Enable gpg signing and import the pubkey of the signing key on each m…

…achine
rubygems · Jul 1, 2014 · f7ddc92 · f7ddc92
1 parent 7dc14ed
commit f7ddc92
Show file tree

Hide file tree

Showing 6 changed files with 48 additions and 8 deletions.
diff --git a/Berksfile.lock b/Berksfile.lock
@@ -204,7 +204,7 @@ GRAPH
     runit (>= 0.0.0)
     unicorn (>= 0.0.0)
     user (>= 0.0.0)
-  rubygems-apt (0.0.4)
+  rubygems-apt (0.0.5)
     apt (>= 0.0.0)
   rubygems-backups (0.0.6)
     chef-vault (>= 0.0.0)
@@ -267,7 +267,7 @@ GRAPH
   rubygems-redis (0.0.2)
     redisio (>= 0.0.0)
     rubygems (>= 0.0.0)
-  rubygems-repo (0.0.9)
+  rubygems-repo (0.0.10)
     aptly (>= 0.0.0)
     rubygems (>= 0.0.0)
   rubygems-ruby (0.0.1)

diff --git a/cookbooks/rubygems-apt/files/default/packages.key b/cookbooks/rubygems-apt/files/default/packages.key
@@ -0,0 +1,31 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFOyXsgBCADWXL9pyJRrA9Gv/wM13Vd6dEhpMTC2qDsS29J0Iv1OjotZJe1t
+bVklAIbXfwhZ2osoVZoDqMiOGOqaLdLv4jTGNk/KjjdEqZqnQ7MfSD9CCwT1fqo+
+dqAqxOCCImc+yfRT8KE71AvZsx+saJXToQ50ub0ksetdpba+C7MssEFpkFCCNF3X
+e5vxhhEYI7vDPUN3Y4m6h4tJYjA4Q1lhUq03zU+f8M6EbfYs3m5jrd+/oAdbiLkG
+4VTOs0HIvuQyMqFJBJzG9Ckl996OJgeljYmrfV7UlGH8LaLp1USHOYV0/v8jGpVc
+D8pK1v1DXxjAwT2wlB+dAuTPkxlBXZwELeM1ABEBAAG0LVJ1YnlHZW1zLm9yZyBP
+cHMgVGVhbSA8cGFja2FnZXNAcnVieWdlbXMub3JnPokBPgQTAQIAKAUCU7JeyAIb
+AwUJCWYBgAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQgHdAnWBkvs36KAf/
+coEmQmocmhNDIUbvs7yEFuF5o11mOgrg8HGz2PbPtVpCnCUbWZBz3edYkIDVXhNB
+eyZrkcjs+MHpTd/+fu7lbDU9W/dW9vDCqZX0hKeJi/4c1X75mkE8iXsrJpxgIW5o
+cx8/hmZmgRisAPtdAYfUxoOKt0ElmQvnVrKMvCvwkk35ODb4+VDsHoj6vF4Vln9/
+o6epxPkY4c1WdYH4GzUuBNWufpy1J64Of3fg58x0JnOXhj3p82Z+YIKiT+hvoCL2
+csk5r5FH2HebXFRc9mhkGNHtCazV6Oma3yBs4XxQx5dpJRocYg/EZjPx2Df1Zoys
+KyW5ohwj9+wiecO97ZInarkBDQRTsl7IAQgAlV56gI5SbKrDW+fDSXXu087jaknt
+XJcKm+i+xumpZy3s/R1zO8Q6CN/RKLc+SDiZ/7P2qTH2zuNoaoZTlWpXjAw/w8eZ
+4E12ID9WqpuczILkJ1m1ghYUQ0GbTb8pVL5Bnxsn4jCm4oqvMsf84DSiVfMeRbkG
+ccmAsICIeV2kdOOOscoR531n25azV1qk1H3jxAgSgbO6KMlp9aQ+hS/srTilH0BW
+A86eMtTGCVMoBEaxMWtGebRwVnhh9MxiLy3s1bm6cAnSuBIIJM0lVwIzLrHzRMJN
+XMJH3CQkUN5UGkugvv5YV+ejwi00nrSc8Pb+sAA1BDNExptJUOwl1REldQARAQAB
+iQElBBgBAgAPBQJTsl7IAhsMBQkJZgGAAAoJEIB3QJ1gZL7NKMkIAJlw2f9nk8Rg
+2/fZi2xeJKbwaVdNrqGLwY65CYC0CJP83UKQXoBhkePKRb2Q6GNYU5Okhkw4LCzd
+6QNrken/0CuJpVFH5XBCBo/nA//GxEW8tMIOBz4lpM5MPXP9BDeFkxZt5ZlFKHg9
+b3aV86rJUAefBj1o4MdRxY2+6hkCmUP8ZQydecXcpxZTd16XtWJETwH3p2Smids+
+gzZTqTW30cgLiKRwcxDmZQhD+CVUUl6hrzlhhrbIv+CWoTaMRmmcKgnoJuXcoqg4
+dG1GghGZcfJWDgTpWRBGBcvIxhTDHM/hfgiZWKeHhPOI3jayvOtb7hmKxOuiRypF
+db4eUZ9TvRY=
+=rEZ+
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/cookbooks/rubygems-apt/metadata.rb b/cookbooks/rubygems-apt/metadata.rb
@@ -1,7 +1,7 @@
 name 'rubygems-apt'
 maintainer 'RubyGems.org ops team'
 
-version '0.0.4'
+version '0.0.5'
 
 depends 'apt'
 

diff --git a/cookbooks/rubygems-apt/recipes/default.rb b/cookbooks/rubygems-apt/recipes/default.rb
@@ -4,8 +4,20 @@
 end
 
 file '/etc/apt/apt.conf.d/05unauthenticated' do
+  action :delete
+end
+
+directory '/etc/apt/rubygems' do
   action :create
-  content "APT::Get::AllowUnauthenticated 'true';"
+end
+
+cookbook_file 'packages.key' do
+  path '/etc/apt/rubygems/packages.key'
+end
+
+execute 'import-rubygems-apt-key' do
+  command '/usr/bin/apt-key add /etc/apt/rubygems/packages.key'
+  not_if "/usr/bin/apt-key list | grep '2048R/6064BECD'"
 end
 
 apt_repository 'rubygems_main' do

diff --git a/cookbooks/rubygems-repo/metadata.rb b/cookbooks/rubygems-repo/metadata.rb
@@ -1,7 +1,7 @@
 name 'rubygems-repo'
 maintainer 'RubyGems.org ops team'
 
-version '0.0.9'
+version '0.0.10'
 
 depends 'aptly'
 depends 'rubygems'

diff --git a/cookbooks/rubygems-repo/recipes/default.rb b/cookbooks/rubygems-repo/recipes/default.rb
@@ -7,9 +7,6 @@
 
 node.default['aptly']['architectures'] = ['amd64']
 
-# Dont' re-sign packages with our own key.
-node.default['aptly']['gpgdisablesign'] = true
-
 # This repo contains scripts for snapshotting, merging, and publishing repos.
 git "#{node['aptly']['rootdir']}/apt-tools" do
   repository 'https://github.com/skottler/rubygems-apt-tools' do