From 6592bfc6ba3fcb65f549e316844c2e58cc2c77e7 Mon Sep 17 00:00:00 2001 From: Carl-Christian Salvesen Date: Wed, 27 Sep 2017 13:12:13 +0200 Subject: [PATCH 1/4] Don't run apt-get update on every puppetrun * Read the $metadata_expire variable, and skip apt-get update if it's fresh enough. * Import the gpg key only if it is missing. --- manifests/repo.pp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/manifests/repo.pp b/manifests/repo.pp index 3f60778..399ccc3 100644 --- a/manifests/repo.pp +++ b/manifests/repo.pp @@ -74,12 +74,14 @@ command => "wget --auth-no-challenge -qO - ${base_url}/${repo_name}/gpgkey | apt-key add -", path => '/usr/bin/:/bin/', require => File[$normalized_name], + unless => "gpg --batch --no-default-keyring --keyring /etc/apt/trusted.gpg --list-keys ${base_url}/${repo_name}", } exec { "apt_get_update_${normalized_name}": command => "apt-get update -o Dir::Etc::sourcelist=\"sources.list.d/${normalized_name}.list\" -o Dir::Etc::sourceparts=\"-\" -o APT::Get::List-Cleanup=\"0\"", path => '/usr/bin/:/bin/', require => Exec["apt_key_add_${normalized_name}"], + onlyif => "test $[$(date +%s) - $(stat -c%Y /var/cache/apt/pkgcache.bin)] -gt ${metadata_expire}", } } default: { From b06e2f59164ced1072ca79eee6330835d9715e8b Mon Sep 17 00:00:00 2001 From: Carl-Christian Salvesen Date: Wed, 27 Sep 2017 14:54:07 +0200 Subject: [PATCH 2/4] Add support for overriding distro name --- manifests/repo.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/repo.pp b/manifests/repo.pp index 399ccc3..e7942c7 100644 --- a/manifests/repo.pp +++ b/manifests/repo.pp @@ -25,6 +25,7 @@ $priority = undef, $metadata_expire = 300, $server_address = 'https://packagecloud.io', + $distribution = $::lsbdistcodename, ) { validate_string($type) validate_string($master_token) @@ -61,7 +62,6 @@ $component = 'main' $repo_url = "${base_url}/${repo_name}/${osname}" - $distribution = $::lsbdistcodename file { $normalized_name: ensure => file, From 49770f2c1631e49890325651a31cb9d9af78e91e Mon Sep 17 00:00:00 2001 From: Carl-Christian Salvesen Date: Tue, 3 Oct 2017 16:26:21 +0200 Subject: [PATCH 3/4] Only add keys once --- manifests/repo.pp | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/manifests/repo.pp b/manifests/repo.pp index e7942c7..594d353 100644 --- a/manifests/repo.pp +++ b/manifests/repo.pp @@ -68,13 +68,20 @@ path => "/etc/apt/sources.list.d/${normalized_name}.list", mode => '0644', content => template('packagecloud/apt.erb'), + notify => Exec["apt_key_add_${normalized_name}"], } - exec { "apt_key_add_${normalized_name}": - command => "wget --auth-no-challenge -qO - ${base_url}/${repo_name}/gpgkey | apt-key add -", - path => '/usr/bin/:/bin/', + exec { "apt_key_download_${normalized_name}": + command => "wget --auth-no-challenge -q -O /etc/apt/sources.list.d/${normalized_name}.list ${base_url}/${repo_name}/gpgkey", + creates => "/var/cache/apt/${normalized_name}.gpgkey", require => File[$normalized_name], - unless => "gpg --batch --no-default-keyring --keyring /etc/apt/trusted.gpg --list-keys ${base_url}/${repo_name}", + notify => Exec["apt_key_add_${normalized_name}"], + } + + exec { "apt_key_add_${normalized_name}": + command => "apt-key add /var/cache/apt/${normalized_name}.gpgkey", + path => '/usr/bin/:/bin/', + refreshonly => true, } exec { "apt_get_update_${normalized_name}": @@ -94,7 +101,7 @@ 'RedHat', 'redhat', 'CentOS', 'centos', 'Amazon', 'Fedora', 'Scientific', 'OracleLinux', 'OEL': { $majrel = $::osreleasemaj - if $::pygpgme_installed == 'false' { + if $::pygpgme_installed == false { warning('The pygpgme package could not be installed. This means GPG verification is not possible for any RPM installed on your system. To fix this, add a repository with pygpgme. Usualy, the EPEL repository for your system will have this. More information: https://fedoraproject.org/wiki/EPEL#How_can_I_use_these_extra_packages.3F and https://github.com/stahnma/puppet-module-epel') $repo_gpgcheck = 0 } else { From 8b8a572f31ac32bbd5abfd196f04c6497a5c6c31 Mon Sep 17 00:00:00 2001 From: Carl-Christian Salvesen Date: Thu, 12 Oct 2017 14:25:38 +0200 Subject: [PATCH 4/4] Do not refresh keys and apt on every run --- manifests/repo.pp | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/manifests/repo.pp b/manifests/repo.pp index 594d353..51e4f6d 100644 --- a/manifests/repo.pp +++ b/manifests/repo.pp @@ -72,10 +72,12 @@ } exec { "apt_key_download_${normalized_name}": - command => "wget --auth-no-challenge -q -O /etc/apt/sources.list.d/${normalized_name}.list ${base_url}/${repo_name}/gpgkey", + command => "wget --auth-no-challenge -q -O /var/cache/apt/${normalized_name}.gpgkey ${base_url}/${repo_name}/gpgkey", + path => '/usr/bin/:/bin/', creates => "/var/cache/apt/${normalized_name}.gpgkey", require => File[$normalized_name], notify => Exec["apt_key_add_${normalized_name}"], + unless => "/usr/bin/gpg --with-colons /etc/apt/trusted.gpg | /bin/grep -F \"$(/usr/bin/gpg --with-colons /var/cache/apt/${normalized_name}.gpgkey)\"", } exec { "apt_key_add_${normalized_name}": @@ -85,12 +87,15 @@ } exec { "apt_get_update_${normalized_name}": - command => "apt-get update -o Dir::Etc::sourcelist=\"sources.list.d/${normalized_name}.list\" -o Dir::Etc::sourceparts=\"-\" -o APT::Get::List-Cleanup=\"0\"", - path => '/usr/bin/:/bin/', - require => Exec["apt_key_add_${normalized_name}"], - onlyif => "test $[$(date +%s) - $(stat -c%Y /var/cache/apt/pkgcache.bin)] -gt ${metadata_expire}", + command => "apt-get update -o Dir::Etc::sourcelist=\"sources.list.d/${normalized_name}.list\" -o Dir::Etc::sourceparts=\"-\" -o APT::Get::List-Cleanup=\"0\"", + path => '/usr/bin/:/bin/', + require => Exec["apt_key_add_${normalized_name}"], + subscribe => Exec["apt_key_add_${normalized_name}"], + refreshonly => true, +# onlyif => "test $[$(date +%s) - $(stat -c%Y /var/cache/apt/pkgcache.bin)] -gt ${metadata_expire}", } } + default: { fail("Sorry, ${::operatingsystem} isn't supported for apt repos at this time. Email support@packagecloud.io") }