puppet-forge-server 1.9.0 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 08f079588ee75d93139153846fb0021ffd6e856a
-  data.tar.gz: 985dd8259b92e2a616e2ea00dcb4ac906572fb69
+  metadata.gz: 729d7bfd39907675eb708e82189328460b0ad915
+  data.tar.gz: 70d8b9cd7f17bf0689a988d558e644b962b10e6b
 SHA512:
-  metadata.gz: 3bb6e219dd02e6484fab928c5c5047bf51329facd1fc1d2acd4613c79f4e22bc1fce66f4709302c0b57d24137417b23a8cd1b37c64b149e7f6e48cbc5186a438
-  data.tar.gz: 4abba59d6b0cc3c16a65534940a37187286207ba273936dcf0c0b6d859c7a851cb055a549aecdaaf551797817cd08f3ab711341cc67223aac54fa175543bb8d6
+  metadata.gz: a295bacb75065a6d551c2af7b23ca3c2ea464065f827ab9ff98375af32fc328878aedd0c1b535faf677085b1a8886616d027d5a6d5ad5461ee2fed141fade074
+  data.tar.gz: 5b7f82e4a6a79495a124b67bb588fe58bda9004c995b6cfc7c3353be06653c08d4839b4f27d7c9dca5addc93893112ee233bb7516676473c4bdf732524ccfdee

data/README.md

@@ -20,6 +20,8 @@ Puppet 2, 3 and 4 as well as librarian-puppet are supported.
     * [Proxy the official Puppet Forge v1 API and local Pulp puppet repository](#proxy-the-official-puppet-forge-v1-api-and-local-pulp-puppet-repository)
   * [Locally stored modules](#locally-stored-modules)
   * [All-in](#all-in)
+    *  [r10k](#r10k)
+    *  [librarian-puppet](#librarian-puppet)
   * [Daemon](#daemon)
 * [Web UI](#web-ui)
 * [Architecture](#command-reference)
@@ -30,7 +32,7 @@ Puppet 2, 3 and 4 as well as librarian-puppet are supported.
 * [Limitations](#limitations)
 * [Reference](#reference)
 
-## Installation
+## Manual Installation
 
 Install the gem
 ```
@@ -45,6 +47,10 @@ bundle install
 bundle exec bin/puppet-forge-server --help
 ```
 
+## Installation with Puppet
+
+To install the Puppet Forge Server with puppet, you can use this module: https://github.com/unibet/puppet-forge_server
+
 ### Dependencies
 The gem installtion requires the ruby development packages and GCC.
 
@@ -108,6 +114,23 @@ wget -P modules/ forge.puppetlabs.com/system/releases/p/puppetlabs/puppetlabs-st
 bundle exec bin/puppet-forge-server -m modules/ -x https://forgeapi.puppetlabs.com -x http://my.local.pulp/pulp_puppet/forge/repository/demo
 ```
 
+#### r10k
+Create an example Puppetfile
+```
+cat > Puppetfile <<EOF
+mod 'puppetlabs/apache'
+EOF
+
+```
+Add forge/baseurl to r10k.yaml
+```
+cat >> r10k.yaml <<EOF
+forge:
+  baseurl: 'http://localhost:8080'
+EOF
+```
+
+#### librarian-puppet
 Create an example Puppetfile
 ```
 cat > Puppetfile <<EOF

data/lib/puppet_forge_server/api/v1/modules.rb

@@ -38,7 +38,7 @@ module PuppetForgeServer::Api::V1
             :author => author,
             :full_name => element.metadata.name.sub('-', '/'),
             :name => name,
-            :desc => element.metadata.description,
+            :desc => element.metadata.description || element.metadata.summary,
             :version => element.metadata.version,
             :project_url => element.metadata.project_page,
             :releases => releases_version(element.metadata),

data/lib/puppet_forge_server/api/v3/modules.rb

@@ -52,7 +52,7 @@ module PuppetForgeServer::Api::V3
 
     private
     def releases_version(metadata)
-      [{:version => metadata.version, :uri => "/v3/releases/#{metadata.name}-#{metadata.version}"}]
+      [{:version => metadata.version, :uri => "/v3/releases/#{metadata.name}-#{metadata.version}", :slug => "#{metadata.name}-#{metadata.version}"}]
     end
 
     def max_version(left, right)

data/lib/puppet_forge_server/app/frontend.rb

@@ -45,12 +45,18 @@ module PuppetForgeServer::App
 
     get '/modules' do
       query = params[:query]
+      halt(400, haml(:security, :locals => {:query => query})) \
+        unless safe_input? query
+
       modules = get("#{request.base_url}/v3/modules?query=#{query}")['results']
       haml :modules, :locals => {:query => query, :modules => modules}
     end
 
     get '/module' do
       module_v3_name = params[:name].gsub(/\//, '-')
+      halt(400, haml(:security, :locals => {:query => module_v3_name})) \
+        unless safe_input? module_v3_name
+
       releases = get("#{request.base_url}/v3/modules/#{module_v3_name}")['releases']
       if params.has_key? 'version'
         module_uri = releases.find {|r| r['version'] == params['version']}['uri']
@@ -63,7 +69,10 @@ module PuppetForgeServer::App
       rescue
         readme_markdown = ''
       end
-      haml :module, :locals => { :module_metadata => module_metadata, :base_url => request.base_url, :readme_markdown => readme_markdown, :releases => releases }
+      haml :module, :locals => { :module_metadata => module_metadata,
+                                 :base_url => request.base_url,
+                                 :readme_markdown => readme_markdown,
+                                 :releases => releases }
     end
 
     get '/upload' do
@@ -84,5 +93,10 @@ module PuppetForgeServer::App
         {'results' => []}
       end
     end
+
+    def safe_input?(query)
+      unsafe_query = CGI::unescape(query)
+      %w[< javascript:].none? { |q| unsafe_query.include?(q) }
+    end
   end
 end

data/lib/puppet_forge_server/app/public/css/puppetlabs.css

@@ -135,6 +135,12 @@ body {
 .clearfix {
   display: block;
 }
+.code-block {
+  margin: 1em;
+}
+input[type=file]{
+  display: inline-block;
+}
 input[type=search] {
   width: 80%;
   max-width: 650px;

data/lib/puppet_forge_server/app/version3.rb

@@ -40,7 +40,7 @@ module PuppetForgeServer::App
 
     get '/v3/releases/:module' do
       halt 404, json({:errors => ['404 Not found']}) unless params[:module]
-      author, name, version = params[:module].split '-'
+      author, name, version = params[:module].split('-',3)
       halt 400, json({:errors => ["'#{params[:module]}' is not a valid release slug"]}) unless author && name && version
       releases = releases(author, name, version)
       halt 404, json({:errors => ['404 Not found']}) unless releases

data/lib/puppet_forge_server/app/views/security.haml

@@ -0,0 +1,20 @@
+-# -*- encoding: utf-8 -*-
+-#
+-# Copyright 2014 North Development AB
+-#
+-# Licensed under the Apache License, Version 2.0 (the "License");
+-# you may not use this file except in compliance with the License.
+-# You may obtain a copy of the License at
+-#
+-# http://www.apache.org/licenses/LICENSE-2.0
+-#
+-# Unless required by applicable law or agreed to in writing, software
+-# distributed under the License is distributed on an "AS IS" BASIS,
+-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-# See the License for the specific language governing permissions and
+-# limitations under the License.
+
+%h3.search-results-title Security violation
+
+%h4 The query provided contains illegal or dangerous characters.
+Please clean them up and try again.

data/lib/puppet_forge_server/app/views/upload.haml

@@ -18,28 +18,35 @@
 
 / TODO Need better formatting
 / TODO Better error notification
-/ TODO Information on programatic uploads
 %h3 Upload Puppet Module
 
-Specify below the location of the Puppet module .tar.gz file that you wish to publish.
+%div.section.site-width#content
+  Specify below the location of the Puppet module .tar.gz file that you wish to publish.
 
-The Puppet module .tar.gz file should be generated by executing
+  The Puppet module .tar.gz file should be generated by executing
 
-%div
-  %pre
-    puppet module build
+  %div.code-block
+    %pre
+      puppet module build
 
-The result will be a pkg directory at the top level of the module with the .tag.gz within it.
+  The result will be a pkg directory at the top level of the module with the .tag.gz within it.
+  Once the .tar.gz has been generated, it can be uploaded to this Puppet Forge server through the
+  form below or by executing the following curl command line.
 
-%span.search_error
-  -if upload_status
-    -case upload_status
-    -when '200'
-      File has been uploaded
-    -when ''
-    -else
-      Upload has failed. #{upload_status}
+  %div.code-block
+    %pre
+      :markdown
+        curl -F "file=@pkg/_<name>_-_<version>_.tar.gz" #{request.env['REQUEST_URI']}
 
-%form{:action => '/upload', :method=>'post', :enctype=>'multipart/form-data' }
-  %input{ :type => 'file', :name=>'file'}
-  %input{ :type=>'submit', :value=>'Upload'}
+  %span.search_error
+    -if upload_status
+      -case upload_status
+      -when '200'
+        File has been uploaded
+      -when ''
+      -else
+        Upload has failed. #{upload_status}
+
+  %form{:action => '/upload', :method=>'post', :enctype=>'multipart/form-data' }
+    %input{ :type => 'file', :name=>'file'}
+    %input{ :type=>'submit', :value=>'Upload'}

data/lib/puppet_forge_server/backends/proxy.rb

@@ -28,7 +28,7 @@ module PuppetForgeServer::Backends
       @file_path = file_path
 
       # Create directory structure for all alphabetic letters
-      (10...36).each do |i|
+      (0...36).each do |i|
         FileUtils.mkdir_p(File.join(@cache_dir, i.to_s(36)))
       end
     end

data/lib/puppet_forge_server/http/http_client.rb

@@ -31,6 +31,23 @@ module PuppetForgeServer::Http
       cache.extend(PuppetForgeServer::Utils::FilteringInspecter)
       @log = PuppetForgeServer::Logger.get
       @cache = cache
+      @uri_options= {
+        'User-Agent' => "Puppet-Forge-Server/#{PuppetForgeServer::VERSION}",
+        :allow_redirections => :safe,
+      }
+      # OpenURI does not work with  http_proxy=http://username:password@proxyserver:port/
+      # so split the proxy_url and feed it basic authentication.
+      if ENV.has_key?('http_proxy')
+        proxy = URI.parse(ENV['http_proxy'])
+        if proxy.userinfo != nil
+          @uri_options[:proxy_http_basic_authentication] = [
+            "#{proxy.scheme}://#{proxy.host}:#{proxy.port}",
+            proxy.userinfo.split(':')[0],
+            proxy.userinfo.split(':')[1]
+          ]
+        end
+      end
+
     end
 
     def post_file(url, file_hash, options = {})
@@ -69,7 +86,7 @@ module PuppetForgeServer::Http
       contents = @cache.fetch(url) do
         tmpfile = ::Timeout.timeout(10) do
           PuppetForgeServer::Logger.get.debug "Fetching data for url: #{url} from remote server"
-          open(url, 'User-Agent' => "Puppet-Forge-Server/#{PuppetForgeServer::VERSION}", :allow_redirections => :safe)
+          open(url, @uri_options)
         end
         contents = tmpfile.read
         tmpfile.close

data/lib/puppet_forge_server/server.rb

@@ -71,7 +71,7 @@ module PuppetForgeServer
       options.default = 'default'
       @log.info " +- Daemonizing: #{options[:daemonize]}"
       @log.info " |- Port: #{options[:port]}"
-      @log.info " |- Host: #{options[:hostname]}"
+      @log.info " |- Host: #{options[:host]}"
       @log.info " |- Pidfile: #{options[:pidfile]}" if options[:pidfile]
       @log.info " |- Server: #{options[:server]}"
       @log.info ' `- Backends:'
@@ -84,7 +84,7 @@ module PuppetForgeServer
       FileUtils.mkdir_p File.dirname(options[:pidfile]) if options[:pidfile]
       Rack::Server.start(
           :app => server,
-          :Host => options[:hostname],
+          :Host => options[:host],
           :Port => options[:port],
           :server => options[:server],
           :daemonize => options[:daemonize],

data/lib/puppet_forge_server/version.rb

@@ -15,5 +15,5 @@
 # limitations under the License.
 
 module PuppetForgeServer
-    VERSION = '1.9.0'
+    VERSION = '1.10.0'
 end

data/spec/unit/http/http_client_spec.rb

@@ -24,7 +24,7 @@ describe PuppetForgeServer::Http::HttpClient do
                      "Connection: close\r\n"
         socket.print "\r\n"
         # To simulate network lag
-        sleep 0.01
+        sleep 0.05
         socket.print response
         socket.close
       end

metadata

@@ -1,69 +1,69 @@
 --- !ruby/object:Gem::Specification
 name: puppet-forge-server
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.10.0
 platform: ruby
 authors:
 - Ilja Bobkevic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-22 00:00:00.000000000 Z
+date: 2017-10-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sinatra
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.4'
 - !ruby/object:Gem::Dependency
   name: sinatra-contrib
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.4'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.8'
 - !ruby/object:Gem::Dependency
   name: rack-mount
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.8'
 - !ruby/object:Gem::Dependency
@@ -84,210 +84,210 @@ dependencies:
   name: open4
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.3'
 - !ruby/object:Gem::Dependency
   name: open_uri_redirections
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.1'
 - !ruby/object:Gem::Dependency
   name: haml
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '4.0'
 - !ruby/object:Gem::Dependency
   name: deep_merge
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
   name: multipart-post
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 2.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 2.0.0
 - !ruby/object:Gem::Dependency
   name: redcarpet
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 3.3.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 3.3.0
 - !ruby/object:Gem::Dependency
   name: lrucache
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.1.4
 - !ruby/object:Gem::Dependency
   name: iconv
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 1.0.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 1.0.4
 - !ruby/object:Gem::Dependency
   name: logger-colors
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '10.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '10.3'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '3.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '3.1'
 - !ruby/object:Gem::Dependency
   name: rspec-core
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '3.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '3.1'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.11.0
 - !ruby/object:Gem::Dependency
   name: rspec-stopwatch
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.1.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.1.3
 - !ruby/object:Gem::Dependency
   name: pry
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 description: Private Puppet forge server supports local files, both v1 and v3 API
@@ -298,9 +298,9 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".rspec"
-- ".travis.yml"
+- .gitignore
+- .rspec
+- .travis.yml
 - Gemfile
 - README.md
 - Rakefile
@@ -323,6 +323,7 @@ files:
 - lib/puppet_forge_server/app/views/layout.haml
 - lib/puppet_forge_server/app/views/module.haml
 - lib/puppet_forge_server/app/views/modules.haml
+- lib/puppet_forge_server/app/views/security.haml
 - lib/puppet_forge_server/app/views/upload.haml
 - lib/puppet_forge_server/backends/directory.rb
 - lib/puppet_forge_server/backends/proxy.rb
@@ -367,17 +368,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.1
+rubygems_version: 2.0.14.1
 signing_key: 
 specification_version: 4
 summary: Private Puppet forge server