Merge ~pjdc/ubuntu-mirror-charm/+git/ubuntu-mirror-charm:shared-triggers into ubuntu-mirror-charm:master

[Paul Collins]

merge triggers where key is the same

Unmerged commits

1dc2669... by Paul Collins on 2020-07-31

add test case for extract_ssh_public_key

7f14448... by Paul Collins on 2020-07-31

merge triggers where key is the same

d0f72d8... by Paul Collins on 2020-07-31

ignore compiled Python

diff --git a/.gitignore b/.gitignore
index 490cc43..526bc62 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
 *~
 *.charm
+*.pyc
+*.pyo
 .tox
 .coverage
 __pycache__
diff --git a/hooks/hooks.py b/hooks/hooks.py
index c4d3d47..c1d5a2a 100755
--- a/hooks/hooks.py
+++ b/hooks/hooks.py
@@ -45,6 +45,10 @@ from charmhelpers.payload.execd import execd_run
 from Cheetah.Template import Template
 from Config import Config
 
+from utils import (
+    extract_ssh_public_key,
+)
+
 hooks = Hooks()
 
 apache_tls_settings = {
@@ -565,17 +569,35 @@ def configure_vsftp(conf, hostname):
     log("CHARM: Finished configuring vsftp")
 
 
-#
-# Set up any external ssh sync triggers
-#
-def configure_triggers(conf, hostname):
+SSH_TRIGGER_TEMPLATE = 'no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="{command}",{trigger}'
+
+
+# cdimage-builder.internal triggers releases and cdimage using the
+# same key, so when this unit has both roles, sync both of them.
+def merge_shared_key_triggers(conf, triggers):
+    """Merge (in place) triggers that use the same ssh key."""
+
+    cdimage_key = extract_ssh_public_key(triggers.get('cdimage'))
+    releases_key = extract_ssh_public_key(triggers.get('releases'))
+    if cdimage_key and releases_key and cdimage_key == releases_key:
+        releases = conf.mirror_map('releases')
+        cdimage = conf.mirror_map('cdimage')
+        command = '( {releases_command} releases ; {cdimage_command} cdimage ) &'.format(
+            releases_command=os.path.join(conf.script_dir(), releases['command']),
+            cdimage_command=os.path.join(conf.script_dir(), cdimage['command']),
+        )
+        triggers['releases'] = SSH_TRIGGER_TEMPLATE.format(
+            command=command,
+            trigger=releases['trigger'],
+        )
+        del(triggers['cdimage'])
+
+
+def make_triggers(conf, hostname):
+    """Return this unit's triggers in a dict, keyed by role."""
     roles = conf.roles()
-    if hostname not in roles:
-        return
 
-    template = 'no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="${command}",${trigger}'
-    tmpl_data = {}
-    contents = ""
+    triggers = {}
 
     for role in roles[hostname]:
         try:
@@ -587,15 +609,30 @@ def configure_triggers(conf, hostname):
             continue
         else:
             if mirror["trigger"]:
-                tmpl_data["command"] = "%s %s &" % (os.path.join(conf.script_dir(), mirror["command"]), role)
-                tmpl_data["trigger"] = mirror["trigger"]
-                contents += str(Template(template, tmpl_data)) + "\n"
+                triggers[role] = SSH_TRIGGER_TEMPLATE.format(
+                    command="%s %s &" % (os.path.join(conf.script_dir(), mirror["command"]), role),
+                    trigger=mirror["trigger"],
+                )
+
+    return triggers
+
+
+#
+# Set up any external ssh sync triggers
+#
+def configure_triggers(conf, hostname):
+    roles = conf.roles()
+    if hostname not in roles:
+        return
+
+    triggers = make_triggers(conf, hostname)
+    merge_shared_key_triggers(conf, triggers)
 
     keyfile = get_ssh_keyfile(conf.mirror_user())
     ssh_dir = os.path.dirname(keyfile)
     if not os.path.isdir(ssh_dir):
         mkdir(ssh_dir)
-    write_file(keyfile, contents)
+    write_file(keyfile, '\n'.join(triggers.values()) + '\n')
 
 
 def configure_nrpe(conf, hostname):  # noqa: C901
diff --git a/hooks/utils.py b/hooks/utils.py
new file mode 100644
index 0000000..2d10a21
--- /dev/null
+++ b/hooks/utils.py
@@ -0,0 +1,11 @@
+def extract_ssh_public_key(key):
+    """Return the field after the field that begins with "ssh-", which
+    should be the key itself.  This function can therefore cope with
+    fairly arbitrarily-decorated ssh keys, e.g. those with "from", etc."""
+
+    kelts = key.split(' ')
+    while kelts:
+        # This doesn't work for every type of key, but nobody should be using ECDSA anyway.
+        if kelts.pop(0).startswith('ssh-'):
+            return kelts[0]
+    return None
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/requirements.txt
diff --git a/tests/unit/requirements.txt b/tests/unit/requirements.txt
new file mode 100644
index 0000000..786ff01
--- /dev/null
+++ b/tests/unit/requirements.txt
@@ -0,0 +1,6 @@
+# test requirements
+mock
+pytest
+pytest-cov
+# charm requirements
+pyyaml
diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
new file mode 100644
index 0000000..3a15841
--- /dev/null
+++ b/tests/unit/test_charm.py
@@ -0,0 +1,13 @@
+import unittest
+
+from utils import (
+    extract_ssh_public_key,
+)
+
+BARE_RELEASES_SSH_KEY = "AAAAB3NzaC1yc2EAAAABIwAAAQEA7TIXsws/s48o4N1MA+TpaudHS8XVF79JujYQGTumroZZqbsr04lbg1FaJ9HyS9P31e8lP2bmB5rexJaMyfAxDTV+DtrHXmeLi/XcGSOXoliOa/j3eQmdZyYme9z+Tfp8s3S6nxuDP3BRKkOuIzOPgPO5fr8AH7y83v3fyHi+H0sbm6agX2b+xV9oP8+DEgSxPNfZEVTgpdJ7/ULwAl68mWQW0w6VTVx0CMYF+cvcorcZMGmy+THzk8WH2XRalA5HqeiBtS7vJ+yFHJ5WbQOEUeR6gHRcrogR4Yd10eFWUNAFyvt53zF7W91PEgnJWjcCUN/uctybAFSgDK1UB6TPkQ=="  # noqa: E501
+RELEASES_SSH_KEY = 'from="91.189.90.151,91.189.89.127,10.22.96.61,10.22.96.161" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA7TIXsws/s48o4N1MA+TpaudHS8XVF79JujYQGTumroZZqbsr04lbg1FaJ9HyS9P31e8lP2bmB5rexJaMyfAxDTV+DtrHXmeLi/XcGSOXoliOa/j3eQmdZyYme9z+Tfp8s3S6nxuDP3BRKkOuIzOPgPO5fr8AH7y83v3fyHi+H0sbm6agX2b+xV9oP8+DEgSxPNfZEVTgpdJ7/ULwAl68mWQW0w6VTVx0CMYF+cvcorcZMGmy+THzk8WH2XRalA5HqeiBtS7vJ+yFHJ5WbQOEUeR6gHRcrogR4Yd10eFWUNAFyvt53zF7W91PEgnJWjcCUN/uctybAFSgDK1UB6TPkQ== cjwatson@little'  # noqa: E501
+
+
+class TestUbuntuMirrorCharmUtils(unittest.TestCase):
+    def test_extract_ssh_public_key(self):
+        self.assertEqual(extract_ssh_public_key(RELEASES_SSH_KEY), BARE_RELEASES_SSH_KEY)
diff --git a/tox.ini b/tox.ini
index 7898f03..7c38a0b 100644
--- a/tox.ini
+++ b/tox.ini
@@ -10,13 +10,13 @@ setenv =
 
 [testenv:unit]
 commands =
-    pytest --ignore mod --ignore {toxinidir}/tests/functional \
-      {posargs:-v  --cov=src --cov-report=term-missing --cov-branch}
+    pytest --ignore {toxinidir}/tests/functional \
+      {posargs:-v  --cov=hooks --cov-report=term-missing --cov-branch}
 deps = -r{toxinidir}/tests/unit/requirements.txt
        -r{toxinidir}/requirements.txt
 setenv =
-  PYTHONPATH={toxinidir}/src:{toxinidir}/build/lib:{toxinidir}/build/venv
-  TZ=UTC
+  PYTHONPATH = {toxinidir}/hooks
+  TZ = UTC
 
 [testenv:functional]
 passenv =