-
Notifications
You must be signed in to change notification settings - Fork 65
debian: default fresh installs to native certificate enrollment #1451
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
denisonbarbosa
wants to merge
2
commits into
split/certificate-management
from
split/packaging-and-e2e
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,29 @@ | ||
| #!/bin/sh | ||
| set -e | ||
|
|
||
| CONFFILE=/etc/adsys.yaml | ||
|
|
||
| case "$1" in | ||
| configure) | ||
| pam-auth-update --package adsys | ||
| DEBIAN_FRONTEND=noninteractive pam-auth-update --package adsys | ||
|
|
||
| # For new installations (no previous version), set the LDAP-only | ||
| # certificate enrollment as default. Existing installations, and | ||
| # any file already present (e.g. hand-created by the admin before | ||
| # the first install, or left behind by a previous "remove"), are | ||
| # left untouched: existing installations keep the code default | ||
| # (cepces) for backward compatibility. The file is only ever | ||
| # removed on "dpkg --purge" (see postrm); a plain "remove" leaves | ||
| # it in place. | ||
| if [ -z "$2" ]; then | ||
| if [ ! -e "$CONFFILE" ] && [ ! -L "$CONFFILE" ]; then | ||
| cat > "$CONFFILE" << 'EOF' | ||
| # Certificate enrollment method: ldap (native Go, LDAP/RPC) or cepces (legacy Python/CEPCES). | ||
| certificate_enrollment: ldap | ||
| EOF | ||
| fi | ||
| fi | ||
| ;; | ||
| esac | ||
|
|
||
| #DEBHELPER# | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| #!/bin/sh | ||
| set -e | ||
|
|
||
| case "$1" in | ||
| purge) | ||
| # Only "dpkg --purge" removes the administrator's configuration; | ||
| # "remove" leaves it in place. There is no ucf/conffile machinery | ||
| # involved: the file is created directly by postinst (see there), | ||
| # so a plain rm is all that is needed here. | ||
| rm -f /etc/adsys.yaml | ||
| ;; | ||
| esac | ||
|
|
||
| #DEBHELPER# |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| #!/bin/sh | ||
| # Packaging-level smoke test for the adsys binary package lifecycle. | ||
| # | ||
| # Covers: | ||
| # - M11: adsys directly depends on ca-certificates because the native LDAP | ||
| # certificate backend requires update-ca-certificates to be present. | ||
| # - M12: /etc/adsys.yaml is only ever created by postinst on a genuinely | ||
| # new install (dpkg's "most-recently-configured-version" is empty) that | ||
| # finds no file already in place, and is only ever removed by postrm on | ||
| # purge, never on a plain remove. So an administrator's edits, or any | ||
| # file already present before the very first install, always survive | ||
| # upgrades, reinstalls and remove. | ||
| set -e | ||
|
|
||
| CONFFILE=/etc/adsys.yaml | ||
| PKG=adsys | ||
|
|
||
| fail() { | ||
| echo "FAIL: $*" >&2 | ||
| exit 1 | ||
| } | ||
|
|
||
| # Resolve the exact package-under-test candidate version and pin every | ||
| # install/reinstall to it below, so this test always exercises the | ||
| # freshly built package and fails loudly instead of silently falling back | ||
| # to some other version an archive mirror configured in the testbed might | ||
| # offer. | ||
| CANDIDATE=$(apt-cache policy "$PKG" | awk '/Candidate:/ {print $2}') | ||
| [ -n "$CANDIDATE" ] && [ "$CANDIDATE" != "(none)" ] \ | ||
| || fail "could not determine an install candidate for $PKG" | ||
|
|
||
| assert_installed_version() { | ||
| INSTALLED=$(dpkg-query -W -f='${Version}' "$PKG" 2>/dev/null || true) | ||
| [ "$INSTALLED" = "$CANDIDATE" ] \ | ||
| || fail "expected $PKG $CANDIDATE to be installed, got '${INSTALLED:-<none>}'" | ||
| } | ||
|
|
||
| # Plain install: used both for a genuinely fresh/first configure and for | ||
| # reinstalling over a "config-files" (removed but not purged) package. | ||
| apt_install() { | ||
| apt-get install -y "${PKG}=${CANDIDATE}" | ||
| assert_installed_version | ||
| } | ||
|
|
||
| # Forces maintainer scripts to rerun even though the same version is | ||
| # already fully installed, to simulate an upgrade-like reconfigure. | ||
| apt_reinstall() { | ||
| apt-get install --reinstall -y "${PKG}=${CANDIDATE}" | ||
| assert_installed_version | ||
| } | ||
|
|
||
| echo "== M11: ca-certificates is a direct runtime dependency ==" | ||
| command -v update-ca-certificates >/dev/null 2>&1 \ | ||
| || fail "update-ca-certificates is not available; ca-certificates dependency is missing or broken" | ||
| dpkg-query -W -f='${Depends}\n' "$PKG" | tr ',' '\n' | grep -qw 'ca-certificates' \ | ||
| || fail "$PKG no longer declares a direct dependency on ca-certificates" | ||
|
|
||
| echo "== M12: /etc/adsys.yaml lifecycle (candidate: $CANDIDATE) ==" | ||
|
|
||
| # Fresh install: autopkgtest already installed the package under test, so | ||
| # the LDAP default must be in place. | ||
| assert_installed_version | ||
| [ -e "$CONFFILE" ] || fail "$CONFFILE is missing after a fresh install" | ||
| grep -q '^certificate_enrollment: ldap$' "$CONFFILE" \ | ||
| || fail "$CONFFILE does not contain the expected fresh-install default" | ||
|
|
||
| # Simulate an administrator edit, then an upgrade-like reconfigure of the | ||
| # already-installed package (most-recently-configured-version is set): | ||
| # local edits must survive untouched. | ||
| echo "# local-admin-edit-marker" >> "$CONFFILE" | ||
| apt_reinstall | ||
| grep -q 'local-admin-edit-marker' "$CONFFILE" \ | ||
| || fail "reinstalling $PKG discarded administrator edits to $CONFFILE" | ||
|
|
||
| # Plain remove must keep the conffile around (postrm only acts on purge). | ||
| apt-get remove -y "$PKG" | ||
| [ -e "$CONFFILE" ] || fail "'apt-get remove' deleted $CONFFILE; it must survive until purge" | ||
| grep -q 'local-admin-edit-marker' "$CONFFILE" \ | ||
| || fail "$CONFFILE lost its content across 'apt-get remove'" | ||
|
|
||
| # Installing again over the "config-files" state left by remove still has | ||
| # a most-recently-configured-version recorded by dpkg, so postinst must | ||
| # not touch the file at all. | ||
| apt_install | ||
| grep -q 'local-admin-edit-marker' "$CONFFILE" \ | ||
| || fail "reinstalling over the config-files state lost administrator edits" | ||
|
|
||
| # Purge must remove the file. | ||
| apt-get purge -y "$PKG" | ||
| [ ! -e "$CONFFILE" ] || fail "'apt-get purge' left $CONFFILE behind" | ||
|
|
||
| # A file created by an administrator after a purge, while the package is | ||
| # fully uninstalled, must be preserved by the next install: this is the | ||
| # genuinely-new-install-with-a-pre-existing-file case, and the only one | ||
| # where postinst's "file already present" guard actually has to trigger. | ||
| printf '# custom-pre-existing-marker\ncertificate_enrollment: cepces\n' > "$CONFFILE" | ||
| apt_install | ||
| grep -q 'custom-pre-existing-marker' "$CONFFILE" \ | ||
| || fail "installing over a file created after purge lost its content" | ||
| grep -q '^certificate_enrollment: cepces$' "$CONFFILE" \ | ||
| || fail "installing over a pre-existing file changed its certificate_enrollment setting" | ||
|
|
||
| # Leave the testbed in a clean, usable state: purge the custom file away | ||
| # and reinstall so a plain fresh LDAP default is in place again. | ||
| apt-get purge -y "$PKG" | ||
| apt_install | ||
| [ -e "$CONFFILE" ] || fail "$CONFFILE is missing after the final reinstall" | ||
| grep -q '^certificate_enrollment: ldap$' "$CONFFILE" \ | ||
| || fail "$CONFFILE does not contain the expected default after the final reinstall" | ||
|
|
||
| echo "OK" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.