puppet: Add ksplice uptrack for kernel hotpatches.

scripts/lib/setup-apt-repo-ksplice

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -x
+set -e
+set -u
+set -o pipefail
+
+verify=false
+args="$(getopt -o '' --long verify -- "$@")"
+eval "set -- $args"
+while true; do
+    case "$1" in
+        --verify)
+            verify=true
+            shift
+            ;;
+        --)
+            shift
+            break
+            ;;
+    esac
+done
+
+# Ensure the directory for LAST_DEPENDENCIES_HASH exists
+mkdir -p /var/lib/zulip
+
+SOURCES_FILE=/etc/apt/sources.list.d/ksplice.list
+STAMP_FILE=/etc/apt/sources.list.d/ksplice.list.apt-update-in-progress
+
+ZULIP_SCRIPTS="$(dirname "$(dirname "$0")")"
+DEPENDENCIES_HASH=$(sha1sum "$ZULIP_SCRIPTS/setup/"*.asc "$0")
+DEPENDENCIES_HASH_FILE="/var/lib/zulip/setup-repositories-state-ksplice"
+# Ensure that DEPENDENCIES_HASH_FILE exists before hashing it.
+touch "$DEPENDENCIES_HASH_FILE"
+LAST_DEPENDENCIES_HASH="$(cat "$DEPENDENCIES_HASH_FILE")"
+
+# First, we only do anything in setup-apt-repo if any of its inputs
+# (apt keys, code, etc.)  changed.
+if [ "$DEPENDENCIES_HASH" = "$LAST_DEPENDENCIES_HASH" ]; then
+    exit 0
+elif [ "$verify" == true ]; then
+    exit 1
+fi
+
+# Ensure that the sources file exists
+touch "$SOURCES_FILE"
+
+# Hash it to check if the sources file is changed by the script later.
+zulip_source_hash=$(sha1sum "$SOURCES_FILE")
+
+pre_setup_deps=(lsb-release apt-transport-https ca-certificates gnupg wget)
+if ! apt-get -dy install "${pre_setup_deps[@]}"; then
+    apt-get update
+fi
+apt-get -y install "${pre_setup_deps[@]}"
+
+SCRIPTS_PATH="$(cd "$(dirname "$(dirname "$0")")" && pwd)"
+
+release=$(lsb_release -sc)
+if [[ "$release" =~ ^(buster|bionic|cosmic|disco|eoan|focal|groovy)$ ]]; then
+    apt-key add "$SCRIPTS_PATH"/setup/ksplice.asc
+    cat >$SOURCES_FILE <<EOF
+deb http://www.ksplice.com/apt $release ksplice
+deb-src http://www.ksplice.com/apt $release ksplice
+EOF
+else
+    echo "Unsupported release $release."
+    exit 1
+fi
+
+if [ "$zulip_source_hash" = "$(sha1sum "$SOURCES_FILE")" ] && ! [ -e "$STAMP_FILE" ]; then
+    echo "zulip.list file did not change; skipping apt-get update"
+else
+    # We create this stamp file to ensure `apt-get update` will be run
+    # the next time this script is invoked, and each time after, until
+    # `apt-get update` finishes successfully.
+    touch "$STAMP_FILE"
+    apt-get update && rm -f "$STAMP_FILE"
+fi
+
+echo "$DEPENDENCIES_HASH" >"$DEPENDENCIES_HASH_FILE"