aboutsummaryrefslogtreecommitdiff
path: root/README
diff options
context:
space:
mode:
authorintrigeri <intrigeri@boum.org>2015-08-31 09:51:45 +0000
committerintrigeri <intrigeri@boum.org>2015-08-31 09:51:45 +0000
commit1e81ba185e3d1bd598542aa1e58fe6ae9389af87 (patch)
treed5d6b98844b11eb9eb52ba52ae59fe97c6d9daf2 /README
parent58cfaa32f9de6c38157b2680fbf59da400b8f940 (diff)
parent544796e0502e1377fc374bc9092a0ae8d8392be0 (diff)
downloadpuppet-apt-1e81ba185e3d1bd598542aa1e58fe6ae9389af87.tar.gz
puppet-apt-1e81ba185e3d1bd598542aa1e58fe6ae9389af87.tar.bz2
Merge remote-tracking branch 'shared/key' into tmp
Diffstat (limited to 'README')
-rw-r--r--README40
1 files changed, 40 insertions, 0 deletions
diff --git a/README b/README
index 8333be2..85cf6df 100644
--- a/README
+++ b/README
@@ -478,6 +478,46 @@ Example:
'puppet:///modules/site_apt/company_internals.list' ],
}
+apt::key
+--------
+
+Deploys a secure apt OpenPGP key. This usually accompanies the
+sources.list snippets above for third party repositories. For example,
+you would do:
+
+ apt::key { 'neurodebian.gpg':
+ ensure => present,
+ source => 'puppet:///modules/site_apt/neurodebian.gpg',
+ }
+
+This deploys the key in the `/etc/apt/trusted.gpg.d` directory, which
+is assumed by secure apt to be binary OpenPGP keys and *not*
+"ascii-armored" or "plain text" OpenPGP key material. For the latter,
+use `apt::key::plain`.
+
+The `.gpg` extension is compulsory for `apt` to pickup the key properly.
+
+apt::key::plain
+---------------
+
+Deploys a secure apt OpenPGP key. This usually accompanies the
+sources.list snippets above for third party repositories. For example,
+you would do:
+
+ apt::key::plain { 'neurodebian.asc':
+ source => 'puppet:///modules/site_apt/neurodebian.asc',
+ }
+
+This deploys the key in the `${apt_base_dir}/keys` directory (as
+opposed to `$custom_key_dir` which deploys it in `keys.d`). The reason
+this exists on top of `$custom_key_dir` is to allow a more
+decentralised distribution of those keys, without having all modules
+throw their keys in the same directory in the manifests.
+
+Note that this model does *not* currently allow keys to be removed!
+Use `apt::key` instead for a more practical, revokable approach, but
+that needs binary keys.
+
apt::upgrade_package
--------------------