Merge branch 'main' into cmk-fips-api-signing

Author: weizhouapache

.asf.yaml

@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+github:
+  description: "Apache Cloudstack Cloudmonkey"
+  homepage: https://cloudstack.apache.org
+  labels:
+    - go
+    - golang
+    - cloudstack
+  features:
+    wiki: true
+    issues: true
+    projects: true
+
+  protected_branches:
+    main: {}
+
+  copilot_code_review:
+    enabled: true
+    review_drafts: true
+    review_on_push: true

.github/workflows/ci.yml

@@ -107,7 +107,7 @@ jobs:
         run: |
           mvn -q -Pdeveloper -pl developer -Ddeploydb
           mvn -q -Pdeveloper -pl developer -Ddeploydb-simulator
-          python3 -m pip install --user --upgrade tools/marvin/dist/Marvin-*.tar.gz
+          python3 -m pip install --user --upgrade tools/marvin/dist/[mM]arvin-*.tar.gz
 
       - name: Start CloudStack mgmt (Jetty) in background
         id: start_ms

.rat-excludes

@@ -4,4 +4,5 @@ apache-rat-0.17
 go.sum
 rat-report.txt
 /snap/snapcraft.yaml
-vendor
+vendor
+**/*.patch

AGENTS.md

@@ -0,0 +1,13 @@
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# Agent Guide for cloudstack-cloudmonkey
+
+This file is read by automated agents (security scanners, code analyzers,
+AI assistants) operating on this repository.
+
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md)
+
+Agents that scan this repository should consult `SECURITY.md` and the
+project-wide threat model it links before reporting issues.

Makefile

@@ -48,6 +48,22 @@ run: all
 debug:
 	$(GO) build -mod=vendor -gcflags='-N -l' -o cmk &&  dlv --listen=:2345 --headless=true --api-version=2 exec ./cmk
 
+.PHONY: vendor-patch
+vendor-patch: ## Refresh vendor/ and re-apply the local patches in patches/
+	$(info $(M) Refreshing vendor/ and re-applying local patches…)
+	$Q $(GO) mod vendor
+	$Q for p in patches/*.patch; do git apply "$$p" || exit 1; done
+	$Q echo "$(M) Done! See patches/README.md"
+
+.PHONY: vendor-check
+vendor-check: ## Verify vendor/ still carries the local patches in patches/
+	$(info $(M) Checking local patches are present in vendor/…)
+	$Q for p in patches/*.patch; do \
+		git apply --reverse --check "$$p" || { \
+			echo "ERROR: $$p is not applied to vendor/; run 'make vendor-patch'"; exit 1; }; \
+	done
+	$Q echo "$(M) All local patches present"
+
 dist-mkdir: all
 	rm -fr dist
 	mkdir -p dist

README.md

@@ -79,6 +79,27 @@ If cloudmonkey is being upgraded from a version lower than v6.0.0, it must be no
 that the cloudmonkey configuration path is changed from `~/.cloudmonkey/config` to 
 `~/.cmk/config` and a default `localcloud` profile is created. One must first set up basic configurations such as apikey/secretkey/username/password/url for the required profile(s) as required
 
+### Environment Variables
+
+`cmk` supports environment variables that mirror its CLI flags. CLI flags take
+precedence over environment variables, which take precedence over values in the
+config file.
+
+| Environment variable | Flag | Description |
+|----------------------|------|-------------|
+| `CMK_CONFIG` | `-c` | Config file path |
+| `CMK_PROFILE` | `-p` | Server profile |
+| `CMK_URL` | `-u` | CloudStack's API endpoint URL |
+| `CMK_API_KEY` | `-k` | CloudStack user's API key |
+| `CMK_SECRET_KEY` | `-s` | CloudStack user's secret key |
+| `CMK_OUTPUT` | `-o` | API response output format |
+| `CMK_DEBUG` | `-d` | Enable debug mode when set to a boolean true value (e.g. `true` or `1`) |
+
+`CMK_CONFIG` must point to an existing config file, and `CMK_PROFILE` must name
+an existing profile in the config; otherwise `cmk` exits with an error. A profile
+selected via `CMK_PROFILE` applies only to that invocation and is not persisted
+to the config file.
+
 ### License
 
 Licensed to the Apache Software Foundation (ASF) under one

SECURITY.md

@@ -0,0 +1,35 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Security Policy
+
+## Reporting a Vulnerability
+
+`apache/cloudstack-cloudmonkey` follows the [Apache Software Foundation security process](https://www.apache.org/security/).
+Please report suspected vulnerabilities privately to `security@apache.org`; do not
+open public GitHub issues or pull requests for security reports.
+
+## Threat Model
+
+`apache/cloudstack-cloudmonkey` is part of the Apache CloudStack project and is covered by the
+**project-wide CloudStack threat model** rather than a per-repository copy. What the
+project treats as in scope and out of scope, the security properties it provides and
+disclaims, the adversary model, and how findings are triaged are documented in that
+model: <https://github.com/apache/cloudstack/blob/main/THREAT_MODEL.md>.
+
+(That link resolves once the project-wide model lands on `apache/cloudstack`'s
+`main` branch — see apache/cloudstack#13293. A thin `cloudstack-cloudmonkey`-specific
+addendum can be added here later if this component needs one.)

cli/completer.go

@@ -208,6 +208,22 @@ func findAPI(apiMap map[string][]*config.API, relatedNoun string) *config.API {
 	return autocompleteAPI
 }
 
+// pluralizeNoun applies simple English pluralization rules used by the
+// autocomplete heuristics below (e.g., policy -> policies, disk -> disks).
+func pluralizeNoun(noun string) string {
+	switch {
+	case strings.HasSuffix(noun, "ies"):
+		return noun
+	case strings.HasSuffix(noun, "y") && len(noun) > 1 && !strings.ContainsAny(string(noun[len(noun)-2]), "aeiou"):
+		// Handle words ending in consonant + y (e.g., policy -> policies)
+		return noun[:len(noun)-1] + "ies"
+	case strings.HasSuffix(noun, "s") || strings.HasSuffix(noun, "x") || strings.HasSuffix(noun, "z") || strings.HasSuffix(noun, "ch") || strings.HasSuffix(noun, "sh"):
+		return noun + "es"
+	default:
+		return noun + "s"
+	}
+}
+
 func findAutocompleteAPI(arg *config.APIArg, apiFound *config.API, apiMap map[string][]*config.API) *config.API {
 	if arg.Type == "map" {
 		return nil
@@ -220,8 +236,9 @@ func findAutocompleteAPI(arg *config.APIArg, apiFound *config.API, apiMap map[st
 	case argName == "id" || argName == "ids":
 		// Heuristic: user is trying to autocomplete for id/ids arg for a list API
 		relatedNoun = apiFound.Noun
-		if apiFound.Verb != "list" {
-			relatedNoun += "s"
+		if apiFound.Verb != "list" && findAPI(apiMap, relatedNoun) == nil {
+			// Noun may already be plural (e.g. bulk ops like deleteAlerts)
+			relatedNoun = pluralizeNoun(relatedNoun)
 		}
 	case argName == "account":
 		// Heuristic: user is trying to autocomplete for accounts
@@ -249,12 +266,7 @@ func findAutocompleteAPI(arg *config.APIArg, apiFound *config.API, apiMap map[st
 				}
 			}
 		}
-		// Handle common cases where base ends with a vowel and needs "es"
-		if strings.HasSuffix(base, "s") || strings.HasSuffix(base, "x") || strings.HasSuffix(base, "z") || strings.HasSuffix(base, "ch") || strings.HasSuffix(base, "sh") {
-			relatedNoun = base + "es"
-		} else {
-			relatedNoun = base + "s"
-		}
+		relatedNoun = pluralizeNoun(base)
 	}
 
 	config.Debug("Possible related noun for the arg: ", relatedNoun, " and type: ", arg.Type)

cli/prompt.go

@@ -23,7 +23,7 @@ import (
 	"strings"
 
 	"github.com/apache/cloudstack-cloudmonkey/config"
-	"github.com/chzyer/readline"
+	"github.com/ergochat/readline"
 )
 
 // CLI config instance

cmd/command.go

@@ -65,13 +65,15 @@ CloudMonkey (cmk) 🐵 is a command line interface for Apache CloudStack.
 Allowed flags:
   -h        Show this help message or API doc when specified after an API
   -v        Print version
-  -o        API response output format: json, text, table, column, csv
-  -p        Server profile
-  -d        Enable debug mode
-  -c        Different config file path
-  -u	    CloudStack's API endpoint URL
-  -s	    CloudStack user's secret Key
-  -k	    CloudStack user's API Key
+  -o        API response output format: json, text, table, column, csv (env: CMK_OUTPUT)
+  -p        Server profile (env: CMK_PROFILE)
+  -d        Enable debug mode (env: CMK_DEBUG)
+  -c        Different config file path (env: CMK_CONFIG)
+  -u        CloudStack's API endpoint URL (env: CMK_URL)
+  -s        CloudStack user's secret key (env: CMK_SECRET_KEY)
+  -k        CloudStack user's API key (env: CMK_API_KEY)
+
+CLI flags take precedence over their environment variables.
 
 Default commands:
 %s