Repositories and Keys

APT reads its sources from /etc/apt/sources.list.d/. Ubuntu 26.04 225 describes its archive in ubuntu.sources, in the deb822 key-value form (URIs:, Suites:, Signed-By: and so on); vendors often still write one-line .list files. This machine's MySQL 524 came that way: Oracle's mysql.list reads deb [signed-by=/usr/share/keyrings/mysql-apt-config.gpg], then http://repo.mysql.com/apt/ubuntu/ 524 , the suite resolute and a component such as mysql-9.7-lts.

Two repositories offer mysql-server: which one wins?Shell

apt-cache policy mysql-server | head -9

Output

mysql-server:
  Installed: 9.7.2-1ubuntu26.04
  Candidate: 9.7.2-1ubuntu26.04
  Version table:
 *** 9.7.2-1ubuntu26.04 500
        500 http://repo.mysql.com/apt/ubuntu resolute/mysql-9.7-lts amd64 Packages
        100 /var/lib/dpkg/status
     8.4.11-0ubuntu0.26.04.1 500
        500 http://archive.ubuntu.com/ubuntu resolute-updates/main amd64 Packages

Both sources sit at the default priority 500, so the higher version wins: Oracle's 9.7.2 beats Ubuntu's 8.4.11 with no configuration at all.

The old apt-key add put keys in one keyring trusted for every repository; APT 3.2 on Ubuntu 26.04 no longer ships apt-key, and each source names its own keyring in signed-by. Keys expire: gpg --show-keys on Oracle's keyring prints expires: 2027-10-23, after which apt update fails for that source until you install the renewed key.

What each current release ships, and how to reach PHP 8.5
Release	PHP in the distribution	Route to PHP 8.5
Ubuntu 26.04 LTS (resolute)	8.5.4	Already there
Ubuntu 24.04 LTS (noble)	8.3.6	Sury, or ppa:ondrej/php
Debian 13 319 (trixie)	8.4.24	Sury packages.sury.org/php
RHEL 664 / Alma / Rocky 10	8.3; 8.4 from 10.2	Remi php:remi-8.5
RHEL / Alma / Rocky 9	8.0; streams 8.2, 8.3	Remi php:remi-8.5

On Debian and Ubuntu the third party is Ondřej Surý's packages.sury.org. Its published procedure follows; it was not run on this book's Ubuntu 26.04 machine, which needs no extra PHP source.

Adding the Sury PHP repository on Debian 13 or Ubuntu 24.04Shell

sudo apt-get install -y lsb-release ca-certificates curl
sudo curl -sSLo /tmp/debsuryorg-archive-keyring.deb \
    https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] \
    https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
sudo apt-get update && sudo apt-get install -y php8.5-fpm php8.5-cli php8.5-mysql

The keyring's fingerprint must match the Signed-By: field of the repository's Release file, 1505 8500 A023 5D97 F5D1 0063 B188 E2B6 95BD 4743. Unpacking the package here showed it also drops a copy into /etc/apt/trusted.gpg.d/, trusted for every source, so the scoping is weaker than it looks. Pinning stops the repository winning upgrades you never intended: low priority for the origin, high for PHP.

/etc/apt/preferences.d/php — take only PHP from the third partyYAML

Package: *
Pin: origin packages.sury.org
Pin-Priority: 100
Package: php* libapache2-mod-php*
Pin: origin packages.sury.org
Pin-Priority: 600

MENU