如何在Packer模板中实现GPG密钥验证失败时终止构建

Packer的Shell Provisioner默认会检查每个命令的退出状态码，只要某个命令返回非零值，就会自动终止构建并抛出错误。不过为了让脚本的错误处理更可靠，我们可以通过两种方式确保GPG验证失败时立刻停止构建：

方式一：开启脚本错误自动退出 #

在脚本开头加入set -e，让bash在任何命令执行失败时立即终止脚本，Packer会检测到非零退出码并停止构建。修改后的模板片段如下：

"type": "shell",
"inline": [
  "set -e",
  "sudo wget https://694911143906-eu-west-1-guardduty-agent-rpm-artifacts.s3.amazonaws.com/1.0.0/x86_64/amazon-guardduty-agent-1.0.0.x86_64.rpm",
  "sudo wget https://694911143906-eu-west-1-guardduty-agent-rpm-artifacts.s3.amazonaws.com/1.0.0/x86_64/amazon-guardduty-agent-1.0.0.x86_64.sig",
  "sudo wget https://694911143906-eu-west-1-guardduty-agent-rpm-artifacts.s3.amazonaws.com/1.0.0/publickey.pem",
  "sudo gpg --import publickey.pem",
  "sudo gpg --verify amazon-guardduty-agent-1.0.0.x86_64.sig amazon-guardduty-agent-1.0.0.x86_64.rpm",
  "sudo rpm -ivh amazon-guardduty-agent-1.0.0.x86_64.rpm"
]

注：原脚本中第二个wget的URL存在错误（s3.aws.com应为s3.amazonaws.com），已在上述代码中修正。

方式二：显式检查GPG验证结果 #

如果需要自定义错误提示，可以在GPG验证命令后显式判断退出码，失败时输出提示并手动退出：

"type": "shell",
"inline": [
  "sudo wget https://694911143906-eu-west-1-guardduty-agent-rpm-artifacts.s3.amazonaws.com/1.0.0/x86_64/amazon-guardduty-agent-1.0.0.x86_64.rpm",
  "sudo wget https://694911143906-eu-west-1-guardduty-agent-rpm-artifacts.s3.amazonaws.com/1.0.0/x86_64/amazon-guardduty-agent-1.0.0.x86_64.sig",
  "sudo wget https://694911143906-eu-west-1-guardduty-agent-rpm-artifacts.s3.amazonaws.com/1.0.0/publickey.pem",
  "sudo gpg --import publickey.pem",
  "sudo gpg --verify amazon-guardduty-agent-1.0.0.x86_64.sig amazon-guardduty-agent-1.0.0.x86_64.rpm || { echo 'GPG验证失败，终止Packer构建'; exit 1; }",
  "sudo rpm -ivh amazon-guardduty-agent-1.0.0.x86_64.rpm"
]

两种方式都能实现需求，方式一的set -e更简洁，还能覆盖所有命令的失败场景，推荐使用。

内容的提问来源于stack exchange，提问作者user7692855