openvox 7.37.1 → 8.19.0

data/lib/puppet/x509/cert_provider.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/x509'
 
 # Class for loading and saving cert related objects. By default the provider
@@ -41,7 +43,7 @@ class Puppet::X509::CertProvider
   def save_cacerts(certs)
     save_pem(certs.map(&:to_pem).join, @capath, **permissions_for_setting(:localcacert))
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to save CA certificates to '%{capath}'") % {capath: @capath}, e)
+    raise Puppet::Error.new(_("Failed to save CA certificates to '%{capath}'") % { capath: @capath }, e)
   end
 
   # Load CA certs from the configured `capath`.
@@ -57,9 +59,10 @@ class Puppet::X509::CertProvider
     if !pem && required
       raise Puppet::Error, _("The CA certificates are missing from '%{path}'") % { path: @capath }
     end
+
     pem ? load_cacerts_from_pem(pem) : nil
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to load CA certificates from '%{capath}'") % {capath: @capath}, e)
+    raise Puppet::Error.new(_("Failed to load CA certificates from '%{capath}'") % { capath: @capath }, e)
   end
 
   # Load PEM encoded CA certificates.
@@ -87,7 +90,7 @@ class Puppet::X509::CertProvider
   def save_crls(crls)
     save_pem(crls.map(&:to_pem).join, @crlpath, **permissions_for_setting(:hostcrl))
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to save CRLs to '%{crlpath}'") % {crlpath: @crlpath}, e)
+    raise Puppet::Error.new(_("Failed to save CRLs to '%{crlpath}'") % { crlpath: @crlpath }, e)
   end
 
   # Load CRLs from the configured `crlpath` path.
@@ -103,9 +106,10 @@ class Puppet::X509::CertProvider
     if !pem && required
       raise Puppet::Error, _("The CRL is missing from '%{path}'") % { path: @crlpath }
     end
+
     pem ? load_crls_from_pem(pem) : nil
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to load CRLs from '%{crlpath}'") % {crlpath: @crlpath}, e)
+    raise Puppet::Error.new(_("Failed to load CRLs from '%{crlpath}'") % { crlpath: @crlpath }, e)
   end
 
   # Load PEM encoded CRL(s).
@@ -146,6 +150,28 @@ class Puppet::X509::CertProvider
     Puppet::FileSystem.touch(@crlpath, mtime: time)
   end
 
+  # Return the time when the CA bundle was last updated.
+  #
+  # @return [Time, nil] Time when the CA bundle was last updated, or nil if we don't
+  #   have a CA bundle
+  #
+  # @api private
+  def ca_last_update
+    stat = Puppet::FileSystem.stat(@capath)
+    Time.at(stat.mtime)
+  rescue Errno::ENOENT
+    nil
+  end
+
+  # Set the CA bundle last updated time.
+  #
+  # @param time [Time] The last updated time
+  #
+  # @api private
+  def ca_last_update=(time)
+    Puppet::FileSystem.touch(@capath, mtime: time)
+  end
+
   # Save named private key in the configured `privatekeydir`. For
   # historical reasons, names are case insensitive.
   #
@@ -159,7 +185,7 @@ class Puppet::X509::CertProvider
   # @api private
   def save_private_key(name, key, password: nil)
     pem = if password
-            cipher = OpenSSL::Cipher::AES.new(128, :CBC)
+            cipher = OpenSSL::Cipher.new('aes-128-cbc')
             key.export(cipher, password)
           else
             key.to_pem
@@ -167,7 +193,7 @@ class Puppet::X509::CertProvider
     path = @hostprivkey || to_path(@privatekeydir, name)
     save_pem(pem, path, **permissions_for_setting(:hostprivkey))
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to save private key for '%{name}'") % {name: name}, e)
+    raise Puppet::Error.new(_("Failed to save private key for '%{name}'") % { name: name }, e)
   end
 
   # Load a private key from the configured `privatekeydir`. For
@@ -189,9 +215,10 @@ class Puppet::X509::CertProvider
     if !pem && required
       raise Puppet::Error, _("The private key is missing from '%{path}'") % { path: path }
     end
+
     pem ? load_private_key_from_pem(pem, password: password) : nil
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to load private key for '%{name}'") % {name: name}, e)
+    raise Puppet::Error.new(_("Failed to load private key for '%{name}'") % { name: name }, e)
   end
 
   # Load a PEM encoded private key.
@@ -234,7 +261,7 @@ class Puppet::X509::CertProvider
     path = @hostcert || to_path(@certdir, name)
     save_pem(cert.to_pem, path, **permissions_for_setting(:hostcert))
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to save client certificate for '%{name}'") % {name: name}, e)
+    raise Puppet::Error.new(_("Failed to save client certificate for '%{name}'") % { name: name }, e)
   end
 
   # Load a named client cert from the configured `certdir`.
@@ -252,9 +279,10 @@ class Puppet::X509::CertProvider
     if !pem && required
       raise Puppet::Error, _("The client certificate is missing from '%{path}'") % { path: path }
     end
+
     pem ? load_client_cert_from_pem(pem) : nil
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to load client certificate for '%{name}'") % {name: name}, e)
+    raise Puppet::Error.new(_("Failed to load client certificate for '%{name}'") % { name: name }, e)
   end
 
   # Load a PEM encoded certificate.
@@ -288,6 +316,13 @@ class Puppet::X509::CertProvider
       options[:extension_requests] = csr_attributes.extension_requests
     end
 
+    # Adds auto-renew attribute to CSR if the agent supports auto-renewal of
+    # certificates
+    if Puppet[:hostcert_renewal_interval] && Puppet[:hostcert_renewal_interval] > 0
+      options[:csr_attributes] ||= {}
+      options[:csr_attributes].merge!({ '1.3.6.1.4.1.34380.1.3.2' => 'true' })
+    end
+
     csr = Puppet::SSL::CertificateRequest.new(name)
     csr.generate(private_key, options)
   end
@@ -303,7 +338,7 @@ class Puppet::X509::CertProvider
     path = to_path(@requestdir, name)
     save_pem(csr.to_pem, path, **permissions_for_setting(:hostcsr))
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to save certificate request for '%{name}'") % {name: name}, e)
+    raise Puppet::Error.new(_("Failed to save certificate request for '%{name}'") % { name: name }, e)
   end
 
   # Load a named certificate signing request (CSR) from the configured `requestdir`.
@@ -319,7 +354,7 @@ class Puppet::X509::CertProvider
     pem = load_pem(path)
     pem ? load_request_from_pem(pem) : nil
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to load certificate request for '%{name}'") % {name: name}, e)
+    raise Puppet::Error.new(_("Failed to load certificate request for '%{name}'") % { name: name }, e)
   end
 
   # Delete a named certificate signing request (CSR) from the configured `requestdir`.
@@ -332,7 +367,7 @@ class Puppet::X509::CertProvider
     path = to_path(@requestdir, name)
     delete_pem(path)
   rescue SystemCallError => e
-    raise Puppet::Error.new(_("Failed to delete certificate request for '%{name}'") % {name: name}, e)
+    raise Puppet::Error.new(_("Failed to delete certificate request for '%{name}'") % { name: name }, e)
   end
 
   # Load a PEM encoded certificate signing request (CSR).
@@ -352,6 +387,7 @@ class Puppet::X509::CertProvider
   # @param name [String] the name associated with the cert related object
   def to_path(base, name)
     raise _("Certname %{name} must not contain unprintable or non-ASCII characters") % { name: name.inspect } unless name =~ VALID_CERTNAME
+
     File.join(base, "#{name.downcase}.pem")
   end
 

data/lib/puppet/x509/pem_store.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/x509'
 
 # Methods for managing PEM encoded files. While PEM encoded strings are
@@ -29,7 +31,7 @@ module Puppet::X509::PemStore
   # @raise [Errno::EACCES] if permission is denied
   # @raise [Errno::EPERM] if the operation cannot be completed
   # @api private
-  def save_pem(pem, path, owner: nil, group: nil, mode: 0644)
+  def save_pem(pem, path, owner: nil, group: nil, mode: 0o644)
     Puppet::FileSystem.replace_file(path, mode) do |f|
       f.set_encoding('UTF-8')
       f.write(pem.encode('UTF-8'))

data/lib/puppet/x509.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../puppet'
 require_relative '../puppet/ssl/openssl_loader'
 

data/lib/puppet.rb

@@ -1,12 +1,13 @@
+# frozen_string_literal: true
+
 require_relative 'puppet/version'
 require_relative 'puppet/concurrent/synchronized'
 
-if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new("2.5.0")
-  raise LoadError, "Puppet #{Puppet.version} requires Ruby 2.5.0 or greater, found Ruby #{RUBY_VERSION.dup}."
+Puppet::OLDEST_RECOMMENDED_RUBY_VERSION = '3.1.0'
+if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new(Puppet::OLDEST_RECOMMENDED_RUBY_VERSION)
+  raise LoadError, "Puppet #{Puppet.version} requires Ruby #{Puppet::OLDEST_RECOMMENDED_RUBY_VERSION} or greater, found Ruby #{RUBY_VERSION.dup}."
 end
 
-Puppet::OLDEST_RECOMMENDED_RUBY_VERSION = '2.5.0'
-
 $LOAD_PATH.extend(Puppet::Concurrent::Synchronized)
 
 # see the bottom of the file for further inclusions
@@ -19,10 +20,6 @@ require_relative 'puppet/settings'
 require_relative 'puppet/util/feature'
 require_relative 'puppet/util/suidmanager'
 require_relative 'puppet/util/run_mode'
-# PSON is deprecated, use JSON instead
-require_relative 'puppet/external/pson/common'
-require_relative 'puppet/external/pson/version'
-require_relative 'puppet/external/pson/pure'
 require_relative 'puppet/gettext/config'
 require_relative 'puppet/defaults'
 
@@ -78,9 +75,9 @@ module Puppet
   # @api public
   def self.[](param)
     if param == :debug
-      return Puppet::Util::Log.level == :debug
+      Puppet::Util::Log.level == :debug
     else
-      return @@settings[param]
+      @@settings[param]
     end
   end
 
@@ -94,7 +91,7 @@ module Puppet
   require_relative 'puppet/feature/base'
 
   # setting access and stuff
-  def self.[]=(param,value)
+  def self.[]=(param, value)
     @@settings[param] = value
   end
 
@@ -104,9 +101,9 @@ module Puppet
 
   def self.debug=(value)
     if value
-      Puppet::Util::Log.level=(:debug)
+      Puppet::Util::Log.level = (:debug)
     else
-      Puppet::Util::Log.level=(:notice)
+      Puppet::Util::Log.level = (:notice)
     end
   end
 
@@ -130,6 +127,7 @@ module Puppet
 
   # Now that settings are loaded we have the code loaded to be able to issue
   # deprecation warnings. Warn if we're on a deprecated ruby version.
+  # Update JRuby version constraints in PUP-11716
   if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new(Puppet::OLDEST_RECOMMENDED_RUBY_VERSION)
     Puppet.deprecation_warning(_("Support for ruby version %{version} is deprecated and will be removed in a future release. See https://puppet.com/docs/puppet/latest/system_requirements.html for a list of supported ruby versions.") % { version: RUBY_VERSION })
   end
@@ -153,9 +151,9 @@ module Puppet
     dir = Puppet[:vendormoduledir]
     if dir && File.directory?(dir)
       Dir.entries(dir)
-        .reject { |f| f =~ /^\./ }
-        .map { |f| File.join(dir, f, "lib") }
-        .select { |d| FileTest.directory?(d) }
+         .reject { |f| f =~ /^\./ }
+         .map { |f| File.join(dir, f, "lib") }
+         .select { |d| FileTest.directory?(d) }
     else
       []
     end
@@ -229,7 +227,8 @@ module Puppet
         loaders << Puppet::Environments::StaticPrivate.new(
           Puppet::Node::Environment.create(default_environment,
                                            modulepath,
-                                           Puppet::Node::Environment::NO_MANIFEST))
+                                           Puppet::Node::Environment::NO_MANIFEST)
+        )
       end
     end
 
@@ -238,7 +237,11 @@ module Puppet
       :ssl_context => proc { Puppet.runtime[:http].default_ssl_context },
       :http_session => proc { Puppet.runtime[:http].create_session },
       :plugins => proc { Puppet::Plugins::Configuration.load_plugins },
-      :rich_data => false
+      :rich_data => Puppet[:rich_data],
+      # `stringify_rich` controls whether `rich_data` is stringified into a lossy format
+      # instead of a lossless format. Catalogs should not be stringified, though to_yaml
+      # and the resource application have uses for a lossy, user friendly format.
+      :stringify_rich => false
     }
   end
 
@@ -260,7 +263,7 @@ module Puppet
     @context.push(overrides, description)
   end
 
-  # Push something onto the the context and make it global across threads. This
+  # Push something onto the context and make it global across threads. This
   # has the potential to convert threadlocal overrides earlier on the stack into
   # global overrides.
   # @api private

data/lib/puppet_pal.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Puppet as a Library "PAL"
 # This is the entry point when using PAL as a standalone library.
 #

data/lib/puppet_x.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # The Puppet Extensions Module.
 #
 # Submodules of this module should be named after the publisher (e.g.