Jira (PUP-10538) Puppet module tool does not check for metadata, assumes all directories contain modules, and can cause importing of an invalid module

2 views
Skip to first unread message

Rob Nelson (Jira)

unread,
Jun 3, 2020, 2:38:02 PM6/3/20
to puppe...@googlegroups.com
Rob Nelson created an issue
 
Puppet / Bug PUP-10538
Puppet module tool does not check for metadata, assumes all directories contain modules, and can cause importing of an invalid module
Issue Type: Bug Bug
Assignee: Unassigned
Created: 2020/06/03 11:37 AM
Priority: Normal Normal
Reporter: Rob Nelson

Puppet Version:6.15.0
Puppet Server Version:6.15.0
OS Name/Version: Centos 7.6

Given an environment.conf of modulepath = site:site/module:modules:$basemodulepath, and modules in site/role, site/profile, site/module/ahtenable, the autoloader attempts to load modules in this order:

role
profile
module
ahtenable

The autoloader then generates an error that the class name ahtenable is unacceptable in file .../site/module/ahtenable/manifests/init.pp.

Changing the environment.conf to say modulepath = site/module:site:modules:$basemodulepath results in loading the modules:

ahtenable
role
profile
module

The autoloader no longer complains about unacceptable classnames.

Desired Behavior: Puppet should traverse the modulepath and only import directories that look like modules

Actual Behavior: Puppet traverses the modulepath and imports every directory under a directory in the modulepath, even if it does not contain a module directly

I believe this is because PMT was written before metadata.json was a standard, maybe even before the old modulefile standard was a standard, and so it just enumerates all subdirectories. We now suggest a metadata.json file in modules, so PMT could search for that, or some other files (lib/facter, manifests with at least one .pp file, etc) before attempting to import a directory of directories.

 

Our solution was to move ahtenable into another directory and include that in the environment.conf's modulepath. However, this bug could still result in importing non-modules with a potential for overlap or overwriting the namespace.

Add Comment Add Comment
 
This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)
Atlassian logo
Reply all
Reply to author
Forward
0 new messages