apt 11.0.0 creates invalid `*.source` files

[dhs-rec]

Describe the Bug

As of version 11.0.0, the apt module creates invalid *.source files which lack a Components field. I guess this is due to (from manifests/source.pp)

      # The deb822 format requires that if the Suite ($release) is a path (contains a /) that
      # the Components field be absent.

which is completely wrong. The spec says:

The Suite can specify an exact path in relation to the URI(s) provided, in which case the Components: must be omitted and suite must end with a slash ( / ). Alternatively, it may take the form of a distribution version (e.g. a version codename like disco or artful ). If the suite does not specify a path, at least one deb822-field-component must be present.

This misinterpretation leads to the following repository being created w/o the (required) Components field:

apt::source { 'mongodb':
  comment  => 'MongoDB APT repository',
  keyring  => '/etc/apt/keyrings/mongodb.gpg',
  location => ['http://repo.mongodb.org/apt/debian'],
  release  => ['bookworm/mongodb-org/6.0'],  # Does not END with slash, "Components" is required
  repos    => ['main'],
}

Result (wrong):

# This file is managed by Puppet. DO NOT EDIT.
# MongoDB APT repository
Enabled: yes
Types: deb 
URIs: http://repo.mongodb.org/apt/debian 
Suites: bookworm/mongodb-org/6.0 
Signed-By: /etc/apt/keyrings/mongodb.gpg

Here's also an example for a correct one:

apt::source { 'jenkins':
  comment  => 'Jenkins APT repository',
  keyring  => '/etc/apt/keyrings/jenkins-keyring.asc',
  location => ['https://pkg.jenkins.io/debian-stable'],
  release  => ['binary/'],   # Ends with slash, Components can be omitted
  repos    => [],
}

Result (correct):

# This file is managed by Puppet. DO NOT EDIT.
# Jenkins APT repository
Enabled: yes
Types: deb 
URIs: https://pkg.jenkins.io/debian-stable
Suites: binary/ 
Signed-By: /etc/apt/keyrings/jenkins-keyring.asc

Expected Behavior

The Components field is omitted ONLY if the Suites END with a /.

Steps to Reproduce

Steps to reproduce the behavior:

1. Update to apt 11.0.0
2. Apply the above resources

Environment

• Version 11.0.0.
• Platform Debian 12/13

Additional Context

https://repolib.readthedocs.io/en/latest/deb822-format.html

[dhs-rec]

In addition, I believe 11.0.0 also introduced a syntax error in lib/puppet/provider/apt_key/apt_key.rb, line 57:

50       key_array << new(
51         name: line_hash[:key_fingerprint],
52         id: line_hash[:key_long],
53         fingerprint: line_hash[:key_fingerprint],
54         short: line_hash[:key_short],
55         long: line_hash[:key_long],
56         ensure: :present,
57         expired:,
58         expiry: line_hash[:key_expiry].nil? ? nil : line_hash[:key_expiry].strftime('%Y-%m-%d'),
59         size: line_hash[:key_size],
60         type: line_hash[:key_type],
61         created: line_hash[:key_created].strftime('%Y-%m-%d'),
62       )

[deric]

@dhs-rec expired: is valid syntax in Ruby 3.1 which will be equal to expired: expired

However it won't be compatible with Puppet 7.

[dhs-rec]

@deric, thanks for clarification. Didn't know this. However, still looks strange... ;-)

[janit42]

addressed by pull-request #1224 ?

[dhs-rec]

@janit42, no, I don't think so. This PR is 6 months old, but 11.0.0 was released Sep. 05th. The problem is this line, which checks whether any suite contains a slash, while it should check whether it ends with one.

[dhs-rec]

For documentation of the different Debian repository formats see here. It distinguishes between standard and flat repositories. For standard ones, it defines:

The distribution part (stable in this case) specifies a subdirectory in $ARCHIVE_ROOT/dists. It can contain additional slashes to specify subdirectories nested deeper, eg. stable/updates. distribution typically corresponds to Suite or Codename specified in the Release files.

Whereas it says this for "flat" repositories:

A flat repository does not use the dists hierarchy of directories, and instead places meta index and indices directly into the archive root (or some part below it) In sources.list syntax, a flat repository is specified like this:

deb uri directory/

[dhs-rec]

Any news on this?