Issues with Ubuntu/Debian Install Instructions

[Stuart-Wilcox]

Following the instructions in the Ubuntu/Debian section of the README.md:

# Install needed packages
sudo apt-get install -y curl debsig-verify

# Download public key signature file
curl -s https://api.github.com/repos/microsoft/git/releases/latest \
| grep -E 'browser_download_url.*msft-git-public.asc' \
| cut -d : -f 2,3 \
| tr -d \" \
| xargs -I 'url' curl -L -o msft-git-public.asc 'url'

# De-armor public key signature file
gpg --output msft-git-public.gpg --dearmor msft-git-public.asc  # --> this step fails because the file never got created in the previous step

> gpg: can't open 'msft-git-public.asc': No such file or directory
> gpg: dearmoring failed: No such file or directory

The root cause seems to be that this command curl -s https://api.github.com/repos/microsoft/git/releases/latest | grep -E 'browser_download_url.*msft-git-public.asc' does not find any matches.

Looking at what the releases endpoint gives, I don't think there's any .asc files available, so perhaps the url is wrong or the behaviour isn't as expected?

> curl -s https://api.github.com/repos/microsoft/git/releases/latest | grep 'browser_download_url'

"browser_download_url": "https://github.com/microsoft/git/releases/download/v2.54.0.vfs.0.2/Git-2.54.0.vfs.0.2-64-bit.exe"
"browser_download_url": "https://github.com/microsoft/git/releases/download/v2.54.0.vfs.0.2/Git-2.54.0.vfs.0.2-arm64.exe"
"browser_download_url": "https://github.com/microsoft/git/releases/download/v2.54.0.vfs.0.2/git-2.54.0.vfs.0.2-universal.dmg"
"browser_download_url": "https://github.com/microsoft/git/releases/download/v2.54.0.vfs.0.2/git-2.54.0.vfs.0.2-universal.pkg"
"browser_download_url": "https://github.com/microsoft/git/releases/download/v2.54.0.vfs.0.2/microsoft-git_2.54.0.vfs.0.2_amd64.deb"
"browser_download_url": "https://github.com/microsoft/git/releases/download/v2.54.0.vfs.0.2/microsoft-git_2.54.0.vfs.0.2_arm64.deb"
"browser_download_url": "https://github.com/microsoft/git/releases/download/v2.54.0.vfs.0.2/PortableGit-2.54.0.vfs.0.2-64-bit.7z.exe"
"browser_download_url": "https://github.com/microsoft/git/releases/download/v2.54.0.vfs.0.2/PortableGit-2.54.0.vfs.0.2-arm64.7z.exe"

What is the correct way to install for Ubuntu/Debian?

[mjcheetham]

We no longer publish the Microsoft GPG public key. The docs need updating to refer to downloading the public key from the official repo: https://learn.microsoft.com/en-us/linux/packages#how-to-use-the-gpg-repository-signing-key

[mjcheetham]

I think we're using the 2025 key.

[Stuart-Wilcox]

Thanks for that insight. If I update the steps to be something like

# Download public key signature file
curl -L -o msft-git-public.asc https://packages.microsoft.com/keys/microsoft-2025.asc

# De-armor public key signature file
gpg --output msft-git-public.gpg --dearmor msft-git-public.asc

# Note that the fingerprint of this key is "B8F12E25441124E1", which you can
# determine by running:
gpg --show-keys msft-git-public.asc | head -n 2 | tail -n 1 | tail -c 17

> EE4D7792F748182B # --> this output does not match the comment above - which one is correct?

Then the fingerprint of the key does not match up to what's in the comment. Which one is correct?