cem_acpt 0.12.2 → 0.12.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e37459e007c8e05a53fddf7920cefb42223e7e490785a3601372fdf172de82f
-  data.tar.gz: 1147801fce2be7b5d0a1847d817449ad2492c8ec04707d5a82713663b2406804
+  metadata.gz: 0670fc107d34a475c456d55ee179f24488d862e24ca3eb58b1645bf994ebc216
+  data.tar.gz: e39cb29afd796dea81395ab17cc6bf6107202221a0ac1e927e5bdad256db6a61
 SHA512:
-  metadata.gz: e3e28851afbfdeeb9a2d4ca0cfc0fb10f304ba121111422416f5a50757fc9ea50bdc30db20149d00b0d04dcf91d548e73c03276863601037417ce1c39a914090
-  data.tar.gz: 232de289f1ba433d6e5c25737cadffc8641dae7052075e359e663f935225547b44f3e430f8509c9f2519f8d8abf41204b83c76964eee387cf554f45bafd04b49
+  metadata.gz: b4718840a0a1802a3b08ee469fd8857e6a6e5bbc4c26cf5902793d6e7e0eb5bae7efe781e8f354ad28edd951605c1270bee07f187e00532cb07ee3131e3f98ab
+  data.tar.gz: d9267e9d122d925f4384c638141f25be84a22a036fc60c4ad1319dacb302daafd144e04cc7dacf495f0d607f84ab401f6b4190006184cdcf967034ced6e70b54

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    cem_acpt (0.12.2)
+    cem_acpt (0.12.3)
       async-http (>= 0.60, < 0.70)
       bcrypt_pbkdf (>= 1.0, < 2.0)
       deep_merge (>= 1.2, < 2.0)

data/lib/cem_acpt/image_builder/provision_commands.rb

@@ -97,10 +97,22 @@ module CemAcpt
       end
 
       class DebianFamily
-        def initialize(config, image_name, base_image, os_major_version, puppet_version)
+        CODENAME_MAP = {
+          'ubuntu' => {
+            '2004' => 'focal',
+            '2204' => 'jammy',
+            '2404' => 'noble',
+          },
+          'debian' => {
+            '12' => 'bookworm',
+          },
+        }.freeze
+
+        def initialize(config, image_name, base_image, os_major_version, puppet_version, os: 'ubuntu')
           @config = config
           @image_name = image_name
           @base_image = base_image
+          @os = os
           @os_major_version = os_major_version
           @puppet_version = puppet_version
         end
@@ -121,8 +133,16 @@ module CemAcpt
 
         private
 
+        def apt_codename
+          CODENAME_MAP.dig(@os, @os_major_version) || 'focal'
+        end
+
+        def noninteractive?
+          (@os == 'ubuntu' && @os_major_version.to_i > 2004) || @os == 'debian'
+        end
+
         def upgrade_packages_command
-          if @os_major_version.to_i > 2004
+          if noninteractive?
             'sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=a apt-get update &&'\
             ' sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=a apt-get upgrade -y'
           else
@@ -146,15 +166,15 @@ module CemAcpt
 
         # Update to the new private Puppet platform repository URL for apt
         def puppet_platform_repository_url
-          "https://apt-puppetcore.puppet.com/public/puppet#{@puppet_version}-release-focal.deb"
+          "https://apt-puppetcore.puppet.com/public/puppet#{@puppet_version}-release-#{apt_codename}.deb"
         end
 
         def enable_puppet_repository_command
-          "wget --content-disposition #{puppet_platform_repository_url} && sudo dpkg -i puppet#{@puppet_version}-release-focal.deb"
+          "wget --content-disposition #{puppet_platform_repository_url} && sudo dpkg -i puppet#{@puppet_version}-release-#{apt_codename}.deb"
         end
 
         def install_puppet_agent_command
-          if @os_major_version.to_i > 2004
+          if noninteractive?
             'sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=a apt-get install -y puppet-agent'
           else
             'sudo apt-get install -y puppet-agent'
@@ -175,6 +195,7 @@ module CemAcpt
           'oel' => 'EnterpriseLinuxFamily',
           'rocky' => 'EnterpriseLinuxFamily',
           'ubuntu' => 'DebianFamily',
+          'debian' => 'DebianFamily',
           'windows' => 'WindowsFamily',
         }.freeze
 
@@ -184,7 +205,12 @@ module CemAcpt
           cmd_klass = OS_CLASS_MAP[os.to_s]
           raise "Unsupported OS: #{os}" unless cmd_klass
 
-          const_get(cmd_klass).new(config, image_name, base_image, os_major_version, puppet_version).provision_commands
+          klass = const_get(cmd_klass)
+          if klass == DebianFamily
+            klass.new(config, image_name, base_image, os_major_version, puppet_version, os: os.to_s).provision_commands
+          else
+            klass.new(config, image_name, base_image, os_major_version, puppet_version).provision_commands
+          end
         end
       end
     end

data/lib/cem_acpt/provision/terraform/linux.rb

@@ -6,12 +6,15 @@ module CemAcpt
   module Provision
     # Class provides methods for gathering provision data for Linux nodes
     class Linux < OsData
+      GOSS_VERSION = 'v0.4.9'
+      GOSS_DOWNLOAD_URL = "https://github.com/goss-org/goss/releases/download/#{GOSS_VERSION}/goss-linux-amd64"
+
       def self.valid_names
-        %w[centos rhel oel alma rocky ubuntu]
+        %w[centos rhel oel alma rocky ubuntu debian]
       end
 
       def self.valid_versions
-        %w[7 8 9 10 2004 2204 2404]
+        %w[7 8 9 10 12 2004 2204 2404]
       end
 
       def systemd_files
@@ -29,7 +32,7 @@ module CemAcpt
       def provision_commands
         commands = [
           "sudo /opt/puppetlabs/puppet/bin/puppet module install #{destination_provision_directory}/#{remote_module_package_name}",
-          'curl -fsSL https://goss.rocks/install | sudo sh',
+          "sudo curl -fsSL #{GOSS_DOWNLOAD_URL} -o /usr/local/bin/goss && sudo chmod +rx /usr/local/bin/goss",
           'sudo /opt/puppetlabs/puppet/bin/gem install webrick',
           'sudo chmod +x /opt/cem_acpt/log_service/log_service.rb',
           'sudo /opt/cem_acpt/log_service/log_service.rb',
@@ -88,7 +91,7 @@ module CemAcpt
             'sudo dnf upgrade -y dnf',
           ]
           (commands << base).flatten
-        elsif image_name.include?('ubuntu')
+        elsif image_name.include?('ubuntu') || image_name.include?('debian')
           commands = ['sudo apt purge -y unattended-upgrades', 'sudo apt-get update -y']
           (commands << base).flatten
         else

data/lib/cem_acpt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CemAcpt
-  VERSION = '0.12.2'
+  VERSION = '0.12.4'
 end

data/specifications/CEM-6827.md

@@ -0,0 +1,91 @@
+# CEM-6827 — Fix Goss installation to bypass broken upstream install script
+
+## Summary
+
+All acceptance tests across all branches are failing with `ECONNREFUSED` on ports 8080–8083.
+The `cem_acpt` gem installs Goss on test VMs via `curl -fsSL https://goss.rocks/install | sudo sh`
+(`lib/cem_acpt/provision/terraform/linux.rb:32`). The upstream install script was recently changed
+to construct download URLs using a new naming convention (`goss_0.4.9_linux_x86_64.tar.gz`), but
+existing releases still publish assets under the old format (`goss-linux-amd64`). The constructed
+URL returns a 404, Goss is never installed, the health-check sidecar never starts, and every
+acceptance test fails.
+
+Replace the `curl | sh` invocation with a direct binary download from the GitHub releases page,
+hard-pinned to Goss v0.4.9.
+
+## Goals
+
+- Goss installs successfully on test VMs regardless of the state of the upstream install script.
+- Acceptance tests pass the health-check stage and connect on ports 8080–8083.
+- The Goss version is pinned to a known-good release (v0.4.9) so future upstream changes cannot silently break provisioning.
+
+## Non-goals
+
+- Supporting architectures other than amd64 (all test VMs are x86_64).
+- Adding SHA-256 checksum verification for the downloaded binary (the previous `curl | sh` had no verification either).
+- Making the Goss version configurable via `cem_acpt` config.
+- Windows Goss support (Windows nodes do not use Goss).
+- Fixing or working around the upstream install script itself.
+
+## Proposed Design
+
+### `lib/cem_acpt/provision/terraform/linux.rb`
+
+Add two constants at the top of the `Linux` class for the pinned version and download URL:
+
+```ruby
+GOSS_VERSION = 'v0.4.9'
+GOSS_DOWNLOAD_URL = "https://github.com/goss-org/goss/releases/download/#{GOSS_VERSION}/goss-linux-amd64"
+```
+
+Replace the `curl | sh` line in `provision_commands`:
+
+```ruby
+# before
+'curl -fsSL https://goss.rocks/install | sudo sh',
+
+# after
+"curl -fsSL #{GOSS_DOWNLOAD_URL} -o /usr/local/bin/goss && sudo chmod +rx /usr/local/bin/goss",
+```
+
+This downloads the binary directly to `/usr/local/bin/goss` (the same location the old install script used) and makes it executable.
+
+## Edge Cases
+
+- **Upstream install script is fixed later** — the direct download is stable regardless; no action needed. We can evaluate returning to the install script in a future ticket if desired.
+- **Goss v0.4.9 release assets are removed from GitHub** — unlikely for a tagged release, but if it happens the download would 404 and `curl -f` would fail fast with a clear error rather than silently installing nothing.
+- **Network failure during download** — `curl -f` returns a non-zero exit code, Terraform `remote-exec` aborts, and the provisioning error is surfaced to the operator. Same behavior as before.
+
+## Constraints / Invariants
+
+- The Goss binary must land at `/usr/local/bin/goss` — all three systemd service units (`goss-acpt.service`, `goss-idempotent.service`, `goss-noop.service`) invoke `goss` by that path.
+- `scan_provision_commands` is unaffected — it intentionally skips Goss installation.
+- The `provision_commands_wrapper` method is unchanged; it delegates to `provision_commands` which picks up the new install command.
+
+## Test Plan
+
+### `spec/cem_acpt/provision/terraform/linux_spec.rb`
+
+1. Assert that `provision_commands` includes a command containing the `GOSS_DOWNLOAD_URL` constant value.
+2. Assert that `provision_commands` does **not** contain `goss.rocks/install`.
+3. Assert that the Goss install command writes to `/usr/local/bin/goss`.
+
+### Existing specs
+
+Run the full spec suite (`bundle exec rake spec`) to confirm no regressions.
+
+## Acceptance Criteria
+
+- [ ] `provision_commands` no longer references `goss.rocks/install`.
+- [ ] `provision_commands` downloads Goss v0.4.9 directly from the GitHub releases page.
+- [ ] The Goss binary is placed at `/usr/local/bin/goss` with execute permissions.
+- [ ] `GOSS_VERSION` and `GOSS_DOWNLOAD_URL` are defined as constants on `CemAcpt::Provision::Linux`.
+- [ ] `scan_provision_commands` is unchanged (no Goss installation in scan mode).
+- [ ] All existing specs pass.
+- [ ] New unit tests verify the download URL and absence of `goss.rocks`.
+
+## Files Touched
+
+- `lib/cem_acpt/provision/terraform/linux.rb` — replace `curl | sh` with direct download; add `GOSS_VERSION` and `GOSS_DOWNLOAD_URL` constants.
+- `spec/cem_acpt/provision/terraform/linux_spec.rb` — add tests for new Goss install command.
+- `specifications/CEM-6827.md` — this file.

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: cem_acpt
 version: !ruby/object:Gem::Version
-  version: 0.12.2
+  version: 0.12.4
 platform: ruby
 authors:
 - puppetlabs
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-24 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: async-http
@@ -350,6 +349,7 @@ files:
 - specifications/CEM-6765.md
 - specifications/CEM-6798.md
 - specifications/CEM-6799.md
+- specifications/CEM-6827.md
 homepage: https://github.com/puppetlabs/cem_acpt
 licenses:
 - proprietary
@@ -357,7 +357,6 @@ metadata:
   homepage_uri: https://github.com/puppetlabs/cem_acpt
   source_code_uri: https://github.com/puppetlabs/cem_acpt
   changelog_uri: https://github.com/puppetlabs/cem_acpt
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -372,8 +371,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: CEM Acceptance Tests
 test_files: []