puppet-check 2.5.1 → 2.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3c5911fe2362e7462d111f97705eea6b60842ce107bb94d35e6f8657cea6812
-  data.tar.gz: 52413822ec2375afd5fab3bb933220ad15bbcab285641f6717d94057c7fe0554
+  metadata.gz: 98b3c25f3adb4837ec7ce74efb4e06c422defab2a7360646b4daae7dda962c0f
+  data.tar.gz: 4814ad9b99fd205914ad1b976280d70479264ebff708aa0390a22346d1c4c1e6
 SHA512:
-  metadata.gz: fa0c790ee8186c5d1f2eb7091c78d789c68fef7d16292fe3a70c3d41a41d1eb65c3ece36462578bfe2874bb236316fa9b5737f7316f6902d1017bb15c182cf0a
-  data.tar.gz: 87e82df7685a13f4122838b225ef8e44d8de30b9e14f8cbb75577b76074fff5f40ca895c7bef00a7648862abba1edc31d5e237b0cb4ba8e0e5e1eb5aa4486304
+  metadata.gz: 714bc3ea74a76dd03a2dac33274e12b236f898cfe5f6257ea1a04dd7f0a61124d4509d1b73e2c74f2bf8b8d987aa3343ece7fce5a8e387a211464f400e7aecc7
+  data.tar.gz: 9c0737fee70f019f5189a499981b4a54b1449cb43d297b92ce2e8da5fe13dfa7194b4239db4417394626747de8acc250b3d5388b20687a469998c02d4b46418d

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+### 2.5.2
+- Fix incorrect exit code `0` when `octocatalog` detects catalog compilation failure.
+- Avoid mutation of and optimize Rubocop argument interfacing.
+- Fix existing module install check when using Puppet Forge source for RSpec.
+- Upgrade EYAML validation functionality from beta to release candidate.
+
 ### 2.5.1
 - Fix explicit `fail_on_warnings` default value assignment.
 - Improve message transformation for Puppet::Face errors and warnings.

data/README.md

@@ -13,7 +13,7 @@
 ## Description
 Puppet Check is a gem that provides a comprehensive, streamlined, and efficient analysis of the syntax, style, and validity of your entire Puppet code and data.
 
-**IMPORTANT**: The current support for encrypted yaml validation is experimental and should be considered a beta feature as of 2.3.0.
+**IMPORTANT**: The current support for encrypted yaml validation is semi-experimental and should be considered a release candidate feature as of 2.5.2.
 
 ### Former Method for Code and Data Checks
 ![Old](https://raw.githubusercontent.com/mschuchard/puppet-check/master/images/puppetcheck_old.png)

data/lib/puppet-check/data_parser.rb

@@ -25,6 +25,7 @@ class DataParser
   # checks eyaml (.eyaml/.eyml)
   def self.eyaml(files, public, private)
     require 'openssl'
+    require 'base64'
 
     # keys specified?
     if public.nil? || private.nil?
@@ -42,34 +43,47 @@ class DataParser
     rsa = OpenSSL::PKey::RSA.new(File.read(private))
     x509 = OpenSSL::X509::Certificate.new(File.read(public))
 
+    # iterate through files and decrypt eyaml values
     files.each do |file|
-      # check encoded yaml syntax
+      # load the file
       parsed = YAML.safe_load_file(file, permitted_classes: [Symbol], permitted_symbols: [], aliases: true)
 
-      # extract encoded values
-      # ENC[PKCS7]
-
-      # decrypt the encoded yaml
-      # decrypted = OpenSSL::PKCS7.new(File.read(file)).decrypt(rsa, x509)
-
-      # check decoded eyaml syntax
-      # decoded = YAML.safe_load(decrypted)
-
-      # merge data hashes
-      # parsed = merge(parsed, decoded)
+      # decrypt any ENC[PKCS7,...] leaf values found in the parsed structure
+      decoded = decrypt_eyaml(parsed, rsa, x509)
     rescue StandardError => err
       PuppetCheck.files[:errors][file] = err.to_s.gsub("(#{file}): ", '').split("\n")
     else
       warnings = []
 
       # perform some rudimentary hiera checks if data exists and is hieradata
-      warnings = hiera(parsed, file) if parsed
+      warnings = hiera(decoded, file) if decoded
 
       next PuppetCheck.files[:warnings][file] = warnings unless warnings.empty?
       PuppetCheck.files[:clean].push(file.to_s)
     end
   end
 
+  # recursively decrypts ENC[PKCS7,...] leaf values in a parsed eyaml structure
+  private_class_method def self.decrypt_eyaml(data, rsa, x509)
+    case data
+    when Hash
+      # recurse into hash values, keys are never encrypted
+      data.transform_values { |v| decrypt_eyaml(v, rsa, x509) }
+    when Array
+      # recurse into array elements
+      data.map { |v| decrypt_eyaml(v, rsa, x509) }
+    when String
+      # leave plain (non-ENC) strings untouched
+      match = data.match(/\AENC\[PKCS7,(.+)\]\z/m)
+      return data unless match
+
+      # decode the base64 payload to DER and decrypt
+      OpenSSL::PKCS7.new(Base64.decode64(match[1])).decrypt(rsa, x509)
+    else
+      data
+    end
+  end
+
   # metadata consts
   REQUIRED_KEYS = %w[name version author license summary source dependencies].freeze
   REQ_DEP_KEYS = %w[requirements dependencies].freeze

data/lib/puppet-check/rspec_puppet_support.rb

@@ -97,7 +97,7 @@ class RSpecPuppetSupport
   # download external module dependency with forge
   private_class_method def self.forge(forge_name, args = '')
     # is the module present? do an upgrade; otherwise, do an install
-    subcommand = File.directory?("spec/fixtures/modules/#{forge_name}") ? 'upgrade' : 'install'
+    subcommand = File.directory?("spec/fixtures/modules/#{forge_name.split('-').last}") ? 'upgrade' : 'install'
     spawn("puppet module #{subcommand} --modulepath spec/fixtures/modules/ #{args} #{forge_name}")
   end
 

data/lib/puppet-check/ruby_parser.rb

@@ -23,10 +23,15 @@ class RubyParser
       # check ruby style
       if style
         # add rubocop rspec plugin if the file is a spec
-        rc_args.push('--plugin', 'rubocop-rspec') if file =~ /_spec\.rb$/
+        if file =~ /_spec\.rb$/
+          # invoke RuboCop with rspec plugin
+          rubocop_warnings = Utils.capture_stdout { rubocop_cli.run(rc_args + ['--plugin', 'rubocop-rspec','--enable-pending-cops', '--plugin', 'rubocop-performance', '--format', 'json', file]) }
+        else
+          # invoke rubocop
+          rubocop_warnings = Utils.capture_stdout { rubocop_cli.run(rc_args + ['--enable-pending-cops', '--plugin', 'rubocop-performance', '--format', 'json', file]) }
+        end
 
-        # check RuboCop and parse warnings' JSON output
-        rubocop_warnings = Utils.capture_stdout { rubocop_cli.run(rc_args + ['--enable-pending-cops', '--plugin', 'rubocop-performance', '--format', 'json', file]) }
+        # parse rubocop offenses' structured JSON output
         rubocop_offenses = JSON.parse(rubocop_warnings)['files'][0]['offenses'].map { |warning| "#{warning['location']['line']}:#{warning['location']['column']} #{warning['message']}" }
 
         # check Reek using examiner api

data/lib/puppet_check.rb

@@ -42,12 +42,15 @@ class PuppetCheck
       # if octocatalog-diff is not installed then continue immediately
       rescue NameError
         puts 'puppet-check: immediately continuing to results'
+        0
       # smoke check failure? output message and return 2
       rescue OctocatalogDiff::Errors::CatalogError => err
         puts 'There was a smoke check error:'
         puts err
         puts catalog.error_message unless catalog.valid?
         2
+      else
+        0
       end
       # perform regression checks if there were no errors and the user desires
       # begin
@@ -61,7 +64,6 @@ class PuppetCheck
 
       # code to output differences in catalog?
       # everything passed? return 0
-      0
     else
       # error files? return 2
       2
@@ -120,14 +122,14 @@ class PuppetCheck
     manifests, files = files.partition { |file| File.extname(file) == '.pp' }
     PuppetParser.manifest(manifests, style, puppetlint_args) unless manifests.empty?
     # check puppet templates
-    templates, files = files.partition { |file| File.extname(file) == '.epp' }
-    PuppetParser.template(templates) unless templates.empty?
+    epp, files = files.partition { |file| File.extname(file) == '.epp' }
+    PuppetParser.template(epp) unless epp.empty?
     # check ruby files
     rubies, files = files.partition { |file| File.extname(file) == '.rb' }
     RubyParser.ruby(rubies, style, rubocop_args) unless rubies.empty?
     # check ruby templates
-    templates, files = files.partition { |file| File.extname(file) == '.erb' }
-    RubyParser.template(templates) unless templates.empty?
+    erb, files = files.partition { |file| File.extname(file) == '.erb' }
+    RubyParser.template(erb) unless erb.empty?
     # check yaml data
     yamls, files = files.partition { |file| File.extname(file) =~ /\.ya?ml$/ }
     DataParser.yaml(yamls) unless yamls.empty?

data/puppet-check.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |spec|
   spec.name          = 'puppet-check'
-  spec.version       = '2.5.1'
+  spec.version       = '2.5.2'
   spec.authors       = ['Matt Schuchard']
   spec.description   = 'Puppet Check is a gem that provides a comprehensive, streamlined, and efficient analysis of the syntax, style, and validity of your entire Puppet code and data.'
   spec.summary       = 'A streamlined comprehensive set of checks for your entire Puppet code and data'

data/spec/fixtures/hieradata/decrypt_error.eyaml

@@ -0,0 +1,3 @@
+---
+bad:
+  eyaml: ENC[PKCS7,not-a-valid-pkcs7-payload==]

data/spec/fixtures/hieradata/nested_array.eyaml

@@ -0,0 +1,6 @@
+---
+items:
+- name: one
+  secret: ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAWYkSR19bdTGCu3NUMRGjHUIkXidzM4ejpICm7voB4JLUYyrwPxnvb8d761VA6JJwLe6dPmppm1x62k6Sp9HXyP3BqkhBlshLsgbNSbhMoLBPxfpjQhRTDFbeqZq35aY6grqj25AYB18Grfja8RoSK4jLHBECPJr0lUgW4qBANgV7KcaZndwxyDfTPFA3vCtc4r1l/r4Bg9esyV3ClJHP5A7bOmw38aibGcu1O4CHLEHCt3plvqrF7vElSFBJi62I7omGvdJitY+CVe6eTJiHLn3HnP9jeRGdRiC2eGhS+A7sE8JXK3n/ZtKFiH78payBlU6BWolgapBC3RnFw9jabTA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB/Ep4/M8NuRlUOin0nQKjXgBArdhX8G2RtUEdfdl3ujD89]
+- name: two
+  secret: plain

data/spec/puppet-check/data_parser_spec.rb

@@ -64,13 +64,71 @@ describe DataParser do
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}hieradata/good.eyaml"])
     end
+    it 'puts an eyaml file with an undecryptable PKCS7 payload in the error files hash; distinctly from a YAML syntax error' do
+      DataParser.eyaml(["#{FIXTURES_DIR}hieradata/decrypt_error.eyaml"], "#{FIXTURES_DIR}keys/public_key.pkcs7.pem", "#{FIXTURES_DIR}keys/private_key.pkcs7.pem")
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}hieradata/decrypt_error.eyaml"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/decrypt_error.eyaml"].join("\n")).to match(/PKCS7/i)
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/decrypt_error.eyaml"].join("\n")).not_to match(/^block sequence entries are not allowed/)
+      expect(PuppetCheck.files[:warnings]).to eql({})
+      expect(PuppetCheck.files[:clean]).to eql([])
+    end
+    it 'decrypts an ENC[PKCS7,...] value nested inside an array of hashes and puts the file in the clean files array' do
+      DataParser.eyaml(["#{FIXTURES_DIR}hieradata/nested_array.eyaml"], "#{FIXTURES_DIR}keys/public_key.pkcs7.pem", "#{FIXTURES_DIR}keys/private_key.pkcs7.pem")
+      expect(PuppetCheck.files[:errors]).to eql({})
+      expect(PuppetCheck.files[:warnings]).to eql({})
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}hieradata/nested_array.eyaml"])
+    end
+  end
+
+  context '.decrypt_eyaml' do
+    before(:all) do
+      require 'openssl'
+      require 'base64'
+    end
+
+    let(:rsa) { OpenSSL::PKey::RSA.new(File.read("#{FIXTURES_DIR}keys/private_key.pkcs7.pem")) }
+    let(:x509) { OpenSSL::X509::Certificate.new(File.read("#{FIXTURES_DIR}keys/public_key.pkcs7.pem")) }
+
+    # encrypts a plaintext value against the fixture cert and wraps it as eyaml expects
+    def encrypt(plaintext)
+      pkcs7 = OpenSSL::PKCS7.encrypt([x509], plaintext, OpenSSL::Cipher.new('AES-256-CBC'), OpenSSL::PKCS7::BINARY)
+      "ENC[PKCS7,#{Base64.strict_encode64(pkcs7.to_der)}]"
+    end
+
+    it 'decrypts a single ENC[PKCS7,...] string to its original plaintext' do
+      expect(DataParser.send(:decrypt_eyaml, encrypt('puppetcheck'), rsa, x509)).to eql('puppetcheck')
+    end
+    it 'leaves a plain non-ENC string untouched' do
+      expect(DataParser.send(:decrypt_eyaml, 'plaintext value', rsa, x509)).to eql('plaintext value')
+    end
+    it 'leaves a string that merely resembles but does not fully match the ENC[PKCS7,...] pattern untouched' do
+      expect(DataParser.send(:decrypt_eyaml, 'prefix ENC[PKCS7,abc] suffix', rsa, x509)).to eql('prefix ENC[PKCS7,abc] suffix')
+    end
+    it 'recurses into hash values and decrypts them, while never decrypting hash keys' do
+      encrypted = encrypt('secret-value')
+      result = DataParser.send(:decrypt_eyaml, { encrypted => 'plain-key-value', 'plain-key' => encrypted }, rsa, x509)
+      expect(result.keys).to eql([encrypted, 'plain-key'])
+      expect(result[encrypted]).to eql('plain-key-value')
+      expect(result['plain-key']).to eql('secret-value')
+    end
+    it 'recurses into array elements and decrypts them' do
+      expect(DataParser.send(:decrypt_eyaml, ['plain', encrypt('array-secret')], rsa, x509)).to eql(['plain', 'array-secret'])
+    end
+    it 'recurses through nested hash/array/hash structures' do
+      expect(DataParser.send(:decrypt_eyaml, { 'list' => [{ 'inner' => encrypt('nested-secret') }] }, rsa, x509)).to eql({ 'list' => [{ 'inner' => 'nested-secret' }] })
+    end
+    it 'returns non-string/hash/array scalars unchanged' do
+      expect(DataParser.send(:decrypt_eyaml, 42, rsa, x509)).to eql(42)
+      expect(DataParser.send(:decrypt_eyaml, nil, rsa, x509)).to be_nil
+      expect(DataParser.send(:decrypt_eyaml, true, rsa, x509)).to be true
+    end
   end
 
   context '.json' do
     it 'puts a bad syntax json file in the error files hash' do
       DataParser.json(["#{FIXTURES_DIR}hieradata/syntax.json"])
       expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}hieradata/syntax.json"])
-      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/syntax.json"].join("\n")).to match(/after object value, got.*at line 2 column 3/)
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/syntax.json"].join("\n")).to match(/after object value, got.*at line 3 column 3/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
@@ -121,4 +179,4 @@ describe DataParser do
       expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}task_metadata/task_good.json"])
     end
   end
-end
+end

data/spec/puppet_check_spec.rb

@@ -112,16 +112,51 @@ describe PuppetCheck do
   end
 
   context '.execute_parsers' do
-    it 'correctly organizes a set of files and invokes the correct parsers' do
-      # parser_output = instance_double('execute_parsers', files: %w[puppet.pp puppet_template.epp ruby.rb ruby_template.erb yaml.yaml yaml.yml json.json Puppetfile Modulefile foobarbaz], style: false, pl_args: [], rc_args: [])
-      # expect(parser_output).to receive(:manifest).with(%w[puppet.pp])
-      # expect(parser_output).to receive(:template).with(%w[puppet_template.epp])
-      # expect(parser_output).to receive(:ruby).with(%w[ruby.rb])
-      # expect(parser_output).to receive(:template).with(%w[ruby_template.erb])
-      # expect(parser_output).to receive(:yaml).with(%w[yaml.yaml yaml.yml])
-      # expect(parser_output).to receive(:json).with(%w[json.json])
-      # expect(parser_output).to receive(:librarian).with(%w[Puppetfile Modulefile])
-      # expect(PuppetCheck.files[:ignored]).to eql(%w[foobarbaz])
+    before(:each) do
+      PuppetCheck.files = { errors: {}, warnings: {}, clean: [], ignored: [] }
+    end
+    let(:puppet_check) { PuppetCheck.new }
+
+    it 'correctly routes each file type to the appropriate parser and ignores unrecognized files' do
+      expect(PuppetParser).to receive(:manifest).with(['manifests/good.pp'], false, [])
+      expect(PuppetParser).to receive(:template).with(['templates/good.epp'])
+      expect(RubyParser).to receive(:ruby).with(['lib/good.rb'], false, [])
+      expect(RubyParser).to receive(:template).with(['templates/good.erb'])
+      expect(DataParser).to receive(:yaml).with(['hieradata/good.yaml', 'hieradata/good.yml'])
+      expect(DataParser).to receive(:json).with(['hieradata/good.json'])
+      expect(DataParser).to receive(:eyaml).with(['hieradata/good.eyaml'], nil, nil)
+      expect(RubyParser).to receive(:librarian).with(['librarian/Puppetfile_good'], false, [])
+
+      puppet_check.send(:execute_parsers, %w[manifests/good.pp templates/good.epp lib/good.rb templates/good.erb hieradata/good.yaml hieradata/good.yml hieradata/good.json hieradata/good.eyaml librarian/Puppetfile_good foobarbaz], false, [], [], nil, nil)
+
+      expect(PuppetCheck.files[:ignored]).to eql(['foobarbaz'])
+    end
+
+    it 'passes style and arg options through to the correct parsers and skips parser calls when a given file category is empty' do
+      expect(PuppetParser).to receive(:manifest).with(['manifests/good.pp'], true, ['--no-140chars-check'])
+      expect(PuppetParser).not_to receive(:template)
+      expect(RubyParser).to receive(:ruby).with(['lib/good.rb'], true, ['--except', 'Style/FrozenStringLiteralComment'])
+      expect(RubyParser).to receive(:librarian).with(['librarian/Puppetfile_good'], true, ['--except', 'Style/FrozenStringLiteralComment'])
+      expect(RubyParser).not_to receive(:template)
+      expect(DataParser).to receive(:yaml).with(['hieradata/good.yaml'])
+      expect(DataParser).not_to receive(:json)
+      expect(DataParser).not_to receive(:eyaml)
+
+      puppet_check.send(
+        :execute_parsers,
+        %w[manifests/good.pp lib/good.rb hieradata/good.yaml librarian/Puppetfile_good],
+        true,
+        ['--no-140chars-check'],
+        ['--except', 'Style/FrozenStringLiteralComment'],
+        nil,
+        nil
+      )
+    end
+
+    it 'returns PuppetCheck.files' do
+      allow(PuppetParser).to receive(:manifest)
+      result = puppet_check.send(:execute_parsers, ['manifests/good.pp'], false, [], [], nil, nil)
+      expect(result).to eql(PuppetCheck.files)
     end
   end
 end

data/spec/system/system_spec.rb

@@ -15,9 +15,9 @@ describe PuppetCheck do
         expect(PuppetCheck::CLI.run(%w[-s --puppet-lint no-hard_tabs-check,no-140chars-check --rubocop Layout/LineLength,Style/Encoding --public keys/public_key.pkcs7.pem --private keys/private_key.pkcs7.pem --smoke -n good.example.com --octoconfig spec/octocatalog-diff/octocatalog-diff.cfg.rb .])).to eql(2)
       end
 
-      expect(PuppetCheck.files[:errors].length).to eql(11)
+      expect(PuppetCheck.files[:errors].length).to eql(12)
       expect(PuppetCheck.files[:warnings].length).to eql(13)
-      expect(PuppetCheck.files[:clean].length).to eql(13)
+      expect(PuppetCheck.files[:clean].length).to eql(14)
       expect(PuppetCheck.files[:ignored].length).to eql(3)
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppet-check
 version: !ruby/object:Gem::Version
-  version: 2.5.1
+  version: 2.5.2
 platform: ruby
 authors:
 - Matt Schuchard
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-02 00:00:00.000000000 Z
+date: 2026-07-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: puppet
@@ -153,9 +153,11 @@ files:
 - lib/puppet_check.rb
 - puppet-check.gemspec
 - spec/fixtures/foobarbaz
+- spec/fixtures/hieradata/decrypt_error.eyaml
 - spec/fixtures/hieradata/good.eyaml
 - spec/fixtures/hieradata/good.json
 - spec/fixtures/hieradata/good.yaml
+- spec/fixtures/hieradata/nested_array.eyaml
 - spec/fixtures/hieradata/style.eyaml
 - spec/fixtures/hieradata/style.yaml
 - spec/fixtures/hieradata/syntax.eyaml