How to fix Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead in APT

First, check what keys are currently stored in the legacy trusted.gpg file:

sudo apt-key list

This shows all keys with their IDs. Note the 8-character key ID at the end of each key fingerprint you need to migrate.

For each key you've added with apt-key, export it to the modern location. Replace KEYID with the 8-character ID from the previous step:

sudo apt-key export KEYID | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/keyname.gpg > /dev/null

The --dearmor flag converts the ASCII-armored key format to binary format required by modern apt.

Example for a key with ID 12345678:

sudo apt-key export 12345678 | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/my-repo.gpg > /dev/null

For new repositories, download the GPG key directly to the recommended location instead of using apt-key:

curl -sS https://example.com/repo-key.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/example-repo.gpg > /dev/null

You can also use wget:

wget -qO - https://example.com/repo-key.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/example-repo.gpg > /dev/null

Update your repository source files to explicitly reference the key file using the signed-by tag. This binds the key to that specific repository, preventing cross-signing vulnerabilities.

For a repository list file at /etc/apt/sources.list.d/example-repo.list:

deb [signed-by=/etc/apt/trusted.gpg.d/example-repo.gpg] https://download.example.com/repository focal main

Or if storing keys in /usr/share/keyrings:

deb [signed-by=/usr/share/keyrings/example-repo.gpg] https://download.example.com/repository focal main

Edit existing sources.list entries and add the [signed-by=...] section right after 'deb'.

Test that the repository works with the new key:

sudo apt update

If the update completes without warnings, remove the old key from the legacy trusted.gpg file. Replace KEYID with the key ID you exported:

sudo apt-key del KEYID

You can verify the key was removed:

sudo apt-key list