#!/usr/bin/env python3 """ Write out a puppet cosmos-modules.conf """ import hashlib import os import os.path import sys import re import socket try: fqdn = socket.getfqdn() hostname = socket.gethostname() except OSError: host_info = None else: domainname = fqdn[len(hostname + ".") :] environ = "test" if (domainname.find("test") != -1) else "prod" customer = domainname.split(".")[0] host_info = { "customer": customer, "domainname": domainname, "environment": environ, "fqdn": fqdn, "hostname": hostname, } try: from configobj import ConfigObj OS_INFO = ConfigObj("/etc/os-release") except (IOError, ModuleNotFoundError): OS_INFO = None def get_file_hash(modulesfile): """ Based on https://github.com/python/cpython/pull/31930: should use hashlib.file_digest() but it is only available in python 3.11 """ try: with open(modulesfile, "rb") as fileobj: digestobj = hashlib.sha256() _bufsize = 2**18 buf = bytearray(_bufsize) # Reusable buffer to reduce allocations. view = memoryview(buf) while True: size = fileobj.readinto(buf) if size == 0: break # EOF digestobj.update(view[:size]) except FileNotFoundError: return "" return digestobj.hexdigest() def get_list_hash(file_lines): """Get hash of list contents""" file_lines_hash = hashlib.sha256() for line in file_lines: file_lines_hash.update(line) return file_lines_hash.hexdigest() def create_file_content(modules): """ Write out the expected file contents to a list so we can check the expected checksum before writing anything """ file_lines = [] file_lines.append( "# Generated by {}\n".format( # pylint: disable=consider-using-f-string os.path.basename(sys.argv[0]) ).encode("utf-8") ) for key in modules: file_lines.append( "{0:11} {1} {2} {3}\n".format( # pylint: disable=consider-using-f-string key, modules[key]["repo"], modules[key]["upgrade"], modules[key]["tag"], ).encode("utf-8") ) return file_lines def main(): """Starting point of the program""" modulesfile: str = "/etc/puppet/cosmos-modules.conf" modulesfile_tmp: str = modulesfile + ".tmp" modules: dict = { "sunet": { "repo": "https://github.com/SUNET/puppet-sunet.git", "upgrade": "yes", "tag": "stable-2*", }, "nagioscfg": { "repo": "https://github.com/SUNET/puppet-nagioscfg.git", "upgrade": "yes", "tag": "sunet-2*", }, } # When/if we want we can do stuff to modules here if OS_INFO: if OS_INFO["VERSION_CODENAME"] == "bullseye": pass if host_info: if re.match('^internal-[^-]+-test-[^-]+-\d+.geteduroam.sunet.se$', host_info["fqdn"]): #modules["sunet"]["tag"] = "testing-2*" modules["sunet"]["tag"] = "jocar-prevent-realm-spoof-2*" # Build list of expected file content file_lines = create_file_content(modules) # Get hash of the list list_hash = get_list_hash(file_lines) # Get hash of the existing file on disk file_hash = get_file_hash(modulesfile) # Update the file if necessary if list_hash != file_hash: # Since we are reading the file with 'rb' when computing our hash use 'wb' when # writing so we dont end up creating a file that does not match the # expected hash with open(modulesfile_tmp, "wb") as fileobj: for line in file_lines: fileobj.write(line) # Rename it in place so the update is atomic for anything else trying to # read the file os.rename(modulesfile_tmp, modulesfile) if __name__ == "__main__": main()