# HG changeset patch
# User Konstantin Pavlov <thresh@nginx.com>
# Date 1613569180 -10800
# Node ID e4d370d43176013f01bc66ec3e47f9599201e255
# Parent  991cf4287c36c82a539b890c47dd961443d48ff7
Linux packages: removed apt-key usage to import gpg keys on Debian/Ubuntu.

apt-key is deprecated since 2017 and will be removed after Debian 11 and Ubuntu 22.04.

All distributions since at least 2013 support storing trusted keys in
/etc/apt/trusted.gpg.d/ instead, so using it should be safe.

A special workaround is added for Ubuntu 16.04 shipping gnupg 2.1, which is not
compatible with the CLI invocation we use.

diff --git a/xml/en/linux_packages.xml b/xml/en/linux_packages.xml
--- a/xml/en/linux_packages.xml
+++ b/xml/en/linux_packages.xml
@@ -7,7 +7,7 @@
 <article name="nginx: Linux packages"
          link="/en/linux_packages.html"
          lang="en"
-         rev="56">
+         rev="57">
 
 <section name="Supported distributions and versions" id="distributions">
 
@@ -236,23 +236,29 @@ echo -e "Package: *\nPin: origin nginx.o
 </programlisting>
 
 Next, import an official nginx signing key so apt could verify the packages
-authenticity:
+authenticity.
+Fetch the key:
 <programlisting>
-curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add -
+curl -o /tmp/nginx_signing.key https://nginx.org/keys/nginx_signing.key
 </programlisting>
 
-Verify that you now have the proper key:
+Verify that the downloaded file contains the proper key:
 <programlisting>
-sudo apt-key fingerprint ABF5BD827BD9BF62
+gpg --dry-run --quiet --import --import-options import-show /tmp/nginx_signing.key
 </programlisting>
 
 The output should contain the full fingerprint
-<command>573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62</command>
+<command>573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62</command>
 as follows:
 <programlisting>
 pub   rsa2048 2011-08-19 [SC] [expires: 2024-06-14]
-      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
-uid   [ unknown] nginx signing key &lt;signing-key@nginx.com&gt;
+      573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
+uid                      nginx signing key &lt;signing-key@nginx.com&gt;
+</programlisting>
+
+Finally, move the key to apt trusted key storage (note the "asc" file extension change):
+<programlisting>
+sudo mv /tmp/nginx_signing.key /etc/apt/trusted.gpg.d/nginx_signing.asc
 </programlisting>
 
 To install nginx, run the following commands:
@@ -295,23 +301,34 @@ echo -e "Package: *\nPin: origin nginx.o
 </programlisting>
 
 Next, import an official nginx signing key so apt could verify the packages
-authenticity:
+authenticity.
+Fetch the key:
 <programlisting>
-curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add -
+curl -o /tmp/nginx_signing.key https://nginx.org/keys/nginx_signing.key
 </programlisting>
 
-Verify that you now have the proper key:
+Verify that the downloaded file contains the proper key:
 <programlisting>
-sudo apt-key fingerprint ABF5BD827BD9BF62
+gpg --dry-run --quiet --import --import-options show-only /tmp/nginx_signing.key
+</programlisting>
+
+Note: on Ubuntu 16.04, use the following command instead:
+<programlisting>
+gpg --with-fingerprint /tmp/nginx_signing.key
 </programlisting>
 
 The output should contain the full fingerprint
-<command>573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62</command>
+<command>573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62</command>
 as follows:
 <programlisting>
 pub   rsa2048 2011-08-19 [SC] [expires: 2024-06-14]
-      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
-uid   [ unknown] nginx signing key &lt;signing-key@nginx.com&gt;
+      573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
+uid                      nginx signing key &lt;signing-key@nginx.com&gt;
+</programlisting>
+
+Finally, move the key to apt trusted key storage (note the "asc" file extension change):
+<programlisting>
+sudo mv /tmp/nginx_signing.key /etc/apt/trusted.gpg.d/nginx_signing.asc
 </programlisting>
 
 To install nginx, run the following commands:
diff --git a/xml/ru/linux_packages.xml b/xml/ru/linux_packages.xml
--- a/xml/ru/linux_packages.xml
+++ b/xml/ru/linux_packages.xml
@@ -7,7 +7,7 @@
 <article name="nginx: пакеты для Linux"
          link="/ru/linux_packages.html"
          lang="ru"
-         rev="56">
+         rev="57">
 
 <section name="Поддерживаемые дистрибутивы и версии" id="distributions">
 
@@ -235,22 +235,29 @@ echo -e "Package: *\nPin: origin nginx.o
 </programlisting>
 
 Теперь нужно импортировать официальный ключ,
-используемый apt для проверки подлинности пакетов:
+используемый apt для проверки подлинности пакетов.
+Скачайте ключ:
 <programlisting>
-curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add -
+curl -o /tmp/nginx_signing.key https://nginx.org/keys/nginx_signing.key
 </programlisting>
 
-Проверьте, верный ли ключ был импортирован:
+Проверьте, верный ли ключ был загружен:
 <programlisting>
-sudo apt-key fingerprint ABF5BD827BD9BF62
+gpg --dry-run --quiet --import --import-options import-show /tmp/nginx_signing.key
 </programlisting>
 
 Вывод команды должен содержать полный отпечаток ключа
-<command>573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62</command>:
+<command>573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62</command>:
 <programlisting>
 pub   rsa2048 2011-08-19 [SC] [expires: 2024-06-14]
-      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
 uid   [ unknown] nginx signing key &lt;signing-key@nginx.com&gt;
+      573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
+uid                      nginx signing key &lt;signing-key@nginx.com&gt;
+</programlisting>
+
+Переместите ключ в каталог доверенных ключей apt (обратите внимание на изменение расширения "asc"):
+<programlisting>
+sudo mv /tmp/nginx_signing.key /etc/apt/trusted.gpg.d/nginx_signing.asc
 </programlisting>
 
 Чтобы установить nginx, выполните следующие команды:
@@ -292,23 +299,35 @@ echo -e "Package: *\nPin: origin nginx.o
     | sudo tee /etc/apt/preferences.d/99nginx
 </programlisting>
 
-Теперь нужно импортировать официальный ключ, используемый apt для проверки
-подлинности пакетов:
+Теперь нужно импортировать официальный ключ,
+используемый apt для проверки подлинности пакетов.
+Скачайте ключ:
 <programlisting>
-curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add -
+curl -o /tmp/nginx_signing.key https://nginx.org/keys/nginx_signing.key
 </programlisting>
 
-Проверьте, верный ли ключ был импортирован:
+Проверьте, верный ли ключ был загружен:
 <programlisting>
-sudo apt-key fingerprint ABF5BD827BD9BF62
+gpg --dry-run --quiet --import --import-options import-show /tmp/nginx_signing.key
+</programlisting>
+
+На Ubuntu 16.04, выполните следующую команду вместо предыдущей:
+<programlisting>
+gpg --with-fingerprint /tmp/nginx_signing.key
 </programlisting>
 
 Вывод команды должен содержать полный отпечаток ключа
-<command>573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62</command>:
+<command>573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62</command>:
 <programlisting>
 pub   rsa2048 2011-08-19 [SC] [expires: 2024-06-14]
-      573B FD6B 3D8F BC64 1079  A6AB ABF5 BD82 7BD9 BF62
 uid   [ unknown] nginx signing key &lt;signing-key@nginx.com&gt;
+      573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
+uid                      nginx signing key &lt;signing-key@nginx.com&gt;
+</programlisting>
+
+Переместите ключ в каталог доверенных ключей apt (обратите внимание на изменение расширения "asc"):
+<programlisting>
+sudo mv /tmp/nginx_signing.key /etc/apt/trusted.gpg.d/nginx_signing.asc
 </programlisting>
 
 Чтобы установить nginx, выполните следующие команды: