Skip to content

Commit 1504454

Browse files
author
Slavek Kabrda
authored
Enable repo_gpgcheck for RPM repositories by default (#693)
1 parent 7bd38d1 commit 1504454

7 files changed

+138
-9
lines changed

‎.fixtures.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@ fixtures:
1616
forge_modules:
1717
yumrepo_core: "puppetlabs/yumrepo_core"
1818
powershell: "puppetlabs/powershell"
19-
zypprepo: "puppet/zypprepo"
19+
zypprepo:
20+
repo: "puppet/zypprepo"
21+
ref: "3.1.0"
2022
symlinks:
2123
custom_datadog: "#{source_dir}/spec/custom_fixtures/custom_datadog"
2224
datadog_agent: "#{source_dir}"

‎kitchen.yml

+4
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,10 @@ platforms:
6868
- cd /home/kitchen/puppet && r10k puppetfile install --moduledir=/tmp/modules
6969

7070
- name: opensuse/leap-15
71+
# Workaround for flakes on initializing opensuse/leap-15:
72+
# => SCP did not finish successfully (255): (Net::SCP::Error)
73+
transport:
74+
max_ssh_sessions: 1
7175
driver_config:
7276
# we use a custom image that runs systemd
7377
image: 'datadog/docker-library:chef_kitchen_systemd_opensuse_leap_15'

‎manifests/init.pp

+10
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,13 @@
221221
# RPM: https://yum.datadoghq.com/stable/7/x86_64/ (with matching agent version and architecture)
222222
# Windows: https://https://s3.amazonaws.com/ddagent-windows-stable/
223223
# String. Default: undef
224+
# $rpm_repo_gpgcheck
225+
# Whether or not to perform repodata signature check for RPM repositories.
226+
# Applies to Red Hat and SUSE platforms. When set to `undef`, this is activated
227+
# for all Agent versions other than 5 when `agent_repo_uri` is also undefinded.
228+
# The `undef` value also translates to `false` on RHEL/CentOS 8.1 because
229+
# of a bug in libdnf: https://bugzilla.redhat.com/show_bug.cgi?id=1792506
230+
# Boolean. Default: undef
224231
# $apt_release
225232
# The distribution channel to be used for the APT repo. Eg: 'stable' or 'beta'.
226233
# String. Default: stable
@@ -334,6 +341,7 @@
334341
Boolean $container_collect_all = $datadog_agent::params::container_collect_all,
335342
Hash[String[1], Data] $agent_extra_options = {},
336343
Optional[String] $agent_repo_uri = undef,
344+
Optional[Boolean] $rpm_repo_gpgcheck = undef,
337345
Optional[Boolean] $use_apt_backup_keyserver = $datadog_agent::params::use_apt_backup_keyserver,
338346
String $apt_backup_keyserver = $datadog_agent::params::apt_backup_keyserver,
339347
String $apt_keyserver = $datadog_agent::params::apt_keyserver,
@@ -438,6 +446,7 @@
438446
agent_repo_uri => $agent_repo_uri,
439447
manage_repo => $manage_repo,
440448
agent_version => $agent_version,
449+
rpm_repo_gpgcheck => $rpm_repo_gpgcheck,
441450
}
442451
}
443452
'Windows' : {
@@ -462,6 +471,7 @@
462471
agent_flavor => $agent_flavor,
463472
agent_repo_uri => $agent_repo_uri,
464473
agent_version => $agent_version,
474+
rpm_repo_gpgcheck => $rpm_repo_gpgcheck,
465475
}
466476
}
467477
default: { fail("Class[datadog_agent]: Unsupported operatingsystem: ${::operatingsystem}") }

‎manifests/redhat.pp

+29-5
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
Boolean $manage_repo = true,
1010
String $agent_version = $datadog_agent::params::agent_version,
1111
String $agent_flavor = $datadog_agent::params::package_name,
12+
Optional[Boolean] $rpm_repo_gpgcheck = undef,
1213
) inherits datadog_agent::params {
1314

1415
if $manage_repo {
@@ -19,6 +20,28 @@
1920
'https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public',
2021
'https://keys.datadoghq.com/DATADOG_RPM_KEY.public',
2122
]
23+
if ($rpm_repo_gpgcheck != undef) {
24+
$repo_gpgcheck = $rpm_repo_gpgcheck
25+
} else {
26+
if ($agent_repo_uri == undef) and ($agent_major_version > 5) {
27+
case $::operatingsystem {
28+
'RedHat', 'CentOS', 'OracleLinux': {
29+
# disable repo_gpgcheck on 8.1 because of https://bugzilla.redhat.com/show_bug.cgi?id=1792506
30+
if $::operatingsystemrelease =~ /^8.1/ {
31+
$repo_gpgcheck = false
32+
} else {
33+
$repo_gpgcheck = true
34+
}
35+
}
36+
default: {
37+
$repo_gpgcheck = true
38+
}
39+
}
40+
} else {
41+
$repo_gpgcheck = false
42+
}
43+
44+
}
2245

2346
case $agent_major_version {
2447
5 : {
@@ -55,11 +78,12 @@
5578
}
5679

5780
yumrepo {'datadog':
58-
enabled => 1,
59-
gpgcheck => 1,
60-
gpgkey => join($gpgkeys, "\n "),
61-
descr => 'Datadog, Inc.',
62-
baseurl => $baseurl,
81+
enabled => 1,
82+
gpgcheck => 1,
83+
gpgkey => join($gpgkeys, "\n "),
84+
repo_gpgcheck => $repo_gpgcheck,
85+
descr => 'Datadog, Inc.',
86+
baseurl => $baseurl,
6387
}
6488

6589
package { $agent_flavor:

‎manifests/suse.pp

+17
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
String $release = $datadog_agent::params::apt_default_release,
1010
Optional[String] $agent_repo_uri = undef,
1111
String $agent_flavor = $datadog_agent::params::package_name,
12+
Optional[Boolean] $rpm_repo_gpgcheck = undef,
1213
) inherits datadog_agent::params {
1314

1415
$current_key = 'https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public'
@@ -19,6 +20,16 @@
1920
'https://keys.datadoghq.com/DATADOG_RPM_KEY.public',
2021
]
2122

23+
if ($rpm_repo_gpgcheck != undef) {
24+
$repo_gpgcheck = $rpm_repo_gpgcheck
25+
} else {
26+
if ($agent_repo_uri == undef) {
27+
$repo_gpgcheck = true
28+
} else {
29+
$repo_gpgcheck = false
30+
}
31+
}
32+
2233
case $agent_major_version {
2334
5 : { fail('Agent v5 package not available in SUSE') }
2435
6 : { $gpgkeys = $all_keys }
@@ -63,6 +74,12 @@
6374
gpgcheck => 1,
6475
# zypper on SUSE < 15 only understands a single gpgkey value
6576
gpgkey => (Float($::operatingsystemmajrelease) >= 15.0) ? { true => join($gpgkeys, "\n "), default => $current_key },
77+
# TODO: when updating zypprepo to 4.0.0, uncomment the repo_gpgcheck line
78+
# For now, we can leave this commented, as zypper by default does repodata
79+
# signature checks if the repomd.xml.asc is present, so repodata checks
80+
# are effective for most users anyway. We'll make this explicit when we
81+
# update zypprepo version.
82+
# repo_gpgcheck => $repo_gpgcheck,
6683
keeppackages => 1,
6784
}
6885

‎spec/classes/datadog_agent_redhat_spec.rb

+71-3
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@
3131
https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
3232
https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public
3333
https://keys.datadoghq.com/DATADOG_RPM_KEY.public')\
34-
.with_baseurl('https://yum.datadoghq.com/rpm/x86_64/')
34+
.with_baseurl('https://yum.datadoghq.com/rpm/x86_64/')\
35+
.with_repo_gpgcheck(false)
3536
end
3637
end
3738
context 'with manage_repo => false' do
@@ -79,7 +80,8 @@
7980
https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
8081
https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public
8182
https://keys.datadoghq.com/DATADOG_RPM_KEY.public')\
82-
.with_baseurl('https://yum.datadoghq.com/stable/6/x86_64/')
83+
.with_baseurl('https://yum.datadoghq.com/stable/6/x86_64/')\
84+
.with_repo_gpgcheck(true)
8385
end
8486
end
8587
context 'with manage_repo => false' do
@@ -127,7 +129,8 @@
127129
.with_gpgkey('https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public
128130
https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
129131
https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public')\
130-
.with_baseurl('https://yum.datadoghq.com/stable/7/x86_64/')
132+
.with_baseurl('https://yum.datadoghq.com/stable/7/x86_64/')\
133+
.with_repo_gpgcheck(true)
131134
end
132135
end
133136
context 'with manage_repo => false' do
@@ -151,4 +154,69 @@
151154
.with_ensure('latest')
152155
end
153156
end
157+
158+
context 'rhel 8.1' do
159+
# we expect repo_gpgcheck to be false on 8.1
160+
let(:facts) do
161+
{
162+
osfamily: 'redhat',
163+
operatingsystem: 'RedHat',
164+
operatingsystemrelease: '8.1',
165+
architecture: 'x86_64',
166+
}
167+
end
168+
169+
# it should install the mirror
170+
context 'with manage_repo => true' do
171+
let(:params) do
172+
{
173+
manage_repo: true, agent_major_version: 7
174+
}
175+
end
176+
177+
it do
178+
is_expected.to contain_yumrepo('datadog')
179+
.with_enabled(1)\
180+
.with_gpgcheck(1)\
181+
.with_gpgkey('https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public
182+
https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
183+
https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public')\
184+
.with_baseurl('https://yum.datadoghq.com/stable/7/x86_64/')\
185+
.with_repo_gpgcheck(false)
186+
end
187+
end
188+
end
189+
190+
context 'rhel 8.2' do
191+
# we expect repo_gpgcheck to be true on 8.2 (and later)
192+
let(:facts) do
193+
{
194+
osfamily: 'redhat',
195+
operatingsystem: 'RedHat',
196+
operatingsystemrelease: '8.2',
197+
architecture: 'x86_64',
198+
}
199+
end
200+
201+
# it should install the mirror
202+
context 'with manage_repo => true' do
203+
let(:params) do
204+
{
205+
manage_repo: true, agent_major_version: 7
206+
}
207+
end
208+
209+
it do
210+
# we expect repo_gpgcheck to be false on 8.1
211+
is_expected.to contain_yumrepo('datadog')
212+
.with_enabled(1)\
213+
.with_gpgcheck(1)\
214+
.with_gpgkey('https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public
215+
https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
216+
https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public')\
217+
.with_baseurl('https://yum.datadoghq.com/stable/7/x86_64/')\
218+
.with_repo_gpgcheck(true)
219+
end
220+
end
221+
end
154222
end

‎spec/classes/datadog_agent_suse_spec.rb

+4
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public
3636
https://keys.datadoghq.com/DATADOG_RPM_KEY.public')\
3737
.with_baseurl('https://yum.datadoghq.com/suse/stable/6/x86_64')
38+
# .with_repo_gpgcheck(true)
3839
end
3940
end
4041

@@ -53,6 +54,7 @@
5354
https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public
5455
https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public')\
5556
.with_baseurl('https://yum.datadoghq.com/suse/stable/7/x86_64')
57+
# .with_repo_gpgcheck(true)
5658
end
5759
end
5860
end
@@ -77,6 +79,7 @@
7779
.with_gpgcheck(1)\
7880
.with_gpgkey('https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public')\
7981
.with_baseurl('https://yum.datadoghq.com/suse/stable/6/x86_64')
82+
# .with_repo_gpgcheck(true)
8083
end
8184
end
8285

@@ -93,6 +96,7 @@
9396
.with_gpgcheck(1)\
9497
.with_gpgkey('https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public')\
9598
.with_baseurl('https://yum.datadoghq.com/suse/stable/7/x86_64')
99+
# .with_repo_gpgcheck(true)
96100
end
97101
end
98102
end

0 commit comments

Comments
 (0)