Salt Project Package Repository (repo.saltproject.io) Migration and Guidance

[ScriptAutomate]

Salt Project Community Members!

This week, packages from repo.saltproject.io will be migrated to packages.broadcom.com. This means a variety of disruptive changes are being implemented around installing, upgrading, and pinning/locking Salt.

Read for more details: https://saltproject.io/blog/salt-project-package-repo-migration-and-guidance/

[svenseeberg]

packages.broadcom.com does not support IPv6 yet. Could Broadcom please start supporting IPv6? A project like Saltstack, which is used to manage infrastructure, should not depend on legacy network technology.

[OrangeDog]

I cannot get it working, and cannot see why:

# cat /etc/apt/sources.list.d/salt.list
deb [arch=amd64 signed-by=/etc/apt/keyrings/salt-archive-keyring.gpg] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main

# gpg --import-options show-only --import /etc/apt/keyrings/salt-archive-keyring.gpg
pub   rsa3072 2023-02-01 [SC]
      10857FFDD3F91EAE577A21D664CBBC8173D76B3F
uid                      Salt Project Packaging <[email protected]>
sub   rsa3072 2023-02-01 [E]

# apt update
Get:6 https://packages.broadcom.com/artifactory/saltproject-deb stable InRelease [3,427 B]
Err:6 https://packages.broadcom.com/artifactory/saltproject-deb stable InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 64CBBC8173D76B3F
Reading package lists... Done
W: GPG error: https://packages.broadcom.com/artifactory/saltproject-deb stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 64CBBC8173D76B3F
E: The repository 'https://packages.broadcom.com/artifactory/saltproject-deb stable InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

[OrangeDog]

It turns out that https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public returns an ASCII-armored key, so must be in a .asc file for apt to use it.

The linked guide says to use a .pgp file, which will not work.

This is also inconsistent with the pkgrepo.managed state, which will automatically un-armor any ASCII keys.