summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLeif Johansson <leifj@sunet.se>2013-12-20 04:18:45 -0800
committerLeif Johansson <leifj@sunet.se>2013-12-20 04:18:45 -0800
commit67337f5c7cba477b9e4a37d0e85ca5b0e7426f65 (patch)
tree22324e2981ce017c7b6ecbfdb7b3f7ff773f3a79
parentf1c2ae2e0495f279493d8989b1c72bf3f8ed122a (diff)
parentaaac847d84bd4660ae4011a866cd5c8bef791a2c (diff)
Merge pull request #2 from Ratler/verify_puppet_modules
Verify git signatures for puppet modules
-rw-r--r--global/overlay/etc/puppet/puppet.conf1
-rwxr-xr-xglobal/post-tasks.d/018packages98
2 files changed, 88 insertions, 11 deletions
diff --git a/global/overlay/etc/puppet/puppet.conf b/global/overlay/etc/puppet/puppet.conf
index 0ba85f4..a269892 100644
--- a/global/overlay/etc/puppet/puppet.conf
+++ b/global/overlay/etc/puppet/puppet.conf
@@ -7,6 +7,7 @@ factpath=$vardir/lib/facter
templatedir=$confdir/templates
node_terminus = exec
external_nodes = /etc/puppet/cosmos_enc.py
+modulepath = /etc/puppet/modules:/etc/puppet/cosmos-modules:/usr/share/puppet/modules
[master]
# These are needed when the puppetmaster is run by passenger
diff --git a/global/post-tasks.d/018packages b/global/post-tasks.d/018packages
index 9e25e69..57dff1a 100755
--- a/global/post-tasks.d/018packages
+++ b/global/post-tasks.d/018packages
@@ -1,16 +1,92 @@
-#!/bin/sh
+#!/bin/bash
+
+CONFIG=${CONFIG:=/etc/puppet/cosmos-modules.conf}
+CACHE_DIR=/var/cache/puppet-modules
+MODULES_DIR=${MODULES_DIR:=/etc/puppet/cosmos-modules}
+GIT_TAG_PATTERN=${COSMOS_UPDATE_VERIFY_GIT_TAG_PATTERN:-multiverse*}
+export GNUPGHOME=/etc/cosmos/gnupg
python -c "import yaml" 2>/dev/null || apt-get -y install python-yaml
-if [ -f /etc/puppet/cosmos-modules.conf ]; then
- grep -E -v "^#" /etc/puppet/cosmos-modules.conf | (
- cd /etc/puppet/modules && while read module src update; do
- if [ ! -d /etc/puppet/modules/$module ]; then
- echo $src | grep -q "://" && git clone $src $module || puppet module install $src
- else
- if [ "x$update" = "xyes" ]; then
- echo $src | grep -q "://" && (cd /etc/puppet/modules/$module && git pull -q) || puppet module upgrade $src
+
+stage_module() {
+ rm -rf $CACHE_DIR/staging/$1
+ git archive --format=tar --prefix=$1/ $2 | (cd $CACHE_DIR/staging/ && tar xf -)
+}
+
+if [ -f $CONFIG ]; then
+ if [ ! -d $MODULES_DIR ]; then
+ mkdir -p $MODULES_DIR
+ fi
+ if [ ! -d $CACHE_DIR ]; then
+ mkdir -p $CACHE_DIR/{scm,staging}
+ fi
+
+ # First pass to clone any new modules, and update those marked for updating.
+ grep -E -v "^#" $CONFIG | (
+ while read module src update; do
+ # We only support git:// urls atm
+ if [ "${src:0:6}" = "git://" ]; then
+ if [ ! -d $CACHE_DIR/scm/$module ]; then
+ git clone -q $src $CACHE_DIR/scm/$module
+ elif [ -d $CACHE_DIR/scm/$module/.git ]; then
+ if [ "$update" = "yes" ]; then
+ cd $CACHE_DIR/scm/$module
+ git pull -q
+ else
+ continue
fi
- fi
- done)
+ else
+ echo "ERROR: Ignoring non-git repository"
+ continue
+ fi
+ fi
+ done
+ )
+
+ # Second pass to verify the signatures on all modules and stage those that
+ # have good signatures.
+ grep -E -v "^#" $CONFIG | (
+ while read module src update; do
+ # We only support git:// urls atm
+ if [ "${src:0:6}" = "git://" ]; then
+ # Verify git tag
+ cd $CACHE_DIR/scm/$module
+ TAG=$(git tag -l $GIT_TAG_PATTERN | sort | tail -1)
+ if [ "$COSMOS_VERBOSE" = "y" ]; then
+ echo ""
+ echo "Checking signature on tag ${TAG} for puppet-module $module"
+ fi
+ if [ -z "$TAG" ]; then
+ echo "ERROR: No git tag found for pattern '$GIT_TAG_PATTERN' on puppet-module $module"
+ continue
+ fi
+ fail=1
+ git tag -v $TAG > /dev/null 2>&1 && fail=0
+ if [ $fail == 0 ]; then
+ if [ "$COSMOS_VERBOSE" = "y" ]; then
+ # short output on good signature
+ git tag -v $TAG 2>&1 | grep "gpg: Good signature"
+ fi
+ # Put archive in staging since tag verified OK
+ stage_module $module $TAG
+ else
+ echo "################################################################"
+ echo "FAILED signature check on puppet-module $module"
+ echo "################################################################"
+ git tag -v $TAG
+ fi
+ fi
+ done
+ )
+
+ # Cleanup removed puppet modules from CACHE_DIR
+ for MODULE in $(ls -1 $CACHE_DIR/staging/); do
+ if ! grep -E -q "^$MODULE\s+" $CONFIG; then
+ rm -rf $CACHE_DIR/{scm,staging}/$MODULE
+ fi
+ done
+
+ # Installing verified puppet modules
+ rsync --archive --delete $CACHE_DIR/staging/ $MODULES_DIR/
fi