From a95d4ffefafaf3e7142bacbc33951ab9f2dc3d74 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <KAction@debian.org>
Date: Tue, 23 Apr 2019 12:36:24 +0000
Subject: [PATCH 001/383] Fix spelling error in manpage

---
 cdist/conf/type/__zypper_service/man.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__zypper_service/man.rst b/cdist/conf/type/__zypper_service/man.rst
index ea48aebb..e082dc02 100644
--- a/cdist/conf/type/__zypper_service/man.rst
+++ b/cdist/conf/type/__zypper_service/man.rst
@@ -46,10 +46,10 @@ EXAMPLES
     # Ensure that internal SLES11 SP3 RIS is in installed and all other services and repos are discarded
     __zypper_service INTERNAL_SLES11_SP3 --service_desc "Internal SLES11 SP3 RIS" --uri "http://path/to/your/ris/dir" --remove-all-other-services --remove-all-repos
 
-    # Ensure that internal SLES11 SP3 RIS is in installed, no changes to ohter services or repos
+    # Ensure that internal SLES11 SP3 RIS is in installed, no changes to other services or repos
     __zypper_service INTERNAL_SLES11_SP3 --service_desc "Internal SLES11 SP3 RIS" --uri "http://path/to/your/ris/dir"
 
-    # Drop service by uri, no changes to ohter services or repos
+    # Drop service by uri, no changes to other services or repos
     __zypper_service INTERNAL_SLES11_SP3 --state absent --uri "http://path/to/your/ris/dir"
 
 

From 31b9859e08d685032a4bc15eca0ed6f80cfb9fdd Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 23 Apr 2019 17:22:02 +0200
Subject: [PATCH 002/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index bf106861..c64ca60a 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Type __zypper_service: Fix spelling error in manpage (Dmitry Bogatov)
+
 4.11.1: 2019-04-22
 	* Core: Improve explorer error reporting (Darko Poljak)
 	* Type __directory: explorer stat: add support for Solaris (Ander Punnar)

From 894311a57200c5bc2094890033d6df0867d52c43 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 24 Apr 2019 00:08:43 +0300
Subject: [PATCH 003/383] __acl: if users/groups check fail, log error and exit
 in explorer

---
 cdist/conf/type/__acl/explorer/missing_users_groups | 3 ++-
 cdist/conf/type/__acl/gencode-remote                | 8 --------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/cdist/conf/type/__acl/explorer/missing_users_groups b/cdist/conf/type/__acl/explorer/missing_users_groups
index b4af614c..2f3b9e6d 100755
--- a/cdist/conf/type/__acl/explorer/missing_users_groups
+++ b/cdist/conf/type/__acl/explorer/missing_users_groups
@@ -40,7 +40,8 @@ do
 
         if ! getent "$getent_db" "$check" > /dev/null
         then
-            echo "missing $parameter '$check'"
+            echo "missing $parameter '$check'" >&2
+            exit 1
         fi
     done \
         < "$__object/parameter/$parameter"
diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index a0f25a15..c0594497 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -22,14 +22,6 @@ file_is="$( cat "$__object/explorer/file_is" )"
 
 [ "$file_is" = 'missing' ] && exit 0
 
-missing_users_groups="$( cat "$__object/explorer/missing_users_groups" )"
-
-if [ -n "$missing_users_groups" ]
-then
-    echo "$missing_users_groups" >&2
-    exit 1
-fi
-
 os="$( cat "$__global/explorer/os" )"
 
 acl_is="$( cat "$__object/explorer/acl_is" )"

From d66b6969f31ea2c7690a0b85a41a76d07b7ac3e0 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 24 Apr 2019 00:09:49 +0300
Subject: [PATCH 004/383] __acl: rename missing_users_groups explorer to more
 generic name for future checks

---
 cdist/conf/type/__acl/explorer/{missing_users_groups => checks} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename cdist/conf/type/__acl/explorer/{missing_users_groups => checks} (100%)

diff --git a/cdist/conf/type/__acl/explorer/missing_users_groups b/cdist/conf/type/__acl/explorer/checks
similarity index 100%
rename from cdist/conf/type/__acl/explorer/missing_users_groups
rename to cdist/conf/type/__acl/explorer/checks

From f586937614383ebf67e2bcbf061c0ab7b7847620 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 24 Apr 2019 00:36:53 +0300
Subject: [PATCH 005/383] __acl: drop Solaris because POSIX-draft ACL
 specification is not supported

---
 cdist/conf/type/__acl/gencode-remote | 44 ++++++++++++----------------
 cdist/conf/type/__acl/man.rst        |  6 ++--
 2 files changed, 20 insertions(+), 30 deletions(-)

diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index c0594497..61a83c8c 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -74,34 +74,26 @@ fi
 
 if [ -f "$__object/parameter/remove" ]
 then
-    if echo "$os" | grep -Fq 'solaris'
-    then
-        # Solaris setfacl behaves differently.
-        # We will not support Solaris for now, because no way to test it.
-        # But adding support should be easy (use -s instead of -m on modify).
-        echo "$os setfacl do not support -x flag for ACL remove" >&2
-    else
-        echo "$acl_is" | while read -r acl
-        do
-            # Skip wanted ACL entries which already exist
-            # and skip mask and other entries, because we
-            # can't actually remove them, but only change.
-            if echo "$acl_should" | grep -Eq "^$acl" \
-                || echo "$acl" | grep -Eq '^(default:)?(mask|other)'
-            then continue
-            fi
+    echo "$acl_is" | while read -r acl
+    do
+        # Skip wanted ACL entries which already exist
+        # and skip mask and other entries, because we
+        # can't actually remove them, but only change.
+        if echo "$acl_should" | grep -Eq "^$acl" \
+            || echo "$acl" | grep -Eq '^(default:)?(mask|other)'
+        then continue
+        fi
 
-            if echo "$os" | grep -Eq 'macosx|freebsd'
-            then
-                remove="$acl"
-            else
-                remove="$( echo "$acl" | sed 's/:...$//' )"
-            fi
+        if echo "$os" | grep -Eq 'macosx|freebsd'
+        then
+            remove="$acl"
+        else
+            remove="$( echo "$acl" | sed 's/:...$//' )"
+        fi
 
-            echo "$setfacl_exec -x \"$remove\" \"$acl_path\""
-            echo "removed '$remove'" >> "$__messages_out"
-        done
-    fi
+        echo "$setfacl_exec -x \"$remove\" \"$acl_path\""
+        echo "removed '$remove'" >> "$__messages_out"
+    done
 fi
 
 for acl in $acl_should
diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst
index 092eb555..e6784c87 100644
--- a/cdist/conf/type/__acl/man.rst
+++ b/cdist/conf/type/__acl/man.rst
@@ -10,11 +10,9 @@ DESCRIPTION
 -----------
 ACL must be defined as 3-symbol combination, using ``r``, ``w``, ``x`` and ``-``.
 
-Fully supported on Linux (tested on Debian and CentOS).
+Fully supported and tested on Linux, partial support for FreeBSD.
 
-Partial support for FreeBSD, OSX and Solaris.
-
-OpenBSD and NetBSD support is not possible.
+OpenBSD, NetBSD and Solaris support is not possible.
 
 See ``setfacl`` and ``acl`` manpages for more details.
 

From 4c21983698932e17ca9276873e32a908b4235bf7 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 24 Apr 2019 00:39:54 +0300
Subject: [PATCH 006/383] __acl: remove macosx because no way to properly test

---
 cdist/conf/type/__acl/gencode-remote | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index 61a83c8c..ef903816 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -64,7 +64,7 @@ setfacl_exec='setfacl'
 
 if [ -f "$__object/parameter/recursive" ]
 then
-    if echo "$os" | grep -Eq 'macosx|freebsd'
+    if echo "$os" | grep -Fq 'freebsd'
     then
         echo "$os setfacl do not support recursive operations" >&2
     else
@@ -84,7 +84,7 @@ then
         then continue
         fi
 
-        if echo "$os" | grep -Eq 'macosx|freebsd'
+        if echo "$os" | grep -Fq 'freebsd'
         then
             remove="$acl"
         else
@@ -100,7 +100,7 @@ for acl in $acl_should
 do
     if ! echo "$acl_is" | grep -Eq "^$acl"
     then
-        if echo "$os" | grep -Eq 'macosx|freebsd' \
+        if echo "$os" | grep -Fq 'freebsd' \
             && echo "$acl" | grep -Eq '^default:'
         then
             echo "setting default ACL in $os is currently not supported. sorry :(" >&2

From 510ea220f275caf2667547c55b54f06b55965bf5 Mon Sep 17 00:00:00 2001
From: Takashi Yoshi <takashi@yoshi.email>
Date: Wed, 24 Apr 2019 11:02:32 +0200
Subject: [PATCH 007/383] [type/__block] Quote prefix and suffix correctly

Before prefix and suffix were not allowed to contain " (quotes).
---
 cdist/conf/type/__block/gencode-remote | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__block/gencode-remote b/cdist/conf/type/__block/gencode-remote
index f269c785..1f5cc033 100755
--- a/cdist/conf/type/__block/gencode-remote
+++ b/cdist/conf/type/__block/gencode-remote
@@ -18,6 +18,11 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+# quote function from http://www.etalabs.net/sh_tricks.html
+quote() {
+   printf '%s\n' "$1" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/"
+}
+
 file="$(cat "$__object/parameter/file" 2>/dev/null || echo "/$__object_id")"
 state_should=$(cat "$__object/parameter/state")
 prefix=$(cat "$__object/parameter/prefix" 2>/dev/null || echo "#cdist:__block/$__object_id")
@@ -46,7 +51,7 @@ tmpfile=\$(mktemp ${file}.cdist.XXXXXXXXXX)
 if [ -f "$file" ]; then
    cp -p "$file" "\$tmpfile"
 fi
-awk -v prefix="^$prefix\$" -v suffix="^$suffix\$" '
+awk -v prefix=^$(quote "$prefix")\$ -v suffix=^$(quote "$suffix")\$ '
 {
    if (match(\$0,prefix)) {
       triggered=1

From 6dd5278aded69d62db030a53cfefb4dac1b46023 Mon Sep 17 00:00:00 2001
From: Takashi Yoshi <takashi@yoshi.email>
Date: Wed, 24 Apr 2019 11:15:44 +0200
Subject: [PATCH 008/383] [explorer/init] Add support for OpenBSD

---
 cdist/conf/explorer/init | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index 43a66a50..a8a7857e 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -29,7 +29,7 @@ case "$uname_s" in
     Linux)
         (pgrep -P0 -l | awk '/^1[ \t]/ {print $2;}') || true
     ;;
-    FreeBSD)
+    FreeBSD|OpenBSD)
         ps -o comm= -p 1 || true
     ;;
     *)

From f7ace88ec25957a71bf621cfefdc2e91db7d7994 Mon Sep 17 00:00:00 2001
From: Takashi Yoshi <takashi@yoshi.email>
Date: Wed, 24 Apr 2019 11:36:57 +0200
Subject: [PATCH 009/383] [__postgres_{database,role}] Run psql with
 --no-password (-w)

cdist does not work with interactive processes, so it's better to fail when
manual password input is required.
---
 cdist/conf/type/__postgres_database/explorer/state | 2 +-
 cdist/conf/type/__postgres_role/explorer/state     | 2 +-
 cdist/conf/type/__postgres_role/gencode-remote     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__postgres_database/explorer/state b/cdist/conf/type/__postgres_database/explorer/state
index 652d81e7..d68d4120 100755
--- a/cdist/conf/type/__postgres_database/explorer/state
+++ b/cdist/conf/type/__postgres_database/explorer/state
@@ -34,7 +34,7 @@ esac
 
 name="$__object_id"
 
-if test -n "$(su - "$postgres_user" -c "psql postgres -tAc \"SELECT 1 FROM pg_database WHERE datname='$name'\"")"
+if test -n "$(su - "$postgres_user" -c "psql postgres -twAc \"SELECT 1 FROM pg_database WHERE datname='$name'\"")"
 then
     echo 'present'
 else
diff --git a/cdist/conf/type/__postgres_role/explorer/state b/cdist/conf/type/__postgres_role/explorer/state
index 5cc71477..c8e1fa9d 100755
--- a/cdist/conf/type/__postgres_role/explorer/state
+++ b/cdist/conf/type/__postgres_role/explorer/state
@@ -34,7 +34,7 @@ esac
 
 name="$__object_id"
 
-if test -n "$(su - "$postgres_user" -c "psql postgres -tAc \"SELECT 1 FROM pg_roles WHERE rolname='$name'\"")"
+if test -n "$(su - "$postgres_user" -c "psql postgres -twAc \"SELECT 1 FROM pg_roles WHERE rolname='$name'\"")"
 then
     echo 'present'
 else
diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote
index 30d0689c..fd56e85d 100755
--- a/cdist/conf/type/__postgres_role/gencode-remote
+++ b/cdist/conf/type/__postgres_role/gencode-remote
@@ -55,7 +55,7 @@ case "$state_should" in
         [ -n "$password" ] && password="PASSWORD '$password'"
 
         cmd="CREATE ROLE $name WITH $password $booleans"
-        echo "su - '$postgres_user' -c \"psql postgres -c \\\"$cmd\\\"\""
+        echo "su - '$postgres_user' -c \"psql postgres -wc \\\"$cmd\\\"\""
     ;;
     absent)
         echo "su - '$postgres_user' -c \"dropuser \\\"$name\\\"\""

From 3ca337dfe0878a71ca14e550111d31fffa14b461 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 24 Apr 2019 12:23:37 +0200
Subject: [PATCH 010/383] ++changelog

---
 docs/changelog | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index c64ca60a..ca66a0f0 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,10 @@ Changelog
 
 next:
 	* Type __zypper_service: Fix spelling error in manpage (Dmitry Bogatov)
+	* Explorer init: Add support for OpenBSD (sideeffect42)
+	* Type __postgres_database: Run psql with -w (no-password) (sideeffect42)
+	* Type __postgres_role: Run psql with -w (no-password) (sideeffect42)
+	* Type __block: Quote prefix/suffix - fix when prefix/suffix contains quotes (sideeffect42)
 
 4.11.1: 2019-04-22
 	* Core: Improve explorer error reporting (Darko Poljak)

From 8b93bf0218cf2097976159dab332dcaaff3f5eb4 Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Sun, 30 Dec 2018 11:59:34 +0100
Subject: [PATCH 011/383] Migrate from github to ungleich gitlab

---
 bin/build-helper                              | 49 ++++++++----------
 bin/build-helper.freebsd                      | 48 ++++++++----------
 cdist/conf/type/__cdist/man.rst               |  4 +-
 .../type/__cdist/parameter/default/source     |  2 +-
 cdist/conf/type/__git/man.rst                 |  2 +-
 docs/dev/github-gitlab-migration/release      | 50 +++++++++++++++++++
 docs/src/cdist-hacker.rst                     | 20 ++++----
 docs/src/cdist-install.rst                    | 13 ++---
 docs/src/cdist-quickstart.rst                 |  2 +-
 9 files changed, 112 insertions(+), 78 deletions(-)
 create mode 100755 docs/dev/github-gitlab-migration/release

diff --git a/bin/build-helper b/bin/build-helper
index 963f02f9..72f683b9 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -209,35 +209,30 @@ eof
         fi
         gpg --armor --detach-sign "${archivename}" || exit 1
 
-        # make github release
-        curl -H "Authorization: token ${token}" \
-            --request POST \
-            --data "{ \"tag_name\":\"${tag}\", \
-                      \"target_commitish\":\"master\", \
-                      \"name\": \"${tag}\", \
-                      \"body\":\"${tag}\", \
-                      \"draft\":false, \
-                      \"prerelease\": false}" \
-            "https://api.github.com/repos/ungleich/cdist/releases" || exit 1
+        project="ungleich-public%2Fcdist"
+        sed_cmd='s/^.*"markdown":"\([^"]*\)".*$/\1/'
 
-        # get release ID
-        repoid=$(curl "https://api.github.com/repos/ungleich/cdist/releases/tags/${tag}" \
-            | python3 -c 'import json; import sys; print(json.loads(sys.stdin.read())["id"])') \
+        # upload archive
+        response_archive=$(curl -f -X POST \
+             -H "PRIVATE-TOKEN: ${token}" \
+             -F "file=@${archivename}" \
+             "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
+             | sed "${sed_cmd}") || exit 1
+
+        # upload archive signature
+        response_archive_sig=$(curl -f -X POST \
+             -H "PRIVATE-TOKEN: ${token}" \
+             -F "file=@${archivename}.asc" \
+            "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
+             | sed "${sed_cmd}") || exit 1
+
+        # make release
+        curl -f -X POST \
+             -H "PRIVATE-TOKEN: ${token}" \
+             -F "description=Release ${tag}<br/>${response_archive}<br/>${response_archive_sig}" \
+            "https://code.ungleich.ch/api/v4/projects/${project}/repository/tags/${tag}/release" \
             || exit 1
 
-        # upload archive and then signature
-        curl -H "Authorization: token ${token}" \
-             -H "Accept: application/vnd.github.manifold-preview" \
-             -H "Content-Type: application/x-gtar" \
-             --data-binary @${archivename} \
-            "https://uploads.github.com/repos/ungleich/cdist/releases/${repoid}/assets?name=${archivename}" \
-            || exit 1
-        curl -H "Authorization: token ${token}" \
-             -H "Accept: application/vnd.github.manifold-preview" \
-             -H "Content-Type: application/pgp-signature" \
-             --data-binary @${archivename}.asc \
-            "https://uploads.github.com/repos/ungleich/cdist/releases/${repoid}/assets?name=${archivename}.asc" \
-            || exit 1
 
         # remove generated files (archive and asc)
         if [ $# -eq 2 ]
@@ -314,7 +309,7 @@ eof
         "$0" release-git-tag
 
         # sign git tag
-        printf "Enter github authentication token: "
+        printf "Enter upstream repository authentication token: "
         read token
         "$0" sign-git-release "${target_version}" "${token}"
 
diff --git a/bin/build-helper.freebsd b/bin/build-helper.freebsd
index ea16ef42..cb8e5397 100755
--- a/bin/build-helper.freebsd
+++ b/bin/build-helper.freebsd
@@ -244,34 +244,28 @@ eof
         fi
         gpg --armor --detach-sign "${archivename}" || exit 1
 
-        # make github release
-        curl -H "Authorization: token ${token}" \
-            --request POST \
-            --data "{ \"tag_name\":\"${tag}\", \
-                      \"target_commitish\":\"master\", \
-                      \"name\": \"${tag}\", \
-                      \"body\":\"${tag}\", \
-                      \"draft\":false, \
-                      \"prerelease\": false}" \
-            "https://api.github.com/repos/ungleich/cdist/releases" || exit 1
+        project="ungleich-public%2Fcdist"
+        sed_cmd='s/^.*"markdown":"\([^"]*\)".*$/\1/'
 
-        # get release ID
-        repoid=$(curl "https://api.github.com/repos/ungleich/cdist/releases/tags/${tag}" \
-            | python3 -c 'import json; import sys; print(json.loads(sys.stdin.read())["id"])') \
-            || exit 1
+        # upload archive
+        response_archive=$(curl -f -X POST \
+             -H "PRIVATE-TOKEN: ${token}" \
+             -F "file=@${archivename}" \
+             "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
+             | sed "${sed_cmd}") || exit 1
 
-        # upload archive and then signature
-        curl -H "Authorization: token ${token}" \
-             -H "Accept: application/vnd.github.manifold-preview" \
-             -H "Content-Type: application/x-gtar" \
-             --data-binary @${archivename} \
-            "https://uploads.github.com/repos/ungleich/cdist/releases/${repoid}/assets?name=${archivename}" \
-            || exit 1
-        curl -H "Authorization: token ${token}" \
-             -H "Accept: application/vnd.github.manifold-preview" \
-             -H "Content-Type: application/pgp-signature" \
-             --data-binary @${archivename}.asc \
-            "https://uploads.github.com/repos/ungleich/cdist/releases/${repoid}/assets?name=${archivename}.asc" \
+        # upload archive signature
+        response_archive_sig=$(curl -f -X POST \
+             -H "PRIVATE-TOKEN: ${token}" \
+             -F "file=@${archivename}.asc" \
+            "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
+             | sed "${sed_cmd}") || exit 1
+
+        # make release
+        curl -f -X POST \
+             -H "PRIVATE-TOKEN: ${token}" \
+             -F "description=Release ${tag}<br/>${response_archive}<br/>${response_archive_sig}" \
+            "https://code.ungleich.ch/api/v4/projects/${project}/repository/tags/${tag}/release" \
             || exit 1
 
         # remove generated files (archive and asc)
@@ -349,7 +343,7 @@ eof
         "$0" release-git-tag
 
         # sign git tag
-        printf "Enter github authentication token: "
+        printf "Enter upstream repository authentication token: "
         read token
         "$0" sign-git-release "${target_version}" "${token}"
 
diff --git a/cdist/conf/type/__cdist/man.rst b/cdist/conf/type/__cdist/man.rst
index 9e1c72cb..15c77d7f 100644
--- a/cdist/conf/type/__cdist/man.rst
+++ b/cdist/conf/type/__cdist/man.rst
@@ -30,7 +30,7 @@ username
 
 source
     Select the source from which to clone cdist from.
-    Defaults to "git://github.com/ungleich/cdist.git".
+    Defaults to "git://code.ungleich.ch/ungleich-public/cdist.git".
 
 
 branch
@@ -47,7 +47,7 @@ EXAMPLES
     __cdist /home/cdist/cdist
 
     # Use alternative source
-    __cdist --source "git://github.com/ungleich/cdist" /home/cdist/cdist
+    __cdist --source "git://code.ungleich.ch/ungleich-public/cdist" /home/cdist/cdist
 
 
 AUTHORS
diff --git a/cdist/conf/type/__cdist/parameter/default/source b/cdist/conf/type/__cdist/parameter/default/source
index 3f8e31ad..5f44a285 100644
--- a/cdist/conf/type/__cdist/parameter/default/source
+++ b/cdist/conf/type/__cdist/parameter/default/source
@@ -1 +1 @@
-git://github.com/ungleich/cdist.git
+git://code.ungleich.ch/ungleich-public/cdist.git
diff --git a/cdist/conf/type/__git/man.rst b/cdist/conf/type/__git/man.rst
index 17e9c623..aa704d2b 100644
--- a/cdist/conf/type/__git/man.rst
+++ b/cdist/conf/type/__git/man.rst
@@ -44,7 +44,7 @@ EXAMPLES
     __git /home/services/dokuwiki --source git://github.com/splitbrain/dokuwiki.git
 
     # Checkout cdist, stay on branch 2.1
-    __git /home/nico/cdist --source git://github.com/ungleich/cdist.git --branch 2.1
+    __git /home/nico/cdist --source git://code.ungleich.ch/ungleich-public/cdist.git --branch 2.1
 
 
 AUTHORS
diff --git a/docs/dev/github-gitlab-migration/release b/docs/dev/github-gitlab-migration/release
new file mode 100755
index 00000000..c973f0f1
--- /dev/null
+++ b/docs/dev/github-gitlab-migration/release
@@ -0,0 +1,50 @@
+#!/bin/sh -e
+
+set -x
+
+printf "Enter tag name: "
+read tag
+printf "Enter repository authentication token: "
+read token
+
+git tag -d "${tag}" || :
+
+git tag "${tag}" -m "Release ${tag}"
+git push origin "${tag}"
+
+echo 'foo' > foo
+echo 'foo signature' > foo.asc
+
+archivename="foo"
+
+project="poljakowski%2Fmy-cdist-testing"
+sed_cmd='s/^.*"markdown":"\([^"]*\)".*$/\1/'
+
+# upload archive
+response_archive=$(curl -f -X POST \
+     -H "PRIVATE-TOKEN: ${token}" \
+     -F "file=@${archivename}" \
+     "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
+     | sed "${sed_cmd}") || exit 1
+
+# upload archive signature
+response_archive_sig=$(curl -f -X POST \
+     -H "PRIVATE-TOKEN: ${token}" \
+     -F "file=@${archivename}.asc" \
+    "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
+     | sed "${sed_cmd}") || exit 1
+
+# make release
+curl -f -X POST \
+     -H "PRIVATE-TOKEN: ${token}" \
+     -F "description=Release ${tag}<br/>${response_archive}<br/>${response_archive_sig}" \
+    "https://code.ungleich.ch/api/v4/projects/${project}/repository/tags/${tag}/release" \
+    || exit 1
+
+# get tag
+curl -f -X GET \
+     -H "PRIVATE-TOKEN: ${token}" \
+    "https://code.ungleich.ch/api/v4/projects/${project}/repository/tags/${tag}" \
+    || exit 1
+
+rm -f foo foo.asc
diff --git a/docs/src/cdist-hacker.rst b/docs/src/cdist-hacker.rst
index d65c41a6..e4252e19 100644
--- a/docs/src/cdist-hacker.rst
+++ b/docs/src/cdist-hacker.rst
@@ -16,7 +16,7 @@ Reporting bugs
 --------------
 If you believe you've found a bug and verified that it is
 in the latest version, drop a mail to the cdist mailing list,
-subject prefixed with "[BUG] " or create an issue on github.
+subject prefixed with "[BUG] " or create an issue on code.ungleich.ch.
 
 
 Coding conventions (everywhere)
@@ -51,7 +51,7 @@ work nor kill the authors brain:
 
 As soon as your work meets these requirements, write a mail
 for inclusion to the mailinglist **cdist-configuration-management at googlegroups.com**
-or open a pull request at http://github.com/ungleich/cdist.
+or open a merge request at https://code.ungleich.ch/ungleich-public/cdist.
 
 
 How to submit a new type
@@ -76,7 +76,7 @@ The following workflow works fine for most developers
 .. code-block:: sh
 
     # get latest upstream master branch
-    git clone https://github.com/ungleich/cdist.git
+    git clone https://code.ungleich.ch/ungleich-public/cdist.git
 
     # update if already existing
     cd cdist; git fetch -v; git merge origin/master
@@ -88,22 +88,22 @@ The following workflow works fine for most developers
     # *hack*
     *hack*
 
-    # clone the cdist repository on github if you haven't done so
+    # clone the cdist repository on code.ungleich.ch if you haven't done so
 
     # configure your repo to know about your clone (only once)
-    git remote add github git@github.com:YOURUSERNAME/cdist.git
+    git remote add ungleich git@code.ungleich.ch:YOURUSERNAME/cdist.git
 
-    # push the new branch to github 
-    git push github documentation_cleanup
+    # push the new branch to ungleich gitlab
+    git push ungleich documentation_cleanup
 
     # (or everything)
-    git push --mirror github
+    git push --mirror ungleich
 
-    # create a pull request at github (use a browser)
+    # create a merge request at ungleich gitlab (use a browser)
     # *fixthingsbecausequalityassurancefoundissuesinourpatch*
     *hack*
 
-    # push code to github again
+    # push code to ungleich gitlab again
     git push ... # like above
 
     # add comment that everything should be green now (use a browser)
diff --git a/docs/src/cdist-install.rst b/docs/src/cdist-install.rst
index afc50016..c05036b0 100644
--- a/docs/src/cdist-install.rst
+++ b/docs/src/cdist-install.rst
@@ -36,10 +36,13 @@ To install cdist, execute the following commands:
 
 .. code-block:: sh
 
-    git clone https://github.com/ungleich/cdist.git
+    git clone https://code.ungleich.ch/ungleich-public/cdist.git
     cd cdist
     export PATH=$PATH:$(pwd -P)/bin
 
+From version 4.2.0 cdist tags and releases are signed.
+You can get GPG public key used for signing `here <_static/pgp-key-EFD2AE4EC36B6901.asc>`_.
+
 To install cdist with distutils from cloned repository, first you have to
 create version.py:
 
@@ -74,14 +77,6 @@ So for instance if you want to use and stay with version 4.1, you can use
 
     git checkout -b 4.1 origin/4.1
 
-Git mirrors
-^^^^^^^^^^^
-
-If the main site is down, you can acquire cdist from one of the following sites:
-
- * git://github.com/telmich/cdist.git `github <https://github.com/telmich/cdist>`_
- * git://git.code.sf.net/p/cdist/code `sourceforge <https://sourceforge.net/p/cdist/code>`_
-
 Building and using documentation (man and html)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/docs/src/cdist-quickstart.rst b/docs/src/cdist-quickstart.rst
index 0020568d..b9220b67 100644
--- a/docs/src/cdist-quickstart.rst
+++ b/docs/src/cdist-quickstart.rst
@@ -56,7 +56,7 @@ code into your shell to get started and configure localhost::
     # Get cdist 
     # Mirrors can be found on
     # http://www.nico.schottelius.org/software/cdist/install/#index2h4
-    git clone git://github.com/ungleich/cdist
+    git clone git://code.ungleich.ch/ungleich-public/cdist
 
     # Create manifest (maps configuration to host(s)
     cd cdist

From 6ad261fdf26466be47d9d49b54f17bc34d6392b7 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 25 Apr 2019 23:04:38 +0200
Subject: [PATCH 012/383] ++changelog

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index ca66a0f0..9c87d3f7 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,6 +7,8 @@ next:
 	* Type __postgres_database: Run psql with -w (no-password) (sideeffect42)
 	* Type __postgres_role: Run psql with -w (no-password) (sideeffect42)
 	* Type __block: Quote prefix/suffix - fix when prefix/suffix contains quotes (sideeffect42)
+	* Build: Update due to migration to code.ungleich.ch (Darko Poljak)
+	* Documentation: Update due to migration to code.ungleich.ch (Darko Poljak)
 
 4.11.1: 2019-04-22
 	* Core: Improve explorer error reporting (Darko Poljak)

From 2505023387ea670fa12af1e9c69c503ac5681136 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 1 May 2019 12:31:30 +0200
Subject: [PATCH 013/383] Append requirement only if already not present

---
 cdist/emulator.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cdist/emulator.py b/cdist/emulator.py
index 5103f1a4..3cf82f84 100644
--- a/cdist/emulator.py
+++ b/cdist/emulator.py
@@ -319,7 +319,9 @@ class Emulator(object):
                                        lastcreatedtype)
                     else:
                         if 'require' in self.env:
-                            self.env['require'] += " " + lastcreatedtype
+                            appendix = " " + lastcreatedtype
+                            if appendix not in self.env['require']:
+                                self.env['require'] += appendix
                         else:
                             self.env['require'] = lastcreatedtype
                         self.log.debug(("Injecting require for "

From edfaa65d2b37fcb4a7de2280b61dec30dd3a8c5d Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 1 May 2019 14:18:39 +0200
Subject: [PATCH 014/383] Detect dependency cycle as soon as possible

---
 cdist/config.py               | 59 ++++++++++++++++++++++++++++--
 cdist/test/config/__init__.py | 68 +++++++++++++++++++++++++++++++++--
 2 files changed, 123 insertions(+), 4 deletions(-)

diff --git a/cdist/config.py b/cdist/config.py
index fae2ff46..4e226b3a 100644
--- a/cdist/config.py
+++ b/cdist/config.py
@@ -43,6 +43,33 @@ from cdist import core, inventory
 from cdist.util.remoteutil import inspect_ssh_mux_opts
 
 
+def graph_check_cycle(graph):
+    # Start from each node in the graph and check for cycle starting from it.
+    for node in graph:
+        # Cycle path.
+        path = [node]
+        has_cycle = _graph_dfs_cycle( graph, node, path)
+        if has_cycle:
+            return has_cycle, path
+    return False, None
+
+
+def _graph_dfs_cycle(graph, node, path):
+    for neighbour in graph.get(node, ()):
+        # If node is already in path then this is cycle.
+        if neighbour in path:
+            path.append(neighbour)
+            return True
+        path.append(neighbour)
+        rv = _graph_dfs_cycle(graph, neighbour, path)
+        if rv:
+            return True
+        # Remove last item from list - neighbour whose DFS path we have have
+        # just checked.
+        del path[-1]
+    return False
+
+
 class Config(object):
     """Cdist main class to hold arbitrary data"""
 
@@ -254,14 +281,14 @@ class Config(object):
                     cls.onehost(host, host_tags, host_base_path, hostdir,
                                 args, parallel=False,
                                 configuration=configuration)
-                except cdist.Error as e:
+                except cdist.Error:
                     failed_hosts.append(host)
         if args.parallel and len(process_args) == 1:
             log.debug("Only 1 host for parallel processing, doing it "
                       "sequentially")
             try:
                 cls.onehost(*process_args[0])
-            except cdist.Error as e:
+            except cdist.Error:
                 failed_hosts.append(host)
         elif args.parallel:
             log.trace("Multiprocessing start method is {}".format(
@@ -653,6 +680,28 @@ class Config(object):
         self.__dict__.update(state)
         self._open_logger()
 
+    def _validate_dependencies(self):
+        '''
+            Build dependency graph for unfinished objects and
+            check for cycles.
+        '''
+        graph = {}
+        for cdist_object in self.object_list():
+            obj_name = cdist_object.name
+            if obj_name not in graph:
+                graph[obj_name] = []
+            if cdist_object.state == cdist_object.STATE_DONE:
+                continue
+
+            for requirement in cdist_object.requirements_unfinished(
+                    cdist_object.requirements):
+                graph[obj_name].append(requirement.name)
+
+            for requirement in cdist_object.requirements_unfinished(
+                    cdist_object.autorequire):
+                graph[obj_name].append(requirement.name)
+        return graph_check_cycle(graph)
+
     def iterate_until_finished(self):
         """
             Go through all objects and solve them
@@ -662,6 +711,12 @@ class Config(object):
         objects_changed = True
 
         while objects_changed:
+            # Check for cycles as early as possible.
+            has_cycle, path = self._validate_dependencies()
+            if has_cycle:
+                raise cdist.UnresolvableRequirementsError(
+                    "Cycle detected in object dependencies:\n{}!".format(
+                        " -> ".join(path)))
             objects_changed = self.iterate_once()
 
         # Check whether all objects have been finished
diff --git a/cdist/test/config/__init__.py b/cdist/test/config/__init__.py
index 2b0d8b5f..499593e3 100644
--- a/cdist/test/config/__init__.py
+++ b/cdist/test/config/__init__.py
@@ -23,7 +23,6 @@
 
 import os
 import shutil
-import tempfile
 
 from cdist import test
 from cdist import core
@@ -212,7 +211,7 @@ class ConfigRunTestCase(test.CdistTestCase):
         dryrun.run()
         # if we are here, dryrun works like expected
 
-    def test_desp_resolver(self):
+    def test_deps_resolver(self):
         """Test to show dependency resolver warning message."""
         local = cdist.exec.local.Local(
             target_host=self.target_host,
@@ -229,6 +228,71 @@ class ConfigRunTestCase(test.CdistTestCase):
         config = cdist.config.Config(local, self.remote, dry_run=True)
         config.run()
 
+    def test_graph_check_cycle_empty(self):
+        graph = {}
+        has_cycle, path = cdist.config.graph_check_cycle(graph)
+        self.assertFalse(has_cycle)
+
+    def test_graph_check_cycle_1(self):
+        #
+        # a -> b -> c
+        #      |
+        #      +--> d -> e
+        graph = {
+            'a': ['b', ],
+            'b': ['c', 'd', ],
+            'd': ['e', ],
+        }
+        has_cycle, path = cdist.config.graph_check_cycle(graph)
+        self.assertFalse(has_cycle)
+
+    def test_graph_check_cycle_2(self):
+        #
+        # a -> b -> c
+        # /\        |
+        #  \        |
+        #   +-------+
+        graph = {
+            'a': ['b', ],
+            'b': ['c', ],
+            'c': ['a', ],
+        }
+        has_cycle, path = cdist.config.graph_check_cycle(graph)
+        self.assertTrue(has_cycle)
+        self.assertGreater(path.count(path[-1]), 1)
+
+    def test_graph_check_cycle_3(self):
+        #
+        # a -> b -> c
+        #  \        \
+        #   \        +--> g
+        #    \            /\
+        #     \           /|
+        #      +-> d -> e  |
+        #           \      |
+        #            + --> f
+        #
+        # h -> i --> j
+        # |    /\    |
+        # \/    |    \/
+        # n     m <- k
+        graph = {
+            'a': ['b', 'd', ],
+            'b': ['c', ],
+            'c': ['g', ],
+            'd': ['e', 'f', ],
+            'e': ['g', ],
+            'f': ['g', ],
+            'h': ['i', 'n', ],
+            'i': ['j', ],
+            'j': ['k', ],
+            'k': ['m', ],
+            'm': ['i', ],
+        }
+        has_cycle, path = cdist.config.graph_check_cycle(graph)
+        self.assertTrue(has_cycle)
+        self.assertGreater(path.count(path[-1]), 1)
+
 
 # Currently the resolving code will simply detect that this object does
 # not exist. It should probably check if the type is a singleton as well

From 2a0a24ecccaf555591a560af934843e57f3689a2 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 3 May 2019 14:38:48 +0200
Subject: [PATCH 015/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 9c87d3f7..d367ed47 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -9,6 +9,7 @@ next:
 	* Type __block: Quote prefix/suffix - fix when prefix/suffix contains quotes (sideeffect42)
 	* Build: Update due to migration to code.ungleich.ch (Darko Poljak)
 	* Documentation: Update due to migration to code.ungleich.ch (Darko Poljak)
+	* Core: Detect and report dependency cycle as soon as possible (Darko Poljak)
 
 4.11.1: 2019-04-22
 	* Core: Improve explorer error reporting (Darko Poljak)

From 6258e397ed7ee64d394372dc2dd2953a236e04fe Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 3 May 2019 21:39:25 +0200
Subject: [PATCH 016/383] Include changelog in gitlab release

---
 bin/build-helper         | 7 ++++++-
 bin/build-helper.freebsd | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/bin/build-helper b/bin/build-helper
index 72f683b9..d72c6cab 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -227,9 +227,14 @@ eof
              | sed "${sed_cmd}") || exit 1
 
         # make release
+        changelog=$("$0" changelog-changes "$1" | sed 's/^[[:space:]]*//')
+        release_notes=$(
+            printf "Release %s\n\n%s\n\n%s\n\n**Changelog**\n\n%s\n" \
+                "${tag}" "${response_archive}" "${response_archive_sig}" "${changelog}"
+        )
         curl -f -X POST \
              -H "PRIVATE-TOKEN: ${token}" \
-             -F "description=Release ${tag}<br/>${response_archive}<br/>${response_archive_sig}" \
+             -F "description=${release_notes}" \
             "https://code.ungleich.ch/api/v4/projects/${project}/repository/tags/${tag}/release" \
             || exit 1
 
diff --git a/bin/build-helper.freebsd b/bin/build-helper.freebsd
index cb8e5397..4f393cb0 100755
--- a/bin/build-helper.freebsd
+++ b/bin/build-helper.freebsd
@@ -262,9 +262,14 @@ eof
              | sed "${sed_cmd}") || exit 1
 
         # make release
+        changelog=$("$0" changelog-changes "$1" | sed 's/^[[:space:]]*//')
+        release_notes=$(
+            printf "Release %s\n\n%s\n\n%s\n\n**Changelog**\n\n%s\n" \
+                "${tag}" "${response_archive}" "${response_archive_sig}" "${changelog}"
+        )
         curl -f -X POST \
              -H "PRIVATE-TOKEN: ${token}" \
-             -F "description=Release ${tag}<br/>${response_archive}<br/>${response_archive_sig}" \
+             -F "description=${release_notes}" \
             "https://code.ungleich.ch/api/v4/projects/${project}/repository/tags/${tag}/release" \
             || exit 1
 

From fe833fdfcb466ab460a76123b078a0e778cf924c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 3 May 2019 21:46:17 +0200
Subject: [PATCH 017/383] Sign git tag as one of the last steps

If it fails then the whole release should not fail,
signing git tag can be tried again.
---
 bin/build-helper         | 10 +++++-----
 bin/build-helper.freebsd | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/bin/build-helper b/bin/build-helper
index d72c6cab..53dbf5da 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -313,11 +313,6 @@ eof
         # Tag the current commit
         "$0" release-git-tag
 
-        # sign git tag
-        printf "Enter upstream repository authentication token: "
-        read token
-        "$0" sign-git-release "${target_version}" "${token}"
-
         # Also merge back the version branch
         if [ "$masterbranch" = yes ]; then
             git checkout master
@@ -343,6 +338,11 @@ eof
         # Archlinux release is based on pypi
         make archlinux-release
 
+        # sign git tag
+        printf "Enter upstream repository authentication token: "
+        read token
+        "$0" sign-git-release "${target_version}" "${token}"
+
         # Announce change on ML
         make ml-release
 
diff --git a/bin/build-helper.freebsd b/bin/build-helper.freebsd
index 4f393cb0..f3d1fca1 100755
--- a/bin/build-helper.freebsd
+++ b/bin/build-helper.freebsd
@@ -347,11 +347,6 @@ eof
         # Tag the current commit
         "$0" release-git-tag
 
-        # sign git tag
-        printf "Enter upstream repository authentication token: "
-        read token
-        "$0" sign-git-release "${target_version}" "${token}"
-
         # Also merge back the version branch
         if [ "$masterbranch" = yes ]; then
             git checkout master
@@ -393,6 +388,11 @@ eof
             ;;
         esac
 
+        # sign git tag
+        printf "Enter upstream repository authentication token: "
+        read token
+        "$0" sign-git-release "${target_version}" "${token}"
+
         # Announce change on ML
         make helper=${helper} WEBDIR=${WEBDIR} ml-release
     ;;

From 71945ef956a227d9abe33d0e415e2670fa6c0060 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 3 May 2019 21:55:27 +0200
Subject: [PATCH 018/383] Fix copy-paste thing

---
 bin/build-helper | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/build-helper b/bin/build-helper
index 53dbf5da..b5898ae3 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -400,7 +400,7 @@ eof
     ;;
 
     shellcheck)
-        make helper=${helper} WEBDIR=${WEBDIR} shellcheck
+        make shellcheck
         printf "\\nPlease review shellcheck report.\\n"
         while true
         do

From bd9884fac4c46c29d4313cadd40020bf8cf542be Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 3 May 2019 22:16:51 +0200
Subject: [PATCH 019/383] Tell curl to use HTTP version 1.1

By default, was getting the following error:
curl: (92) HTTP/2 stream 0 was not closed cleanly: PROTOCOL_ERROR (err 1)
---
 bin/build-helper         | 2 ++
 bin/build-helper.freebsd | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/bin/build-helper b/bin/build-helper
index b5898ae3..0fea5071 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -214,6 +214,7 @@ eof
 
         # upload archive
         response_archive=$(curl -f -X POST \
+             --http1.1 \
              -H "PRIVATE-TOKEN: ${token}" \
              -F "file=@${archivename}" \
              "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
@@ -221,6 +222,7 @@ eof
 
         # upload archive signature
         response_archive_sig=$(curl -f -X POST \
+             --http1.1 \
              -H "PRIVATE-TOKEN: ${token}" \
              -F "file=@${archivename}.asc" \
             "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
diff --git a/bin/build-helper.freebsd b/bin/build-helper.freebsd
index f3d1fca1..9823dab5 100755
--- a/bin/build-helper.freebsd
+++ b/bin/build-helper.freebsd
@@ -249,6 +249,7 @@ eof
 
         # upload archive
         response_archive=$(curl -f -X POST \
+             --http1.1 \
              -H "PRIVATE-TOKEN: ${token}" \
              -F "file=@${archivename}" \
              "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
@@ -256,6 +257,7 @@ eof
 
         # upload archive signature
         response_archive_sig=$(curl -f -X POST \
+             --http1.1 \
              -H "PRIVATE-TOKEN: ${token}" \
              -F "file=@${archivename}.asc" \
             "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \

From 0ab43e24055e00324e18852356f8e2b85637df94 Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Sat, 13 Apr 2019 21:18:27 +0200
Subject: [PATCH 020/383] Release -j/--jobs option, i.e. make it non-beta

---
 cdist/argparse.py                  | 5 ++---
 docs/src/cdist-parallelization.rst | 7 +++----
 docs/src/man1/cdist.rst            | 2 +-
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/cdist/argparse.py b/cdist/argparse.py
index 72fc0d0f..3ebdc138 100644
--- a/cdist/argparse.py
+++ b/cdist/argparse.py
@@ -11,7 +11,7 @@ import cdist.configuration
 BETA_COMMANDS = set(('install', 'inventory', ))
 # set of beta arguments for sub-commands
 BETA_ARGS = {
-    'config': set(('jobs', 'tag', 'all_tagged_hosts', 'use_archiving', )),
+    'config': set(('tag', 'all_tagged_hosts', 'use_archiving', )),
 }
 EPILOG = "Get cdist at http://www.nico.schottelius.org/software/cdist/"
 # Parser others can reuse
@@ -191,8 +191,7 @@ def get_parsers():
                                   name="positive int"),
            help=('Operate in parallel in specified maximum number of jobs. '
                  'Global explorers, object prepare and object run are '
-                 'supported. Without argument CPU count is used by default. '
-                 'Currently in beta.'),
+                 'supported. Without argument CPU count is used by default. '),
            action='store', dest='jobs',
            const=multiprocessing.cpu_count())
     parser['config_main'].add_argument(
diff --git a/docs/src/cdist-parallelization.rst b/docs/src/cdist-parallelization.rst
index ed3afae9..d458a128 100644
--- a/docs/src/cdist-parallelization.rst
+++ b/docs/src/cdist-parallelization.rst
@@ -12,8 +12,7 @@ The other way is to operate in parallel within one host where you specify
 the number of jobs. This is enabled with :strong:`-j/--jobs` option where you
 can specify the number of parallel jobs. By default,
 :strong:`multiprocessing.cpu_count()` is used. For this mode global explorers,
-object preparation and object run are supported and this option is still in
-:strong:`beta`.
+object preparation and object run are supported.
 
 You can, of course, use those two options together. This means that each host
 will be processed by its own process. Within each process cdist will operate
@@ -32,11 +31,11 @@ Examples
 
     # Configure hosts read from file hosts.file sequentially but using default
     # number of parallel jobs
-    $ cdist config -b -j -f hosts.file
+    $ cdist config -j -f hosts.file
 
     # Configure hosts read from file hosts.file in parallel using 16
     # parallel jobs
-    $ cdist config -b -j 16 -p -f hosts.file
+    $ cdist config -j 16 -p -f hosts.file
 
 
 Caveats
diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index 2eb0ce00..30832f2f 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -165,7 +165,7 @@ Install command is currently in beta.
     Operate in parallel in specified maximum number of
     jobs. Global explorers, object prepare and object run
     are supported. Without argument CPU count is used by
-    default. Currently in beta.
+    default.
 
 **-n, --dry-run**
     Do not execute code.

From 249ac917d3ed0620be768e27c4baa34e02e962a1 Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Tue, 23 Apr 2019 22:39:41 +0200
Subject: [PATCH 021/383] Changes due to new website

---
 .gitignore                                    |   1 +
 Makefile                                      |  61 +------
 README                                        |   3 +-
 bin/build-helper                              |  35 +---
 bin/build-helper.freebsd                      |  99 +++--------
 docs/src/_static/cdist-logo.jpeg              | Bin 0 -> 12560 bytes
 docs/src/{ => _static}/cdist-logo.png         | Bin
 .../_static}/pgp-key-EFD2AE4EC36B6901.asc     |   0
 docs/src/cdist-intro.rst                      |  15 --
 docs/src/cdist-os.rst                         |  23 +--
 docs/src/cdist-support.rst                    |  10 +-
 .../{cdist-update.rst => cdist-upgrade.rst}   |   4 +-
 docs/src/conf.py                              |   5 +-
 docs/src/index.rst                            |  17 +-
 docs/web/cdist.mdwn                           |  21 ---
 docs/web/cdist/cdist-logo.png                 | Bin 1542 -> 0 bytes
 docs/web/cdist/documentation.mdwn             |  12 --
 docs/web/cdist/features.mdwn                  |  26 ---
 docs/web/cdist/install.mdwn                   | 103 ------------
 docs/web/cdist/os.mdwn                        |  18 --
 docs/web/cdist/support.mdwn                   |  28 ----
 docs/web/cdist/update.mdwn                    | 158 ------------------
 docs/web/cdist/update/2.0-to-2.1.mdwn         | 118 -------------
 docs/web/cdist/why.mdwn                       |  69 --------
 24 files changed, 62 insertions(+), 764 deletions(-)
 create mode 100644 docs/src/_static/cdist-logo.jpeg
 rename docs/src/{ => _static}/cdist-logo.png (100%)
 rename docs/{web/cdist => src/_static}/pgp-key-EFD2AE4EC36B6901.asc (100%)
 delete mode 100644 docs/src/cdist-intro.rst
 rename docs/src/{cdist-update.rst => cdist-upgrade.rst} (99%)
 delete mode 100644 docs/web/cdist.mdwn
 delete mode 100644 docs/web/cdist/cdist-logo.png
 delete mode 100644 docs/web/cdist/documentation.mdwn
 delete mode 100644 docs/web/cdist/features.mdwn
 delete mode 100644 docs/web/cdist/install.mdwn
 delete mode 100644 docs/web/cdist/os.mdwn
 delete mode 100644 docs/web/cdist/support.mdwn
 delete mode 100644 docs/web/cdist/update.mdwn
 delete mode 100644 docs/web/cdist/update/2.0-to-2.1.mdwn
 delete mode 100644 docs/web/cdist/why.mdwn

diff --git a/.gitignore b/.gitignore
index 460bbf28..4b80b425 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,7 @@ Session.vim
 # Temporary
 .netrwhist
 *~
+*.tmp
 # Auto-generated tag files
 tags
 # Persistent undo
diff --git a/Makefile b/Makefile
index 5f03997a..099812e2 100644
--- a/Makefile
+++ b/Makefile
@@ -24,13 +24,6 @@ DOCS_SRC_DIR=docs/src
 SPEECHDIR=docs/speeches
 TYPEDIR=cdist/conf/type
 
-WEBSRCDIR=docs/web
-
-WEBDIR=$$HOME/vcs/www.nico.schottelius.org
-WEBBLOG=$(WEBDIR)/blog
-WEBBASE=$(WEBDIR)/software/cdist
-WEBPAGE=$(WEBBASE).mdwn
-
 CHANGELOG_VERSION=$(shell $(helper) changelog-version)
 CHANGELOG_FILE=docs/changelog
 
@@ -47,7 +40,6 @@ SHELLCHECK_SKIP=grep -v ': __.*is referenced but not assigned.*\[SC2154\]'
 ################################################################################
 # Manpages
 #
-MAN1DSTDIR=$(DOCS_SRC_DIR)/man1
 MAN7DSTDIR=$(DOCS_SRC_DIR)/man7
 
 # Manpages #1: Types
@@ -81,24 +73,6 @@ docs: man html
 docs-clean:
 	$(SPHINXC)
 
-# Manpages #5: release part
-MANWEBDIR=$(WEBBASE)/man/$(CHANGELOG_VERSION)
-HTMLBUILDDIR=docs/dist/html
-
-docs-dist: html
-	rm -rf "${MANWEBDIR}"
-	mkdir -p "${MANWEBDIR}"
-	# mkdir -p "${MANWEBDIR}/man1" "${MANWEBDIR}/man7"
-	# cp ${MAN1DSTDIR}/*.html ${MAN1DSTDIR}/*.css ${MANWEBDIR}/man1
-	# cp ${MAN7DSTDIR}/*.html ${MAN7DSTDIR}/*.css ${MANWEBDIR}/man7
-	cp -R ${HTMLBUILDDIR}/* ${MANWEBDIR}
-	cd ${MANWEBDIR} && git add . && git commit -m "cdist manpages update: $(CHANGELOG_VERSION)" || true
-
-man-latest-link: web-pub
-	# Fix ikiwiki, which does not like symlinks for pseudo security
-	ssh staticweb.ungleich.ch \
-		"cd /home/services/www/nico/nico.schottelius.org/www/software/cdist/man/ && rm -f latest && ln -sf "$(CHANGELOG_VERSION)" latest"
-
 # Manpages: .cdist Types
 DOT_CDIST_PATH=${HOME}/.cdist
 DOTMAN7DSTDIR=$(MAN7DSTDIR)
@@ -111,7 +85,6 @@ DOTMANTYPES=$(subst /man.rst,.rst,$(DOTMANTYPEPREFIX))
 $(DOTMAN7DSTDIR)/cdist-type%.rst: $(DOTTYPEDIR)/%/man.rst
 	ln -sf "$^" $@
 
-# Manpages #3: generic part
 dotman: $(DOTMANTYPES)
 	$(SPHINXM)
 
@@ -120,7 +93,6 @@ dotman: $(DOTMANTYPES)
 #
 SPEECHESOURCES=$(SPEECHDIR)/*.tex
 SPEECHES=$(SPEECHESOURCES:.tex=.pdf)
-SPEECHESWEBDIR=$(WEBBASE)/speeches
 
 # Create speeches and ensure Toc is up-to-date
 $(SPEECHDIR)/%.pdf: $(SPEECHDIR)/%.tex
@@ -130,36 +102,6 @@ $(SPEECHDIR)/%.pdf: $(SPEECHDIR)/%.tex
 
 speeches: $(SPEECHES)
 
-speeches-dist: speeches
-	rm -rf "${SPEECHESWEBDIR}"
-	mkdir -p "${SPEECHESWEBDIR}"
-	cp ${SPEECHES} "${SPEECHESWEBDIR}"
-	cd ${SPEECHESWEBDIR} && git add . && git commit -m "cdist speeches updated" || true
-
-################################################################################
-# Website
-#
-
-BLOGFILE=$(WEBBLOG)/cdist-$(CHANGELOG_VERSION)-released.mdwn
-
-$(BLOGFILE): $(CHANGELOG_FILE)
-	$(helper) blog $(CHANGELOG_VERSION) $(BLOGFILE)
-
-web-blog: $(BLOGFILE)
-
-web-doc:
-	# Go to top level, because of cdist.mdwn
-	rsync -av "$(WEBSRCDIR)/" "${WEBBASE}/.."
-	cd "${WEBBASE}/.." && git add cdist* && git commit -m "cdist doc update" cdist* || true
-
-web-dist: web-blog web-doc
-
-web-pub: web-dist docs-dist speeches-dist
-	cd "${WEBDIR}" && make pub
-
-web-release-all: man-latest-link
-web-release-all-no-latest: web-pub
-
 ################################################################################
 # Release: Mailinglist
 #
@@ -239,6 +181,9 @@ clean:
 	rm -f cdist-*.tar.gz
 	rm -f cdist-*.tar.gz.asc
 
+	# Temp files
+	rm -f *.tmp
+
 distclean: clean
 	rm -f cdist/version.py
 
diff --git a/README b/README
index a67e25e3..caf2dac8 100644
--- a/README
+++ b/README
@@ -3,4 +3,5 @@ cdist
 
 cdist is a usable configuration management system.
 
-For the web documentation have a look at docs/web/.
+For the web documentation have a look at https://www.cdi.st/
+or at docs/src for reStructuredText manual.
diff --git a/bin/build-helper b/bin/build-helper
index 0fea5071..04b7621b 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -76,33 +76,6 @@ case "$option" in
         "$0" test
     ;;
 
-    blog)
-        version=$1; shift
-        blogfile=$1; shift
-        dir=${blogfile%/*}
-        file=${blogfile##*/}
-
-
-        cat << eof > "$blogfile"
-[[!meta title="Cdist $version released"]]
-
-Here's a short overview about the changes found in version ${version}:
-
-eof
-
-        $0 changelog-changes "$version" >> "$blogfile"
-
-        cat << eof >> "$blogfile"
-For more information visit the [[cdist homepage|software/cdist]].
-
-[[!tag cdist config unix]]
-eof
-        cd "$dir"
-        git add "$file"
-        # Allow git commit to fail if there are no changes
-        git commit -m "cdist blog update: $version" "$blogfile" || true
-    ;;
-
     ml-release)
         if [ $# -ne 1 ]; then
             echo "$0 ml-release version" >&2
@@ -324,13 +297,6 @@ eof
         # Publish git changes
         make pub
 
-        # publish man, speeches, website
-        if [ "$masterbranch" = yes ]; then
-            make web-release-all
-        else
-            make web-release-all-no-latest
-        fi
-
         # Ensure that pypi release has the right version
         "$0" version
 
@@ -351,6 +317,7 @@ eof
         cat << eof
 Manual steps post release:
 
+    - cdist-web
     - linkedin
     - hackernews
     - reddit
diff --git a/bin/build-helper.freebsd b/bin/build-helper.freebsd
index 9823dab5..c292280c 100755
--- a/bin/build-helper.freebsd
+++ b/bin/build-helper.freebsd
@@ -31,30 +31,13 @@ basedir=${0%/*}/../
 # .freebsd - run as freebsd
 basename=${0##*/}
 run_as=${basename#*.}
-case "$run_as" in
-    freebsd)
-        to_a=cdist-configuration-management
-        to_d=googlegroups.com
-        from_a=darko.poljak
-        from_d=gmail.com
-        ml_name="Darko Poljak"
-        ml_sig_name="Darko"
 
-        # vars for make
-        WEBDIR=../vcs/www.nico.schottelius.org
-    ;;
-    *)
-        to_a=cdist
-        to_d=l.schottelius.org
-        from_a=nico-cdist
-        from_d=schottelius.org
-        ml_name="Nico -telmich- Schottelius"
-        ml_sig_name="Nico"
-
-        # vars for make
-        WEBDIR=$$HOME/vcs/www.nico.schottelius.org
-    ;;
-esac
+to_a=cdist-configuration-management
+to_d=googlegroups.com
+from_a=darko.poljak
+from_d=gmail.com
+ml_name="Darko Poljak"
+ml_sig_name="Darko"
 
 # Change to checkout directory
 cd "$basedir"
@@ -66,7 +49,6 @@ option=$1; shift
 case "$option" in
     print-make-vars)
         printf "helper: ${helper}\n"
-        printf "WEBDIR: ${WEBDIR}\n"
     ;;
     print-runas)
         printf "run_as: $run_as\n"
@@ -117,33 +99,6 @@ case "$option" in
         "$0" test
     ;;
 
-    blog)
-        version=$1; shift
-        blogfile=$1; shift
-        dir=${blogfile%/*}
-        file=${blogfile##*/}
-
-
-        cat << eof > "$blogfile"
-[[!meta title="Cdist $version released"]]
-
-Here's a short overview about the changes found in version ${version}:
-
-eof
-
-        $0 changelog-changes "$version" >> "$blogfile"
-
-        cat << eof >> "$blogfile"
-For more information visit the [[cdist homepage|software/cdist]].
-
-[[!tag cdist config unix]]
-eof
-        cd "$dir"
-        git add "$file"
-        # Allow git commit to fail if there are no changes
-        git commit -m "cdist blog update: $version" "$blogfile" || true
-    ;;
-
     ml-release)
         if [ $# -ne 1 ]; then
             echo "$0 ml-release version" >&2
@@ -159,7 +114,7 @@ eof
         cat << eof
 From: ${ml_name} <$from>
 To: cdist mailing list <$to>
-Subject: cdist $version released
+Subject: cdist $version has been released
 
 Hello .*,
 
@@ -177,7 +132,7 @@ ${ml_sig_name}
 -- 
 Automatisation at its best level. With cdist.
 eof
-        ) | /usr/sbin/sendmail -f "$from" "$to"
+        ) > mailinglist.tmp
     ;;
 
     release-git-tag)
@@ -337,11 +292,11 @@ eof
 
         # Generate documentation (man and html)
         # First, clean old generated docs
-        make helper=${helper} WEBDIR=${WEBDIR} docs-clean
-        make helper=${helper} WEBDIR=${WEBDIR} docs
+        make helper=${helper} docs-clean
+        make helper=${helper} docs
 
         # Generate speeches (indirect check if they build)
-        make helper=${helper} WEBDIR=${WEBDIR} speeches
+        make helper=${helper} speeches
 
         ############################################################# 
         # Everything green, let's do the release
@@ -364,7 +319,7 @@ eof
                 git push -u origin "${target_branch}"
             ;;
             *)
-                make helper=${helper} WEBDIR=${WEBDIR} pub
+                make helper=${helper} pub
             ;;
         esac
 
@@ -372,23 +327,7 @@ eof
         "$0" version
 
         # Create and publish package for pypi
-        make helper=${helper} WEBDIR=${WEBDIR} pypi-release
-
-        # publish man, speeches, website
-        if [ "$masterbranch" = yes ]; then
-            make helper=${helper} WEBDIR=${WEBDIR} web-release-all
-        else
-            make helper=${helper} WEBDIR=${WEBDIR} web-release-all-no-latest
-        fi
-
-        case "$run_as" in
-            freebsd)
-            ;;
-            *)
-                # Archlinux release is based on pypi
-                make archlinux-release
-            ;;
-        esac
+        make helper=${helper} pypi-release
 
         # sign git tag
         printf "Enter upstream repository authentication token: "
@@ -396,7 +335,15 @@ eof
         "$0" sign-git-release "${target_version}" "${token}"
 
         # Announce change on ML
-        make helper=${helper} WEBDIR=${WEBDIR} ml-release
+        make helper=${helper} ml-release
+
+        cat << eof
+Manual steps post release:
+
+    - cdist-web
+    - twitter
+
+eof
     ;;
 
     test)
@@ -441,7 +388,7 @@ eof
     ;;
 
     shellcheck)
-        make helper=${helper} WEBDIR=${WEBDIR} shellcheck
+        make helper=${helper} shellcheck
         printf "\\nPlease review shellcheck report.\\n"
         while true
         do
diff --git a/docs/src/_static/cdist-logo.jpeg b/docs/src/_static/cdist-logo.jpeg
new file mode 100644
index 0000000000000000000000000000000000000000..9bfa25298bb427d56cece5b630beb2447b618c31
GIT binary patch
literal 12560
zcmeHtdpMNs-u7+R*bg$a!4!&;lugQRNC*j)6fy0QM^cFxbK4}Lc#uS8Y(hm%%BEB%
z*`*z_SD2xVy&1+d%suzKmuIbKeQP~E>wVYyj_*B=?~gTy%Q%j?%zgc?-{w4j=XD9X
z1)rb`kchDG!Vh?ff*&z)F)>k5F-Z(&k+`&^w6v6@l$4CDf}D)3ysVUzoRXaUVnrMd
zCyiBJqNKP)K@q1YBm(A(ib;rxNhr!l$teEYFTqPlUR($gUMV7^4hhQ(iO35H>V)zj
zNJvcRw-@x+myj@6-y)2-grt-lBrGH%A}lJhuv#!P0(=IE%8Mzi+-S9EvFjm>dXS=i
zR7$S6#@5mr+^$xprorLU(GrqM%1f3mTeVtCd(B!yqfN$}x0qOOv$3_?Ztt*rkK11N
zefvF*96fg2$Jg(~nX|#?LPF1n#axKJ7<VZ?AvNu4`n8PfnOS-Hw+jl3?%cii=y6$j
zMdg#HRj+F6>KhtgH@*4T*51+C)!oy}7##ZY_1pL1kx|z4411RIgF81b1d05`9Ps-u
z2K}8q^1vQpQBe_5%z`~a!XaRY$cu`t+_*@=$`x}cXtBC}l(^#7l-$x92@Qi?Ox)qq
zt&&QbhKyCL1(SZW=wCA^`v1zJzZvv5dj!3Zv<PsUyofwRfcU%f611WJjQ{Mx|3VCi
zOzR9bB1$@glo+yBXtC8tGdu%3{$6ia_M6ZBwZWS88mA+ltsA|4(<fHdKTQC|bs<Lu
zP%h!+09Wd~0BUk$Q5y&5))V9i<L2Q4D8K*7T8NJ!Fg>O&UmvPL#hUqH-te>=xfp#<
z!v$IxBa%#FQn{42;n>9Knv+H46^9RBnYNP34oXSMK0if#F9UC*F`Wg_oB=Tw&%qG+
zGQ%RnCddH)DNHZ4An-F$b8jy8RsT|EA3ye1`tzwX#f?FlkIe2qA9|Y(L2?_TBgWX#
zG;x@IpE4b0u|fbnJWdfnc}kI{1KbF>!Fhf$A|rqzD=A329b!Qn(&9^?iv-Y1&t}wt
z+MJ**GA}8BqG56ec?JJ|wZe)1)vQe^g(J(dDa97qyX_U$>1!t$%T(AN$9%7uOWxVR
zo+XFDHHrf0OCO0SfQ}dlpb<mdyt1X3qU%2&ICr=9i8814Gp;YLTKo7(eRf(ieCgi)
zWV#SF@e6o9jof@!L;ER9BUW>fmsZTAK3j;>fn(tj3k)Yh0A-`A1W*mwCZAoN;16%`
zN7JNwJk`ub@>#5YQvvC2T05iZC1+8jMR#6a#nYteUY$z^?4|E$+Nmzx{+f{P_|KR2
z-!1#U`3(QA=#POgMYaGD62y%XK!?T#_-eB?E<(gsJ!G)}LU(jA?D$b#0?0ZHJy$#r
z%!!7<<SaxRc+5lq4F_7{t-2Uk1os$qwyVQ)q}v1#du!L^EQ!GL05)$tOY2P>oM=pT
zzA}lJ2cPkmDdR-H_u0|#%<byrE`8|r_bdo8&ZF&v8I8Rme4HZ{QKSkWm3&ksq6lu?
zQw6@mK>)GdKvM*I0z7@PT2BC#W`c)gN%EzrV*Dh+vE|sF#f)+R6kAgMDOs)wzGIPV
z{+W3x^6;f7H>=Iiiple<UyMddYUlmau|+SDHtk^MCx8xm4)En>kyq~QAFL46-tG!v
zTnZ#io*M1C1Eigo0HL=@D+Q2xcDw-c-T)7m-w%7uj6)K_wD_SlU|whW@V|}$Dc9An
z9mZKUY0`y==ExC#wS_oIF3aEPOvAOx-V!^R!eM&<&Z5@nqk4#V0yM9bfHbf`6&S0n
zxS~mx=LX&x-KV*(_r<j5njgJU&7(R^<uF$_qi!rNaJ*TVySE-|b?T&+21`L}ItSac
zR)=LIfas4YDoY<#>BU?PladfXT)r`iH)b`Wk*F-#X_5d!$dQBqZE78jOB!gz&x>$P
z1(4Vb@W4EQF$1f>!&v$hqTDQi8iz$V9}|$Baj29j>&5CTw_D9rH4jA{<%tfRYSyrT
z@gDq4=DFwnYnay(OP;IufogK{o#mI6XJsz`Xz&#|oS>Z}obZmN6<<cd_*Qx}JiF^L
zvdrz?QmyAN(hnyXslHttMZ}PNK*YT!=`(Hm8YuJ#Wf#`h&--0No{gWgiOYYuzV`EK
z^I;LTLIQFO#3;R-hNG?u98X@v-M!;Nwi4sy`XyNE^%!;u@h4*-epwz(K>+>HCQv%x
zBS8WvhY&+!5(xqbpM(A6pu^JpX`50OHj}85xkN^*W_0@sV-5)cfkMr}rv8*qdy_BC
z@&<6+m|dOaOGPW^ue{3$ku5GWOsc;gX>!^bcgs@jr+PXz*GnDFK!J}0&}x5XKKgPD
z6!aHR1jYt8cb69myk$?;B)<nMq?$=ER5fa+{VL9Fnt9Ps6u9o=o9V)tA4gpvQRyQC
zhC=i1He`^xwcpUq0;mOFGr-jY#WuNB0AX)%hXjx%jDhLZFiNn*S6p>}3p1Swy*KJ;
z<#5e}dmUM)jXkF7xwC`fthK{#dx4e8X`O)Mhq28u%_lo%S3!!dJF<Ky80U`#Cur{a
zFnQ`8W|#f2wh-I>HDwu%eupN4V!aQHw4C^%X3#-j<=s`wia)Yf_42!|KEqC=XM<Gk
zdYPWgwpv(frQA$~m%E!OO>w&b;+%l^UU{@7<#?{HPyN#-o^lMb(wD~msFUf8CgD;C
znERWPG+Ftfo3YO0a|?kCk$YN+@i23amPBA<m?5atcL6lShW}`F3udAK$IbZ3b^tSh
zL&<z0L=}YGU%#=}l^Ab_N*S?U$6V2<c{vXX_(J55&H8g(xV3jl;d}~$AG&||LvQV#
zj{Aw9t$m)ok$v#m;i6{bx$mMkeeOeHeTwcw)OsR!9i{;*Lvm!<Cg1k;#>MPto7G8l
zJo>aOYyT#@m6rQ2<R}ECMPkY!@&m+60HwMPIrD`3L4l2<ep9IKW5Eb+XecBR(J3C@
z)f4K`pz6@+Xun?f>>R1PwY^xePX{`+Q({rII>;&Q9PFswEBy4DVan_f22J$nqSp3d
zP$?N!qjl>#!>Na%yO<u9ze>fk=SWS$ks_OVBAXgFL*Z^yf1V{4F#VPQV!9C2&~^c|
zcy>UN`_{gNe({r&apw<{J^EYUycsRnXYk~pb@&n0G4`^5T4n!MfoBN47)~71XS{>H
z25}oQ-{$EVeWd(xqD)ZudVP&}Q_AiZS$kY3i19`bLam;dzxP^}*vB5<UYp{+&+qzD
zY)_fn4`WW-z^0V)zzO3)LN8_Tz5q%H&O939Wb1qOmd^Q&J)R=dcT|nlO8S}~DhiFj
z<$8!>$Y98X>iOWJo&iVtz#;=&vhBxj+S5gW7Oof1j4o2{t#;N-OKSo}excC+K6K{8
zxpo3bv$$q}gDDe0tvbYat6*nX9B_&BP*e0Jhcds)SLFT!=fR?StSqvWDO);(#Szz2
z@<vW&9{+XvL)h9CsMe84%xV7;YJD?Tr)a{8P)A4@VLrBfMqnm|y4KL-E8m{EBR?ZD
zs=iB^KZsrxqEjj`6VxF>@7wyv=CgHGb}<13gr01*i`HLlb6A>B1knC9lZ{a=2i-rE
z{Rx5jH_8d|0)e@=dCnX!2X`Ad1N)?i&pNo)pz8l3fYMr77=DbQ0OHG)39;@2Vu625
zW7-hrjETwusQaA&ns*W-$98=$LgbxMr>=UCxdsF@&5D?N7P=5Cnijc5vum&jQB32^
zcUtI%Ho9>G=@Gj;u|gwfjLN^(=U)x*IJP<B-Ii%9QL*9fre@r{CohzAfI_E^-yfpM
z_3Sv<{-tbL@YMwJv8;3Qi_}J!R3eLLw+=fh*f*Km{}$~F5&ySA%K^1u^#GC?QVY+|
zf-JYQCpO2zRv>_#Xmk2g7X{Glm>!yx8flS9{iZkMgIpu10838)08?MUJJXSR1lXP0
zI7H#e0>U=@BS&`q-#q}^qQ_OALT<*z6UK>Y;D79hWgXnd0!S2OZQ8FaEq>xOJUl$c
z$@(ADfM7tQml0KbT9D-oV(ffy&6U}^vPE~-s_l?h*%sGb?TPkueX)rE2q?ClRhMnR
ze{6P0;&h8|il?8;%u5Nmb09swgw5%L2T>o;=r@U_gXDG?cbvwOmhBg2GVEtpNVtZq
zX-eqE+t%nNGnUXF=Ey2@g83IMbkR2LjB4c;n~b<00RiFeX9E4YZpDe+)@W56s@55A
zmVs-q4?KE2>+p($j?osrWqsP|#DHck!mrd0RjuuhTF$=pGIlDvSnFJV<xq5I?}n7R
z$b)O|&>>T|DhPQ6KombrVDAaWBT683>H*Nm5?bKlJEH{dx?};ANNwxY7MYPkRbb$*
zR@ZizxgRfpl<g3JPry}q`F8-gJ|dv&Y0kbm*mv7$^h;`L3b|>67Ykb_mq(A3M%$58
zk!Ad~%*i;+MG~QKM5$yV;81{SiPOrrI2%a`izm2z8z^XC3A)mgq{Vd`Y+llbn=bR(
z6yCBt-y~O?mKcD)0vo8U><T2gQb#>L<Qp6qT^0*)dGVIFW=Zv#@jo=XCJ6}cS)(ok
z--C5+8@$@MiFUVlq<eR?%VHfezDk5eeYH>}3QJ3$v`+<$Ppk}2ERI*wK6Lrmt!~C1
z*)OSLkSB90&WNb&zp2VLzR2rDZ$aB7`r}8j1=noN)AuO&PY`2a=638AvdQD<A9ea8
zYGUQ-*5c($FaNN_@5>j}YrT#?!C%h5KsfvY!|~t-A3Gm$OzeA|(@wDrw+>ZnGqH>0
z_wuNscN{+SOZLkMXG?r~l^r6-Qd)(!b4!}_f_(BPL`JH1d(fCed<>e9l)u2HK!Q~9
z&GRA&8)%Hic`P5N3Vb96=nU&@7x)}Md~CT-y{@H&?8mcDUSlfAVSECZoT0az>rE8p
zzV%|V+wQ-sa$|Qo=}WJ>XuRf$Y)?bbzVv=10_4pQO9ZX$qRpF+Mdt|9@`zk5Kq)h+
zuabEpRP^F3GU3j41j(|%YSN6ju7Gd{14_~#X%Rzxh3D${Alb>62;)nOK<33#`$iGK
zwWBNGreSUjT9XB%mpmYD=K{j@3~<#c$PH?u02)6I^H)dHwvNrTq2k~lSC0(}Al_2I
zaO`uaEg&8NY)60eZ$8A^%=Ot}yVeLRZ+iecxQ~%uI`=Cqi5#GI6S=x|I|ne;YMU{K
z#~#JZZkkB`;?Dv-1Do3OiH^S{fc%IFS;VO4248K?hg9vKT5s^x<K^?`)TC1wOOsSg
z*o+4sw5!o;$4tDECxixhQbpU^r^<xaRR$kS)7V}-bs3+R1<l?da#wPabn}%7ic?t;
z`QbJN>UYhV(ift*?f<HW;M!z1etxY<GAgAZfCk6doP>Wp;lQ@nVA*N|ioYjj*8l|~
z%kD#jxHgPtA-}G+(Q{R1i&lo57Jh!a^!Q<n$Tc(fTmUcRQvi!m@g@dsDR;=bi_X1r
zZ=cOQqEnczcf*z)-bXTYo}GFvN>_0o<|_)#*?<@je^$u#d|ADs6Ch@MMu>7&@P)1v
z>obLSlB}00_tsfhZf*!aPSafg*Jl7+^BX7}u@|5gU;(%SN@)X;i@8Kp{8qte_41F@
zz-le8#`9<VRoYfnU%zN{+-3WL>Qe^&<%B;3aPYhn13Rb4cAjU&2q2sL{w<i-gwjT2
z@#Ag$l;=Ukp?RO`EBiHHym-Wuv@v>QrLz5ifw5>R*@a*-KmR|gcOrAu{IbAhJWe^6
zrg1Z!Wt*!^PkV%I^>5JWf`7rznM_?Ka*R*V=G|7E$3Zwg2=W>OROu6G1OM0O%XY1D
zoRZV<&qxiZHQhnp!PnT=#iV|prxiN)boS|zg%FbjBgsStPY#;kUC6<1%lpR#iOk?p
zsR-(I(qd+<jr)oN#C|W6`SBzppuH4NThN?o^e4&}xKu_&A=&NG^9=lcIoJWI$q}x8
z00Q$6q8l>^Pn>5Q3K!3+wMz0jvFF&EYnO!N2%Oemfvn>Hbs2vl)inK5K9de{V@YqM
zuk~tf%w-R3ZboA)@ekR+B@1p@7_dGC4}W=rSON`Tb_z`nqZhy6@&wST#z71}jtaBG
zyTtyjj^=-jf(S8bh?3T;UH$`)NFF7w878Zr`kz@TGMOKD0rUnRb;<ZH_FJA6vNmQY
zq=vYJtA1K>%;fAtYYq7AmeMLML}d-4Ggr*giYv!TgvRV@HS+X%+|K63l|PNPx|p=>
za0zx$Tg0S_cyT};v1X<<%sVHNbnjSXJQz76asPpwNX%v2!O&wXezl@U+nm|sf*B6Z
zK$IR2KHrqGsyT+VCdlLtR=?mC#^M>NHsJ<}Kf<y`FTj#$2p&02Ga1gowmNeolIyYa
z@?aUCVb&W0gF{dx4BLUY2?FS^GxHz;;;(3<(JKUyT<+E7Q*qTQRmoMgL1uO{t7z%r
z*jgY6z|phemjaLgdcf}5XCKt2oSt}gr+vOF-aRiuOm26<u!oo#L+;V!EnGjNDG_c$
zGqJ6y_gkL;IxhvE+eXmG9~XWWhWf%j0;m^LKkyi?bHpog9rzR9;-mZa8{pMBDoCrt
z3vrFj=2l-od1pEfPA0NGF#_YB2jy6t<$H8He%&aRlXg4BnCI{^hMgn(4ODPh$H6Hi
zHF+7_tpupoHgkAGI^X=~*5@}CMYxL>hhG=v!CjZ}^Sb`tkIX=<{=EeASF)bAIY%rn
z&G2}nQo@ebEXZSx!OsF3{(aFzlmOE5VkM#t6Yc`Y;WkyB`U}6}>|H~+_xs@N^LuWT
zy2?rjKlye|y7QO8=Q|@M(JX>b1D2`5VC??&tdyD^|C9rIY;1l7$QUxox{{mDQzx0w
zE*>)Ec!Z6F9GHIWNzsj(kKN5aWQpJAYNH7K-4L470dV{B;h{llY}fN~f1TH`+%SBf
ze6VX=4^irR6#z5S7y{^0ioRi=x4*rLY_x9_zQl+-3(9aBTq7TtpE%fD7jAn{^M*}S
zd)Nep!k46N@*kscS5fOt;frv2b6jrqb*m$T+N)Y`U1w}dg<5?^hl>S}a1OSA{_j*U
zLZ)*vZTbLt1>7C>8~r`y_Wv!2>&(QUl6HVOj8t<g@AQ#exW|q^4!u(t93gAArhU_8
ziM)w#^n+B^!6VtUe6|Z_y0Lh;3&poj8cytbGqjUdc}AtP($(;^ZS9?72gL~<MZ}K-
z^~pW?47gDY)6g&VvHWf1hRV~mj~I4k#TW6nNHh1~8g<a`zu3wsh;!^@GaD_us_%WZ
zYdd8q#C5YF4*@+T8x?}j)WKZPAC3D0(rb<gqu&8pU;-hry9L9j$MFE$l?~^L@tfrV
zqXpV%DG)Y)Fr|3e0KIDfSvg{fk5hF2L}0p1buVh>I49e%2p7tA-tVrNFPZSubm#h&
z6!q@63WoIcFV?J(b65FRy&4d!{WN+!P06Rag>;@dIC*&Fkfz7`gpD8C(|(-MR*gJ%
znSY?`%linRiHb(C6tj#cV*Cz2*lX@-^P)T``<dHue90am-YpwN7tE@kR8BM-T@NH)
zZB`LKDiCH{cg;xrrb6S}lP?gy>~1BDHDLKl<<$LZasnvDc^lBYmJrw;oiBdF2HZ4^
zC?1{+C&YTIg`fXgd8P#NSSqPtmT4M8+~?jzWbVSwX`-qCIbH&^*LS~l9j<C;TYQR6
zC0So^o}<~4BjCUj6!zk3fJ%1>4KdWwNQGcWI)-m<j~dxlnu#rQ8k&-_Q(u=-P4#_{
zq+e2aOjQ2!GGx}P>;ZhD-K9vvIo<aL?{YKOA&@p~5F&u0PQzEW8}WBU+TJBu37{hI
zt+Zotwa((-3CzoWOTqfJ1<)(nN>tZMm0AxkvzGRg-Z*BwJq2jgid$YnXK|xPP8rnL
z>YsVh-2B8d@!@CJz4zCK!alFlI*P)dowHTuaPES>#dHdhOhf#q2;9{jv+t)akWQXF
zdHku)otKL5HMZcNPNWej9X|$;#nvd;vxT110n1<PcC~^PG>6(+sK3&Q(<!T}6+n)5
zJ!P&o5hKXC-vM{w9b{?EK?_BDI;HnC0cW%5J)u5}<Zf|LW%(t`1gqIzb;1>rE|CT^
zcj0>qiM<A#@aknYmAz)}jD~>SJKXSQpWJ^uOb*#WhtKb&33)9uJ{r9C%_+Bw;)YQA
zj}S!R6X)F{uE<dMfH3zJ+apw~E^S?kx5L1*wy9H!rePY9_Zmz0m<v%afPQQ=Rbr?r
zdP{D~>WenAskSxgS1(74kBU$2a-ZqqS->@0$@=6E*EaZ>Y<i~ll=1r1Vw<ib#&UH}
zN0uKoJJRE+)-hWMDzI1$Z67X}7JF`LgG$q(V*O(HrH4WCyB5rt7;X-r8@8s6Hk{rE
z(|cfUAD)S*nxgSuU8qck0J_qG88!bGCj~1b$`}Xzq8rRdOq(ZxYwqP9G^L-9@MpKx
zW_?jx&E#a3c<L0q;FpECmc&To+BaYZz;O(qyU|G`LpWXlJ;ElHObi-$kNjF#dh*`W
zEm4&fgo*5VG<<BH(tef~Ky<DueI9>OcYU7k>iBt+4J)tm<hE14HF9ooH-_^FNH8lT
zdVT8!kBBj&n<X1om&4i0_&vv(pJ<dr=YyS#MwLyR_~o-VrvlCgtbH%dQZYPv8+R~V
z&eBLsQHaOqNuZyy@%+0akz<GMc-I_ZE#DbwcX#AujmLN2#@>~fDUIM2r;ApwqRIED
zUo*CK1?x$VR`h14z-J0iZ2F)XJ^68O!oKdaYu{Kcs(!}>a3^+}JH$jkO6i^q&}rNh
z1m(^qp3cyOyL{h#;XOPuWr=^<?*4Uk3Yb{?bUL!bLUEhsWM@`Q4YF)K!K57&Ir_)|
z+hLN%{Dp>`j3l@YQ{N_Y$+EWqhCdh+K#SfApoS5^RAY<A189;D9O)C7y$5_M;1Emv
zjh|?ve?z}kMnnI`E;DPhHG!Lo!;Qvjm%hnOd7CaeE3&!71Je1kBPZgAj-T|c-;N(w
z0<Zl;v&irNxvR{<UhxI;9v`eYdJQOaRa_d{0JzOZUmf;(n)#ocG68jIPJ`0{=12L_
zN~hvUrnycG9jZeAiO%FOZ_|S4&H1t}(&?J1R`Zf`G!!2L4z6?-4z3=7p1KO++vU;L
z6Bt~R5Wd1QDzaQp04>k|e>khq5jg8rsl0JI^B%n^`KrZ(9G`(7XNATA5bcYw{n*B_
z<r$7g4~}^~b__l;qvSQ-4Ng`sB4f<a7eKD7<UfAy$MX(NeKS=jUz0!VadK*WLbfS0
zFS5eebmKRBS?IInP$XsxQxeh{P3Eq~wRxbuAU)sQ3^Wd+<d$D`e>2O`LKH%31F2|F
z|MDl|9=hvaaX8jVl&2d(U97(C0r9_pW=16S=T;BssLJq{tD$Y^%Szh(%CWf%e=cCZ
zAxeY&{N+BID(iR7ohJ45+GKC<=3}WcE~3ZXp!7v%kwG_?0eJm6I+Fm#>T$ITGkFKN
zWA4l{GPa7@_ccBFQ-0=T=h+nN*khYrtmdLr!@Ih#LVp5Ko#oT+h++(CPl$uZHxSr6
z(!U=kOqQEtE9sOu?T7Fnf9bUH_#DrClvuXDw8U@zT&aJ4MP{JN<d2PpQMIKmklGEW
z2q6ZQt3`-EtGC#<_hz>K$AY9+^HLR80yM?yPA-W&Gk^nWQ)5B$%L&z~@83uvcK&kK
z*Qc~{dp0Nd()L$&n$p=pjo*nuo}?gd`1vz3&(#cDzGeID8@i%5v~GMSBx088U-$CR
zhIC)sV6tx59Hk^ELxH74%<6n~P;Y!!a<_A6;q2ql0WaD9YGoD;S=?Bct;3>TGI~Nf
zRPd?(F7bV6ig`)wuck-WteD09a0)V}EjJS??05DH8PZkg9mQ;XD_z-ItRZ{P%1quH
zT^lPovX*Z)PByNcYY4cy=dM{H^3mR*^;=t!-H{msPAvb%tX|JxgsiTeM|me)zO6u}
zOc$T=c<BfG4<YVt6s8k)ZZUEOoHuI|*iNSa`Jt(VhBS1cm<SQihn+T6eG=8Rryk9n
z@43=#=7X7jz(XZ+0po|0;PF)$G@g31c6X7Z!IuIib((OxIq1o|+DP<qGP*9S`sOpY
zM<3txYDV0!QFQOdzq0})N9gxKOoEwvh}~PiGXTFf!X{RWws{aGPv|c#e<ro3nG;;A
zc3hJ1H7zZT->Fr)gn#*t-Y@rOb+$~brzebdp7kw=J}R5Ka>?2^p(~Qa4TTV@EAcL|
zA`Vg5J8B9<j3tPC)bWbbZ3nnkH?T`bor=}O1yJEHr%e~PkPrJ;Eh=I}czk#4H00gV
z+f{Ko&BJ?JtK)LncO^oKLR<e%VHTzp(JsK#4$lEeIvDQES1AAOG@6-=+PlZl#<6}t
zAKe>i(u>S4R6De32617EQS0$C`<ExnhaO(6mM^W7@$_NSsz{YI`Bk*O<7{fny`wFS
zL5u6xu1hgVKN|GwOQw}-Jp}9QaUTZKyd5g>0%kVvX|L8KZD>1M%?zkDYRJ#`$n`s0
zWcD~O$wQ<oX?O0>BG8fkbhQ0vN0hLs8y}pk)_}v)FYn2UaJMSVHqOE3j4|U-$sW*p
z<qu+ci+~yPEB$|j(f;HPh=tKYx!{ESnVg5P|Ez9D5>#pQO8oTxYBji9*qN_=0-;k|
zfzqklh+GSdqi~=!(CICsZT|Uo614;7s)y9f(VbOEPR}pgHdyN$7XE1Hl&Iqt%#+ub
zBCMz%2+>3_#EHclv`C{jOYS%CFNj!yUETKe(>83gVI0@hP7@VL)tT4hE@p<<axu*O
z+Ui9u8GI@G3i+~nOaFLheTV+>I!Z&N=_qKwwm2tlETc)89la!F>f045^mz`5UO0G9
z#wJ$Zr?;Z_)Yk0DzdLNTM4fhv_{olQ901R8{FSPP*fahsm=oh4y?rx2!6D|wo3_TZ
zo%Zp^9t@MWRFnE^jAMqC5%~~wr*$2Lqt^s(`s7o4Payljo-L62*P&@>{TzXPHkjvR
zDMm^MzyW&LRA<HjPa2TXRT2KgRdCIA!k08|2wE!wFulq9+!1tacMFd!0VXD5P`y^l
ztsM#6&$*?e2A(wRipwNxW~O`&;gb?67C+PDuW;Yb<ZAEw`-kp)3g9`V*M+zSF7+C&
z$<TQ6n%b=XG4&U;^ZwGER~f3k{!Bukoda@=`(8SL71yZQ05q8ZuV7dHjQ1yiFS6WX
z3YX3N(Kh}OX1UE!FO`3yD2B%E?xb!zJmdN_{O$#7an%nyTf5y~WDfZb4&ipr8%)az
zGj_a<+lU(-dK$3#_ERrT$oTQwero6LJqV*8uI7Vn@P%Jfz}b$36-Xn0x&v?OA4|&v
zQW1ZWKzPl0ZVT)^Nh=|+%YLgR1Na8U?{(z&cklhIBF;hX5uVk)<*-WV&c?mh*X*0>
zAQeBM^<|!_9l7a#x78A#DS#H5zxZs$_HS9RD4>?RT7D?(ZF4X8eA3mefAyE}n_WpK
zh|F!Y1XqVwwT)!Cr^$~G+_+<pi0UC@oSi`61qV@a+N7i40zfUe(S<uNfL@ouwO1|l
z;T8rx5RrTiQq6;(3uJm_8siOqDPi~&(-;*4SGsiZ%&*wX6!zxO<v;+S66Ta>zJS6v
zfYL-yz%SWxNt2Zk)u~^5M)y5qMaYVX>qmJ<Bm6n|nt2Ik<%Ke@rG-3eKaNZ9Qp<+v
zOUma=eQ>3J5dn=_kJ{R~yr~u2{#w0yGd~xmUxUTT#-qv}A2MVbBN6LUj!kFs?(wtT
zw|u1&*4uAcbuNu~6l_Nlx<J!35bMgPLAl6QW<9@}ytjSjlX6n{1$)fczJWhoaQzhb
zbR4)AreX$k_9%A>l4yr)u?E+|WYrd~g%vlWHq_o_+9IrQR3(>{hQ?t<V7l9P02-hQ
z$hvSrDp<!w(U@yzK-22ax%lsGYBC~kH?(>)D=rFv7BK`oop?_GJq~<T+#HP;ey&XS
z+RBl!<yk-U+&_8$>ZRMHREO_3kJ5dzP2CF?<nuuEGmW`p3Xito)u^QNjKIaACttmq
ze$$Vs==ky^X<xr)chJ{5dNj1<wMECg73lW#esVA24~`|bfX&>nP-kh!oaM+(1PP-+
zY3>d8w%`b7mkx@H-tEj~OWGTkiS?-$FP=V%<Ws}u!$4VOICHh(aS3p={JkMtu?x`}
zl#y~=wwJQ%N`3XC8M|lt%F<U<0<&++S&sBq+y5MR<vi<ueSL{Pc{BNsek7I|x?l!>
z{L!00C;3M|c1_4A3UL8r{mGk!Od=w`ydh-SWxINsyrGU1^zyagzSU3D<4#E@F2Q{M
zK0>6Pb-^ToyN!=BA_>PRQq^hnKEuRkztT>2Oo^vXGLvo$h)50J6Ha#Eto`d@@)PV8
zSok@PXT@C~C>=Uvo4B{_=2Sd7-udx}@b=p(`Qb?~WNku#()4AZj>=WHxMyTvz{J#<
zDz|liGbPG<R@viAudS$|O+_70{-bUGW~6els07gGM5kGm<GCzTPnLV4nN7|KS1-T9
zhW-JY^Irn$I}*2~YQ7W-_t`Q*Bm=bo_l=@jEjoh7leQen_cytM-U#pu=9EWl$(Ma!
znju>Cu<>1Zn0rC%{txnZl_iP`gBcrxnMOnLwT{<<IxHGr)0h*m5IC4?8-#hh0MOF;
zf<W*G3%N*HEPw_+1)>H-FV_Rao^IzkPBOTA;l)ivqrY<DlxaQ0l=u>68*(Wq`Uz%b
z5g5HFK$6^|Isx>911kIFuC6_<{9B;fQ+x?sWFWHTJSF45kP?AwyO?;sjD?l}qE!qa
z$6wr_YmLw5k(;xQQ;+10h9wm!6__|{oX}ma|L8%B@?pItv+u(Sa0O;+YL}mmyn07(
r46+T%YzaN!z4C)>*UmoGuAQJ}yZcSo{9dvD^ZtL>@E`U9Bk1`r-RKs7

literal 0
HcmV?d00001

diff --git a/docs/src/cdist-logo.png b/docs/src/_static/cdist-logo.png
similarity index 100%
rename from docs/src/cdist-logo.png
rename to docs/src/_static/cdist-logo.png
diff --git a/docs/web/cdist/pgp-key-EFD2AE4EC36B6901.asc b/docs/src/_static/pgp-key-EFD2AE4EC36B6901.asc
similarity index 100%
rename from docs/web/cdist/pgp-key-EFD2AE4EC36B6901.asc
rename to docs/src/_static/pgp-key-EFD2AE4EC36B6901.asc
diff --git a/docs/src/cdist-intro.rst b/docs/src/cdist-intro.rst
deleted file mode 100644
index fad40fe5..00000000
--- a/docs/src/cdist-intro.rst
+++ /dev/null
@@ -1,15 +0,0 @@
-cdist - usable configuration management
-=======================================
-
-.. image:: cdist-logo.png
-    :alt: cdist-logo
-
-cdist is a usable configuration management system.
-It adheres to the KISS principle and 
-is being used in small up to enterprise grade environments.
-cdist is an alternative to other configuration management systems like
-
-* `bcfg2 <http://trac.mcs.anl.gov/projects/bcfg2>`_
-* `chef <http://wiki.opscode.com/display/chef/>`_
-* `cfengine <http://www.cfengine.org/>`_
-* `puppet <http://www.puppetlabs.com/>`_.
diff --git a/docs/src/cdist-os.rst b/docs/src/cdist-os.rst
index 4f6b4820..a8e31226 100644
--- a/docs/src/cdist-os.rst
+++ b/docs/src/cdist-os.rst
@@ -1,16 +1,19 @@
-Supported Operating Systems
+Supported operating systems
 ===========================
 
 cdist was tested or is know to run on at least
 
-* `Archlinux <http://www.archlinux.org/>`_
-* `Debian <http://www.debian.org/>`_
-* `CentOS <http://www.centos.org/>`_
-* `Fedora <http://fedoraproject.org/>`_
+* `Alpine Linux <https://alpinelinux.org>`_
+* `Archlinux <http://www.archlinux.org>`_
+* `CentOS <http://www.centos.org>`_
+* `Debian <http://www.debian.org>`_
+* `Devuan <https://devuan.org>`_
+* `Fedora <http://fedoraproject.org>`_
 * `FreeBSD <http://www.freebsd.org>`_
-* `Gentoo <http://www.gentoo.org/>`_
-* `Mac OS X <http://www.apple.com/macosx/>`_
+* `Gentoo <http://www.gentoo.org>`_
+* `Mac OS X <http://www.apple.com/macosx>`_
+* `NetBSD <https://www.netbsd.org>`_
 * `OpenBSD <http://www.openbsd.org>`_
-* `Redhat <http://www.redhat.com/>`_
-* `Ubuntu <http://www.ubuntu.com/>`_
-* `XenServer <http://www.citrix.com/xenserver/>`_
+* `Redhat <http://www.redhat.com>`_
+* `Ubuntu <http://www.ubuntu.com>`_
+* `XenServer <http://www.citrix.com/xenserver>`_
diff --git a/docs/src/cdist-support.rst b/docs/src/cdist-support.rst
index 2343500e..19afde2f 100644
--- a/docs/src/cdist-support.rst
+++ b/docs/src/cdist-support.rst
@@ -1,11 +1,9 @@
 Support
 -------
 
-IRC
-~~~
-
-You can join the development ***IRC channel***
-`#cstar on irc.freenode.net <irc://irc.freenode.org/#cstar>`_.
+Chat
+~~~~
+Chat with us: `ungleich chat <https://chat.ungleich.ch/ungleich/channels/cdist>`_.
 
 Mailing list
 ~~~~~~~~~~~~
@@ -25,4 +23,4 @@ Commercial support
 ~~~~~~~~~~~~~~~~~~
 
 You can request commercial support for cdist from
-`my company <http://www.ungleich.ch/>`_.
+`ungleich <http://www.ungleich.ch/>`_.
diff --git a/docs/src/cdist-update.rst b/docs/src/cdist-upgrade.rst
similarity index 99%
rename from docs/src/cdist-update.rst
rename to docs/src/cdist-upgrade.rst
index e810d6e9..e57ed63c 100644
--- a/docs/src/cdist-update.rst
+++ b/docs/src/cdist-upgrade.rst
@@ -1,5 +1,5 @@
-How to update cdist
-===================
+How to upgrade cdist
+====================
 
 Update the git installation
 ---------------------------
diff --git a/docs/src/conf.py b/docs/src/conf.py
index 8ed48324..78f9842c 100644
--- a/docs/src/conf.py
+++ b/docs/src/conf.py
@@ -56,7 +56,7 @@ master_doc = 'index'
 
 # General information about the project.
 project = 'cdist'
-# copyright = '2016, Darko Poljak'
+copyright = 'ungleich GmbH 2019'
 # author = 'Darko Poljak'
 
 # The version info for the project you're documenting, acts as replacement for
@@ -138,7 +138,7 @@ html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
 
 # The name of an image file (relative to this directory) to place at the top
 # of the sidebar.
-# html_logo = None
+html_logo = '_static/cdist-logo.jpeg'
 
 # The name of an image file (relative to this directory) to use as a favicon of
 # the docs.  This file should be a Windows icon file (.ico)
@@ -150,6 +150,7 @@ html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
 # html_static_path = ['_static']
+html_static_path = ['_static']
 
 # Add any extra paths that contain custom files (such as robots.txt or
 # .htaccess) here, relative to this directory. These files are copied
diff --git a/docs/src/index.rst b/docs/src/index.rst
index af303f5b..95e44d52 100644
--- a/docs/src/index.rst
+++ b/docs/src/index.rst
@@ -1,20 +1,23 @@
-Welcome to cdist documentation
-==============================
+cdist - usable configuration management
+=======================================
+
+cdist is a usable configuration management system.
+It adheres to the KISS principle and 
+is being used in small up to enterprise grade environments.
 
-Contents:
 
 .. toctree::
-   :maxdepth: 2
+   :maxdepth: 3
    :glob:
    :numbered:
+   :hidden:
 
-   cdist-intro
    cdist-why
+   cdist-features
    cdist-os
    cdist-install
-   cdist-update
+   cdist-upgrade
    cdist-support
-   cdist-features
    cdist-quickstart
    cdist-real-world
    man1/cdist
diff --git a/docs/web/cdist.mdwn b/docs/web/cdist.mdwn
deleted file mode 100644
index 90af20cb..00000000
--- a/docs/web/cdist.mdwn
+++ /dev/null
@@ -1,21 +0,0 @@
-[[!meta title="cdist - usable configuration management"]]
-
-![cdist-logo](cdist-logo.png "cdist logo")
-
-cdist is a usable configuration management system.
-It adheres to the KISS principle and 
-is being used in small up to enterprise grade environments.
-cdist is an alternative to other configuration management systems like
-[bcfg2](http://bcfg2.org/),
-[chef](https://www.chef.sh/),
-[cfengine](https://cfengine.com/)
-and [puppet](https://puppet.com/).
-
- * [[Why should I use cdist?|why]]
- * [[Documentation|documentation]]
- * [[Supported Operating Systems|os]]
- * [[Installation|install]]
- * [[Update|update]]
- * [[Support|support]]
-
-[[!tag cdist unix]]
diff --git a/docs/web/cdist/cdist-logo.png b/docs/web/cdist/cdist-logo.png
deleted file mode 100644
index 13c2792728d20511f18ae60df8524d68b8a35cbf..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1542
zcmV+h2Ko7kP)<h;3K|Lk000e1NJLTq00B4v005=|0{{R3bgBWa00001b5ch_0Itp)
z=>Px#22e~?MF0Q*|NsA`*`M72000SaNLh0L01FcU01FcV0GgZ_00007bV*G`2ipS@
z0U8oZ%R(#w00o9gL_t(o!|j;OOC(1Wz^mIa(<@6fGKU<Rp|&zJwu2B^aujieMUzY1
z{R<KZ<d|(e<<`gs+BOFfj}nH)gLqm(j*Cp<hBl`?=Vngk81^s7`>5*AnRX5Vhb0Zp
zl-0j^^}hPms}|z_>pi<{At%Dr`U@U4gF4RoGSKpzdV%|9@IftRZLXV9@rE>N@N!C~
zGe!OUp&qdMyVA_e*UFQ*nQ6FwG6UDY#;;ZQdr1m53*5jARMf$*1#sLK#5utjPU&db
zU785<T=TUV_55Gqb3KiOmE^@asl0xKers@QRpjNlM<z)cqM~2Mt&n~TIGnBHB-u;B
zn+vLTq)FZ;|B)RJs&>>|Q;`jcYt&fW8y13Dv?GjzEFS5zgd^L_8Dcpp*UC7%Q|3g|
zeW!0Xc2ln5Rr4S=Vw`9rom{QR%eaLoD99VfwGKs%e!wYXuc>Ro!YNg<!`J$DcJ&PW
z#aJhjN?{!Nubhf<Fa$f?ykS<N#8Rtb$G(cZIM3PM&%!%_K~%_txwyhz5a$#)F@Fl{
zzRUT*{<i1eQdvqq{yHO@xNel^&SR1U^3IMoGI?>8JEj$j^K%vMI*!X+fZJ61zup&|
z_&2@o@#j2c4Ow58Hv--l{9E;X!t)PThohc&SqQ&#?<w%wzec-uAf<7@*0_(BT>tli
zeQ~q`w_7_Q4-|PvJ%@O73;v3uexPskGwxuUxYYml(wYAUI%ek9r9qEY?};s1j`9Ns
zws+2%V_kFL`}_%&3B=6YnssgO7v^UEE^rn<`DuRG-WhWykyiNA+NRs7e#(n=#)dSo
zC4b`2WX@hcQKUGP1Q;~i_~10#_Lg>}wnLWcfIX@<+++6!>FOsE(lNYg;o!>kuYLrZ
zgn0Pmn(d&{8hK&l4S+j<N)H1l44np)O}M2zY6Hk?@R%II6AD~JoYjCEHgMpFJhuR1
z{lpXV?%`12y0Fk&NDddCrjOoc>!SA~?-kZ(d{hS{KtRyo7mHqy$s_JuIA?hdVknB7
zLmcRLeo>TXD!t|!#KppS^(U1G?uTqIrW6TN&L%q)1U|fh!8$5_6|fyo5;wJD>?Nn8
z7@(SuyO_)`(2ft;4l8l7-_6;9W~(mlmj~#Vqtq{l($Q`rzu?y<art-v7Y+J(4xbvV
zr%iVc^I(nh0N4HQGQX~kcrZ$ybo26Rxb?}nPcKGuC3~Zyy_g5c-Q~Y&zl@qiJ4EAj
z2P$kS54dm2`vuDA4wl+t9_aom|6I<h64y@G&F6uzT=eZ$DG#dhZ0ywRuoSl{*FbJ&
z`%Z3_<c;J?_KKn%_Gte-AUl>O%mX=fdC=B&2+U{e4Ydo2tmeVMoEvfXx48|#$#HqW
zTvw#rm^=`@-JY`kV#Va)&A7P1?!T;r((*!4!$HtGcXKPzc`S^6g>{Se%ENDB0rpaV
z5LWU)8vnI-KXJt}pCil*k@~kQ_nrqXYSH9EMl)|%efJ-1(-zZu5F_WnM!-h{74^xT
z;0|clXTjlN%3<RW4JsUX$vKJO;6VO!L*QWDugdF&)R53-i~BUV+u?IwN!}43BfV4p
z0&bzeEeFgE_!#M3j^nhvAs=%|KkNy@eThw?ax~WqsAuG3kha&sHZYO65iGgdjv?-E
z=J?gg)q{OLf;dz5&Va6GiMw|NwG)~|@eI#jYktxa;F2HO3_RwyKhHfnNn7BjkT{6=
ziP#X<Q(e_m#^Hm5@y<9b2AbRK>T{{fFAO-|Ift!@>@-G2m|qxhyoK=0!BZA|iCn<k
zB~5%bmg5%&I^Lo)UY_Pck>43h9NNJLMXkOv16dzyd&)Y5*|k+R=&8w!jnSNv6LK39
saY9X~U}r+kn~+<bkdyy0_dZ<z0+t-8wYqrCv;Y7A07*qoM6N<$f;zJO5&!@I

diff --git a/docs/web/cdist/documentation.mdwn b/docs/web/cdist/documentation.mdwn
deleted file mode 100644
index 6479a4bb..00000000
--- a/docs/web/cdist/documentation.mdwn
+++ /dev/null
@@ -1,12 +0,0 @@
-[[!meta title="Documentation"]]
-
-You can browse the
-[latest version of the documentation](/software/cdist/man/latest) or
-have a look at [all versions](/software/cdist/man).
-
-You can also view [speeches about cdist](/software/cdist/speeches).
-
-Checking out beta? Find the docs here:
-[beta documentation](/software/cdist/man/beta).
-
-[[!tag cdist unix]]
diff --git a/docs/web/cdist/features.mdwn b/docs/web/cdist/features.mdwn
deleted file mode 100644
index 77c61382..00000000
--- a/docs/web/cdist/features.mdwn
+++ /dev/null
@@ -1,26 +0,0 @@
-But cdist ticks differently, here is the feature set that makes it unique:
-
-[[!table  data="""
-Keywords | Description
-Simplicity | There is only one type to extend cdist called ***type***
-Design | Type and core cleanly separated
-Design | Sticks completly to the KISS (keep it simple and stupid) paradigma
-Design | Meaningful error messages - do not lose time debugging error messages
-Design | Consistency in behaviour, naming and documentation
-Design | No surprise factor: Only do what is obviously clear, no magic
-Design | Define target state, do not focus on methods or scripts
-Design | Push architecture: Instantly apply your changes
-Small core | cdist's core is very small - less code, less bugs
-Fast development | Focus on straightforwardness of type creation is a main development objective
-Fast development | Batteries included: A lot of requirements can be solved using standard types
-Modern Programming Language | cdist is written in Python
-Requirements, Scalability | No central server needed, cdist operates in push mode and can be run from any computer
-Requirements, Scalability, Upgrade | cdist only needs to be updated on the master, not on the target hosts
-Requirements, Security | Uses well-know [SSH](http://www.openssh.com/) as transport protocol
-Requirements, Simplicity | Requires only shell and SSH server on the target
-UNIX | Reuse of existing tools like cat, find, mv, ... 
-UNIX, familar environment, documentation | Is available as manpages and HTML
-UNIX, simplicity, familar environment | cdist is configured in POSIX shell
-"""]]
-
-[[!tag cdist unix]]
diff --git a/docs/web/cdist/install.mdwn b/docs/web/cdist/install.mdwn
deleted file mode 100644
index 0ced26db..00000000
--- a/docs/web/cdist/install.mdwn
+++ /dev/null
@@ -1,103 +0,0 @@
-[[!meta title="How to install cdist"]]
-[[!toc levels=3]]
-
-## Requirements
-
-### Source Host
-
-This is the machine you use to configure the target hosts.
-
- * /bin/sh: A posix like shell (for instance bash, dash, zsh)
- * Python >= 3.2
- * SSH client
- * Asciidoc and xsltproc (for building the manpages)
-
-### Target Hosts
-
- * /bin/sh: A posix like shell (for instance bash, dash, zsh)
- * SSH server
-
-## Install cdist
-
-You can install cdist either from git or as a python package.
-
-### From git
-
-Cloning cdist from git gives you the advantage of having
-a version control in place for development of your own stuff
-immediately.
-
-To install cdist, execute the following commands:
-
-    git clone https://github.com/ungleich/cdist.git
-    cd cdist
-    export PATH=$PATH:$(pwd -P)/bin
-
-From version 4.2.0 cdist tags and github releases are signed.
-You can get GPG public key used for signing [here](/software/cdist/pgp-key-EFD2AE4EC36B6901.asc).
-
-#### Available versions in git
-
- * The active development takes place in the **master** branch
- * The current stable version can be found in the **2.0** branch
- * The upcoming stable version can be found in the **2.1** branch
-
-Other branches may be available for features or bugfixes, but they
-may vanish at any point. To select a specific branch use
-
-    # Generic code
-    git checkout -b <localbranchname> origin/<branchname>
-
-So for instance if you want to use and stay with version 2.0, you can use
-
-    git checkout -b 2.0 origin/2.0
-
-#### Git Mirrors
-
-If the main site is down, you can acquire cdist from one of the following sites:
-
- * git://github.com/telmich/cdist.git ([github](https://github.com/telmich/cdist))
- * git://git.code.sf.net/p/cdist/code ([sourceforge](https://sourceforge.net/p/cdist/code))
-
-#### Building and using documentation (man and html)
-
-If you want to build and use the documentation, run:
-
-    make docs
-
-Documentation comes in two formats, man pages and full HTML
-documentation. Documentation is built into distribution's
-docs/dist directory. man pages are in docs/dist/man and
-HTML documentation in docs/dist/html.
-
-If you want to use man pages, run:
-
-    export MANPATH=$MANPATH:$(pwd -P)/docs/dist/man
-
-Or you can move manpages from docs/dist/man directory to some
-other directory and add it to MANPATH.
-
-Full HTML documentation can be accessed at docs/dist/html/index.html.
-
-You can also build manpages for types in your ~/.cdist directory:
-
-    make dotman
-
-Built manpages are now in docs/dist/man directory. If you have
-some other custom .cdist directory, e.g. /opt/cdist then use:
-
-    DOT_CDIST_PATH=/opt/cdist make dotman
-
-
-### Python Package
-
-Cdist is available as a python package at
-[PyPi](http://pypi.python.org/pypi/cdist/). You can install it using
-
-    pip install cdist
-
-## Use cdist
-
-[[Dig into the documentation|documentation]] to get started with cdist!
-
-[[!tag cdist unix]]
diff --git a/docs/web/cdist/os.mdwn b/docs/web/cdist/os.mdwn
deleted file mode 100644
index 3677f52c..00000000
--- a/docs/web/cdist/os.mdwn
+++ /dev/null
@@ -1,18 +0,0 @@
-[[!meta title="Supported Operating Systems"]]
-
-cdist was tested or is know to run on at least
-
- * [Archlinux](http://www.archlinux.org/)
- * [Debian](http://www.debian.org/)
- * [CentOS](http://www.centos.org/)
- * [Scientific](https://www.scientificlinux.org/)
- * [Fedora](http://fedoraproject.org/)
- * [FreeBSD](http://www.freebsd.org)
- * [Gentoo](http://www.gentoo.org/)
- * [Mac OS X](http://www.apple.com/macosx/)
- * [OpenBSD](http://www.openbsd.org)
- * [Redhat](http://www.redhat.com/)
- * [Ubuntu](http://www.ubuntu.com/)
- * [XenServer](http://www.citrix.com/xenserver/)
-
-[[!tag cdist unix]]
diff --git a/docs/web/cdist/support.mdwn b/docs/web/cdist/support.mdwn
deleted file mode 100644
index 4f92853b..00000000
--- a/docs/web/cdist/support.mdwn
+++ /dev/null
@@ -1,28 +0,0 @@
-## Support
-
-### IRC
-
-You can join the development ***IRC channel***
-[#cstar on irc.freenode.net](irc://irc.freenode.org/#cstar).
-
-### Mailing list
-
-Bug reports, questions, patches, etc. should be send to the
-[cdist mailing list](https://groups.google.com/forum/#!forum/cdist-configuration-management).
-
-### Linkedin
-
-If you have an account
-at [Linked in](http://www.linkedin.com/),
-you can join the
-[cdist group](http://www.linkedin.com/groups/cdist-configuration-management-3952797).
-
-### Chat
-Chat with us: [ungleich chat](https://chat.ungleich.ch/channel/cdist).
-
-### Commercial support
-
-You can request commercial support for cdist from
-[my company](http://www.ungleich.ch/english/).
-
-[[!tag cdist unix]]
diff --git a/docs/web/cdist/update.mdwn b/docs/web/cdist/update.mdwn
deleted file mode 100644
index df4617bb..00000000
--- a/docs/web/cdist/update.mdwn
+++ /dev/null
@@ -1,158 +0,0 @@
-[[!meta title="How to update cdist"]]
-
-## Update The Git Installation
-
-To upgrade cdist in the current branch use
-
-    git pull
-
-    # Also update the manpages
-    ./build man
-    export MANPATH=$MANPATH:$(pwd -P)/doc/man
-
-If you stay on a version branche (i.e. 1.0, 1.1., ...), nothing should break.
-The master branch on the other hand is the development branch and may not be
-working, break your setup or eat the tree in your garden.
-
-### Safely upgrading to new versions
-
-To upgrade to **any** further cdist version, you can take the
-following procedure to do a safe upgrade:
-
-    # Create new branch to try out the update
-    git checkout -b upgrade_cdist
-
-    # Get latest cdist version in git database
-    git fetch -v
-
-    # see what will happen on merge - replace
-    # master with the branch you plan to merge
-    git diff upgrade_cdist..origin/master
-
-    # Merge the new version
-    git merge origin/master
-
-Now you can ensure all custom types work with the new version.
-Assume that you need to go back to an older version during
-the migration/update, you can do so as follows:
-
-    # commit changes
-    git commit -m ...
-
-    # go back to original branch
-    git checkout master
-
-After that, you can go back and continue the upgrade:
-
-    # git checkout upgrade_cdist
-
-
-## Update The Python Package
-
-To upgrade to the lastet version do
-
-    pip install --upgrade cdist
-
-## General Update Instructions
-
-### Updating from 3.0 to 3.1
-
-The type **\_\_ssh_authorized_keys** now also manages existing keys, 
-not only the ones added by cdist.
-
-### Updating from 2.3 to 3.0
-
-The **changed** attribute of objects has been removed.
-Use [messaging](/software/cdist/man/3.0.0/man7/cdist-messaging.html) instead.
-
-### Updating from 2.2 to 2.3
-
-No incompatibilities.
-
-### Updating from 2.1 to 2.2
-
-Starting with 2.2, the syntax for requiring a singleton type changed:
-Old format:
-
-    require="__singleton_type/singleton" ...
-
-New format:
-
-    require="__singleton_type" ...
-
-Internally the "singleton" object id was dropped to make life more easy.
-You can probably fix your configuration by running the following code
-snippet (currently untested, please report back if it works for you):
-
-    find ~/.cdist/* -type f -exec sed -i 's,/singleton,,' {} \;
-
-### Updating from 2.0 to 2.1
-
-Have a look at the update guide for [[2.0 to 2.1|2.0-to-2.1]].
-
- * Type **\_\_package* and \_\_process** use --state **present** or **absent**.
-   The states **removed/installed** and **stopped/running** have been removed.
-   Support for the new states is already present in 2.0.
- * Type **\_\_directory**: Parameter --parents and --recursive are now boolean
-   The old "yes/no" values need to be removed.
- * Type **\_\_rvm_ruby**: Parameter --default is now boolean
-   The old "yes/no" values need to be removed.
- * Type **\_\_rvm_gemset**: Parameter --default is now boolean
-   The old "yes/no" values need to be removed.
- * Type **\_\_addifnosuchline** and **\_\_removeline** have been replaced by **\_\_line**
- * The **conf** directory is now located at **cdist/conf**.
-   You need to migrate your types, explorers and manifests
-   manually to the new location.
- * Replace the variable **\_\_self** by **\_\_object_name**
-   Support for the variable **\_\_object_name** is already present in 2.0.
- * The types **\_\_autofs**, **\_\_autofs_map** and **\_\_autofs_reload** have been removed
-   (no maintainer, no users)
- * Type **\_\_user**: Parameter --groups removed (use the new \_\_user_groups type)
- * Type **\_\_ssh_authorized_key** has been replaced by more flexible type 
-    **\_\_ssh_authorized_keys**
-
-### Updating from 1.7 to 2.0
-
-* Ensure python (>= 3.2) is installed on the source host
-* Use "cdist config host" instead of "cdist-deploy-to host"
-* Use "cdist config -p host1 host2" instead of "cdist-mass-deploy"
-* Use "cdist banner" for fun
-* Use **\_\_object_name** instead of **\_\_self** in manifests
-
-### Updating from 1.6 to 1.7
-
-* If you used the global explorer **hardware_type**, you need to change
-  your code to use **machine** instead.
-
-### Updating from 1.5 to 1.6
-
-* If you used **\_\_package_apt --preseed**, you need to use the new
-  type **\_\_debconf_set_selections** instead.
-* The **\_\_package** types accepted either --state deinstalled or
-  --state uninstaaled. Starting with 1.6, it was made consistently
-  to --state removed.
-
-### Updating from 1.3 to 1.5
-
-No incompatibilities.
-
-### Updating from 1.2 to 1.3
-
-Rename **gencode** of every type to **gencode-remote**.
-
-### Updating from 1.1 to 1.2
-
-No incompatibilities.
-
-### Updating from 1.0 to 1.1
-
-In 1.1 the type **\_\_file** was split into **\_\_directory**, **\_\_file** and
-**\_\_link**. The parameter **--type** was removed from **\_\_file**. Thus you
-need to replace **\_\_file** calls in your manifests:
-
- * Remove --type from all \_\_file calls
- * If type was symlink, use \_\_link and --type symbolic
- * If type was directory, use \_\_directory
-
-
-[[!tag cdist unix]]
diff --git a/docs/web/cdist/update/2.0-to-2.1.mdwn b/docs/web/cdist/update/2.0-to-2.1.mdwn
deleted file mode 100644
index 3b5f5dc4..00000000
--- a/docs/web/cdist/update/2.0-to-2.1.mdwn
+++ /dev/null
@@ -1,118 +0,0 @@
-[[!meta title="Update Guide for 2.0 to 2.1"]]
-
-## Introduction
-
-When changing your installation from 2.0 to 2.1, there are
-a lot of changes coming up. 2.1 is mainly a cleanup release,
-which removes long time deprecated behaviour, but also makes
-a lot of things more consistent and allows you to split off your types,
-explorers and manifest to custom directories.
-
-This document will guide you to a successful update.
-
-## Preparation
-
-As for every software and system you use in production, you should first of 
-all make a backup of your data. To prevent any breakage, it is
-recommended to create a new git branch to do the update on:
-
-    % git checkout -b update_to_2.1
-
-This also ensure that whenever you need to do a change in your
-2.0 based tree, you can simply go back to that branch, apply the change
-and configure your systems - independently of your update progress!
-
-Next fetch the latest upstream changes, I assume that
-origin refers to one of the upstream mirrors (change origin if you use
-another remote name for upstream cdist):
-
-    % git fetch -v origin
-
-## Merge the changes
-
-Now try to merge upstream into the new branch.
-
-    % git merge origin/2.1
-
-Fix any conflicts that may have been occurred due to local changes
-and then **git add** and *git commit** those changes. This should seldom 
-occur and if, it's mostly for people hacking on the cdist core.
-
-## Move "conf" directory
-
-One of the biggest changes in cdist 2.1 is that you can have multiple
-**conf** directories: Indeed, the new default behaviour of cdist is to
-search for conf directories
-
- * below the python module (cdist/conf in the source tree or in the installed location)
- * at ~/.cdist/ (on conf suffix there)
-
-So you can now choose, where to store your types.
-
-### Integrate your conf/ back into the tree
-
-If you choose to store your types together with the upstream types,
-you can just move all your stuff below **cdist/conf**:
-
-    % git mv conf/type/* cdist/conf/type
-    % git mv conf/manifest/* cdist/conf/manifest
-    % git mv conf/explorer/* cdist/conf/explorer
-    % git commit -m "Re-Integrate my conf directory into cdist 2.1 tree"
-
-### Move your conf/ directory to ~/.cdist
-
-If you want to store your site specific
-configuration outside of the cdist tree, you
-can move your conf/ directory to your homedirectory ($HOME) under ~/.cdist:
-
-    % mv conf ~/.cdist
-    % git rm -r conf
-    % git commit -m "Move my conf directory to ~/.cdist"
-
-It it still recommended to use a version control system like git in it:
-
-    % cd ~/.cdist
-    % git init
-    % git add .
-    % git commit -m "Create new git repository containing my cdist configuration"
-
-## Test the migration
-
-Some of the types shipped with upstream were changed, so you may want to test 
-the result by running cdist on one of your staging target hosts:
-
-    % ./bin/cdist config -v staging-host
-
-All incompatibilities are listed on the [[cdist update page|software/cdist/update]],
-so you can browse through the list and update your configuration.
-
-## Final Cleanups
-
-When everything is tested, there are some cleanups to be done to finalise the update.
-
-### When continuing to keep conf/ in the tree
-
-You can then merge back your changes into the master tree and continue to work
-as normal.
-
-### When using ~/.cdist
-
-If you decided to move your site specific code to ~/.cdist, you can now switch your
-**master** branch or version branch to upstream directly. Assumnig you are in the
-cdist directory, having your previous branch checked out, you can create a clean
-state using the following commands:
-
-    % upstream_branch=2.1
-    % current_branch=$(git rev-parse --abbrev-ref HEAD)
-    % git checkout -b archive_my_own_tree
-    % git branch -D "$current_branch"
-    % git checkout -b "$current_branch" "origin/$upstream_branch"
-
-Afther these commands, your previous main branch is accessible at
-**archive_my_own_tree** and your branch is now tracking upstream.
-
-## Questions? Critics? Hints?
-
-If you think this manual helped or misses some information, do not 
-hesitate to contact us on any of the usual ways (irc, mailinglist,
-github issue tracker, ...).
diff --git a/docs/web/cdist/why.mdwn b/docs/web/cdist/why.mdwn
deleted file mode 100644
index f571555c..00000000
--- a/docs/web/cdist/why.mdwn
+++ /dev/null
@@ -1,69 +0,0 @@
-[[!meta title="Why should I use cdist?"]]
-
-[[!toc]]
-
-There are several motivations to use cdist, these
-are probably the most popular ones.
-
-## Known language
-
-Cdist is being configured in
-[shell script](https://en.wikipedia.org/wiki/Shell_script).
-Shell script is used by UNIX system engineers for decades.
-So when cdist is introduced, your staff does not need to learn a new
-[DSL](https://en.wikipedia.org/wiki/Domain-specific_language)
-or programming language.
-
-## Powerful language
-
-Not only is shell scripting widely known by system engineers,
-but it is also a very powerful language. Here are some features
-which make daily work easy:
-
- * Configuration can react dynamicly on explored values
- * High level string manipulation (using sed, awk, grep)
- * Conditional support (**if, case**)
- * Loop support (**for, while**)
- * Support for dependencies between cdist types
-
-## More than shell scripting
-
-If you compare regular shell scripting with cdist, there is one major
-difference: When using cdist types,
-the results are 
-[idempotent](https://en.wikipedia.org/wiki/Idempotence). 
-In practise that means it does not matter in which order you 
-call cdist types, the result is always the same.
-
-## Zero dependency configuration management
-
-Cdist requires very litte on a target system. Even better,
-in almost all cases all dependencies are usually fulfilled.
-Cdist does not require an agent or a high level programming
-languages on the target host: it will run on any host that
-has a **ssh server running** and a posix compatible shell
-(**/bin/sh**). Compared to other configuration management systems,
-it does not require to open up an additional port.
-
-## Push based distribution
-
-Cdist uses the push based model for configuration. In this
-scenario, one (or more) computers connect the target hosts
-and apply the configuration. That way the source host has
-very little requirements: Cdist can even run on a sysadmin
-notebook that is loosely connected to the network and has
-limited amount of resources.
-
-Furthermore, from a security point of view, only one machine 
-needs access to the target hosts. No target hosts will ever
-need to connect back to the source host, which contains the
-full configuration.
-
-## Highly scalable
-
-If at some point you manage more hosts than can be handled from
-a single source host, you can simply add more resources: Either
-add more cores to one host or add hosts.
-Cdist will utilise the given resources in parallel.
-
-[[!tag cdist unix]]

From 2f93320627a996756a0375b2e9178f360ccea73c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 2 May 2019 19:37:01 +0200
Subject: [PATCH 022/383] Generating speeches is not part of cdist release

Speeches should be generated on demand when needed
and the cdist website should be updated.
---
 bin/build-helper         | 3 ---
 bin/build-helper.freebsd | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/bin/build-helper b/bin/build-helper
index 04b7621b..bb5956b8 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -279,9 +279,6 @@ eof
         make docs-clean
         make docs
 
-        # Generate speeches (indirect check if they build)
-        make speeches
-
         ############################################################# 
         # Everything green, let's do the release
 
diff --git a/bin/build-helper.freebsd b/bin/build-helper.freebsd
index c292280c..2a71a899 100755
--- a/bin/build-helper.freebsd
+++ b/bin/build-helper.freebsd
@@ -295,9 +295,6 @@ eof
         make helper=${helper} docs-clean
         make helper=${helper} docs
 
-        # Generate speeches (indirect check if they build)
-        make helper=${helper} speeches
-
         ############################################################# 
         # Everything green, let's do the release
 

From d242f1e7588912364c5c5dd6d1595202d24bc42f Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 May 2019 00:31:33 +0200
Subject: [PATCH 023/383] Unify build-helper scripts

---
 bin/build-helper         |  89 +++++---
 bin/build-helper.darko   |   1 +
 bin/build-helper.freebsd | 427 ---------------------------------------
 3 files changed, 63 insertions(+), 454 deletions(-)
 create mode 120000 bin/build-helper.darko
 delete mode 100755 bin/build-helper.freebsd

diff --git a/bin/build-helper b/bin/build-helper
index bb5956b8..0b2d5282 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -1,6 +1,7 @@
 #!/bin/sh
 #
 # 2011-2013 Nico Schottelius (nico-cdist at schottelius.org)
+# 2016-2019 Darko Poljak (darko.poljak at gmail.com)
 #
 # This file is part of cdist.
 #
@@ -18,10 +19,36 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 #
-# This file contains the heavy lifting found usually in the Makefile
+# This file contains the heavy lifting found usually in the Makefile.
 #
 
+# vars for make
+helper=$0
+
 basedir=${0%/*}/../
+# run_as is used to check how the script is called (by $0 value)
+# currently supported sufixes for $0 are:
+# .darko - run as darko
+basename=${0##*/}
+run_as=${basename#*.}
+
+to_a=cdist-configuration-management
+to_d=googlegroups.com
+case "$run_as" in
+    darko)
+        from_a=darko.poljak
+        from_d=gmail.com
+        ml_name="Darko Poljak"
+        ml_sig_name="Darko"
+    ;;
+    *)
+        from_a=nico.schottelius
+        from_d=ungleich.ch
+        ml_name="Nico Schottelius"
+        ml_sig_name="Nico"
+    ;;
+esac
+
 # Change to checkout directory
 cd "$basedir"
 
@@ -30,6 +57,12 @@ version=$(git describe)
 option=$1; shift
 
 case "$option" in
+    print-make-vars)
+        printf "helper: ${helper}\n"
+    ;;
+    print-runas)
+        printf "run_as: $run_as\n"
+    ;;
     changelog-changes)
         if [ "$#" -eq 1 ]; then
             start=$1
@@ -84,19 +117,14 @@ case "$option" in
 
         version=$1; shift
 
-        to_a=cdist
-        to_d=l.schottelius.org
         to=${to_a}@${to_d}
-
-        from_a=nico-cdist
-        from_d=schottelius.org
         from=${from_a}@${from_d}
 
         ( 
         cat << eof
-From: Nico -telmich- Schottelius <$from>
+From: ${ml_name} <$from>
 To: cdist mailing list <$to>
-Subject: cdist $version released
+Subject: cdist $version has been released
 
 Hello .*,
 
@@ -108,15 +136,18 @@ eof
         cat << eof
 
 Cheers,
-
-Nico
+${ml_sig_name}
 
 -- 
 Automatisation at its best level. With cdist.
 eof
-        ) | /usr/sbin/sendmail -f "$from" "$to"
-    ;;
+        ) > mailinglist.tmp
 
+        if [ "$run_as" = "build-helper" ]
+        then
+            /usr/sbin/sendmail -f "$from" "$to" < mailinglist.tmp && rm -f mailinglist.tmp
+        fi
+    ;;
 
     release-git-tag)
         target_version=$($0 changelog-version)
@@ -213,7 +244,6 @@ eof
             "https://code.ungleich.ch/api/v4/projects/${project}/repository/tags/${tag}/release" \
             || exit 1
 
-
         # remove generated files (archive and asc)
         if [ $# -eq 2 ]
         then
@@ -276,8 +306,8 @@ eof
 
         # Generate documentation (man and html)
         # First, clean old generated docs
-        make docs-clean
-        make docs
+        make helper=${helper} docs-clean
+        make helper=${helper} docs
 
         ############################################################# 
         # Everything green, let's do the release
@@ -292,16 +322,27 @@ eof
         fi
 
         # Publish git changes
-        make pub
+        if [ "$run_as" = "build-helper" ]
+        then
+            make helper=${helper} pub
+        else
+            # if we are not Nico :) then just push, no mirror
+            git push
+            # push also new branch and set up tracking
+            git push -u origin "${target_branch}"
+        fi
 
         # Ensure that pypi release has the right version
         "$0" version
 
         # Create and publish package for pypi
-        make pypi-release
+        make helper=${helper} pypi-release
 
-        # Archlinux release is based on pypi
-        make archlinux-release
+        if [ "$run_as" = "build-helper" ]
+        then
+            # Archlinux release is based on pypi
+            make helper=${helper} archlinux-release
+        fi
 
         # sign git tag
         printf "Enter upstream repository authentication token: "
@@ -309,19 +350,13 @@ eof
         "$0" sign-git-release "${target_version}" "${token}"
 
         # Announce change on ML
-        make ml-release
+        make helper=${helper} ml-release
 
         cat << eof
 Manual steps post release:
-
     - cdist-web
-    - linkedin
-    - hackernews
-    - reddit
     - twitter
-
 eof
-
     ;;
 
     test)
@@ -366,7 +401,7 @@ eof
     ;;
 
     shellcheck)
-        make shellcheck
+        make helper=${helper} shellcheck
         printf "\\nPlease review shellcheck report.\\n"
         while true
         do
diff --git a/bin/build-helper.darko b/bin/build-helper.darko
new file mode 120000
index 00000000..1f3e3384
--- /dev/null
+++ b/bin/build-helper.darko
@@ -0,0 +1 @@
+build-helper
\ No newline at end of file
diff --git a/bin/build-helper.freebsd b/bin/build-helper.freebsd
deleted file mode 100755
index 2a71a899..00000000
--- a/bin/build-helper.freebsd
+++ /dev/null
@@ -1,427 +0,0 @@
-#!/bin/sh
-#
-# 2011-2013 Nico Schottelius (nico-cdist at schottelius.org)
-# 2016 Darko Poljak (darko.poljak at gmail.com)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-# This file contains the heavy lifting found usually in the Makefile
-#
-
-# vars for make
-helper=$0
-
-basedir=${0%/*}/../
-# run_as is used to check how the script is called (by $0 value)
-# currently supported sufixes for $0 are:
-# .freebsd - run as freebsd
-basename=${0##*/}
-run_as=${basename#*.}
-
-to_a=cdist-configuration-management
-to_d=googlegroups.com
-from_a=darko.poljak
-from_d=gmail.com
-ml_name="Darko Poljak"
-ml_sig_name="Darko"
-
-# Change to checkout directory
-cd "$basedir"
-
-version=$(git describe)
-
-option=$1; shift
-
-case "$option" in
-    print-make-vars)
-        printf "helper: ${helper}\n"
-    ;;
-    print-runas)
-        printf "run_as: $run_as\n"
-    ;;
-    changelog-changes)
-        if [ "$#" -eq 1 ]; then
-            start=$1
-        else
-            start="[[:digit:]]"
-        fi
-
-        end="[[:digit:]]"
-
-        awk -F: "BEGIN { start=0 }
-            {
-                if(start == 0) {
-                    if (\$0 ~ /^$start/) {
-                        start = 1
-                    }
-                } else {
-                    if (\$0 ~ /^$end/) {
-                        exit
-                    } else {
-                        print \$0 
-                    }
-                }
-            }" "$basedir/docs/changelog"
-    ;;
-
-    changelog-version)
-        # get version from changelog
-        grep '^[[:digit:]]' "$basedir/docs/changelog" | head -n1 | sed 's/:.*//'
-    ;;
-
-    check-date)
-        # verify date in changelog is today
-        date_today="$(date +%Y-%m-%d)"
-        date_changelog=$(grep '^[[:digit:]]' "$basedir/docs/changelog" | head -n1 | sed 's/.*: //')
-
-        if [ "$date_today" != "$date_changelog" ]; then
-            echo "Date in changelog is not today"
-            echo "Changelog: $date_changelog"
-            exit 1
-        fi
-    ;;
-
-    check-unittest)
-        "$0" test
-    ;;
-
-    ml-release)
-        if [ $# -ne 1 ]; then
-            echo "$0 ml-release version" >&2
-            exit 1
-        fi
-
-        version=$1; shift
-
-        to=${to_a}@${to_d}
-        from=${from_a}@${from_d}
-
-        ( 
-        cat << eof
-From: ${ml_name} <$from>
-To: cdist mailing list <$to>
-Subject: cdist $version has been released
-
-Hello .*,
-
-cdist $version has been released with the following changes:
-
-eof
-
-        "$0" changelog-changes "$version"
-        cat << eof
-
-Cheers,
-
-${ml_sig_name}
-
--- 
-Automatisation at its best level. With cdist.
-eof
-        ) > mailinglist.tmp
-    ;;
-
-    release-git-tag)
-        target_version=$($0 changelog-version)
-        if git rev-parse --verify refs/tags/$target_version 2>/dev/null; then
-            echo "Tag for $target_version exists, aborting"
-            exit 1
-        fi
-        printf "Enter tag description for ${target_version}: "
-        read tagmessage
-
-        # setup for signed tags:
-        # gpg --fulL-gen-key
-        # gpg --list-secret-keys --keyid-format LONG
-        # git config --local user.signingkey <id>
-        # for exporting pub key:
-        #     gpg --armor --export <id> > pubkey.asc
-        #     gpg --output pubkey.gpg --export <id>
-        # show tag with signature
-        # git show <tag>
-        # verify tag signature
-        # git tag -v <tag>
-        #
-        # gpg verify signature
-        # gpg --verify <asc-file> <file>
-        # gpg --no-default-keyring --keyring <pubkey.gpg> --verify <asc-file> <file>
-        # Ensure gpg-agent is running.
-        export GPG_TTY=$(tty)
-        gpg-agent
-
-        git tag -s "$target_version" -m "$tagmessage"
-        git push --tags
-    ;;
-
-    sign-git-release)
-        if [ $# -lt 2 ]
-        then
-            printf "usage: $0 sign-git-release TAG TOKEN [ARCHIVE]\n"
-            printf "    if ARCHIVE is not specified then it is created\n"
-            exit 1
-        fi
-        tag="$1"
-        if ! git rev-parse -q --verify "${tag}" >/dev/null 2>&1
-        then
-            printf "Tag \"${tag}\" not found.\n"
-            exit 1
-        fi
-        token="$2"
-        if [ $# -gt 2 ]
-        then
-            archivename="$3"
-        else
-            archivename="cdist-${tag}.tar"
-            git archive --prefix="cdist-${tag}/" -o "${archivename}" "${tag}" \
-                || exit 1
-            # make sure target version is generated
-            "$0" target-version
-            tar -x -f "${archivename}" || exit 1
-            cp cdist/version.py "cdist-${tag}/cdist/version.py" || exit 1
-            tar -c -f "${archivename}" "cdist-${tag}/" || exit 1
-            rm -r -f "cdist-${tag}/"
-            gzip "${archivename}" || exit 1
-            archivename="${archivename}.gz"
-        fi
-        gpg --armor --detach-sign "${archivename}" || exit 1
-
-        project="ungleich-public%2Fcdist"
-        sed_cmd='s/^.*"markdown":"\([^"]*\)".*$/\1/'
-
-        # upload archive
-        response_archive=$(curl -f -X POST \
-             --http1.1 \
-             -H "PRIVATE-TOKEN: ${token}" \
-             -F "file=@${archivename}" \
-             "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
-             | sed "${sed_cmd}") || exit 1
-
-        # upload archive signature
-        response_archive_sig=$(curl -f -X POST \
-             --http1.1 \
-             -H "PRIVATE-TOKEN: ${token}" \
-             -F "file=@${archivename}.asc" \
-            "https://code.ungleich.ch/api/v4/projects/${project}/uploads" \
-             | sed "${sed_cmd}") || exit 1
-
-        # make release
-        changelog=$("$0" changelog-changes "$1" | sed 's/^[[:space:]]*//')
-        release_notes=$(
-            printf "Release %s\n\n%s\n\n%s\n\n**Changelog**\n\n%s\n" \
-                "${tag}" "${response_archive}" "${response_archive_sig}" "${changelog}"
-        )
-        curl -f -X POST \
-             -H "PRIVATE-TOKEN: ${token}" \
-             -F "description=${release_notes}" \
-            "https://code.ungleich.ch/api/v4/projects/${project}/repository/tags/${tag}/release" \
-            || exit 1
-
-        # remove generated files (archive and asc)
-        if [ $# -eq 2 ]
-        then
-            rm -f "${archivename}"
-        fi
-        rm -f "${archivename}.asc"
-    ;;
-
-    release)
-        set -e
-        target_version=$($0 changelog-version)
-        target_branch=$($0 version-branch)
-
-        echo "Beginning release process for $target_version"
-
-        # First check everything is sane
-        "$0" check-date
-        "$0" check-unittest
-        "$0" check-pycodestyle
-        "$0" shellcheck
-
-        # Generate version file to be included in packaging
-        "$0" target-version
-
-        # Ensure the git status is clean, else abort
-        if ! git diff-index --name-only --exit-code HEAD ; then
-            echo "Unclean tree, see files above, aborting"
-            exit 1
-        fi
-
-        # Ensure we are on the master branch
-        masterbranch=yes
-        if [ "$(git rev-parse --abbrev-ref HEAD)" != "master" ]; then
-            echo "Releases are happening from the master branch, aborting"
-
-            echo "Enter the magic word to release anyway"
-            read magicword
-
-            if [ "$magicword" = "iknowwhatido" ]; then
-                masterbranch=no
-            else
-                exit 1
-            fi
-        fi
-
-        if [ "$masterbranch" = yes ]; then
-            # Ensure version branch exists
-            if ! git rev-parse --verify refs/heads/$target_branch 2>/dev/null; then
-                git branch "$target_branch"
-            fi
-
-            # Merge master branch into version branch
-            git checkout "$target_branch"
-            git merge master
-        fi
-
-        # Verify that after the merge everything works
-        "$0" check-date
-        "$0" check-unittest
-
-        # Generate documentation (man and html)
-        # First, clean old generated docs
-        make helper=${helper} docs-clean
-        make helper=${helper} docs
-
-        ############################################################# 
-        # Everything green, let's do the release
-
-        # Tag the current commit
-        "$0" release-git-tag
-
-        # Also merge back the version branch
-        if [ "$masterbranch" = yes ]; then
-            git checkout master
-            git merge "$target_branch"
-        fi
-
-        # Publish git changes
-        case "$run_as" in
-            freebsd)
-                # if we are not Nico :) then just push, no mirror
-                git push
-                # push also new branch and set up tracking
-                git push -u origin "${target_branch}"
-            ;;
-            *)
-                make helper=${helper} pub
-            ;;
-        esac
-
-        # Ensure that pypi release has the right version
-        "$0" version
-
-        # Create and publish package for pypi
-        make helper=${helper} pypi-release
-
-        # sign git tag
-        printf "Enter upstream repository authentication token: "
-        read token
-        "$0" sign-git-release "${target_version}" "${token}"
-
-        # Announce change on ML
-        make helper=${helper} ml-release
-
-        cat << eof
-Manual steps post release:
-
-    - cdist-web
-    - twitter
-
-eof
-    ;;
-
-    test)
-        export PYTHONPATH="$(pwd -P)"
-
-        if [ $# -lt 1 ]; then
-            python3 -m cdist.test
-        else
-            python3 -m unittest "$@"
-        fi
-    ;;
-
-    test-remote)
-        export PYTHONPATH="$(pwd -P)"
-        python3 -m cdist.test.exec.remote
-    ;;
-
-    pycodestyle|pep8)
-        pycodestyle "${basedir}" "${basedir}/scripts/cdist" | less
-    ;;
-
-    check-pycodestyle)
-        "$0" pycodestyle
-        printf "\\nPlease review pycodestyle report.\\n"
-        while true
-        do
-            echo "Continue (yes/no)?"
-            any=
-            read any
-            case "$any" in
-                yes)
-                    break
-                ;;
-                no)
-                    exit 1
-                ;;
-                *)
-                    echo "Please answer with 'yes' or 'no' explicitly."
-                ;;
-        esac
-        done
-    ;;
-
-    shellcheck)
-        make helper=${helper} shellcheck
-        printf "\\nPlease review shellcheck report.\\n"
-        while true
-        do
-            echo "Continue (yes/no)?"
-            any=
-            read any
-            case "$any" in
-                yes)
-                    break
-                ;;
-                no)
-                    exit 1
-                ;;
-                *)
-                    echo "Please answer with 'yes' or 'no' explicitly."
-                ;;
-        esac
-        done
-    ;;
-
-    version-branch)
-        "$0" changelog-version | cut -d. -f '1,2'
-    ;;
-
-    version)
-        echo "VERSION = \"$(git describe)\"" > cdist/version.py
-    ;;
-
-    target-version)
-        target_version=$($0 changelog-version)
-        echo "VERSION = \"${target_version}\"" > cdist/version.py
-    ;;
-
-    *)
-        echo "Unknown helper target $@ - aborting"
-        exit 1
-    ;;
-
-esac

From 513fde1cc1fcc612514cefaf18fd0822095c92e9 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 May 2019 10:51:10 +0200
Subject: [PATCH 024/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index d367ed47..2e1df3d5 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -10,6 +10,9 @@ next:
 	* Build: Update due to migration to code.ungleich.ch (Darko Poljak)
 	* Documentation: Update due to migration to code.ungleich.ch (Darko Poljak)
 	* Core: Detect and report dependency cycle as soon as possible (Darko Poljak)
+	* Core, documentation: Release -j/--jobs option, i.e. make it non-beta (Darko Poljak)
+	* Documentation: Update due to new cdist website (Darko Poljak)
+	* Build: Update due to new cdist website (Darko Poljak)
 
 4.11.1: 2019-04-22
 	* Core: Improve explorer error reporting (Darko Poljak)

From 10a29ca9e6173b5843aab6b45143b4f7c343d401 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 5 May 2019 00:02:51 +0200
Subject: [PATCH 025/383] Fix pycodestyle issue

---
 cdist/config.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/config.py b/cdist/config.py
index 4e226b3a..bc05a28c 100644
--- a/cdist/config.py
+++ b/cdist/config.py
@@ -48,7 +48,7 @@ def graph_check_cycle(graph):
     for node in graph:
         # Cycle path.
         path = [node]
-        has_cycle = _graph_dfs_cycle( graph, node, path)
+        has_cycle = _graph_dfs_cycle(graph, node, path)
         if has_cycle:
             return has_cycle, path
     return False, None

From aad6c341780669c0c6ce26aae99259669f9f839b Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 May 2019 23:30:50 +0200
Subject: [PATCH 026/383] Release 5.0.0

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 2e1df3d5..d6251523 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+5.0.0: 2019-05-05
 	* Type __zypper_service: Fix spelling error in manpage (Dmitry Bogatov)
 	* Explorer init: Add support for OpenBSD (sideeffect42)
 	* Type __postgres_database: Run psql with -w (no-password) (sideeffect42)

From 4d75a05e3595e2bcfa96c461d8025cc92babf7f3 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 5 May 2019 10:31:23 +0200
Subject: [PATCH 027/383] Rm redundant tag description from rel notes

---
 bin/build-helper | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bin/build-helper b/bin/build-helper
index 0b2d5282..009e96ff 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -235,8 +235,8 @@ eof
         # make release
         changelog=$("$0" changelog-changes "$1" | sed 's/^[[:space:]]*//')
         release_notes=$(
-            printf "Release %s\n\n%s\n\n%s\n\n**Changelog**\n\n%s\n" \
-                "${tag}" "${response_archive}" "${response_archive_sig}" "${changelog}"
+            printf "%s\n\n%s\n\n**Changelog**\n\n%s\n" \
+                "${response_archive}" "${response_archive_sig}" "${changelog}"
         )
         curl -f -X POST \
              -H "PRIVATE-TOKEN: ${token}" \

From 735f57b3a032fad842c9d4306080b5d7a4c53a38 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 5 May 2019 17:55:02 +0200
Subject: [PATCH 028/383] Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section

---
 docs/src/cdist-best-practice.rst | 92 ++++++++++++++++++++++++++++++++
 1 file changed, 92 insertions(+)

diff --git a/docs/src/cdist-best-practice.rst b/docs/src/cdist-best-practice.rst
index a99ba88e..7a1255d6 100644
--- a/docs/src/cdist-best-practice.rst
+++ b/docs/src/cdist-best-practice.rst
@@ -224,3 +224,95 @@ in the repository for such content: It allows you to
 easily distinguish what is used by cdist and what is not
 and also to store all important files in one
 repository.
+
+
+Perils of CDIST_ORDER_DEPENDENCY
+--------------------------------
+With CDIST_ORDER_DEPENDENCY all types are executed in the order in which they
+are created in the manifest. The current created object automatically depends
+on the previously created object.
+
+It essentially helps you to build up blocks of code that build upon each other
+(like first creating the directory xyz than the file below the directory).
+
+This can be helpful, but it can also be the source of *evil*.
+
+Let's see an example. Suppose you have special init manifest where among other
+things you are assuring that remote host has packages `sudo` and `curl`
+installed.
+
+**init1**
+
+.. code-block:: sh
+
+   CDIST_ORDER_DEPENDENCY=1
+   export CDIST_ORDER_DEPENDENCY
+
+   for p in sudo curl
+   do
+      __package "${p}"
+   done
+
+Then you have some other special init manifest where among other things you are
+assuring `sudo` package is installed.
+
+**init2**
+
+.. code-block:: sh
+
+   CDIST_ORDER_DEPENDENCY=1
+   export CDIST_ORDER_DEPENDENCY
+
+   __package sudo
+
+Then you have third init manifest where you combine those two init manifests,
+by including them:
+
+**init**
+
+.. code-block:: sh
+
+   sh -e "$__manifest/init1"
+   sh -e "$__manifest/init2"
+
+The resulting init manifest is then equal to:
+
+.. code-block:: sh
+
+   CDIST_ORDER_DEPENDENCY=1
+   export CDIST_ORDER_DEPENDENCY
+
+   for p in sudo curl
+   do
+      __package "${p}"
+   done
+
+   CDIST_ORDER_DEPENDENCY=1
+   export CDIST_ORDER_DEPENDENCY
+
+   __package sudo
+
+In the end you get the following dependencies:
+
+* `__package/curl` depends on `__package/sudo`
+* `__package/sudo` depends on `__package/curl`
+
+And here you have a circular dependency!
+
+In the real world manifest can be quite complex, dependencies can become
+complicated and circual dependencies are not so obvious. Resolving it can
+become cumbersome.
+
+**Practical solution?**
+
+Instead of managing complex init manifests you can write custom types.
+Each custom type can do one thing, it has well defined dependencies that will
+not leak into init manifest. In custom type you can also add special explorers
+and gencode.
+
+Then, in init manifest you combine your complex types. It is:  
+
+* cleaner
+* easier to follow
+* easier to maintain
+* easier to debug.

From 28082c710aa02a1861a4396513469ecfa7ef2d4f Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 6 May 2019 11:11:10 +0200
Subject: [PATCH 029/383] Add refs to perils of CDIST_ORDER_DEPENDENCY

---
 docs/src/cdist-manifest.rst     | 2 ++
 docs/src/cdist-reference.rst.sh | 1 +
 2 files changed, 3 insertions(+)

diff --git a/docs/src/cdist-manifest.rst b/docs/src/cdist-manifest.rst
index 0e266943..4dd3e74b 100644
--- a/docs/src/cdist-manifest.rst
+++ b/docs/src/cdist-manifest.rst
@@ -163,6 +163,8 @@ automatically depends on the previously created object.
 It essentially helps you to build up blocks of code that build upon each other
 (like first creating the directory xyz than the file below the directory).
 
+Read also about `perils of CDIST_ORDER_DEPENDENCY <cdist-best-practice.html#perils-of-cdist-order-dependency>`_.
+
 
 Overrides
 ---------
diff --git a/docs/src/cdist-reference.rst.sh b/docs/src/cdist-reference.rst.sh
index 59ce018b..2c9c7b40 100755
--- a/docs/src/cdist-reference.rst.sh
+++ b/docs/src/cdist-reference.rst.sh
@@ -323,6 +323,7 @@ CDIST_OVERRIDE
 
 CDIST_ORDER_DEPENDENCY
     Create dependencies based on the execution order (see  \`cdist manifest <cdist-manifest.html>\`_).
+    Read also about \`perils of CDIST_ORDER_DEPENDENCY <cdist-best-practice.html#perils-of-cdist-order-dependency>\`_.
 
 CDIST_REMOTE_EXEC
     Use this command for remote execution (should behave like ssh).

From 02eb6c75a7979eb2fa1ec2b4921ab9fafe582edd Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 6 May 2019 17:11:23 +0200
Subject: [PATCH 030/383] Add 'CDIST_ORDER_DEPENDENCY kills parallelization'

---
 docs/src/cdist-best-practice.rst | 45 ++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/docs/src/cdist-best-practice.rst b/docs/src/cdist-best-practice.rst
index 7a1255d6..a91f2cc0 100644
--- a/docs/src/cdist-best-practice.rst
+++ b/docs/src/cdist-best-practice.rst
@@ -237,6 +237,10 @@ It essentially helps you to build up blocks of code that build upon each other
 
 This can be helpful, but it can also be the source of *evil*.
 
+
+CDIST_ORDER_DEPENDENCY easily causes unobvious dependency cycles
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
 Let's see an example. Suppose you have special init manifest where among other
 things you are assuring that remote host has packages `sudo` and `curl`
 installed.
@@ -316,3 +320,44 @@ Then, in init manifest you combine your complex types. It is:
 * easier to follow
 * easier to maintain
 * easier to debug.
+
+
+CDIST_ORDER_DEPENDENCY kills parallelization
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Suppose you have defined CDIST_ORDER_DEPENDENCY and then, among other things,
+you specify creation of three, by nature independent, files.
+
+**init**
+
+.. code-block:: sh
+
+   CDIST_ORDER_DEPENDENCY=1
+   export CDIST_ORDER_DEPENDENCY
+
+   ...
+   __file /tmp/file1
+   __file /tmp/file2
+   __file /tmp/file3
+   ...
+
+Due to defined CDIST_ORDER_DEPENDENCY cdist will execute them in specified order.
+It is better to use CDIST_ORDER_DEPENDENCY in well defined blocks:
+
+**init**
+
+.. code-block:: sh
+
+   CDIST_ORDER_DEPENDENCY=1
+   export CDIST_ORDER_DEPENDENCY
+   ...
+   unset CDIST_ORDER_DEPENDENCY
+
+   __file /tmp/file1
+   __file /tmp/file2
+   __file /tmp/file3
+
+   CDIST_ORDER_DEPENDENCY=1
+   export CDIST_ORDER_DEPENDENCY
+   ...
+   unset CDIST_ORDER_DEPENDENCY

From d696a55879b74eac091e338c95dbe5b144c8054c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 6 May 2019 17:13:36 +0200
Subject: [PATCH 031/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index d6251523..40cb1f83 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Documentation: Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section (Darko Poljak)
+
 5.0.0: 2019-05-05
 	* Type __zypper_service: Fix spelling error in manpage (Dmitry Bogatov)
 	* Explorer init: Add support for OpenBSD (sideeffect42)

From 4f40c6ac656413cb6664809c299e1021430d13d0 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 7 May 2019 18:16:54 +0200
Subject: [PATCH 032/383] Re-arrange Makefile and build-helper script

Maintainers should use build-helper script.
End users should use Makefile, which contains targets
that can be run on pure source (without git repository).
---
 .gitattributes             |   2 +
 Makefile                   | 158 ++++---------------
 README-maintainers         |   4 +
 bin/build-helper           | 311 +++++++++++++++++++++++++++++--------
 bin/build-helper.darko     |   1 -
 docs/changelog             |   1 +
 docs/src/cdist-install.rst |  19 ++-
 7 files changed, 296 insertions(+), 200 deletions(-)
 create mode 100644 README-maintainers
 delete mode 120000 bin/build-helper.darko

diff --git a/.gitattributes b/.gitattributes
index aeaab8b9..45c10d7b 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,3 +4,5 @@
 docs/speeches export-ignore
 docs/video export-ignore
 docs/src/man7 export-ignore
+bin/build-helper export-ignore
+README-maintainers export-ignore
diff --git a/Makefile b/Makefile
index 099812e2..b739ab1f 100644
--- a/Makefile
+++ b/Makefile
@@ -18,25 +18,27 @@
 #
 #
 
-helper=./bin/build-helper
+.PHONY: help
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "man             build only man user documentation"
+	@echo "html            build only html user documentation"
+	@echo "docs            build both man and html user documentation"
+	@echo "dotman          build man pages for types in your ~/.cdist directory"
+	@echo "speeches        build speeches pdf files"
+	@echo "install         install in the system site-packages directory"
+	@echo "install-user    install in the user site-packages directory"
+	@echo "docs-clean      clean documentation"
+	@echo "clean           clean"
 
 DOCS_SRC_DIR=docs/src
 SPEECHDIR=docs/speeches
 TYPEDIR=cdist/conf/type
 
-CHANGELOG_VERSION=$(shell $(helper) changelog-version)
-CHANGELOG_FILE=docs/changelog
-
-PYTHON_VERSION=cdist/version.py
-
 SPHINXM=make -C $(DOCS_SRC_DIR) man
 SPHINXH=make -C $(DOCS_SRC_DIR) html
 SPHINXC=make -C $(DOCS_SRC_DIR) clean
 
-SHELLCHECKCMD=shellcheck -s sh -f gcc -x
-# Skip SC2154 for variables starting with __ since such variables are cdist
-# environment variables.
-SHELLCHECK_SKIP=grep -v ': __.*is referenced but not assigned.*\[SC2154\]'
 ################################################################################
 # Manpages
 #
@@ -61,11 +63,16 @@ DOCSREFSH=$(DOCS_SRC_DIR)/cdist-reference.rst.sh
 $(DOCSREF): $(DOCSREFSH)
 	$(DOCSREFSH)
 
+version:
+	@[ -f "cdist/version.py" ] || { \
+		printf "Missing 'cdist/version.py', please generate it first.\n" && exit 1; \
+	}
+
 # Manpages #3: generic part
-man: $(MANTYPES) $(DOCSREF) $(PYTHON_VERSION)
+man: version $(MANTYPES) $(DOCSREF)
 	$(SPHINXM)
 
-html: $(MANTYPES) $(DOCSREF) $(PYTHON_VERSION)
+html: version $(MANTYPES) $(DOCSREF)
 	$(SPHINXH)
 
 docs: man html
@@ -85,7 +92,7 @@ DOTMANTYPES=$(subst /man.rst,.rst,$(DOTMANTYPEPREFIX))
 $(DOTMAN7DSTDIR)/cdist-type%.rst: $(DOTTYPEDIR)/%/man.rst
 	ln -sf "$^" $@
 
-dotman: $(DOTMANTYPES)
+dotman: version $(DOTMANTYPES)
 	$(SPHINXM)
 
 ################################################################################
@@ -103,132 +110,25 @@ $(SPEECHDIR)/%.pdf: $(SPEECHDIR)/%.tex
 speeches: $(SPEECHES)
 
 ################################################################################
-# Release: Mailinglist
+# Misc
 #
-ML_FILE=.lock-ml
-
-# Only send mail once - lock until new changelog things happened
-$(ML_FILE): $(CHANGELOG_FILE)
-	$(helper) ml-release $(CHANGELOG_VERSION)
-	touch $@
-
-ml-release: $(ML_FILE)
-
-
-################################################################################
-# pypi
-#
-PYPI_FILE=.pypi-release
-$(PYPI_FILE): man $(PYTHON_VERSION)
-	python3 setup.py sdist upload
-	touch $@
-
-pypi-release: $(PYPI_FILE)
-################################################################################
-# archlinux
-#
-ARCHLINUX_FILE=.lock-archlinux
-ARCHLINUXTAR=cdist-$(CHANGELOG_VERSION)-1.src.tar.gz
-
-$(ARCHLINUXTAR): PKGBUILD
-	umask 022; mkaurball
-
-PKGBUILD: PKGBUILD.in $(PYTHON_VERSION)
-	./PKGBUILD.in $(CHANGELOG_VERSION)
-
-$(ARCHLINUX_FILE): $(ARCHLINUXTAR) $(PYTHON_VERSION)
-	burp -c system $(ARCHLINUXTAR)
-	touch $@
-
-archlinux-release: $(ARCHLINUX_FILE)
-
-################################################################################
-# Release
-#
-
-$(PYTHON_VERSION) version: .git/refs/heads/master
-	$(helper) version
-
-# Code that is better handled in a shell script
-check-%:
-	$(helper) $@
-
-release:
-	$(helper) $@
-
-################################################################################
-# Cleanup
-#
-
-clean:
+clean: docs-clean
 	rm -f $(DOCS_SRC_DIR)/cdist-reference.rst
 
 	find "$(DOCS_SRC_DIR)" -mindepth 2 -type l \
 	| xargs rm -f
 
-	make -C $(DOCS_SRC_DIR) clean
-
 	find * -name __pycache__  | xargs rm -rf
 
-	# Archlinux
-	rm -f cdist-*.pkg.tar.xz cdist-*.tar.gz
-	rm -rf pkg/ src/
-
-	rm -f MANIFEST PKGBUILD
-	rm -rf dist/
-
-	# Signed release
-	rm -f cdist-*.tar.gz
-	rm -f cdist-*.tar.gz.asc
-
-	# Temp files
-	rm -f *.tmp
-
-distclean: clean
-	rm -f cdist/version.py
+	# distutils
+	rm -rf ./build
 
 ################################################################################
-# Misc
+# install
 #
 
-# The pub is Nico's "push to all git remotes" way ("make pub")
-pub:
-	git push --mirror
+install:
+	python3 setup.py install
 
-test:
-	$(helper) $@
-
-test-remote:
-	$(helper) $@
-
-pycodestyle pep8:
-	$(helper) $@
-
-shellcheck-global-explorers:
-	@find cdist/conf/explorer -type f -exec $(SHELLCHECKCMD) {} + | $(SHELLCHECK_SKIP) || exit 0
-
-shellcheck-type-explorers:
-	@find cdist/conf/type -type f -path "*/explorer/*" -exec $(SHELLCHECKCMD) {} + | $(SHELLCHECK_SKIP) || exit 0
-
-shellcheck-manifests:
-	@find cdist/conf/type -type f -name manifest -exec $(SHELLCHECKCMD) {} + | $(SHELLCHECK_SKIP) || exit 0
-
-shellcheck-local-gencodes:
-	@find cdist/conf/type -type f -name gencode-local -exec $(SHELLCHECKCMD) {} + | $(SHELLCHECK_SKIP) || exit 0
-
-shellcheck-remote-gencodes:
-	@find cdist/conf/type -type f -name gencode-remote -exec $(SHELLCHECKCMD) {} + | $(SHELLCHECK_SKIP) || exit 0
-
-shellcheck-scripts:
-	@$(SHELLCHECKCMD) scripts/cdist-dump || exit 0
-
-shellcheck-gencodes: shellcheck-local-gencodes shellcheck-remote-gencodes
-
-shellcheck-types: shellcheck-type-explorers shellcheck-manifests shellcheck-gencodes
-
-shellcheck: shellcheck-global-explorers shellcheck-types shellcheck-scripts
-
-shellcheck-type-files:
-	@find cdist/conf/type -type f -path "*/files/*" -exec $(SHELLCHECKCMD) {} + | $(SHELLCHECK_SKIP) || exit 0
-
-shellcheck-with-files: shellcheck shellcheck-type-files
+install-user:
+	python3 setup.py install --user
diff --git a/README-maintainers b/README-maintainers
new file mode 100644
index 00000000..af57f475
--- /dev/null
+++ b/README-maintainers
@@ -0,0 +1,4 @@
+Maintainers should use ./bin/build-helper script.
+
+Makefile is intended for end users. It can be used for non-maintaining
+targets that can be run from pure source (without git repository).
diff --git a/bin/build-helper b/bin/build-helper
index 009e96ff..bba44ded 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -22,47 +22,101 @@
 # This file contains the heavy lifting found usually in the Makefile.
 #
 
-# vars for make
-helper=$0
+usage() {
+    printf "usage: %s TARGET [RUN-AS]
+    Available targets:
+        print-runas
+        changelog-changes
+        changelog-version
+        check-date
+        check-unittest
+        ml-release
+        archlinux-release
+        pypi-release
+        release-git-tag
+        sign-git-release
+        release
+        test
+        test-remote
+        pycodestyle
+        pep8
+        check-pycodestyle
+        shellcheck-global-explorers
+        shellcheck-type-explorers
+        shellcheck-manifests
+        shellcheck-local-gencodes
+        shellcheck-remote-gencodes
+        shellcheck-scripts
+        shellcheck-gencodes
+        shellcheck-types
+        shellcheck
+        shellcheck-type-files
+        shellcheck-with-files
+        shellcheck-build-helper
+        check-shellcheck
+        version-branch
+        version
+        target-version
+        clean
+        distclean
+    Run as:
+        nico
+        darko - default, if not specified\n" "$1"
+}
 
-basedir=${0%/*}/../
-# run_as is used to check how the script is called (by $0 value)
-# currently supported sufixes for $0 are:
-# .darko - run as darko
-basename=${0##*/}
-run_as=${basename#*.}
+basename="${0##*/}"
+
+if [ $# -lt 1 ]
+then
+    usage "${basename}"
+    exit 1
+fi
+
+option=$1; shift
+if [ $# -ge 1 ]
+then
+    run_as="$1"
+else
+    run_as="darko"
+fi
 
-to_a=cdist-configuration-management
-to_d=googlegroups.com
 case "$run_as" in
-    darko)
+    nico)
+        from_a=nico.schottelius
+        from_d=ungleich.ch
+        ml_name="Nico Schottelius"
+        ml_sig_name="Nico"
+    ;;
+    darko|'')
         from_a=darko.poljak
         from_d=gmail.com
         ml_name="Darko Poljak"
         ml_sig_name="Darko"
     ;;
     *)
-        from_a=nico.schottelius
-        from_d=ungleich.ch
-        ml_name="Nico Schottelius"
-        ml_sig_name="Nico"
+        printf "Unsupported RUN-AS value: '%s'.\n" "${run_as}" >&2
+        usage "${basename}"
+        exit 1
     ;;
 esac
 
+SHELLCHECKCMD="shellcheck -s sh -f gcc -x"
+# Skip SC2154 for variables starting with __ since such variables are cdist
+# environment variables.
+SHELLCHECK_SKIP=': __.*is referenced but not assigned.*\[SC2154\]'
+
+to_a="cdist-configuration-management"
+to_d="googlegroups.com"
+
 # Change to checkout directory
+basedir="${0%/*}/../"
 cd "$basedir"
 
-version=$(git describe)
-
-option=$1; shift
-
 case "$option" in
-    print-make-vars)
-        printf "helper: ${helper}\n"
-    ;;
     print-runas)
-        printf "run_as: $run_as\n"
+        printf "run_as: '%s'\n" "$run_as"
     ;;
+
     changelog-changes)
         if [ "$#" -eq 1 ]; then
             start=$1
@@ -99,8 +153,8 @@ case "$option" in
         date_changelog=$(grep '^[[:digit:]]' "$basedir/docs/changelog" | head -n1 | sed 's/.*: //')
 
         if [ "$date_today" != "$date_changelog" ]; then
-            echo "Date in changelog is not today"
-            echo "Changelog: $date_changelog"
+            printf "Date in changelog is not today\n"
+            printf "Changelog date: %s\n" "${date_changelog}"
             exit 1
         fi
     ;;
@@ -111,10 +165,15 @@ case "$option" in
 
     ml-release)
         if [ $# -ne 1 ]; then
-            echo "$0 ml-release version" >&2
+            printf "%s ml-release version\n" "$0" >&2
             exit 1
         fi
 
+        # Send mail only once - lock until new changelog things happened.
+        [ ! -f .lock-ml ] && touch .lock-ml
+        x=$(find 'docs' -name changelog -type f -newer .lock-ml)
+        [ -z "${x}" ] && exit 0
+
         version=$1; shift
 
         to=${to_a}@${to_d}
@@ -143,20 +202,45 @@ Automatisation at its best level. With cdist.
 eof
         ) > mailinglist.tmp
 
-        if [ "$run_as" = "build-helper" ]
+        if [ "$run_as" = "nico" ]
         then
             /usr/sbin/sendmail -f "$from" "$to" < mailinglist.tmp && rm -f mailinglist.tmp
         fi
+
+        touch .lock-ml
+    ;;
+
+    archlinux-release)
+        if [ $# -ne 1 ]; then
+            printf "%s archlinux-release version\n" "$0" >&2
+            exit 1
+        fi
+        version=$1; shift
+
+        ARCHLINUXTAR="cdist-${version}-1.src.tar.gz"
+        ./PKGBUILD.in "${version}"
+        umask 022
+        mkaurball
+        burp -c system "${ARCHLINUXTAR}"
+    ;;
+
+    pypi-release)
+        # Ensure that pypi release has the right version
+        "$0" version
+
+        make docs-clean
+        make docs
+        python3 setup.py sdist upload
     ;;
 
     release-git-tag)
         target_version=$($0 changelog-version)
-        if git rev-parse --verify refs/tags/$target_version 2>/dev/null; then
-            echo "Tag for $target_version exists, aborting"
+        if git rev-parse --verify "refs/tags/${target_version}" 2>/dev/null; then
+            printf "Tag for %s exists, aborting\n" "${target_version}"
             exit 1
         fi
-        printf "Enter tag description for ${target_version}: "
-        read tagmessage
+        printf "Enter tag description for %s: " "${target_version}"
+        read -r tagmessage
 
         # setup for signed tags:
         # gpg --fulL-gen-key
@@ -174,7 +258,8 @@ eof
         # gpg --verify <asc-file> <file>
         # gpg --no-default-keyring --keyring <pubkey.gpg> --verify <asc-file> <file>
         # Ensure gpg-agent is running.
-        export GPG_TTY=$(tty)
+        GPG_TTY=$(tty)
+        export GPG_TTY
         gpg-agent
 
         git tag -s "$target_version" -m "$tagmessage"
@@ -184,14 +269,14 @@ eof
     sign-git-release)
         if [ $# -lt 2 ]
         then
-            printf "usage: $0 sign-git-release TAG TOKEN [ARCHIVE]\n"
+            printf "usage: %s sign-git-release TAG TOKEN [ARCHIVE]\n" "$0"
             printf "    if ARCHIVE is not specified then it is created\n"
             exit 1
         fi
         tag="$1"
         if ! git rev-parse -q --verify "${tag}" >/dev/null 2>&1
         then
-            printf "Tag \"${tag}\" not found.\n"
+            printf "Tag \"%s\" not found.\n" "${tag}"
             exit 1
         fi
         token="$2"
@@ -257,30 +342,30 @@ eof
         target_version=$($0 changelog-version)
         target_branch=$($0 version-branch)
 
-        echo "Beginning release process for $target_version"
+        printf "Beginning release process for %s\n" "${target_version}"
 
         # First check everything is sane
         "$0" check-date
         "$0" check-unittest
         "$0" check-pycodestyle
-        "$0" shellcheck
+        "$0" check-shellcheck
 
         # Generate version file to be included in packaging
         "$0" target-version
 
         # Ensure the git status is clean, else abort
         if ! git diff-index --name-only --exit-code HEAD ; then
-            echo "Unclean tree, see files above, aborting"
+            printf "Unclean tree, see files above, aborting.\n"
             exit 1
         fi
 
         # Ensure we are on the master branch
         masterbranch=yes
         if [ "$(git rev-parse --abbrev-ref HEAD)" != "master" ]; then
-            echo "Releases are happening from the master branch, aborting"
+            printf "Releases are happening from the master branch, aborting.\n"
 
-            echo "Enter the magic word to release anyway"
-            read magicword
+            printf "Enter the magic word to release anyway:"
+            read -r magicword
 
             if [ "$magicword" = "iknowwhatido" ]; then
                 masterbranch=no
@@ -291,7 +376,7 @@ eof
 
         if [ "$masterbranch" = yes ]; then
             # Ensure version branch exists
-            if ! git rev-parse --verify refs/heads/$target_branch 2>/dev/null; then
+            if ! git rev-parse --verify "refs/heads/${target_branch}" 2>/dev/null; then
                 git branch "$target_branch"
             fi
 
@@ -306,8 +391,8 @@ eof
 
         # Generate documentation (man and html)
         # First, clean old generated docs
-        make helper=${helper} docs-clean
-        make helper=${helper} docs
+        make docs-clean
+        make docs
 
         ############################################################# 
         # Everything green, let's do the release
@@ -322,35 +407,33 @@ eof
         fi
 
         # Publish git changes
-        if [ "$run_as" = "build-helper" ]
-        then
-            make helper=${helper} pub
-        else
+        # if you want to have mirror locally then uncomment this support
+        # if [ "$run_as" = "nico" ]
+        # then
+        #     git push --mirror
+        # else
             # if we are not Nico :) then just push, no mirror
             git push
             # push also new branch and set up tracking
             git push -u origin "${target_branch}"
-        fi
-
-        # Ensure that pypi release has the right version
-        "$0" version
+        # fi
 
         # Create and publish package for pypi
-        make helper=${helper} pypi-release
+        "$0" pypi-release
 
-        if [ "$run_as" = "build-helper" ]
+        if [ "$run_as" = "nico" ]
         then
             # Archlinux release is based on pypi
-            make helper=${helper} archlinux-release
+            "$0" archlinux-release
         fi
 
         # sign git tag
         printf "Enter upstream repository authentication token: "
-        read token
+        read -r token
         "$0" sign-git-release "${target_version}" "${token}"
 
         # Announce change on ML
-        make helper=${helper} ml-release
+        "$0" ml-release "${target_version}"
 
         cat << eof
 Manual steps post release:
@@ -360,7 +443,14 @@ eof
     ;;
 
     test)
-        export PYTHONPATH="$(pwd -P)"
+        if [ ! -f "cdist/version.py" ]
+        then
+            printf "cdist/version.py is missing, generate it first.\n"
+            exit 1
+        fi
+
+        PYTHONPATH="$(pwd -P)"
+        export PYTHONPATH
 
         if [ $# -lt 1 ]; then
             python3 -m cdist.test
@@ -370,7 +460,15 @@ eof
     ;;
 
     test-remote)
-        export PYTHONPATH="$(pwd -P)"
+        if [ ! -f "cdist/version.py" ]
+        then
+            printf "cdist/version.py is missing, generate it first.\n"
+            exit 1
+        fi
+
+        PYTHONPATH="$(pwd -P)"
+        export PYTHONPATH
+
         python3 -m cdist.test.exec.remote
     ;;
 
@@ -383,9 +481,9 @@ eof
         printf "\\nPlease review pycodestyle report.\\n"
         while true
         do
-            echo "Continue (yes/no)?"
+            printf "Continue (yes/no)?\n"
             any=
-            read any
+            read -r any
             case "$any" in
                 yes)
                     break
@@ -394,20 +492,74 @@ eof
                     exit 1
                 ;;
                 *)
-                    echo "Please answer with 'yes' or 'no' explicitly."
+                    printf "Please answer with 'yes' or 'no' explicitly.\n"
                 ;;
         esac
         done
     ;;
 
+    shellcheck-global-explorers)
+        find cdist/conf/explorer -type f -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+    ;;
+
+    shellcheck-type-explorers)
+        find cdist/conf/type -type f -path "*/explorer/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+    ;;
+
+    shellcheck-manifests)
+        find cdist/conf/type -type f -name manifest -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+    ;;
+
+    shellcheck-local-gencodes)
+        find cdist/conf/type -type f -name gencode-local -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+    ;;
+
+    shellcheck-remote-gencodes)
+        find cdist/conf/type -type f -name gencode-remote -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+    ;;
+
+    shellcheck-scripts)
+        ${SHELLCHECKCMD} scripts/cdist-dump || exit 0
+    ;;
+
+    shellcheck-gencodes)
+        "$0" shellcheck-local-gencodes
+        "$0" shellcheck-remote-gencodes
+    ;;
+
+    shellcheck-types)
+        "$0" shellcheck-type-explorers
+        "$0" shellcheck-manifests
+        "$0" shellcheck-gencodes
+    ;;
+
     shellcheck)
-        make helper=${helper} shellcheck
+        "$0" shellcheck-global-explorers
+        "$0" shellcheck-types
+        "$0" shellcheck-scripts
+    ;;
+
+    shellcheck-type-files)
+        find cdist/conf/type -type f -path "*/files/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+    ;;
+
+    shellcheck-with-files)
+        "$0" shellcheck
+        "$0" shellcheck-type-files
+    ;;
+
+    shellcheck-build-helper)
+        ${SHELLCHECKCMD} ./bin/build-helper
+    ;;
+
+    check-shellcheck)
+        "$0" shellcheck
         printf "\\nPlease review shellcheck report.\\n"
         while true
         do
-            echo "Continue (yes/no)?"
+            printf "Continue (yes/no)?\n"
             any=
-            read any
+            read -r any
             case "$any" in
                 yes)
                     break
@@ -416,7 +568,7 @@ eof
                     exit 1
                 ;;
                 *)
-                    echo "Please answer with 'yes' or 'no' explicitly."
+                    printf "Please answer with 'yes' or 'no' explicitly.\n"
                 ;;
         esac
         done
@@ -427,16 +579,39 @@ eof
     ;;
 
     version)
-        echo "VERSION = \"$(git describe)\"" > cdist/version.py
+        printf "VERSION = \"%s\"\n" "$(git describe)" > cdist/version.py
     ;;
 
     target-version)
         target_version=$($0 changelog-version)
-        echo "VERSION = \"${target_version}\"" > cdist/version.py
+        printf "VERSION = \"%s\"\n" "${target_version}" > cdist/version.py
     ;;
 
+    clean)
+        make clean
+
+        # Archlinux
+        rm -f cdist-*.pkg.tar.xz cdist-*.tar.gz
+        rm -rf pkg/ src/
+
+        rm -f MANIFEST PKGBUILD
+        rm -rf dist/
+
+        # Signed release
+        rm -f cdist-*.tar.gz
+        rm -f cdist-*.tar.gz.asc
+
+        # Temp files
+        rm -f ./*.tmp
+    ;;
+
+    distclean)
+        "$0" clean
+        rm -f cdist/version.py
+    ;;
     *)
-        echo "Unknown helper target $@ - aborting"
+        printf "Unknown target: '%s'.\n" "${option}" >&2
+        usage "${basename}"
         exit 1
     ;;
 
diff --git a/bin/build-helper.darko b/bin/build-helper.darko
deleted file mode 120000
index 1f3e3384..00000000
--- a/bin/build-helper.darko
+++ /dev/null
@@ -1 +0,0 @@
-build-helper
\ No newline at end of file
diff --git a/docs/changelog b/docs/changelog
index 40cb1f83..38c59047 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Documentation: Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section (Darko Poljak)
+	* Build: Clean and separate end user targets into Makefile and maintainer targets into build-helper (Darko Poljak)
 
 5.0.0: 2019-05-05
 	* Type __zypper_service: Fix spelling error in manpage (Dmitry Bogatov)
diff --git a/docs/src/cdist-install.rst b/docs/src/cdist-install.rst
index c05036b0..4d3df8f8 100644
--- a/docs/src/cdist-install.rst
+++ b/docs/src/cdist-install.rst
@@ -48,14 +48,29 @@ create version.py:
 
 .. code-block:: sh
 
-    make version
+    ./bin/build-helper version
 
-Then, as usual, you execute the following command:
+Then you install it with:
+
+.. code-block:: sh
+
+   make install
+
+or with:
+
+.. code-block:: sh
+
+   make install-user
+
+to install it into user *site-packages* directory.
+Or directly with distutils:
 
 .. code-block:: sh
 
     python setup.py install
 
+Note that `bin/build-helper` script is intended for cdist maintainers.
+
 
 Available versions in git
 ^^^^^^^^^^^^^^^^^^^^^^^^^

From 73fd1ffbc142c57d652750aac143fe07a2e58135 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 8 May 2019 23:38:43 +0200
Subject: [PATCH 033/383] Update homepage

---
 setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index d76bbd4b..5f14a2f4 100644
--- a/setup.py
+++ b/setup.py
@@ -41,7 +41,7 @@ setup(
     description="A Usable Configuration Management System",
     author="Nico Schottelius",
     author_email="nico-cdist-pypi@schottelius.org",
-    url="http://www.nico.schottelius.org/software/cdist/",
+    url="https://www.cdi.st/",
     classifiers=[
         "Development Status :: 6 - Mature",
         "Environment :: Console",

From 15f01149f96205d17711cbe8abdcabfd37f1087c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 9 May 2019 08:26:42 +0200
Subject: [PATCH 034/383] Update old homepage residual refs and non working git
 protocol

---
 PKGBUILD.in                                      | 2 +-
 cdist/argparse.py                                | 2 +-
 cdist/conf/type/__cdist/man.rst                  | 4 ++--
 cdist/conf/type/__cdist/parameter/default/source | 2 +-
 cdist/conf/type/__git/man.rst                    | 2 +-
 docs/changelog                                   | 3 +++
 docs/src/cdist-install.rst                       | 2 ++
 docs/src/cdist-quickstart.rst                    | 4 +---
 8 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/PKGBUILD.in b/PKGBUILD.in
index c967249d..c0188e68 100755
--- a/PKGBUILD.in
+++ b/PKGBUILD.in
@@ -9,7 +9,7 @@ pkgver=$version
 pkgrel=1
 pkgdesc='A Usable Configuration Management System"'
 arch=('any')
-url='http://www.nico.schottelius.org/software/cdist/'
+url='https://www.cdi.st/'
 license=('GPL3')
 depends=('python>=3.2.0')
 source=("http://pypi.python.org/packages/source/c/cdist/cdist-\${pkgver}.tar.gz")
diff --git a/cdist/argparse.py b/cdist/argparse.py
index 3ebdc138..421d1b54 100644
--- a/cdist/argparse.py
+++ b/cdist/argparse.py
@@ -13,7 +13,7 @@ BETA_COMMANDS = set(('install', 'inventory', ))
 BETA_ARGS = {
     'config': set(('tag', 'all_tagged_hosts', 'use_archiving', )),
 }
-EPILOG = "Get cdist at http://www.nico.schottelius.org/software/cdist/"
+EPILOG = "Get cdist at https://code.ungleich.ch/ungleich-public/cdist"
 # Parser others can reuse
 parser = None
 
diff --git a/cdist/conf/type/__cdist/man.rst b/cdist/conf/type/__cdist/man.rst
index 15c77d7f..be082781 100644
--- a/cdist/conf/type/__cdist/man.rst
+++ b/cdist/conf/type/__cdist/man.rst
@@ -30,7 +30,7 @@ username
 
 source
     Select the source from which to clone cdist from.
-    Defaults to "git://code.ungleich.ch/ungleich-public/cdist.git".
+    Defaults to "git@code.ungleich.ch:ungleich-public/cdist.git".
 
 
 branch
@@ -47,7 +47,7 @@ EXAMPLES
     __cdist /home/cdist/cdist
 
     # Use alternative source
-    __cdist --source "git://code.ungleich.ch/ungleich-public/cdist" /home/cdist/cdist
+    __cdist --source "git@code.ungleich.ch:ungleich-public/cdist.git" /home/cdist/cdist
 
 
 AUTHORS
diff --git a/cdist/conf/type/__cdist/parameter/default/source b/cdist/conf/type/__cdist/parameter/default/source
index 5f44a285..1ad3a250 100644
--- a/cdist/conf/type/__cdist/parameter/default/source
+++ b/cdist/conf/type/__cdist/parameter/default/source
@@ -1 +1 @@
-git://code.ungleich.ch/ungleich-public/cdist.git
+git@code.ungleich.ch:ungleich-public/cdist.git
diff --git a/cdist/conf/type/__git/man.rst b/cdist/conf/type/__git/man.rst
index aa704d2b..130925c8 100644
--- a/cdist/conf/type/__git/man.rst
+++ b/cdist/conf/type/__git/man.rst
@@ -44,7 +44,7 @@ EXAMPLES
     __git /home/services/dokuwiki --source git://github.com/splitbrain/dokuwiki.git
 
     # Checkout cdist, stay on branch 2.1
-    __git /home/nico/cdist --source git://code.ungleich.ch/ungleich-public/cdist.git --branch 2.1
+    __git /home/nico/cdist --source git@code.ungleich.ch:ungleich-public/cdist.git --branch 2.1
 
 
 AUTHORS
diff --git a/docs/changelog b/docs/changelog
index 38c59047..e3fd9368 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,9 @@ Changelog
 next:
 	* Documentation: Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section (Darko Poljak)
 	* Build: Clean and separate end user targets into Makefile and maintainer targets into build-helper (Darko Poljak)
+	* Core: Update residual references to old cdist homepage (Darko Poljak)
+	* Documentation: Update residual references to old cdist homepage and git source (Darko Poljak)
+	* Type __cdist: Fix non working 'git://' protocol source (Darko Poljak)
 
 5.0.0: 2019-05-05
 	* Type __zypper_service: Fix spelling error in manpage (Dmitry Bogatov)
diff --git a/docs/src/cdist-install.rst b/docs/src/cdist-install.rst
index 4d3df8f8..a9b7d6b5 100644
--- a/docs/src/cdist-install.rst
+++ b/docs/src/cdist-install.rst
@@ -43,6 +43,8 @@ To install cdist, execute the following commands:
 From version 4.2.0 cdist tags and releases are signed.
 You can get GPG public key used for signing `here <_static/pgp-key-EFD2AE4EC36B6901.asc>`_.
 
+You can also get cdist from `github mirror <https://github.com/ungleich/cdist>`_.
+
 To install cdist with distutils from cloned repository, first you have to
 create version.py:
 
diff --git a/docs/src/cdist-quickstart.rst b/docs/src/cdist-quickstart.rst
index b9220b67..99af869f 100644
--- a/docs/src/cdist-quickstart.rst
+++ b/docs/src/cdist-quickstart.rst
@@ -54,9 +54,7 @@ we can use cdist to configure it. You can copy and paste the following
 code into your shell to get started and configure localhost::
 
     # Get cdist 
-    # Mirrors can be found on
-    # http://www.nico.schottelius.org/software/cdist/install/#index2h4
-    git clone git://code.ungleich.ch/ungleich-public/cdist
+    git clone git@code.ungleich.ch:ungleich-public/cdist.git
 
     # Create manifest (maps configuration to host(s)
     cd cdist

From a8ee4356efbd15517c90763ea92e59c0faec2a23 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 9 May 2019 19:11:09 +0200
Subject: [PATCH 035/383] Release 5.0.1

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index e3fd9368..cd66c649 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+5.0.1: 2019-05-09
 	* Documentation: Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section (Darko Poljak)
 	* Build: Clean and separate end user targets into Makefile and maintainer targets into build-helper (Darko Poljak)
 	* Core: Update residual references to old cdist homepage (Darko Poljak)

From afa00a90943d69704aa9aa4c616992bada09c13c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 9 May 2019 19:35:52 +0200
Subject: [PATCH 036/383] Fix build-helper script

---
 bin/build-helper | 87 ++++++++++++++++++++++++------------------------
 1 file changed, 43 insertions(+), 44 deletions(-)

diff --git a/bin/build-helper b/bin/build-helper
index bba44ded..00fe4ec7 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -23,7 +23,7 @@
 #
 
 usage() {
-    printf "usage: %s TARGET [RUN-AS]
+    printf "usage: %s TARGET RUN-AS
     Available targets:
         print-runas
         changelog-changes
@@ -61,24 +61,19 @@ usage() {
         distclean
     Run as:
         nico
-        darko - default, if not specified\n" "$1"
+        darko - default, if empty string specified\n" "$1"
 }
 
 basename="${0##*/}"
 
-if [ $# -lt 1 ]
+if [ $# -lt 2 ]
 then
     usage "${basename}"
     exit 1
 fi
 
 option=$1; shift
-if [ $# -ge 1 ]
-then
-    run_as="$1"
-else
-    run_as="darko"
-fi
+run_as="$1"; shift
 
 case "$run_as" in
     nico)
@@ -92,6 +87,10 @@ case "$run_as" in
         from_d=gmail.com
         ml_name="Darko Poljak"
         ml_sig_name="Darko"
+        if [ -z "${run_as}" ]
+        then
+            run_as="darko"
+        fi
     ;;
     *)
         printf "Unsupported RUN-AS value: '%s'.\n" "${run_as}" >&2
@@ -160,7 +159,7 @@ case "$option" in
     ;;
 
     check-unittest)
-        "$0" test
+        "$0" test "${run_as}"
     ;;
 
     ml-release)
@@ -191,7 +190,7 @@ cdist $version has been released with the following changes:
 
 eof
 
-        "$0" changelog-changes "$version"
+        "$0" changelog-changes "${run_as}" "$version"
         cat << eof
 
 Cheers,
@@ -226,7 +225,7 @@ eof
 
     pypi-release)
         # Ensure that pypi release has the right version
-        "$0" version
+        "$0" version "${run_as}"
 
         make docs-clean
         make docs
@@ -234,7 +233,7 @@ eof
     ;;
 
     release-git-tag)
-        target_version=$($0 changelog-version)
+        target_version=$($0 changelog-version "${run_as}")
         if git rev-parse --verify "refs/tags/${target_version}" 2>/dev/null; then
             printf "Tag for %s exists, aborting\n" "${target_version}"
             exit 1
@@ -288,7 +287,7 @@ eof
             git archive --prefix="cdist-${tag}/" -o "${archivename}" "${tag}" \
                 || exit 1
             # make sure target version is generated
-            "$0" target-version
+            "$0" target-version "${run_as}"
             tar -x -f "${archivename}" || exit 1
             cp cdist/version.py "cdist-${tag}/cdist/version.py" || exit 1
             tar -c -f "${archivename}" "cdist-${tag}/" || exit 1
@@ -318,7 +317,7 @@ eof
              | sed "${sed_cmd}") || exit 1
 
         # make release
-        changelog=$("$0" changelog-changes "$1" | sed 's/^[[:space:]]*//')
+        changelog=$("$0" changelog-changes "${run_as}" "$1" | sed 's/^[[:space:]]*//')
         release_notes=$(
             printf "%s\n\n%s\n\n**Changelog**\n\n%s\n" \
                 "${response_archive}" "${response_archive_sig}" "${changelog}"
@@ -339,19 +338,19 @@ eof
 
     release)
         set -e
-        target_version=$($0 changelog-version)
-        target_branch=$($0 version-branch)
+        target_version=$($0 changelog-version "${run_as}")
+        target_branch=$($0 version-branch "${run_as}")
 
         printf "Beginning release process for %s\n" "${target_version}"
 
         # First check everything is sane
-        "$0" check-date
-        "$0" check-unittest
-        "$0" check-pycodestyle
-        "$0" check-shellcheck
+        "$0" check-date "${run_as}"
+        "$0" check-unittest "${run_as}"
+        "$0" check-pycodestyle "${run_as}"
+        "$0" check-shellcheck "${run_as}"
 
         # Generate version file to be included in packaging
-        "$0" target-version
+        "$0" target-version "${run_as}"
 
         # Ensure the git status is clean, else abort
         if ! git diff-index --name-only --exit-code HEAD ; then
@@ -386,8 +385,8 @@ eof
         fi
 
         # Verify that after the merge everything works
-        "$0" check-date
-        "$0" check-unittest
+        "$0" check-date "${run_as}"
+        "$0" check-unittest "${run_as}"
 
         # Generate documentation (man and html)
         # First, clean old generated docs
@@ -398,7 +397,7 @@ eof
         # Everything green, let's do the release
 
         # Tag the current commit
-        "$0" release-git-tag
+        "$0" release-git-tag "${run_as}"
 
         # Also merge back the version branch
         if [ "$masterbranch" = yes ]; then
@@ -419,21 +418,21 @@ eof
         # fi
 
         # Create and publish package for pypi
-        "$0" pypi-release
+        "$0" pypi-release "${run_as}"
 
         if [ "$run_as" = "nico" ]
         then
             # Archlinux release is based on pypi
-            "$0" archlinux-release
+            "$0" archlinux-release "${run_as}"
         fi
 
         # sign git tag
         printf "Enter upstream repository authentication token: "
         read -r token
-        "$0" sign-git-release "${target_version}" "${token}"
+        "$0" sign-git-release "${run_as}" "${target_version}" "${token}"
 
         # Announce change on ML
-        "$0" ml-release "${target_version}"
+        "$0" ml-release "${run_as}" "${target_version}"
 
         cat << eof
 Manual steps post release:
@@ -477,7 +476,7 @@ eof
     ;;
 
     check-pycodestyle)
-        "$0" pycodestyle
+        "$0" pycodestyle "${run_as}"
         printf "\\nPlease review pycodestyle report.\\n"
         while true
         do
@@ -523,20 +522,20 @@ eof
     ;;
 
     shellcheck-gencodes)
-        "$0" shellcheck-local-gencodes
-        "$0" shellcheck-remote-gencodes
+        "$0" shellcheck-local-gencodes "${run_as}"
+        "$0" shellcheck-remote-gencodes "${run_as}"
     ;;
 
     shellcheck-types)
-        "$0" shellcheck-type-explorers
-        "$0" shellcheck-manifests
-        "$0" shellcheck-gencodes
+        "$0" shellcheck-type-explorers "${run_as}"
+        "$0" shellcheck-manifests "${run_as}"
+        "$0" shellcheck-gencodes "${run_as}"
     ;;
 
     shellcheck)
-        "$0" shellcheck-global-explorers
-        "$0" shellcheck-types
-        "$0" shellcheck-scripts
+        "$0" shellcheck-global-explorers "${run_as}"
+        "$0" shellcheck-types "${run_as}"
+        "$0" shellcheck-scripts "${run_as}"
     ;;
 
     shellcheck-type-files)
@@ -544,8 +543,8 @@ eof
     ;;
 
     shellcheck-with-files)
-        "$0" shellcheck
-        "$0" shellcheck-type-files
+        "$0" shellcheck "${run_as}"
+        "$0" shellcheck-type-files "${run_as}"
     ;;
 
     shellcheck-build-helper)
@@ -553,7 +552,7 @@ eof
     ;;
 
     check-shellcheck)
-        "$0" shellcheck
+        "$0" shellcheck "${run_as}"
         printf "\\nPlease review shellcheck report.\\n"
         while true
         do
@@ -575,7 +574,7 @@ eof
     ;;
 
     version-branch)
-        "$0" changelog-version | cut -d. -f '1,2'
+        "$0" changelog-version "${run_as}" | cut -d. -f '1,2'
     ;;
 
     version)
@@ -583,7 +582,7 @@ eof
     ;;
 
     target-version)
-        target_version=$($0 changelog-version)
+        target_version=$($0 changelog-version "${run_as}")
         printf "VERSION = \"%s\"\n" "${target_version}" > cdist/version.py
     ;;
 
@@ -606,7 +605,7 @@ eof
     ;;
 
     distclean)
-        "$0" clean
+        "$0" clean "${run_as}"
         rm -f cdist/version.py
     ;;
     *)

From 66cdbc5233407d5f926e1db3e4031ffe6ef3a8b2 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 9 May 2019 21:05:33 +0200
Subject: [PATCH 037/383] Simplify maintainer's helper script

---
 bin/build-helper | 145 +++++++++++++----------------------------------
 1 file changed, 39 insertions(+), 106 deletions(-)

diff --git a/bin/build-helper b/bin/build-helper
index 00fe4ec7..1698a678 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -23,9 +23,8 @@
 #
 
 usage() {
-    printf "usage: %s TARGET RUN-AS
+    printf "usage: %s TARGET [TARGET-ARGS...]
     Available targets:
-        print-runas
         changelog-changes
         changelog-version
         check-date
@@ -58,64 +57,29 @@ usage() {
         version
         target-version
         clean
-        distclean
-    Run as:
-        nico
-        darko - default, if empty string specified\n" "$1"
+        distclean\n" "$1"
 }
 
 basename="${0##*/}"
 
-if [ $# -lt 2 ]
+if [ $# -lt 1 ]
 then
     usage "${basename}"
     exit 1
 fi
 
 option=$1; shift
-run_as="$1"; shift
-
-case "$run_as" in
-    nico)
-        from_a=nico.schottelius
-        from_d=ungleich.ch
-        ml_name="Nico Schottelius"
-        ml_sig_name="Nico"
-    ;;
-    darko|'')
-        from_a=darko.poljak
-        from_d=gmail.com
-        ml_name="Darko Poljak"
-        ml_sig_name="Darko"
-        if [ -z "${run_as}" ]
-        then
-            run_as="darko"
-        fi
-    ;;
-    *)
-        printf "Unsupported RUN-AS value: '%s'.\n" "${run_as}" >&2
-        usage "${basename}"
-        exit 1
-    ;;
-esac
 
 SHELLCHECKCMD="shellcheck -s sh -f gcc -x"
 # Skip SC2154 for variables starting with __ since such variables are cdist
 # environment variables.
 SHELLCHECK_SKIP=': __.*is referenced but not assigned.*\[SC2154\]'
 
-to_a="cdist-configuration-management"
-to_d="googlegroups.com"
-
 # Change to checkout directory
 basedir="${0%/*}/../"
 cd "$basedir"
 
 case "$option" in
-    print-runas)
-        printf "run_as: '%s'\n" "$run_as"
-    ;;
-
     changelog-changes)
         if [ "$#" -eq 1 ]; then
             start=$1
@@ -159,7 +123,7 @@ case "$option" in
     ;;
 
     check-unittest)
-        "$0" test "${run_as}"
+        "$0" test
     ;;
 
     ml-release)
@@ -168,20 +132,10 @@ case "$option" in
             exit 1
         fi
 
-        # Send mail only once - lock until new changelog things happened.
-        [ ! -f .lock-ml ] && touch .lock-ml
-        x=$(find 'docs' -name changelog -type f -newer .lock-ml)
-        [ -z "${x}" ] && exit 0
-
         version=$1; shift
 
-        to=${to_a}@${to_d}
-        from=${from_a}@${from_d}
-
         ( 
         cat << eof
-From: ${ml_name} <$from>
-To: cdist mailing list <$to>
 Subject: cdist $version has been released
 
 Hello .*,
@@ -190,23 +144,11 @@ cdist $version has been released with the following changes:
 
 eof
 
-        "$0" changelog-changes "${run_as}" "$version"
+        "$0" changelog-changes "$version"
         cat << eof
 
-Cheers,
-${ml_sig_name}
-
--- 
-Automatisation at its best level. With cdist.
 eof
         ) > mailinglist.tmp
-
-        if [ "$run_as" = "nico" ]
-        then
-            /usr/sbin/sendmail -f "$from" "$to" < mailinglist.tmp && rm -f mailinglist.tmp
-        fi
-
-        touch .lock-ml
     ;;
 
     archlinux-release)
@@ -225,7 +167,7 @@ eof
 
     pypi-release)
         # Ensure that pypi release has the right version
-        "$0" version "${run_as}"
+        "$0" version
 
         make docs-clean
         make docs
@@ -233,7 +175,7 @@ eof
     ;;
 
     release-git-tag)
-        target_version=$($0 changelog-version "${run_as}")
+        target_version=$($0 changelog-version)
         if git rev-parse --verify "refs/tags/${target_version}" 2>/dev/null; then
             printf "Tag for %s exists, aborting\n" "${target_version}"
             exit 1
@@ -287,7 +229,7 @@ eof
             git archive --prefix="cdist-${tag}/" -o "${archivename}" "${tag}" \
                 || exit 1
             # make sure target version is generated
-            "$0" target-version "${run_as}"
+            "$0" target-version
             tar -x -f "${archivename}" || exit 1
             cp cdist/version.py "cdist-${tag}/cdist/version.py" || exit 1
             tar -c -f "${archivename}" "cdist-${tag}/" || exit 1
@@ -317,7 +259,7 @@ eof
              | sed "${sed_cmd}") || exit 1
 
         # make release
-        changelog=$("$0" changelog-changes "${run_as}" "$1" | sed 's/^[[:space:]]*//')
+        changelog=$("$0" changelog-changes "$1" | sed 's/^[[:space:]]*//')
         release_notes=$(
             printf "%s\n\n%s\n\n**Changelog**\n\n%s\n" \
                 "${response_archive}" "${response_archive_sig}" "${changelog}"
@@ -338,19 +280,19 @@ eof
 
     release)
         set -e
-        target_version=$($0 changelog-version "${run_as}")
-        target_branch=$($0 version-branch "${run_as}")
+        target_version=$($0 changelog-version)
+        target_branch=$($0 version-branch)
 
         printf "Beginning release process for %s\n" "${target_version}"
 
         # First check everything is sane
-        "$0" check-date "${run_as}"
-        "$0" check-unittest "${run_as}"
-        "$0" check-pycodestyle "${run_as}"
-        "$0" check-shellcheck "${run_as}"
+        "$0" check-date
+        "$0" check-unittest
+        "$0" check-pycodestyle
+        "$0" check-shellcheck
 
         # Generate version file to be included in packaging
-        "$0" target-version "${run_as}"
+        "$0" target-version
 
         # Ensure the git status is clean, else abort
         if ! git diff-index --name-only --exit-code HEAD ; then
@@ -385,8 +327,8 @@ eof
         fi
 
         # Verify that after the merge everything works
-        "$0" check-date "${run_as}"
-        "$0" check-unittest "${run_as}"
+        "$0" check-date
+        "$0" check-unittest
 
         # Generate documentation (man and html)
         # First, clean old generated docs
@@ -397,7 +339,7 @@ eof
         # Everything green, let's do the release
 
         # Tag the current commit
-        "$0" release-git-tag "${run_as}"
+        "$0" release-git-tag
 
         # Also merge back the version branch
         if [ "$masterbranch" = yes ]; then
@@ -406,37 +348,28 @@ eof
         fi
 
         # Publish git changes
-        # if you want to have mirror locally then uncomment this support
-        # if [ "$run_as" = "nico" ]
-        # then
+        # if you want to have mirror locally then uncomment this and comment below
         #     git push --mirror
-        # else
-            # if we are not Nico :) then just push, no mirror
             git push
             # push also new branch and set up tracking
             git push -u origin "${target_branch}"
         # fi
 
         # Create and publish package for pypi
-        "$0" pypi-release "${run_as}"
-
-        if [ "$run_as" = "nico" ]
-        then
-            # Archlinux release is based on pypi
-            "$0" archlinux-release "${run_as}"
-        fi
+        "$0" pypi-release
 
         # sign git tag
         printf "Enter upstream repository authentication token: "
         read -r token
-        "$0" sign-git-release "${run_as}" "${target_version}" "${token}"
+        "$0" sign-git-release "${target_version}" "${token}"
 
         # Announce change on ML
-        "$0" ml-release "${run_as}" "${target_version}"
+        "$0" ml-release "${target_version}"
 
         cat << eof
 Manual steps post release:
     - cdist-web
+    - send mail body generated in mailinglist.tmp and inform Dmitry for deb
     - twitter
 eof
     ;;
@@ -476,7 +409,7 @@ eof
     ;;
 
     check-pycodestyle)
-        "$0" pycodestyle "${run_as}"
+        "$0" pycodestyle
         printf "\\nPlease review pycodestyle report.\\n"
         while true
         do
@@ -522,20 +455,20 @@ eof
     ;;
 
     shellcheck-gencodes)
-        "$0" shellcheck-local-gencodes "${run_as}"
-        "$0" shellcheck-remote-gencodes "${run_as}"
+        "$0" shellcheck-local-gencodes
+        "$0" shellcheck-remote-gencodes
     ;;
 
     shellcheck-types)
-        "$0" shellcheck-type-explorers "${run_as}"
-        "$0" shellcheck-manifests "${run_as}"
-        "$0" shellcheck-gencodes "${run_as}"
+        "$0" shellcheck-type-explorers
+        "$0" shellcheck-manifests
+        "$0" shellcheck-gencodes
     ;;
 
     shellcheck)
-        "$0" shellcheck-global-explorers "${run_as}"
-        "$0" shellcheck-types "${run_as}"
-        "$0" shellcheck-scripts "${run_as}"
+        "$0" shellcheck-global-explorers
+        "$0" shellcheck-types
+        "$0" shellcheck-scripts
     ;;
 
     shellcheck-type-files)
@@ -543,8 +476,8 @@ eof
     ;;
 
     shellcheck-with-files)
-        "$0" shellcheck "${run_as}"
-        "$0" shellcheck-type-files "${run_as}"
+        "$0" shellcheck
+        "$0" shellcheck-type-files
     ;;
 
     shellcheck-build-helper)
@@ -552,7 +485,7 @@ eof
     ;;
 
     check-shellcheck)
-        "$0" shellcheck "${run_as}"
+        "$0" shellcheck
         printf "\\nPlease review shellcheck report.\\n"
         while true
         do
@@ -574,7 +507,7 @@ eof
     ;;
 
     version-branch)
-        "$0" changelog-version "${run_as}" | cut -d. -f '1,2'
+        "$0" changelog-version | cut -d. -f '1,2'
     ;;
 
     version)
@@ -582,7 +515,7 @@ eof
     ;;
 
     target-version)
-        target_version=$($0 changelog-version "${run_as}")
+        target_version=$($0 changelog-version)
         printf "VERSION = \"%s\"\n" "${target_version}" > cdist/version.py
     ;;
 
@@ -605,7 +538,7 @@ eof
     ;;
 
     distclean)
-        "$0" clean "${run_as}"
+        "$0" clean
         rm -f cdist/version.py
     ;;
     *)

From 569ae29955961cd2901ef6307efff152daa87473 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Tue, 14 May 2019 11:47:15 +0200
Subject: [PATCH 038/383] [__package_apk] fix / add support for @yrepo syntax

---
 cdist/conf/type/__package_apk/explorer/state | 4 ++++
 docs/changelog                               | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/cdist/conf/type/__package_apk/explorer/state b/cdist/conf/type/__package_apk/explorer/state
index 29ccf3a5..b477ca7c 100755
--- a/cdist/conf/type/__package_apk/explorer/state
+++ b/cdist/conf/type/__package_apk/explorer/state
@@ -27,6 +27,10 @@ else
    name="$__object_id"
 fi
 
+# Remove the @.. repo tag for finding out whether it is installed
+# f.i. pass@testing => pass
+name="$(echo "$name" | sed 's/@.*//')"
+
 if [ "$(apk list -I "$name")" ]; then
     echo present
 else
diff --git a/docs/changelog b/docs/changelog
index cd66c649..af8fef8f 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Type __package_apk: Fix @repo handling in explorer (Nico Schottelius)
+
 5.0.1: 2019-05-09
 	* Documentation: Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section (Darko Poljak)
 	* Build: Clean and separate end user targets into Makefile and maintainer targets into build-helper (Darko Poljak)

From ca8bc959ed931734570b2c47d2d99c5b35c754a3 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Tue, 14 May 2019 13:27:43 +0300
Subject: [PATCH 039/383] __acl: add todo note

---
 cdist/conf/type/__acl/explorer/checks | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cdist/conf/type/__acl/explorer/checks b/cdist/conf/type/__acl/explorer/checks
index 2f3b9e6d..2aae13f6 100755
--- a/cdist/conf/type/__acl/explorer/checks
+++ b/cdist/conf/type/__acl/explorer/checks
@@ -18,6 +18,8 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+# TODO check if filesystem has ACL turned on etc
+
 [ ! -e "/$__object_id" ] && exit 0
 
 for parameter in user group

From 7dfc5bc4736b00e8622555169c65800bb7bf4600 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Tue, 14 May 2019 13:41:32 +0300
Subject: [PATCH 040/383] __acl: we do not have to check here if file exist

---
 cdist/conf/type/__acl/explorer/checks | 2 --
 1 file changed, 2 deletions(-)

diff --git a/cdist/conf/type/__acl/explorer/checks b/cdist/conf/type/__acl/explorer/checks
index 2aae13f6..a2fcf44d 100755
--- a/cdist/conf/type/__acl/explorer/checks
+++ b/cdist/conf/type/__acl/explorer/checks
@@ -20,8 +20,6 @@
 
 # TODO check if filesystem has ACL turned on etc
 
-[ ! -e "/$__object_id" ] && exit 0
-
 for parameter in user group
 do
     if [ ! -f "$__object/parameter/$parameter" ]

From 7a25ec00edb8458c8a11de3971024a9f99d1ba47 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Tue, 14 May 2019 13:42:56 +0300
Subject: [PATCH 041/383] __acl: add TODO note about dry-run

---
 cdist/conf/type/__acl/gencode-remote | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index ef903816..d47469c1 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -20,6 +20,7 @@
 
 file_is="$( cat "$__object/explorer/file_is" )"
 
+# TODO this check is not needed with dry-run
 [ "$file_is" = 'missing' ] && exit 0
 
 os="$( cat "$__global/explorer/os" )"

From 5f462d638017c22548176aeb7594098d009af21e Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Tue, 14 May 2019 16:49:33 +0200
Subject: [PATCH 042/383] ++alpine support

---
 cdist/conf/type/__postfix/manifest                | 3 ++-
 cdist/conf/type/__postfix_postconf/explorer/value | 2 +-
 cdist/conf/type/__postfix_postconf/gencode-remote | 3 ++-
 docs/changelog                                    | 2 ++
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__postfix/manifest b/cdist/conf/type/__postfix/manifest
index 1aea53a1..f3616979 100755
--- a/cdist/conf/type/__postfix/manifest
+++ b/cdist/conf/type/__postfix/manifest
@@ -1,6 +1,7 @@
 #!/bin/sh -e
 #
 # 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2019 Nico Schottelius (nico-cdist at schottelius.org)
 #
 # This file is part of cdist.
 #
@@ -22,7 +23,7 @@
 os=$(cat "$__global/explorer/os")
 
 case "$os" in
-   ubuntu|debian|archlinux|suse|scientific|centos|devuan)
+   alpine|ubuntu|debian|archlinux|suse|scientific|centos|devuan)
       __package postfix --state present
    ;;
    *)
diff --git a/cdist/conf/type/__postfix_postconf/explorer/value b/cdist/conf/type/__postfix_postconf/explorer/value
index 17126c94..67dacad8 100755
--- a/cdist/conf/type/__postfix_postconf/explorer/value
+++ b/cdist/conf/type/__postfix_postconf/explorer/value
@@ -22,7 +22,7 @@
 os=$("$__explorer/os")
 
 case "$os" in
-   ubuntu|debian|archlinux|suse|scientific|centos|devuan)
+   alpine|ubuntu|debian|archlinux|suse|scientific|centos|devuan)
       :
    ;;
    *)
diff --git a/cdist/conf/type/__postfix_postconf/gencode-remote b/cdist/conf/type/__postfix_postconf/gencode-remote
index 6df0da7f..279dddd4 100755
--- a/cdist/conf/type/__postfix_postconf/gencode-remote
+++ b/cdist/conf/type/__postfix_postconf/gencode-remote
@@ -1,6 +1,7 @@
 #!/bin/sh -e
 #
 # 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2019 Nico Schottelius (nico-cdist at schottelius.org)
 #
 # This file is part of cdist.
 #
@@ -21,7 +22,7 @@
 os=$(cat "$__global/explorer/os")
 
 case "$os" in
-   ubuntu|debian|archlinux|suse|scientific|centos|devuan)
+   alpine|archlinux|centos|debian|devuan|suse|scientific|ubuntu)
       :
    ;;
    *)
diff --git a/docs/changelog b/docs/changelog
index af8fef8f..556fd42f 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,8 @@ Changelog
 
 next:
 	* Type __package_apk: Fix @repo handling in explorer (Nico Schottelius)
+	* Type __postfix: Add alpine support (Nico Schottelius)
+	* Type __postfix_postconf: Add alpine support (Nico Schottelius)
 
 5.0.1: 2019-05-09
 	* Documentation: Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section (Darko Poljak)

From ce52203ba3a84297599f9b0eeb66ae83f967859e Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Tue, 14 May 2019 17:10:26 +0200
Subject: [PATCH 043/383] __user add alpine support

---
 cdist/conf/type/__user/manifest | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 cdist/conf/type/__user/manifest

diff --git a/cdist/conf/type/__user/manifest b/cdist/conf/type/__user/manifest
new file mode 100644
index 00000000..8f10b38c
--- /dev/null
+++ b/cdist/conf/type/__user/manifest
@@ -0,0 +1,32 @@
+#!/bin/sh -e
+#
+# 2019 Nico Schottelius (nico-cdist at schottelius.org)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# Manage users.
+
+os=$(cat "$__global/explorer/os")
+
+case "$os" in
+    alpine)
+        __package shadow
+        ;;
+    *)
+        :
+        ;;
+esac

From fe643b9092a61f5616624e10ebd0abdf0749823a Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Tue, 14 May 2019 17:10:46 +0200
Subject: [PATCH 044/383] ++doc

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 556fd42f..41b0088f 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Type __package_apk: Fix @repo handling in explorer (Nico Schottelius)
 	* Type __postfix: Add alpine support (Nico Schottelius)
 	* Type __postfix_postconf: Add alpine support (Nico Schottelius)
+	* Type __user: Add alpine support (Nico Schottelius)
 
 5.0.1: 2019-05-09
 	* Documentation: Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section (Darko Poljak)

From 69622b0fa5f0d29eaf6d4357a0e84f8a6f6b101b Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Thu, 16 May 2019 21:58:47 +0200
Subject: [PATCH 045/383] set __cdist_dry_run env var if dry-run

---
 cdist/config.py                 | 9 ++++++---
 cdist/core/code.py              | 5 ++++-
 cdist/core/explorer.py          | 6 +++++-
 cdist/core/manifest.py          | 5 ++++-
 docs/src/cdist-reference.rst.sh | 4 ++++
 docs/src/cdist-type.rst         | 9 +++++++++
 6 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/cdist/config.py b/cdist/config.py
index bc05a28c..30117382 100644
--- a/cdist/config.py
+++ b/cdist/config.py
@@ -104,9 +104,12 @@ class Config(object):
         self.remove_remote_files_dirs = remove_remote_files_dirs
 
         self.explorer = core.Explorer(self.local.target_host, self.local,
-                                      self.remote, jobs=self.jobs)
-        self.manifest = core.Manifest(self.local.target_host, self.local)
-        self.code = core.Code(self.local.target_host, self.local, self.remote)
+                                      self.remote, jobs=self.jobs,
+                                      dry_run=self.dry_run)
+        self.manifest = core.Manifest(self.local.target_host, self.local,
+                                      dry_run=self.dry_run)
+        self.code = core.Code(self.local.target_host, self.local, self.remote,
+                              dry_run=self.dry_run)
 
     def _init_files_dirs(self):
         """Prepare files and directories for the run"""
diff --git a/cdist/core/code.py b/cdist/core/code.py
index 670029ed..1550880a 100644
--- a/cdist/core/code.py
+++ b/cdist/core/code.py
@@ -97,7 +97,7 @@ class Code(object):
 
     """
     # target_host is tuple (target_host, target_hostname, target_fqdn)
-    def __init__(self, target_host, local, remote):
+    def __init__(self, target_host, local, remote, dry_run=False):
         self.target_host = target_host
         self.local = local
         self.remote = remote
@@ -113,6 +113,9 @@ class Code(object):
                 local.log),
         }
 
+        if dry_run:
+            self.env['__cdist_dry_run'] = '1'
+
     def _run_gencode(self, cdist_object, which):
         cdist_type = cdist_object.cdist_type
         script = os.path.join(self.local.type_path,
diff --git a/cdist/core/explorer.py b/cdist/core/explorer.py
index acceacac..353d7681 100644
--- a/cdist/core/explorer.py
+++ b/cdist/core/explorer.py
@@ -67,7 +67,7 @@ class Explorer(object):
     """Executes cdist explorers.
 
     """
-    def __init__(self, target_host, local, remote, jobs=None):
+    def __init__(self, target_host, local, remote, jobs=None, dry_run=False):
         self.target_host = target_host
 
         self._open_logger()
@@ -84,6 +84,10 @@ class Explorer(object):
             '__cdist_log_level_name': util.log_level_name_env_var_val(
                 self.log),
         }
+
+        if dry_run:
+            self.env['__cdist_dry_run'] = '1'
+
         self._type_explorers_transferred = []
         self.jobs = jobs
 
diff --git a/cdist/core/manifest.py b/cdist/core/manifest.py
index 938ad8b8..07af0ef8 100644
--- a/cdist/core/manifest.py
+++ b/cdist/core/manifest.py
@@ -96,7 +96,7 @@ class Manifest(object):
     """Executes cdist manifests.
 
     """
-    def __init__(self, target_host, local):
+    def __init__(self, target_host, local, dry_run=False):
         self.target_host = target_host
         self.local = local
 
@@ -117,6 +117,9 @@ class Manifest(object):
                 self.log),
         }
 
+        if dry_run:
+            self.env['__cdist_dry_run'] = '1'
+
     def _open_logger(self):
         self.log = logging.getLogger(self.target_host[0])
 
diff --git a/docs/src/cdist-reference.rst.sh b/docs/src/cdist-reference.rst.sh
index 2c9c7b40..f4a37816 100755
--- a/docs/src/cdist-reference.rst.sh
+++ b/docs/src/cdist-reference.rst.sh
@@ -219,6 +219,10 @@ __cdist_log_level, __cdist_log_level_name
     | TRACE          | 5               |
     +----------------+-----------------+
 
+    Available for: initial manifest, explorer, type manifest, type explorer,
+    type gencode.
+__cdist_dry_run
+    Is set only when doing dry run (``-n`` flag).
     Available for: initial manifest, explorer, type manifest, type explorer,
     type gencode.
 __explorer
diff --git a/docs/src/cdist-type.rst b/docs/src/cdist-type.rst
index 7c0dab8d..7e5e39ef 100644
--- a/docs/src/cdist-type.rst
+++ b/docs/src/cdist-type.rst
@@ -371,6 +371,15 @@ It is available for initial manifest, explorer, type manifest,
 type explorer, type gencode.
 
 
+Detecting dry run
+-----------------
+
+If ``$__cdist_dry_run`` environment variable is set, then it's dry run.
+
+It is available for initial manifest, explorer, type manifest,
+type explorer, type gencode.
+
+
 Hints for typewriters
 ----------------------
 It must be assumed that the target is pretty dumb and thus does not have high

From 7195b594f302be7742eaa84e1daa0bdc71bbc012 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 16 May 2019 21:59:30 +0200
Subject: [PATCH 046/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 41b0088f..47b4b14b 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -6,6 +6,7 @@ next:
 	* Type __postfix: Add alpine support (Nico Schottelius)
 	* Type __postfix_postconf: Add alpine support (Nico Schottelius)
 	* Type __user: Add alpine support (Nico Schottelius)
+	* Core: Set __cdist_dry_run env var (Ander Punnar)
 
 5.0.1: 2019-05-09
 	* Documentation: Add 'Perils of CDIST_ORDER_DEPENDENCY' sub-section (Darko Poljak)

From d604a9db7a080c1cc3782f6e488a2ed6a508fd02 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 17 May 2019 13:03:46 +0200
Subject: [PATCH 047/383] Fix pycodestyle

---
 cdist/inventory.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/inventory.py b/cdist/inventory.py
index 7da306fa..138a2034 100644
--- a/cdist/inventory.py
+++ b/cdist/inventory.py
@@ -315,7 +315,7 @@ class InventoryHost(Inventory):
         hostpath = self._host_path(host)
         self.log.trace("hostpath: {}".format(hostpath))
         if self.action == "add" and not os.path.exists(hostpath):
-                self._new_hostpath(hostpath)
+            self._new_hostpath(hostpath)
         else:
             if not os.path.isfile(hostpath):
                 raise cdist.Error(("Host path \'{}\' is"

From 4a5425a95e8b5fce1d2e49064301a4e173f8d003 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 17 May 2019 13:02:05 +0200
Subject: [PATCH 048/383] Release 5.0.2

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 47b4b14b..515f7b69 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+5.0.2: 2019-05-17
 	* Type __package_apk: Fix @repo handling in explorer (Nico Schottelius)
 	* Type __postfix: Add alpine support (Nico Schottelius)
 	* Type __postfix_postconf: Add alpine support (Nico Schottelius)

From 21a16f5584a08b8f155c01d2cbb78a003fc5725b Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Sat, 18 May 2019 23:46:09 +0200
Subject: [PATCH 049/383] consul, changelog, consul agent => alpine

---
 .../type/__consul/files/versions/1.5.0/cksum  |  1 +
 .../type/__consul/files/versions/1.5.0/source |  1 +
 cdist/conf/type/__consul/gencode-remote       |  2 +-
 cdist/conf/type/__consul/manifest             |  3 +-
 .../__consul_agent/files/consul.sys-openrc    | 38 +++++++++++++++
 cdist/conf/type/__consul_agent/manifest       | 47 +++++++++----------
 docs/changelog                                |  5 ++
 7 files changed, 71 insertions(+), 26 deletions(-)
 create mode 100644 cdist/conf/type/__consul/files/versions/1.5.0/cksum
 create mode 100644 cdist/conf/type/__consul/files/versions/1.5.0/source
 create mode 100644 cdist/conf/type/__consul_agent/files/consul.sys-openrc

diff --git a/cdist/conf/type/__consul/files/versions/1.5.0/cksum b/cdist/conf/type/__consul/files/versions/1.5.0/cksum
new file mode 100644
index 00000000..efca9caa
--- /dev/null
+++ b/cdist/conf/type/__consul/files/versions/1.5.0/cksum
@@ -0,0 +1 @@
+886614099 103959898 consul
diff --git a/cdist/conf/type/__consul/files/versions/1.5.0/source b/cdist/conf/type/__consul/files/versions/1.5.0/source
new file mode 100644
index 00000000..cafa9248
--- /dev/null
+++ b/cdist/conf/type/__consul/files/versions/1.5.0/source
@@ -0,0 +1 @@
+https://releases.hashicorp.com/consul/1.5.0/consul_1.5.0_linux_amd64.zip
diff --git a/cdist/conf/type/__consul/gencode-remote b/cdist/conf/type/__consul/gencode-remote
index 1d2244ea..2a21054f 100755
--- a/cdist/conf/type/__consul/gencode-remote
+++ b/cdist/conf/type/__consul/gencode-remote
@@ -42,7 +42,7 @@ source_file_name="${source##*/}"
 cksum_should=$(cut -d' ' -f1,2 "$version_dir/cksum")
 
 cat << eof
-    tmpdir=\$(mktemp -d --tmpdir="/tmp" "${__type##*/}.XXXXXXXXXX")
+    tmpdir=\$(mktemp -d -p /tmp "${__type##*/}.XXXXXXXXXX")
     curl -s -L "$source" > "\$tmpdir/$source_file_name"
     unzip -p "\$tmpdir/$source_file_name" > "${destination}.tmp"
     rm -rf "\$tmpdir"
diff --git a/cdist/conf/type/__consul/manifest b/cdist/conf/type/__consul/manifest
index 0dd50f53..156eb667 100755
--- a/cdist/conf/type/__consul/manifest
+++ b/cdist/conf/type/__consul/manifest
@@ -24,7 +24,7 @@
 os=$(cat "$__global/explorer/os")
 
 case "$os" in
-   scientific|centos|redhat|ubuntu|debian|devuan|archlinux|gentoo)
+   alpine|scientific|centos|redhat|ubuntu|debian|devuan|archlinux|gentoo)
       # any linux should work
       :
    ;;
@@ -47,6 +47,7 @@ fi
 
 if [ -f "$__object/parameter/direct" ]; then
     __package unzip
+    __package curl
 else
     __staged_file /usr/local/bin/consul \
        --source "$(cat "$version_dir/source")" \
diff --git a/cdist/conf/type/__consul_agent/files/consul.sys-openrc b/cdist/conf/type/__consul_agent/files/consul.sys-openrc
new file mode 100644
index 00000000..1dbe9375
--- /dev/null
+++ b/cdist/conf/type/__consul_agent/files/consul.sys-openrc
@@ -0,0 +1,38 @@
+#!/sbin/openrc-run
+# 2019 Nico Schottelius (nico-cdist at schottelius.org)
+
+description="consul agent"
+
+pidfile="${CONSUL_PIDFILE:-"/var/run/$RC_SVCNAME/pidfile"}"
+command="${CONSUL_BINARY:-"/usr/local/bin/consul"}"
+
+
+checkconfig() {
+	if [ ! -d /var/run/consul ] ; then
+		mkdir -p /var/run/consul || return 1
+        chown consul:consul /var/run/$NAME || return 1
+        chmod 2770 /var/run/$NAME || return 1
+	fi
+}
+
+start() {
+    need net
+
+    start-stop-daemon --start --quiet --oknodo \
+            --pidfile "$pidfile" --background \
+            --exec $command -- agent -pid-file="$pidfile" -config-dir /etc/consul/conf.d
+}
+start_pre() {
+	checkconfig
+}
+
+stop() {
+	if [ "${RC_CMD}" = "restart" ] ; then
+		checkconfig || return 1
+	fi
+
+	ebegin "Stopping $RC_SVCNAME"
+	start-stop-daemon --stop --exec "$command" \
+		--pidfile "$pidfile" --quiet
+	eend $?
+}
diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index c48bfe85..a88d26ed 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -1,7 +1,7 @@
 #!/bin/sh -e
 #
 # 2015 Steven Armstrong (steven-cdist at armstrong.cc)
-# 2015 Nico Schottelius (nico-cdist at schottelius.org)
+# 2015-2019 Nico Schottelius (nico-cdist at schottelius.org)
 #
 # This file is part of cdist.
 #
@@ -23,7 +23,7 @@
 os=$(cat "$__global/explorer/os")
 
 case "$os" in
-   scientific|centos|debian|devuan|redhat|ubuntu)
+   alpine|scientific|centos|debian|devuan|redhat|ubuntu)
       # whitelist safeguard
       :
    ;;
@@ -181,22 +181,25 @@ init_upstart()
 
 # Install init script to start on boot
 case "$os" in
-   centos|redhat)
-      os_version="$(sed 's/[^0-9.]//g' "$__global/explorer/os_version")"
-      major_version="${os_version%%.*}"
-      case "$major_version" in
-         [456])
-            init_sysvinit redhat
-         ;;
-         7)
-            init_systemd
-         ;;
-         *)
-            echo "Unsupported CentOS/Redhat version: $os_version" >&2
-            exit 1
-         ;;
-      esac
-   ;;
+    alpine|devuan)
+        init_sysvinit debian
+        ;;
+    centos|redhat)
+        os_version="$(sed 's/[^0-9.]//g' "$__global/explorer/os_version")"
+        major_version="${os_version%%.*}"
+        case "$major_version" in
+            [456])
+                init_sysvinit redhat
+                ;;
+            7)
+                init_systemd
+                ;;
+            *)
+                echo "Unsupported CentOS/Redhat version: $os_version" >&2
+                exit 1
+                ;;
+        esac
+        ;;
 
     debian)
         os_version=$(cat "$__global/explorer/os_version")
@@ -214,13 +217,9 @@ case "$os" in
                 exit 1
             ;;
         esac
-    ;;
-
-    devuan)
-        init_sysvinit debian
-    ;;
+        ;;
 
     ubuntu)
         init_upstart
-    ;;
+        ;;
 esac
diff --git a/docs/changelog b/docs/changelog
index 515f7b69..b8071ffe 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,11 @@
 Changelog
 ---------
 
+next:
+	* Type __consul: Add alpine support (Nico Schottelius)
+	* Type __consul: Add version 1.5.0 (Nico Schottelius)
+	* Type __consul_agent: Add alpine support (Nico Schottelius)
+
 5.0.2: 2019-05-17
 	* Type __package_apk: Fix @repo handling in explorer (Nico Schottelius)
 	* Type __postfix: Add alpine support (Nico Schottelius)

From 03f8c3aaed3d106792a05e9e24e14b86f7e0414c Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sun, 19 May 2019 23:22:02 +0300
Subject: [PATCH 050/383] __acl: don't exit on missing file when dry run

---
 cdist/conf/type/__acl/gencode-remote | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index d47469c1..36eca3f8 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -20,8 +20,7 @@
 
 file_is="$( cat "$__object/explorer/file_is" )"
 
-# TODO this check is not needed with dry-run
-[ "$file_is" = 'missing' ] && exit 0
+[ "$file_is" = 'missing' ] && [ -z "$__cdist_dry_run" ] && exit 0
 
 os="$( cat "$__global/explorer/os" )"
 

From 02e10b1ffd1d1fa28586caf234f5e007dfe7e606 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sun, 19 May 2019 23:27:58 +0300
Subject: [PATCH 051/383] __acl: fix SC1117

---
 cdist/conf/type/__acl/gencode-remote | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index 36eca3f8..f5b0474f 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -48,7 +48,7 @@ do
         then
             [ "$file_is" = 'directory' ] && rep=x || rep=-
 
-            acl="$( echo "$acl" | sed "s/\(.*\)X/\1$rep/" )"
+            acl="$( echo "$acl" | sed "s/\\(.*\\)X/\\1$rep/" )"
         fi
 
         echo "$parameter" | grep -Eq '(mask|other)' && sep=:: || sep=:

From e30d76014accf5e1f0860f504c287c5ed025da9c Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sun, 19 May 2019 23:44:20 +0300
Subject: [PATCH 052/383] __acl: update man

---
 cdist/conf/type/__acl/man.rst | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst
index e6784c87..d066aae5 100644
--- a/cdist/conf/type/__acl/man.rst
+++ b/cdist/conf/type/__acl/man.rst
@@ -10,9 +10,7 @@ DESCRIPTION
 -----------
 ACL must be defined as 3-symbol combination, using ``r``, ``w``, ``x`` and ``-``.
 
-Fully supported and tested on Linux, partial support for FreeBSD.
-
-OpenBSD, NetBSD and Solaris support is not possible.
+Fully supported and tested on Linux (ext4 filesystem), partial support for FreeBSD.
 
 See ``setfacl`` and ``acl`` manpages for more details.
 

From 34eec3c214b1fbd95246e9243196173b55aee41a Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 19 May 2019 13:40:24 +0200
Subject: [PATCH 053/383] Add cdist-new-type helper scrpt

---
 bin/build-helper                   |   2 +-
 docs/changelog                     |   1 +
 docs/src/cdist-troubleshooting.rst |   3 +-
 docs/src/cdist-type.rst            |   3 +
 docs/src/index.rst                 |   1 +
 docs/src/man1/cdist-new-type.rst   |  74 ++++++++++++++
 scripts/cdist-new-type             | 159 +++++++++++++++++++++++++++++
 setup.py                           |   2 +-
 8 files changed, 242 insertions(+), 3 deletions(-)
 create mode 100644 docs/src/man1/cdist-new-type.rst
 create mode 100755 scripts/cdist-new-type

diff --git a/bin/build-helper b/bin/build-helper
index 1698a678..9a776491 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -451,7 +451,7 @@ eof
     ;;
 
     shellcheck-scripts)
-        ${SHELLCHECKCMD} scripts/cdist-dump || exit 0
+        ${SHELLCHECKCMD} scripts/cdist-dump scripts/cdist-new-type || exit 0
     ;;
 
     shellcheck-gencodes)
diff --git a/docs/changelog b/docs/changelog
index b8071ffe..acf462f2 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Type __consul: Add alpine support (Nico Schottelius)
 	* Type __consul: Add version 1.5.0 (Nico Schottelius)
 	* Type __consul_agent: Add alpine support (Nico Schottelius)
+	* New helper script: cdist-new-type (Steven Armstrong, Darko Poljak)
 
 5.0.2: 2019-05-17
 	* Type __package_apk: Fix @repo handling in explorer (Nico Schottelius)
diff --git a/docs/src/cdist-troubleshooting.rst b/docs/src/cdist-troubleshooting.rst
index 6b7fb4af..e639aafd 100644
--- a/docs/src/cdist-troubleshooting.rst
+++ b/docs/src/cdist-troubleshooting.rst
@@ -47,7 +47,8 @@ you write to use the -e flag:
 Using debug dump helper script
 ------------------------------
 Since cdist stores data to local cache that can be used for debugging there
-is a helper script that dumps data from local cache.
+is a helper script that dumps data from local cache,
+`cdist-dump <man1/cdist-dump.html>`_.
 
 For more info see:
 
diff --git a/docs/src/cdist-type.rst b/docs/src/cdist-type.rst
index 7e5e39ef..880df819 100644
--- a/docs/src/cdist-type.rst
+++ b/docs/src/cdist-type.rst
@@ -93,6 +93,9 @@ they are written in shell so they are executed using '/bin/sh -e' or 'CDIST_LOCA
 
 For executable shell code it is suggested that shebang is '#!/bin/sh -e'.
 
+For creating type skeleton you can use helper script
+`cdist-new-type <man1/cdist-new-type.html>`_.
+
 
 Defining parameters
 -------------------
diff --git a/docs/src/index.rst b/docs/src/index.rst
index 95e44d52..6cbd938a 100644
--- a/docs/src/index.rst
+++ b/docs/src/index.rst
@@ -22,6 +22,7 @@ is being used in small up to enterprise grade environments.
    cdist-real-world
    man1/cdist
    man1/cdist-dump
+   man1/cdist-new-type
    cdist-bootstrap
    cdist-configuration
    cdist-manifest
diff --git a/docs/src/man1/cdist-new-type.rst b/docs/src/man1/cdist-new-type.rst
new file mode 100644
index 00000000..f1a8b992
--- /dev/null
+++ b/docs/src/man1/cdist-new-type.rst
@@ -0,0 +1,74 @@
+cdist-new-type(1)
+=================
+
+NAME
+----
+cdist-new-type - Create new type skeleton
+
+
+SYNOPSIS
+--------
+
+::
+
+    cdist-new-type TYPE-NAME AUTHOR-NAME AUTHOR-EMAIL [TYPE-BASE-PATH]
+
+
+
+DESCRIPTION
+-----------
+cdist-new-type is a helper script that creates new type skeleton.
+It is then up to the type author to finish the type.
+
+It creates skeletons for the following files:
+
+* man.rst
+* manifest
+* gencode-remote.
+
+Upon creation it prints the path to the newly created type directory.
+
+
+ARGUMENTS
+---------
+**TYPE-NAME**
+   Name of the new type.
+
+**AUTHOR-NAME**
+   Type author's full name.
+
+**AUTHOR-NAME**
+   Type author's email.
+
+**TYPE-BASE-PATH**
+    Path to the base directory of the type. If not set it defaults
+    to '$PWD/type'.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # Create new type __foo in ~/.cdist directory.
+    $ cd ~/.cdist
+    $ cdist-new-type '__foo' 'Foo Bar' 'foo.bar at foobar.org'
+    /home/foo/.cdist/type/__foo
+
+
+SEE ALSO
+--------
+:strong:`cdist`\ (1)
+
+
+AUTHORS
+-------
+
+| Steven Armstrong <steven-cdist--@--armstrong.cc>
+| Darko Poljak <darko.poljak--@--ungleich.ch>
+
+
+COPYING
+-------
+Copyright \(C) 2019 Steven Armstrong, Darko Poljak. Free use of this software is
+granted under the terms of the GNU General Public License v3 or later (GPLv3+).
diff --git a/scripts/cdist-new-type b/scripts/cdist-new-type
new file mode 100755
index 00000000..79dcfd90
--- /dev/null
+++ b/scripts/cdist-new-type
@@ -0,0 +1,159 @@
+#!/bin/sh
+
+basename="${0##*/}"
+
+if [ $# -lt 3 ]
+then
+    printf "usage: %s TYPE-NAME AUTHOR-NAME AUTHOR-EMAIL [TYPE-BASE-PATH]
+    TYPE-NAME       Name of the type.
+    AUTHOR-NAME     Type author's full name.
+    AUTHOR-EMAIL    Type author's email.
+    TYPE-BASE-PATH  Path to the base directory of the type. If not set it defaults
+                    to '\$PWD/type'.\n" "${basename}"
+    exit 1
+fi
+
+type_name="$1"
+shift
+author_name="$1"
+shift
+author_email="$1"
+shift
+
+if [ $# -ge 1 ]
+then
+    type_base_path="$1"
+    shift
+else
+    #type_base_path=~/.cdist/type
+    type_base_path="$PWD/type"
+fi
+
+error() {
+   printf "%s\n" "$*" >&2
+}
+
+die() {
+   error "$@"
+   exit 1
+}
+
+cd "$type_base_path" || die "Could not change to type directory: $type_base_path.
+You have to specify type base path or run me from within a cdist conf directory,
+e.g. ~/.cdist."
+
+year=$(date +%Y)
+copyright="# $year $author_name ($author_email)"
+
+license="# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+"
+
+set -e
+
+mkdir "$type_name"
+cd "$type_name"
+
+### man page
+header="cdist-type${type_name}(7)"
+header_length="${#header}"
+cat >> man.rst << DONE
+$header
+$(while [ "${header_length}" -gt 0 ]; do printf "="; header_length=$((header_length - 1)); done; printf "\n";)
+
+NAME
+----
+cdist-type${type_name} - TODO
+
+
+DESCRIPTION
+-----------
+This space intentionally left blank.
+
+
+REQUIRED PARAMETERS
+-------------------
+None.
+
+
+OPTIONAL PARAMETERS
+-------------------
+None.
+
+
+BOOLEAN PARAMETERS
+------------------
+None.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # TODO
+    ${type_name}
+
+
+SEE ALSO
+--------
+:strong:\`TODO\`\\ (7)
+
+
+AUTHORS
+-------
+$author_name <$author_email>
+
+
+COPYING
+-------
+Copyright \(C) $year $author_name. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+DONE
+
+### manifest
+cat >> manifest << DONE
+#!/bin/sh -e
+#
+${copyright}
+#
+${license}
+
+os=\$(cat "\$__global/explorer/os")
+
+case "\$os" in
+   *)
+      printf "Your operating system (%s) is currently not supported by this type (%s)\n" "\$os" "\${__type##*/}" >&2
+      printf "Please contribute an implementation for it if you can.\n" >&2
+      exit 1
+   ;;
+esac
+DONE
+chmod +x manifest
+
+# gencode-remote
+cat >> gencode-remote << DONE
+#!/bin/sh -e
+#
+${copyright}
+#
+${license}
+DONE
+chmod +x gencode-remote
+
+printf "%s/%s\n" "$type_base_path" "$type_name"
diff --git a/setup.py b/setup.py
index 5f14a2f4..ae651125 100644
--- a/setup.py
+++ b/setup.py
@@ -36,7 +36,7 @@ setup(
     name="cdist",
     packages=["cdist", "cdist.core", "cdist.exec", "cdist.util", ],
     package_data={'cdist': package_data},
-    scripts=["scripts/cdist", "scripts/cdist-dump"],
+    scripts=["scripts/cdist", "scripts/cdist-dump", "scripts/cdist-new-type"],
     version=cdist.version.VERSION,
     description="A Usable Configuration Management System",
     author="Nico Schottelius",

From 4949af894e917ac57fb5365c7ea482770bb1c3ba Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 20 May 2019 18:50:25 +0200
Subject: [PATCH 054/383] Add type deprecation support.

---
 cdist/config.py                               | 11 ++++++++
 cdist/core/cdist_type.py                      | 11 ++++++++
 cdist/test/cdist_type/__init__.py             | 10 ++++++++
 .../fixtures/__deprecated/deprecated          |  0
 docs/changelog                                |  1 +
 docs/src/cdist-type.rst                       | 25 +++++++++++++++++++
 6 files changed, 58 insertions(+)
 create mode 100644 cdist/test/cdist_type/fixtures/__deprecated/deprecated

diff --git a/cdist/config.py b/cdist/config.py
index 30117382..1a0ab4d5 100644
--- a/cdist/config.py
+++ b/cdist/config.py
@@ -758,8 +758,19 @@ class Config(object):
                     ("The requirements of the following objects could not be "
                      "resolved:\n%s") % ("\n".join(info_string)))
 
+    def _handle_deprecation(self, cdist_object):
+        cdist_type = cdist_object.cdist_type
+        deprecated = cdist_type.deprecated
+        if deprecated is not None:
+            if deprecated:
+                self.log.warning("Type %s is deprecated: %s", cdist_type.name,
+                                 deprecated)
+            else:
+                self.log.warning("Type %s is deprecated.", cdist_type.name)
+
     def object_prepare(self, cdist_object, transfer_type_explorers=True):
         """Prepare object: Run type explorer + manifest"""
+        self._handle_deprecation(cdist_object)
         self.log.verbose("Preparing object {}".format(cdist_object.name))
         self.log.verbose(
             "Running manifest and explorers for " + cdist_object.name)
diff --git a/cdist/core/cdist_type.py b/cdist/core/cdist_type.py
index 99e40e70..7cabd72f 100644
--- a/cdist/core/cdist_type.py
+++ b/cdist/core/cdist_type.py
@@ -133,6 +133,17 @@ class CdistType(object):
            cannot run in parallel."""
         return os.path.isfile(os.path.join(self.absolute_path, "nonparallel"))
 
+    @property
+    def deprecated(self):
+        """Get type deprecation message. If message is None then type
+        is not deprecated."""
+        deprecated_path = os.path.join(self.absolute_path, "deprecated")
+        try:
+            with open(deprecated_path, 'r') as f:
+                return f.read()
+        except FileNotFoundError:
+            return None
+
     @property
     def explorers(self):
         """Return a list of available explorers"""
diff --git a/cdist/test/cdist_type/__init__.py b/cdist/test/cdist_type/__init__.py
index ca961170..ac84d874 100644
--- a/cdist/test/cdist_type/__init__.py
+++ b/cdist/test/cdist_type/__init__.py
@@ -123,6 +123,16 @@ class TypeTestCase(test.CdistTestCase):
         cdist_type = core.CdistType(base_path, '__not_nonparallel')
         self.assertFalse(cdist_type.is_nonparallel)
 
+    def test_deprecated(self):
+        base_path = fixtures
+        cdist_type = core.CdistType(base_path, '__deprecated')
+        self.assertIsNotNone(cdist_type.deprecated)
+
+    def test_not_deprecated(self):
+        base_path = fixtures
+        cdist_type = core.CdistType(base_path, '__not_deprecated')
+        self.assertIsNone(cdist_type.deprecated)
+
     def test_install_is_install(self):
         base_path = fixtures
         cdist_type = core.CdistType(base_path, '__install')
diff --git a/cdist/test/cdist_type/fixtures/__deprecated/deprecated b/cdist/test/cdist_type/fixtures/__deprecated/deprecated
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/changelog b/docs/changelog
index acf462f2..ba092840 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -6,6 +6,7 @@ next:
 	* Type __consul: Add version 1.5.0 (Nico Schottelius)
 	* Type __consul_agent: Add alpine support (Nico Schottelius)
 	* New helper script: cdist-new-type (Steven Armstrong, Darko Poljak)
+	* Core: Add support for deprecated type marker (Darko Poljak)
 
 5.0.2: 2019-05-17
 	* Type __package_apk: Fix @repo handling in explorer (Nico Schottelius)
diff --git a/docs/src/cdist-type.rst b/docs/src/cdist-type.rst
index 880df819..dfad6fa0 100644
--- a/docs/src/cdist-type.rst
+++ b/docs/src/cdist-type.rst
@@ -71,6 +71,31 @@ when using -j option. Example of such a type is __package_dpkg type where dpkg i
 prevents to be run in more than one instance.
 
 
+Deprecated types
+-----------------
+If a type is flagged with 'deprecated' marker then it is considered deprecated.
+Upon it's usage cdist writes warning line. If 'deprecated' marker has content
+then this content is printed as a deprecation messages, e.g.:
+
+.. code-block:: sh
+
+    $ ls -l deprecated 
+    -rw-r--r--  1 darko  darko  71 May 20 18:30 deprecated
+    $ cat deprecated 
+    This type is deprecated. It will be removed in the next minor release.
+    $ echo '__foo foo' | ./bin/cdist config -i - 185.203.112.26
+    WARNING: 185.203.112.26: Type __foo is deprecated: This type is deprecated. It will be removed in the next minor release.
+
+If 'deprecated' marker has no content then general message is printed, e.g.:
+
+.. code-block:: sh
+
+    $ ls -l deprecated 
+    -rw-r--r--  1 darko  darko  0 May 20 18:36 deprecated
+    $ echo '__bar foo' | ./bin/cdist config -i - 185.203.112.26
+    WARNING: 185.203.112.26: Type __bar is deprecated.
+
+
 How to write a new type
 -----------------------
 A type consists of

From c58ae44409b7170ee44187eb3622612baf91ac51 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 22 May 2019 18:34:31 +0200
Subject: [PATCH 055/383] Release 5.1.0

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index ba092840..86ac6c9e 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+5.1.0: 2019-05-22
 	* Type __consul: Add alpine support (Nico Schottelius)
 	* Type __consul: Add version 1.5.0 (Nico Schottelius)
 	* Type __consul_agent: Add alpine support (Nico Schottelius)

From 1d57305d359fd773a540adcec8116d785f51e9db Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sat, 25 May 2019 15:58:39 +0200
Subject: [PATCH 056/383] Use gpg key, fallback to deprecated apt-key

Fixes #762
---
 cdist/conf/type/__apt_key/explorer/state      | 18 ++++-
 cdist/conf/type/__apt_key/gencode-remote      | 76 ++++++++++++++++++-
 cdist/conf/type/__apt_key/man.rst             | 17 ++++-
 cdist/conf/type/__apt_key/manifest            |  8 ++
 .../type/__apt_key/parameter/default/keydir   |  1 +
 cdist/conf/type/__apt_key/parameter/optional  |  2 +
 6 files changed, 114 insertions(+), 8 deletions(-)
 create mode 100755 cdist/conf/type/__apt_key/manifest
 create mode 100644 cdist/conf/type/__apt_key/parameter/default/keydir

diff --git a/cdist/conf/type/__apt_key/explorer/state b/cdist/conf/type/__apt_key/explorer/state
index f7940741..38f1bd3c 100755
--- a/cdist/conf/type/__apt_key/explorer/state
+++ b/cdist/conf/type/__apt_key/explorer/state
@@ -27,6 +27,18 @@ else
    keyid="$__object_id"
 fi
 
-apt-key export "$keyid" | head -n 1 | grep -Fqe "BEGIN PGP PUBLIC KEY BLOCK" \
-   && echo present \
-   || echo absent
+keydir="$(cat "$__object/parameter/keydir")"
+keyfile="$keydir/$__object_id.gpg"
+
+if [ -d "$keydir" ]
+then
+   if [ -f "$keyfile" ]
+   then echo present
+   else echo absent
+   fi
+else
+   # fallback to deprecated apt-key
+   apt-key export "$keyid" | head -n 1 | grep -Fqe "BEGIN PGP PUBLIC KEY BLOCK" \
+      && echo present \
+      || echo absent
+fi
diff --git a/cdist/conf/type/__apt_key/gencode-remote b/cdist/conf/type/__apt_key/gencode-remote
index 9c4fa00c..47c8bb49 100755
--- a/cdist/conf/type/__apt_key/gencode-remote
+++ b/cdist/conf/type/__apt_key/gencode-remote
@@ -31,12 +31,84 @@ if [ "$state_should" = "$state_is" ]; then
    exit 0
 fi
 
+keydir="$(cat "$__object/parameter/keydir")"
+keyfile="$keydir/$__object_id.gpg"
+
 case "$state_should" in
    present)
       keyserver="$(cat "$__object/parameter/keyserver")"
-      echo "apt-key adv --keyserver \"$keyserver\" --recv-keys \"$keyid\""
+
+      if [ -f "$__object/parameter/uri" ]; then
+         uri="$(cat "$__object/parameter/uri")"
+
+         if [ -d "$keydir" ]; then
+            cat << EOF
+
+curl -s -L \\
+    -o "$keyfile" \\
+    "$uri"
+
+if grep -Fq 'BEGIN PGP PUBLIC KEY BLOCK' \\
+    "$keyfile"
+then
+    cat "$keyfile" \\
+        | gpg --export > "$keyfile"
+fi
+
+EOF
+         else
+            # fallback to deprecated apt-key
+            echo "curl -s -L '$uri' | apt-key add -"
+         fi
+      elif [ -d "$keydir" ]; then
+         tmp='/tmp/cdist_apt_key_tmp'
+
+         # we need to kill gpg after 30 seconds, because gpg
+         # can get stuck if keyserver is not responding.
+         # exporting env var and not exit 1,
+         # because we need to clean up and kill dirmngr.
+         cat << EOF
+
+mkdir -m 700 -p "$tmp"
+
+if timeout 30s \\
+    gpg --homedir "$tmp" \\
+        --keyserver "$keyserver" \\
+        --recv-keys "$keyid"
+then
+    gpg --homedir "$tmp" \\
+        --export "$keyid" \\
+        > "$keyfile"
+else
+    export GPG_GOT_STUCK=1
+fi
+
+GNUPGHOME="$tmp" gpgconf --kill dirmngr
+
+rm -rf "$tmp"
+
+if [ -n "\$GPG_GOT_STUCK" ]
+then
+    echo "GPG GOT STUCK - no response from keyserver after 30 seconds" >&2
+    exit 1
+fi
+
+EOF
+      else
+         # fallback to deprecated apt-key
+         echo "apt-key adv --keyserver \"$keyserver\" --recv-keys \"$keyid\""
+      fi
+
+      echo "added '$keyid'" >> "$__messages_out"
    ;;
    absent)
-      echo "apt-key del \"$keyid\""
+      if [ -f "$keyfile" ]; then
+         echo "rm '$keyfile'"
+      else
+         # fallback to deprecated apt-key
+         echo "apt-key del \"$keyid\""
+      fi
+
+      echo "removed '$keyid'" >> "$__messages_out"
    ;;
 esac
diff --git a/cdist/conf/type/__apt_key/man.rst b/cdist/conf/type/__apt_key/man.rst
index 9009877e..234bc715 100644
--- a/cdist/conf/type/__apt_key/man.rst
+++ b/cdist/conf/type/__apt_key/man.rst
@@ -28,6 +28,12 @@ keyserver
    the keyserver from which to fetch the key. If omitted the default set
    in ./parameter/default/keyserver is used.
 
+keydir
+   key save location, defaults to ``/etc/apt/trusted.pgp.d``
+
+uri
+   the URI from which to download the key
+
 
 EXAMPLES
 --------
@@ -47,15 +53,20 @@ EXAMPLES
     # same thing with other keyserver
     __apt_key UbuntuArchiveKey --keyid 437D05B5 --keyserver keyserver.ubuntu.com
 
+    # download key from the internet
+    __apt_key rabbitmq \
+       --uri http://www.rabbitmq.com/rabbitmq-signing-key-public.asc
+
 
 AUTHORS
 -------
 Steven Armstrong <steven-cdist--@--armstrong.cc>
+Ander Punnar <ander-at-kvlt-dot-ee>
 
 
 COPYING
 -------
-Copyright \(C) 2011-2014 Steven Armstrong. You can redistribute it
-and/or modify it under the terms of the GNU General Public License as
-published by the Free Software Foundation, either version 3 of the
+Copyright \(C) 2011-2019 Steven Armstrong and Ander Punnar. You can
+redistribute it and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation, either version 3 of the
 License, or (at your option) any later version.
diff --git a/cdist/conf/type/__apt_key/manifest b/cdist/conf/type/__apt_key/manifest
new file mode 100755
index 00000000..010357cd
--- /dev/null
+++ b/cdist/conf/type/__apt_key/manifest
@@ -0,0 +1,8 @@
+#!/bin/sh -e
+
+__package gnupg
+
+if [ -f "$__object/parameter/uri" ]
+then __package curl
+else __package dirmngr
+fi
diff --git a/cdist/conf/type/__apt_key/parameter/default/keydir b/cdist/conf/type/__apt_key/parameter/default/keydir
new file mode 100644
index 00000000..190eb2de
--- /dev/null
+++ b/cdist/conf/type/__apt_key/parameter/default/keydir
@@ -0,0 +1 @@
+/etc/apt/trusted.gpg.d
diff --git a/cdist/conf/type/__apt_key/parameter/optional b/cdist/conf/type/__apt_key/parameter/optional
index 18cf2586..de647375 100644
--- a/cdist/conf/type/__apt_key/parameter/optional
+++ b/cdist/conf/type/__apt_key/parameter/optional
@@ -1,3 +1,5 @@
 state
 keyid
 keyserver
+keydir
+uri

From 520cfeda989fbcaf12706a3540a9267ad23afdee Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 25 May 2019 16:10:18 +0200
Subject: [PATCH 057/383] ++

---
 docs/changelog | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 86ac6c9e..66140bb1 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,10 @@
 Changelog
 ---------
 
+next:
+	* Type __apt_key: Use gpg key, fallback to deprecated apt-key (Ander Punnar)
+	* Type __acl: Fix and improve (Ander Punnar)
+
 5.1.0: 2019-05-22
 	* Type __consul: Add alpine support (Nico Schottelius)
 	* Type __consul: Add version 1.5.0 (Nico Schottelius)

From 68837e45cc768fed8a891d22c60cde4ecb3ed62b Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 25 May 2019 19:19:47 +0200
Subject: [PATCH 058/383] Document type stdin inside loop caveats

---
 docs/changelog          |  1 +
 docs/src/cdist-type.rst | 67 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 66140bb1..1cded1f9 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* Type __apt_key: Use gpg key, fallback to deprecated apt-key (Ander Punnar)
 	* Type __acl: Fix and improve (Ander Punnar)
+	* Documentation: Document type stdin inside loop caveats (Darko Poljak)
 
 5.1.0: 2019-05-22
 	* Type __consul: Add alpine support (Nico Schottelius)
diff --git a/docs/src/cdist-type.rst b/docs/src/cdist-type.rst
index dfad6fa0..6cf83258 100644
--- a/docs/src/cdist-type.rst
+++ b/docs/src/cdist-type.rst
@@ -216,6 +216,73 @@ In the __file type, stdin is used as source for the file, if - is used for sourc
     ....
 
 
+Stdin inside a loop
+~~~~~~~~~~~~~~~~~~~
+Since cdist saves type's stdin content in the object as **$__object/stdin**,
+so it can be accessed in manifest and gencode-* scripts, this can lead to
+unexpected behavior. For example, suppose you have some type with the following
+in its manifest:
+
+.. code-block:: sh
+
+    if [ -f "$__object/parameter/foo" ]
+    then
+        while read -r l
+        do
+            __file "$l"
+            echo "$l" >&2
+        done < "$__object/parameter/foo"
+    fi
+
+and init manifest:
+
+.. code-block:: sh
+
+    __foo foo --foo a --foo b --foo c
+
+You expect that manifest stderr content is:
+
+.. code-block:: sh
+
+    a
+    b
+    c
+
+and that files *a*, *b* and *c* are created. But all you get in manifest stderr
+is:
+
+.. code-block:: sh
+
+    a
+
+and only *a* file is created.
+
+When redirecting parameter *foo* file content to while's stdin that means that all
+commands in while body have this same stdin. So when *__file* type gets executed,
+cdist saves its stdin which means it gets the remaining content of parameter *foo*
+file, i.e.:
+
+.. code-block:: sh
+
+    b
+    c
+
+The solution is to make sure that your types inside such loops get their stdin
+from somewhere else, e.g. for the above problem *__file* type can get empty
+stdin from */dev/null*:
+
+.. code-block:: sh
+
+    if [ -f "$__object/parameter/foo" ]
+    then
+        while read -r l
+        do
+            __file "$l" < /dev/null
+            echo "$l" >&2
+        done < "$__object/parameter/foo"
+    fi
+
+
 Writing the manifest
 --------------------
 In the manifest of a type you can use other types, so your type extends

From 8315677ad1fc6dff6e10cb78754cbb5748340811 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 28 May 2019 17:53:34 +0200
Subject: [PATCH 059/383] Release 5.1.1

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 1cded1f9..2f20fd84 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+5.1.1: 2019-05-28
 	* Type __apt_key: Use gpg key, fallback to deprecated apt-key (Ander Punnar)
 	* Type __acl: Fix and improve (Ander Punnar)
 	* Documentation: Document type stdin inside loop caveats (Darko Poljak)

From 55ba49efacc962d3233e28483b4237059356f887 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 19 Jun 2019 18:19:32 +0200
Subject: [PATCH 060/383] Add support for deprecated type parameters

---
 cdist/config.py                               |  5 ++++
 cdist/core/cdist_type.py                      | 21 ++++++++++++++++
 cdist/test/cdist_type/__init__.py             | 12 ++++++++++
 .../__with_deprecated_parameters/deprecated   |  0
 .../parameter/deprecated                      |  2 ++
 .../parameter/optional                        |  4 ++++
 docs/src/cdist-type.rst                       | 24 ++++++++++++++++++-
 7 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 cdist/test/cdist_type/fixtures/__with_deprecated_parameters/deprecated
 create mode 100644 cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated
 create mode 100644 cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/optional

diff --git a/cdist/config.py b/cdist/config.py
index 1a0ab4d5..6622823b 100644
--- a/cdist/config.py
+++ b/cdist/config.py
@@ -767,6 +767,11 @@ class Config(object):
                                  deprecated)
             else:
                 self.log.warning("Type %s is deprecated.", cdist_type.name)
+        for param in cdist_object.parameters:
+            if param in cdist_type.deprecated_parameters:
+                self.log.warning(("%s parameter of type %s is deprecated, "
+                                  "see man page for details"),
+                                 param, cdist_type.name)
 
     def object_prepare(self, cdist_object, transfer_type_explorers=True):
         """Prepare object: Run type explorer + manifest"""
diff --git a/cdist/core/cdist_type.py b/cdist/core/cdist_type.py
index 7cabd72f..48926a03 100644
--- a/cdist/core/cdist_type.py
+++ b/cdist/core/cdist_type.py
@@ -69,6 +69,7 @@ class CdistType(object):
         self.__optional_multiple_parameters = None
         self.__boolean_parameters = None
         self.__parameter_defaults = None
+        self.__deprecated_parameters = None
 
     def __hash__(self):
         return hash(self.name)
@@ -275,3 +276,23 @@ class CdistType(object):
             finally:
                 self.__parameter_defaults = defaults
         return self.__parameter_defaults
+
+    @property
+    def deprecated_parameters(self):
+        """Return a list of deprecated parameters"""
+        if not self.__deprecated_parameters:
+            parameters = []
+            try:
+                with open(os.path.join(self.absolute_path,
+                                       "parameter",
+                                       "deprecated")) as fd:
+                    for line in fd:
+                        line = line.strip()
+                        if line:
+                            parameters.append(line)
+            except EnvironmentError:
+                # error ignored
+                pass
+            finally:
+                self.__deprecated_parameters = parameters
+        return self.__deprecated_parameters
diff --git a/cdist/test/cdist_type/__init__.py b/cdist/test/cdist_type/__init__.py
index ac84d874..9eee395c 100644
--- a/cdist/test/cdist_type/__init__.py
+++ b/cdist/test/cdist_type/__init__.py
@@ -200,3 +200,15 @@ class TypeTestCase(test.CdistTestCase):
         self.assertEqual(
             list(sorted(cdist_type.parameter_defaults.keys())),
             ['bar', 'foo'])
+
+    def test_without_deprecated_parameters(self):
+        base_path = fixtures
+        cdist_type = core.CdistType(base_path,
+                                    '__without_deprecated_parameters')
+        self.assertEqual(cdist_type.deprecated_parameters, [])
+
+    def test_with_deprecated_parameters(self):
+        base_path = fixtures
+        cdist_type = core.CdistType(base_path, '__with_deprecated_parameters')
+        self.assertEqual(cdist_type.deprecated_parameters,
+                         ['eggs', 'spam'])
diff --git a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/deprecated b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/deprecated
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated
new file mode 100644
index 00000000..81830edb
--- /dev/null
+++ b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated
@@ -0,0 +1,2 @@
+eggs
+spam
diff --git a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/optional b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/optional
new file mode 100644
index 00000000..7c804d5f
--- /dev/null
+++ b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/optional
@@ -0,0 +1,4 @@
+spam
+eggs
+sausage
+spam
diff --git a/docs/src/cdist-type.rst b/docs/src/cdist-type.rst
index 6cf83258..623ba481 100644
--- a/docs/src/cdist-type.rst
+++ b/docs/src/cdist-type.rst
@@ -74,7 +74,7 @@ prevents to be run in more than one instance.
 Deprecated types
 -----------------
 If a type is flagged with 'deprecated' marker then it is considered deprecated.
-Upon it's usage cdist writes warning line. If 'deprecated' marker has content
+When it is used cdist writes warning line. If 'deprecated' marker has content
 then this content is printed as a deprecation messages, e.g.:
 
 .. code-block:: sh
@@ -186,6 +186,28 @@ Example: (e.g. in cdist/conf/type/__nginx_vhost/manifest)
     fi
 
 
+Deprecated parameters
+---------------------
+To deprecate type parameters one can declare a newline separated file
+**parameter/deprecated** where each line contains deprecated parameter.
+When it is used cdist writes warning line, e.g.:
+
+.. code-block:: sh
+
+    $ cat parameter/optional_multiple
+    foo
+    spam
+    eggs
+    $ cat parameter/deprecated
+    spam
+    eggs
+    $ echo '__foo foo --foo foo --spam spam' | ./bin/cdist config -i - 185.203.112.26
+    WARNING: 185.203.112.26: spam parameter of type __foo is deprecated, see man page for details
+    $ echo '__foo foo --foo foo --eggs eggs --spam spam' | ./bin/cdist config -i - 185.203.112.26
+    WARNING: 185.203.112.26: spam parameter of type __foo is deprecated, see man page for details
+    WARNING: 185.203.112.26: eggs parameter of type __foo is deprecated, see man page for details
+
+
 Input from stdin
 ----------------
 Every type can access what has been written on stdin when it has been called.

From 3cb4e76175c06370cc7b69a326c9ae1c6c0b0c37 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 19 Jun 2019 18:19:32 +0200
Subject: [PATCH 061/383] Allow custom message for each deprecated parameter

---
 cdist/config.py                               | 11 +++++--
 cdist/core/cdist_type.py                      | 24 +++++++-------
 cdist/test/cdist_type/__init__.py             |  9 ++++--
 .../parameter/deprecated                      |  2 --
 .../parameter/deprecated/eggs                 |  1 +
 .../{deprecated => parameter/deprecated/spam} |  0
 .../parameter/optional                        |  1 -
 docs/src/cdist-type.rst                       | 31 ++++++++++---------
 8 files changed, 44 insertions(+), 35 deletions(-)
 delete mode 100644 cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated
 create mode 100644 cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated/eggs
 rename cdist/test/cdist_type/fixtures/__with_deprecated_parameters/{deprecated => parameter/deprecated/spam} (100%)

diff --git a/cdist/config.py b/cdist/config.py
index 6622823b..26d07fc4 100644
--- a/cdist/config.py
+++ b/cdist/config.py
@@ -769,9 +769,14 @@ class Config(object):
                 self.log.warning("Type %s is deprecated.", cdist_type.name)
         for param in cdist_object.parameters:
             if param in cdist_type.deprecated_parameters:
-                self.log.warning(("%s parameter of type %s is deprecated, "
-                                  "see man page for details"),
-                                 param, cdist_type.name)
+                msg = cdist_type.deprecated_parameters[param]
+                if msg:
+                    format = "%s parameter of type %s is deprecated: %s"
+                    args = [param, cdist_type.name, msg]
+                else:
+                    format = "%s parameter of type %s is deprecated."
+                    args = [param, cdist_type.name]
+                self.log.warning(format, *args)
 
     def object_prepare(self, cdist_object, transfer_type_explorers=True):
         """Prepare object: Run type explorer + manifest"""
diff --git a/cdist/core/cdist_type.py b/cdist/core/cdist_type.py
index 48926a03..4500f50d 100644
--- a/cdist/core/cdist_type.py
+++ b/cdist/core/cdist_type.py
@@ -279,20 +279,20 @@ class CdistType(object):
 
     @property
     def deprecated_parameters(self):
-        """Return a list of deprecated parameters"""
         if not self.__deprecated_parameters:
-            parameters = []
+            deprecated = {}
             try:
-                with open(os.path.join(self.absolute_path,
-                                       "parameter",
-                                       "deprecated")) as fd:
-                    for line in fd:
-                        line = line.strip()
-                        if line:
-                            parameters.append(line)
+                deprecated_dir = os.path.join(self.absolute_path,
+                                              "parameter",
+                                              "deprecated")
+                for name in cdist.core.listdir(deprecated_dir):
+                    try:
+                        with open(os.path.join(deprecated_dir, name)) as fd:
+                            deprecated[name] = fd.read().strip()
+                    except EnvironmentError:
+                        pass  # Swallow errors raised by open() or read()
             except EnvironmentError:
-                # error ignored
-                pass
+                pass  # Swallow error raised by os.listdir()
             finally:
-                self.__deprecated_parameters = parameters
+                self.__deprecated_parameters = deprecated
         return self.__deprecated_parameters
diff --git a/cdist/test/cdist_type/__init__.py b/cdist/test/cdist_type/__init__.py
index 9eee395c..a51a1e6f 100644
--- a/cdist/test/cdist_type/__init__.py
+++ b/cdist/test/cdist_type/__init__.py
@@ -205,10 +205,13 @@ class TypeTestCase(test.CdistTestCase):
         base_path = fixtures
         cdist_type = core.CdistType(base_path,
                                     '__without_deprecated_parameters')
-        self.assertEqual(cdist_type.deprecated_parameters, [])
+        self.assertEqual(cdist_type.deprecated_parameters, {})
 
     def test_with_deprecated_parameters(self):
         base_path = fixtures
         cdist_type = core.CdistType(base_path, '__with_deprecated_parameters')
-        self.assertEqual(cdist_type.deprecated_parameters,
-                         ['eggs', 'spam'])
+        self.assertTrue('eggs' in cdist_type.deprecated_parameters)
+        self.assertTrue('spam' in cdist_type.deprecated_parameters)
+        self.assertEqual(cdist_type.deprecated_parameters['eggs'],
+                         'Deprecated')
+        self.assertEqual(cdist_type.deprecated_parameters['spam'], '')
diff --git a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated
deleted file mode 100644
index 81830edb..00000000
--- a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated
+++ /dev/null
@@ -1,2 +0,0 @@
-eggs
-spam
diff --git a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated/eggs b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated/eggs
new file mode 100644
index 00000000..69d9f456
--- /dev/null
+++ b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated/eggs
@@ -0,0 +1 @@
+Deprecated
diff --git a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/deprecated b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated/spam
similarity index 100%
rename from cdist/test/cdist_type/fixtures/__with_deprecated_parameters/deprecated
rename to cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/deprecated/spam
diff --git a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/optional b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/optional
index 7c804d5f..bfe09199 100644
--- a/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/optional
+++ b/cdist/test/cdist_type/fixtures/__with_deprecated_parameters/parameter/optional
@@ -1,4 +1,3 @@
 spam
 eggs
 sausage
-spam
diff --git a/docs/src/cdist-type.rst b/docs/src/cdist-type.rst
index 623ba481..582c0938 100644
--- a/docs/src/cdist-type.rst
+++ b/docs/src/cdist-type.rst
@@ -188,24 +188,27 @@ Example: (e.g. in cdist/conf/type/__nginx_vhost/manifest)
 
 Deprecated parameters
 ---------------------
-To deprecate type parameters one can declare a newline separated file
-**parameter/deprecated** where each line contains deprecated parameter.
-When it is used cdist writes warning line, e.g.:
+To deprecate type parameters one can declare a file for each deprecated
+parameter under **parameter/deprecated** directory.
+
+When such parameter is used cdist writes warning line with deprecation message.
+If such file has content then this content is printed as deprecation message.
+If there is no content then generic parameter deprecation message is printed.
+
+Example:
 
 .. code-block:: sh
 
-    $ cat parameter/optional_multiple
-    foo
-    spam
-    eggs
-    $ cat parameter/deprecated
-    spam
-    eggs
-    $ echo '__foo foo --foo foo --spam spam' | ./bin/cdist config -i - 185.203.112.26
-    WARNING: 185.203.112.26: spam parameter of type __foo is deprecated, see man page for details
+    $ ls parameter/deprecated/
+    eggs    spam
+    $ cat parameter/deprecated/eggs
+    eggs parameter is deprecated, please use multiple egg parameter.
+    $ cat parameter/deprecated/spam
+    $ echo '__foo foo --foo foo --eggs eggs' | ./bin/cdist config -i - 185.203.112.26
+    WARNING: 185.203.112.26: eggs parameter of type __foo is deprecated: eggs parameter is deprecated, please use multiple egg parameter.
     $ echo '__foo foo --foo foo --eggs eggs --spam spam' | ./bin/cdist config -i - 185.203.112.26
-    WARNING: 185.203.112.26: spam parameter of type __foo is deprecated, see man page for details
-    WARNING: 185.203.112.26: eggs parameter of type __foo is deprecated, see man page for details
+    WARNING: 185.203.112.26: spam parameter of type __foo is deprecated.
+    WARNING: 185.203.112.26: eggs parameter of type __foo is deprecated: eggs parameter is deprecated, please use multiple egg parameter.
 
 
 Input from stdin

From d723f60673c35b91017319a6699c53e3d0f38425 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 20 Jun 2019 18:12:50 +0200
Subject: [PATCH 062/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 2f20fd84..a79b116d 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Core: Add support for type parameters deprecation (Darko Poljak)
+
 5.1.1: 2019-05-28
 	* Type __apt_key: Use gpg key, fallback to deprecated apt-key (Ander Punnar)
 	* Type __acl: Fix and improve (Ander Punnar)

From 91a6ecc70173638aae928ddadabd93d9d46f097e Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Thu, 30 May 2019 23:04:46 +0300
Subject: [PATCH 063/383] __acl: rewrite

---
 cdist/conf/type/__acl/explorer/checks         | 32 ++++------
 cdist/conf/type/__acl/gencode-remote          | 54 ++++++++---------
 cdist/conf/type/__acl/man.rst                 | 59 ++++++++++---------
 cdist/conf/type/__acl/parameter/optional      |  2 -
 .../type/__acl/parameter/optional_multiple    |  2 -
 .../type/__acl/parameter/required_multiple    |  1 +
 6 files changed, 66 insertions(+), 84 deletions(-)
 delete mode 100644 cdist/conf/type/__acl/parameter/optional
 delete mode 100644 cdist/conf/type/__acl/parameter/optional_multiple
 create mode 100644 cdist/conf/type/__acl/parameter/required_multiple

diff --git a/cdist/conf/type/__acl/explorer/checks b/cdist/conf/type/__acl/explorer/checks
index a2fcf44d..5b379a08 100755
--- a/cdist/conf/type/__acl/explorer/checks
+++ b/cdist/conf/type/__acl/explorer/checks
@@ -20,29 +20,17 @@
 
 # TODO check if filesystem has ACL turned on etc
 
-for parameter in user group
+grep -E '^(default:)?(user|group):' "$__object/parameter/acl" \
+| while read -r acl
 do
-    if [ ! -f "$__object/parameter/$parameter" ]
+    param="$( echo "$acl" | awk -F: '{print $(NF-2)}' )"
+    check="$( echo "$acl" | awk -F: '{print $(NF-1)}' )"
+
+    [ "$param" = 'user' ] && db=passwd || db="$param"
+
+    if ! getent "$db" "$check" > /dev/null
     then
-        continue
+        echo "missing $param '$check'" >&2
+        exit 1
     fi
-
-    while read -r acl
-    do
-        check="$( echo "$acl" | awk -F: '{print $1}' )"
-
-        if [ "$parameter" = 'user' ]
-        then
-            getent_db=passwd
-        else
-            getent_db="$parameter"
-        fi
-
-        if ! getent "$getent_db" "$check" > /dev/null
-        then
-            echo "missing $parameter '$check'" >&2
-            exit 1
-        fi
-    done \
-        < "$__object/parameter/$parameter"
 done
diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index f5b0474f..3c7085f0 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -24,41 +24,35 @@ file_is="$( cat "$__object/explorer/file_is" )"
 
 os="$( cat "$__global/explorer/os" )"
 
-acl_is="$( cat "$__object/explorer/acl_is" )"
-
 acl_path="/$__object_id"
 
-if [ -f "$__object/parameter/default" ] && [ "$file_is" = 'directory' ]
+acl_is="$( cat "$__object/explorer/acl_is" )"
+
+acl_should="$( cat "$__object/parameter/acl" )"
+
+if [ -f "$__object/parameter/default" ]
 then
-    set_default=1
-else
-    set_default=0
+    acl_should="$( echo "$acl_should" \
+        | sed 's/^default://' \
+        | sort -u \
+        | sed 's/\(.*\)/default:\1\n\1/' )"
 fi
 
-acl_should="$( for parameter in user group mask other
-do
-    if [ ! -f "$__object/parameter/$parameter" ]
-    then
-        continue
-    fi
+if [ "$file_is" = 'regular' ] \
+    && echo "$acl_should" | grep -Eq '^default:'
+then
+    # only directories can have default ACLs,
+    # but instead of error,
+    # let's just remove default entries
+    acl_should="$( echo "$acl_should" | grep -Ev '^default:' )"
+fi
 
-    while read -r acl
-    do
-        if echo "$acl" | awk -F: '{ print $NF }' | grep -Fq 'X'
-        then
-            [ "$file_is" = 'directory' ] && rep=x || rep=-
+if echo "$acl_should" | awk -F: '{ print $NF }' | grep -Fq 'X'
+then
+    [ "$file_is" = 'directory' ] && rep=x || rep=-
 
-            acl="$( echo "$acl" | sed "s/\\(.*\\)X/\\1$rep/" )"
-        fi
-
-        echo "$parameter" | grep -Eq '(mask|other)' && sep=:: || sep=:
-
-        echo "$parameter$sep$acl"
-
-        [ "$set_default" = '1' ] && echo "default:$parameter$sep$acl"
-    done \
-        < "$__object/parameter/$parameter"
-done )"
+    acl_should="$( echo "$acl_should" | sed "s/\\(.*\\)X/\\1$rep/" )"
+fi
 
 setfacl_exec='setfacl'
 
@@ -76,7 +70,7 @@ if [ -f "$__object/parameter/remove" ]
 then
     echo "$acl_is" | while read -r acl
     do
-        # Skip wanted ACL entries which already exist
+        # skip wanted ACL entries which already exist
         # and skip mask and other entries, because we
         # can't actually remove them, but only change.
         if echo "$acl_should" | grep -Eq "^$acl" \
@@ -103,7 +97,7 @@ do
         if echo "$os" | grep -Fq 'freebsd' \
             && echo "$acl" | grep -Eq '^default:'
         then
-            echo "setting default ACL in $os is currently not supported. sorry :(" >&2
+            echo "setting default ACL in $os is currently not supported" >&2
         else
             echo "$setfacl_exec -m \"$acl\" \"$acl_path\""
             echo "added '$acl'" >> "$__messages_out"
diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst
index d066aae5..a71e0d3c 100644
--- a/cdist/conf/type/__acl/man.rst
+++ b/cdist/conf/type/__acl/man.rst
@@ -8,42 +8,30 @@ cdist-type__acl - Set ACL entries
 
 DESCRIPTION
 -----------
-ACL must be defined as 3-symbol combination, using ``r``, ``w``, ``x`` and ``-``.
-
 Fully supported and tested on Linux (ext4 filesystem), partial support for FreeBSD.
 
 See ``setfacl`` and ``acl`` manpages for more details.
 
 
-OPTIONAL MULTIPLE PARAMETERS
+REQUIRED MULTIPLE PARAMETERS
 ----------------------------
-user
-   Add user ACL entry.
-
-group
-   Add group ACL entry.
-
-
-OPTIONAL PARAMETERS
--------------------
-mask
-   Add mask ACL entry.
-
-other
-   Add other ACL entry.
+acl
+   Set ACL entry following ``getfacl`` output syntax.
 
 
 BOOLEAN PARAMETERS
 ------------------
+default
+   Set all ACL entries as default too.
+   Only directories can have default ACLs.
+   Setting default ACL in FreeBSD is currently not supported.
+
 recursive
    Make ``setfacl`` recursive (Linux only), but not ``getfacl`` in explorer.
 
-default
-   Add default ACL entries (FreeBSD not supported).
-
 remove
-   Remove undefined ACL entries (Solaris not supported).
-   ACL entries for ``mask`` and ``other`` can't be removed.
+   Remove undefined ACL entries.
+   ``mask`` and ``other`` entries can't be removed, but only changed.
 
 
 EXAMPLES
@@ -52,15 +40,30 @@ EXAMPLES
 .. code-block:: sh
 
     __acl /srv/project \
+        --default \
         --recursive \
+        --remove \
+        --acl user:alice:rwx \
+        --acl user:bob:r-x \
+        --acl group:project-group:rwx \
+        --acl group:some-other-group:r-x \
+        --acl mask::r-x \
+        --acl other::r-x
+
+    # give Alice read-only access to subdir,
+    # but don't allow her to see parent content.
+
+    __acl /srv/project2 \
+        --remove \
+        --acl default:group:secret-project:rwx \
+        --acl group:secret-project:rwx \
+        --acl user:alice:--x
+
+    __acl /srv/project2/subdir \
         --default \
         --remove \
-        --user alice:rwx \
-        --user bob:r-x \
-        --group project-group:rwx \
-        --group some-other-group:r-x \
-        --mask r-x \
-        --other r-x
+        --acl group:secret-project:rwx \
+        --acl user:alice:r-x
 
 
 AUTHORS
diff --git a/cdist/conf/type/__acl/parameter/optional b/cdist/conf/type/__acl/parameter/optional
deleted file mode 100644
index 4b32086b..00000000
--- a/cdist/conf/type/__acl/parameter/optional
+++ /dev/null
@@ -1,2 +0,0 @@
-mask
-other
diff --git a/cdist/conf/type/__acl/parameter/optional_multiple b/cdist/conf/type/__acl/parameter/optional_multiple
deleted file mode 100644
index 22f5a52c..00000000
--- a/cdist/conf/type/__acl/parameter/optional_multiple
+++ /dev/null
@@ -1,2 +0,0 @@
-user
-group
diff --git a/cdist/conf/type/__acl/parameter/required_multiple b/cdist/conf/type/__acl/parameter/required_multiple
new file mode 100644
index 00000000..39fead3b
--- /dev/null
+++ b/cdist/conf/type/__acl/parameter/required_multiple
@@ -0,0 +1 @@
+acl

From a5df0badaf1d38bc0f47e3e30bfd9f2e683677d1 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sun, 16 Jun 2019 15:18:39 +0300
Subject: [PATCH 064/383] __acl: add compatibility for deprecated parameters

---
 cdist/conf/type/__acl/explorer/checks         | 27 ++++++++++---------
 cdist/conf/type/__acl/gencode-remote          | 22 ++++++++++++++-
 cdist/conf/type/__acl/man.rst                 |  6 +++++
 cdist/conf/type/__acl/parameter/optional      |  2 ++
 .../type/__acl/parameter/optional_multiple    |  3 +++
 .../type/__acl/parameter/required_multiple    |  1 -
 6 files changed, 47 insertions(+), 14 deletions(-)
 create mode 100644 cdist/conf/type/__acl/parameter/optional
 create mode 100644 cdist/conf/type/__acl/parameter/optional_multiple
 delete mode 100644 cdist/conf/type/__acl/parameter/required_multiple

diff --git a/cdist/conf/type/__acl/explorer/checks b/cdist/conf/type/__acl/explorer/checks
index 5b379a08..70bb0412 100755
--- a/cdist/conf/type/__acl/explorer/checks
+++ b/cdist/conf/type/__acl/explorer/checks
@@ -20,17 +20,20 @@
 
 # TODO check if filesystem has ACL turned on etc
 
-grep -E '^(default:)?(user|group):' "$__object/parameter/acl" \
-| while read -r acl
-do
-    param="$( echo "$acl" | awk -F: '{print $(NF-2)}' )"
-    check="$( echo "$acl" | awk -F: '{print $(NF-1)}' )"
+if [ -f "$__object/parameter/acl" ]
+then
+    grep -E '^(default:)?(user|group):' "$__object/parameter/acl" \
+    | while read -r acl
+    do
+        param="$( echo "$acl" | awk -F: '{print $(NF-2)}' )"
+        check="$( echo "$acl" | awk -F: '{print $(NF-1)}' )"
 
-    [ "$param" = 'user' ] && db=passwd || db="$param"
+        [ "$param" = 'user' ] && db=passwd || db="$param"
 
-    if ! getent "$db" "$check" > /dev/null
-    then
-        echo "missing $param '$check'" >&2
-        exit 1
-    fi
-done
+        if ! getent "$db" "$check" > /dev/null
+        then
+            echo "missing $param '$check'" >&2
+            exit 1
+        fi
+    done
+fi
diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index 3c7085f0..6dab4d09 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -28,7 +28,27 @@ acl_path="/$__object_id"
 
 acl_is="$( cat "$__object/explorer/acl_is" )"
 
-acl_should="$( cat "$__object/parameter/acl" )"
+if [ -f "$__object/parameter/acl" ]
+then
+    acl_should="$( cat "$__object/parameter/acl" )"
+elif
+    [ -f "$__object/parameter/user" ] \
+        || [ -f "$__object/parameter/group" ] \
+        || [ -f "$__object/parameter/mask" ] \
+        || [ -f "$__object/parameter/other" ]
+then
+    acl_should="$( for param in user group mask other
+    do
+        [ ! -f "$__object/parameter/$param" ] && continue
+
+        echo "$param" | grep -Eq 'mask|other' && sep=:: || sep=:
+
+        echo "$param$sep$( cat "$__object/parameter/$param" )"
+    done )"
+else
+    echo 'no parameters set' >&2
+    exit 1
+fi
 
 if [ -f "$__object/parameter/default" ]
 then
diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst
index a71e0d3c..85e946ce 100644
--- a/cdist/conf/type/__acl/man.rst
+++ b/cdist/conf/type/__acl/man.rst
@@ -34,6 +34,12 @@ remove
    ``mask`` and ``other`` entries can't be removed, but only changed.
 
 
+DEPRECATED PARAMETERS
+---------------------
+Parameters ``user``, ``group``, ``mask`` and ``other`` are deprecated and they
+will be removed in future versions. Please use ``acl`` parameter instead.
+
+
 EXAMPLES
 --------
 
diff --git a/cdist/conf/type/__acl/parameter/optional b/cdist/conf/type/__acl/parameter/optional
new file mode 100644
index 00000000..4b32086b
--- /dev/null
+++ b/cdist/conf/type/__acl/parameter/optional
@@ -0,0 +1,2 @@
+mask
+other
diff --git a/cdist/conf/type/__acl/parameter/optional_multiple b/cdist/conf/type/__acl/parameter/optional_multiple
new file mode 100644
index 00000000..95c25d55
--- /dev/null
+++ b/cdist/conf/type/__acl/parameter/optional_multiple
@@ -0,0 +1,3 @@
+acl
+user
+group
diff --git a/cdist/conf/type/__acl/parameter/required_multiple b/cdist/conf/type/__acl/parameter/required_multiple
deleted file mode 100644
index 39fead3b..00000000
--- a/cdist/conf/type/__acl/parameter/required_multiple
+++ /dev/null
@@ -1 +0,0 @@
-acl

From a4bc051ad9ecb538d5d239a03990b788acf81d88 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 21 Jun 2019 13:02:44 +0300
Subject: [PATCH 065/383] __acl: use type deprecation

---
 cdist/conf/type/__acl/parameter/deprecated/group | 1 +
 cdist/conf/type/__acl/parameter/deprecated/mask  | 1 +
 cdist/conf/type/__acl/parameter/deprecated/other | 1 +
 cdist/conf/type/__acl/parameter/deprecated/user  | 1 +
 4 files changed, 4 insertions(+)
 create mode 100644 cdist/conf/type/__acl/parameter/deprecated/group
 create mode 100644 cdist/conf/type/__acl/parameter/deprecated/mask
 create mode 100644 cdist/conf/type/__acl/parameter/deprecated/other
 create mode 100644 cdist/conf/type/__acl/parameter/deprecated/user

diff --git a/cdist/conf/type/__acl/parameter/deprecated/group b/cdist/conf/type/__acl/parameter/deprecated/group
new file mode 100644
index 00000000..94e14159
--- /dev/null
+++ b/cdist/conf/type/__acl/parameter/deprecated/group
@@ -0,0 +1 @@
+see manual for details
diff --git a/cdist/conf/type/__acl/parameter/deprecated/mask b/cdist/conf/type/__acl/parameter/deprecated/mask
new file mode 100644
index 00000000..94e14159
--- /dev/null
+++ b/cdist/conf/type/__acl/parameter/deprecated/mask
@@ -0,0 +1 @@
+see manual for details
diff --git a/cdist/conf/type/__acl/parameter/deprecated/other b/cdist/conf/type/__acl/parameter/deprecated/other
new file mode 100644
index 00000000..94e14159
--- /dev/null
+++ b/cdist/conf/type/__acl/parameter/deprecated/other
@@ -0,0 +1 @@
+see manual for details
diff --git a/cdist/conf/type/__acl/parameter/deprecated/user b/cdist/conf/type/__acl/parameter/deprecated/user
new file mode 100644
index 00000000..94e14159
--- /dev/null
+++ b/cdist/conf/type/__acl/parameter/deprecated/user
@@ -0,0 +1 @@
+see manual for details

From 8881ff22246afb78e71a7b992fcb032eb4ce1e90 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 21 Jun 2019 12:55:33 +0200
Subject: [PATCH 066/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index a79b116d..2548b4ce 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Core: Add support for type parameters deprecation (Darko Poljak)
+	* Type __acl: Rewrite and improve (Ander Punnar)
 
 5.1.1: 2019-05-28
 	* Type __apt_key: Use gpg key, fallback to deprecated apt-key (Ander Punnar)

From 6915d300153e690e569f3f691d8bdec4952d91a6 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 21 Jun 2019 14:13:25 +0200
Subject: [PATCH 067/383] Release 5.1.2

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 2548b4ce..4952991b 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+5.1.2: 2019-06-21
 	* Core: Add support for type parameters deprecation (Darko Poljak)
 	* Type __acl: Rewrite and improve (Ander Punnar)
 

From 5c11c15ae4f7962588f88a9fcdad5bc812d819d0 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 23 Jun 2019 19:55:37 +0200
Subject: [PATCH 068/383] Overcome bash CDPATH issue

Thanks to Dmitry Bogatov.
---
 Makefile       | 6 +++---
 docs/changelog | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index b739ab1f..fa3327d1 100644
--- a/Makefile
+++ b/Makefile
@@ -31,9 +31,9 @@ help:
 	@echo "docs-clean      clean documentation"
 	@echo "clean           clean"
 
-DOCS_SRC_DIR=docs/src
-SPEECHDIR=docs/speeches
-TYPEDIR=cdist/conf/type
+DOCS_SRC_DIR=./docs/src
+SPEECHDIR=./docs/speeches
+TYPEDIR=./cdist/conf/type
 
 SPHINXM=make -C $(DOCS_SRC_DIR) man
 SPHINXH=make -C $(DOCS_SRC_DIR) html
diff --git a/docs/changelog b/docs/changelog
index 4952991b..e4e312fd 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)
+
 5.1.2: 2019-06-21
 	* Core: Add support for type parameters deprecation (Darko Poljak)
 	* Type __acl: Rewrite and improve (Ander Punnar)

From 6bb58f882086f5f46c20355f768ee1095540f4d2 Mon Sep 17 00:00:00 2001
From: Dominique Roux <dominique.roux4@gmail.com>
Date: Wed, 24 Jul 2019 13:32:39 +0200
Subject: [PATCH 069/383] Updated the __grafana_dashboard type for the new
 package repository - Changed the signing key uri - Changed the repo uri

---
 cdist/conf/type/__grafana_dashboard/manifest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__grafana_dashboard/manifest b/cdist/conf/type/__grafana_dashboard/manifest
index 9cd1465d..c1fe9416 100755
--- a/cdist/conf/type/__grafana_dashboard/manifest
+++ b/cdist/conf/type/__grafana_dashboard/manifest
@@ -21,10 +21,10 @@ case $os in
 
         __apt_key_uri grafana \
             --name 'Grafana Release Signing Key' \
-            --uri https://packagecloud.io/gpg.key
+            --uri https://packages.grafana.com/gpg.key
 
         require="$require __apt_key_uri/grafana" __apt_source grafana \
-                    --uri https://packagecloud.io/grafana/stable/debian/ \
+                    --uri https://packages.grafana.com/oss/deb \
                     --distribution $apt_source_distribution \
                     --component main
 

From a70d2e0af5a7b842d8a1b0ceb03abb90a770e001 Mon Sep 17 00:00:00 2001
From: Dominique Roux <dominique.roux4@gmail.com>
Date: Wed, 24 Jul 2019 13:35:46 +0200
Subject: [PATCH 070/383] Had to change the apt_source_distribution to stable,
 since the repository doesn't differ in distributions

---
 cdist/conf/type/__grafana_dashboard/manifest | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__grafana_dashboard/manifest b/cdist/conf/type/__grafana_dashboard/manifest
index c1fe9416..e652202b 100755
--- a/cdist/conf/type/__grafana_dashboard/manifest
+++ b/cdist/conf/type/__grafana_dashboard/manifest
@@ -8,10 +8,12 @@ case $os in
     debian|devuan)
         case $os_version in
             8*|jessie)
-                apt_source_distribution=jessie
+                # Differntation not needed anymore
+                apt_source_distribution=stable
                 ;;
             9*|ascii/ceres|ascii)
-                apt_source_distribution=stretch
+                # Differntation not needed anymore
+                apt_source_distribution=stable
                 ;;
             *)
                 echo "Don't know how to install Grafana on $os $os_version. Send us a pull request!" >&2

From f7efde0d0a28cd0e82f6126abcbc7f797a0602b8 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 25 Jul 2019 08:06:58 +0200
Subject: [PATCH 071/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index e4e312fd..ae2eac8d 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)
+	* Type __grafana_dashboard: Update distribution name, package signing key URI and repository URI (Dominique Roux)
 
 5.1.2: 2019-06-21
 	* Core: Add support for type parameters deprecation (Darko Poljak)

From 031d59c82ccadb931db70bc3c22a013f1104b8e5 Mon Sep 17 00:00:00 2001
From: Dominique Roux <dominique.roux4@gmail.com>
Date: Sun, 4 Aug 2019 21:23:44 +0200
Subject: [PATCH 072/383] Added Devuan support for __docker type

---
 cdist/conf/type/__docker/manifest | 37 +++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/cdist/conf/type/__docker/manifest b/cdist/conf/type/__docker/manifest
index 04a9ff27..f20337d7 100755
--- a/cdist/conf/type/__docker/manifest
+++ b/cdist/conf/type/__docker/manifest
@@ -64,6 +64,43 @@ case "$os" in
         require="__apt_source/docker" __package docker-ce --state "${state}"
       fi
    ;;
+   devuan)
+      os_version="$(cat "$__global/explorer/os_version")"
+
+      case "$os_version" in
+        ascii)
+          distributione="stretch"
+        ;;
+        jessie)
+          distribution="jessie"
+        ;;
+        *)
+          echo "Your devuan release ($os_version) is currently not supported by this type (${__type##*/}).">&2
+          echo "Please contribute an implementation for it if you can." >&2
+          exit 1
+        ;;
+      esac
+
+      if [ "${state}" = "present" ]; then
+        __package apt-transport-https
+        __package ca-certificates
+        __package gnupg2
+      fi
+      __apt_key_uri docker --name "Docker Release (CE deb) <docker@docker.com>" \
+        --uri "https://download.docker.com/linux/${os}/gpg" --state "${state}"
+
+      require="__apt_key_uri/docker" __apt_source docker \
+         --uri "https://download.docker.com/linux/${os}" \
+         --distribution "${distribution}" \
+         --state "${state}" \
+         --component "stable"
+      if [ "$version" != "latest" ]; then
+        require="__apt_source/docker" __package docker-ce --version "${version}" --state "${state}"
+      else
+        require="__apt_source/docker" __package docker-ce --state "${state}"
+      fi
+
+   ;;
    *)
       echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
       echo "Please contribute an implementation for it if you can." >&2

From c6b739b5b6de870e629d421b140587278777b5de Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 4 Aug 2019 21:52:59 +0200
Subject: [PATCH 073/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index ae2eac8d..57412999 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)
 	* Type __grafana_dashboard: Update distribution name, package signing key URI and repository URI (Dominique Roux)
+	* Type __docker: Add devuan support (Dominique Roux)
 
 5.1.2: 2019-06-21
 	* Core: Add support for type parameters deprecation (Darko Poljak)

From 2f7dc5a65d264d7f210ab06834980d8782c4a565 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 4 Aug 2019 21:54:13 +0200
Subject: [PATCH 074/383] Fix variable typo

---
 cdist/conf/type/__docker/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__docker/manifest b/cdist/conf/type/__docker/manifest
index f20337d7..6a57d85a 100755
--- a/cdist/conf/type/__docker/manifest
+++ b/cdist/conf/type/__docker/manifest
@@ -69,7 +69,7 @@ case "$os" in
 
       case "$os_version" in
         ascii)
-          distributione="stretch"
+          distribution="stretch"
         ;;
         jessie)
           distribution="jessie"

From c0aa2214aa5b34ae1a073682fc3bd6545ceacf36 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 15 Aug 2019 14:19:54 +0200
Subject: [PATCH 075/383] [letsencrypt] add support for devuan/beowulf

---
 cdist/conf/type/__letsencrypt_cert/manifest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest
index d6892c9b..072fa398 100755
--- a/cdist/conf/type/__letsencrypt_cert/manifest
+++ b/cdist/conf/type/__letsencrypt_cert/manifest
@@ -67,6 +67,9 @@ if [ -z "${certbot_fullpath}" ]; then
 					require="__apt_source/ascii-backports" __package_apt certbot \
 						--target-release ascii-backports
 				;;
+				bewoulf*)
+					__package_apt certbot
+				;;
 				*)
 					echo "Unsupported OS version: $os_version" >&2
 					exit 1

From 7182de596891f963c6867c1d0b08a5276450c56f Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 15 Aug 2019 14:20:14 +0200
Subject: [PATCH 076/383] ++changes

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index ae2eac8d..b13e54fa 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)
 	* Type __grafana_dashboard: Update distribution name, package signing key URI and repository URI (Dominique Roux)
+	* Type __letsencrypt_cert: Add Devuan Beowulf support (Nico Schottelius)
 
 5.1.2: 2019-06-21
 	* Core: Add support for type parameters deprecation (Darko Poljak)

From a86893889b3a9d84712a71a23da60461671ca0e9 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 15 Aug 2019 14:24:11 +0200
Subject: [PATCH 077/383] [letsencrypt] devuan/ascii: only install certbot
 package

It seems python-certbot is gone
---
 cdist/conf/type/__letsencrypt_cert/manifest | 2 --
 1 file changed, 2 deletions(-)

diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest
index 072fa398..d598949e 100755
--- a/cdist/conf/type/__letsencrypt_cert/manifest
+++ b/cdist/conf/type/__letsencrypt_cert/manifest
@@ -62,8 +62,6 @@ if [ -z "${certbot_fullpath}" ]; then
 								 --distribution ascii-backports \
 								 --component main
 
-					require="__apt_source/ascii-backports" __package_apt python-certbot \
-						--target-release ascii-backports
 					require="__apt_source/ascii-backports" __package_apt certbot \
 						--target-release ascii-backports
 				;;

From 6c780c24c7d1fdf8a316fef98a304c07ffd57d0e Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 15 Aug 2019 14:25:16 +0200
Subject: [PATCH 078/383] ++changes

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 6e20c64e..f3b84ba8 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)
 	* Type __grafana_dashboard: Update distribution name, package signing key URI and repository URI (Dominique Roux)
 	* Type __letsencrypt_cert: Add Devuan Beowulf support (Nico Schottelius)
+	* Type __letsencrypt_cert: Fix Devuan Ascii: support (Nico Schottelius)
 	* Type __docker: Add devuan support (Dominique Roux)
 
 5.1.2: 2019-06-21

From 451dfaffe49fc85f8222da19177b7aa05c864f56 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=BDubom=C3=ADr=20Ku=C4=8Dera?=
 <lubomir.kucera.jr@gmail.com>
Date: Fri, 23 Aug 2019 11:28:13 +0200
Subject: [PATCH 079/383] __docker_swarm: Fix for Docker 19.03

---
 cdist/conf/type/__docker_swarm/explorer/swarm-state | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__docker_swarm/explorer/swarm-state b/cdist/conf/type/__docker_swarm/explorer/swarm-state
index 9c1bc32d..2c9fd598 100755
--- a/cdist/conf/type/__docker_swarm/explorer/swarm-state
+++ b/cdist/conf/type/__docker_swarm/explorer/swarm-state
@@ -18,4 +18,4 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-docker info 2>/dev/null | grep "^Swarm: " | cut -d " " -f 2-
+docker info 2>/dev/null | grep '^ *Swarm: ' | awk '{print $2}'

From 65b9e1d00f230ca97ef30546e1490a8b51e83c19 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 29 Aug 2019 14:40:16 +0200
Subject: [PATCH 080/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index f3b84ba8..b790b983 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,6 +7,7 @@ next:
 	* Type __letsencrypt_cert: Add Devuan Beowulf support (Nico Schottelius)
 	* Type __letsencrypt_cert: Fix Devuan Ascii: support (Nico Schottelius)
 	* Type __docker: Add devuan support (Dominique Roux)
+	* Type __docker_swarm: Fix for Docker 19.03 (Ľubomír Kučera)
 
 5.1.2: 2019-06-21
 	* Core: Add support for type parameters deprecation (Darko Poljak)

From 067d0a62e73d89fef35e1f7183a3b376634da5c0 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 30 Aug 2019 08:51:08 +0200
Subject: [PATCH 081/383] Release 5.1.3

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index b790b983..7594a6d4 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+5.1.3: 2019-08-30
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)
 	* Type __grafana_dashboard: Update distribution name, package signing key URI and repository URI (Dominique Roux)
 	* Type __letsencrypt_cert: Add Devuan Beowulf support (Nico Schottelius)

From 4294ff55e16ae8aba978721f8077605c6157eaf1 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 9 Sep 2019 16:12:16 +0200
Subject: [PATCH 082/383] [type/__git] Add --recursive parameter

---
 cdist/conf/type/__git/gencode-remote    | 32 ++++++++++++-------------
 cdist/conf/type/__git/man.rst           |  2 ++
 cdist/conf/type/__git/parameter/boolean |  1 +
 3 files changed, 19 insertions(+), 16 deletions(-)
 create mode 100644 cdist/conf/type/__git/parameter/boolean

diff --git a/cdist/conf/type/__git/gencode-remote b/cdist/conf/type/__git/gencode-remote
index 5a9e23fc..3ba21add 100755
--- a/cdist/conf/type/__git/gencode-remote
+++ b/cdist/conf/type/__git/gencode-remote
@@ -19,32 +19,31 @@
 #
 #
 
-state_is="$(cat "$__object/explorer/state")"
-owner_is="$(cat "$__object/explorer/owner")"
-group_is="$(cat "$__object/explorer/group")"
+state_is=$(cat "$__object/explorer/state")
+owner_is=$(cat "$__object/explorer/owner")
+group_is=$(cat "$__object/explorer/group")
 
-state_should="$(cat "$__object/parameter/state")"
+state_should=$(cat "$__object/parameter/state")
 
-branch="$(cat "$__object/parameter/branch")"
+branch=$(cat "$__object/parameter/branch")
 
-source="$(cat "$__object/parameter/source")"
+source=$(cat "$__object/parameter/source")
 
 destination="/$__object_id"
 
-owner="$(cat "$__object/parameter/owner")"
-group="$(cat "$__object/parameter/group")"
-mode="$(cat "$__object/parameter/mode")"
+owner=$(cat "$__object/parameter/owner")
+group=$(cat "$__object/parameter/group")
+mode=$(cat "$__object/parameter/mode")
 
-[  "$state_should" = "$state_is" ] && \
-[  "$owner" = "$owner_is" ] && \
-[  "$group" = "$group_is" ] && \
-[  -n "$mode" ] && exit 0
+[ "$state_should" = "$state_is" ] \
+ && [ "$owner" = "$owner_is" ] \
+ && [ "$group" = "$group_is" ] \
+ && [ -n "$mode" ] && exit 0
 
 case $state_should in
     present)
-
         if [ "$state_should" != "$state_is" ]; then
-            echo git clone --quiet --branch "$branch" "$source" "$destination"
+            echo git clone --quiet $([ -f "$__object/parameter/recursive" ] && echo '--recursive') --branch "$branch" "$source" "$destination"
         fi
         if { [ -n "$owner" ] && [ "$owner_is" != "$owner" ]; } || \
            { [ -n "$group" ] && [ "$group_is" != "$group" ]; }; then
@@ -54,8 +53,9 @@ case $state_should in
             echo chmod -R "$mode" "$destination"
         fi
     ;;
-    # Handled in manifest
+
     absent)
+        # Handled in manifest
     ;;
 
     *)
diff --git a/cdist/conf/type/__git/man.rst b/cdist/conf/type/__git/man.rst
index 130925c8..e4c06c99 100644
--- a/cdist/conf/type/__git/man.rst
+++ b/cdist/conf/type/__git/man.rst
@@ -35,6 +35,8 @@ mode
 owner
    User to chown to.
 
+recursive
+   Recursive clone...
 
 EXAMPLES
 --------
diff --git a/cdist/conf/type/__git/parameter/boolean b/cdist/conf/type/__git/parameter/boolean
new file mode 100644
index 00000000..a633e659
--- /dev/null
+++ b/cdist/conf/type/__git/parameter/boolean
@@ -0,0 +1 @@
+recursive

From 88fe83ed735d533a77c1cd68081893442a1acc1e Mon Sep 17 00:00:00 2001
From: PCoder <purple.coder@yahoo.co.uk>
Date: Sat, 14 Sep 2019 15:24:36 +0530
Subject: [PATCH 083/383] Fix beowulf's spelling

---
 cdist/conf/type/__letsencrypt_cert/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest
index d598949e..f736f3f2 100755
--- a/cdist/conf/type/__letsencrypt_cert/manifest
+++ b/cdist/conf/type/__letsencrypt_cert/manifest
@@ -65,7 +65,7 @@ if [ -z "${certbot_fullpath}" ]; then
 					require="__apt_source/ascii-backports" __package_apt certbot \
 						--target-release ascii-backports
 				;;
-				bewoulf*)
+				beowulf*)
 					__package_apt certbot
 				;;
 				*)

From eab540bd0fc4a81408890f0dc8f45e8a7f609d06 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 18 Sep 2019 07:04:41 +0200
Subject: [PATCH 084/383] ++

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 7594a6d4..e7e6b182 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)
+
 5.1.3: 2019-08-30
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)
 	* Type __grafana_dashboard: Update distribution name, package signing key URI and repository URI (Dominique Roux)

From 799ec7236971fac597ccb3f80a646fae7e4817f5 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 20 Sep 2019 07:15:37 +0200
Subject: [PATCH 085/383] Implement preos

---
 cdist/argparse.py                             |    6 +-
 cdist/preos.py                                |  101 +
 cdist/preos/debootstrap/__init__.py           |    1 +
 cdist/preos/debootstrap/debootstrap.py        |  240 ++
 cdist/preos/debootstrap/files/code            |  274 ++
 .../files/devuan-debootstrap/Makefile         |   18 +
 .../files/devuan-debootstrap/README           |   65 +
 .../debootstrap/files/devuan-debootstrap/TODO |   11 +
 .../devuan-debootstrap/debian/.gitignore      |    6 +
 .../debian/README.DevuanSource                |   15 +
 .../files/devuan-debootstrap/debian/changelog | 2655 +++++++++++++++++
 .../files/devuan-debootstrap/debian/compat    |    1 +
 .../files/devuan-debootstrap/debian/control   |   26 +
 .../files/devuan-debootstrap/debian/copyright |   30 +
 .../debian/debootstrap.docs                   |    1 +
 .../debian/debootstrap.manpages               |    1 +
 .../files/devuan-debootstrap/debian/gbp.conf  |    9 +
 .../files/devuan-debootstrap/debian/rules     |   47 +
 .../devuan-debootstrap/debian/source/format   |    1 +
 .../files/devuan-debootstrap/debootstrap      |  703 +++++
 .../files/devuan-debootstrap/debootstrap.8    |  189 ++
 .../files/devuan-debootstrap/functions        | 1735 +++++++++++
 .../files/devuan-debootstrap/scripts/aequorea |  202 ++
 .../files/devuan-debootstrap/scripts/ascii    |    1 +
 .../devuan-debootstrap/scripts/bartholomea    |    1 +
 .../files/devuan-debootstrap/scripts/breezy   |  163 +
 .../files/devuan-debootstrap/scripts/bullseye |    1 +
 .../files/devuan-debootstrap/scripts/buster   |    1 +
 .../files/devuan-debootstrap/scripts/ceres    |  218 ++
 .../devuan-debootstrap/scripts/chromodoris    |    1 +
 .../files/devuan-debootstrap/scripts/dapper   |  168 ++
 .../files/devuan-debootstrap/scripts/dasyatis |    1 +
 .../files/devuan-debootstrap/scripts/edgy     |  187 ++
 .../files/devuan-debootstrap/scripts/etch     |    1 +
 .../devuan-debootstrap/scripts/etch-m68k      |    1 +
 .../files/devuan-debootstrap/scripts/feisty   |  190 ++
 .../files/devuan-debootstrap/scripts/gutsy    |  230 ++
 .../files/devuan-debootstrap/scripts/hardy    |    1 +
 .../files/devuan-debootstrap/scripts/hoary    |  179 ++
 .../devuan-debootstrap/scripts/hoary.buildd   |  159 +
 .../files/devuan-debootstrap/scripts/intrepid |    1 +
 .../files/devuan-debootstrap/scripts/jaunty   |    1 +
 .../files/devuan-debootstrap/scripts/jessie   |    1 +
 .../scripts/jessie-kfreebsd                   |    1 +
 .../files/devuan-debootstrap/scripts/karmic   |    1 +
 .../files/devuan-debootstrap/scripts/lenny    |    1 +
 .../files/devuan-debootstrap/scripts/lucid    |    1 +
 .../files/devuan-debootstrap/scripts/maverick |    1 +
 .../files/devuan-debootstrap/scripts/natty    |    1 +
 .../devuan-debootstrap/scripts/oldoldstable   |    1 +
 .../devuan-debootstrap/scripts/oldstable      |    1 +
 .../files/devuan-debootstrap/scripts/oneiric  |    1 +
 .../files/devuan-debootstrap/scripts/potato   |  104 +
 .../files/devuan-debootstrap/scripts/precise  |    1 +
 .../files/devuan-debootstrap/scripts/quantal  |    1 +
 .../files/devuan-debootstrap/scripts/raring   |    1 +
 .../files/devuan-debootstrap/scripts/sarge    |  218 ++
 .../devuan-debootstrap/scripts/sarge.buildd   |  166 ++
 .../scripts/sarge.fakechroot                  |  171 ++
 .../files/devuan-debootstrap/scripts/saucy    |    1 +
 .../files/devuan-debootstrap/scripts/sid      |  214 ++
 .../files/devuan-debootstrap/scripts/squeeze  |    1 +
 .../files/devuan-debootstrap/scripts/stable   |    1 +
 .../files/devuan-debootstrap/scripts/stretch  |    1 +
 .../files/devuan-debootstrap/scripts/testing  |    1 +
 .../files/devuan-debootstrap/scripts/trusty   |    1 +
 .../files/devuan-debootstrap/scripts/unstable |    1 +
 .../files/devuan-debootstrap/scripts/utopic   |    1 +
 .../files/devuan-debootstrap/scripts/vivid    |    1 +
 .../files/devuan-debootstrap/scripts/warty    |  166 ++
 .../devuan-debootstrap/scripts/warty.buildd   |  159 +
 .../files/devuan-debootstrap/scripts/wheezy   |    1 +
 .../files/devuan-debootstrap/scripts/wily     |    1 +
 .../files/devuan-debootstrap/scripts/woody    |  203 ++
 .../devuan-debootstrap/scripts/woody.buildd   |  166 ++
 .../files/devuan-debootstrap/scripts/xenial   |    1 +
 .../files/devuan-debootstrap/scripts/yakkety  |    1 +
 .../files/devuan-debootstrap/scripts/zesty    |    1 +
 .../debootstrap/files/init-manifest-debian    |   39 +
 .../debootstrap/files/init-manifest-devuan    |   39 +
 .../debootstrap/files/init-manifest-ubuntu    |   39 +
 cdist/preos/debootstrap/files/remote-copy.sh  |    8 +
 cdist/preos/debootstrap/files/remote-exec.sh  |   24 +
 completions/bash/cdist-completion.bash        |    2 +-
 completions/zsh/_cdist                        |    2 +-
 docs/changelog                                |    1 +
 docs/src/cdist-preos.rst                      |  137 +
 docs/src/cdist-reference.rst.sh               |    3 +
 docs/src/index.rst                            |    1 +
 docs/src/man1/cdist.rst                       |  172 +-
 hacking/preos-sh/init                         |   32 +
 hacking/preos-sh/preos.sh                     |   31 +
 hacking/preos-sh/remote-copy.sh               |    8 +
 hacking/preos-sh/remote-exec.sh               |   24 +
 scripts/cdist                                 |    3 +
 95 files changed, 9997 insertions(+), 4 deletions(-)
 create mode 100644 cdist/preos.py
 create mode 100644 cdist/preos/debootstrap/__init__.py
 create mode 100644 cdist/preos/debootstrap/debootstrap.py
 create mode 100755 cdist/preos/debootstrap/files/code
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/Makefile
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/README
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/TODO
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/.gitignore
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/README.DevuanSource
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/changelog
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/compat
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/control
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/copyright
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/debootstrap.docs
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/debootstrap.manpages
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/gbp.conf
 create mode 100755 cdist/preos/debootstrap/files/devuan-debootstrap/debian/rules
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debian/source/format
 create mode 100755 cdist/preos/debootstrap/files/devuan-debootstrap/debootstrap
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/debootstrap.8
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/functions
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/aequorea
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/ascii
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/bartholomea
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/breezy
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/bullseye
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/buster
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/ceres
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/chromodoris
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/dapper
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/dasyatis
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/edgy
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/etch
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/etch-m68k
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/feisty
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/gutsy
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hardy
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hoary
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hoary.buildd
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/intrepid
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jaunty
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jessie
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jessie-kfreebsd
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/karmic
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/lenny
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/lucid
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/maverick
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/natty
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oldoldstable
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oldstable
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oneiric
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/potato
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/precise
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/quantal
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/raring
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge.buildd
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge.fakechroot
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/saucy
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sid
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/squeeze
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/stable
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/stretch
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/testing
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/trusty
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/unstable
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/utopic
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/vivid
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/warty
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/warty.buildd
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/wheezy
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/wily
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/woody
 create mode 100644 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/woody.buildd
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/xenial
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/yakkety
 create mode 120000 cdist/preos/debootstrap/files/devuan-debootstrap/scripts/zesty
 create mode 100644 cdist/preos/debootstrap/files/init-manifest-debian
 create mode 100644 cdist/preos/debootstrap/files/init-manifest-devuan
 create mode 100644 cdist/preos/debootstrap/files/init-manifest-ubuntu
 create mode 100755 cdist/preos/debootstrap/files/remote-copy.sh
 create mode 100755 cdist/preos/debootstrap/files/remote-exec.sh
 create mode 100644 docs/src/cdist-preos.rst
 create mode 100644 hacking/preos-sh/init
 create mode 100644 hacking/preos-sh/preos.sh
 create mode 100644 hacking/preos-sh/remote-copy.sh
 create mode 100644 hacking/preos-sh/remote-exec.sh

diff --git a/cdist/argparse.py b/cdist/argparse.py
index 421d1b54..3ccc0545 100644
--- a/cdist/argparse.py
+++ b/cdist/argparse.py
@@ -5,10 +5,11 @@ import logging
 import collections
 import functools
 import cdist.configuration
+import cdist.preos
 
 
 # set of beta sub-commands
-BETA_COMMANDS = set(('install', 'inventory', ))
+BETA_COMMANDS = set(('install', 'inventory', 'preos', ))
 # set of beta arguments for sub-commands
 BETA_ARGS = {
     'config': set(('tag', 'all_tagged_hosts', 'use_archiving', )),
@@ -422,6 +423,9 @@ def get_parsers():
     parser['inventory'].set_defaults(
             func=cdist.inventory.Inventory.commandline)
 
+    # PreOs
+    parser['preos'] = parser['sub'].add_parser('preos', add_help=False)
+
     # Shell
     parser['shell'] = parser['sub'].add_parser(
             'shell', parents=[parser['loglevel']])
diff --git a/cdist/preos.py b/cdist/preos.py
new file mode 100644
index 00000000..46b45554
--- /dev/null
+++ b/cdist/preos.py
@@ -0,0 +1,101 @@
+import os
+import os.path
+import sys
+import inspect
+import argparse
+import cdist
+import logging
+
+
+_PREOS_CALL = "commandline"
+_PREOS_NAME = "_preos_name"
+_PREOS_MARKER = "_cdist_preos"
+_PLUGINS_DIR = "preos"
+_PLUGINS_PATH = [os.path.join(os.path.dirname(__file__), _PLUGINS_DIR), ]
+cdist_home = cdist.home_dir()
+if cdist_home:
+    cdist_home_preos = os.path.join(cdist_home, "preos")
+    if os.path.isdir(cdist_home_preos):
+        _PLUGINS_PATH.append(cdist_home_preos)
+sys.path.extend(_PLUGINS_PATH)
+
+
+log = logging.getLogger("PreOS")
+
+
+def preos_plugin(obj):
+    """It is preos if _PREOS_MARKER is True and has _PREOS_CALL."""
+    if hasattr(obj, _PREOS_MARKER):
+        is_preos = getattr(obj, _PREOS_MARKER)
+    else:
+        is_preos = False
+
+    if is_preos and hasattr(obj, _PREOS_CALL):
+        yield obj
+
+
+def scan_preos_dir_plugins(dir):
+    for fname in os.listdir(dir):
+        if os.path.isfile(os.path.join(dir, fname)):
+            fname = os.path.splitext(fname)[0]
+        module_name = fname
+        try:
+            module = __import__(module_name)
+            yield from preos_plugin(module)
+            clsmembers = inspect.getmembers(module, inspect.isclass)
+            for cm in clsmembers:
+                c = cm[1]
+                yield from preos_plugin(c)
+        except ImportError as e:
+            log.warning("Cannot import '{}': {}".format(module_name, e))
+
+
+def find_preos_plugins():
+    for dir in _PLUGINS_PATH:
+        yield from scan_preos_dir_plugins(dir)
+
+
+def find_preoses():
+    preoses = {}
+    for preos in find_preos_plugins():
+        if hasattr(preos, _PREOS_NAME):
+            preos_name = getattr(preos, _PREOS_NAME)
+        else:
+            preos_name = preos.__name__.lower()
+        preoses[preos_name] = preos
+    return preoses
+
+
+def check_root():
+    if os.geteuid() != 0:
+        raise cdist.Error("Must be run with root privileges")
+
+
+class PreOS(object):
+    preoses = None
+
+    @classmethod
+    def commandline(cls, argv):
+
+        if not cls.preoses:
+            cls.preoses = find_preoses()
+
+        parser = argparse.ArgumentParser(
+            description="Create PreOS", prog="cdist preos")
+        parser.add_argument('preos', help='PreOS to create, one of: {}'.format(
+            set(cls.preoses)))
+        args = parser.parse_args(argv[1:2])
+
+        preos_name = args.preos
+        if preos_name in cls.preoses:
+            preos = cls.preoses[preos_name]
+            func = getattr(preos, _PREOS_CALL)
+            if inspect.ismodule(preos):
+                func_args = [preos, argv[2:], ]
+            else:
+                func_args = [argv[2:], ]
+            log.info("Running preos : {}".format(preos_name))
+            func(*func_args)
+        else:
+            log.error("Unknown preos: {}, available preoses: {}".format(
+                preos_name, set(cls.preoses.keys())))
diff --git a/cdist/preos/debootstrap/__init__.py b/cdist/preos/debootstrap/__init__.py
new file mode 100644
index 00000000..6d340b4a
--- /dev/null
+++ b/cdist/preos/debootstrap/__init__.py
@@ -0,0 +1 @@
+from debootstrap.debootstrap import Debian, Ubuntu, Devuan
diff --git a/cdist/preos/debootstrap/debootstrap.py b/cdist/preos/debootstrap/debootstrap.py
new file mode 100644
index 00000000..617d280b
--- /dev/null
+++ b/cdist/preos/debootstrap/debootstrap.py
@@ -0,0 +1,240 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# 2016 Darko Poljak (darko.poljak at ungleich.ch)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+
+import cdist
+import cdist.config
+import cdist.core
+import cdist.preos
+import argparse
+import cdist.argparse
+import logging
+import os
+import subprocess
+
+
+class Debian(object):
+    _preos_name = 'debian'
+    _cdist_preos = True
+
+    _files_dir = os.path.join(os.path.dirname(__file__), "files")
+
+    @classmethod
+    def default_args(cls):
+        default_remote_exec = os.path.join(cls._files_dir, "remote-exec.sh")
+        default_remote_copy = os.path.join(cls._files_dir, "remote-copy.sh")
+        default_init_manifest = os.path.join(
+            cls._files_dir, "init-manifest-{}".format(cls._preos_name))
+
+        defargs = argparse.Namespace()
+        defargs.arch = 'amd64'
+        defargs.bootstrap = False
+        defargs.configure = False
+        defargs.cdist_params = '-v'
+        defargs.rm_bootstrap_dir = False
+        defargs.suite = 'stable'
+        defargs.remote_exec = default_remote_exec
+        defargs.remote_copy = default_remote_copy
+        defargs.manifest = default_init_manifest
+
+        return defargs
+
+    @classmethod
+    def get_parser(cls):
+        defargs = cls.default_args()
+        cdist_parser = cdist.argparse.get_parsers()
+        parser = argparse.ArgumentParser(
+                prog='cdist preos {}'.format(cls._preos_name),
+                parents=[cdist_parser['loglevel'], cdist_parser['beta']])
+        parser.add_argument('target_dir', nargs=1,
+                            help=("target directory where PreOS will be "
+                                  "bootstrapped"))
+        parser.add_argument(
+            '-a', '--arch',
+            help="target debootstrap architecture, by default '{}'".format(
+                defargs.arch), dest='arch', default=defargs.arch)
+        parser.add_argument(
+            '-B', '--bootstrap',
+            help='do bootstrap step',
+            dest='bootstrap', action='store_true', default=defargs.bootstrap)
+        parser.add_argument(
+            '-C', '--configure',
+            help='do configure step',
+            dest='configure', action='store_true', default=defargs.configure)
+        parser.add_argument(
+            '-c', '--cdist-params',
+            help=("parameters that will be passed to cdist config, by default"
+                  " '{}' is used".format(defargs.cdist_params)),
+            dest='cdist_params', default=defargs.cdist_params)
+        parser.add_argument(
+            '-D', '--drive-boot',
+            help='create bootable PreOS on specified drive',
+            dest='drive')
+        parser.add_argument(
+            '-e', '--remote-exec',
+            help=("remote exec that cdist config will use, by default "
+                  "internal script is used"),
+            dest='remote_exec', default=defargs.remote_exec)
+        parser.add_argument(
+            '-i', '--init-manifest',
+            help=("init manifest that cdist config will use, by default "
+                  "internal init manifest is used"),
+            dest='manifest', default=defargs.manifest)
+        parser.add_argument(
+            '-k', '--keyfile', action="append",
+            help=("ssh key files that will be added to cdist config; "
+                  "'__ssh_authorized_keys root ...' type is appended to "
+                  "initial manifest"),
+            dest='keyfile')
+        parser.add_argument(
+            '-m', '--mirror',
+            help='use specified mirror for debootstrap',
+            dest='mirror')
+        parser.add_argument(
+            '-P', '--root-password',
+            help='Set specified password for root, generated by default',
+            dest='root_password')
+        parser.add_argument('-p', '--pxe-boot-dir', help='PXE boot directory',
+                            dest='pxe_boot_dir')
+        parser.add_argument(
+            '-r', '--rm-bootstrap-dir',
+            help='remove target directory after finishing',
+            dest='rm_bootstrap_dir', action='store_true',
+            default=defargs.rm_bootstrap_dir)
+        parser.add_argument(
+            '-S', '--script',
+            help='use specified script for debootstrap',
+            dest='script')
+        parser.add_argument('-s', '--suite',
+                            help="suite used for debootstrap, "
+                                 "by default '{}'".format(defargs.suite),
+                            dest='suite', default=defargs.suite)
+        parser.add_argument(
+            '-y', '--remote-copy',
+            help=("remote copy that cdist config will use, by default "
+                  "internal script is used"),
+            dest='remote_copy', default=defargs.remote_copy)
+        parser.epilog = cdist.argparse.EPILOG
+
+        return parser
+
+    @classmethod
+    def update_env(cls, env):
+        pass
+
+    @classmethod
+    def commandline(cls, argv):
+        log = logging.getLogger(cls.__name__)
+
+        parser = cls.get_parser()
+        cdist.argparse.add_beta_command(cls._preos_name)
+        args = parser.parse_args(argv)
+        if args.script and not args.mirror:
+            raise cdist.Error("script option cannot be used without "
+                              "mirror option")
+
+        args.command = cls._preos_name
+        cdist.argparse.check_beta(vars(args))
+
+        cdist.preos.check_root()
+
+        args.target_dir = os.path.realpath(args.target_dir[0])
+        args.os = cls._preos_name
+        args.remote_exec = os.path.realpath(args.remote_exec)
+        args.remote_copy = os.path.realpath(args.remote_copy)
+        args.manifest = os.path.realpath(args.manifest)
+        if args.keyfile:
+            new_keyfile = [os.path.realpath(x) for x in args.keyfile]
+            args.keyfile = new_keyfile
+        if args.pxe_boot_dir:
+            args.pxe_boot_dir = os.path.realpath(args.pxe_boot_dir)
+
+        cdist.argparse.handle_loglevel(args)
+        log.debug("preos: {}, args: {}".format(cls._preos_name, args))
+        try:
+            env = vars(args)
+            new_env = {}
+            for key in env:
+                if key == 'verbose':
+                    if env[key] >= 3:
+                        new_env['debug'] = "yes"
+                    elif env[key] == 2:
+                        new_env['verbose'] = "yes"
+                elif not env[key]:
+                    new_env[key] = ''
+                elif isinstance(env[key], bool) and env[key]:
+                    new_env[key] = "yes"
+                elif isinstance(env[key], list):
+                    val = env[key]
+                    new_env[key + "_cnt"] = str(len(val))
+                    for i, v in enumerate(val):
+                        new_env[key + "_" + str(i)] = v
+                else:
+                    new_env[key] = str(env[key])
+            env = new_env
+            env.update(os.environ)
+            cls.update_env(env)
+            log.debug("preos: {} env: {}".format(cls._preos_name, env))
+            cmd = os.path.join(cls._files_dir, "code")
+            info_msg = ["Running preos: {}, suite: {}, arch: {}".format(
+                cls._preos_name, args.suite, args.arch), ]
+            if args.mirror:
+                info_msg.append("mirror: {}".format(args.mirror))
+            if args.script:
+                info_msg.append("script: {}".format(args.script))
+            if args.bootstrap:
+                info_msg.append("bootstrapping")
+            if args.configure:
+                info_msg.append("configuring")
+            if args.pxe_boot_dir:
+                info_msg.append("creating PXE")
+            if args.drive:
+                info_msg.append("creating bootable drive")
+            log.info(info_msg)
+            log.debug("cmd={}".format(cmd))
+            subprocess.check_call(cmd, env=env, shell=True)
+        except subprocess.CalledProcessError as e:
+            log.error("preos {} failed: {}".format(cls._preos_name, e))
+
+
+class Ubuntu(Debian):
+    _preos_name = "ubuntu"
+
+    @classmethod
+    def default_args(cls):
+        defargs = super().default_args()
+        defargs.suite = 'xenial'
+        return defargs
+
+
+class Devuan(Debian):
+    _preos_name = "devuan"
+
+    @classmethod
+    def default_args(cls):
+        defargs = super().default_args()
+        defargs.suite = 'jessie'
+        return defargs
+
+    @classmethod
+    def update_env(cls, env):
+        env['DEBOOTSTRAP_DIR'] = os.path.join(cls._files_dir,
+                                              'devuan-debootstrap')
diff --git a/cdist/preos/debootstrap/files/code b/cdist/preos/debootstrap/files/code
new file mode 100755
index 00000000..9e37003b
--- /dev/null
+++ b/cdist/preos/debootstrap/files/code
@@ -0,0 +1,274 @@
+#!/bin/sh
+##
+## 2016 Darko Poljak (darko.poljak at ungleich.ch)
+##
+## This file is part of cdist.
+##
+## cdist is free software: you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation, either version 3 of the License, or
+## (at your option) any later version.
+##
+## cdist is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+##
+## You should have received a copy of the GNU General Public License
+## along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+set -e
+
+if [ "${debug}" ]
+then
+    set -x
+    cdist_params="${cdist_params} -d"
+fi
+
+bootstrap_dir="${target_dir}"
+
+case "${os}" in
+    ubuntu|debian|devuan)
+        # nothing, those are valid values
+        ;;
+    *)
+        echo "ERROR: invalid os value: ${os}" >&2
+        exit 1
+        ;;
+esac
+
+check_bootstrap_dir() {
+    if [ ! -e "$1" ]
+    then
+        echo "ERROR: bootstrap directory $1 does not exist" >&2
+        exit 1
+    fi
+}
+
+# bootstrap
+if [ "${bootstrap}" ]
+then
+    if [ "${DEBOOTSTRAP_DIR}" ]
+    then
+        debootstrap_cmd="${DEBOOTSTRAP_DIR}/debootstrap"
+    else
+        command -v debootstrap 2>&1 > /dev/null || {
+            echo "ERROR: debootstrap not found" >&2
+            exit 1
+        }
+        debootstrap_cmd="debootstrap"
+    fi
+
+    # If PreOS on drive then do not check for directory emptiness.
+    # Partition can at least contain 'lost+found' directory.
+    if [ ! "${drive}" ]
+    then
+        if [ -e "${bootstrap_dir}" ]
+        then
+            dir_content=$(ls -A "${bootstrap_dir}" | wc -l)
+        else
+            dir_content=0
+        fi
+        if [ "${dir_content}" -ne 0 ]
+        then
+            echo "ERROR: "${bootstrap_dir}" not empty " >&2
+            exit 1
+        fi
+    fi
+
+    if [ "${verbose}" -o "${debug}" ]
+    then
+        echo "bootstrapping..."
+    fi
+    mkdir -p "${bootstrap_dir}"
+    "${debootstrap_cmd}" --include=openssh-server --arch=${arch} ${suite} ${bootstrap_dir} \
+        ${mirror} ${script}
+    if [ "${verbose}" -o "${debug}" ]
+    then
+        echo "bootstrap finished"
+    fi
+fi
+
+chroot_mount() {
+    mount -t proc none "${bootstrap_dir}/proc" || true
+    mount -t sysfs none "${bootstrap_dir}/sys" || true
+    mount -o bind /dev "${bootstrap_dir}/dev" || true
+    mount -t devpts none "${bootstrap_dir}/dev/pts" || true
+}
+
+chroot_umount() {
+    umount "${bootstrap_dir}/dev/pts" || true
+    umount "${bootstrap_dir}/dev" || true
+    umount "${bootstrap_dir}/sys" || true
+    umount "${bootstrap_dir}/proc" || true
+}
+
+TRAPFUNC="umount \"${bootstrap_dir}/dev/pts\" || true; \
+umount \"${bootstrap_dir}/dev\" || true; \
+umount \"${bootstrap_dir}/sys\" || true; \
+umount \"${bootstrap_dir}/proc\" || true;"
+
+# config
+if [ "${configure}" ]
+then
+    if [ ! -f "${manifest}" ]
+    then
+        echo "ERROR: ${manifest} does not exist" >&2
+        exit 1
+    fi
+    if [ ! -f "${remote_exec}" ]
+    then
+        echo "ERROR: ${remote_exec} does not exist" >&2
+        exit 1
+    fi
+    if [ ! -f "${remote_copy}" ]
+    then
+        echo "ERROR: ${remote_copy} does not exist" >&2
+        exit 1
+    fi
+
+    if [ "${keyfile_cnt}" -a "${keyfile_cnt}" -gt 0 ]
+    then
+        i="$((keyfile_cnt - 1))"
+        keyfiles=""
+        while [ "${i}" -ge 0 ]
+        do
+            kf_var="keyfile_${i}"
+            eval kf='$'"${kf_var}"
+            if [ ! -f "${kf}" ]
+            then
+                echo "ERROR: ${kf} does not exist" >&2
+                exit 1
+            fi
+            key=$(cat "${kf}")
+            keyfiles="${keyfiles} --key '${key}'"
+            i=$((i - 1))
+        done
+        ssh_auth_keys_line="__ssh_authorized_keys root ${keyfiles}\n"
+    else
+        ssh_auth_keys_line=""
+    fi
+
+    check_bootstrap_dir "${bootstrap_dir}"
+
+    if [ "${verbose}" -o "${debug}" ]
+    then
+        echo "configuring..."
+    fi
+
+    trap "${TRAPFUNC}" 0 1 2 3 15
+
+    chroot_mount
+
+    chroot "${bootstrap_dir}" /usr/bin/apt-get update
+
+    if [ "${drive}" ]
+    then
+        grub_manifest_line="__package grub-pc --state present\n"
+        grub_kern_params_line="__line linux_kernel_params \
+--file /etc/default/grub \
+--line 'GRUB_CMDLINE_LINUX_DEFAULT=\"quiet splash net.ifnames=0\"'\n"
+    else
+        grub_manifest_line=""
+        grub_kern_params_line=""
+    fi
+    grub_lines="${grub_manifest_line}${grub_kern_params_line}"
+
+    printf "${ssh_auth_keys_line}${grub_lines}" \
+        | cat "${manifest}" - |\
+        cdist config \
+            ${cdist_params} -i - \
+            --remote-exec "${remote_exec}" \
+            --remote-copy "${remote_copy}" \
+            "${bootstrap_dir}"
+
+    # __hostname with systmed uses hostnamectl which needs dbus running
+    # set hostname explicitly here instead
+    printf "preos\n" > "${bootstrap_dir}/etc/hostname"
+
+    chroot "${bootstrap_dir}" /usr/bin/apt-get autoclean
+    chroot "${bootstrap_dir}" /usr/bin/apt-get clean
+    chroot "${bootstrap_dir}" /usr/bin/apt-get autoremove
+
+    chroot_umount
+
+    trap - 0 1 2 3 15
+
+    if [ "${verbose}" -o "${debug}" ]
+    then
+        echo "configuring finished"
+    fi
+fi
+
+if [ "${pxe_boot_dir}" ]
+then
+    check_bootstrap_dir "${bootstrap_dir}"
+
+    if [ "${verbose}" -o "${debug}" ]
+    then
+        echo "creating pxe..."
+    fi
+
+    mkdir -p "${pxe_boot_dir}"
+    cp "${bootstrap_dir}"/boot/vmlinuz-* "${pxe_boot_dir}/kernel"
+    cd "${bootstrap_dir}"
+    find . -print0 | cpio --null -o --format=newc | gzip -9 > "${pxe_boot_dir}/initramfs"
+
+    mkdir -p "${pxe_boot_dir}/pxelinux.cfg"
+    cat <<EOPXEF > "${pxe_boot_dir}/pxelinux.cfg/default"
+    DEFAULT preos
+    LABEL preos
+    KERNEL kernel
+    APPEND utf8 load_ramdisk=1 root=/dev/ram nofb initrd=initramfs console=ttyS1,115200 net.ifnames=0
+EOPXEF
+
+    cp "${bootstrap_dir}/usr/lib/PXELINUX/pxelinux.0" "${pxe_boot_dir}/pxelinux.0"
+    cp "${bootstrap_dir}/usr/lib/syslinux/modules/bios/ldlinux.c32" \
+        "${pxe_boot_dir}/ldlinux.c32"
+    # network boot need all files world readable
+    chmod -R 644 "${pxe_boot_dir}"/*
+
+    if [ "${verbose}" -o "${debug}" ]
+    then
+        echo "pxe creation finished"
+    fi
+fi
+
+if [ "${drive}" ]
+then
+    trap "${TRAPFUNC}" 0 1 2 3 15
+    chroot_mount
+    chroot "${bootstrap_dir}" grub-install ${drive}
+    chroot "${bootstrap_dir}" /bin/sh -c "GRUB_DISABLE_OS_PROBER=true update-grub"
+    # set root password
+    if [ ! "${root_password}" ]
+    then
+        if ! which strings >/dev/null 2>&1
+        then
+            printf "strings is missing\n" >&2
+            exit 1
+        fi
+        root_password="$(head -n 1000 /dev/urandom | strings | \
+            grep -o '[[:alnum:]]' | head -n 30 | tr -d '\n')"
+        printf "Generated root password (without quotes):'${root_password}'\n"
+    fi
+    chroot "${bootstrap_dir}" /bin/sh -c "echo \"root:${root_password}\" | \
+        chpasswd"
+    # /etc/securetty must not be world writeable.
+    chmod 644 "${bootstrap_dir}"/etc/securetty
+    chroot_umount
+    trap - 0 1 2 3 15
+fi
+
+if [ "${rm_bootstrap_dir}" ]
+then
+    if [ "${verbose}" -o "${debug}" ]
+    then
+        echo "removing bootstrap dir..."
+    fi
+    rm -r -f "${bootstrap_dir}"
+    if [ "${verbose}" -o "${debug}" ]
+    then
+        echo "removing bootstrap dir finished"
+    fi
+fi
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/Makefile b/cdist/preos/debootstrap/files/devuan-debootstrap/Makefile
new file mode 100644
index 00000000..85168031
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/Makefile
@@ -0,0 +1,18 @@
+# avoid dpkg-dev dependency; fish out the version with sed
+VERSION := $(shell sed 's/.*(\(.*\)).*/\1/; q' debian/changelog)
+
+all:
+
+clean:
+
+DSDIR=$(DESTDIR)/usr/share/debootstrap
+install:
+	mkdir -p $(DSDIR)/scripts
+	mkdir -p $(DESTDIR)/usr/sbin
+
+	cp -a scripts/* $(DSDIR)/scripts/
+	install -o root -g root -m 0644 functions $(DSDIR)/
+
+	sed 's/@VERSION@/$(VERSION)/g' debootstrap >$(DESTDIR)/usr/sbin/debootstrap
+	chown root:root $(DESTDIR)/usr/sbin/debootstrap
+	chmod 0755 $(DESTDIR)/usr/sbin/debootstrap
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/README b/cdist/preos/debootstrap/files/devuan-debootstrap/README
new file mode 100644
index 00000000..4d8c3049
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/README
@@ -0,0 +1,65 @@
+README for debootstrap
+======================
+
+See the manpage for (some) documentation.
+
+Running debootstrap from source
+-------------------------------
+
+You can run debootstrap from its source tree without installing it. This
+can be useful if you want a quick way to make a Debian chroot on another
+system, or if you are testing modifications to debootstrap.
+
+First, get the source.
+
+* Either by using git
+  git clone https://anonscm.debian.org/git/d-i/debootstrap.git
+
+* Or by visiting <https://packages.debian.org/source/sid/debootstrap>
+  and downloading the tar.gz file
+
+Then in the debootstrap source directory:
+
+    export DEBOOTSTRAP_DIR=`pwd`
+    sudo ./debootstrap stable my-stable-dir
+
+If you are running a multi-stage boot strap (for example for a QEMU
+rootfs) you don't even need root:
+
+    export DEBOOTSTRAP_DIR=`pwd`
+    fakeroot ./debootstrap --foreign --arch=armhf testing my-testing-dir http://deb.debian.org/debian
+
+Of course you will need to execute the second stage as root to finish the bootstrap:
+
+   (on foreign hardware)
+   /debootstrap/debootstrap --second-stage
+
+
+Future
+------
+
+  * Cross-strap support - so you can bootstrap a filesystem to the
+    point where it will successfully boot, and finish installing itself
+    without having to be running the target architecture or OS yourself.
+
+	debootstrap --arch powerpc sarge ./sarge-ppc-chroot ...
+
+    on an i386 system, boot a powerpc box with sarge-ppc-chroot as its
+    root files system, and have it "work". The cross-hurd package does
+    something similar, and should be replaced by this feature.
+
+  * There should be some (better) way of telling debootstrap what "base"
+    packages you want to install -- this varies between making a chroot,
+    doing an install, and doing a buildd. Also, some installs want
+    different base packages (to setup networking, or kernels, eg)
+
+
+NMUing
+------
+
+If there's a problem with debootstrap that you need fixed, feel free to do
+an NMU to fix it. Usual rules: try not to break anything, and mail the
+patch to the BTS. Don't worry about asking first though.
+
+However, note that debootstrap is now team maintained. Anyone in d-i can do
+a release without the bother of a NMU.
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/TODO b/cdist/preos/debootstrap/files/devuan-debootstrap/TODO
new file mode 100644
index 00000000..e5fde0e4
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/TODO
@@ -0,0 +1,11 @@
+
+Features:
+  ++ second stage via chroot debootstrap/debootstrap
+  ++ debootstrap/deb file to record deb destinations/information
+
+  -- configuration file
+      -- versus command line
+      -- support for sources (vs mirrors)
+      -- faux-pinning for packages 
+
+  ++ makedev in second stage
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/.gitignore b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/.gitignore
new file mode 100644
index 00000000..39638d97
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/.gitignore
@@ -0,0 +1,6 @@
+debootstrap
+debootstrap-udeb
+files
+*.debhelper.log
+*.substvars
+
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/README.DevuanSource b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/README.DevuanSource
new file mode 100644
index 00000000..6446a088
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/README.DevuanSource
@@ -0,0 +1,15 @@
+To sync up with debians source for inspiration you should run the following:
+
+	`git remote add alioth-git git://anonscm.debian.org/d-i/debootstrap.git`
+	`git fetch alioth-git`
+
+After that you can either cherry-pick or merge releases from debian.  To
+merge a release, it's do:
+	`git tag` to list the release tags
+and
+	`git merge <tag>`
+followed by all the fixups and then commit with an appropriate message like
+	"Merging Release <tag> from debian"
+
+Copyright 2016 Daniel Reurich <daniel@centurion.net.nz>
+
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/changelog b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/changelog
new file mode 100644
index 00000000..8688197d
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/changelog
@@ -0,0 +1,2655 @@
+debootstrap (1.0.87+devuan1.1) unstable; urgency=medium
+
+  * add git to builddeps
+
+ -- Daniel Reurich <centurion@haggai.centurion.net.nz>  Fri, 13 Jan 2017 23:12:50 +1300
+
+debootstrap (1.0.87+devuan1.0) unstable; urgency=high
+
+  [ Julien Cristau ]
+  * Default to split /usr again, as merged-/usr breaks dpkg-shlibdeps
+    (closes: #844221).
+
+  [ Riku Voipio ]
+  * remove scratchbox2 support (closes: #796189)
+
+ -- Christian Perrier <bubulle@debian.org>  Wed, 16 Nov 2016 06:47:27 +0100
+
+debootstrap (1.0.86+devuan1.0) unstable; urgency=high
+
+  [ Daniel Reurich ]
+  * Restore Devuan Jessie version
+  * switch to 3.0 (git) source format
+  * set git-depth
+  * Add directions for inspiration from debians source
+  * removed file so we can build using git source format
+  * merge 1.0.86 for jessie
+
+ -- Daniel Reurich <centurion@haggai.centurion.net.nz>  Fri, 13 Jan 2017 15:58:19 +1300
+
+debootstrap (1.0.86) unstable; urgency=high
+
+  * Rework split_inline_sig by using shell built-ins instead of trying to
+    mix sed and tr together, which might work on regular systems but not
+    from inside the Debian Installer (Closes: #842591). Thanks to Ansgar
+    Burchardt for the proof of concept!
+
+ -- Cyril Brulebois <kibi@debian.org>  Sun, 30 Oct 2016 23:35:45 +0100
+
+debootstrap (1.0.85-1+devuan1) unstable; urgency=medium
+
+  * sync with debian upstream package
+  * add right keyrings with the new schema on devuan-keyring package
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Sat, 29 Oct 2016 23:21:57 +0200
+
+
+debootstrap (1.0.85) unstable; urgency=medium
+
+  [ Julien Cristau ]
+  * Add support for downloading and validating InRelease files, by splitting
+    up detached signature from signed data.
+  * Switch default mirror to deb.debian.org.
+
+  [ Colin Watson ]
+  * Add (Ubuntu) zesty as a symlink to gutsy.
+
+  [ Ansgar Burchardt ]
+  * Add jessie-kfreebsd to merged-/usr blacklist.
+  * No longer Build-Depend on makedev. The code using it was already
+    removed in debootstrap 1.0.82.
+  * Do not use `tar -k` for older releases which might have file
+    conflicts between the packages to be installed. (Closes: #838388)
+  * Error out when seeing short options. (Closes: #548880)
+  * Add oldoldstable -> sid script symlink. (Closes: #792734)
+  * Add buster -> sid and bullseye -> sid script symlinks.
+  * Only unpack and configure the base system when there are actually
+    packages to install. (Closes: #825034)
+  * debootstrap.8: Use stretch instead of wheezy in examples.
+
+  [ Marco d'Itri ]
+  * Enable merged-/usr by default. (Closes: #839046)
+
+ -- Julien Cristau <jcristau@debian.org>  Fri, 21 Oct 2016 20:22:49 +0200
+
+debootstrap (1.0.84) unstable; urgency=medium
+
+  [ Ansgar Burchardt ]
+  * Add support for xz-compressed Packages indices. (Closes: #837649)
+
+ -- Christian Perrier <bubulle@debian.org>  Thu, 06 Oct 2016 06:59:38 +0200
+
+debootstrap (1.0.83) unstable; urgency=medium
+
+  [ Ansgar Burchardt ]
+  * functions: Validate that the requested suite is listed in the
+    Release file's Suite or Codename field. (Closes: #837075)
+  * Add support for merged-/usr, enabled by a new --merged-usr option.
+    (Closes: #810301)
+  * Feign install of dpkg in second stage. This avoids problems when
+    using dpkg-deb together with busybox' tar. (Closes: #837185)
+  * README: Use https://.
+
+  [ Steve McIntyre ]
+  * Update Standards-Version to 3.9.8 (no changes needed)
+
+ -- Steve McIntyre <93sam@debian.org>  Tue, 13 Sep 2016 13:16:41 +0100
+
+debootstrap (1.0.82) unstable; urgency=medium
+
+  [ Alex Bennée ]
+  * Excise all devices.tar.gz code. Closes: #830869
+
+ -- Christian Perrier <bubulle@debian.org>  Thu, 08 Sep 2016 07:09:56 +0200
+
+debootstrap (1.0.81) unstable; urgency=medium
+
+  [ Luca Falavigna ]
+  * Add (Ubuntu) yakkety as a symlink to gutsy.
+
+ -- Christian Perrier <bubulle@debian.org>  Tue, 03 May 2016 06:51:57 +0200
+
+debootstrap (1.0.80-1+devuan1) unstable; urgency=medium
+
+  * sync with debian upstream package.
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Sun, 24 Apr 2016 06:16:29 +0200
+
+debootstrap (1.0.80) unstable; urgency=medium
+
+  [ Jon Boden ]
+  * scripts/gutsy: Support kfreebsd & hurd arches on Ubuntu targets
+    (closes: #818748)
+
+ -- Christian Perrier <bubulle@debian.org>  Tue, 22 Mar 2016 19:27:45 +0100
+
+debootstrap (1.0.79) unstable; urgency=medium
+
+  [ Samuel Thibault ]
+  * hurd: move setting up dev and servers firmlink to setup_proc stage. Also
+    firmlink proc there.  Thanks Gabriele Giacone for all the investigation!
+    (Closes: #768102)
+
+ -- Christian Perrier <bubulle@debian.org>  Fri, 19 Feb 2016 07:23:59 +0100
+
+debootstrap (1.0.78+nmu1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Split setup_devices in setup_devices (which now only deals with static
+    device nodes) and setup_dynamic_devices, and move the calls to
+    setup_devices from the beginning of the second stage to the end of the
+    first stage.
+    setup_dynamic_devices mounts the appropriate filesystems which provide
+    dynamic device nodes for the architectures which need one in
+    debootstrap (kfreebsd and hurd).
+    This fixes a bug in --second-stage introduced in 1.0.34 and exposed
+    by the devices-related changes of 1.0.76: the second stage debootstrap
+    runs "dpkg --print-architecture >/dev/null" at the very beginning of
+    the program when /dev is still empty, so it creates an empty regular
+    file in place of /dev/null and this will cause mknod to fail later.
+    (Closes: #813232)
+
+ -- Marco d'Itri <md@linux.it>  Wed, 17 Feb 2016 01:23:23 +0100
+
+debootstrap (1.0.78) unstable; urgency=high
+
+  * Use HTTPS for Vcs-* URLs, and link to cgit rather than gitweb.
+  * Don't call mknod with the --mode option, it's not supported in
+    busybox. Use -m instead - fixes the broken fix for #812811.
+    Closes: #813124. Urgency high to get this fix propagated quickly -
+    it's breaking d-i installs right now. Adding myself to uploaders and
+    uploading.
+
+ -- Steve McIntyre <93sam@debian.org>  Fri, 29 Jan 2016 16:36:00 +0000
+
+debootstrap (1.0.77) unstable; urgency=medium
+
+  [ Marco d'Itri ]
+  * Fix permissions on device nodes (Closes: #812811).
+
+ -- Cyril Brulebois <kibi@debian.org>  Wed, 27 Jan 2016 20:22:05 +0100
+
+debootstrap (1.0.76) unstable; urgency=medium
+
+  [ Marco d'Itri ]
+  * Stop creating useless device nodes (Closes: #571136).
+
+ -- Cyril Brulebois <kibi@debian.org>  Sun, 24 Jan 2016 08:55:18 +0100
+
+debootstrap (1.0.75-1+devuan1) unstable; urgency=medium
+
+  * sync with debian upstream package 
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Wed, 02 Dec 2015 04:05:36 +0100
+
+debootstrap (1.0.75) unstable; urgency=medium
+
+  * Stop cleaning KEEP_DEBOOTSTRAP_DIR twice, as spotted by Chris Lamb
+    (Closes: #804415).
+  * Add Tanglu support (Closes: #771687), thanks to Matthias Klumpp. At
+    the moment, the following extra suites are recognized:
+     - aequorea
+     - bartholomea
+     - chromodoris
+     - dasyatis
+
+ -- Cyril Brulebois <kibi@debian.org>  Wed, 11 Nov 2015 18:49:28 +0100
+
+debootstrap (1.0.74) unstable; urgency=medium
+
+  [ Colin Watson ]
+  * Add (Ubuntu) xenial as a symlink to gutsy.
+
+ -- Christian Perrier <bubulle@debian.org>  Tue, 03 Nov 2015 07:09:23 +0100
+
+debootstrap (1.0.73) unstable; urgency=medium
+
+  * Generate a deburis file with (package, version, uri) tuples, similar
+    to the existing debpaths.
+
+ -- Cyril Brulebois <kibi@debian.org>  Thu, 22 Oct 2015 12:43:35 +0200
+
+debootstrap (1.0.72-1+devuan1) unstable; urgency=medium
+
+  * Rebase on debian 1.0.70 debootstrap version
+  * Added Daniel Reurich in Uploaders
+  * Integrating Daniel Reurich patches for d-i
+  * Updated manpage with Daniel Reurich changes
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Thu, 21 May 2015 05:45:36 +0200
+
+debootstrap (1.0.72) unstable; urgency=medium
+
+  [ Iain Lane ]
+  * Add (Ubuntu) wily as a symlink to gutsy (closes: #787117).
+
+  [ Colin Watson ]
+  * Fix resolve_deps and setup_available to work in the --foreign case
+    (closes: #757819, LP: #1450980).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 28 Jul 2015 14:32:19 +0100
+
+debootstrap (1.0.71-1+devuan1) unstable; urgency=medium
+
+  * make devuan-baseconf and devuan-keyring requireds packages
+  * make sure we have sysvinit-core and not systemd in the chroot
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Fri, 01 May 2015 02:13:04 +0200
+
+debootstrap (1.0.71) unstable; urgency=medium
+
+  * Adjust sed call to render it more portable (missing ';'), making it
+    work with FreeBSD sed. Thanks to Nikolai Lifanov for the report and
+    the patch (Closes: #791802).
+
+ -- Cyril Brulebois <kibi@debian.org>  Fri, 10 Jul 2015 01:29:52 +0200
+
+debootstrap (1.0.70-1+devuan1) unstable; urgency=medium
+
+  * Debianization of debootstrap.
+  * added ceres script and link jessie and ascii to it
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Sat, 11 Apr 2015 08:03:36 +0200
+
+debootstrap (1.0.70) unstable; urgency=medium
+
+  * Use tr instead of (missing in d-i) xargs (Closes: #785693). Thanks,
+    Julian Schauder!
+
+ -- Cyril Brulebois <kibi@debian.org>  Tue, 19 May 2015 11:38:27 +0200
+
+debootstrap (1.0.69-1+devuan1) unstable; urgency=medium
+
+  * Fix package description.
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Sat, 07 Mar 2015 21:31:07 +0100
+
+debootstrap (1.0.69) unstable; urgency=medium
+
+  [ Cyril Brulebois ]
+  * Make sure to deduplicate package list in download_release to avoid
+    issues while counting downloaded packages. The failure path could lead
+    to printing some strange integer (Closes: #709751, #768445, #785276,
+    #774752).
+    This was reported to mostly happen whenever --no-resolve-deps is used.
+  * Add support for --force-check-gpg so that one can programmatically
+    make sure keyring checks are used and that no fallback to an https
+    mirror happens (Closes: #661501, #733179, #775454).
+  * Switch default mirror from ftp.us.debian.org to the new, official
+    http redirector service: httpredir.debian.org
+  * Make it possible to override the MAKEDEV variable (Closes: #734743).
+    Thanks, Wookey!
+
+  [ Christian Perrier ]
+  * Update Standards to 3.9.6 (checked)
+
+ -- Christian Perrier <bubulle@debian.org>  Mon, 18 May 2015 14:07:43 +0200
+
+debootstrap (1.0.68-2+devuan1) unstable; urgency=medium
+
+  * Added missing symlink.
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Sat, 07 Mar 2015 21:18:26 +0100
+
+debootstrap (1.0.68-1+devuan1) unstable; urgency=medium
+
+  * Added script for ascii.
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Sat, 07 Mar 2015 11:47:02 +0100
+debootstrap (1.0.68) unstable; urgency=medium
+
+  [ Steven Chamberlain ]
+  * Support the jessie-kfreebsd suite, by using the same script as
+    jessie (a symlink to sid) (Closes: #784927).
+
+ -- Christian Perrier <bubulle@debian.org>  Mon, 11 May 2015 07:46:19 +0200
+
+debootstrap (1.0.67-1+devuan2) unstable; urgency=medium
+
+  * Switch to quilt format
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Tue, 03 Mar 2015 07:44:11 +0100
+
+debootstrap (1.0.67+devuan1) unstable; urgency=medium
+
+  * Applied init freedom patch (debian bug 668001)
+  * moved to devuan
+
+ -- Franco (nextime) Lanza <nextime@devuan.org>  Tue, 03 Mar 2015 07:09:36 +0100
+
+debootstrap (1.0.67) unstable; urgency=medium
+
+  [ Cyril Brulebois ]
+  * Apply patch by Jérémy Bobbio to support reproducible builds: specify
+    a modification time on the tar side, and add the -n option to gzip
+    (Closes: #774069). Thanks, Jérémy!
+  * Update setup_apt_sources to look at USE_COMPONENTS if COMPONENTS is
+    empty, fixing the empty sources.list bug with foreign architectures
+    (Closes: #732255, #773867).
+
+ -- Christian Perrier <bubulle@debian.org>  Wed, 14 Jan 2015 07:03:17 +0100
+
+debootstrap (1.0.66) unstable; urgency=low
+
+  [ Cyril Brulebois ]
+  * Specify gzip compression in debian/source/options to allow for better
+    portability on other platforms (Closes: #770214). Thanks, Joey Hess!
+  * Specify gzip compression for debootstrap, and xz for debootstrap-udeb,
+    to mitigate the need for xz on non-Debian platforms (see: #770217).
+
+ -- Christian Perrier <bubulle@debian.org>  Mon, 24 Nov 2014 09:15:50 +0100
+
+debootstrap (1.0.65) unstable; urgency=medium
+
+  [ Julien Cristau ]
+  * Add support for stretch.
+
+ -- Christian Perrier <bubulle@debian.org>  Mon, 10 Nov 2014 09:24:56 +0100
+
+debootstrap (1.0.64) unstable; urgency=medium
+
+  * Add (Ubuntu) vivid as a symlink to gutsy.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 20 Oct 2014 16:48:49 +0100
+
+debootstrap (1.0.63) unstable; urgency=medium
+
+  [ Joey Hess ]
+  * Move set -e out of shebang line. Closes: #762713
+
+ -- Christian Perrier <bubulle@debian.org>  Thu, 25 Sep 2014 06:44:16 +0200
+
+debootstrap (1.0.62) unstable; urgency=medium
+
+  [ Cyril Brulebois ]
+  * Fix reporting of package version in retrieval and validation steps
+    to cope with epochs.
+
+ -- Christian Perrier <bubulle@debian.org>  Mon, 15 Sep 2014 11:40:54 +0200
+
+debootstrap (1.0.61) unstable; urgency=medium
+
+  * Fix "possibly the package $pkg is at fault" warnings to account for
+    changed error output in dpkg 1.17.2.
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 31 Aug 2014 22:07:49 +0100
+
+debootstrap (1.0.60) unstable; urgency=medium
+
+  [ Adam Conrad ]
+  * Add (Ubuntu) utopic as a symlink to gutsy.
+
+  [ Guillem Jover ]
+  * Sync deb support with latest dpkg-deb (closes: #739136):
+    - Add uncompressed data.tar deb member support.
+    - Add uncompressed and xz control.tar deb member support.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 06 May 2014 09:37:34 +0100
+
+debootstrap (1.0.59) unstable; urgency=medium
+
+  * Install ca-certificates as well as apt-transport-https for HTTPS
+    installations.  This makes it possible to copy certificates that were
+    built into the installer to /usr/local/share/ca-certificates/ and thus
+    have them continue to be trusted after installation.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 13 Feb 2014 13:42:54 +0000
+
+debootstrap (1.0.58) unstable; urgency=medium
+
+  * Policy version 3.9.5: no changes required.
+  * Install apt-transport-https if installing from an HTTPS mirror
+    (LP: #1135163).  It may still be necessary to copy certificates into
+    place, but there's at least a reasonable chance that somebody installing
+    from HTTPS may want to keep using it, and we have to install
+    apt-transport-https at this point otherwise they won't be able to do
+    that end-to-end.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 11 Feb 2014 17:46:41 +0000
+
+debootstrap (1.0.57) unstable; urgency=medium
+
+  * pkgdetails_perl: Only interpret percentages following whitespace, to
+    cope with GNU wget outputting the local file name (which may contain "%"
+    due to URL-encoding) after it finishes the download (LP: #1172101).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 07 Feb 2014 16:12:23 +0000
+
+debootstrap (1.0.56) unstable; urgency=low
+
+  [ Tollef Fog Heen ]
+  * Install base-passwd and base-files in two calls rather than one to
+    avoid problems with home-built media with different ordering in
+    Packages.  Thanks to Jo Shields for pointing this out and providing
+    the workaround.  Closes: #601670.  LP: #1001131.
+
+  [ Joey Hess ]
+  * When deboostrapping Debian, and the debian-archive-keyring is not
+    available, switch the default mirror to a https url. This way at
+    least the CA level of security is available even for users who
+    have no way to check gpg keys in the WoT. The https mirror is
+    currently https://mirrors.kernel.org/debian.
+  * Avoid writing https urls into sources.list, as apt does not support https.
+
+ -- Christian Perrier <bubulle@debian.org>  Mon, 30 Dec 2013 08:00:41 +0100
+
+debootstrap (1.0.55) unstable; urgency=low
+
+  [ Matthias Klose ]
+  * Add (Ubuntu) trusty as a symlink to gutsy.
+
+ -- Christian Perrier <bubulle@debian.org>  Tue, 22 Oct 2013 13:43:23 +0200
+
+debootstrap (1.0.53) unstable; urgency=low
+
+  [ Dmitrijs Ledkovs ]
+  * Set debian source format to '3.0 (native)'.
+  * Bump debhelper compat level to 9.
+  * Set Vcs-* to canonical format.
+
+  [ Christian Perrier ]
+  * Update Standards to 3.9.4 (checked)
+
+ -- Christian Perrier <bubulle@debian.org>  Sun, 14 Jul 2013 13:06:33 +0200
+
+debootstrap (1.0.52) unstable; urgency=low
+
+  * scripts/gutsy: Make the fake initctl pass through "initctl version"
+    calls, used by such things as invoke-rc.d to figure out whether it's
+    running under Upstart (LP: #1182540).
+  * scripts/sid, scripts/gutsy: Add a policy-rc.d, matching that in
+    debian-installer-utils.  This is the primary way to disable daemon
+    startup.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 22 May 2013 16:55:59 +0100
+
+debootstrap (1.0.51) unstable; urgency=low
+
+  [ Scott Kitterman ]
+  * Add (Ubuntu) saucy as a symlink to gutsy (closes: #706989).
+
+  [ Colin Watson ]
+  * Clarify location of pkgdetails.c in error message (closes: #708771).
+  * Resolve mount point symlinks relative to the target chroot before
+    unmounting them (closes: #702861, #703037, #704744).
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 18 May 2013 23:18:08 +0100
+
+debootstrap (1.0.50) unstable; urgency=low
+
+  [ Hector Oron ]
+  * Report package version information on package retrieve and validation.
+    Closes: #697675
+
+ -- Christian Perrier <bubulle@debian.org>  Fri, 17 May 2013 13:34:34 +0200
+
+debootstrap (1.0.49) unstable; urgency=medium
+
+  * Add support for jessie. Closes: #706788
+
+ -- Joey Hess <joeyh@debian.org>  Sat, 04 May 2013 23:37:52 -0400
+
+debootstrap (1.0.48) unstable; urgency=low
+
+  * Team upload
+
+  [ Julien Cristau ]
+  * Disable InRelease support.  gpgv won't give us back the signed data, and
+    full gpg is not available inside d-i (closes: #703889).
+  * Move extract_release_components to after signature verification.
+    Suggested by Ansgar Burchardt.
+
+ -- Didier Raboud <odyx@debian.org>  Thu, 04 Apr 2013 16:17:57 +0200
+
+debootstrap (1.0.47) unstable; urgency=low
+
+  * Team upload
+  * Properly decrypt the InRelease file when downloading from an archive
+    where InRelease is used. This longstanding bug was masked by former
+    APT behaviour and was revealed only with recent APT versions
+    Closes: #703146
+    Thanks to Michael Vogt for the analysis and patch
+  * Add a dependency on gpg because of the above change.
+
+ -- Christian Perrier <bubulle@debian.org>  Wed, 20 Mar 2013 21:34:29 +0100
+
+debootstrap (1.0.46) unstable; urgency=low
+
+  * Team upload.
+  * Use `which` to find out sh only if /bin/sh does not exist.
+
+ -- Samuel Thibault <sthibault@debian.org>  Thu, 27 Dec 2012 15:47:16 +0100
+
+debootstrap (1.0.45) unstable; urgency=low
+
+  [ Joey Hess ]
+  * Better support use on Android by not hardcoding /bin/sh
+    in a test file that's created, and instead putting in the
+    actual path to sh. Closes: #694310 Thanks, Shawn Landden
+
+ -- Christian Perrier <bubulle@debian.org>  Sat, 22 Dec 2012 12:56:32 +0100
+
+debootstrap (1.0.44) unstable; urgency=low
+
+  * Remove double quotes to fix for loop on GNU/kFreeBSD, thanks to
+    Oleg Ginzburg (Closes: #693718).
+
+ -- Cyril Brulebois <kibi@debian.org>  Tue, 20 Nov 2012 23:55:53 +0100
+
+debootstrap (1.0.43) unstable; urgency=low
+
+  [ Joey Hess ]
+  * Fix "arc" typo. Closes: #686680
+
+  [ Colin Watson ]
+  * Add (Ubuntu) raring as a symlink to gutsy.
+
+  [ Christian Perrier ]
+  * Add myself to Uploaders and drop Anthony Towns who is no
+    longer active in debootstrap maintenance for a few years. Thanks
+    for your work, Anthony.
+  * Bump Standards to 3.9.3 (checked)
+  * Replace XC-Package-Type by Package-Type in debian/control
+
+ -- Christian Perrier <bubulle@debian.org>  Sat, 27 Oct 2012 12:46:46 +0200
+
+debootstrap (1.0.42) unstable; urgency=low
+
+  * Downgrade the absence of an InRelease file from a warning to an info
+    message.  For now, debootstrap can cope fine without, and it's possible
+    there are Debian mirrors that don't have InRelease; Ubuntu doesn't quite
+    have InRelease support yet either (LP: #1017398).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 03 Jul 2012 15:34:57 +0100
+
+debootstrap (1.0.41) unstable; urgency=low
+
+  [ Mehdi Dogguy ]
+  * Add support for InRelease files (Closes: #638682)
+
+ -- Joey Hess <joeyh@debian.org>  Thu, 21 Jun 2012 13:16:22 -0400
+
+debootstrap (1.0.40) unstable; urgency=low
+
+  [ Joey Hess ]
+  * When installation or configuration of a package fails, output a message
+    that points the user to the log file. Attempt to grep out the first 
+    package that dpkg failed on and show its name too. Closes: #472704
+
+  [ Colin Watson ]
+  * Add (Ubuntu) quantal as a symlink to gutsy.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 26 Apr 2012 17:44:44 +0100
+
+debootstrap (1.0.39) unstable; urgency=low
+
+  * Retry corrupted downloads rather than carrying on almost regardless.
+    Patch mostly due to Michael Gilbert, rearranged somewhat by me (closes:
+    #618920).
+  * Stop at the end of the retrieval phase if any packages failed to
+    download.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 13 Mar 2012 17:21:13 +0000
+
+debootstrap (1.0.38) unstable; urgency=low
+
+  [ Joey Hess ]
+  * Improve error message when a decompressor is not available, 
+    to indicate which package has been built with bzip today.
+    Closes: #644719
+
+  [ Otavio Salvador ]
+  * Fix --print-debs support when using --foreign param. Closes:
+    #551837.
+
+  [ Colin Watson ]
+  * pkgdetails_perl: Use the last of a sequence of stanzas for the same
+    package name, rather than the first (closes: #649319).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 21 Nov 2011 13:20:53 +0000
+
+debootstrap (1.0.37) unstable; urgency=low
+
+  * Add (Ubuntu) precise as a symlink to gutsy.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 05 Oct 2011 21:58:37 +0100
+
+debootstrap (1.0.36) unstable; urgency=low
+
+  * Guess host OS based on uname for non-Debian systems. Closes: #637363
+  * Clarify "target" in usage message.
+  * Fix support for running debootstrap on a FreeBSD host to create a kFreeBSD
+    chroot or jail. Thanks, Arno Toell.
+  * Search PATH for programs, rather than checking hardcoded locations.
+  * Support using md5 and shaN programs, as found on FreeBSD, in addition
+    to md5sum and shaNsum.
+  * When FreeBSD (not kfreebsd) is the host, don't chroot to mount special
+    filesystems.
+  * When debootstrapping on FreeBSD, warn if necessary modules are not
+    loaded. Thanks, Arno Toell.
+  * Workaround for umount bug #634107, which broke pbuilder and "debootstrap ."
+    Closes: #631087
+
+ -- Joey Hess <joeyh@debian.org>  Sun, 21 Aug 2011 18:39:26 -0400
+
+debootstrap (1.0.35) unstable; urgency=low
+
+  [ Robert Millan ]
+  * Don't build devices.tar.gz if building on GNU/kFreeBSD (closes:
+    #637297).
+  * Don't use --arch when we specifically care about the host architecture
+    (closes: #637298).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 10 Aug 2011 13:04:41 +0100
+
+debootstrap (1.0.34) unstable; urgency=low
+
+  * Add more information regarding the version and architecture in case
+    a download fails. Closes: #633625.
+  * add /usr/sbin and /sbin to PATH for fakechroot variant. Closes:
+    #588773
+  * Move setup_devices to second stage of bootstrap. Closes: #498731,
+    #531316
+
+ -- Otavio Salvador <otavio@debian.org>  Thu, 28 Jul 2011 19:13:10 +0200
+
+debootstrap (1.0.33) unstable; urgency=low
+
+  [ Joey Hess ]
+  * Mention minbase variant in --help. Closes: #632418
+  * Use md5sums for sarge, which did not consistently have sha1sums
+    everywhere. Closes: #633158
+
+  [ Colin Watson ]
+  * Improve text of error message when decompression command is not
+    available.
+
+ -- Otavio Salvador <otavio@debian.org>  Sun, 24 Jul 2011 10:33:56 +0200
+
+debootstrap (1.0.32) unstable; urgency=low
+
+  * Use md5sums for woody and potato, which only had those checksums
+    in the Packages files. Closes: #627365
+
+ -- Joey Hess <joeyh@debian.org>  Mon, 30 May 2011 13:57:46 -0400
+
+debootstrap (1.0.31) unstable; urgency=low
+
+  [ Mark Hymers ]
+  * Don't use the Build-Essential: yes field in Debian, use the
+    build-essential package. Closes: #619700.
+
+  [ Colin Watson ]
+  * If ubuntu-keyring is installed, check Release signatures against it when
+    bootstrapping Ubuntu gutsy and later.
+  * Recommend ubuntu-keyring rather than debian-archive-keyring on
+    Ubuntu-derived systems.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 20 May 2011 09:45:48 +0100
+
+debootstrap (1.0.30) unstable; urgency=low
+
+  [ Joey Hess ]
+  * Recommend debian-archive-keyring, and if it is installed,
+    default to checking gpg signatures of the Release file against it
+    when bootstrapping sid, squeeze, wheezy, etch, and lenny.
+    Closes: #560038
+  * Add --no-check-gpg option that can be used to disable release file
+    verification. Closes: #624229
+  * Needs base-installer 1.117.
+  * Add a warning message if the keyring file is not available, and
+    --no-check-gpg is not specified.
+  * Clear all global variables used for options, so that unclean
+    environment doesn't break debootstrap. Closes: #621657
+  * Removed the --boot-floppies switch and mode. Assuming this has
+    not been used in 10 years.
+
+  [ Colin Watson ]
+  * Resolve dependencies from all requested components (LP: #740167).
+
+ -- Joey Hess <joeyh@debian.org>  Tue, 26 Apr 2011 17:10:00 -0400
+
+debootstrap (1.0.29) unstable; urgency=low
+
+  [ Joey Hess ]
+  * Support bootstrapping oldstable. (Lenny could already be bootstrapped
+    using that suite name.)
+
+  [ Colin Watson ]
+  * Add (Ubuntu) oneiric as a symlink to gutsy.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 22 Mar 2011 10:58:49 +0000
+
+debootstrap (1.0.28) unstable; urgency=low
+
+  [ Miguel Figueiredo ]
+  * Fix for ar usage, thanks to Guillem Jover. Closes: #598729
+
+  [ Joey Hess ]
+  * Remove 5 second sleeps when debootstrap finds additional required
+    dependencies. d-i just got that much faster.
+  * Use SHA checksums. Defaulting to SHA256, and configurable by 
+    SHA_SIZE environment variable. Closes: #614315
+  * If a sha256sum program is not available, fall back to sha1sum.
+    This is to support debootstrap use on embedded systems, which are more
+    likely to have the latter.
+  * Avoid new(?) warning from dpkg about missing Maintainer field when
+    feigning install of a package.
+
+ -- Joey Hess <joeyh@debian.org>  Mon, 21 Feb 2011 20:48:46 -0400
+
+debootstrap (1.0.27) unstable; urgency=low
+
+  [ Miguel Figueiredo ]
+  * Fix bug and typo on --private-key
+    Patch by Jonathan Klee. 
+
+  [ Jeremie Koenig ]
+  * Hurd support:
+    - Use the newer setup-translators script and firmlink
+      $TARGET/{dev,servers} in setup_devices_hurd;
+    - Don't attempt to build devices.tar.gz, which is not needed.
+
+ -- Otavio Salvador <otavio@debian.org>  Mon, 07 Feb 2011 19:40:24 -0200
+
+debootstrap (1.0.26) unstable; urgency=low
+
+  [ Christian Perrier ]
+  * Consistently use tab indenting in scripts/gutsy and scripts/sid
+    Patch by Karl Goetz. Closes: #601821
+  * Fix a typo in the debootstrap script
+    Patch by Karl Goetz. Closes: #601822
+
+  [ Joey Hess ]
+  * sid: Remove old workaround for etch era coreutils/textutils md5sum
+    diversion problem. (#329394)
+
+ -- Otavio Salvador <otavio@debian.org>  Fri, 12 Nov 2010 10:07:41 -0200
+
+debootstrap (1.0.25) unstable; urgency=low
+
+  * Remove debug statement that slipped in.
+  * Add test to guard against devices.tar.gz being empty.
+  * /dev/MAKEDEV cannot be relied on (udev likes to make it a symlink to
+    true). Always use /sbin/MAKEDEV. Closes: #598080
+
+ -- Joey Hess <joeyh@debian.org>  Sun, 26 Sep 2010 13:18:31 -0400
+
+debootstrap (1.0.24) unstable; urgency=low
+
+  [ Miguel Figueiredo ]
+  * Apply patches from by Jonathan Klee and Guillaume Chauvel 
+    to add support to https (closes: #521196).
+
+  [ Colin Watson ]
+  * Add (Ubuntu) natty as a symlink to gutsy.
+
+  [ Joey Hess ]
+  * Add support for wheezy. Closes: #597461
+
+ -- Joey Hess <joeyh@debian.org>  Sun, 19 Sep 2010 21:40:00 -0400
+
+debootstrap (1.0.23) unstable; urgency=low
+
+  * Add (Ubuntu) maverick as a symlink to gutsy.
+  * Add ${misc:Depends}.
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 19 May 2010 13:35:34 +0100
+
+debootstrap (1.0.22) unstable; urgency=low
+
+  * Redo release since it ended up with testing directory in tar.gz.
+
+ -- Otavio Salvador <otavio@debian.org>  Mon, 22 Feb 2010 16:52:49 -0300
+
+debootstrap (1.0.21) unstable; urgency=low
+
+  [ Otavio Salvador ]
+  * Apply patch from Clint Adams <schizo@debian.org> to add support for
+    gz/bz2/xz data.tar (closes: #458663).
+
+  [ Guillem Jover ]
+  * Refactor deb extractors into two new functions.
+  * Use dpkg-deb if available instead of ar (closes: #557296).
+  * Add an --extractor option to override the automatic extractor selection.
+
+  [ Otavio Salvador ]
+  * Document new --extractor option in manpage.
+  * Apply patch from Vagrant Cascadian <vagrant+bugs@freegeek.org> not
+    fail if resolv.conf is a broken symlink (closes: #390647).
+
+  [ Frans Pop ]
+  * Use tab indentation in scripts/debian/sid to reduce its size (relevant
+    for Debian Installer).
+  * Add apt to base packages for the buildd variant as it is no longer marked
+    Build-Essential.
+
+  [ Otavio Salvador ]
+  * Apply patch from Andres Salomon <dilinger@collabora.co.uk> to honor
+    --components when using mirror_style 'main' (closes: #561283).
+  * Apply patch from Andres Salomon <dilinger@collabora.co.uk> to fix
+    iteration through components in download_main (closes: #561298).
+
+  [ Joey Hess ]
+  * Allow the suite to be stable, testing, or unstable when debootstrapping
+    Debian. Closes: #288109
+  * Make scripts directory in source tree look like installed directory,
+    and add a section to README explaining an easy way to run
+    debootstrap w/o installing it. Closes: #345762
+  * Convert rules file to use dh with overrides.
+  * Remove binary-basedebs target from debian/rules.
+    This target has been broken in multiple ways since 2007. While I
+    accidentially partially fixed it with the above changes, this is evidence
+    it's dead code that can be safely removed.
+
+ -- Otavio Salvador <otavio@debian.org>  Sun, 21 Feb 2010 23:11:06 -0300
+
+debootstrap (1.0.20) unstable; urgency=low
+
+  * For recent Ubuntu versions, move $TARGET/sbin/initctl aside in the same
+    way we do start-stop-daemon, so that attempts to control Upstart jobs
+    won't inadvertently affect jobs in the host system.
+  * Rename EXAMPLE section in debootstrap(8) to EXAMPLES (closes: #548458).
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 04 Oct 2009 21:23:07 +0100
+
+debootstrap (1.0.19) unstable; urgency=low
+
+  * Ignore failures from dpkg --predep-package. It exits 1 if there are no
+    suitable packages available, which isn't an error for us, but in_target
+    complains anyway, so just use in_target_nofail; the termination
+    condition is handled immediately afterwards anyway.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 24 Sep 2009 19:57:05 +0100
+
+debootstrap (1.0.18) unstable; urgency=low
+
+  * Only use dpkg from the chroot, as there is no guarantee dpkg is 
+    available outside of the chroot (d-i installation for example).
+
+ -- Aurelien Jarno <aurel32@debian.org>  Wed, 23 Sep 2009 11:37:01 +0200
+
+debootstrap (1.0.17) unstable; urgency=low
+
+  * Remove boneheaded use of sudo left over from testing (closes: #547949).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 22 Sep 2009 20:10:19 +0100
+
+debootstrap (1.0.16) unstable; urgency=low
+
+  [ Colin Watson ]
+  * Cope with pre-dependencies of included packages that aren't in Priority:
+    required (closes: #487908).
+  * Upgrade to debhelper v7. (Override rules get pretty hairy for this
+    package, so I haven't switched to dh(1).)
+  * Use ports.ubuntu.com as default mirror on sparc for Ubuntu hardy and
+    beyond (LP: #431145).
+  * Add (Ubuntu) lucid as a symlink to gutsy.
+
+  [ Frans Pop ]
+  * Makefile: remove unused ARCH variable.
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 21 Sep 2009 16:28:40 +0100
+
+debootstrap (1.0.15) unstable; urgency=low
+
+  * On Linux, clear out /etc/mtab on exit if it's not a symlink. Should fix
+    problems Wouter Verhelst and Martin Michlmayr are seeing with
+    initramfs-tools MODULES=dep, although it probably isn't a perfect
+    solution.
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 23 Jul 2009 16:45:00 +0100
+
+debootstrap (1.0.14) unstable; urgency=low
+
+  * Apply patch from Felix Zielcke <fzielcke@z-51.de> to use "dpkg
+    --print-architecture" to avoid deprecation warning. Closes: #531680.
+  * Reference squeeze instead of sarge in manpage. Based on a patch from
+    Geoff Simmons <gsimmons@gsimmons.org>. Closes: #534575.
+  * Apply patch from Riku Voipio <riku.voipio@iki.fi> to add support for
+    scratchbox variant. Closes: #536820.
+
+ -- Otavio Salvador <otavio@ossystems.com.br>  Wed, 22 Jul 2009 12:34:54 -0300
+
+debootstrap (1.0.13) unstable; urgency=low
+
+  [ Otavio Salvador ]
+  * Apply patch from Luca Favatella <slackydeb@gmail.com> to improve
+    coding style.
+
+  [ Colin Watson ]
+  * Add (Ubuntu) karmic as a symlink to gutsy.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 24 Apr 2009 20:08:24 +0100
+
+debootstrap (1.0.12) unstable; urgency=low
+
+  [ Otavio Salvador ]
+  * Improve code to choose between libc packages. Thanks to Luca Favatella
+    <slackydeb@gmail.com> for first version of the patch.
+
+  [ Colin Watson ]
+  * Remove partial support for emitting translated progress messages with
+    gettext. Don't panic; d-i still has all the support necessary for this.
+    debootstrap's own support for doing this outside d-i with gettext's
+    shell bindings has been completely broken ever since it was added in
+    2003, though, and nobody has complained. Fixing it would require a big
+    pile of infrastructure and some non-trivial patches, plus arranging to
+    copy all the translations over from base-installer, and it just doesn't
+    seem worth it, so lose the cruft (LP: #188690).
+  * Export PATH, just to make sure. It isn't necessarily exported by shells
+    running from init=/bin/sh or similar, and the upstream bash maintainer
+    is unwilling to export it by default; it's easy enough to do so here
+    (LP: #320188).
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 17 Mar 2009 16:38:46 +0000
+
+debootstrap (1.0.11) unstable; urgency=low
+
+  * Add (Ubuntu) jaunty as a symlink to gutsy.
+  * Clarify that --second-stage is needed to complete the bootstrapping
+    process after --foreign.
+  * Fix --make-tarball= option (closes: #484869).
+  * Fix old Debian scripts and all Ubuntu scripts to cope with Anthony's
+    change in 1.0.8 to make --second-stage not bother recalculating required
+    and base.
+  * Rename 'repeat' to 'repeatn', since 'repeat' is a reserved word in zsh;
+    although strictly speaking this seems like an incompatibility in zsh
+    when linked to /bin/sh (closes: #340058).
+  * Fix --unpack-tarball= option (thanks, Torsten Landschoff; closes:
+    #500759).
+  * Fix handling of relative DEBOOTSTRAP_DIR (thanks, Mikhail Gusarov;
+    closes: #503460).
+  * Cope with ancient versions of chroot(8) that don't call chdir() (thanks,
+    Patrik Arvhult; closes: #350635).
+  * Recommend gnupg for --keyring option (thanks, Robert Millan; closes:
+    #467571).
+  * Note that you can't --include packages with non-required Pre-Depends
+    (see #487908).
+  * Mention /sys in EXAMPLE section of manual page, and use "defaults"
+    rather than "none" as the mount options for /proc (thanks, Raúl Sánchez
+    Siles; closes: #410787).
+  * Add /dev/console to devices.tar.gz (after all, MAKEDEV's 'consoleonly'
+    was added for boot-floppies in the first place; see
+    https://lists.ubuntu.com/archives/ubuntu-devel/2009-January/027230.html).
+  * Add support for squeeze (closes: #513488).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 18 Feb 2009 23:46:12 +0000
+
+debootstrap (1.0.10) unstable; urgency=low
+
+  [ Joey Hess ]
+  * Avoid "broken pipe" errors in bootstrap.log from the the smallyes function.
+    The errors themselves are inherent to how the function is used, so just
+    suppress them. Closes: #480560.
+
+  [ Frans Pop ]
+  * Do not cache Release and Release.gpg files. Closes: #488424.
+  * Abort if a Packages file failed to verify.
+  * Update standards version to 3.8.0; no other changes needed.
+
+ -- Frans Pop <fjp@debian.org>  Wed, 02 Jul 2008 17:44:25 +0200
+
+debootstrap (1.0.9) unstable; urgency=low
+
+  [ Frans Pop ]
+  * Error out on unrecognized options to avoid invalid options to be
+    recognized as arguments.
+
+  [ Colin Watson ]
+  * Use 'chown 0:0' in all scripts rather than deprecated 'chown 0.0'
+    (thanks, Evan Klitzke).
+  * Add (Ubuntu) intrepid as a symlink to gutsy.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 29 Apr 2008 19:36:19 +0100
+
+debootstrap (1.0.8) unstable; urgency=low
+
+  [ Frans Pop ]
+  * Change Priority for the udeb to extra in line with overrides file.
+
+  [ Colin Watson ]
+  * Partially revert r50134; there are people who depend on being able to
+    use the "upstream" Makefile on non-Debian systems. Create necessary
+    directories in the Makefile rather than relying on dh_installdirs to do
+    it (LP: #172645).
+  * Use ftp.us.debian.org rather than ftp.debian.org
+    (http://lists.debian.org/debian-devel-announce/2007/12/msg00002.html).
+
+  [ Anthony Towns ]
+  * Add minbase variant for the sid script that only install apt (and
+    its dependencies) instead of all of base. (Closes: Bug#351912,
+    Bug#452654)
+  * Make --second-stage not bother recalculating required and base as
+    it's not needed.
+  * Make --arch and other arguments accept both "--arch i386" and
+    "--arch=i386" forms of specifying a parameter to avoid the
+    inconsistency.
+
+  [ Stephen R. Marenka ]
+  * Allow installation of etch-m68k. (Closes: Bug#458965)
+
+  [ Colin Watson ]
+  * Add minbase variant for Ubuntu gutsy/hardy; see Anthony's change above.
+  * Minor manual page formatting improvements.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 15 Jan 2008 11:19:34 +0000
+
+debootstrap (1.0.7) unstable; urgency=low
+
+  * No longer include full devices tarball in udeb.
+  * Also try 'udpkg --print-architecture' when determining the target
+    architecture.
+  * Utility pkgdetails moved from debootstrap-udeb to bootstrap-base so that
+    the udeb can become 'Architecture: all'.
+  * Change /usr/lib/debootstrap to /usr/share/debootstrap. Closes: #430615.
+  * Use tab indentation in debootstrap and functions saving 3kB (relevant for
+    Debian Installer).
+  * Fix various inconsistencies in build scripts.
+  * Fix dpkg-genchanges warning 'missing Priority for source files'.
+  * Update Standards-Version to 3.7.2. No changes needed.
+  * Changes in udeb require base-installer 1.85.
+
+ -- Frans Pop <fjp@debian.org>  Wed, 14 Nov 2007 12:15:45 +0100
+
+debootstrap (1.0.6) unstable; urgency=low
+
+  * Ensure that the target directory exists in check_sane_mount.
+  * Don't ignore 'make clean' errors. (The Makefile is always present.)
+
+ -- Colin Watson <cjwatson@debian.org>  Sun, 21 Oct 2007 10:50:59 +0100
+
+debootstrap (1.0.5) unstable; urgency=low
+
+  [ Colin Watson ]
+  * Don't rely on GNU sed's s///I extension (closes: #350583).
+
+  [ Joey Hess ]
+  * Skip the noexec/nodev test when running --print-debs or other operations
+    that do not involve building systems.
+
+ -- Joey Hess <joeyh@debian.org>  Sat, 20 Oct 2007 23:10:34 -0400
+
+debootstrap (1.0.4) unstable; urgency=low
+
+  [ Neil Williams ]
+  * Add --second-stage-target option that allows embedded to test for
+    installations in a chroot on the device (closes: #445157).
+
+  [ Colin Watson ]
+  * Add (Ubuntu) hardy as a symlink to gutsy.
+  * Unmount /lib/init/rw on exit (closes: #391604).
+  * Cope if uncompressed Packages is missing from Release (closes: #402380).
+  * Don't rely on XSI test(1) extensions.
+  * Add support for ssh:/// URLs (thanks, Steffen Joeris; closes: #434893).
+  * Fix Ubuntu hoary and breezy scripts to unmount /dev etc. on exit
+    (closes: #327708).
+  * Emit an error if we cannot create working devices or executables on the
+    target (based on work by Bastian Kleineidam; closes: #233798).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 19 Oct 2007 14:57:37 +0100
+
+debootstrap (1.0.3) unstable; urgency=low
+
+  * Ignore errors when unmounting filesystems, to avoid stopping at the
+    first one with problems.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 21 Aug 2007 12:32:37 +0100
+
+debootstrap (1.0.2) unstable; urgency=low
+
+  [ Joey Hess ]
+  * Document --components in man page.
+  * Update man page, as packages listed in --include should now be auto
+    dep-resolved by default.
+
+  [ Colin Watson ]
+  * Extensive quoting fixes, allowing installation to a target containing
+    spaces (closes: #387673).
+  * scripts/debian/sid: Handle libc0.3 on hurd-i386 (thanks, Michael Banck;
+    closes: #314304).
+  * functions: Stub out /proc setup and add device setup for the Hurd
+    (thanks, Michael Banck; closes: #314311).
+  * Add --version option (closes: #294484).
+
+  [ Otavio Salvador ]
+  * Fix bunzip2 path. Thanks Martín Ferrari <martin.ferrari@gmail.com> by
+    the patch (closes: #436218).
+
+ -- Otavio Salvador <otavio@debian.org>  Tue, 07 Aug 2007 20:12:55 -0300
+
+debootstrap (1.0.1) unstable; urgency=low
+
+  * scripts/ubuntu/gutsy: Determine buildd variant dynamically using
+    Build-Essential: yes.
+  * scripts/ubuntu/gutsy.fakechroot: Remove devmapper postinst hack, no
+    longer needed.
+  * scripts/ubuntu/*.fakechroot: Merge into the corresponding main scripts
+    as variants.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 20 Jul 2007 11:55:22 +0100
+
+debootstrap (1.0.0) unstable; urgency=low
+
+  [ Anthony Towns ]
+  * Make debootstrap team maintained under the d-i banner.
+  * Add Joey, Frans and Junichi as uploaders, remove JHM (not in the
+    d-i group).
+  * Make pkgdetails.c not need C99 extensions. (Closes: Bug#398977)
+  * Fix am_doing_phase implementation in debootstrap script. Thanks to
+    Tero Janka for spotting the problem and the fix. (Closes: Bug#409881)
+
+  [ Joey Hess ]
+  * Drop support for sarge from the udeb.
+  * Update README.Debian:
+    - One todo item is done. (I think cross-strap is too, but unsure.)
+    - Reword NMU policy to note that it's team-maintained now.
+  * ACK my prior NMU. Closes: #418600
+  * If /dev/MAKEDEV DNE, as on certain s390 machines, use /sbin/MAKEDEV.
+    Closes: #420908
+    Note that /dev/MAKEDEV is still the correct location, and is still tried
+    first so that building works on all FHS systems, as noted in #190239.
+
+  [ Colin Watson ]
+  * Add support for Ubuntu dapper (Closes: #342838), edgy, feisty, and
+    gutsy. Exclude everything but gutsy from the udeb.
+  * Fix "deboostrap" typo in debootstrap(8) (thanks, Adam Conrad).
+  * Fix "htp" typo in temporary /etc/apt/sources.list.
+  * Drop support for woody from the udeb too.
+  * When removing $TARGET/debootstrap, debootstrap.log is still open as
+    stdout/stderr and needs to remain so, but after unlinking it some NFS
+    servers implement this by a temporary file in the same directory, which
+    makes it impossible to rmdir that directory. Moving it instead works
+    around the problem (thanks, Steven McCoy;
+    https://launchpad.net/bugs/65003).
+  * Fix formatting error in debootstrap(8) (.R is not a macro).
+  * Reorganise scripts into scripts/debian/ and scripts/ubuntu/ directories
+    in the source tree to declutter the top level.
+  * Add default_mirror function; reorganise the debootstrap script a little
+    so that it works. Set the default mirror for Ubuntu suites to
+    http://archive.ubuntu.com/ubuntu, and the default mirror for Debian
+    etch/lenny/sid architectures other than amd64 and i386 to
+    http://ftp.us.debian.org/debian (per ajt; see bug #363049).
+  * Add devices created by fd to devices-std.tar.gz, so that
+    /dev/std{in,out,err} is available conveniently in chroots with /proc and
+    /dev/pts mounted (thanks, Matthias Klose).
+  * Document --keyring and --make-tarball. (Closes: #368988)
+  * Update Ubuntu mirrors: warty/hoary/breezy => old-releases.ubuntu.com,
+    unsupported architectures => ports.ubuntu.com.
+  * Add myself to Uploaders.
+  * Bump to 1.0.0. Nobody uses debootstrap in production, do they?
+
+  [ Joey Hess ]
+  * Remove the extended package description (aka bloat) from the udeb.
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 23 Jun 2007 02:19:27 +0100
+
+debootstrap (0.3.3.3) unstable; urgency=low
+
+  * NMU
+  * Add support for lenny.
+
+ -- Joey Hess <joeyh@debian.org>  Tue, 10 Apr 2007 15:24:15 -0400
+
+debootstrap (0.3.3.2) unstable; urgency=low
+
+  * NMU with maintainer approval
+  * Remove --force-auto-select option for 'sid' script as it is no longer
+    supported by dpkg. Closes: #409527.
+
+ -- Frans Pop <fjp@debian.org>  Fri, 16 Feb 2007 20:43:36 +0100
+
+debootstrap (0.3.3.1) unstable; urgency=low
+
+  * NMU with maintainer approval
+  * functions/get_debs: build list of available packages from all specified
+    sources; this allows debootstrap to also use e.g. custom versions of base
+    packages from a source of local packages included on an installation CD.
+    Closes: #398762.
+
+ -- Frans Pop <fjp@debian.org>  Thu, 16 Nov 2006 05:30:43 +0100
+
+debootstrap (0.3.3) unstable; urgency=low
+
+  * Include kFreeBSD and fakechroot support from 0.3.2.1 and 0.3.2.2 NMUs,
+    thanks to Otavio Salvador and Piotr Roszatycki. (Closes: Bug#319100,
+    Bug#328446, Bug#204652, Bug#315044, Bug#Bug#319799)
+
+  * Require target to be specified in all cases; document usage of target
+    for --print-debs. (Closes: Bug#335922, Bug#337230)
+
+  * Use ln -sf when symlinking awk for woody and sarge. (Closes: Bug#299048)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun,  6 Nov 2005 04:12:39 +1000
+
+debootstrap (0.3.2.2) unstable; urgency=low
+
+  * NMU
+  * Added relicensed fakechroot variant. Closes: #204652.
+
+ -- Piotr Roszatycki <dexter@debian.org>  Sat, 29 Oct 2005 11:29:00 +0200
+
+debootstrap (0.3.2.1) unstable; urgency=low
+
+  * NMU with maintainer approval
+  * Applied patch from Robert Millan <rmh@aybabtu.com> to add support to
+    Debian GNU/kFreeBSD. Closes: #319799
+
+ -- Otavio Salvador <otavio@debian.org>  Fri, 28 Oct 2005 16:14:57 -0200
+
+debootstrap (0.3.2) unstable; urgency=low
+
+  * Revert fakechroot NMUs (0.3.1.1, 0.3.1.3, 0.3.1.7) due to incompatible
+    license requirements (GPL) (Reopens: Bug#204652)
+
+  * Changes from 0.3.1.2 NMU, thanks to Joey Hess: (Closes: Bug#314810)
+    + Fix incorrect use of "$@" in local. Closes: #314157, #314547
+    + Fix fd redirection in download progress code. See #314373
+    + Remove md5sums file from udeb. Closes: #314378
+    + Fix debian-installer mode warning code. Closes: #314340
+
+  * Changes from 0.3.1.4 NMU, thanks to Joey Hess:
+    + Wrap eval statement in exit_function in parens, working around
+      bug #315444 in busybox sh. Closes: #314373
+
+  * Changes from 0.3.1.5 NMU, thanks to Anibal Monsalve Salazar:
+    + Fixed "--variant=buildd option does not work" for pbuilder,
+      closes: #314858. Patch by Matt Kraai <kraai@ftbfs.org>.
+
+  * Changes from 0.3.1.6 NMU, thanks to Joey Hess:
+    + Patch from Colin to redirect status messages to stderr when running
+      --print-debs. Closes: #315875
+    + Restore logging to stderr in debian-installer mode. Closes: #314160
+
+  * Changes from 0.3.1.8 NMU, thanks to Petter Reinholdtsen:
+    + [functions] Mount /sys if it exist and is supported by the kernel.
+      Patch from Cajus Pollmeier, Colin Watson and Ubuntu. (Closes: #289105)
+    + [debootstrap] Document --resolve-deps in usage info. (Closes: #328161)
+    + [etch] Replace libsigc++-1.2-5c102 with libsigc++-1.2-5c2. (Closes: #334506)
+    + [etch] Remove pppoe from base, and only install
+      ipchains on m68k.  Patch from Sven Luther. (Closes: #239390)
+    + [sarge] Remove duplicate entries for m68k and amd64.  Patch from
+      Frans Pop. (Workaround for bug #319777)
+    + [etch] Add support for ppc64.  The patch for 'sid' did no longer
+      apply.  Patch from Andreas Jochens. (Closes: #313353)
+    + [sarge,etch,sid] Set DEBCONF_NONINTERACTIVE_SEEN=true during build, to
+      avoid questions during upgrade. (Closes: #238301)
+    + Add script for breezy.  Patch from Colin Watson. (Closes: #315940)
+
+  * Changes from 0.3.1.9 NMU, thanks to Joey Hess:
+    + Replace the etch script with a copy of the sid script, which pulls in
+      gnupg, so the installed etch system has a usable apt. Closes: #334521
+
+  * Create /dev/ptmx in minimal devices tarball. (Closes: Bug#317072)
+
+  * Don't create empty available files, since old dpkg and new kernels can't
+    deal with them. (Closes: Bug#308169, Bug#329468)
+
+  * Bump Standards-Version. Bump debhelper compatability level to 4.
+  * Cleanup debian/rules, thanks to Joey Hess. (Closes: Bug#314863)
+
+  * Emit error message if no pkgdetails is available. (Closes: Bug#326831)
+
+  * Turn on --resolve-deps by default. Add --no-resolve-deps as an option.
+    Combined with the previous changes to make the etch script dynamically
+    determine base, this should resolve all the "can't install <foo>"
+    bugs. (Closes: Bug#280210, Bug#308361, Bug#318281, Bug#323362,
+    Bug#318254, Bug#313292, Bug#334683, Bug#248578, Bug#289635)
+
+  * md5sum doesn't exist when coreutils is unpacked but not configured;
+    cp it across so it's available for --second-stage. (Closes: Bug#329394)
+
+  * Catch failures in "dpkg --status-fd" (Closes: Bug#317447, Bug#323661)
+
+  * Make "without" work right for duplicates (Closes: Bug#316884,
+    Bug#319777)
+
+  * Simplify and correct file descriptor handling and debootstrap.log
+    behaviour.
+
+  * Delete $TARGET with --print-debs and --make-tarball. (Closes: Bug#328369)
+
+  * Add a --make-tarball option. (Closes: Bug#152845)
+
+  * Create a default sources.list for apt. (Closes: Bug#283234, Bug#315225)
+
+  * Update manpage to talk about woody instead of sarge. (Closes: Bug#315862)
+
+  * Use partial/ directory when downloading. (Closes: Bug#109176)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun, 23 Oct 2005 14:49:08 +1000
+
+debootstrap (0.3.1) unstable; urgency=low
+
+  * sid script updated:
+    - Determine base dynamically (Priority: required for required packages,
+      Priority: important for base packages, Build-Essential: yes for buildd
+      variant base). (Closes: Bug#88984, Bug#193134)
+    - Use fine grained dpkg progress display, thanks again to Colin Watson.
+      (Closes: Bug#229314, Bug#231109, Bug#244563)
+
+  * dpkg output (etc) goes to /var/log/bootstrap.log in the target, rather
+    than stdout. This is probably difficult for frontends to capture
+    at present.
+
+  * Parsing of Packages file sped up. (Yay!)
+
+  * debootstrap.deb now arch: all (Closes: Bug#122465, Bug#131552)
+    - perl implementation of pkgdetails used by preference
+    - devices.tar.gz reduced to minimal set of devices; frontends should
+      setup udev or supply their own devices or similar in future
+    - /usr/lib/debootstrap/arch not shipped
+    - none of the above applies to udebs yet; though the devices.tar.gz
+      change will eventually
+
+  * Support for verifying based on Release.gpg files (--keyring). Thanks
+    to Colin Watson. (Closes: Bug#313383)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Tue, 14 Jun 2005 00:22:55 +1000
+
+debootstrap (0.3.0) unstable; urgency=low
+
+  * The Gernot Heiser release, dedicated to everyone who drinks enough to
+    lose their better judgement, and those of us who didn't have any in
+    the first place.
+
+  * Major update. New features:
+    + Use $TARGET/debootstrap directory for state info
+      (--keep-debootstrap-dir)
+    + Support for cross-strapping (--foreign / --second-stage)
+      (Closes: Bug#202529)
+    + Support for resolving dependencies (--resolve-deps)
+    + Support for Debian etch, and Ubuntu warty and hoary (Closes: Bug#312417)
+    + Support for handling variants within the main suite script
+    + Support for other versions of base packages in /v/c/apt/archives
+    + Initial support for fine-grained dpkg progress display, thanks to
+      Colin Watson (currently only for warty and hoary)
+    + Initial support for determining base system dynamically.
+    + No longer display "debootstrap.invalid" when working with
+      Release/Packages files. (Closes: Bug#241795, Bug#256255)
+    + Ignores failures for on_exit cleanup commands. (Closes: Bug#253387,
+      Bug#253468, Bug#308774)
+    + Early reporting of unavailable packages.
+    + More efficient parsing of Packages files.
+    + Generalised additions and exclusions. (Closes: Bug#191793)
+    + Handles symlinked configuration files in /etc a little better.
+      (Closes: Bug#161987, Bug#252907, Bug#272257)
+
+  * Dropped support for slink.
+
+  * Use ln -fs for mawk/awk link. (Closes: Bug#248398, Bug#258524)
+
+  * Dropped mail-transport-agent, and hence mailx and at from sid/etch base.
+    (Closes: Bug#168473)
+  * Dropped ipchains for i386 (Closes: Bug#266119)
+  * Other minor changes to meet dependencies, also. (Closes: Bug#312701)
+
+  * Minor manpage fixes. (Closes: Bug#285777)
+  * Add check for specifying no components (CloseS: Bug#283810)
+
+  * Include 0.2.45 NMUs, thanks to Steve Langasek.
+    (Closes: Bug#295571, Bug#283752, Bug#278158)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun, 12 Jun 2005 23:49:58 +1000
+
+debootstrap (0.2.45-0.2) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * [sarge, sid] Replace libparted1.6-0 with libparted1.6-12 for ia64,
+    to keep up with the ABI changes for that package. (Closes: #295571)
+  * [sarge, sid] include pciutils on hppa as well, per request of the
+    hppa folks. (Closes: #283752)
+
+ -- Steve Langasek <vorlon@debian.org>  Fri, 25 Feb 2005 22:23:30 -0800
+
+debootstrap (0.2.45-0.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * [sarge, sid] Drop libgnutls10 and libgcrypt7, since they are no
+    longer needed by exim4. (Closes: #278158).
+
+ -- Steve Langasek <vorlon@debian.org>  Thu, 20 Jan 2005 21:20:22 -0800
+
+debootstrap (0.2.45) unstable; urgency=high
+
+  * Acknowledge NMUs. (Closes: #270135)
+  * [woody.buildd] Corrected ia64 special cases. Patch by Brett Johnson
+    <brett@hp.com>. (Closes: #271894)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat, 18 Sep 2004 13:49:23 +0200
+
+debootstrap (0.2.44.2) unstable; urgency=low
+
+  * NMU again, this time using the makedev in unstable instead of the
+    experimental so devices.tar.gz isn't empty on ia64...  oops... /o\
+
+ -- Bdale Garbee <bdale@gag.com>  Tue, 14 Sep 2004 20:03:56 -0600
+
+debootstrap (0.2.44.1) unstable; urgency=low
+
+  * NMU to resolve d-i inability to install sid on ia64
+  * add pciutils to the base package list for ia64, to avoid having to regress
+    efibootmgr in unstable, closes: #270315, #268490
+
+ -- Bdale Garbee <bdale@gag.com>  Mon, 13 Sep 2004 15:11:11 -0500
+
+debootstrap (0.2.44) unstable; urgency=high
+
+  * [sarge] Removed "gcc-3.0-base" and "libstdc++3" for HPPA as they have been
+    removed from sarge as well on that arch. (Closes: #268917)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Mon, 30 Aug 2004 08:53:30 +0200
+
+debootstrap (0.2.43) unstable; urgency=high
+
+  * [sarge] Added back libgnutls10 in order not to break d-i testing.
+    (Closes: #268578, #268663).
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 29 Aug 2004 09:08:48 +0200
+
+debootstrap (0.2.42) unstable; urgency=high
+
+  * Acknowledge NMUs. (Closes: #262137, #262165, #262178, #262375)
+  * [sarge] Switch to libgnutls11 so exim4 can switch. (Closes: #268325) 
+  * [sid] Removed "gcc-3.0-base" and "libstdc++3" for HPPA as they have been
+    removed from sid. (Closes: #268049)
+  * [Makefile] Make the regular video devices on all archs. (Closes: #265081)
+  * [Makefile,debootstrap] Switched away from deprecated chown syntax;
+    switched away from XSIisms '-a' and '-o'. (Closes: #256098)
+  * [debootstrap.8] Use '\-' rather than '-' in options. (Closes: #263955)
+    Confirmed that the "exlude" typo has already been fixed. (Closes: #254108)
+    Applied patch by Javier Fernández-Sanguino Peña <jfs@computer.org>
+    for "file" URL documentation and a more complete example. (Closes: #226662)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Fri, 27 Aug 2004 15:40:02 +0200
+
+debootstrap (0.2.41-0.2) unstable; urgency=low
+
+  * Non-maintainer upload
+  * [sarge, sid] Add missing libgcrypt11 to base, needed by libgnutls11
+    in sid and needed in sarge for opencdk8 to be rebuilt against it
+    (closes: #262375, #262178).
+
+ -- Steve Langasek <vorlon@debian.org>  Fri, 30 Jul 2004 20:26:57 -0700
+
+debootstrap (0.2.41-0.1) unstable; urgency=low
+
+  * Non-maintainer upload with consent of JHM.
+  * Pull libfribidi0 back out of base, it's opportunistically installed
+    by d-i now for the locales that need it (closes: #262137).
+  * Re-add bootloaders on ia64, sparc, mips, hppa, and m68k to base,
+    because debian-installer isn't ready for this change (closes: #262165).
+
+ -- Steve Langasek <vorlon@debian.org>  Thu, 29 Jul 2004 14:14:33 -0700
+
+debootstrap (0.2.41) unstable; urgency=high
+
+  * High urgency upload as per tbm's request.
+  * [sarge, sid] No longer install setserial, as it causes problems on some
+    systems (e.g. #212646) and there is a consensus it is no longer needed in
+    a base environment.
+  * [sarge, sid] Removed aboot, aboot-base, elilo, efibootmgr, silo, dvhtool,
+    delo, palo, vmelilo. As per the consensus reached in the thread starting 
+    with http://lists.debian.org/debian-boot/2004/04/msg00634.html, the
+    installation of boot loaders is now debian-installer's responsibility.
+    (Closes: #247906)
+  * [sarge, sid] Added libfribidi0 to base to make debconf localisation into
+    right to left languages possible. (Closes: #253229)
+  * [sarge.buildd] Drop libdb4.0 for libdb4.2 as needed by perl.
+  * [sid] Added libgnutls11 as libgnutls10 is being phased out.
+  * [Makefile] Include /dev/ida on ia64. (Closes: #258055)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Thu, 29 Jul 2004 20:37:37 +0200
+
+debootstrap (0.2.40) unstable; urgency=medium
+
+  * [woody.buildd] Ensure the on_exit umounting of /dev/pts doesn't mess up
+    an otherwise OK exit status. (Closes: #260699)
+  * Acknowledge NMUs. (Closes: #258350, #260253)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Thu, 22 Jul 2004 21:53:20 +0200
+
+debootstrap (0.2.39.2) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * [sarge, sid] Drop quik from powerpc, as debian-installer handles this
+    now (closes: #260253).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 22 Jul 2004 16:56:19 +0100
+
+debootstrap (0.2.39.1) unstable; urgency=low
+
+  * NMU
+  * add passwd to sid.buildd,sarge.buildd as bash depends on them
+
+ -- Junichi Uekawa <dancer@debian.org>  Fri,  9 Jul 2004 09:07:28 +0900
+
+debootstrap (0.2.39) unstable; urgency=medium
+
+  * [sarge,sid] Dropped libdb2. Thanks Matt Zimmerman. (Closes: #250813)
+  * [sarge,sid] Dropped libident. Thanks LaMont Jones. (Closes: #251320)
+  * [sarge,sid] Dropped slang1. Thanks LaMont Jones. (Closes: #251328)
+  * [woody.buildd] Install libperl5.6. Thanks Rene Engelhard. (Closes: #251702)
+  * [sarge.buildd] Install libc6.1 rather than libc6 on alpha. Thanks Rene
+    Engelhard. (Closes: #251703)
+  
+  Goswin von Brederlow <brederlo@informatik.uni-tuebingen.de>
+  * Copy script for sarge to sid
+  * Add handling for amd64 to sarge/sid scripts
+  * Dropped gcc-3.2-base. (Closes: #250836)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat,  5 Jun 2004 10:02:50 +0200
+
+debootstrap (0.2.38.1) unstable; urgency=low
+
+  * NMU.
+  * [sarge] Add libdb4.2 since apt-utils (0.5.25) depends on this.
+
+ -- Otavio Salvador <otavio@debian.org>  Thu, 20 May 2004 22:18:41 -0300
+
+debootstrap (0.2.38) unstable; urgency=medium
+
+  * [woody.buildd] Readd libgdbmg1 (for perl-modules).
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Fri,  7 May 2004 10:55:13 +0200
+
+debootstrap (0.2.37) unstable; urgency=medium
+
+  * [debian/control] Bumped makedev build dependency so as not to get pty
+    permissions problems. (Closes: #246709)
+  * [sid, sid.buildd] Add/switch to libdb4.2 for the new perl packages.
+  * Acknowledge NMU 0.2.36.1. (Closes: #246368)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue,  4 May 2004 07:58:02 +0200
+
+debootstrap (0.2.36.1) unstable; urgency=low
+
+  * Non-maintainer upload with maintainer permission.
+  * [sarge, sid] Drop yaboot from powerpc, as debian-installer handles this
+    now (closes: #246368).
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 30 Apr 2004 00:05:02 +0100
+
+debootstrap (0.2.36) unstable; urgency=high
+
+  Joey Hess <joeyh@debian.org>:
+  * [sid, sarge] Add a subst_package function, and use it to replace libc6
+    with libc6.1 on alpha and ia64, to avoid reordering libc in the required
+    list and work around bug #238963. (Closes: #245680)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 25 Apr 2004 18:37:42 +0200
+
+debootstrap (0.2.35) unstable; urgency=high
+
+  * [sarge, sid] Dropped syslinux. (Closes: #205379)
+  * [woody, woody.buildd] Removed libgdbmg1. (Closes: #244447)
+  * [debootstrap, functions] Sync at the end of debootstrap. (Closes: #225742)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Thu, 22 Apr 2004 16:51:49 +0200
+
+debootstrap (0.2.34) unstable; urgency=high
+
+  * [sid] Dropped libpci1 and libpci2 as the pciutils dependency change has
+    been reverted. (Closes: #244344)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Thu, 22 Apr 2004 08:14:28 +0200
+
+debootstrap (0.2.33) unstable; urgency=high
+
+  * [sid] Added libpci1 and libpci2 for all archs where pciutils is installed,
+    as pciutils now depends on them. (Closes: #244344)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 18 Apr 2004 09:41:23 +0200
+
+debootstrap (0.2.32) unstable; urgency=high
+
+  * [sarge, sid] No longer try to filter out console-tools on s390. While
+    console-tools is basically useless on s390, base-config depends on it.
+    (Closes: #241727)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Fri,  9 Apr 2004 16:26:23 +0200
+
+debootstrap (0.2.31) unstable; urgency=medium
+
+  * [sarge] Exim has changed GnuTLS dependencies. Added libgnutls10,
+    libgcrypt7, libgpg-error0, libopencdk8, libtasn1-2; dropped libgnutls7,
+    libgcrypt1, libtasn1-0.
+  * [sarge] Removed libgnutls7, libgcrypt1, libtasn1-0.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue, 23 Mar 2004 22:47:28 +0100
+
+debootstrap (0.2.30) unstable; urgency=medium
+
+  * [sarge, sid] aboot needs aboot-base. (Closes: #236368, #239302)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Mon, 22 Mar 2004 21:10:31 +0100
+
+debootstrap (0.2.29) unstable; urgency=low
+
+  * NMU with permission of maintainer.
+  * Added {woody,sarge,sid}.buildd scripts to create build chroots.
+    Closes: #236418.
+  * Added --variant=buildd option for convenient access to these scripts.
+
+ -- Daniel Schepler <schepler@debian.org>  Wed, 10 Mar 2004 02:29:27 -0800
+
+debootstrap (0.2.28) unstable; urgency=medium
+
+  * [sid] Exim has changed GnuTLS dependencies. Added libgnutls10, libgcrypt7,
+    libgpg-error0, libopencdk8, libtasn1-2; dropped libgnutls7, libgcrypt1, 
+    libtasn1-0.
+  * [sarge,sid] Dropped lilo, mbr, modconf, libdevmapper1.00 as
+    debian-installer handles the bootloader installation and modules
+    configuration. (Closes: #232667, #232672, #232673)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue, 24 Feb 2004 09:57:35 +0100
+
+debootstrap (0.2.27) unstable; urgency=medium
+
+  * [sarge] Lilo now needs libdevmapper1.00; Removed libopencdk8, libgcrypt7,
+    libgpg-error0.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat, 14 Feb 2004 01:19:48 +0100
+
+debootstrap (0.2.26) unstable; urgency=medium
+
+  * [sarge] Removed gcc-3.2-base. (Closes: #230697)
+  * [sid] Lilo now needs libdevmapper1.00 .
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue,  3 Feb 2004 08:27:54 +0100
+
+debootstrap (0.2.25) unstable; urgency=high
+
+  * [functions] Unmount proc/bus/usb, not proc/usb. (Closes: #229122)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Fri, 30 Jan 2004 18:01:29 +0100
+
+debootstrap (0.2.24) unstable; urgency=high
+
+  * [functions, sarge, sid] Try to unmount proc/usb, dev/shm, dev/pts on exit;
+    don't fail when there's nothing to unmount.
+    (Closes: #229122, #229901, #229907)
+  * [woody] Don't fail when there's no dev/pts to unmount.
+  * [sarge, sid] Don't install pcmcia-cs as debian-installer takes care of
+    that where needed. (Closes: #221907)
+  * [sid] Removed libopencdk8, libgcrypt7, libgpg-error0.
+  * [sarge] libopencdk8 (needed for exim4-daemon-light via libgnutls7)
+    Depends: libgcrypt7, libgpg-error0. (Closes: #229989)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 28 Jan 2004 18:48:02 +0100
+
+debootstrap (0.2.23) unstable; urgency=high
+
+  * [sarge] Dropped libopencdk4 in favour of libopencdk8 as gnutls has switched.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Thu,  1 Jan 2004 01:30:02 +0100
+
+debootstrap (0.2.22) unstable; urgency=high
+
+  * [sid] libopencdk8 Depends: libgcrypt7, libgpg-error0.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 31 Dec 2003 12:35:03 +0100
+
+debootstrap (0.2.21) unstable; urgency=high
+
+  * [sarge] Added coreutils' new predependencies libacl1 and libattr1; removed
+    libsasl2 as it is no longer needed.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 28 Dec 2003 22:54:08 +0100
+
+debootstrap (0.2.20) unstable; urgency=high
+
+  * [sarge] base-config now Depends: aptitude; aptitude Depends:
+    libsigc++-1.2-5c102.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 28 Dec 2003 15:11:31 +0100
+
+debootstrap (0.2.19) unstable; urgency=high
+
+  * [sid] base-config now Depends: aptitude; aptitude Depends:
+    libsigc++-1.2-5c102.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 24 Dec 2003 09:03:44 +0100
+
+debootstrap (0.2.18) unstable; urgency=low
+
+  * Thanks to Steinar Gunderson and Matt Kraii for the NMU fixing some
+    d-i related problems. (Closes: Bug#220150)
+  * Acknowledge that the problems really are fixed now. (Closes:
+    Bug#213669, Bug#209273, Bug#210912)
+
+  * Fix downloading of Packages files to retry if bz2 or gz isn't available
+    on the mirror. (Closes: Bug#194592)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sat, 15 Nov 2003 00:13:13 +1000
+
+debootstrap (0.2.17.1) unstable; urgency=high
+
+  * NMU
+  * [sarge,sid] Display only the package name when retrieving packages.
+    (Closes: #213669, #209273)
+  * [sarge,sid] Added progress information for downloading package
+    details. (Closes: #210912)
+
+ -- Steinar H. Gunderson <sgunderson@bigfoot.com>  Mon, 10 Nov 2003 15:11:09 +0100
+
+debootstrap (0.2.17) unstable; urgency=high
+
+  * [sarge] Fixed typo: libreadlin4 -> libreadline4. (Closes: #219655)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat,  8 Nov 2003 23:23:37 +0100
+
+debootstrap (0.2.16) unstable; urgency=high
+
+  * [sarge,sid] libreadline4 is required for amiga-fdisk on powerpc.
+    (Closes: #218533)
+  * [sarge,sid] Put libreadline4 in required rather than base for ia64.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed,  5 Nov 2003 08:09:41 +0100
+
+debootstrap (0.2.15) unstable; urgency=high
+
+  * ia64 fixes by Richard Hirst <rhirst@linuxcare.com>: (Closes: #218533)
+  * [sarge, sid] Add libreadline4 to base for ia64 as parted needs it.
+  * [sarge, sid] Remove gcc-2.96-base from required for ia64.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat,  1 Nov 2003 12:58:34 +0100
+
+debootstrap (0.2.14) unstable; urgency=high
+
+  * [sarge] Made exim4 the default MTA. (Closes: #217657)
+  * [sarge] Removed libstdc++2.10-glibc2.2, libldap2 .
+  * [sid] Dropped libopencdk4 in favour of libopencdk8 as gnutls has switched.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue, 28 Oct 2003 09:56:27 +0100
+
+debootstrap (0.2.13) unstable; urgency=high
+
+  * [sarge] Added libtextwrap1 for tasksel.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 22 Oct 2003 08:10:37 +0200
+
+debootstrap (0.2.12) unstable; urgency=high
+
+  * [sarge, sid] Add libreadline4 to required for m68k as amiga-fdisk needs
+    it. (Closes: #216617)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Mon, 20 Oct 2003 10:05:09 +0200
+
+debootstrap (0.2.11) unstable; urgency=high
+
+  * [sid] Added libc6-sparc64 lib64gcc1 lib64ncurses5 to base for sparc.
+    (Closes: #215590)
+  * [sarge, sid] Dropped libreadline as bash no longer depends on it.
+  * [sid] Dropped libstdc++2.10-glibc2.2 and its associated special cases as
+    it is no longer needed.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 15 Oct 2003 19:42:58 +0200
+
+debootstrap (0.2.10) unstable; urgency=high
+
+  * [sid] Fixed /usr/sbin/sendmail symlink to point to exim4. (Closes: #213734)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat,  4 Oct 2003 15:47:31 +0200
+
+debootstrap (0.2.9) unstable; urgency=high
+
+  * [sarge] Added libgdbm3 for man-db.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Thu,  2 Oct 2003 23:57:09 +0200
+
+debootstrap (0.2.8) unstable; urgency=high
+
+  * [sid] Added libtextwrap1 for tasksel; removed libsasl2 as it is no longer
+    needed.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Thu,  2 Oct 2003 07:57:16 +0200
+
+debootstrap (0.2.7) unstable; urgency=high (fixes RC d-i bug)
+
+  * [sarge] Reinstated special-case for libperl5.8; it is still needed for
+    non-i386 until sarge has perl >= 5.8.0-20. (Closes: #213280)
+  * [debian/control] Updated Standards-Version; fixed removal of slink and
+    potato scripts from udeb.
+  * [debian/control] Updated priorities; debootstrap-udeb is required (for
+    debian-installer).
+  * [debian/rules] Fixed dpkg-distaddfile accordingly.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue, 30 Sep 2003 14:31:57 +0200
+
+debootstrap (0.2.6) unstable; urgency=low
+
+  * [sarge] Added e2fslibs, libcomerr2, libss2, libuuid1 for e2fsprogs.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Fri, 26 Sep 2003 13:50:58 +0200
+
+debootstrap (0.2.5) unstable; urgency=low
+
+  * [sid] Added libgdbm3 for man-db.
+  * [sarge, sid] Dropped special-case for libperl5.8 (Closes: #210425).
+  * [sid] Make exim4 the default MTA as it is configured through debconf.
+    (Closes: #208047)
+  * [sid] Removed libldap2 which is no longer needed.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 21 Sep 2003 13:30:49 +0200
+
+debootstrap (0.2.4) unstable; urgency=low
+
+  * [sid] Added coreutils' new predependencies libacl1 and libattr1.
+  * [debian/README.Debian] Corrected example invocation. (Closes: #206142)
+  * [debian/README.Debian] Fixed a typo.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 20 Aug 2003 10:28:49 +0200
+
+debootstrap (0.2.3) unstable; urgency=low
+
+  * [sarge] Add new dependencies of debconf: debconf-i18n
+    liblocale-gettext-perl libtext-wrapi18n-perl libtext-charwidth-perl.
+  * Acknowledge NMU. (Closes: #203370)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat, 16 Aug 2003 20:15:40 +0200
+
+debootstrap (0.2.2-0.1) unstable; urgency=low
+
+  * NMU.
+  * Fix typo in woody script. (Closes: #203370)
+
+ -- Petter Reinholdtsen <pere@debian.org>  Tue, 29 Jul 2003 20:29:01 +0200
+
+debootstrap (0.2.2) unstable; urgency=low
+
+  * [debian/changelog] Included entries for NMUs 0.1.17.31 through .34 whose
+    changes were incorporated by aj already.
+  * [Makefile] Invoke MAKEDEV through its FHS location (noted by Matt
+    Zimmerman). (Closes: #190239)
+  * Acknowledge older NMUs whose changes have been incoporated.
+    (Closes: #135675, #161695, #191849)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue, 29 Jul 2003 18:31:49 +0200
+
+debootstrap (0.2.1) unstable; urgency=low
+
+  * The Day of the Daffodils release.
+
+  * Accept NMUs up to 0.1.17.30. Thanks guys! (Closes: Bug#148377,
+    Bug#150161, Bug#150492, Bug#153962, Bug#154463, Bug#155906,
+    Bug#160879, Bug#161469, Bug#161469, Bug#161722, Bug#163860,
+    Bug#172118, Bug#176221, Bug#179504, Bug#179725, Bug#185397,
+    Bug#187893, Bug#188053, Bug#189472, Bug#189551, Bug#190108,
+    Bug#191288, Bug#193794, Bug#193806, Bug#195012, Bug#195742,
+    Bug#199333, Bug#201066)
+  * JHM added to Uploaders.
+
+  * Change the info/error/warning/progress calls to include a unique word
+    for each string, a printf format string, and any arguments to the
+    printf string.
+  * Add support for debian-installer interaction
+
+  * Add some support for l10n. Gettext is used if it's available; no
+    translations are included as of yet. This support doesn't
+    affect debian-installer, which has its own stuff for i18n, nor
+    boot-floppies. (Closes: Bug#125647)
+
+  * Some initial support for cross-bootstrapping in the sid script.
+
+  * Use dpkg --print-installation-architecture instead of
+    --print-architecture. (Closes: Bug#138526, Bug#159720)
+
+  * Add new dependencies of debconf: debconf-i18n liblocale-gettext-perl
+    libtext-wrapi18n-perl libtext-charwidth-perl. (Closes: Bug#201066)
+  * Add new dependencies of libldap2: libgnutls7 libgcrypt1 liblzo1
+    libopencdk4 libtasn1-0 zlib1g. (Closes: Bug#201663)
+  * Remove libgdbmg1. (Closes: Bug#202304)
+  * Add new dependecies of e2fsprogs: e2fslibs libcomerr2 libss2 libuuid1.
+    (Closes: Bug#203033)
+  * Add wget to base. (Closes: Bug#145635)
+  * Switch from netkit-ping to iputils-ping.
+
+  * Changed the manpage a little. (Closes: Bug#126864)
+  * Updated README.Debian.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Tue, 29 Jul 2003 18:15:24 +1000
+
+debootstrap (0.1.17.34) unstable; urgency=medium
+
+  * [sid] Added e2fsprogs' new predependencies (e2fslibs, libcomerr2, libss2,
+    libuuid1).
+  * [sarge] Removed libgdbmg1 as it is no longer needed.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 27 Jul 2003 09:20:49 +0200
+
+debootstrap (0.1.17.33) unstable; urgency=medium
+
+  * [sid] Removed libgdbmg1 as it is no longer needed.
+  * [sarge] libldap2 now Depends: libgnutls7, libsasl2; added those and their
+    dependencies (libgcrypt1 liblzo1 libopencdk4 libtasn1-0 zlib1g). Dropped
+    libsasl7 in favour of libsasl2.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Mon, 21 Jul 2003 19:00:28 +0200
+
+debootstrap (0.1.17.32) unstable; urgency=medium
+
+  * [sid] libldap2 now Depends: libgnutls7; added that and its dependencies
+    (libgcrypt1 liblzo1 libopencdk4 libtasn1-0 zlib1g); dropped libssl0.9.7 .
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Thu, 17 Jul 2003 07:05:09 +0200
+
+debootstrap (0.1.17.31) unstable; urgency=medium
+
+  * [sid] Follow debconf changes. debconf now Depends: debconf-i18n |
+    debconf-english; debconf-i18n having Priority: important and
+    debconf-english having Priority: extra, so we satisfy the dependency
+    through debconf-i18n. debconf-i18n in turn pulls in three additional
+    packages: liblocale-gettext-perl, libtext-wrapi18n-perl,
+    libtext-charwidth-perl .
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 13 Jul 2003 08:52:55 +0200
+
+debootstrap (0.1.17.30) unstable; urgency=medium
+
+  * [sarge]
+    * Added sysv-rc for /usr/sbin/update-rc.d .
+    * Added initscripts to satisfy sysvinit's predependency.
+    * libparted1.6-0 has replaced libparted1.4 on ia64. (Closes: #197957)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Mon, 30 Jun 2003 07:05:22 +0200
+
+debootstrap (0.1.17.29) unstable; urgency=medium
+
+  * [sid] libconsole has replaced console-tools-libs. (Closes: #195722)
+  * [sarge] libperl5.6 has been replaced by libperl5.8 . (Closes: #195588)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Mon,  2 Jun 2003 00:40:54 +0200
+
+debootstrap (0.1.17.28) unstable; urgency=medium
+
+  * [sarge] libnewt0.51 has replaced libnewt0; it requires slang1a-utf8.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 28 May 2003 07:42:14 +0200
+
+debootstrap (0.1.17.27) unstable; urgency=medium
+
+  * urgency medium to not hold up .26 with that longer as necessary
+  * [sarge] added libtext-iconv-perl (this is the second part
+    from .22) (closes: #184539)
+
+ -- Rene Engelhard <rene@debian.org>  Mon, 19 May 2003 00:08:48 +0200
+
+debootstrap (0.1.17.26) unstable; urgency=medium
+
+  * [sarge] libpcap0.7 has replaced libpcap0.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun, 18 May 2003 23:23:46 +0200
+
+debootstrap (0.1.17.25) unstable; urgency=medium
+
+  * [sarge] Added libblkid1 (for e2fsprogs).
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun,  4 May 2003 12:44:00 +0200
+
+debootstrap (0.1.17.24) unstable; urgency=medium
+
+  * [sid] Updates for new whiptail:
+    * Replaced libnewt0 by libnewt0.51.
+    * Added slang1a-utf8.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue, 29 Apr 2003 19:04:51 +0200
+
+debootstrap (0.1.17.23) unstable; urgency=medium
+
+  * [sid]
+    * Added sysv-rc for /usr/sbin/update-rc.d .
+    * Added initscripts to satisfy sysvinit's predependency.
+    * For exim, dropped libsasl7 in favour of libsasl2.
+    * Added libssl0.9.7 for libsasl2.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue, 22 Apr 2003 06:56:25 +0200
+
+debootstrap (0.1.17.22) unstable; urgency=low
+
+  * [sid] added libtext-iconv-perl which is needed to display
+    localized po-debconf templates actually localized.
+    This needs a second step later for sarge but that only is possible
+    after libtext-iconv-perl 1.2-2 went into sarge.
+
+ -- Rene Engelhard <rene@debian.org>  Fri, 18 Apr 2003 16:25:17 +0200
+
+debootstrap (0.1.17.21) unstable; urgency=medium
+
+  * [sarge, sid] Added gcc-3.3-base (as it is needed for current libstdc++5).
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Fri, 18 Apr 2003 08:11:55 +0200
+
+debootstrap (0.1.17.20) unstable; urgency=medium
+
+  * [woody, sarge, sid] Add devfsd on s390 as that architecture uses devfs by
+    default. (Closes: #180252)
+  * [sarge] Removed the dummy fileutils package.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Mon,  7 Apr 2003 19:59:42 +0200
+
+debootstrap (0.1.17.19) unstable; urgency=medium
+
+  * [sid] Added libblkid1 (for e2fsprogs).
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun,  6 Apr 2003 21:43:29 +0200
+
+debootstrap (0.1.17.18) unstable; urgency=medium
+
+  * [sarge] Added libgcc1, libstdc++5, gcc-3.2-base; dropped aptitude,
+    libsigc++0 .
+  * Debootstrap has depended on binutils since 0.1.17.3. (Closes: #184304)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 19 Mar 2003 06:55:56 +0100
+
+debootstrap (0.1.17.17) unstable; urgency=medium
+
+  * NMU
+  * Really drop aptitude from the sid script, not just libsigc++0.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue,  4 Feb 2003 06:49:36 +0100
+
+debootstrap (0.1.17.16) unstable; urgency=medium
+
+  * NMU
+  * Drop aptitude from the sid script (base-config 1.51 dropped its dependency
+    on it) and libsigc++0 (which was only needed for aptitude). This makes
+    "pbuilder create --distribution sid" work again. (Closes: #177221, #177998).
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sun,  2 Feb 2003 20:41:35 +0100
+
+debootstrap (0.1.17.15) unstable; urgency=low
+
+  * NMU
+  * For gcc-transition, libgcc1 and libstdc++5 and gcc-3.2-base
+  required by groff-base, and potentially other packages compiled with
+  gcc-3.2.
+
+ -- Junichi Uekawa <dancer@debian.org>  Mon, 13 Jan 2003 15:39:55 +0900
+
+debootstrap (0.1.17.14) unstable; urgency=low
+
+  * NMU
+  * Remove debootstrap-udeb's dependency on retriever.
+
+ -- Tollef Fog Heen <tfheen@debian.org>  Sat,  7 Dec 2002 14:53:52 +0100
+
+debootstrap (0.1.17.13) unstable; urgency=low
+
+  * NMU
+  * sarge: Removed shellutils, textutils and added coreutils instead.
+    Verified that the result works for "pbuilder create --distribution sarge"
+    (Closes: #163789)
+    Fileutils is still in there for now, due to sarge's debconf versioned
+    dependency on it.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Tue,  8 Oct 2002 23:17:47 +0200
+
+debootstrap (0.1.17.12) unstable; urgency=low
+
+  * NMU
+  * Fix shell variable quoting problem, to change $10 -> ${10}
+    (closes: #161468)
+
+ -- Junichi Uekawa <dancer@debian.org>  Sat, 21 Sep 2002 13:39:47 +0900
+
+debootstrap (0.1.17.11) unstable; urgency=low
+
+  * NMU
+  * sarge: added libdb1-compat.
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat, 21 Sep 2002 00:37:36 +0200
+
+debootstrap (0.1.17.10) unstable; urgency=low
+
+  * NMU
+  * sid: Removed shellutils, fileutils, and added coreutils for required
+    target (closes: #161332)
+  * sid: change libperl5.6 to libperl5.8 (closes: #158606)
+
+ -- Junichi Uekawa <dancer@debian.org>  Wed, 18 Sep 2002 21:41:36 +0900
+
+debootstrap (0.1.17.9) unstable; urgency=low
+
+  * NMU
+  * Added "libdb1-compat" to sid and verified that the resulting package is
+    usable for "pbuilder create --distribution sid".
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Sat, 14 Sep 2002 15:09:10 +0200
+
+debootstrap (0.1.17.8) unstable; urgency=low
+
+  * NMU
+  * The "it didn't change the way the installer worked" release.
+  * Makefile: create $(DESTDIR)/usr/share/man/man8 before attempting to
+    install a file to it (Closes: #139543)
+  * functions: fix race condition in smallyes() implementation; thanks to Matt
+    Zimmerman for the analysis.  "Sometimes, dpkg finishes executing before
+    smallyes runs, and it loops forever while echo fails repeatedly due to the
+    broken pipe."  To fix this race, we simply swap the loop condition and
+    body, so that if the echo fails, smallyes() exits cleanly.  I further
+    changed "true" to ":" to save the expense of an extra process for shells
+    where "true" is not a built-in.
+    (Closes: #139529)
+
+ -- Branden Robinson <branden@progeny.com>  Thu, 29 Aug 2002 12:50:08 -0500
+
+debootstrap (0.1.17.7) unstable; urgency=low
+
+  * NMU
+  * Forked "sid" target from "sarge" target, changed "libcap0" to the now
+    current "libpcap0.7" and verified that the result works with pbuilder.
+    (Closes: #156574)
+
+ -- J.H.M. Dassen (Ray) <jdassen@debian.org>  Wed, 21 Aug 2002 11:01:52 +0200
+
+debootstrap (0.1.17.6) unstable; urgency=low
+
+  * NMU
+  * add dselect to required (I found out that it is actually required
+    for pbuilder create to work) (closes: #154527)
+  * change DEBIAN_FRONTEND=Noninteractive to "noninteractive" (closes: #154794)
+  * add sh* patch from Yaegashi (closes: #155142)
+
+ -- Junichi Uekawa <dancer@debian.org>  Thu,  8 Aug 2002 19:23:04 +0900
+
+debootstrap (0.1.17.5) unstable; urgency=low
+
+  * NMU
+  * mistake in the last upload, sorry aj.
+    sid points to sarge, not woody. (closes: #149971)
+
+ -- Junichi Uekawa <dancer@debian.org>  Sat, 27 Jul 2002 17:22:05 +0900
+
+debootstrap (0.1.17.4) unstable; urgency=low
+
+  * NMU
+  * add "sarge" target (closes: #153957)
+
+ -- Junichi Uekawa <dancer@debian.org>  Tue, 23 Jul 2002 18:03:01 +0900
+
+debootstrap (0.1.17.3) unstable; urgency=low
+
+  * NMU
+  * Depend on binutils (closes: #138489)
+  * Sleep is optional (closes: #150468)
+  * POSIXify a bit more (closes: #150487)
+  * Add support for --components (closes: #116801)
+
+ -- Tollef Fog Heen <tfheen@debian.org>  Thu, 20 Jun 2002 00:13:06 +0200
+
+debootstrap (0.1.17.2) unstable; urgency=low
+
+  * NMU
+  * Make sid script not a symlink from woody script
+  * add aptitude and libsigc++0 to base for sid. (closes: #149971)
+
+ -- Junichi Uekawa <dancer@debian.org>  Sat, 15 Jun 2002 12:46:11 +0900
+
+debootstrap (0.1.17.1) unstable; urgency=low
+
+  * NMU
+  * Add udeb support (closes: #143874)
+
+ -- Tollef Fog Heen <tfheen@debian.org>  Tue, 28 May 2002 14:15:41 +0200
+
+debootstrap (0.1.17) unstable; urgency=high
+
+  * Includes changes from NMUs. Thanks to Stefan Gybas and Eduard Bloch.
+    (Closes: Bug#130764, Bug#135676, Bug#134306, Bug#133882, Bug#131768,
+    Bug#117980, Bug#133298, Bug#130668, Bug#111175, Bug#131147, Bug#95143,
+    Bug#130482)
+
+  * Don't use PIPESTATUS to work out if wget succeeded, since that's a
+    bashism and we're seriously not allowed bashisms. Duh. This should
+    help with all those "Malformed release" problems. Thanks to Phil
+    Blundell and Chris Tillman for spotting this. (Closes: Bug#136729)
+
+  * Apply patch from Matt Zimmerman to get rid of some irritating warnings
+    that can show up sometimes due to sed getting it's output stream closed
+    on it. (Closes: Bug#131478)
+
+  * Don't use "export foo=bar" on a single line since it's a bashism.
+    (Closes: Bug#138187)
+
+  * Made the "smallyes" usage independent of --boot-floppies. Too much
+    code duplication otherwise.
+
+  * Install ipchains on arches that have 2.2.x kernels by default, and
+    iptables on arches that have 2.4.x kernels by default. Some arches
+    have both. (Closes: Bug#134478)
+
+  * Don't rm malformed Release files, rename them to something obvious
+    instead so people can have a hope at seeing what's going on. (Closes:
+    Bug#131756)
+
+  * Error out on missing entries in Release files. (Closes: Bug#136886)
+
+  * Fix basedeb creation to not bother building devices tarball. (Closes:
+    Bug#137243)
+
+  * Workaround for ldconfig no longer needed, so removed. (Closes: Bug#135819)
+  * Workaround for /dev/initctl was never needed and stupid, so removed.
+
+  * Make sure devices.tar.gz is gzip -9'ed. (Closes: Bug#136687)
+
+  * Use any "main" components found in Release file, eg "main",
+    "non-US/main", "local/main". (Closes: Bug#116801)
+
+  * Add parted to base for ia64. (Closes: Bug#138246)
+
+  * Moved the "successful!" message and sleep hack for boot-floppies from
+    the woody script to the debootstrap script itself.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Thu, 14 Mar 2002 18:28:24 +1000
+
+debootstrap (0.1.16.4) unstable; urgency=low
+
+  * NMU, needed for boot-floppies 3.0.20
+  * Added cciss and ataraid device files, closes: #135675
+  * Applied the patch from Matt Zimmermann to fix --include, closes: #134306
+  * Mail suppression fixed in previous release, closes: #133882
+
+ -- Eduard Bloch <blade@debian.org>  Sun,  3 Mar 2002 12:21:19 +0100
+
+debootstrap (0.1.16.3) unstable; urgency=low
+
+  * non-maintainer-upload
+  * require newer makedev, fixes build problems on m86k and arm
+  * unsets $TMP, $TEMP and $TMPDIR in the beginning, closes: #131768, #117980
+  * added gcc-2.96-base to ia64's required packages list, closes: #133298
+
+ -- Eduard Bloch <blade@debian.org>  Tue, 12 Feb 2002 19:30:47 +0100
+
+debootstrap (0.1.16.2) unstable; urgency=low
+
+  * non-maintainer-upload
+  * added modification suggested by Branden Robinson and Matt Kraai terminate
+    cat (now tail) better, closes: #130668
+  * provides options to install additional packages, or exclude some from the
+    list. May be needed in boot-floppies soon. Closes: #111175, #131147
+  * --verbose option, closes: #95143
+  * added additional devices to the device list, especially input and usb
+    needed for modern device drivers (Joysticks, USB, Scanners)
+  * added pppoeconf to the packages list, better choice for DSL users
+  * forced remove of dev/initctl, prevents breaking on re-installation
+
+ -- Eduard Bloch <blade@debian.org>  Mon, 28 Jan 2002 19:14:41 +0100
+
+debootstrap (0.1.16.1) unstable; urgency=high
+
+  * non-maintainer upload for boot-floppies 3.0.19
+  * Fixed list of base and required packages for s390
+  * setup_devices(): don't fail if devices.tar.gz is not present and we
+    are using devfs
+  * disable handling of /dev/initctl for boot-floppies, closes: #130482
+
+ -- Stefan Gybas <sgybas@debian.org>  Thu, 24 Jan 2002 15:17:42 +0100
+
+debootstrap (0.1.16) unstable; urgency=low
+
+  * Include NMUs 0.1.15.1 - .9, thanks to Adam di Carlo, Ethan Benson and
+    Bdale Garbee. (Closes: Bug#113265, Bug#119314, Bug#119251)
+  * Many bugs were fixed in the NMUs. Closes them properly. (Closes:
+    Bug#89673, Bug#97174, Bug#99229, Bug#105980, Bug#106062, Bug#106102,
+    Bug#106106, Bug#106134, Bug#106711, Bug#106877, Bug#107262,
+    Bug#107404, Bug#107447, Bug#109670, Bug#110312, Bug#111001,
+    Bug#111065, Bug#112778, Bug#112795, Bug#112842, Bug#113444,
+    Bug#114056, Bug#114653, Bug#115467, Bug#115481, Bug#115557,
+    Bug#115581, Bug#115699, Bug#116061, Bug#116424, Bug#119769,
+    Bug#119947, Bug#121724, Bug#123958, Bug#125954, Bug#126018,
+    Bug#126630, Bug#126799)
+
+  * Informative error for people who type `--boot-floppies' when running
+    by hand. (Closes: Bug#107548)
+  * Create dev/initctl in target, and setup a cat process to dump anything
+    sent to it to /dev/null so that if init is run in the chroot,
+    it doesn't try doing anything too clever to talk to the real
+    init. (Closes: Bug#120597)
+  * Create awk symlink since base-files insists on having it available.
+    (Closes: Bug#127934)
+
+  * Use DEBOOTSTRAP_DIR to work out where /usr/lib/debootstrap is.
+  * So, in theory, to create basedeb tarballs, you should be able to unpack
+    the source and say:
+    .
+        fakeroot debian/rules binary-basedebs SUITE=woody VERSION=3.0 \
+            MIRROR="http://ftp.debian.org/debian" ARCHES="i386 powerpc"
+    (Closes: Bug#127546)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun, 20 Jan 2002 21:04:37 +1000
+
+debootstrap (0.1.15.9) unstable; urgency=high
+
+  * non-maintainer upload
+  * debian/rules: new 'basedebs' target that makes basedebs.tgz and 1.44
+    split images for base per arch
+  * functions: better return value handling during wget (wgetprogress)
+  * repeat() had a useless eval, removed, which simplifies some silly
+    quoting
+  * incorrect error message in in_target_msg(), closes: #119769
+  * debian/changelog: remove obsolete "local variables"
+  * additional progress message when validating the release file after
+    download
+  * when the downloaded release file is invalid, make sure to delete it
+    closes: #119947
+  * debian/rules: minor fixes and cosmetics
+  * upgrade wget from Recommends to Depends, closes: #126799
+  * depend on binutils, for 'ar', closes: #123958
+
+ -- Adam Di Carlo <aph@debian.org>  Fri,  4 Jan 2002 20:01:58 -0500
+
+debootstrap (0.1.15.8) unstable; urgency=high
+
+  * non-maintainer upload
+  * Fix progress bar hooks to enable proper progress on basedebs.tgz
+    installation as well as actual base installation and extraction.
+  * trap signals so cleanup is still performed.
+  * When in --boot-floppies mode echo a Success info message to stdout, so
+    it will show up on /dev/tty4, this is so users watching tty4 stop
+    being confused when things just stop at completion.
+  * Replace $TARGET/sbin/start-stop-daemon with a shell script instead of
+    /bin/true, this shell script announces that its a fake noop version so
+    users will know whats wrong if debootstrap aborts before completion.
+
+ -- Ethan Benson <erbenson@alaska.net>  Sat,  3 Nov 2001 23:14:08 -0900
+
+debootstrap (0.1.15.7) unstable; urgency=high
+
+  * non-maintainer upload
+  * when reporting errors in 'in_target', don't chop down to the first
+    50 characters
+  * woody: when in boot-floppies mode, provide more user-friendly warning
+    messages, using new 'in_target_msg' function
+  * woody: more info messages for the core/required/base package
+    installation part
+  * instead of 'ln -s' we should be using 'ln -sf'; this would prevent
+    running debootstrap twice in the same target dir; closes: #111065
+  * before mounting proc, umount it just in case; normally this shouldn't
+    be needed if on_exit is working all the time, but I find without this,
+    sometimes problems are caused
+  * woody/i386 needs psmisc for pcmcia-cs (critical bug!)
+  * --download-only mode can be run as non-root; closes: #116424
+  * tested some problems which I couldn't reproduce
+    closes: #115699
+
+ -- Adam Di Carlo <aph@debian.org>  Wed, 24 Oct 2001 16:05:39 -0400
+
+debootstrap (0.1.15.6) unstable; urgency=medium
+
+  * non-maintainer upload
+  * smaller and wiser version of smallyes(), thanks to Herbert Xu
+  * woody base includes pcmcia-cs for i386 and powerpc (closes: #114653)
+  * wget progress bar support (closes: #116061)
+
+ -- Adam Di Carlo <aph@debian.org>  Thu, 18 Oct 2001 15:14:02 -0400
+
+debootstrap (0.1.15.5) unstable; urgency=high
+
+  * From Ethan Benson:
+  * pipe yes output into dpkg runs inside install_debs() this way on_exit
+    works in --boot-floppies mode. (Closes: #112842, #115481)
+  * Add libpcap0 to base, ppp depends on it now. (Closes: #114056)
+
+  * From Adam Di Carlo:
+  * Potato installation on non-i386 was broken, need libc6
+    (closes: #112778); however, there are other ways the Potato base
+    install doesn't represent quite what Potato boot-floppies would
+    consider base
+  * apply patch from Tommi Virtanen which improves the 'smallyes'
+    function; apparently this fixes a console-tools postinst loop,
+    although I haven't seen that (closes: #115581)
+  * get rid of some line continuators in potato and woody scripts, they
+    were obscuring some problems
+
+ -- Adam Di Carlo <aph@debian.org>  Mon, 15 Oct 2001 01:56:16 -0400
+
+debootstrap (0.1.15.4) unstable; urgency=high
+
+  * more fixed for the benefits of boot-floppies
+  * add telnetd on s390; yes, it's gross, but it's needed for
+    installation, to connect from the line mode console
+    closes: #112795
+
+ -- Adam Di Carlo <aph@debian.org>  Sun, 23 Sep 2001 16:11:03 -0400
+
+debootstrap (0.1.15.3) unstable; urgency=high
+
+  * Fix deficient command line option parsing, optional arguments no
+    longer have to be declared in a specific order, for example before you
+    could not put --arch before --download-only, now you can.
+  * Add --help option and useful help output.
+  * Stop using dirname, basename, and yes, they are being removed from
+    busybox.
+  * Fix many many quoting bugs.
+  * Fix debootstrap man page (Closes: #107404, #109670)
+  * Add ftp support (Closes: #110312)
+  * Don't waste time downloading useless non-free/contrib (Closes: #89673)
+  * Path cleanup (Closes: #97174)
+  * Add pppconfig to woody base (Closes: #111001)
+  * Remove syslinux from base (Closes: #107447)
+  * Eliminate useless warning about creating exim.conf (Closes: #99229)
+  * Don't use "here documents" (they create tmp files in /tmp which could
+    be very well be full on boot-floppies).
+  * Don't use echo -n it is not portable.
+  * Set umask to 022.
+  * All patches from Ethan Benson, I am just the builder!
+    These have been tested with boot-floppies and work properly.
+
+ -- Adam Di Carlo <aph@debian.org>  Sat, 22 Sep 2001 12:30:02 -0400
+
+debootstrap (0.1.15.2) unstable; urgency=low
+
+  * quoting required in one place for the new ash (Closes: Bug#106062)
+  * s390 support (Closes: Bug#107262)
+  * remove some packages from Woody's base that aren't needed:
+    - update (not needed with modern kernels, Closes: Bug#106877)
+    - syslinux (Closes: Bug#107477)
+    - ldso (should be pulled in by libc6, Closes: Bug#106102)
+  * kinks in mipsel base worked themselves out (Closes: Bug#106711)
+
+ -- Adam Di Carlo <aph@debian.org>  Wed,  8 Aug 2001 12:04:40 -0400
+
+debootstrap (0.1.15.1) unstable; urgency=low
+
+  * add efibootmgr on ia64, as per bug 105980.
+
+ -- Bdale Garbee <bdale@gag.com>  Fri,  3 Aug 2001 14:13:23 -0600
+
+debootstrap (0.1.15) unstable; urgency=low
+
+  * Do progress indications (by bytes) for Packages downloads and .deb
+    downloads. (Closes: Bug#101886)
+  * Don't use seq. Silly busybox.
+  * Add pppoe to base. (Closes: Bug#102378)
+  * No point keeping around the "sid.is-broken" file.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Wed, 27 Jun 2001 21:29:29 +1000
+
+debootstrap (0.1.14) unstable; urgency=low
+
+  * Make in_target_nofail kill stderr. No more "/dev/pts: not mounted" error.
+    Yay. :)
+
+  * Refactor woody, potato and slink scripts; do away with
+    woody.debs. Change the way the scripts work. (Now they define
+    functions which debootstrap calls. Much nicer)
+  * Support --download-only option.
+  * Support resuming downloads of Release and Packages files, even gzipped
+    ones.
+  * Support null: (Packages files assumed to be named for a debootstrap.invalid
+    host)
+  * Always use the deboostrap.invalid name, and use that in
+    /etc/apt/sources.list. Remove /etc/apt/sources.list after the base
+    system is build.
+  * All this should be enough to support basedeb.tgz installs on
+    debootstrap's behalf. Some more stuff would be useful, but isn't
+    immediately necessary. (Closes: Bug#102217)
+
+  * Add ia64 support and fix libc6 == libc6.1 problem. (Closes: Bug#101829)
+
+  * Be a little more careful with permissions on devs tarball. Hopefully.
+    (Closes: Bug#102308)
+
+  * Don't worry if md5sum from stdin adds a "  -" after the md5sum. Should
+    make debootstrap more usable on non-Debian Linuxes.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Mon, 25 Jun 2001 18:38:35 +1000
+
+debootstrap (0.1.13) unstable; urgency=low
+
+  * Add symlink for sid.debs.
+  * Fix the special casing for hppa. (Closes: Bug#101604)
+  * Remove groff from base. (Closes: Bug#101173)
+  * Retry partially successful downloads a couple of times.
+    (Closes: Bug#101476)
+  * Minor wording changes wrt downloading Release file (Closes: Bug#101705)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Thu, 21 Jun 2001 12:08:10 +1000
+
+debootstrap (0.1.12) unstable; urgency=high
+
+  * Split determination of base into a separate script to enable further
+    innovation! Come on, tell me that doesn't excite you!
+
+  * Add groff-base to base. (Closes: Bug#100112, Bug#100123)
+  * Remove libstdc++2.10 and some other hopefully unnecessary debs
+    (Closes: Bug#99708)
+
+  * Remove lilo.conf special casing. Change some warnings to info messages.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun, 10 Jun 2001 01:22:12 +1000
+
+debootstrap (0.1.11) unstable; urgency=low
+
+  * Add dhcp-client to base. (Closes: Bug#100083)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sat,  9 Jun 2001 00:11:26 +1000
+
+debootstrap (0.1.10) unstable; urgency=low
+
+  * Don't abort build on devfs systems: the makedev we build-dep on should
+    be recent enough. (Closes: Bug#97713)
+  * Check for malformed release files. Thanks to Martin Michlmayr for the
+    patch. (Closes: Bug#97707)
+  * Use --force-confold when installing base. That is: if you want the
+    conffile from the package to be there at the end, don't create a
+    file in the first place. I'm not convinced this is right.
+    (Closes: Bug#99025)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Mon, 28 May 2001 14:43:07 +1000
+
+debootstrap (0.1.9) unstable; urgency=low
+
+  * Abort build on devfs systems (MAKEDEV fails for no good reason)
+    (Closes: Bug#97713)
+
+  * Add support for mips and mipsel (Closes: Bug#97711)
+  * Add some support for hppa (install palo in base)
+
+  * Don't install ldso (Closes: Bug#97708)
+  * Don't install libopenldap1 or libopenldap-runtime (replaced by libldap2)
+    (Closes: Bug#98050)
+  * Do install libdb3 and libcap1.
+  * Install klogd too. (But only as part of base. Move sysklogd to base too)
+
+  * Setup a dummy lilo.conf on i386 only. (Closes: Bug#97710, Bug#98052)
+
+  * Trim a trailing / for target and url.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun, 20 May 2001 13:33:34 +1000
+
+debootstrap (0.1.8) unstable; urgency=low
+
+  * Add adduser and base-config into base. base-config unfortunately depends
+    on perl instead of perl-base. (Closes: Bug#96439)
+  * Force LANG=C. Need to work out how i18n should be handled.
+  * Kludge potato install so it's noninteractive. Thanks to Colin Watson
+    for the patch. (Closes: Bug#94441)
+  * Get rid of dh_testversion.
+  * Make a sid script (just a symlink to the woody script).
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Wed,  9 May 2001 20:33:00 +1000
+
+debootstrap (0.1.7) unstable; urgency=low
+
+  * Don't worry if umounting /dev/pts fails.
+  * Add debootstrap(8) manpage, thanks to Matt Kraai. (Closes: Bug#86238)
+  * Add a blank line to the end of the faked /var/lib/dpkg/status. Spotted
+    by Richard Hirst.
+  * Added console-tools and console-data into the base system.
+  * Move /etc/exim.conf to /etc/exim/exim.conf so that sendmail doesn't
+    give errors, even if debconf tries to use it before exim is
+    configured.  Gack.
+  * Add fdutils back into base.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Mon, 30 Apr 2001 15:49:27 +1000
+
+debootstrap (0.1.6) unstable; urgency=low
+
+  * Only create stuff in /etc if it hasn't already been created.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Mon, 23 Apr 2001 18:02:55 +1000
+
+debootstrap (0.1.5) unstable; urgency=low
+
+  * Use "head -n X" instead of "head -X" to work with busybox.
+    (Closes: Bug#94575)
+  * Use s///I instead of s///i for case insensitivity, again for busybox.
+    (Closes: Bug#94579)
+  * Fixed typo that would have stopped debootstrap from falling back to an
+    uncompressed Packages file.
+  * Added libsasl7 and libldap2 to woody base, since woody exim now depends
+    on them.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun, 22 Apr 2001 01:47:00 +1000
+
+debootstrap (0.1.4) unstable; urgency=low
+
+  * If we've got a Release file, check that the Packages files we download
+    have the right md5sums.
+  * Build-Depend on new makedev, and don't hax0r powerpc devices as much.
+    (Closes: Bug#93836)
+  * Hopefully support arm chroots. (Closes: Bug#92592) Declare it to be
+    Arch: any, and see what dies. There's a chance that nothing will. Not
+    a *big* chance, but a chance.
+  * Fiddled with the base system some more. Added apt-utils so
+    preconfiguration will work.
+  * Added permission to NMU to the README.Debian.
+  * Mention file:/ URLs in README.Debian. (Closes: Bug#87099)
+  * Add a --boot-floppies option that changes the way the I/O happens, in
+    a way that's hopefully useful for boot-floppies. See README.Debian for
+    details.
+  * Also added a bit more output.
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Mon, 26 Mar 2001 22:30:12 +1000
+
+debootstrap (0.1.3) unstable; urgency=high
+
+  * Switch from debconf-tiny to debconf, since that's what's now in
+    woody. (Using debconf-tiny probably makes the package unusable, hence
+    the urgency) Fixup perl, lilo and console-apt to cope with changes in
+    the base system in woody. Added ae, left nano and nvi.
+  * Add support for m68k, sparc and powerpc, based on Christian Steigies
+    patches and Adam Di Carlo's NMU (Closes: Bug#89883, Bug#91221)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun, 25 Mar 2001 14:29:02 +1000
+
+debootstrap (0.1.2) unstable; urgency=low
+
+  * Add support for slink.
+  * Fix support for woody (no lilo, console-*, different perl)
+  * Re-download Packages files every time (Closes: Bug#88438)
+    (Should this be changed to re-download things where the md5 doesn't match?)
+
+ -- Anthony Towns <aj@azure.humbug.org.au>  Sun,  4 Mar 2001 19:42:29 +1000
+
+debootstrap (0.1.1) unstable; urgency=low
+
+  * Initial Release. (Closes: Bug#82245)
+
+  * Called it debootstrap instead of debchroot, because it's more about
+    bootstrapping a Debian environment, whether that will end up being
+    in a chroot, or as a standalone system. Blame Adam di Carlo. :)
+
+ -- Anthony Towns <ajt@debian.org>  Tue, 30 Jan 2001 10:54:45 +1000
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/compat b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/compat
new file mode 100644
index 00000000..ec635144
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/compat
@@ -0,0 +1 @@
+9
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/control b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/control
new file mode 100644
index 00000000..6925a63c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/control
@@ -0,0 +1,26 @@
+Source: debootstrap
+Section: admin
+Priority: extra
+Maintainer: Franco (nextime) Lanza <nextime@devuan.org>
+Uploaders: Franco (nextime) Lanza <nextime@devuan.org>, Daniel Reurich <daniel@centurion.net.nz>
+Build-Depends: debhelper (>= 9), makedev (>= 2.3.1-69) [linux-any], git
+Standards-Version: 3.9.8
+Vcs-Browser: https://git.devuan.org/devuan-packages/debootstrap
+Vcs-Git: https://git.devuan.org/devuan-packages/debootstrap.git
+
+Package: debootstrap
+Architecture: all
+Depends: ${misc:Depends}, wget
+Recommends: gnupg, ${keyring}, devuan-keyring
+Description: Bootstrap a basic Devuan system
+ debootstrap is used to create a Devuan base system from scratch,
+ without requiring the availability of dpkg or apt. It does this by
+ downloading .deb files from a mirror site, and carefully unpacking them
+ into a directory which can eventually be chrooted into.
+
+Package: debootstrap-udeb
+Section: debian-installer
+Package-Type: udeb
+Architecture: all
+Depends: ${misc:Depends}, mounted-partitions
+Description: Bootstrap the Devuan system
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/copyright b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/copyright
new file mode 100644
index 00000000..b34963b1
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/copyright
@@ -0,0 +1,30 @@
+This package was debianized by Anthony Towns <ajt@debian.org> on
+Tue, 30 Jan 2001 10:54:45 +1000.
+
+It was written from scratch for Debian by Anthony Towns <ajt@debian.org>
+based loosely on the code for constructing base tarballs as part of the
+boot-floppies package.
+
+Copyright:
+
+Copyright (c) 2001-2005 Anthony Towns
+
+   Permission is hereby granted, free of charge, to any person obtaining
+   a copy of this software and associated documentation files (the
+   "Software"), to deal in the Software without restriction, including
+   without limitation the rights to use, copy, modify, merge, publish,
+   distribute, sublicense, and/or sell copies of the Software, and to
+   permit persons to whom the Software is furnished to do so, subject to
+   the following conditions:
+     
+   The above copyright notice and this permission notice shall be
+   included in all copies or substantial portions of the Software.
+     
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+   IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+   CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+   TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+   SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/debootstrap.docs b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/debootstrap.docs
new file mode 100644
index 00000000..e845566c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/debootstrap.docs
@@ -0,0 +1 @@
+README
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/debootstrap.manpages b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/debootstrap.manpages
new file mode 100644
index 00000000..d6a5e4ac
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/debootstrap.manpages
@@ -0,0 +1 @@
+debootstrap.8
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/gbp.conf b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/gbp.conf
new file mode 100644
index 00000000..ac8e799c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/gbp.conf
@@ -0,0 +1,9 @@
+[DEFAULT]
+compression = xz
+pristine-tar = false
+upstream-tag = devuan/1.0.85
+
+[git-buildpackage]
+upstream-tree = tag
+tarball-dir = ../tarballs/
+export-dir = ../build-area/
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/rules b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/rules
new file mode 100755
index 00000000..23bc4a61
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/rules
@@ -0,0 +1,47 @@
+#! /usr/bin/make -f
+
+ifeq (0,$(shell dpkg-vendor --derives-from Ubuntu; echo $$?))
+  KEYRING := ubuntu-keyring
+else ifeq (0,$(shell dpkg-vendor --derives-from Devuan; echo $$?))
+  KEYRING := devuan-keyring
+else ifeq (0,$(shell dpkg-vendor --derives-from Tanglu; echo $$?))
+  KEYRING := tanglu-archive-keyring
+else
+  KEYRING := debian-archive-keyring
+endif
+
+%:
+	dh $@
+
+# need to be root to make devices, so build is done in install target
+override_dh_auto_build:
+
+override_dh_auto_install:
+	dh_auto_build
+	
+	$(MAKE) install DESTDIR=$(CURDIR)/debian/debootstrap
+	$(MAKE) install DESTDIR=$(CURDIR)/debian/debootstrap-udeb
+	
+	# remove scripts not needed by d-i
+	-rm -f debian/debootstrap-udeb/usr/share/debootstrap/scripts/potato \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/woody \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/sarge \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/warty \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/hoary \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/breezy \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/dapper \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/edgy \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/feisty \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/*.buildd \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/*.fakechroot \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/stable \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/testing \
+		debian/debootstrap-udeb/usr/share/debootstrap/scripts/unstable
+
+override_dh_gencontrol:
+	dh_gencontrol -- -Vkeyring=$(KEYRING)
+
+# Specify gzip to mitigate #770217:
+override_dh_builddeb:
+	dh_builddeb -pdebootstrap      -- -Zgzip
+	dh_builddeb -pdebootstrap-udeb -- -Zxz
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debian/source/format b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/source/format
new file mode 100644
index 00000000..af745b31
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debian/source/format
@@ -0,0 +1 @@
+3.0 (git)
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debootstrap b/cdist/preos/debootstrap/files/devuan-debootstrap/debootstrap
new file mode 100755
index 00000000..71c70540
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debootstrap
@@ -0,0 +1,703 @@
+#!/bin/sh
+set -e
+
+VERSION='@VERSION@'
+
+unset TMP TEMP TMPDIR || true
+
+# might not be exported if we're running from init=/bin/sh or similar
+export PATH
+
+###########################################################################
+
+if [ -z "$DEBOOTSTRAP_DIR" ]; then
+	if [ -x /debootstrap/debootstrap ]; then
+		DEBOOTSTRAP_DIR=/debootstrap
+	else
+		DEBOOTSTRAP_DIR=/usr/share/debootstrap
+	fi
+fi
+
+. $DEBOOTSTRAP_DIR/functions
+exec 4>&1
+
+LANG=C
+USE_COMPONENTS=main
+KEYRING=""
+DISABLE_KEYRING=""
+FORCE_KEYRING=""
+VARIANT=""
+MERGED_USR="no"
+ARCH=""
+HOST_ARCH=""
+HOST_OS=""
+KEEP_DEBOOTSTRAP_DIR=""
+USE_DEBIANINSTALLER_INTERACTION=""
+SECOND_STAGE_ONLY=""
+PRINT_DEBS=""
+CHROOTDIR=""
+MAKE_TARBALL=""
+EXTRACTOR_OVERRIDE=""
+UNPACK_TARBALL=""
+ADDITIONAL=""
+EXCLUDE=""
+VERBOSE=""
+CERTIFICATE=""
+CHECKCERTIF=""
+PRIVATEKEY=""
+
+
+DEF_MIRROR="http://packages.devuan.org/merged"
+DEF_HTTPS_MIRROR="https://packages.devuan.org/merged"
+
+export LANG USE_COMPONENTS EXCLUDE
+umask 022
+
+###########################################################################
+
+## phases:
+##   finddebs dldebs printdebs first_stage second_stage
+
+RESOLVE_DEPS=true
+
+WHAT_TO_DO="finddebs dldebs first_stage second_stage"
+am_doing_phase () {
+	# usage:   if am_doing_phase finddebs; then ...; fi
+	local x;
+	for x in "$@"; do
+		if echo " $WHAT_TO_DO " | grep -q " $x "; then return 0; fi
+	done
+	return 1
+}
+
+###########################################################################
+
+usage_err()
+{
+	info USAGE1 "usage: [OPTION]... <suite> <target> [<mirror> [<script>]]"
+	info USAGE2 "Try \`${0##*/} --help' for more information."
+	error "$@"
+}
+
+usage()
+{
+	echo "Usage: ${0##*/} [OPTION]... <suite> <target> [<mirror> [<script>]]"
+	echo "Bootstrap a Debian base system into a target directory."
+	echo
+	cat <<EOF
+      --help                 display this help and exit
+      --version              display version information and exit
+      --verbose              don't turn off the output of wget
+
+      --download-only        download packages, but don't perform installation
+      --print-debs           print the packages to be installed, and exit
+
+      --arch=A               set the architecture to install (use if no dpkg)
+                               [ --arch=powerpc ]
+
+      --include=A,B,C        adds specified names to the list of base packages
+      --exclude=A,B,C        removes specified packages from the list
+      --components=A,B,C     use packages from the listed components of the
+                             archive
+      --variant=X            use variant X of the bootstrap scripts
+                             (currently supported variants: buildd, fakechroot,
+                              minbase)
+      --merged-usr           make /{bin,sbin,lib}/ symlinks to /usr/
+      --keyring=K            check Release files against keyring K
+      --no-check-gpg         avoid checking Release file signatures
+      --force-check-gpg      force checking Release file signatures
+                             (also disables automatic fallback to HTTPS in case
+                             of a missing keyring), aborting otherwise
+      --no-resolve-deps      don't try to resolve dependencies automatically
+
+      --unpack-tarball=T     acquire .debs from a tarball instead of http
+      --make-tarball=T       download .debs and create a tarball (tgz format)
+      --second-stage-target=DIR
+                             Run second stage in a subdirectory instead of root
+                               (can be used to create a foreign chroot)
+                               (requires --second-stage)
+      --extractor=TYPE       override automatic .deb extractor selection
+                               (supported: $EXTRACTORS_SUPPORTED)
+      --debian-installer     used for internal purposes by debian-installer
+      --private-key=file     read the private key from file
+      --certificate=file     use the client certificate stored in file (PEM)
+      --no-check-certificate do not check certificate against certificate authorities
+EOF
+}
+
+###########################################################################
+
+if [ -z "$PKGDETAILS" ]; then
+	error 1 NO_PKGDETAILS "No pkgdetails available; either install perl, or build pkgdetails.c from the base-installer source package"
+fi
+
+###########################################################################
+
+if [ $# != 0 ] ; then
+    while true ; do
+	case "$1" in
+	    --help)
+		usage
+		exit 0
+		;;
+	    --version)
+		echo "debootstrap $VERSION"
+		exit 0
+		;;
+	    --debian-installer)
+		if ! (echo -n "" >&3) 2>/dev/null; then
+			error 1 ARG_DIBYHAND "If running debootstrap by hand, don't use --debian-installer"
+		fi
+		USE_DEBIANINSTALLER_INTERACTION=yes
+		shift
+		;;
+	    --foreign)
+		if [ "$PRINT_DEBS" != "true" ]; then
+			WHAT_TO_DO="finddebs dldebs first_stage"
+		fi
+		shift
+		;;
+	    --second-stage)
+		WHAT_TO_DO="second_stage"
+		SECOND_STAGE_ONLY=true
+		shift
+		;;
+	    --second-stage-target|--second-stage-target=?*)
+		if [ "$SECOND_STAGE_ONLY" != "true" ] ; then
+			error 1 STAGE2ONLY "option %s only applies in the second stage" "$1"
+		fi
+		if [ "$1" = "--second-stage-target" -a -n "$2" ] ; then
+			CHROOTDIR="$2"
+			shift 2
+		elif [ "$1" != "${1#--second-stage-target=}" ]; then
+			CHROOTDIR="${1#--second-stage-target=}"
+			shift
+		else
+			error 1 NEEDARG "option requires an argument: %s" "$1"
+		fi
+		;;
+	    --print-debs)
+		WHAT_TO_DO="finddebs printdebs kill_target"
+		PRINT_DEBS=true
+		shift
+		;;
+	    --download-only)
+		WHAT_TO_DO="finddebs dldebs"
+		shift
+		;;
+	    --make-tarball|--make-tarball=?*)
+		WHAT_TO_DO="finddebs dldebs maketarball kill_target"
+		if [ "$1" = "--make-tarball" -a -n "$2" ] ; then
+			MAKE_TARBALL="$2"
+			shift 2
+		elif [ "$1" != "${1#--make-tarball=}" ]; then
+			MAKE_TARBALL="${1#--make-tarball=}"
+			shift
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		;;
+	    --resolve-deps)
+		# redundant, but avoids breaking compatibility
+		RESOLVE_DEPS=true
+		shift
+		;;
+	    --no-resolve-deps)
+		RESOLVE_DEPS=false
+		shift
+		;;
+	    --keep-debootstrap-dir)
+		KEEP_DEBOOTSTRAP_DIR=true
+		shift
+		;;
+	    --arch|--arch=?*)
+		if [ "$1" = "--arch" -a -n "$2" ] ; then
+			ARCH="$2"
+			shift 2
+                elif [ "$1" != "${1#--arch=}" ]; then
+			ARCH="${1#--arch=}"
+			shift
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		;;
+	    --extractor|--extractor=?*)
+		if [ "$1" = "--extractor" -a -n "$2" ] ; then
+			EXTRACTOR_OVERRIDE="$2"
+			shift 2
+		elif [ "$1" != "${1#--extractor=}" ]; then
+			EXTRACTOR_OVERRIDE="${1#--extractor=}"
+			shift
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		if valid_extractor "$EXTRACTOR_OVERRIDE"; then
+			if ! type "$EXTRACTOR_OVERRIDE" >/dev/null 2>&1; then
+				error 1 MISSINGEXTRACTOR "The selected extractor cannot be found: %s" "$EXTRACTOR_OVERRIDE"
+			fi
+		else
+			error 1 BADEXTRACTOR "%s: unknown extractor" "$EXTRACTOR_OVERRIDE"
+		fi
+		;;
+	    --unpack-tarball|--unpack-tarball=?*)
+		if [ "$1" = "--unpack-tarball" -a -n "$2" ] ; then
+			UNPACK_TARBALL="$2"
+			shift 2
+		elif [ "$1" != "${1#--unpack-tarball=}" ]; then
+			UNPACK_TARBALL="${1#--unpack-tarball=}"
+			shift
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		if [ ! -f "$UNPACK_TARBALL" ] ; then
+			error 1 NOTARBALL "%s: No such file or directory" "$UNPACK_TARBALL"
+		fi
+		;;
+	    --include|--include=?*)
+		if [ "$1" = "--include" -a -n "$2" ]; then
+			ADDITIONAL="$2"
+			shift 2
+                elif [ "$1" != "${1#--include=}" ]; then
+			ADDITIONAL="${1#--include=}"
+			shift 1
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		ADDITIONAL="$(echo "$ADDITIONAL" | tr , " ")"
+		;;
+	    --exclude|--exclude=?*)
+		if [ "$1" = "--exclude" -a -n "$2" ]; then
+			EXCLUDE="$2"
+			shift 2
+                elif [ "$1" != "${1#--exclude=}" ]; then
+			EXCLUDE="${1#--exclude=}"
+			shift 1
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		EXCLUDE="$(echo "$EXCLUDE" | tr , " ")"
+		;;
+	    --verbose)
+		VERBOSE=true
+		export VERBOSE
+		shift 1
+		;;
+	    --components|--components=?*)
+		if [ "$1" = "--components" -a -n "$2" ]; then
+			USE_COMPONENTS="$2"
+			shift 2
+                elif [ "$1" != "${1#--components=}" ]; then
+			USE_COMPONENTS="${1#--components=}"
+			shift 1
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		USE_COMPONENTS="$(echo "$USE_COMPONENTS" | tr , "|")"
+		;;
+	    --variant|--variant=?*)
+		if [ "$1" = "--variant" -a -n "$2" ]; then
+			VARIANT="$2"
+			shift 2
+                elif [ "$1" != "${1#--variant=}" ]; then
+			VARIANT="${1#--variant=}"
+			shift 1
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		;;
+            --merged-usr)
+		MERGED_USR=yes
+		shift
+		;;
+	    --no-merged-usr)
+		MERGED_USR=no
+		shift
+		;;
+	    --keyring|--keyring=?*)
+		if ! gpgv --version >/dev/null 2>&1; then
+			error 1 NEEDGPGV "gpgv not installed, but required for Release verification"
+		fi
+		if [ "$1" = "--keyring" -a -n "$2" ]; then
+			KEYRING="$2"
+			shift 2
+                elif [ "$1" != "${1#--keyring=}" ]; then
+			KEYRING="${1#--keyring=}"
+			shift 1
+		else
+			error 1 NEEDARG "option requires an argument %s" "$1"
+		fi
+		;;
+	    --no-check-gpg)
+			shift 1
+			DISABLE_KEYRING=1
+		;;
+	    --force-check-gpg)
+			shift 1
+			FORCE_KEYRING=1
+		;;
+	    --certificate|--certificate=?*)
+		if [ "$1" = "--certificate" -a -n "$2" ]; then
+			CERTIFICATE="--certificate=$2"
+			shift 2
+		elif [ "$1" != "${1#--certificate=}" ]; then
+			CERTIFICATE="--certificate=${1#--certificate=}" 
+			shift 1
+		else
+		       error 1 NEEDARG "option requires an argument %s" "$1" 
+		fi
+		;;
+	    --private-key|--private-key=?*)
+		if [ "$1" = "--private-key" -a -n "$2" ]; then
+			PRIVATEKEY="--private-key=$2"
+			shift 2
+		elif [ "$1" != "${1#--private-key=}" ]; then
+			PRIVATEKEY="--private-key=${1#--private-key=}" 
+			shift 1
+		else
+		       error 1 NEEDARG "option requires an argument %s" "$1" 
+		fi
+		;;
+	    --no-check-certificate)
+		CHECKCERTIF="--no-check-certificate"
+		shift
+		;;
+	    -*)
+		error 1 BADARG "unrecognized or invalid option %s" "$1"
+		;;
+	    *)
+		break
+		;;
+	esac
+    done
+fi
+
+###########################################################################
+
+if [ -n "$DISABLE_KEYRING" -a -n "$FORCE_KEYRING" ]; then
+	error 1 BADARG "Both --no-check-gpg and --force-check-gpg specified, please pick one (at most)"
+fi
+
+###########################################################################
+
+if [ "$SECOND_STAGE_ONLY" = "true" ]; then
+	SUITE=$(cat $DEBOOTSTRAP_DIR/suite)
+	ARCH=$(cat $DEBOOTSTRAP_DIR/arch)
+	if [ -e $DEBOOTSTRAP_DIR/variant ]; then
+		VARIANT=$(cat $DEBOOTSTRAP_DIR/variant)
+		SUPPORTED_VARIANTS="$VARIANT"
+	fi
+	if [ -z "$CHROOTDIR" ]; then
+		TARGET=/
+	else
+		TARGET=$CHROOTDIR
+	fi
+	SCRIPT=$DEBOOTSTRAP_DIR/suite-script
+else
+	if [ -z "$1" ] || [ -z "$2" ]; then
+		usage_err 1 NEEDSUITETARGET "You must specify a suite and a target."
+	fi
+	SUITE="$1"
+	TARGET="$2"
+	USER_MIRROR="$3"
+	TARGET="${TARGET%/}"
+	if [ "${TARGET#/}" = "${TARGET}" ]; then
+		if [ "${TARGET%/*}" = "$TARGET" ] ; then
+			TARGET="$(echo "`pwd`/$TARGET")"
+		else
+			TARGET="$(cd "${TARGET%/*}"; echo "`pwd`/${TARGET##*/}")"
+		fi
+	fi
+
+	SCRIPT="$DEBOOTSTRAP_DIR/scripts/$1"
+	if [ -n "$VARIANT" ] && [ -e "${SCRIPT}.${VARIANT}" ]; then
+		SCRIPT="${SCRIPT}.${VARIANT}"
+		SUPPORTED_VARIANTS="$VARIANT"
+	fi
+	if [ "$4" != "" ]; then
+		SCRIPT="$4"
+	fi
+fi
+
+###########################################################################
+
+if in_path dpkg && \
+     dpkg --print-architecture >/dev/null 2>&1; then
+	HOST_ARCH=`/usr/bin/dpkg --print-architecture`
+elif in_path udpkg && \
+     udpkg --print-architecture >/dev/null 2>&1; then
+	HOST_ARCH=`/usr/bin/udpkg --print-architecture`
+elif [ -e $DEBOOTSTRAP_DIR/arch ]; then
+	HOST_ARCH=`cat $DEBOOTSTRAP_DIR/arch`
+fi
+HOST_OS="$HOST_ARCH"
+# basic host OS guessing for non-Debian systems
+if [ -z "$HOST_OS" ]; then
+	case `uname` in
+		Linux)
+			HOST_OS=linux
+		;;
+		GNU/kFreeBSD)
+			HOST_OS=kfreebsd
+		;;
+		GNU)
+			HOST_OS=hurd
+		;;
+		FreeBSD*)
+			HOST_OS=freebsd
+		;;
+	esac
+fi
+
+if [ -z "$ARCH" ]; then
+	ARCH=$HOST_ARCH
+fi
+
+if [ -z "$ARCH" ] || [ -z "$HOST_OS" ]; then
+        error 1 WHATARCH "Couldn't work out current architecture"
+
+fi
+
+if [ "$HOST_OS" = "kfreebsd" ] || [ "$HOST_OS" = "freebsd" ]; then
+	for module in linprocfs fdescfs tmpfs linsysfs; do
+		kldstat -m "$module" > /dev/null 2>&1 || warning SANITYCHECK "Probably required module %s is not loaded" "$module"
+	done
+fi
+
+if [ "$TARGET" = "/" ]; then
+	CHROOT_CMD=""
+else
+	CHROOT_CMD="chroot $TARGET"
+fi
+
+if [ -z "$SHA_SIZE" ]; then
+	SHA_SIZE=256
+fi
+if ! in_path "sha${SHA_SIZE}sum" && ! in_path "sha${SHA_SIZE}"; then
+	SHA_SIZE=1
+fi
+DEBOOTSTRAP_CHECKSUM_FIELD="SHA$SHA_SIZE"
+
+export ARCH SUITE TARGET CHROOT_CMD SHA_SIZE DEBOOTSTRAP_CHECKSUM_FIELD
+
+if am_doing_phase first_stage second_stage; then
+	if in_path id && [ `id -u` -ne 0 ]; then
+		error 1 NEEDROOT "debootstrap can only run as root"
+	fi
+	# Ensure that we can create working devices and executables on the target.
+	if ! check_sane_mount "$TARGET"; then
+		error 1 NOEXEC "Cannot install into target '$TARGET' mounted with noexec or nodev"
+	fi
+fi
+
+if [ ! -e "$SCRIPT" ]; then
+	error 1 NOSCRIPT "No such script: %s" "$SCRIPT"
+fi
+
+###########################################################################
+
+if [ "$TARGET" != "" ]; then
+	mkdir -p "$TARGET/debootstrap"
+fi
+
+###########################################################################
+
+# Use of fd's by functions/scripts:
+#
+#    stdin/stdout/stderr: used normally
+#    fd 4: I:/W:/etc information
+#    fd 5,6: spare for functions
+#    fd 7,8: spare for scripts
+
+if [ "$USE_DEBIANINSTALLER_INTERACTION" = yes ]; then
+	#    stdout=stderr: full log of debootstrap run
+	#    fd 3: I:/W:/etc information
+	exec 4>&3
+elif am_doing_phase printdebs; then
+	#    stderr: I:/W:/etc information
+	#    stdout: debs needed
+	exec 4>&2
+else
+	#    stderr: used in exceptional circumstances only
+	#    stdout: I:/W:/etc information
+	#    $TARGET/debootstrap/debootstrap.log: full log of debootstrap run
+	exec 4>&1
+	exec >>"$TARGET/debootstrap/debootstrap.log"
+	exec 2>&1
+fi
+
+###########################################################################
+
+if [ "$UNPACK_TARBALL" ]; then
+	if [ "${UNPACK_TARBALL#/}" = "$UNPACK_TARBALL" ]; then
+		error 1 TARPATH "Tarball must be given a complete path"
+	fi
+	if [ "${UNPACK_TARBALL%.tar}" != "$UNPACK_TARBALL" ]; then
+		(cd "$TARGET" && tar -xf "$UNPACK_TARBALL")
+	elif [ "${UNPACK_TARBALL%.tgz}" != "$UNPACK_TARBALL" ]; then
+		(cd "$TARGET" && zcat "$UNPACK_TARBALL" | tar -xf -)
+	else
+		error 1 NOTTAR "Unknown tarball: must be either .tar or .tgz"
+	fi
+fi
+
+###########################################################################
+
+. "$SCRIPT"
+
+if [ "$SECOND_STAGE_ONLY" = "true" ]; then
+	MIRRORS=null:
+else
+	MIRRORS="$DEF_MIRROR"
+	if [ "$USER_MIRROR" != "" ]; then
+		MIRRORS="$USER_MIRROR"
+		MIRRORS="${MIRRORS%/}"
+	fi
+fi
+
+export MIRRORS
+
+ok=false
+for v in $SUPPORTED_VARIANTS; do
+	if doing_variant $v; then ok=true; fi
+done
+if ! $ok; then
+	error 1 UNSUPPVARIANT "unsupported variant"
+fi
+
+###########################################################################
+
+if am_doing_phase finddebs; then
+	if [ "$FINDDEBS_NEEDS_INDICES" = "true" ] || \
+	   [ "$RESOLVE_DEPS" = "true" ]; then
+		download_indices
+		GOT_INDICES=true
+	fi
+
+	work_out_debs
+
+	base=$(without "$base $ADDITIONAL" "$EXCLUDE")
+
+	if [ "$RESOLVE_DEPS" = true ]; then
+		requiredX=$(echo $(echo $required | tr ' ' '\n' | sort | uniq))
+		baseX=$(echo $(echo $base | tr ' ' '\n' | sort | uniq))
+
+		baseN=$(without "$baseX" "$requiredX")
+		baseU=$(without "$baseX" "$baseN")
+
+		if [ "$baseU" != "" ]; then
+			info REDUNDANTBASE "Found packages in base already in required: %s" "$baseU"
+		fi
+
+		info RESOLVEREQ "Resolving dependencies of required packages..."
+		required=$(resolve_deps $requiredX)
+		info RESOLVEBASE "Resolving dependencies of base packages..."
+		base=$(resolve_deps $baseX)
+		base=$(without "$base" "$required")
+
+		requiredX=$(without "$required" "$requiredX")
+		baseX=$(without "$base" "$baseX")
+		if [ "$requiredX" != "" ]; then
+			info NEWREQUIRED "Found additional required dependencies: %s" "$requiredX"
+		fi
+		if [ "$baseX" != "" ]; then
+			info NEWBASE "Found additional base dependencies: %s" "$baseX"
+		fi
+	fi
+
+	all_debs="$required $base"
+fi
+
+if am_doing_phase printdebs; then
+	echo "$all_debs"
+fi
+
+if am_doing_phase dldebs; then
+	if [ "$GOT_INDICES" != "true" ]; then
+		download_indices
+	fi
+	download $all_debs
+fi
+
+if am_doing_phase maketarball; then
+	(cd $TARGET;
+	 tar czf - var/lib/apt var/cache/apt) >$MAKE_TARBALL
+fi
+
+if am_doing_phase first_stage; then
+	choose_extractor
+
+	# first stage sets up the chroot -- no calls should be made to
+	# "chroot $TARGET" here; but they should be possible by the time it's
+	# finished
+	first_stage_install
+
+	if ! am_doing_phase second_stage; then
+		cp "$0"				 "$TARGET/debootstrap/debootstrap"
+		cp $DEBOOTSTRAP_DIR/functions	 "$TARGET/debootstrap/functions"
+		cp $SCRIPT			 "$TARGET/debootstrap/suite-script"
+		echo "$ARCH"			>"$TARGET/debootstrap/arch"
+		echo "$SUITE"			>"$TARGET/debootstrap/suite"
+		[ "" = "$VARIANT" ] ||
+		echo "$VARIANT"			>"$TARGET/debootstrap/variant"
+		echo "$required"		>"$TARGET/debootstrap/required"
+		echo "$base"			>"$TARGET/debootstrap/base"
+
+		chmod 755 "$TARGET/debootstrap/debootstrap"
+	fi
+fi
+
+if am_doing_phase second_stage; then
+	if [ "$SECOND_STAGE_ONLY" = true ]; then
+		required="$(cat $DEBOOTSTRAP_DIR/required)"
+		base="$(cat $DEBOOTSTRAP_DIR/base)"
+		all_debs="$required $base"
+	fi
+
+	# second stage uses the chroot to clean itself up -- has to be able to
+	# work from entirely within the chroot (in case we've booted into it,
+	# possibly over NFS eg)
+
+	second_stage_install
+
+	# create sources.list
+	# first, kill debootstrap.invalid sources.list
+	if [ -e "$TARGET/etc/apt/sources.list" ]; then
+		rm -f "$TARGET/etc/apt/sources.list"
+	fi
+	if [ "${MIRRORS#http://}" != "$MIRRORS" ]; then
+		setup_apt_sources "${MIRRORS%% *}"
+		mv_invalid_to "${MIRRORS%% *}"
+	else
+		setup_apt_sources "$DEF_MIRROR"
+		mv_invalid_to "$DEF_MIRROR"
+	fi
+
+	if [ -e "$TARGET/debootstrap/debootstrap.log" ]; then
+		if [ "$KEEP_DEBOOTSTRAP_DIR" = true ]; then
+			cp "$TARGET/debootstrap/debootstrap.log" "$TARGET/var/log/bootstrap.log"
+		else
+			# debootstrap.log is still open as stdout/stderr and needs
+			# to remain so, but after unlinking it some NFS servers
+			# implement this by a temporary file in the same directory,
+			# which makes it impossible to rmdir that directory.
+			# Moving it instead works around the problem.
+			mv "$TARGET/debootstrap/debootstrap.log" "$TARGET/var/log/bootstrap.log"
+		fi
+	fi
+	sync
+
+	if [ "$KEEP_DEBOOTSTRAP_DIR" = true ]; then
+		if [ -x "$TARGET/debootstrap/debootstrap" ]; then
+			chmod 644 "$TARGET/debootstrap/debootstrap"
+		fi
+	else
+		rm -rf "$TARGET/debootstrap"
+	fi
+fi
+
+if am_doing_phase kill_target; then
+	if [ "$KEEP_DEBOOTSTRAP_DIR" != true ]; then
+		info KILLTARGET "Deleting target directory"
+		rm -rf "$TARGET"
+	fi
+fi
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/debootstrap.8 b/cdist/preos/debootstrap/files/devuan-debootstrap/debootstrap.8
new file mode 100644
index 00000000..ce6e814e
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/debootstrap.8
@@ -0,0 +1,189 @@
+.TH DEBOOTSTRAP 8 2015-05-21 "Devuan Project" "Devuan GNU/Linux manual"
+.SH NAME
+debootstrap \- Bootstrap a basic Devuan system
+.SH SYNOPSIS
+.B debootstrap
+.RB [ OPTION\&.\&.\&. ]
+.I SUITE TARGET
+.RI [ MIRROR
+.RI [ SCRIPT ]]
+
+.B debootstrap
+.RB [ OPTION\&.\&.\&. ]
+\-\-second\-stage
+.SH DESCRIPTION
+.B debootstrap
+bootstraps a basic Devuan system of
+.I SUITE
+into
+.I TARGET
+from
+.I MIRROR
+by running
+.IR SCRIPT .
+.I MIRROR
+can be an http:// or https:// URL, a file:/// URL, or an ssh:/// URL.
+.PP
+The
+.I SUITE
+may be a release code name (eg, ceres, ascii, jessie)
+or a symbolic name (eg, unstable, testing, stable, oldstable)
+.PP
+Notice that file:/ URLs are translated to file:/// (correct scheme as
+described in RFC1738 for local filenames), and file:// will \fBnot\fR work.
+ssh://USER@HOST/PATH URLs are retrieved using
+.BR scp ;
+use of
+.B ssh\-agent
+or similar is strongly recommended.
+.PP
+\fBDebootstrap\fR can be used to install Devuan in a system without using an
+installation disk but can also be used to run a different Devuan flavor in a \fBchroot\fR
+environment.
+This way you can create a full (minimal) Devuan installation which
+can be used for testing purposes (see the \fBEXAMPLES\fR section). 
+If you are looking for a chroot system to build packages please take a look at 
+\fBpbuilder\fR.
+.SH "OPTIONS"
+.PP
+.IP "\fB\-\-arch=ARCH\fP"
+Set the target architecture (use if dpkg isn't installed).
+See also \-\-foreign.
+.IP
+.IP "\fB\-\-include=alpha,beta\fP"
+Comma separated list of packages which will be added to download and extract
+lists.
+.IP
+.IP "\fB\-\-exclude=alpha,beta\fP"
+Comma separated list of packages which will be removed from download and
+extract lists.
+WARNING: you can and probably will exclude essential packages, be
+careful using this option.
+.IP
+.IP "\fB\-\-components=alpha,beta\fP"
+Use packages from the listed components of the archive.
+.IP
+.IP "\fB\-\-no\-resolve\-deps\fP"
+By default, debootstrap will attempt to automatically resolve any missing
+dependencies, warning if any are found.
+Note that this is not a complete dependency resolve in the sense of dpkg
+or apt, and that it is far better to specify the entire base system than
+rely on this option.
+With this option set, this behaviour is disabled.
+.IP
+.IP "\fB\-\-variant=minbase|buildd|fakechroot\fP"
+Name of the bootstrap script variant to use.
+Currently, the variants supported are minbase, which only includes
+essential packages and apt; buildd, which installs the build-essential
+packages into
+.IR TARGET ;
+and fakechroot, which installs the packages without root privileges.
+The default, with no \fB\-\-variant=X\fP argument, is to create a base
+Devuan installation in
+.IR TARGET .
+.IP
+.IP "\fB\-\-merged-usr\fP"
+Create /{bin,sbin,lib}/ symlinks pointing to their counterparts in /usr/.
+.IP
+.IP "\fB\-\-no-merged-usr\fP"
+Do not create /{bin,sbin,lib}/ symlinks pointing to their counterparts in /usr/.
+(Default.)
+.IP
+.IP "\fB\-\-keyring=KEYRING\fP"
+Override the default keyring for the distribution being bootstrapped,
+and use
+.IR KEYRING
+to check signatures of retrieved Release files.
+.IP
+.IP "\fB\-\-no-check-gpg\fP"
+Disables checking gpg signatures of retrieved Release files.
+.IP
+.IP "\fB\-\-force-check-gpg\fP"
+Forces checking Release file signatures, disabling automatic fallback to
+HTTPS in case of a missing keyring. Incompatible with the previous option.
+.IP
+.IP "\fB\-\-verbose\fP"
+Produce more info about downloading.
+.IP
+.IP "\fB\-\-print\-debs\fP"
+Print the packages to be installed, and exit.
+Note that a TARGET directory must be specified so debootstrap can
+download Packages files to determine which packages should be installed,
+and to resolve dependencies.
+The TARGET directory will be deleted unless \-\-keep\-debootstrap\-dir
+is specified.
+.IP
+.IP "\fB\-\-download\-only\fP"
+Download packages, but don't perform installation.
+.IP
+.IP "\fB\-\-foreign\fP"
+Do the initial unpack phase of bootstrapping only, for example if the
+target architecture does not match the host architecture.
+A copy of debootstrap sufficient for completing the bootstrap process
+will be installed as /debootstrap/debootstrap in the target filesystem.
+You can run it with the \fB\-\-second\-stage\fP option to complete the
+bootstrapping process.
+.IP
+.IP "\fB\-\-second\-stage\fP"
+Complete the bootstrapping process.
+Other arguments are generally not needed.
+.IP
+.IP "\fB\-\-second\-stage\-target=DIR\fP"
+Run second stage in a subdirectory instead of root. (can be used to create
+a foreign chroot) (requires \-\-second\-stage)
+.IP
+.IP "\fB\-\-keep\-debootstrap\-dir\fP"
+Don't delete the /debootstrap directory in the target after completing the
+installation.
+.IP
+.IP "\fB\-\-unpack\-tarball=FILE\fP"
+Acquire .debs from tarball FILE instead of downloading via http.
+.IP
+.IP "\fB\-\-make\-tarball=FILE\fP"
+Instead of bootstrapping, make a tarball (written to FILE) of the downloaded
+packages.
+The resulting tarball may be passed to a later
+.BR \-\-unpack\-tarball .
+.IP
+.IP "\fB\-\-debian\-installer\fP"
+Used for internal purposes by the debian-installer
+.IP 
+.IP "\fB\-\-extractor=TYPE\fP"
+Override automatic .deb extractor selection to
+.IR TYPE .
+Supported extractors are: dpkg-deb and ar.
+.IP
+.IP "\fB\-\-no\-check\-certificate\fP"
+Do not check certificate against certificate authorities
+.IP
+.IP "\fB\-\-certificate=FILE\fP"
+Use the client certificate stored in file (PEM)
+.IP
+.IP "\fB\-\-private\-key=FILE\fP"
+Read the private key from file
+
+.SH EXAMPLES
+.
+.PP 
+To setup an \fIascii\fR system:
+.PP 
+     debootstrap ascii ./ascii-chroot http://packages.devuan.org/merged
+.PP
+     debootstrap ascii ./ascii-chroot file:///LOCAL_MIRROR/devuan
+.PP
+Full process to create a complete Devuan installation of \fIceres\fR (unstable)
+in a chroot:
+.PP
+     main # debootstrap ceres ceres-root http://packages.devuan.org/merged
+     [ ... watch it download the whole system ]
+     main # echo "proc ceres-root/proc proc defaults 0 0" >> /etc/fstab
+     main # mount proc ceres-root/proc -t proc
+     main # echo "sysfs ceres-root/sys sysfs defaults 0 0" >> /etc/fstab
+     main # mount sysfs ceres-root/sys -t sysfs
+     main # cp /etc/hosts ceres-root/etc/hosts
+     main # chroot ceres-root /bin/bash
+.SH AUTHOR
+.B debootstrap
+This manpage was originally written by Anthony Towns <ajt@debian.org>.
+and Matt Kraai <kraai@debian.org> for Debian.
+It was re-worked for Devuan by Daniel Reurich <daniel@centurion.net.nz>.
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/functions b/cdist/preos/debootstrap/files/devuan-debootstrap/functions
new file mode 100644
index 00000000..00b21d5e
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/functions
@@ -0,0 +1,1735 @@
+############################################################### smallutils
+
+smallyes() {
+	YES="${1-y}"
+	while echo "$YES" 2>/dev/null ; do : ; done
+}
+
+in_path () {
+	local OLD_IFS="$IFS"
+	IFS=":"
+	for dir in $PATH; do
+		if [ -x "$dir/$1" ]; then
+			IFS="$OLD_IFS"
+			return 0
+		fi
+	done
+	IFS="$OLD_IFS"
+	return 1
+}
+
+############################################################### interaction
+
+error () {
+	# <error code> <name> <string> <args>
+	local err="$1"
+	local name="$2"
+	local fmt="$3"
+	shift; shift; shift
+	if [ "$USE_DEBIANINSTALLER_INTERACTION" ]; then
+		(echo "E: $name"
+		for x in "$@"; do echo "EA: $x"; done
+		echo "EF: $fmt") >&4
+	else
+		(printf "E: $fmt\n" "$@") >&4
+	fi
+	exit $err
+}
+
+warning () {
+	# <name> <string> <args>
+	local name="$1"
+	local fmt="$2"
+	shift; shift
+	if [ "$USE_DEBIANINSTALLER_INTERACTION" ]; then
+		(echo "W: $name"
+		for x in "$@"; do echo "WA: $x"; done
+		echo "WF: $fmt") >&4
+	else
+		printf "W: $fmt\n" "$@" >&4
+	fi
+}
+
+info () {
+	# <name> <string> <args>
+	local name="$1"
+	local fmt="$2"
+	shift; shift
+	if [ "$USE_DEBIANINSTALLER_INTERACTION" ]; then
+		(echo "I: $name"
+		for x in "$@"; do echo "IA: $x"; done
+		echo "IF: $fmt") >&4
+	else
+		printf "I: $fmt\n" "$@" >&4
+	fi
+}
+
+PROGRESS_NOW=0
+PROGRESS_END=0
+PROGRESS_NEXT=""
+PROGRESS_WHAT=""
+
+progress_next () {
+	PROGRESS_NEXT="$1"
+}
+
+wgetprogress () {
+	[ ! "$VERBOSE" ] && QSWITCH="-q"
+	local ret=0
+	if [ "$USE_DEBIANINSTALLER_INTERACTION" ] && [ "$PROGRESS_NEXT" ]; then
+		wget "$@" 2>&1 >/dev/null | $PKGDETAILS "WGET%" $PROGRESS_NOW $PROGRESS_NEXT $PROGRESS_END >&3
+		ret=$?
+	else
+		wget $QSWITCH "$@" 
+		ret=$?
+	fi
+	return $ret
+}
+
+progress () {
+	# <now> <end> <name> <string> <args>
+	local now="$1"
+	local end="$2"
+	local name="$3"
+	local fmt="$4"
+	shift; shift; shift; shift
+	if [ "$USE_DEBIANINSTALLER_INTERACTION" ]; then
+		PROGRESS_NOW="$now"
+		PROGRESS_END="$end"
+		PROGRESS_NEXT=""
+		(echo "P: $now $end $name"
+		for x in "$@"; do echo "PA: $x"; done
+		echo "PF: $fmt") >&3
+	fi
+}
+
+dpkg_progress () {
+	# <now> <end> <name> <desc> UNPACKING|CONFIGURING
+	local now="$1"
+	local end="$2"
+	local name="$3"
+	local desc="$4"
+	local action="$5"
+	local expect=
+
+	if [ "$action" = UNPACKING ]; then
+		expect=half-installed
+	elif [ "$action" = CONFIGURING ]; then
+		expect=half-configured
+	fi
+
+	dp () {
+		now="$(($now + ${1:-1}))"
+	}
+
+	exitcode=0
+	while read status pkg qstate; do
+		if [ "$status" = "EXITCODE" ]; then
+			exitcode="$pkg"
+			continue
+		fi
+		[ "$qstate" = "$expect" ] || continue
+		case $qstate in
+		    half-installed)
+			dp; progress "$now" "$end" "$name" "$desc"
+			info "$action" "Unpacking %s..." "${pkg%:}"
+			expect=unpacked
+			;;
+		    unpacked)
+			expect=half-installed
+			;;
+		    half-configured)
+			dp; progress "$now" "$end" "$name" "$desc"
+			info "$action" "Configuring %s..." "${pkg%:}"
+			expect=installed
+			;;
+		    installed)
+			expect=half-configured
+			;;
+		esac
+	done
+	return $exitcode
+}
+
+############################################################# set variables
+
+default_mirror () {
+	DEF_MIRROR="$1"
+}
+
+FINDDEBS_NEEDS_INDICES=false
+finddebs_style () {
+	case "$1" in
+	    hardcoded)
+		;;
+	    from-indices)
+		FINDDEBS_NEEDS_INDICES=true
+		;;
+	    *)
+		error 1 BADFINDDEBS "unknown finddebs style"
+		;;
+	 esac
+}
+
+mk_download_dirs () {
+	if [ $DLDEST = "apt_dest" ]; then
+		mkdir -p "$TARGET/$APTSTATE/lists/partial"
+		mkdir -p "$TARGET/var/cache/apt/archives/partial"
+	fi
+}
+
+download_style () {
+	case "$1" in
+	    apt)
+		if [ "$2" = "var-state" ]; then
+			APTSTATE=var/state/apt
+		else
+			APTSTATE=var/lib/apt
+		fi
+		DLDEST=apt_dest
+		export APTSTATE DLDEST DEBFOR
+		;;
+	    *)
+		error 1 BADDLOAD "unknown download style"
+		;;
+	esac
+}
+
+keyring () {
+	if [ -z "$KEYRING" ]; then
+		if [ -e "$1" ]; then
+			KEYRING="$1"
+		elif [ -z "$DISABLE_KEYRING" ]; then
+			if [ -n "$DEF_HTTPS_MIRROR" ] && [ -z "$USER_MIRROR" ] && [ -z "$FORCE_KEYRING" ]; then
+				info KEYRING "Keyring file not available at %s; switching to https mirror %s" "$1" "$DEF_HTTPS_MIRROR"
+				USER_MIRROR="$DEF_HTTPS_MIRROR"
+			else
+				warning KEYRING "Cannot check Release signature; keyring file not available %s" "$1"
+				if [ -n "$FORCE_KEYRING" ]; then
+					error 1 KEYRING "Keyring-based check was requested; aborting accordingly"
+				fi
+			fi
+		fi
+	fi
+}
+
+########################################################## variant handling
+
+doing_variant () {
+	if [ "$1" = "$VARIANT" ]; then return 0; fi
+	if [ "$1" = "-" ] && [ "$VARIANT" = "" ]; then return 0; fi
+	return 1
+}
+
+SUPPORTED_VARIANTS="-"
+variants () {
+	SUPPORTED_VARIANTS="$*"
+	for v in $*; do
+		if doing_variant "$v"; then return 0; fi
+	done
+	error 1 UNSUPPVARIANT "unsupported variant"
+}
+
+################################################# work out names for things
+
+mirror_style () {
+	case "$1" in
+	    release)
+		DOWNLOAD_INDICES=download_release_indices
+		DOWNLOAD_DEBS=download_release
+		;;
+	    main)
+		DOWNLOAD_INDICES=download_main_indices
+		DOWNLOAD_DEBS=download_main
+		;;
+	    *)
+		error 1 BADMIRROR "unknown mirror style"
+		;;
+	esac
+	export DOWNLOAD_INDICES
+	export DOWNLOAD_DEBS
+}
+
+force_md5 () {
+	DEBOOTSTRAP_CHECKSUM_FIELD=MD5SUM
+	export DEBOOTSTRAP_CHECKSUM_FIELD
+}
+
+verify_checksum () {
+	# args: dest checksum size
+	local expchecksum="$2"
+	local expsize="$3"
+	if [ "$DEBOOTSTRAP_CHECKSUM_FIELD" = "MD5SUM" ]; then
+		if in_path md5sum; then
+			relchecksum=`md5sum < "$1" | sed 's/ .*$//'`
+		elif in_path md5; then
+			relchecksum=`md5 < "$1"`
+		else
+			error 1 SIGCHECK "Cannot check md5sum"
+		fi
+	else
+		if in_path "sha${SHA_SIZE}sum"; then
+			relchecksum=`sha${SHA_SIZE}sum < "$1" | sed 's/ .*$//'`
+		elif in_path "sha${SHA_SIZE}"; then
+			relchecksum=`sha${SHA_SIZE} < "$1"`
+		else
+			error 1 SIGCHECK "Cannot check sha${SHA_SIZE}sum"
+		fi
+	fi
+	relsize=`wc -c < "$1"`
+	if [ "$expsize" -ne "$relsize" ] || [ "$expchecksum" != "$relchecksum" ]; then
+		return 1
+	fi
+	return 0
+}
+
+get () {
+	# args: from dest 'nocache'
+	# args: from dest [checksum size] [alt {checksum size type}]
+	local displayname
+	local versionname
+	if [ "${2%.deb}" != "$2" ]; then
+		displayname="$(echo "$2" | sed 's,^.*/,,;s,_.*$,,')"
+		versionname="$(echo "$2" | sed 's,^.*/,,' | cut -d_ -f2 | sed 's/%3a/:/')"
+	else
+		displayname="$(echo "$1" | sed 's,^.*/,,')"
+	fi
+
+	if [ -e "$2" ]; then
+		if [ -z "$3" ]; then
+			return 0
+		elif [ "$3" = nocache ]; then
+			rm -f "$2"
+		else
+			info VALIDATING "Validating %s %s" "$displayname" "$versionname"
+			if verify_checksum "$2" "$3" "$4"; then
+				return 0
+			else
+				rm -f "$2"
+			fi
+		fi
+	fi
+	# Drop 'nocache' option
+	if [ "$3" = nocache ]; then
+		set "$1" "$2"
+	fi
+
+	if [ "$#" -gt 5 ]; then
+		local st=3
+		if [ "$5" = "-" ]; then st=6; fi
+		local order="$(a=$st; while [ "$a" -le $# ]; do eval echo \"\${$(($a+1))}\" $a;
+		a=$(($a + 3)); done | sort -n | sed 's/.* //')"
+	else
+		local order=3
+	fi
+	for a in $order; do
+		local checksum="$(eval echo \${$a})"
+		local siz="$(eval echo \${$(( $a+1 ))})"
+		local typ="$(eval echo \${$(( $a+2 ))})"
+		local from
+		local dest
+		local iters=0
+
+		case "$typ" in
+		    xz)  from="$1.xz"; dest="$2.xz" ;;
+		    bz2) from="$1.bz2"; dest="$2.bz2" ;;
+		    gz)  from="$1.gz"; dest="$2.gz" ;;
+		    *)   from="$1"; dest="$2" ;;
+		esac
+
+		if [ "${dest#/}" = "$dest" ]; then
+			dest="./$dest"
+		fi
+		local dest2="$dest"
+		if [ -d "${dest2%/*}/partial" ]; then
+			dest2="${dest2%/*}/partial/${dest2##*/}"
+		fi
+
+		while [ "$iters" -lt 10 ]; do
+			info RETRIEVING "Retrieving %s %s" "$displayname" "$versionname"
+			if ! just_get "$from" "$dest2"; then continue 2; fi
+			if [ "$checksum" != "" ]; then
+				info VALIDATING "Validating %s %s" "$displayname" "$versionname"
+				if verify_checksum "$dest2" "$checksum" "$siz"; then
+					checksum=""
+				fi
+			fi
+			if [ -z "$checksum" ]; then
+				[ "$dest2" = "$dest" ] || mv "$dest2" "$dest"
+				case "$typ" in
+				    gz)  gunzip "$dest" ;;
+				    bz2) bunzip2 "$dest" ;;
+				    xz)  unxz "$dest" ;;
+				esac
+				return 0
+			else
+				rm -f "$dest2"
+				warning RETRYING "Retrying failed download of %s" "$from"
+				iters="$(($iters + 1))"
+			fi
+		done
+		warning CORRUPTFILE "%s was corrupt" "$from"
+	done
+	return 1
+}
+
+just_get () {
+	# args: from dest
+	local from="$1"
+	local dest="$2"
+	mkdir -p "${dest%/*}"
+	if [ "${from#null:}" != "$from" ]; then
+		error 1 NOTPREDL "%s was not pre-downloaded" "${from#null:}"
+	elif [ "${from#http://}" != "$from" ] || [ "${from#ftp://}" != "$from" ]; then
+		# http/ftp mirror
+		if wgetprogress -O "$dest" "$from"; then
+			return 0
+		else
+			rm -f "$dest"
+			return 1
+		fi
+	elif [ "${from#https://}" != "$from" ] ; then
+		# http/ftp mirror
+		if wgetprogress $CHECKCERTIF $CERTIFICATE $PRIVATEKEY -O "$dest" "$from"; then
+			return 0
+		else
+			rm -f "$dest"
+			return 1
+		fi
+	elif [ "${from#file:}" != "$from" ]; then
+		local base="${from#file:}"
+		if [ "${base#//}" != "$base" ]; then
+			base="/${from#file://*/}"
+		fi
+		if [ -e "$base" ]; then
+			cp "$base" "$dest"
+			return 0
+		else
+			return 1
+		fi
+	elif [ "${from#ssh:}" != "$from" ]; then
+		local ssh_dest="$(echo $from | sed -e 's#ssh://##' -e 's#/#:/#')"
+		if [ -n "$ssh_dest" ]; then
+			scp "$ssh_dest" "$dest"
+			return 0
+		else
+			return 1
+		fi
+	else
+		error 1 UNKNOWNLOC "unknown location %s" "$from"
+	fi
+}
+
+download () {
+	mk_download_dirs
+	"$DOWNLOAD_DEBS" $(echo "$@" | tr ' ' '\n' | sort)
+}
+
+download_indices () {
+	mk_download_dirs
+	"$DOWNLOAD_INDICES" $(echo "$@" | tr ' ' '\n' | sort)
+}
+
+debfor () {
+	(while read pkg path; do
+		for p in "$@"; do
+			[ "$p" = "$pkg" ] || continue;
+			echo "$path"
+		done
+	 done <"$TARGET/debootstrap/debpaths"
+	)
+}
+
+apt_dest () {
+	# args:
+	#   deb package version arch mirror path
+	#   pkg suite component arch mirror path
+	#   rel suite mirror path
+	case "$1" in
+	    deb)
+		echo "/var/cache/apt/archives/${2}_${3}_${4}.deb" | sed 's/:/%3a/'
+		;;
+	    pkg)
+		local m="$5"
+		m="debootstrap.invalid"
+		#if [ "${m#http://}" != "$m" ]; then
+		#	m="${m#http://}"
+		#elif [ "${m#file://}" != "$m" ]; then
+		#	m="file_localhost_${m#file://*/}"
+		#elif [ "${m#file:/}" != "$m" ]; then
+		#	m="file_localhost_${m#file:/}"
+		#fi
+
+		printf "%s" "$APTSTATE/lists/"
+		echo "${m}_$6" | sed 's/\//_/g'
+		;;
+	    rel)
+		local m="$3"
+		m="debootstrap.invalid"
+		#if [ "${m#http://}" != "$m" ]; then
+		#	m="${m#http://}"
+		#elif [ "${m#file://}" != "$m" ]; then
+		#	m="file_localhost_${m#file://*/}"
+		#elif [ "${m#file:/}" != "$m" ]; then
+		#	m="file_localhost_${m#file:/}"
+		#fi
+		printf "%s" "$APTSTATE/lists/"
+		echo "${m}_$4" | sed 's/\//_/g'
+		;;
+	esac
+}
+
+################################################################## download
+
+get_release_checksum () {
+	local reldest="$1"
+	local path="$2"
+	if [ "$DEBOOTSTRAP_CHECKSUM_FIELD" = MD5SUM ]; then
+		local match="^[Mm][Dd]5[Ss][Uu][Mm]"
+	else
+		local match="^[Ss][Hh][Aa]$SHA_SIZE:"
+	fi
+	sed -n "/$match/,/^[^ ]/p" < "$reldest" | \
+		while read a b c; do
+			if [ "$c" = "$path" ]; then echo "$a $b"; fi
+		done | head -n 1
+}
+
+extract_release_components () {
+	local reldest="$1"; shift
+	TMPCOMPONENTS="$(sed -n 's/Components: *//p' "$reldest")"
+	for c in $TMPCOMPONENTS ; do
+		eval "
+		case \"\$c\" in
+		    $USE_COMPONENTS)
+			COMPONENTS=\"\$COMPONENTS \$c\"
+			;;
+		esac
+		"
+	done
+	COMPONENTS="$(echo $COMPONENTS)"
+	if [ -z "$COMPONENTS" ]; then
+		mv "$reldest" "$reldest.malformed"
+		error 1 INVALIDREL "Invalid Release file, no valid components"
+	fi
+}
+
+CODENAME=""
+validate_suite () {
+	local reldest="$1"
+
+	CODENAME=$(sed -n "s/^Codename: *//p" "$reldest")
+	local suite=$(sed -n "s/^Suite: *//p" "$reldest")
+
+	if [ "$SUITE" != "$suite" ] && [ "$SUITE" != "$CODENAME" ]; then
+		error 1 WRONGSUITE "Asked to install suite %s, but got %s (codename: %s) from mirror" "$SUITE" "$suite" "$CODENAME"
+	fi
+}
+
+split_inline_sig () {
+	local inreldest="$1"
+	local reldest="$2"
+	local relsigdest="$3"
+
+	# Note: InRelease files are fun since one needs to remove the
+	# last newline from the PGP SIGNED MESSAGE part, while keeping
+	# the PGP SIGNATURE part intact. This shell implementation
+	# should work on most if not all systems, instead of trying to
+	# sed/tr/head, etc.
+	rm -f "$reldest" "$relsigdest"
+	nl=""
+	state=pre-begin
+	while IFS= read -r line; do
+		case "${state}" in
+		    pre-begin)
+			if [ "x${line}" = "x-----BEGIN PGP SIGNED MESSAGE-----" ]; then
+				state=begin
+			fi
+			;;
+		    begin)
+			if [ "x${line}" = "x" ]; then
+				state=data
+			fi
+			;;
+		    data)
+			if [ "x${line}" = "x-----BEGIN PGP SIGNATURE-----" ]; then
+				printf "%s\n" "${line}" > "$relsigdest"
+				state=signature
+			else
+				printf "${nl}%s" "${line}" >> "$reldest"
+				nl="\n"
+			fi
+			;;
+		    signature)
+			printf "%s\n" "${line}" >> "$relsigdest"
+			if [ "x${line}" = "x-----END PGP SIGNATURE-----" ]; then
+				break
+			fi
+		esac
+	done < "$inreldest"
+}
+
+download_release_sig () {
+	local m1="$1"
+	local inreldest="$2"
+	local reldest="$3"
+	local relsigdest="$4"
+
+	progress 0 100 DOWNREL "Downloading Release file"
+	progress_next 100
+	if get "$m1/dists/$SUITE/InRelease" "$inreldest" nocache; then
+		split_inline_sig "$inreldest" "$reldest" "$relsigdest"
+		progress 100 100 DOWNREL "Downloading Release file"
+	else
+		get "$m1/dists/$SUITE/Release" "$reldest" nocache ||
+			error 1 NOGETREL "Failed getting release file %s" "$m1/dists/$SUITE/Release"
+		progress 100 100 DOWNREL "Downloading Release file"
+	fi
+	if [ -n "$KEYRING" ] && [ -z "$DISABLE_KEYRING" ]; then
+		progress 0 100 DOWNRELSIG "Downloading Release file signature"
+		if ! [ -f "$relsigdest" ]; then
+			progress_next 50
+			get "$m1/dists/$SUITE/Release.gpg" "$relsigdest" nocache ||
+				error 1 NOGETRELSIG "Failed getting release signature file %s" \
+				"$m1/dists/$SUITE/Release.gpg"
+			progress 50 100 DOWNRELSIG "Downloading Release file signature"
+		fi
+
+		info RELEASESIG "Checking Release signature"
+		# Don't worry about the exit status from gpgv; parsing the output will
+		# take care of that.
+		(gpgv --status-fd 1 --keyring "$KEYRING" --ignore-time-conflict \
+		 "$relsigdest" "$reldest" || true) | read_gpg_status
+		progress 100 100 DOWNRELSIG "Downloading Release file signature"
+	fi
+}
+
+download_release_indices () {
+	local m1="${MIRRORS%% *}"
+	local inreldest="$TARGET/$($DLDEST rel "$SUITE" "$m1" "dists/$SUITE/InRelease")"
+	local reldest="$TARGET/$($DLDEST rel "$SUITE" "$m1" "dists/$SUITE/Release")"
+	local relsigdest="$TARGET/$($DLDEST rel "$SUITE" "$m1" "dists/$SUITE/Release.gpg")"
+
+	download_release_sig "$m1" "$inreldest" "$reldest" "$relsigdest"
+
+	validate_suite "$reldest"
+
+	extract_release_components $reldest
+
+	local totalpkgs=0
+	for c in $COMPONENTS; do
+		local subpath="$c/binary-$ARCH/Packages"
+		local xzi="`get_release_checksum "$reldest" "$subpath.xz"`"
+		local bz2i="`get_release_checksum "$reldest" "$subpath.bz2"`"
+		local gzi="`get_release_checksum "$reldest" "$subpath.gz"`"
+		local normi="`get_release_checksum "$reldest" "$subpath"`"
+		local i=
+		if [ "$normi" != "" ]; then
+			i="$normi"
+		elif in_path bunzip2 && [ "$bz2i" != "" ]; then
+			i="$bz2i"
+		elif in_path unxz && [ "$xzi" != "" ]; then
+			i="$xzi"
+		elif in_path gunzip && [ "$gzi" != "" ]; then
+			i="$gzi"
+		fi
+		if [ "$i" != "" ]; then
+			totalpkgs="$(( $totalpkgs + ${i#* } ))"
+		else
+			mv "$reldest" "$reldest.malformed"
+			error 1 MISSINGRELENTRY "Invalid Release file, no entry for %s" "$subpath"
+		fi
+	done
+
+	local donepkgs=0
+	local pkgdest
+	progress 0 $totalpkgs DOWNPKGS "Downloading Packages files"
+	for c in $COMPONENTS; do
+		local subpath="$c/binary-$ARCH/Packages"
+		local path="dists/$SUITE/$subpath"
+		local xzi="`get_release_checksum "$reldest" "$subpath.xz"`"
+		local bz2i="`get_release_checksum "$reldest" "$subpath.bz2"`"
+		local gzi="`get_release_checksum "$reldest" "$subpath.gz"`"
+		local normi="`get_release_checksum "$reldest" "$subpath"`"
+		local ext=
+		local i=
+		if [ "$normi" != "" ]; then
+			ext="$ext $normi ."
+			i="$normi"
+		fi
+		if in_path unxz && [ "$xzi" != "" ]; then
+			ext="$ext $xzi xz"
+			i="${i:-$xzi}"
+		fi
+		if in_path bunzip2 && [ "$bz2i" != "" ]; then
+			ext="$ext $bz2i bz2"
+			i="${i:-$bz2i}"
+		fi
+		if in_path gunzip && [ "$gzi" != "" ]; then
+			ext="$ext $gzi gz"
+			i="${i:-$gzi}"
+		fi
+		progress_next "$(($donepkgs + ${i#* }))"
+		for m in $MIRRORS; do
+			pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m" "$path")"
+			if get "$m/$path" "$pkgdest" $ext; then break; fi
+		done
+		if [ ! -f "$pkgdest" ]; then
+			error 1 COULDNTDL "Couldn't download %s" "$path"
+		fi
+		donepkgs="$(($donepkgs + ${i#* }))"
+		progress $donepkgs $totalpkgs DOWNPKGS "Downloading Packages files"
+	done
+}
+
+get_package_sizes () {
+	# mirror pkgdest debs..
+	local m="$1"; shift
+	local pkgdest="$1"; shift
+	$PKGDETAILS PKGS "$m" "$pkgdest" "$@" | (
+		newleft=""
+		totaldebs=0
+		countdebs=0
+		while read p details; do
+			if [ "$details" = "-" ]; then
+				newleft="$newleft $p"
+			else
+				size="${details##* }";
+				totaldebs="$(($totaldebs + $size))"
+				countdebs="$(($countdebs + 1))"
+			fi
+		done
+		echo "$countdebs $totaldebs$newleft"
+	)
+}
+
+# note, leftovers come back on fd5 !!
+download_debs () {
+	local m="$1"
+	local pkgdest="$2"
+	shift; shift
+
+	$PKGDETAILS PKGS "$m" "$pkgdest" "$@" | (
+		leftover=""
+		while read p ver arc mdup fil checksum size; do
+			if [ "$ver" = "-" ]; then
+				leftover="$leftover $p"
+			else
+				progress_next "$(($dloaddebs + $size))"
+				local debdest="$($DLDEST deb "$p" "$ver" "$arc" "$m" "$fil")"
+				if get "$m/$fil" "$TARGET/$debdest" "$checksum" "$size"; then
+					dloaddebs="$(($dloaddebs + $size))"
+					echo >>$TARGET/debootstrap/deburis "$p $ver $m/$fil"
+					echo >>$TARGET/debootstrap/debpaths "$p $debdest"
+				else
+					warning COULDNTDL "Couldn't download package %s (ver %s arch %s)" "$p" "$ver" "$arc"
+					leftover="$leftover $p"
+				fi
+			fi
+		done
+		echo >&5 ${leftover# }
+	)
+}
+
+download_release () {
+	local m1="${MIRRORS%% *}"
+
+	local numdebs="$#"
+
+	local countdebs=0
+	progress $countdebs $numdebs SIZEDEBS "Finding package sizes"
+
+	local totaldebs=0
+	local leftoverdebs="$*"
+
+	# Fix possible duplicate package names, which would screw up counts:
+	leftoverdebs=$(printf "$leftoverdebs"|tr ' ' '\n'|sort -u|tr '\n' ' ')
+	numdebs=$(printf "$leftoverdebs"|wc -w)
+
+	for c in $COMPONENTS; do
+		if [ "$countdebs" -ge "$numdebs" ]; then break; fi
+
+		local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+		local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m1" "$path")"
+		if [ ! -e "$pkgdest" ]; then continue; fi
+
+		info CHECKINGSIZES "Checking component %s on %s..." "$c" "$m1"
+
+		leftoverdebs="$(get_package_sizes "$m1" "$pkgdest" $leftoverdebs)"
+
+		countdebs=$(($countdebs + ${leftoverdebs%% *}))
+		leftoverdebs=${leftoverdebs#* }
+
+		totaldebs=${leftoverdebs%% *}
+		leftoverdebs=${leftoverdebs#* }
+
+		progress $countdebs $numdebs SIZEDEBS "Finding package sizes"
+	done
+
+	if [ "$countdebs" -ne "$numdebs" ]; then
+		error 1 LEFTOVERDEBS "Couldn't find these debs: %s" "$leftoverdebs"
+	fi
+
+	local dloaddebs=0
+
+	progress $dloaddebs $totaldebs DOWNDEBS "Downloading packages"
+	:>$TARGET/debootstrap/debpaths
+
+	pkgs_to_get="$*"
+	for c in $COMPONENTS; do
+	    local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+	    for m in $MIRRORS; do
+		local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m" "$path")"
+		if [ ! -e "$pkgdest" ]; then continue; fi
+		pkgs_to_get="$(download_debs "$m" "$pkgdest" $pkgs_to_get 5>&1 1>&6)"
+		if [ -z "$pkgs_to_get" ]; then break; fi
+	    done 6>&1
+	    if [ -z "$pkgs_to_get" ]; then break; fi
+	done
+	progress $dloaddebs $totaldebs DOWNDEBS "Downloading packages"
+	if [ "$pkgs_to_get" != "" ]; then
+		error 1 COULDNTDLPKGS "Couldn't download packages: %s" "$pkgs_to_get"
+	fi
+}
+
+download_main_indices () {
+	local m1="${MIRRORS%% *}"
+	local comp="${USE_COMPONENTS}"
+	progress 0 100 DOWNMAINPKGS "Downloading Packages file"
+	progress_next 100
+
+	if [ -z "$comp" ]; then comp=main; fi
+	COMPONENTS="$(echo $comp | tr '|' ' ')"
+
+	export COMPONENTS
+	for m in $MIRRORS; do
+	    for c in $COMPONENTS; do
+		local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+		local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m" "$path")"
+		if in_path gunzip && get "$m/${path}.gz" "${pkgdest}.gz"; then
+			rm -f "$pkgdest"
+			gunzip "$pkgdest.gz"
+		elif get "$m/$path" "$pkgdest"; then
+			true
+		fi
+	    done
+	done
+	progress 100 100 DOWNMAINPKGS "Downloading Packages file"
+}
+
+download_main () {
+	local m1="${MIRRORS%% *}"
+
+	:>$TARGET/debootstrap/debpaths
+	for p in "$@"; do
+	    for c in $COMPONENTS; do
+		local details=""
+		for m in $MIRRORS; do
+			local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+			local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m" "$path")"
+			if [ ! -e "$pkgdest" ]; then continue; fi
+			details="$($PKGDETAILS PKGS "$m" "$pkgdest" "$p")"
+			if [ "$details" = "$p -" ]; then
+				details=""
+				continue
+			fi
+			size="${details##* }"; details="${details% *}"
+			checksum="${details##* }"; details="${details% *}"
+			local debdest="$($DLDEST deb $details)"
+			if get "$m/${details##* }" "$TARGET/$debdest" "$checksum" "$size"; then
+				echo >>$TARGET/debootstrap/debpaths "$p $debdest"
+				details="done"
+				break
+			fi
+		done
+		if [ "$details" != "" ]; then
+			break
+		fi
+	    done
+	    if [ "$details" != "done" ]; then
+		error 1 COULDNTDL "Couldn't download %s" "$p"
+	    fi
+	done
+}
+
+###################################################### deb choosing support
+
+get_debs () {
+	local field="$1"
+	shift
+	local m1 c
+	for m1 in $MIRRORS; do
+		for c in $COMPONENTS; do
+			local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+			local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m1" "$path")"
+			echo $("$PKGDETAILS" FIELD "$field" "$m1" "$pkgdest" "$@" | sed 's/ .*//')
+		done
+	done
+}
+
+################################################################ extraction
+
+EXTRACTORS_SUPPORTED="dpkg-deb ar"
+EXTRACT_DEB_TAR_OPTIONS=
+
+# Native dpkg-deb based extractors
+extract_dpkg_deb_field () {
+	local pkg="$1"
+	local field="$2"
+
+	dpkg-deb -f "$pkg" "$field"
+}
+
+extract_dpkg_deb_data () {
+	local pkg="$1"
+
+	dpkg-deb --fsys-tarfile "$pkg" | tar $EXTRACT_DEB_TAR_OPTIONS -xf -
+}
+
+# Raw .deb extractors
+extract_ar_deb_field () {
+	local pkg="$1"
+	local field="$2"
+	local tarball=$(ar -t "$pkg" | grep "^control\.tar")
+
+	case "$tarball" in
+		control.tar.gz) cat_cmd=zcat ;;
+		control.tar.xz) cat_cmd=xzcat ;;
+		control.tar) cat_cmd=cat ;;
+		*) error 1 UNKNOWNCONTROLCOMP "Unknown compression type for %s in %s" "$tarball" "$pkg" ;;
+	esac
+
+	if type $cat_cmd >/dev/null 2>&1; then
+		ar -p "$pkg" "$tarball" | $cat_cmd |
+		    tar -O -xf - control ./control 2>/dev/null |
+		    grep -i "^$field:" | sed -e 's/[^:]*: *//' | head -n 1
+	else
+		error 1 UNPACKCMDUNVL "Extracting %s requires the %s command, which is not available" "$pkg" "$cat_cmd"
+	fi
+}
+
+extract_ar_deb_data () {
+	local pkg="$1"
+	local tarball=$(ar -t "$pkg" | grep "^data.tar")
+
+	case "$tarball" in
+		data.tar.gz) cat_cmd=zcat ;;
+		data.tar.bz2) cat_cmd=bzcat ;;
+		data.tar.xz) cat_cmd=xzcat ;;
+		data.tar) cat_cmd=cat ;;
+		*) error 1 UNKNOWNDATACOMP "Unknown compression type for %s in %s" "$tarball" "$pkg" ;;
+	esac
+
+	if type $cat_cmd >/dev/null 2>&1; then
+		ar -p "$pkg" "$tarball" | $cat_cmd | tar $EXTRACT_DEB_TAR_OPTIONS -xf -
+	else
+		error 1 UNPACKCMDUNVL "Extracting %s requires the %s command, which is not available" "$pkg" "$cat_cmd"
+	fi
+}
+
+valid_extractor () {
+	local extractor="$1"
+
+	for E in $EXTRACTORS_SUPPORTED; do
+		if [ "$extractor" = "$E" ]; then
+			return 0
+		fi
+	done
+
+	return 1
+}
+
+choose_extractor () {
+	local extractor
+
+	if [ -n "$EXTRACTOR_OVERRIDE" ]; then
+		extractor="$EXTRACTOR_OVERRIDE"
+	elif type dpkg-deb >/dev/null 2>&1; then
+		extractor="dpkg-deb"
+	else
+		extractor="ar"
+	fi
+
+	info CHOSENEXTRACTOR "Chosen extractor for .deb packages: %s" "$extractor"
+	case "$extractor" in
+	dpkg-deb)
+		extract_deb_field () { extract_dpkg_deb_field "$@"; }
+		extract_deb_data () { extract_dpkg_deb_data "$@"; }
+		;;
+	ar)
+		extract_deb_field () { extract_ar_deb_field "$@"; }
+		extract_deb_data () { extract_ar_deb_data "$@"; }
+		;;
+	esac
+}
+
+extract () { (
+	cd "$TARGET"
+	local p=0 cat_cmd
+	for pkg in $(debfor "$@"); do
+		p="$(($p + 1))"
+		progress "$p" "$#" EXTRACTPKGS "Extracting packages"
+		packagename="$(echo "$pkg" | sed 's,^.*/,,;s,_.*$,,')"
+		info EXTRACTING "Extracting %s..." "$packagename"
+		extract_deb_data "./$pkg"
+	done
+); }
+
+in_target_nofail () {
+	if ! $CHROOT_CMD "$@" 2>/dev/null; then
+		true
+	fi
+	return 0
+}
+
+in_target_failmsg () {
+	local code="$1"
+	local msg="$2"
+	local arg="$3"
+	shift; shift; shift
+	if ! $CHROOT_CMD "$@"; then
+		warning "$code" "$msg" "$arg"
+		# Try to point user at actual failing package.
+		msg="See %s for details"
+		if [ -e "$TARGET/debootstrap/debootstrap.log" ]; then
+			arg="$TARGET/debootstrap/debootstrap.log"
+			local pkg="$(grep '^dpkg: error processing ' "$TARGET/debootstrap/debootstrap.log" | head -n 1 | sed 's/\(error processing \)\(package \|archive \)/\1/' | cut -d ' ' -f 4)"
+			if [ -n "$pkg" ]; then
+				msg="$msg (possibly the package $pkg is at fault)"
+			fi
+		else
+			arg="the log"
+		fi
+		warning "$code" "$msg" "$arg"
+		return 1
+	fi
+	return 0
+}
+
+in_target () {
+	in_target_failmsg IN_TARGET_FAIL "Failure trying to run: %s" "$CHROOT_CMD $*" "$@"
+}
+
+###################################################### standard setup stuff
+
+conditional_cp () {
+	if [ ! -e "$2/$1" ]; then
+		if [ -L "$1" ] && [ -e "$1" ]; then
+			cat "$1" >"$2/$1"
+		elif [ -e "$1" ]; then
+			cp -a "$1" "$2/$1"
+		fi
+	fi
+}
+
+mv_invalid_to () {
+	local m="$1"
+	m="$(echo "${m#http://}" | tr '/' '_' | sed 's/_*//')"
+	(cd "$TARGET/$APTSTATE/lists"
+	 for a in debootstrap.invalid_*; do
+		 mv "$a" "${m}_${a#*_}"
+	 done
+	)
+}
+
+setup_apt_sources () {
+	mkdir -p "$TARGET/etc/apt"
+	# Cope with the foreign case where COMPONENTS would be empty:
+	sources_components="${COMPONENTS:-$USE_COMPONENTS}"
+	for m in "$@"; do
+		local cs=""
+		for c in $sources_components; do
+			local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+			local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m" "$path")"
+			if [ -e "$pkgdest" ]; then cs="$cs $c"; fi
+		done
+		if [ "$cs" != "" ]; then echo "deb $m $SUITE$cs"; fi
+	done > "$TARGET/etc/apt/sources.list"
+}
+
+setup_etc () {
+	mkdir -p "$TARGET/etc"
+
+	conditional_cp /etc/resolv.conf "$TARGET"
+	conditional_cp /etc/hostname "$TARGET"
+
+	if [ "$DLDEST" = apt_dest ] && [ ! -e "$TARGET/etc/apt/sources.list" ]; then
+		setup_apt_sources "http://debootstrap.invalid/"
+	fi
+}
+
+UMOUNT_DIRS=
+
+umount_exit_function () {
+	local realdir
+	for dir in $UMOUNT_DIRS; do
+		realdir="$(in_target_nofail readlink -f "$dir")"
+		[ "$realdir" ] || continue
+		( cd / ; umount "$TARGET/${realdir#/}" ) || true
+	done
+}
+
+umount_on_exit () {
+	if [ "$UMOUNT_DIRS" ]; then
+		UMOUNT_DIRS="$UMOUNT_DIRS $1"
+	else
+		UMOUNT_DIRS="$1"
+		on_exit umount_exit_function
+	fi
+}
+
+clear_mtab () {
+	if [ -f "$TARGET/etc/mtab" ] && [ ! -h "$TARGET/etc/mtab" ]; then
+		rm -f "$TARGET/etc/mtab"
+	fi
+}
+
+setup_proc () {
+	case "$HOST_OS" in
+	    *freebsd*)
+		umount_on_exit /dev
+		umount_on_exit /proc
+		umount "$TARGET/proc" 2>/dev/null || true
+		if [ "$HOST_OS" = kfreebsd ]; then
+			in_target mount -t linprocfs proc /proc
+		else
+			mount -t linprocfs proc $TARGET/proc
+		fi
+		;;
+	    hurd*)
+		# firmlink $TARGET/{dev,servers,proc} to the system ones.
+		settrans -a "$TARGET/dev" /hurd/firmlink /dev
+		settrans -a "$TARGET/servers" /hurd/firmlink /servers
+	        settrans -a "$TARGET/proc" /hurd/firmlink /proc
+		;;
+	    *)
+		umount_on_exit /dev/pts
+		umount_on_exit /dev/shm
+		umount_on_exit /proc/bus/usb
+		umount_on_exit /proc
+		umount "$TARGET/proc" 2>/dev/null || true
+		in_target mount -t proc proc /proc
+		if [ -d "$TARGET/sys" ] && \
+		   grep -q '[[:space:]]sysfs' /proc/filesystems 2>/dev/null; then
+			umount_on_exit /sys
+			umount "$TARGET/sys" 2>/dev/null || true
+			in_target mount -t sysfs sysfs /sys
+		fi
+		on_exit clear_mtab
+		;;
+	esac
+	umount_on_exit /lib/init/rw
+}
+
+setup_proc_fakechroot () {
+	rm -rf "$TARGET/proc"
+	ln -s /proc "$TARGET"
+}
+
+# create the static device nodes
+setup_devices () {
+	if doing_variant fakechroot; then
+		setup_devices_fakechroot
+		return 0
+	fi
+
+	case "$HOST_OS" in
+	    kfreebsd*)
+		;;
+	    freebsd)
+		;;
+	    hurd*)
+		;;
+	    *)
+		setup_devices_simple
+		;;
+	esac
+}
+
+# enable the dynamic device nodes
+setup_dynamic_devices () {
+	if doing_variant fakechroot; then
+		return 0
+	fi
+
+	case "$HOST_OS" in
+	    kfreebsd*)
+		in_target mount -t devfs devfs /dev ;;
+	    freebsd)
+		mount -t devfs devfs $TARGET/dev ;;
+	    hurd*)
+	        # Use the setup-translators of the hurd package
+	        in_target /usr/lib/hurd/setup-translators -k ;;
+	esac
+}
+
+setup_devices_simple () {
+	# The list of devices that can be created in a container comes from
+	# src/core/cgroup.c in the systemd source tree.
+	mknod -m 666 $TARGET/dev/null	c 1 3
+	mknod -m 666 $TARGET/dev/zero	c 1 5
+	mknod -m 666 $TARGET/dev/full	c 1 7
+	mknod -m 666 $TARGET/dev/random	c 1 8
+	mknod -m 666 $TARGET/dev/urandom	c 1 9
+	mknod -m 666 $TARGET/dev/tty	c 5 0
+	mkdir $TARGET/dev/pts/ $TARGET/dev/shm/
+	ln -s pts/ptmx $TARGET/dev/ptmx
+	ln -s /proc/self/fd   $TARGET/dev/fd
+	ln -s /proc/self/fd/0 $TARGET/dev/stdin
+	ln -s /proc/self/fd/1 $TARGET/dev/stdout
+	ln -s /proc/self/fd/2 $TARGET/dev/stderr
+}
+
+setup_devices_fakechroot () {
+	rm -rf "$TARGET/dev"
+	ln -s /dev "$TARGET"
+}
+
+setup_dselect_method () {
+	case "$1" in
+	    apt)
+		mkdir -p "$TARGET/var/lib/dpkg"
+		echo "apt apt" > "$TARGET/var/lib/dpkg/cmethopt"
+		chmod 644 "$TARGET/var/lib/dpkg/cmethopt"
+		;;
+	    *)
+		error 1 UNKNOWNDSELECT "unknown dselect method"
+		;;
+	esac
+}
+
+# Find out where the runtime dynamic linker and the shared libraries
+# can be installed on each architecture: native, multilib and multiarch.
+# This data can be verified by checking the files in the debian/sysdeps/
+# directory of the glibc package.
+#
+# This function must be updated to support any new architecture which
+# either installs the RTLD in a directory different from /lib or builds
+# multilib library packages.
+setup_merged_usr() {
+	if [ "$MERGED_USR" = "no" ]; then return 0; fi
+
+	local link_dir
+	case $ARCH in
+	    hurd-*)	return 0 ;;
+	    amd64)	link_dir="lib32 lib64 libx32" ;;
+	    i386)	link_dir="lib64 libx32" ;;
+	    mips|mipsel)
+			link_dir="lib32 lib64" ;;
+	    mips64*|mipsn32*)
+			link_dir="lib32 lib64 libo32" ;;
+	    powerpc)	link_dir="lib64" ;;
+	    ppc64)	link_dir="lib32 lib64" ;;
+	    ppc64el)	link_dir="lib64" ;;
+	    s390x)	link_dir="lib32" ;;
+	    sparc)	link_dir="lib64" ;;
+	    sparc64)	link_dir="lib32 lib64" ;;
+	    x32)	link_dir="lib32 lib64 libx32" ;;
+	esac
+	link_dir="bin sbin lib $link_dir"
+
+	local dir
+	for dir in $link_dir; do
+		ln -s usr/$dir $TARGET/$dir
+		mkdir -p $TARGET/usr/$dir
+	done
+}
+
+################################################################ pkgdetails
+
+# NOTE
+# For the debootstrap udeb, pkgdetails is provided by the bootstrap-base
+# udeb, so the pkgdetails API needs to be kept in sync with that.
+
+if in_path perl; then
+	PKGDETAILS=pkgdetails_perl
+
+	pkgdetails_field () {
+		# uniq field mirror Packages values...
+		perl -le '
+$unique = shift @ARGV; $field = lc(shift @ARGV); $mirror = shift @ARGV;
+%fields = map { $_, 0 } @ARGV;
+$prevpkg = "";
+while (<STDIN>) {
+	chomp;
+	next if (/^ /);
+	if (/^([^:]*:)\s*(.*)$/) {
+		$f = lc($1); $v = $2;
+		if ($f eq "package:") {
+			$last = 0;
+			$pkg = $v;
+			if ($pkg ne $prevpkg) {
+				print $output if defined $output;
+				if ($unique && defined $output_val) {
+					delete $fields{$output_val};
+					$last = 1 unless keys %fields;
+				}
+				$prevpkg = $pkg;
+			}
+			undef $output;
+			undef $output_val;
+			last if $last;
+		}
+		$ver = $v if ($f eq "version:");
+		$arc = $v if ($f eq "architecture:");
+		$fil = $v if ($f eq "filename:");
+		$chk = $v if (lc $f eq lc($ENV{DEBOOTSTRAP_CHECKSUM_FIELD}).":");
+		$siz = $v if ($f eq "size:");
+		$val = $v if ($f eq $field);
+	} elsif (/^$/) {
+		if (defined $val && defined $fields{$val}) {
+			$output = sprintf "%s %s %s %s %s %s %s",
+			 $pkg, $ver, $arc, $mirror, $fil, $chk, $siz;
+			$output_val = $val;
+		}
+		undef $val;
+	}
+}
+print $output if defined $output;
+delete $fields{$output_val} if $unique && defined $output_val;
+for $v (keys %fields) {
+	printf ("%s -\n", $v) if ($unique);
+}
+' "$@"
+	}
+
+	pkgdetails_perl () {
+		if [ "$1" = "WGET%" ]; then
+			shift;
+			perl -e '
+$v = 0;
+$allow_percentage = 0;
+while (read STDIN, $x, 1) {
+	if ($x =~ m/\s/) {
+		$allow_percentage = 1;
+	} elsif ($allow_percentage and $x =~ m/\d/) {
+		$v *= 10;
+		$v += $x;
+	} elsif ($allow_percentage and $x eq "%") {
+		printf "P: %d %d%s\n", int($v / 100.0 * ($ARGV[1] - $ARGV[0]) + $ARGV[0]), $ARGV[2], ($#ARGV == 3 ? " $ARGV[3]" : "");
+		$v = 0;
+	} else {
+		$v = 0;
+		$allow_percentage = 0;
+	}
+}' "$@"
+		elif [ "$1" = "GETDEPS" ]; then
+			local pkgdest="$2"; shift; shift
+			perl -e '
+$prevpkg = "";
+@d = ();
+my %exclude;
+$exclude{$_} = 1 for split(" ", $ENV{"EXCLUDE"});
+while (<STDIN>) {
+	chomp;
+	if (/^Package: (.*)$/) {
+		$pkg = $1;
+		if ($pkg ne $prevpkg) {
+			for my $d (@d) {
+				print "$d\n";
+			}
+		}
+		$prevpkg = $1;
+		@d = ();
+	}
+	$in = 1 if (grep {$_ eq $pkg} @ARGV);
+	$in = 0 if (/^$/);
+	if ($in and (/^Depends: (.*)$/ or /^Pre-Depends: (.*)$/)) {
+		for $d (split /\s*,\s*/, $1) {
+			for $p (split /\s*\|\s*/, $d) {
+				$p =~ s/\s*[(].*[)]\s*//;
+				if (!$exclude{$p}) {
+					push @d, $p;
+					last;
+				}
+			}
+		}
+	}
+}
+for my $d (@d) {
+	print "$d\n";
+}' <"$pkgdest" "$@" | sort | uniq
+		elif [ "$1" = "PKGS" ]; then
+			local m="$2"
+			local p="$3"
+			shift; shift; shift
+			pkgdetails_field 1 Package: "$m" "$@" < "$p"
+		elif [ "$1" = "FIELD" ]; then
+			local f="$2"
+			local m="$3"
+			local p="$4"
+			shift; shift; shift; shift
+			pkgdetails_field 0 "$f" "$m" "$@" < "$p"
+		elif [ "$1" = "STANZAS" ]; then
+			local pkgdest="$2"; shift; shift
+			perl -e '
+my $accum = "";
+while (<STDIN>) {
+	$accum .= $_;
+	$in = 1 if (/^Package: (.*)$/ && grep {$_ eq $1} @ARGV);
+	if ($in and /^$/) {
+		print $accum;
+		if (substr($accum, -1) != "\n") {
+			print "\n\n";
+		} elsif (substr($accum, -2, 1) != "\n") {
+			print "\n";
+		}
+		$in = 0;
+	}
+	$accum = "" if /^$/;
+}' <"$pkgdest" "$@"
+		fi
+	}
+elif [ -e "/usr/lib/debootstrap/pkgdetails" ]; then
+	PKGDETAILS="/usr/lib/debootstrap/pkgdetails"
+elif [ -e "$DEBOOTSTRAP_DIR/pkgdetails" ]; then
+	PKGDETAILS="$DEBOOTSTRAP_DIR/pkgdetails"
+else
+	PKGDETAILS=""
+fi
+
+##################################################### dependency resolution
+
+resolve_deps () {
+	local m1="${MIRRORS%% *}"
+
+	local PKGS="$*"
+	local ALLPKGS="$PKGS";
+	local ALLPKGS2="";
+	while [ "$PKGS" != "" ]; do
+		local NEWPKGS=""
+		for c in ${COMPONENTS:-$USE_COMPONENTS}; do
+			local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+			local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m1" "$path")"
+			NEWPKGS="$NEWPKGS $("$PKGDETAILS" GETDEPS "$pkgdest" $PKGS)"
+		done
+		PKGS=$(echo "$PKGS $NEWPKGS" | tr ' ' '\n' | sort | uniq)
+		local REALPKGS=""
+		for c in ${COMPONENTS:-$USE_COMPONENTS}; do
+			local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+			local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m1" "$path")"
+			REALPKGS="$REALPKGS $("$PKGDETAILS" PKGS REAL "$pkgdest" $PKGS | sed -n 's/ .*REAL.*$//p')"
+		done
+		PKGS="$REALPKGS"
+		ALLPKGS2=$(echo "$PKGS $ALLPKGS" | tr ' ' '\n' | sort | uniq)
+		PKGS=$(without "$ALLPKGS2" "$ALLPKGS")
+		ALLPKGS="$ALLPKGS2"
+	done
+	echo $ALLPKGS
+}
+
+setup_available () {
+	local m1="${MIRRORS%% *}"
+
+	for c in ${COMPONENTS:-$USE_COMPONENTS}; do
+		local path="dists/$SUITE/$c/binary-$ARCH/Packages"
+		local pkgdest="$TARGET/$($DLDEST pkg "$SUITE" "$c" "$ARCH" "$m1" "$path")"
+		# XXX: What if a package is in more than one component?
+		# -- cjwatson 2009-07-29
+		"$PKGDETAILS" STANZAS "$pkgdest" "$@"
+	done >"$TARGET/var/lib/dpkg/available"
+
+	for pkg; do
+		echo "$pkg install"
+	done | in_target dpkg --set-selections
+}
+
+get_next_predep () {
+	local stanza="$(in_target_nofail dpkg --predep-package)"
+	[ "$stanza" ] || return 1
+	echo "$stanza" | grep '^Package:' | sed 's/^Package://; s/^ *//'
+}
+
+################################################################### helpers
+
+# Return zero if it is possible to create devices and execute programs in
+# this directory. (Both may be forbidden by mount options, e.g. nodev and
+# noexec respectively.)
+check_sane_mount () {
+	mkdir -p "$1"
+
+	case "$HOST_OS" in
+	    *freebsd*|hurd*)
+		;;
+	    *)
+		mknod "$1/test-dev-null" c 1 3 || return 1
+		if ! echo test > "$1/test-dev-null"; then
+			rm -f "$1/test-dev-null"
+			return 1
+		fi
+		rm -f "$1/test-dev-null"
+		;;
+	esac
+
+	SH=/bin/sh
+	[ -x $SH ] || SH=`which sh`
+
+	cat > "$1/test-exec" <<EOF
+#! $SH
+:
+EOF
+	chmod +x "$1/test-exec"
+	if ! "$1/test-exec"; then
+		rm -f "$1/test-exec"
+		return 1
+	fi
+	rm -f "$1/test-exec"
+
+	return 0
+}
+
+read_gpg_status () {
+	badsig=
+	unkkey=
+	validsig=
+	while read prefix keyword keyid rest; do
+		[ "$prefix" = '[GNUPG:]' ] || continue
+		case $keyword in
+		    BADSIG)	badsig="$keyid" ;;
+		    NO_PUBKEY)	unkkey="$keyid" ;;
+		    VALIDSIG)	validsig="$keyid" ;;
+		esac
+	done
+	if [ "$validsig" ]; then
+		info VALIDRELSIG "Valid Release signature (key id %s)" "$validsig"
+	elif [ "$badsig" ]; then
+		error 1 BADRELSIG "Invalid Release signature (key id %s)" "$badsig"
+	elif [ "$unkkey" ]; then
+		error 1 UNKNOWNRELSIG "Release signed by unknown key (key id %s)" "$unkkey"
+	else
+		error 1 SIGCHECK "Error executing gpgv to check Release signature"
+	fi
+}
+
+without () {
+	# usage:  without "a b c" "a d" -> "b" "c"
+	(echo $1 | tr ' ' '\n' | sort | uniq;
+	 echo $2 $2 | tr ' ' '\n') | sort | uniq -u | tr '\n' ' '
+	echo
+}
+
+# Formerly called 'repeat', but that's a reserved word in zsh.
+repeatn () {
+	local n="$1"
+	shift
+	while [ "$n" -gt 0 ]; do
+		if "$@"; then
+			break
+		else
+			n="$(( $n - 1 ))"
+			sleep 1
+		fi
+	done
+	if [ "$n" -eq 0 ]; then return 1; fi
+	return 0
+}
+
+N_EXIT_THINGS=0
+exit_function () {
+	local n=0
+	while [ "$n" -lt "$N_EXIT_THINGS" ]; do
+		(eval $(eval echo \${EXIT_THING_$n}) 2>/dev/null || true)
+		n="$(( $n + 1 ))"
+	done
+	N_EXIT_THINGS=0
+}
+
+trap "exit_function" 0
+trap "exit 129" 1
+trap "error 130 INTERRUPTED \"Interrupt caught ... exiting\"" 2
+trap "exit 131" 3
+trap "exit 143" 15
+
+on_exit () {
+	eval `echo EXIT_THING_${N_EXIT_THINGS}=\"$1\"`
+	N_EXIT_THINGS="$(( $N_EXIT_THINGS + 1 ))"
+}
+
+############################################################## fakechroot tools
+
+install_fakechroot_tools () {
+	if [ "$VARIANT" = "fakechroot" ]; then
+		export PATH=/usr/sbin:/sbin:$PATH
+	fi
+
+	mv "$TARGET/sbin/ldconfig" "$TARGET/sbin/ldconfig.REAL"
+	echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake ldconfig called, doing nothing\"" > "$TARGET/sbin/ldconfig"
+	chmod 755 "$TARGET/sbin/ldconfig"
+
+	echo \
+"/sbin/ldconfig
+/sbin/ldconfig.REAL
+fakechroot" >> "$TARGET/var/lib/dpkg/diversions"
+
+	mv "$TARGET/usr/bin/ldd" "$TARGET/usr/bin/ldd.REAL"
+	cat << 'END' > "$TARGET/usr/bin/ldd"
+#!/usr/bin/perl
+
+# fakeldd
+#
+# Replacement for ldd with usage of objdump
+#
+# (c) 2003-2005 Piotr Roszatycki <dexter@debian.org>, BSD
+
+
+my %libs = ();
+
+my $status = 0;
+my $dynamic = 0;
+my $biarch = 0;
+
+my $ldlinuxsodir = "/lib";
+my @ld_library_path = qw(/usr/lib /lib);
+
+
+sub ldso($) {
+	my ($lib) = @_;
+	my @files = ();
+
+	if ($lib =~ /^\//) {
+	    $libs{$lib} = $lib;
+	    push @files, $lib;
+	} else {
+	    foreach my $ld_path (@ld_library_path) {
+		next unless -f "$ld_path/$lib";
+		my $badformat = 0;
+		open OBJDUMP, "objdump -p $ld_path/$lib 2>/dev/null |";
+	 	while (my $line = <OBJDUMP>) {
+		    if ($line =~ /file format (\S*)$/) {
+				$badformat = 1 unless $format eq $1;
+				last;
+		    }
+		}
+		close OBJDUMP;
+		next if $badformat;
+		$libs{$lib} = "$ld_path/$lib";
+		push @files, "$ld_path/$lib";
+	    }
+	    objdump(@files);
+	}
+}
+
+
+sub objdump(@) {
+	my (@files) = @_;
+	my @libs = ();
+
+	foreach my $file (@files) {
+	    open OBJDUMP, "objdump -p $file 2>/dev/null |";
+	    while (my $line = <OBJDUMP>) {
+		$line =~ s/^\s+//;
+		my @f = split (/\s+/, $line);
+		if ($line =~ /file format (\S*)$/) {
+		    if (not $format) {
+			$format = $1;
+			if ($unamearch eq "x86_64" and $format eq "elf32-i386") {
+			    my $link = readlink "/lib/ld-linux.so.2";
+			    if ($link =~ /^\/emul\/ia32-linux\//) {
+				$ld_library_path[-2] = "/emul/ia32-linux/usr/lib";
+				$ld_library_path[-1] = "/emul/ia32-linux/lib";
+			    }
+			} elsif ($unamearch =~ /^(sparc|sparc64)$/ and $format eq "elf64-sparc") {
+			    $ldlinuxsodir = "/lib64";
+			    $ld_library_path[-2] = "/usr/lib64";
+			    $ld_library_path[-1] = "/lib64";
+			}
+		    } else {
+			next unless $format eq $1;
+		    }
+		}
+		if (not $dynamic and $f[0] eq "Dynamic") {
+		    $dynamic = 1;
+		}
+		next unless $f[0] eq "NEEDED";
+		if ($f[1] =~ /^ld-linux(\.|-)/) {
+		    $f[1] = "$ldlinuxsodir/" . $f[1];
+		}
+		if (not defined $libs{$f[1]}) {
+		    $libs{$f[1]} = undef;
+		    push @libs, $f[1];
+		}
+	    }
+	    close OBJDUMP;
+	}
+
+	foreach my $lib (@libs) {
+	    ldso($lib);
+	}
+}
+
+
+if ($#ARGV < 0) {
+	print STDERR "fakeldd: missing file arguments\n";
+	exit 1;
+}
+
+while ($ARGV[0] =~ /^-/) {
+	my $arg = $ARGV[0];
+	shift @ARGV;
+	last if $arg eq "--";
+}
+
+open LD_SO_CONF, "/etc/ld.so.conf";
+while ($line = <LD_SO_CONF>) {
+	chomp $line;
+	unshift @ld_library_path, $line;
+}
+close LD_SO_CONF;
+
+unshift @ld_library_path, split(/:/, $ENV{LD_LIBRARY_PATH});
+
+$unamearch = `/bin/uname -m`;
+chomp $unamearch;
+
+foreach my $file (@ARGV) {
+	my $address;
+	%libs = ();
+	$dynamic = 0;
+
+	if ($#ARGV > 0) {
+		print "$file:\n";
+	}
+
+	if (not -f $file) {
+		print STDERR "ldd: $file: No such file or directory\n";
+		$status = 1;
+		next;
+	}
+
+	objdump($file);
+
+	if ($dynamic == 0) {
+		print "\tnot a dynamic executable\n";
+		$status = 1;
+	} elsif (scalar %libs eq "0") {
+		print "\tstatically linked\n";
+	}
+
+	if ($format =~ /^elf64-/) {
+		$address = "0x0000000000000000";
+	} else {
+		$address = "0x00000000";
+	}
+
+	foreach $lib (keys %libs) {
+		if ($libs{$lib}) {
+			printf "\t%s => %s (%s)\n", $lib, $libs{$lib}, $address;
+		} else {
+			printf "\t%s => not found\n", $lib;
+		}
+	}
+}
+
+exit $status;
+END
+	chmod 755 "$TARGET/usr/bin/ldd"
+
+	echo \
+"/usr/bin/ldd
+/usr/bin/ldd.REAL
+fakechroot" >> "$TARGET/var/lib/dpkg/diversions"
+
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/aequorea b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/aequorea
new file mode 100644
index 00000000..1ae17d86
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/aequorea
@@ -0,0 +1,202 @@
+mirror_style release
+download_style apt
+finddebs_style from-indices
+variants - buildd fakechroot minbase
+keyring /usr/share/keyrings/tanglu-archive-keyring.gpg
+default_mirror http://archive.tanglu.org/tanglu
+
+if doing_variant fakechroot; then
+	test "$FAKECHROOT" = "true" || error 1 FAKECHROOTREQ "This variant requires fakechroot environment to be started"
+fi
+
+case $ARCH in
+	alpha|ia64) LIBC="libc6.1" ;;
+	kfreebsd-*) LIBC="libc0.1" ;;
+	hurd-*)     LIBC="libc0.3" ;;
+	*)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+	required="$(get_debs Priority: required)"
+
+	if doing_variant - || doing_variant fakechroot; then
+		#required="$required $(get_debs Priority: important)"
+		#  ^^ should be getting debconf here somehow maybe
+		base="$(get_debs Priority: important)"
+
+		# we want the Tanglu minimal dependency set to be installed
+		base="$base tanglu-minimal"
+	elif doing_variant buildd; then
+		base="apt build-essential"
+	elif doing_variant minbase; then
+		base="apt"
+	fi
+
+	if doing_variant fakechroot; then
+		# ldd.fake needs binutils
+		required="$required binutils"
+	fi
+
+	case $MIRRORS in
+	    https://*)
+		base="$base apt-transport-https ca-certificates"
+		;;
+	esac
+}
+
+first_stage_install () {
+	extract $required
+
+	mkdir -p "$TARGET/var/lib/dpkg"
+	: >"$TARGET/var/lib/dpkg/status"
+	: >"$TARGET/var/lib/dpkg/available"
+
+	setup_etc
+	if [ ! -e "$TARGET/etc/fstab" ]; then
+		echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+		chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+	fi
+
+	setup_devices
+
+	x_feign_install () {
+		local pkg="$1"
+		local deb="$(debfor $pkg)"
+		local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+		mkdir -p "$TARGET/var/lib/dpkg/info"
+
+		echo \
+"Package: $pkg
+Version: $ver
+Maintainer: unknown
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+		touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+	}
+
+	x_feign_install dpkg
+}
+
+second_stage_install () {
+	setup_dynamic_devices
+
+	x_core_install () {
+		smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+	}
+
+	p () {
+		baseprog="$(($baseprog + ${1:-1}))"
+	}
+
+	if doing_variant fakechroot; then
+		setup_proc_fakechroot
+	else
+		setup_proc
+		in_target /sbin/ldconfig
+	fi
+
+	DEBIAN_FRONTEND=noninteractive
+	DEBCONF_NONINTERACTIVE_SEEN=true
+	export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+	baseprog=0
+	bases=7
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+	info INSTCORE "Installing core packages..."
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+	ln -sf mawk "$TARGET/usr/bin/awk"
+	x_core_install base-passwd
+	x_core_install base-files
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+	x_core_install dpkg
+
+	if [ ! -e "$TARGET/etc/localtime" ]; then
+		ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+	fi
+
+	if doing_variant fakechroot; then
+		install_fakechroot_tools
+	fi
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+	x_core_install $LIBC
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+	x_core_install perl-base
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+	rm "$TARGET/usr/bin/awk"
+	x_core_install mawk
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+	if doing_variant -; then
+		x_core_install debconf
+	fi
+
+	baseprog=0
+	bases=$(set -- $required; echo $#)
+
+	info UNPACKREQ "Unpacking required packages..."
+
+	exec 7>&1
+
+	smallyes '' |
+		(repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" \
+		dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 || echo EXITCODE $?) |
+		dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING
+
+	info CONFREQ "Configuring required packages..."
+
+	mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+	echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+	chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+	setup_dselect_method apt
+
+	smallyes '' |
+		(in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" \
+		dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 || echo EXITCODE $?) |
+		dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING
+
+	baseprog=0
+	bases="$(set -- $base; echo $#)"
+
+	info UNPACKBASE "Unpacking the base system..."
+
+	setup_available $required $base
+	done_predeps=
+	while predep=$(get_next_predep); do
+		# We have to resolve dependencies of pre-dependencies manually because
+		# dpkg --predep-package doesn't handle this.
+		predep=$(without "$(without "$(resolve_deps $predep)" "$required")" "$done_predeps")
+		# XXX: progress is tricky due to how dpkg_progress works
+		# -- cjwatson 2009-07-29
+		p; smallyes '' |
+		in_target dpkg --force-overwrite --force-confold --skip-same-version --install $(debfor $predep)
+		base=$(without "$base" "$predep")
+		done_predeps="$done_predeps $predep"
+	done
+
+	smallyes '' |
+		(repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" \
+		dpkg --status-fd 8 --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 || echo EXITCODE $?) |
+		dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING
+
+	info CONFBASE "Configuring the base system..."
+
+	smallyes '' |
+		(repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be re-attempted up to five times." "" \
+		dpkg --status-fd 8 --force-confold --skip-same-version --configure -a 8>&1 1>&7 || echo EXITCODE $?) |
+		dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING
+
+	mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+	progress $bases $bases CONFBASE "Configuring base system"
+	info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/ascii b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/ascii
new file mode 120000
index 00000000..8eb08550
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/ascii
@@ -0,0 +1 @@
+ceres
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/bartholomea b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/bartholomea
new file mode 120000
index 00000000..aa62febf
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/bartholomea
@@ -0,0 +1 @@
+aequorea
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/breezy b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/breezy
new file mode 100644
index 00000000..2148cec3
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/breezy
@@ -0,0 +1,163 @@
+default_mirror http://old-releases.ubuntu.com/ubuntu
+mirror_style release
+download_style apt
+finddebs_style from-indices
+variants - buildd
+
+case $ARCH in
+  alpha|ia64) LIBC="libc6.1" ;;
+  *)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+    required="$(get_debs Priority: required)"
+
+    if doing_variant -; then
+      #required="$required $(get_debs Priority: important)"
+      #  ^^ should be getting debconf here somehow maybe
+      base="$(get_debs Priority: important)"
+    elif doing_variant buildd; then
+      # TODO: add Build-Essential: yes extraoverrides
+      #base="$(get_debs Build-Essential: yes)"
+
+      add () { if [ "$ARCH" = "$1" ]; then eval "$2=\"\$$2 $3\""; fi; }
+
+      base="apt binutils cpio cpp cpp-4.0 dpkg-dev g++ g++-4.0 gcc gcc-4.0 gcc-4.0-base ${LIBC}-dev libdb4.2 libgdbm3 libstdc++6 libstdc++6-4.0-dev linux-kernel-headers make patch perl perl-modules"
+
+      add ia64 base "libunwind7-dev"
+      add sparc base "lib64gcc1"
+      add sparc base "libc6-dev-sparc64"
+      add sparc base "libc6-sparc64"
+    fi
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    setup_proc
+    umount_on_exit /dev/.static/dev
+    umount_on_exit /dev
+    in_target /sbin/ldconfig
+
+    DEBIAN_FRONTEND=noninteractive
+    DEBCONF_NONINTERACTIVE_SEEN=true
+    export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+    baseprog=0
+    bases=7
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+    x_core_install perl-base
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+    if doing_variant -; then
+      x_core_install debconf
+    fi
+
+    baseprog=0
+    bases=$(set -- $required; echo $#)
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" \
+      dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING) 7>&1
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    smallyes '' |
+      (in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" \
+      dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING) 7>&1
+
+    baseprog=0
+    bases="$(set -- $base; echo $#)"
+
+    info UNPACKBASE "Unpacking the base system..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" \
+      dpkg --status-fd 8 --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING) 7>&1
+
+    info CONFBASE "Configuring the base system..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" \
+      dpkg --status-fd 8 --force-confold --skip-same-version --configure -a 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING) 7>&1
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases CONFBASE "Configuring base system"
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/bullseye b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/bullseye
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/bullseye
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/buster b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/buster
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/buster
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/ceres b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/ceres
new file mode 100644
index 00000000..0e9868db
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/ceres
@@ -0,0 +1,218 @@
+mirror_style release
+download_style apt
+finddebs_style from-indices
+variants - buildd fakechroot minbase scratchbox
+keyring /usr/share/keyrings/devuan-archive-keyring.gpg
+
+if doing_variant fakechroot; then
+	test "$FAKECHROOT" = "true" || error 1 FAKECHROOTREQ "This variant requires fakechroot environment to be started"
+fi
+
+case $ARCH in
+	alpha|ia64) LIBC="libc6.1" ;;
+	kfreebsd-*) LIBC="libc0.1" ;;
+	hurd-*)     LIBC="libc0.3" ;;
+	*)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+	required="$(get_debs Priority: required)"
+   devuan_required="devuan-keyring devuan-baseconf sysvinit-core"
+   devuan_remove="systemd systemd-sysv"
+
+	if doing_variant - || doing_variant fakechroot; then
+		#required="$required $(get_debs Priority: important)"
+		#  ^^ should be getting debconf here somehow maybe
+		base="$(get_debs Priority: important) $devuan_required"
+	elif doing_variant buildd || doing_variant scratchbox; then
+		base="apt build-essential $devuan_required"
+	elif doing_variant minbase; then
+		base="apt $devuan_required"
+	fi
+
+	if doing_variant fakechroot; then
+		# ldd.fake needs binutils
+		required="$required binutils"
+	fi
+
+	case $MIRRORS in
+	    https://*)
+		base="$base apt-transport-https ca-certificates"
+		;;
+	esac
+   #base=$(without "$base" "$devuan_remove")
+}
+
+first_stage_install () {
+   case "$CODENAME" in 
+      jessie|jessie-kfreebsd) ;;
+      *)
+         EXTRACT_DEB_TAR_OPTIONS="$EXTRACT_DEB_TAR_OPTIONS -k"
+         setup_merged_usr
+         ;;
+   esac
+	extract $required
+
+	mkdir -p "$TARGET/var/lib/dpkg"
+	: >"$TARGET/var/lib/dpkg/status"
+	: >"$TARGET/var/lib/dpkg/available"
+
+	setup_etc
+	if [ ! -e "$TARGET/etc/fstab" ]; then
+		echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+		chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+	fi
+
+   setup_devices
+}
+
+second_stage_install () {
+   setup_dynamic_devices 
+
+	x_feign_install () {
+		local pkg="$1"
+		local deb="$(debfor $pkg)"
+		local ver="$(in_target dpkg-deb -f "$deb" Version)"
+
+		mkdir -p "$TARGET/var/lib/dpkg/info"
+
+		echo \
+"Package: $pkg
+Version: $ver
+Maintainer: unknown
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+		touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+	}
+
+	x_feign_install dpkg
+
+	x_core_install () {
+		smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+	}
+
+	p () {
+		baseprog="$(($baseprog + ${1:-1}))"
+	}
+
+	if doing_variant fakechroot; then
+		setup_proc_fakechroot
+	elif doing_variant scratchbox; then
+		true
+	else
+		setup_proc
+		in_target /sbin/ldconfig
+	fi
+
+	DEBIAN_FRONTEND=noninteractive
+	DEBCONF_NONINTERACTIVE_SEEN=true
+	export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+	baseprog=0
+	bases=7
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+	info INSTCORE "Installing core packages..."
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+	ln -sf mawk "$TARGET/usr/bin/awk"
+	x_core_install base-passwd
+	x_core_install base-files
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+	x_core_install dpkg
+
+	if [ ! -e "$TARGET/etc/localtime" ]; then
+		ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+	fi
+
+	if doing_variant fakechroot; then
+		install_fakechroot_tools
+	fi
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+	x_core_install $LIBC
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+	x_core_install perl-base
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+	rm "$TARGET/usr/bin/awk"
+	x_core_install mawk
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+	if doing_variant -; then
+		x_core_install debconf
+	fi
+
+	baseprog=0
+	bases=$(set -- $required; echo $#)
+
+	info UNPACKREQ "Unpacking required packages..."
+
+	exec 7>&1
+
+	smallyes '' |
+		(repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" \
+		dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 || echo EXITCODE $?) |
+		dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING
+
+	info CONFREQ "Configuring required packages..."
+
+	echo \
+"#!/bin/sh
+exit 101" > "$TARGET/usr/sbin/policy-rc.d"
+	chmod 755 "$TARGET/usr/sbin/policy-rc.d"
+
+	mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+	echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+	chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+	setup_dselect_method apt
+
+	smallyes '' |
+		(in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" \
+		dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 || echo EXITCODE $?) |
+		dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING
+
+	baseprog=0
+	bases="$(set -- $base; echo $#)"
+
+	info UNPACKBASE "Unpacking the base system..."
+
+	setup_available $required $base
+	done_predeps=
+	while predep=$(get_next_predep); do
+		# We have to resolve dependencies of pre-dependencies manually because
+		# dpkg --predep-package doesn't handle this.
+		predep=$(without "$(without "$(resolve_deps $predep)" "$required")" "$done_predeps")
+		# XXX: progress is tricky due to how dpkg_progress works
+		# -- cjwatson 2009-07-29
+		p; smallyes '' |
+		in_target dpkg --force-overwrite --force-confold --skip-same-version --install $(debfor $predep)
+		base=$(without "$base" "$predep")
+		done_predeps="$done_predeps $predep"
+	done
+
+   if [ -n "$base" ]; then
+	   smallyes '' |
+		   (repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" \
+		   dpkg --status-fd 8 --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 || echo EXITCODE $?) |
+		   dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING
+
+	   info CONFBASE "Configuring the base system..."
+
+	   smallyes '' |
+		   (repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be re-attempted up to five times." "" \
+		   dpkg --status-fd 8 --force-confold --skip-same-version --configure -a 8>&1 1>&7 || echo EXITCODE $?) |
+		   dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING
+   fi
+
+	mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+	rm -f "$TARGET/usr/sbin/policy-rc.d"
+
+	progress $bases $bases CONFBASE "Configuring base system"
+	info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/chromodoris b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/chromodoris
new file mode 120000
index 00000000..aa62febf
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/chromodoris
@@ -0,0 +1 @@
+aequorea
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/dapper b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/dapper
new file mode 100644
index 00000000..af83c0cf
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/dapper
@@ -0,0 +1,168 @@
+case $ARCH in
+  amd64|i386|powerpc|sparc)
+    default_mirror http://archive.ubuntu.com/ubuntu
+    ;;
+  *)
+    default_mirror http://ports.ubuntu.com/ubuntu-ports
+    ;;
+esac
+mirror_style release
+download_style apt
+finddebs_style from-indices
+variants - buildd
+
+case $ARCH in
+  alpha|ia64) LIBC="libc6.1" ;;
+  *)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+    required="$(get_debs Priority: required)"
+
+    if doing_variant -; then
+      #required="$required $(get_debs Priority: important)"
+      #  ^^ should be getting debconf here somehow maybe
+      base="$(get_debs Priority: important)"
+    elif doing_variant buildd; then
+      # TODO: add Build-Essential: yes extraoverrides
+      #base="$(get_debs Build-Essential: yes)"
+
+      add () { if [ "$ARCH" = "$1" ]; then eval "$2=\"\$$2 $3\""; fi; }
+
+      base="apt binutils cpio cpp cpp-4.0 dpkg-dev g++ g++-4.0 gcc gcc-4.0 ${LIBC}-dev libgdbm3 libstdc++6 libstdc++6-4.0-dev linux-kernel-headers make patch perl perl-modules"
+
+      add ia64 base "libunwind7-dev"
+      add sparc base "lib64gcc1"
+      add sparc base "libc6-dev-sparc64"
+      add sparc base "libc6-sparc64"
+    fi
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    : >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    setup_proc
+    in_target /sbin/ldconfig
+
+    DEBIAN_FRONTEND=noninteractive
+    DEBCONF_NONINTERACTIVE_SEEN=true
+    export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+    baseprog=0
+    bases=7
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+    x_core_install perl-base
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+    if doing_variant -; then
+      x_core_install debconf
+    fi
+
+    baseprog=0
+    bases=$(set -- $required; echo $#)
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" \
+      dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING) 7>&1
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    smallyes '' |
+      (in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" \
+      dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING) 7>&1
+
+    baseprog=0
+    bases="$(set -- $base; echo $#)"
+
+    info UNPACKBASE "Unpacking the base system..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" \
+      dpkg --status-fd 8 --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING) 7>&1
+
+    info CONFBASE "Configuring the base system..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" \
+      dpkg --status-fd 8 --force-confold --skip-same-version --configure -a 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING) 7>&1
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases CONFBASE "Configuring base system"
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/dasyatis b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/dasyatis
new file mode 120000
index 00000000..aa62febf
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/dasyatis
@@ -0,0 +1 @@
+aequorea
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/edgy b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/edgy
new file mode 100644
index 00000000..01d65682
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/edgy
@@ -0,0 +1,187 @@
+case $ARCH in
+  amd64|i386|powerpc|sparc)
+    default_mirror http://archive.ubuntu.com/ubuntu
+    ;;
+  *)
+    default_mirror http://ports.ubuntu.com/ubuntu-ports
+    ;;
+esac
+mirror_style release
+download_style apt
+finddebs_style from-indices
+variants - buildd fakechroot
+
+if doing_variant fakechroot; then
+    test "$FAKECHROOT" = "true" || error 1 FAKECHROOTREQ "This variant requires fakechroot environment to be started"
+fi
+
+case $ARCH in
+  alpha|ia64) LIBC="libc6.1" ;;
+  *)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+    required="$(get_debs Priority: required)"
+
+    if doing_variant -; then
+      #required="$required $(get_debs Priority: important)"
+      #  ^^ should be getting debconf here somehow maybe
+      base="$(get_debs Priority: important)"
+    elif doing_variant buildd; then
+      # TODO: add Build-Essential: yes extraoverrides
+      #base="$(get_debs Build-Essential: yes)"
+
+      add () { if [ "$ARCH" = "$1" ]; then eval "$2=\"\$$2 $3\""; fi; }
+
+      base="apt binutils cpio cpp cpp-4.1 dpkg-dev g++ g++-4.1 gcc gcc-4.1 ${LIBC}-dev libdb4.4 libgdbm3 libstdc++6 libstdc++6-4.1-dev linux-libc-dev make patch perl perl-modules"
+
+      add ia64 base "libunwind7-dev"
+      add sparc base "lib64gcc1"
+      add sparc base "libc6-dev-sparc64"
+      add sparc base "libc6-sparc64"
+    elif doing_variant fakechroot; then
+      base="apt"
+    fi
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    : >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    if doing_variant fakechroot; then
+	setup_proc_fakechroot
+    else
+	setup_proc
+	in_target /sbin/ldconfig
+    fi
+
+    DEBIAN_FRONTEND=noninteractive
+    DEBCONF_NONINTERACTIVE_SEEN=true
+    export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+    baseprog=0
+    bases=7
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    if doing_variant fakechroot; then
+	install_fakechroot_tools
+    fi
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+    x_core_install perl-base
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+    if doing_variant -; then
+      x_core_install debconf
+    fi
+
+    baseprog=0
+    bases=$(set -- $required; echo $#)
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" \
+      dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING) 7>&1
+
+    info CONFREQ "Configuring required packages..."
+
+    if doing_variant fakechroot; then
+	# fix initscripts postinst (no mounting possible, and wrong if condition)
+	sed -i '/dpkg.*--compare-versions/ s/\<lt\>/lt-nl/' "$TARGET/var/lib/dpkg/info/initscripts.postinst"
+    fi
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    smallyes '' |
+      (in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" \
+      dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING) 7>&1
+
+    baseprog=0
+    bases="$(set -- $base; echo $#)"
+
+    info UNPACKBASE "Unpacking the base system..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" \
+      dpkg --status-fd 8 --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING) 7>&1
+
+    info CONFBASE "Configuring the base system..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" \
+      dpkg --status-fd 8 --force-confold --skip-same-version --configure -a 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING) 7>&1
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases CONFBASE "Configuring base system"
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/etch b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/etch
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/etch
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/etch-m68k b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/etch-m68k
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/etch-m68k
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/feisty b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/feisty
new file mode 100644
index 00000000..b0a46312
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/feisty
@@ -0,0 +1,190 @@
+case $ARCH in
+  amd64|i386|powerpc|sparc)
+    default_mirror http://archive.ubuntu.com/ubuntu
+    ;;
+  *)
+    default_mirror http://ports.ubuntu.com/ubuntu-ports
+    ;;
+esac
+mirror_style release
+download_style apt
+finddebs_style from-indices
+variants - buildd fakechroot
+
+if doing_variant fakechroot; then
+    test "$FAKECHROOT" = "true" || error 1 FAKECHROOTREQ "This variant requires fakechroot environment to be started"
+fi
+
+case $ARCH in
+  alpha|ia64) LIBC="libc6.1" ;;
+  *)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+    required="$(get_debs Priority: required)"
+
+    if doing_variant -; then
+      #required="$required $(get_debs Priority: important)"
+      #  ^^ should be getting debconf here somehow maybe
+      base="$(get_debs Priority: important)"
+    elif doing_variant buildd; then
+      # TODO: add Build-Essential: yes extraoverrides
+      #base="$(get_debs Build-Essential: yes)"
+
+      add () { if [ "$ARCH" = "$1" ]; then eval "$2=\"\$$2 $3\""; fi; }
+
+      base="apt binutils cpio cpp cpp-4.1 dpkg-dev g++ g++-4.1 gcc gcc-4.1 ${LIBC}-dev libdb4.4 libgdbm3 libstdc++6 libstdc++6-4.1-dev linux-libc-dev make patch perl perl-modules"
+
+      add ia64 base "libunwind7-dev"
+      add sparc base "lib64gcc1"
+      add sparc base "libc6-dev-sparc64"
+      add sparc base "libc6-sparc64"
+    elif doing_variant fakechroot; then
+      base="apt"
+    fi
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    : >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    if doing_variant fakechroot; then
+	setup_proc_fakechroot
+    else
+	setup_proc
+	in_target /sbin/ldconfig
+    fi
+
+    DEBIAN_FRONTEND=noninteractive
+    DEBCONF_NONINTERACTIVE_SEEN=true
+    export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+    baseprog=0
+    bases=7
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    if doing_variant fakechroot; then
+	install_fakechroot_tools
+    fi
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+    x_core_install perl-base
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+    if doing_variant -; then
+      x_core_install debconf
+    fi
+
+    baseprog=0
+    bases=$(set -- $required; echo $#)
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" \
+      dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING) 7>&1
+
+    info CONFREQ "Configuring required packages..."
+
+    if doing_variant fakechroot; then
+	# fix initscripts postinst (no mounting possible, and wrong if condition)
+	sed -i '/dpkg.*--compare-versions/ s/\<lt\>/lt-nl/' "$TARGET/var/lib/dpkg/info/initscripts.postinst"
+
+	# kill libdevmapper postinst; it tries to create /dev/mapper/
+	rm "$TARGET/var/lib/dpkg/info/libdevmapper1"*.postinst
+    fi
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    smallyes '' |
+      (in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" \
+      dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING) 7>&1
+
+    baseprog=0
+    bases="$(set -- $base; echo $#)"
+
+    info UNPACKBASE "Unpacking the base system..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" \
+      dpkg --status-fd 8 --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING) 7>&1
+
+    info CONFBASE "Configuring the base system..."
+
+    smallyes '' |
+      (repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" \
+      dpkg --status-fd 8 --force-confold --skip-same-version --configure -a 8>&1 1>&7 |
+      dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING) 7>&1
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases CONFBASE "Configuring base system"
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/gutsy b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/gutsy
new file mode 100644
index 00000000..f525d8ff
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/gutsy
@@ -0,0 +1,230 @@
+case $ARCH in
+  amd64|i386)
+	default_mirror http://archive.ubuntu.com/ubuntu
+	;;
+  sparc)
+	case $SUITE in
+	  gutsy)
+	default_mirror http://archive.ubuntu.com/ubuntu
+	;;
+	  *)
+	default_mirror http://ports.ubuntu.com/ubuntu-ports
+	;;
+	esac
+	;;
+  *)
+	default_mirror http://ports.ubuntu.com/ubuntu-ports
+	;;
+esac
+mirror_style release
+download_style apt
+finddebs_style from-indices
+variants - buildd fakechroot minbase
+keyring /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+if doing_variant fakechroot; then
+	test "$FAKECHROOT" = "true" || error 1 FAKECHROOTREQ "This variant requires fakechroot environment to be started"
+fi
+
+case $ARCH in
+	alpha|ia64) LIBC="libc6.1" ;;
+	kfreebsd-*) LIBC="libc0.1" ;;
+	hurd-*)     LIBC="libc0.3" ;;
+	*)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+	required="$(get_debs Priority: required)"
+
+	if doing_variant -; then
+		#required="$required $(get_debs Priority: important)"
+		#  ^^ should be getting debconf here somehow maybe
+		base="$(get_debs Priority: important)"
+	elif doing_variant buildd; then
+		base="$(get_debs Build-Essential: yes)"
+	elif doing_variant fakechroot || doing_variant minbase; then
+		base="apt"
+	fi
+
+	case $MIRRORS in
+	    https://*)
+		base="$base apt-transport-https ca-certificates"
+		;;
+	esac
+}
+
+first_stage_install () {
+	extract $required
+
+	mkdir -p "$TARGET/var/lib/dpkg"
+	: >"$TARGET/var/lib/dpkg/status"
+	: >"$TARGET/var/lib/dpkg/available"
+
+	setup_etc
+	if [ ! -e "$TARGET/etc/fstab" ]; then
+		echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+		chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+	fi
+
+	setup_devices
+
+	x_feign_install () {
+		local pkg="$1"
+		local deb="$(debfor $pkg)"
+		local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+		mkdir -p "$TARGET/var/lib/dpkg/info"
+
+		echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+		touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+	}
+
+	x_feign_install dpkg
+}
+
+second_stage_install () {
+	x_core_install () {
+		smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+	}
+
+	p () {
+		baseprog="$(($baseprog + ${1:-1}))"
+	}
+
+	if doing_variant fakechroot; then
+		setup_proc_fakechroot
+	else
+		setup_proc
+		in_target /sbin/ldconfig
+	fi
+
+	DEBIAN_FRONTEND=noninteractive
+	DEBCONF_NONINTERACTIVE_SEEN=true
+	export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+	baseprog=0
+	bases=7
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+	info INSTCORE "Installing core packages..."
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+	ln -sf mawk "$TARGET/usr/bin/awk"
+	x_core_install base-passwd
+	x_core_install base-files
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+	x_core_install dpkg
+
+	if [ ! -e "$TARGET/etc/localtime" ]; then
+		ln -sf /usr/share/zoneinfo/Etc/UTC "$TARGET/etc/localtime"
+	fi
+
+	if doing_variant fakechroot; then
+		install_fakechroot_tools
+	fi
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+	x_core_install $LIBC
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+	x_core_install perl-base
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+	rm "$TARGET/usr/bin/awk"
+	x_core_install mawk
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+	if doing_variant -; then
+		x_core_install debconf
+	fi
+
+	baseprog=0
+	bases=$(set -- $required; echo $#)
+
+	info UNPACKREQ "Unpacking required packages..."
+
+	smallyes '' |
+		(repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" \
+		dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 |
+		dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING) 7>&1
+
+	info CONFREQ "Configuring required packages..."
+
+	if doing_variant fakechroot; then
+	# fix initscripts postinst (no mounting possible, and wrong if condition)
+	sed -i '/dpkg.*--compare-versions/ s/\<lt\>/lt-nl/' "$TARGET/var/lib/dpkg/info/initscripts.postinst"
+	fi
+
+	echo \
+"#!/bin/sh
+exit 101" > "$TARGET/usr/sbin/policy-rc.d"
+	chmod 755 "$TARGET/usr/sbin/policy-rc.d"
+
+	mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+	echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+	chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+	if [ -x "$TARGET/sbin/initctl" ]; then
+	  mv "$TARGET/sbin/initctl" "$TARGET/sbin/initctl.REAL"
+	  echo \
+"#!/bin/sh
+if [ \"\$1\" = version ]; then exec /sbin/initctl.REAL \"\$@\"; fi
+echo
+echo \"Warning: Fake initctl called, doing nothing\"" > "$TARGET/sbin/initctl"
+	  chmod 755 "$TARGET/sbin/initctl"
+	fi
+
+	setup_dselect_method apt
+
+	smallyes '' |
+		(in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" \
+		dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 |
+		dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING) 7>&1
+
+	baseprog=0
+	bases="$(set -- $base; echo $#)"
+
+	info UNPACKBASE "Unpacking the base system..."
+
+	setup_available $required $base
+	done_predeps=
+	while predep=$(get_next_predep); do
+		# We have to resolve dependencies of pre-dependencies manually because
+		# dpkg --predep-package doesn't handle this.
+		predep=$(without "$(without "$(resolve_deps $predep)" "$required")" "$done_predeps")
+		# XXX: progress is tricky due to how dpkg_progress works
+		# -- cjwatson 2009-07-29
+		p; smallyes '' |
+		in_target dpkg --force-overwrite --force-confold --skip-same-version --install $(debfor $predep)
+		base=$(without "$base" "$predep")
+		done_predeps="$done_predeps $predep"
+	done
+
+	smallyes '' |
+		(repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" \
+		dpkg --status-fd 8 --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 |
+		dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING) 7>&1
+
+	info CONFBASE "Configuring the base system..."
+
+	smallyes '' |
+		(repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be re-attempted up to five times." "" \
+		dpkg --status-fd 8 --force-confold --skip-same-version --configure -a 8>&1 1>&7 |
+		dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING) 7>&1
+
+	if [ -x "$TARGET/sbin/initctl.REAL" ]; then
+		mv "$TARGET/sbin/initctl.REAL" "$TARGET/sbin/initctl"
+	fi
+	mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+	rm -f "$TARGET/usr/sbin/policy-rc.d"
+
+	progress $bases $bases CONFBASE "Configuring base system"
+	info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hardy b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hardy
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hardy
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hoary b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hoary
new file mode 100644
index 00000000..e5fe9fc2
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hoary
@@ -0,0 +1,179 @@
+default_mirror http://old-releases.ubuntu.com/ubuntu
+mirror_style release
+download_style apt
+
+case $ARCH in
+  ia64)       LIBC="libc6.1" ;;
+  *)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+
+    required="base-files base-passwd bash bsdutils coreutils libacl1 libattr1 debconf debconf-i18n liblocale-gettext-perl libtext-iconv-perl libtext-wrapi18n-perl libtext-charwidth-perl debianutils diff dpkg dselect libblkid1 e2fsprogs e2fslibs libcomerr2 libss2 libuuid1 findutils grep gzip hostname libcap1 libdb1-compat libdb3 libncurses5 libnewt0.51 libpam-modules libpam-runtime libpam0g libpopt0 login makedev mawk mount ncurses-base ncurses-bin passwd perl-base procps python-minimal python2.4-minimal sed slang1a-utf8 lsb-base initscripts sysvinit sysv-rc tar util-linux zlib1g whiptail libgcc1 gcc-3.3-base libstdc++5"
+
+    base="adduser alsa-base alsa-utils apt apt-utils aptitude at base-config bind9-host bsdmainutils bzip2 console-common console-data console-tools cpio cramfsprogs cron dash dhcp3-client dhcp3-common discover1 discover1-data dmsetup dnsutils dosfstools ed eject ethtool evms evms-ncurses fdutils file ftp gettext-base gnupg grepmap groff-base hdparm hotplug ifrename ifupdown info initrd-tools iproute iptables iputils-arping iputils-ping iputils-tracepath jfsutils klogd less libasound2 libbz2-1.0 libconsole libdb4.2 libdevmapper1.00 libdiscover1 libdns16 libevms-2.5 libfribidi0 libgc1 libgcrypt11 libgdbm3 libgnutls11 libgpg-error0 libgpmg1 libidn11 libisc7 libiw27 libldap2 liblockfile1 liblwres1 liblzo1 libmagic1 libncursesw5 libopencdk8 libparted1.6-12 libpcap0.8 libreiserfs0.3-0 libsasl2 libsasl2-modules libsigc++-1.2-5c102 libssl0.9.7 libtasn1-2 libusb-0.1-4 libwrap0 locales logrotate lsb-release lshw lsof lvm-common lvm10 lvm2 mailx man-db manpages mdadm mii-diag mime-support module-init-tools mtr-tiny mutt nano net-tools netbase netcat netkit-inetd ntp ntpdate openssh-client parted pciutils popularity-contest postfix postfix-tls ppp pppconfig pppoeconf psmisc python python2.4 reiser4progs reiserfsprogs reportbug rsync strace sudo sysklogd tcpd tcpdump telnet time ubuntu-base ubuntu-keyring udev usbutils vim vim-common w3m wget wireless-tools xfsprogs"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+    subst_package () {
+        echo "$3" | tr ' ' '\n' | sed "s/^$1$/$2/" | tr '\n' ' '
+    }
+
+    case $ARCH in
+        "i386")
+            required="$required libc6 libc6-i686"
+            base="$base dmidecode libelfg0 ltrace memtest86+ libreadline4"
+            ;;
+        "powerpc")
+            required="$required libc6 libreadline4"
+            base="$base hfsplus hfsutils libelfg0 libhfsp0 ltrace mac-fdisk pmac-fdisk powerpc-utils"
+            ;;
+        "amd64")
+            required="$required libc6"
+            base="$base dmidecode libelfg0 ltrace memtest86+ libreadline4"
+            ;;
+        "ia64")
+            required="$required libc6.1 libunwind7"
+            base="$base dmidecode libreadline4"
+            ;;
+        "sparc")
+            required="$required libc6"
+            base="$base lib64gcc1 libc6-sparc64 libreadline4"
+            ;;
+        *)
+            # who knows?
+            ;;
+    esac
+}
+
+install_debs () {
+    first_stage_install
+    second_stage_install
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    DEBIAN_FRONTEND=noninteractive
+    DEBCONF_NONINTERACTIVE_SEEN=true
+    export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+    baseprog=0
+    bases=7
+
+    setup_proc
+    umount_on_exit /.dev
+    umount_on_exit /dev
+    in_target /sbin/ldconfig
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+    x_core_install debconf
+
+    baseprog=0
+    bases="$(set -- $required; echo $#)"
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    smallyes '' | (repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 | dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING) 7>&1
+
+    baseprog=0
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+    #on_exit "(in_target_nofail umount /dev/pts) || true"
+
+    smallyes '' | (in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 | dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING) 7>&1
+
+    baseprog=0
+    bases="$(set -- $base; echo $#)"
+
+    info UNPACKBASE "Unpacking the base system..."
+
+    smallyes '' | (repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --status-fd 8 --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 | dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING) 7>&1
+
+    baseprog=0
+
+    info CONFBASE "Configuring the base system..."
+
+    mv "$TARGET/usr/sbin/sendmail" "$TARGET/usr/sbin/sendmail.REAL"
+    ln -s /bin/true "$TARGET/usr/sbin/sendmail"
+
+    smallyes '' | (repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg --status-fd 8 --force-confold --skip-same-version  --configure -a 8>&1 1>&7 | dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING) 7>&1
+
+    rm -f "$TARGET/usr/sbin/sendmail"
+    mv "$TARGET/usr/sbin/sendmail.REAL" "$TARGET/usr/sbin/sendmail"
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases CONFBASE "Configuring base system"
+    info BASESUCCESS "Base system installed successfully."
+}
+
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hoary.buildd b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hoary.buildd
new file mode 100644
index 00000000..8d10d809
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/hoary.buildd
@@ -0,0 +1,159 @@
+default_mirror http://old-releases.ubuntu.com/ubuntu
+mirror_style release
+download_style apt
+
+LIBC=libc6
+if [ "$ARCH" = "alpha" ] || [ "$ARCH" = "ia64" ]; then
+  LIBC="libc6.1"
+fi
+
+work_out_debs () {
+    required="base-files base-passwd bash bsdutils build-essential coreutils debianutils diff dpkg dselect e2fslibs e2fsprogs fakeroot findutils gcc-3.3-base grep gzip hostname initscripts libacl1 libattr1 libblkid1 libc6 libcap1 libcomerr2 libdb1-compat libdb3 libgcc1 libncurses5 libpam-modules libpam-runtime libpam0g libss2 libstdc++5 libuuid1 login lsb-base mawk mount ncurses-base ncurses-bin passwd perl-base pkgstriptranslations python-minimal python2.4-minimal sed slang1a-utf8 sysv-rc sysvinit tar util-linux zlib1g"
+
+    base="apt binutils cpio cpp cpp-3.3 dpkg-dev g++ g++-3.3 gcc gcc-3.3 libc6-dev libdb4.2 libgdbm3 libstdc++5-3.3-dev linux-kernel-headers make patch perl perl-modules"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+    subst_package () {
+        echo "$3" | tr ' ' '\n' | sed "s/^$1$/$2/" | tr '\n' ' '
+    }
+
+    case $ARCH in
+        "amd64")
+            ;;
+        "i386")
+            ;;
+	"powerpc")
+	    ;;
+        "ia64")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+            base="$(subst_package "libc6-dev" "libc6.1-dev" "$base")"
+            base="$base libunwind7 libunwind7-dev"
+            ;;
+
+	# Unsupported architectures:
+        "alpha")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+	    base="$(subst_package "libc6-dev" "libc6.1-dev" "$base")"
+            ;;
+        *)
+            # who knows?
+            ;;
+    esac
+}
+
+install_debs () {
+    first_stage_install
+    second_stage_install
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    DEBIAN_FRONTEND=noninteractive
+    export DEBIAN_FRONTEND
+
+    baseprog=0
+    bases=40
+
+    setup_proc
+    in_target /sbin/ldconfig
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #8
+    smallyes '' | repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --force-depends --unpack $(debfor $required)
+    p 10; progress $baseprog $bases INSTCORE "Installing core packages" #18
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+    #on_exit "in_target_nofail umount /dev/pts"
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #19
+    smallyes '' | in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --configure --pending --force-configure-any --force-depends
+    p 10; progress $baseprog $bases INSTCORE "Installing core packages" #29
+
+    info INSTCORE "Installing base packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #30
+    smallyes '' | repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base)
+
+    smallyes '' | repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg  --force-confold --skip-same-version  --configure -a
+
+    p 9; progress $baseprog $bases INSTCORE "Installing core packages" #39
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases INSTCORE "Installing core packages" #40
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/intrepid b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/intrepid
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/intrepid
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jaunty b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jaunty
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jaunty
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jessie b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jessie
new file mode 120000
index 00000000..8eb08550
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jessie
@@ -0,0 +1 @@
+ceres
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jessie-kfreebsd b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jessie-kfreebsd
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/jessie-kfreebsd
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/karmic b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/karmic
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/karmic
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/lenny b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/lenny
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/lenny
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/lucid b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/lucid
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/lucid
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/maverick b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/maverick
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/maverick
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/natty b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/natty
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/natty
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oldoldstable b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oldoldstable
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oldoldstable
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oldstable b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oldstable
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oldstable
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oneiric b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oneiric
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/oneiric
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/potato b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/potato
new file mode 100644
index 00000000..b6dedab8
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/potato
@@ -0,0 +1,104 @@
+mirror_style release
+download_style apt var-state
+force_md5
+
+LIBC=libc6
+if [ "$ARCH" = alpha ]; then
+  LIBC="libc6.1"
+fi
+
+work_out_debs () {
+    required="base-files base-passwd bash bsdutils debconf-tiny debianutils diff dpkg e2fsprogs fileutils findutils grep gzip hostname ldso libc6 libdb2 libgdbmg1 libncurses5 libnewt0 libpam-modules libpam-runtime libpam0g libpopt0 libreadline4 libstdc++2.10 login makedev mawk modutils mount ncurses-base ncurses-bin passwd perl-5.005-base perl-base procps sed shellutils slang1 sysklogd sysvinit tar textutils update util-linux whiptail"
+
+    base="adduser ae apt base-config elvis-tiny fbset fdutils gettext-base console-data console-tools console-tools-libs libdb2 libwrap0 locales modconf netbase ftp ppp pppconfig pump tasksel tcpd textutils telnet xviddetect"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+
+    case $ARCH in
+      "alpha")
+        required="$(without_package "libc6" "$required") libc6.1"
+        ;;
+      "i386")
+        base="$base fdflush isapnptools lilo mbr pciutils pcmcia-cs psmisc setserial syslinux"
+        ;;
+       *)
+        # other arches may have special needs not yet represented here
+        # oh well, Potato is old
+    esac
+}
+
+first_stage_install () {
+    extract $required
+
+    :> "$TARGET/var/lib/dpkg/status"
+    echo > "$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+    chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+
+    x_feign_install () {
+        local pkg=$1
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    setup_devices
+
+    x_feign_install dpkg
+
+    if [ -e "$TARGET/usr/bin/perl-5.005.dist" ]; then
+        mv "$TARGET/usr/bin/perl-5.005.dist" "$TARGET/usr/bin/perl-5.005"
+    fi
+    if [ ! -e "$TARGET/usr/bin/perl" ]; then
+        ln -sf perl-5.005 "$TARGET/usr/bin/perl"
+    fi
+}
+
+second_stage_install () {
+    x_core_install () {
+        in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    export DEBIAN_FRONTEND=Noninteractive
+
+    setup_proc
+    ln "$TARGET/sbin/ldconfig.new" "$TARGET/sbin/ldconfig"
+    in_target /sbin/ldconfig
+
+    x_core_install base-files base-passwd ldso
+    x_core_install dpkg
+
+    ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    x_core_install $LIBC
+
+    smallyes '' | x_core_install perl-5.005-base
+    x_core_install mawk
+    x_core_install debconf-tiny
+
+    in_target dpkg-preconfigure $(debfor $required $base)
+
+    repeatn 5 in_target dpkg --force-depends --unpack $(debfor $required)
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    cp "$TARGET/bin/true" "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    in_target dpkg --configure --pending --force-configure-any --force-depends
+
+    smallyes '' | repeatn 5 in_target dpkg --force-auto-select --force-overwrite --skip-same-version --install $(debfor $base)
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/precise b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/precise
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/precise
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/quantal b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/quantal
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/quantal
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/raring b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/raring
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/raring
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge
new file mode 100644
index 00000000..aa37d946
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge
@@ -0,0 +1,218 @@
+mirror_style release
+download_style apt
+force_md5
+
+LIBC=libc6
+if [ "$ARCH" = "alpha" ] || [ "$ARCH" = "ia64" ]; then
+  LIBC="libc6.1"
+fi
+
+work_out_debs () {
+
+    required="base-files base-passwd bash bsdutils coreutils libacl1 libattr1 debconf debconf-i18n liblocale-gettext-perl libtext-wrapi18n-perl libtext-charwidth-perl debianutils diff dpkg dselect libblkid1 e2fsprogs e2fslibs libcomerr2 libss2 libuuid1 findutils grep gzip hostname libcap1 libc6 libdb1-compat libdb3 libncurses5 libnewt0.51 libpam-modules libpam-runtime libpam0g libperl5.8 libpopt0 login makedev mawk modutils mount ncurses-base ncurses-bin passwd perl-base procps sed slang1a-utf8 initscripts sysvinit sysv-rc tar util-linux whiptail libgcc1 gcc-3.3-base libstdc++5"
+
+    base="adduser apt apt-utils libdb4.2 at base-config aptitude libsigc++-1.2-5c102 bsdmainutils console-common console-tools libconsole console-data cpio cron dhcp-client ed exim4 exim4-base exim4-config exim4-daemon-light libgcrypt11 libgnutls11 libgpg-error0 libopencdk8 libtasn1-2 fdutils gettext-base groff-base ifupdown info klogd libssl0.9.7 liblzo1 zlib1g liblockfile1 libpcre3 libwrap0 logrotate mailx man-db libgdbm3 manpages nano net-tools netbase netkit-inetd iputils-ping nvi ppp pppconfig pppoe pppoeconf libpcap0.7 sysklogd tasksel libtextwrap1 tcpd telnet libtext-iconv-perl wget"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+    subst_package () {
+        echo "$3" | tr ' ' '\n' | sed "s/^$1$/$2/" | tr '\n' ' '
+    }
+
+    IPFWTOOL=iptables
+
+    case $ARCH in
+        "alpha")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+            base="$base pciutils"
+	    IPFWTOOL="ipchains"
+            ;;
+        "arm")
+            base="$base libgpmg1"
+	    IPFWTOOL="ipchains iptables"
+            ;;
+        "i386")
+	    required="$(without_package "libperl5.8" "$required")"
+            base="$base pciutils psmisc"
+	    IPFWTOOL="ipchains iptables"
+            ;;
+        "ia64")
+            required="$(subst_package "libc6" "libc6.1" "$required") libreadline4"
+            base="$base elilo efibootmgr dosfstools libparted1.6-12 parted"
+            ;;
+        "m68k")
+            required="$required libreadline4"
+            base="$base atari-bootstrap atari-fdisk amiga-fdisk eject mac-fdisk pmac-fdisk-cross vmelilo"
+	    IPFWTOOL="ipchains"
+            ;;
+        "powerpc")
+            required="$required libreadline4"
+            base="$base mac-fdisk amiga-fdisk psmisc powerpc-utils pciutils hfsutils"
+	    IPFWTOOL="ipchains iptables"
+            ;;
+        "sparc")
+            base="$base silo eject pciutils sparc-utils"
+	    IPFWTOOL="ipchains iptables"
+            ;;
+        "mips")
+            base="$base dvhtool pciutils"
+            ;;
+        "mipsel")
+            base="$base pciutils"
+            ;;
+        "hppa")
+            base="$base palo pciutils"
+            required="$(without_package "libstdc++2.10-glibc2.2" "$required")"
+            ;;
+        s390|s390x)
+            # base-config depends on console-tools and console-data
+            # so we can't exclude them although they are useless on s390
+            base="$base s390-tools telnetd devfsd"
+            base="$(without_package "console-tools-libs" "$base")"
+            base="$(without_package "fdutils" "$base")"
+            base="$(without_package "ppp" "$base")"
+            base="$(without_package "pppconfig" "$base")"
+            base="$(without_package "pppoe" "$base")"
+            base="$(without_package "pppoeconf" "$base")"
+            ;;
+	sh*)
+	    base="$base libstdc++3 gcc-3.0-base"
+	    base="$(without_package "fdutils" "$base")"
+	    required="$required libgcc1"
+	    required="$(without_package "libstdc++2.10-glibc2.2" "$required")"
+	    ;;
+        "amd64")
+            base="$base pciutils psmisc"
+	    IPFWTOOL="iptables"
+            ;;
+        *)
+            # who knows?
+            ;;
+    esac
+
+    base="$base $IPFWTOOL"
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    setup_proc
+    in_target /sbin/ldconfig
+
+    DEBIAN_FRONTEND=noninteractive
+    DEBCONF_NONINTERACTIVE_SEEN=true
+    export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+    baseprog=0
+    bases=40
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTBASE "Installing base system" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTBASE "Installing base system" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTBASE "Installing base system" #7
+    x_core_install debconf
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #8
+    smallyes '' | repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --force-depends --unpack $(debfor $required)
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #18
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #19
+    smallyes '' | in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --configure --pending --force-configure-any --force-depends
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #29
+
+#    if [ ! -e "$TARGET/etc/exim/exim.conf" ]; then
+#        mkdir -p "$TARGET/etc/exim"
+#        touch "$TARGET/etc/exim/exim.conf"
+#    fi
+
+    info INSTBASE "Installing base packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #30
+    smallyes '' | repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base)
+
+    rm -f "$TARGET/usr/sbin/sendmail"
+    ln -sf /bin/true "$TARGET/usr/sbin/sendmail"
+
+    smallyes '' | repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg  --force-confold --skip-same-version  --configure -a
+
+    rm -f "$TARGET/usr/sbin/sendmail"
+    ln -sf exim4 "$TARGET/usr/sbin/sendmail"
+
+    p 9; progress $baseprog $bases INSTBASE "Installing base system" #39
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases INSTBASE "Installing base system" #40
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge.buildd b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge.buildd
new file mode 100644
index 00000000..c674672c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge.buildd
@@ -0,0 +1,166 @@
+mirror_style release
+download_style apt
+force_md5
+
+LIBC=libc6
+if [ "$ARCH" = "alpha" ] || [ "$ARCH" = "ia64" ]; then
+  LIBC="libc6.1"
+fi
+
+work_out_debs () {
+
+    required="base-files base-passwd bash bsdutils coreutils debianutils diff dpkg dselect e2fslibs e2fsprogs findutils gcc-3.3-base grep gzip hostname initscripts libacl1 libattr1 libblkid1 libc6 libcap1 libcomerr2 libdb1-compat libdb3 libgcc1 libncurses5 libpam-modules libpam-runtime libpam0g libss2 libstdc++5 libuuid1 login mawk mount ncurses-base ncurses-bin passwd perl-base sed slang1a-utf8 sysv-rc sysvinit tar util-linux zlib1g"
+
+    base="apt binutils cpio cpp cpp-3.3 dpkg-dev g++ g++-3.3 gcc gcc-3.3 libc6-dev libdb4.2 libgdbm3 libstdc++5-3.3-dev linux-kernel-headers make patch perl perl-modules"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+    subst_package () {
+        echo "$3" | tr ' ' '\n' | sed "s/^$1$/$2/" | tr '\n' ' '
+    }
+
+    case $ARCH in
+        "alpha")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+	    base="$(subst_package "libc6-dev" "libc6.1-dev" "$base")"
+            ;;
+        "arm")
+            ;;
+        "i386")
+            ;;
+        "ia64")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+	    base="$(subst_package "libc6-dev" "libc6.1-dev" "$base")"
+            ;;
+        "m68k")
+            ;;
+        "powerpc")
+            ;;
+        "sparc")
+            ;;
+        "mips")
+            ;;
+        "mipsel")
+            ;;
+        "hppa")
+            ;;
+        s390|s390x)
+            ;;
+	sh*)
+	    ;;
+        *)
+            # who knows?
+            ;;
+    esac
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    setup_proc
+    in_target /sbin/ldconfig
+
+    DEBIAN_FRONTEND=noninteractive
+    export DEBIAN_FRONTEND
+
+    baseprog=0
+    bases=40
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTBASE "Installing base system" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTBASE "Installing base system" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTBASE "Installing base system" #7
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #8
+    smallyes '' | repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --force-depends --unpack $(debfor $required)
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #18
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #19
+    smallyes '' | in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --configure --pending --force-configure-any --force-depends
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #29
+
+    info INSTBASE "Installing base packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #30
+    smallyes '' | repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base)
+
+    smallyes '' | repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg  --force-confold --skip-same-version  --configure -a
+
+    p 9; progress $baseprog $bases INSTBASE "Installing base system" #39
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases INSTBASE "Installing base system" #40
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge.fakechroot b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge.fakechroot
new file mode 100644
index 00000000..df3ae1b4
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sarge.fakechroot
@@ -0,0 +1,171 @@
+test "$FAKECHROOT" = "true" || error 1 FAKECHROOTREQ "This variant requires fakechroot environment to be started"
+
+mirror_style release
+download_style apt
+force_md5
+
+LIBC=libc6
+if [ "$ARCH" = "alpha" ] || [ "$ARCH" = "ia64" ]; then
+  LIBC="libc6.1"
+fi
+
+work_out_debs () {
+
+    required="base-files base-passwd bash bsdutils coreutils debianutils diff dpkg dselect e2fslibs e2fsprogs findutils gcc-3.3-base grep gzip hostname initscripts libacl1 libattr1 libblkid1 libc6 libcap1 libcomerr2 libdb1-compat libdb3 libgcc1 libncurses5 libpam-modules libpam-runtime libpam0g libss2 libstdc++5 libuuid1 login mawk mount ncurses-base ncurses-bin passwd perl-base sed slang1a-utf8 sysv-rc sysvinit tar util-linux zlib1g"
+
+    base="apt binutils cpio cpp cpp-3.3 dpkg-dev g++ g++-3.3 gcc gcc-3.3 libc6-dev libdb4.2 libgdbm3 libstdc++5-3.3-dev linux-kernel-headers make patch perl perl-modules"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+    subst_package () {
+        echo "$3" | tr ' ' '\n' | sed "s/^$1$/$2/" | tr '\n' ' '
+    }
+
+    required="$required binutils fakechroot"
+    base="$(without_package "binutils" "$base")"
+
+    case $ARCH in
+        "alpha")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+	    base="$(subst_package "libc6-dev" "libc6.1-dev" "$base")"
+            ;;
+        "arm")
+            ;;
+        "i386")
+            ;;
+        "ia64")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+	    base="$(subst_package "libc6-dev" "libc6.1-dev" "$base")"
+            ;;
+        "m68k")
+            ;;
+        "powerpc")
+            ;;
+        "sparc")
+            ;;
+        "mips")
+            ;;
+        "mipsel")
+            ;;
+        "hppa")
+            ;;
+        s390|s390x)
+            ;;
+	sh*)
+	    ;;
+        *)
+            # who knows?
+            ;;
+    esac
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    : >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    setup_devices_fakechroot
+    setup_proc_fakechroot
+
+    DEBIAN_FRONTEND=noninteractive
+    export DEBIAN_FRONTEND
+
+    baseprog=0
+    bases=40
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTBASE "Installing base system" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    install_fakechroot_tools
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTBASE "Installing base system" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTBASE "Installing base system" #7
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #8
+    smallyes '' | repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --force-depends --unpack $(debfor $required)
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #18
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #19
+    smallyes '' | in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --configure --pending --force-configure-any --force-depends
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #29
+
+    info INSTBASE "Installing base packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #30
+    smallyes '' | repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base)
+
+    smallyes '' | repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg  --force-confold --skip-same-version  --configure -a
+
+    p 9; progress $baseprog $bases INSTBASE "Installing base system" #39
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases INSTBASE "Installing base system" #40
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/saucy b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/saucy
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/saucy
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sid b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sid
new file mode 100644
index 00000000..1d96477c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/sid
@@ -0,0 +1,214 @@
+mirror_style release
+download_style apt
+finddebs_style from-indices
+variants - buildd fakechroot minbase
+keyring /usr/share/keyrings/debian-archive-keyring.gpg
+
+if doing_variant fakechroot; then
+	test "$FAKECHROOT" = "true" || error 1 FAKECHROOTREQ "This variant requires fakechroot environment to be started"
+fi
+
+case $ARCH in
+	alpha|ia64) LIBC="libc6.1" ;;
+	kfreebsd-*) LIBC="libc0.1" ;;
+	hurd-*)     LIBC="libc0.3" ;;
+	*)          LIBC="libc6" ;;
+esac
+
+work_out_debs () {
+	required="$(get_debs Priority: required)"
+
+	if doing_variant - || doing_variant fakechroot; then
+		#required="$required $(get_debs Priority: important)"
+		#  ^^ should be getting debconf here somehow maybe
+		base="$(get_debs Priority: important)"
+	elif doing_variant buildd; then
+		base="apt build-essential"
+	elif doing_variant minbase; then
+		base="apt"
+	fi
+
+	if doing_variant fakechroot; then
+		# ldd.fake needs binutils
+		required="$required binutils"
+	fi
+
+	case $MIRRORS in
+	    https://*)
+		base="$base apt-transport-https ca-certificates"
+		;;
+	esac
+}
+
+first_stage_install () {
+	case "$CODENAME" in
+		etch|etch-m68k|jessie|jessie-kfreebsd|lenny|squeeze|wheezy) ;;
+		*)
+			EXTRACT_DEB_TAR_OPTIONS="$EXTRACT_DEB_TAR_OPTIONS -k"
+			setup_merged_usr
+			;;
+	esac
+
+	extract $required
+
+	mkdir -p "$TARGET/var/lib/dpkg"
+	: >"$TARGET/var/lib/dpkg/status"
+	: >"$TARGET/var/lib/dpkg/available"
+
+	setup_etc
+	if [ ! -e "$TARGET/etc/fstab" ]; then
+		echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+		chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+	fi
+
+	setup_devices
+}
+
+second_stage_install () {
+	setup_dynamic_devices
+
+	x_feign_install () {
+		local pkg="$1"
+		local deb="$(debfor $pkg)"
+		local ver="$(in_target dpkg-deb -f "$deb" Version)"
+
+		mkdir -p "$TARGET/var/lib/dpkg/info"
+
+		echo \
+"Package: $pkg
+Version: $ver
+Maintainer: unknown
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+		touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+	}
+
+	x_feign_install dpkg
+
+	x_core_install () {
+		smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+	}
+
+	p () {
+		baseprog="$(($baseprog + ${1:-1}))"
+	}
+
+	if doing_variant fakechroot; then
+		setup_proc_fakechroot
+	else
+		setup_proc
+		in_target /sbin/ldconfig
+	fi
+
+	DEBIAN_FRONTEND=noninteractive
+	DEBCONF_NONINTERACTIVE_SEEN=true
+	export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+	baseprog=0
+	bases=7
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+	info INSTCORE "Installing core packages..."
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+	ln -sf mawk "$TARGET/usr/bin/awk"
+	x_core_install base-passwd
+	x_core_install base-files
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+	x_core_install dpkg
+
+	if [ ! -e "$TARGET/etc/localtime" ]; then
+		ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+	fi
+
+	if doing_variant fakechroot; then
+		install_fakechroot_tools
+	fi
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+	x_core_install $LIBC
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+	x_core_install perl-base
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+	rm "$TARGET/usr/bin/awk"
+	x_core_install mawk
+
+	p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+	if doing_variant -; then
+		x_core_install debconf
+	fi
+
+	baseprog=0
+	bases=$(set -- $required; echo $#)
+
+	info UNPACKREQ "Unpacking required packages..."
+
+	exec 7>&1
+
+	smallyes '' |
+		(repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" \
+		dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 || echo EXITCODE $?) |
+		dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING
+
+	info CONFREQ "Configuring required packages..."
+
+	echo \
+"#!/bin/sh
+exit 101" > "$TARGET/usr/sbin/policy-rc.d"
+	chmod 755 "$TARGET/usr/sbin/policy-rc.d"
+
+	mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+	echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+	chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+	setup_dselect_method apt
+
+	smallyes '' |
+		(in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" \
+		dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 || echo EXITCODE $?) |
+		dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING
+
+	baseprog=0
+	bases="$(set -- $base; echo $#)"
+
+	info UNPACKBASE "Unpacking the base system..."
+
+	setup_available $required $base
+	done_predeps=
+	while predep=$(get_next_predep); do
+		# We have to resolve dependencies of pre-dependencies manually because
+		# dpkg --predep-package doesn't handle this.
+		predep=$(without "$(without "$(resolve_deps $predep)" "$required")" "$done_predeps")
+		# XXX: progress is tricky due to how dpkg_progress works
+		# -- cjwatson 2009-07-29
+		p; smallyes '' |
+		in_target dpkg --force-overwrite --force-confold --skip-same-version --install $(debfor $predep)
+		base=$(without "$base" "$predep")
+		done_predeps="$done_predeps $predep"
+	done
+
+	if [ -n "$base" ]; then
+		smallyes '' |
+			(repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" \
+			dpkg --status-fd 8 --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 || echo EXITCODE $?) |
+			dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING
+
+		info CONFBASE "Configuring the base system..."
+
+		smallyes '' |
+			(repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be re-attempted up to five times." "" \
+			dpkg --status-fd 8 --force-confold --skip-same-version --configure -a 8>&1 1>&7 || echo EXITCODE $?) |
+			dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING
+	fi
+
+	mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+	rm -f "$TARGET/usr/sbin/policy-rc.d"
+
+	progress $bases $bases CONFBASE "Configuring base system"
+	info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/squeeze b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/squeeze
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/squeeze
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/stable b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/stable
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/stable
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/stretch b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/stretch
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/stretch
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/testing b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/testing
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/testing
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/trusty b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/trusty
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/trusty
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/unstable b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/unstable
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/unstable
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/utopic b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/utopic
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/utopic
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/vivid b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/vivid
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/vivid
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/warty b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/warty
new file mode 100644
index 00000000..e21a6d8c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/warty
@@ -0,0 +1,166 @@
+default_mirror http://old-releases.ubuntu.com/ubuntu
+mirror_style release
+download_style apt
+
+LIBC=libc6
+
+work_out_debs () {
+
+    required="base-files base-passwd bash bsdutils coreutils libacl1 libattr1 debconf debconf-i18n liblocale-gettext-perl libtext-iconv-perl libtext-wrapi18n-perl libtext-charwidth-perl debianutils diff dpkg dselect libblkid1 e2fsprogs e2fslibs libcomerr2 libss2 libuuid1 findutils grep gzip hostname libcap1 libc6 libdb1-compat libdb3 libncurses5 libnewt0.51 libpam-modules libpam-runtime libpam0g libpopt0 login makedev mawk modutils mount ncurses-base ncurses-bin passwd perl-base procps sed slang1a-utf8 lsb-base initscripts sysvinit sysv-rc tar util-linux zlib1g whiptail libgcc1 gcc-3.3-base libstdc++5"
+
+    base="adduser alsa-base alsa-utils apt apt-utils aptitude at base-config bind9-host bsdmainutils bzip2 console-common console-data console-tools cpio cramfsprogs cron dash dbus-1 dhcp3-client dhcp3-common discover1 discover1-data dmsetup dnsutils dosfstools ed eject evms evms-ncurses fdutils file ftp gettext-base gnupg groff-base hdparm hotplug ifrename ifupdown info initrd-tools iproute iptables iputils-arping iputils-ping iputils-tracepath jfsutils klogd less libasound2 libatm1 libbz2-1.0 libconsole libdb4.2 libdevmapper1.00 libdiscover1 libdns16 libevms-2.3 libexpat1 libfribidi0 libgc1 libgcrypt7 libgdbm3 libgnutls10 libgpg-error0 libgpmg1 libidn11 libisc7 libiw27 libldap2 liblockfile1 liblwres1 liblzo1 libmagic1 libncursesw5 libopencdk8 libparted1.6-0 libpcap0.7 libpcap0.8 libreiserfs0.3-0 libsasl2 libsigc++-1.2-5c102 libssl0.9.7 libtasn1-2 libusb-0.1-4 libwrap0 locales logrotate lshw lsof ltrace lvm-common lvm10 lvm2 mailx man-db manpages mdadm mii-diag mime-support module-init-tools mtr-tiny mutt nano net-tools netbase netcat netkit-inetd ntp ntpdate openssh-client parted pciutils popularity-contest postfix postfix-tls ppp pppconfig pppoeconf psmisc python python2.3 reiser4progs reiserfsprogs reportbug rsync strace sudo sysklogd tcpd tcpdump telnet time ubuntu-base udev usbutils vim vim-common w3m wget wireless-tools xfsprogs"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+    subst_package () {
+        echo "$3" | tr ' ' '\n' | sed "s/^$1$/$2/" | tr '\n' ' '
+    }
+
+    case $ARCH in
+        "i386")
+            required="$required libc6-i686"
+            base="$base dmidecode memtest86+ libreadline4"
+            ;;
+        "powerpc")
+            required="$required libreadline4"
+            base="$base hfsplus hfsutils libhfsp0 mac-fdisk pmac-fdisk powerpc-utils"
+            ;;
+        "amd64")
+            base="$base dmidecode libreadline4"
+            ;;
+        *)
+            # who knows?
+            ;;
+    esac
+}
+
+install_debs () {
+    first_stage_install
+    second_stage_install
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    DEBIAN_FRONTEND=noninteractive
+    DEBCONF_NONINTERACTIVE_SEEN=true
+    export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+    setup_proc
+    in_target /sbin/ldconfig
+
+    baseprog=0
+    bases=7
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+    x_core_install debconf
+
+    baseprog=0
+    bases="$(set -- $required; echo $#)"
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    smallyes '' | (repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --status-fd 8 --force-depends --unpack $(debfor $required) 8>&1 1>&7 | dpkg_progress $baseprog $bases UNPACKREQ "Unpacking required packages" UNPACKING) 7>&1
+
+    baseprog=0
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+    #on_exit "(in_target_nofail umount /dev/pts) || true"
+
+    smallyes '' | (in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --status-fd 8 --configure --pending --force-configure-any --force-depends 8>&1 1>&7 | dpkg_progress $baseprog $bases CONFREQ "Configuring required packages" CONFIGURING) 7>&1
+
+    baseprog=0
+    bases="$(set -- $base; echo $#)"
+
+    info UNPACKBASE "Unpacking the base system..."
+
+    smallyes '' | (repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --status-fd 8 --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base) 8>&1 1>&7 | dpkg_progress $baseprog $bases UNPACKBASE "Unpacking base system" UNPACKING) 7>&1
+
+    baseprog=0
+
+    info CONFBASE "Configuring the base system..."
+
+    mv "$TARGET/usr/sbin/sendmail" "$TARGET/usr/sbin/sendmail.REAL"
+    ln -s /bin/true "$TARGET/usr/sbin/sendmail"
+
+    smallyes '' | (repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg --status-fd 8 --force-confold --skip-same-version  --configure -a 8>&1 1>&7 | dpkg_progress $baseprog $bases CONFBASE "Configuring base system" CONFIGURING) 7>&1
+
+    rm -f "$TARGET/usr/sbin/sendmail"
+    mv "$TARGET/usr/sbin/sendmail.REAL" "$TARGET/usr/sbin/sendmail"
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases CONFBASE "Configuring base system"
+    info BASESUCCESS "Base system installed successfully."
+}
+
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/warty.buildd b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/warty.buildd
new file mode 100644
index 00000000..09c5467c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/warty.buildd
@@ -0,0 +1,159 @@
+default_mirror http://old-releases.ubuntu.com/ubuntu
+mirror_style release
+download_style apt
+
+LIBC=libc6
+if [ "$ARCH" = "alpha" ] || [ "$ARCH" = "ia64" ]; then
+  LIBC="libc6.1"
+fi
+
+work_out_debs () {
+
+    required="base-files base-passwd bash bsdutils build-essential coreutils debianutils diff dpkg dselect e2fslibs e2fsprogs fakeroot findutils gcc-3.3-base grep gzip hostname initscripts libacl1 libattr1 libblkid1 libc6 libcap1 libcomerr2 libdb1-compat libdb3 libgcc1 libncurses5 libpam-modules libpam-runtime libpam0g libss2 libstdc++5 libuuid1 login lsb-base mawk mount ncurses-base ncurses-bin perl-base sed slang1a-utf8 sysv-rc sysvinit tar util-linux zlib1g"
+
+    base="apt binutils cpio cpp cpp-3.3 dpkg-dev g++ g++-3.3 gcc gcc-3.3 libc6-dev libdb4.2 libgdbm3 libstdc++5-3.3-dev linux-kernel-headers make patch perl perl-modules"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+    subst_package () {
+        echo "$3" | tr ' ' '\n' | sed "s/^$1$/$2/" | tr '\n' ' '
+    }
+
+    case $ARCH in
+        "amd64")
+            ;;
+        "i386")
+            ;;
+	"powerpc")
+	    ;;
+
+	# Unsupported architectures:
+        "alpha")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+	    base="$(subst_package "libc6-dev" "libc6.1-dev" "$base")"
+            ;;
+        "ia64")
+            required="$(subst_package "libc6" "libc6.1" "$required")"
+	    base="$(subst_package "libc6-dev" "libc6.1-dev" "$base")"
+            ;;
+        *)
+            # who knows?
+            ;;
+    esac
+}
+
+install_debs () {
+    first_stage_install
+    second_stage_install
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    DEBIAN_FRONTEND=noninteractive
+    export DEBIAN_FRONTEND
+
+    baseprog=0
+    bases=40
+
+    setup_proc
+    in_target /sbin/ldconfig
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #7
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #8
+    smallyes '' | repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --force-depends --unpack $(debfor $required)
+    p 10; progress $baseprog $bases INSTCORE "Installing core packages" #18
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+    #on_exit "in_target_nofail umount /dev/pts"
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #19
+    smallyes '' | in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --configure --pending --force-configure-any --force-depends
+    p 10; progress $baseprog $bases INSTCORE "Installing core packages" #29
+
+    info INSTCORE "Installing base packages..."
+
+    p; progress $baseprog $bases INSTCORE "Installing core packages" #30
+    smallyes '' | repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base)
+
+    smallyes '' | repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg  --force-confold --skip-same-version  --configure -a
+
+    p 9; progress $baseprog $bases INSTCORE "Installing core packages" #39
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases INSTCORE "Installing core packages" #40
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/wheezy b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/wheezy
new file mode 120000
index 00000000..9a63c961
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/wheezy
@@ -0,0 +1 @@
+sid
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/wily b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/wily
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/wily
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/woody b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/woody
new file mode 100644
index 00000000..12c65a37
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/woody
@@ -0,0 +1,203 @@
+mirror_style release
+download_style apt
+force_md5
+
+LIBC=libc6
+if [ "$ARCH" = "alpha" ] || [ "$ARCH" = "ia64" ]; then
+  LIBC="libc6.1"
+fi
+
+work_out_debs () {
+
+    required="base-files base-passwd bash bsdutils debconf debianutils diff dpkg e2fsprogs fileutils findutils grep gzip hostname libcap1 libc6 libdb2 libdb3 libncurses5 libnewt0 libpam-modules libpam-runtime libpam0g libperl5.6 libpopt0 libreadline4 libstdc++2.10-glibc2.2 login makedev mawk modutils mount ncurses-base ncurses-bin passwd perl-base procps sed shellutils slang1 sysvinit tar textutils util-linux whiptail"
+
+    base="adduser apt apt-utils at base-config bsdmainutils console-common console-tools console-tools-libs console-data cpio cron dhcp-client ed exim fdutils gettext-base groff-base ifupdown info klogd libident libldap2 liblockfile1 libpcre3 libsasl7 libwrap0 logrotate mailx man-db manpages modconf nano net-tools netbase netkit-inetd netkit-ping nvi ppp pppconfig pppoe pppoeconf libpcap0 sysklogd tasksel tcpd telnet"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+
+    IPFWTOOL=iptables
+
+    case $ARCH in
+        "alpha")
+            required="$(without_package "libc6" "$required") libc6.1"
+            base="$base setserial aboot pciutils"
+	    IPFWTOOL="ipchains"
+            ;;
+        "arm")
+            base="$base setserial libgpmg1"
+	    IPFWTOOL="ipchains iptables"
+            ;;
+        "i386")
+            required="$(without_package "libperl5.6" "$required") mbr"
+            base="$base lilo pciutils setserial syslinux psmisc pcmcia-cs"
+	    IPFWTOOL="ipchains iptables"
+            ;;
+        "ia64")
+            required="$(without_package "libc6" "$required") libc6.1 gcc-2.96-base"
+            base="$base elilo efibootmgr dosfstools libparted1.4 parted"
+            ;;
+        "m68k")
+            base="$base atari-bootstrap atari-fdisk amiga-fdisk eject mac-fdisk pmac-fdisk-cross setserial vmelilo"
+	    IPFWTOOL="ipchains"
+            ;;
+        "powerpc")
+            base="$base quik mac-fdisk amiga-fdisk psmisc powerpc-utils setserial pciutils hfsutils yaboot pcmcia-cs"
+	    IPFWTOOL="ipchains iptables"
+            ;;
+        "sparc")
+            base="$base silo eject pciutils sparc-utils"
+	    IPFWTOOL="ipchains iptables"
+            ;;
+        "mips")
+            base="$base dvhtool pciutils setserial" # pcmcia-cs
+            ;;
+        "mipsel")
+            base="$base delo pciutils setserial" # pcmcia-cs
+            ;;
+        "hppa")
+            base="$base palo libstdc++3 gcc-3.0-base"
+            required="$(without_package "libstdc++2.10-glibc2.2" "$required")"
+            ;;
+        s390|s390x)
+            # base-config depends on console-data and console-common
+            # so we can't exclude them although they are useless on s390
+            base="$base s390-tools telnetd devfsd"
+            base="$(without_package "console-tools" "$base")"
+            base="$(without_package "console-tools-libs" "$base")"
+            base="$(without_package "fdutils" "$base")"
+            base="$(without_package "ppp" "$base")"
+            base="$(without_package "pppconfig" "$base")"
+            base="$(without_package "pppoe" "$base")"
+            base="$(without_package "pppoeconf" "$base")"
+            ;;
+        *)
+            # who knows?
+            ;;
+    esac
+
+    base="$base $IPFWTOOL"
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    setup_proc
+    in_target /sbin/ldconfig
+
+    DEBIAN_FRONTEND=Noninteractive
+    export DEBIAN_FRONTEND
+
+    baseprog=0
+    bases=40
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTBASE "Installing base system" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTBASE "Installing base system" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTBASE "Installing base system" #7
+    x_core_install debconf
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #8
+    smallyes '' | repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --force-depends --unpack $(debfor $required)
+    p 10; progress $baseprog $bases INSTBASE "Installing base system"  #18
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #19
+    smallyes '' | in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --configure --pending --force-configure-any --force-depends
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #29
+
+    if [ ! -e "$TARGET/etc/exim/exim.conf" ]; then
+        mkdir -p "$TARGET/etc/exim"
+        touch "$TARGET/etc/exim/exim.conf"
+    fi
+
+    info INSTBASE "Installing base packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #30
+    smallyes '' | repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base)
+
+    rm -f "$TARGET/usr/sbin/sendmail"
+    ln -sf /bin/true "$TARGET/usr/sbin/sendmail"
+
+    smallyes '' | repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg  --force-confold --skip-same-version  --configure -a
+
+    rm -f "$TARGET/usr/sbin/sendmail"
+    ln -sf exim "$TARGET/usr/sbin/sendmail"
+
+    p 9; progress $baseprog $bases INSTBASE "Installing base system" #39
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases INSTBASE "Installing base system" #40
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/woody.buildd b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/woody.buildd
new file mode 100644
index 00000000..0dd8d50c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/woody.buildd
@@ -0,0 +1,166 @@
+mirror_style release
+download_style apt
+force_md5
+
+LIBC=libc6
+if [ "$ARCH" = "alpha" ] || [ "$ARCH" = "ia64" ]; then
+  LIBC="libc6.1"
+fi
+
+work_out_debs () {
+
+    required="base-files base-passwd bash bsdutils debianutils diff dpkg e2fsprogs fileutils findutils grep gzip hostname libc6 libcap1 libdb3 libgdbmg1 libncurses5 libpam-modules libpam-runtime libpam0g libperl5.6 libstdc++2.10-glibc2.2 login mawk mount ncurses-base ncurses-bin perl-base sed shellutils slang1 sysvinit tar textutils util-linux"
+
+    base="apt binutils cpio cpp cpp-2.95 debconf dpkg-dev g++ g++-2.95 gcc gcc-2.95 libc6-dev libdb2 libstdc++2.10-dev make patch perl perl-modules"
+
+    without_package () {
+        echo "$2" | tr ' ' '\n' | grep -v "^$1$" | tr '\n' ' '
+    }
+
+    case $ARCH in
+        "alpha")
+            required="$(without_package "libc6" "$required") libc6.1"
+	    base="$(without_package "libc6-dev" "$base") libc6.1-dev"
+            ;;
+        "arm")
+            ;;
+        "i386")
+            ;;
+        "ia64")
+	    required="$(without_package "libc6" "$required") libc6.1 gcc-2.96-base libreadline4"
+	    base="$(without_package "cpp-2.95" "$base") cpp-2.96"
+	    base="$(without_package "gcc-2.95" "$base") gcc-2.96"
+	    base="$(without_package "g++-2.95" "$base") g++-2.96"
+	    base="$(without_package "libc6-dev" "$base") libc6.1-dev elilo efibootmgr dosfstools libparted1.4 parted"
+            ;;
+        "m68k")
+            ;;
+        "powerpc")
+            ;;
+        "sparc")
+            ;;
+        "mips")
+            ;;
+        "mipsel")
+            ;;
+        "hppa")
+            ;;
+        s390|s390x)
+            ;;
+	sh*)
+	    ;;
+        *)
+            # who knows?
+            ;;
+    esac
+}
+
+first_stage_install () {
+    extract $required
+
+    mkdir -p "$TARGET/var/lib/dpkg"
+    : >"$TARGET/var/lib/dpkg/status"
+    echo >"$TARGET/var/lib/dpkg/available"
+
+    setup_etc
+    if [ ! -e "$TARGET/etc/fstab" ]; then
+        echo '# UNCONFIGURED FSTAB FOR BASE SYSTEM' > "$TARGET/etc/fstab"
+        chown 0:0 "$TARGET/etc/fstab"; chmod 644 "$TARGET/etc/fstab"
+    fi
+
+    setup_devices
+
+    x_feign_install () {
+        local pkg="$1"
+        local deb="$(debfor $pkg)"
+        local ver="$(extract_deb_field "$TARGET/$deb" Version)"
+
+        mkdir -p "$TARGET/var/lib/dpkg/info"
+
+        echo \
+"Package: $pkg
+Version: $ver
+Status: install ok installed" >> "$TARGET/var/lib/dpkg/status"
+
+        touch "$TARGET/var/lib/dpkg/info/${pkg}.list"
+    }
+
+    x_feign_install dpkg
+}
+
+second_stage_install () {
+    x_core_install () {
+	smallyes '' | in_target dpkg --force-depends --install $(debfor "$@")
+    }
+
+    p () {
+	baseprog="$(($baseprog + ${1:-1}))"
+    }
+
+    setup_proc
+    in_target /sbin/ldconfig
+
+    DEBIAN_FRONTEND=noninteractive
+    export DEBIAN_FRONTEND
+
+    baseprog=0
+    bases=40
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #1
+    info INSTCORE "Installing core packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #2
+    ln -sf mawk "$TARGET/usr/bin/awk"
+    x_core_install base-files base-passwd
+    p; progress $baseprog $bases INSTBASE "Installing base system" #3
+    x_core_install dpkg
+
+    if [ ! -e "$TARGET/etc/localtime" ]; then
+        ln -sf /usr/share/zoneinfo/UTC "$TARGET/etc/localtime"
+    fi
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #4
+    x_core_install $LIBC
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #5
+    x_core_install perl-base
+    p; progress $baseprog $bases INSTBASE "Installing base system" #6
+    rm "$TARGET/usr/bin/awk"
+    x_core_install mawk
+    p; progress $baseprog $bases INSTBASE "Installing base system" #7
+
+    info UNPACKREQ "Unpacking required packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #8
+    smallyes '' | repeatn 5 in_target_failmsg UNPACK_REQ_FAIL_FIVE "Failure while unpacking required packages.  This will be attempted up to five times." "" dpkg --force-depends --unpack $(debfor $required)
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #18
+
+    info CONFREQ "Configuring required packages..."
+
+    mv "$TARGET/sbin/start-stop-daemon" "$TARGET/sbin/start-stop-daemon.REAL"
+    echo \
+"#!/bin/sh
+echo
+echo \"Warning: Fake start-stop-daemon called, doing nothing\"" > "$TARGET/sbin/start-stop-daemon"
+    chmod 755 "$TARGET/sbin/start-stop-daemon"
+
+    setup_dselect_method apt
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #19
+    smallyes '' | in_target_failmsg CONF_REQ_FAIL "Failure while configuring required packages." "" dpkg --configure --pending --force-configure-any --force-depends
+    p 10; progress $baseprog $bases INSTBASE "Installing base system" #29
+
+    info INSTBASE "Installing base packages..."
+
+    p; progress $baseprog $bases INSTBASE "Installing base system" #30
+    smallyes '' | repeatn 5 in_target_failmsg INST_BASE_FAIL_FIVE "Failure while installing base packages.  This will be re-attempted up to five times." "" dpkg --force-auto-select --force-overwrite --force-confold --skip-same-version --unpack $(debfor $base)
+
+    smallyes '' | repeatn 5 in_target_failmsg CONF_BASE_FAIL_FIVE "Failure while configuring base packages.  This will be attempted 5 times." "" dpkg  --force-confold --skip-same-version  --configure -a
+
+    p 9; progress $baseprog $bases INSTBASE "Installing base system" #39
+
+    mv "$TARGET/sbin/start-stop-daemon.REAL" "$TARGET/sbin/start-stop-daemon"
+
+    progress $bases $bases INSTBASE "Installing base system" #40
+    info BASESUCCESS "Base system installed successfully."
+}
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/xenial b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/xenial
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/xenial
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/yakkety b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/yakkety
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/yakkety
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/zesty b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/zesty
new file mode 120000
index 00000000..3840936c
--- /dev/null
+++ b/cdist/preos/debootstrap/files/devuan-debootstrap/scripts/zesty
@@ -0,0 +1 @@
+gutsy
\ No newline at end of file
diff --git a/cdist/preos/debootstrap/files/init-manifest-debian b/cdist/preos/debootstrap/files/init-manifest-debian
new file mode 100644
index 00000000..bf8cd07e
--- /dev/null
+++ b/cdist/preos/debootstrap/files/init-manifest-debian
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+# basic init manifest for PreOS config
+
+for pkg in \
+    file \
+    linux-image-amd64 \
+    lsb-release \
+    dosfstools \
+    gdisk \
+    openssh-server curl \
+    pxelinux syslinux-common \
+    gdisk util-linux lvm2 mdadm \
+    btrfs-tools e2fsprogs jfsutils reiser4progs xfsprogs; do
+    __package $pkg --state present
+done
+
+# initramfs requires /init
+__link /init --source /sbin/init --type symbolic
+
+__file /etc/network/interfaces --source - --mode 0644 << eof
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+# The primary network interface
+auto eth0
+allow-hotplug eth0
+iface eth0 inet dhcp
+eof
+
+# Steven found this out - coyping it 1:1
+# fix the bloody 'stdin: is not a tty' problem
+__line /root/.profile --line 'mesg n' --state absent
+
+# skipped for now, in case of systemd __hostname uses
+# hostnamectl for setting hostname and it needs dbus running
+# __hostname --name preos
+# hostname setting is currently done before this configuration
diff --git a/cdist/preos/debootstrap/files/init-manifest-devuan b/cdist/preos/debootstrap/files/init-manifest-devuan
new file mode 100644
index 00000000..bf8cd07e
--- /dev/null
+++ b/cdist/preos/debootstrap/files/init-manifest-devuan
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+# basic init manifest for PreOS config
+
+for pkg in \
+    file \
+    linux-image-amd64 \
+    lsb-release \
+    dosfstools \
+    gdisk \
+    openssh-server curl \
+    pxelinux syslinux-common \
+    gdisk util-linux lvm2 mdadm \
+    btrfs-tools e2fsprogs jfsutils reiser4progs xfsprogs; do
+    __package $pkg --state present
+done
+
+# initramfs requires /init
+__link /init --source /sbin/init --type symbolic
+
+__file /etc/network/interfaces --source - --mode 0644 << eof
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+# The primary network interface
+auto eth0
+allow-hotplug eth0
+iface eth0 inet dhcp
+eof
+
+# Steven found this out - coyping it 1:1
+# fix the bloody 'stdin: is not a tty' problem
+__line /root/.profile --line 'mesg n' --state absent
+
+# skipped for now, in case of systemd __hostname uses
+# hostnamectl for setting hostname and it needs dbus running
+# __hostname --name preos
+# hostname setting is currently done before this configuration
diff --git a/cdist/preos/debootstrap/files/init-manifest-ubuntu b/cdist/preos/debootstrap/files/init-manifest-ubuntu
new file mode 100644
index 00000000..6886ef53
--- /dev/null
+++ b/cdist/preos/debootstrap/files/init-manifest-ubuntu
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+# basic init manifest for PreOS config
+
+for pkg in \
+    file \
+    linux-image-generic \
+    lsb-release \
+    dosfstools \
+    gdisk \
+    openssh-server curl \
+    pxelinux syslinux-common \
+    gdisk util-linux lvm2 mdadm \
+    btrfs-tools e2fsprogs jfsutils reiser4progs xfsprogs; do
+    __package $pkg --state present
+done
+
+# initramfs requires /init
+__link /init --source /sbin/init --type symbolic
+
+__file /etc/network/interfaces --source - --mode 0644 << eof
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+# The primary network interface
+auto eth0
+allow-hotplug eth0
+iface eth0 inet dhcp
+eof
+
+# Steven found this out - coyping it 1:1
+# fix the bloody 'stdin: is not a tty' problem
+__line /root/.profile --line 'mesg n' --state absent
+
+# skipped for now, in case of systemd __hostname uses
+# hostnamectl for setting hostname and it needs dbus running
+# __hostname --name preos
+# hostname setting is currently done before this configuration
diff --git a/cdist/preos/debootstrap/files/remote-copy.sh b/cdist/preos/debootstrap/files/remote-copy.sh
new file mode 100755
index 00000000..4f83f313
--- /dev/null
+++ b/cdist/preos/debootstrap/files/remote-copy.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# echo $@
+# set -x
+src=$1; shift
+dst=$1; shift
+real_dst=$(echo $dst | sed 's,:,,')
+cp -L "$src" "$real_dst"
diff --git a/cdist/preos/debootstrap/files/remote-exec.sh b/cdist/preos/debootstrap/files/remote-exec.sh
new file mode 100755
index 00000000..3c4bcf2f
--- /dev/null
+++ b/cdist/preos/debootstrap/files/remote-exec.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+
+# echo $@
+# set -x
+
+chroot="$1"; shift
+
+script=$(mktemp "${chroot}/tmp/chroot-${0##*/}.XXXXXXXXXX")
+trap cleanup INT TERM EXIT
+cleanup() {
+   [ $__cdist_debug ] || rm "$script"
+}
+
+echo "#!/bin/sh -l" > "$script"
+echo "$@" >> "$script"
+chmod +x "$script"
+
+relative_script="${script#$chroot}"
+
+# ensure PATH is setup
+export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin
+
+# run in chroot
+chroot "$chroot" "$relative_script"
diff --git a/completions/bash/cdist-completion.bash b/completions/bash/cdist-completion.bash
index 1311384a..cdac7f29 100644
--- a/completions/bash/cdist-completion.bash
+++ b/completions/bash/cdist-completion.bash
@@ -6,7 +6,7 @@ _cdist()
     prev="${COMP_WORDS[COMP_CWORD-1]}"
     prevprev="${COMP_WORDS[COMP_CWORD-2]}"
     opts="-h --help -q --quiet -v --verbose -V --version"
-    cmds="banner config install inventory shell"
+    cmds="banner config install inventory preos shell"
 
     case "${prevprev}" in
         shell)
diff --git a/completions/zsh/_cdist b/completions/zsh/_cdist
index 405023ed..1bd275ef 100644
--- a/completions/zsh/_cdist
+++ b/completions/zsh/_cdist
@@ -11,7 +11,7 @@ _cdist()
 
     case $state in
         opts_cmds)
-            _arguments '1:Options and commands:(banner config install inventory shell -h --help -q --quiet -v --verbose -V --version)'
+            _arguments '1:Options and commands:(banner config install inventory preos shell -h --help -q --quiet -v --verbose -V --version)'
             ;;
         *)
             case $words[2] in
diff --git a/docs/changelog b/docs/changelog
index e7e6b182..81a5c0ba 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)
+	* Core: Add preos functionality (Darko Poljak)
 
 5.1.3: 2019-08-30
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)
diff --git a/docs/src/cdist-preos.rst b/docs/src/cdist-preos.rst
new file mode 100644
index 00000000..8b3deff8
--- /dev/null
+++ b/docs/src/cdist-preos.rst
@@ -0,0 +1,137 @@
+PreOS
+=====
+
+Description
+-----------
+With cdist you can install and configure new machines. You can use cdist to
+create PreOS, minimal OS which purpose is to boot new machine.
+After PreOS is booted machine is ready for installing desired OS and
+then it is ready for configuration.
+
+PreOS creation
+--------------
+With cdist you can create PreOS.
+Currently supported PreOS-es include:
+
+* debian
+* ubuntu
+* devuan.
+
+PreOS is created using cdist preos command. preos command has subcommands that
+create the desired PreOS.
+
+For example, to create ubuntu PreOS:
+
+.. code-block:: sh
+
+    $ cdist preos ubuntu /preos/preos-ubuntu -b -C \
+        -k ~/.ssh/id_rsa.pub -p /preos/pxe-ubuntu
+
+For more info about available options see cdist manual page.
+
+This will bootstrap (``-b``) ubuntu PreOS in ``/preos/preos-ubuntu`` directory, it
+will be configured (``-C``) using default built-in initial manifest and with
+specified ssh authorized key (``-k``).
+After bootstrapping and configuration PXE
+boot directory will be created (``-p``) in ``/preos/pxe-ubuntu``.
+
+After PreOS is created new machines can be booted using created PXE (after
+proper dhcp, tftp setting).
+
+Since PreOS is configured with ssh authorized key it can be accessed throguh
+ssh, i.e. it can be further installed and configured with cdist.
+
+Implementing new PreOS sub-command
+----------------------------------
+preos command is implemented as a plugin system. This plugin system scans for
+preos subcommands in ``cdist/preos/`` distribution directory and also in
+``~/.cdist/preos/`` directory if it exists.
+
+preos subcommand is a module or a class that satisfies the following:
+
+* it has attribute ``_cdist_preos`` set to ``True``
+* it has function/method ``commandline``.
+
+For a module based preos subcommand ``commandline`` function accepts a module
+object as its first argument and the list of command line
+arguments (``sys.argv[2:]``).
+
+For a class preos subcommand ``commandline`` method should be staticmethod and
+it accepts a class object as its first argument and the list of command line
+arguments(``sys.argv[2:]``).
+
+If preos scanning finds a module/class that has ``_cdist_preos`` set
+to ``True`` and it has function/method ``commandline`` then this module/class is
+registered to preos subcommands. The name of the command is set to ``_preos_name``
+attribute if it exists, otherwise it is set to the module/class name, lowercase.
+When registered preos subcommand is specified as preos command then ``commandline``
+will be called with first argument set to module/class object and second argument
+set to ``sys.argv[2:]``.
+
+Example writing new dummy preos sub-command
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Module based preos:
+^^^^^^^^^^^^^^^^^^^
+
+#. Create directory ``~/.cdist/preos/`` if it does not exist
+#. Create ``~/.cdist/preos/netbsd.py`` with the following contents:
+
+.. code-block:: python
+
+    _preos_name = 'netbsd'
+    _cdist_preos = True
+
+    def commandline(cls, args):
+        print("NetBSD PreOS: {}".format(args))
+
+When you try to run this new preos you will get:
+
+.. code-block:: sh
+
+    $ cdist preos -h
+    usage: cdist preos [-h] preos
+
+    Create PreOS
+
+    positional arguments:
+      preos       PreOS to create, one of: {'netbsd', 'debian', 'ubuntu'}
+
+    optional arguments:
+      -h, --help  show this help message and exit
+    $ cdist preos netbsd
+    NetBSD PreOS: []
+
+Class based preos:
+^^^^^^^^^^^^^^^^^^
+
+#. Create directory ``~/.cdist/preos/`` if it does not exist
+#. Create ``~/.cdist/preos/freebsd.py`` with the following contents:
+
+.. code-block:: python
+
+    class FreeBSD(object):
+        _cdist_preos = True
+
+        @classmethod
+        def commandline(cls, args):
+            print("FreeBSD dummy preos: {}".format(args))
+
+When you try to run this new preos you will get:
+
+.. code-block:: sh
+
+    $ cdist preos -h
+    usage: cdist preos [-h] preos
+
+    Create PreOS
+
+    positional arguments:
+      preos       PreOS to create, one of: {'freebsd', 'debian', 'ubuntu'}
+
+    optional arguments:
+      -h, --help  show this help message and exit
+    $ cdist preos freebsd
+    FreeBSD dummy preos: []
+
+In the ``commandline`` function/method you have all the freedom to actually create
+PreOS.
diff --git a/docs/src/cdist-reference.rst.sh b/docs/src/cdist-reference.rst.sh
index f4a37816..3ab12fe2 100755
--- a/docs/src/cdist-reference.rst.sh
+++ b/docs/src/cdist-reference.rst.sh
@@ -67,6 +67,9 @@ cdist/inventory/
     The distribution inventory directory.
     This path is relative to cdist installation directory.
 
+cdist/preos/
+    The distribution PreOS plugins directory.
+
 confdir
     Cdist will use all available configuration directories and create
     a temporary confdir containing links to the real configuration directories.
diff --git a/docs/src/index.rst b/docs/src/index.rst
index 6cbd938a..5e54d8fc 100644
--- a/docs/src/index.rst
+++ b/docs/src/index.rst
@@ -32,6 +32,7 @@ is being used in small up to enterprise grade environments.
    cdist-messaging
    cdist-parallelization
    cdist-inventory
+   cdist-preos
    cdist-integration
    cdist-reference
    cdist-best-practice
diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index 30832f2f..982004b0 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -11,7 +11,7 @@ SYNOPSIS
 
 ::
 
-    cdist [-h] [-V] {banner,config,install,inventory,shell} ...
+    cdist [-h] [-V] {banner,config,install,inventory,preos,shell} ...
 
     cdist banner [-h] [-l LOGLEVEL] [-q] [-v]
 
@@ -59,6 +59,29 @@ SYNOPSIS
                          [-I INVENTORY_DIR] [-a] [-f HOSTFILE] [-H] [-t]
                          [host [host ...]]
 
+    cdist preos [-h] preos
+
+    cdist preos debian [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
+                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
+                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
+                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
+                       target_dir
+
+    cdist preos devuan [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
+                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
+                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
+                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
+                       target_dir
+
+    cdist preos ubuntu [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
+                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
+                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
+                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
+                       target_dir
+
     cdist shell [-h] [-l LOGLEVEL] [-q] [-v] [-s SHELL]
 
 
@@ -432,6 +455,135 @@ List inventory database.
     all hosts that contain any of specified tags.
 
 
+PREOS
+-----
+Create PreOS. Currently, the following PreOS-es are supported:
+
+* debian
+* ubuntu
+* devuan
+
+
+PREOS DEBIAN/DEVUAN
+-------------------
+
+**target_dir**
+    target directory where PreOS will be bootstrapped
+
+**-a ARCH, --arch ARCH**
+    target debootstrap architecture, by default 'amd64'
+
+**-B, --bootstrap**
+    do bootstrap step
+
+**-b, --beta**
+    Enable beta functionality.
+
+**-C, --configure**
+    do configure step
+
+**-c CDIST_PARAMS, --cdist-params CDIST_PARAMS**
+    parameters that will be passed to cdist config, by
+    default '-v' is used
+
+**-D DRIVE, --drive-boot DRIVE**
+   create bootable PreOS on specified drive
+
+**-e REMOTE_EXEC, --remote-exec REMOTE_EXEC**
+    remote exec that cdist config will use, by default
+    internal script is used
+
+**-i MANIFEST, --init-manifest MANIFEST**
+    init manifest that cdist config will use, by default
+    internal init manifest is used
+
+**-k KEYFILE, --keyfile KEYFILE**
+    ssh key files that will be added to cdist config;
+    '``__ssh_authorized_keys root ...``' type is appended to initial manifest
+
+**-m MIRROR, --mirror MIRROR**
+    use specified mirror for debootstrap
+
+**-P ROOT_PASSWORD, --root-password ROOT_PASSWORD**
+    Set specified password for root, generated by default
+
+**-p PXE_BOOT_DIR, --pxe-boot-dir PXE_BOOT_DIR**
+    PXE boot directory
+
+**-r, --rm-bootstrap-dir**
+    remove target directory after finishing
+
+**-S SCRIPT, --script SCRIPT**
+    use specified script for debootstrap
+
+**-s SUITE, --suite SUITE**
+    suite used for debootstrap, by default 'stable'
+
+**-y REMOTE_COPY, --remote-copy REMOTE_COPY**
+    remote copy that cdist config will use, by default
+    internal script is used
+
+
+PREOS UBUNTU
+------------
+
+**target_dir**
+    target directory where PreOS will be bootstrapped
+
+**-a ARCH, --arch ARCH**
+    target debootstrap architecture, by default 'amd64'
+
+**-B, --bootstrap**
+    do bootstrap step
+
+**-b, --beta**
+    Enable beta functionality.
+
+**-C, --configure**
+    do configure step
+
+**-c CDIST_PARAMS, --cdist-params CDIST_PARAMS**
+    parameters that will be passed to cdist config, by
+    default '-v' is used
+
+**-D DRIVE, --drive-boot DRIVE**
+   create bootable PreOS on specified drive
+
+**-e REMOTE_EXEC, --remote-exec REMOTE_EXEC**
+    remote exec that cdist config will use, by default
+    internal script is used
+
+**-i MANIFEST, --init-manifest MANIFEST**
+    init manifest that cdist config will use, by default
+    internal init manifest is used
+
+**-k KEYFILE, --keyfile KEYFILE**
+    ssh key files that will be added to cdist config;
+    '``__ssh_authorized_keys root ...``' type is appended to initial manifest
+
+**-m MIRROR, --mirror MIRROR**
+    use specified mirror for debootstrap
+
+**-P ROOT_PASSWORD, --root-password ROOT_PASSWORD**
+    Set specified password for root, generated by default
+
+**-p PXE_BOOT_DIR, --pxe-boot-dir PXE_BOOT_DIR**
+    PXE boot directory
+
+**-r, --rm-bootstrap-dir**
+    remove target directory after finishing
+
+**-S SCRIPT, --script SCRIPT**
+    use specified script for debootstrap
+
+**-s SUITE, --suite SUITE**
+    suite used for debootstrap, by default 'xenial'
+
+**-y REMOTE_COPY, --remote-copy REMOTE_COPY**
+    remote copy that cdist config will use, by default
+    internal script is used
+
+
 SHELL
 -----
 This command allows you to spawn a shell that enables access
@@ -540,12 +692,16 @@ FILES
 ~/.cdist/inventory
     The home inventory directory. If ~/.cdist exists it will be used as
     default inventory directory.
+~/.cdist/preos
+    PreOS plugins directory, if existing.
 cdist/conf
     The distribution configuration directory. It contains official types and
     explorers. This path is relative to cdist installation directory.
 cdist/inventory
     The distribution inventory directory.
     This path is relative to cdist installation directory.
+cdist/preos
+    The distribution PreOS plugins directory.
 /etc/cdist.cfg
     Global cdist configuration file, if exists.
 ~/.cdist.cfg or $XDG_CONFIG_HOME/cdist/cdist.cfg
@@ -635,6 +791,20 @@ EXAMPLES
     # Configure all hosts from inventory db
     $ cdist config -b -A
 
+    # Create default debian PreOS in debug mode
+    $ cdist preos debian /preos/preos-debian -b -vvvv -C \
+        -k ~/.ssh/id_rsa.pub -p /preos/pxe-debian
+
+    # Create ubuntu PreOS
+    $ cdist preos ubuntu /preos/preos-ubuntu -b -C \
+        -k ~/.ssh/id_rsa.pub -p /preos/pxe-ubuntu
+
+    # Create ubuntu PreOS on drive /dev/sdb
+    # and set root password to 'password'.
+    $ cdist preos ubuntu /mnt -b -B -C \
+        -k ~/.ssh/id_rsa.pub -D /dev/sdb \
+        -P password
+
 
 ENVIRONMENT
 -----------
diff --git a/hacking/preos-sh/init b/hacking/preos-sh/init
new file mode 100644
index 00000000..c4317110
--- /dev/null
+++ b/hacking/preos-sh/init
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+for pkg in \
+    file \
+    linux-image-amd64 \
+    lsb-release \
+    openssh-server curl \
+    pxelinux syslinux-common grub2 \
+    gdisk util-linux lvm2 mdadm \
+    btrfs-tools e2fsprogs jfsutils reiser4progs xfsprogs; do
+    __package $pkg --state present
+done
+
+# initramfs requires /init
+__link /init --source /sbin/init --type symbolic
+
+__file /etc/network/interfaces --source - --mode 0644 << eof
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+# The primary network interface
+auto eth0
+allow-hotplug eth0
+iface eth0 inet dhcp
+eof
+
+# Steven found this out - coyping it 1:1
+# fix the bloody 'stdin: is not a tty' problem
+__line /root/.profile --line 'mesg n' --state absent
+
+__hostname --name preos
diff --git a/hacking/preos-sh/preos.sh b/hacking/preos-sh/preos.sh
new file mode 100644
index 00000000..53181420
--- /dev/null
+++ b/hacking/preos-sh/preos.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+TARGET_DIR="$1"
+PXE_BOOT_DIR="$2"
+
+debootstrap --include=openssh-server --arch=amd64 stable $TARGET_DIR
+chroot $TARGET_DIR /usr/bin/apt-get update
+
+# Configure the OS
+cdist config -i init --remote-exec remote-exec.sh --remote-copy remote-exec.sh $TARGET_DIR
+
+# Cleanup chroot
+chroot $TARGET_DIR /usr/bin/apt-get autoclean
+chroot $TARGET_DIR /usr/bin/apt-get clean
+chroot $TARGET_DIR /usr/bin/apt-get autoremove
+
+# Output pxe files
+cp $TARGET_DIR/boot/vmlinuz-* $PXE_BOOT_DIR/kernel
+
+cd $TARGET_DIR
+find . -print0 | cpio --null -o --format=newc | gzip -9 > $PXE_BOOT_DIR/initramfs
+
+cat << EOF > $PXE_BOOT_DIR/pxelinux.cfg/default
+DEFAULT preos
+LABEL preos
+KERNEL kernel
+INITRD initramfs
+EOF
+
+cp $TARGET_DIR/usr/lib/PXELINUX/pxelinux.0 $PXE_BOOT_DIR/pxelinux.0
+cp $TARGET_DIR/usr/lib/syslinux/modules/bios/ldlinux.c32 $PXE_BOOT_DIR/ldlinux.c32
diff --git a/hacking/preos-sh/remote-copy.sh b/hacking/preos-sh/remote-copy.sh
new file mode 100644
index 00000000..4f83f313
--- /dev/null
+++ b/hacking/preos-sh/remote-copy.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# echo $@
+# set -x
+src=$1; shift
+dst=$1; shift
+real_dst=$(echo $dst | sed 's,:,,')
+cp -L "$src" "$real_dst"
diff --git a/hacking/preos-sh/remote-exec.sh b/hacking/preos-sh/remote-exec.sh
new file mode 100644
index 00000000..3c4bcf2f
--- /dev/null
+++ b/hacking/preos-sh/remote-exec.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+
+# echo $@
+# set -x
+
+chroot="$1"; shift
+
+script=$(mktemp "${chroot}/tmp/chroot-${0##*/}.XXXXXXXXXX")
+trap cleanup INT TERM EXIT
+cleanup() {
+   [ $__cdist_debug ] || rm "$script"
+}
+
+echo "#!/bin/sh -l" > "$script"
+echo "$@" >> "$script"
+chmod +x "$script"
+
+relative_script="${script#$chroot}"
+
+# ensure PATH is setup
+export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/sbin
+
+# run in chroot
+chroot "$chroot" "$relative_script"
diff --git a/scripts/cdist b/scripts/cdist
index 3110e657..7bf12c01 100755
--- a/scripts/cdist
+++ b/scripts/cdist
@@ -35,6 +35,9 @@ import cdist.inventory
 def commandline():
     """Parse command line"""
 
+    # preos subcommand hack
+    if len(sys.argv) > 1 and sys.argv[1] == 'preos':
+        return cdist.preos.PreOS.commandline(sys.argv[1:])
     parser, cfg = cdist.argparse.parse_and_configure(sys.argv[1:])
     args = cfg.get_args()
 

From d147f4a86feff649d4a74a0dee696a3213b35cc9 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 20 Sep 2019 12:00:22 +0300
Subject: [PATCH 086/383] __apt_key: fix key dearmor when fetching from uri

---
 cdist/conf/type/__apt_key/gencode-remote | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/cdist/conf/type/__apt_key/gencode-remote b/cdist/conf/type/__apt_key/gencode-remote
index 47c8bb49..e9daa524 100755
--- a/cdist/conf/type/__apt_key/gencode-remote
+++ b/cdist/conf/type/__apt_key/gencode-remote
@@ -48,11 +48,11 @@ curl -s -L \\
     -o "$keyfile" \\
     "$uri"
 
-if grep -Fq 'BEGIN PGP PUBLIC KEY BLOCK' \\
-    "$keyfile"
+key="\$( cat "$keyfile" )"
+
+if echo "\$key" | grep -Fq 'BEGIN PGP PUBLIC KEY BLOCK'
 then
-    cat "$keyfile" \\
-        | gpg --export > "$keyfile"
+    echo "\$key" | gpg --dearmor > "$keyfile"
 fi
 
 EOF

From 90d9326740b72d79003ad9405563a00e8e060eef Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Fri, 20 Sep 2019 21:17:13 +0900
Subject: [PATCH 087/383] [__sysctl] add alpine support

---
 cdist/conf/type/__sysctl/manifest | 3 ++-
 docs/changelog                    | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__sysctl/manifest b/cdist/conf/type/__sysctl/manifest
index b4e2e902..71dea7f7 100755
--- a/cdist/conf/type/__sysctl/manifest
+++ b/cdist/conf/type/__sysctl/manifest
@@ -2,6 +2,7 @@
 #
 # 2014 Steven Armstrong (steven-cdist at armstrong.cc)
 # 2018 Takashi Yoshi (takashi at yoshi.email)
+# 2019 Nico Schottelius (nico-cdist at schottelius.org)
 #
 # This file is part of cdist.
 #
@@ -24,7 +25,7 @@ os=$(cat "$__global/explorer/os")
 
 case "$os" in
    # Linux
-   redhat|centos|ubuntu|debian|devuan|archlinux|coreos)
+   alpine|redhat|centos|ubuntu|debian|devuan|archlinux|coreos)
       :
    ;;
    # BSD
diff --git a/docs/changelog b/docs/changelog
index 81a5c0ba..6417adb9 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)
 	* Core: Add preos functionality (Darko Poljak)
+	* Type __sysctl: Add alpine support (Nico Schottelius)
 
 5.1.3: 2019-08-30
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)

From b657ba82219da405e310c5e8222f403ab01ed55e Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 20 Sep 2019 19:50:55 +0200
Subject: [PATCH 088/383] Fix log level when verbosity option is not specified

---
 cdist/argparse.py                      |  1 +
 cdist/preos/debootstrap/debootstrap.py | 10 +++++-----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/cdist/argparse.py b/cdist/argparse.py
index 3ccc0545..34493379 100644
--- a/cdist/argparse.py
+++ b/cdist/argparse.py
@@ -21,6 +21,7 @@ parser = None
 
 _verbosity_level_off = -2
 _verbosity_level = {
+    None: logging.WARNING,
     _verbosity_level_off: logging.OFF,
     -1: logging.ERROR,
     0: logging.WARNING,
diff --git a/cdist/preos/debootstrap/debootstrap.py b/cdist/preos/debootstrap/debootstrap.py
index 617d280b..bd8e5759 100644
--- a/cdist/preos/debootstrap/debootstrap.py
+++ b/cdist/preos/debootstrap/debootstrap.py
@@ -173,11 +173,11 @@ class Debian(object):
             env = vars(args)
             new_env = {}
             for key in env:
-                if key == 'verbose':
-                    if env[key] >= 3:
-                        new_env['debug'] = "yes"
-                    elif env[key] == 2:
-                        new_env['verbose'] = "yes"
+                if key == 'verbose' and env[key]:
+                        if env[key] >= 3:
+                            new_env['debug'] = "yes"
+                        elif env[key] == 2:
+                            new_env['verbose'] = "yes"
                 elif not env[key]:
                     new_env[key] = ''
                 elif isinstance(env[key], bool) and env[key]:

From 97bcfcc23ce1fa88e763b03a723aad34a9700fca Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 20 Sep 2019 19:56:17 +0200
Subject: [PATCH 089/383] Release preos, i.e. make it non-beta

---
 cdist/argparse.py                      | 2 +-
 cdist/preos/debootstrap/debootstrap.py | 9 ++++-----
 docs/src/cdist-preos.rst               | 4 ++--
 docs/src/man1/cdist.rst                | 9 ++++-----
 4 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/cdist/argparse.py b/cdist/argparse.py
index 34493379..ca69cdae 100644
--- a/cdist/argparse.py
+++ b/cdist/argparse.py
@@ -9,7 +9,7 @@ import cdist.preos
 
 
 # set of beta sub-commands
-BETA_COMMANDS = set(('install', 'inventory', 'preos', ))
+BETA_COMMANDS = set(('install', 'inventory', ))
 # set of beta arguments for sub-commands
 BETA_ARGS = {
     'config': set(('tag', 'all_tagged_hosts', 'use_archiving', )),
diff --git a/cdist/preos/debootstrap/debootstrap.py b/cdist/preos/debootstrap/debootstrap.py
index bd8e5759..f53dd4a7 100644
--- a/cdist/preos/debootstrap/debootstrap.py
+++ b/cdist/preos/debootstrap/debootstrap.py
@@ -145,7 +145,6 @@ class Debian(object):
         log = logging.getLogger(cls.__name__)
 
         parser = cls.get_parser()
-        cdist.argparse.add_beta_command(cls._preos_name)
         args = parser.parse_args(argv)
         if args.script and not args.mirror:
             raise cdist.Error("script option cannot be used without "
@@ -174,10 +173,10 @@ class Debian(object):
             new_env = {}
             for key in env:
                 if key == 'verbose' and env[key]:
-                        if env[key] >= 3:
-                            new_env['debug'] = "yes"
-                        elif env[key] == 2:
-                            new_env['verbose'] = "yes"
+                    if env[key] >= 3:
+                        new_env['debug'] = "yes"
+                    elif env[key] == 2:
+                        new_env['verbose'] = "yes"
                 elif not env[key]:
                     new_env[key] = ''
                 elif isinstance(env[key], bool) and env[key]:
diff --git a/docs/src/cdist-preos.rst b/docs/src/cdist-preos.rst
index 8b3deff8..e85af2de 100644
--- a/docs/src/cdist-preos.rst
+++ b/docs/src/cdist-preos.rst
@@ -24,12 +24,12 @@ For example, to create ubuntu PreOS:
 
 .. code-block:: sh
 
-    $ cdist preos ubuntu /preos/preos-ubuntu -b -C \
+    $ cdist preos ubuntu /preos/preos-ubuntu -B -C \
         -k ~/.ssh/id_rsa.pub -p /preos/pxe-ubuntu
 
 For more info about available options see cdist manual page.
 
-This will bootstrap (``-b``) ubuntu PreOS in ``/preos/preos-ubuntu`` directory, it
+This will bootstrap (``-B``) ubuntu PreOS in ``/preos/preos-ubuntu`` directory, it
 will be configured (``-C``) using default built-in initial manifest and with
 specified ssh authorized key (``-k``).
 After bootstrapping and configuration PXE
diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index 982004b0..7f368e68 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -734,8 +734,7 @@ EXAMPLES
     % cdist config -f loadbalancers
 
     # Configure hosts read from file web.hosts using 16 parallel jobs
-    # (beta functionality)
-    % cdist config -b -j 16 -f web.hosts
+    % cdist config -j 16 -f web.hosts
 
     # Display banner
     cdist banner
@@ -792,16 +791,16 @@ EXAMPLES
     $ cdist config -b -A
 
     # Create default debian PreOS in debug mode
-    $ cdist preos debian /preos/preos-debian -b -vvvv -C \
+    $ cdist preos debian /preos/preos-debian -vvvv -C \
         -k ~/.ssh/id_rsa.pub -p /preos/pxe-debian
 
     # Create ubuntu PreOS
-    $ cdist preos ubuntu /preos/preos-ubuntu -b -C \
+    $ cdist preos ubuntu /preos/preos-ubuntu -C \
         -k ~/.ssh/id_rsa.pub -p /preos/pxe-ubuntu
 
     # Create ubuntu PreOS on drive /dev/sdb
     # and set root password to 'password'.
-    $ cdist preos ubuntu /mnt -b -B -C \
+    $ cdist preos ubuntu /mnt -B -C \
         -k ~/.ssh/id_rsa.pub -D /dev/sdb \
         -P password
 

From 5c8e31b2ef85ccc740a75696675ac032cd33c199 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 30 Sep 2019 13:22:55 +0200
Subject: [PATCH 090/383] [type/__git] Improve documentation of --recursive
 option

---
 cdist/conf/type/__git/man.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__git/man.rst b/cdist/conf/type/__git/man.rst
index e4c06c99..144eadda 100644
--- a/cdist/conf/type/__git/man.rst
+++ b/cdist/conf/type/__git/man.rst
@@ -36,7 +36,7 @@ owner
    User to chown to.
 
 recursive
-   Recursive clone...
+   Passes the --recursive flag to git when cloning the repository.
 
 EXAMPLES
 --------

From 9d8a0dae6683294492914c16ecfdef69b08b361c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 1 Oct 2019 07:01:38 +0200
Subject: [PATCH 091/383] ++changelog

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 6417adb9..8d9ad531 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,8 @@ next:
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)
 	* Core: Add preos functionality (Darko Poljak)
 	* Type __sysctl: Add alpine support (Nico Schottelius)
+	* Type __git: Add recursive option (Dennis Camera)
+	* Type __apt_key: Fix key dearmor (Ander Punnar)
 
 5.1.3: 2019-08-30
 	* Build: Overcome bash CDPATH when building docs (Dmitry Bogatov)

From 50156bd7cd5dc443125b31cd46e284c29708555b Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 1 Oct 2019 07:10:37 +0200
Subject: [PATCH 092/383] shellcheck

---
 cdist/conf/type/__git/gencode-remote | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__git/gencode-remote b/cdist/conf/type/__git/gencode-remote
index 3ba21add..4de0f1c6 100755
--- a/cdist/conf/type/__git/gencode-remote
+++ b/cdist/conf/type/__git/gencode-remote
@@ -35,6 +35,8 @@ owner=$(cat "$__object/parameter/owner")
 group=$(cat "$__object/parameter/group")
 mode=$(cat "$__object/parameter/mode")
 
+[ -f "$__object/parameter/recursive" ] && recursive='--recursive' || recursive=''
+
 [ "$state_should" = "$state_is" ] \
  && [ "$owner" = "$owner_is" ] \
  && [ "$group" = "$group_is" ] \
@@ -43,7 +45,7 @@ mode=$(cat "$__object/parameter/mode")
 case $state_should in
     present)
         if [ "$state_should" != "$state_is" ]; then
-            echo git clone --quiet $([ -f "$__object/parameter/recursive" ] && echo '--recursive') --branch "$branch" "$source" "$destination"
+            echo git clone --quiet "$recursive" --branch "$branch" "$source" "$destination"
         fi
         if { [ -n "$owner" ] && [ "$owner_is" != "$owner" ]; } || \
            { [ -n "$group" ] && [ "$group_is" != "$group" ]; }; then

From 828b4c867c8e1d1a37a093bc6c2ee82c1ed14024 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 1 Oct 2019 07:14:35 +0200
Subject: [PATCH 093/383] Release 6.0.0

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 8d9ad531..168d0beb 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.0.0: 2019-10-01
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)
 	* Core: Add preos functionality (Darko Poljak)
 	* Type __sysctl: Add alpine support (Nico Schottelius)

From 2d751443a429b19443cb4499cce2f1526c28c1a0 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Tue, 1 Oct 2019 08:08:35 +0200
Subject: [PATCH 094/383] [__user] Fall back to /etc files if getent(1) is not
 available

On systems without getent(1) the script would fail because "command -v getent"
exits with 1 which terminates the script due to it being called by sh -e.
---
 cdist/conf/type/__user/explorer/group  |  6 ++----
 cdist/conf/type/__user/explorer/passwd |  5 ++---
 cdist/conf/type/__user/explorer/shadow | 21 +++++++++++----------
 3 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/cdist/conf/type/__user/explorer/group b/cdist/conf/type/__user/explorer/group
index 2aae2973..0fd1471a 100755
--- a/cdist/conf/type/__user/explorer/group
+++ b/cdist/conf/type/__user/explorer/group
@@ -23,11 +23,9 @@
 
 if [ -f "$__object/parameter/gid" ]; then
    gid=$(cat "$__object/parameter/gid")
-   getent=$(command -v getent)
-   if [ X != X"${getent}" ]; then
-      "${getent}" group "$gid" || true
+   if command -v getent >/dev/null; then
+      getent group "$gid" || true
    elif [ -f /etc/group ]; then
       grep -E "^(${gid}|([^:]+:){2}${gid}):" /etc/group || true
    fi
 fi
-
diff --git a/cdist/conf/type/__user/explorer/passwd b/cdist/conf/type/__user/explorer/passwd
index 677e3ff0..b8391a6f 100755
--- a/cdist/conf/type/__user/explorer/passwd
+++ b/cdist/conf/type/__user/explorer/passwd
@@ -23,9 +23,8 @@
 
 name=$__object_id
 
-getent=$(command -v getent)
-if [ X != X"${getent}" ]; then
-  "${getent}" passwd "$name" || true
+if command -v getent >/dev/null; then
+  getent passwd "$name" || true
 elif [ -f /etc/passwd ]; then
   grep "^${name}:" /etc/passwd || true
 fi
diff --git a/cdist/conf/type/__user/explorer/shadow b/cdist/conf/type/__user/explorer/shadow
index c49992d5..73ce0e29 100755
--- a/cdist/conf/type/__user/explorer/shadow
+++ b/cdist/conf/type/__user/explorer/shadow
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -e
 #
 # 2011 Steven Armstrong (steven-cdist at armstrong.cc)
 #
@@ -22,18 +22,19 @@
 #
 
 name=$__object_id
-os="$("$__explorer/os")"
-# Default to using shadow passwords
-database="shadow"
 
-case "$os" in
-  "freebsd"|"netbsd"|"openbsd")  database="passwd";;
+case $("$__explorer/os") in
+  'freebsd'|'netbsd'|'openbsd')
+    database='passwd'
+    ;;
+  # Default to using shadow passwords
+  *)
+    database='shadow'
+    ;;
 esac
-  
 
-getent=$(command -v getent)
-if [ X != X"${getent}" ]; then
-  "${getent}" "$database" "$name" || true
+if command -v getent >/dev/null; then
+  getent "$database" "$name" || true
 elif [ -f /etc/shadow ]; then
   grep "^${name}:" /etc/shadow || true
 fi

From 092dd19611eaa40a23d0ec1c5cd9bf770579f082 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Tue, 1 Oct 2019 08:11:41 +0200
Subject: [PATCH 095/383] [__ssh_dot_ssh] Fall back to /etc files if getent(1)
 is not available

Some (embedded) systems don't provide getent(1). The workaround parses
/etc/passwd and /etc/group under the assumption that these sysems only use local
users and groups.
---
 cdist/conf/type/__ssh_dot_ssh/explorer/group  | 11 +++++++++--
 cdist/conf/type/__ssh_dot_ssh/explorer/passwd | 15 ++++++++++++++-
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__ssh_dot_ssh/explorer/group b/cdist/conf/type/__ssh_dot_ssh/explorer/group
index cdea6fe7..faf44cb8 100755
--- a/cdist/conf/type/__ssh_dot_ssh/explorer/group
+++ b/cdist/conf/type/__ssh_dot_ssh/explorer/group
@@ -1,6 +1,7 @@
 #!/bin/sh
 #
 # 2014 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -18,5 +19,11 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-gid="$("$__type_explorer/passwd" | cut -d':' -f 4)"
-getent group "$gid" || true
+gid=$("$__type_explorer/passwd" | cut -d':' -f4)
+
+if command -v getent >/dev/null
+then
+	getent group "$gid" || true
+else
+	awk -F: "\$3 == \"$gid\" { print }" /etc/group
+fi
diff --git a/cdist/conf/type/__ssh_dot_ssh/explorer/passwd b/cdist/conf/type/__ssh_dot_ssh/explorer/passwd
index 3fbad06f..42686b20 100755
--- a/cdist/conf/type/__ssh_dot_ssh/explorer/passwd
+++ b/cdist/conf/type/__ssh_dot_ssh/explorer/passwd
@@ -2,6 +2,7 @@
 #
 # 2012 Steven Armstrong (steven-cdist at armstrong.cc)
 # 2014 Nico Schottelius (nico-cdist at schottelius.org)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -21,4 +22,16 @@
 
 owner="$__object_id"
 
-getent passwd "$owner" || true
+if command -v getent >/dev/null
+then
+    getent passwd "$owner" || true
+else
+    case $owner in
+        [0-9][0-9]*)
+            awk -F: "\$3 == \"$owner\" { print }" /etc/passwd
+            ;;
+        *)
+            grep "^$owner:" /etc/passwd || true
+            ;;
+    esac
+fi

From 95ab68a2723390b531de76c5a39e88692d41dceb Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Tue, 1 Oct 2019 08:26:59 +0200
Subject: [PATCH 096/383] [__ssh_authorized_keys] Fall back to /etc files if
 getent(1) is not available

Some (embedded) systems don't provide getent(1). The workaround parses
/etc/passwd and /etc/group under the assumption that these sysems only use local
users and groups.
---
 .../type/__ssh_authorized_keys/explorer/file  | 26 +++++++++++++++--
 .../type/__ssh_authorized_keys/explorer/group | 29 +++++++++++++++++--
 2 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/type/__ssh_authorized_keys/explorer/file b/cdist/conf/type/__ssh_authorized_keys/explorer/file
index 5a02721a..09d55f6f 100755
--- a/cdist/conf/type/__ssh_authorized_keys/explorer/file
+++ b/cdist/conf/type/__ssh_authorized_keys/explorer/file
@@ -1,6 +1,7 @@
 #!/bin/sh
 #
 # 2014 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -21,7 +22,28 @@
 if [ -f "$__object/parameter/file" ]; then
    cat "$__object/parameter/file"
 else
-   owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
-   home=$(getent passwd "$owner" | cut -d':' -f 6)
+   if [ -s "$__object/parameter/owner" ]
+   then
+	   owner=$(cat "$__object/parameter/owner")
+   else
+	   owner="$__object_id"
+   fi
+
+   if command -v getent >/dev/null
+   then
+      owner_line=$(getent passwd "$owner")
+   else
+      case $owner
+      in
+         [0-9][0-9]*)
+            owner_line=$(awk -F: "\$3 == \"${owner}\" { print }" /etc/passwd)
+            ;;
+         *)
+            owner_line=$(awk -F: "\$1 == \"${owner}\" { print }" /etc/passwd)
+            ;;
+      esac
+   fi
+
+   home=$(echo "$owner_line" | cut -d':' -f6)
    echo "$home/.ssh/authorized_keys"
 fi
diff --git a/cdist/conf/type/__ssh_authorized_keys/explorer/group b/cdist/conf/type/__ssh_authorized_keys/explorer/group
index 72a4e314..1bd14840 100755
--- a/cdist/conf/type/__ssh_authorized_keys/explorer/group
+++ b/cdist/conf/type/__ssh_authorized_keys/explorer/group
@@ -1,6 +1,7 @@
 #!/bin/sh
 #
 # 2014 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -18,6 +19,28 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
-gid="$(getent passwd "$owner" | cut -d':' -f 4)"
-getent group "$gid" || true
+if [ -s "$__object/parameter/owner" ]
+then
+	owner=$(cat "$__object/parameter/owner")
+else
+	owner="$__object_id"
+fi
+
+if command -v getent >/dev/null
+then
+	gid=$(getent passwd "$owner" | cut -d':' -f4)
+	getent group "$gid" || true
+else
+	# Fallback to local file scanning
+	case $owner
+	in
+		[0-9][0-9]*)
+			gid=$(awk -F: "\$3 == \"${owner}\" { print $4 }" /etc/passwd)
+			;;
+		*)
+			gid=$(awk -F: "\$1 == \"${owner}\" { print $4 }" /etc/passwd)
+			;;
+	esac
+
+	awk -F: "\$3 == \"$gid\" { print }" /etc/group
+fi

From bad3a4a4cb69acc9278eedbade1323cbb7ef6cc2 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Tue, 1 Oct 2019 10:04:57 +0200
Subject: [PATCH 097/383] [__group] Fall back to /etc files if getent(1) is not
 available

Some (embedded) systems (and Mac OS X) don't provide getent(1). The workaround
parses /etc/group under the assumption that the system only uses local users and
groups.
---
 cdist/conf/type/__group/explorer/group   | 19 +++++++++++++--
 cdist/conf/type/__group/explorer/gshadow | 30 ++++++++++++++++++------
 2 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/cdist/conf/type/__group/explorer/group b/cdist/conf/type/__group/explorer/group
index 07f73a91..dc673f61 100755
--- a/cdist/conf/type/__group/explorer/group
+++ b/cdist/conf/type/__group/explorer/group
@@ -1,6 +1,7 @@
 #!/bin/sh
 #
 # 2011-2015 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -21,7 +22,21 @@
 # Get an existing groups group entry.
 #
 
+not_supported() {
+	echo "Your operating system ($("$__explorer/os")) is currently not supported." >&2
+	echo "Cannot extract group information." >&2
+	echo "Please contribute an implementation for it if you can." >&2
+	exit 1
+}
+
 name=$__object_id
 
-getent group "$name" || true
-
+if command -v getent >/dev/null
+then
+	getent group "$name" || true
+elif [ -f /etc/group ]
+then
+	grep "^${name}:" /etc/group || true
+else
+	not_supported
+fi
diff --git a/cdist/conf/type/__group/explorer/gshadow b/cdist/conf/type/__group/explorer/gshadow
index ef40b7bc..05841d69 100755
--- a/cdist/conf/type/__group/explorer/gshadow
+++ b/cdist/conf/type/__group/explorer/gshadow
@@ -1,6 +1,7 @@
 #!/bin/sh
 #
 # 2011-2015 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -22,13 +23,28 @@
 #
 
 name=$__object_id
-os="$("$__explorer/os")"
+os=$("$__explorer/os")
 
-case "$os" in
-    "freebsd"|"netbsd")
-	echo "$os does not have getent gshadow"
-	exit 0
-    ;;
+not_supported() {
+	echo "Your operating system ($os) is currently not supported." >&2
+	echo "Cannot extract group information." >&2
+	echo "Please contribute an implementation for it if you can." >&2
+	exit 1
+}
+
+case $os in
+	"freebsd"|"netbsd")
+		echo "$os does not have getent gshadow" >&2
+		exit 0
+	;;
 esac
 
-getent gshadow "$name" || true
+if command -v getent >/dev/null
+then
+	getent gshadow "$name" || true
+elif [ -f /etc/gshadow ]
+then
+	grep "^${name}:" /etc/gshadow || true
+else
+	not_supported
+fi

From 259aa13b6ab90a12baebbacbcf1ce5d5c4cce06b Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Tue, 1 Oct 2019 11:06:02 +0200
Subject: [PATCH 098/383] [__ssh_authorized_keys] Better path checks

---
 .../type/__ssh_authorized_keys/explorer/file  | 58 +++++++++++--------
 .../conf/type/__ssh_authorized_keys/manifest  |  6 ++
 2 files changed, 41 insertions(+), 23 deletions(-)

diff --git a/cdist/conf/type/__ssh_authorized_keys/explorer/file b/cdist/conf/type/__ssh_authorized_keys/explorer/file
index 09d55f6f..017bcb38 100755
--- a/cdist/conf/type/__ssh_authorized_keys/explorer/file
+++ b/cdist/conf/type/__ssh_authorized_keys/explorer/file
@@ -20,30 +20,42 @@
 #
 
 if [ -f "$__object/parameter/file" ]; then
-   cat "$__object/parameter/file"
+	cat "$__object/parameter/file"
 else
-   if [ -s "$__object/parameter/owner" ]
-   then
-	   owner=$(cat "$__object/parameter/owner")
-   else
-	   owner="$__object_id"
-   fi
+	if [ -s "$__object/parameter/owner" ]
+	then
+		owner=$(cat "$__object/parameter/owner")
+	else
+		owner="$__object_id"
+	fi
 
-   if command -v getent >/dev/null
-   then
-      owner_line=$(getent passwd "$owner")
-   else
-      case $owner
-      in
-         [0-9][0-9]*)
-            owner_line=$(awk -F: "\$3 == \"${owner}\" { print }" /etc/passwd)
-            ;;
-         *)
-            owner_line=$(awk -F: "\$1 == \"${owner}\" { print }" /etc/passwd)
-            ;;
-      esac
-   fi
+	if command -v getent >/dev/null
+	then
+		owner_line=$(getent passwd "$owner")
+	elif [ -f /etc/passwd ]
+	then
+		case $owner
+		in
+			[0-9][0-9]*)
+				owner_line=$(awk -F: "\$3 == \"${owner}\" { print }" /etc/passwd)
+				;;
+			*)
+				owner_line=$(awk -F: "\$1 == \"${owner}\" { print }" /etc/passwd)
+				;;
+		esac
+	fi
 
-   home=$(echo "$owner_line" | cut -d':' -f6)
-   echo "$home/.ssh/authorized_keys"
+	if [ "$owner_line" ]
+	then
+		home=$(echo "$owner_line" | cut -d':' -f6)
+	fi
+
+	if [ ! -d "$home" ]
+	then
+		# Don't know how to determine user's home directory, fall back to ~
+		home="~$owner"
+		command -v realpath >/dev/null && home=$(realpath "$home")
+	fi
+
+	[ -d "$home" ] && echo "$home/.ssh/authorized_keys"
 fi
diff --git a/cdist/conf/type/__ssh_authorized_keys/manifest b/cdist/conf/type/__ssh_authorized_keys/manifest
index b507c7ff..b9f0582e 100755
--- a/cdist/conf/type/__ssh_authorized_keys/manifest
+++ b/cdist/conf/type/__ssh_authorized_keys/manifest
@@ -23,6 +23,12 @@ owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
 state="$(cat "$__object/parameter/state" 2>/dev/null)"
 file="$(cat "$__object/explorer/file")"
 
+if [ ! -f "$__object/parameter/nofile" ] && [ -z "$file" ]
+then
+	echo "Cannot determine path of authorized_keys file" >&2
+	exit 1
+fi
+
 if [ ! -f "$__object/parameter/noparent" ] || [ ! -f "$__object/parameter/nofile" ]; then
    group="$(cut -d':' -f 1 "$__object/explorer/group")"
    if [ -z "$group" ]; then

From 7981f81dcde7d7ef6b8dbc999e62c26aa9acb431 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 1 Oct 2019 13:18:01 +0200
Subject: [PATCH 099/383] ++changelog

---
 docs/changelog | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 168d0beb..61dfe167 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,12 @@
 Changelog
 ---------
 
+next:
+	* Type __group: Support OSes without getent (Dennis Camera)
+	* Type __user: Support OSes without getent (Dennis Camera)
+	* Type __ssh_authorized_keys: Support OSes without getent (Dennis Camera)
+	* Type __ssh_dot_ssh: Support OSes without getent (Dennis Camera)
+
 6.0.0: 2019-10-01
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)
 	* Core: Add preos functionality (Darko Poljak)

From f57ce648a382171a145d11d98411f40ce5e1c587 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 2 Oct 2019 15:38:38 +0200
Subject: [PATCH 100/383] [__ssh_authorized_keys] Fix incorrectly escaped
 variable

---
 cdist/conf/type/__ssh_authorized_keys/explorer/group | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__ssh_authorized_keys/explorer/group b/cdist/conf/type/__ssh_authorized_keys/explorer/group
index 1bd14840..d259050f 100755
--- a/cdist/conf/type/__ssh_authorized_keys/explorer/group
+++ b/cdist/conf/type/__ssh_authorized_keys/explorer/group
@@ -35,10 +35,10 @@ else
 	case $owner
 	in
 		[0-9][0-9]*)
-			gid=$(awk -F: "\$3 == \"${owner}\" { print $4 }" /etc/passwd)
+			gid=$(awk -F: "\$3 == \"${owner}\" { print \$4 }" /etc/passwd)
 			;;
 		*)
-			gid=$(awk -F: "\$1 == \"${owner}\" { print $4 }" /etc/passwd)
+			gid=$(awk -F: "\$1 == \"${owner}\" { print \$4 }" /etc/passwd)
 			;;
 	esac
 

From 55f8036377e5fa3a0ed504dd072c65ebfdecd40f Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 2 Oct 2019 18:09:39 +0200
Subject: [PATCH 101/383] [explorer/interfaces] Always sort output

Before, only the output of ifconfig was sorted.
---
 cdist/conf/explorer/interfaces | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/cdist/conf/explorer/interfaces b/cdist/conf/explorer/interfaces
index 55287971..aeb55ed0 100755
--- a/cdist/conf/explorer/interfaces
+++ b/cdist/conf/explorer/interfaces
@@ -18,13 +18,11 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-if command -v ip > /dev/null
+if command -v ip >/dev/null
 then
-    ip -o link show | sed -n 's/^[0-9]\+: \(.\+\): <.*/\1/p'
-
-elif command -v ifconfig > /dev/null
+	ip -o link show | sed -n 's/^[0-9]\+: \(.\+\): <.*/\1/p'
+elif command -v ifconfig >/dev/null
 then
-    ifconfig -a \
-        | sed -n -E 's/^(.*)(:[[:space:]]*flags=|Link encap).*/\1/p' \
-        | sort -u
-fi
+	ifconfig -a | sed -n -E 's/^(.*)(:[[:space:]]*flags=|Link encap).*/\1/p'
+fi \
+ | sort -u

From bf400928e20f44a585d398f09aa759c729a9a24c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 3 Oct 2019 07:56:36 +0200
Subject: [PATCH 102/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 61dfe167..e63acd5d 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -6,6 +6,7 @@ next:
 	* Type __user: Support OSes without getent (Dennis Camera)
 	* Type __ssh_authorized_keys: Support OSes without getent (Dennis Camera)
 	* Type __ssh_dot_ssh: Support OSes without getent (Dennis Camera)
+	* Explorer interfaces: Always sort output (Dennis Camera)
 
 6.0.0: 2019-10-01
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)

From 3c9eb7bce769e7a902e437cdb411be9f5179fe27 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 15 Aug 2019 16:15:47 +0200
Subject: [PATCH 103/383] [__hostname] Support all systemd OSes and prefer
 hostnamectl

---
 cdist/conf/type/__hostname/explorer/hostname | 48 ++++++++++++++++++++
 cdist/conf/type/__hostname/gencode-remote    | 32 +++++++++----
 cdist/conf/type/__hostname/manifest          |  4 +-
 3 files changed, 74 insertions(+), 10 deletions(-)
 create mode 100644 cdist/conf/type/__hostname/explorer/hostname

diff --git a/cdist/conf/type/__hostname/explorer/hostname b/cdist/conf/type/__hostname/explorer/hostname
new file mode 100644
index 00000000..aaaa3a30
--- /dev/null
+++ b/cdist/conf/type/__hostname/explorer/hostname
@@ -0,0 +1,48 @@
+#!/bin/sh
+#
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# Retrieve the running hostname
+#
+
+# Firstly, check hostnamectl if available.
+if command -v hostnamectl >/dev/null
+then
+    hostnamectl --static && exit 0
+fi
+
+
+# Almost any distribution
+if [ -f /etc/hostname ]; then
+    cat /etc/hostname
+# SuSE
+elif [ -f /etc/HOSTNAME ]; then
+    cat /etc/HOSTNAME
+# OpenBSD
+elif [ -f /etc/myname ]; then
+    cat /etc/myname
+# FreeBSD
+elif [ "$(uname -s)" == FreeBSD ]; then
+    (. /etc/rc.conf && echo $hostname)
+# Mac OS X
+elif [ "$(uname -s)" == Darwin -a -f "$(command -v scutil)" ]; then
+    scutil --get HostName 2>/dev/null || hostname -s
+else
+    command -v hostname && hostname -s
+fi
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 8b5797dd..20de7078 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -2,6 +2,7 @@
 #
 # 2014-2017 Steven Armstrong (steven-cdist at armstrong.cc)
 # 2014 Nico Schottelius (nico-cdist at schottelius.org)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -46,8 +47,9 @@ case "$os" in
         fi
     ;;
     *)
-        echo "Unsupported os: $os" >&2
-        exit 1
+        if [ "$name_running" -a "$name_running" = "$name_should" ]; then
+            exit 0
+        fi
     ;;
 esac
 
@@ -56,23 +58,35 @@ esac
 #
 echo changed >> "$__messages_out"
 
-# Use the good old way to set the hostname even on machines running systemd.
+
+# First try to set the hostname using hostnamectl, if available.
+if [ "$has_hostnamectl" ]; then
+    # Allow hostnamectl to fail silently.
+    # Who the fuck invented a tool that needs dbus to set the hostname anyway ...
+
+    cat <<EOF
+if hostnamectl set-hostname '$name_should'; then
+    printf '%s\\n' '$name_should' > /etc/hostname
+    exit 0
+fi
+EOF
+fi
+
+# Use the good old way to set the hostname. Also if hostnamectl fails.
 case "$os" in
     archlinux|debian|ubuntu|devuan|centos|coreos|alpine)
         printf "printf '%%s\\\\n' '$name_should' > /etc/hostname\\n"
         echo "hostname -F /etc/hostname"
     ;;
     freebsd|openbsd)
+        # NOTE: Writing the hostname to file is done in the manifest.
         echo "hostname '$name_should'"
     ;;
     suse)
         echo "hostname '$name_should'"
         printf "printf '%%s\\\\n' '$name_should' > /etc/HOSTNAME\\n"
     ;;
+    *)
+        echo "echo 'Unsupported OS: $os' >&2; exit 1"
+    ;;
 esac
-
-if [ "$has_hostnamectl" ]; then
-    # Allow hostnamectl set-hostname to fail silently.
-    # Who the fuck invented a tool that needs dbus to set the hostname anyway ...
-    echo "hostnamectl set-hostname '$name_should' || true"
-fi
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 8f1adf12..5ea3b8ff 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -2,6 +2,7 @@
 #
 # 2012 Steven Armstrong (steven-cdist at armstrong.cc)
 # 2014 Nico Schottelius (nico-cdist at schottelius.org)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -63,6 +64,7 @@ case "$os" in
         echo "$name_should" | __file /etc/myname --source -
     ;;
     *)
-        not_supported
+        # On other operating systems we fall back to hostnamectl if available…
+        test -n "$(cat "$__object/explorer/has_hostnamectl")" || not_supported
     ;;
 esac

From 2804a8bae6de1f0c3ae376092a3102d8a6964373 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 15 Aug 2019 16:16:38 +0200
Subject: [PATCH 104/383] [__hostname] Add support for macosx

---
 cdist/conf/type/__hostname/explorer/hostname | 2 +-
 cdist/conf/type/__hostname/gencode-remote    | 3 +++
 cdist/conf/type/__hostname/manifest          | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__hostname/explorer/hostname b/cdist/conf/type/__hostname/explorer/hostname
index aaaa3a30..0b562d11 100644
--- a/cdist/conf/type/__hostname/explorer/hostname
+++ b/cdist/conf/type/__hostname/explorer/hostname
@@ -41,7 +41,7 @@ elif [ -f /etc/myname ]; then
 elif [ "$(uname -s)" == FreeBSD ]; then
     (. /etc/rc.conf && echo $hostname)
 # Mac OS X
-elif [ "$(uname -s)" == Darwin -a -f "$(command -v scutil)" ]; then
+elif [ "$(uname -s)" == Darwin -a -x "$(command -v scutil)" ]; then
     scutil --get HostName 2>/dev/null || hostname -s
 else
     command -v hostname && hostname -s
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 20de7078..ee12f822 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -86,6 +86,9 @@ case "$os" in
         echo "hostname '$name_should'"
         printf "printf '%%s\\\\n' '$name_should' > /etc/HOSTNAME\\n"
     ;;
+    macosx)
+        echo "scutil --set HostName '$name_should'"
+    ;;
     *)
         echo "echo 'Unsupported OS: $os' >&2; exit 1"
     ;;
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 5ea3b8ff..fe067718 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -42,7 +42,7 @@ not_supported() {
 }
 
 case "$os" in
-    archlinux|debian|suse|ubuntu|devuan|coreos|alpine)
+    archlinux|debian|suse|ubuntu|devuan|coreos|alpine|macosx)
         # handled in gencode-remote
         :
     ;;

From abc765bd99fae9e479dfed2a3d39e780a1ab3c34 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 30 Sep 2019 12:52:43 +0200
Subject: [PATCH 105/383] [__hostname/explorer/hostname] Darwin: Always fall
 back to hostname if scutil is missing or fails

---
 cdist/conf/type/__hostname/explorer/hostname | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__hostname/explorer/hostname b/cdist/conf/type/__hostname/explorer/hostname
index 0b562d11..8aab1ec0 100644
--- a/cdist/conf/type/__hostname/explorer/hostname
+++ b/cdist/conf/type/__hostname/explorer/hostname
@@ -41,8 +41,8 @@ elif [ -f /etc/myname ]; then
 elif [ "$(uname -s)" == FreeBSD ]; then
     (. /etc/rc.conf && echo $hostname)
 # Mac OS X
-elif [ "$(uname -s)" == Darwin -a -x "$(command -v scutil)" ]; then
-    scutil --get HostName 2>/dev/null || hostname -s
+elif [ "$(uname -s)" == Darwin ]; then
+    [ -x "$(command -v scutil)" ] && scutil --get HostName 2>/dev/null || hostname -s
 else
     command -v hostname && hostname -s
 fi

From fba14496e7ea19e32bffb6991a3512da6c1a4288 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 15 Aug 2019 16:12:56 +0200
Subject: [PATCH 106/383] [explorer/os] Unquote values from os-release file

---
 cdist/conf/explorer/os | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/explorer/os b/cdist/conf/explorer/os
index d522300c..563fa4cf 100755
--- a/cdist/conf/explorer/os
+++ b/cdist/conf/explorer/os
@@ -145,7 +145,7 @@ esac
 if [ -f /etc/os-release ]; then
    # already lowercase, according to:
    # https://www.freedesktop.org/software/systemd/man/os-release.html
-   awk -F= '/^ID=/ {print $2;}' /etc/os-release
+   awk -F= '/^ID=/ { if ($2 ~ /^'"'"'(.*)'"'"'$/ || $2 ~ /^"(.*)"$/) { print substr($2, 2, length($2) - 2) } else { print $2 } }' /etc/os-release
    exit 0
 fi
 

From 81ba849af8340ff3d59646d602a429b9170b9701 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 3 Oct 2019 19:19:06 +0200
Subject: [PATCH 107/383] Move __hostname hostname explorer to global scope

---
 cdist/conf/explorer/hostname                  | 24 ++++++++--
 cdist/conf/type/__hostname/explorer/hostname  | 48 -------------------
 .../__hostname/explorer/hostname_sysconfig    |  2 +-
 3 files changed, 21 insertions(+), 53 deletions(-)
 delete mode 100644 cdist/conf/type/__hostname/explorer/hostname

diff --git a/cdist/conf/explorer/hostname b/cdist/conf/explorer/hostname
index 7715c6b0..13ac91c2 100755
--- a/cdist/conf/explorer/hostname
+++ b/cdist/conf/explorer/hostname
@@ -1,7 +1,6 @@
 #!/bin/sh
 #
-# 2010-2014 Nico Schottelius (nico-cdist at schottelius.org)
-# 2012 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -19,7 +18,24 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 #
+# Retrieve the running hostname
+#
 
-if command -v uname >/dev/null; then
-   uname -n
+# Firstly, check hostnamectl if available.
+if command -v hostnamectl >/dev/null
+then
+	hostnamectl status --static && exit 0
+fi
+
+# In case hostnamectl is missing or failed:
+# We fall back to alternative approaches
+if [ "$(uname -s)" = Darwin ] && command -v scutil >/dev/null
+then
+	# Mac OS X
+	scutil --get HostName 2>/dev/null
+elif command -v hostname >/dev/null
+then
+	hostname -s
+else
+	uname -n
 fi
diff --git a/cdist/conf/type/__hostname/explorer/hostname b/cdist/conf/type/__hostname/explorer/hostname
deleted file mode 100644
index 8aab1ec0..00000000
--- a/cdist/conf/type/__hostname/explorer/hostname
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/bin/sh
-#
-# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-# Retrieve the running hostname
-#
-
-# Firstly, check hostnamectl if available.
-if command -v hostnamectl >/dev/null
-then
-    hostnamectl --static && exit 0
-fi
-
-
-# Almost any distribution
-if [ -f /etc/hostname ]; then
-    cat /etc/hostname
-# SuSE
-elif [ -f /etc/HOSTNAME ]; then
-    cat /etc/HOSTNAME
-# OpenBSD
-elif [ -f /etc/myname ]; then
-    cat /etc/myname
-# FreeBSD
-elif [ "$(uname -s)" == FreeBSD ]; then
-    (. /etc/rc.conf && echo $hostname)
-# Mac OS X
-elif [ "$(uname -s)" == Darwin ]; then
-    [ -x "$(command -v scutil)" ] && scutil --get HostName 2>/dev/null || hostname -s
-else
-    command -v hostname && hostname -s
-fi
diff --git a/cdist/conf/type/__hostname/explorer/hostname_sysconfig b/cdist/conf/type/__hostname/explorer/hostname_sysconfig
index d0d7b4e7..4d6b8513 100755
--- a/cdist/conf/type/__hostname/explorer/hostname_sysconfig
+++ b/cdist/conf/type/__hostname/explorer/hostname_sysconfig
@@ -18,7 +18,7 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 #
-# Retrieve the contents of /etc/hostname
+# Retrieve the contents of /etc/sysconfig/network
 #
 
 if [ -f /etc/sysconfig/network ]; then

From b039e4b1b4a4802059f8ed893c352d9f153734ae Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 3 Oct 2019 20:36:25 +0200
Subject: [PATCH 108/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index e63acd5d..b475af5b 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,6 +7,7 @@ next:
 	* Type __ssh_authorized_keys: Support OSes without getent (Dennis Camera)
 	* Type __ssh_dot_ssh: Support OSes without getent (Dennis Camera)
 	* Explorer interfaces: Always sort output (Dennis Camera)
+	* Explorer os: Unquote value from os-release file (Dennis Camera)
 
 6.0.0: 2019-10-01
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)

From ee440ec61996b53889dff3327d1fd4c4fa0f2a57 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 3 Oct 2019 21:41:51 +0200
Subject: [PATCH 109/383] [__hostname] Compress state check

---
 cdist/conf/type/__hostname/gencode-remote | 29 +++++++++--------------
 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index ee12f822..c6779a22 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -33,25 +33,18 @@ name_sysconfig=$(cat "$__object/explorer/hostname_sysconfig")
 has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
 
 ################################################################################
-# If everything is ok -> exit
+# Check if the hostname is already correct
 #
-case "$os" in
-    archlinux|debian|suse|ubuntu|devuan|coreos|alpine)
-        if [ "$name_config" = "$name_should" ] && [ "$name_running" = "$name_should" ]; then
-            exit 0
-        fi
-    ;;
-    scientific|centos|freebsd|openbsd)
-        if [ "$name_sysconfig" = "$name_should" ] && [ "$name_running" = "$name_should" ]; then
-            exit 0
-        fi
-    ;;
-    *)
-        if [ "$name_running" -a "$name_running" = "$name_should" ]; then
-            exit 0
-        fi
-    ;;
-esac
+if [ "$name_running" = "$name_should" ]; then
+    case "$os" in
+        archlinux|debian|suse|ubuntu|devuan|coreos|alpine)
+            [ "$name_config" != "$name_should" ] || exit 0
+        ;;
+        scientific|centos|freebsd|openbsd)
+            [ "$name_sysconfig" != "$name_should" ] || exit 0
+        ;;
+    esac
+fi
 
 ################################################################################
 # Setup hostname

From 644768cc02a4bf0a58a9ae83d3aaa3a318f5f9c8 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 2 Oct 2019 15:37:51 +0200
Subject: [PATCH 110/383] Add __select_editor type

---
 .../type/__select_editor/explorer/editor_path | 97 +++++++++++++++++++
 .../conf/type/__select_editor/explorer/group  | 26 +++++
 .../type/__select_editor/explorer/user_home   | 26 +++++
 cdist/conf/type/__select_editor/man.rst       | 51 ++++++++++
 cdist/conf/type/__select_editor/manifest      | 59 +++++++++++
 .../__select_editor/parameter/default/state   |  1 +
 .../type/__select_editor/parameter/optional   |  1 +
 .../type/__select_editor/parameter/required   |  1 +
 8 files changed, 262 insertions(+)
 create mode 100644 cdist/conf/type/__select_editor/explorer/editor_path
 create mode 100644 cdist/conf/type/__select_editor/explorer/group
 create mode 100644 cdist/conf/type/__select_editor/explorer/user_home
 create mode 100644 cdist/conf/type/__select_editor/man.rst
 create mode 100644 cdist/conf/type/__select_editor/manifest
 create mode 100644 cdist/conf/type/__select_editor/parameter/default/state
 create mode 100644 cdist/conf/type/__select_editor/parameter/optional
 create mode 100644 cdist/conf/type/__select_editor/parameter/required

diff --git a/cdist/conf/type/__select_editor/explorer/editor_path b/cdist/conf/type/__select_editor/explorer/editor_path
new file mode 100644
index 00000000..88952e23
--- /dev/null
+++ b/cdist/conf/type/__select_editor/explorer/editor_path
@@ -0,0 +1,97 @@
+#!/bin/sh
+#
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# Check if the given editor is present on the target system and determine its
+# absolute path.
+#
+
+case $("${__explorer}/os")
+in
+	debian|devuan|ubuntu)
+		:  # supported
+		;;
+	*)
+		exit 0  # will produce an error message in the manifest
+		;;
+esac
+
+
+editor=$(cat "${__object}/parameter/editor")
+editors=$(update-alternatives --list editor)
+
+if test $(echo "${editors}" | wc -l) -lt 1
+then
+	echo 'No editors have been found on this system.' >&2
+	exit 1
+fi
+
+case $editor
+in
+	/*)
+		is_path=true
+		;;
+	*/*)
+		echo 'Relative editor paths are not supported' >&2
+		exit 1
+		;;
+	*)
+		is_path=false
+		;;
+esac
+
+
+IFS='
+'
+if $is_path
+then
+	if ! test -f "${editor}"
+	then
+		echo "Editor ${editor} is missing on the target system." >&2
+		exit 1
+	fi
+
+	for e in $editors
+	do
+		if test "${editor}" = "${e}"
+		then
+			# Editor is present and part of the alternatives list -> use it!
+			echo "${editor}"
+			exit 0
+		fi
+	done
+
+	echo "Editor ${editor} is not in the alternatives list of the target system." >&2
+	exit 1
+else
+	for e in $editors
+	do
+		if test "$(basename "${e}")" = "${editor}"
+		then
+			# Editor could be found by basename in the alternatives list -> use it!
+			echo "${e}"
+			exit 0
+		fi
+	done
+
+	echo "Editor ${editor} is missing on the target system." >&2
+	exit 1
+fi
+
+exit 1
diff --git a/cdist/conf/type/__select_editor/explorer/group b/cdist/conf/type/__select_editor/explorer/group
new file mode 100644
index 00000000..5d288189
--- /dev/null
+++ b/cdist/conf/type/__select_editor/explorer/group
@@ -0,0 +1,26 @@
+#!/bin/sh -e
+#
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# Determines the primary group of the user.
+#
+
+user=$__object_id
+
+id -gn "${user}" 2>/dev/null
diff --git a/cdist/conf/type/__select_editor/explorer/user_home b/cdist/conf/type/__select_editor/explorer/user_home
new file mode 100644
index 00000000..dc1725a0
--- /dev/null
+++ b/cdist/conf/type/__select_editor/explorer/user_home
@@ -0,0 +1,26 @@
+#!/bin/sh
+#
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# Determines the home folder of the target user.
+#
+
+user=$__object_id
+
+getent passwd "${user}" | cut -d':' -f6
diff --git a/cdist/conf/type/__select_editor/man.rst b/cdist/conf/type/__select_editor/man.rst
new file mode 100644
index 00000000..98e5ef81
--- /dev/null
+++ b/cdist/conf/type/__select_editor/man.rst
@@ -0,0 +1,51 @@
+cdist-type__select_editor(7)
+============================
+
+NAME
+----
+cdist-type__select_editor - Select the sensible-editor
+
+
+DESCRIPTION
+-----------
+This cdist type allows you to select the sensible-editor on Debian-based systems
+for a given user.
+
+
+REQUIRED PARAMETERS
+-------------------
+editor
+    Name or path of the editor to be selected.
+
+
+OPTIONAL PARAMETERS
+-------------------
+state
+    either "present" or "absent". Defaults to "present".
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __select_editor root --editor /bin/ed  # ed(1) is the standard
+    __select_editor noob --editor nano
+
+
+SEE ALSO
+--------
+none
+
+
+AUTHOR
+-------
+Dennis Camera <dennis.camera--@--ssrq-sds-fds.ch>
+
+
+COPYING
+-------
+Copyright \(C) 2019 Dennis Camera.
+You can redistribute it and/or modify it under the terms of the GNU General
+Public License as published by the Free Software Foundation, either version 3 of
+the License, or (at your option) any later version.
diff --git a/cdist/conf/type/__select_editor/manifest b/cdist/conf/type/__select_editor/manifest
new file mode 100644
index 00000000..5ed97533
--- /dev/null
+++ b/cdist/conf/type/__select_editor/manifest
@@ -0,0 +1,59 @@
+#!/bin/sh -e
+# -*- mode: sh; indent-tabs-mode: t -*-
+#
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+os=$(cat "${__global}/explorer/os")
+
+state=$(cat "${__object}/parameter/state")
+user=$__object_id
+
+editor_path=$(cat "${__object}/explorer/editor_path")
+user_home=$(cat "${__object}/explorer/user_home")
+group=$(cat "${__object}/explorer/group")
+
+case $os
+in
+	debian|devuan|ubuntu)
+		test "${state}" = 'present' && __package_apt sensible-utils --state present
+		;;
+	*)
+		echo "OS ${os} does not support select-editor." >&2
+		exit 1
+		;;
+esac
+
+if test -z "${user_home}"
+then
+	echo "Could not find ${user}'s home directory." >&2
+	exit 1
+fi
+
+if test -z "${editor_path}"
+then
+	echo "Editor \"$(cat "${__object}/parameter/editor")\" is missing on the target system." >&2
+	exit 1
+fi
+
+__file "${user_home}/.selected_editor" --state "${state}" \
+	--owner "${user}" --group "${group}" --mode 0644 \
+	--source - <<EOF
+# Managed by cdist
+SELECTED_EDITOR="${editor_path}"
+EOF
diff --git a/cdist/conf/type/__select_editor/parameter/default/state b/cdist/conf/type/__select_editor/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__select_editor/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__select_editor/parameter/optional b/cdist/conf/type/__select_editor/parameter/optional
new file mode 100644
index 00000000..ff72b5c7
--- /dev/null
+++ b/cdist/conf/type/__select_editor/parameter/optional
@@ -0,0 +1 @@
+state
diff --git a/cdist/conf/type/__select_editor/parameter/required b/cdist/conf/type/__select_editor/parameter/required
new file mode 100644
index 00000000..85042acd
--- /dev/null
+++ b/cdist/conf/type/__select_editor/parameter/required
@@ -0,0 +1 @@
+editor

From a432d6a51e7e5cf6e2e788e72e2ce20ba4ca3dcf Mon Sep 17 00:00:00 2001
From: Ahmed Bilal Khalid <ahmedbilal96@gmail.com>
Date: Fri, 4 Oct 2019 14:13:10 +0500
Subject: [PATCH 111/383] Support Added for Debian 10* in __letsencrypt_cert

---
 cdist/conf/type/__letsencrypt_cert/manifest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest
index f736f3f2..1d96ee1a 100755
--- a/cdist/conf/type/__letsencrypt_cert/manifest
+++ b/cdist/conf/type/__letsencrypt_cert/manifest
@@ -33,6 +33,9 @@ if [ -z "${certbot_fullpath}" ]; then
 					require="__apt_source/stretch-backports" __package_apt certbot \
 						--target-release stretch-backports
 				;;
+				10*)
+					__package_apt certbot
+				;;
 				*)
 					echo "Unsupported OS version: $os_version" >&2
 					exit 1

From 9e9c3982a851195dc223c1c6d5d37f0d37fd697b Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Fri, 4 Oct 2019 14:04:17 +0200
Subject: [PATCH 112/383] Rename __select_editor to __sensible_editor

---
 .../explorer/editor_path                               |  0
 .../explorer/group                                     |  0
 .../explorer/user_home                                 |  0
 .../{__select_editor => __sensible_editor}/man.rst     | 10 +++++-----
 .../{__select_editor => __sensible_editor}/manifest    |  0
 .../parameter/default/state                            |  0
 .../parameter/optional                                 |  0
 .../parameter/required                                 |  0
 8 files changed, 5 insertions(+), 5 deletions(-)
 rename cdist/conf/type/{__select_editor => __sensible_editor}/explorer/editor_path (100%)
 rename cdist/conf/type/{__select_editor => __sensible_editor}/explorer/group (100%)
 rename cdist/conf/type/{__select_editor => __sensible_editor}/explorer/user_home (100%)
 rename cdist/conf/type/{__select_editor => __sensible_editor}/man.rst (73%)
 rename cdist/conf/type/{__select_editor => __sensible_editor}/manifest (100%)
 rename cdist/conf/type/{__select_editor => __sensible_editor}/parameter/default/state (100%)
 rename cdist/conf/type/{__select_editor => __sensible_editor}/parameter/optional (100%)
 rename cdist/conf/type/{__select_editor => __sensible_editor}/parameter/required (100%)

diff --git a/cdist/conf/type/__select_editor/explorer/editor_path b/cdist/conf/type/__sensible_editor/explorer/editor_path
similarity index 100%
rename from cdist/conf/type/__select_editor/explorer/editor_path
rename to cdist/conf/type/__sensible_editor/explorer/editor_path
diff --git a/cdist/conf/type/__select_editor/explorer/group b/cdist/conf/type/__sensible_editor/explorer/group
similarity index 100%
rename from cdist/conf/type/__select_editor/explorer/group
rename to cdist/conf/type/__sensible_editor/explorer/group
diff --git a/cdist/conf/type/__select_editor/explorer/user_home b/cdist/conf/type/__sensible_editor/explorer/user_home
similarity index 100%
rename from cdist/conf/type/__select_editor/explorer/user_home
rename to cdist/conf/type/__sensible_editor/explorer/user_home
diff --git a/cdist/conf/type/__select_editor/man.rst b/cdist/conf/type/__sensible_editor/man.rst
similarity index 73%
rename from cdist/conf/type/__select_editor/man.rst
rename to cdist/conf/type/__sensible_editor/man.rst
index 98e5ef81..4dd20a3e 100644
--- a/cdist/conf/type/__select_editor/man.rst
+++ b/cdist/conf/type/__sensible_editor/man.rst
@@ -1,9 +1,9 @@
-cdist-type__select_editor(7)
+cdist-type__sensible_editor(7)
 ============================
 
 NAME
 ----
-cdist-type__select_editor - Select the sensible-editor
+cdist-type__sensible_editor - Select the sensible-editor
 
 
 DESCRIPTION
@@ -21,7 +21,7 @@ editor
 OPTIONAL PARAMETERS
 -------------------
 state
-    either "present" or "absent". Defaults to "present".
+    Either "present" or "absent". Defaults to "present".
 
 
 EXAMPLES
@@ -29,8 +29,8 @@ EXAMPLES
 
 .. code-block:: sh
 
-    __select_editor root --editor /bin/ed  # ed(1) is the standard
-    __select_editor noob --editor nano
+    __sensible_editor root --editor /bin/ed  # ed(1) is the standard
+    __sensible_editor noob --editor nano
 
 
 SEE ALSO
diff --git a/cdist/conf/type/__select_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
similarity index 100%
rename from cdist/conf/type/__select_editor/manifest
rename to cdist/conf/type/__sensible_editor/manifest
diff --git a/cdist/conf/type/__select_editor/parameter/default/state b/cdist/conf/type/__sensible_editor/parameter/default/state
similarity index 100%
rename from cdist/conf/type/__select_editor/parameter/default/state
rename to cdist/conf/type/__sensible_editor/parameter/default/state
diff --git a/cdist/conf/type/__select_editor/parameter/optional b/cdist/conf/type/__sensible_editor/parameter/optional
similarity index 100%
rename from cdist/conf/type/__select_editor/parameter/optional
rename to cdist/conf/type/__sensible_editor/parameter/optional
diff --git a/cdist/conf/type/__select_editor/parameter/required b/cdist/conf/type/__sensible_editor/parameter/required
similarity index 100%
rename from cdist/conf/type/__select_editor/parameter/required
rename to cdist/conf/type/__sensible_editor/parameter/required

From 2eebc300cfe599f4d78ed8dfd2509594fe6836b1 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Fri, 4 Oct 2019 14:50:20 +0200
Subject: [PATCH 113/383] Only ignore MANIFEST file in root directory

On systems with case-insensitive file systems (like Mac OS X) the previous line
also ignores all types' manifest files.
This commit changes the .gitignore to only ignore the MANIFEST file in the root
directory generated for the PyPI release.
---
 .gitignore | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 4b80b425..ed8b453a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,7 +34,7 @@ cdist/inventory/
 # Python: cache, distutils, distribution in general
 __pycache__/
 *.pyc
-MANIFEST
+/MANIFEST
 dist/
 cdist/version.py
 cdist.egg-info/

From f5342e9a35c6660004392f400c0843b26e65562a Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Fri, 4 Oct 2019 20:03:19 +0200
Subject: [PATCH 114/383] [explorer/hostname] Remove code reading persistent
 hostname

---
 cdist/conf/explorer/hostname | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/cdist/conf/explorer/hostname b/cdist/conf/explorer/hostname
index 13ac91c2..a16afb65 100755
--- a/cdist/conf/explorer/hostname
+++ b/cdist/conf/explorer/hostname
@@ -21,19 +21,7 @@
 # Retrieve the running hostname
 #
 
-# Firstly, check hostnamectl if available.
-if command -v hostnamectl >/dev/null
-then
-	hostnamectl status --static && exit 0
-fi
-
-# In case hostnamectl is missing or failed:
-# We fall back to alternative approaches
-if [ "$(uname -s)" = Darwin ] && command -v scutil >/dev/null
-then
-	# Mac OS X
-	scutil --get HostName 2>/dev/null
-elif command -v hostname >/dev/null
+if command -v hostname >/dev/null
 then
 	hostname -s
 else

From 69170b20f667b8fa3b2fd4424d60060dc1c5a149 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 4 Oct 2019 20:07:28 +0200
Subject: [PATCH 115/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index b475af5b..e56bf3b5 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -8,6 +8,7 @@ next:
 	* Type __ssh_dot_ssh: Support OSes without getent (Dennis Camera)
 	* Explorer interfaces: Always sort output (Dennis Camera)
 	* Explorer os: Unquote value from os-release file (Dennis Camera)
+	* Type __letsencrypt_cert: Support Debian 10* (Ahmed Bilal Khalid)
 
 6.0.0: 2019-10-01
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)

From d106632b2fdd07f804af4c395fedc65b328e1dc7 Mon Sep 17 00:00:00 2001
From: Dominique Roux <dominique.roux@ungleich.ch>
Date: Sat, 5 Oct 2019 07:48:58 +0200
Subject: [PATCH 116/383] Added missing exit 1 in __prometheus_server cdist
 type

---
 cdist/conf/type/__prometheus_server/manifest | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cdist/conf/type/__prometheus_server/manifest b/cdist/conf/type/__prometheus_server/manifest
index 8685130f..73a0799c 100755
--- a/cdist/conf/type/__prometheus_server/manifest
+++ b/cdist/conf/type/__prometheus_server/manifest
@@ -33,6 +33,7 @@ if [ -f "$__object/parameter/install-from-backports" ]; then
 		*)
 			echo "--install-from-backports is only supported on Devuan -- ignoring." >&2
 			echo "Send a pull request if you require it." >&2
+			exit 1
 		;;
 	esac
 else

From 4c21781c4beec7fae27a310991d12a1bd61c1309 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 5 Oct 2019 07:52:34 +0200
Subject: [PATCH 117/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index e56bf3b5..5d9dab73 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -9,6 +9,7 @@ next:
 	* Explorer interfaces: Always sort output (Dennis Camera)
 	* Explorer os: Unquote value from os-release file (Dennis Camera)
 	* Type __letsencrypt_cert: Support Debian 10* (Ahmed Bilal Khalid)
+	* Type __prometheus_server: Add missing exit after unsupported error message (Dominique Roux)
 
 6.0.0: 2019-10-01
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)

From 56c654808d84630e82f60ae0376cf3e5b54274c2 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Fri, 4 Oct 2019 20:35:14 +0200
Subject: [PATCH 118/383] [__hostname] Unify persistent hostname explorers

---
 .../type/__hostname/explorer/hostname_file    | 30 -----------
 .../__hostname/explorer/hostname_sysconfig    | 26 ----------
 .../__hostname/explorer/persistent_hostname   | 52 +++++++++++++++++++
 cdist/conf/type/__hostname/gencode-remote     | 14 ++---
 4 files changed, 55 insertions(+), 67 deletions(-)
 delete mode 100755 cdist/conf/type/__hostname/explorer/hostname_file
 delete mode 100755 cdist/conf/type/__hostname/explorer/hostname_sysconfig
 create mode 100755 cdist/conf/type/__hostname/explorer/persistent_hostname

diff --git a/cdist/conf/type/__hostname/explorer/hostname_file b/cdist/conf/type/__hostname/explorer/hostname_file
deleted file mode 100755
index 6a00aa9f..00000000
--- a/cdist/conf/type/__hostname/explorer/hostname_file
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/sh
-#
-# 2014 Nico Schottelius (nico-cdist at schottelius.org)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-# Retrieve the contents of /etc/hostname
-#
-
-# Almost any distribution
-if [ -f /etc/hostname ]; then
-    cat /etc/hostname
-# SuSE
-elif [ -f /etc/HOSTNAME ]; then
-    cat /etc/HOSTNAME
-fi
diff --git a/cdist/conf/type/__hostname/explorer/hostname_sysconfig b/cdist/conf/type/__hostname/explorer/hostname_sysconfig
deleted file mode 100755
index 4d6b8513..00000000
--- a/cdist/conf/type/__hostname/explorer/hostname_sysconfig
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-#
-# 2014 Nico Schottelius (nico-cdist at schottelius.org)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-# Retrieve the contents of /etc/sysconfig/network
-#
-
-if [ -f /etc/sysconfig/network ]; then
-    awk -F= '/^HOSTNAME=/ { print $2 }' /etc/sysconfig/network
-fi
diff --git a/cdist/conf/type/__hostname/explorer/persistent_hostname b/cdist/conf/type/__hostname/explorer/persistent_hostname
new file mode 100755
index 00000000..9ec5639b
--- /dev/null
+++ b/cdist/conf/type/__hostname/explorer/persistent_hostname
@@ -0,0 +1,52 @@
+#!/bin/sh
+#
+# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# Retrieve the persistent hostname
+#
+
+# Firstly, check hostnamectl if available.
+if command -v hostnamectl >/dev/null
+then
+	hostnamectl status --static && exit 0
+fi
+
+# In case hostnamectl is missing or failed:
+# Fall back to alternative OS-specific approaches.
+case $("$__explorer/os")
+in
+	alpine|archlinux|coreos|debian|devuan|suse|ubuntu)
+		[ -f /etc/hostname ] && cat /etc/hostname
+		;;
+	suse)
+		[ -f /etc/HOSTNAME ] && cat /etc/HOSTNAME
+		;;
+	scientific|centos)
+		[ -f /etc/sysconfig/network ] && awk -F= '/^HOSTNAME=/ { print $2 }' /etc/sysconfig/network
+		;;
+	freebsd)
+		(. /etc/rc.conf && echo "$hostname")
+		;;
+	openbsd)
+		cat /etc/myname
+		;;
+	macosx)
+		scutil --get HostName 2>/dev/null
+		;;
+esac
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index c6779a22..e7f32323 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -28,22 +28,14 @@ fi
 
 os=$(cat "$__global/explorer/os")
 name_running=$(cat "$__global/explorer/hostname")
-name_config=$(cat "$__object/explorer/hostname_file")
-name_sysconfig=$(cat "$__object/explorer/hostname_sysconfig")
+name_config=$(cat "$__object/explorer/persistent_hostname")
 has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
 
 ################################################################################
 # Check if the hostname is already correct
 #
-if [ "$name_running" = "$name_should" ]; then
-    case "$os" in
-        archlinux|debian|suse|ubuntu|devuan|coreos|alpine)
-            [ "$name_config" != "$name_should" ] || exit 0
-        ;;
-        scientific|centos|freebsd|openbsd)
-            [ "$name_sysconfig" != "$name_should" ] || exit 0
-        ;;
-    esac
+if [ "$name_running" = "$name_should" ] && [ ! "$name_config" -o "$name_config" = "$name_should" ]; then
+    exit 0
 fi
 
 ################################################################################

From 1bab641c948174d82653736bfbbd39b09aa61801 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 5 Oct 2019 18:43:06 +0200
Subject: [PATCH 119/383] [explorer/hostname] Do not shorten hostname in any
 case

---
 cdist/conf/explorer/hostname | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/explorer/hostname b/cdist/conf/explorer/hostname
index a16afb65..dca004d1 100755
--- a/cdist/conf/explorer/hostname
+++ b/cdist/conf/explorer/hostname
@@ -23,7 +23,7 @@
 
 if command -v hostname >/dev/null
 then
-	hostname -s
+	hostname
 else
 	uname -n
 fi

From 9a6ca1a343d983cc9e838ee23776af31cb21cadd Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 12:07:54 +0200
Subject: [PATCH 120/383] [__sensible_editor] Remove mixed error reporting from
 manifest

---
 .../__sensible_editor/explorer/editor_path     |  2 +-
 .../type/__sensible_editor/explorer/user_home  | 11 +++++++++--
 cdist/conf/type/__sensible_editor/man.rst      |  2 +-
 cdist/conf/type/__sensible_editor/manifest     | 18 +++---------------
 4 files changed, 14 insertions(+), 19 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/explorer/editor_path b/cdist/conf/type/__sensible_editor/explorer/editor_path
index 88952e23..a1673a52 100644
--- a/cdist/conf/type/__sensible_editor/explorer/editor_path
+++ b/cdist/conf/type/__sensible_editor/explorer/editor_path
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -e
 #
 # 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
diff --git a/cdist/conf/type/__sensible_editor/explorer/user_home b/cdist/conf/type/__sensible_editor/explorer/user_home
index dc1725a0..b88243f7 100644
--- a/cdist/conf/type/__sensible_editor/explorer/user_home
+++ b/cdist/conf/type/__sensible_editor/explorer/user_home
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -e
 #
 # 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
@@ -22,5 +22,12 @@
 #
 
 user=$__object_id
+home=$(getent passwd "${user}" | cut -d':' -f6)
 
-getent passwd "${user}" | cut -d':' -f6
+if ! test -d "${home}"
+then
+	echo "Cannot find home directory of user ${user}" >&2
+	exit 1
+fi
+
+echo "${home}"
diff --git a/cdist/conf/type/__sensible_editor/man.rst b/cdist/conf/type/__sensible_editor/man.rst
index 4dd20a3e..2d7682a6 100644
--- a/cdist/conf/type/__sensible_editor/man.rst
+++ b/cdist/conf/type/__sensible_editor/man.rst
@@ -1,5 +1,5 @@
 cdist-type__sensible_editor(7)
-============================
+==============================
 
 NAME
 ----
diff --git a/cdist/conf/type/__sensible_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
index 5ed97533..b02625e2 100644
--- a/cdist/conf/type/__sensible_editor/manifest
+++ b/cdist/conf/type/__sensible_editor/manifest
@@ -24,10 +24,6 @@ os=$(cat "${__global}/explorer/os")
 state=$(cat "${__object}/parameter/state")
 user=$__object_id
 
-editor_path=$(cat "${__object}/explorer/editor_path")
-user_home=$(cat "${__object}/explorer/user_home")
-group=$(cat "${__object}/explorer/group")
-
 case $os
 in
 	debian|devuan|ubuntu)
@@ -39,17 +35,9 @@ in
 		;;
 esac
 
-if test -z "${user_home}"
-then
-	echo "Could not find ${user}'s home directory." >&2
-	exit 1
-fi
-
-if test -z "${editor_path}"
-then
-	echo "Editor \"$(cat "${__object}/parameter/editor")\" is missing on the target system." >&2
-	exit 1
-fi
+editor_path=$(cat "${__object}/explorer/editor_path")
+user_home=$(cat "${__object}/explorer/user_home")
+group=$(cat "${__object}/explorer/group")
 
 __file "${user_home}/.selected_editor" --state "${state}" \
 	--owner "${user}" --group "${group}" --mode 0644 \

From d43eb5b22f11696d6992cbb6375806f7a8af133a Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 5 Oct 2019 20:10:52 +0200
Subject: [PATCH 121/383] [__hostname] Add support for NetBSD

---
 .../conf/type/__hostname/explorer/persistent_hostname  | 10 ++++++++++
 cdist/conf/type/__hostname/manifest                    |  9 +++++++++
 2 files changed, 19 insertions(+)

diff --git a/cdist/conf/type/__hostname/explorer/persistent_hostname b/cdist/conf/type/__hostname/explorer/persistent_hostname
index 9ec5639b..8909ebaa 100755
--- a/cdist/conf/type/__hostname/explorer/persistent_hostname
+++ b/cdist/conf/type/__hostname/explorer/persistent_hostname
@@ -43,6 +43,16 @@ in
 	freebsd)
 		(. /etc/rc.conf && echo "$hostname")
 		;;
+	netbsd)
+		if grep -q '^hostname=' /etc/rc.conf
+		then
+			(. /etc/rc.conf && echo "$hostname")
+		elif [ -f /etc/myname ]
+		then
+			# Fall back to /etc/myname file
+			cat /etc/myname
+		fi
+		;;
 	openbsd)
 		cat /etc/myname
 		;;
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index fe067718..b0948d24 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -60,6 +60,15 @@ case "$os" in
             --key 'hostname' \
             --value "$name_should"
     ;;
+    netbsd)
+        __key_value rcconf-hostname \
+            --file /etc/rc.conf \
+            --delimiter '=' \
+            --key 'hostname' \
+            --value "\"$name_should\""
+        # To avoid confusion, ensure that the hostname is only stored once
+        __file /etc/myname --state absent
+    ;;
     openbsd)
         echo "$name_should" | __file /etc/myname --source -
     ;;

From 77210c349e70bd1f54394f1873c768ddb62d7ea9 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 17:56:37 +0200
Subject: [PATCH 122/383] [__hostname] Extend os switches with
 RedHat-derivatives (CentOS, Fedora, RedHat, Scientific)

---
 cdist/conf/type/__hostname/explorer/persistent_hostname | 2 +-
 cdist/conf/type/__hostname/gencode-remote               | 6 +++---
 cdist/conf/type/__hostname/manifest                     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/type/__hostname/explorer/persistent_hostname b/cdist/conf/type/__hostname/explorer/persistent_hostname
index 8909ebaa..ce71d06a 100755
--- a/cdist/conf/type/__hostname/explorer/persistent_hostname
+++ b/cdist/conf/type/__hostname/explorer/persistent_hostname
@@ -37,7 +37,7 @@ in
 	suse)
 		[ -f /etc/HOSTNAME ] && cat /etc/HOSTNAME
 		;;
-	scientific|centos)
+	centos|fedora|redhat|scientific)
 		[ -f /etc/sysconfig/network ] && awk -F= '/^HOSTNAME=/ { print $2 }' /etc/sysconfig/network
 		;;
 	freebsd)
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index e7f32323..e3f1bee4 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -58,12 +58,12 @@ EOF
 fi
 
 # Use the good old way to set the hostname. Also if hostnamectl fails.
-case "$os" in
-    archlinux|debian|ubuntu|devuan|centos|coreos|alpine)
+case $os in
+    archlinux|debian|ubuntu|devuan|coreos|alpine)
         printf "printf '%%s\\\\n' '$name_should' > /etc/hostname\\n"
         echo "hostname -F /etc/hostname"
     ;;
-    freebsd|openbsd)
+    centos|fedora|redhat|scientific|freebsd|openbsd)
         # NOTE: Writing the hostname to file is done in the manifest.
         echo "hostname '$name_should'"
     ;;
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index b0948d24..ccd11c4e 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -46,7 +46,7 @@ case "$os" in
         # handled in gencode-remote
         :
     ;;
-    scientific|centos)
+    centos|fedora|redhat|scientific)
         __key_value sysconfig-hostname \
             --file /etc/sysconfig/network \
             --delimiter '=' \

From 7bf203509bdaf42c88fbc67fbdd8dd1a15a6e21d Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 18:01:58 +0200
Subject: [PATCH 123/383] [__hostname] Use __key_value exact_delimiter for
 shell-like files

---
 cdist/conf/type/__hostname/manifest | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index ccd11c4e..f1c17653 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -49,21 +49,21 @@ case "$os" in
     centos|fedora|redhat|scientific)
         __key_value sysconfig-hostname \
             --file /etc/sysconfig/network \
-            --delimiter '=' \
+            --delimiter '=' --exact_delimiter \
             --key HOSTNAME \
-            --value "$name_should" --exact_delimiter
+            --value "\"$name_should\""
     ;;
     freebsd)
         __key_value rcconf-hostname \
             --file /etc/rc.conf \
-            --delimiter '=' \
+            --delimiter '=' --exact_delimiter \
             --key 'hostname' \
             --value "$name_should"
     ;;
     netbsd)
         __key_value rcconf-hostname \
             --file /etc/rc.conf \
-            --delimiter '=' \
+            --delimiter '=' --exact_delimiter \
             --key 'hostname' \
             --value "\"$name_should\""
         # To avoid confusion, ensure that the hostname is only stored once

From 74568e8a0aa0f1e8222aff49c9b00f667694b0c3 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 18:02:24 +0200
Subject: [PATCH 124/383] [__hostname] Use FQDN as hostname on RedHat
 derivatives and BSDs

---
 cdist/conf/type/__hostname/manifest | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index f1c17653..5d9eeeeb 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -25,10 +25,13 @@ if [ -f "$__object/parameter/name" ]; then
     name_should="$(cat "$__object/parameter/name")"
 else
     case "$os" in
-    openbsd)
+    # RedHat-derivatives and BSDs
+    centos|fedora|redhat|scientific|freebsd|netbsd|openbsd)
+        # Hostname is FQDN
         name_should="${__target_host}"
     ;;
     *)
+        # Hostname is only first component of FQDN
         name_should="${__target_host%%.*}"
     ;;
     esac

From 3e7cf68de590c755c74bd3542166a698b86b27d4 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 18:14:35 +0200
Subject: [PATCH 125/383] [__hostname] Source sysconfig file instead of
 processing through AWK

This way quotes and expansions will be handled correctly.
---
 cdist/conf/type/__hostname/explorer/persistent_hostname | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__hostname/explorer/persistent_hostname b/cdist/conf/type/__hostname/explorer/persistent_hostname
index ce71d06a..6bc0786f 100755
--- a/cdist/conf/type/__hostname/explorer/persistent_hostname
+++ b/cdist/conf/type/__hostname/explorer/persistent_hostname
@@ -38,7 +38,8 @@ in
 		[ -f /etc/HOSTNAME ] && cat /etc/HOSTNAME
 		;;
 	centos|fedora|redhat|scientific)
-		[ -f /etc/sysconfig/network ] && awk -F= '/^HOSTNAME=/ { print $2 }' /etc/sysconfig/network
+		[ -f /etc/sysconfig/network ] \
+			&& (. /etc/sysconfig/network && echo "$HOSTNAME")
 		;;
 	freebsd)
 		(. /etc/rc.conf && echo "$hostname")

From cbb108d61c20d2699946f819aff77de99b7bb94f Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 18:23:56 +0200
Subject: [PATCH 126/383] [__hostname] Copy FQDN-logic to gencode-remote

Otherwise, the code-remote gets run on the remote every time.
---
 cdist/conf/type/__hostname/gencode-remote | 23 +++++++++++++++++------
 cdist/conf/type/__hostname/manifest       | 20 ++++++++++----------
 2 files changed, 27 insertions(+), 16 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index e3f1bee4..973d1d97 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -20,17 +20,28 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-if [ -f "$__object/parameter/name" ]; then
-    name_should="$(cat "$__object/parameter/name")"
-else
-    name_should="${__target_host%%.*}"
-fi
-
 os=$(cat "$__global/explorer/os")
 name_running=$(cat "$__global/explorer/hostname")
 name_config=$(cat "$__object/explorer/persistent_hostname")
 has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
 
+
+if [ -f "$__object/parameter/name" ]; then
+    name_should="$(cat "$__object/parameter/name")"
+else
+    case $os in
+        # RedHat-derivatives and BSDs
+        centos|fedora|redhat|scientific|freebsd|netbsd|openbsd)
+            # Hostname is FQDN
+            name_should="${__target_host}"
+        ;;
+        *)
+            # Hostname is only first component of FQDN
+            name_should="${__target_host%%.*}"
+        ;;
+    esac
+fi
+
 ################################################################################
 # Check if the hostname is already correct
 #
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 5d9eeeeb..699f3e93 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -24,16 +24,16 @@ os=$(cat "$__global/explorer/os")
 if [ -f "$__object/parameter/name" ]; then
     name_should="$(cat "$__object/parameter/name")"
 else
-    case "$os" in
-    # RedHat-derivatives and BSDs
-    centos|fedora|redhat|scientific|freebsd|netbsd|openbsd)
-        # Hostname is FQDN
-        name_should="${__target_host}"
-    ;;
-    *)
-        # Hostname is only first component of FQDN
-        name_should="${__target_host%%.*}"
-    ;;
+    case $os in
+        # RedHat-derivatives and BSDs
+        centos|fedora|redhat|scientific|freebsd|netbsd|openbsd)
+            # Hostname is FQDN
+            name_should="${__target_host}"
+        ;;
+        *)
+            # Hostname is only first component of FQDN
+            name_should="${__target_host%%.*}"
+        ;;
     esac
 fi
 

From 6e1a105c22021e0f98e63930eeade65b416aaa2d Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 18:36:43 +0200
Subject: [PATCH 127/383] [__hostname] Lint

---
 cdist/conf/type/__hostname/gencode-remote | 12 ++++++++----
 cdist/conf/type/__hostname/manifest       |  6 ++++--
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 973d1d97..b258165d 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -29,7 +29,8 @@ has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
 if [ -f "$__object/parameter/name" ]; then
     name_should="$(cat "$__object/parameter/name")"
 else
-    case $os in
+    case $os
+    in
         # RedHat-derivatives and BSDs
         centos|fedora|redhat|scientific|freebsd|netbsd|openbsd)
             # Hostname is FQDN
@@ -45,14 +46,16 @@ fi
 ################################################################################
 # Check if the hostname is already correct
 #
-if [ "$name_running" = "$name_should" ] && [ ! "$name_config" -o "$name_config" = "$name_should" ]; then
+if [ "$name_running" = "$name_should" ] \
+  && [ -z "$name_config" -o "$name_config" = "$name_should" ]
+then
     exit 0
 fi
 
 ################################################################################
 # Setup hostname
 #
-echo changed >> "$__messages_out"
+echo 'changed' >> "$__messages_out"
 
 
 # First try to set the hostname using hostnamectl, if available.
@@ -69,7 +72,8 @@ EOF
 fi
 
 # Use the good old way to set the hostname. Also if hostnamectl fails.
-case $os in
+case $os
+in
     archlinux|debian|ubuntu|devuan|coreos|alpine)
         printf "printf '%%s\\\\n' '$name_should' > /etc/hostname\\n"
         echo "hostname -F /etc/hostname"
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 699f3e93..18152c3e 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -24,7 +24,8 @@ os=$(cat "$__global/explorer/os")
 if [ -f "$__object/parameter/name" ]; then
     name_should="$(cat "$__object/parameter/name")"
 else
-    case $os in
+    case $os
+    in
         # RedHat-derivatives and BSDs
         centos|fedora|redhat|scientific|freebsd|netbsd|openbsd)
             # Hostname is FQDN
@@ -44,7 +45,8 @@ not_supported() {
    exit 1
 }
 
-case "$os" in
+case $os
+in
     archlinux|debian|suse|ubuntu|devuan|coreos|alpine|macosx)
         # handled in gencode-remote
         :

From da1d70e16ac56511fb03f30bf9c76645c01caab8 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 18:43:27 +0200
Subject: [PATCH 128/383] [__hostname] Also quote hostname in FreeBSD rc.conf

---
 cdist/conf/type/__hostname/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 18152c3e..53e530d7 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -63,7 +63,7 @@ in
             --file /etc/rc.conf \
             --delimiter '=' --exact_delimiter \
             --key 'hostname' \
-            --value "$name_should"
+            --value "\"$name_should\""
     ;;
     netbsd)
         __key_value rcconf-hostname \

From 064e992a7aec8916a2bc65e5279f65bab4464140 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 21:03:49 +0200
Subject: [PATCH 129/383] [__hostname] Support openSUSE and replace printf with
 echo

---
 .../type/__hostname/explorer/persistent_hostname     | 12 ++++++------
 cdist/conf/type/__hostname/gencode-remote            | 12 +++++++-----
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/cdist/conf/type/__hostname/explorer/persistent_hostname b/cdist/conf/type/__hostname/explorer/persistent_hostname
index 6bc0786f..ec52bbd2 100755
--- a/cdist/conf/type/__hostname/explorer/persistent_hostname
+++ b/cdist/conf/type/__hostname/explorer/persistent_hostname
@@ -31,12 +31,9 @@ fi
 # Fall back to alternative OS-specific approaches.
 case $("$__explorer/os")
 in
-	alpine|archlinux|coreos|debian|devuan|suse|ubuntu)
+	alpine|archlinux|coreos|debian|devuan|ubuntu)
 		[ -f /etc/hostname ] && cat /etc/hostname
 		;;
-	suse)
-		[ -f /etc/HOSTNAME ] && cat /etc/HOSTNAME
-		;;
 	centos|fedora|redhat|scientific)
 		[ -f /etc/sysconfig/network ] \
 			&& (. /etc/sysconfig/network && echo "$HOSTNAME")
@@ -44,6 +41,9 @@ in
 	freebsd)
 		(. /etc/rc.conf && echo "$hostname")
 		;;
+	macosx)
+		scutil --get HostName 2>/dev/null
+		;;
 	netbsd)
 		if grep -q '^hostname=' /etc/rc.conf
 		then
@@ -57,7 +57,7 @@ in
 	openbsd)
 		cat /etc/myname
 		;;
-	macosx)
-		scutil --get HostName 2>/dev/null
+	suse)
+		cat /etc/HOSTNAME 2>/dev/null
 		;;
 esac
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index b258165d..37ace1b7 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -75,20 +75,22 @@ fi
 case $os
 in
     archlinux|debian|ubuntu|devuan|coreos|alpine)
-        printf "printf '%%s\\\\n' '$name_should' > /etc/hostname\\n"
+        echo "printf '%s\\n' '$name_should' > /etc/hostname"
         echo "hostname -F /etc/hostname"
     ;;
     centos|fedora|redhat|scientific|freebsd|openbsd)
         # NOTE: Writing the hostname to file is done in the manifest.
         echo "hostname '$name_should'"
     ;;
-    suse)
-        echo "hostname '$name_should'"
-        printf "printf '%%s\\\\n' '$name_should' > /etc/HOSTNAME\\n"
-    ;;
     macosx)
         echo "scutil --set HostName '$name_should'"
     ;;
+    suse)
+        # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
+        # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.
+        echo "printf '%s\\n' '$name_should' > /etc/HOSTNAME"
+        echo 'hostname -F /etc/HOSTNAME'
+    ;;
     *)
         echo "echo 'Unsupported OS: $os' >&2; exit 1"
     ;;

From e1c08c25b5a821fc2b9a9094c5801440559087a5 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 7 Oct 2019 11:29:28 +0200
Subject: [PATCH 130/383] Fix missed parameter file reading

---
 cdist/conf/type/__group/explorer/group   | 2 +-
 cdist/conf/type/__group/explorer/gshadow | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__group/explorer/group b/cdist/conf/type/__group/explorer/group
index dc673f61..8c8e840d 100755
--- a/cdist/conf/type/__group/explorer/group
+++ b/cdist/conf/type/__group/explorer/group
@@ -23,7 +23,7 @@
 #
 
 not_supported() {
-	echo "Your operating system ($("$__explorer/os")) is currently not supported." >&2
+	echo "Your operating system ($(cat "$__explorer/os")) is currently not supported." >&2
 	echo "Cannot extract group information." >&2
 	echo "Please contribute an implementation for it if you can." >&2
 	exit 1
diff --git a/cdist/conf/type/__group/explorer/gshadow b/cdist/conf/type/__group/explorer/gshadow
index 05841d69..c0dce1e3 100755
--- a/cdist/conf/type/__group/explorer/gshadow
+++ b/cdist/conf/type/__group/explorer/gshadow
@@ -23,7 +23,7 @@
 #
 
 name=$__object_id
-os=$("$__explorer/os")
+os=$(cat "$__explorer/os")
 
 not_supported() {
 	echo "Your operating system ($os) is currently not supported." >&2

From c11e757dfac865fc54f2bbe7b5ad015d25e813ad Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 6 Oct 2019 23:34:59 +0200
Subject: [PATCH 131/383] [__hostname] Add support for Gentoo

---
 .../conf/type/__hostname/explorer/persistent_hostname  |  3 +++
 cdist/conf/type/__hostname/gencode-remote              | 10 +++++-----
 cdist/conf/type/__hostname/manifest                    |  7 +++++++
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/type/__hostname/explorer/persistent_hostname b/cdist/conf/type/__hostname/explorer/persistent_hostname
index ec52bbd2..141c44fe 100755
--- a/cdist/conf/type/__hostname/explorer/persistent_hostname
+++ b/cdist/conf/type/__hostname/explorer/persistent_hostname
@@ -41,6 +41,9 @@ in
 	freebsd)
 		(. /etc/rc.conf && echo "$hostname")
 		;;
+	gentoo)
+		(. /etc/conf.d/hostname && echo "$hostname")
+		;;
 	macosx)
 		scutil --get HostName 2>/dev/null
 		;;
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 37ace1b7..64fff7ad 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -74,14 +74,10 @@ fi
 # Use the good old way to set the hostname. Also if hostnamectl fails.
 case $os
 in
-    archlinux|debian|ubuntu|devuan|coreos|alpine)
+    alpine|archlinux|coreos|debian|devuan|ubuntu)
         echo "printf '%s\\n' '$name_should' > /etc/hostname"
         echo "hostname -F /etc/hostname"
     ;;
-    centos|fedora|redhat|scientific|freebsd|openbsd)
-        # NOTE: Writing the hostname to file is done in the manifest.
-        echo "hostname '$name_should'"
-    ;;
     macosx)
         echo "scutil --set HostName '$name_should'"
     ;;
@@ -91,6 +87,10 @@ in
         echo "printf '%s\\n' '$name_should' > /etc/HOSTNAME"
         echo 'hostname -F /etc/HOSTNAME'
     ;;
+    centos|fedora|freebsd|gentoo|netbsd|openbsd|redhat|scientific)
+        # NOTE: Writing the hostname to file is done in the manifest.
+        echo "hostname '$name_should'"
+    ;;
     *)
         echo "echo 'Unsupported OS: $os' >&2; exit 1"
     ;;
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 53e530d7..0ffd7678 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -58,6 +58,13 @@ in
             --key HOSTNAME \
             --value "\"$name_should\""
     ;;
+    gentoo)
+        __key_value confd-hostname \
+            --file /etc/conf.d/hostname \
+            --delimiter '=' --exact_delimiter \
+            --key 'hostname' \
+            --value "\"$name_should\""
+    ;;
     freebsd)
         __key_value rcconf-hostname \
             --file /etc/rc.conf \

From 6d2e81d0dce0bbc41711aa2fa9dacdc5add44d2a Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 8 Oct 2019 08:30:27 +0200
Subject: [PATCH 132/383] Revert "Fix missed parameter file reading"

This reverts commit e1c08c25b5a821fc2b9a9094c5801440559087a5.

This fix was a mistake. No reading is needed, this is explorer
execution on the remote.
---
 cdist/conf/type/__group/explorer/group   | 2 +-
 cdist/conf/type/__group/explorer/gshadow | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__group/explorer/group b/cdist/conf/type/__group/explorer/group
index 8c8e840d..dc673f61 100755
--- a/cdist/conf/type/__group/explorer/group
+++ b/cdist/conf/type/__group/explorer/group
@@ -23,7 +23,7 @@
 #
 
 not_supported() {
-	echo "Your operating system ($(cat "$__explorer/os")) is currently not supported." >&2
+	echo "Your operating system ($("$__explorer/os")) is currently not supported." >&2
 	echo "Cannot extract group information." >&2
 	echo "Please contribute an implementation for it if you can." >&2
 	exit 1
diff --git a/cdist/conf/type/__group/explorer/gshadow b/cdist/conf/type/__group/explorer/gshadow
index c0dce1e3..05841d69 100755
--- a/cdist/conf/type/__group/explorer/gshadow
+++ b/cdist/conf/type/__group/explorer/gshadow
@@ -23,7 +23,7 @@
 #
 
 name=$__object_id
-os=$(cat "$__explorer/os")
+os=$("$__explorer/os")
 
 not_supported() {
 	echo "Your operating system ($os) is currently not supported." >&2

From 0c7d98e89e8c45cb3112bf5f5a8585b55d76b932 Mon Sep 17 00:00:00 2001
From: Jonas Hagen <jonas.hagen@qrst.ch>
Date: Tue, 8 Oct 2019 11:22:04 +0200
Subject: [PATCH 133/383] Use --recurse-submodules instead of --recursive

The option --recursive is not documented for git >2.11 (2016),
instead --recurse-submodules should be used.
---
 cdist/conf/type/__git/gencode-remote | 2 +-
 cdist/conf/type/__git/man.rst        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__git/gencode-remote b/cdist/conf/type/__git/gencode-remote
index 4de0f1c6..a36ff5cd 100755
--- a/cdist/conf/type/__git/gencode-remote
+++ b/cdist/conf/type/__git/gencode-remote
@@ -35,7 +35,7 @@ owner=$(cat "$__object/parameter/owner")
 group=$(cat "$__object/parameter/group")
 mode=$(cat "$__object/parameter/mode")
 
-[ -f "$__object/parameter/recursive" ] && recursive='--recursive' || recursive=''
+[ -f "$__object/parameter/recursive" ] && recursive='--recurse-submodules' || recursive=''
 
 [ "$state_should" = "$state_is" ] \
  && [ "$owner" = "$owner_is" ] \
diff --git a/cdist/conf/type/__git/man.rst b/cdist/conf/type/__git/man.rst
index 144eadda..f18a5a0e 100644
--- a/cdist/conf/type/__git/man.rst
+++ b/cdist/conf/type/__git/man.rst
@@ -36,7 +36,7 @@ owner
    User to chown to.
 
 recursive
-   Passes the --recursive flag to git when cloning the repository.
+   Passes the --recurse-submodules flag to git when cloning the repository.
 
 EXAMPLES
 --------

From 2abc34f92236d272f29cd8029bdec7fea8ae6455 Mon Sep 17 00:00:00 2001
From: Jonas Hagen <jonas.hagen@qrst.ch>
Date: Tue, 8 Oct 2019 11:22:05 +0200
Subject: [PATCH 134/383] Add --shallow option

Provides the capability to make shallow clones (including submodules) to deploy
repositories with huge history.

Note that this might not work with some servers (github.com) if the commit
that is required by a submodule is too far away from any reference.
---
 cdist/conf/type/__git/gencode-remote    | 3 ++-
 cdist/conf/type/__git/man.rst           | 4 ++++
 cdist/conf/type/__git/parameter/boolean | 1 +
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__git/gencode-remote b/cdist/conf/type/__git/gencode-remote
index a36ff5cd..ab22655f 100755
--- a/cdist/conf/type/__git/gencode-remote
+++ b/cdist/conf/type/__git/gencode-remote
@@ -36,6 +36,7 @@ group=$(cat "$__object/parameter/group")
 mode=$(cat "$__object/parameter/mode")
 
 [ -f "$__object/parameter/recursive" ] && recursive='--recurse-submodules' || recursive=''
+[ -f "$__object/parameter/shallow" ] && shallow='--depth 1 --shallow-submodules' || shallow=''
 
 [ "$state_should" = "$state_is" ] \
  && [ "$owner" = "$owner_is" ] \
@@ -45,7 +46,7 @@ mode=$(cat "$__object/parameter/mode")
 case $state_should in
     present)
         if [ "$state_should" != "$state_is" ]; then
-            echo git clone --quiet "$recursive" --branch "$branch" "$source" "$destination"
+            echo git clone --quiet "$recursive" "$shallow" --branch "$branch" "$source" "$destination"
         fi
         if { [ -n "$owner" ] && [ "$owner_is" != "$owner" ]; } || \
            { [ -n "$group" ] && [ "$group_is" != "$group" ]; }; then
diff --git a/cdist/conf/type/__git/man.rst b/cdist/conf/type/__git/man.rst
index f18a5a0e..d3e15f25 100644
--- a/cdist/conf/type/__git/man.rst
+++ b/cdist/conf/type/__git/man.rst
@@ -38,6 +38,10 @@ owner
 recursive
    Passes the --recurse-submodules flag to git when cloning the repository.
 
+shallow
+   Sets --depth=1 and --shallow-submodules for cloning repositories with big history.
+
+
 EXAMPLES
 --------
 
diff --git a/cdist/conf/type/__git/parameter/boolean b/cdist/conf/type/__git/parameter/boolean
index a633e659..d600d4ca 100644
--- a/cdist/conf/type/__git/parameter/boolean
+++ b/cdist/conf/type/__git/parameter/boolean
@@ -1 +1,2 @@
 recursive
+shallow

From be756f218971918b91a7a2fcc0140cc56c956d3f Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 8 Oct 2019 13:48:51 +0200
Subject: [PATCH 135/383] ++changelog

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 5d9dab73..089fd256 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -10,6 +10,8 @@ next:
 	* Explorer os: Unquote value from os-release file (Dennis Camera)
 	* Type __letsencrypt_cert: Support Debian 10* (Ahmed Bilal Khalid)
 	* Type __prometheus_server: Add missing exit after unsupported error message (Dominique Roux)
+	* Type __git: Use --recurse-submodules instead of --recursive (Jonas Hagen)
+	* Type __git: Add --shallow option (Jonas Hagen)
 
 6.0.0: 2019-10-01
 	* Type __letsencrypt_cert: Fix beowulf's spelling (Mondi Ravi)

From d1f4657ed9e064fc00d457778162ce37d0396850 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 8 Oct 2019 14:08:19 +0200
Subject: [PATCH 136/383] Release 6.0.1

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 089fd256..959ab8ae 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.0.1: 2019-10-08
 	* Type __group: Support OSes without getent (Dennis Camera)
 	* Type __user: Support OSes without getent (Dennis Camera)
 	* Type __ssh_authorized_keys: Support OSes without getent (Dennis Camera)

From 7d235fb013021d771c75479450e2e2dcda1426a3 Mon Sep 17 00:00:00 2001
From: Thomas Eckert <tom@it-eckert.de>
Date: Tue, 8 Oct 2019 18:19:20 +0200
Subject: [PATCH 137/383] add new type `__xymon_server`

This type installs a Xymon monitoring-server. See https://xymon.com/ for
a demo and further information.
---
 cdist/conf/type/__xymon_server/gencode-remote | 25 ++++++
 cdist/conf/type/__xymon_server/man.rst        | 87 +++++++++++++++++++
 cdist/conf/type/__xymon_server/manifest       | 50 +++++++++++
 .../type/__xymon_server/parameter/boolean     |  1 +
 .../__xymon_server/parameter/default/state    |  1 +
 .../type/__xymon_server/parameter/optional    |  1 +
 cdist/conf/type/__xymon_server/singleton      |  0
 7 files changed, 165 insertions(+)
 create mode 100755 cdist/conf/type/__xymon_server/gencode-remote
 create mode 100644 cdist/conf/type/__xymon_server/man.rst
 create mode 100755 cdist/conf/type/__xymon_server/manifest
 create mode 100644 cdist/conf/type/__xymon_server/parameter/boolean
 create mode 100644 cdist/conf/type/__xymon_server/parameter/default/state
 create mode 100644 cdist/conf/type/__xymon_server/parameter/optional
 create mode 100644 cdist/conf/type/__xymon_server/singleton

diff --git a/cdist/conf/type/__xymon_server/gencode-remote b/cdist/conf/type/__xymon_server/gencode-remote
new file mode 100755
index 00000000..55451c42
--- /dev/null
+++ b/cdist/conf/type/__xymon_server/gencode-remote
@@ -0,0 +1,25 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+## "move" user-modified dirs to /etc/xymon to be managed by __xymon_config:
+if [ ! -L /usr/lib/xymon/server/ext ]; then
+	echo "mv /usr/lib/xymon/server/ext /etc/xymon"
+	echo "ln -s /etc/xymon/ext /usr/lib/xymon/server/"
+	echo "ext-dir moved and symlinked" >> "$__messages_out"
+fi	
diff --git a/cdist/conf/type/__xymon_server/man.rst b/cdist/conf/type/__xymon_server/man.rst
new file mode 100644
index 00000000..a9a180e1
--- /dev/null
+++ b/cdist/conf/type/__xymon_server/man.rst
@@ -0,0 +1,87 @@
+cdist-type__xymon_server(7)
+===========================
+
+NAME
+----
+cdist-type__xymon_server - Install a Xymon server
+
+
+DESCRIPTION
+-----------
+This cdist type installs a Xymon (https://www.xymon.com/) server and (optional)
+required helper packages.
+
+This includes the Xymon client as a dependency, so NO NEED to install
+`__xymon_client` separately.
+
+To access the webinterface a webserver is required.  The cdist-type
+`__xymon_apache` can be used to install and configure the apache webserver for
+the use with Xymon.
+
+Further and day-to-day configuration of Xymon can either be done manually in
+`/etc/xymon/` or the directory can be deployed and managed by `__xymon_config`.
+
+
+REQUIRED PARAMETERS
+-------------------
+None.
+
+
+OPTIONAL PARAMETERS
+-------------------
+state
+    'present', 'absent', defaults to 'present'. If '--install_helpers' is
+    specified for 'absent' the helper packages will be un-installed.
+
+
+BOOLEAN PARAMETERS
+------------------
+install_helpers
+    Install helper packages used by Xymon (fping, heirloom-mailx, traceroute,
+    ntpdate).
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # minmal
+    __xymon_server
+
+    # the same
+    __xymon_server --state present
+
+    # also install helper packages:
+    __xymon_server --install_helpers
+
+    # examples to give a more complete picture: __xymon_server installed on
+    # `xymon.example.com` w/ IP 192.168.1.1:
+    #
+    # install webserver and grant 2 private subnets access to the webinterface:
+    __xymon_apache --ipacl "192.168.0.0/16 10.0.0.0/8"
+    # deploy server-configuration with __xymon_config:
+    __xymon_config --confdir=xymon.example.com
+
+    # install xymon-client on other machines (not needed on the server):
+    __xymon_client --servers "192.168.1.1"
+
+
+
+SEE ALSO
+--------
+:strong:`cdist__xymon_apache`\ (7), :strong:`cdist__xymon_config`\ (7),
+:strong:`cdist__xymon_client`\ (7), :strong:`xymon`\ (7)
+
+
+AUTHORS
+-------
+Thomas Eckert <tom--@--it-eckert.de>
+
+
+COPYING
+-------
+Copyright \(C) 2018-2019 Thomas Eckert. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__xymon_server/manifest b/cdist/conf/type/__xymon_server/manifest
new file mode 100755
index 00000000..7cee0d23
--- /dev/null
+++ b/cdist/conf/type/__xymon_server/manifest
@@ -0,0 +1,50 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+state=$(cat "$__object/parameter/state")
+if [ -f "$__object/parameter/install_helpers" ]; then
+	install_helpers=1
+else
+	install_helpers=0
+fi
+
+os=$(cat "$__global/explorer/os")
+case "$os" in
+	debian|ubuntu)
+		:
+	;;
+	*)
+		echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
+		echo "Please contribute an implementation for it if you can." >&2
+		exit 1
+	;;
+esac
+
+__package xymon --state "$state"
+
+## install helper-packages/tools used by the xymon server if requested:
+if [ "$install_helpers" = "1" ]; then
+	__package fping --state "$state"
+	__package heirloom-mailx --state "$state"
+	__package traceroute --state "$state"
+	__package ntpdate --state "$state"
+fi
+
+## CLI-usage often requires a shell:
+require="__package/xymon" __user xymon --shell "/bin/bash" --state "$state"
diff --git a/cdist/conf/type/__xymon_server/parameter/boolean b/cdist/conf/type/__xymon_server/parameter/boolean
new file mode 100644
index 00000000..56ebcb2c
--- /dev/null
+++ b/cdist/conf/type/__xymon_server/parameter/boolean
@@ -0,0 +1 @@
+install_helpers
diff --git a/cdist/conf/type/__xymon_server/parameter/default/state b/cdist/conf/type/__xymon_server/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__xymon_server/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__xymon_server/parameter/optional b/cdist/conf/type/__xymon_server/parameter/optional
new file mode 100644
index 00000000..ff72b5c7
--- /dev/null
+++ b/cdist/conf/type/__xymon_server/parameter/optional
@@ -0,0 +1 @@
+state
diff --git a/cdist/conf/type/__xymon_server/singleton b/cdist/conf/type/__xymon_server/singleton
new file mode 100644
index 00000000..e69de29b

From f35a1b9cdf6f91e49789f364cd5faeae01132c39 Mon Sep 17 00:00:00 2001
From: Thomas Eckert <tom@it-eckert.de>
Date: Tue, 8 Oct 2019 18:32:26 +0200
Subject: [PATCH 138/383] add new type `__xymon_apache` as a helper for
 `__xymon_server`

Details in `man.rst`
---
 .../type/__xymon_apache/explorer/active-conf  | 22 ++++++
 .../__xymon_apache/explorer/active-modules    |  5 ++
 cdist/conf/type/__xymon_apache/gencode-remote | 56 +++++++++++++
 cdist/conf/type/__xymon_apache/man.rst        | 79 +++++++++++++++++++
 cdist/conf/type/__xymon_apache/manifest       | 42 ++++++++++
 .../__xymon_apache/parameter/default/state    |  1 +
 .../type/__xymon_apache/parameter/optional    |  2 +
 cdist/conf/type/__xymon_apache/singleton      |  0
 8 files changed, 207 insertions(+)
 create mode 100755 cdist/conf/type/__xymon_apache/explorer/active-conf
 create mode 100755 cdist/conf/type/__xymon_apache/explorer/active-modules
 create mode 100755 cdist/conf/type/__xymon_apache/gencode-remote
 create mode 100644 cdist/conf/type/__xymon_apache/man.rst
 create mode 100755 cdist/conf/type/__xymon_apache/manifest
 create mode 100644 cdist/conf/type/__xymon_apache/parameter/default/state
 create mode 100644 cdist/conf/type/__xymon_apache/parameter/optional
 create mode 100644 cdist/conf/type/__xymon_apache/singleton

diff --git a/cdist/conf/type/__xymon_apache/explorer/active-conf b/cdist/conf/type/__xymon_apache/explorer/active-conf
new file mode 100755
index 00000000..bd281e21
--- /dev/null
+++ b/cdist/conf/type/__xymon_apache/explorer/active-conf
@@ -0,0 +1,22 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+if [ -d /etc/apache2/mods-enabled ]; then
+	ls -1 /etc/apache2/conf-enabled/
+fi
diff --git a/cdist/conf/type/__xymon_apache/explorer/active-modules b/cdist/conf/type/__xymon_apache/explorer/active-modules
new file mode 100755
index 00000000..4c745ced
--- /dev/null
+++ b/cdist/conf/type/__xymon_apache/explorer/active-modules
@@ -0,0 +1,5 @@
+#!/bin/sh -e
+
+if [ -d /etc/apache2/mods-enabled ]; then
+	/usr/sbin/apachectl -t -D DUMP_MODULES | awk '/.*_module/ { gsub(/_module.*$/, ""); gsub(/^ /, ""); print }' 
+fi
diff --git a/cdist/conf/type/__xymon_apache/gencode-remote b/cdist/conf/type/__xymon_apache/gencode-remote
new file mode 100755
index 00000000..e7d8e344
--- /dev/null
+++ b/cdist/conf/type/__xymon_apache/gencode-remote
@@ -0,0 +1,56 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+state=$(cat "$__object/parameter/state")
+
+os=$(cat "$__global/explorer/os")
+case "$os" in
+	debian|ubuntu)
+		:
+	;;
+	*)
+		echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
+		echo "Please contribute an implementation for it if you can." >&2
+		exit 1
+	;;
+esac
+
+if [ "$state" = "present"  ]; then
+	if ! grep -q ^rewrite "$__object/explorer/active-modules"; then
+		echo "a2enmod rewrite >/dev/null"
+		echo "mod:rewrite enabled" >> "$__messages_out"
+	fi
+	if ! grep -q "^cgi$" "$__object/explorer/active-modules"; then
+		echo "a2enmod cgi >/dev/null"
+		echo "mod:cgi enabled" >> "$__messages_out"
+	fi
+
+	if ! grep -q ^xymon.conf "$__object/explorer/active-conf"; then
+		echo "a2enconf xymon >/dev/null"
+		echo "conf:xymon enabled" >> "$__messages_out"
+	fi
+fi
+
+if grep -q "^mod:.* enabled" "$__messages_out"; then
+	echo "systemctl restart apache2.service"
+	echo "apache restarted" >> "$__messages_out"
+elif grep -q "^conf:xymon enabled" "$__messages_out"; then
+	echo "systemctl reload apache2.service"
+	echo "apache reloaded" >> "$__messages_out"
+fi
diff --git a/cdist/conf/type/__xymon_apache/man.rst b/cdist/conf/type/__xymon_apache/man.rst
new file mode 100644
index 00000000..8358c821
--- /dev/null
+++ b/cdist/conf/type/__xymon_apache/man.rst
@@ -0,0 +1,79 @@
+cdist-type__xymon_apache(7)
+===========================
+
+NAME
+----
+cdist-type__xymon_apache - Configure apache2-webserver for Xymon
+
+
+DESCRIPTION
+-----------
+This cdist type installs and configures apache2 to be used "exclusively" (in
+the sense that no other use is taken care of) with Xymon (the systems and
+network monitor).
+
+It depends on `__xymon_server`.
+
+
+REQUIRED PARAMETERS
+-------------------
+None.
+
+
+OPTIONAL PARAMETERS
+-------------------
+state
+   'present', 'absent', defaults to 'present'.
+
+ipacl
+   IP(-ranges) that have access to the Xymon webpages and CGIs. Apache2-style
+   syntax suitable for `Require ip ...`. Example: `192.168.1.0/24 10.0.0.0/8`
+
+
+MESSAGES
+--------
+mod:rewrite enabled
+   apache module enabled
+conf:xymon enabled
+   apache config for xymon enabled
+apache restarted
+   apache2.service was reloaded
+apache reloaded
+   apache2.service was restarted
+
+
+EXPLORERS
+---------
+active-conf
+   lists apache2 `conf-enabled`
+active-modules
+   lists active apache2-modules
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # minmal, only localhost-access:
+    __xymon_apache
+    # allow more IPs to access the Xymon-webinterface:
+    __xymon_apache --ipacl "192.168.0.0/16 10.0.0.0/8" --state "present"
+
+
+SEE ALSO
+--------
+:strong:`cdist__xymon_server`\ (7)
+
+
+AUTHORS
+-------
+Thomas Eckert <tom--@--it-eckert.de>
+
+
+COPYING
+-------
+Copyright \(C) 2018-2019 Thomas Eckert. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__xymon_apache/manifest b/cdist/conf/type/__xymon_apache/manifest
new file mode 100755
index 00000000..bfd0af79
--- /dev/null
+++ b/cdist/conf/type/__xymon_apache/manifest
@@ -0,0 +1,42 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+state=$(cat "$__object/parameter/state")
+
+os=$(cat "$__global/explorer/os")
+case "$os" in
+	debian|ubuntu)
+		:
+	;;
+	*)
+		echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
+		echo "Please contribute an implementation for it if you can." >&2
+		exit 1
+	;;
+esac
+
+__package apache2 --state "$state"
+
+## edit xymon.conf IP-ranges
+if [ -f "$__object/parameter/ipacl" ]; then
+	require="__package/xymon" __line /etc/apache2/conf-available/xymon.conf \
+		--line "        Require ip $(cat "$__object/parameter/ipacl")" \
+		--after "^[[:space:]]*Require local" \
+		--state "present"
+fi
diff --git a/cdist/conf/type/__xymon_apache/parameter/default/state b/cdist/conf/type/__xymon_apache/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__xymon_apache/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__xymon_apache/parameter/optional b/cdist/conf/type/__xymon_apache/parameter/optional
new file mode 100644
index 00000000..d374ec41
--- /dev/null
+++ b/cdist/conf/type/__xymon_apache/parameter/optional
@@ -0,0 +1,2 @@
+state
+ipacl
diff --git a/cdist/conf/type/__xymon_apache/singleton b/cdist/conf/type/__xymon_apache/singleton
new file mode 100644
index 00000000..e69de29b

From 48ed7f17541dfbdd3a1d1c17c2bbe8570f0b468f Mon Sep 17 00:00:00 2001
From: Thomas Eckert <tom@it-eckert.de>
Date: Tue, 8 Oct 2019 18:38:33 +0200
Subject: [PATCH 139/383] correct condition -- should check on remote side

---
 cdist/conf/type/__xymon_server/gencode-remote | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/type/__xymon_server/gencode-remote b/cdist/conf/type/__xymon_server/gencode-remote
index 55451c42..0770e319 100755
--- a/cdist/conf/type/__xymon_server/gencode-remote
+++ b/cdist/conf/type/__xymon_server/gencode-remote
@@ -18,8 +18,9 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 
 ## "move" user-modified dirs to /etc/xymon to be managed by __xymon_config:
-if [ ! -L /usr/lib/xymon/server/ext ]; then
-	echo "mv /usr/lib/xymon/server/ext /etc/xymon"
-	echo "ln -s /etc/xymon/ext /usr/lib/xymon/server/"
-	echo "ext-dir moved and symlinked" >> "$__messages_out"
-fi	
+cat <<-EOT
+	if [ ! -L /usr/lib/xymon/server/ext ]; then
+		mv /usr/lib/xymon/server/ext /etc/xymon
+		ln -s /etc/xymon/ext /usr/lib/xymon/server/
+	fi	
+EOT

From e9289abfabc2ac2dfd9c3466ab1592eb7033d8e1 Mon Sep 17 00:00:00 2001
From: Thomas Eckert <tom@it-eckert.de>
Date: Tue, 8 Oct 2019 18:55:37 +0200
Subject: [PATCH 140/383] add new type `__xymon_config` to configure
 xymon-servers

This allows configuration of a xymon-server.
The server can be installed with `__xymon_server` or manually. In the
latter case the `ext/`-dir symlink has to be added.
---
 cdist/conf/type/__xymon_config/files/.keep    |  0
 cdist/conf/type/__xymon_config/gencode-remote | 23 ++++++++
 cdist/conf/type/__xymon_config/man.rst        | 57 +++++++++++++++++++
 cdist/conf/type/__xymon_config/manifest       | 24 ++++++++
 .../type/__xymon_config/parameter/required    |  1 +
 cdist/conf/type/__xymon_config/singleton      |  0
 6 files changed, 105 insertions(+)
 create mode 100644 cdist/conf/type/__xymon_config/files/.keep
 create mode 100644 cdist/conf/type/__xymon_config/gencode-remote
 create mode 100644 cdist/conf/type/__xymon_config/man.rst
 create mode 100644 cdist/conf/type/__xymon_config/manifest
 create mode 100644 cdist/conf/type/__xymon_config/parameter/required
 create mode 100644 cdist/conf/type/__xymon_config/singleton

diff --git a/cdist/conf/type/__xymon_config/files/.keep b/cdist/conf/type/__xymon_config/files/.keep
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/conf/type/__xymon_config/gencode-remote b/cdist/conf/type/__xymon_config/gencode-remote
new file mode 100644
index 00000000..b25a0fda
--- /dev/null
+++ b/cdist/conf/type/__xymon_config/gencode-remote
@@ -0,0 +1,23 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+## to speed up config-reload we send a HUP to the server process:
+cat <<-EOT
+	pkill -HUP xymond || { echo "HUPing xymond failed" >&2; exit 1; }
+EOT
diff --git a/cdist/conf/type/__xymon_config/man.rst b/cdist/conf/type/__xymon_config/man.rst
new file mode 100644
index 00000000..8b427ca0
--- /dev/null
+++ b/cdist/conf/type/__xymon_config/man.rst
@@ -0,0 +1,57 @@
+cdist-type__xymon_config(7)
+===========================
+
+NAME
+----
+cdist-type__xymon_config - Deploy a Xymon configuration-directory
+
+
+DESCRIPTION
+-----------
+This cdist type deploys a full Xymon configuration directory from the files-dir
+to the host.  This type requires an installed Xymon server, e.g. deployed by
+`__xymon_server`.
+
+WARNING: This type _replaces_ the `/etc/xymon/`-directory! The previous
+contents is replaced/deleted!
+
+
+REQUIRED PARAMETERS
+-------------------
+confdir
+   The directory in `./files/` that contains the `/etc/xymon/`-content to be
+   deployed.
+
+
+REQUIRED FILES
+--------------
+The directory specified by `confdir` has to contain a valid xymon-configuration
+(`/etc/xymon/`) _plus_ the `ext/`-directory that normally resides in
+`/usr/lib/xymon/server/`.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __xymon_config --confdir=xymon.example.com
+    # this will replace /etc/xymon/ on the target host with
+    # the contents from __xymon_config/files/xymon.example.com/
+
+
+SEE ALSO
+--------
+:strong:`cdist__xymon_server`\ (7), :strong:`xymon`\ (7)
+
+AUTHORS
+-------
+Thomas Eckert <tom--@--it-eckert.de>
+
+
+COPYING
+-------
+Copyright \(C) 2018-2019 Thomas Eckert. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__xymon_config/manifest b/cdist/conf/type/__xymon_config/manifest
new file mode 100644
index 00000000..fb1bce54
--- /dev/null
+++ b/cdist/conf/type/__xymon_config/manifest
@@ -0,0 +1,24 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+confdir=$(cat "$__object/parameter/confdir")
+
+__rsync /etc/xymon/ \
+	--source "$__type/files/$confdir/" \
+	--rsync-opts "delete"
diff --git a/cdist/conf/type/__xymon_config/parameter/required b/cdist/conf/type/__xymon_config/parameter/required
new file mode 100644
index 00000000..43222f13
--- /dev/null
+++ b/cdist/conf/type/__xymon_config/parameter/required
@@ -0,0 +1 @@
+confdir
diff --git a/cdist/conf/type/__xymon_config/singleton b/cdist/conf/type/__xymon_config/singleton
new file mode 100644
index 00000000..e69de29b

From 0bdc62482ac46d4238c4bb2389c66b40a62755c5 Mon Sep 17 00:00:00 2001
From: Thomas Eckert <tom@it-eckert.de>
Date: Tue, 8 Oct 2019 19:03:38 +0200
Subject: [PATCH 141/383] add new type `__xymon_client`

---
 cdist/conf/type/__xymon_client/gencode-remote | 28 +++++++++
 cdist/conf/type/__xymon_client/man.rst        | 57 +++++++++++++++++++
 cdist/conf/type/__xymon_client/manifest       | 49 ++++++++++++++++
 .../__xymon_client/parameter/default/servers  |  1 +
 .../__xymon_client/parameter/default/state    |  1 +
 .../type/__xymon_client/parameter/optional    |  2 +
 cdist/conf/type/__xymon_client/singleton      |  0
 7 files changed, 138 insertions(+)
 create mode 100755 cdist/conf/type/__xymon_client/gencode-remote
 create mode 100644 cdist/conf/type/__xymon_client/man.rst
 create mode 100755 cdist/conf/type/__xymon_client/manifest
 create mode 100644 cdist/conf/type/__xymon_client/parameter/default/servers
 create mode 100644 cdist/conf/type/__xymon_client/parameter/default/state
 create mode 100644 cdist/conf/type/__xymon_client/parameter/optional
 create mode 100644 cdist/conf/type/__xymon_client/singleton

diff --git a/cdist/conf/type/__xymon_client/gencode-remote b/cdist/conf/type/__xymon_client/gencode-remote
new file mode 100755
index 00000000..49eed317
--- /dev/null
+++ b/cdist/conf/type/__xymon_client/gencode-remote
@@ -0,0 +1,28 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+servers=$(cat "$__object/parameter/servers")
+
+if grep -q ^__key_value/CLIENTHOSTNAME "$__messages_in" || grep -q ^__key_value/XYMONSERVERS "$__messages_in" ; then
+	echo "systemctl restart xymon-client"
+	echo "restarted" >> "$__messages_out"
+	cat <<-EOT
+		echo "xymon-client xymon-client/XYMONSERVERS string $servers" | debconf-set-selections
+	EOT
+fi	
diff --git a/cdist/conf/type/__xymon_client/man.rst b/cdist/conf/type/__xymon_client/man.rst
new file mode 100644
index 00000000..6f90c15b
--- /dev/null
+++ b/cdist/conf/type/__xymon_client/man.rst
@@ -0,0 +1,57 @@
+cdist-type__xymon_client(7)
+===========================
+
+NAME
+----
+cdist-type__xymon_client - Install the Xymon client
+
+
+DESCRIPTION
+-----------
+This cdist type installs the Xymon client and configures it to report with
+FQDN.
+
+
+REQUIRED PARAMETERS
+-------------------
+None.
+
+
+OPTIONAL PARAMETERS
+-------------------
+state
+   'present', 'absent', defaults to 'present'.
+
+servers
+   One or more IP adresses (space separated) of the Xymon server(s) to report
+   to. While DNS-names are ok it is discouraged, defaults to 127.0.0.1.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # minmal, report to 127.0.0.1
+    __xymon_client
+
+    # specify server:
+    __xymon_client --servers "192.168.1.1"
+
+
+SEE ALSO
+--------
+:strong:`cdist__xymon_server`\ (7), :strong:`xymon`\ (7)
+
+
+AUTHORS
+-------
+Thomas Eckert <tom--@--it-eckert.de>
+
+
+COPYING
+-------
+Copyright \(C) 2018-2019 Thomas Eckert. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__xymon_client/manifest b/cdist/conf/type/__xymon_client/manifest
new file mode 100755
index 00000000..92ad079e
--- /dev/null
+++ b/cdist/conf/type/__xymon_client/manifest
@@ -0,0 +1,49 @@
+#!/bin/sh -e
+#
+# 2018-2019 Thomas Eckert (tom at it-eckert.de)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+
+state=$(cat "$__object/parameter/state")
+servers=$(cat "$__object/parameter/servers")
+
+os=$(cat "$__global/explorer/os")
+case "$os" in
+	debian|ubuntu)
+		:
+	;;
+	*)
+		echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
+		echo "Please contribute an implementation for it if you can." >&2
+		exit 1
+	;;
+esac
+
+__package xymon-client --state "$state"
+
+require="__package/xymon-client" __key_value CLIENTHOSTNAME \
+       	--file /etc/default/xymon-client \
+	--value "'$__target_hostname'" \
+	--delimiter '=' \
+	--state "$state"
+require="__package/xymon-client" __key_value XYMONSERVERS \
+       	--file /etc/default/xymon-client \
+	--value "'$servers'" \
+	--delimiter '=' \
+	--state "$state"
+
+## CLI-usage often requires a shell:
+require="__package/xymon-client" __user xymon --shell "/bin/bash" --state "$state"
diff --git a/cdist/conf/type/__xymon_client/parameter/default/servers b/cdist/conf/type/__xymon_client/parameter/default/servers
new file mode 100644
index 00000000..7b9ad531
--- /dev/null
+++ b/cdist/conf/type/__xymon_client/parameter/default/servers
@@ -0,0 +1 @@
+127.0.0.1
diff --git a/cdist/conf/type/__xymon_client/parameter/default/state b/cdist/conf/type/__xymon_client/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__xymon_client/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__xymon_client/parameter/optional b/cdist/conf/type/__xymon_client/parameter/optional
new file mode 100644
index 00000000..7c34489a
--- /dev/null
+++ b/cdist/conf/type/__xymon_client/parameter/optional
@@ -0,0 +1,2 @@
+state
+servers
diff --git a/cdist/conf/type/__xymon_client/singleton b/cdist/conf/type/__xymon_client/singleton
new file mode 100644
index 00000000..e69de29b

From b6898b097f01941d68860c02118f5f5f2ddb8576 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Tue, 8 Oct 2019 23:05:23 +0200
Subject: [PATCH 142/383] [__sensible_editor] Add support for RedHat
 derivatives

They have added sensible-utils lately.
select-editor(1) does not work because their alternatives system is broken,
but sensible-editor(1) works just fine, so we can support it.
---
 .../__sensible_editor/explorer/editor_path    | 84 +++++++++++--------
 cdist/conf/type/__sensible_editor/man.rst     | 15 +++-
 cdist/conf/type/__sensible_editor/manifest    | 18 +++-
 3 files changed, 78 insertions(+), 39 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/explorer/editor_path b/cdist/conf/type/__sensible_editor/explorer/editor_path
index a1673a52..8b10b17b 100644
--- a/cdist/conf/type/__sensible_editor/explorer/editor_path
+++ b/cdist/conf/type/__sensible_editor/explorer/editor_path
@@ -22,76 +22,92 @@
 # absolute path.
 #
 
+die() {
+	echo "$@" >&2
+	exit 1
+}
+
+editor_missing() { die "Editor '$1' is missing on the target system."; }
+editor_no_alternative() { die "Editor '$1' is not in the alternatives list of the target system."; }
+
+
 case $("${__explorer}/os")
 in
 	debian|devuan|ubuntu)
-		:  # supported
+		has_alternatives=true
+		editors=$(update-alternatives --list editor)
 		;;
 	*)
-		exit 0  # will produce an error message in the manifest
+		# NOTE: RedHat has an alternatives system but it doesn't usually track
+		#       editors and it is a pain to extract the list.
+		has_alternatives=false
 		;;
 esac
 
-
 editor=$(cat "${__object}/parameter/editor")
-editors=$(update-alternatives --list editor)
-
-if test $(echo "${editors}" | wc -l) -lt 1
-then
-	echo 'No editors have been found on this system.' >&2
-	exit 1
-fi
 
 case $editor
 in
 	/*)
-		is_path=true
+		is_abspath=true
 		;;
 	*/*)
-		echo 'Relative editor paths are not supported' >&2
-		exit 1
+		die 'Relative editor paths are not supported'
 		;;
 	*)
-		is_path=false
+		is_abspath=false
 		;;
 esac
 
 
-IFS='
-'
-if $is_path
+if $has_alternatives && test "$(echo "${editors}" | wc -l)" -gt 0
 then
-	if ! test -f "${editor}"
+	IFS='
+'
+	if ! $is_abspath
 	then
-		echo "Editor ${editor} is missing on the target system." >&2
-		exit 1
+		# First, try to resolve the absolute path using $editors.
+		for e in $editors
+		do
+			if test "$(basename "${e}")" = "${editor}"
+			then
+				editor="${e}"
+				break
+			fi
+		done
 	fi
 
+	# Check if path is present
+	test -f "${editor}" || editor_missing "${editor}"
+
 	for e in $editors
 	do
 		if test "${editor}" = "${e}"
 		then
-			# Editor is present and part of the alternatives list -> use it!
+			# Editor is part of the alternatives list -> use it!
 			echo "${editor}"
 			exit 0
 		fi
 	done
 
-	echo "Editor ${editor} is not in the alternatives list of the target system." >&2
-	exit 1
+	editor_no_alternative "${editor}"
 else
-	for e in $editors
-	do
-		if test "$(basename "${e}")" = "${editor}"
-		then
-			# Editor could be found by basename in the alternatives list -> use it!
-			echo "${e}"
-			exit 0
-		fi
-	done
+	# NOTE: This branch is mostly for RedHat-based systems which do
+	#       not track editor alternatives.  To make this type useful
+	#       on RedHat at all we allow an absoloute path to be provided
+	#       in any case.
 
-	echo "Editor ${editor} is missing on the target system." >&2
-	exit 1
+	if $is_abspath
+	then
+		test -x "${editor}" || editor_missing "${editor}"
+
+		echo "${editor}"
+		exit 0
+	else
+		die "The target doesn't list any editor alternatives. " \
+		    "Please specify an absolute path or populate the alternatives list."
+	fi
 fi
 
+# The script should never reach this statement!
 exit 1
diff --git a/cdist/conf/type/__sensible_editor/man.rst b/cdist/conf/type/__sensible_editor/man.rst
index 2d7682a6..9e2245ef 100644
--- a/cdist/conf/type/__sensible_editor/man.rst
+++ b/cdist/conf/type/__sensible_editor/man.rst
@@ -8,14 +8,15 @@ cdist-type__sensible_editor - Select the sensible-editor
 
 DESCRIPTION
 -----------
-This cdist type allows you to select the sensible-editor on Debian-based systems
-for a given user.
+This cdist type allows you to select the :strong:`sensible-editor` for
+a given user.
 
 
 REQUIRED PARAMETERS
 -------------------
 editor
     Name or path of the editor to be selected.
+    On systems other than Debian derivatives an absolute path is required.
 
 
 OPTIONAL PARAMETERS
@@ -33,9 +34,17 @@ EXAMPLES
     __sensible_editor noob --editor nano
 
 
+LIMITATIONS
+-----------
+This type only works on operating systems on which the sensible-utils package
+is available.
+
+Hint: On RedHat-based systems setting up the EPEL repo might be necessary.
+
+
 SEE ALSO
 --------
-none
+:strong:`select-editor`\ (1), :strong:`sensible-editor`\ (1).
 
 
 AUTHOR
diff --git a/cdist/conf/type/__sensible_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
index b02625e2..56a6b02f 100644
--- a/cdist/conf/type/__sensible_editor/manifest
+++ b/cdist/conf/type/__sensible_editor/manifest
@@ -27,14 +27,28 @@ user=$__object_id
 case $os
 in
 	debian|devuan|ubuntu)
-		test "${state}" = 'present' && __package_apt sensible-utils --state present
+		test "${state}" != 'absent' \
+			&& __package sensible-utils --state present --type apt
+		;;
+	centos|fedora|redhat|scientific)
+		test "${state}" != 'absent' \
+			&& __package sensible-utils --state present --type yum
 		;;
 	*)
-		echo "OS ${os} does not support select-editor." >&2
+		echo "OS ${os} does not support sensible-editor." >&2
+		echo "If it does, please provide a patch." >&2
 		exit 1
 		;;
 esac
 
+if test "${state}" != 'present' && test "${state}" != 'absent'
+then
+	echo 'Only "present" and "absent" are allowed for --state' >&2
+	exit 1
+fi
+
+test "${state}" = 'absent' || export __require='__package/sensible-utils'
+
 editor_path=$(cat "${__object}/explorer/editor_path")
 user_home=$(cat "${__object}/explorer/user_home")
 group=$(cat "${__object}/explorer/group")

From c3af8a0cc0a2d10a4456f0382f491d6108f54df4 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 10 Oct 2019 11:19:00 +0200
Subject: [PATCH 143/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 959ab8ae..db67e173 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)
+
 6.0.1: 2019-10-08
 	* Type __group: Support OSes without getent (Dennis Camera)
 	* Type __user: Support OSes without getent (Dennis Camera)

From 522100b9fb2f80a1fe9cf7b3d946a432957ec739 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 12 Oct 2019 11:07:39 +0200
Subject: [PATCH 144/383] [__sensible_editor] Refactor

---
 .../__sensible_editor/explorer/editor_path    |  5 +-
 cdist/conf/type/__sensible_editor/manifest    | 48 ++++++++++++-------
 2 files changed, 34 insertions(+), 19 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/explorer/editor_path b/cdist/conf/type/__sensible_editor/explorer/editor_path
index 8b10b17b..b0de2f0a 100644
--- a/cdist/conf/type/__sensible_editor/explorer/editor_path
+++ b/cdist/conf/type/__sensible_editor/explorer/editor_path
@@ -35,7 +35,10 @@ case $("${__explorer}/os")
 in
 	debian|devuan|ubuntu)
 		has_alternatives=true
-		editors=$(update-alternatives --list editor)
+
+		# NOTE: Old versions do not support `--list`, in this case ignore the errors.
+		#       This will require an absolute path to be provided, though.
+		editors=$(update-alternatives --list editor 2>/dev/null)
 		;;
 	*)
 		# NOTE: RedHat has an alternatives system but it doesn't usually track
diff --git a/cdist/conf/type/__sensible_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
index 56a6b02f..2ad8c54e 100644
--- a/cdist/conf/type/__sensible_editor/manifest
+++ b/cdist/conf/type/__sensible_editor/manifest
@@ -19,35 +19,47 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+not_supported() {
+	echo "OS ${os} does not support __sensible_editor." >&2
+	echo 'If it does, please provide a patch.' >&2
+	exit 1
+}
+
 os=$(cat "${__global}/explorer/os")
 
 state=$(cat "${__object}/parameter/state")
 user=$__object_id
 
-case $os
-in
-	debian|devuan|ubuntu)
-		test "${state}" != 'absent' \
-			&& __package sensible-utils --state present --type apt
-		;;
-	centos|fedora|redhat|scientific)
-		test "${state}" != 'absent' \
-			&& __package sensible-utils --state present --type yum
-		;;
-	*)
-		echo "OS ${os} does not support sensible-editor." >&2
-		echo "If it does, please provide a patch." >&2
-		exit 1
-		;;
-esac
-
 if test "${state}" != 'present' && test "${state}" != 'absent'
 then
 	echo 'Only "present" and "absent" are allowed for --state' >&2
 	exit 1
 fi
 
-test "${state}" = 'absent' || export __require='__package/sensible-utils'
+case $os
+in
+	debian)
+		pkg_type='apt'
+		;;
+	devuan)
+		pkg_type='apt'
+		;;
+	ubuntu)
+		pkg_type='apt'
+		;;
+	centos|fedora|redhat|scientific)
+		pkg_type='yum'
+		;;
+	*)
+		not_supported
+		;;
+esac
+
+if test "${state}" != 'absent'
+then
+	__package sensible-utils --state present --type "${pkg_type}"
+	export __require='__package/sensible-utils'
+fi
 
 editor_path=$(cat "${__object}/explorer/editor_path")
 user_home=$(cat "${__object}/explorer/user_home")

From e64d1710b531cdb2db9a8a0bcb1c5dd7d287f3fb Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 12 Oct 2019 13:01:39 +0200
Subject: [PATCH 145/383] [__sensible_editor] Add support for old Ubuntu
 versions

---
 cdist/conf/type/__sensible_editor/manifest | 24 ++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
index 2ad8c54e..988f00e5 100644
--- a/cdist/conf/type/__sensible_editor/manifest
+++ b/cdist/conf/type/__sensible_editor/manifest
@@ -19,6 +19,21 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+version_ge() {
+	awk -F '[^0-9.]' -v target="${1:?}" '
+	function max(x, y) { return x > y ? x : y; }
+	BEGIN {
+		getline;
+		nx = split($1, x, ".");
+		ny = split(target, y, ".");
+		for (i = 1; i <= max(nx, ny); ++i) {
+			if (x[i] < y[i]) exit 1;
+			else if (x[i] > y[i]) exit 0;
+			else continue;
+		}
+	}'
+}
+
 not_supported() {
 	echo "OS ${os} does not support __sensible_editor." >&2
 	echo 'If it does, please provide a patch.' >&2
@@ -26,6 +41,7 @@ not_supported() {
 }
 
 os=$(cat "${__global}/explorer/os")
+os_version=$(cat "${__global}/explorer/os_version")
 
 state=$(cat "${__object}/parameter/state")
 user=$__object_id
@@ -36,6 +52,8 @@ then
 	exit 1
 fi
 
+package_name='sensible-utils'
+
 case $os
 in
 	debian)
@@ -45,6 +63,7 @@ in
 		pkg_type='apt'
 		;;
 	ubuntu)
+		"${os_version}" | version_ge 10.04 || package_name='debianutils'
 		pkg_type='apt'
 		;;
 	centos|fedora|redhat|scientific)
@@ -57,8 +76,9 @@ esac
 
 if test "${state}" != 'absent'
 then
-	__package sensible-utils --state present --type "${pkg_type}"
-	export __require='__package/sensible-utils'
+	__package "${package_name}" --state present \
+		--type "${pkg_type}"
+	export __require="__package/${package_name}"
 fi
 
 editor_path=$(cat "${__object}/explorer/editor_path")

From d11b1915471c5c0c0b530ae9cd022b293866e292 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 12 Oct 2019 13:02:26 +0200
Subject: [PATCH 146/383] [__sensible_editor] Document supported operating
 systems in man page

---
 cdist/conf/type/__sensible_editor/man.rst | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/man.rst b/cdist/conf/type/__sensible_editor/man.rst
index 9e2245ef..d0f5356e 100644
--- a/cdist/conf/type/__sensible_editor/man.rst
+++ b/cdist/conf/type/__sensible_editor/man.rst
@@ -36,11 +36,19 @@ EXAMPLES
 
 LIMITATIONS
 -----------
-This type only works on operating systems on which the sensible-utils package
-is available.
 
-Hint: On RedHat-based systems setting up the EPEL repo might be necessary.
+This type supports the following operating systems:
+* Debian 8 (jessie) or later
+* Devuan
+* Ubuntu 8.10 (intrepid) or later
+* RHEL/CentOS 7 or later (EPEL repo required)
+* Fedora 21 or later
 
+In general, this type could work on operating systems on which the
+sensible-utils package is available.
+
+On old versions of Ubuntu the sensible-* utils are part of the
+debianutils package.
 
 SEE ALSO
 --------

From f782a8547035decee53a745da56edb47490ba5a8 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 12 Oct 2019 13:27:42 +0200
Subject: [PATCH 147/383] [__sensible_editor] Reword limitations paragraph of
 man page

---
 cdist/conf/type/__sensible_editor/man.rst | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/man.rst b/cdist/conf/type/__sensible_editor/man.rst
index d0f5356e..4260a369 100644
--- a/cdist/conf/type/__sensible_editor/man.rst
+++ b/cdist/conf/type/__sensible_editor/man.rst
@@ -37,17 +37,17 @@ EXAMPLES
 LIMITATIONS
 -----------
 
-This type supports the following operating systems:
-* Debian 8 (jessie) or later
-* Devuan
-* Ubuntu 8.10 (intrepid) or later
-* RHEL/CentOS 7 or later (EPEL repo required)
-* Fedora 21 or later
+This type depends upon the :strong:`sensible-editor`\ (1) script which
+is part of the sensible-utils package.
 
-In general, this type could work on operating systems on which the
-sensible-utils package is available.
+Therefore, the following operating systems are supported:
+  * Debian 8 (jessie) or later
+  * Devuan
+  * Ubuntu 8.10 (intrepid) or later
+  * RHEL/CentOS 7 or later (EPEL repo required)
+  * Fedora 21 or later
 
-On old versions of Ubuntu the sensible-* utils are part of the
+Note: on old versions of Ubuntu the sensible-* utils are part of the
 debianutils package.
 
 SEE ALSO

From 30c7d153e828afd52d1e76328622deb06aca6aaa Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 12 Oct 2019 18:47:27 +0200
Subject: [PATCH 148/383] [__hostname] Only write to distro specific file when
 hostnamectl is missing

---
 cdist/conf/type/__hostname/gencode-remote |  7 +++++-
 cdist/conf/type/__hostname/manifest       | 30 +++++++++++++++--------
 2 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 64fff7ad..182d37ae 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -78,6 +78,11 @@ in
         echo "printf '%s\\n' '$name_should' > /etc/hostname"
         echo "hostname -F /etc/hostname"
     ;;
+    gentoo)
+        # NOTE: Writing the hostname to file is done in the manifest for OpenRC.
+        #       For systemd hostnamectl should take care of that.
+        echo "hostname '$name_should'"
+    ;;
     macosx)
         echo "scutil --set HostName '$name_should'"
     ;;
@@ -87,7 +92,7 @@ in
         echo "printf '%s\\n' '$name_should' > /etc/HOSTNAME"
         echo 'hostname -F /etc/HOSTNAME'
     ;;
-    centos|fedora|freebsd|gentoo|netbsd|openbsd|redhat|scientific)
+    centos|fedora|freebsd|netbsd|openbsd|redhat|scientific)
         # NOTE: Writing the hostname to file is done in the manifest.
         echo "hostname '$name_should'"
     ;;
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 0ffd7678..58034a19 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -52,18 +52,28 @@ in
         :
     ;;
     centos|fedora|redhat|scientific)
-        __key_value sysconfig-hostname \
-            --file /etc/sysconfig/network \
-            --delimiter '=' --exact_delimiter \
-            --key HOSTNAME \
-            --value "\"$name_should\""
+        if test -z "$(cat "$__object/explorer/has_hostnamectl")"
+        then
+            # Only write to /etc/sysconfig/network on non-systemd versions.
+            # On systemd-based versions this entry is ignored.
+            __key_value sysconfig-hostname \
+                --file /etc/sysconfig/network \
+                --delimiter '=' --exact_delimiter \
+                --key HOSTNAME \
+                --value "\"$name_should\""
+        fi
     ;;
     gentoo)
-        __key_value confd-hostname \
-            --file /etc/conf.d/hostname \
-            --delimiter '=' --exact_delimiter \
-            --key 'hostname' \
-            --value "\"$name_should\""
+        if test -z "$(cat "$__object/explorer/has_hostnamectl")"
+        then
+            # Only write to /etc/conf.d/hostname on OpenRC-based installations.
+            # On systemd use hostnamectl(1) in gencode-remote.
+            __key_value confd-hostname \
+                --file /etc/conf.d/hostname \
+                --delimiter '=' --exact_delimiter \
+                --key 'hostname' \
+                --value "\"$name_should\""
+        fi
     ;;
     freebsd)
         __key_value rcconf-hostname \

From cee553a6dd27e2099e60763dec8bb9d061ef3aad Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 12 Oct 2019 18:49:31 +0200
Subject: [PATCH 149/383] [__hostname] Improve systemd hostname setting

This means we write to /etc/hostname before running hostnamectl, so that
it can overwrite the file if it wants to.
---
 cdist/conf/type/__hostname/gencode-remote | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 182d37ae..36593ef2 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -61,23 +61,29 @@ echo 'changed' >> "$__messages_out"
 # First try to set the hostname using hostnamectl, if available.
 if [ "$has_hostnamectl" ]; then
     # Allow hostnamectl to fail silently.
-    # Who the fuck invented a tool that needs dbus to set the hostname anyway ...
+    # Who the fuck invented a tool that needs dbus to set the hostname anyway…
 
-    cat <<EOF
-if hostnamectl set-hostname '$name_should'; then
-    printf '%s\\n' '$name_should' > /etc/hostname
-    exit 0
-fi
-EOF
+    # NOTE: We write the static hostname to /etc/hostname first in case
+    #       hostnamectl fails. Fallback-code below will then adjust the running
+    #       hostname below.
+    echo "printf '%s\\n' '$name_should' > /etc/hostname"
+
+    echo "hostnamectl set-hostname '$name_should' && exit 0"
 fi
 
 # Use the good old way to set the hostname. Also if hostnamectl fails.
 case $os
 in
-    alpine|archlinux|coreos|debian|devuan|ubuntu)
+    alpine|archlinux|debian|devuan|ubuntu)
         echo "printf '%s\\n' '$name_should' > /etc/hostname"
         echo "hostname -F /etc/hostname"
     ;;
+    coreos|openbmc-phosphor)
+        # NOTE: systemd-only distros have the hostname already written above.
+        #       But since hostamectl failed, we update the running hostname
+        #       manually.
+        echo "hostname -F /etc/hostname"
+        ;;
     gentoo)
         # NOTE: Writing the hostname to file is done in the manifest for OpenRC.
         #       For systemd hostnamectl should take care of that.

From 00dd16d7c34f576e76893636dbffc3ea3091e62a Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 13 Oct 2019 10:13:20 +0200
Subject: [PATCH 150/383] [__sensible_editor] List available editors when an
 incorrect one is provided

---
 cdist/conf/type/__sensible_editor/explorer/editor_path | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/explorer/editor_path b/cdist/conf/type/__sensible_editor/explorer/editor_path
index b0de2f0a..b6230545 100644
--- a/cdist/conf/type/__sensible_editor/explorer/editor_path
+++ b/cdist/conf/type/__sensible_editor/explorer/editor_path
@@ -28,7 +28,10 @@ die() {
 }
 
 editor_missing() { die "Editor '$1' is missing on the target system."; }
-editor_no_alternative() { die "Editor '$1' is not in the alternatives list of the target system."; }
+editor_no_alternative() {
+	die "Editor '$1' is not in the alternatives list of the target system." \
+		"$(test "${editors}" && echo "\nPlease choose one of:\n\n${editors}")"
+}
 
 
 case $("${__explorer}/os")
@@ -63,7 +66,7 @@ in
 esac
 
 
-if $has_alternatives && test "$(echo "${editors}" | wc -l)" -gt 0
+if $has_alternatives && test -n "${editors}"
 then
 	IFS='
 '

From 3bbb7b02d2c41fa4ff141d7e2a68d820136c3cd7 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 13 Oct 2019 10:14:05 +0200
Subject: [PATCH 151/383] [__sensible_editor] Allow to omit the --editor
 parameter if --state is absent

---
 cdist/conf/type/__sensible_editor/explorer/editor_path | 7 ++++++-
 cdist/conf/type/__sensible_editor/man.rst              | 2 ++
 cdist/conf/type/__sensible_editor/parameter/optional   | 1 +
 cdist/conf/type/__sensible_editor/parameter/required   | 1 -
 4 files changed, 9 insertions(+), 2 deletions(-)
 delete mode 100644 cdist/conf/type/__sensible_editor/parameter/required

diff --git a/cdist/conf/type/__sensible_editor/explorer/editor_path b/cdist/conf/type/__sensible_editor/explorer/editor_path
index b6230545..d19a5b06 100644
--- a/cdist/conf/type/__sensible_editor/explorer/editor_path
+++ b/cdist/conf/type/__sensible_editor/explorer/editor_path
@@ -33,6 +33,9 @@ editor_no_alternative() {
 		"$(test "${editors}" && echo "\nPlease choose one of:\n\n${editors}")"
 }
 
+# No need to check for the path if the file is supposed to be removed.
+test "$(cat "${__object}/parameter/state")" != 'absent' || exit 0
+
 
 case $("${__explorer}/os")
 in
@@ -50,7 +53,9 @@ in
 		;;
 esac
 
-editor=$(cat "${__object}/parameter/editor")
+# Read --editor parameter and check its value since it is "optional"
+editor=$(cat "${__object}/parameter/editor" 2>/dev/null) || true
+test -n "${editor}" || die 'Please provide an --editor to configure.'
 
 case $editor
 in
diff --git a/cdist/conf/type/__sensible_editor/man.rst b/cdist/conf/type/__sensible_editor/man.rst
index 4260a369..b11aff46 100644
--- a/cdist/conf/type/__sensible_editor/man.rst
+++ b/cdist/conf/type/__sensible_editor/man.rst
@@ -18,6 +18,8 @@ editor
     Name or path of the editor to be selected.
     On systems other than Debian derivatives an absolute path is required.
 
+	It is permissible to omit this parameter if --state is absent.
+
 
 OPTIONAL PARAMETERS
 -------------------
diff --git a/cdist/conf/type/__sensible_editor/parameter/optional b/cdist/conf/type/__sensible_editor/parameter/optional
index ff72b5c7..ae55e240 100644
--- a/cdist/conf/type/__sensible_editor/parameter/optional
+++ b/cdist/conf/type/__sensible_editor/parameter/optional
@@ -1 +1,2 @@
+editor
 state
diff --git a/cdist/conf/type/__sensible_editor/parameter/required b/cdist/conf/type/__sensible_editor/parameter/required
deleted file mode 100644
index 85042acd..00000000
--- a/cdist/conf/type/__sensible_editor/parameter/required
+++ /dev/null
@@ -1 +0,0 @@
-editor

From 8b0734f719de690742361a8756d25511f2c16029 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 13 Oct 2019 10:14:27 +0200
Subject: [PATCH 152/383] [__sensible_editor] Improve error message when a
 basename of an editor not in the alternatives is provided

---
 .../__sensible_editor/explorer/editor_path    | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/explorer/editor_path b/cdist/conf/type/__sensible_editor/explorer/editor_path
index d19a5b06..8a5199c9 100644
--- a/cdist/conf/type/__sensible_editor/explorer/editor_path
+++ b/cdist/conf/type/__sensible_editor/explorer/editor_path
@@ -78,17 +78,24 @@ then
 	if ! $is_abspath
 	then
 		# First, try to resolve the absolute path using $editors.
-		for e in $editors
+		while true
 		do
-			if test "$(basename "${e}")" = "${editor}"
-			then
-				editor="${e}"
-				break
-			fi
+			for e in $editors
+			do
+				if test "$(basename "${e}")" = "${editor}"
+				then
+					editor="${e}"
+					break 2  # break out of both loops
+				fi
+			done
+
+			# Iterating through alternatives did not yield a result
+			editor_no_alternative "${editor}"
+			break
 		done
 	fi
 
-	# Check if path is present
+	# Check if editor is present
 	test -f "${editor}" || editor_missing "${editor}"
 
 	for e in $editors

From 9edf5e8fe03edbf01f2b02a2ab4a5643d31b21d2 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 13 Oct 2019 10:39:50 +0200
Subject: [PATCH 153/383] [__sensible_utils] Fix Ubuntu version detection

---
 cdist/conf/type/__sensible_editor/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__sensible_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
index 988f00e5..43344dac 100644
--- a/cdist/conf/type/__sensible_editor/manifest
+++ b/cdist/conf/type/__sensible_editor/manifest
@@ -63,7 +63,7 @@ in
 		pkg_type='apt'
 		;;
 	ubuntu)
-		"${os_version}" | version_ge 10.04 || package_name='debianutils'
+		(echo "${os_version}" | version_ge 10.04) || package_name='debianutils'
 		pkg_type='apt'
 		;;
 	centos|fedora|redhat|scientific)

From 2bc26e398c33aa350b3fc214a6a1fc150f8f8f47 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Sun, 13 Oct 2019 11:15:53 +0200
Subject: [PATCH 154/383] [__letsencrypt_cert] Add Arch Linux support

---
 cdist/conf/type/__letsencrypt_cert/manifest | 3 +++
 docs/changelog                              | 1 +
 2 files changed, 4 insertions(+)

diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest
index 1d96ee1a..35962d31 100755
--- a/cdist/conf/type/__letsencrypt_cert/manifest
+++ b/cdist/conf/type/__letsencrypt_cert/manifest
@@ -7,6 +7,9 @@ if [ -z "${certbot_fullpath}" ]; then
 	os_version="$(cat "${__global}/explorer/os_version")"
 
 	case "$os" in
+        archlinux)
+            __package certbot
+            ;;
 		debian)
 			case "$os_version" in
 				8*)
diff --git a/docs/changelog b/docs/changelog
index db67e173..f1b37065 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)
+	* Type __letsencrypt_cert: Add Arch Linux support (Nico Schottelius)
 
 6.0.1: 2019-10-08
 	* Type __group: Support OSes without getent (Dennis Camera)

From 365974c4471e0df503d771e9b0d604a8f1883af8 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 13 Oct 2019 13:42:15 +0200
Subject: [PATCH 155/383] [__sensible_editor] Use int comparisons in version_ge

---
 cdist/conf/type/__sensible_editor/manifest | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
index 43344dac..3a1926b6 100644
--- a/cdist/conf/type/__sensible_editor/manifest
+++ b/cdist/conf/type/__sensible_editor/manifest
@@ -27,8 +27,9 @@ version_ge() {
 		nx = split($1, x, ".");
 		ny = split(target, y, ".");
 		for (i = 1; i <= max(nx, ny); ++i) {
-			if (x[i] < y[i]) exit 1;
-			else if (x[i] > y[i]) exit 0;
+			diff = int(x[i]) - int(y[i]);
+			if (diff < 0) exit 1;
+			else if (diff > 0) exit 0;
 			else continue;
 		}
 	}'

From 58eb474b017813f1781cf31836018f40fdf2f0ae Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 13 Oct 2019 13:49:51 +0200
Subject: [PATCH 156/383] [__sensible_editor] Add exists as a possible --state
 value

---
 cdist/conf/type/__sensible_editor/man.rst  | 10 +++++++++-
 cdist/conf/type/__sensible_editor/manifest |  4 ++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__sensible_editor/man.rst b/cdist/conf/type/__sensible_editor/man.rst
index b11aff46..9b805e06 100644
--- a/cdist/conf/type/__sensible_editor/man.rst
+++ b/cdist/conf/type/__sensible_editor/man.rst
@@ -24,7 +24,15 @@ editor
 OPTIONAL PARAMETERS
 -------------------
 state
-    Either "present" or "absent". Defaults to "present".
+    'present', 'absent', or 'exists'. Defaults to 'present', where:
+
+    present
+        the sensible-editor is exactly what is specified in --editor.
+    absent
+        no sensible-editor configuration is present.
+    exists
+        the sensible-editor will be set to what is specified in --editor,
+        unless there already is a configuration on the target system.
 
 
 EXAMPLES
diff --git a/cdist/conf/type/__sensible_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
index 3a1926b6..d4883403 100644
--- a/cdist/conf/type/__sensible_editor/manifest
+++ b/cdist/conf/type/__sensible_editor/manifest
@@ -47,9 +47,9 @@ os_version=$(cat "${__global}/explorer/os_version")
 state=$(cat "${__object}/parameter/state")
 user=$__object_id
 
-if test "${state}" != 'present' && test "${state}" != 'absent'
+if test "${state}" != 'present' && test "${state}" != 'exists' && test "${state}" != 'absent'
 then
-	echo 'Only "present" and "absent" are allowed for --state' >&2
+	echo 'Only "present", "exists", and "absent" are allowed for --state' >&2
 	exit 1
 fi
 

From 9567826dc19526037219558ddd81912e1cdcf129 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 14 Oct 2019 09:21:23 +0200
Subject: [PATCH 157/383] [__sensible_editor] Fix incorrect require variable

---
 cdist/conf/type/__sensible_editor/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__sensible_editor/manifest b/cdist/conf/type/__sensible_editor/manifest
index d4883403..1cdb0c2c 100644
--- a/cdist/conf/type/__sensible_editor/manifest
+++ b/cdist/conf/type/__sensible_editor/manifest
@@ -79,7 +79,7 @@ if test "${state}" != 'absent'
 then
 	__package "${package_name}" --state present \
 		--type "${pkg_type}"
-	export __require="__package/${package_name}"
+	export require="__package/${package_name}"
 fi
 
 editor_path=$(cat "${__object}/explorer/editor_path")

From e462821e469f0f81d56f11f3e8a1637d3b0e2291 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 14 Oct 2019 11:29:49 +0200
Subject: [PATCH 158/383] [__sensible_editor] Fix SC2028

---
 cdist/conf/type/__sensible_editor/explorer/editor_path | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__sensible_editor/explorer/editor_path b/cdist/conf/type/__sensible_editor/explorer/editor_path
index 8a5199c9..dcf63c9b 100644
--- a/cdist/conf/type/__sensible_editor/explorer/editor_path
+++ b/cdist/conf/type/__sensible_editor/explorer/editor_path
@@ -30,7 +30,7 @@ die() {
 editor_missing() { die "Editor '$1' is missing on the target system."; }
 editor_no_alternative() {
 	die "Editor '$1' is not in the alternatives list of the target system." \
-		"$(test "${editors}" && echo "\nPlease choose one of:\n\n${editors}")"
+		"$(test -n "${editors}" && printf '\nPlease choose one of:\n\n%s\n' "${editors}")"
 }
 
 # No need to check for the path if the file is supposed to be removed.

From 3c86c175aa6c771dc4768214c7a3130aae932cb0 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 14 Oct 2019 11:41:04 +0200
Subject: [PATCH 159/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index f1b37065..412614e5 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)
 	* Type __letsencrypt_cert: Add Arch Linux support (Nico Schottelius)
+	* New type: __sensible_editor (Dennis Camera)
 
 6.0.1: 2019-10-08
 	* Type __group: Support OSes without getent (Dennis Camera)

From f5c725a57f212f733e0e73d238b64bf49feb5fce Mon Sep 17 00:00:00 2001
From: Ahmed Bilal <49-ahmedbilal@users.noreply.code.ungleich.ch>
Date: Tue, 15 Oct 2019 20:19:04 +0200
Subject: [PATCH 160/383] Fix issues/Make prometheus+grafana+blackbox types
 compatible with Debian 10

---
 cdist/conf/type/__grafana_dashboard/manifest       | 9 ++++++---
 cdist/conf/type/__letsencrypt_cert/manifest        | 1 +
 cdist/conf/type/__prometheus_alertmanager/manifest | 3 ++-
 cdist/conf/type/__prometheus_exporter/manifest     | 6 ++++--
 cdist/conf/type/__prometheus_server/manifest       | 7 ++++---
 5 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/cdist/conf/type/__grafana_dashboard/manifest b/cdist/conf/type/__grafana_dashboard/manifest
index e652202b..d145c4c3 100755
--- a/cdist/conf/type/__grafana_dashboard/manifest
+++ b/cdist/conf/type/__grafana_dashboard/manifest
@@ -15,6 +15,10 @@ case $os in
                 # Differntation not needed anymore
                 apt_source_distribution=stable
                 ;;
+            10*)
+                # Differntation not needed anymore
+                apt_source_distribution=stable
+                ;;
             *)
                 echo "Don't know how to install Grafana on $os $os_version. Send us a pull request!" >&2
                 exit 1
@@ -29,10 +33,9 @@ case $os in
                     --uri https://packages.grafana.com/oss/deb \
                     --distribution $apt_source_distribution \
                     --component main
-
         __package apt-transport-https
-
-        require="$require __apt_source/grafana __package/apt-transport-https" __package grafana
+        require="$require __apt_source/grafana" __apt_update_index
+        require="$require  __package/apt-transport-https __apt_update_index" __package grafana
         require="$require __package/grafana" __start_on_boot grafana-server
         require="$require __start_on_boot/grafana-server" __process grafana-server --start "service grafana-server start"
         ;;
diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest
index 35962d31..bc039e44 100755
--- a/cdist/conf/type/__letsencrypt_cert/manifest
+++ b/cdist/conf/type/__letsencrypt_cert/manifest
@@ -39,6 +39,7 @@ if [ -z "${certbot_fullpath}" ]; then
 				10*)
 					__package_apt certbot
 				;;
+
 				*)
 					echo "Unsupported OS version: $os_version" >&2
 					exit 1
diff --git a/cdist/conf/type/__prometheus_alertmanager/manifest b/cdist/conf/type/__prometheus_alertmanager/manifest
index 8ee818c3..cf410c44 100755
--- a/cdist/conf/type/__prometheus_alertmanager/manifest
+++ b/cdist/conf/type/__prometheus_alertmanager/manifest
@@ -30,6 +30,7 @@ if [ -f "$__object/parameter/install-from-backports" ]; then
 		*)
 			echo "--install-from-backports is only supported on Devuan -- ignoring." >&2
 			echo "Send a pull request if you require it." >&2
+			exit 1
 		;;
 	esac
 else
@@ -60,5 +61,5 @@ require="$require __directory/$storage_path $require_pkg" \
 __config_file $CONF \
 	--source "$config" \
 	--group prometheus --mode 640 \
-	--onchange "service prometheus-alertmanager reload"  # TODO when a config-check tool is available, check config here
+	--onchange "service prometheus-alertmanager restart"  # TODO when a config-check tool is available, check config here
 
diff --git a/cdist/conf/type/__prometheus_exporter/manifest b/cdist/conf/type/__prometheus_exporter/manifest
index b9e14531..f3930ac6 100644
--- a/cdist/conf/type/__prometheus_exporter/manifest
+++ b/cdist/conf/type/__prometheus_exporter/manifest
@@ -5,9 +5,11 @@ export GOBIN=/opt/gocode/bin  # where to find go binaries
 exporter="$(cat "$__object/parameter/exporter")"
 [ -z "$exporter" ] && exporter="$__object_id"
 
-__user prometheus --system
+__user prometheus
+require="__user/prometheus" __group prometheus
+require="__group/prometheus" __user_groups prometheus --group prometheus
 
-require=""
+require="__user_groups/prometheus"
 case $exporter in
 	node)
 		TEXTFILES=/service/node-exporter/textfiles  # path for the textfiles collector
diff --git a/cdist/conf/type/__prometheus_server/manifest b/cdist/conf/type/__prometheus_server/manifest
index 73a0799c..9756169e 100755
--- a/cdist/conf/type/__prometheus_server/manifest
+++ b/cdist/conf/type/__prometheus_server/manifest
@@ -38,7 +38,8 @@ if [ -f "$__object/parameter/install-from-backports" ]; then
 	esac
 else
 	__package prometheus
-	require_pkg="__package/prometheus"
+	__package prometheus-blackbox-exporter
+	require_pkg="__package/prometheus __package/prometheus-blackbox-exporter"
 fi
 
 ##### PREPARE PATHS AND SUCH ################################################
@@ -59,7 +60,7 @@ require="$require __directory/$storage_path $require_pkg" \
 __config_file $CONF \
 	--source "$config" \
 	--group prometheus --mode 640 \
-	--onchange "promtool check config $CONF && service prometheus reload"
+	--onchange "promtool check config $CONF && service prometheus restart"
 
 for file in $rule_files; do
 	dest=$CONF_DIR/$(basename "$file")
@@ -67,6 +68,6 @@ for file in $rule_files; do
 	__config_file "$dest" \
 		--source "$file" \
 		--owner prometheus \
-		--onchange "promtool check rules '$dest' && service prometheus reload"
+		--onchange "promtool check rules '$dest' && service prometheus restart"
 done
 

From 6214408f2a44a53f848853b833a7b3a2d00ba813 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 15 Oct 2019 20:19:57 +0200
Subject: [PATCH 161/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 412614e5..24ba6b7e 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)
 	* Type __letsencrypt_cert: Add Arch Linux support (Nico Schottelius)
 	* New type: __sensible_editor (Dennis Camera)
+	* Types __grafana_dashboard, __prometheus_alertmanager, __prometheus_exporter, __prometheus_server: Support Debian 10 (Ahmed Bilal Khalid)
 
 6.0.1: 2019-10-08
 	* Type __group: Support OSes without getent (Dennis Camera)

From 778cd4ff0ecc2cdbdd5da1726621172ed6cc95e0 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 17 Oct 2019 11:14:09 +0200
Subject: [PATCH 162/383] Release 6.0.2

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 24ba6b7e..8e6e56ca 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.0.2: 2019-10-17
 	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)
 	* Type __letsencrypt_cert: Add Arch Linux support (Nico Schottelius)
 	* New type: __sensible_editor (Dennis Camera)

From 689b5a299265ae4626348073afe409336893a175 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 17 Oct 2019 16:44:26 +0200
Subject: [PATCH 163/383] [letsencrypt_cert] add support for alpine

---
 cdist/conf/type/__letsencrypt_cert/manifest | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest
index 35962d31..4fa5f119 100755
--- a/cdist/conf/type/__letsencrypt_cert/manifest
+++ b/cdist/conf/type/__letsencrypt_cert/manifest
@@ -8,6 +8,9 @@ if [ -z "${certbot_fullpath}" ]; then
 
 	case "$os" in
         archlinux)
+            __package certbot
+            ;;
+        alpine)
             __package certbot
             ;;
 		debian)

From 076133028f181d2fe0811dc9d915cfba36d07421 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 17 Oct 2019 16:44:56 +0200
Subject: [PATCH 164/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index f1b37065..10aeafc9 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)
 	* Type __letsencrypt_cert: Add Arch Linux support (Nico Schottelius)
+	* Type __letsencrypt_cert: Add Alpine support (Nico Schottelius)
 
 6.0.1: 2019-10-08
 	* Type __group: Support OSes without getent (Dennis Camera)

From fc28f58c77080e94215719ba4f2aa3f3162c8300 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 17 Oct 2019 20:48:52 +0200
Subject: [PATCH 165/383] Generate version.py if it does not exist

---
 setup.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index ae651125..ee823df9 100644
--- a/setup.py
+++ b/setup.py
@@ -1,7 +1,14 @@
 from distutils.core import setup
-import cdist
 import os
 import re
+import subprocess
+
+
+if not os.path.exists(os.path.join('cdist', 'version.py')):
+    subprocess.run([os.path.join('bin', 'build-helper'), 'version', ])
+
+
+import cdist
 
 
 def data_finder(data_dir):

From 2d0af7b7ccc34d450a1b0cfb6532f6d2439ee7a4 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 18 Oct 2019 10:24:11 +0200
Subject: [PATCH 166/383] Generate verions.py only if git cloned repo

---
 setup.py | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/setup.py b/setup.py
index ee823df9..2bb1e16d 100644
--- a/setup.py
+++ b/setup.py
@@ -1,11 +1,24 @@
 from distutils.core import setup
+from distutils.errors import DistutilsError
 import os
 import re
 import subprocess
 
 
-if not os.path.exists(os.path.join('cdist', 'version.py')):
-    subprocess.run([os.path.join('bin', 'build-helper'), 'version', ])
+# We have it only if it is a git cloned repo.
+build_helper = os.path.join('bin', 'build-helper')
+# Version file path.
+version_file = os.path.join('cdist', 'version.py')
+# If we have build-helper we could be a git repo.
+if os.path.exists(build_helper):
+    # Try to generate version.py.
+    rv = subprocess.run([build_helper, 'version', ])
+    if rv.returncode != 0:
+        raise DistutilsError("Failed to generate {}".format(version_file))
+else:
+    # Otherwise, version.py should be present.
+    if not os.path.exists(version_file):
+        raise DistutilsError("Missing version file {}".format(version_file))
 
 
 import cdist

From f6a45808f9796630aa415209d711424d570e145e Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 18 Oct 2019 13:11:59 +0200
Subject: [PATCH 167/383] Fix building man pages command

---
 docs/src/cdist-upgrade.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/src/cdist-upgrade.rst b/docs/src/cdist-upgrade.rst
index e57ed63c..67fd4934 100644
--- a/docs/src/cdist-upgrade.rst
+++ b/docs/src/cdist-upgrade.rst
@@ -11,7 +11,7 @@ To upgrade cdist in the current branch use
     git pull
 
     # Also update the manpages
-    ./build man
+    make man
     export MANPATH=$MANPATH:$(pwd -P)/doc/man
 
 If you stay on a version branche (i.e. 1.0, 1.1., ...), nothing should break.

From ecc77e55ed7f7c76a9f2f1b6af6e5d7fd44bef99 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Fri, 18 Oct 2019 19:45:19 +0200
Subject: [PATCH 168/383] Add timing hack / test1

---
 hacking/timing-tests/benchmark-files.sh | 79 +++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 hacking/timing-tests/benchmark-files.sh

diff --git a/hacking/timing-tests/benchmark-files.sh b/hacking/timing-tests/benchmark-files.sh
new file mode 100644
index 00000000..c71d1c7e
--- /dev/null
+++ b/hacking/timing-tests/benchmark-files.sh
@@ -0,0 +1,79 @@
+#!/bin/sh
+
+num=50000
+dsthost=localhost
+
+tmp=$(mktemp -d)
+remote_tmp=${tmp}-remote
+
+cd "$tmp"
+
+create_files() {
+    i=0
+    while [ $i -lt $num ]; do
+        echo $i > file-${i}
+        i=$((i+1))
+    done
+}
+
+delete_remote() {
+    ssh "${dsthost}" "rm -rf ${remote_tmp}"
+}
+
+
+tar_remote() {
+    cd "${tmp}"
+    tar c . | ssh "${dsthost}" "mkdir ${remote_tmp}; cd ${remote_tmp}; tar x"
+}
+
+cdist_remote()
+{
+    (
+        while [ $i -lt $num ]; do
+            echo __file ${remote_tmp}/file-${i} --source "${tmp}/file-${i}"
+            i=$((i+1))
+        done
+    ) | cdist config -i - -vv "${dsthost}"
+
+}
+
+cdist_remote_parallel()
+{
+    (
+        while [ $i -lt $num ]; do
+            echo __file ${remote_tmp}/file-${i} --source "${tmp}/file-${i}"
+            i=$((i+1))
+        done
+    ) | cdist config -j10 -i - -vv "${dsthost}"
+
+}
+
+echo "Creating ${num} files"
+time create_files
+
+echo "scping files"
+time scp -r "${tmp}" "${dsthost}:$remote_tmp" >/dev/null
+
+echo "delete remote"
+time delete_remote
+
+echo "taring files"
+time tar_remote
+
+echo "delete remote"
+time delete_remote
+
+echo "cdisting files"
+time cdist_remote
+
+echo "delete remote"
+time delete_remote
+
+echo "cdisting files (parallel)!"
+time cdist_remote
+
+echo "delete remote"
+time delete_remote
+
+echo "delete local"
+rm -rf "$tmp"

From 32c15f2ecbc9a4cf29258f9d8e28ef537bcc2ac1 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <KAction@disroot.org>
Date: Sun, 20 Oct 2019 18:59:48 +0000
Subject: [PATCH 169/383] Fix spelling error in manpage

---
 cdist/conf/type/__xymon_client/man.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__xymon_client/man.rst b/cdist/conf/type/__xymon_client/man.rst
index 6f90c15b..6660b0ef 100644
--- a/cdist/conf/type/__xymon_client/man.rst
+++ b/cdist/conf/type/__xymon_client/man.rst
@@ -23,7 +23,7 @@ state
    'present', 'absent', defaults to 'present'.
 
 servers
-   One or more IP adresses (space separated) of the Xymon server(s) to report
+   One or more IP addresses (space separated) of the Xymon server(s) to report
    to. While DNS-names are ok it is discouraged, defaults to 127.0.0.1.
 
 

From 50a3130b0ae280526ac13fd8a3619717d29c57ac Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 21 Oct 2019 12:02:53 +0200
Subject: [PATCH 170/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 176c5d40..5020c3c2 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Type __letsencrypt_cert: Add Alpine support (Nico Schottelius)
+	* Type __xymon_client: Fix spelling error in manpage (Dmitry Bogatov)
 
 6.0.2: 2019-10-17
 	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)

From c3b066c14733fd62969abd7a36e3ac881ed71227 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 24 Oct 2019 19:44:51 +0200
Subject: [PATCH 171/383] [__hostname] Check hostname length if getconf(1) is
 available

---
 cdist/conf/type/__hostname/explorer/max_len | 10 ++++++++++
 cdist/conf/type/__hostname/manifest         | 18 ++++++++++++------
 2 files changed, 22 insertions(+), 6 deletions(-)
 create mode 100644 cdist/conf/type/__hostname/explorer/max_len

diff --git a/cdist/conf/type/__hostname/explorer/max_len b/cdist/conf/type/__hostname/explorer/max_len
new file mode 100644
index 00000000..97d8a142
--- /dev/null
+++ b/cdist/conf/type/__hostname/explorer/max_len
@@ -0,0 +1,10 @@
+#!/bin/sh -e
+
+command -v getconf >/dev/null || exit 0
+
+val=$(getconf HOST_NAME_MAX 2>/dev/null)
+
+if test -n "${val}" -a "${val}" != 'undefined'
+then
+	echo "${val}"
+fi
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 58034a19..2c6057d6 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -20,6 +20,13 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+not_supported() {
+   echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
+   echo "Please contribute an implementation for it if you can." >&2
+   exit 1
+}
+
+
 os=$(cat "$__global/explorer/os")
 if [ -f "$__object/parameter/name" ]; then
     name_should="$(cat "$__object/parameter/name")"
@@ -38,12 +45,11 @@ else
     esac
 fi
 
-
-not_supported() {
-   echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
-   echo "Please contribute an implementation for it if you can." >&2
-   exit 1
-}
+if test -n "${max_len}" -a "$(wc -c "${name_should}")" -gt "${max_len}"a
+then
+	printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2
+	exit 1
+fi
 
 case $os
 in

From 629d443f5aa61eaf8d41c066011108e2b3b9caa1 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Fri, 25 Oct 2019 01:40:48 +0200
Subject: [PATCH 172/383] [__hostname] Fix "command not found" errors with old
 Bash

---
 cdist/conf/type/__hostname/explorer/has_hostnamectl     | 2 +-
 cdist/conf/type/__hostname/explorer/max_len             | 2 +-
 cdist/conf/type/__hostname/explorer/persistent_hostname | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/type/__hostname/explorer/has_hostnamectl b/cdist/conf/type/__hostname/explorer/has_hostnamectl
index 9040023d..2f531f30 100755
--- a/cdist/conf/type/__hostname/explorer/has_hostnamectl
+++ b/cdist/conf/type/__hostname/explorer/has_hostnamectl
@@ -21,4 +21,4 @@
 # Check whether system has hostnamectl
 #
 
-command -v hostnamectl || true
+command -v hostnamectl 2>/dev/null || true
diff --git a/cdist/conf/type/__hostname/explorer/max_len b/cdist/conf/type/__hostname/explorer/max_len
index 97d8a142..fb863949 100644
--- a/cdist/conf/type/__hostname/explorer/max_len
+++ b/cdist/conf/type/__hostname/explorer/max_len
@@ -2,7 +2,7 @@
 
 command -v getconf >/dev/null || exit 0
 
-val=$(getconf HOST_NAME_MAX 2>/dev/null)
+val=$(getconf HOST_NAME_MAX 2>/dev/null) || exit 0
 
 if test -n "${val}" -a "${val}" != 'undefined'
 then
diff --git a/cdist/conf/type/__hostname/explorer/persistent_hostname b/cdist/conf/type/__hostname/explorer/persistent_hostname
index 141c44fe..0feb0809 100755
--- a/cdist/conf/type/__hostname/explorer/persistent_hostname
+++ b/cdist/conf/type/__hostname/explorer/persistent_hostname
@@ -22,7 +22,7 @@
 #
 
 # Firstly, check hostnamectl if available.
-if command -v hostnamectl >/dev/null
+if command -v hostnamectl >/dev/null 2>&1
 then
 	hostnamectl status --static && exit 0
 fi
@@ -32,10 +32,10 @@ fi
 case $("$__explorer/os")
 in
 	alpine|archlinux|coreos|debian|devuan|ubuntu)
-		[ -f /etc/hostname ] && cat /etc/hostname
+		test -f /etc/hostname && cat /etc/hostname
 		;;
 	centos|fedora|redhat|scientific)
-		[ -f /etc/sysconfig/network ] \
+		test -f /etc/sysconfig/network \
 			&& (. /etc/sysconfig/network && echo "$HOSTNAME")
 		;;
 	freebsd)

From d4313c7501b39c09e01cee530ec36a7452bcfc53 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Fri, 25 Oct 2019 01:41:26 +0200
Subject: [PATCH 173/383] [__hostname] Fix checking of maximum hostname length
 against sysconf(3)

---
 cdist/conf/type/__hostname/manifest | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 2c6057d6..f3739f6c 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -28,6 +28,8 @@ not_supported() {
 
 
 os=$(cat "$__global/explorer/os")
+max_len=$(cat "$__object/explorer/max_len")
+
 if [ -f "$__object/parameter/name" ]; then
     name_should="$(cat "$__object/parameter/name")"
 else
@@ -45,7 +47,7 @@ else
     esac
 fi
 
-if test -n "${max_len}" -a "$(wc -c "${name_should}")" -gt "${max_len}"a
+if test -n "${max_len}" -a "$(printf "${name_should}" | wc -c)" -gt "${max_len}"
 then
 	printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2
 	exit 1

From b65ceba56936b581870754afa879284b686e057b Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Fri, 25 Oct 2019 02:16:43 +0200
Subject: [PATCH 174/383] [__hostame] Resolve shellcheck errors

---
 cdist/conf/type/__hostname/gencode-remote | 10 +++++-----
 cdist/conf/type/__hostname/manifest       |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 36593ef2..5942b2e3 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -55,18 +55,18 @@ fi
 ################################################################################
 # Setup hostname
 #
-echo 'changed' >> "$__messages_out"
+echo 'changed' >>"$__messages_out"
 
 
 # First try to set the hostname using hostnamectl, if available.
-if [ "$has_hostnamectl" ]; then
+if [ -n "$has_hostnamectl" ]; then
     # Allow hostnamectl to fail silently.
     # Who the fuck invented a tool that needs dbus to set the hostname anyway…
 
     # NOTE: We write the static hostname to /etc/hostname first in case
     #       hostnamectl fails. Fallback-code below will then adjust the running
     #       hostname below.
-    echo "printf '%s\\n' '$name_should' > /etc/hostname"
+    echo "echo '$name_should' >/etc/hostname"
 
     echo "hostnamectl set-hostname '$name_should' && exit 0"
 fi
@@ -75,7 +75,7 @@ fi
 case $os
 in
     alpine|archlinux|debian|devuan|ubuntu)
-        echo "printf '%s\\n' '$name_should' > /etc/hostname"
+        echo "echo '$name_should' >/etc/hostname"
         echo "hostname -F /etc/hostname"
     ;;
     coreos|openbmc-phosphor)
@@ -95,7 +95,7 @@ in
     suse)
         # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
         # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.
-        echo "printf '%s\\n' '$name_should' > /etc/HOSTNAME"
+        echo "echo '$name_should' >/etc/HOSTNAME"
         echo 'hostname -F /etc/HOSTNAME'
     ;;
     centos|fedora|freebsd|netbsd|openbsd|redhat|scientific)
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index f3739f6c..a4068cc2 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -47,7 +47,7 @@ else
     esac
 fi
 
-if test -n "${max_len}" -a "$(printf "${name_should}" | wc -c)" -gt "${max_len}"
+if test -n "${max_len}" -a "$(printf '%s' "${name_should}" | wc -c)" -gt "${max_len}"
 then
 	printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2
 	exit 1

From 00852cb17d375da39ae585ec337da18a4f63587d Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 25 Oct 2019 14:26:08 +0200
Subject: [PATCH 175/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 5020c3c2..cdc4e8f5 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* Type __letsencrypt_cert: Add Alpine support (Nico Schottelius)
 	* Type __xymon_client: Fix spelling error in manpage (Dmitry Bogatov)
+	* Build: Support pip from git (Darko Poljak, Ľubomír Kučera)
 
 6.0.2: 2019-10-17
 	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)

From 6eec5f87a4e2c3b006a2bded1e85ec565cd7acc6 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 26 Oct 2019 17:11:35 +0200
Subject: [PATCH 176/383] [__hostame] Simplify and revert hostnamectl to be a
 last resort

---
 .../__hostname/explorer/persistent_hostname   | 66 ----------------
 cdist/conf/type/__hostname/gencode-remote     | 73 +++++++----------
 cdist/conf/type/__hostname/manifest           | 78 +++++++++++++++----
 3 files changed, 90 insertions(+), 127 deletions(-)
 delete mode 100755 cdist/conf/type/__hostname/explorer/persistent_hostname

diff --git a/cdist/conf/type/__hostname/explorer/persistent_hostname b/cdist/conf/type/__hostname/explorer/persistent_hostname
deleted file mode 100755
index 0feb0809..00000000
--- a/cdist/conf/type/__hostname/explorer/persistent_hostname
+++ /dev/null
@@ -1,66 +0,0 @@
-#!/bin/sh
-#
-# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-# Retrieve the persistent hostname
-#
-
-# Firstly, check hostnamectl if available.
-if command -v hostnamectl >/dev/null 2>&1
-then
-	hostnamectl status --static && exit 0
-fi
-
-# In case hostnamectl is missing or failed:
-# Fall back to alternative OS-specific approaches.
-case $("$__explorer/os")
-in
-	alpine|archlinux|coreos|debian|devuan|ubuntu)
-		test -f /etc/hostname && cat /etc/hostname
-		;;
-	centos|fedora|redhat|scientific)
-		test -f /etc/sysconfig/network \
-			&& (. /etc/sysconfig/network && echo "$HOSTNAME")
-		;;
-	freebsd)
-		(. /etc/rc.conf && echo "$hostname")
-		;;
-	gentoo)
-		(. /etc/conf.d/hostname && echo "$hostname")
-		;;
-	macosx)
-		scutil --get HostName 2>/dev/null
-		;;
-	netbsd)
-		if grep -q '^hostname=' /etc/rc.conf
-		then
-			(. /etc/rc.conf && echo "$hostname")
-		elif [ -f /etc/myname ]
-		then
-			# Fall back to /etc/myname file
-			cat /etc/myname
-		fi
-		;;
-	openbsd)
-		cat /etc/myname
-		;;
-	suse)
-		cat /etc/HOSTNAME 2>/dev/null
-		;;
-esac
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 5942b2e3..253bf5ea 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -22,17 +22,17 @@
 
 os=$(cat "$__global/explorer/os")
 name_running=$(cat "$__global/explorer/hostname")
-name_config=$(cat "$__object/explorer/persistent_hostname")
 has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
 
 
-if [ -f "$__object/parameter/name" ]; then
-    name_should="$(cat "$__object/parameter/name")"
+if test -s "$__object/parameter/name"
+then
+    name_should=$(cat "$__object/parameter/name")
 else
     case $os
     in
         # RedHat-derivatives and BSDs
-        centos|fedora|redhat|scientific|freebsd|netbsd|openbsd)
+        centos|fedora|redhat|scientific|freebsd|macosx|netbsd|openbsd)
             # Hostname is FQDN
             name_should="${__target_host}"
         ;;
@@ -43,66 +43,49 @@ else
     esac
 fi
 
+
 ################################################################################
-# Check if the hostname is already correct
+# Check if the (running) hostname is already correct
 #
-if [ "$name_running" = "$name_should" ] \
-  && [ -z "$name_config" -o "$name_config" = "$name_should" ]
-then
-    exit 0
-fi
+test "$name_running" != "$name_should" || exit 0
+
 
 ################################################################################
 # Setup hostname
 #
 echo 'changed' >>"$__messages_out"
 
-
-# First try to set the hostname using hostnamectl, if available.
-if [ -n "$has_hostnamectl" ]; then
-    # Allow hostnamectl to fail silently.
-    # Who the fuck invented a tool that needs dbus to set the hostname anyway…
-
-    # NOTE: We write the static hostname to /etc/hostname first in case
-    #       hostnamectl fails. Fallback-code below will then adjust the running
-    #       hostname below.
-    echo "echo '$name_should' >/etc/hostname"
-
-    echo "hostnamectl set-hostname '$name_should' && exit 0"
-fi
-
-# Use the good old way to set the hostname. Also if hostnamectl fails.
+# Use the good old way to set the hostname.
 case $os
 in
-    alpine|archlinux|debian|devuan|ubuntu)
-        echo "echo '$name_should' >/etc/hostname"
-        echo "hostname -F /etc/hostname"
+    alpine|debian|devuan|ubuntu)
+        echo 'hostname -F /etc/hostname'
     ;;
-    coreos|openbmc-phosphor)
-        # NOTE: systemd-only distros have the hostname already written above.
-        #       But since hostamectl failed, we update the running hostname
-        #       manually.
-        echo "hostname -F /etc/hostname"
-        ;;
-    gentoo)
-        # NOTE: Writing the hostname to file is done in the manifest for OpenRC.
-        #       For systemd hostnamectl should take care of that.
+    archlinux|centos|fedora|redhat|scientific|freebsd|netbsd|gentoo)
         echo "hostname '$name_should'"
     ;;
     macosx)
         echo "scutil --set HostName '$name_should'"
     ;;
+    openbsd)
+        echo 'hostname -F /etc/myname'
+    ;;
     suse)
-        # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
-        # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.
-        echo "echo '$name_should' >/etc/HOSTNAME"
         echo 'hostname -F /etc/HOSTNAME'
     ;;
-    centos|fedora|freebsd|netbsd|openbsd|redhat|scientific)
-        # NOTE: Writing the hostname to file is done in the manifest.
-        echo "hostname '$name_should'"
-    ;;
     *)
-        echo "echo 'Unsupported OS: $os' >&2; exit 1"
+        # Fall back to set the hostname using hostnamectl, if available.
+        if test -n "$has_hostnamectl"
+        then
+            # Don't use hostnamectl as the primary means to set the hostname for
+            # systemd systems, because it cannot be trusted to work reliably and
+            # exit with non-zero when it fails.
+            # Who invented a tool that needs dbus to set the hostname anyway…
+
+            echo "hostnamectl set-hostname \"\$(cat /etc/hostname)\""
+            echo "test \"\$(hostname)\" = \"\$(cat /etc/hostname)\" || hostname -F /etc/hostname"
+        else
+            printf "echo 'Unsupported OS: %s' >&2\nexit 1\n" "$os"
+        fi
     ;;
 esac
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index a4068cc2..78adc20b 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -20,18 +20,25 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+onchange_cmd="echo changed >>'$__messages_out'"
+
 not_supported() {
-   echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
-   echo "Please contribute an implementation for it if you can." >&2
-   exit 1
+    echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
+    echo "Please contribute an implementation for it if you can." >&2
+    exit 1
 }
 
+set_hostname_systemd() {
+    echo "$1" | __file /etc/hostname --source - --onchange "$onchange_cmd"
+}
 
 os=$(cat "$__global/explorer/os")
 max_len=$(cat "$__object/explorer/max_len")
+has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
 
-if [ -f "$__object/parameter/name" ]; then
-    name_should="$(cat "$__object/parameter/name")"
+if test -s "$__object/parameter/name"
+then
+    name_should=$(cat "$__object/parameter/name")
 else
     case $os
     in
@@ -49,18 +56,37 @@ fi
 
 if test -n "${max_len}" -a "$(printf '%s' "${name_should}" | wc -c)" -gt "${max_len}"
 then
-	printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2
-	exit 1
+    printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2
+    exit 1
 fi
 
 case $os
 in
-    archlinux|debian|suse|ubuntu|devuan|coreos|alpine|macosx)
+    alpine|debian|devuan|ubuntu)
+        echo "$name_should" \
+            | __file /etc/hostname --source - --onchange "$onchange_cmd"
+    ;;
+    macosx)
         # handled in gencode-remote
         :
     ;;
+    archlinux)
+        if test -n "$has_hostnamectl"
+        then
+            set_hostname_systemd "$name_should"
+        else
+            # Only for ancient ArchLinux, write to /etc/rc.conf on pre-systemd
+            # versions.
+            __key_value sysconfig-hostname \
+                --file /etc/rc.conf \
+                --delimiter '=' --exact_delimiter \
+                --key 'HOSTNAME' \
+                --value "\"$name_should\"" \
+                --onchange "$onchange_cmd"
+        fi
+        ;;
     centos|fedora|redhat|scientific)
-        if test -z "$(cat "$__object/explorer/has_hostnamectl")"
+        if test -z "$has_hostnamectl"
         then
             # Only write to /etc/sysconfig/network on non-systemd versions.
             # On systemd-based versions this entry is ignored.
@@ -68,11 +94,14 @@ in
                 --file /etc/sysconfig/network \
                 --delimiter '=' --exact_delimiter \
                 --key HOSTNAME \
-                --value "\"$name_should\""
+                --value "\"$name_should\"" \
+                --onchange "$onchange_cmd"
+        else
+            set_hostname_systemd "$name_should"
         fi
     ;;
     gentoo)
-        if test -z "$(cat "$__object/explorer/has_hostnamectl")"
+        if test -z "$has_hostnamectl"
         then
             # Only write to /etc/conf.d/hostname on OpenRC-based installations.
             # On systemd use hostnamectl(1) in gencode-remote.
@@ -81,6 +110,8 @@ in
                 --delimiter '=' --exact_delimiter \
                 --key 'hostname' \
                 --value "\"$name_should\""
+        else
+            set_hostname_systemd "$name_should"
         fi
     ;;
     freebsd)
@@ -88,22 +119,37 @@ in
             --file /etc/rc.conf \
             --delimiter '=' --exact_delimiter \
             --key 'hostname' \
-            --value "\"$name_should\""
+            --value "\"$name_should\"" \
+            --onchange "$onchange_cmd"
     ;;
     netbsd)
         __key_value rcconf-hostname \
             --file /etc/rc.conf \
             --delimiter '=' --exact_delimiter \
             --key 'hostname' \
-            --value "\"$name_should\""
+            --value "\"$name_should\"" \
+            --onchange "$onchange_cmd"
+
         # To avoid confusion, ensure that the hostname is only stored once
         __file /etc/myname --state absent
     ;;
     openbsd)
-        echo "$name_should" | __file /etc/myname --source -
+        echo "$name_should" \
+            | __file /etc/myname --source - --onchange "$onchange_cmd"
+    ;;
+    suse)
+        # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
+        # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.
+        echo "$name_should" \
+            | __file /etc/HOSTNAME --source - --onchange "$onchange_cmd"
     ;;
     *)
-        # On other operating systems we fall back to hostnamectl if available…
-        test -n "$(cat "$__object/explorer/has_hostnamectl")" || not_supported
+        # On other operating systems we fall back to systemd's hostnamectl if available…
+        if test -n "$has_hostnamectl"
+        then
+            set_hostname_systemd "$name_should"
+        else
+            not_supported
+        fi
     ;;
 esac

From e7279680edbd645249eca3c2d363d233dd1cd269 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 26 Oct 2019 17:12:08 +0200
Subject: [PATCH 177/383] [__hostname/man.rst] Add link to RFC 1178

---
 cdist/conf/type/__hostname/man.rst | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__hostname/man.rst b/cdist/conf/type/__hostname/man.rst
index d23a3b8a..72aefbab 100644
--- a/cdist/conf/type/__hostname/man.rst
+++ b/cdist/conf/type/__hostname/man.rst
@@ -8,7 +8,10 @@ cdist-type__hostname - Set the hostname
 
 DESCRIPTION
 -----------
-Set's the hostname on various operating systems.
+Sets the hostname on various operating systems.
+
+**Tip:** For advice on choosing a hostname, see
+`RFC 1178 <https://tools.ietf.org/html/rfc1178>`_.
 
 
 REQUIRED PARAMETERS
@@ -18,7 +21,7 @@ None.
 OPTIONAL PARAMETERS
 -------------------
 name
-   The hostname to set. Defaults to the first segment of __target_host 
+   The hostname to set. Defaults to the first segment of __target_host
    (${__target_host%%.*})
 
 

From f276813f7f1fe0af7775bb41adf37dcd3d377992 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 26 Oct 2019 17:25:44 +0200
Subject: [PATCH 178/383] [__hostname] Remove incorrectly sent messages (again)

The --onchage sent the message on the target where messaging is not supported.

Now the result is that a "changed" message is only emitted when the running
hostname changes, not when the persistent hostname changes.
---
 cdist/conf/type/__hostname/manifest | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 78adc20b..49591926 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -20,8 +20,6 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-onchange_cmd="echo changed >>'$__messages_out'"
-
 not_supported() {
     echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
     echo "Please contribute an implementation for it if you can." >&2
@@ -29,7 +27,7 @@ not_supported() {
 }
 
 set_hostname_systemd() {
-    echo "$1" | __file /etc/hostname --source - --onchange "$onchange_cmd"
+    echo "$1" | __file /etc/hostname --source -
 }
 
 os=$(cat "$__global/explorer/os")
@@ -64,7 +62,7 @@ case $os
 in
     alpine|debian|devuan|ubuntu)
         echo "$name_should" \
-            | __file /etc/hostname --source - --onchange "$onchange_cmd"
+            | __file /etc/hostname --source -
     ;;
     macosx)
         # handled in gencode-remote
@@ -81,8 +79,7 @@ in
                 --file /etc/rc.conf \
                 --delimiter '=' --exact_delimiter \
                 --key 'HOSTNAME' \
-                --value "\"$name_should\"" \
-                --onchange "$onchange_cmd"
+                --value "\"$name_should\""
         fi
         ;;
     centos|fedora|redhat|scientific)
@@ -94,8 +91,7 @@ in
                 --file /etc/sysconfig/network \
                 --delimiter '=' --exact_delimiter \
                 --key HOSTNAME \
-                --value "\"$name_should\"" \
-                --onchange "$onchange_cmd"
+                --value "\"$name_should\""
         else
             set_hostname_systemd "$name_should"
         fi
@@ -119,29 +115,27 @@ in
             --file /etc/rc.conf \
             --delimiter '=' --exact_delimiter \
             --key 'hostname' \
-            --value "\"$name_should\"" \
-            --onchange "$onchange_cmd"
+            --value "\"$name_should\""
     ;;
     netbsd)
         __key_value rcconf-hostname \
             --file /etc/rc.conf \
             --delimiter '=' --exact_delimiter \
             --key 'hostname' \
-            --value "\"$name_should\"" \
-            --onchange "$onchange_cmd"
+            --value "\"$name_should\""
 
         # To avoid confusion, ensure that the hostname is only stored once
         __file /etc/myname --state absent
     ;;
     openbsd)
         echo "$name_should" \
-            | __file /etc/myname --source - --onchange "$onchange_cmd"
+            | __file /etc/myname --source -
     ;;
     suse)
         # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
         # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.
         echo "$name_should" \
-            | __file /etc/HOSTNAME --source - --onchange "$onchange_cmd"
+            | __file /etc/HOSTNAME --source -
     ;;
     *)
         # On other operating systems we fall back to systemd's hostnamectl if available…

From cbae534af58859da299972b95d9f5c05040c33e5 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 26 Oct 2019 21:01:54 +0200
Subject: [PATCH 179/383] [__hostname] Patch for modern ArchLinux without
 hostname(1)

---
 cdist/conf/type/__hostname/gencode-remote | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 253bf5ea..6840ca9e 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -61,7 +61,12 @@ in
     alpine|debian|devuan|ubuntu)
         echo 'hostname -F /etc/hostname'
     ;;
-    archlinux|centos|fedora|redhat|scientific|freebsd|netbsd|gentoo)
+    archlinux)
+        echo 'command -v hostnamectl >/dev/null 2>&1' \
+            "&& hostnamectl set-hostname '$name_should'" \
+            "|| hostname '$name_should'"
+    ;;
+    centos|fedora|redhat|scientific|freebsd|netbsd|gentoo)
         echo "hostname '$name_should'"
     ;;
     macosx)

From 0ec52fd1bd1a5b20aa5d8503da62d18b43399403 Mon Sep 17 00:00:00 2001
From: Ahmed Bilal <49-ahmedbilal@users.noreply.code.ungleich.ch>
Date: Sun, 27 Oct 2019 18:11:08 +0100
Subject: [PATCH 180/383] alpine support added in __package_update_index

---
 cdist/conf/type/__package_update_index/explorer/currage | 3 +++
 cdist/conf/type/__package_update_index/explorer/type    | 1 +
 cdist/conf/type/__package_update_index/gencode-remote   | 4 ++++
 3 files changed, 8 insertions(+)

diff --git a/cdist/conf/type/__package_update_index/explorer/currage b/cdist/conf/type/__package_update_index/explorer/currage
index 3539b8e1..cfb778d5 100644
--- a/cdist/conf/type/__package_update_index/explorer/currage
+++ b/cdist/conf/type/__package_update_index/explorer/currage
@@ -34,6 +34,9 @@ case "$type" in
             echo 0
         fi
         ;;
+    alpine)
+        echo 0
+        ;;
     *)  echo "Your specified type ($type) is currently not supported." >&2
         echo "Please contribute an implementation for it if you can." >&2
         ;;
diff --git a/cdist/conf/type/__package_update_index/explorer/type b/cdist/conf/type/__package_update_index/explorer/type
index 35254c5f..c98e1e67 100644
--- a/cdist/conf/type/__package_update_index/explorer/type
+++ b/cdist/conf/type/__package_update_index/explorer/type
@@ -26,6 +26,7 @@ else
         amazon|scientific|centos|fedora|redhat) echo "yum" ;;
         debian|ubuntu|devuan) echo "apt" ;;
         archlinux) echo "pacman" ;;
+        alpine) echo "apk" ;;
         *)
             echo "Don't know how to manage packages on: $os" >&2
             exit 1
diff --git a/cdist/conf/type/__package_update_index/gencode-remote b/cdist/conf/type/__package_update_index/gencode-remote
index 738d38eb..9b2ecba2 100755
--- a/cdist/conf/type/__package_update_index/gencode-remote
+++ b/cdist/conf/type/__package_update_index/gencode-remote
@@ -47,6 +47,10 @@ case "$type" in
         echo "pacman --noprogressbar --sync --refresh"
         echo "pacman package database synced (age was: $currage)" >> "$__messages_out"
         ;;
+    alpine)
+        echo "apk update"
+        echo "apk package database updated."
+        ;;
     *)
         echo "Don't know how to manage packages for type: $type" >&2
         exit 1

From 39b320a19a14c1e7653ff14e7e824f2d1ac762cb Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 27 Oct 2019 19:12:52 +0100
Subject: [PATCH 181/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index cdc4e8f5..d4b55336 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Type __letsencrypt_cert: Add Alpine support (Nico Schottelius)
 	* Type __xymon_client: Fix spelling error in manpage (Dmitry Bogatov)
 	* Build: Support pip from git (Darko Poljak, Ľubomír Kučera)
+	* Type __package_update_index: Add Alpine support (Ahmed Bilal Khalid)
 
 6.0.2: 2019-10-17
 	* New types: __xymon_server, __xymon_apache, __xymon_config, __xymon_client (Thomas Eckert)

From b9571a2bbdf3cb9cca52444f5da2db16327801c9 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 26 Oct 2019 22:17:08 +0200
Subject: [PATCH 182/383] [__hostname] Add support for Void Linux

---
 cdist/conf/type/__hostname/gencode-remote | 2 +-
 cdist/conf/type/__hostname/manifest       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 6840ca9e..90312fad 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -66,7 +66,7 @@ in
             "&& hostnamectl set-hostname '$name_should'" \
             "|| hostname '$name_should'"
     ;;
-    centos|fedora|redhat|scientific|freebsd|netbsd|gentoo)
+    centos|fedora|redhat|scientific|freebsd|netbsd|gentoo|void)
         echo "hostname '$name_should'"
     ;;
     macosx)
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 49591926..4465038d 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -60,7 +60,7 @@ fi
 
 case $os
 in
-    alpine|debian|devuan|ubuntu)
+    alpine|debian|devuan|ubuntu|void)
         echo "$name_should" \
             | __file /etc/hostname --source -
     ;;

From 66c85230a0aa35a64323e2cfc68490ef87055670 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 27 Oct 2019 13:16:05 +0100
Subject: [PATCH 183/383] [__hostname] Make __key_value names more meaningful

---
 cdist/conf/type/__hostname/manifest | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 4465038d..64f90492 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -61,12 +61,7 @@ fi
 case $os
 in
     alpine|debian|devuan|ubuntu|void)
-        echo "$name_should" \
-            | __file /etc/hostname --source -
-    ;;
-    macosx)
-        # handled in gencode-remote
-        :
+        echo "$name_should" | __file /etc/hostname --source -
     ;;
     archlinux)
         if test -n "$has_hostnamectl"
@@ -75,7 +70,8 @@ in
         else
             # Only for ancient ArchLinux, write to /etc/rc.conf on pre-systemd
             # versions.
-            __key_value sysconfig-hostname \
+			# There are some versions which use /etc/hostname but not systemd. It is unclear which ones these are.
+            __key_value '/etc/rc.conf:HOSTNAME' \
                 --file /etc/rc.conf \
                 --delimiter '=' --exact_delimiter \
                 --key 'HOSTNAME' \
@@ -87,7 +83,7 @@ in
         then
             # Only write to /etc/sysconfig/network on non-systemd versions.
             # On systemd-based versions this entry is ignored.
-            __key_value sysconfig-hostname \
+            __key_value '/etc/sysconfig/network:HOSTNAME' \
                 --file /etc/sysconfig/network \
                 --delimiter '=' --exact_delimiter \
                 --key HOSTNAME \
@@ -101,7 +97,7 @@ in
         then
             # Only write to /etc/conf.d/hostname on OpenRC-based installations.
             # On systemd use hostnamectl(1) in gencode-remote.
-            __key_value confd-hostname \
+            __key_value '/etc/conf.d/hostname:hostname' \
                 --file /etc/conf.d/hostname \
                 --delimiter '=' --exact_delimiter \
                 --key 'hostname' \
@@ -111,14 +107,18 @@ in
         fi
     ;;
     freebsd)
-        __key_value rcconf-hostname \
+        __key_value '/etc/rc.conf:hostname' \
             --file /etc/rc.conf \
             --delimiter '=' --exact_delimiter \
             --key 'hostname' \
             --value "\"$name_should\""
     ;;
+    macosx)
+        # handled in gencode-remote
+        :
+    ;;
     netbsd)
-        __key_value rcconf-hostname \
+        __key_value '/etc/rc.conf:hostname' \
             --file /etc/rc.conf \
             --delimiter '=' --exact_delimiter \
             --key 'hostname' \
@@ -128,14 +128,12 @@ in
         __file /etc/myname --state absent
     ;;
     openbsd)
-        echo "$name_should" \
-            | __file /etc/myname --source -
+        echo "$name_should" | __file /etc/myname --source -
     ;;
     suse)
         # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
         # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.
-        echo "$name_should" \
-            | __file /etc/HOSTNAME --source -
+        echo "$name_should" | __file /etc/HOSTNAME --source -
     ;;
     *)
         # On other operating systems we fall back to systemd's hostnamectl if available…

From 5eb9fec550907d3ae65ce9ef62849093afc7c9f4 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 27 Oct 2019 15:14:09 +0100
Subject: [PATCH 184/383] [__hostname] Add support for Slackware

---
 cdist/conf/type/__hostname/gencode-remote | 2 +-
 cdist/conf/type/__hostname/manifest       | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 90312fad..1e798036 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -66,7 +66,7 @@ in
             "&& hostnamectl set-hostname '$name_should'" \
             "|| hostname '$name_should'"
     ;;
-    centos|fedora|redhat|scientific|freebsd|netbsd|gentoo|void)
+    centos|fedora|redhat|scientific|freebsd|netbsd|gentoo|slackware|void)
         echo "hostname '$name_should'"
     ;;
     macosx)
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 64f90492..8b4d26b1 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -41,7 +41,7 @@ else
     case $os
     in
         # RedHat-derivatives and BSDs
-        centos|fedora|redhat|scientific|freebsd|netbsd|openbsd)
+        centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|slackware)
             # Hostname is FQDN
             name_should="${__target_host}"
         ;;
@@ -130,6 +130,12 @@ in
     openbsd)
         echo "$name_should" | __file /etc/myname --source -
     ;;
+    slackware)
+        # We write the FQDN into /etc/HOSTNAME.
+        # But /etc/rc.d/rc.M will only read the first component from this file
+        # and set it as the running hostname on boot.
+        echo "$name_should" | __file /etc/HOSTNAME --source -
+    ;;
     suse)
         # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
         # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.

From c939bd6bf676b186ced82bebf925ce83b7c79df4 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 27 Oct 2019 20:12:10 +0100
Subject: [PATCH 185/383] [__hostname] Small fixes

---
 cdist/conf/type/__hostname/gencode-remote | 5 +----
 cdist/conf/type/__hostname/manifest       | 6 +++---
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 1e798036..4532bacf 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -66,15 +66,12 @@ in
             "&& hostnamectl set-hostname '$name_should'" \
             "|| hostname '$name_should'"
     ;;
-    centos|fedora|redhat|scientific|freebsd|netbsd|gentoo|slackware|void)
+    centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|gentoo|slackware|void)
         echo "hostname '$name_should'"
     ;;
     macosx)
         echo "scutil --set HostName '$name_should'"
     ;;
-    openbsd)
-        echo 'hostname -F /etc/myname'
-    ;;
     suse)
         echo 'hostname -F /etc/HOSTNAME'
     ;;
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 8b4d26b1..31d43264 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -52,7 +52,7 @@ else
     esac
 fi
 
-if test -n "${max_len}" -a "$(printf '%s' "${name_should}" | wc -c)" -gt "${max_len}"
+if test -n "${max_len}" && test "$(printf '%s' "${name_should}" | wc -c)" -gt "${max_len}"
 then
     printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2
     exit 1
@@ -69,8 +69,8 @@ in
             set_hostname_systemd "$name_should"
         else
             # Only for ancient ArchLinux, write to /etc/rc.conf on pre-systemd
-            # versions.
-			# There are some versions which use /etc/hostname but not systemd. It is unclear which ones these are.
+            # versions.  There are some versions which use /etc/hostname but not
+			# systemd. It is unclear which ones these are.
             __key_value '/etc/rc.conf:HOSTNAME' \
                 --file /etc/rc.conf \
                 --delimiter '=' --exact_delimiter \

From 5fcd4bc09f1f34c20c53a9a5cc25d084d86c36d8 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 31 Oct 2019 08:56:13 +0100
Subject: [PATCH 186/383] Release 6.0.3

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index d4b55336..1ba56e73 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.0.3: 2019-10-31
 	* Type __letsencrypt_cert: Add Alpine support (Nico Schottelius)
 	* Type __xymon_client: Fix spelling error in manpage (Dmitry Bogatov)
 	* Build: Support pip from git (Darko Poljak, Ľubomír Kučera)

From 7b8f1f09d9cbe6d0da721597055b68e2efd9980d Mon Sep 17 00:00:00 2001
From: Kirill Miazine <km@krot.org>
Date: Fri, 8 Nov 2019 09:00:29 +0100
Subject: [PATCH 187/383] Correct a couple of typos.

---
 docs/src/cdist-real-world.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/src/cdist-real-world.rst b/docs/src/cdist-real-world.rst
index 8ccb0fc9..ba118d63 100644
--- a/docs/src/cdist-real-world.rst
+++ b/docs/src/cdist-real-world.rst
@@ -27,7 +27,7 @@ for that. This type will:
 - configure nginx.
 
 Our type will not create the actual python application. Its intention is only
-to configure hosing for specified user and project. It is up to the user to
+to configure hosting for specified user and project. It is up to the user to
 create his/her applications.
 
 So let's start.
@@ -480,7 +480,7 @@ Creating python bottle application
 
 We now need to create Bottle application. As you remember from the beginning
 of this walkthrough our type does not create the actual python application,
-its intention is only to configure hosing for specified user and project.
+its intention is only to configure hosting for specified user and project.
 It is up to the user to create his/her applications.
 
 Become app user::

From 8b0686766a0f6f6eb4219ec54a68ef270703bff5 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Fri, 8 Nov 2019 13:27:38 +0100
Subject: [PATCH 188/383] ++changes

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 1ba56e73..1c56ec74 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Doc: Fix typos (Kirill Miazine)
+
 6.0.3: 2019-10-31
 	* Type __letsencrypt_cert: Add Alpine support (Nico Schottelius)
 	* Type __xymon_client: Fix spelling error in manpage (Dmitry Bogatov)

From 88947d45b3a6a8496b568e0880a94afd6553bbed Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 16 Nov 2019 14:57:27 +0100
Subject: [PATCH 189/383] [__hostname] Add support for Solaris

---
 cdist/conf/type/__hostname/gencode-remote | 3 +++
 cdist/conf/type/__hostname/manifest       | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 4532bacf..f06ee145 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -72,6 +72,9 @@ in
     macosx)
         echo "scutil --set HostName '$name_should'"
     ;;
+    solaris)
+        echo "uname -S '$name_should'"
+    ;;
     suse)
         echo 'hostname -F /etc/HOSTNAME'
     ;;
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 31d43264..6b26cada 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -136,6 +136,9 @@ in
         # and set it as the running hostname on boot.
         echo "$name_should" | __file /etc/HOSTNAME --source -
     ;;
+    solaris)
+        echo "$name_should" | __file /etc/nodename --source -
+    ;;
     suse)
         # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
         # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.

From a885082534dedb56a78f2b2ee7c3ff7a20348b59 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 16 Nov 2019 14:58:30 +0100
Subject: [PATCH 190/383] [__hostname] Little bit of clean up

---
 cdist/conf/type/__hostname/manifest | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 6b26cada..f2f65155 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -52,7 +52,7 @@ else
     esac
 fi
 
-if test -n "${max_len}" && test "$(printf '%s' "${name_should}" | wc -c)" -gt "${max_len}"
+if test -n "$max_len" && test "$(printf '%s' "$name_should" | wc -c)" -gt "$max_len"
 then
     printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2
     exit 1
@@ -93,10 +93,10 @@ in
         fi
     ;;
     gentoo)
+        # Only write to /etc/conf.d/hostname on OpenRC-based installations.
+        # On systemd use hostnamectl(1) in gencode-remote.
         if test -z "$has_hostnamectl"
         then
-            # Only write to /etc/conf.d/hostname on OpenRC-based installations.
-            # On systemd use hostnamectl(1) in gencode-remote.
             __key_value '/etc/conf.d/hostname:hostname' \
                 --file /etc/conf.d/hostname \
                 --delimiter '=' --exact_delimiter \

From f18bdd1fade8b2caea80bdeb4d0c099f421a3d18 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sat, 16 Nov 2019 23:31:58 +0100
Subject: [PATCH 191/383] [__hostname] Comment out support for ancient
 ArchLinux versions

---
 cdist/conf/type/__hostname/manifest | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index f2f65155..7e36cb53 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -68,14 +68,17 @@ in
         then
             set_hostname_systemd "$name_should"
         else
+            echo 'Ancient ArchLinux variants without hostnamectl are not supported.' >&2
+            exit 1
             # Only for ancient ArchLinux, write to /etc/rc.conf on pre-systemd
             # versions.  There are some versions which use /etc/hostname but not
-			# systemd. It is unclear which ones these are.
-            __key_value '/etc/rc.conf:HOSTNAME' \
-                --file /etc/rc.conf \
-                --delimiter '=' --exact_delimiter \
-                --key 'HOSTNAME' \
-                --value "\"$name_should\""
+            # systemd. It is unclear which ones these are.
+
+            # __key_value '/etc/rc.conf:HOSTNAME' \
+            #     --file /etc/rc.conf \
+            #     --delimiter '=' --exact_delimiter \
+            #     --key 'HOSTNAME' \
+            #     --value "\"$name_should\""
         fi
         ;;
     centos|fedora|redhat|scientific)

From a45e30612301a93e1156f97309c9b0f090c4a4ce Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 17 Nov 2019 14:46:37 +0100
Subject: [PATCH 192/383] [__hostname] Better support different versions of
 SuSE

---
 cdist/conf/type/__hostname/gencode-remote | 16 +++++---
 cdist/conf/type/__hostname/manifest       | 50 ++++++++++++++++++-----
 2 files changed, 50 insertions(+), 16 deletions(-)

diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index f06ee145..ae224611 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -66,7 +66,7 @@ in
             "&& hostnamectl set-hostname '$name_should'" \
             "|| hostname '$name_should'"
     ;;
-    centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|gentoo|slackware|void)
+    centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|gentoo|void)
         echo "hostname '$name_should'"
     ;;
     macosx)
@@ -75,8 +75,11 @@ in
     solaris)
         echo "uname -S '$name_should'"
     ;;
-    suse)
-        echo 'hostname -F /etc/HOSTNAME'
+    slackware|suse|opensuse-leap)
+        # We do not read from /etc/HOSTNAME, because the running
+        # hostname is the first component only while the file contains
+        # the FQDN.
+        echo "hostname '$name_should'"
     ;;
     *)
         # Fall back to set the hostname using hostnamectl, if available.
@@ -84,11 +87,12 @@ in
         then
             # Don't use hostnamectl as the primary means to set the hostname for
             # systemd systems, because it cannot be trusted to work reliably and
-            # exit with non-zero when it fails.
-            # Who invented a tool that needs dbus to set the hostname anyway…
+            # exit with non-zero when it fails (e.g. hostname too long,
+            # D-Bus failure, etc.).
 
             echo "hostnamectl set-hostname \"\$(cat /etc/hostname)\""
-            echo "test \"\$(hostname)\" = \"\$(cat /etc/hostname)\" || hostname -F /etc/hostname"
+            echo "test \"\$(hostname)\" = \"\$(cat /etc/hostname)\"" \
+                 " || hostname -F /etc/hostname"
         else
             printf "echo 'Unsupported OS: %s' >&2\nexit 1\n" "$os"
         fi
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 7e36cb53..75a90027 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -31,6 +31,9 @@ set_hostname_systemd() {
 }
 
 os=$(cat "$__global/explorer/os")
+os_version=$(cat "$__global/explorer/os_version")
+os_major=$(echo "$os_version" | grep -o '^[0-9][0-9]*')
+
 max_len=$(cat "$__object/explorer/max_len")
 has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
 
@@ -45,8 +48,21 @@ else
             # Hostname is FQDN
             name_should="${__target_host}"
         ;;
+        suse|opensuse-leap)
+            # Classic SuSE stores the FQDN in /etc/HOSTNAME, while
+            # systemd does not. The running hostname is the first
+            # component in both cases.
+            # In versions before 15.x, the FQDN is stored in /etc/hostname.
+            if test -n "$has_hostnamectl" && test "$os_major" -ge 15 \
+                    && test "$os_major" -ne 42
+            then
+                name_should="${__target_host%%.*}"
+            else
+                name_should="${__target_host}"
+            fi
+        ;;
         *)
-            # Hostname is only first component of FQDN
+            # Hostname is only first component of FQDN on all other systems.
             name_should="${__target_host%%.*}"
         ;;
     esac
@@ -127,28 +143,42 @@ in
             --key 'hostname' \
             --value "\"$name_should\""
 
-        # To avoid confusion, ensure that the hostname is only stored once
+        # To avoid confusion, ensure that the hostname is only stored once.
         __file /etc/myname --state absent
     ;;
     openbsd)
         echo "$name_should" | __file /etc/myname --source -
     ;;
     slackware)
-        # We write the FQDN into /etc/HOSTNAME.
-        # But /etc/rc.d/rc.M will only read the first component from this file
-        # and set it as the running hostname on boot.
+        # We write the FQDN into /etc/HOSTNAME.  But /etc/rc.d/rc.M will only
+        # read the first component from this file and set it as the running
+        # hostname on boot.
         echo "$name_should" | __file /etc/HOSTNAME --source -
     ;;
     solaris)
         echo "$name_should" | __file /etc/nodename --source -
     ;;
-    suse)
-        # We write into /etc/HOSTNAME for backwards-compatibility.  Modern SuSE
-        # has hostnamectl anyway and symlinks /etc/HOSTNAME to /etc/hostname.
-        echo "$name_should" | __file /etc/HOSTNAME --source -
+    suse|opensuse-leap)
+        # Modern SuSE provides /etc/HOSTNAME as a symlink for
+        # backwards-compatibility. Unfortunately it cannot be used
+        # here as __file does not follow the symlink.
+        # Therefore, we use the presence of the hostnamectl binary as
+        # an indication of which file to use.  This unfortunately does
+        # not work correctly on openSUSE 12.x which provides
+        # hostnamectl but not /etc/hostname.
+
+        if test -n "$has_hostnamectl" -a "$os_major" -gt 12
+        then
+            hostname_file='/etc/hostname'
+        else
+            hostname_file='/etc/HOSTNAME'
+        fi
+
+        echo "$name_should" | __file "$hostname_file" --source -
     ;;
     *)
-        # On other operating systems we fall back to systemd's hostnamectl if available…
+        # On other operating systems we fall back to systemd's
+        # hostnamectl if available…
         if test -n "$has_hostnamectl"
         then
             set_hostname_systemd "$name_should"

From c1633d9301c053b604cceb39b57621636e80b9cd Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 19 Nov 2019 21:29:45 +0100
Subject: [PATCH 193/383] Release 6.0.4

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 1c56ec74..b0a52eb6 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.0.4: 2019-11-19
 	* Doc: Fix typos (Kirill Miazine)
 
 6.0.3: 2019-10-31

From 6c67d7194af8166882da6169e681ca5a7836d534 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 19 Nov 2019 21:53:40 +0100
Subject: [PATCH 194/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index b0a52eb6..49416d6d 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Explorer hostname, type __hostname: Support more operating systems, rewrite type and hostname explorer (Dennis Camera)
+
 6.0.4: 2019-11-19
 	* Doc: Fix typos (Kirill Miazine)
 

From 0bc00477aeea206e80a1e1fb887024ca2e43d0ab Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 19 Nov 2019 21:54:56 +0100
Subject: [PATCH 195/383] Release 6.1.0

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 49416d6d..2342b0b0 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.1.0: 2019-11-19
 	* Explorer hostname, type __hostname: Support more operating systems, rewrite type and hostname explorer (Dennis Camera)
 
 6.0.4: 2019-11-19

From 34bd96db4b61c9c80e41d0a91ddb51ef9dbb08c3 Mon Sep 17 00:00:00 2001
From: Thomas Eckert <tom@it-eckert.de>
Date: Wed, 20 Nov 2019 15:47:25 +0100
Subject: [PATCH 196/383] add `--msgcache`-parameter to support passive clients
 (__xymon_client)

Fix a typo along the way, too.
---
 cdist/conf/type/__xymon_client/man.rst           | 13 +++++++++++--
 cdist/conf/type/__xymon_client/manifest          |  9 +++++++--
 cdist/conf/type/__xymon_client/parameter/boolean |  1 +
 3 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 cdist/conf/type/__xymon_client/parameter/boolean

diff --git a/cdist/conf/type/__xymon_client/man.rst b/cdist/conf/type/__xymon_client/man.rst
index 6660b0ef..05d085dc 100644
--- a/cdist/conf/type/__xymon_client/man.rst
+++ b/cdist/conf/type/__xymon_client/man.rst
@@ -27,21 +27,30 @@ servers
    to. While DNS-names are ok it is discouraged, defaults to 127.0.0.1.
 
 
+BOOLEAN PARAMETERS
+------------------
+msgcache
+    Enable xymon `msgcache`. Note: XYMONSERVER has to be `127.0.0.1` for using
+    `msgcache` (see `msgcache (8)` of the xymon documentation for details).
+
 EXAMPLES
 --------
 
 .. code-block:: sh
 
-    # minmal, report to 127.0.0.1
+    # minimal, report to 127.0.0.1
     __xymon_client
 
     # specify server:
     __xymon_client --servers "192.168.1.1"
 
+    # activate `msgcache` for passive client:
+    __xymon_client --msgcache
+
 
 SEE ALSO
 --------
-:strong:`cdist__xymon_server`\ (7), :strong:`xymon`\ (7)
+:strong:`cdist__xymon_server`\ (7), :strong:`xymon`\ (7), :strong:`msgcache`\ (8)
 
 
 AUTHORS
diff --git a/cdist/conf/type/__xymon_client/manifest b/cdist/conf/type/__xymon_client/manifest
index 92ad079e..88293a12 100755
--- a/cdist/conf/type/__xymon_client/manifest
+++ b/cdist/conf/type/__xymon_client/manifest
@@ -34,13 +34,18 @@ esac
 
 __package xymon-client --state "$state"
 
+if [ -f "$__object/parameter/msgcache" ]; then
+	require="__package/xymon-client" __line /etc/xymon/clientlaunch.cfg \
+		--regex DISABLED --state absent
+fi
+
 require="__package/xymon-client" __key_value CLIENTHOSTNAME \
-       	--file /etc/default/xymon-client \
+	--file /etc/default/xymon-client \
 	--value "'$__target_hostname'" \
 	--delimiter '=' \
 	--state "$state"
 require="__package/xymon-client" __key_value XYMONSERVERS \
-       	--file /etc/default/xymon-client \
+	--file /etc/default/xymon-client \
 	--value "'$servers'" \
 	--delimiter '=' \
 	--state "$state"
diff --git a/cdist/conf/type/__xymon_client/parameter/boolean b/cdist/conf/type/__xymon_client/parameter/boolean
new file mode 100644
index 00000000..0dd7839d
--- /dev/null
+++ b/cdist/conf/type/__xymon_client/parameter/boolean
@@ -0,0 +1 @@
+msgcache

From 552860b9cd801af0dc3cd63969f935dca1e54491 Mon Sep 17 00:00:00 2001
From: Thomas Eckert <tom@it-eckert.de>
Date: Wed, 20 Nov 2019 15:49:25 +0100
Subject: [PATCH 197/383] add parameters for ownership and generic
 rsync-options (__xymon_config)

---
 cdist/conf/type/__xymon_config/man.rst        | 23 ++++++++++++++++++-
 cdist/conf/type/__xymon_config/manifest       | 21 ++++++++++++++++-
 .../type/__xymon_config/parameter/optional    |  2 ++
 .../parameter/optional_multiple               |  1 +
 4 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 cdist/conf/type/__xymon_config/parameter/optional
 create mode 100644 cdist/conf/type/__xymon_config/parameter/optional_multiple

diff --git a/cdist/conf/type/__xymon_config/man.rst b/cdist/conf/type/__xymon_config/man.rst
index 8b427ca0..8adfbe1f 100644
--- a/cdist/conf/type/__xymon_config/man.rst
+++ b/cdist/conf/type/__xymon_config/man.rst
@@ -23,6 +23,21 @@ confdir
    deployed.
 
 
+OPTIONAL PARAMETERS
+-------------------
+owner
+   passed as-is as `--owner` to `__rsync`
+
+group
+   passed as-is as `--group` to `__rsync`
+
+
+OPTIONAL MULTIPLE PARAMETERS
+----------------------------
+rsync-opts
+   identical to __rsync type, only `--`-options are supported
+
+
 REQUIRED FILES
 --------------
 The directory specified by `confdir` has to contain a valid xymon-configuration
@@ -39,10 +54,16 @@ EXAMPLES
     # this will replace /etc/xymon/ on the target host with
     # the contents from __xymon_config/files/xymon.example.com/
 
+    ## the same but set ownership to `xymon:xymon` and exclude
+    ## the `netrc`-file:
+    __xymon_config --confdir=xymon.example.com \
+       --owner xymon --group xymon \
+       --rsync-opts "exclude=netrc"
+
 
 SEE ALSO
 --------
-:strong:`cdist__xymon_server`\ (7), :strong:`xymon`\ (7)
+:strong:`cdist__xymon_server`\ (7), :strong:`cdist__rsync`\ (7), :strong:`xymon`\ (7)
 
 AUTHORS
 -------
diff --git a/cdist/conf/type/__xymon_config/manifest b/cdist/conf/type/__xymon_config/manifest
index fb1bce54..4a5fb6c9 100644
--- a/cdist/conf/type/__xymon_config/manifest
+++ b/cdist/conf/type/__xymon_config/manifest
@@ -18,7 +18,26 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 
 confdir=$(cat "$__object/parameter/confdir")
+set --
+if [ -f "$__object/parameter/owner" ]; then
+	owner=$(cat "$__object/parameter/owner")
+	set -- "$@" "--owner $owner"
+fi
+if [ -f "$__object/parameter/group" ]; then
+	group=$(cat "$__object/parameter/group")
+	set -- "$@" "--group $group"
+fi
 
+## pass `--rsync-opts` as-is to `__rsync`:
+if [ -f "$__object/parameter/rsync-opts" ]; then
+	while read -r opts; do
+		# shellcheck disable=SC2089
+		set -- "$@" "--rsync-opts '$opts'"
+	done < "$__object/parameter/rsync-opts"
+fi
+
+# shellcheck disable=SC2068,SC2090
 __rsync /etc/xymon/ \
 	--source "$__type/files/$confdir/" \
-	--rsync-opts "delete"
+	--rsync-opts "delete" \
+	$@
diff --git a/cdist/conf/type/__xymon_config/parameter/optional b/cdist/conf/type/__xymon_config/parameter/optional
new file mode 100644
index 00000000..866b4bde
--- /dev/null
+++ b/cdist/conf/type/__xymon_config/parameter/optional
@@ -0,0 +1,2 @@
+owner
+group
diff --git a/cdist/conf/type/__xymon_config/parameter/optional_multiple b/cdist/conf/type/__xymon_config/parameter/optional_multiple
new file mode 100644
index 00000000..fdb7cd88
--- /dev/null
+++ b/cdist/conf/type/__xymon_config/parameter/optional_multiple
@@ -0,0 +1 @@
+rsync-opts

From ac2463fe31fcf74da47e6a159c67e041f7dc617e Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 20 Nov 2019 20:58:42 +0100
Subject: [PATCH 198/383] ++changelog

---
 docs/changelog | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 2342b0b0..dc317ac9 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,10 @@
 Changelog
 ---------
 
+next:
+	* Type __xymon_config: Add parameters for ownership and generic rsync options (Thomas Eckert)
+	* Type __xymon_client: Add msgcache parameter to support passive clients (Thomas Eckert)
+
 6.1.0: 2019-11-19
 	* Explorer hostname, type __hostname: Support more operating systems, rewrite type and hostname explorer (Dennis Camera)
 

From 01bd01573e6cb6fb3ba5d279e10bf58ab2cab929 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Thu, 21 Nov 2019 14:15:51 +0200
Subject: [PATCH 199/383] __apt_key: use mktemp for unique temporary gpg home

---
 cdist/conf/type/__apt_key/gencode-remote | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/cdist/conf/type/__apt_key/gencode-remote b/cdist/conf/type/__apt_key/gencode-remote
index e9daa524..0c96ff67 100755
--- a/cdist/conf/type/__apt_key/gencode-remote
+++ b/cdist/conf/type/__apt_key/gencode-remote
@@ -61,31 +61,29 @@ EOF
             echo "curl -s -L '$uri' | apt-key add -"
          fi
       elif [ -d "$keydir" ]; then
-         tmp='/tmp/cdist_apt_key_tmp'
-
          # we need to kill gpg after 30 seconds, because gpg
          # can get stuck if keyserver is not responding.
          # exporting env var and not exit 1,
          # because we need to clean up and kill dirmngr.
          cat << EOF
 
-mkdir -m 700 -p "$tmp"
+gpgtmphome="\$( mktemp -d )"
 
 if timeout 30s \\
-    gpg --homedir "$tmp" \\
+    gpg --homedir "\$gpgtmphome" \\
         --keyserver "$keyserver" \\
         --recv-keys "$keyid"
 then
-    gpg --homedir "$tmp" \\
+    gpg --homedir "\$gpgtmphome" \\
         --export "$keyid" \\
         > "$keyfile"
 else
     export GPG_GOT_STUCK=1
 fi
 
-GNUPGHOME="$tmp" gpgconf --kill dirmngr
+GNUPGHOME="\$gpgtmphome" gpgconf --kill dirmngr
 
-rm -rf "$tmp"
+rm -rf "\$gpgtmphome"
 
 if [ -n "\$GPG_GOT_STUCK" ]
 then

From b8c6f8c8f504c52062561b18921346733cce7dca Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 21 Nov 2019 17:01:27 +0100
Subject: [PATCH 200/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index dc317ac9..71509004 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* Type __xymon_config: Add parameters for ownership and generic rsync options (Thomas Eckert)
 	* Type __xymon_client: Add msgcache parameter to support passive clients (Thomas Eckert)
+	* Type __apt_key: Use mktemp for unique temporary gpg home (Ander Punnar)
 
 6.1.0: 2019-11-19
 	* Explorer hostname, type __hostname: Support more operating systems, rewrite type and hostname explorer (Dennis Camera)

From 4ed18e3446a6eae022ac099a34ef4f25401874ae Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 22 Nov 2019 18:56:11 +0200
Subject: [PATCH 201/383] __hostname: silence grep exit 1, when os_version is
 not numeric

on Debian Sid os_version returns 'bullseye/sid'
---
 cdist/conf/type/__hostname/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 75a90027..e1e356a0 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -32,7 +32,7 @@ set_hostname_systemd() {
 
 os=$(cat "$__global/explorer/os")
 os_version=$(cat "$__global/explorer/os_version")
-os_major=$(echo "$os_version" | grep -o '^[0-9][0-9]*')
+os_major=$(echo "$os_version" | grep -o '^[0-9][0-9]*' || true)
 
 max_len=$(cat "$__object/explorer/max_len")
 has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")

From b876ebb16e2500b00a2ab73ff909b8067e8d055a Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 22 Nov 2019 19:59:52 +0100
Subject: [PATCH 202/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 71509004..d287a2af 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Type __xymon_config: Add parameters for ownership and generic rsync options (Thomas Eckert)
 	* Type __xymon_client: Add msgcache parameter to support passive clients (Thomas Eckert)
 	* Type __apt_key: Use mktemp for unique temporary gpg home (Ander Punnar)
+	* Type __hostname: Silence grep exit 1 when os_version is not numeric (Ander Punnar)
 
 6.1.0: 2019-11-19
 	* Explorer hostname, type __hostname: Support more operating systems, rewrite type and hostname explorer (Dennis Camera)

From 64b07af4ab21483ebe6b03adb4d3f12c26544135 Mon Sep 17 00:00:00 2001
From: Daniel Tschada <daniel.tschada@ungleich.ch>
Date: Sun, 24 Nov 2019 17:18:34 +0100
Subject: [PATCH 203/383] give error msg to stderr

---
 cdist/conf/type/__ufw/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__ufw/manifest b/cdist/conf/type/__ufw/manifest
index 54309ff5..370b7ff5 100755
--- a/cdist/conf/type/__ufw/manifest
+++ b/cdist/conf/type/__ufw/manifest
@@ -31,7 +31,7 @@ case "$state" in
                     __package epel-release
                     require='__package/epel-release' __package ufw
                 else
-                    echo 'CentOS version 7 is required!'
+                    echo 'CentOS version 7 is required!' >&2
                     exit 1
                 fi
                 ;;

From 56435492a0e8a66c7437d93823e88f058d48f307 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 24 Nov 2019 17:18:02 +0100
Subject: [PATCH 204/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index d287a2af..82941895 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -6,6 +6,7 @@ next:
 	* Type __xymon_client: Add msgcache parameter to support passive clients (Thomas Eckert)
 	* Type __apt_key: Use mktemp for unique temporary gpg home (Ander Punnar)
 	* Type __hostname: Silence grep exit 1 when os_version is not numeric (Ander Punnar)
+	* Type __ufw: Print error message to stderr (Daniel Tschada)
 
 6.1.0: 2019-11-19
 	* Explorer hostname, type __hostname: Support more operating systems, rewrite type and hostname explorer (Dennis Camera)

From 2848a6a0f4e31e5e2fe19ab1340785b0cc332baa Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Mon, 25 Nov 2019 21:52:00 +0200
Subject: [PATCH 205/383] __clean_path: use __directory and __file types for
 better clarity

---
 cdist/conf/type/__clean_path/explorer/list  |  6 ++--
 cdist/conf/type/__clean_path/gencode-remote | 26 +---------------
 cdist/conf/type/__clean_path/manifest       | 33 +++++++++++++++++++++
 3 files changed, 38 insertions(+), 27 deletions(-)
 create mode 100755 cdist/conf/type/__clean_path/manifest

diff --git a/cdist/conf/type/__clean_path/explorer/list b/cdist/conf/type/__clean_path/explorer/list
index 07d38127..58d0b411 100755
--- a/cdist/conf/type/__clean_path/explorer/list
+++ b/cdist/conf/type/__clean_path/explorer/list
@@ -29,7 +29,9 @@ then
     exclude="$( cat "$__object/parameter/exclude" )"
 
     find "$path" -mindepth 1 -maxdepth 1 -regex "$pattern" \
-        -and -not -regex "$exclude"
+        -and -not -regex "$exclude" \
+        \( -type d -printf '%p/\n' , -type f -print \)
 else
-    find "$path" -mindepth 1 -maxdepth 1 -regex "$pattern"
+    find "$path" -mindepth 1 -maxdepth 1 -regex "$pattern" \
+        \( -type d -printf '%p/\n' , -type f -print \)
 fi
diff --git a/cdist/conf/type/__clean_path/gencode-remote b/cdist/conf/type/__clean_path/gencode-remote
index 998a70d8..0157733f 100755
--- a/cdist/conf/type/__clean_path/gencode-remote
+++ b/cdist/conf/type/__clean_path/gencode-remote
@@ -18,31 +18,7 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-[ ! -s "$__object/explorer/list" ] && exit 0
-
-path="/$__object_id"
-
-pattern="$( cat "$__object/parameter/pattern" )"
-
-if [ -f "$__object/parameter/exclude" ]
-then
-    exclude="$( cat "$__object/parameter/exclude" )"
-
-    echo "find '$path' -mindepth 1 -maxdepth 1 -regex '$pattern'" \
-        "-and -not -regex '$exclude'" \
-        '-exec rm -rf {} \;'
-else
-    echo "find '$path' -mindepth 1 -maxdepth 1 -regex '$pattern'" \
-        '-exec rm -rf {} \;'
-fi
-
-while read -r f
-do
-    echo "removed '$f'" >> "$__messages_out"
-done \
-< "$__object/explorer/list"
-
-if [ -f "$__object/parameter/onchange" ]
+if [ -f "$__object/explorer/list" ] && [ -f "$__object/parameter/onchange" ]
 then
     cat "$__object/parameter/onchange"
 fi
diff --git a/cdist/conf/type/__clean_path/manifest b/cdist/conf/type/__clean_path/manifest
new file mode 100755
index 00000000..065ecb36
--- /dev/null
+++ b/cdist/conf/type/__clean_path/manifest
@@ -0,0 +1,33 @@
+#!/bin/sh -e
+#
+# 2019 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+[ ! -f "$__object/explorer/list" ] && exit 0
+
+for l in $( cat "$__object/explorer/list" )
+do
+    if echo "$l" | grep -Eq '/$'
+    then
+        __directory "$l" --state absent
+        echo "removed directory '$l'" >> "$__messages_out"
+    else
+        __file "$l" --state absent
+        echo "removed file '$l'" >> "$__messages_out"
+    fi
+done

From e44219903a11954f0078782bd234d2913633032e Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 25 Nov 2019 21:01:20 +0100
Subject: [PATCH 206/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 82941895..d70cd72c 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,6 +7,7 @@ next:
 	* Type __apt_key: Use mktemp for unique temporary gpg home (Ander Punnar)
 	* Type __hostname: Silence grep exit 1 when os_version is not numeric (Ander Punnar)
 	* Type __ufw: Print error message to stderr (Daniel Tschada)
+	* Type __clean_path: Use __directory and __file types for better clarity (Ander Punnar)
 
 6.1.0: 2019-11-19
 	* Explorer hostname, type __hostname: Support more operating systems, rewrite type and hostname explorer (Dennis Camera)

From 8236de763f1194c8ca80f44f1bc4d607d3dbb754 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 26 Nov 2019 17:57:19 +0100
Subject: [PATCH 207/383] Revert "++changelog"

This reverts commit e44219903a11954f0078782bd234d2913633032e.
---
 docs/changelog | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index d70cd72c..82941895 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,7 +7,6 @@ next:
 	* Type __apt_key: Use mktemp for unique temporary gpg home (Ander Punnar)
 	* Type __hostname: Silence grep exit 1 when os_version is not numeric (Ander Punnar)
 	* Type __ufw: Print error message to stderr (Daniel Tschada)
-	* Type __clean_path: Use __directory and __file types for better clarity (Ander Punnar)
 
 6.1.0: 2019-11-19
 	* Explorer hostname, type __hostname: Support more operating systems, rewrite type and hostname explorer (Dennis Camera)

From d1c3264cce6716f4950bef832c57923994457c31 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 26 Nov 2019 17:58:25 +0100
Subject: [PATCH 208/383] Revert "Merge branch '__clean_path_use_types' into
 'master'"

This reverts commit 073523be38742578a1bb47e030869a8f141517d3, reversing
changes made to 56435492a0e8a66c7437d93823e88f058d48f307.
---
 cdist/conf/type/__clean_path/explorer/list  |  6 ++--
 cdist/conf/type/__clean_path/gencode-remote | 26 +++++++++++++++-
 cdist/conf/type/__clean_path/manifest       | 33 ---------------------
 3 files changed, 27 insertions(+), 38 deletions(-)
 delete mode 100755 cdist/conf/type/__clean_path/manifest

diff --git a/cdist/conf/type/__clean_path/explorer/list b/cdist/conf/type/__clean_path/explorer/list
index 58d0b411..07d38127 100755
--- a/cdist/conf/type/__clean_path/explorer/list
+++ b/cdist/conf/type/__clean_path/explorer/list
@@ -29,9 +29,7 @@ then
     exclude="$( cat "$__object/parameter/exclude" )"
 
     find "$path" -mindepth 1 -maxdepth 1 -regex "$pattern" \
-        -and -not -regex "$exclude" \
-        \( -type d -printf '%p/\n' , -type f -print \)
+        -and -not -regex "$exclude"
 else
-    find "$path" -mindepth 1 -maxdepth 1 -regex "$pattern" \
-        \( -type d -printf '%p/\n' , -type f -print \)
+    find "$path" -mindepth 1 -maxdepth 1 -regex "$pattern"
 fi
diff --git a/cdist/conf/type/__clean_path/gencode-remote b/cdist/conf/type/__clean_path/gencode-remote
index 0157733f..998a70d8 100755
--- a/cdist/conf/type/__clean_path/gencode-remote
+++ b/cdist/conf/type/__clean_path/gencode-remote
@@ -18,7 +18,31 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-if [ -f "$__object/explorer/list" ] && [ -f "$__object/parameter/onchange" ]
+[ ! -s "$__object/explorer/list" ] && exit 0
+
+path="/$__object_id"
+
+pattern="$( cat "$__object/parameter/pattern" )"
+
+if [ -f "$__object/parameter/exclude" ]
+then
+    exclude="$( cat "$__object/parameter/exclude" )"
+
+    echo "find '$path' -mindepth 1 -maxdepth 1 -regex '$pattern'" \
+        "-and -not -regex '$exclude'" \
+        '-exec rm -rf {} \;'
+else
+    echo "find '$path' -mindepth 1 -maxdepth 1 -regex '$pattern'" \
+        '-exec rm -rf {} \;'
+fi
+
+while read -r f
+do
+    echo "removed '$f'" >> "$__messages_out"
+done \
+< "$__object/explorer/list"
+
+if [ -f "$__object/parameter/onchange" ]
 then
     cat "$__object/parameter/onchange"
 fi
diff --git a/cdist/conf/type/__clean_path/manifest b/cdist/conf/type/__clean_path/manifest
deleted file mode 100755
index 065ecb36..00000000
--- a/cdist/conf/type/__clean_path/manifest
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/sh -e
-#
-# 2019 Ander Punnar (ander-at-kvlt-dot-ee)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-
-[ ! -f "$__object/explorer/list" ] && exit 0
-
-for l in $( cat "$__object/explorer/list" )
-do
-    if echo "$l" | grep -Eq '/$'
-    then
-        __directory "$l" --state absent
-        echo "removed directory '$l'" >> "$__messages_out"
-    else
-        __file "$l" --state absent
-        echo "removed file '$l'" >> "$__messages_out"
-    fi
-done

From 3b5aa8654d2b6912bc26b98ffdecaaf5d4979d70 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 26 Nov 2019 19:24:15 +0100
Subject: [PATCH 209/383] Release 6.1.1

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 82941895..f6e9357c 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.1.1: 2019-11-26
 	* Type __xymon_config: Add parameters for ownership and generic rsync options (Thomas Eckert)
 	* Type __xymon_client: Add msgcache parameter to support passive clients (Thomas Eckert)
 	* Type __apt_key: Use mktemp for unique temporary gpg home (Ander Punnar)

From c01aa576de4e7fe9920ea7b116a5376145e6d433 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 27 Nov 2019 14:51:28 +0100
Subject: [PATCH 210/383] Add/keep empty directories

---
 cdist/test/cdist_type/fixtures/__not_deprecated/.keep             | 0
 .../cdist_type/fixtures/__without_deprecated_parameters/.keep     | 0
 cdist/test/inventory/fixtures/.keep                               | 0
 3 files changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 cdist/test/cdist_type/fixtures/__not_deprecated/.keep
 create mode 100644 cdist/test/cdist_type/fixtures/__without_deprecated_parameters/.keep
 create mode 100644 cdist/test/inventory/fixtures/.keep

diff --git a/cdist/test/cdist_type/fixtures/__not_deprecated/.keep b/cdist/test/cdist_type/fixtures/__not_deprecated/.keep
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/test/cdist_type/fixtures/__without_deprecated_parameters/.keep b/cdist/test/cdist_type/fixtures/__without_deprecated_parameters/.keep
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/test/inventory/fixtures/.keep b/cdist/test/inventory/fixtures/.keep
new file mode 100644
index 00000000..e69de29b

From 3d3b59ab87e72bf407e4c7f8880f19fc0e009f25 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 27 Nov 2019 14:59:25 +0100
Subject: [PATCH 211/383] Add pycodestyle ignores

---
 bin/build-helper  | 2 +-
 cdist/config.py   | 2 +-
 cdist/emulator.py | 2 +-
 setup.py          | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/bin/build-helper b/bin/build-helper
index 9a776491..7cfc4d55 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -405,7 +405,7 @@ eof
     ;;
 
     pycodestyle|pep8)
-        pycodestyle "${basedir}" "${basedir}/scripts/cdist" | less
+        pycodestyle "${basedir}" "${basedir}/scripts/cdist"
     ;;
 
     check-pycodestyle)
diff --git a/cdist/config.py b/cdist/config.py
index 26d07fc4..6c30db2e 100644
--- a/cdist/config.py
+++ b/cdist/config.py
@@ -368,7 +368,7 @@ class Config(object):
     def resolve_target_addresses(host, family):
         try:
             return ipaddr.resolve_target_addresses(host, family)
-        except:
+        except:  # noqa
             e = sys.exc_info()[1]
             raise cdist.Error(("Error resolving target addresses for host '{}'"
                                ": {}").format(host, e))
diff --git a/cdist/emulator.py b/cdist/emulator.py
index 3cf82f84..417f2cdd 100644
--- a/cdist/emulator.py
+++ b/cdist/emulator.py
@@ -44,7 +44,7 @@ class MissingRequiredEnvironmentVariableError(cdist.Error):
 class DefaultList(list):
     """Helper class to allow default values for optional_multiple parameters.
 
-       @see https://groups.google.com/forum/#!msg/comp.lang.python/sAUvkJEDpRc/RnRymrzJVDYJ
+       @see https://groups.google.com/forum/#!msg/comp.lang.python/sAUvkJEDpRc/RnRymrzJVDYJ  # noqa
     """
     def __copy__(self):
         return []
diff --git a/setup.py b/setup.py
index 2bb1e16d..7b000041 100644
--- a/setup.py
+++ b/setup.py
@@ -21,7 +21,7 @@ else:
         raise DistutilsError("Missing version file {}".format(version_file))
 
 
-import cdist
+import cdist  # noqa
 
 
 def data_finder(data_dir):
@@ -66,7 +66,7 @@ setup(
         "Development Status :: 6 - Mature",
         "Environment :: Console",
         "Intended Audience :: System Administrators",
-        "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
+        "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",  # noqa
         "Operating System :: MacOS :: MacOS X",
         "Operating System :: POSIX",
         "Operating System :: POSIX :: BSD",

From f3bd439c43ca7fd6a3f2d5f2f58d4df141780935 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 27 Nov 2019 14:22:13 +0100
Subject: [PATCH 212/383] Add gitlab CI

---
 .gitlab-ci.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .gitlab-ci.yml

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 00000000..44de6b0b
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,28 @@
+stages:
+    - test
+
+unit_tests:
+    stage: test
+    before_script:
+        - 'apk update'
+        - 'apk add python3'
+    script:
+        - ./bin/build-helper version
+        - ./bin/build-helper test
+
+pycodestyle:
+    stage: test
+    before_script:
+        - 'apk update'
+        - 'apk add python3 py3-pycodestyle'
+        - 'ln -f -s /usr/bin/pycodestyle-3 /usr/bin/pycodestyle'
+    script:
+        - ./bin/build-helper pycodestyle
+
+shellcheck:
+    stage: test
+    before_script:
+        - 'wget https://storage.googleapis.com/shellcheck/shellcheck-stable.linux.x86_64.tar.xz'
+        - 'tar xf shellcheck-stable.linux.x86_64.tar.xz && mv shellcheck-stable/shellcheck /usr/bin/'
+    script:
+        - ./bin/build-helper shellcheck

From da274e5ef3e8c1eb47bb9fde003248711439fc8d Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 23 Nov 2019 00:25:51 +0100
Subject: [PATCH 213/383] Redefine/reimplement CDIST_ORDER_DEPENDENCY

CDIST_ORDER_DEPENDENCY now defines type order dependency context.
cdist (emulator) maintains global state variables, as files,
order_dep_state and typeorder_dep, and per object state variable,
as file, typeorder_dep.

If order_dep_state exists then this defines that order dependency is
turned on.
If order_dep_state does not exist then order dependency is turned off.

If order dependency is on then objects created after it is turned on are
recorded into:
    * global typeorder_dep, in case of init manifest
    * object's typeorder_dep, in case of type's manifest.

If order dependency is on then requirement is injected, where object
created before current, is read from:
    * global typeorder_dep, in case of init manifest
    * object's typeorder_dep, in case of type's manifest.

Every time order dependency is turned off, typeorder_dep files are
removed, which means that type order list is cleared, context is
cleaned.

In the end cdist cleans after itself, i.e. mentioned files are removed.

When running type manifest is finished typeorder_dep file is removed.
When running config finishes global typeorder_dep and order_dep_state
files are removed.

Global type order recording is untouched.
Furthermore, for completeness, type order is now recorded for each object
too.
---
 cdist/config.py                 |   4 ++
 cdist/core/cdist_object.py      |  10 +++
 cdist/core/manifest.py          |  14 ++++
 cdist/emulator.py               | 124 +++++++++++++++++++++++---------
 cdist/test/emulator/__init__.py |  43 +++++++++--
 5 files changed, 157 insertions(+), 38 deletions(-)

diff --git a/cdist/config.py b/cdist/config.py
index 6c30db2e..97cc1da6 100644
--- a/cdist/config.py
+++ b/cdist/config.py
@@ -124,6 +124,7 @@ class Config(object):
         """Remove files and directories for the run"""
         if self.remove_remote_files_dirs:
             self._remove_remote_files_dirs()
+        self.manifest.cleanup()
 
     @staticmethod
     def hosts(source):
@@ -787,6 +788,9 @@ class Config(object):
         self.explorer.run_type_explorers(cdist_object, transfer_type_explorers)
         try:
             self.manifest.run_type_manifest(cdist_object)
+            self.log.trace("[ORDER_DEP] Removing order dep files for %s",
+                           cdist_object)
+            cdist_object.cleanup()
             cdist_object.state = core.CdistObject.STATE_PREPARED
         except cdist.Error as e:
             raise cdist.CdistObjectError(cdist_object, e)
diff --git a/cdist/core/cdist_object.py b/cdist/core/cdist_object.py
index 237f0ddd..114a47e0 100644
--- a/cdist/core/cdist_object.py
+++ b/cdist/core/cdist_object.py
@@ -243,6 +243,16 @@ class CdistObject(object):
             lambda obj: os.path.join(obj.base_path, obj.code_local_path))
     code_remote = fsproperty.FileStringProperty(
             lambda obj: os.path.join(obj.base_path, obj.code_remote_path))
+    typeorder = fsproperty.FileListProperty(
+            lambda obj: os.path.join(obj.absolute_path, 'typeorder'))
+    typeorder_dep = fsproperty.FileListProperty(
+            lambda obj: os.path.join(obj.absolute_path, 'typeorder_dep'))
+
+    def cleanup(self):
+        try:
+            os.remove(os.path.join(self.absolute_path, 'typeorder_dep'))
+        except FileNotFoundError:
+            pass
 
     @property
     def exists(self):
diff --git a/cdist/core/manifest.py b/cdist/core/manifest.py
index 07af0ef8..8aeaf860 100644
--- a/cdist/core/manifest.py
+++ b/cdist/core/manifest.py
@@ -96,6 +96,10 @@ class Manifest(object):
     """Executes cdist manifests.
 
     """
+
+    ORDER_DEP_STATE_NAME = 'order_dep_state'
+    TYPEORDER_DEP_NAME = 'typeorder_dep'
+
     def __init__(self, target_host, local, dry_run=False):
         self.target_host = target_host
         self.local = local
@@ -212,3 +216,13 @@ class Manifest(object):
                     type_manifest,
                     env=self.env_type_manifest(cdist_object),
                     message_prefix=message_prefix)
+
+    def cleanup(self):
+        def _rm_file(fname):
+            try:
+                self.log.trace("[ORDER_DEP] Removing %s", fname)
+                os.remove(os.path.join(self.local.base_path, fname))
+            except FileNotFoundError:
+                pass
+        _rm_file(Manifest.ORDER_DEP_STATE_NAME)
+        _rm_file(Manifest.TYPEORDER_DEP_NAME)
diff --git a/cdist/emulator.py b/cdist/emulator.py
index 417f2cdd..4800e2a3 100644
--- a/cdist/emulator.py
+++ b/cdist/emulator.py
@@ -29,6 +29,7 @@ import sys
 import cdist
 from cdist import core
 from cdist import flock
+from cdist.core.manifest import Manifest
 
 
 class MissingRequiredEnvironmentVariableError(cdist.Error):
@@ -82,6 +83,11 @@ class Emulator(object):
         self.object_base_path = os.path.join(self.global_path, "object")
         self.typeorder_path = os.path.join(self.global_path, "typeorder")
 
+        self.typeorder_dep_path = os.path.join(self.global_path,
+                                               Manifest.TYPEORDER_DEP_NAME)
+        self.order_dep_state_path = os.path.join(self.global_path,
+                                                 Manifest.ORDER_DEP_STATE_NAME)
+
         self.type_name = os.path.basename(argv[0])
         self.cdist_type = core.CdistType(self.type_base_path, self.type_name)
 
@@ -206,6 +212,14 @@ class Emulator(object):
         return params
 
     def setup_object(self):
+        # CDIST_ORDER_DEPENDENCY state
+        order_dep_on = self._order_dep_on()
+        order_dep_defined = "CDIST_ORDER_DEPENDENCY" in self.env
+        if not order_dep_defined and order_dep_on:
+            self._set_order_dep_state_off()
+        if order_dep_defined and not order_dep_on:
+            self._set_order_dep_state_on()
+
         # Create object with given parameters
         self.parameters = {}
         for key, value in vars(self.args).items():
@@ -237,6 +251,20 @@ class Emulator(object):
             # record the created object in typeorder file
             with open(self.typeorder_path, 'a') as typeorderfile:
                 print(self.cdist_object.name, file=typeorderfile)
+            # record the created object in parent object typeorder file
+            __object_name = self.env.get('__object_name', None)
+            depname = self.cdist_object.name
+            if __object_name:
+                parent = self.cdist_object.object_from_name(__object_name)
+                parent.typeorder.append(self.cdist_object.name)
+                if self._order_dep_on():
+                    self.log.trace(('[ORDER_DEP] Adding %s to typeorder dep'
+                                    ' for %s'), depname, parent.name)
+                    parent.typeorder_dep.append(depname)
+            elif self._order_dep_on():
+                self.log.trace('[ORDER_DEP] Adding %s to global typeorder dep',
+                               depname)
+                self._add_typeorder_dep(depname)
 
         # Record / Append source
         self.cdist_object.source.append(self.object_source)
@@ -293,45 +321,73 @@ class Emulator(object):
 
         return cdist_object.name
 
+    def _order_dep_on(self):
+        return os.path.exists(self.order_dep_state_path)
+
+    def _set_order_dep_state_on(self):
+        self.log.trace('[ORDER_DEP] Setting order dep state on')
+        with open(self.order_dep_state_path, 'w'):
+            pass
+
+    def _set_order_dep_state_off(self):
+        self.log.trace('[ORDER_DEP] Setting order dep state off')
+        # remove order dep state file
+        try:
+            os.remove(self.order_dep_state_path)
+        except FileNotFoundError:
+            pass
+        # remove typeorder dep file
+        try:
+            os.remove(self.typeorder_dep_path)
+        except FileNotFoundError:
+            pass
+
+    def _add_typeorder_dep(self, name):
+        with open(self.typeorder_dep_path, 'a') as f:
+            print(name, file=f)
+
+    def _read_typeorder_dep(self):
+        try:
+            with open(self.typeorder_dep_path, 'r') as f:
+                return f.readlines()
+        except FileNotFoundError:
+            return []
+
     def record_requirements(self):
         """Record requirements."""
 
+        order_dep_on = self._order_dep_on()
+
         # Inject the predecessor, but not if its an override
         # (this would leed to an circular dependency)
-        if ("CDIST_ORDER_DEPENDENCY" in self.env and
-                'CDIST_OVERRIDE' not in self.env):
-            # load object name created befor this one from typeorder file ...
-            with open(self.typeorder_path, 'r') as typecreationfile:
-                typecreationorder = typecreationfile.readlines()
-                # get the type created before this one ...
-                try:
-                    lastcreatedtype = typecreationorder[-2].strip()
-                    # __object_name is the name of the object whose type
-                    # manifest is currently executed
-                    __object_name = self.env.get('__object_name', None)
-                    if lastcreatedtype == __object_name:
-                        self.log.debug(("Not injecting require for "
-                                        "CDIST_ORDER_DEPENDENCY: %s for %s,"
-                                        " %s's type manifest is currently"
-                                        " being executed"),
-                                       lastcreatedtype,
-                                       self.cdist_object.name,
-                                       lastcreatedtype)
-                    else:
-                        if 'require' in self.env:
-                            appendix = " " + lastcreatedtype
-                            if appendix not in self.env['require']:
-                                self.env['require'] += appendix
-                        else:
-                            self.env['require'] = lastcreatedtype
-                        self.log.debug(("Injecting require for "
-                                        "CDIST_ORDER_DEPENDENCY: %s for %s"),
-                                       lastcreatedtype,
-                                       self.cdist_object.name)
-                except IndexError:
-                    # if no second last line, we are on the first type,
-                    # so do not set a requirement
-                    pass
+        if (order_dep_on and 'CDIST_OVERRIDE' not in self.env):
+            try:
+                # __object_name is the name of the object whose type
+                # manifest is currently executed
+                __object_name = self.env.get('__object_name', None)
+                # load object name created befor this one from typeorder
+                # dep file
+                if __object_name:
+                    parent = self.cdist_object.object_from_name(
+                        __object_name)
+                    typeorder = parent.typeorder_dep
+                else:
+                    typeorder = self._read_typeorder_dep()
+                # get the type created before this one
+                lastcreatedtype = typeorder[-2].strip()
+                if 'require' in self.env:
+                    if lastcreatedtype not in self.env['require']:
+                        self.env['require'] += " " + lastcreatedtype
+                else:
+                    self.env['require'] = lastcreatedtype
+                self.log.debug(("Injecting require for "
+                                "CDIST_ORDER_DEPENDENCY: %s for %s"),
+                               lastcreatedtype,
+                               self.cdist_object.name)
+            except IndexError:
+                # if no second last line, we are on the first type,
+                # so do not set a requirement
+                pass
 
         reqs = set()
         if "require" in self.env:
diff --git a/cdist/test/emulator/__init__.py b/cdist/test/emulator/__init__.py
index 5691093c..e375676c 100644
--- a/cdist/test/emulator/__init__.py
+++ b/cdist/test/emulator/__init__.py
@@ -24,8 +24,6 @@
 import io
 import os
 import shutil
-import string
-import filecmp
 import random
 import logging
 
@@ -34,7 +32,6 @@ from cdist import test
 from cdist.exec import local
 from cdist import emulator
 from cdist import core
-from cdist import config
 
 import os.path as op
 my_dir = op.abspath(op.dirname(__file__))
@@ -115,7 +112,7 @@ class EmulatorTestCase(test.CdistTestCase):
     def test_requirement_pattern(self):
         argv = ['__file', '/tmp/foobar']
         self.env['require'] = '__file/etc/*'
-        emu = emulator.Emulator(argv, env=self.env)
+        emulator.Emulator(argv, env=self.env)
         # if we get here all is fine
 
     def test_loglevel(self):
@@ -172,6 +169,44 @@ class EmulatorTestCase(test.CdistTestCase):
         self.assertEqual(list(file_object.requirements), ['__planet/mars'])
         # if we get here all is fine
 
+    def test_order_dependency_context(self):
+        test_seq = ('A', True, 'B', 'C', 'D', False, 'E', 'F', True, 'G',
+                    'H', False, 'I', )
+        expected_requirements = {
+            'C': set(('__planet/B', )),
+            'D': set(('__planet/C', )),
+            'H': set(('__planet/G', )),
+        }
+        # Ensure env var is not in env
+        if 'CDIST_ORDER_DEPENDENCY' in self.env:
+            del self.env['CDIST_ORDER_DEPENDENCY']
+
+        for x in test_seq:
+            if isinstance(x, str):
+                # Clear because of order dep injection
+                # In real world, this is not shared over instances
+                if 'require' in self.env:
+                    del self.env['require']
+                argv = ['__planet', x]
+                emu = emulator.Emulator(argv, env=self.env)
+                emu.run()
+            elif isinstance(x, bool):
+                if x:
+                    self.env['CDIST_ORDER_DEPENDENCY'] = 'on'
+                elif 'CDIST_ORDER_DEPENDENCY' in self.env:
+                    del self.env['CDIST_ORDER_DEPENDENCY']
+        cdist_type = core.CdistType(self.local.type_path, '__planet')
+        for x in test_seq:
+            if isinstance(x, str):
+                obj = core.CdistObject(cdist_type, self.local.object_path,
+                                       self.local.object_marker_name, x)
+                reqs = set(obj.requirements)
+                if x in expected_requirements:
+                    self.assertEqual(reqs, expected_requirements[x])
+                else:
+                    self.assertTrue(len(reqs) == 0)
+        # if we get here all is fine
+
 
 class EmulatorConflictingRequirementsTestCase(test.CdistTestCase):
 

From 332f5dcff9b27e110c60bc94aa9c2f3c40f44121 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 23 Nov 2019 00:25:51 +0100
Subject: [PATCH 214/383] Redefine/reimplement CDIST_ORDER_DEPENDENCY

Update documentation.
---
 docs/src/cdist-best-practice.rst |  91 +----------------------
 docs/src/cdist-manifest.rst      | 121 ++++++++++++++++++++++++++++++-
 docs/src/cdist-reference.rst.sh  |   2 +-
 docs/src/man1/cdist.rst          |   2 +
 4 files changed, 126 insertions(+), 90 deletions(-)

diff --git a/docs/src/cdist-best-practice.rst b/docs/src/cdist-best-practice.rst
index a91f2cc0..39ec453e 100644
--- a/docs/src/cdist-best-practice.rst
+++ b/docs/src/cdist-best-practice.rst
@@ -226,8 +226,8 @@ and also to store all important files in one
 repository.
 
 
-Perils of CDIST_ORDER_DEPENDENCY
---------------------------------
+Notes on CDIST_ORDER_DEPENDENCY
+-------------------------------
 With CDIST_ORDER_DEPENDENCY all types are executed in the order in which they
 are created in the manifest. The current created object automatically depends
 on the previously created object.
@@ -235,96 +235,11 @@ on the previously created object.
 It essentially helps you to build up blocks of code that build upon each other
 (like first creating the directory xyz than the file below the directory).
 
-This can be helpful, but it can also be the source of *evil*.
-
-
-CDIST_ORDER_DEPENDENCY easily causes unobvious dependency cycles
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Let's see an example. Suppose you have special init manifest where among other
-things you are assuring that remote host has packages `sudo` and `curl`
-installed.
-
-**init1**
-
-.. code-block:: sh
-
-   CDIST_ORDER_DEPENDENCY=1
-   export CDIST_ORDER_DEPENDENCY
-
-   for p in sudo curl
-   do
-      __package "${p}"
-   done
-
-Then you have some other special init manifest where among other things you are
-assuring `sudo` package is installed.
-
-**init2**
-
-.. code-block:: sh
-
-   CDIST_ORDER_DEPENDENCY=1
-   export CDIST_ORDER_DEPENDENCY
-
-   __package sudo
-
-Then you have third init manifest where you combine those two init manifests,
-by including them:
-
-**init**
-
-.. code-block:: sh
-
-   sh -e "$__manifest/init1"
-   sh -e "$__manifest/init2"
-
-The resulting init manifest is then equal to:
-
-.. code-block:: sh
-
-   CDIST_ORDER_DEPENDENCY=1
-   export CDIST_ORDER_DEPENDENCY
-
-   for p in sudo curl
-   do
-      __package "${p}"
-   done
-
-   CDIST_ORDER_DEPENDENCY=1
-   export CDIST_ORDER_DEPENDENCY
-
-   __package sudo
-
-In the end you get the following dependencies:
-
-* `__package/curl` depends on `__package/sudo`
-* `__package/sudo` depends on `__package/curl`
-
-And here you have a circular dependency!
-
-In the real world manifest can be quite complex, dependencies can become
-complicated and circual dependencies are not so obvious. Resolving it can
-become cumbersome.
-
-**Practical solution?**
-
-Instead of managing complex init manifests you can write custom types.
-Each custom type can do one thing, it has well defined dependencies that will
-not leak into init manifest. In custom type you can also add special explorers
-and gencode.
-
-Then, in init manifest you combine your complex types. It is:  
-
-* cleaner
-* easier to follow
-* easier to maintain
-* easier to debug.
+This can be helpful, but one must be aware of its side effects.
 
 
 CDIST_ORDER_DEPENDENCY kills parallelization
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
 Suppose you have defined CDIST_ORDER_DEPENDENCY and then, among other things,
 you specify creation of three, by nature independent, files.
 
diff --git a/docs/src/cdist-manifest.rst b/docs/src/cdist-manifest.rst
index 4dd3e74b..5dbca479 100644
--- a/docs/src/cdist-manifest.rst
+++ b/docs/src/cdist-manifest.rst
@@ -163,7 +163,126 @@ automatically depends on the previously created object.
 It essentially helps you to build up blocks of code that build upon each other
 (like first creating the directory xyz than the file below the directory).
 
-Read also about `perils of CDIST_ORDER_DEPENDENCY <cdist-best-practice.html#perils-of-cdist-order-dependency>`_.
+Read also about `notes on CDIST_ORDER_DEPENDENCY <cdist-best-practice.html#notes-on-cdist-order-dependency>`_.
+
+In version 6.2.0 semantic CDIST_ORDER_DEPENDENCY is finally fixed and well defined.
+
+CDIST_ORDER_DEPENDENCY defines type order dependency context. Order dependency context
+starts when CDIST_ORDER_DEPENDENCY is set, and ends when it is unset. After each
+manifest execution finishes, any existing order dependency context is automatically
+unset. This ensures that CDIST_ORDER_DEPENDENCY is valid within the manifest where it
+is used. When order dependency context is defined then cdist executes types in the
+order in which they are created in the manifest inside order dependency context.
+
+Sometimes the best way to see how something works is to see examples.
+
+Suppose you have defined **initial manifest**:
+
+.. code-block:: sh
+
+    __cycle1 cycle1
+    export CDIST_ORDER_DEPENDENCY=1
+    __cycle2 cycle2
+    __cycle3 cycle3
+
+with types **__cycle1**:
+
+.. code-block:: sh
+
+    export CDIST_ORDER_DEPENDENCY=1
+    __file /tmp/cycle11
+    __file /tmp/cycle12
+    __file /tmp/cycle13
+
+**__cycle2**:
+
+.. code-block:: sh
+
+    __file /tmp/cycle21
+    export CDIST_ORDER_DEPENDENCY=1
+    __file /tmp/cycle22
+    __file /tmp/cycle23
+    unset CDIST_ORDER_DEPENDENCY
+    __file /tmp/cycle24
+
+**__cycle3**:
+
+.. code-block:: sh
+
+    __file /tmp/cycle31
+    __file /tmp/cycle32
+    export CDIST_ORDER_DEPENDENCY=1
+    __file /tmp/cycle33
+    __file /tmp/cycle34
+
+For the above config, cdist results in the following expected *dependency graph*
+(type *__cycleX* is shown as *cX*, *__file/tmp/cycleXY* is shown as *fcXY*):
+
+::
+
+    c1---->fc11
+    |      /\
+    |       |
+    +----->fc12
+    |      /\
+    |       |
+    +----->fc13
+
+    c2--+--->fc21
+    /\  |
+    |   |
+    |   +----->fc22
+    |   |      /\
+    |   |       |
+    |   +----->fc23
+    |   |
+    |   |
+    |   +----->fc24
+    |
+    |
+    c3---->fc31
+    |
+    |
+    +----->fc32
+    |
+    |
+    +----->fc33
+    |      /\
+    |       |
+    +----->fc34
+
+Before version 6.2.0 the above configuration would result in cycle:
+
+::
+
+    ERROR: 185.203.112.26: Cycle detected in object dependencies:
+    __file/tmp/cycle11 -> __cycle3/cycle3 -> __cycle2/cycle2 -> __cycle1/cycle1 -> __file/tmp/cycle11!
+
+The following manifest shows an example for order dependency contexts:
+
+.. code-block:: sh
+
+    __file /tmp/fileA
+    export CDIST_ORDER_DEPENDENCY=1
+    __file /tmp/fileB
+    __file /tmp/fileC
+    __file /tmp/fileD
+    unset CDIST_ORDER_DEPENDENCY
+    __file /tmp/fileE
+    __file /tmp/fileF
+    export CDIST_ORDER_DEPENDENCY=1
+    __file /tmp/fileG
+    __file /tmp/fileH
+    unset CDIST_ORDER_DEPENDENCY
+    __file /tmp/fileI
+
+This means:
+
+* C depends on B
+* D depends on C
+* H depends on G
+
+and there are no other dependencies from this manifest.
 
 
 Overrides
diff --git a/docs/src/cdist-reference.rst.sh b/docs/src/cdist-reference.rst.sh
index 3ab12fe2..e77d98f6 100755
--- a/docs/src/cdist-reference.rst.sh
+++ b/docs/src/cdist-reference.rst.sh
@@ -330,7 +330,7 @@ CDIST_OVERRIDE
 
 CDIST_ORDER_DEPENDENCY
     Create dependencies based on the execution order (see  \`cdist manifest <cdist-manifest.html>\`_).
-    Read also about \`perils of CDIST_ORDER_DEPENDENCY <cdist-best-practice.html#perils-of-cdist-order-dependency>\`_.
+    Note that in version 6.2.0 semantic of this processing mode is finally fixed and well defined.
 
 CDIST_REMOTE_EXEC
     Use this command for remote execution (should behave like ssh).
diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index 7f368e68..f40491e9 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -827,6 +827,8 @@ CDIST_OVERRIDE
 
 CDIST_ORDER_DEPENDENCY
     Create dependencies based on the execution order.
+    Note that in version 6.2.0 semantic of this processing mode is
+    finally fixed and well defined.
 
 CDIST_REMOTE_EXEC
     Use this command for remote execution (should behave like ssh).

From b3012b99114f586da045e37a2ac74985c33bcc82 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 29 Nov 2019 13:56:32 +0100
Subject: [PATCH 215/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index f6e9357c..175d9b61 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)
+
 6.1.1: 2019-11-26
 	* Type __xymon_config: Add parameters for ownership and generic rsync options (Thomas Eckert)
 	* Type __xymon_client: Add msgcache parameter to support passive clients (Thomas Eckert)

From a1f33ca8ebbeb6faae1b7f14af7fb83700a329e4 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 30 Nov 2019 23:11:36 +0100
Subject: [PATCH 216/383] Release 6.2.0

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 175d9b61..09e30e79 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)
 
 6.1.1: 2019-11-26

From 648cdf8e29c886652c0ea20599e7b17370ed81de Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@ungleich.ch>
Date: Sun, 1 Dec 2019 14:23:02 +0100
Subject: [PATCH 217/383] Add LICENSE

---
 LICENSE | 674 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 674 insertions(+)
 create mode 100644 LICENSE

diff --git a/LICENSE b/LICENSE
new file mode 100644
index 00000000..14682ad6
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    cdist
+    Copyright (C) 2019  ungleich-public
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    cdist  Copyright (C) 2019  ungleich-public
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.

From 8c0ee28b9940b765e48e839008b8f3765567da8e Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 2 Dec 2019 12:35:43 +0100
Subject: [PATCH 218/383] gitlab CI runner should have necessary tools

---
 .gitlab-ci.yml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 44de6b0b..1cc17995 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,26 +3,16 @@ stages:
 
 unit_tests:
     stage: test
-    before_script:
-        - 'apk update'
-        - 'apk add python3'
     script:
         - ./bin/build-helper version
         - ./bin/build-helper test
 
 pycodestyle:
     stage: test
-    before_script:
-        - 'apk update'
-        - 'apk add python3 py3-pycodestyle'
-        - 'ln -f -s /usr/bin/pycodestyle-3 /usr/bin/pycodestyle'
     script:
         - ./bin/build-helper pycodestyle
 
 shellcheck:
     stage: test
-    before_script:
-        - 'wget https://storage.googleapis.com/shellcheck/shellcheck-stable.linux.x86_64.tar.xz'
-        - 'tar xf shellcheck-stable.linux.x86_64.tar.xz && mv shellcheck-stable/shellcheck /usr/bin/'
     script:
         - ./bin/build-helper shellcheck

From d25c72e678f8d4fb311a9800a3097e1bf6e9bf16 Mon Sep 17 00:00:00 2001
From: Dominique Roux <dominique.roux4@gmail.com>
Date: Tue, 3 Dec 2019 10:13:46 +0100
Subject: [PATCH 219/383] [PACKAGE-UPDATE-INDEX]: Bugfix of the alpine part of
 the __package_update_index type

---
 cdist/conf/type/__package_update_index/gencode-remote | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__package_update_index/gencode-remote b/cdist/conf/type/__package_update_index/gencode-remote
index 9b2ecba2..6c51cbed 100755
--- a/cdist/conf/type/__package_update_index/gencode-remote
+++ b/cdist/conf/type/__package_update_index/gencode-remote
@@ -47,9 +47,9 @@ case "$type" in
         echo "pacman --noprogressbar --sync --refresh"
         echo "pacman package database synced (age was: $currage)" >> "$__messages_out"
         ;;
-    alpine)
+    apk)
         echo "apk update"
-        echo "apk package database updated."
+        echo "apk package database updated." >>"$__messages_out"
         ;;
     *)
         echo "Don't know how to manage packages for type: $type" >&2

From 320f962e1df7f27909e6157e8dfc6033706c8ddd Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 4 Dec 2019 22:27:58 +0100
Subject: [PATCH 220/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 09e30e79..8bdee928 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Type __package_update_index: Fix Alpine part (Dominique Roux)
+
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)
 

From 4f21bf534dd91c7395845beb08715ad6c84bafef Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Thu, 5 Dec 2019 23:14:27 +0100
Subject: [PATCH 221/383] [docs] PreOS: English nitpicking.

---
 cdist/argparse.py        |  2 +-
 docs/src/cdist-preos.rst | 70 ++++++++++++++++++++--------------------
 2 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/cdist/argparse.py b/cdist/argparse.py
index ca69cdae..ed94d266 100644
--- a/cdist/argparse.py
+++ b/cdist/argparse.py
@@ -424,7 +424,7 @@ def get_parsers():
     parser['inventory'].set_defaults(
             func=cdist.inventory.Inventory.commandline)
 
-    # PreOs
+    # PreOS
     parser['preos'] = parser['sub'].add_parser('preos', add_help=False)
 
     # Shell
diff --git a/docs/src/cdist-preos.rst b/docs/src/cdist-preos.rst
index e85af2de..2f102fef 100644
--- a/docs/src/cdist-preos.rst
+++ b/docs/src/cdist-preos.rst
@@ -4,9 +4,9 @@ PreOS
 Description
 -----------
 With cdist you can install and configure new machines. You can use cdist to
-create PreOS, minimal OS which purpose is to boot new machine.
-After PreOS is booted machine is ready for installing desired OS and
-then it is ready for configuration.
+create PreOS, minimal OS whose purpose is to boot a new machine.
+After PreOS is booted, the machine is ready for installing the desired OS and
+afterwards it is ready for configuration.
 
 PreOS creation
 --------------
@@ -15,62 +15,62 @@ Currently supported PreOS-es include:
 
 * debian
 * ubuntu
-* devuan.
+* devuan
 
-PreOS is created using cdist preos command. preos command has subcommands that
-create the desired PreOS.
+PreOS is created using the ``cdist preos`` command.
+This command has subcommands that determine the desired PreOS.
 
-For example, to create ubuntu PreOS:
+For example, to create an ubuntu PreOS:
 
 .. code-block:: sh
 
     $ cdist preos ubuntu /preos/preos-ubuntu -B -C \
         -k ~/.ssh/id_rsa.pub -p /preos/pxe-ubuntu
 
-For more info about available options see cdist manual page.
+For more info about the available options see the cdist manual page.
 
-This will bootstrap (``-B``) ubuntu PreOS in ``/preos/preos-ubuntu`` directory, it
-will be configured (``-C``) using default built-in initial manifest and with
-specified ssh authorized key (``-k``).
-After bootstrapping and configuration PXE
-boot directory will be created (``-p``) in ``/preos/pxe-ubuntu``.
+This will bootstrap (``-B``) ubuntu PreOS in the ``/preos/preos-ubuntu``
+directory, it will be configured (``-C``) using default the built-in initial
+manifest and with specified ssh authorized key (``-k``).
+After bootstrapping and configuration, the PXE boot directory will be
+created (``-p``) in ``/preos/pxe-ubuntu``.
 
-After PreOS is created new machines can be booted using created PXE (after
-proper dhcp, tftp setting).
+After PreOS is created, new machines can be booted using the created PXE
+(after proper dhcp and tftp settings).
 
-Since PreOS is configured with ssh authorized key it can be accessed throguh
+Since PreOS is configured with ssh authorized key it can be accessed through
 ssh, i.e. it can be further installed and configured with cdist.
 
-Implementing new PreOS sub-command
-----------------------------------
+Implementing a new PreOS sub-command
+------------------------------------
 preos command is implemented as a plugin system. This plugin system scans for
-preos subcommands in ``cdist/preos/`` distribution directory and also in
+preos subcommands in the ``cdist/preos/`` distribution directory and also in
 ``~/.cdist/preos/`` directory if it exists.
 
 preos subcommand is a module or a class that satisfies the following:
 
-* it has attribute ``_cdist_preos`` set to ``True``
-* it has function/method ``commandline``.
+* it has the attribute ``_cdist_preos`` set to ``True``
+* it defines a function/method ``commandline``.
 
-For a module based preos subcommand ``commandline`` function accepts a module
-object as its first argument and the list of command line
+For a module-based preos subcommand, the ``commandline`` function accepts a
+module object as its first argument and the list of command line
 arguments (``sys.argv[2:]``).
 
-For a class preos subcommand ``commandline`` method should be staticmethod and
-it accepts a class object as its first argument and the list of command line
-arguments(``sys.argv[2:]``).
+For a class-based preos subcommand ``commandline`` method should be
+static-method and must accept a class as its first argument and the
+list of command line arguments (``sys.argv[2:]``).
 
 If preos scanning finds a module/class that has ``_cdist_preos`` set
-to ``True`` and it has function/method ``commandline`` then this module/class is
+to ``True`` and a function/method ``commandline`` then this module/class is
 registered to preos subcommands. The name of the command is set to ``_preos_name``
-attribute if it exists, otherwise it is set to the module/class name, lowercase.
-When registered preos subcommand is specified as preos command then ``commandline``
-will be called with first argument set to module/class object and second argument
-set to ``sys.argv[2:]``.
+attribute if defined in the module/class, defaulting to the module/class name in lowercase.
+When a registered preos subcommand is specified, ``commandline``
+will be called with the first argument set to module/class and the second
+argument set to ``sys.argv[2:]``.
 
-Example writing new dummy preos sub-command
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-Module based preos:
+Example of writing new dummy preos sub-command
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Module-based preos:
 ^^^^^^^^^^^^^^^^^^^
 
 #. Create directory ``~/.cdist/preos/`` if it does not exist
@@ -134,4 +134,4 @@ When you try to run this new preos you will get:
     FreeBSD dummy preos: []
 
 In the ``commandline`` function/method you have all the freedom to actually create
-PreOS.
+a PreOS.

From f22349ce8a6571601478a76bfe3b68bb574154ba Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 6 Dec 2019 08:56:57 +0100
Subject: [PATCH 222/383] Fix documentation for install types

Fixes gitlab #790.
---
 cdist/conf/type/__install_directory/man.rst | 102 +++++++++++++++++++-
 cdist/conf/type/__install_file/man.rst      |  14 ++-
 docs/changelog                              |   1 +
 3 files changed, 115 insertions(+), 2 deletions(-)
 mode change 120000 => 100644 cdist/conf/type/__install_directory/man.rst

diff --git a/cdist/conf/type/__install_directory/man.rst b/cdist/conf/type/__install_directory/man.rst
deleted file mode 120000
index 1ad7fa84..00000000
--- a/cdist/conf/type/__install_directory/man.rst
+++ /dev/null
@@ -1 +0,0 @@
-../__directory/man.rst
\ No newline at end of file
diff --git a/cdist/conf/type/__install_directory/man.rst b/cdist/conf/type/__install_directory/man.rst
new file mode 100644
index 00000000..c402cbad
--- /dev/null
+++ b/cdist/conf/type/__install_directory/man.rst
@@ -0,0 +1,101 @@
+cdist-type__install_directory(7)
+================================
+
+NAME
+----
+cdist-type__install_directory - Manage a directory with install command
+
+
+DESCRIPTION
+-----------
+This cdist type allows you to create or remove directories on the target.
+
+
+REQUIRED PARAMETERS
+-------------------
+None.
+
+
+OPTIONAL PARAMETERS
+-------------------
+state
+   'present' or 'absent', defaults to 'present'
+
+group
+   Group to chgrp to.
+
+mode
+   Unix permissions, suitable for chmod.
+
+owner
+   User to chown to.
+
+
+BOOLEAN PARAMETERS
+------------------
+parents
+   Whether to create parents as well (mkdir -p behaviour).
+   Warning: all intermediate directory permissions default
+   to whatever mkdir -p does. 
+
+   Usually this means root:root, 0700.
+
+recursive
+   If supplied the chgrp and chown call will run recursively.
+   This does *not* influence the behaviour of chmod.
+
+MESSAGES
+--------
+chgrp <group>
+    Changed group membership
+chown <owner>
+    Changed owner
+chmod <mode>
+    Changed mode
+create
+    Empty directory was created
+remove
+    Directory exists, but state is absent, directory will be removed by generated code.
+remove non directory
+    Something other than a directory with the same name exists and was removed prior to create.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # A silly example
+    __install_directory /tmp/foobar
+
+    # Remove a directory
+    __install_directory /tmp/foobar --state absent
+
+    # Ensure /etc exists correctly
+    __install_directory /etc --owner root --group root --mode 0755
+
+    # Create nfs service directory, including parents
+    __install_directory /home/services/nfs --parents
+
+    # Change permissions recursively
+    __install_directory /home/services --recursive --owner root --group root
+
+    # Setup a temp directory
+    __install_directory /local --mode 1777
+
+    # Take it all
+    __install_directory /home/services/kvm --recursive --parents \
+        --owner root --group root --mode 0755 --state present
+
+
+AUTHORS
+-------
+Nico Schottelius <nico-cdist--@--schottelius.org>
+
+
+COPYING
+-------
+Copyright \(C) 2011 Nico Schottelius. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__install_file/man.rst b/cdist/conf/type/__install_file/man.rst
index c5409167..977ed77c 100644
--- a/cdist/conf/type/__install_file/man.rst
+++ b/cdist/conf/type/__install_file/man.rst
@@ -23,6 +23,10 @@ symlink
 directory
   replace it with the source file
 
+One exception is that when state is pre-exists, an error is raised if
+the file would have been created otherwise (e.g. it is not present or
+not a regular file).
+
 In any case, make sure that the file attributes are as specified.
 
 
@@ -33,7 +37,7 @@ None.
 OPTIONAL PARAMETERS
 -------------------
 state
-   'present', 'absent' or 'exists', defaults to 'present' where:
+   'present', 'absent', 'exists' or 'pre-exists', defaults to 'present' where:
 
    present
       the file is exactly the one from source
@@ -41,6 +45,9 @@ state
       the file does not exist
    exists
       the file from source but only if it doesn't already exist
+   pre-exists
+      check that the file exists and is a regular file, but do not
+      create or modify it
 
 group
    Group to chgrp to.
@@ -56,6 +63,9 @@ source
    If not supplied, an empty file or directory will be created.
    If source is '-' (dash), take what was written to stdin as the file content.
 
+onchange
+   The code to run if file is modified.
+
 MESSAGES
 --------
 chgrp <group>
@@ -93,6 +103,8 @@ EXAMPLES
     __install_file /home/frodo/.bashrc --source "/etc/skel/.bashrc" \
        --state exists \
        --owner frodo --mode 0600
+    # Check that the file is present, show an error when it is not
+    __install_file /etc/somefile --state pre-exists
     # Take file content from stdin
     __install_file /tmp/whatever --owner root --group root --mode 644 --source - << DONE
         Here goes the content for /tmp/whatever
diff --git a/docs/changelog b/docs/changelog
index 8bdee928..ed993609 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)
+	* Documentation: Fix man pages for install types (Darko Poljak)
 
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)

From 90e85d81285a1ed60085b4df0a1618e4aeaa8c6f Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 6 Dec 2019 09:37:21 +0100
Subject: [PATCH 223/383] Embed config skeleton instead of rewriting it

Resolves #796.
---
 .gitignore                       |  1 +
 Makefile                         |  8 +++-
 docs/changelog                   |  1 +
 docs/src/cdist-configuration.rst | 70 ++------------------------------
 4 files changed, 13 insertions(+), 67 deletions(-)

diff --git a/.gitignore b/.gitignore
index ed8b453a..fb831051 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,7 @@ docs/src/man1/*.1
 docs/src/man7/*.7
 docs/src/man7/cdist-type__*.rst
 docs/src/cdist-reference.rst
+docs/src/cdist.cfg.skeleton
 
 # Ignore cdist cache for version control
 /cache/
diff --git a/Makefile b/Makefile
index fa3327d1..e6a2a28e 100644
--- a/Makefile
+++ b/Makefile
@@ -63,6 +63,11 @@ DOCSREFSH=$(DOCS_SRC_DIR)/cdist-reference.rst.sh
 $(DOCSREF): $(DOCSREFSH)
 	$(DOCSREFSH)
 
+DOCSCFGSKEL=./configuration/cdist.cfg.skeleton
+
+configskel: $(DOCSCFGSKEL)
+	cp -f "$(DOCSCFGSKEL)" "$(DOCS_SRC_DIR)/"
+
 version:
 	@[ -f "cdist/version.py" ] || { \
 		printf "Missing 'cdist/version.py', please generate it first.\n" && exit 1; \
@@ -72,7 +77,7 @@ version:
 man: version $(MANTYPES) $(DOCSREF)
 	$(SPHINXM)
 
-html: version $(MANTYPES) $(DOCSREF)
+html: version configskel $(MANTYPES) $(DOCSREF)
 	$(SPHINXH)
 
 docs: man html
@@ -114,6 +119,7 @@ speeches: $(SPEECHES)
 #
 clean: docs-clean
 	rm -f $(DOCS_SRC_DIR)/cdist-reference.rst
+	rm -f $(DOCS_SRC_DIR)/cdist.cfg.skeleton
 
 	find "$(DOCS_SRC_DIR)" -mindepth 2 -type l \
 	| xargs rm -f
diff --git a/docs/changelog b/docs/changelog
index ed993609..ca33d7bd 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)
 	* Documentation: Fix man pages for install types (Darko Poljak)
+	* Documentation: Embed config skeleton instead of rewriting it (Darko Poljak)
 
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)
diff --git a/docs/src/cdist-configuration.rst b/docs/src/cdist-configuration.rst
index 4c9b4d33..706ed761 100644
--- a/docs/src/cdist-configuration.rst
+++ b/docs/src/cdist-configuration.rst
@@ -31,73 +31,11 @@ can be used.
 
 Config file format
 ------------------
+
 cdist configuration file is in the INI file format. Currently it supports
 only [GLOBAL] section.
-The possible keywords and their meanings are as follows:
 
-:strong:`archiving`
-    Use specified archiving. Valid values include:
-    'none', 'tar', 'tgz', 'tbz2' and 'txz'.
+Here you can find configuration file skeleton:
 
-:strong:`beta`
-    Enable beta functionality. It recognizes boolean values from
-    'yes'/'no', 'on'/'off', 'true'/'false' and '1'/'0'.
-
-:strong:`cache_path_pattern`
-    Specify cache path pattern.
-
-:strong:`conf_dir`
-    List of configuration directories separated with the character conventionally
-    used by the operating system to separate search path components (as in PATH),
-    such as ':' for POSIX or ';' for Windows.
-    If also specified at command line then values from command line are
-    appended to this value.
-
-:strong:`init_manifest`
-    Specify default initial manifest.
-
-:strong:`inventory_dir`
-    Specify inventory directory.
-
-:strong:`jobs`
-    Specify number of jobs for parallel processing. If -1 then the default,
-    number of CPU's in the system is used. If 0 then parallel processing in
-    jobs is disabled. If set to positive number then specified maximum
-    number of processes will be used.
-
-:strong:`local_shell`
-    Shell command used for local execution.
-
-:strong:`out_path`
-    Directory to save cdist output in.
-
-:strong:`parallel`
-    Process hosts in parallel. If -1 then the default, number of CPU's in
-    the system is used. If 0 then parallel processing of hosts is disabled.
-    If set to positive number then specified maximum number of processes
-    will be used.
-
-:strong:`remote_copy`
-    Command to use for remote copy (should behave like scp).
-
-:strong:`remote_exec`
-    Command to use for remote execution (should behave like ssh).
-
-:strong:`remote_out_path`
-    Directory to save cdist output in on the target host.
-
-:strong:`remote_shell`
-    Shell command at remote host used for remote execution.
-
-:strong:`save_output_streams`
-    Enable/disable saving output streams (enabled by default).
-    It recognizes boolean values from 'yes'/'no', 'on'/'off', 'true'/'false'
-    and '1'/'0'.
-
-:strong:`timestamp`
-    Timestamp log messages with the current local date and time
-    in the format: YYYYMMDDHHMMSS.us.
-
-:strong:`verbosity`
-    Set verbosity level. Valid values are: 
-    'ERROR', 'WARNING', 'INFO', 'VERBOSE', 'DEBUG', 'TRACE' and 'OFF'.
+.. literalinclude:: cdist.cfg.skeleton
+    :language: ini

From 71b6646b38799f7316d791a4d9b511098d879ab0 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 6 Dec 2019 10:00:32 +0100
Subject: [PATCH 224/383] Rm cdist-type prefix and man page ref from docs

E.g.

16.10. __block
16.11. __ccollect_source
16.12. __cdist
16.13. __cdistmarker
16.14. __check_messages

insted of

16.10. cdist-type__block(7)
16.11. cdist-type__ccollect_source(7)
16.12. cdist-type__cdist(7)
16.13. cdist-type__cdistmarker(7)
16.14. cdist-type__check_messages(7)
---
 .gitignore                  |  1 +
 Makefile                    | 10 ++++++-
 docs/src/cdist-types.rst    |  8 ------
 docs/src/cdist-types.rst.sh | 55 +++++++++++++++++++++++++++++++++++++
 4 files changed, 65 insertions(+), 9 deletions(-)
 delete mode 100644 docs/src/cdist-types.rst
 create mode 100755 docs/src/cdist-types.rst.sh

diff --git a/.gitignore b/.gitignore
index fb831051..85a8ccc7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,7 @@ docs/src/man1/*.1
 docs/src/man7/*.7
 docs/src/man7/cdist-type__*.rst
 docs/src/cdist-reference.rst
+docs/src/cdist-types.rst
 docs/src/cdist.cfg.skeleton
 
 # Ignore cdist cache for version control
diff --git a/Makefile b/Makefile
index e6a2a28e..f89ac1e7 100644
--- a/Makefile
+++ b/Makefile
@@ -63,6 +63,13 @@ DOCSREFSH=$(DOCS_SRC_DIR)/cdist-reference.rst.sh
 $(DOCSREF): $(DOCSREFSH)
 	$(DOCSREFSH)
 
+# Html types list with references
+DOCSTYPESREF=$(MAN7DSTDIR)/cdist-types.rst
+DOCSTYPESREFSH=$(DOCS_SRC_DIR)/cdist-types.rst.sh
+
+$(DOCSTYPESREF): $(DOCSTYPESREFSH)
+	$(DOCSTYPESREFSH)
+
 DOCSCFGSKEL=./configuration/cdist.cfg.skeleton
 
 configskel: $(DOCSCFGSKEL)
@@ -77,7 +84,7 @@ version:
 man: version $(MANTYPES) $(DOCSREF)
 	$(SPHINXM)
 
-html: version configskel $(MANTYPES) $(DOCSREF)
+html: version configskel $(MANTYPES) $(DOCSREF) $(DOCSTYPESREF)
 	$(SPHINXH)
 
 docs: man html
@@ -119,6 +126,7 @@ speeches: $(SPEECHES)
 #
 clean: docs-clean
 	rm -f $(DOCS_SRC_DIR)/cdist-reference.rst
+	rm -f $(DOCS_SRC_DIR)/cdist-types.rst
 	rm -f $(DOCS_SRC_DIR)/cdist.cfg.skeleton
 
 	find "$(DOCS_SRC_DIR)" -mindepth 2 -type l \
diff --git a/docs/src/cdist-types.rst b/docs/src/cdist-types.rst
deleted file mode 100644
index d5104667..00000000
--- a/docs/src/cdist-types.rst
+++ /dev/null
@@ -1,8 +0,0 @@
-cdist types
-===========
-
-.. toctree::
-   :titlesonly:
-   :glob:
-
-   man7/*
diff --git a/docs/src/cdist-types.rst.sh b/docs/src/cdist-types.rst.sh
new file mode 100755
index 00000000..2eb66009
--- /dev/null
+++ b/docs/src/cdist-types.rst.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+#
+# 2019 Darko Poljak (darko.poljak at gmail.com) 
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# Generate cdist-types.rst that lists available types.
+#
+
+__cdist_pwd="$(pwd -P)"
+__cdist_mydir="${0%/*}";
+__cdist_abs_mydir="$(cd "$__cdist_mydir" && pwd -P)"
+__cdist_myname=${0##*/};
+__cdist_abs_myname="$__cdist_abs_mydir/$__cdist_myname"
+
+filename="${__cdist_myname%.sh}"
+dest="$__cdist_abs_mydir/$filename"
+
+cd "$__cdist_abs_mydir"
+
+exec > "$dest"
+cat << eof 
+cdist types
+===========
+
+.. toctree::
+   :titlesonly:
+
+eof
+
+# If there is no such file then ls prints error to stderr,
+# so redirect stderr to /dev/null.
+for type in $(ls man7/cdist-type__*.rst 2>/dev/null | LC_ALL=C sort); do
+    no_dir="${type#man7/}";
+    no_type="${no_dir#cdist-type}";
+    name="${no_type%.rst}";
+    manref="${no_dir%.rst}"
+    man="${manref}(7)"
+
+    echo "   $name" "<man7/${manref}>"
+done

From f2cbc01e3f885c41962a1e474922127c49099203 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 6 Dec 2019 10:04:06 +0100
Subject: [PATCH 225/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index ca33d7bd..bf0398a9 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)
 	* Documentation: Fix man pages for install types (Darko Poljak)
 	* Documentation: Embed config skeleton instead of rewriting it (Darko Poljak)
+	* Documentation: Remove cdist-type prefix and man page reference from type list in html (Darko Poljak)
 
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)

From 839e7a408e199cd5a0884c25e283c9bebe13e26d Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 6 Dec 2019 19:46:17 +0100
Subject: [PATCH 226/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index bf0398a9..f4e38578 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -6,6 +6,7 @@ next:
 	* Documentation: Fix man pages for install types (Darko Poljak)
 	* Documentation: Embed config skeleton instead of rewriting it (Darko Poljak)
 	* Documentation: Remove cdist-type prefix and man page reference from type list in html (Darko Poljak)
+	* Documentation: PreOS english nitpicking (Evil Ham)
 
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)

From d5ac9ea348aa0ed640941232fbc2c783d95b8750 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 8 Dec 2019 16:34:38 +0100
Subject: [PATCH 227/383] Docs: install from source, verify signature

Add chapter for installing from source with signature verification.
Resolves #795.
---
 docs/changelog             |  1 +
 docs/src/cdist-install.rst | 27 +++++++++++++++++++++++++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/docs/changelog b/docs/changelog
index f4e38578..33db10da 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,6 +7,7 @@ next:
 	* Documentation: Embed config skeleton instead of rewriting it (Darko Poljak)
 	* Documentation: Remove cdist-type prefix and man page reference from type list in html (Darko Poljak)
 	* Documentation: PreOS english nitpicking (Evil Ham)
+	* Documentation: Add installing from source with signature verification (Darko Poljak)
 
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)
diff --git a/docs/src/cdist-install.rst b/docs/src/cdist-install.rst
index a9b7d6b5..880b9f8e 100644
--- a/docs/src/cdist-install.rst
+++ b/docs/src/cdist-install.rst
@@ -23,8 +23,6 @@ Target Hosts
 Install cdist
 -------------
 
-You can install cdist either from git or as a python package.
-
 From git
 ~~~~~~~~
 
@@ -42,6 +40,7 @@ To install cdist, execute the following commands:
 
 From version 4.2.0 cdist tags and releases are signed.
 You can get GPG public key used for signing `here <_static/pgp-key-EFD2AE4EC36B6901.asc>`_.
+It is assumed that you are familiar with *git* ways of signing and verification.
 
 You can also get cdist from `github mirror <https://github.com/ungleich/cdist>`_.
 
@@ -157,3 +156,27 @@ Cdist is available as a python package at
 .. code-block:: sh
 
     pip install cdist
+
+Installing from source with signature verification
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If you want to install cdist from signed source and verify it, first you need to
+download cdist archive and its detached signature.
+
+Get both, *cdist-x.y.z.tar.gz* and *cdist-x.y.z.tar.gz.asc* from release
+notes of the desired tag *x.y.z* at
+`cdist git repository <https://code.ungleich.ch/ungleich-public/cdist/-/tags>`_.
+
+Get GPG public key used for signing `here <_static/pgp-key-EFD2AE4EC36B6901.asc>`_
+and import it into GPG.
+
+Now cdist source archive can be verified using `gpg`, e.g. to verify `cdist-6.2.0`:
+
+.. code-block:: sh
+
+    $ gpg --verify cdist-6.2.0.tar.gz.asc cdist-6.2.0.targ.gz
+    gpg: Signature made Sat Nov 30 23:14:19 2019 CET
+    gpg:                using RSA key 69767822F3ECC3C349C1EFFFEFD2AE4EC36B6901
+    gpg: Good signature from "ungleich GmbH (ungleich FOSS) <foss@ungleich.ch>" [ultimate]
+
+Further steps are the same as for `installing from git <cdist-install.html#from-git>`_.

From 4735df1bed2b23db8c16f568280ef1c5a8ed4c03 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 6 Dec 2019 19:40:05 +0100
Subject: [PATCH 228/383] Add plugins-dir preos option

---
 cdist/argparse.py        |  2 +-
 cdist/preos.py           | 72 +++++++++++++++++++++++++++++-----------
 docs/src/cdist-preos.rst | 30 ++++++-----------
 docs/src/man1/cdist.rst  | 52 +++++++++++++++++------------
 4 files changed, 95 insertions(+), 61 deletions(-)

diff --git a/cdist/argparse.py b/cdist/argparse.py
index ed94d266..7dc683f3 100644
--- a/cdist/argparse.py
+++ b/cdist/argparse.py
@@ -103,7 +103,7 @@ def get_parsers():
                                    name="log level"),
             help=('Set the specified verbosity level. '
                   'The levels, in order from the lowest to the highest, are: '
-                  'ERROR (-1), WARNING (0), INFO (1), VERBOSE (2), DEBUG (3) '
+                  'ERROR (-1), WARNING (0), INFO (1), VERBOSE (2), DEBUG (3), '
                   'TRACE (4 or higher). If used along with -v then -v '
                   'increases last set value and -l overwrites last set '
                   'value.'),
diff --git a/cdist/preos.py b/cdist/preos.py
index 46b45554..378071db 100644
--- a/cdist/preos.py
+++ b/cdist/preos.py
@@ -5,6 +5,8 @@ import inspect
 import argparse
 import cdist
 import logging
+import re
+import cdist.argparse
 
 
 _PREOS_CALL = "commandline"
@@ -12,15 +14,24 @@ _PREOS_NAME = "_preos_name"
 _PREOS_MARKER = "_cdist_preos"
 _PLUGINS_DIR = "preos"
 _PLUGINS_PATH = [os.path.join(os.path.dirname(__file__), _PLUGINS_DIR), ]
+log = logging.getLogger("PreOS")
+
+
+def extend_plugins_path(dirs):
+    for dir in dirs:
+        preos_dir = os.path.expanduser(os.path.join(dir, "preos"))
+        if os.path.isdir(preos_dir):
+            _PLUGINS_PATH.append(preos_dir)
+
+
 cdist_home = cdist.home_dir()
 if cdist_home:
-    cdist_home_preos = os.path.join(cdist_home, "preos")
-    if os.path.isdir(cdist_home_preos):
-        _PLUGINS_PATH.append(cdist_home_preos)
-sys.path.extend(_PLUGINS_PATH)
-
-
-log = logging.getLogger("PreOS")
+    extend_plugins_path((cdist_home, ))
+x = 'CDIST_PATH'
+if x in os.environ:
+    vals = re.split(r'(?<!\\):', os.environ[x])
+    vals = [x for x in vals if x]
+    extend_plugins_path(vals)
 
 
 def preos_plugin(obj):
@@ -71,31 +82,54 @@ def check_root():
         raise cdist.Error("Must be run with root privileges")
 
 
+def get_available_preoses_string(cls):
+    preoses = ['    - {}'.format(x) for x in sorted(set(cls.preoses))]
+    return "Available PreOS-es:\n{}".format("\n".join(preoses))
+
+
 class PreOS(object):
     preoses = None
 
     @classmethod
     def commandline(cls, argv):
-
-        if not cls.preoses:
-            cls.preoses = find_preoses()
-
+        cdist_parser = cdist.argparse.get_parsers()
         parser = argparse.ArgumentParser(
-            description="Create PreOS", prog="cdist preos")
-        parser.add_argument('preos', help='PreOS to create, one of: {}'.format(
-            set(cls.preoses)))
-        args = parser.parse_args(argv[1:2])
+            description="Create PreOS", prog="cdist preos",
+            parents=[cdist_parser['loglevel'], ])
+        parser.add_argument('preos', help='PreOS to create',
+                            nargs='?', default=None)
+        parser.add_argument('-c', '--conf-dir',
+                            help=('Add configuration directory (one that '
+                                  'contains "preos" subdirectory)'),
+                            action='append')
+        parser.add_argument('-L', '--list-preoses',
+                            help='List available PreOS-es',
+                            action='store_true', default=False)
+        parser.add_argument('remainder_args', nargs=argparse.REMAINDER)
+        args = parser.parse_args(argv[1:])
+        cdist.argparse.handle_loglevel(args)
+        log.debug("preos args : {}".format(args))
+
+        if args.conf_dir:
+            extend_plugins_path(args.conf_dir)
+        sys.path.extend(_PLUGINS_PATH)
+        cls.preoses = find_preoses()
+
+        if args.list_preoses or not args.preos:
+            print(get_available_preoses_string(cls))
+            sys.exit(0)
 
         preos_name = args.preos
         if preos_name in cls.preoses:
             preos = cls.preoses[preos_name]
             func = getattr(preos, _PREOS_CALL)
             if inspect.ismodule(preos):
-                func_args = [preos, argv[2:], ]
+                func_args = [preos, args.remainder_args, ]
             else:
-                func_args = [argv[2:], ]
+                func_args = [args.remainder_args, ]
             log.info("Running preos : {}".format(preos_name))
             func(*func_args)
         else:
-            log.error("Unknown preos: {}, available preoses: {}".format(
-                preos_name, set(cls.preoses.keys())))
+            raise cdist.Error(
+                "Invalid PreOS {}. {}".format(
+                    preos_name, get_available_preoses_string(cls)))
diff --git a/docs/src/cdist-preos.rst b/docs/src/cdist-preos.rst
index 2f102fef..9570bcfc 100644
--- a/docs/src/cdist-preos.rst
+++ b/docs/src/cdist-preos.rst
@@ -88,16 +88,12 @@ When you try to run this new preos you will get:
 
 .. code-block:: sh
 
-    $ cdist preos -h
-    usage: cdist preos [-h] preos
-
-    Create PreOS
-
-    positional arguments:
-      preos       PreOS to create, one of: {'netbsd', 'debian', 'ubuntu'}
-
-    optional arguments:
-      -h, --help  show this help message and exit
+    $ cdist preos -L
+    Available PreOS-es:
+        - debian
+        - devuan
+        - netbsd
+        - ubuntu
     $ cdist preos netbsd
     NetBSD PreOS: []
 
@@ -121,15 +117,11 @@ When you try to run this new preos you will get:
 .. code-block:: sh
 
     $ cdist preos -h
-    usage: cdist preos [-h] preos
-
-    Create PreOS
-
-    positional arguments:
-      preos       PreOS to create, one of: {'freebsd', 'debian', 'ubuntu'}
-
-    optional arguments:
-      -h, --help  show this help message and exit
+    Available PreOS-es:
+        - debian
+        - devuan
+        - freebsd
+        - ubuntu
     $ cdist preos freebsd
     FreeBSD dummy preos: []
 
diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index f40491e9..d6937272 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -59,28 +59,28 @@ SYNOPSIS
                          [-I INVENTORY_DIR] [-a] [-f HOSTFILE] [-H] [-t]
                          [host [host ...]]
 
-    cdist preos [-h] preos
+    cdist preos [-h] [-l LOGLEVEL] [-q] [-v] [-c CONF_DIR] [-L] [preos] ...
 
-    cdist preos debian [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
-                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
-                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
-                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
-                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
-                       target_dir
+    cdist preos [preos-options] debian [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+                                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
+                                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
+                                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
+                                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
+                                       target_dir
 
-    cdist preos devuan [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
-                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
-                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
-                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
-                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
-                       target_dir
+    cdist preos [preos-options] devuan [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+                                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
+                                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
+                                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
+                                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
+                                       target_dir
 
-    cdist preos ubuntu [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
-                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
-                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
-                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
-                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
-                       target_dir
+    cdist preos [preos-options] ubuntu [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
+                                       [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
+                                       [-i MANIFEST] [-k KEYFILE ] [-m MIRROR]
+                                       [-P ROOT_PASSWORD] [-p PXE_BOOT_DIR] [-r]
+                                       [-S SCRIPT] [-s SUITE] [-y REMOTE_COPY]
+                                       target_dir
 
     cdist shell [-h] [-l LOGLEVEL] [-q] [-v] [-s SHELL]
 
@@ -103,7 +103,7 @@ All commands accept the following options:
 **-l LOGLEVEL, --log-level LOGLEVEL**
     Set the specified verbosity level. The levels, in
     order from the lowest to the highest, are: ERROR (-1),
-    WARNING (0), INFO (1), VERBOSE (2), DEBUG (3) TRACE (4
+    WARNING (0), INFO (1), VERBOSE (2), DEBUG (3), TRACE (4
     or higher). If used along with -v then -v increases
     last set value and -l overwrites last set value.
 
@@ -116,7 +116,7 @@ All commands accept the following options:
     value is 0 which includes ERROR and WARNING levels.
     The levels, in order from the lowest to the highest,
     are: ERROR (-1), WARNING (0), INFO (1), VERBOSE (2),
-    DEBUG (3) TRACE (4 or higher). If used along with -l
+    DEBUG (3), TRACE (4 or higher). If used along with -l
     then -l overwrites last set value and -v increases
     last set value.
 
@@ -457,7 +457,15 @@ List inventory database.
 
 PREOS
 -----
-Create PreOS. Currently, the following PreOS-es are supported:
+Create PreOS.
+
+**-c CONF_DIR, --conf-dir CONF_DIR**
+    Add configuration directory (one that contains "preos" subdirectory).
+
+**-L, --list-preoses**
+    List available PreOS-es.
+
+Currently, the following PreOS-es are supported:
 
 * debian
 * ubuntu

From 553cfc28e7193ade2678cd805a7f236e51e92972 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 9 Dec 2019 09:57:54 +0100
Subject: [PATCH 229/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 33db10da..04ffac62 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -8,6 +8,7 @@ next:
 	* Documentation: Remove cdist-type prefix and man page reference from type list in html (Darko Poljak)
 	* Documentation: PreOS english nitpicking (Evil Ham)
 	* Documentation: Add installing from source with signature verification (Darko Poljak)
+	* Core: preos: Support top command logging options, custom conf-dir option and CDIST_PATH env var (Darko Poljak)
 
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)

From bee95efa4317eacbde98237f7952d020cdfb5e61 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Mon, 9 Dec 2019 19:13:10 +0100
Subject: [PATCH 230/383] [new-type] __openldap_server

Originally developed at ungleich and improved for Open Sourcing by Evilham.
---
 cdist/conf/type/__openldap_server/man.rst     | 148 +++++++++++
 cdist/conf/type/__openldap_server/manifest    | 235 ++++++++++++++++++
 .../type/__openldap_server/parameter/boolean  |   2 +
 .../type/__openldap_server/parameter/optional |   4 +
 .../parameter/optional_multiple               |   2 +
 .../type/__openldap_server/parameter/required |   4 +
 6 files changed, 395 insertions(+)
 create mode 100644 cdist/conf/type/__openldap_server/man.rst
 create mode 100644 cdist/conf/type/__openldap_server/manifest
 create mode 100644 cdist/conf/type/__openldap_server/parameter/boolean
 create mode 100644 cdist/conf/type/__openldap_server/parameter/optional
 create mode 100644 cdist/conf/type/__openldap_server/parameter/optional_multiple
 create mode 100644 cdist/conf/type/__openldap_server/parameter/required

diff --git a/cdist/conf/type/__openldap_server/man.rst b/cdist/conf/type/__openldap_server/man.rst
new file mode 100644
index 00000000..29bbc231
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/man.rst
@@ -0,0 +1,148 @@
+cdist-type__openldap_server(7)
+==============================
+
+NAME
+----
+cdist-type__openldap_server - Setup an openldap(4) server instance
+
+
+DESCRIPTION
+-----------
+This type can be used to bootstrap an LDAP environment using openldap as slapd.
+
+
+REQUIRED PARAMETERS
+-------------------
+manager-dn
+    The rootdn to set up in the directory.
+    E.g. `cn=manager,dc=ungleich,dc=ch`. See `slapd.conf(5)`.
+
+manager-password-hash
+    The password for `manager-dn` in the directory.
+    This should be valid for `slapd.conf` like `{SSHA}qV+mCs3u8Q2sCmUXT4Ybw7MebHTASMyr`.
+    Generate e.g. with: `slappasswd -s weneedgoodsecurity`.
+    See `slappasswd(8C)`, `slapd.conf(5)`.
+    TODO: implement this: http://blog.adamsbros.org/2015/06/09/openldap-ssha-salted-hashes-by-hand/
+      to allow for a manager-password parameter and ensure idempotency (care with salts).
+      Such manager-password parameter should be mutually exclusive with this one.
+
+serverid
+    The server for the directory.
+    E.g. `dc=ungleich,dc=ch`. See `slapd.conf(5)`.
+
+suffix
+    The suffix for the directory.
+    E.g. `dc=ungleich,dc=ch`. See `slapd.conf(5)`.
+
+
+OPTIONAL PARAMETERS
+-------------------
+syncrepl-credentials
+    Only has an effect if `replicate` is set; required in that case.
+    This secret is shared amongst the hosts that will replicate the directory.
+    Note that each replication server needs this secret and it is saved in
+    plain text in the directory.
+
+syncrepl-searchbase
+    Only has an effect if `replicate` is set; required in that case.
+    The searchbase to use for replication.
+    E.g. `dc=ungleich,dc=ch`. See `slapd.conf(5)`.
+
+tls-cert
+    If defined, `__letsencrypt_cert` is not used and this must be the path in
+    the remote hosts to the PEM-encoded TLS certificate.
+    Requires: `tls-privkey` and `tls-ca`.
+    Permissions, existence and renewal of these files are left up to the
+    type's user.
+
+tls-privkey
+    Required if `tls-cert` is defined.
+    Path in the remote hosts to the PEM-encoded private key file.
+
+tls-ca
+    Required if `tls-cert` is defined.
+    Path in the remote hosts to the PEM-encoded CA certificate file.
+
+
+OPTIONAL MULTIPLE PARAMETERS
+----------------------------
+syncrepl-host
+    Only has an effect if `replicate` is set; required in that case.
+    Set once per host that will replicate the directory.
+
+module
+    LDAP module to load. See `slapd.conf(5)`.
+    Default value is OS-dependent, see manifest.
+
+
+BOOLEAN PARAMETERS
+------------------
+staging
+    Passed to `cdist-type__letsencrypt_cert`; has otherwise no use.
+    Obtain a test certificate from a staging server.
+
+replicate
+    Whether to setup replication or not.
+    If present `syncrepl-credentials` and `syncrepl-host` are also required.
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # Modify the ruleset on $__target_host:
+    __pf_ruleset --state present --source /my/pf/ruleset.conf
+    require="__pf_ruleset" \
+       __pf_apply
+
+    # Remove the ruleset on $__target_host (implies disabling pf(4):
+    __pf_ruleset --state absent
+    require="__pf_ruleset" \
+       __pf_apply
+
+    root@ldap-for-guacamole:~# cat ldapbase.ldif
+    dn: dc=guaca-test,dc=ungleich,dc=ch
+    objectClass: top
+    objectClass: dcObject
+    objectClass: organization
+    o: Some description
+    dc: guaca-test
+
+
+    # Sample usage:
+    #
+    # id=1
+    # for host in ldap-test1.ungleich.ch ldap-test2.ungleich.ch; do
+    #     echo "__ungleich_ldap ${host} \
+    #         --manager-dn 'cn=manager,dc=ungleich,dc=ch' \
+    #         --manager-password '{SSHA}fooo' \
+    #         --serverid '${id}' \
+    #         --staging \
+    #         --suffix 'dc=ungleich,dc=ch' \
+    #         --searchbase 'dc=ungleich,dc=ch' \
+    #         --syncrepl-credentials 'fooo' \
+    #         --syncrepl-host 'ldap-test1.ungleich.ch' \
+    #         --syncrepl-host 'ldap-test2.ungleich.ch' \
+    #         --descriptiont 'Ungleich LDAP server'" \
+    #         | cdist config -i - -v ${host}
+    #     id=$((id + 1))
+    # done
+
+
+SEE ALSO
+--------
+:strong:`cdist-type__letsencrypt_cert`\ (7)
+
+
+AUTHORS
+-------
+ungleich <foss--@--ungleich.ch>
+Evilham <contact--@--evilham.com>
+
+
+COPYING
+-------
+Copyright \(C) 2020 ungleich glarus ag. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
new file mode 100644
index 00000000..2acaaed5
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -0,0 +1,235 @@
+#!/bin/sh
+
+name="${__target_host}"
+manager_dn=$(cat "${__object}/parameter/manager-dn")
+manager_password_hash=$(cat "${__object}/parameter/manager-password-hash")
+serverid=$(cat "${__object}/parameter/serverid")
+suffix=$(cat "${__object}/parameter/suffix")
+slapd_modules=$(cat "${__object}/parameter/module" || true)
+
+
+OS="$(cat "${__global}/explorer/os")"
+
+# Setup OS-dependent vars
+# TODO: treat other OS better, defaulting to Debian-like
+case "${OS}" in
+    freebsd)
+	      PKGS="openldap-server"
+	      ETC="/usr/local/etc"
+        SLAPD_DIR="/usr/local/etc/openldap"
+        SLAPD_DATA_DIR="/var/db/openldap-data"
+        SLAPD_RUN_DIR="/var/run/openldap"
+        SLAPD_MODULE_PATH="/usr/local/libexec/openldap"
+        if [ -z "${slapd_modules}" ]; then
+            # It looks like ppolicy and syncprov must be compiled
+            slapd_modules="back_mdb back_monitor"
+        fi
+        ;;
+    *)
+        PKGS="slapd ldap-utils"
+	      ETC="/etc"
+        SLAPD_DIR="/etc/ldap"
+        SLAPD_DATA_DIR="/var/lib/ldap"
+        SLAPD_RUN_DIR="/var/run/slapd"
+        SLAPD_MODULE_PATH="/usr/lib/ldap"
+        if [ -z "${slapd_modules}" ]; then
+            slapd_modules="back_mdb ppolicy syncprov back_monitor"
+        fi
+        ;;
+esac
+
+
+
+# Determine if __letsencrypt_cert is to be used and setup vars accordingly
+if [ -f "${__object}/parameter/tls-cert" ]; then
+    tls_cert=$(cat "${__object}/parameter/tls-cert")
+
+    if [ ! -f "${__object}/parameter/tls-privkey" ]; then
+        echo "When tls-cert is defined, tls-privkey is also required." >&2
+        exit 1
+    fi
+    tls_privkey=$(cat "${__object}/parameter/tls-privkey")
+
+    if [ ! -f "${__object}/parameter/tls-ca" ]; then
+        echo "When tls-cert is defined, tls-ca is also required." >&2
+        exit 1
+    fi
+    tls_ca=$(cat "${__object}/parameter/tls-ca")
+
+    _skip_letsencrypt_cert="YES"
+else
+    tls_cert="${SLAPD_DIR}/sasl2/cert.pem"
+    tls_privkey="${SLAPD_DIR}/sasl2/privkey.pem"
+    tls_ca="${SLAPD_DIR}/sasl2/chain.pem"
+fi
+
+mkdir "${__object}/files"
+ldapconf="${__object}/files/ldapconf"
+
+replication=""
+if [ -f "${__object}/parameter/replicate" ]; then
+    replication=yes
+
+    if [ ! -f "${__object}/parameter/syncrepl-searchbase" ]; then
+        echo "Requiring the searchbase for replication" >&2
+        exit 1
+    fi
+    syncrepl_searchbase=$(cat "${__object}/parameter/syncrepl-searchbase")
+
+    if [ ! -f "${__object}/parameter/syncrepl-credentials" ]; then
+        echo "Requiring credentials for replication" >&2
+        exit 1
+    fi
+
+    syncrepl_credentials=$(cat "${__object}/parameter/syncrepl-credentials")
+
+    if [ ! -f "${__object}/parameter/syncrepl-host" ]; then
+        echo "Requiring host(s) for replication" >&2
+        exit 1
+    fi
+    syncrepl_hosts=$(cat "${__object}/parameter/syncrepl-host")
+
+fi
+
+# Install required packages
+for pkg in ${PKGS}; do
+    __package ${pkg}
+done
+
+
+# TODO: Implement __start_on_boot for BSD
+require="__package/slapd" __start_on_boot slapd
+
+# TODO: treat other OS better. Defaulting to Debian-like.
+if [ "${OS}" != "freebsd" ]; then
+    require="__package/slapd" __line rm_slapd_conf \
+       --file ${ETC}/default/slapd \
+       --regex 'SLAPD_CONF=.*' \
+       --state absent
+
+    require="__package/slapd" __line rm_slapd_services \
+       --file ${ETC}/default/slapd \
+       --regex 'SLAPD_SERVICES=.*' \
+       --state absent
+
+    require="__line/rm_slapd_conf" __line add_slapd_conf \
+       --file ${ETC}/default/slapd \
+       --line 'SLAPD_CONF=${SLAPD_DIR}/slapd.conf' \
+       --state present
+
+    require="__line/rm_slapd_services" __line add_slapd_services \
+       --file ${ETC}/default/slapd \
+       --line "SLAPD_SERVICES=\"ldap://localhost/ ldap://${name}/\"" \
+       --state present
+fi
+
+
+if [ -z "${_skip_letsencrypt_cert}" ]; then
+    if [ -f "${__object}/parameter/staging" ]; then
+        staging="--staging"
+    else
+        staging=""
+    fi
+
+    __letsencrypt_cert "${name}" --admin-email technik@ungleich.ch \
+        --renew-hook "cp ${ETC}/letsencrypt/live/${name}/*.pem ${SLAPD_DIR}/sasl2 && chown -R openldap:openldap ${SLAPD_DIR}/sasl2 && service slapd restart" \
+        --automatic-renewal ${staging}
+fi
+
+require="__package/slapd" __directory ${SLAPD_DIR}/slapd.d --state absent
+
+if [ -z "${_skip_letsencrypt_cert}" ]; then
+    require="__package/slapd __letsencrypt_cert/${name}" \
+           __file ${SLAPD_DIR}/slapd.conf --owner root --group root --mode 644 \
+           --source "${ldapconf}"
+else
+    require="__package/slapd" \
+           __file ${SLAPD_DIR}/slapd.conf --owner root --group root --mode 644 \
+           --source "${ldapconf}"
+fi
+
+# Start slapd.conf
+cat << EOF > "${ldapconf}"
+pidfile ${SLAPD_RUN_DIR}/slapd.pid
+argsfile ${SLAPD_RUN_DIR}/slapd.args
+
+TLSCipherSuite NORMAL
+TLSCertificateFile ${tls_cert}
+TLSCertificateKeyFile ${tls_privkey}
+TLSCACertificateFile ${tls_ca}
+
+disallow bind_anon
+require bind
+security tls=1
+
+include ${SLAPD_DIR}/schema/corba.schema
+include ${SLAPD_DIR}/schema/core.schema
+include ${SLAPD_DIR}/schema/cosine.schema
+include ${SLAPD_DIR}/schema/duaconf.schema
+include ${SLAPD_DIR}/schema/dyngroup.schema
+include ${SLAPD_DIR}/schema/inetorgperson.schema
+include ${SLAPD_DIR}/schema/java.schema
+include ${SLAPD_DIR}/schema/misc.schema
+include ${SLAPD_DIR}/schema/nis.schema
+include ${SLAPD_DIR}/schema/openldap.schema
+include ${SLAPD_DIR}/schema/ppolicy.schema
+include ${SLAPD_DIR}/schema/collective.schema
+
+modulepath ${SLAPD_MODULE_PATH}
+EOF
+
+# Add specified modules
+for module in ${slapd_modules}; do
+    echo "moduleload ${module}.la" >> "${ldapconf}"
+done
+
+# Rest of the config
+cat << EOF >> "${ldapconf}"
+loglevel 1024
+
+database mdb
+maxsize 1073741824
+
+suffix "${suffix}"
+directory ${SLAPD_DATA_DIR}
+rootdn "${manager_dn}"
+rootpw "${manager_password_hash}"
+
+index objectClass eq,pres
+index ou,cn,mail,surname,givenname eq,pres,sub
+index uidNumber,gidNumber,loginShell eq,pres
+index uid,memberUid eq,pres,sub
+index nisMapName,nisMapEntry eq,pres,sub
+index entryCSN,entryUUID eq
+
+serverid ${serverid}
+EOF
+
+# Setup replication
+if [ "${replication}" ]; then
+    rid=1;
+    for syncrepl in ${syncrepl_hosts}; do
+    cat <<EOF >> "${ldapconf}"
+syncrepl rid=${rid}
+ provider=ldap://${syncrepl}
+ bindmethod=simple
+ starttls=yes
+ binddn="${manager_dn}"
+ credentials=${syncrepl_credentials}
+ searchbase="${syncrepl_searchbase}"
+ type=refreshAndPersist
+ retry="5 + 5 +"
+ interval=00:00:00:05
+EOF
+    rid=$((rid + 1))
+    done
+    cat <<EOF >> "${ldapconf}"
+mirrormode true
+overlay syncprov
+syncprov-checkpoint 100 5
+syncprov-sessionlog 100
+
+database monitor
+limits dn.exact="${manager_dn}" time=unlimited size=unlimited
+EOF
+fi
diff --git a/cdist/conf/type/__openldap_server/parameter/boolean b/cdist/conf/type/__openldap_server/parameter/boolean
new file mode 100644
index 00000000..45056fe9
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/parameter/boolean
@@ -0,0 +1,2 @@
+staging
+replicate
diff --git a/cdist/conf/type/__openldap_server/parameter/optional b/cdist/conf/type/__openldap_server/parameter/optional
new file mode 100644
index 00000000..a9a8ab2c
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/parameter/optional
@@ -0,0 +1,4 @@
+description
+syncrepl-credentials
+syncrepl-searchbase
+tls-cert
diff --git a/cdist/conf/type/__openldap_server/parameter/optional_multiple b/cdist/conf/type/__openldap_server/parameter/optional_multiple
new file mode 100644
index 00000000..107c03d9
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/parameter/optional_multiple
@@ -0,0 +1,2 @@
+syncrepl-host
+module
diff --git a/cdist/conf/type/__openldap_server/parameter/required b/cdist/conf/type/__openldap_server/parameter/required
new file mode 100644
index 00000000..1ee6f219
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/parameter/required
@@ -0,0 +1,4 @@
+manager-dn
+manager-password-hash
+serverid
+suffix

From fd430eab622206b9a04780ca5fa9d7c807f16c93 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Mon, 9 Dec 2019 19:39:43 +0100
Subject: [PATCH 231/383] [new-type] __openldap_server: Add a "schema" optional
 parameter.

---
 cdist/conf/type/__openldap_server/man.rst     |  7 +++++
 cdist/conf/type/__openldap_server/manifest    | 29 +++++++------------
 .../parameter/default/schema                  | 12 ++++++++
 .../type/__openldap_server/parameter/optional |  3 +-
 4 files changed, 31 insertions(+), 20 deletions(-)
 create mode 100644 cdist/conf/type/__openldap_server/parameter/default/schema

diff --git a/cdist/conf/type/__openldap_server/man.rst b/cdist/conf/type/__openldap_server/man.rst
index 29bbc231..1fc24eaa 100644
--- a/cdist/conf/type/__openldap_server/man.rst
+++ b/cdist/conf/type/__openldap_server/man.rst
@@ -74,6 +74,13 @@ module
     LDAP module to load. See `slapd.conf(5)`.
     Default value is OS-dependent, see manifest.
 
+schema
+    Name of LDAP schema to load. Must be the name without extension of a
+    `.schema` file in slapd's schema directory (usually `/etc/slapd/schema` or
+    `/usr/local/etc/openldap/schema`).
+    Example value: `inetorgperson`
+    The type user must ensure that the schema file is deployed.
+    This defaults to a sensible subset, for details see the type definition.
 
 BOOLEAN PARAMETERS
 ------------------
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index 2acaaed5..518edd86 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -6,6 +6,7 @@ manager_password_hash=$(cat "${__object}/parameter/manager-password-hash")
 serverid=$(cat "${__object}/parameter/serverid")
 suffix=$(cat "${__object}/parameter/suffix")
 slapd_modules=$(cat "${__object}/parameter/module" || true)
+schemas=$(cat "${__object}/parameter/schema")
 
 
 OS="$(cat "${__global}/explorer/os")"
@@ -14,8 +15,8 @@ OS="$(cat "${__global}/explorer/os")"
 # TODO: treat other OS better, defaulting to Debian-like
 case "${OS}" in
     freebsd)
-	      PKGS="openldap-server"
-	      ETC="/usr/local/etc"
+        PKGS="openldap-server"
+        ETC="/usr/local/etc"
         SLAPD_DIR="/usr/local/etc/openldap"
         SLAPD_DATA_DIR="/var/db/openldap-data"
         SLAPD_RUN_DIR="/var/run/openldap"
@@ -27,7 +28,7 @@ case "${OS}" in
         ;;
     *)
         PKGS="slapd ldap-utils"
-	      ETC="/etc"
+        ETC="/etc"
         SLAPD_DIR="/etc/ldap"
         SLAPD_DATA_DIR="/var/lib/ldap"
         SLAPD_RUN_DIR="/var/run/slapd"
@@ -39,7 +40,6 @@ case "${OS}" in
 esac
 
 
-
 # Determine if __letsencrypt_cert is to be used and setup vars accordingly
 if [ -f "${__object}/parameter/tls-cert" ]; then
     tls_cert=$(cat "${__object}/parameter/tls-cert")
@@ -161,24 +161,15 @@ TLSCACertificateFile ${tls_ca}
 disallow bind_anon
 require bind
 security tls=1
-
-include ${SLAPD_DIR}/schema/corba.schema
-include ${SLAPD_DIR}/schema/core.schema
-include ${SLAPD_DIR}/schema/cosine.schema
-include ${SLAPD_DIR}/schema/duaconf.schema
-include ${SLAPD_DIR}/schema/dyngroup.schema
-include ${SLAPD_DIR}/schema/inetorgperson.schema
-include ${SLAPD_DIR}/schema/java.schema
-include ${SLAPD_DIR}/schema/misc.schema
-include ${SLAPD_DIR}/schema/nis.schema
-include ${SLAPD_DIR}/schema/openldap.schema
-include ${SLAPD_DIR}/schema/ppolicy.schema
-include ${SLAPD_DIR}/schema/collective.schema
-
-modulepath ${SLAPD_MODULE_PATH}
 EOF
 
+# Add specified schemas
+for schema in ${schemas}; do
+    echo "include ${SLAPD_DIR}/schema/${schema}.schema" >> "${ldapconf}"
+done
+
 # Add specified modules
+echo "modulepath ${SLAPD_MODULE_PATH}" >> "${ldapconf}"
 for module in ${slapd_modules}; do
     echo "moduleload ${module}.la" >> "${ldapconf}"
 done
diff --git a/cdist/conf/type/__openldap_server/parameter/default/schema b/cdist/conf/type/__openldap_server/parameter/default/schema
new file mode 100644
index 00000000..825bdb15
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/parameter/default/schema
@@ -0,0 +1,12 @@
+corba
+core
+cosine
+duaconf
+dyngroup
+inetorgperson
+java
+misc
+nis
+openldap
+ppolicy
+collective
diff --git a/cdist/conf/type/__openldap_server/parameter/optional b/cdist/conf/type/__openldap_server/parameter/optional
index a9a8ab2c..53587c4e 100644
--- a/cdist/conf/type/__openldap_server/parameter/optional
+++ b/cdist/conf/type/__openldap_server/parameter/optional
@@ -1,4 +1,5 @@
-description
 syncrepl-credentials
 syncrepl-searchbase
 tls-cert
+tls-privkey
+tls-ca

From 1ad605a509cfd534334111c1d6c1ea8682446b10 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Mon, 9 Dec 2019 19:49:05 +0100
Subject: [PATCH 232/383] [new-type] __openldap_server: Add admin-email
 parameter.

---
 cdist/conf/type/__openldap_server/man.rst            | 5 +++++
 cdist/conf/type/__openldap_server/manifest           | 8 +++++++-
 cdist/conf/type/__openldap_server/parameter/optional | 1 +
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__openldap_server/man.rst b/cdist/conf/type/__openldap_server/man.rst
index 1fc24eaa..4447971a 100644
--- a/cdist/conf/type/__openldap_server/man.rst
+++ b/cdist/conf/type/__openldap_server/man.rst
@@ -48,6 +48,11 @@ syncrepl-searchbase
     The searchbase to use for replication.
     E.g. `dc=ungleich,dc=ch`. See `slapd.conf(5)`.
 
+admin-email
+    Passed to `cdist-type__letsencrypt_cert`; has otherwise no use.
+    Required if using `__letsencrypt_cert`.
+    Where to send Let's Encrypt emails like "certificate needs renewal".
+
 tls-cert
     If defined, `__letsencrypt_cert` is not used and this must be the path in
     the remote hosts to the PEM-encoded TLS certificate.
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index 518edd86..e10432d6 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -58,6 +58,12 @@ if [ -f "${__object}/parameter/tls-cert" ]; then
 
     _skip_letsencrypt_cert="YES"
 else
+    if [ ! -f "${__object}/parameter/admin-email" ]; then
+        echo "When using __letsencrypt_cert, admin-email is also required." >&2
+        exit 1
+    fi
+    admin_email=$(cat "${__object}/parameter/admin-email")
+
     tls_cert="${SLAPD_DIR}/sasl2/cert.pem"
     tls_privkey="${SLAPD_DIR}/sasl2/privkey.pem"
     tls_ca="${SLAPD_DIR}/sasl2/chain.pem"
@@ -131,7 +137,7 @@ if [ -z "${_skip_letsencrypt_cert}" ]; then
         staging=""
     fi
 
-    __letsencrypt_cert "${name}" --admin-email technik@ungleich.ch \
+    __letsencrypt_cert "${name}" --admin-email "${admin_email}" \
         --renew-hook "cp ${ETC}/letsencrypt/live/${name}/*.pem ${SLAPD_DIR}/sasl2 && chown -R openldap:openldap ${SLAPD_DIR}/sasl2 && service slapd restart" \
         --automatic-renewal ${staging}
 fi
diff --git a/cdist/conf/type/__openldap_server/parameter/optional b/cdist/conf/type/__openldap_server/parameter/optional
index 53587c4e..f4254cb6 100644
--- a/cdist/conf/type/__openldap_server/parameter/optional
+++ b/cdist/conf/type/__openldap_server/parameter/optional
@@ -1,5 +1,6 @@
 syncrepl-credentials
 syncrepl-searchbase
+admin-email
 tls-cert
 tls-privkey
 tls-ca

From 42914d26c5addae027cc382ec035a687cd3aaf6d Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Mon, 9 Dec 2019 19:59:15 +0100
Subject: [PATCH 233/383] [new-type] __openldap_server: sudo make nico.happy.

---
 cdist/conf/type/__openldap_server/manifest | 53 ++++++++++++----------
 1 file changed, 30 insertions(+), 23 deletions(-)

diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index e10432d6..ffd92626 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -9,11 +9,10 @@ slapd_modules=$(cat "${__object}/parameter/module" || true)
 schemas=$(cat "${__object}/parameter/schema")
 
 
-OS="$(cat "${__global}/explorer/os")"
+os="$(cat "${__global}/explorer/os")"
 
 # Setup OS-dependent vars
-# TODO: treat other OS better, defaulting to Debian-like
-case "${OS}" in
+case "${os}" in
     freebsd)
         PKGS="openldap-server"
         ETC="/usr/local/etc"
@@ -26,7 +25,7 @@ case "${OS}" in
             slapd_modules="back_mdb back_monitor"
         fi
         ;;
-    *)
+    debian|ubuntu|devuan)
         PKGS="slapd ldap-utils"
         ETC="/etc"
         SLAPD_DIR="/etc/ldap"
@@ -37,6 +36,10 @@ case "${OS}" in
             slapd_modules="back_mdb ppolicy syncprov back_monitor"
         fi
         ;;
+    *)
+        echo "Don't know the openldap defaults for: $os" >&2
+        exit 1
+        ;;
 esac
 
 
@@ -106,28 +109,32 @@ done
 # TODO: Implement __start_on_boot for BSD
 require="__package/slapd" __start_on_boot slapd
 
-# TODO: treat other OS better. Defaulting to Debian-like.
-if [ "${OS}" != "freebsd" ]; then
-    require="__package/slapd" __line rm_slapd_conf \
-       --file ${ETC}/default/slapd \
-       --regex 'SLAPD_CONF=.*' \
-       --state absent
+case "${os}" in
+    debian|ubuntu|devuan)
+        require="__package/slapd" __line rm_slapd_conf \
+               --file ${ETC}/default/slapd \
+               --regex 'SLAPD_CONF=.*' \
+               --state absent
 
-    require="__package/slapd" __line rm_slapd_services \
-       --file ${ETC}/default/slapd \
-       --regex 'SLAPD_SERVICES=.*' \
-       --state absent
+        require="__package/slapd" __line rm_slapd_services \
+               --file ${ETC}/default/slapd \
+               --regex 'SLAPD_SERVICES=.*' \
+               --state absent
 
-    require="__line/rm_slapd_conf" __line add_slapd_conf \
-       --file ${ETC}/default/slapd \
-       --line 'SLAPD_CONF=${SLAPD_DIR}/slapd.conf' \
-       --state present
+        require="__line/rm_slapd_conf" __line add_slapd_conf \
+               --file ${ETC}/default/slapd \
+               --line 'SLAPD_CONF=${SLAPD_DIR}/slapd.conf' \
+               --state present
 
-    require="__line/rm_slapd_services" __line add_slapd_services \
-       --file ${ETC}/default/slapd \
-       --line "SLAPD_SERVICES=\"ldap://localhost/ ldap://${name}/\"" \
-       --state present
-fi
+        require="__line/rm_slapd_services" __line add_slapd_services \
+               --file ${ETC}/default/slapd \
+               --line "SLAPD_SERVICES=\"ldap://localhost/ ldap://${name}/\"" \
+               --state present
+        ;;
+    *)
+        # Nothing to do here, move on.
+        ;;
+esac
 
 
 if [ -z "${_skip_letsencrypt_cert}" ]; then

From 22c5cd550bb1069c2bb8106bbe907f016b9b821a Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Tue, 10 Dec 2019 12:49:07 +0100
Subject: [PATCH 234/383] [new-type] __openldap_server: first public version.

This already takes care of setting up the base DN and managing it as well as
allowing for settings for the listener URLS.

The type was also made a singleton as it doesn't make much sense to setup
multiple LDAP servers on the same machine.
---
 .../type/__openldap_server/gencode-remote     |  44 ++++++
 cdist/conf/type/__openldap_server/man.rst     | 126 +++++++++++++-----
 cdist/conf/type/__openldap_server/manifest    |  48 +++++--
 .../parameter/default/description             |   1 +
 .../type/__openldap_server/parameter/optional |   4 +-
 .../parameter/optional_multiple               |   1 +
 .../type/__openldap_server/parameter/required |   1 +
 .../parameter/required_multiple               |   1 +
 cdist/conf/type/__openldap_server/singleton   |   0
 9 files changed, 176 insertions(+), 50 deletions(-)
 create mode 100644 cdist/conf/type/__openldap_server/gencode-remote
 create mode 100644 cdist/conf/type/__openldap_server/parameter/default/description
 create mode 100644 cdist/conf/type/__openldap_server/parameter/required_multiple
 create mode 100644 cdist/conf/type/__openldap_server/singleton

diff --git a/cdist/conf/type/__openldap_server/gencode-remote b/cdist/conf/type/__openldap_server/gencode-remote
new file mode 100644
index 00000000..0ac434af
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/gencode-remote
@@ -0,0 +1,44 @@
+#!/bin/sh
+
+manager_dn=$(cat "${__object}/parameter/manager-dn")
+manager_password=$(cat "${__object}/parameter/manager-password")
+description=$(cat "${__object}/parameter/description")
+suffix=$(cat "${__object}/parameter/suffix")
+suffix_dc=$(echo -n ${suffix} | awk -F',' '{print $1}' | awk -F'=' '{print $2}')
+
+SLAPD_IPC=$(cat "${__object}/parameter/slapd-url" | tr '\n' ' ' | awk '{ print $1}')
+
+cat <<DONE # | tee /dev/stderr
+# Restart service
+service slapd restart
+# It can sometimes take a tiny bit to bind
+sleep 1
+# Create or update base object
+if ldapsearch -xZ -D "${manager_dn}" -w "${manager_password}" -H '${SLAPD_IPC}' -b '${suffix}' -s base 2>&1 > /dev/null; then
+    # Already exists, use ldapmodify
+    ldapmodify -xZ -D "${manager_dn}" -w "${manager_password}" -H '${SLAPD_IPC}' <<EOF
+dn: ${suffix}
+changetype: modify
+replace: objectClass
+objectClass: top
+objectClass: dcObject
+objectClass: organization
+-
+replace: o
+o: ${description}
+-
+replace: dc
+dc: ${suffix_dc}
+EOF
+else
+    # Does not exist, use ldapadd
+    ldapadd -xZ -D "${manager_dn}" -w "${manager_password}" -H '${SLAPD_IPC}' <<EOF
+dn: ${suffix}
+objectClass: top
+objectClass: dcObject
+objectClass: organization
+o: ${description}
+dc: ${suffix_dc}
+EOF
+fi
+DONE
diff --git a/cdist/conf/type/__openldap_server/man.rst b/cdist/conf/type/__openldap_server/man.rst
index 4447971a..84b534bd 100644
--- a/cdist/conf/type/__openldap_server/man.rst
+++ b/cdist/conf/type/__openldap_server/man.rst
@@ -10,6 +10,9 @@ DESCRIPTION
 -----------
 This type can be used to bootstrap an LDAP environment using openldap as slapd.
 
+It bootstraps the LDAP server with sane defaults and creates and manages the
+base DN defined by `suffix`.
+
 
 REQUIRED PARAMETERS
 -------------------
@@ -17,14 +20,19 @@ manager-dn
     The rootdn to set up in the directory.
     E.g. `cn=manager,dc=ungleich,dc=ch`. See `slapd.conf(5)`.
 
+manager-password
+    The password for `manager-dn` in the directory.
+    This will be used to connect to the LDAP server on the first `slapd-url`
+    with the given `manager-dn`.
+
 manager-password-hash
     The password for `manager-dn` in the directory.
     This should be valid for `slapd.conf` like `{SSHA}qV+mCs3u8Q2sCmUXT4Ybw7MebHTASMyr`.
     Generate e.g. with: `slappasswd -s weneedgoodsecurity`.
     See `slappasswd(8C)`, `slapd.conf(5)`.
     TODO: implement this: http://blog.adamsbros.org/2015/06/09/openldap-ssha-salted-hashes-by-hand/
-      to allow for a manager-password parameter and ensure idempotency (care with salts).
-      Such manager-password parameter should be mutually exclusive with this one.
+      to derive from the manager-password parameter and ensure idempotency (care with salts).
+      At that point, manager-password-hash should be deprecated and ignored.
 
 serverid
     The server for the directory.
@@ -35,6 +43,17 @@ suffix
     E.g. `dc=ungleich,dc=ch`. See `slapd.conf(5)`.
 
 
+REQUIRED MULTIPLE PARAMETERS
+----------------------------
+slapd-url
+    A URL for slapd to listen on.
+    Pass once for each URL you want to support,
+    e.g.: `--slapd-url ldaps://my.fqdn/ --slapd-url ldap://my.fqdn/`.
+    The first instance that is passed will be used as the main URL to
+    connect to this LDAP server
+    See the `-h` flag in `slapd(8C)`.
+
+
 OPTIONAL PARAMETERS
 -------------------
 syncrepl-credentials
@@ -53,6 +72,11 @@ admin-email
     Required if using `__letsencrypt_cert`.
     Where to send Let's Encrypt emails like "certificate needs renewal".
 
+tls-cipher-suite
+    Setting for TLSCipherSuite.
+    Defaults to `NORMAL` in a Debian-like OS and `HIGH:MEDIUM:+SSLv2` on FreeBSD.
+    See `slapd.conf(5)`.
+
 tls-cert
     If defined, `__letsencrypt_cert` is not used and this must be the path in
     the remote hosts to the PEM-encoded TLS certificate.
@@ -87,6 +111,11 @@ schema
     The type user must ensure that the schema file is deployed.
     This defaults to a sensible subset, for details see the type definition.
 
+description
+    The description of the base DN passed in the `suffix` parameter.
+    Defaults to `Managed by cdist, do not edit manually.`
+
+
 BOOLEAN PARAMETERS
 ------------------
 staging
@@ -97,48 +126,71 @@ replicate
     Whether to setup replication or not.
     If present `syncrepl-credentials` and `syncrepl-host` are also required.
 
+
 EXAMPLES
 --------
 
 .. code-block:: sh
 
-    # Modify the ruleset on $__target_host:
-    __pf_ruleset --state present --source /my/pf/ruleset.conf
-    require="__pf_ruleset" \
-       __pf_apply
+    # Example of a simple server with manual certificate management.
+    pki_prefix="/usr/local/etc/pki/realms/ldap.camilion.cloud" \
+      __openldap_server \
+        --manager-dn 'cn=manager,dc=camilion,dc=cloud' \
+        --manager-password "foo" \
+        --manager-password-hash '{SSHA}foo' \
+        --serverid 0 \
+        --suffix 'dc=camilion,dc=cloud' \
+        --slapd-url 'ldaps://ldap.camilion.cloud' \
+        --tls-cert '${pki_prefix}/default.crt' \
+        --tls-privkey '${pki_prefix}/default.key' \
+        --tls-ca '${pki_prefix}/CA.crt'
 
-    # Remove the ruleset on $__target_host (implies disabling pf(4):
-    __pf_ruleset --state absent
-    require="__pf_ruleset" \
-       __pf_apply
-
-    root@ldap-for-guacamole:~# cat ldapbase.ldif
-    dn: dc=guaca-test,dc=ungleich,dc=ch
-    objectClass: top
-    objectClass: dcObject
-    objectClass: organization
-    o: Some description
-    dc: guaca-test
-
-
-    # Sample usage:
+    # The created basedn looks as follows:
     #
-    # id=1
-    # for host in ldap-test1.ungleich.ch ldap-test2.ungleich.ch; do
-    #     echo "__ungleich_ldap ${host} \
-    #         --manager-dn 'cn=manager,dc=ungleich,dc=ch' \
-    #         --manager-password '{SSHA}fooo' \
-    #         --serverid '${id}' \
-    #         --staging \
-    #         --suffix 'dc=ungleich,dc=ch' \
-    #         --searchbase 'dc=ungleich,dc=ch' \
-    #         --syncrepl-credentials 'fooo' \
-    #         --syncrepl-host 'ldap-test1.ungleich.ch' \
-    #         --syncrepl-host 'ldap-test2.ungleich.ch' \
-    #         --descriptiont 'Ungleich LDAP server'" \
-    #         | cdist config -i - -v ${host}
-    #     id=$((id + 1))
-    # done
+    # dn: dc=camilion,dc=cloud
+    # objectClass: top
+    # objectClass: dcObject
+    # objectClass: organization
+    # o: Managed by cdist, do not edit manually.
+    # dc: camilion
+    #
+    # Do not change it manually, the type will overwrite your changes.
+
+
+    #
+    # Changing to a replicated setup is a simple change to something like:
+    #
+    # Example for multiple servers with replication and automatic
+    # Let's Encrypt certificate management through certbot.
+    id=1
+    for host in ldap-test1.ungleich.ch ldap-test2.ungleich.ch; do
+        echo "__ungleich_ldap \
+            --manager-dn 'cn=manager,dc=ungleich,dc=ch' \
+            --manager-psasword 'foo' \
+            --manager-password-hash '{SSHA}fooo' \
+            --serverid '${id}' \
+            --suffix 'dc=ungleich,dc=ch' \
+            --slapd-url ldap://${host} \
+            --searchbase 'dc=ungleich,dc=ch' \
+            --syncrepl-credentials 'fooo' \
+            --syncrepl-host 'ldap-test1.ungleich.ch' \
+            --syncrepl-host 'ldap-test2.ungleich.ch' \
+            --description 'Ungleich LDAP server'" \
+            --staging \
+            | cdist config -i - -v ${host}
+        id=$((id + 1))
+    done
+
+    # The created basedn looks as follows:
+    #
+    # dn: dc=ungleich,dc=ch
+    # objectClass: top
+    # objectClass: dcObject
+    # objectClass: organization
+    # o: Ungleich LDAP server
+    # dc: ungleich
+    #
+    # Do not change it manually, the type will overwrite your changes.
 
 
 SEE ALSO
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index ffd92626..2d1df32f 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -5,13 +5,17 @@ manager_dn=$(cat "${__object}/parameter/manager-dn")
 manager_password_hash=$(cat "${__object}/parameter/manager-password-hash")
 serverid=$(cat "${__object}/parameter/serverid")
 suffix=$(cat "${__object}/parameter/suffix")
-slapd_modules=$(cat "${__object}/parameter/module" || true)
+slapd_modules=$(cat "${__object}/parameter/module" 2>/dev/null || true)
 schemas=$(cat "${__object}/parameter/schema")
+slapd_urls=$(cat "${__object}/parameter/slapd-url" | tr '\n' ' ')
+tls_cipher_suite=$(cat "${__object}/parameter/tls-cipher-suite" 2>/dev/null || true)
 
 
 os="$(cat "${__global}/explorer/os")"
 
 # Setup OS-dependent vars
+CONF_OWNER="root"
+CONF_GROUP="root"
 case "${os}" in
     freebsd)
         PKGS="openldap-server"
@@ -24,6 +28,12 @@ case "${os}" in
             # It looks like ppolicy and syncprov must be compiled
             slapd_modules="back_mdb back_monitor"
         fi
+        CONF_OWNER="ldap"
+        CONF_GROUP="ldap"
+        if [ -z "${tls_cipher_suite}" ]; then
+            # TODO: research default for FreeBSD. 'NORMAL' appears to not work
+            tls_cipher_suite="HIGH:MEDIUM:+SSLv2"
+        fi
         ;;
     debian|ubuntu|devuan)
         PKGS="slapd ldap-utils"
@@ -35,6 +45,9 @@ case "${os}" in
         if [ -z "${slapd_modules}" ]; then
             slapd_modules="back_mdb ppolicy syncprov back_monitor"
         fi
+        if [ -z "${tls_cipher_suite}" ]; then
+            tls_cipher_suite="NORMAL"
+        fi
         ;;
     *)
         echo "Don't know the openldap defaults for: $os" >&2
@@ -42,6 +55,8 @@ case "${os}" in
         ;;
 esac
 
+PKG_MAIN=$(echo ${PKGS} | awk '{print $1;}')
+
 
 # Determine if __letsencrypt_cert is to be used and setup vars accordingly
 if [ -f "${__object}/parameter/tls-cert" ]; then
@@ -106,17 +121,26 @@ for pkg in ${PKGS}; do
 done
 
 
-# TODO: Implement __start_on_boot for BSD
-require="__package/slapd" __start_on_boot slapd
+require="__package/${PKG_MAIN}" __start_on_boot slapd
 
+# Setup -h flag for the listeners. See man slapd (-h flag).
 case "${os}" in
+    freebsd)
+        require="__package/${PKG_MAIN}" __key_value \
+               --file "/etc/rc.conf" \
+               --key "slapd_flags" \
+               --value "\"-h '${slapd_urls}'\"" \
+               --delimiter "=" \
+               --comment "# LDAP Listener URLs" \
+               "${__target_host}__slapd_flags"
+        ;;
     debian|ubuntu|devuan)
-        require="__package/slapd" __line rm_slapd_conf \
+        require="__package/${PKG_MAIN}" __line rm_slapd_conf \
                --file ${ETC}/default/slapd \
                --regex 'SLAPD_CONF=.*' \
                --state absent
 
-        require="__package/slapd" __line rm_slapd_services \
+        require="__package/${PKG_MAIN}" __line rm_slapd_services \
                --file ${ETC}/default/slapd \
                --regex 'SLAPD_SERVICES=.*' \
                --state absent
@@ -128,7 +152,7 @@ case "${os}" in
 
         require="__line/rm_slapd_services" __line add_slapd_services \
                --file ${ETC}/default/slapd \
-               --line "SLAPD_SERVICES=\"ldap://localhost/ ldap://${name}/\"" \
+               --line "SLAPD_SERVICES=\"${slapd_urls}\"" \
                --state present
         ;;
     *)
@@ -149,15 +173,15 @@ if [ -z "${_skip_letsencrypt_cert}" ]; then
         --automatic-renewal ${staging}
 fi
 
-require="__package/slapd" __directory ${SLAPD_DIR}/slapd.d --state absent
+require="__package/${PKG_MAIN}" __directory ${SLAPD_DIR}/slapd.d --state absent
 
 if [ -z "${_skip_letsencrypt_cert}" ]; then
-    require="__package/slapd __letsencrypt_cert/${name}" \
-           __file ${SLAPD_DIR}/slapd.conf --owner root --group root --mode 644 \
+    require="__package/${PKG_MAIN} __letsencrypt_cert/${name}" \
+           __file ${SLAPD_DIR}/slapd.conf --owner ${CONF_OWNER} --group ${CONF_GROUP} --mode 644 \
            --source "${ldapconf}"
 else
-    require="__package/slapd" \
-           __file ${SLAPD_DIR}/slapd.conf --owner root --group root --mode 644 \
+    require="__package/${PKG_MAIN}" \
+           __file ${SLAPD_DIR}/slapd.conf --owner ${CONF_OWNER} --group ${CONF_GROUP} --mode 644 \
            --source "${ldapconf}"
 fi
 
@@ -166,7 +190,7 @@ cat << EOF > "${ldapconf}"
 pidfile ${SLAPD_RUN_DIR}/slapd.pid
 argsfile ${SLAPD_RUN_DIR}/slapd.args
 
-TLSCipherSuite NORMAL
+TLSCipherSuite ${tls_cipher_suite}
 TLSCertificateFile ${tls_cert}
 TLSCertificateKeyFile ${tls_privkey}
 TLSCACertificateFile ${tls_ca}
diff --git a/cdist/conf/type/__openldap_server/parameter/default/description b/cdist/conf/type/__openldap_server/parameter/default/description
new file mode 100644
index 00000000..6d8e37e1
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/parameter/default/description
@@ -0,0 +1 @@
+Managed by cdist, do not edit manually.
diff --git a/cdist/conf/type/__openldap_server/parameter/optional b/cdist/conf/type/__openldap_server/parameter/optional
index f4254cb6..a92b9c6e 100644
--- a/cdist/conf/type/__openldap_server/parameter/optional
+++ b/cdist/conf/type/__openldap_server/parameter/optional
@@ -1,6 +1,8 @@
+description
 syncrepl-credentials
 syncrepl-searchbase
 admin-email
+tls-cipher-suite
 tls-cert
 tls-privkey
-tls-ca
+tls-ca
\ No newline at end of file
diff --git a/cdist/conf/type/__openldap_server/parameter/optional_multiple b/cdist/conf/type/__openldap_server/parameter/optional_multiple
index 107c03d9..52a83d5c 100644
--- a/cdist/conf/type/__openldap_server/parameter/optional_multiple
+++ b/cdist/conf/type/__openldap_server/parameter/optional_multiple
@@ -1,2 +1,3 @@
 syncrepl-host
 module
+schema
diff --git a/cdist/conf/type/__openldap_server/parameter/required b/cdist/conf/type/__openldap_server/parameter/required
index 1ee6f219..ff58158d 100644
--- a/cdist/conf/type/__openldap_server/parameter/required
+++ b/cdist/conf/type/__openldap_server/parameter/required
@@ -1,4 +1,5 @@
 manager-dn
+manager-password
 manager-password-hash
 serverid
 suffix
diff --git a/cdist/conf/type/__openldap_server/parameter/required_multiple b/cdist/conf/type/__openldap_server/parameter/required_multiple
new file mode 100644
index 00000000..848b8dc2
--- /dev/null
+++ b/cdist/conf/type/__openldap_server/parameter/required_multiple
@@ -0,0 +1 @@
+slapd-url
\ No newline at end of file
diff --git a/cdist/conf/type/__openldap_server/singleton b/cdist/conf/type/__openldap_server/singleton
new file mode 100644
index 00000000..e69de29b

From 79d58f0813fd08c77d826ac552dfdb9e0f40dbbd Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Tue, 10 Dec 2019 13:04:24 +0100
Subject: [PATCH 235/383] [new-type] __openldap_server: fix docs / dependency.

It's nicer to have slapd_flags after slapd_enable in rc.conf on freebsd.
---
 cdist/conf/type/__openldap_server/man.rst  | 6 +++---
 cdist/conf/type/__openldap_server/manifest | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cdist/conf/type/__openldap_server/man.rst b/cdist/conf/type/__openldap_server/man.rst
index 84b534bd..1c2c9b70 100644
--- a/cdist/conf/type/__openldap_server/man.rst
+++ b/cdist/conf/type/__openldap_server/man.rst
@@ -141,9 +141,9 @@ EXAMPLES
         --serverid 0 \
         --suffix 'dc=camilion,dc=cloud' \
         --slapd-url 'ldaps://ldap.camilion.cloud' \
-        --tls-cert '${pki_prefix}/default.crt' \
-        --tls-privkey '${pki_prefix}/default.key' \
-        --tls-ca '${pki_prefix}/CA.crt'
+        --tls-cert "${pki_prefix}/default.crt" \
+        --tls-privkey "${pki_prefix}/default.key" \
+        --tls-ca "${pki_prefix}/CA.crt"
 
     # The created basedn looks as follows:
     #
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index 2d1df32f..070a31d5 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -126,7 +126,7 @@ require="__package/${PKG_MAIN}" __start_on_boot slapd
 # Setup -h flag for the listeners. See man slapd (-h flag).
 case "${os}" in
     freebsd)
-        require="__package/${PKG_MAIN}" __key_value \
+        require="__start_on_boot/slapd" __key_value \
                --file "/etc/rc.conf" \
                --key "slapd_flags" \
                --value "\"-h '${slapd_urls}'\"" \

From 35f0d4dbfa9307923fa013ff806d30087a8cf291 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Tue, 10 Dec 2019 13:10:19 +0100
Subject: [PATCH 236/383] [new-type] __openldap_server: another documentation
 typo.

---
 cdist/conf/type/__openldap_server/man.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__openldap_server/man.rst b/cdist/conf/type/__openldap_server/man.rst
index 1c2c9b70..d20101d1 100644
--- a/cdist/conf/type/__openldap_server/man.rst
+++ b/cdist/conf/type/__openldap_server/man.rst
@@ -133,8 +133,8 @@ EXAMPLES
 .. code-block:: sh
 
     # Example of a simple server with manual certificate management.
-    pki_prefix="/usr/local/etc/pki/realms/ldap.camilion.cloud" \
-      __openldap_server \
+    pki_prefix="/usr/local/etc/pki/realms/ldap.camilion.cloud"
+    __openldap_server \
         --manager-dn 'cn=manager,dc=camilion,dc=cloud' \
         --manager-password "foo" \
         --manager-password-hash '{SSHA}foo' \

From 3ba230c10db98cf2cddb0aeeb256392223fb2558 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Tue, 10 Dec 2019 13:12:54 +0100
Subject: [PATCH 237/383] [type-docs] __start_on_boot: remove unspported *BSD
 claim.

The type appears to support {Open,Free}BSD properly.
---
 cdist/conf/type/__start_on_boot/man.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__start_on_boot/man.rst b/cdist/conf/type/__start_on_boot/man.rst
index b7c73ab1..f8afe94b 100644
--- a/cdist/conf/type/__start_on_boot/man.rst
+++ b/cdist/conf/type/__start_on_boot/man.rst
@@ -12,7 +12,7 @@ This cdist type allows you to enable or disable stuff to be started
 at boot of your operating system.
 
 Warning: This type has not been tested intensively and is not fully
-supported (i.e. \*BSD are not implemented).
+supported.
 
 
 REQUIRED PARAMETERS

From 3c62a88ca7907b15dc501ddb3395c66b6196cb13 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 10 Dec 2019 19:33:29 +0100
Subject: [PATCH 238/383] ++changelog

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 04ffac62..186dce7a 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -9,6 +9,8 @@ next:
 	* Documentation: PreOS english nitpicking (Evil Ham)
 	* Documentation: Add installing from source with signature verification (Darko Poljak)
 	* Core: preos: Support top command logging options, custom conf-dir option and CDIST_PATH env var (Darko Poljak)
+	* Type __start_on_boot: Docs: remove unsupported *BSD claim (Evil Ham)
+	* New type: __openldap_server (Evil Ham)
 
 6.2.0: 2019-11-30
 	* Core: Redefine/reimplement/fix CDIST_ORDER_DEPENDENCY (Darko Poljak)

From 2c7b4ddc55a9a2f76ae5b51a6020c0cd14900705 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 12 Dec 2019 06:18:04 +0100
Subject: [PATCH 239/383] Update cdist man page

---
 docs/src/man1/cdist.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index d6937272..55db82ed 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -915,5 +915,5 @@ such case and display a warning message. An example of such a case:
 
 COPYING
 -------
-Copyright \(C) 2011-2017 Nico Schottelius. Free use of this software is
+Copyright \(C) 2011-2019 Nico Schottelius. Free use of this software is
 granted under the terms of the GNU General Public License v3 or later (GPLv3+).

From bd4eee7925356c8e557a75688694feff94cca297 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 12 Dec 2019 07:00:23 +0100
Subject: [PATCH 240/383] Fix shellcheck reported issues

---
 cdist/conf/type/__openldap_server/gencode-remote | 4 ++--
 cdist/conf/type/__openldap_server/manifest       | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/type/__openldap_server/gencode-remote b/cdist/conf/type/__openldap_server/gencode-remote
index 0ac434af..b1e98f8c 100644
--- a/cdist/conf/type/__openldap_server/gencode-remote
+++ b/cdist/conf/type/__openldap_server/gencode-remote
@@ -4,9 +4,9 @@ manager_dn=$(cat "${__object}/parameter/manager-dn")
 manager_password=$(cat "${__object}/parameter/manager-password")
 description=$(cat "${__object}/parameter/description")
 suffix=$(cat "${__object}/parameter/suffix")
-suffix_dc=$(echo -n ${suffix} | awk -F',' '{print $1}' | awk -F'=' '{print $2}')
+suffix_dc=$(printf "%s" "${suffix}" | awk -F',' '{print $1}' | awk -F'=' '{print $2}')
 
-SLAPD_IPC=$(cat "${__object}/parameter/slapd-url" | tr '\n' ' ' | awk '{ print $1}')
+SLAPD_IPC=$(tr '\n' ' ' < "${__object}/parameter/slapd-url" | awk '{ print $1}')
 
 cat <<DONE # | tee /dev/stderr
 # Restart service
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index 070a31d5..dadc9f20 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -7,7 +7,7 @@ serverid=$(cat "${__object}/parameter/serverid")
 suffix=$(cat "${__object}/parameter/suffix")
 slapd_modules=$(cat "${__object}/parameter/module" 2>/dev/null || true)
 schemas=$(cat "${__object}/parameter/schema")
-slapd_urls=$(cat "${__object}/parameter/slapd-url" | tr '\n' ' ')
+slapd_urls=$(tr '\n' ' ' < "${__object}/parameter/slapd-url")
 tls_cipher_suite=$(cat "${__object}/parameter/tls-cipher-suite" 2>/dev/null || true)
 
 
@@ -55,7 +55,7 @@ case "${os}" in
         ;;
 esac
 
-PKG_MAIN=$(echo ${PKGS} | awk '{print $1;}')
+PKG_MAIN=$(echo "${PKGS}" | awk '{print $1;}')
 
 
 # Determine if __letsencrypt_cert is to be used and setup vars accordingly
@@ -117,7 +117,7 @@ fi
 
 # Install required packages
 for pkg in ${PKGS}; do
-    __package ${pkg}
+    __package "${pkg}"
 done
 
 
@@ -147,7 +147,7 @@ case "${os}" in
 
         require="__line/rm_slapd_conf" __line add_slapd_conf \
                --file ${ETC}/default/slapd \
-               --line 'SLAPD_CONF=${SLAPD_DIR}/slapd.conf' \
+               --line "SLAPD_CONF=${SLAPD_DIR}/slapd.conf" \
                --state present
 
         require="__line/rm_slapd_services" __line add_slapd_services \

From 8562871da9a51752fea47308e496e139210edf75 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 12 Dec 2019 07:35:53 +0100
Subject: [PATCH 241/383] Fix shellcheck exit status

shellcheck* targets were always reporting exit status 0.
With this fix, if shellcheck fails, then build-helper script
exits with 1.
---
 bin/build-helper | 50 ++++++++++++++++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/bin/build-helper b/bin/build-helper
index 7cfc4d55..69dee4c7 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -74,6 +74,7 @@ SHELLCHECKCMD="shellcheck -s sh -f gcc -x"
 # Skip SC2154 for variables starting with __ since such variables are cdist
 # environment variables.
 SHELLCHECK_SKIP=': __.*is referenced but not assigned.*\[SC2154\]'
+SHELLCHECKTMP=".shellcheck.tmp"
 
 # Change to checkout directory
 basedir="${0%/*}/../"
@@ -431,53 +432,67 @@ eof
     ;;
 
     shellcheck-global-explorers)
-        find cdist/conf/explorer -type f -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/explorer -type f -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-type-explorers)
-        find cdist/conf/type -type f -path "*/explorer/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -path "*/explorer/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-manifests)
-        find cdist/conf/type -type f -name manifest -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -name manifest -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-local-gencodes)
-        find cdist/conf/type -type f -name gencode-local -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -name gencode-local -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-remote-gencodes)
-        find cdist/conf/type -type f -name gencode-remote -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -name gencode-remote -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-scripts)
-        ${SHELLCHECKCMD} scripts/cdist-dump scripts/cdist-new-type || exit 0
+        # shellcheck disable=SC2086
+        ${SHELLCHECKCMD} scripts/cdist-dump scripts/cdist-new-type > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-gencodes)
-        "$0" shellcheck-local-gencodes
-        "$0" shellcheck-remote-gencodes
+        "$0" shellcheck-local-gencodes || exit 1
+        "$0" shellcheck-remote-gencodes || exit 1
     ;;
 
     shellcheck-types)
-        "$0" shellcheck-type-explorers
-        "$0" shellcheck-manifests
-        "$0" shellcheck-gencodes
+        "$0" shellcheck-type-explorers || exit 1
+        "$0" shellcheck-manifests || exit 1
+        "$0" shellcheck-gencodes || exit 1
     ;;
 
     shellcheck)
-        "$0" shellcheck-global-explorers
-        "$0" shellcheck-types
-        "$0" shellcheck-scripts
+        "$0" shellcheck-global-explorers || exit 1
+        "$0" shellcheck-types || exit 1
+        "$0" shellcheck-scripts || exit 1
     ;;
 
     shellcheck-type-files)
-        find cdist/conf/type -type f -path "*/files/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0
+        # shellcheck disable=SC2086
+        find cdist/conf/type -type f -path "*/files/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}"
+        test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; }
     ;;
 
     shellcheck-with-files)
-        "$0" shellcheck
-        "$0" shellcheck-type-files
+        "$0" shellcheck || exit 1
+        "$0" shellcheck-type-files || exit 1
     ;;
 
     shellcheck-build-helper)
@@ -535,6 +550,7 @@ eof
 
         # Temp files
         rm -f ./*.tmp
+        rm -f ./.*.tmp
     ;;
 
     distclean)

From 9859080217a9dc067250a0fc0f686a2242ef1083 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 12 Dec 2019 07:43:07 +0100
Subject: [PATCH 242/383] Release 6.3.0

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 186dce7a..674e14c7 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.3.0: 2019-12-12
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)
 	* Documentation: Fix man pages for install types (Darko Poljak)
 	* Documentation: Embed config skeleton instead of rewriting it (Darko Poljak)

From f407e8825fc2eb70fa489dc218b46f1f2d92d747 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Sun, 15 Dec 2019 22:56:16 +0100
Subject: [PATCH 243/383] [consul/alpine] no init script required to be
 deployed anymore

---
 cdist/conf/type/__consul_agent/manifest | 2 +-
 docs/changelog                          | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index a88d26ed..ee682d72 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -181,7 +181,7 @@ init_upstart()
 
 # Install init script to start on boot
 case "$os" in
-    alpine|devuan)
+    devuan)
         init_sysvinit debian
         ;;
     centos|redhat)
diff --git a/docs/changelog b/docs/changelog
index 674e14c7..415af0af 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,10 @@
 Changelog
 ---------
 
+next:
+	* Type __consul_agent: don't deploy init script on Alpine anymore,
+	it ships with one itself (Nico Schottelius)
+
 6.3.0: 2019-12-12
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)
 	* Documentation: Fix man pages for install types (Darko Poljak)

From df05abd15b6676d6594b3e8aebff112c2f5c0ce7 Mon Sep 17 00:00:00 2001
From: Steven Armstrong <steven@icarus.ethz.ch>
Date: Thu, 19 Dec 2019 12:33:47 +0100
Subject: [PATCH 244/383] bugfix: __install_chroot_umount was not using
 __chroot_umount/manifest

Signed-off-by: Steven Armstrong <steven@icarus.ethz.ch>
---
 cdist/conf/type/__install_chroot_umount/manifest | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 cdist/conf/type/__install_chroot_umount/manifest

diff --git a/cdist/conf/type/__install_chroot_umount/manifest b/cdist/conf/type/__install_chroot_umount/manifest
new file mode 120000
index 00000000..f17af67a
--- /dev/null
+++ b/cdist/conf/type/__install_chroot_umount/manifest
@@ -0,0 +1 @@
+../__chroot_umount/manifest
\ No newline at end of file

From beb930c0dc6e80d0718029fa8fc5539f373154a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Tue, 31 Dec 2019 11:05:40 +0100
Subject: [PATCH 245/383] __postgres_*: use delimited identifiers (double
 quoted) in generated SQL

---
 cdist/conf/type/__postgres_database/gencode-remote | 6 +++---
 cdist/conf/type/__postgres_role/gencode-remote     | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cdist/conf/type/__postgres_database/gencode-remote b/cdist/conf/type/__postgres_database/gencode-remote
index 61cfa50d..9f12d215 100755
--- a/cdist/conf/type/__postgres_database/gencode-remote
+++ b/cdist/conf/type/__postgres_database/gencode-remote
@@ -41,12 +41,12 @@ if [ "$state_should" != "$state_is" ]; then
       present)
          owner=""
          if [ -f "$__object/parameter/owner" ]; then
-            owner="-O '$(cat "$__object/parameter/owner")'"
+            owner="-O \"$(cat "$__object/parameter/owner")\""
          fi
-         echo "su - '$postgres_user' -c \"createdb $owner '$name'\""
+         echo "su - '$postgres_user' -c \"createdb $owner \"$name\"\""
       ;;
       absent)
-         echo "su - '$postgres_user' -c \"dropdb '$name'\""
+         echo "su - '$postgres_user' -c \"dropdb \"$name\"\""
       ;;
    esac
 fi
diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote
index fd56e85d..0b8852f4 100755
--- a/cdist/conf/type/__postgres_role/gencode-remote
+++ b/cdist/conf/type/__postgres_role/gencode-remote
@@ -54,7 +54,7 @@ case "$state_should" in
 
         [ -n "$password" ] && password="PASSWORD '$password'"
 
-        cmd="CREATE ROLE $name WITH $password $booleans"
+        cmd="CREATE ROLE \"$name\" WITH $password $booleans"
         echo "su - '$postgres_user' -c \"psql postgres -wc \\\"$cmd\\\"\""
     ;;
     absent)

From c32e4040b1b17f1e4c8173f23f1bdb2d5112f227 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Tue, 31 Dec 2019 19:16:49 +0200
Subject: [PATCH 246/383] __mysql_*: initial rewrite

---
 .../conf/type/__mysql_database/explorer/state | 15 ++++
 .../conf/type/__mysql_database/gencode-remote | 72 ++++++-------------
 cdist/conf/type/__mysql_database/man.rst      | 49 -------------
 cdist/conf/type/__mysql_database/manifest     | 26 +++++++
 .../__mysql_database/parameter/default/state  |  1 +
 .../type/__mysql_database/parameter/optional  |  1 +
 .../type/__mysql_privileges/explorer/state    | 22 ++++++
 .../type/__mysql_privileges/gencode-remote    | 31 ++++++++
 .../__mysql_privileges/parameter/default/host |  1 +
 .../parameter/default/privileges              |  1 +
 .../parameter/default/state                   |  1 +
 .../parameter/default/table                   |  1 +
 .../__mysql_privileges/parameter/optional     |  4 ++
 .../__mysql_privileges/parameter/required     |  2 +
 cdist/conf/type/__mysql_user/explorer/state   | 36 ++++++++++
 cdist/conf/type/__mysql_user/gencode-remote   | 50 +++++++++++++
 .../type/__mysql_user/parameter/default/host  |  1 +
 .../type/__mysql_user/parameter/default/state |  1 +
 .../conf/type/__mysql_user/parameter/optional |  4 ++
 19 files changed, 221 insertions(+), 98 deletions(-)
 create mode 100755 cdist/conf/type/__mysql_database/explorer/state
 delete mode 100644 cdist/conf/type/__mysql_database/man.rst
 create mode 100755 cdist/conf/type/__mysql_database/manifest
 create mode 100644 cdist/conf/type/__mysql_database/parameter/default/state
 create mode 100755 cdist/conf/type/__mysql_privileges/explorer/state
 create mode 100755 cdist/conf/type/__mysql_privileges/gencode-remote
 create mode 100644 cdist/conf/type/__mysql_privileges/parameter/default/host
 create mode 100644 cdist/conf/type/__mysql_privileges/parameter/default/privileges
 create mode 100644 cdist/conf/type/__mysql_privileges/parameter/default/state
 create mode 100644 cdist/conf/type/__mysql_privileges/parameter/default/table
 create mode 100644 cdist/conf/type/__mysql_privileges/parameter/optional
 create mode 100644 cdist/conf/type/__mysql_privileges/parameter/required
 create mode 100755 cdist/conf/type/__mysql_user/explorer/state
 create mode 100755 cdist/conf/type/__mysql_user/gencode-remote
 create mode 100644 cdist/conf/type/__mysql_user/parameter/default/host
 create mode 100644 cdist/conf/type/__mysql_user/parameter/default/state
 create mode 100644 cdist/conf/type/__mysql_user/parameter/optional

diff --git a/cdist/conf/type/__mysql_database/explorer/state b/cdist/conf/type/__mysql_database/explorer/state
new file mode 100755
index 00000000..16cc9ce5
--- /dev/null
+++ b/cdist/conf/type/__mysql_database/explorer/state
@@ -0,0 +1,15 @@
+#!/bin/sh -e
+
+if [ -f "$__object/parameter/name" ]
+then
+    name="$( cat "$__object/parameter/name" )"
+else
+    name="$__object_id"
+fi
+
+if [ -n "$( mysql -B -N -e "show databases like '$name'" )" ]
+then
+    echo 'present'
+else
+    echo 'absent'
+fi
diff --git a/cdist/conf/type/__mysql_database/gencode-remote b/cdist/conf/type/__mysql_database/gencode-remote
index 23e51b05..d3692572 100755
--- a/cdist/conf/type/__mysql_database/gencode-remote
+++ b/cdist/conf/type/__mysql_database/gencode-remote
@@ -1,54 +1,28 @@
 #!/bin/sh -e
-#
-# 2012 Benedikt Koeppel (code@benediktkoeppel.ch)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
 
-# if --database was specified
-if [ -f "$__object/parameter/name" ]; then
-   database="$(cat "$__object/parameter/name")"
-else # otherwise use the object id as database name
-   database="$__object_id"
+state_is="$( cat "$__object/explorer/state" )"
+
+state_should="$( cat "$__object/parameter/state" )"
+
+if [ "$state_is" = "$state_should" ]
+then
+    exit 0
 fi
 
-cat <<-EOFF
-mysql -u root <<-EOF
-	CREATE DATABASE IF NOT EXISTS $database
-EOF
-EOFF
-
-# if --user was specified
-if [ -f "$__object/parameter/user" ]; then
-   user="$(cat "$__object/parameter/user")"
-
-   # if --password was specified
-   if [ -f "$__object/parameter/password" ]; then
-      password="$(cat "$__object/parameter/password")"
-      cat <<-EOFF
-      mysql -u root <<-EOF
-      	GRANT ALL PRIVILEGES ON $database.* to '$user'@'localhost' IDENTIFIED BY '$password';
-EOF
-EOFF
-   else
-      cat <<-EOFF
-      mysql -u root <<-EOF
-      	GRANT ALL PRIVILEGES ON $database.* to '$user'@'localhost';
-EOF
-EOFF
-   fi
+if [ -f "$__object/parameter/name" ]
+then
+    name="$( cat "$__object/parameter/name" )"
+else
+    name="$__object_id"
 fi
+
+case "$state_should" in
+    present)
+        echo "mysql -e 'create database \`$name\`'"
+        echo "create database $name" >> "$__messages_out"
+    ;;
+    absent)
+        echo "mysql -e 'drop database \`$name\`'"
+        echo "drop database $name" >> "$__messages_out"
+    ;;
+esac
diff --git a/cdist/conf/type/__mysql_database/man.rst b/cdist/conf/type/__mysql_database/man.rst
deleted file mode 100644
index 1e245a08..00000000
--- a/cdist/conf/type/__mysql_database/man.rst
+++ /dev/null
@@ -1,49 +0,0 @@
-cdist-type__mysql_database(7)
-=============================
-
-NAME
-----
-cdist-type__mysql_database - Manage a MySQL database
-
-
-DESCRIPTION
------------
-This cdist type allows you to install a MySQL database.
-
-
-REQUIRED PARAMETERS
--------------------
-None.
-
-OPTIONAL PARAMETERS
--------------------
-name
-   The name of the database to install
-   defaults to the object id
-
-user
-   A user that should have access to the database
-
-password
-   The password for the user who manages the database
-
-
-EXAMPLES
---------
-
-.. code-block:: sh
-
-    __mysql_database "cdist" --name "cdist" --user "myuser" --password "mypwd"
-
-
-AUTHORS
--------
-Benedikt Koeppel <code@benediktkoeppel.ch>
-
-
-COPYING
--------
-Copyright \(C) 2012 Benedikt Koeppel. You can redistribute it
-and/or modify it under the terms of the GNU General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
diff --git a/cdist/conf/type/__mysql_database/manifest b/cdist/conf/type/__mysql_database/manifest
new file mode 100755
index 00000000..a57c31ce
--- /dev/null
+++ b/cdist/conf/type/__mysql_database/manifest
@@ -0,0 +1,26 @@
+#!/bin/sh -e
+
+if [ -f "$__object/parameter/user" ]
+then
+    user="$( cat "$__object/parameter/user" )"
+fi
+
+if [ -f "$__object/parameter/password" ]
+then
+    password="$( cat "$__object/parameter/password" )"
+fi
+
+if [ -n "$user" ] && [ -n "$password" ]
+then
+    if [ -f "$__object/parameter/name" ]
+    then
+        database="$( cat "$__object/parameter/name" )"
+    else
+        database="$__object_id"
+    fi
+
+    __mysql_user "$user" --password "$password"
+
+    require="__mysql_user/$user" \
+        __mysql_privileges "$database/$user" --database "$database" --user "$user"
+fi
diff --git a/cdist/conf/type/__mysql_database/parameter/default/state b/cdist/conf/type/__mysql_database/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__mysql_database/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__mysql_database/parameter/optional b/cdist/conf/type/__mysql_database/parameter/optional
index 756afee7..6c0b1e85 100644
--- a/cdist/conf/type/__mysql_database/parameter/optional
+++ b/cdist/conf/type/__mysql_database/parameter/optional
@@ -1,3 +1,4 @@
 name
 user
 password
+state
diff --git a/cdist/conf/type/__mysql_privileges/explorer/state b/cdist/conf/type/__mysql_privileges/explorer/state
new file mode 100755
index 00000000..97674479
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/explorer/state
@@ -0,0 +1,22 @@
+#!/bin/sh -e
+
+privileges="$( cat "$__object/parameter/privileges" )"
+
+database="$( cat "$__object/parameter/database" )"
+
+table="$( cat "$__object/parameter/table" )"
+
+user="$( cat "$__object/parameter/user" )"
+
+host="$( cat "$__object/parameter/host" )"
+
+check_privileges="$( 
+    mysql -B -N -e "show grants for '$user'@'$host'" \
+        | grep -Ei "^grant $privileges on .$database.\..$table. to " || true )"
+
+if [ -n "$check_privileges" ]
+then
+    echo 'present'
+else
+    echo 'absent'
+fi
diff --git a/cdist/conf/type/__mysql_privileges/gencode-remote b/cdist/conf/type/__mysql_privileges/gencode-remote
new file mode 100755
index 00000000..6b2e0fc1
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/gencode-remote
@@ -0,0 +1,31 @@
+#!/bin/sh -e
+
+state_is="$( cat "$__object/explorer/state" )"
+
+state_should="$( cat "$__object/parameter/state" )"
+
+if [ "$state_is" = "$state_should" ]
+then
+    exit 0
+fi
+
+privileges="$( cat "$__object/parameter/privileges" )"
+
+database="$( cat "$__object/parameter/database" )"
+
+table="$( cat "$__object/parameter/table" )"
+
+user="$( cat "$__object/parameter/user" )"
+
+host="$( cat "$__object/parameter/host" )"
+
+case "$state_should" in
+    present)
+        echo "mysql -e 'grant $privileges on \`$database\`.\`$table\` to \`$user\`@\`$host\`'"
+        echo "grant $privileges on $database.$table to $user@$host" >> "$__messages_out"
+    ;;
+    absent)
+        echo "mysql -e 'revoke $privileges on \`$database\`.\`$table\` from \`$user\`@\`$host\`'"
+        echo "revoke $privileges on $database.$table from $user@$host" >> "$__messages_out"
+    ;;
+esac
diff --git a/cdist/conf/type/__mysql_privileges/parameter/default/host b/cdist/conf/type/__mysql_privileges/parameter/default/host
new file mode 100644
index 00000000..2fbb50c4
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/parameter/default/host
@@ -0,0 +1 @@
+localhost
diff --git a/cdist/conf/type/__mysql_privileges/parameter/default/privileges b/cdist/conf/type/__mysql_privileges/parameter/default/privileges
new file mode 100644
index 00000000..5472efad
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/parameter/default/privileges
@@ -0,0 +1 @@
+all privileges
diff --git a/cdist/conf/type/__mysql_privileges/parameter/default/state b/cdist/conf/type/__mysql_privileges/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__mysql_privileges/parameter/default/table b/cdist/conf/type/__mysql_privileges/parameter/default/table
new file mode 100644
index 00000000..72e8ffc0
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/parameter/default/table
@@ -0,0 +1 @@
+*
diff --git a/cdist/conf/type/__mysql_privileges/parameter/optional b/cdist/conf/type/__mysql_privileges/parameter/optional
new file mode 100644
index 00000000..d4ed5bc5
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/parameter/optional
@@ -0,0 +1,4 @@
+privileges
+table
+host
+state
diff --git a/cdist/conf/type/__mysql_privileges/parameter/required b/cdist/conf/type/__mysql_privileges/parameter/required
new file mode 100644
index 00000000..152b4a1e
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/parameter/required
@@ -0,0 +1,2 @@
+database
+user
diff --git a/cdist/conf/type/__mysql_user/explorer/state b/cdist/conf/type/__mysql_user/explorer/state
new file mode 100755
index 00000000..c91bb36a
--- /dev/null
+++ b/cdist/conf/type/__mysql_user/explorer/state
@@ -0,0 +1,36 @@
+#!/bin/sh -e
+
+if [ -f "$__object/parameter/name" ]
+then
+    name="$( cat "$__object/parameter/name" )"
+else
+    name="$__object_id"
+fi
+
+if [ -f "$__object/parameter/password" ]
+then
+    password="$( cat "$__object/parameter/password" )"
+else
+    password=''
+fi
+
+host="$( cat "$__object/parameter/host" )"
+
+check_user="$( mysql -B -N -e "select user from mysql.user where user = '$name' and host = '$host'" )"
+
+if [ -n "$check_user" ]
+then
+    if [ -n "$password" ]
+    then
+        check_password="$( mysql -B -N -e "select user from mysql.user where user = '$name' and host = '$host' and password = password( '$password' )" )"
+    fi
+
+    if [ -n "$password" ] && [ -z "$check_password" ]
+    then
+        echo 'change-password'
+    else
+        echo 'present'
+    fi
+else
+    echo 'absent'
+fi
diff --git a/cdist/conf/type/__mysql_user/gencode-remote b/cdist/conf/type/__mysql_user/gencode-remote
new file mode 100755
index 00000000..67500716
--- /dev/null
+++ b/cdist/conf/type/__mysql_user/gencode-remote
@@ -0,0 +1,50 @@
+#!/bin/sh -e
+
+state_is="$( cat "$__object/explorer/state" )"
+
+state_should="$( cat "$__object/parameter/state" )"
+
+if [ "$state_is" = "$state_should" ]
+then
+    exit 0
+fi
+
+if [ -f "$__object/parameter/name" ]
+then
+    name="$( cat "$__object/parameter/name" )"
+else
+    name="$__object_id"
+fi
+
+host="$( cat "$__object/parameter/host" )"
+
+if [ -f "$__object/parameter/password" ]
+then
+    password="$( cat "$__object/parameter/password" )"
+else
+    if [ "$state_should" = 'present' ]
+    then
+        echo '--password needed' >&2
+        exit 1
+    else
+        password=''
+    fi
+fi
+
+if [ "$state_is" = 'absent' ] && [ "$state_should" = 'present' ]
+then
+    echo "mysql -e 'create user \`$name\`@\`$host\` identified by \"$password\"'"
+    echo "create user $name@$host" >> "$__messages_out"
+
+elif [ "$state_is" != 'absent' ] && [ "$state_should" = 'absent' ]
+then
+    echo "mysql -e 'drop user \`$name\`@\`$host\`'"
+    echo "drop user $name@$host" >> "$__messages_out"
+
+elif [ "$state_is" = 'change-password' ]
+then
+    # this only works with MySQL 5.7.6 and later or MariaDB 10.1.20 and later
+    echo "mysql -e 'alter user \`$name\`@\`$host\` identified by \"$password\"'"
+    echo "mysql -e 'flush privileges'"
+    echo "change password $name@$host" >> "$__messages_out"
+fi
diff --git a/cdist/conf/type/__mysql_user/parameter/default/host b/cdist/conf/type/__mysql_user/parameter/default/host
new file mode 100644
index 00000000..2fbb50c4
--- /dev/null
+++ b/cdist/conf/type/__mysql_user/parameter/default/host
@@ -0,0 +1 @@
+localhost
diff --git a/cdist/conf/type/__mysql_user/parameter/default/state b/cdist/conf/type/__mysql_user/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__mysql_user/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__mysql_user/parameter/optional b/cdist/conf/type/__mysql_user/parameter/optional
new file mode 100644
index 00000000..a286266c
--- /dev/null
+++ b/cdist/conf/type/__mysql_user/parameter/optional
@@ -0,0 +1,4 @@
+name
+host
+password
+state

From 9a693537f4192e3cd133e14cd31ab1bdcc792608 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 1 Jan 2020 12:38:12 +0200
Subject: [PATCH 247/383] __mysql_*: add license headers

---
 .../conf/type/__mysql_database/explorer/state  | 18 ++++++++++++++++++
 .../conf/type/__mysql_database/gencode-remote  | 18 ++++++++++++++++++
 cdist/conf/type/__mysql_database/manifest      | 18 ++++++++++++++++++
 .../type/__mysql_privileges/explorer/state     | 18 ++++++++++++++++++
 .../type/__mysql_privileges/gencode-remote     | 18 ++++++++++++++++++
 cdist/conf/type/__mysql_user/explorer/state    | 18 ++++++++++++++++++
 cdist/conf/type/__mysql_user/gencode-remote    | 18 ++++++++++++++++++
 7 files changed, 126 insertions(+)

diff --git a/cdist/conf/type/__mysql_database/explorer/state b/cdist/conf/type/__mysql_database/explorer/state
index 16cc9ce5..79858695 100755
--- a/cdist/conf/type/__mysql_database/explorer/state
+++ b/cdist/conf/type/__mysql_database/explorer/state
@@ -1,4 +1,22 @@
 #!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
 
 if [ -f "$__object/parameter/name" ]
 then
diff --git a/cdist/conf/type/__mysql_database/gencode-remote b/cdist/conf/type/__mysql_database/gencode-remote
index d3692572..1bdb2b11 100755
--- a/cdist/conf/type/__mysql_database/gencode-remote
+++ b/cdist/conf/type/__mysql_database/gencode-remote
@@ -1,4 +1,22 @@
 #!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
 
 state_is="$( cat "$__object/explorer/state" )"
 
diff --git a/cdist/conf/type/__mysql_database/manifest b/cdist/conf/type/__mysql_database/manifest
index a57c31ce..628b543c 100755
--- a/cdist/conf/type/__mysql_database/manifest
+++ b/cdist/conf/type/__mysql_database/manifest
@@ -1,4 +1,22 @@
 #!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
 
 if [ -f "$__object/parameter/user" ]
 then
diff --git a/cdist/conf/type/__mysql_privileges/explorer/state b/cdist/conf/type/__mysql_privileges/explorer/state
index 97674479..0cfbaacd 100755
--- a/cdist/conf/type/__mysql_privileges/explorer/state
+++ b/cdist/conf/type/__mysql_privileges/explorer/state
@@ -1,4 +1,22 @@
 #!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
 
 privileges="$( cat "$__object/parameter/privileges" )"
 
diff --git a/cdist/conf/type/__mysql_privileges/gencode-remote b/cdist/conf/type/__mysql_privileges/gencode-remote
index 6b2e0fc1..bcd362e6 100755
--- a/cdist/conf/type/__mysql_privileges/gencode-remote
+++ b/cdist/conf/type/__mysql_privileges/gencode-remote
@@ -1,4 +1,22 @@
 #!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
 
 state_is="$( cat "$__object/explorer/state" )"
 
diff --git a/cdist/conf/type/__mysql_user/explorer/state b/cdist/conf/type/__mysql_user/explorer/state
index c91bb36a..6817ee9d 100755
--- a/cdist/conf/type/__mysql_user/explorer/state
+++ b/cdist/conf/type/__mysql_user/explorer/state
@@ -1,4 +1,22 @@
 #!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
 
 if [ -f "$__object/parameter/name" ]
 then
diff --git a/cdist/conf/type/__mysql_user/gencode-remote b/cdist/conf/type/__mysql_user/gencode-remote
index 67500716..5f13bc87 100755
--- a/cdist/conf/type/__mysql_user/gencode-remote
+++ b/cdist/conf/type/__mysql_user/gencode-remote
@@ -1,4 +1,22 @@
 #!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
 
 state_is="$( cat "$__object/explorer/state" )"
 

From 24862e0208705cd9081f5963d1f07e0fcceb23f2 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 3 Jan 2020 18:26:11 +0200
Subject: [PATCH 248/383] __mysql_database: carry over state

---
 cdist/conf/type/__mysql_database/manifest | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__mysql_database/manifest b/cdist/conf/type/__mysql_database/manifest
index 628b543c..a3c9ed5d 100755
--- a/cdist/conf/type/__mysql_database/manifest
+++ b/cdist/conf/type/__mysql_database/manifest
@@ -37,8 +37,16 @@ then
         database="$__object_id"
     fi
 
-    __mysql_user "$user" --password "$password"
+    state_should="$( cat "$__object/parameter/state" )"
 
+    __mysql_user "$user" \
+        --password "$password" \
+        --state "$state_should"
+
+    # removing user should remove all user's privileges
     require="__mysql_user/$user" \
-        __mysql_privileges "$database/$user" --database "$database" --user "$user"
+        __mysql_privileges "$database/$user" \
+            --database "$database" \
+            --user "$user" \
+            --state "$state_should"
 fi

From fcc774cb7b2b3f2128dc77d622d7801397d906b7 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 3 Jan 2020 18:33:23 +0200
Subject: [PATCH 249/383] __mysql_database: add manual

---
 cdist/conf/type/__mysql_database/man.rst | 55 ++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 cdist/conf/type/__mysql_database/man.rst

diff --git a/cdist/conf/type/__mysql_database/man.rst b/cdist/conf/type/__mysql_database/man.rst
new file mode 100644
index 00000000..b3b56b5f
--- /dev/null
+++ b/cdist/conf/type/__mysql_database/man.rst
@@ -0,0 +1,55 @@
+cdist-type__mysql_database(7)
+=============================
+
+NAME
+----
+cdist-type__mysql_database - Manage a MySQL database
+
+
+DESCRIPTION
+-----------
+
+Create MySQL database and optionally user with all privileges.
+
+
+OPTIONAL PARAMETERS
+-------------------
+name
+   Name of database. Defaults to object id.
+
+user
+   Create user and give all privileges to database.
+
+password
+   Password for user.
+
+state
+   Defaults to present.
+   If absent and user is also set, both will be removed (with privileges).
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # just create database
+    __mysql_database foo
+
+    # create database with respective user with all privileges to database
+    __mysql_database bar \
+        --user name \
+        --password secret
+
+
+AUTHORS
+-------
+Ander Punnar <ander-at-kvlt-dot-ee>
+
+
+COPYING
+-------
+Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.

From 5e8dc7122d764896247258ae4c9049e222f4d7ff Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 3 Jan 2020 18:48:11 +0200
Subject: [PATCH 250/383] __mysql_user: add manual

---
 cdist/conf/type/__mysql_user/man.rst | 48 ++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 cdist/conf/type/__mysql_user/man.rst

diff --git a/cdist/conf/type/__mysql_user/man.rst b/cdist/conf/type/__mysql_user/man.rst
new file mode 100644
index 00000000..c2b222d5
--- /dev/null
+++ b/cdist/conf/type/__mysql_user/man.rst
@@ -0,0 +1,48 @@
+cdist-type__mysql_user(7)
+=========================
+
+NAME
+----
+cdist-type__mysql_user - Manage a MySQL user
+
+
+DESCRIPTION
+-----------
+
+Create MySQL user or change password for the user.
+
+
+OPTIONAL PARAMETERS
+-------------------
+name
+   Name of user. Defaults to object id.
+
+host
+   Host of user. Defaults to localhost.
+
+password
+   Password of user.
+
+state
+   Defaults to present.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __mysql_user user --password secret
+
+
+AUTHORS
+-------
+Ander Punnar <ander-at-kvlt-dot-ee>
+
+
+COPYING
+-------
+Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.

From 4329cced82930a336378765b294b9a3be9433991 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 3 Jan 2020 18:55:55 +0200
Subject: [PATCH 251/383] __mysql_privileges: add manual

---
 cdist/conf/type/__mysql_privileges/man.rst | 57 ++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 cdist/conf/type/__mysql_privileges/man.rst

diff --git a/cdist/conf/type/__mysql_privileges/man.rst b/cdist/conf/type/__mysql_privileges/man.rst
new file mode 100644
index 00000000..8208d7d4
--- /dev/null
+++ b/cdist/conf/type/__mysql_privileges/man.rst
@@ -0,0 +1,57 @@
+cdist-type__mysql_privileges(7)
+===============================
+
+NAME
+----
+cdist-type__mysql_privileges - Manage MySQL privileges
+
+
+DESCRIPTION
+-----------
+
+Grant and revoke privileges of MySQL user.
+
+
+REQUIRED PARAMETERS
+-------------------
+database
+   Name of database.
+
+User
+   Name of user.
+
+
+OPTIONAL PARAMETERS
+-------------------
+privileges
+   Defaults to "all".
+
+table
+   Defaults to "*".
+
+host
+   Defaults to localhost.
+
+state
+   "present" grants and "absent" revokes. Defaults to present.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __mysql_privileges user-to-db --database db --user user
+
+
+AUTHORS
+-------
+Ander Punnar <ander-at-kvlt-dot-ee>
+
+
+COPYING
+-------
+Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.

From 6369bc1ae5e17dd9c0a13d57419107cbdb166245 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 Jan 2020 10:07:53 +0100
Subject: [PATCH 252/383] ++changelog

---
 docs/changelog | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/changelog b/docs/changelog
index 415af0af..8feb0b83 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -2,8 +2,9 @@ Changelog
 ---------
 
 next:
-	* Type __consul_agent: don't deploy init script on Alpine anymore,
-	it ships with one itself (Nico Schottelius)
+	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)
+	* Type __install_chroot_umount: Bugfix: type was not using __chroot_umount/manifest (Steven Armstrong)
+	* Types __postgres_*: Use double quoted identifiers in generated SQL (fnux)
 
 6.3.0: 2019-12-12
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)

From 72935e0a797461d39f64b9f85bac02ad06347b1d Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 Jan 2020 11:08:48 +0100
Subject: [PATCH 253/383] ++changelog

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 8feb0b83..d0a3a2de 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,7 +4,7 @@ Changelog
 next:
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)
 	* Type __install_chroot_umount: Bugfix: type was not using __chroot_umount/manifest (Steven Armstrong)
-	* Types __postgres_*: Use double quoted identifiers in generated SQL (fnux)
+	* Types __postgres_*: Use double quoted identifiers in generated SQL (Timothée Floure)
 
 6.3.0: 2019-12-12
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)

From e4596593c08f43284e1fa85d1e353b733bebdc57 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 30 Dec 2019 09:32:15 +0100
Subject: [PATCH 254/383] Add cdist info command

---
 cdist/argparse.py       |  32 +++++++
 cdist/exec/local.py     |  42 ++-------
 cdist/exec/util.py      |  25 ++++++
 cdist/info.py           | 183 ++++++++++++++++++++++++++++++++++++++++
 docs/src/man1/cdist.rst |  37 +++++++-
 5 files changed, 283 insertions(+), 36 deletions(-)
 create mode 100644 cdist/info.py

diff --git a/cdist/argparse.py b/cdist/argparse.py
index 7dc683f3..611c484a 100644
--- a/cdist/argparse.py
+++ b/cdist/argparse.py
@@ -6,6 +6,7 @@ import collections
 import functools
 import cdist.configuration
 import cdist.preos
+import cdist.info
 
 
 # set of beta sub-commands
@@ -436,6 +437,37 @@ def get_parsers():
                   ' should be POSIX compatible shell.'))
     parser['shell'].set_defaults(func=cdist.shell.Shell.commandline)
 
+    # Info
+    parser['info'] = parser['sub'].add_parser('info')
+    parser['info'].add_argument(
+            '-a', '--all', help='Display all info. This is the default.',
+            action='store_true', default=False)
+    parser['info'].add_argument(
+            '-c', '--conf-dir',
+            help='Add configuration directory (can be repeated).',
+            action='append')
+    parser['info'].add_argument(
+            '-e', '--global-explorers',
+            help='Display info for global explorers.', action='store_true',
+            default=False)
+    parser['info'].add_argument(
+            '-F', '--fixed-string',
+            help='Interpret pattern as a fixed string.', action='store_true',
+            default=False)
+    parser['info'].add_argument(
+            '-f', '--full', help='Display full details.',
+            action='store_true', default=False)
+    parser['info'].add_argument(
+           '-g', '--config-file',
+           help='Use specified custom configuration file.',
+           dest="config_file", required=False)
+    parser['info'].add_argument(
+            '-t', '--types', help='Display info for types.',
+            action='store_true', default=False)
+    parser['info'].add_argument(
+            'pattern', nargs='?', help='Glob pattern.')
+    parser['info'].set_defaults(func=cdist.info.Info.commandline)
+
     for p in parser:
         parser[p].epilog = EPILOG
 
diff --git a/cdist/exec/local.py b/cdist/exec/local.py
index f83c85df..ad6c6e36 100644
--- a/cdist/exec/local.py
+++ b/cdist/exec/local.py
@@ -69,7 +69,6 @@ class Local(object):
 
         self.exec_path = exec_path
         self.custom_initial_manifest = initial_manifest
-        self._add_conf_dirs = add_conf_dirs
         self.cache_path_pattern = cache_path_pattern
         self.quiet_mode = quiet_mode
         if configuration:
@@ -84,16 +83,7 @@ class Local(object):
         self._init_cache_dir(None)
         self._init_paths()
         self._init_object_marker()
-        self._init_conf_dirs()
-
-    @property
-    def dist_conf_dir(self):
-        return os.path.abspath(os.path.join(os.path.dirname(cdist.__file__),
-                                            "conf"))
-
-    @property
-    def home_dir(self):
-        return cdist.home_dir()
+        self._init_conf_dirs(add_conf_dirs)
 
     def _init_log(self):
         self.log = logging.getLogger(self.target_host[0])
@@ -140,28 +130,9 @@ class Local(object):
         # Does not need to be secure - just randomly different from .cdist
         self.object_marker_name = tempfile.mktemp(prefix='.cdist-', dir='')
 
-    def _init_conf_dirs(self):
-        self.conf_dirs = []
-
-        self.conf_dirs.append(self.dist_conf_dir)
-
-        # Is the default place for user created explorer, type and manifest
-        if self.home_dir:
-            self.conf_dirs.append(self.home_dir)
-
-        # Add directories defined in the CDIST_PATH environment variable
-        # if 'CDIST_PATH' in os.environ:
-        #     cdist_path_dirs = re.split(r'(?<!\\):', os.environ['CDIST_PATH'])
-        #     cdist_path_dirs.reverse()
-        #     self.conf_dirs.extend(cdist_path_dirs)
-        if 'conf_dir' in self.configuration:
-            conf_dirs = self.configuration['conf_dir']
-            if conf_dirs:
-                self.conf_dirs.extend(conf_dirs)
-
-        # Add command line supplied directories
-        if self._add_conf_dirs:
-            self.conf_dirs.extend(self._add_conf_dirs)
+    def _init_conf_dirs(self, add_conf_dirs):
+        self.conf_dirs = util.resolve_conf_dirs(
+            self.configuration, add_conf_dirs=add_conf_dirs)
 
     def _init_directories(self):
         self.mkdir(self.conf_path)
@@ -187,10 +158,11 @@ class Local(object):
             self.object_marker_name, self.object_marker_file))
 
     def _init_cache_dir(self, cache_dir):
+        home_dir = cdist.home_dir()
         if cache_dir:
             self.cache_path = cache_dir
-        elif self.home_dir:
-            self.cache_path = os.path.join(self.home_dir, "cache")
+        elif home_dir:
+            self.cache_path = os.path.join(home_dir, "cache")
         else:
             raise cdist.Error(
                 "No homedir setup and no cache dir location given")
diff --git a/cdist/exec/util.py b/cdist/exec/util.py
index c96f757b..5513f01d 100644
--- a/cdist/exec/util.py
+++ b/cdist/exec/util.py
@@ -175,3 +175,28 @@ def log_std_fd(log, command, stdfd, prefix):
         stdfd.seek(0, 0)
         log.trace("Command: {}; {}: {}".format(
             command, prefix, stdfd.read().decode()))
+
+
+def dist_conf_dir():
+    return os.path.abspath(os.path.join(os.path.dirname(cdist.__file__),
+                                        "conf"))
+
+
+def resolve_conf_dirs(configuration, add_conf_dirs):
+    conf_dirs = []
+
+    conf_dirs.append(dist_conf_dir())
+
+    home_dir = cdist.home_dir()
+    if home_dir:
+        conf_dirs.append(home_dir)
+
+    if 'conf_dir' in configuration:
+        x = configuration['conf_dir']
+        if x:
+            conf_dirs.extend(x)
+
+    if add_conf_dirs:
+        conf_dirs.extend(add_conf_dirs)
+    conf_dirs = set(conf_dirs)
+    return conf_dirs
diff --git a/cdist/info.py b/cdist/info.py
new file mode 100644
index 00000000..4c1d3560
--- /dev/null
+++ b/cdist/info.py
@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# 2019-2020 Darko Poljak (darko.poljak at gmail.com)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+#
+
+import cdist
+import cdist.configuration
+import cdist.core
+import cdist.exec.util as util
+import os
+import glob
+import fnmatch
+
+
+class Info(object):
+
+    def __init__(self, conf_dirs, args):
+        self.conf_dirs = conf_dirs
+        self.all = args.all
+        self.display_global_explorers = args.global_explorers
+        self.display_types = args.types
+        if not self.display_global_explorers and not self.display_types:
+            self.all = True
+        self.fixed_string = args.fixed_string
+        self._setup_glob_pattern(args.pattern)
+        self.full = args.full
+
+    def _setup_glob_pattern(self, pattern):
+        if pattern is None:
+            self.glob_pattern = '*'
+        elif ('?' in pattern or '*' in pattern or '[' in pattern or
+              self.fixed_string):
+            self.glob_pattern = pattern
+        else:
+            self.glob_pattern = '*' + pattern + '*'
+
+    @classmethod
+    def commandline(cls, args):
+        cfg = cdist.configuration.Configuration(args)
+        configuration = cfg.get_config(section='GLOBAL')
+        conf_dirs = util.resolve_conf_dirs(configuration,
+                                           args.conf_dir)
+        c = cls(conf_dirs, args)
+        c.run()
+
+    def _get_global_explorers(self, conf_path):
+        rv = []
+        global_explorer_path = os.path.join(conf_path, "explorer",
+                                            self.glob_pattern)
+        if self.fixed_string:
+            if os.path.exists(global_explorer_path):
+                rv.append(global_explorer_path)
+        else:
+            for explorer in glob.glob(global_explorer_path):
+                rv.append(explorer)
+        return rv
+
+    def _should_display_type(self, dir_entry):
+        if not dir_entry.is_dir():
+            return False
+        if self.glob_pattern is None:
+            return True
+        if self.fixed_string:
+            return dir_entry.name == self.glob_pattern
+        else:
+            return fnmatch.fnmatch(dir_entry.name, self.glob_pattern)
+
+    def _get_types(self, conf_path):
+        rv = []
+        types_path = os.path.join(conf_path, "type")
+        if not os.path.exists(types_path):
+            return rv
+        with os.scandir(types_path) as it:
+            for entry in it:
+                if self._should_display_type(entry):
+                    rv.append(entry.path)
+        return rv
+
+    def _display_details(self, title, details, default_values=None,
+                         deprecated=None):
+        if not details:
+            return
+        if isinstance(details, bool):
+            print("\t{}: {}".format(title, 'yes' if details else 'no'))
+        elif isinstance(details, str):
+            print("\t{}: {}".format(title, details))
+        elif isinstance(details, list):
+            dv = dict(default_values) if default_values else {}
+            dp = dict(deprecated) if deprecated else {}
+
+            print("\t{}:".format(title))
+            for x in sorted(details):
+                print("\t\t{}".format(x), end='')
+                has_default = x in dv
+                is_deprecated = x in dp
+                need_comma = False
+                if has_default or is_deprecated:
+                    print(" (", end='')
+                if has_default:
+                    print("default: {}".format(dv[x]), end='')
+                    need_comma = True
+                if is_deprecated:
+                    print("{}deprecated".format(', ' if need_comma else ''),
+                          end='')
+                if has_default or is_deprecated:
+                    print(")", end='')
+                print()
+
+    def _display_type_parameters(self, cdist_type):
+        self._display_details("required parameters",
+                              cdist_type.required_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+        self._display_details("required multiple parameters",
+                              cdist_type.required_multiple_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+        self._display_details("optional parameters",
+                              cdist_type.optional_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+        self._display_details("optional multiple parameters",
+                              cdist_type.optional_multiple_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+        self._display_details("boolean parameters",
+                              cdist_type.boolean_parameters,
+                              default_values=cdist_type.parameter_defaults,
+                              deprecated=cdist_type.deprecated_parameters)
+
+    def _display_type_characteristics(self, cdist_type):
+        characteristics = []
+        if cdist_type.is_install:
+            characteristics.append('install')
+        else:
+            characteristics.append('config')
+        if cdist_type.is_singleton:
+            characteristics.append('singleton')
+        if cdist_type.is_nonparallel:
+            characteristics.append('nonparallel')
+        else:
+            characteristics.append('parallel')
+        if cdist_type.deprecated is not None:
+            characteristics.append('deprecated')
+        print("\t{}".format(', '.join(characteristics)))
+
+    def _display_type_details(self, type_path):
+        dirname, basename = os.path.split(type_path)
+        cdist_type = cdist.core.CdistType(dirname, basename)
+
+        self._display_type_characteristics(cdist_type)
+        self._display_type_parameters(cdist_type)
+
+    def run(self):
+        rv = []
+        for conf_path in self.conf_dirs:
+            if self.all or self.display_global_explorers:
+                rv.extend((x, 'E', ) for x in self._get_global_explorers(
+                    conf_path))
+            if self.all or self.display_types:
+                rv.extend((x, 'T', ) for x in self._get_types(conf_path))
+        rv = sorted(rv, key=lambda x: x[0])
+        for x, t in rv:
+            print(x)
+            if self.full and t == 'T':
+                self._display_type_details(x)
diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index 55db82ed..66c356ec 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -11,7 +11,7 @@ SYNOPSIS
 
 ::
 
-    cdist [-h] [-V] {banner,config,install,inventory,preos,shell} ...
+    cdist [-h] [-V] {banner,config,install,inventory,preos,shell,info} ...
 
     cdist banner [-h] [-l LOGLEVEL] [-q] [-v]
 
@@ -84,6 +84,8 @@ SYNOPSIS
 
     cdist shell [-h] [-l LOGLEVEL] [-q] [-v] [-s SHELL]
 
+    cdist info [-h] [-a] [-c CONF_DIR] [-e] [-F] [-f] [-t] [pattern]
+
 
 DESCRIPTION
 -----------
@@ -604,6 +606,39 @@ usage. Its primary use is for debugging type parameters.
     be POSIX compatible shell.
 
 
+INFO
+----
+Display information for cdist (global explorers, types).
+
+**pattern**
+    Glob pattern. If it contains special characters('?', '*', '[') then it is
+    used as specified, otherwise it is translated to `*pattern*`.
+
+**-h, --help**
+    Show help message and exit.
+
+**-a, --all**
+    Display all info. This is the default.
+
+**-c CONF_DIR, --conf-dir CONF_DIR**
+    Add configuration directory (can be repeated).
+
+**-e, --global-explorers**
+    Display info for global explorers.
+
+**-F, --fixed-string**
+    Interpret pattern as a fixed string.
+
+**-f, --full**
+    Display full details.
+
+**-g CONFIG_FILE, --config-file CONFIG_FILE**
+    Use specified custom configuration file.
+
+**-t, --types**
+    Display info for types.
+
+
 CONFIGURATION
 -------------
 cdist obtains configuration data from the following sources in the following

From 7b1192257d8517cc838f84a8c57ac0964d104588 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 Jan 2020 13:17:54 +0100
Subject: [PATCH 255/383] Fix incomplete cdist info synopsis

---
 docs/src/man1/cdist.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index 66c356ec..bc73a0b8 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -84,7 +84,7 @@ SYNOPSIS
 
     cdist shell [-h] [-l LOGLEVEL] [-q] [-v] [-s SHELL]
 
-    cdist info [-h] [-a] [-c CONF_DIR] [-e] [-F] [-f] [-t] [pattern]
+    cdist info [-h] [-a] [-c CONF_DIR] [-e] [-F] [-f] [-g CONFIG_FILE] [-t] [pattern]
 
 
 DESCRIPTION

From e2015367925c8a2716e6a79f6f2609f2877cd134 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 Jan 2020 13:18:13 +0100
Subject: [PATCH 256/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index d0a3a2de..7489489e 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)
 	* Type __install_chroot_umount: Bugfix: type was not using __chroot_umount/manifest (Steven Armstrong)
 	* Types __postgres_*: Use double quoted identifiers in generated SQL (Timothée Floure)
+	* Core: Add cdist info command (Darko Poljak)
 
 6.3.0: 2019-12-12
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)

From bc1990c7c8244b2d00a91bc13dbf796d91c21041 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 Jan 2020 13:44:04 +0100
Subject: [PATCH 257/383] ++changelog

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 7489489e..fc4d69a8 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -6,6 +6,8 @@ next:
 	* Type __install_chroot_umount: Bugfix: type was not using __chroot_umount/manifest (Steven Armstrong)
 	* Types __postgres_*: Use double quoted identifiers in generated SQL (Timothée Floure)
 	* Core: Add cdist info command (Darko Poljak)
+	* New types: __mysql_user, __mysql_privileges (Ander Punnar)
+	* Type __mysql_database: Rewrite (Ander Punnar)
 
 6.3.0: 2019-12-12
 	* Type __package_update_index: Fix Alpine part (Dominique Roux)

From 7c9dd3b03e31f39cbe758510e2aa1f542eae4825 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 Jan 2020 14:36:14 +0100
Subject: [PATCH 258/383] Release 6.4.0

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index fc4d69a8..706d76af 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.4.0: 2020-01-04
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)
 	* Type __install_chroot_umount: Bugfix: type was not using __chroot_umount/manifest (Steven Armstrong)
 	* Types __postgres_*: Use double quoted identifiers in generated SQL (Timothée Floure)

From d1a64596fe73697d3e6a8e514991ffc173d04772 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 Jan 2020 14:56:05 +0100
Subject: [PATCH 259/383] Update build-helper

---
 bin/build-helper | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/build-helper b/bin/build-helper
index 69dee4c7..ed41e438 100755
--- a/bin/build-helper
+++ b/bin/build-helper
@@ -370,7 +370,7 @@ eof
         cat << eof
 Manual steps post release:
     - cdist-web
-    - send mail body generated in mailinglist.tmp and inform Dmitry for deb
+    - send generated mailinglist.tmp mail
     - twitter
 eof
     ;;

From 94e32dcd78d73ea5f09845cfdd4f488095f17145 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sat, 4 Jan 2020 16:36:44 +0200
Subject: [PATCH 260/383] __apt_unattended_upgrades: initial commit

---
 .../type/__apt_unattended_upgrades/manifest   | 74 +++++++++++++++++++
 .../parameter/boolean                         |  1 +
 .../parameter/optional                        |  1 +
 .../parameter/optional_multiple               |  1 +
 .../type/__apt_unattended_upgrades/singleton  |  0
 5 files changed, 77 insertions(+)
 create mode 100755 cdist/conf/type/__apt_unattended_upgrades/manifest
 create mode 100644 cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
 create mode 100644 cdist/conf/type/__apt_unattended_upgrades/parameter/optional
 create mode 100644 cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple
 create mode 100644 cdist/conf/type/__apt_unattended_upgrades/singleton

diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
new file mode 100755
index 00000000..bf4d825a
--- /dev/null
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -0,0 +1,74 @@
+#!/bin/sh -e
+
+__package unattended-upgrades
+
+# in normal circumstances 20auto-upgrades is managed
+# by debconf and it can only contain these lines
+# https://wiki.debian.org/UnattendedUpgrades
+
+require='__package/unattended-upgrades' \
+    __file /etc/apt/apt.conf.d/20auto-upgrades \
+        --owner root \
+        --group root \
+        --mode 644 \
+        --source - << EOF
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+EOF
+
+# lets not write into upstream 50unattended-upgrades file,
+# but use our own config files to avoid clashes
+
+ml_conf='/etc/apt/apt.conf.d/51unattended-upgrades-mail'
+bl_conf='/etc/apt/apt.conf.d/51unattended-upgrades-blacklist'
+
+if [ -f "$__object/parameter/mail" ]
+then
+    mail="$( cat "$__object/parameter/mail" )"
+else
+    mail=''
+fi
+
+if [ -n "$mail" ]
+then
+    if [ -f "$__object/parameter/mail-on-error" ]
+    then
+        mail_on_error='true'
+    else
+        mail_on_error='false'
+    fi
+
+    __file "$ml_conf" \
+        --owner root \
+        --group root \
+        --mode 644 \
+        --source - << EOF
+Unattended-Upgrade::Mail "$mail";
+Unattended-Upgrade::MailOnlyOnError "$mail_on_error";
+EOF
+
+else
+    __file "$ml_conf" --state absent
+fi
+
+if [ -f "$__object/parameter/blacklist" ]
+then
+    bl='Unattended-Upgrade::Package-Blacklist {';
+
+    while read -r l
+    do
+        bl="$( printf '%s\n"%s";\n' "$bl" "$l" )"
+    done \
+        < "$__object/parameter/blacklist"
+
+    bl="$( printf '%s\n}' "$bl" )"
+
+    echo "$bl" \
+        | __file "$bl_conf" \
+            --owner root \
+            --group root \
+            --mode 644 \
+            --source -
+else
+    __file "$bl_conf" --state absent
+fi
diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean b/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
new file mode 100644
index 00000000..edcaa12a
--- /dev/null
+++ b/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
@@ -0,0 +1 @@
+mail-on-error
diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/optional b/cdist/conf/type/__apt_unattended_upgrades/parameter/optional
new file mode 100644
index 00000000..fa7963cc
--- /dev/null
+++ b/cdist/conf/type/__apt_unattended_upgrades/parameter/optional
@@ -0,0 +1 @@
+mail
diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple b/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple
new file mode 100644
index 00000000..27b9ffc9
--- /dev/null
+++ b/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple
@@ -0,0 +1 @@
+blacklist
diff --git a/cdist/conf/type/__apt_unattended_upgrades/singleton b/cdist/conf/type/__apt_unattended_upgrades/singleton
new file mode 100644
index 00000000..e69de29b

From a9d491f998c2b41ad97bfeace7f1d24a73ff7482 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sat, 4 Jan 2020 16:59:42 +0200
Subject: [PATCH 261/383] __apt_unattended_upgrades: add license header

---
 .../type/__apt_unattended_upgrades/manifest    | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
index bf4d825a..88a5ccd8 100755
--- a/cdist/conf/type/__apt_unattended_upgrades/manifest
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -1,4 +1,22 @@
 #!/bin/sh -e
+#
+# 2020 Ander Punnar (ander-at-kvlt-dot-ee)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
 
 __package unattended-upgrades
 

From ec8d9571f971c0a0616acdccc9a32589f1b6f042 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sat, 4 Jan 2020 17:07:46 +0200
Subject: [PATCH 262/383] __apt_unattended_upgrades: add manual

---
 .../type/__apt_unattended_upgrades/man.rst    | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 cdist/conf/type/__apt_unattended_upgrades/man.rst

diff --git a/cdist/conf/type/__apt_unattended_upgrades/man.rst b/cdist/conf/type/__apt_unattended_upgrades/man.rst
new file mode 100644
index 00000000..d64b2e9e
--- /dev/null
+++ b/cdist/conf/type/__apt_unattended_upgrades/man.rst
@@ -0,0 +1,54 @@
+cdist-type__apt_unattended_upgrades(7)
+======================================
+
+NAME
+----
+cdist-type__apt_unattended_upgrades - automatic installation of updates
+
+
+DESCRIPTION
+-----------
+
+Install and configure unattended-upgrades package.
+
+
+OPTIONAL PARAMETERS
+-------------------
+mail
+   Send email to this address for problems or packages upgrades.
+
+
+OPTIONAL MULTIPLE PARAMETERS
+----------------------------
+blacklist
+   Python regular expressions, matching packages to exclude from upgrading.
+
+
+BOOLEAN PARAMETERS
+------------------
+mail-on-error
+   Get emails only on errors.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    __apt_unattended_upgrades \
+        --mail root \
+        --mail-on-error \
+        --blacklist multipath-tools \
+        --blacklist open-iscsi
+
+AUTHORS
+-------
+Ander Punnar <ander-at-kvlt-dot-ee>
+
+
+COPYING
+-------
+Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.

From d4bd49bbb598dfd4e4a510a2bf9035dcb4686e4a Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sat, 4 Jan 2020 17:43:57 +0200
Subject: [PATCH 263/383] __acl: rename --acl to --entry for the sake of
 consistency, add compatibility

---
 cdist/conf/type/__acl/gencode-remote          |  5 +++-
 cdist/conf/type/__acl/man.rst                 | 28 +++++++++----------
 .../conf/type/__acl/parameter/deprecated/acl  |  1 +
 .../type/__acl/parameter/optional_multiple    |  1 +
 4 files changed, 20 insertions(+), 15 deletions(-)
 create mode 100644 cdist/conf/type/__acl/parameter/deprecated/acl

diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index 6dab4d09..f4f0d1e2 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -28,7 +28,10 @@ acl_path="/$__object_id"
 
 acl_is="$( cat "$__object/explorer/acl_is" )"
 
-if [ -f "$__object/parameter/acl" ]
+if [ -f "$__object/parameter/entry" ]
+then
+    acl_should="$( cat "$__object/parameter/entry" )"
+elif [ -f "$__object/parameter/acl" ]
 then
     acl_should="$( cat "$__object/parameter/acl" )"
 elif
diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst
index 85e946ce..c3493e49 100644
--- a/cdist/conf/type/__acl/man.rst
+++ b/cdist/conf/type/__acl/man.rst
@@ -15,7 +15,7 @@ See ``setfacl`` and ``acl`` manpages for more details.
 
 REQUIRED MULTIPLE PARAMETERS
 ----------------------------
-acl
+entry
    Set ACL entry following ``getfacl`` output syntax.
 
 
@@ -36,8 +36,8 @@ remove
 
 DEPRECATED PARAMETERS
 ---------------------
-Parameters ``user``, ``group``, ``mask`` and ``other`` are deprecated and they
-will be removed in future versions. Please use ``acl`` parameter instead.
+Parameters ``acl``, ``user``, ``group``, ``mask`` and ``other`` are deprecated and they
+will be removed in future versions. Please use ``entry`` parameter instead.
 
 
 EXAMPLES
@@ -49,27 +49,27 @@ EXAMPLES
         --default \
         --recursive \
         --remove \
-        --acl user:alice:rwx \
-        --acl user:bob:r-x \
-        --acl group:project-group:rwx \
-        --acl group:some-other-group:r-x \
-        --acl mask::r-x \
-        --acl other::r-x
+        --entry user:alice:rwx \
+        --entry user:bob:r-x \
+        --entry group:project-group:rwx \
+        --entry group:some-other-group:r-x \
+        --entry mask::r-x \
+        --entry other::r-x
 
     # give Alice read-only access to subdir,
     # but don't allow her to see parent content.
 
     __acl /srv/project2 \
         --remove \
-        --acl default:group:secret-project:rwx \
-        --acl group:secret-project:rwx \
-        --acl user:alice:--x
+        --entry default:group:secret-project:rwx \
+        --entry group:secret-project:rwx \
+        --entry user:alice:--x
 
     __acl /srv/project2/subdir \
         --default \
         --remove \
-        --acl group:secret-project:rwx \
-        --acl user:alice:r-x
+        --entry group:secret-project:rwx \
+        --entry user:alice:r-x
 
 
 AUTHORS
diff --git a/cdist/conf/type/__acl/parameter/deprecated/acl b/cdist/conf/type/__acl/parameter/deprecated/acl
new file mode 100644
index 00000000..94e14159
--- /dev/null
+++ b/cdist/conf/type/__acl/parameter/deprecated/acl
@@ -0,0 +1 @@
+see manual for details
diff --git a/cdist/conf/type/__acl/parameter/optional_multiple b/cdist/conf/type/__acl/parameter/optional_multiple
index 95c25d55..c615d507 100644
--- a/cdist/conf/type/__acl/parameter/optional_multiple
+++ b/cdist/conf/type/__acl/parameter/optional_multiple
@@ -1,3 +1,4 @@
+entry
 acl
 user
 group

From 51ba4a49d8ec79968f79563f994489c619f10bac Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 4 Jan 2020 18:21:23 +0100
Subject: [PATCH 264/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 706d76af..a7bcf9b1 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)
+
 6.4.0: 2020-01-04
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)
 	* Type __install_chroot_umount: Bugfix: type was not using __chroot_umount/manifest (Steven Armstrong)

From 11f569959d6e331d4d5052ca73fb5d83bf9df8e7 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 11 Jan 2020 14:16:33 +0100
Subject: [PATCH 265/383] Fix missing configuration file usage, support -g

PreOS code did not use configuration support. This fix adds support
for using cdist configuration, which takes into account cdist
configuration file, environment variables and command line options,
especially conf_dir.

It also adds support for -g, --config-file option, for specifying
custom configuration file.
---
 cdist/preos.py          | 24 +++++++++++-------------
 docs/changelog          |  1 +
 docs/src/man1/cdist.rst |  7 ++++++-
 3 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/cdist/preos.py b/cdist/preos.py
index 378071db..491338d2 100644
--- a/cdist/preos.py
+++ b/cdist/preos.py
@@ -5,8 +5,9 @@ import inspect
 import argparse
 import cdist
 import logging
-import re
 import cdist.argparse
+import cdist.configuration
+import cdist.exec.util as util
 
 
 _PREOS_CALL = "commandline"
@@ -24,16 +25,6 @@ def extend_plugins_path(dirs):
             _PLUGINS_PATH.append(preos_dir)
 
 
-cdist_home = cdist.home_dir()
-if cdist_home:
-    extend_plugins_path((cdist_home, ))
-x = 'CDIST_PATH'
-if x in os.environ:
-    vals = re.split(r'(?<!\\):', os.environ[x])
-    vals = [x for x in vals if x]
-    extend_plugins_path(vals)
-
-
 def preos_plugin(obj):
     """It is preos if _PREOS_MARKER is True and has _PREOS_CALL."""
     if hasattr(obj, _PREOS_MARKER):
@@ -102,6 +93,9 @@ class PreOS(object):
                             help=('Add configuration directory (one that '
                                   'contains "preos" subdirectory)'),
                             action='append')
+        parser.add_argument('-g', '--config-file',
+                            help='Use specified custom configuration file.',
+                            dest="config_file", required=False)
         parser.add_argument('-L', '--list-preoses',
                             help='List available PreOS-es',
                             action='store_true', default=False)
@@ -110,8 +104,12 @@ class PreOS(object):
         cdist.argparse.handle_loglevel(args)
         log.debug("preos args : {}".format(args))
 
-        if args.conf_dir:
-            extend_plugins_path(args.conf_dir)
+        cfg = cdist.configuration.Configuration(args)
+        configuration = cfg.get_config(section='GLOBAL')
+        conf_dirs = util.resolve_conf_dirs(configuration,
+                                           args.conf_dir)
+
+        extend_plugins_path(conf_dirs)
         sys.path.extend(_PLUGINS_PATH)
         cls.preoses = find_preoses()
 
diff --git a/docs/changelog b/docs/changelog
index a7bcf9b1..1b1a909e 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)
+	* Core: preos: Fix missing configuration file usage, support -g, --config-file option (Darko Poljak)
 
 6.4.0: 2020-01-04
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)
diff --git a/docs/src/man1/cdist.rst b/docs/src/man1/cdist.rst
index bc73a0b8..38248821 100644
--- a/docs/src/man1/cdist.rst
+++ b/docs/src/man1/cdist.rst
@@ -59,7 +59,9 @@ SYNOPSIS
                          [-I INVENTORY_DIR] [-a] [-f HOSTFILE] [-H] [-t]
                          [host [host ...]]
 
-    cdist preos [-h] [-l LOGLEVEL] [-q] [-v] [-c CONF_DIR] [-L] [preos] ...
+    cdist preos [-h] [-l LOGLEVEL] [-q] [-v] [-c CONF_DIR] [-g CONFIG_FILE]
+                [-L]
+                [preos] ...
 
     cdist preos [preos-options] debian [-h] [-l LOGLEVEL] [-q] [-v] [-b] [-a ARCH] [-B]
                                        [-C] [-c CDIST_PARAMS] [-D DRIVE] [-e REMOTE_EXEC]
@@ -464,6 +466,9 @@ Create PreOS.
 **-c CONF_DIR, --conf-dir CONF_DIR**
     Add configuration directory (one that contains "preos" subdirectory).
 
+**-g CONFIG_FILE, --config-file CONFIG_FILE**
+    Use specified custom configuration file.
+
 **-L, --list-preoses**
     List available PreOS-es.
 

From 3f133dbc1752437617c4b1589259a85827d79ef9 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 11 Jan 2020 15:26:46 +0100
Subject: [PATCH 266/383] Info command: support tilde expansion

---
 cdist/exec/util.py | 7 +++++++
 cdist/info.py      | 8 +++-----
 cdist/preos.py     | 7 ++-----
 docs/changelog     | 1 +
 4 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/cdist/exec/util.py b/cdist/exec/util.py
index 5513f01d..9787f431 100644
--- a/cdist/exec/util.py
+++ b/cdist/exec/util.py
@@ -24,6 +24,7 @@ import os
 from tempfile import TemporaryFile
 
 import cdist
+import cdist.configuration
 
 
 # IMPORTANT:
@@ -200,3 +201,9 @@ def resolve_conf_dirs(configuration, add_conf_dirs):
         conf_dirs.extend(add_conf_dirs)
     conf_dirs = set(conf_dirs)
     return conf_dirs
+
+
+def resolve_conf_dirs_from_config_and_args(args):
+    cfg = cdist.configuration.Configuration(args)
+    configuration = cfg.get_config(section='GLOBAL')
+    return resolve_conf_dirs(configuration, args.conf_dir)
diff --git a/cdist/info.py b/cdist/info.py
index 4c1d3560..b896a3d1 100644
--- a/cdist/info.py
+++ b/cdist/info.py
@@ -53,10 +53,7 @@ class Info(object):
 
     @classmethod
     def commandline(cls, args):
-        cfg = cdist.configuration.Configuration(args)
-        configuration = cfg.get_config(section='GLOBAL')
-        conf_dirs = util.resolve_conf_dirs(configuration,
-                                           args.conf_dir)
+        conf_dirs = util.resolve_conf_dirs_from_config_and_args(args)
         c = cls(conf_dirs, args)
         c.run()
 
@@ -170,7 +167,8 @@ class Info(object):
 
     def run(self):
         rv = []
-        for conf_path in self.conf_dirs:
+        for cp in self.conf_dirs:
+            conf_path = os.path.expanduser(cp)
             if self.all or self.display_global_explorers:
                 rv.extend((x, 'E', ) for x in self._get_global_explorers(
                     conf_path))
diff --git a/cdist/preos.py b/cdist/preos.py
index 491338d2..e353fe3b 100644
--- a/cdist/preos.py
+++ b/cdist/preos.py
@@ -101,13 +101,10 @@ class PreOS(object):
                             action='store_true', default=False)
         parser.add_argument('remainder_args', nargs=argparse.REMAINDER)
         args = parser.parse_args(argv[1:])
-        cdist.argparse.handle_loglevel(args)
+        st.argparse.handle_loglevel(args)
         log.debug("preos args : {}".format(args))
 
-        cfg = cdist.configuration.Configuration(args)
-        configuration = cfg.get_config(section='GLOBAL')
-        conf_dirs = util.resolve_conf_dirs(configuration,
-                                           args.conf_dir)
+        conf_dirs = util.resolve_conf_dirs_from_config_and_args(args)
 
         extend_plugins_path(conf_dirs)
         sys.path.extend(_PLUGINS_PATH)
diff --git a/docs/changelog b/docs/changelog
index 1b1a909e..526fc320 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,7 @@ Changelog
 next:
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)
 	* Core: preos: Fix missing configuration file usage, support -g, --config-file option (Darko Poljak)
+	* Core info command: Support tilde expansion of conf directories (Darko Poljak)
 
 6.4.0: 2020-01-04
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)

From 3258fc98e15fedbd98e17f7d0b568a38b8da139c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 12 Jan 2020 12:19:49 +0100
Subject: [PATCH 267/383] Fix typo

---
 cdist/preos.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/preos.py b/cdist/preos.py
index e353fe3b..bf2a8e60 100644
--- a/cdist/preos.py
+++ b/cdist/preos.py
@@ -101,7 +101,7 @@ class PreOS(object):
                             action='store_true', default=False)
         parser.add_argument('remainder_args', nargs=argparse.REMAINDER)
         args = parser.parse_args(argv[1:])
-        st.argparse.handle_loglevel(args)
+        cdist.argparse.handle_loglevel(args)
         log.debug("preos args : {}".format(args))
 
         conf_dirs = util.resolve_conf_dirs_from_config_and_args(args)

From 93ec4b46aab9cd61d66cb375fcf7a2599c5ef9bb Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 15 Jan 2020 17:23:13 +0100
Subject: [PATCH 268/383] [__line] Ensure the line is only added once

---
 cdist/conf/type/__line/explorer/state | 22 +++++++++++-----------
 cdist/conf/type/__line/gencode-remote |  3 +++
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/cdist/conf/type/__line/explorer/state b/cdist/conf/type/__line/explorer/state
index 2ef252c8..9c0dd1b2 100755
--- a/cdist/conf/type/__line/explorer/state
+++ b/cdist/conf/type/__line/explorer/state
@@ -18,6 +18,17 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+if [ -f "$__object/parameter/file" ]; then
+   file="$(cat "$__object/parameter/file")"
+else
+   file="/$__object_id"
+fi
+
+if [ ! -f "$file" ]; then
+  echo "file_missing"
+  exit 0
+fi
+
 if [ -f "$__object/parameter/before" ]; then
    position="before"
 elif [ -f "$__object/parameter/after" ]; then
@@ -33,17 +44,6 @@ else
    needle="line"
 fi
 
-if [ -f "$__object/parameter/file" ]; then
-   file="$(cat "$__object/parameter/file")"
-else
-   file="/$__object_id"
-fi
-
-if [ ! -f "$file" ]; then
-  echo "file_missing"
-  exit 0
-fi
-
 awk -v position="$position" -v needle="$needle" '
 function _find(_text, _pattern) {
    if (needle == "regex") {
diff --git a/cdist/conf/type/__line/gencode-remote b/cdist/conf/type/__line/gencode-remote
index 03e90c1b..0dd8609a 100755
--- a/cdist/conf/type/__line/gencode-remote
+++ b/cdist/conf/type/__line/gencode-remote
@@ -1,6 +1,7 @@
 #!/bin/sh -e
 #
 # 2018 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -104,10 +105,12 @@ BEGIN {
       if (anchor && match(\$0, anchor)) {
          if (position == "before") {
             print line
+            add = 0
             print
          } else if (position == "after") {
             print
             print line
+            add = 0
          }
          next
       }

From 629d0795c80bdf8af83a71712c643275be0799f1 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 15 Jan 2020 17:23:26 +0100
Subject: [PATCH 269/383] [__line] Always add line to end if anchor is not
 found

---
 cdist/conf/type/__line/gencode-remote | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__line/gencode-remote b/cdist/conf/type/__line/gencode-remote
index 0dd8609a..c8c90c38 100755
--- a/cdist/conf/type/__line/gencode-remote
+++ b/cdist/conf/type/__line/gencode-remote
@@ -118,7 +118,7 @@ BEGIN {
    print
 }
 END {
-   if (add && position == "end") {
+   if (add) {
       print line
    }
 }

From 4cdb8aaa03d07aa72de8dd5961844699ad5888bd Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 15 Jan 2020 17:39:21 +0100
Subject: [PATCH 270/383] [__line/state] Make sure the index match is at the
 beginning

Without the == 1 all lines which contain --line as a substring match.  e.g. if
--line is "line" and the file contains the line "wrong line" this was considered
a match.
---
 cdist/conf/type/__line/explorer/state | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__line/explorer/state b/cdist/conf/type/__line/explorer/state
index 9c0dd1b2..28ec35e2 100755
--- a/cdist/conf/type/__line/explorer/state
+++ b/cdist/conf/type/__line/explorer/state
@@ -49,7 +49,7 @@ function _find(_text, _pattern) {
    if (needle == "regex") {
       return match(_text, _pattern)
    } else {
-      return index(_text, _pattern)
+      return index(_text, _pattern) == 1
    }
 }
 BEGIN {

From 51b1b11cc21e257acbce420ecfcd48ec37e66705 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 15 Jan 2020 17:54:40 +0100
Subject: [PATCH 271/383] [__line/state] Logic fixes in explorer

This commit fixes the incorrectly reported state "wrongposition" if position is
"after" and anchor is present in the file but the line missing.
---
 cdist/conf/type/__line/explorer/state | 41 +++++++++++++++------------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/cdist/conf/type/__line/explorer/state b/cdist/conf/type/__line/explorer/state
index 28ec35e2..6ff0a798 100755
--- a/cdist/conf/type/__line/explorer/state
+++ b/cdist/conf/type/__line/explorer/state
@@ -1,6 +1,7 @@
 #!/bin/sh -e
 #
 # 2018 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -19,7 +20,7 @@
 #
 
 if [ -f "$__object/parameter/file" ]; then
-   file="$(cat "$__object/parameter/file")"
+   file=$(cat "$__object/parameter/file")
 else
    file="/$__object_id"
 fi
@@ -55,41 +56,45 @@ function _find(_text, _pattern) {
 BEGIN {
    getline anchor < (ENVIRON["__object"] "/parameter/" position)
    getline pattern < (ENVIRON["__object"] "/parameter/" needle)
-   state = "absent"
+
+   found_line = 0
+   correct_pos = (position != "after" && position != "before")
 }
 {
    if (position == "after") {
       if (match($0, anchor)) {
          getline
          if (_find($0, pattern)) {
-            state = "present"
+            found_line++
+            correct_pos = 1
+            exit 0
          }
-         else {
-            state = "wrongposition"
-         }
-         exit 0
+      } else if (_find($0, pattern)) {
+         found_line++
       }
-   }
-   else if (position == "before") {
+   } else if (position == "before") {
       if (_find($0, pattern)) {
+         found_line++
          getline
          if (match($0, anchor)) {
-            state = "present"
+            correct_pos = 1
+            exit 0
          }
-         else {
-            state = "wrongposition"
-         }
-         exit 0
       }
-   }
-   else {
+   } else {
       if (_find($0, pattern)) {
-         state = "present"
+         found_line++
          exit 0
       }
    }
 }
 END {
-   print state
+   if (found_line && correct_pos) {
+      print "present"
+   } else if (found_line) {
+      print "wrongposition"
+   } else {
+      print "absent"
+   }
 }
 ' "$file"

From cd2d5b3f79d1e3ea8545b67096d67d6ceda763e6 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 15 Jan 2020 19:24:21 +0200
Subject: [PATCH 272/383] __apt_unattended_upgrades: all objects depend on
 package

---
 cdist/conf/type/__apt_unattended_upgrades/manifest | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
index 88a5ccd8..811e79a6 100755
--- a/cdist/conf/type/__apt_unattended_upgrades/manifest
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -20,16 +20,17 @@
 
 __package unattended-upgrades
 
+export require='__package/unattended-upgrades'
+
 # in normal circumstances 20auto-upgrades is managed
 # by debconf and it can only contain these lines
 # https://wiki.debian.org/UnattendedUpgrades
 
-require='__package/unattended-upgrades' \
-    __file /etc/apt/apt.conf.d/20auto-upgrades \
-        --owner root \
-        --group root \
-        --mode 644 \
-        --source - << EOF
+__file /etc/apt/apt.conf.d/20auto-upgrades \
+    --owner root \
+    --group root \
+    --mode 644 \
+    --source - << EOF
 APT::Periodic::Update-Package-Lists "1";
 APT::Periodic::Unattended-Upgrade "1";
 EOF

From 68e5502fce3d3ae043ae0792a14abd1970834d36 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 15 Jan 2020 19:27:02 +0200
Subject: [PATCH 273/383] __apt_unattended_upgrades: move debian wiki link to
 manual

---
 cdist/conf/type/__apt_unattended_upgrades/man.rst  | 2 ++
 cdist/conf/type/__apt_unattended_upgrades/manifest | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__apt_unattended_upgrades/man.rst b/cdist/conf/type/__apt_unattended_upgrades/man.rst
index d64b2e9e..f75c6513 100644
--- a/cdist/conf/type/__apt_unattended_upgrades/man.rst
+++ b/cdist/conf/type/__apt_unattended_upgrades/man.rst
@@ -11,6 +11,8 @@ DESCRIPTION
 
 Install and configure unattended-upgrades package.
 
+For more information see https://wiki.debian.org/UnattendedUpgrades.
+
 
 OPTIONAL PARAMETERS
 -------------------
diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
index 811e79a6..03cc2c50 100755
--- a/cdist/conf/type/__apt_unattended_upgrades/manifest
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -24,7 +24,6 @@ export require='__package/unattended-upgrades'
 
 # in normal circumstances 20auto-upgrades is managed
 # by debconf and it can only contain these lines
-# https://wiki.debian.org/UnattendedUpgrades
 
 __file /etc/apt/apt.conf.d/20auto-upgrades \
     --owner root \

From 2cf44c66d46435e859fe0528d4b414dafd8b468a Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 15 Jan 2020 19:00:30 +0100
Subject: [PATCH 274/383] [__directory] Add --state exists and --state
 pre-exists

---
 cdist/conf/type/__directory/gencode-remote | 17 ++++++++++++++---
 cdist/conf/type/__directory/man.rst        | 15 +++++++++++++--
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/type/__directory/gencode-remote b/cdist/conf/type/__directory/gencode-remote
index 374db47a..e1ab69d7 100755
--- a/cdist/conf/type/__directory/gencode-remote
+++ b/cdist/conf/type/__directory/gencode-remote
@@ -3,6 +3,7 @@
 # 2011-2013 Nico Schottelius (nico-cdist at schottelius.org)
 # 2013 Steven Armstrong (steven-cdist armstrong.cc)
 # 2014 Daniel Heule (hda at sfs.biz)
+# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -21,8 +22,8 @@
 #
 
 destination="/$__object_id"
-state_should="$(cat "$__object/parameter/state")"
-type="$(cat "$__object/explorer/type")"
+state_should=$(cat "$__object/parameter/state")
+type=$(cat "$__object/explorer/type")
 stat_file="$__object/explorer/stat"
 
 # variable to keep track if we have to set directory attributes
@@ -72,7 +73,7 @@ set_mode() {
 }
 
 case "$state_should" in
-   present)
+   present|exists)
       if [ "$type" != "directory" ]; then
          set_attributes=1
          if [ "$type" != "none" ]; then
@@ -83,6 +84,10 @@ case "$state_should" in
          fi
          echo "mkdir $mkdiropt '$destination'"
          echo "create" >> "$__messages_out"
+      elif [ "$state_should" = 'exists' ]; then
+         # The type is directory and --state exists. We are done and do not
+         # check or set the attributes.
+         exit 0
       fi
 
       # Note: Mode - needs to happen last as a chown/chgrp can alter mode by
@@ -103,6 +108,12 @@ case "$state_should" in
          fi
       done
    ;;
+   pre-exists)
+      if [ "$type" != "directory" ]; then
+         echo "Directory \"$destination\" does not exist" >&2
+         exit 1
+      fi
+   ;;
    absent)
         if [ "$type" = "directory" ]; then
             echo "rm -rf '$destination'"
diff --git a/cdist/conf/type/__directory/man.rst b/cdist/conf/type/__directory/man.rst
index 74b00afe..7755334c 100644
--- a/cdist/conf/type/__directory/man.rst
+++ b/cdist/conf/type/__directory/man.rst
@@ -19,7 +19,18 @@ None.
 OPTIONAL PARAMETERS
 -------------------
 state
-   'present' or 'absent', defaults to 'present'
+   'present', 'absent', 'exists' or 'pre-exists', defaults to 'present' where:
+
+   present
+      the directory exists and the given attributes are set.
+   absent
+      the directory does not exist.
+   exists
+      the directory exists, but its attributes are not altered if it already
+      existed.
+   pre-exists
+      check that the directory exists and is indeed a directory, but do not
+      create or modify it.
 
 group
    Group to chgrp to.
@@ -36,7 +47,7 @@ BOOLEAN PARAMETERS
 parents
    Whether to create parents as well (mkdir -p behaviour).
    Warning: all intermediate directory permissions default
-   to whatever mkdir -p does. 
+   to whatever mkdir -p does.
 
    Usually this means root:root, 0700.
 

From cd24a806e7be7b3300543943e8c7a5582a55d15e Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 15 Jan 2020 20:48:32 +0200
Subject: [PATCH 275/383] __apt_unattended_upgrades: rewrite manifest, add more
 parameters

---
 .../type/__apt_unattended_upgrades/manifest   | 88 +++++++++++++------
 .../parameter/boolean                         |  4 +
 2 files changed, 63 insertions(+), 29 deletions(-)

diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
index 03cc2c50..cb99b611 100755
--- a/cdist/conf/type/__apt_unattended_upgrades/manifest
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -34,39 +34,61 @@ APT::Periodic::Update-Package-Lists "1";
 APT::Periodic::Unattended-Upgrade "1";
 EOF
 
-# lets not write into upstream 50unattended-upgrades file,
-# but use our own config files to avoid clashes
-
-ml_conf='/etc/apt/apt.conf.d/51unattended-upgrades-mail'
-bl_conf='/etc/apt/apt.conf.d/51unattended-upgrades-blacklist'
+conf='# this file is managed by cdist'
 
 if [ -f "$__object/parameter/mail" ]
 then
-    mail="$( cat "$__object/parameter/mail" )"
-else
-    mail=''
+    conf="$(
+        printf \
+            '%s\nUnattended-Upgrade::Mail "%s";\n' \
+            "$conf" \
+            "$( cat "$__object/parameter/mail" )"
+        )"
 fi
 
-if [ -n "$mail" ]
+if [ -f "$__object/parameter/mail-on-error" ]
 then
-    if [ -f "$__object/parameter/mail-on-error" ]
-    then
-        mail_on_error='true'
-    else
-        mail_on_error='false'
-    fi
+    conf="$(
+        printf \
+            '%s\nUnattended-Upgrade::MailOnlyOnError "true";\n' \
+            "$conf"
+        )"
+fi
 
-    __file "$ml_conf" \
-        --owner root \
-        --group root \
-        --mode 644 \
-        --source - << EOF
-Unattended-Upgrade::Mail "$mail";
-Unattended-Upgrade::MailOnlyOnError "$mail_on_error";
-EOF
+if [ -f "$__object/parameter/no-auto-fix" ]
+then
+    conf="$(
+        printf \
+            '%s\nUnattended-Upgrade::AutoFixInterruptedDpkg "false";\n' \
+            "$conf"
+        )"
+fi
 
-else
-    __file "$ml_conf" --state absent
+if [ -f "$__object/parameter/no-minimal-steps" ]
+then
+    conf="$(
+        printf \
+            '%s\nUnattended-Upgrade::MinimalSteps "false";\n' \
+            "$conf"
+        )"
+fi
+
+if [ -f "$__object/parameter/on-shutdown" ]
+then
+    conf="$(
+        printf \
+            '%s\nUnattended-Upgrade::InstallOnShutdown "true";\n' \
+            "$conf"
+        )"
+fi
+
+if [ -f "$__object/parameter/reboot" ]
+then
+    conf="$(
+        printf \
+            '%s\nUnattended-Upgrade::Automatic-Reboot "true";\n' \
+            "$conf"
+        )"
 fi
 
 if [ -f "$__object/parameter/blacklist" ]
@@ -79,14 +101,22 @@ then
     done \
         < "$__object/parameter/blacklist"
 
-    bl="$( printf '%s\n}' "$bl" )"
+    conf="$( printf '%s\n%s\n}\n' "$conf" "$bl" )"
+fi
 
-    echo "$bl" \
-        | __file "$bl_conf" \
+# lets not write into upstream 50unattended-upgrades file,
+# but use our own config files to avoid clashes
+
+conf_file='/etc/apt/apt.conf.d/51unattended-upgrades-cdist'
+
+if [ "$( echo "$conf" | wc -l )" -gt 1 ]
+then
+    echo "$conf" \
+        | __file "$conf_file" \
             --owner root \
             --group root \
             --mode 644 \
             --source -
 else
-    __file "$bl_conf" --state absent
+    __file "$conf_file" --state absent
 fi
diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean b/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
index edcaa12a..6ad9790f 100644
--- a/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
+++ b/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
@@ -1 +1,5 @@
 mail-on-error
+no-auto-fix
+no-minimal-steps
+on-shutdown
+reboot

From b3f36dbe5bc7d1e21892f765ee08dfc5d8c6a6e3 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 15 Jan 2020 20:51:47 +0200
Subject: [PATCH 276/383] __apt_unattended_upgrades: fix typo

---
 cdist/conf/type/__apt_unattended_upgrades/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
index cb99b611..04225a9b 100755
--- a/cdist/conf/type/__apt_unattended_upgrades/manifest
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -105,7 +105,7 @@ then
 fi
 
 # lets not write into upstream 50unattended-upgrades file,
-# but use our own config files to avoid clashes
+# but use our own config file to avoid clashes
 
 conf_file='/etc/apt/apt.conf.d/51unattended-upgrades-cdist'
 

From 5a9a1ba57fc45df63cff123a42905360c3a7bddb Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 15 Jan 2020 22:00:56 +0100
Subject: [PATCH 277/383] [__line] Produce error when file does not exist

---
 cdist/conf/type/__line/explorer/state |  5 +----
 cdist/conf/type/__line/gencode-remote | 17 +++++++++++------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/cdist/conf/type/__line/explorer/state b/cdist/conf/type/__line/explorer/state
index 6ff0a798..e8fc3630 100755
--- a/cdist/conf/type/__line/explorer/state
+++ b/cdist/conf/type/__line/explorer/state
@@ -25,10 +25,7 @@ else
    file="/$__object_id"
 fi
 
-if [ ! -f "$file" ]; then
-  echo "file_missing"
-  exit 0
-fi
+[ -f "$file" ] || exit 0
 
 if [ -f "$__object/parameter/before" ]; then
    position="before"
diff --git a/cdist/conf/type/__line/gencode-remote b/cdist/conf/type/__line/gencode-remote
index c8c90c38..88cae68b 100755
--- a/cdist/conf/type/__line/gencode-remote
+++ b/cdist/conf/type/__line/gencode-remote
@@ -24,9 +24,20 @@ if [ -f "$__object/parameter/before" ] && [ -f "$__object/parameter/after" ]; th
    exit 1
 fi
 
+if [ -f "$__object/parameter/file" ]; then
+   file="$(cat "$__object/parameter/file")"
+else
+   file="/$__object_id"
+fi
+
 state_should="$(cat "$__object/parameter/state")"
 state_is="$(cat "$__object/explorer/state")"
 
+if [ -z "$state_is" ]; then
+   printf 'The file "%s" is missing. Please create it before using %s on it.\n' "$file" "${__type##*/}" >&2
+   exit 1
+fi
+
 if [ "$state_should" = "$state_is" ]; then
    # nothing to do
    exit 0
@@ -47,12 +58,6 @@ else
    needle="line"
 fi
 
-if [ -f "$__object/parameter/file" ]; then
-   file="$(cat "$__object/parameter/file")"
-else
-   file="/$__object_id"
-fi
-
 add=0
 remove=0
 case "$state_should" in

From f5f70671cb3e4ca8b2d5e2a0e66a1847f05ef4bf Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Thu, 16 Jan 2020 00:59:03 +0200
Subject: [PATCH 278/383] __apt_unattended_upgrades: make parameters more
 speaking

---
 cdist/conf/type/__apt_unattended_upgrades/manifest        | 8 ++++----
 .../conf/type/__apt_unattended_upgrades/parameter/boolean | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
index 04225a9b..094dfa1c 100755
--- a/cdist/conf/type/__apt_unattended_upgrades/manifest
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -46,7 +46,7 @@ then
         )"
 fi
 
-if [ -f "$__object/parameter/mail-on-error" ]
+if [ -f "$__object/parameter/mail-only-on-error" ]
 then
     conf="$(
         printf \
@@ -55,7 +55,7 @@ then
         )"
 fi
 
-if [ -f "$__object/parameter/no-auto-fix" ]
+if [ -f "$__object/parameter/no-auto-fix-interrupted-dpkg" ]
 then
     conf="$(
         printf \
@@ -73,7 +73,7 @@ then
         )"
 fi
 
-if [ -f "$__object/parameter/on-shutdown" ]
+if [ -f "$__object/parameter/install-on-shutdown" ]
 then
     conf="$(
         printf \
@@ -82,7 +82,7 @@ then
         )"
 fi
 
-if [ -f "$__object/parameter/reboot" ]
+if [ -f "$__object/parameter/automatic-reboot" ]
 then
     conf="$(
         printf \
diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean b/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
index 6ad9790f..831dc95c 100644
--- a/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
+++ b/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
@@ -1,5 +1,5 @@
-mail-on-error
-no-auto-fix
+mail-only-on-error
+no-auto-fix-interrupted-dpkg
 no-minimal-steps
-on-shutdown
-reboot
+install-on-shutdown
+automatic-reboot

From 6fa0d687f7bdf3ba1e6a032118553d90ceba0b22 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Thu, 16 Jan 2020 01:13:27 +0200
Subject: [PATCH 279/383] __apt_unattended_upgrades: alternative approach

---
 .../type/__apt_unattended_upgrades/manifest   | 100 ++++++------------
 .../parameter/boolean                         |   5 -
 .../parameter/optional                        |   1 -
 .../parameter/optional_multiple               |   1 +
 4 files changed, 31 insertions(+), 76 deletions(-)
 delete mode 100644 cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
 delete mode 100644 cdist/conf/type/__apt_unattended_upgrades/parameter/optional

diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
index 094dfa1c..2f8f6e76 100755
--- a/cdist/conf/type/__apt_unattended_upgrades/manifest
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -34,81 +34,41 @@ APT::Periodic::Update-Package-Lists "1";
 APT::Periodic::Unattended-Upgrade "1";
 EOF
 
-conf='# this file is managed by cdist'
-
-if [ -f "$__object/parameter/mail" ]
-then
-    conf="$(
-        printf \
-            '%s\nUnattended-Upgrade::Mail "%s";\n' \
-            "$conf" \
-            "$( cat "$__object/parameter/mail" )"
-        )"
-fi
-
-if [ -f "$__object/parameter/mail-only-on-error" ]
-then
-    conf="$(
-        printf \
-            '%s\nUnattended-Upgrade::MailOnlyOnError "true";\n' \
-            "$conf"
-        )"
-fi
-
-if [ -f "$__object/parameter/no-auto-fix-interrupted-dpkg" ]
-then
-    conf="$(
-        printf \
-            '%s\nUnattended-Upgrade::AutoFixInterruptedDpkg "false";\n' \
-            "$conf"
-        )"
-fi
-
-if [ -f "$__object/parameter/no-minimal-steps" ]
-then
-    conf="$(
-        printf \
-            '%s\nUnattended-Upgrade::MinimalSteps "false";\n' \
-            "$conf"
-        )"
-fi
-
-if [ -f "$__object/parameter/install-on-shutdown" ]
-then
-    conf="$(
-        printf \
-            '%s\nUnattended-Upgrade::InstallOnShutdown "true";\n' \
-            "$conf"
-        )"
-fi
-
-if [ -f "$__object/parameter/automatic-reboot" ]
-then
-    conf="$(
-        printf \
-            '%s\nUnattended-Upgrade::Automatic-Reboot "true";\n' \
-            "$conf"
-        )"
-fi
-
-if [ -f "$__object/parameter/blacklist" ]
-then
-    bl='Unattended-Upgrade::Package-Blacklist {';
-
-    while read -r l
-    do
-        bl="$( printf '%s\n"%s";\n' "$bl" "$l" )"
-    done \
-        < "$__object/parameter/blacklist"
-
-    conf="$( printf '%s\n%s\n}\n' "$conf" "$bl" )"
-fi
-
 # lets not write into upstream 50unattended-upgrades file,
 # but use our own config file to avoid clashes
 
 conf_file='/etc/apt/apt.conf.d/51unattended-upgrades-cdist'
 
+conf='# this file is managed by cdist'
+
+if [ -f "$__object/parameter/option" ]
+then
+    o=''
+
+    while read -r l
+    do
+        k="$( echo "$l" | awk -F= '{print $1}' )"
+        v="$( echo "$l" | awk -F= '{print $2}' )"
+        o="$( printf '%s\nUnattended-Upgrade::%s "%s";\n' "$o" "$k" "$v" )"
+    done \
+        < "$__object/parameter/option"
+
+    conf="$( printf '%s\n%s\n' "$conf" "$o" )"
+fi
+
+if [ -f "$__object/parameter/blacklist" ]
+then
+    b='Unattended-Upgrade::Package-Blacklist {'
+
+    while read -r l
+    do
+        b="$( printf '%s\n"%s";\n' "$b" "$l" )"
+    done \
+        < "$__object/parameter/blacklist"
+
+    conf="$( printf '%s\n%s\n}\n' "$conf" "$b" )"
+fi
+
 if [ "$( echo "$conf" | wc -l )" -gt 1 ]
 then
     echo "$conf" \
diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean b/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
deleted file mode 100644
index 831dc95c..00000000
--- a/cdist/conf/type/__apt_unattended_upgrades/parameter/boolean
+++ /dev/null
@@ -1,5 +0,0 @@
-mail-only-on-error
-no-auto-fix-interrupted-dpkg
-no-minimal-steps
-install-on-shutdown
-automatic-reboot
diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/optional b/cdist/conf/type/__apt_unattended_upgrades/parameter/optional
deleted file mode 100644
index fa7963cc..00000000
--- a/cdist/conf/type/__apt_unattended_upgrades/parameter/optional
+++ /dev/null
@@ -1 +0,0 @@
-mail
diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple b/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple
index 27b9ffc9..ea4fba2b 100644
--- a/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple
+++ b/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple
@@ -1 +1,2 @@
+option
 blacklist

From ef2f4b9a004369cc390f1271721bc22d6a44f402 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Fri, 17 Jan 2020 11:21:28 +0100
Subject: [PATCH 280/383] __postgres_*: fix forgotten edge cases in delimited
 identifier escape

---
 cdist/conf/type/__postgres_database/gencode-remote |  8 ++++++--
 cdist/conf/type/__postgres_role/gencode-remote     | 10 ++++++----
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/type/__postgres_database/gencode-remote b/cdist/conf/type/__postgres_database/gencode-remote
index 9f12d215..47e6b97c 100755
--- a/cdist/conf/type/__postgres_database/gencode-remote
+++ b/cdist/conf/type/__postgres_database/gencode-remote
@@ -43,10 +43,14 @@ if [ "$state_should" != "$state_is" ]; then
          if [ -f "$__object/parameter/owner" ]; then
             owner="-O \"$(cat "$__object/parameter/owner")\""
          fi
-         echo "su - '$postgres_user' -c \"createdb $owner \"$name\"\""
+         cat << EOF
+su - '$postgres_user' -c "createdb $owner \"$name\""
+EOF
       ;;
       absent)
-         echo "su - '$postgres_user' -c \"dropdb \"$name\"\""
+         cat << EOF
+su - '$postgres_user' -c "dropdb \"$name\""
+EOF
       ;;
    esac
 fi
diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote
index 0b8852f4..977832c9 100755
--- a/cdist/conf/type/__postgres_role/gencode-remote
+++ b/cdist/conf/type/__postgres_role/gencode-remote
@@ -53,11 +53,13 @@ case "$state_should" in
         done
 
         [ -n "$password" ] && password="PASSWORD '$password'"
-
-        cmd="CREATE ROLE \"$name\" WITH $password $booleans"
-        echo "su - '$postgres_user' -c \"psql postgres -wc \\\"$cmd\\\"\""
+        cat << EOF
+su - '$postgres_user' -c "psql postgres -wc 'CREATE ROLE \"$name\" WITH $password $booleans;'"
+EOF
     ;;
     absent)
-        echo "su - '$postgres_user' -c \"dropuser \\\"$name\\\"\""
+        cat << EOF
+su - '$postgres_user' -c "dropuser \"$name\""
+EOF
     ;;
 esac

From 6097cd9e90341146948886a9480cd0b70ee9e60f Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 17 Jan 2020 14:41:00 +0200
Subject: [PATCH 281/383] __apt_unattended_upgrades: use word expansions

---
 cdist/conf/type/__apt_unattended_upgrades/manifest | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest
index 2f8f6e76..3c00e2f4 100755
--- a/cdist/conf/type/__apt_unattended_upgrades/manifest
+++ b/cdist/conf/type/__apt_unattended_upgrades/manifest
@@ -47,9 +47,7 @@ then
 
     while read -r l
     do
-        k="$( echo "$l" | awk -F= '{print $1}' )"
-        v="$( echo "$l" | awk -F= '{print $2}' )"
-        o="$( printf '%s\nUnattended-Upgrade::%s "%s";\n' "$o" "$k" "$v" )"
+        o="$( printf '%s\nUnattended-Upgrade::%s "%s";\n' "$o" "${l%%=*}" "${l#*=}" )"
     done \
         < "$__object/parameter/option"
 

From 65c5b592a590f3f4f8b31a1b7c32b2a98354d054 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 17 Jan 2020 14:48:54 +0200
Subject: [PATCH 282/383] __apt_unattended_upgrades: update manual

---
 .../type/__apt_unattended_upgrades/man.rst    | 40 ++++++++++++-------
 1 file changed, 26 insertions(+), 14 deletions(-)

diff --git a/cdist/conf/type/__apt_unattended_upgrades/man.rst b/cdist/conf/type/__apt_unattended_upgrades/man.rst
index f75c6513..2231b5f9 100644
--- a/cdist/conf/type/__apt_unattended_upgrades/man.rst
+++ b/cdist/conf/type/__apt_unattended_upgrades/man.rst
@@ -14,35 +14,47 @@ Install and configure unattended-upgrades package.
 For more information see https://wiki.debian.org/UnattendedUpgrades.
 
 
-OPTIONAL PARAMETERS
--------------------
-mail
-   Send email to this address for problems or packages upgrades.
-
-
 OPTIONAL MULTIPLE PARAMETERS
 ----------------------------
+option
+   Set options for unattended-upgrades. See examples.
+
+   Supported options with default values (as of 2020-01-17) are:
+
+   - AutoFixInterruptedDpkg, default is "true"
+   - MinimalSteps, default is "true"
+   - InstallOnShutdown, default is "false"
+   - Mail, default is "" (empty)
+   - MailOnlyOnError, default is "false"
+   - Remove-Unused-Kernel-Packages, default is "true"
+   - Remove-New-Unused-Dependencies, default is "true"
+   - Remove-Unused-Dependencies, default is "false"
+   - Automatic-Reboot, default is "false"
+   - Automatic-Reboot-WithUsers, default is "true"
+   - Automatic-Reboot-Time, default is "02:00"
+   - SyslogEnable, default is "false"
+   - SyslogFacility, default is "daemon"
+   - OnlyOnACPower, default is "true"
+   - Skip-Updates-On-Metered-Connections, default is "true"
+   - Verbose, default is "false"
+   - Debug, default is "false"
+
 blacklist
    Python regular expressions, matching packages to exclude from upgrading.
 
 
-BOOLEAN PARAMETERS
-------------------
-mail-on-error
-   Get emails only on errors.
-
-
 EXAMPLES
 --------
 
 .. code-block:: sh
 
     __apt_unattended_upgrades \
-        --mail root \
-        --mail-on-error \
+        --option Mail=root \
+        --option MailOnlyOnError=true \
         --blacklist multipath-tools \
         --blacklist open-iscsi
 
+
 AUTHORS
 -------
 Ander Punnar <ander-at-kvlt-dot-ee>

From e292c9f1245a59cda5c721d4ce4e201ce9799349 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 17 Jan 2020 15:48:59 +0100
Subject: [PATCH 283/383] ++changelog

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 526fc320..bc251d64 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,8 @@ next:
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)
 	* Core: preos: Fix missing configuration file usage, support -g, --config-file option (Darko Poljak)
 	* Core info command: Support tilde expansion of conf directories (Darko Poljak)
+	* Types __postgres_*: Fix edge cases in quoted identifiers (Timothée Floure)
+	* New type: __apt_unattended_upgrades (Ander Punnar)
 
 6.4.0: 2020-01-04
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)

From 45890cc7e43577252e8560ca70611a88e9936ffa Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 17 Jan 2020 18:14:49 +0100
Subject: [PATCH 284/383] ++changelog

---
 docs/changelog | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index bc251d64..ccaf848f 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,6 +7,12 @@ next:
 	* Core info command: Support tilde expansion of conf directories (Darko Poljak)
 	* Types __postgres_*: Fix edge cases in quoted identifiers (Timothée Floure)
 	* New type: __apt_unattended_upgrades (Ander Punnar)
+	* Type __line: Bugfixes: (Dennis Camera)
+		- ensure the line is only added once
+		- always add line to end if anchor is not found
+		- match line at the beginning when not regex
+		- fix incorrect 'wrongposition' in state explorer
+		- produce error when file does not exist
 
 6.4.0: 2020-01-04
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)

From e1ac97b6a5b10d29b7b9bd70c5adea7e9c33b2e9 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sun, 19 Jan 2020 14:02:00 +0200
Subject: [PATCH 285/383] __acl: add --source

---
 cdist/conf/type/__acl/gencode-remote     | 12 +++++++++++-
 cdist/conf/type/__acl/man.rst            | 12 ++++++++++++
 cdist/conf/type/__acl/parameter/optional |  1 +
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index f4f0d1e2..70a46af5 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -28,7 +28,17 @@ acl_path="/$__object_id"
 
 acl_is="$( cat "$__object/explorer/acl_is" )"
 
-if [ -f "$__object/parameter/entry" ]
+if [ -f "$__object/parameter/source" ]
+then
+    acl_source="$( cat "$__object/parameter/source" )"
+
+    if [ "$acl_source" = '-' ]
+    then
+        acl_should="$( cat "$__object/stdin" )"
+    else
+        acl_should="$( grep -Ev '^#|^$' "$acl_source" )"
+    fi
+elif [ -f "$__object/parameter/entry" ]
 then
     acl_should="$( cat "$__object/parameter/entry" )"
 elif [ -f "$__object/parameter/acl" ]
diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst
index c3493e49..e7ef9579 100644
--- a/cdist/conf/type/__acl/man.rst
+++ b/cdist/conf/type/__acl/man.rst
@@ -19,6 +19,14 @@ entry
    Set ACL entry following ``getfacl`` output syntax.
 
 
+OPTIONAL PARAMETERS
+-------------------
+source
+   Read ACL entries from stdin or file.
+   Ordering of entries is not important.
+   When reading from file, comments and empty lines are ignored.
+
+
 BOOLEAN PARAMETERS
 ------------------
 default
@@ -71,6 +79,10 @@ EXAMPLES
         --entry group:secret-project:rwx \
         --entry user:alice:r-x
 
+    # read acl from stdin
+    echo 'user:alice:rwx' \
+        | __acl /path/to/directory --source -
+
 
 AUTHORS
 -------
diff --git a/cdist/conf/type/__acl/parameter/optional b/cdist/conf/type/__acl/parameter/optional
index 4b32086b..12edcccb 100644
--- a/cdist/conf/type/__acl/parameter/optional
+++ b/cdist/conf/type/__acl/parameter/optional
@@ -1,2 +1,3 @@
 mask
 other
+source

From 5089f9055ecb0b826942c8f947eb26f9ef397aaa Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 19 Jan 2020 19:41:26 +0100
Subject: [PATCH 286/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index ccaf848f..3f240e5a 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -13,6 +13,7 @@ next:
 		- match line at the beginning when not regex
 		- fix incorrect 'wrongposition' in state explorer
 		- produce error when file does not exist
+	* Type __acl: Add --source parameter (Ander Punnar)
 
 6.4.0: 2020-01-04
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)

From 1fbd2fc2bdf76697dd50808cd3927d15f6b8bc5c Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sun, 19 Jan 2020 22:51:40 +0200
Subject: [PATCH 287/383] __acl: add --file and --directory for convenience

---
 cdist/conf/type/__acl/gencode-remote     |  8 +++++++-
 cdist/conf/type/__acl/man.rst            | 13 +++++++++++++
 cdist/conf/type/__acl/manifest           | 11 +++++++++++
 cdist/conf/type/__acl/parameter/optional |  2 ++
 4 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100755 cdist/conf/type/__acl/manifest

diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote
index 70a46af5..e5404a9d 100755
--- a/cdist/conf/type/__acl/gencode-remote
+++ b/cdist/conf/type/__acl/gencode-remote
@@ -20,7 +20,13 @@
 
 file_is="$( cat "$__object/explorer/file_is" )"
 
-[ "$file_is" = 'missing' ] && [ -z "$__cdist_dry_run" ] && exit 0
+if [ "$file_is" = 'missing' ] \
+    && [ -z "$__cdist_dry_run" ] \
+    && \( [ ! -f "$__object/parameter/file" ] \
+        || [ ! -f "$__object/parameter/directory" ] \)
+then
+    exit 0
+fi
 
 os="$( cat "$__global/explorer/os" )"
 
diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst
index e7ef9579..28412871 100644
--- a/cdist/conf/type/__acl/man.rst
+++ b/cdist/conf/type/__acl/man.rst
@@ -26,6 +26,12 @@ source
    Ordering of entries is not important.
    When reading from file, comments and empty lines are ignored.
 
+file
+   Create/change file with ``__file`` using ``user:group:mode`` pattern.
+
+directory
+   Create/change directory with ``__directory`` using ``user:group:mode`` pattern.
+
 
 BOOLEAN PARAMETERS
 ------------------
@@ -83,6 +89,13 @@ EXAMPLES
     echo 'user:alice:rwx' \
         | __acl /path/to/directory --source -
 
+    # create/change directory too
+    __acl /path/to/directory \
+        --default \
+        --remove \
+        --directory root:root:770 \
+        --entry user:nobody:rwx
+
 
 AUTHORS
 -------
diff --git a/cdist/conf/type/__acl/manifest b/cdist/conf/type/__acl/manifest
new file mode 100755
index 00000000..5fd23110
--- /dev/null
+++ b/cdist/conf/type/__acl/manifest
@@ -0,0 +1,11 @@
+#!/bin/sh -e
+
+for p in file directory
+do
+    [ ! -f "$__object/parameter/$p" ] && continue
+
+    "__$p" "/$__object_id" \
+        --owner "$( awk -F: '{print $1}' "$__object/parameter/$p" )" \
+        --group "$( awk -F: '{print $2}' "$__object/parameter/$p" )" \
+        --mode  "$( awk -F: '{print $3}' "$__object/parameter/$p" )"
+done
diff --git a/cdist/conf/type/__acl/parameter/optional b/cdist/conf/type/__acl/parameter/optional
index 12edcccb..cdcbc0b8 100644
--- a/cdist/conf/type/__acl/parameter/optional
+++ b/cdist/conf/type/__acl/parameter/optional
@@ -1,3 +1,5 @@
 mask
 other
 source
+file
+directory

From 4e8ccd9b788c11403f586bf0c413d57546013c1b Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 20 Jan 2020 09:08:55 +0100
Subject: [PATCH 288/383] ++changelog

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 3f240e5a..083cf5fb 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -13,7 +13,7 @@ next:
 		- match line at the beginning when not regex
 		- fix incorrect 'wrongposition' in state explorer
 		- produce error when file does not exist
-	* Type __acl: Add --source parameter (Ander Punnar)
+	* Type __acl: Add --source, --file and --directory parameters (Ander Punnar)
 
 6.4.0: 2020-01-04
 	* Type __consul_agent: Don't deploy init script on Alpine anymore, it ships with one itself (Nico Schottelius)

From 8f12a4c505812d640cd926567ee8c6300a6341fb Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 23 Jan 2020 07:10:48 +0100
Subject: [PATCH 289/383] Release 6.5.0

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 083cf5fb..467c0f22 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.5.0: 2020-01-23
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)
 	* Core: preos: Fix missing configuration file usage, support -g, --config-file option (Darko Poljak)
 	* Core info command: Support tilde expansion of conf directories (Darko Poljak)

From 87f30b6053315f11013bbf92ce1281bca2d54f43 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 23 Jan 2020 14:40:07 +0100
Subject: [PATCH 290/383] Update sphinx docs copyright year

---
 docs/src/conf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/src/conf.py b/docs/src/conf.py
index 78f9842c..47765413 100644
--- a/docs/src/conf.py
+++ b/docs/src/conf.py
@@ -56,7 +56,7 @@ master_doc = 'index'
 
 # General information about the project.
 project = 'cdist'
-copyright = 'ungleich GmbH 2019'
+copyright = 'ungleich GmbH 2020'
 # author = 'Darko Poljak'
 
 # The version info for the project you're documenting, acts as replacement for

From de1a421b68edeb2bf3660f2ed98e109db93e8d88 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 2 Oct 2019 15:39:30 +0200
Subject: [PATCH 291/383] [explorer/init] Support for Darwin and more BusyBox
 combinations

---
 cdist/conf/explorer/init | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index a8a7857e..829d6ab8 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -23,14 +23,22 @@
 # for example at linux this value is "init" or "systemd" in most cases
 #
 
-uname_s="$(uname -s)"
-
-case "$uname_s" in
+case $(uname -s) in
     Linux)
-        (pgrep -P0 -l | awk '/^1[ \t]/ {print $2;}') || true
+        if command -v pgrep >/dev/null
+        then
+            # BusyBox's version of ps does not support some options.
+            # On Linux systems, we prefer pgrep to get the name of PID1.
+            (pgrep -P0 -l | awk '/^1[ \t]/ {print $2;}') || true
+        else
+            ps -o comm= -p 1 2>/dev/null || cat /proc/1/comm
+        fi
     ;;
     FreeBSD|OpenBSD)
-        ps -o comm= -p 1 || true
+        ps -o comm= -p 1 2>/dev/null || true
+    ;;
+    Darwin)
+        basename "$(ps -o comm= -p 1 2>/dev/null)"
     ;;
     *)
         # return a empty string as unknown value

From 4fe2dcba891ae52cccbe02553976be2bb7291fd1 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 30 Jan 2020 18:35:50 +0100
Subject: [PATCH 292/383] [explorer/init] Linux is a mess...

---
 cdist/conf/explorer/init | 44 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index 829d6ab8..ceae2e9f 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -25,14 +25,48 @@
 
 case $(uname -s) in
     Linux)
-        if command -v pgrep >/dev/null
+        if test -d /proc/1/
         then
-            # BusyBox's version of ps does not support some options.
-            # On Linux systems, we prefer pgrep to get the name of PID1.
-            (pgrep -P0 -l | awk '/^1[ \t]/ {print $2;}') || true
+            comm_name=$(cat /proc/1/comm)
         else
-            ps -o comm= -p 1 2>/dev/null || cat /proc/1/comm
+            # BusyBox's versions of ps and pgrep do not support some options
+            # depending on which compile-time options have been used.
+            # Both pgrep and ps are tried to get the command name
+            comm_name=$(
+                pgrep -P0 -l 2>/dev/null | awk '/^1[ \t]/ { print $2 }'
+                || ps -o comm= -p 1 2>/dev/null)
         fi
+
+        case $comm_name
+        in
+            systemd)
+                echo systemd
+            ;;
+            init)
+                # It could be anything...
+
+                if test -h /proc/1/exe
+                then
+                    init_exe=/proc/1/exe
+                else
+                    init_exe=$(command -v "$comm_name")
+                fi
+
+                test -x "$comm_exe" || exit 1
+
+                case $("$comm_exe" --version | head -n 1)
+                in
+                    *SysV*)
+                        echo init
+                    ;;
+                    *upstart*)
+                        echo upstart
+                    ;;
+                    *)
+                        echo ""
+                    ;;
+                esac
+        esac
     ;;
     FreeBSD|OpenBSD)
         ps -o comm= -p 1 2>/dev/null || true

From e5d86ffc9360767502469d00a0db1aca72d4f483 Mon Sep 17 00:00:00 2001
From: Matthias Stecher <matthiasstecher@gmx.de>
Date: Sat, 1 Feb 2020 17:08:25 +0100
Subject: [PATCH 293/383] Fix to remove cronjobs when the cronjob expression
 did not match.

---
 cdist/conf/type/__cron/gencode-remote | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__cron/gencode-remote b/cdist/conf/type/__cron/gencode-remote
index 59398058..8f3c92dc 100755
--- a/cdist/conf/type/__cron/gencode-remote
+++ b/cdist/conf/type/__cron/gencode-remote
@@ -42,8 +42,12 @@ fi
 mkdir "$__object/files"
 echo "$entry" > "$__object/files/entry"
 
-if diff -q "$__object/files/entry" "$__object/explorer/entry" >/dev/null; then
-    state_is=present
+if [ -s "$__object/explorer/entry" ]; then
+    if diff -q "$__object/files/entry" "$__object/explorer/entry" >/dev/null; then
+        state_is=present
+    else
+        state_is=modified
+    fi
 else
     state_is=absent
 fi

From f3237e5d76c995d138bdf287c00a03d48f4ac742 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Mon, 3 Feb 2020 17:44:47 +0100
Subject: [PATCH 294/383] [consul agent] add support for Debian 10

---
 cdist/conf/type/__consul_agent/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index ee682d72..e00f29ec 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -209,7 +209,7 @@ case "$os" in
             [567])
                 init_sysvinit debian
             ;;
-            [89])
+            [89]|10)
                 init_systemd
             ;;
             *)

From 0f420993e1befd2692aca6cae43efb751a4a78de Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Mon, 3 Feb 2020 17:45:34 +0100
Subject: [PATCH 295/383] ++ changelog update

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 467c0f22..9f5e73bd 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)
+
 6.5.0: 2020-01-23
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)
 	* Core: preos: Fix missing configuration file usage, support -g, --config-file option (Darko Poljak)

From e82dd35869e00b2fb00b6907b5fc3a960981bc6e Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 30 Sep 2019 18:50:20 +0200
Subject: [PATCH 296/383] [__file] stat explorer patch for systems without
 stat(1)

Some embedded systems (like OpenWrt) do not ship a stat(1) binary.
This workaround parses the output of ls(1) and /etc/passwd, /etc/group to
gather the information needed.
---
 cdist/conf/type/__file/explorer/stat | 64 ++++++++++++++++++++--------
 1 file changed, 46 insertions(+), 18 deletions(-)

diff --git a/cdist/conf/type/__file/explorer/stat b/cdist/conf/type/__file/explorer/stat
index 13c1c208..91c8cc84 100755
--- a/cdist/conf/type/__file/explorer/stat
+++ b/cdist/conf/type/__file/explorer/stat
@@ -2,6 +2,7 @@
 #
 # 2013 Steven Armstrong (steven-cdist armstrong.cc)
 # 2019 Nico Schottelius (nico-cdist at schottelius.org)
+# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -21,29 +22,54 @@
 
 destination="/$__object_id"
 
+fallback() {
+   # Fallback: Patch the output together, manually.
+
+   ls_line=$(ls -ldn "$destination")
+
+   uid=$(echo "$ls_line" | awk '{ print $3 }')
+   gid=$(echo "$ls_line" | awk '{ print $4 }')
+
+   owner=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/passwd)
+   group=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/group)
+
+   mode_text=$(echo "$ls_line" | awk '{ print $1 }')
+   mode=$(echo "$mode_text" | awk '{ k=0; for (i=0; i<=8; i++) k += ((substr($1, i+2, 1) ~ /[rwx]/) * 2^(8-i)); printf("%0o", k) }')
+
+   size=$(echo "$ls_line" | awk '{ print $5 }')
+   links=$(echo "$ls_line" | awk '{ print $2 }')
+
+   printf 'type: %s\nowner: %d %s\ngroup: %d %s\nmode: %s %s\nsize: %d\nlinks: %d\n' \
+      "$("$__type_explorer/type")" \
+      "$uid" "$owner" \
+      "$gid" "$group" \
+      "$mode" "$mode_text" \
+      "$size" \
+      "$links"
+}
+
+
 # nothing to work with, nothing we could do
 [ -e "$destination" ] || exit 0
 
-os=$("$__explorer/os")
-case "$os" in
-   "freebsd"|"netbsd"|"openbsd"|"macosx")
+
+if ! command -v stat >/dev/null
+then
+   fallback
+   exit
+fi
+
+
+case $("$__explorer/os")
+in
+   freebsd|netbsd|openbsd|macosx)
       stat -f "type: %HT
 owner: %Du %Su
 group: %Dg %Sg
 mode: %Lp %Sp
 size: %Dz
 links: %Dl
-" "$destination" | awk '/^type/ { print tolower($0); next; } { print; }'
-      ;;
-   alpine)
-       # busybox stat
-      stat -c "type: %F
-owner: %u %U
-group: %g %G
-mode: %a %A
-size: %s
-links: %h
-" "$destination"
+" "$destination" | awk '/^type/ { print tolower($0); next } { print }'
       ;;
     solaris)
         ls1="$( ls -ld "$destination" )"
@@ -77,12 +103,14 @@ links: %h
         echo "links: $( echo "$ls1" | awk '{print $2}' )"
     ;;
    *)
-      stat --printf="type: %F
+      # NOTE: Do not use --printf here as it is not supported by BusyBox stat.
+      # NOTE: BusyBox's stat might not support the "-c" option, in which case
+      #       we fall through to the shell fallback.
+      stat -c "type: %F
 owner: %u %U
 group: %g %G
 mode: %a %A
 size: %s
-links: %h
-" "$destination"
-      ;;
+links: %h" "$destination" 2>/dev/null || fallback
+         ;;
 esac

From 3b5433d63af27f06f3c44b121b21d7e0520af7bf Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 3 Feb 2020 18:12:27 +0100
Subject: [PATCH 297/383] [__directory] stat explorer patch for systems without
 stat(1)

Some embedded systems (like OpenWrt) do not ship a stat(1) binary.
This workaround parses the output of ls(1) and /etc/passwd, /etc/group to
gather the information needed.
---
 cdist/conf/type/__directory/explorer/stat | 48 +++++++++++++++++------
 1 file changed, 35 insertions(+), 13 deletions(-)

diff --git a/cdist/conf/type/__directory/explorer/stat b/cdist/conf/type/__directory/explorer/stat
index 03d466ba..105d894f 100755
--- a/cdist/conf/type/__directory/explorer/stat
+++ b/cdist/conf/type/__directory/explorer/stat
@@ -1,6 +1,7 @@
 #!/bin/sh
 #
 # 2013 Steven Armstrong (steven-cdist armstrong.cc)
+# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -20,24 +21,43 @@
 
 destination="/$__object_id"
 
+fallback() {
+   # Patch the output together, manually
+
+   ls_line=$(ls -ldn "$destination")
+
+   uid=$(echo "$ls_line" | awk '{ print $3 }')
+   gid=$(echo "$ls_line" | awk '{ print $4 }')
+
+   owner=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/passwd)
+   group=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/group)
+
+   mode_text=$(echo "$ls_line" | awk '{ print $1 }')
+   mode=$(echo "$mode_text" | awk '{ k=0; for (i=0; i<=8; i++) k += ((substr($1, i+2, 1) ~ /[rwx]/) * 2^(8-i)); printf("%0o", k) }')
+
+   printf 'type: %s\nowner: %d %s\ngroup: %d %s\nmode: %s %s\n' \
+      "$("$__type_explorer/type")" \
+      "$uid" "$owner" \
+      "$gid" "$group" \
+      "$mode" "$mode_text"
+}
+
 # nothing to work with, nothing we could do
 [ -e "$destination" ] || exit 0
 
-os=$("$__explorer/os")
-case "$os" in
+if ! command -v stat >/dev/null
+then
+   fallback
+   exit
+fi
+
+case $("$__explorer/os") in
    "freebsd"|"netbsd"|"openbsd"|"macosx")
       stat -f "type: %HT
 owner: %Du %Su
 group: %Dg %Sg
 mode: %Lp %Sp
-" "$destination" | awk '/^type/ { print tolower($0); next; } { print; }'
-      ;;
-   alpine)
-      stat -c "type: %F
-owner: %u %U
-group: %g %G
-mode: %a %A
-" "$destination"
+" "$destination" | awk '/^type/ { print tolower($0); next } { print }'
       ;;
     solaris)
         ls1="$( ls -ld "$destination" )"
@@ -69,10 +89,12 @@ mode: %a %A
         echo "mode: $octets $( echo "$ls1" | awk '{print $1}' )"
     ;;
    *)
-       stat --printf="type: %F
+      # NOTE: Do not use --printf here as it is not supported by BusyBox stat.
+      # NOTE: BusyBox's stat might not support the "-c" option, in which case
+      #       we fall through to the shell fallback.
+       stat -c "type: %F
 owner: %u %U
 group: %g %G
-mode: %a %A
-" "$destination"
+mode: %a %A" "$destination" 2>/dev/null || fallback
    ;;
 esac

From 984e0dc8c4975904057a7ab0a8c9d357ed0b4fdf Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 3 Feb 2020 19:29:04 +0100
Subject: [PATCH 298/383] [explorer/os_release] Add fallbacks to
 /usr/lib/os-release and /var/run/os-release

---
 cdist/conf/explorer/os_release | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/explorer/os_release b/cdist/conf/explorer/os_release
index cfc01004..6489446b 100644
--- a/cdist/conf/explorer/os_release
+++ b/cdist/conf/explorer/os_release
@@ -1,6 +1,7 @@
 #!/bin/sh
 #
 # 2018 Adam Dej (dejko.a at gmail.com)
+# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -21,6 +22,17 @@
 
 # See os-release(5) and http://0pointer.de/blog/projects/os-release
 
-set +e
+if test -f /etc/os-release
+then
+	# Linux and FreeBSD (usually a symlink)
+	cat /etc/os-release
+elif test -f /usr/lib/os-release
+then
+	# systemd
+	cat /usr/lib/os-release
+elif test -f /var/run/os-release
+then
+	# FreeBSD (created by os-release service)
+	cat /var/run/os-release
+fi
 
-cat /etc/os-release || cat /usr/lib/os-release || true

From 7a5d6d5a7d602863cd7d74bfb4e13a8bb59c5944 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Tue, 4 Feb 2020 07:45:04 +0100
Subject: [PATCH 299/383] ++changelog

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 9f5e73bd..bf0a8777 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,8 @@ Changelog
 
 next:
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)
+	* Explorer os_release: Add fallbacks (Dennis Camera)
+	* Types __file, __directory: Add fallback for systems without stat (Dennis Camera)
 
 6.5.0: 2020-01-23
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)

From 08d5814e2cc8ea6a204afca91bec7b831116112b Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sun, 9 Feb 2020 20:37:06 +0200
Subject: [PATCH 300/383] __package_apt: update index cache, on installation,
 when it is older than one day

---
 cdist/conf/type/__package_apt/gencode-remote | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/cdist/conf/type/__package_apt/gencode-remote b/cdist/conf/type/__package_apt/gencode-remote
index 699eb0c9..b3184a9c 100755
--- a/cdist/conf/type/__package_apt/gencode-remote
+++ b/cdist/conf/type/__package_apt/gencode-remote
@@ -74,6 +74,11 @@ fi
 
 case "$state_should" in
     present)
+        cat << EOF
+if [ -f /var/cache/apt/pkgcache.bin ] && [ "\$( stat --format %Y /var/cache/apt/pkgcache.bin )" -lt "\$( date +%s -d '-1 day' )" ]
+then echo apt-get update > /dev/null 2>&1 || true
+fi
+EOF
         if [ -n "$version" ]; then
             name="${name}=${version}"
         fi

From b3bad9468de78cf90e8ce92a59c8bb3d285883fe Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Sun, 9 Feb 2020 20:43:09 +0200
Subject: [PATCH 301/383] __package_apt: pkgcache.bin may not exist

---
 cdist/conf/type/__package_apt/gencode-remote | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__package_apt/gencode-remote b/cdist/conf/type/__package_apt/gencode-remote
index b3184a9c..cb79e886 100755
--- a/cdist/conf/type/__package_apt/gencode-remote
+++ b/cdist/conf/type/__package_apt/gencode-remote
@@ -75,7 +75,7 @@ fi
 case "$state_should" in
     present)
         cat << EOF
-if [ -f /var/cache/apt/pkgcache.bin ] && [ "\$( stat --format %Y /var/cache/apt/pkgcache.bin )" -lt "\$( date +%s -d '-1 day' )" ]
+if [ ! -f /var/cache/apt/pkgcache.bin ] || [ "\$( stat --format %Y /var/cache/apt/pkgcache.bin )" -lt "\$( date +%s -d '-1 day' )" ]
 then echo apt-get update > /dev/null 2>&1 || true
 fi
 EOF

From bcefeb240c81fd263763c794acc7f6ce0b8f6db0 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Mon, 10 Feb 2020 15:51:15 +0100
Subject: [PATCH 302/383] add note about IPv6, because people ask

---
 docs/src/index.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/src/index.rst b/docs/src/index.rst
index 5e54d8fc..31c044dc 100644
--- a/docs/src/index.rst
+++ b/docs/src/index.rst
@@ -2,8 +2,9 @@ cdist - usable configuration management
 =======================================
 
 cdist is a usable configuration management system.
-It adheres to the KISS principle and 
+It adheres to the KISS principle and
 is being used in small up to enterprise grade environments.
+It natively supports IPv6 since the first release.
 
 
 .. toctree::

From 710e99f240ef616c6c1978167749b877b3d1e8dc Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Thu, 13 Feb 2020 17:29:44 +0200
Subject: [PATCH 303/383] __mysql_privileges: fix quoting

---
 cdist/conf/type/__mysql_privileges/explorer/state | 2 +-
 cdist/conf/type/__mysql_privileges/gencode-remote | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__mysql_privileges/explorer/state b/cdist/conf/type/__mysql_privileges/explorer/state
index 0cfbaacd..4f13a70c 100755
--- a/cdist/conf/type/__mysql_privileges/explorer/state
+++ b/cdist/conf/type/__mysql_privileges/explorer/state
@@ -30,7 +30,7 @@ host="$( cat "$__object/parameter/host" )"
 
 check_privileges="$( 
     mysql -B -N -e "show grants for '$user'@'$host'" \
-        | grep -Ei "^grant $privileges on .$database.\..$table. to " || true )"
+        | grep -Ei "^grant $privileges on .$database.\..?$table.? to " || true )"
 
 if [ -n "$check_privileges" ]
 then
diff --git a/cdist/conf/type/__mysql_privileges/gencode-remote b/cdist/conf/type/__mysql_privileges/gencode-remote
index bcd362e6..20975c50 100755
--- a/cdist/conf/type/__mysql_privileges/gencode-remote
+++ b/cdist/conf/type/__mysql_privileges/gencode-remote
@@ -37,13 +37,18 @@ user="$( cat "$__object/parameter/user" )"
 
 host="$( cat "$__object/parameter/host" )"
 
+if [ "$table" != '*' ]
+then
+    table="$( printf '`%s`' "$table" )"
+fi
+
 case "$state_should" in
     present)
-        echo "mysql -e 'grant $privileges on \`$database\`.\`$table\` to \`$user\`@\`$host\`'"
+        echo "mysql -e 'grant $privileges on \`$database\`.$table to \`$user\`@\`$host\`'"
         echo "grant $privileges on $database.$table to $user@$host" >> "$__messages_out"
     ;;
     absent)
-        echo "mysql -e 'revoke $privileges on \`$database\`.\`$table\` from \`$user\`@\`$host\`'"
+        echo "mysql -e 'revoke $privileges on \`$database\`.$table from \`$user\`@\`$host\`'"
         echo "revoke $privileges on $database.$table from $user@$host" >> "$__messages_out"
     ;;
 esac

From b7483d73ebc5a95c96adc4a40173ce5015173eeb Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Thu, 13 Feb 2020 17:38:19 +0200
Subject: [PATCH 304/383] __mysql_privileges: fix shellcheck

---
 cdist/conf/type/__mysql_privileges/gencode-remote | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cdist/conf/type/__mysql_privileges/gencode-remote b/cdist/conf/type/__mysql_privileges/gencode-remote
index 20975c50..0656699f 100755
--- a/cdist/conf/type/__mysql_privileges/gencode-remote
+++ b/cdist/conf/type/__mysql_privileges/gencode-remote
@@ -39,6 +39,7 @@ host="$( cat "$__object/parameter/host" )"
 
 if [ "$table" != '*' ]
 then
+    # shellcheck disable=SC2016
     table="$( printf '`%s`' "$table" )"
 fi
 

From f771840178ed2586a4abc47f5e513da2309d5128 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Thu, 13 Feb 2020 17:38:34 +0200
Subject: [PATCH 305/383] __mysql_privileges: fix typo

---
 cdist/conf/type/__mysql_privileges/man.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__mysql_privileges/man.rst b/cdist/conf/type/__mysql_privileges/man.rst
index 8208d7d4..b72c9eba 100644
--- a/cdist/conf/type/__mysql_privileges/man.rst
+++ b/cdist/conf/type/__mysql_privileges/man.rst
@@ -17,7 +17,7 @@ REQUIRED PARAMETERS
 database
    Name of database.
 
-User
+user
    Name of user.
 
 

From e5f9d320049dea5acef6e505cc7a4966ecbd72c6 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 14 Feb 2020 16:07:06 +0100
Subject: [PATCH 306/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index bf0a8777..3f69899a 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)
 	* Explorer os_release: Add fallbacks (Dennis Camera)
 	* Types __file, __directory: Add fallback for systems without stat (Dennis Camera)
+	* Type __mysql_privileges: Fix quoting (Ander Punnar)
 
 6.5.0: 2020-01-23
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)

From 1be5a9d3163fc5b8aa107764ea5aab41f46e860a Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 14 Feb 2020 19:19:12 +0200
Subject: [PATCH 307/383] __package_apt: add note about updating index

---
 cdist/conf/type/__package_apt/man.rst | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cdist/conf/type/__package_apt/man.rst b/cdist/conf/type/__package_apt/man.rst
index a3a70d91..a1691eac 100644
--- a/cdist/conf/type/__package_apt/man.rst
+++ b/cdist/conf/type/__package_apt/man.rst
@@ -11,6 +11,9 @@ DESCRIPTION
 apt-get is usually used on Debian and variants (like Ubuntu) to
 manage packages.
 
+This type will also update package index, if it is older
+than one day, to avoid missing package error messages.
+
 
 REQUIRED PARAMETERS
 -------------------

From 869a38676f97b7863997b7d2c257447a63344368 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Fri, 14 Feb 2020 19:22:06 +0200
Subject: [PATCH 308/383] __package_apt: add comment about package index update

---
 cdist/conf/type/__package_apt/gencode-remote | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cdist/conf/type/__package_apt/gencode-remote b/cdist/conf/type/__package_apt/gencode-remote
index cb79e886..e02564a2 100755
--- a/cdist/conf/type/__package_apt/gencode-remote
+++ b/cdist/conf/type/__package_apt/gencode-remote
@@ -74,6 +74,9 @@ fi
 
 case "$state_should" in
     present)
+        # following is bit ugly, but important hack.
+        # due to how cdist config run works, there isn't
+        # currently better way to do it :(
         cat << EOF
 if [ ! -f /var/cache/apt/pkgcache.bin ] || [ "\$( stat --format %Y /var/cache/apt/pkgcache.bin )" -lt "\$( date +%s -d '-1 day' )" ]
 then echo apt-get update > /dev/null 2>&1 || true

From 48bff6656322eecd940a1e0a2c272fe2303268f6 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 14 Feb 2020 21:55:35 +0100
Subject: [PATCH 309/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 3f69899a..734db7ea 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -6,6 +6,7 @@ next:
 	* Explorer os_release: Add fallbacks (Dennis Camera)
 	* Types __file, __directory: Add fallback for systems without stat (Dennis Camera)
 	* Type __mysql_privileges: Fix quoting (Ander Punnar)
+	* Type __package_apt: Update package index if it is older than one day (Ander Punnar)
 
 6.5.0: 2020-01-23
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)

From a761d4842ca36688fd6355a63185da985528366a Mon Sep 17 00:00:00 2001
From: Matthias Stecher <matthiasstecher@gmx.de>
Date: Sat, 15 Feb 2020 08:21:24 +0100
Subject: [PATCH 310/383] Add check for the state parameter in manifest.

This only allow following cases:
  - present
  - absent
else, it will abort with an error message.
---
 cdist/conf/type/__cron/manifest | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/cdist/conf/type/__cron/manifest b/cdist/conf/type/__cron/manifest
index 53973e07..3017e2fd 100755
--- a/cdist/conf/type/__cron/manifest
+++ b/cdist/conf/type/__cron/manifest
@@ -22,3 +22,12 @@ if [ -f "$__object/parameter/raw" ] && [ -f "$__object/parameter/raw_command" ];
     echo "ERROR: both raw and raw_command specified" >&2
     exit 1
 fi
+
+case "$(cat "$__object/parameter/state" 2>/dev/null || echo "present")" in
+    present) ;;
+    absent) ;;
+
+    *)
+        echo "ERROR: unkown cron state" >&2
+        exit 2
+esac

From 5e6e17b3e55ea5b53a3ad9fe28f1d1c422121369 Mon Sep 17 00:00:00 2001
From: Matthias Stecher <matthiasstecher@gmx.de>
Date: Sat, 15 Feb 2020 09:46:23 +0100
Subject: [PATCH 311/383] Moved default parameter values from scripts to cdist
 parameter handling.

For more generalisation, the default parameter values are now handled by
cdist instead of trying to get a value and use a default if parameter is
not given.

It handles the default values in a more general way, instead of write
one default in (possibly) multiple places.
Problem occurred when checking the 'state' parameter, which required to
set a default value in two places.
---
 cdist/conf/type/__cron/gencode-remote                | 12 ++++++------
 cdist/conf/type/__cron/manifest                      |  2 +-
 .../conf/type/__cron/parameter/default/day_of_month  |  1 +
 cdist/conf/type/__cron/parameter/default/day_of_week |  1 +
 cdist/conf/type/__cron/parameter/default/hour        |  1 +
 cdist/conf/type/__cron/parameter/default/minute      |  1 +
 cdist/conf/type/__cron/parameter/default/month       |  1 +
 cdist/conf/type/__cron/parameter/default/state       |  1 +
 8 files changed, 13 insertions(+), 7 deletions(-)
 create mode 100644 cdist/conf/type/__cron/parameter/default/day_of_month
 create mode 100644 cdist/conf/type/__cron/parameter/default/day_of_week
 create mode 100644 cdist/conf/type/__cron/parameter/default/hour
 create mode 100644 cdist/conf/type/__cron/parameter/default/minute
 create mode 100644 cdist/conf/type/__cron/parameter/default/month
 create mode 100644 cdist/conf/type/__cron/parameter/default/state

diff --git a/cdist/conf/type/__cron/gencode-remote b/cdist/conf/type/__cron/gencode-remote
index 8f3c92dc..9debbc47 100755
--- a/cdist/conf/type/__cron/gencode-remote
+++ b/cdist/conf/type/__cron/gencode-remote
@@ -31,11 +31,11 @@ if [ -f "$__object/parameter/raw" ]; then
 elif [ -f "$__object/parameter/raw_command" ]; then
    entry="$command"
 else
-   minute="$(cat "$__object/parameter/minute" 2>/dev/null || echo "*")"
-   hour="$(cat "$__object/parameter/hour" 2>/dev/null || echo "*")"
-   day_of_month="$(cat "$__object/parameter/day_of_month" 2>/dev/null || echo "*")"
-   month="$(cat "$__object/parameter/month" 2>/dev/null || echo "*")"
-   day_of_week="$(cat "$__object/parameter/day_of_week" 2>/dev/null || echo "*")"
+   minute="$(cat "$__object/parameter/minute")"
+   hour="$(cat "$__object/parameter/hour")"
+   day_of_month="$(cat "$__object/parameter/day_of_month")"
+   month="$(cat "$__object/parameter/month")"
+   day_of_week="$(cat "$__object/parameter/day_of_week")"
    entry="$minute $hour $day_of_month $month $day_of_week $command # $name"
 fi
 
@@ -52,7 +52,7 @@ else
     state_is=absent
 fi
 
-state_should="$(cat "$__object/parameter/state" 2>/dev/null || echo "present")"
+state_should="$(cat "$__object/parameter/state")"
 
 [ "$state_is" = "$state_should" ] && exit 0
 
diff --git a/cdist/conf/type/__cron/manifest b/cdist/conf/type/__cron/manifest
index 3017e2fd..e7b51863 100755
--- a/cdist/conf/type/__cron/manifest
+++ b/cdist/conf/type/__cron/manifest
@@ -23,7 +23,7 @@ if [ -f "$__object/parameter/raw" ] && [ -f "$__object/parameter/raw_command" ];
     exit 1
 fi
 
-case "$(cat "$__object/parameter/state" 2>/dev/null || echo "present")" in
+case "$(cat "$__object/parameter/state")" in
     present) ;;
     absent) ;;
 
diff --git a/cdist/conf/type/__cron/parameter/default/day_of_month b/cdist/conf/type/__cron/parameter/default/day_of_month
new file mode 100644
index 00000000..72e8ffc0
--- /dev/null
+++ b/cdist/conf/type/__cron/parameter/default/day_of_month
@@ -0,0 +1 @@
+*
diff --git a/cdist/conf/type/__cron/parameter/default/day_of_week b/cdist/conf/type/__cron/parameter/default/day_of_week
new file mode 100644
index 00000000..72e8ffc0
--- /dev/null
+++ b/cdist/conf/type/__cron/parameter/default/day_of_week
@@ -0,0 +1 @@
+*
diff --git a/cdist/conf/type/__cron/parameter/default/hour b/cdist/conf/type/__cron/parameter/default/hour
new file mode 100644
index 00000000..72e8ffc0
--- /dev/null
+++ b/cdist/conf/type/__cron/parameter/default/hour
@@ -0,0 +1 @@
+*
diff --git a/cdist/conf/type/__cron/parameter/default/minute b/cdist/conf/type/__cron/parameter/default/minute
new file mode 100644
index 00000000..72e8ffc0
--- /dev/null
+++ b/cdist/conf/type/__cron/parameter/default/minute
@@ -0,0 +1 @@
+*
diff --git a/cdist/conf/type/__cron/parameter/default/month b/cdist/conf/type/__cron/parameter/default/month
new file mode 100644
index 00000000..72e8ffc0
--- /dev/null
+++ b/cdist/conf/type/__cron/parameter/default/month
@@ -0,0 +1 @@
+*
diff --git a/cdist/conf/type/__cron/parameter/default/state b/cdist/conf/type/__cron/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__cron/parameter/default/state
@@ -0,0 +1 @@
+present

From ef089d1c6114e840c4b8022d43322bdb18b96e8f Mon Sep 17 00:00:00 2001
From: Matthias Stecher <matthiasstecher@gmx.de>
Date: Mon, 6 Jan 2020 10:42:12 +0100
Subject: [PATCH 312/383] [__systemd_service] new type to manage the state of
 systemd services

---
 .../type/__systemd_service/explorer/state     |  43 +++++++
 .../type/__systemd_service/gencode-remote     |  98 ++++++++++++++++
 cdist/conf/type/__systemd_service/man.rst     | 110 ++++++++++++++++++
 .../type/__systemd_service/parameter/boolean  |   1 +
 .../__systemd_service/parameter/default/state |   1 +
 .../type/__systemd_service/parameter/optional |   3 +
 6 files changed, 256 insertions(+)
 create mode 100755 cdist/conf/type/__systemd_service/explorer/state
 create mode 100755 cdist/conf/type/__systemd_service/gencode-remote
 create mode 100644 cdist/conf/type/__systemd_service/man.rst
 create mode 100644 cdist/conf/type/__systemd_service/parameter/boolean
 create mode 100644 cdist/conf/type/__systemd_service/parameter/default/state
 create mode 100644 cdist/conf/type/__systemd_service/parameter/optional

diff --git a/cdist/conf/type/__systemd_service/explorer/state b/cdist/conf/type/__systemd_service/explorer/state
new file mode 100755
index 00000000..f5f751d4
--- /dev/null
+++ b/cdist/conf/type/__systemd_service/explorer/state
@@ -0,0 +1,43 @@
+#!/bin/sh -e
+# explorer/state
+#
+# 2020 Matthias Stecher <matthiasstecher at gmx.de>
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+# Check if the service is running or stopped.
+#
+# The explorer must check before if the service exist, because 'systemctl is-active'
+# will return "inactive" even if there is no service there:
+#   systemctl cat foo        # does not exist
+#   systemctl is-active foo  # is "inactive"
+
+
+# get name of the service
+if [ -f "$__object/parameter/name" ]; then
+    name="$(cat "$__object/parameter/name")"
+else
+    name="$__object_id"
+fi
+
+
+# check if the service exist, else exit without output (also if systemd doesn't exist)
+# do not exit here with an error code, will be done in the gencode-remote script
+systemctl cat "$name" > /dev/null 2>&1 || exit 0
+
+# print if the service is running or not
+systemctl is-active -q "$name" && printf "running" || printf "stopped"
diff --git a/cdist/conf/type/__systemd_service/gencode-remote b/cdist/conf/type/__systemd_service/gencode-remote
new file mode 100755
index 00000000..c867ff22
--- /dev/null
+++ b/cdist/conf/type/__systemd_service/gencode-remote
@@ -0,0 +1,98 @@
+#!/bin/sh -e
+# gencode-remote
+#
+# 2020 Matthias Stecher <matthiasstecher at gmx.de>
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+# Checks the given state of the service and set it to the given
+# state. Optionally, it executes the action if service running.
+
+
+# get name of the service
+name="$__object/parameter/name"
+if [ -f "$name" ]; then
+    name="$(cat "$name")"
+else
+    name="$__object_id"
+fi
+
+
+# read current status and parameters
+state="$(cat "$__object/explorer/state")"
+should="$(cat "$__object/parameter/state")"
+
+# if systemd/service does not exist
+if [ -z "$state" ]; then
+    printf "systemd or service '%s' does not exist!\n" "$name" >&2
+    exit 1
+fi
+
+
+# save the action required
+required_action=""
+
+# check the state of the service that should be
+if [ "$state" != "$should" ]; then
+    # select what to do to get the $should state
+    case "$should" in
+        running)
+            if [ "$state" = "stopped" ]; then required_action="start"; fi
+            ;;
+
+        stopped)
+            if [ "$state" = "running" ]; then required_action="stop"; fi
+            ;;
+    esac
+fi
+
+# check if the action can be achieved if given
+if [ -f "$__object/parameter/action" ] \
+    && [ -z "$required_action" ] && [ "$state" = "running" ]; then
+
+    # there must be an action
+    action="$(cat "$__object/parameter/action")"
+
+    # select the action to the required element
+    case "$action" in
+        restart)
+            required_action="restart"
+            ;;
+
+        reload)
+            required_action="reload"
+            ;;
+
+        *)
+            printf "action '%s' does not exist!" "$action" >&2
+            exit 2
+    esac
+
+    # Make a special check: only do this action if a dependency did something
+    # it is required that the dependencies write there action to $__messages_in
+    if [ -f "$__object/parameter/if-required" ]; then
+        # exit here if there are no changes from the dependencies affected (nothing to do)
+        if ! grep -q -f "$__object/require" "$__messages_in"; then exit 0; fi
+    fi
+fi
+
+# print the execution command if a action given
+if [ -n "$required_action" ]; then
+    # also print it as message
+    echo "$required_action" >> "$__messages_out"
+    echo "systemctl $required_action '$name'"
+fi
diff --git a/cdist/conf/type/__systemd_service/man.rst b/cdist/conf/type/__systemd_service/man.rst
new file mode 100644
index 00000000..678cee29
--- /dev/null
+++ b/cdist/conf/type/__systemd_service/man.rst
@@ -0,0 +1,110 @@
+cdist-type__systemd-service(7)
+==============================
+
+NAME
+----
+cdist-type__systemd-service - Controls a systemd service state
+
+DESCRIPTION
+-----------
+This type controls systemd services to define a state of the service,
+or an action like reloading or restarting. It is useful to reload a
+service after configuration applied or shutdown one service.
+
+The activation or deactivation is out of scope. Look for the
+:strong:`cdist-type__systemd_util`\ (7) type instead.
+
+REQUIRED PARAMETERS
+-------------------
+
+None.
+
+OPTIONAL PARAMETERS
+-------------------
+
+name
+    String which will used as name instead of the object id.
+
+state
+    The state which the service should be in:
+
+    running
+        Service should run (default)
+
+    stoppend
+        Service should stopped
+
+action
+    Executes an action on on the service. It will only execute it if the
+    service keeps the state **running**. There are following actions, where:
+
+    reload
+        Reloads the service
+
+    restart
+        Restarts the service
+
+BOOLEAN PARAMETERS
+-----------------
+
+if-required
+    Only execute the action if minimum one required type outputs a message to
+    **$__messages_out**. Through this, the action should only executed if a
+    dependency did something. The action will not executed if no dependencies
+    given.
+
+MESSAGES
+--------
+
+start
+    Started the service
+
+stop
+    Stopped the service
+
+restart
+    Restarted the service
+
+reload
+    Reloaded the service
+
+ABORTS
+------
+Aborts in following cases:
+
+systemd or the service does not exist
+
+EXAMPLES
+--------
+.. code-block:: sh
+
+    # service must run
+    __systemd_service nginx
+
+    # service must stopped
+    __systemd_service sshd \
+        --state stopped
+
+    # restart the service
+    __systemd_service apache2 \
+        --action restart
+
+    # makes sure the service exist with an alternative name
+    __systemd_service foo \
+        --name sshd
+
+    # reload the service for a modified configuration file
+    # only reloads the service if the file really changed
+    require="__config_file/etc/foo.conf" __systemd_service foo \
+        --action reload --if-required
+
+AUTHORS
+-------
+Matthias Stecher <matthiasstecher at gmx.de>
+
+COPYRIGHT
+---------
+Copyright \(C) 2020 Matthias Stecher. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__systemd_service/parameter/boolean b/cdist/conf/type/__systemd_service/parameter/boolean
new file mode 100644
index 00000000..a4bccb66
--- /dev/null
+++ b/cdist/conf/type/__systemd_service/parameter/boolean
@@ -0,0 +1 @@
+if-required
diff --git a/cdist/conf/type/__systemd_service/parameter/default/state b/cdist/conf/type/__systemd_service/parameter/default/state
new file mode 100644
index 00000000..a2ae71b3
--- /dev/null
+++ b/cdist/conf/type/__systemd_service/parameter/default/state
@@ -0,0 +1 @@
+running
diff --git a/cdist/conf/type/__systemd_service/parameter/optional b/cdist/conf/type/__systemd_service/parameter/optional
new file mode 100644
index 00000000..fc78265f
--- /dev/null
+++ b/cdist/conf/type/__systemd_service/parameter/optional
@@ -0,0 +1,3 @@
+name
+state
+action

From 58841fc4bfd8dbeb82717fe3638b3bb4d2ed017b Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 15 Feb 2020 12:20:41 +0100
Subject: [PATCH 313/383] ++changelog

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 734db7ea..f687e5ed 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,6 +7,8 @@ next:
 	* Types __file, __directory: Add fallback for systems without stat (Dennis Camera)
 	* Type __mysql_privileges: Fix quoting (Ander Punnar)
 	* Type __package_apt: Update package index if it is older than one day (Ander Punnar)
+	* Type __cron: Fix job removal if 'is' and 'should' don't match (Matthias Stecher)
+	* New type: __systemd_service (Matthias Stecher)
 
 6.5.0: 2020-01-23
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)

From a1536933ab066671e09aaf47a3c6101a68a6b60f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Sat, 15 Feb 2020 08:51:29 +0100
Subject: [PATCH 314/383] Fix password command synthax in __postgres_role

---
 cdist/conf/type/__postgres_role/gencode-remote | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote
index 977832c9..282294c9 100755
--- a/cdist/conf/type/__postgres_role/gencode-remote
+++ b/cdist/conf/type/__postgres_role/gencode-remote
@@ -54,7 +54,7 @@ case "$state_should" in
 
         [ -n "$password" ] && password="PASSWORD '$password'"
         cat << EOF
-su - '$postgres_user' -c "psql postgres -wc 'CREATE ROLE \"$name\" WITH $password $booleans;'"
+su - '$postgres_user' -c "psql postgres -wc \"CREATE ROLE \\\\\"$name\\\\\" WITH $password $booleans;\""
 EOF
     ;;
     absent)

From cda77e5e8a44eabde7e39396c39fd34daba1c702 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 15 Feb 2020 14:35:29 +0100
Subject: [PATCH 315/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index f687e5ed..d5ed1b06 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -9,6 +9,7 @@ next:
 	* Type __package_apt: Update package index if it is older than one day (Ander Punnar)
 	* Type __cron: Fix job removal if 'is' and 'should' don't match (Matthias Stecher)
 	* New type: __systemd_service (Matthias Stecher)
+	* Type __postgres_role: Fix password command synthax (Timothée Floure)
 
 6.5.0: 2020-01-23
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)

From 9f3747cf3f664ba5cc2f74ec356d833e7eda2621 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 15 Feb 2020 14:36:26 +0100
Subject: [PATCH 316/383] Release 6.5.1

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index d5ed1b06..9f1e6245 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.5.1: 2020-02-15
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)
 	* Explorer os_release: Add fallbacks (Dennis Camera)
 	* Types __file, __directory: Add fallback for systems without stat (Dennis Camera)

From 0640b02f90d92e11f6a4f8b7c0110d9b5a9bfb89 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 15 Feb 2020 14:59:12 +0100
Subject: [PATCH 317/383] Fix too short title underline

---
 cdist/conf/type/__systemd_service/man.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__systemd_service/man.rst b/cdist/conf/type/__systemd_service/man.rst
index 678cee29..7eca398b 100644
--- a/cdist/conf/type/__systemd_service/man.rst
+++ b/cdist/conf/type/__systemd_service/man.rst
@@ -45,7 +45,7 @@ action
         Restarts the service
 
 BOOLEAN PARAMETERS
------------------
+------------------
 
 if-required
     Only execute the action if minimum one required type outputs a message to

From c09165d1228e887e2fb4dad456c6b1409211a499 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 15 Feb 2020 21:05:24 +0100
Subject: [PATCH 318/383] Fix spelling

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 9f1e6245..bd767b9d 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -9,7 +9,7 @@ Changelog
 	* Type __package_apt: Update package index if it is older than one day (Ander Punnar)
 	* Type __cron: Fix job removal if 'is' and 'should' don't match (Matthias Stecher)
 	* New type: __systemd_service (Matthias Stecher)
-	* Type __postgres_role: Fix password command synthax (Timothée Floure)
+	* Type __postgres_role: Fix password command syntax (Timothée Floure)
 
 6.5.0: 2020-01-23
 	* Type __acl: Add --entry parameter to replace --acl, deprecate --acl (Ander Punnar)

From 70200cd28fe9b35670f574e77d49e747f23072f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Tue, 21 Jan 2020 10:06:09 +0100
Subject: [PATCH 319/383] Refactor __consul_agent type to support distribution
 packages

---
 cdist/conf/type/__consul_agent/man.rst        |   3 +
 cdist/conf/type/__consul_agent/manifest       | 373 +++++++++++-------
 .../type/__consul_agent/parameter/boolean     |   1 +
 3 files changed, 225 insertions(+), 152 deletions(-)

diff --git a/cdist/conf/type/__consul_agent/man.rst b/cdist/conf/type/__consul_agent/man.rst
index 966abc60..62ee70bb 100644
--- a/cdist/conf/type/__consul_agent/man.rst
+++ b/cdist/conf/type/__consul_agent/man.rst
@@ -116,6 +116,9 @@ verify-incoming
 verify-outgoing
    enforce the use of TLS and verify the peers authenticity on outgoing connections
 
+use-distribution-package
+   uses distribution package instead of upstream binary
+
 
 EXAMPLES
 --------
diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index e00f29ec..599f15b4 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -2,6 +2,7 @@
 #
 # 2015 Steven Armstrong (steven-cdist at armstrong.cc)
 # 2015-2019 Nico Schottelius (nico-cdist at schottelius.org)
+# 2019 Timothée Floure (timothee.floure at ungleich.ch)
 #
 # This file is part of cdist.
 #
@@ -19,133 +20,64 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-
 os=$(cat "$__global/explorer/os")
 
-case "$os" in
-   alpine|scientific|centos|debian|devuan|redhat|ubuntu)
-      # whitelist safeguard
-      :
-   ;;
-   *)
-      echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
-      echo "Please contribute an implementation for it if you can." >&2
-      exit 1
-   ;;
-esac
+###
+# Type parameters.
 
 state="$(cat "$__object/parameter/state")"
 user="$(cat "$__object/parameter/user")"
 group="$(cat "$__object/parameter/group")"
+release=$(cat "$__global/explorer/lsb_release")
+if [ -f "$__object/parameter/use-distribution-package" ]; then
+  use_distribution_package=1
+fi
+
+###
+# Those are default that might be overriden by os-specific logic.
+
 data_dir="/var/lib/consul"
 conf_dir="/etc/consul/conf.d"
 conf_file="config.json"
+tls_dir="$conf_dir/tls"
 
-# FIXME: there has got to be a better way to handle the dependencies in this case
-case "$state" in
-   present)
-      __group "$group" --system --state "$state"
-      require="__group/$group" \
-         __user "$user" --system --gid "$group" \
-            --home "$data_dir" --state "$state"
-      export require="__user/consul"
-   ;;
-   absent)
-      echo "Sorry, state=absent currently not supported :-(" >&2
-      exit 1
-      require="$__object_name" \
-         __user "$user" --system --gid "$group" --state "$state"
-      require="__user/$user" \
-         __group "$group" --system --state "$state"
-   ;;
-esac
+###
+# Sane deployment, based on distribution package when available.
 
-__directory /etc/consul \
-   --owner root --group "$group" --mode 750 --state "$state"
-require="__directory/etc/consul" \
-   __directory "$conf_dir" \
-      --owner root --group "$group" --mode 750 --state "$state"
+distribution_setup () {
+  case "$os" in
+     debian)
+       # consul is only available starting Debian 10 (buster).
+       # See https://packages.debian.org/buster/consul
+       if [ $release -lt 10 ]; then
+         echo "Consul is not available for your debian release." >&2
+         echo "Please use the 'manual' (i.e. non-package) installation or \
+           upgrade the target system." >&2
+         exit 1
+       fi
 
-if [ -f "$__object/parameter/ca-file-source" ] || [ -f "$__object/parameter/cert-file-source" ] || [ -f "$__object/parameter/key-file-source" ]; then
-   # create directory for ssl certs
-   require="__directory/etc/consul" \
-      __directory /etc/consul/ssl \
-         --owner root --group "$group" --mode 750 --state "$state"
-fi
+       # Override previously defined environment to match debian packaging.
+       conf_dir='/etc/consul.d'
+       user='consul'
+       grou='consul'
+     ;;
+     *)
+        echo "Your operating system ($os) is currently not supported with the \
+          --use-distribution-package flag (${__type##*/})." >&2
+        echo "Please use non-package installation or contribute an \
+          implementation for if you can." >&2
+        exit 1
+     ;;
+  esac
 
-__directory "$data_dir" \
-   --owner "$user" --group "$group" --mode 770 --state "$state"
+  # Install consul package.
+  __package consul --state $state
 
+  export config_deployment_requires="__package/consul"
+}
 
-# Generate json config file
-(
-echo "{"
-
-# parameters we define ourself
-printf '   "data_dir": "%s"\n' "$data_dir"
-
-cd "$__object/parameter/"
-for param in *; do
-   case "$param" in
-      state|user|group|json-config) continue ;;
-      ca-file-source|cert-file-source|key-file-source)
-         source="$(cat "$__object/parameter/$param")"
-         destination="/etc/consul/ssl/${source##*/}"
-         require="__directory/etc/consul/ssl" \
-            __file "$destination" \
-               --owner root --group consul --mode 640 \
-               --source "$source" \
-               --state "$state"
-         key="$(echo "${param%-*}" | tr '-' '_')"
-         printf '   ,"%s": "%s"\n' "$key" "$destination"
-      ;;
-      disable-remote-exec|disable-update-check|leave-on-terminate|rejoin-after-leave|server|enable-syslog|verify-incoming|verify-outgoing)
-         # handle boolean parameters
-         key="$(echo "$param" | tr '-' '_')"
-         printf '   ,"%s": true\n' "$key"
-      ;;
-      retry-join)
-         # join multiple parameters into json array
-         retry_join="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join")"
-         # remove trailing ,
-         printf '   ,"retry_join": [%s]\n' "${retry_join%*,}"
-      ;;
-      retry-join-wan)
-         # join multiple parameters into json array over wan
-         retry_join_wan="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join-wan")"
-         # remove trailing ,
-         printf '   ,"retry_join_wan": [%s]\n' "${retry_join_wan%*,}"
-      ;;
-      bootstrap-expect)
-         # integer key=value parameters
-         key="$(echo "$param" | tr '-' '_')"
-         printf '   ,"%s": %s\n' "$key" "$(cat "$__object/parameter/$param")"
-      ;;
-      *)
-         # string key=value parameters
-         key="$(echo "$param" | tr '-' '_')"
-         printf '   ,"%s": "%s"\n' "$key" "$(cat "$__object/parameter/$param")"
-      ;;
-   esac
-done
-if [ -f "$__object/parameter/json-config" ]; then
-   json_config="$(cat "$__object/parameter/json-config")"
-   if [ "$json_config" = "-" ]; then
-      json_config="$__object/stdin"
-   fi
-   # remove leading and trailing whitespace and commas from first and last line
-   # indent each line with 3 spaces for consistency
-   json=$(sed -e 's/^[ \t]*/   /' -e '1s/^[ \t,]*//' -e '$s/[ \t,]*$//' "$json_config")
-   printf '   ,%s\n' "$json"
-fi
-echo "}"
-) | \
-require="__directory${conf_dir}" \
-   __config_file "${conf_dir}/${conf_file}" \
-      --owner root --group "$group" --mode 640 \
-      --state "$state" \
-      --onchange 'service consul status >/dev/null && service consul reload || true' \
-      --source -
+###
+# LEGACY manual deployment, kept for compatibility reasons.
 
 init_sysvinit()
 {
@@ -179,47 +111,184 @@ init_upstart()
     require="__file/etc/init/consul.conf" __start_on_boot consul
 }
 
-# Install init script to start on boot
-case "$os" in
-    devuan)
-        init_sysvinit debian
-        ;;
-    centos|redhat)
-        os_version="$(sed 's/[^0-9.]//g' "$__global/explorer/os_version")"
-        major_version="${os_version%%.*}"
-        case "$major_version" in
-            [456])
-                init_sysvinit redhat
-                ;;
-            7)
-                init_systemd
-                ;;
-            *)
-                echo "Unsupported CentOS/Redhat version: $os_version" >&2
-                exit 1
-                ;;
-        esac
-        ;;
+manual_setup () {
+  case "$os" in
+     alpine|scientific|centos|debian|devuan|redhat|ubuntu)
+        # whitelist safeguard
+        :
+     ;;
+     *)
+        echo "Your operating system ($os) is currently not supported by this \
+          type (${__type##*/})." >&2
+        echo "Please contribute an implementation for it if you can." >&2
+        exit 1
+     ;;
+  esac
 
-    debian)
-        os_version=$(cat "$__global/explorer/os_version")
-        major_version="${os_version%%.*}"
+  # FIXME: there has got to be a better way to handle the dependencies in this case
+  case "$state" in
+     present)
+        __group "$group" --system --state "$state"
+        require="__group/$group" __user "$user" \
+          --system --gid "$group" --home "$data_dir" --state "$state"
+     ;;
+     *)
+        echo "The $state state is not (yet?) supported by this type." >&2
+        exit 1
+     ;;
+  esac
 
-        case "$major_version" in
-            [567])
-                init_sysvinit debian
-            ;;
-            [89]|10)
-                init_systemd
-            ;;
-            *)
-                echo "Unsupported Debian version $os_version" >&2
-                exit 1
-            ;;
-        esac
-        ;;
+  # Create data directory.
+  require="__user/consul"__directory "$data_dir" \
+    --owner "$user" --group "$group" --mode 770 --state "$state"
 
-    ubuntu)
-        init_upstart
+  # Create config directory.
+  require="__user/consul" __directory "$conf_dir" \
+    --parents --owner root --group "$group" --mode 750 --state "$state"
+
+  # Install init script to start on boot
+  case "$os" in
+      devuan)
+          init_sysvinit debian
+          ;;
+      centos|redhat)
+          os_version="$(sed 's/[^0-9.]//g' "$__global/explorer/os_version")"
+          major_version="${os_version%%.*}"
+          case "$major_version" in
+              [456])
+                  init_sysvinit redhat
+                  ;;
+              7)
+                  init_systemd
+                  ;;
+              *)
+                  echo "Unsupported CentOS/Redhat version: $os_version" >&2
+                  exit 1
+                  ;;
+          esac
+          ;;
+
+      debian)
+          os_version=$(cat "$__global/explorer/os_version")
+          major_version="${os_version%%.*}"
+
+          case "$major_version" in
+              [567])
+                  init_sysvinit debian
+              ;;
+              [89]|10)
+                  init_systemd
+              ;;
+              *)
+                  echo "Unsupported Debian version $os_version" >&2
+                  exit 1
+              ;;
+          esac
+          ;;
+
+      ubuntu)
+          init_upstart
+          ;;
+  esac
+
+  config_deployment_requires="__user/consul __directory/$conf_dir"
+}
+
+###
+# Trigger requested installation method.
+if [ $use_distribution_package ]; then
+  distribution_setup
+else
+  manual_setup
+fi
+
+###
+# Generate and deploy configuration.
+json_configuration=$(
+  echo "{"
+
+  # parameters we define ourself
+  printf '   "data_dir": "%s"\n' "$data_dir"
+
+  cd "$__object/parameter/"
+  for param in *; do
+     case "$param" in
+        state|user|group|json-config|use-distribution-package) continue ;;
+        ca-file-source|cert-file-source|key-file-source)
+           source="$(cat "$__object/parameter/$param")"
+           destination="/etc/consul/ssl/${source##*/}"
+           require="__directory/etc/consul/ssl" \
+              __file "$destination" \
+                 --owner root --group consul --mode 640 \
+                 --source "$source" \
+                 --state "$state"
+           key="$(echo "${param%-*}" | tr '-' '_')"
+           printf '   ,"%s": "%s"\n' "$key" "$destination"
         ;;
-esac
+        disable-remote-exec|disable-update-check|leave-on-terminate\
+          |rejoin-after-leave|server|enable-syslog|verify-incoming|verify-outgoing)
+           # handle boolean parameters
+           key="$(echo "$param" | tr '-' '_')"
+           printf '   ,"%s": true\n' "$key"
+        ;;
+        retry-join)
+           # join multiple parameters into json array
+           retry_join="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join")"
+           # remove trailing ,
+           printf '   ,"retry_join": [%s]\n' "${retry_join%*,}"
+        ;;
+        retry-join-wan)
+           # join multiple parameters into json array over wan
+           retry_join_wan="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join-wan")"
+           # remove trailing ,
+           printf '   ,"retry_join_wan": [%s]\n' "${retry_join_wan%*,}"
+        ;;
+        bootstrap-expect)
+           # integer key=value parameters
+           key="$(echo "$param" | tr '-' '_')"
+           printf '   ,"%s": %s\n' "$key" "$(cat "$__object/parameter/$param")"
+        ;;
+        *)
+           # string key=value parameters
+           key="$(echo "$param" | tr '-' '_')"
+           printf '   ,"%s": "%s"\n' "$key" "$(cat "$__object/parameter/$param")"
+        ;;
+     esac
+  done
+  if [ -f "$__object/parameter/json-config" ]; then
+     json_config="$(cat "$__object/parameter/json-config")"
+     if [ "$json_config" = "-" ]; then
+        json_config="$__object/stdin"
+     fi
+     # remove leading and trailing whitespace and commas from first and last line
+     # indent each line with 3 spaces for consistency
+     json=$(sed -e 's/^[ \t]*/   /' -e '1s/^[ \t,]*//' -e '$s/[ \t,]*$//' "$json_config")
+     printf '   ,%s\n' "$json"
+  fi
+  echo "}"
+)
+echo "$json_configuration" | require="$config_deployment_requires" \
+  __file "$conf_dir/$conf_file" \
+      --owner root --group "$group" --mode 640 \
+      --state "$state" \
+      --source -
+
+# Set configuration deployment as requirement for service restart.
+restart_requires="__file/$conf_dir/$conf_file"
+
+###
+# Install TLS certificates.
+if [ -f "$__object/parameter/ca-file-source" ] || \
+   [ -f "$__object/parameter/cert-file-source" ] || \
+   [ -f "$__object/parameter/key-file-source" ]; then
+
+   requires="__file/$conf_dir/$conf_file" __directory $conf_dir/tls \
+     --owner root --group "$group" --mode 750 --state "$state"
+
+   # Append to service restart requirements.
+   restart_requires="$restart_requires __directory/$conf_dir/tls"
+fi
+
+###
+# Restart consul agent after everything else.
+require="$restart_requires" __service consul --action restart
diff --git a/cdist/conf/type/__consul_agent/parameter/boolean b/cdist/conf/type/__consul_agent/parameter/boolean
index 91f7f17e..c86853c3 100644
--- a/cdist/conf/type/__consul_agent/parameter/boolean
+++ b/cdist/conf/type/__consul_agent/parameter/boolean
@@ -6,3 +6,4 @@ server
 enable-syslog
 verify-incoming
 verify-outgoing
+use-distribution-package

From f595664924b3ae2ad190f9469fdf0be3b38d8a47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Tue, 21 Jan 2020 10:07:21 +0100
Subject: [PATCH 320/383] Patch __consul_* to discover remote consul
 configuration dir

---
 cdist/conf/type/__consul_check/explorer/conf-dir  |  1 +
 cdist/conf/type/__consul_check/manifest           |  2 +-
 .../conf/type/__consul_service/explorer/conf-dir  | 15 +++++++++++++++
 cdist/conf/type/__consul_service/manifest         |  5 ++---
 .../type/__consul_watch_checks/explorer/conf-dir  |  1 +
 cdist/conf/type/__consul_watch_checks/manifest    |  2 +-
 .../type/__consul_watch_event/explorer/conf-dir   |  1 +
 cdist/conf/type/__consul_watch_event/manifest     |  2 +-
 .../type/__consul_watch_key/explorer/conf-dir     |  1 +
 cdist/conf/type/__consul_watch_key/manifest       |  2 +-
 .../__consul_watch_keyprefix/explorer/conf-dir    |  1 +
 cdist/conf/type/__consul_watch_keyprefix/manifest |  2 +-
 .../type/__consul_watch_nodes/explorer/conf-dir   |  1 +
 cdist/conf/type/__consul_watch_nodes/manifest     |  2 +-
 .../type/__consul_watch_service/explorer/conf-dir |  1 +
 cdist/conf/type/__consul_watch_service/manifest   |  2 +-
 .../__consul_watch_services/explorer/conf-dir     |  1 +
 cdist/conf/type/__consul_watch_services/manifest  |  2 +-
 18 files changed, 33 insertions(+), 11 deletions(-)
 create mode 120000 cdist/conf/type/__consul_check/explorer/conf-dir
 create mode 100644 cdist/conf/type/__consul_service/explorer/conf-dir
 create mode 120000 cdist/conf/type/__consul_watch_checks/explorer/conf-dir
 create mode 120000 cdist/conf/type/__consul_watch_event/explorer/conf-dir
 create mode 120000 cdist/conf/type/__consul_watch_key/explorer/conf-dir
 create mode 120000 cdist/conf/type/__consul_watch_keyprefix/explorer/conf-dir
 create mode 120000 cdist/conf/type/__consul_watch_nodes/explorer/conf-dir
 create mode 120000 cdist/conf/type/__consul_watch_service/explorer/conf-dir
 create mode 120000 cdist/conf/type/__consul_watch_services/explorer/conf-dir

diff --git a/cdist/conf/type/__consul_check/explorer/conf-dir b/cdist/conf/type/__consul_check/explorer/conf-dir
new file mode 120000
index 00000000..daa712c3
--- /dev/null
+++ b/cdist/conf/type/__consul_check/explorer/conf-dir
@@ -0,0 +1 @@
+../../__consul_service/explorer/conf-dir
\ No newline at end of file
diff --git a/cdist/conf/type/__consul_check/manifest b/cdist/conf/type/__consul_check/manifest
index c9f7add9..522aa1a9 100755
--- a/cdist/conf/type/__consul_check/manifest
+++ b/cdist/conf/type/__consul_check/manifest
@@ -19,7 +19,7 @@
 #
 
 name="$(cat "$__object/parameter/name" 2>/dev/null || echo "$__object_id")"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="check_${name}.json"
 state="$(cat "$__object/parameter/state")"
 
diff --git a/cdist/conf/type/__consul_service/explorer/conf-dir b/cdist/conf/type/__consul_service/explorer/conf-dir
new file mode 100644
index 00000000..6e94f781
--- /dev/null
+++ b/cdist/conf/type/__consul_service/explorer/conf-dir
@@ -0,0 +1,15 @@
+# Determine the configuration directory used by consul.
+
+check_dir () {
+  if [ -d "$1" ]; then
+    echo -n "$1"
+    exit
+  fi
+}
+
+check_dir '/etc/consul/conf.d'
+check_dir '/etc/consul.d'
+check_dir '/etc/consul'
+
+echo 'Could not determine consul configuration dir. Exiting.' >&2
+exit 1
diff --git a/cdist/conf/type/__consul_service/manifest b/cdist/conf/type/__consul_service/manifest
index 60397db7..d16f18e0 100755
--- a/cdist/conf/type/__consul_service/manifest
+++ b/cdist/conf/type/__consul_service/manifest
@@ -19,7 +19,7 @@
 #
 
 name="$(cat "$__object/parameter/name" 2>/dev/null || echo "$__object_id")"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="service_${name}.json"
 state="$(cat "$__object/parameter/state")"
 
@@ -45,7 +45,7 @@ printf '      "name": "%s"\n' "$name"
 cd "$__object/parameter/"
 for param in *; do
    case "$param" in
-      state|name|check-interval) continue ;;
+      state|name|check-interval|conf-dir) continue ;;
       check-script)
          printf '     ,"check": {\n'
          printf '         "script": "%s"\n' "$(cat "$__object/parameter/check-script")"
@@ -86,7 +86,6 @@ echo "   }"
 # end json file
 echo "}"
 ) | \
-require="__directory${conf_dir}" \
    __config_file "${conf_dir}/${conf_file}" \
       --owner root --group consul --mode 640 \
       --state "$state" \
diff --git a/cdist/conf/type/__consul_watch_checks/explorer/conf-dir b/cdist/conf/type/__consul_watch_checks/explorer/conf-dir
new file mode 120000
index 00000000..daa712c3
--- /dev/null
+++ b/cdist/conf/type/__consul_watch_checks/explorer/conf-dir
@@ -0,0 +1 @@
+../../__consul_service/explorer/conf-dir
\ No newline at end of file
diff --git a/cdist/conf/type/__consul_watch_checks/manifest b/cdist/conf/type/__consul_watch_checks/manifest
index 5fdd7a74..4976b25a 100755
--- a/cdist/conf/type/__consul_watch_checks/manifest
+++ b/cdist/conf/type/__consul_watch_checks/manifest
@@ -20,7 +20,7 @@
 
 cdist_type="${__type##*/}"
 watch_type="${cdist_type##*_}"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="watch_${watch_type}_${__object_id}.json"
 state="$(cat "$__object/parameter/state")"
 
diff --git a/cdist/conf/type/__consul_watch_event/explorer/conf-dir b/cdist/conf/type/__consul_watch_event/explorer/conf-dir
new file mode 120000
index 00000000..daa712c3
--- /dev/null
+++ b/cdist/conf/type/__consul_watch_event/explorer/conf-dir
@@ -0,0 +1 @@
+../../__consul_service/explorer/conf-dir
\ No newline at end of file
diff --git a/cdist/conf/type/__consul_watch_event/manifest b/cdist/conf/type/__consul_watch_event/manifest
index 61934656..b17680c1 100755
--- a/cdist/conf/type/__consul_watch_event/manifest
+++ b/cdist/conf/type/__consul_watch_event/manifest
@@ -20,7 +20,7 @@
 
 cdist_type="${__type##*/}"
 watch_type="${cdist_type##*_}"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="watch_${watch_type}_${__object_id}.json"
 state="$(cat "$__object/parameter/state")"
 
diff --git a/cdist/conf/type/__consul_watch_key/explorer/conf-dir b/cdist/conf/type/__consul_watch_key/explorer/conf-dir
new file mode 120000
index 00000000..daa712c3
--- /dev/null
+++ b/cdist/conf/type/__consul_watch_key/explorer/conf-dir
@@ -0,0 +1 @@
+../../__consul_service/explorer/conf-dir
\ No newline at end of file
diff --git a/cdist/conf/type/__consul_watch_key/manifest b/cdist/conf/type/__consul_watch_key/manifest
index 61934656..b17680c1 100755
--- a/cdist/conf/type/__consul_watch_key/manifest
+++ b/cdist/conf/type/__consul_watch_key/manifest
@@ -20,7 +20,7 @@
 
 cdist_type="${__type##*/}"
 watch_type="${cdist_type##*_}"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="watch_${watch_type}_${__object_id}.json"
 state="$(cat "$__object/parameter/state")"
 
diff --git a/cdist/conf/type/__consul_watch_keyprefix/explorer/conf-dir b/cdist/conf/type/__consul_watch_keyprefix/explorer/conf-dir
new file mode 120000
index 00000000..daa712c3
--- /dev/null
+++ b/cdist/conf/type/__consul_watch_keyprefix/explorer/conf-dir
@@ -0,0 +1 @@
+../../__consul_service/explorer/conf-dir
\ No newline at end of file
diff --git a/cdist/conf/type/__consul_watch_keyprefix/manifest b/cdist/conf/type/__consul_watch_keyprefix/manifest
index 61934656..b17680c1 100755
--- a/cdist/conf/type/__consul_watch_keyprefix/manifest
+++ b/cdist/conf/type/__consul_watch_keyprefix/manifest
@@ -20,7 +20,7 @@
 
 cdist_type="${__type##*/}"
 watch_type="${cdist_type##*_}"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="watch_${watch_type}_${__object_id}.json"
 state="$(cat "$__object/parameter/state")"
 
diff --git a/cdist/conf/type/__consul_watch_nodes/explorer/conf-dir b/cdist/conf/type/__consul_watch_nodes/explorer/conf-dir
new file mode 120000
index 00000000..daa712c3
--- /dev/null
+++ b/cdist/conf/type/__consul_watch_nodes/explorer/conf-dir
@@ -0,0 +1 @@
+../../__consul_service/explorer/conf-dir
\ No newline at end of file
diff --git a/cdist/conf/type/__consul_watch_nodes/manifest b/cdist/conf/type/__consul_watch_nodes/manifest
index 61934656..b17680c1 100755
--- a/cdist/conf/type/__consul_watch_nodes/manifest
+++ b/cdist/conf/type/__consul_watch_nodes/manifest
@@ -20,7 +20,7 @@
 
 cdist_type="${__type##*/}"
 watch_type="${cdist_type##*_}"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="watch_${watch_type}_${__object_id}.json"
 state="$(cat "$__object/parameter/state")"
 
diff --git a/cdist/conf/type/__consul_watch_service/explorer/conf-dir b/cdist/conf/type/__consul_watch_service/explorer/conf-dir
new file mode 120000
index 00000000..daa712c3
--- /dev/null
+++ b/cdist/conf/type/__consul_watch_service/explorer/conf-dir
@@ -0,0 +1 @@
+../../__consul_service/explorer/conf-dir
\ No newline at end of file
diff --git a/cdist/conf/type/__consul_watch_service/manifest b/cdist/conf/type/__consul_watch_service/manifest
index db38eb18..e8d18328 100755
--- a/cdist/conf/type/__consul_watch_service/manifest
+++ b/cdist/conf/type/__consul_watch_service/manifest
@@ -20,7 +20,7 @@
 
 cdist_type="${__type##*/}"
 watch_type="${cdist_type##*_}"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="watch_${watch_type}_${__object_id}.json"
 state="$(cat "$__object/parameter/state")"
 
diff --git a/cdist/conf/type/__consul_watch_services/explorer/conf-dir b/cdist/conf/type/__consul_watch_services/explorer/conf-dir
new file mode 120000
index 00000000..daa712c3
--- /dev/null
+++ b/cdist/conf/type/__consul_watch_services/explorer/conf-dir
@@ -0,0 +1 @@
+../../__consul_service/explorer/conf-dir
\ No newline at end of file
diff --git a/cdist/conf/type/__consul_watch_services/manifest b/cdist/conf/type/__consul_watch_services/manifest
index 61934656..b17680c1 100755
--- a/cdist/conf/type/__consul_watch_services/manifest
+++ b/cdist/conf/type/__consul_watch_services/manifest
@@ -20,7 +20,7 @@
 
 cdist_type="${__type##*/}"
 watch_type="${cdist_type##*_}"
-conf_dir="/etc/consul/conf.d"
+conf_dir=$(cat "$__object/explorer/conf-dir")
 conf_file="watch_${watch_type}_${__object_id}.json"
 state="$(cat "$__object/parameter/state")"
 

From 31ad1bdaad701720303054d668cf9635987edf1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Sun, 26 Jan 2020 15:13:12 +0100
Subject: [PATCH 321/383] Fix various typos and styling errors in
 __consul_agent, conf-dir explorer

---
 cdist/conf/type/__consul_agent/manifest       | 40 ++++++++++---------
 .../type/__consul_service/explorer/conf-dir   |  2 +-
 2 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index 599f15b4..40667002 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -49,7 +49,7 @@ distribution_setup () {
      debian)
        # consul is only available starting Debian 10 (buster).
        # See https://packages.debian.org/buster/consul
-       if [ $release -lt 10 ]; then
+       if [ "$release" -lt 10 ]; then
          echo "Consul is not available for your debian release." >&2
          echo "Please use the 'manual' (i.e. non-package) installation or \
            upgrade the target system." >&2
@@ -59,7 +59,7 @@ distribution_setup () {
        # Override previously defined environment to match debian packaging.
        conf_dir='/etc/consul.d'
        user='consul'
-       grou='consul'
+       group='consul'
      ;;
      *)
         echo "Your operating system ($os) is currently not supported with the \
@@ -71,7 +71,7 @@ distribution_setup () {
   esac
 
   # Install consul package.
-  __package consul --state $state
+  __package consul --state "$state"
 
   export config_deployment_requires="__package/consul"
 }
@@ -139,7 +139,7 @@ manual_setup () {
   esac
 
   # Create data directory.
-  require="__user/consul"__directory "$data_dir" \
+  require="__user/consul" __directory "$data_dir" \
     --owner "$user" --group "$group" --mode 770 --state "$state"
 
   # Create config directory.
@@ -202,8 +202,23 @@ else
   manual_setup
 fi
 
+###
+# Install TLS certificates.
+
+if [ -f "$__object/parameter/ca-file-source" ] || \
+   [ -f "$__object/parameter/cert-file-source" ] || \
+   [ -f "$__object/parameter/key-file-source" ]; then
+
+   requires="$config_deployment_requires" __directory $tls_dir \
+     --owner root --group "$group" --mode 750 --state "$state"
+
+   # Append to service restart requirements.
+   restart_requires="$restart_requires __directory/$conf_dir/tls"
+fi
+
 ###
 # Generate and deploy configuration.
+
 json_configuration=$(
   echo "{"
 
@@ -216,8 +231,8 @@ json_configuration=$(
         state|user|group|json-config|use-distribution-package) continue ;;
         ca-file-source|cert-file-source|key-file-source)
            source="$(cat "$__object/parameter/$param")"
-           destination="/etc/consul/ssl/${source##*/}"
-           require="__directory/etc/consul/ssl" \
+           destination="$tls_dir/${source##*/}"
+           require="__directory/$tls_dir" \
               __file "$destination" \
                  --owner root --group consul --mode 640 \
                  --source "$source" \
@@ -276,19 +291,6 @@ echo "$json_configuration" | require="$config_deployment_requires" \
 # Set configuration deployment as requirement for service restart.
 restart_requires="__file/$conf_dir/$conf_file"
 
-###
-# Install TLS certificates.
-if [ -f "$__object/parameter/ca-file-source" ] || \
-   [ -f "$__object/parameter/cert-file-source" ] || \
-   [ -f "$__object/parameter/key-file-source" ]; then
-
-   requires="__file/$conf_dir/$conf_file" __directory $conf_dir/tls \
-     --owner root --group "$group" --mode 750 --state "$state"
-
-   # Append to service restart requirements.
-   restart_requires="$restart_requires __directory/$conf_dir/tls"
-fi
-
 ###
 # Restart consul agent after everything else.
 require="$restart_requires" __service consul --action restart
diff --git a/cdist/conf/type/__consul_service/explorer/conf-dir b/cdist/conf/type/__consul_service/explorer/conf-dir
index 6e94f781..0fc9ef84 100644
--- a/cdist/conf/type/__consul_service/explorer/conf-dir
+++ b/cdist/conf/type/__consul_service/explorer/conf-dir
@@ -2,7 +2,7 @@
 
 check_dir () {
   if [ -d "$1" ]; then
-    echo -n "$1"
+    printf '%s' "$1"
     exit
   fi
 }

From 09540dc6bd63cb338ed8dc27bf69e2cc3547f02f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Mon, 17 Feb 2020 11:18:36 +0100
Subject: [PATCH 322/383] Add simple __service type

---
 .../type/__service/explorer/service-manager   |  8 +++
 cdist/conf/type/__service/gencode-remote      |  9 ++++
 cdist/conf/type/__service/man.rst             | 51 +++++++++++++++++++
 cdist/conf/type/__service/manifest            | 15 ++++++
 cdist/conf/type/__service/parameter/required  |  1 +
 5 files changed, 84 insertions(+)
 create mode 100755 cdist/conf/type/__service/explorer/service-manager
 create mode 100755 cdist/conf/type/__service/gencode-remote
 create mode 100644 cdist/conf/type/__service/man.rst
 create mode 100644 cdist/conf/type/__service/manifest
 create mode 100644 cdist/conf/type/__service/parameter/required

diff --git a/cdist/conf/type/__service/explorer/service-manager b/cdist/conf/type/__service/explorer/service-manager
new file mode 100755
index 00000000..55a873fa
--- /dev/null
+++ b/cdist/conf/type/__service/explorer/service-manager
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# Assume systemd if systemctl is in PATH.
+if [ "$(command -v systemctl)" ]; then
+	printf "systemd"
+else
+	printf "unknown"
+fi
diff --git a/cdist/conf/type/__service/gencode-remote b/cdist/conf/type/__service/gencode-remote
new file mode 100755
index 00000000..ac62e05f
--- /dev/null
+++ b/cdist/conf/type/__service/gencode-remote
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+manager="$(cat "$__object/explorer/service-manager")"
+name=$__object_id
+action="$(cat "$__object/parameter/action")"
+
+if [ "$manager" = "unknown" ]; then
+	echo "service '$name' '$action'"
+fi
diff --git a/cdist/conf/type/__service/man.rst b/cdist/conf/type/__service/man.rst
new file mode 100644
index 00000000..f9b23d5b
--- /dev/null
+++ b/cdist/conf/type/__service/man.rst
@@ -0,0 +1,51 @@
+cdist-type__service(7)
+======================
+
+NAME
+----
+cdist-type__service - Run action on a system service
+
+
+DESCRIPTION
+-----------
+This type allows you to run an action against a system service.
+
+
+REQUIRED PARAMETERS
+-------------------
+action
+  Arbitrary parameter passed as action. Usually 'start', 'stop', 'reload' or 'restart'.
+
+OPTIONAL PARAMETERS
+-------------------
+None.
+
+
+BOOLEAN PARAMETERS
+------------------
+None.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # Restart nginx service.
+    __service nginx --action restart
+
+    # Stop postfix service.
+    __service postfix --action stop
+
+
+AUTHORS
+-------
+Timothée Floure <timothee.floure@ungleich.ch>
+
+
+COPYING
+-------
+Copyright \(C) 2019 Timothée Floure. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__service/manifest b/cdist/conf/type/__service/manifest
new file mode 100644
index 00000000..cb5af234
--- /dev/null
+++ b/cdist/conf/type/__service/manifest
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+manager="$(cat "$__object/explorer/service-manager")"
+
+name=$__object_id
+action="$(cat "$__object/parameter/action")"
+
+case "$manager" in
+	systemd)
+		__systemd_service "$name" --action "$action"
+	;;
+	*)
+		# Unknown: handled by `service $NAME $action` in gencode-remote.
+	;;
+esac
diff --git a/cdist/conf/type/__service/parameter/required b/cdist/conf/type/__service/parameter/required
new file mode 100644
index 00000000..a9f84d41
--- /dev/null
+++ b/cdist/conf/type/__service/parameter/required
@@ -0,0 +1 @@
+action

From b891bb05d5751fe0f80829d7fe54cd56468d5e51 Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 19 Feb 2020 12:58:22 +0200
Subject: [PATCH 323/383] __update_alternatives: add state explorer

---
 cdist/conf/type/__update_alternatives/explorer/state | 8 ++++++++
 cdist/conf/type/__update_alternatives/gencode-remote | 4 ++++
 2 files changed, 12 insertions(+)
 create mode 100755 cdist/conf/type/__update_alternatives/explorer/state

diff --git a/cdist/conf/type/__update_alternatives/explorer/state b/cdist/conf/type/__update_alternatives/explorer/state
new file mode 100755
index 00000000..04a78aaa
--- /dev/null
+++ b/cdist/conf/type/__update_alternatives/explorer/state
@@ -0,0 +1,8 @@
+#!/bin/sh -e
+path="$(cat "$__object/parameter/path")"
+name="$__object_id"
+link="$(readlink "/etc/alternatives/$name")"
+if [ "$path" = "$link" ]
+then echo present
+else echo absent
+fi
diff --git a/cdist/conf/type/__update_alternatives/gencode-remote b/cdist/conf/type/__update_alternatives/gencode-remote
index 0e7b0d89..b632deb2 100755
--- a/cdist/conf/type/__update_alternatives/gencode-remote
+++ b/cdist/conf/type/__update_alternatives/gencode-remote
@@ -21,6 +21,10 @@
 # Setup alternative - no standard way to create, always set
 #
 
+if [ "$(cat "$__object/explorer/state")" = 'present' ]
+then exit 0
+fi
+
 path="$(cat "$__object/parameter/path")"
 name="$__object_id"
 echo "update-alternatives --quiet --set '$name' '$path'"

From a3bc8f94075e23d8c0032fc8322aba5eebebd41e Mon Sep 17 00:00:00 2001
From: Ander Punnar <ander@kvlt.ee>
Date: Wed, 19 Feb 2020 12:59:14 +0200
Subject: [PATCH 324/383] __update_alternatives: remove expired comment

---
 cdist/conf/type/__update_alternatives/gencode-remote | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/cdist/conf/type/__update_alternatives/gencode-remote b/cdist/conf/type/__update_alternatives/gencode-remote
index b632deb2..c0b49814 100755
--- a/cdist/conf/type/__update_alternatives/gencode-remote
+++ b/cdist/conf/type/__update_alternatives/gencode-remote
@@ -17,9 +17,6 @@
 # You should have received a copy of the GNU General Public License
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
-#
-# Setup alternative - no standard way to create, always set
-#
 
 if [ "$(cat "$__object/explorer/state")" = 'present' ]
 then exit 0

From 1b0caeda13ddfc3d941332ea912983aba01b4819 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 19 Feb 2020 14:49:35 +0100
Subject: [PATCH 325/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index bd767b9d..6410d36d 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Type __update_alternatives: Add state explorer (Ander Punnar)
+
 6.5.1: 2020-02-15
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)
 	* Explorer os_release: Add fallbacks (Dennis Camera)

From 28d3760e29aaf8cdb30390f7e78c2334d7af8bc4 Mon Sep 17 00:00:00 2001
From: Jin-Guk Kwon <jinguk.kwon@ungleich.ch>
Date: Thu, 20 Feb 2020 09:40:55 +0100
Subject: [PATCH 326/383] [cdist]Update os_version for alpine

---
 cdist/conf/explorer/os_version | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/explorer/os_version b/cdist/conf/explorer/os_version
index 4c41695b..1d54ea60 100755
--- a/cdist/conf/explorer/os_version
+++ b/cdist/conf/explorer/os_version
@@ -70,4 +70,7 @@ case "$("$__explorer/os")" in
    ubuntu)
       lsb_release -sr
    ;;
-esac
+   alpine)
+       cat /etc/alpine-release
+   ;;
+esac
\ No newline at end of file

From ceddbd15a04327489916b61e58fdf2d7a7728427 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 20 Feb 2020 10:15:34 +0100
Subject: [PATCH 327/383] ++changes

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 6410d36d..b0ebf789 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Type __update_alternatives: Add state explorer (Ander Punnar)
+	* Explorer os_version: Add support for Alpine Linux (Jin-Guk Kwon)
 
 6.5.1: 2020-02-15
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)

From 21c9e3db1852eebb88be5454137ceb23159f7dc0 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Mon, 3 Feb 2020 22:12:21 +0100
Subject: [PATCH 328/383] [explorer/init] Support more init systems

---
 cdist/conf/explorer/init | 225 ++++++++++++++++++++++++++++++---------
 1 file changed, 174 insertions(+), 51 deletions(-)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index ceae2e9f..bf1736cd 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -1,7 +1,8 @@
-#!/bin/sh
+#!/bin/sh -e
 #
 # 2016 Daniel Heule (hda at sfs.biz)
 # Copyright 2017, Philippe Gregoire <pg@pgregoire.xyz>
+# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch)
 #
 # This file is part of cdist.
 #
@@ -23,59 +24,181 @@
 # for example at linux this value is "init" or "systemd" in most cases
 #
 
+set -e
+
+# Expected values:
+# Linux:
+#  Gentoo:
+#	 sysvinit, openrc-init
+
+# GNU:
+#	Debian:
+#	  hurd-init, sysvinit
+
+# [root@fedora-12 ~]# readlink /proc/1/exe
+# /sbin/init (deleted)
+# [root@fedora-12 ~]# ls -l /proc/1/exe
+# lrwxrwxrwx. 1 root root 0 2020-01-30 23:00 /proc/1/exe -> /sbin/init (deleted)
+
+# inspired by https://stackoverflow.com/a/33266819
+shreadlink() (
+	CDPATH=
+	target=$1 fname= targetDir=
+
+	# Resolve potential symlinks until the ultimate target is found.
+	while :
+	do
+		if ! test -e "$target"
+		then
+			printf 'ERROR: %s does not exist.\n' "'$target'" >&2
+			return 1
+		fi
+
+		# Change to target dir; necessary for correct resolution of target path.
+		cd "$(dirname -- "$target")"
+
+		fname=$(basename -- "$target") # Extract filename.
+		[ "$fname" = '/' ] && fname='' # !! curiously, `basename /` returns '/'
+
+		[ -L "$fname" ] || break
+
+		# Extract [next] target path, which may be defined
+		# *relative* to the symlink's own directory.
+		# Note: We parse `ls -l` output to find the symlink target
+		#		which is the only POSIX-compliant, albeit somewhat fragile, way.
+		# FIXME: Will break if one of the filenames contain ’ -> ’
+		target=$(ls -l "$fname" | sed -e 's/^.* -> //')
+	done
+
+	# Get canonical dir. path
+	targetDir=$(pwd -P)
+
+	# Output the ultimate target's canonical path.
+	# Note that we manually resolve paths ending in /. and /.. to make sure we have a normalized path.
+	if test "$fname" = '.'
+	then
+		printf '%s\n' "${targetDir%/}"
+	elif test "$fname" = '..'
+	then
+		# Caveat: something like /var/.. will resolve to /private (assuming /var@ -> /private/var), i.e. the '..' is applied
+		# AFTER canonicalization.
+		printf '%s\n' "$(dirname -- "${targetDir}")"
+	else
+		printf '%s/%s\n' "${targetDir%/}" "$fname"
+	fi
+)
+
+
 case $(uname -s) in
-    Linux)
-        if test -d /proc/1/
-        then
-            comm_name=$(cat /proc/1/comm)
-        else
-            # BusyBox's versions of ps and pgrep do not support some options
-            # depending on which compile-time options have been used.
-            # Both pgrep and ps are tried to get the command name
-            comm_name=$(
-                pgrep -P0 -l 2>/dev/null | awk '/^1[ \t]/ { print $2 }'
-                || ps -o comm= -p 1 2>/dev/null)
-        fi
+	Linux|GNU)
+		# if test -f /proc/1/comm
+		# then
+		#	  comm_name=$(cat /proc/1/comm)
+		# else
+			# BusyBox's versions of ps and pgrep do not support some options
+			# depending on which compile-time options have been used.
+			# Both pgrep and ps are tried to get the command name
+		#	  comm_name=$(
+		#		  pgrep -P0 -l 2>/dev/null | awk '/^1[ \t]/ { print $2 }'
+		#		  || ps -o comm= -p 1 2>/dev/null)
+		# fi
 
-        case $comm_name
-        in
-            systemd)
-                echo systemd
-            ;;
-            init)
-                # It could be anything...
+		init_exe=$(shreadlink /proc/1/exe)
 
-                if test -h /proc/1/exe
-                then
-                    init_exe=/proc/1/exe
-                else
-                    init_exe=$(command -v "$comm_name")
-                fi
+		if ! test -x "$init_exe"
+		then
+			# On some rare occasions it can happen that the
+			# running init's binary has been replaced. In this
+			# case Linux adjusts the symlink to "X (deleted)"
+			case $init_exe
+			in
+				*' (deleted)')
+					init_exe=${init_exe% (deleted)}
+					test -x "$init_exe" || exit 1
+					;;
+				*)
+					exit 1
+					;;
+			esac
+		fi
 
-                test -x "$comm_exe" || exit 1
+		if test "$init_exe" = '/hurd/init'
+		then
+			# XXX: Could maybe be removed
+			echo hurd-init
+			exit 0
+		fi
 
-                case $("$comm_exe" --version | head -n 1)
-                in
-                    *SysV*)
-                        echo init
-                    ;;
-                    *upstart*)
-                        echo upstart
-                    ;;
-                    *)
-                        echo ""
-                    ;;
-                esac
-        esac
-    ;;
-    FreeBSD|OpenBSD)
-        ps -o comm= -p 1 2>/dev/null || true
-    ;;
-    Darwin)
-        basename "$(ps -o comm= -p 1 2>/dev/null)"
-    ;;
-    *)
-        # return a empty string as unknown value
-        echo ""
-    ;;
+		comm_name=$(basename "$init_exe")
+		case $comm_name
+		in
+			init)
+				:  # handled below
+				;;
+			systemd)
+				# NOTE: sd_booted(3)
+				if test -d /run/systemd/system/
+				then
+					echo systemd
+					exit 0
+				fi
+				# otherwise: treat like "init"
+				;;
+			*)
+				echo "$comm_name"
+				exit 0
+				;;
+		esac
+
+		# init: it could be anything...
+		case $("$init_exe" --version 2>/dev/null | head -n 1)
+		in
+			SysV*)
+				# This is a little bit more specific than init
+				echo sysvinit
+				exit 0
+				;;
+			*'GNU Hurd'*)
+				echo hurd-init
+				;;
+			*upstart*)
+				echo upstart
+				exit 0
+				;;
+		esac
+		case $("$init_exe" --help 2>/dev/null | head -n 1)
+		in
+			BusyBox*)
+				echo busybox
+				exit 0
+				;;
+		esac
+
+		echo init
+		;;
+	FreeBSD|OpenBSD)
+		ps -o comm= -p 1 2>/dev/null || true
+		;;
+	Darwin)
+		basename "$(ps -o comm= -p 1 2>/dev/null)"
+		;;
+	SunOS)
+		comm_name=$(ps -o comm= -p 1 2>/dev/null)
+		if test "$(basename "$comm_name")" != 'init'
+		then
+			echo "${comm_name}"
+			exit 0
+		fi
+
+		# XXX: Is this the correct way??
+		if test -f /etc/svc/volatile/svc_nonpersist.db
+		then
+			echo smf
+			exit 0
+		fi
+		;;
+	*)
+		# return a empty string as unknown value
+		echo ""
+		;;
 esac

From d895bb0e87f524e8a64a802e6ff1922e52860ffa Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Tue, 18 Feb 2020 01:24:41 +0100
Subject: [PATCH 329/383] [explorer/init] Clean up

---
 cdist/conf/explorer/init | 399 ++++++++++++++++++++++++---------------
 1 file changed, 246 insertions(+), 153 deletions(-)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index bf1736cd..2d4f07c1 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -20,185 +20,278 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 #
-# Returns the process name of pid 1 ( normaly the init system )
-# for example at linux this value is "init" or "systemd" in most cases
+# Returns the name of the init system (PID 1)
 #
-
-set -e
-
 # Expected values:
 # Linux:
+#  Adélie Linux:
+#    sysvinit+openrc
+#  Alpine Linux:
+#    busybox-init+openrc
+#  ArchLinux:
+#    systemd, sysvinit
+#  CRUX:
+#    sysvinit
+#  Debian:
+#    systemd, upstart, sysvinit, openrc, ???
+#  Devuan:
+#    sysvinit, ???
 #  Gentoo:
-#	 sysvinit, openrc-init
-
+#    sysvinit+openrc, openrc-init, systemd
+#  OpenBMC:
+#    systemd
+#  OpenWrt:
+#    procd, init??
+#  RedHat (RHEL, CentOS, Fedora, RedHat Linux, ...):
+#    systemd, upstart, sysvinit
+#  Slackware:
+#    sysvinit
+#  SuSE:
+#    systemd, sysvinit
+#  Ubuntu:
+#    systemd, upstart, sysvinit
+#
 # GNU:
-#	Debian:
-#	  hurd-init, sysvinit
+#   Debian:
+#     hurd-init, sysvinit
+#
+# BSD:
+#  {Free,Open,Net}BSD:
+#    init
+#
+# Mac OS X:
+#   launchd, init
+#
+# Solaris/Illumos:
+#   smf, init
+
 
 # [root@fedora-12 ~]# readlink /proc/1/exe
 # /sbin/init (deleted)
 # [root@fedora-12 ~]# ls -l /proc/1/exe
 # lrwxrwxrwx. 1 root root 0 2020-01-30 23:00 /proc/1/exe -> /sbin/init (deleted)
 
-# inspired by https://stackoverflow.com/a/33266819
-shreadlink() (
-	CDPATH=
-	target=$1 fname= targetDir=
+set -e
+#set -x  # DEBUG
 
-	# Resolve potential symlinks until the ultimate target is found.
-	while :
-	do
-		if ! test -e "$target"
-		then
-			printf 'ERROR: %s does not exist.\n' "'$target'" >&2
-			return 1
-		fi
-
-		# Change to target dir; necessary for correct resolution of target path.
-		cd "$(dirname -- "$target")"
-
-		fname=$(basename -- "$target") # Extract filename.
-		[ "$fname" = '/' ] && fname='' # !! curiously, `basename /` returns '/'
-
-		[ -L "$fname" ] || break
-
-		# Extract [next] target path, which may be defined
-		# *relative* to the symlink's own directory.
-		# Note: We parse `ls -l` output to find the symlink target
-		#		which is the only POSIX-compliant, albeit somewhat fragile, way.
-		# FIXME: Will break if one of the filenames contain ’ -> ’
-		target=$(ls -l "$fname" | sed -e 's/^.* -> //')
-	done
-
-	# Get canonical dir. path
-	targetDir=$(pwd -P)
-
-	# Output the ultimate target's canonical path.
-	# Note that we manually resolve paths ending in /. and /.. to make sure we have a normalized path.
-	if test "$fname" = '.'
+validate_busybox_init() {
+	# It is quite common to use SysVinit to stack other init systemd
+	# (like OpenRC) on top of it. So we check for that, too.
+	if stacked=$(validate_openrc)
 	then
-		printf '%s\n' "${targetDir%/}"
-	elif test "$fname" = '..'
-	then
-		# Caveat: something like /var/.. will resolve to /private (assuming /var@ -> /private/var), i.e. the '..' is applied
-		# AFTER canonicalization.
-		printf '%s\n' "$(dirname -- "${targetDir}")"
+		echo "busybox-init+${stacked}"
 	else
-		printf '%s/%s\n' "${targetDir%/}" "$fname"
+		echo busybox-init
 	fi
-)
+}
 
+validate_hurd_init() {
+	# FIXME: Test me!
+	test -x /hurd/init || return 1
+	grep -q 'GNU Hurd' /hurd/init || return 1
+	echo hurd-init
+}
 
-case $(uname -s) in
-	Linux|GNU)
-		# if test -f /proc/1/comm
-		# then
-		#	  comm_name=$(cat /proc/1/comm)
-		# else
-			# BusyBox's versions of ps and pgrep do not support some options
-			# depending on which compile-time options have been used.
-			# Both pgrep and ps are tried to get the command name
-		#	  comm_name=$(
-		#		  pgrep -P0 -l 2>/dev/null | awk '/^1[ \t]/ { print $2 }'
-		#		  || ps -o comm= -p 1 2>/dev/null)
-		# fi
+validate_openrc() {
+	test -f /run/openrc/softlevel || return 1
+	echo openrc
+}
 
-		init_exe=$(shreadlink /proc/1/exe)
+validate_procd() {
+	grep -q 'procd' /sbin/procd || return 1
+	echo procd
+}
 
-		if ! test -x "$init_exe"
-		then
-			# On some rare occasions it can happen that the
-			# running init's binary has been replaced. In this
-			# case Linux adjusts the symlink to "X (deleted)"
-			case $init_exe
-			in
-				*' (deleted)')
-					init_exe=${init_exe% (deleted)}
-					test -x "$init_exe" || exit 1
-					;;
-				*)
-					exit 1
-					;;
-			esac
-		fi
+validate_runit() {
+	test -d /run/runit || return 1
+	echo runit
+}
 
-		if test "$init_exe" = '/hurd/init'
-		then
-			# XXX: Could maybe be removed
-			echo hurd-init
-			exit 0
-		fi
+validate_smf() {
+	# XXX: Is this the correct way??
+	test -f /etc/svc/volatile/svc_nonpersist.db || return 1
+	echo smf
+}
 
-		comm_name=$(basename "$init_exe")
-		case $comm_name
+validate_systemd() {
+	# NOTE: sd_booted(3)
+	test -d /run/systemd/system/ || return 1
+	# systemctl --version | sed -e '/^systemd/!d;s/^systemd //'
+	echo systemd
+}
+
+validate_sysvinit() {
+	test -x /sbin/init \
+	 && grep -q 'INIT_VERSION=sysvinit-[0-9.]*' /sbin/init \
+	 || return 1
+
+	# It is quite common to use SysVinit to stack other init systemd
+	# (like OpenRC) on top of it. So we check for that, too.
+	if stacked=$(validate_openrc)
+	then
+		echo "sysvinit+${stacked}"
+	else
+		echo sysvinit
+	fi
+	unset stacked
+}
+
+validate_upstart() {
+	test -x "$(command -v initctl)" || return 1
+	case $(initctl version)
+	in
+		*'(upstart '*')')
+			# if type -d /etc/init
+			# then
+			# 	# modern (DBus-based?) upstart >= 0.5
+			# 	:
+			# elif type -d /etc/events.d
+			# then
+			# 	# ancient upstart
+			# 	:
+			# fi
+			echo upstart
+			;;
+		*)
+			return 1
+			;;
+	esac
+}
+
+find_init_procfs() (
+	# First, check if the required file in procfs exists...
+	test -h /proc/1/exe || return 1
+
+	# Find init executable
+	init_exe=$(ls -l /proc/1/exe 2>/dev/null)
+	init_exe=${init_exe#* -> }
+
+	if ! test -x "$init_exe"
+	then
+		# On some rare occasions it can happen that the
+		# running init's binary has been replaced. In this
+		# case Linux adjusts the symlink to "X (deleted)"
+		case $init_exe
 		in
-			init)
-				:  # handled below
-				;;
-			systemd)
-				# NOTE: sd_booted(3)
-				if test -d /run/systemd/system/
-				then
-					echo systemd
-					exit 0
-				fi
-				# otherwise: treat like "init"
+			*' (deleted)')
+				init_exe=${init_exe% (deleted)}
+				test -x "$init_exe" || exit 1
 				;;
 			*)
-				echo "$comm_name"
-				exit 0
+				exit 1
 				;;
 		esac
+	fi
 
-		# init: it could be anything...
-		case $("$init_exe" --version 2>/dev/null | head -n 1)
-		in
-			SysV*)
-				# This is a little bit more specific than init
-				echo sysvinit
-				exit 0
-				;;
-			*'GNU Hurd'*)
-				echo hurd-init
-				;;
-			*upstart*)
-				echo upstart
-				exit 0
-				;;
-		esac
-		case $("$init_exe" --help 2>/dev/null | head -n 1)
-		in
-			BusyBox*)
-				echo busybox
-				exit 0
-				;;
-		esac
+	echo "${init_exe}"
+)
 
-		echo init
-		;;
-	FreeBSD|OpenBSD)
-		ps -o comm= -p 1 2>/dev/null || true
-		;;
-	Darwin)
-		basename "$(ps -o comm= -p 1 2>/dev/null)"
-		;;
-	SunOS)
-		comm_name=$(ps -o comm= -p 1 2>/dev/null)
-		if test "$(basename "$comm_name")" != 'init'
-		then
-			echo "${comm_name}"
-			exit 0
-		fi
+# BusyBox's versions of ps and pgrep do not support some options
+# depending on which compile-time options have been used.
 
-		# XXX: Is this the correct way??
-		if test -f /etc/svc/volatile/svc_nonpersist.db
-		then
-			echo smf
-			exit 0
-		fi
-		;;
-	*)
-		# return a empty string as unknown value
-		echo ""
-		;;
-esac
+find_init_pgrep() {
+	pgrep -P0 -fl 2>/dev/null | awk -F '[[:blank:]]' '$1 == 1 { print $2 }'
+}
+
+find_init_ps() {
+	case $(uname -s)
+	in
+		Darwin|NetBSD)
+			ps -o ucomm= -p 1 2>/dev/null
+			;;
+		FreeBSD)
+			ps -o command= -p 1 2>/dev/null | cut -d ' ' -f 1
+			;;
+		OpenBSD)
+			ps -o command -p 1 2>/dev/null | tail -n +2 | cut -d ' ' -f 1
+			;;
+		*)
+			ps -o comm= -p 1 2>/dev/null
+			;;
+	esac
+}
+
+find_init() {
+	case $(uname -s)
+	in
+		Linux|GNU|NetBSD)
+			find_init_procfs || find_init_pgrep || find_init_ps
+			;;
+		FreeBSD)
+			find_init_procfs || find_init_ps
+			;;
+		OpenBSD)
+			find_init_pgrep || find_init_ps
+			;;
+		Darwin|FreeBSD|SunOS)
+			find_init_ps
+			;;
+		*)
+			echo "Don't know how to determine init." >&2
+			echo 'Please send a patch.' >&2
+			exit 1
+	esac
+}
+
+validate_by_comm_name() {
+	case $1
+	in
+		busybox)
+			validate_busybox_init
+			;;
+		init)
+			# FIXME: Do some more magic here!
+			echo init
+			;;
+		openrc-init)
+			validate_openrc >/dev/null && echo openrc-init
+			;;
+		runit)
+			validate_runit
+			;;
+		systemd)
+			validate_systemd
+			;;
+		*)
+			# Run validate function by comm name if available.
+			# Fall back to comm name if either it does not exist or
+			# returns non-zero.
+			type "validate_$1" >/dev/null && "validate_$1" || echo $1
+	esac
+}
+
+try_all() {
+	# init: it could be anything...
+	# We try some approaches to gather more information about init without
+	# calling it! On some init systemd this triggers a reinitialisation of
+	# the system which we don't want (e.g. embedded systems).
+
+	validate_sysvinit || \
+	validate_openrc || \
+	validate_runit || \
+	validate_smf || \
+	validate_upstart || \
+	validate_hurd_init || \
+	echo init  # fallback
+}
+
+init=$(find_init)
+
+if test -x "${init}"
+then
+	case $init
+	in
+		/hurd/init)
+			# FIXME: Create validate function
+			echo hurd-init
+			;;
+		*/init)
+			try_all
+			;;
+		*)
+			validate_by_comm_name "$(basename "${init}")"
+			;;
+	esac
+else
+	validate_by_comm_name "${init}"
+fi

From 364340c8d5a1bcb6492d6c8cdfbbd808b13b5024 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 20 Feb 2020 21:34:21 +0100
Subject: [PATCH 330/383] [explorer/init] Refactor and testing

---
 cdist/conf/explorer/init | 392 ++++++++++++++++++++++++++-------------
 1 file changed, 267 insertions(+), 125 deletions(-)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index 2d4f07c1..db417a14 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -21,7 +21,7 @@
 #
 #
 # Returns the name of the init system (PID 1)
-#
+
 # Expected values:
 # Linux:
 #  Adélie Linux:
@@ -35,122 +35,221 @@
 #  Debian:
 #    systemd, upstart, sysvinit, openrc, ???
 #  Devuan:
-#    sysvinit, ???
+#    sysvinit, sysvinit+openrc
 #  Gentoo:
 #    sysvinit+openrc, openrc-init, systemd
 #  OpenBMC:
 #    systemd
 #  OpenWrt:
-#    procd, init??
+#    procd, init???
 #  RedHat (RHEL, CentOS, Fedora, RedHat Linux, ...):
-#    systemd, upstart, sysvinit
+#    systemd, upstart, upstart-legacy, sysvinit
 #  Slackware:
 #    sysvinit
 #  SuSE:
 #    systemd, sysvinit
 #  Ubuntu:
-#    systemd, upstart, sysvinit
+#    systemd, upstart, upstart-legacy, sysvinit
+#  VoidLinux:
+#    runit
 #
 # GNU:
 #   Debian:
-#     hurd-init, sysvinit
+#     sysvinit, hurd-init
 #
 # BSD:
 #  {Free,Open,Net}BSD:
 #    init
 #
 # Mac OS X:
-#   launchd, init
+#   launchd, init+SystemStarter
 #
 # Solaris/Illumos:
-#   smf, init
+#   smf, init???
 
+# NOTE: init systems can be stacked. This is popular to run OpenRC on top of
+# sysvinit (Gentoo) or busybox-init (Alpine), but can also be used to run runit
+# as a systemd service.  This makes init system detection very complicated
+# (which result is expected?)  This script tries to untangle some combinations,
+# OpenRC on top of sysv or busybox (X+openrc), but will ignore others (runit as
+# a systemd service)
+
+# NOTE: When we have no idea, nothing will be printed!
+
+# NOTE:
+# When trying to gather information about the init system make sure to do so
+# without calling the binary!   On some systems this triggers a reinitialisation
+# of the system which we don't want (e.g. embedded systems).
 
-# [root@fedora-12 ~]# readlink /proc/1/exe
-# /sbin/init (deleted)
-# [root@fedora-12 ~]# ls -l /proc/1/exe
-# lrwxrwxrwx. 1 root root 0 2020-01-30 23:00 /proc/1/exe -> /sbin/init (deleted)
 
 set -e
-#set -x  # DEBUG
 
-validate_busybox_init() {
-	# It is quite common to use SysVinit to stack other init systemd
+KERNEL_NAME=$(uname -s)
+
+KNOWN_INIT_SYSTEMS=$(cat <<EOF
+systemd
+sysvinit
+upstart
+runit
+procd
+smf
+launchd
+init
+hurd_init
+systemstarter
+EOF
+)
+
+
+common_candidates_by_kernel() {
+	case $KERNEL_NAME
+	in
+		FreeBSD|NetBSD|OpenBSD)
+			echo init
+			;;
+		Linux)
+			echo systemd
+			echo sysvinit
+			echo upstart
+			;;
+		GNU)
+			echo sysvinit
+			echo hurd-init
+			;;
+		Darwin)
+			echo launchd
+			echo systemstarter
+			;;
+		SunOS)
+			echo smf
+			;;
+	esac
+}
+
+
+## Helpers
+
+trim() {
+	sed -e 's/^[[:blank:]]*//' -e 's/[[:blank:]]*$//' -e '/^[[:blank:]]*$/d'
+}
+
+unique() {
+	# Delete duplicate lines (keeping input order)
+	awk '!x[$0]++'
+}
+
+
+## Check functions
+# These functions are used to verify if a guess is correct by checking some
+# common property of a running system (presence of a directory in /run etc.)
+
+check_busybox_init() (
+	busybox_path=${1:-/bin/busybox}
+	test -x "${busybox_path}" || return 1
+	grep -q 'BusyBox v[0-9]' "${busybox_path}" || return 1
+
+	# It is quite common to use Busybox init to stack other init systemd
 	# (like OpenRC) on top of it. So we check for that, too.
-	if stacked=$(validate_openrc)
+	if stacked=$(check_openrc)
 	then
 		echo "busybox-init+${stacked}"
 	else
 		echo busybox-init
 	fi
-}
+)
 
-validate_hurd_init() {
-	# FIXME: Test me!
-	test -x /hurd/init || return 1
-	grep -q 'GNU Hurd' /hurd/init || return 1
+check_hurd_init() (
+	init_exe=${1:-/hurd/init}
+	test -x "${init_exe}" || return 1
+	grep -q 'GNU Hurd' "${init_exe}" || return 1
 	echo hurd-init
+)
+
+check_init() {
+	# Checks for various BSD inits...
+	test -x /sbin/init || return 1
+
+	if grep -q -E '(Free|Net|Open)BSD' /sbin/init
+	then
+		echo init
+		return 0
+	fi
 }
 
-validate_openrc() {
+check_launchd() {
+	command -v launchctl >/dev/null 2>&1 || return 1
+	launchctl getenv PATH >/dev/null || return 1
+	echo launchd
+}
+
+check_openrc() {
 	test -f /run/openrc/softlevel || return 1
 	echo openrc
 }
 
-validate_procd() {
-	grep -q 'procd' /sbin/procd || return 1
+check_procd() (
+	procd_path=${1:-/sbin/procd}
+	test -x "${procd_path}" || return 1
+	grep -q 'procd' "${procd_path}" || return 1
 	echo procd
-}
+)
 
-validate_runit() {
+check_runit() {
 	test -d /run/runit || return 1
 	echo runit
 }
 
-validate_smf() {
+check_smf() {
 	# XXX: Is this the correct way??
 	test -f /etc/svc/volatile/svc_nonpersist.db || return 1
 	echo smf
 }
 
-validate_systemd() {
+check_systemd() {
 	# NOTE: sd_booted(3)
 	test -d /run/systemd/system/ || return 1
 	# systemctl --version | sed -e '/^systemd/!d;s/^systemd //'
 	echo systemd
 }
 
-validate_sysvinit() {
-	test -x /sbin/init \
-	 && grep -q 'INIT_VERSION=sysvinit-[0-9.]*' /sbin/init \
-	 || return 1
+check_systemstarter() {
+	test -d /System/Library/StartupItems/ || return 1
+	test -f /System/Library/StartupItems/LoginWindow/StartupParameters.plist || return 1
+	echo init+SystemStarter
+}
+
+check_sysvinit() (
+	init_path=${1:-/sbin/init}
+	grep -q 'INIT_VERSION=sysvinit-[0-9.]*' "${init_path}" || return 1
 
 	# It is quite common to use SysVinit to stack other init systemd
 	# (like OpenRC) on top of it. So we check for that, too.
-	if stacked=$(validate_openrc)
+	if stacked=$(check_openrc)
 	then
 		echo "sysvinit+${stacked}"
 	else
 		echo sysvinit
 	fi
 	unset stacked
-}
+)
 
-validate_upstart() {
+check_upstart() {
 	test -x "$(command -v initctl)" || return 1
 	case $(initctl version)
 	in
 		*'(upstart '*')')
-			# if type -d /etc/init
-			# then
-			# 	# modern (DBus-based?) upstart >= 0.5
-			# 	:
-			# elif type -d /etc/events.d
-			# then
-			# 	# ancient upstart
-			# 	:
-			# fi
-			echo upstart
+			if test -d /etc/init
+			then
+				# modern (DBus-based?) upstart >= 0.5
+				echo upstart
+			elif test -d /etc/event.d
+			then
+				# ancient upstart
+				echo upstart-legacy
+			else
+				# whatever...
+				echo upstart
+			fi
 			;;
 		*)
 			return 1
@@ -163,7 +262,7 @@ find_init_procfs() (
 	test -h /proc/1/exe || return 1
 
 	# Find init executable
-	init_exe=$(ls -l /proc/1/exe 2>/dev/null)
+	init_exe=$(ls -l /proc/1/exe 2>/dev/null) || return 1
 	init_exe=${init_exe#* -> }
 
 	if ! test -x "$init_exe"
@@ -171,21 +270,100 @@ find_init_procfs() (
 		# On some rare occasions it can happen that the
 		# running init's binary has been replaced. In this
 		# case Linux adjusts the symlink to "X (deleted)"
-		case $init_exe
-		in
-			*' (deleted)')
-				init_exe=${init_exe% (deleted)}
-				test -x "$init_exe" || exit 1
-				;;
-			*)
-				exit 1
-				;;
-		esac
+
+		# [root@fedora-12 ~]# readlink /proc/1/exe
+		# /sbin/init (deleted)
+		# [root@fedora-12 ~]# ls -l /proc/1/exe
+		# lrwxrwxrwx. 1 root root 0 2020-01-30 23:00 /proc/1/exe -> /sbin/init (deleted)
+
+		init_exe=${init_exe% (deleted)}
+		test -x "$init_exe" || return 1
 	fi
 
 	echo "${init_exe}"
 )
 
+guess_by_path() {
+	case $1
+	in
+		/bin/busybox)
+			check_busybox_init "$1" && return
+			;;
+		/lib/systemd/systemd)
+			check_systemd "$1" && return
+			;;
+		/hurd/init)
+			check_hurd_init "$1" && return
+			;;
+		/sbin/launchd)
+			check_launchd "$1" && return
+			;;
+		/usr/bin/runit|/sbin/runit)
+			check_runit "$1" && return
+			;;
+		/sbin/openrc-init)
+			if check_openrc "$1" >/dev/null
+			then
+				echo openrc-init
+				return
+			fi
+			;;
+		/sbin/procd)
+			check_procd && return
+			;;
+		/sbin/init|*/init)
+			# init: it could be anything -> (explicit) no match
+			return 1
+			;;
+	esac
+
+	# No match
+	return 1
+}
+
+guess_by_comm_name() {
+	case $1
+	in
+		busybox)
+			check_busybox_init && return
+			;;
+		openrc-init)
+			if check_openrc >/dev/null
+			then
+				echo openrc-init
+				return 0
+			fi
+			;;
+		init)
+			# init could be anything -> no match
+			return 1
+			;;
+		*)
+			# Run check function by comm name if available.
+			# Fall back to comm name if either it does not exist or
+			# returns non-zero.
+			if type "check_$1" >/dev/null
+			then
+				"check_$1" && return
+			else
+				echo "$1" ; return 0
+			fi
+	esac
+
+	return 1
+}
+
+check_list() (
+	# List must be a multi-line input on stdin (one name per line)
+	while read init
+	do
+		"check_${init}" || continue
+		return 0
+	done
+	return 1
+)
+
+
 # BusyBox's versions of ps and pgrep do not support some options
 # depending on which compile-time options have been used.
 
@@ -194,25 +372,31 @@ find_init_pgrep() {
 }
 
 find_init_ps() {
-	case $(uname -s)
+	case $KERNEL_NAME
 	in
-		Darwin|NetBSD)
-			ps -o ucomm= -p 1 2>/dev/null
+		Darwin)
+			ps -o command -p 1 2>/dev/null | tail -n +2
 			;;
 		FreeBSD)
-			ps -o command= -p 1 2>/dev/null | cut -d ' ' -f 1
+			ps -o args= -p 1 2>/dev/null | cut -d ' ' -f 1
 			;;
-		OpenBSD)
-			ps -o command -p 1 2>/dev/null | tail -n +2 | cut -d ' ' -f 1
-			;;
-		*)
+		Linux)
 			ps -o comm= -p 1 2>/dev/null
 			;;
-	esac
+		NetBSD)
+			ps -o comm= -p 1 2>/dev/null
+			;;
+		OpenBSD)
+			ps -o args -p 1 2>/dev/null | tail -n +2 | cut -d ' ' -f 1
+			;;
+		*)
+			ps -o args= -p 1 2>/dev/null
+			;;
+	esac | trim  # trim trailing whitespace (some ps like Darwin add it)
 }
 
 find_init() {
-	case $(uname -s)
+	case $KERNEL_NAME
 	in
 		Linux|GNU|NetBSD)
 			find_init_procfs || find_init_pgrep || find_init_ps
@@ -233,65 +417,23 @@ find_init() {
 	esac
 }
 
-validate_by_comm_name() {
-	case $1
-	in
-		busybox)
-			validate_busybox_init
-			;;
-		init)
-			# FIXME: Do some more magic here!
-			echo init
-			;;
-		openrc-init)
-			validate_openrc >/dev/null && echo openrc-init
-			;;
-		runit)
-			validate_runit
-			;;
-		systemd)
-			validate_systemd
-			;;
-		*)
-			# Run validate function by comm name if available.
-			# Fall back to comm name if either it does not exist or
-			# returns non-zero.
-			type "validate_$1" >/dev/null && "validate_$1" || echo $1
-	esac
-}
-
-try_all() {
-	# init: it could be anything...
-	# We try some approaches to gather more information about init without
-	# calling it! On some init systemd this triggers a reinitialisation of
-	# the system which we don't want (e.g. embedded systems).
-
-	validate_sysvinit || \
-	validate_openrc || \
-	validate_runit || \
-	validate_smf || \
-	validate_upstart || \
-	validate_hurd_init || \
-	echo init  # fallback
-}
+# -----
 
 init=$(find_init)
 
-if test -x "${init}"
-then
-	case $init
-	in
-		/hurd/init)
-			# FIXME: Create validate function
-			echo hurd-init
-			;;
-		*/init)
-			try_all
-			;;
-		*)
-			validate_by_comm_name "$(basename "${init}")"
-			;;
-	esac
-else
-	validate_by_comm_name "${init}"
-fi
+# If we got a path, guess by the path first (fall back to file name if no match)
+# else guess by file name directly.
+{
+	test -x "${init}" \
+		&& guess_by_path "${init}" \
+		|| guess_by_comm_name "$(basename "${init}")"
+} && exit 0 || true
+
+
+# Guessing based on the file path and name didn’t lead to a definitive result.
+#
+# We go through all of the checks until we find a match. To speed up the
+# process, common cases will be checked first based on the underlying kernel.
+
+{ common_candidates_by_kernel; echo "${KNOWN_INIT_SYSTEMS}"; } \
+	| unique | check_list

From 0d84c91b4047d3da0571d0262b4b5d9a8f9796b9 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 20 Feb 2020 22:55:46 +0100
Subject: [PATCH 331/383] [explorer/init] Fix unique() for Solaris

---
 cdist/conf/explorer/init | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index db417a14..0f04a0ee 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -135,7 +135,8 @@ trim() {
 
 unique() {
 	# Delete duplicate lines (keeping input order)
-	awk '!x[$0]++'
+	# NOTE: Solaris AWK breaks without if/print construct.
+	awk '{ if (!x[$0]++) print }'
 }
 
 

From 0d6bc8e8f8166a3f61dd4da4a0e499499d3702c4 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Thu, 20 Feb 2020 23:29:21 +0100
Subject: [PATCH 332/383] [explorer/init] Make shellcheck happy

---
 cdist/conf/explorer/init | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index 0f04a0ee..1b921c68 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -310,7 +310,7 @@ guess_by_path() {
 			fi
 			;;
 		/sbin/procd)
-			check_procd && return
+			check_procd "$1" && return
 			;;
 		/sbin/init|*/init)
 			# init: it could be anything -> (explicit) no match
@@ -356,7 +356,7 @@ guess_by_comm_name() {
 
 check_list() (
 	# List must be a multi-line input on stdin (one name per line)
-	while read init
+	while read -r init
 	do
 		"check_${init}" || continue
 		return 0
@@ -408,7 +408,7 @@ find_init() {
 		OpenBSD)
 			find_init_pgrep || find_init_ps
 			;;
-		Darwin|FreeBSD|SunOS)
+		Darwin|SunOS)
 			find_init_ps
 			;;
 		*)
@@ -424,6 +424,7 @@ init=$(find_init)
 
 # If we got a path, guess by the path first (fall back to file name if no match)
 # else guess by file name directly.
+# shellcheck disable=SC2015
 {
 	test -x "${init}" \
 		&& guess_by_path "${init}" \

From 49fc21ec47d665155edac73bdbae4fed9258f382 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 23 Feb 2020 09:32:03 +0100
Subject: [PATCH 333/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index b0ebf789..8463bb89 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -4,6 +4,9 @@ Changelog
 next:
 	* Type __update_alternatives: Add state explorer (Ander Punnar)
 	* Explorer os_version: Add support for Alpine Linux (Jin-Guk Kwon)
+	* Explorer init: Rewrite and support more init systems (Dennis Camera)
+	* New type: __service (Timothée Floure)
+	* Types __consul_*: Add optional parameter for using distribution packages (Timothée Floure)
 
 6.5.1: 2020-02-15
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)

From c6aba8d189c2efc7c88f9c595acba7ceae5a4e00 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 23 Feb 2020 22:59:41 +0100
Subject: [PATCH 334/383] [explorer/disks] Fix for NetBSD

When connecting over SSH and running /bin/sh, the PATH is missing sbin locations.
sysctl is located at /sbin/sysctl on NetBSD.
---
 cdist/conf/explorer/disks | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/cdist/conf/explorer/disks b/cdist/conf/explorer/disks
index 87a6b5c6..08290bc7 100755
--- a/cdist/conf/explorer/disks
+++ b/cdist/conf/explorer/disks
@@ -1,14 +1,20 @@
-#!/bin/sh
+#!/bin/sh -e
 
 uname_s="$(uname -s)"
 
-case "${uname_s}" in
+case $uname_s in
     FreeBSD)
         sysctl -n kern.disks
     ;;
-    OpenBSD|NetBSD)
+    OpenBSD)
         sysctl -n hw.disknames | grep -Eo '[lsw]d[0-9]+' | xargs
     ;;
+    NetBSD)
+        PATH="${PATH}:/usr/local/sbin:/usr/sbin:/sbin"
+        sysctl -n hw.disknames \
+        | awk 'BEGIN { RS = " " } /^[lsw]d[0-9]+/' \
+        | xargs
+    ;;
     Linux)
         if command -v lsblk > /dev/null
         then
@@ -23,5 +29,3 @@ case "${uname_s}" in
         printf "Don't know how to list disks for %s operating system, if you can please submit a patch\n" "${uname_s}" >&2
     ;;
 esac
-
-exit 0

From e6f683b88633fa0722b3787e3daa39db640ce0f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Mon, 24 Feb 2020 09:20:49 +0100
Subject: [PATCH 335/383] Add support for alpine (edge) package to
 __consul_agent

---
 cdist/conf/type/__consul_agent/manifest | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index 40667002..0d819d45 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -61,6 +61,17 @@ distribution_setup () {
        user='consul'
        group='consul'
      ;;
+     alpine)
+       # consul is only available starting Alpine 3.12 (= edge during the 3.11 cycle).
+       # See https://pkgs.alpinelinux.org/packages?name=consul&branch=edge
+
+       # Override previously defined environment to match alpine packaging.
+       conf_dir='/etc/consul'
+       conf_file='server.json'
+       data_dir='/var/consul'
+       user='consul'
+       group='consul'
+     ;;
      *)
         echo "Your operating system ($os) is currently not supported with the \
           --use-distribution-package flag (${__type##*/})." >&2

From d3bd2669ec49fb861016e614893dac280ed5fd35 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 23 Feb 2020 23:07:40 +0100
Subject: [PATCH 336/383] [explorer/disks] Support Linux without lsblk
 (fallback to sysfs)

---
 cdist/conf/explorer/disks | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/explorer/disks b/cdist/conf/explorer/disks
index 08290bc7..0fabc95f 100755
--- a/cdist/conf/explorer/disks
+++ b/cdist/conf/explorer/disks
@@ -16,16 +16,33 @@ case $uname_s in
         | xargs
     ;;
     Linux)
-        if command -v lsblk > /dev/null
+        # list of major device numbers toexclude:
+        #  ram disks, floppies, cdroms
+        # https://www.kernel.org/doc/Documentation/admin-guide/devices.txt
+        ign_majors='1 2 11'
+
+        if command -v lsblk >/dev/null 2>&1
         then
-            # exclude ram disks, floppies and cdroms
-            # https://www.kernel.org/doc/Documentation/admin-guide/devices.txt
-            lsblk -e 1,2,11 -dno name | xargs
+            lsblk -e "$(echo "$ign_majors" | tr ' ' ',')" -dno name | xargs
+        elif test -d /sys/block/
+        then
+            # shellcheck disable=SC2012
+            ls -1 /sys/block/ \
+            | awk -v ign_majors="$(echo "$ign_majors" | tr ' ' '|')" '
+                {
+                  devfile = "/sys/block/" $0 "/dev"
+                  getline devno < devfile
+                  close(devfile)
+                  if (devno !~ "^(" ign_majors "):") print
+                }' \
+            | xargs
         else
-            printf "Don't know how to list disks for %s operating system without lsblk, if you can please submit a patch\n" "${uname_s}" >&2
+            echo "Don't know how to list disks on Linux without lsblk and sysfs." >&2
+            echo 'If you can, please submit a patch.'>&2
         fi
     ;;
     *)
-        printf "Don't know how to list disks for %s operating system, if you can please submit a patch\n" "${uname_s}" >&2
+        printf "Don't know how to list disks for %s operating system.\n" "${uname_s}" >&2
+        printf 'If you can please submit a patch\n' >&2
     ;;
 esac

From 1ef126e16f95e822562978abd895a3c036f7d5c4 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 23 Feb 2020 23:08:40 +0100
Subject: [PATCH 337/383] [explorer/disks] Move xargs call to the bottom

---
 cdist/conf/explorer/disks | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/cdist/conf/explorer/disks b/cdist/conf/explorer/disks
index 0fabc95f..ed1afce4 100755
--- a/cdist/conf/explorer/disks
+++ b/cdist/conf/explorer/disks
@@ -7,13 +7,12 @@ case $uname_s in
         sysctl -n kern.disks
     ;;
     OpenBSD)
-        sysctl -n hw.disknames | grep -Eo '[lsw]d[0-9]+' | xargs
+        sysctl -n hw.disknames | grep -Eo '[lsw]d[0-9]+'
     ;;
     NetBSD)
         PATH="${PATH}:/usr/local/sbin:/usr/sbin:/sbin"
         sysctl -n hw.disknames \
-        | awk 'BEGIN { RS = " " } /^[lsw]d[0-9]+/' \
-        | xargs
+        | awk 'BEGIN { RS = " " } /^[lsw]d[0-9]+/'
     ;;
     Linux)
         # list of major device numbers toexclude:
@@ -23,7 +22,7 @@ case $uname_s in
 
         if command -v lsblk >/dev/null 2>&1
         then
-            lsblk -e "$(echo "$ign_majors" | tr ' ' ',')" -dno name | xargs
+            lsblk -e "$(echo "$ign_majors" | tr ' ' ',')" -dno name
         elif test -d /sys/block/
         then
             # shellcheck disable=SC2012
@@ -34,8 +33,7 @@ case $uname_s in
                   getline devno < devfile
                   close(devfile)
                   if (devno !~ "^(" ign_majors "):") print
-                }' \
-            | xargs
+                }'
         else
             echo "Don't know how to list disks on Linux without lsblk and sysfs." >&2
             echo 'If you can, please submit a patch.'>&2
@@ -45,4 +43,5 @@ case $uname_s in
         printf "Don't know how to list disks for %s operating system.\n" "${uname_s}" >&2
         printf 'If you can please submit a patch\n' >&2
     ;;
-esac
+esac \
+| xargs

From 6db6dc4ac0950579ce13252dcca6d0f61f5533c6 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Sun, 23 Feb 2020 23:14:14 +0100
Subject: [PATCH 338/383] [explorer/disks] Add license header

---
 cdist/conf/explorer/disks | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/cdist/conf/explorer/disks b/cdist/conf/explorer/disks
index ed1afce4..24540601 100755
--- a/cdist/conf/explorer/disks
+++ b/cdist/conf/explorer/disks
@@ -1,4 +1,24 @@
 #!/bin/sh -e
+#
+# based on previous work by other people, modified by:
+# 2020 Dennis Camera <dennis.camera at ssrq-sds-fds.ch>
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+# Finds disks of the system (excl. ram disks, floppy, cdrom)
 
 uname_s="$(uname -s)"
 

From b2db864eaf95a50e7e0d31be52f86ab1d0bea480 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 26 Feb 2020 13:01:29 +0100
Subject: [PATCH 339/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 8463bb89..35590655 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -7,6 +7,7 @@ next:
 	* Explorer init: Rewrite and support more init systems (Dennis Camera)
 	* New type: __service (Timothée Floure)
 	* Types __consul_*: Add optional parameter for using distribution packages (Timothée Floure)
+	* Explorer disks: Fix NetBSD, support Linux w/o lsblk (Dennis Camera)
 
 6.5.1: 2020-02-15
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)

From 6b4b6534a1187e2533f627ff485873aeac7c4a32 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 26 Feb 2020 16:12:21 +0100
Subject: [PATCH 340/383] [__directory] Give more precise error message when
 --state pre-exists

---
 cdist/conf/type/__directory/gencode-remote | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/cdist/conf/type/__directory/gencode-remote b/cdist/conf/type/__directory/gencode-remote
index e1ab69d7..a1a32ea2 100755
--- a/cdist/conf/type/__directory/gencode-remote
+++ b/cdist/conf/type/__directory/gencode-remote
@@ -109,10 +109,24 @@ case "$state_should" in
       done
    ;;
    pre-exists)
-      if [ "$type" != "directory" ]; then
-         echo "Directory \"$destination\" does not exist" >&2
-         exit 1
-      fi
+      case $type in
+         directory)
+            # all good
+            exit 0
+         ;;
+         none)
+            printf 'Directory "%s" does not exist\n' "$destination" >&2
+            exit 1
+         ;;
+         file|symlink)
+            printf 'File "%s" exists and is a %s, but should be a directory\n' "$destination" "$type" >&2
+            exit 1
+         ;;
+         *)
+            printf 'File or directory "%s" is in an unknown state\n' "$destination" >&2
+            exit 1
+         ;;
+      esac
    ;;
    absent)
         if [ "$type" = "directory" ]; then

From 046f7d0663fb6e117f76747bf71c7976abc90962 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 26 Feb 2020 16:32:03 +0100
Subject: [PATCH 341/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 35590655..4fdfcd68 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -8,6 +8,7 @@ next:
 	* New type: __service (Timothée Floure)
 	* Types __consul_*: Add optional parameter for using distribution packages (Timothée Floure)
 	* Explorer disks: Fix NetBSD, support Linux w/o lsblk (Dennis Camera)
+	* Type __directory: Add 'exists' and 'pre-exists' states (Dennis Camera)
 
 6.5.1: 2020-02-15
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)

From 46d2487f08e04d3f6f3cbd434404dda006e83276 Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 26 Feb 2020 16:40:53 +0100
Subject: [PATCH 342/383] [__file] Give more precise error message when --state
 pre-exists

---
 cdist/conf/type/__file/gencode-local | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/type/__file/gencode-local b/cdist/conf/type/__file/gencode-local
index fb9f9a92..231b6927 100755
--- a/cdist/conf/type/__file/gencode-local
+++ b/cdist/conf/type/__file/gencode-local
@@ -31,12 +31,24 @@ if [ "$state_should" = "pre-exists" ]; then
       exit 1
    fi
 
-   if [ "$type" = "file" ]; then
-      exit 0 # nothing to do
-   else
-      echo "File \"$destination\" does not exist"
-      exit 1
-   fi
+   case $type in
+      file)
+         # nothing to do
+         exit 0
+      ;;
+      none)
+         printf 'File "%s" does not exist\n' "$destination" >&2
+         exit 1
+      ;;
+      directory|symlink)
+         printf 'File "%s" exists and is a %s, but should be a regular file\n' "$destination" "$type" >&2
+         exit 1
+      ;;
+      *)
+         printf 'File or directory "%s" is in an unknown state\n' "$destination" >&2
+         exit 1
+      ;;
+   esac
 fi
 
 upload_file=

From 9eacba06bb218bd0627ef633b363495331ac6c5b Mon Sep 17 00:00:00 2001
From: Dennis Camera <dennis.camera@ssrq-sds-fds.ch>
Date: Wed, 26 Feb 2020 16:48:14 +0100
Subject: [PATCH 343/383] [__file] Treat pre-exists as a special case in
 gencode-remote as it should never get there

---
 cdist/conf/type/__file/gencode-remote | 56 ++++++++++++++-------------
 1 file changed, 30 insertions(+), 26 deletions(-)

diff --git a/cdist/conf/type/__file/gencode-remote b/cdist/conf/type/__file/gencode-remote
index b04c471e..815593bd 100755
--- a/cdist/conf/type/__file/gencode-remote
+++ b/cdist/conf/type/__file/gencode-remote
@@ -55,37 +55,41 @@ set_owner() {
 }
 
 set_mode() {
-   echo "chmod '$1' '$destination'"
-   echo "chmod '$1'" >> "$__messages_out"
-   fire_onchange=1
+    echo "chmod '$1' '$destination'"
+    echo "chmod '$1'" >> "$__messages_out"
+    fire_onchange=1
 }
 
 case "$state_should" in
-    present|exists|pre-exists)
-    # Note: Mode - needs to happen last as a chown/chgrp can alter mode by
-    #  clearing S_ISUID and S_ISGID bits (see chown(2))
-    for attribute in group owner mode; do
-        if [ -f "$__object/parameter/$attribute" ]; then
-            value_should="$(cat "$__object/parameter/$attribute")"
+    present|exists)
+        # Note: Mode - needs to happen last as a chown/chgrp can alter mode by
+        #  clearing S_ISUID and S_ISGID bits (see chown(2))
+        for attribute in group owner mode; do
+            if [ -f "$__object/parameter/$attribute" ]; then
+                value_should="$(cat "$__object/parameter/$attribute")"
 
-            # change 0xxx format to xxx format => same as stat returns
-            if [ "$attribute" = mode ]; then
-                value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')"
-            fi
-            
-            value_is="$(get_current_value "$attribute" "$value_should")"
-            if [ -f "$__object/files/set-attributes" ] || [ "$value_should" != "$value_is" ]; then
-                "set_$attribute" "$value_should"
+                # change 0xxx format to xxx format => same as stat returns
+                if [ "$attribute" = mode ]; then
+                    value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')"
+                fi
+
+                value_is="$(get_current_value "$attribute" "$value_should")"
+                if [ -f "$__object/files/set-attributes" ] || [ "$value_should" != "$value_is" ]; then
+                    "set_$attribute" "$value_should"
+                fi
             fi
+        done
+        if [ -f "$__object/files/set-attributes" ]; then
+            # set-attributes is created if file is created or uploaded in gencode-local
+            fire_onchange=1
         fi
-    done
-    if [ -f "$__object/files/set-attributes" ]; then
-        # set-attributes is created if file is created or uploaded in gencode-local
-        fire_onchange=1
-    fi
-
     ;;
 
+    pre-exists)
+        # pre-exists should never reach gencode-remote…
+        exit 1
+   ;;
+
     absent)
         if [ "$type" = "file" ]; then
             echo "rm -f '$destination'"
@@ -101,7 +105,7 @@ case "$state_should" in
 esac
 
 if [ -f "$__object/parameter/onchange" ]; then
-   if [ -n "$fire_onchange" ]; then
-      cat "$__object/parameter/onchange"
-   fi
+    if [ -n "$fire_onchange" ]; then
+        cat "$__object/parameter/onchange"
+    fi
 fi

From da6ccf808ef4417b90e0882abd042f0a40f28a8e Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 26 Feb 2020 21:48:08 +0100
Subject: [PATCH 344/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 4fdfcd68..9075cf3f 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -9,6 +9,7 @@ next:
 	* Types __consul_*: Add optional parameter for using distribution packages (Timothée Floure)
 	* Explorer disks: Fix NetBSD, support Linux w/o lsblk (Dennis Camera)
 	* Type __directory: Add 'exists' and 'pre-exists' states (Dennis Camera)
+	* Type __file: Improve error messages for pre-exists state (Dennis Camera)
 
 6.5.1: 2020-02-15
 	* Type __consul_agent: Add Debian 10 support (Nico Schottelius)

From 213f1b049c55205ffe233de22e68c4a4738c8b82 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 27 Feb 2020 20:23:04 +0100
Subject: [PATCH 345/383] Release 6.5.2

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 9075cf3f..64b124e8 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.5.2: 2020-02-27
 	* Type __update_alternatives: Add state explorer (Ander Punnar)
 	* Explorer os_version: Add support for Alpine Linux (Jin-Guk Kwon)
 	* Explorer init: Rewrite and support more init systems (Dennis Camera)

From fb32d6ed3f9421d515b0ec2eabe9ab4fcc6ccacb Mon Sep 17 00:00:00 2001
From: llnu <llnu@protonmail.ch>
Date: Sun, 8 Mar 2020 16:04:02 +0100
Subject: [PATCH 346/383] alpine uses a different getent lib which doesnt
 support: getent shadow

---
 cdist/conf/type/__user/explorer/shadow | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__user/explorer/shadow b/cdist/conf/type/__user/explorer/shadow
index 73ce0e29..63d38f0d 100755
--- a/cdist/conf/type/__user/explorer/shadow
+++ b/cdist/conf/type/__user/explorer/shadow
@@ -24,7 +24,7 @@
 name=$__object_id
 
 case $("$__explorer/os") in
-  'freebsd'|'netbsd'|'openbsd')
+  'freebsd'|'netbsd'|'openbsd'|'alpine')
     database='passwd'
     ;;
   # Default to using shadow passwords

From f7d5f5bc974fff858c9999752badce3c6e8ba72e Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Mon, 9 Mar 2020 08:02:18 +0100
Subject: [PATCH 347/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 64b124e8..93df32a2 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Type __user: Fix missing shadow for alpine (llnu)
+
 6.5.2: 2020-02-27
 	* Type __update_alternatives: Add state explorer (Ander Punnar)
 	* Explorer os_version: Add support for Alpine Linux (Jin-Guk Kwon)

From 358e04b2afa380b63843869f1f57967e0ef8de22 Mon Sep 17 00:00:00 2001
From: Matthias Stecher <matthiasstecher@gmx.de>
Date: Sat, 14 Mar 2020 09:58:38 +0100
Subject: [PATCH 348/383] Handle specially if no time about the last index
 update found.

The explorer 'currage' now returns -1 if he can not find any value about
this. The gencode-remote script handle this value special to not exit if
-1 given as value.

This fixes the bug
  https://code.ungleich.ch/ungleich-public/cdist/issues/803
---
 cdist/conf/type/__package_update_index/explorer/currage | 6 +++---
 cdist/conf/type/__package_update_index/gencode-remote   | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/cdist/conf/type/__package_update_index/explorer/currage b/cdist/conf/type/__package_update_index/explorer/currage
index cfb778d5..bd51ee86 100644
--- a/cdist/conf/type/__package_update_index/explorer/currage
+++ b/cdist/conf/type/__package_update_index/explorer/currage
@@ -24,18 +24,18 @@ case "$type" in
         if [ -f "/var/cache/apt/pkgcache.bin" ]; then
             echo $(($(date +"%s")-$(stat --format '%Y' /var/cache/apt/pkgcache.bin)))
         else
-            echo 0
+            echo -1
         fi
         ;;
     pacman)
         if [ -d "/var/lib/pacman/sync" ]; then
             echo $(($(date +"%s")-$(stat --format '%Y' /var/lib/pacman/sync)))
         else
-            echo 0
+            echo -1
         fi
         ;;
     alpine)
-        echo 0
+        echo -1
         ;;
     *)  echo "Your specified type ($type) is currently not supported." >&2
         echo "Please contribute an implementation for it if you can." >&2
diff --git a/cdist/conf/type/__package_update_index/gencode-remote b/cdist/conf/type/__package_update_index/gencode-remote
index 6c51cbed..803468b5 100755
--- a/cdist/conf/type/__package_update_index/gencode-remote
+++ b/cdist/conf/type/__package_update_index/gencode-remote
@@ -31,7 +31,8 @@ if [ -n "$maxage" ]; then
     if [ "$type" != "apt" ] && [ "$type" != "pacman" ]; then
         echo "ERROR: \"--maxage\" only supported for \"apt\" or \"pacman\" pkg-manager." >&2
         exit 1
-    elif [ "$currage" -lt "$maxage" ]; then
+    # do not exit if no value found (represented as -1)
+    elif [ "$currage" -ne -1 ] && [ "$currage" -lt "$maxage" ]; then
         exit 0 # no need to update
     fi
 fi

From 1bd19d6dee1799e0ed472941a6ff3f47dc01e4d6 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Mon, 23 Mar 2020 12:26:59 +0100
Subject: [PATCH 349/383] [__letsencrypt_acmetiny] Simpler alternative to
 certbot.

This is inspired heavily by `debops.pki` in the https://debops.org project.
However there are several simplifications to their way of doing it.
---
 .../__letsencrypt_acmetiny/gencode-remote     | 109 ++++++++++
 .../conf/type/__letsencrypt_acmetiny/manifest |   1 +
 .../type/__letsencrypt_acmetiny/nonparallel   |   0
 .../parameter/optional_multiple               |   1 +
 .../gencode-remote                            |  12 ++
 .../type/__letsencrypt_acmetiny_base/manifest | 202 ++++++++++++++++++
 .../parameter/optional                        |   1 +
 .../__letsencrypt_acmetiny_base/singleton     |   0
 8 files changed, 326 insertions(+)
 create mode 100644 cdist/conf/type/__letsencrypt_acmetiny/gencode-remote
 create mode 100644 cdist/conf/type/__letsencrypt_acmetiny/manifest
 create mode 100644 cdist/conf/type/__letsencrypt_acmetiny/nonparallel
 create mode 100644 cdist/conf/type/__letsencrypt_acmetiny/parameter/optional_multiple
 create mode 100644 cdist/conf/type/__letsencrypt_acmetiny_base/gencode-remote
 create mode 100644 cdist/conf/type/__letsencrypt_acmetiny_base/manifest
 create mode 100644 cdist/conf/type/__letsencrypt_acmetiny_base/parameter/optional
 create mode 100644 cdist/conf/type/__letsencrypt_acmetiny_base/singleton

diff --git a/cdist/conf/type/__letsencrypt_acmetiny/gencode-remote b/cdist/conf/type/__letsencrypt_acmetiny/gencode-remote
new file mode 100644
index 00000000..466b889d
--- /dev/null
+++ b/cdist/conf/type/__letsencrypt_acmetiny/gencode-remote
@@ -0,0 +1,109 @@
+#!/bin/sh -e
+
+ACME_TINY_CERT_REQUEST_DIR="/var/acme-tiny/cert-requests"
+ACME_TINY_ACCOUNT_KEY="/var/acme-tiny/account.key"
+ACME_CHALLENGE_DIR="/srv/www/sites/acme/public/.well-known/acme-challenge"
+
+REALM="${__object_id}"
+EXTRA_DOMAINS=""
+if [ -f "${__object}/parameter/extra-domain" ]; then
+  EXTRA_DOMAINS="$(cat "${__object}/parameter/extra-domain")"
+fi
+
+#TODO: support linux too
+REALM_DIR="/usr/local/etc/pki/realms/${REALM}"
+REALM_CERT="${REALM_DIR}/default.crt"
+REALM_KEY="${REALM_DIR}/default.key"
+REALM_CERT_REQUEST="${ACME_TINY_CERT_REQUEST_DIR}/${REALM}.csr"
+REALM_CERT_REQUEST_CNF="${ACME_TINY_CERT_REQUEST_DIR}/${REALM}.cnf"
+
+CSR_ALT_NAMES=""
+REALM_CERT_REQUEST_CNF_LINE=""
+if [ -n "${EXTRA_DOMAINS}" ]; then
+  CSR_ALT_NAMES="DNS:${REALM}"
+  for domain in ${EXTRA_DOMAINS}; do
+    CSR_ALT_NAMES="${CSR_ALT_NAMES},DNS:${domain}"
+  done
+  # CSR requests are executed always against .new, only after succeeding .new replaces the .cnf
+  REALM_CERT_REQUEST_CNF_LINE="-reqexts SAN -config '${REALM_CERT_REQUEST_CNF}.new'"
+fi
+
+cat << EOF
+if [ ! -d '${REALM_DIR}' ]; then
+  mkdir -p '${REALM_DIR}'
+fi
+if [ ! -f '${REALM_KEY}' ]; then
+  openssl genrsa 4096 > '${REALM_KEY}'
+fi
+
+if [ ! -d '${ACME_TINY_CERT_REQUEST_DIR}' ]; then
+  mkdir '${ACME_TINY_CERT_REQUEST_DIR}'
+fi
+
+FORCE_CSR_REGEN=""
+if [ -n '${CSR_ALT_NAMES}' ]; then
+  # Generate new config
+  cat /etc/ssl/openssl.cnf > '${REALM_CERT_REQUEST_CNF}.new'
+  printf '[SAN]\nsubjectAltName=${CSR_ALT_NAMES}' >> '${REALM_CERT_REQUEST_CNF}.new'
+  # Compare to previous config if necessary
+  if [ -f '${REALM_CERT_REQUEST_CNF}' ]; then
+    CNF_DIFF=\$(diff -q '${REALM_CERT_REQUEST_CNF}' '${REALM_CERT_REQUEST_CNF}.new' || true)
+    if [ -n "\${CNF_DIFF}" ]; then
+      # Options have changed
+      FORCE_CSR_REGEN="YES"
+    else
+      # Since they match, we won't be using this, clean it
+      rm '${REALM_CERT_REQUEST_CNF}.new'
+    fi
+  else
+    # We never used SAN here, CSR regen needed.
+    FORCE_CSR_REGEN="YES"
+  fi
+else
+  # We used SAN at some point, not any more
+  if [ -f '${REALM_CERT_REQUEST_CNF}' ]; then
+    rm '${REALM_CERT_REQUEST_CNF}'
+    FORCE_CSR_REGEN="YES"
+  fi
+fi
+
+# Create or re-create when params have changed
+if [ ! -f '${REALM_CERT_REQUEST}' -o -n "\${FORCE_CSR_REGEN}" ]; then
+  openssl req -new -sha256 -key '${REALM_KEY}' -subj '/CN=${REALM}' -out '${REALM_CERT_REQUEST}' ${REALM_CERT_REQUEST_CNF_LINE}
+fi
+
+# Check if cert exists, and if so whether or not it's older than a month
+if [ -f '${REALM_CERT}' ]; then
+  MODIFIED_IN_30d="\$(find '${REALM_CERT}' -mtime -30d)"
+  if [ -z "\${MODIFIED_IN_30d}" ]; then
+    # Cert is over a month old, it's fine to regenerate
+    FORCE_CRT_REGEN="YES"
+  fi
+else
+  # This cert doesn't exist
+  FORCE_CRT_REGEN="YES"
+fi
+
+
+# Only request certificate when needed
+# TODO: support linux too
+if [ -n "\${FORCE_CSR_REGEN}" -o -n "\${FORCE_CRT_REGEN}" ]; then
+  doas -u acme-tiny -- acme_tiny \
+    --account '${ACME_TINY_ACCOUNT_KEY}' \
+    --csr '${REALM_CERT_REQUEST}' \
+    --acme-dir '${ACME_CHALLENGE_DIR}' > '${REALM_CERT}.new'
+
+  if [ -s '${REALM_CERT}.new' ]; then
+    mv '${REALM_CERT}.new' '${REALM_CERT}'
+  else
+    echo "Failed to generate cert for realm '${REALM}'."
+    exit 1
+  fi
+fi
+
+if [ -n '${REALM_CERT_REQUEST_CNF_LINE}' -a -f '${REALM_CERT_REQUEST_CNF}.new' ]; then
+  # CSR and cert generation succeded with a new config, put new config in-place.
+  # This is the last thing we do, so we try again next time if sth fails.
+  mv '${REALM_CERT_REQUEST_CNF}.new' '${REALM_CERT_REQUEST_CNF}'
+fi
+EOF
diff --git a/cdist/conf/type/__letsencrypt_acmetiny/manifest b/cdist/conf/type/__letsencrypt_acmetiny/manifest
new file mode 100644
index 00000000..48438abb
--- /dev/null
+++ b/cdist/conf/type/__letsencrypt_acmetiny/manifest
@@ -0,0 +1 @@
+#__letsencrypt_acmetiny_base
diff --git a/cdist/conf/type/__letsencrypt_acmetiny/nonparallel b/cdist/conf/type/__letsencrypt_acmetiny/nonparallel
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/conf/type/__letsencrypt_acmetiny/parameter/optional_multiple b/cdist/conf/type/__letsencrypt_acmetiny/parameter/optional_multiple
new file mode 100644
index 00000000..7bfb11da
--- /dev/null
+++ b/cdist/conf/type/__letsencrypt_acmetiny/parameter/optional_multiple
@@ -0,0 +1 @@
+extra-domain
diff --git a/cdist/conf/type/__letsencrypt_acmetiny_base/gencode-remote b/cdist/conf/type/__letsencrypt_acmetiny_base/gencode-remote
new file mode 100644
index 00000000..1e4174a4
--- /dev/null
+++ b/cdist/conf/type/__letsencrypt_acmetiny_base/gencode-remote
@@ -0,0 +1,12 @@
+#!/bin/sh -e
+
+ACME_HOME="/var/acme-tiny"
+ACME_ACCOUNT_KEY="${ACME_HOME}/account.key"
+
+cat << EOF
+if [ ! -f '${ACME_ACCOUNT_KEY}' ]; then
+  openssl genrsa 4096 > '${ACME_ACCOUNT_KEY}'
+  chown acme-tiny:acme-tiny '${ACME_ACCOUNT_KEY}'
+  chmod 640 '${ACME_ACCOUNT_KEY}'
+fi
+EOF
diff --git a/cdist/conf/type/__letsencrypt_acmetiny_base/manifest b/cdist/conf/type/__letsencrypt_acmetiny_base/manifest
new file mode 100644
index 00000000..fd6961fa
--- /dev/null
+++ b/cdist/conf/type/__letsencrypt_acmetiny_base/manifest
@@ -0,0 +1,202 @@
+# Arguments
+ACME_DOMAIN="$(cat $__object/parameter/acme_domain || true)"
+
+if [ -z "${ACME_DOMAIN}" ]; then
+  ACME_DOMAIN="${__target_host}"
+fi
+
+
+# Install needed stuffz
+
+## TODO: consider not depending on nginx? It is... practical though.
+## TODO: Maybe just move this out to a sepecial type?
+__package "nginx"
+
+NGINX_ETC="/usr/local/etc/nginx"
+
+# Setup the acme-challenge snippet
+require="__package/nginx" __directory "${NGINX_ETC}/snippets" --state present
+require="__directory${NGINX_ETC}/snippets" __file "${NGINX_ETC}/snippets/acme-challenge.conf" \
+  --mode 644 \
+  --source - << EOF
+# This file is managed remotely, all changes will be lost
+
+# This was heavily inspired by debops.org.
+
+# Automatic Certificate Management Environment (ACME) support.
+# https://tools.ietf.org/html/draft-ietf-acme-acme-01
+# https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment
+
+
+# Return the ACME challenge present in the server public root.
+# If not found, switch to global web server root.
+location ^~ /.well-known/acme-challenge/ {
+        default_type "text/plain";
+        try_files \$uri @well-known-acme-challenge;
+}
+
+# Return the ACME challenge present in the global server public root.
+# If not present, redirect request to a specified domain.
+location @well-known-acme-challenge {
+        root /srv/www/sites/acme/public;
+        default_type "text/plain";
+        try_files \$uri @redirect-acme-challenge;
+}
+
+# Redirect the ACME challenge to a different host. If a redirect loop is
+# detected, return 404.
+location @redirect-acme-challenge {
+        if (\$arg_redirect) {
+                return 404;
+        }
+        return 307 \$scheme://${ACME_DOMAIN}\$request_uri?redirect=yes;
+}
+
+# Return 404 if ACME challenge well known path is accessed directly.
+location = /.well-known/acme-challenge/ {
+    return 404;
+}
+EOF
+
+require="__package/nginx" __directory "${NGINX_ETC}/sites-enabled" --state present
+require="__directory${NGINX_ETC}/sites-enabled" __file "${NGINX_ETC}/nginx.conf" \
+  --mode 644 \
+  --source - << EOF
+# This file is managed remotely, all changes will be lost
+
+worker_processes  1;
+
+# This default error log path is compiled-in to make sure configuration parsing
+# errors are logged somewhere, especially during unattended boot when stderr
+# isn't normally logged anywhere. This path will be touched on every nginx
+# start regardless of error log location configured here. See
+# https://trac.nginx.org/nginx/ticket/147 for more info. 
+#
+#error_log  /var/log/nginx/error.log;
+#
+
+#pid        logs/nginx.pid;
+
+
+events {
+        worker_connections  1024;
+}
+
+
+http {
+
+        include       mime.types;
+        default_type  application/octet-stream;
+
+        server_tokens off;
+
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout 5m;
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        types_hash_max_size 2048;
+        gzip on;
+        gzip_disable "msie6";
+        gzip_comp_level    5;
+        gzip_min_length    256;
+        gzip_proxied       any;
+        gzip_vary          on;
+        gzip_types
+          application/atom+xml
+          application/javascript
+          application/json
+          application/ld+json
+          application/manifest+json
+          application/rss+xml
+          application/vnd.geo+json
+          application/vnd.ms-fontobject
+          application/x-font-ttf
+          application/x-web-app-manifest+json
+          application/xhtml+xml
+          application/xml
+          font/opentype
+          image/bmp
+          image/svg+xml
+          image/x-icon
+          text/cache-manifest
+          text/css
+          text/plain
+          text/vcard
+          text/vnd.rim.location.xloc
+          text/vtt
+          text/x-component
+          text/x-cross-domain-policy;
+
+        # Logging
+        access_log /var/log/nginx/access.log;
+        error_log  /var/log/nginx/error.log;
+
+        #add_header X-Clacks-Overhead "GNU Terry Pratchett";
+
+        # Virtual Hosts Configs
+        include ${NGINX_ETC}/sites-enabled/*.conf;
+}
+EOF
+
+require="__directory${NGINX_ETC}/sites-enabled" __file "${NGINX_ETC}/sites-enabled/welcome.conf" \
+  --mode 644 \
+  --source - << EOF
+# This file is managed remotely, all changes will be lost
+
+# nginx server configuration for:
+#    - https://welcome/
+
+server {
+
+        listen [::]:80;
+
+        server_name welcome;
+
+        root /srv/www/sites/welcome/public;
+
+        include snippets/acme-challenge.conf;
+
+        location / {
+                return 301 https://$host$request_uri;
+        }
+}
+EOF
+
+## TODO: this is kinda bad, don't restart every time.
+##       Otherwise this isn't idempotent.
+require="__package/nginx" __service nginx --action onerestart
+require="__package/nginx" __start_on_boot nginx
+
+
+__package "acme-tiny"
+
+# Create acme-tiny user and secure home dir
+ACME_TINY_HOME="/var/acme-tiny"
+require="__package/acme-tiny" __user acme-tiny --system --home ${ACME_TINY_HOME} --comment "acme-tiny client"
+require="__user/acme-tiny" __directory "${ACME_TINY_HOME}" --state present --mode 0750 --owner acme-tiny --group acme-tiny
+
+# Create ACME challenge dirs to be served by nginx
+ACME_PUBLIC_DIR="/srv/www/sites/acme/public"
+ACME_WELLKNOWN_DIR="${ACME_PUBLIC_DIR}/.well-known"
+ACME_CHALLENGE_DIR="${ACME_WELLKNOWN_DIR}/acme-challenge"
+__directory "${ACME_PUBLIC_DIR}" \
+  --parents \
+  --state present \
+  --owner acme-tiny --group www \
+  --mode 2750 # TODO: check whether this does require gid?
+require="__directory${ACME_PUBLIC_DIR}" __directory "${ACME_WELLKNOWN_DIR}" \
+  --state present \
+  --owner acme-tiny --group www \
+  --mode 0750
+require="__directory${ACME_WELLKNOWN_DIR}" __directory "${ACME_CHALLENGE_DIR}" \
+  --state present \
+  --owner acme-tiny --group www \
+  --mode 0750
+
+__package doas
+DOAS_CONF="/usr/local/etc/doas.conf"
+require="__package/doas" __file "${DOAS_CONF}" --mode 0640
+require="__file${DOAS_CONF}" __line "${DOAS_CONF}" \
+  --regex 'root as acme-tiny' \
+  --line 'permit nopass root as acme-tiny'
diff --git a/cdist/conf/type/__letsencrypt_acmetiny_base/parameter/optional b/cdist/conf/type/__letsencrypt_acmetiny_base/parameter/optional
new file mode 100644
index 00000000..fb20814d
--- /dev/null
+++ b/cdist/conf/type/__letsencrypt_acmetiny_base/parameter/optional
@@ -0,0 +1 @@
+acme_domain
diff --git a/cdist/conf/type/__letsencrypt_acmetiny_base/singleton b/cdist/conf/type/__letsencrypt_acmetiny_base/singleton
new file mode 100644
index 00000000..e69de29b

From 9fdc9082f4fd48cdc369d7d8b61b7c17912fe31a Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Mon, 23 Mar 2020 12:35:54 +0100
Subject: [PATCH 350/383] [__letsencrypt_acmetiny] fix spellcheck warnings
 (bugs!)

---
 cdist/conf/type/__letsencrypt_acmetiny_base/manifest | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__letsencrypt_acmetiny_base/manifest b/cdist/conf/type/__letsencrypt_acmetiny_base/manifest
index fd6961fa..7bce9a63 100644
--- a/cdist/conf/type/__letsencrypt_acmetiny_base/manifest
+++ b/cdist/conf/type/__letsencrypt_acmetiny_base/manifest
@@ -1,5 +1,5 @@
 # Arguments
-ACME_DOMAIN="$(cat $__object/parameter/acme_domain || true)"
+ACME_DOMAIN="$(cat "${__object}/parameter/acme_domain" || true)"
 
 if [ -z "${ACME_DOMAIN}" ]; then
   ACME_DOMAIN="${__target_host}"
@@ -158,7 +158,7 @@ server {
         include snippets/acme-challenge.conf;
 
         location / {
-                return 301 https://$host$request_uri;
+                return 301 https://\$host\$request_uri;
         }
 }
 EOF

From f00e4af5f0f1f49ab93be001468327ea90df6bd0 Mon Sep 17 00:00:00 2001
From: Andrew Schleifer <me@andrewschleifer.name>
Date: Thu, 26 Mar 2020 21:17:32 +0800
Subject: [PATCH 351/383] fix typo

---
 cdist/conf/type/__letsencrypt_cert/man.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__letsencrypt_cert/man.rst b/cdist/conf/type/__letsencrypt_cert/man.rst
index c4ffc6bc..85eb88ea 100644
--- a/cdist/conf/type/__letsencrypt_cert/man.rst
+++ b/cdist/conf/type/__letsencrypt_cert/man.rst
@@ -59,13 +59,13 @@ MESSAGES
 --------
 
 change
-    Certificte was changed.
+    Certificate was changed.
 
 create
-    Certificte was created.
+    Certificate was created.
 
 remove
-    Certificte was removed.
+    Certificate was removed.
 
 EXAMPLES
 --------

From 66d990502987aae97695a4b8678e7d160f1066f7 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 26 Mar 2020 21:48:17 +0100
Subject: [PATCH 352/383] [__consul_agent] make conf_dir depent on the OS

---
 cdist/conf/type/__consul_agent/manifest | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index 0d819d45..a7fe0bc5 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -1,7 +1,7 @@
 #!/bin/sh -e
 #
 # 2015 Steven Armstrong (steven-cdist at armstrong.cc)
-# 2015-2019 Nico Schottelius (nico-cdist at schottelius.org)
+# 2015-2020 Nico Schottelius (nico-cdist at schottelius.org)
 # 2019 Timothée Floure (timothee.floure at ungleich.ch)
 #
 # This file is part of cdist.
@@ -37,10 +37,22 @@ fi
 # Those are default that might be overriden by os-specific logic.
 
 data_dir="/var/lib/consul"
-conf_dir="/etc/consul/conf.d"
-conf_file="config.json"
+
+
+
 tls_dir="$conf_dir/tls"
 
+case "$os" in
+    alpine)
+        conf_dir="/etc/consul"
+        conf_file="server.json"
+        ;;
+    *)
+        conf_dir="/etc/consul/conf.d"
+        conf_file="config.json"
+        ;;
+esac
+
 ###
 # Sane deployment, based on distribution package when available.
 

From ec11f04ab83504035271483a61549a4e0c51053c Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 26 Mar 2020 21:49:43 +0100
Subject: [PATCH 353/383] ++changes

---
 docs/changelog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index 93df32a2..76f47679 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,8 @@ Changelog
 
 next:
 	* Type __user: Fix missing shadow for alpine (llnu)
+	* Type __consule_agent: Make conf_dir dependent on OS - fixes
+	Alpine (Nico Schottelius)
 
 6.5.2: 2020-02-27
 	* Type __update_alternatives: Add state explorer (Ander Punnar)

From df63cfe0884d460942a34b31d9296a31aa8edb2f Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 27 Mar 2020 08:50:27 +0100
Subject: [PATCH 354/383] ++changelog

---
 docs/changelog | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/changelog b/docs/changelog
index 76f47679..8e51b949 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,8 +3,8 @@ Changelog
 
 next:
 	* Type __user: Fix missing shadow for alpine (llnu)
-	* Type __consule_agent: Make conf_dir dependent on OS - fixes
-	Alpine (Nico Schottelius)
+	* Type __consule_agent: Make conf_dir dependent on OS - fixes Alpine (Nico Schottelius)
+	* Type __letsencrypt_cert: Fix typo (Andrew Schleifer)
 
 6.5.2: 2020-02-27
 	* Type __update_alternatives: Add state explorer (Ander Punnar)

From b25939cdd64fdab7d71ab9285c64ad5bf14797f5 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 27 Mar 2020 13:30:52 +0100
Subject: [PATCH 355/383] Fix shellcheck

---
 cdist/conf/type/__consul_agent/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index a7fe0bc5..7b54529c 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -232,7 +232,7 @@ if [ -f "$__object/parameter/ca-file-source" ] || \
    [ -f "$__object/parameter/cert-file-source" ] || \
    [ -f "$__object/parameter/key-file-source" ]; then
 
-   requires="$config_deployment_requires" __directory $tls_dir \
+   requires="$config_deployment_requires" __directory "$tls_dir" \
      --owner root --group "$group" --mode 750 --state "$state"
 
    # Append to service restart requirements.

From da30afe791e1eca11d68fedc88d7a943ecf089e5 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 29 Mar 2020 12:54:02 +0200
Subject: [PATCH 356/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index 8e51b949..62ef28be 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -5,6 +5,7 @@ next:
 	* Type __user: Fix missing shadow for alpine (llnu)
 	* Type __consule_agent: Make conf_dir dependent on OS - fixes Alpine (Nico Schottelius)
 	* Type __letsencrypt_cert: Fix typo (Andrew Schleifer)
+	* Type __package_update_index: Fix maxage false positives (Matthias Stecher)
 
 6.5.2: 2020-02-27
 	* Type __update_alternatives: Add state explorer (Ander Punnar)

From 0f639a9278e32b395bbc0f20b53b89ce1bb324a8 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 2 Apr 2020 18:14:09 +0200
Subject: [PATCH 357/383] Make __cron nonparallel

It fails due to removal / edit of crontab at the same time

VERBOSE: [18331]: uncloud.ungleich.ch: Running object __cron/pg_dump_cleanup
VERBOSE: [18332]: uncloud.ungleich.ch: Running object __ungleich_packages/server
VERBOSE: [18335]: uncloud.ungleich.ch: Running object __postgres_role/app
INFO: [18335]: uncloud.ungleich.ch: Processing __postgres_role/app
INFO: [18331]: uncloud.ungleich.ch: Processing __cron/pg_dump_cleanup
ERROR: [16451]: uncloud.ungleich.ch: ssh -o User=root -o ControlPath=/tmp/tmp_8eu4oep/s -o ControlMaster=auto -o ControlPersist=2h uncloud.ungleich.ch /bin/sh -c ' export __object=/var/lib/cdist/object/__cron/pg_dumpall_under_day/.cdist-mfd00npk;  export __object_id=pg_dumpall_under_day;/bin/sh -e /var/lib/cdist/object/__cron/pg_dumpall_under_day/.cdist-mfd00npk/code-remote': ['ssh', '-o', 'User=root', '-o', 'ControlPath=/tmp/tmp_8eu4oep/s', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=2h', 'uncloud.ungleich.ch', "/bin/sh -c ' export __object=/var/lib/cdist/object/__cron/pg_dumpall_under_day/.cdist-mfd00npk;  export __object_id=pg_dumpall_under_day;/bin/sh -e /var/lib/cdist/object/__cron/pg_dumpall_under_day/.cdist-mfd00npk/code-remote'"]

Error processing object '__cron/pg_dumpall_under_day'
=====================================================
name: __cron/pg_dumpall_under_day
path: /tmp/tmplaq9cwdh/6318c251013a449595327745daacf3ee/data/object/__cron/pg_dumpall_under_day/.cdist-mfd00npk
source: /tmp/tmplaq9cwdh/6318c251013a449595327745daacf3ee/data/conf/type/__ungleich_postgresql/manifest
type: /home/nico/vcs/cdist/cdist/conf/type/__cron

code-remote:stderr
------------------
crontab: can't move 'postgres.new' to 'postgres': No such file or directory

VERBOSE: [16451]: config: Total processing time for 1 host(s): 13.98031210899353
[18:09] line:~%
---
 cdist/conf/type/__cron/nonparallel | 0
 docs/changelog                     | 1 +
 2 files changed, 1 insertion(+)
 create mode 100644 cdist/conf/type/__cron/nonparallel

diff --git a/cdist/conf/type/__cron/nonparallel b/cdist/conf/type/__cron/nonparallel
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/changelog b/docs/changelog
index 62ef28be..b608b35f 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -2,6 +2,7 @@ Changelog
 ---------
 
 next:
+	* Type __cron: Make non parallel due to race condition (Nico Schottelius)
 	* Type __user: Fix missing shadow for alpine (llnu)
 	* Type __consule_agent: Make conf_dir dependent on OS - fixes Alpine (Nico Schottelius)
 	* Type __letsencrypt_cert: Fix typo (Andrew Schleifer)

From d034fe9369f1f7aa00a7b0136ffd940ecbceb588 Mon Sep 17 00:00:00 2001
From: Nico Schottelius <nico@nico-notebook.schottelius.org>
Date: Thu, 2 Apr 2020 18:24:13 +0200
Subject: [PATCH 358/383] [__pyvenv] use python3 -m venv on alpine

Until python4 comes, this will work
---
 cdist/conf/type/__pyvenv/gencode-remote | 12 +++++++++++-
 docs/changelog                          |  1 +
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__pyvenv/gencode-remote b/cdist/conf/type/__pyvenv/gencode-remote
index 04700683..05ec3b29 100755
--- a/cdist/conf/type/__pyvenv/gencode-remote
+++ b/cdist/conf/type/__pyvenv/gencode-remote
@@ -37,11 +37,21 @@ mode="$(cat "$__object/parameter/mode")"
 destination="/$__object_id"
 venvparams="$(cat "$__object/parameter/venvparams")"
 pyvenvparam="$__object/parameter/pyvenv"
+
+os=$(cat $__global/explorer/os)
+
 if [ -f "$pyvenvparam" ]
 then
     pyvenv=$(cat "$pyvenvparam")
 else
-    pyvenv="pyvenv"
+    case "$os" in
+        alpine) # no pyvenv on alpine - I assume others will follow
+            pyvenv="python3 -m venv"
+            ;;
+        *)
+            pyvenv="pyvenv"
+            ;;
+    esac
 fi
 
 case $state_should in
diff --git a/docs/changelog b/docs/changelog
index b608b35f..f5846925 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Type __cron: Make non parallel due to race condition (Nico Schottelius)
+	* Type __pyvenv: Use python3 -m venv on Alpine (Nico Schottelius)
 	* Type __user: Fix missing shadow for alpine (llnu)
 	* Type __consule_agent: Make conf_dir dependent on OS - fixes Alpine (Nico Schottelius)
 	* Type __letsencrypt_cert: Fix typo (Andrew Schleifer)

From 890c73f6bdd027e60cedd868323f9d0438408b7a Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Thu, 2 Apr 2020 20:18:04 +0200
Subject: [PATCH 359/383] Fix shellcheck issues

---
 cdist/conf/type/__package_update_index/explorer/currage | 6 +++---
 cdist/conf/type/__pyvenv/gencode-remote                 | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cdist/conf/type/__package_update_index/explorer/currage b/cdist/conf/type/__package_update_index/explorer/currage
index bd51ee86..8eadaf53 100644
--- a/cdist/conf/type/__package_update_index/explorer/currage
+++ b/cdist/conf/type/__package_update_index/explorer/currage
@@ -24,18 +24,18 @@ case "$type" in
         if [ -f "/var/cache/apt/pkgcache.bin" ]; then
             echo $(($(date +"%s")-$(stat --format '%Y' /var/cache/apt/pkgcache.bin)))
         else
-            echo -1
+            echo -- -1
         fi
         ;;
     pacman)
         if [ -d "/var/lib/pacman/sync" ]; then
             echo $(($(date +"%s")-$(stat --format '%Y' /var/lib/pacman/sync)))
         else
-            echo -1
+            echo -- -1
         fi
         ;;
     alpine)
-        echo -1
+        echo -- -1
         ;;
     *)  echo "Your specified type ($type) is currently not supported." >&2
         echo "Please contribute an implementation for it if you can." >&2
diff --git a/cdist/conf/type/__pyvenv/gencode-remote b/cdist/conf/type/__pyvenv/gencode-remote
index 05ec3b29..9c7b7fab 100755
--- a/cdist/conf/type/__pyvenv/gencode-remote
+++ b/cdist/conf/type/__pyvenv/gencode-remote
@@ -38,7 +38,7 @@ destination="/$__object_id"
 venvparams="$(cat "$__object/parameter/venvparams")"
 pyvenvparam="$__object/parameter/pyvenv"
 
-os=$(cat $__global/explorer/os)
+os=$(cat "$__global/explorer/os")
 
 if [ -f "$pyvenvparam" ]
 then

From ceb6b597ef66dc21c901b5b52f251f4c8c61cd54 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Fri, 3 Apr 2020 19:45:44 +0200
Subject: [PATCH 360/383] Release 6.5.3

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index f5846925..aa5439d5 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.5.3: 2020-04-03
 	* Type __cron: Make non parallel due to race condition (Nico Schottelius)
 	* Type __pyvenv: Use python3 -m venv on Alpine (Nico Schottelius)
 	* Type __user: Fix missing shadow for alpine (llnu)

From d53077f4e8fbca26c6f1105efa1060df749900b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Mon, 6 Apr 2020 09:26:52 +0200
Subject: [PATCH 361/383] Add --encoding, --lc-collate, --lc-support to
 __postgres_database type

---
 .../type/__postgres_database/gencode-remote    | 18 +++++++++++++++++-
 cdist/conf/type/__postgres_database/man.rst    | 12 ++++++++++--
 .../__postgres_database/parameter/optional     |  3 +++
 3 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/cdist/conf/type/__postgres_database/gencode-remote b/cdist/conf/type/__postgres_database/gencode-remote
index 47e6b97c..b5f52f50 100755
--- a/cdist/conf/type/__postgres_database/gencode-remote
+++ b/cdist/conf/type/__postgres_database/gencode-remote
@@ -43,8 +43,24 @@ if [ "$state_should" != "$state_is" ]; then
          if [ -f "$__object/parameter/owner" ]; then
             owner="-O \"$(cat "$__object/parameter/owner")\""
          fi
+
+         encoding=""
+         if [ -f "$__object/parameter/encoding" ]; then
+            encoding="--encoding \"$(cat "$__object/parameter/encoding")\""
+         fi
+
+         lc_collate=""
+         if [ -f "$__object/parameter/lc-collate" ]; then
+            lc_collate="--lc-collate \"$(cat "$__object/parameter/lc-collate")\""
+         fi
+
+         lc_ctype=""
+         if [ -f "$__object/parameter/lc-ctype" ]; then
+            lc_ctype="--lc-ctype \"$(cat "$__object/parameter/lc-ctype")\""
+         fi
+
          cat << EOF
-su - '$postgres_user' -c "createdb $owner \"$name\""
+su - '$postgres_user' -c "createdb $owner \"$name\" $encoding $lc_collate $lc_ctype"
 EOF
       ;;
       absent)
diff --git a/cdist/conf/type/__postgres_database/man.rst b/cdist/conf/type/__postgres_database/man.rst
index acceec9b..97ac95eb 100644
--- a/cdist/conf/type/__postgres_database/man.rst
+++ b/cdist/conf/type/__postgres_database/man.rst
@@ -14,11 +14,19 @@ This cdist type allows you to create or drop postgres databases.
 OPTIONAL PARAMETERS
 -------------------
 state
-   either 'present' or 'absent', defaults to 'present'.
+   Either 'present' or 'absent', defaults to 'present'.
 
 owner
-   the role owning this database
+   Specifies the database user who will own the new database.
 
+encoding
+   Specifies the character encoding scheme to be used in this database.
+
+lc-collate
+   Specifies the LC_COLLATE setting to be used in this database.
+
+lc-ctype
+   Specifies the LC_CTYPE setting to be used in this database.
 
 EXAMPLES
 --------
diff --git a/cdist/conf/type/__postgres_database/parameter/optional b/cdist/conf/type/__postgres_database/parameter/optional
index d86b6469..fed2581e 100644
--- a/cdist/conf/type/__postgres_database/parameter/optional
+++ b/cdist/conf/type/__postgres_database/parameter/optional
@@ -1,2 +1,5 @@
 state
 owner
+encoding
+lc-collate
+lc-ctype

From 76d978d3d85051fe943334771c30dfff907f6e21 Mon Sep 17 00:00:00 2001
From: Steven Armstrong <steven@icarus.ethz.ch>
Date: Fri, 10 Apr 2020 10:51:17 +0200
Subject: [PATCH 362/383] explorer/init: do not grep on non-existent init

Signed-off-by: Steven Armstrong <steven@icarus.ethz.ch>
---
 cdist/conf/explorer/init | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init
index 1b921c68..f27c77ef 100755
--- a/cdist/conf/explorer/init
+++ b/cdist/conf/explorer/init
@@ -221,6 +221,7 @@ check_systemstarter() {
 
 check_sysvinit() (
 	init_path=${1:-/sbin/init}
+	test -x "${init_path}" || return 1
 	grep -q 'INIT_VERSION=sysvinit-[0-9.]*' "${init_path}" || return 1
 
 	# It is quite common to use SysVinit to stack other init systemd

From e19c1bb1e0072a4bfd6ec64ada2d3c4fab1ac064 Mon Sep 17 00:00:00 2001
From: Steven Armstrong <steven@icarus.ethz.ch>
Date: Fri, 10 Apr 2020 21:50:39 +0200
Subject: [PATCH 363/383] remove duplicates from conf dirs while preserving
 order

Signed-off-by: Steven Armstrong <steven@icarus.ethz.ch>
---
 cdist/exec/util.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cdist/exec/util.py b/cdist/exec/util.py
index 9787f431..e3be2235 100644
--- a/cdist/exec/util.py
+++ b/cdist/exec/util.py
@@ -199,7 +199,9 @@ def resolve_conf_dirs(configuration, add_conf_dirs):
 
     if add_conf_dirs:
         conf_dirs.extend(add_conf_dirs)
-    conf_dirs = set(conf_dirs)
+
+    # Remove duplicates.
+    conf_dirs = list(dict.fromkeys(conf_dirs))
     return conf_dirs
 
 

From 1ebcc219c26f91bcc634a9526171871f15210bd9 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 11 Apr 2020 09:54:57 +0200
Subject: [PATCH 364/383] ++changelog

---
 docs/changelog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index aa5439d5..a927a08d 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,9 @@
 Changelog
 ---------
 
+next:
+	* Explorer init: Do not grep on non-existent init (Steven Armstrong)
+
 6.5.3: 2020-04-03
 	* Type __cron: Make non parallel due to race condition (Nico Schottelius)
 	* Type __pyvenv: Use python3 -m venv on Alpine (Nico Schottelius)

From 704e78322ed5794fd9baf324f64363858fda2b26 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 11 Apr 2020 20:26:20 +0200
Subject: [PATCH 365/383] Use OrderedDict to guarantee order

Note:
> Changed in version 3.7: Dictionary order is guaranteed to be
> insertion order. This behavior was an implementation detail of
> CPython from 3.6.
---
 cdist/exec/util.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cdist/exec/util.py b/cdist/exec/util.py
index e3be2235..90a26ad3 100644
--- a/cdist/exec/util.py
+++ b/cdist/exec/util.py
@@ -22,6 +22,7 @@
 import subprocess
 import os
 from tempfile import TemporaryFile
+from collections import OrderedDict
 
 import cdist
 import cdist.configuration
@@ -201,7 +202,7 @@ def resolve_conf_dirs(configuration, add_conf_dirs):
         conf_dirs.extend(add_conf_dirs)
 
     # Remove duplicates.
-    conf_dirs = list(dict.fromkeys(conf_dirs))
+    conf_dirs = list(OrderedDict.fromkeys(conf_dirs))
     return conf_dirs
 
 

From d1eecb93eeef11da057052fe14818ff442a0d0c8 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 11 Apr 2020 20:30:56 +0200
Subject: [PATCH 366/383] ++changelog

---
 docs/changelog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/changelog b/docs/changelog
index a927a08d..8c7d497b 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -3,6 +3,7 @@ Changelog
 
 next:
 	* Explorer init: Do not grep on non-existent init (Steven Armstrong)
+	* Core: Bugfix to preserve conf dirs order (Steven Armstrong)
 
 6.5.3: 2020-04-03
 	* Type __cron: Make non parallel due to race condition (Nico Schottelius)

From 0805fac7e91b9ea3d0dd92fb00e36bc33d8cf779 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sat, 11 Apr 2020 20:35:29 +0200
Subject: [PATCH 367/383] Release 6.5.4

---
 docs/changelog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/changelog b/docs/changelog
index 8c7d497b..b6b1bb39 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,7 +1,7 @@
 Changelog
 ---------
 
-next:
+6.5.4: 2020-04-11
 	* Explorer init: Do not grep on non-existent init (Steven Armstrong)
 	* Core: Bugfix to preserve conf dirs order (Steven Armstrong)
 

From c3f924d350772d7c3af1ce8bbbe29f1b8010d4f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Tue, 14 Apr 2020 10:23:08 +0200
Subject: [PATCH 368/383] Add --template flag to __postgres_database type

---
 cdist/conf/type/__postgres_database/gencode-remote     | 7 ++++++-
 cdist/conf/type/__postgres_database/man.rst            | 4 ++++
 cdist/conf/type/__postgres_database/parameter/optional | 1 +
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__postgres_database/gencode-remote b/cdist/conf/type/__postgres_database/gencode-remote
index b5f52f50..0f11cff4 100755
--- a/cdist/conf/type/__postgres_database/gencode-remote
+++ b/cdist/conf/type/__postgres_database/gencode-remote
@@ -44,6 +44,11 @@ if [ "$state_should" != "$state_is" ]; then
             owner="-O \"$(cat "$__object/parameter/owner")\""
          fi
 
+         template=""
+         if [ -f "$__object/parameter/template" ]; then
+            template="--template \"$(cat "$__object/parameter/template")\""
+         fi
+
          encoding=""
          if [ -f "$__object/parameter/encoding" ]; then
             encoding="--encoding \"$(cat "$__object/parameter/encoding")\""
@@ -60,7 +65,7 @@ if [ "$state_should" != "$state_is" ]; then
          fi
 
          cat << EOF
-su - '$postgres_user' -c "createdb $owner \"$name\" $encoding $lc_collate $lc_ctype"
+su - '$postgres_user' -c "createdb $owner \"$name\" $template $encoding $lc_collate $lc_ctype"
 EOF
       ;;
       absent)
diff --git a/cdist/conf/type/__postgres_database/man.rst b/cdist/conf/type/__postgres_database/man.rst
index 97ac95eb..870b4917 100644
--- a/cdist/conf/type/__postgres_database/man.rst
+++ b/cdist/conf/type/__postgres_database/man.rst
@@ -28,6 +28,10 @@ lc-collate
 lc-ctype
    Specifies the LC_CTYPE setting to be used in this database.
 
+template
+   Specifies the template database from which to build this database.
+
+
 EXAMPLES
 --------
 
diff --git a/cdist/conf/type/__postgres_database/parameter/optional b/cdist/conf/type/__postgres_database/parameter/optional
index fed2581e..877fbf32 100644
--- a/cdist/conf/type/__postgres_database/parameter/optional
+++ b/cdist/conf/type/__postgres_database/parameter/optional
@@ -3,3 +3,4 @@ owner
 encoding
 lc-collate
 lc-ctype
+template

From 742163e38c2a8124390cecee02a9c865fe18fdff Mon Sep 17 00:00:00 2001
From: Joachim Desroches <joachim.desroches@epfl.ch>
Date: Wed, 15 Apr 2020 17:10:33 +0200
Subject: [PATCH 369/383] Fix configuration file location

---
 cdist/configuration.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cdist/configuration.py b/cdist/configuration.py
index f05a5963..1011a382 100644
--- a/cdist/configuration.py
+++ b/cdist/configuration.py
@@ -274,7 +274,8 @@ class Configuration(metaclass=Singleton):
              os.path.isfile(_local_config_file))):
         _local_config_file = os.path.join(
             os.environ.get('XDG_CONFIG_HOME',
-                           os.path.expanduser('~/.config/cdist')),
+                           os.path.expanduser('~/.config/')),
+            'cdist',
             _config_basename)
     _dist_config_file = os.path.join(
         os.path.abspath(os.path.join(os.path.dirname(cdist.__file__), "conf")),

From c9c1e7d79050afe2bc69b875096dbd1379d70eea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Tue, 21 Apr 2020 08:13:32 +0200
Subject: [PATCH 370/383] Import CI image definition

---
 other/ci/Dockerfile   | 8 ++++++++
 other/ci/README.md    | 3 +++
 other/ci/repositories | 3 +++
 3 files changed, 14 insertions(+)
 create mode 100644 other/ci/Dockerfile
 create mode 100644 other/ci/README.md
 create mode 100644 other/ci/repositories

diff --git a/other/ci/Dockerfile b/other/ci/Dockerfile
new file mode 100644
index 00000000..03d6b546
--- /dev/null
+++ b/other/ci/Dockerfile
@@ -0,0 +1,8 @@
+FROM alpine:latest
+
+COPY ./repositories /etc/apk/
+
+RUN apk update
+RUN apk upgrade
+RUN apk add python3 py3-pycodestyle rsync make shellcheck git
+RUN apk fix
diff --git a/other/ci/README.md b/other/ci/README.md
new file mode 100644
index 00000000..0bd64613
--- /dev/null
+++ b/other/ci/README.md
@@ -0,0 +1,3 @@
+This container is used for cdist's CI pipeline, and deployed in ungleich's docker registry at:
+
+	code.ungleich.ch:5050/ungleich-public/cdist-ci:latest
diff --git a/other/ci/repositories b/other/ci/repositories
new file mode 100644
index 00000000..46cabcc3
--- /dev/null
+++ b/other/ci/repositories
@@ -0,0 +1,3 @@
+https://mirror.ungleich.ch/mirror/packages/alpine/edge/main
+https://mirror.ungleich.ch/mirror/packages/alpine/edge/community
+https://mirror.ungleich.ch/mirror/packages/alpine/edge/testing

From 7d576554708115cef78eac364b20265386998882 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Tue, 21 Apr 2020 08:15:51 +0200
Subject: [PATCH 371/383] Fix typo in cdist-ci image README

---
 other/ci/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/other/ci/README.md b/other/ci/README.md
index 0bd64613..6a9b0ac5 100644
--- a/other/ci/README.md
+++ b/other/ci/README.md
@@ -1,3 +1,3 @@
 This container is used for cdist's CI pipeline, and deployed in ungleich's docker registry at:
 
-	code.ungleich.ch:5050/ungleich-public/cdist-ci:latest
+	code.ungleich.ch:5050/ungleich-public/cdist/cdist-ci:latest

From e2b26aa233fe702f19a39fa1378a6c531d36720f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timoth=C3=A9e=20Floure?= <timothee.floure@posteo.net>
Date: Tue, 21 Apr 2020 08:16:46 +0200
Subject: [PATCH 372/383] Patch CI configuration to use cdist-ci image

---
 .gitlab-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1cc17995..e215652c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,8 @@
 stages:
     - test
 
+image: code.ungleich.ch:5050/ungleich-public/cdist/cdist-ci:latest
+
 unit_tests:
     stage: test
     script:

From 38ccdfda321e6bdb683842d227b379feea5e752c Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 22 Apr 2020 23:21:34 +0200
Subject: [PATCH 373/383] Fix newly found shellcheck issues

---
 cdist/conf/type/__cdist/manifest           | 1 +
 cdist/conf/type/__openldap_server/manifest | 1 +
 2 files changed, 2 insertions(+)

diff --git a/cdist/conf/type/__cdist/manifest b/cdist/conf/type/__cdist/manifest
index a97cf288..0b0f1263 100755
--- a/cdist/conf/type/__cdist/manifest
+++ b/cdist/conf/type/__cdist/manifest
@@ -37,6 +37,7 @@ source="$(cat "$__object/parameter/source")"
 # out of it
 home=/home/$username
 
+# shellcheck disable=SC2086
 __user "$username" --home "$home" $shell
 
 require="__user/$username" __directory "$home" \
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index dadc9f20..d35603c4 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -168,6 +168,7 @@ if [ -z "${_skip_letsencrypt_cert}" ]; then
         staging=""
     fi
 
+    # shellcheck disable=SC2086
     __letsencrypt_cert "${name}" --admin-email "${admin_email}" \
         --renew-hook "cp ${ETC}/letsencrypt/live/${name}/*.pem ${SLAPD_DIR}/sasl2 && chown -R openldap:openldap ${SLAPD_DIR}/sasl2 && service slapd restart" \
         --automatic-renewal ${staging}

From 41e59a748dc45aaec88edc7a7eaed96c6086b1b1 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Wed, 22 Apr 2020 23:24:34 +0200
Subject: [PATCH 374/383] Fix newly found shellcheck issues

---
 scripts/cdist-dump | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/cdist-dump b/scripts/cdist-dump
index 83b09eb8..d29e5985 100755
--- a/scripts/cdist-dump
+++ b/scripts/cdist-dump
@@ -224,6 +224,7 @@ hor_line()
 if [ "${do_global_explorer}" ]
 then
     print_verbose 2 "Dumping global explorers"
+    # shellcheck disable=SC2086
     set -- "$@" ${or} \( \
                 -path "*/explorer/*" -a \
                 ! -path "*/conf/*" -a \

From 6cb0afdb9fb6c0edae0e39f4479facbb24b2c289 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Fri, 24 Apr 2020 13:29:43 +0200
Subject: [PATCH 375/383] Changes changes

---
 .../__letsencrypt_acmetiny/gencode-remote     |  5 +-
 .../type/__letsencrypt_acmetiny_base/manifest | 25 ++++++
 cdist/conf/type/__openldap_server/manifest    |  3 +
 .../type/__openldap_server/parameter/optional |  3 +-
 .../gencode-remote}                           | 21 +++--
 .../type/__pf_apply_anchor/parameter/optional |  1 +
 cdist/conf/type/__pf_rdr/manifest             | 20 +++++
 .../type/__pf_rdr/parameter/default/proto     |  1 +
 .../type/__pf_rdr/parameter/default/state     |  1 +
 cdist/conf/type/__pf_rdr/parameter/optional   |  2 +
 cdist/conf/type/__pf_rdr/parameter/required   |  2 +
 cdist/conf/type/__pf_ruleset/gencode-local    | 81 -------------------
 .../__pf_ruleset/{gencode-remote => manifest} | 44 +++++-----
 cdist/conf/type/__postfix/manifest            | 14 +---
 14 files changed, 96 insertions(+), 127 deletions(-)
 rename cdist/conf/type/{__pf_ruleset/explorer/cksum => __pf_apply_anchor/gencode-remote} (62%)
 create mode 100644 cdist/conf/type/__pf_apply_anchor/parameter/optional
 create mode 100644 cdist/conf/type/__pf_rdr/manifest
 create mode 100644 cdist/conf/type/__pf_rdr/parameter/default/proto
 create mode 100644 cdist/conf/type/__pf_rdr/parameter/default/state
 create mode 100644 cdist/conf/type/__pf_rdr/parameter/optional
 create mode 100644 cdist/conf/type/__pf_rdr/parameter/required
 delete mode 100755 cdist/conf/type/__pf_ruleset/gencode-local
 rename cdist/conf/type/__pf_ruleset/{gencode-remote => manifest} (58%)

diff --git a/cdist/conf/type/__letsencrypt_acmetiny/gencode-remote b/cdist/conf/type/__letsencrypt_acmetiny/gencode-remote
index 466b889d..9243acc9 100644
--- a/cdist/conf/type/__letsencrypt_acmetiny/gencode-remote
+++ b/cdist/conf/type/__letsencrypt_acmetiny/gencode-remote
@@ -11,7 +11,8 @@ if [ -f "${__object}/parameter/extra-domain" ]; then
 fi
 
 #TODO: support linux too
-REALM_DIR="/usr/local/etc/pki/realms/${REALM}"
+REALMS_DIR="/usr/local/etc/pki/realms"
+REALM_DIR="${REALMS_DIR}/${REALM}"
 REALM_CERT="${REALM_DIR}/default.crt"
 REALM_KEY="${REALM_DIR}/default.key"
 REALM_CERT_REQUEST="${ACME_TINY_CERT_REQUEST_DIR}/${REALM}.csr"
@@ -101,6 +102,8 @@ if [ -n "\${FORCE_CSR_REGEN}" -o -n "\${FORCE_CRT_REGEN}" ]; then
   fi
 fi
 
+cat "${REALM_CERT}" "${REALMS_DIR}/chain.pem" > ${REALM_DIR}/fullchain.pem
+
 if [ -n '${REALM_CERT_REQUEST_CNF_LINE}' -a -f '${REALM_CERT_REQUEST_CNF}.new' ]; then
   # CSR and cert generation succeded with a new config, put new config in-place.
   # This is the last thing we do, so we try again next time if sth fails.
diff --git a/cdist/conf/type/__letsencrypt_acmetiny_base/manifest b/cdist/conf/type/__letsencrypt_acmetiny_base/manifest
index 7bce9a63..cbedcdff 100644
--- a/cdist/conf/type/__letsencrypt_acmetiny_base/manifest
+++ b/cdist/conf/type/__letsencrypt_acmetiny_base/manifest
@@ -200,3 +200,28 @@ require="__package/doas" __file "${DOAS_CONF}" --mode 0640
 require="__file${DOAS_CONF}" __line "${DOAS_CONF}" \
   --regex 'root as acme-tiny' \
   --line 'permit nopass root as acme-tiny'
+
+# Setup CA 
+REALMS_DIR="/usr/local/etc/pki/realms"
+__directory "${REALMS_DIR}" \
+  --parents \
+  --state present \
+  --mode 0755
+
+require="__directory${REALMS_DIR}" __file ${REALMS_DIR}/intermediate.pem \
+  --mode 0644 \
+  --source - << EOF
+$(curl -s https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt)
+EOF
+require="__directory${REALMS_DIR}" __file ${REALMS_DIR}/root.pem \
+  --mode 0644 \
+  --source - << EOF
+$(curl -s https://letsencrypt.org/certs/trustid-x3-root.pem.txt)
+EOF
+require="__directory${REALMS_DIR}" __file ${REALMS_DIR}/chain.pem \
+  --mode 0644 \
+  --source - << EOF
+$(curl -s https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt)
+$(curl -s https://letsencrypt.org/certs/trustid-x3-root.pem.txt)
+EOF
+
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index dadc9f20..88fdbafa 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -9,6 +9,7 @@ slapd_modules=$(cat "${__object}/parameter/module" 2>/dev/null || true)
 schemas=$(cat "${__object}/parameter/schema")
 slapd_urls=$(tr '\n' ' ' < "${__object}/parameter/slapd-url")
 tls_cipher_suite=$(cat "${__object}/parameter/tls-cipher-suite" 2>/dev/null || true)
+extra_config=$(cat "${__object}/parameter/extra-config" || true)
 
 
 os="$(cat "${__global}/explorer/os")"
@@ -230,6 +231,8 @@ index uid,memberUid eq,pres,sub
 index nisMapName,nisMapEntry eq,pres,sub
 index entryCSN,entryUUID eq
 
+${extra_config}
+
 serverid ${serverid}
 EOF
 
diff --git a/cdist/conf/type/__openldap_server/parameter/optional b/cdist/conf/type/__openldap_server/parameter/optional
index a92b9c6e..71c64659 100644
--- a/cdist/conf/type/__openldap_server/parameter/optional
+++ b/cdist/conf/type/__openldap_server/parameter/optional
@@ -5,4 +5,5 @@ admin-email
 tls-cipher-suite
 tls-cert
 tls-privkey
-tls-ca
\ No newline at end of file
+tls-ca
+extra-config
diff --git a/cdist/conf/type/__pf_ruleset/explorer/cksum b/cdist/conf/type/__pf_apply_anchor/gencode-remote
similarity index 62%
rename from cdist/conf/type/__pf_ruleset/explorer/cksum
rename to cdist/conf/type/__pf_apply_anchor/gencode-remote
index 9be6c901..3d259aca 100755
--- a/cdist/conf/type/__pf_ruleset/explorer/cksum
+++ b/cdist/conf/type/__pf_apply_anchor/gencode-remote
@@ -18,24 +18,23 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 #
-# Get the 256 bit SHA2 checksum of the pf ruleset on the target host.
+# Apply pf(4) ruleset on *BSD
 #
 
 # Debug
-#exec >&2
+# exec >&2
 #set -x
 
-# Check /etc/rc.conf for pf's configuration file name. Default to /etc/pf.conf
-# See if file exists and if so, get checksum
+ANCHORS_DIR="/etc/pf.d"
 
-RC="/etc/rc.conf"
-TMP="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')"
-PFCONF="${TMP:-"/etc/pf.conf"}"
-
-if [ -f "${PFCONF}" ]; then	# The pf config file exists, find its cksum.
-	cksum -o 1 "${PFCONF}" | cut -d= -f2 | awk '{print $1}'
+if [ -f "${__object}/parameter/anchor_name" ]; then
+    anchor_name="$(cat "${__object}/parameter/anchor_name")"
+else
+    anchor_name="${__object_id}"
 fi
+anchor_file="${ANCHORS_DIR}/${anchor_name}"
+
+echo "pfctl -a \"${anchor_name}\" -f \"${anchor_file}\""
 
 # Debug
 #set +x
-
diff --git a/cdist/conf/type/__pf_apply_anchor/parameter/optional b/cdist/conf/type/__pf_apply_anchor/parameter/optional
new file mode 100644
index 00000000..b9f61e28
--- /dev/null
+++ b/cdist/conf/type/__pf_apply_anchor/parameter/optional
@@ -0,0 +1 @@
+anchor_name
diff --git a/cdist/conf/type/__pf_rdr/manifest b/cdist/conf/type/__pf_rdr/manifest
new file mode 100644
index 00000000..83bf2ed8
--- /dev/null
+++ b/cdist/conf/type/__pf_rdr/manifest
@@ -0,0 +1,20 @@
+# TODO header :D
+# TODO it would be cool to print a warning if a generated anchor is unused in pf.conf
+
+DESTDIR=/etc/pf.d
+
+proto="$(cat "$__object/parameter/proto")"
+from="$(cat "$__object/parameter/from")"
+to="$(cat "$__object/parameter/to")"
+state="$(cat "$__object/parameter/state")"
+
+from="$(echo $from | sed 's/:/ port /')"
+to="$(echo $to | sed 's/:/ port /')"
+
+anchorname="$(echo $__object_id | cut -d/ -f1)"
+rule="rdr pass log proto $proto from any to $from -> $to"
+
+__directory "$DESTDIR" --parents
+
+require="__directory/$DESTDIR" \
+__line __pf_rdr/$__object_id --state $state --line "$rule" --file $DESTDIR/$anchorname
diff --git a/cdist/conf/type/__pf_rdr/parameter/default/proto b/cdist/conf/type/__pf_rdr/parameter/default/proto
new file mode 100644
index 00000000..28a29e6f
--- /dev/null
+++ b/cdist/conf/type/__pf_rdr/parameter/default/proto
@@ -0,0 +1 @@
+tcp
diff --git a/cdist/conf/type/__pf_rdr/parameter/default/state b/cdist/conf/type/__pf_rdr/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__pf_rdr/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__pf_rdr/parameter/optional b/cdist/conf/type/__pf_rdr/parameter/optional
new file mode 100644
index 00000000..09ec92ca
--- /dev/null
+++ b/cdist/conf/type/__pf_rdr/parameter/optional
@@ -0,0 +1,2 @@
+proto
+state
diff --git a/cdist/conf/type/__pf_rdr/parameter/required b/cdist/conf/type/__pf_rdr/parameter/required
new file mode 100644
index 00000000..4a568482
--- /dev/null
+++ b/cdist/conf/type/__pf_rdr/parameter/required
@@ -0,0 +1,2 @@
+from
+to
diff --git a/cdist/conf/type/__pf_ruleset/gencode-local b/cdist/conf/type/__pf_ruleset/gencode-local
deleted file mode 100755
index 11bfb0b1..00000000
--- a/cdist/conf/type/__pf_ruleset/gencode-local
+++ /dev/null
@@ -1,81 +0,0 @@
-#!/bin/sh -e
-#
-# 2012 Jake Guffey (jake.guffey at eprotex.com)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-# Manage pf(4) on *BSD
-#
-
-# Debug
-#exec >&2
-#set -x
-
-# Send files to $__target_host via $__remote_copy
-
-uname=$(uname)   # Need to know what the cdist host is running so we know how to compute the ruleset's checksum
-state=$(cat "$__object/parameter/state")
-
-if [ "$state" = "absent" ]; then   # There is nothing more for a *local* script to do
-   exit 0
-fi
-
-if [ -f "$__object/parameter/source" ]; then
-   source=$(cat "$__object/parameter/source")
-fi
-
-rcvar=$(cat "$__object/explorer/rcvar")
-cksum=$(cat "$__object/explorer/cksum")
-
-
-cat <<EOF
-case $uname in
-   Darwin)
-      currentSum=\$(cksum -o 1 ${source} | cut '-d ' -f1)
-      ;;
-   Linux)
-      currentSum=\$(cksum ${source} | cut '-d ' -f1)
-      ;;
-   FreeBSD)
-      currentSum=\$(cksum -o 1 ${source} | cut -d= -f2 | sed 's/ //g')
-      ;;
-   *)
-      echo "Sorry, I do not know how to find a cksum on ${uname}." >&2
-      exit 1
-      ;;
-esac
-
-# IPv6 fix
-if $(echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$')
-then
-    my_target_host="[${__target_host}]"
-else
-    my_target_host="${__target_host}"
-fi
-
-if [ -n "${cksum}" ]; then
-   if [ ! "\${currentSum}" = "${cksum}" ]; then
-      $__remote_copy "${source}" "\${my_target_host}:${rcvar}.new"
-   fi
-else # File just doesn't exist yet
-   $__remote_copy "${source}" "\${my_target_host}:${rcvar}.new"
-fi
-EOF
-
-# Debug
-#exec +x
-
diff --git a/cdist/conf/type/__pf_ruleset/gencode-remote b/cdist/conf/type/__pf_ruleset/manifest
similarity index 58%
rename from cdist/conf/type/__pf_ruleset/gencode-remote
rename to cdist/conf/type/__pf_ruleset/manifest
index 12760fdf..25206add 100755
--- a/cdist/conf/type/__pf_ruleset/gencode-remote
+++ b/cdist/conf/type/__pf_ruleset/manifest
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# 2012 Jake Guffey (jake.guffey at eprotex.com)
+# 2016 Kamila Součková (kamila at ksp.sk)
 #
 # This file is part of cdist.
 #
@@ -25,25 +25,29 @@
 #exec >&2
 #set -x
 
-# Remove ${rcvar} in the case of --state absent
-
-state=$(cat "$__object/parameter/state")
 rcvar=$(cat "$__object/explorer/rcvar")
-
-if [ "$state" = "present" ]; then   # There is nothing more for a *remote* script to do
-   exit 0
-elif [ "$state" = "absent" ]; then
-   # --state absent, so ensure that .new doesn't exist and that conf is renamed to .old
-   cat <<EOF
-   if [ -f "${rcvar}.new" ]; then
-      rm "${rcvar}.new"
-   fi
-   if [ -f "${rcvar}" ]; then
-      mv "${rcvar}" "${rcvar}.old"
-   fi
-EOF
-else
-   echo "Unknown state ${state}!" >&2
-   exit 1
+state=$(cat "$__object/parameter/state")
+if [ -f "$__object/parameter/source" ]; then
+    source=$(cat "$__object/parameter/source")
 fi
 
+if [ "$state" = "absent" ]; then
+    action="/etc/rc.d/pf stop"
+else
+    action="/etc/rc.d/pf reload || /etc/rc.d/pf start"
+fi
+
+__key_value __pf_ruleset/rcvar \
+    --state "$state" \
+    --file /etc/rc.conf \
+    --delimiter "=" \
+    --key "pf_enable" \
+    --value "YES"
+
+require="${require} __key_value/__pf_ruleset/rcvar" __config_file $rcvar \
+    --source "$source" \
+    --state "$state" \
+    --onchange "$action"
+
+# Debug
+#exec +x
diff --git a/cdist/conf/type/__postfix/manifest b/cdist/conf/type/__postfix/manifest
index f3616979..121bba96 100755
--- a/cdist/conf/type/__postfix/manifest
+++ b/cdist/conf/type/__postfix/manifest
@@ -19,16 +19,4 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-
-os=$(cat "$__global/explorer/os")
-
-case "$os" in
-   alpine|ubuntu|debian|archlinux|suse|scientific|centos|devuan)
-      __package postfix --state present
-   ;;
-   *)
-      echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
-      echo "Please contribute an implementation for it if you can." >&2
-      exit 1
-   ;;
-esac
+__package postfix --state present

From de37b0ce450109306e31affa67dd2ff3653b6d68 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Fri, 24 Apr 2020 20:26:44 +0200
Subject: [PATCH 376/383] [__motd] Improve documentation and support for
 FreeBSD

This makes it easier to use the type just by reading the man page and also
treats FreeBSD's MOTD better.
---
 cdist/conf/type/__motd/gencode-remote | 11 +++++++++++
 cdist/conf/type/__motd/man.rst        | 19 ++++++++++++++++++-
 cdist/conf/type/__motd/manifest       |  8 ++++++++
 3 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__motd/gencode-remote b/cdist/conf/type/__motd/gencode-remote
index bc842cc8..738ea834 100755
--- a/cdist/conf/type/__motd/gencode-remote
+++ b/cdist/conf/type/__motd/gencode-remote
@@ -29,7 +29,18 @@ case "$os" in
         echo "uname -snrvm > /var/run/motd"
         echo "cat /etc/motd.tail >> /var/run/motd"
     ;;
+    freebsd)
+        # FreeBSD only updates /etc/motd on boot,
+	# as seen in /etc/rc.d/motd
+	echo "uname -sri > /etc/motd"
+	echo "cat /etc/motd.template >> /etc/motd"
+	# FreeBSD 13 starts treating motd slightly different from previous
+	# versions this ensures hosts have the expected config.
+	echo "rm /etc/motd.template || true"
+	echo "service motd start"
+    ;;
     *)
+        # Other OS tend to treat /etc/motd statically
         exit 0
     ;;
 esac
diff --git a/cdist/conf/type/__motd/man.rst b/cdist/conf/type/__motd/man.rst
index 17369684..a567dc80 100644
--- a/cdist/conf/type/__motd/man.rst
+++ b/cdist/conf/type/__motd/man.rst
@@ -10,6 +10,13 @@ DESCRIPTION
 -----------
 This cdist type allows you to easily setup /etc/motd.
 
+.. note::
+      In some OS, motd is a bit special, check `motd(5)`.
+      Currently Debian, Devuan, Ubuntu and FreeBSD are taken into account.
+      If your OS of choice does something besides /etc/motd, check the source
+      and contribute support for it.
+      Otherwise it will likely just work.
+
 
 REQUIRED PARAMETERS
 -------------------
@@ -20,6 +27,7 @@ OPTIONAL PARAMETERS
 -------------------
 source
    If supplied, copy this file from the host running cdist to the target.
+   If source is '-' (dash), take what was written to stdin as the file content.
    If not supplied, a default message will be placed onto the target.
 
 
@@ -34,6 +42,15 @@ EXAMPLES
     # Supply source file from a different type
     __motd --source "$__type/files/my-motd"
 
+    # Supply source from stdin
+    __motd --source "-" <<EOF
+    Take this kiss upon the brow!
+    And, in parting from you now,
+    Thus much let me avow-
+    You are not wrong, who deem
+    That my days have been a dream
+    EOF
+
 
 AUTHORS
 -------
@@ -42,7 +59,7 @@ Nico Schottelius <nico-cdist--@--schottelius.org>
 
 COPYING
 -------
-Copyright \(C) 2011 Nico Schottelius. You can redistribute it
+Copyright \(C) 2020 Nico Schottelius. You can redistribute it
 and/or modify it under the terms of the GNU General Public License as
 published by the Free Software Foundation, either version 3 of the
 License, or (at your option) any later version.
diff --git a/cdist/conf/type/__motd/manifest b/cdist/conf/type/__motd/manifest
index cd741cf4..ded734d7 100755
--- a/cdist/conf/type/__motd/manifest
+++ b/cdist/conf/type/__motd/manifest
@@ -34,9 +34,17 @@ os=$(cat "$__global/explorer/os")
 
 case "$os" in
    debian|ubuntu|devuan)
+      # Debian-based systems use /etc/motd.tail as a template
       destination=/etc/motd.tail
    ;;
+   freebsd)
+      # FreeBSD uses motd.template to prepend system information on boot
+      # (this actually only applies starting with version 13,
+      #  but we fix that for whatever version in gencode-remote)
+      destination=/etc/motd.template
+   ;;
    *)
+      # Most UNIX systems, including other Linux and OpenBSD just use /etc/motd
       destination=/etc/motd
    ;;
 esac

From 056c7c5400e7beeb15de800be6b62661998259ff Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Sat, 25 Apr 2020 00:12:24 +0200
Subject: [PATCH 377/383] [__openldap_server] Support extra config parameter.

This allows the user to, e.g. manually define ACLs, while this type does not
support that.
---
 cdist/conf/type/__openldap_server/man.rst            | 3 +++
 cdist/conf/type/__openldap_server/manifest           | 3 +++
 cdist/conf/type/__openldap_server/parameter/optional | 3 ++-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/cdist/conf/type/__openldap_server/man.rst b/cdist/conf/type/__openldap_server/man.rst
index d20101d1..fbad21d8 100644
--- a/cdist/conf/type/__openldap_server/man.rst
+++ b/cdist/conf/type/__openldap_server/man.rst
@@ -92,6 +92,9 @@ tls-ca
     Required if `tls-cert` is defined.
     Path in the remote hosts to the PEM-encoded CA certificate file.
 
+extra-config
+    Custom settings to be added in `slapd.conf(5)`.
+
 
 OPTIONAL MULTIPLE PARAMETERS
 ----------------------------
diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest
index d35603c4..84ba176f 100644
--- a/cdist/conf/type/__openldap_server/manifest
+++ b/cdist/conf/type/__openldap_server/manifest
@@ -9,6 +9,7 @@ slapd_modules=$(cat "${__object}/parameter/module" 2>/dev/null || true)
 schemas=$(cat "${__object}/parameter/schema")
 slapd_urls=$(tr '\n' ' ' < "${__object}/parameter/slapd-url")
 tls_cipher_suite=$(cat "${__object}/parameter/tls-cipher-suite" 2>/dev/null || true)
+extra_config=$(cat "${__object}/parameter/extra-config" || true)
 
 
 os="$(cat "${__global}/explorer/os")"
@@ -231,6 +232,8 @@ index uid,memberUid eq,pres,sub
 index nisMapName,nisMapEntry eq,pres,sub
 index entryCSN,entryUUID eq
 
+${extra_config}
+
 serverid ${serverid}
 EOF
 
diff --git a/cdist/conf/type/__openldap_server/parameter/optional b/cdist/conf/type/__openldap_server/parameter/optional
index a92b9c6e..71c64659 100644
--- a/cdist/conf/type/__openldap_server/parameter/optional
+++ b/cdist/conf/type/__openldap_server/parameter/optional
@@ -5,4 +5,5 @@ admin-email
 tls-cipher-suite
 tls-cert
 tls-privkey
-tls-ca
\ No newline at end of file
+tls-ca
+extra-config

From 5981d0a5f1deb2e60ea3c95ad3b535f1425060f6 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Sat, 25 Apr 2020 00:22:28 +0200
Subject: [PATCH 378/383] [__postfix] Automagically support more OSs by not
 checking too much.

It is quite likely that the package is going to be called postfix, rather
than trying to have an exhaustive "allow list" for this package, we can
just add special cases for OSs where that is not the case (not aware of any
atm).
---
 cdist/conf/type/__postfix/manifest | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/cdist/conf/type/__postfix/manifest b/cdist/conf/type/__postfix/manifest
index f3616979..121bba96 100755
--- a/cdist/conf/type/__postfix/manifest
+++ b/cdist/conf/type/__postfix/manifest
@@ -19,16 +19,4 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-
-os=$(cat "$__global/explorer/os")
-
-case "$os" in
-   alpine|ubuntu|debian|archlinux|suse|scientific|centos|devuan)
-      __package postfix --state present
-   ;;
-   *)
-      echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
-      echo "Please contribute an implementation for it if you can." >&2
-      exit 1
-   ;;
-esac
+__package postfix --state present

From cd6c02d16cf1a24d8370ed993d7b67beef2ed516 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Sat, 25 Apr 2020 01:29:17 +0200
Subject: [PATCH 379/383] Add copyright notice and make consistent with other
 types

---
 cdist/conf/type/__pf_rdr/manifest | 46 ++++++++++++++++++++++---------
 1 file changed, 33 insertions(+), 13 deletions(-)

diff --git a/cdist/conf/type/__pf_rdr/manifest b/cdist/conf/type/__pf_rdr/manifest
index 83bf2ed8..39ab4470 100644
--- a/cdist/conf/type/__pf_rdr/manifest
+++ b/cdist/conf/type/__pf_rdr/manifest
@@ -1,20 +1,40 @@
-# TODO header :D
+#!/bin/sh -e
+#
+# 2016 Kamila Součková (coding at kamila.is)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
 # TODO it would be cool to print a warning if a generated anchor is unused in pf.conf
 
-DESTDIR=/etc/pf.d
+ANCHORS_DIR=/etc/pf.d
 
-proto="$(cat "$__object/parameter/proto")"
-from="$(cat "$__object/parameter/from")"
-to="$(cat "$__object/parameter/to")"
-state="$(cat "$__object/parameter/state")"
+proto="$(cat "${__object}/parameter/proto")"
+from="$(cat "${__object}/parameter/from")"
+to="$(cat "${__object}/parameter/to")"
+state="$(cat "${__object}/parameter/state")"
 
-from="$(echo $from | sed 's/:/ port /')"
-to="$(echo $to | sed 's/:/ port /')"
+# This breaks utterly with IPv6
+from="$(echo ${from} | sed 's/:/ port /')"
+to="$(echo ${to} | sed 's/:/ port /')"
 
-anchorname="$(echo $__object_id | cut -d/ -f1)"
-rule="rdr pass log proto $proto from any to $from -> $to"
+anchor_name="$(echo ${__object_id} | cut -d/ -f1)"
+rule="rdr pass log proto ${proto} from any to ${from} -> ${to}"
 
-__directory "$DESTDIR" --parents
+__directory "${ANCHORS_DIR}" --parents
 
-require="__directory/$DESTDIR" \
-__line __pf_rdr/$__object_id --state $state --line "$rule" --file $DESTDIR/$anchorname
+require="__directory/${ANCHORS_DIR}" \
+__line __pf_rdr/${__object_id} --state ${state} --line "${rule}" --file ${ANCHORS_DIR}/${anchor_name}

From fefe90e9c9bde2ad00c142c01d5a588eb99751e5 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Sat, 25 Apr 2020 12:23:27 +0200
Subject: [PATCH 380/383] [__pf*] (~) __pf_ruleset (+)__pf_apply_anchor,
 deprecate __pf_apply
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

__pf_apply the way it exists on cdist is not really useful and __pf_ruleset does
not take advantage of other types as it should, being instead overly complex and
not as reliable.

The new __pf_ruleset is compatible with the previous one, and __pf_apply_anchors
allows for a simple and powerful way of managing pf anchors.
The functionality previously provided by __pf_apply is still possible out of the
box in __pf_ruleset.

These patches were mostly contributed by Kamila Součková and made fit for
upstreaming by Evilham.
---
 cdist/conf/type/__pf_apply/deprecated         |  1 +
 .../gencode-remote}                           | 28 +++----
 cdist/conf/type/__pf_apply_anchor/man.rst     | 62 ++++++++++++++
 .../type/__pf_apply_anchor/parameter/optional |  1 +
 cdist/conf/type/__pf_ruleset/gencode-local    | 81 -------------------
 cdist/conf/type/__pf_ruleset/man.rst          | 14 ++--
 .../__pf_ruleset/{gencode-remote => manifest} | 47 +++++------
 7 files changed, 105 insertions(+), 129 deletions(-)
 create mode 100644 cdist/conf/type/__pf_apply/deprecated
 rename cdist/conf/type/{__pf_ruleset/explorer/cksum => __pf_apply_anchor/gencode-remote} (55%)
 create mode 100644 cdist/conf/type/__pf_apply_anchor/man.rst
 create mode 100644 cdist/conf/type/__pf_apply_anchor/parameter/optional
 delete mode 100755 cdist/conf/type/__pf_ruleset/gencode-local
 rename cdist/conf/type/__pf_ruleset/{gencode-remote => manifest} (51%)

diff --git a/cdist/conf/type/__pf_apply/deprecated b/cdist/conf/type/__pf_apply/deprecated
new file mode 100644
index 00000000..36cfed90
--- /dev/null
+++ b/cdist/conf/type/__pf_apply/deprecated
@@ -0,0 +1 @@
+Consider moving to __pf_apply_anchor. Get in touch if you need __pf_apply.
diff --git a/cdist/conf/type/__pf_ruleset/explorer/cksum b/cdist/conf/type/__pf_apply_anchor/gencode-remote
similarity index 55%
rename from cdist/conf/type/__pf_ruleset/explorer/cksum
rename to cdist/conf/type/__pf_apply_anchor/gencode-remote
index 9be6c901..36c26521 100755
--- a/cdist/conf/type/__pf_ruleset/explorer/cksum
+++ b/cdist/conf/type/__pf_apply_anchor/gencode-remote
@@ -1,6 +1,6 @@
-#!/bin/sh
+#!/bin/sh -e
 #
-# 2012 Jake Guffey (jake.guffey at eprotex.com)
+# 2016 Kamila Součková (coding at kamila.is)
 #
 # This file is part of cdist.
 #
@@ -18,24 +18,16 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 #
-# Get the 256 bit SHA2 checksum of the pf ruleset on the target host.
+# Apply pf(4) ruleset on *BSD
 #
 
-# Debug
-#exec >&2
-#set -x
+ANCHORS_DIR="/etc/pf.d"
 
-# Check /etc/rc.conf for pf's configuration file name. Default to /etc/pf.conf
-# See if file exists and if so, get checksum
-
-RC="/etc/rc.conf"
-TMP="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')"
-PFCONF="${TMP:-"/etc/pf.conf"}"
-
-if [ -f "${PFCONF}" ]; then	# The pf config file exists, find its cksum.
-	cksum -o 1 "${PFCONF}" | cut -d= -f2 | awk '{print $1}'
+if [ -f "${__object}/parameter/anchor_name" ]; then
+    anchor_name="$(cat "${__object}/parameter/anchor_name")"
+else
+    anchor_name="${__object_id}"
 fi
+anchor_file="${ANCHORS_DIR}/${anchor_name}"
 
-# Debug
-#set +x
-
+echo "pfctl -a \"${anchor_name}\" -f \"${anchor_file}\""
diff --git a/cdist/conf/type/__pf_apply_anchor/man.rst b/cdist/conf/type/__pf_apply_anchor/man.rst
new file mode 100644
index 00000000..aef6cdf4
--- /dev/null
+++ b/cdist/conf/type/__pf_apply_anchor/man.rst
@@ -0,0 +1,62 @@
+cdist-type__pf_apply_anchor(7)
+==============================
+
+NAME
+----
+cdist-type__pf_apply_anchor - Apply a pf(4) anchor on $__target_host
+
+
+DESCRIPTION
+-----------
+This type is used on \*BSD systems to manage anchors for the pf firewall.
+
+Notice this type does not take care of copying the ruleset, that must be
+done by the user with, e.g. `__file`.
+
+
+OPTIONAL PARAMETERS
+-------------------
+anchor_name
+   The name of the anchor to apply. If not set, `${__object_id}` is used.
+   This type requires `/etc/pf.d/${anchor_name}` to exist on
+   `$__target_host`.
+
+
+EXAMPLES
+--------
+
+.. code-block:: sh
+
+    # Copy anchor file to ${__target_host}
+    __file "/etc/pf.d/80_dns" --source - <<EOF
+    # Managed remotely, changes will be lost
+
+    pass quick proto {tcp,udp} from any to any port domain
+    EOF
+
+    # Apply the anchor
+    require="__file/etc/pf.d/80_dns" __pf_apply_anchor 80_dns
+    # This is roughly equivalent to:
+    #   pfctl -a "${anchor_name}" -f "/etc/pf.d/${anchor_name}"
+
+
+SEE ALSO
+--------
+:strong:`pf`\ (4)
+
+
+AUTHORS
+-------
+Evilham <contact--@--evilham.com>
+Kamila Součková <coding--@--kamila.is>
+Jake Guffey <jake.guffey--@--eprotex.com>
+
+
+COPYING
+-------
+Copyright \(C) 2020 Evilham.
+Copyright \(C) 2016 Kamila Součková.
+Copyright \(C) 2012 Jake Guffey. You can redistribute it
+and/or modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
diff --git a/cdist/conf/type/__pf_apply_anchor/parameter/optional b/cdist/conf/type/__pf_apply_anchor/parameter/optional
new file mode 100644
index 00000000..b9f61e28
--- /dev/null
+++ b/cdist/conf/type/__pf_apply_anchor/parameter/optional
@@ -0,0 +1 @@
+anchor_name
diff --git a/cdist/conf/type/__pf_ruleset/gencode-local b/cdist/conf/type/__pf_ruleset/gencode-local
deleted file mode 100755
index 11bfb0b1..00000000
--- a/cdist/conf/type/__pf_ruleset/gencode-local
+++ /dev/null
@@ -1,81 +0,0 @@
-#!/bin/sh -e
-#
-# 2012 Jake Guffey (jake.guffey at eprotex.com)
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-# Manage pf(4) on *BSD
-#
-
-# Debug
-#exec >&2
-#set -x
-
-# Send files to $__target_host via $__remote_copy
-
-uname=$(uname)   # Need to know what the cdist host is running so we know how to compute the ruleset's checksum
-state=$(cat "$__object/parameter/state")
-
-if [ "$state" = "absent" ]; then   # There is nothing more for a *local* script to do
-   exit 0
-fi
-
-if [ -f "$__object/parameter/source" ]; then
-   source=$(cat "$__object/parameter/source")
-fi
-
-rcvar=$(cat "$__object/explorer/rcvar")
-cksum=$(cat "$__object/explorer/cksum")
-
-
-cat <<EOF
-case $uname in
-   Darwin)
-      currentSum=\$(cksum -o 1 ${source} | cut '-d ' -f1)
-      ;;
-   Linux)
-      currentSum=\$(cksum ${source} | cut '-d ' -f1)
-      ;;
-   FreeBSD)
-      currentSum=\$(cksum -o 1 ${source} | cut -d= -f2 | sed 's/ //g')
-      ;;
-   *)
-      echo "Sorry, I do not know how to find a cksum on ${uname}." >&2
-      exit 1
-      ;;
-esac
-
-# IPv6 fix
-if $(echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$')
-then
-    my_target_host="[${__target_host}]"
-else
-    my_target_host="${__target_host}"
-fi
-
-if [ -n "${cksum}" ]; then
-   if [ ! "\${currentSum}" = "${cksum}" ]; then
-      $__remote_copy "${source}" "\${my_target_host}:${rcvar}.new"
-   fi
-else # File just doesn't exist yet
-   $__remote_copy "${source}" "\${my_target_host}:${rcvar}.new"
-fi
-EOF
-
-# Debug
-#exec +x
-
diff --git a/cdist/conf/type/__pf_ruleset/man.rst b/cdist/conf/type/__pf_ruleset/man.rst
index 5719e94e..db8873ac 100644
--- a/cdist/conf/type/__pf_ruleset/man.rst
+++ b/cdist/conf/type/__pf_ruleset/man.rst
@@ -10,6 +10,9 @@ DESCRIPTION
 -----------
 This type is used on \*BSD systems to manage the pf firewall's ruleset.
 
+It will also enable and disable the pf firewall as requested in the `state`
+parameter.
+
 
 REQUIRED PARAMETERS
 -------------------
@@ -20,9 +23,8 @@ state
 OPTIONAL PARAMETERS
 -------------------
 source
-   If supplied, use to define the ruleset to load onto the $__target_host for pf(4).
-   Note that this type is almost useless without a ruleset defined, but it's technically not
-   needed, e.g. for the case of disabling the firewall temporarily.
+   Required when state is "present".
+   Defines the ruleset to load onto the $__target_host for `pf(4)`.
 
 
 EXAMPLES
@@ -30,10 +32,10 @@ EXAMPLES
 
 .. code-block:: sh
 
-    # Remove the current ruleset in place
+    # Remove the current ruleset in place and disable pf
     __pf_ruleset --state absent
 
-    # Enable the firewall with the ruleset defined in $__manifest/files/pf.conf
+    # Enable pf with the ruleset defined in $__manifest/files/pf.conf
     __pf_ruleset --state present --source $__manifest/files/pf.conf
 
 
@@ -44,11 +46,13 @@ SEE ALSO
 
 AUTHORS
 -------
+Kamila Součková <coding--@--kamila.is>
 Jake Guffey <jake.guffey--@--eprotex.com>
 
 
 COPYING
 -------
+Copyright \(C) 2016 Kamila Součková.
 Copyright \(C) 2012 Jake Guffey. You can redistribute it
 and/or modify it under the terms of the GNU General Public License as
 published by the Free Software Foundation, either version 3 of the
diff --git a/cdist/conf/type/__pf_ruleset/gencode-remote b/cdist/conf/type/__pf_ruleset/manifest
similarity index 51%
rename from cdist/conf/type/__pf_ruleset/gencode-remote
rename to cdist/conf/type/__pf_ruleset/manifest
index 12760fdf..34fee5dd 100755
--- a/cdist/conf/type/__pf_ruleset/gencode-remote
+++ b/cdist/conf/type/__pf_ruleset/manifest
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# 2012 Jake Guffey (jake.guffey at eprotex.com)
+# 2016 Kamila Součková (coding at kamila.is)
 #
 # This file is part of cdist.
 #
@@ -21,29 +21,26 @@
 # Manage pf(4) on *BSD
 #
 
-# Debug
-#exec >&2
-#set -x
-
-# Remove ${rcvar} in the case of --state absent
-
-state=$(cat "$__object/parameter/state")
-rcvar=$(cat "$__object/explorer/rcvar")
-
-if [ "$state" = "present" ]; then   # There is nothing more for a *remote* script to do
-   exit 0
-elif [ "$state" = "absent" ]; then
-   # --state absent, so ensure that .new doesn't exist and that conf is renamed to .old
-   cat <<EOF
-   if [ -f "${rcvar}.new" ]; then
-      rm "${rcvar}.new"
-   fi
-   if [ -f "${rcvar}" ]; then
-      mv "${rcvar}" "${rcvar}.old"
-   fi
-EOF
-else
-   echo "Unknown state ${state}!" >&2
-   exit 1
+rcvar="$(cat "${__object}/explorer/rcvar")"
+state="$(cat "${__object}/parameter/state")"
+if [ -f "${__object}/parameter/source" ]; then
+    source="$(cat "${__object}/parameter/source")"
 fi
 
+if [ "${state}" = "absent" ]; then
+    action="/etc/rc.d/pf stop"
+else
+    action="/etc/rc.d/pf reload || /etc/rc.d/pf start"
+fi
+
+__key_value __pf_ruleset/rcvar \
+    --state "${state}" \
+    --file /etc/rc.conf \
+    --delimiter "=" \
+    --key "pf_enable" \
+    --value "YES"
+
+require="__key_value/__pf_ruleset/rcvar" __config_file ${rcvar} \
+    --source "${source}" \
+    --state "${state}" \
+    --onchange "${action}"

From 292879544154f11f4cd719ebf0c67c25000a25fd Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Sat, 25 Apr 2020 14:54:29 +0200
Subject: [PATCH 381/383] [__pf_ruleset] Fix shellcheck issue.

---
 cdist/conf/type/__pf_ruleset/manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__pf_ruleset/manifest b/cdist/conf/type/__pf_ruleset/manifest
index 34fee5dd..27b35328 100755
--- a/cdist/conf/type/__pf_ruleset/manifest
+++ b/cdist/conf/type/__pf_ruleset/manifest
@@ -40,7 +40,7 @@ __key_value __pf_ruleset/rcvar \
     --key "pf_enable" \
     --value "YES"
 
-require="__key_value/__pf_ruleset/rcvar" __config_file ${rcvar} \
+require="__key_value/__pf_ruleset/rcvar" __config_file "${rcvar}" \
     --source "${source}" \
     --state "${state}" \
     --onchange "${action}"

From 04b7f240ebc1ae5b0f23279d75b65b50d062ccd1 Mon Sep 17 00:00:00 2001
From: Darko Poljak <foss@ungleich.com>
Date: Sun, 26 Apr 2020 10:01:18 +0200
Subject: [PATCH 382/383] ++changelog

---
 docs/changelog | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/changelog b/docs/changelog
index b6b1bb39..7cacf3cf 100644
--- a/docs/changelog
+++ b/docs/changelog
@@ -1,6 +1,16 @@
 Changelog
 ---------
 
+next:
+	* Core: Fix XDG_CONFIG_HOME config file location (Joachim Desroches)
+	* Type __postgres_database: Add encoding, lc-collate, lc-ctype, template parameters (Timothée Floure)
+	* Type __motd: Improve documentation and support for FreeBSD (Evil Ham)
+	* Type __openldap_server: Support extra config parameter (Evil Ham)
+	* Type __postfix: Automagically support more OSs by not checking too much (Evil Ham)
+	* New type: __pf_apply_anchor (Kamila Součková, Evil Ham)
+	* Type __pf_ruleset: Refactor (Kamila Součková, Evil Ham)
+	* Type __pf_apply: Deprecate type (Kamila Součková, Evil Ham)
+
 6.5.4: 2020-04-11
 	* Explorer init: Do not grep on non-existent init (Steven Armstrong)
 	* Core: Bugfix to preserve conf dirs order (Steven Armstrong)

From 3ee742f0abdb27d41267c967c5a45448db891009 Mon Sep 17 00:00:00 2001
From: Evilham <cvs@evilham.com>
Date: Sun, 26 Apr 2020 17:54:36 +0200
Subject: [PATCH 383/383] Kamila's changes +iocage_cone + tinydns* ~
 __daemontools_service

Consider at some point whether or not they are worth upstreaming.
(also __pf_rdr belongs to this batch)
---
 cdist/conf/type/__daemontools_service/man.rst |   6 +
 .../conf/type/__daemontools_service/manifest  |  16 +-
 .../parameter/default/group                   |   0
 .../parameter/default/owner                   |   0
 .../__daemontools_service/parameter/optional  |   2 +
 cdist/conf/type/__iocage_clone/gencode-remote | 152 ++++++++++++++++++
 cdist/conf/type/__iocage_clone/manifest       |   1 +
 .../parameter/default/allow_socket_af         |   1 +
 .../__iocage_clone/parameter/default/bridge   |   1 +
 .../parameter/default/devfs_ruleset           |   1 +
 .../parameter/default/jail_zfs_dataset        |   0
 .../parameter/default/mount_linprocfs         |   1 +
 .../parameter/default/mount_procfs            |   1 +
 .../type/__iocage_clone/parameter/default/net |   1 +
 .../__iocage_clone/parameter/default/state    |   1 +
 .../type/__iocage_clone/parameter/optional    |   7 +
 .../parameter/optional_multiple               |   1 +
 .../type/__iocage_clone/parameter/required    |   2 +
 cdist/conf/type/__tinydns/gencode-remote      |   7 +
 cdist/conf/type/__tinydns/manifest            |   8 +
 cdist/conf/type/__tinydns/parameter/required  |   2 +
 cdist/conf/type/__tinydns_host/gencode-remote |   9 ++
 cdist/conf/type/__tinydns_host/manifest       |   0
 .../type/__tinydns_host/parameter/required    |   1 +
 cdist/conf/type/__tinydns_ns/gencode-remote   |  13 ++
 .../conf/type/__tinydns_ns/parameter/required |   1 +
 26 files changed, 232 insertions(+), 3 deletions(-)
 create mode 100644 cdist/conf/type/__daemontools_service/parameter/default/group
 create mode 100644 cdist/conf/type/__daemontools_service/parameter/default/owner
 create mode 100755 cdist/conf/type/__iocage_clone/gencode-remote
 create mode 100644 cdist/conf/type/__iocage_clone/manifest
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/default/allow_socket_af
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/default/bridge
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/default/devfs_ruleset
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/default/jail_zfs_dataset
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/default/mount_linprocfs
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/default/mount_procfs
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/default/net
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/default/state
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/optional
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/optional_multiple
 create mode 100644 cdist/conf/type/__iocage_clone/parameter/required
 create mode 100644 cdist/conf/type/__tinydns/gencode-remote
 create mode 100644 cdist/conf/type/__tinydns/manifest
 create mode 100644 cdist/conf/type/__tinydns/parameter/required
 create mode 100644 cdist/conf/type/__tinydns_host/gencode-remote
 create mode 100644 cdist/conf/type/__tinydns_host/manifest
 create mode 100644 cdist/conf/type/__tinydns_host/parameter/required
 create mode 100644 cdist/conf/type/__tinydns_ns/gencode-remote
 create mode 100644 cdist/conf/type/__tinydns_ns/parameter/required

diff --git a/cdist/conf/type/__daemontools_service/man.rst b/cdist/conf/type/__daemontools_service/man.rst
index ec1d20ff..9bbbe2f8 100644
--- a/cdist/conf/type/__daemontools_service/man.rst
+++ b/cdist/conf/type/__daemontools_service/man.rst
@@ -40,6 +40,12 @@ run-file
 log-run
    Command to run for log consumption. Default: `multilog t ./main`
 
+owner
+   User to chown to.
+
+group
+   User to chgrp to.
+
 servicedir
    Directory to install into. Default: `/service`
 
diff --git a/cdist/conf/type/__daemontools_service/manifest b/cdist/conf/type/__daemontools_service/manifest
index 78bae285..8a81b5f5 100755
--- a/cdist/conf/type/__daemontools_service/manifest
+++ b/cdist/conf/type/__daemontools_service/manifest
@@ -9,6 +9,8 @@ servicedir=$(cat "$__object/parameter/servicedir")
 run=$(cat "$__object/parameter/run")
 runfile=$(cat "$__object/parameter/run-file")
 logrun=$(cat "$__object/parameter/log-run")
+owner=$(cat "$__object/parameter/owner")
+group=$(cat "$__object/parameter/group")
 
 svc=$(cat "$__type/explorer/svc")
 
@@ -25,14 +27,22 @@ badusage() {
 [ -z "$run$runfile" ] && badusage
 [ -n "$run" ] && [ -n "$runfile" ] && badusage
 
-__directory "$servicedir/$name/log/main" --parents
+flags=""
+if [ -n "$owner" ]; then
+  flags="$flags --owner $owner"
+fi
+if [ -n "$group" ]; then
+  flags="$flags --group $group"
+fi
+
+__directory "$servicedir/$name/log/main" --parents $flags
 
 echo "$RUN_PREFIX$run" | require="__directory/$servicedir/$name/log/main" __config_file "$servicedir/$name/run" \
 	--onchange "svc -t '$servicedir/$name' 2>/dev/null" \
-	--mode 755 \
+	--mode 755 $flags \
 	--source "${runfile:--}"
 
 echo "$RUN_PREFIX$logrun" | require="__directory/$servicedir/$name/log/main" __config_file "$servicedir/$name/log/run" \
 	--onchange "svc -t '$servicedir/$name/log' 2>/dev/null" \
-	--mode 755 \
+	--mode 755 $flags \
 	--source "-"
diff --git a/cdist/conf/type/__daemontools_service/parameter/default/group b/cdist/conf/type/__daemontools_service/parameter/default/group
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/conf/type/__daemontools_service/parameter/default/owner b/cdist/conf/type/__daemontools_service/parameter/default/owner
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/conf/type/__daemontools_service/parameter/optional b/cdist/conf/type/__daemontools_service/parameter/optional
index 7e54985f..7c66b514 100644
--- a/cdist/conf/type/__daemontools_service/parameter/optional
+++ b/cdist/conf/type/__daemontools_service/parameter/optional
@@ -1,4 +1,6 @@
+group
 log-run
+owner
 run
 run-file
 servicedir
diff --git a/cdist/conf/type/__iocage_clone/gencode-remote b/cdist/conf/type/__iocage_clone/gencode-remote
new file mode 100755
index 00000000..30d77099
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/gencode-remote
@@ -0,0 +1,152 @@
+#!/bin/sh
+
+state="$(cat $__object/parameter/state)"
+template="$(cat $__object/parameter/template)"
+ip4_addr="$(cat $__object/parameter/bridge)|$(cat $__object/parameter/ip)"
+interfaces="none:none"
+defaultrouter="none"
+vnet="off"
+jail_zfs_dataset="$(cat $__object/parameter/jail_zfs_dataset)"
+devfs_ruleset="$(cat $__object/parameter/devfs_ruleset)"
+allow_socket_af="$(cat $__object/parameter/allow_socket_af)"
+mount_procfs="$(cat $__object/parameter/mount_procfs)"
+mount_linprocfs="$(cat $__object/parameter/mount_linprocfs)"
+
+if [ "X$state" = "Xabsent" ]; then
+  cat <<EOF
+    iocage stop $__object_id || true
+    iocage destroy -f $__object_id || true
+    rm -f /iocage/jails/$__object_id
+EOF
+else 
+  cat <<EOF
+get_property_zfs () {
+  zfs get -H -o value \$1 "\$2"
+}
+
+get_property_iocage () {
+  get_property_zfs "org.freebsd.iocage:\$1" "/iocage/jails/\$2"
+}
+
+create_new=0
+if [ ! -d /iocage/jails/"$__object_id" ]; then
+  echo "Jail $__object_id does not exist, going to create."
+  create_new=1
+else
+  base=\$(get_property_zfs origin "/iocage/jails/$__object_id")
+  current_template=\$(get_property_zfs org.freebsd.iocage:tag "\$base")
+  if [ "X\$current_template" != "X$template" ]; then
+    echo "Jail $__object_id has base \$current_template, which is not $template. " >&2
+    create_new=1
+  fi
+fi
+
+if [ \$create_new -eq 0 ]; then
+  if [ "off" == "\$(get_property_iocage jail_zfs "$__object_id")" ]; then
+    current_jail_zfs_dataset=""
+  else
+    current_jail_zfs_dataset="\$(get_property_iocage jail_zfs_dataset "$__object_id")"
+  fi
+fi
+
+configure=0
+if [ \$create_new -eq 1 ]; then
+  configure=1
+elif [ "X$vnet" != "X\$(get_property_iocage vnet "$__object_id")" ]; then
+  configure=1
+elif [ "X$ip4_addr" != "X\$(get_property_iocage ip4_addr "$__object_id")" ]; then
+  configure=1
+elif [ "X$interfaces" != "X\$(get_property_iocage interfaces "$__object_id")" ]; then
+  configure=1
+elif [ "X$defaultrouter" != "X\$(get_property_iocage defaultrouter "$__object_id")" ]; then
+  configure=1
+elif [ "X$mount_procfs" != "X\$(get_property_iocage mount_procfs "$__object_id")" ]; then
+  configure=1
+elif [ "X$devfs_ruleset" != "X\$(get_property_iocage devfs_ruleset "$__object_id")" ]; then
+  configure=1
+elif [ "X$allow_socket_af" != "X\$(get_property_iocage allow_socket_af "$__object_id")" ]; then
+  configure=1
+elif [ "X$jail_zfs_dataset" != "X\$current_jail_zfs_dataset" ]; then
+  configure=1
+fi
+
+if [ \$create_new -eq 1 ]; then
+  echo "Creating jail $__object_id" >&2
+
+  iocage stop $__object_id || true
+  iocage destroy -f $__object_id || true
+  # Without VNETs, we should not need this.
+  # TODO(riso): Use nicer path
+  # /root/cdist/ioc deconfigure $__object_id
+
+  rm -f /iocage/jails/$__object_id
+
+  iocage clone $template tag=$__object_id
+  iocage set boot=on $__object_id
+  UUID=\$(iocage list | grep " $__object_id " | awk "{ print \\\$2; }")
+  rm -f /iocage/jails/$__object_id
+  ln -s /iocage/jails/\$UUID /iocage/jails/$__object_id
+else
+  UUID=\$(iocage list | grep " $__object_id " | awk "{ print \\\$2; }")
+  echo "Jail $__object_id already exists, UUID=\$UUID" >&2
+fi
+
+ROOT="/iocage/jails/\$UUID/root"
+FSTAB="/iocage/jails/\$UUID/fstab"
+rm -f \$FSTAB.new
+touch \$FSTAB.new
+cat $__object/parameter/mount 2>/dev/null | \\
+while read mount; do
+  src=\$(echo \$mount | awk -F: "{ print \\\$1; }")
+  dst_rel=\$(echo \$mount | awk -F: "{ print \\\$2; }")
+  dst="/iocage/jails/\$UUID/root/\$dst_rel"
+  mkdir -p "\$dst"
+  echo "\$src	\$dst	nullfs	rw	0	0" >>\$FSTAB.new
+done
+if [ $mount_linprocfs -eq 1 ]; then
+  echo "linproc /iocage/jails/\$UUID/root/compat/linux/proc linprocfs rw 0 0" >>\$FSTAB.new
+fi
+
+fstab_changed=0
+if diff -q \$FSTAB \$FSTAB.new >/dev/null; then
+  # pass
+else
+  configure=1
+  fstab_changed=1
+fi
+
+if [ \$configure -eq 1 ]; then
+  echo "Configuring jail $__object_id." >&2
+  iocage stop $__object_id || true
+
+  iocage set vnet="$vnet" $__object_id
+  iocage set interfaces="$interfaces" $__object_id
+  iocage set hostname="$__object_id" $__object_id
+  iocage set ip4_addr="$ip4_addr" $__object_id
+  iocage set defaultrouter="$defaultrouter" $__object_id
+  iocage set mount_procfs="$mount_procfs" $__object_id
+  iocage set devfs_ruleset="$devfs_ruleset" $__object_id
+  iocage set allow_socket_af="$allow_socket_af" $__object_id
+  if [ -n "$jail_zfs_dataset" ]; then
+    iocage set jail_zfs=on $__object_id
+    iocage set jail_zfs_dataset="$jail_zfs_dataset" $__object_id
+  else
+    iocage set jail_zfs=off $__object_id
+  fi
+
+  if [ \$fstab_changed -eq 1 ]; then
+    umount -afF \$FSTAB || true
+    mv \$FSTAB.new \$FSTAB
+  fi
+
+  iocage start $__object_id || true
+
+  # Iocage creates new mac address, but arp can have an old mac cached.
+  # TODO(riso): Is this true without VNETs?
+  arp -d -a
+else
+  echo "Jail $__object_id is already configured." >&2
+fi
+rm -f \$FSTAB.new
+EOF
+fi
diff --git a/cdist/conf/type/__iocage_clone/manifest b/cdist/conf/type/__iocage_clone/manifest
new file mode 100644
index 00000000..0684fce8
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/manifest
@@ -0,0 +1 @@
+__package iocage
diff --git a/cdist/conf/type/__iocage_clone/parameter/default/allow_socket_af b/cdist/conf/type/__iocage_clone/parameter/default/allow_socket_af
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/default/allow_socket_af
@@ -0,0 +1 @@
+0
diff --git a/cdist/conf/type/__iocage_clone/parameter/default/bridge b/cdist/conf/type/__iocage_clone/parameter/default/bridge
new file mode 100644
index 00000000..092f51c8
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/default/bridge
@@ -0,0 +1 @@
+bridge0
diff --git a/cdist/conf/type/__iocage_clone/parameter/default/devfs_ruleset b/cdist/conf/type/__iocage_clone/parameter/default/devfs_ruleset
new file mode 100644
index 00000000..b8626c4c
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/default/devfs_ruleset
@@ -0,0 +1 @@
+4
diff --git a/cdist/conf/type/__iocage_clone/parameter/default/jail_zfs_dataset b/cdist/conf/type/__iocage_clone/parameter/default/jail_zfs_dataset
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/conf/type/__iocage_clone/parameter/default/mount_linprocfs b/cdist/conf/type/__iocage_clone/parameter/default/mount_linprocfs
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/default/mount_linprocfs
@@ -0,0 +1 @@
+0
diff --git a/cdist/conf/type/__iocage_clone/parameter/default/mount_procfs b/cdist/conf/type/__iocage_clone/parameter/default/mount_procfs
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/default/mount_procfs
@@ -0,0 +1 @@
+0
diff --git a/cdist/conf/type/__iocage_clone/parameter/default/net b/cdist/conf/type/__iocage_clone/parameter/default/net
new file mode 100644
index 00000000..a45fd52c
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/default/net
@@ -0,0 +1 @@
+24
diff --git a/cdist/conf/type/__iocage_clone/parameter/default/state b/cdist/conf/type/__iocage_clone/parameter/default/state
new file mode 100644
index 00000000..e7f6134f
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/default/state
@@ -0,0 +1 @@
+present
diff --git a/cdist/conf/type/__iocage_clone/parameter/optional b/cdist/conf/type/__iocage_clone/parameter/optional
new file mode 100644
index 00000000..8ca73ed9
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/optional
@@ -0,0 +1,7 @@
+state
+bridge
+jail_zfs_dataset
+mount_procfs
+mount_linprocfs
+devfs_ruleset
+allow_socket_af
diff --git a/cdist/conf/type/__iocage_clone/parameter/optional_multiple b/cdist/conf/type/__iocage_clone/parameter/optional_multiple
new file mode 100644
index 00000000..fde64773
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/optional_multiple
@@ -0,0 +1 @@
+mount
diff --git a/cdist/conf/type/__iocage_clone/parameter/required b/cdist/conf/type/__iocage_clone/parameter/required
new file mode 100644
index 00000000..209d1544
--- /dev/null
+++ b/cdist/conf/type/__iocage_clone/parameter/required
@@ -0,0 +1,2 @@
+ip
+template
diff --git a/cdist/conf/type/__tinydns/gencode-remote b/cdist/conf/type/__tinydns/gencode-remote
new file mode 100644
index 00000000..824479b6
--- /dev/null
+++ b/cdist/conf/type/__tinydns/gencode-remote
@@ -0,0 +1,7 @@
+servicename=$__object_id
+user="$(cat "$__object/parameter/user")"
+server_ip="$(cat "$__object/parameter/server-ip")"
+
+cat<<EOF
+test -d /etc/tinydns/$servicename || tinydns-conf $user $user /etc/tinydns/$servicename $server_ip
+EOF
diff --git a/cdist/conf/type/__tinydns/manifest b/cdist/conf/type/__tinydns/manifest
new file mode 100644
index 00000000..3d51eddf
--- /dev/null
+++ b/cdist/conf/type/__tinydns/manifest
@@ -0,0 +1,8 @@
+service_name=$__object_id
+user="$(cat "$__object/parameter/user")"
+
+__package djbdns
+__directory /etc/tinydns --mode 755
+__user $user --system --shell /bin/false
+
+require="__daemontools" __link /service/tinydns-$service_name --type symbolic --source /etc/tinydns/$service_name
diff --git a/cdist/conf/type/__tinydns/parameter/required b/cdist/conf/type/__tinydns/parameter/required
new file mode 100644
index 00000000..ac560815
--- /dev/null
+++ b/cdist/conf/type/__tinydns/parameter/required
@@ -0,0 +1,2 @@
+user
+server-ip
diff --git a/cdist/conf/type/__tinydns_host/gencode-remote b/cdist/conf/type/__tinydns_host/gencode-remote
new file mode 100644
index 00000000..e4eb96bc
--- /dev/null
+++ b/cdist/conf/type/__tinydns_host/gencode-remote
@@ -0,0 +1,9 @@
+servicename=$(echo $__object_id | cut -d/ -f1)
+name=$(echo $__object_id | cut -d/ -f2-)
+ip="$(cat "$__object/parameter/ip")"
+
+cat<<EOF
+cd /etc/tinydns/$servicename/root
+grep '=$name:$ip' data 2>/dev/null || ./add-host $name $ip
+make
+EOF
diff --git a/cdist/conf/type/__tinydns_host/manifest b/cdist/conf/type/__tinydns_host/manifest
new file mode 100644
index 00000000..e69de29b
diff --git a/cdist/conf/type/__tinydns_host/parameter/required b/cdist/conf/type/__tinydns_host/parameter/required
new file mode 100644
index 00000000..93d111b2
--- /dev/null
+++ b/cdist/conf/type/__tinydns_host/parameter/required
@@ -0,0 +1 @@
+ip
diff --git a/cdist/conf/type/__tinydns_ns/gencode-remote b/cdist/conf/type/__tinydns_ns/gencode-remote
new file mode 100644
index 00000000..7305e605
--- /dev/null
+++ b/cdist/conf/type/__tinydns_ns/gencode-remote
@@ -0,0 +1,13 @@
+set -x
+
+servicename=$(echo $__object_id | cut -d/ -f1)
+name=$(echo $__object_id | cut -d/ -f2-)
+ip="$(cat "$__object/parameter/ip")"
+
+cat<<EOF
+cd /etc/tinydns/$servicename/root
+grep .$host:$ip data 2>/dev/null || ./add-ns $name $ip
+make
+EOF
+
+set +x
diff --git a/cdist/conf/type/__tinydns_ns/parameter/required b/cdist/conf/type/__tinydns_ns/parameter/required
new file mode 100644
index 00000000..93d111b2
--- /dev/null
+++ b/cdist/conf/type/__tinydns_ns/parameter/required
@@ -0,0 +1 @@
+ip