Managing GPG Keys with 'apt-key' in APT Package Manager (with examples)

The apt-key utility is an essential tool in the world of Debian-based Linux distributions such as Debian and Ubuntu. It manages the GPG (GNU Privacy Guard) keys on your system, ensuring that the packages you install through APT (Advanced Package Tool) are trustworthy. These GPG keys are used to verify the authenticity of the packages you download, protecting your system from malicious software. Although apt-key is deprecated, understanding its use can be helpful for managing legacy systems or scripts. Today, we’ll explore several use cases for the apt-key command, which include listing, adding, deleting, and managing trusted keys.

Use Case 1: List Trusted Keys

Code:

apt-key list

Motivation:

Listing trusted keys is a fundamental task when managing your system’s repositories. This command helps you to see all the GPG keys that the APT system currently trusts. By reviewing this list, you can identify and verify keys to ensure that they are still needed, helping you maintain a clean and secure system environment.

Explanation:

• apt-key: The command-line utility used for managing GPG keys.
• list: This argument tells the apt-key command to output a list of all trusted keys stored in its database.

Example Output:

A successful execution of this command might output something similar to:

/etc/apt/trusted.gpg
--------------------
pub   rsa2048 2021-03-03 [SC]
      ABC123ABC123ABC123ABC123ABC123ABC123ABC1
uid           [ unknown] Example Key <example@example.com>
sub   rsa2048 2021-03-03 [E]

/etc/apt/trusted.gpg.d/example.gpg
----------------------------------
pub   rsa4096 2020-12-12 [SC]
      DEF456DEF456DEF456DEF456DEF456DEF456DEF4
uid           [  full  ] Example Repository User <user@repository.com>
sub   rsa4096 2020-12-12 [E]

Use Case 2: Add a Key to the Trusted Keystore

Code:

apt-key add public_key_file.asc

Motivation:

Adding a key manually is useful when you have a specific GPG key file (such as public_key_file.asc) and you want to trust packages signed with that key. This approach is necessary when setting up third-party repositories that distribute their keys separately.

Explanation:

• apt-key: The tool used for key management.
• add: This argument signifies the operation to add a new key.
• public_key_file.asc: This is the file containing the public GPG key you wish to add to the trusted keystore.

Example Output:

On successful key addition, the command provides no output, but you can verify the operation by listing the keys again with apt-key list.

Use Case 3: Delete a Key from the Trusted Keystore

Code:

apt-key del key_id

Motivation:

Deleting a key is crucial when a repository is no longer needed or if you want to tighten security by removing unused or old keys. This command ensures that packages from the repository associated with the deleted key will no longer be trusted and installed by APT.

Explanation:

• apt-key: The command-line interface for GPG key management.
• del: Specifies the action to delete a key.
• key_id: Represents the ID of the key to be removed. This ID can be found using apt-key list.

Example Output:

If successful, the command will yield a response such as:

OK

Use Case 4: Add a Remote Key to the Trusted Keystore

Code:

wget -qO - https://host.tld/filename.key | apt-key add -

Motivation:

This method is ideal for situations where you need to add a key from a remote source quickly. Organizations often provide direct URLs to their key files to facilitate easy setup of their repositories.

Explanation:

• wget: A utility to retrieve files from the web.
• -q: Quiet mode, suppressing the output of all but essential information.
• -O -: Instructs wget to dump the output to stdout, allowing it to be piped directly.
• https://host.tld/filename.key: The URL of the remote key file you wish to trust.
• |: Pipe operator used to pass output from wget to apt-key.
• apt-key add -: Adds the key received from the pipe to the trusted keystore. The hyphen indicates that the key is read from stdin.

Example Output:

As with the local key addition, this command provides no direct output upon success but can be verified by listing the keys.

Use Case 5: Add a Key from Keyserver with Only Key ID

Code:

apt-key adv --keyserver pgp.mit.edu --recv KEYID

Motivation:

Fetching a key directly from a keyserver is particularly useful when working with open-source projects frequently using public keyservers for GPG key distribution. This command connects to a trusted keyserver and retrieves the key by its ID, simplifying the addition process.

Explanation:

• apt-key: Key management utility.
• adv: Advanced options for apt-key, allowing for more specific control.
• --keyserver pgp.mit.edu: Specifies the keyserver to connect to, in this case, using MIT’s public keyserver.
• --recv KEYID: The operation to receive a key from the keyserver using its unique key ID.

Example Output:

Successful execution will show output confirming the key’s retrieval, such as:

gpg: requesting key ABCDEF01 from hkp server pgp.mit.edu
gpg: key ABCDEF01: public key "Example Key <example@domain.com>" imported
gpg: Total number processed: 1
gpg: imported: 1

Conclusion

The apt-key command, despite its deprecation, plays a significant role in manually managing repository authentication on Debian-based systems. Understanding how to leverage these commands ensures that you maintain a secure, trusted set of repositories while navigating through system administration tasks, especially when handling legacy systems. As apt-key is phased out, modern alternatives and methods are recommended for increased security and ease of use. However, familiarity with these commands remains useful for specific cases.