autosign 0.0.6 → 0.0.7

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    MmQ5ODVkNzdjNjNmYjI4YjhiYWUzYmM3NmQ0ODlhNjgyNDljOWI3NQ==
+    YWFiZDhhNDExMzllMTRiNTMxMjYzZjNjNjljYzQ1MjdjNjc3NGM2MQ==
   data.tar.gz: !binary |-
-    YmVkMjY0NjE5ZjIwMjBkYThiNDdkYTczMzBhYmVkYWRjMzNhMDQzMQ==
+    Mzk0ZmVhNWNlNDg1Y2FjYmE0N2RjY2EzOTIyOTUyOWYzODk3NTgwOQ==
 SHA512:
   metadata.gz: !binary |-
-    ODhmODE3ZjYxMmMwNGE0ZjgzMWJlYzBjZThlYTE0Y2EwYTY1NzhkYWZlNmE1
-    N2JlMDBkMTUzMWM3MmYxZGRhN2I5MTIwY2QxNjI0YTkyNDk3MjhhNDUxMDFl
-    YzE2YTkzZDFlZTk5MGZlOWU1MGFlYzU0MzU4ZTEzZGUwMDQxYzY=
+    MmZmZTA5YmE2ZjM4NjY3ZTdlZTNkMjhiMTllNDczNWU4MTYzNWZmMDc4MjI0
+    ODhlZjE1YjUyZWYxNTU4ZDA1YzQ4Y2EyNGY1OGRiNjVjNzlhOGExN2M1ODZj
+    Mzk5YzhkZWY2NGNhMTc0M2QwNGU4ZTMwZWIyOGUwMjQyZWVmNWE=
   data.tar.gz: !binary |-
-    NTc3OGI1NzYzYjc4MDU3MDVkYjE3YTJlZTBhYmY1ZTAxYjhhZDUxNDlhM2Rk
-    ZmI1MGNjYjVjYzM1YjE3ZjgyMzQ0NmE5NTk3NjY5YWEwN2FlZDI0ZDFmYWNj
-    ZmNmYmFhZjJmMWYyN2MzZGUzZDJhMTEwN2M0MDdiNGVkNWIzMDQ=
+    MTJhNzI0NzM5NDYwMjVmOWU5MGI0NzIwODI5NDgwMGMwODlkNTY1NzRkZTcz
+    NWE3ODdiNjY5NzdlYzU4MzVmNDg1YzgyODc3MzA4NTBkMjVmMmYwZGRlOGRh
+    ZDQzYjYxZTFjMjY1NzViMmM5YmQ4YTBhYzViZTExMzA2YWY3YWM=

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    autosign (0.0.6)
+    autosign (0.0.7)
       deep_merge (~> 1)
       gli (~> 2)
       iniparse (~> 1)
@@ -23,14 +23,14 @@ GEM
     builder (3.2.2)
     childprocess (0.5.6)
       ffi (~> 1.0, >= 1.0.11)
-    contracts (0.10)
+    contracts (0.10.1)
     coveralls (0.8.2)
       json (~> 1.8)
       rest-client (>= 1.6.8, < 2)
       simplecov (~> 0.10.0)
       term-ansicolor (~> 1.3)
       thor (~> 0.19.1)
-    cucumber (2.0.1)
+    cucumber (2.0.2)
       builder (>= 2.1.2)
       cucumber-core (~> 1.2.0)
       diff-lcs (>= 1.1.3)

data/bin/autosign

@@ -37,15 +37,11 @@ desc 'Quiet output - only log errors'
 switch [:q, :quiet]
 
 desc 'Generate an autosign token'
-arg_name 'certname or regex the autosign token will be valid for'
+arg_name 'certname/regex'
 command :generate do |c|
   c.desc 'Generate a reusable token; default is to generate one-time tokens'
   c.switch [:r, :reusable]
 
-  c.desc 'certname or regex of certnames the autosign token will be valid for'
-  c.arg_name 'certname'
-  c.flag [:n,:certname]
-
   c.desc 'autosign token validity period'
   c.default_value '7200'
   c.arg_name 'seconds'
@@ -57,16 +53,17 @@ command :generate do |c|
     options['validfor'] = config.settings.to_hash['jwt_token']['validity'].to_s if options['validfor'] == '7200'
     @logger.debug "validfor: " + options['validfor']
     help_now!('no secret was defined via --secret or a config file') if global_options['secret'].nil?
-    help_now!('certname is required') if options['certname'].nil?
+    help_now!('certname is required as argument') if args[0].nil?
+    certname = args[0]
 
     help_now!('validfor setting must be an positive integer number of seconds') if !/\A\d+\z/.match(options['validfor'].to_s)
-    token = Autosign::Token.new(options['certname'].to_s, options['reusable'], options['validfor'].to_i, Socket.gethostname.to_s, global_options['secret'])
-    @logger.info "generated token for: " + options['certname'].to_s
-    puts "Autosign token for: " + token.certname
-    puts "Valid until: " + Time.at(token.validto).to_s
-    puts ""
-    puts token.sign.to_s
+    token = Autosign::Token.new(certname, options['reusable'], options['validfor'].to_i, Socket.gethostname.to_s, global_options['secret'])
+    @logger.info "generated token for: " + certname
+    puts "Autosign token for: " + token.certname + ", valid until: " + Time.at(token.validto).to_s
+    puts "To use the token, put the following in ${puppet_confdir}/csr_attributes.yaml prior to running puppet agent for the first time:"
     puts ""
+    puts "custom_attributes:"
+    puts "  challengePassword: \"#{token.sign.to_s}\""
   end
 end
 
@@ -101,11 +98,12 @@ end
 desc 'Autosign configuration'
 command :config do |c|
 
-  c.desc 'Configure a puppet server for autosigning'
+  c.desc 'Create a default autosign.conf file'
   c.command :setup do |setup|
     setup.action do |global_options,options,args|
       @logger.info "setup command ran with #{global_options} #{options} #{args}"
-      @logger.info "generated default config file" if Autosign::Config.generate_default
+      result = Autosign::Config.generate_default
+      STDOUT.puts "generated default config file at #{result}" if result
     end
   end
 
@@ -120,18 +118,6 @@ command :config do |c|
 
 end
 
-desc 'Install an autosign token; run this prior to running puppet for the first time on an agent'
-arg_name 'token'
-command :use do |c|
-  c.action do |global_options,options,args|
-    puppet_confdir = %x[puppet config print confdir].chomp
-    @logger.debug "use command ran with #{global_options} #{options} #{args}"
-    puts "put the following in #{puppet_confdir}/csr_attributes.yaml prior to running puppet agent for the first time:
-custom_attributes:
-  challengePassword: \"#{args[0]}\""
-  end
-end
-
 pre do |global,command,options,args|
   # Pre logic here
   # Return true to proceed; false to abort and not call the

data/features/autosign.feature

@@ -13,9 +13,9 @@ Feature: Generate autosign key
       secret = secret
       """
     When I run `chmod 600 autosign.conf`
-     And I run `autosign --config autosign.conf generate --certname foo.example.com`
+     And I run `autosign --config autosign.conf generate foo.example.com`
     Then the output should contain "Autosign token for: foo.example.com"
-     And the output should contain "Valid until"
+     And the output should contain "valid until"
      And the exit status should be 0
 
   Scenario: Generate new reusable token
@@ -28,9 +28,9 @@ Feature: Generate autosign key
       validity = 7200
       """
     When I run `chmod 600 autosign.conf`
-    When I run `autosign --config autosign.conf generate --certname foo.example.com --reusable`
+    When I run `autosign --config autosign.conf generate foo.example.com --reusable`
     Then the output should contain "Autosign token for: foo.example.com"
-     And the output should contain "Valid until"
+     And the output should contain "valid until"
      And the exit status should be 0
 
   Scenario: Validate a token
@@ -69,10 +69,3 @@ Feature: Generate autosign key
     When I run `chmod 600 autosign.conf`
     When I run `autosign --config autosign.conf validate --certname "foo.example.com" "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJkYXRhIjoie1wiY2VydG5hbWVcIjpcImZvby5leGFtcGxlLmNvbVwiLFwicmVxdWVzdGVyXCI6XCJEYW5pZWxzLU1hY0Jvb2stUHJvLTIubG9jYWxcIixcInJldXNhYmxlXCI6ZmFsc2UsXCJ2YWxpZGZvclwiOjEsXCJ1dWlkXCI6XCJlNjI1Y2I1Ny02NzY5LTQwMzQtODNiZS0zNzkxNmQ5YmMxMDRcIn0iLCJleHAiOiIxNDM2NDY2MzAyIn0.UXEDEbRqEWx5SdSpQjfowU56JubY5Yz2QN6cckby2es-g2P_n2lyAS6AwFeliBXyCDyVUelIT3g1QP4TdB9EEA"`
     Then the exit status should be 1
-
-  Scenario: Generate a csr_attributes.yaml file
-    When I run `autosign use hunter2`
-    Then the output should contain "challengePassword: "
-     And the output should contain "csr_attributes.yaml"
-     And the output should contain "hunter2"
-     And the exit status should be 0

data/lib/autosign/config.rb

@@ -43,7 +43,10 @@ module Autosign
       raise 'settings is not a hash' unless settings_param.is_a?(Hash)
 
       # look in the following places for a config file
-      @config_file_paths = ['/etc/autosign.conf', '/usr/local/etc/autosign.conf', File.join(Dir.home, '.autosign.conf')]
+      @config_file_paths = ['/etc/autosign.conf', '/usr/local/etc/autosign.conf']
+
+      # HOME is unset when puppet runs, so we need to only use it if it's set
+      @config_file_paths << File.join(Dir.home, '.autosign.conf') unless ENV['HOME'].nil?
       @config_file_paths = [ settings_param['config_file'] ] unless settings_param['config_file'].nil?
 
       @settings = settings_param
@@ -145,13 +148,13 @@ module Autosign
           {
             'logpath'     => '/var/log/autosign.log',
             'confpath'    => '/etc/autosign.conf',
-            'journalfile' => File.join(Dir.home, '/var/log/autosign.journal')
+            'journalfile' => File.join(Dir.home, '/var/autosign/autosign.journal')
           }
         when /bsd/
           {
             'logpath'     => '/var/log/autosign.log',
             'confpath'    => '/usr/local/etc/autosign.conf',
-            'journalfile' => File.join(Dir.home, '/var/log/autosign.journal')
+            'journalfile' => File.join(Dir.home, '/var/autosign/autosign.journal')
           }
         else
           raise Autosign::Exceptions::Error, "unsupported os: #{host_os.inspect}"
@@ -162,15 +165,23 @@ module Autosign
         doc.section("general") do |general|
           general.option("loglevel", "warn")
           general.option("logfile", os_defaults['logpath'])
-          general.option("journalfile", os_defaults['journalfile'])
         end
         doc.section("jwt_token") do |jwt_token|
           jwt_token.option("secret", SecureRandom.base64(15))
           jwt_token.option("validity", 7200)
+          jwt_token.option("journalfile", os_defaults['journalfile'])
+        end
+        doc.section("multiplexer") do |jwt_token|
+          jwt_token.option(";external_policy_executable", '/usr/local/bin/some_autosign_executable')
+          jwt_token.option(";external_policy_executable", '/usr/local/bin/another_autosign_executable')
+        end
+        doc.section("password_list") do |jwt_token|
+          jwt_token.option(";password", 'static_autosign_password_here')
+          jwt_token.option(";password", 'another_static_autosign_password')
         end
       end.to_ini
       raise Autosign::Exceptions::Error, "file #{os_defaults['confpath']} already exists, aborting" if File.file?(os_defaults['confpath'])
-      File.write(os_defaults['confpath'], config)
+      return os_defaults['confpath'] if File.write(os_defaults['confpath'], config)
     end
   end
 end

data/lib/autosign/version.rb

@@ -1,3 +1,3 @@
 module Autosign
-  VERSION = '0.0.6'
+  VERSION = '0.0.7'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: autosign
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
 platform: ruby
 authors:
 - Your Name Here
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-15 00:00:00.000000000 Z
+date: 2015-07-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake