Skip to content
This repository has been archived by the owner on Feb 15, 2022. It is now read-only.

deanwilson/puppet-lint-yumrepo_gpgcheck_enabled-check

Repository files navigation

puppet-lint yumrepo_gpgcheck_enabled check

A puppet-lint extension that ensures yumrepo resources have the gpgcheck attribute and that it is enabled.

Actions Status

The gpgcheck attribute indicates if yum should perform a GPG signature check on packages. Having this disabled means you'll accept any packages from your configured repo, not just those signed by the packagers. While it's often more work to sign your own packages you should at the very least enable it for all upstream yum repositories.

Installation

To use this plugin add the following line to your Gemfile

gem 'puppet-lint-yumrepo_gpgcheck_enabled-check'

and then run bundle install

Usage

This plugin provides a new check to puppet-lint that warns if it finds a yumrepo resource that either does not contain the gpgcheck attribute or does not set the value to enable it.

yumrepo { 'company_app_repo':
  enabled  => 1,
  descr    => 'Local repo holding company application packages',
  baseurl  => 'http://repos.example.org/apps',
}

This example is missing gpgcheck and will return

yumrepo should have the gpgcheck attribute

The second example does not enable gpgcheck

yumrepo { 'company_app_repo':
  enabled  => 1,
  descr    => 'Local repo holding company application packages',
  baseurl  => 'http://repos.example.org/apps',
  gpgcheck => 0,
}

and will return

yumrepo should enable the gpgcheck attribute

Other puppet-lint plugins

You can find a list of my puppet-lint plugins in the unixdaemon puppet-lint-plugins repo

Author

Dean Wilson

About

puppet-lint check to ensure gpgcheck is enabled on yumrepo resources

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Contributors 4

  •  
  •  
  •  
  •  

Languages