Skip to content

Commit 5228d1e

Browse files
kenyonkenyon
committed
(MODULES-9695) Debian: use modern APT keyring format
This updates puppet_agent::osfamily::debian to use modern APT keyrings instead of the deprecated apt-key method used by apt::key and apt::source.key without `name`. This also removes the legacy key, because keys not used for signing package sources aren't needed. /etc/pki is not needed anymore (also this directory is a RedHatism) because keyrings are now stored in the default location of /etc/apt/keyrings. We don't clean it up though, in case people are using the files there for something else.
1 parent cae2480 commit 5228d1e

File tree

2 files changed

+11
-80
lines changed

2 files changed

+11
-80
lines changed

‎manifests/osfamily/debian.pp‎

Lines changed: 3 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -71,44 +71,15 @@
7171
} else {
7272
$source = $puppet_agent::apt_source
7373
}
74-
$legacy_keyname = 'GPG-KEY-puppet'
75-
$legacy_gpg_path = "/etc/pki/deb-gpg/${legacy_keyname}"
76-
$keyname = 'GPG-KEY-puppet-20250406'
77-
$gpg_path = "/etc/pki/deb-gpg/${keyname}"
78-
79-
if getvar('::puppet_agent::manage_pki_dir') == true {
80-
file { ['/etc/pki', '/etc/pki/deb-gpg']:
81-
ensure => directory,
82-
}
83-
}
84-
85-
file { $legacy_gpg_path:
86-
ensure => file,
87-
owner => 0,
88-
group => 0,
89-
mode => '0644',
90-
source => "puppet:///modules/puppet_agent/${legacy_keyname}",
91-
}
92-
93-
apt::key { 'legacy key':
94-
id => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
95-
source => $legacy_gpg_path,
96-
}
9774

98-
file { $gpg_path:
99-
ensure => file,
100-
owner => 0,
101-
group => 0,
102-
mode => '0644',
103-
source => "puppet:///modules/puppet_agent/${keyname}",
104-
}
75+
$keyname = 'GPG-KEY-puppet-20250406'
10576

10677
apt::source { 'pc_repo':
10778
location => $source,
10879
repos => $puppet_agent::collection,
10980
key => {
110-
'id' => 'D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26',
111-
'source' => $gpg_path,
81+
'name' => "${keyname}.asc",
82+
'content' => file("${module_name}/${keyname}"),
11283
},
11384
notify => Exec['pc_repo_force'],
11485
}

‎spec/classes/puppet_agent_osfamily_debian_spec.rb‎

Lines changed: 8 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -151,44 +151,14 @@
151151
})
152152
}
153153

154-
it {
155-
is_expected.to contain_file('/etc/pki/deb-gpg/GPG-KEY-puppet-20250406')
156-
.with({
157-
'ensure' => 'file',
158-
'owner' => '0',
159-
'group' => '0',
160-
'mode' => '0644',
161-
'source' => 'puppet:///modules/puppet_agent/GPG-KEY-puppet-20250406',
162-
})
163-
}
164-
165-
it {
166-
is_expected.to contain_file('/etc/pki/deb-gpg/GPG-KEY-puppet')
167-
.with({
168-
'ensure' => 'file',
169-
'owner' => '0',
170-
'group' => '0',
171-
'mode' => '0644',
172-
'source' => 'puppet:///modules/puppet_agent/GPG-KEY-puppet',
173-
})
174-
}
175-
176-
it {
177-
is_expected.to contain_apt__key('legacy key')
178-
.with({
179-
'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
180-
'source' => '/etc/pki/deb-gpg/GPG-KEY-puppet',
181-
})
182-
}
183-
184154
it {
185155
is_expected.to contain_apt__source('pc_repo')
186156
.with({
187157
'location' => 'https://master.example.vm:8140/packages/2000.0.0/debian-7-x86_64',
188158
'repos' => 'PC1',
189159
'key' => {
190-
'id' => 'D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26',
191-
'source' => '/etc/pki/deb-gpg/GPG-KEY-puppet-20250406',
160+
'name' => 'GPG-KEY-puppet-20250406.asc',
161+
'content' => Puppet::FileSystem.read_preserve_line_endings('files/GPG-KEY-puppet-20250406'),
192162
},
193163
})
194164
}
@@ -209,8 +179,8 @@
209179
'location' => 'https://fake-apt-mirror.com/packages/2000.0.0/debian-7-x86_64',
210180
'repos' => 'PC1',
211181
'key' => {
212-
'id' => 'D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26',
213-
'source' => '/etc/pki/deb-gpg/GPG-KEY-puppet-20250406',
182+
'name' => 'GPG-KEY-puppet-20250406.asc',
183+
'content' => Puppet::FileSystem.read_preserve_line_endings('files/GPG-KEY-puppet-20250406'),
214184
},
215185
})
216186
}
@@ -225,7 +195,6 @@
225195
end
226196

227197
it { is_expected.not_to contain_apt__setting('conf-pc_repo') }
228-
it { is_expected.not_to contain_apt__key('legacy key') }
229198
it { is_expected.not_to contain_apt__source('pc_repo') }
230199
end
231200

@@ -245,22 +214,14 @@
245214
}
246215
end
247216

248-
it {
249-
is_expected.to contain_apt__key('legacy key')
250-
.with({
251-
'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
252-
'source' => '/etc/pki/deb-gpg/GPG-KEY-puppet',
253-
})
254-
}
255-
256217
it {
257218
is_expected.to contain_apt__source('pc_repo')
258219
.with({
259220
'location' => 'https://apt.puppet.com',
260221
'repos' => 'puppet5',
261222
'key' => {
262-
'id' => 'D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26',
263-
'source' => '/etc/pki/deb-gpg/GPG-KEY-puppet-20250406',
223+
'name' => 'GPG-KEY-puppet-20250406.asc',
224+
'content' => Puppet::FileSystem.read_preserve_line_endings('files/GPG-KEY-puppet-20250406'),
264225
},
265226
})
266227
}
@@ -282,8 +243,8 @@
282243
'location' => 'https://fake-apt-mirror.com/',
283244
'repos' => 'puppet5',
284245
'key' => {
285-
'id' => 'D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26',
286-
'source' => '/etc/pki/deb-gpg/GPG-KEY-puppet-20250406',
246+
'name' => 'GPG-KEY-puppet-20250406.asc',
247+
'content' => Puppet::FileSystem.read_preserve_line_endings('files/GPG-KEY-puppet-20250406'),
287248
},
288249
})
289250
}
@@ -297,7 +258,6 @@
297258
}
298259
end
299260

300-
it { is_expected.not_to contain_apt__key('legacy key') }
301261
it { is_expected.not_to contain_apt__source('pc_repo') }
302262
end
303263

0 commit comments

Comments
 (0)