doc/apt-key.8.xml

   1 <?xml version="1.0" encoding="utf-8" standalone="no"?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
   4 <!ENTITY % aptent SYSTEM "apt.ent"> %aptent;
   5 <!ENTITY % aptverbatiment SYSTEM "apt-verbatim.ent"> %aptverbatiment;
   6 <!ENTITY % aptvendor SYSTEM "apt-vendor.ent"> %aptvendor;
   7 ]>
   8
   9 <refentry>
  10  <refentryinfo>
  11    &apt-author.jgunthorpe;
  12    &apt-author.team;
  13    &apt-email;
  14    &apt-product;
  15    <!-- The last update date -->
  16    <date>2015-10-15T00:00:00Z</date>
  17  </refentryinfo>
  18
  19  <refmeta>
  20    <refentrytitle>apt-key</refentrytitle>
  21    <manvolnum>8</manvolnum>
  22    <refmiscinfo class="manual">APT</refmiscinfo>
  23  </refmeta>
  24
  25  <!-- Man page title -->
  26  <refnamediv>
  27     <refname>apt-key</refname>
  28     <refpurpose>APT key management utility</refpurpose>
  29  </refnamediv>
  30
  31  &synopsis-command-apt-key;
  32
  33  <refsect1><title>Description</title>
  34    <para>
  35    <command>apt-key</command> is used to manage the list of keys used
  36    by apt to authenticate packages.  Packages which have been
  37    authenticated using these keys will be considered trusted.
  38    </para>
  39 </refsect1>
  40
  41 <refsect1><title>Commands</title>
  42    <variablelist>
  43      <varlistentry><term><option>add</option> <option>&synopsis-param-filename;</option></term>
  44      <listitem>
  45      <para>
  46        Add a new key to the list of trusted keys.
  47        The key is read from the filename given with the parameter
  48        &synopsis-param-filename; or if the filename is <literal>-</literal>
  49        from standard input.
  50      </para>
  51      <para>
  52      It is critical that keys added manually via <command>apt-key</command> are
  53      verified to belong to the owner of the repositories they claim to be for
  54      otherwise the &apt-secure; infrastructure is completely undermined.
  55      </para>
  56      </listitem>
  57      </varlistentry>
  58
  59      <varlistentry><term><option>del</option> <option>&synopsis-param-keyid;</option></term>
  60      <listitem>
  61      <para>
  62
  63        Remove a key from the list of trusted keys.
  64
  65      </para>
  66
  67      </listitem>
  68      </varlistentry>
  69
  70      <varlistentry><term><option>export</option> <option>&synopsis-param-keyid;</option></term>
  71      <listitem>
  72      <para>
  73
  74         Output the key &synopsis-param-keyid; to standard output.
  75
  76      </para>
  77
  78      </listitem>
  79      </varlistentry>
  80
  81      <varlistentry><term><option>exportall</option></term>
  82      <listitem>
  83      <para>
  84
  85         Output all trusted keys to standard output.
  86
  87      </para>
  88
  89      </listitem>
  90      </varlistentry>
  91
  92      <varlistentry><term><option>list</option></term>
  93      <listitem>
  94      <para>
  95
  96        List trusted keys.
  97
  98      </para>
  99
 100      </listitem>
 101      </varlistentry>
 102
 103      <varlistentry><term><option>finger</option></term>
 104      <listitem>
 105      <para>
 106
 107      List fingerprints of trusted keys.
 108
 109      </para>
 110
 111      </listitem>
 112      </varlistentry>
 113
 114      <varlistentry><term><option>adv</option></term>
 115      <listitem>
 116      <para>
 117      Pass advanced options to gpg. With <command>adv --recv-key</command> you
 118      can e.g. download key from keyservers directly into the the trusted set of
 119      keys. Note that there are <emphasis>no</emphasis> checks performed, so it is
 120      easy to completely undermine the &apt-secure; infrastructure if used without
 121      care.
 122      </para>
 123
 124      </listitem>
 125      </varlistentry>
 126
 127      <varlistentry><term><option>update</option></term>
 128      <listitem>
 129      <para>
 130
 131        Update the local keyring with the archive keyring and remove from
 132        the local keyring the archive keys which are no longer valid.
 133        The archive keyring is shipped in the <literal>archive-keyring</literal> package of your
 134        distribution, e.g. the &keyring-package; package in &keyring-distro;.
 135
 136      </para>
 137
 138      </listitem>
 139      </varlistentry>
 140
 141      <varlistentry><term><option>net-update</option></term>
 142      <listitem>
 143      <para>
 144
 145        Perform an update working similarly to the <command>update</command> command above,
 146        but get the archive keyring from a URI instead and validate it against a master key.
 147
 148        This requires an installed &wget; and an APT build configured to have
 149        a server to fetch from and a master keyring to validate.
 150
 151        APT in Debian does not support this command, relying on
 152        <command>update</command> instead, but Ubuntu's APT does.
 153
 154      </para>
 155
 156      </listitem>
 157      </varlistentry>
 158    </variablelist>
 159 </refsect1>
 160
 161  <refsect1><title>Options</title>
 162 <para>Note that options need to be defined before the commands described in the previous section.</para>
 163    <variablelist>
 164       <varlistentry><term><option>--keyring</option> <option>&synopsis-param-filename;</option></term>
 165       <listitem><para>With this option it is possible to specify a particular keyring
 166       file the command should operate on. The default is that a command is executed
 167       on the <filename>trusted.gpg</filename> file as well as on all parts in the
 168       <filename>trusted.gpg.d</filename> directory, though <filename>trusted.gpg</filename>
 169       is the primary keyring which means that e.g. new keys are added to this one.
 170       </para></listitem>
 171       </varlistentry>
 172    </variablelist>
 173  </refsect1>
 174
 175  <refsect1><title>Files</title>
 176    <variablelist>
 177
 178      &file-trustedgpg;
 179
 180      <varlistentry><term><filename>/etc/apt/trustdb.gpg</filename></term>
 181      <listitem><para>Local trust database of archive keys.</para></listitem>
 182      </varlistentry>
 183
 184      <varlistentry><term>&keyring-filename;</term>
 185      <listitem><para>Keyring of &keyring-distro; archive trusted keys.</para></listitem>
 186      </varlistentry>
 187
 188      <varlistentry><term>&keyring-removed-filename;</term>
 189      <listitem><para>Keyring of &keyring-distro; archive removed trusted keys.</para></listitem>
 190      </varlistentry>
 191
 192    </variablelist>
 193
 194 </refsect1>
 195
 196 <refsect1><title>See Also</title>
 197 <para>
 198 &apt-get;, &apt-secure;
 199 </para>
 200 </refsect1>
 201
 202  &manbugs;
 203  &manauthor;
 204
 205 </refentry>
 206