[fabianspannagel]

What

Installs the Graylog repo key with apt::keyring and references it via signed-by (/etc/apt/keyrings/graylog-keyring.gpg) instead of writing it to the global /etc/apt/trusted.gpg.d/. The legacy key file is removed.

Breaking change

• puppetlabs/apt minimum is now 9.2.0, the first release with apt::keyring.
• On existing nodes, the old key is removed from trusted.gpg.d.

Testing

• pdk validate: no new warnings
• pdk test unit (repository_spec.rb): passes, spec updated for the new resources
• Litmus acceptance on Ubuntu 22.04: 12 examples, 0 failures
• Debian 9 and Ubuntu 18.04 are in operatingsystem_support but were only compile-tested via unit tests

Notes

server_spec.rb has 14 failures on main too (Sensitive server.conf content with Puppet 8), unrelated to this change.

[fabianspannagel]

@bernd , could you take a look at this when you have time? It moves the Graylog apt key to /etc/apt/keyrings with signed-by and raises the puppetlabs/apt minimum to 9.2.0. Unit tests and an Ubuntu 22.04 acceptance run are described above.