openvox 7.37.1 → 8.19.0

data/lib/puppet/ssl/state_machine.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl'
 require_relative '../../puppet/util/pidlock'
 
@@ -49,14 +51,25 @@ class Puppet::SSL::StateMachine
     def next_state
       Puppet.debug("Loading CA certs")
 
+      force_crl_refresh = false
+
       cacerts = @cert_provider.load_cacerts
       if cacerts
         next_ctx = @ssl_provider.create_root_context(cacerts: cacerts, revocation: false)
+
+        now = Time.now
+        last_update = @cert_provider.ca_last_update
+        if needs_refresh?(now, last_update)
+          # If we refresh the CA, then we need to force the CRL to be refreshed too,
+          # since if there is a new CA in the chain, then we need its CRL to check
+          # the full chain for revocation status.
+          next_ctx, force_crl_refresh = refresh_ca(next_ctx, last_update)
+        end
       else
         route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
         _, pem = route.get_certificate(Puppet::SSL::CA_NAME, ssl_context: @ssl_context)
         if @machine.ca_fingerprint
-          actual_digest = Puppet::SSL::Digest.new(@machine.digest, pem).to_hex
+          actual_digest = @machine.digest_as_hex(pem)
           expected_digest = @machine.ca_fingerprint.scan(/../).join(':').upcase
           if actual_digest == expected_digest
             Puppet.info(_("Verified CA bundle with digest (%{digest_type}) %{actual_digest}") %
@@ -73,7 +86,7 @@ class Puppet::SSL::StateMachine
         @cert_provider.save_cacerts(cacerts)
       end
 
-      NeedCRLs.new(@machine, next_ctx)
+      NeedCRLs.new(@machine, next_ctx, force_crl_refresh)
     rescue OpenSSL::X509::CertificateError => e
       Error.new(@machine, e.message, e)
     rescue Puppet::HTTP::ResponseError => e
@@ -83,6 +96,56 @@ class Puppet::SSL::StateMachine
         to_error(_('Could not download CA certificate: %{message}') % { message: e.message }, e)
       end
     end
+
+    private
+
+    def needs_refresh?(now, last_update)
+      return true if last_update.nil?
+
+      ca_ttl = Puppet[:ca_refresh_interval]
+      return false unless ca_ttl
+
+      now.to_i > last_update.to_i + ca_ttl
+    end
+
+    def refresh_ca(ssl_ctx, last_update)
+      Puppet.info(_("Refreshing CA certificate"))
+
+      # return the next_ctx containing the updated ca
+      next_ctx = [download_ca(ssl_ctx, last_update), true]
+
+      # After a successful refresh, update ca_last_update
+      @cert_provider.ca_last_update = Time.now
+
+      next_ctx
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 304
+        Puppet.info(_("CA certificate is unmodified, using existing CA certificate"))
+      else
+        Puppet.info(_("Failed to refresh CA certificate, using existing CA certificate: %{message}") % { message: e.message })
+      end
+
+      # return the original ssl_ctx
+      [ssl_ctx, false]
+    rescue Puppet::HTTP::HTTPError => e
+      Puppet.warning(_("Failed to refresh CA certificate, using existing CA certificate: %{message}") % { message: e.message })
+
+      # return the original ssl_ctx
+      [ssl_ctx, false]
+    end
+
+    def download_ca(ssl_ctx, last_update)
+      route = @machine.session.route_to(:ca, ssl_context: ssl_ctx)
+      _, pem = route.get_certificate(Puppet::SSL::CA_NAME, if_modified_since: last_update, ssl_context: ssl_ctx)
+      cacerts = @cert_provider.load_cacerts_from_pem(pem)
+      # verify cacerts before saving
+      next_ctx = @ssl_provider.create_root_context(cacerts: cacerts, revocation: false)
+      @cert_provider.save_cacerts(cacerts)
+
+      Puppet.info("Refreshed CA certificate: #{@machine.digest_as_hex(pem)}")
+
+      next_ctx
+    end
   end
 
   # If revocation is enabled, load CRLs or download them, using the CA bundle
@@ -92,6 +155,13 @@ class Puppet::SSL::StateMachine
   # for which we don't have a CRL
   #
   class NeedCRLs < SSLState
+    attr_reader :force_crl_refresh
+
+    def initialize(machine, ssl_context, force_crl_refresh = false)
+      super(machine, ssl_context)
+      @force_crl_refresh = force_crl_refresh
+    end
+
     def next_state
       Puppet.debug("Loading CRLs")
 
@@ -101,15 +171,10 @@ class Puppet::SSL::StateMachine
         if crls
           next_ctx = @ssl_provider.create_root_context(cacerts: ssl_context[:cacerts], crls: crls)
 
-          crl_ttl = Puppet[:crl_refresh_interval]
-          if crl_ttl
-            last_update = @cert_provider.crl_last_update
-            now = Time.now
-            if last_update.nil? || now.to_i > last_update.to_i + crl_ttl
-              # set last updated time first, then make a best effort to refresh
-              @cert_provider.crl_last_update = now
-              next_ctx = refresh_crl(next_ctx, last_update)
-            end
+          now = Time.now
+          last_update = @cert_provider.crl_last_update
+          if needs_refresh?(now, last_update)
+            next_ctx = refresh_crl(next_ctx, last_update)
           end
         else
           next_ctx = download_crl(@ssl_context, nil)
@@ -132,22 +197,36 @@ class Puppet::SSL::StateMachine
 
     private
 
+    def needs_refresh?(now, last_update)
+      return true if @force_crl_refresh || last_update.nil?
+
+      crl_ttl = Puppet[:crl_refresh_interval]
+      return false unless crl_ttl
+
+      now.to_i > last_update.to_i + crl_ttl
+    end
+
     def refresh_crl(ssl_ctx, last_update)
       Puppet.info(_("Refreshing CRL"))
 
       # return the next_ctx containing the updated crl
-      download_crl(ssl_ctx, last_update)
+      next_ctx = download_crl(ssl_ctx, last_update)
+
+      # After a successful refresh, update crl_last_update
+      @cert_provider.crl_last_update = Time.now
+
+      next_ctx
     rescue Puppet::HTTP::ResponseError => e
       if e.response.code == 304
         Puppet.info(_("CRL is unmodified, using existing CRL"))
       else
-        Puppet.info(_("Failed to refresh CRL, using existing CRL: %{message}") % {message: e.message})
+        Puppet.info(_("Failed to refresh CRL, using existing CRL: %{message}") % { message: e.message })
       end
 
       # return the original ssl_ctx
       ssl_ctx
     rescue Puppet::HTTP::HTTPError => e
-      Puppet.warning(_("Failed to refresh CRL, using existing CRL: %{message}") % {message: e.message})
+      Puppet.warning(_("Failed to refresh CRL, using existing CRL: %{message}") % { message: e.message })
 
       # return the original ssl_ctx
       ssl_ctx
@@ -161,6 +240,8 @@ class Puppet::SSL::StateMachine
       next_ctx = @ssl_provider.create_root_context(cacerts: ssl_ctx[:cacerts], crls: crls)
       @cert_provider.save_crls(crls)
 
+      Puppet.info("Refreshed CRL: #{@machine.digest_as_hex(pem)}")
+
       next_ctx
     end
   end
@@ -182,7 +263,11 @@ class Puppet::SSL::StateMachine
           next_ctx = @ssl_provider.create_context(
             cacerts: @ssl_context.cacerts, crls: @ssl_context.crls, private_key: key, client_cert: cert
           )
-          return Done.new(@machine, next_ctx)
+          if needs_refresh?(cert)
+            return NeedRenewedCert.new(@machine, next_ctx, key)
+          else
+            return Done.new(@machine, next_ctx)
+          end
         end
       else
         if Puppet[:key_type] == 'ec'
@@ -198,6 +283,15 @@ class Puppet::SSL::StateMachine
 
       NeedSubmitCSR.new(@machine, @ssl_context, key)
     end
+
+    private
+
+    def needs_refresh?(cert)
+      cert_ttl = Puppet[:hostcert_renewal_interval]
+      return false unless cert_ttl
+
+      Time.now.to_i >= (cert.not_after.to_i - cert_ttl)
+    end
   end
 
   # Base class for states with a private key.
@@ -256,19 +350,52 @@ class Puppet::SSL::StateMachine
     rescue Puppet::SSL::SSLError => e
       Error.new(@machine, e.message, e)
     rescue OpenSSL::X509::CertificateError => e
-      Error.new(@machine, _("Failed to parse certificate: %{message}") % {message: e.message}, e)
+      Error.new(@machine, _("Failed to parse certificate: %{message}") % { message: e.message }, e)
     rescue Puppet::HTTP::ResponseError => e
       if e.response.code == 404
-        Puppet.info(_("Certificate for %{certname} has not been signed yet") % {certname: Puppet[:certname]})
+        Puppet.info(_("Certificate for %{certname} has not been signed yet") % { certname: Puppet[:certname] })
         $stdout.puts _("Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}).") % { name: Puppet[:certname] }
         Wait.new(@machine)
       else
         to_error(_("Failed to retrieve certificate for %{certname}: %{message}") %
-                 {certname: Puppet[:certname], message: e.response.message}, e)
+                 { certname: Puppet[:certname], message: e.message }, e)
       end
     end
   end
 
+  # Class to renew a client/host certificate automatically.
+  #
+  class NeedRenewedCert < KeySSLState
+    def next_state
+      Puppet.debug(_("Renewing client certificate"))
+
+      route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
+      cert = OpenSSL::X509::Certificate.new(
+        route.post_certificate_renewal(@ssl_context)[1]
+      )
+
+      # verify client cert before saving
+      next_ctx = @ssl_provider.create_context(
+        cacerts: @ssl_context.cacerts, crls: @ssl_context.crls, private_key: @private_key, client_cert: cert
+      )
+      @cert_provider.save_client_cert(Puppet[:certname], cert)
+
+      Puppet.info(_("Renewed client certificate: %{cert_digest}, not before '%{not_before}', not after '%{not_after}'") % { cert_digest: @machine.digest_as_hex(cert.to_pem), not_before: cert.not_before, not_after: cert.not_after })
+
+      Done.new(@machine, next_ctx)
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 404
+        Puppet.info(_("Certificate autorenewal has not been enabled on the server."))
+      else
+        Puppet.warning(_("Failed to automatically renew certificate: %{code} %{reason}") % { code: e.response.code, reason: e.response.reason })
+      end
+      Done.new(@machine, @ssl_context)
+    rescue => e
+      Puppet.warning(_("Unable to automatically renew certificate: %{message}") % { message: e.message })
+      Done.new(@machine, @ssl_context)
+    end
+  end
+
   # We cannot make progress, so wait if allowed to do so, or exit.
   #
   class Wait < SSLState
@@ -282,10 +409,10 @@ class Puppet::SSL::StateMachine
         log_error(_("Exiting now because the waitforcert setting is set to 0."))
         exit(1)
       elsif Time.now.to_i > @machine.wait_deadline
-        log_error(_("Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded.") % {name: Puppet[:certname] })
+        log_error(_("Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded.") % { name: Puppet[:certname] })
         exit(1)
       else
-        Puppet.info(_("Will try again in %{time} seconds.") % {time: time})
+        Puppet.info(_("Will try again in %{time} seconds.") % { time: time })
 
         # close http/tls and session state before sleeping
         Puppet.runtime[:http].close
@@ -316,7 +443,7 @@ class Puppet::SSL::StateMachine
         LockFailure.new(@machine, _("Another puppet instance is already running and the maxwaitforlock timeout has been exceeded; exiting"))
       else
         Puppet.info _("Another puppet instance is already running; waiting for it to finish")
-        Puppet.info _("Will try again in %{time} seconds.") % {time: @machine.waitforlock}
+        Puppet.info _("Will try again in %{time} seconds.") % { time: @machine.waitforlock }
         Kernel.sleep @machine.waitforlock
 
         # try again
@@ -420,7 +547,7 @@ class Puppet::SSL::StateMachine
     final_state.ssl_context
   end
 
-  # Run the state machine for CA certs and CRLs.
+  # Run the state machine for client certs.
   #
   # @return [Puppet::SSL::SSLContext] initialized SSLContext
   # @raise [Puppet::Error] If we fail to generate an SSLContext
@@ -440,6 +567,10 @@ class Puppet::SSL::StateMachine
     @lockfile.unlock
   end
 
+  def digest_as_hex(str)
+    Puppet::SSL::Digest.new(digest, str).to_hex
+  end
+
   private
 
   def run_machine(state, stop)

data/lib/puppet/ssl/verifier.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl'
 
 # Verify an SSL connection.
 #
 # @api private
 class Puppet::SSL::Verifier
-
   FIVE_MINUTES_AS_SECONDS = 5 * 60
 
   attr_reader :ssl_context
@@ -29,7 +30,7 @@ class Puppet::SSL::Verifier
   # @api private
   def reusable?(verifier)
     verifier.instance_of?(self.class) &&
-      verifier.ssl_context.object_id == @ssl_context.object_id
+      verifier.ssl_context.equal?(@ssl_context) # same object?
   end
 
   # Configure the `http` connection based on the current `ssl_context`.

data/lib/puppet/ssl.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Just to make the constants work out.
 require_relative '../puppet'
 require_relative 'ssl/openssl_loader'
@@ -9,7 +11,7 @@ require_relative 'ssl/openssl_loader'
 # @see Puppet::SSL::SSLProvider
 # @api private
 module Puppet::SSL
-  CA_NAME = "ca".freeze
+  CA_NAME = "ca"
 
   require_relative 'ssl/oids'
   require_relative 'ssl/error'

data/lib/puppet/syntax_checkers/base64.rb

@@ -1,9 +1,10 @@
+# frozen_string_literal: true
+
 # A syntax checker for Base64.
 # @api public
 require_relative '../../puppet/syntax_checkers'
 require 'base64'
 class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
-
   # Checks the text for BASE64 syntax issues and reports them to the given acceptor.
   # This checker allows the most relaxed form of Base64, including newlines and missing padding.
   # It also accept URLsafe input.
@@ -15,9 +16,10 @@ class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxCh
   # @api public
   #
   def check(text, syntax, acceptor, source_pos)
-    raise ArgumentError.new(_("Base64 syntax checker: the text to check must be a String.")) unless text.is_a?(String)
-    raise ArgumentError.new(_("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json")) unless syntax.is_a?(String)
-    raise ArgumentError.new(_("Base64 syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    raise ArgumentError, _("Base64 syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError, _("Base64 syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
     cleaned_text = text.gsub(/[\r?\n[:blank:]]/, '')
     begin
       # Do a strict decode64 on text with all whitespace stripped since the non strict version
@@ -33,7 +35,7 @@ class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxCh
       # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
       # and the issue code. (In this case especially, where there is only a single error message being issued).
       #
-      issue = Puppet::Pops::Issues::issue(:ILLEGAL_BASE64) { msg }
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_BASE64) { msg }
       acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
     end
   end

data/lib/puppet/syntax_checkers/epp.rb

@@ -1,8 +1,9 @@
+# frozen_string_literal: true
+
 # A syntax checker for JSON.
 # @api public
 require_relative '../../puppet/syntax_checkers'
 class Puppet::SyntaxCheckers::EPP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
-
   # Checks the text for Puppet Language EPP syntax issues and reports them to the given acceptor.
   #
   # Error messages from the checker are capped at 100 chars from the source text.
@@ -14,20 +15,20 @@ class Puppet::SyntaxCheckers::EPP < Puppet::Plugins::SyntaxCheckers::SyntaxCheck
   # @api public
   #
   def check(text, syntax, acceptor, source_pos)
-    raise ArgumentError.new(_("EPP syntax checker: the text to check must be a String.")) unless text.is_a?(String)
-    raise ArgumentError.new(_("EPP syntax checker: the syntax identifier must be a String, e.g. pp")) unless syntax == 'epp'
-    raise ArgumentError.new(_("EPP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    raise ArgumentError, _("EPP syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("EPP syntax checker: the syntax identifier must be a String, e.g. pp") unless syntax == 'epp'
+    raise ArgumentError, _("EPP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
 
     begin
       Puppet::Pops::Parser::EvaluatingParser::EvaluatingEppParser.singleton.parse_string(text)
     rescue => e
       # Cap the message to 100 chars and replace newlines
-      msg = _("EPP syntax checker: \"%{message}\"") % { message: e.message().slice(0,500).gsub(/\r?\n/, "\\n") }
+      msg = _("EPP syntax checker: \"%{message}\"") % { message: e.message().slice(0, 500).gsub(/\r?\n/, "\\n") }
 
       # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
       # and the issue code. (In this case especially, where there is only a single error message being issued).
       #
-      issue = Puppet::Pops::Issues::issue(:ILLEGAL_EPP) { msg }
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_EPP) { msg }
       acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
     end
   end

data/lib/puppet/syntax_checkers/json.rb

@@ -1,8 +1,9 @@
+# frozen_string_literal: true
+
 # A syntax checker for JSON.
 # @api public
 require_relative '../../puppet/syntax_checkers'
 class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
-
   # Checks the text for JSON syntax issues and reports them to the given acceptor.
   #
   # Error messages from the checker are capped at 100 chars from the source text.
@@ -14,21 +15,20 @@ class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChec
   # @api public
   #
   def check(text, syntax, acceptor, source_pos)
-    raise ArgumentError.new(_("Json syntax checker: the text to check must be a String.")) unless text.is_a?(String)
-    raise ArgumentError.new(_("Json syntax checker: the syntax identifier must be a String, e.g. json, data+json")) unless syntax.is_a?(String)
-    raise ArgumentError.new(_("Json syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
-    #raise ArgumentError.new("Json syntax checker: location_info must be a Hash") unless location_info.is_a?(Hash)
+    raise ArgumentError, _("Json syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("Json syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError, _("Json syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
 
     begin
       Puppet::Util::Json.load(text)
     rescue => e
       # Cap the message to 100 chars and replace newlines
-      msg = _("JSON syntax checker: Cannot parse invalid JSON string. \"%{message}\"") % { message: e.message().slice(0,100).gsub(/\r?\n/, "\\n") }
+      msg = _("JSON syntax checker: Cannot parse invalid JSON string. \"%{message}\"") % { message: e.message().slice(0, 100).gsub(/\r?\n/, "\\n") }
 
       # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
       # and the issue code. (In this case especially, where there is only a single error message being issued).
       #
-      issue = Puppet::Pops::Issues::issue(:ILLEGAL_JSON) { msg }
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_JSON) { msg }
       acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
     end
   end

data/lib/puppet/syntax_checkers/pp.rb

@@ -1,8 +1,9 @@
+# frozen_string_literal: true
+
 # A syntax checker for JSON.
 # @api public
 require_relative '../../puppet/syntax_checkers'
 class Puppet::SyntaxCheckers::PP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
-
   # Checks the text for Puppet Language syntax issues and reports them to the given acceptor.
   #
   # Error messages from the checker are capped at 100 chars from the source text.
@@ -14,20 +15,20 @@ class Puppet::SyntaxCheckers::PP < Puppet::Plugins::SyntaxCheckers::SyntaxChecke
   # @api public
   #
   def check(text, syntax, acceptor, source_pos)
-    raise ArgumentError.new(_("PP syntax checker: the text to check must be a String.")) unless text.is_a?(String)
-    raise ArgumentError.new(_("PP syntax checker: the syntax identifier must be a String, e.g. pp")) unless syntax == 'pp'
-    raise ArgumentError.new(_("PP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    raise ArgumentError, _("PP syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("PP syntax checker: the syntax identifier must be a String, e.g. pp") unless syntax == 'pp'
+    raise ArgumentError, _("PP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
 
     begin
       Puppet::Pops::Parser::EvaluatingParser.singleton.parse_string(text)
     rescue => e
       # Cap the message to 100 chars and replace newlines
-      msg = _("PP syntax checker: \"%{message}\"") % { message: e.message().slice(0,500).gsub(/\r?\n/, "\\n") }
+      msg = _("PP syntax checker: \"%{message}\"") % { message: e.message().slice(0, 500).gsub(/\r?\n/, "\\n") }
 
       # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
       # and the issue code. (In this case especially, where there is only a single error message being issued).
       #
-      issue = Puppet::Pops::Issues::issue(:ILLEGAL_PP) { msg }
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_PP) { msg }
       acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
     end
   end

data/lib/puppet/syntax_checkers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # A name space for syntax checkers provided by Puppet.
 module Puppet::SyntaxCheckers
-end
+end