Repository: vscode
Issue: VS Code APT sources.list: add signed-by field and remove unnecessary architectures
Labels: debt,linux,deb,packaging

<!-- ⚠️⚠️ Do Not Delete This! bug_report_template ⚠️⚠️ -->
<!-- Please read our Rules of Conduct: https://opensource.microsoft.com/codeofconduct/ -->
<!-- 🕮 Read our guide about submitting issues: https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions -->
<!-- 🔎 Search existing issues to avoid creating duplicates. -->
<!-- 🧪 Test using the latest Insiders build to see if your issue has already been fixed: https://code.visualstudio.com/insiders/ -->
<!-- 💡 Instead of creating your report here, use 'Report Issue' from the 'Help' menu in VS Code to pre-fill useful information. -->
<!-- 🔧 Launch with `code --disable-extensions` to check. -->
Does this issue occur when all extensions are disabled?: Yes

<!-- 🪓 If you answered No above, use 'Help: Start Extension Bisect' from Command Palette to try to identify the cause. -->
<!-- 📣 Issues caused by an extension need to be reported directly to the extension publisher. The 'Help > Report Issue' dialog can assist with this. -->
- VS Code Version: 1.96.4
- OS Version: Debian sid

Steps to Reproduce:

VS Code's APT sources.list has two problems. Now it is:

```sh
~> cat /etc/apt/sources.list.d/vscode.list
### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# You may comment out this entry, but any other modifications may be lost.
deb [arch=amd64,arm64,armhf] https://packages.microsoft.com/repos/code stable main
```

### Problem 1: Missing `signed-by` field

The recent [APT 2.9.24 update](https://mastodon.social/@juliank/113866133456641922) introduced a [change](https://salsa.debian.org/apt-team/apt/-/commit/61f8f40f921cde13c5b97abbdf900646745e8e30#b3f55b8d9783f2ed27acfd1f0fe06dfc461e2aba_1_6):

> /etc/apt/trusted.gpg is no longer used as a source of signers.  
> Sources without Signed-By are fully deprecated, and therefore /etc/apt/trusted.gpg.d is deprecated.

This has led to warnings when running `apt update`, such as:

```
Notice: Missing Signed-By in the sources.list(5) entry for 'https://packages.microsoft.com/repos/edge'
Notice: Missing Signed-By in the sources.list(5) entry for 'https://packages.microsoft.com/repos/code'
Notice: Consider migrating all sources.list(5) entries to the deb822 .sources format
Notice: The deb822 .sources format supports both embedded as well as external OpenPGP keys
Notice: See apt-secure(7) for best practices in configuring repository signing.
```

---

### Problem 2: Unnecessary architectures

The current configuration includes three architectures: `amd64`, `arm64`, and `armhf`. This results in downloading unnecessary index files for architectures that are not in use, wasting bandwidth and server resources. Should these be removed?

---

### Solution

According to the [Debian Wiki](https://wiki.debian.org/DebianRepository/UseThirdParty), the `microsoft.gpg` key should be moved from `/etc/apt/trusted.gpg.d` to `/usr/share/keyrings`, and then you can choose one of the following two solutions:

1. Update `/etc/apt/sources.list.d/vscode.list` to the following:
```
deb [signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/code stable main
```

2. Completely remove `/etc/apt/sources.list.d/vscode.list` and switch to the DEB822 format. For more information on the DEB822 format, refer to `source.list(5)`. The DEB822 format also allows embedding the public key within the source list file.