X-Git-Url: https://git.saurik.com/apt.git/blobdiff_plain/5abbf5bbb5ee8717f89cac6ef409c4cec79259f6..f9de4208b490eb987daaf0dd0c3f9edead204f24:/doc/apt-key.8.xml diff --git a/doc/apt-key.8.xml b/doc/apt-key.8.xml index 1d91790ea..093abfe8a 100644 --- a/doc/apt-key.8.xml +++ b/doc/apt-key.8.xml @@ -13,7 +13,7 @@ &apt-email; &apt-product; - 2012-06-09T00:00:00Z + 2016-07-07T00:00:00Z @@ -36,6 +36,15 @@ by apt to authenticate packages. Packages which have been authenticated using these keys will be considered trusted. + + Note that if usage of apt-key is desired the additional + installation of the GNU Privacy Guard suite (packaged in + gnupg) is required. For this reason alone the programatic + usage (especially in package maintainerscripts!) is strongly discouraged. + Further more the output format of all commands is undefined and can and does + change whenever the underlying commands change. apt-key will + try to detect such usage and generates warnings on stderr in these cases. + Commands @@ -48,7 +57,17 @@ &synopsis-param-filename; or if the filename is - from standard input. - + + It is critical that keys added manually via apt-key are + verified to belong to the owner of the repositories they claim to be for + otherwise the &apt-secure; infrastructure is completely undermined. + + + Instead of using this command a keyring can be placed directly in the + /etc/apt/trusted.gpg.d/ directory with a descriptive name + (same rules for filename apply as for &apt-conf; files) and "gpg" + as file extension. + @@ -85,51 +104,45 @@ - + , - List trusted keys. + List trusted keys with fingerprints. - - - - - List fingerprints of trusted keys. - - - - - - - - Pass advanced options to gpg. With adv --recv-key you can download the - public key. - + Pass advanced options to gpg. With adv --recv-key you + can e.g. download key from keyservers directly into the the trusted set of + keys. Note that there are no checks performed, so it is + easy to completely undermine the &apt-secure; infrastructure if used without + care. - + (deprecated) - Update the local keyring with the archive keyring and remove from the local keyring the archive keys which are no longer valid. The archive keyring is shipped in the archive-keyring package of your distribution, e.g. the &keyring-package; package in &keyring-distro;. - - + + Note that a distribution does not need to and in fact should not use + this command any longer and instead ship keyring files in the + /etc/apt/trusted.gpg directory directly as this + avoids a dependency on gnupg and it is easier to manage + keys by simply adding and removing files for maintainers and users alike. + @@ -172,18 +185,6 @@ &file-trustedgpg; - /etc/apt/trustdb.gpg - Local trust database of archive keys. - - - &keyring-filename; - Keyring of &keyring-distro; archive trusted keys. - - - &keyring-removed-filename; - Keyring of &keyring-distro; archive removed trusted keys. - -