Speedata repo: apt add-key deprecated

[Cicorione]

Hi @pgundlach,

there have been some changes on Debian 12 and the apt add-key behavior has changed:

W: https://software.speedata.de/download/devel/dists/stable/Release.gpg: 
Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the 
DEPRECATION section in apt-key(8) for details.

https://manpages.debian.org/testing/apt/apt-key.8.en.html

DEPRECATION

Except for using apt-key del in maintainer scripts, the use of apt-key is deprecated. This section shows how to replace existing use of apt-key.

If your existing use of apt-key add looks like this:

wget -qO- https://myrepo.example/myrepo.asc | sudo apt-key add -

Then you can directly replace this with (though note the recommendation below):

wget -qO- https://myrepo.example/myrepo.asc | sudo tee /etc/apt/trusted.gpg.d/myrepo.asc

Make sure to use the "asc" extension for ASCII armored keys and the "gpg" extension for the binary OpenPGP format (also known as "GPG key public ring"). The binary OpenPGP format works for all apt versions, while the ASCII armored format works for apt version >= 1.4.

Recommended: Instead of placing keys into the /etc/apt/trusted.gpg.d directory, you can place them anywhere on your filesystem by using the Signed-By option in your sources.list and pointing to the filename of the key. See sources.list(5) for details. Since APT 2.4, /etc/apt/keyrings is provided as the recommended location for keys not managed by packages. When using a deb822-style sources.list, and with apt version >= 2.4, the Signed-By option can also be used to include the full ASCII armored keyring directly in the sources.list without an additional file.

Don't ask me how this works because I know very little. Perhaps this link can be useful for you:

https://www.digitalocean.com/community/tutorials/how-to-handle-apt-key-and-add-apt-repository-deprecation-using-gpg-to-add-external-repositories-on-ubuntu-22-04

Thanks

[pgundlach]

Thank you very much, I will take a close look and see what I need to do.

[Cicorione]

Let me tell you that something I feel that I am tormenting you rather than helping... 😟

[pgundlach]

No, absolutely not! Any feedback is welcome, and bug reports doubly so (<-- don't know if this is correct English). There are many aspects of the speedata Publisher that I never use, for example installation on Linux or Windows, so I cannot test that well or I don't see if there is something wrong. So sometimes I might sound negative (oh, yet another bug) or sometimes I need a long time to fix a bug, but I am very very grateful for any message if something goes wrong.

[pgundlach]

Thank you very much. The next version will include the correct steps from the digitital ocean site you've linked to. This is really helpful!

---

This will be the text, for those that come here later:

APT repository: If you have root or sudo rights on Debian or Ubuntu GNU/Linux (or a similar system), you can install the .deb files we have prepared from our APT repository. (For now, only the 64 bit architecture is supported.) This is very easy, just follow a few steps: Add our GPG key to the system to make sure you get the correct software:

curl -fsSL http://de.speedata.s3.amazonaws.com/gpgkey-speedata.txt  | sudo gpg --dearmor   -o /usr/share/keyrings/speedata_de.gpg

Add the following file to /etc/apt/sources.list.d/speedata.list for the development version (unstable):

deb [arch=amd64 signed-by=/usr/share/keyrings/speedata_de.gpg]  https://software.speedata.de/download/devel stable main

or for the main (stable) releases:

deb  [arch=amd64 signed-by=/usr/share/keyrings/speedata_de.gpg]  https://software.speedata.de/download/public stable main

Now you can run sudo apt update and apt install speedata-publisher and have a working installation.

[Cicorione]

Thank you it worked like a charm! 👏👏👏