&apt-author.jgunthorpe; &apt-author.team; &apt-email; &apt-product; 2012-06-09T00:00:00Z
apt-key
8
APT

# apt-key

APT key management utility

&synopsis-command-apt-key;

## Description

`apt-key` is used to manage the list of keys used by apt to authenticate packages. Packages which have been authenticated using these keys will be considered trusted.

## Commands

`add` `&synopsis-param-filename;`

  Add a new key to the list of trusted keys. The key is read from the filename given with the parameter &synopsis-param-filename; or if the filename is `-` from standard input.

`del` `&synopsis-param-keyid;`

  Remove a key from the list of trusted keys.

`export` `&synopsis-param-keyid;`

  Output the key &synopsis-param-keyid; to standard output.

`exportall`

  Output all trusted keys to standard output.

`list`

  List trusted keys.

`finger`

  List fingerprints of trusted keys.

`adv`

  Pass advanced options to gpg. With adv --recv-key you can download the public key.

`update`

  Update the local keyring with the archive keyring and remove from the local keyring the archive keys which are no longer valid. The archive keyring is shipped in the `archive-keyring` package of your distribution, e.g. the &keyring-package; package in &keyring-distro;.

`net-update`

  Perform an update working similarly to the `update` command above, but get the archive keyring from a URI instead and validate it against a master key.

  This requires an installed &wget; and an APT build configured to have a server to fetch from and a master keyring to validate.

  APT in Debian does not support this command, relying on `update` instead, but Ubuntu's APT does.

## Options

Note that options need to be defined before the commands described in the previous section.

`--keyring` `&synopsis-param-filename;`

  With this option it is possible to specify a particular keyring file the command should operate on. The default is that a command is executed on the `trusted.gpg` file as well as on all parts in the `trusted.gpg.d` directory, though `trusted.gpg` is the primary keyring which means that e.g. new keys are added to this one.

## Files

&file-trustedgpg;

`/etc/apt/trustdb.gpg`

  Local trust database of archive keys.

&keyring-filename;

  Keyring of &keyring-distro; archive trusted keys.

&keyring-removed-filename;

  Keyring of &keyring-distro; archive removed trusted keys.

## See Also

&apt-get;, &apt-secure;

&manbugs; &manauthor;