Refactors (ready for review)

.sync.yml

@@ -1,3 +1,5 @@
 ---
 spec/spec_helper.rb:
   hiera_config: spec/fixtures/hiera.yaml
+  coverage_report: true
+  minimum_code_coverage_percentage: 100

data/os/AIX.yaml

@@ -0,0 +1,10 @@
+---
+ca_cert::supported:             true
+ca_cert::trusted_cert_dir:      '/var/ssl/certs'
+ca_cert::update_cmd:            '/usr/bin/c_rehash'
+ca_cert::cert_dir_group:        'system'
+ca_cert::cert_dir_mode:         '0755'
+ca_cert::package_name:          'ca-certificates'
+ca_cert::ca::ca_file_group:     'system'
+ca_cert::ca::ca_file_mode:      '0644'
+ca_cert::ca::ca_file_extension: 'crt'

data/os/Archlinux.yaml

@@ -0,0 +1,11 @@
+---
+ca_cert::supported:             true
+ca_cert::trusted_cert_dir:      '/etc/ca-certificates/trust-source/anchors/'
+ca_cert::distrusted_cert_dir:   '/etc/ca-certificates/trust-source/blacklist'
+ca_cert::update_cmd:            'trust extract-compat'
+ca_cert::cert_dir_group:        'root'
+ca_cert::cert_dir_mode:         '0755'
+ca_cert::package_name:          'ca-certificates'
+ca_cert::ca::ca_file_group:     'root'
+ca_cert::ca::ca_file_mode:      '0644'
+ca_cert::ca::ca_file_extension: 'crt'

data/os/Debian.yaml

@@ -0,0 +1,10 @@
+---
+ca_cert::supported:             true
+ca_cert::trusted_cert_dir:      '/usr/local/share/ca-certificates'
+ca_cert::update_cmd:            'update-ca-certificates'
+ca_cert::cert_dir_group:        'staff'
+ca_cert::cert_dir_mode:         '2665'
+ca_cert::package_name:          'ca-certificates'
+ca_cert::ca::ca_file_group:     'root'
+ca_cert::ca::ca_file_mode:      '0444'
+ca_cert::ca::ca_file_extension: 'crt'

data/os/RedHat.yaml

@@ -0,0 +1,10 @@
+---
+ca_cert::supported:             true
+ca_cert::trusted_cert_dir:      '/etc/pki/ca-trust/source/anchors'
+ca_cert::distrusted_cert_dir:   '/etc/pki/ca-trust/source/blacklist'
+ca_cert::update_cmd:            'update-ca-trust extract'
+ca_cert::cert_dir_group:        'root'
+ca_cert::cert_dir_mode:         '0755'
+ca_cert::ca::ca_file_group:     'root'
+ca_cert::ca::ca_file_mode:      '0644'
+ca_cert::ca::ca_file_extension: 'crt'

data/os/Solaris.yaml

@@ -0,0 +1,9 @@
+---
+ca_cert::trusted_cert_dir:      '/etc/certs/CA/'
+ca_cert::update_cmd:            '/usr/sbin/svcadm restart /system/ca-certificates'
+ca_cert::cert_dir_group:        'sys'
+ca_cert::cert_dir_mode:         '0755'
+ca_cert::package_name:          'ca-certificates'
+ca_cert::ca::ca_file_group:     'root'
+ca_cert::ca::ca_file_mode:      '0444'
+ca_cert::ca::ca_file_extension: 'pem'

data/os/Solaris/11.yaml

@@ -0,0 +1,2 @@
+---
+ca_cert::supported:             true

data/os/Suse.yaml

@@ -0,0 +1,11 @@
+---
+ca_cert::supported:             true
+ca_cert::trusted_cert_dir:      '/etc/pki/trust/anchors'
+ca_cert::distrusted_cert_dir:   '/etc/pki/trust/blacklist'
+ca_cert::update_cmd:            'update-ca-certificates'
+ca_cert::cert_dir_group:        'root'
+ca_cert::cert_dir_mode:         '0755'
+ca_cert::package_name:          'ca-certificates'
+ca_cert::ca::ca_file_group:     'root'
+ca_cert::ca::ca_file_mode:      '0644'
+ca_cert::ca::ca_file_extension: 'crt'

data/os/Suse/10.yaml

@@ -0,0 +1,5 @@
+---
+ca_cert::trusted_cert_dir:      '/etc/ssl/certs'
+ca_cert::update_cmd:            'c_rehash'
+ca_cert::package_name:          'openssl-certs'
+ca_cert::ca::ca_file_extension: 'pem'

data/os/Suse/11.yaml

@@ -0,0 +1,5 @@
+---
+ca_cert::trusted_cert_dir:      '/etc/ssl/certs'
+ca_cert::update_cmd:            'c_rehash'
+ca_cert::package_name:          'openssl-certs'
+ca_cert::ca::ca_file_extension: 'pem'

data/os/Ubuntu.yaml

@@ -0,0 +1,10 @@
+---
+ca_cert::supported:             true
+ca_cert::trusted_cert_dir:      '/usr/local/share/ca-certificates'
+ca_cert::update_cmd:            'update-ca-certificates'
+ca_cert::cert_dir_group:        'staff'
+ca_cert::cert_dir_mode:         '0755'
+ca_cert::package_name:          'ca-certificates'
+ca_cert::ca::ca_file_group:     'root'
+ca_cert::ca::ca_file_mode:      '0444'
+ca_cert::ca::ca_file_extension: 'crt'

hiera.yaml

@@ -0,0 +1,21 @@
+---
+version: 5
+
+defaults:  # Used for any hierarchy level that omits these keys.
+  datadir: data         # This path is relative to hiera.yaml's directory.
+  data_hash: yaml_data  # Use the built-in YAML backend.
+
+hierarchy:
+  - name: "osfamily/major release"
+    paths:
+        # Used to distinguish between Debian and Ubuntu
+      - "os/%{facts.os.name}/%{facts.os.release.major}.yaml"
+      - "os/%{facts.os.family}/%{facts.os.release.major}.yaml"
+        # Used for Solaris
+      - "os/%{facts.os.family}/%{facts.kernelrelease}.yaml"
+  - name: "osfamily"
+    paths:
+      - "os/%{facts.os.name}.yaml"
+      - "os/%{facts.os.family}.yaml"
+  - name: 'common'
+    path: 'common.yaml'

manifests/ca.pp

@@ -1,69 +1,64 @@
-# ca.pp
+# @summary
+#   Manage a CA Certificate on a system. This cannot manage pre-installed
+#   operating system CAs.
 #
-# Manage a CA Certificate on a system. This cannot manage pre-installed
-# operating system CAs.
+# @example
+#   ca_cert::ca { 'globalsign_org_intermediate':
+#     source => 'http://secure.globalsign.com/cacert/gsorganizationvalsha2g2r1.crt',
+#   }
 #
-# === Parameters
+# @author
+#   Phil Fenstermacher <phillip.fenstermacher@gmail.com>
 #
-# [*ca_text*]
+# @param ca_text
 #   The text of the CA certificate to install. Required if text is the source
 #   (default). If a different source is specified this parameter is ignored.
-# [*source*]
+#
+# @param source
 #   Where the CA certificate should be retrieved from. text, http, https, ftp,
 #   file, and puppet protocols/sources are supported. If text, then the ca_text parameter
 #   is also required. Defaults to text.
-# [*ensure*]
+#
+# @param ensure
 #   Whether or not the CA certificate should be on a system or not. Valid
 #   values are trusted, present, distrusted, and absent. Note: untrusted is
 #   not supported on Debian based systems - using it will log a warning
-#   and treat it the same as absent. (defaults to trusted)
-# [*verify_https_cert*]
+#   and treat it the same as absent. (defaults to trusted).
+#
+# @param verify_https_cert
 #   When retrieving a certificate whether or not to validate the CA of the
 #   source. (defaults to true)
-# [*checksum*]
+#
+# @param checksum
 #   The checksum of the file. (defaults to undef)
-# [*checksum_type*]
+#
+# @param checksum_type
 #   The type of file checksum. (defauts to undef)
-# [*ca_file_group*]
+#
+# @param ca_file_group
 #   The installed CA certificate's POSIX group permissions. This uses
 #   the same syntax as Puppet's native file resource's "group" parameter.
 #   (defaults to 'root' with the exeption of AIX which defaults to 'system')
-# [*ca_file_mode*]
+#
+# @param ca_file_mode
 #   The installed CA certificate's POSIX filesystem permissions. This uses
 #   the same syntax as Puppet's native file resource's "mode" parameter.
 #   (defaults to '0444', i.e. world-readable)
 #
-# === Examples
+# @param ca_file_extension
+#   File extenstion for the certificate.
 #
-# ca_cert::ca { 'globalsign_org_intermediate':
-#   source => 'http://secure.globalsign.com/cacert/gsorganizationvalsha2g2r1.crt',
-# }
 define ca_cert::ca (
-  Optional[String] $ca_text      = undef,
-  String $source                 = 'text',
-  String $ensure                 = 'trusted',
-  Boolean $verify_https_cert     = true,
-  Optional[String] $checksum     = undef,
+  Optional[String] $ca_text          = undef,
+  String $source                     = 'text',
+  String $ensure                     = 'trusted',
+  Boolean $verify_https_cert         = true,
+  Optional[String] $checksum         = undef,
   Optional[String[1]] $checksum_type = undef,
-  Optional[String] $ca_file_group = undef,
-  Optional[String] $ca_file_mode = undef,
+  String[1] $ca_file_group           = lookup('ca_cert::ca::ca_file_group'),
+  String[1] $ca_file_mode            = lookup('ca_cert::ca::ca_file_mode'),
+  String[1] $ca_file_extension       = lookup('ca_cert::ca::ca_file_extension'),
 ) {
-  include ca_cert::params
-  include ca_cert::update
-  require ca_cert::enable
-
-  if $ca_file_group == undef {
-    $file_group = $ca_cert::params::ca_file_group
-  } else {
-    $file_group = $ca_file_group
-  }
-
-  if $ca_file_mode == undef {
-    $file_mode = $ca_cert::params::ca_file_mode
-  } else {
-    $file_mode = $ca_file_mode
-  }
-
   if ($ensure == 'trusted' or $ensure == 'distrusted') and $source == 'text' and !$ca_text {
     fail('ca_text is required if source is set to text')
   }
@@ -94,11 +89,11 @@
   }
 
   # Determine Full Resource Name
-  $resource_name = "${name}.${ca_cert::params::ca_file_extension}"
+  $resource_name = "${name}.${ca_file_extension}"
 
   $ca_cert = $adjusted_ensure ? {
-    'distrusted' => "${ca_cert::params::distrusted_cert_dir}/${resource_name}",
-    default      => "${ca_cert::params::trusted_cert_dir}/${resource_name}",
+    'distrusted' => "${ca_cert::distrusted_cert_dir}/${resource_name}",
+    default      => "${ca_cert::trusted_cert_dir}/${resource_name}",
   }
 
   case $adjusted_ensure {
@@ -112,9 +107,9 @@
             source => $source,
             path   => $ca_cert,
             owner  => 'root',
-            group  => $file_group,
-            mode   => $file_mode,
-            notify => Class['ca_cert::update'],
+            group  => $ca_file_group,
+            mode   => $ca_file_mode,
+            notify => Exec['ca_cert_update'],
           }
         }
         'ftp', 'https', 'http': {
@@ -124,7 +119,7 @@
             checksum       => $checksum,
             checksum_type  => $checksum_type,
             allow_insecure => !$verify_https_cert,
-            notify         => Class['ca_cert::update'],
+            notify         => Exec['ca_cert_update'],
           }
         }
         'file': {
@@ -134,9 +129,9 @@
             source => $source_path,
             path   => $ca_cert,
             owner  => 'root',
-            group  => $file_group,
-            mode   => $file_mode,
-            notify => Class['ca_cert::update'],
+            group  => $ca_file_group,
+            mode   => $ca_file_mode,
+            notify => Exec['ca_cert_update'],
           }
         }
         'text': {
@@ -145,9 +140,9 @@
             content => $ca_text,
             path    => $ca_cert,
             owner   => 'root',
-            group   => $file_group,
-            mode    => $file_mode,
-            notify  => Class['ca_cert::update'],
+            group   => $ca_file_group,
+            mode    => $ca_file_mode,
+            notify  => Exec['ca_cert_update'],
           }
         }
         default: {
@@ -158,7 +153,7 @@
     'absent': {
       file { $ca_cert:
         ensure => absent,
-        notify => Class['ca_cert::update'],
+        notify => Exec['ca_cert_update'],
       }
     }
     default: {