Chef Package Versioning

Question

If a Chef recipe (or any of it's cookbook dependencies) use the package resource without specifying a version, then the latest version of the package is installed. If you want to control and test exactly what you are installing, then you must always supply the package version. What can you do when the cookbooks that you depend on do not take the same precautions?

See for example the default recipe in the ark cookbook. If this recipe is used on a production server, it could install packages that have not been tested. This is just one example (with over 5m downloads) so I am wondering how people are getting around this problem.

Answer 1

We had the same issue in our cookbook. So we decided to use data bags.

Data bags can be easily changed, for example:

knife data bag from file my_data_bag host1

OR

knife data bag edit my_data_bag host1

Your recipe will be able to see the specified version from the data bag using the code like this:

my_bag = data_bag_item('my_data_bag', 'host1')
Chef::Log.info("You have changed the version to: #{my_bag['version']}")

package 'java' do
  version my_bag['version']
  action :install
end

So finally you don't need to modify Cookbook or Recipe. All you need is to pass the version to the data bag.

Answer 2

What can you do when the cookbooks that you depend on do not take the same precautions?

I don't think there is a simple answer. This is basically "the Chef way" ...

^{(Actually, I would suggest that hard-wiring package versions could do more harm than good. One of the good things about using a (good) distribution's package repo is that they regularly release updates with patches for security issues and bugs. But if you wired fixed package versions into your recipes or roles/nodes or something, you would prevent any such patches from propagating to your system.)}

However, if it is critical to you that package versions are stable then maybe ...

• Clone and hack the cookbooks in question to use specific versions. (Actually, you probably need to do this anyway, to avoid being bitten by unstable cookbooks!)

• Use a distro (such as RHEL or its "clones") that values long-term stability, and only pushes out package updates that are "really important".

• Create your own private mirror of the distro's package repos with only the "good" versions of the critical packages in it.

• Modify Chef so that the package resources pick/install specified versions by default. (I don't imagine this would be easy. But if you did come up with a good solution at this level, it would be a pretty useful addition to Chef! IMO.)

---

UPDATE

Actually, there is a way to do this for (at least) Debian-based systems; see the apt cookbook and in particular the references to "pinning".

Or with yum, you could "lock" particular versions using "yum versionlock ..." as described here: https://www.zulius.com/how-to/yum-install-specific-package-version/

UPDATE - 2

Another possible trick would be to "inject" a version attribute into the "unsafe" package resources. Something like this:

# first, include_recipe a recipe that specifies 'package "foo"' without 
# a version attribute

# then ...
r = resources("package[foo]")
r.variables['version'] = "1.2.3"

^{With a little ingenuity, one could create a "package version lock" recipe that pulled the versions from a databag, and dealt with missing resource exceptions and version attributes that were actually provided. But I don't know if this is "A Good Idea" (tm).}

Answer 3

In short : I'm not managing this.

In a more complete answer: All distro/release go throught a validation phase before releasing new packages, I'm confident over it and it helps me keep in sync with security fixes.

As far as I know all package managers takes care of not upgrading a package in a breaking way if it is a dependencies of a package installed manually, again you have to trust the package maintainer about this.

i.e.: the package ressource without version won't update make nor gcc if it is a dependency of one package you installed with a fixed version.

For exemple under ubuntu, if you set the nagios package to manual, it will never try to update the libc package over a breaking change, and so I could break other package isntallation as dependencies are not satisfied.

If you're absolutely concerned about it, you have some choices:

1. Rewrite each pacakge ressource to use fixed version of packages
2. Fork any cookbook to fix thooses issues (you can write a foodcritic rule to help you detect package ressources without specific versions)
3. Have your own repos, stable and testing, and move packages inside stable repo once tested and use testing repo on your staging/QA environement.

The 3 is the most conservative as you choose what is in the repo in the stable branch and it won't change magically. The drawback is security fixes you'll have to manage.

Hope it would help.

Answer 4

Chef's package resource uses the package manager of the node's operating system (like apt, yum, etc). These tools always install the most recent version that is available through the repositories. That's why chef's package resource also installs this version.

What the ark cookbook is that it downloads the source code and then compiles it - obvious that you can specify the version to install (through the passed URL).

So it depends on your actual need. If you want to install the version that is available through the distro's or your own package repo, then it's totally fine (and that's what most cookbooks do). If you want to compile everything from source (where you usually have the option to specify the version, the coverage of chef cookbooks supporting this is lower.

Personally, I'd suggest that you set up an own apt/yum/whatever repo for the software for which have specific version requirements.