I have set up a private deb repository and copied some signed deb packages into it. I have installed the signing key locally. However when I try to install from the repo I get this warning:
WARNING: The following packages cannot be authenticated!
When installing manually, I can just press y but I want to install these packages automatically using puppet, and that fails.
So what's the problem? Do I need to resign packages with a key I control? Is there a better way of ensuring I have a particular version of puppet installed?
The repository is then updated with a script that runs these commands for each repo:
cd /var/www/html/apt/ubuntu/lucid dpkg-scanpackages binary /dev/null | gzip -9c > binary/Packages.gz dpkg-scansources sources /dev/null | gzip -9c > sources/Sources.gz
I have installed the signing key on the client.
$ sudo apt-key list /etc/apt/trusted.gpg -------------------- ... pub 4096R/4BD6EC30 2010-07-10 [expires: 2016-07-08] uid Puppet Labs Release Key (Puppet Labs Release Key) <firstname.lastname@example.org> ...
The rationale for doing this is that I want all puppet clients to be the same version. So all machines should get the packages from my repository by using the following pin in
Package: puppet puppet-common facter Pin: origin deb.example.org Pin-Priority: 1001
(We are currently using puppet 2.6.x, so I need a priority of 1001 to downgrade precise clients from 2.7.x).
I have read about holding packages but that doesn't help me change package versions.
All suggestions welcome.