feat(debian): use repository keyring instead of key_id

postgres/codenamemap.yaml

@@ -29,7 +29,7 @@
  data_dir: {{ data_dir }}
  fromrepo: {{ fromrepo }}
  pkg_repo:
- name: 'deb http:https://apt.postgresql.org/pub/repos/apt {{ name }}-pgdg main'
+ name: 'deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg] http:https://apt.postgresql.org/pub/repos/apt {{ name }}-pgdg main'
  pkg: postgresql-{{ version }}
  pkg_client: postgresql-client-{{ version }}
  prepare_cluster:

postgres/osfamilymap.yaml

@@ -16,8 +16,8 @@ Debian:
  pkgs_deps: ['python3-apt']
  pkg_repo:
  humanname: PostgreSQL Official Repository
- key_url: 'https://www.postgresql.org/media/keys/ACCC4CF8.asc'
  file: /etc/apt/sources.list.d/pgdg.list
+ pkg_repo_keyring: 'https://download.postgresql.org/pub/repos/apt/pool/main/p/pgdg-keyring/pgdg-keyring_2018.2_all.deb'
  pkg_repo_keyid: ACCC4CF8
  {% if repo.use_upstream_repo == true %}
  pkg_dev: ''

postgres/server/remove.sls

@@ -12,6 +12,12 @@ postgresql-repo-removed:
  - keyid: {{ postgres.pkg_repo_keyid }}
  {%- endif %}
 
+ {% if grains.os_family == 'Debian' %}
+postgresql-repo-keyring-removed:
+ pkg.removed:
+ - name: pgdg-keyring
+ {%- endif -%}
+
 #remove release installed by formula
 postgresql-server-removed:
  pkg.removed:

postgres/upstream.sls

@@ -23,6 +23,15 @@ postgresql-pkg-deps:
  - pkgs: {{ postgres.pkgs_deps | json }}
 
 # Add upstream repository for your distro
+ {% if grains.os_family == 'Debian' %}
+postgresql-repo-keyring:
+ pkg.installed:
+ - sources:
+ - pgdg-keyring: {{ postgres.pkg_repo_keyring }}
+ - require_in:
+ - pkgrepo: postgresql-repo
+ {%- endif %}
+
 postgresql-repo:
  pkgrepo.managed:
  {{- format_kwargs(postgres.pkg_repo) }}
@@ -39,6 +48,12 @@ postgresql-repo:
  - keyid: {{ postgres.pkg_repo_keyid }}
  {%- endif %}
 
+ {% if grains.os_family == 'Debian' %}
+postgresql-repo-keyring:
+ pkg.removed:
+ - name: pgdg-keyring
+ {%- endif -%}
+
  {%- endif -%}
 
 {%- elif grains.os not in ('Windows', 'MacOS',) %}

test/integration/repo/controls/repository.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+case platform.family
+when 'redhat'
+ repo_file = '/etc/yum.repos.d/pgdg13.repo'
+ repo_url = 'https://download.postgresql.org/pub/repos/yum/13/redhat/rhel-$releasever-$basearch'
+when 'debian'
+ # Inspec does not provide a `codename` matcher, so we add ours
+ finger_codename = {
+ 'ubuntu-18.04' => 'bionic',
+ 'ubuntu-20.04' => 'focal',
+ 'debian-9' => 'stretch',
+ 'debian-10' => 'buster',
+ 'debian-11' => 'bullseye'
+ }
+ codename = finger_codename[system.platform[:finger]]
+
+ repo_keyring = '/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg'
+ repo_file = '/etc/apt/sources.list.d/pgdg.list'
+ # rubocop:disable Metrics/LineLength
+ repo_url = "deb [signed-by=#{repo_keyring}] http:https://apt.postgresql.org/pub/repos/apt #{codename}-pgdg main"
+ # rubocop:enable Metrics/LineLength
+end
+
+control 'Postgresql repository keyring' do
+ title 'should be installed'
+
+ only_if('Requirement for Debian family') do
+ os.debian?
+ end
+
+ describe package('pgdg-keyring') do
+ it { should be_installed }
+ end
+
+ describe file(repo_keyring) do
+ it { should exist }
+ it { should be_owned_by 'root' }
+ it { should be_grouped_into 'root' }
+ its('mode') { should cmp '0644' }
+ end
+end
+
+control 'Postgresql repository' do
+ impact 1
+ title 'should be configured'
+ describe file(repo_file) do
+ its('content') { should include repo_url }
+ end
+end