unstable; urgency=medium
- Install an empty /etc/apt/keyrings directory. This directory is intended to provide an alternative to /usr/share/keyrings for placing keys used with signed-by.
That means before Ubuntu 22.04 Jammy, Debian 12 Bookworm.
apt-key is a security measure. You can learn more on it here. As such, adding files to
/etc/apt/trusted.gpg.d is also insecure. Because
/etc/apt/trusted.gpg.d is a way to add keys to the keyring (
apt-key add, by copying files.
Also note that:
The recommended locations for keyrings are /usr/share/keyrings for keyrings managed by packages, and /etc/apt/keyrings for keyrings managed by the system operator.
apt-key is deprecated since
2.1.8 (Debian link):
apt (2.1.8) unstable; urgency=medium
- Fully deprecate apt-key, schedule removal for Q2/2022
In terms of releases that would be Ubuntu 21.10 Impish, Debian 11 Bullseye. The commit (Debian link).
Ability to specify
apt sources was added in
1.1.exp9 (Debian link):
apt (1.1~exp9) experimental; urgency=medium
- implement Signed-By option for sources.list
The commit (Debian link).