Search code examples
ansibledebianapt

Adding debian/ubuntu repo key without apt-key (from keyserver.ubuntu.com)


As you probably know, since debian 11 command apt-key is deprecated and it will be removed. The "right" way to add a repository key is to copy it to /usr/share/keyrings (and specify signed-by= into repository file). Most programs provide a link from the gpg key (binary or ascii armored), but when you have only the key id it's a little tricky when you don't know what to do it (and google it's not your friend) See my answer for this simple solution (for ubuntu keyserver, I didn't ever use other), hope it will save someone's time!


Solution

  • To download the key from the keyserver.ubuntu.com key repo, use this example for ansible repository:

    wget -O /usr/share/keyrings/ansible.asc "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x6125E2A8C77F2818FB7BD15B93C4A3FD7BB9C367"
    echo "deb [signed-by=/usr/share/keyrings/ansible.asc] https://ppa.launchpadcontent.net/ansible/ansible/ubuntu jammy main" > /etc/apt/sources.list.d/ansible.list
    

    you will need the signing key id (6125E2A8C77F2818FB7BD15B93C4A3FD7BB9C367 is the key for ansible repo hosted on launchpad), and of course repo url and key filename will differ for you, depending on the repository you're trying to add

    of course, if you are using some configuration management (i.e. ansible, puppet, chef) there is a module to be called (for ansible: get_url), so that url and maybe file locations are the "answer" you're looking for

    ubuntu keyserver provides repo key in ascii armored format, so you must use the .asc file extension

    you will not need to de-armor the file (especially when you are using an ansible role/playbook), also you will not need to install gpg packages (other than those on a "base" debian installation)

    hope it helps!