canonical / canonical/cloud-init

[enhancement]: improve get gpg keyserver documentation in schema and examples

Open
#6,345 2 comments 0 reactions 0 assignees View on GitHub
documentation enhancement
Dominant language
Python
Stars
3.8k
Forks
1.1k
Avg merge
2d 23h
Merged PRs (30d)
18

Description

# Enhancement

## Background

Trying to install `docker` using `apt` config in cloud-init.

The [docker docs] get the gpg key directly from https://download.docker.com/linux/ubuntu/gpg.

I can get this to work in cloud-init (and multipass) by manually extracting the `keyid` from the actual key, for example using

```bash
wget -qO- https://download.docker.com/linux/ubuntu/gpg | gpg --with-fingerprint --with-colons
```

and doing the following:

```yaml
apt:
sources:
docker:
keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
keyserver: https://download.docker.com/linux/ubuntu/gpg
source: deb [arch=amd64 signed-by=$KEY_FILE] https://download.docker.com/linux/ubuntu $RELEASE stable
```

Note this seems to work both *with* `signed-by=$KEY_FILE` and *without*.

Another option is just to download the key manually and include the raw value under `apt.sources.docker.key`.

However, both approaches require a manual step that is not so obvious, as may be apparent from the number of views and variety of responses to [this so question].

## Proposal

Would it not be possible to simply get the key directly from a url, in line with the [docker docs]?

For example, something like the following would make sense to me:

```yaml
apt:
sources:
docker:
key: https://download.docker.com/linux/ubuntu/gpg
source: deb [arch=amd64] https://download.docker.com/linux/ubuntu $RELEASE stable
```

or, alternatively, using `keyserver` *without* the need for the `keyid`:

```yaml
apt:
sources:
docker:
keyserver: https://download.docker.com/linux/ubuntu/gpg
source: deb [arch=amd64] https://download.docker.com/linux/ubuntu $RELEASE stable
```

Neither of those options seem to work presently.

## Docs

On a related note: the [cloud-init docs] mention `keyserver` as an "*alternate* keyserver":

>- `keyid`: a key to import via shortid or fingerprint.
>- `key`: a raw PGP key.
>- `keyserver`: alternate keyserver to pull `keyid` key from.

The word *alternate* implies there is also a *default* keyserver.

I assume it's this:

https://github.com/canonical/cloud-init/blob/c3e881f2c4f161b42c0afcb6efee3fbbe9de472a/cloudinit/config/cc_apt_configure.py#L58

Afaik this is only mentioned in some comments in the documentation examples, but it is not mentioned explicitly in the actual "apt configure" docs.

[cloud-init docs]: https://cloudinit.readthedocs.io/en/latest/reference/modules.html#apt-configure
[docker docs]: https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository
[this so question]: https://stackoverflow.com/questions/24418815/how-do-i-install-docker-using-cloud-init

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.