# How To: 'apt-key' is deprecated, here's how to fix it **URL:** \ **Category:** Debian\ **Created:** [May 11, 2021, 10:55am UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489 "2021-05-11T10:55:05Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Jasdela](https://community.learnlinux.tv/user_avatar/community.learnlinux.tv/jasdela/32/208_2.png) [@Jasdela](https://community.learnlinux.tv/u/Jasdela)\ **Post date:** [May 11, 2021, 10:55am UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/1 "2021-05-11T10:55:05Z")
> Note: While you see me talk a lot about Ubuntu in this topic, APT is actually a Debian utility. For that reason, this topic lives in the Debian category. _Hey everyone,_ If you ever had to add a custom 3rd party repository to your APT configuration (like Docker, Kubernetes, Perforce), you’ve probably used `apt-key` in the process. However, starting at **Debian 11** and **Ubuntu 20.10** , `apt-key` is now **deprecated** and it will no longer be available **after Debian 11** and **Ubuntu 22.04**. > `apt-key` is deprecated because it has a security weakness regarding key signing and trusting. In this topic, I will show you the new way of adding 3rd party repositories to your APT configuration. Here’s an example of the **old approach** : ``` wget -qO - https://package.perforce.com/perforce.pubkey | sudo apt-key add - sudo echo "deb http://package.perforce.com/apt/ubuntu focal release" > /etc/apt/sources.list.d/perforce.list ``` > You might also have done the second line manually using a text editor, [like Jay did in his recent Kubernetes video.](https://youtu.be/MO8N79lQSWU?t=2720) The new way of adding keys is as follows: ``` wget -qO - https://package.perforce.com/perforce.pubkey | sudo gpg --dearmor -o /usr/share/keyrings/perforce-archive-keyring.gpg sudo echo "deb [signed-by=/usr/share/keyrings/perforce-archive-keyring.gpg] http://package.perforce.com/apt/ubuntu focal release" > /etc/apt/sources.list.d/perforce.list ``` So what’s new here? In the old approach, your key gets added to either `/etc/apt/trusted.gpg` or `/etc/apt/trusted.gpg.d`. As the name suggest, your key gets trusted, **unconditionally** , for **every repository** you have defined. This is bad, because if you add a 3rd party repository, it has the ability to replace packages from the official repositories. The new approach puts your key inside its own file (in this case `perforce-archive-keyring.gpg`) so that it will no longer be trusted by every repository by default. The second change is the addition of `[signed-by=/usr/share/keyrings/perforce-archive-keyring.gpg]` to your repository file. This indicates that this repository will only be trusted with the exact key you added a step earlier. > A couple of notes on the new approach: > > - Make sure you have the `gnupg` package installed so that you can use the `gpg` utility. > - If the public key you’re downloading is not armored, you will need to slightly modify the first line in the new approach, [check out this article which goes more in depth.](https://www.linuxuprising.com/2021/01/apt-key-is-deprecated-how-to-add.html) That’s it, now you can just continue your usual steps by doing `sudo apt update` and install your 3rd party programs! And remember, you can already start using this new approach, so you’re not forced to do it later when `apt-key` is gone! Cheers, Jasper ---
**Author:** ![ameinild](https://community.learnlinux.tv/letter_avatar_proxy/v4/letter/a/51bf81/32.png) [@ameinild](https://community.learnlinux.tv/u/ameinild)\ **Post date:** [May 11, 2021, 2:27pm UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/2 "2021-05-11T14:27:07Z")
Hi Jasper. Thanks for bringing this up. Everything you state is absolutely right. I stumbled upon this some time ago, and to solve the problem, I actually created a shell script to download and install keys in the preferred way. > **[GitHub - ameinild/add-apt-key: POSIX Script for installing APT keys](https://github.com/ameinild/add-apt-key)** > > POSIX Script for installing APT keys. Contribute to ameinild/add-apt-key development by creating an account on GitHub. The github page and `--help` option has some explanation and example of use. Hopefully this makes it a lot easier to get the key to the correct format. Unfortunately, the command `add-apt-repository` does not include an option to add with a `[signed-by=xyz]` option, so this part has to be done manually in your sources file. Hope some of you can use this. ---
**Author:** ![jay](https://community.learnlinux.tv/user_avatar/community.learnlinux.tv/jay/32/649_2.png) [@jay](https://community.learnlinux.tv/u/jay)\ **Post date:** [May 11, 2021, 2:43pm UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/3 "2021-05-11T14:43:16Z")
Thank you for sharing this, great info! ---
**Author:** ![David](https://community.learnlinux.tv/letter_avatar_proxy/v4/letter/d/aeb1de/32.png) [@David](https://community.learnlinux.tv/u/David)\ **Post date:** [May 11, 2021, 11:51pm UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/4 "2021-05-11T23:51:23Z")
Interesting info. Thanks for sharing. ---
**Author:** ![BigBunny](https://community.learnlinux.tv/letter_avatar_proxy/v4/letter/b/c6cbf5/32.png) [@BigBunny](https://community.learnlinux.tv/u/BigBunny)\ **Post date:** [May 12, 2021, 8:19am UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/5 "2021-05-12T08:19:29Z")
I came across this issue earlier this year when I found the VPN key needed updating and it would not accept the new key in the normal way. I tried all the standard ways and variations that I found on-line but nothing worked. (If you read the articles they mentioned the difference between ascii and binary keys and the issues you can come across.) I also found the fact that apt-key was deprecated but everybody still appeared to be using it. In my case the easiest way was to reinstall the application with the latest version and that solved the problem. However if you check your installation you will probably find everything is still in the deprecated key location so there’s a lot of catching up to take place. From a security position this change is a necessity. ---
**Author:** ![jay](https://community.learnlinux.tv/user_avatar/community.learnlinux.tv/jay/32/649_2.png) [@jay](https://community.learnlinux.tv/u/jay)\ **Post date:** [May 12, 2021, 3:20pm UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/6 "2021-05-12T15:20:36Z")
I think the issue here will be how long things generally take to be deprecated. If I read that correctly, Ubuntu will deprecate it after the next LTS release, and considering that release will be supported for up to 5 years on servers after it makes its debut, it will be quite a long time until we stop seeing apt-key. ---
**Author:** ![BigBunny](https://community.learnlinux.tv/letter_avatar_proxy/v4/letter/b/c6cbf5/32.png) [@BigBunny](https://community.learnlinux.tv/u/BigBunny)\ **Post date:** [May 17, 2021, 12:15pm UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/7 "2021-05-17T12:15:16Z")
Another thing is if people upgrade to the next versions how will they get those keys moved. From what I read there is no automatic way of doing it at present. I would imagine many will just try to uninstall and re-install but that could have consequences for anything encrypted, etc. ---
**Author:** ![jay](https://community.learnlinux.tv/user_avatar/community.learnlinux.tv/jay/32/649_2.png) [@jay](https://community.learnlinux.tv/u/jay)\ **Post date:** [May 19, 2021, 10:37pm UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/8 "2021-05-19T22:37:17Z")
Very few people prune their keys, unfortunately. ---
**Author:** ![BigBunny](https://community.learnlinux.tv/letter_avatar_proxy/v4/letter/b/c6cbf5/32.png) [@BigBunny](https://community.learnlinux.tv/u/BigBunny)\ **Post date:** [May 28, 2021, 7:31am UTC](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489/9 "2021-05-28T07:31:05Z")
One of the issues is peoples lax attitudes to security. It’s even amongst some IT personnel. They want security without anything that slows them down or put a further burden on them. (That’s probably one of the reasons why very few people use TFA, (two factor authentication), or use a good password manager so they can have multiple, long, not easily remembered passwords and only need to remember the passwords manager password with hopefully TFA. Long term FIDO or similar is the way to go, but though the keys/dongles are going down in price I think it needs to go further before the general public takes it on board.)