Use upstream apt module, expand Ubuntu support - #4

.fixtures.yml

@@ -6,3 +6,4 @@ fixtures:
      stdlib: "puppetlabs/stdlib"
      augeas_core: "puppetlabs/augeas_core"
      yumrepo: "puppetlabs/yumrepo_core"
+     apt: "puppetlabs/apt"

manifests/apt.pp

@@ -13,31 +13,19 @@
     }
   }
 
-  package { $::duo_unix::duo_package:
-    ensure  => $package_state,
-    require => [
-      File[$repo_file],
-      Exec['Duo Security GPG Import'],
-      Exec['duo-security-apt-update']
-    ]
-  }
-
-  file { $repo_file:
-    owner   => 'root',
-    group   => 'root',
-    mode    => '0644',
-    content => "deb ${repo_uri}/${facts['operatingsystem']} ${facts['lsbdistcodename']} main",
-    notify  => Exec['duo-security-apt-update']
-  }
-
-  exec { 'duo-security-apt-update':
-    command     => '/usr/bin/apt-get update',
-    refreshonly => true
-  }
+  if $::duo_unix::manage_repo {
+    apt::source { 'duosecurity':
+      location => $repo_uri,
+      repos    => 'main',
+      key      => {
+        'id'     => '08C2A645DDF240B85844068D7A450864C1A07A85',
+        'source' => 'https://duo.com/DUO-GPG-PUBLIC-KEY.asc'
+      }
+    }
 
-  exec { 'Duo Security GPG Import':
-    command => "/usr/bin/apt-key add ${::duo_unix::gpg_file}",
-    unless  => '/usr/bin/apt-key list | grep "Duo Security"',
-    notify  => Exec['duo-security-apt-update']
+    package { $::duo_unix::duo_package:
+      ensure  => $package_state,
+      require => Apt::Source['duosecurity'],
+    }
   }
 }

manifests/generic.pp

@@ -18,8 +18,7 @@
       group  => 'root',
       mode   => '0644',
       # Updated 2020-03, see https://help.duo.com/s/article/5503
-      source => 'puppet:///modules/duo_unix/DUO-GPG-PUBLIC-KEY',
-      notify => Exec['Duo Security GPG Import'];
+      source => "puppet:///modules/${module_name}/DUO-GPG-PUBLIC-KEY",
     }
   }
 

manifests/yum.pp

@@ -18,18 +18,12 @@
   }
 
   if $facts['os']['family'] == 'RedHat' and $::duo_unix::manage_repo {
-    exec { 'Duo Security GPG Import':
-      command => "/bin/rpm --import ${::duo_unix::gpg_file}",
-      unless  => "/bin/rpm -q gpg-pubkey-`echo $(gpg --throw-keyids < ${::duo_unix::gpg_file}) | cut --characters=11-18 | tr [A-Z] [a-z]`",
-      before  => Yumrepo['duosecurity'],
-      require => File[$::duo_unix::gpg_file];
-    }
-
     yumrepo { 'duosecurity':
       descr    => 'Duo Security Repository',
       baseurl  => "${repo_uri}/${os}/${releasever}/\$basearch",
       gpgcheck => '1',
       enabled  => '1',
+      gpgkey   => "file://${::duo_unix::gpg_file}",
       before   => Package[$::duo_unix::duo_package],
       require  => File[$::duo_unix::gpg_file];
     }

metadata.json

@@ -52,7 +52,9 @@
     {
       "operatingsystem": "Ubuntu",
       "operatingsystemrelease": [
-        "14.04"
+        "14.04",
+        "16.04",
+        "18.04"
       ]
     }
   ],

spec/classes/duo_unix_spec.rb

@@ -25,6 +25,8 @@
           case facts[:osfamily]
           when 'Debian'
             it { is_expected.to contain_class('duo_unix::apt') }
+            it { is_expected.to contain_file('/etc/apt/DUO-GPG-PUBLIC-KEY') }
+            it { is_expected.to contain_apt__source('duosecurity').that_comes_before('Package[duo-unix]') }
             it { is_expected.to contain_package('duo-unix').with_ensure('installed') }
             it {
               is_expected.to contain_service('ssh').with(
@@ -35,7 +37,6 @@
           when 'RedHat'
             it { is_expected.to contain_class('duo_unix::yum') }
             it { is_expected.to contain_file('/etc/pki/rpm-gpg/DUO-GPG-PUBLIC-KEY') }
-            it { is_expected.to contain_yumrepo('duosecurity') }
             it { is_expected.to contain_yumrepo('duosecurity').that_comes_before('Package[duo_unix]') }
             it { is_expected.to contain_package('duo_unix').with_ensure('installed') }
             it {