Add support for repo_gpgcheck, which should default to 0 since HashiCorp does not sign this repo (vs the RPMs in the repo, which are signed).

Without this, RHEL-like nodes with a global `repo_gpgcheck=1` setting will not be able to use this repo.  This global setting is required on many hardened systems.
This commit is contained in:
hammondr 2022-01-27 09:47:06 -05:00 committed by Ryan Hammond
parent 8197cc3dad
commit 49edc2e297

View file

@ -25,6 +25,7 @@ class hashi_stack::repo (
Stdlib::HTTPSUrl $key_source = 'https://apt.releases.hashicorp.com/gpg',
String $description = 'HashiCorp package repository.',
String $rpm_base = 'https://rpm.releases.hashicorp.com',
Integer[0,1] $repo_gpgcheck = 0,
) {
case $facts['os']['family'] {
'Debian': {
@ -53,6 +54,7 @@ class hashi_stack::repo (
baseurl => "${rpm_base}/RHEL/\$releasever/\$basearch/stable",
gpgcheck => 1,
gpgkey => $key_source,
repo_gpgcheck => $repo_gpgcheck,
enabled => 1,
proxy => $proxy,
priority => $priority,