Puppet RPMKEY Module

This repository aims to ease the GPG keymanagement with rpm

Background

A package maintainer can sign his RPM packages with a secret gpg key. This allows a third party (e.g. you) to verify the package with the corresponding public key. The rpm utility has its own keyring and commands to import and remove public gpg keys.

A key can be imported with rpm --import and will then present itself as an installed package of the form gpgkey-#{keyid}-#{signature_date}. In the same way the key can be removed from the keyring by removing the corresponding package with rpm --erase

The puppet way

The new puppet rpmkey type treats a single key as a puppet resource so you can e.g. specify

rpmkey { '0608B895':
  ensure => present,
  source => 'https://fedoraproject.org/static/0608B895.txt',
}

The above resource will import the key if it is not already present. If you want to make sure that a key is absent (remove it when it is present) specify the following instead:

rpmkey { '0608B895':
  ensure => absent,
}

The name of the rpmkey resource has to be the keyID of the gpg key. If you have the public key available as a file but you are unsure of the correct keyID, use gpg to extract the keyID. For example, to find the keyID used by EPEL 7:

$ gpg ./RPM-GPG-KEY-EPEL-7
pub  4096R/352C64E5 2013-12-16 Fedora EPEL (7) <epel@fedoraproject.org>

The string after the / is what rpmkey expects (352C64E5).

Running the tests

The easiest way to run the tests is via bundler

bundle install
bundle exec rake spec SPEC_OPTS='--format documentation'

Contribution

Thanks to the following contributers, who made this module more usable:

• Gene Liverman
• Michael Moll
• duritong

Reference

Table of Contents

Resource types

• rpmkey: Define public GPG keys that should be part of the rpm keyring.

Resource types

rpmkey

Define public GPG keys that should be part of the rpm keyring.

Properties

The following properties are available in the rpmkey type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

Parameters

The following parameters are available in the rpmkey type.

• name
• provider
• source

name

namevar

The name of the key. This is the keyID (in hex) in uppercase.

provider

The specific backend to use for this rpmkey resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

source

The source of the public key if the key is not already imported.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[2.0.1] - 2024-05-20

Changed

• Updated badges

[2.0.0] - 2024-05-20

Added

• Support RHEL8 and CentOS 8
• Add version requirement in metadata.json (>= 6.21.0 < 9.0.0)

Changed

• Update structure to work with latest puppet version

[1.0.3] - 2015-02-04

Fixed

• do not crash on unexpected rpm output
• improve test coverage

[1.0.2] - 2015-02-01

Added

• Add SLES and CentOS as supported operating systems (thanks to Michael Moll and Gene Liverman for testing)

Changed

• If the source parameter specifies a local file that you also manage through a puppet file resource, the file resource will be autorequired by the rpmkey resource (Thanks to duritong for implementing this)

[1.0.1] - 2015-01-22

Changed

• Update metadata.json with tested operating systems

[1.0.0] - 2015-01-21

Added

• Initial release for puppet forge