W: https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

fix_nvidia_key.md

Fix: apt update NVIDIA Legacy Keyring Warning

Problem

Running apt update produces the following warning:

W: https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/InRelease:
Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the
DEPRECATION section in apt-key(8) for details.

This happens because the NVIDIA CUDA repository GPG key was added to the legacy /etc/apt/trusted.gpg keyring using the deprecated apt-key tool. Modern Debian/Ubuntu versions require per-source keyring files stored in /etc/apt/keyrings/.

---

Steps to Resolve

1. Find the key fingerprint

List keys in the legacy keyring and locate the CUDA/NVIDIA entry:

apt-key list 2>/dev/null | grep -B2 "cudatools"

Example output:

pub   rsa4096 2022-04-14 [SC]
      EB69 3B30 35CD 5710 E231  E123 A4B4 6996 3BF8 63CC
uid           [ unknown] cudatools <cudatools@nvidia.com>

Note the fingerprint (without spaces): EB693B3035CD5710E231E123A4B469963BF863CC

2. Export the key to the modern keyrings directory

mkdir -p /etc/apt/keyrings
apt-key export EB693B3035CD5710E231E123A4B469963BF863CC \
  | gpg --dearmor -o /etc/apt/keyrings/cuda-archive-keyring.gpg

3. Find the CUDA sources list file

grep -rl "nvidia\|cuda" /etc/apt/sources.list.d/ /etc/apt/sources.list

This will typically point to /etc/apt/sources.list.d/cuda.list.

4. Update the sources file to use the new keyring

Open the sources file (e.g. /etc/apt/sources.list.d/cuda.list) and add a signed-by option pointing to the exported key.

Before:

deb https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64 /

After:

deb [signed-by=/etc/apt/keyrings/cuda-archive-keyring.gpg] https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64 /

5. Remove the key from the legacy keyring

apt-key del EB693B3035CD5710E231E123A4B469963BF863CC

6. Verify the fix

apt update

The warning should no longer appear.

---

Notes

• Replace the fingerprint with the one shown by apt-key list on your system if it differs.
• The same approach applies to any other repository triggering the same warning — identify the key fingerprint, export it, update the corresponding sources file with signed-by, and remove it from the legacy keyring.
• The /etc/apt/keyrings/ directory is the recommended location on Ubuntu 22.04+ / Debian 12+. Alternatively, /usr/share/keyrings/ can be used for system-managed keys.