openvox 8.19.0

data/lib/puppet/ssl/base.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl/openssl_loader'
+require_relative '../../puppet/ssl'
+require_relative '../../puppet/ssl/digest'
+
+# The base class for wrapping SSL instances.
+class Puppet::SSL::Base
+  # For now, use the YAML separator.
+  SEPARATOR = "\n---\n"
+
+  # Only allow printing ascii characters, excluding /
+  VALID_CERTNAME = /\A[ -.0-~]+\Z/
+
+  def self.from_multiple_s(text)
+    text.split(SEPARATOR).collect { |inst| from_s(inst) }
+  end
+
+  def self.to_multiple_s(instances)
+    instances.collect(&:to_s).join(SEPARATOR)
+  end
+
+  def self.wraps(klass)
+    @wrapped_class = klass
+  end
+
+  def self.wrapped_class
+    raise(Puppet::DevError, _("%{name} has not declared what class it wraps") % { name: self }) unless defined?(@wrapped_class)
+
+    @wrapped_class
+  end
+
+  def self.validate_certname(name)
+    raise _("Certname %{name} must not contain unprintable or non-ASCII characters") % { name: name.inspect } unless name =~ VALID_CERTNAME
+  end
+
+  attr_accessor :name, :content
+
+  def generate
+    raise Puppet::DevError, _("%{class_name} did not override 'generate'") % { class_name: self.class }
+  end
+
+  def initialize(name)
+    @name = name.to_s.downcase
+    self.class.validate_certname(@name)
+  end
+
+  ##
+  # name_from_subject extracts the common name attribute from the subject of an
+  # x.509 certificate certificate
+  #
+  # @api private
+  #
+  # @param [OpenSSL::X509::Name] subject The full subject (distinguished name) of the x.509
+  #   certificate.
+  #
+  # @return [String] the name (CN) extracted from the subject.
+  def self.name_from_subject(subject)
+    if subject.respond_to? :to_a
+      (subject.to_a.assoc('CN') || [])[1]
+    end
+  end
+
+  # Create an instance of our Puppet::SSL::* class using a given instance of the wrapped class
+  def self.from_instance(instance, name = nil)
+    unless instance.is_a?(wrapped_class)
+      raise ArgumentError, _("Object must be an instance of %{class_name}, %{actual_class} given") %
+                           { class_name: wrapped_class, actual_class: instance.class }
+    end
+    if name.nil? and !instance.respond_to?(:subject)
+      raise ArgumentError, _("Name must be supplied if it cannot be determined from the instance")
+    end
+
+    name ||= name_from_subject(instance.subject)
+    result = new(name)
+    result.content = instance
+    result
+  end
+
+  # Convert a string into an instance
+  def self.from_s(string, name = nil)
+    instance = wrapped_class.new(string)
+    from_instance(instance, name)
+  end
+
+  # Read content from disk appropriately.
+  def read(path)
+    # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest
+    # nothing derives from Puppet::SSL::Certificate, but it is called by a number of other SSL Indirectors:
+    # Puppet::Indirector::CertificateStatus::File (.indirection.find)
+    # Puppet::Network::HTTP::WEBrick (.indirection.find)
+    # Puppet::Network::HTTP::RackREST (.from_instance)
+    # Puppet::Network::HTTP::WEBrickREST (.from_instance)
+    # Puppet::SSL::Inventory (.indirection.search, implements its own add / rebuild / serials with encoding UTF8)
+    @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII))
+  end
+
+  # Convert our thing to pem.
+  def to_s
+    return "" unless content
+
+    content.to_pem
+  end
+
+  def to_data_hash
+    to_s
+  end
+
+  # Provide the full text of the thing we're dealing with.
+  def to_text
+    return "" unless content
+
+    content.to_text
+  end
+
+  def fingerprint(md = :SHA256)
+    mds = md.to_s.upcase
+    digest(mds).to_hex
+  end
+
+  def digest(algorithm = nil)
+    algorithm ||= digest_algorithm
+
+    Puppet::SSL::Digest.new(algorithm, content.to_der)
+  end
+
+  def digest_algorithm
+    # The signature_algorithm on the X509 cert is a combination of the digest
+    # algorithm and the encryption algorithm
+    # e.g. md5WithRSAEncryption, sha256WithRSAEncryption
+    # Unfortunately there isn't a consistent pattern
+    # See RFCs 3279, 5758
+    digest_re = Regexp.union(
+      /ripemd160/i,
+      /md[245]/i,
+      /sha\d*/i
+    )
+    ln = content.signature_algorithm
+    match = digest_re.match(ln)
+    if match
+      match[0].downcase
+    else
+      raise Puppet::Error, _("Unknown signature algorithm '%{ln}'") % { ln: ln }
+    end
+  end
+
+  private
+
+  def wrapped_class
+    self.class.wrapped_class
+  end
+end

data/lib/puppet/ssl/certificate.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl/base'
+
+# Manage certificates themselves.  This class has no
+# 'generate' method because the CA is responsible
+# for turning CSRs into certificates; we can only
+# retrieve them from the CA (or not, as is often
+# the case).
+#
+# @deprecated Use {Puppet::SSL::SSLProvider} instead.
+class Puppet::SSL::Certificate < Puppet::SSL::Base
+  # This is defined from the base class
+  wraps OpenSSL::X509::Certificate
+
+  # Because of how the format handler class is included, this
+  # can't be in the base class.
+  def self.supported_formats
+    [:s]
+  end
+
+  def self.subject_alt_names_for(cert)
+    alts = cert.extensions.find { |ext| ext.oid == "subjectAltName" }
+    return [] unless alts
+
+    alts.value.split(/\s*,\s*/)
+  end
+
+  def subject_alt_names
+    self.class.subject_alt_names_for(content)
+  end
+
+  def expiration
+    return nil unless content
+
+    content.not_after
+  end
+
+  # This name is what gets extracted from the subject before being passed
+  # to the constructor, so it's not downcased
+  def unmunged_name
+    self.class.name_from_subject(content.subject.to_utf8)
+  end
+
+  # Any extensions registered with custom OIDs as defined in module
+  # Puppet::SSL::Oids may be looked up here.
+  #
+  # A cert with a 'pp_uuid' extension having the value 'abcd' would return:
+  #
+  # [{ 'oid' => 'pp_uuid', 'value' => 'abcd'}]
+  #
+  # @return [Array<Hash{String => String}>] An array of two element hashes,
+  # with key/value pairs for the extension's oid, and its value.
+  def custom_extensions
+    custom_exts = content.extensions.select do |ext|
+      Puppet::SSL::Oids.subtree_of?('ppRegCertExt', ext.oid) or
+        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', ext.oid) or
+        Puppet::SSL::Oids.subtree_of?('ppAuthCertExt', ext.oid)
+    end
+
+    custom_exts.map do |ext|
+      { 'oid' => ext.oid, 'value' => get_ext_val(ext.oid) }
+    end
+  end
+
+  private
+
+  # Extract the extensions sequence from the wrapped certificate's raw ASN.1 form
+  def exts_seq
+    # See RFC-2459 section 4.1 (https://tools.ietf.org/html/rfc2459#section-4.1)
+    # to see where this is defined. Essentially this is saying "in the first
+    # sequence in the certificate, find the item that's tagged with 3. This
+    # is where the extensions are stored."
+    @extensions_tag ||= 3
+
+    @exts_seq ||= OpenSSL::ASN1.decode(content.to_der).value[0].value.find do |data|
+      (data.tag == @extensions_tag) && (data.tag_class == :CONTEXT_SPECIFIC)
+    end.value[0]
+  end
+
+  # Get the DER parsed value of an X.509 extension by it's OID, or short name
+  # if one has been registered with OpenSSL.
+  def get_ext_val(oid)
+    ext_obj = exts_seq.value.find do |ext_seq|
+      ext_seq.value[0].value == oid
+    end
+
+    raw_val = ext_obj.value.last.value
+
+    begin
+      OpenSSL::ASN1.decode(raw_val).value
+    rescue OpenSSL::ASN1::ASN1Error
+      # This is required to maintain backward compatibility with the previous
+      # way trusted facts were signed. See PUP-3560
+      raw_val
+    end
+  end
+end

data/lib/puppet/ssl/certificate_request.rb

@@ -0,0 +1,320 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl/base'
+require_relative '../../puppet/ssl/certificate_signer'
+
+# This class creates and manages X509 certificate signing requests.
+#
+# ## CSR attributes
+#
+# CSRs may contain a set of attributes that includes supplementary information
+# about the CSR or information for the signed certificate.
+#
+# PKCS#9/RFC 2985 section 5.4 formally defines the "Challenge password",
+# "Extension request", and "Extended-certificate attributes", but this
+# implementation only handles the "Extension request" attribute. Other
+# attributes may be defined on a CSR, but the RFC doesn't define behavior for
+# any other attributes so we treat them as only informational.
+#
+# ## CSR Extension request attribute
+#
+# CSRs may contain an optional set of extension requests, which allow CSRs to
+# include additional information that may be included in the signed
+# certificate. Any additional information that should be copied from the CSR
+# to the signed certificate MUST be included in this attribute.
+#
+# This behavior is dictated by PKCS#9/RFC 2985 section 5.4.2.
+#
+# @see https://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
+#
+class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
+  wraps OpenSSL::X509::Request
+
+  # Because of how the format handler class is included, this
+  # can't be in the base class.
+  def self.supported_formats
+    [:s]
+  end
+
+  def extension_factory
+    # rubocop:disable Naming/MemoizedInstanceVariableName
+    @ef ||= OpenSSL::X509::ExtensionFactory.new
+    # rubocop:enable Naming/MemoizedInstanceVariableName
+  end
+
+  # Create a certificate request with our system settings.
+  #
+  # @param key [OpenSSL::X509::Key] The private key associated with this CSR.
+  # @param options [Hash]
+  # @option options [String] :dns_alt_names A comma separated list of
+  #   Subject Alternative Names to include in the CSR extension request.
+  # @option options [Hash<String, String, Array<String>>] :csr_attributes A hash
+  #   of OIDs and values that are either a string or array of strings.
+  # @option options [Array<String, String>] :extension_requests A hash of
+  #   certificate extensions to add to the CSR extReq attribute, excluding
+  #   the Subject Alternative Names extension.
+  #
+  # @raise [Puppet::Error] If the generated CSR signature couldn't be verified
+  #
+  # @return [OpenSSL::X509::Request] The generated CSR
+  def generate(key, options = {})
+    Puppet.info _("Creating a new SSL certificate request for %{name}") % { name: name }
+
+    # If we're a CSR for the CA, then use the real ca_name, rather than the
+    # fake 'ca' name.  This is mostly for backward compatibility with 0.24.x,
+    # but it's also just a good idea.
+    common_name = name == Puppet::SSL::CA_NAME ? Puppet.settings[:ca_name] : name
+
+    csr = OpenSSL::X509::Request.new
+    csr.version = 0
+    csr.subject = OpenSSL::X509::Name.new([["CN", common_name]])
+
+    csr.public_key = if key.is_a?(OpenSSL::PKey::EC)
+                       # EC#public_key doesn't follow the PKey API,
+                       # see https://github.com/ruby/openssl/issues/29
+                       key
+                     else
+                       key.public_key
+                     end
+
+    if options[:csr_attributes]
+      add_csr_attributes(csr, options[:csr_attributes])
+    end
+
+    if (ext_req_attribute = extension_request_attribute(options))
+      csr.add_attribute(ext_req_attribute)
+    end
+
+    signer = Puppet::SSL::CertificateSigner.new
+    signer.sign(csr, key)
+
+    raise Puppet::Error, _("CSR sign verification failed; you need to clean the certificate request for %{name} on the server") % { name: name } unless csr.verify(csr.public_key)
+
+    @content = csr
+
+    # we won't be able to get the digest on jruby
+    if @content.signature_algorithm
+      Puppet.info _("Certificate Request fingerprint (%{digest}): %{hex_digest}") % { digest: digest.name, hex_digest: digest.to_hex }
+    end
+    @content
+  end
+
+  def ext_value_to_ruby_value(asn1_arr)
+    # A list of ASN1 types than can't be directly converted to a Ruby type
+    @non_convertible ||= [OpenSSL::ASN1::EndOfContent,
+                          OpenSSL::ASN1::BitString,
+                          OpenSSL::ASN1::Null,
+                          OpenSSL::ASN1::Enumerated,
+                          OpenSSL::ASN1::UTCTime,
+                          OpenSSL::ASN1::GeneralizedTime,
+                          OpenSSL::ASN1::Sequence,
+                          OpenSSL::ASN1::Set]
+
+    begin
+      # Attempt to decode the extension's DER data located in the original OctetString
+      asn1_val = OpenSSL::ASN1.decode(asn1_arr.last.value)
+    rescue OpenSSL::ASN1::ASN1Error
+      # This is to allow supporting the old-style of not DER encoding trusted facts
+      return asn1_arr.last.value
+    end
+
+    # If the extension value can not be directly converted to an atomic Ruby
+    # type, use the original ASN1 value. This is needed to work around a bug
+    # in Ruby's OpenSSL library which doesn't convert the value of unknown
+    # extension OIDs properly. See PUP-3560
+    if @non_convertible.include?(asn1_val.class) then
+      # Allows OpenSSL to take the ASN1 value and turn it into something Ruby understands
+      OpenSSL::X509::Extension.new(asn1_arr.first.value, asn1_val.to_der).value
+    else
+      asn1_val.value
+    end
+  end
+
+  # Return the set of extensions requested on this CSR, in a form designed to
+  # be useful to Ruby: an array of hashes.  Which, not coincidentally, you can pass
+  # successfully to the OpenSSL constructor later, if you want.
+  #
+  # @return [Array<Hash{String => String}>] An array of two or three element
+  # hashes, with key/value pairs for the extension's oid, its value, and
+  # optionally its critical state.
+  def request_extensions
+    raise Puppet::Error, _("CSR needs content to extract fields") unless @content
+
+    # Prefer the standard extReq, but accept the Microsoft specific version as
+    # a fallback, if the standard version isn't found.
+    attribute   = @content.attributes.find { |x| x.oid == "extReq" }
+    attribute ||= @content.attributes.find { |x| x.oid == "msExtReq" }
+    return [] unless attribute
+
+    extensions = unpack_extension_request(attribute)
+
+    index = -1
+    extensions.map do |ext_values|
+      index += 1
+
+      value = ext_value_to_ruby_value(ext_values)
+
+      # OK, turn that into an extension, to unpack the content.  Lovely that
+      # we have to swap the order of arguments to the underlying method, or
+      # perhaps that the ASN.1 representation chose to pack them in a
+      # strange order where the optional component comes *earlier* than the
+      # fixed component in the sequence.
+      case ext_values.length
+      when 2
+        { "oid" => ext_values[0].value, "value" => value }
+      when 3
+        { "oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value }
+      else
+        raise Puppet::Error, _("In %{attr}, expected extension record %{index} to have two or three items, but found %{count}") % { attr: attribute.oid, index: index, count: ext_values.length }
+      end
+    end
+  end
+
+  def subject_alt_names
+    @subject_alt_names ||= request_extensions
+                           .select { |x| x["oid"] == "subjectAltName" }
+                           .map { |x| x["value"].split(/\s*,\s*/) }
+                           .flatten
+                           .sort
+                           .uniq
+  end
+
+  # Return all user specified attributes attached to this CSR as a hash. IF an
+  # OID has a single value it is returned as a string, otherwise all values are
+  # returned as an array.
+  #
+  # The format of CSR attributes is specified in PKCS#10/RFC 2986
+  #
+  # @see https://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
+  #
+  # @api public
+  #
+  # @return [Hash<String, String>]
+  def custom_attributes
+    x509_attributes = @content.attributes.reject do |attr|
+      PRIVATE_CSR_ATTRIBUTES.include? attr.oid
+    end
+
+    x509_attributes.map do |attr|
+      { "oid" => attr.oid, "value" => attr.value.value.first.value }
+    end
+  end
+
+  private
+
+  # Exclude OIDs that may conflict with how Puppet creates CSRs.
+  #
+  # We only have nominal support for Microsoft extension requests, but since we
+  # ultimately respect that field when looking for extension requests in a CSR
+  # we need to prevent that field from being written to directly.
+  PRIVATE_CSR_ATTRIBUTES = [
+    'extReq',   '1.2.840.113549.1.9.14',
+    'msExtReq', '1.3.6.1.4.1.311.2.1.14'
+  ]
+
+  def add_csr_attributes(csr, csr_attributes)
+    csr_attributes.each do |oid, value|
+      if PRIVATE_CSR_ATTRIBUTES.include? oid
+        raise ArgumentError, _("Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute") % { oid: oid }
+      end
+
+      encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)
+
+      attr_set = OpenSSL::ASN1::Set.new([encoded])
+      csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
+      Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
+    rescue OpenSSL::X509::AttributeError => e
+      raise Puppet::Error, _("Cannot create CSR with attribute %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
+    end
+  end
+
+  PRIVATE_EXTENSIONS = [
+    'subjectAltName', '2.5.29.17'
+  ]
+
+  # @api private
+  def extension_request_attribute(options)
+    extensions = []
+
+    if options[:extension_requests]
+      options[:extension_requests].each_pair do |oid, value|
+        if PRIVATE_EXTENSIONS.include? oid
+          raise Puppet::Error, _("Cannot specify CSR extension request %{oid}: conflicts with internally used extension request") % { oid: oid }
+        end
+
+        ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
+        extensions << ext
+      rescue OpenSSL::X509::ExtensionError => e
+        raise Puppet::Error, _("Cannot create CSR with extension request %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
+      end
+    end
+
+    if options[:dns_alt_names]
+      raw_names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
+
+      parsed_names = raw_names.map do |name|
+        if !name.start_with?("IP:") && !name.start_with?("DNS:")
+          "DNS:#{name}"
+        else
+          name
+        end
+      end.sort.uniq.join(", ")
+
+      alt_names_ext = extension_factory.create_extension("subjectAltName", parsed_names, false)
+
+      extensions << alt_names_ext
+    end
+
+    unless extensions.empty?
+      seq = OpenSSL::ASN1::Sequence(extensions)
+      ext_req = OpenSSL::ASN1::Set([seq])
+      OpenSSL::X509::Attribute.new("extReq", ext_req)
+    end
+  end
+
+  # Unpack the extReq attribute into an array of Extensions.
+  #
+  # The extension request attribute is structured like
+  # `Set[Sequence[Extensions]]` where the outer Set only contains a single
+  # sequence.
+  #
+  # In addition the Ruby implementation of ASN1 requires that all ASN1 values
+  # contain a single value, so Sets and Sequence have to contain an array
+  # that in turn holds the elements. This is why we have to unpack an array
+  # every time we unpack a Set/Seq.
+  #
+  # @see https://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
+  # @see https://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
+  #
+  # @api private
+  #
+  # @param attribute [OpenSSL::X509::Attribute] The X509 extension request
+  #
+  # @return [Array<Array<Object>>] A array of arrays containing the extension
+  #   OID the critical state if present, and the extension value.
+  def unpack_extension_request(attribute)
+    unless attribute.value.is_a? OpenSSL::ASN1::Set
+      raise Puppet::Error, _("In %{attr}, expected Set but found %{klass}") % { attr: attribute.oid, klass: attribute.value.class }
+    end
+
+    unless attribute.value.value.is_a? Array
+      raise Puppet::Error, _("In %{attr}, expected Set[Array] but found %{klass}") % { attr: attribute.oid, klass: attribute.value.value.class }
+    end
+
+    unless attribute.value.value.size == 1
+      raise Puppet::Error, _("In %{attr}, expected Set[Array] with one value but found %{count} elements") % { attr: attribute.oid, count: attribute.value.value.size }
+    end
+
+    unless attribute.value.value.first.is_a? OpenSSL::ASN1::Sequence
+      raise Puppet::Error, _("In %{attr}, expected Set[Array[Sequence[...]]], but found %{klass}") % { attr: attribute.oid, klass: extension.class }
+    end
+
+    unless attribute.value.value.first.value.is_a? Array
+      raise Puppet::Error, _("In %{attr}, expected Set[Array[Sequence[Array[...]]]], but found %{klass}") % { attr: attribute.oid, klass: extension.value.class }
+    end
+
+    extensions = attribute.value.value.first.value
+
+    extensions.map(&:value)
+  end
+end

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl'
+require_relative '../../puppet/util/yaml'
+
+# This class transforms simple key/value pairs into the equivalent ASN1
+# structures. Values may be strings or arrays of strings.
+#
+# @api private
+class Puppet::SSL::CertificateRequestAttributes
+  attr_reader :path, :custom_attributes, :extension_requests
+
+  def initialize(path)
+    @path = path
+    @custom_attributes = {}
+    @extension_requests = {}
+  end
+
+  # Attempt to load a yaml file at the given @path.
+  # @return true if we are able to load the file, false otherwise
+  # @raise [Puppet::Error] if there are unexpected attribute keys
+  def load
+    Puppet.info(_("csr_attributes file loading from %{path}") % { path: path })
+    if Puppet::FileSystem.exist?(path)
+      hash = Puppet::Util::Yaml.safe_load_file(path, [Symbol]) || {}
+      unless hash.is_a?(Hash)
+        raise Puppet::Error, _("invalid CSR attributes, expected instance of Hash, received instance of %{klass}") % { klass: hash.class }
+      end
+
+      @custom_attributes = hash.delete('custom_attributes') || {}
+      @extension_requests = hash.delete('extension_requests') || {}
+      unless hash.keys.empty?
+        raise Puppet::Error, _("unexpected attributes %{keys} in %{path}") % { keys: hash.keys.inspect, path: @path.inspect }
+      end
+
+      return true
+    end
+    false
+  end
+end

data/lib/puppet/ssl/certificate_signer.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+# Take care of signing a certificate in a FIPS 140-2 compliant manner.
+#
+# @see https://projects.puppetlabs.com/issues/17295
+#
+# @api private
+class Puppet::SSL::CertificateSigner
+  # @!attribute [r] digest
+  #   @return [OpenSSL::Digest]
+  attr_reader :digest
+
+  def initialize
+    if OpenSSL::Digest.const_defined?('SHA256')
+      @digest = OpenSSL::Digest::SHA256
+    elsif OpenSSL::Digest.const_defined?('SHA1')
+      @digest = OpenSSL::Digest::SHA1
+    elsif OpenSSL::Digest.const_defined?('SHA512')
+      @digest = OpenSSL::Digest::SHA512
+    elsif OpenSSL::Digest.const_defined?('SHA384')
+      @digest = OpenSSL::Digest::SHA384
+    elsif OpenSSL::Digest.const_defined?('SHA224')
+      @digest = OpenSSL::Digest::SHA224
+    else
+      raise Puppet::Error,
+            "No FIPS 140-2 compliant digest algorithm in OpenSSL::Digest"
+    end
+  end
+
+  # Sign a certificate signing request (CSR) with a private key.
+  #
+  # @param [OpenSSL::X509::Request] content The CSR to sign
+  # @param [OpenSSL::X509::PKey] key The private key to sign with
+  #
+  # @api private
+  def sign(content, key)
+    content.sign(key, @digest.new)
+  end
+end

data/lib/puppet/ssl/digest.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class Puppet::SSL::Digest
+  attr_reader :digest
+
+  def initialize(algorithm, content)
+    algorithm ||= 'SHA256'
+    @digest = OpenSSL::Digest.new(algorithm, content)
+  end
+
+  def to_s
+    "(#{name}) #{to_hex}"
+  end
+
+  def to_hex
+    @digest.hexdigest.scan(/../).join(':').upcase
+  end
+
+  def name
+    @digest.name.upcase
+  end
+end