bolt 0.20.0 → 0.20.2

data/vendored/puppet/lib/puppet/module_tool/shared_behaviors.rb

@@ -0,0 +1,180 @@
+module Puppet::ModuleTool::Shared
+
+  include Puppet::ModuleTool::Errors
+
+  def get_local_constraints
+    @local      = Hash.new { |h,k| h[k] = { } }
+    @conditions = Hash.new { |h,k| h[k] = [] }
+    @installed  = Hash.new { |h,k| h[k] = [] }
+
+    @environment.modules_by_path.values.flatten.each do |mod|
+      mod_name = (mod.forge_name || mod.name).gsub('/', '-')
+      @installed[mod_name] << mod
+      d = @local["#{mod_name}@#{mod.version}"]
+      (mod.dependencies || []).each do |hash|
+        name, conditions = hash['name'], hash['version_requirement']
+        name = name.gsub('/', '-')
+        d[name] = conditions
+        @conditions[name] << {
+          :module => mod_name,
+          :version => mod.version,
+          :dependency => conditions
+        }
+      end
+    end
+  end
+
+  def get_remote_constraints(forge)
+    @remote   = Hash.new { |h,k| h[k] = { } }
+    @urls     = {}
+    @versions = Hash.new { |h,k| h[k] = [] }
+
+    Puppet.notice _("Downloading from %{uri} ...") % { uri: forge.uri }
+    author, modname = Puppet::ModuleTool.username_and_modname_from(@module_name)
+    info = forge.remote_dependency_info(author, modname, @options[:version])
+    info.each do |pair|
+      mod_name, releases = pair
+      mod_name = mod_name.gsub('/', '-')
+      releases.each do |rel|
+        semver = SemanticPuppet::Version.parse(rel['version']) rescue SemanticPuppet::Version::MIN
+        @versions[mod_name] << { :vstring => rel['version'], :semver => semver }
+        @versions[mod_name].sort! { |a, b| a[:semver] <=> b[:semver] }
+        @urls["#{mod_name}@#{rel['version']}"] = rel['file']
+        d = @remote["#{mod_name}@#{rel['version']}"]
+        (rel['dependencies'] || []).each do |name, conditions|
+          d[name.gsub('/', '-')] = conditions
+        end
+      end
+    end
+  end
+
+  def implicit_version(mod)
+    return :latest if @conditions[mod].empty?
+    if @conditions[mod].all? { |c| c[:queued] || c[:module] == :you }
+      return :latest
+    end
+    return :best
+  end
+
+  def annotated_version(mod, versions)
+    if versions.empty?
+      return implicit_version(mod)
+    else
+      return "#{implicit_version(mod)}: #{versions.last}"
+    end
+  end
+
+  def resolve_constraints(dependencies, source = [{:name => :you}], seen = {}, action = @action)
+    dependencies = dependencies.map do |mod, range|
+      source.last[:dependency] = range
+
+      @conditions[mod] << {
+        :module     => source.last[:name],
+        :version    => source.last[:version],
+        :dependency => range,
+        :queued     => true
+      }
+
+      if forced?
+        range = Puppet::Module.parse_range(@version, @strict_semver) rescue Puppet::Module.parse_range('>= 0.0.0', @strict_semver)
+      else
+        range = (@conditions[mod]).map do |r|
+          Puppet::Module.parse_range(r[:dependency], @strict_semver) rescue Puppet::Module.parse_range('>= 0.0.0', @strict_semver)
+        end.inject(&:&)
+      end
+
+      if @action == :install && seen.include?(mod)
+        next if range === seen[mod][:semver]
+
+        req_module   = @module_name
+        req_versions = @versions["#{@module_name}"].map { |v| v[:semver] }
+        raise InvalidDependencyCycleError,
+          :module_name       => mod,
+          :source            => (source + [{ :name => mod, :version => source.last[:dependency] }]),
+          :requested_module  => req_module,
+          :requested_version => @version || annotated_version(req_module, req_versions),
+          :conditions        => @conditions
+      end
+
+      if !(forced? || @installed[mod].empty? || source.last[:name] == :you)
+        next if range === SemanticPuppet::Version.parse(@installed[mod].first.version)
+        action = :upgrade
+      elsif @installed[mod].empty?
+        action = :install
+      end
+
+      if action == :upgrade
+        @conditions.each { |_, conds| conds.delete_if { |c| c[:module] == mod } }
+      end
+
+      versions = @versions["#{mod}"].select { |h| range === h[:semver] }
+      valid_versions = versions.select { |x| x[:semver].special == '' }
+      valid_versions = versions if valid_versions.empty?
+
+      unless version = valid_versions.last
+        req_module   = @module_name
+        req_versions = @versions["#{@module_name}"].map { |v| v[:semver] }
+        raise NoVersionsSatisfyError,
+          :requested_name    => req_module,
+          :requested_version => @version || annotated_version(req_module, req_versions),
+          :installed_version => @installed[@module_name].empty? ? nil : @installed[@module_name].first.version,
+          :dependency_name   => mod,
+          :conditions        => @conditions[mod],
+          :action            => @action
+      end
+
+      seen[mod] = version
+
+      {
+        :module           => mod,
+        :version          => version,
+        :action           => action,
+        :previous_version => @installed[mod].empty? ? nil : @installed[mod].first.version,
+        :file             => @urls["#{mod}@#{version[:vstring]}"],
+        :path             => action == :install ? @options[:target_dir] : (@installed[mod].empty? ? @options[:target_dir] : @installed[mod].first.modulepath),
+        :dependencies     => []
+      }
+    end.compact
+    dependencies.each do |mod|
+      deps = @remote["#{mod[:module]}@#{mod[:version][:vstring]}"].sort_by(&:first)
+      mod[:dependencies] = resolve_constraints(deps, source + [{ :name => mod[:module], :version => mod[:version][:vstring] }], seen, :install)
+    end unless @ignore_dependencies
+    return dependencies
+  end
+
+  def download_tarballs(graph, default_path, forge)
+    graph.map do |release|
+      begin
+        if release[:tarball]
+          cache_path = Pathname(release[:tarball])
+        else
+          cache_path = forge.retrieve(release[:file])
+        end
+      rescue OpenURI::HTTPError => e
+        raise RuntimeError, _("Could not download module: %{message}") % { message: e.message }, e.backtrace
+      end
+
+      [
+        { (release[:path] ||= default_path) => cache_path},
+        *download_tarballs(release[:dependencies], default_path, forge)
+      ]
+    end.flatten
+  end
+
+  def forced?
+    options[:force]
+  end
+
+  def add_module_name_constraints_to_graph(graph)
+    # Puppet modules are installed by "module name", but resolved by
+    # "full name" (including namespace).  So that we don't run into
+    # problems at install time, we should reject any solution that
+    # depends on multiple nodes with the same "module name".
+    graph.add_graph_constraint('PMT') do |nodes|
+      names = nodes.map { |x| x.dependency_names + [ x.name ] }.flatten
+      names = names.map { |x| x.tr('/', '-') }.uniq
+      names = names.map { |x| x[/-(.*)/, 1] }
+      names.length == names.uniq.length
+    end
+  end
+end

data/vendored/puppet/lib/puppet/module_tool/skeleton/templates/generator/spec/spec_helper.rb

@@ -0,0 +1 @@
+require 'puppetlabs_spec_helper/module_spec_helper'

data/vendored/puppet/lib/puppet/module_tool/tar.rb

@@ -0,0 +1,18 @@
+require 'puppet/module_tool'
+require 'puppet/util'
+
+module Puppet::ModuleTool::Tar
+  require 'puppet/module_tool/tar/gnu'
+  require 'puppet/module_tool/tar/mini'
+
+  def self.instance
+    if Puppet.features.minitar? && Puppet.features.zlib?
+      Mini.new
+    elsif Puppet::Util.which('tar') && ! Puppet::Util::Platform.windows?
+      Gnu.new
+    else
+      #TRANSLATORS "tar" is a program name and should not be translated
+      raise RuntimeError, _('No suitable tar implementation found')
+    end
+  end
+end

data/vendored/puppet/lib/puppet/module_tool/tar/gnu.rb

@@ -0,0 +1,19 @@
+require 'shellwords'
+
+class Puppet::ModuleTool::Tar::Gnu
+  def unpack(sourcefile, destdir, owner)
+    sourcefile = File.expand_path(sourcefile)
+    destdir = File.expand_path(destdir)
+
+    Dir.chdir(destdir) do
+      Puppet::Util::Execution.execute("gzip -dc #{Shellwords.shellescape(sourcefile)} | tar xof -")
+      Puppet::Util::Execution.execute("find . -type d -exec chmod 755 {} +")
+      Puppet::Util::Execution.execute("find . -type f -exec chmod u+rw,g+r,a-st {} +")
+      Puppet::Util::Execution.execute("chown -R #{owner} .")
+    end
+  end
+
+  def pack(sourcedir, destfile)
+    Puppet::Util::Execution.execute("tar cf - #{sourcedir} | gzip -c > #{File.basename(destfile)}")
+  end
+end

data/vendored/puppet/lib/puppet/module_tool/tar/mini.rb

@@ -0,0 +1,106 @@
+class Puppet::ModuleTool::Tar::Mini
+  def unpack(sourcefile, destdir, _)
+    Zlib::GzipReader.open(sourcefile) do |reader|
+      Archive::Tar::Minitar.unpack(reader, destdir, find_valid_files(reader)) do |action, name, stats|
+        case action
+        when :dir
+          validate_entry(destdir, name)
+          set_dir_mode!(stats)
+          Puppet.debug("Extracting: #{destdir}/#{name}")
+        when :file_start
+          # Octal string of the old file mode.
+          validate_entry(destdir, name)
+          set_file_mode!(stats)
+          Puppet.debug("Extracting: #{destdir}/#{name}")
+        end
+        set_default_user_and_group!(stats)
+        stats
+      end
+    end
+  end
+
+  def pack(sourcedir, destfile)
+    Zlib::GzipWriter.open(destfile) do |writer|
+      Archive::Tar::Minitar.pack(sourcedir, writer) do |step, name, stats|
+        # TODO smcclellan 2017-10-31 Set permissions here when this yield block
+        # executes before the header is written. As it stands, the `stats`
+        # argument isn't mutable in a way that will effect the desired mode for
+        # the file.
+      end
+    end
+  end
+
+  private
+
+  EXECUTABLE = 0755
+  NOT_EXECUTABLE = 0644
+  USER_EXECUTE = 0100
+
+  def set_dir_mode!(stats)
+    if stats.key?(:mode)
+      # This is only the case for `pack`, so this code will not run.
+      stats[:mode] = EXECUTABLE
+    elsif stats.key?(:entry)
+      old_mode = stats[:entry].instance_variable_get(:@mode)
+      if old_mode.is_a?(Integer)
+        stats[:entry].instance_variable_set(:@mode, EXECUTABLE)
+      end
+    end
+  end
+
+  # Sets a file mode to 0755 if the file is executable by the user.
+  # Sets a file mode to 0644 if the file mode is set (non-Windows).
+  def sanitized_mode(old_mode)
+    old_mode & USER_EXECUTE != 0 ? EXECUTABLE : NOT_EXECUTABLE
+  end
+
+  def set_file_mode!(stats)
+    if stats.key?(:mode)
+      # This is only the case for `pack`, so this code will not run.
+      stats[:mode] = sanitized_mode(stats[:mode])
+    elsif stats.key?(:entry)
+      old_mode = stats[:entry].instance_variable_get(:@mode)
+      # If the user can execute the file, set 0755, otherwise 0644.
+      if old_mode.is_a?(Integer)
+        new_mode = sanitized_mode(old_mode)
+        stats[:entry].instance_variable_set(:@mode, new_mode)
+      end
+    end
+  end
+
+  # Sets UID and GID to 0 for standardization.
+  def set_default_user_and_group!(stats)
+    stats[:uid] = 0
+    stats[:gid] = 0
+  end
+
+  # Find all the valid files in tarfile.
+  #
+  # This check was mainly added to ignore 'x' and 'g' flags from the PAX
+  # standard but will also ignore any other non-standard tar flags.
+  # tar format info: https://pic.dhe.ibm.com/infocenter/zos/v1r13/index.jsp?topic=%2Fcom.ibm.zos.r13.bpxa500%2Ftaf.htm
+  # pax format info: https://pic.dhe.ibm.com/infocenter/zos/v1r13/index.jsp?topic=%2Fcom.ibm.zos.r13.bpxa500%2Fpxarchfm.htm
+  def find_valid_files(tarfile)
+    Archive::Tar::Minitar.open(tarfile).collect do |entry|
+      flag = entry.typeflag
+      if flag.nil? || flag =~ /[[:digit:]]/ && (0..7).include?(flag.to_i)
+        entry.full_name
+      else
+        Puppet.debug "Invalid tar flag '#{flag}' will not be extracted: #{entry.name}"
+        next
+      end
+    end
+  end
+
+  def validate_entry(destdir, path)
+    if Pathname.new(path).absolute?
+      raise Puppet::ModuleTool::Errors::InvalidPathInPackageError, :entry_path => path, :directory => destdir
+    end
+
+    path = File.expand_path File.join(destdir, path)
+
+    if path !~ /\A#{Regexp.escape destdir}/
+      raise Puppet::ModuleTool::Errors::InvalidPathInPackageError, :entry_path => path, :directory => destdir
+    end
+  end
+end

data/vendored/puppet/lib/puppet/network.rb

@@ -0,0 +1,3 @@
+# Just a stub, so we can correctly scope other classes.
+module Puppet::Network # :nodoc:
+end

data/vendored/puppet/lib/puppet/network/auth_config_parser.rb

@@ -0,0 +1,90 @@
+require 'puppet/network/rights'
+
+module Puppet::Network
+class AuthConfigParser
+
+  def self.new_from_file(file)
+    self.new(Puppet::FileSystem.read(file, :encoding => 'utf-8'))
+  end
+
+  def initialize(string)
+    @string = string
+  end
+
+  def parse
+    Puppet::Network::AuthConfig.new(parse_rights)
+  end
+
+  def parse_rights
+    rights = Puppet::Network::Rights.new
+    right = nil
+    count = 1
+    @string.each_line { |line|
+      case line.chomp
+      when /^\s*#/, /^\s*$/
+        # skip comments and blank lines
+      when /^path\s+((?:~\s+)?[^ ]+)\s*$/ # "path /path" or "path ~ regex"
+        name = $1.chomp
+        right = rights.newright(name, count, @file)
+      when /^\s*(allow(?:_ip)?|deny(?:_ip)?|method|environment|auth(?:enticated)?)\s+(.+?)(\s*#.*)?$/
+        if right.nil?
+          #TRANSLATORS "path" is a configuration file entry and should not be translated
+          raise Puppet::ConfigurationError, _("Missing or invalid 'path' before right directive at %{error_location}") %
+              { error_location: Puppet::Util::Errors.error_location(@file, count) }
+        end
+        parse_right_directive(right, $1, $2, count)
+      else
+        error_location_str = Puppet::Util::Errors.error_location(nil, count)
+        raise Puppet::ConfigurationError, _("Invalid entry at %{error_location}: %{file_text}") %
+            { error_location: error_location_str, file_text: line }
+      end
+      count += 1
+    }
+
+    # Verify each of the rights are valid.
+    # We let the check raise an error, so that it can raise an error
+    # pointing to the specific problem.
+    rights.each { |name, r|
+      r.valid?
+    }
+    rights
+  end
+
+  def parse_right_directive(right, var, value, count)
+    value.strip!
+    case var
+    when "allow"
+      modify_right(right, :allow, value, _("allowing %{value} access"), count)
+    when "deny"
+      modify_right(right, :deny, value, _("denying %{value} access"), count)
+    when "allow_ip"
+      modify_right(right, :allow_ip, value, _("allowing IP %{value} access"), count)
+    when "deny_ip"
+      modify_right(right, :deny_ip, value, _("denying IP %{value} access"), count)
+    when "method"
+      modify_right(right, :restrict_method, value, _("allowing 'method' %{value}"), count)
+    when "environment"
+      modify_right(right, :restrict_environment, value, _("adding environment %{value}"), count)
+    when /auth(?:enticated)?/
+      modify_right(right, :restrict_authenticated, value, _("adding authentication %{value}"), count)
+    else
+      error_location_str = Puppet::Util::Errors.error_location(nil, count)
+      raise Puppet::ConfigurationError, _("Invalid argument '%{var}' at %{error_location}") %
+          { var: var, error_location: error_location_str }
+    end
+  end
+
+  def modify_right(right, method, value, msg, count)
+    value.split(/\s*,\s*/).each do |val|
+      begin
+        val.strip!
+        right.info msg % { value: val }
+        right.send(method, val)
+      rescue Puppet::AuthStoreError => detail
+        error_location_str = Puppet::Util::Errors.error_location(@file, count)
+        raise Puppet::ConfigurationError, "#{detail} #{error_location_str}", detail.backtrace
+      end
+    end
+  end
+end
+end

data/vendored/puppet/lib/puppet/network/authconfig.rb

@@ -0,0 +1,112 @@
+require 'puppet/network/rights'
+require 'puppet/network/http'
+
+module Puppet
+  class ConfigurationError < Puppet::Error; end
+  class Network::DefaultAuthProvider
+    attr_accessor :rights
+
+    def self.master_url_prefix
+      Puppet::Network::HTTP::MASTER_URL_PREFIX
+    end
+
+    def self.ca_url_prefix
+      Puppet::Network::HTTP::CA_URL_PREFIX
+    end
+
+    def self.default_acl
+      [
+      # Master API V3
+      { :acl => "#{master_url_prefix}/v3/environments", :method => :find, :allow => '*', :authenticated => true },
+
+      { :acl => "~ ^#{master_url_prefix}\/v3\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      { :acl => "~ ^#{master_url_prefix}\/v3\/node\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      { :acl => "~ ^#{master_url_prefix}\/v3\/report\/([^\/]+)$", :method => :save, :allow => '$1', :authenticated => true },
+
+      # this one will allow all file access, and thus delegate
+      # to fileserver.conf
+      { :acl => "#{master_url_prefix}/v3/file" },
+
+      { :acl => "#{master_url_prefix}/v3/status", :method => [:find], :authenticated => true },
+
+      # CA API V1
+      { :acl => "#{ca_url_prefix}/v1/certificate_revocation_list/ca", :method => :find, :authenticated => true },
+
+      # These allow `auth any`, because if you can do them anonymously you
+      # should probably also be able to do them when trusted.
+      { :acl => "#{ca_url_prefix}/v1/certificate/ca", :method => :find, :authenticated => :any },
+      { :acl => "#{ca_url_prefix}/v1/certificate/", :method => :find, :authenticated => :any },
+      { :acl => "#{ca_url_prefix}/v1/certificate_request", :method => [:find, :save], :authenticated => :any },
+      ]
+    end
+
+    # Just proxy the setting methods to our rights stuff
+    [:allow, :deny].each do |method|
+      define_method(method) do |*args|
+        @rights.send(method, *args)
+      end
+    end
+
+    # force regular ACLs to be present
+    def insert_default_acl
+      self.class.default_acl.each do |acl|
+        unless rights[acl[:acl]]
+          Puppet.info _("Inserting default '%{acl}' (auth %{auth}) ACL") % { acl: acl[:acl], auth: acl[:authenticated] }
+          mk_acl(acl)
+        end
+      end
+      # queue an empty (ie deny all) right for every other path
+      # actually this is not strictly necessary as the rights system
+      # denies not explicitly allowed paths
+      unless rights["/"]
+        rights.newright("/").restrict_authenticated(:any)
+      end
+    end
+
+    def mk_acl(acl)
+      right = @rights.newright(acl[:acl])
+      right.allow(acl[:allow] || "*")
+
+      if method = acl[:method]
+        method = [method] unless method.is_a?(Array)
+        method.each { |m| right.restrict_method(m) }
+      end
+      right.restrict_authenticated(acl[:authenticated]) unless acl[:authenticated].nil?
+    end
+
+    # check whether this request is allowed in our ACL
+    # raise an Puppet::Network::AuthorizedError if the request
+    # is denied.
+    def check_authorization(method, path, params)
+      if authorization_failure_exception = @rights.is_request_forbidden_and_why?(method, path, params)
+        Puppet.warning(_("Denying access: %{authorization_failure_exception}") % { authorization_failure_exception: authorization_failure_exception })
+        raise authorization_failure_exception
+      end
+    end
+
+    def initialize(rights=nil)
+      @rights = rights || Puppet::Network::Rights.new
+      insert_default_acl
+    end
+  end
+
+  class Network::AuthConfig
+    @@authprovider_class = nil
+
+    def self.authprovider_class=(klass)
+      @@authprovider_class = klass
+    end
+
+    def self.authprovider_class
+      @@authprovider_class || Puppet::Network::DefaultAuthProvider
+    end
+
+    def initialize(rights=nil)
+      @authprovider = self.class.authprovider_class.new(rights)
+    end
+
+    def check_authorization(method, path, params)
+      @authprovider.check_authorization(method, path, params)
+    end
+  end
+end