Updated Puppet GPG signing key

by Morgan Rhodes|5 October 2016

See more posts about: Industry News, Product and Tips & How To

Editor's Note: This change to the GPG signing key affects both Puppet Enterprise users and open source Puppet users. If you're using Puppet Enterprise, you'll be getting the new key in the next release, or if you manually update your version of puppet-agent, you'll get it then.

The GPG signing key we’ve been using to sign Puppet products on Linux is expiring in January 2017, so we’ve recently switched to a new key. This means you’ll need to import the new key to be able to use our public apt and yum repositories. Here are three ways you can update to use the new key.

Update your puppetlabs-release packages

If you’re already setting up your repos using the puppetlabs-release or puppetlabs-release-pc1 packages, this is going to be the easiest way to get the updated key.

On EL and Fedora

$ sudo yum update puppetlabs-release

or $ sudo yum update puppetlabs-release-pc1

On Debian and Ubuntu

$ sudo apt-get upgrade puppetlabs-release-pc1

or $ sudo apt-get upgrade puppetlabs-release

Update the key with Puppet

Here are some manifest snippets you can use to import the new GPG signing key with Puppet.

On EL and Fedora, Puppet >= 4.4.0

# You’ll need to make sure /etc/pki and /etc/pki/rpm-gpg already exist
file { '/etc/pki/rpm-gpg/GPG-KEY-puppet':
  ensure => present,
  source => 'https://yum.puppetlabs.com/RPM-GPG-KEY-puppet',
}

exec { "validate gpg key":
  path      => '/bin:/usr/bin:/sbin:/usr/sbin',
  command   => "gpg --keyid-format 0xLONG /etc/pki/rpm-gpg/GPG-KEY-puppet | grep -q 7F438280EF8D349F",
  require   => File['/etc/pki/rpm-gpg/GPG-KEY-puppet'],
  logoutput => 'on_failure',
}

exec { "import gpg key":
  path      => '/bin:/usr/bin:/sbin:/usr/sbin',
  command   => "rpm --import /etc/pki/rpm-gpg/GPG-KEY-puppet",
  unless    => "rpm -q gpg-pubkey-`echo $(gpg --throw-keyids < /etc/pki/rpm-gpg/GPG-KEY-puppet) | cut --characters=11-18 | tr [A-Z] [a-z]`",
  require   => [ File['/etc/pki/rpm-gpg/GPG-KEY-puppet'], Exec['validate gpg key'] ],
  logoutput => 'on_failure',
}

On EL and Fedora, Puppet < 4.4.0

# You’ll need to make sure /etc/pki and /etc/pki/rpm-gpg already exist
# This depends on the lwf/remote_file module at https://forge.puppet.com/lwf/remote_file
remote_file { '/etc/pki/rpm-gpg/GPG-KEY-puppet':
  ensure => present,
  source => 'https://yum.puppetlabs.com/RPM-GPG-KEY-puppet',
}

exec { "validate gpg key":
  path      => '/bin:/usr/bin:/sbin:/usr/sbin',
  command   => "gpg --keyid-format 0xLONG /etc/pki/rpm-gpg/GPG-KEY-puppet | grep -q 7F438280EF8D349F",
  require   => Remote_file['/etc/pki/rpm-gpg/GPG-KEY-puppet'],
  logoutput => 'on_failure',
}

exec { "import gpg key":
  path      => '/bin:/usr/bin:/sbin:/usr/sbin',
  command   => "rpm --import /etc/pki/rpm-gpg/GPG-KEY-puppet",
  unless    => "rpm -q gpg-pubkey-`echo $(gpg --throw-keyids < /etc/pki/rpm-gpg/GPG-KEY-puppet) | cut --characters=11-18 | tr [A-Z] [a-z]`",
  require   => [ Remote_file['/etc/pki/rpm-gpg/GPG-KEY-puppet'], Exec['validate gpg key'] ],
  logoutput => 'on_failure',
}

On Debian and Ubuntu

# This is based on puppetlabs-apt >= 2.0.0
apt::key { 'puppet gpg key':
  id     => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
  server => 'pgp.mit.edu',
}

Update the key manually

You can also update the key manually on your servers.

On EL and Fedora

$ curl --remote-name --location https://yum.puppetlabs.com/RPM-GPG-KEY-puppet
$ gpg --keyid-format 0xLONG --with-fingerprint ./RPM-GPG-KEY-puppet
pub  4096R/0x7F438280EF8D349F 2016-08-18 Puppet, Inc. Release Key (Puppet, Inc. Release Key) <rel...@puppet.com>
      Key fingerprint = 6F6B 1550 9CF8 E59E 6E46  9F32 7F43 8280 EF8D 349F
sub  4096R/0xA2D80E04656674AE 2016-08-18 [expires: 2021-08-17]
$ rpm --import RPM-GPG-KEY-puppet

On Debian and Ubuntu

$ curl --remote-name --location https://apt.puppetlabs.com/DEB-GPG-KEY-puppet
$ gpg --keyid-format 0xLONG --with-fingerprint ./DEB-GPG-KEY-puppet
pub  4096R/0x7F438280EF8D349F 2016-08-18 Puppet, Inc. Release Key (Puppet, Inc. Release Key) <rel...@puppet.com>
      Key fingerprint = 6F6B 1550 9CF8 E59E 6E46  9F32 7F43 8280 EF8D 349F
sub  4096R/0xA2D80E04656674AE 2016-08-18 [expires: 2021-08-17]
$ apt-key add DEB-GPG-KEY-puppet

Hopefully this helps get you up and running with our new GPG signing key. If you have any questions, feel free to ask on #puppet on freenode, #puppet on the puppet community slack, or the puppet-users Google group.

Morgan Rhodes is a release engineer at Puppet.