Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save robfrawley/3fb890e1347ca7e0bfb7f79f2a9766c3 to your computer and use it in GitHub Desktop.
Save robfrawley/3fb890e1347ca7e0bfb7f79f2a9766c3 to your computer and use it in GitHub Desktop.

Do not use apt-key add.

apt-key add [filename]

Note: Instead of using this command a keyring should be placed directly in the /etc/apt/trusted.gpg.d/ directory with a descriptive name and either "gpg" or "asc" as file extension.
    — apt-key(8) manpage

So instead of curl -fsSL https://packagecloud.io/AtomEditor/atom/gpgkey | sudo apt-key add - you actually should use something like this:

curl -fsSL https://packagecloud.io/AtomEditor/atom/gpgkey \
  | gpg --dearmor \
  | sudo tee /etc/apt/trusted.gpg.d/atom.gpg \
  > /dev/null

(You have to use gpg --dearmor because sometimes APT doesn't recognize ASCII-armoured keys, which kinda sucks but works for us so whatever)

Once again, in a single line:

curl -fsSL https://packagecloud.io/AtomEditor/atom/gpgkey | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/atom.gpg > /dev/null

Why?

apt-key add writes the key into the /etc/apt/trusted.gpg keyring, which makes it a bit harder to remove the key once you don't need it (you'll still be able to do apt-key del [key-id] but it's less intuitive and you have to remember what the key fingerprint was). Also this way you'll have a more pretty structure if you already store repolists in separate files in sources.list.d/* (which you of course totally should). Finally, this is what add-apt-repository ppa:whatever does, so you'll stay in line with it as well.

(We can only wonder why this isn't the default apt-key add behaviour, though.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment