From aa699737c30b056b237c45ff4ff323c59bb1c9d4 Mon Sep 17 00:00:00 2001
From: Robbe Van der Gucht <robbe.van.der.gucht@fraudbuster.mobi>
Date: Wed, 22 Jul 2026 11:50:38 +0200
Subject: [PATCH 1/2] fix(permissions): permissions on sources and key

---
 apt/repositories.sls | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/apt/repositories.sls b/apt/repositories.sls
index 6f61a1d..0900247 100644
--- a/apt/repositories.sls
+++ b/apt/repositories.sls
@@ -81,6 +81,7 @@
 {%- set r_distro = args.distro or 'stable' %}
 {%- set r_comps = args.comps|default(['main'])|join(' ') %}
 {%- set r_keyserver = args.keyserver if args.keyserver is defined else apt_map.default_keyserver %}
+{%- set r_signedby_file = r_opts.split() | select ('match', '^signed-by=') | map('replace', 'signed-by=', '') | first | default(none) %}
 
   {%- for type in args.type|d(['binary']) %}
     {%- set r_type = 'deb-src' if type == 'source' else 'deb' %}
@@ -114,11 +115,20 @@
   file.managed:
     - name: {{ sources_list_dir }}/{{ r_file }}
     - replace: false
+    - mode: '644'
     - require_in:
       - file: {{ sources_list_dir }}
       # require_in the directory clean state
       # This way, we don't remove all the files, just to add them again.
   {%- endfor %}
+
+  {% if signedby_file %}
+{{ repo }} {{ signedby_file }}:
+  file.managed:
+    - name: {{ signedby_file }}
+    - replace: false
+    - mode: '644'
+  {%- endif %}
 {% endfor %}
 
 {% if repositories %}

From 95966d4f936fec6d10ec3005c71484e2a5b40f3f Mon Sep 17 00:00:00 2001
From: Robbe Van der Gucht <robbe.van.der.gucht@fraudbuster.mobi>
Date: Thu, 10 Sep 2026 14:15:31 +0200
Subject: [PATCH 2/2] feat(mode): add an option to configure sources.list
 permissions

---
 apt/map.jinja        |  2 ++
 apt/repositories.sls | 24 +++++++++++++++++++-----
 pillar.example       |  1 +
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/apt/map.jinja b/apt/map.jinja
index 33d90e4..7649fd7 100644
--- a/apt/map.jinja
+++ b/apt/map.jinja
@@ -9,6 +9,7 @@
         'periodic_config': '10periodic',
         'sources_list_dir': '/etc/apt/sources.list.d',
         'remove_sources_list': false,
+        'mode_sources_list': '0644',
         'clean_sources_list_d': false,
         'preferences_dir': '/etc/apt/preferences.d',
         'preferences': {},
@@ -53,6 +54,7 @@
         'periodic_config': '10periodic',
         'sources_list_dir': '/etc/apt/sources.list.d',
         'remove_sources_list': false,
+        'mode_sources_list': '0644',
         'clean_sources_list_d': false,
         'preferences_dir': '/etc/apt/preferences.d',
         'preferences': {},
diff --git a/apt/repositories.sls b/apt/repositories.sls
index 0900247..ccdccce 100644
--- a/apt/repositories.sls
+++ b/apt/repositories.sls
@@ -8,6 +8,7 @@
 {% set clean_keyrings_d = apt.get('clean_keyrings_d', apt_map.clean_keyrings_d) %}
 {% set default_url = apt.get('default_url', apt_map.default_url) %}
 {% set keyring_package = apt.get('keyring_package', apt_map.default_keyring_package) %}
+{% set mode_sources_list = apt.get('mode_sources_list', apt_map.mode_sources_list ) %}
 
 {{ keyring_package }}:
   pkg.installed:
@@ -55,6 +56,8 @@
     - group: root
     - clean: {{ clean_keyrings_d }}
 
+{% set signedby_files = [] %}
+
 {% for repo, args in repositories.items() %}
 
 {% set r_opts = '' %}
@@ -115,20 +118,31 @@
   file.managed:
     - name: {{ sources_list_dir }}/{{ r_file }}
     - replace: false
-    - mode: '644'
+    - mode: {{ mode_sources_list }}
+    - user: root
+    - group: root
     - require_in:
       - file: {{ sources_list_dir }}
       # require_in the directory clean state
       # This way, we don't remove all the files, just to add them again.
   {%- endfor %}
 
-  {% if signedby_file %}
-{{ repo }} {{ signedby_file }}:
+  {% if r_signedby_file %}
+    {% do signedby_files.append(r_signedby_file) %}
+  {%- endif %}
+{% endfor %}
+
+{% for signedby_file in signedby_files | unique %}
+{{ signedby_file }}:
   file.managed:
     - name: {{ signedby_file }}
     - replace: false
-    - mode: '644'
-  {%- endif %}
+    - mode: '0644'
+    # The above permissions are not configurable because 'apt' drops privileges
+    # when doing key verification, even when running as root it is important 
+    # that these keys are readable for everyone.
+    - user: root
+    - group: root
 {% endfor %}
 
 {% if repositories %}
diff --git a/pillar.example b/pillar.example
index 8df4614..a230be2 100644
--- a/pillar.example
+++ b/pillar.example
@@ -10,6 +10,7 @@ apt:
 
   remove_sources_list: true
   clean_sources_list_d: true
+  mode_sources_list: '0644'
 
   remove_preferences: true
   clean_preferences_d: true