Repository navigation
Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), contrary to apt-key deprecation notice #22041
Description
Is this a docs issue?
- My issue is about the documentation content or website
Type of issue
Information is incorrect
Description
The Docker installation instructions for Ubuntu currently store the GPG key in the deprecated /etc/apt/keyrings/ directory, which results in the following warning when running apt-get update:
Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
Proposed Fix:
The installation guide should be updated to use /usr/share/keyrings/ instead of /etc/apt/keyrings/, following best practices for managing repository keys.
Current Documentation (Deprecated Method)
sudo apt-get update
sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
Location
https://docs.docker.com/engine/install/ubuntu/
Suggestion
Recommended Fix (Using /usr/share/keyrings/)
sudo apt-get update
sudo apt-get install -y ca-certificates curl gpg
sudo install -m 0755 -d /usr/share/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker.gpg
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
This change aligns with APT's new key management best practices and prevents the warning message from appearing.
Expected Outcome:
- No warning about trusted.gpg when running apt-get update.
- Keyring storage follows the recommended /usr/share/keyrings/ location for security and maintainability.
Would appreciate your feedback on updating the documentation accordingly. 🚀
Activity
thaJeztah commentedon Feb 16, 2025
Hm; this looks related to;
Quoting that PR's description, which was done after conferring with Debian maintainers (the contributor is a Debian maintainer as well);
cc @tianon
tianon commentedon Feb 18, 2025
Yeah, if you're seeing this warning, something's wrong on your system. Do you have a simple reproducer?
Here's what I get when I try to reproduce using the instructions from https://docs.docker.com/engine/install/ubuntu/ (lots of "setup" output removed for brevity):
(as you can see, no warnings or errors)
ukpagrace commentedon Feb 21, 2025
@tianon sorry for the late reply, I am running it on Ubuntu 24.04.1 LTS
Kernel: Linux 6.8.0-52-generic
Architecture: x86-64
tianon commentedon Feb 24, 2025
That's useful data, but doesn't give us what we need to actually reproduce:
My guess is you've got some leftover configuration from something else (maybe a previous install that didn't use
/etc/apt/keyrings?) and that's what's tripping this warning.(In my example reproducer above, it's also Ubuntu 24.04, and you can see there's no warnings from
apt-get update.)docker-robot commentedon May 25, 2025
There hasn't been any activity on this issue for a long time.
If the problem is still relevant, mark the issue as fresh with a
/remove-lifecycle stalecomment.If not, this issue will be closed in 14 days. This helps our maintainers focus on the active issues.
Prevent issues from auto-closing with a
/lifecycle frozencomment./lifecycle stale
ukpagrace commentedon May 25, 2025
Yes you were right about this, thanks for your help 🙂
thaJeztah commentedon May 25, 2025
Looks like it's resolved; let me close this ticket