Updating a GPG key:
Yes, that's possible using the exec resource type, which "executes external commands". To prevent the exec
from running each time, use unless and check / parse the output of apt-key list
, for example via grep
.
Adding a GPG key:
The puppetlabs apt module provides apt::key, which adds GPG keys. To use it, put something into your code along the lines of (from the docs):
apt::key { 'puppetlabs':
id => '47B320EB4C7C375AA9DAE1A01054B7A24BD6EC30',
server => 'pgp.mit.edu',
}
Security note:
Using short key IDs presents a serious security issue, potentially leaving you open to collision attacks. We recommend you always use full fingerprints to identify your GPG keys. This module allows short keys, but issues a security warning if you use them.
Some more information why this should matter to you:
Short OpenPGP Key IDs, for example 0×2861A790, are 32 bits long. They have been shown to be easily spoofed by another key with the same Key ID. Long OpenPGP Key IDs (for example 0xA1E6148633874A3D) are 64 bits long. They are trivially collidable, which is also a potentially serious problem.
If you want to deal with a cryptographically-strong identifier for a key, you should use the full fingerprint. You should never rely on the short, or even long, Key ID. [...]
Reference and more information about this.