1 From: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
2 Date: Mon, 22 Jan 2018 00:28:09 +0100
3 Subject: [PATCH] system.repo: Debian: Add keyserver proxy support
5 Introduce a new, optional set of parameters to configure the proxy
6 used for key fetching / keyserver access under:
7 linux:system:proxy:keyserver:http(s).
9 Previously, when fetching GPG keys for APT keyring, either using
10 public key download & import (as for default repos) or via keyserver,
11 we relied on simple `curl` calls or passed it down to Salt aptpkg
13 To be able to retrieve APT keys behind a proxy, one used to have to
14 configure the proxy for the Salt minion, which does not yet have
15 `no_proxy` support (either *all* or *no* traffic hits the proxy).
17 When the new http(s) proxy param is set:
18 - no longer pass key configuration to Salt aptpkg (until it properly
20 - handle all keys explicitly with `curl` and `apt-key`;
21 - set 'http(s)_proxy' env vars for `cmd.run`/`cmd.wait` calls;
23 If linux:system:proxy:keyserver is not defined, the behavior is
24 unchanged for backwards compatibility.
26 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
28 README.rst | 16 ++++++++++++++++
29 linux/system/repo.sls | 38 ++++++++++++++++++++++++++++++++++++++
30 2 files changed, 54 insertions(+)
32 diff --git a/linux/system/repo.sls b/linux/system/repo.sls
33 index 5d4d059..964db3f 100644
34 --- a/linux/system/repo.sls
35 +++ b/linux/system/repo.sls
36 @@ -96,13 +96,48 @@ linux_repo_{{ name }}_key:
37 - name: "curl -s {{ repo.key_url }} | apt-key add -"
39 - file: default_repo_list
41 + - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', None) }}
42 + - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', None) }}
46 +{#- repo.default is false #}
49 {%- if repo.get('enabled', True) %}
51 +{%- if system.proxy.keyserver is defined %}
53 +{%- if repo.get('key') %}
55 +linux_repo_{{ name }}_key:
57 + - name: "echo '{{ repo.key }}' | apt-key add -"
59 +{%- elif repo.key_url|default(False) %}
61 +linux_repo_{{ name }}_key:
63 + - name: "curl -s {{ repo.key_url }} | apt-key add -"
65 + - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', None) }}
66 + - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', None) }}
68 +{%- elif repo.key_id is defined and repo.key_server is defined %}
70 +linux_repo_{{ name }}_key:
72 + - name: "apt-key adv --keyserver {{ repo.key_server }} --recv {{ repo.key_id }}"
74 + - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', None) }}
75 + - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', None) }}
79 +{#- system.proxy.keyserver #}
82 linux_repo_{{ name }}:
84 {%- if repo.ppa is defined %}
85 @@ -115,6 +150,7 @@ linux_repo_{{ name }}:
87 - file: /etc/apt/sources.list.d/{{ name }}.list
88 - clean_file: {{ repo.clean|default(True) }}
89 + {%- if system.proxy.keyserver is not defined %}
90 {%- if repo.key_id is defined %}
91 - keyid: {{ repo.key_id }}
93 @@ -124,6 +160,7 @@ linux_repo_{{ name }}:
94 {%- if repo.key_url is defined %}
95 - key_url: {{ repo.key_url }}
98 - consolidate: {{ repo.get('consolidate', False) }}
99 - clean_file: {{ repo.get('clean_file', False) }}
100 - refresh_db: {{ repo.get('refresh_db', True) }}
101 @@ -140,6 +177,7 @@ linux_repo_{{ name }}:
105 +{#- repo.enabled is false #}
108 linux_repo_{{ name }}_absent: