How to fix Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead in APT

APTINTERMEDIATEMEDIUMUpdated Dec 29, 2025· 318 views

The apt-key tool is deprecated as it stores all trusted keys in a single file, creating security risks. Modern systems require managing GPG keys individually in /etc/apt/trusted.gpg.d or /usr/share/keyrings with proper repository bindings.

Quick fix

Fixes Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead

sudo apt-key list
  1. List current keys added with apt-key
  2. Export legacy keys to the new keyrings location
  3. Download future keys directly to the new location
  4. Update repository source files with signed-by tag
apt — error
sudo apt-key list
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead

What this error means

When you add a GPG key using the deprecated apt-key command, the system displays a deprecation warning. This is because apt-key stores all trusted keys in a single /etc/apt/trusted.gpg file, which means any repository authenticated with that file can be cross-signed by unrelated GPG keys. This creates a security vulnerability where a compromised key could verify packages from any repository. Modern Debian and Ubuntu systems (including Ubuntu 24.04+) require managing keyring files individually in /etc/apt/trusted.gpg.d or /usr/share/keyrings. This approach binds specific GPG keys to specific repositories using the signed-by tag, preventing unauthorized package verification.

Typical symptoms

  • Warning message appears when running 'apt-key add' or installing packages from third-party repositories
  • Build pipelines or CI/CD systems display deprecation warnings during apt operations
  • System shows warnings like 'Key is stored in legacy trusted.gpg keyring' on recent Ubuntu/Debian versions
  • Repository managers show deprecated warnings in logs even though packages install successfully

Common causes

  1. Using the deprecated apt-key add command to add repository signing keys
  2. Third-party software or installers that automatically run apt-key for repository setup
  3. Keys added via apt-key on systems upgraded to Ubuntu 24.04 or later

How to fix "Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead"

1List current keys added with apt-key

First, check what keys are currently stored in the legacy trusted.gpg file:

bash
sudo apt-key list

This shows all keys with their IDs. Note the 8-character key ID at the end of each key fingerprint you need to migrate.

2Export legacy keys to the new keyrings location

For each key you've added with apt-key, export it to the modern location. Replace KEYID with the 8-character ID from the previous step:

bash
sudo apt-key export KEYID | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/keyname.gpg > /dev/null

The --dearmor flag converts the ASCII-armored key format to binary format required by modern apt.

Example for a key with ID 12345678:

bash
sudo apt-key export 12345678 | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/my-repo.gpg > /dev/null
3Download future keys directly to the new location

For new repositories, download the GPG key directly to the recommended location instead of using apt-key:

bash
curl -sS https://example.com/repo-key.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/example-repo.gpg > /dev/null

You can also use wget:

bash
wget -qO - https://example.com/repo-key.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/example-repo.gpg > /dev/null
4Update repository source files with signed-by tag

Update your repository source files to explicitly reference the key file using the signed-by tag. This binds the key to that specific repository, preventing cross-signing vulnerabilities.

For a repository list file at /etc/apt/sources.list.d/example-repo.list:

bash
deb [signed-by=/etc/apt/trusted.gpg.d/example-repo.gpg] https://download.example.com/repository focal main

Or if storing keys in /usr/share/keyrings:

bash
deb [signed-by=/usr/share/keyrings/example-repo.gpg] https://download.example.com/repository focal main

Edit existing sources.list entries and add the [signed-by=...] section right after 'deb'.

5Verify the new key works and remove legacy key

Test that the repository works with the new key:

bash
sudo apt update

If the update completes without warnings, remove the old key from the legacy trusted.gpg file. Replace KEYID with the key ID you exported:

bash
sudo apt-key del KEYID

You can verify the key was removed:

bash
sudo apt-key list

Advanced notes

When choosing between /etc/apt/trusted.gpg.d and /usr/share/keyrings, the recommended approach is:
- Use /usr/share/keyrings for stable distribution-managed keyrings and package-provided keys
- Use /etc/apt/trusted.gpg.d for system administrator-added keys specific to the machine

On systems with SELinux enabled, ensure the key files have the correct security context. The gpg --dearmor conversion is important: the --dearmor flag converts from ASCII-armored format (with "-----BEGIN PGP PUBLIC KEY BLOCK-----" headers) to binary OpenPGP format that apt requires. Some newer versions of gpg use --dearmour (British spelling) - both are equivalent.

If you have many legacy keys from apt-key, consider using a script to batch export them all at once rather than manually processing each one.

Frequently asked questions

What does "Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d" mean?
When you add a GPG key using the deprecated apt-key command, the system displays a deprecation warning. gpg file, which means any repository authenticated with that file can be cross-signed by unrelated GPG keys. This creates a security vulnerability where a compromised key could verify packages from any repository.
How do I fix "Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d"?
The apt-key tool is deprecated as it stores all trusted keys in a single file, creating security risks. Modern systems require managing GPG keys individually in /etc/apt/trusted.gpg.d or /usr/share/keyrings with proper repository bindings.
What causes "Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d"?
Using the deprecated apt-key add command to add repository signing keys Third-party software or installers that automatically run apt-key for repository setup Keys added via apt-key on systems upgraded to Ubuntu 24.04 or later
Is the "Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading