beaker-pe 3.6.6 → 3.6.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa8b72f2297a472ddc6291dd99dba0607bee54af45ebf9599675aac36823ecc7
-  data.tar.gz: 8186462c53f80d68b4d0c19c46d1fafdb24bd4af604b18d2b40a3ca0820dbf23
+  metadata.gz: 8e808082867ede5c141a2d6e9def116fcd87d33d1c97ca2a16a401e158794df4
+  data.tar.gz: 96feaaf93f3f957dd331277c3f182cf702aa9c6ec3f1c0212c9381c3ccd819cc
 SHA512:
-  metadata.gz: 723ce4a758aaa6cfd40b907ae7a6877349d6402393e445b9a9f147437d60db22d64d9ef29f795884f0f16a9b07c8cb566e9a9bcf50383cfd1819266a59ef0d6d
-  data.tar.gz: b862c17a232e7c30b7d5d623a0d947a0cf95c58554722f76cba6f5f23e5b60a224e30ba0ca04fa2f8058192b0ab46b831d101831fb894ea9270d745fe839d16e
+  metadata.gz: 975b99a50a8c499ac0e1afef7bf86939b088073bda0a9ba2236c1851858454ea96b6b9f7a8c9570cd23dc16b4cfb27299527aeb385c33b1a7a969199d873aaef
+  data.tar.gz: 28cbb7db3d6523034643dcd5134509209839a9368de7f274a41bfd1ae72c704f76573d13227efc073335874d85c4bfb9c3c414a5a435703760479cd3d2c7c6e4

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [3.6.8](https://github.com/puppetlabs/beaker-pe/tree/3.6.8) (2026-09-17)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.7...3.6.8)
+
+**Merged pull requests:**
+
+- \(PE-32680\) Fix GPG key refresh for PE 2023.8.0 and earlier [\#308](https://github.com/puppetlabs/beaker-pe/pull/308) ([cthorn42](https://github.com/cthorn42))
+
+## [3.6.7](https://github.com/puppetlabs/beaker-pe/tree/3.6.7) (2026-08-14)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.6...3.6.7)
+
+**Fixed bugs:**
+
+- \(PE-45827\) Query PuppetDB's unauthenticated status endpoint in check\_puppetdb\_status\_endpoint [\#313](https://github.com/puppetlabs/beaker-pe/pull/313) ([steveax](https://github.com/steveax))
+
 ## [3.6.6](https://github.com/puppetlabs/beaker-pe/tree/3.6.6) (2026-08-12)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.5...3.6.6)
@@ -100,19 +116,19 @@
 
 ## [2.19.0](https://github.com/puppetlabs/beaker-pe/tree/2.19.0) (2024-06-21)
 
-[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.2.0...2.19.0)
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/2.18.0...2.19.0)
 
 **Implemented enhancements:**
 
 - \(PE-38685\) Beaker 6 upgrade [\#281](https://github.com/puppetlabs/beaker-pe/pull/281) ([tlehman](https://github.com/tlehman))
 
-## [3.2.0](https://github.com/puppetlabs/beaker-pe/tree/3.2.0) (2024-06-11)
+## [2.18.0](https://github.com/puppetlabs/beaker-pe/tree/2.18.0) (2024-06-11)
 
-[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/2.18.0...3.2.0)
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.2.0...2.18.0)
 
-## [2.18.0](https://github.com/puppetlabs/beaker-pe/tree/2.18.0) (2024-06-11)
+## [3.2.0](https://github.com/puppetlabs/beaker-pe/tree/3.2.0) (2024-06-11)
 
-[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.1.0...2.18.0)
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.1.0...3.2.0)
 
 **Implemented enhancements:**
 
@@ -120,19 +136,19 @@
 
 ## [3.1.0](https://github.com/puppetlabs/beaker-pe/tree/3.1.0) (2024-05-22)
 
-[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/2.17.0...3.1.0)
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.0.1...3.1.0)
 
 **Merged pull requests:**
 
 - \(PE-37784\) Remove upper bound for beaker-puppet [\#273](https://github.com/puppetlabs/beaker-pe/pull/273) ([nmburgan](https://github.com/nmburgan))
 
-## [2.17.0](https://github.com/puppetlabs/beaker-pe/tree/2.17.0) (2024-04-10)
+## [3.0.1](https://github.com/puppetlabs/beaker-pe/tree/3.0.1) (2024-04-10)
 
-[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.0.1...2.17.0)
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/2.17.0...3.0.1)
 
-## [3.0.1](https://github.com/puppetlabs/beaker-pe/tree/3.0.1) (2024-04-10)
+## [2.17.0](https://github.com/puppetlabs/beaker-pe/tree/2.17.0) (2024-04-10)
 
-[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/2.16.1...3.0.1)
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/2.16.1...2.17.0)
 
 ## [2.16.1](https://github.com/puppetlabs/beaker-pe/tree/2.16.1) (2024-03-19)
 

data/lib/beaker-pe/install/pe_utils.rb

@@ -510,13 +510,13 @@ NOASK
         end
 
         #PE-32680, GPG expired on older PE versions, need to update with a new GPG key on the primary server
-        #only affects PE versions 2019.8.4 and earlier, and only needed for debian, ubuntu, and sles agent platforms
+        #only affects PE versions 2023.8.0 and earlier, and only needed for debian, ubuntu, and sles agent platforms
         # @param [Host] host to see if we need to update the gpg key
         # @param [String] location of the GPG key we intend to overwrite
-        # If someone is using this gem and is not on the PE private network, they need to download the new private GPG key and host
-        # it somewhere, then set the URL as an enviromental variable GPG_URL.
+        # Defaults to Puppet's public release key (same key, renewed self-signature); override
+        # via the GPG_URL environment variable if a different source is needed.
         def gpg_key_overwrite(host, location)
-          gpg_url = ENV['GPG_URL'] || 'https://artifactory.delivery.puppetlabs.net/artifactory/generic__local/extended_gpg_key.asc'
+          gpg_url = ENV['GPG_URL'] || 'https://yum.puppet.com/RPM-GPG-KEY-puppet'
           case location
           when 'tarball'
             path_to_gpg_key = "#{host['working_dir']}/#{host['dist']}/packages/GPG-KEY-puppet"
@@ -528,9 +528,26 @@ NOASK
             raise(StandardError, "gpg_key_overwrite requires a valid location: tarball, or pe_repo. #{location} was supplied")
           end
 
-          if (host['roles'].include?('master') || host['roles'].include?('pe_postgres')) && version_is_less(host[:pe_ver], '2019.8.5') && hosts.any? {|agent| agent['platform'] =~ /(debian)|(ubuntu)|(sles)/}
+          if (host['roles'].include?('master') || host['roles'].include?('pe_postgres')) && version_is_less(host[:pe_ver], '2023.8.1') && hosts.any? {|agent| agent['platform'] =~ /(debian)|(ubuntu)|(sles)/}
+            # Some PE releases also ship a separately-dated copy of this key alongside the
+            # undated one (e.g. GPG-KEY-puppet-2025-04-06), which frictionless install scripts
+            # may reference directly. Find any such siblings before we remove the undated file,
+            # so we can refresh them with the same content too.
+            gpg_key_dir = File.dirname(path_to_gpg_key)
+            gpg_key_basename = File.basename(path_to_gpg_key)
+            dated_gpg_keys = on(host, "ls -1 #{gpg_key_dir}/#{gpg_key_basename}-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] 2>/dev/null", :acceptable_exit_codes => [0,1,2]).stdout.split("\n")
+
             on(host, "rm -f #{path_to_gpg_key}")
-            on(host, "curl #{gpg_url} --output #{path_to_gpg_key}")
+            # The puppet-agent tarball fetch above already uses retry_on to survive network
+            # blips; do the same here so a transient curl failure doesn't abort the whole run.
+            retry_on(host, "curl --fail #{gpg_url} --output #{path_to_gpg_key}", {
+              desired_exit_codes: [0],
+              max_retries: 3,
+              verbose: 'true'
+            })
+            unless dated_gpg_keys.empty?
+              on(host, dated_gpg_keys.map { |dated_gpg_key| "cp #{path_to_gpg_key} #{dated_gpg_key}" }.join(' && '))
+            end
             if location == 'pe_repo'
               gpg_key_overwrite(host, 'pe_repo_env')
             elsif location == 'pe_repo_env'
@@ -1850,21 +1867,31 @@ EOM
               # Prefer the ssl status endpoint. PuppetDB's jetty listener is
               # explicitly configured with `client-auth = want`, not `need`
               # (see puppet_enterprise::puppetdb::jetty_ini.pp), and
-              # /pdb/meta/v1/version -- like the rest of /status/v1/* -- is
-              # allow-unauthenticated in PuppetDB's auth.conf. So `curl -k`
-              # gets a real, validated response with no client cert needed,
-              # and it's the only path that still works once the cleartext
-              # listener is disabled by default (PE-45384/PE-44906,
-              # SECVULN-1792; PE-45827).
-              output = on(host, "curl -s -k https://localhost:#{ssl_port}/pdb/meta/v1/version", :accept_all_exit_codes => true)
-              match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+              # /status/v1/* is allow-unauthenticated in PuppetDB's auth.conf,
+              # so `curl -k` gets a real, content-validated response with no
+              # client cert needed. This is the only path that still works
+              # once the cleartext listener is disabled by default
+              # (PE-45384/PE-44906, SECVULN-1792).
+              #
+              # NB: /pdb/meta/v1/version is NOT allow-unauthenticated -- it
+              # requires a cert or token, so a bare `curl -k` against it is
+              # rejected with "Must supply a certificate or token". PE-45827
+              # switched this check to ssl but kept /pdb/meta/v1/version, so it
+              # still hard-failed ("PuppetDB took too long to start") on
+              # cleartext-disabled upgrade hosts. Query the status endpoint and
+              # validate the running state instead, matching the working
+              # sleep_until_puppetdb_started (beaker-puppet, PE-45697). PE-45827.
+              status_endpoint = "status/v1/services/puppetdb-status"
+              running = /"state"\s*:\s*"running"/
+              output = on(host, "curl -s -k https://localhost:#{ssl_port}/#{status_endpoint}", :accept_all_exit_codes => true)
+              match = output.stdout =~ running
 
               # Fall back to the cleartext port for older or nonstandard
               # configurations where the ssl endpoint doesn't behave as
               # above.
               if !match
-                output = on(host, "curl -s http://localhost:#{nonssl_port}/pdb/meta/v1/version", :accept_all_exit_codes => true)
-                match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+                output = on(host, "curl -s http://localhost:#{nonssl_port}/#{status_endpoint}", :accept_all_exit_codes => true)
+                match = output.stdout =~ running
               end
 
               sleep 1

data/lib/beaker-pe/version.rb

@@ -3,7 +3,7 @@ module Beaker
     module PE
 
       module Version
-        STRING = '3.6.6'
+        STRING = '3.6.8'
       end
 
     end

data/spec/beaker-pe/install/pe_utils_spec.rb

@@ -2671,24 +2671,25 @@ NOASK
       subject.check_puppetdb_status_endpoint(unixhost)
     end
 
-    it 'succeeds via the ssl endpoint alone, without ever falling back to cleartext (PE-45827)' do
+    it 'queries the allow-unauthenticated ssl status endpoint, not /pdb/meta (PE-45827)' do
       allow(subject).to receive(:version_is_less).and_return(false)
       allow(subject).to receive(:sleep)
-      ssl_result = double(Beaker::Result, :stdout => '{"version":"7.12.1"}', :exit_code => 0)
-      expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/}, anything).once.and_return(ssl_result)
+      ssl_result = double(Beaker::Result, :stdout => '{"puppetdb-status":{"state":"running"}}', :exit_code => 0)
+      expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/status/v1/services/puppetdb-status}, anything).once.and_return(ssl_result)
+      expect(subject).not_to receive(:on).with(anything, %r{/pdb/meta/}, anything)
       expect(subject).not_to receive(:on).with(anything, %r{http://localhost:8080/}, anything)
 
       expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
     end
 
-    context 'when the ssl endpoint never returns valid content (older or nonstandard config)' do
-      it 'falls back to the cleartext endpoint' do
+    context 'when the ssl endpoint never returns a running state (older or nonstandard config)' do
+      it 'falls back to the cleartext status endpoint' do
         allow(subject).to receive(:version_is_less).and_return(false)
         allow(subject).to receive(:sleep)
         ssl_result = double(Beaker::Result, :stdout => '', :exit_code => 0)
-        nonssl_result = double(Beaker::Result, :stdout => '{"version":"7.12.1"}', :exit_code => 0)
-        expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/}, anything).once.ordered.and_return(ssl_result)
-        expect(subject).to receive(:on).with(anything, %r{http://localhost:8080/}, anything).once.ordered.and_return(nonssl_result)
+        nonssl_result = double(Beaker::Result, :stdout => '{"puppetdb-status":{"state":"running"}}', :exit_code => 0)
+        expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/status/v1/services/puppetdb-status}, anything).once.ordered.and_return(ssl_result)
+        expect(subject).to receive(:on).with(anything, %r{http://localhost:8080/status/v1/services/puppetdb-status}, anything).once.ordered.and_return(nonssl_result)
 
         expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: beaker-pe
 version: !ruby/object:Gem::Version
-  version: 3.6.6
+  version: 3.6.8
 platform: ruby
 authors:
 - Puppetlabs