Migrate to new method for legacy compiler checks

Author: petergmurphy

plans/upgrade.pp

@@ -140,14 +140,18 @@
     $memo + { $result.target.peadm::certname => $result['extensions'] }
   }
 
-  $compiler_missing_legacy_targets = $cert_extensions_temp.filter |$name,$exts| {
-    ($name in $compiler_targets.map |$t| { $t.name }) and (peadm::oid('peadm_legacy_compiler') in $exts and $exts[peadm::oid('peadm_legacy_compiler')] == undef)
+  # Add legacy compiler role to compilers that are missing it
+  $legacy_compiler_targets = $cert_extensions_temp.filter |$name,$exts| {
+    ($name in $compiler_targets.map |$t| { $t.name }) and
+    ($exts[peadm::oid('peadm_legacy_compiler')] != undef) and
+    ($exts[peadm::oid('peadm_legacy_compiler')] == 'true') and
+    ($exts['pp_auth_role'] != 'pe_compiler_legacy')
   }.keys
 
-  run_plan('peadm::modify_certificate', $compiler_missing_legacy_targets,
+  run_plan('peadm::modify_certificate', $legacy_compiler_targets,
     primary_host   => $primary_target,
     add_extensions => {
-      peadm::oid('peadm_legacy_compiler') => 'false',
+      'pp_auth_role' => 'pe_compiler_legacy',
     },
   )