[Bug 1862764] Re: add-apt-repository should use signed-by

[fermulator]

Can confirm all of the above.

https://fostips.com/apt-key-deprecated-right-way-add-repository
https://www.north-47.com/knowledge-base/how-to-securely-install-apps-on-debian-based-linux-distros/

With apt-key being deprecated and a transition to more secure (better)
restriction of repository trust via "signed-by", we definitely need add-
apt-repository to support this ASAP.

After Ubuntu 20.04 apt-key will no longer be present and well before the
next LTS we need tooling/documentation to leverage the new recommended
approach.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to software-properties in Ubuntu.
https://bugs.launchpad.net/bugs/1862764

Title:
  add-apt-repository should use signed-by

Status in software-properties package in Ubuntu:
  Confirmed

Bug description:
  add-apt-repository should use signed-by

  apt sources.list syntax supports limiting which keys are used to sign
  a given repo.

  It would be nice for add-apt-repository to import the key somewhere
  else but trusted.gpg.d and then specify path to it, using the "signed-
  by" field.

  ProblemType: Bug
  DistroRelease: Ubuntu 20.04
  Package: software-properties-common 0.98.6
  ProcVersionSignature: Ubuntu 5.4.0-1002.4-oem 5.4.8
  Uname: Linux 5.4.0-1002-oem x86_64
  NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
  ApportVersion: 2.20.11-0ubuntu16
  Architecture: amd64
  CurrentDesktop: ubuntu:GNOME
  Date: Tue Feb 11 12:01:49 2020
  InstallationDate: Installed on 2016-01-26 (1477 days ago)
  InstallationMedia: Ubuntu-Server 16.04 LTS "Xenial Xerus" - Alpha amd64 (20160125)
  PackageArchitecture: all
  ProcEnviron:
   TERM=xterm-256color
   PATH=(custom, no user)
   XDG_RUNTIME_DIR=<set>
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  SourcePackage: software-properties
  UpgradeStatus: Upgraded to focal on 2019-01-15 (391 days ago)
  modified.conffile..etc.default.apport: [modified]
  mtime.conffile..etc.default.apport: 2020-01-10T16:24:15.968394

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/1862764/+subscriptions