canonical / canonical/cloud-init

Listing apt keys doesn't work after apt-file deprecation

Open
#5,333 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
3.8k
Forks
1.1k
Avg merge
2d 23h
Merged PRs (30d)
18

Description

The [code to list GPG keys](https://github.com/canonical/cloud-init/blob/19cb8cf926a31bef1d60a643a7f9d945f9a16591/cloudinit/gpg.py#L80) expects to receive a keyring. It calls
```
gpg --no-options --with-fingerprint --no-default-keyring --list-keys --keyring
```

That's fine when using the deprecated `/etc/apt/trusted.gpg` as `trusted.gpg` is a key ring.

However, its only [call site](https://github.com/canonical/cloud-init/blob/19cb8cf926a31bef1d60a643a7f9d945f9a16591/cloudinit/config/cc_apt_configure.py#L1243) will also list all files under `/etc/apt/trusted.gpg.d`, which are not keyrings. They are simply dearmored public keys and so will not work with the `--list-keys` command.

That said, it appears that this code [isn't even used anywhere](https://github.com/canonical/cloud-init/blob/19cb8cf926a31bef1d60a643a7f9d945f9a16591/cloudinit/config/cc_apt_configure.py#L1251-L1252), so we might be better off just deleting it altogether.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.