(MODULES-11808) Fix InfluxDB apt source on Ubuntu 24.04 (apt::keyring)#128
Open
actowery wants to merge 3 commits into
Open
(MODULES-11808) Fix InfluxDB apt source on Ubuntu 24.04 (apt::keyring)#128actowery wants to merge 3 commits into
actowery wants to merge 3 commits into
Conversation
The Debian-family branch of manifests/init.pp declared apt::source with an
inline `key => { id, source }` hash. That form routes through the deprecated
apt::key defined type, which drops the trust file under /etc/apt/trusted.gpg.d/
and does not set signed-by= on the source list entry. Ubuntu 24.04's apt
enforces deb822-style trust scoping and rejects the InfluxDB source with a
missing-signature error, so the influxdb2 package fails to install.
Switch to the name+source key hash, which routes through apt::keyring in
puppetlabs-apt 9.2.0+. apt::source then writes the key to /etc/apt/keyrings/,
references it via signed-by=, and orders the keyring before the source list
file automatically.
Also:
- Bump puppetlabs-apt dep floor to >= 9.2.0 (first version shipping
apt::keyring) and pin the same in .fixtures.yml so unit tests exercise the
floor.
- Mark the repo_gpg_key_id parameter as retained-for-backcompat-but-not-enforced
in the param docstring; the fingerprint pinning previously performed by
apt::key no longer occurs, since apt::keyring trusts the HTTPS-served file
directly.
- Add unit assertions covering the new apt::keyring + key-hash form on every
Debian-family OS in operatingsystem_support (including the originally
broken Ubuntu 24.04), plus negative assertions in the archive_source and
"neither repo nor archive" contexts to guard against future regressions
leaking repo resources into the no-repo paths.
Reported in #126.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…for idempotency
The initial Ubuntu 24.04 fix used apt::source's key => { name, source } hash,
which internally declares apt::keyring with source => <https url>. That is
not idempotent: Puppet's HTTPS file source rewrites the local file on every
agent run because Puppet does not stably checksum HTTPS-served content. The
PE LTS litmus run on PR #128 caught this — the install puppet apply
succeeded, but the idempotency check showed the keyring file mtime changing
between runs:
Notice: .../Apt::Keyring[influxdb2.asc]/File[.../influxdb2.asc]/content:
content changed '{mtime}18:50:05' to '{mtime}18:50:52'
Switch to fetching the key via the archive defined type (puppet/archive is
already a module dependency), which only downloads when the destination file
is missing. Point apt::source's keyring parameter at the resulting absolute
path so the rendered source list still carries signed-by=.
Drop the apt dep floor from >= 9.2.0 back to >= 9.0.0 — apt::source's keyring
parameter has existed since v9.0.0; only the apt::keyring defined type
required 9.2.0, and this PR no longer uses it.
Declare /etc/apt/keyrings/ via ensure_resource so the archive download
succeeds on systems where the directory does not pre-exist (older Ubuntu /
Debian releases).
Test changes: assert the new archive resource and the keyring directory in
the Debian repo context; update the negative assertions in the archive_source
and "neither repo nor archive" contexts to negate the new archive resource
rather than the now-unused apt::keyring.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Author
CI failure contextFour jobs are red on the latest run. None are caused by this PR; all are pre-existing CI breakage on platforms this PR does not touch. Sles-15, PE LTS and PE latestPE install fails because The acceptance tests never run — RedHat-8, PE LTS and PE latestBolt's net-ssh transport drops mid-stream during the post-install Classic SSH flake during a long-running heavy operation. Also fails before the acceptance step. Separately worth noting: RedHat-8 runs the Prior historyThe same two-platform failure pattern is present on every recent change to this module:
GitHub purged the job logs (>30 days, HTTP 410), so I can't byte-compare the failure causes against today's. What is verifiable: same workflow, same platforms, same What is greenOn the latest run for this PR:
The Debian-family code path this PR changes is exercised, idempotent, and green everywhere the harness can actually install PE. |
…File['keyrings']
Per maintainer feedback: drop the apt version pin in .fixtures.yml so CI
exercises the latest puppetlabs-apt customers are likely running, not just
the dependency floor. Bleeding-edge fixtures catch regressions in the
latest apt that would otherwise only surface to users.
Unpinning exposed a latent bug: apt 11.3.0+ declares
file { 'keyrings': path => '/etc/apt/keyrings', ... } in its main apt
class. The previous code added ensure_resource('file', '/etc/apt/keyrings',
...), creating a second File resource managing the same path with a
different title — at apply time on apt 11.3+ this would have produced
conflicting state.
Switch ensure_resource to title 'keyrings' (matching apt's declaration).
On apt < 11.3 our declaration creates the directory; on apt >= 11.3
ensure_resource is a no-op since the resource already exists. Update the
File['keyrings'] require chain on the archive resource and the matching
spec assertion to use the new title.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
puppetlabs/influxdbv3.0.1 fails to install on Ubuntu 24.04 becausemanifests/init.ppdeclares the Debian apt source with an inlinekey => { id, source }hash. That form routes through the deprecatedapt::keydefined type, which drops the trust file under/etc/apt/trusted.gpg.d/without settingsigned-by=on the source list entry. Ubuntu 24.04's apt enforces deb822-style trust scoping and rejects the InfluxDB source with a missing-signature error.This PR switches to the modern
key => { 'name', 'source' }hash, which routes throughapt::keyringinpuppetlabs-apt9.2.0+. The apt module then writes the key file to/etc/apt/keyrings/, references it viasigned-by=on the source list entry, and orders the keyring before the source list file automatically.Changes
manifests/init.pp— Debian-family branch ofapt::sourcenow useskey => { 'name' => "${repo_name}.asc", 'source' => $repo_gpg_key_url }. Param$repo_gpg_key_idis retained for backward compatibility but its docstring now notes it no longer enforces fingerprint verification (theapt::keyringpath trusts the HTTPS-served file directly).metadata.json— bumpspuppetlabs/aptdependency floor from>= 8.0.0to>= 9.2.0(the release that introducedapt::keyring, 2023-12-04)..fixtures.yml— pins theaptfixture to9.2.0so unit tests exercise the dependency floor.spec/classes/init_spec.rb— assertscontain_apt__keyring('influxdb2.asc')and the structuralkey:hash on every Debian-family OS inoperatingsystem_support(including the originally-broken Ubuntu 24.04). Adds negative assertions in thearchive_sourceand "neither repo nor archive" contexts to guard against regressions that would leak repo resources into the no-repo code paths.Jira
Upstream issue
Test plan
bundle exec rspec spec/classes/init_spec.rb— 83 examples, 0 failures across Ubuntu 18.04 / 20.04 / 22.04 / 24.04 + Debian 11.bundle exec rake validateclean.bundle exec rake lintclean.93b0c34(job run, 17m41s). Acceptance spec appliesinclude influxdbidempotently and assertsss -Htln sport = :8086 | LISTEN, i.e. install + idempotent + service alive on a real Ubuntu 24.04 + PE 2023.8.9 VM.Out of scope
.listformat withsigned-by=works on 22.04).puppet_operational_dashboards).auto_release.ymlafter merge.🤖 Generated with Claude Code