Reproducer for fixing the knockout prefix bug (#149)

* Allow escaping knockout prefix (--) strings
* Allow for escaping knockout prefixes in strings to preserve leading `--` entries
* raise timeout of FIPS jobs

Closes #148

.gitlab-ci.yml

@@ -349,6 +349,7 @@ pup6.pe-fips:
   <<: *acceptance_base
   script:
     - 'BEAKER_fips=yes bundle exec rake beaker:suites[default]'
+  timeout: 2h
 
 pup6.pe-oel:
   <<: *pup_6_pe
@@ -368,6 +369,7 @@ pup6.pe-oel-fips:
   <<: *with_SIMP_ACCEPTANCE_MATRIX_LEVEL_3
   script:
     - 'BEAKER_fips=yes bundle exec rake beaker:suites[default,oel]'
+  timeout: 2h
 
 pup7.x:
   <<: *pup_7_x

CHANGELOG

@@ -1,3 +1,7 @@
+* Fri May 20 2022 Trevor Vaughan <[email protected]> - 3.2.2
+- Allow for escaping knockout prefixes in strings to preserve leading `--`
+  entries
+
 * Wed Mar 02 2022 Mike Riddle <[email protected]> - 3.2.2
 - Updated confines to allow for negative matches using the '--' prefix
 

lib/puppet/functions/compliance_markup/enforcement.rb

@@ -69,6 +69,11 @@ def hiera_enforcement(key, options, context)
       @context.not_found
     end
 
+    # Allow for escaping knockout prefixes that we want to preserve in strings
+    # NOTE: This is horrible but less horrible than traversing all manner of
+    # data structures recursively.
+    retval = JSON.load(retval.to_json.gsub('\\--', '--'))
+
     # Add the key to the cache if we found something
     cache(key, retval) if retval
 

spec/functions/compliance_markup/03_enforcement_profile_merge_spec.rb

@@ -99,7 +99,7 @@
         'settings' => {
           'parameter' => 'test_module_03::hash_param',
           'value'     => {
-            'hash key 2' => 'hash value 2',
+            'hash key 2' => '\-- hash value 2',
           },
         },
         'ces'      => [
@@ -173,7 +173,7 @@
       it { is_expected.to run.with_params('test_module_03::array_param').and_return(['array value 2', 'array value 1']) }
 
       # Test a simple hash.
-      it { is_expected.to run.with_params('test_module_03::hash_param').and_return({'hash key 1' => 'hash value 1', 'hash key 2' => 'hash value 2'}) }
+      it { is_expected.to run.with_params('test_module_03::hash_param').and_return({'hash key 1' => 'hash value 1', 'hash key 2' => '-- hash value 2'}) }
 
       # Test a nested hash.
       it { is_expected.to run.with_params('test_module_03::nested_hash').and_return({'key' => { 'key1' => 'value1', 'key2' => 'value2'}}) }
@@ -196,7 +196,7 @@
       it { is_expected.to run.with_params('test_module_03::array_param').and_return(['array value 1', 'array value 2']) }
 
       # Test a simple hash.
-      it { is_expected.to run.with_params('test_module_03::hash_param').and_return({'hash key 2' => 'hash value 2', 'hash key 1' => 'hash value 1'}) }
+      it { is_expected.to run.with_params('test_module_03::hash_param').and_return({'hash key 2' => '-- hash value 2', 'hash key 1' => 'hash value 1'}) }
 
       # Test a nested hash.
       it { is_expected.to run.with_params('test_module_03::nested_hash').and_return({'key' => { 'key1' => 'value2', 'key2' => 'value2'}}) }