Dear Maintainer,

cloud-init uses gnupg in two ways: directly, to fetch and export keys
(when specified by ID, see [0]), and via apt-key to add keys to the system
(whether specified via ID or in full, see [1]).  (Even once we remove
apt-key usage[2], we will still need it for the former use case.)

I've just opened a PR[3] to add this to our Ubuntu packaging, and would
request that you do the same so that Debian users are able to configure
custom apt sources using cloud-init configuration.

(My assumption here is that Debian cloud images are built with
--install-recommends; if not, then you may want to consider ensuring
that gnupg is present in Debian cloud images via other means.)


Thanks!

Dan

[0] https://github.com/canonical/cloud-init/blob/master/cloudinit/gpg.py
[1] https://github.com/canonical/cloud-init/blob/master/cloudinit/config/cc_apt_configure.py#L698
[2] https://bugs.launchpad.net/cloud-init/+bug/1836336
[3] https://github.com/canonical/cloud-init/pull/583

This was previously discussed in the context of
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910654

Unfortunately, most of the discussion occurred in person at the 2018
cloud team sprint, and wasn't captured in the bug report.  IIRC, at the
time, most of the discussion focused on the apt-key use-case, and there
were enough people who felt strongly that using gpg to fetch keys from a
key server was a sufficiently bad idea, and the same functionality could
be provided by passing a complete public key directly via cloud-config
userdata, that we should support this functionality.  This opinion
wasn't universally held, but it was held strongly enough by enough
people to overrule any dissenting opionions.

Maybe it's worth revisiting this discussion for bullseye?

noah

No, none of this use-cases are valid.

Per ID is not reliable, as the keyserver network is falling apart.

Per complete key does not need gnupg, but needs to deposit the keys in
the correct file.

Bastian

I tried to add complete key on debian 10 and it turns out it requires
gnupg. Here's a relevant cloud-init config and error.

apt:
  preserve_sources_list: true
  sources:
    docker.list:
      source: "deb [arch=amd64] https://download.docker.com/linux/debian
$RELEASE edge"
      key: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----
        ...

Cloud-init v. 20.2 running 'modules:config' at Thu, 08 Apr 2021 15:33:51
+0000. Up 16.04 seconds.
2021-04-08 15:33:52,098 - cc_apt_configure.py[ERROR]: failed to add apt GPG
Key to apt keyring
Traceback (most recent call last):
  File
"/usr/lib/python3/dist-packages/cloudinit/config/cc_apt_configure.py", line
553, in add_apt_key_raw
    util.subp(['apt-key', 'add', '-'], data=key.encode(), target=target)
  File "/usr/lib/python3/dist-packages/cloudinit/util.py", line 2192, in
subp
    cmd=args)
cloudinit.util.ProcessExecutionError: Unexpected error while running
command.
Command: ['apt-key', 'add', '-']
Exit code: 255
Reason: -
Stdout:
Stderr: E: gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of
them is required for this operation
2021-04-08 15:33:52,133 - util.py[WARNING]: Running module apt-configure
(<module 'cloudinit.config.cc_apt_configure' from
'/usr/lib/python3/dist-packages/cloudinit/config/cc_apt_configure.py'>)
failed

Jarek

It says "Have gnupg or gnupg installed"

There are a couple issues here.

First, cloud-init should stop using apt-key to add keys provided via
this mechanism.  That's tracked upstream at
https://bugs.launchpad.net/cloud-init/+bug/1836336

Second, if the file is provided in ASCII-armored format inline in
cloud-config, as you've shown here, then cloud-init *should* install it
to /usr/share/keyrings/ and the deb sources line should be specified to
include a signed-by directive, as documented in the third-party apt
sources list best practices. [1] In order for that to work, though, the
key needs to be available in *binary* format.  So we still do need gpg
to do the conversion.

For now, to work around this in our cloud images, I recommend using a
cloud-config "packages:" entry to install gpg, and then use a script
similar to the one shown at [2] as a user-data script.

Alternatively, you can use a bootcmd cloud-config directive to install
gpg early in your instance's boot process, which will make it available
in time for the apt-configure module's execution.

noah

1. https://wiki.debian.org/DebianRepository/UseThirdParty
2. https://github.com/docker/docker.github.io/issues/11625#issuecomment-751388087

No, apt does not require a binary key file.  Just give it the correct
name, ending with .asc.

Bastian

Indeed.

So, the "right way" to accomplish the installation of a third-party
apt repository (e.g. for Docker) is with user-data like the following:

#cloud-config
write_files:
  path: /usr/share/keyrings/docker.asc
  owner: root:root
  permissions: '0644'
  content: |
    ---- BEGIN PGP PUBLIC KEY BLOCK -----
    ....
apt:
  sources:
    docker.list:
      source: "deb [signed-by=/usr/share/keyrings/docker.asc] https://download.docker.com/linux/debian buster stable"
packages:
  - docker-ce

(note that I haven't actually tried this, but it looks right, and should
work with cloud-init in buster today)

IMO cloud-init's handling of apt keys should probably just be a frontend
to this functionality.

noah