backports: add keyring support

Author: kenyon

examples/backports.pp

@@ -4,8 +4,4 @@
   location => 'http://us.archive.ubuntu.com/ubuntu',
   release  => 'trusty-backports',
   repos    => 'main universe multiverse restricted',
-  key      => {
-    id     => '630239CC130E1A7FD81A27B140976EAF437D05B5',
-    server => 'keyserver.ubuntu.com',
-  },
 }

manifests/backports.pp

@@ -1,15 +1,7 @@
 # @summary Manages backports.
 #
-# @example Set up a backport source for Linux Mint qiana
-#   class { 'apt::backports':
-#     location => 'http://us.archive.ubuntu.com/ubuntu',
-#     release  => 'trusty-backports',
-#     repos    => 'main universe multiverse restricted',
-#     key      => {
-#       id     => '630239CC130E1A7FD81A27B140976EAF437D05B5',
-#       server => 'keyserver.ubuntu.com',
-#     },
-#   }
+# @example Set up a backport source for Ubuntu
+#   include apt::backports
 #
 # @param location
 #   Specifies an Apt repository containing the backports to manage. Valid options: a string containing a URL. Default value for Debian and
@@ -36,6 +28,11 @@
 #   Specifies a key to authenticate the backports. Valid options: a string to be passed to the id parameter of the apt::key defined type, or a
 #   hash of parameter => value pairs to be passed to apt::key's id, server, content, source, and/or options parameters.
 #
+# @param keyring
+#   Absolute path to a file containing the PGP keyring used to sign this
+#   repository. Value is passed to the apt::source and used to set signed-by on
+#   the source entry.
+#
 # @param pin
 #   Specifies a pin priority for the backports. Valid options: a number or string to be passed to the `id` parameter of the `apt::pin` defined
 #   type, or a hash of `parameter => value` pairs to be passed to `apt::pin`'s corresponding parameters.
@@ -48,6 +45,7 @@
   Optional[String] $release                     = undef,
   Optional[String] $repos                       = undef,
   Optional[Variant[String, Hash]] $key          = undef,
+  Stdlib::AbsolutePath $keyring                 = "/usr/share/keyrings/${facts['os']['name'].downcase}-archive-keyring.gpg",
   Variant[Integer, String, Hash] $pin           = 200,
   Variant[Hash] $include                        = {},
 ) {
@@ -56,32 +54,43 @@
   if $location {
     $_location = $location
   }
+
   if $release {
     $_release = $release
   }
+
   if $repos {
     $_repos = $repos
   }
 
   if (!($facts['os']['name'] == 'Debian' or $facts['os']['name'] == 'Ubuntu')) {
-    unless $location and $release and $repos and $key {
-      fail('If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key')
+    unless $location and $release and $repos {
+      fail('If not on Debian or Ubuntu, you must explicitly pass location, release, and repos')
     }
   }
+
   unless $location {
     $_location = $apt::backports['location']
   }
+
   unless $release {
     if fact('os.distro.codename') {
       $_release = "${fact('os.distro.codename')}-backports"
     } else {
       fail('os.distro.codename fact not available: release parameter required')
     }
   }
+
   unless $repos {
     $_repos = $apt::backports['repos']
   }
 
+  $_keyring = if $key {
+    undef
+  } else {
+    $keyring
+  }
+
   if $pin =~ Hash {
     $_pin = $pin
   } elsif $pin =~ Numeric or $pin =~ String {
@@ -101,6 +110,7 @@
     repos    => $_repos,
     include  => $include,
     key      => $key,
+    keyring  => $_keyring,
     pin      => $_pin,
   }
 }

spec/classes/apt_backports_spec.rb

@@ -34,6 +34,7 @@
             'priority' => 200,
             'release' => 'bullseye-backports'
           },
+          keyring: '/usr/share/keyrings/debian-archive-keyring.gpg',
         )
       }
     end
@@ -65,6 +66,7 @@
             'priority' => 200,
             'release' => 'jammy-backports'
           },
+          keyring: '/usr/share/keyrings/ubuntu-archive-keyring.gpg',
         )
       }
     end
@@ -144,7 +146,7 @@
     end
   end
 
-  describe 'mint tests' do
+  describe 'linuxmint tests' do
     let(:facts) do
       {
         os: {
@@ -193,7 +195,7 @@
       end
 
       it do
-        expect(subject).to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key})
+        expect(subject).to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, and repos})
       end
     end
 
@@ -207,7 +209,7 @@
       end
 
       it do
-        expect(subject).to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key})
+        expect(subject).to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, and repos})
       end
     end
 
@@ -221,21 +223,7 @@
       end
 
       it do
-        expect(subject).to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key})
-      end
-    end
-
-    context 'with missing key' do
-      let(:params) do
-        {
-          location: 'http://archive.ubuntu.com/ubuntu',
-          release: 'trusty-backports',
-          repos: 'main universe multiverse restricted'
-        }
-      end
-
-      it do
-        expect(subject).to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key})
+        expect(subject).to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, and repos})
       end
     end
   end