Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

random failures in java_ks provider #425

Open
vchepkov opened this issue Mar 13, 2023 · 5 comments · May be fixed by #461
Open

random failures in java_ks provider #425

vchepkov opened this issue Mar 13, 2023 · 5 comments · May be fixed by #461
Labels
community

Comments

@vchepkov
Copy link

Observe random errors in java_ks provider in PE2021.7.2 (puppet 7) environment, Amsazon Linux 2 agent, RHEL8 server

change from 'present' to 'latest' failed: Execution of 'keytool -v -printcert -file /tmp/certificate20230313-11787-1fogisx' returned 1: keytool error: java.io.FileNotFoundException: /tmp/certificate20230313-11787-1fogisx (No such file or directory)
java.io.FileNotFoundException: /tmp/certificate20230313-11787-1fogisx (No such file or directory)

The temp file is created by provider itself, so there seems to be some race condition

java_ks { "sat.example.com:${cacerts}":
    ensure              => 'latest',
    certificate_content => file("${module_name}/sat.example.com.pem"),
    password            => 'changeit',
    storetype           => 'jks',
  }

It doesn't happen each puppet run, I didn't find any pattern
@alexjfisher
Copy link

Me too, on a CentOS 7 VM.
@vchepkov Did you ever figure out what was causing this?

@alexjfisher
Copy link

I'm guessing that this Tempfile is garbage collected

puppetlabs-java_ks/lib/puppet/provider/java_ks/keytool.rb

Line 287 in 5dc91d7

file = Tempfile.new('certificate')

before keytool reads the file here.

puppetlabs-java_ks/lib/puppet/provider/java_ks/keytool.rb

Line 200 in 5dc91d7

'-v', '-printcert', '-file', certificate

@alexjfisher
Copy link

Furthermore,

puppetlabs-java_ks/lib/puppet/provider/java_ks/keytool.rb

Line 186 in 5dc91d7

if Puppet[:noop] && !File.exist?(certificate)
and

puppetlabs-java_ks/lib/puppet/provider/java_ks/keytool.rb

Line 200 in 5dc91d7

'-v', '-printcert', '-file', certificate
don't refer to the same file (when the certificate parameter isn't being used).

@alexjfisher alexjfisher mentioned this issue Oct 23, 2024
Merged
@alexjfisher
Copy link

The private_key method also creates a Tempfile but no reference to it is maintained after the method exits, so can also create a similar race condition.

@alexjfisher alexjfisher linked a pull request Oct 23, 2024 that will close this issue
Open
@vchepkov
Copy link
Author

We have migrated to RHEL8 and haven't seen the problem since

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
community
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix race condition by memoizing Tempfile objects alexjfisher/puppetlabs-java_ks
3 participants
@alexjfisher @vchepkov @ia-content