bolt 2.15.0 → 2.16.0

data/lib/bolt/config/transport/orch.rb

@@ -7,24 +7,15 @@ module Bolt
   class Config
     module Transport
       class Orch < Base
-        # NOTE: All transport configuration options should have a corresponding schema definition
-        #       in schemas/bolt-transport-definitions.json
-        OPTIONS = {
-          "cacert"            => { type: String,
-                                   desc: "The path to the CA certificate." },
-          "host"              => { type: String,
-                                   desc: "Host name." },
-          "job-poll-interval" => { type: Integer,
-                                   desc: "Set interval to poll orchestrator for job status." },
-          "job-poll-timeout"  => { type: Integer,
-                                   desc: "Set time to wait for orchestrator job status." },
-          "service-url"       => { type: String,
-                                   desc: "The URL of the orchestrator API." },
-          "task-environment"  => { type: String,
-                                   desc: "The environment the orchestrator loads task code from." },
-          "token-file"        => { type: String,
-                                   desc: "The path to the token file." }
-        }.freeze
+        OPTIONS = %w[
+          cacert
+          host
+          job-poll-interval
+          job-poll-timeout
+          service-url
+          task-environment
+          token-file
+        ].freeze
 
         DEFAULTS = {
           "task-environment" => "production"

data/lib/bolt/config/transport/remote.rb

@@ -7,12 +7,9 @@ module Bolt
   class Config
     module Transport
       class Remote < Base
-        # NOTE: All transport configuration options should have a corresponding schema definition
-        #       in schemas/bolt-transport-definitions.json
-        OPTIONS = {
-          "run-on" => { type: String,
-                        desc: "The proxy target that the task executes on." }
-        }.freeze
+        OPTIONS = %w[
+          run-on
+        ].freeze
 
         DEFAULTS = {
           "run-on" => "localhost"

data/lib/bolt/config/transport/ssh.rb

@@ -7,148 +7,68 @@ module Bolt
   class Config
     module Transport
       class SSH < Base
-        LOGIN_SHELLS = %w[sh bash zsh dash ksh powershell].freeze
-
-        # NOTE: All transport configuration options should have a corresponding schema definition
-        #       in schemas/bolt-transport-definitions.json
-        OPTIONS = {
-          "cleanup"               => { type: TrueClass,
-                                       external: true,
-                                       desc: "Whether to clean up temporary files created on targets." },
-          "connect-timeout"       => { type: Integer,
-                                       desc: "How long to wait when establishing connections." },
-          "copy-command"          => { external: true,
-                                       desc: "Command to use when copying files using ssh-command. "\
-                                             "Bolt runs `<copy-command> <src> <dest>`. **This option is "\
-                                             "experimental.**" },
-          "disconnect-timeout"    => { type: Integer,
-                                       desc: "How long to wait before force-closing a connection." },
-          "encryption-algorithms" => { type: Array,
-                                       desc: "List of encryption algorithms to use when establishing a "\
-                                             "connection with a target. Supported algorithms are "\
-                                             "defined by the Ruby net-ssh library and can be viewed "\
-                                             "[here](https://github.com/net-ssh/net-ssh#supported-algorithms). "\
-                                             "All supported, non-deprecated algorithms are available by default when "\
-                                             "this option is not used. To reference all default algorithms "\
-                                             "when using this option, add 'defaults' to the list of supported "\
-                                             "algorithms." },
-          "extensions"            => { type: Array,
-                                       desc: "List of file extensions that are accepted for scripts or tasks on "\
-                                             "Windows. Scripts with these file extensions rely on the target's file "\
-                                             "type association to run. For example, if Python is installed on the "\
-                                             "system, a `.py` script runs with `python.exe`. The extensions `.ps1`, "\
-                                             "`.rb`, and `.pp` are always allowed and run via hard-coded "\
-                                             "executables." },
-          "host"                  => { type: String,
-                                       external: true,
-                                       desc: "Host name." },
-          "host-key-algorithms"   => { type: Array,
-                                       desc: "List of host key algorithms to use when establishing a connection "\
-                                             "with a target. Supported algorithms are defined by the Ruby net-ssh "\
-                                             "library "\
-                                             "([docs](https://github.com/net-ssh/net-ssh#supported-algorithms)). "\
-                                             "All supported, non-deprecated algorithms are available by default when "\
-                                             "this option is not used. To reference all default algorithms "\
-                                             "using this option, add 'defaults' to the list of supported "\
-                                             "algorithms." },
-          "host-key-check"        => { type: TrueClass,
-                                       external: true,
-                                       desc: "Whether to perform host key validation when connecting." },
-          "interpreters"          => { type: Hash,
-                                       external: true,
-                                       desc: "A map of an extension name to the absolute path of an executable, "\
-                                             "enabling you to override the shebang defined in a task executable. "\
-                                             "The extension can optionally be specified with the `.` character "\
-                                             "(`.py` and `py` both map to a task executable `task.py`) and the "\
-                                             "extension is case sensitive. When a target's name is `localhost`, "\
-                                             "Ruby tasks run with the Bolt Ruby interpreter by default." },
-          "kex-algorithms"        => { type: Array,
-                                       desc: "List of key exchange algorithms to use when establishing a "\
-                                             "connection to a target. Supported algorithms are defined by the "\
-                                             "Ruby net-ssh library "\
-                                             "([docs](https://github.com/net-ssh/net-ssh#supported-algorithms)). "\
-                                             "All supported, non-deprecated algorithms are available by default when "\
-                                             "this option is not used. To reference all default algorithms "\
-                                             "using this option, add 'defaults' to the list of supported "\
-                                             "algorithms." },
-          "load-config"           => { type: TrueClass,
-                                       desc: "Whether to load system SSH configuration." },
-          "login-shell"           => { type: String,
-                                       desc: "Which login shell Bolt should expect on the target. "\
-                                             "Supported shells are #{LOGIN_SHELLS.join(', ')}. "\
-                                             "**This option is experimental.**" },
-          "mac-algorithms"        => { type: Array,
-                                       desc: "List of message authentication code algorithms to use when "\
-                                             "establishing a connection to a target. Supported algorithms are "\
-                                             "defined by the Ruby net-ssh library "\
-                                             "([docs](https://github.com/net-ssh/net-ssh#supported-algorithms)). "\
-                                             "All supported, non-deprecated algorithms are available by default when "\
-                                             "this option is not used. To reference all default algorithms "\
-                                             "using this option, add 'defaults' to the list of supported "\
-                                             "algorithms." },
-          "password"              => { type: String,
-                                       desc: "Login password." },
-          "port"                  => { type: Integer,
-                                       external: true,
-                                       desc: "Connection port." },
-          "private-key"           => { external: true,
-                                       desc: "Either the path to the private key file to use for authentication, or "\
-                                             "a hash with the key `key-data` and the contents of the private key." },
-          "proxyjump"             => { type: String,
-                                       desc: "A jump host to proxy connections through, and an optional user to "\
-                                             "connect with." },
-          "run-as"                => { type: String,
-                                       external: true,
-                                       desc: "A different user to run commands as after login." },
-          "run-as-command"        => { type: Array,
-                                       external: true,
-                                       desc: "The command to elevate permissions. Bolt appends the user and command "\
-                                             "strings to the configured `run-as-command` before running it on the "\
-                                             "target. This command must not require an interactive password prompt, "\
-                                             "and the `sudo-password` option is ignored when `run-as-command` is "\
-                                             "specified. The `run-as-command` must be specified as an array." },
-          "script-dir"            => { type: String,
-                                       external: true,
-                                       desc: "The subdirectory of the tmpdir to use in place of a randomized "\
-                                             "subdirectory for uploading and executing temporary files on the "\
-                                             "target. It's expected that this directory already exists as a subdir "\
-                                             "of tmpdir, which is either configured or defaults to `/tmp`." },
-          "ssh-command"           => { external: true,
-                                       desc: "Command and flags to use when SSHing. This enables the external "\
-                                             "SSH transport which shells out to the specified command. "\
-                                             "**This option is experimental.**" },
-          "sudo-executable"       => { type: String,
-                                       external: true,
-                                       desc: "The executable to use when escalating to the configured `run-as` "\
-                                             "user. This is useful when you want to escalate using the configured "\
-                                             "`sudo-password`, since `run-as-command` does not use `sudo-password` "\
-                                             "or support prompting. The command executed on the target is "\
-                                             "`<sudo-executable> -S -u <user> -p custom_bolt_prompt <command>`. "\
-                                             "**This option is experimental.**" },
-          "sudo-password"         => { type: String,
-                                       external: true,
-                                       desc: "Password to use when changing users via `run-as`." },
-          "tmpdir"                => { type: String,
-                                       external: true,
-                                       desc: "The directory to upload and execute temporary files on the target." },
-          "tty"                   => { type: TrueClass,
-                                       desc: "Request a pseudo tty for the session. This option is generally "\
-                                             "only used in conjunction with the `run-as` option when the sudoers "\
-                                             "policy requires a `tty`." },
-          "user"                  => { type: String,
-                                       external: true,
-                                       desc: "Login user." }
-        }.freeze
+        # Options available when using the net-ssh-based transport
+        OPTIONS = %w[
+          cleanup
+          connect-timeout
+          disconnect-timeout
+          encryption-algorithms
+          extensions
+          host
+          host-key-algorithms
+          host-key-check
+          interpreters
+          kex-algorithms
+          load-config
+          login-shell
+          mac-algorithms
+          password
+          port
+          private-key
+          proxyjump
+          script-dir
+          tmpdir
+          tty
+          user
+        ].concat(RUN_AS_OPTIONS).sort.freeze
+
+        # Options available when using the external ssh transport
+        EXTERNAL_OPTIONS = %w[
+          cleanup
+          copy-command
+          host
+          host-key-check
+          interpreters
+          port
+          private-key
+          script-dir
+          ssh-command
+          tmpdir
+          user
+        ].concat(RUN_AS_OPTIONS).sort.freeze
 
         DEFAULTS = {
           "cleanup"            => true,
           "connect-timeout"    => 10,
-          "tty"                => false,
-          "load-config"        => true,
           "disconnect-timeout" => 5,
-          "login-shell"        => 'bash'
+          "load-config"        => true,
+          "login-shell"        => 'bash',
+          "tty"                => false
         }.freeze
 
+        # The set of options available for the ssh and external ssh transports overlap, so we
+        # need to check which transport is used before fully initializing, otherwise options
+        # may not be filtered correctly.
+        def initialize(data = {}, project = nil)
+          assert_hash_or_config(data)
+          @external = true if data['ssh-command']
+          super(data, project)
+        end
+
+        private def filter(unfiltered)
+          @external ? unfiltered.slice(*EXTERNAL_OPTIONS) : unfiltered.slice(*OPTIONS)
+        end
+
         private def validate
           super
 
@@ -201,20 +121,6 @@ module Bolt
             msg = 'Cannot use external SSH transport with load-config set to false'
             raise Bolt::ValidationError, msg
           end
-
-          if (ssh_cmd = @config['ssh-command'])
-            unless ssh_cmd.is_a?(String) || ssh_cmd.is_a?(Array)
-              raise Bolt::ValidationError,
-                    "ssh-command must be a String or Array, received #{ssh_cmd.class} #{ssh_cmd.inspect}"
-            end
-          end
-
-          if (copy_cmd = @config['copy-command'])
-            unless copy_cmd.is_a?(String) || copy_cmd.is_a?(Array)
-              raise Bolt::ValidationError,
-                    "copy-command must be a String or Array, received #{copy_cmd.class} #{copy_cmd.inspect}"
-            end
-          end
         end
       end
     end

data/lib/bolt/config/transport/winrm.rb

@@ -7,53 +7,24 @@ module Bolt
   class Config
     module Transport
       class WinRM < Base
-        # NOTE: All transport configuration options should have a corresponding schema definition
-        #       in schemas/bolt-transport-definitions.json
-        OPTIONS = {
-          "basic-auth-only" => { type: TrueClass,
-                                 desc: "Force basic authentication. This option is only available when using SSL." },
-          "cacert"          => { type: String,
-                                 desc: "The path to the CA certificate." },
-          "cleanup"         => { type: TrueClass,
-                                 desc: "Whether to clean up temporary files created on targets." },
-          "connect-timeout" => { type: Integer,
-                                 desc: "How long Bolt should wait when establishing connections." },
-          "extensions"      => { type: Array,
-                                 desc: "List of file extensions that are accepted for scripts or tasks. "\
-                                      "Scripts with these file extensions rely on the target's file type "\
-                                      "association to run. For example, if Python is installed on the system, "\
-                                      "a `.py` script runs with `python.exe`. The extensions `.ps1`, `.rb`, and "\
-                                      "`.pp` are always allowed and run via hard-coded executables." },
-          "file-protocol"   => { type: String,
-                                 desc: "Which file transfer protocol to use. Either `winrm` or `smb`. Using `smb` is "\
-                                      "recommended for large file transfers." },
-          "host"            => { type: String,
-                                 desc: "Host name." },
-          "interpreters"    => { type: Hash,
-                                 desc: "A map of an extension name to the absolute path of an executable, "\
-                                      "enabling you to override the shebang defined in a task executable. The "\
-                                      "extension can optionally be specified with the `.` character (`.py` and "\
-                                      "`py` both map to a task executable `task.py`) and the extension is case "\
-                                      "sensitive. When a target's name is `localhost`, Ruby tasks run with the "\
-                                      "Bolt Ruby interpreter by default." },
-          "password"        => { type: String,
-                                 desc: "Login password. **Required unless using Kerberos.**" },
-          "port"            => { type: Integer,
-                                 desc: "Connection port." },
-          "realm"           => { type: String,
-                                 desc: "Kerberos realm (Active Directory domain) to authenticate against." },
-          "smb-port"        => { type: Integer,
-                                 desc: "With file-protocol set to smb, this is the port to establish a "\
-                                      "connection on." },
-          "ssl"             => { type: TrueClass,
-                                 desc: "When true, Bolt uses secure https connections for WinRM." },
-          "ssl-verify"      => { type: TrueClass,
-                                 desc: "When true, verifies the targets certificate matches the cacert." },
-          "tmpdir"          => { type: String,
-                                 desc: "The directory to upload and execute temporary files on the target." },
-          "user"            => { type: String,
-                                 desc: "Login user. **Required unless using Kerberos.**" }
-        }.freeze
+        OPTIONS = %w[
+          basic-auth-only
+          cacert
+          cleanup
+          connect-timeout
+          extensions
+          file-protocol
+          host
+          interpreters
+          password
+          port
+          realm
+          smb-port
+          ssl
+          ssl-verify
+          tmpdir
+          user
+        ].freeze
 
         DEFAULTS = {
           "basic-auth-only" => false,

data/lib/bolt/inventory/group.rb

@@ -16,7 +16,7 @@ module Bolt
       DATA_KEYS = %w[config facts vars features plugin_hooks].freeze
       TARGET_KEYS = DATA_KEYS + %w[name alias uri]
       GROUP_KEYS = DATA_KEYS + %w[name groups targets]
-      CONFIG_KEYS = Bolt::Config::INVENTORY_CONFIG.keys
+      CONFIG_KEYS = Bolt::Config::INVENTORY_OPTIONS.keys
 
       def initialize(input, plugins)
         @logger = Logging.logger[self]

data/lib/bolt/inventory/inventory.rb

@@ -78,20 +78,6 @@ module Bolt
         target_array.first
       end
 
-      def self.localhost_defaults(data)
-        defaults = {
-          'config' => {
-            'transport' => 'local',
-            'local' => { 'interpreters' => { '.rb' => RbConfig.ruby } }
-          },
-          'features' => ['puppet-agent']
-        }
-        data = Bolt::Util.deep_merge(defaults, data)
-        # If features is an empty array deep_merge won't add the puppet-agent
-        data['features'] += ['puppet-agent'] if data['features'].empty?
-        data
-      end
-
       #### PRIVATE ####
       def group_data_for(target_name)
         @groups.group_collect(target_name)

data/lib/bolt/inventory/target.rb

@@ -30,6 +30,10 @@ module Bolt
           @safe_name = @uri_obj.omit(:password).to_str.sub(%r{^//}, '')
         end
 
+        if @name == 'localhost'
+          target_data = localhost_defaults(target_data)
+        end
+
         @config = target_data['config'] || {}
         @vars = target_data['vars'] || {}
         @facts = target_data['facts'] || {}
@@ -45,6 +49,20 @@ module Bolt
         validate
       end
 
+      def localhost_defaults(data)
+        defaults = {
+          'config' => {
+            'transport' => 'local',
+            'local' => { 'interpreters' => { '.rb' => RbConfig.ruby } }
+          },
+          'features' => ['puppet-agent']
+        }
+        data = Bolt::Util.deep_merge(defaults, data)
+        # If features is an empty array deep_merge won't add the puppet-agent
+        data['features'] += ['puppet-agent'] if data['features'].empty?
+        data
+      end
+
       # rubocop:disable Naming/AccessorMethodName
       def set_resource(resource)
         if (existing_resource = resources[resource.reference])
@@ -218,11 +236,6 @@ module Bolt
             'target_alias' => []
           }
 
-          # This should be handled by `get_targets`
-          if @name == 'localhost'
-            group_data = Bolt::Inventory::Inventory.localhost_defaults(group_data)
-          end
-
           @group_cache = group_data
         end
 

data/lib/bolt/pal.rb

@@ -137,7 +137,9 @@ module Bolt
       # TODO: If we always call this inside a bolt_executor we can remove this here
       setup
       r = Puppet::Pal.in_tmp_environment('bolt', modulepath: @modulepath, facts: {}) do |pal|
-        Puppet.override(bolt_project: @project,
+        # Only load the project if it a) exists, b) has a name it can be loaded with
+        bolt_project = @project if @project&.name
+        Puppet.override(bolt_project: bolt_project,
                         yaml_plan_instantiator: Bolt::PAL::YamlPlan::Loader) do
           pal.with_script_compiler do |compiler|
             alias_types(compiler)

data/lib/bolt/project.rb

@@ -9,8 +9,10 @@ module Bolt
     BOLTDIR_NAME = 'Boltdir'
     PROJECT_SETTINGS = {
       "name"  => "The name of the project",
-      "plans" => "An array of plan names to whitelist. Whitelisted plans are included in `bolt plan show` output",
-      "tasks" => "An array of task names to whitelist. Whitelisted plans are included in `bolt task show` output"
+      "plans" => "An array of plan names to show, if they exist in the project."\
+                 "These plans are included in `bolt plan show` output",
+      "tasks" => "An array of task names to show, if they exist in the project."\
+                 "These tasks are included in `bolt task show` output"
     }.freeze
 
     attr_reader :path, :data, :config_file, :inventory_file, :modulepath, :hiera_config,
@@ -67,17 +69,17 @@ module Bolt
       @resource_types = @path + '.resource_types'
       @type = type
 
-      tc = Bolt::Config::INVENTORY_CONFIG.keys & raw_data.keys
+      tc = Bolt::Config::INVENTORY_OPTIONS.keys & raw_data.keys
       if tc.any?
         msg = "Transport configuration isn't supported in bolt-project.yaml. Ignoring keys #{tc}"
         @warnings << { msg: msg }
       end
 
-      @data = raw_data.reject { |k, _| Bolt::Config::INVENTORY_CONFIG.keys.include?(k) }
+      @data = raw_data.reject { |k, _| Bolt::Config::INVENTORY_OPTIONS.include?(k) }
 
       # Once bolt.yaml deprecation is removed, this attribute should be removed
       # and replaced with .project_file in lib/bolt/config.rb
-      @config_file = if (Bolt::Config::OPTIONS.keys & @data.keys).any?
+      @config_file = if (Bolt::Config::BOLT_OPTIONS & @data.keys).any?
                        if (@path + 'bolt.yaml').file?
                          msg = "bolt-project.yaml contains valid config keys, bolt.yaml will be ignored"
                          @warnings << { msg: msg }
@@ -109,10 +111,7 @@ module Bolt
     end
 
     def name
-      # If the project is in mymod/Boltdir/bolt-project.yaml, use mymod as the project name
-      dirname = @path.basename.to_s == 'Boltdir' ? @path.parent.basename.to_s : @path.basename.to_s
-      pname = @data['name'] || dirname
-      pname.include?('-') ? pname.split('-', 2)[1] : pname
+      @data['name']
     end
 
     def tasks
@@ -123,36 +122,20 @@ module Bolt
       @data['plans']
     end
 
-    def project_directory_name?(name)
-      # it must match an installed project name according to forge validator
-      name =~ /^[a-z][a-z0-9_]*$/
-    end
-
-    def project_namespaced_name?(name)
-      # it must match the full project name according to forge validator
-      name =~ /^[a-zA-Z0-9]+[-][a-z][a-z0-9_]*$/
-    end
-
     def validate
-      n = @data['name']
-      if n && !project_directory_name?(n) && !project_namespaced_name?(n)
-        raise Bolt::ValidationError, <<~ERROR_STRING
-        Invalid project name '#{n}' in bolt-project.yaml; project names must match either:
-        An installed project name (ex. projectname) matching the expression /^[a-z][a-z0-9_]*$/ -or-
-        A namespaced project name (ex. author-projectname) matching the expression /^[a-zA-Z0-9]+[-][a-z][a-z0-9_]*$/
-        ERROR_STRING
-      elsif !project_directory_name?(name) && !project_namespaced_name?(name)
-        raise Bolt::ValidationError, <<~ERROR_STRING
-        Invalid project name '#{name}'; project names must match either:
-        A project name (ex. projectname) matching the expression /^[a-z][a-z0-9_]*$/ -or-
-        A namespaced project name (ex. author-projectname) matching the expression /^[a-zA-Z0-9]+[-][a-z][a-z0-9_]*$/
-
-        Configure project name in <project_dir>/bolt-project.yaml
-        ERROR_STRING
-      # If the project name is the same as one of the built-in modules raise a warning
-      elsif Dir.children(Bolt::PAL::BOLTLIB_PATH).include?(name)
-        raise Bolt::ValidationError, "The project '#{name}' will not be loaded. The project name conflicts "\
-          "with a built-in Bolt module of the same name."
+      if name
+        name_regex = /^[a-z][a-z0-9_]*$/
+        if name !~ name_regex
+          raise Bolt::ValidationError, <<~ERROR_STRING
+          Invalid project name '#{name}' in bolt-project.yaml; project name must match #{name_regex.inspect}
+          ERROR_STRING
+        elsif Dir.children(Bolt::PAL::BOLTLIB_PATH).include?(name)
+          raise Bolt::ValidationError, "The project '#{name}' will not be loaded. The project name conflicts "\
+            "with a built-in Bolt module of the same name."
+        end
+      else
+        message = "No project name is specified in bolt-project.yaml. Project-level content will not be available."
+        @warnings << { msg: message }
       end
 
       %w[tasks plans].each do |conf|