Commit `425a57870e`

425a57870ea403d1c2ecc904e8b50aaf4155cd6f

parent: a47e6fb0d8

Unsigned

cmc <hello@cleberg.net> · 2024-06-19 13:28 UTC

add trusted.gpg blog post

Layout: unified · split

content/blog/2024-06-19-deprecated-trusted-gpg-fix.md added +133

		@@ -0,0 +1,133 @@
	1	+++
	2	date = 2024-06-19 08:00:00
	3	title = "Fixing Ubuntu Error: 'Key is stored in legacy trusted.gpg keyring'"
	4	description = "Learn how to update GPG keys from the trusted.gpg keyring in Ubuntu."
	5	+++
	6
	7	## System Warning
	8
	9	When running an update on an Ubuntu system, you may have run into a system
	10	warning that looks like the example below.
	11
	12	```txt
	13	W: https://dl.yarnpkg.com/debian/dists/stable/InRelease: Key is stored in legacy
	14	trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in
	15	apt-key(8) for details.
	16	```
	17
	18	While this example references the `yarn` package, the warning message is the
	19	same for any repository using the deprecated `trusted.gpg` key ring.
	20
	21	The issue arises from managing keys with the `apt-key` command, which utilizes
	22	the `/etc/apt/trusted.gpg` file by default. Instead, Ubuntu has moved to
	23	managing key rings with individual `.gpg` files in the `/etc/apt/trusted.gpg.d/`
	24	directory.
	25
	26	To fix this issue, let's check to see which keys are using the `trusted.gpg` key
	27	ring and move them into their own dedicated key ring.
	28
	29	## Finding All Keys in the Keyring
	30
	31	Let's start by simply listing the keys used by the `apt` commands. To do this,
	32	run the following command.
	33
	34	```sh
	35	sudo apt-key list
	36	```
	37
	38	This command will show an output similar to the one below. You may see
	39	additional keys in the `/etc/apt/trusted.gpg.d/` directory - this is where we
	40	will be moving any keys currently found in the `trusted.gpg` key ring.
	41
	42	In the below example, we can see that this system has four different GPG keys
	43	stored within the `trusted.gpg` key ring. Let's go ahead and move them into
	44	their own files.
	45
	46	```txt
	47	Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead
	48	(see apt-key(8)).
	49
	50	/etc/apt/trusted.gpg
	51	--------------------
	52	pub rsa2048 2011-08-19 [SC] [expires: 2027-05-24]
	53	573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62
	54	uid [ unknown] nginx signing key <signing-key@nginx.com>
	55
	56	pub rsa4096 2016-10-05 [SC]
	57	72EC F46A 56B4 AD39 C907 BBB7 1646 B01B 86E5 0310
	58	uid [ unknown] Yarn Packaging <yarn@dan.cx>
	59	sub rsa4096 2016-10-05 [E]
	60	sub rsa4096 2019-01-02 [S] [expires: 2026-01-23]
	61	sub rsa4096 2019-01-11 [S] [expires: 2026-01-23]
	62
	63	pub rsa4096 2024-05-29 [SC]
	64	8540 A6F1 8833 A80E 9C16 53A4 2FD2 1310 B49F 6B46
	65	uid [ unknown] nginx signing key <signing-key-2@nginx.com>
	66
	67	pub rsa4096 2024-05-29 [SC]
	68	9E9B E90E ACBC DE69 FE9B 204C BCDC D8A3 8D88 A2B3
	69	uid [ unknown] nginx signing key <signing-key-3@nginx.com>
	70	```
	71
	72	## Moving Keys to the Proper Location
	73
	74	### Exporting Keys to New Files
	75
	76	Now that we know the keys, we will need to move them into their own key ring. We
	77	can do this by copying the last eight (8) characters from the key's signature
	78	and exporting it from this key ring into its own.
	79
	80	Using the yarn example from the beginning, here's the command to move this key
	81	into its own key ring.
	82
	83	```sh
	84	sudo apt-key export 86E50310 \| sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/yarn.gpg
	85	```
	86
	87	You can repeat this process for any other keys, such as the `nginx` keys in the
	88	example above.
	89
	90	### Cleaning Up
	91
	92	If you run `sudo apt-key list` again, you should see the keys within their own
	93	key rings:
	94
	95	```txt
	96	/etc/apt/trusted.gpg.d/nginx-archive-keyring.gpg
	97	------------------------------------------------
	98	pub rsa4096 2024-05-29 [SC]
	99	8540 A6F1 8833 A80E 9C16 53A4 2FD2 1310 B49F 6B46
	100	uid [ unknown] nginx signing key <signing-key-2@nginx.com>
	101
	102	pub rsa2048 2011-08-19 [SC] [expires: 2027-05-24]
	103	573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62
	104	uid [ unknown] nginx signing key <signing-key@nginx.com>
	105
	106	pub rsa4096 2024-05-29 [SC]
	107	9E9B E90E ACBC DE69 FE9B 204C BCDC D8A3 8D88 A2B3
	108	uid [ unknown] nginx signing key <signing-key-3@nginx.com>
	109
	110	/etc/apt/trusted.gpg.d/yarn.gpg
	111	-------------------------------
	112	pub rsa4096 2016-10-05 [SC]
	113	72EC F46A 56B4 AD39 C907 BBB7 1646 B01B 86E5 0310
	114	uid [ unknown] Yarn Packaging <yarn@dan.cx>
	115	sub rsa4096 2016-10-05 [E]
	116	sub rsa4096 2019-01-02 [S] [expires: 2026-01-23]
	117	sub rsa4096 2019-01-11 [S] [expires: 2026-01-23]
	118	```
	119
	120	Once you have verified that the keys are valid and stored in their own key
	121	rings, you can archive the `trusted.gpg` file and run a system update to test
	122	the new files.
	123
	124	```sh
	125	sudo mv /etc/apt/trusted.gpg /etc/apt/trusted.gpg.bkp
	126	sudo apt update
	127	```
	128
	129	Once you've verified that updates work as expected and that the keys are working
	130	as intended, you can delete the `.bkp` file created above. If you're storing
	131	keys that are not easily re-attainable, I suggest keeping the `.bkp` file stored
	132	in a safe location until you are positive that you no longer need it.
	133

Commit 425a57870e

Commit `425a57870e`