chore: migrate to new apt repositories

Makefile

@@ -3,7 +3,7 @@ AMI_ARCH=x86_64
 AMI_PREFIX=semaphore-agent
 AMI_INSTANCE_TYPE=t2.micro
 AGENT_VERSION=v2.2.16
-TOOLBOX_VERSION=v1.20.5
+TOOLBOX_VERSION=v1.38.4
 PACKER_OS=linux
 UBUNTU_VERSION=focal
 SOURCE_AMI?=

packer/linux/ansible/group_vars/all.yml

@@ -7,9 +7,16 @@ awscli_url: "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-{{ awscli_vers
 docker_apt_repository: "deb [arch=amd64] https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
 docker_apt_gpg_key: "https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg"
 yq_url: "https://github.com/mikefarah/yq/releases/download/v4.16.2/yq_linux_amd64"
-erlang_gpg_key_url: https://github.com/rabbitmq/signing-keys/releases/download/3.0/cloudsmith.rabbitmq-erlang.E495BB49CC4BBE5B.key
-erlang_gpg_key_checksum: "84df2e5fd80d464c3eb9acd2f751b2f6a723438200915dd50fbf12f08698e4ec"
-erlang_gpg_key_path: /usr/share/keyrings/rabbitmq-erlang.E495BB49CC4BBE5B.asc
+erlang_gpg_key_url: https://keys.openpgp.org/vks/v1/by-fingerprint/0A9AF2115F4687BD29803A206B73A36E6026DFCA
+erlang_gpg_key_checksum: "f06ccb0568a012e751e276c15b733494147fbb0663c79ab77f3574def4767f99"
+erlang_gpg_key_path: /usr/share/keyrings/com.rabbitmq.team.gpg
+erlang_gpg_key_source_path: "{{ erlang_gpg_key_path }}.asc"
+erlang_repo_mirrors:
+  - https://deb1.rabbitmq.com
+  - https://deb2.rabbitmq.com
+erlang_package_specs:
+  # Pin Erlang 26.2.5.13 across all Ubuntu releases for consistent builds.
+  default: erlang-base=1:26.2.5.13-1
 cloudwatch_agent_url: https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb
 systemd_restart_seconds: 300
 apt_hold_patterns: []

packer/linux/ansible/roles/erlang/tasks/main.yml

@@ -1,24 +1,36 @@
 ---
 - name: Download GPG key
+  register: erlang_gpg_key_download
   ansible.builtin.get_url:
     url: "{{ erlang_gpg_key_url }}"
-    dest: "{{ erlang_gpg_key_path }}"
+    dest: "{{ erlang_gpg_key_source_path }}"
     checksum: "sha256:{{ erlang_gpg_key_checksum }}"
-    mode: '0755'
+    mode: '0644'
     force: true
 
-- name: "Add repository to APT sources list"
-  ansible.builtin.apt_repository:
-    repo: "deb [arch=amd64 signed-by={{ erlang_gpg_key_path }}] https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-erlang/deb/ubuntu focal main"
-    state: present
+- name: Check existing keyring
+  ansible.builtin.stat:
+    path: "{{ erlang_gpg_key_path }}"
+  register: erlang_gpg_keyring
 
-- name: "Add src repository to APT sources list"
+- name: De-Armor GPG key
+  ansible.builtin.command:
+    cmd: "gpg --dearmor --yes --output {{ erlang_gpg_key_path }} {{ erlang_gpg_key_source_path }}"
+  when: erlang_gpg_key_download.changed or not erlang_gpg_keyring.stat.exists
+
+- name: "Add repository to APT sources list"
   ansible.builtin.apt_repository:
-    repo: "deb-src [signed-by={{ erlang_gpg_key_path }}] https://ppa1.rabbitmq.com/rabbitmq/rabbitmq-erlang/deb/ubuntu focal main"
+    repo: >-
+      deb [arch=amd64 signed-by={{ erlang_gpg_key_path }}]
+      {{ item }}/rabbitmq-erlang/{{ ansible_distribution | lower }}/{{ ansible_distribution_release }}
+      {{ ansible_distribution_release }} main
     state: present
+  loop: "{{ erlang_repo_mirrors }}"
+  loop_control:
+    label: "{{ item }}"
 
 - name: Install Erlang
   when: install_erlang | bool
   ansible.builtin.apt:
     pkg:
-      - erlang-base=1:24.3.4.17-1
+      - "{{ erlang_package_specs.get(ansible_distribution_release, erlang_package_specs.default) }}"