apt-key deprecation

[hwiedPro]

Apt-key is deprecated but still used in autoproj. This might in future lead to an severe issues for workspaces that have to instal osrepos.

https://manpages.ubuntu.com/manpages/jammy/en/man8/apt-key.8.html

autoproj/lib/autoproj/repository_managers/apt.rb

Line 168 in fbbb95d

"apt-key",

Warning from apt:

W: https://repo.url/jammy/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

[chhtz]

If I understand it correctly, it is now recommended to download keys individually to /etc/apt/keyrings/ (the location is just a convention, we could even add an autoproj subfolder and place "our" keys there) and then only sign individual repositories with their key (preventing cross-validation of repositories by keys originally installed for a different repository).

https://askubuntu.com/a/1307181

Ping @doudou @g-arjones @planthaber Any opinions/plans on that already? I could try providing a patch if nobody is already working on that.

[planthaber]

When changing the ppa handling, we could try to also handle this in the same approach:

When a ppa was already added manually, autoproj may create a duplicate entry (dfki-ric/ros2-package_set#14).