Merge branch '18761-debian-family-apt-keyrings'

closes #18761
Arvados-DCO-1.1-Signed-off-by: Javier Bértoli <jbertoli@curii.com>

diff --git a/arvados/api/package/install.sls b/arvados/api/package/install.sls
index ce0004e676807d68a68e9ff5c182befb90e48176..1c487a6ae2c9e6df98f672bd79a50e113ac8b06f 100644 (file)
--- a/arvados/api/package/install.sls
+++ b/arvados/api/package/install.sls
@@ -45,5 +45,6 @@ arvados-api-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.api.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true
     - require:
       - sls: {{ sls_config_file }}

diff --git a/arvados/config/package/install.sls b/arvados/config/package/install.sls
index 031e3e867732583a8a88026ecd3cd269e9e1d46c..31e4e30017b2d86d504cf02dca08129c0d2f0ade 100644 (file)
--- a/arvados/config/package/install.sls
+++ b/arvados/config/package/install.sls
@@ -9,3 +9,4 @@ arvados-config-package-install-pkg-installed:
   pkg.installed:
     - name: arvados-server
     - version: {{ arvados.version }}
+    - refresh: true

diff --git a/arvados/controller/package/install.sls b/arvados/controller/package/install.sls
index 62161ea1d57304f5befecbb1d5cef8d8adfe984a..a820045b794b7bb1a3deaf39a6a85541a2bfc902 100644 (file)
--- a/arvados/controller/package/install.sls
+++ b/arvados/controller/package/install.sls
@@ -42,3 +42,4 @@ arvados-controller-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.controller.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true

diff --git a/arvados/dispatcher/package/install.sls b/arvados/dispatcher/package/install.sls
index ec76dabc43af3a063013679a12208f6cd6e10ad5..2073201138246f713009f299219c571e29565233 100644 (file)
--- a/arvados/dispatcher/package/install.sls
+++ b/arvados/dispatcher/package/install.sls
@@ -9,6 +9,7 @@ arvados-dispatcher-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.dispatcher.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true
 
 # FIXME! Until https://dev.arvados.org/issues/16995 makes it to
 # a new release, this is required so the dependency is installed
@@ -16,7 +17,8 @@ arvados-dispatcher-package-install-pkg-installed:
 arvados-dispatcher-package-install-crunch-run-pkg-installed:
   pkg.installed:
     - name: crunch-run
+    - version: {{ arvados.version }}
+    - refresh: true
     - require:
       - pkg: arvados-dispatcher-package-install-pkg-installed
-    - version: {{ arvados.version }}
 {%- endif %}

diff --git a/arvados/init.sls b/arvados/init.sls
index 983607010d77d710e04859387ef511ed8f5521e9..48ad78622dbef9cb5bcceb359b7af7cc65ba781c 100644 (file)
--- a/arvados/init.sls
+++ b/arvados/init.sls
@@ -15,3 +15,4 @@ include:
   - .shell
   - .workbench
   - .dispatcher
+  - .keepbalance

diff --git a/arvados/keepproxy/package/install.sls b/arvados/keepproxy/package/install.sls
index e06faa6b9e5dd169c00e078076d943edc5be619f..5176a7d4831af599ae56a300560314d80c164d32 100644 (file)
--- a/arvados/keepproxy/package/install.sls
+++ b/arvados/keepproxy/package/install.sls
@@ -9,3 +9,4 @@ arvados-keepproxy-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.keepproxy.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true

diff --git a/arvados/keepstore/package/install.sls b/arvados/keepstore/package/install.sls
index 9d311d5fe36f59fa156d9502af9aa8c6fb0b255f..38853a5d59252731d3d74140f6eadc4bb69f7a76 100644 (file)
--- a/arvados/keepstore/package/install.sls
+++ b/arvados/keepstore/package/install.sls
@@ -9,3 +9,4 @@ arvados-keepstore-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.keepstore.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true

diff --git a/arvados/keepweb/package/install.sls b/arvados/keepweb/package/install.sls
index e9cfd4cbf02006e2a4bb4a8930bb23357566c1eb..23144eeb2a3cef2b9c8899d19fc102e2cd8e9a14 100644 (file)
--- a/arvados/keepweb/package/install.sls
+++ b/arvados/keepweb/package/install.sls
@@ -9,3 +9,4 @@ arvados-keepweb-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.keepweb.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true

diff --git a/arvados/osfamilymap.yaml b/arvados/osfamilymap.yaml
index 22516a4b48eb33e06ad001bf352d4130dd0fcb1f..7df0f006a55d351d9c392e0233cd2c5d562c0c06 100644 (file)
--- a/arvados/osfamilymap.yaml
+++ b/arvados/osfamilymap.yaml
@@ -18,7 +18,9 @@ Debian:
   repo:
     url_base: 'http://apt.arvados.org'
     file: /etc/apt/sources.list.d/arvados.list
-    key_url: 'http://apt.arvados.org/pubkey.gpg'
+    keyring_file: /usr/share/keyrings/arvados-archive-keyring.gpg
+    keyring_source: 'http://apt.arvados.org/keyring.gpg'
+    keyring_source_hash: 53c2c84849ada21e383f55af0753adb321cc941e7efab94483e3a1703fcc66f1
 
 RedHat:
   repo:

diff --git a/arvados/repo/install.sls b/arvados/repo/install.sls
index cd42aaa9afb7a20bd366001d6250bfc4f7ba9585..2c9360e6fea47347575c309315f7debc755070a4 100644 (file)
--- a/arvados/repo/install.sls
+++ b/arvados/repo/install.sls
@@ -16,12 +16,22 @@
     {%- else %}
       {%- set release = distro %}
     {%- endif %}
-arvados-repo-install-pkgrepo-managed:
-  pkgrepo.managed:
-    - humanname: {{ arvados.repo.humanname }}
-    - name: deb {{ arvados.repo.url_base }}/{{ distro }} {{ release }} main
-    - file: {{ arvados.repo.file }}
-    - key_url: {{ arvados.repo.key_url }}
+
+arvados-repo-install-pkgrepo-keyring-managed:
+  file.managed:
+    - name: {{ arvados.repo.keyring_file }}
+    - source:
+      - {{ arvados.repo.keyring_source }}
+    - source_hash: sha256={{ arvados.repo.keyring_source_hash }}
+    - require_in:
+      - file: arvados-repo-install-file-managed
+
+arvados-repo-install-file-managed:
+  file.managed:
+    - name: {{ arvados.repo.file }}
+    - contents: >
+        deb [signed-by={{ arvados.repo.keyring_file }} arch=amd64]
+        {{ arvados.repo.url_base }}/{{ distro }} {{ release }} main
 
   {%- elif grains.get('os_family') == 'RedHat' %}
     {%- if arvados.release == 'testing' %}

diff --git a/arvados/shell/package/install.sls b/arvados/shell/package/install.sls
index 6d1300fe21de5da1065b4c2ca2173e523bb8643b..7a0698fc48b826f7aa7be9fcb81e990bcc215e4a 100644 (file)
--- a/arvados/shell/package/install.sls
+++ b/arvados/shell/package/install.sls
@@ -30,6 +30,7 @@ arvados-shell-package-install-pkg-installed:
       - {{ package }}
         {%- endif %}
       {%- endfor %}
+    - refresh: true
 
 arvados-shell-package-install-gems-deps-pkg-installed:
   pkg.installed:

diff --git a/arvados/websocket/package/install.sls b/arvados/websocket/package/install.sls
index fe8f87a11836b6056eaad4b78be2b7cf4cb0f1c8..a1c4344a3dd00fa27773333b52d659a10354ac79 100644 (file)
--- a/arvados/websocket/package/install.sls
+++ b/arvados/websocket/package/install.sls
@@ -9,3 +9,4 @@ arvados-websocket-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.websocket.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true

diff --git a/arvados/workbench/package/install.sls b/arvados/workbench/package/install.sls
index f379f649683fb174fa176b855c8d5c3cb1f339ae..0eb191e51c33376ed0e347262f52ca785460ba14 100644 (file)
--- a/arvados/workbench/package/install.sls
+++ b/arvados/workbench/package/install.sls
@@ -29,6 +29,7 @@ arvados-workbench-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.workbench.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true
     - require:
       {%- if arvados.ruby.manage_ruby %}
       - {{ ruby_dep }}: arvados-ruby-package-install-ruby-{{ ruby_dep }}-installed

diff --git a/arvados/workbench2/package/install.sls b/arvados/workbench2/package/install.sls
index 9e503ff88003a82c35d3a05aa069b01f7899de2f..2ba21c09467e11bdaabb7616fbf4b6ae9a2e9cee 100644 (file)
--- a/arvados/workbench2/package/install.sls
+++ b/arvados/workbench2/package/install.sls
@@ -10,5 +10,6 @@ arvados-workbench2-package-install-pkg-installed:
   pkg.installed:
     - name: {{ arvados.workbench2.pkg.name }}
     - version: {{ arvados.version }}
+    - refresh: true
     - require:
       - sls: {{ sls_config_file }}

diff --git a/kitchen.yml b/kitchen.yml
index 5e707293a7aa62f0183db79bb7579415d607e53e..443e2199ab2637ce6b26461f8a5650d237070800 100644 (file)
--- a/kitchen.yml
+++ b/kitchen.yml
@@ -57,6 +57,23 @@ platforms:
     driver:
       image: saltimages/salt-master-py3:centos-7
 
+  ## SALT `3004.0`
+  - name: debian-11-3004.0-py3
+    driver:
+      image: saltimages/salt-3004.0-py3:debian-11
+  - name: debian-10-3004.0-py3
+    driver:
+      image: saltimages/salt-3004.0-py3:debian-10
+  - name: ubuntu-2004-3004.0-py3
+    driver:
+      image: saltimages/salt-3004.0-py3:ubuntu-20.04
+  - name: ubuntu-1804-3004.0-py3
+    driver:
+      image: saltimages/salt-3004.0-py3:ubuntu-18.04
+  - name: centos-7-3004.0-py3
+    driver:
+      image: saltimages/salt-3004.0-py3:centos-7
+
   ## SALT `3003.3`
   - name: debian-11-3003.3-py3
     driver:
@@ -75,9 +92,6 @@ platforms:
       image: saltimages/salt-3003.3-py3:centos-7
 
   ## SALT `3002.7`
-  - name: debian-11-3002.7-py3
-    driver:
-      image: saltimages/salt-3002.7-py3:debian-11
   - name: debian-10-3002.7-py3
     driver:
       image: saltimages/salt-3002.7-py3:debian-10
@@ -91,20 +105,6 @@ platforms:
     driver:
       image: saltimages/salt-3002.7-py3:centos-7
 
-  ## SALT `3001.8`
-  - name: debian-10-3001.8-py3
-    driver:
-      image: saltimages/salt-3001.8-py3:debian-10
-  - name: ubuntu-2004-3001.8-py3
-    driver:
-      image: saltimages/salt-3001.8-py3:ubuntu-20.04
-  - name: ubuntu-1804-3001.8-py3
-    driver:
-      image: saltimages/salt-3001.8-py3:ubuntu-18.04
-  - name: centos-7-3001.8-py3
-    driver:
-      image: saltimages/salt-3001.8-py3:centos-7
-
 verifier:
   # https://www.inspec.io/
   name: inspec

diff --git a/test/integration/repo/controls/repo_spec.rb b/test/integration/repo/controls/repo_spec.rb
index 601119f2ba15088487dd6ef4137ca1931223e6f2..49078c606d380bb9b7112a3c0b2c101790e73d15 100644 (file)
--- a/test/integration/repo/controls/repo_spec.rb
+++ b/test/integration/repo/controls/repo_spec.rb
@@ -23,7 +23,23 @@ when 'debian', 'ubuntu'
     codename = 'bullseye'
   end
   repo_file = '/etc/apt/sources.list.d/arvados.list'
-  repo_url = "deb http://apt.arvados.org/#{codename} #{codename} main"
+  repo_keyring = '/usr/share/keyrings/arvados-archive-keyring.gpg'
+  repo_url = "deb [signed-by=/usr/share/keyrings/arvados-archive-keyring.gpg arch=amd64] http://apt.arvados.org/#{codename} #{codename} main"
+end
+
+control 'arvados repository keyring' do
+  title 'should be installed'
+
+  only_if('Requirement for Debian family') do
+    platform.family == 'debian'
+  end
+
+  describe file(repo_keyring) do
+    it { should exist }
+    it { should be_owned_by 'root' }
+    it { should be_grouped_into 'root' }
+    its('mode') { should cmp '0644' }
+  end
 end
 
 control 'arvados repository' do

diff --git a/test/integration/shell/controls/repo_spec.rb b/test/integration/shell/controls/repo_spec.rb
index a9dc3cbf86fed8424e339ca7755210cbc5f327cb..0f097fe0a5e598554539ac5338f14ec48cbfe5c0 100644 (file)
--- a/test/integration/shell/controls/repo_spec.rb
+++ b/test/integration/shell/controls/repo_spec.rb
@@ -23,7 +23,23 @@ when 'debian', 'ubuntu'
     codename = 'bullseye'
   end
   repo_file = '/etc/apt/sources.list.d/arvados.list'
-  repo_url = "deb http://apt.arvados.org/#{codename} #{codename}-dev main"
+  repo_keyring = '/usr/share/keyrings/arvados-archive-keyring.gpg'
+  repo_url = "deb [signed-by=/usr/share/keyrings/arvados-archive-keyring.gpg arch=amd64] http://apt.arvados.org/#{codename} #{codename}-dev main"
+end
+
+control 'arvados repository keyring' do
+  title 'should be installed'
+
+  only_if('Requirement for Debian family') do
+    platform.family == 'debian'
+  end
+
+  describe file(repo_keyring) do
+    it { should exist }
+    it { should be_owned_by 'root' }
+    it { should be_grouped_into 'root' }
+    its('mode') { should cmp '0644' }
+  end
 end
 
 control 'arvados repository' do