Ignore subkeys in apt-key's output #665
Conversation
The output of `apt-key adv --list-keys --with-colons --fingerprint --fixed-list-mode` is always a `pub` line followed by one of more `fpr` lines (for subkeys, if any). This can cause the wrong pairs of `pub` and `fpr` lines to be hashed, resulting in nonsense. The ordering `pub`, `fpr`, `pub`, `fpr` is guaranteed by `apt-key`. Therefore, this commit clears `fpr_line` when a `pub` line is encountered, to reset the grouping. The current code ignores subkeys anyway, so this is no more bad.
|
Thank you! I had a problem that puppet always reports some keys as created even if they already existed. Annoying bug if Puppetboard always list your hosts as changed and you wonder who keeps changing them. Your change fixes this for me. |
|
Yes, can we please get this merged? |
|
I started to test on Debian-9 Stretch today and also was bitten by this issue. It seems that Version 2.1.16 of GnuPG contains a change to always print the fingerprints for subkeys (if I read the changelog correctly). This creates additional "fpr" lines in the output when listing keys. Ubuntu 17.04 still ships with GnuPG 2.1.15, so there is no problem. But Debian-9 uses 2.1.18 and this causes the apt_key type to fail. So this issue will probably start to bite more people if Stretch is officially supported by Puppetlabs. Preconditions to trigger the issue:
The second key resource seems to be out of sync every time. Manually deleting the first key will re-add the key and then this resource seems to be out of sync every time. |
|
Merged - Thank you! |
(#MODULES-4358)
The output of
apt-key adv --list-keys --with-colons --fingerprint --fixed-list-modeis always apubline followed by one of morefprlines (for subkeys, if any). This can cause the wrong pairs ofpubandfprlines to be hashed, resulting in nonsense.The ordering
pub,fpr,pub,fpris guaranteed byapt-key.Therefore, this commit clears
fpr_linewhen apubline is encountered, to reset the grouping. The current code ignores subkeys anyway, so this is no more bad.