use pkg.add_repo_key and return unless

Change-Id: I111a584879c391cab41ca5579dfcad170a3248ad

.kitchen.yml

   log_level: error
   formula: linux
   grains:
-    noservices: true
+    noservices: True
+    kitchen-test: True
   state_top:
     base:
       "*":

linux/system/repo.sls

 {%- if repo.get('key') %} {# 2 #}
 
 linux_repo_{{ name }}_key:
+{% if grains['saltversioninfo'] < [2017, 7] %}
   cmd.run:
     - name: |
             echo "{{ repo.key | indent(12) }}" | apt-key add -
+    {%- if not grains.get('kitchen-test') %}
+    {# omitted from tests, as behaves inconsistently across CI/platforms #}
+    - unless: |
+            apt-key finger --with-colons | grep -qF $(echo "{{ repo.key| indent(12) }}" | gpg --with-fingerprint --with-colons | grep -E '^fpr')
+    {%- endif %}
+{%- else %}
+  module.run:
+    - name: pkg.add_repo_key
+    - text: |
+          {{ repo.key | indent(10) }}
+{%- endif %}
     - require_in:
     {%- if repo.get('default', False) %}
       - file: default_repo_list
 linux_repo_{{ name }}_key:
   cmd.run:
     - name: "curl -sL {{ repo.key_url }} | apt-key add -"
+    {%- if not grains.get('kitchen-test') %}
+    {# omitted from tests, as behaves inconsistently across CI/platforms #}
+    - unless: "apt-key finger --with-colons | grep -qF $(curl -sL {{ repo.key_url }} | gpg --with-fingerprint --with-colons | grep -E '^fpr')"
+    {%- endif %}
     - require_in:
     {%- if repo.get('default', False) %}
       - file: default_repo_list