Open ThamesDev opened 3 years ago
In their defense packagecloud themselves are recommending the apt-key approach.
Regardless, I completely agree. Exporting to a keyfile is way more secure, as the GPG key would then only be able to verify packages for the Atom repository, and not things like the Debian and Ubuntu repositories.
This last thing isn't required or anything, but just a general improvement:
This line:
$ sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/atom-archive-keyring.gpg arch=amd64] https://packagecloud.io/AtomEditor/atom/any/ any main" > /etc/apt/sources.list.d/atom.list'
could be:
$ echo "deb [signed-by=/usr/share/keyrings/atom-archive-keyring.gpg arch=amd64] https://packagecloud.io/AtomEditor/atom/any/ any main" | sudo tee /etc/apt/sources.list.d/atom.list'
You're thus only running the sudo
command when writing out to the file (that part isn't really a big deal though), and it's just a bit cleaner imo.
Sorry I didn't reply to this earlier, that's a good idea, I'll do it when I next have access to my laptop.
All good! Sounds great then too.
Actually, on second though now, it would probably be a better idea to make that a separate PR. If the people on the Atom team end up not wanting to change the command, it's just going to be tedious to have to change everything again.
Ok, so it's ready then.
Description of the Change
In your detailed Debian/Ubuntu installation guide, the command
apt-key
is used. This command is being deprecated. Instead, I'd like to suggest this more future-proof option, usinggpg --dearmor | sudo tee /usr/share/keyrings/atom-archive-keyring.gpg
. Please tell me if there are any modifications you'd like me to make.Release Notes
N/A