Skip to content

Commit dd044f1

Browse files
marcoandredinismarcoandredinis
authored
Teleport Install scripts: use /etc/apt/keyrings/ when adding Teleport's public key for DEB packages (#50273)
* Teleport Install scripts: use `/etc/apt/trusted.gpg.d/` for DEB packages * use etc apt keyrings for storing the keys
1 parent efaec73 commit dd044f1

File tree

7 files changed

+31
-21
lines changed

7 files changed

+31
-21
lines changed

‎api/types/installers/agentless-installer.sh.tmpl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,9 @@ install_teleport() {
123123
echo "deb https://apt.releases.teleport.dev/ubuntu ${VERSION_CODENAME?} {{ .RepoChannel }}" | sudo tee /etc/apt/sources.list.d/teleport.list
124124
rm /tmp/teleport-pubkey.asc
125125
else
126-
curl https://apt.releases.teleport.dev/gpg | sudo tee /usr/share/keyrings/teleport-archive-keyring.asc
127-
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} {{ .RepoChannel }}" | sudo tee /etc/apt/sources.list.d/teleport.list >/dev/null
126+
sudo mkdir -p /etc/apt/keyrings
127+
curl https://apt.releases.teleport.dev/gpg | sudo tee /etc/apt/keyrings/teleport-archive-keyring.asc
128+
echo "deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} {{ .RepoChannel }}" | sudo tee /etc/apt/sources.list.d/teleport.list >/dev/null
128129
fi
129130
sudo apt-get update
130131

‎assets/install-scripts/install-connect.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,9 +129,10 @@ add_apt_key() {
129129
TMP_KEY="$TEMP_DIR/teleport-pubkey.gpg"
130130
download "https://apt.releases.teleport.dev/gpg" "$TMP_KEY"
131131
set -x
132-
cat $TMP_KEY | $SUDO tee /usr/share/keyrings/teleport-archive-keyring.asc >/dev/null
132+
$SUDO mkdir -p /etc/apt/keyrings
133+
cat $TMP_KEY | $SUDO tee /etc/apt/keyrings/teleport-archive-keyring.asc >/dev/null
133134
set +x
134-
TELEPORT_REPO="deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${APT_REPO_ID?} ${APT_REPO_VERSION_CODENAME?} stable/v${MAJOR}"
135+
TELEPORT_REPO="deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${APT_REPO_ID?} ${APT_REPO_VERSION_CODENAME?} stable/v${MAJOR}"
135136
fi
136137

137138
set -x

‎assets/install-scripts/install.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,9 +129,10 @@ add_apt_key() {
129129
TMP_KEY="$TEMP_DIR/teleport-pubkey.gpg"
130130
download "https://apt.releases.teleport.dev/gpg" "$TMP_KEY"
131131
set -x
132-
$SUDO cp "$TMP_KEY" /usr/share/keyrings/teleport-archive-keyring.asc
132+
$SUDO mkdir -p /etc/apt/keyrings
133+
$SUDO cp "$TMP_KEY" /etc/apt/keyrings/teleport-archive-keyring.asc
133134
set +x
134-
TELEPORT_REPO="deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${APT_REPO_ID?} ${APT_REPO_VERSION_CODENAME?} ${CHANNEL}"
135+
TELEPORT_REPO="deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${APT_REPO_ID?} ${APT_REPO_VERSION_CODENAME?} ${CHANNEL}"
135136
fi
136137

137138
set -x

‎lib/srv/server/installer/autodiscover_test.go

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -745,16 +745,16 @@ func TestAutoDiscoverNode(t *testing.T) {
745745
// SLES 12, 15
746746
var wellKnownOS = map[string]map[string]map[string]string{
747747
"debian": {
748-
"9": {etcOSReleaseFile: debian9OSRelease, "/usr/share/keyrings/": "", "/etc/apt/sources.list.d/": ""},
749-
"10": {etcOSReleaseFile: debian10OSRelease, "/usr/share/keyrings/": "", "/etc/apt/sources.list.d/": ""},
750-
"11": {etcOSReleaseFile: debian11OSRelease, "/usr/share/keyrings/": "", "/etc/apt/sources.list.d/": ""},
751-
"12": {etcOSReleaseFile: debian12OSRelease, "/usr/share/keyrings/": "", "/etc/apt/sources.list.d/": ""},
748+
"9": {etcOSReleaseFile: debian9OSRelease, "/etc/apt/keyrings/": "", "/etc/apt/sources.list.d/": ""},
749+
"10": {etcOSReleaseFile: debian10OSRelease, "/etc/apt/keyrings/": "", "/etc/apt/sources.list.d/": ""},
750+
"11": {etcOSReleaseFile: debian11OSRelease, "/etc/apt/keyrings/": "", "/etc/apt/sources.list.d/": ""},
751+
"12": {etcOSReleaseFile: debian12OSRelease, "/etc/apt/keyrings/": "", "/etc/apt/sources.list.d/": ""},
752752
},
753753
"ubuntu": {
754-
"18.04": {etcOSReleaseFile: ubuntu1804OSRelease, "/usr/share/keyrings/": "", "/etc/apt/sources.list.d/": ""},
755-
"20.04": {etcOSReleaseFile: ubuntu2004OSRelease, "/usr/share/keyrings/": "", "/etc/apt/sources.list.d/": ""},
756-
"22.04": {etcOSReleaseFile: ubuntu2204OSRelease, "/usr/share/keyrings/": "", "/etc/apt/sources.list.d/": ""},
757-
"24.04": {etcOSReleaseFile: ubuntu2404OSRelease, "/usr/share/keyrings/": "", "/etc/apt/sources.list.d/": ""},
754+
"18.04": {etcOSReleaseFile: ubuntu1804OSRelease, "/etc/apt/sources.list.d/": ""}, // No /etc/apt/keyrings/ by default
755+
"20.04": {etcOSReleaseFile: ubuntu2004OSRelease, "/etc/apt/sources.list.d/": ""}, // No /etc/apt/keyrings/ by default
756+
"22.04": {etcOSReleaseFile: ubuntu2204OSRelease, "/etc/apt/keyrings/": "", "/etc/apt/sources.list.d/": ""},
757+
"24.04": {etcOSReleaseFile: ubuntu2404OSRelease, "/etc/apt/keyrings/": "", "/etc/apt/sources.list.d/": ""},
758758
},
759759
"amzn": {
760760
"2": {etcOSReleaseFile: amzn2OSRelease},

‎lib/utils/packagemanager/apt.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,14 @@ const (
4040
aptRepoEndpoint = "https://apt.releases.teleport.dev/"
4141

4242
aptTeleportSourceListFileRelative = "/etc/apt/sources.list.d/teleport.list"
43-
aptTeleportPublicKeyFileRelative = "/usr/share/keyrings/teleport-archive-keyring.asc"
4443

45-
aptFilePermsRepository = 0o644
44+
aptKeyringsLocation = "/etc/apt/keyrings"
45+
aptKeyringsLocationPerms = 0o755
46+
aptFilePermsRepository = 0o644
4647
)
4748

49+
var aptTeleportPublicKeyFileRelative = filepath.Join(aptKeyringsLocation, "teleport-archive-keyring.asc")
50+
4851
// APT is a wrapper for apt package manager.
4952
// This package manager is used in Debian/Ubuntu and distros based on this distribution.
5053
type APT struct {
@@ -128,7 +131,10 @@ func (pm *APT) AddTeleportRepository(ctx context.Context, linuxInfo *linux.OSRel
128131
aptTeleportSourceListFile := filepath.Join(pm.fsRootPrefix, aptTeleportSourceListFileRelative)
129132
aptTeleportPublicKeyFile := filepath.Join(pm.fsRootPrefix, aptTeleportPublicKeyFileRelative)
130133
// Format for teleport repo entry should look like this:
131-
// deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} $RepoChannel"
134+
// deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} $RepoChannel"
135+
if err := os.MkdirAll(filepath.Join(pm.fsRootPrefix, aptKeyringsLocation), aptKeyringsLocationPerms); err != nil {
136+
return trace.Wrap(err)
137+
}
132138
teleportRepoMetadata := fmt.Sprintf("deb [signed-by=%s] %s%s %s %s", aptTeleportPublicKeyFile, aptRepoEndpoint, linuxInfo.ID, linuxInfo.VersionCodename, repoChannel)
133139

134140
switch {

‎lib/web/scripts/node-join/install.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -945,9 +945,10 @@ install_from_repo() {
945945
curl -fsSL https://apt.releases.teleport.dev/gpg | apt-key add -
946946
echo "deb https://apt.releases.teleport.dev/${ID} ${VERSION_CODENAME} ${REPO_CHANNEL}" > /etc/apt/sources.list.d/teleport.list
947947
else
948+
mkdir -p /etc/apt/keyrings
948949
curl -fsSL https://apt.releases.teleport.dev/gpg \
949-
-o /usr/share/keyrings/teleport-archive-keyring.asc
950-
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \
950+
-o /etc/apt/keyrings/teleport-archive-keyring.asc
951+
echo "deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] \
951952
https://apt.releases.teleport.dev/${ID} ${VERSION_CODENAME} ${REPO_CHANNEL}" > /etc/apt/sources.list.d/teleport.list
952953
fi
953954
apt-get update

‎web/packages/shared/components/TextSelectCopy/TextSelectCopyMulti.story.tsx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,15 +45,15 @@ export const BashMultiWithComment = () => {
4545
<Component
4646
lines={[
4747
{
48-
text: `sudo curl https://apt.releases.teleport.dev/gpg \\\n-o /usr/share/keyrings/teleport-archive-keyring.asc`,
48+
text: `sudo curl https://apt.releases.teleport.dev/gpg \\\n-o /etc/apt/keyrings/teleport-archive-keyring.asc`,
4949
comment: `Download Teleport's PGP public key`,
5050
},
5151
{
5252
text: 'sudo DEBUG=1 teleport start -c cfg-all -d',
5353
},
5454
{
5555
text:
56-
`echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \\\n` +
56+
`echo "deb [signed-by=/etc/apt/keyrings/teleport-archive-keyring.asc] \\\n` +
5757
`https://apt.releases.teleport.dev/stable/v10" \\\n` +
5858
`| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null`,
5959
comment:

0 commit comments

Comments
 (0)