[EN] [Solved] How to migrate sources.list entries to deb822?

[eriefisher]

Hello Folks,
Onepiece here.  I made Reply #2 on this tread.
I have an understanding of the theory of what needs to be done to fix this, but I'm still very, very  confused about the actual steps needed to remedy.  There are some highly experienced and highly technical answers in this thread, but I'm hoping someone can "dumb it down" for me to do the fix.  Here is my understanding...please correct me where I'm off track.

The old way of managing “Signed by” is using the standard file that was created during the initial installation.  This now outdated file is called:  /etc/apt/sources.list. 
This file should be DELETED and REPLACED by the new deb822 format-compliant file titled:   /etc/apt/sources.list.d/debian.sources

The contents of the new file, /etc/apt/sources.list.d/debian.sources should contain a short paragraph for EACH of the Notices that indicate a Signed by problem.  In my case these Notices are:

          Notice: Missing Signed-By in the sources.list(5) entry for 'https://deb.debian.org/debian
          Notice: Missing Signed-By in the sources.list(5) entry for 'https://packages.siduction.org/fixes'

So, I should create a new /etc/apt/sources.list.d/debian.sources file that contains these two paragraphs:

Types:      deb
 URIs:       https://deb.debian.org/debian/
 Suites:     unstable
 Components: main contrib non-free non-free-firmware
 Enabled:    yes
 Signed-By:  /usr/share/keyrings/debian-archive-keyring.gpg


Types:      deb
 URIs:       https://packages.siduction.org/fixes
 Suites:     unstable
 Components: main contrib non-free non-free-firmware
 Enabled:    yes
 Signed-By:  /usr/share/keyrings/debian-archive-keyring.gpg

Did I get this right?   Please dumb down any replies so that even a cave man can understand.  Thank you.
.
.

If you run apt update it will tell you if and what the problem is should you make a mistake creating the .sources file. The information is the same as the .list file. just the format has changed.

[hendrikL]

Please, take a look to the signed-by line.

And  for the record, debian and siduction a two different things.

So you need a debian sources and a fixes. sources and a extra sources,

[ruebe99]

no idea were to find your probs. I get on that machine

inxi -r | grep -v "No active apt repos in:"
Repos:
  Active apt repos in: /etc/apt/sources.list.d/aptosid.list
    1: deb [signed-by=/usr/share/aptosid-archive-keyring/aptosid-archive-keyring.gpg] http://aptosid.com/debian/ sid main fix.main
  Active apt repos in: /etc/apt/sources.list.d/archive_uri-http_www_deb-multimedia_org-trixie.list
    1: deb [signed-by=/etc/apt/trusted.gpg.d/deb-multimedia-keyring.gpg] http://www.deb-multimedia.org/ testing non-free main
  Active apt repos in: /etc/apt/sources.list.d/backports.list
    1: deb [signed-by=/usr/share/keyrings/backports-archive-keyring.gpg] http://deb.debian.org/debian/ trixie-backports main contrib
  Active apt repos in: /etc/apt/sources.list.d/codecs.list
    1: deb [signed-by=/usr/share/keyrings/codecs-archive-keyring.gpg] http://ftp.debian.org/debian/ bullseye-backports main non-free
    2: deb [signed-by=/usr/share/keyrings/codecs-archive-keyring.gpg] http://ftp.debian.org/debian/ bookworm-backports main non-free
  Active apt repos in: /etc/apt/sources.list.d/debian.list
    1: deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://httpredir.debian.org/debian/ sid main contrib non-free non-free-firmware
    2: deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://httpredir.debian.org/debian/ testing main contrib non-free non-free-firmware
    3: deb-src [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://httpredir.debian.org/debian/ sid main contrib non-free
  Active apt repos in: /etc/apt/sources.list.d/extra.list
    1: deb [signed-by=/usr/share/siduction-archive-keyring/siduction-archive-keyring.gpg] https://packages.siduction.org/extra unstable main contrib non-free non-free-firmware
  Active apt repos in: /etc/apt/sources.list.d/fixes.list
    1: deb [signed-by=/usr/share/siduction-archive-keyring/siduction-archive-keyring.gpg] https://packages.siduction.org/fixes unstable main contrib non-free non-free-firmware
  Active apt repos in: /etc/apt/sources.list.d/google-chrome.list
    1: deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome-archive-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main
  Active apt repos in: /etc/apt/sources.list.d/openproject.list
    1: deb [signed-by=/usr/share/keyrings/openproject-archive-keyring.gpg] https://dl.packager.io/srv/deb/opf/openproject/stable/12/debian/ 10 main
  Active apt repos in: /etc/apt/sources.list.d/signal-xenial.list
    1: deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt/ xenial main
  Active apt repos in: /etc/apt/sources.list.d/sublime-text.list
    1: deb [signed-by=/usr/share/keyrings/sublime-text-archive-keyring.gpg] https://download.sublimetext.com/ apt/stable/
  Active apt repos in: /etc/apt/sources.list.d/winehq.list
    1: deb [signed-by=/usr/share/keyrings/winehq-archive-keyring.gpg] https://dl.winehq.org/wine-builds/debian/ bullseye main

sorry, but everything works fine for my tiny little installation.
what contradicts the
https://gist.github.com/maxhq/7dadf55064aaadc4d9e5993f89fad7b0
( migrate-apt-keys.sh  )

ruebe99

[onepiece]

Guess its been [Solved]  for everybody but me...   
I still dont get how all these pieces are supposed to fit.

I'll crawl back into my cave till I do a future Siduction re-install. 
At that time hope the details on this deb822 format conversion are automatically carried out at install time.

Best to all.

[hendrikL]

@ruebe66, but I think <foo>.list files will be replaced by <foo>.sources, sooner than later.

And for that reason, I think we should go the right way because in a not so far future you have to change it again.

Do not misunderstand me, it is ok how you solved it, it is right and it will work for a while, but think about it.

And keep in mind, with the deb.822 format you can insert a key directly in the <foo>.sources file, there is more power than in the <one-liner>.list file.

[hendrikL]

Guess its been [Solved]  for everybody but me...   
I still dont get how all these pieces are supposed to fit.

I'll crawl back into my cave till I do a future Siduction re-install. 
At that time hope the details on this deb822 format conversion are automatically carried out at install time.

Best to all.

There is no reason to give up.
(Raffi is still searching for that "One Pice" and didn't gave up)

For our /etc/apt/sources.list.d/extra.list and fixes.list,
You have to change <foo>.list to <foo>.sources.

Code: [Select]

mv extra.list extra.sources
mv fixes.list fixes.sources

open them with an editor of your choice, every step has to be done as root, and change them.

Code: [Select]

nano fixes.sources

Types: deb deb-src
URIs: https://<the.server.you.prefer.ltd>/fixes
Suites: unstable
Components: main
Enabled: yes
Signed-By: /usr/share/siduction-archive-keyring/siduction-archive-keyring.gpg

and for extra.sources

Code: [Select]

Types: deb deb-src
URIs: https://<the.server.you.prefer.ltd>/extra
Suites: unstable
Components: main
Enabled: yes
Signed-By: /usr/share/siduction-archive-keyring/siduction-archive-keyring.gpg


and the debian.sources should contain

Code: [Select]

Types: deb deb-src
URIs: https://deb.debian.org/debian
Suites: unstable
Components: main contrib non-free non-free-firmware
Enabled: yes
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Create this files and insert with copy and paste.

[scholle1]

EN
A small script for siduction users.
It backup the directory /etc/apt/sources.list.d to /etc/apt/sources.list.d-old.
It then converts the existing files into the new deb822 format.
The Signed-By: line only contains an entry for debian or siduction.
For other sources, the user must make the entry themselves.
Tested on a “shine on ...” and a “wintersky” installation.
Save the script with any name in /usr/local/bin/ and make it executable.
Then run it.

DE
Ein kleines Skript für siduction User.
Es sichert das Verzeichnis /etc/apt/sources.list.d nach /etc/apt/sources.list.d-old.
Anschließend wandelt es die vorhandenen Dateien in das neue Format deb822 um.
Die Signed-By: Zeile erhält nur für debian oder siduction einen Eintrag.
Bei anderen Quellen muss der User den Eintrag selbst vornehmen.
Getestet auf einer "shine on ..." und einer "wintersky" Installation.
Das Skript mit beliebigen Namen in /usr/local/bin/ speichern und ausführbar machen.
Dann ausführen.

Code: [Select]

#!/usr/bin/bash

datei=""
zeile=""
quelle="/etc/apt/sources.list.d/"


###################
### Begin funktions

transform () {
zeile=$(sed 's! \+! !g' <<<$zeile)
aktiv=""
if grep -q "^#" <<<$zeile; then
aktiv="no"
werte=($(sed 's!^# \?!!' <<<$zeile))
else
aktiv="yes"
werte=($(cat <<<$zeile))
fi

# Signature file for debian and siduction only.
# Others remain empty.
if $(grep -q debian <<<${werte[1]}); then
signatur="/usr/share/keyrings/debian-archive-keyring.gpg"
elif $(grep -q siduction <<<${werte[1]}); then
signatur="/usr/share/keyrings/siduction-archive-keyring.gpg"
else
signatur=""
fi

echo "Types:      ${werte[0]}" >> "$quelle"$(basename -s list "$datei")sources
echo "URIs:       ${werte[1]}" >> "$quelle"$(basename -s list "$datei")sources
echo "Suites:     ${werte[2]}" >> "$quelle"$(basename -s list "$datei")sources
echo "Components: ${werte[@]:3}" >> "$quelle"$(basename -s list "$datei")sources
echo "Enabled:    $aktiv" >> "$quelle"$(basename -s list "$datei")sources
echo "Signed-By:  $signatur" >> "$quelle"$(basename -s list "$datei")sources
echo "" >> "$quelle"$(basename -s list "$datei")sources

}

### End funktions
#################


# Backup the sources list folder.
mkdir /etc/apt/sources.list.d-old 2>/dev/null
cp -a /etc/apt/sources.list.d/* /etc/apt/sources.list.d-old/


for datei in $(ls "$quelle"); do

while read zeile; do
if [ "X$zeile" = "X" ]; then
echo "" >> "$quelle"$(basename -s list "$datei")sources
else
if $(grep -q "^#\? *deb[ -]\(src \)\?" <<<"$zeile"); then
transform
else
echo "$zeile" >> "$quelle"$(basename -s list "$datei")sources
fi
fi
done <<< $(cat "$quelle$datei")
rm "$quelle$datei"
done
exit 0

[ruebe99]

I agree to the spirit of future - but messages like "read man page apt-secure (7)" are not really transparent/useful for me. or did you try it even once?
my standard reply might be "why the hack I have probs only with debian" - I'm running several machines at home and in fact sid based since decades, And I agree again: security first! - innovation second.
Just fyi : I swapped for reasons given for all important things to opensuse (tumbleweed) - name it production system. and  I have no win installation for given reasons. so I am always badly surprised about "enhancement" causing nothing but trouble and weak information all around.
thanks to all the hints and knowledge I can find here, but nevertheless I am looking for solutions.

[eriefisher]

thanks to all the hints and knowledge I can find here, but nevertheless I am looking for solutions.

The solution has been posted several times. I'm not sure what the issue still is? convert debian.list to debian.sources in the format posted several times here. As well as any other repos you may have. There is also a link to the Debian wiki explaining how and why that I posted earlier.

[ro_sid]

Sorry people, but I do not understand your problems. Both versions .list and .sources work. It is just that apt tries to enforce putting a signed-by entry into the .list "one-liner" file and a Signed-By into the .sources now. Soon it could even insist on it.
Both(!) versions need the full path to the keyring or signature file! [That is a shortcoming, because the filename should suffice and the /usr/share/keyrings and the /etc/keyrings directories, suggested as places for the signature files, should be searched by default for the filenames. As were the "trusted" entries and directories before. But as of today they are not. A pity, making for uneccessary long entries.] And even for Siduction and its .gpg file /usr/share/keyrings is sufficient, as there is a symlink to the actual location there.
By the way, as much as I like the "822"-format, it is actually the older format, dating back to at least "Ham", the "one-liner" being the newer one. So you are actually suggesting to switch from the newer to the older format .
And you may even mix and mingle entries in the one or other form and both will be used by apt (simultaneously). Just put them into the matching directory and give them the according filename extension.

There is nothing new here, just the introduction of "signed" recently, now nagged about, and may be required later on.

[micspabo]

Guess its been [Solved]  for everybody but me...   
I still dont get how all these pieces are supposed to fit.

Just try one step after the other. Count the lines with "Notice:" from "apt update" first.
Then create a debian.sources as in Reply #1 and disable the lines in debian.list.
Execute "apt update" again and count the amount of "Notice:" lines again.
After that read Reply #5 and try that too.

[Achy1lles]

Had some issues with "signed-by" in sources.list. Don't know if someone already found that little skript at github:
 
https://gist.github.com/maxhq/7dadf55064aaadc4d9e5993f89fad7b0

It solved the signed-by things in all *list files.
cheers,
ruebe99

Yeah! I used another variation of the script that is in github and it worked like a charm... Although, it still uses the *list extension format. Here is what a did:

;; migrating apt-keys in /etc/apt/sources.list.d

;; cd /tmp

;;  git clone https://github.com/kstr0k/migrate-apt-keys.git

;;  cd migrate-apt-keys

;;  sudo ./migrate-apt-keys /usr/share/keyrings/ /etc/apt/sources.list.d/*.list

[ro_sid]

Here are examples for the .list format:
One for Siduction, one for Sid:

• deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] https://ftp.halifax.rwth-aachen.de/debian unstable main contrib non-free-firmware non-free
• deb [signed-by=/usr/share/keyrings/siduction-archive-keyring.gpg] https://packages.siduction.org/extra unstable main contrib non-free-firmware non-free

[eriefisher]

Here are examples for the .list format:
One for Siduction, one for Sid:

• deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] https://ftp.halifax.rwth-aachen.de/debian unstable main contrib non-free-firmware non-free
• deb [signed-by=/usr/share/keyrings/siduction-archive-keyring.gpg] https://packages.siduction.org/extra unstable main contrib non-free-firmware non-free

Yes this format works, as it has for some time now. I think, however, that eventually everything will be switched over to the debian.sources format. This is just a guess but I'm sure they didn't come up with something new for no reason other than a second option. I'm putting my money on the debian.sources format.

[ro_sid]

[...]
Yes this format works, as it has for some time now. I think, however, that eventually everything will be switched over to the debian.sources format. This is just a guess but I'm sure they didn't come up with something new for no reason other than a second option. I'm putting my money on the debian.sources format.

I have no problem with these intentions, as deb822 is a very fine format. But it is not(!) new. See my posting above.
(Relatively) New is just the now recommended and later may be required signing of each repository with (just) its own key.
[I believe I went just the other way around some twenty years ago  ]