cloud-init shouldn't use apt-key

[ubuntu-server-builder]

This bug was originally filed in Launchpad as LP: #1836336

Launchpad details

affected_projects = []
assignee = holmanb
assignee_name = Brett Holman
date_closed = 2021-11-02T19:54:11.759887+00:00
date_created = 2019-07-12T08:41:08.109276+00:00
date_fix_committed = 2021-10-29T19:34:13.901299+00:00
date_fix_released = 2021-11-02T19:54:11.759887+00:00
id = 1836336
importance = high
is_complete = True
lp_url = https://bugs.launchpad.net/cloud-init/+bug/1836336
milestone = None
owner = juliank
owner_name = Julian Andres Klode
private = False
status = fix_released
submitter = juliank
submitter_name = Julian Andres Klode
tags = []
duplicates = [1892493, 1930281]

Launchpad user Julian Andres Klode(juliank) wrote on 2019-07-12T08:41:08.109276+00:00

In cc_apt_configure.py, add_apt_key_raw() uses apt-key to add keys. apt-key is deprecated (that's why it prints a warning)

It should instead be dropping raw .gpg files or (optionally, starting with bionic / apt 1.4) ASCII armored .asc files into trusted.gpg.d, with a name matching the name of the source.

Not sure if there are other places.

[ubuntu-server-builder]

Launchpad user Dan Watkins(oddbloke) wrote on 2019-07-15T19:30:32.539436+00:00

Hi Julian,

Thanks for letting us know! I have a couple of questions, one to help us understand priority and one to inform implementation once we get there:

• Are there any plans to remove apt-key from Debian or Ubuntu any time soon? (i.e. Is there a forcing function here?)
• When you say "with a name matching the name of the source", is that a strict requirement for the key to be found, or best practice?

Thanks!

Dan

[ubuntu-server-builder]

Launchpad user Julian Andres Klode(juliank) wrote on 2019-07-22T19:46:11.397771+00:00

• Are there any plans to remove apt-key from Debian or Ubuntu any time soon? (i.e. Is there a forcing function here?)

I don't really know. I mean, I'd love to, as I'm probably going to kill use of apt-key in apt entirely. It also does not work on Debian without installing gnupg first (which is installed in Ubuntu IIRC)

• When you say "with a name matching the name of the source", is that a strict requirement for the key to be found, or best practice?

A best practice, though I'm considering the possibility of automatically restricting a foo.list to use a foo.gpg key if the foo.gpg key exists.

[ubuntu-server-builder]

Launchpad user James Falcon(falcojr) wrote on 2021-09-28T14:56:58.694905+00:00

Changed priority to high as support for apt-key will soon be removed.

[ubuntu-server-builder]

Launchpad user James Falcon(falcojr) wrote on 2021-10-29T19:34:33.250208+00:00

See #1068

[ubuntu-server-builder]

Launchpad user James Falcon(falcojr) wrote on 2021-11-02T19:54:13.039583+00:00

This bug is believed to be fixed in cloud-init in version 21.4. If this is still a problem for you, please make a comment and set the state back to New

Thank you.