puppet-lint-yumrepo_gpgcheck_enabled-check 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/LICENSE +21 -0
- data/README.md +52 -0
- data/lib/puppet-lint/plugins/yumrepo_gpgcheck_enabled.rb +35 -0
- data/spec/puppet-lint/plugins/puppet-lint-yumrepo_gpgcheck_enabled_spec.rb +71 -0
- data/spec/spec_helper.rb +3 -0
- metadata +137 -0
checksums.yaml
ADDED
@@ -0,0 +1,7 @@
|
|
1
|
+
---
|
2
|
+
SHA1:
|
3
|
+
metadata.gz: c72729be39986cdc40516543826441b22b4a2863
|
4
|
+
data.tar.gz: 4145156920e990c8c4c020f1233526c15648424b
|
5
|
+
SHA512:
|
6
|
+
metadata.gz: d994b789108f67af647dfe8f579586e34ca4f19d15a805842f5534f779d094f0893b246f9c8eb125946aac2d1acf2128d2b0fa1d57783ce5a4911f6784b417ae
|
7
|
+
data.tar.gz: a7253c042bf701ad21193ae6385012125e7e0a90f8c04cfa51b9b69b2201a2c11ac2d8fb1e173fdd1afaaae6a8dd7f65c4aab02aed03bb25d5a1dedd8bdaaa6b
|
data/LICENSE
ADDED
@@ -0,0 +1,21 @@
|
|
1
|
+
The MIT License (MIT)
|
2
|
+
|
3
|
+
Copyright (c) 2016 Dean Wilson
|
4
|
+
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
7
|
+
in the Software without restriction, including without limitation the rights
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
10
|
+
furnished to do so, subject to the following conditions:
|
11
|
+
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
13
|
+
copies or substantial portions of the Software.
|
14
|
+
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
21
|
+
SOFTWARE.
|
data/README.md
ADDED
@@ -0,0 +1,52 @@
|
|
1
|
+
# puppet-lint yumrepo_gpgcheck_enabled check #
|
2
|
+
|
3
|
+
A puppet-lint extension that ensures yumrepo resources have the gpgcheck
|
4
|
+
attribute and that it is enabled.
|
5
|
+
|
6
|
+
[![Build Status](https://travis-ci.org/deanwilson/puppet-lint-yumrepo_gpgcheck_enabled-check.svg?branch=master)](https://travis-ci.org/deanwilson/puppet-lint-yumrepo_gpgcheck_enabled-check)
|
7
|
+
|
8
|
+
The `gpgcheck` attribute indicates if `yum` should perform a GPG
|
9
|
+
signature check on packages. Having this disabled means you'll accept
|
10
|
+
any packages from your configured repo, not just those signed by the
|
11
|
+
packagers. While it's often more work to sign your own packages you should
|
12
|
+
at the very least enable it for all upstream yum repositories.
|
13
|
+
|
14
|
+
## Installation ##
|
15
|
+
|
16
|
+
To use this plugin add the following line to your Gemfile
|
17
|
+
|
18
|
+
gem 'puppet-lint-yumrepo_gpgcheck_enabled-check'
|
19
|
+
|
20
|
+
and then run `bundle install`
|
21
|
+
|
22
|
+
## Usage ##
|
23
|
+
|
24
|
+
This plugin provides a new check to `puppet-lint` that warns if it finds
|
25
|
+
a `yumrepo` resource that either does not contain the `gpgcheck` attribute
|
26
|
+
or does not set the value to enable it.
|
27
|
+
|
28
|
+
yumrepo { 'company_app_repo':
|
29
|
+
enabled => 1,
|
30
|
+
descr => 'Local repo holding company application packages',
|
31
|
+
baseurl => 'http://repos.example.org/apps',
|
32
|
+
}
|
33
|
+
|
34
|
+
This example is missing `gpgcheck` and will return
|
35
|
+
|
36
|
+
yumrepo should have the gpgcheck attribute
|
37
|
+
|
38
|
+
The second example does not enable `gpgcheck`
|
39
|
+
|
40
|
+
yumrepo { 'company_app_repo':
|
41
|
+
enabled => 1,
|
42
|
+
descr => 'Local repo holding company application packages',
|
43
|
+
baseurl => 'http://repos.example.org/apps',
|
44
|
+
gpgcheck => 0,
|
45
|
+
}
|
46
|
+
|
47
|
+
and will return
|
48
|
+
|
49
|
+
yumrepo should enable the gpgcheck attribute
|
50
|
+
|
51
|
+
### Author ###
|
52
|
+
[Dean Wilson](http://www.unixdaemon.net)
|
@@ -0,0 +1,35 @@
|
|
1
|
+
PuppetLint.new_check(:yumrepo_gpgcheck_enabled) do
|
2
|
+
def check
|
3
|
+
resource_indexes.each do |resource|
|
4
|
+
next unless resource[:type].value == 'yumrepo'
|
5
|
+
|
6
|
+
# if the gpgcheck value doesn't exist then warn and return early.
|
7
|
+
if resource[:param_tokens].select { |pt| pt.value == 'gpgcheck' }.empty?
|
8
|
+
|
9
|
+
notify :warning, {
|
10
|
+
message: 'yumrepo should have the gpgcheck attribute',
|
11
|
+
line: resource[:type].line,
|
12
|
+
column: resource[:type].column,
|
13
|
+
}
|
14
|
+
|
15
|
+
else # we have at least one gpgcheck - check it's enabled
|
16
|
+
|
17
|
+
resource[:param_tokens].select { |param_token|
|
18
|
+
param_token.value == 'gpgcheck'
|
19
|
+
}.each do |content_token|
|
20
|
+
setting = content_token.next_code_token.next_code_token
|
21
|
+
|
22
|
+
# skip if valid. we only care about broken settings.
|
23
|
+
next if ['True', 1, '1', 'Yes'].include? setting.value
|
24
|
+
|
25
|
+
notify :warning, {
|
26
|
+
message: 'yumrepo should enable the gpgcheck attribute',
|
27
|
+
line: setting.line,
|
28
|
+
column: setting.column,
|
29
|
+
}
|
30
|
+
|
31
|
+
end
|
32
|
+
end
|
33
|
+
end
|
34
|
+
end
|
35
|
+
end
|
@@ -0,0 +1,71 @@
|
|
1
|
+
require 'spec_helper'
|
2
|
+
|
3
|
+
describe 'yumrepo_gpgcheck_enabled' do
|
4
|
+
context 'yumrepo with enabled gpgcheck' do
|
5
|
+
let(:code) do
|
6
|
+
<<-EOS
|
7
|
+
class yum_gpgenabled {
|
8
|
+
yumrepo { 'company_app_repo':
|
9
|
+
enabled => 1,
|
10
|
+
descr => 'Local repo holding company application packages',
|
11
|
+
baseurl => 'http://repos.example.org/apps',
|
12
|
+
gpgcheck => 1,
|
13
|
+
}
|
14
|
+
}
|
15
|
+
EOS
|
16
|
+
end
|
17
|
+
|
18
|
+
it 'should not detect any problems' do
|
19
|
+
expect(problems).to have(0).problems
|
20
|
+
end
|
21
|
+
end
|
22
|
+
|
23
|
+
context 'yumrepo without gpgcheck attribute' do
|
24
|
+
let(:absent_msg) { 'yumrepo should have the gpgcheck attribute' }
|
25
|
+
|
26
|
+
let(:code) do
|
27
|
+
<<-EOS
|
28
|
+
class yum_gpgenabled {
|
29
|
+
yumrepo { 'company_app_repo':
|
30
|
+
enabled => 1,
|
31
|
+
descr => 'Local repo holding company application packages',
|
32
|
+
baseurl => 'http://repos.example.org/apps',
|
33
|
+
}
|
34
|
+
}
|
35
|
+
EOS
|
36
|
+
end
|
37
|
+
|
38
|
+
it 'should detect a problem' do
|
39
|
+
expect(problems).to have(1).problem
|
40
|
+
end
|
41
|
+
|
42
|
+
it 'should create a warning' do
|
43
|
+
expect(problems).to contain_warning(absent_msg).on_line(2).in_column(11)
|
44
|
+
end
|
45
|
+
end
|
46
|
+
|
47
|
+
context 'yumrepo with disabled gpgcheck' do
|
48
|
+
let(:enable_msg) { 'yumrepo should enable the gpgcheck attribute' }
|
49
|
+
|
50
|
+
let(:code) do
|
51
|
+
<<-EOS
|
52
|
+
class yum_gpgenabled {
|
53
|
+
yumrepo { 'company_app_repo':
|
54
|
+
enabled => 1,
|
55
|
+
descr => 'Local repo holding company application packages',
|
56
|
+
baseurl => 'http://repos.example.org/apps',
|
57
|
+
gpgcheck => 0,
|
58
|
+
}
|
59
|
+
}
|
60
|
+
EOS
|
61
|
+
end
|
62
|
+
|
63
|
+
it 'should detect a problem' do
|
64
|
+
expect(problems).to have(1).problem
|
65
|
+
end
|
66
|
+
|
67
|
+
it 'should create a warning' do
|
68
|
+
expect(problems).to contain_warning(enable_msg).on_line(6).in_column(25)
|
69
|
+
end
|
70
|
+
end
|
71
|
+
end
|
data/spec/spec_helper.rb
ADDED
metadata
ADDED
@@ -0,0 +1,137 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: puppet-lint-yumrepo_gpgcheck_enabled-check
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
version: 0.0.1
|
5
|
+
platform: ruby
|
6
|
+
authors:
|
7
|
+
- Dean Wilson
|
8
|
+
autorequire:
|
9
|
+
bindir: bin
|
10
|
+
cert_chain: []
|
11
|
+
date: 2016-01-30 00:00:00.000000000 Z
|
12
|
+
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: puppet-lint
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - "~>"
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: '1.1'
|
20
|
+
type: :runtime
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - "~>"
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: '1.1'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: rspec
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
30
|
+
requirements:
|
31
|
+
- - "~>"
|
32
|
+
- !ruby/object:Gem::Version
|
33
|
+
version: '3.0'
|
34
|
+
type: :development
|
35
|
+
prerelease: false
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
37
|
+
requirements:
|
38
|
+
- - "~>"
|
39
|
+
- !ruby/object:Gem::Version
|
40
|
+
version: '3.0'
|
41
|
+
- !ruby/object:Gem::Dependency
|
42
|
+
name: rspec-its
|
43
|
+
requirement: !ruby/object:Gem::Requirement
|
44
|
+
requirements:
|
45
|
+
- - "~>"
|
46
|
+
- !ruby/object:Gem::Version
|
47
|
+
version: '1.0'
|
48
|
+
type: :development
|
49
|
+
prerelease: false
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
51
|
+
requirements:
|
52
|
+
- - "~>"
|
53
|
+
- !ruby/object:Gem::Version
|
54
|
+
version: '1.0'
|
55
|
+
- !ruby/object:Gem::Dependency
|
56
|
+
name: rspec-collection_matchers
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
58
|
+
requirements:
|
59
|
+
- - "~>"
|
60
|
+
- !ruby/object:Gem::Version
|
61
|
+
version: '1.0'
|
62
|
+
type: :development
|
63
|
+
prerelease: false
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - "~>"
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '1.0'
|
69
|
+
- !ruby/object:Gem::Dependency
|
70
|
+
name: rubocop
|
71
|
+
requirement: !ruby/object:Gem::Requirement
|
72
|
+
requirements:
|
73
|
+
- - "~>"
|
74
|
+
- !ruby/object:Gem::Version
|
75
|
+
version: 0.36.0
|
76
|
+
type: :development
|
77
|
+
prerelease: false
|
78
|
+
version_requirements: !ruby/object:Gem::Requirement
|
79
|
+
requirements:
|
80
|
+
- - "~>"
|
81
|
+
- !ruby/object:Gem::Version
|
82
|
+
version: 0.36.0
|
83
|
+
- !ruby/object:Gem::Dependency
|
84
|
+
name: rake
|
85
|
+
requirement: !ruby/object:Gem::Requirement
|
86
|
+
requirements:
|
87
|
+
- - ">="
|
88
|
+
- !ruby/object:Gem::Version
|
89
|
+
version: '0'
|
90
|
+
type: :development
|
91
|
+
prerelease: false
|
92
|
+
version_requirements: !ruby/object:Gem::Requirement
|
93
|
+
requirements:
|
94
|
+
- - ">="
|
95
|
+
- !ruby/object:Gem::Version
|
96
|
+
version: '0'
|
97
|
+
description: |2
|
98
|
+
A puppet-lint extension that ensures yumrepo resources have the gpgcheck
|
99
|
+
attribute and that it is enabled.
|
100
|
+
email: dean.wilson@gmail.com
|
101
|
+
executables: []
|
102
|
+
extensions: []
|
103
|
+
extra_rdoc_files: []
|
104
|
+
files:
|
105
|
+
- LICENSE
|
106
|
+
- README.md
|
107
|
+
- lib/puppet-lint/plugins/yumrepo_gpgcheck_enabled.rb
|
108
|
+
- spec/puppet-lint/plugins/puppet-lint-yumrepo_gpgcheck_enabled_spec.rb
|
109
|
+
- spec/spec_helper.rb
|
110
|
+
homepage: https://github.com/deanwilson/puppet-lint-yumrepo_gpgcheck_enabled-check
|
111
|
+
licenses:
|
112
|
+
- MIT
|
113
|
+
metadata: {}
|
114
|
+
post_install_message:
|
115
|
+
rdoc_options: []
|
116
|
+
require_paths:
|
117
|
+
- lib
|
118
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
119
|
+
requirements:
|
120
|
+
- - ">="
|
121
|
+
- !ruby/object:Gem::Version
|
122
|
+
version: '0'
|
123
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
124
|
+
requirements:
|
125
|
+
- - ">="
|
126
|
+
- !ruby/object:Gem::Version
|
127
|
+
version: '0'
|
128
|
+
requirements: []
|
129
|
+
rubyforge_project:
|
130
|
+
rubygems_version: 2.4.8
|
131
|
+
signing_key:
|
132
|
+
specification_version: 4
|
133
|
+
summary: puppet-lint check to ensure gpgcheck is enabled on yumrepo resources
|
134
|
+
test_files:
|
135
|
+
- spec/spec_helper.rb
|
136
|
+
- spec/puppet-lint/plugins/puppet-lint-yumrepo_gpgcheck_enabled_spec.rb
|
137
|
+
has_rdoc:
|