diff --git a/tasks/docker.yml b/tasks/docker.yml index 912b2d5d564d445abf07e8187f8648f3af60c7b6..0246ec9d1e0edd164746ab179827576cabf825e0 100644 --- a/tasks/docker.yml +++ b/tasks/docker.yml @@ -72,17 +72,40 @@ owner: root group: root - - name: Docker gpg key present + - name: Docker ascii armored gpg key present ansible.builtin.get_url: - url: "https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg" + url: "{{ docker_gpg_url }}" checksum: "{{ docker_gpg_checksum }}" - dest: /etc/apt/keyrings/docker.asc + dest: /root/docker.asc mode: 0644 owner: root group: root + register: docker_gpg_asc_file + + - name: Stat Docker gpg asc file + ansible.builtin.stat: + path: /etc/apt/keyrings/docker.gpg + register: docker_gpg_file + + - name: Docker gpg key dearmored + ansible.builtin.shell: | + set -e -o pipefail + gpg --dearmor < /root/docker.asc > /etc/apt/keyrings/docker.gpg + args: + executable: "{% if ansible_distribution == 'Ubuntu' %}/usr/bin/bash{% elif ansible_distribution == 'Debian' %}/bin/bash{% endif %}" + when: ( docker_gpg_asc_file.changed | bool ) or ( not docker_gpg_file.stat.exists | bool ) - name: Docker gpg key check command - ansible.builtin.command: gpg --with-colons --show-keys /etc/apt/keyrings/docker.asc + ansible.builtin.command: + gpg --with-colons + {% if ansible_distribution == "Ubuntu" and ansible_distribution_version is version('18.04', '<=') %} + --with-fingerprint --with-subkey-fingerprint + {% elif ansible_distribution == "Debian" and ansible_distribution_version is version('10.0', '<=') %} + --with-fingerprint --with-subkey-fingerprint + {% else %} + --show-keys + {% endif %} + /etc/apt/keyrings/docker.gpg check_mode: false changed_when: false register: docker_gpg diff --git a/templates/docker.sources.j2 b/templates/docker.sources.j2 index 93dd5b29eb5528e638d1fc1631d1e6933e06d450..126fcc2e183614df4b24fcf7e02eba1feddf81bb 100644 --- a/templates/docker.sources.j2 +++ b/templates/docker.sources.j2 @@ -5,4 +5,4 @@ URIs: https://download.docker.com/linux/{{ ansible_distribution | lower }} Architectures: {{ ansible_facts.ansible_local.dpkg_arch.arch }} Components: stable Suites: {{ ansible_distribution_release }} -Signed-By: /etc/apt/keyrings/docker.asc +Signed-By: /etc/apt/keyrings/docker.gpg diff --git a/vars/main.yml b/vars/main.yml index e1366c7e858c5fbbc1bdf5cce3863d4dd559a472..c232f14c36efe23074d26f3e923dd8d10997205a 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -1,4 +1,8 @@ --- +# ASCII armored GPG public key URL linked from +# https://docs.docker.com/engine/install/debian/ +docker_gpg_url: "https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg" + # Get the sha256 checksum using the following command # wget -q https://download.docker.com/linux/debian/gpg -O - | sha256sum - | awk '{ print $1 }' | sed 's/^/"sha256:/' | sed 's/$/"/' docker_gpg_checksum: "sha256:1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570" @@ -9,6 +13,9 @@ docker_gpg_fingerprints: - 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 - D3306A018370199E527AE7997EA0A9C3F273FCD8 +# Packages available will vary between distros, you can get the packages installed from this repo using +# aptitude search "?origin (docker) ?installed" +# # Get the packages using the following command # grep Package /var/lib/apt/lists/download.docker.com_*_Packages | sed 's/^Package: //' | uniq | sort | sed 's/^/ - /' docker_pkg: