leap_platform.git/puppet/modules/site_apt/manifests, branch master

Bug: Directly deploy leap-archive keyrings

2018-03-20T20:58:35+00:00

The leap-archive keyring expired March 8th 2018.
We updated it, and published updated installation
docs at https://bitmask.net/en/install/linux.

For jessie, we dont install the leap-archive-keyring
package anymore but directly deploy the keys to
apt's trusted keystore.

- Fixes: https://0xacab.org/leap/bitmask-dev/issues/9279

Bug: fix repository layout

2017-10-31T16:16:29+00:00

Fix the order of the leap repository so it matches the correct repository
layout. Fixes #8888.

Bug: jessie apt keys stable/experimental/staging

2017-10-03T20:52:25+00:00

The apt sources lines for people using more experimental software was
wrong, we abolished the 'experimental' repository some time ago and
develoment happens now in the master branch.

solves #8862, #8876

Bug: jessie apt keys must be in /etc/apt/trusted.gpg.d

2017-09-28T20:32:37+00:00

For newer than jessie the 'old' code was enough. This bug didn't show up
because our testing images had the keys and sources lines already
included within /etc/apt…

solves #8862

Pin python-cryptography to jessie-backports

2017-06-27T18:34:43+00:00

Needed to satisfy leap-mx dependency (>=17.0)

- Resolves: #8837

Install python-treq from strech on jessie nodes

2017-06-27T18:14:09+00:00

New soledad-common depends on `python-treq`, which
is only available in debian stretch.
We pin all stretch packages to 1 (same as for sid), which
means (from `man apt_preferences`):

    "causes a version to be installed only if there is no
    installed version of the package"

- Resolves: #8836

Add configured apt component to the unattended-upgrades whitelist

2017-06-24T10:26:08+00:00

Resolves: #8792

Add signed-by option to sources.list (Closes: #8425)

2017-05-02T18:41:49+00:00

This gets us a simple apt repository privilege separation:
  (a) our key can't be used to forge other repos
  (b) other keys can't be used to forge our repo.

From sources.list(5):

  · Signed-By (signed-by) is either an absolute path to a keyring
    file (has to be accessible and readable for the _apt user, so ensure
    everyone has read-permissions on the file) or one or more
    fingerprints of keys either in the trusted.gpg keyring or in the
    keyrings in the trusted.gpg.d/ directory (see apt-key
    fingerprint). If the option is set, only the key(s) in this keyring
    or only the keys with these fingerprints are used for the
    apt-secure(8) verification of this repository. Defaults to the value
    of the option with the same name if set in the previously acquired
    Release file. Otherwise all keys in the trusted keyrings are
    considered valid signers for this repository.

Make platform apt dist/component configurable

2017-03-16T13:00:48+00:00

[feat] dont use backports for rsyslog anymore

2017-02-23T09:56:21+00:00