puppet-lint-yumrepo_gpgcheck_enabled-check 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: c72729be39986cdc40516543826441b22b4a2863
+  data.tar.gz: 4145156920e990c8c4c020f1233526c15648424b
+SHA512:
+  metadata.gz: d994b789108f67af647dfe8f579586e34ca4f19d15a805842f5534f779d094f0893b246f9c8eb125946aac2d1acf2128d2b0fa1d57783ce5a4911f6784b417ae
+  data.tar.gz: a7253c042bf701ad21193ae6385012125e7e0a90f8c04cfa51b9b69b2201a2c11ac2d8fb1e173fdd1afaaae6a8dd7f65c4aab02aed03bb25d5a1dedd8bdaaa6b

data/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Dean Wilson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,52 @@
+# puppet-lint yumrepo_gpgcheck_enabled check #
+
+A puppet-lint extension that ensures yumrepo resources have the gpgcheck
+attribute and that it is enabled.
+
+[![Build Status](https://travis-ci.org/deanwilson/puppet-lint-yumrepo_gpgcheck_enabled-check.svg?branch=master)](https://travis-ci.org/deanwilson/puppet-lint-yumrepo_gpgcheck_enabled-check)
+
+The `gpgcheck` attribute indicates if `yum` should perform a GPG
+signature check on packages. Having this disabled means you'll accept
+any packages from your configured repo, not just those signed by the
+packagers. While it's often more work to sign your own packages you should
+at the very least enable it for all upstream yum repositories.
+
+## Installation ##
+
+To use this plugin add the following line to your Gemfile
+
+    gem 'puppet-lint-yumrepo_gpgcheck_enabled-check'
+
+and then run `bundle install`
+
+## Usage ##
+
+This plugin provides a new check to `puppet-lint` that warns if it finds
+a `yumrepo` resource that either does not contain the `gpgcheck` attribute
+or does not set the value to enable it.
+
+    yumrepo { 'company_app_repo':
+      enabled  => 1,
+      descr    => 'Local repo holding company application packages',
+      baseurl  => 'http://repos.example.org/apps',
+    }
+
+This example is missing `gpgcheck` and will return
+
+    yumrepo should have the gpgcheck attribute
+
+The second example does not enable `gpgcheck`
+
+    yumrepo { 'company_app_repo':
+      enabled  => 1,
+      descr    => 'Local repo holding company application packages',
+      baseurl  => 'http://repos.example.org/apps',
+      gpgcheck => 0,
+    }
+
+and will return
+
+    yumrepo should enable the gpgcheck attribute
+
+### Author ###
+[Dean Wilson](http://www.unixdaemon.net)

data/lib/puppet-lint/plugins/yumrepo_gpgcheck_enabled.rb

@@ -0,0 +1,35 @@
+PuppetLint.new_check(:yumrepo_gpgcheck_enabled) do
+  def check
+    resource_indexes.each do |resource|
+      next unless resource[:type].value == 'yumrepo'
+
+      # if the gpgcheck value doesn't exist then warn and return early.
+      if resource[:param_tokens].select { |pt| pt.value == 'gpgcheck' }.empty?
+
+        notify :warning, {
+          message: 'yumrepo should have the gpgcheck attribute',
+          line:    resource[:type].line,
+          column:  resource[:type].column,
+        }
+
+      else # we have at least one gpgcheck - check it's enabled
+
+        resource[:param_tokens].select { |param_token|
+          param_token.value == 'gpgcheck'
+        }.each do |content_token|
+          setting = content_token.next_code_token.next_code_token
+
+          # skip if valid. we only care about broken settings.
+          next if ['True', 1, '1', 'Yes'].include? setting.value
+
+          notify :warning, {
+            message: 'yumrepo should enable the gpgcheck attribute',
+            line:    setting.line,
+            column:  setting.column,
+          }
+
+        end
+      end
+    end
+  end
+end

data/spec/puppet-lint/plugins/puppet-lint-yumrepo_gpgcheck_enabled_spec.rb

@@ -0,0 +1,71 @@
+require 'spec_helper'
+
+describe 'yumrepo_gpgcheck_enabled' do
+  context 'yumrepo with enabled gpgcheck' do
+    let(:code) do
+      <<-EOS
+        class yum_gpgenabled {
+          yumrepo { 'company_app_repo':
+            enabled  => 1,
+            descr    => 'Local repo holding company application packages',
+            baseurl  => 'http://repos.example.org/apps',
+            gpgcheck => 1,
+          }
+        }
+      EOS
+    end
+
+    it 'should not detect any problems' do
+      expect(problems).to have(0).problems
+    end
+  end
+
+  context 'yumrepo without gpgcheck attribute' do
+    let(:absent_msg) { 'yumrepo should have the gpgcheck attribute' }
+
+    let(:code) do
+      <<-EOS
+        class yum_gpgenabled {
+          yumrepo { 'company_app_repo':
+            enabled  => 1,
+            descr    => 'Local repo holding company application packages',
+            baseurl  => 'http://repos.example.org/apps',
+          }
+        }
+      EOS
+    end
+
+    it 'should detect a problem' do
+      expect(problems).to have(1).problem
+    end
+
+    it 'should create a warning' do
+      expect(problems).to contain_warning(absent_msg).on_line(2).in_column(11)
+    end
+  end
+
+  context 'yumrepo with disabled gpgcheck' do
+    let(:enable_msg) { 'yumrepo should enable the gpgcheck attribute' }
+
+    let(:code) do
+      <<-EOS
+        class yum_gpgenabled {
+          yumrepo { 'company_app_repo':
+            enabled  => 1,
+            descr    => 'Local repo holding company application packages',
+            baseurl  => 'http://repos.example.org/apps',
+            gpgcheck => 0,
+          }
+        }
+      EOS
+    end
+
+    it 'should detect a problem' do
+      expect(problems).to have(1).problem
+    end
+
+    it 'should create a warning' do
+      expect(problems).to contain_warning(enable_msg).on_line(6).in_column(25)
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,3 @@
+require 'puppet-lint'
+
+PuppetLint::Plugins.load_spec_helper

metadata

@@ -0,0 +1,137 @@
+--- !ruby/object:Gem::Specification
+name: puppet-lint-yumrepo_gpgcheck_enabled-check
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Dean Wilson
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-01-30 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: puppet-lint
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rspec-its
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: rspec-collection_matchers
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.36.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.36.0
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: |2
+      A puppet-lint extension that ensures yumrepo resources have the gpgcheck
+      attribute and that it is enabled.
+email: dean.wilson@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/puppet-lint/plugins/yumrepo_gpgcheck_enabled.rb
+- spec/puppet-lint/plugins/puppet-lint-yumrepo_gpgcheck_enabled_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/deanwilson/puppet-lint-yumrepo_gpgcheck_enabled-check
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.8
+signing_key: 
+specification_version: 4
+summary: puppet-lint check to ensure gpgcheck is enabled on yumrepo resources
+test_files:
+- spec/spec_helper.rb
+- spec/puppet-lint/plugins/puppet-lint-yumrepo_gpgcheck_enabled_spec.rb
+has_rdoc: