Adding a third-party APT repository the current way: deb822 .sources files and Signed-By keyrings

Goal

Add a third-party APT repository on Debian 12/13 or Ubuntu 22.04/24.04 without using the deprecated system-wide trusted keyring, and verify the signing key before trusting it.

Prerequisites

The vendor's public signing key (a fingerprint you can check out-of-band) and its repository URL/suite name; gnupg installed to dearmor the key.

Steps

1. Create the keyring directory if absent: install -d -m 0755 /etc/apt/keyrings.
2. Fetch and convert the vendor's key to binary form, never adding it to the old system trust store: curl -fsSL https://example.org/apt/key.asc | gpg --dearmor -o /etc/apt/keyrings/example.gpg.
3. Before trusting it, print the fingerprint and compare it against the value published by the vendor through a separate channel: gpg --show-keys --with-fingerprint /etc/apt/keyrings/example.gpg.
4. Write the repository definition. The modern deb822 form goes in /etc/apt/sources.list.d/example.sources (the .sources extension selects this format; sources.list(5) documents both "one line style" and multiline "deb822 style" stanzas):

   Types: deb
   URIs: https://example.org/apt
   Suites: stable
   Components: main
   Signed-By: /etc/apt/keyrings/example.gpg
   

   The classic one-line equivalent in a .list file is deb [signed-by=/etc/apt/keyrings/example.gpg] https://example.org/apt stable main.
5. Do not use apt-key add: the apt-key manual page states its use "is deprecated, except for the use of apt-key del in maintainer scripts", and recommends placing a keyring directly under a keyrings/trusted.gpg.d directory instead, which is exactly what steps 1–4 do.
6. Refresh and verify: apt-get update should mention the new source with no "NO_PUBKEY" warning, then apt-cache policy <a package from that repo> should list it as a candidate.

Expected result

apt-get update succeeds without a missing-key warning, and the package is installable from the new source; apt-cache policy shows the pinned origin.

Limits and test basis

Signed-By scopes trust to exactly that repository line, unlike the old global trusted keyring; if several .sources/.list files reference the same key file, removing the key breaks all of them at once. To undo, delete the .sources/.list file and the keyring file, then run apt-get update again — no reboot needed.