diff options
| -rw-r--r-- | README | 49 | ||||
| -rw-r--r-- | manifests/init.pp | 1 | ||||
| -rw-r--r-- | manifests/key.pp | 13 | ||||
| -rw-r--r-- | manifests/key/plain.pp | 13 | ||||
| -rw-r--r-- | manifests/params.pp | 1 | ||||
| -rw-r--r-- | templates/50unattended-upgrades.erb | 15 | ||||
| -rw-r--r-- | templates/Debian/sources.list.erb | 12 | ||||
| -rw-r--r-- | templates/Ubuntu/sources.list.erb | 12 |
8 files changed, 100 insertions, 16 deletions
@@ -17,6 +17,14 @@ Ubuntu support is lagging behind but not absent either. ! Upgrade Notice ! + * Several parser functions have been updated: you need to restart your puppet + master, otherwise some nodes may keep on using an old, cached version! + (https://docs.puppetlabs.com/guides/custom_functions.html#gotchas) + + * If you were using custom 50unattended-upgrades.${::lsbdistcodename} in your + site_apt, these are no longer supported. You should migrate to passing + $blacklisted_packages to the apt::unattended_upgrades class. + * the apt class has been moved to a paramterized class. if you were including this class before, after passing some variables, you will need to move to instantiating the class with those variables instead. For example, if you @@ -91,6 +99,7 @@ This module needs: - the lsb module: git://labs.riseup.net/shared-lsb - the common module: git://labs.riseup.net/shared-common +- the stdlib module: https://forge.puppetlabs.com/puppetlabs/stdlib By default, on normal hosts, this module sets the configuration option DSelect::Clean to 'auto'. On virtual servers, the value is set by default to @@ -462,6 +471,46 @@ Example: 'puppet:///modules/site_apt/company_internals.list' ], } +apt::key +-------- + +Deploys a secure apt OpenPGP key. This usually accompanies the +sources.list snippets above for third party repositories. For example, +you would do: + + apt::key { 'neurodebian.gpg': + ensure => present, + source => 'puppet:///modules/site_apt/neurodebian.gpg', + } + +This deploys the key in the `/etc/apt/trusted.gpg.d` directory, which +is assumed by secure apt to be binary OpenPGP keys and *not* +"ascii-armored" or "plain text" OpenPGP key material. For the latter, +use `apt::key::plain`. + +The `.gpg` extension is compulsory for `apt` to pickup the key properly. + +apt::key::plain +--------------- + +Deploys a secure apt OpenPGP key. This usually accompanies the +sources.list snippets above for third party repositories. For example, +you would do: + + apt::key::plain { 'neurodebian.asc': + source => 'puppet:///modules/site_apt/neurodebian.asc', + } + +This deploys the key in the `${apt_base_dir}/keys` directory (as +opposed to `$custom_key_dir` which deploys it in `keys.d`). The reason +this exists on top of `$custom_key_dir` is to allow a more +decentralised distribution of those keys, without having all modules +throw their keys in the same directory in the manifests. + +Note that this model does *not* currently allow keys to be removed! +Use `apt::key` instead for a more practical, revokable approach, but +that needs binary keys. + apt::upgrade_package -------------------- diff --git a/manifests/init.pp b/manifests/init.pp index 68856cc..062be4c 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -7,6 +7,7 @@ class apt( $codename = $apt::params::codename, $use_lts = $apt::params::use_lts, $use_volatile = $apt::params::use_volatile, + $use_backports = $apt::params::use_backports, $include_src = $apt::params::include_src, $use_next_release = $apt::params::use_next_release, $debian_url = $apt::params::debian_url, diff --git a/manifests/key.pp b/manifests/key.pp new file mode 100644 index 0000000..65b62e9 --- /dev/null +++ b/manifests/key.pp @@ -0,0 +1,13 @@ +define apt::key ($source, $ensure = 'present') { + validate_re( + $name, '\.gpg$', + 'An apt::key resource name must have the .gpg extension', + ) + + file { + "/etc/apt/trusted.gpg.d/${name}": + ensure => $ensure, + source => $source, + notify => Exec['refresh_apt'], + } +} diff --git a/manifests/key/plain.pp b/manifests/key/plain.pp new file mode 100644 index 0000000..e4a2f89 --- /dev/null +++ b/manifests/key/plain.pp @@ -0,0 +1,13 @@ +define apt::key::plain ($source) { + file { + "${apt::apt_base_dir}/keys/${name}": + source => $source; + "${apt::apt_base_dir}/keys": + ensure => directory; + } + exec { "apt-key add '${apt::apt_base_dir}/keys/${name}'": + subscribe => File["${apt::apt_base_dir}/keys/${name}"], + refreshonly => true, + notify => Exec['refresh_apt'], + } +} diff --git a/manifests/params.pp b/manifests/params.pp index f977c27..a1c7392 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -2,6 +2,7 @@ class apt::params () { $codename = $::lsbdistcodename $use_lts = false $use_volatile = false + $use_backports = true $include_src = false $use_next_release = false $debian_url = 'http://httpredir.debian.org/debian/' diff --git a/templates/50unattended-upgrades.erb b/templates/50unattended-upgrades.erb index 94059d5..23c5c89 100644 --- a/templates/50unattended-upgrades.erb +++ b/templates/50unattended-upgrades.erb @@ -1,17 +1,18 @@ // this file is managed by puppet ! -Unattended-Upgrade::Allowed-Origins { <% if scope.lookupvar('::operatingsystem') == 'Ubuntu' -%> +Unattended-Upgrade::Allowed-Origins { "${distro_id}:${distro_codename}-security"; "${distro_id}:${distro_codename}-updates"; "${distro_id}:${distro_codename}-backports"; <% elsif scope.lookupvar('::operatingsystem') == 'Debian' and scope.lookupvar('::operatingsystemmajrelease') == 6 -%> - "${distro-id} ${distro-codename}-security"; - "${distro-id} ${distro-codename}-lts"; +Unattended-Upgrade::Allowed-Origins { + "${distro_id}:oldoldstable"; + "${distro_id}:squeeze-lts"; <% else -%> - # See Debian bug #704087 - "o=Debian,a=oldstable,l=Debian-Security"; - "o=Debian,a=stable,l=Debian-Security"; +Unattended-Upgrade::Origins-Pattern { + "origin=Debian,archive=<%= scope.lookupvar('::apt::release') %>,label=Debian-Security"; + "origin=Debian,archive=${distro_codename}-lts"; <% end -%> }; @@ -20,7 +21,7 @@ Unattended-Upgrade::Package-Blacklist { <% @blacklisted_packages.each do |pkg| -%> "<%= pkg %>"; <% end -%> -} +}; <% end -%> APT::Periodic::Update-Package-Lists "1"; diff --git a/templates/Debian/sources.list.erb b/templates/Debian/sources.list.erb index 37f1c35..ce43135 100644 --- a/templates/Debian/sources.list.erb +++ b/templates/Debian/sources.list.erb @@ -19,14 +19,16 @@ deb-src <%= security_url %> <%= codename %>/updates <%= lrepos %> # There is no security support for <%= release %> <% end -%> +<% if use_backports=scope.lookupvar('apt::use_backports') -%> # backports -<% if (release == "testing" || release == "unstable" || release == "experimental") -%> +<% if (release == "testing" || release == "unstable" || release == "experimental") -%> # There is no backports archive for <%= release %> -<% else -%> +<% else -%> deb <%= backports_url=scope.lookupvar('apt::backports_url') %> <%= codename %>-backports <%= lrepos %> -<% if include_src -%> +<% if include_src -%> deb-src <%= backports_url %> <%= codename %>-backports <%= lrepos %> -<% end +<% end + end end -%> <% if use_volatile=scope.lookupvar('apt::use_volatile') -%> @@ -43,7 +45,7 @@ deb-src <%= debian_url %> <%= codename %>-updates <%= lrepos %> <% if use_lts=scope.lookupvar('apt::use_lts') -%> # LTS -<% if release != "oldstable" -%> +<% if release != "oldoldstable" -%> # There is no LTS archive for <%= release %> <% else -%> deb <%= debian_url %> <%= codename %>-lts <%= lrepos %> diff --git a/templates/Ubuntu/sources.list.erb b/templates/Ubuntu/sources.list.erb index 8d2585d..213f051 100644 --- a/templates/Ubuntu/sources.list.erb +++ b/templates/Ubuntu/sources.list.erb @@ -7,11 +7,13 @@ deb <%= ubuntu_url=scope.lookupvar('apt::ubuntu_url') %> <%= codename %> <%= lre deb-src <%= ubuntu_url %> <%= codename %> <%= lrepos %> <% end -%> +<% if use_volatile=scope.lookupvar('apt::use_volatile') -%> # updates deb <%= ubuntu_url %> <%= codename %>-updates <%= lrepos %> -<% if include_src -%> +<% if include_src -%> deb-src <%= ubuntu_url %> <%= codename %>-updates <%= lrepos %> -<% end -%> +<% end + end -%> # security suppport deb <%= ubuntu_url %> <%= codename %>-security <%= lrepos %> @@ -19,8 +21,10 @@ deb <%= ubuntu_url %> <%= codename %>-security <%= lrepos %> deb-src <%= ubuntu_url %> <%= codename %>-security <%= lrepos %> <% end -%> +<% if use_backports=scope.lookupvar('apt::use_backports') -%> # backports deb <%= ubuntu_url %> <%= codename %>-backports <%= lrepos %> -<% if include_src -%> +<% if include_src -%> deb-src <%= ubuntu_url %> <%= codename %>-backports <%= lrepos %> -<% end -%> +<% end + end -%> |