openvox 8.28.1 → 8.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2237abcdd8a5a1ebb597961b356db775eb64b74e6735e0d3014a3b221bdf49e1
-  data.tar.gz: 8a5f0e31309441c4883df565b8c65e0cecc239465b523d6d3ba97c78d95a808d
+  metadata.gz: bcf52c4710584e363c52de7ad3edcf6ee510cfc3117fa3bf87aa1e082f33ca56
+  data.tar.gz: 1a2c01a5f3fe5fc187acc86b98638e44ae9840ff8d7f546f2c8ebf3d31739043
 SHA512:
-  metadata.gz: ff8595b526d3cb54553745f7932e5b67205f277335f596642625296fc6aecc8c0e26b06385bc2c7ad16d404cf7af0929ef885fadf0892efed3a0662df05a05cf
-  data.tar.gz: b56a9c03db302d36b87ba431d5a4326f77c07626fcc891d6f72a953751def305e84573d55321356d12a80620b277ed061e6873815ff1d016fa4aeb98042efde7
+  metadata.gz: 34a0255bb2676b55da6ea8a5059074f25b578f2f70d8ed0cbf008e4ab0e30b8826a69a83688c6a8eea52c764b598edb731019eac55cb36b95f42422a40dcd9d7
+  data.tar.gz: 6d7d4d889feb3b7495f2674c8cf1a232e03c6b7b49fde5cde13ab84062378d24069c087b0f1049a405e4551ae6999642c574ea1b55a137262ffe94fdc931bc04

data/CHANGELOG.md

@@ -2,7 +2,69 @@
 
 All notable changes to this project will be documented in this file.
 
-## [8.28.1](https://github.com/openvoxproject/openvox/tree/8.28.1) (2026-07-06)
+## [8.30.0](https://github.com/openvoxproject/openvox/tree/8.30.0) (2026-10-07)
+
+[Full Changelog](https://github.com/openvoxproject/openvox/compare/8.29.0...8.30.0)
+
+**Fixed bugs:**
+
+- \[Bug\]: use of "server\_list" \(instead of server\) throws an error [\#658](https://github.com/OpenVoxProject/openvox/issues/658)
+- \[Bug\]: Ruby crashes on child side of fork pre-exec macOS 26 \(Tahoe\) [\#538](https://github.com/OpenVoxProject/openvox/issues/538)
+- \[Backport 8.x\] Pin json below 3 to unblock CI [\#676](https://github.com/OpenVoxProject/openvox/pull/676) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[backport 8.x\] fix: `Deferred` resolution of Puppet-language functions \(e.g. mocks in tests\) failing due to lack of `:global_scope` [\#671](https://github.com/OpenVoxProject/openvox/pull/671) ([griggi-ws](https://github.com/griggi-ws))
+- \[Backport 8.x\] print "Loading facts" just once [\#663](https://github.com/OpenVoxProject/openvox/pull/663) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+**Closed issues:**
+
+- json 3.0.0 breaks Puppet::Util::Json and the test suite [\#654](https://github.com/OpenVoxProject/openvox/issues/654)
+
+**Merged pull requests:**
+
+- \[Backport 8.x\] Skip the tests that need jruby-openssl in FIPS mode [\#714](https://github.com/OpenVoxProject/openvox/pull/714) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Promote openfact 5.7.2 into 8.x [\#711](https://github.com/OpenVoxProject/openvox/pull/711) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Promote puppet-runtime 2026.09.29.1 into 8.x [\#704](https://github.com/OpenVoxProject/openvox/pull/704) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Kill the forked agent run if it outlives runtimeout [\#698](https://github.com/OpenVoxProject/openvox/pull/698) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Wait for certificates in the forked child, not in the daemon [\#697](https://github.com/OpenVoxProject/openvox/pull/697) ([nmburgan](https://github.com/nmburgan))
+- openfact: Update 5.7.0 -\> 5.7.1 [\#678](https://github.com/OpenVoxProject/openvox/pull/678) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Proper markdown for alias reference documentation. [\#650](https://github.com/OpenVoxProject/openvox/pull/650) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+## [8.29.0](https://github.com/openvoxproject/openvox/tree/8.29.0) (2026-09-04)
+
+[Full Changelog](https://github.com/openvoxproject/openvox/compare/8.28.1...8.29.0)
+
+**Implemented enhancements:**
+
+- openfact: Allow 6.x [\#578](https://github.com/OpenVoxProject/openvox/pull/578) ([bastelfreak](https://github.com/bastelfreak))
+
+**Fixed bugs:**
+
+- \[Bug\]: Sometimes Error "This 'if' statement has no effect", sometimes not [\#542](https://github.com/OpenVoxProject/openvox/issues/542)
+- \[Bug\]: Centralized filebucket not working properly [\#367](https://github.com/OpenVoxProject/openvox/issues/367)
+- \[Bug\]: lines in file resource content looking like a checksum throws an error [\#169](https://github.com/OpenVoxProject/openvox/issues/169)
+- \[Backport 8.x\] Fix excessive reads of /proc/mounts [\#621](https://github.com/OpenVoxProject/openvox/pull/621) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Report errors when renewing a certificate fails [\#611](https://github.com/OpenVoxProject/openvox/pull/611) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] fix: Pacman provider uses unrecognized option '--update' [\#565](https://github.com/OpenVoxProject/openvox/pull/565) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+**Security fixes:**
+
+- Promote puppet-runtime 2026.09.02.1 into 8.x [\#629](https://github.com/OpenVoxProject/openvox/pull/629) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+**Closed issues:**
+
+- \[Deprecation\] Replace `puppet master` Terminology in User-Facing Docs/Help [\#347](https://github.com/OpenVoxProject/openvox/issues/347)
+- \[Deprecation\] Fine-Grained `filetimeout` Control [\#345](https://github.com/OpenVoxProject/openvox/issues/345)
+- \[Deprecation\] Data-Binding Settings [\#338](https://github.com/OpenVoxProject/openvox/issues/338)
+- \[Deprecation\] `file { content => <checksum> }` Filebucket Retrieval Behavior [\#335](https://github.com/OpenVoxProject/openvox/issues/335)
+- \[Deprecation\] `Puppet::Indirector::Hiera` Terminus [\#332](https://github.com/OpenVoxProject/openvox/issues/332)
+
+**Merged pull requests:**
+
+- \[Backport 8.x\] puppet generate: print module directory when types are missing [\#618](https://github.com/OpenVoxProject/openvox/pull/618) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Fix a small typo in the markdown docs \(redux\) [\#606](https://github.com/OpenVoxProject/openvox/pull/606) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Remove unloadable CC-BY-1.0 RDoc template and generator [\#588](https://github.com/OpenVoxProject/openvox/pull/588) ([silug](https://github.com/silug))
+- \[Backport 8.x\] Set `PUPPET_EXTRA_OPTS` variable to empty [\#561](https://github.com/OpenVoxProject/openvox/pull/561) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+## [8.28.1](https://github.com/openvoxproject/openvox/tree/8.28.1) (2026-07-07)
 
 [Full Changelog](https://github.com/openvoxproject/openvox/compare/8.28.0...8.28.1)
 

data/Gemfile

@@ -16,7 +16,7 @@ end
 # the runtime_dependencies in openvox.gemspec match the runtime dependencies here
 # (like openfact, semantic_puppet, and puppet-resource_api)
 
-gem "openfact", *location_for(ENV['OPENFACT_LOCATION'] || ["~> 5.0"])
+gem "openfact", *location_for(ENV['OPENFACT_LOCATION'] || [">= 5.0", "< 7"])
 gem "semantic_puppet", *location_for(ENV['SEMANTIC_PUPPET_LOCATION'] || ["~> 1.0"])
 gem "puppet-resource_api", *location_for(ENV['RESOURCE_API_LOCATION'] || ["~> 2.0"])
 # Need to update the openssl gem on MacOS to avoid SSL errors.
@@ -77,7 +77,7 @@ group(:packaging) do
     gem 'vanagon', *location_for(ENV['VANAGON_LOCATION'] || 'https://github.com/openvoxproject/vanagon#main')
   end
   gem 'artifactory'
-  gem 'json'
+  gem 'json', '< 3'
   gem 'octokit'
 end
 

data/Rakefile

@@ -159,7 +159,7 @@ begin
     HEADER
     config.user = "openvoxproject"
     config.project = "openvox"
-    config.exclude_labels = %w[dependencies duplicate question invalid wontfix wont-fix modulesync skip-changelog]
+    config.exclude_labels = %w[dependencies duplicate question invalid wontfix wont-fix modulesync skip-changelog skip-8.x-changelog]
     config.since_tag = "8.18.1"
     config.future_release = Puppet::PUPPETVERSION
     config.exclude_tags_regex = /\A[7,9]\./

data/ext/redhat/client.sysconfig

@@ -1,2 +1,3 @@
 # You may specify parameters to the puppet client here
 #PUPPET_EXTRA_OPTS=--waitforcert=500
+PUPPET_EXTRA_OPTS=

data/lib/puppet/agent.rb

@@ -22,6 +22,12 @@ class Puppet::Agent
   class RunTimeoutError < Exception # rubocop:disable Lint/InheritException
   end
 
+  # Exit status the forked child uses to tell the daemon that the SSL state
+  # machine gave up waiting for a certificate, so the daemon can exit as it
+  # did when the wait happened in the parent. Must not collide with the
+  # detailed exit codes returned by a run (0, 1, 2, 4, 6) or with 254 (NoMemoryError).
+  CERTIFICATE_FAILURE_EXIT_STATUS = 253
+
   attr_reader :client_class, :client, :should_fork
 
   def initialize(client_class, should_fork = true)
@@ -60,12 +66,28 @@ class Puppet::Agent
         end
       end
 
-      # waiting for certs may sleep for awhile depending on onetime, waitforcert and maxwaitforcert!
-      # this needs to happen before forking so that if we fail to obtain certs and try to exit, then
-      # we exit the main process and not the forked child.
-      ssl_context = wait_for_certificates(client_options)
-
       result = run_in_fork(should_fork) do
+        # waiting for certs may sleep for awhile depending on onetime, waitforcert and maxwaitforcert!
+        #
+        # This happens in the forked child, not in the long-lived daemon. Refreshing
+        # the CRL or renewing the certificate resolves the server's name, and on
+        # Ruby 3.3+ that runs in short-lived native threads. If the daemon forks
+        # while one of those threads is exiting, the child inherits glibc's
+        # resolv.conf lock in the locked state and every name lookup in the run
+        # hangs (#485). Keeping the lookups out of the parent avoids that.
+        #
+        # The state machine calls exit when it gives up waiting for a certificate
+        # (waitforcert 0 or maxwaitforcert exceeded). Report that back so the
+        # daemon exits, as it did when the wait happened in the parent.
+        begin
+          ssl_context = wait_for_certificates(client_options)
+        rescue SystemExit
+          next CERTIFICATE_FAILURE_EXIT_STATUS
+        rescue StandardError => detail
+          Puppet.log_exception(detail, _("Could not obtain certificates: %{detail}") % { detail: detail })
+          next nil
+        end
+
         with_client(client_options[:transaction_uuid], client_options[:job_id]) do |client|
           client_args = client_options.merge(:pluginsync => Puppet::Configurer.should_pluginsync?)
           begin
@@ -115,6 +137,9 @@ class Puppet::Agent
           end
         end
       end
+      # The child could not obtain a certificate and the state machine asked to exit.
+      exit(1) if result == CERTIFICATE_FAILURE_EXIT_STATUS
+
       true
     end
     Puppet.notice _("Shutdown/restart in progress (%{status}); skipping run") % { status: Puppet::Application.run_status.inspect } unless block_run
@@ -146,8 +171,55 @@ class Puppet::Agent
       atForkHandler.parent
     end
 
-    exit_code = Process.waitpid2(child_pid)
-    exit_code[1].exitstatus
+    _, status = wait_for_child(child_pid)
+    status.exitstatus
+  end
+
+  # Wait for the forked child to exit. The child enforces `runtimeout` on its
+  # own run, but it may fail to exit afterwards (a stranded thread, a hung
+  # subprocess, etc.). Without a deadline here, the parent blocks forever and
+  # the agent stops checking in. Once the run timeout plus a grace period has
+  # elapsed, the child is killed so the daemon can carry on.
+  def wait_for_child(child_pid)
+    deadline = child_deadline
+    return Process.waitpid2(child_pid) unless deadline
+
+    loop do
+      result = Process.waitpid2(child_pid, Process::WNOHANG)
+      return result if result
+
+      if monotonic_now >= deadline
+        Puppet.err _("Agent run (pid %{pid}) did not exit within %{timeout} seconds of the run timeout, killing it") %
+                   { pid: child_pid, timeout: child_grace_period }
+        begin
+          Process.kill(:KILL, child_pid)
+        rescue Errno::ESRCH
+          # The child exited between the last check and the kill.
+        end
+        return Process.waitpid2(child_pid)
+      end
+
+      sleep 1
+    end
+  end
+
+  # After the run timeout fires inside the child, it may still need to send
+  # its report, which is bounded by the HTTP connect and read timeouts.
+  def child_grace_period
+    Puppet[:http_connect_timeout] + Puppet[:http_read_timeout]
+  end
+
+  # Returns the absolute monotonic deadline for the child, or nil when
+  # `runtimeout` is disabled.
+  def child_deadline
+    runtimeout = Puppet[:runtimeout]
+    return nil if runtimeout.nil? || runtimeout <= 0
+
+    monotonic_now + runtimeout + child_grace_period
+  end
+
+  def monotonic_now
+    Process.clock_gettime(Process::CLOCK_MONOTONIC)
   end
 
   private

data/lib/puppet/application/ssl.rb

@@ -304,13 +304,14 @@ class Puppet::Application::Ssl < Puppet::Application
     @cert_provider.delete_request(certname)
     cert
   rescue Puppet::HTTP::ResponseError => e
-    if e.response.code == 404
-      nil
-    else
-      raise Puppet::Error.new(_("Failed to download certificate: %{message}") % { message: e.message }, e)
-    end
+    body = e.response.body.to_s.strip
+    raise Puppet::Error.new(_("Failed to renew certificate: %{code} %{reason}%{body}") % {
+      code: e.response.code,
+      reason: e.response.reason,
+      body: body.empty? ? '' : ": #{body}"
+    }, e)
   rescue => e
-    raise Puppet::Error.new(_("Failed to download certificate: %{message}") % { message: e.message }, e)
+    raise Puppet::Error.new(_("Failed to renew certificate: %{message}") % { message: e.message }, e)
   end
 
   def verify(certname)

data/lib/puppet/functions/tree_each.rb

@@ -30,7 +30,7 @@
 # `tree_each($data) |$value| { <PUPPET CODE BLOCK> }`
 #
 # The parameter `$path` is always given as an `Array` containing the path that when applied to
-# the tree as `$data.dig(*$path) yields the `$value`.
+# the tree as `$data.dig(*$path)` yields the `$value`.
 # The `$value` is the value at that path.
 #
 # For `Array` values, the path will contain `Integer` entries with the array index,

data/lib/puppet/generate/type.rb

@@ -124,7 +124,7 @@ module Puppet
         environment.modules.each do |mod|
           directory = File.join(Puppet::Util::Autoload.cleanpath(mod.plugin_directory), 'puppet', 'type')
           unless Puppet::FileSystem.exist?(directory)
-            Puppet.debug "Skipping '#{mod.name}' module because it contains no custom types."
+            Puppet.debug "Skipping '#{mod.name}' module because there is no readable puppet/type/ directory under: #{directory}"
             next
           end
 

data/lib/puppet/indirector/facts/facter.rb

@@ -62,21 +62,22 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
       end
     end.flatten + Puppet[:factpath].split(File::PATH_SEPARATOR)
 
-    dirs = dirs.select do |dir|
-      next false unless FileTest.directory?(dir)
-
-      # Even through we no longer directly load facts in the terminus,
-      # print out each .rb in the facts directory as module
-      # developers may find that information useful for debugging purposes
-      if Puppet::Util::Log.sendlevel?(:info)
-        Puppet.info _("Loading facts")
-        Dir.glob("#{dir}/*.rb").each do |file|
-          Puppet.debug { "Loading facts from #{file}" }
+    dirs.select! { |dir| FileTest.directory?(dir) }
+
+    # Even though we no longer directly load facts in the terminus,
+    # print out each .rb in the facts directory as module
+    # developers may find that information useful for debugging purposes
+    unless dirs.empty?
+      Puppet.info _("Loading facts")
+      if Puppet::Util::Log.sendlevel?(:debug)
+        dirs.each do |dir|
+          Dir.glob("#{dir}/*.rb").each do |file|
+            Puppet.debug { "Loading facts from #{file}" }
+          end
         end
       end
-
-      true
     end
+
     dirs << request.options[:custom_dir] if request.options[:custom_dir]
     Puppet.runtime[:facter].search(*dirs)
   end

data/lib/puppet/pops/evaluator/deferred_resolver.rb

@@ -48,7 +48,10 @@ class DeferredResolver
     #    # Server facts are always about the local node's version etc.
     #    @scope.set_server_facts(node.server_facts)
 
-    resolver.resolve_futures(catalog)
+    # Must be wrapped in with_context_overrides to ensure global_scope is valid for Puppet-language functions
+    compiler.with_context_overrides do
+      resolver.resolve_futures(catalog)
+    end
     nil
   end
 

data/lib/puppet/provider/package/pacman.rb

@@ -248,7 +248,7 @@ Puppet::Type.type(:package).provide :pacman, :parent => Puppet::Provider::Packag
              else
                fail _("Source %{source} is not supported by pacman") % { source: source }
              end
-    pacman "--noconfirm", "--noprogressbar", "--update", source
+    pacman "--noconfirm", "--noprogressbar", "--upgrade", source
   end
 
   def install_from_repo

data/lib/puppet/reference/metaparameter.rb

@@ -14,7 +14,7 @@ etc.), prevent Puppet from making changes (`noop`), and change logging verbosity
 
 ## Available Metaparameters
 
-  }.dup
+  }.dup.strip + "\n"
   begin
     params = []
     Puppet::Type.eachmetaparam { |param|

data/lib/puppet/util/rdoc.rb

@@ -16,9 +16,12 @@ module Puppet::Util::RDoc
 
     r = RDoc::RDoc.new
 
-    # specify our own format & where to output
-    options = ["--fmt", "puppet",
-               "--quiet",
+    # Documentation is rendered by RDoc's default generator using our custom
+    # parser. The historical custom "puppet" generator and its HTML template
+    # targeted RDoc 1.x and could not be loaded under any supported RDoc; the
+    # template also carried a CC-BY-1.0 license, which is incompatible with
+    # the Debian Free Software Guidelines. Both were removed.
+    options = ["--quiet",
                "--exclude", "/modules/[^/]*/spec/.*$",
                "--exclude", "/modules/[^/]*/files/.*$",
                "--exclude", "/modules/[^/]*/tests/.*$",

data/lib/puppet/util/selinux.rb

@@ -18,6 +18,9 @@ module Puppet::Util::SELinux
   S_IFDIR = 0o040000
   S_IFLNK = 0o120000
 
+  @@mounts_cache = nil
+  @@mounts_mtime = nil
+
   def self.selinux_support?
     return false unless defined?(Selinux)
     if Selinux.is_selinux_enabled == 1
@@ -259,6 +262,16 @@ module Puppet::Util::SELinux
 
   # Internal helper function to read and parse /proc/mounts
   def read_mounts
+    current_mtime = begin
+      File.mtime('/proc/mounts')
+    rescue Errno::ENOENT, Errno::ENOTDIR
+      nil
+    end
+
+    if @@mounts_cache && current_mtime && @@mounts_mtime == current_mtime
+      return @@mounts_cache
+    end
+
     mounts = ''.dup
     begin
       if File.method_defined? "read_nonblock"
@@ -292,7 +305,9 @@ module Puppet::Util::SELinux
 
       mntpoint[params[1]] = params[2]
     end
-    mntpoint
+
+    @@mounts_mtime = current_mtime
+    @@mounts_cache = mntpoint
   end
 
   # Internal helper function to return which type of filesystem a given file

data/lib/puppet/version.rb

@@ -8,7 +8,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '8.28.1'
+  PUPPETVERSION = '8.30.0'
   IMPLEMENTATION = 'openvox'
 
   ##

data/tasks/vox.rake

@@ -9,8 +9,8 @@ namespace :vox do
     puts "Setting version to #{version}"
 
     data = File.read('lib/puppet/version.rb')
-    new_data = data.sub(/PUPPETVERSION = '\d+\.\d+\.\d+(\.rc\d+)?'/, "PUPPETVERSION = '#{version}'")
-    warn 'Failed to update version in lib/puppet/version.rb' if data == new_data
+    new_data = data.sub(/PUPPETVERSION = '\d+\.\d+\.\d+(-(alpha|beta|rc)\d+)?'/, "PUPPETVERSION = '#{version}'")
+    fail 'Failed to update version in lib/puppet/version.rb' if data == new_data
 
     File.write('lib/puppet/version.rb', new_data)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openvox
 version: !ruby/object:Gem::Version
-  version: 8.28.1
+  version: 8.30.0
 platform: ruby
 authors:
 - OpenVox Project
@@ -143,16 +143,22 @@ dependencies:
   name: openfact
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '7'
 - !ruby/object:Gem::Dependency
   name: ostruct
   requirement: !ruby/object:Gem::Requirement
@@ -1257,8 +1263,6 @@ files:
 - lib/puppet/util/psych_support.rb
 - lib/puppet/util/rdoc.rb
 - lib/puppet/util/rdoc/code_objects.rb
-- lib/puppet/util/rdoc/generators/puppet_generator.rb
-- lib/puppet/util/rdoc/generators/template/puppet/puppet.rb
 - lib/puppet/util/rdoc/parser.rb
 - lib/puppet/util/rdoc/parser/puppet_parser_core.rb
 - lib/puppet/util/rdoc/parser/puppet_parser_rdoc2.rb
@@ -1366,7 +1370,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.1
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: OpenVox, a community implementation of Puppet -- an automated configuration
   management tool