Editor's Note: This change to the GPG signing key affects both Puppet Enterprise users and open source Puppet users. If you're using Puppet Enterprise, you'll be getting the new key in the next release, or if you manually update your version of puppet-agent, you'll get it then.
The GPG signing key we’ve been using to sign Puppet products on Linux is expiring in January 2017, so we’ve recently switched to a new key. This means you’ll need to import the new key to be able to use our public apt and yum repositories. Here are three ways you can update to use the new key.
Update your puppetlabs-release packages
If you’re already setting up your repos using the puppetlabs-release or puppetlabs-release-pc1 packages, this is going to be the easiest way to get the updated key.
On EL and Fedora
$ sudo yum update puppetlabs-release
or $ sudo yum update puppetlabs-release-pc1
On Debian and Ubuntu
$ sudo apt-get upgrade puppetlabs-release-pc1
or $ sudo apt-get upgrade puppetlabs-release
Update the key with Puppet
Here are some manifest snippets you can use to import the new GPG signing key with Puppet.
On EL and Fedora, Puppet >= 4.4.0
# You’ll need to make sure /etc/pki and /etc/pki/rpm-gpg already exist
file { '/etc/pki/rpm-gpg/GPG-KEY-puppet':
ensure => present,
source => 'https://yum.puppetlabs.com/RPM-GPG-KEY-puppet',
}
exec { "validate gpg key":
path => '/bin:/usr/bin:/sbin:/usr/sbin',
command => "gpg --keyid-format 0xLONG /etc/pki/rpm-gpg/GPG-KEY-puppet | grep -q 7F438280EF8D349F",
require => File['/etc/pki/rpm-gpg/GPG-KEY-puppet'],
logoutput => 'on_failure',
}
exec { "import gpg key":
path => '/bin:/usr/bin:/sbin:/usr/sbin',
command => "rpm --import /etc/pki/rpm-gpg/GPG-KEY-puppet",
unless => "rpm -q gpg-pubkey-`echo $(gpg --throw-keyids < /etc/pki/rpm-gpg/GPG-KEY-puppet) | cut --characters=11-18 | tr [A-Z] [a-z]`",
require => [ File['/etc/pki/rpm-gpg/GPG-KEY-puppet'], Exec['validate gpg key'] ],
logoutput => 'on_failure',
}
On EL and Fedora, Puppet < 4.4.0
# You’ll need to make sure /etc/pki and /etc/pki/rpm-gpg already exist
# This depends on the lwf/remote_file module at https://forge.puppet.com/lwf/remote_file
remote_file { '/etc/pki/rpm-gpg/GPG-KEY-puppet':
ensure => present,
source => 'https://yum.puppetlabs.com/RPM-GPG-KEY-puppet',
}
exec { "validate gpg key":
path => '/bin:/usr/bin:/sbin:/usr/sbin',
command => "gpg --keyid-format 0xLONG /etc/pki/rpm-gpg/GPG-KEY-puppet | grep -q 7F438280EF8D349F",
require => Remote_file['/etc/pki/rpm-gpg/GPG-KEY-puppet'],
logoutput => 'on_failure',
}
exec { "import gpg key":
path => '/bin:/usr/bin:/sbin:/usr/sbin',
command => "rpm --import /etc/pki/rpm-gpg/GPG-KEY-puppet",
unless => "rpm -q gpg-pubkey-`echo $(gpg --throw-keyids < /etc/pki/rpm-gpg/GPG-KEY-puppet) | cut --characters=11-18 | tr [A-Z] [a-z]`",
require => [ Remote_file['/etc/pki/rpm-gpg/GPG-KEY-puppet'], Exec['validate gpg key'] ],
logoutput => 'on_failure',
}
On Debian and Ubuntu
# This is based on puppetlabs-apt >= 2.0.0
apt::key { 'puppet gpg key':
id => '6F6B15509CF8E59E6E469F327F438280EF8D349F',
server => 'pgp.mit.edu',
}
Update the key manually
You can also update the key manually on your servers.
On EL and Fedora
$ curl --remote-name --location https://yum.puppetlabs.com/RPM-GPG-KEY-puppet
$ gpg --keyid-format 0xLONG --with-fingerprint ./RPM-GPG-KEY-puppet
pub 4096R/0x7F438280EF8D349F 2016-08-18 Puppet, Inc. Release Key (Puppet, Inc. Release Key) <[email protected]>
Key fingerprint = 6F6B 1550 9CF8 E59E 6E46 9F32 7F43 8280 EF8D 349F
sub 4096R/0xA2D80E04656674AE 2016-08-18 [expires: 2021-08-17]
$ rpm --import RPM-GPG-KEY-puppet
On Debian and Ubuntu
$ curl --remote-name --location https://apt.puppetlabs.com/DEB-GPG-KEY-puppet
$ gpg --keyid-format 0xLONG --with-fingerprint ./DEB-GPG-KEY-puppet
pub 4096R/0x7F438280EF8D349F 2016-08-18 Puppet, Inc. Release Key (Puppet, Inc. Release Key) <[email protected]>
Key fingerprint = 6F6B 1550 9CF8 E59E 6E46 9F32 7F43 8280 EF8D 349F
sub 4096R/0xA2D80E04656674AE 2016-08-18 [expires: 2021-08-17]
$ apt-key add DEB-GPG-KEY-puppet
Hopefully this helps get you up and running with our new GPG signing key. If you have any questions, feel free to ask on #puppet on freenode, #puppet on the puppet community slack, or the puppet-users Google group.
Morgan Rhodes is a release engineer at Puppet.
Learn more
- For more information, see the mailing list discussion here.