sous-chefs / sous-chefs/packagecloud
Packagecloud apt key rotation not applied
Open
Nobody has claimed this yet.
Feature Request
- Dominant language
- Ruby
- Stars
- 17
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
The packagecloud_repo repo only pulls the GPG key during deployment; and does not detect in any way that the key might have been rotated.
To properly solve this, the resource needs to keep the downloaded key, and be able to compare it back against the server copy for updates.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the packagecloud_repo resource and trace how the GPG key is downloaded during deployment. Determine where the downloaded key can be retained and compared with the server copy, then verify that a rotated key is detected and applied. The issue does not name a specific file or test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100