Remove (deprecated) apt-key (#1068)

Also, add the "signed by" option to source definitions. This enables
users to limit the scope of trust for individual keys.

LP: #1836336

5 files changed, 378 insertions, 62 deletions

diff --git a/tests/integration_tests/modules/test_apt.py b/tests/integration_tests/modules/test_apt.py
index 54711fc0..2c388047 100644
--- a/tests/integration_tests/modules/test_apt.py
+++ b/tests/integration_tests/modules/test_apt.py
@@ -1,9 +1,11 @@
 """Series of integration tests covering apt functionality."""
 import re
-from tests.integration_tests.clouds import ImageSpecification
 
 import pytest
 
+from cloudinit.config import cc_apt_configure
+from cloudinit import gpg
+from tests.integration_tests.clouds import ImageSpecification
 from tests.integration_tests.instances import IntegrationInstance
 
 
@@ -43,6 +45,13 @@ apt:
       keyid: 441614D8
       keyserver: keyserver.ubuntu.com
       source: "ppa:simplestreams-dev/trunk"
+    test_signed_by:
+      keyid: A2EB2DEC0BD7519B7B38BE38376A290EC8068B11
+      keyserver: keyserver.ubuntu.com
+      source: "deb [signed-by=$KEY_FILE] http://ppa.launchpad.net/juju/stable/ubuntu $RELEASE main"
+    test_bad_key:
+      key: ""
+      source: "deb $MIRROR $RELEASE main"
     test_key:
       source: "deb http://ppa.launchpad.net/cloud-init-dev/test-archive/ubuntu $RELEASE main"
       key: |
@@ -91,12 +100,27 @@ TEST_KEYSERVER_KEY = "7260 0DB1 5B8E 4C8B 1964  B868 038A CC97 C660 A937"
 TEST_PPA_KEY = "3552 C902 B4DD F7BD 3842  1821 015D 28D7 4416 14D8"
 
 TEST_KEY = "1FF0 D853 5EF7 E719 E5C8  1B9C 083D 06FB E4D3 04DF"
+TEST_SIGNED_BY_KEY = "A2EB 2DEC 0BD7 519B 7B38  BE38 376A 290E C806 8B11"
 
 
 @pytest.mark.ci
 @pytest.mark.ubuntu
 @pytest.mark.user_data(USER_DATA)
 class TestApt:
+    def get_keys(self, class_client: IntegrationInstance):
+        """Return all keys in /etc/apt/trusted.gpg.d/ and /etc/apt/trusted.gpg
+        in human readable format. Mimics the output of apt-key finger
+        """
+        list_cmd = ' '.join(gpg.GPG_LIST) + ' '
+        keys = class_client.execute(list_cmd + cc_apt_configure.APT_LOCAL_KEYS)
+        print(keys)
+        files = class_client.execute(
+            'ls ' + cc_apt_configure.APT_TRUSTED_GPG_DIR)
+        for file in files.split():
+            path = cc_apt_configure.APT_TRUSTED_GPG_DIR + file
+            keys += class_client.execute(list_cmd + path) or ''
+        return keys
+
     def test_sources_list(self, class_client: IntegrationInstance):
         """Integration test for the apt module's `sources_list` functionality.
 
@@ -152,8 +176,33 @@ class TestApt:
             'http://ppa.launchpad.net/simplestreams-dev/trunk/ubuntu'
         ) in ppa_path_contents
 
-        keys = class_client.execute('apt-key finger')
-        assert TEST_PPA_KEY in keys
+        assert TEST_PPA_KEY in self.get_keys(class_client)
+
+    def test_signed_by(self, class_client: IntegrationInstance):
+        """Test the apt signed-by functionality.
+        """
+        release = ImageSpecification.from_os_image().release
+        source = (
+            "deb [signed-by=/etc/apt/cloud-init.gpg.d/test_signed_by.gpg] "
+            "http://ppa.launchpad.net/juju/stable/ubuntu"
+            " {} main".format(release))
+        print(class_client.execute('cat /var/log/cloud-init.log'))
+        path_contents = class_client.read_from_file(
+            '/etc/apt/sources.list.d/test_signed_by.list')
+        assert path_contents == source
+
+        key = class_client.execute(
+            'gpg --no-default-keyring --with-fingerprint --list-keys '
+            '--keyring /etc/apt/cloud-init.gpg.d/test_signed_by.gpg')
+
+        assert TEST_SIGNED_BY_KEY in key
+
+    def test_bad_key(self, class_client: IntegrationInstance):
+        """Test the apt signed-by functionality.
+        """
+        with pytest.raises(OSError):
+            class_client.read_from_file(
+                '/etc/apt/trusted.list.d/test_bad_key.gpg')
 
     def test_key(self, class_client: IntegrationInstance):
         """Test the apt key functionality.
@@ -168,9 +217,7 @@ class TestApt:
         assert (
             'http://ppa.launchpad.net/cloud-init-dev/test-archive/ubuntu'
         ) in test_archive_contents
-
-        keys = class_client.execute('apt-key finger')
-        assert TEST_KEY in keys
+        assert TEST_KEY in self.get_keys(class_client)
 
     def test_keyserver(self, class_client: IntegrationInstance):
         """Test the apt keyserver functionality.
@@ -186,8 +233,7 @@ class TestApt:
             'http://ppa.launchpad.net/cloud-init-raharper/curtin-dev/ubuntu'
         ) in test_keyserver_contents
 
-        keys = class_client.execute('apt-key finger')
-        assert TEST_KEYSERVER_KEY in keys
+        assert TEST_KEYSERVER_KEY in self.get_keys(class_client)
 
     def test_os_pipelining(self, class_client: IntegrationInstance):
         """Test 'os' settings does not write apt config file.
diff --git a/tests/unittests/test_gpg.py b/tests/unittests/test_gpg.py
new file mode 100644
index 00000000..451ffa91
--- /dev/null
+++ b/tests/unittests/test_gpg.py
@@ -0,0 +1,81 @@
+import pytest
+from unittest import mock
+
+from cloudinit import gpg
+from cloudinit import subp
+
+TEST_KEY_HUMAN = '''
+/etc/apt/cloud-init.gpg.d/my_key.gpg
+--------------------------------------------
+pub   rsa4096 2021-10-22 [SC]
+      3A3E F34D FDED B3B7 F3FD  F603 F83F 7712 9A5E BD85
+uid           [ unknown] Brett Holman <brett.holman@canonical.com>
+sub   rsa4096 2021-10-22 [A]
+sub   rsa4096 2021-10-22 [E]
+'''
+
+TEST_KEY_MACHINE = '''
+tru::1:1635129362:0:3:1:5
+pub:-:4096:1:F83F77129A5EBD85:1634912922:::-:::scESCA::::::23::0:
+fpr:::::::::3A3EF34DFDEDB3B7F3FDF603F83F77129A5EBD85:
+uid:-::::1634912922::64F1F1D6FA96316752D635D7C6406C52C40713C7::Brett Holman \
+<brett.holman@canonical.com>::::::::::0:
+sub:-:4096:1:544B39C9A9141F04:1634912922::::::a::::::23:
+fpr:::::::::8BD901490D6EC986D03D6F0D544B39C9A9141F04:
+sub:-:4096:1:F45D9443F0A87092:1634912922::::::e::::::23:
+fpr:::::::::8CCCB332317324F030A45B19F45D9443F0A87092:
+'''
+
+TEST_KEY_FINGERPRINT_HUMAN = \
+    '3A3E F34D FDED B3B7 F3FD  F603 F83F 7712 9A5E BD85'
+
+TEST_KEY_FINGERPRINT_MACHINE = \
+    '3A3EF34DFDEDB3B7F3FDF603F83F77129A5EBD85'
+
+
+class TestGPGCommands:
+    def test_dearmor_bad_value(self):
+        """This exception is handled by the callee. Ensure it is not caught
+        internally.
+        """
+        with mock.patch.object(
+                subp,
+                'subp',
+                side_effect=subp.ProcessExecutionError):
+            with pytest.raises(subp.ProcessExecutionError):
+                gpg.dearmor('garbage key value')
+
+    def test_gpg_list_args(self):
+        """Verify correct command gets called to list keys
+        """
+        no_colons = [
+            'gpg',
+            '--with-fingerprint',
+            '--no-default-keyring',
+            '--list-keys',
+            '--keyring',
+            'key']
+        colons = [
+            'gpg',
+            '--with-fingerprint',
+            '--no-default-keyring',
+            '--list-keys',
+            '--keyring',
+            '--with-colons',
+            'key']
+        with mock.patch.object(subp, 'subp', return_value=('', '')) as m_subp:
+            gpg.list('key')
+            assert mock.call(colons, capture=True) == m_subp.call_args
+
+            gpg.list('key', human_output=True)
+            test_calls = mock.call((no_colons), capture=True)
+            assert test_calls == m_subp.call_args
+
+    def test_gpg_dearmor_args(self):
+        """Verify correct command gets called to dearmor keys
+        """
+        with mock.patch.object(subp, 'subp', return_value=('', '')) as m_subp:
+            gpg.dearmor('key')
+            test_call = mock.call(
+                ["gpg", "--dearmor"], data='key', decode=False)
+            assert test_call == m_subp.call_args
diff --git a/tests/unittests/test_handler/test_handler_apt_key.py b/tests/unittests/test_handler/test_handler_apt_key.py
new file mode 100644
index 00000000..00e5a38d
--- /dev/null
+++ b/tests/unittests/test_handler/test_handler_apt_key.py
@@ -0,0 +1,137 @@
+import os
+from unittest import mock
+
+from cloudinit.config import cc_apt_configure
+from cloudinit import subp
+from cloudinit import util
+
+TEST_KEY_HUMAN = '''
+/etc/apt/cloud-init.gpg.d/my_key.gpg
+--------------------------------------------
+pub   rsa4096 2021-10-22 [SC]
+      3A3E F34D FDED B3B7 F3FD  F603 F83F 7712 9A5E BD85
+uid           [ unknown] Brett Holman <brett.holman@canonical.com>
+sub   rsa4096 2021-10-22 [A]
+sub   rsa4096 2021-10-22 [E]
+'''
+
+TEST_KEY_MACHINE = '''
+tru::1:1635129362:0:3:1:5
+pub:-:4096:1:F83F77129A5EBD85:1634912922:::-:::scESCA::::::23::0:
+fpr:::::::::3A3EF34DFDEDB3B7F3FDF603F83F77129A5EBD85:
+uid:-::::1634912922::64F1F1D6FA96316752D635D7C6406C52C40713C7::Brett Holman \
+<brett.holman@canonical.com>::::::::::0:
+sub:-:4096:1:544B39C9A9141F04:1634912922::::::a::::::23:
+fpr:::::::::8BD901490D6EC986D03D6F0D544B39C9A9141F04:
+sub:-:4096:1:F45D9443F0A87092:1634912922::::::e::::::23:
+fpr:::::::::8CCCB332317324F030A45B19F45D9443F0A87092:
+'''
+
+TEST_KEY_FINGERPRINT_HUMAN = \
+    '3A3E F34D FDED B3B7 F3FD  F603 F83F 7712 9A5E BD85'
+
+TEST_KEY_FINGERPRINT_MACHINE = \
+    '3A3EF34DFDEDB3B7F3FDF603F83F77129A5EBD85'
+
+
+class TestAptKey:
+    """TestAptKey
+    Class to test apt-key commands
+    """
+    @mock.patch.object(subp, 'subp', return_value=('fakekey', ''))
+    @mock.patch.object(util, 'write_file')
+    def _apt_key_add_success_helper(self, directory, *args, hardened=False):
+        file = cc_apt_configure.apt_key(
+            'add',
+            output_file='my-key',
+            data='fakekey',
+            hardened=hardened)
+        assert file == directory + '/my-key.gpg'
+
+    def test_apt_key_add_success(self):
+        """Verify the correct directory path gets returned for unhardened case
+        """
+        self._apt_key_add_success_helper('/etc/apt/trusted.gpg.d')
+
+    def test_apt_key_add_success_hardened(self):
+        """Verify the correct directory path gets returned for hardened case
+        """
+        self._apt_key_add_success_helper(
+            '/etc/apt/cloud-init.gpg.d',
+            hardened=True)
+
+    def test_apt_key_add_fail_no_file_name(self):
+        """Verify that null filename gets handled correctly
+        """
+        file = cc_apt_configure.apt_key(
+            'add',
+            output_file=None,
+            data='')
+        assert '/dev/null' == file
+
+    def _apt_key_fail_helper(self):
+        file = cc_apt_configure.apt_key(
+            'add',
+            output_file='my-key',
+            data='fakekey')
+        assert file == '/dev/null'
+
+    @mock.patch.object(subp, 'subp', side_effect=subp.ProcessExecutionError)
+    def test_apt_key_add_fail_no_file_name_subproc(self, *args):
+        """Verify that bad key value gets handled correctly
+        """
+        self._apt_key_fail_helper()
+
+    @mock.patch.object(
+        subp, 'subp', side_effect=UnicodeDecodeError('test', b'', 1, 1, ''))
+    def test_apt_key_add_fail_no_file_name_unicode(self, *args):
+        """Verify that bad key encoding gets handled correctly
+        """
+        self._apt_key_fail_helper()
+
+    def _apt_key_list_success_helper(self, finger, key, human_output=True):
+        @mock.patch.object(os, 'listdir', return_value=('/fake/dir/key.gpg',))
+        @mock.patch.object(subp, 'subp', return_value=(key, ''))
+        def mocked_list(*a):
+
+            keys = cc_apt_configure.apt_key('list', human_output)
+            assert finger in keys
+        mocked_list()
+
+    def test_apt_key_list_success_human(self):
+        """Verify expected key output, human
+        """
+        self._apt_key_list_success_helper(
+            TEST_KEY_FINGERPRINT_HUMAN,
+            TEST_KEY_HUMAN)
+
+    def test_apt_key_list_success_machine(self):
+        """Verify expected key output, machine
+        """
+        self._apt_key_list_success_helper(
+            TEST_KEY_FINGERPRINT_MACHINE,
+            TEST_KEY_MACHINE, human_output=False)
+
+    @mock.patch.object(os, 'listdir', return_value=())
+    @mock.patch.object(subp, 'subp', return_value=('', ''))
+    def test_apt_key_list_fail_no_keys(self, *args):
+        """Ensure falsy output for no keys
+        """
+        keys = cc_apt_configure.apt_key('list')
+        assert not keys
+
+    @mock.patch.object(os, 'listdir', return_value=('file_not_gpg_key.txt'))
+    @mock.patch.object(subp, 'subp', return_value=('', ''))
+    def test_apt_key_list_fail_no_keys_file(self, *args):
+        """Ensure non-gpg file is not returned.
+
+        apt-key used file extensions for this, so we do too
+        """
+        assert not cc_apt_configure.apt_key('list')
+
+    @mock.patch.object(subp, 'subp', side_effect=subp.ProcessExecutionError)
+    @mock.patch.object(os, 'listdir', return_value=('bad_gpg_key.gpg'))
+    def test_apt_key_list_fail_bad_key_file(self, *args):
+        """Ensure bad gpg key doesn't throw exeption.
+        """
+        assert not cc_apt_configure.apt_key('list')
diff --git a/tests/unittests/test_handler/test_handler_apt_source_v1.py b/tests/unittests/test_handler/test_handler_apt_source_v1.py
index 367971cb..2357d699 100644
--- a/tests/unittests/test_handler/test_handler_apt_source_v1.py
+++ b/tests/unittests/test_handler/test_handler_apt_source_v1.py
@@ -9,6 +9,7 @@ import os
 import re
 import shutil
 import tempfile
+import pathlib
 from unittest import mock
 from unittest.mock import call
 
@@ -279,16 +280,16 @@ class TestAptSourceConfig(TestCase):
         """
         cfg = self.wrapv1conf(cfg)
 
-        with mock.patch.object(subp, 'subp',
-                               return_value=('fakekey 1234', '')) as mockobj:
+        with mock.patch.object(cc_apt_configure, 'add_apt_key') as mockobj:
             cc_apt_configure.handle("test", cfg, self.fakecloud, None, None)
 
-        # check if it added the right ammount of keys
+        # check if it added the right number of keys
         calls = []
-        for _ in range(keynum):
-            calls.append(call(['apt-key', 'add', '-'],
-                              data=b'fakekey 1234',
-                              target=None))
+        sources = cfg['apt']['sources']
+        for src in sources:
+            print(sources[src])
+            calls.append(call(sources[src], None))
+
         mockobj.assert_has_calls(calls, any_order=True)
 
         self.assertTrue(os.path.isfile(filename))
@@ -364,11 +365,17 @@ class TestAptSourceConfig(TestCase):
         """
         cfg = self.wrapv1conf([cfg])
 
-        with mock.patch.object(subp, 'subp') as mockobj:
+        with mock.patch.object(cc_apt_configure, 'add_apt_key') as mockobj:
             cc_apt_configure.handle("test", cfg, self.fakecloud, None, None)
 
-        mockobj.assert_called_with(['apt-key', 'add', '-'],
-                                   data=b'fakekey 4321', target=None)
+        # check if it added the right amount of keys
+        sources = cfg['apt']['sources']
+        calls = []
+        for src in sources:
+            print(sources[src])
+            calls.append(call(sources[src], None))
+
+        mockobj.assert_has_calls(calls, any_order=True)
 
         self.assertTrue(os.path.isfile(filename))
 
@@ -405,12 +412,15 @@ class TestAptSourceConfig(TestCase):
         cfg = {'key': "fakekey 4242",
                'filename': self.aptlistfile}
         cfg = self.wrapv1conf([cfg])
-
-        with mock.patch.object(subp, 'subp') as mockobj:
+        with mock.patch.object(cc_apt_configure, 'apt_key') as mockobj:
             cc_apt_configure.handle("test", cfg, self.fakecloud, None, None)
 
-        mockobj.assert_called_once_with(['apt-key', 'add', '-'],
-                                        data=b'fakekey 4242', target=None)
+        calls = (call(
+            'add',
+            output_file=pathlib.Path(self.aptlistfile).stem,
+            data='fakekey 4242',
+            hardened=False),)
+        mockobj.assert_has_calls(calls, any_order=True)
 
         # filename should be ignored on key only
         self.assertFalse(os.path.isfile(self.aptlistfile))
@@ -422,16 +432,26 @@ class TestAptSourceConfig(TestCase):
         cfg = self.wrapv1conf([cfg])
 
         with mock.patch.object(subp, 'subp',
-                               return_value=('fakekey 1212', '')) as mockobj:
-            cc_apt_configure.handle("test", cfg, self.fakecloud, None, None)
-
-        mockobj.assert_called_with(['apt-key', 'add', '-'],
-                                   data=b'fakekey 1212', target=None)
+                               return_value=('fakekey 1212', '')):
+            with mock.patch.object(cc_apt_configure, 'apt_key') as mockobj:
+                cc_apt_configure.handle(
+                    "test",
+                    cfg,
+                    self.fakecloud,
+                    None,
+                    None)
+
+        calls = (call(
+            'add',
+            output_file=pathlib.Path(self.aptlistfile).stem,
+            data='fakekey 1212',
+            hardened=False),)
+        mockobj.assert_has_calls(calls, any_order=True)
 
         # filename should be ignored on key only
         self.assertFalse(os.path.isfile(self.aptlistfile))
 
-    def apt_src_keyid_real(self, cfg, expectedkey):
+    def apt_src_keyid_real(self, cfg, expectedkey, is_hardened=None):
         """apt_src_keyid_real
         Test specification of a keyid without source including
         up to addition of the key (add_apt_key_raw mocked to keep the
@@ -446,9 +466,14 @@ class TestAptSourceConfig(TestCase):
                                    return_value=expectedkey) as mockgetkey:
                 cc_apt_configure.handle("test", cfg, self.fakecloud,
                                         None, None)
-
+        if is_hardened is not None:
+            mockkey.assert_called_with(
+                expectedkey,
+                self.aptlistfile,
+                hardened=is_hardened)
+        else:
+            mockkey.assert_called_with(expectedkey, self.aptlistfile)
         mockgetkey.assert_called_with(key, keyserver)
-        mockkey.assert_called_with(expectedkey, None)
 
         # filename should be ignored on key only
         self.assertFalse(os.path.isfile(self.aptlistfile))
@@ -459,7 +484,7 @@ class TestAptSourceConfig(TestCase):
         cfg = {'keyid': keyid,
                'filename': self.aptlistfile}
 
-        self.apt_src_keyid_real(cfg, EXPECTEDKEY)
+        self.apt_src_keyid_real(cfg, EXPECTEDKEY, is_hardened=False)
 
     def test_apt_src_longkeyid_real(self):
         """test_apt_src_longkeyid_real - Test long keyid including key add"""
@@ -467,7 +492,7 @@ class TestAptSourceConfig(TestCase):
         cfg = {'keyid': keyid,
                'filename': self.aptlistfile}
 
-        self.apt_src_keyid_real(cfg, EXPECTEDKEY)
+        self.apt_src_keyid_real(cfg, EXPECTEDKEY, is_hardened=False)
 
     def test_apt_src_longkeyid_ks_real(self):
         """test_apt_src_longkeyid_ks_real - Test long keyid from other ks"""
@@ -476,7 +501,7 @@ class TestAptSourceConfig(TestCase):
                'keyserver': 'keys.gnupg.net',
                'filename': self.aptlistfile}
 
-        self.apt_src_keyid_real(cfg, EXPECTEDKEY)
+        self.apt_src_keyid_real(cfg, EXPECTEDKEY, is_hardened=False)
 
     def test_apt_src_ppa(self):
         """Test adding a ppa"""
diff --git a/tests/unittests/test_handler/test_handler_apt_source_v3.py b/tests/unittests/test_handler/test_handler_apt_source_v3.py
index d4db610f..20289121 100644
--- a/tests/unittests/test_handler/test_handler_apt_source_v3.py
+++ b/tests/unittests/test_handler/test_handler_apt_source_v3.py
@@ -10,6 +10,7 @@ import re
 import shutil
 import socket
 import tempfile
+import pathlib
 
 from unittest import TestCase, mock
 from unittest.mock import call
@@ -214,22 +215,24 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
                self.aptlistfile3: {'source': 'deb $MIRROR $RELEASE universe'}}
         self._apt_src_replace_tri(cfg)
 
-    def _apt_src_keyid(self, filename, cfg, keynum):
+    def _apt_src_keyid(self, filename, cfg, keynum, is_hardened=None):
         """_apt_src_keyid
         Test specification of a source + keyid
         """
         params = self._get_default_params()
 
-        with mock.patch("cloudinit.subp.subp",
-                        return_value=('fakekey 1234', '')) as mockobj:
+        with mock.patch.object(cc_apt_configure, 'add_apt_key') as mockobj:
             self._add_apt_sources(cfg, TARGET, template_params=params,
                                   aa_repo_match=self.matcher)
 
-        # check if it added the right ammount of keys
+        # check if it added the right number of keys
         calls = []
-        for _ in range(keynum):
-            calls.append(call(['apt-key', 'add', '-'], data=b'fakekey 1234',
-                              target=TARGET))
+        for key in cfg:
+            if is_hardened is not None:
+                calls.append(call(cfg[key], hardened=is_hardened))
+            else:
+                calls.append(call(cfg[key], TARGET))
+
         mockobj.assert_has_calls(calls, any_order=True)
 
         self.assertTrue(os.path.isfile(filename))
@@ -248,6 +251,7 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
                                              'http://ppa.launchpad.net/'
                                              'smoser/cloud-init-test/ubuntu'
                                              ' xenial main'),
+                                  'filename': self.aptlistfile,
                                   'keyid': "03683F77"}}
         self._apt_src_keyid(self.aptlistfile, cfg, 1)
 
@@ -268,6 +272,7 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
                                               'http://ppa.launchpad.net/'
                                               'smoser/cloud-init-test/ubuntu'
                                               ' xenial multiverse'),
+                                   'filename': self.aptlistfile3,
                                    'keyid': "03683F77"}}
 
         self._apt_src_keyid(self.aptlistfile, cfg, 3)
@@ -293,15 +298,19 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
                                              'http://ppa.launchpad.net/'
                                              'smoser/cloud-init-test/ubuntu'
                                              ' xenial main'),
+                                  'filename': self.aptlistfile,
                                   'key': "fakekey 4321"}}
 
-        with mock.patch.object(subp, 'subp') as mockobj:
+        with mock.patch.object(cc_apt_configure, 'apt_key') as mockobj:
             self._add_apt_sources(cfg, TARGET, template_params=params,
                                   aa_repo_match=self.matcher)
 
-        mockobj.assert_any_call(['apt-key', 'add', '-'], data=b'fakekey 4321',
-                                target=TARGET)
-
+        calls = (call(
+            'add',
+            output_file=pathlib.Path(self.aptlistfile).stem,
+            data='fakekey 4321',
+            hardened=False),)
+        mockobj.assert_has_calls(calls, any_order=True)
         self.assertTrue(os.path.isfile(self.aptlistfile))
 
         contents = util.load_file(self.aptlistfile)
@@ -317,12 +326,16 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
         params = self._get_default_params()
         cfg = {self.aptlistfile: {'key': "fakekey 4242"}}
 
-        with mock.patch.object(subp, 'subp') as mockobj:
+        with mock.patch.object(cc_apt_configure, 'apt_key') as mockobj:
             self._add_apt_sources(cfg, TARGET, template_params=params,
                                   aa_repo_match=self.matcher)
 
-        mockobj.assert_any_call(['apt-key', 'add', '-'], data=b'fakekey 4242',
-                                target=TARGET)
+        calls = (call(
+            'add',
+            output_file=pathlib.Path(self.aptlistfile).stem,
+            data='fakekey 4242',
+            hardened=False),)
+        mockobj.assert_has_calls(calls, any_order=True)
 
         # filename should be ignored on key only
         self.assertFalse(os.path.isfile(self.aptlistfile))
@@ -331,19 +344,23 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
         """test_apt_v3_src_keyidonly - Test keyid without source"""
         params = self._get_default_params()
         cfg = {self.aptlistfile: {'keyid': "03683F77"}}
-
         with mock.patch.object(subp, 'subp',
-                               return_value=('fakekey 1212', '')) as mockobj:
-            self._add_apt_sources(cfg, TARGET, template_params=params,
-                                  aa_repo_match=self.matcher)
+                               return_value=('fakekey 1212', '')):
+            with mock.patch.object(cc_apt_configure, 'apt_key') as mockobj:
+                self._add_apt_sources(cfg, TARGET, template_params=params,
+                                      aa_repo_match=self.matcher)
 
-        mockobj.assert_any_call(['apt-key', 'add', '-'], data=b'fakekey 1212',
-                                target=TARGET)
+        calls = (call(
+            'add',
+            output_file=pathlib.Path(self.aptlistfile).stem,
+            data='fakekey 1212',
+            hardened=False),)
+        mockobj.assert_has_calls(calls, any_order=True)
 
         # filename should be ignored on key only
         self.assertFalse(os.path.isfile(self.aptlistfile))
 
-    def apt_src_keyid_real(self, cfg, expectedkey):
+    def apt_src_keyid_real(self, cfg, expectedkey, is_hardened=None):
         """apt_src_keyid_real
         Test specification of a keyid without source including
         up to addition of the key (add_apt_key_raw mocked to keep the
@@ -361,7 +378,11 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
         mockgetkey.assert_called_with(keycfg['keyid'],
                                       keycfg.get('keyserver',
                                                  'keyserver.ubuntu.com'))
-        mockkey.assert_called_with(expectedkey, TARGET)
+        if is_hardened is not None:
+            mockkey.assert_called_with(
+                expectedkey,
+                keycfg['keyfile'],
+                hardened=is_hardened)
 
         # filename should be ignored on key only
         self.assertFalse(os.path.isfile(self.aptlistfile))
@@ -369,21 +390,24 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
     def test_apt_v3_src_keyid_real(self):
         """test_apt_v3_src_keyid_real - Test keyid including key add"""
         keyid = "03683F77"
-        cfg = {self.aptlistfile: {'keyid': keyid}}
+        cfg = {self.aptlistfile: {'keyid': keyid,
+                                  'keyfile': self.aptlistfile}}
 
-        self.apt_src_keyid_real(cfg, EXPECTEDKEY)
+        self.apt_src_keyid_real(cfg, EXPECTEDKEY, is_hardened=False)
 
     def test_apt_v3_src_longkeyid_real(self):
         """test_apt_v3_src_longkeyid_real Test long keyid including key add"""
         keyid = "B59D 5F15 97A5 04B7 E230  6DCA 0620 BBCF 0368 3F77"
-        cfg = {self.aptlistfile: {'keyid': keyid}}
+        cfg = {self.aptlistfile: {'keyid': keyid,
+                                  'keyfile': self.aptlistfile}}
 
-        self.apt_src_keyid_real(cfg, EXPECTEDKEY)
+        self.apt_src_keyid_real(cfg, EXPECTEDKEY, is_hardened=False)
 
     def test_apt_v3_src_longkeyid_ks_real(self):
         """test_apt_v3_src_longkeyid_ks_real Test long keyid from other ks"""
         keyid = "B59D 5F15 97A5 04B7 E230  6DCA 0620 BBCF 0368 3F77"
         cfg = {self.aptlistfile: {'keyid': keyid,
+                                  'keyfile': self.aptlistfile,
                                   'keyserver': 'keys.gnupg.net'}}
 
         self.apt_src_keyid_real(cfg, EXPECTEDKEY)
@@ -393,6 +417,7 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
         keyid = "03683F77"
         params = self._get_default_params()
         cfg = {self.aptlistfile: {'keyid': keyid,
+                                  'keyfile': self.aptlistfile,
                                   'keyserver': 'test.random.com'}}
 
         # in some test environments only *.ubuntu.com is reachable
@@ -405,7 +430,7 @@ class TestAptSourceConfig(t_help.FilesystemMockingTestCase):
                                       aa_repo_match=self.matcher)
 
         mockgetkey.assert_called_with('03683F77', 'test.random.com')
-        mockadd.assert_called_with('fakekey', TARGET)
+        mockadd.assert_called_with('fakekey', self.aptlistfile, hardened=False)
 
         # filename should be ignored on key only
         self.assertFalse(os.path.isfile(self.aptlistfile))
@@ -1002,10 +1027,12 @@ deb http://ubuntu.com/ubuntu/ xenial-proposed main""")
             'primary': [
                 {'arches': [arch],
                  'uri': 'http://test.ubuntu.com/',
+                 'filename': 'primary',
                  'key': 'fakekey_primary'}],
             'security': [
                 {'arches': [arch],
                  'uri': 'http://testsec.ubuntu.com/',
+                 'filename': 'security',
                  'key': 'fakekey_security'}]
         }
 
@@ -1013,8 +1040,8 @@ deb http://ubuntu.com/ubuntu/ xenial-proposed main""")
                                'add_apt_key_raw') as mockadd:
             cc_apt_configure.add_mirror_keys(cfg, TARGET)
         calls = [
-            mock.call('fakekey_primary', TARGET),
-            mock.call('fakekey_security', TARGET),
+            mock.call('fakekey_primary', 'primary', hardened=False),
+            mock.call('fakekey_security', 'security', hardened=False),
         ]
         mockadd.assert_has_calls(calls, any_order=True)