Allow externally specified bundle for signing environment

For the internal PE promotion workflow we have a use case for signing external
to the project. This commit updates the packaging repo to create and ship a
tarball containing the git bundle in the jenkins ship. This allows us to pull
that in later, external to the packaging repo, and use it when doing a remote
signing. We update the bundle methods to take optional parameters for name,
so that we can differentiate between the normal tarball that gets created and
the git bundle we ship.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
[RE-293] Remove conditionals - make all builds immutable
Merge pull request #213 from shrug/feature/re-293

[RE-293] Remove conditionals - make all builds immutable
Accept overrides for rpm binary and passphrase input

We may move to using a running gpg-agent for signing of rpms. In order to
facilitate this, we need to be able to specify the rpm command to use, because
we need to call a wrapper rather than rpm itself. This is a special case
though, so we want to default to sane regular rpm. A second requirement for the
gpg-agent rpm signing is that we have to be able to switch the input for the
gpg passphrase in the rpm gpg command definition, i.e. we don't want to pass
'--passphrase-fd3' if we're using the agent. This commit supplies solutions to
both of these issues by accepting environment variables for both, allowing us
to set the expected parameters on demand. It moves the actual signing into a
base sign_rpm method that accepts flags for the specific signing we want to do
instead of having to duplicate this logic. Since the sign_modern method is the
equivalent of just calling the sign_rpm method without the second argument
(which is identical to sign_modern) we just get rid of sign_modern altogehter.
Also, we currently send stdout to dev null for rpm signing, but this isn't very
useful to us. This commit removes this, so we can see more about what's
happening when sign rpms.
Rename sign_el5 to sign_legacy and remove sign_modern

The sign_el5 method really signs legacy rpms, e.g. for sles11 as well as for
el5. This commit renames it, more appropriately to sign_legacy_rpm. The
sign_modern method isn't useful anymore so we finish off removing it as well,
replacing it with sign_rpm.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
Run createrepo for sles

We currently only run createrepo for el repositories when we ship PE
projects with the packaging repo. Needless to say, we need to run it on
the sles repos as well.
Merge pull request #215 from melissaanne/maint/master/re-365_createrepo-for-sles

Run createrepo for sles
Define __gpg_check_password_cmd if using gpg-agent

This commit defines __gpg_check_password_cmd as /bin/true when we're signing
with gpg-agent, a requirement of this workflow.
Merge pull request #214 from MosesMendoza/RE-322/master/more_flexible_rpm_signing

Accept overrides for rpm binary and passphrase input
Merge pull request #211 from MosesMendoza/RE-322/master/ship_git_bundle

Allow externally specified bundle for signing environment
(RE-372) Make chattr in ship more targeted

Prior to this commit, we were just chattr'ing everything in the
artifacts directory, kind of willy-nilly. This commit targets the
chattr so that we're only calling it on files we actually shipped,
thereby preventing the potential for a race condition and, ultimately,
for build failures.
Merge pull request #216 from melissaanne/maint/master/re-372

(RE-372) Make chattr in ship more targeted
Ship to temporary incoming dir on PE debian ships

This commit updates shipping of PE deb packages to use a random temporary
incoming dir rather than the current static one. This is in order to enable
multiple concurrent PE deb ships by resolving the inevitable file conflicts
that would have brought.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
Merge pull request #217 from MosesMendoza/randomize_incoming_on_pe_ship

Ship to temporary incoming dir on PE debian ships
(maint) Rsync the deb into the directory

The previous rsync call would copy the deb package to the dirname as a file, so
when the reprepro call was made, they was no wheezy directory to traverse into,
but a wheezy file, which is unexpected and breaks the ship. This commit updates
the rsync call to ship the deb package into the dist directory so wheezy would
be a directory containing packages instead of a package renamed to wheezy.
Merge pull request #218 from haus/maint/fix_rsync_deb_ship

(maint) Rsync the deb into the directory
Use agent when using gpg-agent for rpm signing, no tty

This commit updates the gpg signing for the PE package promotion workflow, to
use the agent when available. Since we're doing this with jenkins, where there
is no tty, we also pass --no-tty
Pass flags to gpp down through debsign to use agent

In the promotion workflow, we need to be able to tell debsign to use gpg but
without the default search for a tty. This is because jenkins doesn't give us a
tty. Debsign accepts an alternate program to use for signing via -p. We take
advantage of this to pass gpg along with our flags to debsign.

We also switch to "sh" instead of %x on the call to ensure failures raise
exceptions.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
Merge pull request #219 from MosesMendoza/maint/master/promotion_fixes

Signing changes for promotion workflow
(RE-384) Tie downstream jobs to downstream label

Currently the downstream job is executed on any slave. This presents a problem,
since the downstream job calls curl, which isn't available on every platform by
default (I'm looking at you solaris 10). This commit updates the downstream job
template to assign the job to only nodes with the label 'downstream', which has
already been set up on the jenkins server and assigned to various sane linux
hosts.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>