X-Git-Url: https://git.saurik.com/apt.git/blobdiff_plain/e27a1f01f90f5eae73f66f25b316ee8859f72105..0568d325ad8660a9966d552634aa17c90ed22516:/doc/apt-key.8.xml diff --git a/doc/apt-key.8.xml b/doc/apt-key.8.xml index cdb307b64..093abfe8a 100644 --- a/doc/apt-key.8.xml +++ b/doc/apt-key.8.xml @@ -1,13 +1,9 @@ - -%aptent; - - -%aptverbatiment; - + %aptent; + %aptverbatiment; + %aptvendor; ]> @@ -17,7 +13,7 @@ &apt-email; &apt-product; - 2012-05-21T00:00:00Z + 2016-07-07T00:00:00Z @@ -40,6 +36,15 @@ by apt to authenticate packages. Packages which have been authenticated using these keys will be considered trusted. + + Note that if usage of apt-key is desired the additional + installation of the GNU Privacy Guard suite (packaged in + gnupg) is required. For this reason alone the programatic + usage (especially in package maintainerscripts!) is strongly discouraged. + Further more the output format of all commands is undefined and can and does + change whenever the underlying commands change. apt-key will + try to detect such usage and generates warnings on stderr in these cases. + Commands @@ -52,7 +57,17 @@ &synopsis-param-filename; or if the filename is - from standard input. - + + It is critical that keys added manually via apt-key are + verified to belong to the owner of the repositories they claim to be for + otherwise the &apt-secure; infrastructure is completely undermined. + + + Instead of using this command a keyring can be placed directly in the + /etc/apt/trusted.gpg.d/ directory with a descriptive name + (same rules for filename apply as for &apt-conf; files) and "gpg" + as file extension. + @@ -89,51 +104,45 @@ - + , - List trusted keys. + List trusted keys with fingerprints. - - - - - - List fingerprints of trusted keys. - - - - - - - Pass advanced options to gpg. With adv --recv-key you can download the - public key. - + Pass advanced options to gpg. With adv --recv-key you + can e.g. download key from keyservers directly into the the trusted set of + keys. Note that there are no checks performed, so it is + easy to completely undermine the &apt-secure; infrastructure if used without + care. - + (deprecated) - Update the local keyring with the archive keyring and remove from the local keyring the archive keys which are no longer valid. The archive keyring is shipped in the archive-keyring package of your - distribution, e.g. the debian-archive-keyring package in Debian. - + distribution, e.g. the &keyring-package; package in &keyring-distro;. + + + Note that a distribution does not need to and in fact should not use + this command any longer and instead ship keyring files in the + /etc/apt/trusted.gpg directory directly as this + avoids a dependency on gnupg and it is easier to manage + keys by simply adding and removing files for maintainers and users alike. - @@ -141,13 +150,13 @@ - Work similar to the update command above, but get the - archive keyring from an URI instead and validate it against a master key. + Perform an update working similarly to the update command above, + but get the archive keyring from a URI instead and validate it against a master key. This requires an installed &wget; and an APT build configured to have a server to fetch from and a master keyring to validate. - APT in Debian does not support this command and relies on + APT in Debian does not support this command, relying on update instead, but Ubuntu's APT does. @@ -161,7 +170,7 @@ Note that options need to be defined before the commands described in the previous section. - With this option it is possible to specify a specific keyring + With this option it is possible to specify a particular keyring file the command should operate on. The default is that a command is executed on the trusted.gpg file as well as on all parts in the trusted.gpg.d directory, though trusted.gpg @@ -176,18 +185,6 @@ &file-trustedgpg; - /etc/apt/trustdb.gpg - Local trust database of archive keys. - - - /usr/share/keyrings/debian-archive-keyring.gpg - Keyring of Debian archive trusted keys. - - - /usr/share/keyrings/debian-archive-removed-keys.gpg - Keyring of Debian archive removed trusted keys. - -