Don't use /usr/share/keyrings for PGP keys which are not managed by a package

Development
1

Hello everyone,

unfortunately comments are turned off for this news posting: New repository signing keys
So I have to open up a new post for this.

Please don’t instruct users of Debian and derivates to download PGP keys into /usr/share/keyrings. That directory is only meant for PGP keys managed by packages.
Instead use /etc/apt/keyrings.

This is clearly communicated by Debian:

If future updates to the certificate will be managed by an apt/dpkg package as recommended below, then it SHOULD be downloaded into /usr/share/keyrings using the same filename that will be provided by the package. If it will be managed locally , it SHOULD be downloaded into /etc/apt/keyrings instead.
In releases older than Debian 12 and Ubuntu 22.04, /etc/apt/keyrings does not exist by default. It SHOULD be created with permissions 0755 if it is needed and does not already exist.

cf:

2

@DanScharon Thanks for the headsup, I have discussed topic with Timar and will change it to /etc/apt/keyrings !

Thanks
Darshan

1 Like