#1125311 apt update fails when repository key has lines terminated by CR-LF

Package:
apt
Source:
apt
Description:
commandline package manager
Submitter:
Alex Cernat
Date:
2026-01-12 12:04:02 UTC
Severity:
normal
#1125311#5
Date:
2026-01-12 11:55:37 UTC
From:
To:
APT on Debian 10/11/12, maybe even 13
apt versions: 2.6.1 (deb 12), 2.2.4 (deb 11), 1.8.2.3 (deb 10) - latest official package each

When a 3rd party repository key file in ascii armored format has lines terminated by CR-LF, the apt update command fails to recognize the key.

Example:

https://downloads.linux.hpe.com/SDR/hpePublicKey2048_key1.pub

Error on apt update:

The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C208ADDE26C2B797

Just by removing the CR characters from that file makes everything ok.

Of course that the key file can be stripped of carriage returns or gpg de-armored, but (at least for me) this behavior seems totaly irrational (it's a text line, indeed terminated windows-style)

This is the .sources file:

X-Repolib-Name: HPE Management Component Pack
Enabled: yes
Types: deb
URIs: https://downloads.linux.hpe.com/SDR/repo/mcp/
Suites: bookworm/current
Components: non-free
Architectures: amd64
Signed-By: /etc/apt/keyrings/hpe-sdr.asc
Enabled: yes

Regards,
Alex