Package install fails when using ondrej PPA due to missing PGP key

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 4.10.8
• Ruby:
• Distribution:Ubuntu 16.04
• Module version: 3.4.1

How to reproduce (e.g Puppet code you use)

  class { '::php':
    ensure              => latest,
    composer            => false,
    manage_repos        => true,
    extensions => {
      gd         => {
        provider => 'apt',
        source   => 'php7-gd',
      },
      curl       => {
        provider => 'apt',
        source   => 'php-curl',
      },
      mysql     => {
      },
      mcrypt     => {
        provider => 'apt',
        source   => 'php-mcrypt',
      },
      mbstring   => {
        provider => 'apt',
        source   => 'php-mbstring',
      },
    },
  }

What are you seeing

Can't install packages from ondrej PPA due to missing PGP key.

What behaviour did you expect instead

successful authenticated package install

Output log

Could not update: Execution of '/usr/bin/apt-get -q -y -o DPkg::Options::=--force-confold install php7.0-cli' returned 100: Reading package lists... Building dependency tree... Reading state information... The following additional packages will be installed: libssl1.1 php-common php7.0-common php7.0-json php7.0-opcache php7.0-readline Suggested packages: php-pear The following NEW packages will be installed: libssl1.1 php-common php7.0-cli php7.0-common php7.0-json php7.0-opcache php7.0-readline 0 upgraded, 7 newly installed, 0 to remove and 137 not upgraded. Need to get 3621 kB of archives. After this operation, 13.1 MB of additional disk space will be used. WARNING: The following packages cannot be authenticated! libssl1.1 php-common php7.0-common php7.0-json php7.0-opcache php7.0-readline php7.0-cli E: There were unauthenticated packages and -y was used without --allow-unauthenticated

Any additional information you'd like to impart

If following code is used (add PGP key of ondrej using apt::key) and require => Apt::Key['ondrej'] is inserted in class { '::php': then it looks like everything is working ok.

  apt::key { 'ondrej':
    id      => '14AA40EC0831756756D7F66C4F4EA0AAE5267A6C',
    server  => 'pgp.mit.edu',
    notify  => Exec['apt_update']
  }

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 4.10.8
• Ruby:
• Distribution:Ubuntu 16.04
• Module version: 3.4.1

How to reproduce (e.g Puppet code you use)

  class { '::php':
    ensure              => latest,
    composer            => false,
    manage_repos        => true,
    extensions => {
      gd         => {
        provider => 'apt',
        source   => 'php7-gd',
      },
      curl       => {
        provider => 'apt',
        source   => 'php-curl',
      },
      mysql     => {
      },
      mcrypt     => {
        provider => 'apt',
        source   => 'php-mcrypt',
      },
      mbstring   => {
        provider => 'apt',
        source   => 'php-mbstring',
      },
    },
  }

What are you seeing

Can't install packages from ondrej PPA due to missing PGP key.

What behaviour did you expect instead

successful authenticated package install

Output log

Could not update: Execution of '/usr/bin/apt-get -q -y -o DPkg::Options::=--force-confold install php7.0-cli' returned 100: Reading package lists... Building dependency tree... Reading state information... The following additional packages will be installed: libssl1.1 php-common php7.0-common php7.0-json php7.0-opcache php7.0-readline Suggested packages: php-pear The following NEW packages will be installed: libssl1.1 php-common php7.0-cli php7.0-common php7.0-json php7.0-opcache php7.0-readline 0 upgraded, 7 newly installed, 0 to remove and 137 not upgraded. Need to get 3621 kB of archives. After this operation, 13.1 MB of additional disk space will be used. WARNING: The following packages cannot be authenticated! libssl1.1 php-common php7.0-common php7.0-json php7.0-opcache php7.0-readline php7.0-cli E: There were unauthenticated packages and -y was used without --allow-unauthenticated

Any additional information you'd like to impart

If following code is used (add PGP key of ondrej using apt::key) and require => Apt::Key['ondrej'] is inserted in class { '::php': then it looks like everything is working ok.

  apt::key { 'ondrej':
    id      => '14AA40EC0831756756D7F66C4F4EA0AAE5267A6C',
    server  => 'pgp.mit.edu',
    notify  => Exec['apt_update']
  }

Start at the ::php class and its manage_repos handling, then inspect the Apt::Key resource and Exec['apt_update'] relationship described in the issue. Reproduce the package installation on Ubuntu 16.04 and verify that the ondrej PPA packages install authenticated without requiring a manual Apt::Key declaration.