• testing apt upgrade 2.9.23 to 2.9.26 changes to sources.list

    From songbird@21:1/5 to All on Thu Feb 6 08:00:01 2025
    when doing the upgrade you do have the option of doing
    a test run to see what changes are made or not making the
    changes at that time.

    when going through this process the comments in
    sources.list were discarded.

    i don't know about other people or what they put in
    sources.list, but i normally kept different entries
    commented out if i wasn't using them and then when i
    needed them i could uncomment them out, run apt-get update
    and then continue on with what i needed to accomplish.
    the new format allows for a flag to toggle the entry
    being active or not.

    without those comments being there i had to go back
    and remove the changes that apt made restore the
    old sources.list file, uncomment out everything and
    then rerun the upgrade of apt.

    noting that some parts were not finished and moved to
    a different file that will need to be updated if i need
    them again (stable and oldstable), i added a bit about
    this to the top of sources.list in comments, i hope
    they are not removed again some other time...

    $ man 5 sources.list


    ===== From NEWS.Debian.gz

    apt (2.9.24) unstable; urgency=medium

    /etc/apt/trusted.gpg is no longer trusted. Setting the Dir::Etc::trusted
    option manually continues to work for some more time.

    sources.list(5) entries without the Signed-By field are deprecated;
    migrate any legacy entries to the deb822 .sources format. See the
    apt-secure(8) manual page for best practices for signer configuration.
    This deprecates the /etc/apt/trusted.gpg.d directory.

    =====


    songbird

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Smith@21:1/5 to songbird on Thu Feb 6 09:00:01 2025
    Hi,

    On Thu, Feb 06, 2025 at 01:51:49AM -0500, songbird wrote:
    when doing the upgrade you do have the option of doing
    a test run to see what changes are made or not making the
    changes at that time.

    when going through this process the comments in
    sources.list were discarded.

    I think this behaviour is unlikely to change unless you report a bug
    about it.

    Having said that, I am not sure how the complaint could be addressed
    since from what I understand you are basically asking for otherwise
    valid but commented-out sources.list lines to be converted into inactive
    deb822 files, which seems like a big request.

    Maybe you would settle for the upgrade process just detecting comments
    in the sources.list files and giving a warning like "all comments will
    be discarded"? A downside being that a great many such files do have
    comments. But, probably best discussed in a bug report about the
    behaviour you do not like.

    Thanks,
    Andy

    --
    https://bitfolk.com/ -- No-nonsense VPS hosting

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Dan Ritter@21:1/5 to Charles Curley on Thu Feb 6 14:50:01 2025
    Charles Curley wrote:
    On Thu, 6 Feb 2025 07:53:07 +0000
    Andy Smith <andy@strugglers.net> wrote:

    Having said that, I am not sure how the complaint could be addressed
    since from what I understand you are basically asking for otherwise
    valid but commented-out sources.list lines to be converted into
    inactive deb822 files, which seems like a big request.

    Another option would be to retain all comments, and let the user
    manually convert commented out entries. Simple, easy to do, and only a
    little obnoxious for the user.

    And for those who are wondering, this is going on in trixie.

    I would find that vastly more preferable. Discarding comments in
    a conversion is a disservice to the user.

    -dsr-

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Charles Curley@21:1/5 to Andy Smith on Thu Feb 6 14:30:01 2025
    On Thu, 6 Feb 2025 07:53:07 +0000
    Andy Smith <andy@strugglers.net> wrote:

    Having said that, I am not sure how the complaint could be addressed
    since from what I understand you are basically asking for otherwise
    valid but commented-out sources.list lines to be converted into
    inactive deb822 files, which seems like a big request.

    Another option would be to retain all comments, and let the user
    manually convert commented out entries. Simple, easy to do, and only a
    little obnoxious for the user.

    And for those who are wondering, this is going on in trixie.

    --
    Does anybody read signatures any more?

    https://charlescurley.com
    https://charlescurley.com/blog/

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Frank McCormick@21:1/5 to Charles Curley on Thu Feb 6 15:00:01 2025
    On 2/6/25 8:20 AM, Charles Curley wrote:
    On Thu, 6 Feb 2025 07:53:07 +0000
    Andy Smith <andy@strugglers.net> wrote:

    Having said that, I am not sure how the complaint could be addressed
    since from what I understand you are basically asking for otherwise
    valid but commented-out sources.list lines to be converted into
    inactive deb822 files, which seems like a big request.

    Another option would be to retain all comments, and let the user
    manually convert commented out entries. Simple, easy to do, and only a
    little obnoxious for the user.

    And for those who are wondering, this is going on in trixie.


    I did this recently. Seemed to go well except that now when I update
    I get
    this :

    All packages are up to date.
    Notice: Missing Signed-By in the sources.list(5) entry for 'http://deb.debian.org/debian'
    Notice: Missing Signed-By in the sources.list(5) entry for 'https://repo.vivaldi.com/stable/deb'

    There is no suggestion as to what to do when this happens.

    --
    Frank McCormick

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Dan Purgert@21:1/5 to Frank McCormick on Thu Feb 6 15:20:01 2025
    On Feb 06, 2025, Frank McCormick wrote:


    On 2/6/25 8:20 AM, Charles Curley wrote:
    On Thu, 6 Feb 2025 07:53:07 +0000
    Andy Smith <andy@strugglers.net> wrote:

    Having said that, I am not sure how the complaint could be addressed since from what I understand you are basically asking for otherwise
    valid but commented-out sources.list lines to be converted into
    inactive deb822 files, which seems like a big request.

    Another option would be to retain all comments, and let the user
    manually convert commented out entries. Simple, easy to do, and only a little obnoxious for the user.

    And for those who are wondering, this is going on in trixie.


    I did this recently. Seemed to go well except that now when I update I
    get
    this :

    All packages are up to date.
    Notice: Missing Signed-By in the sources.list(5) entry for 'http://deb.debian.org/debian'
    Notice: Missing Signed-By in the sources.list(5) entry for 'https://repo.vivaldi.com/stable/deb'

    There is no suggestion as to what to do when this happens.

    I imagine you just need to update the list, something like :

    deb [signed-by=/the/key.gpg] https://therepo etc...

    But that also sounds a little too easy; so I don't know.

    --
    |_|O|_|
    |_|_|O| Github: https://github.com/dpurgert
    |O|O|O| PGP: DDAB 23FB 19FA 7D85 1CC1 E067 6D65 70E5 4CE7 2860

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEE3asj+xn6fYUcweBnbWVw5UznKGAFAmekw7oACgkQbWVw5Uzn KGD2iBAAjKUuHKoAgGxMDzgnnx1XYwzqxPT6OIl+uAH27IRTrbgzoPWEVumOoImx eOSlDGE/MuwYZMS0kjGE76zTbaaihzWo8fgWbtPhAKqLsdc5lY3JaaEX4rw+8wbJ DBVvQCyWfFuJTcA3Hk+K1RQdNrvSss9hyJalp+nfWdt05gRF3CHChdnyHYgvP1f/ 44CSMVPx35V14P1rxy6jfOpOQ68Jp9cVQ78eNz2uEQjwGj3L7QpRnRv9e6IdMETK jKN9NwCMSpNmqUYKaf1t+Q6o93DkxkekIO31vgBk1twP9WBey4+YNJ9GDxkXLdzI /G9qxWh4FrOL9CZTNPt1DQf8GqM6rgh3KUo3ZqcFNZa0bDJgmkvkBhSdxGJgVbDL W9T2aHnYIbKXqInzTXGbYaQFw9HEzdoxyRunKP3HNC4A/Rutvq/glKEvNp2V+uI7 oq49vJhDOnjwRlWV3aaa0rFpQ5VkW+1J+XhLJTsSysQK1iQXxRdxP0VxbR3DXz9i ZzIQNdB3AIVNknEk2ELaMeCFM+1vXTdbimCrCiewrtAAlJ+gHEQ4CDtPl3OOAcI/ zPMAJTgax/9l3FDmL9cQMwei5moSvOYaMm7VqoGSOB4vQOr77c+5rkHjO97E/fpF oYkJM6VcDYVTz9Mue2AJ0nX9m08lYeneeBWDdNuyyNvCjkjkOAg=
    =wxmC
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Us
  • From Joe@21:1/5 to Frank McCormick on Thu Feb 6 16:00:01 2025
    On Thu, 6 Feb 2025 08:54:28 -0500
    Frank McCormick <debianlist@videotron.ca> wrote:

    On 2/6/25 8:20 AM, Charles Curley wrote:
    On Thu, 6 Feb 2025 07:53:07 +0000
    Andy Smith <andy@strugglers.net> wrote:

    Having said that, I am not sure how the complaint could be
    addressed since from what I understand you are basically asking
    for otherwise valid but commented-out sources.list lines to be
    converted into inactive deb822 files, which seems like a big
    request.

    Another option would be to retain all comments, and let the user
    manually convert commented out entries. Simple, easy to do, and
    only a little obnoxious for the user.

    And for those who are wondering, this is going on in trixie.


    I did this recently. Seemed to go well except that now when I
    update I get
    this :

    All packages are up to date.
    Notice: Missing Signed-By in the sources.list(5) entry for 'http://deb.debian.org/debian'
    Notice: Missing Signed-By in the sources.list(5) entry for 'https://repo.vivaldi.com/stable/deb'

    There is no suggestion as to what to do when this happens.


    The quick fix in sources.list for debian is to add signed-by into
    existing lines after deb or deb-src:

    deb \
    [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://deb.debian.org/debian/ \
    <software categories>


    The long-term fix is a file standard.sources root:root 644 in /etc/sources.list.d containing:

    Types: deb
    URIs: https://deb.debian.org/debian/
    Suites: unstable
    Components: main contrib non-free non-free-firmware
    Enabled: yes
    Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

    plus a stanza for any other active debian lines in the existing
    sources.list.

    When an update is run, you will be warned of double source
    descriptions. Then you know the new file is OK and can move/rename /etc/sources.list. All should be well.

    You can add other repositories here but it is better to give them their
    own sources.list.d/xxxx.sources files e.g. opera-stable.sources,
    dmo.sources (deb-multimedia.org).

    Note that some upgrades may place/maintain .list files in
    sources.list.d, as was formerly customary. This will again cause the
    double source error, the new file should be checked and if necessary
    any changes ported into the .sources file, then the .list file moved or renamed. If renamed, apt will find it and be rude about it but ignore
    it.

    Non-debian .list files may not contain any signing information, so it
    may be necessary to track down the signing key. There will be one in
    your filesystem somewhere, e.g. the opera key is in
    /etc/apt/trusted.gpg.d and the dmo one with the debian ones in /usr/share/keyrings. Check the Vivaldi website either for the key
    location or there's probably a current key on the site, or if you're
    lucky it might be in with the debian keys.

    Yes, I did all this in sid about a week ago.

    --
    Joe

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Michael Stone@21:1/5 to Charles Curley on Thu Feb 6 16:30:02 2025
    On Thu, Feb 06, 2025 at 08:09:37AM -0700, Charles Curley wrote:
    Is there anything that tells one how to make this conversion? Better
    yet, a script or two to do it for us? There will be a lot of people >scrambling to convert at the last minute.

    Yes, current version prompts on what to do.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Charles Curley@21:1/5 to Joe on Thu Feb 6 16:20:02 2025
    On Thu, 6 Feb 2025 14:51:17 +0000
    Joe <joe@jretrading.com> wrote:

    The long-term fix is a file standard.sources root:root 644 in /etc/sources.list.d containing:

    Is there anything that tells one how to make this conversion? Better
    yet, a script or two to do it for us? There will be a lot of people
    scrambling to convert at the last minute.

    --
    Does anybody read signatures any more?

    https://charlescurley.com
    https://charlescurley.com/blog/

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From The Wanderer@21:1/5 to Charles Curley on Thu Feb 6 16:30:02 2025
    This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
    On 2025-02-06 at 10:09, Charles Curley wrote:

    On Thu, 6 Feb 2025 14:51:17 +0000 Joe <joe@jretrading.com> wrote:

    The long-term fix is a file standard.sources root:root 644 in
    /etc/sources.list.d containing:

    Is there anything that tells one how to make this conversion? Better
    yet, a script or two to do it for us? There will be a lot of people scrambling to convert at the last minute.

    I haven't seen this hit yet (though I probably will next time I
    dist-upgrade against testing), but a comment in bug #1094263 leads me to suspect that there is now supposed to be an 'apt modernize-sources' sub-command, which looks like it might be intended to make this type of conversion.

    ...except that, per the rest of the discussion in that bug, it almost
    certainly won't be able to predict which signer to apply for each
    sources.list entry. That you'll probably have to add on your own.

    --
    The Wanderer

    The reasonable man adapts himself to the world; the unreasonable one
    persists in trying to adapt the world to himself. Therefore all
    progress depends on the unreasonable man. -- George Bernard Shaw


    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEJCOqsZEc2qVC44pUBKk1jTQoMmsFAmek06kACgkQBKk1jTQo MmsVVg//Up+ES2IzUQQ7HKilO41VH/5vBExoa/bN+poCeGhHZ/m7jt5DOcJIh5tr etUPo7E0GbXovH6jCIJFuQ6/0xgY7aymf6Yz5uqpMFj1jwezNGBd27mjGG7MFaj5 hmD0TVsgZxJ1zic/6WPy6+o/NY0m84XXlvgP789H0CAXj14382SkUkIi6gOliJzV ogljNBKxqo521ZtAAZYSHxbpb1rX4tOAYo0q3DG1ucB4+/E9jwex2lPrkD3t0gmD 8Q/+l1i05TiVBr6mLt8C2aEy5VuasGu1J8+FCJ2UCvOgc14Vf+iqEfjH4X+PcpUT uYfhlixHg+MIZ4GAlF8HUp0D4AL4M8DTbauXIqcfNGjsUv5VMKUnTcxPBn1udvxU mskw//PnlwQzD8MLIgH3Gi4IcJ8//BPnXNmTi3PU+imqqwhLoqepsbZwWDbxvAiq oAQIhH+W0H1svgJtWzTlsyIBrEzFrf7tznG1RhAceEeQXXtQn6ehm5vmoHuAQiJB Au3mHLcWXpMUlRmCAH6uQFJ2/avgClMFhYMwaezmITHDTU6rM7DCcTENg4gLRZ+2 amZPih7wJ7iZeqdsbFmmaE+OJ4OYEkbGwPzKuhONYTJ+jQXk3tAR7BGxMMPsR85H v0PVdNywLFhg4XlL7zOkT2YrzH5q
  • From Joe@21:1/5 to Charles Curley on Thu Feb 6 16:40:01 2025
    On Thu, 6 Feb 2025 08:09:37 -0700
    Charles Curley <charlescurley@charlescurley.com> wrote:

    On Thu, 6 Feb 2025 14:51:17 +0000
    Joe <joe@jretrading.com> wrote:

    The long-term fix is a file standard.sources root:root 644 in /etc/sources.list.d containing:

    Is there anything that tells one how to make this conversion? Better
    yet, a script or two to do it for us? There will be a lot of people scrambling to convert at the last minute.


    I did find a script, but it looked complex enough that I just did it by
    hand, I've only got a few repositories. There are various examples of
    the .sources file format, I copied one and adjusted to taste.

    Here's a formal deb822 description:

    https://repolib.readthedocs.io/en/latest/deb822-format.html

    Here's a few more bits:

    https://forum.siduction.org/index.php?topic=9606.0

    This was where I found the script:

    https://unix.stackexchange.com/questions/790122/any-shell-script-to-update-to-the-deb822-sources-format

    What I didn't notice further down the page was:



    Why in the world bother making your own scripts when you can just do

    # apt modernize-sources
    The following files need modernizing:
    - /etc/apt/sources.list.d/google-chrome-beta.list
    - /etc/apt/sources.list.d/google-earth-pro.list
    - /etc/apt/sources.list.d/jidanni.list

    Modernizing will replace .list files with the new .sources format,
    add Signed-By values where they can be determined automatically,
    and save the old files into .list.bak files.

    Sounds scary.

    Fear not.

    For a simulation, respond N in the following prompt.
    Rewrite 3 sources? [Y/n] N
    Simulating only...

    Why didn't you tell us earlier? That would be more productive, you
    know.

    They just added it.




    --
    Joe

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Michael Stone@21:1/5 to The Wanderer on Thu Feb 6 16:50:01 2025
    On Thu, Feb 06, 2025 at 10:22:17AM -0500, The Wanderer wrote:
    I haven't seen this hit yet (though I probably will next time I
    dist-upgrade against testing), but a comment in bug #1094263 leads me to >suspect that there is now supposed to be an 'apt modernize-sources' >sub-command, which looks like it might be intended to make this type of >conversion.

    ...except that, per the rest of the discussion in that bug, it almost >certainly won't be able to predict which signer to apply for each >sources.list entry. That you'll probably have to add on your own.

    It even tells you that!

    # apt modernize-sources
    The following files need modernizing:
    - /etc/apt/sources.list

    Modernizing will replace .list files with the new .sources format,
    add Signed-By values where they can be determined automatically,
    and save the old files into .list.bak files.

    This command supports the 'signed-by' and 'trusted' options. If you
    have specified other options inside [] brackets, please transfer them
    manually to the output files; see sources.list(5) for a mapping.

    For a simulation, respond N in the following prompt.
    Rewrite 1 sources? [Y/n]
    Modernizing /etc/apt/sources.list...
    - Writing /etc/apt/sources.list.d/debian.sources

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From songbird@21:1/5 to Andy Smith on Thu Feb 6 17:00:01 2025
    Andy Smith wrote:
    Hi,

    On Thu, Feb 06, 2025 at 01:51:49AM -0500, songbird wrote:
    when doing the upgrade you do have the option of doing
    a test run to see what changes are made or not making the
    changes at that time.

    when going through this process the comments in
    sources.list were discarded.

    I think this behaviour is unlikely to change unless you report a bug
    about it.

    there are so many bugs filed against apt that something like
    this has about zero chance of being noticed or changed. also i
    just tried to read through the existing bugs to make sure a
    bug report would not be a duplicate and still have a few
    hundred to go and ran out of time and energy for it.

    this post at least warns people that this change is coming
    for people who are upgrading - i have the time and energy for
    doing something that has a chance of helping people now.

    the only sensible short term easy fix would be to warn that
    comments are discarded and that a backup copy is kept if you
    need to get that information back.

    i'm out of time and energy for the next several days so this
    was a quick warning for those who use testing.

    ...
    songbird

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Charles Curley@21:1/5 to Joe on Thu Feb 6 17:00:01 2025
    On Thu, 6 Feb 2025 15:30:02 +0000
    Joe <joe@jretrading.com> wrote:

    Why in the world bother making your own scripts when you can just do

    # apt modernize-sources
    The following files need modernizing:
    - /etc/apt/sources.list.d/google-chrome-beta.list
    - /etc/apt/sources.list.d/google-earth-pro.list
    - /etc/apt/sources.list.d/jidanni.list

    Right. Thank you.

    --
    Does anybody read signatures any more?

    https://charlescurley.com
    https://charlescurley.com/blog/

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Charles Curley@21:1/5 to Michael Stone on Thu Feb 6 17:00:01 2025
    On Thu, 6 Feb 2025 10:42:27 -0500
    Michael Stone <mstone@debian.org> wrote:

    ...except that, per the rest of the discussion in that bug, it almost >certainly won't be able to predict which signer to apply for each >sources.list entry. That you'll probably have to add on your own.

    It even tells you that!

    # apt modernize-sources
    The following files need modernizing:
    - /etc/apt/sources.list

    Yup. Thank you. However, it is not in the man page for apt or apt-get.

    --
    Does anybody read signatures any more?

    https://charlescurley.com
    https://charlescurley.com/blog/

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Charles Curley@21:1/5 to Charles Curley on Thu Feb 6 17:10:02 2025
    On Thu, 6 Feb 2025 08:53:49 -0700
    Charles Curley <charlescurley@charlescurley.com> wrote:

    However, it is not in the man page for apt or apt-get.

    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094784

    --
    Does anybody read signatures any more?

    https://charlescurley.com
    https://charlescurley.com/blog/

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Joe@21:1/5 to Charles Curley on Thu Feb 6 17:20:01 2025
    On Thu, 6 Feb 2025 08:55:41 -0700
    Charles Curley <charlescurley@charlescurley.com> wrote:

    On Thu, 6 Feb 2025 15:30:02 +0000
    Joe <joe@jretrading.com> wrote:

    Why in the world bother making your own scripts when you can just do

    # apt modernize-sources
    The following files need modernizing:
    - /etc/apt/sources.list.d/google-chrome-beta.list
    - /etc/apt/sources.list.d/google-earth-pro.list
    - /etc/apt/sources.list.d/jidanni.list

    Right. Thank you.


    It wasn't actually me who wrote that, it was copied verbatim and I was
    a bit short of time for quoting.

    I wish I had seen it the first time I found that page.

    --
    Joe

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Smith@21:1/5 to Dan Ritter on Thu Feb 6 20:30:01 2025
    Hi,

    On Thu, Feb 06, 2025 at 08:27:54AM -0500, Dan Ritter wrote:
    Charles Curley wrote:
    Another option would be to retain all comments, and let the user
    manually convert commented out entries. Simple, easy to do, and only a little obnoxious for the user.

    And for those who are wondering, this is going on in trixie.

    I would find that vastly more preferable. Discarding comments in
    a conversion is a disservice to the user.

    Seems sensible, but again I would urge someone who cares about this to
    create a bug report so that the people capable of making the change can
    see it's desired.

    Thanks,
    Andy

    --
    https://bitfolk.com/ -- No-nonsense VPS hosting

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From =?UTF-8?Q?J=C3=B6rg-Volker_Peetz?=@21:1/5 to All on Thu Feb 6 20:50:01 2025
    Also, there is https://wiki.debian.org/SourcesList .

    Regards,
    Jörg.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Michael Stone@21:1/5 to Charles Curley on Thu Feb 6 21:00:01 2025
    On Thu, Feb 06, 2025 at 08:53:49AM -0700, Charles Curley wrote:
    On Thu, 6 Feb 2025 10:42:27 -0500
    Michael Stone <mstone@debian.org> wrote:

    ...except that, per the rest of the discussion in that bug, it almost
    certainly won't be able to predict which signer to apply for each
    sources.list entry. That you'll probably have to add on your own.

    It even tells you that!

    # apt modernize-sources
    The following files need modernizing:
    - /etc/apt/sources.list

    Yup. Thank you. However, it is not in the man page for apt or apt-get.

    I don't understand what it is you're looking for. When you figure that
    out, open it as a wishlist bug on apt. (Note that you trimmed all of
    what apt tells you about signed-by...those were not my additions, it's
    what's printed *by the command* as guidance.)

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Frank Guthausen@21:1/5 to Joe on Tue Feb 25 17:00:01 2025
    On Thu, 6 Feb 2025 14:51:17 +0000
    Joe <joe@jretrading.com> wrote:

    On 2/6/25 8:20 AM, Charles Curley wrote:

    And for those who are wondering, this is going on in trixie.

    [...]

    The quick fix in sources.list for debian is to add signed-by into
    existing lines after deb or deb-src:

    deb \
    [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://deb.debian.org/debian/ \ <software categories>


    The long-term fix is a file standard.sources root:root 644 in /etc/sources.list.d containing:

    Types: deb
    URIs: https://deb.debian.org/debian/
    Suites: unstable
    Components: main contrib non-free non-free-firmware
    Enabled: yes
    Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

    [...]

    Non-debian .list files may not contain any signing information, [...]

    Yes, I did all this in sid about a week ago.

    I am still a little confused about the plans regarding Trixie release.

    Is the usage of deb822 data format optional or
    mandatory? AFAICS we are still at an optional
    path. Can this be confirmed?

    Is the explicit keyring data mandatory or optional? And is there a
    difference regarding this question between old an new data format?
    As far as I understand (so far) it will be mandatory starting with
    Trixie release, but maybe I am on the wrong track.

    The reason for my confusion is the debootstrap workflow from Bookworm
    to Trixie. The provided sources.list is old data format without keyring provided inside the sources.list file. This will possibly break after
    the Trixie release, if keyring data is mandatory.
    --
    kind regards
    Frank

    -----BEGIN PGP SIGNATURE-----

    iQGzBAEBCgAdFiEE86z15c6qwvuAkhy+zDIN/uu9BloFAme955EACgkQzDIN/uu9 BlpZ/Av/V3lFHeB/D9RMfrd+R2p7WYxZbAzofws9PI3yKH6Haxln1/xizeQavoE/ 5OU//RrsSHOiyA4tqfxOfkbDamPIJ+1R/FAmWU5WxqgCQZJ9DDG1Z4c7SnuZlI/K 5kcC39ufYdx9xQJT+waXXyKXUiztf0jufM80SS4qh91FM5QyberLl10Qt7KEpbk9 +cjSZYLpiNvWU3YrqWK8cGrwA+9Rwv52DC5grXmRVm89fAO1jpYmN1Rb4OpGpSHK 0DBkNxdsCzqNzXhaahWY8nXs1mjP+ehpAwV+gh69oXgNNHcAYnEGSejXR9vSJwhI QZdTfIOtZwovWn1EkQtDpSoxxPIf7TxoOk1TtBAVFVU+xQ30OpmRwPgTLbRaA8nv E8xYBV1Un/TvnjwZi33aoDL8Jp74d67lRDtYJPzWNX9t4R+9yCiNNkzKLNSXlB5M 15R35dREGFZDbNFa3gX/WDf6RA8VuB5QbBKjV2UsPzTQ2UEmOioWEH/oyGZxy3Jf
    huh9KfRe
    =Z2+9
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)