openvoxserver-ca 3.1.1 → 3.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f69b3d238712b866f56fe50826f0c104b4904f93f767d8b7d003b7861bac34da
-  data.tar.gz: 7687ad57a9ce424c2e4f76a971d1c223f7d95339ec19ad05ff638cdab5cea110
+  metadata.gz: ad89f0911e4df90019067afd7d11d35970af4fa7e8252af3888f9db24fa46a15
+  data.tar.gz: 7edd0700a89ad6d06f784934b51dd54b904e862b763e6231710ff851e80f3ecf
 SHA512:
-  metadata.gz: cb759a35d4754f5a989c79c6340019e8fd2dbd47eade014b38022c3685906527bba26aa07d0afe21a40ebad4d27ceccbf28b993aac0344bb5b8b085ef309ea17
-  data.tar.gz: 76a5b7c8bbbb08e317841d74e0609d913f6a57eba47da445d52510f758c0bf1777d28df52ed3a84c40735ca590637ac18c3a4885473ddf9ea6352841d76fc4dd
+  metadata.gz: 6ea9016d7224eaae5c65a54e034ebb9300e80ae0d202f09fbef0e9d089fc5dfa86c203179b10f5407825ff414afedcc30c3660daca187b2527edb1c329d1ca71
+  data.tar.gz: 59eed25ee2c0c9d0945c9c8ce1567e3cdd436278ce32d6e90e3ce230343ad325485ada51c91ddc4a68ac50b2e4e1c404f3feef085eaaf80d4fc48f875558832a

data/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file.
 
+## [3.2.1](https://github.com/openvoxproject/openvoxserver-ca/tree/3.2.1) (2026-06-29)
+
+[Full Changelog](https://github.com/openvoxproject/openvoxserver-ca/compare/3.2.0...3.2.1)
+
+**Fixed bugs:**
+
+- \(PE-44595\) Tolerate nil in munge\_alt\_names [\#41](https://github.com/OpenVoxProject/openvoxserver-ca/pull/41) ([bastelfreak](https://github.com/bastelfreak))
+
+## [3.2.0](https://github.com/openvoxproject/openvoxserver-ca/tree/3.2.0) (2026-04-23)
+
+[Full Changelog](https://github.com/openvoxproject/openvoxserver-ca/compare/3.1.1...3.2.0)
+
+**Implemented enhancements:**
+
+- fix: skip chown in rootless containers via ensure\_ownership helper [\#33](https://github.com/OpenVoxProject/openvoxserver-ca/pull/33) ([dotconfig404](https://github.com/dotconfig404))
+
 ## [3.1.1](https://github.com/openvoxproject/openvoxserver-ca/tree/3.1.1) (2026-02-21)
 
 [Full Changelog](https://github.com/openvoxproject/openvoxserver-ca/compare/3.1.0...3.1.1)

data/lib/puppetserver/ca/utils/config.rb

@@ -10,7 +10,10 @@ module Puppetserver
         end
 
         def self.munge_alt_names(names)
-          raw_names = names.split(/\s*,\s*/).map(&:strip)
+          # Tolerate a nil/empty value. A puppet.conf key that is present but
+          # has no value (e.g. `dns_alt_names =`) is read as nil rather than
+          # using the absent-key default, so callers can hand us nil here.
+          raw_names = names.to_s.split(/\s*,\s*/).map(&:strip)
           munged_names = raw_names.map do |name|
             # Prepend the DNS tag if no tag was specified
             if !name.start_with?("IP:") && !name.start_with?("DNS:")

data/lib/puppetserver/ca/utils/file_system.rb

@@ -15,17 +15,26 @@ module Puppetserver
           :signeddir => 0755
         }
 
-        def self.instance
-          @instance ||= new
-        end
-
-        def self.write_file(*args)
-          instance.write_file(*args)
+        def self.write_file(path, one_or_more_objects, mode)
+          File.open(path, 'w', mode) do |f|
+            Array(one_or_more_objects).each do |object|
+              f.puts object.to_s
+            end
+          end
+          ensure_ownership(path)
         end
 
         def self.ensure_dirs(one_or_more_dirs)
           Array(one_or_more_dirs).each do |directory|
-            instance.ensure_dir(directory)
+            ensure_dir(directory)
+          end
+        end
+
+        # Warning: directory mode should be specified in DIR_MODES above
+        def self.ensure_dir(directory)
+          if !File.exist?(directory)
+            FileUtils.mkdir_p(directory, mode: DIR_MODES[directory])
+            ensure_ownership(directory)
           end
         end
 
@@ -53,56 +62,30 @@ module Puppetserver
         def self.forcibly_symlink(source, link_target)
           FileUtils.remove_dir(link_target, true)
           FileUtils.symlink(source, link_target)
-          # Ensure the symlink has the same ownership as the source.
-          # This requires using `FileUtils.chown` rather than `File.chown`, as
-          # the latter will update the ownership of the source rather than the
-          # link itself.
-          # Symlink permissions are ignored in favor of the source's permissions,
-          # so we don't have to change those.
-          source_info = File.stat(source)
-          FileUtils.chown(source_info.uid, source_info.gid, link_target)
-        end
-
-        def initialize
-          @user, @group = find_user_and_group
+          ensure_ownership(link_target)
         end
 
-        def find_user_and_group
-          if !running_as_root?
-            return Process.euid, Process.egid
-          else
-            if pe_puppet_exists?
-              return 'pe-puppet', 'pe-puppet'
-            else
-              return 'puppet', 'puppet'
-            end
-          end
+        # Chown the path to the puppet user when running as root.
+        # Skipped otherwise: a non-root process can only have created the path
+        # as itself, so ownership is already correct, and chowning to any other
+        # user would require CAP_CHOWN (unavailable in rootless containers).
+        #
+        # Uses `FileUtils.chown` rather than `File.chown` so that when `path`
+        # is a symlink it operates on the link itself rather than its target.
+        def self.ensure_ownership(path)
+          return unless running_as_root?
+          user = pe_puppet_exists? ? 'pe-puppet' : 'puppet'
+          group = pe_puppet_exists? ? 'pe-puppet' : 'puppet'
+          FileUtils.chown(user, group, path)
         end
 
-        def running_as_root?
+        def self.running_as_root?
           !Gem.win_platform? && Process.euid == 0
         end
 
-        def pe_puppet_exists?
+        def self.pe_puppet_exists?
           !!(Etc.getpwnam('pe-puppet') rescue nil)
         end
-
-        def write_file(path, one_or_more_objects, mode)
-          File.open(path, 'w', mode) do |f|
-            Array(one_or_more_objects).each do |object|
-              f.puts object.to_s
-            end
-          end
-          FileUtils.chown(@user, @group, path)
-        end
-
-        # Warning: directory mode should be specified in DIR_MODES above
-        def ensure_dir(directory)
-          if !File.exist?(directory)
-            FileUtils.mkdir_p(directory, mode: DIR_MODES[directory])
-            FileUtils.chown(@user, @group, directory)
-          end
-        end
       end
     end
   end

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "3.1.1"
+    VERSION = "3.2.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openvoxserver-ca
 version: !ruby/object:Gem::Version
-  version: 3.1.1
+  version: 3.2.1
 platform: ruby
 authors:
 - OpenVox Project
@@ -65,7 +65,6 @@ extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
-- CODE_OF_CONDUCT.md
 - CONTRIBUTING.md
 - LICENSE
 - README.md
@@ -117,7 +116,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A simple CLI tool for interacting with OpenVox Server's Certificate Authority
 test_files: []

data/CODE_OF_CONDUCT.md

@@ -1,74 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as
-contributors and maintainers pledge to making participation in our project and
-our community a harassment-free experience for everyone, regardless of age, body
-size, disability, ethnicity, gender identity and expression, level of experience,
-nationality, personal appearance, race, religion, or sexual identity and
-orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to creating a positive environment
-include:
-
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-* The use of sexualized language or imagery and unwelcome sexual attention or
-advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or electronic
-  address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community. Examples of
-representing a project or community include using an official project e-mail
-address, posting via an official social media account, or acting as an appointed
-representative at an online or offline event. Representation of a project may be
-further defined and clarified by project maintainers.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at puppetserver-team@puppet.com. All
-complaints will be reviewed and investigated and will result in a response that
-is deemed necessary and appropriate to the circumstances. The project team is
-obligated to maintain confidentiality with regard to the reporter of an incident.
-Further details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good
-faith may face temporary or permanent repercussions as determined by other
-members of the project's leadership.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
-
-[homepage]: http://contributor-covenant.org
-[version]: http://contributor-covenant.org/version/1/4/