bolt 0.0.1 → 0.5.0

data/vendored/puppet/lib/puppet/external/pson/pure/parser.rb

@@ -0,0 +1,307 @@
+require 'strscan'
+
+module PSON
+  module Pure
+    # This class implements the PSON parser that is used to parse a PSON string
+    # into a Ruby data structure.
+    class Parser < StringScanner
+      STRING                = /" ((?:[^\x0-\x1f"\\] |
+      #                              escaped special characters:
+        \\["\\\/bfnrt] |
+        \\u[0-9a-fA-F]{4} |
+        #                          match all but escaped special characters:
+          \\[\x20-\x21\x23-\x2e\x30-\x5b\x5d-\x61\x63-\x65\x67-\x6d\x6f-\x71\x73\x75-\xff])*)
+            "/nx
+      INTEGER               = /(-?0|-?[1-9]\d*)/
+      FLOAT                 = /(-?
+        (?:0|[1-9]\d*)
+        (?:
+          \.\d+(?i:e[+-]?\d+) |
+          \.\d+ |
+          (?i:e[+-]?\d+)
+            )
+            )/x
+      NAN                   = /NaN/
+      INFINITY              = /Infinity/
+      MINUS_INFINITY        = /-Infinity/
+      OBJECT_OPEN           = /\{/
+      OBJECT_CLOSE          = /\}/
+      ARRAY_OPEN            = /\[/
+      ARRAY_CLOSE           = /\]/
+      PAIR_DELIMITER        = /:/
+      COLLECTION_DELIMITER  = /,/
+      TRUE                  = /true/
+      FALSE                 = /false/
+      NULL                  = /null/
+      IGNORE                = %r(
+        (?:
+        //[^\n\r]*[\n\r]| # line comments
+        /\*               # c-style comments
+        (?:
+        [^*/]|        # normal chars
+        /[^*]|        # slashes that do not start a nested comment
+        \*[^/]|       # asterisks that do not end this comment
+        /(?=\*/)      # single slash before this comment's end
+        )*
+        \*/               # the End of this comment
+        |[ \t\r\n]+       # whitespaces: space, horicontal tab, lf, cr
+      )+
+      )mx
+
+      UNPARSED = Object.new
+
+      # Creates a new PSON::Pure::Parser instance for the string _source_.
+      #
+      # It will be configured by the _opts_ hash. _opts_ can have the following
+      # keys:
+      # * *max_nesting*: The maximum depth of nesting allowed in the parsed data
+      #   structures. Disable depth checking with :max_nesting => false|nil|0,
+      #   it defaults to 19.
+      # * *allow_nan*: If set to true, allow NaN, Infinity and -Infinity in
+      #   defiance of RFC 4627 to be parsed by the Parser. This option defaults
+      #   to false.
+      # * *object_class*: Defaults to Hash
+      # * *array_class*: Defaults to Array
+      def initialize(source, opts = {})
+        source = convert_encoding source
+        super source
+        if !opts.key?(:max_nesting) # defaults to 19
+          @max_nesting = 19
+        elsif opts[:max_nesting]
+          @max_nesting = opts[:max_nesting]
+        else
+          @max_nesting = 0
+        end
+        @allow_nan = !!opts[:allow_nan]
+        @object_class = opts[:object_class] || Hash
+        @array_class = opts[:array_class] || Array
+      end
+
+      alias source string
+
+      # Parses the current PSON string _source_ and returns the complete data
+      # structure as a result.
+      def parse
+        reset
+        obj = nil
+        until eos?
+          case
+          when scan(OBJECT_OPEN)
+            obj and raise ParserError, "source '#{peek(20)}' not in PSON!"
+            @current_nesting = 1
+            obj = parse_object
+          when scan(ARRAY_OPEN)
+            obj and raise ParserError, "source '#{peek(20)}' not in PSON!"
+            @current_nesting = 1
+            obj = parse_array
+          when skip(IGNORE)
+            ;
+          else
+            raise ParserError, "source '#{peek(20)}' not in PSON!"
+          end
+        end
+        obj or raise ParserError, "source did not contain any PSON!"
+        obj
+      end
+
+      private
+
+      def convert_encoding(source)
+        if source.respond_to?(:to_str)
+          source = source.to_str
+        else
+          raise TypeError, "#{source.inspect} is not like a string"
+        end
+        if supports_encodings?(source)
+          if source.encoding == ::Encoding::ASCII_8BIT
+            b = source[0, 4].bytes.to_a
+            source =
+              case
+              when b.size >= 4 && b[0] == 0 && b[1] == 0 && b[2] == 0
+                source.dup.force_encoding(::Encoding::UTF_32BE).encode!(::Encoding::UTF_8)
+              when b.size >= 4 && b[0] == 0 && b[2] == 0
+                source.dup.force_encoding(::Encoding::UTF_16BE).encode!(::Encoding::UTF_8)
+              when b.size >= 4 && b[1] == 0 && b[2] == 0 && b[3] == 0
+                source.dup.force_encoding(::Encoding::UTF_32LE).encode!(::Encoding::UTF_8)
+              when b.size >= 4 && b[1] == 0 && b[3] == 0
+                source.dup.force_encoding(::Encoding::UTF_16LE).encode!(::Encoding::UTF_8)
+              else
+                source.dup
+              end
+          else
+            source = source.encode(::Encoding::UTF_8)
+          end
+          source.force_encoding(::Encoding::ASCII_8BIT)
+        else
+          b = source
+          source =
+            case
+            when b.size >= 4 && b[0] == 0 && b[1] == 0 && b[2] == 0
+              PSON.encode('utf-8', 'utf-32be', b)
+            when b.size >= 4 && b[0] == 0 && b[2] == 0
+              PSON.encode('utf-8', 'utf-16be', b)
+            when b.size >= 4 && b[1] == 0 && b[2] == 0 && b[3] == 0
+              PSON.encode('utf-8', 'utf-32le', b)
+            when b.size >= 4 && b[1] == 0 && b[3] == 0
+              PSON.encode('utf-8', 'utf-16le', b)
+            else
+              b
+            end
+        end
+        source
+      end
+
+      def supports_encodings?(string)
+        # Some modules, such as REXML on 1.8.7 (see #22804) can actually create
+        # a top-level Encoding constant when they are misused. Therefore
+        # checking for just that constant is not enough, so we'll be a bit more
+        # robust about if we can actually support encoding transformations.
+        string.respond_to?(:encoding) && defined?(::Encoding)
+      end
+
+      # Unescape characters in strings.
+      UNESCAPE_MAP = Hash.new { |h, k| h[k] = k.chr }
+
+        UNESCAPE_MAP.update(
+          {
+            ?"  => '"',
+            ?\\ => '\\',
+            ?/  => '/',
+            ?b  => "\b",
+            ?f  => "\f",
+            ?n  => "\n",
+            ?r  => "\r",
+            ?t  => "\t",
+            ?u  => nil,
+
+      })
+
+      def parse_string
+        if scan(STRING)
+          return '' if self[1].empty?
+          string = self[1].gsub(%r{(?:\\[\\bfnrt"/]|(?:\\u(?:[A-Fa-f\d]{4}))+|\\[\x20-\xff])}n) do |c|
+            if u = UNESCAPE_MAP[$MATCH[1]]
+              u
+            else # \uXXXX
+              bytes = ''
+              i = 0
+              while c[6 * i] == ?\\ && c[6 * i + 1] == ?u
+                bytes << c[6 * i + 2, 2].to_i(16) << c[6 * i + 4, 2].to_i(16)
+                i += 1
+              end
+              PSON.encode('utf-8', 'utf-16be', bytes)
+            end
+          end
+          string.force_encoding(Encoding::UTF_8) if string.respond_to?(:force_encoding)
+          string
+        else
+          UNPARSED
+        end
+      rescue => e
+        raise GeneratorError, "Caught #{e.class}: #{e}", e.backtrace
+      end
+
+      def parse_value
+        case
+        when scan(FLOAT)
+          Float(self[1])
+        when scan(INTEGER)
+          Integer(self[1])
+        when scan(TRUE)
+          true
+        when scan(FALSE)
+          false
+        when scan(NULL)
+          nil
+        when (string = parse_string) != UNPARSED
+          string
+        when scan(ARRAY_OPEN)
+          @current_nesting += 1
+          ary = parse_array
+          @current_nesting -= 1
+          ary
+        when scan(OBJECT_OPEN)
+          @current_nesting += 1
+          obj = parse_object
+          @current_nesting -= 1
+          obj
+        when @allow_nan && scan(NAN)
+          NaN
+        when @allow_nan && scan(INFINITY)
+          Infinity
+        when @allow_nan && scan(MINUS_INFINITY)
+          MinusInfinity
+        else
+          UNPARSED
+        end
+      end
+
+      def parse_array
+        raise NestingError, "nesting of #@current_nesting is too deep" if
+          @max_nesting.nonzero? && @current_nesting > @max_nesting
+        result = @array_class.new
+        delim = false
+        until eos?
+          case
+          when (value = parse_value) != UNPARSED
+            delim = false
+            result << value
+            skip(IGNORE)
+            if scan(COLLECTION_DELIMITER)
+              delim = true
+            elsif match?(ARRAY_CLOSE)
+              ;
+            else
+              raise ParserError, "expected ',' or ']' in array at '#{peek(20)}'!"
+            end
+          when scan(ARRAY_CLOSE)
+            raise ParserError, "expected next element in array at '#{peek(20)}'!" if delim
+            break
+          when skip(IGNORE)
+            ;
+          else
+            raise ParserError, "unexpected token in array at '#{peek(20)}'!"
+          end
+        end
+        result
+      end
+
+      def parse_object
+        raise NestingError, "nesting of #@current_nesting is too deep" if
+          @max_nesting.nonzero? && @current_nesting > @max_nesting
+        result = @object_class.new
+        delim = false
+        until eos?
+          case
+          when (string = parse_string) != UNPARSED
+            skip(IGNORE)
+            raise ParserError, "expected ':' in object at '#{peek(20)}'!" unless scan(PAIR_DELIMITER)
+            skip(IGNORE)
+            unless (value = parse_value).equal? UNPARSED
+              result[string] = value
+              delim = false
+              skip(IGNORE)
+              if scan(COLLECTION_DELIMITER)
+                delim = true
+              elsif match?(OBJECT_CLOSE)
+                ;
+              else
+                raise ParserError, "expected ',' or '}' in object at '#{peek(20)}'!"
+              end
+            else
+              raise ParserError, "expected value in object at '#{peek(20)}'!"
+            end
+          when scan(OBJECT_CLOSE)
+            raise ParserError, "expected next name, value pair in object at '#{peek(20)}'!" if delim
+            break
+          when skip(IGNORE)
+            ;
+          else
+            raise ParserError, "unexpected token in object at '#{peek(20)}'!"
+          end
+        end
+        result
+      end
+    end
+  end
+end

data/vendored/puppet/lib/puppet/external/pson/version.rb

@@ -0,0 +1,8 @@
+module PSON
+  # PSON version
+  VERSION         = '1.1.9'
+  VERSION_ARRAY   = VERSION.split(/\./).map { |x| x.to_i } # :nodoc:
+  VERSION_MAJOR   = VERSION_ARRAY[0] # :nodoc:
+  VERSION_MINOR   = VERSION_ARRAY[1] # :nodoc:
+  VERSION_BUILD   = VERSION_ARRAY[2] # :nodoc:
+end

data/vendored/puppet/lib/puppet/face.rb

@@ -0,0 +1,12 @@
+# The public name of this feature is 'face', but we have hidden all the
+# plumbing over in the 'interfaces' namespace to make clear the distinction
+# between the two.
+#
+# This file exists to ensure that the public name is usable without revealing
+# the details of the implementation; you really only need go look at anything
+# under Interfaces if you are looking to extend the implementation.
+#
+# It isn't hidden to gratuitously hide things, just to make it easier to
+# separate out the interests people will have.  --daniel 2011-04-07
+require 'puppet/interface'
+Puppet::Face = Puppet::Interface

data/vendored/puppet/lib/puppet/face/ca.rb

@@ -0,0 +1,266 @@
+require 'puppet/face'
+
+Puppet::Face.define(:ca, '0.1.0') do
+  copyright "Puppet Inc.", 2011
+  license   _("Apache 2 license; see COPYING")
+
+  summary _("Local Puppet Certificate Authority management.")
+
+  description <<-TEXT
+    This provides local management of the Puppet Certificate Authority.
+
+    You can use this subcommand to sign outstanding certificate requests, list
+    and manage local certificates, and inspect the state of the CA.
+  TEXT
+
+  action :list do
+    summary _("List certificates and/or certificate requests.")
+
+    description <<-TEXT
+      This will list the current certificates and certificate signing requests
+      in the Puppet CA.  You will also get the fingerprint, and any certificate
+      verification failure reported.
+    TEXT
+
+    option "--[no-]all" do
+      summary _("Include all certificates and requests.")
+    end
+
+    option "--[no-]pending" do
+      summary _("Include pending certificate signing requests.")
+    end
+
+    option "--[no-]signed" do
+      summary _("Include signed certificates.")
+    end
+
+    option "--digest " + _("ALGORITHM") do
+      summary _("The hash algorithm to use when displaying the fingerprint")
+    end
+
+    option "--subject " + _("PATTERN") do
+      summary _("Only list if the subject matches PATTERN.")
+
+      description <<-TEXT
+        Only include certificates or requests where subject matches PATTERN.
+
+        PATTERN is interpreted as a regular expression, allowing complex
+        filtering of the content.
+      TEXT
+    end
+
+    when_invoked do |options|
+      #TRANSLATORS "CA" stands for "certificate authority"
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
+      unless ca = Puppet::SSL::CertificateAuthority.instance
+        #TRANSLATORS "CA" stands for "certificate authority"
+        raise _("Unable to fetch the CA")
+      end
+      Puppet::SSL::Host.ca_location = :only
+
+      pattern = options[:subject].nil? ? nil :
+        Regexp.new(options[:subject], Regexp::IGNORECASE)
+
+      pending = options[:pending].nil? ? options[:all] : options[:pending]
+      signed  = options[:signed].nil?  ? options[:all] : options[:signed]
+
+      # By default we list pending, so if nothing at all was requested...
+      unless pending or signed then pending = true end
+
+      hosts = []
+
+      pending and hosts += ca.waiting?
+      signed  and hosts += ca.list
+
+      pattern and hosts = hosts.select {|hostname| pattern.match hostname }
+
+      hosts.sort.map {|host| Puppet::SSL::Host.new(host) }
+    end
+
+    when_rendering :console do |hosts, options|
+      unless ca = Puppet::SSL::CertificateAuthority.instance
+        raise _("Unable to fetch the CA")
+      end
+
+      length = hosts.map{|x| x.name.length }.max.to_i + 1
+
+      hosts.map do |host|
+        name = host.name.ljust(length)
+        if host.certificate_request then
+          "  #{name} #{host.certificate_request.digest(options[:digest])}"
+        else
+          begin
+            ca.verify(host.name)
+            "+ #{name} #{host.certificate.digest(options[:digest])}"
+          rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError => e
+            "- #{name} #{host.certificate.digest(options[:digest])} (#{e.to_s})"
+          end
+        end
+      end.join("\n")
+    end
+  end
+
+  action :destroy do
+    summary _("Destroy named certificate or pending certificate request.")
+    when_invoked do |host, options|
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
+      unless ca = Puppet::SSL::CertificateAuthority.instance
+        raise _("Unable to fetch the CA")
+      end
+      Puppet::SSL::Host.ca_location = :local
+
+      ca.destroy host
+    end
+  end
+
+  action :revoke do
+    summary _("Add certificate to certificate revocation list.")
+    when_invoked do |host, options|
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
+      unless ca = Puppet::SSL::CertificateAuthority.instance
+        raise _("Unable to fetch the CA")
+      end
+      Puppet::SSL::Host.ca_location = :only
+
+      begin
+        ca.revoke host
+      rescue ArgumentError => e
+        # This is a bit naff, but it makes the behaviour consistent with the
+        # destroy action.  The underlying tools could be nicer for that sort
+        # of thing; they have fairly inconsistent reporting of failures.
+        raise unless e.to_s =~ /Could not find a serial number for /
+        _("Nothing was revoked")
+      end
+    end
+  end
+
+  action :generate do
+    summary _("Generate a certificate for a named client.")
+    option "--dns-alt-names " + _("NAMES") do
+      summary _("Additional DNS names to add to the certificate request")
+      description Puppet.settings.setting(:dns_alt_names).desc
+    end
+
+    when_invoked do |host, options|
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
+      unless ca = Puppet::SSL::CertificateAuthority.instance
+        raise _("Unable to fetch the CA")
+      end
+      Puppet::SSL::Host.ca_location = :local
+
+      begin
+        ca.generate(host, :dns_alt_names => options[:dns_alt_names])
+      rescue RuntimeError => e
+        if e.to_s =~ /already has a requested certificate/
+          _("%{host} already has a certificate request; use sign instead") % { host: host }
+        else
+          raise
+        end
+      rescue ArgumentError => e
+        if e.to_s =~ /A Certificate already exists for /
+          _("%{host} already has a certificate") % { host: host }
+        else
+          raise
+        end
+      end
+    end
+  end
+
+  action :sign do
+    summary _("Sign an outstanding certificate request.")
+    option("--[no-]allow-dns-alt-names") do
+      summary _("Whether or not to accept DNS alt names in the certificate request")
+    end
+
+    when_invoked do |host, options|
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
+      unless ca = Puppet::SSL::CertificateAuthority.instance
+        raise _("Unable to fetch the CA")
+      end
+      Puppet::SSL::Host.ca_location = :only
+
+      begin
+        signing_options = options.select { |k,_|
+          [:allow_dns_alt_names, :allow_authorization_extensions].include?(k)
+        }
+        ca.sign(host, signing_options)
+      rescue ArgumentError => e
+        if e.to_s =~ /Could not find certificate request/
+          e.to_s
+        else
+          raise
+        end
+      end
+    end
+  end
+
+  action :print do
+    summary _("Print the full-text version of a host's certificate.")
+    when_invoked do |host, options|
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
+      unless ca = Puppet::SSL::CertificateAuthority.instance
+        raise _("Unable to fetch the CA")
+      end
+      Puppet::SSL::Host.ca_location = :only
+
+      ca.print host
+    end
+  end
+
+  action :fingerprint do
+    #TRANSLATORS "DIGEST" refers to a hash algorithm
+    summary _("Print the DIGEST (defaults to the signing algorithm) fingerprint of a host's certificate.")
+    option "--digest " + _("ALGORITHM") do
+      summary _("The hash algorithm to use when displaying the fingerprint")
+    end
+
+    when_invoked do |host, options|
+      #TRANSLATORS "CA" stands for "certificate authority"
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
+      unless Puppet::SSL::CertificateAuthority.instance
+        #TRANSLATORS "CA" stands for "certificate authority"
+        raise _("Unable to fetch the CA")
+      end
+      Puppet::SSL::Host.ca_location = :only
+
+      if cert = (Puppet::SSL::Certificate.indirection.find(host) || Puppet::SSL::CertificateRequest.indirection.find(host))
+        cert.digest(options[:digest]).to_s
+      else
+        nil
+      end
+    end
+  end
+
+  action :verify do
+    summary "Verify the named certificate against the local CA certificate."
+    when_invoked do |host, options|
+      #TRANSLATORS "CA" stands for "certificate authority"
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
+      unless ca = Puppet::SSL::CertificateAuthority.instance
+        #TRANSLATORS "CA" stands for "certificate authority"
+        raise _("Unable to fetch the CA")
+      end
+      Puppet::SSL::Host.ca_location = :only
+
+      begin
+        ca.verify host
+        { :host => host, :valid => true }
+      rescue ArgumentError => e
+        raise unless e.to_s =~ /Could not find a certificate for/
+        { :host => host, :valid => false, :error => e.to_s }
+      rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError => e
+        { :host => host, :valid => false, :error => e.to_s }
+      end
+    end
+
+    when_rendering :console do |value|
+      if value[:valid]
+        nil
+      else
+        _("Could not verify %{host}: %{error}") % { host: value[:host], error: value[:error] }
+      end
+    end
+  end
+
+  deprecate
+end