Merge branch 'master' into type__git

cdist/conf/type/__jail/gencode-remote

@@ -34,15 +34,8 @@ fi
 
 state="$(cat "$__object/parameter/state")"
 
-if [ -f "$__object/parameter/started" ]; then
-   started="$(cat "$__object/parameter/started")"
-else
-   if [ ! "$state" = "present" ]; then
-      started="false"
-   else
-      started="true"
-   fi
-fi
+started="true"
+[ -f "$__object/parameter/stopped" ] && started="false"
 
 if [ -f "$__object/parameter/ip" ]; then
    ip="$(cat "$__object/parameter/ip")"
@@ -66,8 +59,8 @@ if [ -f "$__object/parameter/interface" ]; then
    interface="$(cat "$__object/parameter/interface")"
 fi
 
-if [ -f "$__object/parameter/devfs-enable" ]; then
-   devfsenable="$(cat "$__object/parameter/devfs-enable")"
+if [ -f "$__object/parameter/devfs-disable" ]; then
+   devfsenable="false"
 else
    devfsenable="true"
 fi
@@ -82,12 +75,12 @@ fi
 #     is pointless. Treat this as an error.
 if [ -n "$devfsruleset" -a "$devfsenable" = "false" ]; then
    exec >&2
-   echo "Can't have --devfs-ruleset defined without --devfs-enable true."
+   echo "Can't have --devfs-ruleset defined with --devfs-disable"
    exit 1
 fi
 
 if [ -f "$__object/parameter/onboot" ]; then
-   onboot="$(cat "$__object/parameter/onboot")"
+   onboot="true"
 fi
 
 if [ -f "$__object/parameter/jaildir" ]; then
@@ -357,7 +350,3 @@ else   # The jail does not currently exist
       exit 0
    fi
 fi
-
-# Debug
-#set +x
-

cdist/conf/type/__jail/man.text

@@ -27,9 +27,6 @@ OPTIONAL PARAMETERS
 name::
    The name of the jail. Default is to use the object_id as the jail name.
 
-started::
-   Either "true" or "false." Defaults to true.
-
 ip::
    The ifconfig style IP/netmask combination to use for the jail guest. If
    the state parameter is "present," this parameter is required.
@@ -41,23 +38,26 @@ interface::
    The name of the physical interface on the jail server to bind the jail to.
    Defaults to the first interface found in the output of ifconfig -l.
 
-devfs-enable::
-   Whether to allow devfs mounting within the jail. Must be "true" or "false."
-   Defaults to true.
-
 devfs-ruleset::
    The name of the devfs ruleset to associate with the jail. Defaults to
    "jailrules." This ruleset must be copied to the server via another type.
    To use this option, devfs-enable must be "true."
 
-onboot::
-   Whether to add the jail to rc.conf's jail_list variable. Must be either
-   "true" or "false." Defaults to false.
-
 jaildir::
    The location on the remote server to use for hosting jail filesystems.
    Defaults to /usr/jail.
 
+BOOLEAN PARAMETERS
+------------------
+stopped::
+   Do not start the jail
+
+devfs-disable::
+   Whether to disallow devfs mounting within the jail
+
+onboot::
+   Whether to add the jail to rc.conf's jail_list variable. 
+
 
 CAVEATS
 -------
@@ -77,8 +77,8 @@ __jail www --state present --ip "192.168.1.2" --jailbase /my/jail/base.tgz
 # Remove the jail called www
 __jail www --state absent --jailbase /my/jail/base.tgz
 
-# Ensure that the jail called www is started
-__jail www --state present --started true \
+# The jail www should not be started
+__jail www --state present --stopped \
    --ip "192.168.1.2 netmask 255.255.255.0" \
    --jailbase /my/jail/base.tgz
 
@@ -88,10 +88,10 @@ __jail thisjail --state present --name www \
    --jailbase /my/jail/base.tgz
 
 # Go nuts
-__jail lotsofoptions --state present --name testjail --started true \
+__jail lotsofoptions --state present --name testjail \
    --ip "192.168.1.100 netmask 255.255.255.0" \
    --hostname "testjail.example.com" --interface "em0" \
-   --onboot yes --jailbase /my/jail/base.tgz --jaildir /jails
+   --onboot --jailbase /my/jail/base.tgz --jaildir /jails
 --------------------------------------------------------------------------------
 
 

cdist/conf/type/__jail/parameter/boolean

@@ -0,0 +1,3 @@
+onboot
+stopped
+devfs-disable

cdist/conf/type/__jail/parameter/optional

@@ -1,10 +1,7 @@
 name
-started
 ip
 hostname
 interface
-devfs-enable
 devfs-ruleset
-onboot
 jaildir
 jailbase

cdist/conf/type/__qemu_img/gencode-remote

@@ -3,7 +3,7 @@
 # not existing and state != absent
 #
 state="present"
-[ -f "$__object/parameter/state" ] state="$(cat "$__object/parameter/state")"
+[ -f "$__object/parameter/state" ] && state="$(cat "$__object/parameter/state")"
 [ "$state" = "absent" ] && exit 0
 
 exists="$(cat "$__object/explorer/exists")"

cdist/conf/type/__ssh_authorized_key/explorer/dstuser_group

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-# Get option dstuser if defined
-if [ -f "$__object/parameter/dstuser" ]; then
-   dstuser=`cat "$__object/parameter/dstuser"`
-else
-   dstuser="root"
-fi
-
-if id $dstuser >/dev/null 2>&1 ; then
-    id -ng $dstuser
-else
-   echo "$__object_id: Destination user $dstuser does not exist" >&2
-   exit 1
-fi

cdist/conf/type/__ssh_authorized_key/man.text

@@ -1,46 +0,0 @@
-cdist-type__ssh_authorized_key(7)
-=================================
-Aurélien Bondis <aurelien.bondis--@--gmail-DOT-com>
-
-
-NAME
-----
-cdist-type__ssh_authorized_key - Sends a user's public key to another user's authorized_keys
-
-
-DESCRIPTION
------------
-This type sends a rsa key. By default uses root's key and sends it to root's authorized_keys
-
-
-REQUIRED PARAMETERS
--------------------
-None.
-
-
-OPTIONAL PARAMETERS
--------------------
-srcuser:: the user to take the rsa public key from
-dstuser:: the user to give the rsa public key to
-
-
-EXAMPLES
---------
-
---------------------------------------------------------------------------------
-#deploy root's public key
-__ssh_authorized_key admin
-#deploy bob's public key to alice's authorized_keys
-__ssh_authorized_key --srcuser bob --dstuser alice
---------------------------------------------------------------------------------
-
-
-SEE ALSO
---------
-- cdist-type(7)
-
-
-COPYING
--------
-Free use of this software is
-granted under the terms of the GNU General Public License version 3 (GPLv3).

cdist/conf/type/__ssh_authorized_key/manifest

@@ -1,66 +0,0 @@
-#!/bin/sh
-#
-# 2011 Aurélien Bondis  aurelien.bondis AT gmail DOT com
-#
-# This file is part of cdist.
-#
-# cdist is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# cdist is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with cdist. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-# This type allows to send a public ssh key from a user to the
-# authorized_keys of another
-#
-#require="__package openssh-server --state present"
-# Get option srcuser if defined
-if [ -f "$__object/parameter/srcuser" ]; then
-   srcuser=`cat "$__object/parameter/srcuser"`
-fi
-# Get option dstuser if defined
-if [ -f "$__object/parameter/dstuser" ]; then
-   dstuser=`cat "$__object/parameter/dstuser"`
-else
-   dstuser="root"
-fi
-
-# retrieve destination group
-dstgroup=$(cat "$__object/explorer/dstuser_group")
-
-# if a source user is defined, use it's public key
-if [ "$srcuser" ]; then
-   srcrsa="/home/${srcuser}/.ssh/id_rsa.pub"
-# if no source user is defined we use root's public key
-else
-   srcrsa="/root/.ssh/id_rsa.pub"
-fi
-# if a destination user is defined, insert in it's authorized_keys
-if [ "$dstuser" ]; then
-   sshpath="/home/$dstuser/.ssh"
-# if no destination user is defined we use root's home
-else
-   sshpath="/root/.ssh"
-fi
-rsa=`cat $srcrsa`
-__directory $sshpath \
-    --owner $dstuser \
-    --group $dstgroup \
-    --mode 700
-# the file authorized_keys depends on the .ssh folder
-require="__directory${sshpath}" \
-    __file "$sshpath/authorized_keys" \
-    --mode 640 \
-    --owner $dstuser \
-    --group $dstgroup
-# the line added depends on authorized_keys existence
-require="__file${sshpath}/authorized_keys" __addifnosuchline sshkey --file \
- "$sshpath/authorized_keys" --line "$rsa"

cdist/conf/type/__ssh_authorized_key/parameter/optional

@@ -1,2 +0,0 @@
-srcuser
-dstuser

cdist/conf/type/__ssh_authorized_keys/explorer/entry

@@ -0,0 +1,45 @@
+#!/bin/sh
+#
+# 2012 Steven Armstrong (steven-cdist at armstrong.cc)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
+if [ -f "$__object/parameter/file" ]; then
+   file="$(cat "$__object/parameter/file")"
+else
+   home="$("$__type_explorer/passwd" | cut -d':' -f 6)"
+   file="$home/.ssh/authorized_keys"
+fi
+
+# no authorized_keys file, nothing we could do
+[ -f "$file" ] || exit 0
+
+# NOTE: keep variables in sync in manifest/explorer/gencode-*
+prefix="#cdist:$__object_name"
+suffix="#/cdist:$__object_name"
+awk -v prefix="$prefix" -v suffix="$suffix" '{
+   if (index($0,prefix)) {
+      triggered=1
+   }
+   if (triggered) {
+      if (index($0,suffix)) {
+            triggered=0
+      }
+      print
+   }
+}' "$file"

cdist/conf/type/__ssh_authorized_keys/explorer/passwd

@@ -0,0 +1,23 @@
+#!/bin/sh
+#
+# 2012 Steven Armstrong (steven-cdist at armstrong.cc)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
+
+getent passwd "$owner" || true

cdist/conf/type/__ssh_authorized_keys/gencode-remote

@@ -0,0 +1,82 @@
+#!/bin/sh
+#
+# 2012 Steven Armstrong (steven-cdist at armstrong.cc)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
+if [ -f "$__object/parameter/file" ]; then
+   file="$(cat "$__object/parameter/file")"
+else
+   home="$(cut -d':' -f 6 "$__object/explorer/passwd")"
+   file="$home/.ssh/authorized_keys"
+fi 
+
+entry="$__object/files/entry"
+if [ ! -s "$__object/explorer/entry" ]; then
+   state_is='absent'
+else
+   state_is=$(diff -q "$entry" "$__object/explorer/entry" >/dev/null \
+      && echo present \
+      || echo changed
+   )
+fi
+
+state_should="$(cat "$__object/parameter/state" 2>/dev/null || echo present)"
+if [ "$state_should" = "$state_is" ]; then
+   # Nothing to do, move along
+   exit 0
+fi
+
+remove_entry() {
+   # NOTE: keep variables in sync in manifest/explorer/gencode-*
+   prefix="#cdist:$__object_name"
+   suffix="#/cdist:$__object_name"
+   cat << DONE
+tmpfile=\$(mktemp)
+awk -v prefix="$prefix" -v suffix="$suffix" '
+{
+   if (index(\$0,prefix)) {
+      triggered=1
+   }
+   if (triggered) {
+      if (index(\$0,suffix)) {
+         triggered=0
+      }
+   } else {
+      print
+   }
+}' "$file" > "\$tmpfile"
+mv -f "\$tmpfile" "$file"
+DONE
+}
+
+case "$state_should" in
+   present)
+      if [ "$state_is" = "changed" ]; then
+         remove_entry
+      fi
+      cat << DONE
+cat >> "$file" << ${__type##*/}_DONE
+$(cat "$entry")
+${__type##*/}_DONE
+DONE
+   ;;
+   absent)
+      remove_entry
+   ;;
+esac

cdist/conf/type/__ssh_authorized_keys/man.text

@@ -0,0 +1,101 @@
+cdist-type__ssh_authorized_keys(7)
+==================================
+Steven Armstrong <steven-cdist--@--armstrong.cc>
+
+
+NAME
+----
+cdist-type__ssh_authorized_keys - manage ssh authorized_keys files
+
+
+DESCRIPTION
+-----------
+Adds or removes ssh keys from a authorized_keys file.
+
+This type also manages the directory containing the authorized_keys
+file and sets strict ownership and permissions. You can disable this feature
+with the --noparent boolean parameter.
+
+The existence, ownership and permissions of the authorized_keys file itself are
+also managed. This can be disabled with the --nofile boolean parameter. It is
+then left to the user to ensure that the file exists and that ownership and 
+permissions work with ssh.
+
+
+REQUIRED PARAMETERS
+-------------------
+key::
+   the ssh key which shall be added to this authorized_keys file.
+   Must be a string and can be specified multiple times.
+
+
+OPTIONAL PARAMETERS
+-------------------
+owner::
+   the user owning the authorized_keys file, defaults to object_id.
+
+state::
+   if the given keys should be 'present' or 'absent', defaults to 'present'.
+
+file::
+   an alternative destination file, defaults to ~$owner/.ssh/authorized_keys
+
+comment::
+   an optional comment
+
+
+BOOLEAN PARAMETERS
+------------------
+noparent::
+   don't create or change ownership and permissions of the directory containing
+   the authorized_keys file
+
+nofile::
+   don't manage existence, ownership and permissions of the the authorized_keys
+   file
+
+
+EXAMPLES
+--------
+
+--------------------------------------------------------------------------------
+# add your ssh key to remote root's authorized_keys file
+__ssh_authorized_keys root \
+   --key "$(cat ~/.ssh/id_rsa.pub)"
+
+# allow key to login as user-name
+__ssh_authorized_keys user-name \
+   --key "ssh-rsa AXYZAAB3NzaC1yc2..."
+
+# same as above, but with explicit owner, two keys and a comment
+__ssh_authorized_keys some-fancy-id \
+   --owner user-name \
+   --key "ssh-rsa AXYZAAB3NzaC1yc2..." \
+   --key "ssh-rsa AZXYAAB3NzaC1yc2..." \
+   --comment "allow the members of project foo to login"
+
+# same as above, but authorized_keys file in non standard location
+__ssh_authorized_keys some-fancy-id \
+   --file /etc/ssh/keys/user-name/authorized_keys \
+   --owner user-name \
+   --key "ssh-rsa AXYZAAB3NzaC1yc2..."
+
+# same as above, but directory and authorized_keys file is created elswhere
+__ssh_authorized_keys some-fancy-id \
+   --file /etc/ssh/keys/user-name/authorized_keys \
+   --owner user-name \
+   --noparent \
+   --nofile \
+   --key "ssh-rsa AXYZAAB3NzaC1yc2..."
+--------------------------------------------------------------------------------
+
+
+SEE ALSO
+--------
+- cdist-type(7)
+
+
+COPYING
+-------
+Copyright \(C) 2012 Steven Armstrong. Free use of this software is
+granted under the terms of the GNU General Public License version 3 (GPLv3).

cdist/conf/type/__ssh_authorized_keys/manifest

@@ -0,0 +1,74 @@
+#!/bin/sh
+#
+# 2012 Steven Armstrong (steven-cdist at armstrong.cc)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
+state="$(cat "$__object/parameter/present" 2>/dev/null || echo "present")"
+if [ -f "$__object/parameter/file" ]; then
+   file="$(cat "$__object/parameter/file")"
+else
+   home="$(cut -d':' -f 6 "$__object/explorer/passwd")"
+   if [ -z "$home" ]; then
+      echo "Failed to get home directory from explorer." >&2
+      exit 1
+   fi
+   file="$home/.ssh/authorized_keys"
+fi
+
+if [ ! -f "$__object/parameter/noparent" -o ! -f "$__object/parameter/nofile" ]; then
+   group="$(cut -d':' -f 4 "$__object/explorer/passwd")"
+   if [ -z "$group" ]; then
+      echo "Failed to get owners group from explorer." >&2
+      exit 1
+   fi
+
+   if [ ! -f "$__object/parameter/noparent" ]; then
+      # Ensure that the directory in which the authorized_keys shall be exists and 
+      # has the right permissions.
+      ssh_directory="${file%/*}"
+      __directory "$ssh_directory" --state present --parents \
+         --owner "$owner" --group "$group" --mode 0700
+      export require="__directory/$ssh_directory"
+   fi
+   if [ ! -f "$__object/parameter/nofile" ]; then
+      # Ensure that authorized_keys file exists and has the right permissions.
+      __file "$file" \
+         --owner "$owner" \
+         --group "$group" \
+         --mode 0600 \
+         --state exists
+   fi
+fi
+
+# NOTE: keep variables in sync in manifest/explorer/gencode-*
+prefix="#cdist:$__object_name"
+suffix="#/cdist:$__object_name"
+
+mkdir "$__object/files"
+
+# Generate entry for inclusion in authorized_keys file
+entry="$__object/files/entry"
+echo "$prefix" > "$entry"
+if [ -f "$__object/parameter/comment" ]; then
+   echo "# $(cat "$__object/parameter/comment")" >> "$entry"
+fi
+cat "$__object/parameter/key" >> "$entry"
+# ensure we have a newline after keys
+echo >> "$entry"
+echo "$suffix" >> "$entry"

cdist/conf/type/__ssh_authorized_keys/parameter/boolean

@@ -0,0 +1,2 @@
+noparent
+nofile

cdist/conf/type/__ssh_authorized_keys/parameter/optional

@@ -0,0 +1,4 @@
+owner
+state
+file
+comment

cdist/conf/type/__ssh_authorized_keys/parameter/required_multiple

@@ -0,0 +1 @@
+key