Support Debian Trixie

[WilliamDEdwards]

Err:12 https://packages.microsoft.com/debian/13/prod trixie InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EE4D7792F748182B
Reading package lists... Done
...
W: GPG error: https://packages.microsoft.com/debian/13/prod trixie InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EE4D7792F748182B
E: The repository 'https://packages.microsoft.com/debian/13/prod trixie InRelease' is not signed.

Key on https://learn.microsoft.com/en-us/linux/packages#how-to-use-the-gpg-repository-signing-key has a different ID.

[mbearup]

William David Edwards (@WilliamDEdwards) thank you for pointing out that documentation, we'll ensure it gets updated.
In 2025 we introduced new signing keys to align with evolving guidance around repo security.
Recommend using the configuration packages, as they will always have the correct key (installed in the correct place) for a given repo.
https://packages.microsoft.com/config/debian/13/packages-microsoft-prod.deb

[WilliamDEdwards]

Hi Matt Bearup (@mbearup),

Thanks for the quick reply.

1. The documented GPG key did sign the Bookworm packages, so are you saying Trixie packages and up are signed only with a new key?
2. Using configuration packages is extremely impractical for users using configuration management systems.
3. I see usr/share/doc/packages-microsoft-prod/microsoft-prod.gpg inside that package. Is that key available from a (preferably documented) URL?

[mbearup]

William David Edwards (@WilliamDEdwards)
For #1, yes. We have safeguards to ensure the packages and indexes in a given repo are signed with the same key.
For #3, the key is located at https://packages.microsoft.com/keys/microsoft-2025.asc . It is referenced in our docs and our README. Introduction of the new key was also advertised in this GitHub repo.
For #2, the intent is to ensure the .list file and matching key are coupled together. You can always extract the config package contents and include those in your CMS. Or use the key linked above and the .list file. Different teams have different requirements. If there's an alternative that would work better, let us know.

[WilliamDEdwards]

Matt Bearup (@mbearup)

It looks like the keys are being conflated. It is correct that the '2025' key is mentioned in the docs, but only under "How to create snapshots" - but under "How to use the GPG Repository Signing Key", the old(?) key is mentioned.

Where you link to 'this GitHub repo', the old key is actually mentioned. 'microsoft-2025' does not appear on that page.

That said, the '.list' file you mention is an outdated construct. deb822 (aka '.sources') is the new way to go.

[daviddavis]

The list file should still work in trixie but I agree that we should start supporting deb822.

[lashtear]

It looks like the bookworm version of the repo (12) uses the old key, and the trixie version (13) needs the new one. If you want both sets of packages enabled so that you can mix and match, you may want something like:

/etc/apt/sources.list.d/microsoft-prod.sources:

Types: deb
URIs: https://packages.microsoft.com/debian/13/prod/
Suites: trixie
Components: main
Signed-By: /usr/share/keyrings/microsoft-prod.gpg
Architectures: amd64

Types: deb
URIs: https://packages.microsoft.com/debian/12/prod/
Suites: bookworm
Components: main
Signed-By: /usr/share/keyrings/microsoft.gpg
Architectures: amd64

(adjust Architectures as needed, most users don't need them all)

Where /usr/share/keyrings/microsoft-prod.gpg is the microsoft-2025 key described above:

pub   rsa4096 2023-11-15 [SC]
      AA86F75E427A19DD33346403EE4D7792F748182B
uid           Microsoft Corporation - General GPG Signer <gpgsign@microsoft.com>

and the microsoft.gpg key is the older

pub   rsa2048 2015-10-28 [SC]
      BC528686B50D79E339D3721CEB3E94ADBE1229CF
uid           Microsoft (Release signing) <gpgsecurity@microsoft.com>

When using the new deb822 format, you'll want to squash the .list files supplied by the packages-microsoft-prod.deb so that you don't get duplicated (and incorrect) entries, e.g. sudo tee /etc/apt/sources.list.d/microsoft-prod.list </dev/null.

(not part of the project, take this advice with a grain of salt)

[WilliamDEdwards]

Hi Emily Backes (@lashtear), I have found all this to be correct earlier. Remaining issue is that the documentation is ambiguous and scattered.

[mbearup]

William David Edwards (@WilliamDEdwards) just an update on the documentation.

• A Pull request was merged to update the "learn.microsoft.com" docs. It should be live in the next ~24 hours.
• I've also updated the docs in this repo to explain the old and new signing keys.
  Let us know if you have any other concerns on this issue.

[mbearup]

Updated docs are live.