How to fix W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is stored in legacy trusted.gpg keyring in APT

APTINTERMEDIATELOWUpdated Dec 29, 2025· 164 views

This warning appears when APT keys are stored in the deprecated /etc/apt/trusted.gpg file instead of the new /etc/apt/keyrings directory. While it doesn't block updates, apt-key is deprecated and will be removed in future Ubuntu/Debian versions.

Quick fix

Fixes W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is stored in legacy trusted.gpg keyring

sudo apt-key list
  1. List all keys in the legacy trusted.gpg keyring
  2. Identify the key causing the warning
  3. Export the key to the new location
  4. Update the repository configuration file
apt — error
sudo apt-key list
W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is stored in legacy trusted.gpg keyring

What this error means

This warning indicates that one or more PPA or repository GPG keys are stored in the legacy /etc/apt/trusted.gpg keyring file instead of the modern /etc/apt/keyrings directory. The apt-key tool, which managed these keys, has been deprecated since APT 2.4 in favor of individual key files. The security concern is that keys in the legacy trusted.gpg are trusted globally across all repositories on your system, allowing any third-party repository to replace any package.

Typical symptoms

  • Warning message appears during apt update or apt upgrade
  • Multiple "Key is stored in legacy trusted.gpg keyring" warnings for different repositories
  • Warnings appear for PPAs added with apt-key add command
  • Warnings reference PPA URLs or Ubuntu repository URLs with InRelease files

Common causes

  1. GPG keys were added to /etc/apt/trusted.gpg using the deprecated apt-key add command
  2. System upgraded from older Ubuntu/Debian versions before the deprecation warning was introduced
  3. PPA keys were not properly migrated to individual files in /etc/apt/keyrings or /etc/apt/trusted.gpg.d
  4. Third-party installation scripts still use apt-key instead of the new recommended method

How to fix "W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is stored in legacy trusted.gpg keyring"

1List all keys in the legacy trusted.gpg keyring

First, identify which keys are stored in the legacy location:

bash
sudo apt-key list

This will show all keys with their fingerprints and which repositories they are associated with.

2Identify the key causing the warning

From the output of apt-key list, locate the key associated with the PPA mentioned in your warning message. You need the last 8 characters of the key ID (without spaces). For example, if the fingerprint is "DB08 5A08 CA13 B8AC B917 E0F6 D938 EC0D 0386 51BD", the key ID is "038651BD".

3Export the key to the new location

Export the key from the legacy keyring and save it to the proper modern location:

bash
sudo apt-key export <KEY_ID> | sudo gpg --dearmor -o /etc/apt/keyrings/<descriptive_name>.gpg

Replace <KEY_ID> with the 8-character key ID and <descriptive_name> with something descriptive like "ppa-ubuntu-mozilla-security" or "ppa-deadsnakes".

4Update the repository configuration file

Edit the corresponding sources list file, typically found in /etc/apt/sources.list.d/:

bash
sudo nano /etc/apt/sources.list.d/<repository-file>.list

Find the line starting with "deb" and add the signed-by directive. Change from:

bash
deb http://ppa.launchpad.net/user/ppa/ubuntu focal main

To:

bash
deb [signed-by=/etc/apt/keyrings/<descriptive_name>.gpg] http://ppa.launchpad.net/user/ppa/ubuntu focal main

If the file uses the newer DEB822 format (deb822), add a new line instead: Signed-By: /etc/apt/keyrings/<descriptive_name>.gpg

5Remove the old key from legacy keyring

After updating the repository configuration, remove the old key from the deprecated trusted.gpg:

bash
sudo apt-key del <KEY_ID>

Where <KEY_ID> is the same 8-character key ID used earlier.

6Verify the fix with apt update

Run apt update to confirm the warning is resolved:

bash
sudo apt update

The warning for the migrated key should no longer appear. Repeat steps 2-5 for any remaining keys generating warnings.

Advanced notes

For new PPAs or repositories, use the modern method directly: curl -sS https://example.com/key.gpg | gpg --dearmor | sudo tee /etc/apt/keyrings/example.gpg then add the signed-by directive to sources. The legacy trusted.gpg file trusted keys globally across all repositories for security, a risk that individual key files with signed-by eliminate. apt-key will be unavailable after Debian 11 and Ubuntu 22.04 LTS, making this migration essential for long-term system maintenance. The /etc/apt/keyrings directory is the preferred modern location, while /etc/apt/trusted.gpg.d is still supported but less secure than signed-by usage.

Frequently asked questions

What does "W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is store" mean?
gpg keyring file instead of the modern /etc/apt/keyrings directory. 4 in favor of individual key files. gpg are trusted globally across all repositories on your system, allowing any third-party repository to replace any package.
How do I fix "W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is store"?
This warning appears when APT keys are stored in the deprecated /etc/apt/trusted.gpg file instead of the new /etc/apt/keyrings directory. While it doesn't block updates, apt-key is deprecated and will be removed in future Ubuntu/Debian versions.
What causes "W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is store"?
GPG keys were added to /etc/apt/trusted.gpg using the deprecated apt-key add command System upgraded from older Ubuntu/Debian versions before the deprecation warning was introduced PPA keys were not properly migrated to individual files in /etc/apt/keyrings or /etc/apt/trusted.gpg.d
Is the "W: http://ppa.launchpad.net/X/Y/ubuntu/dists/Z/InRelease: Key is store" error serious?
It is a low-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading