So we all know that Chef's remote_file resource has this problem: You can give it an attribute for a checksum, but it only uses that to determine if it should download the file again, not to verify a download.
I found a good blog post on writing a cookbook to actually verify the download against the checksum.
Now I want to apply this to nginx. They sign their tarballs with GPG, which is all well and good, but on my production servers I can't reach the gpg key server, nor do I want to.
I can certainly include the public key file and the signature file in my cookbook.
So given that I have the public key and the signature as .asc files, I could import the public key, then use gpg to verify the download signature. That means a .gnupg directory will be created in the home of whoever's running chef-client, and the public key will be imported into its keyring.
This isn't something that appeals to me on an automated basis! Yet I can't find any way to test the signature of the tarball without importing the public key and creating a keyring.
Should I stop worrying and just do it?