leap_cli 1.7.3 → 1.7.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 36be7f0c765dbd1c64ca36079780ad6f44797fe0
-  data.tar.gz: 379a244c172b9a07d0f9b1a1635d47aa16bd68bc
+  metadata.gz: fde4e852d415bcc30ed9d48a65e5b264ac999d4f
+  data.tar.gz: a3658cdc96431cf991509bbd48e0d3aa4afdadc3
 SHA512:
-  metadata.gz: 079ed74cf97faa015438ecf0dbc4ac2e4bc50a0360e48b602597ef9e8a7e7959943872a498554ef38d455ba461ff65e481d444c25bd55d14e92b6f7abd842fed
-  data.tar.gz: 1ec35e8f043b0b0b4516a6fa447420f0d1eb0e42c062b40afb9aae9ab939c0ce50b97dcf5989a5aac7fd70d26aa88333a8e77c655dfa76d97d7573a616f77f20
+  metadata.gz: 5ab70f0f7a3a39e09ccac39dd3fb69d7dd6a5b47366f1251b24dbfc283ada437ceed72ce1a9e5a27b96d620e7206da597e1c482c0722aca3d2116db115b5f9e5
+  data.tar.gz: 9838e7df5040c85caae31cb394edad4da7f4f809c15c3e5046707e8d4ea97195c75f49d0947df289c91bfaad3fe1549249bf1409b2bce07d49ecae0bfdb9ddd7

data/bin/leap

@@ -18,20 +18,11 @@ LEAP_CLI_BASE_DIR = File.expand_path('..', File.dirname(File.symlink?(__FILE__)
 ORIGINAL_ARGV = ARGV.dup
 
 begin
+  # First, try to load the leap_cli code that is local to this `leap` command.
+  # If that fails, then we try to load leap_cli as a gem.
+  require File.join(LEAP_CLI_BASE_DIR, 'lib','leap_cli','load_paths')
   require 'leap_cli'
 rescue LoadError
-  #
-  # When developing a gem with a command, you normally use `bundle exec bin/command-name`
-  # to run your app. At install-time, RubyGems will make sure lib, etc. are in the load path,
-  # so that you can run the command directly.
-  #
-  # However, I don't like using 'bundle exec'. It is slow, and limits which directory you can
-  # run in. So, instead, we fall back to some path manipulation hackery.
-  #
-  # This allows you to run the command directly while developing the gem, and also lets you
-  # run from anywhere (I like to link 'bin/leap' to /usr/local/bin/leap).
-  #
-  require File.join(LEAP_CLI_BASE_DIR, 'lib','leap_cli','load_paths')
   require 'leap_cli'
 end
 

data/lib/leap_cli/commands/compile.rb

@@ -1,3 +1,4 @@
+require 'socket'
 
 module LeapCli
   module Commands
@@ -14,12 +15,16 @@ module LeapCli
           end
           if environment
             if manager.environment_names.include?(environment)
-              compile_hiera_files(manager.filter([environment]))
+              compile_hiera_files(manager.filter([environment]), false)
             else
               bail! "There is no environment named `#{environment}`."
             end
           else
-            compile_hiera_files(manager.filter)
+            clean_export = LeapCli.leapfile.environment.nil?
+            compile_hiera_files(manager.filter, clean_export)
+          end
+          if file_exists?(:static_web_readme)
+            compile_provider_json(environment)
           end
         end
       end
@@ -31,20 +36,26 @@ module LeapCli
         end
       end
 
+      c.desc "Compile provider.json bootstrap files for your provider."
+      c.command 'provider.json' do |provider|
+        provider.action do |global_options, options, args|
+          compile_provider_json
+        end
+      end
+
       c.default_command :all
     end
 
     protected
 
-    def compile_hiera_files(nodes=nil)
-      # these must come first
-      update_compiled_ssh_configs
-
-      # export generated files
+    #
+    # a "clean" export of secrets will also remove keys that are no longer used,
+    # but this should not be done if we are not examining all possible nodes.
+    #
+    def compile_hiera_files(nodes, clean_export)
+      update_compiled_ssh_configs # must come first
+      sanity_check(nodes)
       manager.export_nodes(nodes)
-      # a "clean" export of secrets will also remove keys that are no longer used,
-      # but this should not be done if we are not examining all possible nodes.
-      clean_export = nodes.nil?
       manager.export_secrets(clean_export)
     end
 
@@ -54,6 +65,34 @@ module LeapCli
       update_known_hosts
     end
 
+    def sanity_check(nodes)
+      # confirm that every node has a unique ip address
+      ips = {}
+      nodes.pick_fields('ip_address').each do |name, ip_address|
+        if ips.key?(ip_address)
+          bail! {
+            log(:fatal_error, "Every node must have its own IP address.") {
+              log "Nodes `#{name}` and `#{ips[ip_address]}` are both configured with `#{ip_address}`."
+            }
+          }
+        else
+          ips[ip_address] = name
+        end
+      end
+      # confirm that the IP address of this machine is not also used for a node.
+      Socket.ip_address_list.each do |addrinfo|
+        if !addrinfo.ipv4_private? && ips.key?(addrinfo.ip_address)
+          ip = addrinfo.ip_address
+          name = ips[ip]
+          bail! {
+            log(:fatal_error, "Something is very wrong. The `leap` command must only be run on your sysadmin machine, not on a provider node.") {
+              log "This machine has the same IP address (#{ip}) as node `#{name}`."
+            }
+          }
+        end
+      end
+    end
+
     ##
     ## SSH
     ##
@@ -132,6 +171,78 @@ module LeapCli
       write_file!(:known_hosts, buffer.string)
     end
 
+    ##
+    ## provider.json
+    ##
+
+    #
+    # generates static provider.json files that can put into place
+    # (e.g. https://domain/provider.json) for the cases where the
+    # webapp domain does not match the provider's domain.
+    #
+    def compile_provider_json(environments=nil)
+      webapp_nodes = manager.nodes[:services => 'webapp']
+      write_file!(:static_web_readme, STATIC_WEB_README)
+      environments ||= manager.environment_names
+      environments.each do |env|
+        node = webapp_nodes[:environment => env].values.first
+        if node
+          env ||= 'default'
+          write_file!(
+            [:static_web_provider_json, env],
+            node['definition_files']['provider']
+          )
+          write_file!(
+            [:static_web_htaccess, env],
+            HTACCESS_FILE % {:min_version => manager.env(env).provider.client_version['min']}
+          )
+        end
+      end
+    end
+
+    HTACCESS_FILE = %[
+  <Location /provider.json>
+    Header set X-Minimum-Client-Version %{min_version}
+  </Location>
+]
+
+    STATIC_WEB_README = %[
+This directory contains statically rendered copies of the `provider.json` file
+used by the client to "bootstrap" configure itself for use with your service
+provider.
+
+There is a separate provider.json file for each environment, although you
+should only need 'production/provider.json' or, if you have no environments
+configured, 'default/provider.json'.
+
+To clarify, this is the public `provider.json` file used by the client, not the
+`provider.json` file that is used to configure the provider.
+
+The provider.json file must be available at `https://domain/provider.json`
+(unless this provider is included in the list of providers which are pre-
+seeded in client).
+
+This provider.json file can be served correctly in one of three ways:
+
+(1) If the property webapp.domain is not configured, then the web app will be
+    installed at https://domain/ and it will handle serving the provider.json file.
+
+(2) If one or more nodes have the 'static' service configured for the provider's
+    domain, then these 'static' nodes will correctly serve provider.json.
+
+(3) Otherwise, you must copy the provider.json file to your web
+    server and make it available at '/provider.json'. The example htaccess
+    file shows what header options should be sent by the web server
+    with the response.
+
+This directory is needed for method (3), but not for methods (1) or (2).
+
+This directory has been created by the command `leap compile provider.json`.
+Once created, it will be kept up to date everytime you compile. You may safely
+remove this directory if you don't use it.
+]
+
+    ##
     ##
     ## ZONE FILE
     ##
@@ -183,7 +294,7 @@ module LeapCli
           if node.dns['aliases']
             node.dns.aliases.each do |host_alias|
               if host_alias != node.domain.full && host_alias != provider.domain
-                put_line.call relative_hostname(host_alias), "IN CNAME  #{relative_hostname(node.domain.full)}"
+                put_line.call relative_hostname(host_alias), "IN A      #{node.ip_address}"
               end
             end
           end

data/lib/leap_cli/commands/deploy.rb

@@ -34,7 +34,7 @@ module LeapCli
           init_submodules
         end
 
-        nodes = manager.filter!(args)
+        nodes = manager.filter!(args, :disabled => false)
         if nodes.size > 1
           say "Deploying to these nodes: #{nodes.keys.join(', ')}"
           if !global[:yes] && !agree("Continue? ")
@@ -51,7 +51,7 @@ module LeapCli
         end
         # compile hiera files for all the nodes in every environment that is
         # being deployed and only those environments.
-        compile_hiera_files(manager.filter(environments))
+        compile_hiera_files(manager.filter(environments), false)
         # update server certificates if needed
         update_certificates(nodes)
 

data/lib/leap_cli/commands/facts.rb

@@ -49,7 +49,7 @@ module LeapCli; module Commands
       if overwrite || content.nil? || content.empty?
         old_facts = {}
       else
-        old_facts = JSON.parse(content)
+        old_facts = manager.facts
       end
       facts = old_facts.merge(new_facts)
       facts.each do |name, value|
@@ -57,7 +57,7 @@ module LeapCli; module Commands
           if value == ""
             value = nil
           else
-            value = JSON.parse(value)
+            value = JSON.parse(value) rescue JSON::ParserError
           end
         end
         if value.is_a? Hash
@@ -69,7 +69,7 @@ module LeapCli; module Commands
         value.nil? || value.empty?
       end
       if facts.empty?
-        nil
+        "{}\n"
       else
         JSON.sorted_generate(facts) + "\n"
       end
@@ -79,7 +79,7 @@ module LeapCli; module Commands
   private
 
   def update_facts(global_options, options, args)
-    nodes = manager.filter(args, :local => false)
+    nodes = manager.filter(args, :local => false, :disabled => false)
     new_facts = {}
     ssh_connect(nodes) do |ssh|
       ssh.leap.run_with_progress(facter_cmd) do |response|

data/lib/leap_cli/commands/list.rb

@@ -46,12 +46,15 @@ module LeapCli; module Commands
     max_width = nodes.keys.inject(0) {|max,i| [i.size,max].max}
     nodes.each_node do |node|
       value = properties.collect{|prop|
-        if node[prop].nil?
+        prop_value = node[prop]
+        if prop_value.nil?
           "null"
-        elsif node[prop] == ""
+        elsif prop_value == ""
           "empty"
+        elsif prop_value.is_a? LeapCli::Config::Object
+          node[prop].dump_json(:compact) # TODO: add option of getting pre-evaluation values.
         else
-          node[prop]
+          prop_value.to_s
         end
       }.join(', ')
       printf("%#{max_width}s  %s\n", node.name, value)

data/lib/leap_cli/commands/pre.rb

@@ -47,6 +47,10 @@ module LeapCli; module Commands
   #  :color   -- true or false, to log in color or not.
   #
   def initialize_leap_cli(require_provider, options={})
+    if Process::Sys.getuid == 0
+      bail! "`leap` should not be run as root."
+    end
+
     # set verbosity
     options[:verbose] ||= 1
     LeapCli.set_log_level(options[:verbose].to_i)

data/lib/leap_cli/commands/vagrant.rb

@@ -9,8 +9,15 @@ module LeapCli; module Commands
     local.desc 'Starts up the virtual machine(s)'
     local.arg_name 'FILTER', :optional => true #, :multiple => false
     local.command :start do |start|
+      start.flag(:basebox,
+        :desc => "The basebox to use. This value is passed to vagrant as the "+
+          "`config.vm.box` option. The value here should be the name of an installed box or a "+
+          "shorthand name of a box in HashiCorp's Atlas.",
+        :arg_name => 'BASEBOX',
+        :default_value => 'LEAP/wheezy'
+      )
       start.action do |global_options,options,args|
-        vagrant_command(["up", "sandbox on"], args)
+        vagrant_command(["up", "sandbox on"], args, options)
       end
     end
 
@@ -84,8 +91,8 @@ module LeapCli; module Commands
 
   protected
 
-  def vagrant_command(cmds, args)
-    vagrant_setup
+  def vagrant_command(cmds, args, options={})
+    vagrant_setup(options)
     cmds = cmds.to_a
     if args.empty?
       nodes = [""]
@@ -108,7 +115,7 @@ module LeapCli; module Commands
 
   private
 
-  def vagrant_setup
+  def vagrant_setup(options)
     assert_bin! 'vagrant', 'Vagrant is required for running local virtual machines. Run "sudo apt-get install vagrant".'
 
     if vagrant_version <= Gem::Version.new('1.0.0')
@@ -123,7 +130,7 @@ module LeapCli; module Commands
         assert_run! 'vagrant plugin install sahara'
       end
     end
-    create_vagrant_file
+    create_vagrant_file(options)
   end
 
   def vagrant_version
@@ -135,16 +142,18 @@ module LeapCli; module Commands
     exec cmd
   end
 
-  def create_vagrant_file
+  def create_vagrant_file(options)
     lines = []
     netmask = IPAddr.new('255.255.255.255').mask(LeapCli.leapfile.vagrant_network.split('/').last).to_s
 
+    basebox = options[:basebox] || 'LEAP/wheezy'
+
     if vagrant_version <= Gem::Version.new('1.1.0')
       lines << %[Vagrant::Config.run do |config|]
       manager.each_node do |node|
         if node.vagrant?
           lines << %[  config.vm.define :#{node.name} do |config|]
-          lines << %[    config.vm.box = "LEAP/wheezy"]
+          lines << %[    config.vm.box = "#{basebox}"]
           lines << %[    config.vm.network :hostonly, "#{node.ip_address}", :netmask => "#{netmask}"]
           lines << %[    config.vm.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]]
           lines << %[    config.vm.customize ["modifyvm", :id, "--name", "#{node.name}"]]
@@ -157,7 +166,7 @@ module LeapCli; module Commands
       manager.each_node do |node|
         if node.vagrant?
           lines << %[  config.vm.define :#{node.name} do |config|]
-          lines << %[    config.vm.box = "LEAP/wheezy"]
+          lines << %[    config.vm.box = "#{basebox}"]
           lines << %[    config.vm.network :private_network, ip: "#{node.ip_address}"]
           lines << %[    config.vm.provider "virtualbox" do |v|]
           lines << %[      v.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]]

data/lib/leap_cli/config/filter.rb

@@ -97,6 +97,9 @@ module LeapCli
         if @options[:local] === false
           node_list = node_list[:environment => '!local']
         end
+        if @options[:disabled] === false
+          node_list = node_list[:environment => '!disabled']
+        end
         node_list
       end
 

data/lib/leap_cli/config/manager.rb

@@ -43,7 +43,15 @@ module LeapCli
       # returns the Hash of the contents of facts.json
       #
       def facts
-        @facts ||= JSON.parse(Util.read_file(:facts) || "{}")
+        @facts ||= begin
+          content = Util.read_file(:facts)
+          if !content || content.empty?
+            content = "{}"
+          end
+          JSON.parse(content)
+        rescue SyntaxError, JSON::ParserError => exc
+          Util::bail! "Could not parse facts.json -- #{exc}"
+        end
       end
 
       #
@@ -247,8 +255,8 @@ module LeapCli
       #
       # same as filter(), but exits if there is no matching nodes
       #
-      def filter!(filters)
-        node_list = filter(filters)
+      def filter!(filters, options={})
+        node_list = filter(filters, options)
         Util::assert! node_list.any?, "Could not match any nodes from '#{filters.join ' '}'"
         return node_list
       end

data/lib/leap_cli/config/object.rb

@@ -85,9 +85,13 @@ module LeapCli
       #
       # export JSON
       #
-      def dump_json
+      def dump_json(*options)
         evaluate(@node)
-        JSON.sorted_generate(self)
+        if options.include? :compact
+          self.to_json
+        else
+          JSON.sorted_generate(self)
+        end
       end
 
       def evaluate(context=@node)
@@ -143,7 +147,7 @@ module LeapCli
         elsif key =~ /\./
           # for keys with with '.' in them, we start from the root object (@node).
           keys = key.split('.')
-          value = @node.get!(keys.first)
+          value = self.get!(keys.first)
           if value.is_a? Config::Object
             value.get!(keys[1..-1].join('.'))
           else

data/lib/leap_cli/config/secrets.rb

@@ -15,6 +15,7 @@ module LeapCli; module Config
 
     # we can't use fetch() or get(), since those already have special meanings
     def retrieve(key, environment)
+      environment ||= 'default'
       self.fetch(environment, {})[key.to_s]
     end
 
@@ -31,6 +32,7 @@ module LeapCli; module Config
     end
 
     def set_with_block(key, environment, &block)
+      environment ||= 'default'
       key = key.to_s
       @discovered_keys[environment] ||= {}
       @discovered_keys[environment][key] = true

data/lib/leap_cli/log.rb

@@ -80,7 +80,7 @@ module LeapCli
       if title
         prefix_options = case title
           when :error     then ['error', :red, :bold]
-          when :fatal_error then ['fatal error', :red, :bold]
+          when :fatal_error then ['fatal error:', :red, :bold]
           when :warning   then ['warning:', :yellow, :bold]
           when :info      then ['info', :cyan, :bold]
           when :updated   then ['updated', :cyan, :bold]

data/lib/leap_cli/remote/leap_plugin.rb

@@ -36,7 +36,8 @@ module LeapCli; module Remote; module LeapPlugin
     rescue Capistrano::CommandError => exc
       LeapCli::Util.bail! do
         exc.hosts.each do |host|
-          LeapCli::Util.log :error, "running deploy: node not initialized. Run 'leap node init #{host}'", :host => host
+          node = host.to_s.split('.').first
+          LeapCli::Util.log :error, "running deploy: node not initialized. Run 'leap node init #{node}'", :host => host
         end
       end
     end
@@ -184,7 +185,8 @@ module LeapCli; module Remote; module LeapPlugin
   private
 
   def progress(str='.')
-    $stdout.print str; $stdout.flush;
+    print str
+    STDOUT.flush
   end
 
   #def mkdir(dir)

data/lib/leap_cli/version.rb

@@ -1,7 +1,7 @@
 module LeapCli
   unless defined?(LeapCli::VERSION)
-    VERSION = '1.7.3'
-    COMPATIBLE_PLATFORM_VERSION = '0.7'..'0.99'
+    VERSION = '1.7.4'
+    COMPATIBLE_PLATFORM_VERSION = '0.7.1'..'0.99'
     SUMMARY = 'Command line interface to the LEAP platform'
     DESCRIPTION = 'The command "leap" can be used to manage a bevy of servers running the LEAP platform from the comfort of your own home.'
     LOAD_PATHS = ['lib', 'vendor/certificate_authority/lib', 'vendor/rsync_command/lib']

data/lib/leap_cli.rb

@@ -11,7 +11,7 @@ $:.unshift(File.expand_path('../leap_cli/override',__FILE__))
 # for a few gems, things will break if using earlier versions.
 # enforce the compatible versions here:
 require 'rubygems'
-gem 'net-ssh', '~> 2.7.0'
+gem 'net-ssh', '~> 2.7'
 gem 'gli', '~> 2.12', '>= 2.12.0'
 
 require 'leap/platform'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: leap_cli
 version: !ruby/object:Gem::Version
-  version: 1.7.3
+  version: 1.7.4
 platform: ruby
 authors:
 - LEAP Encryption Access Project
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-05 00:00:00.000000000 Z
+date: 2015-07-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.7.0
+        version: '2.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.7.0
+        version: '2.7'
 - !ruby/object:Gem::Dependency
   name: capistrano
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.15.5
+        version: '2.15'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.15.5
+        version: '2.15'
 - !ruby/object:Gem::Dependency
   name: ya2yaml
   requirement: !ruby/object:Gem::Requirement
@@ -160,6 +160,9 @@ dependencies:
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.0.6
@@ -167,6 +170,9 @@ dependencies:
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.0.6