在Ubuntu 14.04中,我们通常将用于签署我们软件发布的存储库的密钥安装为keyring到 /etc/apt/trusted.gpg.d。这样apt就知道该密钥是可信的。
然而,在Ubuntu 18.04上似乎不再起作用了。如果我做同样的操作,更新时会出错:
# apt-get update
Hit:1 http://company.com/ubuntu-snapshot bionic InRelease
Reading package lists... Done
W: http://company.com/ubuntu-snapshot/dists/bionic/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/company-keys.gpg are ignored as the file is not readable by user '_apt' executing apt-key.
明显的尝试通过
# sudo chown -v _apt /etc/apt/trusted.gpg.d/company-keys.gpg
changed ownership of '/etc/apt/trusted.gpg.d/company-keys.gpg' from root to _apt
不能工作,因为apt-get update
会产生以下结果:
# apt-get update
Hit:1 http://company.com/ubuntu-snapshot bionic InRelease
Reading package lists... Done
W: http://company.com/ubuntu-snapshot/dists/bionic/InRelease: The key(s) in the keyring /etc/apt/trusted.gpg.d/company-keys.gpg are ignored as the file has an unsupported filetype.
如果我使用以下行添加密钥本身是有效的,那么一切都能按预期工作:
wget -O - http://company.com/key.gpg | sudo apt-key add -
不幸的是,我们无法选择后者,因为我们想部署自己的密钥,并且拥有更改/撤销它们的能力。
我无法弄清楚为什么apt拒绝/etc/apt/trusted.gpg.d
中的密钥环,也找不到描述apt对新Ubuntu版本的不同期望的变更日志。如果您能指出一些资源来解决此问题,我将非常感激。