How to construct Vector's new Datakey deb signing key in Ansible

[artis3n]

I have an Ansible playbook where I was installing Vector through the original timber URLs:

- name: Packages | Vector | Ensure GPG Key
  become: true
  ansible.builtin.get_url:
    url: "https://repositories.timber.io/public/vector/gpg.3543DB2D0A2BC4B8.key"
    dest: "/usr/share/keyrings/timber-vector-archive-keyring.asc"
    mode: '0644'
    owner: root
  register: vector_gpg_key

- name: Packages | Vector | Add Repository
  become: true
  ansible.builtin.apt_repository:
    repo: "deb [signed-by={{ vector_gpg_key.dest }}] https://repositories.timber.io/public/vector/deb/ubuntu {{ ansible_distribution_release }} main"
    state: present
    filename: timber-vector
    mode: '0644'

but I have recently been getting an error that the timber URL no longer had a jammy Release file. I finally took a look and saw the migration notice that took effect back in February and that vector's new installation instructions are a curl | bash script and are now signed under Datadog's main keys. I was digging into https://s3.amazonaws.com/dd-agent/scripts/install_script_vector0.sh to update these Ansible tasks but I'm confused how the /usr/share/keyrings/datadog-archive-keyring.gpg file is getting built inside that script.

I expected something like this to work:

- name: Packages | Vector | Ensure Repo Signing Key
  become: true
  ansible.builtin.get_url:
    url: "https://keys.datadoghq.com/DATADOG_APT_KEY_CURRENT.public"
    dest: "/usr/share/keyrings/datadog-archive-keyring.gpg"
    mode: '0644'
    owner: root
  register: vector_gpg_key

- name: Packages | Vector | Add Repository
  become: true
  ansible.builtin.apt_repository:
    repo: "deb [signed-by={{ vector_gpg_key.dest }}] https://apt.vector.dev/ stable vector-{{ vector_major_version }}"
    state: present
    filename: vector
    mode: '0644'

but that's a PGP public key and running the install script inside a container shows the resulting /usr/share/keyrings/datadog-archive-keyring.gpg is binary. I ended up copying that binary file over and commenting out the get_url step of the Ansible script to get vector back up and running, but that's a temporary patch. What do I need to do instead to idempotently generate the correct /usr/share/keyrings/datadog-archive-keyring.gpg binary file? Running the installer script inside the Ansible playbook is not an option.

[artis3n]

Well I guess I did understand the script, I need to curl | gpg --batch each key into the keyring instead of a simple get_url. I'd love to keep this open if there is a consolidated way I could keep this existing construction, otherwise I'll ansible-ize the following commands:

curl https://keys.datadoghq.com/DATADOG_APT_KEY_CURRENT.public | sudo gpg --no-default-keyring --keyring /usr/share/keyrings/datadog-archive-keyring.gpg --import --batch
curl https://keys.datadoghq.com/DATADOG_APT_KEY_F14F620E.public | sudo gpg --no-default-keyring --keyring /usr/share/keyrings/datadog-archive-keyring.gpg --import --batch
curl https://keys.datadoghq.com/DATADOG_APT_KEY_C0962C7D.public | sudo gpg --no-default-keyring --keyring /usr/share/keyrings/datadog-archive-keyring.gpg --import --batch

[artis3n]

Man I was slow today. dest: "/usr/share/keyrings/datadog-archive-keyring.asc" works fine.