-
Notifications
You must be signed in to change notification settings - Fork 7.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use trusted.gpg.d instead of apt-key #11625
Comments
Same here |
I'm experiencing the same issue, with the additional problem that when I try to manually add the gpg file to
...with of course loads of other errors from not having a valid key. |
This worked for me
Also, if you are using groovy , you should try focal instead. |
Hi @devs-saifur-rahman, thanks for this tip. I was stuck in the same point and it helped me to progress with the install. This may be a good update to be done in the docs. EDIT: I will try to make some time to check if I can do it and submit it. |
apt-key is deprecated and will not be available after Debian 11 / Ubuntu 22.04 Although adding keys directly to ADD A KEY# Adding an ASCII Armored key (.asc key)
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
gpg --dearmor | \
sudo tee /usr/share/keyrings/docker-ce-archive-keyring.gpg > \
/dev/null
# Or if you prefer a one-liner
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/docker-ce-archive-keyring.gpg > /dev/null
# Breakdown of each part
#
# curl downloads the key
# gpg --dearmor creates a binary .gpg because /usr/share/keyrings cannot take .asc keys
# sudo tee because we get permission denied if we try redirect the output of a sudo command
# /dev/null we don't need to see the dearmored keyring on the console ADD REPOSITORY AS A SOURCE IN /etc/apt/sources.list.d/echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-ce-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
sudo tee /etc/apt/sources.list.d/docker-ce.list > \
/dev/null
# Of if you prefer a one-liner
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-ce-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker-ce.list > /dev/null With the above in place, you're ready for the transition away from apt-key to whatever will come next, with the added bonus of Debian's security best practices. :) |
@denis-roy, are these commands same for Debian distribution as well..? [just by replacing ubuntu => debian] sorry if it sounds too stupid, I'm new to Docker.
|
@vieee, the procedure is the same for Debian 9 (Stretch) / Ubuntu 16.04 (Xenial) onward. For more information, refer to PR #11990 Here are the commands you need to execute to install Docker on Debian INSTALLING DEPENDENCIES
ADDING THE KEY
ADDING THE REPOSITORY
UPDATING APT & INSTALLING DOCKER
|
What group of fools decided to deprecate something without first having a replacement or even a suggested replacement, or EVEN DOCUMENTING THIS HORSESHIT???? |
@AkashicSeer, please remain civil. Deprecated means you can still use the tool but its usage is discouraged. The way Debian has decided to deal with third-party keys and repositories is well documented in their Wiki. The Simply put: Nobody is forcing you to change and if you want to change, there is plenty of time to comply. Hint: You might want to change. The proposed way is much more secure: It assign a specific key to a specific repository as opposed to now where any package is checked against any key in your keyring. The group of fools you are referring to is a large body of able open source developers who work mostly without pay to provide the world with a free operating system that anybody, and that includes you, is at complete liberty to use... Or not. If you feel you can contribute ideas or code towards a better way to manage third-keys and repository, as we say in the open source world: Pull Requests are welcome. |
To install Docker for Kali 2020.1 debian amd64 run the following: then:
It worked for me by Hard coding. |
@Pema-Sereka, hardcoding Evaluating
|
@denis-roy, |
@denis-roy Apparently the dependency of GnuPG ( curl -fsSL https://download.docker.com/linux/debian/gpg \
| sudo tee /usr/share/keyrings/docker-ce-archive-keyring.asc > /dev/null Note the file extension |
That's unlikely to work, because sudo has no effect on redirections. The redirection happens in the current shell before sudo is invoked. It will only "work" if the current user already has the right permissions to write to the file. If you need sudo for it, you have to use tee.
|
I think the correct way is: $ sudo touch /etc/apt/trusted.gpg.d/docker.gpg
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/docker.gpg --import - |
As stated earlier, the proposal comes from the Debian Wiki, not from me :) @FranklinYu - They go with binary signatures (.gpg) instead of ASCII Armored ones (.asc) to avoid some error vectors and to maintain interoperability with SecureAPT which requires .gpg sigs @jinliming2 - There are plenty of acceptable ways to deal with this, I just chose to propose the most standard, Debian-compliant way I could find For further discussions, visit PR #11990 |
Cutting and pasting your instructions above fail with the same error on Ubuntu 20.10 and a brand new install of Ubuntu 20.04 LTS. Here is my output from 20.04:
|
@Jon-Biz From the look of it, you are trying to follow Debian's installation procedure on Ubuntu.
There is no release of Debian named Following the installation procedure for Ubuntu will undoublty yield the desired results:
or you could very well just edit the source directly:
to replace |
Thank you for your reply. I have resolved my problems. Fwiw, attempting to add the docker-ce-archive-keyring.gpg to my keyrings directory failed with a 'Permission denied' error. I was able to resolve this by
|
* Offering an alternative to apt-key (deprecated) [Use trusted.gpg.d instead of apt-key · Issue #11625 · docker/docker.github.io](#11625) As of Debian 10 / Ubuntu 20.10, apt-key is deprecated and will not be available after Debian 11 / Ubuntu 22.04 Although adding keys directly to `/etc/apt/trusted.gpg.d`/ is suggested by apt-key deprecation message, as per [Debian Wiki](https://wiki.debian.org/DebianRepository/UseThirdParty) GPG keys for third party repositories should be added to `/usr/share/keyrings` and referenced with the `signed-by` option in the source.list.d entry. Providing a binary .gpg key instead of an ASCII Armored one might help shorten the lengthy command by removing the ` | gpg --dearmor ` bit. This removes the software-properties-common provides add-apt-repository which we don't use anymore
@denis-roy Would you mind sharing more about this? The only place I found about the requirement is a very brief note at DebianRepository/UseThirdParty; I can’t find the relevant description at the SecureApt page. By the way, I tried the armored file on my virtual machine (Debian Buster), and APT didn’t complain. Is SecureApt opt-in? |
@FranklinYu, unfortunately I estimate my understanding to be limited to a little more than what is mentioned in that DebianRepository/UseThirdParty Wiki and wouldn't want to mislead you. You might want to open a discussion or take part in an already open one on that specific Debian Wiki though :) |
──(root💀localhost)-[~] |
@cm038, Kali's rolling release is most likely based on Debian Testing which release names are |
Thanks for your comment. There is an error somewhere but unfortunately I cannot get it resolved. I am using termux on android 11 and when entering apt-get update i get the following errors; ─(root💀localhost)-[~] |
@cm038, the first troubleshooting step would be to validate if Docker on Termux/Android is a supported setup? 🤔 |
This work for me, thnxs amigo:
curl -fsSL https://download.docker.com/linux/debian/gpg | gpg
|
Hello Friends, i have Ubuntu 21.04, i want download katoolin3 sudo ./install.sh; |
That sounds like an issue to raise on the github page for katoolin3, especially since pool.sks-keyservers.net has essentially been disabled/useless for a few months now. |
Yes, this doesn't look related to Docker in any way. For |
Closed issues are locked after 30 days of inactivity. If you have found a problem that seems similar to this, please open a new issue. /lifecycle locked |
Problem description
One of the steps at https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository is to add Docker’s official GPG key like this:
However, the last part generates the following warning (at least on Ubuntu 20.10):
Maybe it is time to use
trusted.gpg.d
as suggested by the warning?The text was updated successfully, but these errors were encountered: