foreman_maintain 1.7.7 → 1.7.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 329ada89d3d751c8024bbc6b70a3ef05100ae55ab54de1704b214ef13a49f7e1
-  data.tar.gz: 34454b5429d9c9666db5a068d8a5149e946360daba3aaeebcb8a72a4f7010a24
+  metadata.gz: 8777c6bb442c0912407d6f30a576230c2c55308168b8303d0fb88acdf63ed5ed
+  data.tar.gz: 60f93fc85d0f78df89cad0a8de1a50cef4cfc31f171ca97cb84e38811868b5b8
 SHA512:
-  metadata.gz: 8fc3733003a48ef868139beab0b0fd3fdf74484ee87bb1f332dbd422aac94aedf527ba22f7e88cdc65a85dfafab299fed03fa16e17d74250f620ddece5c483ea
-  data.tar.gz: d6b385cddfe41a785733e449a8ca6a79488bc1b820c21f3cf18d186a12a0c3be6ea69dc61599ad186539f74bfd50950685a1a994eb26e05f627847a9860c5624
+  metadata.gz: 8ca48978960dfacef447466bbdfcd8f346402591645b0e44ce01d7b00a6c0981a7528c0a066d193807ad503fef6c624c9f0f7d683561cc92f42d07df28cf638b
+  data.tar.gz: e318ca1d5e8816e1073068d373b862871dd2b0527c9c0c4de1839ae6ec1e9bbe04c381409350d599a6bce25890acbc21ceb7c0f48224e463ca8cf21c237b9c13

data/definitions/checks/check_sha1_certificate_authority.rb

@@ -0,0 +1,27 @@
+class Checks::CheckSha1CertificateAuthority < ForemanMaintain::Check
+  metadata do
+    label :check_sha1_certificate_authority
+    description 'Check if server certificate authority is sha1 signed'
+
+    confine do
+      feature(:katello) || feature(:foreman_proxy)
+    end
+
+    do_not_whitelist
+  end
+
+  def run
+    installer_answers = feature(:installer).answers
+    server_ca = installer_answers['certs']['server_ca_cert']
+
+    certificate = OpenSSL::X509::Certificate.new(File.read(server_ca))
+
+    msg = <<~MSG
+      Server CA certificate signed with sha1 which will break on upgrade.
+      Update the server CA certificate with one signed with sha256 or
+      stronger then proceed with the upgrade.
+    MSG
+
+    assert(certificate.signature_algorithm != 'sha1WithRSAEncryption', msg)
+  end
+end

data/definitions/scenarios/foreman_upgrade.rb

@@ -53,6 +53,7 @@ module Scenarios::Foreman
         Checks::PackageManager::Dnf::ValidateDnfConfig,
         Checks::Repositories::CheckNonRhRepository,
         Checks::CheckOrganizationContentAccessMode,
+        Checks::CheckSha1CertificateAuthority,
         Checks::Repositories::Validate
       )
     end

data/definitions/scenarios/satellite_upgrade.rb

@@ -55,6 +55,7 @@ module Scenarios::Satellite
         Checks::CheckIpv6Disable,
         Checks::Disk::AvailableSpacePostgresql13,
         Checks::CheckOrganizationContentAccessMode,
+        Checks::CheckSha1CertificateAuthority,
         Checks::Repositories::Validate.new(:version => target_version),
       )
     end

data/lib/foreman_maintain/version.rb

@@ -1,3 +1,3 @@
 module ForemanMaintain
-  VERSION = '1.7.7'.freeze
+  VERSION = '1.7.8'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: foreman_maintain
 version: !ruby/object:Gem::Version
-  version: 1.7.7
+  version: 1.7.8
 platform: ruby
 authors:
 - Ivan Nečas
@@ -162,6 +162,7 @@ files:
 - definitions/checks/candlepin/db_up.rb
 - definitions/checks/check_hotfix_installed.rb
 - definitions/checks/check_ipv6_disable.rb
+- definitions/checks/check_sha1_certificate_authority.rb
 - definitions/checks/check_tmout.rb
 - definitions/checks/disk/available_space.rb
 - definitions/checks/disk/available_space_candlepin.rb