Remove remaining uses of "normal" attributes

diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index 24a3317882d533b0cefd647c8c35a74fb5f7c9e4..de96b3d16e5f8104e642b8d91c83766f18410c36 100644 (file)
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -1,32 +1,11 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config`
-# on 2020-07-19 17:37:03 UTC using RuboCop version 0.88.0.
+# on 2020-07-29 12:02:45 UTC using RuboCop version 0.88.0.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 15
-ChefCorrectness/NodeNormal:
-  Exclude:
-    - '**/metadata.rb'
-    - '**/Berksfile'
-    - 'cookbooks/dev/recipes/default.rb'
-    - 'cookbooks/mediawiki/resources/site.rb'
-    - 'cookbooks/networking/recipes/default.rb'
-    - 'cookbooks/openvpn/recipes/default.rb'
-    - 'cookbooks/web/recipes/backend.rb'
-    - 'cookbooks/wordpress/resources/site.rb'
-
-# Offense count: 12
-ChefCorrectness/NodeNormalUnless:
-  Exclude:
-    - '**/metadata.rb'
-    - '**/Berksfile'
-    - 'cookbooks/mailman/recipes/default.rb'
-    - 'cookbooks/mediawiki/resources/site.rb'
-    - 'cookbooks/wordpress/resources/site.rb'
-
 # Offense count: 1
 # Configuration parameters: Include.
 # Include: **/definitions/*.rb
@@ -34,7 +13,7 @@ ChefModernize/Definitions:
   Exclude:
     - 'cookbooks/networking/definitions/firewall_rule.rb'
 
-# Offense count: 1056
+# Offense count: 1038
 # Cop supports --auto-correct.
 # Configuration parameters: .
 # SupportedStyles: strings, symbols

diff --git a/cookbooks/chef/libraries/persistent_token.rb b/cookbooks/chef/libraries/persistent_token.rb
new file mode 100644 (file)
index 0000000..8299e85
--- /dev/null
+++ b/cookbooks/chef/libraries/persistent_token.rb
@@ -0,0 +1,20 @@
+require "digest"
+
+class Chef
+  module Mixin
+    module PersistentToken
+      def persistent_token(*args)
+        sha256 = Digest::SHA256.new
+        sha256.update(node[:machine_id])
+        args.each do |arg|
+          sha256.update(arg)
+        end
+        sha256.hexdigest
+      end
+    end
+  end
+
+  class Recipe
+    include Chef::Mixin::PersistentToken
+  end
+end

diff --git a/cookbooks/dev/metadata.rb b/cookbooks/dev/metadata.rb
index 0f689f52bfa5cc4fbb619d06729a7a509a0dd715..457e46dd090e4936639a5f67e5b48c6e3ad3c2ea 100644 (file)
--- a/cookbooks/dev/metadata.rb
+++ b/cookbooks/dev/metadata.rb
@@ -8,6 +8,7 @@ version           "1.0.0"
 supports          "ubuntu"
 depends           "apache"
 depends           "passenger"
+depends           "chef"
 depends           "geoipupdate"
 depends           "git"
 depends           "memcached"

diff --git a/cookbooks/dev/recipes/default.rb b/cookbooks/dev/recipes/default.rb
index 1888e9cdde5f12035b5a005242e525cfd9b82ece..e33c3b230e4d68d728aca6de963f6a92d993fdbd 100644 (file)
--- a/cookbooks/dev/recipes/default.rb
+++ b/cookbooks/dev/recipes/default.rb
@@ -258,9 +258,9 @@ if node[:postgresql][:clusters][:"12/main"]
 
     if details[:repository]
       site_aliases = details[:aliases] || []
-      secret_key_base = details[:secret_key_base] || SecureRandom.base64(96)
+      secret_key_base = persistent_token("dev", "rails", name, "secret_key_base")
 
-      node.normal[:dev][:rails][name][:secret_key_base] = secret_key_base
+      node.rm_normal(:dev, :rails, name)
 
       postgresql_database database_name do
         cluster "12/main"
@@ -447,8 +447,6 @@ if node[:postgresql][:clusters][:"12/main"]
         action :drop
         cluster "12/main"
       end
-
-      node.normal[:dev][:rails].delete(name)
     end
   end
 

diff --git a/cookbooks/mailman/metadata.rb b/cookbooks/mailman/metadata.rb
index dc12f2ffa69916d0b540cb7cd955dd2d8fd874c6..db8f66c693bc1ee6d181419cb2df119359b31166 100644 (file)
--- a/cookbooks/mailman/metadata.rb
+++ b/cookbooks/mailman/metadata.rb
@@ -7,3 +7,4 @@ description       "Installs and configures mailman"
 version           "1.0.0"
 supports          "ubuntu"
 depends           "apache"
+depends           "chef"

diff --git a/cookbooks/mailman/recipes/default.rb b/cookbooks/mailman/recipes/default.rb
index bd88b9d92e2232e225d94d90386009d58bf9c82f..1759bf50bacc3d3e86050ad02ba6955dfb43e6b3 100644 (file)
--- a/cookbooks/mailman/recipes/default.rb
+++ b/cookbooks/mailman/recipes/default.rb
@@ -23,13 +23,16 @@ include_recipe "apache"
 
 package "mailman"
 
-node.normal_unless[:mailman][:subscribe_form_secret] = SecureRandom.base64(48)
+node.rm_normal(:mailman, :subscribe_form_secret)
+
+subscribe_form_secret = persistent_token("mailman", "subscribe_form_secret")
 
 template "/etc/mailman/mm_cfg.py" do
   source "mm_cfg.py.erb"
   user "root"
   group "root"
   mode "644"
+  variables :subscribe_form_secret => subscribe_form_secret
   notifies :restart, "service[mailman]"
 end
 

diff --git a/cookbooks/mailman/templates/default/mm_cfg.py.erb b/cookbooks/mailman/templates/default/mm_cfg.py.erb
index 5252157f27e4e952eefaf9a8a8662b7a8d1f16bd..53b4990d45caf2914e66f5b2acb0d560467b2d3f 100644 (file)
--- a/cookbooks/mailman/templates/default/mm_cfg.py.erb
+++ b/cookbooks/mailman/templates/default/mm_cfg.py.erb
@@ -109,7 +109,7 @@ POSTFIX_STYLE_VIRTUAL_DOMAINS = ['openstreetmap.org']
 
 #-------------------------------------------------------------
 # Secret for web forms to protect against XSRF attacks
-SUBSCRIBE_FORM_SECRET='<%= node[:mailman][:subscribe_form_secret] %>'
+SUBSCRIBE_FORM_SECRET='<%= @subscribe_form_secret %>'
 
 # Note - if you're looking for something that is imported from mm_cfg, but you
 # didn't find it above, it's probably in /usr/lib/mailman/Mailman/Defaults.py.

diff --git a/cookbooks/mediawiki/metadata.rb b/cookbooks/mediawiki/metadata.rb
index 2c4ad74d080769d95e8fd703b0a0af7a93a791ca..6bc4c0ee6aa8cba7fe0b64502e1e5881c0e73d8c 100644 (file)
--- a/cookbooks/mediawiki/metadata.rb
+++ b/cookbooks/mediawiki/metadata.rb
@@ -9,6 +9,7 @@ supports          "ubuntu"
 depends           "accounts"
 depends           "apache"
 depends           "apt"
+depends           "chef"
 depends           "git"
 depends           "memcached"
 depends           "mysql"

diff --git a/cookbooks/mediawiki/resources/site.rb b/cookbooks/mediawiki/resources/site.rb
index de0651f3512aa49d8d880e812b1c170a751513ba..f2ff05050d5aa5d7716592f23fc6f383bff27b56 100644 (file)
--- a/cookbooks/mediawiki/resources/site.rb
+++ b/cookbooks/mediawiki/resources/site.rb
@@ -47,12 +47,14 @@ property :fpm_max_children, :kind_of => Integer, :default => 5
 property :reload_apache, :kind_of => [TrueClass, FalseClass], :default => true
 
 action :create do
-  node.normal_unless[:mediawiki][:sites][new_resource.site] = {}
+  node.rm_normal(:mediawiki, :sites, new_resource.site)
 
-  node.normal[:mediawiki][:sites][new_resource.site][:directory] = site_directory
-  node.normal[:mediawiki][:sites][new_resource.site][:version] = new_resource.version
+  node.default[:mediawiki][:sites][new_resource.site] = {
+    :directory => site_directory,
+    :version => new_resource.version
+  }
 
-  node.normal_unless[:mediawiki][:sites][new_resource.site][:wgSecretKey] = SecureRandom.base64(48)
+  secret_key = persistent_token("mediawiki", new_resource.site, "wgSecretKey")
 
   mysql_user "#{new_resource.database_user}@localhost" do
     password new_resource.database_password
@@ -172,7 +174,8 @@ action :create do
     variables :name => new_resource.site,
               :directory => mediawiki_directory,
               :database_params => database_params,
-              :mediawiki => mediawiki_params
+              :mediawiki => mediawiki_params,
+              :secret_key => secret_key
     notifies :run, "execute[#{mediawiki_directory}/maintenance/update.php]"
   end
 
@@ -592,6 +595,8 @@ action :delete do
 end
 
 action_class do
+  include Chef::Mixin::PersistentToken
+
   def site_directory
     new_resource.directory || "/srv/#{new_resource.site}"
   end

diff --git a/cookbooks/mediawiki/templates/default/LocalSettings.php.erb b/cookbooks/mediawiki/templates/default/LocalSettings.php.erb
index 0fd10ae3d24b1f1064318edc737700e4c32f5fd8..99670dc0f5fe0f591b401ab5bac397d9e16c67de 100644 (file)
--- a/cookbooks/mediawiki/templates/default/LocalSettings.php.erb
+++ b/cookbooks/mediawiki/templates/default/LocalSettings.php.erb
@@ -141,7 +141,7 @@ $wgLanguageCode = "en";
 $wgPageLanguageUseDB = true;
 $wgGroupPermissions['user']['pagelang'] = true;
 
-$wgSecretKey = '<%= @node[:mediawiki][:sites][@name][:wgSecretKey] %>';
+$wgSecretKey = '<%= @secret_key %>';
 
 # Site upgrade key. Must be set to a string (default provided) to turn on the
 # web installer while LocalSettings.php is in place

diff --git a/cookbooks/wordpress/resources/site.rb b/cookbooks/wordpress/resources/site.rb
index ee4f12b91614f17d956c9a6e5758b90cfa258d50..99b506fd43cc692cc1d160c7287beef8cecda76b 100644 (file)
--- a/cookbooks/wordpress/resources/site.rb
+++ b/cookbooks/wordpress/resources/site.rb
@@ -34,18 +34,20 @@ property :reload_apache, :kind_of => [TrueClass, FalseClass], :default => true
 action :create do
   version = new_resource.version || Chef::Wordpress.current_version
 
-  node.normal_unless[:wordpress][:sites][new_resource.site] = {}
+  node.rm_normal(:wordpress, :sites, new_resource.site)
 
-  node.normal[:wordpress][:sites][new_resource.site][:directory] = site_directory
+  node.default[:wordpress][:sites][new_resource.site] = {
+    :directory => site_directory
+  }
 
-  node.normal_unless[:wordpress][:sites][new_resource.site][:auth_key] = SecureRandom.base64(48)
-  node.normal_unless[:wordpress][:sites][new_resource.site][:secure_auth_key] = SecureRandom.base64(48)
-  node.normal_unless[:wordpress][:sites][new_resource.site][:logged_in_key] = SecureRandom.base64(48)
-  node.normal_unless[:wordpress][:sites][new_resource.site][:nonce_key] = SecureRandom.base64(48)
-  node.normal_unless[:wordpress][:sites][new_resource.site][:auth_salt] = SecureRandom.base64(48)
-  node.normal_unless[:wordpress][:sites][new_resource.site][:secure_auth_salt] = SecureRandom.base64(48)
-  node.normal_unless[:wordpress][:sites][new_resource.site][:logged_in_salt] = SecureRandom.base64(48)
-  node.normal_unless[:wordpress][:sites][new_resource.site][:nonce_salt] = SecureRandom.base64(48)
+  auth_key = persistent_token("wordpress", new_resource.site, "auth_key")
+  secure_auth_key = persistent_token("wordpress", new_resource.site, "secure_auth_key")
+  logged_in_key = persistent_token("wordpress", new_resource.site, "logged_in_key")
+  nonce_key = persistent_token("wordpress", new_resource.site, "nonce_key")
+  auth_salt = persistent_token("wordpress", new_resource.site, "auth_salt")
+  secure_auth_salt = persistent_token("wordpress", new_resource.site, "secure_auth_salt")
+  logged_in_salt = persistent_token("wordpress", new_resource.site, "logged_in_salt")
+  nonce_salt = persistent_token("wordpress", new_resource.site, "nonce_salt")
 
   mysql_user "#{new_resource.database_user}@localhost" do
     password new_resource.database_password
@@ -75,14 +77,14 @@ action :create do
     line.gsub!(/password_here/, new_resource.database_password)
     line.gsub!(/wp_/, new_resource.database_prefix)
 
-    line.gsub!(/('AUTH_KEY', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:auth_key]}'")
-    line.gsub!(/('SECURE_AUTH_KEY', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:secure_auth_key]}'")
-    line.gsub!(/('LOGGED_IN_KEY', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:logged_in_key]}'")
-    line.gsub!(/('NONCE_KEY', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:nonce_key]}'")
-    line.gsub!(/('AUTH_SALT', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:auth_salt]}'")
-    line.gsub!(/('SECURE_AUTH_SALT', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:secure_auth_salt]}'")
-    line.gsub!(/('LOGGED_IN_SALT', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:logged_in_salt]}'")
-    line.gsub!(/('NONCE_SALT', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:nonce_salt]}'")
+    line.gsub!(/('AUTH_KEY', *)'put your unique phrase here'/, "\\1'#{auth_key}'")
+    line.gsub!(/('SECURE_AUTH_KEY', *)'put your unique phrase here'/, "\\1'#{secure_auth_key}'")
+    line.gsub!(/('LOGGED_IN_KEY', *)'put your unique phrase here'/, "\\1'#{logged_in_key}'")
+    line.gsub!(/('NONCE_KEY', *)'put your unique phrase here'/, "\\1'#{nonce_key}'")
+    line.gsub!(/('AUTH_SALT', *)'put your unique phrase here'/, "\\1'#{auth_salt}'")
+    line.gsub!(/('SECURE_AUTH_SALT', *)'put your unique phrase here'/, "\\1'#{secure_auth_salt}'")
+    line.gsub!(/('LOGGED_IN_SALT', *)'put your unique phrase here'/, "\\1'#{logged_in_salt}'")
+    line.gsub!(/('NONCE_SALT', *)'put your unique phrase here'/, "\\1'#{nonce_salt}'")
 
     if line =~ /define\('WP_DEBUG'/
       line += "\n"
@@ -202,6 +204,7 @@ end
 
 action_class do
   include Chef::Mixin::EditFile
+  include Chef::Mixin::PersistentToken
 
   def site_directory
     new_resource.directory || "/srv/#{new_resource.site}"