Skip to content

Commit 036d0bb

Browse files
joshcooperjoshcooper
committed
(PA-7437) Drop expired GPG-KEY-puppet-20250406
The key expired 2025-04-06, so delete it. Update manifests and task to refer to GPG-KEY-puppet that was rotated in the previous commit.
1 parent c770944 commit 036d0bb

File tree

8 files changed

+8
-129
lines changed

8 files changed

+8
-129
lines changed

‎acceptance/helpers.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ def set_up_initial_agent_on(host, initial_package_version_or_collection)
240240
# This discrepancy causes apt to error, so we manually add signing info.
241241
if %r{debian|ubuntu}.match?(host['platform'])
242242
step '(Agent) Add apt signing information' do
243-
on(host, "sed -e 's/^deb http/deb [signed-by=\\/etc\\/apt\\/keyrings\\/GPG-KEY-puppet-20250406.asc] http/' /etc/apt/sources.list.d/puppet*.list -i")
243+
on(host, "sed -e 's/^deb http/deb [signed-by=\\/etc\\/apt\\/keyrings\\/GPG-KEY-puppet.asc] http/' /etc/apt/sources.list.d/puppet*.list -i")
244244
end
245245
end
246246

‎docker/upgrade/sles/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ RUN if [[ ${before} == 7.* ]]; then \
4646
fi
4747

4848
# Install FROM version of puppet-agent.
49-
RUN rpm --import https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406 && \
49+
RUN rpm --import https://yum.puppet.com/RPM-GPG-KEY-puppet && \
5050
zypper install --no-confirm --oldpackage --no-recommends --no-confirm puppet-agent-${before}
5151

5252
# This is also duplicated in the docker/bin/helpers/run-upgrade.sh.

‎files/GPG-KEY-puppet-20250406‎

Lines changed: 0 additions & 31 deletions
This file was deleted.

‎manifests/osfamily/redhat.pp‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -94,13 +94,10 @@
9494
}
9595

9696
# lint:ignore:strict_indent
97-
$legacy_keyname = 'GPG-KEY-puppet'
98-
$legacy_gpg_path = "/etc/pki/rpm-gpg/RPM-${legacy_keyname}"
99-
$keyname = 'GPG-KEY-puppet-20250406'
97+
$keyname = 'GPG-KEY-puppet'
10098
$gpg_path = "/etc/pki/rpm-gpg/RPM-${keyname}"
10199
$gpg_homedir = '/root/.gnupg'
102-
$gpg_keys = "file://${legacy_gpg_path}
103-
file://${gpg_path}"
100+
$gpg_keys = "file://${gpg_path}"
104101

105102
$script = @(SCRIPT/L)
106103
ACTION=$0
@@ -131,14 +128,6 @@
131128
}
132129
}
133130

134-
file { $legacy_gpg_path:
135-
ensure => file,
136-
owner => 0,
137-
group => 0,
138-
mode => '0644',
139-
source => "puppet:///modules/puppet_agent/${legacy_keyname}",
140-
}
141-
142131
file { $gpg_path:
143132
ensure => file,
144133
owner => 0,
@@ -147,13 +136,6 @@
147136
source => "puppet:///modules/puppet_agent/${keyname}",
148137
}
149138

150-
exec { "import-${legacy_keyname}":
151-
path => '/bin:/usr/bin:/sbin:/usr/sbin',
152-
command => "/bin/bash -c '${script}' import ${gpg_homedir} ${legacy_gpg_path}",
153-
unless => "/bin/bash -c '${script}' check ${gpg_homedir} ${legacy_gpg_path}",
154-
require => File[$legacy_gpg_path],
155-
logoutput => 'on_failure',
156-
}
157139
exec { "import-${keyname}":
158140
path => '/bin:/usr/bin:/sbin:/usr/sbin',
159141
command => "/bin/bash -c '${script}' import ${gpg_homedir} ${gpg_path}",

‎manifests/osfamily/suse.pp‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,7 @@
6262
case $facts['os']['release']['major'] {
6363
'11', '12', '15': {
6464
# Import the GPG key
65-
$legacy_keyname = 'GPG-KEY-puppet'
66-
$legacy_gpg_path = "/etc/pki/rpm-gpg/RPM-${legacy_keyname}"
67-
$keyname = 'GPG-KEY-puppet-20250406'
65+
$keyname = 'GPG-KEY-puppet'
6866
$gpg_path = "/etc/pki/rpm-gpg/RPM-${keyname}"
6967
$gpg_homedir = '/root/.gnupg'
7068

@@ -105,21 +103,6 @@
105103
source => "puppet:///modules/puppet_agent/${keyname}",
106104
}
107105

108-
file { $legacy_gpg_path:
109-
ensure => file,
110-
owner => 0,
111-
group => 0,
112-
mode => '0644',
113-
source => "puppet:///modules/puppet_agent/${legacy_keyname}",
114-
}
115-
116-
exec { "import-${legacy_keyname}":
117-
path => '/bin:/usr/bin:/sbin:/usr/sbin',
118-
command => "/bin/bash -c '${script}' import ${gpg_homedir} ${legacy_gpg_path}",
119-
unless => "/bin/bash -c '${script}' check ${gpg_homedir} ${legacy_gpg_path}",
120-
require => File[$legacy_gpg_path],
121-
logoutput => 'on_failure',
122-
}
123106
exec { "import-${keyname}":
124107
path => '/bin:/usr/bin:/sbin:/usr/sbin',
125108
command => "/bin/bash -c '${script}' import ${gpg_homedir} ${gpg_path}",

‎spec/classes/puppet_agent_osfamily_redhat_spec.rb‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -62,17 +62,6 @@
6262
fi
6363
SCRIPT
6464

65-
it {
66-
is_expected.to contain_exec('import-GPG-KEY-puppet-20250406')
67-
.with({
68-
'path' => '/bin:/usr/bin:/sbin:/usr/sbin',
69-
'command' => "/bin/bash -c '#{script}' import /root/.gnupg /etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
70-
'unless' => "/bin/bash -c '#{script}' check /root/.gnupg /etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
71-
'require' => 'File[/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406]',
72-
'logoutput' => 'on_failure',
73-
})
74-
}
75-
7665
it {
7766
is_expected.to contain_exec('import-GPG-KEY-puppet')
7867
.with({
@@ -103,17 +92,6 @@
10392
end
10493
end
10594

106-
it {
107-
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406')
108-
.with({
109-
'ensure' => 'file',
110-
'owner' => '0',
111-
'group' => '0',
112-
'mode' => '0644',
113-
'source' => 'puppet:///modules/puppet_agent/GPG-KEY-puppet-20250406',
114-
})
115-
}
116-
11795
it {
11896
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet')
11997
.with({
@@ -154,7 +132,7 @@
154132
'baseurl' => "http://yum.puppet.com/puppet5/#{urlbit.gsub('/f', '/')}/#{arch}",
155133
'enabled' => 'true',
156134
'gpgcheck' => '1',
157-
'gpgkey' => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet\n file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
135+
'gpgkey' => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet',
158136
})
159137
}
160138
end
@@ -215,7 +193,7 @@
215193
'baseurl' => "https://master.example.vm:8140/packages/2000.0.0/#{repodir}",
216194
'enabled' => 'true',
217195
'gpgcheck' => '1',
218-
'gpgkey' => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet\n file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
196+
'gpgkey' => 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet',
219197
'sslcacert' => '/etc/puppetlabs/puppet/ssl/certs/ca.pem',
220198
'sslclientcert' => '/etc/puppetlabs/puppet/ssl/certs/foo.example.vm.pem',
221199
'sslclientkey' => '/etc/puppetlabs/puppet/ssl/private_keys/foo.example.vm.pem',

‎spec/classes/puppet_agent_osfamily_suse_spec.rb‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -82,17 +82,6 @@
8282
})
8383
}
8484

85-
it {
86-
is_expected.to contain_exec('import-GPG-KEY-puppet-20250406')
87-
.with({
88-
'path' => '/bin:/usr/bin:/sbin:/usr/sbin',
89-
'command' => "/bin/bash -c '#{script}' import /root/.gnupg /etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
90-
'unless' => "/bin/bash -c '#{script}' check /root/.gnupg /etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
91-
'require' => 'File[/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406]',
92-
'logoutput' => 'on_failure',
93-
})
94-
}
95-
9685
context 'with manage_pki_dir => true' do
9786
['/etc/pki', '/etc/pki/rpm-gpg'].each do |path|
9887
it {
@@ -114,17 +103,6 @@
114103

115104
it { is_expected.to contain_class('puppet_agent::osfamily::suse') }
116105

117-
it {
118-
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406')
119-
.with({
120-
'ensure' => 'file',
121-
'owner' => '0',
122-
'group' => '0',
123-
'mode' => '0644',
124-
'source' => 'puppet:///modules/puppet_agent/GPG-KEY-puppet-20250406',
125-
})
126-
}
127-
128106
it {
129107
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet')
130108
.with({
@@ -255,17 +233,6 @@
255233

256234
it { is_expected.to contain_class('puppet_agent::osfamily::suse') }
257235

258-
it {
259-
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406')
260-
.with({
261-
'ensure' => 'file',
262-
'owner' => '0',
263-
'group' => '0',
264-
'mode' => '0644',
265-
'source' => 'puppet:///modules/puppet_agent/GPG-KEY-puppet-20250406',
266-
})
267-
}
268-
269236
it {
270237
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet')
271238
.with({

‎tasks/install_shell.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -728,7 +728,7 @@ case $platform in
728728
rm -f "$gpg_key"
729729
done
730730
else
731-
for key in "puppet" "puppet-20250406"; do
731+
for key in "puppet"; do
732732
gpg_key="${tmp_dir}/RPM-GPG-KEY-${key}"
733733
do_download "https://yum.puppet.com/RPM-GPG-KEY-${key}" "$gpg_key"
734734
rpm --import "$gpg_key"

0 commit comments

Comments
 (0)