simp-rake-helpers 5.11.6 → 5.12.0

data/spec/acceptance/files/testpackage/README

@@ -0,0 +1,8 @@
+The following scripts with problematic shebangs have their execute bits set in
+order to trigger the brp-mangle-shebangs script during an RPM build in EL8:
+
+* spec/classes/init_spec.rb:    #!/usr/bin/env rspec => #!/usr/bin/rspec
+* spec/files/mock_something.rb: #!/usr/bin/env ruby  => #!/usr/bin/ruby
+* utils/convert_v1_to_v2.rb:    #!/usr/bin/env ruby  => #!/usr/bin/ruby
+
+*** Do not change their execute bits in Git! ***

data/spec/acceptance/files/testpackage/spec/classes/init_spec.rb

@@ -0,0 +1 @@
+#!/usr/bin/env rspec

data/spec/acceptance/files/testpackage/spec/files/mock_something.rb

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+#This is a mock executable for something
+puts 'hello world'

data/spec/acceptance/files/testpackage/utils/convert_v1_to_v2.rb

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+# convert from version 1 to version 2
+puts "Running #{File.basename(__FILE__)}"

data/spec/acceptance/nodesets/default.yml

@@ -29,11 +29,24 @@ CONFIG:
     password: root
     auth_methods:
       - password
+  docker_preserve_image: true
+  # This is necessary for pretty much all containers
   docker_cap_add:
     - AUDIT_WRITE
-  docker_preserve_image: true
   mount_folders:
     host_files:
       host_path: ./
       container_path: /host_files
-      opts: 'z'
+  # All items below this point are required for systemd
+    cgroup:
+      host_path: /sys/fs/cgroup
+      container_path: /sys/fs/cgroup
+      opts: 'ro'
+  dockeropts:
+    HostConfig:
+      Tmpfs:
+        '/run': 'rw,noexec,nosuid,nodev,size=65536k'
+        '/run/lock': 'rw,noexec,nosuid,nodev,size=65536k'
+        '/tmp': 'rw,exec,nosuid,nodev,size=65536k'
+        '/sys/fs/cgroup/systemd': 'rw,size=65536k'
+        '/var/log/journal': 'rw,noexec,nodev,nosuid,size=65536k'

data/spec/acceptance/support/build_project_helpers.rb

@@ -57,16 +57,40 @@ module Simp::BeakerHelpers::SimpRakeHelpers::BuildProjectHelpers
   # Scans a host path for the 'SIMP Development' GPG key and returns its Key ID
   #
   # @param [Host, String, Symbol] host Beaker host
-  # @param [Hash{Symbol=>String}] opts Beaker options Hash for `#on` ({})
-  # @param [String] proj_dir Absolute path to the parent project directory
+  # @param [String] key_dir Absolute path to GPG key dir
   # @param [Hash{Symbol=>String}] opts Beaker options Hash for `#on` ({})
   # @return [String] GPG dev signing Key ID
   #
-  def dev_signing_key_id(host, proj_dir, opts = {})
-    key_dir = distribution_dir(host, proj_dir, opts) + '/build_keys/dev'
-    res = on(host, %(#{run_cmd} "gpg --list-keys --fingerprint --homedir='#{key_dir}' 'SIMP Development'"))
-    lines = res.stdout.lines.select { |x| x =~ %r{Key fingerprint =} }
-    raise "No 'SIMP Development' GPG keys found under ''" if lines.empty?
-    lines.first.strip.split(%r{\s+})[-4..-1].join.downcase
+  def dev_signing_key_id(host, key_dir, opts = {})
+    # NOTE: This search uses a substring match on 'SIMP Development'.
+    res = on(host, %(#{run_cmd} "gpg --with-colons --fingerprint --homedir='#{key_dir}' 'SIMP Development'"), opts)
+    pub_lines = res.stdout.lines.select { |x| x.start_with?('pub') }
+    raise "No 'SIMP Development' GPG keys found in '#{key_dir}'" if pub_lines.empty?
+    pub_lines.first.split(':')[4].downcase
+  end
+
+  # Returns true when a gpg-agent daemon using the specified GPG home directory
+  # (aka key directory) is running.
+  #
+  # @param [Host, String, Symbol] host Beaker host
+  # @param [String] gpg_homedir Absolute path to GPG home dir
+  def gpg_agent_running?(host, gpg_homedir)
+
+    # This check is being used in tests to verify no gpg-agent for gpg_homedir
+    # is running.  On slow VMs, the gpg-agent can take some time to shutdown.
+    # So wait up to 20 seconds for gpg-agent to shutdown before finalizing
+    # gpg-agent status to be reported.
+
+    retries = 20
+    agent_exists = true
+    while (agent_exists || (retries > 0))
+      result = on(host, "pgrep -c -f 'gpg-agent.*homedir.*#{gpg_homedir}'", :accept_all_exit_codes => true)
+      agent_exists  = (result.stdout.strip != '0')
+      break unless agent_exists
+      sleep 1
+      retries -= 1
+    end
+
+    agent_exists
   end
 end

data/spec/lib/simp/command_utils_spec.rb

@@ -0,0 +1,29 @@
+require 'simp/command_utils'
+require 'spec_helper'
+
+describe Simp::CommandUtils do
+  RSpec.configure do |c|
+    c.include Simp::CommandUtils
+  end
+
+  describe '.which' do
+    it 'should return location of command that exists' do
+      expect(Facter::Core::Execution).to receive(:which).with('ls').and_return('/usr/bin/ls')
+      expect( which('ls') ).to eq('/usr/bin/ls')
+    end
+
+    it 'should return nil if command does not exist by default' do
+      expect( which('/does/not/exist/command') ).to be nil
+    end
+
+    it 'should fail if command does not exist if fail=true' do
+      expect{ which('/does/not/exist/command', true) }.to raise_error(
+        RuntimeError, /Warning: Command \/does\/not\/exist\/command not found/)
+    end
+
+    it 'should cache commands' do
+      allow(Facter::Core::Execution).to receive(:which).with('ls').and_return('/path1/ls', '/path2/ls')
+      expect( which('ls') ).to eq('/path1/ls')
+    end
+  end
+end

data/spec/lib/simp/local_gpg_signing_key_spec.rb.beaker-only

@@ -1,14 +1,24 @@
 require 'simp/local_gpg_signing_key'
 require 'spec_helper'
 require 'fileutils'
+require 'timeout'
 require 'tmpdir'
 
+
+def get_key_id(keydir, key_email)
+  key_id = nil
+  key_info = `gpg --with-colons --homedir=#{keydir} --list-keys '<#{key_email}>' 2>&1 | grep ^pub:`
+  unless key_info.strip.empty?
+    key_id = key_info.split(':')[4]
+  end
+end
+
 describe Simp::LocalGpgSigningKey do
   include FileUtils
 
   before :all do
     TMP_DIR     = Dir.mktmpdir('spec_test__simp_local_gpg_signing_key')
-    TMP_DEV_DIR = File.join(TMP_DIR, 'dev')
+    TMP_DEV_KEYDIR = File.join(TMP_DIR, 'dev')
     OPTS        = {verbose: ENV['VERBOSE'].to_s =~ /^(yes|true)$/ }
 
     mkdir_p TMP_DIR
@@ -24,9 +34,17 @@ describe Simp::LocalGpgSigningKey do
     ENV['GPG_AGENT_INFO'] = ORIGINAL_GPG_AGENT_INFO
   end
 
+  let(:gpg_keydir) { TMP_DEV_KEYDIR }
+  let(:gpg_email_name) { 'gatekeeper@simp.development.key' }
+  let(:opts) { OPTS }
+
   shared_examples_for 'it just generated a local gpg signing key' do
-    it 'creates a local gpg-agent' do
-      expect(agent_info.reject{|x| x.nil?}.keys).to include(:info, :socket, :pid)
+    it 'has the key in the keyring' do
+      expect(get_key_id(gpg_keydir, gpg_email_name)).to_not be_nil
+    end
+
+    it 'had created a local gpg-agent' do
+      expect(agent_info.reject{|x| x.nil?}.keys).to include(:socket, :pid)
     end
 
     it 'had a gpg-agent socket' do
@@ -35,62 +53,141 @@ describe Simp::LocalGpgSigningKey do
     end
 
     it 'has killed the local gpg-agent' do
+      begin
+        # it may take some time for the local gpg-agent to die
+        Timeout::timeout(30) do
+          done = !File.exist?(agent_info[:socket])
+          until(done)
+            sleep(2)
+            done = !File.exist?(agent_info[:socket])
+          end
+        end
+      rescue Timeout::Error
+        puts "agent_info = #{agent_info}"
+        puts "gpg-agent processes running:\n#{`pgrep -f gpg-agent`}"
+      end
+
       expect(File.exist?(agent_info[:socket])).to be false
     end
   end
 
-
   shared_examples_for 'a valid gpg signing key environment' do
-    it 'has a local GPG signing key' do
-      Dir.chdir(TMP_DEV_DIR) { expect(Dir['*']).to include('RPM-GPG-KEY-SIMP-Dev') }
+    it 'has an exported local GPG signing key' do
+      Dir.chdir(gpg_keydir) { expect(Dir['*']).to include('RPM-GPG-KEY-SIMP-Dev') }
     end
 
-    it 'has a populated a gpg-agent directory' do
-      Dir.chdir(TMP_DEV_DIR) do |_dir|
-        expect(Dir['*'].sort).to include(
-          'gengpgkey',
-          'pubring.gpg',
-        )
-      end
+    it 'has a keygen params file with info required for package signing' do
+      params_file = File.join(gpg_keydir, 'gengpgkey')
+      expect(File.exist?(params_file)).to be true
+
+      content = File.read(params_file)
+      expect(content).to match(/^Passphrase: .*$/)
+      expect(content).to match(/^Name-Email: #{gpg_email_name}$/)
     end
   end
 
   shared_examples_for 'it encountered an unexpired local gpg signing key' do
     it 'reuses an unexpired local gpg signing key' do
-      expect{described_class.new(TMP_DEV_DIR,OPTS).ensure_key}.to output(
+      expect{described_class.new(gpg_keydir,opts).ensure_key}.to output(
         /^GPG key \(gatekeeper@simp\.development\.key\) will expire in 14 days\./
       ).to_stdout
+
+      expect(get_key_id(gpg_keydir, gpg_email_name)).to eq original_key_id
     end
 
     it 'reuses an unexpired local gpg signing key' do
-      expect{described_class.new(TMP_DEV_DIR,OPTS).ensure_key}.to output(
+      expect{described_class.new(gpg_keydir,opts).ensure_key}.to output(
         /^GPG key \(gatekeeper@simp\.development\.key\) will expire in 14 days\./
       ).to_stdout
+
+      expect(get_key_id(gpg_keydir, gpg_email_name)).to eq original_key_id
     end
   end
 
   context '#ensure_key' do
     before :all do
-      rm_rf   TMP_DEV_DIR
+      rm_rf   TMP_DEV_KEYDIR
       ENV['GPG_AGENT_INFO'] = nil
     end
 
+
     context 'when run from scratch' do
       before :all do
-        FIRST_RUN_AGENT_INFO  = described_class.new(TMP_DEV_DIR,OPTS).ensure_key
+        FIRST_RUN_AGENT_INFO  = described_class.new(TMP_DEV_KEYDIR,OPTS).ensure_key
       end
+
       let(:agent_info){ FIRST_RUN_AGENT_INFO }
+
       it_behaves_like 'it just generated a local gpg signing key'
       it_behaves_like 'a valid gpg signing key environment'
     end
 
     context 'when run again' do
       before :all do
-        SECOND_RUN_AGENT_INFO = described_class.new(TMP_DEV_DIR,OPTS).ensure_key
+        SECOND_RUN_AGENT_INFO = described_class.new(TMP_DEV_KEYDIR,OPTS).ensure_key
       end
+
       let(:agent_info){ SECOND_RUN_AGENT_INFO }
+      let(:original_key_id) { get_key_id(gpg_keydir, gpg_email_name) }
+
       it_behaves_like 'it encountered an unexpired local gpg signing key'
       it_behaves_like 'a valid gpg signing key environment'
     end
   end
+
+  context '#gpg_agent_info' do
+    before :all do
+      rm_rf   TMP_DEV_KEYDIR
+    end
+
+    # other use cases already tested in ensure_key tests
+    it 'returns nil when no gpg agent env file exists' do
+      expect(described_class.new(gpg_keydir,opts).gpg_agent_info).to be_nil
+    end
+  end
+
+  context '#dev_key_days_left' do
+    before :all do
+      rm_rf   TMP_DEV_KEYDIR
+    end
+
+    let(:gpg_cmd) {  "gpg --with-colons --homedir=#{gpg_keydir} --list-keys '<#{gpg_email_name}>' 2>&1" }
+
+    it 'returns 0 when key is not found' do
+      expect(described_class.new(gpg_keydir,opts).dev_key_days_left).to eq 0
+    end
+
+    it 'returns 0 when key is expired' do
+      generator = described_class.new(gpg_keydir,opts)
+      output = <<~EOM
+        tru::1:1521838828:0:3:1:5
+        pub:e:4096:1:722B97A808E7DAEA:1521838554:1523048154::-:::sc::::::23::0:
+        fpr:::::::::5DD3E8D45C99780DCA7D0B83722B97A808E7DAEA:
+        uid:e::::1521838554::773C55CA511CCE31244D86D4AB70F6499024695F::SIMP Development (Development key 1521838554) <gatekeeper@simp.development.key>::::::::::0:
+      EOM
+      expect(generator).to receive(:`).with(gpg_cmd).and_return(output)
+
+      expect(generator.dev_key_days_left).to eq 0
+    end
+
+    it 'returns # days left when unexpired key is found with ISO 8601 date' do
+      generator = described_class.new(gpg_keydir,opts)
+
+      require 'date'
+      creation_date = DateTime.now - 5
+      expiration_date = creation_date + 14
+      creation_str = creation_date.iso8601.gsub(/:|-/,'')
+      expiration_str = expiration_date.iso8601.gsub(/:|-/,'')
+
+      output = <<~EOM
+        tru::1:1521838828:0:3:1:5
+        pub:u:4096:1:722B97A808E7DAEA:#{creation_str}:#{expiration_str}::-:::sc::::::23::0:
+        fpr:::::::::5DD3E8D45C99780DCA7D0B83722B97A808E7DAEA:
+        uid:e::::1521838554::773C55CA511CCE31244D86D4AB70F6499024695F::SIMP Development (Development key 1521838554) <gatekeeper@simp.development.key>::::::::::0:
+      EOM
+      expect(generator).to receive(:`).with(gpg_cmd).and_return(output)
+
+      expect(generator.dev_key_days_left).to eq 9
+    end
+  end
 end

data/spec/lib/simp/rake/pupmod/fixtures/simpmod/README.md

@@ -21,7 +21,7 @@
 
 Start with a one- or two-sentence summary of what the module does and/or what
 problem it solves. This is your 30-second elevator pitch for your module.
-Consider including OS and Puppet version compatability, and any other
+Consider including OS and Puppet version compatibility, and any other
 information users will need to quickly assess the module's viability within
 their environment.
 
@@ -33,7 +33,7 @@ management, etc.), this is the time to mention it.
 ### This is a SIMP module
 
 This module is a component of the [System Integrity Management
-Platform](https://github.com/NationalSecurityAgency/SIMP), a
+Platform](https://simp-project.com), a
 compliance-management framework built on Puppet.
 
 If you find any issues, they may be submitted to our [bug

data/spec/lib/simp/rpm_signer_spec.rb

@@ -0,0 +1,98 @@
+require 'simp/rpm_signer'
+require 'spec_helper'
+require 'fileutils'
+require 'tmpdir'
+
+
+describe Simp::RpmSigner do
+
+  before :all do
+    @tmp_dir = Dir.mktmpdir('spec_test__rpm_signer')
+    @gpg_keydir = File.join(@tmp_dir, 'dev')
+  end
+
+  after :all do
+    FileUtils.remove_entry_secure(@tmp_dir)
+  end
+
+  let(:verbose) { ENV['VERBOSE'].to_s =~ /^(yes|true)$/ }
+  let(:gpg_email_name) { 'gatekeeper@simp.development.key' }
+  let(:passphrase) { 'dev_passphrase' }
+  let(:key_id) { '722B97A808E7DAEA' }
+  let(:key_size) { 4096 }
+  let(:key_info) { {
+    :dir      => @gpg_keydir,
+    :name     => gpg_email_name,
+    :key_id   => key_id,
+    :key_size => key_size,
+    :password => passphrase
+  } }
+
+  let(:gpg_cmd) {  "gpg --with-colons --homedir=#{@gpg_keydir} --list-keys '<#{gpg_email_name}>' 2>&1" }
+  let(:key_list_output) { <<~EOM
+        tru::1:1521838828:0:3:1:5
+        pub:e:4096:1:722B97A808E7DAEA:1521838554:1523048154::-:::sc::::::23::0:
+        fpr:::::::::5DD3E8D45C99780DCA7D0B83722B97A808E7DAEA:
+        uid:e::::1521838554::773C55CA511CCE31244D86D4AB70F6499024695F::SIMP Development (Development key 1521838554) <gatekeeper@simp.development.key>::::::::::0:
+      EOM
+  }
+
+  # The bulk of load_key is tested in the acceptance test. These tests are
+  # a few edge cases.
+  context '.load_key' do
+    context 'key info missing from files' do
+      before :each do
+        allow(Simp::RpmSigner).to receive(:which).with('gpg').and_return('/usr/bin/gpg')
+        FileUtils.mkdir_p(@gpg_keydir)
+      end
+
+      after :each do
+        FileUtils.rm_rf(@gpg_keydir)
+        Simp::RpmSigner.clear_gpg_keys_cache
+      end
+
+      it 'should prompt user for key email and passphrase when not in files' do
+        expect($stdin).to receive(:gets).and_return(gpg_email_name, passphrase)
+        expect(Simp::RpmSigner).to receive(:`).with(gpg_cmd).and_return(key_list_output)
+
+        expect(Simp::RpmSigner.load_key(@gpg_keydir, verbose)).to eq (key_info)
+
+        # verifies returning info from the cache, otherwise user would be prompted again
+        # and expectation on $stdin would fail
+        expect(Simp::RpmSigner.load_key(@gpg_keydir, verbose)).to eq (key_info)
+      end
+
+      it "should read the passphrase from the 'password' file" do
+        File.open(File.join(@gpg_keydir, 'password'),'w') { |file| file.puts passphrase }
+        expect($stdin).to receive(:gets).and_return(gpg_email_name)
+        expect(Simp::RpmSigner).to receive(:`).with(gpg_cmd).and_return(key_list_output)
+
+        expect(Simp::RpmSigner.load_key(@gpg_keydir, verbose)).to eq (key_info)
+      end
+    end
+
+    context 'errors' do
+      it 'should fail when gpg does not exist' do
+        expect(Simp::RpmSigner).to receive(:which).with('gpg').and_return(nil)
+        expect { Simp::RpmSigner.load_key(@gpg_keydir, verbose) }.to raise_error(
+          /Cannot sign RPMs without 'gpg'/)
+      end
+
+      it 'should fail when keydir does not exist' do
+        expect(Simp::RpmSigner).to receive(:which).with('gpg').and_return('/usr/bin/gpg')
+        expect { Simp::RpmSigner.load_key(@gpg_keydir, verbose) }.to raise_error(
+          /Could not find GPG keydir/)
+      end
+
+      it 'should fail when key info cannot be retrieved via gpg' do
+        FileUtils.mkdir_p(@gpg_keydir)
+        expect(Simp::RpmSigner).to receive(:which).with('gpg').and_return('/usr/bin/gpg')
+        expect($stdin).to receive(:gets).and_return(gpg_email_name, passphrase)
+        expect(Simp::RpmSigner).to receive(:`).with(gpg_cmd).and_return('')
+
+        expect { Simp::RpmSigner.load_key(@gpg_keydir, verbose) }.to raise_error(
+          /Error getting GPG key ID or Key size metadata/)
+      end
+    end
+  end
+end