Skip to content

Add puppetcore macos support #769

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add puppetcore macos support #769

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fd5342f
Upgrade puppetcore* msi from artifacts-puppetcore.puppet.com
joshcooper Mar 18, 2025
4c2832f
(maint) Update MacOS for puppetcore work
cthorn42 Apr 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions REFERENCE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -619,6 +619,35 @@ The puppet-agent version to install.

Default value: `undef`

### <a name="puppet_agent--prepare--package"></a>`puppet_agent::prepare::package`

for installation. This is used on platforms without package managers capable of
working with a remote https repository.

#### Parameters

The following parameters are available in the `puppet_agent::prepare::package` class:

* [`source`](#-puppet_agent--prepare--package--source)
* [`package_file_name`](#-puppet_agent--prepare--package--package_file_name)

##### <a name="-puppet_agent--prepare--package--source"></a>`source`

Data type: `Variant[String, Array]`

The source file for the puppet-agent package. Can use any of the data types
and protocols that the File resource's source attribute can.

##### <a name="-puppet_agent--prepare--package--package_file_name"></a>`package_file_name`

Data type: `Optional[String]`

The destination file name for the puppet-agent package. If no destination
is given, then the basename component of the source will be used as the
destination filename.

Default value: `undef`

### <a name="puppet_agent--prepare--puppet_config"></a>`puppet_agent::prepare::puppet_config`

Private class called from puppet_agent::prepare class.
Expand Down
28 changes: 20 additions & 8 deletions manifests/osfamily/darwin.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,24 +8,36 @@
$productversion_array = split($facts['os']['macosx']['version']['major'], '[.]')
$productversion_major = $productversion_array[0]
}

if $puppet_agent::absolute_source {
$source = $puppet_agent::absolute_source
$source = if $puppet_agent::absolute_source {
$puppet_agent::absolute_source
} elsif ($puppet_agent::is_pe and (!$puppet_agent::use_alternate_sources)) {
$pe_server_version = pe_build_version()
if $puppet_agent::alternate_pe_source {
$source = "${puppet_agent::alternate_pe_source}/packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${$productversion_major}.dmg"
"${puppet_agent::alternate_pe_source}/packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${productversion_major}.dmg"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We lost the inner '$'

Suggested change
"${puppet_agent::alternate_pe_source}/packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${productversion_major}.dmg"
"${puppet_agent::alternate_pe_source}/packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${$productversion_major}.dmg"

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But that's not required, is it? We already have $ before the {

} elsif $puppet_agent::source {
$source = "${puppet_agent::source}/packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${$productversion_major}.dmg"
"${puppet_agent::source}/packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${productversion_major}.dmg"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same

Suggested change
"${puppet_agent::source}/packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${productversion_major}.dmg"
"${puppet_agent::source}/packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${$productversion_major}.dmg"

} else {
"puppet:///pe_packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${productversion_major}.dmg"
}
} elsif $puppet_agent::collection =~ /core/ {
if $puppet_agent::prepare::package_version =~ /^\d+\.\d+\.\d+\.\d+\.g([a-f0-9]+)+$/ {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a better way to determine if we need to set dev=true parameter?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This worked for me, splitting the version and checking for strictly more than 3 components:

    $dev = count(split($puppet_agent::prepare::package_version, '\.')) > 3

"https://artifacts-puppetcore.puppet.com/v1/download?type=native&version=${puppet_agent::prepare::package_version}&os_name=osx&os_version=${productversion_major}&os_arch=${puppet_agent::arch}&dev=true"
} else {
$source = "puppet:///pe_packages/${pe_server_version}/${facts['platform_tag']}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${$productversion_major}.dmg"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we want to keep puppet:///pe_packages/${pe_server_version}/.... as a valid source.

"https://artifacts-puppetcore.puppet.com/v1/download?type=native&version=${puppet_agent::prepare::package_version}&os_name=osx&os_version=${productversion_major}&os_arch=${puppet_agent::arch}"
}
} else {
$source = "${puppet_agent::mac_source}/mac/${puppet_agent::collection}/${productversion_major}/${puppet_agent::arch}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${$productversion_major}.dmg"
"${puppet_agent::mac_source}/mac/${puppet_agent::collection}/${productversion_major}/${puppet_agent::arch}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${productversion_major}.dmg"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, also indentation is off

Suggested change
"${puppet_agent::mac_source}/mac/${puppet_agent::collection}/${productversion_major}/${puppet_agent::arch}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${productversion_major}.dmg"
"${puppet_agent::mac_source}/mac/${puppet_agent::collection}/${productversion_major}/${puppet_agent::arch}/${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${$productversion_major}.dmg"

}

$destination_name = if $puppet_agent::collection =~ /core/ {
"${puppet_agent::package_name}-${puppet_agent::prepare::package_version}-1.osx${productversion_major}.dmg"
} else {
undef
}

class { 'puppet_agent::prepare::package':
source => $source,
source => $source,
destination_name => $destination_name,
}

contain puppet_agent::prepare::package
Expand Down
39 changes: 39 additions & 0 deletions manifests/prepare/package.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,45 @@
creates => $local_package_file_path,
require => File[$puppet_agent::params::local_packages_dir],
}
} elsif $puppet_agent::collection =~ /core/ and $facts['os']['family'] =~ /Darwin/ {
$download_username = getvar('puppet_agent::username', 'forge-key')
$download_password = unwrap(getvar('puppet_agent::password'))

$response_file = "${local_package_file_path}.response"
$netrc_file = "${facts['env_temp_variable']}/.netrc"
file { $netrc_file:
ensure => file,
content => "machine artifacts-puppetcore.puppet.com\nlogin ${download_username}\npassword ${download_password}\n",
mode => '0600',
show_diff => false,
}

$curl_command = "curl -1 -sL --netrc-file '${netrc_file}' -w '%{http_code}' -o '${local_package_file_path}' '${source}' > '${response_file}'"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggest adding --fail so it returns non-zero exit on HTTP error

exec { 'Download Puppet Agent for Darwin':
command => $curl_command,
creates => $local_package_file_path,
path => ['/usr/bin', '/usr/sbin', '/bin', '/sbin'],
}

exec { 'Remove .netrc file':
command => "rm -f '${netrc_file}'",
path => ['/usr/bin', '/bin'],
onlyif => "test -f '${netrc_file}'",
require => Exec['Download Puppet Agent for Darwin'],
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

may produce a "changed" event each time the agent runs?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't that the kind of issue https://forge.puppet.com/modules/puppetlabs/transition/readme exists for?

#
# TODO: This is a temporary workaround to get the HTTP response code from the curl command.
# For now just outputting the response is good enough.
# We need to find a way to interspect this value and fail the catalog if the response
# code is not 200, and then logging the output wont be as important.
#
exec { 'Read HTTP Response Code':
command => "cat '${response_file}'",
path => ['/usr/bin', '/bin'],
onlyif => "test -f '${response_file}'",
logoutput => true,
require => Exec['Download Puppet Agent for Darwin'],
}
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is what the output looks like for setting up the netrc file, reading the output file and then executing the install script:

Started on jovial-duck.delivery.puppetlabs.net...
Finished on jovial-duck.delivery.puppetlabs.net:
  Notice: /Stage[main]/Puppet_agent::Prepare::Package/File[/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.netrc]/ensure: defined content as '{sha256}4f3d0ec5c7fa14041867e7009e7924c13c15c54cc2fbfc52362708a88964bf86'
  Notice: /Stage[main]/Puppet_agent::Prepare::Package/Exec[Remove .netrc file]/returns: executed successfully
  Notice: /Stage[main]/Puppet_agent::Prepare::Package/Exec[Read HTTP Response Code]/returns: 200
  Notice: /Stage[main]/Puppet_agent::Prepare::Package/Exec[Read HTTP Response Code]/returns: executed successfully
  Notice: /Stage[main]/Puppet_agent::Install::Darwin/Exec[osx_install script]/returns: executed successfully
  changed: 4, failed: 0, unchanged: 26 skipped: 0, noop: 0
Finished: apply catalog with 0 failures in 15.54 sec

For now while working on this I'm mainly looking to get quick feedback on the curl HTTP response. But this is only a work in progress, and I do plan on spending time to improve this.

} else {
file { $local_package_file_path:
ensure => file,
Expand Down
64 changes: 52 additions & 12 deletions tasks/install_shell.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,14 @@ warn () {
log "WARN: ${1}"
}

url_parameters() {
if [[ "$version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)\.g([a-f0-9]+)$ ]]; then
echo "&dev=true"
else
echo ""
fi
}

critical () {
log "CRIT: ${1}"
}
Expand Down Expand Up @@ -162,10 +170,18 @@ fi
if [ -n "$PT_mac_source" ]; then
mac_source=$PT_mac_source
else
if [ "$nightly" = true ]; then
mac_source='http://nightlies.puppet.com/downloads'
else
mac_source='http://downloads.puppet.com'
if [[ "$PT_collection" =~ core ]]; then
if [ -z "$password" ]; then
echo "A password parameter is required to install with puppetcore"
exit 1
fi
mac_source='https://artifacts-puppetcore.puppet.com/v1/download'
else
if [ "$nightly" = true ]; then
mac_source='http://nightlies.puppet.com/downloads'
else
mac_source='http://downloads.puppet.com'
fi
fi
fi

Expand Down Expand Up @@ -421,7 +437,11 @@ do_wget() {
# do_curl URL FILENAME
do_curl() {
info "Trying curl..."
run_cmd "curl -1 -sL -D $tmp_stderr '$1' > '$2'"
if [[ -n "$3" && -n "$4" ]]; then
run_cmd "curl -1 -sL -u '$3:$4' -D $tmp_stderr '$1' > '$2'"
else
run_cmd "curl -1 -sL -D $tmp_stderr '$1' > '$2'"
fi
rc=$?

# check for 404
Expand All @@ -431,6 +451,12 @@ do_curl() {
unable_to_retrieve_package
fi

grep "HTTP/2 401" $tmp_stderr 2>&1 >/dev/null
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know that we can safely assume the server replied with HTTP 2. Probably better to just check for:

Suggested change
grep "HTTP/2 401" $tmp_stderr 2>&1 >/dev/null
grep "401 Unauthorized" $tmp_stderr 2>&1 >/dev/null

if test $? -eq 0; then
critical "ERROR 401: Unauthorized access"
unable_to_retrieve_package
fi

# check for bad return status or empty output
if test $rc -ne 0 || test ! -s "$2"; then
capture_tmp_stderr "curl"
Expand Down Expand Up @@ -557,7 +583,11 @@ do_download() {
fi

if exists curl; then
do_curl $1 $2 && return 0
if [[ "$collection" =~ core ]]; then
do_curl $1 $2 "$username" "$password" && return 0
else
do_curl $1 $2 && return 0
fi
fi

if exists fetch; then
Expand Down Expand Up @@ -810,19 +840,29 @@ case $platform in
download_url="${apt_source}/${filename}"
;;
"mac_os_x")
info "Mac platform! Lets get you a DMG..."
filetype="dmg"
arch="x86_64"
if [[ $(uname -p) == "arm" ]]; then
arch="arm64"
fi
if test "$version" = "latest"; then
filename="puppet-agent-latest.dmg"
else
filename="puppet-agent-${version}-1.osx${platform_version}.dmg"
fi
info "Mac platform! Lets get you a DMG...!!"
if [[ "$collection" =~ core ]]; then
if [ -z "$password" ]; then
echo "A password parameter is required to install"
exit 1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we check for an empty password earlier, is the if [ -z "$password ] check needed?

fi

arch="x86_64"
if [[ $(uname -p) == "arm" ]]; then
arch="arm64"
# Call the url_parameters function to append to the download_url
download_url="${mac_source}/?version=${version}&os_name=osx&os_version=${platform_version}&os_arch=${arch}&fips=false$(url_parameters)"
else
download_url="${mac_source}/mac/${collection}/${platform_version}/${arch}/${filename}"
fi
download_url="${mac_source}/mac/${collection}/${platform_version}/${arch}/${filename}"
filetype="dmg"

;;
*)
critical "Sorry $platform is not supported yet!"
Expand Down
Loading