cmc/cleberg.net

  1#+date:        [2024-06-19 Wed 08:00:00]
  2#+title:       Ubuntu: Migrate GPG Keys to trusted.gpg.d
  3#+description: Moving Ubuntu GPG keys from the deprecated trusted.gpg to trusted.gpg.d.
  4#+slug:        deprecated-trusted-gpg-fix
  5#+filetags:    :linux:
  6
  7** System Warning
  8
  9When running an update on an Ubuntu system, you may have run into a system
 10warning that looks like the example below.
 11
 12#+begin_src txt
 13W: https://dl.yarnpkg.com/debian/dists/stable/InRelease: Key is stored in legacy
 14trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in
 15apt-key(8) for details.
 16#+end_src
 17
 18While this example references the =yarn= package, the warning message is the
 19same for any repository using the deprecated =trusted.gpg= key ring.
 20
 21The issue arises from managing keys with the =apt-key= command, which utilizes
 22the =/etc/apt/trusted.gpg= file by default. Instead, Ubuntu has moved to
 23managing key rings with individual =.gpg= files in the =/etc/apt/trusted.gpg.d/=
 24directory.
 25
 26To fix this issue, let's check to see which keys are using the =trusted.gpg= key
 27ring and move them into their own dedicated key ring.
 28
 29** Finding All Keys in the Keyring
 30
 31Let's start by simply listing the keys used by the =apt= commands. To do this,
 32run the following command.
 33
 34#+begin_src sh
 35sudo apt-key list
 36#+end_src
 37
 38This command will show an output similar to the one below. You may see
 39additional keys in the =/etc/apt/trusted.gpg.d/= directory - this is where we
 40will be moving any keys currently found in the =trusted.gpg= key ring.
 41
 42In the below example, we can see that this system has four different GPG keys
 43stored within the =trusted.gpg= key ring. Let's go ahead and move them into
 44their own files.
 45
 46#+begin_src txt
 47Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead
 48(see apt-key(8)).
 49
 50/etc/apt/trusted.gpg
 51--------------------
 52pub   rsa2048 2011-08-19 [SC] [expires: 2027-05-24]
 53      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
 54uid           [ unknown] nginx signing key <signing-key@nginx.com>
 55
 56pub   rsa4096 2016-10-05 [SC]
 57      72EC F46A 56B4 AD39 C907  BBB7 1646 B01B 86E5 0310
 58uid           [ unknown] Yarn Packaging <yarn@dan.cx>
 59sub   rsa4096 2016-10-05 [E]
 60sub   rsa4096 2019-01-02 [S] [expires: 2026-01-23]
 61sub   rsa4096 2019-01-11 [S] [expires: 2026-01-23]
 62
 63pub   rsa4096 2024-05-29 [SC]
 64      8540 A6F1 8833 A80E 9C16  53A4 2FD2 1310 B49F 6B46
 65uid           [ unknown] nginx signing key <signing-key-2@nginx.com>
 66
 67pub   rsa4096 2024-05-29 [SC]
 68      9E9B E90E ACBC DE69 FE9B  204C BCDC D8A3 8D88 A2B3
 69uid           [ unknown] nginx signing key <signing-key-3@nginx.com>
 70#+end_src
 71
 72** Moving Keys to the Proper Location
 73
 74*** Exporting Keys to New Files
 75
 76Now that we know the keys, we will need to move them into their own key ring. We
 77can do this by copying the last eight (8) characters from the key's signature
 78and exporting it from this key ring into its own.
 79
 80Using the yarn example from the beginning, here's the command to move this key
 81into its own key ring.
 82
 83#+begin_src sh
 84sudo apt-key export 86E50310 | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/yarn.gpg
 85#+end_src
 86
 87You can repeat this process for any other keys, such as the =nginx= keys in the
 88example above.
 89
 90*** Cleaning Up
 91
 92If you run =sudo apt-key list= again, you should see the keys within their own
 93key rings:
 94
 95#+begin_src txt
 96/etc/apt/trusted.gpg.d/nginx-archive-keyring.gpg
 97------------------------------------------------
 98pub   rsa4096 2024-05-29 [SC]
 99      8540 A6F1 8833 A80E 9C16  53A4 2FD2 1310 B49F 6B46
100uid           [ unknown] nginx signing key <signing-key-2@nginx.com>
101
102pub   rsa2048 2011-08-19 [SC] [expires: 2027-05-24]
103      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
104uid           [ unknown] nginx signing key <signing-key@nginx.com>
105
106pub   rsa4096 2024-05-29 [SC]
107      9E9B E90E ACBC DE69 FE9B  204C BCDC D8A3 8D88 A2B3
108uid           [ unknown] nginx signing key <signing-key-3@nginx.com>
109
110/etc/apt/trusted.gpg.d/yarn.gpg
111-------------------------------
112pub   rsa4096 2016-10-05 [SC]
113      72EC F46A 56B4 AD39 C907  BBB7 1646 B01B 86E5 0310
114uid           [ unknown] Yarn Packaging <yarn@dan.cx>
115sub   rsa4096 2016-10-05 [E]
116sub   rsa4096 2019-01-02 [S] [expires: 2026-01-23]
117sub   rsa4096 2019-01-11 [S] [expires: 2026-01-23]
118#+end_src
119
120Once you have verified that the keys are valid and stored in their own key
121rings, you can archive the =trusted.gpg= file and run a system update to test
122the new files.
123
124#+begin_src sh
125sudo mv /etc/apt/trusted.gpg /etc/apt/trusted.gpg.bkp
126sudo apt update
127#+end_src
128
129Once you've verified that updates work as expected and that the keys are working
130as intended, you can delete the =.bkp= file created above. If you're storing
131keys that are not easily re-attainable, I suggest keeping the =.bkp= file stored
132in a safe location until you are positive that you no longer need it.