that's wrong

doesn't import it at all, I confirm

do'h, never mind, in my case I use local repo

@bastelfreak hmmm. https://github.com/heini/puppet-wait-for/blob/master/lib/puppet/type/wait_for.rb

@bastelfreak hmmm. https://github.com/heini/puppet-wait-for/blob/master/lib/puppet/type/wait_for.rb

oh nice

This message was deleted.

^^^ An easy one to review :-)

This message was deleted.

is https://github.com/voxpupuli/voxpupuli-acceptance/#environment-variables-to-facts useful here?

I'd be happy to extend https://github.com/voxpupuli/voxpupuli-acceptance/blob/master/lib/voxpupuli/acceptance/facts.rb to also read a file or change logic to better suit your needs

Hiera integration is also doing something similar, but there we use relative paths and assume we're in the right directory

I opened an issue regarding the GPG key: https://github.com/voxpupuli/puppet-yum/issues/273

Uh. The

PathSpec

used by

.pmtignore

will match any dir unless there is a separated as the start of the pattern per https://git-scm.com/docs/gitignore. What this means is that https://github.com/voxpupuli/modulesync_config/blob/master/moduleroot/.pmtignore.erb#L17 will match

templates/log/

and remove it from a forge tarball. I think the fixes is probably to be prefix all paths with

/

so they become relative to the root of the module. E.g.

log/

becomes

/log/

. Any thoughts?

Uh. The

PathSpec

used by

.pmtignore

will match any dir unless there is a separated as the start of the pattern per https://git-scm.com/docs/gitignore. What this means is that https://github.com/voxpupuli/modulesync_config/blob/master/moduleroot/.pmtignore.erb#L17 will match

templates/log/

and remove it from a forge tarball. I think the fixes is probably to be prefix all paths with

/

so they become relative to the root of the module. E.g.

log/

becomes

/log/

. Any thoughts?

This message was deleted.

How about https://github.com/voxpupuli/modulesync_config/pull/791 as a starting point for discussion?

@bastelfreak re: https://github.com/voxpupuli/modulesync_config/pull/791 Is the forge indexer code public?

@bastelfreak re: https://github.com/voxpupuli/modulesync_config/pull/791 Is the forge indexer code public?

I dont know. But maybe @binford2k knows which files/dirs the forge accepts/filters for new module releases/if thats documents/if the forge doesnt modify it at all

what’s context? And what do you mean by indexer?

oh, the zipbomb question?

yes

@binford2k yes, basically, we want to know which files the forge actually cares about

it truly only cares that it’s a directory with a

metadata.json

at the root. If there’s a readme, that’s parsed. If there’s a reference, that’s parsed, etc

I don’t know if it’s vulnerable to a zipbomb though. I have to imagine that was tested at some point, but I’d have to go look at code & history, etc

I know that code manager strips the spec/ dir beofr it commits to filesync. I thought the forge might filter stuff out as well. but maybe thats only happening during puppet module build via .pmtignore/.gitignore

yep, it’s in pdk build