alphagov/hiera-eyaml-gpg — pull request #2 by mattbostock (2014-10-16 14:01:49+00:00)
Title: [#80633966] Set GPG home directory without an environment variable

Previously, `gpg.rb` was setting `ENV['GNUPGHOME']` to set GPG's home
directory, which contains the GPG keyring used by Hiera eYAML GPG, for
the `ruby-gpgme` gem.

This caused problems on our Puppet installation as we have other Puppet
resources that use GPG, such as our [puppet-aptly] module among others.

Because the `ruby` process that runs Puppet also includes Hiera eYAML
GPG, the `GNUPGHOME` environment variable was present throughout the
Puppet run, meaning that our other Puppet resources were using Hiera
eYAML GPG's `:gnupghome` as their GPG home directory.

I was able to verify this by creating a temporary `exec` resource that
prints the environment variables visible to Puppet, i.e.:

exec { 'test':
command => 'env',
logoutput => true,
}

This commit changes this so that we now specify the home directory using
`GPGME::Engine.home_dir`[1] rather than use an environment variable.

I'd hoped to add some Rspec integration tests to verify this, but hit a
number of issues, so resorted to testing this manually in Vagrant. The
environment variable is no longer set, and the GPG home directory is
correctly set. The environment now looks like:

==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: LANGUAGE=en_US:
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: TERM=vt100
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: PATH=/usr/lib/rbenv/shims:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: LANG=en_US.utf8
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: SHELL=/bin/bash
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: USERNAME=root
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: MAIL=/var/mail/root
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: SUDO_COMMAND=/usr/bin/puppet apply /var/govuk/puppet/manifests/site.pp --trusted_node_data --environment vagrant --modulepath /var/govuk/puppet/modules:/var/govuk/puppet/vendor/modules --manifestdir /var/govuk/puppet/manifests --hiera_config /var/govuk/puppet/hiera.yml
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: SUDO_USER=root
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: SUDO_UID=0
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: SUDO_GID=0
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: RBENV_VERSION=1.9.3
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: DEBIAN_FRONTEND=noninteractive
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: APT_LISTBUGS_FRONTEND=none
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: APT_LISTCHANGES_FRONTEND=none
==> cache-2.router: Notice: /Stage[main]/Main/Exec[test]/returns: executed successfully

[1]: https://github.com/ueno/ruby-gpgme/blob/fc299c9c1fb52ce64d288fce4a00db6e9ea79192/lib/gpgme/engine.rb#L63-L70
[puppet-aptly]: https://github.com/gds-operations/puppet-aptly

* * *

Also, make some minor changes and merge sihil/hiera-eyaml-gpg#15 which was raised upstream, is yet to be merged, and is valuable as the error message it fixes had also caught me out.

Note I've created a fork because I'm not sure if the upstream, sihil/hiera-eyaml-gpg, is being actively maintained. I've also pushed my changes upstream: sihil/hiera-eyaml-gpg#19