[patch] Rebase APT keyserver proxy support patch

Sync our patch with upstream PR [1].

[1] https://github.com/salt-formulas/salt-formula-linux/pull/138

Change-Id: If3a51d3aef51accee0901c59e1342b42dbe4be4b
Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
(cherry picked from commit 78d368731c9582361cc291d5618e01702982f2b9)

3 files changed, 130 insertions, 68 deletions

diff --git a/mcp/patches/0011-system.repo-Debian-Add-keyserver-proxy-support.patch b/mcp/patches/0011-system.repo-Debian-Add-keyserver-proxy-support.patch
index 48e945acd..7dfb17fe9 100644
--- a/mcp/patches/0011-system.repo-Debian-Add-keyserver-proxy-support.patch
+++ b/mcp/patches/0011-system.repo-Debian-Add-keyserver-proxy-support.patch
@@ -7,12 +7,8 @@
 : http://www.apache.org/licenses/LICENSE-2.0
 ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
 From: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
-Date: Mon, 22 Jan 2018 00:28:09 +0100
-Subject: [PATCH] system.repo: Debian: Add keyserver proxy support
-
-Introduce a new, optional set of parameters to configure the proxy
-used for key fetching / keyserver access under:
-linux:system:proxy:keyserver:http(s).
+Date: Sun, 3 Jun 2018 19:28:18 +0200
+Subject: [PATCH] system.repo: Debian: Use proxy for keyservers
 
 Previously, when fetching GPG keys for APT keyring, either using
 public key download & import (as for default repos) or via keyserver,
@@ -22,37 +18,113 @@ To be able to retrieve APT keys behind a proxy, one used to have to
 configure the proxy for the Salt minion, which does not yet have
 `no_proxy` support (either *all* or *no* traffic hits the proxy).
 
-When the new http(s) proxy param is set:
+When `linux:system:proxy` http(s) proxies are set:
 - no longer pass key configuration to Salt aptpkg (until it properly
   supports `no_proxy`);
 - handle all keys explicitly with `curl` and `apt-key`;
-- set 'http(s)_proxy' env vars for `cmd.run`/`cmd.wait` calls;
+- set 'http(s)_proxy' env vars for `cmd.wait` calls;
 
-If linux:system:proxy:keyserver is not defined, the behavior is
+If `linux:system:proxy` is not defined, the behavior is
 unchanged for backwards compatibility.
 
-To allow runtime decisions whether the keyserver proxy should be used
-add an additional condition for it to match the first nameserver.
-This allows us to mix virtual nodes with MaaS-provisioned nodes in
-Fuel@OPNFV, while keeping the ext_pillar common.
+NOTE: If present, per-repo proxies are also used for keyserver access.
+
+system.repo: Fix conditions order for Debian proxy
 
 Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
 ---
- README.rst            | 16 ++++++++++++++++
- linux/system/repo.sls | 40 ++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 56 insertions(+)
+ linux/system/repo.sls | 69 +++++++++++++++++++++++++++++++++----------
+ 1 file changed, 53 insertions(+), 16 deletions(-)
 
 diff --git a/linux/system/repo.sls b/linux/system/repo.sls
+index b734498..61f203e 100644
 --- a/linux/system/repo.sls
 +++ b/linux/system/repo.sls
-@@ -96,13 +96,50 @@ linux_repo_{{ name }}_key:
-     - name: "curl -s {{ repo.key_url }} | apt-key add -"
+@@ -5,9 +5,15 @@ linux_repo_prereq_pkgs:
+   pkg.installed:
+   - pkgs: {{ system.pkgs }}
+
++{%- set proxies = {'system': {}, 'repo': {}} %}
++
+ # global proxy setup
+-{%- if system.proxy.get('pkg', {}).get('enabled', False) %}
+ {%- if grains.os_family == 'Debian' %}
++{%- if system.proxy.get('pkg', {}).get('enabled', False) %}
++
++{%- do proxies.system.update({'https': system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true)}) %}
++{%- do proxies.system.update({'http': system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true)}) %}
++{%- do proxies.system.update({'ftp': system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true)}) %}
+
+ /etc/apt/apt.conf.d/99proxies-salt:
+   file.managed:
+@@ -15,9 +21,9 @@ linux_repo_prereq_pkgs:
+   - source: salt://linux/files/apt.conf.d_proxies
+   - defaults:
+       external_host: False
+-      https: {{ system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true) }}
+-      http: {{ system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true) }}
+-      ftp: {{ system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true) }}
++      https: {{ proxies.system.https }}
++      http: {{ proxies.system.http }}
++      ftp: {{ proxies.system.ftp }}
+
+ {%- else %}
+
+@@ -25,9 +31,6 @@ linux_repo_prereq_pkgs:
+   file.absent
+
+ {%- endif %}
+-{%- endif %}
+-
+-{% set default_repos = {} %}
+
+ {%- if system.purge_repos|default(False) %}
+
+@@ -38,6 +41,10 @@ purge_sources_list_d_repos:
+
+ {%- endif %}
+
++{%- endif %}
++
++{% set default_repos = {} %}
++
+ {%- for name, repo in system.repo.items() %}
+ {%- set name=repo.get('name', name) %}
+ {%- if grains.os_family == 'Debian' %}
+@@ -45,16 +52,20 @@ purge_sources_list_d_repos:
+ # per repository proxy setup
+ {%- if repo.get('proxy', {}).get('enabled', False) %}
+ {%- set external_host = repo.proxy.get('host', None) or repo.source.split('/')[2] %}
++{%- do proxies.repo.update({'https': repo.proxy.get('https', None) or system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true)}) %}
++{%- do proxies.repo.update({'http': repo.proxy.get('http', None) or system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true)}) %}
++{%- do proxies.repo.update({'ftp': repo.proxy.get('ftp', None) or system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true)}) %}
+ /etc/apt/apt.conf.d/99proxies-salt-{{ name }}:
+   file.managed:
+   - template: jinja
+   - source: salt://linux/files/apt.conf.d_proxies
+   - defaults:
+       external_host: {{ external_host }}
+-      https: {{ repo.proxy.get('https', None) or system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), True) }}
+-      http: {{ repo.proxy.get('http', None) or system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), True) }}
+-      ftp: {{ repo.proxy.get('ftp', None) or system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), True) }}
++      https: {{ proxies.repo.https }}
++      http: {{ proxies.repo.http }}
++      ftp: {{ proxies.repo.ftp }}
+ {%- else %}
++{%- do proxies.repo.update({'https': None, 'http': None, 'ftp': None}) %}
+ /etc/apt/apt.conf.d/99proxies-salt-{{ name }}:
+   file.absent
+ {%- endif %}
+@@ -96,9 +107,17 @@ linux_repo_{{ name }}_key:
+     - name: "curl -sL {{ repo.key_url }} | apt-key add -"
      - watch:
        - file: default_repo_list
-+{%- if system.proxy.keyserver is defined and grains['dns']['nameservers'][0] in system.proxy.keyserver.http %}
 +    - env:
-+      - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', '') }}
-+      - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', '') }}
++{%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %}
++      - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }}
++{%- endif %}
++{%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %}
++      - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }}
 +{%- endif %}
 
  {%- endif %}
@@ -61,61 +133,49 @@ diff --git a/linux/system/repo.sls b/linux/system/repo.sls
  {%- else %}
 
  {%- if repo.get('enabled', True) %}
-
-+{%- if system.proxy.keyserver is defined and grains['dns']['nameservers'][0] in system.proxy.keyserver.http %}
-+
-+{%- if repo.get('key') %}
-+
-+linux_repo_{{ name }}_key:
-+  cmd.run:
-+    - name: "echo '{{ repo.key }}' | apt-key add -"
-+
-+{%- elif repo.key_url|default(False) %}
-+
-+linux_repo_{{ name }}_key:
-+  cmd.run:
-+    - name: "curl -s {{ repo.key_url }} | apt-key add -"
+@@ -115,12 +134,6 @@ linux_repo_{{ name }}:
+   {%- endif %}
+   - file: /etc/apt/sources.list.d/{{ name }}.list
+   - clean_file: {{ repo.clean|default(True) }}
+-  {%- if repo.key_id is defined %}
+-  - keyid: {{ repo.key_id }}
+-  {%- endif %}
+-  {%- if repo.key_server is defined %}
+-  - keyserver: {{ repo.key_server }}
+-  {%- endif %}
+   - consolidate: {{ repo.get('consolidate', False) }}
+   - clean_file: {{ repo.get('clean_file', False) }}
+   - refresh_db: {{ repo.get('refresh_db', True) }}
+@@ -154,9 +167,33 @@ linux_repo_{{ name }}_key:
+     - unless: "apt-key finger --with-colons | grep -qF $(curl -sL {{ repo.key_url }} | gpg --with-fingerprint --with-colons | grep -E '^fpr')"
+     - require_in:
+       - pkgrepo: linux_repo_{{ name }}
 +    - env:
-+      - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', '') }}
-+      - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', '') }}
-+
++{%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %}
++      - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }}
++{%- endif %}
++{%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %}
++      - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }}
++{%- endif %}
+
 +{%- elif repo.key_id is defined and repo.key_server is defined %}
 +
 +linux_repo_{{ name }}_key:
 +  cmd.run:
 +    - name: "apt-key adv --keyserver {{ repo.key_server }} --recv {{ repo.key_id }}"
++    - unless: 'test -e /etc/apt/sources.list.d/{{ name }}.list'
++    - require_in:
++      - pkgrepo: linux_repo_{{ name }}
 +    - env:
-+      - http_proxy: {{ system.proxy.get('keyserver', {}).get('http', '') }}
-+      - https_proxy: {{ system.proxy.get('keyserver', {}).get('https', '') }}
-+
++{%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %}
++      - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }}
 +{%- endif %}
-+
-+{#- system.proxy.keyserver #}
++{%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %}
++      - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }}
+ {%- endif %}
+
 +{%- endif %}
 +
- linux_repo_{{ name }}:
-   pkgrepo.managed:
-   {%- if repo.ppa is defined %}
-@@ -115,6 +152,7 @@ linux_repo_{{ name }}:
-   {%- endif %}
-   - file: /etc/apt/sources.list.d/{{ name }}.list
-   - clean_file: {{ repo.clean|default(True) }}
-+  {%- if system.proxy.keyserver is not defined or grains['dns']['nameservers'][0] not in system.proxy.keyserver.http %}
-   {%- if repo.key_id is defined %}
-   - keyid: {{ repo.key_id }}
-   {%- endif %}
-@@ -124,6 +162,7 @@ linux_repo_{{ name }}:
-   {%- if repo.key_url is defined %}
-   - key_url: {{ repo.key_url }}
-   {%- endif %}
-+  {%- endif %}
-   - consolidate: {{ repo.get('consolidate', False) }}
-   - clean_file: {{ repo.get('clean_file', False) }}
-   - refresh_db: {{ repo.get('refresh_db', True) }}
-@@ -140,6 +179,7 @@ linux_repo_{{ name }}:
-   {%- endif %}
-   {%- endif %}
-
 +{#- repo.enabled is false #}
  {%- else %}
 
diff --git a/mcp/reclass/classes/cluster/mcp-pike-common-ha/include/lab_proxy_pdf.yml.j2 b/mcp/reclass/classes/cluster/mcp-pike-common-ha/include/lab_proxy_pdf.yml.j2
index 0e95d2d1d..3f238d667 100644
--- a/mcp/reclass/classes/cluster/mcp-pike-common-ha/include/lab_proxy_pdf.yml.j2
+++ b/mcp/reclass/classes/cluster/mcp-pike-common-ha/include/lab_proxy_pdf.yml.j2
@@ -18,7 +18,8 @@ parameters:
   linux:
     system:
       proxy:
-        keyserver:
+        pkg:
+          enabled: true
           http: http://{{ upstream_proxy.address }}:{{ upstream_proxy.port }}
           https: http://{{ upstream_proxy.address }}:{{ upstream_proxy.port }}
 {%- endif %}
diff --git a/mcp/reclass/classes/cluster/mcp-pike-common-ha/include/maas_proxy.yml b/mcp/reclass/classes/cluster/mcp-pike-common-ha/include/maas_proxy.yml
index 11878ff2d..e5b263fe8 100644
--- a/mcp/reclass/classes/cluster/mcp-pike-common-ha/include/maas_proxy.yml
+++ b/mcp/reclass/classes/cluster/mcp-pike-common-ha/include/maas_proxy.yml
@@ -19,6 +19,7 @@ parameters:
   linux:
     system:
       proxy:
-        keyserver:
+        pkg:
+          enabled: true
           http: http://${_param:infra_maas_node01_deploy_address}:8000
           https: http://${_param:infra_maas_node01_deploy_address}:8000