Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/sudo/cmd/sudo-tools/manifest_test.go

@@ -34,7 +34,7 @@ func TestItDeclaresThePackageAndTheDropInSudoReads(t *testing.T) {
 }
 
 func TestTheDropInGrantsExactlyTheOperatorAccountAndParses(t *testing.T) {
-	content := manifest(t).resource(t, "operator")["content"].(string)
+	content := templateText(t, manifest(t).resource(t, "operator"))
 	var rules []string
 	for _, l := range strings.Split(content, "\n") {
 		if l = strings.TrimSpace(l); l != "" && !strings.HasPrefix(l, "#") {

modules/sudo/cmd/sudo-tools/templates_test.go

@@ -0,0 +1,64 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The module's directory, where its manifest and its files/ are.
+const moduleDir = "../.."
+
+// templateText is the text a file resource places on the machine: its template's, in the module's files/
+// (novox/hq ADR 0349 §2). A resource that names no template, or a template that is not there, fails the test.
+func templateText(t *testing.T, r map[string]any) string {
+	t.Helper()
+	name, _ := r["template"].(string)
+	if name == "" {
+		t.Fatalf("resource %v names no template", r["id"])
+	}
+	raw, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(name)))
+	if err != nil {
+		t.Fatalf("resource %v names %s: %v", r["id"], name, err)
+	}
+	return string(raw)
+}
+
+// No file resource carries its text inline: each names its template in files/, and the build packs files/
+// into the one archive the controller reads the templates back from (novox/hq ADR 0349 §2).
+func TestEveryFileTakesItsTextFromATemplate(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join(moduleDir, "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		Resources []map[string]any `json:"resources"`
+		Build     struct {
+			Artifacts []map[string]any `json:"artifacts"`
+		} `json:"build"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range m.Resources {
+		if _, inline := r["content"]; inline {
+			t.Errorf("resource %v keeps its text inline: keep it in files/ and name it as the template", r["id"])
+		}
+		if r["type"] == "file" {
+			templateText(t, r)
+		}
+	}
+	packs := 0
+	for _, a := range m.Build.Artifacts {
+		if a["kind"] == "archive" && a["from"] == "files" {
+			packs++
+			if a["name"] != "files" {
+				t.Errorf("the templates archive is named %v, not files", a["name"])
+			}
+		}
+	}
+	if packs != 1 {
+		t.Errorf("the build packs files/ into %d archives, not one", packs)
+	}
+}

modules/sudo/files/10-mesh-operator

@@ -0,0 +1,9 @@
+# The mesh's (module sudo, novox/hq to-be 42, research 027): the operator account escalates
+# without a prompt. The mesh's tools that act as root run `sudo -n` as this account and rely on it;
+# until this file, every machine said so only in a line set by hand in /etc/sudoers.
+# Written whole at every push: an edit here is overwritten. A file of this directory whose name
+# holds a dot or ends in ~ is not read by sudo; this name holds neither.
+# Every command run through sudo gets a terminal of its own (novox/hq ADR 0266): an agent the operator
+# starts as the agent account through sudo cannot push keystrokes into the operator's shell (TIOCSTI).
+Defaults use_pty
+${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL

modules/sudo/module.json

@@ -21,7 +21,7 @@
       "type": "file",
       "path": "/etc/sudoers.d/10-mesh-operator",
       "mode": "0440",
-      "content": "# The mesh's (module sudo, novox/hq to-be 42, research 027): the operator account escalates\n# without a prompt. The mesh's tools that act as root run `sudo -n` as this account and rely on it;\n# until this file, every machine said so only in a line set by hand in /etc/sudoers.\n# Written whole at every push: an edit here is overwritten. A file of this directory whose name\n# holds a dot or ends in ~ is not read by sudo; this name holds neither.\n# Every command run through sudo gets a terminal of its own (novox/hq ADR 0266): an agent the operator\n# starts as the agent account through sudo cannot push keystrokes into the operator's shell (TIOCSTI).\nDefaults use_pty\n${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL\n"
+      "template": "files/10-mesh-operator"
     }
   ],
   "build": {
@@ -36,6 +36,11 @@
         "loads": [
           "sudo-tools"
         ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }