Skip to content

Commit d341db9

Browse files
committed
update repository keys
Update Deb and Yum repository keys to point to the new 7F438280EF8D349F key. Additionally use HTTPS when fetching keys with Yum to decrease MITM risk, since we don't check if the downloaded key matches the expected keyid. See: https://puppet.com/blog/updated-puppet-gpg-signing-key
1 parent ef3a15e commit d341db9

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

manifests/repo/puppetlabs.pp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
Apt::Source {
99
location => 'http://apt.puppetlabs.com',
1010
key => {
11-
'id' => '47B320EB4C7C375AA9DAE1A01054B7A24BD6EC30',
11+
'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
1212
'server' => 'pgp.mit.edu',
1313
},
1414
}
@@ -27,15 +27,15 @@
2727
descr => 'Puppet Labs Dependencies $releasever - $basearch ',
2828
enabled => '1',
2929
gpgcheck => '1',
30-
gpgkey => 'http://yum.puppetlabs.com/RPM-GPG-KEY-puppetlabs',
30+
gpgkey => 'https://yum.puppetlabs.com/RPM-GPG-KEY-puppet',
3131
}
3232

3333
yumrepo { 'puppetlabs':
3434
baseurl => "http://yum.puppetlabs.com/${ostype}/${prefix}\$releasever/products/\$basearch",
3535
descr => 'Puppet Labs Products $releasever - $basearch',
3636
enabled => '1',
3737
gpgcheck => '1',
38-
gpgkey => 'http://yum.puppetlabs.com/RPM-GPG-KEY-puppetlabs',
38+
gpgkey => 'https://yum.puppetlabs.com/RPM-GPG-KEY-puppet',
3939
}
4040
} else {
4141
fail("Unsupported osfamily ${::osfamily}")

0 commit comments

Comments
 (0)