Restrict APT signing keys only to the corresponding repos.

openjdk-11/playbook.yaml

@@ -3,14 +3,21 @@
   become: true
   become_user: root
   tasks:
-    - name: Ensure Eclipse Adoptium apt repository key is present
-      apt_key:
+    - name: Create a directory for keyrings
+      file:
+        path: /etc/apt/keyrings/
+        state: directory
+        mode: '0755'
+
+    - name: Eclipse Adoptium key
+      get_url:
         url: https://packages.adoptium.net/artifactory/api/gpg/key/public
-        state: present
+        dest: /etc/apt/keyrings/adoptium.asc
+        mode: "0644"
 
     - name: Ensure Eclipse Adoptium apt repository is present
       apt_repository:
-        repo: 'deb https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
+        repo: 'deb [signed-by=/etc/apt/keyrings/adoptium.asc] https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
         filename: openjdk_adoptium
         update_cache: yes
         state: present

openjdk-17/playbook.yaml

@@ -3,14 +3,21 @@
   become: true
   become_user: root
   tasks:
-    - name: Ensure Eclipse Adoptium apt repository key is present
-      apt_key:
+    - name: Create a directory for keyrings
+      file:
+        path: /etc/apt/keyrings/
+        state: directory
+        mode: '0755'
+
+    - name: Eclipse Adoptium key
+      get_url:
         url: https://packages.adoptium.net/artifactory/api/gpg/key/public
-        state: present
+        dest: /etc/apt/keyrings/adoptium.asc
+        mode: "0644"
 
     - name: Ensure Eclipse Adoptium apt repository is present
       apt_repository:
-        repo: 'deb https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
+        repo: 'deb [signed-by=/etc/apt/keyrings/adoptium.asc] https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
         filename: openjdk_adoptium
         update_cache: yes
         state: present

openjdk-21/playbook.yaml

@@ -3,14 +3,21 @@
   become: true
   become_user: root
   tasks:
-    - name: Ensure Eclipse Adoptium apt repository key is present
-      apt_key:
+    - name: Create a directory for keyrings
+      file:
+        path: /etc/apt/keyrings/
+        state: directory
+        mode: '0755'
+
+    - name: Eclipse Adoptium key
+      get_url:
         url: https://packages.adoptium.net/artifactory/api/gpg/key/public
-        state: present
+        dest: /etc/apt/keyrings/adoptium.asc
+        mode: "0644"
 
     - name: Ensure Eclipse Adoptium apt repository is present
       apt_repository:
-        repo: 'deb https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
+        repo: 'deb [signed-by=/etc/apt/keyrings/adoptium.asc] https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
         filename: openjdk_adoptium
         update_cache: yes
         state: present

openjdk-25/playbook.yaml

@@ -3,14 +3,21 @@
   become: true
   become_user: root
   tasks:
-    - name: Ensure Eclipse Adoptium apt repository key is present
-      apt_key:
+    - name: Create a directory for keyrings
+      file:
+        path: /etc/apt/keyrings/
+        state: directory
+        mode: '0755'
+
+    - name: Eclipse Adoptium key
+      get_url:
         url: https://packages.adoptium.net/artifactory/api/gpg/key/public
-        state: present
+        dest: /etc/apt/keyrings/adoptium.asc
+        mode: "0644"
 
     - name: Ensure Eclipse Adoptium apt repository is present
       apt_repository:
-        repo: 'deb https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
+        repo: 'deb [signed-by=/etc/apt/keyrings/adoptium.asc] https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
         filename: openjdk_adoptium
         update_cache: yes
         state: present

openjdk-8/playbook.yaml

@@ -3,14 +3,21 @@
   become: true
   become_user: root
   tasks:
-    - name: Ensure Eclipse Adoptium apt repository key is present
-      apt_key:
+    - name: Create a directory for keyrings
+      file:
+        path: /etc/apt/keyrings/
+        state: directory
+        mode: '0755'
+
+    - name: Eclipse Adoptium key
+      get_url:
         url: https://packages.adoptium.net/artifactory/api/gpg/key/public
-        state: present
+        dest: /etc/apt/keyrings/adoptium.asc
+        mode: "0644"
 
     - name: Ensure Eclipse Adoptium apt repository is present
       apt_repository:
-        repo: 'deb https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
+        repo: 'deb [signed-by=/etc/apt/keyrings/adoptium.asc] https://packages.adoptium.net/artifactory/deb {{ ansible_distribution_release }} main'
         filename: openjdk_adoptium
         update_cache: yes
         state: present

r-studio/playbook.yaml

@@ -4,7 +4,7 @@
   become_user: root
   tasks:
     - name: Fail if not running on Ubuntu 22.04
-      ansible.builtin.fail:
+      fail:
         msg: "These tasks should only be run on Ubuntu 22.04"
       when: ansible_distribution != "Ubuntu" or ansible_distribution_version != "22.04"
 
@@ -19,13 +19,13 @@
     - name: Cpan apt key
       ansible.builtin.get_url:
         url: https://cloud.r-project.org/bin/linux/ubuntu/marutter_pubkey.asc
-        dest: /etc/apt/trusted.gpg.d/cran_ubuntu_key.asc
+        dest: /etc/apt/keyrings/cran_ubuntu_key.asc
         mode: "0644"
 
 
     - name: Add R repository into sources list
       ansible.builtin.apt_repository:
-        repo: "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/cran_ubuntu_key.asc] https://cloud.r-project.org/bin/linux/ubuntu {{ ansible_distribution_release }}-cran40/"
+        repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/cran_ubuntu_key.asc] https://cloud.r-project.org/bin/linux/ubuntu {{ ansible_distribution_release }}-cran40/"
         state: present
 
     - name: Add CRAN Packages