openvoxserver-ca 3.1.1 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f69b3d238712b866f56fe50826f0c104b4904f93f767d8b7d003b7861bac34da
-  data.tar.gz: 7687ad57a9ce424c2e4f76a971d1c223f7d95339ec19ad05ff638cdab5cea110
+  metadata.gz: c1a0e919d1680cad540d1736c820cdaf6cf9cd4b0f18ac3c61939b90bb3fed9f
+  data.tar.gz: 789c622f3bbd987a21759dec2d966389dab1062cb3fffee0ba1ae4f54a615fe2
 SHA512:
-  metadata.gz: cb759a35d4754f5a989c79c6340019e8fd2dbd47eade014b38022c3685906527bba26aa07d0afe21a40ebad4d27ceccbf28b993aac0344bb5b8b085ef309ea17
-  data.tar.gz: 76a5b7c8bbbb08e317841d74e0609d913f6a57eba47da445d52510f758c0bf1777d28df52ed3a84c40735ca590637ac18c3a4885473ddf9ea6352841d76fc4dd
+  metadata.gz: 9bc40b69c27b7b36c4f938bdd00e087739a6eb262a4f246eff5c3d305ad1a75aa1960ce9e8576be15090edfd520de776b7635b4c7957d74f44e5623a55785117
+  data.tar.gz: a63269d9619d665db71c22f9b8e63f6fbfea8dc970bd2e2f232c551b25ed4a95c9c6369a6e533e379dd5ff49eb3ed453d151e2758d2553b256dc2b7a6bf2fa24

data/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file.
 
+## [3.2.0](https://github.com/openvoxproject/openvoxserver-ca/tree/3.2.0) (2026-04-23)
+
+[Full Changelog](https://github.com/openvoxproject/openvoxserver-ca/compare/3.1.1...3.2.0)
+
+**Implemented enhancements:**
+
+- fix: skip chown in rootless containers via ensure\_ownership helper [\#33](https://github.com/OpenVoxProject/openvoxserver-ca/pull/33) ([dotconfig404](https://github.com/dotconfig404))
+
 ## [3.1.1](https://github.com/openvoxproject/openvoxserver-ca/tree/3.1.1) (2026-02-21)
 
 [Full Changelog](https://github.com/openvoxproject/openvoxserver-ca/compare/3.1.0...3.1.1)

data/lib/puppetserver/ca/utils/file_system.rb

@@ -15,17 +15,26 @@ module Puppetserver
           :signeddir => 0755
         }
 
-        def self.instance
-          @instance ||= new
-        end
-
-        def self.write_file(*args)
-          instance.write_file(*args)
+        def self.write_file(path, one_or_more_objects, mode)
+          File.open(path, 'w', mode) do |f|
+            Array(one_or_more_objects).each do |object|
+              f.puts object.to_s
+            end
+          end
+          ensure_ownership(path)
         end
 
         def self.ensure_dirs(one_or_more_dirs)
           Array(one_or_more_dirs).each do |directory|
-            instance.ensure_dir(directory)
+            ensure_dir(directory)
+          end
+        end
+
+        # Warning: directory mode should be specified in DIR_MODES above
+        def self.ensure_dir(directory)
+          if !File.exist?(directory)
+            FileUtils.mkdir_p(directory, mode: DIR_MODES[directory])
+            ensure_ownership(directory)
           end
         end
 
@@ -53,56 +62,30 @@ module Puppetserver
         def self.forcibly_symlink(source, link_target)
           FileUtils.remove_dir(link_target, true)
           FileUtils.symlink(source, link_target)
-          # Ensure the symlink has the same ownership as the source.
-          # This requires using `FileUtils.chown` rather than `File.chown`, as
-          # the latter will update the ownership of the source rather than the
-          # link itself.
-          # Symlink permissions are ignored in favor of the source's permissions,
-          # so we don't have to change those.
-          source_info = File.stat(source)
-          FileUtils.chown(source_info.uid, source_info.gid, link_target)
-        end
-
-        def initialize
-          @user, @group = find_user_and_group
+          ensure_ownership(link_target)
         end
 
-        def find_user_and_group
-          if !running_as_root?
-            return Process.euid, Process.egid
-          else
-            if pe_puppet_exists?
-              return 'pe-puppet', 'pe-puppet'
-            else
-              return 'puppet', 'puppet'
-            end
-          end
+        # Chown the path to the puppet user when running as root.
+        # Skipped otherwise: a non-root process can only have created the path
+        # as itself, so ownership is already correct, and chowning to any other
+        # user would require CAP_CHOWN (unavailable in rootless containers).
+        #
+        # Uses `FileUtils.chown` rather than `File.chown` so that when `path`
+        # is a symlink it operates on the link itself rather than its target.
+        def self.ensure_ownership(path)
+          return unless running_as_root?
+          user = pe_puppet_exists? ? 'pe-puppet' : 'puppet'
+          group = pe_puppet_exists? ? 'pe-puppet' : 'puppet'
+          FileUtils.chown(user, group, path)
         end
 
-        def running_as_root?
+        def self.running_as_root?
           !Gem.win_platform? && Process.euid == 0
         end
 
-        def pe_puppet_exists?
+        def self.pe_puppet_exists?
           !!(Etc.getpwnam('pe-puppet') rescue nil)
         end
-
-        def write_file(path, one_or_more_objects, mode)
-          File.open(path, 'w', mode) do |f|
-            Array(one_or_more_objects).each do |object|
-              f.puts object.to_s
-            end
-          end
-          FileUtils.chown(@user, @group, path)
-        end
-
-        # Warning: directory mode should be specified in DIR_MODES above
-        def ensure_dir(directory)
-          if !File.exist?(directory)
-            FileUtils.mkdir_p(directory, mode: DIR_MODES[directory])
-            FileUtils.chown(@user, @group, directory)
-          end
-        end
       end
     end
   end

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "3.1.1"
+    VERSION = "3.2.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openvoxserver-ca
 version: !ruby/object:Gem::Version
-  version: 3.1.1
+  version: 3.2.0
 platform: ruby
 authors:
 - OpenVox Project
@@ -117,7 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: A simple CLI tool for interacting with OpenVox Server's Certificate Authority
 test_files: []