[vbox-dev] apt-key is deprecated - please update install page accordingly

[Arnaldo Pirrone]

Hello Klaus,

I didn't get the message in my mailbox, that's odd,

Well, I started experiencing this after upgrading debian a few days ago, 
many messages like this are getting printed on the terminal every time I 
launch "apt update"

> W: 
> https://download.virtualbox.org/virtualbox/debian/dists/stretch/InRelease: 
> Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), 
> see the DEPRECATION section in apt-key(8) for details.

This has been introduced in apt 2.4.0 and you can find more info here,

> http://metadata.ftp-master.debian.org/changelogs/main/a/apt/unstable_changelog

but apt-key has already been deprecated in apt 2.1.8 (almost 2 years 
ago) and it's scheduled for removal on Q2/2022. (see the entry for apt 
2.1.8 in the above changelog)

Honestly I think that copying the key and manually editing the 
repository files are extra steps that may puzzle novice users, but 
that's the only way to ensure that repository contents are verified, and 
that each key is used to verify only packages that are in the owner's 
repository, and not in others, unlike it could happen now with a single 
trusted.gpg keyring file. That's the reason why it has been deprecated.
You can also check here for further explanation:

> https://askubuntu.com/a/1307181

I just hope that the debian community is going to agree on a standard 
path where to place the keys, I see that many users are choosing 
/usr/local/share/keyrings because the /usr/local is for files that are 
not installed by packages, other than being system-wide.

I checked the Virtualbox signing key and noticed that 
oracle_vbox_2016.asc is the longest one, and made with a newer version 
of GnuPG. Perhaps you were thinking the opposite? I'm using just that 
with the new method and apt shows no error.
So it could eventually be moved together with the old information to a 
different page as you mentioned.

Thanks for your attention,

Arnaldo Pirrone