diff --git a/.gitattributes b/.gitattributes index 01d20f30..45c10d7b 100644 --- a/.gitattributes +++ b/.gitattributes @@ -4,5 +4,5 @@ docs/speeches export-ignore docs/video export-ignore docs/src/man7 export-ignore -bin/cdist-build-helper export-ignore +bin/build-helper export-ignore README-maintainers export-ignore diff --git a/.gitignore b/.gitignore index 85a8ccc7..ed8b453a 100644 --- a/.gitignore +++ b/.gitignore @@ -24,8 +24,6 @@ docs/src/man1/*.1 docs/src/man7/*.7 docs/src/man7/cdist-type__*.rst docs/src/cdist-reference.rst -docs/src/cdist-types.rst -docs/src/cdist.cfg.skeleton # Ignore cdist cache for version control /cache/ diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml deleted file mode 100644 index a4bc67aa..00000000 --- a/.gitlab-ci.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -image: code.ungleich.ch:5050/ungleich-public/cdist/cdist-ci:latest - -stages: - - test - -before_script: - - ./bin/cdist-build-helper version - -shellcheck: - stage: test - script: - - ./bin/cdist-build-helper shellcheck - -pycodestyle: - stage: test - script: - - ./bin/cdist-build-helper pycodestyle - -unit_tests: - stage: test - script: - - ./bin/cdist-build-helper test diff --git a/LICENSE b/LICENSE deleted file mode 100644 index 14682ad6..00000000 --- a/LICENSE +++ /dev/null @@ -1,674 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 3, 29 June 2007 - - Copyright (C) 2007 Free Software Foundation, Inc. - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The GNU General Public License is a free, copyleft license for -software and other kinds of works. - - The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -the GNU General Public License is intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains free -software for all its users. We, the Free Software Foundation, use the -GNU General Public License for most of our software; it applies also to -any other work released this way by its authors. You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - - To protect your rights, we need to prevent others from denying you -these rights or asking you to surrender the rights. Therefore, you have -certain responsibilities if you distribute copies of the software, or if -you modify it: responsibilities to respect the freedom of others. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must pass on to the recipients the same -freedoms that you received. You must make sure that they, too, receive -or can get the source code. And you must show them these terms so they -know their rights. - - Developers that use the GNU GPL protect your rights with two steps: -(1) assert copyright on the software, and (2) offer you this License -giving you legal permission to copy, distribute and/or modify it. - - For the developers' and authors' protection, the GPL clearly explains -that there is no warranty for this free software. For both users' and -authors' sake, the GPL requires that modified versions be marked as -changed, so that their problems will not be attributed erroneously to -authors of previous versions. - - Some devices are designed to deny users access to install or run -modified versions of the software inside them, although the manufacturer -can do so. This is fundamentally incompatible with the aim of -protecting users' freedom to change the software. The systematic -pattern of such abuse occurs in the area of products for individuals to -use, which is precisely where it is most unacceptable. Therefore, we -have designed this version of the GPL to prohibit the practice for those -products. If such problems arise substantially in other domains, we -stand ready to extend this provision to those domains in future versions -of the GPL, as needed to protect the freedom of users. - - Finally, every program is threatened constantly by software patents. -States should not allow patents to restrict development and use of -software on general-purpose computers, but in those that do, we wish to -avoid the special danger that patents applied to a free program could -make it effectively proprietary. To prevent this, the GPL assures that -patents cannot be used to render the program non-free. - - The precise terms and conditions for copying, distribution and -modification follow. - - TERMS AND CONDITIONS - - 0. Definitions. - - "This License" refers to version 3 of the GNU General Public License. - - "Copyright" also means copyright-like laws that apply to other kinds of -works, such as semiconductor masks. - - "The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - - To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of an -exact copy. The resulting work is called a "modified version" of the -earlier work or a work "based on" the earlier work. - - A "covered work" means either the unmodified Program or a work based -on the Program. - - To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - - To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user through -a computer network, with no transfer of a copy, is not conveying. - - An interactive user interface displays "Appropriate Legal Notices" -to the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - - 1. Source Code. - - The "source code" for a work means the preferred form of the work -for making modifications to it. "Object code" means any non-source -form of a work. - - A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - - The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - - The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - - The Corresponding Source need not include anything that users -can regenerate automatically from other parts of the Corresponding -Source. - - The Corresponding Source for a work in source code form is that -same work. - - 2. Basic Permissions. - - All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - - You may make, run and propagate covered works that you do not -convey, without conditions so long as your license otherwise remains -in force. You may convey covered works to others for the sole purpose -of having them make modifications exclusively for you, or provide you -with facilities for running those works, provided that you comply with -the terms of this License in conveying all material for which you do -not control copyright. Those thus making or running the covered works -for you must do so exclusively on your behalf, under your direction -and control, on terms that prohibit them from making any copies of -your copyrighted material outside their relationship with you. - - Conveying under any other circumstances is permitted solely under -the conditions stated below. Sublicensing is not allowed; section 10 -makes it unnecessary. - - 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - - No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - - When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such circumvention -is effected by exercising rights under this License with respect to -the covered work, and you disclaim any intention to limit operation or -modification of the work as a means of enforcing, against the work's -users, your or third parties' legal rights to forbid circumvention of -technological measures. - - 4. Conveying Verbatim Copies. - - You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - - You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - - 5. Conveying Modified Source Versions. - - You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these conditions: - - a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. - - b) The work must carry prominent notices stating that it is - released under this License and any conditions added under section - 7. This requirement modifies the requirement in section 4 to - "keep intact all notices". - - c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. - - d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - - A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - - 6. Conveying Non-Source Forms. - - You may convey a covered work in object code form under the terms -of sections 4 and 5, provided that you also convey the -machine-readable Corresponding Source under the terms of this License, -in one of these ways: - - a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. - - b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the - Corresponding Source from a network server at no charge. - - c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. - - d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. - - e) Convey the object code using peer-to-peer transmission, provided - you inform other peers where the object code and Corresponding - Source of the work are being offered to the general public at no - charge under subsection 6d. - - A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - - A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, family, -or household purposes, or (2) anything designed or sold for incorporation -into a dwelling. In determining whether a product is a consumer product, -doubtful cases shall be resolved in favor of coverage. For a particular -product received by a particular user, "normally used" refers to a -typical or common use of that class of product, regardless of the status -of the particular user or of the way in which the particular user -actually uses, or expects or is expected to use, the product. A product -is a consumer product regardless of whether the product has substantial -commercial, industrial or non-consumer uses, unless such uses represent -the only significant mode of use of the product. - - "Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to install -and execute modified versions of a covered work in that User Product from -a modified version of its Corresponding Source. The information must -suffice to ensure that the continued functioning of the modified object -code is in no case prevented or interfered with solely because -modification has been made. - - If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - - The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or updates -for a work that has been modified or installed by the recipient, or for -the User Product in which it has been modified or installed. Access to a -network may be denied when the modification itself materially and -adversely affects the operation of the network or violates the rules and -protocols for communication across the network. - - Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - - 7. Additional Terms. - - "Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - - When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - - Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders of -that material) supplement the terms of this License with terms: - - a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or - - b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or - - c) Prohibiting misrepresentation of the origin of that material, or - requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or - - d) Limiting the use for publicity purposes of names of licensors or - authors of the material; or - - e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or - - f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions of - it) with contractual assumptions of liability to the recipient, for - any liability that these contractual assumptions directly impose on - those licensors and authors. - - All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - - If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - - Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; -the above requirements apply either way. - - 8. Termination. - - You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - - However, if you cease all violation of this License, then your -license from a particular copyright holder is reinstated (a) -provisionally, unless and until the copyright holder explicitly and -finally terminates your license, and (b) permanently, if the copyright -holder fails to notify you of the violation by some reasonable means -prior to 60 days after the cessation. - - Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - - Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - - 9. Acceptance Not Required for Having Copies. - - You are not required to accept this License in order to receive or -run a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - - 10. Automatic Licensing of Downstream Recipients. - - Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - - An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - - You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - - 11. Patents. - - A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - - A contributor's "essential patent claims" are all patent claims -owned or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - - Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - - In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - - If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - - If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - - A patent license is "discriminatory" if it does not include within -the scope of its coverage, prohibits the exercise of, or is -conditioned on the non-exercise of one or more of the rights that are -specifically granted under this License. You may not convey a covered -work if you are a party to an arrangement with a third party that is -in the business of distributing software, under which you make payment -to the third party based on the extent of your activity of conveying -the work, and under which the third party grants, to any of the -parties who would receive the covered work from you, a discriminatory -patent license (a) in connection with copies of the covered work -conveyed by you (or copies made from those copies), or (b) primarily -for and in connection with specific products or compilations that -contain the covered work, unless you entered into that arrangement, -or that patent license was granted, prior to 28 March 2007. - - Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - - 12. No Surrender of Others' Freedom. - - If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you may -not convey it at all. For example, if you agree to terms that obligate you -to collect a royalty for further conveying from those to whom you convey -the Program, the only way you could satisfy both those terms and this -License would be to refrain entirely from conveying the Program. - - 13. Use with the GNU Affero General Public License. - - Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU Affero General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the special requirements of the GNU Affero General Public License, -section 13, concerning interaction through a network will apply to the -combination as such. - - 14. Revised Versions of this License. - - The Free Software Foundation may publish revised and/or new versions of -the GNU General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - - Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU General Public License, you may choose any version ever published -by the Free Software Foundation. - - If the Program specifies that a proxy can decide which future -versions of the GNU General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - - Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - - 15. Disclaimer of Warranty. - - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY -OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, -THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM -IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF -ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. Limitation of Liability. - - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS -THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY -GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE -USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF -DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD -PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), -EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMAGES. - - 17. Interpretation of Sections 15 and 16. - - If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -state the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - cdist - Copyright (C) 2019 ungleich-public - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper mail. - - If the program does terminal interaction, make it output a short -notice like this when it starts in an interactive mode: - - cdist Copyright (C) 2019 ungleich-public - This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, your program's commands -might be different; for a GUI interface, you would use an "about box". - - You should also get your employer (if you work as a programmer) or school, -if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU GPL, see -. - - The GNU General Public License does not permit incorporating your program -into proprietary programs. If your program is a subroutine library, you -may consider it more useful to permit linking proprietary applications with -the library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. But first, please read -. diff --git a/Makefile b/Makefile index 89286310..fa3327d1 100644 --- a/Makefile +++ b/Makefile @@ -35,9 +35,9 @@ DOCS_SRC_DIR=./docs/src SPEECHDIR=./docs/speeches TYPEDIR=./cdist/conf/type -SPHINXM=$(MAKE) -C $(DOCS_SRC_DIR) man -SPHINXH=$(MAKE) -C $(DOCS_SRC_DIR) html -SPHINXC=$(MAKE) -C $(DOCS_SRC_DIR) clean +SPHINXM=make -C $(DOCS_SRC_DIR) man +SPHINXH=make -C $(DOCS_SRC_DIR) html +SPHINXC=make -C $(DOCS_SRC_DIR) clean ################################################################################ # Manpages @@ -63,28 +63,16 @@ DOCSREFSH=$(DOCS_SRC_DIR)/cdist-reference.rst.sh $(DOCSREF): $(DOCSREFSH) $(DOCSREFSH) -# Html types list with references -DOCSTYPESREF=$(MAN7DSTDIR)/cdist-types.rst -DOCSTYPESREFSH=$(DOCS_SRC_DIR)/cdist-types.rst.sh - -$(DOCSTYPESREF): $(DOCSTYPESREFSH) - $(DOCSTYPESREFSH) - -DOCSCFGSKEL=./configuration/cdist.cfg.skeleton - -configskel: $(DOCSCFGSKEL) - cp -f "$(DOCSCFGSKEL)" "$(DOCS_SRC_DIR)/" - version: @[ -f "cdist/version.py" ] || { \ printf "Missing 'cdist/version.py', please generate it first.\n" && exit 1; \ } # Manpages #3: generic part -man: version configskel $(MANTYPES) $(DOCSREF) $(DOCSTYPESREF) +man: version $(MANTYPES) $(DOCSREF) $(SPHINXM) -html: version configskel $(MANTYPES) $(DOCSREF) $(DOCSTYPESREF) +html: version $(MANTYPES) $(DOCSREF) $(SPHINXH) docs: man html @@ -104,7 +92,7 @@ DOTMANTYPES=$(subst /man.rst,.rst,$(DOTMANTYPEPREFIX)) $(DOTMAN7DSTDIR)/cdist-type%.rst: $(DOTTYPEDIR)/%/man.rst ln -sf "$^" $@ -dotman: version configskel $(DOTMANTYPES) $(DOCSREF) $(DOCSTYPESREF) +dotman: version $(DOTMANTYPES) $(SPHINXM) ################################################################################ @@ -126,8 +114,6 @@ speeches: $(SPEECHES) # clean: docs-clean rm -f $(DOCS_SRC_DIR)/cdist-reference.rst - rm -f $(DOCS_SRC_DIR)/cdist-types.rst - rm -f $(DOCS_SRC_DIR)/cdist.cfg.skeleton find "$(DOCS_SRC_DIR)" -mindepth 2 -type l \ | xargs rm -f diff --git a/README b/README new file mode 100644 index 00000000..caf2dac8 --- /dev/null +++ b/README @@ -0,0 +1,7 @@ +cdist +----- + +cdist is a usable configuration management system. + +For the web documentation have a look at https://www.cdi.st/ +or at docs/src for reStructuredText manual. diff --git a/README-maintainers b/README-maintainers index 5766dd7d..af57f475 100644 --- a/README-maintainers +++ b/README-maintainers @@ -1,4 +1,4 @@ -Maintainers should use ./bin/cdist-build-helper script. +Maintainers should use ./bin/build-helper script. Makefile is intended for end users. It can be used for non-maintaining targets that can be run from pure source (without git repository). diff --git a/README.md b/README.md deleted file mode 100644 index a468dd86..00000000 --- a/README.md +++ /dev/null @@ -1,31 +0,0 @@ -# cdist - -**cdist** is a usable configuration management system. - -It adheres to the [**KISS principle**](https://en.wikipedia.org/wiki/KISS_principle) -and is being used in small up to enterprise grade environments. - -For more information have a look at [**homepage**](https://cdi.st) -or at **``docs/src``** for manual in **reStructuredText** format. - -## Contributing - -Merge/Pull requests can be made in both -[upstream **GitLab**](https://code.ungleich.ch/ungleich-public/cdist/merge_requests) -(managed by [**ungleich**](https://ungleich.ch)) -and [**GitHub** project](https://github.com/ungleich/cdist/pulls). - -Issues can be made and other project management activites happen -[**only in GitLab**](https://code.ungleich.ch/ungleich-public/cdist) -(needs [**ungleich** account](https://account.ungleich.ch)). - -For community-maintained types there is -[**cdist-contrib** project](https://code.ungleich.ch/ungleich-public/cdist-contrib). - -## Participating - -IRC: ``#cdist`` @ [libera](https://libera.chat) - -Matrix: ``#cdist:ungleich.ch`` - -Matrix and IRC are bridged. diff --git a/bin/cdist-build-helper b/bin/build-helper similarity index 84% rename from bin/cdist-build-helper rename to bin/build-helper index 6f514ef5..9a776491 100755 --- a/bin/cdist-build-helper +++ b/bin/build-helper @@ -1,6 +1,6 @@ #!/bin/sh # -# 2011-2022 Nico Schottelius (nico-cdist at schottelius.org) +# 2011-2013 Nico Schottelius (nico-cdist at schottelius.org) # 2016-2019 Darko Poljak (darko.poljak at gmail.com) # # This file is part of cdist. @@ -45,7 +45,7 @@ usage() { shellcheck-manifests shellcheck-local-gencodes shellcheck-remote-gencodes - shellcheck-bin + shellcheck-scripts shellcheck-gencodes shellcheck-types shellcheck @@ -74,7 +74,6 @@ SHELLCHECKCMD="shellcheck -s sh -f gcc -x" # Skip SC2154 for variables starting with __ since such variables are cdist # environment variables. SHELLCHECK_SKIP=': __.*is referenced but not assigned.*\[SC2154\]' -SHELLCHECKTMP=".shellcheck.tmp" # Change to checkout directory basedir="${0%/*}/../" @@ -100,7 +99,7 @@ case "$option" in if (\$0 ~ /^$end/) { exit } else { - print \$0 + print \$0 } } }" "$basedir/docs/changelog" @@ -135,7 +134,7 @@ case "$option" in version=$1; shift - ( + ( cat << eof Subject: cdist $version has been released @@ -336,7 +335,7 @@ eof make docs-clean make docs - ############################################################# + ############################################################# # Everything green, let's do the release # Tag the current commit @@ -370,7 +369,8 @@ eof cat << eof Manual steps post release: - cdist-web - - send generated mailinglist.tmp mail + - send mail body generated in mailinglist.tmp and inform Dmitry for deb + - twitter eof ;; @@ -405,7 +405,7 @@ eof ;; pycodestyle|pep8) - pycodestyle "${basedir}" "${basedir}/bin/cdist" + pycodestyle "${basedir}" "${basedir}/scripts/cdist" | less ;; check-pycodestyle) @@ -431,80 +431,57 @@ eof ;; shellcheck-global-explorers) - # shellcheck disable=SC2086 - find cdist/conf/explorer -type f -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}" - test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } + find cdist/conf/explorer -type f -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0 ;; shellcheck-type-explorers) - # shellcheck disable=SC2086 - find cdist/conf/type -type f -path "*/explorer/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}" - test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } + find cdist/conf/type -type f -path "*/explorer/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0 ;; shellcheck-manifests) - # shellcheck disable=SC2086 - find cdist/conf/type -type f -name manifest -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}" - test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } + find cdist/conf/type -type f -name manifest -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0 ;; shellcheck-local-gencodes) - # shellcheck disable=SC2086 - find cdist/conf/type -type f -name gencode-local -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}" - test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } + find cdist/conf/type -type f -name gencode-local -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0 ;; shellcheck-remote-gencodes) - # shellcheck disable=SC2086 - find cdist/conf/type -type f -name gencode-remote -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}" - test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } + find cdist/conf/type -type f -name gencode-remote -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0 ;; - # NOTE: shellcheck-scripts is kept for compatibility - shellcheck-bin|shellcheck-scripts) - # shellcheck disable=SC2086 - ${SHELLCHECKCMD} bin/cdist-dump bin/cdist-new-type > "${SHELLCHECKTMP}" - test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } + shellcheck-scripts) + ${SHELLCHECKCMD} scripts/cdist-dump scripts/cdist-new-type || exit 0 ;; shellcheck-gencodes) - errors=false - "$0" shellcheck-local-gencodes || errors=true - "$0" shellcheck-remote-gencodes || errors=true - ! $errors || exit 1 + "$0" shellcheck-local-gencodes + "$0" shellcheck-remote-gencodes ;; shellcheck-types) - errors=false - "$0" shellcheck-type-explorers || errors=true - "$0" shellcheck-manifests || errors=true - "$0" shellcheck-gencodes || errors=true - ! $errors || exit 1 + "$0" shellcheck-type-explorers + "$0" shellcheck-manifests + "$0" shellcheck-gencodes ;; shellcheck) - errors=false - "$0" shellcheck-global-explorers || errors=true - "$0" shellcheck-types || errors=true - "$0" shellcheck-bin || errors=true - ! $errors || exit 1 + "$0" shellcheck-global-explorers + "$0" shellcheck-types + "$0" shellcheck-scripts ;; shellcheck-type-files) - # shellcheck disable=SC2086 - find cdist/conf/type -type f -path "*/files/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" > "${SHELLCHECKTMP}" - test ! -s "${SHELLCHECKTMP}" || { cat "${SHELLCHECKTMP}"; exit 1; } + find cdist/conf/type -type f -path "*/files/*" -exec ${SHELLCHECKCMD} {} + | grep -v "${SHELLCHECK_SKIP}" || exit 0 ;; shellcheck-with-files) - errors=false - "$0" shellcheck || errors=true - "$0" shellcheck-type-files || errors=true - ! $errors || exit 1 + "$0" shellcheck + "$0" shellcheck-type-files ;; shellcheck-build-helper) - ${SHELLCHECKCMD} ./bin/cdist-build-helper + ${SHELLCHECKCMD} ./bin/build-helper ;; check-shellcheck) @@ -534,8 +511,7 @@ eof ;; version) - target_version="$(git describe | sed 's/-/.dev/; s/-/+/g')" - printf "VERSION = \"%s\"\n" "${target_version}" > cdist/version.py + printf "VERSION = \"%s\"\n" "$(git describe)" > cdist/version.py ;; target-version) @@ -559,7 +535,6 @@ eof # Temp files rm -f ./*.tmp - rm -f ./.*.tmp ;; distclean) diff --git a/bin/cdist b/bin/cdist index adb06a8d..645020a1 100755 --- a/bin/cdist +++ b/bin/cdist @@ -1,8 +1,7 @@ -#!/usr/bin/env python3 +#!/bin/sh # -*- coding: utf-8 -*- # -# 2010-2016 Nico Schottelius (nico-cdist at schottelius.org) -# 2016 Darko Poljak (darko.poljak at gmail.com) +# 2012 Nico Schottelius (nico-cdist at schottelius.org) # # This file is part of cdist. # @@ -21,83 +20,14 @@ # # -import logging -import os -import sys +# Wrapper for real script to allow execution from checkout +dir=${0%/*} -# See if this file's parent is cdist module -# and if so add it to module search path. -cdist_dir = os.path.realpath( - os.path.join( - os.path.dirname(os.path.realpath(__file__)), - os.pardir)) -cdist_init_dir = os.path.join(cdist_dir, 'cdist', '__init__.py') -if os.path.exists(cdist_init_dir): - sys.path.insert(0, cdist_dir) +# Ensure version is present - the bundled/shipped version contains a static version, +# the git version contains a dynamic version +"$dir/build-helper" version -import cdist # noqa 402 -import cdist.argparse # noqa 402 -import cdist.banner # noqa 402 -import cdist.config # noqa 402 -import cdist.install # noqa 402 -import cdist.shell # noqa 402 -import cdist.inventory # noqa 402 +libdir=$(cd "${dir}/../" && pwd -P) +export PYTHONPATH="${libdir}" - -def commandline(): - """Parse command line""" - - # preos subcommand hack - if len(sys.argv) > 1 and sys.argv[1] == 'preos': - return cdist.preos.PreOS.commandline(sys.argv[1:]) - parser, cfg = cdist.argparse.parse_and_configure(sys.argv[1:]) - args = cfg.get_args() - - # Work around python 3.3 bug: - # http://bugs.python.org/issue16308 - # http://bugs.python.org/issue9253 - - # FIXME: catching AttributeError also hides - # real problems.. try a different way - - # FIXME: we always print main help, not - # the help of the actual parser being used! - try: - getattr(args, "func") - except AttributeError: - parser['main'].print_help() - sys.exit(0) - - args.func(args) - - -if __name__ == "__main__": - if sys.version_info[:3] < cdist.MIN_SUPPORTED_PYTHON_VERSION: - print( - 'Python >= {} is required on the source host.'.format( - ".".join(map(str, cdist.MIN_SUPPORTED_PYTHON_VERSION))), - file=sys.stderr) - sys.exit(1) - - exit_code = 0 - - try: - import re - import os - - if re.match("__", os.path.basename(sys.argv[0])): - import cdist.emulator - emulator = cdist.emulator.Emulator(sys.argv) - emulator.run() - else: - commandline() - - except KeyboardInterrupt: - exit_code = 2 - - except cdist.Error as e: - log = logging.getLogger("cdist") - log.error(e) - exit_code = 1 - - sys.exit(exit_code) +"$dir/../scripts/cdist" "$@" diff --git a/cdist/__init__.py b/cdist/__init__.py index 31d49889..c673b3ba 100644 --- a/cdist/__init__.py +++ b/cdist/__init__.py @@ -22,27 +22,11 @@ import os import hashlib -import subprocess import cdist.log +import cdist.version - -VERSION = 'unknown version' - -try: - import cdist.version - VERSION = cdist.version.VERSION -except ModuleNotFoundError: - cdist_dir = os.path.abspath( - os.path.join(os.path.dirname(__file__), os.pardir)) - if os.path.isdir(os.path.join(cdist_dir, '.git')): - try: - VERSION = subprocess.check_output( - ['git', 'describe', '--always'], - cwd=cdist_dir, - universal_newlines=True) - except Exception: - pass +VERSION = cdist.version.VERSION BANNER = """ .. . .x+=:. s @@ -64,9 +48,6 @@ REMOTE_EXEC = "ssh -o User=root" REMOTE_CMDS_CLEANUP_PATTERN = "ssh -o User=root -O exit -S {}" -MIN_SUPPORTED_PYTHON_VERSION = (3, 5) - - class Error(Exception): """Base exception class for this project""" pass diff --git a/cdist/argparse.py b/cdist/argparse.py index 8f7bbb85..ca69cdae 100644 --- a/cdist/argparse.py +++ b/cdist/argparse.py @@ -5,14 +5,11 @@ import logging import collections import functools import cdist.configuration -import cdist.log import cdist.preos -import cdist.info -import cdist.scan.commandline # set of beta sub-commands -BETA_COMMANDS = set(('install', 'inventory', 'scan', )) +BETA_COMMANDS = set(('install', 'inventory', )) # set of beta arguments for sub-commands BETA_ARGS = { 'config': set(('tag', 'all_tagged_hosts', 'use_archiving', )), @@ -106,7 +103,7 @@ def get_parsers(): name="log level"), help=('Set the specified verbosity level. ' 'The levels, in order from the lowest to the highest, are: ' - 'ERROR (-1), WARNING (0), INFO (1), VERBOSE (2), DEBUG (3), ' + 'ERROR (-1), WARNING (0), INFO (1), VERBOSE (2), DEBUG (3) ' 'TRACE (4 or higher). If used along with -v then -v ' 'increases last set value and -l overwrites last set ' 'value.'), @@ -127,14 +124,6 @@ def get_parsers(): 'value.'), action='count', default=None) - parser['colored_output'] = argparse.ArgumentParser(add_help=False) - parser['colored_output'].add_argument( - '--colors', metavar='WHEN', - help="Colorize cdist's output based on log level; " - "WHEN is 'always', 'never', or 'auto'.", - action='store', dest='colored_output', required=False, - choices=cdist.configuration.ColoredOutputOption.CHOICES) - parser['beta'] = argparse.ArgumentParser(add_help=False) parser['beta'].add_argument( '-b', '--beta', @@ -207,13 +196,6 @@ def get_parsers(): 'supported. Without argument CPU count is used by default. '), action='store', dest='jobs', const=multiprocessing.cpu_count()) - parser['config_main'].add_argument( - '--log-server', - action='store_true', - help=('Start a log server for sub processes to use. ' - 'This is mainly useful when running cdist nested ' - 'from a code-local script. Log server is alwasy ' - 'implicitly started for \'install\' command.')) parser['config_main'].add_argument( '-n', '--dry-run', help='Do not execute code.', action='store_true') @@ -274,7 +256,8 @@ def get_parsers(): '-f', '--file', help=('Read specified file for a list of additional hosts to ' 'operate on or if \'-\' is given, read stdin (one host per ' - 'line).'), + 'line). If no host or host file is specified then, by ' + 'default, read hosts from stdin.'), dest='hostfile', required=False) parser['config_args'].add_argument( '-p', '--parallel', nargs='?', metavar='HOST_MAX', @@ -299,7 +282,6 @@ def get_parsers(): 'host', nargs='*', help='Host(s) to operate on.') parser['config'] = parser['sub'].add_parser( 'config', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['config_main'], parser['inventory_common'], @@ -318,7 +300,6 @@ def get_parsers(): parser['add-host'] = parser['invsub'].add_parser( 'add-host', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['add-host'].add_argument( @@ -326,12 +307,13 @@ def get_parsers(): parser['add-host'].add_argument( '-f', '--file', help=('Read additional hosts to add from specified file ' - 'or from stdin if \'-\' (each host on separate line). '), + 'or from stdin if \'-\' (each host on separate line). ' + 'If no host or host file is specified then, by default, ' + 'read from stdin.'), dest='hostfile', required=False) parser['add-tag'] = parser['invsub'].add_parser( 'add-tag', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['add-tag'].add_argument( @@ -340,12 +322,20 @@ def get_parsers(): parser['add-tag'].add_argument( '-f', '--file', help=('Read additional hosts to add tags from specified file ' - 'or from stdin if \'-\' (each host on separate line). '), + 'or from stdin if \'-\' (each host on separate line). ' + 'If no host or host file is specified then, by default, ' + 'read from stdin. If no tags/tagfile nor hosts/hostfile' + ' are specified then tags are read from stdin and are' + ' added to all hosts.'), dest='hostfile', required=False) parser['add-tag'].add_argument( '-T', '--tag-file', help=('Read additional tags to add from specified file ' - 'or from stdin if \'-\' (each tag on separate line). '), + 'or from stdin if \'-\' (each tag on separate line). ' + 'If no tag or tag file is specified then, by default, ' + 'read from stdin. If no tags/tagfile nor hosts/hostfile' + ' are specified then tags are read from stdin and are' + ' added to all hosts.'), dest='tagfile', required=False) parser['add-tag'].add_argument( '-t', '--taglist', @@ -355,7 +345,6 @@ def get_parsers(): parser['del-host'] = parser['invsub'].add_parser( 'del-host', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['del-host'].add_argument( @@ -366,12 +355,13 @@ def get_parsers(): parser['del-host'].add_argument( '-f', '--file', help=('Read additional hosts to delete from specified file ' - 'or from stdin if \'-\' (each host on separate line). '), + 'or from stdin if \'-\' (each host on separate line). ' + 'If no host or host file is specified then, by default, ' + 'read from stdin.'), dest='hostfile', required=False) parser['del-tag'] = parser['invsub'].add_parser( 'del-tag', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['del-tag'].add_argument( @@ -384,13 +374,20 @@ def get_parsers(): parser['del-tag'].add_argument( '-f', '--file', help=('Read additional hosts to delete tags for from specified ' - 'file or from stdin if \'-\' (each host on separate ' - 'line). '), + 'file or from stdin if \'-\' (each host on separate line). ' + 'If no host or host file is specified then, by default, ' + 'read from stdin. If no tags/tagfile nor hosts/hostfile' + ' are specified then tags are read from stdin and are' + ' deleted from all hosts.'), dest='hostfile', required=False) parser['del-tag'].add_argument( '-T', '--tag-file', help=('Read additional tags from specified file ' - 'or from stdin if \'-\' (each tag on separate line). '), + 'or from stdin if \'-\' (each tag on separate line). ' + 'If no tag or tag file is specified then, by default, ' + 'read from stdin. If no tags/tagfile nor' + ' hosts/hostfile are specified then tags are read from' + ' stdin and are added to all hosts.'), dest='tagfile', required=False) parser['del-tag'].add_argument( '-t', '--taglist', @@ -400,7 +397,6 @@ def get_parsers(): parser['list'] = parser['invsub'].add_parser( 'list', parents=[parser['loglevel'], parser['beta'], - parser['colored_output'], parser['common'], parser['inventory_common']]) parser['list'].add_argument( @@ -428,87 +424,18 @@ def get_parsers(): parser['inventory'].set_defaults( func=cdist.inventory.Inventory.commandline) - # PreOS + # PreOs parser['preos'] = parser['sub'].add_parser('preos', add_help=False) # Shell parser['shell'] = parser['sub'].add_parser( - 'shell', parents=[parser['loglevel'], parser['colored_output']]) + 'shell', parents=[parser['loglevel']]) parser['shell'].add_argument( '-s', '--shell', help=('Select shell to use, defaults to current shell. Used shell' ' should be POSIX compatible shell.')) parser['shell'].set_defaults(func=cdist.shell.Shell.commandline) - # Info - parser['info'] = parser['sub'].add_parser('info') - parser['info'].add_argument( - '-a', '--all', help='Display all info. This is the default.', - action='store_true', default=False) - parser['info'].add_argument( - '-c', '--conf-dir', - help='Add configuration directory (can be repeated).', - action='append') - parser['info'].add_argument( - '-e', '--global-explorers', - help='Display info for global explorers.', action='store_true', - default=False) - parser['info'].add_argument( - '-F', '--fixed-string', - help='Interpret pattern as a fixed string.', action='store_true', - default=False) - parser['info'].add_argument( - '-f', '--full', help='Display full details.', - action='store_true', default=False) - parser['info'].add_argument( - '-g', '--config-file', - help='Use specified custom configuration file.', - dest="config_file", required=False) - parser['info'].add_argument( - '-t', '--types', help='Display info for types.', - action='store_true', default=False) - parser['info'].add_argument( - 'pattern', nargs='?', help='Glob pattern.') - parser['info'].set_defaults(func=cdist.info.Info.commandline) - - # Scan = config + further - parser['scan'] = parser['sub'].add_parser( - 'scan', parents=[parser['loglevel'], - parser['beta'], - parser['colored_output'], - parser['common'], - parser['config_main']]) - - parser['scan'].add_argument( - '-m', '--mode', help='Which modes should run', - action='append', default=[], - choices=['scan', 'trigger', 'config']) - parser['scan'].add_argument( - '--list', - action='store_true', - help='List the known hosts and exit') - parser['scan'].add_argument( - '--config', - action='store_true', - help='Try to configure detected hosts') - parser['scan'].add_argument( - '-I', '--interface', - action='append', default=[], required=True, - help='On which interfaces to scan/trigger') - parser['scan'].add_argument( - '--name-mapper', - action='store', default=None, - help='Map addresses to names, required for config mode') - parser['scan'].add_argument( - '-d', '--config-delay', - action='store', default=3600, type=int, - help='How long (seconds) to wait before reconfiguring after last try') - parser['scan'].add_argument( - '-t', '--trigger-delay', - action='store', default=5, type=int, - help='How long (seconds) to wait between ICMPv6 echo requests') - parser['scan'].set_defaults(func=cdist.scan.commandline.commandline) - for p in parser: parser[p].epilog = EPILOG @@ -519,12 +446,7 @@ def handle_loglevel(args): if hasattr(args, 'quiet') and args.quiet: args.verbose = _verbosity_level_off - logging.getLogger().setLevel(_verbosity_level[args.verbose]) - - -def handle_log_colors(args): - if cdist.configuration.ColoredOutputOption.translate(args.colored_output): - cdist.log.CdistFormatter.USE_COLORS = True + logging.root.setLevel(_verbosity_level[args.verbose]) def parse_and_configure(argv, singleton=True): @@ -538,14 +460,13 @@ def parse_and_configure(argv, singleton=True): raise cdist.Error(str(e)) # Loglevels are handled globally in here handle_loglevel(args) - handle_log_colors(args) log = logging.getLogger("cdist") - log.verbose("version %s", cdist.VERSION) - log.trace('command line args: %s', cfg.command_line_args) - log.trace('configuration: %s', cfg.get_config()) - log.trace('configured args: %s', args) + log.verbose("version %s" % cdist.VERSION) + log.trace('command line args: {}'.format(cfg.command_line_args)) + log.trace('configuration: {}'.format(cfg.get_config())) + log.trace('configured args: {}'.format(args)) check_beta(vars(args)) diff --git a/cdist/conf/explorer/cpu_cores b/cdist/conf/explorer/cpu_cores index 81e5294e..a52bddac 100755 --- a/cdist/conf/explorer/cpu_cores +++ b/cdist/conf/explorer/cpu_cores @@ -32,11 +32,6 @@ case "$os" in sysctl -n hw.ncpuonline ;; - "freebsd"|"netbsd") - PATH=$(getconf PATH) - sysctl -n hw.ncpu - ;; - *) if [ -r /proc/cpuinfo ]; then cores="$(grep "core id" /proc/cpuinfo | sort | uniq | wc -l)" diff --git a/cdist/conf/explorer/disks b/cdist/conf/explorer/disks index 56d62d10..87a6b5c6 100755 --- a/cdist/conf/explorer/disks +++ b/cdist/conf/explorer/disks @@ -1,66 +1,27 @@ -#!/bin/sh -e -# -# based on previous work by other people, modified by: -# 2020 Dennis Camera -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Finds disks of the system (excl. ram disks, floppy, cdrom) +#!/bin/sh uname_s="$(uname -s)" -case $uname_s in +case "${uname_s}" in FreeBSD) sysctl -n kern.disks ;; - OpenBSD) - sysctl -n hw.disknames | grep -Eo '[lsw]d[0-9]+' - ;; - NetBSD) - PATH=$(getconf PATH) - sysctl -n hw.disknames | awk -v RS=' ' '/^[lsw]d[0-9]+/' + OpenBSD|NetBSD) + sysctl -n hw.disknames | grep -Eo '[lsw]d[0-9]+' | xargs ;; Linux) - # list of major device numbers toexclude: - # ram disks, floppies, cdroms - # https://www.kernel.org/doc/Documentation/admin-guide/devices.txt - ign_majors='1 2 11' - - if command -v lsblk >/dev/null 2>&1 + if command -v lsblk > /dev/null then - lsblk -e "$(echo "$ign_majors" | tr ' ' ',')" -dno name - elif test -d /sys/block/ - then - # shellcheck disable=SC2012 - ls -1 /sys/block/ \ - | awk -v ign_majors="$(echo "$ign_majors" | tr ' ' '|')" ' - { - devfile = "/sys/block/" $0 "/dev" - getline devno < devfile - close(devfile) - if (devno !~ "^(" ign_majors "):") print - }' + # exclude ram disks, floppies and cdroms + # https://www.kernel.org/doc/Documentation/admin-guide/devices.txt + lsblk -e 1,2,11 -dno name | xargs else - echo "Don't know how to list disks on Linux without lsblk and sysfs." >&2 - echo 'If you can, please submit a patch.'>&2 + printf "Don't know how to list disks for %s operating system without lsblk, if you can please submit a patch\n" "${uname_s}" >&2 fi ;; *) - printf "Don't know how to list disks for %s operating system.\n" "${uname_s}" >&2 - printf 'If you can please submit a patch\n' >&2 + printf "Don't know how to list disks for %s operating system, if you can please submit a patch\n" "${uname_s}" >&2 ;; -esac \ -| xargs +esac + +exit 0 diff --git a/cdist/conf/explorer/hostname b/cdist/conf/explorer/hostname index dca004d1..7715c6b0 100755 --- a/cdist/conf/explorer/hostname +++ b/cdist/conf/explorer/hostname @@ -1,6 +1,7 @@ #!/bin/sh # -# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) +# 2010-2014 Nico Schottelius (nico-cdist at schottelius.org) +# 2012 Steven Armstrong (steven-cdist at armstrong.cc) # # This file is part of cdist. # @@ -18,12 +19,7 @@ # along with cdist. If not, see . # # -# Retrieve the running hostname -# -if command -v hostname >/dev/null -then - hostname -else - uname -n +if command -v uname >/dev/null; then + uname -n fi diff --git a/cdist/conf/explorer/init b/cdist/conf/explorer/init index f27c77ef..a8a7857e 100755 --- a/cdist/conf/explorer/init +++ b/cdist/conf/explorer/init @@ -1,8 +1,7 @@ -#!/bin/sh -e +#!/bin/sh # # 2016 Daniel Heule (hda at sfs.biz) # Copyright 2017, Philippe Gregoire -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -20,423 +19,21 @@ # along with cdist. If not, see . # # -# Returns the name of the init system (PID 1) - -# Expected values: -# Linux: -# Adélie Linux: -# sysvinit+openrc -# Alpine Linux: -# busybox-init+openrc -# ArchLinux: -# systemd, sysvinit -# CRUX: -# sysvinit -# Debian: -# systemd, upstart, sysvinit, openrc, ??? -# Devuan: -# sysvinit, sysvinit+openrc -# Gentoo: -# sysvinit+openrc, openrc-init, systemd -# OpenBMC: -# systemd -# OpenWrt: -# procd, init??? -# RedHat (RHEL, CentOS, Fedora, RedHat Linux, ...): -# systemd, upstart, upstart-legacy, sysvinit -# Slackware: -# sysvinit -# SuSE: -# systemd, sysvinit -# Ubuntu: -# systemd, upstart, upstart-legacy, sysvinit -# VoidLinux: -# runit +# Returns the process name of pid 1 ( normaly the init system ) +# for example at linux this value is "init" or "systemd" in most cases # -# GNU: -# Debian: -# sysvinit, hurd-init -# -# BSD: -# {Free,Open,Net}BSD: -# init -# -# Mac OS X: -# launchd, init+SystemStarter -# -# Solaris/Illumos: -# smf, init??? -# NOTE: init systems can be stacked. This is popular to run OpenRC on top of -# sysvinit (Gentoo) or busybox-init (Alpine), but can also be used to run runit -# as a systemd service. This makes init system detection very complicated -# (which result is expected?) This script tries to untangle some combinations, -# OpenRC on top of sysv or busybox (X+openrc), but will ignore others (runit as -# a systemd service) +uname_s="$(uname -s)" -# NOTE: When we have no idea, nothing will be printed! - -# NOTE: -# When trying to gather information about the init system make sure to do so -# without calling the binary! On some systems this triggers a reinitialisation -# of the system which we don't want (e.g. embedded systems). - - -set -e - -KERNEL_NAME=$(uname -s) - -KNOWN_INIT_SYSTEMS=$(cat </dev/null 2>&1 || return 1 - launchctl getenv PATH >/dev/null || return 1 - echo launchd -} - -check_openrc() { - test -f /run/openrc/softlevel || return 1 - echo openrc -} - -check_procd() ( - procd_path=${1:-/sbin/procd} - test -x "${procd_path}" || return 1 - grep -q 'procd' "${procd_path}" || return 1 - echo procd -) - -check_runit() { - test -d /run/runit || return 1 - echo runit -} - -check_smf() { - # XXX: Is this the correct way?? - test -f /etc/svc/volatile/svc_nonpersist.db || return 1 - echo smf -} - -check_systemd() { - # NOTE: sd_booted(3) - test -d /run/systemd/system/ || return 1 - # systemctl --version | sed -e '/^systemd/!d;s/^systemd //' - echo systemd -} - -check_systemstarter() { - test -d /System/Library/StartupItems/ || return 1 - test -f /System/Library/StartupItems/LoginWindow/StartupParameters.plist || return 1 - echo init+SystemStarter -} - -check_sysvinit() ( - init_path=${1:-/sbin/init} - test -x "${init_path}" || return 1 - grep -q 'INIT_VERSION=sysvinit-[0-9.]*' "${init_path}" || return 1 - - # It is quite common to use SysVinit to stack other init systemd - # (like OpenRC) on top of it. So we check for that, too. - if stacked=$(check_openrc) - then - echo "sysvinit+${stacked}" - else - echo sysvinit - fi - unset stacked -) - -check_upstart() { - test -x "$(command -v initctl)" || return 1 - case $(initctl version) - in - *'(upstart '*')') - if test -d /etc/init - then - # modern (DBus-based?) upstart >= 0.5 - echo upstart - elif test -d /etc/event.d - then - # ancient upstart - echo upstart-legacy - else - # whatever... - echo upstart - fi - ;; - *) - return 1 - ;; - esac -} - -find_init_procfs() ( - # First, check if the required file in procfs exists... - test -h /proc/1/exe || return 1 - - # Find init executable - init_exe=$(ls -l /proc/1/exe 2>/dev/null) || return 1 - init_exe=${init_exe#* -> } - - if ! test -x "$init_exe" - then - # On some rare occasions it can happen that the - # running init's binary has been replaced. In this - # case Linux adjusts the symlink to "X (deleted)" - - # [root@fedora-12 ~]# readlink /proc/1/exe - # /sbin/init (deleted) - # [root@fedora-12 ~]# ls -l /proc/1/exe - # lrwxrwxrwx. 1 root root 0 2020-01-30 23:00 /proc/1/exe -> /sbin/init (deleted) - - init_exe=${init_exe% (deleted)} - test -x "$init_exe" || return 1 - fi - - echo "${init_exe}" -) - -guess_by_path() { - case $1 - in - /bin/busybox) - check_busybox_init "$1" && return - ;; - /lib/systemd/systemd) - check_systemd "$1" && return - ;; - /hurd/init) - check_hurd_init "$1" && return - ;; - /sbin/launchd) - check_launchd "$1" && return - ;; - /usr/bin/runit|/sbin/runit) - check_runit "$1" && return - ;; - /sbin/openrc-init) - if check_openrc "$1" >/dev/null - then - echo openrc-init - return - fi - ;; - /sbin/procd) - check_procd "$1" && return - ;; - /sbin/init|*/init) - # init: it could be anything -> (explicit) no match - return 1 - ;; - esac - - # No match - return 1 -} - -guess_by_comm_name() { - case $1 - in - busybox) - check_busybox_init && return - ;; - openrc-init) - if check_openrc >/dev/null - then - echo openrc-init - return 0 - fi - ;; - init) - # init could be anything -> no match - return 1 - ;; - *) - # Run check function by comm name if available. - # Fall back to comm name if either it does not exist or - # returns non-zero. - if type "check_$1" >/dev/null - then - "check_$1" && return - else - echo "$1" ; return 0 - fi - esac - - return 1 -} - -check_list() ( - # List must be a multi-line input on stdin (one name per line) - while read -r init - do - "check_${init}" || continue - return 0 - done - return 1 -) - - -# BusyBox's versions of ps and pgrep do not support some options -# depending on which compile-time options have been used. - -find_init_pgrep() { - pgrep -P0 -fl 2>/dev/null | awk -F '[[:blank:]]' '$1 == 1 { print $2 }' -} - -find_init_ps() { - case $KERNEL_NAME - in - Darwin) - ps -o command -p 1 2>/dev/null | tail -n +2 - ;; - FreeBSD) - ps -o args= -p 1 2>/dev/null | cut -d ' ' -f 1 - ;; - Linux) - ps -o comm= -p 1 2>/dev/null - ;; - NetBSD) - ps -o comm= -p 1 2>/dev/null - ;; - OpenBSD) - ps -o args -p 1 2>/dev/null | tail -n +2 | cut -d ' ' -f 1 - ;; - *) - ps -o args= -p 1 2>/dev/null - ;; - esac | trim # trim trailing whitespace (some ps like Darwin add it) -} - -find_init() { - case $KERNEL_NAME - in - Linux|GNU|NetBSD) - find_init_procfs || find_init_pgrep || find_init_ps - ;; - FreeBSD) - find_init_procfs || find_init_ps - ;; - OpenBSD) - find_init_pgrep || find_init_ps - ;; - Darwin|SunOS) - find_init_ps - ;; - *) - echo "Don't know how to determine init." >&2 - echo 'Please send a patch.' >&2 - exit 1 - esac -} - -# ----- - -init=$(find_init) - -# If we got a path, guess by the path first (fall back to file name if no match) -# else guess by file name directly. -# shellcheck disable=SC2015 -{ - test -x "${init}" \ - && guess_by_path "${init}" \ - || guess_by_comm_name "$(basename "${init}")" -} && exit 0 || true - - -# Guessing based on the file path and name didn’t lead to a definitive result. -# -# We go through all of the checks until we find a match. To speed up the -# process, common cases will be checked first based on the underlying kernel. - -{ common_candidates_by_kernel; echo "${KNOWN_INIT_SYSTEMS}"; } \ - | unique | check_list +case "$uname_s" in + Linux) + (pgrep -P0 -l | awk '/^1[ \t]/ {print $2;}') || true + ;; + FreeBSD|OpenBSD) + ps -o comm= -p 1 || true + ;; + *) + # return a empty string as unknown value + echo "" + ;; +esac diff --git a/cdist/conf/explorer/lsb_codename b/cdist/conf/explorer/lsb_codename index c9fb5cdf..26bb8e3d 100755 --- a/cdist/conf/explorer/lsb_codename +++ b/cdist/conf/explorer/lsb_codename @@ -21,9 +21,6 @@ set +e case "$("$__explorer/os")" in - checkpoint) - awk '{printf("%s\n", $(NF-1))}' /etc/cp-release - ;; openwrt) # shellcheck disable=SC1091 (. /etc/openwrt_release && echo "$DISTRIB_CODENAME") diff --git a/cdist/conf/explorer/lsb_description b/cdist/conf/explorer/lsb_description index 7279a9c2..b1009627 100755 --- a/cdist/conf/explorer/lsb_description +++ b/cdist/conf/explorer/lsb_description @@ -21,9 +21,6 @@ set +e case "$("$__explorer/os")" in - checkpoint) - cat /etc/cp-release - ;; openwrt) # shellcheck disable=SC1091 (. /etc/openwrt_release && echo "$DISTRIB_DESCRIPTION") diff --git a/cdist/conf/explorer/lsb_id b/cdist/conf/explorer/lsb_id index 1f91cc40..82ff9977 100755 --- a/cdist/conf/explorer/lsb_id +++ b/cdist/conf/explorer/lsb_id @@ -21,9 +21,6 @@ set +e case "$("$__explorer/os")" in - checkpoint) - echo "CheckPoint" - ;; openwrt) # shellcheck disable=SC1091 (. /etc/openwrt_release && echo "$DISTRIB_ID") diff --git a/cdist/conf/explorer/lsb_release b/cdist/conf/explorer/lsb_release index 0bb9f7fe..5ebfff1a 100755 --- a/cdist/conf/explorer/lsb_release +++ b/cdist/conf/explorer/lsb_release @@ -21,9 +21,6 @@ set +e case "$("$__explorer/os")" in - checkpoint) - sed /etc/cp-release -e 's/.* R\([1-9][0-9]*\)\.[0-9]*$/\1/' - ;; openwrt) # shellcheck disable=SC1091 (. /etc/openwrt_release && echo "$DISTRIB_RELEASE") diff --git a/cdist/conf/explorer/machine_type b/cdist/conf/explorer/machine_type index c31f5ca6..bb21f69c 100755 --- a/cdist/conf/explorer/machine_type +++ b/cdist/conf/explorer/machine_type @@ -1,6 +1,7 @@ -#!/bin/sh -e +#!/bin/sh # -# 2021 Dennis Camera (cdist at dtnr.ch) +# 2014 Daniel Heule (hda at sfs.biz) +# 2014 Thomas Oettli (otho at sfs.biz) # # This file is part of cdist. # @@ -17,1019 +18,63 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -# This explorer tries to determine what type of machine the target to be -# configured is (container, virtual machine, bare-metal). -# -# It will print one line for each layer it can detect. -# The format of all lines is: TYPE[ VERB VENDOR] -# -# VERB does not have a special meaning, it is just for better readability. -# -# e.g. -# container -# container on lxc -# virtual by kvm-spapr -# -# The third word of each line (except the first) can be composed of different -# parts concatenated with a `-' (minus) character, with each component being -# a specification of the previous, e.g.: -# - lxc-libvirt (LXC container, managed by libvirt) -# - lpar-s390 / lpar-power (LPAR running on IBM S/390 or POWER, respectively) -# - xen-hvm / xen-pv (Xen HVM vs para-virtualization) -# -# If this explorer cannot collect enough information about virtualization it -# will fall back to 'physical'. # -# Add /sbin and /usr/sbin to the path so we can find system -# binaries like dmidecode. -PATH=$(getconf PATH 2>/dev/null) || PATH='/usr/bin:/bin' -PATH="/sbin:/usr/sbin:${PATH}" -export PATH +# FIXME: other system types (not linux ...) -arch=$(uname -m | sed -e 's/i.86/i386/' -e 's/arm.*/arm/') -uname_s=$(uname -s) - - -is_command() { command -v "$1" >/dev/null 2>&1; } - -files_same() { - # shellcheck disable=SC2012 - LC_ALL=C df -P "$1" "$2" 2>/dev/null | { - read -r _ # skip header line - read -r fs1 _ _ _ _ mp1 - read -r fs2 _ _ _ _ mp2 - test "${fs1}" = "${fs2}" -a "${mp1}" = "${mp2}" || return 1 - } && - ls -1Ldi "$1" "$2" 2>/dev/null | { - read -r ino1 _ - read -r ino2 _ - test "${ino1}" = "${ino2}" || return 1 - } -} - -is_oneof() ( - x=$1; shift - for y - do - test "${x}" = "${y}" || continue - return 0 - done - return 1 -) - -tolower() { LC_ALL=C tr '[:upper:]' '[:lower:]'; } - -# shellcheck disable=SC2086 -glob_exists() { set -- $1; test -e "$1"; } - -get_dmi_field() { - if is_oneof "${uname_s}" NetBSD - then - case $1 - in - (system-manufacturer) _mib=machdep.dmi.system-vendor ;; - (system-product-name) _mib=machdep.dmi.system-product ;; - (system-version|system-uuid) _mib=machdep.dmi.$1 ;; - (bios-vendor|bios-version) _mib=machdep.dmi.$1 ;; - (biod-release-date) _mib=machdep.dmi.bios-date ;; - (*) _mib= ;; - esac - - test -n "${_mib}" && get_sysctl "${_mib}" | grep -e . && return - fi - - if is_command dmidecode - then - dmidecode -s "$1" - elif test -d "${dmi_sysfs-}" - then - case $1 - in - (system-manufacturer) _filename=sys_vendor ;; - (system-product-name) _filename=product_name ;; - (*) _filename=$(echo "$1" | tr - _) ;; - esac - if test -r "${dmi_sysfs-}/${_filename}" - then - cat "${dmi_sysfs}/${_filename}" - fi - unset _filename - elif test "${uname_s}" = OpenBSD - then - # NOTE: something similar to system-manufacutrer and system-product-name - # is available on OpenBSD in sysctl - case $1 - in - (system-manufacturer) _mib=hw.vendor ;; - (system-product-name) _mib=hw.product ;; - (*) _mib= ;; - esac - - test -n "${_mib}" && get_sysctl "${_mib}" | grep -e . && return - fi - - return 1 -} - -has_cpuinfo() { test -e /proc/cpuinfo; } - -get_sysctl() { - is_command sysctl && sysctl -n "$1" 2>/dev/null -} - -detected_layer() { - test -n "${_toplayer:-}" || echo "${_toplayer:=${1:?}}" -} - - -# Check for chroot - -has_chroot_systemd() { - is_command systemd-detect-virt && systemd-detect-virt --help | grep -q -e '^ -r' -} - -check_chroot_systemd() { - systemd-detect-virt -r -} - -has_chroot_debian_ischroot() { - is_command ischroot -} - -check_chroot_debian_ischroot() { - ischroot --default-false -} - -has_chroot_procfs() { - test -d /proc/ -} - -check_chroot_procfs() ( - is_chroot=false # default - if test -e /proc/1/root && ! files_same /proc/1/root / - then - is_chroot=true - fi - if test -e /proc/1/mountinfo -a -e /proc/self/mountinfo - then - has_mountinfo=true - cmp -s /proc/1/mountinfo /proc/self/mountinfo || is_chroot=true - fi - - if ${is_chroot} - then - # try to determine where the chroot has been mounted - rootdev=$(LC_ALL=C df -P / | awk 'NR==2{print $1}') - - if test -e "${rootdev}" - then - # escape chroot to determine where the device containing the - # chroot's / is mounted - rootdevmnt=$(LC_ALL=C chroot /proc/1/root df -P "${rootdev}" | awk 'NR==2{print $6}') - - # shellcheck disable=SC2012 - root_ino=$(ls -1di / | awk '{print $1}') - - # escape chroot and find mount point by inode - chroot /proc/1/root find "${rootdevmnt}" -xdev -type d -inum "${root_ino}" - elif ${has_mountinfo} - then - while read -r mntid _ _ _ cmntpnt _ - do - read -r _ _ _ _ hmntpnt _ <<-EOF - $(grep -e "^$((mntid)) " /proc/1/mountinfo) - EOF - printf '%s\n' "${hmntpnt%${cmntpnt}}" - done /dev/null) && - case ${_ctengine} - in - (''|'none') - return 1 ;; - ('container-other') - return 0 ;; - ('systemd-nspawn') - echo systemd_nspawn ;; - (*) - echo "${_ctengine}" ;; - esac -) - -has_ct_pid_1() { - test -r /run/systemd/container -o -r /proc/1/environ -} - -translate_container_name() { - case $1 - in - ('lxc') - echo lxc ;; - ('lxc-libvirt') - echo lxc-libvirt ;; - ('podman') - echo podman ;; - ('systemd-nspawn') - echo systemd_nspawn ;; - (*) - return 1 ;; - esac - return 0 -} - -check_ct_pid_1() { - if test -r /run/systemd/container - then - translate_container_name "$(head -n1 /run/systemd/container)" \ - && return 0 - fi - - if test -r /proc/1/environ - then - translate_container_name "$( - LC_ALL=C tr '\000' '\n' /dev/null - then - # https://github.com/Microsoft/WSL/issues/423#issuecomment-221627364 - echo wsl - elif test -d /var/.cagefs - then - # https://docs.cloudlinux.com/cloudlinux_os_components/#cagefs - # CageFS is not "really" a container, but it isn't a chroot either. - echo cagefs - elif test -e /proc/self/status && grep -q -e '^VxID: [0-9]\{1,\}' /proc/self/status - then - # Linux-VServer - if grep -q -x -F 'VxID: 0' /proc/self/status - then - # host - return 1 - else - # guest - echo linux_vserver - fi - else - return 1 - fi -} - -check_ct_os_specific() ( - if jailed=$(get_sysctl security.jail.jailed) && test "${jailed}" = 1 - then - # FreeBSD jail - echo jail - return 0 - fi - - if is_command zonename && test "$(zonename)" != global - then - # Solaris zone - echo zone - return 0 - fi - - return 1 -) - - -# Check for hypervisor - -guess_hypervisor_from_cpu_model() { - case $1 - in - (*\ KVM\ *) - echo kvm ;; - (*\ QEMU\ *|QEMU\ *) - echo qemu ;; - (*) - return 1 ;; - esac -} - -has_vm_systemd() { - is_command systemd-detect-virt && systemd-detect-virt --help | grep -q -e '^ -v' -} - -check_vm_systemd() ( - _hypervisor=$(systemd-detect-virt -v 2>/dev/null) && - case ${_hypervisor} - in - (''|'none') - return 1 ;; - ('amazon') - echo aws ;; - ('bochs') - echo kvm ;; - ('microsoft') - # assumption - echo hyperv ;; - ('oracle') - echo virtualbox ;; - ('vm-other') - return 0 ;; - (*) - echo "${_hypervisor}" ;; - esac -) - -has_vm_cpuinfo() { has_cpuinfo; } - -check_vm_cpuinfo() { - if grep -q -F 'User Mode Linux' /proc/cpuinfo \ - || grep -q -F 'UML' /proc/cpuinfo - then - # User Mode Linux - echo uml - elif grep -q -e '^vendor_id.*: PowerVM Lx86' /proc/cpuinfo - then - # IBM PowerVM Lx86 (Linux/x86 emulator) - echo powervm_lx86 - elif grep -q -e '^vendor_id.*: IBM/S390' /proc/cpuinfo - then - # IBM SystemZ (S/390) - if test -f /proc/sysinfo - then - if grep -q -e '^VM[0-9]* Control Program: KVM/Linux' /proc/sysinfo - then - echo kvm-s390 - return 0 - elif grep -q -e '^VM[0-9]* Control Program: z/VM' /proc/sysinfo - then - echo zvm - return 0 - elif grep -q -e '^LPAR ' /proc/sysinfo - then - echo zvm-lpar - return 0 - fi - fi - return 1 - else - if grep -q -e '^model name.*:' /proc/cpuinfo - then - sed -n -e 's/^model name[^:]*: *//p' /proc/cpuinfo \ - | while read -r _cpu_model - do - guess_hypervisor_from_cpu_model "${_cpu_model}" - done \ - | sort \ - | uniq -c \ - | awk ' - { if ($1 > most_c) { most_c = $1; most_s = $2 } } - END { - if (most_s) print most_s - exit !most_s - }' \ - && return 0 - fi - return 1 - fi -} - -check_vm_arch_specific() { - case ${arch} - in - (ppc64|ppc64le) - # Check PPC64 LPAR, KVM - - # example /proc/cpuinfo line indicating 'not baremetal' - # platform : pSeries - # - # example /proc/ppc64/lparcfg systemtype line - # system_type=IBM pSeries (emulated by qemu) - - if has_cpuinfo && grep -q -e 'platform.**pSeries' /proc/cpuinfo - then - if test -e /proc/ppc64/lparcfg - then - # Assume LPAR, now detect shared or dedicated - if grep -q -x -F 'shared_processor_mode=1' /proc/ppc64/lparcfg - then - echo powervm-shared - return 0 - else - echo powervm-dedicated - return 0 - fi - fi - fi - ;; - (sparc*) - # Check for SPARC LDoms - - if test -e /dev/mdesc - then - if test -d /sys/class/vlds/ctrl -a -d /sys/class/vlds/sp - then - # control LDom - return 1 - else - # guest LDom - echo ldom-sparc - fi - - # MDPROP=/usr/lib/ldoms/mdprop.py - # if test -x "${MDPROP}" - # then - # if test -n "$("${MDPROP}" -v iodevice device-type=pciex)" - # then - # echo ldoms-root - # echo ldoms-io - # elif test -n "$("${MDPROP}" -v iov-device vf-id=0)" - # then - # echo ldoms-io - # fi - # fi - return 0 - fi - ;; - (i?86|x86*|amd64|i86pc) - # VMM CPUID flag denotes that this system is running under a VMM - if is_oneof "${uname_s}" Darwin - then - get_sysctl machdep.cpu.features | tr ' ' '\n' | grep -qixF VMM \ - && return 0 - fi - if has_cpuinfo \ - && grep -q -i -e '^flags.*:.*\(hypervisor\|vmm\)\( \|$\)' /proc/cpuinfo - then - return 0 - fi - ;; - (ia64) - if test -d /sys/bus/xen -a ! -d /sys/bus/xen-backend - then - # PV-on-HVM drivers installed in a Xen guest - echo xen-hvm - return 0 - fi - ;; - esac - return 1 -} - -has_vm_dmi() { - # Check for various products in SMBIOS/DMI. - # Note that DMI doesn't exist on all architectures (only x86 and some ARM). - # On other architectures the $dmi variable will be empty. - - if test -d /sys/class/dmi/id/ - then - dmi_sysfs=/sys/class/dmi/id - elif test -d /sys/devices/virtual/dmi/id/ - then - dmi_sysfs=/sys/devices/virtual/dmi/id - fi - - # shellcheck disable=SC2015 - { - is_command dmidecode \ - && ( - # dmidecode needs to exit 0 and not print the No SMBIOS/DMI line - dmi_out=$(dmidecode 2>&1) \ - && ! printf '%s\n' "${dmi_out}" \ - | grep -qF 'No SMBIOS nor DMI entry point found, sorry.' - ) \ - || test -d "${dmi_sysfs}" - } -} - -check_vm_dmi() { - case $(get_dmi_field system-product-name) - in - (*.metal) - if test "$(get_dmi_field system-manufacturer)" = 'Amazon EC2' - then - # AWS EC2 bare metal -> no virtualisation - return 1 - fi - ;; - ('BHYVE') - echo bhyve - return 0 - ;; - ('Google Compute Engine') - echo gce - return 0 - ;; - ('RHEV Hypervisor') - # Red Hat Enterprise Virtualization - echo rhev - return 0 - ;; - ('KVM'|'Bochs'|'KVM Virtual Machine') - echo kvm - return 0 - ;; - ('Parallels Virtual Platform') - echo parallels - return 0 - ;; - ('VirtualBox') - echo virtualbox - return 0 - ;; - ('VMware Virtual Platform') - echo vmware - return 0 - ;; - esac - - case $(get_dmi_field system-manufacturer) - in - ('Alibaba'*) - case $(get_dmi_field system-product-name) - in - ('Alibaba Cloud ECS') - echo alibaba-ecs - ;; - (*) - echo alibaba - ;; - esac - return 0 - ;; - ('Amazon EC2') - # AWS on bare-metal or KVM - echo aws-ec2 - return 0 - ;; - ('innotek GmbH'|'Oracle Corporation') - echo virtualbox - return 0 - ;; - ('Joyent') - if test "$(get_dmi_field system-product-name)" = 'SmartDC HVM' - then - # SmartOS KVM - echo kvm-smartdc_hvm - return 0 - fi - ;; - ('Microsoft Corporation'*) - if test "$(get_dmi_field system-product-name)" = 'Virtual Machine' - then - if test -e /proc/irq/7/hyperv \ - || expr "$(get_dmi_field bios-version)" : 'VRTUAL.*' >/dev/null - then - echo hyperv - return 0 - fi - - case $(get_dmi_field system-version) - in - (VPC[0-9]*|VS2005*|*[Vv]irtual*[Pp][Cc]*) - echo virtualpc - return 0 - ;; - (*) - echo hyperv - return 0 - ;; - esac - fi - ;; - ('Nutanix') - # Nutanix AHV. Similar to KVM. - if test "$(get_dmi_field system-product-name)" = 'AHV' - then - echo nutanix_ahv - return 0 - fi - ;; - ('oVirt') - echo ovirt - return 0 - ;; - ('Parallels Software International Inc.') - echo parallels - return 0 - ;; - ('QEMU') - echo qemu - return 0 - ;; - ('VMware, Inc.') - echo vmware - return 0 - ;; - esac - - case $(get_dmi_field bios-vendor) - in - ('Amazon EC2') - # AWS on bare-metal or KVM - echo aws-ec2 - return 0 - ;; - ('BHYVE') - echo bhyve - return 0 - ;; - ('innotek GmbH') - echo virtualbox - return 0 - ;; - ('Parallels Software International Inc.') - echo parallels - return 0 - ;; - ('Xen') - if get_dmi_field bios-version | grep -q -e '\([0-9]\{1,\}\.\)\{2\}amazon' - then - # AWS on Xen - echo aws-xen - return 0 - fi - ;; - esac - - return 1 -} - -check_vm_hyp_specific() { - if is_command vmware-checkvm && vmware-checkvm >/dev/null - then - # vmware-checkvm is provided by VMware's open-vm-tools - echo vmware - return 0 - elif test -d /proc/xen - then - test -r /proc/xen/capabilities && - if grep -q -F 'control_d' /proc/xen/capabilities 2>/dev/null - then - # Xen dom0 - return 1 - else - # Xen domU - echo xen - return 0 - fi - fi - return 1 -} - -has_vm_dt() { - # OpenFirmware/Das U-Boot device-tree - test -d /proc/device-tree -} - -check_vm_dt() { - case ${arch} - in - (arm|aarch64) - if test -r /proc/device-tree/hypervisor/compatible - then - if grep -q -F 'xen' /proc/device-tree/hypervisor/compatible - then - echo xen - return 0 - elif grep -q -F 'vmware' /proc/device-tree/hypervisor/compatible - then - # e.g. VMware ESXi on ARM - echo vmware - return 0 - fi - fi - if glob_exists /proc/device-tree/fw-cfg@*/compatible - then - # qemu,fw-cfg-mmio - sed -e 's/,.*$//' /proc/device-tree/fw-cfg@*/compatible | head -n1 - return 0 - fi - if grep -q -F 'dummy-virt' /proc/device-tree/compatible - then - echo lkvm - return 0 - fi - ;; - (ppc64*) - if test -d /proc/device-tree/hypervisor \ - && grep -qF 'linux,kvm' /proc/device-tree/hypervisor/compatible - then - # We are running as a spapr KVM guest on ppc64 - echo kvm-spapr - return 0 - fi - if test -r /proc/device-tree/ibm,partition-name \ - && test -r /proc/device-tree/hmc-managed\? \ - && test -r /proc/device-tree/chosen/qemu,graphic-width - then - echo powervm - fi - ;; - esac - return 1 -} - -has_vm_sys_hypervisor() { - test -d /sys/hypervisor/ -} - -check_vm_sys_hypervisor() { - test -r /sys/hypervisor/type && - case $(head -n1 /sys/hypervisor/type) - in - (xen) - # Ordinary kernel with pv_ops. There does not seem to be - # enough information at present to tell whether this is dom0 - # or domU. - echo xen - return 0 - ;; - esac - return 1 -} - -check_vm_os_specific() { - _hyp_generic=false - - case ${uname_s} - in - (Darwin) - if hv_vmm_present=$(get_sysctl kern.hv_vmm_present) \ - && test "${hv_vmm_present}" -ne 0 - then - _hyp_generic=true - fi - ;; - (FreeBSD) - # FreeBSD does not have /proc/cpuinfo even when procfs is used. - # Instead there is a sysctl kern.vm_guest. - # Which is 'none' if physical, else the virtualisation. - vm_guest=$(get_sysctl kern.vm_guest | tolower) && - case ${vm_guest} - in - (none) ;; - (generic) _hyp_generic=true ;; - (*) - # kernel could detect hypervisor - case ${vm_guest} - in - (hv) echo hyperv ;; - (vbox) echo virtualbox ;; - (*) echo "${vm_guest}" ;; - esac - return 0 - ;; - esac - ;; - (NetBSD) - machdep_hv=$(get_sysctl machdep.hypervisor | tolower) && - case ${machdep_hv} - in - (none) ;; - (generic) _hyp_generic=true ;; - (*) - # kernel could detect hypervisor - case ${machdep_hv} - in - (hyper-v) echo hyperv ;; - (xenhvm*) echo xen-hvm ;; - (xenpv*) echo xen-pv ;; - (xen*) echo xen ;; - (*) echo "${machdep_hv}" ;; - esac - return 0 - ;; - esac - ;; - (OpenBSD) - if is_command hostctl && glob_exists /dev/pvbus[0-9]* - then - for _pvbus in /dev/pvbus[0-9]* - do - _h_out=$(hostctl -f "${_pvbus}" -t 2>/dev/null) || continue - case $(expr "${_h_out}" : '[^:]*: *\(.*\)$') - in - (KVM) echo kvm ;; - (Hyper-V) echo hyperv ;; - (VMware) echo vmware ;; - (Xen) echo xen ;; - (bhyve) echo bhyve ;; - (OpenBSD) echo openbsd_vmm ;; - esac - return 0 - done - fi - ;; - (SunOS) - diag_conf=$(prtdiag | sed -n -e 's/.*Configuration: *//p' -e '/^$/q') - # NOTE: Don't use -e or -F in Solaris grep - if printf '%s\n' "${diag_conf}" | grep -q -i QEMU - then - echo qemu - return 0 - elif printf '%s\n' "${diag_conf}" | grep -q -i VMware - then - echo vmware - return 0 - fi - ;; - (Linux) - if is_command dmesg - then - while read -r line - do - case ${line} - in - ('Booting paravirtualized kernel on ') - case $(expr "${line}" : '.* kernel on \(.*\)') - in - ('Xen') - echo xen-pv; return 0 ;; - ('bare hardware') - return 1 ;; - esac - ;; - ('Hypervisor detected') - case $(expr "${line}" : '.*: *\(.*\)') - in - ('ACRN') - echo acrn ;; - ('Jailhouse') - echo jailhouse ;; - ('KVM') - echo kvm ;; - ('Microsoft Hyper-V') - echo hyperv ;; - ('VMware') - echo vmware ;; - ('Xen HVM') - echo xen-hvm ;; - ('Xen PV') - echo xen-pv ;; - esac - return 0 - ;; - (lpar:*' under hypervisor') - return 0 ;; - esac - done <<-EOF - $(dmesg 2>/dev/null | awk ' - /Booting paravirtualized kernel on / - /Hypervisor detected: / - /lpar: .* under hypervisor/ - ') - EOF - fi - esac - - # Try to guess hypervisor based on CPU model (sysctl hw.model if available) - if cpu_model=$(get_sysctl hw.model) - then - guess_hypervisor_from_cpu_model "${cpu_model}" && return 0 - fi - - if ${_hyp_generic} - then - # cannot say which hypervisor, but one was detected - return 0 - else - return 1 - fi -} - -run_stage() { - if type "has_$1_$2" >/dev/null 2>&1 - then - "has_$1_$2" - else - true - fi \ - && "check_$1_$2" -} - - -# Execute chroot stages - -for stage in \ - procfs debian_ischroot systemd -do - chrootpnt=$(run_stage chroot ${stage}) || continue - is_chrooted=true - detected_layer 'chroot' - if test -n "${chrootpnt}" - then - echo chroot at "${chrootpnt}" - break - fi -done -if ${is_chrooted:-false} && test -z "${chrootpnt}" -then - # could determine chroot, but not its mount point - echo chroot +if [ -d "/proc/vz" ] && [ ! -d "/proc/bc" ]; then + echo openvz + exit fi - -# Execute container stages - -for stage in \ - systemd pid_1 cgroup files os_specific -do - ctengine=$(run_stage ct ${stage}) || continue - detected_layer 'container' - is_contained=true - if test -n "${ctengine}" - then - echo container on "${ctengine}" - break - fi -done -if ${is_contained:-false} && test -z "${ctengine}" -then - # none of the stages could determine the specific container engine, but - # we are running in some container. - echo container +if [ -e "/proc/1/environ" ] && + tr '\000' '\n' < "/proc/1/environ" | grep -Eiq '^container='; then + echo lxc + exit fi +if [ -r /proc/cpuinfo ]; then + # this should only exist on virtual guest machines, + # tested on vmware, xen, kvm + if grep -q "hypervisor" /proc/cpuinfo; then + # this file is aviable in xen guest systems + if [ -r /sys/hypervisor/type ]; then + if grep -q -i "xen" /sys/hypervisor/type; then + echo virtual_by_xen + exit + fi + else + if [ -r /sys/class/dmi/id/product_name ]; then + if grep -q -i 'vmware' /sys/class/dmi/id/product_name; then + echo "virtual_by_vmware" + exit + elif grep -q -i 'bochs' /sys/class/dmi/id/product_name; then + echo "virtual_by_kvm" + exit + elif grep -q -i 'virtualbox' /sys/class/dmi/id/product_name; then + echo "virtual_by_virtualbox" + exit + fi + fi -# Execute virtual machine / hypervisor stages + if [ -r /sys/class/dmi/id/sys_vendor ]; then + if grep -q -i 'qemu' /sys/class/dmi/id/sys_vendor; then + echo "virtual_by_kvm" + exit + fi + fi -for stage in \ - systemd os_specific hyp_specific sys_hypervisor dt dmi cpuinfo arch_specific -do - hypervisor=$(run_stage vm ${stage}) || continue - detected_layer 'virtual machine' - is_virtual=true - if test -n "${hypervisor}" - then - echo virtual by "${hypervisor}" - break - fi -done -if ${is_virtual:-false} && test -z "${hypervisor}" -then - # none of the stages could determine the specific hypervisor, but - # we are virtual. - echo virtual + if [ -r /sys/class/dmi/id/chassis_vendor ]; then + if grep -q -i 'qemu' /sys/class/dmi/id/chassis_vendor; then + echo "virtual_by_kvm" + exit + fi + fi + fi + echo "virtual_by_unknown" + else + echo "physical" + fi +else + echo "unknown" fi - - -# Fallback - -detected_layer physical diff --git a/cdist/conf/explorer/memory b/cdist/conf/explorer/memory index c6d113cf..4e3efff8 100755 --- a/cdist/conf/explorer/memory +++ b/cdist/conf/explorer/memory @@ -1,9 +1,8 @@ -#!/bin/sh -e +#!/bin/sh # # 2014 Daniel Heule (hda at sfs.biz) # 2014 Thomas Oettli (otho at sfs.biz) # Copyright 2017, Philippe Gregoire -# 2020 Dennis Camera # # This file is part of cdist. # @@ -20,73 +19,23 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -# Returns the amount of memory physically installed in the system, or if that -# cannot be determined the amount available to the operating system kernel, -# in kibibytes (kiB). +# -str2bytes() { - awk -F' ' ' - $2 == "B" || !$2 { print $1 } - $2 == "kB" { printf "%.f\n", ($1 * 1000) } - $2 == "MB" { printf "%.f\n", ($1 * 1000 * 1000) } - $2 == "GB" { printf "%.f\n", ($1 * 1000 * 1000 * 1000) } - $2 == "TB" { printf "%.f\n", ($1 * 1000 * 1000 * 1000 * 1000) } - $2 == "kiB" { printf "%.f\n", ($1 * 1024) } - $2 == "MiB" { printf "%.f\n", ($1 * 1024 * 1024) } - $2 == "GiB" { printf "%.f\n", ($1 * 1024 * 1024 * 1024) } - $2 == "TiB" { printf "%.f\n", ($1 * 1024 * 1024 * 1024 * 1024) }' -} +# FIXME: other system types (not linux ...) -bytes2kib() { - awk '$0 > 0 { printf "%.f\n", ($0 / 1024) }' -} +os=$("$__explorer/os") +case "$os" in + "macosx") + echo "$(sysctl -n hw.memsize)/1024" | bc + ;; + "openbsd") + echo "$(sysctl -n hw.physmem) / 1048576" | bc + ;; -case $(uname -s) -in - (Darwin) - sysctl -n hw.memsize | bytes2kib - ;; - (FreeBSD) - sysctl -n hw.realmem | bytes2kib - ;; - (NetBSD|OpenBSD) - # NOTE: This reports "usable" memory, not physically installed memory. - command -p sysctl -n hw.physmem | bytes2kib - ;; - (SunOS) - # Make sure that awk from xpg4 is used for the scripts to work - export PATH="/usr/xpg4/bin:${PATH}" - prtconf \ - | awk -F ': ' ' - $1 == "Memory size" { sub(/Megabytes/, "MiB", $2); print $2 } - /^$/ { exit }' \ - | str2bytes \ - | bytes2kib - ;; - (Linux) - if test -d /sys/devices/system/memory - then - # Use memory blocks if the architecture (e.g. x86, PPC64, s390) - # supports them (they denote physical memory) - num_mem_blocks=$(cat /sys/devices/system/memory/memory[0-9]*/state | grep -cxF online) - mem_block_size=$(cat /sys/devices/system/memory/block_size_bytes) - - echo $((num_mem_blocks * 0x$mem_block_size)) | bytes2kib && exit - fi - if test -r /proc/meminfo - then - # Fall back to meminfo file on other architectures (e.g. ARM, MIPS, - # PowerPC) - # NOTE: This is "usable" memory, not physically installed memory. - awk -F ': +' '$1 == "MemTotal" { sub(/B$/, "iB", $2); print $2 }' /proc/meminfo \ - | str2bytes \ - | bytes2kib - fi - ;; - (*) - printf "Your kernel (%s) is currently not supported by the memory explorer\n" "$(uname -s)" >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - ;; + *) + if [ -r /proc/meminfo ]; then + grep "MemTotal:" /proc/meminfo | awk '{print $2}' + fi + ;; esac diff --git a/cdist/conf/explorer/os b/cdist/conf/explorer/os index b9232ee4..563fa4cf 100755 --- a/cdist/conf/explorer/os +++ b/cdist/conf/explorer/os @@ -116,13 +116,6 @@ if [ -f /etc/slackware-version ]; then exit 0 fi -# Appliances - -if grep -q '^Check Point Gaia' /etc/cp-release 2>/dev/null; then - echo checkpoint - exit 0 -fi - uname_s="$(uname -s)" # Assume there is no tr on the client -> do lower case ourselves @@ -150,13 +143,6 @@ case "$uname_s" in esac if [ -f /etc/os-release ]; then - # after sles15, suse don't provide an /etc/SuSE-release anymore, but there is almost no difference between sles and opensuse leap, so call it suse - # shellcheck disable=SC1091 - if (. /etc/os-release && echo "${ID_LIKE}" | grep -q '\(^\|\ \)suse\($\|\ \)') - then - echo suse - exit 0 - fi # already lowercase, according to: # https://www.freedesktop.org/software/systemd/man/os-release.html awk -F= '/^ID=/ { if ($2 ~ /^'"'"'(.*)'"'"'$/ || $2 ~ /^"(.*)"$/) { print substr($2, 2, length($2) - 2) } else { print $2 } }' /etc/os-release diff --git a/cdist/conf/explorer/os_release b/cdist/conf/explorer/os_release index ec85046f..cfc01004 100644 --- a/cdist/conf/explorer/os_release +++ b/cdist/conf/explorer/os_release @@ -1,7 +1,6 @@ #!/bin/sh # # 2018 Adam Dej (dejko.a at gmail.com) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -22,21 +21,6 @@ # See os-release(5) and http://0pointer.de/blog/projects/os-release -if test -f /etc/os-release -then - # Linux and FreeBSD (usually a symlink) - cat /etc/os-release -elif test -f /usr/lib/os-release -then - # systemd - cat /usr/lib/os-release -elif test -f /var/run/os-release -then - # FreeBSD (created by os-release service) - cat /var/run/os-release -elif test -f /etc/cp-release -then - # Checkpoint firewall or management (actually linux based) - cat /etc/cp-release -fi +set +e +cat /etc/os-release || cat /usr/lib/os-release || true diff --git a/cdist/conf/explorer/os_version b/cdist/conf/explorer/os_version index fc59fd14..4c41695b 100755 --- a/cdist/conf/explorer/os_version +++ b/cdist/conf/explorer/os_version @@ -1,7 +1,6 @@ -#!/bin/sh -e +#!/bin/sh # # 2010-2011 Nico Schottelius (nico-cdist at schottelius.org) -# 2020-2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -18,22 +17,12 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # +# # All os variables are lower case # +# -rc_getvar() { - awk -F= -v varname="$2" ' - function unquote(s) { - if (s ~ /^".*"$/ || s ~ /^'\''.*'\''$/) - return substr(s, 2, length(s) - 2) - else - return s - } - $1 == varname { print unquote(substr($0, index($0, "=") + 1)) }' "$1" -} - -case $("${__explorer:?}/os") -in +case "$("$__explorer/os")" in amazon) cat /etc/system-release ;; @@ -41,58 +30,11 @@ in # empty, but well... cat /etc/arch-release ;; - checkpoint) - awk '{version=$NF; printf("%s\n", substr(version, 2))}' /etc/cp-release - ;; debian) - debian_version=$(cat /etc/debian_version) - case $debian_version - in - testing/unstable) - # previous to Debian 4.0 testing/unstable was used - # cf. https://metadata.ftp-master.debian.org/changelogs/main/b/base-files/base-files_11_changelog - echo 3.99 - ;; - */sid) - # sid versions don't have a number, so we decode by codename: - case $(expr "$debian_version" : '\([a-z]\{1,\}\)/') - in - trixie) echo 12.99 ;; - bookworm) echo 11.99 ;; - bullseye) echo 10.99 ;; - buster) echo 9.99 ;; - stretch) echo 8.99 ;; - jessie) echo 7.99 ;; - wheezy) echo 6.99 ;; - squeeze) echo 5.99 ;; - lenny) echo 4.99 ;; - *) echo 99.99 ;; - esac - ;; - *) - echo "$debian_version" - ;; - esac + cat /etc/debian_version ;; devuan) - devuan_version=$(cat /etc/devuan_version) - case ${devuan_version} - in - (*/ceres) - # ceres versions don't have a number, so we decode by codename: - case ${devuan_version} - in - (daedalus/ceres) echo 4.99 ;; - (chimaera/ceres) echo 3.99 ;; - (beowulf/ceres) echo 2.99 ;; - (ascii/ceres) echo 1.99 ;; - (*) exit 1 - esac - ;; - (*) - echo "${devuan_version}" - ;; - esac + cat /etc/devuan_version ;; fedora) cat /etc/fedora-release @@ -101,20 +43,7 @@ in cat /etc/gentoo-release ;; macosx) - # NOTE: Legacy versions (< 10.3) do not support options - sw_vers | awk -F ':[ \t]+' '$1 == "ProductVersion" { print $2 }' - ;; - freebsd) - # Apparently uname -r is not a reliable way to get the patch level. - # See: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251743 - if command -v freebsd-version >/dev/null 2>&1 - then - # get userland version - freebsd-version -u - else - # fallback to kernel release for FreeBSD < 10.0 - uname -r - fi + sw_vers -productVersion ;; *bsd|solaris) uname -r @@ -139,22 +68,6 @@ in fi ;; ubuntu) - if command -v lsb_release >/dev/null 2>&1 - then - lsb_release -sr - elif test -r /usr/lib/os-release - then - # fallback to /usr/lib/os-release if lsb_release is not present (like - # on minimized Ubuntu installations) - rc_getvar /usr/lib/os-release VERSION_ID - elif test -r /etc/lsb-release - then - # extract DISTRIB_RELEASE= variable from /etc/lsb-release on old - # versions without /usr/lib/os-release. - rc_getvar /etc/lsb-release DISTRIB_RELEASE - fi - ;; - alpine) - cat /etc/alpine-release + lsb_release -sr ;; esac diff --git a/cdist/conf/type/__mysql_privileges/explorer/state b/cdist/conf/type/__acl/explorer/checks similarity index 54% rename from cdist/conf/type/__mysql_privileges/explorer/state rename to cdist/conf/type/__acl/explorer/checks index 4f13a70c..70bb0412 100755 --- a/cdist/conf/type/__mysql_privileges/explorer/state +++ b/cdist/conf/type/__acl/explorer/checks @@ -1,6 +1,6 @@ #!/bin/sh -e # -# 2020 Ander Punnar (ander-at-kvlt-dot-ee) +# 2019 Ander Punnar (ander-at-kvlt-dot-ee) # # This file is part of cdist. # @@ -18,23 +18,22 @@ # along with cdist. If not, see . # -privileges="$( cat "$__object/parameter/privileges" )" +# TODO check if filesystem has ACL turned on etc -database="$( cat "$__object/parameter/database" )" - -table="$( cat "$__object/parameter/table" )" - -user="$( cat "$__object/parameter/user" )" - -host="$( cat "$__object/parameter/host" )" - -check_privileges="$( - mysql -B -N -e "show grants for '$user'@'$host'" \ - | grep -Ei "^grant $privileges on .$database.\..?$table.? to " || true )" - -if [ -n "$check_privileges" ] +if [ -f "$__object/parameter/acl" ] then - echo 'present' -else - echo 'absent' + grep -E '^(default:)?(user|group):' "$__object/parameter/acl" \ + | while read -r acl + do + param="$( echo "$acl" | awk -F: '{print $(NF-2)}' )" + check="$( echo "$acl" | awk -F: '{print $(NF-1)}' )" + + [ "$param" = 'user' ] && db=passwd || db="$param" + + if ! getent "$db" "$check" > /dev/null + then + echo "missing $param '$check'" >&2 + exit 1 + fi + done fi diff --git a/cdist/conf/type/__acl/explorer/getent b/cdist/conf/type/__acl/explorer/getent deleted file mode 100755 index 7e6c2c30..00000000 --- a/cdist/conf/type/__acl/explorer/getent +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -e - -getent passwd | awk -F: '{print "user:"$1}' -getent group | awk -F: '{print "group:"$1}' diff --git a/cdist/conf/type/__acl/gencode-remote b/cdist/conf/type/__acl/gencode-remote index 32318e91..6dab4d09 100755 --- a/cdist/conf/type/__acl/gencode-remote +++ b/cdist/conf/type/__acl/gencode-remote @@ -20,13 +20,7 @@ file_is="$( cat "$__object/explorer/file_is" )" -if [ "$file_is" = 'missing' ] \ - && [ -z "$__cdist_dry_run" ] \ - && [ ! -f "$__object/parameter/file" ] \ - && [ ! -f "$__object/parameter/directory" ] -then - exit 0 -fi +[ "$file_is" = 'missing' ] && [ -z "$__cdist_dry_run" ] && exit 0 os="$( cat "$__global/explorer/os" )" @@ -34,39 +28,28 @@ acl_path="/$__object_id" acl_is="$( cat "$__object/explorer/acl_is" )" -if [ -f "$__object/parameter/source" ] +if [ -f "$__object/parameter/acl" ] then - acl_source="$( cat "$__object/parameter/source" )" + acl_should="$( cat "$__object/parameter/acl" )" +elif + [ -f "$__object/parameter/user" ] \ + || [ -f "$__object/parameter/group" ] \ + || [ -f "$__object/parameter/mask" ] \ + || [ -f "$__object/parameter/other" ] +then + acl_should="$( for param in user group mask other + do + [ ! -f "$__object/parameter/$param" ] && continue - if [ "$acl_source" = '-' ] - then - acl_should="$( cat "$__object/stdin" )" - else - acl_should="$( grep -Ev '^#|^$' "$acl_source" )" - fi -elif [ -f "$__object/parameter/entry" ] -then - acl_should="$( cat "$__object/parameter/entry" )" + echo "$param" | grep -Eq 'mask|other' && sep=:: || sep=: + + echo "$param$sep$( cat "$__object/parameter/$param" )" + done )" else echo 'no parameters set' >&2 exit 1 fi -# instead of setfacl's non-helpful message "Option -m: Invalid argument near character X" -# let's check if target has necessary users and groups, since mistyped or missing -# users/groups in target is most common reason. -echo "$acl_should" \ - | grep -Po '(user|group):[^:]+' \ - | sort -u \ - | while read -r l - do - if ! grep "$l" -Fxq "$__object/explorer/getent" - then - echo "no $l' in target" | sed "s/:/ '/" >&2 - exit 1 - fi - done - if [ -f "$__object/parameter/default" ] then acl_should="$( echo "$acl_should" \ diff --git a/cdist/conf/type/__acl/man.rst b/cdist/conf/type/__acl/man.rst index 307be72b..85e946ce 100644 --- a/cdist/conf/type/__acl/man.rst +++ b/cdist/conf/type/__acl/man.rst @@ -12,29 +12,11 @@ Fully supported and tested on Linux (ext4 filesystem), partial support for FreeB See ``setfacl`` and ``acl`` manpages for more details. -One of ``--entry`` or ``--source`` must be used. - -OPTIONAL MULTIPLE PARAMETERS +REQUIRED MULTIPLE PARAMETERS ---------------------------- -entry +acl Set ACL entry following ``getfacl`` output syntax. - Must be used if ``--source`` is not used. - - -OPTIONAL PARAMETERS -------------------- -source - Read ACL entries from stdin or file. - Ordering of entries is not important. - When reading from file, comments and empty lines are ignored. - Must be used if ``--entry`` is not used. - -file - Create/change file with ``__file`` using ``user:group:mode`` pattern. - -directory - Create/change directory with ``__directory`` using ``user:group:mode`` pattern. BOOLEAN PARAMETERS @@ -52,6 +34,12 @@ remove ``mask`` and ``other`` entries can't be removed, but only changed. +DEPRECATED PARAMETERS +--------------------- +Parameters ``user``, ``group``, ``mask`` and ``other`` are deprecated and they +will be removed in future versions. Please use ``acl`` parameter instead. + + EXAMPLES -------- @@ -61,38 +49,27 @@ EXAMPLES --default \ --recursive \ --remove \ - --entry user:alice:rwx \ - --entry user:bob:r-x \ - --entry group:project-group:rwx \ - --entry group:some-other-group:r-x \ - --entry mask::r-x \ - --entry other::r-x + --acl user:alice:rwx \ + --acl user:bob:r-x \ + --acl group:project-group:rwx \ + --acl group:some-other-group:r-x \ + --acl mask::r-x \ + --acl other::r-x # give Alice read-only access to subdir, # but don't allow her to see parent content. __acl /srv/project2 \ --remove \ - --entry default:group:secret-project:rwx \ - --entry group:secret-project:rwx \ - --entry user:alice:--x + --acl default:group:secret-project:rwx \ + --acl group:secret-project:rwx \ + --acl user:alice:--x __acl /srv/project2/subdir \ --default \ --remove \ - --entry group:secret-project:rwx \ - --entry user:alice:r-x - - # read acl from stdin - echo 'user:alice:rwx' \ - | __acl /path/to/directory --source - - - # create/change directory too - __acl /path/to/directory \ - --default \ - --remove \ - --directory root:root:770 \ - --entry user:nobody:rwx + --acl group:secret-project:rwx \ + --acl user:alice:r-x AUTHORS diff --git a/cdist/conf/type/__acl/manifest b/cdist/conf/type/__acl/manifest deleted file mode 100755 index 5fd23110..00000000 --- a/cdist/conf/type/__acl/manifest +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/sh -e - -for p in file directory -do - [ ! -f "$__object/parameter/$p" ] && continue - - "__$p" "/$__object_id" \ - --owner "$( awk -F: '{print $1}' "$__object/parameter/$p" )" \ - --group "$( awk -F: '{print $2}' "$__object/parameter/$p" )" \ - --mode "$( awk -F: '{print $3}' "$__object/parameter/$p" )" -done diff --git a/cdist/conf/type/__acl/parameter/deprecated/group b/cdist/conf/type/__acl/parameter/deprecated/group new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/group @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/deprecated/mask b/cdist/conf/type/__acl/parameter/deprecated/mask new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/mask @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/deprecated/other b/cdist/conf/type/__acl/parameter/deprecated/other new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/other @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/deprecated/user b/cdist/conf/type/__acl/parameter/deprecated/user new file mode 100644 index 00000000..94e14159 --- /dev/null +++ b/cdist/conf/type/__acl/parameter/deprecated/user @@ -0,0 +1 @@ +see manual for details diff --git a/cdist/conf/type/__acl/parameter/optional b/cdist/conf/type/__acl/parameter/optional index 5a0c29a3..4b32086b 100644 --- a/cdist/conf/type/__acl/parameter/optional +++ b/cdist/conf/type/__acl/parameter/optional @@ -1,3 +1,2 @@ -source -file -directory +mask +other diff --git a/cdist/conf/type/__acl/parameter/optional_multiple b/cdist/conf/type/__acl/parameter/optional_multiple index 4c884f03..95c25d55 100644 --- a/cdist/conf/type/__acl/parameter/optional_multiple +++ b/cdist/conf/type/__acl/parameter/optional_multiple @@ -1 +1,3 @@ -entry +acl +user +group diff --git a/cdist/conf/type/__apt_backports/man.rst b/cdist/conf/type/__apt_backports/man.rst deleted file mode 100644 index 7036fb84..00000000 --- a/cdist/conf/type/__apt_backports/man.rst +++ /dev/null @@ -1,104 +0,0 @@ -cdist-type__debian_backports(7) -=============================== - -NAME ----- -cdist-type__apt_backports - Install backports - - -DESCRIPTION ------------ -This singleton type installs backports for the current OS release. -It aborts if backports are not supported for the specified OS or -no version codename could be fetched (like Debian unstable). - -The package index will be automatically updated if required. - -It supports backports from following OSes: - -- Debian -- Devuan -- Ubuntu - - -REQUIRED PARAMETERS -------------------- -None. - - -OPTIONAL PARAMETERS -------------------- -state - Represents the state of the backports repository. ``present`` or - ``absent``, defaults to ``present``. - - Will be directly passed to :strong:`cdist-type__apt_source`\ (7). - -mirror - The mirror to fetch the backports from. Will defaults to the generic - mirror of the current OS. - - Will be directly passed to :strong:`cdist-type__apt_source`\ (7). - - -BOOLEAN PARAMETERS ------------------- -None. - - -MESSAGES --------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # setup the backports - __apt_backports - __apt_backports --state absent - __apt_backports --state present --mirror "http://ftp.de.debian.org/debian/" - - # install a backports package - # currently for the buster release backports - require="__apt_backports" __package_apt wireguard \ - --target-release buster-backports - - -ABORTS ------- -Aborts if the detected os is not Debian. - -Aborts if no distribuition codename could be detected. This is common for the -unstable distribution, but there is no backports repository for it already. - - -CAVEATS -------- -For Ubuntu, it setup all componenents for the backports repository: ``main``, -``restricted``, ``universe`` and ``multiverse``. The user may not want to -install proprietary packages, which will only be installed if the user -explicitly uses the backports target-release. The user may change this behavior -to install backports packages without the need of explicitly select it. - - -SEE ALSO --------- -`Official Debian Backports site `_ - -:strong:`cdist-type__apt_source`\ (7) - - -AUTHORS -------- -Matthias Stecher - - -COPYING -------- -Copyright \(C) 2020 Matthias Stecher. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_backports/manifest b/cdist/conf/type/__apt_backports/manifest deleted file mode 100755 index 6fcd9212..00000000 --- a/cdist/conf/type/__apt_backports/manifest +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/sh -e -# __apt_backports/manifest -# -# 2020 Matthias Stecher (matthiasstecher at gmx.de) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# -# Enables/disables backports repository. Utilises __apt_source for it. -# - - -# Get the distribution codename by /etc/os-release. -# is already executed in a subshell by string substitution -# lsb_release may not be given in all installations -codename_os_release() { - # shellcheck disable=SC1090 - # shellcheck disable=SC1091 - . "$__global/explorer/os_release" - printf "%s" "$VERSION_CODENAME" -} - -# detect backport distribution -os="$(cat "$__global/explorer/os")" -case "$os" in - debian) - dist="$( codename_os_release )" - components="main" - mirror="http://deb.debian.org/debian/" - ;; - devuan) - dist="$( codename_os_release )" - components="main" - mirror="http://deb.devuan.org/merged" - ;; - ubuntu) - dist="$( codename_os_release )" - components="main restricted universe multiverse" - mirror="http://archive.ubuntu.com/ubuntu" - ;; - - *) - printf "Backports for %s are not supported!\n" "$os" >&2 - exit 1 - ;; -esac - -# error if no codename given (e.g. on Debian unstable) -if [ -z "$dist" ]; then - printf "No backports for unkown version of distribution %s!\n" "$os" >&2 - exit 1 -fi - - -# parameters -state="$(cat "$__object/parameter/state")" - -# mirror already set for the os, only override user-values -if [ -f "$__object/parameter/mirror" ]; then - mirror="$(cat "$__object/parameter/mirror")" -fi - - -# install the given backports repository -__apt_source "${dist}-backports" \ - --state "$state" \ - --distribution "${dist}-backports" \ - --component "$components" \ - --uri "$mirror" diff --git a/cdist/conf/type/__apt_backports/parameter/default/state b/cdist/conf/type/__apt_backports/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__apt_backports/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__apt_backports/parameter/optional b/cdist/conf/type/__apt_backports/parameter/optional deleted file mode 100644 index 4b05c235..00000000 --- a/cdist/conf/type/__apt_backports/parameter/optional +++ /dev/null @@ -1,2 +0,0 @@ -state -mirror diff --git a/cdist/conf/type/__apt_key/explorer/state b/cdist/conf/type/__apt_key/explorer/state index 8ab268c1..38f1bd3c 100755 --- a/cdist/conf/type/__apt_key/explorer/state +++ b/cdist/conf/type/__apt_key/explorer/state @@ -27,25 +27,18 @@ else keyid="$__object_id" fi -# From apt-key(8): -# Use of apt-key is deprecated, except for the use of apt-key del in -# maintainer scripts to remove existing keys from the main keyring. -# If such usage of apt-key is desired the additional installation of -# the GNU Privacy Guard suite (packaged in gnupg) is required. -if [ -f "${__object}/parameter/use-deprecated-apt-key" ]; then - if apt-key export "$keyid" | head -n 1 | grep -Fqe "BEGIN PGP PUBLIC KEY BLOCK" - then echo present - else echo absent - fi - exit -fi - keydir="$(cat "$__object/parameter/keydir")" keyfile="$keydir/$__object_id.gpg" -if [ -f "$keyfile" ] +if [ -d "$keydir" ] then - echo present - exit + if [ -f "$keyfile" ] + then echo present + else echo absent + fi +else + # fallback to deprecated apt-key + apt-key export "$keyid" | head -n 1 | grep -Fqe "BEGIN PGP PUBLIC KEY BLOCK" \ + && echo present \ + || echo absent fi -echo absent diff --git a/cdist/conf/type/__apt_key/gencode-remote b/cdist/conf/type/__apt_key/gencode-remote index 17dc9bfc..e9daa524 100755 --- a/cdist/conf/type/__apt_key/gencode-remote +++ b/cdist/conf/type/__apt_key/gencode-remote @@ -25,7 +25,11 @@ else fi state_should="$(cat "$__object/parameter/state")" state_is="$(cat "$__object/explorer/state")" -method="$(cat "$__object/key_method")" + +if [ "$state_should" = "$state_is" ]; then + # nothing to do + exit 0 +fi keydir="$(cat "$__object/parameter/keydir")" keyfile="$keydir/$__object_id.gpg" @@ -33,41 +37,55 @@ keyfile="$keydir/$__object_id.gpg" case "$state_should" in present) keyserver="$(cat "$__object/parameter/keyserver")" - # Using __download or __file as key source - # Propagate messages if needed - if [ "${method}" = "uri" ] || [ "${method}" = "source" ]; then - if grep -Eq "^__(file|download)$keyfile" "$__messages_in"; then - echo "added '$keyid'" >> "$__messages_out" + + if [ -f "$__object/parameter/uri" ]; then + uri="$(cat "$__object/parameter/uri")" + + if [ -d "$keydir" ]; then + cat << EOF + +curl -s -L \\ + -o "$keyfile" \\ + "$uri" + +key="\$( cat "$keyfile" )" + +if echo "\$key" | grep -Fq 'BEGIN PGP PUBLIC KEY BLOCK' +then + echo "\$key" | gpg --dearmor > "$keyfile" +fi + +EOF + else + # fallback to deprecated apt-key + echo "curl -s -L '$uri' | apt-key add -" fi - exit 0 - elif [ "${state_is}" = "present" ]; then - exit 0 - fi - # Using key servers to fetch the key - if [ ! -f "$__object/parameter/use-deprecated-apt-key" ]; then + elif [ -d "$keydir" ]; then + tmp='/tmp/cdist_apt_key_tmp' + # we need to kill gpg after 30 seconds, because gpg # can get stuck if keyserver is not responding. # exporting env var and not exit 1, # because we need to clean up and kill dirmngr. cat << EOF -gpgtmphome="\$( mktemp -d )" +mkdir -m 700 -p "$tmp" if timeout 30s \\ - gpg --homedir "\$gpgtmphome" \\ + gpg --homedir "$tmp" \\ --keyserver "$keyserver" \\ --recv-keys "$keyid" then - gpg --homedir "\$gpgtmphome" \\ + gpg --homedir "$tmp" \\ --export "$keyid" \\ > "$keyfile" else export GPG_GOT_STUCK=1 fi -GNUPGHOME="\$gpgtmphome" gpgconf --kill dirmngr +GNUPGHOME="$tmp" gpgconf --kill dirmngr -rm -rf "\$gpgtmphome" +rm -rf "$tmp" if [ -n "\$GPG_GOT_STUCK" ] then @@ -84,16 +102,13 @@ EOF echo "added '$keyid'" >> "$__messages_out" ;; absent) - # Removal for keys added from a keyserver without this flag - # is done in the manifest - if [ "$state_is" != "absent" ] && \ - [ -f "$__object/parameter/use-deprecated-apt-key" ]; then + if [ -f "$keyfile" ]; then + echo "rm '$keyfile'" + else # fallback to deprecated apt-key echo "apt-key del \"$keyid\"" - echo "removed '$keyid'" >> "$__messages_out" - # Propagate messages if needed - elif grep -Eq "^__file$keyfile" "$__messages_in"; then - echo "removed '$keyid'" >> "$__messages_out" fi + + echo "removed '$keyid'" >> "$__messages_out" ;; esac diff --git a/cdist/conf/type/__apt_key/man.rst b/cdist/conf/type/__apt_key/man.rst index e35eaa0f..234bc715 100644 --- a/cdist/conf/type/__apt_key/man.rst +++ b/cdist/conf/type/__apt_key/man.rst @@ -10,14 +10,6 @@ DESCRIPTION ----------- Manages the list of keys used by apt to authenticate packages. -This is done by placing the requested key in a file named -``$__object_id.gpg`` in the ``keydir`` directory. - -This is supported by modern releases of Debian-based distributions. - -In order of preference, exactly one of: ``source``, ``uri`` or ``keyid`` -must be specified. - REQUIRED PARAMETERS ------------------- @@ -26,49 +18,21 @@ None. OPTIONAL PARAMETERS ------------------- -keydir - keyring directory, defaults to ``/etc/apt/trusted.pgp.d``, which is - enabled system-wide by default. - -source - path to a file containing the GPG key of the repository. - Using this is recommended as it ensures that the manifest/type manintainer - has validated the key. - If ``-``, the GPG key is read from the type's stdin. - state 'present' or 'absent'. Defaults to 'present' -uri - the URI from which to download the key. - It is highly recommended that you only use protocols with TLS like HTTPS. - This uses ``__download`` but does not use checksums, if you want to ensure - that the key doesn't change, you are better off downloading it and using - ``--source``. - - -DEPRECATED OPTIONAL PARAMETERS ------------------------------- keyid - the id of the key to download from the ``keyserver``. - This is to be used in absence of ``--source`` and ``--uri`` or together - with ``--use-deprecated-apt-key`` for key removal. - Defaults to ``$__object_id``. + the id of the key to add. Defaults to __object_id keyserver - the keyserver from which to fetch the key. - Defaults to ``pool.sks-keyservers.net``. + the keyserver from which to fetch the key. If omitted the default set + in ./parameter/default/keyserver is used. +keydir + key save location, defaults to ``/etc/apt/trusted.pgp.d`` -DEPRECATED BOOLEAN PARAMETERS ------------------------------ -use-deprecated-apt-key - ``apt-key(8)`` will last be available in Debian 11 and Ubuntu 22.04. - You can use this parameter to force usage of ``apt-key(8)``. - Please only use this parameter to *remove* keys from the keyring, - in order to prepare for removal of ``apt-key``. - Adding keys should be done without this parameter. - This parameter will be removed when Debian 11 stops being supported. +uri + the URI from which to download the key EXAMPLES @@ -76,39 +40,33 @@ EXAMPLES .. code-block:: sh - # add a key that has been verified by a type maintainer - __apt_key jitsi_meet_2021 \ - --source cdist-contrib/type/__jitsi_meet/files/apt_2021.gpg + # Add Ubuntu Archive Automatic Signing Key + __apt_key 437D05B5 + # Same thing + __apt_key 437D05B5 --state present + # Get rid of it + __apt_key 437D05B5 --state absent - # remove an old, deprecated or expired key - __apt_key jitsi_meet_2016 --state absent + # same thing with human readable name and explicit keyid + __apt_key UbuntuArchiveKey --keyid 437D05B5 - # Get rid of a key that might have been added to - # /etc/apt/trusted.gpg with apt-key - __apt_key 0x40976EAF437D05B5 --use-deprecated-apt-key --state absent + # same thing with other keyserver + __apt_key UbuntuArchiveKey --keyid 437D05B5 --keyserver keyserver.ubuntu.com - # add a key that we define in-line - __apt_key jitsi_meet_2021 --source '-' < Ander Punnar -Evilham COPYING ------- -Copyright \(C) 2011-2021 Steven Armstrong, Ander Punnar and Evilham. You can +Copyright \(C) 2011-2019 Steven Armstrong and Ander Punnar. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_key/manifest b/cdist/conf/type/__apt_key/manifest index 889a764a..010357cd 100755 --- a/cdist/conf/type/__apt_key/manifest +++ b/cdist/conf/type/__apt_key/manifest @@ -2,105 +2,7 @@ __package gnupg -state_should="$(cat "${__object}/parameter/state")" - -incompatible_args() -{ - cat >> /dev/stderr <<-EOF - This type does not support --${1} and --${method} simultaneously. - EOF - exit 1 -} - -if [ -f "${__object}/parameter/source" ]; then - method="source" - src="$(cat "${__object}/parameter/source")" - if [ "${src}" = "-" ]; then - src="${__object}/stdin" - fi -fi -if [ -f "${__object}/parameter/uri" ]; then - if [ -n "${method}" ]; then - incompatible_args uri - fi - method="uri" - src="$(cat "${__object}/parameter/uri")" -fi -if [ -f "${__object}/parameter/keyid" ]; then - if [ -n "${method}" ]; then - incompatible_args keyid - fi - method="keyid" -fi -# Keep old default -if [ -z "${method}" ]; then - method="keyid" -fi -# Save this for later in gencode-remote -echo "${method}" > "${__object}/key_method" - -# Required remotely (most likely already installed) -__package dirmngr -# We need this in case a key has to be dearmor'd -__package gnupg -export require="__package/gnupg" - -if [ -f "${__object}/parameter/use-deprecated-apt-key" ]; then - # This is required if apt-key(8) is to be used - if [ "${method}" = "source" ] || [ "${method}" = "uri" ]; then - incompatible_args use-deprecated-apt-key - fi -else - if [ "${state_should}" = "absent" ] && \ - [ -f "${__object}/parameter/keyid" ]; then - cat >> /dev/stderr < -Dennis Camera COPYING ------- -Copyright \(C) 2014 Steven Armstrong, 2020 Dennis Camera. -You can redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either version 3 of -the License, or (at your option) any later version. +Copyright \(C) 2014 Steven Armstrong. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_norecommends/manifest b/cdist/conf/type/__apt_norecommends/manifest index fc187784..e737df89 100755 --- a/cdist/conf/type/__apt_norecommends/manifest +++ b/cdist/conf/type/__apt_norecommends/manifest @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2014 Steven Armstrong (steven-cdist at armstrong.cc) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -20,28 +19,26 @@ # -os=$(cat "${__global:?}/explorer/os") +os=$(cat "$__global/explorer/os") -case ${os} -in - (ubuntu|debian|devuan) - __file /etc/apt/apt.conf.d/00InstallRecommends --state present \ - --owner root --group root --mode 0644 --source - <<-'EOF' - APT::Install-Recommends "false"; - APT::Install-Suggests "false"; - APT::AutoRemove::RecommendsImportant "false"; - APT::AutoRemove::SuggestsImportant "false"; - EOF - - # TODO: Remove the following object after some time - require=__file/etc/apt/apt.conf.d/00InstallRecommends \ - __file /etc/apt/apt.conf.d/99-no-recommends --state absent - ;; - (*) - cat >&2 <&2 << DONE The developer of this type (${__type##*/}) did not think your operating system ($os) would have any use for it. If you think otherwise please submit a patch. -EOF - exit 1 - ;; +DONE + exit 1 + ;; esac diff --git a/cdist/conf/type/__apt_pin/man.rst b/cdist/conf/type/__apt_pin/man.rst deleted file mode 100644 index e6ec8b51..00000000 --- a/cdist/conf/type/__apt_pin/man.rst +++ /dev/null @@ -1,79 +0,0 @@ -cdist-type__apt_pin(7) -====================== - -NAME ----- -cdist-type__apt_pin - Manage apt pinning rules - - -DESCRIPTION ------------ -Adds/removes/edits rules to pin some packages to a specific distribution. Useful if using multiple debian repositories at the same time. (Useful, if one wants to use a few specific packages from backports or perhaps Debain testing... or even sid.) - - -REQUIRED PARAMETERS -------------------- -distribution - Specifies what distribution the package should be pinned to. Accepts both codenames (buster/bullseye/sid) and suite names (stable/testing/...). - - -OPTIONAL PARAMETERS -------------------- -package - Package name, glob or regular expression to match (multiple) packages. If not specified `__object_id` is used. - -priority - The priority value to assign to matching packages. Defaults to 500. (To match the default target distro's priority) - -state - Will be passed to underlying `__file` type; see there for valid values and defaults. - - - -BOOLEAN PARAMETERS ------------------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # Add the bullseye repo to buster, but do not install any packages by default, - # only if explicitely asked for (-1 means "never" for apt) - __apt_pin bullseye-default \ - --package "*" \ - --distribution bullseye \ - --priority -1 - - require="__apt_pin/bullseye-default" __apt_source bullseye \ - --uri http://deb.debian.org/debian/ \ - --distribution bullseye \ - --component main - - __apt_pin foo --package "foo foo-*" --distribution bullseye - - __foo # Assuming, this installs the `foo` package internally - - __package foo-plugin-extras # Assuming we also need some extra stuff - - -SEE ALSO --------- -:strong:`apt_preferences`\ (5) -:strong:`cdist-type__apt_source`\ (7) -:strong:`cdist-type__apt_backports`\ (7) -:strong:`cdist-type__file`\ (7) - -AUTHORS -------- -Daniel Fancsali - - -COPYING -------- -Copyright \(C) 2021 Daniel Fancsali. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_pin/manifest b/cdist/conf/type/__apt_pin/manifest deleted file mode 100755 index 983b2b42..00000000 --- a/cdist/conf/type/__apt_pin/manifest +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/sh -e -# -# 2021 Daniel Fancsali (fancsali@gmail.com) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - - -name="$__object_id" - -os=$(cat "$__global/explorer/os") -state="$(cat "$__object/parameter/state")" - -if [ -f "$__object/parameter/package" ]; then - package="$(cat "$__object/parameter/package")" -else - package=$name -fi - -distribution="$(cat "$__object/parameter/distribution")" -priority="$(cat "$__object/parameter/priority")" - - -case "$os" in - debian|ubuntu|devuan) - ;; - *) - printf "This type is specific to Debian and it's derivatives" >&2 - exit 1 - ;; -esac - -case $distribution in - stable|testing|unstable|experimental) - pin="release a=$distribution" - ;; - *) - pin="release n=$distribution" - ;; -esac - - -__file "/etc/apt/preferences.d/$name" \ - --owner root --group root --mode 0644 \ - --state "$state" \ - --source - << EOF -# Created by cdist ${__type##*/} -# Do not change. Changes will be overwritten. -# - -# $name -Package: $package -Pin: $pin -Pin-Priority: $priority -EOF diff --git a/cdist/conf/type/__apt_pin/nonparallel b/cdist/conf/type/__apt_pin/nonparallel deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__apt_pin/parameter/default/priority b/cdist/conf/type/__apt_pin/parameter/default/priority deleted file mode 100644 index 1b79f38e..00000000 --- a/cdist/conf/type/__apt_pin/parameter/default/priority +++ /dev/null @@ -1 +0,0 @@ -500 diff --git a/cdist/conf/type/__apt_pin/parameter/default/state b/cdist/conf/type/__apt_pin/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__apt_pin/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__apt_pin/parameter/optional b/cdist/conf/type/__apt_pin/parameter/optional deleted file mode 100644 index 847e703d..00000000 --- a/cdist/conf/type/__apt_pin/parameter/optional +++ /dev/null @@ -1,3 +0,0 @@ -state -package -priority diff --git a/cdist/conf/type/__apt_pin/parameter/required b/cdist/conf/type/__apt_pin/parameter/required deleted file mode 100644 index c8572d92..00000000 --- a/cdist/conf/type/__apt_pin/parameter/required +++ /dev/null @@ -1 +0,0 @@ -distribution diff --git a/cdist/conf/type/__apt_ppa/files/remove-apt-repository b/cdist/conf/type/__apt_ppa/files/remove-apt-repository new file mode 100755 index 00000000..3eb7d491 --- /dev/null +++ b/cdist/conf/type/__apt_ppa/files/remove-apt-repository @@ -0,0 +1,55 @@ +#!/usr/bin/env python +# +# Remove the given apt repository. +# +# Exit with: +# 0: if it worked +# 1: if not +# 2: on other error + +import os +import sys +from aptsources import distro, sourceslist +from softwareproperties import ppa +from softwareproperties.SoftwareProperties import SoftwareProperties + + +def remove_if_empty(file_name): + with open(file_name, 'r') as f: + if f.read().strip(): + return + os.unlink(file_name) + +def remove_repository(repository): + #print 'repository:', repository + codename = distro.get_distro().codename + #print 'codename:', codename + (line, file) = ppa.expand_ppa_line(repository.strip(), codename) + #print 'line:', line + #print 'file:', file + deb_source_entry = sourceslist.SourceEntry(line, file) + src_source_entry = sourceslist.SourceEntry('deb-src{}'.format(line[3:]), file) + + try: + sp = SoftwareProperties() + sp.remove_source(deb_source_entry) + try: + # If there's a deb-src entry, remove that too + sp.remove_source(src_source_entry) + except: + pass + remove_if_empty(file) + return True + except ValueError: + print >> sys.stderr, "Error: '%s' doesn't exists in a sourcelist file" % line + return False + +if __name__ == '__main__': + if (len(sys.argv) != 2): + print >> sys.stderr, 'Error: need a repository as argument' + sys.exit(2) + repository = sys.argv[1] + if remove_repository(repository): + sys.exit(0) + else: + sys.exit(1) diff --git a/cdist/conf/type/__apt_ppa/gencode-remote b/cdist/conf/type/__apt_ppa/gencode-remote index e41341b8..84ebebfe 100755 --- a/cdist/conf/type/__apt_ppa/gencode-remote +++ b/cdist/conf/type/__apt_ppa/gencode-remote @@ -29,9 +29,9 @@ fi case "$state_should" in present) - echo "add-apt-repository -y '$name'" + echo "add-apt-repository '$name'" ;; absent) - echo "add-apt-repository -r -y '$name'" + echo "remove-apt-repository '$name'" ;; esac diff --git a/cdist/conf/type/__apt_ppa/manifest b/cdist/conf/type/__apt_ppa/manifest index 57e85442..c6f4e876 100755 --- a/cdist/conf/type/__apt_ppa/manifest +++ b/cdist/conf/type/__apt_ppa/manifest @@ -20,4 +20,9 @@ __package software-properties-common +require="__package/software-properties-common" \ + __file /usr/local/bin/remove-apt-repository \ + --source "$__type/files/remove-apt-repository" \ + --mode 0755 + require="$__object_name" __apt_update_index diff --git a/cdist/conf/type/__apt_source/files/source.list.template b/cdist/conf/type/__apt_source/files/source.list.template index a28bb45f..d4420e96 100755 --- a/cdist/conf/type/__apt_source/files/source.list.template +++ b/cdist/conf/type/__apt_source/files/source.list.template @@ -2,14 +2,13 @@ set -u entry="$uri $distribution $component" - cat << DONE # Created by cdist ${__type##*/} # Do not change. Changes will be overwritten. # # $name -deb ${options} $entry +deb ${forcedarch} $entry DONE if [ -f "$__object/parameter/include-src" ]; then echo "deb-src $entry" diff --git a/cdist/conf/type/__apt_source/gencode-remote b/cdist/conf/type/__apt_source/gencode-remote index 973b0f6c..1e8592c6 100755 --- a/cdist/conf/type/__apt_source/gencode-remote +++ b/cdist/conf/type/__apt_source/gencode-remote @@ -22,21 +22,7 @@ name="$__object_id" destination="/etc/apt/sources.list.d/${name}.list" -# There are special arguments to apt(8) to prevent aborts if apt woudn't been -# updated after the 19th April 2021 till the bullseye release. The additional -# arguments acknoledge the happend suite change (the apt(8) update does the -# same by itself). -# -# Using '-o $config' instead of the --allow-releaseinfo-change-* parameter -# allows backward compatablility to pre-buster Debian versions. -# -# See more: ticket #861 -# https://code.ungleich.ch/ungleich-public/cdist/-/issues/861 -apt_opts="-o Acquire::AllowReleaseInfoChange::Suite=true -o Acquire::AllowReleaseInfoChange::Version=true" - -# run 'apt-get update' only if something changed with our sources.list file -# it will be run a second time on error as a redundancy messure to success if grep -q "^__file${destination}" "$__messages_in"; then - printf 'apt-get %s update || apt-get %s update\n' "$apt_opts" "$apt_opts" + printf 'apt-get update || apt-get update\n' fi diff --git a/cdist/conf/type/__apt_source/man.rst b/cdist/conf/type/__apt_source/man.rst index d317a135..d1acb388 100644 --- a/cdist/conf/type/__apt_source/man.rst +++ b/cdist/conf/type/__apt_source/man.rst @@ -23,9 +23,6 @@ OPTIONAL PARAMETERS arch set this if you need to force and specific arch (ubuntu specific) -signed-by - provide a GPG key fingerprint or keyring path for signature checks - state 'present' or 'absent', defaults to 'present' @@ -59,11 +56,6 @@ EXAMPLES --uri http://archive.canonical.com/ \ --component partner --state present - __apt_source goaccess \ - --uri http://deb.goaccess.io/ \ - --component main \ - --signed-by C03B48887D5E56B046715D3297BD1A0133449C3D - AUTHORS ------- diff --git a/cdist/conf/type/__apt_source/manifest b/cdist/conf/type/__apt_source/manifest index fd1ec47f..35f15909 100755 --- a/cdist/conf/type/__apt_source/manifest +++ b/cdist/conf/type/__apt_source/manifest @@ -21,7 +21,6 @@ name="$__object_id" state="$(cat "$__object/parameter/state")" uri="$(cat "$__object/parameter/uri")" -options="" if [ -f "$__object/parameter/distribution" ]; then distribution="$(cat "$__object/parameter/distribution")" @@ -32,15 +31,9 @@ fi component="$(cat "$__object/parameter/component")" if [ -f "$__object/parameter/arch" ]; then - options="arch=$(cat "$__object/parameter/arch")" -fi - -if [ -f "$__object/parameter/signed-by" ]; then - options="$options signed-by=$(cat "$__object/parameter/signed-by")" -fi - -if [ "$options" ]; then - options="[$options]" + forcedarch="[arch=$(cat "$__object/parameter/arch")]" +else + forcedarch="" fi # export variables for use in template @@ -48,7 +41,7 @@ export name export uri export distribution export component -export options +export forcedarch # generate file from template mkdir "$__object/files" diff --git a/cdist/conf/type/__apt_source/parameter/optional b/cdist/conf/type/__apt_source/parameter/optional index 0b5470a1..87537335 100644 --- a/cdist/conf/type/__apt_source/parameter/optional +++ b/cdist/conf/type/__apt_source/parameter/optional @@ -1,5 +1,4 @@ state distribution component -arch -signed-by +arch \ No newline at end of file diff --git a/cdist/conf/type/__apt_unattended_upgrades/man.rst b/cdist/conf/type/__apt_unattended_upgrades/man.rst deleted file mode 100644 index 2231b5f9..00000000 --- a/cdist/conf/type/__apt_unattended_upgrades/man.rst +++ /dev/null @@ -1,68 +0,0 @@ -cdist-type__apt_unattended_upgrades(7) -====================================== - -NAME ----- -cdist-type__apt_unattended_upgrades - automatic installation of updates - - -DESCRIPTION ------------ - -Install and configure unattended-upgrades package. - -For more information see https://wiki.debian.org/UnattendedUpgrades. - - -OPTIONAL MULTIPLE PARAMETERS ----------------------------- -option - Set options for unattended-upgrades. See examples. - - Supported options with default values (as of 2020-01-17) are: - - - AutoFixInterruptedDpkg, default is "true" - - MinimalSteps, default is "true" - - InstallOnShutdown, default is "false" - - Mail, default is "" (empty) - - MailOnlyOnError, default is "false" - - Remove-Unused-Kernel-Packages, default is "true" - - Remove-New-Unused-Dependencies, default is "true" - - Remove-Unused-Dependencies, default is "false" - - Automatic-Reboot, default is "false" - - Automatic-Reboot-WithUsers, default is "true" - - Automatic-Reboot-Time, default is "02:00" - - SyslogEnable, default is "false" - - SyslogFacility, default is "daemon" - - OnlyOnACPower, default is "true" - - Skip-Updates-On-Metered-Connections, default is "true" - - Verbose, default is "false" - - Debug, default is "false" - -blacklist - Python regular expressions, matching packages to exclude from upgrading. - - -EXAMPLES --------- - -.. code-block:: sh - - __apt_unattended_upgrades \ - --option Mail=root \ - --option MailOnlyOnError=true \ - --blacklist multipath-tools \ - --blacklist open-iscsi - - -AUTHORS -------- -Ander Punnar - - -COPYING -------- -Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it -under the terms of the GNU General Public License as published by the Free -Software Foundation, either version 3 of the License, or (at your option) any -later version. diff --git a/cdist/conf/type/__apt_unattended_upgrades/manifest b/cdist/conf/type/__apt_unattended_upgrades/manifest deleted file mode 100755 index 3c00e2f4..00000000 --- a/cdist/conf/type/__apt_unattended_upgrades/manifest +++ /dev/null @@ -1,80 +0,0 @@ -#!/bin/sh -e -# -# 2020 Ander Punnar (ander-at-kvlt-dot-ee) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -__package unattended-upgrades - -export require='__package/unattended-upgrades' - -# in normal circumstances 20auto-upgrades is managed -# by debconf and it can only contain these lines - -__file /etc/apt/apt.conf.d/20auto-upgrades \ - --owner root \ - --group root \ - --mode 644 \ - --source - << EOF -APT::Periodic::Update-Package-Lists "1"; -APT::Periodic::Unattended-Upgrade "1"; -EOF - -# lets not write into upstream 50unattended-upgrades file, -# but use our own config file to avoid clashes - -conf_file='/etc/apt/apt.conf.d/51unattended-upgrades-cdist' - -conf='# this file is managed by cdist' - -if [ -f "$__object/parameter/option" ] -then - o='' - - while read -r l - do - o="$( printf '%s\nUnattended-Upgrade::%s "%s";\n' "$o" "${l%%=*}" "${l#*=}" )" - done \ - < "$__object/parameter/option" - - conf="$( printf '%s\n%s\n' "$conf" "$o" )" -fi - -if [ -f "$__object/parameter/blacklist" ] -then - b='Unattended-Upgrade::Package-Blacklist {' - - while read -r l - do - b="$( printf '%s\n"%s";\n' "$b" "$l" )" - done \ - < "$__object/parameter/blacklist" - - conf="$( printf '%s\n%s\n}\n' "$conf" "$b" )" -fi - -if [ "$( echo "$conf" | wc -l )" -gt 1 ] -then - echo "$conf" \ - | __file "$conf_file" \ - --owner root \ - --group root \ - --mode 644 \ - --source - -else - __file "$conf_file" --state absent -fi diff --git a/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple b/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple deleted file mode 100644 index ea4fba2b..00000000 --- a/cdist/conf/type/__apt_unattended_upgrades/parameter/optional_multiple +++ /dev/null @@ -1,2 +0,0 @@ -option -blacklist diff --git a/cdist/conf/type/__apt_unattended_upgrades/singleton b/cdist/conf/type/__apt_unattended_upgrades/singleton deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__apt_update_index/gencode-remote b/cdist/conf/type/__apt_update_index/gencode-remote index 2d7f9030..70b59710 100755 --- a/cdist/conf/type/__apt_update_index/gencode-remote +++ b/cdist/conf/type/__apt_update_index/gencode-remote @@ -18,23 +18,9 @@ # along with cdist. If not, see . # - -# There are special arguments to apt(8) to prevent aborts if apt woudn't been -# updated after the 19th April 2021 till the bullseye release. The additional -# arguments acknoledge the happend suite change (the apt(8) update does the -# same by itself). -# -# Using '-o $config' instead of the --allow-releaseinfo-change-* parameter -# allows backward compatablility to pre-buster Debian versions. -# -# See more: ticket #861 -# https://code.ungleich.ch/ungleich-public/cdist/-/issues/861 -apt_opts="-o Acquire::AllowReleaseInfoChange::Suite=true -o Acquire::AllowReleaseInfoChange::Version=true" - # run 'apt-get update' if anything in /etc/apt is newer then /var/lib/apt/lists -# it will be run a second time on error as a redundancy messure to success cat << DONE if find /etc/apt -mindepth 1 -cnewer /var/lib/apt/lists | grep . > /dev/null; then - apt-get $apt_opts update || apt-get $apt_opts update + apt-get update || apt-get update fi DONE diff --git a/cdist/conf/type/__block/gencode-remote b/cdist/conf/type/__block/gencode-remote index 7a1f4064..1f5cc033 100755 --- a/cdist/conf/type/__block/gencode-remote +++ b/cdist/conf/type/__block/gencode-remote @@ -46,29 +46,28 @@ fi remove_block() { cat << DONE -tmpfile=\$(mktemp ${quoted_file}.cdist.XXXXXXXXXX) +tmpfile=\$(mktemp ${file}.cdist.XXXXXXXXXX) # preserve ownership and permissions of existing file -if [ -f $quoted_file ]; then - cp -p $quoted_file "\$tmpfile" +if [ -f "$file" ]; then + cp -p "$file" "\$tmpfile" fi -awk -v prefix=$(quote "$prefix") -v suffix=$(quote "$suffix") ' +awk -v prefix=^$(quote "$prefix")\$ -v suffix=^$(quote "$suffix")\$ ' { - if (\$0 == prefix) { + if (match(\$0,prefix)) { triggered=1 } if (triggered) { - if (\$0 == suffix) { + if (match(\$0,suffix)) { triggered=0 } } else { print } -}' $quoted_file > "\$tmpfile" -mv -f "\$tmpfile" $quoted_file +}' "$file" > "\$tmpfile" +mv -f "\$tmpfile" "$file" DONE } -quoted_file="$(quote "$file")" case "$state_should" in present) if [ "$state_is" = "changed" ]; then @@ -78,7 +77,7 @@ case "$state_should" in echo add >> "$__messages_out" fi cat << DONE -cat >> $quoted_file << '${__type##*/}_DONE' +cat >> "$file" << ${__type##*/}_DONE $(cat "$block") ${__type##*/}_DONE DONE diff --git a/cdist/conf/type/__cdist/manifest b/cdist/conf/type/__cdist/manifest index 0b0f1263..a97cf288 100755 --- a/cdist/conf/type/__cdist/manifest +++ b/cdist/conf/type/__cdist/manifest @@ -37,7 +37,6 @@ source="$(cat "$__object/parameter/source")" # out of it home=/home/$username -# shellcheck disable=SC2086 __user "$username" --home "$home" $shell require="__user/$username" __directory "$home" \ diff --git a/cdist/conf/type/__clean_path/explorer/list b/cdist/conf/type/__clean_path/explorer/list index 2bdc63a5..07d38127 100755 --- a/cdist/conf/type/__clean_path/explorer/list +++ b/cdist/conf/type/__clean_path/explorer/list @@ -18,12 +18,7 @@ # along with cdist. If not, see . # -if [ -f "$__object/parameter/path" ] -then - path="$( cat "$__object/parameter/path" )" -else - path="/$__object_id" -fi +path="/$__object_id" [ ! -d "$path" ] && exit 0 diff --git a/cdist/conf/type/__clean_path/gencode-remote b/cdist/conf/type/__clean_path/gencode-remote index 2899c4a5..998a70d8 100755 --- a/cdist/conf/type/__clean_path/gencode-remote +++ b/cdist/conf/type/__clean_path/gencode-remote @@ -20,12 +20,7 @@ [ ! -s "$__object/explorer/list" ] && exit 0 -if [ -f "$__object/parameter/path" ] -then - path="$( cat "$__object/parameter/path" )" -else - path="/$__object_id" -fi +path="/$__object_id" pattern="$( cat "$__object/parameter/pattern" )" diff --git a/cdist/conf/type/__clean_path/man.rst b/cdist/conf/type/__clean_path/man.rst index 31d90701..826f4589 100644 --- a/cdist/conf/type/__clean_path/man.rst +++ b/cdist/conf/type/__clean_path/man.rst @@ -10,7 +10,7 @@ DESCRIPTION ----------- Remove files and directories which match the pattern. -Provided path must be a directory. +Provided path (as __object_id) must be a directory. Patterns are passed to ``find``'s ``-regex`` - see ``find(1)`` for more details. @@ -29,9 +29,6 @@ pattern OPTIONAL PARAMETERS ------------------- -path - Path which will be cleaned. Defaults to ``$__object_id``. - exclude Pattern of files which are excluded from removal. @@ -49,11 +46,6 @@ EXAMPLES --exclude '.+\(charset\.conf\|security\.conf\)' \ --onchange 'service apache2 restart' - __clean_path apache2-conf-enabled \ - --path /etc/apache2/conf-enabled \ - --pattern '.+' \ - --exclude '.+\(charset\.conf\|security\.conf\)' \ - --onchange 'service apache2 restart' AUTHORS ------- diff --git a/cdist/conf/type/__clean_path/parameter/optional b/cdist/conf/type/__clean_path/parameter/optional index 3b97f71c..6f313474 100644 --- a/cdist/conf/type/__clean_path/parameter/optional +++ b/cdist/conf/type/__clean_path/parameter/optional @@ -1,3 +1,2 @@ exclude onchange -path diff --git a/cdist/conf/type/__consul_agent/man.rst b/cdist/conf/type/__consul_agent/man.rst index 62ee70bb..966abc60 100644 --- a/cdist/conf/type/__consul_agent/man.rst +++ b/cdist/conf/type/__consul_agent/man.rst @@ -116,9 +116,6 @@ verify-incoming verify-outgoing enforce the use of TLS and verify the peers authenticity on outgoing connections -use-distribution-package - uses distribution package instead of upstream binary - EXAMPLES -------- diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest index 7b54529c..a88d26ed 100755 --- a/cdist/conf/type/__consul_agent/manifest +++ b/cdist/conf/type/__consul_agent/manifest @@ -1,8 +1,7 @@ #!/bin/sh -e # # 2015 Steven Armstrong (steven-cdist at armstrong.cc) -# 2015-2020 Nico Schottelius (nico-cdist at schottelius.org) -# 2019 Timothée Floure (timothee.floure at ungleich.ch) +# 2015-2019 Nico Schottelius (nico-cdist at schottelius.org) # # This file is part of cdist. # @@ -20,87 +19,133 @@ # along with cdist. If not, see . # + os=$(cat "$__global/explorer/os") -### -# Type parameters. +case "$os" in + alpine|scientific|centos|debian|devuan|redhat|ubuntu) + # whitelist safeguard + : + ;; + *) + echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2 + echo "Please contribute an implementation for it if you can." >&2 + exit 1 + ;; +esac state="$(cat "$__object/parameter/state")" user="$(cat "$__object/parameter/user")" group="$(cat "$__object/parameter/group")" -release=$(cat "$__global/explorer/lsb_release") -if [ -f "$__object/parameter/use-distribution-package" ]; then - use_distribution_package=1 -fi - -### -# Those are default that might be overriden by os-specific logic. - data_dir="/var/lib/consul" +conf_dir="/etc/consul/conf.d" +conf_file="config.json" - - -tls_dir="$conf_dir/tls" - -case "$os" in - alpine) - conf_dir="/etc/consul" - conf_file="server.json" - ;; - *) - conf_dir="/etc/consul/conf.d" - conf_file="config.json" - ;; +# FIXME: there has got to be a better way to handle the dependencies in this case +case "$state" in + present) + __group "$group" --system --state "$state" + require="__group/$group" \ + __user "$user" --system --gid "$group" \ + --home "$data_dir" --state "$state" + export require="__user/consul" + ;; + absent) + echo "Sorry, state=absent currently not supported :-(" >&2 + exit 1 + require="$__object_name" \ + __user "$user" --system --gid "$group" --state "$state" + require="__user/$user" \ + __group "$group" --system --state "$state" + ;; esac -### -# Sane deployment, based on distribution package when available. +__directory /etc/consul \ + --owner root --group "$group" --mode 750 --state "$state" +require="__directory/etc/consul" \ + __directory "$conf_dir" \ + --owner root --group "$group" --mode 750 --state "$state" -distribution_setup () { - case "$os" in - debian) - # consul is only available starting Debian 10 (buster). - # See https://packages.debian.org/buster/consul - if [ "$release" -lt 10 ]; then - echo "Consul is not available for your debian release." >&2 - echo "Please use the 'manual' (i.e. non-package) installation or \ - upgrade the target system." >&2 - exit 1 - fi +if [ -f "$__object/parameter/ca-file-source" ] || [ -f "$__object/parameter/cert-file-source" ] || [ -f "$__object/parameter/key-file-source" ]; then + # create directory for ssl certs + require="__directory/etc/consul" \ + __directory /etc/consul/ssl \ + --owner root --group "$group" --mode 750 --state "$state" +fi - # Override previously defined environment to match debian packaging. - conf_dir='/etc/consul.d' - user='consul' - group='consul' - ;; - alpine) - # consul is only available starting Alpine 3.12 (= edge during the 3.11 cycle). - # See https://pkgs.alpinelinux.org/packages?name=consul&branch=edge +__directory "$data_dir" \ + --owner "$user" --group "$group" --mode 770 --state "$state" - # Override previously defined environment to match alpine packaging. - conf_dir='/etc/consul' - conf_file='server.json' - data_dir='/var/consul' - user='consul' - group='consul' - ;; - *) - echo "Your operating system ($os) is currently not supported with the \ - --use-distribution-package flag (${__type##*/})." >&2 - echo "Please use non-package installation or contribute an \ - implementation for if you can." >&2 - exit 1 - ;; - esac - # Install consul package. - __package consul --state "$state" +# Generate json config file +( +echo "{" - export config_deployment_requires="__package/consul" -} +# parameters we define ourself +printf ' "data_dir": "%s"\n' "$data_dir" -### -# LEGACY manual deployment, kept for compatibility reasons. +cd "$__object/parameter/" +for param in *; do + case "$param" in + state|user|group|json-config) continue ;; + ca-file-source|cert-file-source|key-file-source) + source="$(cat "$__object/parameter/$param")" + destination="/etc/consul/ssl/${source##*/}" + require="__directory/etc/consul/ssl" \ + __file "$destination" \ + --owner root --group consul --mode 640 \ + --source "$source" \ + --state "$state" + key="$(echo "${param%-*}" | tr '-' '_')" + printf ' ,"%s": "%s"\n' "$key" "$destination" + ;; + disable-remote-exec|disable-update-check|leave-on-terminate|rejoin-after-leave|server|enable-syslog|verify-incoming|verify-outgoing) + # handle boolean parameters + key="$(echo "$param" | tr '-' '_')" + printf ' ,"%s": true\n' "$key" + ;; + retry-join) + # join multiple parameters into json array + retry_join="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join")" + # remove trailing , + printf ' ,"retry_join": [%s]\n' "${retry_join%*,}" + ;; + retry-join-wan) + # join multiple parameters into json array over wan + retry_join_wan="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join-wan")" + # remove trailing , + printf ' ,"retry_join_wan": [%s]\n' "${retry_join_wan%*,}" + ;; + bootstrap-expect) + # integer key=value parameters + key="$(echo "$param" | tr '-' '_')" + printf ' ,"%s": %s\n' "$key" "$(cat "$__object/parameter/$param")" + ;; + *) + # string key=value parameters + key="$(echo "$param" | tr '-' '_')" + printf ' ,"%s": "%s"\n' "$key" "$(cat "$__object/parameter/$param")" + ;; + esac +done +if [ -f "$__object/parameter/json-config" ]; then + json_config="$(cat "$__object/parameter/json-config")" + if [ "$json_config" = "-" ]; then + json_config="$__object/stdin" + fi + # remove leading and trailing whitespace and commas from first and last line + # indent each line with 3 spaces for consistency + json=$(sed -e 's/^[ \t]*/ /' -e '1s/^[ \t,]*//' -e '$s/[ \t,]*$//' "$json_config") + printf ' ,%s\n' "$json" +fi +echo "}" +) | \ +require="__directory${conf_dir}" \ + __config_file "${conf_dir}/${conf_file}" \ + --owner root --group "$group" --mode 640 \ + --state "$state" \ + --onchange 'service consul status >/dev/null && service consul reload || true' \ + --source - init_sysvinit() { @@ -134,186 +179,47 @@ init_upstart() require="__file/etc/init/consul.conf" __start_on_boot consul } -manual_setup () { - case "$os" in - alpine|scientific|centos|debian|devuan|redhat|ubuntu) - # whitelist safeguard - : - ;; - *) - echo "Your operating system ($os) is currently not supported by this \ - type (${__type##*/})." >&2 - echo "Please contribute an implementation for it if you can." >&2 - exit 1 - ;; - esac - - # FIXME: there has got to be a better way to handle the dependencies in this case - case "$state" in - present) - __group "$group" --system --state "$state" - require="__group/$group" __user "$user" \ - --system --gid "$group" --home "$data_dir" --state "$state" - ;; - *) - echo "The $state state is not (yet?) supported by this type." >&2 - exit 1 - ;; - esac - - # Create data directory. - require="__user/consul" __directory "$data_dir" \ - --owner "$user" --group "$group" --mode 770 --state "$state" - - # Create config directory. - require="__user/consul" __directory "$conf_dir" \ - --parents --owner root --group "$group" --mode 750 --state "$state" - - # Install init script to start on boot - case "$os" in - devuan) - init_sysvinit debian - ;; - centos|redhat) - os_version="$(sed 's/[^0-9.]//g' "$__global/explorer/os_version")" - major_version="${os_version%%.*}" - case "$major_version" in - [456]) - init_sysvinit redhat - ;; - 7) - init_systemd - ;; - *) - echo "Unsupported CentOS/Redhat version: $os_version" >&2 - exit 1 - ;; - esac - ;; - - debian) - os_version=$(cat "$__global/explorer/os_version") - major_version="${os_version%%.*}" - - case "$major_version" in - [567]) - init_sysvinit debian - ;; - [89]|10) - init_systemd - ;; - *) - echo "Unsupported Debian version $os_version" >&2 - exit 1 - ;; - esac - ;; - - ubuntu) - init_upstart - ;; - esac - - config_deployment_requires="__user/consul __directory/$conf_dir" -} - -### -# Trigger requested installation method. -if [ $use_distribution_package ]; then - distribution_setup -else - manual_setup -fi - -### -# Install TLS certificates. - -if [ -f "$__object/parameter/ca-file-source" ] || \ - [ -f "$__object/parameter/cert-file-source" ] || \ - [ -f "$__object/parameter/key-file-source" ]; then - - requires="$config_deployment_requires" __directory "$tls_dir" \ - --owner root --group "$group" --mode 750 --state "$state" - - # Append to service restart requirements. - restart_requires="$restart_requires __directory/$conf_dir/tls" -fi - -### -# Generate and deploy configuration. - -json_configuration=$( - echo "{" - - # parameters we define ourself - printf ' "data_dir": "%s"\n' "$data_dir" - - cd "$__object/parameter/" - for param in *; do - case "$param" in - state|user|group|json-config|use-distribution-package) continue ;; - ca-file-source|cert-file-source|key-file-source) - source="$(cat "$__object/parameter/$param")" - destination="$tls_dir/${source##*/}" - require="__directory/$tls_dir" \ - __file "$destination" \ - --owner root --group consul --mode 640 \ - --source "$source" \ - --state "$state" - key="$(echo "${param%-*}" | tr '-' '_')" - printf ' ,"%s": "%s"\n' "$key" "$destination" +# Install init script to start on boot +case "$os" in + alpine|devuan) + init_sysvinit debian ;; - disable-remote-exec|disable-update-check|leave-on-terminate\ - |rejoin-after-leave|server|enable-syslog|verify-incoming|verify-outgoing) - # handle boolean parameters - key="$(echo "$param" | tr '-' '_')" - printf ' ,"%s": true\n' "$key" + centos|redhat) + os_version="$(sed 's/[^0-9.]//g' "$__global/explorer/os_version")" + major_version="${os_version%%.*}" + case "$major_version" in + [456]) + init_sysvinit redhat + ;; + 7) + init_systemd + ;; + *) + echo "Unsupported CentOS/Redhat version: $os_version" >&2 + exit 1 + ;; + esac ;; - retry-join) - # join multiple parameters into json array - retry_join="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join")" - # remove trailing , - printf ' ,"retry_join": [%s]\n' "${retry_join%*,}" - ;; - retry-join-wan) - # join multiple parameters into json array over wan - retry_join_wan="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join-wan")" - # remove trailing , - printf ' ,"retry_join_wan": [%s]\n' "${retry_join_wan%*,}" - ;; - bootstrap-expect) - # integer key=value parameters - key="$(echo "$param" | tr '-' '_')" - printf ' ,"%s": %s\n' "$key" "$(cat "$__object/parameter/$param")" - ;; - *) - # string key=value parameters - key="$(echo "$param" | tr '-' '_')" - printf ' ,"%s": "%s"\n' "$key" "$(cat "$__object/parameter/$param")" - ;; - esac - done - if [ -f "$__object/parameter/json-config" ]; then - json_config="$(cat "$__object/parameter/json-config")" - if [ "$json_config" = "-" ]; then - json_config="$__object/stdin" - fi - # remove leading and trailing whitespace and commas from first and last line - # indent each line with 3 spaces for consistency - json=$(sed -e 's/^[ \t]*/ /' -e '1s/^[ \t,]*//' -e '$s/[ \t,]*$//' "$json_config") - printf ' ,%s\n' "$json" - fi - echo "}" -) -echo "$json_configuration" | require="$config_deployment_requires" \ - __file "$conf_dir/$conf_file" \ - --owner root --group "$group" --mode 640 \ - --state "$state" \ - --source - -# Set configuration deployment as requirement for service restart. -restart_requires="__file/$conf_dir/$conf_file" + debian) + os_version=$(cat "$__global/explorer/os_version") + major_version="${os_version%%.*}" -### -# Restart consul agent after everything else. -require="$restart_requires" __service consul --action restart + case "$major_version" in + [567]) + init_sysvinit debian + ;; + [89]) + init_systemd + ;; + *) + echo "Unsupported Debian version $os_version" >&2 + exit 1 + ;; + esac + ;; + + ubuntu) + init_upstart + ;; +esac diff --git a/cdist/conf/type/__consul_agent/parameter/boolean b/cdist/conf/type/__consul_agent/parameter/boolean index c86853c3..91f7f17e 100644 --- a/cdist/conf/type/__consul_agent/parameter/boolean +++ b/cdist/conf/type/__consul_agent/parameter/boolean @@ -6,4 +6,3 @@ server enable-syslog verify-incoming verify-outgoing -use-distribution-package diff --git a/cdist/conf/type/__consul_check/explorer/conf-dir b/cdist/conf/type/__consul_check/explorer/conf-dir deleted file mode 120000 index daa712c3..00000000 --- a/cdist/conf/type/__consul_check/explorer/conf-dir +++ /dev/null @@ -1 +0,0 @@ -../../__consul_service/explorer/conf-dir \ No newline at end of file diff --git a/cdist/conf/type/__consul_check/manifest b/cdist/conf/type/__consul_check/manifest index 522aa1a9..c9f7add9 100755 --- a/cdist/conf/type/__consul_check/manifest +++ b/cdist/conf/type/__consul_check/manifest @@ -19,7 +19,7 @@ # name="$(cat "$__object/parameter/name" 2>/dev/null || echo "$__object_id")" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="check_${name}.json" state="$(cat "$__object/parameter/state")" diff --git a/cdist/conf/type/__consul_service/explorer/conf-dir b/cdist/conf/type/__consul_service/explorer/conf-dir deleted file mode 100644 index 0fc9ef84..00000000 --- a/cdist/conf/type/__consul_service/explorer/conf-dir +++ /dev/null @@ -1,15 +0,0 @@ -# Determine the configuration directory used by consul. - -check_dir () { - if [ -d "$1" ]; then - printf '%s' "$1" - exit - fi -} - -check_dir '/etc/consul/conf.d' -check_dir '/etc/consul.d' -check_dir '/etc/consul' - -echo 'Could not determine consul configuration dir. Exiting.' >&2 -exit 1 diff --git a/cdist/conf/type/__consul_service/manifest b/cdist/conf/type/__consul_service/manifest index d16f18e0..60397db7 100755 --- a/cdist/conf/type/__consul_service/manifest +++ b/cdist/conf/type/__consul_service/manifest @@ -19,7 +19,7 @@ # name="$(cat "$__object/parameter/name" 2>/dev/null || echo "$__object_id")" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="service_${name}.json" state="$(cat "$__object/parameter/state")" @@ -45,7 +45,7 @@ printf ' "name": "%s"\n' "$name" cd "$__object/parameter/" for param in *; do case "$param" in - state|name|check-interval|conf-dir) continue ;; + state|name|check-interval) continue ;; check-script) printf ' ,"check": {\n' printf ' "script": "%s"\n' "$(cat "$__object/parameter/check-script")" @@ -86,6 +86,7 @@ echo " }" # end json file echo "}" ) | \ +require="__directory${conf_dir}" \ __config_file "${conf_dir}/${conf_file}" \ --owner root --group consul --mode 640 \ --state "$state" \ diff --git a/cdist/conf/type/__consul_watch_checks/explorer/conf-dir b/cdist/conf/type/__consul_watch_checks/explorer/conf-dir deleted file mode 120000 index daa712c3..00000000 --- a/cdist/conf/type/__consul_watch_checks/explorer/conf-dir +++ /dev/null @@ -1 +0,0 @@ -../../__consul_service/explorer/conf-dir \ No newline at end of file diff --git a/cdist/conf/type/__consul_watch_checks/manifest b/cdist/conf/type/__consul_watch_checks/manifest index 4976b25a..5fdd7a74 100755 --- a/cdist/conf/type/__consul_watch_checks/manifest +++ b/cdist/conf/type/__consul_watch_checks/manifest @@ -20,7 +20,7 @@ cdist_type="${__type##*/}" watch_type="${cdist_type##*_}" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="watch_${watch_type}_${__object_id}.json" state="$(cat "$__object/parameter/state")" diff --git a/cdist/conf/type/__consul_watch_event/explorer/conf-dir b/cdist/conf/type/__consul_watch_event/explorer/conf-dir deleted file mode 120000 index daa712c3..00000000 --- a/cdist/conf/type/__consul_watch_event/explorer/conf-dir +++ /dev/null @@ -1 +0,0 @@ -../../__consul_service/explorer/conf-dir \ No newline at end of file diff --git a/cdist/conf/type/__consul_watch_event/manifest b/cdist/conf/type/__consul_watch_event/manifest index b17680c1..61934656 100755 --- a/cdist/conf/type/__consul_watch_event/manifest +++ b/cdist/conf/type/__consul_watch_event/manifest @@ -20,7 +20,7 @@ cdist_type="${__type##*/}" watch_type="${cdist_type##*_}" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="watch_${watch_type}_${__object_id}.json" state="$(cat "$__object/parameter/state")" diff --git a/cdist/conf/type/__consul_watch_key/explorer/conf-dir b/cdist/conf/type/__consul_watch_key/explorer/conf-dir deleted file mode 120000 index daa712c3..00000000 --- a/cdist/conf/type/__consul_watch_key/explorer/conf-dir +++ /dev/null @@ -1 +0,0 @@ -../../__consul_service/explorer/conf-dir \ No newline at end of file diff --git a/cdist/conf/type/__consul_watch_key/manifest b/cdist/conf/type/__consul_watch_key/manifest index b17680c1..61934656 100755 --- a/cdist/conf/type/__consul_watch_key/manifest +++ b/cdist/conf/type/__consul_watch_key/manifest @@ -20,7 +20,7 @@ cdist_type="${__type##*/}" watch_type="${cdist_type##*_}" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="watch_${watch_type}_${__object_id}.json" state="$(cat "$__object/parameter/state")" diff --git a/cdist/conf/type/__consul_watch_keyprefix/explorer/conf-dir b/cdist/conf/type/__consul_watch_keyprefix/explorer/conf-dir deleted file mode 120000 index daa712c3..00000000 --- a/cdist/conf/type/__consul_watch_keyprefix/explorer/conf-dir +++ /dev/null @@ -1 +0,0 @@ -../../__consul_service/explorer/conf-dir \ No newline at end of file diff --git a/cdist/conf/type/__consul_watch_keyprefix/manifest b/cdist/conf/type/__consul_watch_keyprefix/manifest index b17680c1..61934656 100755 --- a/cdist/conf/type/__consul_watch_keyprefix/manifest +++ b/cdist/conf/type/__consul_watch_keyprefix/manifest @@ -20,7 +20,7 @@ cdist_type="${__type##*/}" watch_type="${cdist_type##*_}" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="watch_${watch_type}_${__object_id}.json" state="$(cat "$__object/parameter/state")" diff --git a/cdist/conf/type/__consul_watch_nodes/explorer/conf-dir b/cdist/conf/type/__consul_watch_nodes/explorer/conf-dir deleted file mode 120000 index daa712c3..00000000 --- a/cdist/conf/type/__consul_watch_nodes/explorer/conf-dir +++ /dev/null @@ -1 +0,0 @@ -../../__consul_service/explorer/conf-dir \ No newline at end of file diff --git a/cdist/conf/type/__consul_watch_nodes/manifest b/cdist/conf/type/__consul_watch_nodes/manifest index b17680c1..61934656 100755 --- a/cdist/conf/type/__consul_watch_nodes/manifest +++ b/cdist/conf/type/__consul_watch_nodes/manifest @@ -20,7 +20,7 @@ cdist_type="${__type##*/}" watch_type="${cdist_type##*_}" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="watch_${watch_type}_${__object_id}.json" state="$(cat "$__object/parameter/state")" diff --git a/cdist/conf/type/__consul_watch_service/explorer/conf-dir b/cdist/conf/type/__consul_watch_service/explorer/conf-dir deleted file mode 120000 index daa712c3..00000000 --- a/cdist/conf/type/__consul_watch_service/explorer/conf-dir +++ /dev/null @@ -1 +0,0 @@ -../../__consul_service/explorer/conf-dir \ No newline at end of file diff --git a/cdist/conf/type/__consul_watch_service/manifest b/cdist/conf/type/__consul_watch_service/manifest index e8d18328..db38eb18 100755 --- a/cdist/conf/type/__consul_watch_service/manifest +++ b/cdist/conf/type/__consul_watch_service/manifest @@ -20,7 +20,7 @@ cdist_type="${__type##*/}" watch_type="${cdist_type##*_}" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="watch_${watch_type}_${__object_id}.json" state="$(cat "$__object/parameter/state")" diff --git a/cdist/conf/type/__consul_watch_services/explorer/conf-dir b/cdist/conf/type/__consul_watch_services/explorer/conf-dir deleted file mode 120000 index daa712c3..00000000 --- a/cdist/conf/type/__consul_watch_services/explorer/conf-dir +++ /dev/null @@ -1 +0,0 @@ -../../__consul_service/explorer/conf-dir \ No newline at end of file diff --git a/cdist/conf/type/__consul_watch_services/manifest b/cdist/conf/type/__consul_watch_services/manifest index b17680c1..61934656 100755 --- a/cdist/conf/type/__consul_watch_services/manifest +++ b/cdist/conf/type/__consul_watch_services/manifest @@ -20,7 +20,7 @@ cdist_type="${__type##*/}" watch_type="${cdist_type##*_}" -conf_dir=$(cat "$__object/explorer/conf-dir") +conf_dir="/etc/consul/conf.d" conf_file="watch_${watch_type}_${__object_id}.json" state="$(cat "$__object/parameter/state")" diff --git a/cdist/conf/type/__cron/gencode-remote b/cdist/conf/type/__cron/gencode-remote index 9debbc47..59398058 100755 --- a/cdist/conf/type/__cron/gencode-remote +++ b/cdist/conf/type/__cron/gencode-remote @@ -31,28 +31,24 @@ if [ -f "$__object/parameter/raw" ]; then elif [ -f "$__object/parameter/raw_command" ]; then entry="$command" else - minute="$(cat "$__object/parameter/minute")" - hour="$(cat "$__object/parameter/hour")" - day_of_month="$(cat "$__object/parameter/day_of_month")" - month="$(cat "$__object/parameter/month")" - day_of_week="$(cat "$__object/parameter/day_of_week")" + minute="$(cat "$__object/parameter/minute" 2>/dev/null || echo "*")" + hour="$(cat "$__object/parameter/hour" 2>/dev/null || echo "*")" + day_of_month="$(cat "$__object/parameter/day_of_month" 2>/dev/null || echo "*")" + month="$(cat "$__object/parameter/month" 2>/dev/null || echo "*")" + day_of_week="$(cat "$__object/parameter/day_of_week" 2>/dev/null || echo "*")" entry="$minute $hour $day_of_month $month $day_of_week $command # $name" fi mkdir "$__object/files" echo "$entry" > "$__object/files/entry" -if [ -s "$__object/explorer/entry" ]; then - if diff -q "$__object/files/entry" "$__object/explorer/entry" >/dev/null; then - state_is=present - else - state_is=modified - fi +if diff -q "$__object/files/entry" "$__object/explorer/entry" >/dev/null; then + state_is=present else state_is=absent fi -state_should="$(cat "$__object/parameter/state")" +state_should="$(cat "$__object/parameter/state" 2>/dev/null || echo "present")" [ "$state_is" = "$state_should" ] && exit 0 diff --git a/cdist/conf/type/__cron/man.rst b/cdist/conf/type/__cron/man.rst index e39bfb5c..d0694738 100644 --- a/cdist/conf/type/__cron/man.rst +++ b/cdist/conf/type/__cron/man.rst @@ -21,11 +21,6 @@ command OPTIONAL PARAMETERS ------------------- -**NOTE**: All time-related parameters (``--minute``, ``--hour``, ``--day_of_month`` -``--month`` and ``--day_of_week``) defaults to ``*``, which means to execute it -**always**. If you set ``--hour 0`` to execute the cronjob only at midnight, it -will execute **every** minute in the first hour of the morning all days. - state Either present or absent. Defaults to present. minute diff --git a/cdist/conf/type/__cron/manifest b/cdist/conf/type/__cron/manifest index e7b51863..53973e07 100755 --- a/cdist/conf/type/__cron/manifest +++ b/cdist/conf/type/__cron/manifest @@ -22,12 +22,3 @@ if [ -f "$__object/parameter/raw" ] && [ -f "$__object/parameter/raw_command" ]; echo "ERROR: both raw and raw_command specified" >&2 exit 1 fi - -case "$(cat "$__object/parameter/state")" in - present) ;; - absent) ;; - - *) - echo "ERROR: unkown cron state" >&2 - exit 2 -esac diff --git a/cdist/conf/type/__cron/nonparallel b/cdist/conf/type/__cron/nonparallel deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__cron/parameter/default/day_of_month b/cdist/conf/type/__cron/parameter/default/day_of_month deleted file mode 100644 index 72e8ffc0..00000000 --- a/cdist/conf/type/__cron/parameter/default/day_of_month +++ /dev/null @@ -1 +0,0 @@ -* diff --git a/cdist/conf/type/__cron/parameter/default/day_of_week b/cdist/conf/type/__cron/parameter/default/day_of_week deleted file mode 100644 index 72e8ffc0..00000000 --- a/cdist/conf/type/__cron/parameter/default/day_of_week +++ /dev/null @@ -1 +0,0 @@ -* diff --git a/cdist/conf/type/__cron/parameter/default/hour b/cdist/conf/type/__cron/parameter/default/hour deleted file mode 100644 index 72e8ffc0..00000000 --- a/cdist/conf/type/__cron/parameter/default/hour +++ /dev/null @@ -1 +0,0 @@ -* diff --git a/cdist/conf/type/__cron/parameter/default/minute b/cdist/conf/type/__cron/parameter/default/minute deleted file mode 100644 index 72e8ffc0..00000000 --- a/cdist/conf/type/__cron/parameter/default/minute +++ /dev/null @@ -1 +0,0 @@ -* diff --git a/cdist/conf/type/__cron/parameter/default/month b/cdist/conf/type/__cron/parameter/default/month deleted file mode 100644 index 72e8ffc0..00000000 --- a/cdist/conf/type/__cron/parameter/default/month +++ /dev/null @@ -1 +0,0 @@ -* diff --git a/cdist/conf/type/__cron/parameter/default/state b/cdist/conf/type/__cron/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__cron/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__debconf_set_selections/explorer/state b/cdist/conf/type/__debconf_set_selections/explorer/state deleted file mode 100644 index f8a3f6c8..00000000 --- a/cdist/conf/type/__debconf_set_selections/explorer/state +++ /dev/null @@ -1,142 +0,0 @@ -#!/bin/sh -e -# -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Determine current debconf selections' state. -# Prints one of: -# present: all selections are already set as they should. -# different: one or more of the selections have a different value. -# absent: one or more of the selections are not (currently) defined. -# - -test -x /usr/bin/perl || { - # cannot find perl (no perl ~ no debconf) - echo 'absent' - exit 0 -} - -linesfile="${__object:?}/parameter/line" -test -s "${linesfile}" || { - if test -s "${__object:?}/parameter/file" - then - echo absent - else - echo present - fi - exit 0 -} - -# assert __type_explorer is set (because it is used by the Perl script) -: "${__type_explorer:?}" - -/usr/bin/perl -- - "${linesfile}" <<'EOF' -use strict; -use warnings "all"; - -use Fcntl qw(:DEFAULT :flock); - -use Debconf::Db; -use Debconf::Question; - -# Extract @known... arrays from debconf-set-selections -# These values are required to distinguish flags and values in the given lines. -# DC: I couldn't think of a more ugly solution to the problem… -my @knownflags; -my @knowntypes; -my $debconf_set_selections = '/usr/bin/debconf-set-selections'; -if (-e $debconf_set_selections) { - my $sed_known = 's/^my \(@known\(flags\|types\) = qw([a-z ]*);\).*$/\1/p'; - eval `sed -n '$sed_known' '$debconf_set_selections'`; -} - -sub mungeline ($) { - my $line = shift; - chomp $line; - $line =~ s/\r$//; - return $line; -} - -sub fatal { printf STDERR @_; exit 1; } - -my $state = 'present'; - -sub state { - my $new = shift; - if ($state eq 'present' - or ($state eq 'different' and $new eq 'absent')) { - $state = $new; - } -} - - -# Load Debconf DB but manually lock on the state explorer script, -# because Debconf aborts immediately if executed concurrently. -# This is not really an ideal solution because the Debconf DB could be locked by -# another process (e.g. apt-get), but no way to achieve this could be found. -# If you know how to, please provide a patch. -my $lockfile = "%ENV{'__type_explorer'}/state"; -if (open my $lock_fh, '+<', $lockfile) { - flock $lock_fh, LOCK_EX or die "Cannot lock $lockfile"; -} -{ - Debconf::Db->load(readonly => 'true'); -} - - -while (<>) { - # Read and process lines (taken from debconf-set-selections) - $_ = mungeline($_); - while (/\\$/ && ! eof) { - s/\\$//; - $_ .= mungeline(<>); - } - next if /^\s*$/ || /^\s*\#/; - - my ($owner, $label, $type, $content) = /^\s*(\S+)\s+(\S+)\s+(\S+)(?:\s(.*))?/ - or fatal "invalid line: %s\n", $_; - $content = '' unless defined $content; - - - # Compare is and should state - my $q = Debconf::Question->get($label); - - unless (defined $q) { - # probably a preseed - state 'absent'; - next; - } - - if (grep { $_ eq $q->type } @knownflags) { - # This line wants to set a flag, presumably. - if ($q->flag($q->type) ne $content) { - state 'different'; - } - } else { - # Otherwise, it's probably a value… - if ($q->value ne $content) { - state 'different'; - } - - unless (grep { $_ eq $owner } (split /, /, $q->owners)) { - state 'different'; - } - } -} - -printf "%s\n", $state; -EOF diff --git a/cdist/conf/type/__debconf_set_selections/gencode-remote b/cdist/conf/type/__debconf_set_selections/gencode-remote index 9ba28f09..e99aef40 100755 --- a/cdist/conf/type/__debconf_set_selections/gencode-remote +++ b/cdist/conf/type/__debconf_set_selections/gencode-remote @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2011-2014 Nico Schottelius (nico-cdist at schottelius.org) -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -18,37 +17,16 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # +# +# Setup selections +# -if test -f "${__object:?}/parameter/line" -then - filename="${__object:?}/parameter/line" -elif test -s "${__object:?}/parameter/file" -then - filename=$(cat "${__object:?}/parameter/file") - if test "${filename}" = '-' - then - filename="${__object:?}/stdin" - fi -else - printf 'Neither --line nor --file set.\n' >&2 - exit 1 +filename="$(cat "$__object/parameter/file")" + +if [ "$filename" = "-" ]; then + filename="$__object/stdin" fi -# setting no lines makes no sense -test -s "${filename}" || exit 0 - -state_is=$(cat "${__object:?}/explorer/state") - -if test "${state_is}" != 'present' -then - cat <<-CODE - debconf-set-selections <<'EOF' - $(cat "${filename}") - EOF - CODE - - awk ' - { - printf "set %s %s %s %s\n", $1, $2, $3, $4 - }' "${filename}" >>"${__messages_out:?}" -fi +echo "debconf-set-selections << __file-eof" +cat "$filename" +echo "__file-eof" diff --git a/cdist/conf/type/__debconf_set_selections/man.rst b/cdist/conf/type/__debconf_set_selections/man.rst index fd0040ae..58c25b81 100644 --- a/cdist/conf/type/__debconf_set_selections/man.rst +++ b/cdist/conf/type/__debconf_set_selections/man.rst @@ -8,33 +8,15 @@ cdist-type__debconf_set_selections - Setup debconf selections DESCRIPTION ----------- -On Debian and alike systems :strong:`debconf-set-selections`\ (1) can be used +On Debian and alike systems debconf-set-selections(1) can be used to setup configuration parameters. REQUIRED PARAMETERS ------------------- -cf. ``--line``. - - -OPTIONAL PARAMETERS -------------------- file - Use the given filename as input for :strong:`debconf-set-selections`\ (1) - If filename is ``-``, read from stdin. - - **This parameter is deprecated, because it doesn't work with state detection.** -line - A line in :strong:`debconf-set-selections`\ (1) compatible format. - This parameter can be used multiple times to set multiple options. - - (This parameter is actually required, but marked optional because the - deprecated ``--file`` is still accepted.) - - -BOOLEAN PARAMETERS ------------------- -None. + Use the given filename as input for debconf-set-selections(1) + If filename is "-", read from stdin. EXAMPLES @@ -42,29 +24,30 @@ EXAMPLES .. code-block:: sh - # Setup gitolite's gituser - __debconf_set_selections nslcd --line 'gitolite gitolite/gituser string git' + # Setup configuration for nslcd + __debconf_set_selections nslcd --file /path/to/file - # Setup configuration for nslcd from a file. - # NB: Multiple lines can be passed to --line, although this can be considered a hack. - __debconf_set_selections nslcd --line "$(cat "${__files:?}/preseed/nslcd.debconf")" + # Setup configuration for nslcd from another type + __debconf_set_selections nslcd --file "$__type/files/preseed/nslcd" + + __debconf_set_selections nslcd --file - << eof + gitolite gitolite/gituser string git + eof SEE ALSO -------- -- :strong:`cdist-type__update_alternatives`\ (7) -- :strong:`debconf-set-selections`\ (1) +:strong:`debconf-set-selections`\ (1), :strong:`cdist-type__update_alternatives`\ (7) AUTHORS ------- -| Nico Schottelius -| Dennis Camera +Nico Schottelius COPYING ------- -Copyright \(C) 2011-2014 Nico Schottelius, 2021 Dennis Camera. -You can redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either version 3 of -the License, or (at your option) any later version. +Copyright \(C) 2011-2014 Nico Schottelius. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__debconf_set_selections/nonparallel b/cdist/conf/type/__debconf_set_selections/nonparallel deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__debconf_set_selections/parameter/deprecated/file b/cdist/conf/type/__debconf_set_selections/parameter/deprecated/file deleted file mode 100644 index 09db545a..00000000 --- a/cdist/conf/type/__debconf_set_selections/parameter/deprecated/file +++ /dev/null @@ -1 +0,0 @@ -'file' has been deprecated in favour of 'line' in order to provide idempotency. diff --git a/cdist/conf/type/__debconf_set_selections/parameter/optional_multiple b/cdist/conf/type/__debconf_set_selections/parameter/optional_multiple deleted file mode 100644 index a999a0c2..00000000 --- a/cdist/conf/type/__debconf_set_selections/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -line diff --git a/cdist/conf/type/__debconf_set_selections/parameter/optional b/cdist/conf/type/__debconf_set_selections/parameter/required similarity index 100% rename from cdist/conf/type/__debconf_set_selections/parameter/optional rename to cdist/conf/type/__debconf_set_selections/parameter/required diff --git a/cdist/conf/type/__directory/explorer/stat b/cdist/conf/type/__directory/explorer/stat index f817cb02..03d466ba 100755 --- a/cdist/conf/type/__directory/explorer/stat +++ b/cdist/conf/type/__directory/explorer/stat @@ -1,7 +1,6 @@ #!/bin/sh # # 2013 Steven Armstrong (steven-cdist armstrong.cc) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -21,51 +20,59 @@ destination="/$__object_id" -fallback() { - # Patch the output together, manually - - ls_line=$(ls -ldn "$destination") - - uid=$(echo "$ls_line" | awk '{ print $3 }') - gid=$(echo "$ls_line" | awk '{ print $4 }') - - owner=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/passwd) - group=$(awk -F: -v gid="$gid" '$3 == gid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/group) - - mode_text=$(echo "$ls_line" | awk '{ print $1 }') - mode=$(echo "$mode_text" | awk '{for(i=8;i>=0;--i){c=substr($1,10-i,1);k+=((c~/[rwxst]/)*2^i);if(!(i%3))k+=(tolower(c)~/[lst]/)*2^(9+i/3)}printf("%04o",k)}') - - printf 'type: %s\nowner: %d %s\ngroup: %d %s\nmode: %s %s\n' \ - "$("$__type_explorer/type")" \ - "$uid" "$owner" \ - "$gid" "$group" \ - "$mode" "$mode_text" -} - # nothing to work with, nothing we could do [ -e "$destination" ] || exit 0 -command -v stat >/dev/null 2>&1 || { - fallback - exit -} - -case $("$__explorer/os") -in - freebsd|netbsd|openbsd|macosx) - stat -f 'type: %HT +os=$("$__explorer/os") +case "$os" in + "freebsd"|"netbsd"|"openbsd"|"macosx") + stat -f "type: %HT owner: %Du %Su group: %Dg %Sg -mode: %Mp%03Lp %Sp -' "$destination" | awk '/^type/ { print tolower($0); next } { print }' +mode: %Lp %Sp +" "$destination" | awk '/^type/ { print tolower($0); next; } { print; }' ;; - *) - # NOTE: Do not use --printf here as it is not supported by BusyBox stat. - # NOTE: BusyBox's stat might not support the "-c" option, in which case - # we fall through to the shell fallback. - stat -c 'type: %F + alpine) + stat -c "type: %F owner: %u %U group: %g %G -mode: %04a %A' "$destination" 2>/dev/null || fallback +mode: %a %A +" "$destination" ;; + solaris) + ls1="$( ls -ld "$destination" )" + ls2="$( ls -ldn "$destination" )" + + if [ -f "$__object/parameter/mode" ] + then mode_should="$( cat "$__object/parameter/mode" )" + fi + + # yes, it is ugly hack, but if you know better way... + if [ -z "$( find "$destination" -perm "$mode_should" )" ] + then octets=888 + else octets="$( echo "$mode_should" | sed 's/^0//' )" + fi + + case "$( echo "$ls1" | cut -c1-1 )" in + -) echo 'type: regular file' ;; + d) echo 'type: directory' ;; + esac + + echo "owner: $( echo "$ls2" \ + | awk '{print $3}' ) $( echo "$ls1" \ + | awk '{print $3}' )" + + echo "group: $( echo "$ls2" \ + | awk '{print $4}' ) $( echo "$ls1" \ + | awk '{print $4}' )" + + echo "mode: $octets $( echo "$ls1" | awk '{print $1}' )" + ;; + *) + stat --printf="type: %F +owner: %u %U +group: %g %G +mode: %a %A +" "$destination" + ;; esac diff --git a/cdist/conf/type/__directory/gencode-remote b/cdist/conf/type/__directory/gencode-remote index d9c00b56..374db47a 100755 --- a/cdist/conf/type/__directory/gencode-remote +++ b/cdist/conf/type/__directory/gencode-remote @@ -3,7 +3,6 @@ # 2011-2013 Nico Schottelius (nico-cdist at schottelius.org) # 2013 Steven Armstrong (steven-cdist armstrong.cc) # 2014 Daniel Heule (hda at sfs.biz) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -22,8 +21,8 @@ # destination="/$__object_id" -state_should=$(cat "$__object/parameter/state") -type=$(cat "$__object/explorer/type") +state_should="$(cat "$__object/parameter/state")" +type="$(cat "$__object/explorer/type")" stat_file="$__object/explorer/stat" # variable to keep track if we have to set directory attributes @@ -73,7 +72,7 @@ set_mode() { } case "$state_should" in - present|exists) + present) if [ "$type" != "directory" ]; then set_attributes=1 if [ "$type" != "none" ]; then @@ -84,10 +83,6 @@ case "$state_should" in fi echo "mkdir $mkdiropt '$destination'" echo "create" >> "$__messages_out" - elif [ "$state_should" = 'exists' ]; then - # The type is directory and --state exists. We are done and do not - # check or set the attributes. - exit 0 fi # Note: Mode - needs to happen last as a chown/chgrp can alter mode by @@ -97,11 +92,9 @@ case "$state_should" in value_should="$(cat "$__object/parameter/$attribute")" value_is="$(get_current_value "$attribute" "$value_should")" - # format mode in four digits => same as stat returns + # change 0xxx format to xxx format => same as stat returns if [ "$attribute" = mode ]; then - # Convert to four-digit octal number (printf interprets - # strings with leading 0s as octal!) - value_should=$(printf '%04o' "0${value_should}") + value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')" fi if [ "$set_attributes" = 1 ] || [ "$value_should" != "$value_is" ]; then @@ -110,26 +103,6 @@ case "$state_should" in fi done ;; - pre-exists) - case $type in - directory) - # all good - exit 0 - ;; - none) - printf 'Directory "%s" does not exist\n' "$destination" >&2 - exit 1 - ;; - file|symlink) - printf 'File "%s" exists and is a %s, but should be a directory\n' "$destination" "$type" >&2 - exit 1 - ;; - *) - printf 'File or directory "%s" is in an unknown state\n' "$destination" >&2 - exit 1 - ;; - esac - ;; absent) if [ "$type" = "directory" ]; then echo "rm -rf '$destination'" diff --git a/cdist/conf/type/__directory/man.rst b/cdist/conf/type/__directory/man.rst index 7755334c..74b00afe 100644 --- a/cdist/conf/type/__directory/man.rst +++ b/cdist/conf/type/__directory/man.rst @@ -19,18 +19,7 @@ None. OPTIONAL PARAMETERS ------------------- state - 'present', 'absent', 'exists' or 'pre-exists', defaults to 'present' where: - - present - the directory exists and the given attributes are set. - absent - the directory does not exist. - exists - the directory exists, but its attributes are not altered if it already - existed. - pre-exists - check that the directory exists and is indeed a directory, but do not - create or modify it. + 'present' or 'absent', defaults to 'present' group Group to chgrp to. @@ -47,7 +36,7 @@ BOOLEAN PARAMETERS parents Whether to create parents as well (mkdir -p behaviour). Warning: all intermediate directory permissions default - to whatever mkdir -p does. + to whatever mkdir -p does. Usually this means root:root, 0700. diff --git a/cdist/conf/type/__dot_file/man.rst b/cdist/conf/type/__dot_file/man.rst index c8f36712..ae65eb95 100644 --- a/cdist/conf/type/__dot_file/man.rst +++ b/cdist/conf/type/__dot_file/man.rst @@ -25,9 +25,6 @@ user OPTIONAL PARAMETERS ------------------- -dirmode - forwarded to :strong:`__directory` type as mode - mode forwarded to :strong:`__file` type @@ -37,12 +34,6 @@ state source forwarded to :strong:`__file` type -file - forwarded to :strong:`__file` type - This can be used if multiple users need to have a dotfile updated, - which will result in duplicate object id errors. When using the - file parameter the object id can be some unique value. - MESSAGES -------- @@ -67,15 +58,6 @@ EXAMPLES # Install default xmonad config for user 'eve'. Parent directory is created automatically. __dot_file .xmonad/xmonad.hs --user eve --state exists --source "$__files/xmonad.hs" - # install .vimrc for root and some users - for user in root userx usery userz; do - __dot_file "${user}_dot_vimrc" \ - --user $user \ - --file .vimrc \ - --state exists \ - --source "$__files/$user/.vimrc" - done - SEE ALSO -------- diff --git a/cdist/conf/type/__dot_file/manifest b/cdist/conf/type/__dot_file/manifest index a38ed943..5e4957e5 100755 --- a/cdist/conf/type/__dot_file/manifest +++ b/cdist/conf/type/__dot_file/manifest @@ -19,20 +19,13 @@ set -eu user="$(cat "${__object}/parameter/user")" home="$(cat "${__object}/explorer/home")" primary_group="$(cat "${__object}/explorer/primary_group")" -dirmode="$(cat "${__object}/parameter/dirmode")" -if [ -f "${__object}/parameter/file" ]; then - file="$(cat "${__object}/parameter/file")" -else - file="${__object_id}" -fi - # Create parent directory. Type __directory has flag 'parents', but it # will leave us with root-owned directory in user home, which is not # acceptable. So we create parent directories one-by-one. XXX: maybe # it should be fixed in '__directory'? set -- -subpath=${file} +subpath=${__object_id} while subpath="$(dirname "${subpath}")" ; do [ "${subpath}" = . ] && break set -- "${subpath}" "$@" @@ -43,7 +36,6 @@ export CDIST_ORDER_DEPENDENCY for dir ; do __directory "${home}/${dir}" \ --group "${primary_group}" \ - --mode "${dirmode}" \ --owner "${user}" done @@ -70,4 +62,4 @@ if [ "${source}" = "-" ] ; then fi unset source -__file "${home}/${file}" --owner "$user" --group "$primary_group" "$@" +__file "${home}/${__object_id}" --owner "$user" --group "$primary_group" "$@" diff --git a/cdist/conf/type/__dot_file/parameter/default/dirmode b/cdist/conf/type/__dot_file/parameter/default/dirmode deleted file mode 100644 index e9745d1f..00000000 --- a/cdist/conf/type/__dot_file/parameter/default/dirmode +++ /dev/null @@ -1 +0,0 @@ -0700 diff --git a/cdist/conf/type/__dot_file/parameter/optional b/cdist/conf/type/__dot_file/parameter/optional index 9f7f83fb..ccab9fa6 100644 --- a/cdist/conf/type/__dot_file/parameter/optional +++ b/cdist/conf/type/__dot_file/parameter/optional @@ -1,4 +1,3 @@ state mode source -dirmode diff --git a/cdist/conf/type/__download/explorer/remote_cmd_get b/cdist/conf/type/__download/explorer/remote_cmd_get deleted file mode 100755 index 9f1cd59c..00000000 --- a/cdist/conf/type/__download/explorer/remote_cmd_get +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/sh -e - -if [ -f "$__object/parameter/cmd-get" ] -then - cat "$__object/parameter/cmd-get" -elif - command -v curl > /dev/null -then - echo "curl -sSL -o - '%s'" -elif - command -v fetch > /dev/null -then - echo "fetch -o - '%s'" -else - echo "wget -O - '%s'" -fi diff --git a/cdist/conf/type/__download/explorer/remote_cmd_sum b/cdist/conf/type/__download/explorer/remote_cmd_sum deleted file mode 100755 index 84df663c..00000000 --- a/cdist/conf/type/__download/explorer/remote_cmd_sum +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/sh -e - -if [ ! -f "$__object/parameter/sum" ] -then - exit 0 -fi - -if [ -f "$__object/parameter/cmd-sum" ] -then - cat "$__object/parameter/cmd-sum" - exit 0 -fi - -sum_should="$( cat "$__object/parameter/sum" )" - -if echo "$sum_should" | grep -Fq ':' -then - sum_hash="$( echo "$sum_should" | cut -d : -f 1 )" -else - if echo "$sum_should" | grep -Eq '^[0-9]+\s[0-9]+$' - then - sum_hash='cksum' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{32}$' - then - sum_hash='md5' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{40}$' - then - sum_hash='sha1' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{64}$' - then - sum_hash='sha256' - else - echo 'hash format detection failed' >&2 - exit 1 - fi -fi - -os="$( "$__explorer/os" )" - -case "$sum_hash" in - cksum) - echo "cksum %s | awk '{print \$1\" \"\$2}'" - ;; - md5) - case "$os" in - freebsd) - echo "md5 -q %s" - ;; - *) - echo "md5sum %s | awk '{print \$1}'" - ;; - esac - ;; - sha1) - case "$os" in - freebsd) - echo "sha1 -q %s" - ;; - *) - echo "sha1sum %s | awk '{print \$1}'" - ;; - esac - ;; - sha256) - case "$os" in - freebsd) - echo "sha256 -q %s" - ;; - *) - echo "sha256sum %s | awk '{print \$1}'" - ;; - esac - ;; - *) - # we arrive here only if --sum is given with unknown format prefix - echo "unknown hash format: $sum_hash" >&2 - exit 1 - ;; -esac diff --git a/cdist/conf/type/__download/explorer/state b/cdist/conf/type/__download/explorer/state deleted file mode 100755 index 8c5d5ce1..00000000 --- a/cdist/conf/type/__download/explorer/state +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/sh -e - -if [ -f "$__object/parameter/destination" ] -then - dst="$( cat "$__object/parameter/destination" )" -else - dst="/$__object_id" -fi - -if [ ! -f "$dst" ] -then - echo 'absent' - exit 0 -fi - -if [ ! -f "$__object/parameter/sum" ] -then - echo 'present' - exit 0 -fi - -sum_should="$( cat "$__object/parameter/sum" )" - -if echo "$sum_should" | grep -Fq ':' -then - sum_should="$( echo "$sum_should" | cut -d : -f 2 )" -fi - -sum_cmd="$( "$__type_explorer/remote_cmd_sum" )" - -# shellcheck disable=SC2059 -sum_is="$( eval "$( printf "$sum_cmd" "'$dst'" )" )" - -if [ -z "$sum_is" ] -then - echo 'existing destination checksum failed' >&2 - exit 1 -fi - -if [ "$sum_is" = "$sum_should" ] -then - echo 'present' -else - echo 'mismatch' -fi diff --git a/cdist/conf/type/__download/gencode-local b/cdist/conf/type/__download/gencode-local deleted file mode 100755 index d1b0d0d5..00000000 --- a/cdist/conf/type/__download/gencode-local +++ /dev/null @@ -1,155 +0,0 @@ -#!/bin/sh -e - -download="$( cat "$__object/parameter/download" )" - -state_is="$( cat "$__object/explorer/state" )" - -if [ "$download" != 'local' ] || [ "$state_is" = 'present' ] -then - exit 0 -fi - -url="$( cat "$__object/parameter/url" )" - -if [ -f "$__object/parameter/destination" ] -then - dst="$( cat "$__object/parameter/destination" )" -else - dst="/$__object_id" -fi - -if [ -f "$__object/parameter/cmd-get" ] -then - cmd="$( cat "$__object/parameter/cmd-get" )" - -elif command -v curl > /dev/null -then - cmd="curl -sSL -o - '%s'" - -elif command -v fetch > /dev/null -then - cmd="fetch -o - '%s'" - -elif command -v wget > /dev/null -then - cmd="wget -O - '%s'" - -else - echo 'local download failed, no usable utility' >&2 - exit 1 -fi - -echo "download_tmp=\"\$( mktemp )\"" - -# shellcheck disable=SC2059 -printf "$cmd > \"\$download_tmp\"\n" "$url" - -if [ -f "$__object/parameter/sum" ] -then - sum_should="$( cat "$__object/parameter/sum" )" - - if [ -f "$__object/parameter/cmd-sum" ] - then - local_cmd_sum="$( cat "$__object/parameter/cmd-sum" )" - else - if echo "$sum_should" | grep -Fq ':' - then - sum_hash="$( echo "$sum_should" | cut -d : -f 1 )" - - sum_should="$( echo "$sum_should" | cut -d : -f 2 )" - else - if echo "$sum_should" | grep -Eq '^[0-9]+\s[0-9]+$' - then - sum_hash='cksum' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{32}$' - then - sum_hash='md5' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{40}$' - then - sum_hash='sha1' - elif - echo "$sum_should" | grep -Eiq '^[a-f0-9]{64}$' - then - sum_hash='sha256' - else - echo 'hash format detection failed' >&2 - exit 1 - fi - fi - - case "$sum_hash" in - cksum) - local_cmd_sum="cksum %s | awk '{print \$1\" \"\$2}'" - ;; - md5) - if command -v md5 > /dev/null - then - local_cmd_sum="md5 -q %s" - elif - command -v md5sum > /dev/null - then - local_cmd_sum="md5sum %s | awk '{print \$1}'" - fi - ;; - sha1) - if command -v sha1 > /dev/null - then - local_cmd_sum="sha1 -q %s" - elif - command -v sha1sum > /dev/null - then - local_cmd_sum="sha1sum %s | awk '{print \$1}'" - fi - ;; - sha256) - if command -v sha256 > /dev/null - then - local_cmd_sum="sha256 -q %s" - elif - command -v sha256sum > /dev/null - then - local_cmd_sum="sha256sum %s | awk '{print \$1}'" - fi - ;; - *) - # we arrive here only if --sum is given with unknown format prefix - echo "unknown hash format: $sum_hash" >&2 - exit 1 - ;; - esac - - if [ -z "$local_cmd_sum" ] - then - echo 'local checksum verification failed, no usable utility' >&2 - exit 1 - fi - fi - - # shellcheck disable=SC2059 - echo "sum_is=\"\$( $( printf "$local_cmd_sum" "\"\$download_tmp\"" ) )\"" - - echo "if [ \"\$sum_is\" != '$sum_should' ]; then" - - echo "echo 'local download checksum mismatch' >&2" - - echo "rm -f \"\$download_tmp\"" - - echo 'exit 1; fi' -fi - -if echo "$__target_host" | grep -Eq '^[0-9a-fA-F:]+$' -then - target_host="[$__target_host]" -else - target_host="$__target_host" -fi - -# shellcheck disable=SC2016 -printf '%s "$download_tmp" %s:%s\n' \ - "$__remote_copy" \ - "$target_host" \ - "$dst" - -echo "rm -f \"\$download_tmp\"" diff --git a/cdist/conf/type/__download/gencode-remote b/cdist/conf/type/__download/gencode-remote deleted file mode 100755 index e49bcec3..00000000 --- a/cdist/conf/type/__download/gencode-remote +++ /dev/null @@ -1,59 +0,0 @@ -#!/bin/sh -e - -download="$( cat "$__object/parameter/download" )" - -state_is="$( cat "$__object/explorer/state" )" - -if [ "$download" = 'remote' ] && [ "$state_is" != 'present' ] -then - cmd_get="$( cat "$__object/explorer/remote_cmd_get" )" - - url="$( cat "$__object/parameter/url" )" - - if [ -f "$__object/parameter/destination" ] - then - dst="$( cat "$__object/parameter/destination" )" - else - dst="/$__object_id" - fi - - echo "download_tmp=\"\$( mktemp )\"" - - # shellcheck disable=SC2059 - printf "$cmd_get > \"\$download_tmp\"\n" "$url" - - if [ -f "$__object/parameter/sum" ] - then - sum_should="$( cat "$__object/parameter/sum" )" - - if [ -f "$__object/parameter/cmd-sum" ] - then - remote_cmd_sum="$( cat "$__object/parameter/cmd-sum" )" - else - remote_cmd_sum="$( cat "$__object/explorer/remote_cmd_sum" )" - - if echo "$sum_should" | grep -Fq ':' - then - sum_should="$( echo "$sum_should" | cut -d : -f 2 )" - fi - fi - - # shellcheck disable=SC2059 - echo "sum_is=\"\$( $( printf "$remote_cmd_sum" "\"\$download_tmp\"" ) )\"" - - echo "if [ \"\$sum_is\" != '$sum_should' ]; then" - - echo "echo 'remote download checksum mismatch' >&2" - - echo "rm -f \"\$download_tmp\"" - - echo 'exit 1; fi' - fi - - echo "mv \"\$download_tmp\" '$dst'" -fi - -if [ -f "$__object/parameter/onchange" ] && [ "$state_is" != "present" ] -then - cat "$__object/parameter/onchange" -fi diff --git a/cdist/conf/type/__download/man.rst b/cdist/conf/type/__download/man.rst deleted file mode 100644 index c16510a9..00000000 --- a/cdist/conf/type/__download/man.rst +++ /dev/null @@ -1,101 +0,0 @@ -cdist-type__download(7) -======================= - -NAME ----- -cdist-type__download - Download a file - - -DESCRIPTION ------------ -By default type will try to use ``curl``, ``fetch`` or ``wget``. -If download happens in target (see ``--download``) then type will -fallback to (and install) ``wget``. - -If download happens in local machine, then environment variables like -``{http,https,ftp}_proxy`` etc can be used on cdist execution -(``http_proxy=foo cdist config ...``). - -To change downloaded file's owner, group or permissions, use ``require='__download/path/to/file' __file ...``. - - -REQUIRED PARAMETERS -------------------- -url - File's URL. - - -OPTIONAL PARAMETERS -------------------- -destination - Downloaded file's destination in target. If unset, ``$__object_id`` is used. - -sum - Supported formats: ``cksum`` output without file name, MD5, SHA1 and SHA256. - - Type tries to detect hash format with regexes, but prefixes - ``cksum:``, ``md5:``, ``sha1:`` and ``sha256:`` are also supported. - - Checksum have two purposes - state check and post-download verification. - In state check, if destination checksum mismatches, then content of URL - will be downloaded to temporary file. If downloaded temporary file's - checksum matches, then it will be moved to destination (overwritten). - - For local downloads it is expected that usable utilities for checksum - calculation exist in the system. - -download - If ``local`` (default), then file is downloaded to local storage and copied - to target host. If ``remote``, then download happens in target. - - For local downloads it is expected that usable utilities for downloading - exist in the system. Type will try to use ``curl``, ``fetch`` or ``wget``. - -cmd-get - Command used for downloading. - Command must output to ``stdout``. - Parameter will be used for ``printf`` and must include only one - format specification ``%s`` which will become URL. - For example: ``wget -O - '%s'``. - -cmd-sum - Command used for checksum calculation. - Command output and ``--sum`` parameter must match. - Parameter will be used for ``printf`` and must include only one - format specification ``%s`` which will become destination. - For example: ``md5sum '%s' | awk '{print $1}'``. - -onchange - Execute this command after download. - - -EXAMPLES --------- - -.. code-block:: sh - - __directory /opt/cpma - - require='__directory/opt/cpma' \ - __download /opt/cpma/cnq3.zip \ - --url https://cdn.playmorepromode.com/files/cnq3/cnq3-1.51.zip \ - --sum 46da3021ca9eace277115ec9106c5b46 - - require='__download/opt/cpma/cnq3.zip' \ - __unpack /opt/cpma/cnq3.zip \ - --backup-destination \ - --preserve-archive \ - --destination /opt/cpma/server - - -AUTHORS -------- -Ander Punnar - - -COPYING -------- -Copyright \(C) 2021 Ander Punnar. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__download/manifest b/cdist/conf/type/__download/manifest deleted file mode 100755 index 3d4c498b..00000000 --- a/cdist/conf/type/__download/manifest +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/sh -e - -if grep -Eq '^wget' "$__object/explorer/remote_cmd_get" -then - __package wget -fi diff --git a/cdist/conf/type/__download/parameter/default/download b/cdist/conf/type/__download/parameter/default/download deleted file mode 100644 index 40830374..00000000 --- a/cdist/conf/type/__download/parameter/default/download +++ /dev/null @@ -1 +0,0 @@ -local diff --git a/cdist/conf/type/__download/parameter/optional b/cdist/conf/type/__download/parameter/optional deleted file mode 100644 index e809ef78..00000000 --- a/cdist/conf/type/__download/parameter/optional +++ /dev/null @@ -1,6 +0,0 @@ -cmd-get -cmd-sum -destination -download -onchange -sum diff --git a/cdist/conf/type/__download/parameter/required b/cdist/conf/type/__download/parameter/required deleted file mode 100644 index 96cdd3b9..00000000 --- a/cdist/conf/type/__download/parameter/required +++ /dev/null @@ -1 +0,0 @@ -url diff --git a/cdist/conf/type/__dpkg_architecture/explorer/architecture b/cdist/conf/type/__dpkg_architecture/explorer/architecture deleted file mode 100755 index 03e7e386..00000000 --- a/cdist/conf/type/__dpkg_architecture/explorer/architecture +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh -e -# __dpkg_architecture/explorer/architecture -# -# 2020 Matthias Stecher -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# Get the main architecture of this machine - - -# print or die in the gencode-remote -dpkg --print-architecture || true diff --git a/cdist/conf/type/__dpkg_architecture/explorer/foreign-architectures b/cdist/conf/type/__dpkg_architecture/explorer/foreign-architectures deleted file mode 100755 index a150d307..00000000 --- a/cdist/conf/type/__dpkg_architecture/explorer/foreign-architectures +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/sh -e -# __dpkg_architecture/explorer/foreign-architectures -# -# 2020 Matthias Stecher -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# Print all additional architectures - - -# print or die in the gencode-remote -dpkg --print-foreign-architectures || true diff --git a/cdist/conf/type/__dpkg_architecture/gencode-remote b/cdist/conf/type/__dpkg_architecture/gencode-remote deleted file mode 100755 index 47fb24e7..00000000 --- a/cdist/conf/type/__dpkg_architecture/gencode-remote +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/sh -e -# __dpkg_architecture/gencode-remote -# -# 2020 Matthias Stecher -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - - -# Get parameter and explorer -state_should="$(cat "$__object/parameter/state")" -arch_wanted="$__object_id" -main_arch="$(cat "$__object/explorer/architecture")" - -# Exit here if dpkg do not work (empty explorer) -if [ -z "$main_arch" ]; then - echo "dpkg is not available or unable to detect a architecture!" >&2 - exit 1 -fi - - -# Check if requested architecture is the main one -if [ "$arch_wanted" = "$main_arch" ]; then - # higher than present; we can not remove it - state_is="present" - caution="yes" - -# Check if the architecture not already used -elif grep -qFx "$arch_wanted" "$__object/explorer/foreign-architectures"; then - state_is="present" - -# arch does not exist -else - state_is="absent" -fi - - -# Check what to do -if [ "$state_is" != "$state_should" ]; then - case "$state_should" in - present) - # print add code - printf "dpkg --add-architecture '%s'\n" "$arch_wanted" - # updating the index to make the new architecture available - echo "apt update" - - echo added >> "$__messages_out" - ;; - - absent) - if [ "$caution" ]; then - printf "can not remove the main arch '%s' of the system!\n" "$main_arch" >&2 - exit 1 - fi - - # removing all existing packages for the architecture - printf "apt purge '.*:%s'\n" "$arch_wanted" - # print remove code - printf "dpkg --remove-architecture '%s'\n" "$arch_wanted" - - echo removed >> "$__messages_out" - ;; - - *) - printf "state '%s' is unknown!\n" "$state_should" >&2 - exit 1 - ;; - esac -fi diff --git a/cdist/conf/type/__dpkg_architecture/man.rst b/cdist/conf/type/__dpkg_architecture/man.rst deleted file mode 100644 index fa196229..00000000 --- a/cdist/conf/type/__dpkg_architecture/man.rst +++ /dev/null @@ -1,103 +0,0 @@ -cdist-type__dpkg_architecture(7) -================================ - -NAME ----- -cdist-type__dpkg_architecture - Handles foreign architectures on debian-like -systems managed by `dpkg` - - -DESCRIPTION ------------ -This type handles foreign architectures on systems managed by -:strong:`dpkg`\ (1). The object id is the name of the architecture accepted by -`dpkg`, which should be added or removed. - -If the architecture is not setup on the system, it adds a new architecture as a -new foreign architecture in `dpkg`. Then, it updates the apt package index to -make packages from the new architecture available. - -If the architecture should be removed, it will remove it if it is not the base -architecture on where the system was installed on. Before it, it will purge -every package based on the "to be removed" architecture via `apt` to be able to -remove the selected architecture. - - -REQUIRED PARAMETERS -------------------- -None. - - -OPTIONAL PARAMETERS -------------------- -state - ``present`` or ``absent``. Defaults to ``present``. - - -MESSAGES --------- -added - Added the specified architecture - -removed - Removed the specified architecture - - -ABORTS ------- -Aborts in the following cases: - -If :strong:`dpkg`\ (1) is not available. It will abort with a proper error -message. - -If the architecture is the same as the base architecture the system is build -upon it (returned by ``dpkg --print-architecture``) and it should be removed. - -It will fail if it can not execute :strong:`apt`\ (8). It is assumed that it is -already installed. - - -EXAMPLES --------- - -.. code-block:: sh - - # add i386 (32 bit) architecture - __dpkg_architecture i386 - - # remove it again :) - __dpkg_architecture i386 --state absent - - -SEE ALSO --------- -`Multiarch on Debian systems `_ - -`How to setup multiarch on Debian `_ - -:strong:`dpkg`\ (1) -:strong:`cdist-type__package_dpkg`\ (7) -:strong:`cdist-type__package_apt`\ (7) - -Useful commands: - -.. code-block:: sh - - # base architecture installed on this system - dpkg --print-architecture - - # extra architectures added - dpkg --print-foreign-architectures - - -AUTHORS -------- -Matthias Stecher - - -COPYING -------- -Copyright \(C) 2020 Matthias Stecher. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -ublished by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__dpkg_architecture/nonparallel b/cdist/conf/type/__dpkg_architecture/nonparallel deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__dpkg_architecture/parameter/default/state b/cdist/conf/type/__dpkg_architecture/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__dpkg_architecture/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__dpkg_architecture/parameter/optional b/cdist/conf/type/__dpkg_architecture/parameter/optional deleted file mode 100644 index ff72b5c7..00000000 --- a/cdist/conf/type/__dpkg_architecture/parameter/optional +++ /dev/null @@ -1 +0,0 @@ -state diff --git a/cdist/conf/type/__file/explorer/stat b/cdist/conf/type/__file/explorer/stat index 29b3c8a3..13c1c208 100755 --- a/cdist/conf/type/__file/explorer/stat +++ b/cdist/conf/type/__file/explorer/stat @@ -2,7 +2,6 @@ # # 2013 Steven Armstrong (steven-cdist armstrong.cc) # 2019 Nico Schottelius (nico-cdist at schottelius.org) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -22,63 +21,68 @@ destination="/$__object_id" -fallback() { - # Fallback: Patch the output together, manually. - - ls_line=$(ls -ldn "$destination") - - uid=$(echo "$ls_line" | awk '{ print $3 }') - gid=$(echo "$ls_line" | awk '{ print $4 }') - - owner=$(awk -F: -v uid="$uid" '$3 == uid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/passwd) - group=$(awk -F: -v gid="$gid" '$3 == gid { print $1; f=1 } END { if (!f) print "UNKNOWN" }' /etc/group) - - mode_text=$(echo "$ls_line" | awk '{ print $1 }') - mode=$(echo "$mode_text" | awk '{for(i=8;i>=0;--i){c=substr($1,10-i,1);k+=((c~/[rwxst]/)*2^i);if(!(i%3))k+=(tolower(c)~/[lst]/)*2^(9+i/3)}printf("%04o",k)}') - - size=$(echo "$ls_line" | awk '{ print $5 }') - links=$(echo "$ls_line" | awk '{ print $2 }') - - printf 'type: %s\nowner: %d %s\ngroup: %d %s\nmode: %s %s\nsize: %d\nlinks: %d\n' \ - "$("$__type_explorer/type")" \ - "$uid" "$owner" \ - "$gid" "$group" \ - "$mode" "$mode_text" \ - "$size" \ - "$links" -} - - # nothing to work with, nothing we could do [ -e "$destination" ] || exit 0 - -command -v stat >/dev/null 2>&1 || { - fallback - exit -} - - -case $("$__explorer/os") -in - freebsd|netbsd|openbsd|macosx) - stat -f 'type: %HT +os=$("$__explorer/os") +case "$os" in + "freebsd"|"netbsd"|"openbsd"|"macosx") + stat -f "type: %HT owner: %Du %Su group: %Dg %Sg -mode: %Mp%03Lp %Sp +mode: %Lp %Sp size: %Dz links: %Dl -' "$destination" | awk '/^type/ { print tolower($0); next } { print }' +" "$destination" | awk '/^type/ { print tolower($0); next; } { print; }' ;; - *) - # NOTE: Do not use --printf here as it is not supported by BusyBox stat. - # NOTE: BusyBox's stat might not support the "-c" option, in which case - # we fall through to the shell fallback. - stat -c 'type: %F + alpine) + # busybox stat + stat -c "type: %F owner: %u %U group: %g %G -mode: %04a %A +mode: %a %A size: %s -links: %h' "$destination" 2>/dev/null || fallback +links: %h +" "$destination" + ;; + solaris) + ls1="$( ls -ld "$destination" )" + ls2="$( ls -ldn "$destination" )" + + if [ -f "$__object/parameter/mode" ] + then mode_should="$( cat "$__object/parameter/mode" )" + fi + + # yes, it is ugly hack, but if you know better way... + if [ -z "$( find "$destination" -perm "$mode_should" )" ] + then octets=888 + else octets="$( echo "$mode_should" | sed 's/^0//' )" + fi + + case "$( echo "$ls1" | cut -c1-1 )" in + -) echo 'type: regular file' ;; + d) echo 'type: directory' ;; + esac + + echo "owner: $( echo "$ls2" \ + | awk '{print $3}' ) $( echo "$ls1" \ + | awk '{print $3}' )" + + echo "group: $( echo "$ls2" \ + | awk '{print $4}' ) $( echo "$ls1" \ + | awk '{print $4}' )" + + echo "mode: $octets $( echo "$ls1" | awk '{print $1}' )" + echo "size: $( echo "$ls1" | awk '{print $5}' )" + echo "links: $( echo "$ls1" | awk '{print $2}' )" + ;; + *) + stat --printf="type: %F +owner: %u %U +group: %g %G +mode: %a %A +size: %s +links: %h +" "$destination" ;; esac diff --git a/cdist/conf/type/__file/gencode-local b/cdist/conf/type/__file/gencode-local index 5a303308..fb9f9a92 100755 --- a/cdist/conf/type/__file/gencode-local +++ b/cdist/conf/type/__file/gencode-local @@ -1,7 +1,7 @@ #!/bin/sh -e # # 2011-2012 Nico Schottelius (nico-cdist at schottelius.org) -# 2013-2022 Steven Armstrong (steven-cdist armstrong.cc) +# 2013 Steven Armstrong (steven-cdist armstrong.cc) # # This file is part of cdist. # @@ -31,24 +31,12 @@ if [ "$state_should" = "pre-exists" ]; then exit 1 fi - case $type in - file) - # nothing to do - exit 0 - ;; - none) - printf 'File "%s" does not exist\n' "$destination" >&2 - exit 1 - ;; - directory|symlink) - printf 'File "%s" exists and is a %s, but should be a regular file\n' "$destination" "$type" >&2 - exit 1 - ;; - *) - printf 'File or directory "%s" is in an unknown state\n' "$destination" >&2 - exit 1 - ;; - esac + if [ "$type" = "file" ]; then + exit 0 # nothing to do + else + echo "File \"$destination\" does not exist" + exit 1 + fi fi upload_file= @@ -72,7 +60,6 @@ if [ "$state_should" = "present" ] || [ "$state_should" = "exists" ]; then if [ "$type" != "file" ]; then # destination is not a regular file, upload source to replace it upload_file=1 - echo upload >> "$__messages_out" else local_cksum="$(cksum < "$source")" remote_cksum="$(cat "$__object/explorer/cksum")" @@ -89,39 +76,27 @@ if [ "$state_should" = "present" ] || [ "$state_should" = "exists" ]; then mkdir "$__object/files" touch "$__object/files/set-attributes" - if [ "$create_file" ]; then - # When creating an empty file we create it locally and then - # upload it so that permissions can be set before moving the file - # into place. - source="$__object/files/empty" - touch "$source" - fi - # upload file to temp location - upload_destination="${destination}.cdist.${__cdist_object_marker}.$$" - # Yes, we are aware that this is a race condition. - # However: - # a) cdist usually writes to directories that are not user writable - # (probably > 99.9%) - # b) if they are user owned, the user / attacker always wins - # (probably < 0.1%) - # c) the only case which we could improve are tmp directories and we - # don't think managing tmp directories with cdist is a typical case - # ("the rest %)" - - # Tell gencode-remote to where we uploaded the file so it can move - # it to its final destination. - echo "$upload_destination" > "$__object/files/upload-destination" - - # IPv6 fix - if echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$' - then - my_target_host="[${__target_host}]" - else - my_target_host="${__target_host}" - fi + tempfile_template="${destination}.cdist.XXXXXXXXXX" cat << DONE -$__remote_copy "$source" "${my_target_host}:${upload_destination}" +destination_upload="\$($__remote_exec $__target_host "mktemp $tempfile_template")" +DONE + if [ "$upload_file" ]; then + echo upload >> "$__messages_out" + # IPv6 fix + if echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$' + then + my_target_host="[${__target_host}]" + else + my_target_host="${__target_host}" + fi + cat << DONE +$__remote_copy "$source" "${my_target_host}:\$destination_upload" +DONE + fi +# move uploaded file into place +cat << DONE +$__remote_exec $__target_host "rm -rf \"$destination\"; mv \"\$destination_upload\" \"$destination\"" DONE fi fi diff --git a/cdist/conf/type/__file/gencode-remote b/cdist/conf/type/__file/gencode-remote index 1a9ff69c..b04c471e 100755 --- a/cdist/conf/type/__file/gencode-remote +++ b/cdist/conf/type/__file/gencode-remote @@ -1,7 +1,7 @@ #!/bin/sh -e # # 2011-2013 Nico Schottelius (nico-cdist at schottelius.org) -# 2013-2022 Steven Armstrong (steven-cdist armstrong.cc) +# 2013 Steven Armstrong (steven-cdist armstrong.cc) # # This file is part of cdist. # @@ -55,48 +55,35 @@ set_owner() { } set_mode() { - echo "chmod '$1' '$destination'" - echo "chmod '$1'" >> "$__messages_out" - fire_onchange=1 + echo "chmod '$1' '$destination'" + echo "chmod '$1'" >> "$__messages_out" + fire_onchange=1 } case "$state_should" in - present|exists) - if [ -f "$__object/files/upload-destination" ]; then - final_destination="$destination" - # We change the 'global' $destination variable here so we can - # change attributes of the new/uploaded file before moving it - # to it's final destination. - destination="$(cat "$__object/files/upload-destination")" - fi - # Note: Mode - needs to happen last as a chown/chgrp can alter mode by - # clearing S_ISUID and S_ISGID bits (see chown(2)) - for attribute in group owner mode; do - if [ -f "$__object/parameter/$attribute" ]; then - value_should="$(cat "$__object/parameter/$attribute")" + present|exists|pre-exists) + # Note: Mode - needs to happen last as a chown/chgrp can alter mode by + # clearing S_ISUID and S_ISGID bits (see chown(2)) + for attribute in group owner mode; do + if [ -f "$__object/parameter/$attribute" ]; then + value_should="$(cat "$__object/parameter/$attribute")" - # format mode in four digits => same as stat returns - if [ "$attribute" = mode ]; then - # Convert to four-digit octal number (printf interprets - # strings with leading 0s as octal!) - value_should=$(printf '%04o' "0${value_should}") - fi - - value_is="$(get_current_value "$attribute" "$value_should")" - if [ -f "$__object/files/set-attributes" ] || [ "$value_should" != "$value_is" ]; then - "set_$attribute" "$value_should" - fi + # change 0xxx format to xxx format => same as stat returns + if [ "$attribute" = mode ]; then + value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')" + fi + + value_is="$(get_current_value "$attribute" "$value_should")" + if [ -f "$__object/files/set-attributes" ] || [ "$value_should" != "$value_is" ]; then + "set_$attribute" "$value_should" fi - done - if [ -f "$__object/files/upload-destination" ]; then - # move uploaded file into place - printf 'rm -rf "%s"\n' "$final_destination" - printf 'mv "%s" "%s"\n' "$destination" "$final_destination" - fi - if [ -f "$__object/files/set-attributes" ]; then - # set-attributes is created if file is created or uploaded in gencode-local - fire_onchange=1 fi + done + if [ -f "$__object/files/set-attributes" ]; then + # set-attributes is created if file is created or uploaded in gencode-local + fire_onchange=1 + fi + ;; absent) @@ -107,10 +94,6 @@ case "$state_should" in fi ;; - pre-exists) - : - ;; - *) echo "Unknown state: $state_should" >&2 exit 1 @@ -118,7 +101,7 @@ case "$state_should" in esac if [ -f "$__object/parameter/onchange" ]; then - if [ -n "$fire_onchange" ]; then - cat "$__object/parameter/onchange" - fi + if [ -n "$fire_onchange" ]; then + cat "$__object/parameter/onchange" + fi fi diff --git a/cdist/conf/type/__file/man.rst b/cdist/conf/type/__file/man.rst index 2f3b9e69..7a0603bb 100644 --- a/cdist/conf/type/__file/man.rst +++ b/cdist/conf/type/__file/man.rst @@ -50,13 +50,13 @@ state create or modify it group - Group to chgrp to. Defaults to ``root``. + Group to chgrp to. mode - Unix permissions, suitable for chmod. Defaults to a very secure ``0600``. + Unix permissions, suitable for chmod. owner - User to chown to. Defaults to ``root``. + User to chown to. source If supplied, copy this file from the host running cdist to the target. diff --git a/cdist/conf/type/__filesystem/explorer/lsblk b/cdist/conf/type/__filesystem/explorer/lsblk index d376c09f..9ae544ac 100644 --- a/cdist/conf/type/__filesystem/explorer/lsblk +++ b/cdist/conf/type/__filesystem/explorer/lsblk @@ -18,16 +18,16 @@ # along with cdist. If not, see . # -os=$("${__explorer:?}/os") +os=$("$__explorer/os") -if [ -f "${__object:?}/parameter/device" ]; then +if [ -f "$__object/parameter/device" ]; then blkdev="$(cat "$__object/parameter/device")" else - blkdev="${__object_id:?}" + blkdev="$__object_id" fi case "$os" in - alpine|centos|fedora|gentoo|redhat|suse|ubuntu) + centos|fedora|redhat|suse|gentoo) if [ ! -x "$(command -v lsblk)" ]; then echo "lsblk is required for __filesystem type" >&2 exit 1 diff --git a/cdist/conf/type/__git/explorer/group b/cdist/conf/type/__git/explorer/group index ab4396b1..3ddf9656 100644 --- a/cdist/conf/type/__git/explorer/group +++ b/cdist/conf/type/__git/explorer/group @@ -1,24 +1,5 @@ -#!/bin/sh -e +#!/bin/sh -destination="/${__object_id:?}/.git" +destination="/$__object_id/.git" -# shellcheck disable=SC2012 -group_gid=$(ls -ldn "${destination}" | awk '{ print $4 }') - -# NOTE: +1 because $((notanum)) prints 0. -if test $((group_gid + 1)) -ge 0 -then - group_should=$(cat "${__object:?}/parameter/group") - - if expr "${group_should}" : '[0-9]*$' >/dev/null - then - printf '%u\n' "${group_gid}" - else - if command -v getent > /dev/null - then - getent group "${group_gid}" | cut -d : -f 1 - else - awk -F: -v gid="${group_gid}" '$3 == gid { print $1 }' /etc/group - fi - fi -fi +stat --print "%G" "${destination}" 2>/dev/null || exit 0 diff --git a/cdist/conf/type/__git/explorer/owner b/cdist/conf/type/__git/explorer/owner index 4a4d0d13..4c3cd431 100644 --- a/cdist/conf/type/__git/explorer/owner +++ b/cdist/conf/type/__git/explorer/owner @@ -1,19 +1,5 @@ -#!/bin/sh -e +#!/bin/sh -destination="/${__object_id:?}/.git" +destination="/$__object_id/.git" -# shellcheck disable=SC2012 -owner_uid=$(ls -ldn "${destination}" | awk '{ print $3 }') - -# NOTE: +1 because $((notanum)) prints 0. -if test $((owner_uid + 1)) -ge 0 -then - owner_should=$(cat "${__object:?}/parameter/owner") - - if expr "${owner_should}" : '[0-9]*$' >/dev/null - then - printf '%u\n' "${owner_uid}" - else - printf '%s\n' "$(id -u -n "${owner_uid}")" - fi -fi +stat --print "%U" "${destination}" 2>/dev/null || exit 0 diff --git a/cdist/conf/type/__grafana_dashboard/manifest b/cdist/conf/type/__grafana_dashboard/manifest index 0d944482..d145c4c3 100755 --- a/cdist/conf/type/__grafana_dashboard/manifest +++ b/cdist/conf/type/__grafana_dashboard/manifest @@ -15,7 +15,7 @@ case $os in # Differntation not needed anymore apt_source_distribution=stable ;; - 10*|11*) + 10*) # Differntation not needed anymore apt_source_distribution=stable ;; diff --git a/cdist/conf/type/__group/gencode-remote b/cdist/conf/type/__group/gencode-remote index ff63e218..6091c548 100755 --- a/cdist/conf/type/__group/gencode-remote +++ b/cdist/conf/type/__group/gencode-remote @@ -88,7 +88,7 @@ if [ "$state" = "present" ]; then fi done if [ "$os" = "freebsd" ]; then - echo pw groupadd "$name" "$@" + echo pw groupadd "$@" "$name" else echo groupadd "$@" "$name" fi diff --git a/cdist/conf/type/__haproxy_dualstack/files/http b/cdist/conf/type/__haproxy_dualstack/files/http deleted file mode 100644 index 0508a465..00000000 --- a/cdist/conf/type/__haproxy_dualstack/files/http +++ /dev/null @@ -1,8 +0,0 @@ -frontend http - bind BIND@:80 - mode http - option httplog - default_backend http - -backend http - mode http diff --git a/cdist/conf/type/__haproxy_dualstack/files/https b/cdist/conf/type/__haproxy_dualstack/files/https deleted file mode 100644 index 73deac46..00000000 --- a/cdist/conf/type/__haproxy_dualstack/files/https +++ /dev/null @@ -1,10 +0,0 @@ -frontend https - bind BIND@:443 - mode tcp - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_ssl_hello_type 1 } - default_backend https - -backend https - mode tcp diff --git a/cdist/conf/type/__haproxy_dualstack/files/imaps b/cdist/conf/type/__haproxy_dualstack/files/imaps deleted file mode 100644 index b1ec3793..00000000 --- a/cdist/conf/type/__haproxy_dualstack/files/imaps +++ /dev/null @@ -1,12 +0,0 @@ -frontend imaps - bind BIND@:143 - bind BIND@:993 - - mode tcp - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_ssl_hello_type 1 } - default_backend imaps - -backend imaps - mode tcp diff --git a/cdist/conf/type/__haproxy_dualstack/files/smtps b/cdist/conf/type/__haproxy_dualstack/files/smtps deleted file mode 100644 index dce6ed4a..00000000 --- a/cdist/conf/type/__haproxy_dualstack/files/smtps +++ /dev/null @@ -1,12 +0,0 @@ -frontend smtps - bind BIND@:25 - bind BIND@:465 - - mode tcp - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_ssl_hello_type 1 } - default_backend smtps - -backend smtps - mode tcp diff --git a/cdist/conf/type/__haproxy_dualstack/man.rst b/cdist/conf/type/__haproxy_dualstack/man.rst deleted file mode 100644 index 6c131cbe..00000000 --- a/cdist/conf/type/__haproxy_dualstack/man.rst +++ /dev/null @@ -1,121 +0,0 @@ -cdist-type__haproxy_dualstack(7) -================================ - - -NAME ----- -cdist-type__haproxy_dualstack - Proxy services from a dual-stack server - - -DESCRIPTION ------------ -This (singleton) type installs and configures haproxy to act as a dual-stack -proxy for single-stack services. - -This can be useful to add IPv4 support to IPv6-only services while only using -one IPv4 for many such services. - -By default this type uses the plain TCP proxy mode, which means that there is no -need for TLS termination on this host when SNI is supported. -This also means that proxied services will not receive the client's IP address, -but will see the proxy's IP address instead (that of `$__target_host`). - -This can be solved by using the PROXY protocol, but do take into account that, -e.g. nginx cannot serve both regular HTTP(S) and PROXY protocols on the same -port, so you will need to use other ports for that. - -As a recommendation in this type: use TCP ports 8080 and 591 respectively to -serve HTTP and HTTPS using the PROXY protocol. - -See the EXAMPLES for more details. - - -OPTIONAL PARAMETERS -------------------- -v4proxy - Proxy incoming IPv4 connections to the equivalent IPv6 endpoint. - In its simplest use, it must be a NAME with an `AAAA` DNS entry, which is - the IP address actually providing the proxied services. - The full format of this argument is: - `[proxy:]NAME[[:PROTOCOL_1=PORT_1]...[:PROTOCOL_N=PORT_N]]` - Where starting with `proxy:` determines that the PROXY protocol must be - used and each `:PROTOCOL=PORT` (e.g. `:http=8080` or `:https=591`) is a PORT - override for the given PROTOCOL (see `--protocol`), if not present the - PROTOCOL's default port will be used. - - -v6proxy - Proxy incoming IPv6 connections to the equivalent IPv4 endpoint. - In its simplest use, it must be a NAME with an `A` DNS entry, which is - the IP address actually providing the proxied services. - See `--v4proxy` for more options and details. - -protocol - Can be passed multiple times or as a space-separated list of protocols. - Currently supported protocols are: `http`, `https`, `imaps`, `smtps`. - This defaults to: `http https imaps smtps`. - - -EXAMPLES --------- - -.. code-block:: sh - - # Proxy the IPv6-only services so IPv4-only clients can access them - # This uses HAProxy's TCP mode for http, https, imaps and smtps - __haproxy_dualstack \ - --v4proxy ipv6.chat \ - --v4proxy matrix.ungleich.ch - - # Proxy the IPv6-only HTTP(S) services so IPv4-only clients can access them - # Note this means that the backend IPv6-only server will only see - # the IPv6 address of the haproxy host managed by cdist, which can be - # troublesome if this information is relevant for analytics/security/... - # See the PROXY example below - __haproxy_dualstack \ - --protocol http --protocol https \ - --v4proxy ipv6.chat \ - --v4proxy matrix.ungleich.ch - - # Use the PROXY protocol to proxy the IPv6-only HTTP(S) services enabling - # IPv4-only clients to access them while maintaining the client's IP address - __haproxy_dualstack \ - --protocol http --protocol https \ - --v4proxy proxy:ipv6.chat:http=8080:https=591 \ - --v4proxy proxy:matrix.ungleich.ch:http=8080:https=591 - # Note however that the PROXY protocol is not compatible with regular - # HTTP(S) protocols, so your nginx will have to listen on different ports - # with the PROXY settings. - # Note that you will need to restrict access to the 8080 port to prevent - # Client IP spoofing. - # This can be something like: - # server { - # # listen for regular HTTP connections - # listen [::]:80 default_server; - # listen 80 default_server; - # # listen for PROXY HTTP connections - # listen [::]:8080 proxy_protocol; - # # Accept the Client's IP from the PROXY protocol - # real_ip_header proxy_protocol; - # } - - -SEE ALSO --------- -- https://www.haproxy.com/blog/enhanced-ssl-load-balancing-with-server-name-indication-sni-tls-extension/ -- https://www.haproxy.com/blog/haproxy/proxy-protocol/ -- https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/ - - -AUTHORS -------- -ungleich -Evilham - - -COPYING -------- -Copyright \(C) 2021 ungleich glarus ag. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__haproxy_dualstack/manifest b/cdist/conf/type/__haproxy_dualstack/manifest deleted file mode 100644 index d110eea6..00000000 --- a/cdist/conf/type/__haproxy_dualstack/manifest +++ /dev/null @@ -1,155 +0,0 @@ -#!/bin/sh -eu - -__package haproxy -require="__package/haproxy" __start_on_boot haproxy - -tmpdir="$__object/files" -mkdir "$tmpdir" -configtmp="$__object/files/haproxy.cfg" - -os=$(cat "$__global/explorer/os") -case $os in - freebsd) - CONFIG_FILE="/usr/local/etc/haproxy.conf" - cat < "$configtmp" -global - maxconn 4000 - user nobody - group nogroup - daemon - -EOF - - ;; - *) - CONFIG_FILE="/etc/haproxy/haproxy.cfg" - cat < "$configtmp" -global - log [::1] local2 - chroot /var/lib/haproxy - pidfile /var/run/haproxy.pid - maxconn 4000 - user haproxy - group haproxy - daemon - - # turn on stats unix socket - stats socket /var/lib/haproxy/stats - -EOF - ;; -esac - -cat <> "$configtmp" -defaults - retries 3 - log global - timeout http-request 10s - timeout queue 1m - timeout connect 10s - timeout client 1m - timeout server 1m - timeout http-keep-alive 10s - timeout check 10s -EOF - -dig_cmd="$(command -v dig || true)" -get_ip() { - # Usage: get_ip (ipv4|ipv6) NAME - # uses "dig" if available, else fallback to "host" - case $1 in - ipv4) - if [ -n "${dig_cmd}" ]; then - ${dig_cmd} +short A "$2" - else - host -t A "$2" | cut -d ' ' -f 4 | grep -v 'found:' - fi - ;; - ipv6) - if [ -n "${dig_cmd}" ]; then - ${dig_cmd} +short AAAA "$2" - else - host -t AAAA "$2" | cut -d ' ' -f 5 | grep -v 'NXDOMAIN' - fi - ;; - esac -} - -PROTOCOLS="$(cat "$__object/parameter/protocol")" - -for proxy in v4proxy v6proxy; do - param=$__object/parameter/$proxy - # no backend? skip generating code - if [ ! -f "$param" ]; then - continue - fi - - # turn backend name into bind parameter: v4backend -> ipv4@ - bind=$(echo $proxy | sed -e 's/^/ip/' -e 's/proxy//') - - case $bind in - ipv4) - backendproto=ipv6 - ;; - ipv6) - backendproto=ipv4 - ;; - esac - - for proto in ${PROTOCOLS}; do - # Add protocol "header" - printf "\n# %s %s \n" "${bind}" "${proto}" >> "$configtmp" - - sed -e "s/BIND/$bind/" \ - -e "s/\(frontend[[:space:]].*\)/\1$bind/" \ - -e "s/\(backend[[:space:]].*\)/\\1$bind/" \ - "$__type/files/$proto" >> "$configtmp" - - while read -r hostdefinition; do - if echo "$hostdefinition" | grep -qE '^proxy:'; then - # Proxy protocol was requested - host="$(echo "$hostdefinition" | sed -E 's/^proxy:([^:]+).*$/\1/')" - send_proxy=" send-proxy" - else - # Just use tcp proxy mode - host="$hostdefinition" - send_proxy="" - fi - if echo "$hostdefinition" | grep -qE ":${proto}="; then - # Use custom port definition if requested - port="$(echo "$hostdefinition" | sed -E "s/^(.*:)?${proto}=([0-9]+).*$/:\2/")" - else - # Else use the default - port="" - fi - servername=$host - - res=$(get_ip "$bind" "$servername") - - if [ -z "$res" ]; then - echo "$servername does not resolve - aborting config" >&2 - exit 1 - fi - - # Treat protocols without TLS+SNI specially - if [ "$proto" = http ]; then - echo " use-server $servername if { hdr(host) -i $host }" >> "$configtmp" - else - echo " use-server $servername if { req_ssl_sni -i $host }" >> "$configtmp" - fi - - # Create the "server" itself. - # Note that port and send_proxy will be empty unless - # they were requested by the type user - echo " server $servername ${backendproto}@${host}${port}${send_proxy}" >> "$configtmp" - - done < "$param" - done -done - -# Create config file -require="__package/haproxy" __file ${CONFIG_FILE} --source "$configtmp" --mode 0644 - -require="__file${CONFIG_FILE}" __check_messages "haproxy_reload" \ - --pattern "^__file${CONFIG_FILE}" \ - --execute "service haproxy reload || service haproxy restart" diff --git a/cdist/conf/type/__haproxy_dualstack/parameter/default/protocol b/cdist/conf/type/__haproxy_dualstack/parameter/default/protocol deleted file mode 100644 index dc8bb7bf..00000000 --- a/cdist/conf/type/__haproxy_dualstack/parameter/default/protocol +++ /dev/null @@ -1 +0,0 @@ -http https imaps smtps diff --git a/cdist/conf/type/__haproxy_dualstack/parameter/optional_multiple b/cdist/conf/type/__haproxy_dualstack/parameter/optional_multiple deleted file mode 100644 index 8c482bd4..00000000 --- a/cdist/conf/type/__haproxy_dualstack/parameter/optional_multiple +++ /dev/null @@ -1,3 +0,0 @@ -protocol -v4proxy -v6proxy diff --git a/cdist/conf/type/__haproxy_dualstack/singleton b/cdist/conf/type/__haproxy_dualstack/singleton deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__hostname/explorer/has_hostnamectl b/cdist/conf/type/__hostname/explorer/has_hostnamectl index 2f531f30..9040023d 100755 --- a/cdist/conf/type/__hostname/explorer/has_hostnamectl +++ b/cdist/conf/type/__hostname/explorer/has_hostnamectl @@ -21,4 +21,4 @@ # Check whether system has hostnamectl # -command -v hostnamectl 2>/dev/null || true +command -v hostnamectl || true diff --git a/cdist/conf/type/__uci_section/explorer/type b/cdist/conf/type/__hostname/explorer/hostname_file old mode 100644 new mode 100755 similarity index 72% rename from cdist/conf/type/__uci_section/explorer/type rename to cdist/conf/type/__hostname/explorer/hostname_file index 1675c2e0..6a00aa9f --- a/cdist/conf/type/__uci_section/explorer/type +++ b/cdist/conf/type/__hostname/explorer/hostname_file @@ -1,6 +1,6 @@ -#!/bin/sh -e +#!/bin/sh # -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) +# 2014 Nico Schottelius (nico-cdist at schottelius.org) # # This file is part of cdist. # @@ -17,9 +17,14 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -# This explorer retrieves the current section type. +# +# Retrieve the contents of /etc/hostname +# -section=$("${__type_explorer:?}/match") -test -n "${section}" || exit 0 - -uci -s -N get "${section}" 2>/dev/null || true +# Almost any distribution +if [ -f /etc/hostname ]; then + cat /etc/hostname +# SuSE +elif [ -f /etc/HOSTNAME ]; then + cat /etc/HOSTNAME +fi diff --git a/cdist/conf/type/__debconf_set_selections/manifest b/cdist/conf/type/__hostname/explorer/hostname_sysconfig similarity index 75% rename from cdist/conf/type/__debconf_set_selections/manifest rename to cdist/conf/type/__hostname/explorer/hostname_sysconfig index 0f4fb2e2..d0d7b4e7 100755 --- a/cdist/conf/type/__debconf_set_selections/manifest +++ b/cdist/conf/type/__hostname/explorer/hostname_sysconfig @@ -1,6 +1,6 @@ -#!/bin/sh -e +#!/bin/sh # -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) +# 2014 Nico Schottelius (nico-cdist at schottelius.org) # # This file is part of cdist. # @@ -17,5 +17,10 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # +# +# Retrieve the contents of /etc/hostname +# -__package_apt debconf +if [ -f /etc/sysconfig/network ]; then + awk -F= '/^HOSTNAME=/ { print $2 }' /etc/sysconfig/network +fi diff --git a/cdist/conf/type/__hostname/explorer/max_len b/cdist/conf/type/__hostname/explorer/max_len deleted file mode 100644 index fb863949..00000000 --- a/cdist/conf/type/__hostname/explorer/max_len +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/sh -e - -command -v getconf >/dev/null || exit 0 - -val=$(getconf HOST_NAME_MAX 2>/dev/null) || exit 0 - -if test -n "${val}" -a "${val}" != 'undefined' -then - echo "${val}" -fi diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote index c1a97ac8..8b5797dd 100755 --- a/cdist/conf/type/__hostname/gencode-remote +++ b/cdist/conf/type/__hostname/gencode-remote @@ -2,7 +2,6 @@ # # 2014-2017 Steven Armstrong (steven-cdist at armstrong.cc) # 2014 Nico Schottelius (nico-cdist at schottelius.org) -# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -20,86 +19,60 @@ # along with cdist. If not, see . # -os=$(cat "${__global:?}/explorer/os") -name_running=$(cat "${__global:?}/explorer/hostname") -has_hostnamectl=$(cat "${__object:?}/explorer/has_hostnamectl") - - -if test -s "${__object:?}/parameter/name" -then - name_should=$(cat "${__object:?}/parameter/name") +if [ -f "$__object/parameter/name" ]; then + name_should="$(cat "$__object/parameter/name")" else - case ${os} - in - # RedHat-derivatives and BSDs - (centos|fedora|redhat|scientific|freebsd|macosx|netbsd|openbsd) - # Hostname is FQDN - name_should=${__target_host:?} - ;; - (*) - # Hostname is only first component of FQDN - name_should=${__target_host:?} - name_should=${name_should%%.*} - ;; - esac + name_should="${__target_host%%.*}" fi +os=$(cat "$__global/explorer/os") +name_running=$(cat "$__global/explorer/hostname") +name_config=$(cat "$__object/explorer/hostname_file") +name_sysconfig=$(cat "$__object/explorer/hostname_sysconfig") +has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl") ################################################################################ -# Check if the (running) hostname is already correct +# If everything is ok -> exit # -test "${name_running}" != "${name_should}" || exit 0 - +case "$os" in + archlinux|debian|suse|ubuntu|devuan|coreos|alpine) + if [ "$name_config" = "$name_should" ] && [ "$name_running" = "$name_should" ]; then + exit 0 + fi + ;; + scientific|centos|freebsd|openbsd) + if [ "$name_sysconfig" = "$name_should" ] && [ "$name_running" = "$name_should" ]; then + exit 0 + fi + ;; + *) + echo "Unsupported os: $os" >&2 + exit 1 + ;; +esac ################################################################################ # Setup hostname # -echo 'changed' >>"${__messages_out:?}" +echo changed >> "$__messages_out" -# Use the good old way to set the hostname. -case ${os} -in - (alpine|debian|devuan|ubuntu) - echo 'hostname -F /etc/hostname' - ;; - (archlinux) - echo 'command -v hostnamectl >/dev/null 2>&1' \ - "&& hostnamectl set-hostname '${name_should}'" \ - "|| hostname '${name_should}'" - ;; - (centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|gentoo|void) - echo "hostname '${name_should}'" - ;; - (openwrt) - echo "echo '${name_should}' >/proc/sys/kernel/hostname" - ;; - (macosx) - echo "scutil --set HostName '${name_should}'" - ;; - (solaris) - echo "uname -S '${name_should}'" - ;; - (slackware|suse) - # We do not read from /etc/HOSTNAME, because the running - # hostname is the first component only while the file contains - # the FQDN. - echo "hostname '${name_should}'" - ;; - (*) - # Fall back to set the hostname using hostnamectl, if available. - if test -n "${has_hostnamectl}" - then - # Don't use hostnamectl as the primary means to set the hostname for - # systemd systems, because it cannot be trusted to work reliably and - # exit with non-zero when it fails (e.g. hostname too long, - # D-Bus failure, etc.). - - echo "hostnamectl set-hostname \"\$(cat /etc/hostname)\"" - echo "test \"\$(hostname)\" = \"\$(cat /etc/hostname)\"" \ - " || hostname -F /etc/hostname" - else - printf "echo 'Unsupported OS: %s' >&2\n" "${os}" - printf 'exit 1\n' - fi - ;; +# Use the good old way to set the hostname even on machines running systemd. +case "$os" in + archlinux|debian|ubuntu|devuan|centos|coreos|alpine) + printf "printf '%%s\\\\n' '$name_should' > /etc/hostname\\n" + echo "hostname -F /etc/hostname" + ;; + freebsd|openbsd) + echo "hostname '$name_should'" + ;; + suse) + echo "hostname '$name_should'" + printf "printf '%%s\\\\n' '$name_should' > /etc/HOSTNAME\\n" + ;; esac + +if [ "$has_hostnamectl" ]; then + # Allow hostnamectl set-hostname to fail silently. + # Who the fuck invented a tool that needs dbus to set the hostname anyway ... + echo "hostnamectl set-hostname '$name_should' || true" +fi diff --git a/cdist/conf/type/__hostname/man.rst b/cdist/conf/type/__hostname/man.rst index 72aefbab..d23a3b8a 100644 --- a/cdist/conf/type/__hostname/man.rst +++ b/cdist/conf/type/__hostname/man.rst @@ -8,10 +8,7 @@ cdist-type__hostname - Set the hostname DESCRIPTION ----------- -Sets the hostname on various operating systems. - -**Tip:** For advice on choosing a hostname, see -`RFC 1178 `_. +Set's the hostname on various operating systems. REQUIRED PARAMETERS @@ -21,7 +18,7 @@ None. OPTIONAL PARAMETERS ------------------- name - The hostname to set. Defaults to the first segment of __target_host + The hostname to set. Defaults to the first segment of __target_host (${__target_host%%.*}) diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest index b80aa2ef..8f1adf12 100755 --- a/cdist/conf/type/__hostname/manifest +++ b/cdist/conf/type/__hostname/manifest @@ -2,7 +2,6 @@ # # 2012 Steven Armstrong (steven-cdist at armstrong.cc) # 2014 Nico Schottelius (nico-cdist at schottelius.org) -# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -20,176 +19,50 @@ # along with cdist. If not, see . # -set_hostname_systemd() { - echo "$1" | __file /etc/hostname --source - -} - -os=$(cat "${__global:?}/explorer/os") - -max_len=$(cat "${__object:?}/explorer/max_len") -has_hostnamectl=$(cat "${__object:?}/explorer/has_hostnamectl") - -if test -s "${__object:?}/parameter/name" -then - name_should=$(cat "${__object:?}/parameter/name") +os=$(cat "$__global/explorer/os") +if [ -f "$__object/parameter/name" ]; then + name_should="$(cat "$__object/parameter/name")" else - case ${os} - in - # RedHat-derivatives and BSDs - (centos|fedora|redhat|scientific|freebsd|netbsd|openbsd|slackware|suse) - # Hostname is FQDN - name_should=${__target_host:?} - ;; - *) - # Hostname is only first component of FQDN on all other systems. - name_should=${__target_host:?} - name_should=${name_should%%.*} - ;; + case "$os" in + openbsd) + name_should="${__target_host}" + ;; + *) + name_should="${__target_host%%.*}" + ;; esac fi -if test -n "${max_len}" && test "$(printf '%s' "${name_should}" | wc -c)" -gt "${max_len}" -then - printf "Host name too long. Up to %u characters allowed.\n" "${max_len}" >&2 - exit 1 -fi -case ${os} -in - (alpine|debian|devuan|ubuntu|void) - echo "${name_should}" | __file /etc/hostname --source - - ;; - (archlinux) - if test -n "${has_hostnamectl}" - then - set_hostname_systemd "${name_should}" - else - echo 'Ancient ArchLinux variants without hostnamectl are not supported.' >&2 - exit 1 - # Only for ancient ArchLinux, write to /etc/rc.conf on pre-systemd - # versions. There are some versions which use /etc/hostname but not - # systemd. It is unclear which ones these are. +not_supported() { + echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2 + echo "Please contribute an implementation for it if you can." >&2 + exit 1 +} - # __key_value '/etc/rc.conf:HOSTNAME' \ - # --file /etc/rc.conf \ - # --delimiter '=' --exact_delimiter \ - # --key 'HOSTNAME' \ - # --value "\"$name_should\"" - fi - ;; - (centos|fedora|redhat|scientific) - if test -z "${has_hostnamectl}" - then - # Only write to /etc/sysconfig/network on non-systemd versions. - # On systemd-based versions this entry is ignored. - __key_value '/etc/sysconfig/network:HOSTNAME' \ - --file /etc/sysconfig/network \ - --delimiter '=' --exact_delimiter \ - --key HOSTNAME \ - --value "\"${name_should}\"" - else - set_hostname_systemd "${name_should}" - fi - ;; - (gentoo) - # Only write to /etc/conf.d/hostname on OpenRC-based installations. - # On systemd use hostnamectl(1) in gencode-remote. - if test -z "${has_hostnamectl}" - then - __key_value '/etc/conf.d/hostname:hostname' \ - --file /etc/conf.d/hostname \ - --delimiter '=' --exact_delimiter \ - --key 'hostname' \ - --value "\"${name_should}\"" - else - set_hostname_systemd "$name_should" - fi - ;; - (freebsd) - __key_value '/etc/rc.conf:hostname' \ - --file /etc/rc.conf \ - --delimiter '=' --exact_delimiter \ - --key 'hostname' \ - --value "\"${name_should}\"" - ;; - (macosx) +case "$os" in + archlinux|debian|suse|ubuntu|devuan|coreos|alpine) # handled in gencode-remote - ;; - (netbsd) - __key_value '/etc/rc.conf:hostname' \ + : + ;; + scientific|centos) + __key_value sysconfig-hostname \ + --file /etc/sysconfig/network \ + --delimiter '=' \ + --key HOSTNAME \ + --value "$name_should" --exact_delimiter + ;; + freebsd) + __key_value rcconf-hostname \ --file /etc/rc.conf \ - --delimiter '=' --exact_delimiter \ + --delimiter '=' \ --key 'hostname' \ - --value "\"${name_should}\"" - - # To avoid confusion, ensure that the hostname is only stored once. - __file /etc/myname --state absent - ;; - (openbsd) - echo "${name_should}" | __file /etc/myname --source - - ;; - (openwrt) - __uci system.@system[0].hostname --value "${name_should}" - # --transaction hostname - ;; - (slackware) - # We write the FQDN into /etc/HOSTNAME. But /etc/rc.d/rc.M will only - # read the first component from this file and set it as the running - # hostname on boot. - echo "${name_should}" | __file /etc/HOSTNAME --source - - ;; - (solaris) - echo "${name_should}" | __file /etc/nodename --source - - ;; - (suse) - if test -s "${__global:?}/explorer/os_release" - then - # shellcheck source=/dev/null - os_version=$(. "${__global:?}/explorer/os_release" && echo "${VERSION}") - else - os_version=$(sed -n 's/^VERSION\ *=\ *//p' "${__global:?}/explorer/os_version") - fi - os_major=$(expr "${os_version}" : '\([0-9]\{1,\}\)') - - # Classic SuSE stores the FQDN in /etc/HOSTNAME, while - # systemd does not. The running hostname is the first - # component in both cases. - # In versions before 15.x, the FQDN is stored in /etc/hostname. - if test -n "${has_hostnamectl}" \ - && test "${os_major}" -ge 15 \ - && test "${os_major}" -ne 42 - then - # strip away everything but the first part from $name_should - name_should=${name_should%%.*} - fi - - # Modern SuSE provides /etc/HOSTNAME as a symlink for - # backwards-compatibility. Unfortunately it cannot be used - # here as __file does not follow the symlink. - # Therefore, we use the presence of the hostnamectl binary as - # an indication of which file to use. This unfortunately does - # not work correctly on openSUSE 12.x which provides - # hostnamectl but not /etc/hostname. - - if test -n "${has_hostnamectl}" -a "${os_major}" -gt 12 - then - hostname_file=/etc/hostname - else - hostname_file=/etc/HOSTNAME - fi - - echo "${name_should}" | __file "${hostname_file}" --source - - ;; - (*) - # On other operating systems we fall back to systemd's - # hostnamectl if available… - if test -n "${has_hostnamectl}" - then - set_hostname_systemd "${name_should}" - else - echo "Your operating system (${os}) is currently not supported by this type (${__type##*/})." >&2 - echo "Please contribute an implementation for it if you can." >&2 - exit 1 - fi - ;; + --value "$name_should" + ;; + openbsd) + echo "$name_should" | __file /etc/myname --source - + ;; + *) + not_supported + ;; esac diff --git a/cdist/conf/type/__hosts/man.rst b/cdist/conf/type/__hosts/man.rst index 1ac706cb..bece7967 100644 --- a/cdist/conf/type/__hosts/man.rst +++ b/cdist/conf/type/__hosts/man.rst @@ -25,10 +25,6 @@ ip state is ``present``, this parameter is mandatory, if state is ``absent``, this parameter is silently ignored. -alias - An alias for the hostname. - This parameter can be specified multiple times (once per alias). - EXAMPLES -------- @@ -40,8 +36,6 @@ EXAMPLES # previously configured via __hosts. __hosts happy --state absent - __hosts srv1.example.com --ip 192.168.0.42 --alias srv1 - SEE ALSO -------- @@ -49,14 +43,13 @@ SEE ALSO AUTHORS ------- -| Dmitry Bogatov -| Dennis Camera + +Dmitry Bogatov COPYING ------- -Copyright \(C) 2015-2016 Dmitry Bogatov, 2019 Dennis Camera. -You can redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either version 3 of -the License, or (at your option) any later version. +Copyright (C) 2015,2016 Dmitry Bogatov. Free use of this software is granted +under the terms of the GNU General Public License version 3 or later +(GPLv3+). diff --git a/cdist/conf/type/__hosts/manifest b/cdist/conf/type/__hosts/manifest index 8103ebd5..c536b83b 100755 --- a/cdist/conf/type/__hosts/manifest +++ b/cdist/conf/type/__hosts/manifest @@ -1,42 +1,29 @@ #!/bin/sh -e -# # Copyright (C) 2015 Bogatov Dmitry -# 2019 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify +# This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # -# cdist is distributed in the hope that it will be useful, +# This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . -# +set -ue -set -e +hostname="$__object_id" +state="$(cat "$__object/parameter/state")" +marker="# __hosts/$hostname" -hostname=$__object_id -state=$(cat "${__object}/parameter/state") -marker="# __hosts/${hostname}" +set -- "__hosts/$hostname" --file /etc/hosts --state "$state" -if test "${state}" != 'absent' -then - ip=$(cat "${__object}/parameter/ip") - if test -s "${__object}/parameter/alias" - then - aliases=$(while read -r a; do printf '\t%s' "$a"; done <"$__object/parameter/alias") - fi - - set -- --line "$(printf '%s\t%s%s %s' \ - "${ip}" "${hostname}" "${aliases}" "${marker}")" +if [ "$state" = absent ] ; then + __line "$@" --regex "$marker" else - set -- --regex "$(echo "${marker}" | sed -e 's/\./\\./')$" + ip="$(cat "$__object/parameter/ip")" + __line "$@" --line "$ip $hostname $marker" fi - -__line "/etc/hosts:${hostname}" --file /etc/hosts --state "${state}" "$@" diff --git a/cdist/conf/type/__hosts/parameter/optional_multiple b/cdist/conf/type/__hosts/parameter/optional_multiple deleted file mode 100644 index d077ed80..00000000 --- a/cdist/conf/type/__hosts/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -alias diff --git a/cdist/conf/type/__hwclock/explorer/timedatectl_localrtc b/cdist/conf/type/__hwclock/explorer/timedatectl_localrtc deleted file mode 100755 index 8239122e..00000000 --- a/cdist/conf/type/__hwclock/explorer/timedatectl_localrtc +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Prints the LocalRTC property using timedatectl on systemd-based systems. -# - -command -v timedatectl >/dev/null 2>&1 || exit 0 - -# NOTE: Older versions of timedatectl do not support `timedatectl show' -timedatectl --no-pager status \ -| awk -F': ' '$1 ~ "RTC in local TZ$" { sub(/[ \t]*$/, "", $2); print $2 }' diff --git a/cdist/conf/type/__hwclock/gencode-remote b/cdist/conf/type/__hwclock/gencode-remote deleted file mode 100755 index 5995fb23..00000000 --- a/cdist/conf/type/__hwclock/gencode-remote +++ /dev/null @@ -1,62 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -mode=$(cat "${__object:?}/parameter/mode") - -timedatectl_localrtc=$(cat "${__object:?}/explorer/timedatectl_localrtc") -adjtime_mode=$(cat "${__object:?}/explorer/adjtime_mode") - - -case ${mode} -in - (localtime) - adjtime_str=LOCAL - local_rtc_str=yes - ;; - (UTC|utc) - adjtime_str=UTC - local_rtc_str=no - ;; - (*) - printf 'Invalid value for --mode: %s\n' "${mode}" >&2 - printf 'Acceptable values are: localtime, utc.\n' >&2 - exit 1 -esac - - -if test -n "${timedatectl_localrtc}" -then - # systemd - timedatectl_should=${local_rtc_str} - if test "${timedatectl_localrtc}" != "${timedatectl_should}" - then - printf 'timedatectl set-local-rtc %s\n' "${timedatectl_should}" - fi -elif test -n "${adjtime_mode}" -then - # others (update /etc/adjtime if present) - if test "${adjtime_mode}" != "${adjtime_str}" - then - # Update /etc/adjtime (3rd line is clock mode) - # adjtime(5) https://man7.org/linux/man-pages/man5/adjtime.5.html - # FIXME: Should maybe add third line if adjfile only contains two lines - printf "sed -i '3c\\\\\\n%s\\n' /etc/adjtime\\n" "${adjtime_str}" - fi -fi diff --git a/cdist/conf/type/__hwclock/man.rst b/cdist/conf/type/__hwclock/man.rst deleted file mode 100644 index 65eb648f..00000000 --- a/cdist/conf/type/__hwclock/man.rst +++ /dev/null @@ -1,63 +0,0 @@ -cdist-type__hwclock(7) -====================== - -NAME ----- -cdist-type__hwclock - Manage the hardware real time clock. - - -DESCRIPTION ------------ -This type can be used to control how the hardware clock is used by the operating -system. - - -REQUIRED PARAMETERS -------------------- -mode - What mode the hardware clock is in. - - Acceptable values: - - localtime - The hardware clock is set to local time (common for systems also running - Windows.) - UTC - The hardware clock is set to UTC (common on UNIX systems.) - - -OPTIONAL PARAMETERS -------------------- -None. - - -BOOLEAN PARAMETERS ------------------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # Make the operating system treat the time read from the hwclock as UTC. - __hwclock --mode UTC - - -SEE ALSO --------- -:strong:`hwclock`\ (8) - - -AUTHORS -------- -Dennis Camera - - -COPYING -------- -Copyright \(C) 2020 Dennis Camera. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__hwclock/manifest b/cdist/conf/type/__hwclock/manifest deleted file mode 100755 index 7d9ab88f..00000000 --- a/cdist/conf/type/__hwclock/manifest +++ /dev/null @@ -1,222 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# TODO: Consider supporting BADYEAR - -os=$(cat "${__global:?}/explorer/os") -mode=$(cat "${__object:?}/parameter/mode") - -has_systemd_timedatectl=$(test -s "${__object:?}/explorer/timedatectl_localrtc" && echo true || echo false) - - -case ${mode} -in - (localtime) - local_clock=true - ;; - (UTC|utc) - local_clock=false - ;; - (*) - printf 'Invalid value for --mode: %s\n' "${mode}" >&2 - printf 'Acceptable values are: UTC, localtime.\n' >&2 - exit 1 -esac - - -case ${os} -in - (alpine|gentoo) - if ! $has_systemd_timedatectl - then - # NOTE: Gentoo also supports systemd, in which case /etc/conf.d is - # not used. So we check for systemd presence here and only - # update /etc/conf.d if systemd is not installed. - # https://wiki.gentoo.org/wiki/System_time#Hardware_clock - - export CDIST_ORDER_DEPENDENCY=true - __file /etc/conf.d/hwclock --state present \ - --owner root --group root --mode 0644 - __key_value /etc/conf.d/hwclock:clock \ - --file /etc/conf.d/hwclock \ - --key clock \ - --delimiter '=' --exact_delimiter \ - --value "\"$($local_clock && echo local || echo UTC)\"" - unset CDIST_ORDER_DEPENDENCY - fi - ;; - (centos|fedora|redhat|scientific) - os_version=$(cat "${__global:?}/explorer/os_version") - os_major=$(expr "${os_version}" : '.* release \([0-9]*\)') - case ${os} - in - (centos|scientific) - update_sysconfig=$(test "${os_major}" -lt 6 && echo true || echo false) - ;; - (fedora) - update_sysconfig=$(test "${os_major}" -lt 10 && echo true || echo false) - ;; - (redhat|*) - case ${os_version} - in - ('Red Hat Enterprise Linux'*) - update_sysconfig=$(test "${os_major}" -lt 6 && echo true || echo false) - ;; - ('Red Hat Linux'*) - update_sysconfig=true - ;; - (*) - printf 'Could not determine Red Hat distribution.\n' >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - ;; - esac - ;; - esac - - if ${update_sysconfig:?} - then - export CDIST_ORDER_DEPENDENCY=true - __file /etc/sysconfig/clock --state present \ - --owner root --group root --mode 0644 - __key_value /etc/sysconfig/clock:UTC \ - --file /etc/sysconfig/clock \ - --key UTC \ - --delimiter '=' --exact_delimiter \ - --value "$($local_clock && echo false || echo true)" - unset CDIST_ORDER_DEPENDENCY - fi - ;; - (debian|devuan|ubuntu) - os_major=$(sed 's/[^0-9].*$//' "${__global:?}/explorer/os_version") - - case ${os} - in - (debian) - if test "${os_major}" -ge 7 - then - update_rcS=false - elif test "${os_major}" -ge 3 - then - update_rcS=true - else - # Debian 2.2 should be supportable using rcS. - # Debian 2.1 uses the ancient GMT key. - # Debian 1.3 does not have rcS. - printf "Your operating system (Debian %s) is currently not supported by this type (%s)\n" \ - "$(cat "${__global:?}/explorer/os_version")" "${__type##*/}" >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - fi - ;; - (devuan) - update_rcS=false - ;; - (ubuntu) - update_rcS=$(test "${os_major}" -lt 16 && echo true || echo false) - ;; - esac - - if ${update_rcS} - then - export CDIST_ORDER_DEPENDENCY=true - __file /etc/default/rcS --state present \ - --owner root --group root --mode 0644 - __key_value /etc/default/rcS:UTC \ - --file /etc/default/rcS \ - --key UTC \ - --delimiter '=' --exact_delimiter \ - --value "$($local_clock && echo no || echo yes)" - unset CDIST_ORDER_DEPENDENCY - fi - ;; - (freebsd) - # cf. adjkerntz(8) - __file /etc/wall_cmos_clock \ - --state "$($local_clock && echo present || echo absent)" \ - --owner root --group wheel --mode 0444 - ;; - (netbsd) - # https://wiki.netbsd.org/guide/boot/#index9h2 - __key_value /etc/rc.conf:rtclocaltime \ - --file /etc/rc.conf \ - --key rtclocaltime \ - --delimiter '=' --exact_delimiter \ - --value "$($local_clock && echo YES || echo NO)" - ;; - (slackware) - __file /etc/hardwareclock --owner root --group root --mode 0644 \ - --source - <<-EOF - # /etc/hardwareclock - # - # Tells how the hardware clock time is stored. - # This file is managed by cdist. - - $($local_clock && echo localtime || echo UTC) - EOF - ;; - (suse) - if test -s "${__global:?}/explorer/os_release" - then - # shellcheck source=/dev/null - os_version=$(. "${__global:?}/explorer/os_release" && echo "${VERSION}") - else - os_version=$(sed -n 's/^VERSION\ *=\ *//p' "${__global:?}/explorer/os_version") - fi - os_major=$(expr "${os_version}" : '\([0-9]\{1,\}\)') - - # TODO: Consider using `yast2 timezone set hwclock' instead - if expr "${os_major}" \< 12 - then - # Starting with SuSE 12 (first systemd-based version) - # /etc/sysconfig/clock does not contain the HWCLOCK line - # anymore. - # With SuSE 13, it has been reduced to TIMEZONE configuration. - __key_value /etc/sysconfig/clock:HWCLOCK \ - --file /etc/sysconfig/clock \ - --delimiter '=' --exact_delimiter \ - --key HWCLOCK \ - --value "$($local_clock && echo '"--localtime"' || echo '"-u"')" - fi - ;; - (void) - export CDIST_ORDER_DEPENDENCY=true - __file /etc/rc.conf \ - --owner root --group root --mode 0644 \ - --state present - __key_value /etc/rc.conf:HARDWARECLOCK \ - --file /etc/rc.conf \ - --delimiter '=' --exact_delimiter \ - --key HARDWARECLOCK \ - --value "\"$($local_clock && echo localtime || echo UTC)\"" - unset CDIST_ORDER_DEPENDENCY - ;; - (*) - if ! $has_systemd_timedatectl - then - printf "Your operating system (%s) is currently not supported by this type (%s)\n" "$os" "${__type##*/}" >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - fi - ;; -esac - -# NOTE: timedatectl set-local-rtc for systemd is in gencode-remote -# NOTE: /etc/adjtime is also updated in gencode-remote diff --git a/cdist/conf/type/__hwclock/parameter/required b/cdist/conf/type/__hwclock/parameter/required deleted file mode 100644 index 17ab372f..00000000 --- a/cdist/conf/type/__hwclock/parameter/required +++ /dev/null @@ -1 +0,0 @@ -mode diff --git a/cdist/conf/type/__hwclock/singleton b/cdist/conf/type/__hwclock/singleton deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__install_chroot_umount/manifest b/cdist/conf/type/__install_chroot_umount/manifest deleted file mode 120000 index f17af67a..00000000 --- a/cdist/conf/type/__install_chroot_umount/manifest +++ /dev/null @@ -1 +0,0 @@ -../__chroot_umount/manifest \ No newline at end of file diff --git a/cdist/conf/type/__install_directory/man.rst b/cdist/conf/type/__install_directory/man.rst deleted file mode 100644 index c402cbad..00000000 --- a/cdist/conf/type/__install_directory/man.rst +++ /dev/null @@ -1,101 +0,0 @@ -cdist-type__install_directory(7) -================================ - -NAME ----- -cdist-type__install_directory - Manage a directory with install command - - -DESCRIPTION ------------ -This cdist type allows you to create or remove directories on the target. - - -REQUIRED PARAMETERS -------------------- -None. - - -OPTIONAL PARAMETERS -------------------- -state - 'present' or 'absent', defaults to 'present' - -group - Group to chgrp to. - -mode - Unix permissions, suitable for chmod. - -owner - User to chown to. - - -BOOLEAN PARAMETERS ------------------- -parents - Whether to create parents as well (mkdir -p behaviour). - Warning: all intermediate directory permissions default - to whatever mkdir -p does. - - Usually this means root:root, 0700. - -recursive - If supplied the chgrp and chown call will run recursively. - This does *not* influence the behaviour of chmod. - -MESSAGES --------- -chgrp - Changed group membership -chown - Changed owner -chmod - Changed mode -create - Empty directory was created -remove - Directory exists, but state is absent, directory will be removed by generated code. -remove non directory - Something other than a directory with the same name exists and was removed prior to create. - - -EXAMPLES --------- - -.. code-block:: sh - - # A silly example - __install_directory /tmp/foobar - - # Remove a directory - __install_directory /tmp/foobar --state absent - - # Ensure /etc exists correctly - __install_directory /etc --owner root --group root --mode 0755 - - # Create nfs service directory, including parents - __install_directory /home/services/nfs --parents - - # Change permissions recursively - __install_directory /home/services --recursive --owner root --group root - - # Setup a temp directory - __install_directory /local --mode 1777 - - # Take it all - __install_directory /home/services/kvm --recursive --parents \ - --owner root --group root --mode 0755 --state present - - -AUTHORS -------- -Nico Schottelius - - -COPYING -------- -Copyright \(C) 2011 Nico Schottelius. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__install_directory/man.rst b/cdist/conf/type/__install_directory/man.rst new file mode 120000 index 00000000..1ad7fa84 --- /dev/null +++ b/cdist/conf/type/__install_directory/man.rst @@ -0,0 +1 @@ +../__directory/man.rst \ No newline at end of file diff --git a/cdist/conf/type/__install_file/man.rst b/cdist/conf/type/__install_file/man.rst index 977ed77c..c5409167 100644 --- a/cdist/conf/type/__install_file/man.rst +++ b/cdist/conf/type/__install_file/man.rst @@ -23,10 +23,6 @@ symlink directory replace it with the source file -One exception is that when state is pre-exists, an error is raised if -the file would have been created otherwise (e.g. it is not present or -not a regular file). - In any case, make sure that the file attributes are as specified. @@ -37,7 +33,7 @@ None. OPTIONAL PARAMETERS ------------------- state - 'present', 'absent', 'exists' or 'pre-exists', defaults to 'present' where: + 'present', 'absent' or 'exists', defaults to 'present' where: present the file is exactly the one from source @@ -45,9 +41,6 @@ state the file does not exist exists the file from source but only if it doesn't already exist - pre-exists - check that the file exists and is a regular file, but do not - create or modify it group Group to chgrp to. @@ -63,9 +56,6 @@ source If not supplied, an empty file or directory will be created. If source is '-' (dash), take what was written to stdin as the file content. -onchange - The code to run if file is modified. - MESSAGES -------- chgrp @@ -103,8 +93,6 @@ EXAMPLES __install_file /home/frodo/.bashrc --source "/etc/skel/.bashrc" \ --state exists \ --owner frodo --mode 0600 - # Check that the file is present, show an error when it is not - __install_file /etc/somefile --state pre-exists # Take file content from stdin __install_file /tmp/whatever --owner root --group root --mode 644 --source - << DONE Here goes the content for /tmp/whatever diff --git a/cdist/conf/type/__iptables_apply/files/init-script b/cdist/conf/type/__iptables_apply/files/init-script index e42017ae..d9c79ef7 100644 --- a/cdist/conf/type/__iptables_apply/files/init-script +++ b/cdist/conf/type/__iptables_apply/files/init-script @@ -1,4 +1,7 @@ #!/bin/sh +# Nico Schottelius +# Zürisee, Mon Sep 2 18:38:27 CEST 2013 +# ### BEGIN INIT INFO # Provides: iptables # Required-Start: $local_fs $remote_fs @@ -11,72 +14,34 @@ # and saves/restores previous status ### END INIT INFO -# Originally written by: -# Nico Schottelius -# Zürisee, Mon Sep 2 18:38:27 CEST 2013 -# -# 2013 Nico Schottelius (nico-cdist at schottelius.org) -# 2020 Matthias Stecher (matthiasstecher at gmx.de) -# -# This file is distributed with cdist and licenced under the -# GNU GPLv3+ WITHOUT ANY WARRANTY. - - -# Read files and execute the content with the given commands -# -# Arguments: -# 1: Directory -# 2..n: Commands which should be used to execute the file content -gothrough() { - cd "$1" || return - shift - - # iterate through all rules and continue if it's not a file - for rule in *; do - [ -f "$rule" ] || continue - echo "Appling iptables rule $rule ..." - - # execute it with all commands specificed - ruleparam="$(cat "$rule")" - for cmd in "$@"; do - # Command and Rule should be split. - # shellcheck disable=SC2046 - command $cmd $ruleparam - done - done -} - -# Shortcut for iptables command to do IPv4 and v6 -# only applies to the "reset" target -iptables() { - command iptables "$@" - command ip6tables "$@" -} basedir=/etc/iptables.d -status4="${basedir}/.pre-start" -status6="${basedir}/.pre-start6" +status="${basedir}/.pre-start" case $1 in start) # Save status - iptables-save > "$status4" - ip6tables-save > "$status6" + iptables-save > "$status" # Apply our ruleset - gothrough "$basedir" iptables - #gothrough "$basedir/v4" iptables # conflicts with $basedir - gothrough "$basedir/v6" ip6tables - gothrough "$basedir/all" iptables ip6tables + cd "$basedir" || exit + count="$(find . ! -name . -prune | wc -l)" + + # Only do something if there are rules + if [ "$count" -ge 1 ]; then + for rule in *; do + echo "Applying iptables rule $rule ..." + # Rule should be split. + # shellcheck disable=SC2046 + iptables $(cat "$rule") + done + fi ;; stop) # Restore from status before, if there is something to restore - if [ -f "$status4" ]; then - iptables-restore < "$status4" - fi - if [ -f "$status6" ]; then - ip6tables-restore < "$status6" + if [ -f "$status" ]; then + iptables-restore < "$status" fi ;; restart) diff --git a/cdist/conf/type/__iptables_apply/man.rst b/cdist/conf/type/__iptables_apply/man.rst index 3bef92cc..76e1f6bf 100644 --- a/cdist/conf/type/__iptables_apply/man.rst +++ b/cdist/conf/type/__iptables_apply/man.rst @@ -10,24 +10,7 @@ DESCRIPTION ----------- This cdist type deploys an init script that triggers the configured rules and also re-applies them on -configuration. Rules are written from __iptables_rule -into the folder ``/etc/iptables.d/``. - -It reads all rules from the base folder as rules for IPv4. -Rules in the subfolder ``v6/`` are IPv6 rules. Rules in -the subfolder ``all/`` are applied to both rule tables. All -files contain the arguments for a single ``iptables`` and/or -``ip6tables`` command. - -Rules are applied in the following order: -1. All IPv4 rules -2. All IPv6 rules -2. All rules that should be applied to both tables - -The order of the rules that will be applied are definite -from the result the shell glob returns, which should be -alphabetical. If rules must be applied in a special order, -prefix them with a number like ``02-some-rule``. +configuration. REQUIRED PARAMETERS @@ -41,7 +24,7 @@ None EXAMPLES -------- -None (__iptables_apply is used by __iptables_rule automatically) +None (__iptables_apply is used by __iptables_rule) SEE ALSO @@ -52,13 +35,11 @@ SEE ALSO AUTHORS ------- Nico Schottelius -Matthias Stecher COPYING ------- -Copyright \(C) 2013 Nico Schottelius. -Copyright \(C) 2020 Matthias Stecher. -You can redistribute it and/or modify it under the terms of the GNU -General Public License as published by the Free Software Foundation, -either version 3 of the License, or (at your option) any later version. +Copyright \(C) 2013 Nico Schottelius. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__iptables_rule/man.rst b/cdist/conf/type/__iptables_rule/man.rst index afb71e01..92d8859f 100644 --- a/cdist/conf/type/__iptables_rule/man.rst +++ b/cdist/conf/type/__iptables_rule/man.rst @@ -11,10 +11,6 @@ DESCRIPTION This cdist type allows you to manage iptable rules in a distribution independent manner. -See :strong:`cdist-type__iptables_apply`\ (7) for the -execution order of these rules. It will be executed -automaticly to apply all rules non-volaite. - REQUIRED PARAMETERS ------------------- @@ -29,24 +25,6 @@ state 'present' or 'absent', defaults to 'present' -BOOLEAN PARAMETERS ------------------- -All rules without any of these parameters will be treated like ``--v4`` because -of backward compatibility. - -v4 - Explicitly set it as rule for IPv4. If IPv6 is set, too, it will be - threaten like ``--all``. Will be the default if nothing else is set. - -v6 - Explicitly set it as rule for IPv6. If IPv4 is set, too, it will be - threaten like ``--all``. - -all - Set the rule for both IPv4 and IPv6. It will be saved separately from the - other rules. - - EXAMPLES -------- @@ -70,16 +48,6 @@ EXAMPLES --state absent - # IPv4-only rule for ICMPv4 - __iptables_rule icmp-v4 --v4 --rule "-A INPUT -p icmp -j ACCEPT" - # IPv6-only rule for ICMPv6 - __iptables_rule icmp-v6 --v6 --rule "-A INPUT -p icmpv6 -j ACCEPT" - - # doing something for the dual stack - __iptables_rule fwd-eth0-eth1 --v4 --v6 --rule "-A INPUT -i eth0 -o eth1 -j ACCEPT" - __iptables_rule fwd-eth1-eth0 --all --rule "-A -o eth1 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT" - - SEE ALSO -------- :strong:`cdist-type__iptables_apply`\ (7), :strong:`iptables`\ (8) @@ -88,13 +56,11 @@ SEE ALSO AUTHORS ------- Nico Schottelius -Matthias Stecher COPYING ------- -Copyright \(C) 2013 Nico Schottelius. -Copyright \(C) 2020 Matthias Stecher. -You can redistribute it and/or modify it under the terms of the GNU -General Public License as published by the Free Software Foundation, -either version 3 of the License, or (at your option) any later version. +Copyright \(C) 2013 Nico Schottelius. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__iptables_rule/manifest b/cdist/conf/type/__iptables_rule/manifest index d4394c25..ed78787f 100755 --- a/cdist/conf/type/__iptables_rule/manifest +++ b/cdist/conf/type/__iptables_rule/manifest @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2013 Nico Schottelius (nico-cdist at schottelius.org) -# 2020 Matthias Stecher (matthiasstecher at gmx.de) # # This file is part of cdist. # @@ -25,36 +24,12 @@ base_dir=/etc/iptables.d name="$__object_id" state="$(cat "$__object/parameter/state")" -if [ -f "$__object/parameter/v4" ]; then - only_v4="yes" - # $specific_dir is $base_dir -fi -if [ -f "$__object/parameter/v6" ]; then - only_v6="yes" - specific_dir="$base_dir/v6" -fi -# If rules should be set for both protocols -if { [ "$only_v4" = "yes" ] && [ "$only_v6" = "yes" ]; } || - [ -f "$__object/parameter/all" ]; then - - # all to a specific directory - specific_dir="$base_dir/all" -fi - -# set rule directory based on if it's the base or subdirectory -rule_dir="${specific_dir:-$base_dir}" - ################################################################################ # Basic setup # __directory "$base_dir" --state present -# sub-directory if required -if [ "$specific_dir" ]; then - require="__directory/$base_dir" __directory "$specific_dir" --state present -fi - # Have apply do the real job require="$__object_name" __iptables_apply @@ -62,15 +37,6 @@ require="$__object_name" __iptables_apply # The rule # -for dir in "$base_dir" "$base_dir/v6" "$base_dir/all"; do - # defaults to absent except the directory that should contain the file - if [ "$rule_dir" = "$dir" ]; then - curr_state="$state" - else - curr_state="absent" - fi - - require="__directory/$rule_dir" __file "$dir/$name" \ - --source "$__object/parameter/rule" \ - --state "$curr_state" -done +require="__directory/$base_dir" __file "$base_dir/${name}" \ + --source "$__object/parameter/rule" \ + --state "$state" diff --git a/cdist/conf/type/__iptables_rule/parameter/boolean b/cdist/conf/type/__iptables_rule/parameter/boolean deleted file mode 100644 index 76882272..00000000 --- a/cdist/conf/type/__iptables_rule/parameter/boolean +++ /dev/null @@ -1,3 +0,0 @@ -all -v4 -v6 diff --git a/cdist/conf/type/__key_value/explorer/state b/cdist/conf/type/__key_value/explorer/state index d24600af..7b2de1df 100755 --- a/cdist/conf/type/__key_value/explorer/state +++ b/cdist/conf/type/__key_value/explorer/state @@ -40,9 +40,7 @@ else fi export key state delimiter value exact_delimiter -awk_bin=$(PATH=$(getconf PATH 2>/dev/null) && command -v awk || echo awk) - -"${awk_bin}" -f - "$file" <<"AWK_EOF" +awk -f - "$file" <<"AWK_EOF" BEGIN { state=ENVIRON["state"] key=ENVIRON["key"] diff --git a/cdist/conf/type/__key_value/files/remote_script.sh b/cdist/conf/type/__key_value/files/remote_script.sh index faf080cb..f7a1add5 100644 --- a/cdist/conf/type/__key_value/files/remote_script.sh +++ b/cdist/conf/type/__key_value/files/remote_script.sh @@ -24,10 +24,7 @@ if [ -f "$file" ]; then else touch "$file" fi - -awk_bin=$(PATH=$(getconf PATH 2>/dev/null) && command -v awk || echo awk) - -"${awk_bin}" -f - "$file" >"$tmpfile" <<"AWK_EOF" +awk -f - "$file" >"$tmpfile" <<"AWK_EOF" BEGIN { # import variables in a secure way .. state=ENVIRON["state"] diff --git a/cdist/conf/type/__key_value/gencode-remote b/cdist/conf/type/__key_value/gencode-remote index 1174400e..13cc27c7 100755 --- a/cdist/conf/type/__key_value/gencode-remote +++ b/cdist/conf/type/__key_value/gencode-remote @@ -25,7 +25,7 @@ state_should="$(cat "$__object/parameter/state")" state_is="$(cat "$__object/explorer/state")" fire_onchange='' -if [ "$state_is" = "$state_should" ]; then +if [ "$state_is" = "$state_should" ]; then exit 0 fi diff --git a/cdist/conf/type/__letsencrypt_cert/explorer/certbot-path b/cdist/conf/type/__letsencrypt_cert/explorer/certbot-path new file mode 100755 index 00000000..3c6076df --- /dev/null +++ b/cdist/conf/type/__letsencrypt_cert/explorer/certbot-path @@ -0,0 +1,3 @@ +#!/bin/sh -e + +command -v certbot 2>/dev/null || true diff --git a/cdist/conf/type/__letsencrypt_cert/explorer/certificate-data b/cdist/conf/type/__letsencrypt_cert/explorer/certificate-data deleted file mode 100755 index ff62e742..00000000 --- a/cdist/conf/type/__letsencrypt_cert/explorer/certificate-data +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/sh -e -certbot_path="$(command -v certbot 2>/dev/null || true)" -# Defaults -certificate_exists="no" -certificate_is_test="no" - -if [ -n "${certbot_path}" ]; then - # Find python executable that has access to certbot's module - python_path=$(sed -n '1s/^#! *//p' "${certbot_path}") - - # Use a lock for cdist due to certbot not exiting with failure - # or having any flags for concurrent use. - _certbot() { - ${python_path} - 2>/dev/null <> /dev/stderr - exit 1 - ;; - esac - - hook_contents_tail="$(cat < "${existing_domains}" - certificate_is_test="$(_explorer_var certificate_is_test)" + existing_domains="${__object}/explorer/certificate-domains" + certificate_is_test=$(cat "${__object}/explorer/certificate-is-test") sort -uo "${requested_domains}" "${requested_domains}" sort -uo "${existing_domains}" "${existing_domains}" diff --git a/cdist/conf/type/__letsencrypt_cert/man.rst b/cdist/conf/type/__letsencrypt_cert/man.rst index 43be8424..c4ffc6bc 100644 --- a/cdist/conf/type/__letsencrypt_cert/man.rst +++ b/cdist/conf/type/__letsencrypt_cert/man.rst @@ -1,33 +1,16 @@ cdist-type__letsencrypt_cert(7) =============================== - NAME ---- cdist-type__letsencrypt_cert - Get an SSL certificate from Let's Encrypt - DESCRIPTION ----------- Automatically obtain a Let's Encrypt SSL certificate using Certbot. -This type attempts to setup automatic renewals always. In many Linux -distributions, that is the case out of the box, see: -https://certbot.eff.org/docs/using.html#automated-renewals - -For Alpine Linux and Arch Linux, we setup a system-wide cronjob that -attempts to renew certificates daily. - -If you are using FreeBSD, we configure periodic(8) as recommended by -the port mantainer, so there will be a weekly attempt at renewal. - -If your OS is not mentioned here or on Certbot's docs as having -support for automated renewals, please make sure you check your OS -and possibly patch this type so the system-wide cronjob is installed. - - REQUIRED PARAMETERS ------------------- @@ -38,7 +21,6 @@ object id admin-email Where to send Let's Encrypt emails like "certificate needs renewal". - OPTIONAL PARAMETERS ------------------- @@ -54,80 +36,36 @@ webroot The path to your webroot, as set up in your webserver config. If this parameter is not present, Certbot will be run in standalone mode. - OPTIONAL MULTIPLE PARAMETERS ---------------------------- +renew-hook + Renew hook command directly passed to Certbot in cron job. + domain Domains to be included in the certificate. When specified then object id is not used as a domain. -deploy-hook - Command to be executed only when the certificate associated with this - ``$__object_id`` is issued or renewed. - You can specify it multiple times, but any failure will prevent further - commands from being executed. - - For this command, the - shell variable ``$RENEWED_LINEAGE`` will point to the - config live subdirectory (for example, - ``/etc/letsencrypt/live/${__object_id}``) containing the - new certificates and keys; the shell variable - ``$RENEWED_DOMAINS`` will contain a space-delimited list - of renewed certificate domains (for example, - ``example.com www.example.com``) - -pre-hook - Command to be run in a shell before obtaining any - certificates. - You can specify it multiple times, but any failure will prevent further - commands from being executed. - - Note these run regardless of which certificate is attempted, you may want to - manage these system-wide hooks with ``__file`` in - ``/etc/letsencrypt/renewal-hooks/pre/``. - - Intended primarily for renewal, where it - can be used to temporarily shut down a webserver that - might conflict with the standalone plugin. This will - only be called if a certificate is actually to be - obtained/renewed. - -post-hook - Command to be run in a shell after attempting to - obtain/renew certificates. - You can specify it multiple times, but any failure will prevent further - commands from being executed. - - Note these run regardless of which certificate was attempted, you may want to - manage these system-wide hooks with ``__file`` in - ``/etc/letsencrypt/renewal-hooks/post/``. - - Can be used to deploy - renewed certificates, or to restart any servers that - were stopped by --pre-hook. This is only run if an - attempt was made to obtain/renew a certificate. - - BOOLEAN PARAMETERS ------------------ +automatic-renewal + Install a cron job, which attempts to renew certificates daily. + staging Obtain a test certificate from a staging server. - MESSAGES -------- change - Certificate was changed. + Certificte was changed. create - Certificate was created. + Certificte was created. remove - Certificate was removed. - + Certificte was removed. EXAMPLES -------- @@ -137,7 +75,8 @@ EXAMPLES # use object id as domain __letsencrypt_cert example.com \ --admin-email root@example.com \ - --deploy-hook "service nginx reload" \ + --automatic-renewal \ + --renew-hook "service nginx reload" \ --webroot /data/letsencrypt/root .. code-block:: sh @@ -146,10 +85,11 @@ EXAMPLES # and example.com needs to be included again with domain parameter __letsencrypt_cert example.com \ --admin-email root@example.com \ + --automatic-renewal \ --domain example.com \ --domain foo.example.com \ --domain bar.example.com \ - --deploy-hook "service nginx reload" \ + --renew-hook "service nginx reload" \ --webroot /data/letsencrypt/root AUTHORS @@ -159,13 +99,11 @@ AUTHORS | Kamila Součková | Darko Poljak | Ľubomír Kučera -| Evilham - COPYING ------- -Copyright \(C) 2017-2021 Nico Schottelius, Kamila Součková, Darko Poljak and +Copyright \(C) 2017-2018 Nico Schottelius, Kamila Součková, Darko Poljak and Ľubomír Kučera. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. diff --git a/cdist/conf/type/__letsencrypt_cert/manifest b/cdist/conf/type/__letsencrypt_cert/manifest old mode 100644 new mode 100755 index 39067f3b..bc039e44 --- a/cdist/conf/type/__letsencrypt_cert/manifest +++ b/cdist/conf/type/__letsencrypt_cert/manifest @@ -1,20 +1,15 @@ #!/bin/sh -certbot_fullpath="$(grep "^certbot_path:" "${__object:?}/explorer/certificate-data" | cut -d ':' -f 2-)" -state=$(cat "${__object}/parameter/state") -os="$(cat "${__global:?}/explorer/os")" +certbot_fullpath="$(cat "${__object:?}/explorer/certbot-path")" if [ -z "${certbot_fullpath}" ]; then + os="$(cat "${__global:?}/explorer/os")" os_version="$(cat "${__global}/explorer/os_version")" - # Use this, very common value, as a default. It is OS-dependent - certbot_fullpath="/usr/bin/certbot" + case "$os" in - archlinux) - __package certbot - ;; - alpine) - __package certbot - ;; + archlinux) + __package certbot + ;; debian) case "$os_version" in 8*) @@ -41,7 +36,7 @@ if [ -z "${certbot_fullpath}" ]; then require="__apt_source/stretch-backports" __package_apt certbot \ --target-release stretch-backports ;; - 10*|11*) + 10*) __package_apt certbot ;; @@ -50,7 +45,9 @@ if [ -z "${certbot_fullpath}" ]; then exit 1 ;; esac - ;; + + certbot_fullpath=/usr/bin/certbot + ;; devuan) case "$os_version" in jessie) @@ -83,13 +80,13 @@ if [ -z "${certbot_fullpath}" ]; then exit 1 ;; esac + + certbot_fullpath=/usr/bin/certbot ;; freebsd) - __package py39-certbot - certbot_fullpath="/usr/local/bin/certbot" - ;; - ubuntu) - __package certbot + __package py27-certbot + + certbot_fullpath=/usr/local/bin/certbot ;; *) echo "Unsupported os: $os" >&2 @@ -98,61 +95,18 @@ if [ -z "${certbot_fullpath}" ]; then esac fi -# Other OS-dependent values that we want to set every time -LE_DIR="/etc/letsencrypt" -certbot_cronjob_state="absent" -case "$os" in - archlinux|alpine) - certbot_cronjob_state="present" - ;; - freebsd) - LE_DIR="/usr/local/etc/letsencrypt" - # FreeBSD uses periodic(8) instead of crontabs for this - __line "periodic.conf_weekly_certbot" \ - --file "/etc/periodic.conf" \ - --regex "^(#[[:space:]]*)?weekly_certbot_enable=.*" \ - --state "replace" \ - --line 'weekly_certbot_enable="YES"' - ;; - *) - ;; -esac +if [ -f "${__object}/parameter/automatic-renewal" ]; then + renew_hook_param="${__object}/parameter/renew-hook" + renew_hook="" + if [ -f "${renew_hook_param}" ]; then + while read -r hook; do + renew_hook="${renew_hook} --renew-hook \"${hook}\"" + done < "${renew_hook_param}" + fi -# This is only necessary in certain OS -__cron letsencrypt-certbot \ - --user root \ - --command "${certbot_fullpath} renew -q" \ - --hour 0 \ - --minute 47 \ - --state "${certbot_cronjob_state}" - -# Ensure hook directories -HOOKS_DIR="${LE_DIR}/renewal-hooks" -__directory "${LE_DIR}" --mode 0755 -require="__directory/${LE_DIR}" __directory "${HOOKS_DIR}" --mode 0755 - -if [ -f "${__object}/parameter/domain" ]; then - domains="$(sort "${__object}/parameter/domain")" -else - domains="${__object_id}" + __cron letsencrypt-certbot \ + --user root \ + --command "${certbot_fullpath} renew -q ${renew_hook}" \ + --hour 0 \ + --minute 47 fi - -# Install hooks as needed -for hook in deploy pre post; do - # Using something unique and specific to this object - hook_file="${HOOKS_DIR}/${hook}/${__object_id}.cdist.sh" - - # This defines hook_contents - # shellcheck source=cdist/conf/type/__letsencrypt_cert/files/gen_hook.sh - . "${__type}/files/gen_hook.sh" - - # Ensure hook directory exists - require="__directory/${HOOKS_DIR}" __directory "${HOOKS_DIR}/${hook}" \ - --mode 0755 - require="__directory/${HOOKS_DIR}/${hook}" __file "${hook_file}" \ - --mode 0555 \ - --source '-' \ - --state "${hook_state}" <. # -if [ -f "$__object/parameter/file" ]; then - file=$(cat "$__object/parameter/file") -else - file="/$__object_id" -fi - -[ -f "$file" ] || exit 0 - if [ -f "$__object/parameter/before" ]; then position="before" elif [ -f "$__object/parameter/after" ]; then @@ -42,66 +33,63 @@ else needle="line" fi +if [ -f "$__object/parameter/file" ]; then + file="$(cat "$__object/parameter/file")" +else + file="/$__object_id" +fi + +if [ ! -f "$file" ]; then + echo "file_missing" + exit 0 +fi + awk -v position="$position" -v needle="$needle" ' function _find(_text, _pattern) { if (needle == "regex") { return match(_text, _pattern) } else { - return index(_text, _pattern) == 1 + return index(_text, _pattern) } } BEGIN { getline anchor < (ENVIRON["__object"] "/parameter/" position) getline pattern < (ENVIRON["__object"] "/parameter/" needle) - getline line < (ENVIRON["__object"] "/parameter/line") - - found_line = 0 - correct_line = 0 - correct_pos = (position != "after" && position != "before") + state = "absent" } { if (position == "after") { if (match($0, anchor)) { getline if (_find($0, pattern)) { - found_line++ - if (index($0, line) == 1) { correct_line++ } - correct_pos = 1 - exit 0 + state = "present" } - } else if (_find($0, pattern)) { - found_line++ - if (index($0, line) == 1) { correct_line++ } + else { + state = "wrongposition" + } + exit 0 } - } else if (position == "before") { + } + else if (position == "before") { if (_find($0, pattern)) { - found_line++ - if (index($0, line) == 1) { correct_line++ } getline if (match($0, anchor)) { - correct_pos = 1 - exit 0 + state = "present" } + else { + state = "wrongposition" + } + exit 0 } - } else { + } + else { if (_find($0, pattern)) { - found_line++ - if (index($0, line) == 1) { correct_line++ } + state = "present" exit 0 } } } END { - if (found_line && correct_pos) { - if (correct_line) { - print "present" - } else { - print "matching" - } - } else if (found_line) { - print "wrongposition" - } else { - print "absent" - } + print state } ' "$file" diff --git a/cdist/conf/type/__line/gencode-remote b/cdist/conf/type/__line/gencode-remote index a89886da..03e90c1b 100755 --- a/cdist/conf/type/__line/gencode-remote +++ b/cdist/conf/type/__line/gencode-remote @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2018 Steven Armstrong (steven-cdist at armstrong.cc) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -24,25 +23,10 @@ if [ -f "$__object/parameter/before" ] && [ -f "$__object/parameter/after" ]; th exit 1 fi -if [ -f "$__object/parameter/file" ]; then - file="$(cat "$__object/parameter/file")" -else - file="/$__object_id" -fi - state_should="$(cat "$__object/parameter/state")" state_is="$(cat "$__object/explorer/state")" -if [ -z "$state_is" ]; then - printf 'The file "%s" is missing. Please create it before using %s on it.\n' "$file" "${__type##*/}" >&2 - exit 1 -fi - -if [ "$state_should" = "$state_is" ] || \ - { [ "$state_should" = "present" ] && [ "$state_is" = "matching" ] ;} || \ - { [ "$state_should" = "replace" ] && [ "$state_is" = "present" ] ;} ; then - # If state matches already, or 'present' is used and regex matches - # or 'replace' is used and the exact line is present, then there is +if [ "$state_should" = "$state_is" ]; then # nothing to do exit 0 fi @@ -62,11 +46,17 @@ else needle="line" fi +if [ -f "$__object/parameter/file" ]; then + file="$(cat "$__object/parameter/file")" +else + file="/$__object_id" +fi + add=0 remove=0 case "$state_should" in - present|replace) - if [ "$state_is" = "wrongposition" ] || [ "$state_is" = "matching" ]; then + present) + if [ "$state_is" = "wrongposition" ]; then echo updated >> "$__messages_out" remove=1 else @@ -114,12 +104,10 @@ BEGIN { if (anchor && match(\$0, anchor)) { if (position == "before") { print line - add = 0 print } else if (position == "after") { print print line - add = 0 } next } @@ -127,7 +115,7 @@ BEGIN { print } END { - if (add) { + if (add && position == "end") { print line } } diff --git a/cdist/conf/type/__line/man.rst b/cdist/conf/type/__line/man.rst index 70490f68..f76cab64 100644 --- a/cdist/conf/type/__line/man.rst +++ b/cdist/conf/type/__line/man.rst @@ -31,7 +31,7 @@ file line Specifies the line which should be absent or present. - Must be present, if state is 'present' or 'replace'. + Must be present, if state is 'present'. Ignored if regex is given and state is 'absent'. regex @@ -41,13 +41,10 @@ regex If state is 'absent', ensure all lines matching the regular expression are absent. - If state is 'replace', ensure all lines matching the regular expression - are exactly 'line'. - The regular expression is interpreted by awk's match function. state - 'present', 'absent' or 'replace', defaults to 'present'. + 'present' or 'absent', defaults to 'present' onchange The code to run if line is added, removed or updated. @@ -102,12 +99,6 @@ EXAMPLES --line '-session required pam_exec.so debug log=/tmp/classify.log /usr/local/libexec/classify' \ --after '^session[[:space:]]+include[[:space:]]+password-auth-ac$' - # Uncomment as needed and set a value in a configuration file. - __line /etc/example.conf \ - --line 'SomeSetting SomeValue' \ - --regex '^(#[[:space:]]*)?SomeSetting[[:space:]]' \ - --state replace - SEE ALSO -------- diff --git a/cdist/conf/type/__link/man.rst b/cdist/conf/type/__link/man.rst index 2e81aea9..fe0ce425 100644 --- a/cdist/conf/type/__link/man.rst +++ b/cdist/conf/type/__link/man.rst @@ -18,7 +18,7 @@ source Specifies the link source. type - Specifies the link type: Either hard or symbolic. + Specifies the link type: Either hard or symoblic. OPTIONAL PARAMETERS diff --git a/cdist/conf/type/__locale/deprecated b/cdist/conf/type/__locale/deprecated deleted file mode 100644 index 5a06b28e..00000000 --- a/cdist/conf/type/__locale/deprecated +++ /dev/null @@ -1 +0,0 @@ -This type is deprecated. Please use __localedef instead. diff --git a/cdist/conf/type/__locale/gencode-remote b/cdist/conf/type/__locale/gencode-remote index 4639cef8..1feb9884 100755 --- a/cdist/conf/type/__locale/gencode-remote +++ b/cdist/conf/type/__locale/gencode-remote @@ -23,15 +23,6 @@ locale="$__object_id" -state_is=$(cat "$__object/explorer/state") -state_should=$(cat "$__object/parameter/state") - -# short circuit if there is nothing to do -if [ "$state_is" = "$state_should" ]; then - exit 0 -fi - - # Hardcoded, create a pull request with # branching on $os in case it is at another location alias=/usr/share/locale/locale.alias @@ -44,6 +35,8 @@ charmap=$(echo "$locale" | cut -d . -f 2) # W-T-F! locale_remove=$(echo "$locale" | sed 's/UTF-8/utf8/') +state=$(cat "$__object/parameter/state") + os=$(cat "$__global/explorer/os") # Nothing to be done on alpine @@ -53,7 +46,7 @@ case "$os" in ;; esac -case "$state_should" in +case "$state" in present) echo localedef -A "$alias" -f "$charmap" -i "$input" "$locale" ;; @@ -61,7 +54,7 @@ case "$state_should" in echo localedef --delete-from-archive "$locale_remove" ;; *) - echo "Unsupported state: $state_should" >&2 + echo "Unsupported state: $state" >&2 exit 1 ;; esac diff --git a/cdist/conf/type/__locale_system/manifest b/cdist/conf/type/__locale_system/manifest index 4b996ebc..80f7401b 100755 --- a/cdist/conf/type/__locale_system/manifest +++ b/cdist/conf/type/__locale_system/manifest @@ -3,7 +3,6 @@ # 2012-2016 Steven Armstrong (steven-cdist at armstrong.cc) # 2016 Carlos Ortigoza (carlos.ortigoza at ungleich.ch) # 2016 Nico Schottelius (nico.schottelius at ungleich.ch) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -24,171 +23,17 @@ # Configure system-wide locale by modifying i18n file. # -version_ge() { - awk -F '[^0-9.]' -v target="${1:?}" ' - function max(x, y) { return x > y ? x : y } - BEGIN { - getline - nx = split($1, x, ".") - ny = split(target, y, ".") - for (i = 1; i <= max(nx, ny); ++i) { - diff = int(x[i]) - int(y[i]) - if (diff == 0) continue - exit (diff < 0) - } - }' -} - - -key=$__object_id -onchange_cmd= # none, by default -quote_value=false - -catval() { - # shellcheck disable=SC2059 - printf "$($quote_value && echo '"%s"' || echo '%s')" "$(cat "$1")" -} - -state_should=$(cat "${__object}/parameter/state") - os=$(cat "$__global/explorer/os") -case $os -in - debian) - if version_ge 4 <"${__global}/explorer/os_version" - then - # Debian 4 (etch) and later - locale_conf="/etc/default/locale" - else - locale_conf="/etc/environment" - fi - ;; - devuan) +case "$os" in + debian|ubuntu) locale_conf="/etc/default/locale" ;; - ubuntu) - if version_ge 6.10 <"${__global}/explorer/os_version" - then - # Ubuntu 6.10 (edgy) and later - locale_conf="/etc/default/locale" - else - locale_conf="/etc/environment" - fi - ;; archlinux) locale_conf="/etc/locale.conf" ;; - centos|redhat|scientific) - # shellcheck source=/dev/null - version_id=$(. "${__global}/explorer/os_release" && echo "${VERSION_ID:-0}") - if echo "${version_id}" | version_ge 7 - then - locale_conf="/etc/locale.conf" - else - locale_conf="/etc/sysconfig/i18n" - fi - ;; - fedora) - # shellcheck source=/dev/null - version_id=$(. "${__global}/explorer/os_release" && echo "${VERSION_ID:-0}") - if echo "${version_id}" | version_ge 18 - then - locale_conf="/etc/locale.conf" - quote_value=false - else - locale_conf="/etc/sysconfig/i18n" - fi - ;; - gentoo) - case $(cat "${__global}/explorer/init") - in - (*openrc*) - locale_conf="/etc/env.d/02locale" - onchange_cmd="env-update --no-ldconfig" - quote_value=true - ;; - (systemd) - locale_conf="/etc/locale.conf" - ;; - esac - ;; - freebsd|netbsd) - # NetBSD doesn't have a separate configuration file to set locales. - # In FreeBSD locales could be configured via /etc/login.conf but parsing - # that would be annoying, so the shell login file will have to do. - # "Non-POSIX" shells like csh will not be updated here. - - locale_conf="/etc/profile" - quote_value=true - value="$(catval "${__object}/parameter/value"); export ${key}" - ;; - solaris) - locale_conf="/etc/default/init" - locale_conf_group="sys" - - if version_ge 5.11 <"${__global}/explorer/os_version" - then - # mode on Oracle Solaris 11 is actually 0444, - # but the write bit makes sense, IMO - locale_conf_mode=0644 - - # Oracle Solaris 11.2 and later uses SMF to store environment info. - # This is a hack, but I didn't feel like modifying the whole type - # just for some Oracle nonsense. - # 11.3 apparently added nlsadm(1m), but it is missing from 11.2. - # Illumos continues to use /etc/default/init - # NOTE: Remember not to use "cool" POSIX features like -q or -e with - # Solaris grep. - release_regex='Oracle Solaris 11.[2-9][0-9]*' - case $state_should - in - (present) - svccfg_cmd="svccfg -s svc:/system/environment:init setprop environment/${key} = astring: '$(cat "${__object}/parameter/value")'" - ;; - (absent) - svccfg_cmd="svccfg -s svc:/system/environment:init delprop environment/${key}" - ;; - esac - refresh_cmd='svcadm refresh svc:/system/environment' - onchange_cmd="grep '${release_regex}' /etc/release >&- || exit 0; ${svccfg_cmd:-:} && ${refresh_cmd}" - else - locale_conf_mode=0555 - fi - ;; - slackware) - # NOTE: lang.csh (csh config) is ignored here. - locale_conf="/etc/profile.d/lang.sh" - locale_conf_mode=0755 - key="export ${__object_id}" - ;; - suse) - if test -s "${__global}/explorer/os_release" - then - # shellcheck source=/dev/null - os_version=$(. "${__global}/explorer/os_release" && echo "${VERSION}") - else - os_version=$(sed -n 's/^VERSION\ *=\ *//p' "${__global}/explorer/os_version") - fi - os_major=$(expr "${os_version}" : '\([0-9]\{1,\}\)') - - # https://documentation.suse.com/sles/15-SP2/html/SLES-all/cha-suse.html#sec-suse-l10n - if expr "${os_major}" '>=' 15 \& "${os_major}" != 42 - then - # It seems that starting with SuSE 15 the systemd /etc/locale.conf - # is the preferred way to set locales, although - # /etc/sysconfig/language is still available. - # Older documentation doesn't mention /etc/locale.conf, even though - # is it created when localectl is used. - locale_conf="/etc/locale.conf" - else - locale_conf="/etc/sysconfig/language" - quote_value=true - key="RC_${__object_id}" - fi - ;; - voidlinux) - locale_conf="/etc/locale.conf" + redhat|centos) + locale_conf="/etc/sysconfig/i18n" ;; *) echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2 @@ -197,16 +42,14 @@ in ;; esac -__file "${locale_conf}" --state exists \ - --owner "${locale_conf_owner:-0}" \ - --group "${locale_conf_group:-0}" \ - --mode "${locale_conf_mode:-0644}" +__file "$locale_conf" \ + --owner root --group root --mode 644 \ + --state exists -require="__file/${locale_conf}" \ -__key_value "${locale_conf}:${key#export }" \ - --file "${locale_conf}" \ - --key "${key}" \ - --delimiter '=' --exact_delimiter \ - --state "${state_should}" \ - --value "${value:-$(catval "${__object}/parameter/value")}" \ - --onchange "${onchange_cmd}" +require="__file/$locale_conf" \ + __key_value "$locale_conf:$__object_id" \ + --file "$locale_conf" \ + --key "$__object_id" \ + --delimiter = \ + --state "$(cat "$__object/parameter/state")" \ + --value "$(cat "$__object/parameter/value")" diff --git a/cdist/conf/type/__localedef/explorer/state b/cdist/conf/type/__localedef/explorer/state deleted file mode 100755 index 3ba57661..00000000 --- a/cdist/conf/type/__localedef/explorer/state +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# This explorer determines if the locale is defined on the target system. -# Will print nothing on error. -# -# Possible output: -# present: -# the main locale (and possibly aliases) is present -# absent: -# neither the main locale nor any aliases are present -# alias-present: -# the main locale is absent, but at least one of its aliases is present -# - -# Hardcoded, create a pull request in case it is at another location for -# some other distro. (cf. gencode-remote) -aliasfile='/usr/share/locale/locale.alias' - -command -v locale >/dev/null 2>&1 || exit 0 - -locales=$(locale -a) - -parse_locale() { - # This function will split locales into their parts. Locale strings are - # usually of the form: [language[_territory][.codeset][@modifier]] - # For simplicity, language and territory are not separated by this function. - # Old Linux systems were also using "english" or "german" as locale strings. - # Usage: parse_locale locale_str lang_var codeset_var modifier_var - eval "${2:?}"="$(expr "$1" : '\([^.@]*\)')" - eval "${3:?}"="$(expr "$1" : '[^.]*\.\([^@]*\)')" - eval "${4:?}"="$(expr "$1" : '.*@\(.*\)$')" -} - -format_locale() { - # Usage: format_locale language codeset modifier - printf '%s' "$1" - test -z "$2" || printf '.%s' "$2" - test -z "$3" || printf '@%s' "$3" - printf '\n' -} - -gnu_normalize_codeset() { - # reimplementation of glibc/locale/programs/localedef.c normalize_codeset() - echo "$*" | tr '[:upper:]' '[:lower:]' | tr -cd '[:alnum:]' -} - -locale_available() ( - echo "${locales}" | grep -qxF "$1" || { - # glibc uses "normalized" locale names in archives. - # If a locale is stored in an archive, the normalized name will be - # printed by locale, so that needs to be checked, too. - localename=$( - parse_locale "$1" _lang _codeset _modifier \ - && format_locale "${_lang:?}" "$(gnu_normalize_codeset "${_codeset?}")" \ - "${_modifier?}") - echo "${locales}" | grep -qxF "${localename}" - } -) - -if locale_available "${__object_id:?}" -then - echo present -else - # NOTE: locale.alias can be symlinked. - if test -e "${aliasfile}" - then - # Check if one of the aliases of the locale is defined - baselocale=$( - parse_locale "${__object_id:?}" _lang _codeset _modifiers \ - && format_locale "${_lang}" "${_codeset}") - while read -r _alias _localename - do - if test "${_localename}" = "${baselocale}" \ - && echo "${locales}" | grep -qxF "${_alias}" - then - echo alias-present - exit 0 - fi - done <"${aliasfile}" - fi - - echo absent -fi diff --git a/cdist/conf/type/__localedef/files/lib/glibc.sh b/cdist/conf/type/__localedef/files/lib/glibc.sh deleted file mode 100644 index 6ace80d4..00000000 --- a/cdist/conf/type/__localedef/files/lib/glibc.sh +++ /dev/null @@ -1,5 +0,0 @@ -# -*- mode: sh; indent-tabs-mode: t -*- - -gnu_normalize_codeset() { - echo "$*" | tr -cd '[:alnum:]' | tr '[:upper:]' '[:lower:]' -} diff --git a/cdist/conf/type/__localedef/files/lib/locale.sh b/cdist/conf/type/__localedef/files/lib/locale.sh deleted file mode 100644 index b5e61374..00000000 --- a/cdist/conf/type/__localedef/files/lib/locale.sh +++ /dev/null @@ -1,20 +0,0 @@ -# -*- mode: sh; indent-tabs-mode:t -*- - -parse_locale() { - # This function will split locales into their parts. Locale strings are - # usually of the form: [language[_territory][.codeset][@modifier]] - # For simplicity, language and territory are not separated by this function. - # Old Linux systems were also using "english" or "german" as locale strings. - # Usage: parse_locale locale_str lang_var codeset_var modifier_var - eval "${2:?}"="$(expr "$1" : '\([^.@]*\)')" - eval "${3:?}"="$(expr "$1" : '[^.]*\.\([^@]*\)')" - eval "${4:?}"="$(expr "$1" : '.*@\(.*\)$')" -} - -format_locale() { - # Usage: format_locale language codeset modifier - printf '%s' "$1" - test -z "$2" || printf '.%s' "$2" - test -z "$3" || printf '@%s' "$3" - printf '\n' -} diff --git a/cdist/conf/type/__localedef/gencode-remote b/cdist/conf/type/__localedef/gencode-remote deleted file mode 100755 index 4538151f..00000000 --- a/cdist/conf/type/__localedef/gencode-remote +++ /dev/null @@ -1,136 +0,0 @@ -#!/bin/sh -e -# -# 2013-2019 Nico Schottelius (nico-cdist at schottelius.org) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Manage system locales using localedef(1). -# - -# shellcheck source=cdist/conf/type/__localedef/files/lib/locale.sh -. "${__type:?}/files/lib/locale.sh" -# shellcheck source=cdist/conf/type/__localedef/files/lib/glibc.sh -. "${__type:?}/files/lib/glibc.sh" - -state_is=$(cat "${__object:?}/explorer/state") -state_should=$(cat "${__object:?}/parameter/state") - -test "${state_should}" = 'present' -o "${state_should}" = 'absent' || { - printf 'Invalid state: %s\n' "${state_should}" >&2 - exit 1 -} - -# NOTE: If state explorer fails (e.g. locale(1) missing), the following check -# will always fail and let definition/removal run. -if test "${state_is}" = "${state_should}" -then - exit 0 -fi - -locale=${__object_id:?} -os=$(cat "${__global:?}/explorer/os") - -if expr "${locale}" : '.*/' >/dev/null -then - printf 'Paths as locales are not supported.\n' >&2 - printf '__object_id is: %s\n' "${locale}" >&2 - exit 1 -fi - -: "${lang=}" "${codeset=}" "${modifier=}" # declare variables for shellcheck -parse_locale "${locale}" lang codeset modifier - - -case ${os} -in - (alpine|openwrt) - printf '%s does not support locales.\n' "${os}" >&2 - exit 1 - ;; - (archlinux|debian|devuan|ubuntu|suse|centos|fedora|redhat|scientific) - # FIXME: The code below only works for glibc-based installations. - - # NOTE: Hardcoded, create a pull request in case it is at another - # location for some opther distro. - # NOTE: locale.alias can be symlinked (e.g. Debian) - aliasfile='/usr/share/locale/locale.alias' - - case ${state_should} - in - (present) - input=$(format_locale "${lang}" '' "${modifier}") - cat <<-EOF - set -- - if test -e '${aliasfile}' - then - set -- -A '${aliasfile}' - fi - - localedef -i '${input}' -f '${codeset}' "\$@" '${locale}' - EOF - ;; - (absent) - main_localename=$(format_locale "${lang}" "$(gnu_normalize_codeset "${codeset}")" "${modifier}") - - cat <<-EOF - while read -r _alias _localename - do - if test "\${_localename}" = '$(format_locale "${lang}" "${codeset}")' - then - localedef --delete-from-archive "\${_alias}" - fi - done <'${aliasfile}' - EOF - - if test "${state_is}" = present - then - printf "localedef --delete-from-archive '%s'\n" "${main_localename}" - fi - ;; - esac - ;; - (freebsd) - case ${state_should} - in - (present) - if expr "$(grep -oe '^[0-9]*' "${__global:?}/explorer/os_version")" '>=' 11 >/dev/null - then - # localedef(1) is available with FreeBSD >= 11 - printf "localedef -i '%s' -f '%s' '%s'\n" "${input}" "${codeset}" "${locale}" - else - printf 'localedef(1) was added to FreeBSD starting with version 11.\n' >&2 - printf 'Please upgrade your FreeBSD installation to use %s.\n' "${__type##*/}" >&2 - exit 1 - fi - ;; - (absent) - printf "rm -R '/usr/share/locale/%s'\n" "${locale}" - ;; - esac - ;; - (netbsd|openbsd) - # NetBSD/OpenBSD are missing localedef(1). - # We also do not delete defined locales because they can't be recreated. - echo "${os} is lacking localedef(1). Locale management unavailable." >&2 - exit 1 - ;; - (*) - echo "Your operating system (${os}) is currently not supported by this type (${__type##*/})." >&2 - echo "Please contribute an implementation for it if you can." >&2 - exit 1 - ;; -esac diff --git a/cdist/conf/type/__localedef/man.rst b/cdist/conf/type/__localedef/man.rst deleted file mode 100644 index 454ce9d1..00000000 --- a/cdist/conf/type/__localedef/man.rst +++ /dev/null @@ -1,60 +0,0 @@ -cdist-type__localedef(7) -======================== - -NAME ----- -cdist-type__localedef - Define and remove system locales - - -DESCRIPTION ------------ -This cdist type allows you to define locales on the system using -:strong:`localedef`\ (1) or remove them. -On systems that don't support definition of new locales, the type will raise an -error. - -**NB:** This type respects the glibc ``locale.alias`` file, -i.e. it defines alias locales or deletes aliases of a locale when it is removed. -It is not possible, however, to use alias names to define locales or only remove -certain aliases of a locale. - - -OPTIONAL PARAMETERS -------------------- -state - ``present`` or ``absent``. Defaults to ``present``. - - -EXAMPLES --------- - -.. code-block:: sh - - # Add locale de_CH.UTF-8 - __localedef de_CH.UTF-8 - - # Same as above, but more explicit - __localedef de_CH.UTF-8 --state present - - # Remove colourful British English - __localedef en_GB.UTF-8 --state absent - - -SEE ALSO --------- -:strong:`locale`\ (1), -:strong:`localedef`\ (1), -:strong:`cdist-type__locale_system`\ (7) - - -AUTHORS -------- -| Dennis Camera -| Nico Schottelius - - -COPYING -------- -Copyright \(C) 2013-2019 Nico Schottelius, 2020 Dennis Camera. Free use of this -software is granted under the terms of the GNU General Public License version 3 -or later (GPLv3+). diff --git a/cdist/conf/type/__localedef/manifest b/cdist/conf/type/__localedef/manifest deleted file mode 100755 index 3ab3ad8c..00000000 --- a/cdist/conf/type/__localedef/manifest +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/sh -e -# -# 2013-2019 Nico Schottelius (nico-cdist at schottelius.org) -# 2015 David Hürlimann (david at ungleich.ch) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Install required packages. -# - -case $(cat "${__global:?}/explorer/os") -in - (debian|devuan) - __package_apt locales --state present - ;; -esac diff --git a/cdist/conf/type/__localedef/parameter/default/state b/cdist/conf/type/__localedef/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__localedef/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__localedef/parameter/optional b/cdist/conf/type/__localedef/parameter/optional deleted file mode 100644 index ff72b5c7..00000000 --- a/cdist/conf/type/__localedef/parameter/optional +++ /dev/null @@ -1 +0,0 @@ -state diff --git a/cdist/conf/type/__motd/gencode-remote b/cdist/conf/type/__motd/gencode-remote index cb7bfc84..bc842cc8 100755 --- a/cdist/conf/type/__motd/gencode-remote +++ b/cdist/conf/type/__motd/gencode-remote @@ -22,18 +22,14 @@ os=$(cat "$__global/explorer/os") case "$os" in - freebsd) - # FreeBSD only updates /etc/motd on boot, - # as seen in /etc/rc.d/motd - echo "uname -sri > /etc/motd" - echo "cat /etc/motd.template >> /etc/motd" - # FreeBSD 13 starts treating motd slightly different from previous - # versions this ensures hosts have the expected config. - echo "rm /etc/motd.template || true" - echo "service motd start" + debian|ubuntu|devuan) + + # Debian and Ubuntu need to be updated, + # as seen in /etc/init.d/bootlogs + echo "uname -snrvm > /var/run/motd" + echo "cat /etc/motd.tail >> /var/run/motd" ;; *) - # Other OS tend to treat /etc/motd statically exit 0 ;; esac diff --git a/cdist/conf/type/__motd/man.rst b/cdist/conf/type/__motd/man.rst index a567dc80..17369684 100644 --- a/cdist/conf/type/__motd/man.rst +++ b/cdist/conf/type/__motd/man.rst @@ -10,13 +10,6 @@ DESCRIPTION ----------- This cdist type allows you to easily setup /etc/motd. -.. note:: - In some OS, motd is a bit special, check `motd(5)`. - Currently Debian, Devuan, Ubuntu and FreeBSD are taken into account. - If your OS of choice does something besides /etc/motd, check the source - and contribute support for it. - Otherwise it will likely just work. - REQUIRED PARAMETERS ------------------- @@ -27,7 +20,6 @@ OPTIONAL PARAMETERS ------------------- source If supplied, copy this file from the host running cdist to the target. - If source is '-' (dash), take what was written to stdin as the file content. If not supplied, a default message will be placed onto the target. @@ -42,15 +34,6 @@ EXAMPLES # Supply source file from a different type __motd --source "$__type/files/my-motd" - # Supply source from stdin - __motd --source "-" < COPYING ------- -Copyright \(C) 2020 Nico Schottelius. You can redistribute it +Copyright \(C) 2011 Nico Schottelius. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. diff --git a/cdist/conf/type/__motd/manifest b/cdist/conf/type/__motd/manifest index b8f74ebf..cd741cf4 100755 --- a/cdist/conf/type/__motd/manifest +++ b/cdist/conf/type/__motd/manifest @@ -33,14 +33,10 @@ os=$(cat "$__global/explorer/os") case "$os" in - freebsd) - # FreeBSD uses motd.template to prepend system information on boot - # (this actually only applies starting with version 13, - # but we fix that for whatever version in gencode-remote) - destination=/etc/motd.template + debian|ubuntu|devuan) + destination=/etc/motd.tail ;; *) - # Most UNIX systems, including other Linux and OpenBSD just use /etc/motd destination=/etc/motd ;; esac diff --git a/cdist/conf/type/__mysql_database/gencode-remote b/cdist/conf/type/__mysql_database/gencode-remote index 1bdb2b11..23e51b05 100755 --- a/cdist/conf/type/__mysql_database/gencode-remote +++ b/cdist/conf/type/__mysql_database/gencode-remote @@ -1,6 +1,6 @@ #!/bin/sh -e # -# 2020 Ander Punnar (ander-at-kvlt-dot-ee) +# 2012 Benedikt Koeppel (code@benediktkoeppel.ch) # # This file is part of cdist. # @@ -17,30 +17,38 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # +# -state_is="$( cat "$__object/explorer/state" )" - -state_should="$( cat "$__object/parameter/state" )" - -if [ "$state_is" = "$state_should" ] -then - exit 0 +# if --database was specified +if [ -f "$__object/parameter/name" ]; then + database="$(cat "$__object/parameter/name")" +else # otherwise use the object id as database name + database="$__object_id" fi -if [ -f "$__object/parameter/name" ] -then - name="$( cat "$__object/parameter/name" )" -else - name="$__object_id" -fi +cat <<-EOFF +mysql -u root <<-EOF + CREATE DATABASE IF NOT EXISTS $database +EOF +EOFF -case "$state_should" in - present) - echo "mysql -e 'create database \`$name\`'" - echo "create database $name" >> "$__messages_out" - ;; - absent) - echo "mysql -e 'drop database \`$name\`'" - echo "drop database $name" >> "$__messages_out" - ;; -esac +# if --user was specified +if [ -f "$__object/parameter/user" ]; then + user="$(cat "$__object/parameter/user")" + + # if --password was specified + if [ -f "$__object/parameter/password" ]; then + password="$(cat "$__object/parameter/password")" + cat <<-EOFF + mysql -u root <<-EOF + GRANT ALL PRIVILEGES ON $database.* to '$user'@'localhost' IDENTIFIED BY '$password'; +EOF +EOFF + else + cat <<-EOFF + mysql -u root <<-EOF + GRANT ALL PRIVILEGES ON $database.* to '$user'@'localhost'; +EOF +EOFF + fi +fi diff --git a/cdist/conf/type/__mysql_database/man.rst b/cdist/conf/type/__mysql_database/man.rst index b3b56b5f..1e245a08 100644 --- a/cdist/conf/type/__mysql_database/man.rst +++ b/cdist/conf/type/__mysql_database/man.rst @@ -8,24 +8,24 @@ cdist-type__mysql_database - Manage a MySQL database DESCRIPTION ----------- +This cdist type allows you to install a MySQL database. -Create MySQL database and optionally user with all privileges. +REQUIRED PARAMETERS +------------------- +None. OPTIONAL PARAMETERS ------------------- name - Name of database. Defaults to object id. + The name of the database to install + defaults to the object id user - Create user and give all privileges to database. + A user that should have access to the database password - Password for user. - -state - Defaults to present. - If absent and user is also set, both will be removed (with privileges). + The password for the user who manages the database EXAMPLES @@ -33,23 +33,17 @@ EXAMPLES .. code-block:: sh - # just create database - __mysql_database foo - - # create database with respective user with all privileges to database - __mysql_database bar \ - --user name \ - --password secret + __mysql_database "cdist" --name "cdist" --user "myuser" --password "mypwd" AUTHORS ------- -Ander Punnar +Benedikt Koeppel COPYING ------- -Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it -under the terms of the GNU General Public License as published by the Free -Software Foundation, either version 3 of the License, or (at your option) any -later version. +Copyright \(C) 2012 Benedikt Koeppel. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__mysql_database/manifest b/cdist/conf/type/__mysql_database/manifest deleted file mode 100755 index a3c9ed5d..00000000 --- a/cdist/conf/type/__mysql_database/manifest +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/sh -e -# -# 2020 Ander Punnar (ander-at-kvlt-dot-ee) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -if [ -f "$__object/parameter/user" ] -then - user="$( cat "$__object/parameter/user" )" -fi - -if [ -f "$__object/parameter/password" ] -then - password="$( cat "$__object/parameter/password" )" -fi - -if [ -n "$user" ] && [ -n "$password" ] -then - if [ -f "$__object/parameter/name" ] - then - database="$( cat "$__object/parameter/name" )" - else - database="$__object_id" - fi - - state_should="$( cat "$__object/parameter/state" )" - - __mysql_user "$user" \ - --password "$password" \ - --state "$state_should" - - # removing user should remove all user's privileges - require="__mysql_user/$user" \ - __mysql_privileges "$database/$user" \ - --database "$database" \ - --user "$user" \ - --state "$state_should" -fi diff --git a/cdist/conf/type/__mysql_database/parameter/default/state b/cdist/conf/type/__mysql_database/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__mysql_database/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__mysql_database/parameter/optional b/cdist/conf/type/__mysql_database/parameter/optional index 6c0b1e85..756afee7 100644 --- a/cdist/conf/type/__mysql_database/parameter/optional +++ b/cdist/conf/type/__mysql_database/parameter/optional @@ -1,4 +1,3 @@ name user password -state diff --git a/cdist/conf/type/__mysql_privileges/gencode-remote b/cdist/conf/type/__mysql_privileges/gencode-remote deleted file mode 100755 index 0656699f..00000000 --- a/cdist/conf/type/__mysql_privileges/gencode-remote +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/sh -e -# -# 2020 Ander Punnar (ander-at-kvlt-dot-ee) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -state_is="$( cat "$__object/explorer/state" )" - -state_should="$( cat "$__object/parameter/state" )" - -if [ "$state_is" = "$state_should" ] -then - exit 0 -fi - -privileges="$( cat "$__object/parameter/privileges" )" - -database="$( cat "$__object/parameter/database" )" - -table="$( cat "$__object/parameter/table" )" - -user="$( cat "$__object/parameter/user" )" - -host="$( cat "$__object/parameter/host" )" - -if [ "$table" != '*' ] -then - # shellcheck disable=SC2016 - table="$( printf '`%s`' "$table" )" -fi - -case "$state_should" in - present) - echo "mysql -e 'grant $privileges on \`$database\`.$table to \`$user\`@\`$host\`'" - echo "grant $privileges on $database.$table to $user@$host" >> "$__messages_out" - ;; - absent) - echo "mysql -e 'revoke $privileges on \`$database\`.$table from \`$user\`@\`$host\`'" - echo "revoke $privileges on $database.$table from $user@$host" >> "$__messages_out" - ;; -esac diff --git a/cdist/conf/type/__mysql_privileges/man.rst b/cdist/conf/type/__mysql_privileges/man.rst deleted file mode 100644 index b72c9eba..00000000 --- a/cdist/conf/type/__mysql_privileges/man.rst +++ /dev/null @@ -1,57 +0,0 @@ -cdist-type__mysql_privileges(7) -=============================== - -NAME ----- -cdist-type__mysql_privileges - Manage MySQL privileges - - -DESCRIPTION ------------ - -Grant and revoke privileges of MySQL user. - - -REQUIRED PARAMETERS -------------------- -database - Name of database. - -user - Name of user. - - -OPTIONAL PARAMETERS -------------------- -privileges - Defaults to "all". - -table - Defaults to "*". - -host - Defaults to localhost. - -state - "present" grants and "absent" revokes. Defaults to present. - - -EXAMPLES --------- - -.. code-block:: sh - - __mysql_privileges user-to-db --database db --user user - - -AUTHORS -------- -Ander Punnar - - -COPYING -------- -Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it -under the terms of the GNU General Public License as published by the Free -Software Foundation, either version 3 of the License, or (at your option) any -later version. diff --git a/cdist/conf/type/__mysql_privileges/parameter/default/host b/cdist/conf/type/__mysql_privileges/parameter/default/host deleted file mode 100644 index 2fbb50c4..00000000 --- a/cdist/conf/type/__mysql_privileges/parameter/default/host +++ /dev/null @@ -1 +0,0 @@ -localhost diff --git a/cdist/conf/type/__mysql_privileges/parameter/default/privileges b/cdist/conf/type/__mysql_privileges/parameter/default/privileges deleted file mode 100644 index 5472efad..00000000 --- a/cdist/conf/type/__mysql_privileges/parameter/default/privileges +++ /dev/null @@ -1 +0,0 @@ -all privileges diff --git a/cdist/conf/type/__mysql_privileges/parameter/default/state b/cdist/conf/type/__mysql_privileges/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__mysql_privileges/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__mysql_privileges/parameter/default/table b/cdist/conf/type/__mysql_privileges/parameter/default/table deleted file mode 100644 index 72e8ffc0..00000000 --- a/cdist/conf/type/__mysql_privileges/parameter/default/table +++ /dev/null @@ -1 +0,0 @@ -* diff --git a/cdist/conf/type/__mysql_privileges/parameter/optional b/cdist/conf/type/__mysql_privileges/parameter/optional deleted file mode 100644 index d4ed5bc5..00000000 --- a/cdist/conf/type/__mysql_privileges/parameter/optional +++ /dev/null @@ -1,4 +0,0 @@ -privileges -table -host -state diff --git a/cdist/conf/type/__mysql_privileges/parameter/required b/cdist/conf/type/__mysql_privileges/parameter/required deleted file mode 100644 index 152b4a1e..00000000 --- a/cdist/conf/type/__mysql_privileges/parameter/required +++ /dev/null @@ -1,2 +0,0 @@ -database -user diff --git a/cdist/conf/type/__mysql_user/explorer/state b/cdist/conf/type/__mysql_user/explorer/state deleted file mode 100755 index 6817ee9d..00000000 --- a/cdist/conf/type/__mysql_user/explorer/state +++ /dev/null @@ -1,54 +0,0 @@ -#!/bin/sh -e -# -# 2020 Ander Punnar (ander-at-kvlt-dot-ee) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -if [ -f "$__object/parameter/name" ] -then - name="$( cat "$__object/parameter/name" )" -else - name="$__object_id" -fi - -if [ -f "$__object/parameter/password" ] -then - password="$( cat "$__object/parameter/password" )" -else - password='' -fi - -host="$( cat "$__object/parameter/host" )" - -check_user="$( mysql -B -N -e "select user from mysql.user where user = '$name' and host = '$host'" )" - -if [ -n "$check_user" ] -then - if [ -n "$password" ] - then - check_password="$( mysql -B -N -e "select user from mysql.user where user = '$name' and host = '$host' and password = password( '$password' )" )" - fi - - if [ -n "$password" ] && [ -z "$check_password" ] - then - echo 'change-password' - else - echo 'present' - fi -else - echo 'absent' -fi diff --git a/cdist/conf/type/__mysql_user/gencode-remote b/cdist/conf/type/__mysql_user/gencode-remote deleted file mode 100755 index 5f13bc87..00000000 --- a/cdist/conf/type/__mysql_user/gencode-remote +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/sh -e -# -# 2020 Ander Punnar (ander-at-kvlt-dot-ee) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -state_is="$( cat "$__object/explorer/state" )" - -state_should="$( cat "$__object/parameter/state" )" - -if [ "$state_is" = "$state_should" ] -then - exit 0 -fi - -if [ -f "$__object/parameter/name" ] -then - name="$( cat "$__object/parameter/name" )" -else - name="$__object_id" -fi - -host="$( cat "$__object/parameter/host" )" - -if [ -f "$__object/parameter/password" ] -then - password="$( cat "$__object/parameter/password" )" -else - if [ "$state_should" = 'present' ] - then - echo '--password needed' >&2 - exit 1 - else - password='' - fi -fi - -if [ "$state_is" = 'absent' ] && [ "$state_should" = 'present' ] -then - echo "mysql -e 'create user \`$name\`@\`$host\` identified by \"$password\"'" - echo "create user $name@$host" >> "$__messages_out" - -elif [ "$state_is" != 'absent' ] && [ "$state_should" = 'absent' ] -then - echo "mysql -e 'drop user \`$name\`@\`$host\`'" - echo "drop user $name@$host" >> "$__messages_out" - -elif [ "$state_is" = 'change-password' ] -then - # this only works with MySQL 5.7.6 and later or MariaDB 10.1.20 and later - echo "mysql -e 'alter user \`$name\`@\`$host\` identified by \"$password\"'" - echo "mysql -e 'flush privileges'" - echo "change password $name@$host" >> "$__messages_out" -fi diff --git a/cdist/conf/type/__mysql_user/man.rst b/cdist/conf/type/__mysql_user/man.rst deleted file mode 100644 index c2b222d5..00000000 --- a/cdist/conf/type/__mysql_user/man.rst +++ /dev/null @@ -1,48 +0,0 @@ -cdist-type__mysql_user(7) -========================= - -NAME ----- -cdist-type__mysql_user - Manage a MySQL user - - -DESCRIPTION ------------ - -Create MySQL user or change password for the user. - - -OPTIONAL PARAMETERS -------------------- -name - Name of user. Defaults to object id. - -host - Host of user. Defaults to localhost. - -password - Password of user. - -state - Defaults to present. - - -EXAMPLES --------- - -.. code-block:: sh - - __mysql_user user --password secret - - -AUTHORS -------- -Ander Punnar - - -COPYING -------- -Copyright \(C) 2020 Ander Punnar. You can redistribute it and/or modify it -under the terms of the GNU General Public License as published by the Free -Software Foundation, either version 3 of the License, or (at your option) any -later version. diff --git a/cdist/conf/type/__mysql_user/parameter/default/host b/cdist/conf/type/__mysql_user/parameter/default/host deleted file mode 100644 index 2fbb50c4..00000000 --- a/cdist/conf/type/__mysql_user/parameter/default/host +++ /dev/null @@ -1 +0,0 @@ -localhost diff --git a/cdist/conf/type/__mysql_user/parameter/default/state b/cdist/conf/type/__mysql_user/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__mysql_user/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__mysql_user/parameter/optional b/cdist/conf/type/__mysql_user/parameter/optional deleted file mode 100644 index a286266c..00000000 --- a/cdist/conf/type/__mysql_user/parameter/optional +++ /dev/null @@ -1,4 +0,0 @@ -name -host -password -state diff --git a/cdist/conf/type/__openldap_server/gencode-remote b/cdist/conf/type/__openldap_server/gencode-remote deleted file mode 100644 index b1e98f8c..00000000 --- a/cdist/conf/type/__openldap_server/gencode-remote +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/sh - -manager_dn=$(cat "${__object}/parameter/manager-dn") -manager_password=$(cat "${__object}/parameter/manager-password") -description=$(cat "${__object}/parameter/description") -suffix=$(cat "${__object}/parameter/suffix") -suffix_dc=$(printf "%s" "${suffix}" | awk -F',' '{print $1}' | awk -F'=' '{print $2}') - -SLAPD_IPC=$(tr '\n' ' ' < "${__object}/parameter/slapd-url" | awk '{ print $1}') - -cat <&1 > /dev/null; then - # Already exists, use ldapmodify - ldapmodify -xZ -D "${manager_dn}" -w "${manager_password}" -H '${SLAPD_IPC}' < -Evilham - - -COPYING -------- -Copyright \(C) 2020 ungleich glarus ag. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__openldap_server/manifest b/cdist/conf/type/__openldap_server/manifest deleted file mode 100644 index 2aeece26..00000000 --- a/cdist/conf/type/__openldap_server/manifest +++ /dev/null @@ -1,297 +0,0 @@ -#!/bin/sh - -name="${__target_host}" -manager_dn=$(cat "${__object}/parameter/manager-dn") -manager_password_hash=$(cat "${__object}/parameter/manager-password-hash") -serverid=$(cat "${__object}/parameter/serverid") -suffix=$(cat "${__object}/parameter/suffix") -slapd_modules=$(cat "${__object}/parameter/module" 2>/dev/null || true) -schemas=$(cat "${__object}/parameter/schema") -slapd_urls=$(tr '\n' ' ' < "${__object}/parameter/slapd-url") -tls_cipher_suite=$(cat "${__object}/parameter/tls-cipher-suite" 2>/dev/null || true) -extra_config=$(cat "${__object}/parameter/extra-config" || true) - - -os="$(cat "${__global}/explorer/os")" - -# Setup OS-dependent vars -CONF_OWNER="root" -CONF_GROUP="root" -case "${os}" in - freebsd) - PKGS="openldap-server" - ETC="/usr/local/etc" - SLAPD_DIR="/usr/local/etc/openldap" - SLAPD_DATA_DIR="/var/db/openldap-data" - SLAPD_RUN_DIR="/var/run/openldap" - SLAPD_MODULE_PATH="/usr/local/libexec/openldap" - SLAPD_MODULE_TYPE="la" - if [ -z "${slapd_modules}" ]; then - # It looks like ppolicy and syncprov must be compiled - slapd_modules="back_mdb back_monitor" - fi - CONF_OWNER="ldap" - CONF_GROUP="ldap" - if [ -z "${tls_cipher_suite}" ]; then - # TODO: research default for FreeBSD. 'NORMAL' appears to not work - tls_cipher_suite="HIGH:MEDIUM:+SSLv2" - fi - ;; - debian|ubuntu|devuan) - PKGS="slapd ldap-utils" - ETC="/etc" - SLAPD_DIR="/etc/ldap" - SLAPD_DATA_DIR="/var/lib/ldap" - SLAPD_RUN_DIR="/var/run/slapd" - SLAPD_MODULE_PATH="/usr/lib/ldap" - SLAPD_MODULE_TYPE="la" - if [ -z "${slapd_modules}" ]; then - slapd_modules="back_mdb ppolicy syncprov back_monitor" - fi - CONF_OWNER="openldap" - CONF_GROUP="openldap" - if [ -z "${tls_cipher_suite}" ]; then - tls_cipher_suite="NORMAL" - fi - ;; - alpine) - PKGS="openldap openldap-clients" - ETC="/etc" - SLAPD_DIR="/etc/openldap" - SLAPD_DATA_DIR="/var/lib/openldap" - SLAPD_RUN_DIR="/var/run/openldap" - SLAPD_MODULE_PATH="/usr/lib/openldap" - SLAPD_MODULE_TYPE="so" - if [ -z "${slapd_modules}" ]; then - slapd_modules="back_mdb ppolicy syncprov back_monitor" - PKGS="$PKGS openldap-back-mdb openldap-back-monitor openldap-overlay-all" - fi - CONF_OWNER="ldap" - CONF_GROUP="$SLAPD_USER" - if [ -z "${tls_cipher_suite}" ]; then - tls_cipher_suite="DEFAULT" - fi - ;; - *) - echo "Don't know the openldap defaults for: $os" >&2 - exit 1 - ;; -esac - -PKG_MAIN=$(echo "${PKGS}" | awk '{print $1;}') - - -# Determine if __letsencrypt_cert is to be used and setup vars accordingly -if [ -f "${__object}/parameter/tls-cert" ]; then - tls_cert=$(cat "${__object}/parameter/tls-cert") - - if [ ! -f "${__object}/parameter/tls-privkey" ]; then - echo "When tls-cert is defined, tls-privkey is also required." >&2 - exit 1 - fi - tls_privkey=$(cat "${__object}/parameter/tls-privkey") - - if [ ! -f "${__object}/parameter/tls-ca" ]; then - echo "When tls-cert is defined, tls-ca is also required." >&2 - exit 1 - fi - tls_ca=$(cat "${__object}/parameter/tls-ca") - - _skip_letsencrypt_cert="YES" -else - if [ ! -f "${__object}/parameter/admin-email" ]; then - echo "When using __letsencrypt_cert, admin-email is also required." >&2 - exit 1 - fi - admin_email=$(cat "${__object}/parameter/admin-email") - - tls_cert="${SLAPD_DIR}/sasl2/cert.pem" - tls_privkey="${SLAPD_DIR}/sasl2/privkey.pem" - tls_ca="${SLAPD_DIR}/sasl2/chain.pem" -fi - -mkdir "${__object}/files" -ldapconf="${__object}/files/ldapconf" - -replication="" -if [ -f "${__object}/parameter/replicate" ]; then - replication=yes - - if [ ! -f "${__object}/parameter/syncrepl-searchbase" ]; then - echo "Requiring the searchbase for replication" >&2 - exit 1 - fi - syncrepl_searchbase=$(cat "${__object}/parameter/syncrepl-searchbase") - - if [ ! -f "${__object}/parameter/syncrepl-credentials" ]; then - echo "Requiring credentials for replication" >&2 - exit 1 - fi - - syncrepl_credentials=$(cat "${__object}/parameter/syncrepl-credentials") - - if [ ! -f "${__object}/parameter/syncrepl-host" ]; then - echo "Requiring host(s) for replication" >&2 - exit 1 - fi - syncrepl_hosts=$(cat "${__object}/parameter/syncrepl-host") - -fi - -# Install required packages -for pkg in ${PKGS}; do - __package "${pkg}" -done - - -require="__package/${PKG_MAIN}" __start_on_boot slapd - -# Setup -h flag for the listeners. See man slapd (-h flag). -case "${os}" in - freebsd) - require="__start_on_boot/slapd" __key_value \ - --file "/etc/rc.conf" \ - --key "slapd_flags" \ - --value "\"-h '${slapd_urls}'\"" \ - --delimiter "=" \ - --comment "# LDAP Listener URLs" \ - "${__target_host}__slapd_flags" - ;; - debian|ubuntu|devuan) - require="__package/${PKG_MAIN}" __line rm_slapd_conf \ - --file ${ETC}/default/slapd \ - --regex 'SLAPD_CONF=.*' \ - --state absent - - require="__package/${PKG_MAIN}" __line rm_slapd_services \ - --file ${ETC}/default/slapd \ - --regex 'SLAPD_SERVICES=.*' \ - --state absent - - require="__line/rm_slapd_conf" __line add_slapd_conf \ - --file ${ETC}/default/slapd \ - --line "SLAPD_CONF=${SLAPD_DIR}/slapd.conf" \ - --state present - - require="__line/rm_slapd_services" __line add_slapd_services \ - --file ${ETC}/default/slapd \ - --line "SLAPD_SERVICES=\"${slapd_urls}\"" \ - --state present - ;; - alpine) - require="__package/${PKG_MAIN}" __line add_slapd_services \ - --file ${ETC}/conf.d/slapd \ - --line "command_args=\"-h '${slapd_urls}'\"" \ - --state present - ;; - *) - # Nothing to do here, move on. - ;; -esac - - -if [ -z "${_skip_letsencrypt_cert}" ]; then - if [ -f "${__object}/parameter/staging" ]; then - staging="--staging" - else - staging="" - fi - - # shellcheck disable=SC2086 - __directory ${SLAPD_DIR}/sasl2 - require="__directory/${SLAPD_DIR}/sasl2" __letsencrypt_cert "${name}" \ - --admin-email "${admin_email}" \ - --renew-hook "cp ${ETC}/letsencrypt/live/${name}/*.pem ${SLAPD_DIR}/sasl2 && chown -R ${CONF_OWNER}:${CONF_GROUP} ${SLAPD_DIR}/sasl2 && service slapd restart" \ - --automatic-renewal "${staging}" -fi - -require="__package/${PKG_MAIN}" __directory ${SLAPD_DIR}/slapd.d --state absent - -if [ -z "${_skip_letsencrypt_cert}" ]; then - require="__package/${PKG_MAIN} __letsencrypt_cert/${name}" \ - __file "${SLAPD_DIR}/slapd.conf" --owner "${CONF_OWNER}" --group "${CONF_GROUP}" --mode 644 \ - --source "${ldapconf}" -else - require="__package/${PKG_MAIN}" \ - __file "${SLAPD_DIR}/slapd.conf" --owner "${CONF_OWNER}" --group "${CONF_GROUP}" --mode 644 \ - --source "${ldapconf}" -fi - -# Start slapd.conf -cat << EOF > "${ldapconf}" -pidfile ${SLAPD_RUN_DIR}/slapd.pid -argsfile ${SLAPD_RUN_DIR}/slapd.args - -TLSCipherSuite ${tls_cipher_suite} -TLSCertificateFile ${tls_cert} -TLSCertificateKeyFile ${tls_privkey} -TLSCACertificateFile ${tls_ca} - -disallow bind_anon -require bind -security tls=1 -EOF - -# Add specified schemas -for schema in ${schemas}; do - echo "include ${SLAPD_DIR}/schema/${schema}.schema" >> "${ldapconf}" -done - -# Add specified modules -echo "modulepath ${SLAPD_MODULE_PATH}" >> "${ldapconf}" -for module in ${slapd_modules}; do - echo "moduleload ${module}.${SLAPD_MODULE_TYPE}" >> "${ldapconf}" -done - -# Rest of the config -cat << EOF >> "${ldapconf}" -loglevel 1024 - -database mdb -maxsize 1073741824 - -suffix "${suffix}" -directory ${SLAPD_DATA_DIR} -rootdn "${manager_dn}" -rootpw "${manager_password_hash}" - -index objectClass eq,pres -index ou,cn,mail,surname,givenname eq,pres,sub -index uidNumber,gidNumber,loginShell eq,pres -index uid,memberUid eq,pres,sub -index nisMapName,nisMapEntry eq,pres,sub -index entryCSN,entryUUID eq - -${extra_config} - -serverid ${serverid} -EOF - -# Setup replication -if [ "${replication}" ]; then - rid=1; - for syncrepl in ${syncrepl_hosts}; do - cat <> "${ldapconf}" -syncrepl rid=${rid} - provider=ldap://${syncrepl} - bindmethod=simple - starttls=yes - binddn="${manager_dn}" - credentials=${syncrepl_credentials} - searchbase="${syncrepl_searchbase}" - type=refreshAndPersist - retry="5 + 5 +" - interval=00:00:00:05 -EOF - rid=$((rid + 1)) - done - cat <> "${ldapconf}" -mirrormode true -overlay syncprov -syncprov-checkpoint 100 5 -syncprov-sessionlog 100 - -database monitor -limits dn.exact="${manager_dn}" time=unlimited size=unlimited -EOF -fi diff --git a/cdist/conf/type/__openldap_server/parameter/boolean b/cdist/conf/type/__openldap_server/parameter/boolean deleted file mode 100644 index 45056fe9..00000000 --- a/cdist/conf/type/__openldap_server/parameter/boolean +++ /dev/null @@ -1,2 +0,0 @@ -staging -replicate diff --git a/cdist/conf/type/__openldap_server/parameter/default/description b/cdist/conf/type/__openldap_server/parameter/default/description deleted file mode 100644 index 6d8e37e1..00000000 --- a/cdist/conf/type/__openldap_server/parameter/default/description +++ /dev/null @@ -1 +0,0 @@ -Managed by cdist, do not edit manually. diff --git a/cdist/conf/type/__openldap_server/parameter/default/schema b/cdist/conf/type/__openldap_server/parameter/default/schema deleted file mode 100644 index 825bdb15..00000000 --- a/cdist/conf/type/__openldap_server/parameter/default/schema +++ /dev/null @@ -1,12 +0,0 @@ -corba -core -cosine -duaconf -dyngroup -inetorgperson -java -misc -nis -openldap -ppolicy -collective diff --git a/cdist/conf/type/__openldap_server/parameter/optional b/cdist/conf/type/__openldap_server/parameter/optional deleted file mode 100644 index 71c64659..00000000 --- a/cdist/conf/type/__openldap_server/parameter/optional +++ /dev/null @@ -1,9 +0,0 @@ -description -syncrepl-credentials -syncrepl-searchbase -admin-email -tls-cipher-suite -tls-cert -tls-privkey -tls-ca -extra-config diff --git a/cdist/conf/type/__openldap_server/parameter/optional_multiple b/cdist/conf/type/__openldap_server/parameter/optional_multiple deleted file mode 100644 index 52a83d5c..00000000 --- a/cdist/conf/type/__openldap_server/parameter/optional_multiple +++ /dev/null @@ -1,3 +0,0 @@ -syncrepl-host -module -schema diff --git a/cdist/conf/type/__openldap_server/parameter/required b/cdist/conf/type/__openldap_server/parameter/required deleted file mode 100644 index ff58158d..00000000 --- a/cdist/conf/type/__openldap_server/parameter/required +++ /dev/null @@ -1,5 +0,0 @@ -manager-dn -manager-password -manager-password-hash -serverid -suffix diff --git a/cdist/conf/type/__openldap_server/parameter/required_multiple b/cdist/conf/type/__openldap_server/parameter/required_multiple deleted file mode 100644 index 848b8dc2..00000000 --- a/cdist/conf/type/__openldap_server/parameter/required_multiple +++ /dev/null @@ -1 +0,0 @@ -slapd-url \ No newline at end of file diff --git a/cdist/conf/type/__openldap_server/singleton b/cdist/conf/type/__openldap_server/singleton deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__package_apt/gencode-remote b/cdist/conf/type/__package_apt/gencode-remote index 79c0d9d3..699eb0c9 100755 --- a/cdist/conf/type/__package_apt/gencode-remote +++ b/cdist/conf/type/__package_apt/gencode-remote @@ -42,13 +42,6 @@ else target_release="" fi -if [ -f "$__object/parameter/install-recommends" ]; then - # required if __apt_norecommends is used - recommendsparam="-o APT::Install-Recommends=1" -else - recommendsparam="-o APT::Install-Recommends=0" -fi - if [ -f "$__object/parameter/purge-if-absent" ]; then purgeparam="--purge" else @@ -69,42 +62,22 @@ case "$state_is" in ;; esac +# Hint if we need to avoid questions at some point: +# DEBIAN_PRIORITY=critical can reduce the number of questions +aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\"" + if [ "$state_is" = "$state_should" ]; then if [ -z "$version" ] || [ "$version" = "$version_is" ]; then exit 0; fi fi -# Hint if we need to avoid questions at some point: -# DEBIAN_PRIORITY=critical can reduce the number of questions -aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\"" - case "$state_should" in present) - # There are special arguments to apt(8) to prevent aborts if apt woudn't been - # updated after the 19th April 2021 till the bullseye release. The additional - # arguments acknoledge the happend suite change (the apt(8) update does the - # same by itself). - # - # Using '-o $config' instead of the --allow-releaseinfo-change-* parameter - # allows backward compatablility to pre-buster Debian versions. - # - # See more: ticket #861 - # https://code.ungleich.ch/ungleich-public/cdist/-/issues/861 - apt_opts="-o Acquire::AllowReleaseInfoChange::Suite=true -o Acquire::AllowReleaseInfoChange::Version=true" - - # following is bit ugly, but important hack. - # due to how cdist config run works, there isn't - # currently better way to do it :( - cat << EOF -if [ ! -f /var/cache/apt/pkgcache.bin ] || [ "\$( stat --format %Y /var/cache/apt/pkgcache.bin )" -lt "\$( date +%s -d '-1 day' )" ] -then echo apt-get $apt_opts update > /dev/null 2>&1 || true -fi -EOF if [ -n "$version" ]; then name="${name}=${version}" fi - echo "$aptget $recommendsparam install $target_release '$name'" + echo "$aptget install $target_release '$name'" echo "installed" >> "$__messages_out" ;; absent) diff --git a/cdist/conf/type/__package_apt/man.rst b/cdist/conf/type/__package_apt/man.rst index 4e6101a5..a3a70d91 100644 --- a/cdist/conf/type/__package_apt/man.rst +++ b/cdist/conf/type/__package_apt/man.rst @@ -9,12 +9,7 @@ cdist-type__package_apt - Manage packages with apt-get DESCRIPTION ----------- apt-get is usually used on Debian and variants (like Ubuntu) to -manage packages. The package will be installed without recommended -or suggested packages. If such packages are required, install them -separatly or use the parameter ``--install-recommends``. - -This type will also update package index, if it is older -than one day, to avoid missing package error messages. +manage packages. REQUIRED PARAMETERS @@ -25,7 +20,7 @@ None OPTIONAL PARAMETERS ------------------- name - If supplied, use the name and not the object id as the package name. + If supplied, use the name and not the object id as the package name. state Either "present" or "absent", defaults to "present" @@ -41,15 +36,6 @@ version BOOLEAN PARAMETERS ------------------ -install-recommends - If the package will be installed, it also installs recommended packages - with it. It will not install recommended packages if the original package - is already installed. - - In most cases, it is recommended to install recommended packages separatly - to control which additional packages will be installed to avoid useless - installed packages. - purge-if-absent If this parameter is given when state is `absent`, the package is purged from the system (using `--purge`). diff --git a/cdist/conf/type/__package_apt/parameter/boolean b/cdist/conf/type/__package_apt/parameter/boolean index a2e433f3..f9a0f6b0 100644 --- a/cdist/conf/type/__package_apt/parameter/boolean +++ b/cdist/conf/type/__package_apt/parameter/boolean @@ -1,2 +1 @@ -install-recommends purge-if-absent diff --git a/cdist/conf/type/__package_luarocks/manifest b/cdist/conf/type/__package_luarocks/manifest index 9e4499b2..7d8262ca 100755 --- a/cdist/conf/type/__package_luarocks/manifest +++ b/cdist/conf/type/__package_luarocks/manifest @@ -19,5 +19,5 @@ # along with cdist. If not, see . # -__package luarocks --state present -__package make --state present +__package luarocks --state installed +__package make --state installed diff --git a/cdist/conf/type/__package_opkg/explorer/pkg_status b/cdist/conf/type/__package_opkg/explorer/pkg_status index de7b896b..5da4f742 100755 --- a/cdist/conf/type/__package_opkg/explorer/pkg_status +++ b/cdist/conf/type/__package_opkg/explorer/pkg_status @@ -1,8 +1,7 @@ -#!/bin/sh -e +#!/bin/sh # # 2011 Nico Schottelius (nico-cdist at schottelius.org) # 2012 Giel van Schijndel (giel plus cdist at mortis dot eu) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -20,78 +19,21 @@ # along with cdist. If not, see . # # -# Retrieve the status of a package - parses opkg output +# Retrieve the status of a package - parsed opkg output # -readonly __type_path=${__object%%${__object_id}*} -test -d "${__type_path}" || { echo 'Cannot determine __type_path' >&2; exit 1; } -readonly LOCKFILE="${__type_path:?}/.cdist_opkg.lock" - -if command -v flock >/dev/null 2>&1 -then - # use flock (if available) on FD 9 - _lock() { - exec 9<>"${LOCKFILE:?}" - flock -x 9 - echo $$>&9 - } - _unlock() { - :>"${LOCKFILE:?}" - flock -u 9 - exec 9<&- - } +if [ -f "$__object/parameter/name" ]; then + name="$(cat "$__object/parameter/name")" else - # fallback to mkdir if flock is missing - _lock() { - until mkdir "${LOCKFILE:?}.dir" 2>/dev/null - do - while test -d "${LOCKFILE}.dir" - do - # DEBUG: - # printf 'Locked by PID: %u\n' "$(cat "${LOCKFILE}.dir/pid")" - sleep 1 - done - done - echo $$ >"${LOCKFILE:?}.dir/pid" - } - _unlock() { - test -d "${LOCKFILE}.dir" || return 0 - if test -s "${LOCKFILE}.dir/pid" - then - test "$(cat "${LOCKFILE}.dir/pid")" = $$ || return 1 - rm "${LOCKFILE:?}.dir/pid" - fi - rmdir "${LOCKFILE:?}.dir" - } + name="$__object_id" fi - -if test -f "${__object}/parameter/name" -then - pkg_name=$(cat "${__object}/parameter/name") -else - pkg_name=$__object_id -fi - - -# NOTE: We need to lock parallel execution of type explorers and code-remote -# because opkg will try to acquire the OPKG lock (usually /var/lock/opkg.lock) -# using lockf(2) for every operation. -# It will not wait for the lock but terminate with an error. -# This leads to incorrect 'absent notpresent' statuses when parallel execution -# is enabled. -trap _unlock EXIT -_lock - - -# Except opkg failing, if package is not known / installed -if opkg status "${pkg_name}" 2>/dev/null \ - | grep -q -e '^Status: [^ ][^ ]* [^ ][^ ]* installed$' -then - echo 'present' -elif opkg info "${pkg_name}" 2>/dev/null | grep -q . -then - echo 'absent notpresent' -else - echo 'absent' +# Except dpkg failing, if package is not known / installed +if opkg status "$name" 2>/dev/null | grep -q "^Status: install user installed$"; then + echo "present" + exit 0 +elif [ "$(opkg info "$name" 2> /dev/null | wc -l)" -eq 0 ]; then + echo "absent notpresent" + exit 0 fi +echo "absent" diff --git a/cdist/conf/type/__package_opkg/gencode-remote b/cdist/conf/type/__package_opkg/gencode-remote index 28caff71..269d5f49 100755 --- a/cdist/conf/type/__package_opkg/gencode-remote +++ b/cdist/conf/type/__package_opkg/gencode-remote @@ -2,7 +2,6 @@ # # 2011,2013 Nico Schottelius (nico-cdist at schottelius.org) # 2012 Giel van Schijndel (giel plus cdist at mortis dot eu) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -20,50 +19,41 @@ # along with cdist. If not, see . # # -# Manage packages on OpenWrt, optware, and co. +# Manage packages on OpenWRT and co. # -if test -f "${__object}/parameter/name" -then - name=$(cat "${__object}/parameter/name") +if [ -f "$__object/parameter/name" ]; then + name="$(cat "$__object/parameter/name")" else - name=$__object_id + name="$__object_id" fi -state_should=$(cat "${__object}/parameter/state") -state_is=$(cat "${__object}/explorer/pkg_status") +state_should="$(cat "$__object/parameter/state")" -case $state_is -in - (absent*) - presence=$(echo "${state_is}" | cut -d ' ' -f 2) - state_is='absent' - ;; +state_is="$(cat "$__object/explorer/pkg_status")" +case "$state_is" in + absent*) + present="$(echo "$state_is" | cut -d ' ' -f 2)" + state_is="absent" + ;; esac -if test "${state_is}" = "${state_should}" -then - exit 0 -fi +[ "$state_is" = "$state_should" ] && exit 0 - -case $state_should -in - (present) - if test "${presence}" = 'notpresent' - then - echo 'opkg --verbosity=0 update' - fi - - printf "opkg --verbosity=0 install '%s'\n" "${name}" - echo 'installed' >>"${__messages_out}" - ;; - (absent) - printf "opkg --verbosity=0 remove '%s'" "${name}" - echo 'removed' >>"${__messages_out}" - ;; - (*) - printf 'Unknown state: %s\n' "${state_should}" >&2 - exit 1 - ;; +case "$state_should" in + present) + if [ "$present" = "notpresent" ]; then + echo "opkg --verbosity=0 update" + fi + echo "opkg --verbosity=0 install '$name'" + echo "installed" >> "$__messages_out" + ;; + absent) + echo "opkg --verbosity=0 remove '$name'" + echo "removed" >> "$__messages_out" + ;; + *) + echo "Unknown state: ${state_should}" >&2 + exit 1 + ;; esac diff --git a/cdist/conf/type/__package_pip/explorer/distinfo-dir b/cdist/conf/type/__package_pip/explorer/distinfo-dir deleted file mode 100755 index 18e169ae..00000000 --- a/cdist/conf/type/__package_pip/explorer/distinfo-dir +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/sh -# -# 2021 Matthias Stecher (matthiasstecher at gmx.de) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - - -nameparam="$__object/parameter/name" -if [ -f "$nameparam" ]; then - name=$(cat "$nameparam") -else - name="$__object_id" -fi - -pipparam="$__object/parameter/pip" -if [ -f "$pipparam" ]; then - pip=$(cat "$pipparam") -else - pip="$( "$__type_explorer/pip" )" -fi - - -if command -v "$pip" >/dev/null 2>&1; then - # assemble the path where pip stores all pip package info - "$pip" show "$name" \ - | awk -F': ' ' - $1 == "Name" {name=$2; gsub(/-/,"_",name); next} - $1 == "Version" {version=$2; next} - $1 == "Location" {location=$2; next} - END {if (version != "") printf "%s/%s-%s.dist-info", location, name, version}' -fi diff --git a/cdist/conf/type/__package_pip/explorer/extras b/cdist/conf/type/__package_pip/explorer/extras deleted file mode 100755 index bbdc17ab..00000000 --- a/cdist/conf/type/__package_pip/explorer/extras +++ /dev/null @@ -1,66 +0,0 @@ -#!/bin/sh -# -# 2021 Matthias Stecher (matthiasstecher at gmx.de) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# -# Checks if the given extras are really installed or not. It will be -# done by querring all dependencies for that extra and return it as -# "to be installed" if no dependency was found. -# - - -distinfo_dir="$("$__type_explorer/distinfo-dir")" - -# check if we have something to check -if [ "$distinfo_dir" ] && [ -s "$__object/parameter/extra" ] -then - # save cause freezing is slow - mkdir "$__object/files" - pip_freeze="$__object/files/pip-freeze.tmp" - pip3 freeze > "$pip_freeze" - - # If all is set, it searches all available extras to separatly check them. - # It would work with just 'all' (cause dependencies are specified for - # 'all'), but will not update if one extra is already present. Side effect - # is that it will not use [all] but instead name all extras seperatly. - for extra in $(if grep -qFx all "$__object/parameter/extra"; - then awk -F': ' '$1 == "Provides-Extra" && $2 != "all"{print $2}' "$distinfo_dir/METADATA"; - else tr ',' '\n' < "$__object/parameter/extra"; - fi) - do - # create a grep BRE pattern to search all packages - # maybe a file full of patterns for -F could be written - grep_pattern="$( - awk -F'(: | ; )' -v check="$extra" ' - $1 == "Requires-Dist" { - split($2, r, " "); - sub("extra == ", "", $3); gsub("'"'"'", "", $3); - if($3 == check) print r[1] - }' "$distinfo_dir/METADATA" \ - | sed ':a; $!N; s/\n/\\|/; ta' - )" - - # echo the extra if no packages where found for it - # if there is no pattern, we don't need to search ;-) - # pip matches packages case-insensetive, we need to do that, too - if [ "$grep_pattern" ] && ! grep -qi "$grep_pattern" "$pip_freeze" - then - echo "$extra" - fi - done -fi diff --git a/cdist/conf/type/__package_pip/explorer/pip b/cdist/conf/type/__package_pip/explorer/pip deleted file mode 100755 index cf9fae89..00000000 --- a/cdist/conf/type/__package_pip/explorer/pip +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/sh -e - -for bin in pip3 pip -do - if check="$( command -v "$bin" )" - then - echo "$check" - break - fi -done diff --git a/cdist/conf/type/__package_pip/explorer/state b/cdist/conf/type/__package_pip/explorer/state old mode 100755 new mode 100644 index 3cc98ab9..5be07280 --- a/cdist/conf/type/__package_pip/explorer/state +++ b/cdist/conf/type/__package_pip/explorer/state @@ -32,7 +32,7 @@ pipparam="$__object/parameter/pip" if [ -f "$pipparam" ]; then pip=$(cat "$pipparam") else - pip="$( "$__type_explorer/pip" )" + pip="pip" fi # If there is no pip, it may get created from somebody else. diff --git a/cdist/conf/type/__package_pip/gencode-remote b/cdist/conf/type/__package_pip/gencode-remote index 9abe28bf..dcc4fdf9 100755 --- a/cdist/conf/type/__package_pip/gencode-remote +++ b/cdist/conf/type/__package_pip/gencode-remote @@ -2,7 +2,6 @@ # # 2012 Nico Schottelius (nico-cdist at schottelius.org) # 2016 Darko Poljak (darko.poljak at gmail.com) -# 2021 Matthias Stecher (matthiasstecher at gmx.de) # # This file is part of cdist. # @@ -26,10 +25,7 @@ state_is=$(cat "$__object/explorer/state") state_should="$(cat "$__object/parameter/state")" -# short circuit if state is the same and no extras to install -[ "$state_is" = "$state_should" ] && ! [ -s "$__object/explorer/extras" ] \ - && exit 0 - +[ "$state_is" = "$state_should" ] && exit 0 nameparam="$__object/parameter/name" if [ -f "$nameparam" ]; then @@ -42,12 +38,7 @@ pipparam="$__object/parameter/pip" if [ -f "$pipparam" ]; then pip=$(cat "$pipparam") else - pip="$( cat "$__object/explorer/pip" )" - if [ -z "$pip" ] - then - echo 'pip not found in path' >&2 - exit 1 - fi + pip="pip" fi runasparam="$__object/parameter/runas" @@ -60,19 +51,11 @@ fi case "$state_should" in present) - if [ -s "$__object/explorer/extras" ] - then - # all extras are passed to pip in a comma-separated list in the name - # sed loops through all input lines and add commas between them - extras="$(sed ':a; $!N; s/\n/,/; ta' "$__object/explorer/extras")" - name="${name}[${extras}]" - fi - if [ "$runas" ] then echo "su -c '$pip install -q $name' $runas" else - echo "$pip" install -q "$name" + echo $pip install -q "$name" fi echo "installed" >> "$__messages_out" ;; @@ -81,7 +64,7 @@ case "$state_should" in then echo "su -c '$pip uninstall -q -y $name' $runas" else - echo "$pip" uninstall -q -y "$name" + echo $pip uninstall -q -y "$name" fi echo "removed" >> "$__messages_out" ;; diff --git a/cdist/conf/type/__package_pip/man.rst b/cdist/conf/type/__package_pip/man.rst index 5a2bc673..234ceee2 100644 --- a/cdist/conf/type/__package_pip/man.rst +++ b/cdist/conf/type/__package_pip/man.rst @@ -22,16 +22,6 @@ OPTIONAL PARAMETERS name If supplied, use the name and not the object id as the package name. -extra - Extra optional dependencies which should be installed along the selected - package. Can be specified multiple times. Multiple extras can be passed - in one `--extra` as a comma-separated list. - - Extra optional dependencies will be installed even when the base package - is already installed. Notice that the type will not remove installed extras - that are not explicitly named for the type because pip does not offer a - management for orphaned packages and they may be used by other packages. - pip Instead of using pip from PATH, use the specific pip path. @@ -56,14 +46,6 @@ EXAMPLES # Use pip in a virtualenv located at /foo/shinken_virtualenv as user foo __package_pip pyro --state present --pip /foo/shinken_virtualenv/bin/pip --runas foo - # Install package with optional dependencies - __package_pip mautrix-telegram --extra speedups --extra webp_convert --extra hq_thumbnails - # the extras can also be specified comma-separated - __package_pip mautrix-telegram --extra speedups,webp_convert,hq_thumbnails --extra postgres - - # or take all extras - __package_pip mautrix-telegram --extra all - SEE ALSO -------- @@ -72,13 +54,12 @@ SEE ALSO AUTHORS ------- -| Nico Schottelius -| Matthias Stecher +Nico Schottelius COPYING ------- -Copyright \(C) 2012 Nico Schottelius, 2021 Matthias Stecher. You can -redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either -version 3 of the License, or (at your option) any later version. +Copyright \(C) 2012 Nico Schottelius. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__package_pip/parameter/optional_multiple b/cdist/conf/type/__package_pip/parameter/optional_multiple deleted file mode 100644 index 0f228715..00000000 --- a/cdist/conf/type/__package_pip/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -extra diff --git a/cdist/conf/type/__package_pkg_freebsd/gencode-remote b/cdist/conf/type/__package_pkg_freebsd/gencode-remote index ca9aa45a..3f88f6bc 100755 --- a/cdist/conf/type/__package_pkg_freebsd/gencode-remote +++ b/cdist/conf/type/__package_pkg_freebsd/gencode-remote @@ -37,7 +37,6 @@ assert () # If condition false, then echo "Assertion failed: \"$1\"" # shellcheck disable=SC2039 - # shellcheck disable=SC3044 echo "File \"$0\", line $lineno, called by $(caller 0)" exit $E_ASSERT_FAILED fi diff --git a/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_bootstrapped b/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_bootstrapped deleted file mode 100755 index 429f15d3..00000000 --- a/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_bootstrapped +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -e -if pkg -N >/dev/null 2>&1; then - echo "YES" -fi diff --git a/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version b/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version index 1c6ba5e5..92ce0623 100755 --- a/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version +++ b/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version @@ -18,14 +18,9 @@ # along with cdist. If not, see . # # -# Retrieve the status of a package - parsed pkgng output +# Retrieve the status of a package - parsed dpkg output # -if ! pkg -N >/dev/null 2>&1; then - # Nothing to do if pkg is not bootstrapped - exit -fi - if [ -f "$__object/parameter/name" ]; then name="$(cat "$__object/parameter/name")" else diff --git a/cdist/conf/type/__package_pkgng_freebsd/gencode-remote b/cdist/conf/type/__package_pkgng_freebsd/gencode-remote index 05ba4cb2..dd36efda 100755 --- a/cdist/conf/type/__package_pkgng_freebsd/gencode-remote +++ b/cdist/conf/type/__package_pkgng_freebsd/gencode-remote @@ -43,7 +43,6 @@ fi repo="$(cat "$__object/parameter/repo")" state="$(cat "$__object/parameter/state")" curr_version="$(cat "$__object/explorer/pkg_version")" -pkg_bootstrapped="$(cat "$__object/explorer/pkg_bootstrapped")" add_cmd="pkg install -y" rm_cmd="pkg delete -y" upg_cmd="pkg upgrade -y" @@ -74,10 +73,6 @@ execcmd(){ ;; esac - if [ -z "${pkg_bootstrapped}" ]; then - echo "ASSUME_ALWAYS_YES=yes pkg bootstrap >/dev/null 2>&1" - fi - echo "$_cmd >/dev/null 2>&1" # Silence the output of the command echo "status=\$?" echo "if [ \"\$status\" -ne \"0\" ]; then" diff --git a/cdist/conf/type/__package_update_index/explorer/currage b/cdist/conf/type/__package_update_index/explorer/currage index 8eadaf53..3539b8e1 100644 --- a/cdist/conf/type/__package_update_index/explorer/currage +++ b/cdist/conf/type/__package_update_index/explorer/currage @@ -24,19 +24,16 @@ case "$type" in if [ -f "/var/cache/apt/pkgcache.bin" ]; then echo $(($(date +"%s")-$(stat --format '%Y' /var/cache/apt/pkgcache.bin))) else - echo -- -1 + echo 0 fi ;; pacman) if [ -d "/var/lib/pacman/sync" ]; then echo $(($(date +"%s")-$(stat --format '%Y' /var/lib/pacman/sync))) else - echo -- -1 + echo 0 fi ;; - alpine) - echo -- -1 - ;; *) echo "Your specified type ($type) is currently not supported." >&2 echo "Please contribute an implementation for it if you can." >&2 ;; diff --git a/cdist/conf/type/__package_update_index/explorer/type b/cdist/conf/type/__package_update_index/explorer/type index c98e1e67..35254c5f 100644 --- a/cdist/conf/type/__package_update_index/explorer/type +++ b/cdist/conf/type/__package_update_index/explorer/type @@ -26,7 +26,6 @@ else amazon|scientific|centos|fedora|redhat) echo "yum" ;; debian|ubuntu|devuan) echo "apt" ;; archlinux) echo "pacman" ;; - alpine) echo "apk" ;; *) echo "Don't know how to manage packages on: $os" >&2 exit 1 diff --git a/cdist/conf/type/__package_update_index/gencode-remote b/cdist/conf/type/__package_update_index/gencode-remote index a10c16d3..738d38eb 100755 --- a/cdist/conf/type/__package_update_index/gencode-remote +++ b/cdist/conf/type/__package_update_index/gencode-remote @@ -31,8 +31,7 @@ if [ -n "$maxage" ]; then if [ "$type" != "apt" ] && [ "$type" != "pacman" ]; then echo "ERROR: \"--maxage\" only supported for \"apt\" or \"pacman\" pkg-manager." >&2 exit 1 - # do not exit if no value found (represented as -1) - elif [ "$currage" -ne -1 ] && [ "$currage" -lt "$maxage" ]; then + elif [ "$currage" -lt "$maxage" ]; then exit 0 # no need to update fi fi @@ -41,29 +40,13 @@ fi case "$type" in yum) ;; apt) - # There are special arguments to apt(8) to prevent aborts if apt woudn't been - # updated after the 19th April 2021 till the bullseye release. The additional - # arguments acknoledge the happend suite change (the apt(8) update does the - # same by itself). - # - # Using '-o $config' instead of the --allow-releaseinfo-change-* parameter - # allows backward compatablility to pre-buster Debian versions. - # - # See more: ticket #861 - # https://code.ungleich.ch/ungleich-public/cdist/-/issues/861 - apt_opts="-o Acquire::AllowReleaseInfoChange::Suite=true -o Acquire::AllowReleaseInfoChange::Version=true" - - echo "apt-get --quiet $apt_opts update" + echo "apt-get --quiet update" echo "apt-cache updated (age was: $currage)" >> "$__messages_out" ;; pacman) echo "pacman --noprogressbar --sync --refresh" echo "pacman package database synced (age was: $currage)" >> "$__messages_out" ;; - apk) - echo "apk update" - echo "apk package database updated." >>"$__messages_out" - ;; *) echo "Don't know how to manage packages for type: $type" >&2 exit 1 diff --git a/cdist/conf/type/__package_upgrade_all/gencode-remote b/cdist/conf/type/__package_upgrade_all/gencode-remote index d332e851..38aa001e 100755 --- a/cdist/conf/type/__package_upgrade_all/gencode-remote +++ b/cdist/conf/type/__package_upgrade_all/gencode-remote @@ -28,10 +28,6 @@ apt_clean="$__object/parameter/apt-clean" apt_dist_upgrade="$__object/parameter/apt-dist-upgrade" -if [ -f "$__object/parameter/apt-with-new-pkgs" ]; then - apt_with_new_pkgs="--with-new-pkgs" -fi - if [ -f "$type" ]; then type="$(cat "$type")" else @@ -58,7 +54,7 @@ case "$type" in apt) if [ -f "$apt_dist_upgrade" ] then echo "$aptget dist-upgrade" - else echo "$aptget $apt_with_new_pkgs upgrade" + else echo "$aptget upgrade" fi if [ -f "$apt_clean" ] diff --git a/cdist/conf/type/__package_upgrade_all/man.rst b/cdist/conf/type/__package_upgrade_all/man.rst index 0c116bac..e9e2b8ce 100644 --- a/cdist/conf/type/__package_upgrade_all/man.rst +++ b/cdist/conf/type/__package_upgrade_all/man.rst @@ -33,14 +33,6 @@ BOOLEAN PARAMETERS apt-dist-upgrade Do dist-upgrade instead of upgrade. -apt-with-new-pkg - Allow installing new packages when used in conjunction with - upgrade. This is useful if the update of an installed package - requires new dependencies to be installed. Instead of holding the - package back upgrade will upgrade the package and install the new - dependencies. Note that upgrade with this option will never remove - packages, only allow adding new ones. - apt-clean Clean out the local repository of retrieved package files. diff --git a/cdist/conf/type/__package_upgrade_all/parameter/boolean b/cdist/conf/type/__package_upgrade_all/parameter/boolean index cd22eb90..7a56a34b 100644 --- a/cdist/conf/type/__package_upgrade_all/parameter/boolean +++ b/cdist/conf/type/__package_upgrade_all/parameter/boolean @@ -1,3 +1,2 @@ apt-clean apt-dist-upgrade -apt-with-new-pkgs diff --git a/cdist/conf/type/__hwclock/explorer/adjtime_mode b/cdist/conf/type/__pf_apply/explorer/rcvar similarity index 64% rename from cdist/conf/type/__hwclock/explorer/adjtime_mode rename to cdist/conf/type/__pf_apply/explorer/rcvar index 2b27bedc..7c8d535f 100755 --- a/cdist/conf/type/__hwclock/explorer/adjtime_mode +++ b/cdist/conf/type/__pf_apply/explorer/rcvar @@ -1,6 +1,6 @@ -#!/bin/sh -e +#!/bin/sh # -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) +# 2012 Jake Guffey (jake.guffey at eprotex.com) # # This file is part of cdist. # @@ -17,12 +17,20 @@ # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -# Prints the clock mode read from the /etc/adjtime file, if present. +# +# Get the location of the pf ruleset on the target host. # -# not all operating systems use an adjfile -test -f /etc/adjtime || exit 0 +# Debug +#exec >&2 +#set -x + +# Check /etc/rc.conf for pf's configuration file name. Default to /etc/pf.conf + +RC="/etc/rc.conf" +PFCONF="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')" +echo "${PFCONF:-"/etc/pf.conf"}" + +# Debug +#set +x -# 3rd line is clock mode -# adjtime(5) https://man7.org/linux/man-pages/man5/adjtime.5.html -sed -n 3p /etc/adjtime diff --git a/cdist/conf/type/__pf_apply/gencode-remote b/cdist/conf/type/__pf_apply/gencode-remote new file mode 100755 index 00000000..c8f7a25a --- /dev/null +++ b/cdist/conf/type/__pf_apply/gencode-remote @@ -0,0 +1,51 @@ +#!/bin/sh -e +# +# 2012 Jake Guffey (jake.guffey at eprotex.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# +# Apply pf(4) ruleset on *BSD +# + +# Debug +#exec >&2 +#set -x + +rcvar=$(cat "$__object/explorer/rcvar") + +cat <&2 + fi +fi +EOF + +# Debug +#set +x + diff --git a/cdist/conf/type/__pf_apply/man.rst b/cdist/conf/type/__pf_apply/man.rst new file mode 100644 index 00000000..eee345e7 --- /dev/null +++ b/cdist/conf/type/__pf_apply/man.rst @@ -0,0 +1,55 @@ +cdist-type__pf_apply(7) +======================= + +NAME +---- +cdist-type__pf_apply - Apply pf(4) ruleset on \*BSD + + +DESCRIPTION +----------- +This type is used on \*BSD systems to manage the pf firewall's active ruleset. + + +REQUIRED PARAMETERS +------------------- +NONE + + +OPTIONAL PARAMETERS +------------------- +NONE + + +EXAMPLES +-------- + +.. code-block:: sh + + # Modify the ruleset on $__target_host: + __pf_ruleset --state present --source /my/pf/ruleset.conf + require="__pf_ruleset" \ + __pf_apply + + # Remove the ruleset on $__target_host (implies disabling pf(4): + __pf_ruleset --state absent + require="__pf_ruleset" \ + __pf_apply + + +SEE ALSO +-------- +:strong:`pf`\ (4), :strong:`cdist-type__pf_ruleset`\ (7) + + +AUTHORS +------- +Jake Guffey + + +COPYING +------- +Copyright \(C) 2012 Jake Guffey. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__apt_backports/singleton b/cdist/conf/type/__pf_apply/singleton similarity index 100% rename from cdist/conf/type/__apt_backports/singleton rename to cdist/conf/type/__pf_apply/singleton diff --git a/cdist/conf/type/__pf_apply_anchor/gencode-remote b/cdist/conf/type/__pf_apply_anchor/gencode-remote deleted file mode 100755 index 36c26521..00000000 --- a/cdist/conf/type/__pf_apply_anchor/gencode-remote +++ /dev/null @@ -1,33 +0,0 @@ -#!/bin/sh -e -# -# 2016 Kamila Součková (coding at kamila.is) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# -# Apply pf(4) ruleset on *BSD -# - -ANCHORS_DIR="/etc/pf.d" - -if [ -f "${__object}/parameter/anchor_name" ]; then - anchor_name="$(cat "${__object}/parameter/anchor_name")" -else - anchor_name="${__object_id}" -fi -anchor_file="${ANCHORS_DIR}/${anchor_name}" - -echo "pfctl -a \"${anchor_name}\" -f \"${anchor_file}\"" diff --git a/cdist/conf/type/__pf_apply_anchor/man.rst b/cdist/conf/type/__pf_apply_anchor/man.rst deleted file mode 100644 index aef6cdf4..00000000 --- a/cdist/conf/type/__pf_apply_anchor/man.rst +++ /dev/null @@ -1,62 +0,0 @@ -cdist-type__pf_apply_anchor(7) -============================== - -NAME ----- -cdist-type__pf_apply_anchor - Apply a pf(4) anchor on $__target_host - - -DESCRIPTION ------------ -This type is used on \*BSD systems to manage anchors for the pf firewall. - -Notice this type does not take care of copying the ruleset, that must be -done by the user with, e.g. `__file`. - - -OPTIONAL PARAMETERS -------------------- -anchor_name - The name of the anchor to apply. If not set, `${__object_id}` is used. - This type requires `/etc/pf.d/${anchor_name}` to exist on - `$__target_host`. - - -EXAMPLES --------- - -.. code-block:: sh - - # Copy anchor file to ${__target_host} - __file "/etc/pf.d/80_dns" --source - < -Kamila Součková -Jake Guffey - - -COPYING -------- -Copyright \(C) 2020 Evilham. -Copyright \(C) 2016 Kamila Součková. -Copyright \(C) 2012 Jake Guffey. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__pf_apply_anchor/parameter/optional b/cdist/conf/type/__pf_apply_anchor/parameter/optional deleted file mode 100644 index b9f61e28..00000000 --- a/cdist/conf/type/__pf_apply_anchor/parameter/optional +++ /dev/null @@ -1 +0,0 @@ -anchor_name diff --git a/cdist/conf/type/__locale/explorer/state b/cdist/conf/type/__pf_ruleset/explorer/cksum similarity index 55% rename from cdist/conf/type/__locale/explorer/state rename to cdist/conf/type/__pf_ruleset/explorer/cksum index 4494fcbc..9be6c901 100755 --- a/cdist/conf/type/__locale/explorer/state +++ b/cdist/conf/type/__pf_ruleset/explorer/cksum @@ -1,7 +1,6 @@ -#!/bin/sh -e -# __locale/explorer/state +#!/bin/sh # -# 2020 Matthias Stecher (matthiasstecher at gmx.de) +# 2012 Jake Guffey (jake.guffey at eprotex.com) # # This file is part of cdist. # @@ -19,18 +18,24 @@ # along with cdist. If not, see . # # -# Check if the locale is already installed on the system. -# Outputs 'present' or 'absent' depending if the locale exists. +# Get the 256 bit SHA2 checksum of the pf ruleset on the target host. # +# Debug +#exec >&2 +#set -x -# Get user-defined locale -# locale name is echoed differently than the user propably set it (for UTF-8) -locale="$(echo "$__object_id" | sed 's/UTF-8/utf8/')" +# Check /etc/rc.conf for pf's configuration file name. Default to /etc/pf.conf +# See if file exists and if so, get checksum -# Check if the given locale exists on the system -if localedef --list-archive | grep -qFx "$locale"; then - echo present -else - echo absent +RC="/etc/rc.conf" +TMP="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')" +PFCONF="${TMP:-"/etc/pf.conf"}" + +if [ -f "${PFCONF}" ]; then # The pf config file exists, find its cksum. + cksum -o 1 "${PFCONF}" | cut -d= -f2 | awk '{print $1}' fi + +# Debug +#set +x + diff --git a/cdist/conf/type/__pf_ruleset/gencode-local b/cdist/conf/type/__pf_ruleset/gencode-local new file mode 100755 index 00000000..11bfb0b1 --- /dev/null +++ b/cdist/conf/type/__pf_ruleset/gencode-local @@ -0,0 +1,81 @@ +#!/bin/sh -e +# +# 2012 Jake Guffey (jake.guffey at eprotex.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# +# Manage pf(4) on *BSD +# + +# Debug +#exec >&2 +#set -x + +# Send files to $__target_host via $__remote_copy + +uname=$(uname) # Need to know what the cdist host is running so we know how to compute the ruleset's checksum +state=$(cat "$__object/parameter/state") + +if [ "$state" = "absent" ]; then # There is nothing more for a *local* script to do + exit 0 +fi + +if [ -f "$__object/parameter/source" ]; then + source=$(cat "$__object/parameter/source") +fi + +rcvar=$(cat "$__object/explorer/rcvar") +cksum=$(cat "$__object/explorer/cksum") + + +cat <&2 + exit 1 + ;; +esac + +# IPv6 fix +if $(echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$') +then + my_target_host="[${__target_host}]" +else + my_target_host="${__target_host}" +fi + +if [ -n "${cksum}" ]; then + if [ ! "\${currentSum}" = "${cksum}" ]; then + $__remote_copy "${source}" "\${my_target_host}:${rcvar}.new" + fi +else # File just doesn't exist yet + $__remote_copy "${source}" "\${my_target_host}:${rcvar}.new" +fi +EOF + +# Debug +#exec +x + diff --git a/cdist/conf/type/__pf_ruleset/manifest b/cdist/conf/type/__pf_ruleset/gencode-remote similarity index 51% rename from cdist/conf/type/__pf_ruleset/manifest rename to cdist/conf/type/__pf_ruleset/gencode-remote index 27b35328..12760fdf 100755 --- a/cdist/conf/type/__pf_ruleset/manifest +++ b/cdist/conf/type/__pf_ruleset/gencode-remote @@ -1,6 +1,6 @@ #!/bin/sh -e # -# 2016 Kamila Součková (coding at kamila.is) +# 2012 Jake Guffey (jake.guffey at eprotex.com) # # This file is part of cdist. # @@ -21,26 +21,29 @@ # Manage pf(4) on *BSD # -rcvar="$(cat "${__object}/explorer/rcvar")" -state="$(cat "${__object}/parameter/state")" -if [ -f "${__object}/parameter/source" ]; then - source="$(cat "${__object}/parameter/source")" -fi +# Debug +#exec >&2 +#set -x -if [ "${state}" = "absent" ]; then - action="/etc/rc.d/pf stop" +# Remove ${rcvar} in the case of --state absent + +state=$(cat "$__object/parameter/state") +rcvar=$(cat "$__object/explorer/rcvar") + +if [ "$state" = "present" ]; then # There is nothing more for a *remote* script to do + exit 0 +elif [ "$state" = "absent" ]; then + # --state absent, so ensure that .new doesn't exist and that conf is renamed to .old + cat <&2 + exit 1 fi -__key_value __pf_ruleset/rcvar \ - --state "${state}" \ - --file /etc/rc.conf \ - --delimiter "=" \ - --key "pf_enable" \ - --value "YES" - -require="__key_value/__pf_ruleset/rcvar" __config_file "${rcvar}" \ - --source "${source}" \ - --state "${state}" \ - --onchange "${action}" diff --git a/cdist/conf/type/__pf_ruleset/man.rst b/cdist/conf/type/__pf_ruleset/man.rst index db8873ac..5719e94e 100644 --- a/cdist/conf/type/__pf_ruleset/man.rst +++ b/cdist/conf/type/__pf_ruleset/man.rst @@ -10,9 +10,6 @@ DESCRIPTION ----------- This type is used on \*BSD systems to manage the pf firewall's ruleset. -It will also enable and disable the pf firewall as requested in the `state` -parameter. - REQUIRED PARAMETERS ------------------- @@ -23,8 +20,9 @@ state OPTIONAL PARAMETERS ------------------- source - Required when state is "present". - Defines the ruleset to load onto the $__target_host for `pf(4)`. + If supplied, use to define the ruleset to load onto the $__target_host for pf(4). + Note that this type is almost useless without a ruleset defined, but it's technically not + needed, e.g. for the case of disabling the firewall temporarily. EXAMPLES @@ -32,10 +30,10 @@ EXAMPLES .. code-block:: sh - # Remove the current ruleset in place and disable pf + # Remove the current ruleset in place __pf_ruleset --state absent - # Enable pf with the ruleset defined in $__manifest/files/pf.conf + # Enable the firewall with the ruleset defined in $__manifest/files/pf.conf __pf_ruleset --state present --source $__manifest/files/pf.conf @@ -46,13 +44,11 @@ SEE ALSO AUTHORS ------- -Kamila Součková Jake Guffey COPYING ------- -Copyright \(C) 2016 Kamila Součková. Copyright \(C) 2012 Jake Guffey. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the diff --git a/cdist/conf/type/__postfix/manifest b/cdist/conf/type/__postfix/manifest index 121bba96..f3616979 100755 --- a/cdist/conf/type/__postfix/manifest +++ b/cdist/conf/type/__postfix/manifest @@ -19,4 +19,16 @@ # along with cdist. If not, see . # -__package postfix --state present + +os=$(cat "$__global/explorer/os") + +case "$os" in + alpine|ubuntu|debian|archlinux|suse|scientific|centos|devuan) + __package postfix --state present + ;; + *) + echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2 + echo "Please contribute an implementation for it if you can." >&2 + exit 1 + ;; +esac diff --git a/cdist/conf/type/__postfix_master/gencode-remote b/cdist/conf/type/__postfix_master/gencode-remote index 73de1088..7c109a69 100755 --- a/cdist/conf/type/__postfix_master/gencode-remote +++ b/cdist/conf/type/__postfix_master/gencode-remote @@ -67,7 +67,7 @@ case "$state_should" in remove_entry fi cat << DONE -cat >> "$config" << "${__type##*/}_DONE" +cat >> "$config" << ${__type##*/}_DONE $(cat "$entry") ${__type##*/}_DONE DONE diff --git a/cdist/conf/type/__postfix_master/parameter/optional b/cdist/conf/type/__postfix_master/parameter/optional index 410482b8..792b42c5 100644 --- a/cdist/conf/type/__postfix_master/parameter/optional +++ b/cdist/conf/type/__postfix_master/parameter/optional @@ -4,5 +4,6 @@ unpriv chroot wakeup maxproc +option comment state diff --git a/cdist/conf/type/__postfix_master/parameter/optional_multiple b/cdist/conf/type/__postfix_master/parameter/optional_multiple deleted file mode 100644 index 01925a15..00000000 --- a/cdist/conf/type/__postfix_master/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -option diff --git a/cdist/conf/type/__postgres_conf/explorer/postgres_user b/cdist/conf/type/__postgres_conf/explorer/postgres_user deleted file mode 100644 index c6582dc4..00000000 --- a/cdist/conf/type/__postgres_conf/explorer/postgres_user +++ /dev/null @@ -1,64 +0,0 @@ -#!/bin/sh -e -# -*- mode: sh; indent-tabs-mode: t -*- -# -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -os=$("${__explorer:?}/os") - -case ${os} -in - (alpine) - echo 'postgres' - ;; - (centos|rhel|scientific) - echo 'postgres' - ;; - (debian|devuan|ubuntu) - echo 'postgres' - ;; - (freebsd) - test -x /usr/local/etc/rc.d/postgresql || { - printf 'could not find postgresql rc script./n' >&2 - exit 1 - } - pg_status=$(/usr/local/etc/rc.d/postgresql onestatus) || { - printf 'postgresql daemon is not running.\n' >&2 - exit 1 - } - pg_pid=$(printf '%s\n' "${pg_status}" \ - | sed -n 's/^pg_ctl:.*(PID: *\([0-9]*\))$/\1/p') - - # PostgreSQL < 9.6: pgsql - # PostgreSQL >= 9.6: postgres - ps -o user -p "${pg_pid}" | sed -n '2p' - ;; - (netbsd) - echo 'pgsql' - ;; - (openbsd) - echo '_postgresql' - ;; - (suse) - echo 'postgres' - ;; - (*) - echo "Unsupported OS: ${os}" >&2 - exit 1 - ;; -esac diff --git a/cdist/conf/type/__postgres_conf/explorer/state b/cdist/conf/type/__postgres_conf/explorer/state deleted file mode 100644 index 4b7b0a43..00000000 --- a/cdist/conf/type/__postgres_conf/explorer/state +++ /dev/null @@ -1,223 +0,0 @@ -#!/bin/sh -e -# -*- mode: sh; indent-tabs-mode: t -*- -# -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -postgres_user=$("${__type_explorer:?}/postgres_user") -conf_name=${__object_id:?} - -tolower() { printf '%s' "$*" | tr '[:upper:]' '[:lower:]'; } - -tobytes() { - # NOTE: This function treats everything as base 2. - # It is not compatible with SI units. - awk 'BEGIN { FS = "\n" } - /TB$/ { $0 = ($0 * 1024) "GB" } - /GB$/ { $0 = ($0 * 1024) "MB" } - /MB$/ { $0 = ($0 * 1024) "kB" } - /kB$/ { $0 = ($0 * 1024) "B" } - /B?$/ { sub(/ *B?$/, "") } - ($0*1) == $0 # is number - ' <<-EOF - $1 - EOF -} - -tomillisecs() { - awk 'BEGIN { FS = "\n" } - /d$/ { $0 = ($0 * 24) "h" } - /h$/ { $0 = ($0 * 60) "min" } - /min$/ { $0 = ($0 * 60) "s" } - /[^m]s$/ { $0 = ($0 * 1000) "ms" } - /ms$/ { $0 *= 1 } - ($0*1) == $0 # is number - ' <<-EOF - $1 - EOF -} - -tobool() { - # prints either 'on' or 'off' - case $(tolower "$1") - in - (t|true|y|yes|on|1) - echo 'on' ;; - (f|false|n|no|off|0) - echo 'off' ;; - (*) - printf 'Inavlid bool value: %s\n' "$2" >&2 - return 1 - ;; - esac - return 0 -} - -quote() { printf '%s\n' "$*" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/"; } -psql_exec() { - su - "${postgres_user}" -c "psql postgres -twAc $(quote "$*")" -} - -psql_conf_source() { - # NOTE: SHOW/SET are case-insentitive, so this command should also be. - psql_exec "SELECT CASE WHEN source = 'default' OR setting = boot_val THEN 'default' ELSE source END FROM pg_settings WHERE lower(name) = lower('$1')" -} -psql_conf_cmp() ( - IFS='|' read -r lower_name vartype setting unit <<-EOF - $(psql_exec "SELECT lower(name), vartype, setting, unit FROM pg_settings WHERE lower(name) = lower('$1')") - EOF - - should_value=$2 - is_value=${setting} - - # The following case contains special cases for special settings. - case ${lower_name} - in - (archive_command) - if test "${setting}" = '(disabled)' - then - # DAFUQ PostgreSQL?! - # PostgreSQL returns (disabled) if the feature is inactive. - # We cannot compare the values unless it is enabled, first. - return 0 - fi - ;; - (archive_mode|backslash_quote|constraint_exclusion|force_parallel_mode|huge_pages|synchronous_commit) - # Although only 'on', 'off' are documented, PostgreSQL accepts all - # the "likely" variants of "on" and "off". - case $(tolower "${should_value}") - in - (on|off|true|false|yes|no|1|0) - should_value=$(tobool "${should_value}") - ;; - esac - ;; - esac - - case ${vartype} - in - (bool) - test -z "${unit}" || { - # please fix the explorer if this error occurs. - printf 'units are not supported for vartype: %s\n' "${vartype}" >&2 - exit 1 - } - - should_value=$(tobool "${should_value}") - - test "${is_value}" = "${should_value}" - ;; - (enum) - test -z "${unit}" || { - # please fix the explorer if this error occurs. - printf 'units are not supported with vartype: %s\n' "${vartype}" >&2 - exit 1 - } - - # NOTE: All enums that are currently defined are lower case, but - # PostgreSQL also accepts upper case spelling. - should_value=$(tolower "$2") - - test "${is_value}" = "${should_value}" - ;; - (integer) - # split multiples from unit, first (e.g. 8kB -> 8, kB) - case ${unit} - in - ([0-9]*) - multiple=${unit%%[!0-9]*} - unit=${unit##*[0-9 ]} - ;; - (*) multiple=1 ;; - esac - - is_value=$((setting * multiple))${unit} - - if expr "${should_value}" : '-\{0,1\}[0-9]*$' >/dev/null - then - # default unit - should_value=$((should_value * multiple))${unit} - fi - - # then, do conversion - # NOTE: these conversions work for integers only! - case ${unit} - in - (B|[kMGT]B) - # bytes - is_bytes=$(tobytes "${is_value}") - should_bytes=$(tobytes "${should_value}") - - test $((is_bytes)) -eq $((should_bytes)) - ;; - (ms|s|min|h|d) - # seconds - is_ms=$(tomillisecs "${is_value}") - should_ms=$(tomillisecs "${should_value}") - - test $((is_ms)) -eq $((should_ms)) - ;; - ('') - # no unit - is_int=${is_value} - should_int=${should_value} - - test $((is_int)) -eq $((should_int)) - ;; - esac - ;; - (real|string) - # NOTE: reals could possibly have units, but currently there none. - - test -z "${unit}" || { - # please fix the explorer if this error occurs. - printf 'units are not supported with vartype: %s\n' "${vartype}" >&2 - exit 1 - } - - test "${is_value}" = "${should_value}" - ;; - esac -) - -psql_exec 'SELECT 1' >/dev/null || { - echo 'Connection to PostgreSQL server failed' >&2 - exit 1 -} - -case $(psql_conf_source "${conf_name}") -in - ('') - printf 'Invalid configuration parameter: %s\n' "${conf_name}" >&2 - exit 1 - ;; - (default) - echo absent - ;; - (*) - if ! test -f "${__object:?}/parameter/value" - then - echo present - elif psql_conf_cmp "${conf_name}" "$(cat "${__object:?}/parameter/value")" - then - echo present - else - echo different - fi - ;; -esac diff --git a/cdist/conf/type/__postgres_conf/gencode-remote b/cdist/conf/type/__postgres_conf/gencode-remote deleted file mode 100755 index 27651600..00000000 --- a/cdist/conf/type/__postgres_conf/gencode-remote +++ /dev/null @@ -1,123 +0,0 @@ -#!/bin/sh -e -# -*- mode: sh; indent-tabs-mode: t -*- -# -# 2019-2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# 2020 Beni Ruef (bernhard.ruef at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -state_is=$(cat "${__object:?}/explorer/state") -state_should=$(cat "${__object:?}/parameter/state") -postgres_user=$(cat "${__object:?}/explorer/postgres_user") - -conf_name=${__object_id:?} - -if test "${state_is}" = "${state_should}" -then - exit 0 -fi - -quote() { - for _arg - do - shift - if test -n "$(printf '%s' "${_arg}" | tr -d -c '\t\n \042-\047\050-\052\073-\077\133\\`|~' | tr -c '' '.')" - then - # needs quoting - set -- "$@" "'$(printf '%s' "${_arg}" | sed -e "s/'/'\\\\''/g")'" - else - set -- "$@" "${_arg}" - fi - done - unset _arg - - # NOTE: Use printf because POSIX echo interprets escape sequences - printf '%s' "$*" -} - - -psql_cmd() { - printf 'su - %s -c %s\n' "$(quote "${postgres_user}")" "$(quote "$(quote psql "$@")")" -} - -case ${state_should} -in - (present) - test -n "${__object:?}/parameter/value" || { - echo 'Missing required parameter --value' >&2 - exit 1 - } - - cat <<-EOF - exec 3< "\${__object:?}/parameter/value" - $(psql_cmd postgres -tAwq -o /dev/null -v ON_ERROR_STOP=on) <<'SQL' - \\set conf_value \`cat <&3\` - ALTER SYSTEM SET ${conf_name} = :'conf_value'; - SELECT pg_reload_conf(); - SQL - exec 3<&- - EOF - ;; - (absent) - psql_cmd postgres -qwc "ALTER SYSTEM SET ${conf_name} TO DEFAULT" - ;; - (*) - printf 'Invalid --state: %s\n' "${state_should}" >&2 - printf 'Only "present" and "absent" are acceptable.\n' >&2 - exit 1 - ;; -esac - -# Restart PostgreSQL server if required to apply new configuration value -cat <&2 - exit 1 - esac - ;; - (*) - printf "Don't know how to restart services with your init (%s)\n" "${init}" >&2 - exit 1 - esac - ) -fi -EOF diff --git a/cdist/conf/type/__postgres_conf/man.rst b/cdist/conf/type/__postgres_conf/man.rst deleted file mode 100644 index e035f080..00000000 --- a/cdist/conf/type/__postgres_conf/man.rst +++ /dev/null @@ -1,60 +0,0 @@ -cdist-type__postgres_conf(7) -============================ - -NAME ----- -cdist-type__postgres_conf - Alter PostgreSQL configuration - - -DESCRIPTION ------------ -Configure a running PostgreSQL server using ``ALTER SYSTEM``. - - -REQUIRED PARAMETERS -------------------- -value - The value to set (can be omitted if ``--state`` is set to ``absent``). - - -OPTIONAL PARAMETERS -------------------- -state - ``present`` or ``absent``. - Defaults to ``present``. - - -BOOLEAN PARAMETERS ------------------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # set timezone - __postgres_conf timezone --value Europe/Zurich - - # reset maximum number of concurrent connections to default (normally 100) - __postgres_conf max_connections --state absent - - -SEE ALSO --------- -None. - - -AUTHORS -------- -Beni Ruef (bernhard.ruef--@--ssrq-sds-fds.ch) -Dennis Camera (dennis.camera--@--ssrq-sds-fds.ch) - - -COPYING -------- -Copyright \(C) 2019-2021 SSRQ (www.ssrq-sds-fds.ch). -You can redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either version 3 of -the License, or (at your option) any later version. diff --git a/cdist/conf/type/__postgres_conf/parameter/default/state b/cdist/conf/type/__postgres_conf/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__postgres_conf/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__postgres_conf/parameter/optional b/cdist/conf/type/__postgres_conf/parameter/optional deleted file mode 100644 index d0460d86..00000000 --- a/cdist/conf/type/__postgres_conf/parameter/optional +++ /dev/null @@ -1,2 +0,0 @@ -state -value diff --git a/cdist/conf/type/__postgres_database/explorer/postgres_user b/cdist/conf/type/__postgres_database/explorer/postgres_user deleted file mode 120000 index 714e7237..00000000 --- a/cdist/conf/type/__postgres_database/explorer/postgres_user +++ /dev/null @@ -1 +0,0 @@ -../../__postgres_conf/explorer/postgres_user \ No newline at end of file diff --git a/cdist/conf/type/__postgres_database/explorer/state b/cdist/conf/type/__postgres_database/explorer/state index 6a25df86..d68d4120 100755 --- a/cdist/conf/type/__postgres_database/explorer/state +++ b/cdist/conf/type/__postgres_database/explorer/state @@ -1,7 +1,6 @@ #!/bin/sh # # 2011 Steven Armstrong (steven-cdist at armstrong.cc) -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -19,18 +18,25 @@ # along with cdist. If not, see . # -postgres_user=$("${__type_explorer:?}/postgres_user") +case "$("${__explorer}/os")" +in + netbsd) + postgres_user='pgsql' + ;; + openbsd) + postgres_user='_postgresql' + ;; + *) + postgres_user='postgres' + ;; +esac -dbname=${__object_id:?} -quote() { printf '%s\n' "$*" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/"; } -psql_exec() { - su - "${postgres_user}" -c "psql $(quote "$1") -twAc $(quote "$2")" -} +name="$__object_id" -if psql_exec postgres "SELECT datname FROM pg_database" | grep -qFx "${dbname}" +if test -n "$(su - "$postgres_user" -c "psql postgres -twAc \"SELECT 1 FROM pg_database WHERE datname='$name'\"")" then - echo 'present' + echo 'present' else - echo 'absent' + echo 'absent' fi diff --git a/cdist/conf/type/__postgres_database/gencode-remote b/cdist/conf/type/__postgres_database/gencode-remote index 7d7d6fa2..61cfa50d 100755 --- a/cdist/conf/type/__postgres_database/gencode-remote +++ b/cdist/conf/type/__postgres_database/gencode-remote @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2011 Steven Armstrong (steven-cdist at armstrong.cc) -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -19,63 +18,35 @@ # along with cdist. If not, see . # -quote() { - for _arg - do - shift - if test -n "$(printf '%s' "${_arg}" | tr -d -c '\t\n \042-\047\050-\052\073-\077\133\\`|~' | tr -c '' '.')" - then - # needs quoting - set -- "$@" "'$(printf '%s' "${_arg}" | sed -e "s/'/'\\\\''/g")'" - else - set -- "$@" "${_arg}" - fi - done - unset _arg - - # NOTE: Use printf because POSIX echo interprets escape sequences - printf '%s' "$*" -} - -postgres_user=$(cat "${__object:?}/explorer/postgres_user") - -dbname=${__object_id:?} -state_should=$(cat "${__object:?}/parameter/state") -state_is=$(cat "${__object:?}/explorer/state") - -if test "${state_should}" = "$state_is" -then - exit 0 -fi - -case ${state_should} +case "$(cat "${__global}/explorer/os")" in - (present) - set -- - - while read -r param_name opt - do - if test -f "${__object:?}/parameter/${param_name}" - then - set -- "$@" "${opt}" "$(cat "${__object:?}/parameter/${param_name}")" - fi - done <<-'EOF' - owner -O - template --template - encoding --encoding - lc_collate --lc-collate - lc_ctype --lc-ctype - EOF - - set -- "$@" "${dbname}" - - cat <<-EOF - su - $(quote "${postgres_user}") -c $(quote "$(quote createdb "$@")") - EOF - ;; - (absent) - cat <<-EOF - su - $(quote "${postgres_user}") -c $(quote "$(quote dropdb "${dbname}")") - EOF - ;; + netbsd) + postgres_user='pgsql' + ;; + openbsd) + postgres_user='_postgresql' + ;; + *) + postgres_user='postgres' + ;; esac + + +name="$__object_id" +state_should="$(cat "$__object/parameter/state")" +state_is="$(cat "$__object/explorer/state")" + +if [ "$state_should" != "$state_is" ]; then + case "$state_should" in + present) + owner="" + if [ -f "$__object/parameter/owner" ]; then + owner="-O '$(cat "$__object/parameter/owner")'" + fi + echo "su - '$postgres_user' -c \"createdb $owner '$name'\"" + ;; + absent) + echo "su - '$postgres_user' -c \"dropdb '$name'\"" + ;; + esac +fi diff --git a/cdist/conf/type/__postgres_database/man.rst b/cdist/conf/type/__postgres_database/man.rst index 870b4917..acceec9b 100644 --- a/cdist/conf/type/__postgres_database/man.rst +++ b/cdist/conf/type/__postgres_database/man.rst @@ -14,22 +14,10 @@ This cdist type allows you to create or drop postgres databases. OPTIONAL PARAMETERS ------------------- state - Either 'present' or 'absent', defaults to 'present'. + either 'present' or 'absent', defaults to 'present'. owner - Specifies the database user who will own the new database. - -encoding - Specifies the character encoding scheme to be used in this database. - -lc-collate - Specifies the LC_COLLATE setting to be used in this database. - -lc-ctype - Specifies the LC_CTYPE setting to be used in this database. - -template - Specifies the template database from which to build this database. + the role owning this database EXAMPLES diff --git a/cdist/conf/type/__postgres_database/parameter/optional b/cdist/conf/type/__postgres_database/parameter/optional index 877fbf32..d86b6469 100644 --- a/cdist/conf/type/__postgres_database/parameter/optional +++ b/cdist/conf/type/__postgres_database/parameter/optional @@ -1,6 +1,2 @@ state owner -encoding -lc-collate -lc-ctype -template diff --git a/cdist/conf/type/__postgres_extension/explorer/postgres_user b/cdist/conf/type/__postgres_extension/explorer/postgres_user deleted file mode 120000 index 714e7237..00000000 --- a/cdist/conf/type/__postgres_extension/explorer/postgres_user +++ /dev/null @@ -1 +0,0 @@ -../../__postgres_conf/explorer/postgres_user \ No newline at end of file diff --git a/cdist/conf/type/__postgres_extension/explorer/state b/cdist/conf/type/__postgres_extension/explorer/state deleted file mode 100644 index 9d156be7..00000000 --- a/cdist/conf/type/__postgres_extension/explorer/state +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/sh -e -# -*- mode: sh; indent-tabs-mode: t -*- -# -# 2021 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Prints "present" if the extension is currently installed. -# "absent" otherwise. - -quote() { printf '%s\n' "$*" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/"; } - -postgres_user=$("${__type_explorer:?}/postgres_user") - -IFS=: read -r dbname extname <. # -postgres_user=$(cat "${__object:?}/explorer/postgres_user") - -quote() { printf '%s\n' "$*" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/"; } -psql_cmd() { - printf 'su - %s -c %s\n' \ - "$(quote "${postgres_user}")" \ - "$(quote psql "$(quote "$1")" -c "$(quote "$2")")" -} - - -IFS=: read -r dbname extname <&2 - exit 1 - ;; + netbsd) + postgres_user='pgsql' + ;; + openbsd) + postgres_user='_postgresql' + ;; + *) + postgres_user='postgres' + ;; +esac + + +dbname=$( echo "$__object_id" | cut -d":" -f1 ) +extension=$( echo "$__object_id" | cut -d":" -f2 ) + +state_should=$( cat "$__object/parameter/state" ) + +case "$state_should" in + present) + cmd="CREATE EXTENSION IF NOT EXISTS $extension" + echo "su - '$postgres_user' -c 'psql -c \"$cmd\" \"$dbname\"'" + ;; + absent) + cmd="DROP EXTENSION IF EXISTS $extension" + echo "su - '$postgres_user' -c 'psql -c \"$cmd\" \"$dbname\"'" + ;; esac diff --git a/cdist/conf/type/__postgres_extension/man.rst b/cdist/conf/type/__postgres_extension/man.rst index 442239f6..79645b2b 100644 --- a/cdist/conf/type/__postgres_extension/man.rst +++ b/cdist/conf/type/__postgres_extension/man.rst @@ -3,36 +3,32 @@ cdist-type__postgres_extension(7) NAME ---- -cdist-type__postgres_extension - Manage PostgreSQL extensions +cdist-type__postgres_extension - manage postgres extensions DESCRIPTION ----------- -This cdist type allows you to manage PostgreSQL extensions. +This cdist type allows you to create or drop postgres extensions. -The ``__object_id`` to pass to ``__postgres_extension`` is of the form -``dbname:extension``, e.g.: +The object you need to pass to __postgres_extension consists of +the database name and the extension name joined by a colon in the +following form: + +.. code-block:: sh + + dbname:extension + +f.ex. .. code-block:: sh rails_test:unaccent -**CAUTION!** Be careful when installing extensions from (untrusted) third-party -sources: - - | Installing an extension as superuser requires trusting that the extension's - author wrote the extension installation script in a secure fashion. It is - not terribly difficult for a malicious user to create trojan-horse objects - that will compromise later execution of a carelessly-written extension - script, allowing that user to acquire superuser privileges. - | – ``_ - - OPTIONAL PARAMETERS ------------------- state - either ``present`` or ``absent``, defaults to ``present``. + either "present" or "absent", defaults to "present" EXAMPLES @@ -40,29 +36,24 @@ EXAMPLES .. code-block:: sh - # Install extension unaccent into database rails_test - __postgres_extension rails_test:unaccent - - # Drop extension unaccent from database fails_test - __postgres_extension rails_test:unaccent --state absent + __postgres_extension rails_test:unaccent + __postgres_extension --present rails_test:unaccent + __postgres_extension --absent rails_test:unaccent SEE ALSO -------- -- :strong:`cdist-type__postgres_database`\ (7) -- PostgreSQL "CREATE EXTENSION" documentation at: - ``_. +:strong:`cdist-type__postgre_database`\ (7) +Postgres "Create Extension" documentation at: . -AUTHORS +AUTHOR ------- -| Tomas Pospisek -| Dennis Camera - +Tomas Pospisek COPYING ------- -Copyright \(C) 2014 Tomas Pospisek, 2021 Dennis Camera. -You can redistribute it and/or modify it under the terms of the GNU General -Public License as published by the Free Software Foundation, either version 3 of -the License, or (at your option) any later version. +Copyright \(C) 2014 Tomas Pospisek. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__postgres_role/explorer/postgres_user b/cdist/conf/type/__postgres_role/explorer/postgres_user deleted file mode 120000 index 714e7237..00000000 --- a/cdist/conf/type/__postgres_role/explorer/postgres_user +++ /dev/null @@ -1 +0,0 @@ -../../__postgres_conf/explorer/postgres_user \ No newline at end of file diff --git a/cdist/conf/type/__postgres_role/explorer/state b/cdist/conf/type/__postgres_role/explorer/state index 822816c1..c8e1fa9d 100755 --- a/cdist/conf/type/__postgres_role/explorer/state +++ b/cdist/conf/type/__postgres_role/explorer/state @@ -1,7 +1,6 @@ -#!/bin/sh -e +#!/bin/sh # # 2011 Steven Armstrong (steven-cdist at armstrong.cc) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -12,125 +11,32 @@ # # cdist is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -postgres_user=$("${__type_explorer:?}/postgres_user") -rolename=${__object_id:?} +case "$("${__explorer}/os")" +in + netbsd) + postgres_user='pgsql' + ;; + openbsd) + postgres_user='_postgresql' + ;; + *) + postgres_user='postgres' + ;; +esac -psql_query() { - su -l "${postgres_user}" -c "$( - printf "psql -q -F '\034' -R '\036' -wAc '%s'" \ - "$(printf %s "$*" | sed "s/'/'\\\\''/g")" - )" -} +name="$__object_id" -password_check_login() ( - PGPASSWORD=$(cat "${__object:?}/parameter/password"; printf .) - PGPASSWORD=${PGPASSWORD%?.} - export PGPASSWORD - psql -q -w -h localhost -U "${rolename}" template1 -c '\q' >/dev/null 2>&1 -) - -role_properties=$( - psql_query "SELECT * FROM pg_roles WHERE rolname = '${rolename}'" \ - | awk ' - BEGIN { RS = "\036"; FS = "\034" } - /^\([0-9]+ rows?\)/ { exit } - NR == 1 { for (i = 1; i <= NF; i++) cols[i] = $i; next } - NR == 2 { for (i = 1; i <= NF; i++) printf "%s=%s\n", cols[i], $i }' -) - -if test -n "${role_properties}" +if test -n "$(su - "$postgres_user" -c "psql postgres -twAc \"SELECT 1 FROM pg_roles WHERE rolname='$name'\"")" then - # Check if the user's properties match the parameters - for prop in login createdb createrole superuser - do - bool_should=$(test -f "${__object:?}/parameter/${prop}" && echo 't' || echo 'f') - bool_is=$( - printf '%s\n' "${role_properties}" | - awk -F '=' -v key="${prop}" ' - BEGIN { - if (key == "login") - key = "canlogin" - else if (key == "superuser") - key = "super" - key = "rol" key - } - $1 == key { - sub(/^[^=]*=/, "") - print - } - ' - ) - - test "${bool_is}" = "${bool_should}" || { - state='different properties' - } - done - - # Check password - passwd_stored=$( - psql_query "SELECT rolpassword FROM pg_authid WHERE rolname = '${rolename}'" \ - | awk 'BEGIN { RS = "\036" } NR == 2 { printf "%s.", $0 }') - passwd_stored=${passwd_stored%.} - - if test -s "${__object:?}/parameter/password" - then - passwd_should=$(cat "${__object:?}/parameter/password"; printf .) - fi - passwd_should=${passwd_should%?.} - - if test -z "${passwd_stored}" - then - test -z "${passwd_should}" || state="${state:-different} password" - elif expr "${passwd_stored}" : 'SCRAM-SHA-256\$.*$' >/dev/null - then - # SCRAM-SHA-256 "encrypted" password - # NOTE: There is currently no easy way to check SCRAM passwords without - # logging in - password_check_login || state="${state:-different} password" - elif expr "${passwd_stored}" : 'md5[0-9a-f]\{32\}$' >/dev/null - then - # MD5 "encrypted" password - if command -v md5sum >/dev/null 2>&1 - then - should_md5=$( - printf '%s%s' "${passwd_should}" "${rolename}" \ - | md5sum - | sed -e 's/[^0-9a-f]*$//') - elif command -v gmd5sum >/dev/null 2>&1 - then - should_md5=$( - printf '%s%s' "${passwd_should}" "${rolename}" \ - | gmd5sum - | sed -e 's/[^0-9a-f]*$//') - elif command -v openssl >/dev/null 2>&1 - then - should_md5=$( - printf '%s%s' "${passwd_should}" "${rolename}" \ - | openssl dgst -md5 | sed 's/^.* //') - fi - - if test -n "${should_md5}" - then - test "${passwd_stored}" = "md5${should_md5}" \ - || state="${state:-different} password" - else - password_check_login || state="${state:-different} password" - fi - else - # unencrypted password (unsupported since PostgreSQL 10) - test "${passwd_stored}" = "${passwd_should}" \ - || state="${state:-different} password" - fi - - test -n "${state}" || state='present' + echo 'present' else - state='absent' + echo 'absent' fi - -echo "${state}" diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote index 4cb78330..fd56e85d 100755 --- a/cdist/conf/type/__postgres_role/gencode-remote +++ b/cdist/conf/type/__postgres_role/gencode-remote @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2011 Steven Armstrong (steven-cdist at armstrong.cc) -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) # # This file is part of cdist. # @@ -12,104 +11,53 @@ # # cdist is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with cdist. If not, see . # -quote() { - if test $# -gt 0 - then - printf '%s' "$*" - else - cat - - fi | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/'/" -} - -postgres_user=$(cat "${__object:?}/explorer/postgres_user") -rolename=${__object_id:?} -state_is=$(cat "${__object:?}/explorer/state") -state_should=$(cat "${__object:?}/parameter/state") - -if test "${state_is}" = "${state_should}" -then - exit 0 -fi - -psql_query() { - printf 'su -l %s -c %s\n' \ - "$(quote "${postgres_user}")" \ - "$(quote "psql postgres -q -w -c $(quote "$1")")" -} - -psql_set_password() { - # NOTE: Always make sure that the password does not end up in psql_history! - # NOTE: Never set an empty string as the password, because it can be - # interpreted differently by different tooling. - if test -s "${__object:?}/parameter/password" - then - cat <<-EOF - exec 3< "\${__object:?}/parameter/password" - su -l '${postgres_user}' -c 'psql -q -w postgres' <<'SQL' - \set HISTFILE /dev/null - \set pw \`cat <&3\` - ALTER ROLE "${rolename}" WITH PASSWORD :'pw'; - SQL - exec 3<&- - EOF - else - psql_query "ALTER ROLE \"${rolename}\" WITH PASSWORD NULL;" - fi -} - -role_properties_should() { - _props= - for _prop in login createdb createrole superuser - do - _props="${_props}${_props:+ }$( - if test -f "${__object:?}/parameter/${_prop}" - then - echo "${_prop}" - else - echo "no${_prop}" - fi \ - | tr '[:lower:]' '[:upper:]')" - done - printf '%s\n' "${_props}" - unset _prop _props -} - -case ${state_should} +case "$(cat "${__global}/explorer/os")" in - (present) - case ${state_is} - in - (absent) - psql_query "CREATE ROLE \"${rolename}\" WITH $(role_properties_should);" - psql_set_password - ;; - (different*) - if expr "${state_is}" : 'different.*properties' >/dev/null - then - psql_query "ALTER ROLE \"${rolename}\" WITH $(role_properties_should);" - fi - - if expr "${state_is}" : 'different.*password' >/dev/null - then - psql_set_password - fi - ;; - (*) - printf 'Invalid state reported by state explorer: %s\n' "${state_is}" >&2 - exit 1 - ;; - esac - ;; - (absent) - printf 'su -l %s -c %s\n' \ - "$(quote "${postgres_user}")" \ - "$(quote "dropuser $(quote "${rolename}")")" - ;; + netbsd) + postgres_user='pgsql' + ;; + openbsd) + postgres_user='_postgresql' + ;; + *) + postgres_user='postgres' + ;; +esac + + +name="$__object_id" +state_is="$(cat "$__object/explorer/state")" +state_should="$(cat "$__object/parameter/state")" + +[ "$state_is" = "$state_should" ] && exit 0 + +case "$state_should" in + present) + if [ -f "$__object/parameter/password" ]; then + password="$(cat "$__object/parameter/password")" + fi + booleans="" + for boolean in login createdb createrole superuser; do + if [ ! -f "$__object/parameter/$boolean" ]; then + boolean="no${boolean}" + fi + upper=$(echo $boolean | tr '[:lower:]' '[:upper:]') + booleans="$booleans $upper" + done + + [ -n "$password" ] && password="PASSWORD '$password'" + + cmd="CREATE ROLE $name WITH $password $booleans" + echo "su - '$postgres_user' -c \"psql postgres -wc \\\"$cmd\\\"\"" + ;; + absent) + echo "su - '$postgres_user' -c \"dropuser \\\"$name\\\"\"" + ;; esac diff --git a/cdist/conf/type/__pyvenv/explorer/group b/cdist/conf/type/__pyvenv/explorer/group index 922ce3df..a655bda7 100755 --- a/cdist/conf/type/__pyvenv/explorer/group +++ b/cdist/conf/type/__pyvenv/explorer/group @@ -1,24 +1,5 @@ -#!/bin/sh -e +#!/bin/sh -destination="/${__object_id:?}" +destination="/$__object_id" -# shellcheck disable=SC2012 -group_gid=$(ls -ldn "${destination}" | awk '{ print $4 }') - -# NOTE: +1 because $((notanum)) prints 0. -if test $((group_gid + 1)) -ge 0 -then - group_should=$(cat "${__object:?}/parameter/group") - - if expr "${group_should}" : '[0-9]*$' >/dev/null - then - printf '%u\n' "${group_gid}" - else - if command -v getent >/dev/null 2>&1 - then - getent group "${group_gid}" | cut -d : -f 1 - else - awk -F: -v gid="${group_gid}" '$3 == gid { print $1 }' /etc/group - fi - fi -fi +stat --print "%G" "${destination}" 2>/dev/null || exit 0 diff --git a/cdist/conf/type/__pyvenv/explorer/owner b/cdist/conf/type/__pyvenv/explorer/owner index ebec751f..8b3c7f8e 100755 --- a/cdist/conf/type/__pyvenv/explorer/owner +++ b/cdist/conf/type/__pyvenv/explorer/owner @@ -1,19 +1,5 @@ -#!/bin/sh -e +#!/bin/sh -destination="/${__object_id:?}" +destination="/$__object_id" -# shellcheck disable=SC2012 -owner_uid=$(ls -ldn "${destination}" | awk '{ print $3 }') - -# NOTE: +1 because $((notanum)) prints 0. -if test $((owner_uid + 1)) -ge 0 -then - owner_should=$(cat "${__object:?}/parameter/owner") - - if expr "${owner_should}" : '[0-9]*$' >/dev/null - then - printf '%u\n' "${owner_uid}" - else - printf '%s\n' "$(id -u -n "${owner_uid}")" - fi -fi +stat --print "%U" "${destination}" 2>/dev/null || exit 0 diff --git a/cdist/conf/type/__pyvenv/gencode-remote b/cdist/conf/type/__pyvenv/gencode-remote index c5b64eff..04700683 100755 --- a/cdist/conf/type/__pyvenv/gencode-remote +++ b/cdist/conf/type/__pyvenv/gencode-remote @@ -1,7 +1,6 @@ #!/bin/sh -e # # 2016 Darko Poljak (darko.poljak at gmail.com) -# 2020 Nico Schotetlius (nico.schottelius at ungleich.ch) # # This file is part of cdist. # @@ -38,21 +37,11 @@ mode="$(cat "$__object/parameter/mode")" destination="/$__object_id" venvparams="$(cat "$__object/parameter/venvparams")" pyvenvparam="$__object/parameter/pyvenv" - -os=$(cat "$__global/explorer/os") - if [ -f "$pyvenvparam" ] then pyvenv=$(cat "$pyvenvparam") else - case "$os" in - alpine|ubuntu) # no pyvenv on alpine - I assume others will follow - pyvenv="python3 -m venv" - ;; - *) - pyvenv="pyvenv" - ;; - esac + pyvenv="pyvenv" fi case $state_should in diff --git a/cdist/conf/type/__pyvenv/man.rst b/cdist/conf/type/__pyvenv/man.rst index e2e4a1e6..d7de92fa 100644 --- a/cdist/conf/type/__pyvenv/man.rst +++ b/cdist/conf/type/__pyvenv/man.rst @@ -9,7 +9,7 @@ cdist-type__pyvenv - Create or remove python virtual environment DESCRIPTION ----------- This cdist type allows you to create or remove python virtual -environment using pyvenv on python3 -m venv. +environment using pyvenv. It assumes pyvenv is already installed. Concrete package depends on concrete OS and/or OS version/distribution. Ensure this for e.g. in your init manifest as in the following example: @@ -57,11 +57,11 @@ EXAMPLES __pyvenv /home/services/djangoenv - # Use specific pyvenv + # Use specific pyvenv __pyvenv /home/foo/fooenv --pyvenv /usr/local/bin/pyvenv-3.4 # Create python virtualenv for user foo. - __pyvenv /home/foo/fooenv --group foo --owner foo + __pyvenv /home/foo/fooenv --group foo --user foo # Create python virtualenv with specific parameters. __pyvenv /home/services/djangoenv --venvparams "--copies --system-site-packages" @@ -76,3 +76,4 @@ COPYING ------- Copyright \(C) 2016 Darko Poljak. Free use of this software is granted under the terms of the GNU General Public License v3 or later (GPLv3+). + diff --git a/cdist/conf/type/__rsync/gencode-local b/cdist/conf/type/__rsync/gencode-local index e9f3c131..e36ded2f 100755 --- a/cdist/conf/type/__rsync/gencode-local +++ b/cdist/conf/type/__rsync/gencode-local @@ -1,104 +1,39 @@ #!/bin/sh -e - -if ! command -v rsync > /dev/null -then - echo 'rsync is missing in local machine' >&2 - exit 1 -fi - -src="$( cat "$__object/parameter/source" )" - -if [ ! -e "$src" ] -then - echo "$src not found" >&2 - exit 1 -fi - -if [ -f "$__object/parameter/destination" ] -then - dst="$( cat "$__object/parameter/destination" )" -else - dst="/$__object_id" -fi - -# if source is directory, then make sure that -# source and destination are ending with slash, -# because this is what you almost always want when -# rsyncing two directories. - -if [ -d "$src" ] -then - if ! echo "$src" | grep -Eq '/$' - then - src="$src/" - fi - - if ! echo "$dst" | grep -Eq '/$' - then - dst="$dst/" - fi -fi - -remote_user="$( cat "$__object/parameter/remote-user" )" - -options="$( cat "$__object/parameter/options" )" - -if [ -f "$__object/parameter/option" ] -then - while read -r l - do - # there's a limitation in argparse: value can't begin with '-'. - # to workaround this, let's prefix opts with '\' in manifest and remove here. - # read more about argparse issue: https://bugs.python.org/issue9334 - - options="$options $( echo "$l" | sed 's/\\//g' )" - done \ - < "$__object/parameter/option" -fi - -if [ -f "$__object/parameter/owner" ] || [ -f "$__object/parameter/group" ] -then - options="$options --chown=" - - if [ -f "$__object/parameter/owner" ] - then - owner="$( cat "$__object/parameter/owner" )" - options="$options$owner" - fi - - if [ -f "$__object/parameter/group" ] - then - group="$( cat "$__object/parameter/group" )" - options="$options:$group" - fi -fi - -if [ -f "$__object/parameter/mode" ] -then - mode="$( cat "$__object/parameter/mode" )" - options="$options --chmod=$mode" -fi - -# IMPORTANT # -# 1. we first dry-run rsync with change summary to find out -# if there are any changes and code generation is needed. -# 2. normally, to get current state or target host, we run -# such operations in type explorers, but that's not -# possible due to how rsync works. -# 3. redirecting output of dry-run to stderr to ease debugging. -# 4. to understand how that cryptic regex works, please -# open rsync manpage and read about --itemize-changes. +# 2015 Dominique Roux (dominique.roux4 at gmail.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# -export RSYNC_RSH="$__remote_exec" +source=$(cat "$__object/parameter/source") +remote_user=$(cat "$__object/parameter/remote-user") -# shellcheck disable=SC2086 -if ! rsync --dry-run --itemize-changes $options "$src" "$remote_user@$__target_host:$dst" \ - | grep -E '^(<|>|c|h|\.|\*)[fdL][cstTpogunbax\.\+\?]+\s' >&2 -then - exit 0 +if [ -f "$__object/parameter/destination" ]; then + destination=$(cat "$__object/parameter/destination") +else + destination="/$__object_id" fi -echo "export RSYNC_RSH='$__remote_exec'" +set -- +if [ -f "$__object/parameter/rsync-opts" ]; then + while read -r opts; do + set -- "$@" "--$opts" + done < "$__object/parameter/rsync-opts" +fi -echo "rsync $options $src $remote_user@$__target_host:$dst" +echo rsync -a \ + --no-owner --no-group \ + -q "$@" "${source}/" "${remote_user}@${__target_host}:${destination}" diff --git a/cdist/conf/type/__mysql_database/explorer/state b/cdist/conf/type/__rsync/gencode-remote similarity index 57% rename from cdist/conf/type/__mysql_database/explorer/state rename to cdist/conf/type/__rsync/gencode-remote index 79858695..074246af 100755 --- a/cdist/conf/type/__mysql_database/explorer/state +++ b/cdist/conf/type/__rsync/gencode-remote @@ -1,6 +1,6 @@ #!/bin/sh -e # -# 2020 Ander Punnar (ander-at-kvlt-dot-ee) +# 2015 Dominique Roux (dominique.roux4 at gmail.com) # # This file is part of cdist. # @@ -18,16 +18,20 @@ # along with cdist. If not, see . # -if [ -f "$__object/parameter/name" ] -then - name="$( cat "$__object/parameter/name" )" +if [ -f "$__object/parameter/destination" ]; then + destination=$(cat "$__object/parameter/destination") else - name="$__object_id" + destination="/$__object_id" fi -if [ -n "$( mysql -B -N -e "show databases like '$name'" )" ] -then - echo 'present' -else - echo 'absent' +ownergroup="" +if [ -f "$__object/parameter/owner" ]; then + ownergroup=$(cat "$__object/parameter/owner") +fi +if [ -f "$__object/parameter/group" ]; then + ownergroup="${ownergroup}:$(cat "$__object/parameter/group")" +fi + +if [ "$ownergroup" ]; then + echo chown -R "$ownergroup" "$destination" fi diff --git a/cdist/conf/type/__rsync/man.rst b/cdist/conf/type/__rsync/man.rst index 88019c92..94b06d63 100644 --- a/cdist/conf/type/__rsync/man.rst +++ b/cdist/conf/type/__rsync/man.rst @@ -3,73 +3,112 @@ cdist-type__rsync(7) NAME ---- -cdist-type__rsync - Mirror directories using ``rsync`` +cdist-type__rsync - Mirror directories using rsync DESCRIPTION ----------- -The purpose of this type is to bring power of ``rsync`` into ``cdist``. +WARNING: This type is of BETA quality: + +- it has not been tested widely +- interfaces *may* change +- if there is a better approach to solve the problem -> the type may even vanish + +If you are fine with these constraints, please read on. + + +This cdist type allows you to mirror local directories to the +target host using rsync. Rsync will be installed in the manifest of the type. +If group or owner are giveng, a recursive chown will be executed on the +target host. + +A slash will be appended to the source directory so that only the contents +of the directory are taken and not the directory name itself. REQUIRED PARAMETERS ------------------- source - Source directory in local machine. - If source is directory, slash (``/``) will be added to source and destination paths. + Where to take files from OPTIONAL PARAMETERS ------------------- -destination - Destination directory. Defaults to ``$__object_id``. +group + Group to chgrp to. owner - Will be passed to ``rsync`` as ``--chown=OWNER``. - Read ``rsync(1)`` for more details. + User to chown to. -group - Will be passed to ``rsync`` as ``--chown=:GROUP``. - Read ``rsync(1)`` for more details. - -mode - Will be passed to ``rsync`` as ``--chmod=MODE``. - Read ``rsync(1)`` for more details. - -options - Defaults to ``--recursive --links --perms --times``. - Due to `bug in Python's argparse`_, value must be prefixed with ``\``. +destination + Use this as the base destination instead of the object id remote-user - Defaults to ``root``. + Use this user instead of the default "root" for rsync operations. OPTIONAL MULTIPLE PARAMETERS ---------------------------- -option - Pass additional options to ``rsync``. - See ``rsync(1)`` for all possible options. - Due to `bug in Python's argparse`_, value must be prefixed with ``\``. +rsync-opts + Use this option to give rsync options with. + See rsync(1) for available options. + Only "--" options are supported. + Write the options without the beginning "--" + Can be specified multiple times. + + +MESSAGES +-------- +NONE EXAMPLES -------- + .. code-block:: sh - __rsync /var/www/example.com \ - --owner root \ - --group www-data \ - --mode 'D750,F640' \ - --source "$__files/example.com/www" + # You can use any source directory + __rsync /tmp/testdir \ + --source /etc + + # Use source from type + __rsync /etc \ + --source "$__type/files/package" + + # Allow multiple __rsync objects to write to the same dir + __rsync mystuff \ + --destination /usr/local/bin \ + --source "$__type/files/package" + + __rsync otherstuff \ + --destination /usr/local/bin \ + --source "$__type/files/package2" + + # Use rsync option --exclude + __rsync /tmp/testdir \ + --source /etc \ + --rsync-opts exclude=sshd_conf + + # Use rsync with multiple options --exclude --dry-run + __rsync /tmp/testing \ + --source /home/tester \ + --rsync-opts exclude=id_rsa \ + --rsync-opts dry-run + + +SEE ALSO +-------- +:strong:`rsync`\ (1) AUTHORS ------- -Ander Punnar +Nico Schottelius COPYING ------- -Copyright \(C) 2021 Ander Punnar. You can redistribute it and/or modify it -under the terms of the GNU General Public License as published by the Free -Software Foundation, either version 3 of the License, or (at your option) -any later version. +Copyright \(C) 2015 Nico Schottelius. You can redistribute it +and/or modify it under the terms of the GNU General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. diff --git a/cdist/conf/type/__rsync/manifest b/cdist/conf/type/__rsync/manifest index 64fa804e..9bd44c6d 100755 --- a/cdist/conf/type/__rsync/manifest +++ b/cdist/conf/type/__rsync/manifest @@ -1,3 +1,21 @@ #!/bin/sh -e +# +# 2015 Dominique Roux (dominique.roux4 at gmail.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# __package rsync diff --git a/cdist/conf/type/__rsync/parameter/default/options b/cdist/conf/type/__rsync/parameter/default/options deleted file mode 100644 index d967b110..00000000 --- a/cdist/conf/type/__rsync/parameter/default/options +++ /dev/null @@ -1 +0,0 @@ ---recursive --links --perms --times diff --git a/cdist/conf/type/__rsync/parameter/optional b/cdist/conf/type/__rsync/parameter/optional index 833e9bbe..ac2b2390 100644 --- a/cdist/conf/type/__rsync/parameter/optional +++ b/cdist/conf/type/__rsync/parameter/optional @@ -1,6 +1,4 @@ destination -group -mode -options owner +group remote-user diff --git a/cdist/conf/type/__rsync/parameter/optional_multiple b/cdist/conf/type/__rsync/parameter/optional_multiple index 01925a15..fdb7cd88 100644 --- a/cdist/conf/type/__rsync/parameter/optional_multiple +++ b/cdist/conf/type/__rsync/parameter/optional_multiple @@ -1 +1 @@ -option +rsync-opts diff --git a/cdist/conf/type/__sed/explorer/file b/cdist/conf/type/__sed/explorer/file deleted file mode 100755 index ec3d0fe8..00000000 --- a/cdist/conf/type/__sed/explorer/file +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/sh -e - -if [ -f "$__object/parameter/file" ] -then - file="$( cat "$__object/parameter/file" )" -else - file="/$__object_id" -fi - -if [ ! -e "$file" ] -then - echo "$file does not exist" >&2 - exit 1 -fi - -cat "$file" diff --git a/cdist/conf/type/__sed/gencode-remote b/cdist/conf/type/__sed/gencode-remote deleted file mode 100755 index f99c5a88..00000000 --- a/cdist/conf/type/__sed/gencode-remote +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/sh -e - -if [ -f "$__object/parameter/file" ] -then - file="$( cat "$__object/parameter/file" )" -else - file="/$__object_id" -fi - -script="$( cat "$__object/parameter/script" )" - -if [ "$script" = '-' ] -then - script="$( cat "$__object/stdin" )" -fi - -# since stdin is not available in explorer, we pull file from target with explorer - -file_from_target="$__object/explorer/file" - -sed_cmd='sed' - -if [ -f "$__object/parameter/regexp-extended" ] -then - sed_cmd="$sed_cmd -E" -fi - -# do sed dry run, diff result and if no change, then there's nothing to do -# also redirect diff's output to stderr for debugging purposes - -if echo "$script" | "$sed_cmd" -f - "$file_from_target" | diff -u "$file_from_target" - >&2 -then - exit 0 -fi - -# we can't use -i, because it's not posix, so we fly with tempfile and cp -# and we use cp because we want to preserve destination file's attributes - -# shellcheck disable=SC2016 -echo 'tmp="$__object/tempfile"' - -echo "$sed_cmd -f - '$file' > \"\$tmp\" << EOF" - -echo "$script" - -echo 'EOF' - -echo "cp \"\$tmp\" '$file'" - -# shellcheck disable=SC2016 -echo 'rm -f "$tmp"' - -echo 'change' >> "$__messages_out" - -if [ -f "$__object/parameter/onchange" ] -then - cat "$__object/parameter/onchange" -fi diff --git a/cdist/conf/type/__sed/man.rst b/cdist/conf/type/__sed/man.rst deleted file mode 100644 index 86789363..00000000 --- a/cdist/conf/type/__sed/man.rst +++ /dev/null @@ -1,57 +0,0 @@ -cdist-type__sed(7) -================== - -NAME ----- -cdist-type__sed - Transform text files with ``sed`` - - -DESCRIPTION ------------ -Transform text files with ``sed``. - - -REQUIRED MULTIPLE PARAMETERS ----------------------------- -script - ``sed`` script. - If ``-`` then the script is read from ``stdin``. - - -OPTIONAL PARAMETERS -------------------- -file - Path to the file. Defaults to ``$__object_id``. - -onchange - Execute this command if ``sed`` changes file. - - -BOOLEAN PARAMETERS ------------------- -regexp-extended - Use extended regular expressions in the script. - Might not be supported with every ``sed`` version. - - -EXAMPLES --------- - -.. code-block:: sh - - __sed /tmp/foobar --script 's/foo/bar/' - - echo 's/foo/bar/' | __sed foobar --file /tmp/foobar --script - - - -AUTHORS -------- -Ander Punnar - - -COPYING -------- -Copyright \(C) 2021 Ander Punnar. You can redistribute it and/or modify it -under the terms of the GNU General Public License as published by the Free -Software Foundation, either version 3 of the License, or (at your option) -any later version. diff --git a/cdist/conf/type/__sed/parameter/boolean b/cdist/conf/type/__sed/parameter/boolean deleted file mode 100644 index 1ad75c5d..00000000 --- a/cdist/conf/type/__sed/parameter/boolean +++ /dev/null @@ -1 +0,0 @@ -regexp-extended diff --git a/cdist/conf/type/__sed/parameter/optional b/cdist/conf/type/__sed/parameter/optional deleted file mode 100644 index fa86f917..00000000 --- a/cdist/conf/type/__sed/parameter/optional +++ /dev/null @@ -1,2 +0,0 @@ -file -onchange diff --git a/cdist/conf/type/__sed/parameter/required_multiple b/cdist/conf/type/__sed/parameter/required_multiple deleted file mode 100644 index 84f7e31d..00000000 --- a/cdist/conf/type/__sed/parameter/required_multiple +++ /dev/null @@ -1 +0,0 @@ -script diff --git a/cdist/conf/type/__service/explorer/service-manager b/cdist/conf/type/__service/explorer/service-manager deleted file mode 100755 index 55a873fa..00000000 --- a/cdist/conf/type/__service/explorer/service-manager +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/sh - -# Assume systemd if systemctl is in PATH. -if [ "$(command -v systemctl)" ]; then - printf "systemd" -else - printf "unknown" -fi diff --git a/cdist/conf/type/__service/gencode-remote b/cdist/conf/type/__service/gencode-remote deleted file mode 100755 index ac62e05f..00000000 --- a/cdist/conf/type/__service/gencode-remote +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/sh - -manager="$(cat "$__object/explorer/service-manager")" -name=$__object_id -action="$(cat "$__object/parameter/action")" - -if [ "$manager" = "unknown" ]; then - echo "service '$name' '$action'" -fi diff --git a/cdist/conf/type/__service/man.rst b/cdist/conf/type/__service/man.rst deleted file mode 100644 index f9b23d5b..00000000 --- a/cdist/conf/type/__service/man.rst +++ /dev/null @@ -1,51 +0,0 @@ -cdist-type__service(7) -====================== - -NAME ----- -cdist-type__service - Run action on a system service - - -DESCRIPTION ------------ -This type allows you to run an action against a system service. - - -REQUIRED PARAMETERS -------------------- -action - Arbitrary parameter passed as action. Usually 'start', 'stop', 'reload' or 'restart'. - -OPTIONAL PARAMETERS -------------------- -None. - - -BOOLEAN PARAMETERS ------------------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # Restart nginx service. - __service nginx --action restart - - # Stop postfix service. - __service postfix --action stop - - -AUTHORS -------- -Timothée Floure - - -COPYING -------- -Copyright \(C) 2019 Timothée Floure. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__service/manifest b/cdist/conf/type/__service/manifest deleted file mode 100644 index beb0713c..00000000 --- a/cdist/conf/type/__service/manifest +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/sh - -manager="$(cat "$__object/explorer/service-manager")" - -name=$__object_id -action="$(cat "$__object/parameter/action")" - -case "$manager" in - systemd) - test "$action" = "start" && action="running" - test "$action" = "stop" && action="stopped" - __systemd_service "$name" --state "$action" - ;; - *) - # Unknown: handled by `service $NAME $action` in gencode-remote. - ;; -esac diff --git a/cdist/conf/type/__service/parameter/required b/cdist/conf/type/__service/parameter/required deleted file mode 100644 index a9f84d41..00000000 --- a/cdist/conf/type/__service/parameter/required +++ /dev/null @@ -1 +0,0 @@ -action diff --git a/cdist/conf/type/__snakeoil_cert/explorer/ssl-cert-group b/cdist/conf/type/__snakeoil_cert/explorer/ssl-cert-group deleted file mode 100755 index a6cb3dfd..00000000 --- a/cdist/conf/type/__snakeoil_cert/explorer/ssl-cert-group +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/sh -e - -if grep -Eq '^ssl-cert:' /etc/group -then - echo 'present' -else - echo 'absent' -fi diff --git a/cdist/conf/type/__snakeoil_cert/explorer/state b/cdist/conf/type/__snakeoil_cert/explorer/state deleted file mode 100755 index cc5aae0b..00000000 --- a/cdist/conf/type/__snakeoil_cert/explorer/state +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/sh -e - -key_path="$( cat "$__object/parameter/key-path" )" - -if echo "$key_path" | grep -Fq '%s' -then - # shellcheck disable=SC2059 - key_path="$( printf "$key_path" "$__object_id" )" -fi - -cert_path="$( cat "$__object/parameter/cert-path" )" - -if echo "$cert_path" | grep -Fq '%s' -then - # shellcheck disable=SC2059 - cert_path="$( printf "$cert_path" "$__object_id" )" -fi - -if [ ! -f "$key_path" ] || [ ! -f "$cert_path" ] -then - echo 'absent' -else - echo 'present' -fi diff --git a/cdist/conf/type/__snakeoil_cert/gencode-remote b/cdist/conf/type/__snakeoil_cert/gencode-remote deleted file mode 100755 index 8ffbfad1..00000000 --- a/cdist/conf/type/__snakeoil_cert/gencode-remote +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/sh -e - -state="$( cat "$__object/explorer/state" )" - -if [ "$state" = 'present' ] -then - exit 0 -fi - -if [ -f "$__object/parameter/common-name" ] -then - common_name="$( cat "$__object/parameter/common-name" )" -else - common_name="$__object_id" -fi - -key_path="$( cat "$__object/parameter/key-path" )" - -if echo "$key_path" | grep -Fq '%s' -then - # shellcheck disable=SC2059 - key_path="$( printf "$key_path" "$__object_id" )" -fi - -cert_path="$( cat "$__object/parameter/cert-path" )" - -if echo "$cert_path" | grep -Fq '%s' -then - # shellcheck disable=SC2059 - cert_path="$( printf "$cert_path" "$__object_id" )" -fi - -key_type="$( cat "$__object/parameter/key-type" )" - -key_type_arg="$( echo "$key_type" | cut -d : -f 2 )" - -case "$key_type" in - rsa:*) - echo "openssl genrsa -out '$key_path' $key_type_arg" - ;; - ec:*) - echo "openssl ecparam -name $key_type_arg -genkey -noout -out '$key_path'" - ;; -esac - -# shellcheck disable=SC2016 -echo 'csr_path="$( mktemp )"' - -echo "openssl req -new -subj '/CN=$common_name' -key '$key_path' -out \"\$csr_path\"" - -echo "openssl x509 -req -sha256 -days 3650 -in \"\$csr_path\" -signkey '$key_path' -out '$cert_path'" - -# shellcheck disable=SC2016 -echo 'rm -f "$csr_path"' - -if [ "$( cat "$__object/explorer/ssl-cert-group" )" = 'present' ] -then - key_group='ssl-cert' -else - key_group='root' -fi - -echo "chmod 640 '$key_path'" - -echo "chown root '$key_path'" - -echo "chgrp $key_group '$key_path'" - -echo "chmod 644 '$cert_path'" - -echo "chown root '$cert_path'" - -echo "chgrp root '$cert_path'" diff --git a/cdist/conf/type/__snakeoil_cert/man.rst b/cdist/conf/type/__snakeoil_cert/man.rst deleted file mode 100644 index b0b0a2e9..00000000 --- a/cdist/conf/type/__snakeoil_cert/man.rst +++ /dev/null @@ -1,61 +0,0 @@ -cdist-type__snakeoil_cert(7) -============================ - -NAME ----- -cdist-type__snakeoil_cert - Generate self-signed certificate - - -DESCRIPTION ------------ -The purpose of this type is to generate **self-signed** certificate and private key -for **testing purposes**. Certificate will expire in 3650 days. - -Certificate's and key's access bits will be ``644`` and ``640`` respectively. -If target system has ``ssl-cert`` group, then it will be used as key's group. -Use ``require='__snakeoil_cert/...' __file ...`` to override. - - -OPTIONAL PARAMETERS -------------------- -common-name - Defaults to ``$__object_id``. - -key-path - ``%s`` in path will be replaced with ``$__object_id``. - Defaults to ``/etc/ssl/private/%s.pem``. - -key-type - Possible values are ``rsa:$bits`` and ``ec:$name``. - For possible EC names see ``openssl ecparam -list_curves``. - Defaults to ``rsa:2048``. - -cert-path - ``%s`` in path will be replaced with ``$__object_id``. - Defaults to ``/etc/ssl/certs/%s.pem``. - - -EXAMPLES --------- -.. code-block:: sh - - __snakeoil_cert localhost-rsa \ - --common-name localhost \ - --key-type rsa:4096 - - __snakeoil_cert localhost-ec \ - --common-name localhost \ - --key-type ec:prime256v1 - - -AUTHORS -------- -Ander Punnar - - -COPYING -------- -Copyright \(C) 2021 Ander Punnar. You can redistribute it and/or modify it -under the terms of the GNU General Public License as published by the Free -Software Foundation, either version 3 of the License, or (at your option) -any later version. diff --git a/cdist/conf/type/__snakeoil_cert/parameter/default/cert-path b/cdist/conf/type/__snakeoil_cert/parameter/default/cert-path deleted file mode 100644 index 4bbae089..00000000 --- a/cdist/conf/type/__snakeoil_cert/parameter/default/cert-path +++ /dev/null @@ -1 +0,0 @@ -/etc/ssl/certs/%s.pem diff --git a/cdist/conf/type/__snakeoil_cert/parameter/default/key-path b/cdist/conf/type/__snakeoil_cert/parameter/default/key-path deleted file mode 100644 index 86eb9359..00000000 --- a/cdist/conf/type/__snakeoil_cert/parameter/default/key-path +++ /dev/null @@ -1 +0,0 @@ -/etc/ssl/private/%s.pem diff --git a/cdist/conf/type/__snakeoil_cert/parameter/default/key-type b/cdist/conf/type/__snakeoil_cert/parameter/default/key-type deleted file mode 100644 index f13f8ada..00000000 --- a/cdist/conf/type/__snakeoil_cert/parameter/default/key-type +++ /dev/null @@ -1 +0,0 @@ -rsa:2048 diff --git a/cdist/conf/type/__snakeoil_cert/parameter/optional b/cdist/conf/type/__snakeoil_cert/parameter/optional deleted file mode 100644 index 76d08c0a..00000000 --- a/cdist/conf/type/__snakeoil_cert/parameter/optional +++ /dev/null @@ -1,4 +0,0 @@ -common-name -key-path -key-type -cert-path diff --git a/cdist/conf/type/__ssh_authorized_key/explorer/entry b/cdist/conf/type/__ssh_authorized_key/explorer/entry index aca0f2b9..ccab0afc 100755 --- a/cdist/conf/type/__ssh_authorized_key/explorer/entry +++ b/cdist/conf/type/__ssh_authorized_key/explorer/entry @@ -25,7 +25,6 @@ type_and_key="$(tr ' ' '\n' < "$__object/parameter/key"| awk '/^(ssh|ecdsa)-[^ ] if [ -n "${type_and_key}" ] then file="$(cat "$__object/parameter/file")" - test -e "$file" || exit 0 # get any entries that match the type and key diff --git a/cdist/conf/type/__ssh_authorized_key/gencode-remote b/cdist/conf/type/__ssh_authorized_key/gencode-remote index cbffde94..f37aa565 100755 --- a/cdist/conf/type/__ssh_authorized_key/gencode-remote +++ b/cdist/conf/type/__ssh_authorized_key/gencode-remote @@ -37,10 +37,9 @@ tmpfile=\$(mktemp ${file}.cdist.XXXXXXXXXX) # preserve ownership and permissions of existing file if [ -f "$file" ]; then cp -p "$file" "\$tmpfile" - grep -v -F -x '$line' '$file' >\$tmpfile fi -cat "\$tmpfile" >"$file" -rm -f "\$tmpfile" +grep -v -F -x '$line' '$file' > \$tmpfile || true +mv -f "\$tmpfile" "$file" DONE } diff --git a/cdist/conf/type/__ssh_authorized_key/man.rst b/cdist/conf/type/__ssh_authorized_key/man.rst index 5bae02aa..087a3dae 100644 --- a/cdist/conf/type/__ssh_authorized_key/man.rst +++ b/cdist/conf/type/__ssh_authorized_key/man.rst @@ -15,27 +15,25 @@ This type was created to be used by the __ssh_authorized_keys type. REQUIRED PARAMETERS ------------------- file - The authorized_keys file where the given key should be managed. + the authorized_keys file to which the given key should be added key - The ssh key which shall be managed in this authorized_keys file. - Must be a string containing the ssh keytype, base 64 encoded key and - optional trailing comment which shall be added to the given - authorized_keys file. + a string containing the ssh keytype, base 64 encoded key and optional + trailing comment which shall be added to the given authorized_keys file. OPTIONAL PARAMETERS ------------------- comment - Use this comment instead of the one which may be trailing in the key. + explicit comment instead of the one which may be trailing the given key option - An option to set for this authorized_key entry. + an option to set for this authorized_key entry. Can be specified multiple times. See sshd(8) for available options. state - If the managed key should be 'present' or 'absent', defaults to 'present'. + if the given keys should be 'present' or 'absent', defaults to 'present'. MESSAGES @@ -66,7 +64,7 @@ EXAMPLES SEE ALSO -------- -:strong:`cdist-type__ssh_authorized_keys`\ (7), :strong:`sshd`\ (8) +:strong:`cdist__ssh_authorized_keys`\ (7), :strong:`sshd`\ (8) AUTHORS diff --git a/cdist/conf/type/__ssh_authorized_keys/explorer/keys b/cdist/conf/type/__ssh_authorized_keys/explorer/keys deleted file mode 100755 index 9694a64b..00000000 --- a/cdist/conf/type/__ssh_authorized_keys/explorer/keys +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/sh -e - -# shellcheck disable=SC1090 -# shellcheck disable=SC1091 -file="$( . "$__type_explorer/file" )" - -if [ -f "$file" ] -then - cat "$file" -fi diff --git a/cdist/conf/type/__ssh_authorized_keys/man.rst b/cdist/conf/type/__ssh_authorized_keys/man.rst index dac6adeb..ba310ff9 100644 --- a/cdist/conf/type/__ssh_authorized_keys/man.rst +++ b/cdist/conf/type/__ssh_authorized_keys/man.rst @@ -20,48 +20,42 @@ then left to the user to ensure that the file exists and that ownership and permissions work with ssh. -REQUIRED MULTIPLE PARAMETERS ----------------------------- +REQUIRED PARAMETERS +------------------- key - An ssh key which shall be managed in this authorized_keys file. - Must be a string containing the ssh keytype, base 64 encoded key and - optional trailing comment which shall be added to the given - authorized_keys file. - Can be specified multiple times. + the ssh key which shall be added to this authorized_keys file. + Must be a string and can be specified multiple times. OPTIONAL PARAMETERS ------------------- comment - Use this comment instead of the one which may be trailing in each key. + explicit comment instead of the one which may be trailing the given key file - An alternative destination file, defaults to ~$owner/.ssh/authorized_keys. + an alternative destination file, defaults to ~$owner/.ssh/authorized_keys option - An option to set for all authorized_key entries in the key parameter. + an option to set for all created authorized_key entries. Can be specified multiple times. See sshd(8) for available options. owner - The user owning the authorized_keys file, defaults to object_id. + the user owning the authorized_keys file, defaults to object_id. state - If the given keys should be 'present' or 'absent', defaults to 'present'. + if the given keys should be 'present' or 'absent', defaults to 'present'. BOOLEAN PARAMETERS ------------------ noparent - Don't create or change ownership and permissions of the directory containing - the authorized_keys file. + don't create or change ownership and permissions of the directory containing + the authorized_keys file nofile - Don't manage existence, ownership and permissions of the the authorized_keys - file. - -remove-unknown - Remove undefined keys. + don't manage existence, ownership and permissions of the the authorized_keys + file EXAMPLES @@ -73,12 +67,6 @@ EXAMPLES __ssh_authorized_keys root \ --key "$(cat ~/.ssh/id_rsa.pub)" - # same as above, but make sure your key is only key in - # root's authorized_keys file - __ssh_authorized_keys root \ - --key "$(cat ~/.ssh/id_rsa.pub)" \ - --remove-unknown - # allow key to login as user-name __ssh_authorized_keys user-name \ --key "ssh-rsa AXYZAAB3NzaC1yc2..." diff --git a/cdist/conf/type/__ssh_authorized_keys/manifest b/cdist/conf/type/__ssh_authorized_keys/manifest index b319316b..b9f0582e 100755 --- a/cdist/conf/type/__ssh_authorized_keys/manifest +++ b/cdist/conf/type/__ssh_authorized_keys/manifest @@ -55,12 +55,8 @@ _cksum() { echo "$1" | cksum | cut -d' ' -f 1 } -_type_and_key() { - echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }' -} - while read -r key; do - type_and_key="$( _type_and_key "$key" )" + type_and_key="$(echo "$key" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')" object_id="$(_cksum "$file")-$(_cksum "$type_and_key")" set -- "$object_id" set -- "$@" --file "$file" @@ -76,24 +72,3 @@ while read -r key; do # Ensure __ssh_authorized_key does not read stdin __ssh_authorized_key "$@" < /dev/null done < "$__object/parameter/key" - -if [ -f "$__object/parameter/remove-unknown" ] && - [ -s "$__object/explorer/keys" ] -then - while read -r key - do - type_and_key="$( _type_and_key "$key" )" - - if grep -Fq "$type_and_key" "$__object/parameter/key" - then - continue - fi - - __ssh_authorized_key "remove-$( _cksum "$file$key" )" \ - --file "$file" \ - --key "$key" \ - --state absent \ - < /dev/null - done \ - < "$__object/explorer/keys" -fi diff --git a/cdist/conf/type/__ssh_authorized_keys/parameter/boolean b/cdist/conf/type/__ssh_authorized_keys/parameter/boolean index 7388fed5..4bb126fe 100644 --- a/cdist/conf/type/__ssh_authorized_keys/parameter/boolean +++ b/cdist/conf/type/__ssh_authorized_keys/parameter/boolean @@ -1,3 +1,2 @@ noparent nofile -remove-unknown diff --git a/cdist/conf/type/__ssh_authorized_keys/parameter/optional b/cdist/conf/type/__ssh_authorized_keys/parameter/optional index fa64fc43..21f9bc29 100644 --- a/cdist/conf/type/__ssh_authorized_keys/parameter/optional +++ b/cdist/conf/type/__ssh_authorized_keys/parameter/optional @@ -1,4 +1,5 @@ comment file +option owner state diff --git a/cdist/conf/type/__ssh_authorized_keys/parameter/optional_multiple b/cdist/conf/type/__ssh_authorized_keys/parameter/optional_multiple deleted file mode 100644 index 01925a15..00000000 --- a/cdist/conf/type/__ssh_authorized_keys/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -option diff --git a/cdist/conf/type/__sshd_config/explorer/state b/cdist/conf/type/__sshd_config/explorer/state deleted file mode 100644 index 75c68b8a..00000000 --- a/cdist/conf/type/__sshd_config/explorer/state +++ /dev/null @@ -1,121 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# Determines the current state of the config option. -# Possible output: -# - present: "should" option present in config file -# - default: the "should" option is the default -> don’t know if present -# - absent: no such option present in config file -# - -joinlines() { sed -n -e H -e "\${x;s/^\\n//;s/\\n/${1:?}/g;p;}"; } -trlower() { tr '[:upper:]' '[:lower:]'; } -tolower() { printf '%s' "$*" | trlower; } - -default_value() { - sshd -T -f /dev/null -C "$(make_conn_spec)" \ - | sed -n -e 's/^'"$(tolower "${1:?}")"'[[:blank:]]\{1,\}//p' -} - -make_conn_spec() { - if test -s "${__object:?}/parameter/match" - then - _match_file="${__object:?}/parameter/match" - else - _match_file='/dev/null' - fi - - for _kw in \ - addr=Address \ - user=User \ - host=Host \ - laddr=LocalAddress \ - lport=LocalPort \ - rdomain=RDomain - do - _specname=${_kw%%=*} - _confname=$(tolower "${_kw#*=}") - while read -r _k _v - do - if test "$(tolower "${_k}")" = "${_confname}" - then - printf '%s=%s\n' "${_specname}" "${_v}" - continue 2 - fi - done <"${_match_file}" - - # NOTE: Print test spec even for empty keys to suppress errors like: - # 'Match User' in configuration but 'user' not in connection test specification. - # except lport: - # Invalid port '' in test mode specification lport= - test "${_specname}" = 'lport' || printf '%s=\n' "${_specname}" - done \ - | joinlines ',' - unset _match_file -} - -sshd_config_file=$(cat "${__object:?}/parameter/file") -state_should=$(cat "${__object:?}/parameter/state") - -if test -s "${__object:?}/parameter/option" -then - option_name=$(cat "${__object:?}/parameter/option") -else - option_name=${__object_id:?} -fi - -value_should=$(cat "${__object:?}/parameter/value" 2>/dev/null) \ -|| test "${state_should}" = absent || exit 0 # param optional if --state absent - -command -v sshd >/dev/null 2>&1 || { - echo 'Cannot find sshd.' >&2 - exit 1 -} - -test -e "${sshd_config_file}" || { - echo 'absent' - exit 0 -} - -value_is=$( - sshd -T -f "${sshd_config_file}" -C "$(make_conn_spec)" \ - | sed -n -e 's/^'"$(tolower "${option_name}")"'[[:blank:]]\{1,\}//p') - -if printf '%s\n' "${value_is}" | { - if test -n "${value_should}" - then - grep -q -x -F "${value_should}" - else - # if no value provided, assume "any" value - grep -q -e . - fi - } -then - if default_value "${option_name}" | grep -q -x -F "${value_is}" - then - # Might produce false positives for default values. - # TODO: Manual checking should be done, but for simplicity, this case is - # currently ignored here. - echo default - else - echo present - fi -else - echo absent -fi diff --git a/cdist/conf/type/__sshd_config/files/update_sshd_config.awk b/cdist/conf/type/__sshd_config/files/update_sshd_config.awk deleted file mode 100644 index f7f30e87..00000000 --- a/cdist/conf/type/__sshd_config/files/update_sshd_config.awk +++ /dev/null @@ -1,293 +0,0 @@ -# -*- mode: awk; indent-tabs-mode: t -*- - -function usage() { - print_err("Usage: awk -f update_sshd_config.awk -- -o set|unset [-m 'User git'] -l 'X11Forwarding no' /etc/ssh/sshd_config") -} - -function print_err(s) { print s | "cat >&2" } - -function alength(a, i) { - for (i = 0; (i + 1) in a; ++i); - return i -} - -function join(sep, a, i, s) { - for (i = i ? i : 1; i in a; i++) - s = s sep a[i] - return substr(s, 2) -} - -function getopt(opts, argv, target, files, i, c, lv, idx, nf) { - # trivial getopt(3) implementation; only basic functionality - if (argv[1] == "--") i++ - for (i += 1; i in argv; i++) { - if (lv) { target[c] = argv[i]; lv = 0; continue } - if (argv[i] ~ /^-/) { - c = substr(argv[i], 2, 1) - idx = index(opts, c) - if (!idx) { - print_err(sprintf("invalid option -%c\n", c)) - continue - } - if (substr(opts, idx + 1, 1) == ":") { - # option takes argument - if (length(argv[i]) > 2) - target[c] = substr(argv[i], 3) - else - lv = 1 - } else { - target[c] = 1 - } - } else - files[++nf] = argv[i] - } -} - -# tokenise configuration line -# this function mimics the counterpart in OpenSSH (misc.c) -# but it returns two (next token SUBSEP rest) because I didn’t want to have to -# simulate any pointer magic. -function strdelim_internal(s, split_equals, old) { - if (!s) - return "" - - old = s - - if (!match(s, WHITESPACE "|" QUOTE "" (split_equals ? "|" EQUALS : ""))) - return s - - s = substr(s, RSTART) - old = substr(old, 1, RSTART - 1) - - if (s ~ "^" QUOTE) { - old = substr(old, 2) - - # Find matching quote - if (match(s, QUOTE)) { - old = substr(old, 1, RSTART) - # s = substr() - if (match(s, "^" WHITESPACE "*")) - s = substr(s, RLENGTH) - return old - } else { - # no matching quote - return "" - } - } - - if (match(s, "^" WHITESPACE "+")) { - sub("^" WHITESPACE "+", "", s) - if (split_equals) - sub(EQUALS WHITESPACE "*", "", s) - } else if (s ~ "^" EQUALS) { - s = substr(s, 2) - } - - return old SUBSEP s -} -function strdelim(s) { return strdelim_internal(s, 1) } -function strdelimw(s) { return strdelim_internal(s, 0) } - -function singleton_option(opt) { - return tolower(opt) !~ /^(acceptenv|allowgroups|allowusers|denygroups|denyusers|hostcertificate|hostkey|listenaddress|logverbose|permitlisten|permitopen|port|setenv|subsystem)$/ -} - -function print_update() { - if (mode) { - if (match_only) printf "\t" - printf "%s\n", line_should - updated = 1 - } -} - -BEGIN { - FS = "\n" # disable field splitting - - WHITESPACE = "[ \t]" # servconf.c, misc.c:strdelim_internal (without line breaks, cf. bugs) - QUOTE = "[\"]" # misc.c:strdelim_internal - EQUALS = "[=]" - - split("", opts) - split("", files) - getopt("ho:l:m:", ARGV, opts, files) - - if (opts["h"]) { usage(); exit (e="0") } - - line_should = opts["l"] - match_only = opts["m"] - num_files = alength(files) - - if (num_files != 1 || !opts["o"] || !line_should) { - usage() - exit (e=126) - } - - if (opts["o"] == "set") { - mode = 1 - } else if (opts["o"] == "unset") { - mode = 0 - } else { - print_err(sprintf("invalid mode %s\n", mode)) - exit (e=1) - } - - if (mode) { - # loop over sshd_config twice! - ARGV[2] = ARGV[1] = files[1] - ARGC = 3 - } else { - # only loop once - ARGV[1] = files[1] - ARGC = 2 - } - - split(strdelim(line_should), should, SUBSEP) - option_should = tolower(should[1]) - value_should = should[2] -} - -{ - line = $0 - - # Strip trailing whitespace. Allow \f (form feed) at EOL only - sub("(" WHITESPACE "|\f)*$", "", line) - - # Strip leading whitespace - sub("^" WHITESPACE "*", "", line) - - if (match(line, "^#" WHITESPACE "*")) { - prefix = substr(line, RSTART, RLENGTH) - line = substr(line, RSTART + RLENGTH) - } else { - prefix = "" - } - - line_type = "invalid" - option_is = value_is = "" - - if (line) { - split(strdelim(line), toks, SUBSEP) - - if (tolower(toks[1]) == "match") { - MATCH = (prefix ~ /^#/ ? "#" : "") join(" ", toks, 2) - line_type = "match" - } else if (toks[1] ~ /^[A-Za-z][A-Za-z0-9]+$/) { - # This could be an option line - line_type = "option" - option_is = tolower(toks[1]) - value_is = toks[2] - } - } else { - line_type = "empty" - } -} - -# mode: unset - -!mode { - # delete matching config - if (prefix !~ /^#/) - if (MATCH == match_only && option_is == option_should) - if (!value_should || value_should == value_is) - next - - print - next -} - - -# mode: set - -mode && NR == FNR { - if (line_type == "option") { - if (MATCH !~ /^#/) { - if (prefix ~ /^#/) { - # comment line - last_occ[MATCH, "#" option_is] = FNR - } else { - # option line - last_occ[MATCH, option_is] = FNR - } - last_occ[MATCH] = FNR - } - } else if (line_type == "invalid" && !prefix) { - # INVALID LINE - print_err(sprintf("%s: syntax error on line %u\n", ARGV[0], FNR)) - } - - next -} - -# before second pass prepare hashes containing location information to be used -# in the second pass. -mode && NR > FNR && FNR == 1 { - # First we drop the locations of commented-out options if a non-commented - # option is available. If a non-commented option is available, we will - # append new config options there to have them all at one place. - for (k in last_occ) { - if (k ~ /^#/) { - # delete entries of commented out match blocks - delete last_occ[k] - continue - } - - split(k, parts, SUBSEP) - - if (parts[2] ~ /^#/ && ((parts[1], substr(parts[2], 2)) in last_occ)) - delete last_occ[k] - } - - # Reverse the option => line mapping. The line_map allows for easier lookups - # in the second pass. - # We only keep options, not top-level keywords, because we can only have - # one entry per line and there are conflicts with last lines of "sections". - for (k in last_occ) { - if (!index(k, SUBSEP)) continue - line_map[last_occ[k]] = k - } -} - -# Second pass -mode && line_map[FNR] == match_only SUBSEP option_should && !updated { - split(line_map[FNR], parts, SUBSEP) - - # If option allows multiple values, print current value - if (!singleton_option(parts[2])) { - if (value_should != value_is) - print - } - - print_update() - - next -} - -mode { print } - -# Is a comment option -mode && line_map[FNR] == match_only SUBSEP "#" option_should && !updated { - print_update() -} - -# Last line of the should match section -mode && last_occ[match_only] == FNR && !updated { - # NOTE: Inserting empty lines is only cosmetic. It is only done if - # different options are next to each other and not in a match block - # (match blocks are usually not in the default config and thus don’t - # contain commented blocks.) - if (line && option_is != option_should && !MATCH) - print "" - print_update() -} - -END { - if (e) exit e - - if (mode && !updated) { - if (match_only && MATCH != match_only) { - printf "\nMatch %s\n", match_only - } - - print_update() - } -} diff --git a/cdist/conf/type/__sshd_config/gencode-remote b/cdist/conf/type/__sshd_config/gencode-remote deleted file mode 100755 index 275db4aa..00000000 --- a/cdist/conf/type/__sshd_config/gencode-remote +++ /dev/null @@ -1,98 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -joinlines() { sed -n -e H -e "\${x;s/^\\n//;s/\\n/${1:?}/g;p;}"; } - -state_is=$(cat "${__object:?}/explorer/state") -state_should=$(cat "${__object:?}/parameter/state") - -if test "${state_is}" = "${state_should}" -o "${state_is}" = 'default' -then - # nothing to do (if the value is the default, ignore its state) - exit 0 -fi - -case ${state_should} -in - (present) - mode='set' - ;; - (absent) - mode='unset' - ;; - (*) - printf 'Invalid --state: %s\n' "${state_should}" >&2 - exit 1 - ;; -esac - -sshd_config_file=$(cat "${__object:?}/parameter/file") - -quote() { printf "'%s'" "$(printf '%s' "$*" | sed -e "s/'/'\\\\''/g")"; } -drop_awk_comments() { quote "$(sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@")"; } - -# Ensure the sshd_config file is there -cat <$(quote "${sshd_config_file}") - chown 0:0 $(quote "${sshd_config_file}") - chmod 0644 $(quote "${sshd_config_file}") -} - -EOF - -match_only= -if test -s "${__object:?}/parameter/match" -then - match_only=$(joinlines ' ' <"${__object:?}/parameter/match") -fi - -if test -s "${__object:?}/parameter/option" -then - option_line=$(cat "${__object:?}/parameter/option") -else - option_line=${__object_id:?} -fi - -if test -s "${__object:?}/parameter/value" -then - option_line="${option_line} $(cat "${__object:?}/parameter/value")" -fi - -# Send message on config update -printf '%s%s %s\n' "${mode}" "${match_only:+ [${match_only}]}" \ - "${option_line}" >>"${__messages_out:?}" - -# Update sshd_config (remote code) -cat <$(quote "${sshd_config_file}.tmp") \\ -|| exit - -cmp -s $(quote "${sshd_config_file}") $(quote "${sshd_config_file}.tmp") || { - sshd -t -f $(quote "${sshd_config_file}.tmp") \\ - && cat $(quote "${sshd_config_file}.tmp") >$(quote "${sshd_config_file}") \\ - || exit # stop if sshd_config file check fails -} -rm -f $(quote "${sshd_config_file}.tmp") -EOF diff --git a/cdist/conf/type/__sshd_config/man.rst b/cdist/conf/type/__sshd_config/man.rst deleted file mode 100644 index c8e6b8ad..00000000 --- a/cdist/conf/type/__sshd_config/man.rst +++ /dev/null @@ -1,98 +0,0 @@ -cdist-type__sshd_config(7) -========================== - -NAME ----- -cdist-type__sshd_config - Manage options in sshd_config - - -DESCRIPTION ------------ -This space intentionally left blank. - - -REQUIRED PARAMETERS -------------------- -None. - - -OPTIONAL PARAMETERS -------------------- -file - The path to the sshd_config file to edit. - Defaults to ``/etc/ssh/sshd_config``. -match - Restrict this option to apply only for certain connections. - Allowed values are what would be allowed to be written after a ``Match`` - keyword in ``sshd_config``, e.g. ``--match 'User anoncvs'``. - - Can be used multiple times. All of the values are ANDed together. -option - The name of the option to manipulate. Defaults to ``__object_id``. -state - Can be: - - - ``present``: ensure a matching config line is present (or the default - value). - - ``absent``: ensure no matching config line is present. -value - The option's value to be assigned to the option (if ``--state present``) or - removed (if ``--state absent``). - - This option is required if ``--state present``. If not specified and - ``--state absent``, all values for the given option are removed. - - -BOOLEAN PARAMETERS ------------------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # Disallow root logins with password - __sshd_config PermitRootLogin --value without-password - - # Disallow password-based authentication - __sshd_config PasswordAuthentication --value no - - # Accept the EDITOR environment variable - __sshd_config AcceptEnv:EDITOR --option AcceptEnv --value EDITOR - - # Force command for connections as git user - __sshd_config git@ForceCommand --match 'User git' --option ForceCommand \ - --value 'cd ~git && exec git-shell ${SSH_ORIGINAL_COMMAND:+-c "${SSH_ORIGINAL_COMMAND}"}' - - -SEE ALSO --------- -:strong:`sshd_config`\ (5) - - -BUGS ----- -- This type assumes a nicely formatted config file, - i.e. no config options spanning multiple lines. -- ``Include`` directives are ignored. -- Config options are not added/removed to/from the config file if their value is - the default value. -- | The explorer will incorrectly report ``absent`` if OpenSSH internally - transforms one value to another (e.g. ``permitrootlogin prohibit-password`` - is transformed to ``permitrootlogin without-password``). - | Workaround: Use the value that OpenSSH uses internally. - - -AUTHORS -------- -Dennis Camera - - -COPYING -------- -Copyright \(C) 2020 Dennis Camera. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__sshd_config/manifest b/cdist/conf/type/__sshd_config/manifest deleted file mode 100755 index e37afebb..00000000 --- a/cdist/conf/type/__sshd_config/manifest +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -os=$(cat "${__global:?}/explorer/os") - -state_should=$(cat "${__object:?}/parameter/state") - -case ${os} -in - (alpine|centos|fedora|redhat|scientific|debian|devuan|ubuntu) - if test "${state_should}" != 'absent' - then - __package openssh-server --state present - fi - ;; - (archlinux|gentoo|slackware|suse) - if test "${state_should}" != 'absent' - then - __package openssh --state present - fi - ;; - (freebsd|netbsd|openbsd) - # whitelist - ;; - (openbmc-phosphor) - # whitelist - # OpenBMC can be configured with dropbear and OpenSSH. - # If dropbear is used, the state explorer will already fail because it - # cannot find the sshd binary. - ;; - (*) - : "${__type:?}" # make shellcheck happy - printf 'Your operating system (%s) is currently not supported by this type (%s)\n' \ - "${os}" "${__type##*/}" >&2 - printf 'Please contribute an implementation for it if you can.\n' >&2 - exit 1 - ;; -esac diff --git a/cdist/conf/type/__sshd_config/parameter/default/file b/cdist/conf/type/__sshd_config/parameter/default/file deleted file mode 100644 index d8ea5dfc..00000000 --- a/cdist/conf/type/__sshd_config/parameter/default/file +++ /dev/null @@ -1 +0,0 @@ -/etc/ssh/sshd_config diff --git a/cdist/conf/type/__sshd_config/parameter/default/state b/cdist/conf/type/__sshd_config/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__sshd_config/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__sshd_config/parameter/optional b/cdist/conf/type/__sshd_config/parameter/optional deleted file mode 100644 index 922ab093..00000000 --- a/cdist/conf/type/__sshd_config/parameter/optional +++ /dev/null @@ -1,4 +0,0 @@ -file -option -state -value diff --git a/cdist/conf/type/__sshd_config/parameter/optional_multiple b/cdist/conf/type/__sshd_config/parameter/optional_multiple deleted file mode 100644 index 02b1d1a9..00000000 --- a/cdist/conf/type/__sshd_config/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -match diff --git a/cdist/conf/type/__start_on_boot/man.rst b/cdist/conf/type/__start_on_boot/man.rst index f8afe94b..b7c73ab1 100644 --- a/cdist/conf/type/__start_on_boot/man.rst +++ b/cdist/conf/type/__start_on_boot/man.rst @@ -12,7 +12,7 @@ This cdist type allows you to enable or disable stuff to be started at boot of your operating system. Warning: This type has not been tested intensively and is not fully -supported. +supported (i.e. \*BSD are not implemented). REQUIRED PARAMETERS diff --git a/cdist/conf/type/__sysctl/explorer/value b/cdist/conf/type/__sysctl/explorer/value index 3e93c151..fc85b3d8 100755 --- a/cdist/conf/type/__sysctl/explorer/value +++ b/cdist/conf/type/__sysctl/explorer/value @@ -1,4 +1,4 @@ -#!/bin/sh -e +#!/bin/sh # # 2014 Steven Armstrong (steven-cdist at armstrong.cc) # @@ -18,10 +18,5 @@ # along with cdist. If not, see . # -if test "$(uname -s)" = NetBSD -then - PATH=$(getconf PATH) -fi - # get the current runtime value -sysctl -n "${__object_id}" || true +sysctl -n "$__object_id" || true diff --git a/cdist/conf/type/__sysctl/gencode-remote b/cdist/conf/type/__sysctl/gencode-remote index f0f6deef..711d54e5 100755 --- a/cdist/conf/type/__sysctl/gencode-remote +++ b/cdist/conf/type/__sysctl/gencode-remote @@ -44,8 +44,6 @@ case "$os" in flag='-w' ;; netbsd) - # shellcheck disable=SC2016 - echo 'PATH=$(getconf PATH)' flag='-w' ;; freebsd|openbsd) diff --git a/cdist/conf/type/__sysctl/man.rst b/cdist/conf/type/__sysctl/man.rst index dbb9a1ac..6873003e 100644 --- a/cdist/conf/type/__sysctl/man.rst +++ b/cdist/conf/type/__sysctl/man.rst @@ -26,13 +26,6 @@ EXAMPLES __sysctl net.ipv4.ip_forward --value 1 - # On some operating systems, e.g. NetBSD, to prevent an error if the - # MIB style name does not exist (e.g. optional kernel components), - # name and value can be separated by `?=`. The same effect can be achieved - # in cdist by appending a `?` to the key: - - __sysctl ddb.onpanic? --value -1 - AUTHORS ------- diff --git a/cdist/conf/type/__systemd_service/explorer/state b/cdist/conf/type/__systemd_service/explorer/state deleted file mode 100755 index f5f751d4..00000000 --- a/cdist/conf/type/__systemd_service/explorer/state +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/sh -e -# explorer/state -# -# 2020 Matthias Stecher -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# Check if the service is running or stopped. -# -# The explorer must check before if the service exist, because 'systemctl is-active' -# will return "inactive" even if there is no service there: -# systemctl cat foo # does not exist -# systemctl is-active foo # is "inactive" - - -# get name of the service -if [ -f "$__object/parameter/name" ]; then - name="$(cat "$__object/parameter/name")" -else - name="$__object_id" -fi - - -# check if the service exist, else exit without output (also if systemd doesn't exist) -# do not exit here with an error code, will be done in the gencode-remote script -systemctl cat "$name" > /dev/null 2>&1 || exit 0 - -# print if the service is running or not -systemctl is-active -q "$name" && printf "running" || printf "stopped" diff --git a/cdist/conf/type/__systemd_service/gencode-remote b/cdist/conf/type/__systemd_service/gencode-remote deleted file mode 100755 index c867ff22..00000000 --- a/cdist/conf/type/__systemd_service/gencode-remote +++ /dev/null @@ -1,98 +0,0 @@ -#!/bin/sh -e -# gencode-remote -# -# 2020 Matthias Stecher -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# Checks the given state of the service and set it to the given -# state. Optionally, it executes the action if service running. - - -# get name of the service -name="$__object/parameter/name" -if [ -f "$name" ]; then - name="$(cat "$name")" -else - name="$__object_id" -fi - - -# read current status and parameters -state="$(cat "$__object/explorer/state")" -should="$(cat "$__object/parameter/state")" - -# if systemd/service does not exist -if [ -z "$state" ]; then - printf "systemd or service '%s' does not exist!\n" "$name" >&2 - exit 1 -fi - - -# save the action required -required_action="" - -# check the state of the service that should be -if [ "$state" != "$should" ]; then - # select what to do to get the $should state - case "$should" in - running) - if [ "$state" = "stopped" ]; then required_action="start"; fi - ;; - - stopped) - if [ "$state" = "running" ]; then required_action="stop"; fi - ;; - esac -fi - -# check if the action can be achieved if given -if [ -f "$__object/parameter/action" ] \ - && [ -z "$required_action" ] && [ "$state" = "running" ]; then - - # there must be an action - action="$(cat "$__object/parameter/action")" - - # select the action to the required element - case "$action" in - restart) - required_action="restart" - ;; - - reload) - required_action="reload" - ;; - - *) - printf "action '%s' does not exist!" "$action" >&2 - exit 2 - esac - - # Make a special check: only do this action if a dependency did something - # it is required that the dependencies write there action to $__messages_in - if [ -f "$__object/parameter/if-required" ]; then - # exit here if there are no changes from the dependencies affected (nothing to do) - if ! grep -q -f "$__object/require" "$__messages_in"; then exit 0; fi - fi -fi - -# print the execution command if a action given -if [ -n "$required_action" ]; then - # also print it as message - echo "$required_action" >> "$__messages_out" - echo "systemctl $required_action '$name'" -fi diff --git a/cdist/conf/type/__systemd_service/man.rst b/cdist/conf/type/__systemd_service/man.rst deleted file mode 100644 index cd14c985..00000000 --- a/cdist/conf/type/__systemd_service/man.rst +++ /dev/null @@ -1,117 +0,0 @@ -cdist-type__systemd_service(7) -============================== - -NAME ----- -cdist-type__systemd_service - Controls a systemd service state - - -DESCRIPTION ------------ -This type controls systemd services to define a state of the service, -or an action like reloading or restarting. It is useful to reload a -service after configuration applied or shutdown one service. - -The activation or deactivation is out of scope. Look for the -:strong:`cdist-type__systemd_util`\ (7) type instead. - - -REQUIRED PARAMETERS -------------------- -None. - - -OPTIONAL PARAMETERS -------------------- - -name - String which will used as name instead of the object id. - -state - The state which the service should be in: - - running - Service should run (default) - - stopped - Service should be stopped - -action - Executes an action on on the service. It will only execute it if the - service keeps the state ``running``. There are following actions, where: - - reload - Reloads the service - - restart - Restarts the service - -BOOLEAN PARAMETERS ------------------- - -if-required - Only execute the action if at minimum one required type outputs a message - to ``$__messages_out``. Through this, the action should only executed if a - dependency did something. The action will not executed if no dependencies - given. - - -MESSAGES --------- - -start - Started the service - -stop - Stopped the service - -restart - Restarted the service - -reload - Reloaded the service - - -ABORTS ------- -Aborts in following cases: - -systemd or the service does not exist - - -EXAMPLES --------- -.. code-block:: sh - - # service must run - __systemd_service nginx - - # service must stopped - __systemd_service sshd \ - --state stopped - - # restart the service - __systemd_service apache2 \ - --action restart - - # makes sure the service exist with an alternative name - __systemd_service foo \ - --name sshd - - # reload the service for a modified configuration file - # only reloads the service if the file really changed - require="__file/etc/foo.conf" __systemd_service foo \ - --action reload --if-required - - -AUTHORS -------- -Matthias Stecher - - -COPYRIGHT ---------- -Copyright \(C) 2020 Matthias Stecher. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__systemd_service/parameter/boolean b/cdist/conf/type/__systemd_service/parameter/boolean deleted file mode 100644 index a4bccb66..00000000 --- a/cdist/conf/type/__systemd_service/parameter/boolean +++ /dev/null @@ -1 +0,0 @@ -if-required diff --git a/cdist/conf/type/__systemd_service/parameter/default/state b/cdist/conf/type/__systemd_service/parameter/default/state deleted file mode 100644 index a2ae71b3..00000000 --- a/cdist/conf/type/__systemd_service/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -running diff --git a/cdist/conf/type/__systemd_service/parameter/optional b/cdist/conf/type/__systemd_service/parameter/optional deleted file mode 100644 index fc78265f..00000000 --- a/cdist/conf/type/__systemd_service/parameter/optional +++ /dev/null @@ -1,3 +0,0 @@ -name -state -action diff --git a/cdist/conf/type/__timezone/gencode-remote b/cdist/conf/type/__timezone/gencode-remote index d8612986..5299f548 100755 --- a/cdist/conf/type/__timezone/gencode-remote +++ b/cdist/conf/type/__timezone/gencode-remote @@ -22,7 +22,7 @@ # This type allows to configure the desired localtime timezone. timezone_is=$(cat "$__object/explorer/timezone_is") -timezone_should=$(cat "$__object/parameter/tz") +timezone_should="$__object_id" os=$(cat "$__global/explorer/os") if [ "$timezone_is" = "$timezone_should" ]; then @@ -34,12 +34,3 @@ case "$os" in echo "echo \"$timezone_should\" > /etc/timezone" ;; esac - -case "$os" in - openwrt) - cat < -| Nico Schottelius -| Ramon Salvadó -| Dennis Camera +Ramon Salvadó COPYING ------- -Copyright \(C) 2012-2020 the `AUTHORS`_. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. +Free use of this software is +granted under the terms of the GNU General Public License version 3 (GPLv3). diff --git a/cdist/conf/type/__timezone/manifest b/cdist/conf/type/__timezone/manifest index 307bec04..3d28ccba 100755 --- a/cdist/conf/type/__timezone/manifest +++ b/cdist/conf/type/__timezone/manifest @@ -22,7 +22,7 @@ # # This type allows to configure the desired localtime timezone. -timezone=$(cat "$__object/parameter/tz") +timezone="$__object_id" os=$(cat "$__global/explorer/os") case "$os" in @@ -53,10 +53,7 @@ case "$os" in --file /etc/sysconfig/clock \ --delimiter '=' \ --value "\"$timezone\"" - ;; - openwrt) - : # Uses gencode-remote - ;; + ;; *) echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2 echo "Please contribute an implementation for it if you can." >&2 diff --git a/cdist/conf/type/__timezone/parameter/required b/cdist/conf/type/__timezone/parameter/required deleted file mode 100644 index 975445e4..00000000 --- a/cdist/conf/type/__timezone/parameter/required +++ /dev/null @@ -1 +0,0 @@ -tz diff --git a/cdist/conf/type/__timezone/singleton b/cdist/conf/type/__timezone/singleton deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__uci/explorer/state b/cdist/conf/type/__uci/explorer/state deleted file mode 100644 index d7363dbf..00000000 --- a/cdist/conf/type/__uci/explorer/state +++ /dev/null @@ -1,110 +0,0 @@ -#!/bin/sh -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# This explorer retrieves the current state of the configuration option -# The output of this explorer is one of these values: -# present -# The configuration option is present and has the value of the -# parameter --value. -# absent -# The configuration option is not defined. -# different -# The configuration option is present but has a different value than the -# parameter --value. -# rearranged -# The configuration option is present (a list) and has the same values as -# the parameter --value, but in a different order. - -RS=$(printf '\036') - -option=${__object_id:?} - -values_is=$(uci -s -N -d "${RS}" get "${option}" 2>/dev/null) || { - echo absent - exit 0 -} - -if test -f "${__object:?}/parameter/value" -then - should_file="${__object:?}/parameter/value" -else - should_file='/dev/null' -fi - - -# strip off trailing newline -printf '%s' "${values_is}" \ -| awk ' -function unquote(s) { - # simplified dequoting of single quoted strings - if (s ~ /^'\''.*'\''$/) { - s = substr(s, 2, length(s) - 2) - sub(/'"'\\\\''"'/, "'\''", s) - } - return s -} - -BEGIN { - state = "present" # assume all is fine -} -NR == FNR { - # memoize "should" state - should[FNR] = $0 - should_count++ - - # go to next line (important!) - next -} - -# compare "is" state - -{ $0 = unquote($0) } - -$0 == should[FNR] { next } - -FNR > should_count { - # there are more "is" records than "should" -> definitely different - state = "different" - exit -} - -{ - # see if we can find the value somewhere in should - for (i in should) { - if ($0 == should[i]) { - # ... value found -> rearranged - # FIXME: Duplicate values are not properly handled here. Do they matter? - state = "rearranged" - next - } - } - - state = "different" - exit -} - -END { - if (FNR < should_count) { - # "is" was shorter than "should" -> different - state = "different" - } - - print state -} -' "${should_file}" RS="${RS}" - diff --git a/cdist/conf/type/__uci/files/functions.sh b/cdist/conf/type/__uci/files/functions.sh deleted file mode 100644 index 277f648c..00000000 --- a/cdist/conf/type/__uci/files/functions.sh +++ /dev/null @@ -1,73 +0,0 @@ -# -*- mode: sh; indent-tabs-mode: t -*- - -in_list() { - printf '%s\n' "$@" | { grep -qxF "$(read -r ndl; echo "${ndl}")"; } -} - -quote() { - for _arg - do - shift - if test -n "$(printf %s "${_arg}" | tr -d -c '\t\n \042-\047\050-\052\073-\077\133\\`|~' | tr -c '' '.')" - then - # needs quoting - set -- "$@" "$(printf "'%s'" "$(printf %s "${_arg}" | sed -e "s/'/'\\\\''/g")")" - else - set -- "$@" "${_arg}" - fi - done - unset _arg - - # NOTE: Use printf because POSIX echo interprets escape sequences - printf '%s' "$*" -} - -uci_cmd() { - # Usage: uci_cmd [UCI ARGUMENTS]... - mkdir -p "${__object:?}/files" - printf '%s\n' "$(quote "$@")" >>"${__object:?}/files/uci_batch.txt" -} - -uci_validate_name() { - # like util.c uci_validate_name() - test -n "$*" && test -z "$(echo "$*" | tr -d '[:alnum:]_')" -} - -uci_validate_tuple() ( - tok=${1:?} - case $tok - in - (*.*.*) - # check option - option=${tok##*.} - uci_validate_name "${option}" || { - printf 'Invalid option: %s\n' "${option}" >&2 - return 1 - } - tok=${tok%.*} - ;; - (*.*) - # no option (section definition) - ;; - (*) - printf 'Invalid tuple: %s\n' "$1" >&2 - return 1 - ;; - esac - - case ${tok#*.} - in - (@*) section=$(expr "${tok#*.}" : '@\(.*\)\[-*[0-9]*\]$') ;; - (*) section=${tok#*.} ;; - esac - uci_validate_name "${section}" || { - printf 'Invalid section: %s\n' "${1#*.}" >&2 - return 1 - } - - config=${tok%%.*} - uci_validate_name "${config}" || { - printf 'Invalid config: %s\n' "${config}" >&2 - return 1 - } -) diff --git a/cdist/conf/type/__uci/files/uci_apply.sh b/cdist/conf/type/__uci/files/uci_apply.sh deleted file mode 100644 index 63f94290..00000000 --- a/cdist/conf/type/__uci/files/uci_apply.sh +++ /dev/null @@ -1,43 +0,0 @@ -changes=$(uci changes) - -if test -n "${changes}" -then - echo 'Uncommited UCI changes were found on the target:' - printf '%s\n\n' "${changes}" - echo 'This can be caused by manual changes or due to a previous failed run.' - echo 'Please investigate the situation, revert or commit the changes, and try again.' - exit 1 -fi >&2 - -check_errors() { - # reads stdin and forwards non-empty lines to stderr. - # returns 0 if stdin is empty, else 1. - ! grep -e . >&2 -} - -commit() { - uci commit -} - -rollback() { - printf '\nAn error occurred when trying to commit UCI transaction!\n' >&2 - - uci changes \ - | sed -e 's/^-//' -e 's/\..*\$//' \ - | sort -u \ - | while read -r _package - do - uci revert "${_package}" - echo "${_package}" # for logging - done \ - | awk ' - BEGIN { printf "Reverted changes in: " } - { printf "%s%s", (FNR > 1 ? ", " : ""), $0 } - END { printf "\n" }' >&2 - - return 1 -} - -uci_apply() { - uci batch 2>&1 | check_errors && commit || rollback -} diff --git a/cdist/conf/type/__uci/gencode-remote b/cdist/conf/type/__uci/gencode-remote deleted file mode 100755 index 70a3d3e0..00000000 --- a/cdist/conf/type/__uci/gencode-remote +++ /dev/null @@ -1,101 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# shellcheck source=cdist/conf/type/__uci/files/functions.sh -. "${__type:?}/files/functions.sh" - -state_is=$(cat "${__object:?}/explorer/state") -state_should=$(cat "${__object:?}/parameter/state") - -config=${__object_id:?} -uci_validate_tuple "${config}" - - -case ${state_should} -in - (present) - if in_list "${state_is}" 'present' 'rearranged' - then - # NOTE: order is ignored so rearranged is also fine. - exit 0 - fi - - # Determine type - type=$(cat "${__object:?}/parameter/type" 2>/dev/null || true) - case ${type} - in - (option|list) ;; - ('') - # Guess type by the number of values - test "$(wc -l "${__object:?}/parameter/value")" -gt 1 \ - && type=list \ - || type=option - ;; - (*) - printf 'Invalid --type: %s\n' "${type}" >&2 - exit 1 - ;; - esac - - case ${type} - in - (list) - printf 'set_list %s\n' "${config}" >>"${__messages_out:?}" - - if test "${state_is}" != 'absent' - then - uci_cmd delete "${config}" - fi - - while read -r value - do - uci_cmd add_list "${config}"="${value}" - done <"${__object:?}/parameter/value" - ;; - (option) - printf 'set %s\n' "${config}" >>"${__messages_out:?}" - - value=$(cat "${__object:?}/parameter/value") - uci_cmd set "${config}"="${value}" - ;; - esac - ;; - (absent) - if in_list "${state_is}" 'absent' - then - exit 0 - fi - - printf 'delete %s\n' "${config}" >>"${__messages_out:?}" - uci_cmd delete "${config}" - ;; - (*) - printf 'Invalid --state: %s\n' "${state_should}" >&2 - exit 1 - ;; -esac - -if test -s "${__object:?}/files/uci_batch.txt" -then - cat "${__type:?}/files/uci_apply.sh" - printf "uci_apply <<'EOF'\n" - cat "${__object:?}/files/uci_batch.txt" - printf '\nEOF\n' -fi diff --git a/cdist/conf/type/__uci/man.rst b/cdist/conf/type/__uci/man.rst deleted file mode 100644 index 81a53473..00000000 --- a/cdist/conf/type/__uci/man.rst +++ /dev/null @@ -1,78 +0,0 @@ -cdist-type__uci(7) -================== - -NAME ----- -cdist-type__uci - Manage configuration values in UCI - - -DESCRIPTION ------------ -This cdist type can be used to alter configuration options in OpenWrt's -Unified Configuration Interface (UCI) system. - - -REQUIRED PARAMETERS -------------------- -value - The value to be set. Can be used multiple times. - This parameter is ignored if ``--state`` is ``absent``. - - Due to the way cdist handles arguments, values **must not** contain newline - characters. - - Values do not need special quoting for UCI. The only requirement is that the - value is passed to the type as a single shell argument. - -OPTIONAL PARAMETERS -------------------- -state - ``present`` or ``absent``, defaults to ``present``. -type - If the type should generate an option or a list. - One of: ``option`` or ``list``. - Defaults to auto-detect based on the number of ``--value`` parameters. - - -BOOLEAN PARAMETERS ------------------- -None. - - -EXAMPLES --------- - -.. code-block:: sh - - # Set the system hostname - __uci system.@system[0].hostname --value 'OpenWrt' - - # Set DHCP option 252: tell DHCP clients to not ask for proxy information. - __uci dhcp.lan.dhcp_option --type list --value '252,"\n"' - - # Enable NTP and NTPd (each is applied individually) - __uci system.ntp.enabled --value 1 - __uci system.ntp.enable_server --value 1 - __uci system.ntp.server --type list \ - --value '0.openwrt.pool.ntp.org' \ - --value '1.openwrt.pool.ntp.org' \ - --value '2.openwrt.pool.ntp.org' \ - --value '3.openwrt.pool.ntp.org' - - -SEE ALSO --------- -- https://openwrt.org/docs/guide-user/base-system/uci - - -AUTHORS -------- -Dennis Camera - - -COPYING -------- -Copyright \(C) 2020 Dennis Camera. You can redistribute it -and/or modify it under the terms of the GNU General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. diff --git a/cdist/conf/type/__uci/manifest b/cdist/conf/type/__uci/manifest deleted file mode 100755 index 26920011..00000000 --- a/cdist/conf/type/__uci/manifest +++ /dev/null @@ -1,51 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -os=$(cat "${__global:?}/explorer/os") - -state_should=$(cat "${__object:?}/parameter/state") - -case ${os} -in - (openwrt) - # okay - ;; - (*) - printf "Your operating system (%s) is currently not supported by this type (%s)\n" "${os}" "${__type##*/}" >&2 - printf "Please contribute an implementation for it if you can.\n" >&2 - exit 1 - ;; -esac - -case ${state_should} -in - (present) - test -s "${__object:?}/parameter/value" || { - echo 'The parameter --value is required.' >&2 - exit 1 - } - ;; - (absent) - ;; - (*) - printf 'Invalid --state: %s\n' "${state_should}" >&2 - exit 1 - ;; -esac diff --git a/cdist/conf/type/__uci/nonparallel b/cdist/conf/type/__uci/nonparallel deleted file mode 100644 index e69de29b..00000000 diff --git a/cdist/conf/type/__uci/parameter/default/state b/cdist/conf/type/__uci/parameter/default/state deleted file mode 100644 index e7f6134f..00000000 --- a/cdist/conf/type/__uci/parameter/default/state +++ /dev/null @@ -1 +0,0 @@ -present diff --git a/cdist/conf/type/__uci/parameter/optional b/cdist/conf/type/__uci/parameter/optional deleted file mode 100644 index d9080e3a..00000000 --- a/cdist/conf/type/__uci/parameter/optional +++ /dev/null @@ -1,2 +0,0 @@ -state -type diff --git a/cdist/conf/type/__uci/parameter/optional_multiple b/cdist/conf/type/__uci/parameter/optional_multiple deleted file mode 100644 index 6d4e1507..00000000 --- a/cdist/conf/type/__uci/parameter/optional_multiple +++ /dev/null @@ -1 +0,0 @@ -value diff --git a/cdist/conf/type/__uci_section/explorer/match b/cdist/conf/type/__uci_section/explorer/match deleted file mode 100644 index 0768e404..00000000 --- a/cdist/conf/type/__uci_section/explorer/match +++ /dev/null @@ -1,103 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# This explorer determines the "prefix" of the --type section matching --match -# if set, or __object_id otherwise. - -RS=$(printf '\036') -NL=$(printf '\n '); NL=${NL% } - -squote_values() { - sed -e '/=".*"$/{s/="/='\''/;s/"$/'\''/}' \ - -e "/='.*'$/"'!{s/=/='\''/;s/$/'\''/}' -} -count_lines() ( - IFS=${NL?} - # shellcheck disable=SC2048,SC2086 - set -f -- $*; echo $# -) - -echo "${__object_id:?}" | grep -q -e '^[^.]\{1,\}\.[^.]\{1,\}$' || { - echo 'Section identifiers are a package and section name separated by a "." (period).' >&2 - exit 1 -} - -test -s "${__object:?}/parameter/match" || { - # If no --match is given, we take the __object_id as the section identifier. - echo "${__object_id:?}" - exit 0 -} -test -s "${__object:?}/parameter/type" || { - echo 'Parameters --match and --type must be used together.' >&2 - exit 1 -} - -sect_type_param=$(cat "${__object:?}/parameter/type") -expr "${sect_type_param}" : '[^.]\{1,\}\.[^.]\{1,\}$' >/dev/null 2>&1 || { - echo 'Section types are a package name and section type separated by a "." (period).' >&2 - exit 1 -} -package_filter=${sect_type_param%%.*} -section_filter=${sect_type_param#*.} - -# Find by --match -# NOTE: Apart from section types all values are printed in single quotes by uci show. -match=$(head -n 1 "${__object:?}/parameter/match" | squote_values) - -if uci -s -N get "${__object_id:?}" >/dev/null 2>&1 -then - # Named section exists: ensure if --match applies to it - # if the "matched" option does not exist (e.g. empty section) we use the - # section unconditionally. - if match_value_is=$(uci -s -N get "${__object_id:?}.${match%%=*}" 2>/dev/null) - then - match_value_should=$(expr "${match}" : ".*='\\(.*\\)'$") - - test "${match_value_is}" = "${match_value_should}" || { - printf 'Named section "%s" does not match --match "%s"\n' \ - "${__object_id:?}" "${match}" >&2 - exit 1 - } - fi - - echo "${__object_id:?}" - exit 0 -fi - -# No correctly named section exists already: find one to which --match applies -regex="^${package_filter}\\.@${section_filter}\\[[0-9]\\{1,\\}\\]\\.${match%%=*}=" - -matched_sections=$( - uci -s -N -d "${RS}" show "${package_filter}" 2>/dev/null \ - | grep -e "${regex}" \ - | while read -r _line - do - if test "${_line#*=}" = "${match#*=}" - then - echo "${_line}" - fi - done \ - | sed -e 's/\.[^.]*=.*$//') - -test "$(count_lines "${matched_sections}")" -le 1 || { - printf 'Found multiple matching sections:\n%s\n' "${matched_sections}" >&2 - exit 1 -} - -echo "${matched_sections}" diff --git a/cdist/conf/type/__uci_section/explorer/options b/cdist/conf/type/__uci_section/explorer/options deleted file mode 100644 index e1e60668..00000000 --- a/cdist/conf/type/__uci_section/explorer/options +++ /dev/null @@ -1,48 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera at ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# -# This explorer retrieves the current options of the configuration section. - -RS=$(printf '\036') - -section=$("${__type_explorer:?}/match") -test -n "${section}" || exit 0 - -uci -s -N -d "${RS}" show "${section}" 2>/dev/null \ -| awk -v VSEP="${RS}" ' - { - # Strip off the config and section parts - is_opt = sub(/^([^.]*\.){2}/, "") - - if (!is_opt) { - # this line represents the section -> skip - next - } - - if (index($0, VSEP)) { - # Put values each on a line, like --option and --list parameters - opt = substr($0, 1, index($0, "=") - 1) - split(substr($0, length(opt) + 2), values, VSEP) - for (i in values) { - printf "%s=%s\n", opt, values[i] - } - } else { - print - } - }' diff --git a/cdist/conf/type/__uci_section/files/functions.sh b/cdist/conf/type/__uci_section/files/functions.sh deleted file mode 100644 index 60cb9148..00000000 --- a/cdist/conf/type/__uci_section/files/functions.sh +++ /dev/null @@ -1,59 +0,0 @@ -# -*- mode: sh; indent-tabs-mode: t -*- - -NL=$(printf '\n '); NL=${NL% } - -grep_line() { - { shift; printf '%s\n' "$@"; } | grep -qxF "$1" -} - -print_errors() { - awk -v prefix="${1:-Found errors:}" -v suffix="${2-}" ' - BEGIN { - if (getline) { - print prefix - print - rc = 1 - } - } - { print } - END { - if (rc && suffix) print suffix - exit rc - }' >&2 -} - -quote() { - for _arg - do - shift - if test -n "$(printf %s "${_arg}" | tr -d -c '\t\n \042-\047\050-\052\073-\077\133\\`|~' | tr -c '' '.')" - then - # needs quoting - set -- "$@" "$(printf "'%s'" "$(printf %s "${_arg}" | sed -e "s/'/'\\\\''/g")")" - else - set -- "$@" "${_arg}" - fi - done - unset _arg - printf '%s' "$*" -} - -uci_cmd() { - # Usage: uci_cmd [UCI ARGUMENTS]... - mkdir -p "${__object:?}/files" - printf '%s\n' "$(quote "$@")" >>"${__object:?}/files/uci_batch.txt" -} - -uci_validate_name() { - # like util.c uci_validate_name() - test -n "$*" && test -z "$(printf %s "$*" | tr -d '[:alnum:]_' | tr -c '' .)" -} - -unquote_lines() { - sed -e '/^".*"$/{s/^"//;s/"$//}' \ - -e '/'"^'.*'"'$/{s/'"^'"'//;s/'"'$"'//}' -} - -validate_options() { - grep -shv -e '^[[:alnum:]_]\{1,\}=' "$@" -} diff --git a/cdist/conf/type/__uci_section/files/option_state.awk b/cdist/conf/type/__uci_section/files/option_state.awk deleted file mode 100644 index 97cd94fb..00000000 --- a/cdist/conf/type/__uci_section/files/option_state.awk +++ /dev/null @@ -1,91 +0,0 @@ -# -*- mode: awk; indent-tabs-mode:t -*- -# Usage: awk -f option_state.awk option_type option_name -# e.g. awk -f option_state.awk option title -# awk -f option_state.awk list entry - -function unquote(s) { - # simplified dequoting of single quoted strings - if (s ~ /^'.*'$/) { - s = substr(s, 2, length(s) - 2) - sub(/'\\''/, "'", s) - } - return s -} - -function valueof(line) { - if (line !~ /^[[:alpha:]_]+=/) return 0 - return unquote(substr(line, index(line, "=") + 1)) -} - -BEGIN { - __object = ENVIRON["__object"] - if (!__object) exit 1 - - opttype = ARGV[1] - optname = ARGV[2] - - if (opttype !~ /^(option|list)/ || !optname) { - print "invalid" - exit (e=1) - } - - ARGV[1] = __object "/parameter/" opttype - ARGV[2] = __object "/explorer/options" - - state = "present" -} - -NR == FNR { - # memoize "should" state - if (index($0, optname "=") == 1) { - should[++should_count] = valueof($0) - } - - # go to next line (important!) - next -} - -{ - # compare "is" state - if (index($0, optname "=") != 1) - next - ++is_count - - v = valueof($0) - - if (v == should[is_count]) { - # looks good, but can't say definitely just from this line - } else if (is_count > should_count) { - # there are more "is" records than "should" -> definitely different - state = "different" - exit - } else { - # see if we can find the "is" value somewhere in "should" - for (i in should) { - if (v == should[i]) { - # value found -> could be rearranged - # FIXME: Duplicate values are not properly handled here. Do they matter? - state = "rearranged" - next - } - } - - # "is" value could not be found in "should" -> definitely different - state = "different" - exit - } -} - -END { - if (e) exit - - if (!is_count) { - # no "is" values -> absent - state = "absent" - } else if (is_count < should_count) { - # "is" was shorter than "should" -> different - state = "different" - } - - print state -} diff --git a/cdist/conf/type/__uci_section/files/uci_apply.sh b/cdist/conf/type/__uci_section/files/uci_apply.sh deleted file mode 120000 index 4209151f..00000000 --- a/cdist/conf/type/__uci_section/files/uci_apply.sh +++ /dev/null @@ -1 +0,0 @@ -../../__uci/files/uci_apply.sh \ No newline at end of file diff --git a/cdist/conf/type/__uci_section/gencode-remote b/cdist/conf/type/__uci_section/gencode-remote deleted file mode 100755 index 50fdfa4e..00000000 --- a/cdist/conf/type/__uci_section/gencode-remote +++ /dev/null @@ -1,174 +0,0 @@ -#!/bin/sh -e -# -# 2020 Dennis Camera (dennis.camera@ssrq-sds-fds.ch) -# -# This file is part of cdist. -# -# cdist is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# cdist is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with cdist. If not, see . -# - -# shellcheck source=cdist/conf/type/__uci_section/files/functions.sh -. "${__type:?}/files/functions.sh" - - -section=$(cat "${__object:?}/explorer/match") - -state_is=$(test -s "${__object:?}/explorer/type" && echo present || echo absent) -state_should=$(cat "${__object:?}/parameter/state") - -case $state_should -in - (present) - test -f "${__object:?}/parameter/type" || { - echo 'Parameter --type is required.' >&2 - exit 1 - } - - type_is=$(cat "${__object:?}/explorer/type") - type_should=$(cat "${__object:?}/parameter/type") - - if test -n "${type_is}" - then - sect_type=${type_is} - else - sect_type=${type_should##*.} - fi - - if test -z "${section}" - then - # No section exists and --match was used. - # So we generate a new section identifier from $__object_id. - case ${__object_id:?} - in - (*.*) section=${__object_id:?} ;; - (*) section="${type_should%%.*}.${__object_id:?}" ;; - esac - fi - - # Collect option names - if test -f "${__object:?}/parameter/list" - then - listnames_should=$( - sed -e 's/=.*$//' "${__object:?}/parameter/list" | sort -u) - fi - - if test -f "${__object:?}/parameter/option" - then - optnames_should=$( - sed -e 's/=.*$//' "${__object:?}/parameter/option" | sort -u) - fi - - # Make sure the section itself is present - if test "${state_is}" = absent \ - || test "${type_is}" != "${type_should#*.}" - then - printf 'set %s\n' "${section}" >>"${__messages_out:?}" - # shellcheck disable=SC2140 - uci_cmd set "${section}"="${sect_type}" - fi - - # Delete options/lists not in "should" - sed -e 's/=.*$//' "${__object:?}/explorer/options" \ - | while read -r _optname - do - grep_line "${_optname}" "${listnames_should}" "${optnames_should}" || { - printf 'delete %s\n' "${section}.${_optname}" >>"${__messages_out:?}" - uci_cmd delete "${section}.${_optname}" - } &2 - exit 1 - } - - # Set "should" options - echo "${optnames_should}" \ - | grep -e . \ - | while read -r _optname - do - _opt_state=$(awk -f "${__type:?}/files/option_state.awk" option "${_optname}") \ - || opt_proc_error "${_optname}" - case ${_opt_state} - in - (invalid) - opt_proc_error "${_optname}" - ;; - (present) - ;; - (*) - printf 'set %s\n' "${section}.${_optname}" >>"${__messages_out:?}" - - # shellcheck disable=SC2140 - uci_cmd set "${section}.${_optname}"="$( - grep -e "^${_optname}=" "${__object:?}/parameter/option" \ - | sed -e 's/^.*=//' \ - | unquote_lines \ - | head -n 1)" - ;; - esac - done - - echo "${listnames_should}" \ - | grep -e . \ - | while read -r _optname - do - _list_state=$(awk -f "${__type:?}/files/option_state.awk" list "${_optname}") \ - || opt_proc_error "${_optname}" - case ${_list_state} - in - (invalid) - opt_proc_error "${_optname}" - ;; - (present) - ;; - (*) - printf 'set_list %s\n' "${section}.${_optname}" >>"${__messages_out:?}" - - if test "${_list_state}" != absent - then - uci_cmd delete "${section}.${_optname}" - fi - - grep "^${_optname}=" "${__object:?}/parameter/list" \ - | sed -e 's/^.*=//' \ - | unquote_lines \ - | while read -r _value - do - # shellcheck disable=SC2140 - uci_cmd add_list "${section}.${_optname}"="${_value}" - done - ;; - esac - done - ;; - (absent) - if test "${state_is}" = absent - then - # if explorer found no section there is nothing to delete - exit 0 - fi - - printf 'delete %s\n' "${section}" >>"${__messages_out:?}" - uci_cmd delete "${section}" - ;; -esac - -if test -s "${__object:?}/files/uci_batch.txt" -then - cat "${__type:?}/files/uci_apply.sh" - printf "uci_apply <<'EOF'\n" - cat "${__object:?}/files/uci_batch.txt" - printf '\nEOF\n' -fi diff --git a/cdist/conf/type/__uci_section/man.rst b/cdist/conf/type/__uci_section/man.rst deleted file mode 100644 index a0ab78e8..00000000 --- a/cdist/conf/type/__uci_section/man.rst +++ /dev/null @@ -1,119 +0,0 @@ -cdist-type__uci_section(7) -========================== - -NAME ----- -cdist-type__uci_section - Manage configuration sections in UCI - - -DESCRIPTION ------------ -This cdist type can be used to replace whole configuration sections in OpenWrt's -Unified Configuration Interface (UCI) system. -It can be thought of as syntactic sugar for :strong:`cdist-type__uci`\ (7), -as this type will generate the required `__uci` objects to make the section -contain exactly the options specified using ``--option``. - -Since many default UCI sections are unnamed, this type allows to find the -matching section by one of its options using the ``--match`` parameter. - -**NOTE:** Options already present on the target and not listed in ``--option`` -or ``--list`` will be deleted. - - -REQUIRED PARAMETERS -------------------- -None. - - -OPTIONAL PARAMETERS -------------------- -list - An option that is part of a list and should be present in the section (as - part of a list). Lists with multiple options can be expressed by using the - same ``