Updated Puppet GPG signing key, 2020 edition

Editor's note: This change to the GPG signing key affects both Puppet Enterprise users and open source Puppet users. If you're using Puppet Enterprise, you'll be getting the new key in an upcoming release, or if you manually update your version of puppet-agent, you'll get it then.

Thanks to Morgan Rhodes (@KnittyNerd) for all the technical details for this blog post.

The GPG signing key we’ve been using to sign Puppet products on Linux is expiring in August 2021, so we will be switching to a new key. This means you’ll need to import the new key to be able to use Puppet's public apt and yum repositories. Here are three ways you can update to use the new key.

Update the puppetlabs-release packages

If you are fetching Puppet software via apt or yum, then using one of the puppet-release, puppet5-release or puppet6-release packages this will be the easiest way to get the updated key.

SLES users need to manually update the key before using new release packages

On EL and Fedora

On Debian and Ubuntu

Update the key with Puppet

Here are some manifest snippets you can use to import the new GPG signing key with Puppet.

On EL, SLES and Fedora

On Debian and Ubuntu

Update the key manually

You can also update the key manually on your servers.

On EL, SLES and Fedora

On Debian and Ubuntu

If you have any questions, feel free to ask on #puppet on the Puppet Community Slack, or the puppet-users Google group.

Eric Griswold is a release engineer at Puppet.

Learn more

• For historical reference, you can see the mailing list discussion last time we did this!