Merge branch 'CHEF-1015' of git://github.com/stormsilver/chef into stormsilver/CHEF-1015

Author: adamhjk

chef-server/bin/chef-server

@@ -56,6 +56,14 @@ end
 ARGV.push *[ "-I", File.join(__DIR__, "config", "init.rb") ]
 ARGV.push *[ "-m", __DIR__]
 
+# attempt to find the user and group that this process will become. Fixes CHEF-1015
+if (index = ARGV.index("-u"))
+  Chef::Config[:signing_ca_user] = ARGV[index+1]
+end
+if (index = ARGV.index("-G"))
+  Chef::Config[:signing_ca_group] = ARGV[index+1]
+end
+
 if index = ARGV.index("-C")
   config = ARGV[index+1]
   ARGV.delete("-C")

chef/lib/chef/certificate.rb

@@ -72,6 +72,9 @@ def generate_signing_ca
 
           File.open(ca_cert_file, "w") { |f| f.write ca_cert.to_pem }
           File.open(ca_keypair_file, File::WRONLY|File::EXCL|File::CREAT, 0600) { |f| f.write keypair.to_pem }
+          if (Chef::Config[:signing_ca_user] && Chef::Config[:signing_ca_group])
+            FileUtils.chown(Chef::Config[:signing_ca_user], Chef::Config[:signing_ca_group], ca_keypair_file)
+          end
         end
         self
       end
@@ -146,6 +149,9 @@ def gen_validation_key(name=Chef::Config[:validation_client_name], key_file=Chef
           File.open(key_file, File::WRONLY|File::EXCL|File::CREAT, 0600) do |f|
             f.print(api_client.private_key)
           end
+          if (Chef::Config[:signing_ca_user] && Chef::Config[:signing_ca_group])
+            FileUtils.chown(Chef::Config[:signing_ca_user], Chef::Config[:signing_ca_group], key_file)
+          end
         end
       end
 

chef/lib/chef/config.rb

@@ -183,6 +183,8 @@ def self.manage_secret_key
     # In truth, these don't even have to change
     signing_ca_cert "/var/chef/ca/cert.pem"
     signing_ca_key "/var/chef/ca/key.pem"
+    signing_ca_user nil
+    signing_ca_group nil
     signing_ca_country "US"
     signing_ca_state "Washington"
     signing_ca_location "Seattle"

chef/spec/unit/certificate_spec.rb

@@ -33,7 +33,10 @@ def write(arg)
 describe Chef::Certificate do
   describe "generate_signing_ca" do
     before(:each) do
+      Chef::Config[:signing_ca_user] = nil
+      Chef::Config[:signing_ca_group] = nil
       FileUtils.stub!(:mkdir_p).and_return(true)
+      FileUtils.stub!(:chown).and_return(true)
       File.stub!(:open).and_return(true)
       File.stub!(:exists?).and_return(false)
       @ca_cert = FakeFile.new 
@@ -45,9 +48,19 @@ def write(arg)
       Chef::Certificate.generate_signing_ca
       @ca_cert.data.should =~ /BEGIN CERTIFICATE/
     end
-
+    
     it "should generate an RSA private key" do
       File.should_receive(:open).with(Chef::Config[:signing_ca_key], File::WRONLY|File::EXCL|File::CREAT, 0600).and_yield(@ca_key)
+      FileUtils.should_not_receive(:chown)
+      Chef::Certificate.generate_signing_ca
+      @ca_key.data.should =~ /BEGIN RSA PRIVATE KEY/
+    end
+
+    it "should generate an RSA private key with user and group" do
+      Chef::Config[:signing_ca_user] = "funky"
+      Chef::Config[:signing_ca_group] = "fresh"
+      File.should_receive(:open).with(Chef::Config[:signing_ca_key], File::WRONLY|File::EXCL|File::CREAT, 0600).and_yield(@ca_key)
+      FileUtils.should_receive(:chown).with(Chef::Config[:signing_ca_user], Chef::Config[:signing_ca_group], Chef::Config[:signing_ca_key])
       Chef::Certificate.generate_signing_ca
       @ca_key.data.should =~ /BEGIN RSA PRIVATE KEY/
     end