For YUM (RHEL) I can specify repository with HTTPS link to key file, like /etc/yum.repo.d/elastic-7.x.repo
:
[elastic-7.x]
baseurl = https://artifacts.elastic.co/packages/7.x/yum
gpgcheck = 1
gpgkey = https://artifacts.elastic.co/GPG-KEY-elasticsearch
name = Elasticsearch repository for 7.x packages
In case of Debian I have to download a key file first:
sudo curl -o /usr/share/keyrings/elastic.asc https://artifacts.elastic.co/GPG-KEY-elasticsearch
and than register that file by the attribute signed-by
:
deb [signed-by=/usr/share/keyrings/elastic.asc arch=amd64] https://artifacts.elastic.co/packages/7.x/apt stable main
Can I specify the signing key by HTTPS URL?
This way I avoid updating keys when they rot.