Apt-key deprecation (with workaround)

Bugs and issues Linux
#1

apt-key is deprecated on Debian, and I now get

W: http://apt.insync.io/debian/dists/buster/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

when running apt update.

Now we are supposed to download the signature file, add it to a local directory, and point to the correspond signature file in the sources.list entry. (See, for instance, this post.)

Is there a way to get the signature file?

#2

Just move the /etc/apt/trusted.gpg file to /etc/apt/trusted.gpg.d/ folder, and the warning will go away.

Literally did it 5 minutes ago myself.

4 Likes
#3

Thank you for the assist, as always, @bayindirh :slight_smile:

Checking with our Linux team how we can address this more permanently! cc @finotti

#4

Indeed, I think we need a more permanent solution.

Although @bayindirh suggestion should work (thanks for pointing it out!), it is not the recommended way to deal with keys moving forward, if I understand it correctly.

Keys in /etc/apt/trusted.gpgp.d should also be moved to another location (it seems that /usr/local/share/keyrings is a common suggestion), with one file for each repository, and the corresponding key file added to each corresponding list file in /etc/apt/sources.list.d.

For now, here is something I believe could be done to set it up properly:

  1. Use apt-key list to find all entries in /etc/apt/trusted.gpg.
  2. Make a copy of this file (in the new directory for the keyrings) for each one of the entries. Name accordingly, like insync.gpg for the InSync keyring.
  3. For each one of these files, remove all other entries but the one for it using apt-key del. This leaves only the one key for the particular repository.
  4. For each of these new key files, add the correspond keyring to the sources list file for the corresponding repository.

Right now, for me at least, only InSync has no file already provided. (If all your sources provide with their corresponding key file, you can just delete trusted.gpg and add the new files to the new keyring directory.)

1 Like
#5

Thank you for the very detailed workaround, @finotti!

Our engineer has lined up a fix for this issue, and will be deployed in a future build. Thank you both for reporting this!

#6

I don’t know if this is the right way, but I used the following to solve my problem:

1º

gpg --keyserver keyserver.ubuntu.com --recv-keys ACCAF35C

2º Export gpg key

gpg --output insync.gpg --export ACCAF35C

3º Copy the key to right directory

sudo cp insync.gpg /usr/share/keyrings/

4º Adjust repository on sources.list

deb [signed-by=/usr/share/keyrings/insync.gpg arch=amd64] http://apt.insync.io/debian bookworm  non-free contrib

5º Update repository

sudo apt update
1 Like
#7

Hey @Danilo_Arantes! I appreciate you for sharing the workaround for this issue! Let me send this to our engineer for reference while we continue working on the more permanent fix. :slight_smile:

1 Like
#8

Hey everyone! Could you please update to 3.7.5, in case you haven’t? Our engineer has confirmed that this is fixed in the latest version. :slight_smile:

Please download the latest version here: https://www.insynchq.com/downloads. You may also fetch the update via the repositories.

Thank you!

#9

Thank you very much, I spent time trying several things and here’s the solution.

2 Likes
#10

it’s awesome! @bayindirh

1 Like
#11

Thanks, thi s has really been helpdul