(PA-7437) Drop expired key and rotate "current" key #771
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
joshcooper
force-pushed
the
gpgkey
branch
2 times, most recently
from
fc309c0 to
dfcfa39
Compare
The GPG-KEY-puppet key expired 2025-01-02. Update it with the current one that
doesn't expire:
Before
```
$ openssl sha256 -r files/GPG-KEY-puppet
7908698a5b6c4ff2d555edd1a6d594d1c2071481e1e1f7fd753274a1ab201675 *files/GPG-KEY-puppet
$ gpg --show-keys --with-fingerprint --with-subkey-fingerprint files/GPG-KEY-puppet
pub rsa4096 2016-08-18 [SC] [expired: 2025-01-02]
6F6B 1550 9CF8 E59E 6E46 9F32 7F43 8280 EF8D 349F
uid Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com>
```
After
```
$ openssl sha256 -r files/GPG-KEY-puppet
246d96c86c5a322c2a5e63b2072a238508ad3c2c29795ea56a51a3d355514aca *files/GPG-KEY-puppet
$ gpg --show-keys --with-fingerprint --with-subkey-fingerprint files/GPG-KEY-puppet
pub rsa4096 2019-04-08 [SC]
D681 1ED3 ADEE B844 1AF5 AA8F 4528 B6CD 9E61 EF26
uid Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com>
sub rsa4096 2019-04-08 [E]
90A2 9D0A 6576 E2CA 185A ED3E F230 A24E 9F05 7A83
```
The new key matches other locations:
```
$ curl -sL https://apt.puppet.com/DEB-GPG-KEY-future | openssl sha256 -r
246d96c86c5a322c2a5e63b2072a238508ad3c2c29795ea56a51a3d355514aca *stdin
$ curl -sL https://yum.puppet.com/RPM-GPG-KEY-puppet | openssl sha256 -r
246d96c86c5a322c2a5e63b2072a238508ad3c2c29795ea56a51a3d355514aca *stdin
$ curl -sL https://yum-puppetcore.puppet.com/public/RPM-GPG-KEY-puppet | openssl sha256 -r
246d96c86c5a322c2a5e63b2072a238508ad3c2c29795ea56a51a3d355514aca *stdin
```
The key expired 2025-04-06, so delete it. Update manifests and task to refer to GPG-KEY-puppet that was rotated in the previous commit.
The `set_up_initial_agent_on` method is only ever called with the name of the collection, so remove the code that allowed an arbitrary version to be specified.
The release packages on nightlies.puppet.com contain the wrong GPG key and since those repos won't be updated, just use the previously released packages for now.
The puppet6 deb release packages contain a gpg keyring with a key that expired 225-04-06. If the release package is installed, then future apt-get update command will report errors: ``` $ wget https://apt.puppet.com/puppet6-release-bullseye.deb $ dpkg-deb -c puppet6-release-bullseye.deb | grep keyring -rw-r--r-- root/root 10352 2022-12-09 23:52 ./etc/apt/trusted.gpg.d/puppet6-keyring.gpg $ sudo dpkg -i puppet6-release-bullseye.deb $ sudo apt-get update Hit:1 http://deb.debian.org/debian bullseye InRelease Get:2 http://apt.puppetlabs.com bullseye InRelease [83.8 kB] Err:2 http://apt.puppetlabs.com bullseye InRelease The following signatures were invalid: EXPKEYSIG 4528B6CD9E61EF26 Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com> ``` Since puppet6 has been EOL for many years and we're not going to reissue puppet6 release packages, drop puppet 6 to puppet 7 upgrade tests in the puppet_agent module.
joshcooper
changed the title
mhashizume
approved these changes
Apr 9, 2025
mhashizume
approved these changes
Apr 9, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
GPG-KEY-puppet-20250406GPG-KEY-puppetto be the current key