Re: Package management with cfengine

[Luke A. Kanies]

On Fri, 7 Nov 2003, Chip Seraphine wrote:

> The classes are easy enough; just pass 'em along via argv or command line.
>   Variables are a bit tricky; wish we had a $(cfallvars) supervariable
> that looked like "var1=foo:var2=bar" or something.  As it is, if I need a
> variable in the module I either explicitly set it on the module's
> commandline or have the module determine it from the same way the cfengine
> script does.  [For example, have the value live in a config file and have
> both cfengine and the module read the same file.]

Heh, I just want real variables, real methods, and real local/global scope
for variables. :)

I don't like the supervariable idea, because I already sometimes reach the
limits of the line length, and this would just exacerbate it.  And don't
get me started on the quoting nightmares of something with a value like
"fun:test", because of the fact that you're going through a shell.

I'm just foregoing variables entirely right now, and am instead passing
strings.  For instance, for my inetd.conf generator, I collect a list of
symbolic names that refer to configurations (e.g., telnet_sun, ftp_hp,
rstatd_sun, etc), and then I just pass that list to my module.

That works fine for that module because it's a very simple module which
just updates a file.  Here, I'm trying to use cfengine for all aspects of
package management, essentially converting my begin and finish scripts to
cfengine, and using cfengine to copy the files down, so I get permanent
verification of my packages in every way.  For example, here's what my
cfengine finish script might look like:

groups:
   cfkeys_setup = ( IsPlain(/var/cfengine/ppkeys/localhost.pub) )

control:
   !cfkeys_setup:: actionsequence = ( shellcommands.cfkey_init)

   any:: actionsequence = ( editfiles.cfcron )

shellcommands:
   cfkey_init::
      "/usr/local/sbin/cfkey"

editfiles:
   cfcron:: { ${rootcron}
      AppendIfNoSuchLine "0,30 * * * * /usr/local/sbin/cfservd -F
   }

And any host on which I marked that cfengine was installed, I would expect
this snippet of code would be run.  Except that I'm complicating it a bit
by actually installing every package in something like
/usr/local/software/<package>/<version>, and then linking them to
/usr/local/bin/<bin>.<version> and a single, "current" version to
/usr/local/bin/<bin>.  This is especially complicated, because it's a list
of lists, essentially.  Yay.

> > There are a couple other problems with this model, too, but that's the
> > main one.
> >
> > Is anyone doing something like this right now?  I specifically, definitely
> > want to specify the packages to be installed within cfengine; I don't want
> > an external file that does it or whatever.
>
> If by 'within cfengine' you include modules, then yes.  I wrote a module
> called 'apsht' for updating and installing Solaris packages.  It's a perl
> script that is passed the $(cfallclasses) variable on the command line.
> Using those classes, it consults a directory full of package-list files
> and reads the contents of the appropriate files (the files have names that
> are cfengine-y expressions like "sunos.i386.workstation.!developerws"),
> which are lists of Sun packages.  It then looks in the appropriate depot
> area for its architecture and installs/updates these packages if they need it.

No, as I mention above, I want cfengine to do the work.  It's got all of
the necessary primitives, it's just so difficult that not many people do
it, as far as I can tell.  The absolutely most important piece is that the
logic is done within cfengine, but I want to be able to depend on
platform-specific variables (such as the location of inetd.conf, the
location of root's crontab, the location of nslookup, and many, many more
things) in these snippets, which means that they can't be in a subprocess.

> I was actually talking to Mark about creating a page where I can post a
> few of my modules, but probably won't get that done for a few days.  If
> anybody wants, I'll be happy to post the relevant module now.

Ah, to have a central repository of example configs and modules....

Thanks,
Luke

-- 
"Wouldn't the sentence 'I want to put a hyphen between the words Fish
and And and And and Chips in my Fish-And-Chips sign' have been clearer
if quotation marks had been placed before Fish, and between Fish and
and, and and and And, and And and and, and and and And, and And and
and, and and and Chips, as well as after Chips?"