luxflux/puppet-openvpn — pull request #53 by NITEMAN (2014-03-18 12:24:11+00:00)
Title: revoke-full exit code <> 0 on success

Tested on Debian wheezy.

The last task on revoke-full script is verify the revoked certificate which leads to an exit code distinct of 0.

Excerpt form the script:
~~~
# verify the revocation
$OPENSSL verify -CAfile "$RT" -crl_check "$1.crt"
~~~

Puppet run output:
~~~
Notice: /Stage[main]/Main/Node[xxx]/Openvpn::Revoke[xxx]/Exec[revoke certificate for xxx in context of xxx]/returns: NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/xxx/easy-rsa/keys
Notice: /Stage[main]/Main/Node[xxx]/Openvpn::Revoke[xxx]/Exec[revoke certificate for xxx in context of xxx]/returns: Using configuration from /etc/openvpn/xxx/easy-rsa/openssl-1.0.0.cnf
Notice: /Stage[main]/Main/Node[xxx]/Openvpn::Revoke[xxx]/Exec[revoke certificate for xxx in context of xxx]/returns: Revoking Certificate 0A.
Notice: /Stage[main]/Main/Node[xxx]/Openvpn::Revoke[xxx]/Exec[revoke certificate for xxx in context of xxx]/returns: Data Base Updated
Notice: /Stage[main]/Main/Node[xxx]/Openvpn::Revoke[xxx]/Exec[revoke certificate for xxx in context of xxx]/returns: Using configuration from /etc/openvpn/xxx/easy-rsa/openssl-1.0.0.cnf
Notice: /Stage[main]/Main/Node[xxx]/Openvpn::Revoke[xxx]/Exec[revoke certificate for xxx in context of xxx]/returns: xxx.crt: C = ES, ST = Madrid, L = Madrid, O = "xxx", CN = xxx, emailAddress = xxx@xxx.es
Notice: /Stage[main]/Main/Node[xxx]/Openvpn::Revoke[xxx]/Exec[revoke certificate for xxx in context of xxx]/returns: error 23 at 0 depth lookup:certificate revoked
Error: . ./vars && ./revoke-full xxx && touch revoked/xxx returned 2 instead of one of [0]
Error: /Stage[main]/Main/Node[xxx]/Openvpn::Revoke[xxx]/Exec[revoke certificate for xxx in context of xxx]/returns: change from notrun to 0 failed: . ./vars && ./revoke-full xxx && touch revoked/xxx returned 2 instead of one of [0]
~~~

So I think it's better to test for the revoke-full exit code

WARNING: I've not tested wich exit codes returns revoke-full in other cases