Merge lp:~hopem/charm-helpers/lp1518975 into lp:charm-helpers

[Edward Hope-Morley]

[James Page (james-page)]

review: Needs Fixing

[lp:~hopem/charm-helpers/lp1518975]

530. By Edward Hope-Morley on 2016-02-11

import_pgp_key() > import_key()

Unmerged revisions

=== modified file 'charmhelpers/contrib/openstack/utils.py'
--- charmhelpers/contrib/openstack/utils.py	2016-01-13 21:13:51 +0000
+++ charmhelpers/contrib/openstack/utils.py	2016-02-11 15:34:16 +0000
@@ -25,6 +25,7 @@
 import re
 
 import six
+import tempfile
 import traceback
 import uuid
 import yaml
@@ -41,6 +42,7 @@
     config,
     log as juju_log,
     charm_dir,
+    DEBUG,
     INFO,
     related_units,
     relation_ids,
@@ -347,12 +349,42 @@
 
 
 def import_key(keyid):
-    cmd = "apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 " \
-          "--recv-keys %s" % keyid
-    try:
-        subprocess.check_call(cmd.split(' '))
-    except subprocess.CalledProcessError:
-        error_out("Error importing repo key %s" % keyid)
+    key = keyid.strip()
+    if (key.startswith('-----BEGIN PGP PUBLIC KEY BLOCK-----') and
+            key.endswith('-----END PGP PUBLIC KEY BLOCK-----')):
+        juju_log("PGP key found (looks like ASCII Armor format)", level=DEBUG)
+        juju_log("Importing ASCII Armor PGP key", level=DEBUG)
+        with tempfile.NamedTemporaryFile() as keyfile:
+            with open(keyfile.name, 'w') as fd:
+                fd.write(key)
+                fd.write("\n")
+
+            cmd = ['apt-key', 'add', keyfile.name]
+            try:
+                subprocess.check_call(cmd)
+            except subprocess.CalledProcessError:
+                error_out("Error importing PGP key '%s'" % key)
+    else:
+        juju_log("PGP key found (looks like Radix64 format)", level=DEBUG)
+        juju_log("Importing PGP key from keyserver", level=DEBUG)
+        cmd = ['apt-key', 'adv', '--keyserver',
+               'hkp://keyserver.ubuntu.com:80', '--recv-keys', key]
+        try:
+            subprocess.check_call(cmd)
+        except subprocess.CalledProcessError:
+            error_out("Error importing PGP key '%s'" % key)
+
+
+def get_source_and_pgp_key(input):
+    """Look for a pgp key ID or ascii-armor key in the given input."""
+    index = input.strip()
+    index = input.rfind('|')
+    if index < 0:
+        return input, None
+
+    key = input[index + 1:].strip('|')
+    source = input[:index]
+    return source, key
 
 
 def configure_installation_source(rel):
@@ -364,16 +396,16 @@
         with open('/etc/apt/sources.list.d/juju_deb.list', 'w') as f:
             f.write(DISTRO_PROPOSED % ubuntu_rel)
     elif rel[:4] == "ppa:":
-        src = rel
+        src, key = get_source_and_pgp_key(rel)
+        if key:
+            import_key(key)
+
         subprocess.check_call(["add-apt-repository", "-y", src])
     elif rel[:3] == "deb":
-        l = len(rel.split('|'))
-        if l == 2:
-            src, key = rel.split('|')
-            juju_log("Importing PPA key from keyserver for %s" % src)
+        src, key = get_source_and_pgp_key(rel)
+        if key:
             import_key(key)
-        elif l == 1:
-            src = rel
+
         with open('/etc/apt/sources.list.d/juju_deb.list', 'w') as f:
             f.write(src)
     elif rel[:6] == 'cloud:':

=== modified file 'tests/contrib/openstack/test_openstack_utils.py'
--- tests/contrib/openstack/test_openstack_utils.py	2016-01-13 21:13:51 +0000
+++ tests/contrib/openstack/test_openstack_utils.py	2016-02-11 15:34:16 +0000
@@ -1,6 +1,7 @@
 import io
 import os
 import subprocess
+import tempfile
 import unittest
 from copy import copy
 from testtools import TestCase
@@ -114,6 +115,21 @@
 
 # Mock python-dnspython resolver used by get_host_ip()
 
+PGP_KEY_ASCII_ARMOR = """-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: SKS 1.1.5
+Comment: Hostname: keyserver.ubuntu.com
+
+mI0EUCEyTAEEAMuUxyfiegCCwn4J/c0nw5PUTSJdn5FqiUTq6iMfij65xf1vl0g/Mxqw0gfg
+AJIsCDvO9N9dloLAwF6FUBMg5My7WyhRPTAKF505TKJboyX3Pp4J1fU1LV8QFVOp87vUh1Rz
+B6GU7cSglhnbL85gmbJTllkzkb3h4Yw7W+edjcQ/ABEBAAG0K0xhdW5jaHBhZCBQUEEgZm9y
+IFVidW50dSBDbG91ZCBBcmNoaXZlIFRlYW2IuAQTAQIAIgUCUCEyTAIbAwYLCQgHAwIGFQgC
+CQoLBBYCAwECHgECF4AACgkQimhEop9oEE7kJAP/eTBgq3Mhbvo0d8elMOuqZx3nmU7gSyPh
+ep0zYIRZ5TJWl/7PRtvp0CJA6N6ZywYTQ/4ANHhpibcHZkh8K0AzUvsGXnJRSFoJeqyDbD91
+EhoO+4ZfHs2HvRBQEDZILMa2OyuB497E5Mmyua3HDEOrG2cVLllsUZzpTFCx8NgeMHk=
+=jLBm
+-----END PGP PUBLIC KEY BLOCK-----
+"""
+
 
 class FakeAnswer(object):
     def __init__(self, ip):
@@ -490,25 +506,40 @@
         _e = 'Invalid Cloud Archive release specified: foo-bar'
         mocked_error.assert_called_with(_e)
 
-    def test_import_apt_key(self):
+    @patch.object(openstack, 'juju_log', lambda *args, **kwargs: None)
+    def test_import_apt_key_radix(self):
         '''Ensure shell out apt-key during key import'''
         with patch('subprocess.check_call') as _subp:
             openstack.import_key('foo')
-            cmd = ['apt-key', 'adv', '--keyserver', 'hkp://keyserver.ubuntu.com:80',
-                   '--recv-keys', 'foo']
+            cmd = ['apt-key', 'adv', '--keyserver',
+                   'hkp://keyserver.ubuntu.com:80', '--recv-keys', 'foo']
             _subp.assert_called_with(cmd)
 
+    @patch.object(openstack, 'juju_log', lambda *args, **kwargs: None)
+    def test_import_apt_key_ascii_armor(self):
+        with tempfile.NamedTemporaryFile() as tmp:
+            with patch.object(openstack, 'tempfile') as \
+                    mock_tmpfile:
+                tmpfile = mock_tmpfile.NamedTemporaryFile.return_value
+                tmpfile.__enter__.return_value = tmpfile
+                tmpfile.name = tmp.name
+                with patch('subprocess.check_call') as _subp:
+                    openstack.import_key(PGP_KEY_ASCII_ARMOR)
+                    cmd = ['apt-key', 'add', tmp.name]
+                    _subp.assert_called_with(cmd)
+
+    @patch.object(openstack, 'juju_log', lambda *args, **kwargs: None)
     @patch('charmhelpers.contrib.openstack.utils.error_out')
     def test_import_bad_apt_key(self, mocked_error):
         '''Ensure error when importing apt key fails'''
         with patch('subprocess.check_call') as _subp:
-            cmd = ['apt-key', 'adv', '--keyserver', 'hkp://keyserver.ubuntu.com:80',
-                   '--recv-keys', 'foo']
+            cmd = ['apt-key', 'adv', '--keyserver',
+                   'hkp://keyserver.ubuntu.com:80', '--recv-keys', 'foo']
             _subp.side_effect = subprocess.CalledProcessError(1, cmd, '')
             openstack.import_key('foo')
-            cmd = ['apt-key', 'adv', '--keyserver', 'hkp://keyserver.ubuntu.com:80',
-                   '--recv-keys', 'foo']
-        mocked_error.assert_called_with('Error importing repo key foo')
+            cmd = ['apt-key', 'adv', '--keyserver',
+                   'hkp://keyserver.ubuntu.com:80', '--recv-keys', 'foo']
+        mocked_error.assert_called_with("Error importing PGP key 'foo'")
 
     @patch('os.mkdir')
     @patch('os.path.exists')