Skip to content

Commit bebc2ab

Browse files
author
Slavek Kabrda
authored
Improvements for APT keys management (DataDog#698)
* By default, get keys from keys.datadoghq.com, not Ubuntu keyserver * Always add the DATADOG_APT_KEY_CURRENT.public key (contains key used to sign current repodata) * Add 'signed-by' option to all sources list lines * On Debian >= 9 and Ubuntu >= 16, only add keys to /usr/share/keyrings/datadog-archive-keyring.gpg * On older systems, also add the same keyring to /etc/apt/trusted.gpg.d
1 parent 6c75647 commit bebc2ab

5 files changed

Lines changed: 146 additions & 73 deletions

File tree

‎manifests/init.pp‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -342,9 +342,11 @@
342342
Hash[String[1], Data] $agent_extra_options = {},
343343
Optional[String] $agent_repo_uri = undef,
344344
Optional[Boolean] $rpm_repo_gpgcheck = undef,
345-
Optional[Boolean] $use_apt_backup_keyserver = $datadog_agent::params::use_apt_backup_keyserver,
346-
String $apt_backup_keyserver = $datadog_agent::params::apt_backup_keyserver,
347-
String $apt_keyserver = $datadog_agent::params::apt_keyserver,
345+
# TODO: $use_apt_backup_keyserver, $apt_backup_keyserver and $apt_keyserver can be
346+
# removed in the next major version; they're kept now for backwards compatibility
347+
Optional[Boolean] $use_apt_backup_keyserver = undef,
348+
Optional[String] $apt_backup_keyserver = undef,
349+
Optional[String] $apt_keyserver = undef,
348350
String $apt_release = $datadog_agent::params::apt_default_release,
349351
String $win_msi_location = 'C:/Windows/temp', # Temporary directory where the msi file is downloaded, must exist
350352
Enum['present', 'absent'] $win_ensure = 'present', #TODO: Implement uninstall also for apt and rpm install methods
@@ -424,10 +426,11 @@
424426
if $manage_install {
425427
case $::operatingsystem {
426428
'Ubuntu','Debian' : {
427-
if $use_apt_backup_keyserver {
428-
$_apt_keyserver = $apt_backup_keyserver
429-
} else {
430-
$_apt_keyserver = $apt_keyserver
429+
if $use_apt_backup_keyserver != undef or $apt_backup_keyserver != undef or $apt_keyserver != undef {
430+
notify { 'apt keyserver arguments deprecation':
431+
message => '$use_apt_backup_keyserver, $apt_backup_keyserver and $apt_keyserver are deprecated since version 3.13.0',
432+
loglevel => 'warning',
433+
}
431434
}
432435
class { 'datadog_agent::ubuntu':
433436
agent_major_version => $_agent_major_version,
@@ -436,7 +439,6 @@
436439
agent_repo_uri => $agent_repo_uri,
437440
release => $apt_release,
438441
skip_apt_key_trusting => $skip_apt_key_trusting,
439-
apt_keyserver => $_apt_keyserver,
440442
}
441443
}
442444
'RedHat','CentOS','Fedora','Amazon','Scientific','OracleLinux' : {

‎manifests/params.pp‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@
1919
$logs_enabled = false
2020
$logs_open_files_limit = undef
2121
$container_collect_all = false
22-
$use_apt_backup_keyserver = false
23-
$apt_backup_keyserver = 'hkp://pool.sks-keyservers.net:80'
24-
$apt_keyserver = 'hkp://keyserver.ubuntu.com:80'
2522
$sysprobe_service_name = 'datadog-agent-sysprobe'
2623
$module_metadata = load_module_metadata($module_name)
2724

‎manifests/ubuntu.pp‎

Lines changed: 34 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,18 @@
55

66
class datadog_agent::ubuntu(
77
Integer $agent_major_version = $datadog_agent::params::default_agent_major_version,
8-
Array[String] $apt_keys = ['A2923DFF56EDA6E76E55E492D3A80E30382E94DE', 'D75CEA17048B9ACBF186794B32637D44F14F620E'],
98
String $agent_version = $datadog_agent::params::agent_version,
109
Optional[String] $agent_repo_uri = undef,
1110
String $release = $datadog_agent::params::apt_default_release,
1211
Boolean $skip_apt_key_trusting = false,
13-
String $apt_keyserver = $datadog_agent::params::apt_keyserver,
1412
String $agent_flavor = $datadog_agent::params::package_name,
13+
Optional[String] $apt_trusted_d_keyring = '/etc/apt/trusted.gpg.d/datadog-archive-keyring.gpg',
14+
Optional[String] $apt_usr_share_keyring = '/usr/share/keyrings/datadog-archive-keyring.gpg',
15+
Optional[Hash[String, String]] $apt_default_keys = {
16+
'DATADOG_APT_KEY_CURRENT.public' => 'https://keys.datadoghq.com/DATADOG_APT_KEY_CURRENT.public',
17+
'D75CEA17048B9ACBF186794B32637D44F14F620E' => 'https://keys.datadoghq.com/DATADOG_APT_KEY_F14F620E.public',
18+
'A2923DFF56EDA6E76E55E492D3A80E30382E94DE' => 'https://keys.datadoghq.com/DATADOG_APT_KEY_382E94DE.public',
19+
},
1520
) inherits datadog_agent::params {
1621

1722
if $agent_version =~ /^[0-9]+\.[0-9]+\.[0-9]+((?:~|-)[^0-9\s-]+[^-\s]*)?$/ {
@@ -29,18 +34,40 @@
2934
}
3035

3136
if !$skip_apt_key_trusting {
32-
$apt_keys.each |String $apt_key| {
33-
apt::key { $apt_key:
34-
id => $apt_key,
35-
server => $apt_keyserver,
37+
file { $apt_usr_share_keyring:
38+
ensure => file,
39+
mode => '0644',
40+
}
41+
42+
$apt_default_keys.each |String $key_fingerprint, String $key_url| {
43+
$key_path = "/tmp/${key_fingerprint}"
44+
45+
file { $key_path:
46+
owner => root,
47+
group => root,
48+
mode => '0600',
49+
source => $key_url,
50+
}
51+
52+
exec { "ensure key ${key_fingerprint} is imported in APT keyring":
53+
command => "/bin/cat /tmp/${key_fingerprint} | gpg --import --batch --no-default-keyring --keyring ${apt_usr_share_keyring}",
54+
unless => "/bin/cat /tmp/${key_fingerprint} | gpg --dry-run --import --batch --no-default-keyring --keyring ${apt_usr_share_keyring} 2>&1 | grep 'unchanged: 1'",
55+
}
56+
}
57+
58+
if ($::operatingsystem == 'Ubuntu' and versioncmp($::operatingsystemrelease, '16') == -1) or
59+
($::operatingsystem == 'Debian' and versioncmp($::operatingsystemrelease, '9') == -1) {
60+
file { $apt_trusted_d_keyring:
61+
mode => '0644',
62+
source => "file://${apt_usr_share_keyring}",
3663
}
3764
}
3865
}
3966

4067
if ($agent_repo_uri != undef) {
4168
$location = $agent_repo_uri
4269
} else {
43-
$location = 'https://apt.datadoghq.com/'
70+
$location = "[signed-by=${apt_usr_share_keyring}] https://apt.datadoghq.com/"
4471
}
4572

4673
apt::source { 'datadog-beta':

‎spec/classes/datadog_agent_spec.rb‎

Lines changed: 7 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434

3535
it do
3636
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
37-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+main})
37+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+main})
3838
end
3939
end
4040

@@ -53,7 +53,7 @@
5353

5454
it do
5555
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
56-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+6})
56+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+6})
5757
end
5858
end
5959

@@ -72,7 +72,7 @@
7272

7373
it do
7474
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
75-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+7})
75+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+7})
7676
end
7777
end
7878

@@ -91,7 +91,7 @@
9191

9292
it do
9393
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
94-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+6})
94+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+6})
9595
end
9696
end
9797

@@ -110,7 +110,7 @@
110110

111111
it do
112112
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
113-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+6})
113+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+6})
114114
end
115115
end
116116

@@ -129,7 +129,7 @@
129129

130130
it do
131131
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
132-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+6})
132+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+6})
133133
end
134134
end
135135

@@ -1606,25 +1606,7 @@
16061606
end
16071607
end
16081608

1609-
if DEBIAN_OS.include?(operatingsystem)
1610-
it do
1611-
is_expected.to contain_class('datadog_agent::ubuntu')\
1612-
.with_apt_keyserver('hkp://keyserver.ubuntu.com:80')
1613-
end
1614-
context 'use backup keyserver' do
1615-
let(:params) do
1616-
{
1617-
use_apt_backup_keyserver: true,
1618-
agent_major_version: 5,
1619-
}
1620-
end
1621-
1622-
it do
1623-
is_expected.to contain_class('datadog_agent::ubuntu')\
1624-
.with_apt_keyserver('hkp://pool.sks-keyservers.net:80')
1625-
end
1626-
end
1627-
elsif REDHAT_OS.include?(operatingsystem)
1609+
if REDHAT_OS.include?(operatingsystem)
16281610
it { is_expected.to contain_class('datadog_agent::redhat') }
16291611
end
16301612
end

‎spec/classes/datadog_agent_ubuntu_spec.rb‎

Lines changed: 95 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,25 @@
11
require 'spec_helper'
22

3+
shared_examples 'old debianoid' do
4+
it do
5+
is_expected.to contain_file('/usr/share/keyrings/datadog-archive-keyring.gpg')
6+
is_expected.to contain_file('/etc/apt/trusted.gpg.d/datadog-archive-keyring.gpg')
7+
is_expected.to contain_exec('ensure key DATADOG_APT_KEY_CURRENT.public is imported in APT keyring')
8+
is_expected.to contain_exec('ensure key D75CEA17048B9ACBF186794B32637D44F14F620E is imported in APT keyring')
9+
is_expected.to contain_exec('ensure key A2923DFF56EDA6E76E55E492D3A80E30382E94DE is imported in APT keyring')
10+
end
11+
end
12+
13+
shared_examples 'new debianoid' do
14+
it do
15+
is_expected.to contain_file('/usr/share/keyrings/datadog-archive-keyring.gpg')
16+
is_expected.not_to contain_file('/etc/apt/trusted.gpg.d/datadog-archive-keyring.gpg')
17+
is_expected.to contain_exec('ensure key DATADOG_APT_KEY_CURRENT.public is imported in APT keyring')
18+
is_expected.to contain_exec('ensure key D75CEA17048B9ACBF186794B32637D44F14F620E is imported in APT keyring')
19+
is_expected.to contain_exec('ensure key A2923DFF56EDA6E76E55E492D3A80E30382E94DE is imported in APT keyring')
20+
end
21+
end
22+
323
describe 'datadog_agent::ubuntu' do
424
context 'agent 5' do
525
if RSpec::Support::OS.windows?
@@ -23,30 +43,11 @@
2343
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')
2444
.with_ensure('absent')
2545
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
26-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+main})
46+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+main})
2747
end
2848

2949
# it should install the mirror
3050
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
31-
it do
32-
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')
33-
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')
34-
end
35-
36-
context 'overriding keyserver' do
37-
let(:params) do
38-
{
39-
apt_keyserver: 'hkp://pool.sks-keyservers.net:80',
40-
}
41-
end
42-
43-
it do
44-
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')\
45-
.with_server('hkp://pool.sks-keyservers.net:80')
46-
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')\
47-
.with_server('hkp://pool.sks-keyservers.net:80')
48-
end
49-
end
5051

5152
it do
5253
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
@@ -87,15 +88,11 @@
8788
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')
8889
.with_ensure('absent')
8990
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
90-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+6})
91+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+6})
9192
end
9293

9394
# it should install the mirror
9495
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
95-
it do
96-
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')
97-
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')
98-
end
9996

10097
it do
10198
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')\
@@ -136,13 +133,9 @@
136133
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')
137134
.with_ensure('absent')
138135
is_expected.to contain_file('/etc/apt/sources.list.d/datadog.list')\
139-
.with_content(%r{deb\s+https://apt.datadoghq.com/\s+stable\s+7})
136+
.with_content(%r{deb\s+\[signed-by=/usr/share/keyrings/datadog-archive-keyring.gpg\]\s+https://apt.datadoghq.com/\s+stable\s+7})
140137
end
141138

142-
# it should install the mirror
143-
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
144-
it { is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE') }
145-
146139
it do
147140
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')\
148141
.that_notifies('exec[apt_update]')
@@ -161,4 +154,76 @@
161154
.that_requires('exec[apt_update]')
162155
end
163156
end
157+
158+
context 'ubuntu < 16' do
159+
let(:params) do
160+
{
161+
agent_major_version: 7,
162+
}
163+
end
164+
165+
let(:facts) do
166+
{
167+
osfamily: 'debian',
168+
operatingsystem: 'Ubuntu',
169+
operatingsystemrelease: '14.04',
170+
}
171+
end
172+
173+
include_examples 'old debianoid'
174+
end
175+
176+
context 'ubuntu >= 16' do
177+
let(:params) do
178+
{
179+
agent_major_version: 7,
180+
}
181+
end
182+
183+
let(:facts) do
184+
{
185+
osfamily: 'debian',
186+
operatingsystem: 'Ubuntu',
187+
operatingsystemrelease: '16.04',
188+
}
189+
end
190+
191+
include_examples 'new debianoid'
192+
end
193+
194+
context 'debian < 9' do
195+
let(:params) do
196+
{
197+
agent_major_version: 7,
198+
}
199+
end
200+
201+
let(:facts) do
202+
{
203+
osfamily: 'debian',
204+
operatingsystem: 'Debian',
205+
operatingsystemrelease: '8.0',
206+
}
207+
end
208+
209+
include_examples 'old debianoid'
210+
end
211+
212+
context 'debian >= 9' do
213+
let(:params) do
214+
{
215+
agent_major_version: 7,
216+
}
217+
end
218+
219+
let(:facts) do
220+
{
221+
osfamily: 'debian',
222+
operatingsystem: 'Debian',
223+
operatingsystemrelease: '9.0',
224+
}
225+
end
226+
227+
include_examples 'new debianoid'
228+
end
164229
end

0 commit comments

Comments
 (0)
⚡