CDIST-TYPE__APT_KEY(7)

💖 cdist-type__apt_key — the manual, but make it cute 💖

okay bestie, this is the page for cdist-type__apt_key from the cdist manual, section 7. it's all about keeping your apt keys in check so your packages are who they say they are. let's go 🫶

---

✨ NAME ✨

cdist-type__apt_key — manage the list of keys used by apt 💅

---

🌸 DESCRIPTION 🌸

So basically: this type manages the list of keys that apt uses to authenticate packages. That's the whole vibe. 🔐

How does it do it? It places the requested key in a file named $__object_id.gpg inside the keydir directory. That's it. That's the magic. ✨

This is supported by modern releases of Debian-based distributions. Like, if you're on something ancient, this is not the moment, bestie.

And here's the rule, no cap: in order of preference, exactly one of: source, uri or keyid must be specified. Exactly one. Not zero, not two. ONE. 🚨

---

🎀 REQUIRED PARAMETERS 🎀

None. Nothing. Zero. Free of charge. We love a low-maintenance type. 💖

---

💅 OPTIONAL PARAMETERS 💅

• keydir — the keyring directory. Defaults to /etc/apt/trusted.pgp.d, which is enabled system-wide by default. iykyk 🌈
• source — path to a file containing the GPG key of the repository. Using this is recommended, because it ensures that the manifest/type maintainer has validated the key. Like, someone actually checked it. That's the good stuff. If it's -, the GPG key is read from the type's stdin. 🍓
• state — 'present' or 'absent'. Defaults to 'present'. 🦋
• uri — the URI from which to download the key. It is highly recommended that you only use protocols with TLS like HTTPS. This uses __download but does not use checksums, so if you want to ensure that the key doesn't change, you are better off downloading it and using --source. periodt 💀

---

😭 DEPRECATED OPTIONAL PARAMETERS 😭

yes bestie, these are on the way out. still documented, still here, but the clock is ticking ⏰

• keyid — the id of the key to download from the keyserver. This is to be used in absence of --source and --uri, or together with --use-deprecated-apt-key for key removal. Defaults to $__object_id. 🙈
• keyserver — the keyserver from which to fetch the key. Defaults to pool.sks-keyservers.net. 💜

---

🔥 DEPRECATED BOOLEAN PARAMETERS 🔥

• use-deprecated-apt-key — okay so, apt-key(8) will last be available in Debian 11 and Ubuntu 22.04. You can use this parameter to force usage of apt-key(8). Please only use this parameter to remove keys from the keyring, in order to prepare for removal of apt-key. Adding keys should be done without this parameter. This parameter will be removed when Debian 11 stops being supported. 👑

fr fr, read that again: removal only. adding keys with this is not it. 🚫

---

🌈 EXAMPLES 🌈

add a key that has been verified by a type maintainer:

# add a key that has been verified by a type maintainer
__apt_key jitsi_meet_2021 \
   --source cdist-contrib/type/__jitsi_meet/files/apt_2021.gpg

remove an old, deprecated or expired key:

# remove an old, deprecated or expired key
__apt_key jitsi_meet_2016 --state absent

get rid of a key that might have been added to /etc/apt/trusted.gpg with apt-key:

# Get rid of a key that might have been added to
# /etc/apt/trusted.gpg with apt-key
__apt_key 0x40976EAF437D05B5 --use-deprecated-apt-key --state absent

add a key that we define in-line:

# add a key that we define in-line
__apt_key jitsi_meet_2021 --source '-' <<EOF
-----BEGIN PGP PUBLIC KEY BLOCK-----
[...]
-----END PGP PUBLIC KEY BLOCK-----
EOF

download or update key from the internet:

# download or update key from the internet
__apt_key rabbitmq_2007 \
   --uri https://www.rabbitmq.com/rabbitmq-signing-key-public.asc

---

👑 AUTHORS 👑

Steven Armstrong <steven-cdist--@--armstrong.cc> Ander Punnar <ander-at-kvlt-dot-ee> Evilham <contact~~@~~evilham.com>

icons, all of them 💅

---

🧚 COPYING 🧚

Copyright (C) 2011-2021 Steven Armstrong, Ander Punnar and Evilham. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

---

⭐ COPYRIGHT ⭐

ungleich GmbH 2021

---

and that's the whole page, bestie!! 🎀 this was version 7.0.0, dated Jul 31, 2022, and it's giving CDIST-TYPE__APT_KEY(7) energy. go forth and manage those keys responsibly 💖✨🦋