Fix: nodo::utils::network::tor: setup the keyring only in the first time, then let...

diff --git a/manifests/subsystem/apt/repo.pp b/manifests/subsystem/apt/repo.pp
index d6e03c06af1fb009b575df9b4f14c6287eabc931..0495a0ff4614d80fa4066d08aaae723a60145195 100644 (file)
--- a/manifests/subsystem/apt/repo.pp
+++ b/manifests/subsystem/apt/repo.pp
@@ -2,6 +2,7 @@ define nodo::subsystem::apt::repo(
   $definition,
   $key_source,
   $keyrings_folder = '/etc/apt/keyrings',
+  $keyring_name    = $name,
   $ensure          = present,
 ) {
   # The recommended locations for keyrings are /usr/share/keyrings for keyrings

diff --git a/manifests/utils/network/tor.pp b/manifests/utils/network/tor.pp
index f8726f7a808d316b40bc6383fe55bb066f93d5b8..f93d37a19b9906fa9e6db9eb15a3d05bf1c94c26 100644 (file)
--- a/manifests/utils/network/tor.pp
+++ b/manifests/utils/network/tor.pp
@@ -3,15 +3,28 @@
 class nodo::utils::network::tor (
   $ensure = 'installed',
 ) {
-  # Old keyring location
-  file { '/etc/apt/trusted.gpg.d/torproject.org.gpg':
-    ensure => absent,
+  $keyrings_folder = "/usr/share/keyrings"
+  $keyring         = "${keyrings_folder}/deb.torproject.org-keyring.gpg"
+
+  nodo::subsystem::apt::repo { 'torproject.org':
+    definition      => "deb [signed-by=${keyring}] https://deb.torproject.org/torproject.org ${::lsbdistcodename} main",
+    key_source      => "puppet:///modules/nodo/${keyring}",
+    keyrings_folder => "${keyrings_folder}",
   }
 
-  nodo::subsystem::apt::repo { 'deb.torproject.org-keyring.gpg':
-    definition      => "deb [signed-by=/usr/share/keyrings/deb.torproject.org-keyring.gpg] https://deb.torproject.org/torproject.org ${::lsbdistcodename} main",
-    key_source      => 'puppet:///modules/nodo/usr/share/keyrings/deb.torproject.org-keyring.gpg',
-    keyrings_folder => '/usr/share/keyrings',
+  # Puppet should setup the Tor Project's APT keyring only in the first time
+  # Afterwards ${keyring} will be managed by the deb.torproject.org-keyring package
+  #
+  # References:
+  #
+  # * https://support.torproject.org/apt/tor-deb-repo/
+  # * https://gitlab.torproject.org/tpo/web/support/-/merge_requests/220
+  exec { 'torproject-keyring-copy':
+    command => "cp ${keyrings_folder}/torproject.org.gpg ${keyring}",
+    onlyif  => "/bin/test ! -e ${keyring}",
+    creates => "${keyring}",
+    require => File["${keyrings_folder}/torproject.org.gpg"],
+    notify  => Exec["apt-repo-auto-update-torproject.org"],
   }
 
   package { "deb.torproject.org-keyring":