From 33acc00e5c6d8ab18f2992cccc8ee036b4d7771d Mon Sep 17 00:00:00 2001
From: Antoine Beaupré <anarcat@koumbit.org>
Date: Thu, 11 Jun 2015 10:07:47 -0400
Subject: add apt::key resource to deploy arbitrary keys

the rationale of this is that isn't useful for third party modules,
because they cannot inject keys in there without some serious apt
class hijacking
---
 manifests/key.pp | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 manifests/key.pp

(limited to 'manifests/key.pp')

diff --git a/manifests/key.pp b/manifests/key.pp
new file mode 100644
index 0000000..0ef9721
--- /dev/null
+++ b/manifests/key.pp
@@ -0,0 +1,13 @@
+define apt::key ($source) {
+  file {
+    "${apt::apt_base_dir}/${name}":
+      source  => $source;
+    "${apt::apt_base_dir}/keys":
+      ensure  => directory;
+  }
+  exec { "apt-key add ${apt::apt_base_dir}/${name}":
+    subscribe   => File["${apt::apt_base_dir}/${name}"],
+    refreshonly => true,
+    notify      => Exec['refresh_apt'],
+  }
+}
-- 
cgit v1.2.3


From 891aa0fbbed87e24322da7d3a80514f1bf94f0ac Mon Sep 17 00:00:00 2001
From: Antoine Beaupré <anarcat@koumbit.org>
Date: Thu, 11 Jun 2015 10:21:56 -0400
Subject: allow for binary keys that can be removed

---
 README                 | 25 +++++++++++++++++++++++--
 manifests/key.pp       | 15 +++++----------
 manifests/key/plain.pp | 13 +++++++++++++
 3 files changed, 41 insertions(+), 12 deletions(-)
 create mode 100644 manifests/key/plain.pp

(limited to 'manifests/key.pp')

diff --git a/README b/README
index 835db79..d2cb71b 100644
--- a/README
+++ b/README
@@ -485,8 +485,25 @@ Deploys a secure apt OpenPGP key. This usually accompanies the
 sources.list snippets above for third party repositories. For example,
 you would do:
 
-  apt::key { 'neurodebian.key':
-    source => 'puppet:///modules/site_apt/neurodebian.key',
+  apt::key { 'neurodebian.gpg':
+    ensure => present,
+    source => 'puppet:///modules/site_apt/neurodebian.gpg',
+  }
+
+This deploys the key in the `/etc/apt/trusted.gpg.d` directory, which
+is assumed by secure apt to be binary OpenPGP keys and *not*
+"ascii-armored" or "plain text" OpenPGP key material. For the latter,
+use `apt::key::plain`.
+
+apt::key::plain
+---------------
+
+Deploys a secure apt OpenPGP key. This usually accompanies the
+sources.list snippets above for third party repositories. For example,
+you would do:
+
+  apt::key::asc { 'neurodebian.asc':
+    source => 'puppet:///modules/site_apt/neurodebian.asc',
   }
 
 This deploys the key in the `${apt_base_dir}/keys` directory (as
@@ -495,6 +512,10 @@ this exists on top of `$custom_key_dir` is to allow a more
 decentralised distribution of those keys, without having all modules
 throw their keys in the same directory in the manifests.
 
+Note that this model does *not* currently allow keys to be removed!
+Use `apt::key` instead for a more practical, revokable approach, but
+that needs binary keys.
+
 apt::upgrade_package
 --------------------
 
diff --git a/manifests/key.pp b/manifests/key.pp
index 0ef9721..3f9660f 100644
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -1,13 +1,8 @@
-define apt::key ($source) {
+define apt::key ($ensure => 'present', $source) {
   file {
-    "${apt::apt_base_dir}/${name}":
-      source  => $source;
-    "${apt::apt_base_dir}/keys":
-      ensure  => directory;
-  }
-  exec { "apt-key add ${apt::apt_base_dir}/${name}":
-    subscribe   => File["${apt::apt_base_dir}/${name}"],
-    refreshonly => true,
-    notify      => Exec['refresh_apt'],
+    "/etc/apt/trusted.gpg.d/$name":
+      source => $source,
+      ensure => $ensure,
+      notify => Exec['refresh_apt'],
   }
 }
diff --git a/manifests/key/plain.pp b/manifests/key/plain.pp
new file mode 100644
index 0000000..a84e6dd
--- /dev/null
+++ b/manifests/key/plain.pp
@@ -0,0 +1,13 @@
+define apt::key::plain ($source) {
+  file {
+    "${apt::apt_base_dir}/${name}":
+      source  => $source;
+    "${apt::apt_base_dir}/keys":
+      ensure  => directory;
+  }
+  exec { "apt-key add ${apt::apt_base_dir}/${name}":
+    subscribe   => File["${apt::apt_base_dir}/${name}"],
+    refreshonly => true,
+    notify      => Exec['refresh_apt'],
+  }
+}
-- 
cgit v1.2.3


From 931076f85488e1b0f57aeaf67357a2443b18ffba Mon Sep 17 00:00:00 2001
From: Antoine Beaupré <anarcat@koumbit.org>
Date: Thu, 11 Jun 2015 10:32:40 -0400
Subject: fix typo

---
 manifests/key.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'manifests/key.pp')

diff --git a/manifests/key.pp b/manifests/key.pp
index 3f9660f..b396c1e 100644
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -1,4 +1,4 @@
-define apt::key ($ensure => 'present', $source) {
+define apt::key ($ensure = 'present', $source) {
   file {
     "/etc/apt/trusted.gpg.d/$name":
       source => $source,
-- 
cgit v1.2.3


From dc1a19e6cb7f05815f95f90033d212758f59744b Mon Sep 17 00:00:00 2001
From: intrigeri <intrigeri@boum.org>
Date: Mon, 31 Aug 2015 09:54:28 +0000
Subject: Linting.

---
 manifests/key.pp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'manifests/key.pp')

diff --git a/manifests/key.pp b/manifests/key.pp
index b396c1e..7be526e 100644
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -1,8 +1,8 @@
-define apt::key ($ensure = 'present', $source) {
+define apt::key ($source, $ensure = 'present') {
   file {
-    "/etc/apt/trusted.gpg.d/$name":
-      source => $source,
+    "/etc/apt/trusted.gpg.d/${name}":
       ensure => $ensure,
+      source => $source,
       notify => Exec['refresh_apt'],
   }
 }
-- 
cgit v1.2.3


From 5f7232b420e02eaa38c14a7be75034d9b3cdd64b Mon Sep 17 00:00:00 2001
From: intrigeri <intrigeri@boum.org>
Date: Mon, 31 Aug 2015 10:00:09 +0000
Subject: Add validation for apt::key's name.

It's great to document requirements in README, but error'ing out whenever
the user messes up is even better IMO.
---
 README           | 1 +
 manifests/key.pp | 5 +++++
 2 files changed, 6 insertions(+)

(limited to 'manifests/key.pp')

diff --git a/README b/README
index 85cf6df..1a83ac9 100644
--- a/README
+++ b/README
@@ -99,6 +99,7 @@ This module needs:
 
 - the lsb module: git://labs.riseup.net/shared-lsb
 - the common module: git://labs.riseup.net/shared-common
+- the stdlib module: https://forge.puppetlabs.com/puppetlabs/stdlib
 
 By default, on normal hosts, this module sets the configuration option
 DSelect::Clean to 'auto'. On virtual servers, the value is set by default to
diff --git a/manifests/key.pp b/manifests/key.pp
index 7be526e..65b62e9 100644
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -1,4 +1,9 @@
 define apt::key ($source, $ensure = 'present') {
+  validate_re(
+    $name, '\.gpg$',
+    'An apt::key resource name must have the .gpg extension',
+  )
+
   file {
     "/etc/apt/trusted.gpg.d/${name}":
       ensure => $ensure,
-- 
cgit v1.2.3


From f12b007edd557e91359fd9a5fba57f49e4a59a04 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 26 Jan 2016 14:42:17 +0100
Subject: [refactor] Unify `apt-get update` into one resource

Before, there were two Execs that did an `apt-get update`,
`Exec[refresh_apt]` and `Exec[apt_updated]`, which were triggered
by different resources.
This changes gets rid of the first one, and all resources now depend
on `Exec[apt_updated]`.
---
 README                           | 38 +++++++++++++++++++-------------------
 manifests/apt_conf.pp            |  2 +-
 manifests/dist_upgrade.pp        | 11 +----------
 manifests/dot_d_directories.pp   | 11 ++---------
 manifests/init.pp                | 14 +++++++++++++-
 manifests/key.pp                 |  2 +-
 manifests/key/plain.pp           |  2 +-
 manifests/preferences_snippet.pp |  2 +-
 manifests/sources_list.pp        |  2 +-
 manifests/update.pp              | 12 +++---------
 10 files changed, 43 insertions(+), 53 deletions(-)

(limited to 'manifests/key.pp')

diff --git a/README b/README
index 410201d..e097a7e 100644
--- a/README
+++ b/README
@@ -17,6 +17,14 @@ Ubuntu support is lagging behind but not absent either.
 
 ! Upgrade Notice !
 
+ * The `disable_update` parameter has been removed. The main apt class
+   defaults to *not* run an `apt-get update` on every run anyway so this
+   parameter seems useless.
+   You can include the `apt::update` class if you want it to be run every time.
+
+ * The `apt::upgrade_package` now doesn't automatically call an Exec['apt_updated']
+   anymore, so you would need to include `apt::update` now by hand.
+
  * The apt::codename parameter has been removed. In its place, the
    debian_codename fact may be overridden via an environment variable. This
    will affect all other debian_* facts, and achieve the same result.
@@ -188,15 +196,6 @@ Class parameters:
   If this variable is set the default repositories list ("main contrib non-free")
   is overriden.
 
-* disable_update
-
-  Disable "apt-get update" which is normally triggered by apt::upgrade_package 
-  and apt::dist_upgrade. 
-
-  Note that nodes can be updated once a day by using 
-    APT::Periodic::Update-Package-Lists "1";
-  in i.e. /etc/apt/apt.conf.d/80_apt_update_daily.
-
 * custom_preferences
 
   For historical reasons (Debian Lenny's version of APT did not support the use
@@ -296,9 +295,6 @@ classes may inherit from this one and add to its subscription list
 using the plusignment ('+>') operator. A real-world example can be
 seen in the apt::dist_upgrade::initiator source.
 
-When this class is included the APT indexes are updated on every
-Puppet run due to the author's lack of Puppet wizardry.
-
 apt::dist_upgrade::initiator
 ----------------------------
 
@@ -555,18 +551,22 @@ Exec['apt_updated']
 -------------------
 
 After this point the APT indexes are up-to-date.
+This resource is set to `refreshonly => true` so it is not run on
+every puppetrun. To run this every time, you can include the `apt::update`
+class.
 
 This resource is usually used like this to ensure current packages are
 installed by Package resources:
 
-  include apt::update
-  Package { require => Exec['apt_updated'] }
+    include apt::update
+    Package { require => Exec['apt_updated'] }
+
+Note that nodes can be updated once a day by using
+
+    APT::Periodic::Update-Package-Lists "1";
+
+in i.e. /etc/apt/apt.conf.d/80_apt_update_daily.
 
-Please note that the apt::upgrade_package define automatically uses
-this resource so you don't have to manage this yourself if you need to
-make sure APT indexes are up-to-date before a package upgrade is
-attempted, but don't want "apt-get update" to happen on every Puppet
-run.
 
 Tests
 =====
diff --git a/manifests/apt_conf.pp b/manifests/apt_conf.pp
index f446c69..949f615 100644
--- a/manifests/apt_conf.pp
+++ b/manifests/apt_conf.pp
@@ -38,7 +38,7 @@ define apt::apt_conf(
 
   if $refresh_apt {
     File["/etc/apt/apt.conf.d/${name}"] {
-      notify => Exec['refresh_apt'],
+      notify => Exec['apt_updated'],
     }
   }
 
diff --git a/manifests/dist_upgrade.pp b/manifests/dist_upgrade.pp
index bf78dcc..19c031e 100644
--- a/manifests/dist_upgrade.pp
+++ b/manifests/dist_upgrade.pp
@@ -1,18 +1,9 @@
 class apt::dist_upgrade {
 
-  if $apt::disable_update == false {
-    include apt::update
-  }
-
-  $req = $apt::disable_update ? {
-    true    => undef,
-    default => Exec['apt_updated'],
-  }
-
   exec { 'apt_dist-upgrade':
     command     => '/usr/bin/apt-get -q -y -o \'DPkg::Options::=--force-confold\' dist-upgrade',
     refreshonly => true,
-    require     => $req
+    before      => Exec['apt_updated']
   }
 
 }
diff --git a/manifests/dot_d_directories.pp b/manifests/dot_d_directories.pp
index 37c3fc8..0ace863 100644
--- a/manifests/dot_d_directories.pp
+++ b/manifests/dot_d_directories.pp
@@ -5,18 +5,11 @@ class apt::dot_d_directories {
     '/etc/apt/apt.conf.d':
       ensure   => directory,
       checksum => mtime,
-      notify   => Exec['refresh_apt'];
+      notify   => Exec['apt_updated'];
     '/etc/apt/sources.list.d':
       ensure   => directory,
       checksum => mtime,
-      notify   => Exec['refresh_apt'];
-  }
-
-  exec {
-    # "&& sleep 1" is workaround for older(?) clients
-    'refresh_apt':
-      command     => '/usr/bin/apt-get update && sleep 1',
-      refreshonly => true,
+      notify   => Exec['apt_updated'];
   }
 
 }
diff --git a/manifests/init.pp b/manifests/init.pp
index 1e7ddd7..f9f9357 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -50,7 +50,7 @@ class apt(
     # additional sources should be included via the apt::sources_list define
     '/etc/apt/sources.list':
       content => $sources_content,
-      notify  => Exec['refresh_apt'],
+      notify  => Exec['apt_updated'],
       owner   => root,
       group   => 0,
       mode    => '0644';
@@ -137,4 +137,16 @@ class apt(
 
   # workaround for preseeded_package component
   file { [ '/var/cache', '/var/cache/local', '/var/cache/local/preseeding' ]: ensure => directory }
+
+  exec { 'update_apt':
+    command     => '/usr/bin/apt-get update && /usr/bin/apt-get autoclean',
+    require     => [
+      File['/etc/apt/apt.conf.d', '/etc/apt/preferences' ],
+      File['/etc/apt/sources.list'] ],
+    loglevel    => 'info',
+    refreshonly => true,
+    # Another Semaphor for all packages to reference
+    alias       => [ 'apt_updated', 'refresh_apt']
+  }
+
 }
diff --git a/manifests/key.pp b/manifests/key.pp
index 65b62e9..cb70ec6 100644
--- a/manifests/key.pp
+++ b/manifests/key.pp
@@ -8,6 +8,6 @@ define apt::key ($source, $ensure = 'present') {
     "/etc/apt/trusted.gpg.d/${name}":
       ensure => $ensure,
       source => $source,
-      notify => Exec['refresh_apt'],
+      notify => Exec['apt_updated'],
   }
 }
diff --git a/manifests/key/plain.pp b/manifests/key/plain.pp
index e4a2f89..dff8b51 100644
--- a/manifests/key/plain.pp
+++ b/manifests/key/plain.pp
@@ -8,6 +8,6 @@ define apt::key::plain ($source) {
   exec { "apt-key add '${apt::apt_base_dir}/keys/${name}'":
     subscribe   => File["${apt::apt_base_dir}/keys/${name}"],
     refreshonly => true,
-    notify      => Exec['refresh_apt'],
+    notify      => Exec['apt_updated'],
   }
 }
diff --git a/manifests/preferences_snippet.pp b/manifests/preferences_snippet.pp
index 99feac4..b7dba0d 100644
--- a/manifests/preferences_snippet.pp
+++ b/manifests/preferences_snippet.pp
@@ -32,7 +32,7 @@ define apt::preferences_snippet (
   file { "/etc/apt/preferences.d/${name}":
     ensure => $ensure,
     owner  => root, group => 0, mode => '0644',
-    before => Exec['refresh_apt'];
+    before => Exec['apt_updated'];
   }
 
   case $source {
diff --git a/manifests/sources_list.pp b/manifests/sources_list.pp
index aefad2d..0ee068d 100644
--- a/manifests/sources_list.pp
+++ b/manifests/sources_list.pp
@@ -23,7 +23,7 @@ define apt::sources_list (
   file { "/etc/apt/sources.list.d/${realname}.list":
     ensure => $ensure,
     owner  => root, group => 0, mode => '0644',
-    notify => Exec['refresh_apt'],
+    notify => Exec['apt_updated'],
   }
 
   if $source {
diff --git a/manifests/update.pp b/manifests/update.pp
index 3f45125..dde8320 100644
--- a/manifests/update.pp
+++ b/manifests/update.pp
@@ -1,13 +1,7 @@
-class apt::update {
+class apt::update inherits ::apt {
 
-  exec { 'update_apt':
-    command => '/usr/bin/apt-get update && /usr/bin/apt-get autoclean',
-    require => [
-                File['/etc/apt/apt.conf.d', '/etc/apt/preferences' ],
-                File['/etc/apt/sources.list'] ],
-    loglevel => info,
-    # Another Semaphor for all packages to reference
-    alias => 'apt_updated'
+  Exec['update_apt'] {
+    refreshonly => false
   }
 
 }
-- 
cgit v1.2.3