From 1dca07177fdbb832e0694843c306b98dd9d86cb7 Mon Sep 17 00:00:00 2001 From: Omkar Kawade Date: Thu, 16 Nov 2023 18:59:51 -0800 Subject: [PATCH 1/6] 434 Add GPG keys to keyrings instead of trusted.gpg.d --- defaults/main.yml | 2 +- tasks/setup-Debian.yml | 28 +++++++++++++--------------- 2 files changed, 14 insertions(+), 16 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 8deef24..daad48f 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -38,7 +38,7 @@ docker_apt_release_channel: stable # and is only necessary until Docker officially supports them. docker_apt_ansible_distribution: "{{ 'ubuntu' if ansible_distribution in ['Pop!_OS', 'Linux Mint'] else ansible_distribution }}" docker_apt_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}" -docker_apt_repository: "deb [arch={{ docker_apt_arch }} signed-by=/etc/apt/trusted.gpg.d/docker.asc] {{ docker_repo_url }}/{{ docker_apt_ansible_distribution | lower }} {{ ansible_distribution_release }} {{ docker_apt_release_channel }}" +docker_apt_repository: "deb [arch={{ docker_apt_arch }} signed-by=/etc/apt/keyrings/docker.gpg] {{ docker_repo_url }}/{{ docker_apt_ansible_distribution | lower }} {{ ansible_distribution_release }} {{ docker_apt_release_channel }}" docker_apt_ignore_key_error: true docker_apt_gpg_key: "{{ docker_repo_url }}/{{ docker_apt_ansible_distribution | lower }}/gpg" docker_apt_gpg_key_checksum: "sha256:1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570" diff --git a/tasks/setup-Debian.yml b/tasks/setup-Debian.yml index 69529ba..3279803 100644 --- a/tasks/setup-Debian.yml +++ b/tasks/setup-Debian.yml @@ -27,25 +27,23 @@ state: present when: ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '>=') -- name: Add Docker apt key. - ansible.builtin.get_url: - url: "{{ docker_apt_gpg_key }}" - dest: /etc/apt/trusted.gpg.d/docker.asc - mode: '0644' - force: false - checksum: "{{ docker_apt_gpg_key_checksum | default(omit) }}" - register: add_repository_key - ignore_errors: "{{ docker_apt_ignore_key_error }}" - when: docker_add_repo | bool +- name: Ensure directory exists for /etc/apt/keyrings + file: + path: /etc/apt/keyrings + state: directory + mode: '0755' -- name: Ensure curl is present (on older systems without SNI). +- name: Ensure curl is present package: name=curl state=present - when: add_repository_key is failed and docker_add_repo | bool -- name: Add Docker apt key (alternative for older systems without SNI). +- name: Add Docker apt key shell: > - curl -sSL {{ docker_apt_gpg_key }} | apt-key add - - when: add_repository_key is failed and docker_add_repo | bool + curl -sSL {{ docker_apt_gpg_key }} | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg --yes + +- name: Change permissions for /etc/apt/keyrings/docker.gpg + file: + path: /etc/apt/keyrings/docker.gpg + mode: 'a+r' - name: Add Docker repository. apt_repository: From 12ad263ef65367d36c795e19b8dcfbf301c8a645 Mon Sep 17 00:00:00 2001 From: Omkar Kawade Date: Thu, 16 Nov 2023 20:23:52 -0800 Subject: [PATCH 2/6] 435 Update apt key ansible task --- tasks/setup-Debian.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/setup-Debian.yml b/tasks/setup-Debian.yml index 3279803..8bd7e00 100644 --- a/tasks/setup-Debian.yml +++ b/tasks/setup-Debian.yml @@ -38,7 +38,7 @@ - name: Add Docker apt key shell: > - curl -sSL {{ docker_apt_gpg_key }} | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg --yes + curl -fsSL {{ docker_apt_gpg_key }} | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg --yes - name: Change permissions for /etc/apt/keyrings/docker.gpg file: From ae29f9f9c02a2d5fae0e7f58c86077cc6628d761 Mon Sep 17 00:00:00 2001 From: Omkar Kawade Date: Thu, 16 Nov 2023 21:14:58 -0800 Subject: [PATCH 3/6] 434 changed_when false for adding docker apt key shell cmd --- tasks/setup-Debian.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tasks/setup-Debian.yml b/tasks/setup-Debian.yml index 8bd7e00..8c98a68 100644 --- a/tasks/setup-Debian.yml +++ b/tasks/setup-Debian.yml @@ -39,6 +39,7 @@ - name: Add Docker apt key shell: > curl -fsSL {{ docker_apt_gpg_key }} | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg --yes + changed_when: false - name: Change permissions for /etc/apt/keyrings/docker.gpg file: From 6cb849c416970cf9dded79786e4d65f5fa1850cc Mon Sep 17 00:00:00 2001 From: Omkar Kawade Date: Thu, 16 Nov 2023 21:20:56 -0800 Subject: [PATCH 4/6] 435 ansible-lint --- tasks/setup-Debian.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tasks/setup-Debian.yml b/tasks/setup-Debian.yml index 8c98a68..7a3cb03 100644 --- a/tasks/setup-Debian.yml +++ b/tasks/setup-Debian.yml @@ -36,12 +36,12 @@ - name: Ensure curl is present package: name=curl state=present -- name: Add Docker apt key +- name: Add Docker apt key shell: > curl -fsSL {{ docker_apt_gpg_key }} | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg --yes changed_when: false -- name: Change permissions for /etc/apt/keyrings/docker.gpg +- name: Change permissions for /etc/apt/keyrings/docker.gpg file: path: /etc/apt/keyrings/docker.gpg mode: 'a+r' From 08ae86e0b5fc3e891e9122b138e6d580e3c2f0f1 Mon Sep 17 00:00:00 2001 From: Omkar Kawade Date: Mon, 18 Dec 2023 11:06:21 -0800 Subject: [PATCH 5/6] 434 update apt key destination --- defaults/main.yml | 2 +- tasks/setup-Debian.yml | 17 ++++++++++------- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index daad48f..cdf94f0 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -38,7 +38,7 @@ docker_apt_release_channel: stable # and is only necessary until Docker officially supports them. docker_apt_ansible_distribution: "{{ 'ubuntu' if ansible_distribution in ['Pop!_OS', 'Linux Mint'] else ansible_distribution }}" docker_apt_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}" -docker_apt_repository: "deb [arch={{ docker_apt_arch }} signed-by=/etc/apt/keyrings/docker.gpg] {{ docker_repo_url }}/{{ docker_apt_ansible_distribution | lower }} {{ ansible_distribution_release }} {{ docker_apt_release_channel }}" +docker_apt_repository: "deb [arch={{ docker_apt_arch }} signed-by=/etc/apt/keyrings/docker.asc] {{ docker_repo_url }}/{{ docker_apt_ansible_distribution | lower }} {{ ansible_distribution_release }} {{ docker_apt_release_channel }}" docker_apt_ignore_key_error: true docker_apt_gpg_key: "{{ docker_repo_url }}/{{ docker_apt_ansible_distribution | lower }}/gpg" docker_apt_gpg_key_checksum: "sha256:1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570" diff --git a/tasks/setup-Debian.yml b/tasks/setup-Debian.yml index 7a3cb03..2415cb1 100644 --- a/tasks/setup-Debian.yml +++ b/tasks/setup-Debian.yml @@ -33,13 +33,16 @@ state: directory mode: '0755' -- name: Ensure curl is present - package: name=curl state=present - -- name: Add Docker apt key - shell: > - curl -fsSL {{ docker_apt_gpg_key }} | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg --yes - changed_when: false +- name: Add Docker apt key. + ansible.builtin.get_url: + url: "{{ docker_apt_gpg_key }}" + dest: /etc/apt/keyrings/docker.asc + mode: '0644' + force: false + checksum: "{{ docker_apt_gpg_key_checksum | default(omit) }}" + register: add_repository_key + ignore_errors: "{{ docker_apt_ignore_key_error }}" + when: docker_add_repo | bool - name: Change permissions for /etc/apt/keyrings/docker.gpg file: From d8f92e18746617045dc27f376a8049d6253c8024 Mon Sep 17 00:00:00 2001 From: Omkar Kawade Date: Mon, 18 Dec 2023 12:56:14 -0800 Subject: [PATCH 6/6] 434 remove permissions update, add reverse compatibility --- tasks/setup-Debian.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tasks/setup-Debian.yml b/tasks/setup-Debian.yml index 2415cb1..04b427d 100644 --- a/tasks/setup-Debian.yml +++ b/tasks/setup-Debian.yml @@ -44,10 +44,14 @@ ignore_errors: "{{ docker_apt_ignore_key_error }}" when: docker_add_repo | bool -- name: Change permissions for /etc/apt/keyrings/docker.gpg - file: - path: /etc/apt/keyrings/docker.gpg - mode: 'a+r' +- name: Ensure curl is present (on older systems without SNI). + package: name=curl state=present + when: add_repository_key is failed and docker_add_repo | bool + +- name: Add Docker apt key (alternative for older systems without SNI). + shell: > + curl -sSL {{ docker_apt_gpg_key }} | apt-key add - + when: add_repository_key is failed and docker_add_repo | bool - name: Add Docker repository. apt_repository: