Skip to content

Commit afe9872

Browse files
joshcooperjoshcooper
committed
Drop expired key
Previously, the module installed and managed two GPG keys RPM-GPG-KEY-puppet-20250406 RPM-GPG-KEY-puppet The first expired 20250406, so delete references to that. The second used to be the "legacy" key that expired 20250102, but it was updated in dcddb95, so is now the "current" key.
1 parent dcddb95 commit afe9872

File tree

7 files changed

+8
-98
lines changed

7 files changed

+8
-98
lines changed

‎acceptance/helpers.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ def set_up_initial_agent_on(host, initial_package_version_or_collection)
240240
# This discrepancy causes apt to error, so we manually add signing info.
241241
if %r{debian|ubuntu}.match?(host['platform'])
242242
step '(Agent) Add apt signing information' do
243-
on(host, "sed -e 's/^deb http/deb [signed-by=\\/etc\\/apt\\/keyrings\\/GPG-KEY-puppet-20250406.asc] http/' /etc/apt/sources.list.d/puppet*.list -i")
243+
on(host, "sed -e 's/^deb http/deb [signed-by=\\/etc\\/apt\\/keyrings\\/GPG-KEY-puppet.asc] http/' /etc/apt/sources.list.d/puppet*.list -i")
244244
end
245245
end
246246

‎docker/upgrade/sles/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ RUN if [[ ${before} == 7.* ]]; then \
4646
fi
4747

4848
# Install FROM version of puppet-agent.
49-
RUN rpm --import https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406 && \
49+
RUN rpm --import https://yum.puppet.com/RPM-GPG-KEY-puppet && \
5050
zypper install --no-confirm --oldpackage --no-recommends --no-confirm puppet-agent-${before}
5151

5252
# This is also duplicated in the docker/bin/helpers/run-upgrade.sh.

‎manifests/osfamily/redhat.pp‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -94,13 +94,10 @@
9494
}
9595

9696
# lint:ignore:strict_indent
97-
$legacy_keyname = 'GPG-KEY-puppet'
98-
$legacy_gpg_path = "/etc/pki/rpm-gpg/RPM-${legacy_keyname}"
99-
$keyname = 'GPG-KEY-puppet-20250406'
97+
$keyname = 'GPG-KEY-puppet'
10098
$gpg_path = "/etc/pki/rpm-gpg/RPM-${keyname}"
10199
$gpg_homedir = '/root/.gnupg'
102-
$gpg_keys = "file://${legacy_gpg_path}
103-
file://${gpg_path}"
100+
$gpg_keys = "file://${gpg_path}"
104101

105102
$script = @(SCRIPT/L)
106103
ACTION=$0
@@ -131,14 +128,6 @@
131128
}
132129
}
133130

134-
file { $legacy_gpg_path:
135-
ensure => file,
136-
owner => 0,
137-
group => 0,
138-
mode => '0644',
139-
source => "puppet:///modules/puppet_agent/${legacy_keyname}",
140-
}
141-
142131
file { $gpg_path:
143132
ensure => file,
144133
owner => 0,
@@ -147,13 +136,6 @@
147136
source => "puppet:///modules/puppet_agent/${keyname}",
148137
}
149138

150-
exec { "import-${legacy_keyname}":
151-
path => '/bin:/usr/bin:/sbin:/usr/sbin',
152-
command => "/bin/bash -c '${script}' import ${gpg_homedir} ${legacy_gpg_path}",
153-
unless => "/bin/bash -c '${script}' check ${gpg_homedir} ${legacy_gpg_path}",
154-
require => File[$legacy_gpg_path],
155-
logoutput => 'on_failure',
156-
}
157139
exec { "import-${keyname}":
158140
path => '/bin:/usr/bin:/sbin:/usr/sbin',
159141
command => "/bin/bash -c '${script}' import ${gpg_homedir} ${gpg_path}",

‎manifests/osfamily/suse.pp‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,7 @@
6262
case $facts['os']['release']['major'] {
6363
'11', '12', '15': {
6464
# Import the GPG key
65-
$legacy_keyname = 'GPG-KEY-puppet'
66-
$legacy_gpg_path = "/etc/pki/rpm-gpg/RPM-${legacy_keyname}"
67-
$keyname = 'GPG-KEY-puppet-20250406'
65+
$keyname = 'GPG-KEY-puppet'
6866
$gpg_path = "/etc/pki/rpm-gpg/RPM-${keyname}"
6967
$gpg_homedir = '/root/.gnupg'
7068

@@ -105,21 +103,6 @@
105103
source => "puppet:///modules/puppet_agent/${keyname}",
106104
}
107105

108-
file { $legacy_gpg_path:
109-
ensure => file,
110-
owner => 0,
111-
group => 0,
112-
mode => '0644',
113-
source => "puppet:///modules/puppet_agent/${legacy_keyname}",
114-
}
115-
116-
exec { "import-${legacy_keyname}":
117-
path => '/bin:/usr/bin:/sbin:/usr/sbin',
118-
command => "/bin/bash -c '${script}' import ${gpg_homedir} ${legacy_gpg_path}",
119-
unless => "/bin/bash -c '${script}' check ${gpg_homedir} ${legacy_gpg_path}",
120-
require => File[$legacy_gpg_path],
121-
logoutput => 'on_failure',
122-
}
123106
exec { "import-${keyname}":
124107
path => '/bin:/usr/bin:/sbin:/usr/sbin',
125108
command => "/bin/bash -c '${script}' import ${gpg_homedir} ${gpg_path}",

‎spec/classes/puppet_agent_osfamily_redhat_spec.rb‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -62,17 +62,6 @@
6262
fi
6363
SCRIPT
6464

65-
it {
66-
is_expected.to contain_exec('import-GPG-KEY-puppet-20250406')
67-
.with({
68-
'path' => '/bin:/usr/bin:/sbin:/usr/sbin',
69-
'command' => "/bin/bash -c '#{script}' import /root/.gnupg /etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
70-
'unless' => "/bin/bash -c '#{script}' check /root/.gnupg /etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
71-
'require' => 'File[/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406]',
72-
'logoutput' => 'on_failure',
73-
})
74-
}
75-
7665
it {
7766
is_expected.to contain_exec('import-GPG-KEY-puppet')
7867
.with({
@@ -103,17 +92,6 @@
10392
end
10493
end
10594

106-
it {
107-
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406')
108-
.with({
109-
'ensure' => 'file',
110-
'owner' => '0',
111-
'group' => '0',
112-
'mode' => '0644',
113-
'source' => 'puppet:///modules/puppet_agent/GPG-KEY-puppet-20250406',
114-
})
115-
}
116-
11795
it {
11896
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet')
11997
.with({
@@ -154,7 +132,7 @@
154132
'baseurl' => "http://yum.puppet.com/puppet5/#{urlbit.gsub('/f', '/')}/#{arch}",
155133
'enabled' => 'true',
156134
'gpgcheck' => '1',
157-
'gpgkey' => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet\n file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
135+
'gpgkey' => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet",
158136
})
159137
}
160138
end
@@ -215,7 +193,7 @@
215193
'baseurl' => "https://master.example.vm:8140/packages/2000.0.0/#{repodir}",
216194
'enabled' => 'true',
217195
'gpgcheck' => '1',
218-
'gpgkey' => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet\n file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
196+
'gpgkey' => "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-puppet",
219197
'sslcacert' => '/etc/puppetlabs/puppet/ssl/certs/ca.pem',
220198
'sslclientcert' => '/etc/puppetlabs/puppet/ssl/certs/foo.example.vm.pem',
221199
'sslclientkey' => '/etc/puppetlabs/puppet/ssl/private_keys/foo.example.vm.pem',

‎spec/classes/puppet_agent_osfamily_suse_spec.rb‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -82,17 +82,6 @@
8282
})
8383
}
8484

85-
it {
86-
is_expected.to contain_exec('import-GPG-KEY-puppet-20250406')
87-
.with({
88-
'path' => '/bin:/usr/bin:/sbin:/usr/sbin',
89-
'command' => "/bin/bash -c '#{script}' import /root/.gnupg /etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
90-
'unless' => "/bin/bash -c '#{script}' check /root/.gnupg /etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406",
91-
'require' => 'File[/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406]',
92-
'logoutput' => 'on_failure',
93-
})
94-
}
95-
9685
context 'with manage_pki_dir => true' do
9786
['/etc/pki', '/etc/pki/rpm-gpg'].each do |path|
9887
it {
@@ -114,17 +103,6 @@
114103

115104
it { is_expected.to contain_class('puppet_agent::osfamily::suse') }
116105

117-
it {
118-
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406')
119-
.with({
120-
'ensure' => 'file',
121-
'owner' => '0',
122-
'group' => '0',
123-
'mode' => '0644',
124-
'source' => 'puppet:///modules/puppet_agent/GPG-KEY-puppet-20250406',
125-
})
126-
}
127-
128106
it {
129107
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet')
130108
.with({
@@ -255,17 +233,6 @@
255233

256234
it { is_expected.to contain_class('puppet_agent::osfamily::suse') }
257235

258-
it {
259-
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet-20250406')
260-
.with({
261-
'ensure' => 'file',
262-
'owner' => '0',
263-
'group' => '0',
264-
'mode' => '0644',
265-
'source' => 'puppet:///modules/puppet_agent/GPG-KEY-puppet-20250406',
266-
})
267-
}
268-
269236
it {
270237
is_expected.to contain_file('/etc/pki/rpm-gpg/RPM-GPG-KEY-puppet')
271238
.with({

‎tasks/install_shell.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -728,7 +728,7 @@ case $platform in
728728
rm -f "$gpg_key"
729729
done
730730
else
731-
for key in "puppet" "puppet-20250406"; do
731+
for key in "puppet"; do
732732
gpg_key="${tmp_dir}/RPM-GPG-KEY-${key}"
733733
do_download "https://yum.puppet.com/RPM-GPG-KEY-${key}" "$gpg_key"
734734
rpm --import "$gpg_key"

0 commit comments

Comments
 (0)