fix: skip chown in rootless containers via ensure_ownership helper

[dotconfig404]

Alternative to #30 and #32 that fixes the same rootless-container issue with a small refactor.

In rootless containers, openvoxserver-ca may run without CAP_CHOWN. In that case, the FileUtils.chown calls in file_system.rb can raise Errno::EPERM, aborting commands such as puppetserver ca setup or puppetserver ca import.

This PR consolidates ownership changes into a single helper: FileSystem.ensure_ownership(path). The helper only performs chown when running as root; otherwise it is a no-op. When running as non-root, the current process has created the path, so ownership is already correct.

Note that find_user_and_group already falls back to the current user when not running as root, so existing call sites effectively perform a no-op chown in that case. forcibly_symlink bypasses this and uses the source UID/GID directly, which is what triggers EPERM in rootless environments.

This PR makes the “should we chown at all?” decision explicit and consistent across all call sites.

Compared with #30 and #32, this keeps the same behavioral fix but centralizes the logic in one place, making it easier to reason about.

This preserves existing behavior when running as root.

Changes

• remove singleton state from file_system.rb
• remove find_user_and_group / @user / @group
• introduce ensure_ownership(path)
• convert remaining methods to class methods
• add focused specs for ensure_ownership

[bastelfreak]

please add the missing newline

[bastelfreak]

@dotconfig404 thanks for the PR! Please see the failing the DCO check: https://github.com/OpenVoxProject/openvoxserver-ca/pull/33/checks

[slauger]

Centralizing the ownership logic in ensure_ownership is a much better approach than guarding each call site individually (like #30 and #32 do). The removal of the singleton state and find_user_and_group makes the class easier to reason about.

I'll close #32 in favor of this. LGTM.

[slauger]

@bastelfreak Could you approve the GitHub Actions workflow for this PR?

[bastelfreak]

@slauger @sebastianrakel @rwaffen did one of you had a chance to test this?

[slauger]

I tested this against my operator image build. It replaces the sed-based workarounds. The image build and a puppetserver ca setup both worked fine in a rootless container. LGTM from my side.