apt-key is outdated and no longer included in Debian 12 ff.

[amarradi]

The instructions cause an error during installation
sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 2C0D3C0F
sudo: apt-key: command not found

Installing RPi-Monitor on Debian 13 (Trixie) the Secure Way

🧩 Background

Starting with Debian 12 (Bookworm) and continuing in Debian 13 (Trixie),
the classic apt-key command was removed because it trusted all imported
keys system-wide — a major security risk.

The new approach uses dedicated keyrings stored in
/etc/apt/keyrings/ and referenced per repository with
[signed-by=/etc/apt/keyrings/<keyfile>.gpg].

This method isolates each repository’s trust and prevents
malicious or outdated keys from affecting your entire system.

---

🛠️ Step-by-Step Installation (Debian 13 on Raspberry Pi)

1. Install required tools

bash

sudo apt update
sudo apt install -y gnupg dirmngr ca-certificates curl

sudo mkdir -p /etc/apt/keyrings
sudo chmod 755 /etc/apt/keyrings

We create a temporary GPG home to avoid permission problems, then export the key directly into /etc/apt/keyrings/rpimonitor.gpg.

tmpdir="$(mktemp -d)"
gpg --homedir "$tmpdir" --keyserver hkps://keyserver.ubuntu.com \
    --recv-keys 43A579636E330A99A8336C14E4E362DE2C0D3C0F || \
gpg --homedir "$tmpdir" --keyserver hkp://keyserver.ubuntu.com:80 \
    --recv-keys 43A579636E330A99A8336C14E4E362DE2C0D3C0F

Export the key into the keyrings directory

gpg --homedir "$tmpdir" --export 43A579636E330A99A8336C14E4E362DE2C0D3C0F | \
  sudo tee /etc/apt/keyrings/rpimonitor.gpg >/dev/null

rm -rf "$tmpdir"
sudo chmod 644 /etc/apt/keyrings/rpimonitor.gpg

Add the repository

echo "deb [signed-by=/etc/apt/keyrings/rpimonitor.gpg] http://giteduberger.fr rpimonitor/" | \
  sudo tee /etc/apt/sources.list.d/rpimonitor.list

Installation

sudo apt update
sudo apt install rpimonitor

[koira]

thanks a lot, that helped significantly!

[Robyxxx]

good work! Thanks!

[Lusbueb69]

Thank you, it work, i'm very happy!

Four or five weeks ago, I reinstalled my Magic Mirror with Trixie and was so frustrated that I couldn't install RPIMONITOR anymore because apt-key no longer worked. Is it possible for your fix to be listed on the beginner's page?

[rheart]

Doesn't work anymore:

$ sudo apt-get update
[...]
Err:5 https://giteduberger.fr rpimonitor/ InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is:
Signing key on 43A579636E330A99A8336C14E4E362DE2C0D3C0F is not bound:
 No binding signature at time 2019-06-09T20:36:15Z   because:
 Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

[K7pyk3M5AE2X3]

Can the dev push this to the doc page:

https://xavierberger.github.io/RPi-Monitor-docs/11_installation.html

Also to address the last comment, also including updating to the NEW non-sha1 key. The fact you even made a SHA1 keys in the first place, something that has been dead nearly a decade, makes me suspect the security of the rest of this app.

[nuens]

Doesn't work anymore:

$ sudo apt-get update
[...]
Err:5 https://giteduberger.fr rpimonitor/ InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is:
Signing key on 43A579636E330A99A8336C14E4E362DE2C0D3C0F is not bound:
 No binding signature at time 2019-06-09T20:36:15Z   because:
 Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

This solves that issue.

[K7pyk3M5AE2X3]

Not really, that band-aids it. As the article says, what solves it is for the dev to fix that damn problem, i.e. "The 'correct' way of solving this is for the repository provider to update their signing key to something which is compliant.". If you can't trust the dev to do even basic security, why would we trust him with other basic security things like secure coding, bounds checking, etc.

[altontoth]

Considering the code timestamps says that parts of it hasn't been updated in two years, and the very first thing in the Read.me says

"I don't have time to manage update to Rpi-Monitor. The project looks to be used be many people. Some PR need to be reviewed and merged and next version is requiring tests."

Tells me he probably doesn't have time to keep it up to date with the updates and security improvements. You could always fork the code and improve it, or look for a different tool entirely. Just a thought.

Edit to add: also, the last release is from 2017. So there's that.

[K7pyk3M5AE2X3]

Then take the project down if you (dev) doesn't want to support it; unsupported projects are bane of the OSS (and game mod) communities. Also this isn't a "new" problem, SHA1 was been known broken since the late oughts, he never should have made a sha1 key in 2017 either.

[altontoth]

I'm not the dev, I'm just quoting the main page.

And for a lot of people, old code is still useful, even if it's just for tinkering. To immediately delete something because you've moved on (or maybe even died) is doing a massive disservice to the community and is just gatekeeping for no reason at all, especially for people who are willing to put in the time to make it work for their needs, which IS something I've done with abandoned code.

It would be nice if there was a way for the community to flag something as out of date though, for folks that don't want to take the risk.

[XavierBerger]

Then take the project down if you (dev) doesn't want to support it; unsupported projects are bane of the OSS (and game mod) communities.

This comment just shows that you don't understand what OSS is. The program is no more maintained but is still usable. It can be installed manually.

I remind you that nobody paid me for the development of this software. I gave you this soft for free so if it fit your needs, use it. If not, propose an update, fork it and create a new version, pay somebody to do the job for you if you don't have the skills or just don't use it. But please do not complain about it, it is not a constructive approch and it will not make the things been better.

[K7pyk3M5AE2X3]

Case in point. You literally could have fixed the issue in the less time that it took you to write that response but nah, ego my friend. It shows the priority here.

You made a piece of software, you abandoned it, the responsible thing to do would be remove it; especially if you can't be bothered to fix known security flaws with it.

[G3O-CH]

I haven’t found a solution to this key problem either.

Many thanks to Xavier for all the time and money he has invested in this project over the years.

As I couldn’t solve this problem, I looked for a workaround and found one.

1. Delete the entry causing problems with updates using
   sudo rm /etc/apt/sources.list.d/rpimonitor*.
2. Install Cockpit from
   https://cockpit-project.org/
   using sudo apt install cockpit.
3. Create a user without administrative privileges using
   sudo adduser cockpit.

Best regards from Switzerland
Bobby

[XavierBerger]

Cockpit is far different from RPi-Monitor. It comes with a lot of heavy dependencies (Ruby).
If you are looking for something that will not eat a high percentage of your CPU, I'm not sure if that is the best solution.
Maybe glance is a better solution.