How to fix W: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg) in APT

APTINTERMEDIATELOWUpdated Dec 29, 2025· 279 views

This warning appears when apt finds GPG keys in the deprecated /etc/apt/trusted.gpg file instead of the modern /etc/apt/trusted.gpg.d/ directory. While not blocking updates, it indicates outdated key management that should be migrated to comply with current security practices.

Quick fix

Fixes W: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)

sudo apt-key list
  1. List current keys to identify legacy ones
  2. Apply the quick fix (if you're in a hurry)
  3. Do the proper fix (recommended for production)
  4. Update repository source files to use the new key location
apt — error
sudo apt-key list
W: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)

What this error means

The "Key is stored in legacy trusted.gpg keyring" warning indicates that one or more GPG keys used to verify package authenticity are stored in the deprecated /etc/apt/trusted.gpg file. This file was the standard location for apt key storage before APT 2.4 introduced the /etc/apt/trusted.gpg.d/ directory and /etc/apt/keyrings/ location. This is a deprecation warning, not an error. Your system updates will continue working normally. However, the warning signals that your repository key configuration is outdated. Starting from Debian 11 and Ubuntu 22.04 LTS, apt-key itself is deprecated and will eventually be removed. The warning becomes more critical on newer systems as they encourage moving to per-repository key management instead of storing all keys in a single global keyring. The difference is important for security: the old trusted.gpg approach trusts keys globally for any repository, while the modern approach allows specifying which key should be trusted for which specific repository.

Typical symptoms

  • apt update command outputs warning: 'W: Key is stored in legacy trusted.gpg keyring'
  • Warning appears during apt-get update, apt-get upgrade, or other apt operations
  • Ubuntu 22.04 LTS or Debian 11+ shows this warning when updating PPAs
  • The warning is printed but updates continue normally (not a blocking error)
  • apt-key deprecation notice appears in documentation for your system

Common causes

  1. Repository keys were added using apt-key add command before APT 2.4
  2. Third-party PPAs or repository setup scripts used the deprecated apt-key method
  3. System upgraded from an older Ubuntu/Debian version that still had keys in trusted.gpg
  4. Package installation scripts added keys to the global trusted.gpg keyring
  5. Docker or CI/CD images still use legacy key management practices

How to fix "W: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)"

1List current keys to identify legacy ones

First, see which keys are stored in the legacy location:

bash
sudo apt-key list

This shows all GPG keys, including those in /etc/apt/trusted.gpg. Each key entry shows its fingerprint. The last 8 characters of the fingerprint are the key ID you'll need later.

You can also check the file directly:

bash
ls -la /etc/apt/trusted.gpg
file /etc/apt/trusted.gpg
2Apply the quick fix (if you're in a hurry)

For a temporary solution that removes the warning immediately, simply copy the legacy keyring file to the new directory:

bash
sudo cp /etc/apt/trusted.gpg /etc/apt/trusted.gpg.d/

This works because apt will check both locations. The warning disappears because apt finds keys in the new preferred location.

Note: This is not the most elegant solution (it copies all keys rather than organizing them), but it works for development environments and quick fixes.

3Do the proper fix (recommended for production)

For each key that triggered the warning, export it to the new individual key location:

bash
# Get the full fingerprint of the key you want to migrate
sudo apt-key fingerprint

# Export the key (replace KEY_ID with the last 8 chars of fingerprint)
sudo apt-key export KEY_ID | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/repository-name.gpg

Example - if you have a Docker repository key:

bash
# Export Docker's GPG key to the new location
sudo apt-key export 0EBFCD88 | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/docker-archive-keyring.gpg

# Then remove it from the old location
sudo apt-key --keyring /etc/apt/trusted.gpg del 0EBFCD88

The proper approach involves:
1. Exporting each key individually to /etc/apt/trusted.gpg.d/ with a descriptive name
2. Updating the repository source files to reference the new key location
3. Removing the key from the legacy trusted.gpg file

4Update repository source files to use the new key location

After exporting a key, update the corresponding repository file to reference it explicitly. Repository files are typically in /etc/apt/sources.list.d/

For DEB822 format (newer style):

bash
# Edit the repository configuration file
sudo nano /etc/apt/sources.list.d/docker.sources

# Add or update the Signed-By field:
Signed-By: /etc/apt/trusted.gpg.d/docker-archive-keyring.gpg
deb https://download.docker.com/linux/ubuntu jammy stable

For traditional one-line format:

bash
sudo nano /etc/apt/sources.list.d/docker.list

# Change from:
# deb https://download.docker.com/linux/ubuntu jammy stable

# To:
deb [signed-by=/etc/apt/trusted.gpg.d/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu jammy stable

After updating, run:

bash
sudo apt update

The warning should no longer appear for that repository.

5Verify the fix worked

After migrating keys, confirm the warning is gone:

bash
sudo apt update

You should see no warnings about legacy keyring. Check that new keys are in the correct location:

bash
ls -la /etc/apt/trusted.gpg.d/
sudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/docker-archive-keyring.gpg --list-keys

If the legacy trusted.gpg file is now empty (or no longer needed), you can safely remove it:

bash
# First, back it up just in case
sudo cp /etc/apt/trusted.gpg /etc/apt/trusted.gpg.backup

# Then remove it if all keys have been migrated
sudo rm /etc/apt/trusted.gpg
6Fix Docker setup scripts (if applicable)

If you're using Docker or other tools that set up repositories automatically, they may be using the legacy apt-key method. Update your setup scripts:

Old way (deprecated):

bash
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
echo "deb [arch=amd64] https://download.docker.com/linux/ubuntu jammy stable" | sudo tee /etc/apt/sources.list.d/docker.list

New way (modern):

bash
# Download the key to the keyrings directory
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/docker-archive-keyring.gpg

# Add repository with signed-by reference
echo "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu jammy stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update

Update your Dockerfiles and CI/CD scripts to use the modern approach. This ensures new systems won't generate warnings.

Advanced notes

APT 2.4 and the new keyrings directory: Starting with APT 2.4, the recommended location for GPG keys is /etc/apt/keyrings/ (not /etc/apt/trusted.gpg.d/). The keyrings directory is for keys managed outside of packages, while trusted.gpg.d/ is for package-managed keys. In practice, trusted.gpg.d/ still works fine and is widely used.

apt-key deprecation timeline:
- Debian 11 and Ubuntu 22.04: apt-key is still available but deprecated
- Debian 12 and Ubuntu 24.04: apt-key may be removed
- Plan to migrate before these versions reach your systems

Automating the migration in Dockerfiles: For containerized environments, use the modern method from the start:

dockerfile
FROM ubuntu:22.04

# Install key to new location and add repository in one step
RUN apt-get update && apt-get install -y curl gnupg && \
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmour -o /etc/apt/trusted.gpg.d/docker-archive-keyring.gpg && \
    echo "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu jammy stable" > /etc/apt/sources.list.d/docker.list && \
    apt-get update && apt-get install -y docker-ce

Multiple key management in CI/CD: If managing many repository keys, create a consistent naming scheme:
- docker-archive-keyring.gpg
- kubernetes-archive-keyring.gpg
- postgresql-archive-keyring.gpg

This makes it easy to identify which key belongs to which repository.

DEB822 format: Modern apt supports DEB822 format for repository files (.sources extension). This format is cleaner and more explicit:

bash
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: jammy
Components: stable
Signed-By: /etc/apt/trusted.gpg.d/docker-archive-keyring.gpg

Prefer DEB822 format when setting up new repositories on modern systems.

Verifying key integrity: After importing a key, verify its fingerprint matches the official source:

bash
# Show fingerprint of imported key
sudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/docker-archive-keyring.gpg --fingerprint

# Compare with official Docker key fingerprint: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88

Frequently asked questions

What does "W: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)" mean?
gpg file. d/ directory and /etc/apt/keyrings/ location. This is a deprecation warning, not an error.
How do I fix "W: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)"?
This warning appears when apt finds GPG keys in the deprecated /etc/apt/trusted.gpg file instead of the modern /etc/apt/trusted.gpg.d/ directory. While not blocking updates, it indicates outdated key management that should be migrated to comply with current security practices.
What causes "W: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)"?
Repository keys were added using apt-key add command before APT 2.4 Third-party PPAs or repository setup scripts used the deprecated apt-key method System upgraded from an older Ubuntu/Debian version that still had keys in trusted.gpg
Is the "W: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)" error serious?
It is a low-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading