Fix Ubuntu 24.04 apt repo GPG key handling for Zoomdata and tools repos#228
Fix Ubuntu 24.04 apt repo GPG key handling for Zoomdata and tools repos#228
Conversation
Add --batch --yes flags to gpg --dearmor command so it runs non-interactively when Salt applies states without a controlling terminal. On Ubuntu 24.04, gpg fails with 'cannot open /dev/tty: No such device or address' without these flags, preventing the keyring file from being created and blocking all subsequent apt repo and package installation states. Co-authored-by: srikanthinsight <141009540+srikanthinsight@users.noreply.github.com>
|
@copilot |
Two fixes for non-release repos (tools) on Ubuntu Noble: 1. Support per-repository component configuration: for non-release repos, check for a repo-specific 'components' key (e.g. zoomdata.tools.components) before falling back to default_components. Also add explicit components: [stable] to tools section in defaults.yaml, making it overridable via Pillar for repos that use different component names on Ubuntu 24.04. 2. Apply [signed-by=...] only to the release repo: the downloaded keyring contains only the release repo GPG key. Applying signed-by to non-release repos (tools) that use a different key would escalate their GPG warning to a hard error on Ubuntu 24.04. Restrict the signed-by option and its cmd require to the release repo only; the Ubuntu 22.04 key_url path is unchanged for all repos. Co-authored-by: srikanthinsight <141009540+srikanthinsight@users.noreply.github.com>
The CI log you shared is from a run at With the current code on the branch:
You will still see the zoomdata:
tools:
components:
- <actual-component-name> # whatever component the tools repo uses on NobleThis warning is non-blocking and won't prevent the installation from proceeding. |
apt on Ubuntu 24.04 returns exit code 100 for ANY repo with an
unrecognized GPG key, even without [signed-by=...]. The tools repo
uses key 64CBBC8173D76B3F which is not in the downloaded keyring.
Add [trusted=yes] support per-repo: non-release repos with
trusted:true in their config get [trusted=yes] in their apt
sources entry on Ubuntu 24.04+, bypassing GPG verification for
repos whose key we don't manage. Set tools.trusted=true by
default in defaults.yaml. Users can override per-repo via Pillar.
- defaults.yaml: add trusted:true to tools section
- repo.sls: move repo_cfg lookup to top of for loop; add elif
branch for [trusted=yes] when repo_cfg.get('trusted') is set
Co-authored-by: srikanthinsight <141009540+srikanthinsight@users.noreply.github.com>
On Ubuntu 24.04 (Noble), Salt-managed apt repo configuration fails for both the Zoomdata release repo (hard
E:GPG error blockingapt-get update) and the tools repo (different signing key, no managed keyring entry).Changes
gpg --dearmornon-interactive fixAdded
--batch --yesto thegpg --dearmorinvocation — Ubuntu 24.04's GPG attempts to open/dev/ttyfor confirmation, which fails in non-interactive Salt runs.[signed-by=…]scoped to release repo onlyThe downloaded keyring contains only the release repo key (
F269C8EF6A2C3B7B). Applying[signed-by=<keyring>]to the tools repo (signed with64CBBC8173D76B3F) escalates its GPG warning to a blockingE:error.signed-byand itsrequireare now conditional onrepo == zoomdata.release.[trusted=yes]for non-release repos on Ubuntu 24.04+Even without
[signed-by=…], Ubuntu 24.04 apt returns exit code 100 for repos with any unrecognized key. Added per-repotrustedflag support: whentrusted: trueis set on a repo config,[trusted=yes]is added to the apt sources entry on Ubuntu 24.04+. Defaults totruefor the tools repo:Override via Pillar:
Per-repo component support
Non-release repos now use
<repo>.componentsfrom their config dict before falling back todefault_components, making the tools repo component name overridable independently of the release repo.💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.