From 8cf2fef7ecefa4cff9ae1545eddc9a07c0dc4fc0 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Mon, 19 Aug 2024 09:48:40 -0300
Subject: [PATCH] Changes on Tor, Signal and APT repository handling

---
 .../signal.org.gpg                            | Bin
 .../keyrings/deb.torproject.org-keyring.gpg}  | Bin 37730 -> 38678 bytes
 manifests/subsystem/apt/repo.pp               |  24 +++++++++++++++---
 manifests/utils/network/signal.pp             |   4 +--
 manifests/utils/network/tor.pp                |  21 ++++++++++++---
 5 files changed, 39 insertions(+), 10 deletions(-)
 rename files/etc/apt/{trusted.gpg.d => keyrings}/signal.org.gpg (100%)
 rename files/{etc/apt/trusted.gpg.d/torproject.org.gpg => usr/share/keyrings/deb.torproject.org-keyring.gpg} (96%)

diff --git a/files/etc/apt/trusted.gpg.d/signal.org.gpg b/files/etc/apt/keyrings/signal.org.gpg
similarity index 100%
rename from files/etc/apt/trusted.gpg.d/signal.org.gpg
rename to files/etc/apt/keyrings/signal.org.gpg
diff --git a/files/etc/apt/trusted.gpg.d/torproject.org.gpg b/files/usr/share/keyrings/deb.torproject.org-keyring.gpg
similarity index 96%
rename from files/etc/apt/trusted.gpg.d/torproject.org.gpg
rename to files/usr/share/keyrings/deb.torproject.org-keyring.gpg
index 7614b2039d918e50e3ba16a23ae24693d53461a2..738ef5d7f1408470e1f1e2d6cf4e7639fc5e3f7f 100644
GIT binary patch
delta 594
zcmV-Y0<HbxrUI6(0<Z&wldXb0e`Zazo&^abwQMs03JDPIjJ%$RZQY4*S_l7G&=?%-
z5e1r)js_U!bINm~A_y{hzNu>y=*z6mWpm97EbDIjM^Sy3pR^ohDp6CFS7_pdo#xWr
z)WaoRV62?dkZ`_2fkiLf*Epw1L8A9ma^daO@IPG&hp^th+NE(c1D)A?e_2Y6uwc!#
zTLzV7i^%eX^J~{|GK0$4MRcC(gWtL-n>H6<hn;V@8Q$up*Dzr7&_GFBrE{Y6h^PHC
z6|(~?(71hv-TzGG(M1Y0QB}k_ga)i|(jV!mvaHfWpuOQGPz(Dsh%tt&FI~g_+;3d5
z(rT)D&rh0!vG)nzIynU!9C!YnhWn2M5~_jBqK=@fqhe0-z^^GpV7}17p|b;oUk?X~
z0$T(a0Sc2(j2;SRO|+*42_OJ77qhvED*=BXO$Yx-!*{!G`f&i>FnosBaG6R5Cz9++
z0d&ZmYBO(hzvl-d<;>*1;PWB;=!uBMUqIk(3-q+sNm1LX=bCuaG9gRBLE{#x&|WJ7
z?Y(vYy<-L9pcu>^szll`)Mz0P2z%s_{x7-}2hXO&dnH9w*`0=oc?qc3y2G6lBA0*i
zJUB#H!t8cd#J&cJAEZx0-|F#j8*4%$)OXCIQLc#X(Ifb&jW={>{$^mkSCg$9jbl&6
z1;s5z3Qmh9iYl|B1DzUiDcY59)&+jZGYkks^`uC5&6vjr@oVB{+eoCsZwHl!n)v>w
g$jhayYAwdk_)Ei!l{l+ff6M%L%}oaCpiaw&fdjQC?*IS*

delta 14
VcmbQXj_J`drVY$3n<HD}`2jIt1_uBD

diff --git a/manifests/subsystem/apt/repo.pp b/manifests/subsystem/apt/repo.pp
index ca8f5e1..d6e03c0 100644
--- a/manifests/subsystem/apt/repo.pp
+++ b/manifests/subsystem/apt/repo.pp
@@ -1,15 +1,31 @@
 define nodo::subsystem::apt::repo(
   $definition,
   $key_source,
-  $ensure = present,
+  $keyrings_folder = '/etc/apt/keyrings',
+  $ensure          = present,
 ) {
-  file { "/etc/apt/trusted.gpg.d/${name}.gpg":
+  # The recommended locations for keyrings are /usr/share/keyrings for keyrings
+  # managed by packages, and /etc/apt/keyrings for keyrings managed by the
+  # system operator. If no keyring files are specified the default is the
+  # trusted.gpg keyring and all keyrings in the trusted.gpg.d/ directory (see
+  # apt-key fingerprint).
+  #
+  # -- sources.list(5)
+  file { "${keyrings_folder}/${name}.gpg":
     ensure  => $ensure,
     owner   => "root",
     group   => "root",
     mode    => "0644",
     source  => $key_source,
-    notify  => Exec["apt-repo-auto-update-${name}"],
+  }
+
+  # Old location
+  file { "/etc/apt/trusted.gpg.d/${name}.gpg":
+    ensure  => absent,
+    owner   => "root",
+    group   => "root",
+    mode    => "0644",
+    source  => $key_source,
   }
 
   file { "/etc/apt/sources.list.d/${name}.list":
@@ -18,7 +34,7 @@ define nodo::subsystem::apt::repo(
     group   => "root",
     mode    => "0644",
     content => "${definition}\n",
-    require => [ File["/etc/apt/trusted.gpg.d/${name}.gpg"], Package['apt-transport-https'] ],
+    require => [ File["${keyrings_folder}/${name}.gpg"], Package['apt-transport-https'] ],
     notify  => Exec["apt-repo-auto-update-${name}"],
   }
 
diff --git a/manifests/utils/network/signal.pp b/manifests/utils/network/signal.pp
index 037140a..6cd200b 100644
--- a/manifests/utils/network/signal.pp
+++ b/manifests/utils/network/signal.pp
@@ -1,7 +1,7 @@
 class nodo::utils::network::signal {
   nodo::subsystem::apt::repo { 'signal.org':
-    definition => 'deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main',
-    key_source => 'puppet:///modules/nodo/etc/apt/trusted.gpg.d/signal.org.gpg',
+    definition => 'deb [signed-by=/etc/apt/keyrings/signal.org.gpg arch=amd64] https://updates.signal.org/desktop/apt xenial main',
+    key_source => 'puppet:///modules/nodo/etc/apt/keyrings/signal.org.gpg',
   }
 
   package { 'signal-desktop':
diff --git a/manifests/utils/network/tor.pp b/manifests/utils/network/tor.pp
index 78b08a4..f8726f7 100644
--- a/manifests/utils/network/tor.pp
+++ b/manifests/utils/network/tor.pp
@@ -3,9 +3,15 @@
 class nodo::utils::network::tor (
   $ensure = 'installed',
 ) {
-  nodo::subsystem::apt::repo { 'torproject.org':
-    definition => "deb [signed-by=/etc/apt/trusted.gpg.d/torproject.org.gpg] https://deb.torproject.org/torproject.org ${::lsbdistcodename} main",
-    key_source => 'puppet:///modules/nodo/etc/apt/trusted.gpg.d/torproject.org.gpg',
+  # Old keyring location
+  file { '/etc/apt/trusted.gpg.d/torproject.org.gpg':
+    ensure => absent,
+  }
+
+  nodo::subsystem::apt::repo { 'deb.torproject.org-keyring.gpg':
+    definition      => "deb [signed-by=/usr/share/keyrings/deb.torproject.org-keyring.gpg] https://deb.torproject.org/torproject.org ${::lsbdistcodename} main",
+    key_source      => 'puppet:///modules/nodo/usr/share/keyrings/deb.torproject.org-keyring.gpg',
+    keyrings_folder => '/usr/share/keyrings',
   }
 
   package { "deb.torproject.org-keyring":
@@ -14,8 +20,15 @@ class nodo::utils::network::tor (
   }
 
   package { [
-    'tor-arm',
+    'nyx',
   ]:
     ensure => $ensure,
   }
+
+  # Package 'tor-arm' was renamed to 'nyx'
+  package { [
+    'tor-arm',
+  ]:
+    ensure => absent,
+  }
 }
-- 
2.39.5