Cleanup ssh authorized keys types

Optimize file creations, deletions and writes.

Resolve #829.

cdist/conf/type/__ssh_authorized_key/deprecated

@@ -0,0 +1 @@
+This type is deprecated. Please use __ssh_authorized_keys instead.

cdist/conf/type/__ssh_authorized_keys/gencode-remote

@@ -0,0 +1,151 @@
+#!/bin/sh -e
+#
+# 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2014 Nico Schottelius (nico-cdist at schottelius.org)
+# 2021 Darko Poljak (darko.poljak at gmail.com)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+state="$(cat "$__object/parameter/state" 2>/dev/null)"
+file="$(cat "$__object/explorer/file")"
+keys_file="$__object/explorer/keys"
+
+_type_and_key() {
+    echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }'
+}
+
+_gen_key_entry() {
+    _the_key="$1"
+    # generate the key entry as it should be
+    if [ -f "$__object/parameter/option" ]; then
+        # comma seperated list of options
+        options="$(tr '\n' ',' < "$__object/parameter/option")"
+        printf '%s ' "${options%*,}"
+    fi
+    if [ -f "$__object/parameter/comment" ]; then
+        # extract the keytype and base64 encoded key ignoring any options and comment
+        printf '%s ' "$(echo "${_the_key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
+        # override the comment with the one explicitly given
+        printf '%s' "$(cat "$__object/parameter/comment")"
+    else
+        printf '%s' "${_the_key}"
+    fi
+    printf '\n'
+}
+
+
+cat << DONE
+new_keys=\$(mktemp ${file}.cdist.XXXXXXXXXX)
+patterns=\$(mktemp ${file}.cdist.XXXXXXXXXX)
+
+tmpfile=\$(mktemp ${file}.cdist.XXXXXXXXXX)
+
+# preserve ownership and permissions of existing file
+if [ -f "${file}" ]
+then
+   cp -p "${file}" "\${tmpfile}"
+fi
+DONE
+
+while read -r key; do
+    # validate key
+    validated_key="$(echo "${key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
+    if [ -z "${validated_key}" ]
+    then
+        echo "Key is invalid: \"${key}\"" >&2
+        exit 1
+    fi
+
+    type_and_key="$(_type_and_key "${key}")"
+
+    # remove conflicting entries
+    cat << DONE
+echo '${type_and_key}\\([ \\\\n].*\\)*\$' >> "\${patterns}"
+DONE
+
+    entry="$(_gen_key_entry "${key}")"
+
+    case "${state}" in
+        present)
+            # escape single quotes
+            _line_sanitised=$(echo "${entry}" | sed -e "s/'/'\"'\"'/g")
+            cat << DONE
+printf "%s\\n" "${_line_sanitised}" >> "\${new_keys}"
+DONE
+            echo "added to ${file} (${entry})" >> "$__messages_out"
+        ;;
+        absent)
+            cat << DONE
+echo "${entry}" >> "\${patterns}"
+DONE
+            echo "removed from ${file} (${entry})" >> "$__messages_out"
+        ;;
+    esac
+done < "$__object/parameter/key"
+
+set --
+cat << DONE
+if [ -s "\${patterns}" ] && [ -f "${file}" ]
+then
+    grep -v -f "\${patterns}" "${file}" > "\${tmpfile}" || true
+fi
+if [ -s "\${new_keys}" ]
+then
+    cat "\${new_keys}" >> "\${tmpfile}"
+fi
+
+rm -f "\${patterns}"
+rm -f "\${new_keys}"
+DONE
+
+if [ -f "$__object/parameter/remove-unknown" ] && [ -s "${keys_file}" ]
+then
+    while read -r key
+    do
+        type_and_key="$( _type_and_key "${key}" )"
+
+        if grep -Fq "${type_and_key}" "$__object/parameter/key"
+        then
+            continue
+        fi
+
+        # build grep patterns
+        cat << DONE
+echo "${key}" >> "\${patterns}"
+DONE
+    done < "${keys_file}"
+fi
+
+cat << DONE
+if [ -s "\${patterns}" ] && [ -f "${file}" ]
+then
+    newfile=\$(mktemp ${file}.cdist.XXXXXXXXXX)
+    # preserve ownership and permissions of existing file
+    if [ -f "${file}" ]; then
+       cp -p "${file}" "\${newfile}"
+    fi
+
+    grep -v -F -x -f "\${patterns}" "\${tmpfile}" > "\${newfile}" || true
+    mv -f "\${newfile}" "${file}"
+    rm -f "\${tmpfile}"
+else
+    mv -f "\${tmpfile}" "${file}"
+fi
+
+rm -f "\${patterns}"
+rm -f "\${new_keys}"
+DONE

cdist/conf/type/__ssh_authorized_keys/man.rst

@@ -122,12 +122,13 @@ SEE ALSO
 
 AUTHORS
 -------
-Steven Armstrong <steven-cdist--@--armstrong.cc>
+| Steven Armstrong <steven-cdist--@--armstrong.cc>
+| Darko Poljak <darko.poljak--@--gmail.com>
 
 
 COPYING
 -------
-Copyright \(C) 2012-2014 Steven Armstrong. You can redistribute it
-and/or modify it under the terms of the GNU General Public License as
-published by the Free Software Foundation, either version 3 of the
+Copyright \(C) 2012-2021 Steven Armstrong and Darko Poljak. You can
+redistribute it and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation, either version 3 of the
 License, or (at your option) any later version.

cdist/conf/type/__ssh_authorized_keys/manifest

@@ -2,6 +2,7 @@
 #
 # 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
 # 2014 Nico Schottelius (nico-cdist at schottelius.org)
+# 2021 Darko Poljak (darko.poljak at gmail.com)
 #
 # This file is part of cdist.
 #
@@ -20,80 +21,32 @@
 #
 
 owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
-state="$(cat "$__object/parameter/state" 2>/dev/null)"
 file="$(cat "$__object/explorer/file")"
 
-if [ ! -f "$__object/parameter/nofile" ] && [ -z "$file" ]
+if [ ! -f "$__object/parameter/nofile" ] && [ -z "${file}" ]
 then
-	echo "Cannot determine path of authorized_keys file" >&2
-	exit 1
+    printf "Cannot determine path of authorized_keys file\\n" >&2
+    exit 1
 fi
 
 if [ ! -f "$__object/parameter/noparent" ] || [ ! -f "$__object/parameter/nofile" ]; then
-   group="$(cut -d':' -f 1 "$__object/explorer/group")"
-   if [ -z "$group" ]; then
-      echo "Failed to get owners group from explorer." >&2
-      exit 1
-   fi
+    group="$(cut -d':' -f 1 "$__object/explorer/group")"
+    if [ -z "${group}" ]; then
+        printf "Failed to get owners group from explorer\\n" >&2
+        exit 1
+    fi
 
-   if [ ! -f "$__object/parameter/noparent" ]; then
-      __ssh_dot_ssh "$owner"
-      export require="__ssh_dot_ssh/$owner"
-   fi
-   if [ ! -f "$__object/parameter/nofile" ]; then
-      # Ensure that authorized_keys file exists and has the right permissions.
-      __file "$file" \
-         --owner "$owner" \
-         --group "$group" \
-         --mode 0600 \
-         --state exists
-      export require="__file/$file"
-   fi
-fi
-
-_cksum() {
-   echo "$1" | cksum | cut -d' ' -f 1
-}
-
-_type_and_key() {
-   echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }'
-}
-
-while read -r key; do
-   type_and_key="$( _type_and_key "$key" )"
-   object_id="$(_cksum "$file")-$(_cksum "$type_and_key")"
-   set -- "$object_id"
-   set -- "$@" --file "$file"
-   set -- "$@" --key "$key"
-   set -- "$@" --state "$state"
-   if [ -f "$__object/parameter/option" ]; then
-      # shellcheck disable=SC2046
-      set -- "$@" $(printf -- '--option %s ' $(cat "$__object/parameter/option"))
-   fi
-   if [ -f "$__object/parameter/comment" ]; then
-      set -- "$@" --comment "$(cat "$__object/parameter/comment")"
-   fi
-   # Ensure __ssh_authorized_key does not read stdin
-   __ssh_authorized_key "$@" < /dev/null
-done < "$__object/parameter/key"
-
-if [ -f "$__object/parameter/remove-unknown" ] &&
-    [ -s "$__object/explorer/keys" ]
-then
-    while read -r key
-    do
-        type_and_key="$( _type_and_key "$key" )"
-
-        if grep -Fq "$type_and_key" "$__object/parameter/key"
-        then
-            continue
-        fi
-
-        __ssh_authorized_key "remove-$( _cksum "$file$key" )" \
-            --file "$file" \
-            --key "$key" \
-            --state absent \
-                < /dev/null
-    done \
-        < "$__object/explorer/keys"
+    if [ ! -f "$__object/parameter/noparent" ]; then
+        __ssh_dot_ssh "${owner}"
+        export require="__ssh_dot_ssh/${owner}"
+    fi
+    if [ ! -f "$__object/parameter/nofile" ]; then
+        # Ensure that authorized_keys file exists and has the right permissions.
+        __file "${file}" \
+            --owner "${owner}" \
+            --group "${group}" \
+            --mode 0600 \
+            --state exists
+        export require="__file/${file}"
+    fi
 fi