odysseus-core 0.3.2 → 0.9.0

data/lib/odysseus/setup/public_key.rb

@@ -0,0 +1,127 @@
+# lib/odysseus/setup/public_key.rb
+
+require 'open3'
+
+module Odysseus
+  module Setup
+    # The public keys `odysseus setup` installs for the user it creates,
+    # resolved entirely on THIS machine before the host is touched.
+    #
+    # Getting this wrong produces the worst outcome the command has: a created
+    # user nobody can log in as. So it runs first, and it raises rather than
+    # returning an empty list — there is no sensible way to continue.
+    module PublicKey
+      # A recognised SSH public-key line: key type, whitespace, base64 body,
+      # optional comment (which may itself contain spaces). Anything that
+      # doesn't match -- a private key's PEM body, a mangled file, plain
+      # garbage -- must never survive to become an authorized_keys entry on a
+      # real host.
+      LINE_PATTERN = %r{
+        \A
+        (?: ssh-rsa | ssh-dss | ssh-ed25519
+          | ecdsa-sha2-\S+
+          | sk-ecdsa-sha2-\S+@openssh\.com
+          | sk-ssh-ed25519@openssh\.com )
+        [ \t]+
+        [A-Za-z0-9+/]+=*
+        (?: [ \t]+ \S .* )?
+        \z
+      }x
+
+      # @param keys [Array<String>] ssh.keys entries (private key paths)
+      # @param explicit [Array<String>] paths given with --key, which win
+      # @return [Array<String>] authorized_keys lines, newline-free
+      # @raise [Odysseus::SetupError] when nothing can be resolved
+      def self.resolve(keys:, explicit: [])
+        looked_at = []
+        from_explicit = explicit.any?
+
+        lines = (from_explicit ? explicit : Array(keys)).flat_map do |path|
+          expanded = File.expand_path(path)
+          looked_at << expanded
+          found = from_path(expanded, explicit: from_explicit)
+
+          # A --key path the operator named is not optional. Falling back to
+          # another one, or to ssh.keys, would install a different key than
+          # the one they asked for -- worse than refusing, because they would
+          # believe the named key was authorised when it was not.
+          if from_explicit && found.empty?
+            raise Odysseus::SetupError,
+                  "#{expanded} does not contain a valid SSH public key. --key must point " \
+                  'at a public key (usually the file ending in .pub), not a private key.'
+          end
+
+          found
+        end.uniq
+
+        return lines if lines.any?
+
+        raise Odysseus::SetupError,
+              'Found no public key to install, so the user would be created with no way ' \
+              "to log in. Looked at: #{looked_at.join(', ')}. Pass --key with a path to a " \
+              'public key, or check ssh.keys in deploy.yml.'
+      end
+
+      # An explicit --key path must be a public key itself; an ssh.keys entry
+      # is a private key whose public half is read from its .pub sibling.
+      #
+      # A sibling with nothing written in it -- missing, empty, or
+      # whitespace-only -- is silently derived from the private key: nothing
+      # was expressed there, so deriving is helpful, not presumptuous. A
+      # sibling that has content but none of it validates (for example a
+      # restricted `command="..."` line, which LINE_PATTERN deliberately does
+      # not accept -- see its comment) is refused rather than derived around:
+      # silently substituting a different, less restricted key is the same
+      # "operator believes X is installed, Y is installed instead" failure
+      # the explicit --key raise below exists to prevent, just reached by the
+      # implicit path instead.
+      def self.from_path(path, explicit:)
+        return valid_lines(path) if explicit
+
+        sibling = "#{path}.pub"
+        sibling_lines = valid_lines(sibling)
+        return sibling_lines if sibling_lines.any?
+        return derive(path) unless content?(sibling)
+
+        raise Odysseus::SetupError,
+              "#{sibling} exists but has no valid, unrestricted public key in it, so " \
+              'odysseus will not silently derive a different key in its place. Fix the ' \
+              'file, remove it so the key is derived from the private key instead, or ' \
+              'pass --key with the key to install.'
+      end
+
+      # @return [Array<String>] the valid public-key lines in the file, in
+      #   order; blank or invalid lines are dropped rather than passed through
+      def self.valid_lines(path)
+        return [] unless File.file?(path)
+
+        File.readlines(path).filter_map do |raw|
+          line = raw.strip
+          line if !line.empty? && LINE_PATTERN.match?(line)
+        end
+      end
+
+      # @return [Boolean] whether the file exists and has more than
+      #   whitespace in it -- distinguishes "nothing was expressed here" from
+      #   "something was expressed here, and it didn't validate"
+      def self.content?(path)
+        File.file?(path) && !File.read(path).strip.empty?
+      end
+
+      # `ssh-keygen -y` prints the public half of a private key. It fails
+      # loudly on an encrypted key, which is the right outcome: odysseus cannot
+      # answer a passphrase prompt any more than it can answer sudo's.
+      def self.derive(private_key_path)
+        return [] unless File.file?(private_key_path)
+
+        out, _err, status = Open3.capture3('ssh-keygen', '-y', '-f', private_key_path)
+        return [] unless status.success?
+
+        line = out.strip
+        LINE_PATTERN.match?(line) ? [line] : []
+      end
+
+      private_class_method :from_path, :valid_lines, :content?, :derive
+    end
+  end
+end

data/lib/odysseus/validators/config.rb

@@ -3,7 +3,7 @@
 module Odysseus
   module Validators
     class Config
-      REQUIRED_KEYS = ['service', 'image', 'servers'].freeze
+      REQUIRED_KEYS = %w[service image servers].freeze
 
       def initialize(config)
         @config = config
@@ -17,6 +17,7 @@ module Odysseus
         validate_proxy! if @config['proxy']
         validate_env! if @config['env']
         validate_ssh! if @config['ssh']
+        validate_retain_versions! if @config.key?('retain_versions')
       end
 
       private
@@ -31,13 +32,16 @@ module Odysseus
 
       def validate_servers!
         servers = @config['servers']
-        raise Odysseus::ConfigValidationError,
-              "servers must be a hash" unless servers.is_a?(Hash)
+        unless servers.is_a?(Hash)
+          raise Odysseus::ConfigValidationError,
+                'servers must be a hash'
+        end
 
         servers.each do |role, config|
-          raise Odysseus::ConfigValidationError,
-                "server role '#{role}' must have 'hosts' array" \
-                unless config.is_a?(Hash) && config['hosts'].is_a?(Array)
+          unless config.is_a?(Hash) && config['hosts'].is_a?(Array)
+            raise Odysseus::ConfigValidationError,
+                  "server role '#{role}' must have 'hosts' array"
+          end
 
           validate_containers!(role, config['containers']) if config['containers']
           validate_deploy!(role, config['deploy']) if config['deploy']
@@ -48,37 +52,35 @@ module Odysseus
         proxy = @config['proxy']
         return if proxy.nil?
 
+        return if proxy['app_port']
+
         raise Odysseus::ConfigValidationError,
-              "proxy must have 'app_port'" unless proxy['app_port']
+              "proxy must have 'app_port'"
       end
 
       def validate_env!
         env = @config['env']
         return if env.nil?
 
-        unless env.is_a?(Hash)
-          raise Odysseus::ConfigValidationError, "env must be a hash"
-        end
+        raise Odysseus::ConfigValidationError, 'env must be a hash' unless env.is_a?(Hash)
 
         clear = env['clear']
-        unless clear.nil? || clear.is_a?(Hash)
-          raise Odysseus::ConfigValidationError, "env.clear must be a hash"
-        end
+        raise Odysseus::ConfigValidationError, 'env.clear must be a hash' unless clear.nil? || clear.is_a?(Hash)
 
         secret = env['secret']
-        unless secret.nil? || secret.is_a?(Array)
-          raise Odysseus::ConfigValidationError, "env.secret must be an array"
-        end
+        return if secret.nil? || secret.is_a?(Array)
+
+        raise Odysseus::ConfigValidationError, 'env.secret must be an array'
       end
 
       def validate_containers!(role, containers)
         return unless containers.is_a?(Hash)
 
         count = containers['count']
-        if count && (!count.is_a?(Integer) || count < 1)
-          raise Odysseus::ConfigValidationError,
-                "servers.#{role}.containers.count must be an integer >= 1"
-        end
+        return unless count && (!count.is_a?(Integer) || count < 1)
+
+        raise Odysseus::ConfigValidationError,
+              "servers.#{role}.containers.count must be an integer >= 1"
       end
 
       def validate_deploy!(role, deploy)
@@ -94,7 +96,7 @@ module Odysseus
           val = deploy[key]
           next unless val
 
-          unless val.is_a?(Integer) && val > 0
+          unless val.is_a?(Integer) && val.positive?
             raise Odysseus::ConfigValidationError,
                   "servers.#{role}.deploy.#{key} must be a positive integer"
           end
@@ -105,13 +107,24 @@ module Odysseus
         ssh = @config['ssh']
         return if ssh.nil?
 
-        raise Odysseus::ConfigValidationError,
-              "ssh must be a hash" unless ssh.is_a?(Hash)
+        unless ssh.is_a?(Hash)
+          raise Odysseus::ConfigValidationError,
+                'ssh must be a hash'
+        end
 
         keys = ssh['keys']
+        return if keys.nil? || keys.is_a?(Array)
+
+        raise Odysseus::ConfigValidationError,
+              'ssh.keys must be an array'
+      end
+
+      def validate_retain_versions!
+        value = @config['retain_versions']
+        return if value.is_a?(Integer) && value >= 1
+
         raise Odysseus::ConfigValidationError,
-              "ssh.keys must be an array" \
-              unless keys.nil? || keys.is_a?(Array)
+              "retain_versions must be an integer of 1 or more, got #{value.inspect}"
       end
     end
   end

data/lib/odysseus/version_resolver.rb

@@ -0,0 +1,80 @@
+# lib/odysseus/version_resolver.rb
+
+module Odysseus
+  # Turns an optional --image tag plus the state of the work tree into the
+  # version a deploy will use. The rules live here rather than in Executor so
+  # they can be tested without a config file or an SSH connection.
+  class VersionResolver
+    SHA_LENGTH = 12
+
+    # @param config_dir [String] directory holding deploy.yml
+    # @param logger [Object, nil] responds to #info and #warn
+    def initialize(config_dir:, logger: nil)
+      @config_dir = config_dir
+      @logger = logger
+    end
+
+    # @param image_tag [String, nil] explicit tag; wins over git when given
+    # @return [DeployVersion]
+    # @raise [Odysseus::ConfigError] when no version can be established
+    def resolve(image_tag: nil)
+      # ref stays nil here: an arbitrary explicit tag has no commit it honestly
+      # identifies, and recording HEAD would assert a link that may not exist.
+      # (The no-tag path below refuses on uncommitted changes for exactly this
+      # reason — so that when it does record a ref, the tag actually identifies
+      # the code.) deployer is available regardless, so there is no such reason
+      # to withhold it.
+      return DeployVersion.new(version: image_tag, ref: nil, deployer: deployer) if image_tag
+
+      unless git.repository?
+        raise Odysseus::ConfigError,
+              "#{@config_dir} is not a git repository, so the version cannot be taken from a " \
+              'commit. Pass --image to name the version explicitly.'
+      end
+
+      if git.uncommitted_changes?
+        raise Odysseus::ConfigError,
+              'The working tree has uncommitted changes, so the image tag would not identify ' \
+              'the code being deployed. Commit them, or pass --image to name the version.'
+      end
+
+      sha = git.head_sha(length: SHA_LENGTH)
+
+      unless sha
+        raise Odysseus::ConfigError,
+              "#{@config_dir} is a git repository with no commits yet, so there is no version to " \
+              'deploy. Commit first, or pass --image to name the version.'
+      end
+
+      warn_about_untracked_files
+
+      DeployVersion.new(version: sha, ref: git.ref, deployer: deployer)
+    end
+
+    # Who is running this command: git's configured email, falling back to the
+    # shell user. Works outside a repository — `git config user.email` reads
+    # global config — so a rollback can name a deployer even when the version
+    # came from a host rather than a commit.
+    #
+    # @return [String]
+    def deployer
+      git.committer_email || ENV.fetch('USER', 'unknown')
+    end
+
+    private
+
+    def git
+      @git ||= Odysseus::Git.new(@config_dir)
+    end
+
+    # The build context includes untracked files unless .dockerignore excludes
+    # them, so they can change the image while the tag stays the same. Worth
+    # saying out loud; not worth refusing over.
+    def warn_about_untracked_files
+      return unless git.untracked_files?
+      return unless @logger.respond_to?(:warn)
+
+      @logger.warn('Working tree has untracked files; they may enter the image without changing its tag')
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: odysseus-core
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.9.0
 platform: ruby
 authors:
 - Thomas
@@ -10,61 +10,61 @@ cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: net-ssh
+  name: base64
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '7.2'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '7.2'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: net-scp
+  name: logger
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: base64
+  name: net-scp
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
-  name: logger
+  name: net-ssh
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '7.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '7.2'
 - !ruby/object:Gem::Dependency
   name: zeitwerk
   requirement: !ruby/object:Gem::Requirement
@@ -90,38 +90,59 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
-- Rakefile
 - lib/odysseus.rb
 - lib/odysseus/builder/client.rb
 - lib/odysseus/caddy/client.rb
+- lib/odysseus/command_redaction.rb
 - lib/odysseus/config/parser.rb
 - lib/odysseus/core.rb
+- lib/odysseus/core/deploy_versioning.rb
+- lib/odysseus/core/environment.rb
 - lib/odysseus/core/version.rb
 - lib/odysseus/core/volume_namespacer.rb
+- lib/odysseus/deploy_log.rb
+- lib/odysseus/deploy_version.rb
+- lib/odysseus/deployer/dependency_manager.rb
 - lib/odysseus/deployer/executor.rb
+- lib/odysseus/deployer/retention_sweeper.rb
 - lib/odysseus/deployer/ssh.rb
 - lib/odysseus/docker/client.rb
+- lib/odysseus/docker/labels.rb
 - lib/odysseus/errors.rb
+- lib/odysseus/git.rb
+- lib/odysseus/host_paths.rb
 - lib/odysseus/host_providers.rb
 - lib/odysseus/host_providers/base.rb
 - lib/odysseus/host_providers/static.rb
-- lib/odysseus/orchestrator/accessory_deploy.rb
+- lib/odysseus/host_verifier.rb
+- lib/odysseus/host_versions.rb
+- lib/odysseus/orchestrator/dependency_deploy.rb
 - lib/odysseus/orchestrator/job_deploy.rb
 - lib/odysseus/orchestrator/web_deploy.rb
+- lib/odysseus/plugins.rb
+- lib/odysseus/retention_plan.rb
+- lib/odysseus/retention_planner.rb
+- lib/odysseus/rollback_plan.rb
+- lib/odysseus/rollback_planner.rb
 - lib/odysseus/sails.rb
 - lib/odysseus/secrets/encrypted_file.rb
 - lib/odysseus/secrets/loader.rb
+- lib/odysseus/setup/docker_apt.rb
+- lib/odysseus/setup/escalation.rb
+- lib/odysseus/setup/preparer.rb
+- lib/odysseus/setup/public_key.rb
 - lib/odysseus/validators/config.rb
-- lib/odysseus/version.rb
+- lib/odysseus/version_resolver.rb
 - sig/odysseus/core.rbs
 homepage: https://github.com/WA-Systems-EU/odysseus
 licenses:
-- LGPL-3.0-only
+- MIT
 metadata:
   allowed_push_host: https://rubygems.org
   homepage_uri: https://github.com/WA-Systems-EU/odysseus
   source_code_uri: https://github.com/WA-Systems-EU/odysseus
-  changelog_uri: https://github.com/WA-Systems-EU/odysseus/blob/trunk/CHANGELOG.md
+  changelog_uri: https://github.com/WA-Systems-EU/odysseus/blob/trunk/odysseus-core/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -136,7 +157,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Core library for Odysseus deployment tool
 test_files: []

data/Rakefile

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-RSpec::Core::RakeTask.new(:spec)
-
-require "rubocop/rake_task"
-
-RuboCop::RakeTask.new
-
-task default: %i[spec rubocop]

data/lib/odysseus/version.rb

@@ -1,5 +0,0 @@
-# lib/odysseus/version.rb
-
-module Odysseus
-  VERSION = "0.1.0"
-end