bundlewrap 5.0.2__tar.gz → 5.1.0__tar.gz

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/AUTHORS

@@ -13,3 +13,4 @@ Simon Brielbeck <simon.brielbeck@seibert.group>
 Peter Körner <git@mazdermind.de>
 Manuel Domke <manuel-domke@gmx.org>
 Sophie Schiller <sophie.schiller@seibert.group>
+Max Jäger <xje4@xje4.eu>

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/CHANGELOG.md

@@ -1,3 +1,21 @@
+# 5.1.0
+
+2026-06-18
+
+* added [new hooks](https://docs.bundlewrap.org/repo/hooks/) `repo_init` and `secret_key_use`
+* added `bw apply --add-lock-for-fixed-items` to automatically lock all items that were changed during an apply
+* `BUNDLE_DIR` and `BUNDLE_DATA_DIR` are now available as variables inside bundles
+* fixed triggers, items can now trigger `tag:foo` or any other valid [item selector](https://docs.bundlewrap.org/guide/selectors/)
+* fixed `svc_systemd` items so masking happens only after disabling (and unmasking before enabling); the previous order left orphaned `.wants` symlinks and broke units with `Also=` dependencies such as `NetworkManager`
+* fixed `kubernetes` items so `delete: True` works on its own without requiring `manifest` or `apiVersion`
+* fixed `PathInfo` so `OpenSSH ECDSA public key` is also recognized as text
+
+# 5.0.3
+
+2026-03-17
+
+* `as_htpasswd_entry()` of `Fault` objects now supports the argument `cost=...` (defaults to `12`) to set the bcrypt Cost Factor. The default value was found to be too expensive for some webserver deployments.
+
 # 5.0.2
 
 2026-02-25

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bundlewrap
-Version: 5.0.2
+Version: 5.1.0
 Summary: Config management with Python
 Home-page: http://bundlewrap.org
 Author: Torsten Rehn

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/__init__.py

@@ -1,2 +1,2 @@
-VERSION = (5, 0, 2)
+VERSION = (5, 1, 0)
 VERSION_STRING = ".".join([str(v) for v in VERSION])

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/bundle.py

@@ -86,6 +86,8 @@ class Bundle:
             base_env = {
                 'node': self.node,
                 'repo': self.repo,
+                'BUNDLE_DIR': self.bundle_dir,
+                'BUNDLE_DATA_DIR': self.bundle_data_dir,
             }
 
             # TODO prevent access to node.metadata
@@ -103,6 +105,8 @@ class Bundle:
             base_env = {
                 'node': self.node,
                 'repo': self.repo,
+                'BUNDLE_DIR': self.bundle_dir,
+                'BUNDLE_DATA_DIR': self.bundle_data_dir,
             }
             for item_class in self.repo.item_classes:
                 base_env[item_class.BUNDLE_ATTRIBUTE_NAME] = {}

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/cmdline/apply.py

@@ -72,6 +72,8 @@ def bw_apply(repo, args):
                 'show_skipped_items': args['show_skipped_items'],
                 'skip_list': skip_list,
                 'workers': args['item_workers'],
+                'add_lock_for_fixed_items': bool(args['expiry']),
+                'lock_expiry': args['expiry'],
             },
         }
 

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/cmdline/parser.py

@@ -221,6 +221,15 @@ bundle:my_bundle  # items in this bundle
         metavar=_("PATH"),
         type=str,
     )
+    parser_apply.add_argument(
+        "--add-lock-for-fixed-items",
+        default="",
+        const=DEFAULT_softlock_expiry,
+        nargs='?',
+        dest='expiry',
+        help=HELP_softlock_expiry,
+        type=str,
+    )
 
     # bw debug
     help_debug = _("Start an interactive Python shell for this repository")

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/itemqueue.py

@@ -1,10 +1,10 @@
 from collections import defaultdict
 
 from .deps import (
-    find_item,
     prepare_dependencies,
     remove_item_dependents,
     remove_dep_from_items,
+    resolve_selector,
     split_items_without_deps,
 )
 from .exceptions import NoSuchItem, MetadataUnavailable
@@ -142,12 +142,9 @@ class ItemQueue(BaseQueue):
     def _fire_triggers_for_item(self, item):
         for triggered_item_id in item.triggers:
             try:
-                triggered_item = find_item(
-                    triggered_item_id,
-                    self.all_items,
-                )
-                triggered_item.has_been_triggered = True
-            except NoSuchItem:
+                for triggered_item in resolve_selector(triggered_item_id, self.all_items):
+                    triggered_item.has_been_triggered = True
+            except (NoSuchItem, ValueError):
                 io.debug(_(
                     "{item} tried to trigger {triggered_item}, "
                     "but it wasn't available. It must have been skipped previously."

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/items/kubernetes.py

@@ -206,11 +206,16 @@ class KubernetesItem(Item, metaclass=ABCMeta):
     def validate_attributes(cls, bundle, item_id, attributes):
         if attributes.get('delete', False):
             for attr in attributes.keys():
-                if attr not in ['delete'] + list(BUILTIN_ITEM_ATTRIBUTES.keys()):
-                    raise BundleError(_(
-                        "{item} from bundle '{bundle}' cannot have other "
-                        "attributes besides 'delete'"
-                    ).format(item=item_id, bundle=bundle.name))
+                if attr in ['delete'] + list(BUILTIN_ITEM_ATTRIBUTES.keys()):
+                    continue
+
+                if attr == 'manifest' and set(attributes['manifest'].keys()) == {'apiVersion'}:
+                    continue
+
+                raise BundleError(_(
+                    "{item} from bundle '{bundle}' cannot have other "
+                    "attributes besides 'delete' and 'manifest/apiVersion'"
+                ).format(item=item_id, bundle=bundle.name))
         if attributes.get('manifest') and attributes.get('manifest_file'):
             raise BundleError(_(
                 "{item} from bundle '{bundle}' cannot have both 'manifest' and 'manifest_file'"

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/items/svc_systemd.py

@@ -87,11 +87,8 @@ class SvcSystemd(Item):
         return state
 
     def fix(self, status):
-        if 'masked' in status.keys_to_fix:
-            if self.attributes['masked']:
-                svc_mask(self.node, self.name)
-            else:
-                svc_unmask(self.node, self.name)
+        if 'masked' in status.keys_to_fix and not self.attributes['masked']:
+            svc_unmask(self.node, self.name)
 
         if 'enabled' in status.keys_to_fix:
             if self.attributes['enabled']:
@@ -105,6 +102,9 @@ class SvcSystemd(Item):
             else:
                 svc_stop(self.node, self.name)
 
+        if 'masked' in status.keys_to_fix and self.attributes['masked']:
+            svc_mask(self.node, self.name)
+
     def get_canned_actions(self):
         return {
             'stop': {

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/node.py

@@ -26,7 +26,7 @@ from .exceptions import (
 from .group import GROUP_ATTR_DEFAULTS, GROUP_ATTR_TYPES, GROUP_ATTR_TYPES_ENFORCED
 from .itemqueue import ItemQueue
 from .items import Item
-from .lock import NodeLock
+from .lock import NodeLock, softlock_add
 from .metadata import hash_metadata
 from .utils import (
     cached_property,
@@ -55,6 +55,7 @@ from .utils.text import (
     green,
     mark_for_translation as _,
     prefix_lines,
+    randstr,
     red,
     toml_clean,
     validate_name,
@@ -739,6 +740,8 @@ class Node:
         show_skipped_items=True,
         skip_list=(),
         workers=4,
+        add_lock_for_fixed_items=False,
+        lock_expiry="8h",
     ):
         if not list(self.items):
             io.stdout(_("{x} {node}  has no items").format(
@@ -801,6 +804,23 @@ class Node:
                         show_diff=show_diff,
                         show_skipped_items=show_skipped_items,
                     )
+
+                    if add_lock_for_fixed_items:
+                        items_to_lock = set()
+
+                        for item in item_results:
+                            item_id, status_code, _duration = item
+                            if status_code in (Item.STATUS_FIXED, Item.STATUS_ACTION_SUCCEEDED):
+                                items_to_lock.add(item_id)
+
+                        if items_to_lock:
+                            lock_id = "APPLY_" + randstr(length=4).upper()
+                            softlock_add(
+                                self,
+                                lock_id,
+                                item_selectors=sorted(items_to_lock),
+                                expiry=lock_expiry,
+                            )
             except NodeLockedException as e:
                 if not interactive:
                     io.stderr(_(

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/repo.py

@@ -17,7 +17,7 @@ if version_info >= VERSION_NEW_PACKAGING:
 else:
     from pkg_resources import DistributionNotFound, require, VersionConflict  # needs setuptools
 
-from . import items, VERSION_STRING
+from . import items, VERSION, VERSION_STRING
 from .bundle import FILENAME_ITEMS
 from .exceptions import (
     NoSuchGroup,
@@ -68,8 +68,10 @@ HOOK_EVENTS = (
     'node_apply_start',
     'node_run_end',
     'node_run_start',
+    'repo_init',
     'run_end',
     'run_start',
+    'secret_key_use',
     'test',
     'test_node',
 )
@@ -178,7 +180,7 @@ class HooksProxy:
 
     def __getattr__(self, attrname):
         if attrname not in HOOK_EVENTS:
-            raise AttributeError
+            raise AttributeError(attrname)
 
         if self.__registered_hooks is None:
             self._register_hooks()
@@ -289,6 +291,12 @@ class Repository(MetadataGenerator):
             else:
                 self.item_classes = list(self.items_from_dir(items.__path__[0]))
 
+        self.hooks.repo_init(
+            repo=self,
+            version_string=VERSION_STRING,
+            version_tuple=VERSION,
+        )
+
     def __eq__(self, other):
         if self.path == "/dev/null":
             # in-memory repos are never equal

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/secrets.py

@@ -6,6 +6,7 @@ from os import environ
 from os.path import join
 from string import ascii_letters, punctuation, digits
 from subprocess import PIPE, run
+from threading import Lock
 
 from cryptography.fernet import Fernet
 
@@ -70,6 +71,20 @@ class SecretProxy:
     def __init__(self, repo):
         self.repo = repo
         self.keys = self._load_keys()
+        self.key_hook_lock = Lock()
+        self.key_hook_in_use = {}
+
+    def __hook(self, key):
+        with self.key_hook_lock:
+            if key not in self.key_hook_in_use:
+                self.key_hook_in_use[key] = Lock()
+        if self.key_hook_in_use[key].locked():
+           return
+        with self.key_hook_in_use[key]:
+            self.repo.hooks.secret_key_use(
+                repo=self.repo,
+                key=key,
+            )
 
     def _decrypt(self, cryptotext=None, key=None):
         """
@@ -78,7 +93,8 @@ class SecretProxy:
         if environ.get("BW_VAULT_DUMMY_MODE", "0") != "0":
             return "decrypted text"
 
-        key, cryptotext = self._determine_key_to_use(cryptotext.encode('utf-8'), key, cryptotext)
+        key, key_name, cryptotext = self._determine_key_to_use(cryptotext.encode('utf-8'), key, cryptotext)
+        self.__hook(key_name)
         return Fernet(key).decrypt(cryptotext).decode('utf-8')
 
     def _decrypt_file(self, source_path=None, binary=False, key=None):
@@ -90,7 +106,8 @@ class SecretProxy:
             return "decrypted file"
 
         cryptotext = get_file_contents(join(self.repo.data_dir, source_path))
-        key, cryptotext = self._determine_key_to_use(cryptotext, key, source_path)
+        key, key_name, cryptotext = self._determine_key_to_use(cryptotext, key, source_path)
+        self.__hook(key_name)
 
         f = Fernet(key)
         if binary:
@@ -107,12 +124,13 @@ class SecretProxy:
             return b64encode(b"decrypted file as base64").decode('utf-8')
 
         cryptotext = get_file_contents(join(self.repo.data_dir, source_path))
-        key, cryptotext = self._determine_key_to_use(cryptotext, key, source_path)
+        key, key_name, cryptotext = self._determine_key_to_use(cryptotext, key, source_path)
+        self.__hook(key_name)
 
         f = Fernet(key)
         return b64encode(f.decrypt(cryptotext)).decode('utf-8')
 
-    def _determine_key_to_use(self, cryptotext, key, entity_description):
+    def _determine_key_to_use(self, cryptotext, key_name, entity_description):
         key_delim = cryptotext.find(b'$')
         if key_delim > -1:
             key_from_text = cryptotext[:key_delim].decode('utf-8')
@@ -120,14 +138,15 @@ class SecretProxy:
         else:
             key_from_text = None
 
-        if key is None:
+        if key_name is None:
             if key_from_text is not None:
-                key = key_from_text
+                key_name = key_from_text
             else:
-                key = 'encrypt'
+                key_name = 'encrypt'
 
+        key = None
         try:
-            key = self.keys[key]
+            key = self.keys[key_name]
         except KeyError:
             raise FaultUnavailable(_(
                 "Key '{key}' not available for decryption of the following entity, "
@@ -138,7 +157,7 @@ class SecretProxy:
                 entity_description=entity_description,
             ))
 
-        return key, cryptotext
+        return key, key_name, cryptotext
 
     def _generate_human_password(
         self, identifier=None, digits=2, key='generate', per_word=3, words=4,
@@ -159,6 +178,8 @@ class SecretProxy:
         if environ.get("BW_VAULT_DUMMY_MODE", "0") != "0":
             return "generatedpassword"
 
+        self.__hook(key)
+
         prng = self._get_prng(identifier, key)
 
         pwd = ""
@@ -208,6 +229,8 @@ class SecretProxy:
         if environ.get("BW_VAULT_DUMMY_MODE", "0") != "0":
             return ("generatedpassword"*length)[:length]
 
+        self.__hook(key)
+
         prng = self._get_prng(identifier, key)
 
         alphabet = ascii_letters + digits
@@ -220,6 +243,8 @@ class SecretProxy:
         if environ.get("BW_VAULT_DUMMY_MODE", "0") != "0":
             return b64encode(bytearray([ord("a") for i in range(length)])).decode()
 
+        self.__hook(key)
+
         prng = self._get_prng(identifier, key)
         return b64encode(bytearray([next(prng) for i in range(length)])).decode()
 

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/utils/__init__.py

@@ -190,7 +190,7 @@ class Fault:
             return format_string.format(self.value)
         return Fault(self.id_list + ['format_into ' + format_string], callback)
 
-    def as_htpasswd_entry(self, username):
+    def as_htpasswd_entry(self, username, cost=None):
         def callback():
             # bcrypt demands to have a salt (16 random bytes, encoded
             # with a special `b64encode_bcrypt()` function).
@@ -227,7 +227,7 @@ class Fault:
 
             return '{}:{}'.format(
                 username,
-                bcrypt(self.value, salt=salt),
+                bcrypt(self.value, cost=cost, salt=salt),
             )
         return Fault(self.id_list + ['as_htpasswd_entry ' + username], callback)
 

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/utils/crypto.py

@@ -32,7 +32,7 @@ def b64encode_bcrypt(payload_bytes):
 def bcrypt(
     payload,
     encoding='UTF-8',
-    cost=_DEFAULT_BCRYPT_COST,
+    cost=None,
     salt=None,
 ):
     """
@@ -42,10 +42,13 @@ def bcrypt(
     servers.
 
     -   `encoding`: `payload` will be encoded using this encoding.
-    -   `cost`: Use this cost factor instead of bcrypt's default.
-    -   `salt`: Must be a valid bcrypt salt.
+    -   `cost`: Use this cost factor, or `None` for bcrypt's default.
+    -   `salt`: Must be a valid bcrypt salt, or `None` for bcrypt's default.
     """
 
+    if cost is None:
+        cost = _DEFAULT_BCRYPT_COST
+
     if salt is None:
         salt = _DEFAULT_BCRYPT_SALT
 

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap/utils/remote.py

@@ -82,6 +82,7 @@ class PathInfo:
             self.desc in (
                 "empty",
                 "JSON data",
+                "OpenSSH ECDSA public key",
                 "OpenSSH ED25519 public key",
                 "OpenSSH RSA public key",
                 "OpenSSH DSA public key",

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/bundlewrap.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bundlewrap
-Version: 5.0.2
+Version: 5.1.0
 Summary: Config management with Python
 Home-page: http://bundlewrap.org
 Author: Torsten Rehn

{bundlewrap-5.0.2 → bundlewrap-5.1.0}/setup.py

@@ -2,7 +2,7 @@ from setuptools import find_packages, setup
 
 setup(
     name="bundlewrap",
-    version="5.0.2",
+    version="5.1.0",
     description="Config management with Python",
     long_description=(
         "By allowing for easy and low-overhead config management, BundleWrap fills the gap between complex deployments using Chef or Puppet and old school system administration over SSH.\n"