openvox 7.37.1 → 8.19.0

data/lib/puppet/defaults.rb

@@ -1,11 +1,13 @@
+# frozen_string_literal: true
+
 require_relative '../puppet/util/platform'
 
 module Puppet
-
   def self.default_diffargs
     '-u'
   end
 
+  # If you modify this, update puppet/type/file/checksum.rb too
   def self.default_digest_algorithm
     'sha256'
   end
@@ -30,6 +32,7 @@ module Puppet
 
   def self.default_cadir
     return "" if Puppet::Util::Platform.windows?
+
     old_ca_dir = "#{Puppet[:ssldir]}/ca"
     new_ca_dir = "/etc/puppetlabs/puppetserver/ca"
 
@@ -45,29 +48,15 @@ module Puppet
   end
 
   def self.default_basemodulepath
-    if Puppet::Util::Platform.windows?
-      path = ['$codedir/modules']
-      installdir = ENV["FACTER_env_windows_installdir"]
-      if installdir
-        path << "#{installdir}/puppet/modules"
-      end
-      path.join(File::PATH_SEPARATOR)
-    else
-      '$codedir/modules:/opt/puppetlabs/puppet/modules'
+    path = ['$codedir/modules']
+    if (run_mode_dir = Puppet.run_mode.common_module_dir)
+      path << run_mode_dir
     end
+    path.join(File::PATH_SEPARATOR)
   end
 
   def self.default_vendormoduledir
-    if Puppet::Util::Platform.windows?
-      installdir = ENV["FACTER_env_windows_installdir"]
-      if installdir
-        "#{installdir}\\puppet\\vendor_modules"
-      else
-        nil
-      end
-    else
-      '/opt/puppetlabs/puppet/vendor_modules'
-    end
+    Puppet.run_mode.vendor_module_dir
   end
 
   ############################################################################################
@@ -75,14 +64,14 @@ module Puppet
   #   see the docs for Settings.define_settings
   ############################################################################################
 
-  AS_DURATION = %q{This setting can be a time interval in seconds (30 or 30s), minutes (30m), hours (6h), days (2d), or years (5y).}
+  AS_DURATION = 'This setting can be a time interval in seconds (30 or 30s), minutes (30m), hours (6h), days (2d), or years (5y).'
 
   # @api public
   # @param args [Puppet::Settings] the settings object to define default settings for
   # @return void
   def self.initialize_default_settings!(settings)
     settings.define_settings(:main,
-    :confdir  => {
+    :confdir => {
         :default  => nil,
         :type     => :directory,
         :desc     => "The main Puppet configuration directory.  The default for this setting
@@ -91,7 +80,7 @@ module Puppet
           directory, but if it's running as any other user, it defaults to being
           in the user's home directory.",
     },
-    :codedir  => {
+    :codedir => {
         :default  => nil,
         :type     => :directory,
         :desc     => "The main Puppet code directory.  The default for this setting
@@ -100,7 +89,7 @@ module Puppet
           directory, but if it's running as any other user, it defaults to being
           in the user's home directory.",
     },
-    :vardir   => {
+    :vardir => {
         :default  => nil,
         :type     => :directory,
         :owner    => "service",
@@ -111,12 +100,12 @@ module Puppet
 
     ### NOTE: this setting is usually being set to a symbol value.  We don't officially have a
     ###     setting type for that yet, but we might want to consider creating one.
-    :name     => {
+    :name => {
         :default  => nil,
         :desc     => "The name of the application, if we are running as one.  The
           default is essentially $0 without the path or `.rb`.",
     }
-  )
+    )
 
   settings.define_settings(:main,
     :logdir => {
@@ -130,7 +119,7 @@ module Puppet
     :log_level => {
       :default    => 'notice',
       :type       => :enum,
-      :values     => ["debug","info","notice","warning","err","alert","emerg","crit"],
+      :values     => %w[debug info notice warning err alert emerg crit],
       :desc       => "Default logging level for messages from Puppet. Allowed values are:
 
         * debug
@@ -160,11 +149,11 @@ module Puppet
         * `deprecations` --- disables deprecation warnings.
         * `undefined_variables` --- disables warnings about non existing variables.
         * `undefined_resources` --- disables warnings about non existing resources.",
-      :hook      => proc do |value|
+      :hook => proc do |value|
         values = munge(value)
         valid   = %w[deprecations undefined_variables undefined_resources]
         invalid = values - (values & valid)
-        if not invalid.empty?
+        unless invalid.empty?
           raise ArgumentError, _("Cannot disable unrecognized warning types '%{invalid}'.") % { invalid: invalid.join(',') } +
               ' ' + _("Valid values are '%{values}'.") % { values: valid.join(', ') }
         end
@@ -173,8 +162,8 @@ module Puppet
     :skip_logging_catalog_request_destination => {
       :default => false,
       :type    => :boolean,
-      :desc    => "If you wish to suppress the notice of which compiler supplied the
-        catalog",
+      :desc => "Specifies whether to suppress the notice of which compiler
+        supplied the catalog. A value of `true` suppresses the notice.",
     },
     :merge_dependency_warnings => {
       :default => false,
@@ -190,14 +179,14 @@ module Puppet
         ",
     },
     :strict => {
-      :default    => :warning,
+      :default    => :error,
       :type       => :symbolic_enum,
       :values     => [:off, :warning, :error],
       :desc       => "The strictness level of puppet. Allowed values are:
 
         * off     - do not perform extra validation, do not report
-        * warning - perform extra validation, report as warning (default)
-        * error   - perform extra validation, fail with error
+        * warning - perform extra validation, report as warning
+        * error   - perform extra validation, fail with error (default)
 
         The strictness level is for both language semantics and runtime
         evaluation validation. In addition to controlling the behavior with
@@ -208,7 +197,7 @@ module Puppet
         but may be added in minor releases (x.y.0). In major releases
         it expected that most (if not all) strictness validation become
         standard behavior.",
-      :hook    => proc do |value|
+      :hook => proc do |value|
         munge(value)
         value.to_sym
       end
@@ -370,12 +359,14 @@ module Puppet
           This setting can only be set in the `[main]` section of puppet.conf; it cannot
           be set in `[server]`, `[agent]`, or an environment config section.",
         :call_hook => :on_define_and_write,
-        :hook             => proc do |value|
-          Puppet::Util.set_env('PATH', '') if Puppet::Util.get_env('PATH').nil?
-          Puppet::Util.set_env('PATH', value) unless value == 'none'
-          paths = Puppet::Util.get_env('PATH').split(File::PATH_SEPARATOR)
+        :hook => proc do |value|
+          ENV['PATH'] = '' if ENV['PATH'].nil?
+          ENV['PATH'] = value unless value == 'none'
+          paths = ENV['PATH'].split(File::PATH_SEPARATOR)
           Puppet::Util::Platform.default_paths.each do |path|
-            Puppet::Util.set_env('PATH', Puppet::Util.get_env('PATH') + File::PATH_SEPARATOR + path) unless paths.include?(path)
+            next if paths.include?(path)
+
+            ENV['PATH'] = ENV.fetch('PATH', nil) + File::PATH_SEPARATOR + path
           end
           value
         end
@@ -427,14 +418,16 @@ module Puppet
       :type     => :boolean,
       :default  => true,
       :desc     => <<-'EOT'
-      When versioned_environment_dirs is `true` Puppet will readlink the environmentpath
-      when constructing the environment's modulepath. The full readlinked path is referred
-      to as the "resolved path" and the configured path potentially containing symlinks is
-      the "configured path". When reporting where resources come from users may choose
-      between the configured or resolved path.
-
-      When set to false, the resolved paths are reported instead of the configured paths.
-    EOT
+      Specifies how environment paths are reported. When the value of
+      `versioned_environment_dirs` is `true`, Puppet applies the readlink function to
+      the `environmentpath` setting when constructing the environment's modulepath. The
+      full readlinked path is referred to as the "resolved path," and the configured
+      path potentially containing symlinks is the "configured path." When reporting
+      where resources come from, users may choose between the configured and resolved
+      path.
+
+      When set to `false`, the resolved paths are reported instead of the configured paths.
+      EOT
     },
     :use_last_environment => {
       :type     => :boolean,
@@ -445,7 +438,7 @@ module Puppet
       environment and skip the node request.
 
       When set to false, we will do the node request and ignore the environment data from the last_run_summary file.
-    EOT
+      EOT
     },
     :always_retry_plugins => {
         :type     => :boolean,
@@ -466,10 +459,10 @@ module Puppet
         feature.  This behavior is almost always appropriate for the server,
         and can result in a significant performance improvement for types and
         features that are checked frequently.
-      EOT
+        EOT
     },
     :diff_args => {
-        :default  => lambda { default_diffargs },
+        :default  => -> { default_diffargs },
         :desc     => "Which arguments to pass to the diff command when printing differences between
           files. The command to use can be chosen with the `diff` setting.",
     },
@@ -491,19 +484,19 @@ module Puppet
     },
     :daemonize => {
         :type     => :boolean,
-        :default  => (Puppet::Util::Platform.windows? ? false : true),
+        :default  => !Puppet::Util::Platform.windows?,
         :desc     => "Whether to send the process into the background.  This defaults
           to true on POSIX systems, and to false on Windows (where Puppet
           currently cannot daemonize).",
         :short    => "D",
         :hook     => proc do |value|
-          if value and Puppet::Util::Platform.windows?
-            raise "Cannot daemonize on Windows"
-          end
-      end
+                       if value and Puppet::Util::Platform.windows?
+                         raise "Cannot daemonize on Windows"
+                       end
+                     end
     },
     :maximum_uid => {
-        :default  => 4294967290,
+        :default  => 4_294_967_290,
         :type     => :integer,
         :desc     => "The maximum allowed UID.  Some platforms use negative UIDs
           but then ship with tools that do not know how to handle signed ints,
@@ -589,7 +582,7 @@ module Puppet
       :desc    => "The binder configuration file. Puppet reads this file on each request to configure the bindings system.
       If set to nil (the default), a $confdir/binder_config.yaml is optionally loaded. If it does not exists, a default configuration
       is used. If the setting :binding_config is specified, it must reference a valid and existing yaml file.",
-      :type    => :file,
+      :type => :file,
     },
     :catalog_terminus => {
       :type       => :terminus,
@@ -649,10 +642,10 @@ module Puppet
       :default    => "none",
       :desc       => "The user name for an authenticated HTTP proxy. Requires the `http_proxy_host` setting.",
     },
-    :http_proxy_password =>{
+    :http_proxy_password => {
       :default    => "none",
       :hook       => proc do |value|
-        if value =~ /[@!# \/]/
+        if value =~ %r{[@!# /]}
           raise "Passwords set in the http_proxy_password setting must be valid as part of a URL, and any reserved characters must be URL-encoded. We received: #{value}"
         end
       end,
@@ -713,7 +706,7 @@ Fine grained control of filetimeouts is deprecated. In future
 releases this value will only determine if file content is cached.
 
 Valid values are 0 (never cache) and 15 (15 second minimum wait time).
-            WARNING
+          WARNING
         end
       end
     },
@@ -749,7 +742,7 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
       "
     },
     :environment_data_provider => {
-      :desc       => "The name of a registered environment data provider used when obtaining environment
+      :desc => "The name of a registered environment data provider used when obtaining environment
       specific data. The three built in and registered providers are 'none' (no data), 'function' (data
       obtained by calling the function 'environment::data()') and 'hiera' (data obtained using a data
       provider configured using a hiera.yaml file in root of the environment).
@@ -790,14 +783,14 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
     },
     :location_trusted => {
       :default => false,
-      :type     => :boolean,
-      :desc    => "This will allow sending the name + password and the cookie header to all hosts that puppet may redirect to.
+      :type => :boolean,
+      :desc => "This will allow sending the name + password and the cookie header to all hosts that puppet may redirect to.
         This may or may not introduce a security breach if puppet redirects you to a site to which you'll send your authentication info and cookies."
     }
   )
 
   settings.define_settings(:module_tool,
-    :module_repository  => {
+    :module_repository => {
       :default  => 'https://forgeapi.puppet.com',
       :desc     => "The module repository",
     },
@@ -817,11 +810,10 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
 
     settings.define_settings(
     :main,
-
     # We have to downcase the fqdn, because the current ssl stuff (as opposed to in master) doesn't have good facilities for
     # manipulating naming.
     :certname => {
-      :default => lambda { Puppet::Settings.default_certname.downcase },
+      :default => -> { Puppet::Settings.default_certname.downcase },
       :desc => "The name to use when handling certificates. When a node
         requests a certificate from the CA Puppet Server, it uses the value of the
         `certname` setting as its requested Subject CN.
@@ -916,7 +908,7 @@ EOT
     },
     :certdir => {
       :default => "$ssldir/certs",
-      :type   => :directory,
+      :type => :directory,
       :mode => "0755",
       :owner => "service",
       :group => "service",
@@ -924,7 +916,7 @@ EOT
     },
     :ssldir => {
       :default => "$confdir/ssl",
-      :type   => :directory,
+      :type => :directory,
       :mode => "0771",
       :owner => "service",
       :group => "service",
@@ -937,7 +929,7 @@ EOT
     },
     :publickeydir => {
       :default => "$ssldir/public_keys",
-      :type   => :directory,
+      :type => :directory,
       :mode => "0755",
       :owner => "service",
       :group => "service",
@@ -953,7 +945,7 @@ EOT
     },
     :privatekeydir => {
       :default => "$ssldir/private_keys",
-      :type   => :directory,
+      :type => :directory,
       :mode => "0750",
       :owner => "service",
       :group => "service",
@@ -961,7 +953,7 @@ EOT
     },
     :privatedir => {
       :default => "$ssldir/private",
-      :type   => :directory,
+      :type => :directory,
       :mode => "0750",
       :owner => "service",
       :group => "service",
@@ -969,7 +961,7 @@ EOT
     },
     :passfile => {
       :default => "$privatedir/password",
-      :type   => :file,
+      :type => :file,
       :mode => "0640",
       :owner => "service",
       :group => "service",
@@ -978,7 +970,7 @@ EOT
     },
     :hostcsr => {
       :default => "$requestdir/$certname.pem",
-      :type   => :file,
+      :type => :file,
       :mode => "0644",
       :owner => "service",
       :group => "service",
@@ -987,7 +979,7 @@ EOT
     },
     :hostcert => {
       :default => "$certdir/$certname.pem",
-      :type   => :file,
+      :type => :file,
       :mode => "0644",
       :owner => "service",
       :group => "service",
@@ -995,7 +987,7 @@ EOT
     },
     :hostprivkey => {
       :default => "$privatekeydir/$certname.pem",
-      :type   => :file,
+      :type => :file,
       :mode => "0640",
       :owner => "service",
       :group => "service",
@@ -1003,7 +995,7 @@ EOT
     },
     :hostpubkey => {
       :default => "$publickeydir/$certname.pem",
-      :type   => :file,
+      :type => :file,
       :mode => "0644",
       :owner => "service",
       :group => "service",
@@ -1011,7 +1003,7 @@ EOT
     },
     :localcacert => {
       :default => "$certdir/ca.pem",
-      :type   => :file,
+      :type => :file,
       :mode => "0644",
       :owner => "service",
       :group => "service",
@@ -1019,7 +1011,7 @@ EOT
     },
     :ca_fingerprint => {
       :default => nil,
-      :type   => :string,
+      :type => :string,
       :desc => "The expected fingerprint of the CA certificate. If specified, the agent
         will compare the CA certificate fingerprint that it downloads against this value
         and reject the CA certificate if the values do not match. This only applies
@@ -1036,7 +1028,7 @@ EOT
     },
     :hostcrl => {
       :default => "$ssldir/crl.pem",
-      :type   => :file,
+      :type => :file,
       :mode => "0644",
       :owner => "service",
       :group => "service",
@@ -1089,7 +1081,7 @@ EOT
                    Default is `prime256v1`."
     },
     :digest_algorithm => {
-        :default  => lambda { default_digest_algorithm },
+        :default  => -> { default_digest_algorithm },
         :type     => :enum,
         :values   => valid_digest_algorithms,
         :desc     => "Which digest algorithm to use for file resources and the filebucket.
@@ -1097,7 +1089,7 @@ EOT
                       #{default_digest_algorithm}.",
     },
     :supported_checksum_types => {
-      :default => lambda { default_file_checksum_types },
+      :default => -> { default_file_checksum_types },
       :type    => :array,
       :desc    => "Checksum types supported by this agent for use in file resources of a
                    static catalog. Values must be comma-separated. Valid types are
@@ -1107,7 +1099,7 @@ EOT
         values = munge(value)
 
         invalid = values - Puppet.valid_file_checksum_types
-        if not invalid.empty?
+        unless invalid.empty?
           raise ArgumentError, _("Invalid value '%{value}' for parameter %{name}. Allowed values are '%{allowed_values}'") % {
             value: invalid.first, name: @name, allowed_values: Puppet.valid_file_checksum_types.join("', '")
           }
@@ -1132,7 +1124,7 @@ EOT
       :desc    => "The name to use the Certificate Authority certificate.",
     },
     :cadir => {
-      :default => lambda { default_cadir },
+      :default => -> { default_cadir },
       :type => :directory,
       :desc => "The root directory for the certificate authority.",
     },
@@ -1212,23 +1204,60 @@ EOT
       :desc       => "The default TTL for new certificates.
       #{AS_DURATION}",
     },
-    :crl_refresh_interval => {
+    :ca_refresh_interval => {
+      :default    => "1d",
       :type       => :duration,
-      :desc       => "How often the Puppet agent refreshes its local CRL. By
-         default the CRL is only downloaded once, and never refreshed. If a
-         duration is specified, then the agent will refresh its CRL whenever it
-         next runs and the elapsed time since the CRL was last refreshed exceeds
-         the duration.
-
-         In general, the duration should be greater than the `runinterval`.
-         Setting it to an equal or lesser value will cause the CRL to be
+      :desc       => "How often the Puppet agent refreshes its local CA
+         certificates. By default, CA certificates are refreshed every 24 hours. If a
+         different interval is specified, the agent refreshes its CA certificates during
+         the next agent run if the elapsed time since the certificates were last
+         refreshed exceeds the specified duration.
+
+         In general, the interval should be greater than the `runinterval`
+         value. Setting the `ca_refresh_interval` value to 0 or an equal or
+         lesser value than `runinterval` causes the CA certificates to be
          refreshed on every run.
 
+         If the agent downloads new CA certs, the agent uses those for subsequent
+         network requests. If the refresh request fails or if the CA certs are
+         unchanged on the server, then the agent run will continue using the
+         local CA certs it already has. #{AS_DURATION}",
+    },
+    :crl_refresh_interval => {
+      :default    => "1d",
+      :type       => :duration,
+      :desc       => "How often the Puppet agent refreshes its local Certificate
+         Revocation List (CRL). By default, the CRL is refreshed every 24 hours. If
+         a different interval is specified, the agent refreshes its CRL on the next
+         Puppet agent run if the elapsed time since the CRL was last refreshed
+         exceeds the specified interval.
+
+         In general, the interval should be greater than the `runinterval` value.
+         Setting the `crl_refresh_interval` value to 0 or an equal or lesser value
+         than `runinterval` causes the CRL to be refreshed on every run.
+
          If the agent downloads a new CRL, the agent will use it for subsequent
          network requests. If the refresh request fails or if the CRL is
          unchanged on the server, then the agent run will continue using the
          local CRL it already has.#{AS_DURATION}",
     },
+    :hostcert_renewal_interval => {
+      :default => "30d",
+      :type    => :duration,
+      :desc => "How often the Puppet agent renews its client certificate. By
+         default, the client certificate is renewed 30 days before the certificate
+         expires. If a different interval is specified, the agent renews its client
+         certificate during the next agent run, assuming that the client certificate has
+         expired within the specified duration.
+
+         In general, the `hostcert_renewal_interval` value should be greater than the
+         `runinterval` value. Setting the `hostcert_renewal_interval` value to 0 disables
+         automatic renewal.
+
+         If the agent downloads a new certificate, the agent will use it
+         for subsequent network requests. If the refresh request fails, the agent run
+         continues to use its existing certificate. #{AS_DURATION}",
+    },
     :keylength => {
       :default    => 4096,
       :type       => :integer,
@@ -1242,7 +1271,7 @@ EOT
     }
   )
 
-  # Define the config default.
+    # Define the config default.
 
     settings.define_settings(:application,
       :config_file_name => {
@@ -1266,8 +1295,8 @@ EOT
       :sourceaddress => {
         :default    => nil,
         :desc       => "The address the agent should use to initiate requests.",
-      },
-  )
+      }
+    )
 
   settings.define_settings(:environment,
     :manifest => {
@@ -1387,7 +1416,7 @@ EOT
       :desc       => "File that provides mapping between custom SSL oids and user-friendly names"
     },
     :basemodulepath => {
-      :default => lambda { default_basemodulepath },
+      :default => -> { default_basemodulepath },
       :type => :path,
       :desc => "The search path for **global** modules. Should be specified as a
         list of directories separated by the system path separator character. (The
@@ -1399,7 +1428,7 @@ EOT
         <https://puppet.com/docs/puppet/latest/environments_about.html>",
     },
     :vendormoduledir => {
-      :default => lambda { default_vendormoduledir },
+      :default => -> { default_vendormoduledir },
       :type => :string,
       :desc => "The directory containing **vendored** modules. These modules will
       be used by _all_ environments like those in the `basemodulepath`. The only
@@ -1466,10 +1495,12 @@ EOT
         To turn off reports entirely, set this to `none`",
     },
     :exclude_unchanged_resources => {
-      :default => false,
+      :default => true,
       :type => :boolean,
-      :desc => 'When set to true, resources that have had no changes after catalog application
-        will not have corresponding unchanged resource status updates listed in the report.'
+      :desc => "Specifies how unchanged resources are listed in reports. When
+        set to `true`, resources that have had no changes after catalog application
+        will not have corresponding unchanged resource status updates listed in a
+        report."
     },
     :reportdir => {
       :default => "$vardir/reports",
@@ -1591,7 +1622,7 @@ EOT
       :owner => "root",
       :mode => "0640",
       :desc => "The file in which puppet agent stores a list of the resources
-        associated with the retrieved configuration."  },
+        associated with the retrieved configuration." },
     :puppetdlog => {
       :default => "$logdir/puppetd.log",
       :type => :file,
@@ -1634,7 +1665,7 @@ EOT
       :desc       => "Whether the server will search for SRV records in DNS for the current domain.",
     },
     :srv_domain => {
-      :default    => lambda { Puppet::Settings.domain_fact },
+      :default    => -> { Puppet::Settings.domain_fact },
       :desc       => "The domain which will be queried to find the SRV records of servers to use.",
     },
     :http_extra_headers => {
@@ -1712,15 +1743,21 @@ EOT
       instances will be serialized using this method, since not all classes
       can be guaranteed to support this format, but it will be used for all
       classes that support it.",
+      :hook => proc { |value|
+        if value == "pson" && !Puppet.features.pson?
+          raise(Puppet::Settings::ValidationError, "The 'puppet-pson' gem must be installed to use the PSON serialization format.")
+        end
+      }
     },
     :allow_pson_serialization => {
-      :default    => true,
+      :default    => false,
       :type       => :boolean,
-      :desc       => "Whether when unable to serialize to JSON or other formats,
-        Puppet falls back to PSON. This option affects both puppetserver's
-        configuration management service responses and when the agent saves its
-        cached catalog. This option is useful in preventing the loss of data because
-        rich data cannot be serialized via PSON.",
+      :desc => "Whether to allow PSON serialization. When unable to serialize to
+        JSON or other formats, Puppet falls back to PSON. This option affects the
+        configuration management service responses of Puppet Server and the process by
+        which the agent saves its cached catalog. With a default value of `false`, this
+        option is useful in preventing the loss of data because rich data cannot be
+        serialized via PSON.",
     },
     :agent_catalog_run_lockfile => {
       :default    => "$statedir/agent_catalog_run.lock",
@@ -1744,9 +1781,9 @@ EOT
     },
     :include_legacy_facts => {
       :type       => :boolean,
-      :default    => true,
+      :default    => false,
       :desc       => "Whether to include legacy facts when requesting a catalog. This
-        option can be set to false provided all puppet manifests, hiera.yaml and hiera
+        option can be set to `false` if all puppet manifests, hiera.yaml, and hiera
         configuration layers no longer access legacy facts, such as `$osfamily`, and
         instead access structured facts, such as `$facts['os']['family']`."
     },
@@ -1766,7 +1803,7 @@ EOT
       :desc       => "The soft limit for the number of top level facts.",
     },
     :number_of_facts_soft_limit => {
-      :default    => 2048,
+      :default    => 10_240,
       :type       => :integer,
       :desc       => "The soft limit for the total number of fact values. This counts the
         child elements of all facts (e.g. all items of an array or a hash), not just top
@@ -2002,7 +2039,7 @@ EOT
       :type       => :boolean,
       :desc       => "Whether plugins should be synced with the central server. This setting is
         deprecated.",
-      :hook => proc { |value|
+      :hook => proc { |_value|
         #TRANSLATORS 'pluginsync' is a setting and should not be translated
         Puppet.deprecation_warning(_("Setting 'pluginsync' is deprecated."))
       }
@@ -2020,7 +2057,7 @@ EOT
     }
   )
 
-  # Central fact information.
+    # Central fact information.
 
     settings.define_settings(
     :main,
@@ -2062,14 +2099,14 @@ EOT
         what is being done.",
     },
     :preprocess_deferred => {
-      :default => true,
+      :default => false,
       :type => :boolean,
-      :desc => "Whether puppet should call deferred functions before applying
-        the catalog. If set to `true`, then all prerequisites needed for the
-        deferred function must be satified prior to puppet running. If set to
-        `false`, then deferred functions will follow puppet relationships and
-        ordering. This allows puppet to install prerequisites needed for a
-        deferred function and call the deferred function in the same run."
+      :desc => "Whether Puppet should call deferred functions before applying
+        the catalog. If set to `true`, all prerequisites required for the
+        deferred function must be satisfied before the Puppet run. If set to
+        `false`, deferred functions follow Puppet relationships and
+        ordering. In this way, Puppet can install the prerequisites required for a
+        deferred function and call the deferred function in the same run.",
     },
     :summarize => {
         :default  => false,
@@ -2091,22 +2128,24 @@ EOT
           can produce node information. The command must:
 
           * Take the name of a node as a command-line argument.
+
           * Return a YAML hash with up to three keys:
             * `classes` --- A list of classes, as an array or hash.
             * `environment` --- A string.
             * `parameters` --- A list of top-scope variables to set, as a hash.
+
           * For unknown nodes, exit with a non-zero exit code.
 
           Generally, an ENC script makes requests to an external data source.
 
           For more info, see [the ENC documentation](https://puppet.com/docs/puppet/latest/nodes_external.html).",
     }
-    )
+  )
 
         settings.define_settings(
         :ldap,
     :ldapssl => {
-      :default  => false,
+      :default => false,
       :type   => :boolean,
       :desc   => "Whether SSL should be used when searching for nodes.
         Defaults to false because SSL usually requires certificates
@@ -2171,7 +2210,7 @@ EOT
           have one already set.  Generally, it should be the 'ou=Hosts'
           branch under your main directory.",
     }
-  )
+      )
 
   settings.define_settings(:server,
     :storeconfigs => {
@@ -2235,7 +2274,7 @@ EOT
     EOT
     },
   :strict_variables => {
-    :default => false,
+    :default => true,
     :type => :boolean,
     :desc => <<-'EOT'
       Causes an evaluation error when referencing unknown variables. (This does not affect