[GH-ISSUE #1488] Wrong path for gpg-key at Debian repository #1050

New issue

Closed

opened 2026-05-07 00:29:51 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:29:51 +02:00

Owner

Originally created by @fredl99 on GitHub (Nov 17, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1488

Not critical, but...
The path for the key should be /usr/share/keyrings/ instead of /etc/apt/keyrings/

https://archive.ntfy.sh/apt/

Originally created by @fredl99 on GitHub (Nov 17, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1488 Not critical, but... The path for the key should be `/usr/share/keyrings/` instead of `/etc/apt/keyrings/` https://archive.ntfy.sh/apt/

BreizhHardware closed this issue

2026-05-07 00:29:51 +02:00

BreizhHardware commented

2026-05-07 00:29:52 +02:00

Author

Owner

@binwiederhier commented on GitHub (Nov 17, 2025):

Stuff in /usr/share and /usr/lib is typically only for package-shipped configs, not manually changed configs. So I don't think the keyrings belong there.

Examples:

From man sources.list:

The recommended locations for keyrings are /usr/share/keyrings for keyrings managed by packages, and /etc/apt/keyrings for keyrings managed by the system operator.

       •   Signed-By (signed-by) is an option to require a repository to pass apt-secure(8) verification with a certain set of keys rather than all trusted keys apt has
           configured. It is specified as a list of absolute paths to keyring files (have to be accessible and readable for the _apt system user, so ensure everyone has
           read-permissions on the file) and fingerprints of keys to select from these keyrings. The recommended locations for keyrings are /usr/share/keyrings for keyrings
           managed by packages, and /etc/apt/keyrings for keyrings managed by the system operator. If no keyring files are specified the default is the trusted.gpg keyring and all
           keyrings in the trusted.gpg.d/ directory (see apt-key fingerprint). If no fingerprint is specified all keys in the keyrings are selected. A fingerprint will accept also
           all signatures by a subkey of this key, if this isn't desired an exclamation mark (!) can be appended to the fingerprint to disable this behaviour. The option defaults
           to the value of the option with the same name if set in the previously acquired Release file of this repository (only fingerprints can be specified there through).
           Otherwise all keys in the trusted keyrings are considered valid signers for this repository. The option may also be set directly to an embedded GPG public key block.
           Special care is needed to encode the empty line with leading spaces and ".":

@binwiederhier commented on GitHub (Nov 17, 2025): Stuff in /usr/share and /usr/lib is typically only for package-shipped configs, not manually changed configs. So I don't think the keyrings belong there. Examples: - https://docs.docker.com/engine/install/ubuntu/ - https://github.com/cli/cli/blob/trunk/docs/install_linux.md#debian From `man sources.list`: > The recommended locations for keyrings are /usr/share/keyrings for keyrings managed by packages, and /etc/apt/keyrings for keyrings managed by the system operator. ``` • Signed-By (signed-by) is an option to require a repository to pass apt-secure(8) verification with a certain set of keys rather than all trusted keys apt has configured. It is specified as a list of absolute paths to keyring files (have to be accessible and readable for the _apt system user, so ensure everyone has read-permissions on the file) and fingerprints of keys to select from these keyrings. The recommended locations for keyrings are /usr/share/keyrings for keyrings managed by packages, and /etc/apt/keyrings for keyrings managed by the system operator. If no keyring files are specified the default is the trusted.gpg keyring and all keyrings in the trusted.gpg.d/ directory (see apt-key fingerprint). If no fingerprint is specified all keys in the keyrings are selected. A fingerprint will accept also all signatures by a subkey of this key, if this isn't desired an exclamation mark (!) can be appended to the fingerprint to disable this behaviour. The option defaults to the value of the option with the same name if set in the previously acquired Release file of this repository (only fingerprints can be specified there through). Otherwise all keys in the trusted keyrings are considered valid signers for this repository. The option may also be set directly to an embedded GPG public key block. Special care is needed to encode the empty line with leading spaces and ".": ```

BreizhHardware referenced this issue

2026-05-07 01:02:24 +02:00

[PR #1050] [MERGED] Message size limit+delay limit #1500