Merge lp:~xfactor973/charms/trusty/elasticsearch/version_bump into lp:charms/trusty/elasticsearch

[Chris Holcombe]

Update default version to latest 1.7 stable release.
Add gpg-key-id option.

This update pushes elasticsearch to the latest 1.7 stable release.
Unfortunately there was a problem with the SSL cert for https://packages.elastic.co/GPG-KEY-elasticsearch. I had to disable the validate_cert field.

This update is required to run the latest stable version of Kibana which I plan on proposing for merger next.

[Michael Nelson (michael.nelson)]

Hi Chris.

I'd only be keen to update the default values for repo/key if it works *without* disabling cert validation. Yes, disabling the cert validation allows it to install, but that shouldn't be the default.

So, as an alternative, if you added an apt-key-validate-certs option to the charm (describing why it's required - bad SSL cert), with a sane default - true, and left the other defaults as they are until the SSL cert is fixed, you could then deploy 1.7 by setting the apt-repository, apt-key-url and apt-key-validate-certs options right?

[lp:~xfactor973/charms/trusty/elasticsearch/version_bump]

41. By Chris Holcombe on 2015-09-29

The https and the http GPG key are identical

[Chris Holcombe (xfactor973)]

Hey Michael,

Yup I think that is a good option. The bad SSL cert is unfortunate. It turns out after a little downloading that the both of the GPG certs are identical. I can still add the apt-key-validate-certs option for future SSL problems that may crop up.

[lp:~xfactor973/charms/trusty/elasticsearch/version_bump]

42. By Chris Holcombe on 2015-09-29

Add an option to skip apt key validation. Also took care of a charm-proof nit about categories being changed to tags in the metadata.yaml

[Michael Nelson (michael.nelson)]

On Wed, Sep 30, 2015 at 8:56 AM Chris Holcombe <email address hidden>
wrote:

> Hey Michael,
>
> Yup I think that is a good option. The bad SSL cert is unfortunate. It
> turns out after a little downloading that the both of the GPG certs are
> identical. I can still add the apt-key-validate-certs option for future
> SSL problems that may crop up.
>

Sorry to be a pain, but I'm -1 on adding options for future just-in-case
scenarios. If the 1.7 install works with the current default key, would you
be OK if we just update your branch to land the updated default
apt-repository and categories->tags charm-proof nit?

[lp:~xfactor973/charms/trusty/elasticsearch/version_bump]

43. By Chris Holcombe on 2015-09-30

Removing the validate key config option

[Chris Holcombe (xfactor973)]

I think this should be all set now

[lp:~xfactor973/charms/trusty/elasticsearch/version_bump]

44. By Chris Holcombe on 2015-10-01

Added a gpg key id to avoid man in the middle attacks

[Michael Nelson (michael.nelson)]

Thanks Chris. +1

review: Approve

=== modified file 'config.yaml'
--- config.yaml	2014-10-31 03:43:31 +0000
+++ config.yaml	2015-10-01 19:00:50 +0000
@@ -1,7 +1,7 @@
 options:
   apt-repository:
     type: string
-    default: "deb http://packages.elasticsearch.org/elasticsearch/1.2/debian stable main"
+    default: "deb http://packages.elastic.co/elasticsearch/1.7/debian stable main"
     description: |
       A deb-line for the apt archive which contains the elasticsearch package.
       This is necessary until elasticsearch gets into the debian/ubuntu archives.
@@ -10,6 +10,11 @@
     default: "http://packages.elasticsearch.org/GPG-KEY-elasticsearch"
     description: |
       The url for the key for the apt-repository.
+  gpg-key-id:
+    type: string
+    default: D88E42B4
+    description: |
+      Elasticsearch's GPG fingerprint to validate the apt key
   cluster-name:
     type: string
     default: "elasticsearch"

=== modified file 'metadata.yaml'
--- metadata.yaml	2014-09-11 18:34:45 +0000
+++ metadata.yaml	2015-10-01 19:00:50 +0000
@@ -4,7 +4,7 @@
 description: |
   Distributed RESTful search and analytics
   Read more at http://www.elasticsearch.org
-categories:
+tags:
   - misc
 subordinate: false
 peers:

=== modified file 'tasks/install-elasticsearch.yml'
--- tasks/install-elasticsearch.yml	2014-07-07 15:37:42 +0000
+++ tasks/install-elasticsearch.yml	2015-10-01 19:00:50 +0000
@@ -3,7 +3,7 @@
     - install
     - upgrade-charm
     - config-changed
-  apt_key: url={{ apt_key_url }} state=present
+  apt_key: url={{ apt_key_url }} state=present id={{gpg_key_id}}
   when: apt_key_url != ""
 
 - name: Add apt archive.