From 9513b93a992470e21e387db1451fa4fd21ffc5d6 Mon Sep 17 00:00:00 2001 From: Mike Gabriel Date: Sun, 16 Sep 2018 22:55:58 +0200 Subject: modules/apt: Ship puppetlabs-apt module v4.5.1. --- .../production/modules/apt/CHANGELOG.md | 663 ++++++++++++++++ .../production/modules/apt/CONTRIBUTING.md | 271 +++++++ code/environments/production/modules/apt/Gemfile | 136 ++++ code/environments/production/modules/apt/LICENSE | 202 +++++ .../production/modules/apt/MAINTAINERS.md | 6 + code/environments/production/modules/apt/NOTICE | 37 + code/environments/production/modules/apt/README.md | 543 +++++++++++++ code/environments/production/modules/apt/Rakefile | 3 + .../production/modules/apt/checksums.json | 85 +++ .../production/modules/apt/examples/backports.pp | 11 + .../production/modules/apt/examples/builddep.pp | 3 + .../modules/apt/examples/debian_testing.pp | 18 + .../modules/apt/examples/debian_unstable.pp | 18 + .../modules/apt/examples/disable_keys.pp | 5 + .../modules/apt/examples/fancy_progress.pp | 4 + .../production/modules/apt/examples/force.pp | 28 + .../production/modules/apt/examples/hold.pp | 5 + .../production/modules/apt/examples/key.pp | 6 + .../production/modules/apt/examples/pin.pp | 5 + .../production/modules/apt/examples/ppa.pp | 4 + .../production/modules/apt/examples/release.pp | 4 + .../production/modules/apt/examples/source.pp | 35 + .../modules/apt/examples/unattended_upgrades.pp | 1 + .../modules/apt/lib/facter/apt_reboot_required.rb | 7 + .../apt/lib/facter/apt_update_last_success.rb | 16 + .../modules/apt/lib/facter/apt_updates.rb | 115 +++ .../apt/lib/puppet/provider/apt_key/apt_key.rb | 236 ++++++ .../modules/apt/lib/puppet/type/apt_key.rb | 134 ++++ .../production/modules/apt/locales/config.yaml | 26 + .../production/modules/apt/manifests/backports.pp | 60 ++ .../production/modules/apt/manifests/conf.pp | 22 + .../production/modules/apt/manifests/init.pp | 200 +++++ .../production/modules/apt/manifests/key.pp | 81 ++ .../production/modules/apt/manifests/params.pp | 126 ++++ .../production/modules/apt/manifests/pin.pp | 96 +++ .../production/modules/apt/manifests/ppa.pp | 68 ++ .../production/modules/apt/manifests/setting.pp | 57 ++ .../production/modules/apt/manifests/source.pp | 109 +++ .../production/modules/apt/manifests/update.pp | 65 ++ .../production/modules/apt/metadata.json | 41 + .../apt/spec/acceptance/apt_key_provider_spec.rb | 836 +++++++++++++++++++++ .../modules/apt/spec/acceptance/apt_spec.rb | 66 ++ .../modules/apt/spec/acceptance/class_spec.rb | 16 + .../modules/apt/spec/acceptance/init_task_spec.rb | 11 + .../apt/spec/acceptance/nodesets/centos-7-x64.yml | 10 + .../apt/spec/acceptance/nodesets/debian-8-x64.yml | 10 + .../apt/spec/acceptance/nodesets/default.yml | 10 + .../spec/acceptance/nodesets/docker/centos-7.yml | 12 + .../spec/acceptance/nodesets/docker/debian-8.yml | 11 + .../acceptance/nodesets/docker/ubuntu-14.04.yml | 12 + .../modules/apt/spec/classes/apt_backports_spec.rb | 253 +++++++ .../modules/apt/spec/classes/apt_spec.rb | 387 ++++++++++ .../modules/apt/spec/classes/apt_update_spec.rb | 152 ++++ .../modules/apt/spec/defines/conf_spec.rb | 90 +++ .../modules/apt/spec/defines/key_compat_spec.rb | 360 +++++++++ .../modules/apt/spec/defines/key_spec.rb | 367 +++++++++ .../modules/apt/spec/defines/pin_spec.rb | 148 ++++ .../modules/apt/spec/defines/ppa_spec.rb | 379 ++++++++++ .../modules/apt/spec/defines/setting_spec.rb | 145 ++++ .../modules/apt/spec/defines/source_compat_spec.rb | 154 ++++ .../modules/apt/spec/defines/source_spec.rb | 452 +++++++++++ .../production/modules/apt/spec/spec_helper.rb | 23 + .../modules/apt/spec/spec_helper_acceptance.rb | 90 +++ .../spec/unit/facter/apt_dist_has_updates_spec.rb | 40 + .../apt_dist_package_security_updates_spec.rb | 60 ++ .../unit/facter/apt_dist_package_updates_spec.rb | 35 + .../unit/facter/apt_dist_security_updates_spec.rb | 52 ++ .../apt/spec/unit/facter/apt_dist_updates_spec.rb | 31 + .../apt/spec/unit/facter/apt_has_updates_spec.rb | 38 + .../facter/apt_package_security_updates_spec.rb | 58 ++ .../spec/unit/facter/apt_package_updates_spec.rb | 33 + .../spec/unit/facter/apt_reboot_required_spec.rb | 25 + .../spec/unit/facter/apt_security_updates_spec.rb | 50 ++ .../unit/facter/apt_update_last_success_spec.rb | 25 + .../apt/spec/unit/facter/apt_updates_spec.rb | 30 + .../apt/spec/unit/puppet/type/apt_key_spec.rb | 212 ++++++ .../production/modules/apt/tasks/init.json | 10 + .../production/modules/apt/tasks/init.rb | 24 + .../modules/apt/templates/15update-stamp.epp | 1 + .../modules/apt/templates/_conf_header.epp | 1 + .../production/modules/apt/templates/_header.epp | 1 + .../production/modules/apt/templates/pin.pref.epp | 26 + .../production/modules/apt/templates/proxy.epp | 7 + .../modules/apt/templates/source.list.epp | 10 + 84 files changed, 8315 insertions(+) create mode 100644 code/environments/production/modules/apt/CHANGELOG.md create mode 100644 code/environments/production/modules/apt/CONTRIBUTING.md create mode 100644 code/environments/production/modules/apt/Gemfile create mode 100644 code/environments/production/modules/apt/LICENSE create mode 100644 code/environments/production/modules/apt/MAINTAINERS.md create mode 100644 code/environments/production/modules/apt/NOTICE create mode 100644 code/environments/production/modules/apt/README.md create mode 100644 code/environments/production/modules/apt/Rakefile create mode 100644 code/environments/production/modules/apt/checksums.json create mode 100644 code/environments/production/modules/apt/examples/backports.pp create mode 100644 code/environments/production/modules/apt/examples/builddep.pp create mode 100644 code/environments/production/modules/apt/examples/debian_testing.pp create mode 100644 code/environments/production/modules/apt/examples/debian_unstable.pp create mode 100644 code/environments/production/modules/apt/examples/disable_keys.pp create mode 100644 code/environments/production/modules/apt/examples/fancy_progress.pp create mode 100644 code/environments/production/modules/apt/examples/force.pp create mode 100644 code/environments/production/modules/apt/examples/hold.pp create mode 100644 code/environments/production/modules/apt/examples/key.pp create mode 100644 code/environments/production/modules/apt/examples/pin.pp create mode 100644 code/environments/production/modules/apt/examples/ppa.pp create mode 100644 code/environments/production/modules/apt/examples/release.pp create mode 100644 code/environments/production/modules/apt/examples/source.pp create mode 100644 code/environments/production/modules/apt/examples/unattended_upgrades.pp create mode 100644 code/environments/production/modules/apt/lib/facter/apt_reboot_required.rb create mode 100644 code/environments/production/modules/apt/lib/facter/apt_update_last_success.rb create mode 100644 code/environments/production/modules/apt/lib/facter/apt_updates.rb create mode 100644 code/environments/production/modules/apt/lib/puppet/provider/apt_key/apt_key.rb create mode 100644 code/environments/production/modules/apt/lib/puppet/type/apt_key.rb create mode 100644 code/environments/production/modules/apt/locales/config.yaml create mode 100644 code/environments/production/modules/apt/manifests/backports.pp create mode 100644 code/environments/production/modules/apt/manifests/conf.pp create mode 100644 code/environments/production/modules/apt/manifests/init.pp create mode 100644 code/environments/production/modules/apt/manifests/key.pp create mode 100644 code/environments/production/modules/apt/manifests/params.pp create mode 100644 code/environments/production/modules/apt/manifests/pin.pp create mode 100644 code/environments/production/modules/apt/manifests/ppa.pp create mode 100644 code/environments/production/modules/apt/manifests/setting.pp create mode 100644 code/environments/production/modules/apt/manifests/source.pp create mode 100644 code/environments/production/modules/apt/manifests/update.pp create mode 100644 code/environments/production/modules/apt/metadata.json create mode 100644 code/environments/production/modules/apt/spec/acceptance/apt_key_provider_spec.rb create mode 100644 code/environments/production/modules/apt/spec/acceptance/apt_spec.rb create mode 100644 code/environments/production/modules/apt/spec/acceptance/class_spec.rb create mode 100644 code/environments/production/modules/apt/spec/acceptance/init_task_spec.rb create mode 100644 code/environments/production/modules/apt/spec/acceptance/nodesets/centos-7-x64.yml create mode 100644 code/environments/production/modules/apt/spec/acceptance/nodesets/debian-8-x64.yml create mode 100644 code/environments/production/modules/apt/spec/acceptance/nodesets/default.yml create mode 100644 code/environments/production/modules/apt/spec/acceptance/nodesets/docker/centos-7.yml create mode 100644 code/environments/production/modules/apt/spec/acceptance/nodesets/docker/debian-8.yml create mode 100644 code/environments/production/modules/apt/spec/acceptance/nodesets/docker/ubuntu-14.04.yml create mode 100644 code/environments/production/modules/apt/spec/classes/apt_backports_spec.rb create mode 100644 code/environments/production/modules/apt/spec/classes/apt_spec.rb create mode 100644 code/environments/production/modules/apt/spec/classes/apt_update_spec.rb create mode 100644 code/environments/production/modules/apt/spec/defines/conf_spec.rb create mode 100644 code/environments/production/modules/apt/spec/defines/key_compat_spec.rb create mode 100644 code/environments/production/modules/apt/spec/defines/key_spec.rb create mode 100644 code/environments/production/modules/apt/spec/defines/pin_spec.rb create mode 100644 code/environments/production/modules/apt/spec/defines/ppa_spec.rb create mode 100644 code/environments/production/modules/apt/spec/defines/setting_spec.rb create mode 100644 code/environments/production/modules/apt/spec/defines/source_compat_spec.rb create mode 100644 code/environments/production/modules/apt/spec/defines/source_spec.rb create mode 100644 code/environments/production/modules/apt/spec/spec_helper.rb create mode 100644 code/environments/production/modules/apt/spec/spec_helper_acceptance.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_dist_has_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_dist_package_security_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_dist_package_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_dist_security_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_dist_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_has_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_package_security_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_package_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_reboot_required_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_security_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_update_last_success_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/facter/apt_updates_spec.rb create mode 100644 code/environments/production/modules/apt/spec/unit/puppet/type/apt_key_spec.rb create mode 100644 code/environments/production/modules/apt/tasks/init.json create mode 100755 code/environments/production/modules/apt/tasks/init.rb create mode 100644 code/environments/production/modules/apt/templates/15update-stamp.epp create mode 100644 code/environments/production/modules/apt/templates/_conf_header.epp create mode 100644 code/environments/production/modules/apt/templates/_header.epp create mode 100644 code/environments/production/modules/apt/templates/pin.pref.epp create mode 100644 code/environments/production/modules/apt/templates/proxy.epp create mode 100644 code/environments/production/modules/apt/templates/source.list.epp diff --git a/code/environments/production/modules/apt/CHANGELOG.md b/code/environments/production/modules/apt/CHANGELOG.md new file mode 100644 index 0000000..cc0169f --- /dev/null +++ b/code/environments/production/modules/apt/CHANGELOG.md @@ -0,0 +1,663 @@ +# Changelog + +All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) +and this project adheres to [Semantic Versioning](http://semver.org). + +## Supported Release [4.5.1] +### Summary +This release fixes CVE-2018-6508 which is a potential arbitrary code execution via tasks. + +### Fixed +- Fix init task for arbitrary remote code + +## Supported Release [4.5.0] +### Summary +This release uses the PDK convert functionality which in return makes the module PDK compliant. It also includes a roll up of maintenance changes. + +### Added +- PDK convert apt ([MODULES-6452](https://tickets.puppet.com/browse/MODULES-6452)). +- Testing on Travis using rvm 2.4.1. +- Modulesync updates. + +### Fixed +- Changes to address additional Rubocop failures. +- (maint) Addressing puppet-lint doc warnings. + +### Removed +- `gem update bundler` command in .travis.yml due to ([MODULES-6339](https://tickets.puppet.com/browse/MODULES-6339)). + +## Supported Release [4.4.1] +### Summary +This release is to update the formatting of the module, Rubocop having been run for all ruby files and been set to run automatically on all future commits. + +### Changed +- Rubocop has been implemented. + +## Supported Release [4.4.0] +### Summary + +This release is a rollup of new features and fixes. + +#### Added +- Install `apt-transport-https` if using Debian 7, 8, 9 or Ubuntu 14.04, 16.04. +- Adds a boolean option `direct` to proxy settings to bypass `https_proxy` if not set. +- Adds facter facts for `dist-upgrade` apt updates. + +#### Changed +- Update class is now private. +- Some tidyup of ruby code from Rubocop. +- Fixed circular dependency for package dirmngr. +- Debian updates are no longer treated as security updates. +- Legacy functions have been removed. +- Updates to tests. + +#### Fixed +- [(MODULES-4265)](https://tickets.puppetlabs.com/browse/MODULES-4265) Detect security updates from multiple sources. + +## Supported Release [4.3.0] +### Summary + +This release is adding Tasks to the apt module. + +#### Added +- Add a task that allows apt-get update and upgrade + +## Supported Release [4.2.0] +### Summary + +This release is primarily to fix an error around GPG keys in Debian 9, but includes some other small features and fixes as well. + +#### Added +- `apt_package_security_updates` fact +- The ability to modify the loglevel of `Exec['apt_update'}` +- Puppet 5 support + +#### Changed +- Ubuntu 16.04 now uses `software-priorities-common` + +#### Removed +- Debian 6, Ubuntu 10.04 and 12.04 support. Existing compatibility remains intact but bugs will not be prioritized for these OSes. + +#### Fixed +- **[(MODULES-4686)](https://tickets.puppetlabs.com/browse/MODULES-4686) an error that was causing GPG keyserver imports to fail on Debian 9** + +## Supported Release 4.1.0 +### Summary + +This release removes Data in Modules due to current compatibility issues and reinstates the params.pp file. Also includes a couple of bug fixes. + +#### Features +- (MODULES-4973) Data in Modules which was introduced in the last release has now been reverted due to compatibility issues. + +#### Bugfixes +- Now apt_key only sends the auth basic header when userinfo can be parsed from the URL. +- Reverted the removal of Evolving Web's attribution in NOTICE file. +- Test added to ensure empty string allowed for $release in apt::source. + + +## Supported Release 3.0.0 and 4.0.0 +### Summary + +This release adds new Puppet 4 features: data in modules, EPP templates, the $facts hash, and data types. This release is fully backwards compatible to existing Puppet 4 configurations and provides you with deprecation warnings for every argument that will not work as expected with the final 4.0.0 release. See the stdlib docs here for an in-depth discussion of this: https://github.com/puppetlabs/puppetlabs-stdlib#validate_legacy + +If you want to learn more about the new features used or you wish to upgrade a module yourself, have a look at the NTP: A Puppet 4 language update blog post. + +If you're still running Puppet 3, remain on the latest puppetlabs-apt 2.x release for now, and see the documentation to upgrade to Puppet 4. + +#### Changes + +Data in modules: Moves all distribution and OS-dependent defaults into YAML files in data/, alleviating the need for a params class. Note that while this feature is currently still classed as experimental, the final implementation will support the changes here. +EPP templating: Uses the Puppet language as a base for templates to create simpler and safer templates. No need for Ruby anymore! +The $facts hash: Makes facts visibly distinct from other variables for more readable and maintainable code. This helps eliminate confusion if you use a local variable whose name happens to match that of a common fact. +Data types for validation: Helps you find and replace deprecated code in existing validate functions with stricter, more readable data type notation. First upgrade to the 3.0.0 release of this module, and address all deprecation warnings before upgrading to the final 4.0.0 release. Please see the stdlib docs for an in-depth discussion of this process. + +#### Bugfixes +- Fix apt::source epp template regression introduced in 3.0.0 for the architecture parameter + +## Supported Release 2.4.0 +### Summary +A release that includes only a couple of additional features, but includes several cleanups and bugfixes around existing issues. + +#### Features +- Tests updated to check for idempotency. +- (MODULES-4224) Implementation of beaker-module_install_helper. +- Deprecation warnings are now handled by the deprecation function in stdlib. + +#### Bugfixes +- Now http and https sources fixed for apt_key and can take a userinfo. +- GPG key update. +- Notify_update param now defaults to true to avoid validation errors. +- Implement retry on tests which pull key from a key server which sometimes times out (transient error). +- String comparison error now comphensated for in update.pp. +- (MODULES-4104) Removal of the port number from repository location in order to get the host name of the repository. +- Puppet lint warnings addressed. +- A few small readme issues addressed. + +## Supported Release 2.3.0 +### Summary +A release containing many bugfixes with additional features. + +#### Features +- Apt_updates facts now use /usr/bin/apt-get. +- Addition of notify update to apt::source. +- Update to newest modulesync_configs. +- Installs software-properties-common for Xenial. +- Modulesync updates. +- Add ability to specify a hash of apt::conf defines. + +#### Bugfixes +- A clean up of spec/defines/key_compat_specs, also now runs under STRICT_VARIABLES. +- Apt::setting expects priority to be an integer, set defaults accordingly. +- Fixed version check for Ubuntu on 16.04. +- Now uses hkps.pool.sks-keyservers.net instead of pgp.mit.edu. +- Updates and fixes to tests. General cleanup. +- Fixed regexp for $ensure params. +- Apt/params: Remove unused LSB facts. +- Replaced `-s` with `-f` in ppa rspec tests - After the repository is added, the "${::apt::sources_list_d}/${sources_list_d_filename}" file is created as an empty file. The unless condition of Exec["add-apt-repository-${name}"] calls test -s, which returns 1 if the file is empty. Because the file is empty, the unless condition is never true and the repository is added on every execution. This change replaces the -s test condition with -f, which is true if the file exists or false otherwise. +- Limit non-strict parsing to pre-3.5.0 only - Puppet 3.5.0 introduced strict variables and the module handles strict variables by using the defined() function. This does not work on prior versions of puppet so we now gate based on that version. Puppet 4 series has a new setting `strict` that may be set to enforce strict variables while `strict_variables` remains unset (see PUP-6358) which causes the conditional in manifests/params.pp to erroniously use non-strict 3.5-era parsing and fail. This new conditional corrects the cases such that strict variable behavior happens on versions 3.5.0 and later. + +## Supported Release 2.2.2 +### Summary + +Several bug fixes and the addition of support updates to Debian 8 and Ubuntu Wily. + +#### Bugfixes +- Small fixes to descriptions within the readme and the addition of some examples. +- Updates to run on Ubuntu Wily. +- Fixed apt_key tempfile race condition. +- Run stages limitation added to the documentation. +- Remove unneeded whitespace in source.list template. +- Handle PPA names that contain a plus character. +- Update to current msync configs. +- Avoid duplicate package resources when package_manage => true. +- Avoid multiple package resource declarations. +- Ensure PPAs in tests have valid form. +- Look for correct sources.list.d file for apt::ppa. +- Debian 8 support addiiton to metadata. + +## Supported Release 2.2.1 +### Summary + +Small release for support of newer PE versions. This increments the version of PE in the metadata.json file. + +## 2015-09-29 - Supported Release 2.2.0 +### Summary + +This release includes a few bugfixes. + +#### Features +- Adds an `ensure` parameter for user control of proxy presence. +- Adds ability to set `notify_update` to `apt::conf` (MODULES-2269). +- Apt pins no longer trigger an `apt-get update` run. +- Adds support for creating pins from main class. + +#### Bugfixes +- Updates to use the official Debian mirrors. +- Fixes path to `preferences` and `preferences.d` +- Fixes pinning for backports (MODULES-2446). +- Fixes the name/extension of the preferences files. + +## 2015-07-28 - Supported Release 2.1.1 +### Summary + +This release includes a few bugfixes. + +#### Bugfixes +- Fix incorrect use of anchoring (MODULES-2190) +- Use correct comment type for apt.conf files +- Test fixes +- Documentation fixes + +## 2015-06-16 - Supported Release 2.1.0 +### Summary + +This release largely makes `apt::key` and `apt::source` API-compatible with the 1.8.x versions for ease in upgrading, and also addresses some compatibility issues with older versions of Puppet. + +#### Features +- Add API compatibility to `apt::key` and `apt::source` +- Added `apt_reboot_required` fact + +#### Bugfixes +- Fix compatibility with Puppet versions 3.0-3.4 +- Work around future parser bug PUP-4133 + +## 2015-04-28 - Supported Release 2.0.1 +### Summary + +This bug fixes a few compatibility issues that came up with the 2.0.0 release, and includes test and documentation updates. + +#### Bugfixes +- Fix incompatibility with keyrings containing multiple keys +- Fix bugs preventing the module from working with Puppet < 3.5.0 + +## 2015-04-07 - Supported Release 2.0.0 +### Summary + +This is a major rewrite of the apt module. Many classes and defines were removed, but all existing functionality should still work. Please carefully review documentation before upgrading. + +#### Backwards-incompatible changes + +As this is a major rewrite of the module there are a great number of backwards incompatible changes. Please review this and the updated README carefully before upgrading. + +##### `apt_key` +- `keyserver_options` parameter renamed to `options` + +##### `apt::backports` +- This no longer works out of the box on Linux Mint. If using this on mint, you must specify the `location`, `release`, `repos`, and `key` parameters. [Example](examples/backports.pp) + +##### `apt::builddep` +- This define was removed. Functionality can be matched passing 'build-dep' to `install_options` in the package resource. [Example](examples/builddep.pp) + +##### `apt::debian::testing` +- This class was removed. Manually add an `apt::source` instead. [Example](examples/debian_testing.pp) + +##### `apt::debian::unstable` +- This class was removed. Manually add an `apt::source` instead. [Example](examples/debian_unstable.pp) + +##### `apt::force` +- This define was removed. Functionallity can be matched by setting `install_options` in the package resource. See [here](examples/force.pp) for how to set the options. + +##### `apt::hold` +- This define was removed. Simply use an `apt::pin` with `priority => 1001` for the same functionality. + +##### `apt` +- `always_apt_update` - This parameter was removed. Use `update => { 'frequency' => 'always' }` instead. +- `apt_update_frequency` - This parameter was removed. Use `update => { 'frequency' => }` instead. +- `disable_keys` - This parameter was removed. See this [example](examples/disable_keys.pp) if you need this functionality. +- `proxy_host` - This parameter was removed. Use `proxy => { 'host' => }` instead. +- `proxy_port` - This parameter was removed. Use `proxy => { 'port' => }` instead. +- `purge_sources_list` - This parameter was removed. Use `purge => { 'sources.list' => }` instead. +- `purge_sources_list_d` - This parameter was removed. Use `purge => { 'sources.list.d' => }` instead. +- `purge_preferences` - This parameter was removed. Use `purge => { 'preferences' => }` instead. +- `purge_preferences_d` - This parameter was removed. Use `purge => { 'preferences.d' => }` instead. +- `update_timeout` - This parameter was removed. Use `update => { 'timeout' => }` instead. +- `update_tries` - This parameter was removed. Use `update => { 'tries' => }` instead. + +##### `apt::key` +- `key` - This parameter was renamed to `id`. +- `key_content` - This parameter was renamed to `content`. +- `key_source` - This parameter was renamed to `source`. +- `key_server` - This parameter was renamed to `server`. +- `key_options` - This parameter was renamed to `options`. + +##### `apt::release` +- This class was removed. See this [example](examples/release.pp) for how to achieve this functionality. + +##### `apt::source` +- `include_src` - This parameter was removed. Use `include => { 'src' => }` instead. ***NOTE*** This now defaults to false. +- `include_deb` - This parameter was removed. Use `include => { 'deb' => }` instead. +- `required_packages` - This parameter was removed. Use package resources for these packages if needed. +- `key` - This can either be a key id or a hash including key options. If using a hash, `key => { 'id' => }` must be specified. +- `key_server` - This parameter was removed. Use `key => { 'server' => }` instead. +- `key_content` - This parameter was removed. Use `key => { 'content' => }` instead. +- `key_source` - This parameter was removed. Use `key => { 'source' => }` instead. +- `trusted_source` - This parameter was renamed to `allow_unsigned`. + +##### `apt::unattended_upgrades` +- This class was removed and is being republished under the puppet-community namespace. The git repository is available [here](https://github.com/puppet-community/puppet-unattended_upgrades) and it will be published to the forge [here](https://forge.puppetlabs.com/puppet/unattended_upgrades). + +#### Changes to default behavior +- By default purge unmanaged files in 'sources.list', 'sources.list.d', 'preferences', and 'preferences.d'. +- Changed default for `package_manage` in `apt::ppa` to `false`. Set to `true` in a single PPA if you need the package to be managed. +- `apt::source` will no longer include the `src` entries by default. +- `pin` in `apt::source` now defaults to `undef` instead of `false` + +#### Features +- Added the ability to pass hashes of `apt::key`s, `apt::ppa`s, and `apt::setting`s to `apt`. +- Added 'https' key to `proxy` hash to allow disabling `https_proxy` for the `apt::ppa` environment. +- Added `apt::setting` define to abstract away configuration. +- Added the ability to pass hashes to `pin` and `key` in `apt::backports` and `apt::source`. + +#### Bugfixes +- Fixes for strict variables. + +## 2015-03-17 - Supported Release 1.8.0 +### Summary + +This is the last planned feature release of the 1.x series of this module. All new features will be evaluated for puppetlabs-apt 2.x. + +This release includes many important features, including support for full fingerprints, and fixes issues where `apt_key` was not supporting user/password and `apt_has_updates` was not properly parsing the `apt-check` output. + +#### Changes to default behavior +- The apt module will now throw warnings if you don't use full fingerprints for `apt_key`s + +#### Features +- Use gpg to check keys to work around https://bugs.launchpad.net/ubuntu/+source/gnupg2/+bug/1409117 (MODULES-1675) +- Add 'oldstable' to the default update origins for wheezy +- Add utopic, vivid, and cumulus compatibility +- Add support for full fingerprints +- New parameter for `apt::source` + - `trusted_source` +- New parameters for `apt::ppa` + - `package_name` + - `package_manage` +- New parameter for `apt::unattended_upgrades` + - `legacy_origin` +- Separate `apt::pin` from `apt::backports` to allow pin by release instead of origin + +#### Bugfixes +- Cleanup lint and future parser issues +- Fix to support username and passwords again for `apt_key` (MODULES-1119) +- Fix issue where `apt::force` `$install_check` didn't work with non-English locales (MODULES-1231) +- Allow 5 digit ports in `apt_key` +- Fix for `ensure => absent` in `apt_key` (MODULES-1661) +- Fix `apt_has_updates` not parsing `apt-check` output correctly +- Fix inconsistent headers across files (MODULES-1200) +- Clean up formatting for 50unattended-upgrades.erb + +## 2014-10-28 - Supported Release 1.7.0 +### Summary + +This release includes several new features, documentation and test improvements, and a few bug fixes. + +#### Features +- Updated unit and acceptance tests +- Update module to work with Linux Mint +- Documentation updates +- Future parser / strict variables support +- Improved support for long GPG keys +- New parameters! + - Added `apt_update_frequency` to apt + - Added `cfg_files` and `cfg_missing` parameters to apt::force + - Added `randomsleep` to apt::unattended_upgrades +- Added `apt_update_last_success` fact +- Refactored facts for performance improvements + +#### Bugfixes +- Update apt::builddep to require Exec['apt_update'] instead of notifying it +- Clean up lint errors + +## 2014-08-20 - Supported Release 1.6.0 +### Summary + +#### Features +- Allow URL or domain name for key_server parameter +- Allow custom comment for sources list +- Enable auto-update for Debian squeeze LTS +- Add facts showing available updates +- Test refactoring + +#### Bugfixes +- Allow dashes in URL or domain for key_server parameter + +## 2014-08-13 - Supported Release 1.5.3 +### Summary + +This is a bugfix releases. It addresses a bad regex, failures with unicode +characters, and issues with the $proxy_host handling in apt::ppa. + +#### Features +- Synced files from Modulesync + +#### Bugfixes +- Fix regex to follow APT requirements in apt::pin +- Fix for unicode characters +- Fix inconsistent $proxy_host handling in apt and apt::ppa +- Fix typo in README +- Fix broken acceptance tests + +## 2014-07-15 - Supported Release 1.5.2 +### Summary + +This release merely updates metadata.json so the module can be uninstalled and +upgraded via the puppet module command. + +## 2014-07-10 - Supported Release 1.5.1 +### Summary + +This release has added tests to ensure graceful failure on OSX. + +## 2014-06-04 - Release 1.5.0 +### Summary + +This release adds support for Ubuntu 14.04. It also includes many new features +and important bugfixes. One huge change is that apt::key was replaced with +apt_key, which allows you to use puppet resource apt_key to inventory keys on +your system. + +Special thanks to daenney, our intrepid unofficial apt maintainer! + +#### Features +- Add support for Ubuntu Trusty! +- Add apt::hold define +- Generate valid *.pref files in apt::pin +- Made pin_priority configurable for apt::backports +- Add apt_key type and provider +- Rename "${apt_conf_d}/proxy" to "${apt_conf_d}/01proxy" +- apt::key rewritten to use apt_key type +- Add support for update_tries to apt::update + +#### Bugfixes +- Typo fixes +- Fix unattended upgrades +- Removed bogus line when using purge_preferences +- Fix apt::force to upgrade allow packages to be upgraded to the pacakge from the specified release + +## 2014-03-04 - Supported Release 1.4.2 +### Summary + +This is a supported release. This release tidies up 1.4.1 and re-enables +support for Ubuntu 10.04 + +#### Features + +#### Bugfixes +- Fix apt:ppa to include the -y Ubuntu 10.04 requires. +- Documentation changes. +- Test fixups. + +#### Known Bugs + +* No known issues. + + + +## 2014-02-13 1.4.1 +### Summary +This is a bugfix release. + +#### Bugfixes +- Fix apt::force unable to upgrade packages from releases other than its original +- Removed a few refeneces to aptitude instead of apt-get for portability +- Removed call to getparam() due to stdlib dependency +- Correct apt::source template when architecture is provided +- Retry package installs if apt is locked +- Use root to exec in apt::ppa +- Updated tests and converted acceptance tests to beaker + +## 2013-10-08 - Release 1.4.0 + +### Summary + +Minor bugfix and allow the timeout to be adjusted. + +#### Features +- Add an `updates_timeout` to apt::params + +#### Bugfixes +- Ensure apt::ppa can read a ppa removed by hand. + + +## 2013-10-08 - Release 1.3.0 +### Summary + +This major feature in this release is the new apt::unattended_upgrades class, +allowing you to handle Ubuntu's unattended feature. This allows you to select +specific packages to automatically upgrade without any further user +involvement. + +In addition we extend our Wheezy support, add proxy support to apt:ppa and do +various cleanups and tweaks. + +#### Features +- Add apt::unattended_upgrades support for Ubuntu. +- Add wheezy backports support. +- Use the geoDNS http.debian.net instead of the main debian ftp server. +- Add `options` parameter to apt::ppa in order to pass options to apt-add-repository command. +- Add proxy support for apt::ppa (uses proxy_host and proxy_port from apt). + +#### Bugfixes +- Fix regsubst() calls to quote single letters (for future parser). +- Fix lint warnings and other misc cleanup. + + +## 2013-07-03 - Release 1.2.0 + +#### Features +- Add geppetto `.project` natures +- Add GH auto-release +- Add `apt::key::key_options` parameter +- Add complex pin support using distribution properties for `apt::pin` via new properties: + - `apt::pin::codename` + - `apt::pin::release_version` + - `apt::pin::component` + - `apt::pin::originator` + - `apt::pin::label` +- Add source architecture support to `apt::source::architecture` + +#### Bugfixes +- Use apt-get instead of aptitude in apt::force +- Update default backports location +- Add dependency for required packages before apt-get update + + +## 2013-06-02 - Release 1.1.1 +### Summary + +This is a bug fix release that resolves a number of issues: + +* By changing template variable usage, we remove the deprecation warnings + for Puppet 3.2.x +* Fixed proxy file removal, when proxy absent + +Some documentation, style and whitespaces changes were also merged. This +release also introduced proper rspec-puppet unit testing on Travis-CI to help +reduce regression. + +Thanks to all the community contributors below that made this patch possible. + +#### Detail Changes + +* fix minor comment type (Chris Rutter) +* whitespace fixes (Michael Moll) +* Update travis config file (William Van Hevelingen) +* Build all branches on travis (William Van Hevelingen) +* Standardize travis.yml on pattern introduced in stdlib (William Van Hevelingen) +* Updated content to conform to README best practices template (Lauren Rother) +* Fix apt::release example in readme (Brian Galey) +* add @ to variables in template (Peter Hoeg) +* Remove deprecation warnings for pin.pref.erb as well (Ken Barber) +* Update travis.yml to latest versions of puppet (Ken Barber) +* Fix proxy file removal (Scott Barber) +* Add spec test for removing proxy configuration (Dean Reilly) +* Fix apt::key listing longer than 8 chars (Benjamin Knofe) + + + + +## Release 1.1.0 +### Summary + +This release includes Ubuntu 12.10 (Quantal) support for PPAs. + +--- + +## 2012-05-25 - Puppet Labs - Release 0.0.4 +### Summary + + * Fix ppa list filename when there is a period in the PPA name + * Add .pref extension to apt preferences files + * Allow preferences to be purged + * Extend pin support + + +## 2012-05-04 - Puppet Labs - Release 0.0.3 +### Summary + + * only invoke apt-get update once + * only install python-software-properties if a ppa is added + * support 'ensure => absent' for all defined types + * add apt::conf + * add apt::backports + * fixed Modulefile for module tool dependency resolution + * configure proxy before doing apt-get update + * use apt-get update instead of aptitude for apt::ppa + * add support to pin release + + +## 2012-03-26 - Puppet Labs - Release 0.0.2 +### Summary + +* 41cedbb (#13261) Add real examples to smoke tests. +* d159a78 (#13261) Add key.pp smoke test +* 7116c7a (#13261) Replace foo source with puppetlabs source +* 1ead0bf Ignore pkg directory. +* 9c13872 (#13289) Fix some more style violations +* 0ea4ffa (#13289) Change test scaffolding to use a module & manifest dir fixture path +* a758247 (#13289) Clean up style violations and fix corresponding tests +* 99c3fd3 (#13289) Add puppet lint tests to Rakefile +* 5148cbf (#13125) Apt keys should be case insensitive +* b9607a4 Convert apt::key to use anchors + + +## 2012-03-07 - Puppet Labs - Release 0.0.1 +### Summary + +* d4fec56 Modify apt::source release parameter test +* 1132a07 (#12917) Add contributors to README +* 8cdaf85 (#12823) Add apt::key defined type and modify apt::source to use it +* 7c0d10b (#12809) $release should use $lsbdistcodename and fall back to manual input +* be2cc3e (#12522) Adjust spec test for splitting purge +* 7dc60ae (#12522) Split purge option to spare sources.list +* 9059c4e Fix source specs to test all key permutations +* 8acb202 Add test for python-software-properties package +* a4af11f Check if python-software-properties is defined before attempting to define it. +* 1dcbf3d Add tests for required_packages change +* f3735d2 Allow duplicate $required_packages +* 74c8371 (#12430) Add tests for changes to apt module +* 97ebb2d Test two sources with the same key +* 1160bcd (#12526) Add ability to reverse apt { disable_keys => true } +* 2842d73 Add Modulefile to puppet-apt +* c657742 Allow the use of the same key in multiple sources +* 8c27963 (#12522) Adding purge option to apt class +* 997c9fd (#12529) Add unit test for apt proxy settings +* 50f3cca (#12529) Add parameter to support setting a proxy for apt +* d522877 (#12094) Replace chained .with_* with a hash +* 8cf1bd0 (#12094) Remove deprecated spec.opts file +* 2d688f4 (#12094) Add rspec-puppet tests for apt +* 0fb5f78 (#12094) Replace name with path in file resources +* f759bc0 (#11953) Apt::force passes $version to aptitude +* f71db53 (#11413) Add spec test for apt::force to verify changes to unless +* 2f5d317 (#11413) Update dpkg query used by apt::force +* cf6caa1 (#10451) Add test coverage to apt::ppa +* 0dd697d include_src parameter in example; Whitespace cleanup +* b662eb8 fix typos in "repositories" +* 1be7457 Fix (#10451) - apt::ppa fails to "apt-get update" when new PPA source is added +* 864302a Set the pin priority before adding the source (Fix #10449) +* 1de4e0a Refactored as per mlitteken +* 1af9a13 Added some crazy bash madness to check if the ppa is installed already. Otherwise the manifest tries to add it on every run! +* 52ca73e (#8720) Replace Apt::Ppa with Apt::Builddep +* 5c05fa0 added builddep command. +* a11af50 added the ability to specify the content of a key +* c42db0f Fixes ppa test. +* 77d2b0d reformatted whitespace to match recommended style of 2 space indentation. +* 27ebdfc ignore swap files. +* 377d58a added smoke tests for module. +* 18f614b reformatted apt::ppa according to recommended style. +* d8a1e4e Created a params class to hold global data. +* 636ae85 Added two params for apt class +* 148fc73 Update LICENSE. +* ed2d19e Support ability to add more than one PPA +* 420d537 Add call to apt-update after add-apt-repository in apt::ppa +* 945be77 Add package definition for python-software-properties +* 71fc425 Abs paths for all commands +* 9d51cd1 Adding LICENSE +* 71796e3 Heading fix in README +* 87777d8 Typo in README +* f848bac First commit + +[4.5.0]:https://github.com/puppetlabs/puppetlabs-apt/compare/4.4.1...4.5.0 +[4.4.1]:https://github.com/puppetlabs/puppetlabs-apt/compare/4.4.0...4.4.1 +[4.4.0]:https://github.com/puppetlabs/puppetlabs-apt/compare/4.3.0...4.4.0 +[4.3.0]:https://github.com/puppetlabs/puppetlabs-apt/compare/4.2.0...4.3.0 +[4.2.0]:https://github.com/puppetlabs/puppetlabs-apt/compare/4.1.0...4.2.0 diff --git a/code/environments/production/modules/apt/CONTRIBUTING.md b/code/environments/production/modules/apt/CONTRIBUTING.md new file mode 100644 index 0000000..1a9fb3a --- /dev/null +++ b/code/environments/production/modules/apt/CONTRIBUTING.md @@ -0,0 +1,271 @@ +# Contributing to Puppet modules + +So you want to contribute to a Puppet module: Great! Below are some instructions to get you started doing +that very thing while setting expectations around code quality as well as a few tips for making the +process as easy as possible. + +### Table of Contents + +1. [Getting Started](#getting-started) +1. [Commit Checklist](#commit-checklist) +1. [Submission](#submission) +1. [More about commits](#more-about-commits) +1. [Testing](#testing) + - [Running Tests](#running-tests) + - [Writing Tests](#writing-tests) +1. [Get Help](#get-help) + +## Getting Started + +- Fork the module repository on GitHub and clone to your workspace + +- Make your changes! + +## Commit Checklist + +### The Basics + +- [x] my commit is a single logical unit of work + +- [x] I have checked for unnecessary whitespace with "git diff --check" + +- [x] my commit does not include commented out code or unneeded files + +### The Content + +- [x] my commit includes tests for the bug I fixed or feature I added + +- [x] my commit includes appropriate documentation changes if it is introducing a new feature or changing existing functionality + +- [x] my code passes existing test suites + +### The Commit Message + +- [x] the first line of my commit message includes: + + - [x] an issue number (if applicable), e.g. "(MODULES-xxxx) This is the first line" + + - [x] a short description (50 characters is the soft limit, excluding ticket number(s)) + +- [x] the body of my commit message: + + - [x] is meaningful + + - [x] uses the imperative, present tense: "change", not "changed" or "changes" + + - [x] includes motivation for the change, and contrasts its implementation with the previous behavior + +## Submission + +### Pre-requisites + +- Make sure you have a [GitHub account](https://github.com/join) + +- [Create a ticket](https://tickets.puppet.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppet.com/browse/) you are patching for. + +### Push and PR + +- Push your changes to your fork + +- [Open a Pull Request](https://help.github.com/articles/creating-a-pull-request-from-a-fork/) against the repository in the puppetlabs organization + +## More about commits + + 1. Make separate commits for logically separate changes. + + Please break your commits down into logically consistent units + which include new or changed tests relevant to the rest of the + change. The goal of doing this is to make the diff easier to + read for whoever is reviewing your code. In general, the easier + your diff is to read, the more likely someone will be happy to + review it and get it into the code base. + + If you are going to refactor a piece of code, please do so as a + separate commit from your feature or bug fix changes. + + We also really appreciate changes that include tests to make + sure the bug is not re-introduced, and that the feature is not + accidentally broken. + + Describe the technical detail of the change(s). If your + description starts to get too long, that is a good sign that you + probably need to split up your commit into more finely grained + pieces. + + Commits which plainly describe the things which help + reviewers check the patch and future developers understand the + code are much more likely to be merged in with a minimum of + bike-shedding or requested changes. Ideally, the commit message + would include information, and be in a form suitable for + inclusion in the release notes for the version of Puppet that + includes them. + + Please also check that you are not introducing any trailing + whitespace or other "whitespace errors". You can do this by + running "git diff --check" on your changes before you commit. + + 2. Sending your patches + + To submit your changes via a GitHub pull request, we _highly_ + recommend that you have them on a topic branch, instead of + directly on "master". + It makes things much easier to keep track of, especially if + you decide to work on another thing before your first change + is merged in. + + GitHub has some pretty good + [general documentation](http://help.github.com/) on using + their site. They also have documentation on + [creating pull requests](https://help.github.com/articles/creating-a-pull-request-from-a-fork/). + + In general, after pushing your topic branch up to your + repository on GitHub, you can switch to the branch in the + GitHub UI and click "Pull Request" towards the top of the page + in order to open a pull request. + + 3. Update the related JIRA issue. + + If there is a JIRA issue associated with the change you + submitted, then you should update the ticket to include the + location of your branch, along with any other commentary you + may wish to make. + +# Testing + +## Getting Started + +Our Puppet modules provide [`Gemfile`](./Gemfile)s, which can tell a Ruby package manager such as [bundler](http://bundler.io/) what Ruby packages, +or Gems, are required to build, develop, and test this software. + +Please make sure you have [bundler installed](http://bundler.io/#getting-started) on your system, and then use it to +install all dependencies needed for this project in the project root by running + +```shell +% bundle install --path .bundle/gems +Fetching gem metadata from https://rubygems.org/........ +Fetching gem metadata from https://rubygems.org/.. +Using rake (10.1.0) +Using builder (3.2.2) +-- 8><-- many more --><8 -- +Using rspec-system-puppet (2.2.0) +Using serverspec (0.6.3) +Using rspec-system-serverspec (1.0.0) +Using bundler (1.3.5) +Your bundle is complete! +Use `bundle show [gemname]` to see where a bundled gem is installed. +``` + +NOTE: some systems may require you to run this command with sudo. + +If you already have those gems installed, make sure they are up-to-date: + +```shell +% bundle update +``` + +## Running Tests + +With all dependencies in place and up-to-date, run the tests: + +### Unit Tests + +```shell +% bundle exec rake spec +``` + +This executes all the [rspec tests](http://rspec-puppet.com/) in the directories defined [here](https://github.com/puppetlabs/puppetlabs_spec_helper/blob/699d9fbca1d2489bff1736bb254bb7b7edb32c74/lib/puppetlabs_spec_helper/rake_tasks.rb#L17) and so on. +rspec tests may have the same kind of dependencies as the module they are testing. Although the module defines these dependencies in its [metadata.json](./metadata.json), +rspec tests define them in [.fixtures.yml](./fixtures.yml). + +### Acceptance Tests + +Some Puppet modules also come with acceptance tests, which use [beaker][]. These tests spin up a virtual machine under +[VirtualBox](https://www.virtualbox.org/), controlled with [Vagrant](http://www.vagrantup.com/), to simulate scripted test +scenarios. In order to run these, you need both Virtualbox and Vagrant installed on your system. + +Run the tests by issuing the following command + +```shell +% bundle exec rake spec_clean +% bundle exec rspec spec/acceptance +``` + +This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml), +install Puppet, copy this module, and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb) +and then run all the tests under [spec/acceptance](./spec/acceptance). + +## Writing Tests + +### Unit Tests + +When writing unit tests for Puppet, [rspec-puppet][] is your best friend. It provides tons of helper methods for testing your manifests against a +catalog (e.g. contain_file, contain_package, with_params, etc). It would be ridiculous to try and top rspec-puppet's [documentation][rspec-puppet_docs] +but here's a tiny sample: + +Sample manifest: + +```puppet +file { "a test file": + ensure => present, + path => "/etc/sample", +} +``` + +Sample test: + +```ruby +it 'does a thing' do + expect(subject).to contain_file("a test file").with({:path => "/etc/sample"}) +end +``` + +### Acceptance Tests + +Writing acceptance tests for Puppet involves [beaker][] and its cousin [beaker-rspec][]. A common pattern for acceptance tests is to create a test manifest, apply it +twice to check for idempotency or errors, then run expectations. + +```ruby +it 'does an end-to-end thing' do + pp = <<-EOF + file { 'a test file': + ensure => present, + path => "/etc/sample", + content => "test string", + } + + apply_manifest(pp, :catch_failures => true) + apply_manifest(pp, :catch_changes => true) + +end + +describe file("/etc/sample") do + it { is_expected.to contain "test string" } +end + +``` + +# If you have commit access to the repository + +Even if you have commit access to the repository, you still need to go through the process above, and have someone else review and merge +in your changes. The rule is that **all changes must be reviewed by a project developer that did not write the code to ensure that +all changes go through a code review process.** + +The record of someone performing the merge is the record that they performed the code review. Again, this should be someone other than the author of the topic branch. + +# Get Help + +### On the web +* [Puppet help messageboard](http://puppet.com/community/get-help) +* [Writing tests](https://docs.puppet.com/guides/module_guides/bgtm.html#step-three-module-testing) +* [General GitHub documentation](http://help.github.com/) +* [GitHub pull request documentation](http://help.github.com/send-pull-requests/) + +### On chat +* Slack (slack.puppet.com) #forge-modules, #puppet-dev, #windows, #voxpupuli +* IRC (freenode) #puppet-dev, #voxpupuli + + +[rspec-puppet]: http://rspec-puppet.com/ +[rspec-puppet_docs]: http://rspec-puppet.com/documentation/ +[beaker]: https://github.com/puppetlabs/beaker +[beaker-rspec]: https://github.com/puppetlabs/beaker-rspec diff --git a/code/environments/production/modules/apt/Gemfile b/code/environments/production/modules/apt/Gemfile new file mode 100644 index 0000000..37597a3 --- /dev/null +++ b/code/environments/production/modules/apt/Gemfile @@ -0,0 +1,136 @@ +source ENV['GEM_SOURCE'] || 'https://rubygems.org' + +def location_for(place_or_version, fake_version = nil) + if place_or_version =~ %r{\A(git[:@][^#]*)#(.*)} + [fake_version, { git: Regexp.last_match(1), branch: Regexp.last_match(2), require: false }].compact + elsif place_or_version =~ %r{\Afile:\/\/(.*)} + ['>= 0', { path: File.expand_path(Regexp.last_match(1)), require: false }] + else + [place_or_version, { require: false }] + end +end + +def gem_type(place_or_version) + if place_or_version =~ %r{\Agit[:@]} + :git + elsif !place_or_version.nil? && place_or_version.start_with?('file:') + :file + else + :gem + end +end + +ruby_version_segments = Gem::Version.new(RUBY_VERSION.dup).segments +minor_version = ruby_version_segments[0..1].join('.') + +group :development do + gem "fast_gettext", '1.1.0', require: false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0') + gem "fast_gettext", require: false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0') + gem "json_pure", '<= 2.0.1', require: false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0') + gem "json", '= 1.8.1', require: false if Gem::Version.new(RUBY_VERSION.dup) == Gem::Version.new('2.1.9') + gem "puppet-module-posix-default-r#{minor_version}", require: false, platforms: [:ruby] + gem "puppet-module-posix-dev-r#{minor_version}", require: false, platforms: [:ruby] + gem "puppet-module-win-default-r#{minor_version}", require: false, platforms: [:mswin, :mingw, :x64_mingw] + gem "puppet-module-win-dev-r#{minor_version}", require: false, platforms: [:mswin, :mingw, :x64_mingw] + gem "puppet-blacksmith", '~> 3.4', require: false +end +group :system_tests do + gem "puppet-module-posix-system-r#{minor_version}", require: false, platforms: [:ruby] + gem "puppet-module-win-system-r#{minor_version}", require: false, platforms: [:mswin, :mingw, :x64_mingw] + gem "beaker", *location_for(ENV['BEAKER_VERSION'] || '~> 3.13') + gem "beaker-abs", *location_for(ENV['BEAKER_ABS_VERSION'] || '~> 0.1') + gem "beaker-pe", require: false + gem "beaker-hostgenerator" + gem "beaker-rspec" +end + +puppet_version = ENV['PUPPET_GEM_VERSION'] +puppet_type = gem_type(puppet_version) +facter_version = ENV['FACTER_GEM_VERSION'] +hiera_version = ENV['HIERA_GEM_VERSION'] + +def puppet_older_than?(version) + puppet_version = ENV['PUPPET_GEM_VERSION'] + !puppet_version.nil? && + Gem::Version.correct?(puppet_version) && + Gem::Requirement.new("< #{version}").satisfied_by?(Gem::Version.new(puppet_version.dup)) +end + +gems = {} + +gems['puppet'] = location_for(puppet_version) + +# If facter or hiera versions have been specified via the environment +# variables, use those versions. If not, and if the puppet version is < 3.5.0, +# use known good versions of both for puppet < 3.5.0. +if facter_version + gems['facter'] = location_for(facter_version) +elsif puppet_type == :gem && puppet_older_than?('3.5.0') + gems['facter'] = ['>= 1.6.11', '<= 1.7.5', require: false] +end + +if hiera_version + gems['hiera'] = location_for(ENV['HIERA_GEM_VERSION']) +elsif puppet_type == :gem && puppet_older_than?('3.5.0') + gems['hiera'] = ['>= 1.0.0', '<= 1.3.0', require: false] +end + +if Gem.win_platform? && (puppet_type != :gem || puppet_older_than?('3.5.0')) + # For Puppet gems < 3.5.0 (tested as far back as 3.0.0) on Windows + if puppet_type == :gem + gems['ffi'] = ['1.9.0', require: false] + gems['minitar'] = ['0.5.4', require: false] + gems['win32-eventlog'] = ['0.5.3', '<= 0.6.5', require: false] + gems['win32-process'] = ['0.6.5', '<= 0.7.5', require: false] + gems['win32-security'] = ['~> 0.1.2', '<= 0.2.5', require: false] + gems['win32-service'] = ['0.7.2', '<= 0.8.8', require: false] + else + gems['ffi'] = ['~> 1.9.0', require: false] + gems['minitar'] = ['~> 0.5.4', require: false] + gems['win32-eventlog'] = ['~> 0.5', '<= 0.6.5', require: false] + gems['win32-process'] = ['~> 0.6', '<= 0.7.5', require: false] + gems['win32-security'] = ['~> 0.1', '<= 0.2.5', require: false] + gems['win32-service'] = ['~> 0.7', '<= 0.8.8', require: false] + end + + gems['win32-dir'] = ['~> 0.3', '<= 0.4.9', require: false] + + if RUBY_VERSION.start_with?('1.') + gems['win32console'] = ['1.3.2', require: false] + # sys-admin was removed in Puppet 3.7.0 and doesn't compile under Ruby 2.x + gems['sys-admin'] = ['1.5.6', require: false] + end + + # Puppet < 3.7.0 requires these. + # Puppet >= 3.5.0 gem includes these as requirements. + # The following versions are tested to work with 3.0.0 <= puppet < 3.7.0. + gems['win32-api'] = ['1.4.8', require: false] + gems['win32-taskscheduler'] = ['0.2.2', require: false] + gems['windows-api'] = ['0.4.3', require: false] + gems['windows-pr'] = ['1.2.3', require: false] +elsif Gem.win_platform? + # If we're using a Puppet gem on Windows which handles its own win32-xxx gem + # dependencies (>= 3.5.0), set the maximum versions (see PUP-6445). + gems['win32-dir'] = ['<= 0.4.9', require: false] + gems['win32-eventlog'] = ['<= 0.6.5', require: false] + gems['win32-process'] = ['<= 0.7.5', require: false] + gems['win32-security'] = ['<= 0.2.5', require: false] + gems['win32-service'] = ['<= 0.8.8', require: false] +end + +gems.each do |gem_name, gem_params| + gem gem_name, *gem_params +end + +# Evaluate Gemfile.local and ~/.gemfile if they exist +extra_gemfiles = [ + "#{__FILE__}.local", + File.join(Dir.home, '.gemfile'), +] + +extra_gemfiles.each do |gemfile| + if File.file?(gemfile) && File.readable?(gemfile) + eval(File.read(gemfile), binding) + end +end +# vim: syntax=ruby diff --git a/code/environments/production/modules/apt/LICENSE b/code/environments/production/modules/apt/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/code/environments/production/modules/apt/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/code/environments/production/modules/apt/MAINTAINERS.md b/code/environments/production/modules/apt/MAINTAINERS.md new file mode 100644 index 0000000..0b11ea2 --- /dev/null +++ b/code/environments/production/modules/apt/MAINTAINERS.md @@ -0,0 +1,6 @@ +## Maintenance + +Maintainers: + - Puppet Forge Modules Team `forge-modules |at| puppet |dot| com` + +Tickets: https://tickets.puppet.com/browse/MODULES. Make sure to set component to `apt`. diff --git a/code/environments/production/modules/apt/NOTICE b/code/environments/production/modules/apt/NOTICE new file mode 100644 index 0000000..209695b --- /dev/null +++ b/code/environments/production/modules/apt/NOTICE @@ -0,0 +1,37 @@ +Puppet Module - puppetlabs-apt + +Copyright 2017 Puppet, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + + +Copyright (c) 2011 Evolving Web Inc. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/code/environments/production/modules/apt/README.md b/code/environments/production/modules/apt/README.md new file mode 100644 index 0000000..73272c2 --- /dev/null +++ b/code/environments/production/modules/apt/README.md @@ -0,0 +1,543 @@ +# apt + +#### Table of Contents + + +1. [Module Description - What the module does and why it is useful](#module-description) +1. [Setup - The basics of getting started with apt](#setup) + * [What apt affects](#what-apt-affects) + * [Beginning with apt](#beginning-with-apt) +1. [Usage - Configuration options and additional functionality](#usage) + * [Add GPG keys](#add-gpg-keys) + * [Prioritize backports](#prioritize-backports) + * [Update the list of packages](#update-the-list-of-packages) + * [Pin a specific release](#pin-a-specific-release) + * [Add a Personal Package Archive repository](#add-a-personal-package-archive-repository) + * [Configure Apt from Hiera](#configure-apt-from-hiera) + * [Replace the default sources.list file](#replace-the-default-sourceslist-file) +1. [Reference - An under-the-hood peek at what the module is doing and how](#reference) + * [Classes](#classes) + * [Defined types](#defined-types) + * [Types](#types) + * [Facts](#facts) + * [Tasks](#tasks) +1. [Limitations - OS compatibility, etc.](#limitations) +1. [Development - Guide for contributing to the module](#development) + +## Module Description + +The apt module lets you use Puppet to manage Apt sources, keys, and other configuration options. + +Apt (Advanced Package Tool) is a package manager available on Debian, Ubuntu, and several other operating systems. The apt module provides a series of classes, defines, types, and facts to help you automate Apt package management. + +**Note**: For this module to correctly autodetect which version of Debian/Ubuntu (or derivative) you're running, you need to make sure the 'lsb-release' package is installed. We highly recommend you either make this part of your provisioning layer, if you run many Debian or derivative systems, or ensure that you have Facter 2.2.0 or later installed, which will pull this dependency in for you. + +## Setup + +### What apt affects + +* Your system's `preferences` file and `preferences.d` directory +* Your system's `sources.list` file and `sources.list.d` directory +* System repositories +* Authentication keys + +**Note:** This module offers `purge` parameters which, if set to `true`, **destroy** any configuration on the node's `sources.list(.d)` and `preferences(.d)` that you haven't declared through Puppet. The default for these parameters is `false`. + +### Beginning with apt + +To use the apt module with default parameters, declare the `apt` class. + +```puppet +include apt +``` + +**Note:** The main `apt` class is required by all other classes, types, and defined types in this module. You must declare it whenever you use the module. + +## Usage + +### Add GPG keys + +**Warning:** Using short key IDs presents a serious security issue, potentially leaving you open to collision attacks. We recommend you always use full fingerprints to identify your GPG keys. This module allows short keys, but issues a security warning if you use them. + +Declare the `apt::key` defined type: + +```puppet +apt::key { 'puppetlabs': + id => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + server => 'pgp.mit.edu', + options => 'http-proxy="http://proxyuser:proxypass@example.org:3128"', +} +``` + +### Prioritize backports + +```puppet +class { 'apt::backports': + pin => 500, +} +``` + +By default, the `apt::backports` class drops a pin file for backports, pinning it to a priority of 200. This is lower than the normal default of 500, so packages with `ensure => latest` don't get upgraded from backports without your explicit permission. + +If you raise the priority through the `pin` parameter to 500, normal policy goes into effect and Apt installs or upgrades to the newest version. This means that if a package is available from backports, it and its dependencies are pulled in from backports unless you explicitly set the `ensure` attribute of the `package` resource to `installed`/`present` or a specific version. + +### Update the list of packages + +By default, Puppet runs `apt-get update` on the first Puppet run after you include the `apt` class, and anytime `notify => Exec['apt_update']` occurs; i.e., whenever config files get updated or other relevant changes occur. If you set `update['frequency']` to 'always', the update runs on every Puppet run. You can also set `update['frequency']` to 'daily' or 'weekly': + +```puppet +class { 'apt': + update => { + frequency => 'daily', + }, +} +``` +When `Exec['apt_update']` is triggered, it generates a `Notice` message. Because the default [logging level for agents](https://docs.puppet.com/puppet/latest/configuration.html#loglevel) is `notice`, this causes the repository update to appear in logs and agent reports. Some tools, such as [The Foreman](https://www.theforeman.org), report the update notice as a significant change. To eliminate these updates from reports, set the [loglevel](https://docs.puppet.com/puppet/latest/metaparameter.html#loglevel) metaparameter for `Exec['apt_update']` above the agent logging level: + +```puppet +class { 'apt': + update => { + frequency => 'daily', + loglevel => 'debug', + }, +} +``` + +### Pin a specific release + +```puppet +apt::pin { 'karmic': priority => 700 } +apt::pin { 'karmic-updates': priority => 700 } +apt::pin { 'karmic-security': priority => 700 } +``` + +You can also specify more complex pins using distribution properties: + +```puppet +apt::pin { 'stable': + priority => -10, + originator => 'Debian', + release_version => '3.0', + component => 'main', + label => 'Debian' +} +``` + +To pin multiple packages, pass them to the `packages` parameter as an array or a space-delimited string. + +### Add a Personal Package Archive repository + +```puppet +apt::ppa { 'ppa:drizzle-developers/ppa': } +``` + +### Add an Apt source to `/etc/apt/sources.list.d/` + +```puppet +apt::source { 'debian_unstable': + comment => 'This is the iWeb Debian unstable mirror', + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'unstable', + repos => 'main contrib non-free', + pin => '-10', + key => { + 'id' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + 'server' => 'subkeys.pgp.net', + }, + include => { + 'src' => true, + 'deb' => true, + }, +} +``` + +To use the Puppet Apt repository as a source: + +```puppet +apt::source { 'puppetlabs': + location => 'http://apt.puppetlabs.com', + repos => 'main', + key => { + 'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + 'server' => 'pgp.mit.edu', + }, +} +``` + +### Configure Apt from Hiera + +Instead of specifying your sources directly as resources, you can instead just +include the `apt` class, which will pick up the values automatically from +hiera. + +```yaml +apt::sources: + 'debian_unstable': + comment: 'This is the iWeb Debian unstable mirror' + location: 'http://debian.mirror.iweb.ca/debian/' + release: 'unstable' + repos: 'main contrib non-free' + pin: '-10' + key: + id: 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553' + server: 'subkeys.pgp.net' + include: + src: true + deb: true + + 'puppetlabs': + location: 'http://apt.puppetlabs.com' + repos: 'main' + key: + id: '6F6B15509CF8E59E6E469F327F438280EF8D349F' + server: 'pgp.mit.edu' +``` + +### Replace the default `sources.list` file + +The following example replaces the default `/etc/apt/sources.list`. Along with this code, be sure to use the `purge` parameter, or you might get duplicate source warnings when running Apt. + +```puppet +apt::source { "archive.ubuntu.com-${lsbdistcodename}": + location => 'http://archive.ubuntu.com/ubuntu', + key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos => 'main universe multiverse restricted', +} + +apt::source { "archive.ubuntu.com-${lsbdistcodename}-security": + location => 'http://archive.ubuntu.com/ubuntu', + key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos => 'main universe multiverse restricted', + release => "${lsbdistcodename}-security" +} + +apt::source { "archive.ubuntu.com-${lsbdistcodename}-updates": + location => 'http://archive.ubuntu.com/ubuntu', + key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos => 'main universe multiverse restricted', + release => "${lsbdistcodename}-updates" +} + +apt::source { "archive.ubuntu.com-${lsbdistcodename}-backports": + location => 'http://archive.ubuntu.com/ubuntu', + key => '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos => 'main universe multiverse restricted', + release => "${lsbdistcodename}-backports" +} +``` + +## Reference + +### Classes + +#### Public Classes + +* [`apt`](#class-apt) +* [`apt::backports`](#class-aptbackports) + +#### Private Classes + +* `apt::params`: Provides defaults for the apt module parameters. +* `apt::update`: Updates the list of available packages using `apt-get update`. + +### Defined Types + +* [`apt::conf`](#defined-type-aptconf) +* [`apt::key`](#defined-type-aptkey) +* [`apt::pin`](#defined-type-aptpin) +* [`apt::ppa`](#defined-type-aptppa) +* [`apt::setting`](#defined-type-aptsetting) +* [`apt::source`](#defined-type-aptsource) + +### Types + +* [`apt_key`](#type-apt_key) + +### Facts + +* `apt_updates`: The number of installed packages with available updates from `upgrade`. + +* `apt_dist_updates`: The number of installed packages with available updates from `dist-upgrade`. + +* `apt_security_updates`: The number of installed packages with available security updates from `upgrade`. + +* `apt_security_dist_updates`: The number of installed packages with available security updates from `dist-upgrade`. + +* `apt_package_updates`: The names of all installed packages with available updates from `upgrade`. In Facter 2.0 and later this data is formatted as an array; in earlier versions it is a comma-delimited string. + +* `apt_package_dist_updates`: The names of all installed packages with available updates from `dist-upgrade`. In Facter 2.0 and later this data is formatted as an array; in earlier versions it is a comma-delimited string. + +* `apt_update_last_success`: The date, in epochtime, of the most recent successful `apt-get update` run (based on the mtime of /var/lib/apt/periodic/update-success-stamp). + +* `apt_reboot_required`: Determines if a reboot is necessary after updates have been installed. + +### Tasks + +The Apt module has an example task that allows a user to run apt-get update or upgrade. Please refer to to the [PE documentation](https://puppet.com/docs/pe/2017.3/orchestrator/running_tasks.html) or [Bolt documentation](https://puppet.com/docs/bolt/latest/bolt.html) on how to execute a task. + +#### Class: `apt` + +Main class, includes all other classes. + +##### Parameters + +All parameters are optional unless specified. + +* `confs`: Creates new `apt::conf` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `keys`: Creates new `apt::key` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `ppas`: Creates new `apt::ppa` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `proxy`: Configures Apt to connect to a proxy server. Valid options: a hash made up from the following keys: + + * `host`: Specifies a proxy host to be stored in `/etc/apt/apt.conf.d/01proxy`. Valid options: a string containing a hostname. Default: undef. + + * `port`: Specifies a proxy port to be stored in `/etc/apt/apt.conf.d/01proxy`. Valid options: an integer containing a port number. Default: 8080. + + * `https`: Specifies whether to enable https proxies. Valid options: `true` and `false`. Default: `false`. + + * `ensure`: Optional parameter. Valid options: 'file', 'present', and 'absent'. Default: `undef`. Prefer 'file' over 'present'. + + * `direct`: Specifies whether or not to use a 'DIRECT' https proxy if http proxy is used but https is not. Valid options: `true` and `false`. Default: `false`. + +* `purge`: Specifies whether to purge any existing settings that aren't managed by Puppet. Valid options: a hash made up from the following keys: + + * `sources.list`: Specifies whether to purge any unmanaged entries from `sources.list`. Valid options: `true` and `false`. Default: `false`. + + * `sources.list.d`: Specifies whether to purge any unmanaged entries from `sources.list.d`. Valid options: `true` and `false`. Default: `false`. + + * `preferences`: Specifies whether to purge any unmanaged entries from `preferences`. Valid options: `true` and `false`. Default: `false`. + + * `preferences.d`: Specifies whether to purge any unmanaged entries from `preferences.d`. Valid options: `true` and `false`. Default: `false`. + +* `settings`: Creates new `apt::setting` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `sources`: Creates new `apt::source` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `pins`: Creates new `apt::pin` resources. Valid options: a hash to be passed to the [`create_resources` function](https://docs.puppetlabs.com/references/latest/function.html#createresources). Default: {}. + +* `update`: Configures various update settings. Valid options: a hash made up from the following keys: + + * `frequency`: Specifies how often to run `apt-get update`. If the exec resource `apt_update` is notified, `apt-get update` runs regardless of this value. Valid options: 'always' (at every Puppet run); 'daily' (if the value of `apt_update_last_success` is less than current epoch time minus 86400); 'weekly' (if the value of `apt_update_last_success` is less than current epoch time minus 604800); and 'reluctantly' (only if the exec resource `apt_update` is notified). Default: 'reluctantly'. + + * `timeout`: Specifies how long to wait for the update to complete before canceling it. Valid options: an integer, in seconds. Default: 300. + + * `tries`: Specifies how many times to retry the update after receiving a DNS or HTTP error. Valid options: an integer. Default: 1. + +#### Class: `apt::backports` + +Manages backports. + +##### Parameters + +All parameters are optional on Debian and Ubuntu and required on other operating systems, except where specified. + +* `key`: Specifies a key to authenticate the backports. Valid options: a string to be passed to the `id` parameter of the `apt::key` defined type, or a hash of `parameter => value` pairs to be passed to `apt::key`'s `id`, `server`, `content`, `source`, and/or `options` parameters. Defaults: + + * Debian: 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553' + * Ubuntu: '630239CC130E1A7FD81A27B140976EAF437D05B5' + +* `location`: Specifies an Apt repository containing the backports to manage. Valid options: a string containing a URL. Defaults: + + * Debian: 'http://deb.debian.org/debian' + * Ubuntu: 'http://archive.ubuntu.com/ubuntu' + +* `pin`: *Optional.* Specifies a pin priority for the backports. Valid options: a number or string to be passed to the `id` parameter of the `apt::pin` defined type, or a hash of `parameter => value` pairs to be passed to `apt::pin`'s corresponding parameters. Default: '200'. + +* `release`: Specifies a distribution of the Apt repository containing the backports to manage. Valid options: a string containing the release, used in populating the `source.list` configuration file. Default: on Debian and Ubuntu, '${lsbdistcodename}-backports'. We recommend keeping this default, except on other operating systems. + +* `repos`: Specifies a component of the Apt repository containing the backports to manage. Valid options: A string containing the repos to include, used in populating the `source.list` configuration file. Defaults: + + * Debian: 'main contrib non-free' + * Ubuntu: 'main universe multiverse restricted' + +#### Defined Type: `apt::conf` + +Specifies a custom Apt configuration file. + +##### Parameters + +All parameters are optional unless specified. + + +* `content`: *Required, unless `ensure` is set to 'absent'.* Directly supplies content for the configuration file. Valid options: a string. Default: undef. + +* `ensure`: Specifies whether the configuration file should exist. Valid options: 'present' and 'absent'. Default: 'present'. + +* `priority`: *Optional.* Determines the order in which Apt processes the configuration file. Files with lower priority numbers are loaded first. Valid options: a string containing an integer. Default: '50'. + +* `notify_update`: *Optional.* Specifies whether to trigger an `apt-get update` run. Valid options: `true` and `false`. Default: `true`. + +#### Defined type: `apt::key` + +Manages the GPG keys that Apt uses to authenticate packages. + +The `apt::key` defined type makes use of the `apt_key` type, but includes extra functionality to help prevent duplicate keys. + +##### Parameters (all optional) + +* `content`: Supplies the entire GPG key. Useful in case the key can't be fetched from a remote location and using a file resource is inconvenient. Valid options: a string. Default: undef. + +* `ensure`: Specifies whether the key should exist. Valid options: 'present' and 'absent'. Default: 'present'. + +* `id`: Specifies a GPG key to authenticate Apt package signatures. Valid options: a string containing a key ID (8 or 16 hexadecimal characters, optionally prefixed with "0x") or a full key fingerprint (40 hexadecimal characters). Default: $title. + +* `options`: Passes additional options to `apt-key adv --keyserver-options`. Valid options: a string. Default: undef. + +* `source`: Specifies the location of an existing GPG key file to copy. Valid options: a string containing a URL (ftp://, http://, or https://) or an absolute path. Default: undef. + +* `server`: Specifies a keyserver to provide the GPG key. Valid options: a string containing a domain name or a full URL (http://, https://, or hkp://). Default: 'keyserver.ubuntu.com'. + +#### Defined type: `apt::pin` + +Manages Apt pins. Does not trigger an `apt-get update` run. + +**Note:** For context on these parameters, we recommend reading the man page ['apt_preferences(5)'](http://linux.die.net/man/5/apt_preferences) + +##### Parameters + +All parameters are optional unless specified. + +* `codename`: Specifies the distribution (lsbdistcodename) of the Apt repository. Valid options: a string. Default: ''. + +* `component`: Names the licensing component associated with the packages in the directory tree of the Release file. Valid options: a string. Default: ''. + +* `ensure`: Specifies whether the pin should exist. Valid options: 'file', 'present', and 'absent'. Default: 'present'. + +* `explanation`: Supplies a comment to explain the pin. Valid options: a string. Default: "${caller_module_name}: ${name}". + +* `label`: Names the label of the packages in the directory tree of the Release file. Valid options: a string (most commonly, 'debian'). Default: ''. + +* `order`: Determines the order in which Apt processes the pin file. Files with lower order numbers are loaded first. Valid options: an integer. Default: 50. + +* `origin`: Tells Apt to prefer packages from the specified server. Valid options: a string containing a hostname. Default: ''. + +* `originator`: Names the originator of the packages in the directory tree of the Release file. Valid options: a string (most commonly, 'debian'). Default: ''. + +* `packages`: Specifies which package(s) to pin. Valid options: a string or an array. Default: `*`. + +* `priority`: Sets the priority of the package. If multiple versions of a given package are available, `apt-get` installs the one with the highest priority number (subject to dependency constraints). Valid options: an integer. Default: 0. + +* `release`: Tells Apt to prefer packages that support the specified release. Typical values include 'stable', 'testing', and 'unstable' Valid options: a string. Default: ''. + +* `release_version`: Tells Apt to prefer packages that support the specified operating system release version (such as Debian release version 7). Valid options: a string. Default: ''. + +* `version`: Tells Apt to prefer a specified package version or version range. Valid options: a string. Default: ''. + +#### Defined Type: `apt::ppa` + +Manages PPA repositories using `add-apt-repository`. Not supported on Debian. + +##### Parameters + +All parameters are optional unless specified. + +* `ensure`: Specifies whether the PPA should exist. Valid options: 'present' and 'absent'. Default: 'present'. + +* `options`: Supplies options to be passed to the `add-apt-repository` command. Valid options: a string. Defaults: + + * Lucid: undef + * All others: '-y' + +* `package_manage`: Specifies whether Puppet should manage the package that provides `apt-add-repository`. Valid options: `true` and `false`. Default: `false`. + +* `package_name`: Names the package that provides the `apt-add-repository` command. Valid options: a string. Defaults: + + * Lucid and Precise: 'python-software-properties' + * Trusty and newer: 'software-properties-common' + * All others: 'python-software-properties' + +* `release`: *Optional if lsb-release is installed (unless you're using a different release than indicated by lsb-release, e.g., Linux Mint).* Specifies the operating system of your node. Valid options: a string containing a valid LSB distribution codename. Default: "$lsbdistcodename". + +#### Defined Type: `apt::setting` + +Manages Apt configuration files. + +##### Parameters + +All parameters are optional unless specified. + +* `content`: *Required, unless `source` is set.* Directly supplies content for the configuration file. Cannot be used in combination with `source`. Valid options: see the `content` attribute of [Puppet's native `file` type](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-content). Default: undef. + +* `ensure`: Specifies whether the file should exist. Valid options: 'present', 'absent', and 'file'. Default: 'file'. + +* `notify_update`: *Optional.* Specifies whether to trigger an `apt-get update` run. Valid options: `true` and `false`. Default: `true`. + +* `priority`: *Optional.* Determines the order in which Apt processes the configuration file. Files with higher priority numbers are loaded first. Valid options: an integer or zero-padded integer. Default: 50. + +* `source`: *Required, unless `content` is set.* Specifies a source file to supply the content of the configuration file. Cannot be used in combination with `content`. Valid options: see the `source` attribute of [Puppet's native `file` type](https://docs.puppetlabs.com/references/latest/type.html#file-attribute-source). Default: undef. + +#### Defined Type: `apt::source` + +Manages the Apt sources in `/etc/apt/sources.list.d/`. + +##### Parameters + +All parameters are optional unless specified. + +* `allow_unsigned`: Specifies whether to authenticate packages from this release, even if the Release file is not signed or the signature can't be checked. Valid options: `true` and `false`. Default: `false`. + +* `architecture`: Tells Apt to only download information for specified architectures. Valid options: a string containing one or more architecture names, separated by commas (e.g., 'i386' or 'i386,alpha,powerpc'). Default: undef (if unspecified, Apt downloads information for all architectures defined in the Apt::Architectures option). + +* `comment`: Supplies a comment for adding to the Apt source file. Valid options: a string. Default: $name. + +* `ensure`: Specifies whether the Apt source file should exist. Valid options: 'present' and 'absent'. Default: 'present'. + +* `key`: Creates a declaration of the apt::key defined type. Valid options: a string to be passed to the `id` parameter of the `apt::key` defined type, or a hash of `parameter => value` pairs to be passed to `apt::key`'s `id`, `server`, `content`, `source`, and/or `options` parameters. Default: undef. + +* `include`: Configures include options. Valid options: a hash of available keys. Default: {}. Available keys are: + + * `deb` - Specifies whether to request the distribution's compiled binaries. Valid options: `true` and `false`. Default: `true`. + + * `src` - Specifies whether to request the distribution's uncompiled source code. Valid options: `true` and `false`. Default: `false`. + +* `location`: *Required, unless `ensure` is set to 'absent'.* Specifies an Apt repository. Valid options: a string containing a repository URL. Default: undef. + +* `pin`: Creates a declaration of the apt::pin defined type. Valid options: a number or string to be passed to the `id` parameter of the `apt::pin` defined type, or a hash of `parameter => value` pairs to be passed to `apt::pin`'s corresponding parameters. Default: undef. + +* `release`: Specifies a distribution of the Apt repository. Valid options: a string. Default: "$lsbdistcodename". + + * `repos`: Specifies a component of the Apt repository. Valid options: a string. Default: 'main'. + +* `notify_update`: *Optional.* Specifies whether to trigger an `apt-get update` run. Valid options: `true` and `false`. Default: `true`. + +#### Type: `apt_key` + +Manages the GPG keys that Apt uses to authenticate packages. + +**Note:** In most cases, we recommend using the `apt::key` defined type. It makes use of the `apt_key` type, but includes extra functionality to help prevent duplicate keys. + +##### Parameters + +All parameters are optional. + +* `content`: Supplies the entire GPG key. Useful in case the key can't be fetched from a remote location and using a file resource is inconvenient. Cannot be used in combination with `source`. Valid options: a string. Default: undef. + +* `options`: Passes additional options to `apt-key adv --keyserver-options`. Valid options: a string. Default: undef. + +* `server`: Specifies a keyserver to provide Puppet's GPG key. Valid options: a string containing a domain name or a full URL. Default: 'keyserver.ubuntu.com'. + +* `source`: Specifies the location of an existing GPG key file to copy. Cannot be used in combination with `content`. Valid options: a string containing a URL (ftp://, http://, or https://) or an absolute path. Default: undef. + +## Limitations + +This module is tested and officially supported on Debian 6 and 7 and Ubuntu 10.04, 12.04, and 14.04. Testing on other platforms has been light and cannot be guaranteed. + +This module is not designed to be split across [run stages](https://docs.puppetlabs.com/puppet/latest/reference/lang_run_stages.html). + +### Adding new sources or PPAs + +If you are adding a new source or PPA and trying to install packages from the new source or PPA on the same Puppet run, your `package` resource should depend on `Class['apt::update']`, in addition to depending on the `Apt::Source` or the `Apt::Ppa`. You can also add [collectors](https://docs.puppetlabs.com/puppet/latest/reference/lang_collectors.html) to ensure that all packages happen after `apt::update`, but this can lead to dependency cycles and has implications for [virtual resources](https://docs.puppetlabs.com/puppet/latest/reference/lang_collectors.html#behavior). + +```puppet +Class['apt::update'] -> Package <| provider == 'apt' |> +``` + +## Development + +Puppet modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can't access the huge number of platforms and myriad hardware, software, and deployment configurations that Puppet is intended to serve. We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things. + +For more information, see our [module contribution guide.](https://docs.puppetlabs.com/forge/contributing.html) + +To see who's already involved, see the [list of contributors.](https://github.com/puppetlabs/puppetlabs-apt/graphs/contributors) diff --git a/code/environments/production/modules/apt/Rakefile b/code/environments/production/modules/apt/Rakefile new file mode 100644 index 0000000..802f67b --- /dev/null +++ b/code/environments/production/modules/apt/Rakefile @@ -0,0 +1,3 @@ +require 'puppetlabs_spec_helper/rake_tasks' +require 'puppet-syntax/tasks/puppet-syntax' +require 'puppet_blacksmith/rake_tasks' diff --git a/code/environments/production/modules/apt/checksums.json b/code/environments/production/modules/apt/checksums.json new file mode 100644 index 0000000..2c9bedb --- /dev/null +++ b/code/environments/production/modules/apt/checksums.json @@ -0,0 +1,85 @@ +{ + "CHANGELOG.md": "210cb579a20941c360dc6897e74952ac", + "CONTRIBUTING.md": "4d17f3c942e7c93d1577cc4438a231e4", + "Gemfile": "47f2bb73e730d42a921e7bca4449f5aa", + "LICENSE": "3b83ef96387f14655fc854ddc3c6bd57", + "MAINTAINERS.md": "35674b233c6d12c0f56ee8afbdae29e4", + "NOTICE": "9533d13591355591f69619be28e9cfce", + "README.md": "8bd71b883c237bda10a1f345fddbc78c", + "Rakefile": "df4172642435e770c27019d9d15d59bd", + "examples/backports.pp": "af57ea62ed1b73f540858e00327e6517", + "examples/builddep.pp": "eddb8b7d7c0ef7383d85a74c1cd0de3f", + "examples/debian_testing.pp": "2e50a41180e2afeac2de15ade05ddaa1", + "examples/debian_unstable.pp": "82890803cc4423443db8f40353e16262", + "examples/disable_keys.pp": "3d4e7ac49946d961ff51a719ee713293", + "examples/fancy_progress.pp": "9a55d4ea52be4ebd670befff7ca3b87f", + "examples/force.pp": "f71857eba704a0eb3d8d6b146e80da6d", + "examples/hold.pp": "5e58e0a30d6407a05691d96c7647ae14", + "examples/key.pp": "d85507365bd2753e14e04c344c2f7703", + "examples/pin.pp": "4b4c3612d75a19dba8eb7227070fa4ab", + "examples/ppa.pp": "b902cce8159128b5e8b21bed540743ff", + "examples/release.pp": "2bc960babf8c4dd24b7ffa4220a601f8", + "examples/source.pp": "c79817e129305f86a495f7558de3d3ec", + "examples/unattended_upgrades.pp": "e7a797388ef03077f110f4f268f5ecd1", + "lib/facter/apt_reboot_required.rb": "e7dbcd3849c380cdd08dbc866079c211", + "lib/facter/apt_update_last_success.rb": "f259aac4abdf82c1c6f13e0031bf551a", + "lib/facter/apt_updates.rb": "3c71621f2b03075187c512c42add634b", + "lib/puppet/provider/apt_key/apt_key.rb": "69c1c1861111471ff14f8176505a8697", + "lib/puppet/type/apt_key.rb": "af34d8297da8013b1dd1e21e951d646f", + "locales/config.yaml": "bda37c45d7414bd4e2a6e1c01044e2e6", + "manifests/backports.pp": "2ec31325c4ab15271b9670049d6798d5", + "manifests/conf.pp": "e040cbed191ca66294d7f88ba7c29035", + "manifests/init.pp": "320d40323654450113c2072f4b5be169", + "manifests/key.pp": "96d07fbb816d37fe225a07ca7e409a6d", + "manifests/params.pp": "bdd14319baf4293d476d53ded19cf8cd", + "manifests/pin.pp": "f54f1c6cee012103960f21d411f91f77", + "manifests/ppa.pp": "5c05b41477ba7613af1855ec38be5971", + "manifests/setting.pp": "fd82a93821ce14d1be631ef7eb972a97", + "manifests/source.pp": "3d4c5f4f17062189f5316fec3b2cbd77", + "manifests/update.pp": "78b7f698a8cee3b86906e7c5cfe115f7", + "metadata.json": "6e8bb0ed4641e19e6d4e46e6c4dbb7b3", + "spec/acceptance/apt_key_provider_spec.rb": "3ca9408fa41dd5beea68282b13866ccc", + "spec/acceptance/apt_spec.rb": "8fb011463609160a6a57e2ffa5627671", + "spec/acceptance/class_spec.rb": "b63ac7a092085ee607aa74c55963004f", + "spec/acceptance/init_task_spec.rb": "0a9d390d5e801bf0ac5be96a3d90c2b4", + "spec/acceptance/nodesets/centos-7-x64.yml": "a713f3abd3657f0ae2878829badd23cd", + "spec/acceptance/nodesets/debian-8-x64.yml": "d2d2977900989f30086ad251a14a1f39", + "spec/acceptance/nodesets/default.yml": "b42da5a1ea0c964567ba7495574b8808", + "spec/acceptance/nodesets/docker/centos-7.yml": "8a3892807bdd62306ae4774f41ba11ae", + "spec/acceptance/nodesets/docker/debian-8.yml": "ac8e871d1068c96de5e85a89daaec6df", + "spec/acceptance/nodesets/docker/ubuntu-14.04.yml": "dc42ee922a96908d85b8f0f08203ce58", + "spec/classes/apt_backports_spec.rb": "67b53fc63b82de28fdd4b7bba653bf61", + "spec/classes/apt_spec.rb": "0b10725314a439d2894fd861eb2acaa1", + "spec/classes/apt_update_spec.rb": "bd7c58cf878c2781f4a01fd2f27f3a36", + "spec/defines/conf_spec.rb": "f5bdeb742fbb63f1f2b4540d6b184bcb", + "spec/defines/key_compat_spec.rb": "265b1b8e50d408a8aed79b60ea7094f0", + "spec/defines/key_spec.rb": "60098bfb8ac33968448441fb89d1a989", + "spec/defines/pin_spec.rb": "0c5d2575b3b1b8c9e3a38779863299a4", + "spec/defines/ppa_spec.rb": "205e53544380679fab739ed5fa6c32f5", + "spec/defines/setting_spec.rb": "8da56cd826a127fd8e390eb7b4e53caf", + "spec/defines/source_compat_spec.rb": "65a508f640f5333bbe0da6bdebeb8e42", + "spec/defines/source_spec.rb": "47f8ff347d797347927cb3014c1bfdae", + "spec/spec_helper.rb": "898577ed31fbf848330924de64091e60", + "spec/spec_helper_acceptance.rb": "8b2ab6fb6bd01d92375fbda13d22a018", + "spec/unit/facter/apt_dist_has_updates_spec.rb": "6b85d39d586e7654ad2f0ee3af5a2787", + "spec/unit/facter/apt_dist_package_security_updates_spec.rb": "577b2cd23942bbe67d3a2705d33408dc", + "spec/unit/facter/apt_dist_package_updates_spec.rb": "063821fc13e3b217a853577b6a94a224", + "spec/unit/facter/apt_dist_security_updates_spec.rb": "393a47f50ff6c43aa6ba80d7848cd96a", + "spec/unit/facter/apt_dist_updates_spec.rb": "f96e477aa5c6fd913c2352dba8f40b53", + "spec/unit/facter/apt_has_updates_spec.rb": "cdc8486f14c4c3f35df0c38c2cc72c83", + "spec/unit/facter/apt_package_security_updates_spec.rb": "a0c7f61456fce4b0518b52604ca6342c", + "spec/unit/facter/apt_package_updates_spec.rb": "62708ded28f92c049a38ededa61a7d77", + "spec/unit/facter/apt_reboot_required_spec.rb": "80e860984fc538bede7a2c24625ee234", + "spec/unit/facter/apt_security_updates_spec.rb": "a6d6985e4dcce5839119618d91726c64", + "spec/unit/facter/apt_update_last_success_spec.rb": "0e6cf8b5bec4d91ccfe4b83d088a5b10", + "spec/unit/facter/apt_updates_spec.rb": "6d3fb0763e8133b014838f504ce26f08", + "spec/unit/puppet/type/apt_key_spec.rb": "2c2de871e2ddd556c0676f45cddd8e68", + "tasks/init.json": "f6aed51e207a15340d5258d1fab47a69", + "tasks/init.rb": "329cc4a36f89db4f2485884421af025b", + "templates/15update-stamp.epp": "b9de0ac9e2c9854b1bb213e362dc4e41", + "templates/_conf_header.epp": "6f3077f2eabd3e929a44d55bc1c5446e", + "templates/_header.epp": "9300ac105fe777787ac9e793b8df8d25", + "templates/pin.pref.epp": "ab7a64e3779f93028fe965a6393fad74", + "templates/proxy.epp": "7353f09fa5fdb1819517446ec58c9ad5", + "templates/source.list.epp": "c32995778d056f204d51a6d79505a5aa" +} \ No newline at end of file diff --git a/code/environments/production/modules/apt/examples/backports.pp b/code/environments/production/modules/apt/examples/backports.pp new file mode 100644 index 0000000..5f1f1ee --- /dev/null +++ b/code/environments/production/modules/apt/examples/backports.pp @@ -0,0 +1,11 @@ +# Set up a backport for linuxmint qiana +class { 'apt': } +apt::backports { 'qiana': + location => 'http://us.archive.ubuntu.com/ubuntu', + release => 'trusty-backports', + repos => 'main universe multiverse restricted', + key => { + id => '630239CC130E1A7FD81A27B140976EAF437D05B5', + server => 'hkps.pool.sks-keyservers.net', + }, +} diff --git a/code/environments/production/modules/apt/examples/builddep.pp b/code/environments/production/modules/apt/examples/builddep.pp new file mode 100644 index 0000000..deaaef8 --- /dev/null +++ b/code/environments/production/modules/apt/examples/builddep.pp @@ -0,0 +1,3 @@ +package{ 'glusterfs-server': + install_options => 'build-dep', +} diff --git a/code/environments/production/modules/apt/examples/debian_testing.pp b/code/environments/production/modules/apt/examples/debian_testing.pp new file mode 100644 index 0000000..3ed98f2 --- /dev/null +++ b/code/environments/production/modules/apt/examples/debian_testing.pp @@ -0,0 +1,18 @@ +package { 'debian-keyring': + ensure => present +} + +package { 'debian-archive-keyring': + ensure => present +} + +apt::source { 'debian_testing': + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'testing', + repos => 'main contrib non-free', + pin => '-10', + key => { + id => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + server => 'subkeys.pgp.net', + }, +} diff --git a/code/environments/production/modules/apt/examples/debian_unstable.pp b/code/environments/production/modules/apt/examples/debian_unstable.pp new file mode 100644 index 0000000..b1492cd --- /dev/null +++ b/code/environments/production/modules/apt/examples/debian_unstable.pp @@ -0,0 +1,18 @@ +package { 'debian-keyring': + ensure => present +} + +package { 'debian-archive-keyring': + ensure => present +} + +apt::source { 'debian_unstable': + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'unstable', + repos => 'main contrib non-free', + pin => '-10', + key => { + id => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + server => 'subkeys.pgp.net', + }, +} diff --git a/code/environments/production/modules/apt/examples/disable_keys.pp b/code/environments/production/modules/apt/examples/disable_keys.pp new file mode 100644 index 0000000..50d0ea8 --- /dev/null +++ b/code/environments/production/modules/apt/examples/disable_keys.pp @@ -0,0 +1,5 @@ +#Note: This is generally a bad idea. You should not disable verifying repository signatures. +apt::conf { 'unauth': + priority => 99, + content => 'APT::Get::AllowUnauthenticated 1;' +} diff --git a/code/environments/production/modules/apt/examples/fancy_progress.pp b/code/environments/production/modules/apt/examples/fancy_progress.pp new file mode 100644 index 0000000..db78441 --- /dev/null +++ b/code/environments/production/modules/apt/examples/fancy_progress.pp @@ -0,0 +1,4 @@ +apt::conf { 'progressbar': + priority => 99, + content => 'Dpkg::Progress-Fancy "1";', +} diff --git a/code/environments/production/modules/apt/examples/force.pp b/code/environments/production/modules/apt/examples/force.pp new file mode 100644 index 0000000..4cfaa96 --- /dev/null +++ b/code/environments/production/modules/apt/examples/force.pp @@ -0,0 +1,28 @@ +#if you need to specify a release +$rel_string = '-t ' +#else +$rel_string = '' + +#if you need to specify a version +$ensure = '' +#else +$ensure = installed + +#if overwrite existing cfg files +$config_files = '-o Dpkg::Options::="--force-confnew"' +#elsif force use of old files +$config_files = '-o Dpkg::Options::="--force-confold"' +#elsif update only unchanged files +$config_files = '-o Dpkg::Options::="--force-confdef"' +#else +$config_files = '' + +#if install missing configuration files for the package +$config_missing = '-o Dpkg::Options::="--force-confmiss"' +#else +$config_missing = '' + +package { '': + ensure => $ensure, + install_options => "${config_files} ${config_missing} ${rel_string}", +} diff --git a/code/environments/production/modules/apt/examples/hold.pp b/code/environments/production/modules/apt/examples/hold.pp new file mode 100644 index 0000000..00f760c --- /dev/null +++ b/code/environments/production/modules/apt/examples/hold.pp @@ -0,0 +1,5 @@ +apt::pin { 'hold-vim': + packages => 'vim', + version => '2:7.4.488-5', + priority => 1001, +} diff --git a/code/environments/production/modules/apt/examples/key.pp b/code/environments/production/modules/apt/examples/key.pp new file mode 100644 index 0000000..dc2401b --- /dev/null +++ b/code/environments/production/modules/apt/examples/key.pp @@ -0,0 +1,6 @@ +# Declare Apt key for apt.puppetlabs.com source +apt::key { 'puppetlabs': + id => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + server => 'hkps.pool.sks-keyservers.net', + options => 'http-proxy="http://proxyuser:proxypass@example.org:3128"', +} diff --git a/code/environments/production/modules/apt/examples/pin.pp b/code/environments/production/modules/apt/examples/pin.pp new file mode 100644 index 0000000..6a9024c --- /dev/null +++ b/code/environments/production/modules/apt/examples/pin.pp @@ -0,0 +1,5 @@ +# pin a release in apt, useful for unstable repositories +apt::pin { 'foo': + packages => '*', + priority => 0, +} diff --git a/code/environments/production/modules/apt/examples/ppa.pp b/code/environments/production/modules/apt/examples/ppa.pp new file mode 100644 index 0000000..e728f6f --- /dev/null +++ b/code/environments/production/modules/apt/examples/ppa.pp @@ -0,0 +1,4 @@ +class { 'apt': } + +# Example declaration of an Apt PPA +apt::ppa{ 'ppa:openstack-ppa/bleeding-edge': } diff --git a/code/environments/production/modules/apt/examples/release.pp b/code/environments/production/modules/apt/examples/release.pp new file mode 100644 index 0000000..46d6893 --- /dev/null +++ b/code/environments/production/modules/apt/examples/release.pp @@ -0,0 +1,4 @@ +apt::conf { 'release': + content => 'APT::Default-Release "karmic";', + priority => '01', +} diff --git a/code/environments/production/modules/apt/examples/source.pp b/code/environments/production/modules/apt/examples/source.pp new file mode 100644 index 0000000..a3648c3 --- /dev/null +++ b/code/environments/production/modules/apt/examples/source.pp @@ -0,0 +1,35 @@ +# Declare the apt class to manage /etc/apt/sources.list and /etc/sources.list.d +class { 'apt': } + +# Install the puppetlabs apt source +# Release is automatically obtained from lsbdistcodename fact if available. +apt::source { 'puppetlabs': + location => 'http://apt.puppetlabs.com', + repos => 'main', + key => { + id => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + server => 'hkps.pool.sks-keyservers.net', + }, +} + +# test two sources with the same key +apt::source { 'debian_testing': + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'testing', + repos => 'main contrib non-free', + key => { + id => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + server => 'hkps.pool.sks-keyservers.net', + }, + pin => '-10', +} +apt::source { 'debian_unstable': + location => 'http://debian.mirror.iweb.ca/debian/', + release => 'unstable', + repos => 'main contrib non-free', + key => { + id => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + server => 'hkps.pool.sks-keyservers.net', + }, + pin => '-10', +} diff --git a/code/environments/production/modules/apt/examples/unattended_upgrades.pp b/code/environments/production/modules/apt/examples/unattended_upgrades.pp new file mode 100644 index 0000000..4640904 --- /dev/null +++ b/code/environments/production/modules/apt/examples/unattended_upgrades.pp @@ -0,0 +1 @@ +# TODO diff --git a/code/environments/production/modules/apt/lib/facter/apt_reboot_required.rb b/code/environments/production/modules/apt/lib/facter/apt_reboot_required.rb new file mode 100644 index 0000000..1e1650a --- /dev/null +++ b/code/environments/production/modules/apt/lib/facter/apt_reboot_required.rb @@ -0,0 +1,7 @@ +# apt_reboot_required.rb +Facter.add(:apt_reboot_required) do + confine osfamily: 'Debian' + setcode do + File.file?('/var/run/reboot-required') + end +end diff --git a/code/environments/production/modules/apt/lib/facter/apt_update_last_success.rb b/code/environments/production/modules/apt/lib/facter/apt_update_last_success.rb new file mode 100644 index 0000000..9866a2b --- /dev/null +++ b/code/environments/production/modules/apt/lib/facter/apt_update_last_success.rb @@ -0,0 +1,16 @@ +require 'facter' + +# This is derived from the file /var/lib/apt/periodic/update-success-stamp +# This is generated upon a successful apt-get update run natively in ubuntu. +# the Puppetlabs-apt module deploys this same functionality for other debian-ish OSes +Facter.add('apt_update_last_success') do + confine osfamily: 'Debian' + setcode do + if File.exist?('/var/lib/apt/periodic/update-success-stamp') + # get epoch time + File.mtime('/var/lib/apt/periodic/update-success-stamp').to_i + else + -1 + end + end +end diff --git a/code/environments/production/modules/apt/lib/facter/apt_updates.rb b/code/environments/production/modules/apt/lib/facter/apt_updates.rb new file mode 100644 index 0000000..cf7d12f --- /dev/null +++ b/code/environments/production/modules/apt/lib/facter/apt_updates.rb @@ -0,0 +1,115 @@ +apt_package_updates = nil +apt_dist_updates = nil + +def get_updates(upgrade_option) + apt_updates = nil + if File.executable?('/usr/bin/apt-get') + apt_get_result = Facter::Util::Resolution.exec("/usr/bin/apt-get -s -o Debug::NoLocking=true #{upgrade_option} 2>&1") + unless apt_get_result.nil? + apt_updates = [[], []] + apt_get_result.each_line do |line| + next unless line =~ %r{^Inst\s} + package = line.gsub(%r{^Inst\s([^\s]+)\s.*}, '\1').strip + apt_updates[0].push(package) + security_matches = [ + %r{ Debian-Security:}, + %r{ Ubuntu[^\s]+-security[, ]}, + %r{ gNewSense[^\s]+-security[, ]}, + ] + re = Regexp.union(security_matches) + if line.match(re) + apt_updates[1].push(package) + end + end + end + end + + setcode do + if !apt_updates.nil? && apt_updates.length == 2 + apt_updates != [[], []] + end + end + apt_updates +end + +Facter.add('apt_has_updates') do + confine osfamily: 'Debian' + apt_package_updates = get_updates('upgrade') +end + +Facter.add('apt_has_dist_updates') do + confine osfamily: 'Debian' + apt_dist_updates = get_updates('dist-upgrade') +end + +Facter.add('apt_package_updates') do + confine apt_has_updates: true + setcode do + if Facter.version < '2.0.0' + apt_package_updates[0].join(',') + else + apt_package_updates[0] + end + end +end + +Facter.add('apt_package_dist_updates') do + confine apt_has_dist_updates: true + setcode do + if Facter.version < '2.0.0' + apt_dist_updates[0].join(',') + else + apt_dist_updates[0] + end + end +end + +Facter.add('apt_package_security_updates') do + confine apt_has_updates: true + setcode do + if Facter.version < '2.0.0' + apt_package_updates[1].join(',') + else + apt_package_updates[1] + end + end +end + +Facter.add('apt_package_security_dist_updates') do + confine apt_has_dist_updates: true + setcode do + if Facter.version < '2.0.0' + apt_dist_updates[1].join(',') + else + apt_dist_updates[1] + end + end +end + +Facter.add('apt_updates') do + confine apt_has_updates: true + setcode do + Integer(apt_package_updates[0].length) + end +end + +Facter.add('apt_dist_updates') do + confine apt_has_dist_updates: true + setcode do + Integer(apt_dist_updates[0].length) + end +end + +Facter.add('apt_security_updates') do + confine apt_has_updates: true + setcode do + Integer(apt_package_updates[1].length) + end +end + +Facter.add('apt_security_dist_updates') do + confine apt_has_dist_updates: true + setcode do + Integer(apt_dist_updates[1].length) + end +end diff --git a/code/environments/production/modules/apt/lib/puppet/provider/apt_key/apt_key.rb b/code/environments/production/modules/apt/lib/puppet/provider/apt_key/apt_key.rb new file mode 100644 index 0000000..fc0d206 --- /dev/null +++ b/code/environments/production/modules/apt/lib/puppet/provider/apt_key/apt_key.rb @@ -0,0 +1,236 @@ +require 'open-uri' +require 'net/ftp' +require 'tempfile' + +if RUBY_VERSION == '1.8.7' + # Mothers cry, puppies die and Ruby 1.8.7's open-uri needs to be + # monkeypatched to support passing in :ftp_passive_mode. + require File.expand_path(File.join(File.dirname(__FILE__), '..', '..', '..', + 'puppet_x', 'apt_key', 'patch_openuri.rb')) + OpenURI::Options[:ftp_active_mode] = false +end + +Puppet::Type.type(:apt_key).provide(:apt_key) do + confine osfamily: :debian + defaultfor osfamily: :debian + commands apt_key: 'apt-key' + commands gpg: '/usr/bin/gpg' + + def self.instances + cli_args = ['adv', '--list-keys', '--with-colons', '--fingerprint', '--fixed-list-mode'] + + key_output = apt_key(cli_args).encode('UTF-8', 'binary', invalid: :replace, undef: :replace, replace: '') + + pub_line, sub_line, fpr_line = nil + + key_array = key_output.split("\n").map do |line| + if line.start_with?('pub') + pub_line = line + # reset fpr_line, to skip any previous subkeys which were collected + fpr_line = nil + sub_line = nil + elsif line.start_with?('sub') + sub_line = line + elsif line.start_with?('fpr') + fpr_line = line + end + + if sub_line && fpr_line + sub_line, fpr_line = nil + next + end + + next unless pub_line && fpr_line + + line_hash = key_line_hash(pub_line, fpr_line) + + # reset everything + pub_line, fpr_line = nil + + expired = false + + if line_hash[:key_expiry] + expired = Time.now >= line_hash[:key_expiry] + end + + new( + name: line_hash[:key_fingerprint], + id: line_hash[:key_long], + fingerprint: line_hash[:key_fingerprint], + short: line_hash[:key_short], + long: line_hash[:key_long], + ensure: :present, + expired: expired, + expiry: line_hash[:key_expiry].nil? ? nil : line_hash[:key_expiry].strftime('%Y-%m-%d'), + size: line_hash[:key_size], + type: line_hash[:key_type], + created: line_hash[:key_created].strftime('%Y-%m-%d'), + ) + end + key_array.compact! + end + + def self.prefetch(resources) + apt_keys = instances + resources.each_key do |name| + if name.length == 40 + provider = apt_keys.find { |key| key.fingerprint == name } + resources[name].provider = provider if provider + elsif name.length == 16 + provider = apt_keys.find { |key| key.long == name } + resources[name].provider = provider if provider + elsif name.length == 8 + provider = apt_keys.find { |key| key.short == name } + resources[name].provider = provider if provider + end + end + end + + def self.key_line_hash(pub_line, fpr_line) + pub_split = pub_line.split(':') + fpr_split = fpr_line.split(':') + + fingerprint = fpr_split.last + return_hash = { + key_fingerprint: fingerprint, + key_long: fingerprint[-16..-1], # last 16 characters of fingerprint + key_short: fingerprint[-8..-1], # last 8 characters of fingerprint + key_size: pub_split[2], + key_type: nil, + key_created: Time.at(pub_split[5].to_i), + key_expiry: pub_split[6].empty? ? nil : Time.at(pub_split[6].to_i), + } + + # set key type based on types defined in /usr/share/doc/gnupg/DETAILS.gz + case pub_split[3] + when '1' + return_hash[:key_type] = :rsa + when '17' + return_hash[:key_type] = :dsa + when '18' + return_hash[:key_type] = :ecc + when '19' + return_hash[:key_type] = :ecdsa + end + + return_hash + end + + def source_to_file(value) + parsed_value = URI.parse(value) + if parsed_value.scheme.nil? + raise("The file #{value} does not exist") unless File.exist?(value) + # Because the tempfile method has to return a live object to prevent GC + # of the underlying file from occuring too early, we also have to return + # a file object here. The caller can still call the #path method on the + # closed file handle to get the path. + f = File.open(value, 'r') + f.close + f + else + begin + # Only send basic auth if URL contains userinfo + # Some webservers (e.g. Amazon S3) return code 400 if empty basic auth is sent + if parsed_value.userinfo.nil? + key = parsed_value.read + else + user_pass = parsed_value.userinfo.split(':') + parsed_value.userinfo = '' + key = open(parsed_value, http_basic_authentication: user_pass).read + end + rescue OpenURI::HTTPError, Net::FTPPermError => e + raise("#{e.message} for #{resource[:source]}") + rescue SocketError + raise("could not resolve #{resource[:source]}") + else + tempfile(key) + end + end + end + + # The tempfile method needs to return the tempfile object to the caller, so + # that it doesn't get deleted by the GC immediately after it returns. We + # want the caller to control when it goes out of scope. + def tempfile(content) + file = Tempfile.new('apt_key') + file.write content + file.close + # confirm that the fingerprint from the file, matches the long key that is in the manifest + if name.size == 40 + if File.executable? command(:gpg) + extracted_key = execute(["#{command(:gpg)} --with-fingerprint --with-colons #{file.path} | awk -F: '/^fpr:/ { print $10 }'"], failonfail: false) + extracted_key = extracted_key.chomp + + found_match = false + extracted_key.each_line do |line| + if line.chomp == name + found_match = true + end + end + unless found_match + raise("The id in your manifest #{resource[:name]} and the fingerprint from content/source don't match. Check for an error in the id and content/source is legitimate.") + end + else + warning('/usr/bin/gpg cannot be found for verification of the id.') + end + end + file + end + + def exists? + @property_hash[:ensure] == :present + end + + def create + command = [] + if resource[:source].nil? && resource[:content].nil? + # Breaking up the command like this is needed because it blows up + # if --recv-keys isn't the last argument. + command.push('adv', '--keyserver', resource[:server]) + unless resource[:options].nil? + command.push('--keyserver-options', resource[:options]) + end + command.push('--recv-keys', resource[:id]) + elsif resource[:content] + key_file = tempfile(resource[:content]) + command.push('add', key_file.path) + elsif resource[:source] + key_file = source_to_file(resource[:source]) + command.push('add', key_file.path) + # In case we really screwed up, better safe than sorry. + else + raise("an unexpected condition occurred while trying to add the key: #{resource[:id]}") + end + apt_key(command) + @property_hash[:ensure] = :present + end + + def destroy + loop do + apt_key('del', resource.provider.short) + r = execute(["#{command(:apt_key)} list | grep '/#{resource.provider.short}\s'"], failonfail: false) + break unless r.exitstatus.zero? + end + @property_hash.clear + end + + def read_only(_value) + raise('This is a read-only property.') + end + + mk_resource_methods + + # Needed until PUP-1470 is fixed and we can drop support for Puppet versions + # before that. + def expired + @property_hash[:expired] + end + + # Alias the setters of read-only properties + # to the read_only function. + alias_method :created=, :read_only + alias_method :expired=, :read_only + alias_method :expiry=, :read_only + alias_method :size=, :read_only + alias_method :type=, :read_only +end diff --git a/code/environments/production/modules/apt/lib/puppet/type/apt_key.rb b/code/environments/production/modules/apt/lib/puppet/type/apt_key.rb new file mode 100644 index 0000000..d8b224f --- /dev/null +++ b/code/environments/production/modules/apt/lib/puppet/type/apt_key.rb @@ -0,0 +1,134 @@ +require 'pathname' + +Puppet::Type.newtype(:apt_key) do + @doc = <<-MANIFEST + This type provides Puppet with the capabilities to manage GPG keys needed + by apt to perform package validation. Apt has it's own GPG keyring that can + be manipulated through the `apt-key` command. + + apt_key { '6F6B15509CF8E59E6E469F327F438280EF8D349F': + source => 'http://apt.puppetlabs.com/pubkey.gpg' + } + + **Autorequires**: + + If Puppet is given the location of a key file which looks like an absolute + path this type will autorequire that file. + MANIFEST + + ensurable + + validate do + if self[:content] && self[:source] + raise('The properties content and source are mutually exclusive.') + end + if self[:id].length < 40 + warning('The id should be a full fingerprint (40 characters), see README.') + end + end + + newparam(:id, namevar: true) do + desc 'The ID of the key you want to manage.' + # GPG key ID's should be either 32-bit (short) or 64-bit (long) key ID's + # and may start with the optional 0x, or they can be 40-digit key fingerprints + newvalues(%r{\A(0x)?[0-9a-fA-F]{8}\Z}, %r{\A(0x)?[0-9a-fA-F]{16}\Z}, %r{\A(0x)?[0-9a-fA-F]{40}\Z}) + munge do |value| + id = if value.start_with?('0x') + value.partition('0x').last.upcase + else + value.upcase + end + id + end + end + + newparam(:content) do + desc 'The content of, or string representing, a GPG key.' + end + + newparam(:source) do + desc 'Location of a GPG key file, /path/to/file, ftp://, http:// or https://' + newvalues(%r{\Ahttps?://}, %r{\Aftp://}, %r{\A/\w+}) + end + + autorequire(:file) do + if self[:source] && Pathname.new(self[:source]).absolute? + self[:source] + end + end + + newparam(:server) do + desc 'The key server to fetch the key from based on the ID. It can either be a domain name or url.' + defaultto :'keyserver.ubuntu.com' + + newvalues(%r{\A((hkp|http|https)://)?([a-z\d])([a-z\d-]{0,61}\.)+[a-z\d]+(:\d{2,5})?$}) + end + + newparam(:options) do + desc 'Additional options to pass to apt-key\'s --keyserver-options.' + end + + newproperty(:fingerprint) do + desc <<-MANIFEST + The 40-digit hexadecimal fingerprint of the specified GPG key. + + This property is read-only. + MANIFEST + end + + newproperty(:long) do + desc <<-MANIFEST + The 16-digit hexadecimal id of the specified GPG key. + + This property is read-only. + MANIFEST + end + + newproperty(:short) do + desc <<-MANIFEST + The 8-digit hexadecimal id of the specified GPG key. + + This property is read-only. + MANIFEST + end + + newproperty(:expired) do + desc <<-MANIFEST + Indicates if the key has expired. + + This property is read-only. + MANIFEST + end + + newproperty(:expiry) do + desc <<-MANIFEST + The date the key will expire, or nil if it has no expiry date. + + This property is read-only. + MANIFEST + end + + newproperty(:size) do + desc <<-MANIFEST + The key size, usually a multiple of 1024. + + This property is read-only. + MANIFEST + end + + newproperty(:type) do + desc <<-MANIFEST + The key type, one of: rsa, dsa, ecc, ecdsa + + This property is read-only. + MANIFEST + end + + newproperty(:created) do + desc <<-MANIFEST + Date the key was created. + + This property is read-only. + MANIFEST + end +end diff --git a/code/environments/production/modules/apt/locales/config.yaml b/code/environments/production/modules/apt/locales/config.yaml new file mode 100644 index 0000000..3f64263 --- /dev/null +++ b/code/environments/production/modules/apt/locales/config.yaml @@ -0,0 +1,26 @@ +--- +# This is the project-specific configuration file for setting up +# fast_gettext for your project. +gettext: + # This is used for the name of the .pot and .po files; they will be + # called .pot? + project_name: puppetlabs-apt + # This is used in comments in the .pot and .po files to indicate what + # project the files belong to and should bea little more desctiptive than + # + package_name: puppetlabs-apt + # The locale that the default messages in the .pot file are in + default_locale: en + # The email used for sending bug reports. + bugs_address: docs@puppet.com + # The holder of the copyright. + copyright_holder: Puppet, Inc. + # This determines which comments in code should be eligible for translation. + # Any comments that start with this string will be externalized. (Leave + # empty to include all.) + comments_tag: TRANSLATOR + # Patterns for +Dir.glob+ used to find all files that might contain + # translatable content, relative to the project root directory + source_files: + - './lib/**/*.rb' + diff --git a/code/environments/production/modules/apt/manifests/backports.pp b/code/environments/production/modules/apt/manifests/backports.pp new file mode 100644 index 0000000..6a7e87c --- /dev/null +++ b/code/environments/production/modules/apt/manifests/backports.pp @@ -0,0 +1,60 @@ +# Defining backports for the apt class +class apt::backports ( + Optional[String] $location = undef, + Optional[String] $release = undef, + Optional[String] $repos = undef, + Optional[Variant[String, Hash]] $key = undef, + Optional[Variant[Integer, String, Hash]] $pin = 200, +){ + if $location { + $_location = $location + } + if $release { + $_release = $release + } + if $repos { + $_repos = $repos + } + if $key { + $_key = $key + } + if ($facts['lsbdistid'] == 'Debian' or $facts['lsbdistid'] == 'Ubuntu') { + unless $location { + $_location = $::apt::backports['location'] + } + unless $release { + $_release = "${facts['lsbdistcodename']}-backports" + } + unless $repos { + $_repos = $::apt::backports['repos'] + } + unless $key { + $_key = $::apt::backports['key'] + } + } else { + unless $location and $release and $repos and $key { + fail('If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key') + } + } + + if $pin =~ Hash { + $_pin = $pin + } elsif $pin =~ Numeric or $pin =~ String { + # apt::source defaults to pinning to origin, but we should pin to release + # for backports + $_pin = { + 'priority' => $pin, + 'release' => $_release, + } + } else { + fail('pin must be either a string, number or hash') + } + + apt::source { 'backports': + location => $_location, + release => $_release, + repos => $_repos, + key => $_key, + pin => $_pin, + } +} diff --git a/code/environments/production/modules/apt/manifests/conf.pp b/code/environments/production/modules/apt/manifests/conf.pp new file mode 100644 index 0000000..b791f85 --- /dev/null +++ b/code/environments/production/modules/apt/manifests/conf.pp @@ -0,0 +1,22 @@ +# Defining apt config +define apt::conf ( + Optional[String] $content = undef, + Enum['present', 'absent'] $ensure = present, + Variant[String, Integer] $priority = 50, + Optional[Boolean] $notify_update = undef, +) { + + unless $ensure == 'absent' { + unless $content { + fail('Need to pass in content parameter') + } + } + + $confheadertmp = epp('apt/_conf_header.epp') + apt::setting { "conf-${name}": + ensure => $ensure, + priority => $priority, + content => "${confheadertmp}${content}", + notify_update => $notify_update, + } +} diff --git a/code/environments/production/modules/apt/manifests/init.pp b/code/environments/production/modules/apt/manifests/init.pp new file mode 100644 index 0000000..aa61986 --- /dev/null +++ b/code/environments/production/modules/apt/manifests/init.pp @@ -0,0 +1,200 @@ +# == Class: apt +# +# Manage APT (Advanced Packaging Tool) +# +class apt ( + Hash $update_defaults = $apt::params::update_defaults, + Hash $purge_defaults = $apt::params::purge_defaults, + Hash $proxy_defaults = $apt::params::proxy_defaults, + Hash $include_defaults = $apt::params::include_defaults, + String $provider = $apt::params::provider, + String $keyserver = $apt::params::keyserver, + Optional[String] $ppa_options = $apt::params::ppa_options, + Optional[String] $ppa_package = $apt::params::ppa_package, + Optional[Hash] $backports = $apt::params::backports, + Hash $confs = $apt::params::confs, + Hash $update = $apt::params::update, + Hash $purge = $apt::params::purge, + Hash $proxy = $apt::params::proxy, + Hash $sources = $apt::params::sources, + Hash $keys = $apt::params::keys, + Hash $ppas = $apt::params::ppas, + Hash $pins = $apt::params::pins, + Hash $settings = $apt::params::settings, + String $root = $apt::params::root, + String $sources_list = $apt::params::sources_list, + String $sources_list_d = $apt::params::sources_list_d, + String $conf_d = $apt::params::conf_d, + String $preferences = $apt::params::preferences, + String $preferences_d = $apt::params::preferences_d, + Hash $config_files = $apt::params::config_files, + Hash $source_key_defaults = $apt::params::source_key_defaults +) inherits apt::params { + + if $facts['osfamily'] != 'Debian' { + fail('This module only works on Debian or derivatives like Ubuntu') + } + + if $update['frequency'] { + assert_type( + Enum['always','daily','weekly','reluctantly'], + $update['frequency'], + ) + } + if $update['timeout'] { + assert_type(Integer, $update['timeout']) + } + if $update['tries'] { + assert_type(Integer, $update['tries']) + } + + $_update = merge($::apt::update_defaults, $update) + include ::apt::update + + if $purge['sources.list'] { + assert_type(Boolean, $purge['sources.list']) + } + if $purge['sources.list.d'] { + assert_type(Boolean, $purge['sources.list.d']) + } + if $purge['preferences'] { + assert_type(Boolean, $purge['preferences']) + } + if $purge['preferences.d'] { + assert_type(Boolean, $purge['preferences.d']) + } + + $_purge = merge($::apt::purge_defaults, $purge) + + if $proxy['ensure'] { + assert_type(Enum['file', 'present', 'absent'], $proxy['ensure']) + } + if $proxy['host'] { + assert_type(String, $proxy['host']) + } + if $proxy['port'] { + assert_type(Integer, $proxy['port']) + } + if $proxy['https']{ + assert_type(Boolean, $proxy['https']) + } + if $proxy['direct']{ + assert_type(Boolean, $proxy['direct']) + } + + $_proxy = merge($apt::proxy_defaults, $proxy) + + $confheadertmp = epp('apt/_conf_header.epp') + $proxytmp = epp('apt/proxy.epp', {'proxies' => $_proxy}) + $updatestamptmp = epp('apt/15update-stamp.epp') + + if $_proxy['ensure'] == 'absent' or $_proxy['host'] { + apt::setting { 'conf-proxy': + ensure => $_proxy['ensure'], + priority => '01', + content => "${confheadertmp}${proxytmp}", + } + } + + $sources_list_content = $_purge['sources.list'] ? { + true => "# Repos managed by puppet.\n", + default => undef, + } + + $preferences_ensure = $_purge['preferences'] ? { + true => absent, + default => file, + } + + if $_update['frequency'] == 'always' { + Exec <| title=='apt_update' |> { + refreshonly => false, + } + } + + apt::setting { 'conf-update-stamp': + priority => 15, + content => "${confheadertmp}${updatestamptmp}", + } + + file { 'sources.list': + ensure => file, + path => $::apt::sources_list, + owner => root, + group => root, + mode => '0644', + content => $sources_list_content, + notify => Class['apt::update'], + } + + file { 'sources.list.d': + ensure => directory, + path => $::apt::sources_list_d, + owner => root, + group => root, + mode => '0644', + purge => $_purge['sources.list.d'], + recurse => $_purge['sources.list.d'], + notify => Class['apt::update'], + } + + file { 'preferences': + ensure => $preferences_ensure, + path => $::apt::preferences, + owner => root, + group => root, + mode => '0644', + notify => Class['apt::update'], + } + + file { 'preferences.d': + ensure => directory, + path => $::apt::preferences_d, + owner => root, + group => root, + mode => '0644', + purge => $_purge['preferences.d'], + recurse => $_purge['preferences.d'], + notify => Class['apt::update'], + } + + if $confs { + create_resources('apt::conf', $confs) + } + # manage sources if present + if $sources { + create_resources('apt::source', $sources) + } + # manage keys if present + if $keys { + create_resources('apt::key', $keys) + } + # manage ppas if present + if $ppas { + create_resources('apt::ppa', $ppas) + } + # manage settings if present + if $settings { + create_resources('apt::setting', $settings) + } + + # manage pins if present + if $pins { + create_resources('apt::pin', $pins) + } + + # required for adding GPG keys on Debian 9 (and derivatives) + case $facts['os']['name'] { + 'Debian': { + if versioncmp($facts['os']['release']['major'], '9') >= 0 { + ensure_packages(['dirmngr']) + } + } + 'Ubuntu': { + if versioncmp($facts['os']['release']['full'], '17.04') >= 0 { + ensure_packages(['dirmngr']) + } + } + default: { } + } +} diff --git a/code/environments/production/modules/apt/manifests/key.pp b/code/environments/production/modules/apt/manifests/key.pp new file mode 100644 index 0000000..1933b3f --- /dev/null +++ b/code/environments/production/modules/apt/manifests/key.pp @@ -0,0 +1,81 @@ +# == Define: apt::key +define apt::key ( + String $id = $title, + Enum['present', 'absent'] $ensure = present, + Optional[String] $content = undef, + Optional[String] $source = undef, + String $server = $::apt::keyserver, + Optional[String] $options = undef, + ) { + + assert_type( + Pattern[ + /\A(0x)?[0-9a-fA-F]{8}\Z/, + /\A(0x)?[0-9a-fA-F]{16}\Z/, + /\A(0x)?[0-9a-fA-F]{40}\Z/, + ], $id) + + if $source { + assert_type(Pattern[/\Ahttps?:\/\//, /\Aftp:\/\//, /\A\/\w+/], $source) + } + + if $server { + assert_type(Pattern[/\A((hkp|http|https):\/\/)?([a-z\d])([a-z\d-]{0,61}\.)+[a-z\d]+(:\d{2,5})?$/], $server) + } + + case $ensure { + present: { + if defined(Anchor["apt_key ${id} absent"]){ + fail("key with id ${id} already ensured as absent") + } + + if !defined(Anchor["apt_key ${id} present"]) { + apt_key { $title: + ensure => $ensure, + id => $id, + source => $source, + content => $content, + server => $server, + options => $options, + } -> anchor { "apt_key ${id} present": } + + case $facts['os']['name'] { + 'Debian': { + if versioncmp($facts['os']['release']['major'], '9') >= 0 { + ensure_packages(['dirmngr']) + Apt::Key<| title == $title |> + } + } + 'Ubuntu': { + if versioncmp($facts['os']['release']['full'], '17.04') >= 0 { + ensure_packages(['dirmngr']) + Apt::Key<| title == $title |> + } + } + default: { } + } + } + } + + absent: { + if defined(Anchor["apt_key ${id} present"]){ + fail("key with id ${id} already ensured as present") + } + + if !defined(Anchor["apt_key ${id} absent"]){ + apt_key { $title: + ensure => $ensure, + id => $id, + source => $source, + content => $content, + server => $server, + options => $options, + } -> anchor { "apt_key ${id} absent": } + } + } + + default: { + fail "Invalid 'ensure' value '${ensure}' for apt::key" + } + } +} diff --git a/code/environments/production/modules/apt/manifests/params.pp b/code/environments/production/modules/apt/manifests/params.pp new file mode 100644 index 0000000..c11deba --- /dev/null +++ b/code/environments/production/modules/apt/manifests/params.pp @@ -0,0 +1,126 @@ +# Setting params for the module +class apt::params { + + if $::osfamily != 'Debian' { + fail('This module only works on Debian or derivatives like Ubuntu') + } + + $root = '/etc/apt' + $provider = '/usr/bin/apt-get' + $sources_list = "${root}/sources.list" + $sources_list_d = "${root}/sources.list.d" + $conf_d = "${root}/apt.conf.d" + $preferences = "${root}/preferences" + $preferences_d = "${root}/preferences.d" + $keyserver = 'keyserver.ubuntu.com' + $confs = {} + $update = {} + $purge = {} + $proxy = {} + $sources = {} + $keys = {} + $ppas = {} + $pins = {} + $settings = {} + + $config_files = { + 'conf' => { + 'path' => $conf_d, + 'ext' => '', + }, + 'pref' => { + 'path' => $preferences_d, + 'ext' => '.pref', + }, + 'list' => { + 'path' => $sources_list_d, + 'ext' => '.list', + } + } + + $update_defaults = { + 'frequency' => 'reluctantly', + 'loglevel' => undef, + 'timeout' => undef, + 'tries' => undef, + } + + $proxy_defaults = { + 'ensure' => undef, + 'host' => undef, + 'port' => 8080, + 'https' => false, + 'direct' => false, + } + + $purge_defaults = { + 'sources.list' => false, + 'sources.list.d' => false, + 'preferences' => false, + 'preferences.d' => false, + } + + $source_key_defaults = { + 'server' => $keyserver, + 'options' => undef, + 'content' => undef, + 'source' => undef, + } + + $include_defaults = { + 'deb' => true, + 'src' => false, + } + + case $facts['os']['name']{ + 'Debian': { + case $facts['os']['release']['full'] { + default: { + $backports = { + 'location' => 'http://deb.debian.org/debian', + 'key' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + 'repos' => 'main contrib non-free', + } + } + } + + $ppa_options = undef + $ppa_package = undef + + } + 'Ubuntu': { + $backports = { + 'location' => 'http://archive.ubuntu.com/ubuntu', + 'key' => '630239CC130E1A7FD81A27B140976EAF437D05B5', + 'repos' => 'main universe multiverse restricted', + } + + case $facts['os']['release']['full'] { + '10.04': { + $ppa_options = undef + $ppa_package = 'python-software-properties' + } + '12.04': { + $ppa_options = '-y' + $ppa_package = 'python-software-properties' + } + '14.04', '14.10', '15.04', '15.10', '16.04': { + $ppa_options = '-y' + $ppa_package = 'software-properties-common' + } + default: { + $ppa_options = '-y' + $ppa_package = 'python-software-properties' + } + } + } + undef: { + fail('Unable to determine value for fact os["name"]') + } + default: { + $ppa_options = undef + $ppa_package = undef + $backports = undef + } + } +} diff --git a/code/environments/production/modules/apt/manifests/pin.pp b/code/environments/production/modules/apt/manifests/pin.pp new file mode 100644 index 0000000..831d75f --- /dev/null +++ b/code/environments/production/modules/apt/manifests/pin.pp @@ -0,0 +1,96 @@ +# pin.pp +# pin a release in apt, useful for unstable repositories + +define apt::pin( + Optional[Enum['file', 'present', 'absent']] $ensure = present, + Optional[String] $explanation = undef, + Variant[Integer] $order = 50, + Variant[String, Array] $packages = '*', + Variant[Numeric, String] $priority = 0, + Optional[String] $release = '', # a= + Optional[String] $origin = '', + Optional[String] $version = '', + Optional[String] $codename = '', # n= + Optional[String] $release_version = '', # v= + Optional[String] $component = '', # c= + Optional[String] $originator = '', # o= + Optional[String] $label = '', # l= +) { + + if $explanation { + $_explanation = $explanation + } else { + if defined('$caller_module_name') { # strict vars check + $_explanation = "${caller_module_name}: ${name}" + } else { + $_explanation = ": ${name}" + } + } + + $pin_release_array = [ + $release, + $codename, + $release_version, + $component, + $originator, + $label, + ] + $pin_release = join($pin_release_array, '') + + # Read the manpage 'apt_preferences(5)', especially the chapter + # 'The Effect of APT Preferences' to understand the following logic + # and the difference between specific and general form + if $packages =~ Array { + $packages_string = join($packages, ' ') + } else { + $packages_string = $packages + } + + if $packages_string != '*' { # specific form + if ( $pin_release != '' and ( $origin != '' or $version != '' )) or + ( $version != '' and ( $pin_release != '' or $origin != '' )) { + fail('parameters release, origin, and version are mutually exclusive') + } + } else { # general form + if $version != '' { + fail('parameter version cannot be used in general form') + } + if ( $pin_release != '' and $origin != '' ) { + fail('parameters release and origin are mutually exclusive') + } + } + + # According to man 5 apt_preferences: + # The files have either no or "pref" as filename extension + # and only contain alphanumeric, hyphen (-), underscore (_) and period + # (.) characters. Otherwise APT will print a notice that it has ignored a + # file, unless that file matches a pattern in the + # Dir::Ignore-Files-Silently configuration list - in which case it will + # be silently ignored. + $file_name = regsubst($title, '[^0-9a-z\-_\.]', '_', 'IG') + + $headertmp = epp('apt/_header.epp') + + $pinpreftmp = epp('apt/pin.pref.epp', { + 'name' => $name, + 'pin_release' => $pin_release, + 'release' => $release, + 'codename' => $codename, + 'release_version' => $release_version, + 'component' => $component, + 'originator' => $originator, + 'label' => $label, + 'version' => $version, + 'origin' => $origin, + 'explanation' => $_explanation, + 'packages_string' => $packages_string, + 'priority' => $priority, + }) + + apt::setting { "pref-${file_name}": + ensure => $ensure, + priority => $order, + content => "${headertmp}${pinpreftmp}", + notify_update => false, + } +} diff --git a/code/environments/production/modules/apt/manifests/ppa.pp b/code/environments/production/modules/apt/manifests/ppa.pp new file mode 100644 index 0000000..a67e1a1 --- /dev/null +++ b/code/environments/production/modules/apt/manifests/ppa.pp @@ -0,0 +1,68 @@ +# ppa.pp +define apt::ppa( + String $ensure = 'present', + Optional[String] $options = $::apt::ppa_options, + Optional[String] $release = $facts['lsbdistcodename'], + Optional[String] $package_name = $::apt::ppa_package, + Boolean $package_manage = false, +) { + unless $release { + fail('lsbdistcodename fact not available: release parameter required') + } + + if $facts['lsbdistid'] == 'Debian' { + fail('apt::ppa is not currently supported on Debian.') + } + + if versioncmp($facts['lsbdistrelease'], '15.10') >= 0 { + $distid = downcase($facts['lsbdistid']) + $filename = regsubst($name, '^ppa:([^/]+)/(.+)$', "\\1-${distid}-\\2-${release}") + } else { + $filename = regsubst($name, '^ppa:([^/]+)/(.+)$', "\\1-\\2-${release}") + } + + $filename_no_slashes = regsubst($filename, '/', '-', 'G') + $filename_no_specialchars = regsubst($filename_no_slashes, '[\.\+]', '_', 'G') + $sources_list_d_filename = "${filename_no_specialchars}.list" + + if $ensure == 'present' { + if $package_manage { + ensure_packages($package_name) + $_require = [File['sources.list.d'], Package[$package_name]] + } else { + $_require = File['sources.list.d'] + } + + $_proxy = $::apt::_proxy + if $_proxy['host'] { + if $_proxy['https'] { + $_proxy_env = ["http_proxy=http://${$_proxy['host']}:${$_proxy['port']}", "https_proxy=https://${$_proxy['host']}:${$_proxy['port']}"] + } else { + $_proxy_env = ["http_proxy=http://${$_proxy['host']}:${$_proxy['port']}"] + } + } else { + $_proxy_env = [] + } + + exec { "add-apt-repository-${name}": + environment => $_proxy_env, + command => "/usr/bin/add-apt-repository ${options} ${name}", + unless => "/usr/bin/test -f ${::apt::sources_list_d}/${sources_list_d_filename}", + user => 'root', + logoutput => 'on_failure', + notify => Class['apt::update'], + require => $_require, + } + + file { "${::apt::sources_list_d}/${sources_list_d_filename}": + ensure => file, + require => Exec["add-apt-repository-${name}"], + } + } + else { + file { "${::apt::sources_list_d}/${sources_list_d_filename}": + ensure => 'absent', + notify => Class['apt::update'], + } + } +} diff --git a/code/environments/production/modules/apt/manifests/setting.pp b/code/environments/production/modules/apt/manifests/setting.pp new file mode 100644 index 0000000..a7b11c4 --- /dev/null +++ b/code/environments/production/modules/apt/manifests/setting.pp @@ -0,0 +1,57 @@ +# Defining apt settings +define apt::setting ( + Variant[String, Integer, Array] $priority = 50, + Optional[Enum['file', 'present', 'absent']] $ensure = file, + Optional[String] $source = undef, + Optional[String] $content = undef, + Boolean $notify_update = true, +) { + + if $content and $source { + fail('apt::setting cannot have both content and source') + } + + if !$content and !$source { + fail('apt::setting needs either of content or source') + } + + $title_array = split($title, '-') + $setting_type = $title_array[0] + $base_name = join(delete_at($title_array, 0), '-') + + assert_type(Pattern[/\Aconf\z/, /\Apref\z/, /\Alist\z/], $setting_type) |$a, $b| { + fail("apt::setting resource name/title must start with either 'conf-', 'pref-' or 'list-'") + } + + if $priority !~ Integer { + # need this to allow zero-padded priority. + assert_type(Pattern[/^\d+$/], $priority) |$a, $b| { + fail('apt::setting priority must be an integer or a zero-padded integer') + } + } + + if ($setting_type == 'list') or ($setting_type == 'pref') { + $_priority = '' + } else { + $_priority = $priority + } + + $_path = $::apt::config_files[$setting_type]['path'] + $_ext = $::apt::config_files[$setting_type]['ext'] + + if $notify_update { + $_notify = Class['apt::update'] + } else { + $_notify = undef + } + + file { "${_path}/${_priority}${base_name}${_ext}": + ensure => $ensure, + owner => 'root', + group => 'root', + mode => '0644', + content => $content, + source => $source, + notify => $_notify, + } +} diff --git a/code/environments/production/modules/apt/manifests/source.pp b/code/environments/production/modules/apt/manifests/source.pp new file mode 100644 index 0000000..54295b5 --- /dev/null +++ b/code/environments/production/modules/apt/manifests/source.pp @@ -0,0 +1,109 @@ +# source.pp +# add an apt source +define apt::source( + Optional[String] $location = undef, + String $comment = $name, + String $ensure = present, + Optional[String] $release = undef, + String $repos = 'main', + Optional[Variant[Hash]] $include = {}, + Optional[Variant[String, Hash]] $key = undef, + Optional[Variant[Hash, Numeric, String]] $pin = undef, + Optional[String] $architecture = undef, + Boolean $allow_unsigned = false, + Boolean $notify_update = true, +) { + + # This is needed for compat with 1.8.x + include ::apt + + $_before = Apt::Setting["list-${title}"] + + if !$release { + if $facts['lsbdistcodename'] { + $_release = $facts['lsbdistcodename'] + } else { + fail('lsbdistcodename fact not available: release parameter required') + } + } else { + $_release = $release + } + + # Some releases do not support https transport with default installation + $_transport_https_releases = [ 'wheezy', 'jessie', 'stretch', 'trusty', 'xenial' ] + + if $ensure == 'present' { + if ! $location { + fail('cannot create a source entry without specifying a location') + } elsif $_release in $_transport_https_releases { + $method = split($location, '[:\/]+')[0] + if $method == 'https' { + ensure_packages('apt-transport-https') + } + } + } + + $includes = merge($::apt::include_defaults, $include) + + if $key { + if $key =~ Hash { + unless $key['id'] { + fail('key hash must contain at least an id entry') + } + $_key = merge($::apt::source_key_defaults, $key) + } else { + $_key = { 'id' => assert_type(String[1], $key) } + } + } + + $header = epp('apt/_header.epp') + + $sourcelist = epp('apt/source.list.epp', { + 'comment' => $comment, + 'includes' => $includes, + 'opt_architecture' => $architecture, + 'allow_unsigned' => $allow_unsigned, + 'location' => $location, + 'release' => $_release, + 'repos' => $repos, + }) + + apt::setting { "list-${name}": + ensure => $ensure, + content => "${header}${sourcelist}", + notify_update => $notify_update, + } + + if $pin { + if $pin =~ Hash { + $_pin = merge($pin, { 'ensure' => $ensure, 'before' => $_before }) + } elsif ($pin =~ Numeric or $pin =~ String) { + $url_split = split($location, '[:\/]+') + $host = $url_split[1] + $_pin = { + 'ensure' => $ensure, + 'priority' => $pin, + 'before' => $_before, + 'origin' => $host, + } + } else { + fail('Received invalid value for pin parameter') + } + create_resources('apt::pin', { "${name}" => $_pin }) + } + + # We do not want to remove keys when the source is absent. + if $key and ($ensure == 'present') { + if $_key =~ Hash { + apt::key { "Add key: ${$_key['id']} from Apt::Source ${title}": + ensure => present, + id => $_key['id'], + server => $_key['server'], + content => $_key['content'], + source => $_key['source'], + options => $_key['options'], + before => $_before, + } + } + } +} diff --git a/code/environments/production/modules/apt/manifests/update.pp b/code/environments/production/modules/apt/manifests/update.pp new file mode 100644 index 0000000..00e0600 --- /dev/null +++ b/code/environments/production/modules/apt/manifests/update.pp @@ -0,0 +1,65 @@ +# Defining apt update +class apt::update { + assert_private() + + #TODO: to catch if $::apt_update_last_success has the value of -1 here. If we + #opt to do this, a info/warn would likely be all you'd need likely to happen + #on the first run, but if it's not run in awhile something is likely borked + #with apt and we'd want to know about it. + + case $::apt::_update['frequency'] { + 'always': { + $_kick_apt = true + } + 'daily': { + #compare current date with the apt_update_last_success fact to determine + #if we should kick apt_update. + $daily_threshold = (strftime('%s') - 86400) + if $::apt_update_last_success { + if $::apt_update_last_success + 0 < $daily_threshold { + $_kick_apt = true + } else { + $_kick_apt = false + } + } else { + #if apt-get update has not successfully run, we should kick apt_update + $_kick_apt = true + } + } + 'weekly':{ + #compare current date with the apt_update_last_success fact to determine + #if we should kick apt_update. + $weekly_threshold = (strftime('%s') - 604800) + if $::apt_update_last_success { + if ( $::apt_update_last_success + 0 < $weekly_threshold ) { + $_kick_apt = true + } else { + $_kick_apt = false + } + } else { + #if apt-get update has not successfully run, we should kick apt_update + $_kick_apt = true + } + } + default: { + #catches 'reluctantly', and any other value (which should not occur). + #do nothing. + $_kick_apt = false + } + } + + if $_kick_apt { + $_refresh = false + } else { + $_refresh = true + } + exec { 'apt_update': + command => "${::apt::provider} update", + loglevel => $::apt::_update['loglevel'], + logoutput => 'on_failure', + refreshonly => $_refresh, + timeout => $::apt::_update['timeout'], + tries => $::apt::_update['tries'], + try_sleep => 1 + } +} diff --git a/code/environments/production/modules/apt/metadata.json b/code/environments/production/modules/apt/metadata.json new file mode 100644 index 0000000..d5cd483 --- /dev/null +++ b/code/environments/production/modules/apt/metadata.json @@ -0,0 +1,41 @@ +{ + "name": "puppetlabs-apt", + "version": "4.5.1", + "author": "Puppet Labs", + "summary": "Provides an interface for managing Apt source, key, and definitions with Puppet", + "license": "Apache-2.0", + "source": "https://github.com/puppetlabs/puppetlabs-apt", + "project_page": "https://github.com/puppetlabs/puppetlabs-apt", + "issues_url": "https://tickets.puppetlabs.com/browse/MODULES", + "dependencies": [ + { + "name": "puppetlabs/stdlib", + "version_requirement": ">= 4.16.0 < 5.0.0" + } + ], + "data_provider": null, + "operatingsystem_support": [ + { + "operatingsystem": "Debian", + "operatingsystemrelease": [ + "7", + "8" + ] + }, + { + "operatingsystem": "Ubuntu", + "operatingsystemrelease": [ + "14.04", + "16.04" + ] + } + ], + "requirements": [ + { + "name": "puppet", + "version_requirement": ">= 4.7.0 < 6.0.0" + } + ], + "template-url": "file:///opt/puppetlabs/pdk/share/cache/pdk-templates.git", + "template-ref": "1.3.2-0-g07678c8" +} diff --git a/code/environments/production/modules/apt/spec/acceptance/apt_key_provider_spec.rb b/code/environments/production/modules/apt/spec/acceptance/apt_key_provider_spec.rb new file mode 100644 index 0000000..08bf61f --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/apt_key_provider_spec.rb @@ -0,0 +1,836 @@ +require 'spec_helper_acceptance' + +PUPPETLABS_GPG_KEY_SHORT_ID = 'EF8D349F'.freeze +PUPPETLABS_GPG_KEY_LONG_ID = '7F438280EF8D349F'.freeze +PUPPETLABS_GPG_KEY_FINGERPRINT = '6F6B15509CF8E59E6E469F327F438280EF8D349F'.freeze +PUPPETLABS_APT_URL = 'apt.puppetlabs.com'.freeze +PUPPETLABS_GPG_KEY_FILE = 'DEB-GPG-KEY-puppet'.freeze +CENTOS_GPG_KEY_SHORT_ID = 'C105B9DE'.freeze +CENTOS_GPG_KEY_LONG_ID = '0946FCA2C105B9DE'.freeze +CENTOS_GPG_KEY_FINGERPRINT = 'C1DAC52D1664E8A4386DBA430946FCA2C105B9DE'.freeze +CENTOS_REPO_URL = 'ftp.cvut.cz/centos'.freeze +CENTOS_GPG_KEY_FILE = 'RPM-GPG-KEY-CentOS-6'.freeze + +SHOULD_NEVER_EXIST_ID = 'EF8D349F'.freeze + +KEY_CHECK_COMMAND = 'apt-key adv --list-keys --with-colons --fingerprint | grep '.freeze +PUPPETLABS_KEY_CHECK_COMMAND = "#{KEY_CHECK_COMMAND} #{PUPPETLABS_GPG_KEY_FINGERPRINT}".freeze +CENTOS_KEY_CHECK_COMMAND = "#{KEY_CHECK_COMMAND} #{CENTOS_GPG_KEY_FINGERPRINT}".freeze + +MAX_TIMEOUT_RETRY = 3 +TIMEOUT_RETRY_WAIT = 5 +TIMEOUT_ERROR_MATCHER = %r{no valid OpenPGP data found} + +def populate_default_options_pp(value) + default_options_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{value}', + ensure => 'present', + } + MANIFEST + default_options_pp +end + +def install_key(key) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + shell("apt-key adv --keyserver hkps.pool.sks-keyservers.net \ + --recv-keys #{key}") + end +end + +def apply_manifest_twice(manifest_pp) + apply_manifest(manifest_pp, catch_failures: true) + apply_manifest(manifest_pp, catch_changes: true) +end + +invalid_key_length_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '8280EF8D349F', + } + MANIFEST + +ensure_absent_pp = <<-MANIFEST + apt_key { 'centos': + id => '#{CENTOS_GPG_KEY_LONG_ID}', + ensure => 'absent', + } + MANIFEST + +ensure_absent_long_key_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'absent', + } + MANIFEST + +gpg_key_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_FINGERPRINT}', + ensure => 'present', + content => "-----BEGIN PGP PUBLIC KEY BLOCK----- + + mQINBFe2Iz4BEADqbv/nWmR26bsivTDOLqrfBEvRu9kSfDMzYh9Bmik1A8Z036Eg + h5+TZD8Rrd5TErLQ6eZFmQXk9yKFoa9/C4aBjmsL/u0yeMmVb7/66i+x3eAYGLzV + FyunArjtefZyxq0B2mdRHE8kwl5XGl8015T5RGHCTEhpX14O9yigI7gtliRoZcl3 + hfXtedcvweOf9VrV+t5LF4PrZejom8VcB5CE2pdQ+23KZD48+Cx/sHSLHDtahOTQ + 5HgwOLK7rBll8djFgIqP/UvhOqnZGIsg4MzTvWd/vwanocfY8BPwwodpX6rPUrD2 + aXPsaPeM3Q0juDnJT03c4i0jwCoYPg865sqBBrpOQyefxWD6UzGKYkZbaKeobrTB + xUKUlaz5agSK12j4N+cqVuZUBAWcokXLRrcftt55B8jz/Mwhx8kl6Qtrnzco9tBG + T5JN5vXMkETDjN/TqfB0D0OsLTYOp3jj4hpMpG377Q+6D71YuwfAsikfnpUtEBxe + NixXuKAIqrgG8trfODV+yYYWzfdM2vuuYiZW9pGAdm8ao+JalDZss3HL7oVYXSJp + MIjjhi78beuNflkdL76ACy81t2TvpxoPoUIG098kW3xd720oqQkyWJTgM+wV96bD + ycmRgNQpvqHYKWtZIyZCTzKzTTIdqg/sbE/D8cHGmoy0eHUDshcE0EtxsQARAQAB + tEhQdXBwZXQsIEluYy4gUmVsZWFzZSBLZXkgKFB1cHBldCwgSW5jLiBSZWxlYXNl + IEtleSkgPHJlbGVhc2VAcHVwcGV0LmNvbT6JAj4EEwECACgFAle2Iz4CGwMFCQlm + AYAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEH9DgoDvjTSfIN0P/jcCRzK8 + WIdhcNz5dkj7xRZb8Oft2yDfenQmzb1SwGGa96IwJFcjF4Nq7ymcDUqunS2DEDb2 + gCucsqmW1ubkaggsYbc9voz/SQwhsQpBjfWbuyOX9DWmW6av/aB1F85wP79gyfqT + uidTGxQE6EhDbLe7tuvxOHfM1bKsUtI+0n9TALLLHfXUEdtaXCwMlJuO1IIn1PWa + H7HzyEjw6OW/cy73oM9nuErBIio1O60slPLOW2XNhdWZJCRWkcXyuumRjoepz7WN + 1JgsLOTcB7rcQaBP3pDN0O/Om5dlDQ6oYitoJs/F0gfEgwK68Uy8k8sUR+FLLJqM + o0CwOg6CeWU4ShAEd1xZxVYW6VOOKlz9x9dvjIVDn2SlTBDmLS99ySlQS57rjGPf + GwlRUnuZP4OeSuoFNNJNb9PO6XFSP66eNHFbEpIoBU7phBzwWpTXNsW+kAcY8Rno + 8GzKR/2FRsxe5Nhfh8xy88U7BA0tqxWdqpk/ym+wDcgHBfSRt0dPFnbaHAiMRlgX + J/NPHBQtkoEdQTKA+ICxcNTUMvsPDQgZcU1/ViLMN+6kZaGNDVcPeMgDvqxu0e/T + b3uYiId38HYbHmD6rDrOQL/2VPPXbdGbxDGQUgX1DfdOuFXw1hSTilwI1KdXxUXD + sCsZbchgliqGcI1l2En62+6pI2x5XQqqiJ7+uQINBFe2Iz4BEADzbs8WhdBxBa0t + JBl4Vz0brDgU3YDqNkqnra/T17kVPI7s27VEhoHERmZJ17pKqb2pElpr9mN/FzuN + 0N9wvUaumd9gxzsOCam7DPTmuSIvwysk391mjCJkboo01bhuVXe2FBkgOPFzAJEH + YFPxmu7tWOmCxNYiuuYtxLywU7lC/Zp6CZuq57xJqUWK47I5wDK9/iigkwSb3nDs + 6A2LpkDmCr+rcOwLh5bxDSei7vYW+3TNOkPlC/h6fO9dPeC9AfyW6qPdVFQq1mpZ + Zcj1ALz7zFiciIB4NrD3PTjDlRnaJCWKPafVSsMbyIWmQaJ01ifuE0Owianrau8c + I264VXmI5pA9C8k9f2aVBuJiLsXaLEb03CzFWz9JpBLttA9ccaam3feU2EmnC3sb + 9xD+Ibkxq5mKFN3lEzUAAIqbI1QYGZXPgLxMY7JSvoUxAqeHwpf/dO2LIUqYUpx0 + bF/GWRV9Uql8omNQbhwP0p2X/0Gfxj9Abg2IJM8LeOu3Xk0HACwwyVXgxcgk5FO+ + +KZpTN3iynjmbIzB9qcd9TeSzjVh/RDPSdn5K6Ao5ynubGYmaPwCk+DdVBRDlgWo + 7yNIF4N9rFuSMAEJxA1nS5TYFgIN9oDF3/GHngVGfFCv4EG3yS08Hk1tDV0biKdK + ypcx402TAwVRWP5Pzmxc6/ZXU4ZhZQARAQABiQIlBBgBAgAPBQJXtiM+AhsMBQkJ + ZgGAAAoJEH9DgoDvjTSfbWYQALwafIQK9avVNIuhMsyYPa/yHf6rUOLqrYO1GCmj + vyG4cYmryzdxyfcXEmuE5QAIbEKSISrcO6Nvjt9PwLCjR/dUvco0f0YFTPv+kamn + +Bwp2Zt6d3MenXC6mLXPHR4OqFjzCpUT8kFwycvGPsuqZQ/CO0qzLDmAGTY+4ly3 + 9aQEsQyFhV3P+6SWnaC2TldWpfG/2pCSaSa8dbYbRe3SUNKXwT8kw3WoQYNofF6n + or8oFVA+UIVlvHc5h7L3tfFylRy5CwtR5rBQtoBicRVxEQc7ARNmB1XWuPntMQl/ + N1Fcfc+KSILFblAR6eVv+6BhMvRqzxqe81AEAP+oKVVwJ7H+wTQun2UKAgZATDWP + /LQsYinmLADpraDPqxT2WJe8kjszMDQZCK+jhsVrhZdkiw9EHAM0z7BKz6JERmLu + TIEcickkTfzbJWXZgv40Bvl99yPMswnR1lQHD7TKxyHYrI7dzJQri4mbORg4lOnZ + 3Tyodv21Ocf4as2No1p6esZW+M46zjZeO8zzExmmENI2+P7/VUt+LWyQFiqRM0iW + zGioYMWgVePywFGaTV51/0uF9ymHHC7BDIcLgUWHdg/1B67jR5YQfzPJUqLhnylt + 1sjDRQIlf+3U+ddvre2YxX/rYUI2gBT32QzQrv016KsiZO+N+Iya3B4D68s6xxQS + 3xJn + =mMjt + -----END PGP PUBLIC KEY BLOCK-----", + } + MANIFEST + +multiple_keys_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_FINGERPRINT}', + ensure => 'present', + content => "-----BEGIN PGP PUBLIC KEY BLOCK----- + Version: GnuPG v1 + + mQINBEw3u0ABEAC1+aJQpU59fwZ4mxFjqNCgfZgDhONDSYQFMRnYC1dzBpJHzI6b + fUBQeaZ8rh6N4kZ+wq1eL86YDXkCt4sCvNTP0eF2XaOLbmxtV9bdpTIBep9bQiKg + 5iZaz+brUZlFk/MyJ0Yz//VQ68N1uvXccmD6uxQsVO+gx7rnarg/BGuCNaVtGwy+ + S98g8Begwxs9JmGa8pMCcSxtC7fAfAEZ02cYyrw5KfBvFI3cHDdBqrEJQKwKeLKY + GHK3+H1TM4ZMxPsLuR/XKCbvTyl+OCPxU2OxPjufAxLlr8BWUzgJv6ztPe9imqpH + Ppp3KuLFNorjPqWY5jSgKl94W/CO2x591e++a1PhwUn7iVUwVVe+mOEWnK5+Fd0v + VMQebYCXS+3dNf6gxSvhz8etpw20T9Ytg4EdhLvCJRV/pYlqhcq+E9le1jFOHOc0 + Nc5FQweUtHGaNVyn8S1hvnvWJBMxpXq+Bezfk3X8PhPT/l9O2lLFOOO08jo0OYiI + wrjhMQQOOSZOb3vBRvBZNnnxPrcdjUUm/9cVB8VcgI5KFhG7hmMCwH70tpUWcZCN + NlI1wj/PJ7Tlxjy44f1o4CQ5FxuozkiITJvh9CTg+k3wEmiaGz65w9jRl9ny2gEl + f4CR5+ba+w2dpuDeMwiHJIs5JsGyJjmA5/0xytB7QvgMs2q25vWhygsmUQARAQAB + tEdQdXBwZXQgTGFicyBSZWxlYXNlIEtleSAoUHVwcGV0IExhYnMgUmVsZWFzZSBL + ZXkpIDxpbmZvQHB1cHBldGxhYnMuY29tPokBHAQQAQIABgUCTDfARgAKCRAhWv5Q + 5BRwMq8TCACgG44+c+KgHBinygdU9Oj/r1wmfXbbmR+tpRgZ5sJytHC6gp3wjKFH + XrmddgmYPzKsAUGTxJxRUqxD+lKeo2sEKuXNAPo1C+4hZUV6Ah2N1qytZfpLOP43 + U6WVvMgluQTl6jRaMIwQolUj8ZNjYCdNZQCbfo8tALkedIBPKSrDF5kOwn+zxFyR + 3v5A3mwFXK0bepvjlDuMsmktwk7opgfivP1mA3svPLIZu70PKk+u6UAMb06svt6V + SewYMbgTUzw+SCT1e/0xEpqjUqNgsPnPE6hW116goRB2cz6VYwmKfVe+ioljsVMM + mTqj5xWqoeR0ov6yCyxwVVCWOAIR3QSAiQEcBBABAgAGBQJUCeGFAAoJEBM5V+oR + Ao3zE3AH/1GQTS4JX3kS3WXE2Pi8L+gGylfYsf1dDbaDBX8mPfxKO6usZZmX9fIu + qQwQDIEksGrdcb6nrGecHufJDbLmFZiE77LjjoREFlG9tEyaIAVSCw/vyng9wVo8 + InDF7j1VHuUueh6eu+yvLjUrFuh3CVNHcx2rEIFzx+X5660TbbRfMgxLpTMkkb4w + 7DQjCUmFQD4yLzZzXAzjELc/TgsFGZc3lxo7UuzwX0ZEm15WjrdYwvtMU1TGjjI2 + 6dgk24K3Kb2OeUnCybQ1mLx6qVx0aFd21beKRG9u3Stp8HHXpfLh/aznbCY5JavO + ShOXgNgq3f0/UImLjyuFv27x0HQFxfeJARwEEAEKAAYFAlQHuw4ACgkQpHBvotfb + FDW/pwf+J6JBPpUHi/EsuLLbqDTQjGbnMTsH35pZRApKheaISPRZH8oqgdmWE599 + 6e5GwnXMoBJoUvU0VbcO7aEarWlKmO6dpTKsfvjP+PtiSBeXUa8ewNcTq5N0Z7O5 + IwF2CiHrSTEcySjjboMKJHS/vQCmsLg1j+MA7wq3quzX0vQsGBX3X1x+n2KOH4s8 + BGoXFJs6sM1SInnqkPwryCesj61zc9I72kTM6IsG17X586INWMHoMDzpF/hTWKKw + 2c0kFMDIJDpU+KBKr/e4mbKrp8ToP64GjB0MOx6MqjZI6I3k1PQu8zgWmOQ+yQhI + e/UfB8u+eGbhDwUMqKBEHUzV3b5lj4kCHAQQAQIABgUCUeTczgAKCRBKMwua1kj6 + 4/mED/9RNl8PfjS6SKnqM+UzPHBIP9BqnC07sPiCwZOxd7MOQ73sPbV3Wk1o1PRG + tcAxqDCTUSUPGaf9gdQN8yi9lrZspqCNaZXfzGRaz4+uHU/ji9QMbfQIBTopn6ZM + YtRuiV868N98JOb0yfWLaTEVonFtWFZHrNHbwplHbyzUgGyup5MKSxh90p2S7DX+ + PznSFbwwzeE8En/jxUvHlAQV+eVfC3V+n4vKAC+sjInDu8m2xr1CMIiRCTa1y/vu + uGSJnoAO2GBUjHmPfINZKbicuoWnBtBMqs1GsJvldsv+ggx4cm4UgJvYdyQNLUq4 + pceaq8O4uhGvT/AURkymzldB6+iZRrsmQx5LmP0C5sIbiDXMoS089oYOx8MoGWMI + cErBTKxCPmgZTnDxW+U4+dLrYMF+yBTbLmKmaYhNiSNI4votfA7rEbn+zEDxzKgl + KZs3bzqKZxjoAeWhOKK7r83tSz4I2uHD9XscC6fnp61YGfdtlYJEYYA8XeomvjLa + xQxjQTcdrs48Qcgp8FvgyImelee1ZPbydB8Xd2VMVO2EDPBydlyHHZ6zjKt8Neff + djh6KyrFYJtOW4StdSiBQQofUqiFJq1gy3F6dy/ttSXMivbbNJQJjJV/1zKDnSQH + L7Qnux4SmobkrlHzP2z/rcFPk6CGaLpsHazmIrl8G3dO7UhinIkCHAQQAQIABgUC + VAesWAAKCRBGnps2mw8PHet2EACTyXdYh4kXGgSwQpY8hUJwd9FPrXPyYMTfeJFq + kIBpG/q60Q72Kqvn0AqUSmnROoKzPnwYW/jE+89tx1JBAT+8EtRAJvJaNH9Hovw4 + S3GV5wqImdsmIqJUxl8lh9moB9zfpsqWz2Laa1Xn/TGwmLl/zFL0PWQ4rv8r6pZ/ + OhEE/pnqZDLh/+6PxYmQRsIvDfmeVd57XSYLnT6JNXkAYBnmMouw+L7b2B9LWMIs + 10lfjdOCplNE1FCTFS7K/j13x8Cyul6yF6eeq+rd5ftcw84XW+1qh3Jsw4bSNc0Z + LvGh7zgRznEWhxZrcGzWwtxnEG1aW7wXiDJ/kqAvBNP1LOhIQQH2NVp3oRW+hB1o + Cb/pbIht3xin7g5EJ0cpplTKNvfVdcitIflpgV9CT51oNkV7dVCtkXbFxwGdxP1L + CnYmfJ8IBumX6a3ue741E1tHHp2dZOHXWiMUI6TjYISQjx4KiiFTXJRpMsm5AQDi + ps+TSnF5TsNJ4776aAhP0hTN6Wy864NRoWEPs9OHltmZFCHzzTixQZrNxaUvLALP + vCmQ++U8f4mxD1+/eLXSzcfWolUoqyneTH/DEWpYXaoE5NalLfmoH7WxCR32LXWR + tJ748SZXI5SFjOzIzLsFr/qq36hGqDb7fqsc4LSz8uvJYo7vAdvkSUL2mkHeX4lD + QzwR/4kCHAQQAQgABgUCTPlA6QAKCRBcE9bbkwUuAxdYD/40FxAeNCYByxkr/XRT + 0gFT+NCjPuqPWCM5tf2NIhSapXtb2+32WbAfDzVfqWjC0G0RnQBve+vcjpY4/rJu + 4VKIDGIT8CtnKOIyEcXTNFOehi65xO4ypaeiBPSb3ip3P0of1iZZDQrNHMW5VcyL + 1c+PWT/6exXSGsePtO/89tc6mupqZtC05f5ZXG4jswMF0U6Q5s3S0tG7Y+oQhKNF + JS4sH4rHe1o5CxKwNRSzqccA0hptKy3MHUZ2+zeHzuRdRWGjb2rUiVxnIvPPBGxF + 2JHhB4ERhGgbTxRZ6wZbdW06BOE8r7pGrUpUfCw/WRT3gGXJHpGPOzFAvr3Xl7Vc + DUKTVmIajnpd3SoyD1t2XsvJlSQBOWbViucHdvE4SIKQ77vBLRlZIoXXVb6Wu7Vq + +eQs1ybjwGOhnnKjz8llXcMnLzzN86STpjN4qGTXQy/E9+dyUP1sXn3RRwb+ZkdI + 77m1YY95QRNgG/hqh77IuWWg1MtTSgQnP+F27mfo0/522hObhdAe73VO3ttEPiri + Wy7tw3bS9daP2TAVbYyFqkvptkBb1OXRUSzqUuWjBmZ35UlXjKQsGeUHlOiEh84a + ondF90A7gx0X/ktNIPRrfCGkHJcDu+HVnR7xKk+F0qb9+/pGLiT3rqeQTr8fYsb4 + xLHT7uEg1gVFB1g0kd+RQHzV74kCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoLBBYC + AwECHgECF4AFAk/x5PoFCQtIMjoACgkQEFS3okvW7DAIKQ/9HvZyf+LHVSkCk92K + b6gckniin3+5ooz67hSr8miGBfK4eocqQ0H7bdtWjAILzR/IBY0xj6OHKhYP2k8T + Lc7QhQjt0dRpNkX+Iton2AZryV7vUADreYz44B0bPmhiE+LL46ET5IThLKu/Kfih + zkEEBa9/t178+dO9zCM2xsXaiDhMOxVE32gXvSZKP3hmvnK/FdylUY3nWtPedr+l + HpBLoHGaPH7cjI+MEEugU3oAJ0jpq3V8n4w0jIq2V77wfmbD9byIV7dXcxApzciK + +ekwpQNQMSaceuxLlTZKcdSqo0/qmS2A863YZQ0ZBe+Xyf5OI33+y+Mry+vl6Lre + 2VfPm3udgR10E4tWXJ9Q2CmG+zNPWt73U1FD7xBI7PPvOlyzCX4QJhy2Fn/fvzaN + jHp4/FSiCw0HvX01epcersyun3xxPkRIjwwRM9m5MJ0o4hhPfa97zibXSh8XXBno + sBQxeg6nEnb26eorVQbqGx0ruu/W2m5/JpUfREsFmNOBUbi8xlKNS5CZypH3Zh88 + EZiTFolOMEh+hT6s0l6znBAGGZ4m/Unacm5yDHmg7unCk4JyVopQ2KHMoqG886el + u+rm0ASkhyqBAk9sWKptMl3NHiYTRE/m9VAkugVIB2pi+8u84f+an4Hml4xlyijg + Yu05pqNvnLRyJDLd61hviLC8GYWJAj4EEwECACgFAkw3u0ACGwMFCQPCZwAGCwkI + BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEBBUt6JL1uwwGWsP/2i5hP3qG6V6SFFc + glFkMRLz7TP4f0gCbBtyqBzfbttensLPlB7C/+xfdXHlV0EHQ9nvArWFhXizTNEU + jPYvyjOtIOAryEJZjanaoYtR7IBqiJ2e9v1ywF7p9IGm3wt+qy8MNpHpfmjKUX+f + Eq0rrJGN9tTZzBCZeDrB1doXzbQCIMNnv85vUYaDKRisaB2QrxYZz+7tjNsDKu4j + Qw1m+nVbC6c3ZVX9uNswm7mzwscUFzqQOeq85FD7ifOZnVcOItfaDyBSGVS+aMIr + dUsQjsQYOG/KGjEt+oRJd6rWRvN+K7S33KgJqo4cemibiSzgGDfOEIwxFNzSOSHz + UTL5biHk3A+A7eRQmGoTdOObVtUXOrORgEfEVuORmMEA8xvpJJHnhscBIaglu5zh + 7sGSKFSbnzYXdvFBZ/NyhiRwkLeDQQa9yuU3GOmw0BCK6UqZVkgwW3d6dSGqGWNV + kg3T/Tk1Tkm7M9CYoJVplFhlgnXfwjElvw+/91VDiTmEQ8Kbb7UmHIyXPNVFftcw + fq7eS2vzlnuFDjkQ/o1NQE4o0BGhWMQW6gQZBW6ABF6vW7UUMnoKpPnlaR4c2nD+ + TWBUzE4bx7k2qTcrXArKOWrv3DMsKgoGNQ33DCco6HLuGwrawHesOJBijTFHcDQ2 + ELpR2QyPlIySJ4a2psp4Hc2S43XhiQI+BBMBAgAoAhsDBgsJCAcDAgYVCAIJCgsE + FgIDAQIeAQIXgAUCVwb4BQUJDDXSzQAKCRAQVLeiS9bsMLwBEACtdY+PvfNw8SFu + RpIM2rvdjGsEfJPKpUK5Dx90m1NSVyhMwQeYLdBb0GGgeGjjX8E5kCqhsD53VPWH + AD13nPc3zCeiDJiwpjYXeuGIH7AOG+gZZDLdy14myEN0JQIXQslOK8SiaTn/yI4s + 2Lrje0Ubf6wbJ3uX9MwsqIkugkJrYn9e1BC1uPgESbE1SjiIbB4iL8lrxE6fdyxc + QnUEzneOFQ9kScfPc/M5U9COMuQOuoefiAEh+FRrjxf9ag3NzecTlwk/EdpgmfSj + a+ClS+BJv83zYForrHRfUU1SDiueuWXAH1OTaUpAsZIiXpigTB4X3hLJXB1iKoA1 + TEM/9bZGPdJsS1mwUUy3ukDW1rhOodxojhN1XhT3f7X9Cl8lKxKw1tloRijfL3n4 + njwk6hEyKaURTo4iOs12HDlBZV3zhWONNZTvqrFMkz4OB+q8RGpfO8G4Mbba+fNQ + 2At+cAWmGCoZeX3KfyRtqYe6vtKJf5ptQZgjl3EFPl6OxKjopzomB7o9lXbxARgO + 6Pf9NSyYwlv0sNfy88N5iSsa7Sw7yi9t9tO5KFGoGYLmXXgyjvNZrE8KMh6/hJOW + HsW19noVdogd73q+gjRAl+eZ4J1nKpbSPkbufNoD8uB/j3rr5/sRJrtvVnMTJXwC + iTItalyg7XRJSQ9kAqzvRlxdGobo95kCDQRXtiM+ARAA6m7/51pkdum7Ir0wzi6q + 3wRL0bvZEnwzM2IfQZopNQPGdN+hIIefk2Q/Ea3eUxKy0OnmRZkF5PcihaGvfwuG + gY5rC/7tMnjJlW+/+uovsd3gGBi81RcrpwK47Xn2csatAdpnURxPJMJeVxpfNNeU + +URhwkxIaV9eDvcooCO4LZYkaGXJd4X17XnXL8Hjn/Va1freSxeD62Xo6JvFXAeQ + hNqXUPttymQ+PPgsf7B0ixw7WoTk0OR4MDiyu6wZZfHYxYCKj/1L4Tqp2RiLIODM + 071nf78Gp6HH2PAT8MKHaV+qz1Kw9mlz7Gj3jN0NI7g5yU9N3OItI8AqGD4POubK + gQa6TkMnn8Vg+lMximJGW2inqG60wcVClJWs+WoEitdo+DfnKlbmVAQFnKJFy0a3 + H7beeQfI8/zMIcfJJekLa583KPbQRk+STeb1zJBEw4zf06nwdA9DrC02Dqd44+Ia + TKRt++0Pug+9WLsHwLIpH56VLRAcXjYsV7igCKq4BvLa3zg1fsmGFs33TNr7rmIm + VvaRgHZvGqPiWpQ2bLNxy+6FWF0iaTCI44Yu/G3rjX5ZHS++gAsvNbdk76caD6FC + BtPfJFt8Xe9tKKkJMliU4DPsFfemw8nJkYDUKb6h2ClrWSMmQk8ys00yHaoP7GxP + w/HBxpqMtHh1A7IXBNBLcbEAEQEAAbRIUHVwcGV0LCBJbmMuIFJlbGVhc2UgS2V5 + IChQdXBwZXQsIEluYy4gUmVsZWFzZSBLZXkpIDxyZWxlYXNlQHB1cHBldC5jb20+ + iQI+BBMBAgAoBQJXtiM+AhsDBQkJZgGABgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIX + gAAKCRB/Q4KA7400nyDdD/43AkcyvFiHYXDc+XZI+8UWW/Dn7dsg33p0Js29UsBh + mveiMCRXIxeDau8pnA1Krp0tgxA29oArnLKpltbm5GoILGG3Pb6M/0kMIbEKQY31 + m7sjl/Q1plumr/2gdRfOcD+/YMn6k7onUxsUBOhIQ2y3u7br8Th3zNWyrFLSPtJ/ + UwCyyx311BHbWlwsDJSbjtSCJ9T1mh+x88hI8Ojlv3Mu96DPZ7hKwSIqNTutLJTy + zltlzYXVmSQkVpHF8rrpkY6Hqc+1jdSYLCzk3Ae63EGgT96QzdDvzpuXZQ0OqGIr + aCbPxdIHxIMCuvFMvJPLFEfhSyyajKNAsDoOgnllOEoQBHdcWcVWFulTjipc/cfX + b4yFQ59kpUwQ5i0vfckpUEue64xj3xsJUVJ7mT+DnkrqBTTSTW/TzulxUj+unjRx + WxKSKAVO6YQc8FqU1zbFvpAHGPEZ6PBsykf9hUbMXuTYX4fMcvPFOwQNLasVnaqZ + P8pvsA3IBwX0kbdHTxZ22hwIjEZYFyfzTxwULZKBHUEygPiAsXDU1DL7Dw0IGXFN + f1YizDfupGWhjQ1XD3jIA76sbtHv0297mIiHd/B2Gx5g+qw6zkC/9lTz123Rm8Qx + kFIF9Q33TrhV8NYUk4pcCNSnV8VFw7ArGW3IYJYqhnCNZdhJ+tvuqSNseV0Kqoie + /okBHAQQAQoABgUCV7d12AAKCRATOVfqEQKN8xl+B/0cdW8EhjyBXFWi4B0RzVXR + TIi5vUEe2mL+/cwt/qD70VJbe6Vy2X1VwGX5QrpMtjSnouGAa7aMU+oYXlzz+RPW + MtJTWMMVgOidRnAWw61wFAabZLFyJfVUg/QxI/sUQYkA3VC1XxSHLK+bjfglULRC + Q+JKpuK2D1jz0SrJhQtX6IGkVmT0t1tlwMUWhW3EIuHpc8TwvgxP0wjg8KLd01vK + KJTRLNb6Z3pFlT8rEF0Cw5LFReJM8i4+w1DqIy18xMkuDh09WBJhhCUH8LIHgGlz + D5p3fRmbtkW6T/wpjP2XR+eiGABJ0nr4WTDAwWn9SxnjXapp/QvKd+lOPRYUqRB5 + iQEcBBABAgAGBQJXt3igAAoJEF5FJ36WgCWsN2wH/RBYyRHcIXW3F3oYS884JNj+ + KA4Fl04kmuF9oQ3OnF8JYaYyZ1uuRErGH1UB8BVxTudKcowGCYi8AV4iQHSLx5dr + qY0w2MVlcxC2+8vUYEHYXU2i9EoGa6vwIJU+oSB/evnCJGe5DmzR6EbgQPADlkX3 + IW8GzrnPionDJhP7POwOY4HNOOBRm6AfAE3JMjH++TUuEgAuB0urjCNPmZ2/t9ic + uSS5hDp5HepoaQ2rfEI1Df+/wd8vXAD5Zdi1wZhmDWX8pq/spdAgV4/kMlcKzdRS + FINyA4wajLVLfsYPavBCW18aHV6pEBc9mdhQ3xsqardcnyX+rd9kMgXKsG69WAGJ + ARwEEAEKAAYFAle3ca8ACgkQpHBvotfbFDWkRQf8CZtvvGM1sHJk7l07KDmG2zSM + rWb/GPsySK+DZRZDBJz3m7FWazWnfb2cuqRSMnoDDvnjg5EVSFqdZ3GaTsjKFBNe + NnLp/dC+sjSfKoi+a1iCP5wuhiXOwwWz4O45ekYUKrIwCXh3C32mtnqc6460YQwp + a1pdGqEeGq4aqcZPHUYAb294GuelA1TUkxibCIIDo5f223UNwGV3m9LPTyf0uOwO + 1cht4ZdvccWBFXuDvzMQ9AGh6jHq8SX1uopQkEOY8AY53Lul6ubHzoHIvrld/GaQ + 9osF1dm2/llGtHbQDqnVYVXg+lLNqW0u6JhNSE/EHDi9S2zWmK8J60m4akJRRokB + HAQQAQgABgUCV7eBzwAKCRDfnAdsUd5/xDeuB/0aVR8KKFpEjV+mYspTMJMUi0ku + 0iqXYqVmvMCfrwP2fzKu2MbLqWjgutG9RiwtrMmqaRPx+AYGJMU6k/TVd9bxWP8+ + vxvZzsEz9lPIoH6xCEAgA6AQ6TIYswwU0G6duR/iRUtn57oTixfoFazUFXriY3yk + gAeSphPmG2ZBVU/VEvht6qjkKrxIT46sjNEl5+5R3R9EekrW19D9S0TjtjPOGjfo + +6ZMxKWlGW5gCREliuSTQY1/56MTQdrA6bFdiim0TPftC+aK+6l2kzTyVbygBPPo + 8/p30iOYHOX179HZNwGyGnP9fNxaURLsx7Zymaf2esA4mGVApDDE6QrZbeGHiQEc + BBABCAAGBQJXu01KAAoJEOe7Y9N+knoevtAH/2VjCnLU1xc25iuIDnDKtPdgdclY + tV5w4kLpDxo1WTieCPOjSK5Xbsfe9eSSSqjgsHm1EkejunzuDcmm57LXfcdf3MA3 + 1u6qIkS/fdctj9hkEMonEeWN2NnyYLAkcjWf6+I4u/qhM8BdoT/UmB80rgdq07yr + 14zxMhetoZaqcLMCtZuaVpQMmoa/SbaADQSISiYRN3xWeZUmeWBjU10avK7YeRMN + tyYTCAsRCvrwcKTN9XKdzHgm5kMZfo9UDuqnD2TsUxDwRcwYfe1+ZiHWV6sWZtGv + zPqJ4t7fUO8tlo3LnCCdZRXp3U5i9G8f4xZCkH0fY2kEMHMxOn4T5NS1WxmJARwE + EAEKAAYFAle3euIACgkQutXwo5LphXJtOAf/QvpHm4MsGYMFe0GamNcfCqgPQBfr + +/7SIreIG9BJDpsB+JkNZX3+tcZR5m7tfXl7Zt8+t+ENJVs62FPPzOA8EuXQAMGW + NkyQlV9Y4lFerccUX3gK3rP4BMxTQ372quGXfOIeYwUmTEPaA0me6M0ODla3jT+g + dl9HSwCCLTfv4/2djK/Oi/+m1r3grfeFLbOjoznR4xZoPbWFBWCn7iweWE3B6r1X + n+99DEaLmuEG4Mk8ohlKzIgReZ1wTkHcIt27GG60to8TUhbgqtGcOtE3Qc9hxZXh + wRbYaNFM8gkIAmo4eJuuWd+VWjnMeFH9JKtcrSEgMhI/qyt97c8g5497sYkBHAQQ + AQoABgUCV7d67gAKCRCCRVGYVPwajc8QB/93fnBi8sKAaaWIjFA5ZrZkjZEsVE2a + y8G4hCKUPFk8qwacVSC78I/yFqZPhy1DE2zsXEQEdu9VBNxVvEHuRBrs79XU7L92 + 8xtdzEZF06my+xqYhhgBTqK1VguU4ayD9jKNgE1jGjPnHPFcjLaadyEtDDk9MMwC + fzvtFPGepRi1LYRMYxR4CNxAvAlgb0uVnZ+9dEfo9nfBfRL7ACLtnQbkazJZXyfP + zKeRmxlA9RTRlGm+ufHN5TgzsKFiTBbkQOF51ItAVJcKZVEARuyuMqWXIlZyURXq + kG9x1jAx0oZDW2iVRb6Ft21pAJd5P1ovGacX6EhTubAeAmlkqvmuPh3viQEcBBAB + CgAGBQJXt3sHAAoJEDy4a/JFI238WrgIAJS1gtpqw/tzyeAgopnKUyl+/ocCWoye + 0wkS4/9QLzttQ718oDeb1EIcGnQEkazES1NAPoHAnc6TbvPfu71sfPqiTVMRE4VI + 6AwXdjNT8ZWi0ip8fog1YVzFBxxMpYThDAPqkKPQG3kj3TAUMpmTlM/h63ndOOOU + 5clUmuqT2agX7Xo/lP4qApcvcXe/EhwtWttYkFW9pPtjXUoHA7R4iEw/HZZRGvgi + RRuVkVnta63SBMasyypO8Km35dg/UAE4RRsPV1QLwl+uqgvD6zGt3A8+GNEXoAki + agKt8GJ43DlsD8aDkFzsp0E2iQ+idkqkqy7FXJMe4eG/LL4WG72fNL6JAhwEEAEC + AAYFAle3e60ACgkQyXOBc2z4R/lCtQ//SCePwH2R35N2h9EMYsCH9iypJmFWMcwN + HlEXOKmJrQ3viD0X3iXEa2SNRKKK7Evn3ggN9zbKwLLBIvZimut8LBLiF6TFnK/u + +8kZxGHLW0dhR/IokUY5zadx/E1F0C0IAkY7hNh791K6e7rwjw49pxSUnAQ00YMc + hNFeuq+IRtty+Jnw8uYz9m5CRAzBqPeAQ3mtXeYgkNPWEMQSTW5FDHnINlZItup9 + BSwIQxYJymKFkG3YxcJsx18dQNuVdzhg81b4XS35C2mOjlOhUsD+5Pp+8L0SQ3GC + u3qj/xXazdB9U0yJIs0u3JYb1Rl73v/fQji6UYyU/4TbEAhjl4n8JRgje1bJ4W1g + ugjalCM9YVaLrgjf5CIf0t8rn3G4Hl26ddNm/VroTCMLKXvg4kdFKF1oc6xImqoo + WJblVa4B4la9LxuRsgN9PamGlBUg1cDUftjpSstW1PYQPiGhc0jJh8vXNmIg5fzq + 5dcLLWXOlrQOkg4ce30YzDculzn6ntBl30sCzVi/hxQrX3c0cpAqgRT3azAkO7JT + 4J8fXO8CyAwuXjpDv6g4N9xfIdgTrbtqgnZb3MzOzpd11s7Q6ypCcEZVxt+FKVS1 + LgzJoWMQNVJ31sBwI1KenfB2/YfF6uILtpdFM+soKt86IvQub726rw56JWrIiP8w + +ojBTcDZGM6JAhwEEAEIAAYFAle3gC8ACgkQEFS3okvW7DCFfQ//SduNnxVJqud1 + +c1B+N1G/M3jfkMvSb6Sujb5/4qu5yL2Yo/PoTHesvqkFh5zILGuepCLI4ravZd7 + zyxy31o+egTC+adR4s6118k9swe9XDuZ+SNxBhK9A18pnaPcwa6b0j2q5KZI4klF + DKCg3u+D6qJQ3jqMPKbfPymVn1LE4qzkj/SXll0Nxkw7jIapn30UNONdY+q2nXpZ + Ej4xI01X66v9Zh/IRj8H0jwtJsTKfAoCkRmE9aJW4ywDUMJ0iHAqxYuGX2y617F6 + b1IY1JoWvBlNDTlCwj0v8xF6CK02JQecKhHl9hvAoAuJDhGIqSGkKH3ENAOFN6I0 + 7orX6UrHDafphfqLYmEYCHJhz/QXC6Y4hxWS4cpcGbNqzfoerFkQimi0FT2lLPtn + DH1OOvBvibKAVKkifkAUjYCGN4EJYI39x9VX1I++sqoXWZoAgRTGd7Ppm7PQFdvM + pHQYDMLIzdFex5xvcQGrga1r7kOjUgpSP3rqBTgNfZtDNRucQE1iLOCu6Iias8HW + B66ya5eN7tpAN3vXvtMs1qpOU7748HbUKTOPvccj6abxJ5OKFluK286eLMXW1hHP + rB8I1WuIyYuqgtyuvdiRqhq0d+LyWuM2ZVos0usa03OtAuvnlaaTLE4qsW0cc73l + TAUI89WEAZ4yrD+IIVbR8WNv+F0O0GaJAhwEEAEIAAYFAle3ge4ACgkQhyhST+Id + P8Y9VBAAij8tXwW0Kl/cpJo0AEh1zPObs2ChFucwdj3DIbMOziV4d3cD/agGTL2H + rjNQnfGqr+oxvBOPGTXFJGllhmXYFISWdWQFGNM0G8XF0/zlnMP6c7XEpmUmr0O1 + OQuTVi31lY3kBmFLuZiTmN4YENIo3vCG1z7P8hHb3jpDUR4112KZdqWnvTGznDsA + lFTiNdlX9bU7eoQtFC0bueYv+rvHQ3PdzT4O8NBPuRhrfqVaaCUOERlUGuqjJzlK + TfxRq949Ts7piTqlnwIgw+mWfuvyVtKcRnrIkTSMmDcojKnYmi8FjRQoEyZp5DOZ + NLoJ5OMLCb3gyjQDLtGaPeDuLBiAPfb+dB+FtTplwbeevpOks/Cnbr8eCY2DflMd + 3cgOA7xT5NyoZrUY9nhlRGStqIjJ/QrB1orFt8hqisshGJLgGp+64wvbFORgXvcY + 3M2qoSeCRz03IFjeIf58TxcmaTC+aYffWTFKuGmvUKNCbGod20MyRtl5/xzQ3K5S + bt9u6MXeLw50psnu/GzQEgN52dU36fsh3XNWQrlV3YdTihJHTSeFAs1LA/eg/qJL + 4WPGXmg/sBHFXuv4NC7aqI+0sUjlZfDk3aJCZHmnBTQ8izuvlUhhYy3+8N5D9i5E + KjaIAsEoHGIljwcenI5lLZNSNqlREW3ZED7vJZrbblOWq7ezlhKJAhwEEAEKAAYF + Ale3e7cACgkQAl2/Z5bsLy5UhA/+JZ/I5Zscici5SnbVKTIefcJWwlylWCale/IV + 0m+YXl1GTLOxNFMgeSHlISVDWeo1g22jtT/ln4mfYfKJFN+Hy2lHuknxqZOCwti/ + T6DDSCqk8SZBIJliESPp1yOC6a1I1LhZWGzq1fUc3JtPng/CuiFKgxVQvrKooFTT + eFFzC3+S5Bjfcgz/vw/Hfuf8C2kMW6FFg3SQJIo1Iz8Z4C/f++J9kMKgkU7lfauK + 9B3teN5F7gavOMv1C3SeM7xv0smaayM+coSA29/8LOKbfc5oSucNldXMI9CZTWQa + Kq7gfN5Lq7MPYDScS9UbEXAGQQIWsMIkeLadkdVpOqTjMfvnUX3d+rFdOCI4xFEA + 5mm9o2qsmKTdZtGBeoY1M1Quq4qITtZifqthe6cZ83YulyKCEZniqiQzfCjWYZoS + tcW8rc+DIC/pakwRN7K7nZRNpoYb50+C+vlHfk7tuQuR3B95QFiOdfob9lSrnNtM + pli+diK5g1xmBbhSCUvbSK22ELCEtek6CZxKvkQclscteEhvVDIiq6rl5fMZsQCz + 85L4fMX1HhVQ4fSPIIAfMi1sup36DEtTM9ensT8jKSB0gp9ZHsUAX+NA8PeUsjB1 + p6i7ywHuA0kS4NC8a7uACXgWyQq6rVZPn9w9ogu1k2KdtcHLcQSAgq8jB0Xw3056 + K7S6EVK5Ag0EV7YjPgEQAPNuzxaF0HEFrS0kGXhXPRusOBTdgOo2Sqetr9PXuRU8 + juzbtUSGgcRGZknXukqpvakSWmv2Y38XO43Q33C9Rq6Z32DHOw4JqbsM9Oa5Ii/D + KyTf3WaMImRuijTVuG5Vd7YUGSA48XMAkQdgU/Ga7u1Y6YLE1iK65i3EvLBTuUL9 + mnoJm6rnvEmpRYrjsjnAMr3+KKCTBJvecOzoDYumQOYKv6tw7AuHlvENJ6Lu9hb7 + dM06Q+UL+Hp871094L0B/Jbqo91UVCrWalllyPUAvPvMWJyIgHg2sPc9OMOVGdok + JYo9p9VKwxvIhaZBonTWJ+4TQ7CJqetq7xwjbrhVeYjmkD0LyT1/ZpUG4mIuxdos + RvTcLMVbP0mkEu20D1xxpqbd95TYSacLexv3EP4huTGrmYoU3eUTNQAAipsjVBgZ + lc+AvExjslK+hTECp4fCl/907YshSphSnHRsX8ZZFX1SqXyiY1BuHA/SnZf/QZ/G + P0BuDYgkzwt467deTQcALDDJVeDFyCTkU774pmlM3eLKeOZsjMH2px31N5LONWH9 + EM9J2fkroCjnKe5sZiZo/AKT4N1UFEOWBajvI0gXg32sW5IwAQnEDWdLlNgWAg32 + gMXf8YeeBUZ8UK/gQbfJLTweTW0NXRuIp0rKlzHjTZMDBVFY/k/ObFzr9ldThmFl + ABEBAAGJAiUEGAECAA8FAle2Iz4CGwwFCQlmAYAACgkQf0OCgO+NNJ9tZhAAvBp8 + hAr1q9U0i6EyzJg9r/Id/qtQ4uqtg7UYKaO/IbhxiavLN3HJ9xcSa4TlAAhsQpIh + Ktw7o2+O30/AsKNH91S9yjR/RgVM+/6Rqaf4HCnZm3p3cx6dcLqYtc8dHg6oWPMK + lRPyQXDJy8Y+y6plD8I7SrMsOYAZNj7iXLf1pASxDIWFXc/7pJadoLZOV1al8b/a + kJJpJrx1thtF7dJQ0pfBPyTDdahBg2h8XqeivygVUD5QhWW8dzmHsve18XKVHLkL + C1HmsFC2gGJxFXERBzsBE2YHVda4+e0xCX83UVx9z4pIgsVuUBHp5W/7oGEy9GrP + Gp7zUAQA/6gpVXAnsf7BNC6fZQoCBkBMNY/8tCxiKeYsAOmtoM+rFPZYl7ySOzMw + NBkIr6OGxWuFl2SLD0QcAzTPsErPokRGYu5MgRyJySRN/NslZdmC/jQG+X33I8yz + CdHWVAcPtMrHIdisjt3MlCuLiZs5GDiU6dndPKh2/bU5x/hqzY2jWnp6xlb4zjrO + Nl47zPMTGaYQ0jb4/v9VS34tbJAWKpEzSJbMaKhgxaBV4/LAUZpNXnX/S4X3KYcc + LsEMhwuBRYd2D/UHruNHlhB/M8lSouGfKW3WyMNFAiV/7dT512+t7ZjFf+thQjaA + FPfZDNCu/TXoqyJk7434jJrcHgPryzrHFBLfEmc= + =TREp + -----END PGP PUBLIC KEY BLOCK----- ", + } + MANIFEST + +bogus_key_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + content => 'For posterity: such content, much bogus, wow', + } + MANIFEST + +hkps_pool_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + server => 'hkps.pool.sks-keyservers.net', + } + MANIFEST + +hkp_pool_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_FINGERPRINT}', + ensure => 'present', + server => 'hkp://hkps.pool.sks-keyservers.net:80', + } + MANIFEST + +nonexistant_key_server_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + server => 'nonexistant.key.server', + } + MANIFEST + +dot_server_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + server => '.pgp.key.server', + } + MANIFEST + +http_works_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'http://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + MANIFEST + +http_works_userinfo_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'http://dummyuser:dummypassword@#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + MANIFEST + +four_oh_four_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'http://#{PUPPETLABS_APT_URL}/herpderp.gpg', + } + MANIFEST + +socket_error_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'http://apt.puppetlabss.com/herpderp.gpg', + } + MANIFEST + +ftp_works_pp = <<-MANIFEST + apt_key { 'CentOS 6': + id => '#{CENTOS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'ftp://#{CENTOS_REPO_URL}/#{CENTOS_GPG_KEY_FILE}', + } + MANIFEST + +ftp_550_pp = <<-MANIFEST + apt_key { 'CentOS 6': + id => '#{SHOULD_NEVER_EXIST_ID}', + ensure => 'present', + source => 'ftp://#{CENTOS_REPO_URL}/herpderp.gpg', + } + MANIFEST + +ftp_socket_error_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'ftp://apt.puppetlabss.com/herpderp.gpg', + } + MANIFEST + +https_works_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'https://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + MANIFEST + +https_userinfo_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => 'https://dummyuser:dummypassword@#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + MANIFEST + +https_404_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{SHOULD_NEVER_EXIST_ID}', + ensure => 'present', + source => 'https://#{PUPPETLABS_APT_URL}/herpderp.gpg', + } + MANIFEST + +https_socket_error_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{SHOULD_NEVER_EXIST_ID}', + ensure => 'present', + source => 'https://apt.puppetlabss.com/herpderp.gpg', + } + MANIFEST + +path_exists_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => 'EF8D349F', + ensure => 'present', + source => '/tmp/puppetlabs-pubkey.gpg', + } + MANIFEST + +path_does_not_exist_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => '/tmp/totally_bogus.file', + } + MANIFEST + +path_bogus_content_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + source => '/tmp/fake-key.gpg', + } + MANIFEST + +debug_works_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_LONG_ID}', + ensure => 'present', + options => 'debug', + } + MANIFEST + +fingerprint_match_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '#{PUPPETLABS_GPG_KEY_FINGERPRINT}', + ensure => 'present', + source => 'https://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + MANIFEST + +fingerprint_does_not_match_pp = <<-MANIFEST + apt_key { 'puppetlabs': + id => '6F6B15509CF8E59E6E469F327F438280EF8D9999', + ensure => 'present', + source => 'https://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}', + } + MANIFEST + +describe 'apt_key' do + before(:each) do + # Delete twice to make sure everything is cleaned + # up after the short key collision + shell("apt-key del #{PUPPETLABS_GPG_KEY_SHORT_ID}", + acceptable_exit_codes: [0, 1, 2]) + shell("apt-key del #{PUPPETLABS_GPG_KEY_SHORT_ID}", + acceptable_exit_codes: [0, 1, 2]) + end + + describe 'default options' do + key_versions = { + '32bit key id' => PUPPETLABS_GPG_KEY_SHORT_ID.to_s, + '64bit key id' => PUPPETLABS_GPG_KEY_LONG_ID.to_s, + '160bit key fingerprint' => PUPPETLABS_GPG_KEY_FINGERPRINT.to_s, + '32bit lowercase key id' => PUPPETLABS_GPG_KEY_SHORT_ID.downcase.to_s, + '64bit lowercase key id' => PUPPETLABS_GPG_KEY_LONG_ID.downcase.to_s, + '160bit lowercase key fingerprint' => PUPPETLABS_GPG_KEY_FINGERPRINT.downcase.to_s, + '0x formatted 32bit key id' => "0x#{PUPPETLABS_GPG_KEY_SHORT_ID}", + '0x formatted 64bit key id' => "0x#{PUPPETLABS_GPG_KEY_LONG_ID}", + '0x formatted 160bit key fingerprint' => "0x#{PUPPETLABS_GPG_KEY_FINGERPRINT}", + '0x formatted 32bit lowercase key id' => "0x#{PUPPETLABS_GPG_KEY_SHORT_ID.downcase}", + '0x formatted 64bit lowercase key id' => "0x#{PUPPETLABS_GPG_KEY_LONG_ID.downcase}", + '0x formatted 160bit lowercase key fingerprint' => "0x#{PUPPETLABS_GPG_KEY_FINGERPRINT.downcase}", + } + + key_versions.each do |key, value| # rubocop:disable Lint/UnusedBlockArgument + context 'when key.to_s' do + it 'works' do + apply_manifest_twice(populate_default_options_pp(value)) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + end + + context 'with invalid length key id' do + it 'fails' do + apply_manifest(invalid_key_length_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{Valid values match}) + end + end + end + end + + describe 'ensure =>' do + context 'when absent' do + it 'is removed' do + # Install the key first (retry because key pool may timeout) + install_key(CENTOS_GPG_KEY_FINGERPRINT) + shell(CENTOS_KEY_CHECK_COMMAND) + + # Time to remove it using Puppet + apply_manifest_twice(ensure_absent_pp) + + shell(CENTOS_KEY_CHECK_COMMAND, acceptable_exit_codes: [1]) + + # Re-Install the key (retry because key pool may timeout) + install_key(CENTOS_GPG_KEY_FINGERPRINT) + end + end + + context 'when absent, added with long key', unless: (fact('operatingsystem') == 'Debian' && fact('operatingsystemmajrelease') == '6') do + it 'is removed' do + # Install the key first (retry because key pool may timeout) + install_key(PUPPETLABS_GPG_KEY_LONG_ID) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + + # Time to remove it using Puppet + apply_manifest_twice(ensure_absent_long_key_pp) + + shell(PUPPETLABS_KEY_CHECK_COMMAND, acceptable_exit_codes: [1]) + end + end + end + + describe 'content =>' do + context 'with puppetlabs gpg key' do + it 'works' do + # Apply the manifest (Retry if timeout error is received from key pool) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + apply_manifest(gpg_key_pp, catch_failures: true) + end + + apply_manifest(gpg_key_pp, catch_changes: true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context 'with multiple keys' do + it 'runs without errors' do + apply_manifest_twice(multiple_keys_pp) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context 'with bogus key' do + it 'fails' do + apply_manifest(bogus_key_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{no valid OpenPGP data found}) + end + end + end + end + + describe 'server =>' do + context 'with hkps.pool.sks-keyservers.net' do + it 'works' do + # Apply the manifest (Retry if timeout error is received from key pool) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + apply_manifest(hkps_pool_pp, catch_failures: true) + end + + apply_manifest(hkps_pool_pp, catch_changes: true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context 'with hkp://hkps.pool.sks-keyservers.net:80' do + it 'works' do + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + apply_manifest(hkp_pool_pp, catch_failures: true) + end + + apply_manifest(hkp_pool_pp, catch_changes: true) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context 'with nonexistant.key.server' do + it 'fails' do + apply_manifest(nonexistant_key_server_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{(Host not found|Couldn't resolve host)}) + end + end + end + + context 'with key server start with dot' do + it 'fails' do + apply_manifest(dot_server_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{Invalid value ".pgp.key.server"}) + end + end + end + end + + describe 'source =>' do + context 'with http://' do + it 'works' do + apply_manifest_twice(http_works_pp) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + + it 'works with userinfo' do + apply_manifest_twice(http_works_userinfo_pp) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + + it 'fails with a 404' do + apply_manifest(four_oh_four_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{404 Not Found}) + end + end + + it 'fails with a socket error' do + apply_manifest(socket_error_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{could not resolve}) + end + end + end + + context 'with ftp://' do + before(:each) do + shell("apt-key del #{CENTOS_GPG_KEY_LONG_ID}", + acceptable_exit_codes: [0, 1, 2]) + end + + it 'works' do + apply_manifest_twice(ftp_works_pp) + shell(CENTOS_KEY_CHECK_COMMAND) + end + + it 'fails with a 550' do + apply_manifest(ftp_550_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{550 Failed to open}) + end + end + + it 'fails with a socket error' do + apply_manifest(ftp_socket_error_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{could not resolve}) + end + end + end + + context 'with https://' do + it 'works' do + apply_manifest_twice(https_works_pp) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + + it 'works with userinfo' do + apply_manifest_twice(https_userinfo_pp) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + + it 'fails with a 404' do + apply_manifest(https_404_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{404 Not Found}) + end + end + + it 'fails with a socket error' do + apply_manifest(https_socket_error_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{could not resolve}) + end + end + end + + context 'with /path/that/exists' do + before(:each) do + shell("curl -o /tmp/puppetlabs-pubkey.gpg \ + http://#{PUPPETLABS_APT_URL}/#{PUPPETLABS_GPG_KEY_FILE}") + end + + after(:each) do + shell('rm /tmp/puppetlabs-pubkey.gpg') + end + + it 'works' do + apply_manifest_twice(path_exists_pp) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + + context 'with /path/that/does/not/exist' do + it 'fails' do + apply_manifest(path_does_not_exist_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{does not exist}) + end + end + end + + context 'with /path/that/exists/with/bogus/content' do + before(:each) do + shell('echo "here be dragons" > /tmp/fake-key.gpg') + end + + after(:each) do + shell('rm /tmp/fake-key.gpg') + end + it 'fails' do + apply_manifest(path_bogus_content_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{no valid OpenPGP data found}) + end + end + end + end + + describe 'options =>' do + context 'with debug' do + it 'works' do + apply_manifest_twice(debug_works_pp) + shell(PUPPETLABS_KEY_CHECK_COMMAND) + end + end + end + + describe 'fingerprint validation against source/content' do + context 'with fingerprint in id matches fingerprint from remote key' do + it 'works' do + apply_manifest_twice(fingerprint_match_pp) + end + end + + context 'with fingerprint in id does NOT match fingerprint from remote key' do + it 'works' do + apply_manifest(fingerprint_does_not_match_pp, expect_failures: true) do |r| + expect(r.stderr).to match(%r{don't match}) + end + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/acceptance/apt_spec.rb b/code/environments/production/modules/apt/spec/acceptance/apt_spec.rb new file mode 100644 index 0000000..5505748 --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/apt_spec.rb @@ -0,0 +1,66 @@ +require 'spec_helper_acceptance' + +MAX_TIMEOUT_RETRY = 3 +TIMEOUT_RETRY_WAIT = 5 +TIMEOUT_ERROR_MATCHER = %r{no valid OpenPGP data found} + +everything_everything_pp = <<-MANIFEST + if $::lsbdistcodename == 'lucid' { + $sources = undef + } else { + $sources = { + 'puppetlabs' => { + 'ensure' => present, + 'location' => 'http://apt.puppetlabs.com', + 'repos' => 'main', + 'key' => { + 'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F', + 'server' => 'hkps.pool.sks-keyservers.net', + }, + }, + } + } + class { 'apt': + update => { + 'frequency' => 'always', + 'timeout' => 400, + 'tries' => 3, + }, + purge => { + 'sources.list' => true, + 'sources.list.d' => true, + 'preferences' => true, + 'preferences.d' => true, + }, + sources => $sources, + } + MANIFEST + +describe 'apt class' do + context 'with reset' do + it 'fixes the sources.list' do + shell('cp /etc/apt/sources.list /tmp') + end + end + + context 'with all the things' do + it 'works with no errors' do + # Apply the manifest (Retry if timeout error is received from key pool) + retry_on_error_matching(MAX_TIMEOUT_RETRY, TIMEOUT_RETRY_WAIT, TIMEOUT_ERROR_MATCHER) do + apply_manifest(everything_everything_pp, catch_failures: true) + end + + apply_manifest(everything_everything_pp, catch_failures: true) + end + it 'stills work' do + shell('apt-get update') + shell('apt-get -y --force-yes upgrade') + end + end + + context 'with reset' do + it 'fixes the sources.list' do + shell('cp /tmp/sources.list /etc/apt') + end + end +end diff --git a/code/environments/production/modules/apt/spec/acceptance/class_spec.rb b/code/environments/production/modules/apt/spec/acceptance/class_spec.rb new file mode 100644 index 0000000..53d75f6 --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/class_spec.rb @@ -0,0 +1,16 @@ +require 'spec_helper_acceptance' + +describe 'apt class' do + context 'with default parameters' do + # Using puppet_apply as a helper + it 'works with no errors' do + pp = <<-MANIFEST + class { 'apt': } + MANIFEST + + # Run it twice and test for idempotency + apply_manifest(pp, catch_failures: true) + apply_manifest(pp, catch_changes: true) + end + end +end diff --git a/code/environments/production/modules/apt/spec/acceptance/init_task_spec.rb b/code/environments/production/modules/apt/spec/acceptance/init_task_spec.rb new file mode 100644 index 0000000..58f3ca7 --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/init_task_spec.rb @@ -0,0 +1,11 @@ +# run a test task +require 'spec_helper_acceptance' + +describe 'apt tasks' do + describe 'update and upgrade', if: pe_install? && puppet_version =~ %r{(5\.\d\.\d)} && fact_on(master, 'osfamily') == 'Debian' do + it 'execute arbitary sql' do + result = run_task(task_name: 'apt', params: 'action=update') + expect_multiple_regexes(result: result, regexes: [%r{Reading package lists}, %r{Job completed. 1/1 nodes succeeded}]) + end + end +end diff --git a/code/environments/production/modules/apt/spec/acceptance/nodesets/centos-7-x64.yml b/code/environments/production/modules/apt/spec/acceptance/nodesets/centos-7-x64.yml new file mode 100644 index 0000000..5eebdef --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/nodesets/centos-7-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + centos-7-x64: + roles: + - agent + - default + platform: el-7-x86_64 + hypervisor: vagrant + box: puppetlabs/centos-7.2-64-nocm +CONFIG: + type: foss diff --git a/code/environments/production/modules/apt/spec/acceptance/nodesets/debian-8-x64.yml b/code/environments/production/modules/apt/spec/acceptance/nodesets/debian-8-x64.yml new file mode 100644 index 0000000..fef6e63 --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/nodesets/debian-8-x64.yml @@ -0,0 +1,10 @@ +HOSTS: + debian-8-x64: + roles: + - agent + - default + platform: debian-8-amd64 + hypervisor: vagrant + box: puppetlabs/debian-8.2-64-nocm +CONFIG: + type: foss diff --git a/code/environments/production/modules/apt/spec/acceptance/nodesets/default.yml b/code/environments/production/modules/apt/spec/acceptance/nodesets/default.yml new file mode 100644 index 0000000..dba339c --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/nodesets/default.yml @@ -0,0 +1,10 @@ +HOSTS: + ubuntu-1404-x64: + roles: + - agent + - default + platform: ubuntu-14.04-amd64 + hypervisor: vagrant + box: puppetlabs/ubuntu-14.04-64-nocm +CONFIG: + type: foss diff --git a/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/centos-7.yml b/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/centos-7.yml new file mode 100644 index 0000000..a3333aa --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/centos-7.yml @@ -0,0 +1,12 @@ +HOSTS: + centos-7-x64: + platform: el-7-x86_64 + hypervisor: docker + image: centos:7 + docker_preserve_image: true + docker_cmd: '["/usr/sbin/init"]' + # install various tools required to get the image up to usable levels + docker_image_commands: + - 'yum install -y crontabs tar wget openssl sysvinit-tools iproute which initscripts' +CONFIG: + trace_limit: 200 diff --git a/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/debian-8.yml b/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/debian-8.yml new file mode 100644 index 0000000..df5c319 --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/debian-8.yml @@ -0,0 +1,11 @@ +HOSTS: + debian-8-x64: + platform: debian-8-amd64 + hypervisor: docker + image: debian:8 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + - 'apt-get update && apt-get install -y net-tools wget locales strace lsof && echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen' +CONFIG: + trace_limit: 200 diff --git a/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/ubuntu-14.04.yml b/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/ubuntu-14.04.yml new file mode 100644 index 0000000..b1efa58 --- /dev/null +++ b/code/environments/production/modules/apt/spec/acceptance/nodesets/docker/ubuntu-14.04.yml @@ -0,0 +1,12 @@ +HOSTS: + ubuntu-1404-x64: + platform: ubuntu-14.04-amd64 + hypervisor: docker + image: ubuntu:14.04 + docker_preserve_image: true + docker_cmd: '["/sbin/init"]' + docker_image_commands: + # ensure that upstart is booting correctly in the container + - 'rm /usr/sbin/policy-rc.d && rm /sbin/initctl && dpkg-divert --rename --remove /sbin/initctl && apt-get update && apt-get install -y net-tools wget && locale-gen en_US.UTF-8' +CONFIG: + trace_limit: 200 diff --git a/code/environments/production/modules/apt/spec/classes/apt_backports_spec.rb b/code/environments/production/modules/apt/spec/classes/apt_backports_spec.rb new file mode 100644 index 0000000..33022b9 --- /dev/null +++ b/code/environments/production/modules/apt/spec/classes/apt_backports_spec.rb @@ -0,0 +1,253 @@ +require 'spec_helper' + +describe 'apt::backports', type: :class do + let(:pre_condition) { "class{ '::apt': }" } + + describe 'debian/ubuntu tests' do + context 'with defaults on deb' do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + + it { + is_expected.to contain_apt__source('backports').with(location: 'http://deb.debian.org/debian', + key: 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + repos: 'main contrib non-free', + release: 'wheezy-backports', + pin: { 'priority' => 200, 'release' => 'wheezy-backports' }) + } + end + context 'with defaults on ubuntu' do + let(:facts) do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + lsbdistcodename: 'trusty', + lsbdistrelease: '14.04', + puppetversion: Puppet.version, + } + end + + it { + is_expected.to contain_apt__source('backports').with(location: 'http://archive.ubuntu.com/ubuntu', + key: '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos: 'main universe multiverse restricted', + release: 'trusty-backports', + pin: { 'priority' => 200, 'release' => 'trusty-backports' }) + } + end + context 'with everything set' do + let(:facts) do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + lsbdistcodename: 'trusty', + lsbdistrelease: '14.04', + puppetversion: Puppet.version, + } + end + let(:params) do + { + location: 'http://archive.ubuntu.com/ubuntu-test', + release: 'vivid', + repos: 'main', + key: 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + pin: '90', + } + end + + it { + is_expected.to contain_apt__source('backports').with(location: 'http://archive.ubuntu.com/ubuntu-test', + key: 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + repos: 'main', + release: 'vivid', + pin: { 'priority' => 90, 'release' => 'vivid' }) + } + end + context 'when set things with hashes' do + let(:facts) do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + lsbdistcodename: 'trusty', + lsbdistrelease: '14.04', + puppetversion: Puppet.version, + } + end + let(:params) do + { + key: { + 'id' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553', + }, + pin: { + 'priority' => '90', + }, + } + end + + it { + is_expected.to contain_apt__source('backports').with(key: { 'id' => 'A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553' }, + pin: { 'priority' => '90' }) + } + end + end + describe 'mint tests' do + let(:facts) do + { + os: { family: 'Debian', name: 'Linuxmint', release: { major: '17', full: '17' } }, + lsbdistid: 'linuxmint', + osfamily: 'Debian', + lsbdistcodename: 'qiana', + puppetversion: Puppet.version, + } + end + + context 'with all the needed things set' do + let(:params) do + { + location: 'http://archive.ubuntu.com/ubuntu', + release: 'trusty-backports', + repos: 'main universe multiverse restricted', + key: '630239CC130E1A7FD81A27B140976EAF437D05B5', + } + end + + it { + is_expected.to contain_apt__source('backports').with(location: 'http://archive.ubuntu.com/ubuntu', + key: '630239CC130E1A7FD81A27B140976EAF437D05B5', + repos: 'main universe multiverse restricted', + release: 'trusty-backports', + pin: { 'priority' => 200, 'release' => 'trusty-backports' }) + } + end + context 'with missing location' do + let(:params) do + { + release: 'trusty-backports', + repos: 'main universe multiverse restricted', + key: '630239CC130E1A7FD81A27B140976EAF437D05B5', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key}) + end + end + context 'with missing release' do + let(:params) do + { + location: 'http://archive.ubuntu.com/ubuntu', + repos: 'main universe multiverse restricted', + key: '630239CC130E1A7FD81A27B140976EAF437D05B5', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key}) + end + end + context 'with missing repos' do + let(:params) do + { + location: 'http://archive.ubuntu.com/ubuntu', + release: 'trusty-backports', + key: '630239CC130E1A7FD81A27B140976EAF437D05B5', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key}) + end + end + context 'with missing key' do + let(:params) do + { + location: 'http://archive.ubuntu.com/ubuntu', + release: 'trusty-backports', + repos: 'main universe multiverse restricted', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{If not on Debian or Ubuntu, you must explicitly pass location, release, repos, and key}) + end + end + end + describe 'validation' do + let(:facts) do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + lsbdistcodename: 'trusty', + lsbdistrelease: '14.04', + puppetversion: Puppet.version, + } + end + + context 'with invalid location' do + let(:params) do + { + location: true, + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{expects a}) + end + end + context 'with invalid release' do + let(:params) do + { + release: true, + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{expects a}) + end + end + context 'with invalid repos' do + let(:params) do + { + repos: true, + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{expects a}) + end + end + context 'with invalid key' do + let(:params) do + { + key: true, + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{expects a}) + end + end + context 'with invalid pin' do + let(:params) do + { + pin: true, + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{expects a}) + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/classes/apt_spec.rb b/code/environments/production/modules/apt/spec/classes/apt_spec.rb new file mode 100644 index 0000000..0c6333b --- /dev/null +++ b/code/environments/production/modules/apt/spec/classes/apt_spec.rb @@ -0,0 +1,387 @@ +require 'spec_helper' + +sources_list = { ensure: 'file', + path: '/etc/apt/sources.list', + owner: 'root', + group: 'root', + mode: '0644', + notify: 'Class[Apt::Update]' } + +sources_list_d = { ensure: 'directory', + path: '/etc/apt/sources.list.d', + owner: 'root', + group: 'root', + mode: '0644', + purge: false, + recurse: false, + notify: 'Class[Apt::Update]' } + +preferences = { ensure: 'file', + path: '/etc/apt/preferences', + owner: 'root', + group: 'root', + mode: '0644', + notify: 'Class[Apt::Update]' } + +preferences_d = { ensure: 'directory', + path: '/etc/apt/preferences.d', + owner: 'root', + group: 'root', + mode: '0644', + purge: false, + recurse: false, + notify: 'Class[Apt::Update]' } + +describe 'apt' do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + + context 'with defaults' do + it { + is_expected.to contain_file('sources.list').that_notifies('Class[Apt::Update]').only_with(sources_list) + } + + it { + is_expected.to contain_file('sources.list.d').that_notifies('Class[Apt::Update]').only_with(sources_list_d) + } + + it { + is_expected.to contain_file('preferences').that_notifies('Class[Apt::Update]').only_with(preferences) + } + + it { + is_expected.to contain_file('preferences.d').that_notifies('Class[Apt::Update]').only_with(preferences_d) + } + + it 'lays down /etc/apt/apt.conf.d/15update-stamp' do + is_expected.to contain_file('/etc/apt/apt.conf.d/15update-stamp').with(group: 'root', + mode: '0644', + owner: 'root').with_content( + %r{APT::Update::Post-Invoke-Success {"touch /var/lib/apt/periodic/update-success-stamp 2>/dev/null || true";};}, + ) + end + + it { + is_expected.to contain_exec('apt_update').with(refreshonly: 'true') + } + + it { is_expected.not_to contain_apt__setting('conf-proxy') } + end + + describe 'proxy=' do + context 'when host=localhost' do + let(:params) { { proxy: { 'host' => 'localhost' } } } + + it { + is_expected.to contain_apt__setting('conf-proxy').with(priority: '01').with_content( + %r{Acquire::http::proxy "http://localhost:8080/";}, + ).without_content( + %r{Acquire::https::proxy}, + ) + } + end + + context 'when host=localhost and port=8180' do + let(:params) { { proxy: { 'host' => 'localhost', 'port' => 8180 } } } + + it { + is_expected.to contain_apt__setting('conf-proxy').with(priority: '01').with_content( + %r{Acquire::http::proxy "http://localhost:8180/";}, + ).without_content( + %r{Acquire::https::proxy}, + ) + } + end + + context 'when host=localhost and https=true' do + let(:params) { { proxy: { 'host' => 'localhost', 'https' => true } } } + + it { + is_expected.to contain_apt__setting('conf-proxy').with(priority: '01').with_content( + %r{Acquire::http::proxy "http://localhost:8080/";}, + ).with_content( + %r{Acquire::https::proxy "https://localhost:8080/";}, + ) + } + end + + context 'when host=localhost and direct=true' do + let(:params) { { proxy: { 'host' => 'localhost', 'direct' => true } } } + + it { + is_expected.to contain_apt__setting('conf-proxy').with(priority: '01').with_content( + %r{Acquire::http::proxy "http://localhost:8080/";}, + ).with_content( + %r{Acquire::https::proxy "DIRECT";}, + ) + } + end + + context 'when host=localhost and https=true and direct=true' do + let(:params) { { proxy: { 'host' => 'localhost', 'https' => true, 'direct' => true } } } + + it { + is_expected.to contain_apt__setting('conf-proxy').with(priority: '01').with_content( + %r{Acquire::http::proxy "http://localhost:8080/";}, + ).with_content( + %r{Acquire::https::proxy "https://localhost:8080/";}, + ) + } + it { + is_expected.to contain_apt__setting('conf-proxy').with(priority: '01').with_content( + %r{Acquire::http::proxy "http://localhost:8080/";}, + ).without_content( + %r{Acquire::https::proxy "DIRECT";}, + ) + } + end + + context 'when ensure=absent' do + let(:params) { { proxy: { 'ensure' => 'absent' } } } + + it { + is_expected.to contain_apt__setting('conf-proxy').with(ensure: 'absent', + priority: '01') + } + end + end + context 'with lots of non-defaults' do + let :params do + { + update: { 'frequency' => 'always', 'timeout' => 1, 'tries' => 3 }, + purge: { 'sources.list' => false, 'sources.list.d' => false, + 'preferences' => false, 'preferences.d' => false }, + } + end + + it { + is_expected.to contain_file('sources.list').with(content: nil) + } + + it { + is_expected.to contain_file('sources.list.d').with(purge: false, + recurse: false) + } + + it { + is_expected.to contain_file('preferences').with(ensure: 'file') + } + + it { + is_expected.to contain_file('preferences.d').with(purge: false, + recurse: false) + } + + it { + is_expected.to contain_exec('apt_update').with(refreshonly: false, + timeout: 1, + tries: 3) + } + end + + context 'with sources defined on valid osfamily' do + let :facts do + { os: { family: 'Debian', name: 'Ubuntu', release: { major: '12', full: '12.04' } }, + osfamily: 'Debian', + lsbdistcodename: 'precise', + lsbdistid: 'Ubuntu', + lsbdistrelease: '12.04', + puppetversion: Puppet.version } + end + let(:params) do + { sources: { + 'debian_unstable' => { + 'location' => 'http://debian.mirror.iweb.ca/debian/', + 'release' => 'unstable', + 'repos' => 'main contrib non-free', + 'key' => { 'id' => '150C8614919D8446E01E83AF9AA38DCD55BE302B', 'server' => 'subkeys.pgp.net' }, + 'pin' => '-10', + 'include' => { 'src' => true }, + }, + 'puppetlabs' => { + 'location' => 'http://apt.puppetlabs.com', + 'repos' => 'main', + 'key' => { 'id' => '6F6B15509CF8E59E6E469F327F438280EF8D349F', 'server' => 'pgp.mit.edu' }, + }, + } } + end + + it { + is_expected.to contain_apt__setting('list-debian_unstable').with(ensure: 'present') + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/debian_unstable.list').with_content(%r{^deb http://debian.mirror.iweb.ca/debian/ unstable main contrib non-free$}) } + it { is_expected.to contain_file('/etc/apt/sources.list.d/debian_unstable.list').with_content(%r{^deb-src http://debian.mirror.iweb.ca/debian/ unstable main contrib non-free$}) } + + it { + is_expected.to contain_apt__setting('list-puppetlabs').with(ensure: 'present') + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/puppetlabs.list').with_content(%r{^deb http://apt.puppetlabs.com precise main$}) } + end + + context 'with confs defined on valid osfamily' do + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '12', full: '12.04.5' } }, + osfamily: 'Debian', + lsbdistcodename: 'precise', + lsbdistid: 'Debian', + puppetversion: Puppet.version, + } + end + let(:params) do + { confs: { + 'foo' => { + 'content' => 'foo', + }, + 'bar' => { + 'content' => 'bar', + }, + } } + end + + it { + is_expected.to contain_apt__conf('foo').with(content: 'foo') + } + + it { + is_expected.to contain_apt__conf('bar').with(content: 'bar') + } + end + + context 'with keys defined on valid osfamily' do + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '12', full: '12.04.5' } }, + osfamily: 'Debian', + lsbdistcodename: 'precise', + lsbdistid: 'Debian', + puppetversion: Puppet.version, + } + end + let(:params) do + { keys: { + '55BE302B' => { + 'server' => 'subkeys.pgp.net', + }, + 'EF8D349F' => { + 'server' => 'pgp.mit.edu', + }, + } } + end + + it { + is_expected.to contain_apt__key('55BE302B').with(server: 'subkeys.pgp.net') + } + + it { + is_expected.to contain_apt__key('EF8D349F').with(server: 'pgp.mit.edu') + } + end + + context 'with ppas defined on valid osfamily' do + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '12', full: '12.04.5' } }, + osfamily: 'Debian', + lsbdistcodename: 'precise', + lsbdistid: 'ubuntu', + lsbdistrelease: '12.04', + puppetversion: Puppet.version, + } + end + let(:params) do + { ppas: { + 'ppa:drizzle-developers/ppa' => {}, + 'ppa:nginx/stable' => {}, + } } + end + + it { is_expected.to contain_apt__ppa('ppa:drizzle-developers/ppa') } + it { is_expected.to contain_apt__ppa('ppa:nginx/stable') } + end + + context 'with settings defined on valid osfamily' do + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '12', full: '12.04.5' } }, + osfamily: 'Debian', + lsbdistcodename: 'precise', + lsbdistid: 'Debian', + puppetversion: Puppet.version, + } + end + let(:params) do + { settings: { + 'conf-banana' => { 'content' => 'banana' }, + 'pref-banana' => { 'content' => 'banana' }, + } } + end + + it { is_expected.to contain_apt__setting('conf-banana') } + it { is_expected.to contain_apt__setting('pref-banana') } + end + + context 'with pins defined on valid osfamily' do + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '12', full: '12.04.5' } }, + osfamily: 'Debian', + lsbdistcodename: 'precise', + lsbdistid: 'Debian', + puppetversion: Puppet.version, + } + end + let(:params) do + { pins: { + 'stable' => { 'priority' => 600, 'order' => 50 }, + 'testing' => { 'priority' => 700, 'order' => 100 }, + } } + end + + it { is_expected.to contain_apt__pin('stable') } + it { is_expected.to contain_apt__pin('testing') } + end + + describe 'failing tests' do + context "with purge['sources.list']=>'banana'" do + let(:params) { { purge: { 'sources.list' => 'banana' } } } + + it do + is_expected.to raise_error(Puppet::Error) + end + end + + context "with purge['sources.list.d']=>'banana'" do + let(:params) { { purge: { 'sources.list.d' => 'banana' } } } + + it do + is_expected.to raise_error(Puppet::Error) + end + end + + context "with purge['preferences']=>'banana'" do + let(:params) { { purge: { 'preferences' => 'banana' } } } + + it do + is_expected.to raise_error(Puppet::Error) + end + end + + context "with purge['preferences.d']=>'banana'" do + let(:params) { { purge: { 'preferences.d' => 'banana' } } } + + it do + is_expected.to raise_error(Puppet::Error) + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/classes/apt_update_spec.rb b/code/environments/production/modules/apt/spec/classes/apt_update_spec.rb new file mode 100644 index 0000000..675bbd2 --- /dev/null +++ b/code/environments/production/modules/apt/spec/classes/apt_update_spec.rb @@ -0,0 +1,152 @@ +require 'spec_helper' + +describe 'apt::update', type: :class do + context "when apt::update['frequency']='always'" do + { + 'a recent run' => Time.now.to_i, + 'we are due for a run' => 1_406_660_561, + 'the update-success-stamp file does not exist' => -1, + }.each_pair do |desc, factval| + context "when $::apt_update_last_success indicates #{desc}" do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + apt_update_last_success: factval, + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + let(:pre_condition) do + "class{'::apt': update => {'frequency' => 'always' },}" + end + + it 'triggers an apt-get update run' do + # set the apt_update exec's refreshonly attribute to false + is_expected.to contain_exec('apt_update').with('refreshonly' => false) + end + end + end + context 'when $::apt_update_last_success is nil' do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + let(:pre_condition) { "class{ '::apt': update => {'frequency' => 'always' },}" } + + it 'triggers an apt-get update run' do + # set the apt_update exec\'s refreshonly attribute to false + is_expected.to contain_exec('apt_update').with('refreshonly' => false) + end + end + end + context "when apt::update['frequency']='reluctantly'" do + { + 'a recent run' => Time.now.to_i, + 'we are due for a run' => 1_406_660_561, + 'the update-success-stamp file does not exist' => -1, + }.each_pair do |desc, factval| + context "when $::apt_update_last_success indicates #{desc}" do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + apt_update_last_success: factval, + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + let(:pre_condition) { "class{ '::apt': update => {'frequency' => 'reluctantly' },}" } + + it 'does not trigger an apt-get update run' do + # don't change the apt_update exec's refreshonly attribute. (it should be true) + is_expected.to contain_exec('apt_update').with('refreshonly' => true) + end + end + end + context 'when $::apt_update_last_success is nil' do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + let(:pre_condition) { "class{ '::apt': update => {'frequency' => 'reluctantly' },}" } + + it 'does not trigger an apt-get update run' do + # don't change the apt_update exec's refreshonly attribute. (it should be true) + is_expected.to contain_exec('apt_update').with('refreshonly' => true) + end + end + end + %w[daily weekly].each do |update_frequency| + context "when apt::update['frequency'] has the value of #{update_frequency}" do + { 'we are due for a run' => 1_406_660_561, 'the update-success-stamp file does not exist' => -1 }.each_pair do |desc, factval| + context "when $::apt_update_last_success indicates #{desc}" do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + apt_update_last_success: factval, + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + let(:pre_condition) { "class{ '::apt': update => {'frequency' => '#{update_frequency}',} }" } + + it 'triggers an apt-get update run' do + # set the apt_update exec\'s refreshonly attribute to false + is_expected.to contain_exec('apt_update').with('refreshonly' => false) + end + end + end + context 'when the $::apt_update_last_success fact has a recent value' do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + apt_update_last_success: Time.now.to_i, + puppetversion: Puppet.version, + } + end + let(:pre_condition) { "class{ '::apt': update => {'frequency' => '#{update_frequency}',} }" } + + it 'does not trigger an apt-get update run' do + # don't change the apt_update exec\'s refreshonly attribute. (it should be true) + is_expected.to contain_exec('apt_update').with('refreshonly' => true) + end + end + context 'when $::apt_update_last_success is nil' do + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + apt_update_last_success: nil, + puppetversion: Puppet.version, + } + end + let(:pre_condition) { "class{ '::apt': update => {'frequency' => '#{update_frequency}',} }" } + + it 'triggers an apt-get update run' do + # set the apt_update exec\'s refreshonly attribute to false + is_expected.to contain_exec('apt_update').with('refreshonly' => false) + end + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/defines/conf_spec.rb b/code/environments/production/modules/apt/spec/defines/conf_spec.rb new file mode 100644 index 0000000..d79cb22 --- /dev/null +++ b/code/environments/production/modules/apt/spec/defines/conf_spec.rb @@ -0,0 +1,90 @@ +require 'spec_helper' +describe 'apt::conf', type: :define do + let :pre_condition do + 'class { "apt": }' + end + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + let :title do + 'norecommends' + end + + describe 'when creating an apt preference' do + let :default_params do + { + priority: '00', + content: "Apt::Install-Recommends 0;\nApt::AutoRemove::InstallRecommends 1;\n", + } + end + let :params do + default_params + end + + let :filename do + '/etc/apt/apt.conf.d/00norecommends' + end + + it { + is_expected.to contain_file(filename).with('ensure' => 'present', + 'content' => %r{Apt::Install-Recommends 0;\nApt::AutoRemove::InstallRecommends 1;}, + 'owner' => 'root', + 'group' => 'root', + 'mode' => '0644') + } + + context 'with notify_update = true (default)' do + let :params do + default_params + end + + it { is_expected.to contain_apt__setting("conf-#{title}").with_notify_update(true) } + end + + context 'with notify_update = false' do + let :params do + default_params.merge(notify_update: false) + end + + it { is_expected.to contain_apt__setting("conf-#{title}").with_notify_update(false) } + end + end + + describe 'when creating a preference without content' do + let :params do + { + priority: '00', + } + end + + it 'fails' do + is_expected.to raise_error(%r{pass in content}) + end + end + + describe 'when removing an apt preference' do + let :params do + { + ensure: 'absent', + priority: '00', + } + end + + let :filename do + '/etc/apt/apt.conf.d/00norecommends' + end + + it { + is_expected.to contain_file(filename).with('ensure' => 'absent', + 'owner' => 'root', + 'group' => 'root', + 'mode' => '0644') + } + end +end diff --git a/code/environments/production/modules/apt/spec/defines/key_compat_spec.rb b/code/environments/production/modules/apt/spec/defines/key_compat_spec.rb new file mode 100644 index 0000000..43ccbbc --- /dev/null +++ b/code/environments/production/modules/apt/spec/defines/key_compat_spec.rb @@ -0,0 +1,360 @@ +require 'spec_helper' + +def contains_apt_key_example(title) + { id: title, + ensure: 'present', + source: 'http://apt.puppetlabs.com/pubkey.gpg', + server: 'pgp.mit.edu', + content: params[:content], + options: 'debug' } +end + +def apt_key_example(title) + { id: title, + ensure: 'present', + source: nil, + server: 'keyserver.ubuntu.com', + content: nil, + keyserver_options: nil } +end + +describe 'apt::key', type: :define do + GPG_KEY_ID = '6F6B15509CF8E59E6E469F327F438280EF8D349F'.freeze + + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + + let :title do + GPG_KEY_ID + end + + let :pre_condition do + 'include apt' + end + + describe 'normal operation' do + describe 'default options' do + it { + is_expected.to contain_apt_key(title).with(id: title, + ensure: 'present', + source: nil, + server: 'keyserver.ubuntu.com', + content: nil) + } + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{title} present") + end + end + + describe 'title and key =>' do + let :title do + 'puppetlabs' + end + + let :params do + { + id: GPG_KEY_ID, + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(id: GPG_KEY_ID, + ensure: 'present', + source: nil, + server: 'keyserver.ubuntu.com', + content: nil) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{GPG_KEY_ID} present") + end + end + + describe 'ensure => absent' do + let :params do + { + ensure: 'absent', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(id: title, + ensure: 'absent', + source: nil, + server: 'keyserver.ubuntu.com', + content: nil) + end + it 'contains the apt_key absent anchor' do + is_expected.to contain_anchor("apt_key #{title} absent") + end + end + + describe 'set a bunch of things!' do + let :params do + { + content: 'GPG key content', + source: 'http://apt.puppetlabs.com/pubkey.gpg', + server: 'pgp.mit.edu', + options: 'debug', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(contains_apt_key_example(title)) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{title} present") + end + end + + context 'when domain has dash' do + let(:params) do + { + server: 'p-gp.m-it.edu', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(id: title, + server: 'p-gp.m-it.edu') + end + end + + context 'with url' do + let :params do + { + server: 'hkp://pgp.mit.edu', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(id: title, + server: 'hkp://pgp.mit.edu') + end + end + context 'with url and port number' do + let :params do + { + server: 'hkp://pgp.mit.edu:80', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(id: title, + server: 'hkp://pgp.mit.edu:80') + end + end + end + + describe 'validation' do + context 'when domain begins with a dash' do + let(:params) do + { + server: '-pgp.mit.edu', + } + end + + it 'fails' do + is_expected .to raise_error(%r{expects a match}) + end + end + + context 'when domain begins with dot' do + let(:params) do + { + server: '.pgp.mit.edu', + } + end + + it 'fails' do + is_expected .to raise_error(%r{expects a match}) + end + end + + context 'when domain ends with dot' do + let(:params) do + { + server: 'pgp.mit.edu.', + } + end + + it 'fails' do + is_expected .to raise_error(%r{expects a match}) + end + end + context 'when url character limit is exceeded' do + let :params do + { + server: 'hkp://pgpiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.mit.edu', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with incorrect port number url' do + let :params do + { + server: 'hkp://pgp.mit.edu:8008080', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with incorrect protocol for url' do + let :params do + { + server: 'abc://pgp.mit.edu:80', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with missing port number url' do + let :params do + { + server: 'hkp://pgp.mit.edu:', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with url ending with a dot' do + let :params do + { + server: 'hkp://pgp.mit.edu.', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with url begin with a dash' do + let(:params) do + { + server: 'hkp://-pgp.mit.edu', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with invalid key' do + let :title do + 'Out of rum. Why? Why are we out of rum?' + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + + context 'with invalid source' do + let :params do + { + source: 'afp://puppetlabs.com/key.gpg', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + + context 'with invalid content' do + let :params do + { + content: [], + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a}) + end + end + + context 'with invalid server' do + let :params do + { + server: 'two bottles of rum', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + + context 'with invalid keyserver_options' do + let :params do + { + options: {}, + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a}) + end + end + + context 'with invalid ensure' do + let :params do + { + ensure: 'foo', + } + end + + it 'fails' do + is_expected.to raise_error(%r{Enum\['absent', 'present'\]}) + end + end + + describe 'duplication - two apt::key resources for same key, different titles' do + let :pre_condition do + "#{super()}\napt::key { 'duplicate': id => '#{title}', }" + end + + it 'contains the duplicate apt::key resource' do + is_expected.to contain_apt__key('duplicate').with(id: title, + ensure: 'present') + end + + it 'contains the original apt::key resource' do + is_expected.to contain_apt__key(title).with(id: title, + ensure: 'present') + end + + it 'contains the native apt_key' do + is_expected.to contain_apt_key('duplicate').with(apt_key_example(title)) + end + + it 'does not contain the original apt_key' do + is_expected.not_to contain_apt_key(title) + end + end + + describe 'duplication - two apt::key resources, different ensure' do + let :pre_condition do + "#{super()}\napt::key { 'duplicate': id => '#{title}', ensure => 'absent', }" + end + + it 'informs the user of the impossibility' do + is_expected.to raise_error(%r{already ensured as absent}) + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/defines/key_spec.rb b/code/environments/production/modules/apt/spec/defines/key_spec.rb new file mode 100644 index 0000000..6a5a89f --- /dev/null +++ b/code/environments/production/modules/apt/spec/defines/key_spec.rb @@ -0,0 +1,367 @@ +require 'spec_helper' + +GPG_KEY_ID = '6F6B15509CF8E59E6E469F327F438280EF8D349F'.freeze + +title_key_example = { id: GPG_KEY_ID, + ensure: 'present', + source: nil, + server: 'keyserver.ubuntu.com', + content: nil, + options: nil } + +def default_apt_key_example(title) + { id: title, + ensure: 'present', + source: nil, + server: 'keyserver.ubuntu.com', + content: nil, + options: nil } +end + +def bunch_things_apt_key_example(title, params) + { id: title, + ensure: 'present', + source: 'http://apt.puppetlabs.com/pubkey.gpg', + server: 'pgp.mit.edu', + content: params[:content], + options: 'debug' } +end + +def absent_apt_key(title) + { id: title, + ensure: 'absent', + source: nil, + server: 'keyserver.ubuntu.com', + content: nil, + keyserver: nil } +end + +describe 'apt::key' do + let :pre_condition do + 'class { "apt": }' + end + + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + + let :title do + GPG_KEY_ID + end + + describe 'normal operation' do + describe 'default options' do + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(default_apt_key_example(title)) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{title} present") + end + end + + describe 'title and key =>' do + let :title do + 'puppetlabs' + end + + let :params do + { + id: GPG_KEY_ID, + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(title_key_example) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{GPG_KEY_ID} present") + end + end + + describe 'ensure => absent' do + let :params do + { + ensure: 'absent', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(absent_apt_key(title)) + end + it 'contains the apt_key absent anchor' do + is_expected.to contain_anchor("apt_key #{title} absent") + end + end + + describe 'set a bunch of things!' do + let :params do + { + content: 'GPG key content', + source: 'http://apt.puppetlabs.com/pubkey.gpg', + server: 'pgp.mit.edu', + options: 'debug', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(bunch_things_apt_key_example(title, params)) + end + it 'contains the apt_key present anchor' do + is_expected.to contain_anchor("apt_key #{title} present") + end + end + + context 'when domain with dash' do + let(:params) do + { + server: 'p-gp.m-it.edu', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(id: title, + server: 'p-gp.m-it.edu') + end + end + + context 'with url' do + let :params do + { + server: 'hkp://pgp.mit.edu', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(id: title, + server: 'hkp://pgp.mit.edu') + end + end + context 'when url with port number' do + let :params do + { + server: 'hkp://pgp.mit.edu:80', + } + end + + it 'contains the apt_key' do + is_expected.to contain_apt_key(title).with(id: title, + server: 'hkp://pgp.mit.edu:80') + end + end + end + + describe 'validation' do + context 'when domain begin with dash' do + let(:params) do + { + server: '-pgp.mit.edu', + } + end + + it 'fails' do + is_expected .to raise_error(%r{expects a match}) + end + end + + context 'when domain begin with dot' do + let(:params) do + { + server: '.pgp.mit.edu', + } + end + + it 'fails' do + is_expected .to raise_error(%r{expects a match}) + end + end + + context 'when domain end with dot' do + let(:params) do + { + server: 'pgp.mit.edu.', + } + end + + it 'fails' do + is_expected .to raise_error(%r{expects a match}) + end + end + context 'when character url exceeded' do + let :params do + { + server: 'hkp://pgpiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.mit.edu', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with incorrect port number url' do + let :params do + { + server: 'hkp://pgp.mit.edu:8008080', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with incorrect protocol for url' do + let :params do + { + server: 'abc://pgp.mit.edu:80', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with missing port number url' do + let :params do + { + server: 'hkp://pgp.mit.edu:', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with url ending with a dot' do + let :params do + { + server: 'hkp://pgp.mit.edu.', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'when url begins with a dash' do + let(:params) do + { + server: 'hkp://-pgp.mit.edu', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + context 'with invalid key' do + let :title do + 'Out of rum. Why? Why are we out of rum?' + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + + context 'with invalid source' do + let :params do + { + source: 'afp://puppetlabs.com/key.gpg', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + + context 'with invalid content' do + let :params do + { + content: [], + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a}) + end + end + + context 'with invalid server' do + let :params do + { + server: 'two bottles of rum', + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a match}) + end + end + + context 'with invalid options' do + let :params do + { + options: {}, + } + end + + it 'fails' do + is_expected.to raise_error(%r{expects a}) + end + end + + context 'with invalid ensure' do + %w[foo aabsent absenta apresent presenta].each do |param| + let :params do + { + ensure: param, + } + end + + it 'fails' do + is_expected.to raise_error(%r{for Enum\['absent', 'present'\], got}) + end + end + end + + describe 'duplication - two apt::key resources for same key, different titles' do + let :pre_condition do + "class { 'apt': } + apt::key { 'duplicate': id => '#{title}', }" + end + + it 'contains two apt::key resource - duplicate' do + is_expected.to contain_apt__key('duplicate').with(id: title, + ensure: 'present') + end + it 'contains two apt::key resource - title' do + is_expected.to contain_apt__key(title).with(id: title, + ensure: 'present') + end + + it 'contains only a single apt_key - duplicate' do + is_expected.to contain_apt_key('duplicate').with(default_apt_key_example(title)) + end + it 'contains only a single apt_key - no title' do + is_expected.not_to contain_apt_key(title) + end + end + + describe 'duplication - two apt::key resources, different ensure' do + let :pre_condition do + "class { 'apt': } + apt::key { 'duplicate': id => '#{title}', ensure => 'absent', }" + end + + it 'informs the user of the impossibility' do + is_expected.to raise_error(%r{already ensured as absent}) + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/defines/pin_spec.rb b/code/environments/production/modules/apt/spec/defines/pin_spec.rb new file mode 100644 index 0000000..2329e9a --- /dev/null +++ b/code/environments/production/modules/apt/spec/defines/pin_spec.rb @@ -0,0 +1,148 @@ +require 'spec_helper' +describe 'apt::pin', type: :define do + let :pre_condition do + 'class { "apt": }' + end + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + let(:title) { 'my_pin' } + + context 'with defaults' do + it { is_expected.to contain_apt__setting('pref-my_pin').with_content(%r{Explanation: : my_pin\nPackage: \*\nPin: release a=my_pin\nPin-Priority: 0\n}) } + end + + context 'with set version' do + let :params do + { + 'packages' => 'vim', + 'version' => '1', + } + end + + it { is_expected.to contain_apt__setting('pref-my_pin').with_content(%r{Explanation: : my_pin\nPackage: vim\nPin: version 1\nPin-Priority: 0\n}) } + end + + context 'with set origin' do + let :params do + { + 'packages' => 'vim', + 'origin' => 'test', + } + end + + it { is_expected.to contain_apt__setting('pref-my_pin').with_content(%r{Explanation: : my_pin\nPackage: vim\nPin: origin test\nPin-Priority: 0\n}) } + end + + context 'without defaults' do + let :params do + { + 'explanation' => 'foo', + 'order' => 99, + 'release' => '1', + 'codename' => 'bar', + 'release_version' => '2', + 'component' => 'baz', + 'originator' => 'foobar', + 'label' => 'foobaz', + 'priority' => 10, + } + end + + it { is_expected.to contain_apt__setting('pref-my_pin').with_content(%r{Explanation: foo\nPackage: \*\nPin: release a=1, n=bar, v=2, c=baz, o=foobar, l=foobaz\nPin-Priority: 10\n}) } + it { + is_expected.to contain_apt__setting('pref-my_pin').with('priority' => 99) + } + end + + context 'with ensure absent' do + let :params do + { + 'ensure' => 'absent', + } + end + + it { + is_expected.to contain_apt__setting('pref-my_pin').with('ensure' => 'absent') + } + end + + context 'with bad characters' do + let(:title) { 'such bad && wow!' } + + it { is_expected.to contain_apt__setting('pref-such__bad____wow_') } + end + + describe 'validation' do + context 'with invalid order' do + let :params do + { + 'order' => 'foo', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{expects an Integer value, got String}) + end + end + + context 'with packages == * and version' do + let :params do + { + 'version' => '1', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{parameter version cannot be used in general form}) + end + end + + context 'with packages == * and release and origin' do + let :params do + { + 'origin' => 'test', + 'release' => 'foo', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{parameters release and origin are mutually exclusive}) + end + end + + context 'with specific release and origin' do + let :params do + { + 'release' => 'foo', + 'origin' => 'test', + 'packages' => 'vim', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{parameters release, origin, and version are mutually exclusive}) + end + end + + context 'with specific version and origin' do + let :params do + { + 'version' => '1', + 'origin' => 'test', + 'packages' => 'vim', + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{parameters release, origin, and version are mutually exclusive}) + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/defines/ppa_spec.rb b/code/environments/production/modules/apt/spec/defines/ppa_spec.rb new file mode 100644 index 0000000..b534186 --- /dev/null +++ b/code/environments/production/modules/apt/spec/defines/ppa_spec.rb @@ -0,0 +1,379 @@ +require 'spec_helper' +describe 'apt::ppa' do + let :pre_condition do + 'class { "apt": }' + end + + describe 'defaults' do + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '11', full: '11.04' } }, + lsbdistrelease: '11.04', + lsbdistcodename: 'natty', + operatingsystem: 'Ubuntu', + osfamily: 'Debian', + lsbdistid: 'Ubuntu', + puppetversion: Puppet.version, + } + end + + let(:title) { 'ppa:needs/such.substitution/wow+type' } + + it { is_expected.not_to contain_package('python-software-properties') } + it { + is_expected.to contain_exec('add-apt-repository-ppa:needs/such.substitution/wow+type').that_notifies('Class[Apt::Update]').with(environment: [], + command: '/usr/bin/add-apt-repository -y ppa:needs/such.substitution/wow+type', # rubocop:disable Metrics/LineLength + unless: '/usr/bin/test -f /etc/apt/sources.list.d/needs-such_substitution-wow_type-natty.list', # rubocop:disable Metrics/LineLength + user: 'root', + logoutput: 'on_failure') + } + end + + describe 'Ubuntu 15.10 sources.list filename' do + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '15', full: '15.10' } }, + lsbdistrelease: '15.10', + lsbdistcodename: 'wily', + operatingsystem: 'Ubuntu', + osfamily: 'Debian', + lsbdistid: 'Ubuntu', + puppetversion: Puppet.version, + } + end + + let(:title) { 'ppa:user/foo' } + + it { + is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with(environment: [], + command: '/usr/bin/add-apt-repository -y ppa:user/foo', + unless: '/usr/bin/test -f /etc/apt/sources.list.d/user-ubuntu-foo-wily.list', + user: 'root', + logoutput: 'on_failure') + } + end + + describe 'package_name => software-properties-common' do + let :pre_condition do + 'class { "apt": }' + end + let :params do + { + package_name: 'software-properties-common', + package_manage: true, + } + end + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '11', full: '11.04' } }, + lsbdistrelease: '11.04', + lsbdistcodename: 'natty', + operatingsystem: 'Ubuntu', + osfamily: 'Debian', + lsbdistid: 'Ubuntu', + puppetversion: Puppet.version, + } + end + + let(:title) { 'ppa:needs/such.substitution/wow' } + + it { is_expected.to contain_package('software-properties-common') } + it { + is_expected.to contain_exec('add-apt-repository-ppa:needs/such.substitution/wow').that_notifies('Class[Apt::Update]').with('environment' => [], + 'command' => '/usr/bin/add-apt-repository -y ppa:needs/such.substitution/wow', # rubocop:disable Metrics/LineLength + 'unless' => '/usr/bin/test -f /etc/apt/sources.list.d/needs-such_substitution-wow-natty.list', # rubocop:disable Metrics/LineLength + 'user' => 'root', + 'logoutput' => 'on_failure') + } + + it { + is_expected.to contain_file('/etc/apt/sources.list.d/needs-such_substitution-wow-natty.list').that_requires('Exec[add-apt-repository-ppa:needs/such.substitution/wow]').with('ensure' => 'file') + } + end + + describe 'package_manage => true, multiple ppas, MODULES-2873' do + let :pre_condition do + 'class { "apt": } + apt::ppa {"ppa:user/foo": + package_manage => true + }' + end + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '11', full: '11.04' } }, + lsbdistrelease: '11.04', + lsbdistcodename: 'natty', + operatingsystem: 'Ubuntu', + osfamily: 'Debian', + lsbdistid: 'Ubuntu', + puppetversion: Puppet.version, + } + end + let :params do + { + package_manage: true, + } + end + + let(:title) { 'ppa:user/bar' } + + it { is_expected.to contain_package('python-software-properties') } + it { + is_expected.to contain_exec('add-apt-repository-ppa:user/bar').that_notifies('Class[Apt::Update]').with('environment' => [], + 'command' => '/usr/bin/add-apt-repository -y ppa:user/bar', + 'unless' => '/usr/bin/test -f /etc/apt/sources.list.d/user-bar-natty.list', + 'user' => 'root', + 'logoutput' => 'on_failure') + } + + it { + is_expected.to contain_file('/etc/apt/sources.list.d/user-bar-natty.list').that_requires('Exec[add-apt-repository-ppa:user/bar]').with('ensure' => 'file') + } + end + + describe 'package_manage => false' do + let :pre_condition do + 'class { "apt": }' + end + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '11', full: '11.04' } }, + lsbdistrelease: '11.04', + lsbdistcodename: 'natty', + operatingsystem: 'Ubuntu', + osfamily: 'Debian', + lsbdistid: 'Ubuntu', + puppetversion: Puppet.version, + } + end + let :params do + { + package_manage: false, + } + end + + let(:title) { 'ppa:needs/such.substitution/wow' } + + it { is_expected.not_to contain_package('python-software-properties') } + it { + is_expected.to contain_exec('add-apt-repository-ppa:needs/such.substitution/wow').that_notifies('Class[Apt::Update]').with('environment' => [], + 'command' => '/usr/bin/add-apt-repository -y ppa:needs/such.substitution/wow', # rubocop:disable Metrics/LineLength + 'unless' => '/usr/bin/test -f /etc/apt/sources.list.d/needs-such_substitution-wow-natty.list', # rubocop:disable Metrics/LineLength + 'user' => 'root', + 'logoutput' => 'on_failure') + } + + it { + is_expected.to contain_file('/etc/apt/sources.list.d/needs-such_substitution-wow-natty.list').that_requires('Exec[add-apt-repository-ppa:needs/such.substitution/wow]').with('ensure' => 'file') + } + end + + describe 'apt included, no proxy' do + let :pre_condition do + 'class { "apt": } + apt::ppa { "ppa:user/foo2": } + ' + end + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistrelease: '14.04', + lsbdistcodename: 'trusty', + operatingsystem: 'Ubuntu', + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + options: '', + package_manage: true, + require: 'Apt::Ppa[ppa:user/foo2]', + } + end + let(:title) { 'ppa:user/foo' } + + it { is_expected.to compile.with_all_deps } + it { is_expected.to contain_package('software-properties-common') } + it { + is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with(environment: [], + command: '/usr/bin/add-apt-repository ppa:user/foo', + unless: '/usr/bin/test -f /etc/apt/sources.list.d/user-foo-trusty.list', + user: 'root', + logoutput: 'on_failure') + } + end + + describe 'apt included, proxy host' do + let :pre_condition do + 'class { "apt": + proxy => { "host" => "localhost" }, + }' + end + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistrelease: '14.04', + lsbdistcodename: 'trusty', + operatingsystem: 'Ubuntu', + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + 'options' => '', + 'package_manage' => true, + } + end + let(:title) { 'ppa:user/foo' } + + it { is_expected.to contain_package('software-properties-common') } + it { + is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with(environment: ['http_proxy=http://localhost:8080'], + command: '/usr/bin/add-apt-repository ppa:user/foo', + unless: '/usr/bin/test -f /etc/apt/sources.list.d/user-foo-trusty.list', + user: 'root', + logoutput: 'on_failure') + } + end + + describe 'apt included, proxy host and port' do + let :pre_condition do + 'class { "apt": + proxy => { "host" => "localhost", "port" => 8180 }, + }' + end + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistrelease: '14.04', + lsbdistcodename: 'trusty', + operatingsystem: 'Ubuntu', + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + options: '', + package_manage: true, + } + end + let(:title) { 'ppa:user/foo' } + + it { is_expected.to contain_package('software-properties-common') } + it { + is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with(environment: ['http_proxy=http://localhost:8180'], + command: '/usr/bin/add-apt-repository ppa:user/foo', + unless: '/usr/bin/test -f /etc/apt/sources.list.d/user-foo-trusty.list', + user: 'root', + logoutput: 'on_failure') + } + end + + describe 'apt included, proxy host and port and https' do + let :pre_condition do + 'class { "apt": + proxy => { "host" => "localhost", "port" => 8180, "https" => true }, + }' + end + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistrelease: '14.04', + lsbdistcodename: 'trusty', + operatingsystem: 'Ubuntu', + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + options: '', + package_manage: true, + } + end + let(:title) { 'ppa:user/foo' } + + it { is_expected.to contain_package('software-properties-common') } + it { + is_expected.to contain_exec('add-apt-repository-ppa:user/foo').that_notifies('Class[Apt::Update]').with(environment: ['http_proxy=http://localhost:8180', 'https_proxy=https://localhost:8180'], + command: '/usr/bin/add-apt-repository ppa:user/foo', + unless: '/usr/bin/test -f /etc/apt/sources.list.d/user-foo-trusty.list', + user: 'root', + logoutput: 'on_failure') + } + end + + describe 'ensure absent' do + let :pre_condition do + 'class { "apt": }' + end + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistrelease: '14.04', + lsbdistcodename: 'trusty', + operatingsystem: 'Ubuntu', + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let(:title) { 'ppa:user/foo' } + let :params do + { + ensure: 'absent', + } + end + + it { + is_expected.to contain_file('/etc/apt/sources.list.d/user-foo-trusty.list').that_notifies('Class[Apt::Update]').with(ensure: 'absent') + } + end + + context 'with validation' do + describe 'no release' do + let :facts do + { + os: { family: 'Debian', name: 'Ubuntu', release: { major: '14', full: '14.04' } }, + lsbdistrelease: '14.04', + operatingsystem: 'Ubuntu', + lsbdistid: 'Ubuntu', + osfamily: 'Debian', + lsbdistcodeanme: nil, + puppetversion: Puppet.version, + } + end + let(:title) { 'ppa:user/foo' } + + it do + is_expected.to raise_error(Puppet::Error, %r{lsbdistcodename fact not available: release parameter required}) + end + end + + describe 'not ubuntu' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '6', full: '6.0.7' } }, + lsbdistrelease: '6.0.7', + lsbdistcodename: 'wheezy', + operatingsystem: 'Debian', + lsbdistid: 'debian', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let(:title) { 'ppa:user/foo' } + + it do + is_expected.to raise_error(Puppet::Error, %r{not currently supported on Debian}) + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/defines/setting_spec.rb b/code/environments/production/modules/apt/spec/defines/setting_spec.rb new file mode 100644 index 0000000..1a94de7 --- /dev/null +++ b/code/environments/production/modules/apt/spec/defines/setting_spec.rb @@ -0,0 +1,145 @@ +require 'spec_helper' + +describe 'apt::setting' do + let(:pre_condition) { 'class { "apt": }' } + let :facts do + { + os: { distro: { codename: 'wheezy' }, family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistrelease: '7.0', + lsbdistcodename: 'wheezy', + operatingsystem: 'Debian', + osfamily: 'Debian', + lsbdistid: 'Debian', + puppetversion: Puppet.version, + } + end + let(:title) { 'conf-teddybear' } + + let(:default_params) { { content: 'di' } } + + describe 'when using the defaults' do + context 'without source or content' do + it do + is_expected.to raise_error(Puppet::Error, %r{needs either of }) + end + end + + context 'with title=conf-teddybear ' do + let(:params) { default_params } + + it { is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]') } + end + + context 'with title=pref-teddybear' do + let(:title) { 'pref-teddybear' } + let(:params) { default_params } + + it { is_expected.to contain_file('/etc/apt/preferences.d/teddybear.pref').that_notifies('Class[Apt::Update]') } + end + + context 'with title=list-teddybear' do + let(:title) { 'list-teddybear' } + let(:params) { default_params } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/teddybear.list').that_notifies('Class[Apt::Update]') } + end + + context 'with source' do + let(:params) { { source: 'puppet:///la/die/dah' } } + + it { + is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]').with(ensure: 'file', + owner: 'root', + group: 'root', + mode: '0644', + source: params[:source].to_s) + } + end + + context 'with content' do + let(:params) { default_params } + + it { + is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]').with(ensure: 'file', + owner: 'root', + group: 'root', + mode: '0644', + content: params[:content].to_s) + } + end + end + + describe 'settings requiring settings, MODULES-769' do + let(:pre_condition) do + 'class { "apt": } + apt::setting { "list-teddybear": content => "foo" } + ' + end + let(:facts) do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + let(:title) { 'conf-teddybear' } + let(:default_params) { { content: 'di' } } + + let(:params) { default_params.merge(require: 'Apt::Setting[list-teddybear]') } + + it { is_expected.to compile.with_all_deps } + end + + describe 'when trying to pull one over' do + context 'with source and content' do + let(:params) { default_params.merge(source: 'la') } + + it do + is_expected.to raise_error(Puppet::Error, %r{cannot have both }) + end + end + + context 'with title=ext-teddybear' do + let(:title) { 'ext-teddybear' } + let(:params) { default_params } + + it do + is_expected.to raise_error(Puppet::Error, %r{must start with either}) + end + end + + context 'with ensure=banana' do + let(:params) { default_params.merge(ensure: 'banana') } + + it do + is_expected.to raise_error(Puppet::Error, %r{Enum\['absent', 'file', 'present'\]}) + end + end + + context 'with priority=1.2' do + let(:params) { default_params.merge(priority: 1.2) } + + if Puppet::Util::Package.versioncmp(Puppet.version, '4.0') >= 0 || ENV['FUTURE_PARSER'] == 'yes' + it { is_expected.to compile.and_raise_error(%r{expects a value of type}) } + else + it { is_expected.to compile.and_raise_error(%r{priority must be an integer or a zero-padded integer}) } + end + end + end + + describe 'with priority=100' do + let(:params) { default_params.merge(priority: 100) } + + it { is_expected.to contain_file('/etc/apt/apt.conf.d/100teddybear').that_notifies('Class[Apt::Update]') } + end + + describe 'with ensure=absent' do + let(:params) { default_params.merge(ensure: 'absent') } + + it { + is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]').with(ensure: 'absent') + } + end +end diff --git a/code/environments/production/modules/apt/spec/defines/source_compat_spec.rb b/code/environments/production/modules/apt/spec/defines/source_compat_spec.rb new file mode 100644 index 0000000..f89f4be --- /dev/null +++ b/code/environments/production/modules/apt/spec/defines/source_compat_spec.rb @@ -0,0 +1,154 @@ +require 'spec_helper' + +describe 'apt::source', type: :define do + GPG_KEY_ID = '6F6B15509CF8E59E6E469F327F438280EF8D349F'.freeze + + let :title do + 'my_source' + end + + context 'with mostly defaults' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + + let :params do + { + 'include' => { 'deb' => false, 'src' => true }, + 'location' => 'http://debian.mirror.iweb.ca/debian/', + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with_content(%r{# my_source\ndeb-src http://debian.mirror.iweb.ca/debian/ wheezy main\n}) + } + end + + context 'with no defaults' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + 'comment' => 'foo', + 'location' => 'http://debian.mirror.iweb.ca/debian/', + 'release' => 'sid', + 'repos' => 'testing', + 'include' => { 'src' => false }, + 'key' => GPG_KEY_ID, + 'pin' => '10', + 'architecture' => 'x86_64', + 'allow_unsigned' => true, + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with_content(%r{# foo\ndeb \[arch=x86_64 trusted=yes\] http://debian.mirror.iweb.ca/debian/ sid testing\n}) + .without_content(%r{deb-src}) + } + + it { + is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with('ensure' => 'present', + 'priority' => '10', + 'origin' => 'debian.mirror.iweb.ca') + } + + it { + is_expected.to contain_apt__key("Add key: #{GPG_KEY_ID} from Apt::Source my_source").that_comes_before('Apt::Setting[list-my_source]').with('ensure' => 'present', + 'id' => GPG_KEY_ID) + } + end + + context 'when allow_unsigned true' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + 'include' => { 'src' => false }, + 'location' => 'http://debian.mirror.iweb.ca/debian/', + 'allow_unsigned' => true, + } + end + + it { is_expected.to contain_apt__setting('list-my_source').with_content(%r{# my_source\ndeb \[trusted=yes\] http://debian.mirror.iweb.ca/debian/ wheezy main\n}) } + end + + context 'with architecture equals x86_64' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + 'location' => 'http://debian.mirror.iweb.ca/debian/', + 'architecture' => 'x86_64', + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with_content(%r{# my_source\ndeb \[arch=x86_64\] http://debian.mirror.iweb.ca/debian/ wheezy main\n}) + } + end + + context 'with ensure => absent' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + 'ensure' => 'absent', + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with('ensure' => 'absent') + } + end + + describe 'validation' do + context 'with no release' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{lsbdistcodename fact not available: release parameter required}) + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/defines/source_spec.rb b/code/environments/production/modules/apt/spec/defines/source_spec.rb new file mode 100644 index 0000000..a9077e9 --- /dev/null +++ b/code/environments/production/modules/apt/spec/defines/source_spec.rb @@ -0,0 +1,452 @@ +require 'spec_helper' + +describe 'apt::source' do + GPG_KEY_ID = '6F6B15509CF8E59E6E469F327F438280EF8D349F'.freeze + + let :pre_condition do + 'class { "apt": }' + end + + let :title do + 'my_source' + end + + context 'with defaults' do + context 'without location' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + osfamily: 'Debian', + lsbdistcodename: 'wheezy', + puppetversion: Puppet.version, + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{source entry without specifying a location}) + end + end + context 'with location' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let(:params) { { location: 'hello.there' } } + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').without_content(%r{# my_source\ndeb-src hello.there wheezy main\n}) + } + end + end + + describe 'no defaults' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + operatingsystem: 'Debian', + lsbdistrelease: '7.0', + puppetversion: Puppet.version, + } + end + + context 'with complex pin' do + let :params do + { + location: 'hello.there', + pin: { 'release' => 'wishwash', + 'explanation' => 'wishwash', + 'priority' => 1001 }, + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{hello.there wheezy main\n}) + } + + it { is_expected.to contain_file('/etc/apt/sources.list.d/my_source.list').that_notifies('Class[Apt::Update]') } + + it { + is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with(ensure: 'present', + priority: 1001, + explanation: 'wishwash', + release: 'wishwash') + } + end + + context 'with simple key' do + let :params do + { + comment: 'foo', + location: 'http://debian.mirror.iweb.ca/debian/', + release: 'sid', + repos: 'testing', + key: GPG_KEY_ID, + pin: '10', + architecture: 'x86_64', + allow_unsigned: true, + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{# foo\ndeb \[arch=x86_64 trusted=yes\] http://debian.mirror.iweb.ca/debian/ sid testing\n}) + .without_content(%r{deb-src}) + } + + it { + is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with(ensure: 'present', + priority: '10', + origin: 'debian.mirror.iweb.ca') + } + + it { + is_expected.to contain_apt__key("Add key: #{GPG_KEY_ID} from Apt::Source my_source").that_comes_before('Apt::Setting[list-my_source]').with(ensure: 'present', + id: GPG_KEY_ID) + } + end + + context 'with complex key' do + let :params do + { + comment: 'foo', + location: 'http://debian.mirror.iweb.ca/debian/', + release: 'sid', + repos: 'testing', + key: { 'id' => GPG_KEY_ID, 'server' => 'pgp.mit.edu', + 'content' => 'GPG key content', + 'source' => 'http://apt.puppetlabs.com/pubkey.gpg' }, + pin: '10', + architecture: 'x86_64', + allow_unsigned: true, + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{# foo\ndeb \[arch=x86_64 trusted=yes\] http://debian.mirror.iweb.ca/debian/ sid testing\n}) + .without_content(%r{deb-src}) + } + + it { + is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with(ensure: 'present', + priority: '10', + origin: 'debian.mirror.iweb.ca') + } + + it { + is_expected.to contain_apt__key("Add key: #{GPG_KEY_ID} from Apt::Source my_source").that_comes_before('Apt::Setting[list-my_source]').with(ensure: 'present', + id: GPG_KEY_ID, + server: 'pgp.mit.edu', + content: 'GPG key content', + source: 'http://apt.puppetlabs.com/pubkey.gpg') + } + end + + context 'with simple key' do + let :params do + { + comment: 'foo', + location: 'http://debian.mirror.iweb.ca/debian/', + release: 'sid', + repos: 'testing', + key: GPG_KEY_ID, + pin: '10', + architecture: 'x86_64', + allow_unsigned: true, + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{# foo\ndeb \[arch=x86_64 trusted=yes\] http://debian.mirror.iweb.ca/debian/ sid testing\n}) + .without_content(%r{deb-src}) + } + + it { + is_expected.to contain_apt__pin('my_source').that_comes_before('Apt::Setting[list-my_source]').with(ensure: 'present', + priority: '10', + origin: 'debian.mirror.iweb.ca') + } + + it { + is_expected.to contain_apt__key("Add key: #{GPG_KEY_ID} from Apt::Source my_source").that_comes_before('Apt::Setting[list-my_source]').with(ensure: 'present', + id: GPG_KEY_ID) + } + end + end + + context 'with allow_unsigned true' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + location: 'hello.there', + allow_unsigned: true, + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{# my_source\ndeb \[trusted=yes\] hello.there wheezy main\n}) + } + end + + context 'with architecture equals x86_64' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + location: 'hello.there', + include: { 'deb' => false, 'src' => true }, + architecture: 'x86_64', + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{# my_source\ndeb-src \[arch=x86_64\] hello.there wheezy main\n}) + } + end + + context 'with architecture fact and unset architecture parameter' do + let :facts do + { + architecture: 'amd64', + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + location: 'hello.there', + include: { 'deb' => false, 'src' => true }, + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{# my_source\ndeb-src hello.there wheezy main\n}) + } + end + + context 'with include_src => true' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + location: 'hello.there', + include: { 'src' => true }, + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{# my_source\ndeb hello.there wheezy main\ndeb-src hello.there wheezy main\n}) + } + end + + context 'with include deb => false' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'debian', + lsbdistcodename: 'wheezy', + osfamily: 'debian', + puppetversion: Puppet.version, + } + end + let :params do + { + include: { 'deb' => false }, + location: 'hello.there', + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').without_content(%r{deb-src hello.there wheezy main\n}) + } + it { is_expected.to contain_apt__setting('list-my_source').without_content(%r{deb hello.there wheezy main\n}) } + end + + context 'with include src => true and include deb => false' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'debian', + lsbdistcodename: 'wheezy', + osfamily: 'debian', + puppetversion: Puppet.version, + } + end + let :params do + { + include: { 'deb' => false, 'src' => true }, + location: 'hello.there', + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{deb-src hello.there wheezy main\n}) + } + it { is_expected.to contain_apt__setting('list-my_source').without_content(%r{deb hello.there wheezy main\n}) } + end + + context 'with ensure => absent' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + ensure: 'absent', + } + end + + it { + is_expected.to contain_apt__setting('list-my_source').with(ensure: 'absent') + } + end + + describe 'validation' do + context 'with no release' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let(:params) { { location: 'hello.there' } } + + it do + is_expected.to raise_error(Puppet::Error, %r{lsbdistcodename fact not available: release parameter required}) + end + end + + context 'with release is empty string' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let(:params) { { location: 'hello.there', release: '' } } + + it { is_expected.to contain_apt__setting('list-my_source').with_content(%r{hello\.there main}) } + end + + context 'with invalid pin' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + location: 'hello.there', + pin: true, + } + end + + it do + is_expected.to raise_error(Puppet::Error, %r{expects a value}) + end + end + + context 'with notify_update = undef (default)' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + location: 'hello.there', + } + end + + it { is_expected.to contain_apt__setting("list-#{title}").with_notify_update(true) } + end + + context 'with notify_update = true' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + location: 'hello.there', + notify_update: true, + } + end + + it { is_expected.to contain_apt__setting("list-#{title}").with_notify_update(true) } + end + + context 'with notify_update = false' do + let :facts do + { + os: { family: 'Debian', name: 'Debian', release: { major: '7', full: '7.0' } }, + lsbdistid: 'Debian', + lsbdistcodename: 'wheezy', + osfamily: 'Debian', + puppetversion: Puppet.version, + } + end + let :params do + { + location: 'hello.there', + notify_update: false, + } + end + + it { is_expected.to contain_apt__setting("list-#{title}").with_notify_update(false) } + end + end +end diff --git a/code/environments/production/modules/apt/spec/spec_helper.rb b/code/environments/production/modules/apt/spec/spec_helper.rb new file mode 100644 index 0000000..15266c2 --- /dev/null +++ b/code/environments/production/modules/apt/spec/spec_helper.rb @@ -0,0 +1,23 @@ +require 'puppetlabs_spec_helper/module_spec_helper' +require 'rspec-puppet-facts' +include RspecPuppetFacts + +default_facts = { + puppetversion: Puppet.version, + facterversion: Facter.version, +} + +default_facts_path = File.expand_path(File.join(File.dirname(__FILE__), 'default_facts.yml')) +default_module_facts_path = File.expand_path(File.join(File.dirname(__FILE__), 'default_module_facts.yml')) + +if File.exist?(default_facts_path) && File.readable?(default_facts_path) + default_facts.merge!(YAML.safe_load(File.read(default_facts_path))) +end + +if File.exist?(default_module_facts_path) && File.readable?(default_module_facts_path) + default_facts.merge!(YAML.safe_load(File.read(default_module_facts_path))) +end + +RSpec.configure do |c| + c.default_facts = default_facts +end diff --git a/code/environments/production/modules/apt/spec/spec_helper_acceptance.rb b/code/environments/production/modules/apt/spec/spec_helper_acceptance.rb new file mode 100644 index 0000000..2ec2dba --- /dev/null +++ b/code/environments/production/modules/apt/spec/spec_helper_acceptance.rb @@ -0,0 +1,90 @@ +require 'beaker-rspec' +require 'beaker/puppet_install_helper' +require 'beaker/module_install_helper' + +def install_bolt_on(hosts) + on(hosts, "/opt/puppetlabs/puppet/bin/gem install --source http://rubygems.delivery.puppetlabs.net bolt -v '> 0.0.1'", acceptable_exit_codes: [0, 1]).stdout +end + +def pe_install? + ENV['PUPPET_INSTALL_TYPE'] =~ %r{pe}i +end + +run_puppet_install_helper +install_bolt_on(hosts) unless pe_install? +install_module_on(hosts) +install_module_dependencies_on(hosts) + +UNSUPPORTED_PLATFORMS = %w[RedHat Suse windows AIX Solaris].freeze + +DEFAULT_PASSWORD = if default[:hypervisor] == 'vagrant' + 'vagrant' + elsif default[:hypervisor] == 'vcloud' + 'Qu@lity!' + end + +def puppet_version + (on default, puppet('--version')).output.chomp +end + +def run_puppet_access_login(user:, password: + '~!@#$%^*-/ aZ', lifetime: '5y') + on(master, puppet('access', 'login', '--username', user, '--lifetime', lifetime), stdin: password) +end + +def run_task(task_name:, params: nil, password: DEFAULT_PASSWORD) + if pe_install? + run_puppet_task(task_name: task_name, params: params) + else + run_bolt_task(task_name: task_name, params: params, password: password) + end +end + +def run_bolt_task(task_name:, params: nil, password: DEFAULT_PASSWORD) + on(master, "/opt/puppetlabs/puppet/bin/bolt task run #{task_name} --modules /etc/puppetlabs/code/modules/service --nodes localhost --password #{password} #{params}", acceptable_exit_codes: [0, 1]).stdout # rubocop:disable Metrics/LineLength +end + +def run_puppet_task(task_name:, params: nil) + on(master, puppet('task', 'run', task_name, '--nodes', fact_on(master, 'fqdn'), params.to_s), acceptable_exit_codes: [0, 1]).stdout +end + +def expect_multiple_regexes(result:, regexes:) + regexes.each do |regex| + expect(result).to match(regex) + end +end + +# This method allows a block to be passed in and if an exception is raised +# that matches the 'error_matcher' matcher, the block will wait a set number +# of seconds before retrying. +# Params: +# - max_retry_count - Max number of retries +# - retry_wait_interval_secs - Number of seconds to wait before retry +# - error_matcher - Matcher which the exception raised must match to allow retry +# Example Usage: +# retry_on_error_matching(3, 5, /OpenGPG Error/) do +# apply_manifest(pp, :catch_failures => true) +# end +def retry_on_error_matching(max_retry_count = 3, retry_wait_interval_secs = 5, error_matcher = nil) + try = 0 + begin + try += 1 + yield + rescue StandardError => e + raise unless try < max_retry_count && (error_matcher.nil? || e.message =~ error_matcher) + sleep retry_wait_interval_secs + retry + end +end + +RSpec.configure do |c| + File.expand_path(File.join(File.dirname(__FILE__), '..')) + + # Readable test descriptions + c.formatter = :documentation + + # Configure all nodes in nodeset + c.before :suite do + run_puppet_access_login(user: 'admin') if pe_install? && puppet_version =~ %r{(5\.\d\.\d)} + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_dist_has_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_has_updates_spec.rb new file mode 100644 index 0000000..ae67bcf --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_has_updates_spec.rb @@ -0,0 +1,40 @@ +require 'spec_helper' + +describe 'apt_has_dist_updates fact' do + subject { Facter.fact(:apt_has_dist_updates).value } + + after(:each) { Facter.clear } + + describe 'on non-Debian distro' do + before(:each) do + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'RedHat' + end + it { is_expected.to be_nil } + end + + describe 'on Debian based distro missing apt-get' do + before(:each) do + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns false + end + it { is_expected.to be_nil } + end + + describe 'on Debian based distro' do + before(:each) do + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns 'test' + File.expects(:executable?).with('/usr/bin/apt-get').returns true + apt_output = "Inst extremetuxracer [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf extremetuxracer (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst planet.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf planet.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true dist-upgrade 2>&1').returns apt_output + end + it { is_expected.to be true } + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_dist_package_security_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_package_security_updates_spec.rb new file mode 100644 index 0000000..7f4f16a --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_package_security_updates_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper' + +describe 'apt_package_security_dist_updates fact' do + subject { Facter.fact(:apt_package_security_dist_updates).value } + + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before(:each) do + Facter.fact(:apt_has_dist_updates).stubs(:value).returns false + end + it { is_expected.to be nil } + end + + describe 'when apt has updates' do + before(:each) do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns 'test' + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true dist-upgrade 2>&1').returns apt_get_upgrade_output + end + + describe 'on Debian' do + let(:apt_get_upgrade_output) do + "Inst extremetuxracer [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf extremetuxracer (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst planet.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf planet.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Inst vim [7.52.1-5] (7.52.1-5+deb9u2 Debian-Security:9/stable [amd64]) []\n" \ + "Conf vim (7.52.1-5+deb9u2 Debian-Security:9/stable [amd64])\n" \ + end + + if Facter.version < '2.0.0' + it { is_expected.to eq('vim') } + else + it { is_expected.to eq(['vim']) } + end + end + + describe 'on Ubuntu' do + let(:apt_get_upgrade_output) do + "Inst extremetuxracer [2016f-0ubuntu0.16.04] (2016j-0ubuntu0.16.04 Ubuntu:16.04/xenial-security, Ubuntu:16.04/xenial-updates [all])\n" \ + "Conf extremetuxracer (2016j-0ubuntu0.16.04 Ubuntu:16.04/xenial-security, Ubuntu:16.04/xenial-updates [all])\n" \ + "Inst vim [7.47.0-1ubuntu2] (7.47.0-1ubuntu2.2 Ubuntu:16.04/xenial-security [amd64]) []\n" \ + "Conf vim (7.47.0-1ubuntu2.2 Ubuntu:16.04/xenial-security [amd64])\n" \ + "Inst onioncircuits [2:3.3.10-4ubuntu2] (2:3.3.10-4ubuntu2.3 Ubuntu:16.04/xenial-updates [amd64])\n" \ + "Conf onioncircuits (2:3.3.10-4ubuntu2.3 Ubuntu:16.04/xenial-updates [amd64])\n" + end + + if Facter.version < '2.0.0' + it { is_expected.to eq('extremetuxracer,vim') } + else + it { is_expected.to eq(%w[extremetuxracer vim]) } + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_dist_package_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_package_updates_spec.rb new file mode 100644 index 0000000..080e21f --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_package_updates_spec.rb @@ -0,0 +1,35 @@ +require 'spec_helper' + +describe 'apt_package_dist_updates fact' do + subject { Facter.fact(:apt_package_dist_updates).value } + + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before(:each) do + Facter.fact(:apt_has_dist_updates).stubs(:value).returns false + end + it { is_expected.to be nil } + end + + describe 'when apt has updates' do + before(:each) do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns 'test' + File.expects(:executable?).with('/usr/bin/apt-get').returns true + apt_output = "Inst extremetuxracer [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf extremetuxracer (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst planet.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf planet.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true dist-upgrade 2>&1').returns apt_output + end + if Facter.version < '2.0.0' + it { is_expected.to eq('extremetuxracer,planet.rb') } + else + it { is_expected.to eq(['extremetuxracer', 'planet.rb']) } + end + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_dist_security_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_security_updates_spec.rb new file mode 100644 index 0000000..9b58b6e --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_security_updates_spec.rb @@ -0,0 +1,52 @@ +require 'spec_helper' + +describe 'apt_security_updates fact' do + subject { Facter.fact(:apt_security_dist_updates).value } + + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before(:each) do + Facter.fact(:apt_has_dist_updates).stubs(:value).returns false + end + it { is_expected.to be nil } + end + + describe 'when apt has security updates' do + before(:each) do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns 'test' + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true dist-upgrade 2>&1').returns apt_get_upgrade_output + end + + describe 'on Debian' do + let(:apt_get_upgrade_output) do + "Inst extremetuxracer [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf extremetuxracer (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst planet.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf planet.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Inst vim [7.52.1-5] (7.52.1-5+deb9u2 Debian-Security:9/stable [amd64]) []\n" \ + "Conf vim (7.52.1-5+deb9u2 Debian-Security:9/stable [amd64])\n" \ + end + + it { is_expected.to eq(1) } + end + + describe 'on Ubuntu' do + let(:apt_get_upgrade_output) do + "Inst extremetuxracer [2016f-0ubuntu0.16.04] (2016j-0ubuntu0.16.04 Ubuntu:16.04/xenial-security, Ubuntu:16.04/xenial-updates [all])\n" \ + "Conf extremetuxracer (2016j-0ubuntu0.16.04 Ubuntu:16.04/xenial-security, Ubuntu:16.04/xenial-updates [all])\n" \ + "Inst vim [7.47.0-1ubuntu2] (7.47.0-1ubuntu2.2 Ubuntu:16.04/xenial-security [amd64]) []\n" \ + "Conf vim (7.47.0-1ubuntu2.2 Ubuntu:16.04/xenial-security [amd64])\n" \ + "Inst onioncircuits [2:3.3.10-4ubuntu2] (2:3.3.10-4ubuntu2.3 Ubuntu:16.04/xenial-updates [amd64])\n" \ + "Conf onioncircuits (2:3.3.10-4ubuntu2.3 Ubuntu:16.04/xenial-updates [amd64])\n" + end + + it { is_expected.to eq(2) } + end + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_dist_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_updates_spec.rb new file mode 100644 index 0000000..737d1b6 --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_dist_updates_spec.rb @@ -0,0 +1,31 @@ +require 'spec_helper' + +describe 'apt_updates fact' do + subject { Facter.fact(:apt_dist_updates).value } + + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before(:each) do + Facter.fact(:apt_has_dist_updates).stubs(:value).returns false + end + it { is_expected.to be nil } + end + + describe 'when apt has updates' do + before(:each) do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns 'test' + File.expects(:executable?).with('/usr/bin/apt-get').returns true + apt_output = "Inst extremetuxracer [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf extremetuxracer (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst planet.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf planet.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true dist-upgrade 2>&1').returns apt_output + end + it { is_expected.to eq(2) } + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_has_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_has_updates_spec.rb new file mode 100644 index 0000000..5c06c2f --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_has_updates_spec.rb @@ -0,0 +1,38 @@ +require 'spec_helper' + +describe 'apt_has_updates fact' do + subject { Facter.fact(:apt_has_updates).value } + + after(:each) { Facter.clear } + + describe 'on non-Debian distro' do + before(:each) do + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'RedHat' + end + it { is_expected.to be_nil } + end + + describe 'on Debian based distro missing apt-get' do + before(:each) do + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns false + end + it { is_expected.to be_nil } + end + + describe 'on Debian based distro' do + before(:each) do + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + apt_output = "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns apt_output + end + it { is_expected.to be true } + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_package_security_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_package_security_updates_spec.rb new file mode 100644 index 0000000..1cd992d --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_package_security_updates_spec.rb @@ -0,0 +1,58 @@ +require 'spec_helper' + +describe 'apt_package_security_updates fact' do + subject { Facter.fact(:apt_package_security_updates).value } + + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before(:each) do + Facter.fact(:apt_has_updates).stubs(:value).returns false + end + it { is_expected.to be nil } + end + + describe 'when apt has updates' do + before(:each) do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns apt_get_upgrade_output + end + + describe 'on Debian' do + let(:apt_get_upgrade_output) do + "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Inst curl [7.52.1-5] (7.52.1-5+deb9u2 Debian-Security:9/stable [amd64]) []\n" \ + "Conf curl (7.52.1-5+deb9u2 Debian-Security:9/stable [amd64])\n" \ + end + + if Facter.version < '2.0.0' + it { is_expected.to eq('curl') } + else + it { is_expected.to eq(['curl']) } + end + end + + describe 'on Ubuntu' do + let(:apt_get_upgrade_output) do + "Inst tzdata [2016f-0ubuntu0.16.04] (2016j-0ubuntu0.16.04 Ubuntu:16.04/xenial-security, Ubuntu:16.04/xenial-updates [all])\n" \ + "Conf tzdata (2016j-0ubuntu0.16.04 Ubuntu:16.04/xenial-security, Ubuntu:16.04/xenial-updates [all])\n" \ + "Inst curl [7.47.0-1ubuntu2] (7.47.0-1ubuntu2.2 Ubuntu:16.04/xenial-security [amd64]) []\n" \ + "Conf curl (7.47.0-1ubuntu2.2 Ubuntu:16.04/xenial-security [amd64])\n" \ + "Inst procps [2:3.3.10-4ubuntu2] (2:3.3.10-4ubuntu2.3 Ubuntu:16.04/xenial-updates [amd64])\n" \ + "Conf procps (2:3.3.10-4ubuntu2.3 Ubuntu:16.04/xenial-updates [amd64])\n" + end + + if Facter.version < '2.0.0' + it { is_expected.to eq('tzdata,curl') } + else + it { is_expected.to eq(%w[tzdata curl]) } + end + end + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_package_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_package_updates_spec.rb new file mode 100644 index 0000000..f24481a --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_package_updates_spec.rb @@ -0,0 +1,33 @@ +require 'spec_helper' + +describe 'apt_package_updates fact' do + subject { Facter.fact(:apt_package_updates).value } + + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before(:each) do + Facter.fact(:apt_has_updates).stubs(:value).returns false + end + it { is_expected.to be nil } + end + + describe 'when apt has updates' do + before(:each) do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + apt_output = "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns apt_output + end + if Facter.version < '2.0.0' + it { is_expected.to eq('tzdata,unhide.rb') } + else + it { is_expected.to eq(['tzdata', 'unhide.rb']) } + end + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_reboot_required_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_reboot_required_spec.rb new file mode 100644 index 0000000..356f36b --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_reboot_required_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'apt_reboot_required fact' do + subject { Facter.fact(:apt_reboot_required).value } + + after(:each) { Facter.clear } + + describe 'if a reboot is required' do + before(:each) do + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:file?).returns true + File.expects(:file?).at_least(1).with('/var/run/reboot-required').returns true + end + it { is_expected.to eq true } + end + + describe 'if a reboot is not required' do + before(:each) do + Facter.fact(:osfamily).expects(:value).at_least(1).returns 'Debian' + File.stubs(:file?).returns true + File.expects(:file?).at_least(1).with('/var/run/reboot-required').returns false + end + it { is_expected.to eq false } + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_security_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_security_updates_spec.rb new file mode 100644 index 0000000..fc93552 --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_security_updates_spec.rb @@ -0,0 +1,50 @@ +require 'spec_helper' + +describe 'apt_security_updates fact' do + subject { Facter.fact(:apt_security_updates).value } + + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before(:each) do + Facter.fact(:apt_has_updates).stubs(:value).returns false + end + it { is_expected.to be nil } + end + + describe 'when apt has security updates' do + before(:each) do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns apt_get_upgrade_output + end + + describe 'on Debian' do + let(:apt_get_upgrade_output) do + "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Inst curl [7.52.1-5] (7.52.1-5+deb9u2 Debian-Security:9/stable [amd64]) []\n" \ + "Conf curl (7.52.1-5+deb9u2 Debian-Security:9/stable [amd64])\n" \ + end + + it { is_expected.to eq(1) } + end + + describe 'on Ubuntu' do + let(:apt_get_upgrade_output) do + "Inst tzdata [2016f-0ubuntu0.16.04] (2016j-0ubuntu0.16.04 Ubuntu:16.04/xenial-security, Ubuntu:16.04/xenial-updates [all])\n" \ + "Conf tzdata (2016j-0ubuntu0.16.04 Ubuntu:16.04/xenial-security, Ubuntu:16.04/xenial-updates [all])\n" \ + "Inst curl [7.47.0-1ubuntu2] (7.47.0-1ubuntu2.2 Ubuntu:16.04/xenial-security [amd64]) []\n" \ + "Conf curl (7.47.0-1ubuntu2.2 Ubuntu:16.04/xenial-security [amd64])\n" \ + "Inst procps [2:3.3.10-4ubuntu2] (2:3.3.10-4ubuntu2.3 Ubuntu:16.04/xenial-updates [amd64])\n" \ + "Conf procps (2:3.3.10-4ubuntu2.3 Ubuntu:16.04/xenial-updates [amd64])\n" + end + + it { is_expected.to eq(2) } + end + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_update_last_success_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_update_last_success_spec.rb new file mode 100644 index 0000000..60d7273 --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_update_last_success_spec.rb @@ -0,0 +1,25 @@ +require 'spec_helper' + +describe 'apt_update_last_success fact' do + subject { Facter.fact(:apt_update_last_success).value } + + before(:each) { Facter.clear } + after(:each) { Facter.clear } + + describe 'on Debian based distro which has not yet created the update-success-stamp file' do + it 'has a value of -1' do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.expects(:exist?).with('/var/lib/apt/periodic/update-success-stamp').returns false + is_expected.to eq(-1) + end + end + + describe 'on Debian based distro which has created the update-success-stamp' do + it 'has the value of the mtime of the file' do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:exist?).returns true + File.stubs(:mtime).returns 1_407_660_561 + is_expected.to eq(1_407_660_561) + end + end +end diff --git a/code/environments/production/modules/apt/spec/unit/facter/apt_updates_spec.rb b/code/environments/production/modules/apt/spec/unit/facter/apt_updates_spec.rb new file mode 100644 index 0000000..d0a5dbb --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/facter/apt_updates_spec.rb @@ -0,0 +1,30 @@ +require 'spec_helper' + +describe 'apt_updates fact' do + subject { Facter.fact(:apt_updates).value } + + after(:each) { Facter.clear } + + describe 'when apt has no updates' do + before(:each) do + Facter.fact(:apt_has_updates).stubs(:value).returns false + end + it { is_expected.to be nil } + end + + describe 'when apt has updates' do + before(:each) do + Facter.fact(:osfamily).stubs(:value).returns 'Debian' + File.stubs(:executable?) # Stub all other calls + Facter::Util::Resolution.stubs(:exec) # Catch all other calls + File.expects(:executable?).with('/usr/bin/apt-get').returns true + apt_output = "Inst tzdata [2015f-0+deb8u1] (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Conf tzdata (2015g-0+deb8u1 Debian:stable-updates [all])\n" \ + "Inst unhide.rb [13-1.1] (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" \ + "Conf unhide.rb (22-2~bpo8+1 Debian Backports:jessie-backports [all])\n" + puts apt_output + Facter::Util::Resolution.expects(:exec).with('/usr/bin/apt-get -s -o Debug::NoLocking=true upgrade 2>&1').returns apt_output + end + it { is_expected.to eq(2) } + end +end diff --git a/code/environments/production/modules/apt/spec/unit/puppet/type/apt_key_spec.rb b/code/environments/production/modules/apt/spec/unit/puppet/type/apt_key_spec.rb new file mode 100644 index 0000000..a25d827 --- /dev/null +++ b/code/environments/production/modules/apt/spec/unit/puppet/type/apt_key_spec.rb @@ -0,0 +1,212 @@ +require 'spec_helper' +require 'puppet' + +describe Puppet::Type.type(:apt_key) do + context 'with only namevar 32bit key id' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: 'EF8D349F', + ) + end + + it 'id is set' do + expect(resource[:id]).to eq 'EF8D349F' + end + + it 'name is set to id' do + expect(resource[:name]).to eq 'EF8D349F' + end + + it 'keyserver is default' do + expect(resource[:server]).to eq :'keyserver.ubuntu.com' + end + + it 'source is not set' do + expect(resource[:source]).to eq nil + end + + it 'content is not set' do + expect(resource[:content]).to eq nil + end + end + + context 'with a lowercase 32bit key id' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: 'ef8d349f', + ) + end + + it 'id is set' do + expect(resource[:id]).to eq 'EF8D349F' + end + end + + context 'with a 64bit key id' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: 'FFFFFFFFEF8D349F', + ) + end + + it 'id is set' do + expect(resource[:id]).to eq 'FFFFFFFFEF8D349F' + end + end + + context 'with a 0x formatted key id' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: '0xEF8D349F', + ) + end + + it 'id is set' do + expect(resource[:id]).to eq 'EF8D349F' + end + end + + context 'with a 0x formatted lowercase key id' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: '0xef8d349f', + ) + end + + it 'id is set' do + expect(resource[:id]).to eq 'EF8D349F' + end + end + + context 'with a 0x formatted 64bit key id' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: '0xFFFFFFFFEF8D349F', + ) + end + + it 'id is set' do + expect(resource[:id]).to eq 'FFFFFFFFEF8D349F' + end + end + + context 'with source' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: 'EF8D349F', + source: 'http://apt.puppetlabs.com/pubkey.gpg', + ) + end + + it 'source is set to the URL' do + expect(resource[:source]).to eq 'http://apt.puppetlabs.com/pubkey.gpg' + end + end + + context 'with content' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: 'EF8D349F', + content: 'http://apt.puppetlabs.com/pubkey.gpg', + ) + end + + it 'content is set to the string' do + expect(resource[:content]).to eq 'http://apt.puppetlabs.com/pubkey.gpg' + end + end + + context 'with keyserver' do + let(:resource) do + Puppet::Type.type(:apt_key).new( + id: 'EF8D349F', + server: 'http://keyring.debian.org', + ) + end + + it 'keyserver is set to Debian' do + expect(resource[:server]).to eq 'http://keyring.debian.org' + end + end + + context 'with validation' do + it 'raises an error if content and source are set' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + source: 'http://apt.puppetlabs.com/pubkey.gpg', + content: 'Completely invalid as a GPG key') + }.to raise_error(%r{content and source are mutually exclusive}) + end + + it 'raises an error if a weird length key is used' do + expect { + Puppet::Type.type(:apt_key).new(id: 'FEF8D349F', + source: 'http://apt.puppetlabs.com/pubkey.gpg', + content: 'Completely invalid as a GPG key') + }.to raise_error(%r{Valid values match}) + end + + it 'raises an error when an invalid URI scheme is used in source' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + source: 'hkp://pgp.mit.edu') + }.to raise_error(%r{Valid values match}) + end + + it 'allows the http URI scheme in source' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + source: 'http://pgp.mit.edu') + }.not_to raise_error + end + + it 'allows the http URI with username and password' do + expect { + Puppet::Type.type(:apt_key).new(id: '4BD6EC30', + source: 'http://testme:Password2@pgp.mit.edu') + }.not_to raise_error + end + + it 'allows the https URI scheme in source' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + source: 'https://pgp.mit.edu') + }.not_to raise_error + end + + it 'allows the https URI with username and password' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + source: 'https://testme:Password2@pgp.mit.edu') + }.not_to raise_error + end + + it 'allows the ftp URI scheme in source' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + source: 'ftp://pgp.mit.edu') + }.not_to raise_error + end + + it 'allows an absolute path in source' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + source: '/path/to/a/file') + }.not_to raise_error + end + + it 'allows 5-digit ports' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + source: 'http://pgp.mit.edu:12345/key') + }.not_to raise_error + end + + it 'allows 5-digit ports when using key servers' do + expect { + Puppet::Type.type(:apt_key).new(id: 'EF8D349F', + server: 'http://pgp.mit.edu:12345') + }.not_to raise_error + end + end +end diff --git a/code/environments/production/modules/apt/tasks/init.json b/code/environments/production/modules/apt/tasks/init.json new file mode 100644 index 0000000..2020005 --- /dev/null +++ b/code/environments/production/modules/apt/tasks/init.json @@ -0,0 +1,10 @@ +{ + "description": "Allows you to perform apt functions", + "input_method": "stdin", + "parameters": { + "action": { + "description": "Action to perform ", + "type": "Enum[update, upgrade]" + } + } +} diff --git a/code/environments/production/modules/apt/tasks/init.rb b/code/environments/production/modules/apt/tasks/init.rb new file mode 100755 index 0000000..d256468 --- /dev/null +++ b/code/environments/production/modules/apt/tasks/init.rb @@ -0,0 +1,24 @@ +#!/opt/puppetlabs/puppet/bin/ruby +require 'json' +require 'open3' +require 'puppet' + +def apt_get(action) + cmd = ['apt-get', action] + cmd << ' -y' if action == 'upgrade' + stdout, stderr, status = Open3.capture3(*cmd) + raise Puppet::Error, stderr if status != 0 + { status: stdout.strip } +end + +params = JSON.parse(STDIN.read) +action = params['action'] + +begin + result = apt_get(action) + puts result.to_json + exit 0 +rescue Puppet::Error => e + puts({ status: 'failure', error: e.message }.to_json) + exit 1 +end diff --git a/code/environments/production/modules/apt/templates/15update-stamp.epp b/code/environments/production/modules/apt/templates/15update-stamp.epp new file mode 100644 index 0000000..14ead83 --- /dev/null +++ b/code/environments/production/modules/apt/templates/15update-stamp.epp @@ -0,0 +1 @@ +APT::Update::Post-Invoke-Success {"touch /var/lib/apt/periodic/update-success-stamp 2>/dev/null || true";}; diff --git a/code/environments/production/modules/apt/templates/_conf_header.epp b/code/environments/production/modules/apt/templates/_conf_header.epp new file mode 100644 index 0000000..bfa365e --- /dev/null +++ b/code/environments/production/modules/apt/templates/_conf_header.epp @@ -0,0 +1 @@ +// This file is managed by Puppet. DO NOT EDIT. diff --git a/code/environments/production/modules/apt/templates/_header.epp b/code/environments/production/modules/apt/templates/_header.epp new file mode 100644 index 0000000..487e581 --- /dev/null +++ b/code/environments/production/modules/apt/templates/_header.epp @@ -0,0 +1 @@ +# This file is managed by Puppet. DO NOT EDIT. diff --git a/code/environments/production/modules/apt/templates/pin.pref.epp b/code/environments/production/modules/apt/templates/pin.pref.epp new file mode 100644 index 0000000..7991332 --- /dev/null +++ b/code/environments/production/modules/apt/templates/pin.pref.epp @@ -0,0 +1,26 @@ +<%- | $name, $pin_release, $release, $codename, $release_version, $component, $originator, $label, $version, $origin, $explanation, $packages_string, $priority | -%> +<%- +$pin = +if $pin_release.length > 0 { + $options = [ + if $release { "a=${release}" }, + if $codename { "n=${codename}" }, + if $release_version { "v=${release_version}"}, + if $component { "c=${component}" }, + if $originator { "o=${originator}" }, + if $label { "l=${label}" }, + ].filter |$x| { $x != undef } + "release ${options.join(', ')}" } + +elsif $version and "${version}".length > 0 { + "version ${version}" } +elsif $origin and $origin.length > 0 { + "origin ${origin}" } +else { + "release a=${name}" #Default value +} +-%> +Explanation: <%= $explanation %> +Package: <%= $packages_string %> +Pin: <%= $pin %> +Pin-Priority: <%= $priority %> diff --git a/code/environments/production/modules/apt/templates/proxy.epp b/code/environments/production/modules/apt/templates/proxy.epp new file mode 100644 index 0000000..ee663cb --- /dev/null +++ b/code/environments/production/modules/apt/templates/proxy.epp @@ -0,0 +1,7 @@ +<%- | Hash $proxies | -%> +Acquire::http::proxy "http://<%= $proxies['host'] %>:<%= $proxies['port'] %>/"; +<%- if $proxies['https'] { %> +Acquire::https::proxy "https://<%= $proxies['host'] %>:<%= $proxies['port'] %>/"; +<%- } elsif $proxies['direct'] { -%> +Acquire::https::proxy "DIRECT"; +<%- } -%> diff --git a/code/environments/production/modules/apt/templates/source.list.epp b/code/environments/production/modules/apt/templates/source.list.epp new file mode 100644 index 0000000..4b29726 --- /dev/null +++ b/code/environments/production/modules/apt/templates/source.list.epp @@ -0,0 +1,10 @@ +<%- | String $comment, Hash $includes, $opt_architecture, Boolean $allow_unsigned, $location, $release, String $repos | -%> +# <%= $comment %> +<%- if $includes['deb'] { -%> +deb <%- if ($opt_architecture or $allow_unsigned) {-%> + [<%- if ($opt_architecture) {%>arch=<%= $opt_architecture %><% } %><%if ($opt_architecture and $allow_unsigned) {%> <% }%><% if ($allow_unsigned) {%>trusted=yes<% } %>] <%- } %> <%= $location %> <%= $release %> <%= $repos %> +<%- } -%> +<%- if $includes['src'] { -%> +deb-src <%- if $opt_architecture or $allow_unsigned { -%> + [<%- if ($opt_architecture) {%>arch=<%= $opt_architecture %><% } %><%if ($opt_architecture and $allow_unsigned) {%> <% }%><% if ($allow_unsigned) {%>trusted=yes<% } %>] <%- } %> <%= $location %> <%= $release %> <%= $repos %> +<%- } -%> -- cgit v1.2.3