Rework apt to use packagecloud repos as well (#640)

[wyardley]

Could use some feedback on this, especially in terms of whether the packagecloud repo key itself needs to be configurable, and whether using the mit pgp server is the best way to get the key (it seems safer than grabbing it from the packagecloud site directly).

I couldn't find an easy way around doing variable interpolation in the repo source in the spec tests, but open to suggestions / examples of how to do it better.

[bastelfreak]

is packagecloud a third party service that generates the packages, or just a hosting platform used by the rabbitmq team? If it is the first option, the usage should be optional?

[wyardley]

@bastelfreak in the case of repos_ensure being true (the only time this class should be called), we configure the official repo rather than the OS one or other user-configured ones. The linked issue has more detail, but they were both self-hosting and hosting via Packagecloud for a while (but without a proper yum repo), so we switched yum to use packagecloud when repos_ensure is set. Now, they're saying that they'll be dropping the self-hosted packages, so the packages are built (and signed) by RabbitMQ, but pushed to packagecloud, which hosts the repo and signs the repo metadata.

rspec doesn't yet have a with_server matcher, so need to check how recently that option was added to apt::key. Using a separate source from the download itself seems better to me, security-wise, but not sure what the min required version of apt is to use this style.

[wyardley]

From https://github.com/puppetlabs/puppetlabs-apt/blob/master/CHANGELOG.md, it seems as if it used to be called key_server, but it has a default, so we should just take that; I'll take out the server param entirely in the call.

[bastelfreak]

This fixes #640

[bastelfreak]

@wyardley thanks for the explanation, I didn't see the issue :(

[michaelklishin]

A couple of clarifications: Package Cloud is just a package distribution service. Team RabbitMQ publishes packages our build infra produces there. We won't be dropping the existing repo on rabbitmq.com but it will become a read-only archive.

[wyardley]

Updated with some feedback from the comments. This seems to work for me, and, as a bonus, I think actually makes more sense as well.