canonical / canonical/cloud-init
[enhancement]: improve get gpg keyserver documentation in schema and examples
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 1.1k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 18
Description
# Enhancement
## Background
Trying to install `docker` using `apt` config in cloud-init.
The [docker docs] get the gpg key directly from https://download.docker.com/linux/ubuntu/gpg.
I can get this to work in cloud-init (and multipass) by manually extracting the `keyid` from the actual key, for example using
```bash
wget -qO- https://download.docker.com/linux/ubuntu/gpg | gpg --with-fingerprint --with-colons
```
and doing the following:
```yaml
apt:
sources:
docker:
keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
keyserver: https://download.docker.com/linux/ubuntu/gpg
source: deb [arch=amd64 signed-by=$KEY_FILE] https://download.docker.com/linux/ubuntu $RELEASE stable
```
Note this seems to work both *with* `signed-by=$KEY_FILE` and *without*.
Another option is just to download the key manually and include the raw value under `apt.sources.docker.key`.
However, both approaches require a manual step that is not so obvious, as may be apparent from the number of views and variety of responses to [this so question].
## Proposal
Would it not be possible to simply get the key directly from a url, in line with the [docker docs]?
For example, something like the following would make sense to me:
```yaml
apt:
sources:
docker:
key: https://download.docker.com/linux/ubuntu/gpg
source: deb [arch=amd64] https://download.docker.com/linux/ubuntu $RELEASE stable
```
or, alternatively, using `keyserver` *without* the need for the `keyid`:
```yaml
apt:
sources:
docker:
keyserver: https://download.docker.com/linux/ubuntu/gpg
source: deb [arch=amd64] https://download.docker.com/linux/ubuntu $RELEASE stable
```
Neither of those options seem to work presently.
## Docs
On a related note: the [cloud-init docs] mention `keyserver` as an "*alternate* keyserver":
>- `keyid`: a key to import via shortid or fingerprint.
>- `key`: a raw PGP key.
>- `keyserver`: alternate keyserver to pull `keyid` key from.
The word *alternate* implies there is also a *default* keyserver.
I assume it's this:
https://github.com/canonical/cloud-init/blob/c3e881f2c4f161b42c0afcb6efee3fbbe9de472a/cloudinit/config/cc_apt_configure.py#L58
Afaik this is only mentioned in some comments in the documentation examples, but it is not mentioned explicitly in the actual "apt configure" docs.
[cloud-init docs]: https://cloudinit.readthedocs.io/en/latest/reference/modules.html#apt-configure
[docker docs]: https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository
[this so question]: https://stackoverflow.com/questions/24418815/how-do-i-install-docker-using-cloud-init
Contributor guide
Assessment
This issue has not been assessed yet.