beaker-pe 3.6.5 → 3.6.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 330fb055e63900ac5bdefd9d48a122eb35a13872c6a820bb072fe88409415ab7
-  data.tar.gz: 17588df9d4e67e74cab914118a35457d66aad62397c6c1194c41eb1ba51e967c
+  metadata.gz: aa8b72f2297a472ddc6291dd99dba0607bee54af45ebf9599675aac36823ecc7
+  data.tar.gz: 8186462c53f80d68b4d0c19c46d1fafdb24bd4af604b18d2b40a3ca0820dbf23
 SHA512:
-  metadata.gz: 50576aa57b1e28945226720abe0f959cf1c05b56c29e84f61a215b461bb171728b27c0b03eaea233b9da69fc948938536c23ee8057bc7c54f5647c1ef6d6fd94
-  data.tar.gz: 8e5c488e4dbfd2a940f78a7bf434efc5d9fac63ffece679e07d5a078a616c807c480fe234b53d3710bc0b67c447362382abecefa25e14139f5762ba2195bd0b9
+  metadata.gz: 723ce4a758aaa6cfd40b907ae7a6877349d6402393e445b9a9f147437d60db22d64d9ef29f795884f0f16a9b07c8cb566e9a9bcf50383cfd1819266a59ef0d6d
+  data.tar.gz: b862c17a232e7c30b7d5d623a0d947a0cf95c58554722f76cba6f5f23e5b60a224e30ba0ca04fa2f8058192b0ab46b831d101831fb894ea9270d745fe839d16e

data/CHANGELOG.md

@@ -1,28 +1,45 @@
 # Changelog
 
-## [3.6.5](https://github.com/puppetlabs/beaker-pe/tree/3.6.5) (2026-07-29)
+## [3.6.6](https://github.com/puppetlabs/beaker-pe/tree/3.6.6) (2026-08-12)
+
+[Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.5...3.6.6)
+
+**Fixed bugs:**
+
+- \(PE-45827\) Prefer the ssl status endpoint for PuppetDB liveness validation [\#311](https://github.com/puppetlabs/beaker-pe/pull/311) ([jonathannewman](https://github.com/jonathannewman))
+
+## [3.6.5](https://github.com/puppetlabs/beaker-pe/tree/3.6.5) (2026-07-30)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.4...3.6.5)
 
 **Implemented enhancements:**
 
-- (PE-45366) Add pe_run_in_parallel option, serial by default on macOS [#309](https://github.com/puppetlabs/beaker-pe/pull/309) ([Magisus](https://github.com/Magisus))
+- \(PE-45366\) Add pe\_run\_in\_parallel option, serial by default on macOS [\#309](https://github.com/puppetlabs/beaker-pe/pull/309) ([Magisus](https://github.com/Magisus))
+
+**Merged pull requests:**
+
+- \(maint\) prepare for release 3.6.5 [\#310](https://github.com/puppetlabs/beaker-pe/pull/310) ([Magisus](https://github.com/Magisus))
 
 ## [3.6.4](https://github.com/puppetlabs/beaker-pe/tree/3.6.4) (2026-07-23)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.3...3.6.4)
 
-**Fixed bugs:**
+**Merged pull requests:**
 
-- [PE-41009]: Fall back to agent-downloads when promoted agent is missing from the public mirror [#306](https://github.com/puppetlabs/beaker-pe/pull/306) ([Magisus](https://github.com/Magisus))
+- \(maint\) prepare for release 3.6.4 [\#307](https://github.com/puppetlabs/beaker-pe/pull/307) ([Magisus](https://github.com/Magisus))
+- \(PE-41009\) Fall back to agent-downloads when promoted agent is missing from public mirror [\#306](https://github.com/puppetlabs/beaker-pe/pull/306) ([Magisus](https://github.com/Magisus))
 
 ## [3.6.3](https://github.com/puppetlabs/beaker-pe/tree/3.6.3) (2026-07-16)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.6.2...3.6.3)
 
-**Fixed bugs:**
+**Implemented enhancements:**
 
-- [PE-45082]: Broaden is_expected_pe_postgres_failure? allowlist [#303](https://github.com/puppetlabs/beaker-pe/pull/303) ([steveax](https://github.com/steveax))
+- \(PE-45082\) Broaden is\_expected\_pe\_postgres\_failure? allowlist [\#303](https://github.com/puppetlabs/beaker-pe/pull/303) ([steveax](https://github.com/steveax))
+
+**Merged pull requests:**
+
+- \(maint\) prepare for release 3.6.3 [\#304](https://github.com/puppetlabs/beaker-pe/pull/304) ([steveax](https://github.com/steveax))
 
 ## [3.6.2](https://github.com/puppetlabs/beaker-pe/tree/3.6.2) (2026-06-05)
 
@@ -30,7 +47,7 @@
 
 **Fixed bugs:**
 
-- Add waitforlock flag to second puppet runs to prevent lock collisions [#300](https://github.com/puppetlabs/beaker-pe/pull/300) ([jonathannewman](https://github.com/jonathannewman))
+- Add waitforlock\_flag to second puppet runs to prevent lock collisions [\#300](https://github.com/puppetlabs/beaker-pe/pull/300) ([jonathannewman](https://github.com/jonathannewman))
 
 ## [3.6.1](https://github.com/puppetlabs/beaker-pe/tree/3.6.1) (2025-11-21)
 
@@ -54,15 +71,20 @@
 
 **Implemented enhancements:**
 
-- \(PE-40793\) Follow https->>http redirects [\#287](https://github.com/puppetlabs/beaker-pe/pull/287) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(maint\) prepare for 3.5.0 release [\#288](https://github.com/puppetlabs/beaker-pe/pull/288) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(PE-40793\) Follow https-\>\>http redirects [\#287](https://github.com/puppetlabs/beaker-pe/pull/287) ([tvpartytonight](https://github.com/tvpartytonight))
 
-## [3.4.0](https://github.com/puppetlabs/beaker-pe/tree/3.4.0) (2025-03-12)
+## [3.4.0](https://github.com/puppetlabs/beaker-pe/tree/3.4.0) (2025-03-13)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-pe/compare/3.3.1...3.4.0)
 
 **Implemented enhancements:**
 
-- \(PE-40143\) Add ruby 3.2 support [\#285](https://github.com/puppetlabs/beaker-pe/pull/285) ([tvpartytonight](https://github.com/tvpartytonight))
+- \(PE-40143\) Update beaker-pe for ruby 3.2 compatibility [\#285](https://github.com/puppetlabs/beaker-pe/pull/285) ([tvpartytonight](https://github.com/tvpartytonight))
+
+**Merged pull requests:**
+
+- \(maint\) prep for 3.4.0 release [\#286](https://github.com/puppetlabs/beaker-pe/pull/286) ([tvpartytonight](https://github.com/tvpartytonight))
 
 ## [3.3.1](https://github.com/puppetlabs/beaker-pe/tree/3.3.1) (2024-12-05)
 
@@ -728,7 +750,7 @@
 **Merged pull requests:**
 
 - PE-11351 clear puppet jenkins slaves [\#98](https://github.com/puppetlabs/beaker-pe/pull/98) ([mwbutcher](https://github.com/mwbutcher))
-- \(maint\) Add beaker-abs to gemspec [\#97](https://github.com/puppetlabs/beaker-pe/pull/97) ([smcelmurry](https://github.com/smcelmurry))
+- \(maint\) Add beaker-abs to gemspec [\#97](https://github.com/puppetlabs/beaker-pe/pull/97) ([junebug-spencer](https://github.com/junebug-spencer))
 - \(RE-9922\) Migrate from stickler to artifactory [\#96](https://github.com/puppetlabs/beaker-pe/pull/96) ([sarameisburger](https://github.com/sarameisburger))
 
 ## [1.32.0](https://github.com/puppetlabs/beaker-pe/tree/1.32.0) (2018-01-09)
@@ -799,7 +821,6 @@
 
 - Fix agent installation failure caused by previous commit [\#87](https://github.com/puppetlabs/beaker-pe/pull/87) ([shaigy](https://github.com/shaigy))
 - PE-22051 Changes for adding loadbalancer to LEI job [\#86](https://github.com/puppetlabs/beaker-pe/pull/86) ([shaigy](https://github.com/shaigy))
-- \(MAINT\) Fix linux masterless installation [\#70](https://github.com/puppetlabs/beaker-pe/pull/70) ([Renelast](https://github.com/Renelast))
 
 ## [1.23.0](https://github.com/puppetlabs/beaker-pe/tree/1.23.0) (2017-09-15)
 
@@ -1153,7 +1174,6 @@
 
 - \(maint\) Remove leftover comments [\#7](https://github.com/puppetlabs/beaker-pe/pull/7) ([tvpartytonight](https://github.com/tvpartytonight))
 - BKR-656 [\#6](https://github.com/puppetlabs/beaker-pe/pull/6) ([tvpartytonight](https://github.com/tvpartytonight))
-- Fixes windows masterless installation [\#1](https://github.com/puppetlabs/beaker-pe/pull/1) ([Renelast](https://github.com/Renelast))
 
 ## [0.1.2](https://github.com/puppetlabs/beaker-pe/tree/0.1.2) (2016-04-05)
 

data/lib/beaker-pe/install/pe_utils.rb

@@ -1840,11 +1840,33 @@ EOM
           if version_is_less(host['pe_ver'], '2016.1.0')
             return true
           end
+
+          ssl_port = options[:puppetdb_port_ssl] || 8081
+          nonssl_port = options[:puppetdb_port_nonssl] || 8080
+
           Timeout.timeout(60) do
             match = nil
             while not match
-              output = on(host, "curl -s http://localhost:8080/pdb/meta/v1/version", :accept_all_exit_codes => true)
+              # Prefer the ssl status endpoint. PuppetDB's jetty listener is
+              # explicitly configured with `client-auth = want`, not `need`
+              # (see puppet_enterprise::puppetdb::jetty_ini.pp), and
+              # /pdb/meta/v1/version -- like the rest of /status/v1/* -- is
+              # allow-unauthenticated in PuppetDB's auth.conf. So `curl -k`
+              # gets a real, validated response with no client cert needed,
+              # and it's the only path that still works once the cleartext
+              # listener is disabled by default (PE-45384/PE-44906,
+              # SECVULN-1792; PE-45827).
+              output = on(host, "curl -s -k https://localhost:#{ssl_port}/pdb/meta/v1/version", :accept_all_exit_codes => true)
               match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+
+              # Fall back to the cleartext port for older or nonstandard
+              # configurations where the ssl endpoint doesn't behave as
+              # above.
+              if !match
+                output = on(host, "curl -s http://localhost:#{nonssl_port}/pdb/meta/v1/version", :accept_all_exit_codes => true)
+                match = output.stdout =~ /version.*\d+\.\d+\.\d+/
+              end
+
               sleep 1
             end
           end

data/lib/beaker-pe/version.rb

@@ -3,7 +3,7 @@ module Beaker
     module PE
 
       module Version
-        STRING = '3.6.5'
+        STRING = '3.6.6'
       end
 
     end

data/spec/beaker-pe/install/pe_utils_spec.rb

@@ -2663,6 +2663,48 @@ NOASK
     end
   end
 
+  describe '#check_puppetdb_status_endpoint' do
+    it 'does not do anything if version is less than 2016.1.0' do
+      allow(subject).to receive(:version_is_less).and_return(true)
+
+      expect(subject).not_to receive(:on)
+      subject.check_puppetdb_status_endpoint(unixhost)
+    end
+
+    it 'succeeds via the ssl endpoint alone, without ever falling back to cleartext (PE-45827)' do
+      allow(subject).to receive(:version_is_less).and_return(false)
+      allow(subject).to receive(:sleep)
+      ssl_result = double(Beaker::Result, :stdout => '{"version":"7.12.1"}', :exit_code => 0)
+      expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/}, anything).once.and_return(ssl_result)
+      expect(subject).not_to receive(:on).with(anything, %r{http://localhost:8080/}, anything)
+
+      expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
+    end
+
+    context 'when the ssl endpoint never returns valid content (older or nonstandard config)' do
+      it 'falls back to the cleartext endpoint' do
+        allow(subject).to receive(:version_is_less).and_return(false)
+        allow(subject).to receive(:sleep)
+        ssl_result = double(Beaker::Result, :stdout => '', :exit_code => 0)
+        nonssl_result = double(Beaker::Result, :stdout => '{"version":"7.12.1"}', :exit_code => 0)
+        expect(subject).to receive(:on).with(anything, %r{-k https://localhost:8081/}, anything).once.ordered.and_return(ssl_result)
+        expect(subject).to receive(:on).with(anything, %r{http://localhost:8080/}, anything).once.ordered.and_return(nonssl_result)
+
+        expect { subject.check_puppetdb_status_endpoint(unixhost) }.not_to raise_error
+      end
+    end
+
+    context 'when neither endpoint ever returns valid content' do
+      it 'still fails the test, preserving the original PE-14934 race guard' do
+        allow(subject).to receive(:version_is_less).and_return(false)
+        allow(Timeout).to receive(:timeout).and_raise(Timeout::Error)
+        expect(subject).to receive(:fail_test).with('PuppetDB took too long to start')
+
+        subject.check_puppetdb_status_endpoint(unixhost)
+      end
+    end
+  end
+
   describe '#get_puppet_agent_version' do
 
     context 'when the puppet_agent version is set on an argument' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: beaker-pe
 version: !ruby/object:Gem::Version
-  version: 3.6.5
+  version: 3.6.6
 platform: ruby
 authors:
 - Puppetlabs