[Bug 52439] apt-key is deprecated (bookworm/Debian)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=52439

--- Comment #6 from Osamu Aoki  ---
Hi,

I didn't realize this DEB822.  Thanks.  I need to update debian-reference
package/web pages.
> apt (2.3.10) unstable; urgency=medium
>
> [ Julian Andres Klode ]
> - basehttp: Turn HaveContent into a TriState
> - Set haveContent to FALSE on `Content-Length: 0` (Closes: #990281)
> - Add support for embedding PGP keys into Signed-By in deb822 sources
>
> ...
>
> -- Julian Andres Klode   Mon, 18 Oct 2021 16:35:21 +0200

Use of deb822 s may be a very good approach only after Debian/12 Bookworm
release expected in late-2023 for the user of Debian stable platform. 
Considering Debian supports stable, oldstable, ... , we may need to wait at
least late-2025 to move to use this deb822 for all use cases.

As updated by a Debian developer on 2021-11-18 :

https://wiki.debian.org/DebianRepository/UseThirdParty?action=diff&rev2=...

we should avoid ASCII-armored files at this moment for some Debian platforms.

So updated suggestion should be:

For users of Debian 12/Bookworm testing distribution, deb822 approach works but
not for users of Debian 11/Bullseye stable distribution..

What I suggested which uses non-ASCII-armored file is more robust fall back
method but not as secure.

...
> > Or create a DEB822 format winehq.sources file in /etc/apt/sources.list.d/
> > '''
> > Types: deb
> > URIs: https://dl.winehq.org/wine-builds/debian/
> > Suites: bookworm
> > Components: main
> > Signed-By: /usr/share/keyrings/winehq-archive-keyring.gpg
> > '''
> >
> > The question is how these steps can be done in a simple, fail-safe, easy and
> > foolproof way.
> >
> > [1] https://wiki.debian.org/DebianRepository/UseThirdParty

This is a wiki page both you and I can update.  At least, it is not written by
apt upstream as a restrictive rule.  So treat this as a nice reference but
don't consider it as a Debian policy.
> I think it would be well worth looking into providing a DEB822 format file for
> each distro that can be downloaded and put into /etc/apt/sources.list.d/
> instead of adding it to the system sources.list file. 
> ...

Looks like it works.  So please update document page by clearly specifying
target audience by being specific distribution.

Osamu