curl need add -L param to install.sh when get gpg key

[Vanni-Fan]

in these pages:
https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh
https://docs.fluentbit.io/manual/installation/downloads/linux/debian
https://docs.fluentbit.io/manual/installation/downloads/linux/raspbian-raspberry-pi
https://docs.fluentbit.io/manual/installation/downloads/linux/ubuntu

the curl command will by add -L param to follow 30x location ,
because your https://packages.fluentbit.io/fluentbit.key will be location to https://s3.amazonaws.com/packages.fluentbit.io/fluentbit.key

[JamesParrott]

Thanks Vanni! I wondered why the official installation instructions didn't work. Adding -L helped me get the GPG key on Debian:

sudo sh -c 'curl -L https://packages.fluentbit.io/fluentbit.key | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpg'

[Vanni-Fan]

Thanks Vanni! I wondered why the official installation instructions didn't work. Adding -L helped me get the GPG key on Debian:

sudo sh -c 'curl -L https://packages.fluentbit.io/fluentbit.key | gpg --dearmor > /usr/share/keyrings/fluentbit-keyring.gpg'

The default behavior of curl does not follow 30x. ( but -L param will by follow 30x)
When https://packages.fluentbit.io/fluentbit.key location to https://s3.amazonaws.com/packages.fluentbit.io/fluentbit.key,
curl will obtain an empty content to gpg command.

like this: echo '' | gpg --dearmor, You will receive an error: "no valid OpenPGP data found."

[root@dev vanni]# echo '' | gpg --dearmor
gpg: no valid OpenPGP data found.

[patrick-stephens]

Resolved by #11137

[rafaelma]

This can be a security issue.

Not using -L guarantees that the gpg key has to be found in the address defined in the client repo.
Accepting a redirect when getting the repo gpg key does not guarantee that the client is talking with the correct/official repo.

Another important issue with redirects in repo addresses is that they break all system using a proxy to allow the access to the repo from internal infrastructures.