From 33acc00e5c6d8ab18f2992cccc8ee036b4d7771d Mon Sep 17 00:00:00 2001
From: Antoine Beaupré <anarcat@koumbit.org>
Date: Thu, 11 Jun 2015 10:07:47 -0400
Subject: add apt::key resource to deploy arbitrary keys

the rationale of this is that isn't useful for third party modules,
because they cannot inject keys in there without some serious apt
class hijacking
---
 manifests/key.pp | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 manifests/key.pp

(limited to 'manifests/key.pp')

diff --git a/manifests/key.pp b/manifests/key.pp
new file mode 100644
index 0000000..0ef9721
--- /dev/null
+++ b/manifests/key.pp
@@ -0,0 +1,13 @@
+define apt::key ($source) {
+  file {
+    "${apt::apt_base_dir}/${name}":
+      source  => $source;
+    "${apt::apt_base_dir}/keys":
+      ensure  => directory;
+  }
+  exec { "apt-key add ${apt::apt_base_dir}/${name}":
+    subscribe   => File["${apt::apt_base_dir}/${name}"],
+    refreshonly => true,
+    notify      => Exec['refresh_apt'],
+  }
+}
-- 
cgit v1.2.3


From 891aa0fbbed87e24322da7d3a80514f1bf94f0ac Mon Sep 17 00:00:00 2001
From: Antoine Beaupré <anarcat@koumbit.org>
Date: Thu, 11 Jun 2015 10:21:56 -0400
Subject: allow for binary keys that can be removed

---
 README                 | 25 +++++++++++++++++++++++--
 manifests/key.pp       | 15 +++++----------
 manifests/key/plain.pp | 13 +++++++++++++
 3 files changed, 41 insertions(+), 12 deletions(-)
 create mode 100644 manifests/key/plain.pp

(limited to 'manifests/key.pp')

diff --git a/README b/README
index 835db79..d2cb71b 100644
--- a/README
+++ b/README
@@ -485,8 +485,25 @@ Deploys a secure apt OpenPGP key. This usually accompanies the
 sources.list snippets above for third party repositories. For example,
 you would do:
 
-  apt::key { 'neurodebian.key':
-    source => 'puppet:///modules/site_apt/neurodebian.key',
+  apt::key { 'neurodebian.gpg':
+    ensure => present,
+    source => 'puppet:///modules/site_apt/neurodebian.gpg',
+  }
+
+This deploys the key in the `/etc/apt/trusted.gpg.d` directory, which
+is assumed by secure apt to be binary OpenPGP keys and *not*
+"ascii-armored" or "plain text" OpenPGP key material. For the latter,
+use `apt::key::plain`.
+
+apt::key::plain
+---------------
+
+Deploys a secure apt OpenPGP key. This usually accompanies the
+sources.list snippets above for third party repositories. For example,
+you would do:
+
+  apt::key::asc { 'neurodebian.asc':
+    source => 'puppet:///modules/site_apt/neurodebian.asc',
   }
 
 This deploys the key in the `${apt_base_dir}/keys` directory (as
@@ -495,6 +512,10 @@ this exists on top of `$custom_key_dir` is to allow a more
 decentralised distribution of those keys, without having all modules
 throw their keys in the same directory in the manifests.
 
+Note that this model does *not* currently allow keys to be removed!
+Use `apt::key` instead for a more practical, revokable approach, but
+that needs binary keys.
+
 apt::upgrade_package
 --------------------
 
diff --git a/manifests/key.pp b/manifests/key.pp
index 0ef9721..3f9660f 100644
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -1,13 +1,8 @@
-define apt::key ($source) {
+define apt::key ($ensure => 'present', $source) {
   file {
-    "${apt::apt_base_dir}/${name}":
-      source  => $source;
-    "${apt::apt_base_dir}/keys":
-      ensure  => directory;
-  }
-  exec { "apt-key add ${apt::apt_base_dir}/${name}":
-    subscribe   => File["${apt::apt_base_dir}/${name}"],
-    refreshonly => true,
-    notify      => Exec['refresh_apt'],
+    "/etc/apt/trusted.gpg.d/$name":
+      source => $source,
+      ensure => $ensure,
+      notify => Exec['refresh_apt'],
   }
 }
diff --git a/manifests/key/plain.pp b/manifests/key/plain.pp
new file mode 100644
index 0000000..a84e6dd
--- /dev/null
+++ b/manifests/key/plain.pp
@@ -0,0 +1,13 @@
+define apt::key::plain ($source) {
+  file {
+    "${apt::apt_base_dir}/${name}":
+      source  => $source;
+    "${apt::apt_base_dir}/keys":
+      ensure  => directory;
+  }
+  exec { "apt-key add ${apt::apt_base_dir}/${name}":
+    subscribe   => File["${apt::apt_base_dir}/${name}"],
+    refreshonly => true,
+    notify      => Exec['refresh_apt'],
+  }
+}
-- 
cgit v1.2.3


From 931076f85488e1b0f57aeaf67357a2443b18ffba Mon Sep 17 00:00:00 2001
From: Antoine Beaupré <anarcat@koumbit.org>
Date: Thu, 11 Jun 2015 10:32:40 -0400
Subject: fix typo

---
 manifests/key.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'manifests/key.pp')

diff --git a/manifests/key.pp b/manifests/key.pp
index 3f9660f..b396c1e 100644
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -1,4 +1,4 @@
-define apt::key ($ensure => 'present', $source) {
+define apt::key ($ensure = 'present', $source) {
   file {
     "/etc/apt/trusted.gpg.d/$name":
       source => $source,
-- 
cgit v1.2.3