From ff39329bfdd5fb080919091f845ee78b46582bf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ionu=C8=9B=20Ar=C8=9B=C4=83ri=C8=99i?= <iartarisi@suse.cz>
Date: Wed, 3 Apr 2013 17:17:43 +0200
Subject: [PATCH] CHEF-3938: create global config option for zypper gpg checks

---
 lib/chef/config.rb                        |  6 +++
 lib/chef/provider/package/zypper.rb       | 30 +++++++++-----
 spec/unit/provider/package/zypper_spec.rb | 67 ++++++++++++++++++++++++++++++-
 3 files changed, 92 insertions(+), 11 deletions(-)

Index: lib/chef/config.rb
===================================================================
--- lib/chef/config.rb.orig	2014-10-21 11:24:59.099126952 +0200
+++ lib/chef/config.rb	2014-10-21 11:25:10.200126932 +0200
@@ -299,6 +299,12 @@ class Chef
     signing_ca_domain "opensource.opscode.com"
     signing_ca_email "opensource-cert@opscode.com"
 
+    # Zypper package provider gpg checks. Set to true to enable package
+    # gpg signature checking. This will be default in the
+    # future. Setting to false disables the warnings.
+    # Leaving this set to nil or false is a security hazard!
+    zypper_check_gpg nil
+
     # Report Handlers
     report_handlers []
 
Index: lib/chef/provider/package/zypper.rb
===================================================================
--- lib/chef/provider/package/zypper.rb.orig	2014-10-21 11:24:50.520126967 +0200
+++ lib/chef/provider/package/zypper.rb	2014-10-21 11:25:10.201126932 +0200
@@ -91,11 +91,11 @@ class Chef
             )
           elsif version
             run_command(
-              :command => "zypper -n --no-gpg-checks install -l  #{name}=#{version}"
+              :command => "zypper -n#{gpg_checks} install -l #{name}=#{version}"
             )
           else
             run_command(
-              :command => "zypper -n --no-gpg-checks install -l  #{name}"
+              :command => "zypper -n#{gpg_checks} install -l #{name}"
             )
           end
         end
@@ -107,11 +107,11 @@ class Chef
             )
           elsif version
             run_command(
-              :command => "zypper -n --no-gpg-checks install -l #{name}=#{version}"
+              :command => "zypper -n#{gpg_checks} install -l #{name}=#{version}"
             )
           else
             run_command(
-              :command => "zypper -n --no-gpg-checks install -l #{name}"
+              :command => "zypper -n#{gpg_checks} install -l #{name}"
             )
           end
         end
@@ -123,21 +123,33 @@ class Chef
             )
           elsif version
             run_command(
-              :command => "zypper -n --no-gpg-checks remove  #{name}=#{version}"
+              :command => "zypper -n#{gpg_checks} remove #{name}=#{version}"
             )
           else
             run_command(
-              :command => "zypper -n --no-gpg-checks remove  #{name}"
+              :command => "zypper -n#{gpg_checks} remove #{name}"
             )
           end
-            
-         
         end
       
         def purge_package(name, version)
           remove_package(name, version)
         end
-      
+
+        private
+        def gpg_checks()
+          case Chef::Config[:zypper_check_gpg]
+          when true
+            ""
+          when false
+            " --no-gpg-checks"
+          when nil
+            Chef::Log.warn("Chef::Config[:zypper_check_gpg] was not set. " + 
+              "All packages will be installed without gpg signature checks. " + 
+              "This is a security hazard.")
+            " --no-gpg-checks"
+          end
+        end
       end
     end
   end
Index: spec/unit/provider/package/zypper_spec.rb
===================================================================
--- spec/unit/provider/package/zypper_spec.rb.orig	2014-10-21 11:24:50.635126967 +0200
+++ spec/unit/provider/package/zypper_spec.rb	2014-10-21 11:25:10.201126932 +0200
@@ -92,8 +92,24 @@ describe Chef::Provider::Package::Zypper
 
   describe "install_package" do
     it "should run zypper install with the package name and version" do
+      Chef::Config.stub(:[]).with(:zypper_check_gpg).and_return(true)
       @provider.should_receive(:run_command).with({
-          :command => "zypper -n --no-gpg-checks install -l  emacs=1.0",
+          :command => "zypper -n install -l emacs=1.0",
+        })
+      @provider.install_package("emacs", "1.0")
+    end
+    it "should run zypper install without gpg checks" do
+      Chef::Config.stub(:[]).with(:zypper_check_gpg).and_return(false)
+      @provider.should_receive(:run_command).with({
+          :command => "zypper -n --no-gpg-checks install -l emacs=1.0",
+        })
+      @provider.install_package("emacs", "1.0")
+    end
+    it "should warn about gpg checks on zypper install" do
+      Chef::Log.should_receive(:warn).with(
+        /All packages will be installed without gpg signature checks/)
+      @provider.should_receive(:run_command).with({
+          :command => "zypper -n --no-gpg-checks install -l emacs=1.0",
         })
       @provider.install_package("emacs", "1.0")
     end
@@ -101,6 +117,22 @@ describe Chef::Provider::Package::Zypper
 
   describe "upgrade_package" do
     it "should run zypper update with the package name and version" do
+      Chef::Config.stub(:[]).with(:zypper_check_gpg).and_return(true)
+      @provider.should_receive(:run_command).with({
+          :command => "zypper -n install -l emacs=1.0",
+        })
+      @provider.upgrade_package("emacs", "1.0")
+    end
+    it "should run zypper update without gpg checks" do
+      Chef::Config.stub(:[]).with(:zypper_check_gpg).and_return(false)
+      @provider.should_receive(:run_command).with({
+          :command => "zypper -n --no-gpg-checks install -l emacs=1.0",
+        })
+      @provider.upgrade_package("emacs", "1.0")
+    end
+    it "should warn about gpg checks on zypper upgrade" do
+      Chef::Log.should_receive(:warn).with(
+        /All packages will be installed without gpg signature checks/)
       @provider.should_receive(:run_command).with({
           :command => "zypper -n --no-gpg-checks install -l emacs=1.0",
         })
@@ -110,8 +142,24 @@ describe Chef::Provider::Package::Zypper
 
   describe "remove_package" do
     it "should run zypper remove with the package name" do
+      Chef::Config.stub(:[]).with(:zypper_check_gpg).and_return(true)
+      @provider.should_receive(:run_command).with({
+          :command => "zypper -n remove emacs=1.0",
+        })
+      @provider.remove_package("emacs", "1.0")
+    end
+    it "should run zypper remove without gpg checks" do
+      Chef::Config.stub(:[]).with(:zypper_check_gpg).and_return(false)
+      @provider.should_receive(:run_command).with({
+          :command => "zypper -n --no-gpg-checks remove emacs=1.0",
+        })
+      @provider.remove_package("emacs", "1.0")
+    end
+    it "should warn about gpg checks on zypper remove" do
+      Chef::Log.should_receive(:warn).with(
+        /All packages will be installed without gpg signature checks/)
       @provider.should_receive(:run_command).with({
-          :command => "zypper -n --no-gpg-checks remove  emacs=1.0",
+          :command => "zypper -n --no-gpg-checks remove emacs=1.0",
         })
       @provider.remove_package("emacs", "1.0")
     end
@@ -122,6 +170,21 @@ describe Chef::Provider::Package::Zypper
       @provider.should_receive(:remove_package).with("emacs", "1.0")
       @provider.purge_package("emacs", "1.0")
     end
+    it "should run zypper purge without gpg checks" do
+      Chef::Config.stub(:[]).with(:zypper_check_gpg).and_return(false)
+      @provider.should_receive(:run_command).with({
+          :command => "zypper -n --no-gpg-checks remove emacs=1.0",
+        })
+      @provider.purge_package("emacs", "1.0")
+    end
+    it "should warn about gpg checks on zypper purge" do
+      Chef::Log.should_receive(:warn).with(
+        /All packages will be installed without gpg signature checks/)
+      @provider.should_receive(:run_command).with({
+          :command => "zypper -n --no-gpg-checks remove emacs=1.0",
+        })
+      @provider.purge_package("emacs", "1.0")
+    end
   end
 
   describe "on an older zypper" do
