following instructions at https://support.torproject.org/apt/tor-deb-repo/ step 3:

  1. Then add the gpg key used to sign the packages by running the following commands at your command prompt
    # wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import

    # gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -

results in

"Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)). E: This command can only be used by root."

could someone update/correct/clarify the instructions?

1 Answer 1


The Debian instructions for the new way to connect to a third-party repository are at https://wiki.debian.org/DebianRepository/UseThirdParty. The new method is as follows.

Download the ASCII armored key over HTTPS, dearmor it if necessary, and store it in /usr/share/keyrings. For Tor, that would look like this:

wget -O- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg

Create the sources.list entry in a new file in /etc/apt/sources.list.d/ named tor.list. The entry should have the signed-by option set, and it should point to a file rather than a fingerprint. For Tor, the file /etc/apt/sources.list.d/tor.list would contain a line:

deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org <DISTRIBUTION> main

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.