foreman_maintain 1.9.1 → 1.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 73708bb032234b95b2f4e43e6a754f4edd5a10b5fab5b0fe48e025e97c07b045
-  data.tar.gz: 804e89098c9776b9eaabbe8ddbf25b42fadafca9180bfaaafcc1e2ad19a68cbd
+  metadata.gz: 353f969fb5c1563fa146f6f5cca6a9a5c0a42e22564aa6e26d0d5d2b58d1b943
+  data.tar.gz: b9f71f13a94ffef3cf8b338faf4d43f5aa053c58f84327713581c2f8b8bc6fa8
 SHA512:
-  metadata.gz: 7436f734603158c084a33422808590fc4de98432ecf44d64106c58d625c7356e015d9fba968dd89c72aff8974364bbcd2493e7f74d99e079be59489df4a00714
-  data.tar.gz: d24586355b6f3bd785d8222ee93443712c4de0ce14a0dff53705b029e9a1bf0ab83db582cbce0ccf0da9e603edd5f030c259220d814a466faa20e78e40ef09fd
+  metadata.gz: 81316471839fc3ac86ecc96edccecdf4b6475bdd908ab79c1d55eba6d07a8bad0e75aaa83a440449fc8bf357e1c93df87e0d5f45f4211ba602172be9fde31bd4
+  data.tar.gz: ae7ae727511fe75f9c517de28a93c66231c5e6e2a362541f769a5d99c364f4b49f9bf80b178b1def23fd6f4d83596fdc0d83e06e89540a17d0751bc838347797

data/definitions/checks/check_sha1_certificate_authority.rb

@@ -16,14 +16,34 @@ class Checks::CheckSha1CertificateAuthority < ForemanMaintain::Check
 
     return unless server_ca
 
-    certificate = OpenSSL::X509::Certificate.new(File.read(server_ca))
+    begin
+      certificates = load_fullchain(server_ca)
+    rescue OpenSSL::X509::CertificateError => e
+      assert(false, "Error reading server CA certificate #{server_ca}.\n #{e.message}")
+    else
+      msg = <<~MSG
+        Server CA certificate #{server_ca} signed with sha1 which will break on upgrade.
+        Update the server CA certificate with one signed with sha256 or
+        stronger then proceed with the upgrade.
+      MSG
 
-    msg = <<~MSG
-      Server CA certificate signed with sha1 which will break on upgrade.
-      Update the server CA certificate with one signed with sha256 or
-      stronger then proceed with the upgrade.
-    MSG
+      assert(
+        certificates.all? { |cert| cert.signature_algorithm != 'sha1WithRSAEncryption' },
+        msg
+      )
+    end
+  end
 
-    assert(certificate.signature_algorithm != 'sha1WithRSAEncryption', msg)
+  def load_fullchain(bundle_pem)
+    if OpenSSL::X509::Certificate.respond_to?(:load_file)
+      OpenSSL::X509::Certificate.load_file(bundle_pem)
+    else
+      # Can be removed when only Ruby with load_file support is supported
+      File.binread(bundle_pem).
+        lines.
+        slice_after(/^-----END CERTIFICATE-----/).
+        filter { |pem| pem.join.include?('-----END CERTIFICATE-----') }.
+        map { |pem| OpenSSL::X509::Certificate.new(pem.join) }
+    end
   end
 end

data/definitions/checks/disk/postgresql_mountpoint.rb

@@ -0,0 +1,35 @@
+module Checks
+  module Disk
+    class PostgresqlMountpoint < ForemanMaintain::Check
+      metadata do
+        label :postgresql_mountpoint
+        description 'Check to make sure PostgreSQL data is not on an own mountpoint'
+        confine do
+          feature(:instance).postgresql_local? && ForemanMaintain.el?
+        end
+      end
+
+      def run
+        assert(psql_dir_device == psql_data_dir_device, warning_message)
+      end
+
+      def psql_dir_device
+        device = ForemanMaintain::Utils::Disk::Device.new('/var/lib/pgsql')
+        device.name
+      end
+
+      def psql_data_dir_device
+        device = ForemanMaintain::Utils::Disk::Device.new('/var/lib/pgsql/data')
+        device.name
+      end
+
+      def warning_message
+        <<~MSG
+          PostgreSQL data (/var/lib/pgsql/data) is on a different device than /var/lib/pgsql.
+          This is not supported and breaks PostgreSQL upgrades.
+          Please ensure PostgreSQL data is on the same mountpoint as the /var/lib/pgsql.
+        MSG
+      end
+    end
+  end
+end

data/definitions/scenarios/foreman_upgrade.rb

@@ -39,6 +39,7 @@ module Scenarios::Foreman
         Checks::Disk::AvailableSpace,
         Checks::Disk::AvailableSpaceCandlepin, # if candlepin
         Checks::Disk::AvailableSpacePostgresql13,
+        Checks::Disk::PostgresqlMountpoint,
         Checks::Foreman::ValidateExternalDbVersion, # if external database
         Checks::Foreman::CheckExternalDbEvrPermissions, # if external database
         Checks::Foreman::CheckCorruptedRoles,

data/definitions/scenarios/satellite_upgrade.rb

@@ -38,6 +38,7 @@ module Scenarios::Satellite
         Checks::CheckUpstreamRepository,
         Checks::Disk::AvailableSpace,
         Checks::Disk::AvailableSpaceCandlepin, # if candlepin
+        Checks::Disk::PostgresqlMountpoint,
         Checks::Foreman::ValidateExternalDbVersion, # if external database
         Checks::Foreman::CheckExternalDbEvrPermissions, # if external database
         Checks::Foreman::CheckCorruptedRoles,

data/lib/foreman_maintain/version.rb

@@ -1,3 +1,3 @@
 module ForemanMaintain
-  VERSION = '1.9.1'.freeze
+  VERSION = '1.9.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: foreman_maintain
 version: !ruby/object:Gem::Version
-  version: 1.9.1
+  version: 1.9.2
 platform: ruby
 authors:
 - Ivan Nečas
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-10 00:00:00.000000000 Z
+date: 2025-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: clamp
@@ -167,6 +167,7 @@ files:
 - definitions/checks/disk/available_space_candlepin.rb
 - definitions/checks/disk/available_space_postgresql13.rb
 - definitions/checks/disk/performance.rb
+- definitions/checks/disk/postgresql_mountpoint.rb
 - definitions/checks/env_proxy.rb
 - definitions/checks/foreman/check_corrupted_roles.rb
 - definitions/checks/foreman/check_duplicate_permission.rb