Skip to content

Commit 5ca6bf2

Browse files
committed
(MODULES-9695) Debian: use modern APT keyring format
This updates puppet_agent::osfamily::debian to use modern APT keyrings instead of the deprecated apt-key method used by apt::key and apt::source.key without `name`. This also removes the legacy key, because keys not used for signing package sources aren't needed. /etc/pki is not needed anymore (also this directory is a RedHatism) because keyrings are now stored in the default location of /etc/apt/keyrings. We don't clean it up though, in case people are using the files there for something else.
1 parent bd68744 commit 5ca6bf2

File tree

1 file changed

+3
-32
lines changed

1 file changed

+3
-32
lines changed

manifests/osfamily/debian.pp

Lines changed: 3 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -71,44 +71,15 @@
7171
} else {
7272
$source = $puppet_agent::apt_source
7373
}
74-
$legacy_keyname = 'GPG-KEY-puppet'
75-
$legacy_gpg_path = "/etc/pki/deb-gpg/${legacy_keyname}"
76-
$keyname = 'GPG-KEY-puppet-20250406'
77-
$gpg_path = "/etc/pki/deb-gpg/${keyname}"
78-
79-
if getvar('::puppet_agent::manage_pki_dir') == true {
80-
file { ['/etc/pki', '/etc/pki/deb-gpg']:
81-
ensure => directory,
82-
}
83-
}
84-
85-
file { $legacy_gpg_path:
86-
ensure => file,
87-
owner => 0,
88-
group => 0,
89-
mode => '0644',
90-
source => "puppet:///modules/puppet_agent/${legacy_keyname}",
91-
}
92-
93-
apt::key { 'legacy key':
94-
id => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
95-
source => $legacy_gpg_path,
96-
}
9774

98-
file { $gpg_path:
99-
ensure => file,
100-
owner => 0,
101-
group => 0,
102-
mode => '0644',
103-
source => "puppet:///modules/puppet_agent/${keyname}",
104-
}
75+
$keyname = 'GPG-KEY-puppet-20250406'
10576

10677
apt::source { 'pc_repo':
10778
location => $source,
10879
repos => $puppet_agent::collection,
10980
key => {
110-
'id' => 'D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26',
111-
'source' => $gpg_path,
81+
'name' => "${keyname}.asc",
82+
'content' => file("${module_name}/${keyname}"),
11283
},
11384
notify => Exec['pc_repo_force'],
11485
}

0 commit comments

Comments
 (0)