openvox 8.29.0 → 8.31.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86d05e7a3a189241096c6be834d26a8674a70cadfac8c90acce427992d619ad2
-  data.tar.gz: 430fe316be1706073496df35c7c5316d6402366f51b1f8a099a248769fe02960
+  metadata.gz: ece318da56b45d387a1226f12d25f99701b1aec5c8bd24c14bfe56db28b9e664
+  data.tar.gz: a4b801c632d5c9299c7d292184f184aa153372f5c9e6a8b695a43a56d7affa76
 SHA512:
-  metadata.gz: 914e4b11f6727fd2ab33dcdd76cfa3ef69626ed2b8217be0176bf58fafd6e89504096947715a1345f4c657986313f04918c27a1c639d553f63e6f8cb24c4b0cf
-  data.tar.gz: ac56bb6bd94bc23edc49986eaa92e8db16376865ae60b6833f86ad5615cab95857b0d08fbce52895517821d77aa5e954f4cdffe702ba2979514c08688bd98d9f
+  metadata.gz: 317ad75eebd895d0f718250404861d3090a32569a73b4ca8afe3f09f1ce3440399d99bf0b36eb4199e364f9ffeb592a82cac37ffae59ec0c21d943eb467fcfab
+  data.tar.gz: 4b968c2474e46628e7e06d9937de4d4e7cb3738436c3353491fd9ba2b2ef2ea6624215a9c6e0bfc0a9e8599f0f486f86cd6729878107b113952adef2e16a2123

data/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 All notable changes to this project will be documented in this file.
 
+## [8.31.0](https://github.com/openvoxproject/openvox/tree/8.31.0) (2026-10-12)
+
+[Full Changelog](https://github.com/openvoxproject/openvox/compare/8.30.0...8.31.0)
+
+**Implemented enhancements:**
+
+- \[Backport 8.x\] Port Puppet::Util::Json to the json 3 API [\#721](https://github.com/OpenVoxProject/openvox/pull/721) ([miharp](https://github.com/miharp))
+
+**Merged pull requests:**
+
+- Promote puppet-runtime 2026.10.12.2 into 8.x [\#723](https://github.com/OpenVoxProject/openvox/pull/723) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+## [8.30.0](https://github.com/openvoxproject/openvox/tree/8.30.0) (2026-10-07)
+
+[Full Changelog](https://github.com/openvoxproject/openvox/compare/8.29.0...8.30.0)
+
+**Fixed bugs:**
+
+- \[Bug\]: use of "server\_list" \(instead of server\) throws an error [\#658](https://github.com/OpenVoxProject/openvox/issues/658)
+- \[Bug\]: Ruby crashes on child side of fork pre-exec macOS 26 \(Tahoe\) [\#538](https://github.com/OpenVoxProject/openvox/issues/538)
+- \[Backport 8.x\] Pin json below 3 to unblock CI [\#676](https://github.com/OpenVoxProject/openvox/pull/676) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[backport 8.x\] fix: `Deferred` resolution of Puppet-language functions \(e.g. mocks in tests\) failing due to lack of `:global_scope` [\#671](https://github.com/OpenVoxProject/openvox/pull/671) ([griggi-ws](https://github.com/griggi-ws))
+- \[Backport 8.x\] print "Loading facts" just once [\#663](https://github.com/OpenVoxProject/openvox/pull/663) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
+**Closed issues:**
+
+- json 3.0.0 breaks Puppet::Util::Json and the test suite [\#654](https://github.com/OpenVoxProject/openvox/issues/654)
+
+**Merged pull requests:**
+
+- \[Backport 8.x\] Skip the tests that need jruby-openssl in FIPS mode [\#714](https://github.com/OpenVoxProject/openvox/pull/714) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Promote openfact 5.7.2 into 8.x [\#711](https://github.com/OpenVoxProject/openvox/pull/711) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- Promote puppet-runtime 2026.09.29.1 into 8.x [\#704](https://github.com/OpenVoxProject/openvox/pull/704) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Kill the forked agent run if it outlives runtimeout [\#698](https://github.com/OpenVoxProject/openvox/pull/698) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Wait for certificates in the forked child, not in the daemon [\#697](https://github.com/OpenVoxProject/openvox/pull/697) ([nmburgan](https://github.com/nmburgan))
+- openfact: Update 5.7.0 -\> 5.7.1 [\#678](https://github.com/OpenVoxProject/openvox/pull/678) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+- \[Backport 8.x\] Proper markdown for alias reference documentation. [\#650](https://github.com/OpenVoxProject/openvox/pull/650) ([OpenVoxProjectBot](https://github.com/OpenVoxProjectBot))
+
 ## [8.29.0](https://github.com/openvoxproject/openvox/tree/8.29.0) (2026-09-04)
 
 [Full Changelog](https://github.com/openvoxproject/openvox/compare/8.28.1...8.29.0)

data/Gemfile

@@ -77,7 +77,7 @@ group(:packaging) do
     gem 'vanagon', *location_for(ENV['VANAGON_LOCATION'] || 'https://github.com/openvoxproject/vanagon#main')
   end
   gem 'artifactory'
-  gem 'json'
+  gem 'json', '< 4'
   gem 'octokit'
 end
 

data/Rakefile

@@ -159,7 +159,7 @@ begin
     HEADER
     config.user = "openvoxproject"
     config.project = "openvox"
-    config.exclude_labels = %w[dependencies duplicate question invalid wontfix wont-fix modulesync skip-changelog]
+    config.exclude_labels = %w[dependencies duplicate question invalid wontfix wont-fix modulesync skip-changelog skip-8.x-changelog]
     config.since_tag = "8.18.1"
     config.future_release = Puppet::PUPPETVERSION
     config.exclude_tags_regex = /\A[7,9]\./

data/lib/puppet/agent.rb

@@ -22,6 +22,12 @@ class Puppet::Agent
   class RunTimeoutError < Exception # rubocop:disable Lint/InheritException
   end
 
+  # Exit status the forked child uses to tell the daemon that the SSL state
+  # machine gave up waiting for a certificate, so the daemon can exit as it
+  # did when the wait happened in the parent. Must not collide with the
+  # detailed exit codes returned by a run (0, 1, 2, 4, 6) or with 254 (NoMemoryError).
+  CERTIFICATE_FAILURE_EXIT_STATUS = 253
+
   attr_reader :client_class, :client, :should_fork
 
   def initialize(client_class, should_fork = true)
@@ -60,12 +66,28 @@ class Puppet::Agent
         end
       end
 
-      # waiting for certs may sleep for awhile depending on onetime, waitforcert and maxwaitforcert!
-      # this needs to happen before forking so that if we fail to obtain certs and try to exit, then
-      # we exit the main process and not the forked child.
-      ssl_context = wait_for_certificates(client_options)
-
       result = run_in_fork(should_fork) do
+        # waiting for certs may sleep for awhile depending on onetime, waitforcert and maxwaitforcert!
+        #
+        # This happens in the forked child, not in the long-lived daemon. Refreshing
+        # the CRL or renewing the certificate resolves the server's name, and on
+        # Ruby 3.3+ that runs in short-lived native threads. If the daemon forks
+        # while one of those threads is exiting, the child inherits glibc's
+        # resolv.conf lock in the locked state and every name lookup in the run
+        # hangs (#485). Keeping the lookups out of the parent avoids that.
+        #
+        # The state machine calls exit when it gives up waiting for a certificate
+        # (waitforcert 0 or maxwaitforcert exceeded). Report that back so the
+        # daemon exits, as it did when the wait happened in the parent.
+        begin
+          ssl_context = wait_for_certificates(client_options)
+        rescue SystemExit
+          next CERTIFICATE_FAILURE_EXIT_STATUS
+        rescue StandardError => detail
+          Puppet.log_exception(detail, _("Could not obtain certificates: %{detail}") % { detail: detail })
+          next nil
+        end
+
         with_client(client_options[:transaction_uuid], client_options[:job_id]) do |client|
           client_args = client_options.merge(:pluginsync => Puppet::Configurer.should_pluginsync?)
           begin
@@ -115,6 +137,9 @@ class Puppet::Agent
           end
         end
       end
+      # The child could not obtain a certificate and the state machine asked to exit.
+      exit(1) if result == CERTIFICATE_FAILURE_EXIT_STATUS
+
       true
     end
     Puppet.notice _("Shutdown/restart in progress (%{status}); skipping run") % { status: Puppet::Application.run_status.inspect } unless block_run
@@ -146,8 +171,55 @@ class Puppet::Agent
       atForkHandler.parent
     end
 
-    exit_code = Process.waitpid2(child_pid)
-    exit_code[1].exitstatus
+    _, status = wait_for_child(child_pid)
+    status.exitstatus
+  end
+
+  # Wait for the forked child to exit. The child enforces `runtimeout` on its
+  # own run, but it may fail to exit afterwards (a stranded thread, a hung
+  # subprocess, etc.). Without a deadline here, the parent blocks forever and
+  # the agent stops checking in. Once the run timeout plus a grace period has
+  # elapsed, the child is killed so the daemon can carry on.
+  def wait_for_child(child_pid)
+    deadline = child_deadline
+    return Process.waitpid2(child_pid) unless deadline
+
+    loop do
+      result = Process.waitpid2(child_pid, Process::WNOHANG)
+      return result if result
+
+      if monotonic_now >= deadline
+        Puppet.err _("Agent run (pid %{pid}) did not exit within %{timeout} seconds of the run timeout, killing it") %
+                   { pid: child_pid, timeout: child_grace_period }
+        begin
+          Process.kill(:KILL, child_pid)
+        rescue Errno::ESRCH
+          # The child exited between the last check and the kill.
+        end
+        return Process.waitpid2(child_pid)
+      end
+
+      sleep 1
+    end
+  end
+
+  # After the run timeout fires inside the child, it may still need to send
+  # its report, which is bounded by the HTTP connect and read timeouts.
+  def child_grace_period
+    Puppet[:http_connect_timeout] + Puppet[:http_read_timeout]
+  end
+
+  # Returns the absolute monotonic deadline for the child, or nil when
+  # `runtimeout` is disabled.
+  def child_deadline
+    runtimeout = Puppet[:runtimeout]
+    return nil if runtimeout.nil? || runtimeout <= 0
+
+    monotonic_now + runtimeout + child_grace_period
+  end
+
+  def monotonic_now
+    Process.clock_gettime(Process::CLOCK_MONOTONIC)
   end
 
   private

data/lib/puppet/face/epp.rb

@@ -384,7 +384,7 @@ Puppet::Face.define(:epp, '0.0.1') do
         pn = Puppet::Pops::Model::PNTransformer.transform(parse_result)
         case fmt
         when 'json'
-          options[:pretty] ? JSON.pretty_unparse(pn.to_data) : JSON.dump(pn.to_data)
+          options[:pretty] ? JSON.pretty_generate(pn.to_data) : JSON.dump(pn.to_data)
         else
           pn.format(options[:pretty] ? Puppet::Pops::PN::Indent.new('  ') : nil, output)
         end

data/lib/puppet/face/parser.rb

@@ -194,7 +194,7 @@ Puppet::Face.define(:parser, '0.0.1') do
         pn = Puppet::Pops::Model::PNTransformer.transform(parse_result)
         case fmt
         when 'json'
-          options[:pretty] ? JSON.pretty_unparse(pn.to_data) : JSON.dump(pn.to_data)
+          options[:pretty] ? JSON.pretty_generate(pn.to_data) : JSON.dump(pn.to_data)
         else
           pn.format(options[:pretty] ? Puppet::Pops::PN::Indent.new('  ') : nil, output)
         end

data/lib/puppet/indirector/facts/facter.rb

@@ -62,21 +62,22 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
       end
     end.flatten + Puppet[:factpath].split(File::PATH_SEPARATOR)
 
-    dirs = dirs.select do |dir|
-      next false unless FileTest.directory?(dir)
-
-      # Even through we no longer directly load facts in the terminus,
-      # print out each .rb in the facts directory as module
-      # developers may find that information useful for debugging purposes
-      if Puppet::Util::Log.sendlevel?(:info)
-        Puppet.info _("Loading facts")
-        Dir.glob("#{dir}/*.rb").each do |file|
-          Puppet.debug { "Loading facts from #{file}" }
+    dirs.select! { |dir| FileTest.directory?(dir) }
+
+    # Even though we no longer directly load facts in the terminus,
+    # print out each .rb in the facts directory as module
+    # developers may find that information useful for debugging purposes
+    unless dirs.empty?
+      Puppet.info _("Loading facts")
+      if Puppet::Util::Log.sendlevel?(:debug)
+        dirs.each do |dir|
+          Dir.glob("#{dir}/*.rb").each do |file|
+            Puppet.debug { "Loading facts from #{file}" }
+          end
         end
       end
-
-      true
     end
+
     dirs << request.options[:custom_dir] if request.options[:custom_dir]
     Puppet.runtime[:facter].search(*dirs)
   end

data/lib/puppet/pal/json_catalog_encoder.rb

@@ -58,7 +58,7 @@ class JsonCatalogEncoder
     r = possibly_filtered_catalog.resource(type, title)
     return nil if r.nil?
 
-    r.to_data_hash.to_json(:pretty => pretty)
+    Puppet::Util::Json.dump(r.to_data_hash, :pretty => pretty)
   end
 
   # Applies a filter for virtual resources and returns filtered catalog

data/lib/puppet/pops/evaluator/deferred_resolver.rb

@@ -48,7 +48,10 @@ class DeferredResolver
     #    # Server facts are always about the local node's version etc.
     #    @scope.set_server_facts(node.server_facts)
 
-    resolver.resolve_futures(catalog)
+    # Must be wrapped in with_context_overrides to ensure global_scope is valid for Puppet-language functions
+    compiler.with_context_overrides do
+      resolver.resolve_futures(catalog)
+    end
     nil
   end
 

data/lib/puppet/reference/metaparameter.rb

@@ -14,7 +14,7 @@ etc.), prevent Puppet from making changes (`noop`), and change logging verbosity
 
 ## Available Metaparameters
 
-  }.dup
+  }.dup.strip + "\n"
   begin
     params = []
     Puppet::Type.eachmetaparam { |param|

data/lib/puppet/util/json.rb

@@ -18,6 +18,14 @@ module Puppet::Util
 
     require 'json'
 
+    # Generator options equivalent to the `JSON::PRETTY_STATE_PROTOTYPE`
+    # that json 2.x provided and json 3 removed.
+    PRETTY_OPTIONS = { :indent => '  ', :space => ' ', :object_nl => "\n", :array_nl => "\n" }.freeze
+
+    # Generator options that json 3 rejects as unknown. `quirks_mode` has been
+    # a no-op since json 2.0, when quirks mode became the only mode.
+    OBSOLETE_DUMP_OPTIONS = [:quirks_mode].freeze
+
     # Load the content from a file as JSON if
     # contents are in valid format. This method does not
     # raise error but returns `nil` when invalid file is
@@ -41,16 +49,20 @@ module Puppet::Util
     def self.load(string, options = {})
       string = string.read if string.respond_to?(:read)
 
+      options = options.dup
       options[:symbolize_names] = true if options.delete(:symbolize_keys)
-      ::JSON.parse(string, options)
+      # json 3 only accepts parser options as keyword arguments
+      ::JSON.parse(string, **options)
     rescue JSON::ParserError => e
       raise Puppet::Util::Json::ParseError.build(e, string)
     end
 
     def self.dump(object, options = {})
       # Options is a state when we're being called recursively
-      if !options.is_a?(JSON::State) && options.delete(:pretty)
-        options.merge!(::JSON::PRETTY_STATE_PROTOTYPE.to_h)
+      unless options.is_a?(JSON::State)
+        options = options.dup
+        OBSOLETE_DUMP_OPTIONS.each { |key| options.delete(key) }
+        options.merge!(PRETTY_OPTIONS) if options.delete(:pretty)
       end
       object.to_json(options)
     end

data/lib/puppet/version.rb

@@ -8,7 +8,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '8.29.0'
+  PUPPETVERSION = '8.31.0'
   IMPLEMENTATION = 'openvox'
 
   ##

data/tasks/vox.rake

@@ -9,8 +9,8 @@ namespace :vox do
     puts "Setting version to #{version}"
 
     data = File.read('lib/puppet/version.rb')
-    new_data = data.sub(/PUPPETVERSION = '\d+\.\d+\.\d+(\.rc\d+)?'/, "PUPPETVERSION = '#{version}'")
-    warn 'Failed to update version in lib/puppet/version.rb' if data == new_data
+    new_data = data.sub(/PUPPETVERSION = '\d+\.\d+\.\d+(-(alpha|beta|rc)\d+)?'/, "PUPPETVERSION = '#{version}'")
+    fail 'Failed to update version in lib/puppet/version.rb' if data == new_data
 
     File.write('lib/puppet/version.rb', new_data)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openvox
 version: !ruby/object:Gem::Version
-  version: 8.29.0
+  version: 8.31.0
 platform: ruby
 authors:
 - OpenVox Project