Path: csiph.com!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!bofh.it!news.nic.it!robomod
From: Darac Marjal <mailinglist@darac.org.uk>
Newsgroups: linux.debian.user
Subject: Re: apt-key says deprecated, but not saying what else to use
Date: Sun, 20 Jun 2021 14:20:01 +0200
Message-ID: <Cs4AF-7VB-1@gated-at.bofh.it>
References: <CrPrX-7kN-1@gated-at.bofh.it>
Old-Return-Path: <mailinglist@darac.org.uk>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="kd0JBl8nmdGoiZ7OK7vbI8KopTcDpDFG7"
Approved: robomod@news.nic.it
Lines: 89
Organization: linux.* mail to news gateway
Sender: robomod@news.nic.it
Xref: csiph.com linux.debian.user:236221

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--kd0JBl8nmdGoiZ7OK7vbI8KopTcDpDFG7
Content-Type: multipart/mixed; boundary="um2aBatAuUuVzSY7D9Xnz9zuHIydCuoBo";
 protected-headers="v1"
From: Darac Marjal <mailinglist@darac.org.uk>
To: debian-user@lists.debian.org
Message-ID: <5fc8634b-d000-bb8d-275f-329f95fdcddd@darac.org.uk>
Subject: Re: apt-key says deprecated, but not saying what else to use
References: <22e2d584-e8f9-d0c0-a7f7-b323fbcb3b65@debianlists.mobilxpress.net>
In-Reply-To: <22e2d584-e8f9-d0c0-a7f7-b323fbcb3b65@debianlists.mobilxpress.net>

--um2aBatAuUuVzSY7D9Xnz9zuHIydCuoBo
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-GB


On 19/06/2021 21:07, Marco M=C3=B6ller wrote:
>
> Hello,
> Command apt-key and its man page say that apt-key is deprecated, but
> do not suggest an instead recommended tool. It is only mentioned that
> keys would now be organized in /etc/apt/trusted.gpg.d/=C2=A0 . But how
> should I manage the keys saved there, for instance how to update them,
> or what tool of the Debian distribution is managing them there for the
> apt functionality of the Debian OS?
> Guiding me to a properly up-to-date documentation about this topic
> would be welcome!
> Marco.

For some time, I've been using /etc/apt/trusted.gpg.d rather than using
apt-key. As I understand it, keys in apt-key are trusted to sign *any*
repository you pull from. That is, if you add a suspicious repository
and somehow they were able to push packages signed with their key to the
main debian repo servers, then you'd not be able to distinguish between
"signed by Debian" and "signed by attacker".

Instead, the preferred method is to put binary GPG keys into
/etc/apt/trusted.gpg.d (that is, you might need to run "gpg --dearmor"
if you download an ascii-armoured key). Files there can have any name
it's purely up to the system administrator what the names are, but it
makes sense that they indicate the repository they sign. Then, in
/etc/apt/sources.list.d/*.list, you need to write:

deb [signed-by=3D/etc/apt/trusted.gpg.d/somekey.gpg]
https://repo.attacker.com/ stable main

Now, only this repository trusts that key. If packages there are signed
by another key, verification fails. Similarly, if packages in another
repository are signed by that key, verification fails.

You ask about updating them. There is, as far as I know, no automatic
method for updating these keys, nor for automatically adding them right
now. That's because it's generally considered good practice to add the
key manually. You need to actively state that you trust this repository
on your system. So, for most repositories, that involves a web page
somewhere that says "This is our 'deb ... ' line and this is a link to
our public key." The key will usually be valid for several years, but if
it does start to fail, apt tools *will* tell you that the key has
expired, and that's time to go back and revisit the original site, and
see if they have a new key available.




--um2aBatAuUuVzSY7D9Xnz9zuHIydCuoBo--

--kd0JBl8nmdGoiZ7OK7vbI8KopTcDpDFG7
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEE1A0c5XWknk+U2MemZUdBNabqRbUFAmDPMIEFAwAAAAAACgkQZUdBNabqRbVe
cA//WFL/vfXd9qH+jVks3P6Kbsy/xzICu0Sv5RLAJaAPuPXuTLtWfRrh1436wUxldRdtj+oDLNSg
T6aNX7xRcp7KIIw/K8MzId7W3fBphzR/SZivW+829gXTWsqU8B9dAwweVSHGdjm5jbCejWx+RUJb
9FXZeVrMjrW3v0YwPK0TW/+z+lss/Lj3GfvrfUQPwmqgghFL5NK0/xJxTvyzQoGc5z6tikJ/wMDK
/qUdOW9fyULnbvtx13l0cpFBAINrj09KZZRJyKhIos2iQqKTdWRCURpj8kW1iQZoZpFkoi94uePj
AKoDz8WXGy34WHihy8Tenu8j0iXCPCFMIXWA0LrJjIj1rvHTfWZpbaql5Ipvsn1yDYuq+LTWS0zr
5SkcD+/P+DDncuwNzsu8p14xGQL/tXMkaF7NpXfRD2Vq7EmlEVWcG+/LOP3DrSJje688OifFBdsQ
wyOJI9zSI88F7jhwODdg7lJgVTISn4yjXcZZ2MqOEhQFtjy4x9njPW9503m4KeS/mcfhNEB5Zvn0
tRAsnaBU0AdxlZ8X2F7GxQQuw/3UtEy+iLFvI25CAYFBKn2lyuu6gExnuaAdhyKzdWcabJ5Uj2Oj
Q19GR3DpsI5TK77o7Lmkw9jH6uXos/RzQxCqNcLFN74KThDoCApCoNmCZtySt2QraVcf3WFhlkRd
wUQ=
=qcG9
-----END PGP SIGNATURE-----

--kd0JBl8nmdGoiZ7OK7vbI8KopTcDpDFG7--