18761: use repository keyring instead of key_id

[arvados-formula.git] / arvados / repo / install.sls

diff --git a/arvados/repo/install.sls b/arvados/repo/install.sls
index cd42aaa9afb7a20bd366001d6250bfc4f7ba9585..c58fbe51736063fe2851f2901ac577f177da1a25 100644 (file)
--- a/arvados/repo/install.sls
+++ b/arvados/repo/install.sls
@@ -4,6 +4,7 @@
 {#- Get the `tplroot` from `tpldir` #}
 {%- set tplroot = tpldir.split('/')[0] %}
 {%- from tplroot ~ "/map.jinja" import arvados with context %}
 {#- Get the `tplroot` from `tpldir` #}
 {%- set tplroot = tpldir.split('/')[0] %}
 {%- from tplroot ~ "/map.jinja" import arvados with context %}

+{%- from tplroot ~ "/libtofs.jinja" import files_switch with context %}

 
 {%- if arvados.use_upstream_repo %}
   {%- if grains.get('os_family') == 'Debian' %}
 
 {%- if arvados.use_upstream_repo %}
   {%- if grains.get('os_family') == 'Debian' %}


@@ -16,12 +17,24 @@
     {%- else %}
       {%- set release = distro %}
     {%- endif %}
     {%- else %}
       {%- set release = distro %}
     {%- endif %}

+
+arvados-repo-install-pkgrepo-keyring-managed:
+  file.managed:
+    - name: {{ arvados.repo.repo_keyring }}
+    - source: {{ files_switch(['arvados-archive-keyring.gpg'],
+                              lookup='arvados-repo-install-pkgrepo-keyring-managed'
+                 )
+              }}
+    - require_in:
+      - pkgrepo: arvados-repo-install-pkgrepo-managed
+

 arvados-repo-install-pkgrepo-managed:
   pkgrepo.managed:
     - humanname: {{ arvados.repo.humanname }}
 arvados-repo-install-pkgrepo-managed:
   pkgrepo.managed:
     - humanname: {{ arvados.repo.humanname }}

-    - name: deb {{ arvados.repo.url_base }}/{{ distro }} {{ release }} main
+    - name: >-
+        deb [signed-by={{ arvados.repo.repo_keyring }} arch=amd64]
+        {{ arvados.repo.url_base }}/{{ distro }} {{ release }} main

     - file: {{ arvados.repo.file }}
     - file: {{ arvados.repo.file }}

-    - key_url: {{ arvados.repo.key_url }}

 
   {%- elif grains.get('os_family') == 'RedHat' %}
     {%- if arvados.release == 'testing' %}
 
   {%- elif grains.get('os_family') == 'RedHat' %}
     {%- if arvados.release == 'testing' %}