(PE-32680) Fix GPG key refresh for PE 2023.8.0 and earlier - #308
Open
cthorn42 wants to merge 1 commit into
Open
Conversation
Extends the existing PE-32680 GPG key workaround to cover PE 2023.8.0 and earlier (previously capped at 2019.8.4), and fixes two bugs that were silently breaking the refresh itself: - The default GPG_URL pointed at a dead Artifactory link (404). Since curl lacked --fail, the 404 body was written straight into the key file instead of erroring, and rpm --import failed with "not an armored public key". Now defaults to https://yum.puppet.com/RPM-GPG-KEY-puppet, a live copy of the same key with a renewed (non-expired) self-signature, and curl now fails loudly on a bad download. - Some PE releases ship a second, separately-dated copy of the key (e.g. GPG-KEY-puppet-2025-04-06) alongside the undated one, which frictionless install scripts read directly. Only the undated file was being refreshed, so the dated copy stayed expired and frictionless installs kept failing GPG verification even after the above fix. Now refreshes any dated siblings found alongside the undated file. Verified against a live PE 2023.8.0 install/frictionless-agent run on SLES 15 (previously failing with expired-key signature errors on both the master's local repo and the frictionless agent's zypper repo); setup/install.rb now passes cleanly end to end.
Collaborator
Author
|
Looking to fix the 2023.8.0 cells in jobs like this: |
jonathannewman
approved these changes
Jul 24, 2026
Collaborator
Author
|
Failures are due to PE main CI issues around the pe-puppetserver. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GPG_URL, which pointed at a dead Artifactory link (404) —curllacked--fail, so the 404 body was silently written into the key file instead of erroring, andrpm --importfailed with "not an armored public key". Now defaults tohttps://yum.puppet.com/RPM-GPG-KEY-puppet, a live copy of the same key with a renewed (non-expired) self-signature, andcurl --failnow errors loudly on a bad download instead of corrupting the key fileGPG-KEY-puppet-2025-04-06) alongside the undated one, which frictionless install scripts read directly. Only the undated file was being refreshed, so the dated copy stayed expired and frictionless installs kept failing GPG verification even after the URL fix. Now refreshes any dated siblings found alongside the undated fileTest plan
setup/install.rbin pe_acceptance_tests now passes cleanly end to end (pre_suite: 1 passed / 0 failed / 0 errored) with this gem loaded viaBEAKER_PE_VERSION=file://...🤖 Generated with Claude Code