Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed #403 - Guard new GPG key from being downloaded always #404

Merged
merged 4 commits into from Feb 21, 2017
Merged

Fixed #403 - Guard new GPG key from being downloaded always #404

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a29d4f7
Fixed #403 - Guard new GPG key from being downloaded always
iancward Feb 13, 2017
f38f0df
Fix repo name in previous commit
iancward Feb 13, 2017
bc60110
reinstate CentOS 5 spec for repo, because TLS1.2
iancward Feb 16, 2017
ea1c21d
Fixed indentation on previous commit
iancward Feb 16, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 3 additions & 2 deletions recipes/repository.rb
View file
Open in desktop
Expand Up @@ -56,14 +56,15 @@
remote_file 'DATADOG_RPM_KEY_E09422B3.public' do
path key_local_path
source node['datadog']['yumrepo_gpgkey_new']
not_if 'rpm -q gpg-pubkey-e09422b3' # (key already imported)
notifies :run, 'execute[rpm-import datadog key e09422b3]', :immediately
end

# Import key if fingerprint matches
execute 'rpm-import datadog key e09422b3' do
command "rpm --import #{key_local_path}"
not_if 'rpm -q gpg-pubkey-e09422b3' # (key already imported)
only_if "gpg --dry-run --quiet --with-fingerprint #{key_local_path} | grep 'A4C0 B90D 7443 CF6E 4E8A A341 F106 8E14 E094 22B3'"
action :run
action :nothing
end
end

Expand Down
53 changes: 13 additions & 40 deletions spec/dd-agent_spec.rb
View file
Open in desktop
Expand Up @@ -21,36 +21,9 @@ def set_env_var(name, value)
end
end

shared_examples_for 'debianoids repo' do
it 'installs new apt key' do
expect(chef_run).to run_execute('apt-key import key 382E94DE').with(
command: 'apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 A2923DFF56EDA6E76E55E492D3A80E30382E94DE'
)
end

it 'sets up an apt repo' do
expect(chef_run).to add_apt_repository('datadog')
end

it 'installs apt-transport-https' do
expect(chef_run).to install_package('apt-transport-https')
end
end

shared_examples_for 'rhellions repo' do
it 'installs gnupg' do
expect(chef_run).to install_package('gnupg')
end

it 'downloads and imports the new RPM key' do
expect(chef_run).to create_remote_file('DATADOG_RPM_KEY_E09422B3.public').with(path: '/var/chef/cache/DATADOG_RPM_KEY_E09422B3.public')
expect(chef_run).to run_execute('rpm-import datadog key e09422b3').with(
command: 'rpm --import /var/chef/cache/DATADOG_RPM_KEY_E09422B3.public'
)
end

it 'sets up a yum repo' do
expect(chef_run).to create_yum_repository('datadog')
shared_examples_for 'repo recipe' do
it 'includes the repository recipe' do
expect(chef_run).to include_recipe('datadog::repository')
end
end

Expand Down Expand Up @@ -91,7 +64,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'debianoids repo'
it_behaves_like 'repo recipe'
it_behaves_like 'debianoids no version set'
end

Expand All @@ -106,7 +79,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'debianoids repo'
it_behaves_like 'repo recipe'
it_behaves_like 'debianoids no version set'
end

Expand All @@ -121,7 +94,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'debianoids repo'
it_behaves_like 'repo recipe'
it_behaves_like 'debianoids no version set'
end

Expand All @@ -136,7 +109,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'rhellions repo'
it_behaves_like 'repo recipe'
it_behaves_like 'rhellions no version set'
end

Expand All @@ -151,7 +124,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'rhellions repo'
it_behaves_like 'repo recipe'
it_behaves_like 'rhellions no version set'
end

Expand All @@ -166,7 +139,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'rhellions repo'
it_behaves_like 'repo recipe'
it_behaves_like 'rhellions no version set'
end

Expand Down Expand Up @@ -200,7 +173,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'debianoids repo'
it_behaves_like 'repo recipe'
it_behaves_like 'debianoids no version set'
end

Expand All @@ -218,7 +191,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'debianoids repo'
it_behaves_like 'repo recipe'
it_behaves_like 'version set below 4.x'
end

Expand Down Expand Up @@ -381,7 +354,7 @@ def set_env_var(name, value)
end.converge described_recipe
end

it_behaves_like 'debianoids repo'
it_behaves_like 'repo recipe'
it_behaves_like 'debianoids no version set'
end

Expand All @@ -400,7 +373,7 @@ def set_env_var(name, value)
expect(chef_run).to upgrade_apt_package('datadog-agent')
end

it_behaves_like 'debianoids repo'
it_behaves_like 'repo recipe'
end
end

Expand Down
93 changes: 61 additions & 32 deletions spec/repository_spec.rb
View file
Open in desktop
@@ -1,37 +1,66 @@
describe 'datadog::repository' do
context 'on debianoids' do
cached(:chef_run) do
ChefSpec::SoloRunner.new(
platform: 'debian', version: '8.5'
).converge(described_recipe)
end

it 'include apt cookbook' do
expect(chef_run).to include_recipe('apt::default')
end

it 'installs apt-transport-https' do
expect(chef_run).to install_package('apt-transport-https')
end

it 'installs new apt key' do
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

any reason for removing this test on RHEL <= 5?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @olivielpeau I can add it back, but the repository recipe doesn't have any logic dependent on platform version. The separate test for RHEL5 wasn't actually exercising anything specific, so I thought I'd condense the spec by removing it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually there's one RHEL5-specific thing: the yum repository has to be configured with a gpgkey downloaded through plain text http (the logic that handles that is in the default attributes file: https://github.com/DataDog/chef-datadog/blob/v2.8.1/attributes/default.rb#L85-L91).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oooh.. good catch. This should be fixed in bc60110.

expect(chef_run).to run_execute('apt-key import key 382E94DE').with(
command: 'apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 A2923DFF56EDA6E76E55E492D3A80E30382E94DE'
)
end

it 'sets up an apt repo' do
expect(chef_run).to add_apt_repository('datadog')
end
end

context 'rhellions' do
describe 'on versions 5.x and lower' do
cached(:chef_run) do
ChefSpec::SoloRunner.new(
:platform => 'centos',
:version => '5.8'
) do |node|
node.set['languages'] = { 'python' => { 'version' => '2.4.3' } }
end.converge described_recipe
end

it 'sets up a yum repo' do
expect(chef_run).to create_yum_repository('datadog').with(
gpgkey: 'http://yum.datadoghq.com/DATADOG_RPM_KEY.public'
)
end
end

describe 'on versions 6.x and higher' do
cached(:chef_run) do
ChefSpec::SoloRunner.new(
:platform => 'centos',
:version => '6.3'
) do |node|
node.set['languages'] = { 'python' => { 'version' => '2.7.3' } }
end.converge described_recipe
end

it 'sets up a yum repo' do
expect(chef_run).to create_yum_repository('datadog').with(
gpgkey: 'https://yum.datadoghq.com/DATADOG_RPM_KEY.public'
)
end
cached(:chef_run) do
ChefSpec::SoloRunner.new(
platform: 'centos', version: '6.5'
).converge(described_recipe)
end

it 'sets the yumrepo_gpgkey_new attribute' do
expect(chef_run.node['datadog']['yumrepo_gpgkey_new']).to match(
/DATADOG_RPM_KEY_E09422B3.public/
)
end

it 'installs gnupg' do
expect(chef_run).to install_package('gnupg')
end

it 'downloads the new RPM key' do
expect(chef_run).to create_remote_file('DATADOG_RPM_KEY_E09422B3.public').with(path: '/var/chef/cache/DATADOG_RPM_KEY_E09422B3.public')
end

it 'notifies the GPG key install if a new one is downloaded' do
keyfile_r = chef_run.remote_file('DATADOG_RPM_KEY_E09422B3.public')
expect(keyfile_r).to notify('execute[rpm-import datadog key e09422b3]')
.to(:run).immediately
end

it 'doesn\'t execute[rpm-import datadog key e09422b3] by default' do
keyfile_exec_r = chef_run.execute('rpm-import datadog key e09422b3')
expect(keyfile_exec_r).to do_nothing
end

it 'sets up a yum repo' do
expect(chef_run).to create_yum_repository('datadog').with(
gpgkey: 'https://yum.datadoghq.com/DATADOG_RPM_KEY.public'
)
end
end
end