feat(debian): use repository keyring instead of key_id

postgres/codenamemap.yaml

@@ -29,7 +29,7 @@
   data_dir: {{ data_dir }}
   fromrepo: {{ fromrepo }}
   pkg_repo:
-    name: 'deb http://apt.postgresql.org/pub/repos/apt {{ name }}-pgdg main'
+    name: 'deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg] http://apt.postgresql.org/pub/repos/apt {{ name }}-pgdg main'
   pkg: postgresql-{{ version }}
   pkg_client: postgresql-client-{{ version }}
   prepare_cluster:

postgres/osfamilymap.yaml

@@ -16,8 +16,8 @@ Debian:
   pkgs_deps: ['python3-apt']
   pkg_repo:
     humanname: PostgreSQL Official Repository
-    key_url: 'https://www.postgresql.org/media/keys/ACCC4CF8.asc'
     file: /etc/apt/sources.list.d/pgdg.list
+  pkg_repo_keyring: 'https://download.postgresql.org/pub/repos/apt/pool/main/p/pgdg-keyring/pgdg-keyring_2018.2_all.deb'
   pkg_repo_keyid: ACCC4CF8
     {% if repo.use_upstream_repo == true %}
   pkg_dev: ''

postgres/server/remove.sls

@@ -12,6 +12,12 @@ postgresql-repo-removed:
     - keyid: {{ postgres.pkg_repo_keyid }}
     {%- endif %}
 
+    {% if grains.os_family == 'Debian' %}
+postgresql-repo-keyring-removed:
+  pkg.removed:
+    - name: pgdg-keyring
+    {%- endif -%}
+
 #remove release installed by formula
 postgresql-server-removed:
   pkg.removed:

postgres/upstream.sls

@@ -23,6 +23,15 @@ postgresql-pkg-deps:
     - pkgs: {{ postgres.pkgs_deps | json }}
 
 # Add upstream repository for your distro
+  {% if grains.os_family == 'Debian' %}
+postgresql-repo-keyring:
+  pkg.installed:
+    - sources:
+      - pgdg-keyring: {{ postgres.pkg_repo_keyring }}
+    - require_in:
+      - pkgrepo: postgresql-repo
+  {%- endif %}
+
 postgresql-repo:
   pkgrepo.managed:
     {{- format_kwargs(postgres.pkg_repo) }}
@@ -39,6 +48,12 @@ postgresql-repo:
     - keyid: {{ postgres.pkg_repo_keyid }}
     {%- endif %}
 
+    {% if grains.os_family == 'Debian' %}
+postgresql-repo-keyring:
+  pkg.removed:
+    - name: pgdg-keyring
+    {%- endif -%}
+
   {%- endif -%}
 
 {%- elif grains.os not in ('Windows', 'MacOS',) %}