canonical / canonical/cloud-init

[enhancement]: Apt Keyring Location Should Be Configurable

Open
#5,952 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
3.8k
Forks
1.1k
Avg merge
2d 23h
Merged PRs (30d)
18

Description

# Enhancement

Cloud-init is very nice for bootstrapping a machine before running desired state utilities against it, in particular, repositories to ensure tooling is available before a script/program runs. For ongoing management of those repositories I'd like to standardize the location of the apt keys with ones I'll add outside of the purview of cloud-init. Right now, the apt module hard codes `CLOUD_INIT_GPG_DIR` to a special folder. For semi-trusted keyrings, there seems to be some [consensus](https://askubuntu.com/a/1437410/945240) around placing them in `/etc/apt/keyrings` or `/usr/share/keyrings`.

https://github.com/canonical/cloud-init/blob/9bac08a99b32835a32d4a83c41ac741dbf0c9b12/cloudinit/config/cc_apt_configure.py#L34

I thought I might be able to specify the path to the key but looking at the source but it doesn't seem like it parses the source for `signed-by`. Just a binary choice between the special folder and trusted folder.

https://github.com/canonical/cloud-init/blob/9bac08a99b32835a32d4a83c41ac741dbf0c9b12/cloudinit/config/cc_apt_configure.py#L1103-L1105

Is there a technical reason for placing them in their own directory? It would be really nice if there were an `apt::keyring_dir` property to override the default value. :)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.