v0.9.0

Upgrading from 0.8.x

• No protocol change, no API change. Bump the dependencies to 0.9.0 and rebuild.
• Behaviour change on macOS targets: ssh::authorized_keys' for_user_name(..) and user::Existing used to refuse a mac. They now run there. A playbook that worked around the refusal with for_account(home, uid, gid) keeps working.

Highlights

• Account lookups on macOS: ssh::authorized_keys::{Present, Absent}::for_user_name(..) and user::Existing find the account in Open Directory. Local and directory-bound accounts both resolve, the way sshd finds them at login (getpwnam, through /usr/bin/id -P).
  • So rustible_github::github_ssh_keys_to_user(ctx, "<gh user>", &ctx.facts().user) now works on a Mac too, and one playbook can keep a mixed Linux and macOS fleet's keys in sync (#151).
  • user::Existing then for_user(&account) chains work on a mac.
  • On a mac, user::Existing's groups are the groups whose GroupMembership lists the account (/usr/bin/dscl), as on Linux they are the /etc/group lines that list it. Groups held only through nesting or implicitly (everyone) are not listed, so there are fewer than id -Gn prints.
  • A missing account is refused in both modes, as on Linux. So is a name id would read as a uid (501, -2), rather than resolving to whichever account has that uid.
  • Every other user and group op still refuses a mac.

What's Changed

• ssh::authorized_keys and user::Existing: look accounts up on macOS (Open Directory) by @flipbit03 in #152

Full Changelog: v0.8.1...v0.9.0