I looked at another similar question about adding third-party repos. I am trying to add a third-party desktop IM client called riot . While the site gives link to the third-party it gives no instructions as how to add third-party sources or keyring in Debian. I went through https://riot.im/packages/debian/pool/main/ and made the following additions in my /etc/apt/sources.list -

######## Third party repos #######
deb https://riot.im/packages/debian/ stretch main

Now I have two questions :-

a. Is the third-party repo. I have entered is correct or should I ask for more information from upstream.

b. How do I add the secure key as all packages are usually signed in the Debian Universe. The public key is given at https://riot.im/packages/debian/repo-key.asc

I am on Debian stretch/testing.

  • 2
    There is a clear explanation on how to do it safely here
    – user202754
    May 18, 2021 at 3:54

2 Answers 2


You must NEVER install any 3rd party key with apt-key add, as suggested in other posts, because it would cause the system to accept signatures from the third-party keyholder on all other repositories configured on the system. You should set up the repository and install the key as follows:

  1. Create directory for manually installed OpenPGP keys:

    $ sudo mkdir /usr/local/share/keyrings
  2. Download the key into the directory.

    Since your key’s extension is .asc, it is probably "ascii-armored" (you can check this by downloading they key and opening it in a text editor: if it starts with something like


    then it is armored; if it looks like a set of some binary data, then it is not armored and you can use it as it is):

    • for an armored key:

      $ curl https://riot.im/packages/debian/repo-key.asc | gpg --dearmor | sudo dd of=/usr/local/share/keyrings/riot-archive-keyring.gpg
    • If the key is not armored, then use this command instead:

      $ sudo wget -O /usr/local/share/keyrings/riot-archive-keyring.gpg https://riot.im/packages/debian/repo-key.asc
  3. Add the desired 3rd party repository into the list of sources (pay attention to the signed-by option, it tells APT that the repo is signed with the specific key):

    • It is recommended to use the new deb822 multiline format for sources now. So create new .sources file with the respective content below:

      $ sudoedit /etc/apt/sources.list.d/riot.sources
      Types: deb
      URIs: https://riot.im/packages/debian/
      Suites: stretch
      Components: main
      Signed-By: /usr/local/share/keyrings/riot-archive-keyring.gpg
    • Or if you prefer the legacy style (one line per source), use this command instead::

      $ echo "deb [signed-by=/usr/local/share/keyrings/riot-archive-keyring.gpg] https://riot.im/packages/debian/ stretch main" | sudo tee -a /etc/apt/sources.list.d/riot.list
  4. Restrict the 3rd party repository to some specific software package only. Create preference control file for APT:

    $ sudoedit /etc/apt/preferences.d/riot.pref
  5. Put the following content into the file (if necessary, you can append the package name with asterisk (*) as a wildcard or list multiple package names separated by space ():

    Package: *
    Pin: origin riot.im
    Pin-Priority: 1
    Package: riot-web
    Pin: origin riot.im
    Pin-Priority: 500

You can find official information from Debian here: https://wiki.debian.org/DebianRepository/UseThirdParty

  • 4
    Is there a sensible way to do this automatically, because it would be a massive annoyance to do it laboriously like this every time we add a 3rd-party repository. Only two out of 18 of the 3rd party repos I'm using have done it in this more secure way. Also, we need a script to undo the damage for the repos that have already been added, and put the keys where they should be. I guess I'm going to have to roll up my sleeves and write that script, eh? May 24, 2021 at 16:32
  • @SamWatkins: 1. This is a custom sysadmin operation. it cannot be automated, because no two people ever want the same thing from such automation. 2. What do you mean with repos doing it in this way? Repos don't install keys, .deb packages can. If this is what you wander about, then you can check this (unanswered) question. 3. The benefit of the open-source SW is that you can propose new things, especially if you contribute with your own code. Try to propose your script to a SW, you think it fits to.
    – Trudy
    Jul 11, 2021 at 18:31
  • This answer leads to a false sense of security. "You must NEVER install any 3rd party key" appears to imply that the proposed solution removes risks when using an untrusted archive. It does not. You still have to trust the archive not to contain malicious code.
    – Federico
    Aug 2, 2021 at 13:32
  • 2
    @Frederico, it depends on what attack vector you are concerned of. If you don't trust this specific package in this specific repo, then you are better not to install it at all. "You must NEVER install any 3rd party key" implies that you shall not expose your system more than needed. The answer definitely doesn't (and cannot) ensure 360 degrees security on your system, and it doesn't imply so.
    – Trudy
    Aug 3, 2021 at 6:56
  • 3
    The [signed-by] option limits the damage when a repo's keys are compromised; the key cannot be used to forge packages unrelated to the repo and limits the damage done. Installing a key in the global keyring means that any packages signed by that key are trusted, even though it makes no sense for that to happen.
    – Nelson
    Nov 11, 2021 at 9:55

To add the key run:

wget https://riot.im/packages/debian/repo-key.asc
sudo apt-key add repo-key.asc

The third-party repo is correct and compatible with the general format posted on debian wiki:

The entries in this file normally follow this format:

deb http://site.example.com/debian distribution component1 component2 component3
  • 2
    apt-key is deprecated and will last work in Debian 11. Aug 19, 2022 at 8:50
  • @MartinSchröder Od course.
    – GAD3R
    Aug 24, 2022 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .