Reject partial EC2 metadata results

[djuarezg]

Resolve EC2 metadata with strict HTTP requests so a timeout, transport exception, or non-200 response aborts the entire recursive lookup. Build metadata separately and publish it only after every request succeeds. Previously, the shared HTTP helper converted failures to empty strings, making them indistinguishable from successful empty responses and allowing partially populated metadata to be cached.

Keep successful 200 responses with empty bodies unchanged. Preserve the existing lenient HTTP helper for other callers, userdata behavior, and the EC2 cache lifetime.

Add regression coverage for successful empty values, failed child requests, timeouts, and atomic publication.

Assisted-by: OpenAI Codex:GPT-5

Fixes #175

Checklist

I have:

• read the CONTRIBUTING.md document
• read and accepted the Developer Certificate of Origin document and added a Signed-off-by annotation to each of my commits
• read and accepted the AI Policy document and added Generated-by or Assisted-by annotations to each of my commits created with the help of an AI agent
• tested this code
• included documentation (including possible behaviour changes)
• documented the code
• added or modified regression test(s)
• added or modified unit test(s)

[Copilot]

🟢 Approval recommended

The changes align with the issue’s acceptance criteria, preserve intended empty-200 behavior, and add regression coverage for failure/timeout and atomic publication semantics.

Pull request overview

This PR hardens EC2 metadata resolution to prevent partially populated metadata hashes from being returned and cached when any recursive child request fails. It introduces a strict HTTP request helper that differentiates HTTP 200 (including empty bodies) from non-200 responses and transport/timeouts, and updates the EC2 resolver to only publish metadata after the full traversal succeeds.

Changes:

• Added Facter::Util::Resolvers::Http.get_request! which returns the body for HTTP 200 (including empty) and raises on non-200 or request errors/timeouts.
• Updated Facter::Resolvers::Ec2 to build metadata in a local hash and only assign it to @fact_list[:metadata] after all recursive requests succeed; metadata resolution no longer triggers userdata retrieval.
• Added/updated specs to cover successful empty values, rejection on unsuccessful/timeout child requests, and atomic publication (no partial @fact_list[:metadata]).

File summaries

File	Description
lib/facter/util/resolvers/http.rb	Introduces strict get_request! and refactors request execution to enable raising on non-200/transport errors.
lib/facter/resolvers/ec2.rb	Switches EC2 metadata traversal to strict HTTP and publishes metadata atomically only after successful recursion.
spec/facter/util/resolvers/http_spec.rb	Adds coverage for get_request! success (including empty body) and failure/timeout/error propagation.
spec/facter/resolvers/ec2_spec.rb	Updates behavior expectations to reject partial metadata and ensures userdata isn’t fetched during metadata resolution.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[djuarezg]

Sorry, had to force-push a few times to get GitHub to get commit verified... a bit messy configuration on my account from past jobs.

[Copilot]

🟢 Approval recommended

The implementation matches the stated requirements and includes focused regression coverage.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[OpenVoxProjectBot]

Successfully created backport PR for 5.x:

• [Backport 5.x] Reject partial EC2 metadata results #179