From aadb0b65a2ccbad9aab366aa53fd8fc3c4f1b229 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Javier=20B=C3=A9rtoli?= <jbertoli@curii.com>
Date: Tue, 15 Feb 2022 13:15:42 -0300
Subject: [PATCH] 18761: address review comments
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Arvados-DCO-1.1-Signed-off-by: Javier Bértoli <jbertoli@curii.com>
---
 .../files/default/arvados-archive-keyring.gpg | Bin 1916 -> 0 bytes
 arvados/osfamilymap.yaml                      |   4 +++-
 arvados/repo/install.sls                      |  12 +++++-------
 docs/README.apt.keyring.rst                   |  18 ------------------
 4 files changed, 8 insertions(+), 26 deletions(-)
 delete mode 100644 arvados/files/default/arvados-archive-keyring.gpg
 delete mode 100644 docs/README.apt.keyring.rst

diff --git a/arvados/files/default/arvados-archive-keyring.gpg b/arvados/files/default/arvados-archive-keyring.gpg
deleted file mode 100644
index 6c5c167a990821dbbe01ab776603a367bdd92996..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1916
zcmai#XE+;*9>ygSk*JzQ35`*kV>gXadsWp#rL}5=>nIWu$wjT8A*y<7RSwltx74PB
z+QcX^4@GOVM$~?Ct(sNWx%WBGJzvgqzrUaUzu)`*X#if3-2!<Xz|HZB5?@CuMGwv<
zxW2X&Jg^{{x^n)uFA0YkZh5A{qzq$d{Y}O)Q+H}kVs}QmEaesrOdPBdo6)6kntgTR
z^J{UMTzxDQ&dFl8^{ez=7Q+_A@&yI9z0e<2yq?VCq>7#Pp&ZqCi47E`3I?xbydgfq
z+=`23Go<dq<u%<3qo3E(%jcUu8`&m)O7Q*rdVz9yl1MgM?VuUt6IC-=IG8egW0vCI
z7$A6hylE&o9bt-eTi4UkCZ-!19@3>Y(MPz3Da>sZziN^DYJpDo9D0*Gze#*5y>kek
z@|eGTQZQuQ!iwwo^lU6Si=>he1b5fkyPZC3SMH4YCr`O~Q#*$MfCEsgV}d7n`{D=)
z6Ji)H*gGr$gK!G)#|B{i5jXuJ5C((@g12vQ0M^+1zd3ar-rtA{um=eNU>ryhX;96y
z(lbA7Z6T*{zsg+^7Xkk8&5vN9$8mZfP=XW81LcMQxh}z=+&n;#2#^y1lmY-n<2YbY
z{y)O`R**AXivTWU1f_+|Nt=)4H+8(<ASq}!)peP^+Q<GXr%95!T7?{YVk=%n)gO@a
zsxgu&BgV|cKqh1+0Lf@H`A97`bQBP-eYw;+jJC<0Ghxw#Rdvlg8JS$35P=qU!`|Om
zM1BmSUURT6%6*ZeSnN1-u}Y>R&a`pCc|w+3@NF|AGlC%Pug8@wKI<R3dZy3LAJ3@_
zqk6gln72T@`*c>nUJE2gb#D3}3O7VAY8~!Fm*3TzB?C?-9rNa3ZC-Z39?|U(*lMWl
zM){LpxYG`H2OoS)4cov|bZU?GK?4JWdpX|L7pnG4=(=IHOmmwx-Ro-FE!JB}`}Cph
z&$WhTL_Ch<hbQ={B5bgj|4Re&M_e6)3qI$e2hup_f%r=v-tP51KuN@(?=GJXIfeW5
zpo2U{5$q>Q%9v4O;cD#8OoG_e411!mbw}ohn2~ycepWtYUPHBaNFLAB&Ia0q6whRg
zGsN2$b9NGuCGE+5Ch>iAA(jJ_%q@9^v=f+e_bkJwA#$8(KaeW@s}vBjMO!b~HIE`b
z`<Ra#8`|+m>}i@=YVM*BDt+Hvn>(Jjt+s-N0HfW->YH1?%}l@TsEo05w2+9&%QTi{
z?|l${>2&YQE*3NDsMNi=OlJ?VDxrIR7qJ_wBdFAvpB|vX6LRSquRU|GTx!hp)U`WA
zrBT|btht5Ny@X$rmOAYSdMR6h%wq2wc$OlwP?m#_xZ%v#c5J5AJ6T2rAkRexa>#&z
zPF`N*b7Q%FH<t5US#BT{#`71-8ks<T=s+(}xF=@Op~-Q_qT0V?(^@{a7mh4-JZfL7
zxOP&$PLuVGpeNeHI1%-EHc7f{c>SnkY(-FJ&4*Ma20~cF&t}#8ic(l?Q+wCDD4+^T
zvuL;aU|YJETGTh5F#H27weBj$KQ{QcS~AJ5EJL{2DBq-<tRe$i0MF0#zF$3n8)<EM
zG{dLM(#vJle$rI909krKYG7Qdau7vCFWQJPx1&jmBQpGF56w>d0#RZXXR#V`MaFhf
zDh46EF%=7SP5N<r<5l_l5Z_yAd&Dk;d`i*MW6^)9Vg#2LQEO|IDVrBBJy2?R(3d;f
zk!VGTd$ibLMeoEn#iF*n=m%$w|69@yj^BuO62@*MqCVs2t6vv9ZW{~R*7cwIyDJx(
ziv|85RPhSvB)MczJ?Rarmc@%)$WT3{3Masb_`UBE4mR;?LM8((qPo!xj}5f;eC%nt
z?-Ptko-{xLrN_k3%647_nK`!SKn?;-4{#-mi;M|sw~u8j*YkMkg2tfq=j;jT&F|{L
ztvXpco&k#|ek&uS0rzAzNLFD-kdE9#O<RwfPeWn3D}X>wzu1DO1s|*;2r%4~sv<IO
zhL(;L-cQMj3Q+FvX?A%jh-}{F1Z%L>%n{Dt%U(-1jut;OAnf2Sk~4JMJHUlxShfIP
ztaGiV!nC=8%G2Sdosh?s3;$VCD&Pu8>|7-%82I~x0ZLr>bJ^z1AwP`XnAFW~Z@()Y
za6wS+Q@T*>%SgWU{8P^FIri#JVA8PD5YKU2SW7rm8j9?_!<W0#EB`FgdW-_+quf3$
zsN=?$PQQKG`M6nf3w*4gpjRXpF7!H0uQUE8Bda4he_q|G^Db|OT$Ic8nH91Mh;?%(
zHX0Vzf?{vK9e6V*LLRqr*>U*de=Wg?W4SwWSp2;qw!MZqdR<+T2lMJpjAaogQCZ_a
z&|BlHxFDE{F9(_aJRs8sglP+83Q4=TN>JYsh@ZMY6XDu3eQvb4g2TaHFTK(B6+x!)
paw{qO(GjnrXbH^0c(Qg9%=Ae4f@^av>pQ5}0KzKA-Y3Fn{{~<kYf1nB

diff --git a/arvados/osfamilymap.yaml b/arvados/osfamilymap.yaml
index 3434082..7df0f00 100644
--- a/arvados/osfamilymap.yaml
+++ b/arvados/osfamilymap.yaml
@@ -18,7 +18,9 @@ Debian:
   repo:
     url_base: 'http://apt.arvados.org'
     file: /etc/apt/sources.list.d/arvados.list
-    repo_keyring: /usr/share/keyrings/arvados-archive-keyring.gpg
+    keyring_file: /usr/share/keyrings/arvados-archive-keyring.gpg
+    keyring_source: 'http://apt.arvados.org/keyring.gpg'
+    keyring_source_hash: 53c2c84849ada21e383f55af0753adb321cc941e7efab94483e3a1703fcc66f1
 
 RedHat:
   repo:
diff --git a/arvados/repo/install.sls b/arvados/repo/install.sls
index c58fbe5..c22bbbc 100644
--- a/arvados/repo/install.sls
+++ b/arvados/repo/install.sls
@@ -4,7 +4,6 @@
 {#- Get the `tplroot` from `tpldir` #}
 {%- set tplroot = tpldir.split('/')[0] %}
 {%- from tplroot ~ "/map.jinja" import arvados with context %}
-{%- from tplroot ~ "/libtofs.jinja" import files_switch with context %}
 
 {%- if arvados.use_upstream_repo %}
   {%- if grains.get('os_family') == 'Debian' %}
@@ -20,11 +19,10 @@
 
 arvados-repo-install-pkgrepo-keyring-managed:
   file.managed:
-    - name: {{ arvados.repo.repo_keyring }}
-    - source: {{ files_switch(['arvados-archive-keyring.gpg'],
-                              lookup='arvados-repo-install-pkgrepo-keyring-managed'
-                 )
-              }}
+    - name: {{ arvados.repo.keyring_file }}
+    - source:
+      - {{ arvados.repo.keyring_source }}
+    - source_hash: sha256={{ arvados.repo.keyring_source_hash }}
     - require_in:
       - pkgrepo: arvados-repo-install-pkgrepo-managed
 
@@ -32,7 +30,7 @@ arvados-repo-install-pkgrepo-managed:
   pkgrepo.managed:
     - humanname: {{ arvados.repo.humanname }}
     - name: >-
-        deb [signed-by={{ arvados.repo.repo_keyring }} arch=amd64]
+        deb [signed-by={{ arvados.repo.keyring_file }} arch=amd64]
         {{ arvados.repo.url_base }}/{{ distro }} {{ release }} main
     - file: {{ arvados.repo.file }}
 
diff --git a/docs/README.apt.keyring.rst b/docs/README.apt.keyring.rst
deleted file mode 100644
index 94a5098..0000000
--- a/docs/README.apt.keyring.rst
+++ /dev/null
@@ -1,18 +0,0 @@
-.. _readme_apt_keyrings:
-
-apt repositories' keyrings
-==========================
-
-Debian family of OSes deprecated the use of `apt-key` to manage repositories' keys
-in favor of using `keyring files` which contain a binary OpenPGP format of the key
-(also known as "GPG key public ring")
-
-As arvados don't provide such key files, we created it pulling the
-official key from its site and install the resulting file.
-
-See https://doc.arvados.org/main/install/packages.html#debian for details
-
-.. code-block:: bash
-
-   $ curl -fsSL https://apt.arvados.org/pubkey.gpg | \
-       gpg --dearmor --output arvados-archive-keyring.gpg
-- 
2.30.2