pkgrepo.managed should support key_fingerprint for key_url

[mitar]

Currently one can use key_url to specify which key to install. But there is no way to assure that the key obtained is really the one you expected. Ideally, you could also provide something like key_fingerprint so that the key would be checked against it before installing.

Related: #14677

[garethgreenaway]

@mitar Thanks for the report. This would be a good feature to have.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

If this issue is closed prematurely, please leave a comment and we will gladly reopen the issue.

[mitar]

I still think this would be a good feature to have.

[stale[bot]]

Thank you for updating this issue. It is no longer marked as stale.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

If this issue is closed prematurely, please leave a comment and we will gladly reopen the issue.

[mitar]

Unstale.

[stale[bot]]

Thank you for updating this issue. It is no longer marked as stale.

[hackery]

Agreed - this is generally considered best practice, with many significant software sources publishing a fingerprint for their signing key (or raw download checksum signing etc) and it's strongly recommended to test against it.

My current example is InfluxData (prompted by their recent rotation of signing key).

We currently make an explicit check of the fingerprint in our (Ansible) image building environment, but reproducing that in Salt (used for service provisioning and maintenance) is clumsy with unless or a requisite state withcmd.run -

- name: Download InfluxData package signing key
  get_url:
    url: https://repos.influxdata.com/influxdata-archive.key
    dest: /tmp/influxdata-archive.key

- name: Verify InfluxData package signing key
  shell: gpg --show-keys /tmp/influxdata-archive.key | grep 24C975CBA61A024EE1B631787C3D57159FC2F927
  register: key_verification
  changed_when: false