pkgrepo

Module	Summary
`pkgrepo.managed`	Manage an apt or yum/dnf package repository definition.

All states also accept the full set of requisite parameters and Salt-parity state attributes — see Dependencies & Requisites.

`pkgrepo.managed`

Manage an apt or yum/dnf package repository definition.

Source: pkg/state/modules/pkgrepo/pkgrepo_managed.go

pkgrepo.managed manages an apt or yum/dnf package repository definition file. On the Debian family it writes /etc/apt/sources.list.d/<name>.list (optionally fetching a signing key and refreshing the cache); on the RedHat family it writes /etc/yum.repos.d/<name>.repo. A PPA (ppa:user/name) is handled via add-apt-repository. The repository identifier defaults to the state ID and is used for both the default filename and the yum section header; humanname defaults to it. enabled, gpgcheck, and refresh default to true. Setting ppa also forces the Debian code path when the OS family cannot otherwise be detected.

The rendered repository file body is:

Debian (.list):

# Managed by Zester: <humanname>
<baseurl>

RedHat (.repo):

[<name>]
name=<humanname>
baseurl=<baseurl>
enabled=1
gpgcheck=1
gpgkey=<key_url>          # only when key_url is set

Parameters

Parameter	Type	Required	Default	Description
`name`	`string`	No	State ID	repository identifier, used for the default filename and the yum section header; defaults to the state ID
`humanname`	`string`	No	(none)	descriptive display name (yum name= field / apt comment line); defaults to the repository name
`baseurl`	`string`	No	(none)	the repository line — on apt the full "deb ..." source line, on yum the baseurl= value
`ppa`	`string`	No	(none)	apt PPA reference (e.g. "ppa:user/name"); when set and baseurl is empty the repo is added via add-apt-repository, and it forces the Debian code path when the OS family cannot be detected
`file`	`string`	No	(none)	override the default repository definition file path
`key_url`	`string`	No	(none)	signing-key URL; on apt it is fetched to /etc/apt/keyrings/zester-<name>.gpg and imported via apt-key add, on yum it becomes the gpgkey= field
`enabled`	`bool`	No	`true`	the yum enabled= field (1/0), ignored on apt; defaults to true; a boolean that also accepts the integers 1 (true) and 0 (false)
`gpgcheck`	`bool`	No	`true`	the yum gpgcheck= field (1/0), ignored on apt; defaults to true; a boolean that also accepts the integers 1 (true) and 0 (false)
`refresh`	`bool`	No	`true`	refresh the package cache after writing the repo (apt-get update / <mgr> makecache); defaults to true; a boolean that also accepts the integers 1 (true) and 0 (false)

Effects

Check

Errors when the OS family cannot be determined. A PPA repo always reports a change — a PPA cannot be verified from a single file, so the idempotent add-apt-repository is re-run on every Apply. Otherwise it renders the desired file content and compares it byte-for-byte with the current repo file; a missing or differing file needs a change, and a read failure other than "file does not exist" fails the check (it is never treated as a missing file, so an unreadable file is never blindly overwritten). On Debian with key_url declared it ALSO verifies the imported keyring file /etc/apt/keyrings/zester-<name>.gpg exists — the key URL appears nowhere in the compared .list bytes, so a matching repo file with a never-imported (or deleted) signing key still reports a change. This is presence-only: a key rotated in place at the same URL is not detected. RedHat needs no keyring probe — gpgkey= is part of the compared content and dnf fetches it at transaction time.

Apply

On Debian: imports the signing key when key_url is set (curl writing DIRECTLY to the persistent keyring file /etc/apt/keyrings/zester-<name>.gpg, then apt-key add), then either runs add-apt-repository -y <ppa> or writes the .list file (creating the parent directory), then runs apt-get update when refresh is true. On RedHat: writes the .repo file, then runs <mgr> makecache when refresh is true. Reports the repo name, file, and family in its details.

Revert

A PPA repo is removed via add-apt-repository -r -y <ppa>. A file-based repo has its definition file deleted; on Debian with key_url declared the keyring file /etc/apt/keyrings/zester-<name>.gpg is removed too (an already-absent keyring is fine). Revert removes the whole repo file rather than restoring any prior content.

Examples

Apt repository

On apt, baseurl holds the full deb line; key_url is fetched and imported.

docker:
  pkgrepo.managed:
    - humanname: Docker CE
    - baseurl: "deb [arch=amd64] https://download.docker.com/linux/ubuntu jammy stable"
    - key_url: https://download.docker.com/linux/ubuntu/gpg

Yum repository

On yum, baseurl is the baseurl= value; enabled/gpgcheck default to true.

epel:
  pkgrepo.managed:
    - humanname: Extra Packages for Enterprise Linux
    - baseurl: "https://download.fedoraproject.org/pub/epel/9/Everything/x86_64/"
    - gpgcheck: false

PPA

A PPA is added via add-apt-repository; setting ppa forces the Debian path.

deadsnakes:
  pkgrepo.managed:
    - ppa: "ppa:deadsnakes/ppa"

Add an apt repository ad hoc

The bare positional argument is the repository name; baseurl is a key=value.

zester 'web*' pkgrepo.managed docker baseurl='deb https://download.docker.com/linux/ubuntu jammy stable'