cem_acpt 0.12.2 → 0.12.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e37459e007c8e05a53fddf7920cefb42223e7e490785a3601372fdf172de82f
-  data.tar.gz: 1147801fce2be7b5d0a1847d817449ad2492c8ec04707d5a82713663b2406804
+  metadata.gz: 40d059ce2fbf022d431d61c48d54b20e3b7ded34912c431c646e23886ca4b27e
+  data.tar.gz: 65e50ed28c0fb2884fa3e336e499e2eba9ad3f883cf238c86b0b2a01d8a52623
 SHA512:
-  metadata.gz: e3e28851afbfdeeb9a2d4ca0cfc0fb10f304ba121111422416f5a50757fc9ea50bdc30db20149d00b0d04dcf91d548e73c03276863601037417ce1c39a914090
-  data.tar.gz: 232de289f1ba433d6e5c25737cadffc8641dae7052075e359e663f935225547b44f3e430f8509c9f2519f8d8abf41204b83c76964eee387cf554f45bafd04b49
+  metadata.gz: 67e2180ae47a96d4563d650787498816d448e60fcb101031cbe3c00c4d7ceafa9fe8101f1ea7c4c9195eea665a7bbbc3295fc5d17ea3d0e97637bb92ec15a476
+  data.tar.gz: fa47ea0174cbcba601d9caaa09001c616c69cf845f0fce346b1ae16c3e503b97387a9ba02965d2fbcad9b9211a8711aedde7d138ad5a5b1aa3983a272a49ece2

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    cem_acpt (0.12.2)
+    cem_acpt (0.12.3)
       async-http (>= 0.60, < 0.70)
       bcrypt_pbkdf (>= 1.0, < 2.0)
       deep_merge (>= 1.2, < 2.0)

data/lib/cem_acpt/provision/terraform/linux.rb

@@ -6,6 +6,9 @@ module CemAcpt
   module Provision
     # Class provides methods for gathering provision data for Linux nodes
     class Linux < OsData
+      GOSS_VERSION = 'v0.4.9'
+      GOSS_DOWNLOAD_URL = "https://github.com/goss-org/goss/releases/download/#{GOSS_VERSION}/goss-linux-amd64"
+
       def self.valid_names
         %w[centos rhel oel alma rocky ubuntu]
       end
@@ -29,7 +32,7 @@ module CemAcpt
       def provision_commands
         commands = [
           "sudo /opt/puppetlabs/puppet/bin/puppet module install #{destination_provision_directory}/#{remote_module_package_name}",
-          'curl -fsSL https://goss.rocks/install | sudo sh',
+          "sudo curl -fsSL #{GOSS_DOWNLOAD_URL} -o /usr/local/bin/goss && sudo chmod +rx /usr/local/bin/goss",
           'sudo /opt/puppetlabs/puppet/bin/gem install webrick',
           'sudo chmod +x /opt/cem_acpt/log_service/log_service.rb',
           'sudo /opt/cem_acpt/log_service/log_service.rb',

data/lib/cem_acpt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CemAcpt
-  VERSION = '0.12.2'
+  VERSION = '0.12.3'
 end

data/specifications/CEM-6827.md

@@ -0,0 +1,91 @@
+# CEM-6827 — Fix Goss installation to bypass broken upstream install script
+
+## Summary
+
+All acceptance tests across all branches are failing with `ECONNREFUSED` on ports 8080–8083.
+The `cem_acpt` gem installs Goss on test VMs via `curl -fsSL https://goss.rocks/install | sudo sh`
+(`lib/cem_acpt/provision/terraform/linux.rb:32`). The upstream install script was recently changed
+to construct download URLs using a new naming convention (`goss_0.4.9_linux_x86_64.tar.gz`), but
+existing releases still publish assets under the old format (`goss-linux-amd64`). The constructed
+URL returns a 404, Goss is never installed, the health-check sidecar never starts, and every
+acceptance test fails.
+
+Replace the `curl | sh` invocation with a direct binary download from the GitHub releases page,
+hard-pinned to Goss v0.4.9.
+
+## Goals
+
+- Goss installs successfully on test VMs regardless of the state of the upstream install script.
+- Acceptance tests pass the health-check stage and connect on ports 8080–8083.
+- The Goss version is pinned to a known-good release (v0.4.9) so future upstream changes cannot silently break provisioning.
+
+## Non-goals
+
+- Supporting architectures other than amd64 (all test VMs are x86_64).
+- Adding SHA-256 checksum verification for the downloaded binary (the previous `curl | sh` had no verification either).
+- Making the Goss version configurable via `cem_acpt` config.
+- Windows Goss support (Windows nodes do not use Goss).
+- Fixing or working around the upstream install script itself.
+
+## Proposed Design
+
+### `lib/cem_acpt/provision/terraform/linux.rb`
+
+Add two constants at the top of the `Linux` class for the pinned version and download URL:
+
+```ruby
+GOSS_VERSION = 'v0.4.9'
+GOSS_DOWNLOAD_URL = "https://github.com/goss-org/goss/releases/download/#{GOSS_VERSION}/goss-linux-amd64"
+```
+
+Replace the `curl | sh` line in `provision_commands`:
+
+```ruby
+# before
+'curl -fsSL https://goss.rocks/install | sudo sh',
+
+# after
+"curl -fsSL #{GOSS_DOWNLOAD_URL} -o /usr/local/bin/goss && sudo chmod +rx /usr/local/bin/goss",
+```
+
+This downloads the binary directly to `/usr/local/bin/goss` (the same location the old install script used) and makes it executable.
+
+## Edge Cases
+
+- **Upstream install script is fixed later** — the direct download is stable regardless; no action needed. We can evaluate returning to the install script in a future ticket if desired.
+- **Goss v0.4.9 release assets are removed from GitHub** — unlikely for a tagged release, but if it happens the download would 404 and `curl -f` would fail fast with a clear error rather than silently installing nothing.
+- **Network failure during download** — `curl -f` returns a non-zero exit code, Terraform `remote-exec` aborts, and the provisioning error is surfaced to the operator. Same behavior as before.
+
+## Constraints / Invariants
+
+- The Goss binary must land at `/usr/local/bin/goss` — all three systemd service units (`goss-acpt.service`, `goss-idempotent.service`, `goss-noop.service`) invoke `goss` by that path.
+- `scan_provision_commands` is unaffected — it intentionally skips Goss installation.
+- The `provision_commands_wrapper` method is unchanged; it delegates to `provision_commands` which picks up the new install command.
+
+## Test Plan
+
+### `spec/cem_acpt/provision/terraform/linux_spec.rb`
+
+1. Assert that `provision_commands` includes a command containing the `GOSS_DOWNLOAD_URL` constant value.
+2. Assert that `provision_commands` does **not** contain `goss.rocks/install`.
+3. Assert that the Goss install command writes to `/usr/local/bin/goss`.
+
+### Existing specs
+
+Run the full spec suite (`bundle exec rake spec`) to confirm no regressions.
+
+## Acceptance Criteria
+
+- [ ] `provision_commands` no longer references `goss.rocks/install`.
+- [ ] `provision_commands` downloads Goss v0.4.9 directly from the GitHub releases page.
+- [ ] The Goss binary is placed at `/usr/local/bin/goss` with execute permissions.
+- [ ] `GOSS_VERSION` and `GOSS_DOWNLOAD_URL` are defined as constants on `CemAcpt::Provision::Linux`.
+- [ ] `scan_provision_commands` is unchanged (no Goss installation in scan mode).
+- [ ] All existing specs pass.
+- [ ] New unit tests verify the download URL and absence of `goss.rocks`.
+
+## Files Touched
+
+- `lib/cem_acpt/provision/terraform/linux.rb` — replace `curl | sh` with direct download; add `GOSS_VERSION` and `GOSS_DOWNLOAD_URL` constants.
+- `spec/cem_acpt/provision/terraform/linux_spec.rb` — add tests for new Goss install command.
+- `specifications/CEM-6827.md` — this file.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cem_acpt
 version: !ruby/object:Gem::Version
-  version: 0.12.2
+  version: 0.12.3
 platform: ruby
 authors:
 - puppetlabs
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-24 00:00:00.000000000 Z
+date: 2026-07-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: async-http
@@ -350,6 +350,7 @@ files:
 - specifications/CEM-6765.md
 - specifications/CEM-6798.md
 - specifications/CEM-6799.md
+- specifications/CEM-6827.md
 homepage: https://github.com/puppetlabs/cem_acpt
 licenses:
 - proprietary