MP520-20：Debian Trixie 改變 APT Key 管理政策

[Huang Jia-Bin]

Debian Trixie就在這兩週間 APT Key的管理上發生大變動，主要是變得更嚴謹：
一、停止使用明碼的key，改為一律採用 Binary Key。
二、key的存放位置從 /etc/apt/trusted.gpg.d/ 改到 /usr/share/keyrings/

MP520-20修正步驟如下：

1、下載 Binary key 存放於新位置：
$ sudo wget -O /usr/share/keyrings/mp520.gpg  http://deb.mapleboard.org/mp520/mp520.gpg

2、刪除老Key：
$ sudo rm /etc/apt/trusted.gpg.d/mp520.gpg.key

3、修改 Sources list
$ nano /etc/apt/sources.list.d/mp520.list

deb [signed-by=/usr/share/keyrings/mp520.gpg] http://deb.mapleboard.org/mp520 trixie main
deb-src [signed-by=/usr/share/keyrings/mp520.gpg] http://deb.mapleboard.org/mp520 trixie main

4、完成
$ sudo apt update
$ sudo apt upgrade

[Steven]

Hi Bin,

2025/2/1以後更新又有問題了訊息如下

錯誤:3 http://deb.mapleboard.org/mp520 trixie InRelease
Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 5686FDBDD467C0BC2AA7A87BCC09222600105685 is not bound: Policy rejected asymmetric algorithm because: RSA1024 is not considered secure since 2014-02-01T00:00:00Z

 

[Huang Jia-Bin]

真糟糕，RSA1024 不能用了。請改用 RSA3072 的 mp520v2.gpg，並且把MP520的apt sources結構改變如下，以符合未來Debian的policy：

一、下載 mp520v2.gpg

$ sudo wget -O /usr/share/keyrings/mp520v2.gpg http://deb.mapleboard.org/mp520v2/mp520v2.gpg

二、下載 Sources

$ sudo wget -O /etc/apt/sources.list.d/debian.sources  http://deb.mapleboard.org/mp520v2/debian.sources

$ sudo wget -O /etc/apt/sources.list.d/mp520v2.sources  http://deb.mapleboard.org/mp520v2/mp520v2.sources

$ sudo wget -O /etc/apt/sources.list.d/vscode.sources  http://deb.mapleboard.org/mp520v2/vscode.sources

三、刪除老的 sources.list

$ sudo rm /etc/apt/sources.list

$ sudo rm /etc/apt/sources.list.d/mp520.list

$ sudo rm /etc/apt/sources.list.d/vscode.list

四、大功告成

$ sudo apt update

$ sudo apt upgrade

 

 

[作者]

文章