Repository navigation
Use new deb822 sources format in apt setup instructions #10495
Description
What happened?
Hi everyone, first of all, thank you for this wonderful product that is Syncthing 🙂
I am running Debian testing "forky" and upon running sudo apt update it was warning me that the PGP key for Syncthing would expire in 1 year. So I thought that maybe my install was obsolete and I decided to update Syncthing properly, following your instructions in https://apt.syncthing.net/ .
Upon trying, it seems like these instructions were obsolete as I saw many differences with my Debian system.
1 - Location of PGP keys
The guide says that keyrings should be stored in : /etc/apt/keyrings/
But from what I see on my system they should be stored in : /usr/share/keyrings
2 - Format of the files inside /etc/apt/sources.list.d/
The guide creates the file /etc/apt/sources.list.d/syncthing.list, and that works, sudo apt update shows no errors. ✔️
However, is the format .list going to be deprecated soon ? Because a file named syncthing.sources was already in this folder and this is its contents :
Types: deb
URIs: https://apt.syncthing.net/
Suites: syncthing
Components: stable
Signed-By: /usr/share/keyrings/syncthing-archive-keyring.gpg
I assume that Debian automatically transformed the previous .list file into this new .sources file when I last upgraded my system. Strange stuff 🤷♂️
Thank you for reading me.
Any questions or anything you want me to test, don't hesitate to ask. Thanks 👋
Syncthing version
v1.30.0
Platform & operating system
Linux (64-bit Intel/AMD) - Debian Testing "forky"
Browser version
No response
Activity
PrSunflower commentedon Dec 16, 2025
Also, I was right to think that my Syncthing needed an update :
calmh commentedon Dec 16, 2025
IIRC this is just the difference between where the systems stores its keyrings and where third party providers, e.g. us, should store them.
As for the sources format I don't know, I'll defer to someone who knows Debian packaging better.
dns2utf8 commentedon Apr 14, 2026
There is a new format for the apt repo and one need to download the new key if this error appears:
Error: https://apt.syncthing.net syncthing InRelease Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key FBA2E162F2F44657B38F0309E5665F9BD5970C47, which is needed to verify signature. Signing key on 37C84554E7E0A261E4F76E1ED26E6ED000654A3E is not bound: No binding signature at time 2026-04-14T01:40:55Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00ZFix with
sudo rm {old_key} sudo curl -L -o /usr/share/keyrings/syncthing-archive-keyring.gpg https://syncthing.net/release-key.gpg printf "Types: deb\nURIs: https://apt.syncthing.net/\nSuites: syncthing\nComponents: stable\nSigned-By: /usr/share/keyrings/syncthing-archive-keyring.gpg\n" | sudo tee /etc/apt/sources.list.d/syncthing.sourcesbugith commentedon Apr 28, 2026
In the case
/etc/apt/sources.list.d/syncthing.listalready exists, shouldn't we add the following just below this ?This would also remove any existing
syncthing.list.save,syncthing.list.distUpgrade,syncthing.sources.saveand eventually brokensyncthing.sourceswe could find in Ubuntu.bugith commentedon Apr 28, 2026
/etc/apt/keyringsseems the right place as syncthing key is handled manually (sudo curl...):man sources.list
...The recommended locations for keyrings are /usr/share/keyrings for keyrings managed by packages, and
/etc/apt/keyrings for keyrings managed by the system operator...
man apt-key
... /etc/apt/keyrings/
Place to store additional keyrings to be used with Signed-By...
bugith commentedon May 10, 2026
Also
man sources.list advises new files should use
The suggested filename for new systems is /etc/apt/sources.list.d/vendor.sources...in deb822-style formatthat is for stable-v2:sudo mkdir -p /etc/apt/keyringssudo curl -L -o /etc/apt/keyrings/syncthing-archive-keyring.gpg https://syncthing.net/release-key.gpgecho -e "Types: deb\nURIs: https://apt.syncthing.net/\nSuites: syncthing\nComponents: stable-v2\nSigned-By: /etc/apt/keyrings/syncthing-archive-keyring.gpg\nEnabled: yes\n" | sudo tee /etc/apt/sources.list.d/syncthing.sourcessudo apt-get updatesudo apt-get install syncthingor candidate:
sudo mkdir -p /etc/apt/keyringssudo curl -L -o /etc/apt/keyrings/syncthing-archive-keyring.gpg https://syncthing.net/release-key.gpgecho -e "Types: deb\nURIs: https://apt.syncthing.net/\nSuites: syncthing\nComponents: candidate\nSigned-By: /etc/apt/keyrings/syncthing-archive-keyring.gpg\nEnabled: yes\n" | sudo tee /etc/apt/sources.list.d/syncthing.sourcessudo apt-get updatesudo apt-get install syncthingor with printf for stable-v2:
sudo mkdir -p /etc/apt/keyringssudo curl -L -o /etc/apt/keyrings/syncthing-archive-keyring.gpg https://syncthing.net/release-key.gpgprintf "Types: deb\nURIs: https://apt.syncthing.net/\nSuites: syncthing\nComponents: stable-v2\nSigned-By: /etc/apt/keyrings/syncthing-archive-keyring.gpg\nEnabled: yes\n" | sudo tee /etc/apt/sources.list.d/syncthing.sourcessudo apt-get updatesudo apt-get install syncthingor candidate:
sudo mkdir -p /etc/apt/keyringssudo curl -L -o /etc/apt/keyrings/syncthing-archive-keyring.gpg https://syncthing.net/release-key.gpgprintf "Types: deb\nURIs: https://apt.syncthing.net/\nSuites: syncthing\nComponents: candidate\nSigned-By: /etc/apt/keyrings/syncthing-archive-keyring.gpg\nEnabled: yes\n" | sudo tee /etc/apt/sources.list.d/syncthing.sourcessudo apt-get updatesudo apt-get install syncthingdhs-rec commentedon Jun 26, 2026
Adding to @bugith's comment above: The details can also be found here. The relevant paragraph is:
If future updates to the certificate will be managed by an apt/dpkg package as recommended below, then it SHOULD be downloaded into /usr/share/keyrings using the same filename that will be provided by the package. If it will be managed locally , it SHOULD be downloaded into /etc/apt/keyrings instead.This is unrelated to Debian packaging. It's how Debian package repositories are defined on the end user's system. The
deb822format was already introduced a decade or so ago and Debian 13/Ubuntu 24.04 now made it the default.[-]Instructions seem to be obsolete for APT installation[/-][+]Use new deb822 sources format in apt setup instructions[/+]imsodin commentedon Jun 26, 2026
Anyone who wants to see the new sources file format used in syncthings apt instructions can send a PR - they live here: https://github.com/syncthing/apt-web/blob/main/site/index.html
Changed it to a feature request as the old format still works (and given this is apt, I doubt that's going to change any time soon).
dhs-rec commentedon Jun 26, 2026
@PrSunflower,
Don't know. Given that the "new" format has already been introduced many years ago, it may as well be that the old format is going to be deprecated in another decade...
No, not strange. This is exactly what happens if you update to a Debian version that ships
apt>= 3.x. If I remember right, this is already true for Trixie.