pupistry 0.0.8 → 0.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2d77b057ae7f6a793146456653336f4d8518ad9c
-  data.tar.gz: 883a456f63a65d166c6c9fb27d94b249ff64d10d
+  metadata.gz: 2a46ac7b30671451d7bee3ad1e7d70b20d1fa9f5
+  data.tar.gz: 72e76d1cf0041bdb783eb246a3844126f9a7f36b
 SHA512:
-  metadata.gz: f502b9aea495831ccfa58e14ade4d146cf272c23aa039f94421ed1ec135ad42e8d4459302afbc66e975d0cc15dc5b4241724c339c7f9f6aecedcbb0100a017bb
-  data.tar.gz: aa02112d087ff67fe57b075c02571beaa607a194bfef37cd042cbaeb2ad54a7c6a8f8076ef68b8cede0fdf22e2b1ebbb22745cc4454ac1c5ee827744d4828877
+  metadata.gz: 2e177835938370c964858fbc42261072f950fee59c20bbddc1e43b793517f14ecb943aa3d4b619c0e456511822d741029db8ccf81c09c127e6f83f120434f0e1
+  data.tar.gz: ff3eff835449d84597e95807c6cd304e187420a86ea72bf2b7faebdfa545b5917c7f972cb32bbf9ec31b0f6b517f561bdf86d1a0b56897ae6ddf9fe91df115a7

data/bin/pupistry

@@ -62,15 +62,24 @@ class CLI < Thor
     artifact = Pupistry::Artifact.new
     artifact.checksum = artifact.fetch_latest
 
+    unless artifact.checksum
+      $logger.error "There is no current artifact available for download, no steps can be taken."
+      exit 0
+    end
+
     artifact_installed = Pupistry::Artifact.new
     artifact_installed.checksum = artifact_installed.fetch_installed
 
+    if artifact_installed.checksum
+      $logger.debug "Currently on #{artifact_installed.checksum}"
+    else
+      $logger.debug "No currently installed artifact - blank slate!"
+    end
 
     # Download the new artifact if one has changed. If we already have this
     # version, then we should skip downloading and go straight to running
     # Puppet - unless the user runs with --force (eg to fix a corrupted
     # artifact).
-    $logger.debug "Currently on #{artifact_installed.checksum}"
     
     if artifact.checksum != artifact_installed.checksum or options[:force]
       if options[:force]
@@ -218,6 +227,11 @@ class CLI < Thor
 
     artifact_current.fetch_artifact
 
+    # Are they the same version?
+    if artifact_current.checksum == artifact_upstream.checksum
+      $logger.info "Current version and upstream version are the same, no diff"
+    end
+
     # Unpack the archives
     artifact_current.unpack
     artifact_upstream.unpack

data/lib/pupistry/artifact.rb

@@ -82,7 +82,22 @@ module Pupistry
         manifest = YAML::load(contents)
 
         if defined? manifest['version']
-          return manifest['version']
+          # We have a manifest version supplied, however since the manifest
+          # isn't signed, there's risk of an exploited S3 bucket replacing
+          # the version with injections designed to attack the shell commands
+          # we call from Pupistry.
+          #
+          # Therefore we need to make sure the manifest version matches a
+          # regex suitable for a checksum.
+
+          if /^[A-Za-z0-9]{32}$/.match(manifest['version'])
+            return manifest['version']
+          else
+            $logger.error "Manifest version returned from S3 manifest.latest.yaml did not match expected regex of MD5."
+            $logger.error "Possible bug or security incident, investigate with care!"
+            $logger.error "Returned version string was: \"#{manifest['version']}\""
+            exit 0
+          end
         else
           return false
         end
@@ -107,7 +122,7 @@ module Pupistry
           @checksum   = manifest['version']
         else
           $logger.error "No artifact has been built yet. You need to run pupistry build first?"
-          return 0
+          return false
         end
     end
 
@@ -118,7 +133,7 @@ module Pupistry
       # Make sure the Puppetcode install directory exists
       unless Dir.exists?($config["agent"]["puppetcode"])
         $logger.warn "The destination path of #{$config["agent"]["puppetcode"]} does not appear to exist or is not readable"
-        return 0
+        return false
       end
 
       # Look for a manifest file in the directory and read the version from it.
@@ -128,7 +143,7 @@ module Pupistry
         return manifest['version']
       else
         $logger.warn "No current version installed"
-        return 0
+        return false
       end
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pupistry
 version: !ruby/object:Gem::Version
-  version: 0.0.8
+  version: 0.0.9
 platform: ruby
 authors:
 - Jethro Carr