bolt 0.20.0 → 0.20.2

data/vendored/puppet/lib/puppet/application/apply.rb

@@ -0,0 +1,356 @@
+require 'puppet/application'
+require 'puppet/configurer'
+require 'puppet/util/profiler/aggregate'
+
+class Puppet::Application::Apply < Puppet::Application
+  require 'puppet/util/splayer'
+  include Puppet::Util::Splayer
+
+  option("--debug","-d")
+  option("--execute EXECUTE","-e") do |arg|
+    options[:code] = arg
+  end
+  option("--loadclasses","-L")
+  option("--test","-t")
+  option("--verbose","-v")
+  option("--use-nodes")
+  option("--detailed-exitcodes")
+
+  option("--write-catalog-summary")
+
+  option("--catalog catalog",  "-c catalog") do |arg|
+    options[:catalog] = arg
+  end
+
+  option("--logdest LOGDEST", "-l") do |arg|
+    handle_logdest_arg(arg)
+  end
+
+  option("--parseonly") do |args|
+    puts "--parseonly has been removed. Please use 'puppet parser validate <manifest>'"
+    exit 1
+  end
+
+  def summary
+    _("Apply Puppet manifests locally")
+  end
+
+  def help
+    <<-HELP
+
+puppet-apply(8) -- #{summary}
+========
+
+SYNOPSIS
+--------
+Applies a standalone Puppet manifest to the local system.
+
+
+USAGE
+-----
+puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
+  [-e|--execute] [--detailed-exitcodes] [-L|--loadclasses]
+  [-l|--logdest syslog|eventlog|<ABS FILEPATH>|console] [--noop]
+  [--catalog <catalog>] [--write-catalog-summary] <file>
+
+
+DESCRIPTION
+-----------
+This is the standalone puppet execution tool; use it to apply
+individual manifests.
+
+When provided with a modulepath, via command line or config file, puppet
+apply can effectively mimic the catalog that would be served by puppet
+master with access to the same modules, although there are some subtle
+differences. When combined with scheduling and an automated system for
+pushing manifests, this can be used to implement a serverless Puppet
+site.
+
+Most users should use 'puppet agent' and 'puppet master' for site-wide
+manifests.
+
+
+OPTIONS
+-------
+Note that any setting that's valid in the configuration
+file is also a valid long argument. For example, 'tags' is a
+valid setting, so you can specify '--tags <class>,<tag>'
+as an argument.
+
+See the configuration file documentation at
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet with
+'--genconfig'.
+
+* --debug:
+  Enable full debugging.
+
+* --detailed-exitcodes:
+  Provide extra information about the run via exit codes. If enabled, 'puppet
+  apply' will use the following exit codes:
+
+  0: The run succeeded with no changes or failures; the system was already in
+  the desired state.
+
+  1: The run failed.
+
+  2: The run succeeded, and some resources were changed.
+
+  4: The run succeeded, and some resources failed.
+
+  6: The run succeeded, and included both changes and failures.
+
+* --help:
+  Print this help message
+
+* --loadclasses:
+  Load any stored classes. 'puppet agent' caches configured classes
+  (usually at /etc/puppetlabs/puppet/classes.txt), and setting this option causes
+  all of those classes to be set in your puppet manifest.
+
+* --logdest:
+  Where to send log messages. Choose between 'syslog' (the POSIX syslog
+  service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
+  file. Defaults to 'console'.
+
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
+
+* --noop:
+  Use 'noop' mode where Puppet runs in a no-op or dry-run mode. This
+  is useful for seeing what changes Puppet will make without actually
+  executing the changes.
+
+* --execute:
+  Execute a specific piece of Puppet code
+
+* --test:
+  Enable the most common options used for testing. These are 'verbose',
+  'detailed-exitcodes' and 'show_diff'.
+
+* --verbose:
+  Print extra information.
+
+* --catalog:
+  Apply a JSON catalog (such as one generated with 'puppet master --compile'). You can
+  either specify a JSON file or pipe in JSON from standard input.
+
+* --write-catalog-summary
+  After compiling the catalog saves the resource list and classes list to the node
+  in the state directory named classes.txt and resources.txt
+
+EXAMPLE
+-------
+    $ puppet apply -l /tmp/manifest.log manifest.pp
+    $ puppet apply --modulepath=/root/dev/modules -e "include ntpd::server"
+    $ puppet apply --catalog catalog.json
+
+
+AUTHOR
+------
+Luke Kanies
+
+
+COPYRIGHT
+---------
+Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
+
+    HELP
+  end
+
+  def app_defaults
+    super.merge({
+      :default_file_terminus => :file_server,
+    })
+  end
+
+  def run_command
+    if options[:catalog]
+      apply
+    else
+      main
+    end
+  end
+
+  def apply
+    if options[:catalog] == "-"
+      text = $stdin.read
+    else
+      text = Puppet::FileSystem.read(options[:catalog], :encoding => 'utf-8')
+    end
+    env = Puppet.lookup(:environments).get(Puppet[:environment])
+    Puppet.override(:current_environment => env, :loaders => Puppet::Pops::Loaders.new(env)) do
+      catalog = read_catalog(text)
+      apply_catalog(catalog)
+    end
+  end
+
+  def main
+    # Set our code or file to use.
+    if options[:code] or command_line.args.length == 0
+      Puppet[:code] = options[:code] || STDIN.read
+    else
+      manifest = command_line.args.shift
+      raise _("Could not find file %{manifest}") % { manifest: manifest } unless Puppet::FileSystem.exist?(manifest)
+      Puppet.warning(_("Only one file can be applied per run.  Skipping %{files}") % { files: command_line.args.join(', ') }) if command_line.args.size > 0
+    end
+
+    # splay if needed
+    splay
+
+    unless Puppet[:node_name_fact].empty?
+      # Collect our facts.
+      unless facts = Puppet::Node::Facts.indirection.find(Puppet[:node_name_value])
+        raise _("Could not find facts for %{node}") % { node: Puppet[:node_name_value] }
+      end
+
+      Puppet[:node_name_value] = facts.values[Puppet[:node_name_fact]]
+      facts.name = Puppet[:node_name_value]
+    end
+
+    # Find our Node
+    unless node = Puppet::Node.indirection.find(Puppet[:node_name_value])
+      raise _("Could not find node %{node}") % { node: Puppet[:node_name_value] }
+    end
+
+    configured_environment = node.environment || Puppet.lookup(:current_environment)
+
+    apply_environment = manifest ?
+      configured_environment.override_with(:manifest => manifest) :
+      configured_environment
+
+    # Modify the node descriptor to use the special apply_environment.
+    # It is based on the actual environment from the node, or the locally
+    # configured environment if the node does not specify one.
+    # If a manifest file is passed on the command line, it overrides
+    # the :manifest setting of the apply_environment.
+    node.environment = apply_environment
+
+    #TRANSLATORS "puppet apply" is a program command and should not be translated
+    Puppet.override({:current_environment => apply_environment}, _("For puppet apply")) do
+      # Merge in the facts.
+      node.merge(facts.values) if facts
+
+      # Add server facts so $server_facts[environment] exists when doing a puppet apply
+      node.add_server_facts({})
+
+      # Allow users to load the classes that puppet agent creates.
+      if options[:loadclasses]
+        file = Puppet[:classfile]
+        if Puppet::FileSystem.exist?(file)
+          unless FileTest.readable?(file)
+            $stderr.puts _("%{file} is not readable") % { file: file }
+            exit(63)
+          end
+          node.classes = Puppet::FileSystem.read(file, :encoding => 'utf-8').split(/[\s]+/)
+        end
+      end
+
+      begin
+        # Compile the catalog
+        starttime = Time.now
+
+        # When compiling, the compiler traps and logs certain errors
+        # Those that do not lead to an immediate exit are caught by the general
+        # rule and gets logged.
+        #
+        catalog =
+        begin
+          Puppet::Resource::Catalog.indirection.find(node.name, :use_node => node)
+        rescue Puppet::ParseErrorWithIssue, Puppet::Error
+          # already logged and handled by the compiler for these two cases
+          exit(1)
+        end
+
+        # Translate it to a RAL catalog
+        catalog = catalog.to_ral
+
+        catalog.finalize
+
+        catalog.retrieval_duration = Time.now - starttime
+
+        if options[:write_catalog_summary]
+          catalog.write_class_file
+          catalog.write_resource_file
+        end
+
+        exit_status = Puppet.override(:loaders => Puppet::Pops::Loaders.new(apply_environment)) { apply_catalog(catalog) }
+
+        if not exit_status
+          exit(1)
+        elsif options[:detailed_exitcodes] then
+          exit(exit_status)
+        else
+          exit(0)
+        end
+      rescue => detail
+        Puppet.log_exception(detail)
+        exit(1)
+      end
+    end
+
+  ensure
+    if @profiler
+      Puppet::Util::Profiler.remove_profiler(@profiler)
+      @profiler.shutdown
+    end
+  end
+
+  # Enable all of the most common test options.
+  def setup_test
+    Puppet.settings.handlearg("--no-splay")
+    Puppet.settings.handlearg("--show_diff")
+    options[:verbose] = true
+    options[:detailed_exitcodes] = true
+  end
+
+  def setup
+    setup_test if options[:test]
+
+    exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
+
+    Puppet::Util::Log.newdestination(:console) unless options[:setdest]
+
+    Signal.trap(:INT) do
+      $stderr.puts _("Exiting")
+      exit(1)
+    end
+
+    Puppet.settings.use :main, :agent, :ssl
+
+
+    if Puppet[:catalog_cache_terminus]
+      Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus]
+    end
+
+    # we want the last report to be persisted locally
+    Puppet::Transaction::Report.indirection.cache_class = :yaml
+
+    set_log_level
+
+    if Puppet[:profile]
+      @profiler = Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:info), "apply"))
+    end
+  end
+
+  private
+
+  def read_catalog(text)
+    format = Puppet::Resource::Catalog.default_format
+    begin
+      catalog = Puppet::Resource::Catalog.convert_from(format, text)
+    rescue => detail
+      raise Puppet::Error, _("Could not deserialize catalog from %{format}: %{detail}") % { format: format, detail: detail }, detail.backtrace
+    end
+
+    catalog.to_ral
+  end
+
+  def apply_catalog(catalog)
+    configurer = Puppet::Configurer.new
+    configurer.run(:catalog => catalog, :pluginsync => false)
+  end
+end

data/vendored/puppet/lib/puppet/application/ca.rb

@@ -0,0 +1,11 @@
+require 'puppet/application/face_base'
+require 'puppet/ssl/oids'
+
+class Puppet::Application::Ca < Puppet::Application::FaceBase
+  run_mode :master
+
+  def setup
+    Puppet::SSL::Oids.register_puppet_oids
+    super
+  end
+end

data/vendored/puppet/lib/puppet/application/catalog.rb

@@ -0,0 +1,4 @@
+require 'puppet/application/indirection_base'
+
+class Puppet::Application::Catalog < Puppet::Application::IndirectionBase
+end

data/vendored/puppet/lib/puppet/application/cert.rb

@@ -0,0 +1,339 @@
+require 'puppet/application'
+require 'puppet/ssl/certificate_authority/interface'
+
+class Puppet::Application::Cert < Puppet::Application
+
+  run_mode :master
+
+  attr_accessor :all, :ca, :digest, :signed
+
+  def subcommand
+    @subcommand
+  end
+
+  def subcommand=(name)
+    # Handle the nasty, legacy mapping of "clean" to "destroy".
+    sub = name.to_sym
+    @subcommand = (sub == :clean ? :destroy : sub)
+  end
+
+  option("--clean", "-c") do |arg|
+    self.subcommand = "destroy"
+  end
+
+  option("--all", "-a") do |arg|
+    @all = true
+  end
+
+  option("--digest DIGEST") do |arg|
+    @digest = arg
+  end
+
+  option("--signed", "-s") do |arg|
+    @signed = true
+  end
+
+  option("--debug", "-d") do |arg|
+    options[:debug] = true
+    set_log_level
+  end
+
+  option("--list", "-l") do |arg|
+    self.subcommand = :list
+  end
+
+  option("--revoke", "-r") do |arg|
+    self.subcommand = :revoke
+  end
+
+  option("--generate", "-g") do |arg|
+    self.subcommand = :generate
+  end
+
+  option("--sign", "-s") do |arg|
+    self.subcommand = :sign
+  end
+
+  option("--print", "-p") do |arg|
+    self.subcommand = :print
+  end
+
+  option("--verify", "-v") do |arg|
+    self.subcommand = :verify
+  end
+
+  option("--fingerprint", "-f") do |arg|
+    self.subcommand = :fingerprint
+  end
+
+  option("--reinventory") do |arg|
+    self.subcommand = :reinventory
+  end
+
+  option("--[no-]allow-dns-alt-names") do |value|
+    options[:allow_dns_alt_names] = value
+  end
+
+  option("--[no-]allow-authorization-extensions") do |value|
+    options[:allow_authorization_extensions] = value
+  end
+
+  option("--verbose", "-v") do |arg|
+    options[:verbose] = true
+    set_log_level
+  end
+
+  option("--human-readable", "-H") do |arg|
+    options[:format] = :human
+  end
+
+  option("--machine-readable", "-m") do |arg|
+    options[:format] = :machine
+  end
+
+  option("--interactive", "-i") do |arg|
+    options[:interactive] = true
+  end
+
+  option("--assume-yes", "-y") do |arg|
+    options[:yes] = true
+  end
+
+  def summary
+    _("Manage certificates and requests")
+  end
+
+  def help
+    <<-HELP
+
+puppet-cert(8) -- #{summary}
+========
+
+SYNOPSIS
+--------
+Standalone certificate authority. Capable of generating certificates,
+but mostly used for signing certificate requests from puppet clients.
+
+
+USAGE
+-----
+puppet cert <action> [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
+  [--digest <digest>] [<host>]
+
+
+DESCRIPTION
+-----------
+Because the puppet master service defaults to not signing client
+certificate requests, this script is available for signing outstanding
+requests. It can be used to list outstanding requests and then either
+sign them individually or sign all of them.
+
+ACTIONS
+-------
+
+Every action except 'list' and 'generate' requires a hostname to act on,
+unless the '--all' option is set.
+
+The most important actions for day-to-day use are 'list' and 'sign'.
+
+* clean:
+  Revoke a host's certificate (if applicable) and remove all files
+  related to that host from puppet cert's storage. This is useful when
+  rebuilding hosts, since new certificate signing requests will only be
+  honored if puppet cert does not have a copy of a signed certificate
+  for that host. If '--all' is specified then all host certificates,
+  both signed and unsigned, will be removed.
+
+* fingerprint:
+  Print the DIGEST (defaults to the signing algorithm) fingerprint of a
+  host's certificate.
+
+* generate:
+  Generate a certificate for a named client. A certificate/keypair will
+  be generated for each client named on the command line.
+
+* list:
+  List outstanding certificate requests. If '--all' is specified, signed
+  certificates are also listed, prefixed by '+', and revoked or invalid
+  certificates are prefixed by '-' (the verification outcome is printed
+  in parenthesis). If '--human-readable' or '-H' is specified,
+  certificates are formatted in a way to improve human scan-ability. If
+  '--machine-readable' or '-m' is specified, output is formatted concisely
+  for consumption by a script.
+
+* print:
+  Print the full-text version of a host's certificate.
+
+* revoke:
+  Revoke the certificate of a client. The certificate can be specified either
+  by its serial number (given as a hexadecimal number prefixed by '0x') or by its
+  hostname. The certificate is revoked by adding it to the Certificate Revocation
+  List given by the 'cacrl' configuration option. Note that the puppet master
+  needs to be restarted after revoking certificates.
+
+* sign:
+  Sign an outstanding certificate request. If '--interactive' or '-i' is
+  supplied the user will be prompted to confirm that they are signing the
+  correct certificate (recommended). If '--assume-yes' or '-y' is supplied
+  the interactive prompt will assume the answer of 'yes'.
+
+* verify:
+  Verify the named certificate against the local CA certificate.
+
+* reinventory:
+  Build an inventory of the issued certificates. This will destroy the current
+  inventory file specified by 'cert_inventory' and recreate it from the
+  certificates found in the 'certdir'. Ensure the puppet master is stopped
+  before running this action.
+
+OPTIONS
+-------
+Note that any setting that's valid in the configuration
+file is also a valid long argument. For example, 'ssldir' is a valid
+setting, so you can specify '--ssldir <directory>' as an
+argument.
+
+See the configuration file documentation at
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet cert with
+'--genconfig'.
+
+* --all:
+  Operate on all items. Currently only makes sense with the 'sign',
+  'list', and 'fingerprint' actions.
+
+* --allow-dns-alt-names:
+  Sign a certificate request even if it contains one or more alternate DNS
+  names. If this option isn't specified, 'puppet cert sign' will ignore any
+  requests that contain alternate names.
+
+  In general, ONLY certs intended for a Puppet master server should include
+  alternate DNS names, since Puppet agent relies on those names for identifying
+  its rightful server.
+
+  You can make Puppet agent request a certificate with alternate names by
+  setting 'dns_alt_names' in puppet.conf or specifying '--dns_alt_names' on the
+  command line. The output of 'puppet cert list' shows any requested alt names
+  for pending certificate requests.
+
+* --allow-authorization-extensions:
+  Enable the signing of a request with authorization extensions. Such requests
+  are sensitive because they can be used to write access rules in Puppet Server.
+  Currently, this is the only means by which such requests can be signed.
+
+* --digest:
+  Set the digest for fingerprinting (defaults to the digest used when
+  signing the cert). Valid values depends on your openssl and openssl ruby
+  extension version.
+
+* --debug:
+  Enable full debugging.
+
+* --help:
+  Print this help message
+
+* --verbose:
+  Enable verbosity.
+
+* --version:
+  Print the puppet version number and exit.
+
+
+EXAMPLE
+-------
+    $ puppet cert list
+    culain.madstop.com
+    $ puppet cert sign culain.madstop.com
+
+
+AUTHOR
+------
+Luke Kanies
+
+
+COPYRIGHT
+---------
+Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
+
+    HELP
+  end
+
+  def main
+    if @all
+      hosts = :all
+    elsif @signed
+      hosts = :signed
+    else
+      hosts = command_line.args.collect { |h| h.downcase }
+    end
+    begin
+      if subcommand == :destroy
+        raise _("Refusing to destroy all certs, provide an explicit list of certs to destroy") if hosts == :all
+
+        signed_hosts = hosts - @ca.waiting?
+        apply(@ca, :revoke, options.merge(:to => signed_hosts)) unless signed_hosts.empty?
+      end
+      apply(@ca, subcommand, options.merge(:to => hosts, :digest => @digest))
+    rescue => detail
+      Puppet.log_exception(detail)
+      exit(24)
+    end
+  end
+
+  def setup
+    require 'puppet/ssl/certificate_authority'
+    exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
+
+    Puppet::SSL::Oids.register_puppet_oids
+    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])
+
+    Puppet::Util::Log.newdestination :console
+
+    if [:generate, :destroy].include? subcommand
+      Puppet::SSL::Host.ca_location = :local
+    else
+      Puppet::SSL::Host.ca_location = :only
+    end
+
+    # If we are generating, and the option came from the CLI, it gets added to
+    # the data.  This will do the right thing for non-local certificates, in
+    # that the command line but *NOT* the config file option will apply.
+    if subcommand == :generate
+      if Puppet.settings.set_by_cli?(:dns_alt_names)
+        options[:dns_alt_names] = Puppet[:dns_alt_names]
+      end
+    end
+
+    begin
+      @ca = Puppet::SSL::CertificateAuthority.new
+    rescue => detail
+      Puppet.log_exception(detail)
+      exit(23)
+    end
+  end
+
+  def parse_options
+    # handle the bareword subcommand pattern.
+    result = super
+    unless self.subcommand then
+      if sub = self.command_line.args.shift then
+        self.subcommand = sub
+      else
+        puts help
+        exit
+      end
+    end
+
+    result
+  end
+
+  # Create and run an applicator.  I wanted to build an interface where you could do
+  # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
+  def apply(ca, method, options)
+    raise ArgumentError, _("You must specify the hosts to apply to; valid values are an array or the symbol :all") unless options[:to]
+    applier = Puppet::SSL::CertificateAuthority::Interface.new(method, options)
+    applier.apply(ca)
+  end
+
+end