simp-rake-helpers 5.11.2 → 5.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 120ba7852eb7531d190da1c922c9eccd42bd98ff9f3506ed9d6f0bdb2cd36e96
-  data.tar.gz: 310f8cc891fe4bc07a35699b3d7e735d2222888fd96964b1fed7143e70be35b6
+  metadata.gz: 1d979c12113e415884ec44b2880134bde9e20a3efc99495520e3518a994118f6
+  data.tar.gz: f9da255f0c077f662f00757ca2428b9375b1b4bd2d39de1b484c1a047d87c1f4
 SHA512:
-  metadata.gz: c55a930c618700c3daa341ba4d32fd815ce28c11582cb033be23f313248394de762915d8c9eb4e320c0758f8d25eef200cf00eebbc222755f46ba048d804df8f
-  data.tar.gz: 01bb7784afab0d0074c0ec46bb0ea68b56c62f28310e6e0b504fb6e2b614707a84ffb6fe084e48384ac639a4cdefa12e462dbd4a3fd0ae65c3eb8d3277745be2
+  metadata.gz: 493c503f1ead3608b3718e113188ef08af8905d96fd7297f439adc4809c44e70f4ec6b1c3d08c1eb09458ef4ab1499db61ec3519f1d18ab297e1b8812c5620d1
+  data.tar.gz: bf8bd8cbbf5c36ac268a23e346554a6f7132523f5f32a3f76162fdc8d77dd01898362d51dadd6012e2e07efb08e61737c1398c123e09092b422b94e631a0b43a

data/CHANGELOG.md

@@ -1,3 +1,46 @@
+### 5.12.0 / 2021-02-16
+- Ensure that pkg:install_gem uses the correct documentation options for the
+  version of Ruby in use.
+- Disable brp-mangle-shebangs when building RPMs.
+- Mitigated problem where gpg-agent daemon fails to start because
+  its socket path is longer than 108 characters.
+  - Changed the default location of the GPG keys directory used in the
+    pkg:key_prep and pkg:signrpms Rake tasks to <base_dir>/.dev_gpgkeys.
+  - Added a SIMP_PKG_build_keys_dir environment variable that overrides
+    the default location of the GPG keys directory used in the
+    pkg:key_prep and pkg:signrpms Rake tasks.
+- Added SIMP_PKG_rpmsign_timeout environment variable that overrides
+  default timeout in seconds to wait for an individual RPM signing
+  operation to complete.
+  - Default timeout is 30 seconds.
+  - Most relevant when signing on RPMs on EL8 and the gpg-agent
+    started by rpmsign fails to start, but rpmsign does not detect
+    the failure and hangs.
+- Improved pkg:signrpms error handling and reporting.
+- Fixed bug in GPG handling for GPG 2.1+ in which an existing
+  GPG key that was not cached internally was not detected.
+- Fixed bug where pkg:signrpms failed to sign RPMs on EL8.
+- Fixed bug where pkg:checksig reported failure on EL8, even when
+  the signatures were valid.
+- Deprecated the following top-level Rake tasks for Puppet modules:
+  - compare_latest_tag: use pkg:compare_latest_tag instead
+  - changelog_annotation: use pkg:create_tag_changelog instead
+
+### 5.11.6 / 2021-02-03
+* Fix GPG handling for GPG 2.1+
+
+### 5.11.5 / 2020-12-02
+* Add support for Puppet 7
+* Work around issues with querying RPM spec file changelogs using RPM version 4.15.0+
+* Switch between 'with_unbundled_env' and 'with_clean_env' based on which one
+  Bundler supports.
+
+### 5.11.4 / 2020-08-03
+* Permit *.md files in `rake pkg:compare_latest_tag`
+
+### 5.11.3 / 2020-05-19
+* Fix automatically added dependencies for SIMP 6.4+
+
 ### 5.11.2 / 2020-04-08
 * Version information should not be required on dependencies in metadata.json
 

data/CONTRIBUTING.md

@@ -1,4 +1,4 @@
 ## Contributing
 
-Please refer to the main [SIMP Project Contributing Guide](https://github.com/NationalSecurityAgency/SIMP/blob/master/CONTRIBUTING.md)
+Please refer to the main [SIMP Project Contributing Guide](https://simp-doc.readthedocs.io/en/stable/contributors_guide/index.html)
 for details on contributing to this project.

data/Gemfile

@@ -2,7 +2,7 @@
 #
 # SIMP_GEM_SERVERS | a space/comma delimited list of rubygem servers
 # PUPPET_VERSION   | specifies the version of the puppet gem to load
-puppetversion = ENV.key?('PUPPET_VERSION') ? "#{ENV['PUPPET_VERSION']}" : '~> 5'
+puppetversion = ENV.key?('PUPPET_VERSION') ? "#{ENV['PUPPET_VERSION']}" : '~> 6'
 gem_sources   = ENV.key?('SIMP_GEM_SERVERS') ? ENV['SIMP_GEM_SERVERS'].split(/[, ]+/) : ['https://rubygems.org']
 
 gem_sources.each { |gem_source| source gem_source }
@@ -13,6 +13,10 @@ gem 'simp-build-helpers'
 gem 'simp-beaker-helpers'
 gem 'beaker-puppet_install_helper'
 gem 'rake', '>= 12.3.3'
+# You'll need the following if using podman until they are released upstream
+#gem 'beaker-docker', :git => 'https://github.com/trevor-vaughan/beaker-docker', :branch => 'support_rootless_podman'
+#gem 'docker-api', :git => 'https://github.com/trevor-vaughan/docker-api', :branch => 'podman-compat'
+gem 'beaker-docker'
 
 if puppetversion
   gem 'puppet', puppetversion

data/README.md

@@ -39,7 +39,7 @@ The `simp-rake-helpers` gem provides common Rake tasks to support the SIMP build
 
 ### This gem is part of SIMP
 
-This gem is part of (the build tooling for) the [System Integrity Management Platform](https://github.com/NationalSecurityAgency/SIMP), a compliance-management framework built on [Puppet](https://puppetlabs.com/).
+This gem is part of (the build tooling for) the [System Integrity Management Platform](https://simp-project.com), a compliance-management framework built on [Puppet](https://puppetlabs.com/).
 
 
 ### Features

data/lib/simp/command_utils.rb

@@ -0,0 +1,21 @@
+module Simp; end
+module Simp::CommandUtils
+  require 'facter'
+
+  def which(cmd, fail=false)
+    @which_cache ||= {}
+
+    if @which_cache.has_key?(cmd)
+      command = @which_cache[cmd]
+    else
+      command = Facter::Core::Execution.which(cmd)
+      @which_cache[cmd] = command
+    end
+
+    msg = "Warning: Command #{cmd} not found on the system."
+
+    ( fail ? raise(msg) : warn(msg) ) unless command
+
+    command
+  end
+end

data/lib/simp/componentinfo.rb

@@ -139,6 +139,23 @@ class Simp::ComponentInfo
     if $?.exitstatus != 0
       fail("Could not extract changelog from #{rpm_spec_files[0]}." +
         " To debug, execute:\n   #{changelog_query}")
+    elsif raw_changelog.strip.empty?
+      changelog_lines = []
+
+      in_changelog = false
+      File.read(rpm_spec_files[0]).lines.each do |line|
+        changelog_lines << line if in_changelog
+
+        if line.start_with?('%')
+          if line.start_with?('%changelog')
+            in_changelog = true
+          else
+            in_changelog = false
+          end
+        end
+      end
+
+      raw_changelog = changelog_lines.join
     end
     @changelog = parse_changelog(raw_changelog, latest_version_only, verbose)
   end

data/lib/simp/local_gpg_signing_key.rb

@@ -1,5 +1,6 @@
 require 'securerandom'
 require 'rake'
+require 'simp/command_utils'
 
 module Simp
   # Ensure that a valid GPG signing key exists in a local directory
@@ -14,49 +15,52 @@ module Simp
   #     - New keys are generated using a temporary GPG agent with its own
   #       settings and socket.
   #
-  #   The local signing key's directory is structured like this:
+  #   The local signing key's directory includes the following:
+  #   gpg < 2.1.0 (EL7):
   #
   #   ```
   #   #{key_name}/                        # key directory
   #     +-- RPM-GPG-KEY-SIMP-#{key_name}  # key file
   #     +-- gengpgkey                     # --gen-key params file **
+  #     +-- gpg-agent-info.env            # Lists location of gpg-agent socket + pid
+  #     +-- run_gpg_agnet                 # Script used to start gpg-agent
   #     +-- pubring.gpg
   #     +-- secring.gpg
-  #     +-- trustring.gpg
+  #     +-- trustdb.gpg
   #   ```
   #
-  #   `**` = `SIMP::RPM.sign_keys` will use the values in the `gengpgkey` file
+  #   gpg >= 2.1.0 (EL8):
+  #   ```
+  #   #{key_name}/                        # key directory
+  #     +-- RPM-GPG-KEY-SIMP-#{key_name}  # key file
+  #     +-- gengpgkey                     # --gen-key params file **
+  #     +-- openpgp-revocs.d/<fingerprint id>.rev
+  #     +-- private-keys-v1.d/<user id>.key
+  #     +-- pubring.kbx
+  #     +-- trustdb.gpg
+  #   ```
+  #
+  #   `**` = `SIMP::RpmSigner.sign_rpms` will use the values in the `gengpgkey` file
   #     for the GPG signing key's email and passphrase
   #
   #   If a new key is required, a project-only `gpg-agent` daemon is momentarily
   #   created to generate it, and destroyed after this is done.  The daemon does
-  #   not interact with any other `gpg-agent` daemons on the system--it is
-  #   launched on a random socket and keeps all its files under the
-  #   #{key_name/} directory.
-  #
-  #   When instantiated, the daemon writes an "env-file" to the #{key_name}
-  #   directory.  This file specifies the location of the daemon's socket and
-  #   pid.
+  #   not interact with any other `gpg-agent` daemons on the system. It is
+  #   launched on random socket(s) whose socket file(s) can be found as follows:
   #
-  #   A typical env-file looks like:
+  #   Location                           Environment
+  #   #{key_name} dir                    Docker container for EL8
+  #   temp dir in /run/user/<uid>/gnupg  EL8
+  #   temp dir in /tmp                   EL7
   #
-  #   ```sh
-  #   GPG_AGENT_INFO=/tmp/gpg-4yhfOB/S.gpg-agent:15495:1
-  #   ```
-  #
-  #   A brand-new gpg-agent daemon will output similar information, with an
-  #   additional export:
-  #
-  #   ```sh
-  #   GPG_AGENT_INFO=/tmp/gpg-4yhfOB/S.gpg-agent:15495:1; export GPG_AGENT_INFO;\n"
-  #   ```
   class LocalGpgSigningKey
     include FileUtils
+    include Simp::CommandUtils
 
-    # `SIMP::RPM.sign_keys` will look for a 'gengpgkey' file to
+    # `SIMP::RpmSigner.sign_rpms` will look for a 'gengpgkey' file to
     #   non-interactively sign packages.
     #
-    #   @see SIMP::RPM.sign_keys
+    #   @see SIMP::RpmSigner.sign_rpms
     GPG_GENKEY_PARAMS_FILENAME = 'gengpgkey'.freeze
 
     # @param dir  [String] path to gpg-agent / key directory
@@ -74,10 +78,27 @@ module Simp
       @key_file  = opts[:file]    || "RPM-GPG-KEY-SIMP-#{@label.capitalize}"
       @verbose   = opts[:verbose] || false
 
+      # for EL7 only
       @gpg_agent_env_file = 'gpg-agent-info.env'
       @gpg_agent_script   = 'run_gpg_agent'
     end
 
+    # Return the version of GPG installed on the system
+    #
+    # @return [Gem::Version]
+    def gpg_version
+      return @gpg_version if @gpg_version
+
+      which('gpg', true)
+      @gpg_version = %x{gpg --version}.lines.first.split(/\s+/).last
+
+      unless @gpg_version.nil? || @gpg_version.empty?
+        @gpg_version = Gem::Version.new(@gpg_version)
+      end
+
+      @gpg_version
+    end
+
     # Returns a gpg-agent's env string, if it can be detected from the
     #   gpg-agent-info file
     #
@@ -95,15 +116,45 @@ module Simp
       info
     end
 
-    # Return the number of days left before the GPG signing key expires
+    # Return the number of days left before the GPG signing key expires or
+    # 0 if the key does not exist or the key is missing an expiration date.
     def dev_key_days_left
+      which('gpg', true)
       ensure_gpg_directory
-      days_left   = 0
-      current_key = %x(GPG_AGENT_INFO='' gpg --homedir=#{@dir} --list-keys #{@key_email} 2>/dev/null)
-      unless current_key.empty?
-        lasts_until = current_key.lines.first.strip.split("\s").last.delete(']')
-        days_left = (Date.parse(lasts_until) - Date.today).to_i
+
+      days_left = 0
+      cmd = "gpg --with-colons --homedir=#{@dir} --list-keys '<#{@key_email}>' 2>&1"
+      puts "Executing: #{cmd}" if @verbose
+      %x(#{cmd}).each_line do |line|
+        # See https://github.com/CSNW/gnupg/blob/master/doc/DETAILS
+        # Index  Content
+        #   0    record type
+        #   6    expiration date
+        #
+        # If expiration date contains a 'T', it is in an ISO 8601 format
+        # (e.g., 20210223T091500). Otherwise it is seconds since the epoch.
+        #
+        fields = line.split(':')
+        if fields[0] && (fields[0] == 'pub')
+          raw_exp_date = fields[6]
+          unless raw_exp_date.nil? || raw_exp_date.strip.empty?
+            require 'date'
+
+            exp_date = nil
+            if raw_exp_date.include?('T')
+              exp_date = DateTime.parse(raw_exp_date).to_date
+            else
+              exp_date = Time.at(raw_exp_date.to_i).to_date
+            end
+
+            days_left = (exp_date - Date.today).to_i
+            days_left = 0 if days_left < 0
+          end
+
+          break
+        end
       end
+
       days_left
     end
 
@@ -135,36 +186,18 @@ module Simp
 
         clean_gpg_agent_directory
         write_genkey_parameter_file
-        write_gpg_agent_startup_script
 
+        agent_info = nil
         begin
-          # Start the GPG agent.
-          gpg_agent_output = %x(./#{@gpg_agent_script}).strip
-
-          # Provide a local socket (needed by the `gpg` command when
-          local_socket     = File.join(Dir.pwd, 'S.gpg-agent')
-
-          # This condition was handled differently in previous logic.
-          #
-          #   a.) As the surrounding logic works now, it will _always_ be a new
-          #       agent by this point, because the directory is cleaned out
-          #   b.) The agent's information will be read from the env-file it
-          #        writes at startup
-          #   c.) The old command `gpg-agent --homedir=#{Dir.pwd} /get serverpid`
-          #       did not work on EL6 or EL7.
-          #
-          warn(empty_gpg_agent_message) if gpg_agent_output.empty?
-
-          agent_info = gpg_agent_info
-
-          # The socket is useful to get back info on the command line.
-          unless File.exist?(File.join(Dir.pwd, File.basename(agent_info[:socket])))
-            ln_s(agent_info[:socket], local_socket, :verbose => @verbose)
+          if gpg_version < Gem::Version.new('2.1')
+            agent_info = start_gpg_agent_old
+          else
+            agent_info = start_gpg_agent
           end
-          generate_key(agent_info[:info])
         ensure
-          kill_agent(agent_info[:pid])
+          kill_agent(agent_info[:pid]) if agent_info
         end
+
         agent_info
       end
     end
@@ -174,7 +207,7 @@ module Simp
     #
     # @return [String] Warning message
     def empty_gpg_agent_message
-      <<-WARNING.gsub(/^\s{8}/,'')
+      <<~WARNING
         WARNING: Tried to start an project-only gpg-agent daemon on a random socket by
                  running the script:
 
@@ -195,7 +228,6 @@ module Simp
     #
     # @param pid [String] The GPG Agent PID to kill
     def kill_agent(pid)
-      rm('S.gpg-agent') if File.symlink?('S.gpg-agent')
       if pid
         Process.kill(0, pid)
         Process.kill(15, pid)
@@ -209,11 +241,18 @@ module Simp
     # @param gpg_agent_info_str [String] value to set the GPG_AGENT_INFO
     #   environment variable to use in order to use the correct `gpg-agent`.
     def generate_key(gpg_agent_info_str)
+      which('gpg', true)
+
       puts "Generating new GPG key#{@verbose ? " under '#{@dir}'" : ''}..."
       gpg_cmd = %(GPG_AGENT_INFO=#{gpg_agent_info_str} gpg --homedir="#{@dir}")
+
       pipe    = @verbose ? '| tee' : '>'
-      sh %(#{gpg_cmd} --batch --gen-key #{GPG_GENKEY_PARAMS_FILENAME})
-      sh %(#{gpg_cmd} --armor --export #{@key_email} #{pipe} "#{@key_file}")
+      %x(#{gpg_cmd} --batch --gen-key #{GPG_GENKEY_PARAMS_FILENAME})
+      %x(#{gpg_cmd} --armor --export '<#{@key_email}>' #{pipe} "#{@key_file}")
+
+      if File.stat(@key_file).size == 0
+        fail "Error: Something went wrong generating #{@key_file}"
+      end
     end
 
     # Return a data structure from a gpg-agent env-file formatted string.
@@ -225,6 +264,62 @@ module Simp
       { info: info.strip, socket: matches[:socket], pid: matches[:pid].to_i }
     end
 
+    # Start the gpg-agent
+    # @return Hash of agent info
+    # @raise if gpg-agent fails to start
+    def start_gpg_agent
+      which('gpg', true)
+      which('gpg-agent', true)
+      which('gpg-connect-agent', true)
+
+      # Start the GPG agent, if it is not already running
+      check_agent = "gpg-agent -q --homedir=#{Dir.pwd} >&/dev/null"
+      start_agent = "gpg-agent --homedir=#{Dir.pwd} --daemon >&/dev/null"
+      cmd = "#{check_agent} || #{start_agent}"
+      puts "Executing: #{cmd}" if @verbose
+      %x(#{cmd})
+      if $? && ($?.exitstatus != 0)
+        err_msg = [
+          'Failed to start gpg-agent during key creation.',
+          "  Execute '#{start_agent.gsub(' >&/dev/null','')}' to debug."
+        ].join("\n")
+        raise(err_msg)
+      end
+
+      agent_info = {}
+
+      # Provide a local socket (needed by the `gpg` command when
+      agent_info[:socket] = %x{echo 'GETINFO socket_name' | gpg-connect-agent --homedir=#{Dir.pwd}}.lines.first[1..-1].strip
+
+      # Get the pid
+      agent_info[:pid] = %x{echo 'GETINFO pid' | gpg-connect-agent --homedir=#{Dir.pwd}}.lines.first[1..-1].strip.to_i
+
+      generate_key(%{#{agent_info[:socket]}:#{agent_info[:pid]}:1})
+
+      agent_info
+    end
+
+    # Start the gpg-agent with options suitable for gpg version < 2.1
+    # @return Hash of agent info
+    def start_gpg_agent_old
+      write_gpg_agent_startup_script
+      gpg_agent_output = %x(./#{@gpg_agent_script}).strip
+
+      # By the time we get here, we can be assured we will be starting a
+      # new agent, because the directory is cleaned out.
+      #
+      # Follow-on gpg actions will read the agent's information from
+      # the env-file the agent writes at startup.
+
+      # We're using the --sh option which will spew out the agent config
+      # when the agent starts. If it is empty, this is a problem.
+      warn(empty_gpg_agent_message) if gpg_agent_output.empty?
+
+      agent_info = gpg_agent_info
+      generate_key(agent_info[:info])
+      agent_info
+    end
+
     # Write the `gpg --genkey --batch` control parameter file
     #
     # @see "Unattended key generation" in /usr/share/doc/gnupg2-*/DETAILS for
@@ -232,38 +327,46 @@ module Simp
     def write_genkey_parameter_file
       now               = Time.now.to_i.to_s
       expire_date       = Date.today + 14
-      passphrase        = SecureRandom.base64(500)
-      genkey_parameters = <<-GENKEY_PARAMETERS.gsub(%r{^ {8}}, '')
-        %echo Generating Development GPG Key
-        %echo
-        %echo This key will expire on #{expire_date}
-        %echo
-        Key-Type: RSA
-        Key-Length: 4096
-        Key-Usage: sign
-        Name-Real: SIMP Development
-        Name-Comment: Development key #{now}
-        Name-Email: #{@key_email}
-        Expire-Date: 2w
-        Passphrase: #{passphrase}
-        %pubring pubring.gpg
-        %secring secring.gpg
-        # The following creates the key, so we can print "Done!" afterwards
-        %commit
-        %echo New GPG Development Key Created
-      GENKEY_PARAMETERS
-      File.open(GPG_GENKEY_PARAMS_FILENAME, 'w') { |fh| fh.puts(genkey_parameters) }
+      passphrase        = SecureRandom.base64(100)
+      genkey_parameters = [
+        '%echo Generating Development GPG Key',
+        '%echo',
+        "%echo This key will expire on #{expire_date}",
+        '%echo',
+        'Key-Type: RSA',
+        'Key-Length: 4096',
+        'Key-Usage: sign',
+        'Name-Real: SIMP Development',
+        "Name-Comment: Development key #{now}",
+        "Name-Email: #{@key_email}",
+        'Expire-Date: 2w',
+        "Passphrase: #{passphrase}",
+      ]
+
+      if gpg_version < Gem::Version.new('2.1')
+        genkey_parameters << '%pubring pubring.gpg'
+        genkey_parameters << '%secring secring.gpg'
+      end
+
+      genkey_parameters << '# The following creates the key, so we can print "Done!" afterwards'
+      genkey_parameters << '%commit'
+      genkey_parameters << '%echo New GPG Development Key Created'
+
+      File.open(GPG_GENKEY_PARAMS_FILENAME, 'w') { |fh| fh.puts(genkey_parameters.join("\n")) }
     end
 
     # Write a local gpg-agent daemon script file
     def write_gpg_agent_startup_script
-      gpg_agent_script = <<-AGENT_SCRIPT.gsub(%r{^ {20}}, '')
+      which('gpg-agent', true)
+      pinentry_cmd = which('pinentry-curses', true)
+
+      gpg_agent_script = <<~AGENT_SCRIPT
         #!/bin/sh
 
         gpg-agent --homedir=#{Dir.pwd} --daemon \
           --no-use-standard-socket --sh --batch \
           --write-env-file "#{@gpg_agent_env_file}" \
-          --pinentry-program /usr/bin/pinentry-curses < /dev/null &
+          --pinentry-program #{pinentry_cmd} < /dev/null &
       AGENT_SCRIPT
 
       File.open(@gpg_agent_script, 'w') { |fh| fh.puts(gpg_agent_script) }