'with' attribute

[skaraborgfakir]

I'm a bit unsure about expectation of when 'with' should work.

I have a json file which looks like this:

{
"array": [
"235235"
],
"string": "236253"
}

And '.cf' which looks like this:

vars:
"a_var[$(with)]" -> { "works" }
with => "$(array)",
string => "$(with)";

classes:
"a_exists" -> { "fail" }
with => "$(array)",
fileexists( "..../a_fil_$(with)";

"b_exists" -> { "ok" }
with => "$(string)",
fileexists( "..../b_fil_$(with)");

with in 'vars' and 'classes' behaves differently.
The differenct affects also if /unless in commands

[nickanderson]

I don't know the relevance of the JSON, and the CFEngine snippet wasn't quite syntactically right either. But I think I was able to distill it into a runnable example:

bundle agent __main__
{
  methods:
      "init";
      "test";
}
bundle agent init
{
  files:
      "$(this.promise_dirname)/a_fil_$(test.array)" create => "true";
      "$(this.promise_dirname)/b_fil_$(test.string)" create => "true";
}
bundle agent test
{
  vars:
      "array" slist => { "235235" };
      "string" string => "236253";

      # a_var[235235] string => 235235

      "a_var[$(with)]" -> { "works" }
        with => "$(array)",
        string => "$(with)";

  classes:
      "a_exists" -> { "fail" }
        with => "$(array)",
        if => fileexists( "$(this.promise_dirname)/a_fil_$(with)" );

      "b_exists" -> { "ok" }
        with => "$(string)",
        if => fileexists( "$(this.promise_dirname)/b_fil_$(with)");

  reports:

    a_exists::
      "a_exists";

    b_exists::
      "b_exists";
}

cf-agent -KIf ./main.cf --show-evaluated-vars=test\.

 R: a_exists
 R: b_exists
 Variable name                            Variable value                                               Meta tags                                Comment                                 
 default:test.a_var[235235]               235235                                                       source=promise                                                                   
 default:test.array                        {"235235"}                                                  source=promise                                                                   
 default:test.string                      236253                                                       source=promise                                                                   

What is it that doesn't work?

[skaraborgfakir]

My trouble is something like this,first set up the json:

files: "fil" content => '{ "a": [ "20250903" ], "b": "20250903" }';

  vars:
    "json"
       data => readjson( "fil", "40");
   "formatter"
    string => "My_CA_%s.csr";

     "a_var[$(with)]"
           with => "$(json[a])",
           string => format( "$(formatter)", "$(with)");
    classes:
         "csr_$(with)_finns"
               with => "$(json[a])",
      comment => "ie csr_20250903_finns if the csr already exists",
             expression => fileexists( "./$(a_var[$(with)])");

   commands:
     "openssl"
               with => "$(json[a])",
        args => "req  -out $(a_var[$(with)])",
     unless => "csr_$(with)_finns";

It is almost as if 'with' doesn't iterate over json[a]
Me think that i need to minimise the code..... and see if the symptom persists.

This is cfengine nova 3.21.5.

[skaraborgfakir]

And yes it is the 'openssl req' which is missing - even if the csr doesn't exists.

[nickanderson]

I spent a little bit of time trying to get this into a runnable state but It's still not clear to me:

bundle agent main
{
  methods:
      "init";
      "test";

}
bundle agent init
{
  files:
      "$(test.file)"
        content => '{"a": [ "20250903" ], "b": "20250903" }';
}
bundle agent test
{
  vars:
  "file" string => "/tmp/example.json";
  "dir" string => "/tmp";

  # The sameple data was larger than 40, so increased to 400
  # Added condition to only read if the file exists.
  "json"
     data => readjson( "$(file)", "400"),
     if => fileexists( "$(file)" );

 "formatter"
  string => "My_CA_%s.csr";

   "a_var[$(with)]"
         with => "$(json[a])",
         string => format( "$(formatter)", "$(with)");

  classes:
       "csr_$(with)_finns"
             with => "$(json[a])",
             comment => "ie csr_20250903_finns if the csr already exists",
             expression => fileexists( "$(dir)/$(a_var[$(with)])");

 commands:
   "openssl"
             with => "$(json[a])",
      args => 'req -X509 -new -key $(dir)/My_CA_$(formatter).csr -subj "/C=US/ST=Kansas/L=Lawrence/O=Your Company/OU=IT/CN=yourdomain.com" -out $(dir)/$(a_var[$(with)])',
   unless => "csr_$(with)_finns";
}

Variable name                            Variable value                                               Meta tags                                Comment
default:test.a_var[20250903]             My_CA_20250903.csr                                           source=promise
default:test.dir                         /tmp                                                         source=promise
default:test.file                        /tmp/example.json                                            source=promise
default:test.formatter                   My_CA_%s.csr                                                 source=promise
default:test.json                        {"a":["20250903"],"b":"20250903"}                            source=promise

It would be helpful if you could provide whatever is necessary to run the policy directly.

Also, I think you could simplify your policy here, it's not clear to me the value your use of with is bringing in most cases. Usually, with is useful for transforming a string at promise actuation time. Say, for example if you want to generate an associatiave array using the canonified version of a string as the key instead of the raw value. But at least from what I see here, I think you could probably remove them.

vars:
  "json"
     data => readjson( "fil", "40");
 "formatter"
  string => "My_CA_%s.csr";

   "a_var[$(jason[a])]"
         string => format( "$(formatter)", "$(jason[a])");

  classes:
       "csr_$(json[a])_finns"
           comment => "ie csr_20250903_finns if the csr already exists",
           expression => fileexists( "./$(a_var[$(json[a])])");

 commands:
   "openssl"
      args => "req  -out $(a_var[$(json[a])])",
      unless => "csr_$(json[a])_finns";

[skaraborgfakir]

the main reason for this use of 'with' is this:

"CSR[datum_$(with)] with => "$(default:def.pki_validering_utgivningsdatum)", string => format( "$(default:def.pki_validering_filnamn)", "$(with)", "csr");

classes: "csr_$(with)_finns" with => "$(default:def.pki_validering_utgivningsdatum)", expression => fileexists( "$(CSR[datum_$(with)])");

Compared with:
`
vars:
"CSR[datum_$(default:def.pki_validering_utgivningsdatum)]"
string => format( "$(default:def.pki_validering_fil_datum_typ)",
"$(default:def.pki_validering_utgivningsdatum)",
"csr");

classes:
"CSR_datum_$(default:def.pki_validering_utgivningsdatum)finns"
expression => fileexists( "$(CSR[datum$(default:def.pki_validering_utgivningsdatum)])");
`

The json is loaded using augments, for example a ref to the formatter is basically:
format( "$(default:def.pki_validering_fil_datum_typ)", "20250910", "csr")

[nickanderson]

Can you construct a policy file which I can run directly that will reproduce the behavior?