search

geerlingguy / ansible-role-docker

Ansible Role - Docker
https://galaxy.ansible.com/geerlingguy/docker/
MIT License
1.8k stars 851 forks source link

GPG keys should not be saved to `/apt/trusted.gpg.d` / Do not use `apt-key` #435

Closed kawadeomkar closed 3 months ago

kawadeomkar commented 9 months ago

As per https://wiki.debian.org/DebianRepository/UseThirdParty, third party keys should not be placed in /etc/apt/trusted.gpg.d. From the Wiki:

If future updates to the certificate will be managed by an apt/dpkg package as recommended below, then it SHOULD be downloaded into /usr/share/keyrings using the same filename that will be provided by the package. If it will be managed locally , it SHOULD be downloaded into /etc/apt/keyrings instead.

I noticed that the docker docs installation guide https://docs.docker.com/engine/install/debian/ places the docker GPG keys in /etc/apt/keyrings.

Also, apt-key is deprecated and will not be available after Debian 11 / Ubuntu 22.04. Instead of apt-key add - https://github.com/geerlingguy/ansible-role-docker/blob/8ff4a241477f5f24c718d606a2ee450b370cc47c/tasks/setup-Debian.yml#L47 this should be sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

I've started working on the proposed changes, and will make a PR shortly

github-actions[bot] commented 5 months ago

This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark issues as stale.

github-actions[bot] commented 3 months ago

This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.