apt::key breaks on systems that dont have apt-key #1306

Activity

1. bwitt commented on Oct 28, 2026

   

   bwitt

   on Oct 28, 2026

   Author

   More actions

   @jst-cyr thoughts on how to handle this? can we just fail if someone tries to use this where it is not supported?
2. jst-cyr commented on Oct 29, 2026

   

   jst-cyr

   on Oct 29, 2026

   Member

   More actions

   @bwitt : I did some digging into this today to better understand what's going on and when things were getting deprecated. It looks like we marked in the docs that apt-key is deprecated and to ask folks to transition, but we haven't actually done hard deprecations in the codebase. We also still officially support quite a few older OS versions that do have apt-key.

   Given that, I'm hesitant to recommend we do a hard-break of the functionality across all OS by doing a new major version release that removes apt-key.

   Claude wanted to recommend a full gpg rewrite, but I don't know that we need to go that far. That seems like a lot of code changes for minimal benefits.

   What I'm currently thinking:

   1. We do formal deprecation in the code to give runtime warnings to apt-key users who are still using it on older versions, so they know that a major version will remove this in the future.
   2. Add some sort of 'exists' check for apt-key so we can give a real error with direction to use keyring instead, instead of the current method that just fails with the 'could not find a suitable provider' error.
   3. Update the acceptance tests to have different assertions: if apt-key exists, expect the current acceptance test results. If apt-key does not exist, expect the new error. (This would double as a test for the new error in addition to fixing the acceptance tests)

   What do you think @bwitt ?
3. SugatD

   added a commit that references this issue on Nov 2, 2026

   Deprecate apt_key and fail clearly when apt-key is unavailable

   ...

   3d701e3
4. bwitt commented on Nov 2, 2026

   

   bwitt

   on Nov 2, 2026

   Author

   More actions

   sure that sounds good:

   • do a depreciation warning, in apt::key too
   • switch lib/puppet/provider/apt_key/apt_key.rb:16 to use optional_commands, and then raise a clear error.
   • for acceptance tests decide when to expect error or not based on the OS and version; that way a broken image wont expect failure and pass, it'll properly fail the test.
5. jst-cyr

   linked a pull request that will close this issue(MODULES-12068) Ubuntu 26.04 support: deprecate apt_key and fail clearly without apt-key #1337on Nov 2, 2026
6. jst-cyr commented on Nov 2, 2026

   

   jst-cyr

   on Nov 2, 2026

   Member

   More actions

   @SugatD has started a new PR (#1337) that will close both this (#1306) and #1307 at the same time. It can also be used for #1272 as well to get Debian 13 tests passing as well since it had the same issue with apt-key
7. SugatD

   closed this as completedin #1337on Nov 4, 2026
8. SugatD

   added a commit that references this issue on Nov 4, 2026

   Deprecate apt_key and fail clearly when apt-key is unavailable

   ...

   2e61c71