openvox 8.19.0

data/lib/puppet/application/device.rb

@@ -0,0 +1,440 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/application'
+require_relative '../../puppet/configurer'
+require_relative '../../puppet/util/network_device'
+require_relative '../../puppet/ssl/oids'
+
+class Puppet::Application::Device < Puppet::Application
+  run_mode :agent
+
+  attr_accessor :args, :agent, :host
+
+  def app_defaults
+    super.merge({
+                  :catalog_terminus => :rest,
+                  :catalog_cache_terminus => :json,
+                  :node_terminus => :rest,
+                  :facts_terminus => :network_device,
+                })
+  end
+
+  def preinit
+    # Do an initial trap, so that cancels don't get a stack trace.
+    Signal.trap(:INT) do
+      $stderr.puts _("Cancelling startup")
+      exit(0)
+    end
+
+    {
+      :apply => nil,
+      :waitforcert => nil,
+      :detailed_exitcodes => false,
+      :verbose => false,
+      :debug => false,
+      :centrallogs => false,
+      :setdest => false,
+      :resource => false,
+      :facts => false,
+      :target => nil,
+      :to_yaml => false,
+    }.each do |opt, val|
+      options[opt] = val
+    end
+
+    @args = {}
+  end
+
+  option("--centrallogging")
+  option("--debug", "-d")
+  option("--resource", "-r")
+  option("--facts", "-f")
+  option("--to_yaml", "-y")
+  option("--verbose", "-v")
+
+  option("--detailed-exitcodes") do |_arg|
+    options[:detailed_exitcodes] = true
+  end
+
+  option("--libdir LIBDIR") do |arg|
+    options[:libdir] = arg
+  end
+
+  option("--apply MANIFEST") do |arg|
+    options[:apply] = arg.to_s
+  end
+
+  option("--logdest DEST", "-l DEST") do |arg|
+    handle_logdest_arg(arg)
+  end
+
+  option("--waitforcert WAITFORCERT", "-w") do |arg|
+    options[:waitforcert] = arg.to_i
+  end
+
+  option("--port PORT", "-p") do |arg|
+    @args[:Port] = arg
+  end
+
+  option("--target DEVICE", "-t") do |arg|
+    options[:target] = arg.to_s
+  end
+
+  def summary
+    _("Manage remote network devices via OpenVox")
+  end
+
+  def help
+    <<~HELP
+
+      puppet-device(8) -- #{summary}
+      ========
+
+      SYNOPSIS
+      --------
+      Retrieves catalogs from the OpenVox server and applies them to remote devices.
+
+      This subcommand can be run manually; or periodically using cron,
+      a scheduled task, or a similar tool.
+
+
+      USAGE
+      -----
+        puppet device [-h|--help] [-v|--verbose] [-d|--debug]
+                      [-l|--logdest syslog|<file>|console] [--detailed-exitcodes]
+                      [--deviceconfig <file>] [-w|--waitforcert <seconds>]
+                      [--libdir <directory>]
+                      [-a|--apply <file>] [-f|--facts] [-r|--resource <type> [name]]
+                      [-t|--target <device>] [--user=<user>] [-V|--version]
+
+
+      DESCRIPTION
+      -----------
+      Devices require a proxy OpenVox agent to request certificates, collect facts,
+      retrieve and apply catalogs, and store reports.
+
+
+      USAGE NOTES
+      -----------
+      Devices managed by the puppet-device subcommand on an OpenVox agent are
+      configured in device.conf, which is located at $confdir/device.conf by default,
+      and is configurable with the $deviceconfig setting.
+
+      The device.conf file is an INI-like file, with one section per device:
+
+      [<DEVICE_CERTNAME>]
+      type <TYPE>
+      url <URL>
+      debug
+
+      The section name specifies the certname of the device.
+
+      The values for the type and url properties are specific to each type of device.
+
+      The optional debug property specifies transport-level debugging,
+      and is limited to telnet and ssh transports.
+
+      See https://puppet.com/docs/puppet/latest/config_file_device.html for details.
+
+
+      OPTIONS
+      -------
+      Note that any setting that's valid in the configuration file is also a valid
+      long argument. For example, 'server' is a valid configuration parameter, so
+      you can specify '--server <servername>' as an argument.
+
+      * --help, -h:
+        Print this help message
+
+      * --verbose, -v:
+        Turn on verbose reporting.
+
+      * --debug, -d:
+        Enable full debugging.
+
+      * --logdest, -l:
+        Where to send log messages. Choose between 'syslog' (the POSIX syslog
+        service), 'console', or the path to a log file. If debugging or verbosity is
+        enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
+        Multiple destinations can be set using a comma separated list
+        (eg: `/path/file1,console,/path/file2`)"
+
+        A path ending with '.json' will receive structured output in JSON format. The
+        log file will not have an ending ']' automatically written to it due to the
+        appending nature of logging. It must be appended manually to make the content
+        valid JSON.
+
+      * --detailed-exitcodes:
+        Provide transaction information via exit codes. If this is enabled, an exit
+        code of '1' means at least one device had a compile failure, an exit code of
+        '2' means at least one device had resource changes, and an exit code of '4'
+        means at least one device had resource failures. Exit codes of '3', '5', '6',
+        or '7' means that a bitwise combination of the preceding exit codes happened.
+
+      * --deviceconfig:
+        Path to the device config file for puppet device.
+        Default: $confdir/device.conf
+
+      * --waitforcert, -w:
+        This option only matters for targets that do not yet have certificates
+        and it is enabled by default, with a value of 120 (seconds).  This causes
+        +puppet device+ to poll the server every 2 minutes and ask it to sign a
+        certificate request.  This is useful for the initial setup of a target.
+        You can turn off waiting for certificates by specifying a time of 0.
+
+      * --libdir:
+        Override the per-device libdir with a local directory. Specifying a libdir also
+        disables pluginsync. This is useful for testing.
+
+        A path ending with '.jsonl' will receive structured output in JSON Lines
+        format.
+
+      * --apply:
+        Apply a manifest against a remote target. Target must be specified.
+
+      * --facts:
+        Displays the facts of a remote target. Target must be specified.
+
+      * --resource:
+        Displays a resource state as Puppet code, roughly equivalent to
+        `puppet resource`.  Can be filtered by title. Requires --target be specified.
+
+      * --target:
+        Target a specific device/certificate in the device.conf. Doing so will perform a
+        device run against only that device/certificate.
+
+      * --to_yaml:
+        Output found resources in yaml format, suitable to use with Hiera and
+        create_resources.
+
+      * --user:
+        The user to run as.
+
+
+      EXAMPLE
+      -------
+            $ puppet device --target remotehost --verbose
+
+      AUTHOR
+      ------
+      Brice Figureau
+
+
+      COPYRIGHT
+      ---------
+      Copyright (c) 2011-2018 Puppet Inc.,
+      Copyright (c) 2024 Vox Pupuli
+      Licensed under the Apache 2.0 License
+    HELP
+  end
+
+  def main
+    if options[:resource] and !options[:target]
+      raise _("resource command requires target")
+    end
+    if options[:facts] and !options[:target]
+      raise _("facts command requires target")
+    end
+
+    unless options[:apply].nil?
+      raise _("missing argument: --target is required when using --apply") if options[:target].nil?
+      raise _("%{file} does not exist, cannot apply") % { file: options[:apply] } unless File.file?(options[:apply])
+    end
+    libdir = Puppet[:libdir]
+    vardir = Puppet[:vardir]
+    confdir = Puppet[:confdir]
+    ssldir = Puppet[:ssldir]
+    certname = Puppet[:certname]
+
+    env = Puppet::Node::Environment.remote(Puppet[:environment])
+    returns = Puppet.override(:current_environment => env, :loaders => Puppet::Pops::Loaders.new(env)) do
+      # find device list
+      require_relative '../../puppet/util/network_device/config'
+      devices = Puppet::Util::NetworkDevice::Config.devices.dup
+      if options[:target]
+        devices.select! { |key, _value| key == options[:target] }
+      end
+      if devices.empty?
+        if options[:target]
+          raise _("Target device / certificate '%{target}' not found in %{config}") % { target: options[:target], config: Puppet[:deviceconfig] }
+        else
+          Puppet.err _("No device found in %{config}") % { config: Puppet[:deviceconfig] }
+          exit(1)
+        end
+      end
+      devices.collect do |_devicename, device|
+        # TODO when we drop support for ruby < 2.5 we can remove the extra block here
+
+        device_url = URI.parse(device.url)
+        # Handle nil scheme & port
+        scheme = "#{device_url.scheme}://" if device_url.scheme
+        port = ":#{device_url.port}" if device_url.port
+
+        # override local $vardir and $certname
+        Puppet[:ssldir] = ::File.join(Puppet[:deviceconfdir], device.name, 'ssl')
+        Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
+        Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
+        Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
+        Puppet[:certname] = device.name
+        ssl_context = nil
+
+        # create device directory under $deviceconfdir
+        Puppet::FileSystem.dir_mkpath(Puppet[:ssldir]) unless Puppet::FileSystem.dir_exist?(Puppet[:ssldir])
+
+        # this will reload and recompute default settings and create device-specific sub vardir
+        Puppet.settings.use :main, :agent, :ssl
+
+        # Workaround for PUP-8736: store ssl certs outside the cache directory to prevent accidental removal and keep the old path as symlink
+        optssldir = File.join(Puppet[:confdir], 'ssl')
+        Puppet::FileSystem.symlink(Puppet[:ssldir], optssldir) unless Puppet::FileSystem.exist?(optssldir)
+
+        unless options[:resource] || options[:facts] || options[:apply]
+          # Since it's too complicated to fix properly in the default settings, we workaround for PUP-9642 here.
+          # See https://github.com/puppetlabs/puppet/pull/7483#issuecomment-483455997 for details.
+          # This has to happen after `settings.use` above, so the directory is created and before `setup_host` below, where the SSL
+          # routines would fail with access errors
+          if Puppet.features.root? && !Puppet::Util::Platform.windows?
+            user = Puppet::Type.type(:user).new(name: Puppet[:user]).exists? ? Puppet[:user] : nil
+            group = Puppet::Type.type(:group).new(name: Puppet[:group]).exists? ? Puppet[:group] : nil
+            Puppet.debug("Fixing perms for #{user}:#{group} on #{Puppet[:confdir]}")
+            FileUtils.chown(user, group, Puppet[:confdir]) if user || group
+          end
+
+          ssl_context = setup_context
+
+          unless options[:libdir]
+            Puppet.override(ssl_context: ssl_context) do
+              Puppet::Configurer::PluginHandler.new.download_plugins(env) if Puppet::Configurer.should_pluginsync?
+            end
+          end
+        end
+
+        # this inits the device singleton, so that the facts terminus
+        # and the various network_device provider can use it
+        Puppet::Util::NetworkDevice.init(device)
+
+        if options[:resource]
+          type, name = parse_args(command_line.args)
+          Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+          resources = find_resources(type, name)
+          if options[:to_yaml]
+            data = resources.map do |resource|
+              resource.prune_parameters(:parameters_to_include => @extra_params).to_hiera_hash
+            end.inject(:merge!)
+            text = YAML.dump(type.downcase => data)
+          else
+            text = resources.map do |resource|
+              resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
+            end.join("\n")
+          end
+          (puts text)
+          0
+        elsif options[:facts]
+          Puppet.info _("retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+          remote_facts = Puppet::Node::Facts.indirection.find(name, :environment => env)
+          # Give a proper name to the facts
+          remote_facts.name = remote_facts.values['clientcert']
+          renderer = Puppet::Network::FormatHandler.format(:console)
+          puts renderer.render(remote_facts)
+          0
+        elsif options[:apply]
+          # avoid reporting to server
+          Puppet::Transaction::Report.indirection.terminus_class = :yaml
+          Puppet::Resource::Catalog.indirection.cache_class = nil
+
+          require_relative '../../puppet/application/apply'
+          begin
+            Puppet[:node_terminus] = :plain
+            Puppet[:catalog_terminus] = :compiler
+            Puppet[:catalog_cache_terminus] = nil
+            Puppet[:facts_terminus] = :network_device
+            Puppet.override(:network_device => true) do
+              Puppet::Application::Apply.new(Puppet::Util::CommandLine.new('puppet', ["apply", options[:apply]])).run_command
+            end
+          end
+        else
+          Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+
+          overrides = {}
+          overrides[:ssl_context] = ssl_context if ssl_context
+          Puppet.override(overrides) do
+            configurer = Puppet::Configurer.new
+            configurer.run(:network_device => true, :pluginsync => false)
+          end
+        end
+      rescue => detail
+        Puppet.log_exception(detail)
+        # If we rescued an error, then we return 1 as the exit code
+        1
+      ensure
+        Puppet[:libdir] = libdir
+        Puppet[:vardir] = vardir
+        Puppet[:confdir] = confdir
+        Puppet[:ssldir] = ssldir
+        Puppet[:certname] = certname
+      end
+    end
+
+    if !returns or returns.compact.empty?
+      exit(1)
+    elsif options[:detailed_exitcodes]
+      # Bitwise OR the return codes together, puppet style
+      exit(returns.compact.reduce(:|))
+    elsif returns.include? 1
+      exit(1)
+    else
+      exit(0)
+    end
+  end
+
+  def parse_args(args)
+    type = args.shift or raise _("You must specify the type to display")
+    Puppet::Type.type(type) or raise _("Could not find type %{type}") % { type: type }
+    name = args.shift
+
+    [type, name]
+  end
+
+  def find_resources(type, name)
+    key = [type, name].join('/')
+
+    if name
+      [Puppet::Resource.indirection.find(key)]
+    else
+      Puppet::Resource.indirection.search(key, {})
+    end
+  end
+
+  def setup_context
+    waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
+    sm = Puppet::SSL::StateMachine.new(waitforcert: waitforcert)
+    sm.ensure_client_certificate
+  end
+
+  def setup
+    setup_logs
+
+    Puppet::SSL::Oids.register_puppet_oids
+
+    # setup global device-specific defaults; creates all necessary directories, etc
+    Puppet.settings.use :main, :agent, :device, :ssl
+
+    if options[:apply] || options[:facts] || options[:resource]
+      Puppet::Util::Log.newdestination(:console)
+    else
+      args[:Server] = Puppet[:server]
+      if options[:centrallogs]
+        logdest = args[:Server]
+
+        logdest += ":" + args[:Port] if args.include?(:Port)
+        Puppet::Util::Log.newdestination(logdest)
+      end
+
+      Puppet::Transaction::Report.indirection.terminus_class = :rest
+
+      if Puppet[:catalog_cache_terminus]
+        Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus].intern
+      end
+    end
+  end
+end

data/lib/puppet/application/doc.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/application'
+
+class Puppet::Application::Doc < Puppet::Application
+  run_mode :server
+
+  attr_accessor :unknown_args, :manifest
+
+  def preinit
+    { :references => [], :mode => :text, :format => :to_markdown }.each do |name, value|
+      options[name] = value
+    end
+    @unknown_args = []
+    @manifest = false
+  end
+
+  option("--all", "-a")
+  option("--outputdir OUTPUTDIR", "-o")
+  option("--verbose", "-v")
+  option("--debug", "-d")
+  option("--charset CHARSET")
+
+  option("--format FORMAT", "-f") do |arg|
+    method = "to_#{arg}"
+    require_relative '../../puppet/util/reference'
+    if Puppet::Util::Reference.method_defined?(method)
+      options[:format] = method
+    else
+      raise _("Invalid output format %{arg}") % { arg: arg }
+    end
+  end
+
+  option("--mode MODE", "-m") do |arg|
+    require_relative '../../puppet/util/reference'
+    if Puppet::Util::Reference.modes.include?(arg) or arg.intern == :rdoc
+      options[:mode] = arg.intern
+    else
+      raise _("Invalid output mode %{arg}") % { arg: arg }
+    end
+  end
+
+  option("--list", "-l") do |_arg|
+    require_relative '../../puppet/util/reference'
+    refs = Puppet::Util::Reference.references(Puppet.lookup(:current_environment))
+    puts refs.collect { |r| Puppet::Util::Reference.reference(r).doc }.join("\n")
+    exit(0)
+  end
+
+  option("--reference REFERENCE", "-r") do |arg|
+    options[:references] << arg.intern
+  end
+
+  def summary
+    _("Generate Puppet references for OpenVox")
+  end
+
+  def help
+    <<~HELP
+
+      puppet-doc(8) -- #{summary}
+      ========
+
+      SYNOPSIS
+      --------
+      Generates a reference for all Puppet types. Largely meant for internal use. (Deprecated)
+
+
+      USAGE
+      -----
+      puppet doc [-h|--help] [-l|--list]
+        [-r|--reference <reference-name>]
+
+
+      DESCRIPTION
+      -----------
+      This deprecated command generates a Markdown document to stdout
+      describing all installed Puppet types or all allowable arguments to
+      puppet executables. It is largely meant for internal use and is used to
+      generate the reference documents which can be posted to a website.
+
+      For Puppet module documentation (and all other use cases) this command
+      has been superseded by the "puppet-strings"
+      module - see https://github.com/puppetlabs/puppetlabs-strings for more information.
+
+      This command (puppet-doc) will be removed once the
+      puppetlabs internal documentation processing pipeline is completely based
+      on puppet-strings.
+
+      OPTIONS
+      -------
+
+      * --help:
+        Print this help message
+
+      * --reference:
+        Build a particular reference. Get a list of references by running
+        'puppet doc --list'.
+
+
+      EXAMPLE
+      -------
+          $ puppet doc -r type > /tmp/type_reference.markdown
+
+
+      AUTHOR
+      ------
+      Luke Kanies
+
+
+      COPYRIGHT
+      ---------
+      Copyright (c) 2011 Puppet Inc.
+      Copyright (c) 2024 Vox Pupuli
+      Licensed under the Apache 2.0 License
+
+    HELP
+  end
+
+  def handle_unknown(opt, arg)
+    @unknown_args << { :opt => opt, :arg => arg }
+    true
+  end
+
+  def run_command
+    [:rdoc].include?(options[:mode]) ? send(options[:mode]) : other
+  end
+
+  def rdoc
+    exit_code = 0
+    files = []
+    unless @manifest
+      env = Puppet.lookup(:current_environment)
+      files += env.modulepath
+      files << ::File.dirname(env.manifest) if env.manifest != Puppet::Node::Environment::NO_MANIFEST
+    end
+    files += command_line.args
+    Puppet.info _("scanning: %{files}") % { files: files.inspect }
+
+    Puppet.settings[:document_all] = options[:all] || false
+    begin
+      require_relative '../../puppet/util/rdoc'
+      if @manifest
+        Puppet::Util::RDoc.manifestdoc(files)
+      else
+        options[:outputdir] = "doc" unless options[:outputdir]
+        Puppet::Util::RDoc.rdoc(options[:outputdir], files, options[:charset])
+      end
+    rescue => detail
+      Puppet.log_exception(detail, _("Could not generate documentation: %{detail}") % { detail: detail })
+      exit_code = 1
+    end
+    exit exit_code
+  end
+
+  def other
+    text = ''.dup
+    with_contents = options[:references].length <= 1
+    exit_code = 0
+    require_relative '../../puppet/util/reference'
+    options[:references].sort_by(&:to_s).each do |name|
+      section = Puppet::Util::Reference.reference(name)
+      raise _("Could not find reference %{name}") % { name: name } unless section
+
+      begin
+        # Add the per-section text, but with no ToC
+        text += section.send(options[:format], with_contents)
+      rescue => detail
+        Puppet.log_exception(detail, _("Could not generate reference %{name}: %{detail}") % { name: name, detail: detail })
+        exit_code = 1
+        next
+      end
+    end
+
+    text += Puppet::Util::Reference.footer unless with_contents # We've only got one reference
+
+    puts text
+
+    exit exit_code
+  end
+
+  def setup
+    # sole manifest documentation
+    if command_line.args.size > 0
+      options[:mode] = :rdoc
+      @manifest = true
+    end
+
+    if options[:mode] == :rdoc
+      setup_rdoc
+    else
+      setup_reference
+    end
+
+    setup_logging
+  end
+
+  def setup_reference
+    if options[:all]
+      # Don't add dynamic references to the "all" list.
+      require_relative '../../puppet/util/reference'
+      refs = Puppet::Util::Reference.references(Puppet.lookup(:current_environment))
+      options[:references] = refs.reject do |ref|
+        Puppet::Util::Reference.reference(ref).dynamic?
+      end
+    end
+
+    options[:references] << :type if options[:references].empty?
+  end
+
+  def setup_rdoc
+    # consume the unknown options
+    # and feed them as settings
+    if @unknown_args.size > 0
+      @unknown_args.each do |option|
+        # force absolute path for modulepath when passed on commandline
+        if option[:opt] == "--modulepath"
+          option[:arg] = option[:arg].split(::File::PATH_SEPARATOR).collect { |p| ::File.expand_path(p) }.join(::File::PATH_SEPARATOR)
+        end
+        Puppet.settings.handlearg(option[:opt], option[:arg])
+      end
+    end
+  end
+
+  def setup_logging
+    Puppet::Util::Log.level = :warning
+
+    set_log_level
+
+    Puppet::Util::Log.newdestination(:console)
+  end
+end

data/lib/puppet/application/epp.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/application/face_base'
+require_relative '../../puppet/face'
+
+class Puppet::Application::Epp < Puppet::Application::FaceBase
+end