1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
# frozen_string_literal: true
require 'pathname'
require 'puppet/parameter/boolean'
Puppet::Type.newtype(:apt_key) do
@doc = <<-MANIFEST
@summary This type provides Puppet with the capabilities to manage GPG keys needed
by apt to perform package validation. Apt has it's own GPG keyring that can
be manipulated through the `apt-key` command.
@example Basic usage
apt_key { '6F6B15509CF8E59E6E469F327F438280EF8D349F':
source => 'http://apt.puppetlabs.com/pubkey.gpg'
}
**Autorequires**
If Puppet is given the location of a key file which looks like an absolute
path this type will autorequire that file.
@api private
MANIFEST
ensurable
validate do
raise(_('ensure => absent and refresh => true are mutually exclusive')) if self[:refresh] == true && self[:ensure] == :absent
raise(_('The properties content and source are mutually exclusive.')) if self[:content] && self[:source]
warning(_('The id should be a full fingerprint (40 characters), see README.')) if self[:id].length < 40
end
newparam(:id, namevar: true) do
desc 'The ID of the key you want to manage.'
# GPG key ID's should be either 32-bit (short) or 64-bit (long) key ID's
# and may start with the optional 0x, or they can be 40-digit key fingerprints
newvalues(%r{\A(0x)?[0-9a-fA-F]{8}\Z}, %r{\A(0x)?[0-9a-fA-F]{16}\Z}, %r{\A(0x)?[0-9a-fA-F]{40}\Z})
munge do |value|
id = if value.start_with?('0x')
value.partition('0x').last.upcase
else
value.upcase
end
id
end
end
newparam(:content) do
desc 'The content of, or string representing, a GPG key.'
end
newparam(:source) do
desc 'Location of a GPG key file, /path/to/file, ftp://, http:// or https://'
newvalues(%r{\Ahttps?://}, %r{\Aftp://}, %r{\A/\w+})
end
autorequire(:file) do
self[:source] if self[:source] && Pathname.new(self[:source]).absolute?
end
newparam(:server) do
desc 'The key server to fetch the key from based on the ID. It can either be a domain name or url.'
defaultto :'keyserver.ubuntu.com'
newvalues(%r{\A((hkp|hkps|http|https)://)?([a-z\d])([a-z\d-]{0,61}\.)+[a-z\d]+(:\d{2,5})?(/[a-zA-Z\d\-_.]+)*/?$})
end
newparam(:options) do
desc 'Additional options to pass to apt-key\'s --keyserver-options.'
end
newparam(:refresh, boolean: true, parent: Puppet::Parameter::Boolean) do
desc 'When true, recreate an existing expired key'
defaultto false
end
newparam(:weak_ssl, boolean: true, parent: Puppet::Parameter::Boolean) do
desc 'When true and source uses https, accepts download of keys without SSL verification'
defaultto false
end
newproperty(:fingerprint) do
desc <<-MANIFEST
The 40-digit hexadecimal fingerprint of the specified GPG key.
This property is read-only.
MANIFEST
end
newproperty(:long) do
desc <<-MANIFEST
The 16-digit hexadecimal id of the specified GPG key.
This property is read-only.
MANIFEST
end
newproperty(:short) do
desc <<-MANIFEST
The 8-digit hexadecimal id of the specified GPG key.
This property is read-only.
MANIFEST
end
newproperty(:expired) do
desc <<-MANIFEST
Indicates if the key has expired.
This property is read-only.
MANIFEST
end
newproperty(:expiry) do
desc <<-MANIFEST
The date the key will expire, or nil if it has no expiry date.
This property is read-only.
MANIFEST
end
newproperty(:size) do
desc <<-MANIFEST
The key size, usually a multiple of 1024.
This property is read-only.
MANIFEST
end
newproperty(:type) do
desc <<-MANIFEST
The key type, one of: rsa, dsa, ecc, ecdsa
This property is read-only.
MANIFEST
end
newproperty(:created) do
desc <<-MANIFEST
Date the key was created.
This property is read-only.
MANIFEST
end
end
|
