Let's say you want to add docker
's repo key (an ASCII-armored key):
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
| sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
If you're not sure if the key is ASCII-armored:
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | file -
/dev/stdin: PGP public key block Public-Key (old)
For a non-armored key the output will be along the lines of:
/dev/stdin: OpenPGP Public Key Version 4, Created ..., RSA (Encrypt or Sign, 4096 bits); User ID; Signature; OpenPGP Certificate
And to add it you need:
$ sudo curl -fsSL https://... -o /etc/apt/keyrings/NAME.gpg
More on it can be found here. But it suggests to install keys to /usr/share/keyrings
, which is the location for package maintainers. More on it below.
For apt
< 2.4.0 you need to create /etc/apt/keyrings
before adding the key (Debian link):
apt (2.4.0) unstable; urgency=medium
...
- Install an empty /etc/apt/keyrings directory. This directory is intended to provide an alternative to /usr/share/keyrings for placing keys used with signed-by.
That means before Ubuntu 22.04 Jammy, Debian 12 Bookworm.
Deprecating apt-key
is a security measure. You can learn more on it here. As such, adding files to /etc/apt/trusted.gpg.d
is also insecure. Because /etc/apt/trusted.gpg.d
is a way to add keys to the keyring (/etc/apt/trusted.gpg
) w/o apt-key add
, by copying files.
Also note that:
The recommended locations for keyrings are /usr/share/keyrings for keyrings managed by packages, and /etc/apt/keyrings for keyrings managed by the system operator.
apt-key
is deprecated since 2.1.8
(Debian link):
apt (2.1.8) unstable; urgency=medium
...
- Fully deprecate apt-key, schedule removal for Q2/2022
In terms of releases that would be Ubuntu 21.10 Impish, Debian 11 Bullseye. The commit (Debian link).
Ability to specify signed-by
in apt
sources was added in 1.1.exp9
(Debian link):
apt (1.1~exp9) experimental; urgency=medium
...
- implement Signed-By option for sources.list
The commit (Debian link).