openvox 8.28.0 → 8.29.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22a10676212dffb7385dd0b2a93b63e82b431be1721c626845e9b8c9aa3244a3
-  data.tar.gz: 8b11717749ebc30080d5868897d2af18734696ef84bf52f9e0390ecf5e381431
+  metadata.gz: 86d05e7a3a189241096c6be834d26a8674a70cadfac8c90acce427992d619ad2
+  data.tar.gz: 430fe316be1706073496df35c7c5316d6402366f51b1f8a099a248769fe02960
 SHA512:
-  metadata.gz: d83254af4656f5ba95cc0710ac577d80a53c6d8881c4905601d689eff159838dba3b59635c2db446cae49a5bf137453d055bd067d0c61541e00f6d5a73062d82
-  data.tar.gz: 77ee41bb27713bf2867d9b616580904347595e64a87b24f9d3ba0b3c1c2cc63198cba689b3b806e612db26df8f2cc0e833d6a16e169bf17f393204cf0743a77e
+  metadata.gz: 914e4b11f6727fd2ab33dcdd76cfa3ef69626ed2b8217be0176bf58fafd6e89504096947715a1345f4c657986313f04918c27a1c639d553f63e6f8cb24c4b0cf
+  data.tar.gz: ac56bb6bd94bc23edc49986eaa92e8db16376865ae60b6833f86ad5615cab95857b0d08fbce52895517821d77aa5e954f4cdffe702ba2979514c08688bd98d9f

data/CHANGELOG.md

@@ -2,6 +2,73 @@
 
 All notable changes to this project will be documented in this file.
 
+## [8.29.0](https://github.com/openvoxproject/openvox/tree/8.29.0) (2026-09-04)
+
+[Full Changelog](https://github.com/openvoxproject/openvox/compare/8.28.1...8.29.0)
+
+**Implemented enhancements:**
+
+- openfact: Allow 6.x [\#578](https://github.com/OpenVoxProject/openvox/pull/578) ([bastelfreak](https://github.com/bastelfreak))
+
+**Fixed bugs:**
+
+- \[Bug\]: Sometimes Error "This 'if' statement has no effect", sometimes not [\#542](https://github.com/OpenVoxProject/openvox/issues/542)
+- \[Bug\]: Centralized filebucket not working properly [\#367](https://github.com/OpenVoxProject/openvox/issues/367)
+- \[Bug\]: lines in file resource content looking like a checksum throws an error [\#169](https://github.com/OpenVoxProject/openvox/issues/169)
+- \[Backport 8.x\] Fix excessive reads of /proc/mounts [\#621](https://github.com/OpenVoxProject/openvox/pull/621) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Report errors when renewing a certificate fails [\#611](https://github.com/OpenVoxProject/openvox/pull/611) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] fix: Pacman provider uses unrecognized option '--update' [\#565](https://github.com/OpenVoxProject/openvox/pull/565) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+**Security fixes:**
+
+- Promote puppet-runtime 2026.09.02.1 into 8.x [\#629](https://github.com/OpenVoxProject/openvox/pull/629) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+**Closed issues:**
+
+- \[Deprecation\] Replace `puppet master` Terminology in User-Facing Docs/Help [\#347](https://github.com/OpenVoxProject/openvox/issues/347)
+- \[Deprecation\] Fine-Grained `filetimeout` Control [\#345](https://github.com/OpenVoxProject/openvox/issues/345)
+- \[Deprecation\] Data-Binding Settings [\#338](https://github.com/OpenVoxProject/openvox/issues/338)
+- \[Deprecation\] `file { content => <checksum> }` Filebucket Retrieval Behavior [\#335](https://github.com/OpenVoxProject/openvox/issues/335)
+- \[Deprecation\] `Puppet::Indirector::Hiera` Terminus [\#332](https://github.com/OpenVoxProject/openvox/issues/332)
+
+**Merged pull requests:**
+
+- \[Backport 8.x\] puppet generate: print module directory when types are missing [\#618](https://github.com/OpenVoxProject/openvox/pull/618) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Fix a small typo in the markdown docs \(redux\) [\#606](https://github.com/OpenVoxProject/openvox/pull/606) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Remove unloadable CC-BY-1.0 RDoc template and generator [\#588](https://github.com/OpenVoxProject/openvox/pull/588) ([silug](https://github.com/silug))
+- \[Backport 8.x\] Set `PUPPET_EXTRA_OPTS` variable to empty [\#561](https://github.com/OpenVoxProject/openvox/pull/561) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+## [8.28.1](https://github.com/openvoxproject/openvox/tree/8.28.1) (2026-07-07)
+
+[Full Changelog](https://github.com/openvoxproject/openvox/compare/8.28.0...8.28.1)
+
+**Fixed bugs:**
+
+- \[Bug\]: ca\_refresh\_interval is not respected — agent refreshes CA on every run when server responds 304 [\#435](https://github.com/OpenVoxProject/openvox/issues/435)
+- \[Bug\]: Puppet 8 introduced a regex node definition regression [\#14](https://github.com/OpenVoxProject/openvox/issues/14)
+- \[Backport 8.x\] Update ca\_last\_update/crl\_last\_update on HTTP 304 [\#526](https://github.com/OpenVoxProject/openvox/pull/526) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Copy input mtime to files generated by puppet generate types [\#523](https://github.com/OpenVoxProject/openvox/pull/523) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Fix regex node lookup regression from PUP-11515 [\#515](https://github.com/OpenVoxProject/openvox/pull/515) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Tolerate concurrent creation of directories [\#507](https://github.com/OpenVoxProject/openvox/pull/507) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+**Closed issues:**
+
+- \[Deprecation\] `Puppet::SSL::Certificate` Class [\#344](https://github.com/OpenVoxProject/openvox/issues/344)
+- \[Deprecation\] PAL Script Evaluation APIs [\#343](https://github.com/OpenVoxProject/openvox/issues/343)
+- \[Deprecation\] `source_permissions` File Parameter [\#340](https://github.com/OpenVoxProject/openvox/issues/340)
+- \[Deprecation\] `pluginsync` Setting [\#339](https://github.com/OpenVoxProject/openvox/issues/339)
+- \[Deprecation\] `configprint` Setting [\#337](https://github.com/OpenVoxProject/openvox/issues/337)
+- \[Deprecation\] `regsubst()` Encoding Argument [\#336](https://github.com/OpenVoxProject/openvox/issues/336)
+
+**Merged pull requests:**
+
+- Promote puppet-resource\_api 1.9.2 into 8.x [\#527](https://github.com/OpenVoxProject/openvox/pull/527) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Promote puppet-resource\_api 1.9.1 into 8.x [\#518](https://github.com/OpenVoxProject/openvox/pull/518) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Fix handling of Puppet::Pops serialization issues [\#514](https://github.com/OpenVoxProject/openvox/pull/514) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Promote puppet-runtime 2026.06.24.1 into 8.x [\#501](https://github.com/OpenVoxProject/openvox/pull/501) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Add arm64 support to acceptance 8.x [\#499](https://github.com/OpenVoxProject/openvox/pull/499) ([jpartlow](https://github.com/jpartlow))
+- Add jruby 9.4.15 to CI [\#487](https://github.com/OpenVoxProject/openvox/pull/487) ([bastelfreak](https://github.com/bastelfreak))
+
 ## [8.28.0](https://github.com/openvoxproject/openvox/tree/8.28.0) (2026-06-10)
 
 [Full Changelog](https://github.com/openvoxproject/openvox/compare/8.27.0...8.28.0)

data/Gemfile

@@ -16,7 +16,7 @@ end
 # the runtime_dependencies in openvox.gemspec match the runtime dependencies here
 # (like openfact, semantic_puppet, and puppet-resource_api)
 
-gem "openfact", *location_for(ENV['OPENFACT_LOCATION'] || ["~> 5.0"])
+gem "openfact", *location_for(ENV['OPENFACT_LOCATION'] || [">= 5.0", "< 7"])
 gem "semantic_puppet", *location_for(ENV['SEMANTIC_PUPPET_LOCATION'] || ["~> 1.0"])
 gem "puppet-resource_api", *location_for(ENV['RESOURCE_API_LOCATION'] || ["~> 2.0"])
 # Need to update the openssl gem on MacOS to avoid SSL errors.
@@ -45,11 +45,11 @@ end
 group(:test) do
   # 1.16.0 - 1.16.2 are broken on Windows
   gem 'ffi', '>= 1.15.5', '< 2', '!= 1.16.0', '!= 1.16.1', '!= 1.16.2', require: false
-  gem "json-schema", '>= 2', '< 6', require: false
+  gem "json-schema", '>= 2', '< 7', require: false
   gem "rake", *location_for(ENV['RAKE_LOCATION'] || '~> 13.0')
   gem "rspec", "~> 3.1", require: false
   gem "rspec-expectations", ["~> 3.9", "!= 3.9.3"]
-  gem "rspec-its", "~> 1.1", require: false
+  gem "rspec-its", "~> 2.0", require: false
   gem 'rspec-mocks', '< 3.13.3', require: false # breaking change afterwards: https://github.com/rspec/rspec-mocks/pull/1596
   gem 'vcr', '~> 6.1', require: false
   gem 'webmock', '~> 3.0', require: false

data/ext/redhat/client.sysconfig

@@ -1,2 +1,3 @@
 # You may specify parameters to the puppet client here
 #PUPPET_EXTRA_OPTS=--waitforcert=500
+PUPPET_EXTRA_OPTS=

data/lib/puppet/application/ssl.rb

@@ -304,13 +304,14 @@ class Puppet::Application::Ssl < Puppet::Application
     @cert_provider.delete_request(certname)
     cert
   rescue Puppet::HTTP::ResponseError => e
-    if e.response.code == 404
-      nil
-    else
-      raise Puppet::Error.new(_("Failed to download certificate: %{message}") % { message: e.message }, e)
-    end
+    body = e.response.body.to_s.strip
+    raise Puppet::Error.new(_("Failed to renew certificate: %{code} %{reason}%{body}") % {
+      code: e.response.code,
+      reason: e.response.reason,
+      body: body.empty? ? '' : ": #{body}"
+    }, e)
   rescue => e
-    raise Puppet::Error.new(_("Failed to download certificate: %{message}") % { message: e.message }, e)
+    raise Puppet::Error.new(_("Failed to renew certificate: %{message}") % { message: e.message }, e)
   end
 
   def verify(certname)

data/lib/puppet/functions/tree_each.rb

@@ -30,7 +30,7 @@
 # `tree_each($data) |$value| { <PUPPET CODE BLOCK> }`
 #
 # The parameter `$path` is always given as an `Array` containing the path that when applied to
-# the tree as `$data.dig(*$path) yields the `$value`.
+# the tree as `$data.dig(*$path)` yields the `$value`.
 # The `$value` is the value at that path.
 #
 # For `Array` values, the path will contain `Integer` entries with the array index,

data/lib/puppet/generate/type.rb

@@ -45,11 +45,14 @@ module Puppet
         end
 
         # Determines if the output file is up-to-date with respect to the input file.
+        # Generated files are stamped with their input's mtime, so the output is
+        # up-to-date only on an exact match; an input with older timestamps (e.g.
+        # a module downgrade) also triggers regeneration.
         # @param [String, nil] The path to output to, or nil if determined by input
         # @return [Boolean] Returns true if the output is up-to-date or false if not.
         def up_to_date?(outputdir)
           f = effective_output_path(outputdir)
-          Puppet::FileSystem.exist?(f) && (Puppet::FileSystem.stat(@path) <=> Puppet::FileSystem.stat(f)) <= 0
+          Puppet::FileSystem.exist?(f) && (Puppet::FileSystem.stat(@path) <=> Puppet::FileSystem.stat(f)) == 0
         end
 
         # Gets the filename of the output file.
@@ -121,7 +124,7 @@ module Puppet
         environment.modules.each do |mod|
           directory = File.join(Puppet::Util::Autoload.cleanpath(mod.plugin_directory), 'puppet', 'type')
           unless Puppet::FileSystem.exist?(directory)
-            Puppet.debug "Skipping '#{mod.name}' module because it contains no custom types."
+            Puppet.debug "Skipping '#{mod.name}' module because there is no readable puppet/type/ directory under: #{directory}"
             next
           end
 
@@ -240,6 +243,7 @@ module Puppet
             Puppet::FileSystem.open(effective_output_path, nil, 'w:UTF-8') do |file|
               file.write(result)
             end
+            Puppet::FileSystem.touch(effective_output_path, mtime: Puppet::FileSystem.stat(input.path).mtime)
           rescue Exception => e
             @bad_input = true
             Puppet.log_exception(e, _("Failed to generate '%{effective_output_path}': %{message}") % { effective_output_path: effective_output_path, message: e.message })

data/lib/puppet/pops/serialization/to_data_converter.rb

@@ -305,7 +305,7 @@ module Serialization
         if tos.empty?
           semantic = Puppet::Pops::SemanticError.new(issue, nil, EMPTY_HASH)
         else
-          file, line = stacktrace
+          file, line = Puppet::Pops::PuppetStack.stacktrace
           semantic = Puppet::Pops::SemanticError.new(issue, nil, { :file => file, :line => line })
         end
       end

data/lib/puppet/provider/package/pacman.rb

@@ -248,7 +248,7 @@ Puppet::Type.type(:package).provide :pacman, :parent => Puppet::Provider::Packag
              else
                fail _("Source %{source} is not supported by pacman") % { source: source }
              end
-    pacman "--noconfirm", "--noprogressbar", "--update", source
+    pacman "--noconfirm", "--noprogressbar", "--upgrade", source
   end
 
   def install_from_repo

data/lib/puppet/resource/type.rb

@@ -34,13 +34,13 @@ class Puppet::Resource::Type
   EMPTY_ARRAY = [].freeze
 
   LOOKAROUND_OPERATORS = {
-    "(" => 'LP',
-    "?" => "QU",
-    "<" => "LT",
-    ">" => "GT",
-    "!" => "EX",
-    "=" => "EQ",
-    ")" => 'RP'
+    "(" => 'lp',
+    "?" => "qu",
+    "<" => "lt",
+    ">" => "gt",
+    "!" => "ex",
+    "=" => "eq",
+    ")" => 'rp'
   }.freeze
 
   attr_accessor :file, :line, :doc, :code, :parent, :resource_type_collection, :override
@@ -206,7 +206,7 @@ class Puppet::Resource::Type
 
   def name
     if type == :node && name_is_regex?
-      # Normalize lookarround regex patthern
+      # Normalize lookaround regex pattern to a unique, lookup-safe lowercase string.
       internal_name = @name.source.downcase.gsub(/\(\?[^)]*\)/) do |str|
         str.gsub(/./) { |ch| LOOKAROUND_OPERATORS[ch] || ch }
       end

data/lib/puppet/ssl/state_machine.rb

@@ -121,6 +121,10 @@ class Puppet::SSL::StateMachine
     rescue Puppet::HTTP::ResponseError => e
       if e.response.code == 304
         Puppet.info(_("CA certificate is unmodified, using existing CA certificate"))
+        # 304 confirms the local CA is current, so reset the TTL.
+        # Otherwise ca_last_update (backed by ca.pem mtime) never advances
+        # past the initial download and needs_refresh? triggers on every run.
+        @cert_provider.ca_last_update = Time.now
       else
         Puppet.info(_("Failed to refresh CA certificate, using existing CA certificate: %{message}") % { message: e.message })
       end
@@ -219,6 +223,8 @@ class Puppet::SSL::StateMachine
     rescue Puppet::HTTP::ResponseError => e
       if e.response.code == 304
         Puppet.info(_("CRL is unmodified, using existing CRL"))
+        # 304 confirms the local CRL is current, so reset the TTL.
+        @cert_provider.crl_last_update = Time.now
       else
         Puppet.info(_("Failed to refresh CRL, using existing CRL: %{message}") % { message: e.message })
       end

data/lib/puppet/type/file/ensure.rb

@@ -86,12 +86,21 @@ module Puppet
         raise Puppet::Error,
               "Cannot create #{@resource[:path]}; parent directory #{parent} does not exist"
       end
-      if mode
-        Puppet::Util.withumask(0o00) do
-          Dir.mkdir(@resource[:path], symbolic_mode_to_int(mode, 0o755, true))
+      begin
+        if mode
+          Puppet::Util.withumask(0o00) do
+            Dir.mkdir(@resource[:path], symbolic_mode_to_int(mode, 0o755, true))
+          end
+        else
+          Dir.mkdir(@resource[:path])
         end
-      else
-        Dir.mkdir(@resource[:path])
+      rescue Errno::EEXIST
+        # Another process may have created the directory concurrently. If it
+        # really is a directory now, treat that as success.
+        #
+        # Directory mode, and other properties, will be checked and enforced by
+        # the call to `property_fix`.
+        raise unless Puppet::FileSystem.directory?(@resource[:path])
       end
       @resource.send(:property_fix)
       return :directory_created

data/lib/puppet/util/rdoc.rb

@@ -16,9 +16,12 @@ module Puppet::Util::RDoc
 
     r = RDoc::RDoc.new
 
-    # specify our own format & where to output
-    options = ["--fmt", "puppet",
-               "--quiet",
+    # Documentation is rendered by RDoc's default generator using our custom
+    # parser. The historical custom "puppet" generator and its HTML template
+    # targeted RDoc 1.x and could not be loaded under any supported RDoc; the
+    # template also carried a CC-BY-1.0 license, which is incompatible with
+    # the Debian Free Software Guidelines. Both were removed.
+    options = ["--quiet",
                "--exclude", "/modules/[^/]*/spec/.*$",
                "--exclude", "/modules/[^/]*/files/.*$",
                "--exclude", "/modules/[^/]*/tests/.*$",

data/lib/puppet/util/selinux.rb

@@ -18,6 +18,9 @@ module Puppet::Util::SELinux
   S_IFDIR = 0o040000
   S_IFLNK = 0o120000
 
+  @@mounts_cache = nil
+  @@mounts_mtime = nil
+
   def self.selinux_support?
     return false unless defined?(Selinux)
     if Selinux.is_selinux_enabled == 1
@@ -259,6 +262,16 @@ module Puppet::Util::SELinux
 
   # Internal helper function to read and parse /proc/mounts
   def read_mounts
+    current_mtime = begin
+      File.mtime('/proc/mounts')
+    rescue Errno::ENOENT, Errno::ENOTDIR
+      nil
+    end
+
+    if @@mounts_cache && current_mtime && @@mounts_mtime == current_mtime
+      return @@mounts_cache
+    end
+
     mounts = ''.dup
     begin
       if File.method_defined? "read_nonblock"
@@ -292,7 +305,9 @@ module Puppet::Util::SELinux
 
       mntpoint[params[1]] = params[2]
     end
-    mntpoint
+
+    @@mounts_mtime = current_mtime
+    @@mounts_cache = mntpoint
   end
 
   # Internal helper function to return which type of filesystem a given file

data/lib/puppet/version.rb

@@ -8,7 +8,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '8.28.0'
+  PUPPETVERSION = '8.29.0'
   IMPLEMENTATION = 'openvox'
 
   ##

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openvox
 version: !ruby/object:Gem::Version
-  version: 8.28.0
+  version: 8.29.0
 platform: ruby
 authors:
 - OpenVox Project
@@ -143,16 +143,22 @@ dependencies:
   name: openfact
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '7'
 - !ruby/object:Gem::Dependency
   name: ostruct
   requirement: !ruby/object:Gem::Requirement
@@ -1257,8 +1263,6 @@ files:
 - lib/puppet/util/psych_support.rb
 - lib/puppet/util/rdoc.rb
 - lib/puppet/util/rdoc/code_objects.rb
-- lib/puppet/util/rdoc/generators/puppet_generator.rb
-- lib/puppet/util/rdoc/generators/template/puppet/puppet.rb
 - lib/puppet/util/rdoc/parser.rb
 - lib/puppet/util/rdoc/parser/puppet_parser_core.rb
 - lib/puppet/util/rdoc/parser/puppet_parser_rdoc2.rb
@@ -1366,7 +1370,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.1
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: OpenVox, a community implementation of Puppet -- an automated configuration
   management tool