Skip to content

Commit f9fb91f

Browse files
mx-psimx-psi
authored
Trust new APT and RPM keys (DataDog#667)
* Trust new RPM key * Trust new APT key * Handle keys importing through the gpgkey section The removed section was irrelevant since if keys are not available RPM will automatically import them.
1 parent 8a00f1e commit f9fb91f

4 files changed

Lines changed: 39 additions & 41 deletions

File tree

‎manifests/redhat.pp‎

Lines changed: 10 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -12,18 +12,24 @@
1212

1313
if $manage_repo {
1414

15+
$keys = [
16+
'https://yum.datadoghq.com/DATADOG_RPM_KEY.public',
17+
'https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public',
18+
'https://yum.datadoghq.com/DATADOG_RPM_KEY_20200908.public',
19+
]
20+
1521
case $agent_major_version {
1622
5 : {
1723
$defaulturl = "https://yum.datadoghq.com/rpm/${::architecture}/"
18-
$gpgkey = 'https://yum.datadoghq.com/DATADOG_RPM_KEY.public'
24+
$gpgkeys = $keys
1925
}
2026
6 : {
2127
$defaulturl = "https://yum.datadoghq.com/stable/6/${::architecture}/"
22-
$gpgkey = 'https://yum.datadoghq.com/DATADOG_RPM_KEY.public'
28+
$gpgkeys = $keys
2329
}
2430
7 : {
2531
$defaulturl = "https://yum.datadoghq.com/stable/7/${::architecture}/"
26-
$gpgkey = 'https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public'
32+
$gpgkeys = $keys[1,2]
2733
}
2834
default: { fail('invalid agent_major_version') }
2935
}
@@ -34,23 +40,6 @@
3440
$baseurl = $defaulturl
3541
}
3642

37-
$public_key_local = '/etc/pki/rpm-gpg/DATADOG_RPM_KEY.public'
38-
39-
file { 'DATADOG_RPM_KEY_E09422B3.public':
40-
owner => root,
41-
group => root,
42-
mode => '0600',
43-
path => $public_key_local,
44-
source => 'https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public'
45-
}
46-
47-
exec { 'install-gpg-key':
48-
command => "/bin/rpm --import ${public_key_local}",
49-
onlyif => "/usr/bin/gpg --dry-run --quiet --with-fingerprint -n ${public_key_local} | grep 'A4C0 B90D 7443 CF6E 4E8A A341 F106 8E14 E094 22B3' || gpg --dry-run --import --import-options import-show ${public_key_local} | grep 'A4C0B90D7443CF6E4E8AA341F1068E14E09422B3'",
50-
unless => '/bin/rpm -q gpg-pubkey-e09422b3',
51-
require => File['DATADOG_RPM_KEY_E09422B3.public'],
52-
}
53-
5443
yumrepo { 'datadog-beta':
5544
ensure => absent,
5645
}
@@ -66,10 +55,9 @@
6655
yumrepo {'datadog':
6756
enabled => 1,
6857
gpgcheck => 1,
69-
gpgkey => $gpgkey,
58+
gpgkey => join($gpgkeys, "\n "),
7059
descr => 'Datadog, Inc.',
7160
baseurl => $baseurl,
72-
require => Exec['install-gpg-key'],
7361
}
7462

7563
package { $datadog_agent::params::package_name:

‎manifests/ubuntu.pp‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@
55

66
class datadog_agent::ubuntu(
77
Integer $agent_major_version = $datadog_agent::params::default_agent_major_version,
8-
String $apt_key = 'A2923DFF56EDA6E76E55E492D3A80E30382E94DE',
8+
Array[String] $apt_keys = ['A2923DFF56EDA6E76E55E492D3A80E30382E94DE', 'D75CEA17048B9ACBF186794B32637D44F14F620E'],
99
String $agent_version = $datadog_agent::params::agent_version,
1010
Optional[String] $agent_repo_uri = undef,
1111
String $release = $datadog_agent::params::apt_default_release,
1212
Boolean $skip_apt_key_trusting = false,
13-
Optional[String] $apt_keyserver = undef,
13+
String $apt_keyserver = $datadog_agent::params::apt_keyserver,
1414
) inherits datadog_agent::params {
1515

1616
if $agent_version =~ /^[0-9]+\.[0-9]+\.[0-9]+((?:~|-)[^0-9\s-]+[^-\s]*)?$/ {
@@ -28,12 +28,12 @@
2828
}
2929

3030
if !$skip_apt_key_trusting {
31-
$key = {
32-
'id' => $apt_key,
33-
'server' => $apt_keyserver,
31+
$apt_keys.each |String $apt_key| {
32+
apt::key { $apt_key:
33+
id => $apt_key,
34+
server => $apt_keyserver,
35+
}
3436
}
35-
} else {
36-
$key = {}
3737
}
3838

3939
if ($agent_repo_uri != undef) {
@@ -59,7 +59,6 @@
5959
location => $location,
6060
release => $release,
6161
repos => $repos,
62-
key => $key,
6362
}
6463

6564
package { 'datadog-agent-base':
@@ -72,5 +71,4 @@
7271
require => [Apt::Source['datadog'],
7372
Class['apt::update']],
7473
}
75-
7674
}

‎spec/classes/datadog_agent_redhat_spec.rb‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,9 @@
2727
is_expected.to contain_yumrepo('datadog')
2828
.with_enabled(1)\
2929
.with_gpgcheck(1)\
30-
.with_gpgkey('https://yum.datadoghq.com/DATADOG_RPM_KEY.public')\
30+
.with_gpgkey('https://yum.datadoghq.com/DATADOG_RPM_KEY.public
31+
https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
32+
https://yum.datadoghq.com/DATADOG_RPM_KEY_20200908.public')\
3133
.with_baseurl('https://yum.datadoghq.com/rpm/x86_64/')
3234
end
3335
end
@@ -72,7 +74,9 @@
7274
is_expected.to contain_yumrepo('datadog')
7375
.with_enabled(1)\
7476
.with_gpgcheck(1)\
75-
.with_gpgkey('https://yum.datadoghq.com/DATADOG_RPM_KEY.public')\
77+
.with_gpgkey('https://yum.datadoghq.com/DATADOG_RPM_KEY.public
78+
https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
79+
https://yum.datadoghq.com/DATADOG_RPM_KEY_20200908.public')\
7680
.with_baseurl('https://yum.datadoghq.com/stable/6/x86_64/')
7781
end
7882
end
@@ -118,7 +122,8 @@
118122
is_expected.to contain_yumrepo('datadog')
119123
.with_enabled(1)\
120124
.with_gpgcheck(1)\
121-
.with_gpgkey('https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public')\
125+
.with_gpgkey('https://yum.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
126+
https://yum.datadoghq.com/DATADOG_RPM_KEY_20200908.public')\
122127
.with_baseurl('https://yum.datadoghq.com/stable/7/x86_64/')
123128
end
124129
end

‎spec/classes/datadog_agent_ubuntu_spec.rb‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,12 @@
2727
end
2828

2929
# it should install the mirror
30-
it { is_expected.not_to contain_apt__key('Add key: 935F5A436A5A6E8788F0765B226AE980C7A7DA52 from Apt::Source datadog') }
30+
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
3131
it do
32-
is_expected.to contain_apt__key('Add key: A2923DFF56EDA6E76E55E492D3A80E30382E94DE from Apt::Source datadog')
32+
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')
33+
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')
3334
end
35+
3436
context 'overriding keyserver' do
3537
let(:params) do
3638
{
@@ -39,7 +41,9 @@
3941
end
4042

4143
it do
42-
is_expected.to contain_apt__key('Add key: A2923DFF56EDA6E76E55E492D3A80E30382E94DE from Apt::Source datadog')\
44+
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')\
45+
.with_server('hkp://pool.sks-keyservers.net:80')
46+
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')\
4347
.with_server('hkp://pool.sks-keyservers.net:80')
4448
end
4549
end
@@ -87,8 +91,11 @@
8791
end
8892

8993
# it should install the mirror
90-
it { is_expected.not_to contain_apt__key('Add key: 935F5A436A5A6E8788F0765B226AE980C7A7DA52 from Apt::Source datadog') }
91-
it { is_expected.to contain_apt__key('Add key: A2923DFF56EDA6E76E55E492D3A80E30382E94DE from Apt::Source datadog') }
94+
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
95+
it do
96+
is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE')
97+
is_expected.to contain_apt__key('D75CEA17048B9ACBF186794B32637D44F14F620E')
98+
end
9299

93100
it do
94101
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')\
@@ -133,8 +140,8 @@
133140
end
134141

135142
# it should install the mirror
136-
it { is_expected.not_to contain_apt__key('Add key: 935F5A436A5A6E8788F0765B226AE980C7A7DA52 from Apt::Source datadog') }
137-
it { is_expected.to contain_apt__key('Add key: A2923DFF56EDA6E76E55E492D3A80E30382E94DE from Apt::Source datadog') }
143+
it { is_expected.not_to contain_apt__key('935F5A436A5A6E8788F0765B226AE980C7A7DA52') }
144+
it { is_expected.to contain_apt__key('A2923DFF56EDA6E76E55E492D3A80E30382E94DE') }
138145

139146
it do
140147
is_expected.to contain_file('/etc/apt/sources.list.d/datadog6.list')\

0 commit comments

Comments
 (0)
⚡