修复 Linux 中的 apt-key 弃用错误

今天早上，我从小度假回家后，决定从命令行运行 apt update 和 apt upgrade，只是想看看在我离线期间是否有任何更新。发出 update 命令后，有些地方似乎不太对劲；我看到类似这样的消息

W: https://updates.example.com/desktop/apt/dists/xenial/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

没错，这只是一个警告，但仍然有那个可怕的词，弃用，这通常意味着它很快就会消失。所以我认为我应该看看。根据我的发现，我认为我的经验值得分享。

事实证明，我为某些存储库保留了较旧的配置，这是“很久以前”安装过程的遗留物，需要进行调整。根据警告消息的提示，我在命令行运行了 man apt-key，它提供了一些有趣的信息。在手册页的开头附近

apt-key is used to manage the list of keys used by apt to authenticate packages. Packages which have been authenticated using these keys are considered trusted.
Use of apt-key is deprecated, except for the use of apt-key del in maintainer scripts to remove existing keys from the main keyring. If such usage of apt-key is desired, the additional installation of the GNU Privacy Guard suite (packaged in gnupg) is required.
apt-key(8) will last be available in Debian 11 and Ubuntu 22.04.

“Debian 11 和 Ubuntu 22.04”中最后可用对我来说几乎就是现在。是时候解决这个问题了！

修复 apt-key 弃用错误

在手册页的后面，有 apt update 警告中提到的弃用部分

DEPRECATION
Except for using apt-key del in maintainer scripts, the use of apt-key is deprecated. This section shows how to replace the existing use of apt-key.
If your existing use of apt-key add looks like this:

wget -qO- https://myrepo.example/myrepo.asc | sudo apt-key add -

Then you can directly replace this with (though note the recommendation below):

wget -qO- https://myrepo.example/myrepo.asc | sudo tee /etc/apt/trusted.gpg.d/myrepo.asc

Make sure to use the "asc" extension for ASCII armored keys and the "gpg" extension for the binary OpenPGP format (also known as "GPG key public ring"). The binary OpenPGP format works for all apt versions, while the ASCII armored format works for apt version >= 1.4.

Recommended: Instead of placing keys into the /etc/apt/trusted.gpg.d directory, you can place them anywhere on your filesystem by using the Signed-By option in your sources.list and pointing to the filename of the key. See sources.list(5) for details. Since APT 2.4, /etc/apt/keyrings is provided as the recommended location for keys not managed by packages. When using a deb822-style sources.list, and with apt version >= 2.4, the Signed-By option can also be used to include the full ASCII armored keyring directly in the sources.list without an additional file.

如果您像我一样，有使用 apt-key 添加的来自非存储库内容的密钥，那么以下是过渡步骤

1. 确定 apt-key keyring /etc/apt/trusted.gpg 中有哪些密钥
2. 删除它们
3. 在 /etc/apt/trusted.gpg.d/ 或 /etc/apt/keyrings/ 中查找并安装替换项

1. 查找旧密钥

命令 apt-key list 显示 /etc/apt/trusted.gpg 中的密钥

$ sudo apt-key list
[sudo] password: 
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
/etc/apt/trusted.gpg
--------------------
pub   rsa4096 2017-04-05 [SC]
      DBE4 6B52 81D0 C816 F630  E889 D980 A174 57F6 FB86
uid           [ unknown] Example <support@example.com>
sub   rsa4096 2017-04-05 [E]

pub   rsa4096 2016-04-12 [SC]
      EB4C 1BFD 4F04 2F6D DDCC  EC91 7721 F63B D38B 4796
uid           [ unknown] Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
sub   rsa4096 2021-10-26 [S] [expires: 2024-10-25]
[...]

之后还显示了 /etc/apt/trusted.gpg.d 文件夹中文件中保存的密钥。

[ 相关阅读 如何将现有的 SSH 密钥导入到您的 GPG 密钥中 ]

2. 删除旧密钥

十六进制数字四元组组，例如 DBEA 6B52...FB86，是删除不需要的密钥所需的标识符

$ sudo apt-key del "DBEA 6B52 81D0 C816 F630  E889 D980 A174 57F6 FB86"

这将删除示例密钥。这实际上只是一个示例，实际上您会删除实际存在的密钥。例如，我对系统上的每个真实密钥运行了相同的命令，包括 Google、Signal 和 Ascensio 的密钥。您系统上的密钥将因您安装的内容而异。

3. 添加密钥

获取替换密钥取决于应用程序。例如，Open Whisper 提供了它的密钥以及如何安装它的说明，我决定不遵循它，因为它将密钥放在 /usr/share/keyrings 中。相反，我做了这个

$ wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg
$ sudo mv signal-desktop-keyring.gpg /etc/apt/trusted.gpg.d/
$ sudo chown root:root /etc/apt/trusted.gpg.d/signal-desktop-keyring.gpg
$ sudo chmod ugo+r /etc/apt/trusted.gpg.d/signal-desktop-keyring.gpg
$ sudo chmod go-w /etc/apt/trusted.gpg.d/signal-desktop-keyring.gpg

Ascencio 还提供了安装 OnlyOffice 的说明，其中包括处理 GPG 密钥。我再次修改了他们的说明以适应我的需求

$ gpg --no-default-keyring --keyring gnupg-ring:~/onlyoffice.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys CB2DE8E5
$ sudo mv onlyoffice.gpg /etc/apt/trusted.gpg.d/
$ sudo chown root:root /etc/apt/trusted.gpg.d/onlyoffice.gpg
$ sudo chmod ugo+r /etc/apt/trusted.gpg.d/onlyoffice.gpg
$ sudo chmod go-w /etc/apt/trusted.gpg.d/onlyoffice.gpg

至于 Google 密钥，它通过 .deb 软件包进行管理（看起来是正确的），因此只需使用 dpkg -i 重新安装即可。最后，我得到了这个

$ ls -l /etc/apt/trusted.gpg.d
total 24
-rw-r--r-- 1 root root 7821 Sep  2 10:55 google-chrome.gpg
-rw-r--r-- 1 root root 2279 Sep  2 08:27 onlyoffice.gpg
-rw-r--r-- 1 root root 2223 Sep  2 08:02 signal-desktop-keyring.gpg
-rw-r--r-- 1 root root 2794 Mar 26  2021 ubuntu-keyring-2012-cdimage.gpg
-rw-r--r-- 1 root root 1733 Mar 26  2021 ubuntu-keyring-2018-archive.gpg

过期的密钥

我遇到的最后一个问题密钥来自过时的 QGIS 安装。密钥已过期，我已将其设置为由 apt-key 管理。我最终完全按照他们的说明进行操作，包括在 /etc/apt/keryings 中安装新密钥以及他们为 /etc/apt/sources.list.d/qgis.sources 安装配置建议的格式。

[ 下载 Linux 速查表，适用于 apt 或 dnf ]

Linux 系统维护

现在您可以运行 apt update，而不会出现与已弃用的密钥配置相关的警告或错误。我们 apt 用户只需要记住调整任何依赖于 apt-key 的旧安装说明。您必须将密钥安装到 /etc/apt/trusted.gpg.d/ 或 /etc/apt/keyrings/，而不是使用 apt-key，并根据需要使用 gpg。