From 16a829d3eb14cfdc338f1bba1a1dfcfb0be6841d Mon Sep 17 00:00:00 2001
From: Steven Armstrong <steven@icarus.ethz.ch>
Date: Sat, 22 Feb 2014 01:09:42 +0100
Subject: [PATCH] manage individual keys instead of block of text

also fixes #251

Signed-off-by: Steven Armstrong <steven@icarus.ethz.ch>
---
 .../type/__ssh_authorized_keys/explorer/group | 22 +++++++++++
 .../conf/type/__ssh_authorized_keys/man.text  |  2 +-
 .../conf/type/__ssh_authorized_keys/manifest  | 37 +++++++++++++------
 3 files changed, 49 insertions(+), 12 deletions(-)
 create mode 100755 cdist/conf/type/__ssh_authorized_keys/explorer/group

diff --git a/cdist/conf/type/__ssh_authorized_keys/explorer/group b/cdist/conf/type/__ssh_authorized_keys/explorer/group
new file mode 100755
index 00000000..cdea6fe7
--- /dev/null
+++ b/cdist/conf/type/__ssh_authorized_keys/explorer/group
@@ -0,0 +1,22 @@
+#!/bin/sh
+#
+# 2014 Steven Armstrong (steven-cdist at armstrong.cc)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+gid="$("$__type_explorer/passwd" | cut -d':' -f 4)"
+getent group "$gid" || true
diff --git a/cdist/conf/type/__ssh_authorized_keys/man.text b/cdist/conf/type/__ssh_authorized_keys/man.text
index 7177f26e..259d4152 100644
--- a/cdist/conf/type/__ssh_authorized_keys/man.text
+++ b/cdist/conf/type/__ssh_authorized_keys/man.text
@@ -97,5 +97,5 @@ SEE ALSO
 
 COPYING
 -------
-Copyright \(C) 2012 Steven Armstrong. Free use of this software is
+Copyright \(C) 2012-2014 Steven Armstrong. Free use of this software is
 granted under the terms of the GNU General Public License version 3 (GPLv3).
diff --git a/cdist/conf/type/__ssh_authorized_keys/manifest b/cdist/conf/type/__ssh_authorized_keys/manifest
index 5a9cfbb3..01a29c37 100755
--- a/cdist/conf/type/__ssh_authorized_keys/manifest
+++ b/cdist/conf/type/__ssh_authorized_keys/manifest
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# 2012 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
 #
 # This file is part of cdist.
 #
@@ -32,7 +32,7 @@ else
 fi
 
 if [ ! -f "$__object/parameter/noparent" -o ! -f "$__object/parameter/nofile" ]; then
-   group="$(cut -d':' -f 4 "$__object/explorer/passwd")"
+   group="$(cut -d':' -f 1 "$__object/explorer/group")"
    if [ -z "$group" ]; then
       echo "Failed to get owners group from explorer." >&2
       exit 1
@@ -56,16 +56,31 @@ if [ ! -f "$__object/parameter/noparent" -o ! -f "$__object/parameter/nofile" ];
    fi
 fi
 
-# Generate entry for inclusion in authorized_keys file
-(
-if [ -f "$__object/parameter/comment" ]; then
-   echo "# $(cat "$__object/parameter/comment")"
-fi
-cat "$__object/parameter/key"
-) | \
+# Remove legacy blocks created by old versions of this type
 __block "$__object_name" \
    --file "$file" \
    --prefix "#cdist:$__object_name" \
    --suffix "#/cdist:$__object_name" \
-   --state "$state" \
-   --text -
+   --state 'absent' \
+   --text - << DONE
+remove legacy block
+DONE
+
+_cksum() {
+   echo "$1" | cksum | cut -d' ' -f 1
+}
+
+# Add each key
+IFS=$'\n'
+for key in $(cat "$__object/parameter/key"); do
+   unset IFS
+   raw_key="$(echo "$key" | tr ' ' '\n' | awk '/^ssh-(rsa|dsa)/ {printf $1" ";getline;printf $1}')"
+   set -- "$(_cksum "$raw_key")"
+   set -- "$@" --file "$file"
+   set -- "$@" --regex ".*$raw_key.*"
+   if [ "$state" = 'present' ]; then
+      set -- "$@" --line "$key"
+   fi
+   set -- "$@" --state "$state"
+   require="__block/$__object_name" __line "$@"
+done