fix: update to new repos (#524)

Co-authored-by: Ee Durbin <[email protected]>

Author: JacobCoffee

dockerfiles/Dockerfile.focal

@@ -47,9 +47,12 @@ EXPOSE 22
 RUN /usr/sbin/sshd
 
 # Setup Salt Common
+RUN mkdir -p /etc/apt/keyrings
+RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring-2024.pgp https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
+RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.pgp arch=$(dpkg --print-architecture)] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" > /etc/apt/sources.list.d/salt.list
 
-RUN wget --quiet -O /usr/share/keyrings/salt-archive-keyring.gpg https://repo.saltproject.io/py3/ubuntu/20.04/$(dpkg --print-architecture)/3004/salt-archive-keyring.gpg
-RUN echo "deb [signed-by=/usr/share/keyrings/salt-archive-keyring.gpg arch=$(dpkg --print-architecture)] https://repo.saltproject.io/py3/ubuntu/20.04/$(dpkg --print-architecture)/3004 focal main" > /etc/apt/sources.list.d/salt.list
+# Pin to Salt 3006 LTS
+RUN printf "Package: salt-*\nPin: version 3006.*\nPin-Priority: 1001\n" > /etc/apt/preferences.d/salt-pin-1001
 RUN apt-get update -y && apt-get install -y --no-install-recommends salt-minion
 
 # Start Systemd (systemctl)

dockerfiles/Dockerfile.jammy

@@ -47,8 +47,13 @@ EXPOSE 22
 RUN /usr/sbin/sshd
 
 # Setup Salt Common
-RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring-2023.gpg https://repo.saltproject.io/salt/py3/ubuntu/22.04/$(dpkg --print-architecture)/SALT-PROJECT-GPG-PUBKEY-2023.gpg
-RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg arch=$(dpkg --print-architecture)] https://repo.saltproject.io/salt/py3/ubuntu/22.04/$(dpkg --print-architecture)/3006 jammy main" > /etc/apt/sources.list.d/salt.list
+RUN mkdir -p /etc/apt/keyrings
+RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring-2024.pgp https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
+RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.pgp arch=$(dpkg --print-architecture)] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" > /etc/apt/sources.list.d/salt.list
+
+# Pin to Salt 3006 LTS
+RUN printf "Package: salt-*\nPin: version 3006.*\nPin-Priority: 1001\n" > /etc/apt/preferences.d/salt-pin-1001
+
 RUN apt-get update -y && apt-get install -y --no-install-recommends salt-minion
 
 # Start Systemd (systemctl)

dockerfiles/Dockerfile.noble

@@ -47,9 +47,13 @@ EXPOSE 22
 RUN /usr/sbin/sshd
 
 # Setup Salt Common
-RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring.gpg https://repo.saltproject.io/salt/py3/ubuntu/24.04/$(dpkg --print-architecture)/SALT-PROJECT-GPG-PUBKEY-2023.gpg
-RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring.gpg arch=$(dpkg --print-architecture)] https://repo.saltproject.io/salt/py3/ubuntu/24.04/$(dpkg --print-architecture)/3007 noble main" > /etc/apt/sources.list.d/saltstack.list
-RUN apt-get update -y && apt-get install -y --no-install-recommends salt-minion
+RUN mkdir -p /etc/apt/keyrings
+RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring-2024.pgp https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
+RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.pgp arch=$(dpkg --print-architecture)] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" > /etc/apt/sources.list.d/salt.list
+
+# Pin to Salt 3006 LTS
+RUN printf "Package: salt-*\nPin: version 3006.*\nPin-Priority: 1001\n" > /etc/apt/preferences.d/salt-pin-1001
+
 
 # Start Systemd (systemctl)
 CMD ["/lib/systemd/systemd"]

docs/guides/migration-recipe.md

@@ -99,9 +99,11 @@ index 68387c9..7a8ace1 100644
     CODENAME=$(cat /etc/os-release | grep VERSION_CODENAME | cut -d '=' -f 2)
    
     echo "Adding the SaltStack repository key for $UBUNTU_VERSION $CODENAME ($ARCH)..."
-    sudo curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg https://repo.saltproject.io/salt/py3/ubuntu/$UBUNTU_VERSION/$ARCH/SALT-PROJECT-GPG-PUBKEY-2023.gpg
+    sudo curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2024.gpg https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
     echo "Adding the SaltStack repository for $UBUNTU_VERSION $CODENAME ($ARCH)..."
-    echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg arch=$ARCH] https://repo.saltproject.io/salt/py3/ubuntu/$UBUNTU_VERSION/$ARCH/latest $CODENAME main" | sudo tee /etc/apt/sources.list.d/salt.list
+    echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.gpg arch=$ARCH] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" | sudo tee /etc/apt/sources.list.d/salt.list
+    echo "Pinning Salt to v3006.*"
+    RUN printf "Package: salt-*\nPin: version 3006.*\nPin-Priority: 1001\n" > /etc/apt/preferences.d/salt-pin-1001
     ```
 3. Install and configure the salt-minion. On `$new-host`, run the command
     ```console

salt/base/salt.sls

@@ -33,25 +33,27 @@ remove_old_salt_repo:
   file.absent:
     - name: /etc/apt/sources.list.d/saltstack.list
 
+{% if grains["oscodename"] in ["focal", "jammy", "noble"] %}
+salt-pin-config:
+  file.managed:
+    - name: /etc/apt/preferences.d/salt-pin-1001
+    - contents: |
+        Package: salt-*
+        Pin: version 3006.*
+        Pin-Priority: 1001
+    - user: root
+    - group: root
+    - mode: "0644"
+{% endif %}
+
 salt-repo:
   pkgrepo.managed:
-    - humanname: repo.saltstack.org
-    {% if grains["oscodename"] == "focal" %}
-    - name: deb https://archive.repo.saltproject.io/py3/ubuntu/20.04/{{ grains["osarch"] }}/archive/3004 focal main
-    - key_url: https://archive.repo.saltproject.io/py3/ubuntu/20.04/{{ grains["osarch"] }}/archive/3004/salt-archive-keyring.gpg
-    {% elif grains["oscodename"] == "jammy" %}
-    - name: deb [signed-by=/etc/apt/keyrings/salt-archive-keyring.gpg arch={{ grains["osarch"] }}] https://repo.saltproject.io/salt/py3/ubuntu/22.04/{{ grains["osarch"] }}/3007 jammy main
-    - key_url: https://repo.saltproject.io/salt/py3/ubuntu/22.04/{{ grains["osarch"] }}/SALT-PROJECT-GPG-PUBKEY-2023.gpg
-    - aptkey: False
-    {% elif grains["oscodename"] == "noble" %}
-    - name: deb [signed-by=/etc/apt/keyrings/salt-archive-keyring.gpg arch={{ grains["osarch"] }}] https://repo.saltproject.io/salt/py3/ubuntu/24.04/{{ grains["osarch"] }}/3007 noble main
-    - key_url: https://repo.saltproject.io/salt/py3/ubuntu/24.04/{{ grains["osarch"] }}/SALT-PROJECT-GPG-PUBKEY-2023.gpg
+    {% if grains["oscodename"] in ["focal", "jammy", "noble"] %}
+    - name: deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.pgp arch={{ grains["osarch"] }}] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main
+    - key_url: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
     - aptkey: False
-    {% else %}
-    - name: deb http://archive.repo.saltstack.com/py3/ubuntu/{{ grains["osrelease"] }}/{{ grains["osarch"] }}/2018.3 {{ grains["oscodename"] }} main
-    - key_url: https://archive.repo.saltstack.com/py3/ubuntu/18.04/amd64/2018.3/SALTSTACK-GPG-KEY.pub
-    {% endif %}
     - file: /etc/apt/sources.list.d/salt.list
+    {% endif %}
 {% endif %}