propellor 3.1.2 → 3.2.0

raw patch · 9 files changed

+221/−77 lines, 9 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• CHANGELOG +21/−0
• debian/changelog +21/−0
• joeyconfig.hs +34/−0
• propellor.cabal +1/−1
• src/Propellor/Property/Debootstrap.hs +1/−1
• src/Propellor/Property/Sbuild.hs +121/−58
• src/Propellor/Property/SiteSpecific/JoeySites.hs +1/−5
• src/Propellor/Property/Ssh.hs +1/−1
• src/Propellor/Property/Tor.hs +20/−11

@@ -1,3 +1,24 @@+propellor (3.2.0) unstable; urgency=medium++  [ Sean Whitton ]+  * Using ccache with Sbuild.built & Sbuild.builtFor is now toggleable: these+    properties now take a parameter of type Sbuild.UseCcache.  (API Change)+  * Sbuild.piupartsConf: no longer takes an Apt.Url. (API Change)+  * Sbuild.piupartsConf & Sbuild.piupartsConfFor: does nothing if corresponding+    schroot not built.+    Previously, these properties built the schroot if it was missing.+  * Sbuild.built & Sbuild.piupartsConf: add an additional alias to sid chroots.+    This is for compatibility with `dgit sbuild`.+  * Further improvements to Sbuild.hs haddock.++  [ Joey Hess ]+  * Tor.hiddenService: Converted port parameter from Int to Port. (API change)+  * Tor.hiddenServiceAvailable: The hidden service hostname file may not+    be available immedaitely after configuring tor; avoid ugly error in+    this case.++ -- Joey Hess <id@joeyh.name>  Sat, 10 Sep 2016 11:39:40 -0400+ propellor (3.1.2) unstable; urgency=medium    [ Joey Hess ]

@@ -1,3 +1,24 @@+propellor (3.2.0) unstable; urgency=medium++  [ Sean Whitton ]+  * Using ccache with Sbuild.built & Sbuild.builtFor is now toggleable: these+    properties now take a parameter of type Sbuild.UseCcache.  (API Change)+  * Sbuild.piupartsConf: no longer takes an Apt.Url. (API Change)+  * Sbuild.piupartsConf & Sbuild.piupartsConfFor: does nothing if corresponding+    schroot not built.+    Previously, these properties built the schroot if it was missing.+  * Sbuild.built & Sbuild.piupartsConf: add an additional alias to sid chroots.+    This is for compatibility with `dgit sbuild`.+  * Further improvements to Sbuild.hs haddock.++  [ Joey Hess ]+  * Tor.hiddenService: Converted port parameter from Int to Port. (API change)+  * Tor.hiddenServiceAvailable: The hidden service hostname file may not+    be available immedaitely after configuring tor; avoid ugly error in+    this case.++ -- Joey Hess <id@joeyh.name>  Sat, 10 Sep 2016 11:39:40 -0400+ propellor (3.1.2) unstable; urgency=medium    [ Joey Hess ]

@@ -31,6 +31,7 @@ import qualified Propellor.Property.OS as OS import qualified Propellor.Property.HostingProvider.CloudAtCost as CloudAtCost import qualified Propellor.Property.HostingProvider.Linode as Linode+import qualified Propellor.Property.HostingProvider.DigitalOcean as DigitalOcean import qualified Propellor.Property.SiteSpecific.GitHome as GitHome import qualified Propellor.Property.SiteSpecific.GitAnnexBuilder as GitAnnexBuilder import qualified Propellor.Property.SiteSpecific.IABak as IABak@@ -55,6 +56,7 @@ 	, elephant 	, beaver 	, pell+	, keysafe 	, iabak 	] ++ monsters @@ -88,6 +90,9 @@ 	& JoeySites.dkimMilter 	& JoeySites.alarmClock "*-*-* 7:30" (User "joey") 		"/usr/bin/timeout 45m /home/joey/bin/goodmorning"+	& Ssh.userKeys (User "joey") hostContext+		[ (SshRsa, "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1YoyHxZwG5Eg0yiMTJLSWJ/+dMM6zZkZiR4JJ0iUfP+tT2bm/lxYompbSqBeiCq+PYcSC67mALxp1vfmdOV//LWlbXfotpxtyxbdTcQbHhdz4num9rJQz1tjsOsxTEheX5jKirFNC5OiKhqwIuNydKWDS9qHGqsKcZQ8p+n1g9Lr3nJVGY7eRRXzw/HopTpwmGmAmb9IXY6DC2k91KReRZAlOrk0287LaK3eCe1z0bu7LYzqqS+w99iXZ/Qs0m9OqAPnHZjWQQ0fN4xn5JQpZSJ7sqO38TBAimM+IHPmy2FTNVVn9zGM+vN1O2xr3l796QmaUG1+XLL0shfR/OZbb joey@darkstar")+		]  	! imageBuilt "/tmp/img" c MSDOS (grubBooted PC) 		[ partition EXT2 `mountedAt` "/boot"@@ -452,6 +457,35 @@ 	& Linode.chainPVGrub 5 	& Apt.unattendedUpgrades 	& Branchable.server hosts++keysafe :: Host+keysafe = host "keysafe.joeyh.name" $ props+	& ipv4 "139.59.17.168"+	& Hostname.sane+	& osDebian (Stable "jessie") X86_64+	& Apt.stdSourcesList `onChange` Apt.upgrade+	& DigitalOcean.distroKernel+	-- This is a 500 mb VM, so need more ram to build propellor.+	& Apt.serviceInstalledRunning "swapspace"+	& Cron.runPropellor (Cron.Times "30 * * * *")+	& Apt.installed ["etckeeper", "sudo"]+	& Apt.removed ["nfs-common", "exim4", "exim4-base", "exim4-daemon-light", "rsyslog", "acpid", "rpcbind", "at"]++	& User.hasSomePassword (User "root")+	& User.accountFor (User "joey")+	& User.hasSomePassword (User "joey")+	& Sudo.enabledFor (User "joey")++	& Ssh.installed+	& Ssh.randomHostKeys+	& User "root" `Ssh.authorizedKeysFrom` (User "joey", darkstar)+	& User "joey" `Ssh.authorizedKeysFrom` (User "joey", darkstar)+	& Ssh.noPasswords++	& Tor.installed+	& Tor.hiddenServiceAvailable "keysafe" (Port 4242)+		`requires` Tor.hiddenServiceData "keysafe" hostContext+	-- keysafe installed manually until package is available  iabak :: Host iabak = host "iabak.archiveteam.org" $ props

@@ -1,5 +1,5 @@ Name: propellor-Version: 3.1.2+Version: 3.2.0 Cabal-Version: >= 1.8 License: BSD2 Maintainer: Joey Hess <id@joeyh.name>

@@ -168,7 +168,7 @@ 				makeDevicesTarball 				makeWrapperScript (localInstallDir </> subdir) 				return MadeChange-			_ -> errorMessage "debootstrap tar file did not contain exactly one dirctory"+			_ -> errorMessage "debootstrap tar file did not contain exactly one directory"  sourceRemove :: Property Linux sourceRemove = property "debootstrap not installed from source" $ liftIO $

@@ -12,8 +12,8 @@ 1. you want to build for a Debian release strictly newer than squeeze, or for a Buntish release newer than or equal to trusty -2. if you want to build for Debian stretch or newer, you have sbuild-0.70.0 or newer (there is a backport to jessie)+2. if you want to build for Debian stretch or newer, you have sbuild 0.70.0 or+newer (there is a backport to jessie)  The latter is due to the migration from GnuPG v1 to GnuPG v2.1 in Debian stretch, which older sbuild can't handle.@@ -21,7 +21,7 @@ Suggested usage in @config.hs@:  >  & Apt.installed ["piuparts", "autopkgtest"]->  & Sbuild.builtFor (System (Debian Linux Unstable) X86_32)+>  & Sbuild.builtFor (System (Debian Linux Unstable) X86_32) Sbuild.UseCcache >  & Sbuild.piupartsConfFor (System (Debian Linux Unstable) X86_32) >  & Sbuild.updatedFor (System (Debian Linux Unstable) X86_32) `period` Weekly 1 >  & Sbuild.usableBy (User "spwhitton")@@ -71,6 +71,7 @@ module Propellor.Property.Sbuild ( 	-- * Creating and updating sbuild schroots 	SbuildSchroot(..),+	UseCcache(..), 	built, 	updated, 	piupartsConf,@@ -113,31 +114,37 @@ instance Show SbuildSchroot where 	show (SbuildSchroot suite arch) = suite ++ "-" ++ architectureToDebianArchString arch +-- | Whether an sbuild schroot should use ccache during builds+--+-- ccache is generally useful but it breaks building some packages.  This data+-- types allows you to toggle it on and off for particular schroots.+data UseCcache = UseCcache | NoCcache+ -- | Build and configure a schroot for use with sbuild using a distribution's -- standard mirror -- -- This function is a convenience wrapper around 'built', allowing the user to -- identify the schroot and distribution using the 'System' type-builtFor :: System -> RevertableProperty DebianLike UnixLike-builtFor sys = go <!> deleted+builtFor :: System -> UseCcache -> RevertableProperty DebianLike UnixLike+builtFor sys cc = go <!> deleted   where 	go = property' ("sbuild schroot for " ++ show sys) $ 		\w -> case (schrootFromSystem sys, stdMirror sys) of 			(Just s, Just u)  -> ensureProperty w $-				setupRevertableProperty $ built s u+				setupRevertableProperty $ built s u cc 			_ -> errorMessage 				("don't know how to debootstrap " ++ show sys) 	deleted = property' ("no sbuild schroot for " ++ show sys) $ 		\w -> case schrootFromSystem sys of 			Just s  -> ensureProperty w $-				undoRevertableProperty $ built s "dummy"+				undoRevertableProperty $ built s "dummy" cc 			Nothing -> noChange  -- | Build and configure a schroot for use with sbuild-built :: SbuildSchroot -> Apt.Url -> RevertableProperty DebianLike UnixLike-built s@(SbuildSchroot suite arch) mirror =-	(go-	`requires` ccachePrepared+built :: SbuildSchroot -> Apt.Url -> UseCcache -> RevertableProperty DebianLike UnixLike+built s@(SbuildSchroot suite arch) mirror cc =+	((go `before` enhancedConf)+	`requires` ccacheMaybePrepared cc 	`requires` installed 	`requires` overlaysKernel) 	<!> deleted@@ -157,10 +164,7 @@ 			] 		ifM (liftIO $ 			boolSystemEnv "sbuild-createchroot" params (Just de))-			( ensureProperty w $-				fixConfFile s-				`before` aliasesLine-				`before` commandPrefix+			( ensureProperty w $ fixConfFile s 			, return FailedChange 			) 	-- TODO we should kill any sessions still using the chroot@@ -172,23 +176,31 @@ 				("/etc/sbuild/chroot" </> show s ++ "-sbuild") 			makeChange $ nukeFile (schrootConf s) +	enhancedConf =+		combineProperties ("enhanced schroot conf for " ++ show s) $ props+			& aliasesLine+			-- enable ccache and eatmydata for speed+			& ConfFile.containsIniSetting (schrootConf s)+				( show s ++ "-sbuild"+				, "command-prefix"+				, intercalate "," commandPrefix+				)+ 	-- if we're building a sid chroot, add useful aliases 	-- In order to avoid more than one schroot getting the same aliases, we 	-- only do this if the arch of the chroot equals the host arch. 	aliasesLine :: Property UnixLike-	aliasesLine = property' "maybe set aliases line" $ \w -> do-		maybeOS <- getOS-		case maybeOS of-			Nothing -> return NoChange-			Just (System _ hostArch) ->-				if suite == "unstable" && hostArch == arch-				then ensureProperty w $-					schrootConf s `File.containsLine` aliases-				else return NoChange--	-- enable ccache and eatmydata for speed-	commandPrefix = File.containsLine (schrootConf s)-		"command-prefix=/var/cache/ccache-sbuild/sbuild-setup,eatmydata"+	aliasesLine = property' "maybe set aliases line" $ \w ->+		sidHostArchSchroot s >>= \isSidHostArchSchroot ->+			if isSidHostArchSchroot+			then ensureProperty w $+				ConfFile.containsIniSetting+					(schrootConf s)+					( show s ++ "-sbuild"+					, "aliases"+					, aliases+					)+			else return NoChange  	-- If the user has indicated that this host should use 	-- union-type=overlay schroots, we need to ensure that we have rebooted@@ -214,8 +226,28 @@ 		, return False 		) -	aliases = "aliases=UNRELEASED,sid,rc-buggy,experimental"+	aliases = intercalate ","+		[ "sid"+		-- if the user wants to build for experimental, they would use+		-- their sid chroot and sbuild's --extra-repository option to+		-- enable experimental+		, "rc-buggy"+		, "experimental"+		-- we assume that building for UNRELEASED means building for+		-- unstable+		, "UNRELEASED"+		-- the following is for dgit compatibility:+		, "UNRELEASED-"+			++ architectureToDebianArchString arch+			++ "-sbuild"+		] +	commandPrefix = case cc of+		UseCcache -> "/var/cache/ccache-sbuild/sbuild-setup":base+		_ -> base+	  where+		base = ["eatmydata"]+ -- | Ensure that an sbuild schroot's packages and apt indexes are updated -- -- This function is a convenience wrapper around 'updated', allowing the user to@@ -273,9 +305,8 @@ -- documentation for why you might want to use this property, and sample config. piupartsConfFor :: System -> Property DebianLike piupartsConfFor sys = property' ("piuparts schroot conf for " ++ show sys) $-	\w -> case (schrootFromSystem sys, stdMirror sys) of-			(Just s, Just u)  -> ensureProperty w $-				piupartsConf s u+	\w -> case schrootFromSystem sys of+			Just s -> ensureProperty w $ piupartsConf s 			_ -> errorMessage 				("don't know how to debootstrap " ++ show sys) @@ -291,48 +322,59 @@ --   piuparts in their @~/.sbuildrc@, which is inconvenient. -- -- To make use of this new schroot config, you can put something like this in--- your ~/.sbuildrc:+-- your ~/.sbuildrc (sbuild 0.71.0 or newer): -- --  >  $run_piuparts = 1; --  >  $piuparts_opts = [ --  >      '--schroot',---  >      'unstable-i386-piuparts',+--  >      '%r-%a-piuparts', --  >      '--fail-if-inadequate', --  >      '--fail-on-broken-symlinks', --  >      ];-piupartsConf :: SbuildSchroot -> Apt.Url -> Property DebianLike-piupartsConf s u = go-	`requires` (setupRevertableProperty $ built s u)-	`describe` ("piuparts schroot conf for " ++ show s)+--+-- This property has no effect if the corresponding sbuild schroot does not+-- exist (i.e. you also need 'Sbuild.built' or 'Sbuild.builtFor').+piupartsConf :: SbuildSchroot -> Property DebianLike+piupartsConf s@(SbuildSchroot _ arch) =+	check (doesFileExist (schrootConf s)) go+	`requires` installed   where 	go :: Property DebianLike-	go = tightenTargets $-		check (not <$> doesFileExist f)-			(File.basedOn f (schrootConf s, map munge))-		`before`-		ConfFile.containsIniSetting f (sec, "profile", "piuparts")-		`before`-		ConfFile.containsIniSetting f (sec, "aliases", "")-		`before`-		ConfFile.containsIniSetting f (sec, "command-prefix", "")-		`before`-		File.dirExists dir-		`before`-		File.isSymlinkedTo (dir </> "copyfiles")-			(File.LinkTarget $ orig </> "copyfiles")-		`before`-		File.isSymlinkedTo (dir </> "nssdatabases")-			(File.LinkTarget $ orig </> "nssdatabases")-		`before`-		File.basedOn (dir </> "fstab")-			(orig </> "fstab", filter (/= aptCacheLine))+	go = property' desc $ \w -> do+		aliases <- aliasesLine+		ensureProperty w $ combineProperties desc $ props+			& check (not <$> doesFileExist f)+				(File.basedOn f (schrootConf s, map munge))+			& ConfFile.containsIniSetting f+				(sec, "profile", "piuparts")+			& ConfFile.containsIniSetting f+				(sec, "aliases", aliases)+			& ConfFile.containsIniSetting f+				(sec, "command-prefix", "")+			& File.dirExists dir+			& File.isSymlinkedTo (dir </> "copyfiles")+				(File.LinkTarget $ orig </> "copyfiles")+			& File.isSymlinkedTo (dir </> "nssdatabases")+				(File.LinkTarget $ orig </> "nssdatabases")+			& File.basedOn (dir </> "fstab")+				(orig </> "fstab", filter (/= aptCacheLine))  	orig = "/etc/schroot/sbuild" 	dir = "/etc/schroot/piuparts" 	sec = show s ++ "-piuparts" 	f = schrootPiupartsConf s 	munge = replace "-sbuild]" "-piuparts]"+	desc = "piuparts schroot conf for " ++ show s +	-- normally the piuparts schroot conf has no aliases, but we have to add+	-- one, for dgit compatibility, if this is the default sid chroot+	aliasesLine = sidHostArchSchroot s >>= \isSidHostArchSchroot ->+			return $ if isSidHostArchSchroot+			then "UNRELEASED-"+				++ architectureToDebianArchString arch+				++ "-piuparts"+			else ""+ -- | Bind-mount /var/cache/apt/archives in all sbuild chroots so that the host -- system and the chroot share the apt cache --@@ -409,6 +451,11 @@ 			["kill $(cat /var/run/rngd.pid)"] 			`assume` MadeChange +ccacheMaybePrepared :: UseCcache -> Property DebianLike+ccacheMaybePrepared cc = case cc of+	UseCcache -> ccachePrepared+	NoCcache  -> doNothing+ -- another script from wiki.d.o/sbuild ccachePrepared :: Property DebianLike ccachePrepared = propertyList "sbuild group ccache configured" $ props@@ -468,3 +515,19 @@ schrootPiupartsConf :: SbuildSchroot -> FilePath schrootPiupartsConf (SbuildSchroot s a) = 	"/etc/schroot/chroot.d" </> s ++ "-" ++ architectureToDebianArchString a ++ "-piuparts-propellor"++-- Determine whether a schroot is+--+-- (i)  Debian sid, and+-- (ii) the same architecture as the host.+--+-- This is the "sid host arch schroot".  It is considered the default schroot+-- for sbuild builds, so we add useful aliases that work well with the suggested+-- ~/.sbuildrc given in the haddock+sidHostArchSchroot :: SbuildSchroot -> Propellor Bool+sidHostArchSchroot (SbuildSchroot suite arch) = do+	maybeOS <- getOS+	case maybeOS of+		Nothing -> return False+		Just (System _ hostArch) ->+			return $ suite == "unstable" && hostArch == arch

@@ -71,12 +71,8 @@ 		, "fi" 		, "echo Your game was recorded, as ID:$(basename \"$t\")" 		, "echo if you would like to talk about how it went, email scroll@joeyh.name"-		, "echo 'or, type comments below (finish with a dot on its own line)'"-		, "echo"-		, "echo Your comments:"-		, "timeout --kill-after 1m --foreground 2h mail -E -s \"scroll test $t\" joey@kitenet.net"+		, "read line" 		] `onChange` (g `File.mode` (combineModes (ownerWriteMode:readModes ++ executeModes)))-	& Apt.installed ["bsd-mailx"] 	-- prevent port forwarding etc by not letting scroll log in via ssh 	& Ssh.sshdConfig `File.containsLine` ("DenyUsers scroll") 		`onChange` Ssh.restarted

@@ -362,7 +362,7 @@ -- | Ensures that a local user's authorized_keys contains lines allowing -- logins from a remote user on the specified Host. ----- The ssh keys of the remote user can be set using `keysImported`+-- The ssh keys of the remote user can be set using `userKeys` -- -- Any other lines in the authorized_keys file are preserved as-is. authorizedKeysFrom :: User -> (User, Host) -> Property UnixLike

@@ -119,17 +119,12 @@ 			`describe` ("tor BandwidthRate " ++ v) 	Nothing -> property ("unable to parse " ++ s) noChange -hiddenServiceAvailable :: HiddenServiceName -> Int -> Property DebianLike-hiddenServiceAvailable hn port = hiddenServiceHostName $ hiddenService hn port-  where-	hiddenServiceHostName p =  adjustPropertySatisfy p $ \satisfy -> do-		r <- satisfy-		h <- liftIO $ readFile (varLib </> hn </> "hostname")-		warningMessage $ unwords ["hidden service hostname:", h]-		return r--hiddenService :: HiddenServiceName -> Int -> Property DebianLike-hiddenService hn port = ConfFile.adjustSection+-- | Enables a hidden service for a given port.+--+-- If used without `hiddenServiceData`, tor will generate a new+-- private key.+hiddenService :: HiddenServiceName -> Port -> Property DebianLike+hiddenService hn (Port port) = ConfFile.adjustSection 	(unwords ["hidden service", hn, "available on port", show port]) 	(== oniondir) 	(not . isPrefixOf "HiddenServicePort")@@ -141,6 +136,20 @@ 	oniondir = unwords ["HiddenServiceDir", varLib </> hn] 	onionport = unwords ["HiddenServicePort", show port, "127.0.0.1:" ++ show port] +-- | Same as `hiddenService` but also causes propellor to display+-- the onion address of the hidden service.+hiddenServiceAvailable :: HiddenServiceName -> Port -> Property DebianLike+hiddenServiceAvailable hn port = hiddenServiceHostName $ hiddenService hn port+  where+	hiddenServiceHostName p =  adjustPropertySatisfy p $ \satisfy -> do+		r <- satisfy+		mh <- liftIO $ tryIO $ readFile (varLib </> hn </> "hostname")+		case mh of+			Right h -> warningMessage $ unwords ["hidden service hostname:", h]+			Left _e -> warningMessage "hidden service hostname not available yet"+		return r++-- | Load the private key for a hidden service from the privdata. hiddenServiceData :: IsContext c => HiddenServiceName -> c -> Property (HasInfo + DebianLike) hiddenServiceData hn context = combineProperties desc $ props 	& installonion "hostname"