(MODULES-3307) - Auto update expired keys

[eimlav]

Feature based on https://github.com/hbog/puppetlabs-apt/tree/refresh

[tphoney]

👍 assuming it can run through our adhoc pipeline

[eimlav]

Ran most recent commit bb0f842 through adhoc pipeline, and it has now gone green.

[pmcmaw]

LGTM. Merging.

[anarcat]

this is a really bad idea, i must say. especially now that some people figured out that you can just flood any PGP key out there, fetching arbitrary keys from keyservers, by default, when checking for existence of the key, seems like a huge security problem.

it will necessarily lead to keys being poisoned and completely disabling the AptSecure key verification mechanism, possibly leading to DOS on the entire server as apt struggles to run at all.

key updates should be shipped in-band, as a local source parameter (as in puppet://) and that's it. i understand why someone would make the mistake of pulling from keyservers, because apt-key adv exists, but it's not a good idea to set things up that way.

more information on how to properly setup third-part repositories is available here, i strongly suggest this is taken into consideration in this module more broadly:

https://wiki.debian.org/DebianRepository/UseThirdParty

[lelutin]

I do concur with @anarcat 's analysis of this code. it seems to me to be a pretty bad idea (in general) to automatically download keys from keyservers, especially nowadays since the state of the keyservers is in such a bad shape.

I would be more comfortable with this module if this new code was deactivated by default