::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
: Copyright (c) 2018 Mirantis Inc., Enea AB and others.
:
: All rights reserved. This program and the accompanying materials
: are made available under the terms of the Apache License, Version 2.0
: which accompanies this distribution, and is available at
: http://www.apache.org/licenses/LICENSE-2.0
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
From: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
Date: Sun, 3 Jun 2018 19:28:18 +0200
Subject: [PATCH] system.repo: Debian: Use proxy for keyservers

Previously, when fetching GPG keys for APT keyring, either using
public key download & import (as for default repos) or via keyserver,
we relied on simple `curl` calls or passed it down to Salt aptpkg
module.
To be able to retrieve APT keys behind a proxy, one used to have to
configure the proxy for the Salt minion, which does not yet have
`no_proxy` support (either *all* or *no* traffic hits the proxy).

When `linux:system:proxy` http(s) proxies are set:
- no longer pass key configuration to Salt aptpkg (until it properly
  supports `no_proxy`);
- handle all keys explicitly with `curl` and `apt-key`;
- set 'http(s)_proxy' env vars for `cmd.wait` calls;

If `linux:system:proxy` is not defined, the behavior is
unchanged for backwards compatibility.

NOTE: If present, per-repo proxies are also used for keyserver access.

system.repo: Fix conditions order for Debian proxy

Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
---
 linux/system/repo.sls | 69 +++++++++++++++++++++++++++++++++----------
 1 file changed, 53 insertions(+), 16 deletions(-)

diff --git a/linux/system/repo.sls b/linux/system/repo.sls
index b734498..61f203e 100644
--- a/linux/system/repo.sls
+++ b/linux/system/repo.sls
@@ -5,9 +5,15 @@ linux_repo_prereq_pkgs:
   pkg.installed:
   - pkgs: {{ system.pkgs }}

+{%- set proxies = {'system': {}, 'repo': {}} %}
+
 # global proxy setup
-{%- if system.proxy.get('pkg', {}).get('enabled', False) %}
 {%- if grains.os_family == 'Debian' %}
+{%- if system.proxy.get('pkg', {}).get('enabled', False) %}
+
+{%- do proxies.system.update({'https': system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true)}) %}
+{%- do proxies.system.update({'http': system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true)}) %}
+{%- do proxies.system.update({'ftp': system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true)}) %}

 /etc/apt/apt.conf.d/99proxies-salt:
   file.managed:
@@ -15,9 +21,9 @@ linux_repo_prereq_pkgs:
   - source: salt://linux/files/apt.conf.d_proxies
   - defaults:
       external_host: False
-      https: {{ system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true) }}
-      http: {{ system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true) }}
-      ftp: {{ system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true) }}
+      https: {{ proxies.system.https }}
+      http: {{ proxies.system.http }}
+      ftp: {{ proxies.system.ftp }}

 {%- else %}

@@ -25,9 +31,6 @@ linux_repo_prereq_pkgs:
   file.absent

 {%- endif %}
-{%- endif %}
-
-{% set default_repos = {} %}

 {%- if system.purge_repos|default(False) %}

@@ -38,6 +41,10 @@ purge_sources_list_d_repos:

 {%- endif %}

+{%- endif %}
+
+{% set default_repos = {} %}
+
 {%- for name, repo in system.repo.items() %}
 {%- set name=repo.get('name', name) %}
 {%- if grains.os_family == 'Debian' %}
@@ -45,16 +52,20 @@ purge_sources_list_d_repos:
 # per repository proxy setup
 {%- if repo.get('proxy', {}).get('enabled', False) %}
 {%- set external_host = repo.proxy.get('host', None) or repo.source.split('/')[2] %}
+{%- do proxies.repo.update({'https': repo.proxy.get('https', None) or system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), true)}) %}
+{%- do proxies.repo.update({'http': repo.proxy.get('http', None) or system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), true)}) %}
+{%- do proxies.repo.update({'ftp': repo.proxy.get('ftp', None) or system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), true)}) %}
 /etc/apt/apt.conf.d/99proxies-salt-{{ name }}:
   file.managed:
   - template: jinja
   - source: salt://linux/files/apt.conf.d_proxies
   - defaults:
       external_host: {{ external_host }}
-      https: {{ repo.proxy.get('https', None) or system.proxy.get('pkg', {}).get('https', None) | default(system.proxy.get('https', None), True) }}
-      http: {{ repo.proxy.get('http', None) or system.proxy.get('pkg', {}).get('http', None) | default(system.proxy.get('http', None), True) }}
-      ftp: {{ repo.proxy.get('ftp', None) or system.proxy.get('pkg', {}).get('ftp', None) | default(system.proxy.get('ftp', None), True) }}
+      https: {{ proxies.repo.https }}
+      http: {{ proxies.repo.http }}
+      ftp: {{ proxies.repo.ftp }}
 {%- else %}
+{%- do proxies.repo.update({'https': None, 'http': None, 'ftp': None}) %}
 /etc/apt/apt.conf.d/99proxies-salt-{{ name }}:
   file.absent
 {%- endif %}
@@ -96,9 +107,17 @@ linux_repo_{{ name }}_key:
     - name: "curl -sL {{ repo.key_url }} | apt-key add -"
     - watch:
       - file: default_repo_list
+    - env:
+{%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %}
+      - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }}
+{%- endif %}
+{%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %}
+      - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }}
+{%- endif %}

 {%- endif %}

+{#- repo.default is false #}
 {%- else %}

 {%- if repo.get('enabled', True) %}
@@ -115,12 +134,6 @@ linux_repo_{{ name }}:
   {%- endif %}
   - file: /etc/apt/sources.list.d/{{ name }}.list
   - clean_file: {{ repo.clean|default(True) }}
-  {%- if repo.key_id is defined %}
-  - keyid: {{ repo.key_id }}
-  {%- endif %}
-  {%- if repo.key_server is defined %}
-  - keyserver: {{ repo.key_server }}
-  {%- endif %}
   - consolidate: {{ repo.get('consolidate', False) }}
   - clean_file: {{ repo.get('clean_file', False) }}
   - refresh_db: {{ repo.get('refresh_db', True) }}
@@ -154,9 +167,33 @@ linux_repo_{{ name }}_key:
     - unless: "apt-key finger --with-colons | grep -qF $(curl -sL {{ repo.key_url }} | gpg --with-fingerprint --with-colons | grep -E '^fpr')"
     - require_in:
       - pkgrepo: linux_repo_{{ name }}
+    - env:
+{%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %}
+      - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }}
+{%- endif %}
+{%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %}
+      - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }}
+{%- endif %}

+{%- elif repo.key_id is defined and repo.key_server is defined %}
+
+linux_repo_{{ name }}_key:
+  cmd.run:
+    - name: "apt-key adv --keyserver {{ repo.key_server }} --recv {{ repo.key_id }}"
+    - unless: 'test -e /etc/apt/sources.list.d/{{ name }}.list'
+    - require_in:
+      - pkgrepo: linux_repo_{{ name }}
+    - env:
+{%- if proxies.repo.get('https', None) or proxies.system.get('https', None) %}
+      - https_proxy: {{ proxies.repo.get('https', None) or proxies.system.get('https', None) }}
+{%- endif %}
+{%- if proxies.repo.get('http', None) or proxies.system.get('http', None) %}
+      - http_proxy: {{ proxies.repo.get('http', None) or proxies.system.get('http', None) }}
 {%- endif %}

+{%- endif %}
+
+{#- repo.enabled is false #}
 {%- else %}

 linux_repo_{{ name }}_absent: