Custom Query (894 matches)

I would be nice to be able to depend on the package being installed before installing a configuration file.

I will need to periodically rotate the server cert in order to satisfy infosec requirements. Being able to specify multiple cert fingerprints, to be tried in order, should be sufficient.

The envisioned workflow is:

• generate new cert and get its fingerprint (but don't install yet)
• update /etc/bcfg2.conf to have 'fingerprint = <new fingerprint>, <old fingerprint>
• let clients get new config
• put new server cert in place
• let at least another round of clients updates go through
• remove old fingerprint from /etc/bcfg2.conf

If a host is down for longer than the rotation period, they will need to have the fingerprint manually updated when they're back up.

Bcfg2 requires that you supply a base file (e.g. /etc/motd) when using .cat deltas. It should be possible to add deltas to files that already exist on the system.

If there is no existing file, client should give a warning/error:

Suppressing entry installation - no base file is found for:
 Path:/etc/motd