Upload cookbooks to secure location

[matschaffer]

In order to keep my cookbooks more secure
As a developer
I want my cookbooks to be uploaded to a non-world-readable location

---

Right now since we upload using rsync potentially as a non-privileged user we put all cookbooks in /tmp/chef-solo. Ideally we should be writing these to /var/chef or something more secure, but we'll need to figure out how to get rsync doing that. See https://github.com/matschaffer/knife-solo/blob/master/lib/chef/knife/cook.rb#L67 for rsync stuff.

[matschaffer]

Starting to think that rsync might not be idea. Rather we could probably examine the cookbook dependency tree and sha's and upload using that which would be more inline with what Chef server does. Bonus points if we can leverage chef client code to do this.

[thbar]

Extra note on this: for Windows support we'll have to ensure the folder can be changed (ie: c:/tmp instead of /tmp, or even something else). Just so you know!

[matschaffer]

This might help: http://linuxexchange.org/questions/411/rsync-backups-using-sudo-instead-of-root

[matschaffer]

Making some progress on this in https://github.com/matschaffer/knife-solo/tree/issue/sudo-rsync-1

Still need to do a full test and set up error messages for people to update their solo.rb accordingly.

[matschaffer]

Boo... so turns out that trick makes some assumptions about the sudo environment. Instead I've opted to move the root path config to a knife[:solo_path] config and chmod 700 the dir to avoid it being seen by anything other than the user controlling the ssh connection.

[matschaffer]

Should be fixed with #145