salt: Salt pkgrepo.managed for PPA Does not Import Keys
Description of Issue/Question
Salt no longer imports keys when using pkgrepo.managed with a ppa repository.
Setup
Ubuntu 14.04 LTS
salt 2015.8.8.2 (Beryllium)
Master - minion setup
Steps to Reproduce Issue
Noticed when I was upgrading all my servers PHP packages to 7.
----------
ID: php-pkgs
Function: pkg.installed
Result: False
Comment: The following packages failed to install/update: php-pear, php7.0-gd, php7.0-intl, php7.0-cli, php7.0, php7.0-mcrypt, php7.0-fpm, php7.0-mysql, php7.0-curl, php7.0-json, php7.0-sqlite3
Started: 01:07:47.464101
Duration: 10235.009 ms
Changes:
State that causes the issue:
php-repo:
pkgrepo.managed:
- humanname: PHP Repo
- ppa: ondrej/php
List of keys after running the salt state:
/etc/apt/trusted.gpg
--------------------
pub 1024D/437D05B5 2004-09-12
uid Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>
sub 2048g/79164387 2004-09-12
pub 1024D/FBB75451 2004-12-30
uid Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>
pub 4096R/C0B21F32 2012-05-11
uid Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>
pub 4096R/EFE21092 2012-05-11
uid Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>
pub 4096R/68576280 2014-06-13
uid NodeSource <gpg@nodesource.com>
sub 4096R/AA01DA2C 2014-06-13
pub 1024D/548C16BF 2010-06-29
uid New Relic <support@newrelic.com>
sub 2048g/77E8EB9A 2010-06-29
pub 2048R/DE57BFBE 2014-06-24
uid SaltStack Packaging Team <packaging@saltstack.com>
sub 2048R/17928113 2014-06-24
/etc/apt/trusted.gpg.d/nginx-stable.gpg
---------------------------------------
pub 1024R/C300EE8C 2010-07-21
uid Launchpad Stable
As you can see, it is missing the key for the specific PPA.
Versions Report
Salt Version:
Salt: 2015.8.8.2
Dependency Versions:
Jinja2: 2.7.2
M2Crypto: Not Installed
Mako: 0.9.1
PyYAML: 3.10
PyZMQ: 14.0.1
Python: 2.7.6 (default, Jun 22 2015, 17:58:13)
RAET: Not Installed
Tornado: 4.2.1
ZMQ: 4.0.4
cffi: Not Installed
cherrypy: Not Installed
dateutil: 1.5
gitdb: 0.5.4
gitpython: 0.3.2 RC1
ioflo: Not Installed
libgit2: Not Installed
libnacl: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.3.0
mysql-python: 1.2.3
pycparser: Not Installed
pycrypto: 2.6.1
pygit2: Not Installed
python-gnupg: Not Installed
smmap: 0.8.2
timelib: Not Installed
System Versions:
dist: Ubuntu 14.04 trusty
machine: x86_64
release: 3.13.0-83-generic
system: Ubuntu 14.04 trusty
About this issue
- Original URL
- State: closed
- Created 8 years ago
- Reactions: 3
- Comments: 31 (10 by maintainers)
After lots of debugging, I have found that the problem seems to be with apt-add-repository provided by Ubuntu, so this isn’t really a problem with salt. apt-add-repository apparently breaks when it encounters non-unicode characters when executing without an UTF-8 locale: https://github.com/oerdnj/deb.sury.org/issues/56
So, the workaround I used was to ignore the PPA bit of pkgrepo, and adding the repository like any other repository:
The result of this is almost exactly the same as using apt-add-repository, except that the imported key ends up in /etc/apt/trusted.gpg instead of a separate file. Using apt-add-repository would import that key into /etc/apt/trusted.gpg.d/ondrej_ubuntu_php.gpg instead, but I would say this is of minor importance.
Bigtime having this issue again. Should be fixed as it shouldn’t be a hard fix.
On ubuntu 16.04 with saltstack packages version “2016.11.5+ds-3”. Trying to add ppa:ondrej/php results in this:
So apparently it imports the key to a file “/tmp/tmpdlfjtc8z/trustdb.gpg” and forgets about it?
my saltstate file:
Resulting “apt-key list” output:
Saltstack versions report:
I wanted to report that I’m seeing this issue as well.
State:
After running this state, package still show as unauthenticated. The key does not show up when running
apt-key liston the target minion.apt updateshows the repository as unauthenticated.After running
wget -O - https://repo.saltstack.com/apt/debian/9/amd64/latest/SALTSTACK-GPG-KEY.pub | apt-key add -using acmd.runcall,apt updatereturns successfully, and I’m able to manage packages in this repository.Minion versions:
Can confirm for salt-minion 2017.7.4.
[salt.loaded.int.module.cmdmod:1715][ERROR ][19226] Command ‘[‘apt-add-repository’, ‘-y’, ‘ppa:ondrej/php’]’ failed with return code: 1 [salt.loaded.int.module.cmdmod:1717][ERROR ][19226] stdout: ‘ascii’ codec can’t decode byte 0xc5 in position 92: ordinal not in range(128)
Manually executing apt-add-repository works fine.
This workaround has been working for us for a while:
Still an issue.