Issue 122 - Puppet ENC via Hiera

hiera/install-precise.py

+#!/usr/bin/env python 
+import base64
+import distutils.spawn
+import io
+import os
+import subprocess
+import sys
+
+if distutils.spawn.find_executable('puppet') \
+    and distutils.spawn.find_executable('hiera'):
+  sys.exit(os.EX_OK)
+
+PUPPETLABS_SOURCES = '''
+deb http://apt.puppetlabs.com precise main
+deb-src http://apt.puppetlabs.com precise main'''
+
+PUPPETLABS_PREFS = '''
+# Puppetlabs packages (e.g. hiera) would attempt to install a puppet 3.x
+# or later release (which is not available in precise) if not pinned here
+Package: puppet puppet-common
+Pin: version 2.7.11-*
+Pin-Priority: 1000'''
+
+PUPPETLABS_GPG_KEY = '''
+mQINBEw3u0ABEAC1+aJQpU59fwZ4mxFjqNCgfZgDhONDSYQFMRnYC1dzBpJHzI6bfUBQeaZ8rh6N
+4kZ+wq1eL86YDXkCt4sCvNTP0eF2XaOLbmxtV9bdpTIBep9bQiKg5iZaz+brUZlFk/MyJ0Yz//VQ
+68N1uvXccmD6uxQsVO+gx7rnarg/BGuCNaVtGwy+S98g8Begwxs9JmGa8pMCcSxtC7fAfAEZ02cY
+yrw5KfBvFI3cHDdBqrEJQKwKeLKYGHK3+H1TM4ZMxPsLuR/XKCbvTyl+OCPxU2OxPjufAxLlr8BW
+UzgJv6ztPe9imqpHPpp3KuLFNorjPqWY5jSgKl94W/CO2x591e++a1PhwUn7iVUwVVe+mOEWnK5+
+Fd0vVMQebYCXS+3dNf6gxSvhz8etpw20T9Ytg4EdhLvCJRV/pYlqhcq+E9le1jFOHOc0Nc5FQweU
+tHGaNVyn8S1hvnvWJBMxpXq+Bezfk3X8PhPT/l9O2lLFOOO08jo0OYiIwrjhMQQOOSZOb3vBRvBZ
+NnnxPrcdjUUm/9cVB8VcgI5KFhG7hmMCwH70tpUWcZCNNlI1wj/PJ7Tlxjy44f1o4CQ5FxuozkiI
+TJvh9CTg+k3wEmiaGz65w9jRl9ny2gElf4CR5+ba+w2dpuDeMwiHJIs5JsGyJjmA5/0xytB7QvgM
+s2q25vWhygsmUQARAQABtEdQdXBwZXQgTGFicyBSZWxlYXNlIEtleSAoUHVwcGV0IExhYnMgUmVs
+ZWFzZSBLZXkpIDxpbmZvQHB1cHBldGxhYnMuY29tPokCPgQTAQIAKAIbAwYLCQgHAwIGFQgCCQoL
+BBYCAwECHgECF4AFAk/x5PoFCQtIMjoACgkQEFS3okvW7DAIKQ/9HvZyf+LHVSkCk92Kb6gcknii
+n3+5ooz67hSr8miGBfK4eocqQ0H7bdtWjAILzR/IBY0xj6OHKhYP2k8TLc7QhQjt0dRpNkX+Iton
+2AZryV7vUADreYz44B0bPmhiE+LL46ET5IThLKu/KfihzkEEBa9/t178+dO9zCM2xsXaiDhMOxVE
+32gXvSZKP3hmvnK/FdylUY3nWtPedr+lHpBLoHGaPH7cjI+MEEugU3oAJ0jpq3V8n4w0jIq2V77w
+fmbD9byIV7dXcxApzciK+ekwpQNQMSaceuxLlTZKcdSqo0/qmS2A863YZQ0ZBe+Xyf5OI33+y+Mr
+y+vl6Lre2VfPm3udgR10E4tWXJ9Q2CmG+zNPWt73U1FD7xBI7PPvOlyzCX4QJhy2Fn/fvzaNjHp4
+/FSiCw0HvX01epcersyun3xxPkRIjwwRM9m5MJ0o4hhPfa97zibXSh8XXBnosBQxeg6nEnb26eor
+VQbqGx0ruu/W2m5/JpUfREsFmNOBUbi8xlKNS5CZypH3Zh88EZiTFolOMEh+hT6s0l6znBAGGZ4m
+/Unacm5yDHmg7unCk4JyVopQ2KHMoqG886elu+rm0ASkhyqBAk9sWKptMl3NHiYTRE/m9VAkugVI
+B2pi+8u84f+an4Hml4xlyijgYu05pqNvnLRyJDLd61hviLC8GYWwAgAD'''

[Wladimir Palant, 2014/11/17 16:43:36]

https://pgp.mit.edu/pks/lookup?op=get&search=0x1054B7A24BD6EC30 is the same key,
right? Why not copy the text from there and import it as-is, without doing
base64 decoding yourself? That's actually what we discussed here...

[mathias, 2014/11/27 00:30:18]

In fact I do not recall us discussing to use the stuff from that URL explicitly,
though I remember us discussing the possibility for something like that.
However, the link above is not the same key (it's for YUM and TAR.GZ, not DEB),
we'll use http://apt.puppetlabs.com/pubkey.gpg 

+
+handle = subprocess.Popen(['apt-key', 'add', '-'], stdin=subprocess.PIPE)

[Wladimir Palant, 2014/11/17 16:43:36]

I was already considering asking for that handle to be closed when I realized
that this isn't actually a handle - it's a process object ;)

Maybe use a better variable name?

[mathias, 2014/11/27 00:30:18]

Done.

+decoded_key = base64.b64decode(PUPPETLABS_GPG_KEY)
+handle.communicate(decoded_key)
+
+with io.open('/etc/apt/sources.list.d/puppetlabs.list', 'wb') as handle:
+  handle.write(PUPPETLABS_SOURCES)
+
+with io.open('/etc/apt/preferences.d/puppetlabs', 'wb') as handle:
+  handle.write(PUPPETLABS_PREFS)
+
+subprocess.check_call(['apt-get', '-y', 'update'])
+subprocess.check_call(['apt-get', '-y', 'install', 'puppet'])
+subprocess.check_call(['apt-get', '-y', 'install', 'hiera-puppet'])
+
+if not os.path.exists('/etc/puppet/hiera.yaml'):
+  config = os.path.dirname(__file__) + '/hiera.yaml'

[Wladimir Palant, 2014/11/17 16:43:36]

Please use os.path.join() instead of string concatenation here.

[mathias, 2014/11/27 00:30:18]

Done.

+  if os.path.exists(config):
+    os.symlink(config, '/etc/puppet/hiera.yaml')