parent
ec9b912e45
commit
6607474370
GPG Key ID:
37036C356E56CC51
@ -21,6 +21,7 @@ cookbook 'composer', '~> 2.7.0'
|
|||||||
cookbook 'fail2ban', '~> 7.0.4'
|
cookbook 'fail2ban', '~> 7.0.4'
|
||||||
cookbook 'git', '~> 10.0.0'
|
cookbook 'git', '~> 10.0.0'
|
||||||
cookbook 'golang', '~> 5.3.1'
|
cookbook 'golang', '~> 5.3.1'
|
||||||
|
cookbook 'gpg', '~> 2.0.13'
|
||||||
cookbook 'hostname', '= 0.4.2'
|
cookbook 'hostname', '= 0.4.2'
|
||||||
cookbook 'hostsfile', '~> 3.0.1'
|
cookbook 'hostsfile', '~> 3.0.1'
|
||||||
cookbook 'java', '~> 4.3.0'
|
cookbook 'java', '~> 4.3.0'
|
||||||
|
|||||||
@ -8,6 +8,7 @@ DEPENDENCIES
|
|||||||
firewall (~> 6.2.16)
|
firewall (~> 6.2.16)
|
||||||
git (~> 10.0.0)
|
git (~> 10.0.0)
|
||||||
golang (~> 5.3.1)
|
golang (~> 5.3.1)
|
||||||
|
gpg (~> 2.0.13)
|
||||||
hostname (= 0.4.2)
|
hostname (= 0.4.2)
|
||||||
hostsfile (~> 3.0.1)
|
hostsfile (~> 3.0.1)
|
||||||
ipfs
|
ipfs
|
||||||
@ -59,6 +60,8 @@ GRAPH
|
|||||||
git (10.0.0)
|
git (10.0.0)
|
||||||
golang (5.3.1)
|
golang (5.3.1)
|
||||||
ark (>= 6.0)
|
ark (>= 6.0)
|
||||||
|
gpg (2.0.13)
|
||||||
|
yum-epel (>= 0.0.0)
|
||||||
homebrew (5.4.1)
|
homebrew (5.4.1)
|
||||||
hostname (0.4.2)
|
hostname (0.4.2)
|
||||||
hostsfile (>= 0.0.0)
|
hostsfile (>= 0.0.0)
|
||||||
|
|||||||
5
cookbooks/gpg/.markdownlint-cli2.yaml
Normal file
5
cookbooks/gpg/.markdownlint-cli2.yaml
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
config:
|
||||||
|
ul-indent: false # MD007
|
||||||
|
line-length: false # MD013
|
||||||
|
no-duplicate-heading: false # MD024
|
||||||
|
reference-links-images: false # MD052
|
||||||
89
cookbooks/gpg/CHANGELOG.md
Normal file
89
cookbooks/gpg/CHANGELOG.md
Normal file
@ -0,0 +1,89 @@
|
|||||||
|
# gpg Cookbook CHANGELOG
|
||||||
|
|
||||||
|
This file is used to list changes made in each version of the gpg cookbook.
|
||||||
|
|
||||||
|
## 2.0.13 - *2024-05-02*
|
||||||
|
|
||||||
|
## 2.0.12 - *2024-05-02*
|
||||||
|
|
||||||
|
## 2.0.11 - *2023-09-28*
|
||||||
|
|
||||||
|
## 2.0.10 - *2023-09-04*
|
||||||
|
|
||||||
|
## 2.0.9 - *2023-07-10*
|
||||||
|
|
||||||
|
## 2.0.8 - *2023-05-16*
|
||||||
|
|
||||||
|
- Fix markdown formatting in the changelog
|
||||||
|
- Standardise files with files in sous-chefs/repo-management
|
||||||
|
|
||||||
|
## 2.0.7 - *2023-05-16*
|
||||||
|
|
||||||
|
- Standardise files with files in sous-chefs/repo-management
|
||||||
|
|
||||||
|
## 2.0.6 - *2023-05-03*
|
||||||
|
|
||||||
|
- Standardise files with files in sous-chefs/repo-management
|
||||||
|
|
||||||
|
## 2.0.5 - *2023-04-01*
|
||||||
|
|
||||||
|
- Standardise files with files in sous-chefs/repo-management
|
||||||
|
|
||||||
|
## 2.0.4 - *2023-03-02*
|
||||||
|
|
||||||
|
- Standardise files with files in sous-chefs/repo-management
|
||||||
|
|
||||||
|
## 2.0.3 - *2023-02-14*
|
||||||
|
|
||||||
|
- Remove delivery folder
|
||||||
|
|
||||||
|
## 2.0.2 - *2021-08-31*
|
||||||
|
|
||||||
|
- Standardise files with files in sous-chefs/repo-management
|
||||||
|
|
||||||
|
## 2.0.1 - *2021-06-01*
|
||||||
|
|
||||||
|
- Standardise files with files in sous-chefs/repo-management
|
||||||
|
|
||||||
|
## 2.0.0 - *2021-05-07*
|
||||||
|
|
||||||
|
- Update tested platforms
|
||||||
|
- Set minimum Chef version to 15.3 for unified_mode support
|
||||||
|
|
||||||
|
## 1.3.0 - *2020-12-14*
|
||||||
|
|
||||||
|
- Added support for SUSE and OpenSUSE
|
||||||
|
|
||||||
|
## 1.2.0 (2020-08-26)
|
||||||
|
|
||||||
|
- Comment out enforce_idempotency in kitchen.dokken.yml so tests work
|
||||||
|
- Update/Remove the platforms we test against
|
||||||
|
- Fix support for pinentry_mode on Ubuntu 16.04
|
||||||
|
|
||||||
|
## 1.1.0 (2020-05-14)
|
||||||
|
|
||||||
|
- resolved cookstyle error: resources/install.rb:1:36 convention: `Layout/TrailingWhitespace`
|
||||||
|
- resolved cookstyle error: resources/install.rb:1:37 refactor: `ChefModernize/FoodcriticComments`
|
||||||
|
|
||||||
|
## 1.0.1 (2020-01-26)
|
||||||
|
|
||||||
|
- Use Github Actions for testing
|
||||||
|
- Fix Ubuntu platform checks in the `gpg_key` resource
|
||||||
|
- Use true/false in the resource to simplify the types
|
||||||
|
|
||||||
|
## 1.0.0 (2019-01-26)
|
||||||
|
|
||||||
|
- Adds two new resources `gpg_install` and `gpg_key`
|
||||||
|
- Use CircleCI for testing
|
||||||
|
|
||||||
|
## 0.3.0 (2018-05-08)
|
||||||
|
|
||||||
|
- Sous Chefs will now be maintaining this cookbook. For more information on Sous Chefs see <http://sous-chefs.org/>
|
||||||
|
- This cookbook now requires Chef 12 or later
|
||||||
|
- Added a chefignore file
|
||||||
|
- Added local testing with delivery local mode
|
||||||
|
- Added Code of conduct, testing, contributing, license, and changelog files
|
||||||
|
- Added `chef_version`, `source_url`, and `issues_url` to the metadata
|
||||||
|
- Added ubuntu/debian to the metadata as supported platforms
|
||||||
|
- Updated the kitchen config to use Vagrant on common platforms
|
||||||
|
- Resolved all cookstyle / foodcritic warnings
|
||||||
202
cookbooks/gpg/LICENSE
Normal file
202
cookbooks/gpg/LICENSE
Normal file
@ -0,0 +1,202 @@
|
|||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright {yyyy} {name of copyright owner}
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
||||||
63
cookbooks/gpg/README.md
Normal file
63
cookbooks/gpg/README.md
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# GPG cookbook
|
||||||
|
|
||||||
|
[](https://supermarket.chef.io/cookbooks/gpg)
|
||||||
|
[](https://circleci.com/gh/sous-chefs/gpg)
|
||||||
|
[](#backers)
|
||||||
|
[](#sponsors)
|
||||||
|
[](https://opensource.org/licenses/Apache-2.0)
|
||||||
|
|
||||||
|
Installs and configures GPG on a system
|
||||||
|
|
||||||
|
## Maintainers
|
||||||
|
|
||||||
|
This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit [sous-chefs.org](https://sous-chefs.org/) or come chat with us on the Chef Community Slack in [#sous-chefs](https://chefcommunity.slack.com/messages/C2V7B88SF).
|
||||||
|
|
||||||
|
## Custom resources
|
||||||
|
|
||||||
|
This cookboks uses custom resources to control GPG2.
|
||||||
|
|
||||||
|
Install GPG2 and haveged
|
||||||
|
|
||||||
|
```ruby
|
||||||
|
gpg_install
|
||||||
|
```
|
||||||
|
|
||||||
|
Generate a GPG key for a user
|
||||||
|
|
||||||
|
```ruby
|
||||||
|
gpg_key 'foo' do
|
||||||
|
user 'foo'
|
||||||
|
passphrase 'this-is-not-secure'
|
||||||
|
end
|
||||||
|
```
|
||||||
|
|
||||||
|
For further detail please see the documentation for each resource, or the test cookbook for example usage.
|
||||||
|
|
||||||
|
- [gpg_install](https://github.com/sous-chefs/gpg/blob/master/documentation/resource/install.md)
|
||||||
|
- [gpg_key](https://github.com/sous-chefs/gpg/blob/master/documentation/resource/key.md)
|
||||||
|
- [Test Cookbook](https://github.com/sous-chefs/gpg/blob/master/test/fixtures/cookbooks/test/recipes)
|
||||||
|
|
||||||
|
## Contributors
|
||||||
|
|
||||||
|
This project exists thanks to all the people who [contribute.](https://opencollective.com/sous-chefs/contributors.svg?width=890&button=false)
|
||||||
|
|
||||||
|
### Backers
|
||||||
|
|
||||||
|
Thank you to all our backers!
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### Sponsors
|
||||||
|
|
||||||
|
Support this project by becoming a sponsor. Your logo will show up here with a link to your website.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
115
cookbooks/gpg/chefignore
Normal file
115
cookbooks/gpg/chefignore
Normal file
@ -0,0 +1,115 @@
|
|||||||
|
# Put files/directories that should be ignored in this file when uploading
|
||||||
|
# to a Chef Infra Server or Supermarket.
|
||||||
|
# Lines that start with '# ' are comments.
|
||||||
|
|
||||||
|
# OS generated files #
|
||||||
|
######################
|
||||||
|
.DS_Store
|
||||||
|
ehthumbs.db
|
||||||
|
Icon?
|
||||||
|
nohup.out
|
||||||
|
Thumbs.db
|
||||||
|
.envrc
|
||||||
|
|
||||||
|
# EDITORS #
|
||||||
|
###########
|
||||||
|
.#*
|
||||||
|
.project
|
||||||
|
.settings
|
||||||
|
*_flymake
|
||||||
|
*_flymake.*
|
||||||
|
*.bak
|
||||||
|
*.sw[a-z]
|
||||||
|
*.tmproj
|
||||||
|
*~
|
||||||
|
\#*
|
||||||
|
REVISION
|
||||||
|
TAGS*
|
||||||
|
tmtags
|
||||||
|
.vscode
|
||||||
|
.editorconfig
|
||||||
|
|
||||||
|
## COMPILED ##
|
||||||
|
##############
|
||||||
|
*.class
|
||||||
|
*.com
|
||||||
|
*.dll
|
||||||
|
*.exe
|
||||||
|
*.o
|
||||||
|
*.pyc
|
||||||
|
*.so
|
||||||
|
*/rdoc/
|
||||||
|
a.out
|
||||||
|
mkmf.log
|
||||||
|
|
||||||
|
# Testing #
|
||||||
|
###########
|
||||||
|
.circleci/*
|
||||||
|
.codeclimate.yml
|
||||||
|
.delivery/*
|
||||||
|
.foodcritic
|
||||||
|
.kitchen*
|
||||||
|
.mdlrc
|
||||||
|
.overcommit.yml
|
||||||
|
.rspec
|
||||||
|
.rubocop.yml
|
||||||
|
.travis.yml
|
||||||
|
.watchr
|
||||||
|
.yamllint
|
||||||
|
azure-pipelines.yml
|
||||||
|
Dangerfile
|
||||||
|
examples/*
|
||||||
|
features/*
|
||||||
|
Guardfile
|
||||||
|
kitchen*.yml
|
||||||
|
mlc_config.json
|
||||||
|
Procfile
|
||||||
|
Rakefile
|
||||||
|
spec/*
|
||||||
|
test/*
|
||||||
|
|
||||||
|
# SCM #
|
||||||
|
#######
|
||||||
|
.git
|
||||||
|
.gitattributes
|
||||||
|
.gitconfig
|
||||||
|
.github/*
|
||||||
|
.gitignore
|
||||||
|
.gitkeep
|
||||||
|
.gitmodules
|
||||||
|
.svn
|
||||||
|
*/.bzr/*
|
||||||
|
*/.git
|
||||||
|
*/.hg/*
|
||||||
|
*/.svn/*
|
||||||
|
|
||||||
|
# Berkshelf #
|
||||||
|
#############
|
||||||
|
Berksfile
|
||||||
|
Berksfile.lock
|
||||||
|
cookbooks/*
|
||||||
|
tmp
|
||||||
|
|
||||||
|
# Bundler #
|
||||||
|
###########
|
||||||
|
vendor/*
|
||||||
|
Gemfile
|
||||||
|
Gemfile.lock
|
||||||
|
|
||||||
|
# Policyfile #
|
||||||
|
##############
|
||||||
|
Policyfile.rb
|
||||||
|
Policyfile.lock.json
|
||||||
|
|
||||||
|
# Documentation #
|
||||||
|
#############
|
||||||
|
CODE_OF_CONDUCT*
|
||||||
|
CONTRIBUTING*
|
||||||
|
documentation/*
|
||||||
|
TESTING*
|
||||||
|
UPGRADING*
|
||||||
|
|
||||||
|
# Vagrant #
|
||||||
|
###########
|
||||||
|
.vagrant
|
||||||
|
Vagrantfile
|
||||||
43
cookbooks/gpg/libraries/helpers.rb
Normal file
43
cookbooks/gpg/libraries/helpers.rb
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
module Gpg
|
||||||
|
module Helpers
|
||||||
|
include Chef::Mixin::ShellOut
|
||||||
|
|
||||||
|
def key_exists(new_resource)
|
||||||
|
gpg_check = gpg_cmd
|
||||||
|
gpg_check << gpg_opts if new_resource.override_default_keyring
|
||||||
|
gpg_check << "--list-keys | grep '#{new_resource.name_real}'"
|
||||||
|
|
||||||
|
cmd = Mixlib::ShellOut.new(
|
||||||
|
gpg_check,
|
||||||
|
user: new_resource.user,
|
||||||
|
group: new_resource.group
|
||||||
|
)
|
||||||
|
|
||||||
|
cmd.run_command
|
||||||
|
|
||||||
|
cmd.exitstatus == 0
|
||||||
|
end
|
||||||
|
|
||||||
|
def gpg_opts(new_resource)
|
||||||
|
if new_resource.override_default_keyring
|
||||||
|
"--no-default-keyring --secret-keyring #{new_resource.secring_file} --keyring #{new_resource.pubring_file}"
|
||||||
|
else
|
||||||
|
false
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def gpg_cmd
|
||||||
|
"gpg2 --homedir #{new_resource.home_dir} "
|
||||||
|
end
|
||||||
|
|
||||||
|
def gpg2_packages
|
||||||
|
packages = %w(haveged)
|
||||||
|
if platform_family?('suse')
|
||||||
|
packages.push('gpg2')
|
||||||
|
else
|
||||||
|
packages.push('gnupg2')
|
||||||
|
end
|
||||||
|
packages
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
43
cookbooks/gpg/metadata.json
Normal file
43
cookbooks/gpg/metadata.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"name": "gpg",
|
||||||
|
"description": "Installs/Configures gpg",
|
||||||
|
"long_description": "",
|
||||||
|
"maintainer": "Sous Chefs",
|
||||||
|
"maintainer_email": "help@sous-chefs.org",
|
||||||
|
"license": "Apache-2.0",
|
||||||
|
"platforms": {
|
||||||
|
"debian": ">= 0.0.0",
|
||||||
|
"ubuntu": ">= 0.0.0",
|
||||||
|
"centos": ">= 0.0.0",
|
||||||
|
"redhat": ">= 0.0.0",
|
||||||
|
"oracle": ">= 0.0.0",
|
||||||
|
"amazon": ">= 0.0.0",
|
||||||
|
"opensuse": ">= 0.0.0",
|
||||||
|
"suse": ">= 0.0.0"
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"yum-epel": ">= 0.0.0"
|
||||||
|
},
|
||||||
|
"providing": {
|
||||||
|
|
||||||
|
},
|
||||||
|
"recipes": {
|
||||||
|
|
||||||
|
},
|
||||||
|
"version": "2.0.13",
|
||||||
|
"source_url": "https://github.com/sous-chefs/gpg",
|
||||||
|
"issues_url": "https://github.com/sous-chefs/gpg/issues",
|
||||||
|
"privacy": false,
|
||||||
|
"chef_versions": [
|
||||||
|
[
|
||||||
|
">= 15.3"
|
||||||
|
]
|
||||||
|
],
|
||||||
|
"ohai_versions": [
|
||||||
|
|
||||||
|
],
|
||||||
|
"gems": [
|
||||||
|
|
||||||
|
],
|
||||||
|
"eager_load_libraries": true
|
||||||
|
}
|
||||||
20
cookbooks/gpg/metadata.rb
Normal file
20
cookbooks/gpg/metadata.rb
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
name 'gpg'
|
||||||
|
maintainer 'Sous Chefs'
|
||||||
|
maintainer_email 'help@sous-chefs.org'
|
||||||
|
license 'Apache-2.0'
|
||||||
|
description 'Installs/Configures gpg'
|
||||||
|
source_url 'https://github.com/sous-chefs/gpg'
|
||||||
|
issues_url 'https://github.com/sous-chefs/gpg/issues'
|
||||||
|
version '2.0.13'
|
||||||
|
chef_version '>= 15.3'
|
||||||
|
|
||||||
|
depends 'yum-epel'
|
||||||
|
|
||||||
|
supports 'debian'
|
||||||
|
supports 'ubuntu'
|
||||||
|
supports 'centos'
|
||||||
|
supports 'redhat'
|
||||||
|
supports 'oracle'
|
||||||
|
supports 'amazon'
|
||||||
|
supports 'opensuse'
|
||||||
|
supports 'suse'
|
||||||
18
cookbooks/gpg/renovate.json
Normal file
18
cookbooks/gpg/renovate.json
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
{
|
||||||
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||||
|
"extends": ["config:base"],
|
||||||
|
"packageRules": [
|
||||||
|
{
|
||||||
|
"groupName": "Actions",
|
||||||
|
"matchUpdateTypes": ["minor", "patch", "pin"],
|
||||||
|
"automerge": true,
|
||||||
|
"addLabels": ["Release: Patch", "Skip: Announcements"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"groupName": "Actions",
|
||||||
|
"matchUpdateTypes": ["major"],
|
||||||
|
"automerge": false,
|
||||||
|
"addLabels": ["Release: Patch", "Skip: Announcements"]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
18
cookbooks/gpg/resources/install.rb
Normal file
18
cookbooks/gpg/resources/install.rb
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
unified_mode true
|
||||||
|
|
||||||
|
property :name, String, default: ''
|
||||||
|
|
||||||
|
action :install do
|
||||||
|
include_recipe 'yum-epel' if platform_family?('rhel', 'amazon')
|
||||||
|
|
||||||
|
package gpg2_packages
|
||||||
|
|
||||||
|
service 'haveged' do
|
||||||
|
supports [:status, :restart]
|
||||||
|
action :start
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
action_class do
|
||||||
|
include Gpg::Helpers
|
||||||
|
end
|
||||||
166
cookbooks/gpg/resources/key.rb
Normal file
166
cookbooks/gpg/resources/key.rb
Normal file
@ -0,0 +1,166 @@
|
|||||||
|
unified_mode true
|
||||||
|
|
||||||
|
property :batch_name, String,
|
||||||
|
name_property: true,
|
||||||
|
description: 'Name of the key/batch to generate.'
|
||||||
|
|
||||||
|
property :override_default_keyring, [true, false],
|
||||||
|
default: false,
|
||||||
|
description: 'Set to true if you want to override the pubring_file and secring_file locations.'
|
||||||
|
|
||||||
|
property :pubring_file, String,
|
||||||
|
description: 'Public keyring file location (override_default_keyring must be set to true or this option will be ignored)'
|
||||||
|
|
||||||
|
property :secring_file, String,
|
||||||
|
description: 'Secret keyring file location (override_default_keyring must be set to true or this option will be ignored)'
|
||||||
|
|
||||||
|
property :user, String,
|
||||||
|
default: 'root',
|
||||||
|
description: 'User to generate the key for'
|
||||||
|
|
||||||
|
property :group, String,
|
||||||
|
default: lazy { user },
|
||||||
|
description: 'Group to run the generate command as'
|
||||||
|
|
||||||
|
property :key_type, String,
|
||||||
|
default: '1', equal_to: %w(RSA 1 DSA 17 ),
|
||||||
|
description: 'Corresponds to GPG option: Key-Type (RSA or DSA)'
|
||||||
|
|
||||||
|
property :key_length, String,
|
||||||
|
default: '2048', equal_to: %w( 2048 4096 ),
|
||||||
|
description: 'Corresponds to GPG option: Key-Length (2048 or 4096)'
|
||||||
|
|
||||||
|
property :name_real, String,
|
||||||
|
default: lazy { "Chef Generated Default (#{batch_name})" },
|
||||||
|
description: 'Corresponds to GPG option: Name-Real'
|
||||||
|
|
||||||
|
property :name_comment, String,
|
||||||
|
default: 'generated by Chef',
|
||||||
|
description: 'Corresponds to GPG option: Name-Comment'
|
||||||
|
|
||||||
|
property :name_email, String,
|
||||||
|
default: lazy { "#{node.name}@example.com" },
|
||||||
|
description: 'Corresponds to GPG option: Name-Email'
|
||||||
|
|
||||||
|
property :expire_date, String,
|
||||||
|
default: '0',
|
||||||
|
description: 'Corresponds to GPG option: Expire-Date. Defaults to 0 (no expiry)'
|
||||||
|
|
||||||
|
property :home_dir, String,
|
||||||
|
default: lazy { ::File.expand_path("~#{user}/.gnupg") },
|
||||||
|
description: 'Location to store the keyring. Defaults to ~/.gnupg'
|
||||||
|
|
||||||
|
property :batch_config_file, String,
|
||||||
|
default: lazy { ::File.join(home_dir, "gpg_batch_config_#{batch_name}") },
|
||||||
|
description: 'Batch config file name'
|
||||||
|
|
||||||
|
property :passphrase, String,
|
||||||
|
sensitive: true,
|
||||||
|
description: 'Passphrase for key'
|
||||||
|
|
||||||
|
property :key_file, String,
|
||||||
|
description: 'Keyfile name'
|
||||||
|
|
||||||
|
property :key_fingerprint, String,
|
||||||
|
description: 'Key finger print. Used to identify when deleting keys using the :delete action'
|
||||||
|
|
||||||
|
# Only Ubuntu > 16.04 supports the pinetree_mode. And requires it
|
||||||
|
property :pinentry_mode, [String, FalseClass],
|
||||||
|
default: platform?('ubuntu') && node['platform_version'].to_f > 16.04 ? 'loopback' : false,
|
||||||
|
description: 'Pinentry mode. Set to loopback on Ubuntu and False (off) for all other platforms.'
|
||||||
|
|
||||||
|
property :batch, [true, false],
|
||||||
|
default: true,
|
||||||
|
description: 'Turn batch mode on or off when genrating keys'
|
||||||
|
|
||||||
|
action :generate do
|
||||||
|
unless key_exists(new_resource)
|
||||||
|
|
||||||
|
config_dir = ::File.dirname(new_resource.batch_config_file)
|
||||||
|
|
||||||
|
directory config_dir do
|
||||||
|
owner new_resource.user
|
||||||
|
mode '0700'
|
||||||
|
recursive true
|
||||||
|
not_if { ::Dir.exist?(config_dir) }
|
||||||
|
end
|
||||||
|
|
||||||
|
file new_resource.batch_config_file do
|
||||||
|
content <<~EOS
|
||||||
|
Key-Type: #{new_resource.key_type}
|
||||||
|
Key-Length: #{new_resource.key_length}
|
||||||
|
Name-Real: #{new_resource.name_real}
|
||||||
|
Name-Comment: #{new_resource.name_comment}
|
||||||
|
Name-Email: #{new_resource.name_email}
|
||||||
|
Expire-Date: #{new_resource.expire_date}
|
||||||
|
EOS
|
||||||
|
|
||||||
|
if new_resource.override_default_keyring
|
||||||
|
content << "%pubring #{new_resource.pubring_file}\n"
|
||||||
|
content << "%secring #{new_resource.secring_file}\n"
|
||||||
|
end
|
||||||
|
|
||||||
|
content << "Passphrase: #{new_resource.passphrase}" if new_resource.passphrase
|
||||||
|
content << "%commit\n"
|
||||||
|
mode '0600'
|
||||||
|
owner new_resource.user
|
||||||
|
sensitive true
|
||||||
|
end
|
||||||
|
|
||||||
|
cmd = gpg_cmd
|
||||||
|
cmd << gpg_opts(new_resource) if new_resource.override_default_keyring
|
||||||
|
cmd << " --passphrase #{new_resource.passphrase}"
|
||||||
|
cmd << ' --yes'
|
||||||
|
cmd << ' --batch' if new_resource.batch
|
||||||
|
cmd << ' --pinentry-mode loopback' if new_resource.pinentry_mode
|
||||||
|
cmd << " --gen-key #{new_resource.batch_config_file}"
|
||||||
|
|
||||||
|
execute 'gpg2: generate' do
|
||||||
|
command cmd
|
||||||
|
live_stream true
|
||||||
|
user new_resource.user
|
||||||
|
group new_resource.group
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
action :import do
|
||||||
|
execute 'gpg2: import key' do
|
||||||
|
command "#{gpg_cmd} --import #{new_resource.key_file}"
|
||||||
|
user new_resource.user
|
||||||
|
group new_resource.group
|
||||||
|
not_if { key_exists(new_resource) }
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
action :export do
|
||||||
|
execute 'gpg2: export key' do
|
||||||
|
command "#{gpg_cmd} --export -a \"#{new_resource.name_real}\" > #{new_resource.key_file}"
|
||||||
|
user new_resource.user
|
||||||
|
group new_resource.group
|
||||||
|
not_if { ::File.exist?(new_resource.key_file) }
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
action :delete_public_key do
|
||||||
|
execute 'gpg2: delete key' do
|
||||||
|
command "#{gpg_cmd} --batch --yes --delete-key \"#{new_resource.key_fingerprint}\""
|
||||||
|
user new_resource.user
|
||||||
|
group new_resource.group
|
||||||
|
only_if { key_exists(new_resource) }
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
action :delete_secret_keys do
|
||||||
|
execute 'gpg2: delete key' do
|
||||||
|
command "#{gpg_cmd} --batch --yes --delete-secret-keys \"#{new_resource.key_fingerprint}\""
|
||||||
|
user new_resource.user
|
||||||
|
group new_resource.group
|
||||||
|
only_if { key_exists(new_resource) }
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
action_class do
|
||||||
|
include Gpg::Helpers
|
||||||
|
end
|
||||||
@ -4,6 +4,11 @@ node.default["gitea"]["working_directory"] = "/var/lib/gitea"
|
|||||||
node.default["gitea"]["port"] = 3000
|
node.default["gitea"]["port"] = 3000
|
||||||
node.default["gitea"]["postgresql_host"] = "localhost:5432"
|
node.default["gitea"]["postgresql_host"] = "localhost:5432"
|
||||||
node.default["gitea"]["domain"] = "gitea.kosmos.org"
|
node.default["gitea"]["domain"] = "gitea.kosmos.org"
|
||||||
|
node.default["gitea"]["commit_signing"] = {
|
||||||
|
"name_real" => "Gitea",
|
||||||
|
"name_comment" => "commit signing",
|
||||||
|
"name_email" => "git@#{node["gitea"]["domain"]}"
|
||||||
|
}
|
||||||
|
|
||||||
node.default["gitea"]["config"] = {
|
node.default["gitea"]["config"] = {
|
||||||
"actions": {
|
"actions": {
|
||||||
|
|||||||
@ -8,6 +8,7 @@ version '0.2.0'
|
|||||||
chef_version '>= 14.0'
|
chef_version '>= 14.0'
|
||||||
|
|
||||||
depends "firewall"
|
depends "firewall"
|
||||||
|
depends "gpg"
|
||||||
depends "kosmos_openresty"
|
depends "kosmos_openresty"
|
||||||
depends "kosmos_postgresql"
|
depends "kosmos_postgresql"
|
||||||
depends "backup"
|
depends "backup"
|
||||||
|
|||||||
@ -77,6 +77,22 @@ if node.chef_environment == "production"
|
|||||||
}
|
}
|
||||||
end
|
end
|
||||||
|
|
||||||
|
if node["gitea"]["commit_signing"]
|
||||||
|
gpg_install
|
||||||
|
|
||||||
|
gpg_key "git" do
|
||||||
|
user "git"
|
||||||
|
group "git"
|
||||||
|
name_real node["gitea"]["commit_signing"]["name_real"]
|
||||||
|
name_comment node["gitea"]["commit_signing"]["name_comment"]
|
||||||
|
name_email node["gitea"]["commit_signing"]["name_email"]
|
||||||
|
end
|
||||||
|
|
||||||
|
execute "enable git commit signing for all repositories" do
|
||||||
|
command "su - git -c 'git config --global commit.gpgsign true'"
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
config_variables = {
|
config_variables = {
|
||||||
working_directory: working_directory,
|
working_directory: working_directory,
|
||||||
git_home_directory: git_home_directory,
|
git_home_directory: git_home_directory,
|
||||||
@ -93,6 +109,7 @@ config_variables = {
|
|||||||
smtp_user: smtp_credentials["user_name"],
|
smtp_user: smtp_credentials["user_name"],
|
||||||
smtp_password: smtp_credentials["password"],
|
smtp_password: smtp_credentials["password"],
|
||||||
config: node["gitea"]["config"],
|
config: node["gitea"]["config"],
|
||||||
|
commit_signing: node["gitea"]["commit_signing"],
|
||||||
s3_key_id: gitea_data_bag_item["s3_key_id"],
|
s3_key_id: gitea_data_bag_item["s3_key_id"],
|
||||||
s3_secret_key: gitea_data_bag_item["s3_secret_key"],
|
s3_secret_key: gitea_data_bag_item["s3_secret_key"],
|
||||||
s3_bucket: gitea_data_bag_item["s3_bucket"]
|
s3_bucket: gitea_data_bag_item["s3_bucket"]
|
||||||
|
|||||||
@ -28,6 +28,15 @@ SSL_MODE = disable
|
|||||||
[repository]
|
[repository]
|
||||||
ROOT = <%= @repository_root_directory %>
|
ROOT = <%= @repository_root_directory %>
|
||||||
|
|
||||||
|
<% if @commit_signing %>
|
||||||
|
[repository.signing]
|
||||||
|
SIGNING_KEY = default
|
||||||
|
INITIAL_COMMIT = always
|
||||||
|
CRUD_ACTIONS = always
|
||||||
|
MERGES = always
|
||||||
|
WIKI = never
|
||||||
|
<% end %>
|
||||||
|
|
||||||
# [indexer]
|
# [indexer]
|
||||||
# ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
|
# ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user