Warning from 'apt update' in Raspberry Pi OS Bookworm 32-bit

[reraikes]

root@raspberrypi:~# apt update
Hit:1 http://archive.raspberrypi.com/debian bookworm InRelease
Hit:2 http://raspbian.raspberrypi.com/raspbian bookworm InRelease
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
W: http://raspbian.raspberrypi.com/raspbian/dists/bookworm/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

[MichaIng]

ln -s /usr/share/keyrings/raspbian-archive-keyring.gpg /etc/apt/trusted.gpg.d/raspbian-archive-keyring.gpg
rm /etc/apt/trusted.gpg
apt update

[WLBI]

The fix works great, thanks!

ln -s /usr/share/keyrings/raspbian-archive-keyring.gpg /etc/apt/trusted.gpg.d/raspbian-archive-keyring.gpg
rm /etc/apt/trusted.gpg

[XECDesign]

Closing since the issue is with the Raspbian repo. https://bugs.launchpad.net/raspbian

[MichaIng]

There is already a related bug report from 2020, as apt-key has been deprecated much earlier. I'll refresh it, since now a 2nd warning appeared: https://bugs.launchpad.net/raspbian/+bug/1727874

However, AFAIK, Raspbian maintainers are volunteers, hence it might not be solved quickly, and it would be better to contribute the fix directly. Does anyone know whether Raspbian's own package code is hosted somewhere publicly?

The issue is in raspbian-archive-keyring's postinst maintainer script:

#! /bin/sh
# postinst script for raspbian-archive-keyring

set -e

case "$1" in
    configure)
        apt-key add /usr/share/keyrings/raspbian-archive-keyring.gpg > /dev/null
    ;;

    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.

#DEBHELPER#

exit 0

apt-key add is deprecated, and stores the key in the now additionally deprecated /etc/apt/trusted.gpg. The command could replaced with above symlink generation instead, or the package could ship /etc/apt/trusted.gpg.d/raspbian-archive-keyring.gpg directly, which is how debian-archive-keyring does it, though in ASCII-armored format since Bookworm.