Updated Puppet GPG signing key, 2020 edition

Editor's note: This change to the GPG signing key affects both Puppet Enterprise users and open source Puppet users. If you're using Puppet Enterprise, you'll be getting the new key in an upcoming release, or if you manually update your version of puppet-agent, you'll get it then.

Thanks to Morgan Rhodes (@KnittyNerd) for all the technical details for this blog post.

The GPG signing key we’ve been using to sign Puppet products on Linux is expiring in August 2021, so we will be switching to a new key. This means you’ll need to import the new key to be able to use Puppet's public apt and yum repositories. Here are three ways you can update to use the new key.

Update the puppetlabs-release packages

If you are fetching Puppet software via apt or yum, then using one of the puppet-release, puppet5-release or puppet6-release packages this will be the easiest way to get the updated key.

SLES users need to manually update the key before using new release packages

$ curl --remote-name --location https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406
$ gpg --keyid-format 0xLONG --with-fingerprint ./RPM-GPG-KEY-puppet-20250406
pub  4096R/0x4528B6CD9E61EF26 2019-04-08 Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com>
  	Key fingerprint = D681 1ED3 ADEE B844 1AF5  AA8F 4528 B6CD 9E61 EF26
sub  4096R/0xF230A24E9F057A83 2019-04-08 [expires: 2025-04-06]

$ sudo rpm --import RPM-GPG-KEY-puppet-20250406
$ sudo zypper update puppet-release

On EL and Fedora

$ sudo yum update puppet-release

On Debian and Ubuntu

$ sudo apt-get upgrade puppet-release

Update the key with Puppet

Here are some manifest snippets you can use to import the new GPG signing key with Puppet.

On EL, SLES and Fedora

# You’ll need to make sure /etc/pki and /etc/pki/rpm-gpg already exist
file { '/etc/pki/rpm-gpg/GPG-KEY-puppet-20250406':
    ensure => present,
    source => 'https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406',
}

exec { "validate gpg key":
    path      => '/bin:/usr/bin:/sbin:/usr/sbin',
    command   => "gpg --keyid-format 0xLONG /etc/pki/rpm-gpg/GPG-KEY-puppet-20250406 | grep -q 9E61EF26",
    require   => File['/etc/pki/rpm-gpg/GPG-KEY-puppet-20250406'],
    logoutput => 'on_failure',
}

exec { "import gpg key":
    path      => '/bin:/usr/bin:/sbin:/usr/sbin',
    command   => "rpm --import /etc/pki/rpm-gpg/GPG-KEY-puppet-20250406",
    unless    => "rpm -q gpg-pubkey-`echo $(gpg --throw-keyids < /etc/pki/rpm-gpg/GPG-KEY-puppet-20250406) | cut --characters=11-18 | tr [A-Z] [a-z]`",
    require   => [ File['/etc/pki/rpm-gpg/GPG-KEY-puppet-20250406'], Exec['validate gpg key'] ],
    logoutput => 'on_failure',
}

On Debian and Ubuntu

# This is based on puppetlabs-apt >= 2.0.0
apt::key { 'puppet gpg key':
    id     => 'D6811ED3ADEEB8441AF5AA8F4528B6CD9E61EF26',
    server => 'pgp.mit.edu',
}

Update the key manually

You can also update the key manually on your servers.

On EL, SLES and Fedora

$ curl --remote-name --location https://yum.puppet.com/RPM-GPG-KEY-puppet-20250406
$ gpg --keyid-format 0xLONG --with-fingerprint ./RPM-GPG-KEY-puppet-20250406
pub  4096R/0x4528B6CD9E61EF26 2019-04-08 Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com>
  	Key fingerprint = D681 1ED3 ADEE B844 1AF5  AA8F 4528 B6CD 9E61 EF26
sub  4096R/0xF230A24E9F057A83 2019-04-08 [expires: 2025-04-06]

$ rpm --import RPM-GPG-KEY-puppet-20250406

On Debian and Ubuntu

$ curl --remote-name --location https://apt.puppet.com/DEB-GPG-KEY-puppet-20250406
$ gpg --keyid-format 0xLONG --with-fingerprint ./DEB-GPG-KEY-puppet-20250406
pub   rsa4096/0x4528B6CD9E61EF26 2019-04-08 [SC] [expires: 2025-04-06]
  	Key fingerprint = D681 1ED3 ADEE B844 1AF5  AA8F 4528 B6CD 9E61 EF26
uid                         	Puppet, Inc. Release Key (Puppet, Inc. Release Key) <release@puppet.com>
sub   rsa4096/0xF230A24E9F057A83 2019-04-08 [E] [expires: 2025-04-06]

$ sudo apt-key add DEB-GPG-KEY-puppet-20250406

If you have any questions, feel free to ask on #puppet on the Puppet Community Slack, or the puppet-users Google group.

Eric Griswold is a release engineer at Puppet.

Learn more

• For historical reference, you can see the mailing list discussion last time we did this!