mbailey-chef 0.9.12.1

data/lib/chef/applications.rb

@@ -0,0 +1,4 @@
+require 'chef/application/agent'
+require 'chef/application/client'
+require 'chef/application/knife'
+require 'chef/application/solo'

data/lib/chef/certificate.rb

@@ -0,0 +1,194 @@
+#
+# Author:: Adam Jacob (<adam@opscode.com>)
+# Author:: Christopher Brown (<cb@opscode.com>)
+# Copyright:: Copyright (c) 2009 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'chef/log'
+require 'chef/config'
+require 'chef/api_client'
+require 'openssl'
+require 'fileutils'
+
+class Chef
+  class Certificate
+    class << self
+  
+      # Generates a new CA Certificate and Key, and writes them out to
+      # Chef::Config[:signing_ca_cert] and Chef::Config[:signing_ca_key].
+      def generate_signing_ca
+        ca_cert_file = Chef::Config[:signing_ca_cert]
+        ca_keypair_file = Chef::Config[:signing_ca_key] 
+
+        unless File.exists?(ca_cert_file) && File.exists?(ca_keypair_file)
+          Chef::Log.info("Creating new signing certificate")
+        
+          [ ca_cert_file, ca_keypair_file ].each do |f|
+            ca_basedir = File.dirname(f)
+            FileUtils.mkdir_p ca_basedir
+          end
+
+          keypair = OpenSSL::PKey::RSA.generate(1024)
+
+          ca_cert = OpenSSL::X509::Certificate.new
+          ca_cert.version = 3
+          ca_cert.serial = 1
+          info = [
+            ["C", Chef::Config[:signing_ca_country]], 
+            ["ST", Chef::Config[:signing_ca_state]], 
+            ["L", Chef::Config[:signing_ca_location]], 
+            ["O", Chef::Config[:signing_ca_org]],
+            ["OU", "Certificate Service"], 
+            ["CN", "#{Chef::Config[:signing_ca_domain]}/emailAddress=#{Chef::Config[:signing_ca_email]}"]
+          ]
+          ca_cert.subject = ca_cert.issuer = OpenSSL::X509::Name.new(info)
+          ca_cert.not_before = Time.now
+          ca_cert.not_after = Time.now + 10 * 365 * 24 * 60 * 60 # 10 years
+          ca_cert.public_key = keypair.public_key
+
+          ef = OpenSSL::X509::ExtensionFactory.new
+          ef.subject_certificate = ca_cert
+          ef.issuer_certificate = ca_cert
+          ca_cert.extensions = [
+                  ef.create_extension("basicConstraints", "CA:TRUE", true),
+                  ef.create_extension("subjectKeyIdentifier", "hash"),
+                  ef.create_extension("keyUsage", "cRLSign,keyCertSign", true),
+          ]
+          ca_cert.add_extension ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always")
+          ca_cert.sign keypair, OpenSSL::Digest::SHA1.new
+
+          File.open(ca_cert_file, "w") { |f| f.write ca_cert.to_pem }
+          File.open(ca_keypair_file, File::WRONLY|File::EXCL|File::CREAT, 0600) { |f| f.write keypair.to_pem }
+          if (Chef::Config[:signing_ca_user] && Chef::Config[:signing_ca_group])
+            FileUtils.chown(Chef::Config[:signing_ca_user], Chef::Config[:signing_ca_group], ca_keypair_file)
+          end
+        end
+        self
+      end
+
+      # Creates a new key pair, and signs them with the signing certificate
+      # and key generated from generate_signing_ca above.  
+      #
+      # @param [String] The common name for the key pair.
+      # @param [Optional String] The subject alternative name.
+      # @return [Object, Object] The public and private key objects.
+      def gen_keypair(common_name, subject_alternative_name = nil)
+
+        Chef::Log.info("Creating new key pair for #{common_name}")
+
+        # generate client keypair
+        client_keypair = OpenSSL::PKey::RSA.generate(2048)
+
+        client_cert = OpenSSL::X509::Certificate.new
+
+        ca_cert = OpenSSL::X509::Certificate.new(File.read(Chef::Config[:signing_ca_cert]))
+
+        info = [
+          ["C", Chef::Config[:signing_ca_country]], 
+          ["ST", Chef::Config[:signing_ca_state]], 
+          ["L", Chef::Config[:signing_ca_location]], 
+          ["O", Chef::Config[:signing_ca_org]],
+          ["OU", "Certificate Service"], 
+          ["CN", common_name ]
+        ]
+
+        client_cert.subject = OpenSSL::X509::Name.new(info)
+        client_cert.issuer = ca_cert.subject
+        client_cert.not_before = Time.now
+        client_cert.not_after = Time.now + 10 * 365 * 24 * 60 * 60 # 10 years
+        client_cert.public_key = client_keypair.public_key
+        client_cert.serial = 1
+        client_cert.version = 3
+
+        ef = OpenSSL::X509::ExtensionFactory.new
+        ef.subject_certificate = client_cert
+        ef.issuer_certificate = ca_cert
+
+        client_cert.extensions = [
+                ef.create_extension("basicConstraints", "CA:FALSE", true),
+                ef.create_extension("subjectKeyIdentifier", "hash")
+        ]
+        client_cert.add_extension ef.create_extension("subjectAltName", subject_alternative_name) if subject_alternative_name
+
+        client_cert.sign(OpenSSL::PKey::RSA.new(File.read(Chef::Config[:signing_ca_key])), OpenSSL::Digest::SHA1.new)
+
+        return client_cert.public_key, client_keypair
+      end
+
+      def gen_validation_key(name=Chef::Config[:validation_client_name], key_file=Chef::Config[:validation_key], admin=false)
+        # Create the validation key
+        api_client = Chef::ApiClient.new
+        api_client.name(name)
+        api_client.admin(admin)
+        
+        begin
+          # If both the couch record and file exist, don't do anything. Otherwise,
+          # re-generate the validation key.
+          Chef::ApiClient.cdb_load(name)
+          
+          # The couch document was loaded successfully if we got to here; if we
+          # can't also load the file on the filesystem, we'll regenerate it all.
+          File.open(key_file, "r") do |file|
+          end
+        rescue Chef::Exceptions::CouchDBNotFound
+          create_validation_key(api_client, key_file)
+        rescue
+          if $!.class.name =~ /Errno::/
+            Chef::Log.error("Error opening validation key: #{$!} -- destroying and regenerating")
+            begin
+              api_client.cdb_destroy
+            rescue Bunny::ServerDownError => e
+              # create_validation_key is gonna fail anyway, so let's just bail out.
+              Chef::Log.fatal("Could not de-index (to rabbitmq) previous validation key - rabbitmq is down! Start rabbitmq then restart chef-server to re-generate it")
+              raise
+            end
+            
+            create_validation_key(api_client, key_file)
+          else
+            raise
+          end
+        end
+      end
+      
+      private
+      def create_validation_key(api_client, key_file)
+        Chef::Log.info("Creating validation key...")
+
+        api_client.create_keys
+        begin
+          api_client.cdb_save
+        rescue Bunny::ServerDownError => e
+          # If rabbitmq is down, the client will have been saved in CouchDB,
+          # but not in the index.
+          Chef::Log.fatal("Could not index (to rabbitmq) validation key - rabbitmq is down! Start rabbitmq then restart chef-server to re-generate it")
+
+          # re-raise so the error bubbles out and nukes chef-server
+          raise e
+        end
+        
+        key_dir = File.dirname(key_file)
+        FileUtils.mkdir_p(key_dir) unless File.directory?(key_dir)
+        File.open(key_file, File::WRONLY|File::CREAT, 0600) do |f|
+          f.print(api_client.private_key)
+        end
+        if (Chef::Config[:signing_ca_user] && Chef::Config[:signing_ca_group])
+          FileUtils.chown(Chef::Config[:signing_ca_user], Chef::Config[:signing_ca_group], key_file)
+        end
+      end
+
+    end
+  end
+end

data/lib/chef/checksum.rb

@@ -0,0 +1,182 @@
+#
+# Author:: Tim Hinderliter (<tim@opscode.com>)
+# Copyright:: Copyright (c) 2010 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# 
+#     http://www.apache.org/licenses/LICENSE-2.0
+# 
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'chef/log'
+require 'uuidtools'
+
+class Chef
+  # == Chef::Checksum
+  # Checksum for an individual file; e.g., used for sandbox/cookbook uploading
+  # to track which files the system already manages.
+  class Checksum
+    attr_accessor :checksum, :create_time
+    attr_accessor :couchdb_id, :couchdb_rev
+
+    # When a Checksum commits a sandboxed file to its final home in the checksum
+    # repo, this attribute will have the original on-disk path where the file
+    # was stored; it will be used if the commit is reverted to restore the sandbox
+    # to the pre-commit state.
+    attr_reader :original_committed_file_location
+
+    DESIGN_DOCUMENT = {
+      "version" => 1,
+      "language" => "javascript",
+      "views" => {
+        "all" => {
+          "map" => <<-EOJS
+          function(doc) { 
+            if (doc.chef_type == "checksum") {
+              emit(doc.checksum, doc);
+            }
+          }
+          EOJS
+        },
+      }
+    }
+    
+    # Creates a new Chef::Checksum object.
+    # === Arguments
+    # checksum::: the MD5 content hash of the file
+    # couchdb::: An instance of Chef::CouchDB
+    #
+    # === Returns
+    # object<Chef::Checksum>:: Duh. :)
+    def initialize(checksum=nil, couchdb=nil)
+      @create_time = Time.now.iso8601
+      @checksum = checksum
+      @original_committed_file_location = nil
+    end
+    
+    def to_json(*a)
+      result = {
+        :checksum => checksum,
+        :create_time => create_time,
+        :json_class => self.class.name,
+        :chef_type => 'checksum',
+
+        # For Chef::CouchDB (id_to_name, name_to_id)
+        :name => checksum
+      }
+      result.to_json(*a)
+    end
+
+    def self.json_create(o)
+      checksum = new(o['checksum'])
+      checksum.create_time = o['create_time']
+
+      if o.has_key?('_rev')
+        checksum.couchdb_rev = o["_rev"]
+        o.delete("_rev")
+      end
+      if o.has_key?("_id")
+        checksum.couchdb_id = o["_id"]
+        o.delete("_id")
+      end
+      checksum
+    end
+
+
+    ##
+    # On-Disk Checksum File Repo (Chef Server API)
+    ##
+
+    def file_location
+      File.join(checksum_repo_directory, checksum)
+    end
+
+    def checksum_repo_directory
+      File.join(Chef::Config.checksum_path, checksum[0..1])
+    end
+
+    # Moves the given +sandbox_file+ into the checksum repo using the path
+    # given by +file_location+ and saves the Checksum to the database
+    def commit_sandbox_file(sandbox_file)
+      @original_committed_file_location = sandbox_file
+      Chef::Log.info("commiting sandbox file: move #{sandbox_file} to #{file_location}")
+      FileUtils.mkdir_p(checksum_repo_directory)
+      File.rename(sandbox_file, file_location)
+      cdb_save
+    end
+
+    # Moves the checksum file back to its pre-commit location and deletes
+    # the checksum object from the database, effectively undoing +commit_sandbox_file+.
+    # Raises Chef::Exceptions::IllegalChecksumRevert if the original file location
+    # is unknown, which is will be the case if commit_sandbox_file was not
+    # previously called
+    def revert_sandbox_file_commit
+      unless original_committed_file_location
+        raise Chef::Exceptions::IllegalChecksumRevert, "Checksum #{self.inspect} cannot be reverted because the original sandbox file location is not known"
+      end
+
+      Chef::Log.warn("reverting sandbox file commit: moving #{file_location} back to #{original_committed_file_location}")
+      File.rename(file_location, original_committed_file_location)
+      cdb_destroy
+    end
+
+    # Removes the on-disk file backing this checksum object, then removes it
+    # from the database
+    def purge
+      purge_file
+      cdb_destroy
+    end
+
+    ##
+    # Couchdb
+    ##
+
+    def self.create_design_document(couchdb=nil)
+      (couchdb || Chef::CouchDB.new).create_design_document("checksums", DESIGN_DOCUMENT)
+    end
+    
+    def self.cdb_list(inflate=false, couchdb=nil)
+      rs = (couchdb || Chef::CouchDB.new).list("checksums", inflate)
+      lookup = (inflate ? "value" : "key")
+      rs["rows"].collect { |r| r[lookup] }        
+    end
+    
+    def self.cdb_all_checksums(couchdb = nil)
+      rs = (couchdb || Chef::CouchDB.new).list("checksums", true)
+      rs["rows"].inject({}) { |hash_result, r| hash_result[r['key']] = 1; hash_result }
+    end
+
+    def self.cdb_load(checksum, couchdb=nil)
+      # Probably want to look for a view here at some point
+      (couchdb || Chef::CouchDB.new).load("checksum", checksum)
+    end
+
+    def cdb_destroy(couchdb=nil)
+      (couchdb || Chef::CouchDB.new).delete("checksum", checksum, @couchdb_rev)
+    end
+
+    def cdb_save(couchdb=nil)
+      @couchdb_rev = (couchdb || Chef::CouchDB.new).store("checksum", checksum, self)["rev"]
+    end
+
+
+    private
+
+    # Deletes the file backing this checksum from the on-disk repo.
+    # Purging the checksums is how users can get back to a valid state if
+    # they've deleted files, so we silently swallow Errno::ENOENT here.
+    def purge_file
+      FileUtils.rm(file_location)
+    rescue Errno::ENOENT
+      true
+    end
+
+  end
+end

data/lib/chef/checksum_cache.rb

@@ -0,0 +1,173 @@
+#
+# Author:: Adam Jacob (<adam@opscode.com>)
+# Author:: Daniel DeLeo (<dan@kallistec.com>)
+# Copyright:: Copyright (c) 2009 Opscode, Inc.
+# Copyright:: Copyright (c) 2009 Daniel DeLeo
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# 
+#     http://www.apache.org/licenses/LICENSE-2.0
+# 
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'set'
+require 'fileutils'
+require 'chef/log'
+require 'chef/config'
+require 'chef/client'
+require 'chef/mixin/convert_to_class_name'
+require 'singleton'
+require 'moneta'
+
+class Chef 
+  class ChecksumCache
+    include Chef::Mixin::ConvertToClassName
+    include ::Singleton
+    
+    attr_reader :moneta
+    
+    def initialize(*args)
+      self.reset!(*args)
+    end
+    
+    def reset!(backend=nil, options=nil)
+      backend ||= Chef::Config[:cache_type]
+      options ||= Chef::Config[:cache_options]
+      
+      begin
+        require "moneta/#{convert_to_snake_case(backend, 'Moneta')}"
+      rescue LoadError => e
+        Chef::Log.fatal("Could not load Moneta back end #{backend.inspect}")
+        raise e
+      end
+     
+      @moneta = Moneta.const_get(backend).new(options)
+    end
+
+    def self.reset_cache_validity
+      @valid_cached_checksums = nil
+    end
+
+    Chef::Client.when_run_starts do |run_status|
+      reset_cache_validity
+    end
+
+    def self.valid_cached_checksums
+      @valid_cached_checksums ||= Set.new
+    end
+
+    def self.validate_checksum(checksum_key)
+      valid_cached_checksums << checksum_key
+    end
+
+    def self.all_cached_checksums
+      all_checksums_with_filenames = {}
+
+      Dir[File.join(Chef::Config[:cache_options][:path], '*')].each do |cksum_file|
+        all_checksums_with_filenames[File.basename(cksum_file)] = cksum_file
+      end
+      all_checksums_with_filenames
+    end
+
+    def self.cleanup_checksum_cache
+      Chef::Log.info("cleaning the checksum cache")
+      if (Chef::Config[:cache_type].to_s == "BasicFile")
+        all_cached_checksums.each do |cache_key, cksum_cache_file|
+          unless valid_cached_checksums.include?(cache_key)
+            remove_unused_checksum(cksum_cache_file)
+          end
+        end
+      end
+    end
+
+    Chef::Client.when_run_completes_successfully do |run_status|
+      cleanup_checksum_cache
+    end
+
+    def self.remove_unused_checksum(checksum_file)
+      Chef::Log.debug("removing unused checksum cache file #{checksum_file}")
+      FileUtils.rm(checksum_file)
+    end
+
+    def self.checksum_for_file(*args)
+      instance.checksum_for_file(*args)
+    end
+
+    def validate_checksum(*args)
+      self.class.validate_checksum(*args)
+    end
+
+    def checksum_for_file(file, key=nil)
+      key ||= generate_key(file)
+      fstat = File.stat(file)
+      lookup_checksum(key, fstat) || generate_checksum(key, file, fstat)
+    end
+
+    def lookup_checksum(key, fstat)
+      cached = @moneta.fetch(key)
+      if cached && file_unchanged?(cached, fstat)
+        validate_checksum(key)
+        cached["checksum"]
+      else
+        nil
+      end
+    end
+
+    def generate_checksum(key, file, fstat)
+      checksum = checksum_file(file, Digest::SHA256.new)
+      moneta.store(key, {"mtime" => fstat.mtime.to_f, "checksum" => checksum})
+      validate_checksum(key)
+      checksum
+    end
+
+    def generate_key(file, group="chef")
+      "#{group}-file-#{file.gsub(/(#{File::SEPARATOR}|\.)/, '-')}"
+    end
+
+    def self.generate_md5_checksum_for_file(*args)
+      instance.generate_md5_checksum_for_file(*args)
+    end
+
+    def generate_md5_checksum_for_file(file)
+      checksum_file(file, Digest::MD5.new)
+    end
+
+    def generate_md5_checksum(io)
+      checksum_io(io, Digest::MD5.new)
+    end
+
+    private
+
+    def file_unchanged?(cached, fstat)
+      cached["mtime"].to_f == fstat.mtime.to_f
+    end
+
+    def checksum_file(file, digest)
+      File.open(file) { |f| checksum_io(f, digest) }
+    end
+
+    def checksum_io(io, digest)
+      while chunk = io.read(1024 * 8)
+        digest.update(chunk)
+      end
+      digest.hexdigest
+    end
+
+  end
+end
+
+module Moneta
+  module Defaults
+    def default
+      nil
+    end
+  end
+end