From 851b6a097165af4d51c0db01b5e05256e5006896 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 11:00:48 +0200 Subject: Adding upstream version 2.6.1. Signed-off-by: Daniel Baumann --- doc/apt-key.8.xml | 246 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 246 insertions(+) create mode 100644 doc/apt-key.8.xml (limited to 'doc/apt-key.8.xml') diff --git a/doc/apt-key.8.xml b/doc/apt-key.8.xml new file mode 100644 index 0000000..7cf4da4 --- /dev/null +++ b/doc/apt-key.8.xml @@ -0,0 +1,246 @@ + + %aptent; + %aptverbatiment; + %aptvendor; +]> + + + + &apt-author.jgunthorpe; + &apt-author.team; + &apt-email; + &apt-product; + + 2022-02-22T00:00:00Z + + + + apt-key + 8 + APT + + + + + apt-key + Deprecated APT key management utility + + + &synopsis-command-apt-key; + + Description + + apt-key is used to manage the list of keys used + by apt to authenticate packages. Packages which have been + authenticated using these keys will be considered trusted. + + + Use of apt-key is deprecated, except for the use of + apt-key del in maintainer scripts to remove existing + keys from the main keyring. + If such usage of apt-key is desired the additional + installation of the GNU Privacy Guard suite (packaged in + gnupg) is required. + + + apt-key(8) will last be available in Debian 11 and Ubuntu 22.04. + + + +Supported keyring files +apt-key supports only the binary OpenPGP format (also known as "GPG key + public ring") in files with the "gpg" extension, not + the keybox database format introduced in newer &gpg; versions as default + for keyring files. Binary keyring files intended to be used with any apt + version should therefore always be created with gpg --export. + +Alternatively, if all systems which should be using the created keyring + have at least apt version >= 1.4 installed, you can use the ASCII armored + format with the "asc" extension instead which can be + created with gpg --armor --export. + + + +Commands + + (deprecated) + + + Add a new key to the list of trusted keys. + The key is read from the filename given with the parameter + &synopsis-param-filename; or if the filename is - + from standard input. + + + It is critical that keys added manually via apt-key are + verified to belong to the owner of the repositories they claim to be for + otherwise the &apt-secure; infrastructure is completely undermined. + + + Note: Instead of using this command a keyring + should be placed directly in the /etc/apt/trusted.gpg.d/ + directory with a descriptive name and either "gpg" or + "asc" as file extension. + + + + + (mostly deprecated) + + + + Remove a key from the list of trusted keys. + + + + + + + (deprecated) + + + + Output the key &synopsis-param-keyid; to standard output. + + + + + + + (deprecated) + + + + Output all trusted keys to standard output. + + + + + + + , (deprecated) + + + + List trusted keys with fingerprints. + + + + + + + (deprecated) + + + Pass advanced options to gpg. With adv --recv-key you + can e.g. download key from keyservers directly into the trusted set of + keys. Note that there are no checks performed, so it is + easy to completely undermine the &apt-secure; infrastructure if used without + care. + + + + + + (deprecated) + + + Update the local keyring with the archive keyring and remove from + the local keyring the archive keys which are no longer valid. + The archive keyring is shipped in the archive-keyring package of your + distribution, e.g. the &keyring-package; package in &keyring-distro;. + + + Note that a distribution does not need to and in fact should not use + this command any longer and instead ship keyring files in the + /etc/apt/trusted.gpg.d/ directory directly as this + avoids a dependency on gnupg and it is easier to manage + keys by simply adding and removing files for maintainers and users alike. + + + + + (deprecated) + + + + Perform an update working similarly to the update command above, + but get the archive keyring from a URI instead and validate it against a master key. + + This requires an installed &wget; and an APT build configured to have + a server to fetch from and a master keyring to validate. + + APT in Debian does not support this command, relying on + update instead, but Ubuntu's APT does. + + + + + + + + + Options +Note that options need to be defined before the commands described in the previous section. + + (deprecated) + With this option it is possible to specify a particular keyring + file the command should operate on. The default is that a command is executed + on the trusted.gpg file as well as on all parts in the + trusted.gpg.d directory, though trusted.gpg + is the primary keyring which means that e.g. new keys are added to this one. + + + + + + Deprecation + + Except for using apt-key del in maintainer scripts, the use of apt-key is deprecated. This section shows how to replace existing use of apt-key. + +If your existing use of apt-key add looks like this: +wget -qO- https://myrepo.example/myrepo.asc | sudo apt-key add - +Then you can directly replace this with (though note the recommendation below): +wget -qO- https://myrepo.example/myrepo.asc | sudo tee /etc/apt/trusted.gpg.d/myrepo.asc +Make sure to use the "asc" extension for ASCII armored +keys and the "gpg" extension for the binary OpenPGP +format (also known as "GPG key public ring"). The binary OpenPGP format works +for all apt versions, while the ASCII armored format works for apt version >= +1.4. +Recommended: Instead of placing keys into the /etc/apt/trusted.gpg.d +directory, you can place them anywhere on your filesystem by using the +Signed-By option in your sources.list and +pointing to the filename of the key. See &sources-list; for details. +Since APT 2.4, /etc/apt/keyrings is provided as the recommended +location for keys not managed by packages. +When using a deb822-style sources.list, and with apt version >= 2.4, the +Signed-By option can also be used to include the full ASCII +armored keyring directly in the sources.list without an +additional file. + + + + + + Files + + + &file-trustedgpg; + + + + + +See Also + +&apt-get;, &apt-secure; + + + + &manbugs; + &manauthor; + + + -- cgit v1.2.3