Import the zypper GPG key before templating the repo #6410
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
coderanger
reviewed
Sep 16, 2017
|
@coderanger I'm trying to find a better way to handle that import, but getting a reliable list is hard. |
tas50
force-pushed
the
zypper_gpg_key
branch
from
d181d6e to
a717477
Compare
tas50
force-pushed
the
zypper_gpg_key
branch
3 times, most recently
from
b6415d7 to
8bb1b8a
Compare
|
coderanger
reviewed
Sep 27, 2017
| end | ||
|
|
||
| declare_resource(:execute, "import gpg key from #{new_resource.gpgkey}") do | ||
| command "/bin/rpm --import #{new_resource.gpgkey}" |
There was a problem hiding this comment.
This can use the cache file to avoid downloading it twice.
| # | ||
| # @return [boolean] is the key already known by rpm | ||
| def key_installed?(key_path) | ||
| so = shell_out("rpm -qa gpg-pubkey*").run_command |
There was a problem hiding this comment.
the run_command isn't needed, that's handed by our mixin.
There was a problem hiding this comment.
That was cargo culted from apt. I'll get that cleaned up there as well later
| # | ||
| # @return [String] the fingerprint of the key | ||
| def key_fingerprint(key_path) | ||
| so = shell_out("gpg --with-fingerprint #{key_path}").run_command |
There was a problem hiding this comment.
This should be shell_out! since a failure is not expected, also no run_command.
tas50
force-pushed
the
zypper_gpg_key
branch
from
8bb1b8a to
9df8f9e
Compare
|
I'm not sure about the key importing via fingerprint to be honest. The goal here was to mostly just maintain compat with the behavior of the existing zypper cookbook. We have that and now we can take local keys as well, which is a nice addition thanks to the apt cargo culting. |
|
Next step here is to make sure it works on various versions of SLES and not just opensuse leap, which is where I did my testing. Once that's done I'll get testing on the various methods here. |
|
Works for me re: importing from fingerprint, happy to YAGNI it until someone complains :) |
coderanger
approved these changes
Sep 28, 2017
|
Converges were successful for the nginx repo on: openSUSE Leap 42.2 |
This prevents failures when the key is unknown. This way is *simple*, but I'm not a fan of the way the :before notification results in double template logging. I'm open to a better way that provides some idempotency to the key import. Signed-off-by: Tim Smith <[email protected]>
Signed-off-by: Tim Smith <[email protected]>
GPG import doesn't actually work here. Signed-off-by: Tim Smith <[email protected]>
Signed-off-by: Tim Smith <[email protected]>
Download the key to the cache Grab the key's fingerprint Check to see if that fingerprint is in the RPM database Add it if it's not Signed-off-by: Tim Smith <[email protected]>
Signed-off-by: Tim Smith <[email protected]>
Avoid double downloading the key Signed-off-by: Tim Smith <[email protected]>
Signed-off-by: Tim Smith <[email protected]>
Also fix the cookbook_file lookup logic missing a method it needed for file based keys Signed-off-by: Tim Smith <[email protected]>
tas50
force-pushed
the
zypper_gpg_key
branch
2 times, most recently
from
1e643c3 to
0713896
Compare
Signed-off-by: Tim Smith <[email protected]>
tas50
force-pushed
the
zypper_gpg_key
branch
from
0713896 to
7ec3601
Compare
coderanger
approved these changes
Oct 3, 2017
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This prevents failures when the key is unknown.
This way is simple, but I'm not a fan of the way the :before notification results in double template logging. I'm open to a better way that provides some idempotency to the key import.
Signed-off-by: Tim Smith [email protected]