/etc/apt/trusted.gpg
尽管将密钥放入trusted.gpg.d/
(抑制apt update
警告)实际上对安全性没有任何帮助(为此,您将需要deb [signed-by=...]
到处都有条目),但还是存在令人讨厌的弃用。我第一次在 Ubuntu 22.04 中看到它。
现在,看起来像apt
知道哪个键代表trusted.gpg
哪个sources.list
deb[-src]
条目,但(再次令人烦恼地)拒绝告诉。发出像这样的模糊警告要有用得多
W: https://cloud.r-project.org/bin/linux/ubuntu/jammy-cran40/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
当然,它不会让我轻松地告诉我哪个键签署了trusted.gpg
它。也许有一个详细的选项——我不知道。
相信很多人都经历过这样的事情。然而显然没有脚本可以自动将各个密钥移动到文件夹(例如/usr/local/share/keyrings
)并添加[signed-by=...]
到相关sources.list[.d]
条目。
我将如何完成这项任务?特别是,我该如何确认哪个键代表哪个deb[-src]
条目?我该怎么办提炼one-key.gpg
从堆中取出一个个体trusted.gpg
,以便将其移动到文件夹中?
答案1
我已经调整了要旨中提到的丁克姆的回答- 导致migrate-apt-keys
。它修复了一些问题,例如在单个sources.list.d
文件中使用不同密钥签名的多个条目。
重要命令:
deb[-src]
条目的键位于由条目构造的 URL 下的InRelease
或Release.gpg
文件中(请参阅代码)。使用curl
或wget
下载它们。gpg --no-default-keyring --keyring gnupg-ring:/path/to/file ...
:需要对与 无关的特定文件进行操作~/.gnupg
。文件名必须是路径,而不是基本名称。此外,前缀 withgnupg-ring:
暗示可以处理的密钥环格式,apt
而不是默认的密钥盒格式gpg --list-keys --with-colons --fixed-list-mode
生成机器可读的输出
答案2
尝试一下这个脚本,看看效果如何https://gist.github.com/maxhq/7dadf55064aaadc4d9e5993f89fad7b0
#!/bin/bash
# DESCRIPTION
# This script migrates from "apt-key" managed keys to "[signed-by=/usr/share/keyrings/...]":
# - loop through all lists in /etc/apt/sources.list.d
# - read all lines with "deb..." that do not contain "[signed-by=]"
# - download the GPG signature from the URL
# - read the key ID from the signature
# - download and saves the key using gpg
# - add "[signed-by=/usr/share/keyrings/...]" to the "deb..." line
# - make a backup of the old .list file as .list.apt-key
# After the migration you have to delete (or rename to be safe) /etc/apt/trusted.gpg.d and
# /etc/apt/trusted.gpg
#
# REQUIREMENTS
# bash, perl, curl, gpg
#
# CAVEATS
# This does not work e.g. for Anydesk as the Ubuntu keyserver returns an expired key.
# But you can manually download the ASCII armored key and then run migrate-apt-keys.sh:
# curl https://keys.anydesk.com/repos/DEB-GPG-KEY | gpg --dearmor > /usr/share/keyrings/anydesk-stable-archive-keyring.gpg
# See: https://lists.ubuntu.com/archives/ubuntu-users/2022-January/306500.html
set -e
for repo in /etc/apt/sources.list.d/*.list; do
sig_base=$(basename $repo | sed 's/\.list//')
sig_file="/usr/share/keyrings/${sig_base}-archive-keyring.gpg"
skip_repo=0
new_repo=$(mktemp)
migrated=0
while read line; do
# skip if no repo definition
if grep -E -q -v '^deb(-src)?' <<<"$line"; then echo "$line" >> $new_repo; continue; fi
# skip if already "signed-by"
if grep -E -q 'signed-by' <<<"$line"; then echo "$line" >> $new_repo; continue; fi
echo "$sig_base: >> $line"
if [ -f $sig_file ]; then
echo "$sig_base: key already exists - skipping download"
else
# assemble URL
url=$(echo "$line" | perl -pe 's{^ (?:(?:deb|deb-src) \s+) (?: \[[^\]]+] \s+)? (\S+?)/? \s+ (\S+) \s+ .* }{ $suite=$2; "$1/".($suite=~m|/$|?$suite:"dists/$2/") }xe')
echo "$sig_base: downloading $url"
# download signature
set +e
sigfile=$(curl -s -f -L "${url}InRelease")
if [ $? -ne 0 ]; then
sigfile=$(curl -s -f -L "${url}Release.gpg")
if [ $? -ne 0 ]; then echo "$sig_base: URL ${url}[InRelease|Release.gpg] not found"; exit 1; fi
fi
set -e
# read key ID from signature
keyid=$(echo "$sigfile" | gpg --verify -vv 2>&1 | tr '\n' ' ' | sed -E 's/.*signature.*keyid ([0-9A-Z]+).*/\1/i')
if [ -z "$keyid" ]; then echo "$sig_base: Could not find key id in signature"; exit 1; fi
echo "$sig_base: key id = $keyid"
# download key
temp_sig=$(mktemp)
gpg --quiet --no-default-keyring --keyring $temp_sig --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys $keyid
expiry=$(gpg --no-default-keyring --keyring=$temp_sig --list-keys --with-colons --fixed-list-mode | grep pub | cut -d: -f7)
if [[ ! -z "$expiry" && $expiry < $(date +"%s") ]]; then
expiry_date=$(date -d "1970-01-01 UTC $expiry seconds" +"%Y-%m-%d %T %z")
echo "$sig_base: SKIPPING migration - key expired on $expiry_date"
skip_repo=1; break
fi
mv $temp_sig $sig_file
chmod 0644 $sig_file
fi
echo "$line" \
| SIG=$sig_file perl -pe 's{^ ((?:deb|deb-src) \s+) (?: \[ ([^\]]+) ] \s+ )? (.*) }{$1\[$2 signed-by=$ENV{SIG}\] $3}x' \
>> $new_repo
migrated=1
done < <(cat "$repo")
if [[ $skip_repo == 0 && $migrated == 1 ]]; then
cp $repo $repo.apt-key
# preserve permissions
cat $new_repo > $repo
echo "$sig_base: migration done"
fi
rm $new_repo
done