Skip to content

Trust new APT and RPM keys #667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mx-psi merged 9 commits into from
Nov 6, 2020
Merged

Trust new APT and RPM keys #667

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
42cc022
Trust new RPM key
mx-psi Oct 30, 2020
27f45d0
Trust new APT key
mx-psi Oct 30, 2020
a309a47
Fix spec tests for Ubuntu
mx-psi Nov 2, 2020
8093c83
[empty] CircleCI test
mx-psi Nov 2, 2020
5853bf4
[empty] New empty commit for CircleCI
mx-psi Nov 2, 2020
a52206d
[empty] Empty commit to test again
mx-psi Nov 2, 2020
7ea30f7
Handle keys importing through the gpgkey section
mx-psi Nov 3, 2020
de826e6
[empty] Trigger CircleCI
mx-psi Nov 3, 2020
88bbf83
Update ubuntu.pp
mx-psi Nov 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions manifests/redhat.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,15 @@
case $agent_major_version {
5 : {
$defaulturl = "https://yum.datadoghq.com/rpm/${::architecture}/"
$gpgkey = 'https://yum.datadoghq.com/DATADOG_RPM_KEY.public'
$gpgkeys = ['https://yum.datadoghq.com/DATADOG_RPM_KEY.public']
Comment thread
mx-psi marked this conversation as resolved.
Outdated
}
6 : {
$defaulturl = "https://yum.datadoghq.com/stable/6/${::architecture}/"
$gpgkey = 'https://yum.datadoghq.com/DATADOG_RPM_KEY.public'
$gpgkeys = ['https://yum.datadoghq.com/DATADOG_RPM_KEY.public']
}
7 : {
$defaulturl = "https://yum.datadoghq.com/stable/7/${::architecture}/"
$gpgkey = 'https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public'
$gpgkeys = ['https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public', 'https://yum.datadoghq.com/DATADOG_RPM_KEY_20200908.public']
}
default: { fail('invalid agent_major_version') }
}
Expand All @@ -36,27 +36,27 @@

$public_key_local = '/etc/pki/rpm-gpg/DATADOG_RPM_KEY.public'

file { 'DATADOG_RPM_KEY_E09422B3.public':
file { 'DATADOG_RPM_KEY_20200908.public':
owner => root,
group => root,
mode => '0600',
path => $public_key_local,
source => 'https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public'
source => 'https://yum.datadoghq.com/DATADOG_RPM_KEY_20200908.public'
}

exec { 'install-gpg-key':
command => "/bin/rpm --import ${public_key_local}",
onlyif => "/usr/bin/gpg --dry-run --quiet --with-fingerprint -n ${public_key_local} | grep 'A4C0 B90D 7443 CF6E 4E8A A341 F106 8E14 E094 22B3' || gpg --dry-run --import --import-options import-show ${public_key_local} | grep 'A4C0B90D7443CF6E4E8AA341F1068E14E09422B3'",
unless => '/bin/rpm -q gpg-pubkey-e09422b3',
require => File['DATADOG_RPM_KEY_E09422B3.public'],
onlyif => "/usr/bin/gpg --dry-run --quiet --with-fingerprint -n ${public_key_local} | grep 'C655 9B69 0CA8 82F0 23BD F3F6 3F4D 1729 FD4B F915' || gpg --dry-run --import --import-options import-show ${public_key_local} | grep 'C6559B690CA882F023BDF3F63F4D1729FD4BF915'",
unless => '/bin/rpm -q gpg-pubkey-fd4bf915',
require => File['DATADOG_RPM_KEY_20200908.public'],
}
Comment thread
mx-psi marked this conversation as resolved.
Outdated

yumrepo { 'datadog-beta':
ensure => absent,
}

yumrepo {'datadog5':
ensure => absent,
ensure => absent,
}

yumrepo {'datadog6':
Expand All @@ -66,7 +66,7 @@
yumrepo {'datadog':
enabled => 1,
gpgcheck => 1,
gpgkey => $gpgkey,
gpgkey => join($gpgkeys, "\n "),
descr => 'Datadog, Inc.',
baseurl => $baseurl,
require => Exec['install-gpg-key'],
Expand Down
15 changes: 7 additions & 8 deletions manifests/ubuntu.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@

class datadog_agent::ubuntu(
Integer $agent_major_version = $datadog_agent::params::default_agent_major_version,
String $apt_key = 'A2923DFF56EDA6E76E55E492D3A80E30382E94DE',
Array[String] $apt_keys = ['A2923DFF56EDA6E76E55E492D3A80E30382E94DE', 'D75CEA17048B9ACBF186794B32637D44F14F620E'],
String $agent_version = $datadog_agent::params::agent_version,
Optional[String] $agent_repo_uri = undef,
String $release = $datadog_agent::params::apt_default_release,
Boolean $skip_apt_key_trusting = false,
Optional[String] $apt_keyserver = undef,
String $apt_keyserver = $datadog_agent::params::apt_keyserver,
) inherits datadog_agent::params {

if $agent_version =~ /^[0-9]+\.[0-9]+\.[0-9]+((?:~|-)[^0-9\s-]+[^-\s]*)?$/ {
Expand All @@ -28,12 +28,12 @@
}

if !$skip_apt_key_trusting {
$key = {
'id' => $apt_key,
'server' => $apt_keyserver,
$apt_keys.each |String $apt_key| {
apt::key { $apt_key:
id => $apt_key,
server => $apt_keyserver,
}
}
} else {
$key = {}
}

if ($agent_repo_uri != undef) {
Expand All @@ -59,7 +59,6 @@
location => $location,
release => $release,
repos => $repos,
key => $key,
}

package { 'datadog-agent-base':
Expand Down
3 changes: 2 additions & 1 deletion spec/classes/datadog_agent_redhat_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,8 @@
is_expected.to contain_yumrepo('datadog')
.with_enabled(1)\
.with_gpgcheck(1)\
.with_gpgkey('https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public')\
.with_gpgkey('https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
https://yum.datadoghq.com/DATADOG_RPM_KEY_20200908.public')\
.with_baseurl('https://yum.datadoghq.com/stable/7/x86_64/')
end
end
Expand Down
21 changes: 14 additions & 7 deletions spec/classes/datadog_agent_ubuntu_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,12 @@
end

# it should install the mirror
it { is_expected.not_to contain_apt__key('Add key: 935F5A436A5A6E8788F0765B226AE980C7A7DA52 from Apt::Source datadog') }
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
it do
is_expected.to contain_apt__key('Add key: A2923DFF56EDA6E76E55E492D3A80E30382E94DE from Apt::Source datadog')
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')
end

context 'overriding keyserver' do
let(:params) do
{
Expand All @@ -39,7 +41,9 @@
end

it do
is_expected.to contain_apt__key('Add key: A2923DFF56EDA6E76E55E492D3A80E30382E94DE from Apt::Source datadog')\
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')\
.with_server('hkp://pool.sks-keyservers.net:80')
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')\
.with_server('hkp://pool.sks-keyservers.net:80')
end
end
Expand Down Expand Up @@ -87,8 +91,11 @@
end

# it should install the mirror
it { is_expected.not_to contain_apt__key('Add key: 935F5A436A5A6E8788F0765B226AE980C7A7DA52 from Apt::Source datadog') }
it { is_expected.to contain_apt__key('Add key: A2923DFF56EDA6E76E55E492D3A80E30382E94DE from Apt::Source datadog') }
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
it do
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')
end

it do
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')\
Expand Down Expand Up @@ -133,8 +140,8 @@
end

# it should install the mirror
it { is_expected.not_to contain_apt__key('Add key: 935F5A436A5A6E8788F0765B226AE980C7A7DA52 from Apt::Source datadog') }
it { is_expected.to contain_apt__key('Add key: A2923DFF56EDA6E76E55E492D3A80E30382E94DE from Apt::Source datadog') }
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
it { is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE') }

it do
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')\
Expand Down
⚡