However, it would be a good idea to start transitioning to utilizing the signed-by option as explained below, especially if you maintain a third-party repository.
You can continue to use apt-key for now as it still works. That's because adding OpenPGP keys to /etc/apt/trusted.gpg and /etc/apt/ is equally unsecure, as mentioned above. It's also worth noting that while the apt-key deprecation message says to " manage keyring files in instead", the Debian wiki states otherwise. So this change was made for security reasons (your security). As a result, any unofficial APT repository which has its signing key added to /etc/apt/trusted.gpg or /etc/apt/ can replace any package on the system. The reason for this change is that when adding an OpenPGP key that's used to sign an APT repository to /etc/apt/trusted.gpg or /etc/apt/, the key is unconditionally trusted by APT on all other repositories configured on the system that don't have a signed-by (see below) option, even the official Debian / Ubuntu repositories. What's more, " apt-key will last be available in Debian 11 and Ubuntu 22.04." The apt-key man page mentions that the " use of apt-key is deprecated, except for the use of apt-key del in maintainer scripts to remove existing keys from the main keyring". Some newer Ubuntu versions also show a warning when using a deprecated key: " W: (.) Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details". Manage keyring files in instead (see apt-key(8))". When you try to add an APT repository key using apt-key on Debian, Ubuntu and Linux distributions based on these, you'll see the following message: " Warning: apt-key is deprecated. This article explains how to securely add OpenPGP keys and third-party APT repositories on Debian, Ubuntu, and Linux distributions based on these, like Linux Mint, Pop!_OS, Elementary OS and so on, to replace the deprecated apt-key.
0 kommentar(er)
