apt-key Command Reference: Usage, Deprecation & CI Examples

By Daniel Zoghalchali·Latchkey

apt-key managed APT trusted keys; it is now deprecated in favor of keyrings.

apt-key added and listed the GPG keys APT uses to verify repositories. It is deprecated on modern Debian/Ubuntu in favor of per-repository keyrings referenced with signed-by.

Common flags and usage

• apt-key add <file>: add a key (deprecated)
• apt-key adv --keyserver ... --recv-keys: fetch a key (deprecated)
• apt-key list / del: list or remove trusted keys
• Modern replacement: write a keyring under /etc/apt/keyrings
• Reference it with signed-by= in the .sources or .list entry

Example

curl -fsSL https://example.com/repo.gpg \
  | gpg --dearmor -o /etc/apt/keyrings/example.gpg
echo "deb [signed-by=/etc/apt/keyrings/example.gpg] https://example.com/apt stable main" \
  > /etc/apt/sources.list.d/example.list

In CI

On recent images apt-key prints a deprecation warning and may be absent entirely. Prefer the signed-by keyring pattern above so a third-party repository keeps working when apt-key is removed.

Using this in CI

A runner shell is not a login shell. It does not read your dotfiles, it usually has no TTY, and by default it does not stop on the first error, so a failing command in the middle of a multi-line run block can leave the job green.

# make the shell behave the way you assume it does
- name: Build
  shell: bash
  run: |
    set -euo pipefail    # exit on error, undefined vars, and pipeline failures
    ./do-the-thing | tee out.log

Key takeaways

• apt-key is deprecated; modern APT uses per-repo keyrings.
• Dearmor the key into /etc/apt/keyrings and reference it with signed-by.
• New CI images may not ship apt-key at all.

Frequently asked questions

Related guides

References

• GitHub Actions documentation