+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+: Copyright (c) 2018 Mirantis Inc., Enea AB and others.
+:
+: All rights reserved. This program and the accompanying materials
+: are made available under the terms of the Apache License, Version 2.0
+: which accompanies this distribution, and is available at
+: http://www.apache.org/licenses/LICENSE-2.0
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
From: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
-Date: Mon, 22 Jan 2018 00:28:09 +0100
-Subject: [PATCH] system.repo: Debian: Add keyserver proxy support
-
-Introduce a new, optional set of parameters to configure the proxy
-used for key fetching / keyserver access under:
-linux:system:proxy:keyserver:http(s).
+Date: Sun, 3 Jun 2018 19:28:18 +0200
+Subject: [PATCH] system.repo: Debian: Use proxy for keyservers
Previously, when fetching GPG keys for APT keyring, either using
public key download & import (as for default repos) or via keyserver,
configure the proxy for the Salt minion, which does not yet have
`no_proxy` support (either *all* or *no* traffic hits the proxy).
-When the new http(s) proxy param is set:
+When `linux:system:proxy` http(s) proxies are set:
- no longer pass key configuration to Salt aptpkg (until it properly
supports `no_proxy`);
- handle all keys explicitly with `curl` and `apt-key`;
-- set 'http(s)_proxy' env vars for `cmd.run`/`cmd.wait` calls;
+- set 'http(s)_proxy' env vars for `cmd.wait` calls;
-If linux:system:proxy:keyserver is not defined, the behavior is
+If `linux:system:proxy` is not defined, the behavior is
unchanged for backwards compatibility.
+NOTE: If present, per-repo proxies are also used for keyserver access.
+
+system.repo: Fix conditions order for Debian proxy
+
Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
---
- README.rst | 16 ++++++++++++++++
- linux/system/repo.sls | 40 ++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 56 insertions(+)
+ linux/system/repo.sls | 55 ++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 47 insertions(+), 8 deletions(-)
diff --git a/linux/system/repo.sls b/linux/system/repo.sls
-index 5d4d059..724db5a 100644
+index 9664129..d9f567e 100644
--- a/linux/system/repo.sls
+++ b/linux/system/repo.sls
-@@ -96,13 +96,50 @@ linux_repo_{{ name }}_key:
- - name: "curl -s {{ repo.key_url }} | apt-key add -"
- - watch:
- - file: default_repo_list
-+{%- if system.proxy.keyserver is defined %}
-+ - env:
-+ - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', '') }}
-+ - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', '') }}
-+{%- endif %}
-
- {%- endif %}
-
-+{#- repo.default is false #}
- {%- else %}
-
- {%- if repo.get('enabled', True) %}
+@@ -7,18 +7,27 @@ linux_repo_prereq_pkgs:
+ - pkgs: {{ system.pkgs }}
+ {%- endif %}
-+{%- if system.proxy.keyserver is defined %}
++ {%- set proxies = {'system': {}, 'repo': {}} %}
+
-+{%- if repo.get('key') %}
+ # global proxy setup
+ {%- if grains.os_family == 'Debian' %}
+
-+linux_repo_{{ name }}_key:
-+ cmd.run:
-+ - name: "echo '{{ repo.key }}' | apt-key add -"
-+
-+{%- elif repo.key_url|default(False) %}
+ {%- if system.proxy.get('pkg', {}).get('enabled', False) %}
+
-+linux_repo_{{ name }}_key:
-+ cmd.run:
-+ - name: "curl -s {{ repo.key_url }} | apt-key add -"
-+ - env:
-+ - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', '') }}
-+ - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', '') }}
++ {%- do proxies.system.update({'https': system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true)}) %}
++ {%- do proxies.system.update({'http': system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true)}) %}
++ {%- do proxies.system.update({'ftp': system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true)}) %}
+
-+{%- elif repo.key_id is defined and repo.key_server is defined %}
+ /etc/apt/apt.conf.d/99proxies-salt:
+ file.managed:
+ - template: jinja
+ - source: salt://linux/files/apt.conf.d_proxies
+ - defaults:
+ external_host: False
+- https: {{ system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true) }}
+- http: {{ system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true) }}
+- ftp: {{ system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true) }}
++ https: {{ proxies.system.https }}
++ http: {{ proxies.system.http }}
++ ftp: {{ proxies.system.ftp }}
+
-+linux_repo_{{ name }}_key:
-+ cmd.run:
-+ - name: "apt-key adv --keyserver {{ repo.key_server }} --recv {{ repo.key_id }}"
+ {%- else %}
+ /etc/apt/apt.conf.d/99proxies-salt:
+ file.absent
+@@ -43,16 +52,20 @@ purge_sources_list_d_repos:
+ # per repository proxy setup
+ {%- if repo.get('proxy', {}).get('enabled', False) %}
+ {%- set external_host = repo.proxy.get('host', None) or repo.source.split('/')[2] %}
++ {%- do proxies.repo.update({'https': repo.proxy.get('https', None) or system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true)}) %}
++ {%- do proxies.repo.update({'http': repo.proxy.get('http', None) or system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true)}) %}
++ {%- do proxies.repo.update({'ftp': repo.proxy.get('ftp', None) or system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true)}) %}
+ /etc/apt/apt.conf.d/99proxies-salt-{{ name }}:
+ file.managed:
+ - template: jinja
+ - source: salt://linux/files/apt.conf.d_proxies
+ - defaults:
+ external_host: {{ external_host }}
+- https: {{ repo.proxy.get('https', None) or system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), True) }}
+- http: {{ repo.proxy.get('http', None) or system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), True) }}
+- ftp: {{ repo.proxy.get('ftp', None) or system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), True) }}
++ https: {{ proxies.repo.https }}
++ http: {{ proxies.repo.http }}
++ ftp: {{ proxies.repo.ftp }}
+ {%- else %}
++ {%- do proxies.repo.update({'https': None, 'http': None, 'ftp': None}) %}
+ /etc/apt/apt.conf.d/99proxies-salt-{{ name }}:
+ file.absent
+ {%- endif %}
+@@ -104,6 +117,13 @@ linux_repo_{{ name }}_key:
+ {% else %}
+ - pkgrepo: linux_repo_{{ name }}
+ {% endif %}
+ - env:
-+ - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', '') }}
-+ - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', '') }}
-+
-+{%- endif %}
-+
-+{#- system.proxy.keyserver #}
-+{%- endif %}
-+
++ {%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %}
++ - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }}
++ {%- endif %}
++ {%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %}
++ - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }}
++ {%- endif %}
+ {%- endif %}
+
+ {%- if repo.get('default', False) %}
+@@ -111,6 +131,9 @@ linux_repo_{{ name }}_key:
+ {%- else %}
+
+ {%- if repo.get('enabled', True) %}
++ {%- set use_proxy = ( ( proxies.repo.get('https', None) or proxies.system.get('https', None) or
++ proxies.repo.get('http', None) or proxies.system.get('http', None) ) and
++ repo.key_id is defined and repo.key_server is defined ) %}
linux_repo_{{ name }}:
pkgrepo.managed:
- {%- if repo.ppa is defined %}
-@@ -115,6 +152,7 @@ linux_repo_{{ name }}:
- {%- endif %}
+ - refresh_db: False
+@@ -126,10 +149,10 @@ linux_repo_{{ name }}:
+ {%- endif %}
- file: /etc/apt/sources.list.d/{{ name }}.list
- - clean_file: {{ repo.clean|default(True) }}
-+ {%- if system.proxy.keyserver is not defined %}
- {%- if repo.key_id is defined %}
+ - clean_file: {{ repo.get('clean_file', True) }}
+- {%- if repo.key_id is defined %}
++ {%- if not use_proxy and repo.key_id is defined %}
- keyid: {{ repo.key_id }}
- {%- endif %}
-@@ -124,6 +162,7 @@ linux_repo_{{ name }}:
- {%- if repo.key_url is defined %}
- - key_url: {{ repo.key_url }}
- {%- endif %}
-+ {%- endif %}
- - consolidate: {{ repo.get('consolidate', False) }}
- - clean_file: {{ repo.get('clean_file', False) }}
- - refresh_db: {{ repo.get('refresh_db', True) }}
-@@ -140,6 +179,7 @@ linux_repo_{{ name }}:
- {%- endif %}
- {%- endif %}
-
-+{#- repo.enabled is false #}
- {%- else %}
-
- linux_repo_{{ name }}_absent:
+ {%- endif %}
+- {%- if repo.key_server is defined %}
++ {%- if not use_proxy and repo.key_server is defined %}
+ - keyserver: {{ repo.key_server }}
+ {%- endif %}
+ {%- if repo.key_url is defined and (grains['saltversioninfo'] >= [2017, 7] or repo.key_url.startswith('salt://')) %}
+@@ -143,6 +166,22 @@ linux_repo_{{ name }}:
+ - file: purge_sources_list_d_repos
+ {%- endif %}
+ {%- endif %}
++ {%- if use_proxy and repo.key_id is defined and repo.key_server is defined %}
++linux_repo_{{ name }}_key:
++ cmd.run:
++ - name: "apt-key adv --keyserver {{ repo.key_server }} --recv {{ repo.key_id }}"
++ - unless: 'test -e /etc/apt/sources.list.d/{{ name }}.list'
++ - require_in:
++ - pkgrepo: linux_repo_{{ name }}
++ - env:
++ {%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %}
++ - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }}
++ {%- endif %}
++ {%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %}
++ - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }}
++ {%- endif %}
++ {%- endif %}
++ {#- repo.enabled is false #}
+ {%- else %}
+ linux_repo_{{ name }}:
+ pkgrepo.absent: