Date: Fri, 12 Apr 2024 10:43:52 +0000
To: postgre <pgsql-general@lists.postgresql.org>
From: Laura Smith <n5d9xq3ti233xiyif2vp@protonmail.ch>
Subject: Obsolete Linux downloads (Debian) instructions
Message-ID: <t302wUcbygPnZ0Kg1Kbxbe9K6iKcK47rpXQhZvOwBPJ1jn-qTOG4V2bFIIrr7bSXtvjC8vCSPLsvkBNSVqM2pU8I5xyWc86DOkGf17AxXK4=@protonmail.ch>
Feedback-ID: 9341368:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/t302wUcbygPnZ0Kg1Kbxbe9K6iKcK47rpXQhZvOwBPJ1jn-qTOG4V2bFIIrr7bSXtvjC8vCSPLsvkBNSVqM2pU8I5xyWc86DOkGf17AxXK4%3D%40protonmail.ch>
Precedence: bulk

Hi

Who do I have to badger to get the obsolete and frankly dangerous Debian re=
po instructions fixed @ https://www.postgresql.org/download/linux/debian/=
=C2=A0?=C2=A0

The manner proposed is really "not the done thing" in 2024 and it has been =
explicitly obsoleted by Debian so the project really should not be promotin=
g it as a supported manner to do things.

TL;DR: You should not be using blindly trusting keys for all repos (which i=
s what=C2=A0apt-key add does).=C2=A0 See :=C2=A0https://wiki.debian.org/Deb=
ianRepository/UseThirdParty


Something like this is the way it should be done:


# Install GPG Certcurl -fsSL "https://www.postgresql.org/media/keys/ACCC4CF=
8.asc" \
=C2=A0 =C2=A0 | gpg --dearmor \
=C2=A0 =C2=A0 | sudo sponge /etc/apt/keyrings/postgresql.gpg
#=C2=A0Create source list file
. /etc/os-release
echo "deb [signed-by=3D/etc/apt/keyrings/postgresql.gpg] https://apt.postgr=
esql.org/pub/repos/apt ${VERSION_CODENAME}-pgdg main" \
=C2=A0 =C2=A0 | doas sponge /etc/apt/sources.list.d/postgresql.list
## Install
doas apt-get update && apt-get -y install postgresql