puppet-retrospec 0.7.0 → 0.7.2

data/vendor/gems/puppet-3.7.3/lib/puppet/face/catalog.rb

@@ -0,0 +1,130 @@
+require 'puppet/indirector/face'
+
+Puppet::Indirector::Face.define(:catalog, '0.0.1') do
+  copyright "Puppet Labs", 2011
+  license   "Apache 2 license; see COPYING"
+
+  summary "Compile, save, view, and convert catalogs."
+  description <<-'EOT'
+    This subcommand deals with catalogs, which are compiled per-node artifacts
+    generated from a set of Puppet manifests. By default, it interacts with the
+    compiling subsystem and compiles a catalog using the default manifest and
+    `certname`, but you can change the source of the catalog with the
+    `--terminus` option. You can also choose to print any catalog in 'dot'
+    format (for easy graph viewing with OmniGraffle or Graphviz) with
+    '--render-as dot'.
+  EOT
+  short_description <<-'EOT'
+    This subcommand deals with catalogs, which are compiled per-node artifacts
+    generated from a set of Puppet manifests. By default, it interacts with the
+    compiling subsystem and compiles a catalog using the default manifest and
+    `certname`; use the `--terminus` option to change the source of the catalog.
+  EOT
+
+  get_action(:destroy).summary "Invalid for this subcommand."
+  get_action(:search).summary "Invalid for this subcommand."
+  find = get_action(:find)
+  find.summary "Retrieve the catalog for a node."
+  find.arguments "<certname>"
+  find.returns <<-'EOT'
+    A serialized catalog. When used from the Ruby API, returns a
+    Puppet::Resource::Catalog object.
+  EOT
+
+  action(:apply) do
+    summary "Find and apply a catalog."
+    description <<-'EOT'
+      Finds and applies a catalog. This action takes no arguments, but
+      the source of the catalog can be managed with the `--terminus` option.
+    EOT
+    returns <<-'EOT'
+      Nothing. When used from the Ruby API, returns a
+      Puppet::Transaction::Report object.
+    EOT
+    examples <<-'EOT'
+      Apply the locally cached catalog:
+
+      $ puppet catalog apply --terminus yaml
+
+      Retrieve a catalog from the master and apply it, in one step:
+
+      $ puppet catalog apply --terminus rest
+
+      From `secret_agent.rb` (API example):
+
+          # ...
+          Puppet::Face[:catalog, '0.0.1'].download
+          # (Termini are singletons; catalog.download has a side effect of
+          # setting the catalog terminus to yaml)
+          report  = Puppet::Face[:catalog, '0.0.1'].apply
+          # ...
+    EOT
+
+    when_invoked do |options|
+      catalog = Puppet::Face[:catalog, "0.0.1"].find(Puppet[:certname]) or raise "Could not find catalog for #{Puppet[:certname]}"
+      catalog = catalog.to_ral
+
+      report = Puppet::Transaction::Report.new("apply")
+      report.configuration_version = catalog.version
+      report.environment = Puppet[:environment]
+
+      Puppet::Util::Log.newdestination(report)
+
+      begin
+        benchmark(:notice, "Finished catalog run") do
+          catalog.apply(:report => report)
+        end
+      rescue => detail
+        Puppet.log_exception(detail, "Failed to apply catalog: #{detail}")
+      end
+
+      report.finalize_report
+      report
+    end
+  end
+
+  action(:download) do
+    summary "Download this node's catalog from the puppet master server."
+    description <<-'EOT'
+      Retrieves a catalog from the puppet master and saves it to the local yaml
+      cache. This action always contacts the puppet master and will ignore
+      alternate termini.
+
+      The saved catalog can be used in any subsequent catalog action by specifying
+      '--terminus yaml' for that action.
+    EOT
+    returns "Nothing."
+    notes <<-'EOT'
+      When used from the Ruby API, this action has a side effect of leaving
+      Puppet::Resource::Catalog.indirection.terminus_class set to yaml. The
+      terminus must be explicitly re-set for subsequent catalog actions.
+    EOT
+    examples <<-'EOT'
+      Retrieve and store a catalog:
+
+      $ puppet catalog download
+
+      From `secret_agent.rb` (API example):
+
+          Puppet::Face[:plugin, '0.0.1'].download
+          Puppet::Face[:facts, '0.0.1'].upload
+          Puppet::Face[:catalog, '0.0.1'].download
+          # ...
+    EOT
+    when_invoked do |options|
+      Puppet::Resource::Catalog.indirection.terminus_class = :rest
+      Puppet::Resource::Catalog.indirection.cache_class = nil
+      catalog = nil
+      retrieval_duration = thinmark do
+        catalog = Puppet::Face[:catalog, '0.0.1'].find(Puppet[:certname])
+      end
+      catalog.retrieval_duration = retrieval_duration
+      catalog.write_class_file
+
+      Puppet::Resource::Catalog.indirection.terminus_class = :yaml
+      Puppet::Face[:catalog, "0.0.1"].save(catalog)
+      Puppet.notice "Saved catalog for #{Puppet[:certname]} to yaml"
+      nil
+    end
+  end
+end

data/vendor/gems/puppet-3.7.3/lib/puppet/face/catalog/select.rb

@@ -0,0 +1,49 @@
+# Select and show a list of resources of a given type.
+Puppet::Face.define(:catalog, '0.0.1') do
+  action :select do
+    summary "Retrieve a catalog and filter it for resources of a given type."
+    arguments "<host> <resource_type>"
+    returns <<-'EOT'
+      A list of resource references ("Type[title]"). When used from the API,
+      returns an array of Puppet::Resource objects excised from a catalog.
+    EOT
+    description <<-'EOT'
+      Retrieves a catalog for the specified host, then searches it for all
+      resources of the requested type.
+    EOT
+    notes <<-'NOTES'
+      By default, this action will retrieve a catalog from Puppet's compiler
+      subsystem; you must call the action with `--terminus rest` if you wish
+      to retrieve a catalog from the puppet master.
+
+      FORMATTING ISSUES: This action cannot currently render useful yaml;
+      instead, it returns an entire catalog. Use json instead.
+    NOTES
+    examples <<-'EOT'
+      Ask the puppet master for a list of managed file resources for a node:
+
+      $ puppet catalog select --terminus rest somenode.magpie.lan file
+    EOT
+    when_invoked do |host, type, options|
+      # REVISIT: Eventually, type should have a default value that triggers
+      # the non-specific behaviour.  For now, though, this will do.
+      # --daniel 2011-05-03
+      catalog = Puppet::Resource::Catalog.indirection.find(host)
+
+      if type == '*'
+        catalog.resources
+      else
+        type = type.downcase
+        catalog.resources.reject { |res| res.type.downcase != type }
+      end
+    end
+
+    when_rendering :console do |value|
+      if value.nil? then
+        "no matching resources found"
+      else
+        value.map {|x| x.to_s }.join("\n")
+      end
+    end
+  end
+end

data/vendor/gems/puppet-3.7.3/lib/puppet/face/certificate.rb

@@ -0,0 +1,160 @@
+require 'puppet/indirector/face'
+require 'puppet/ssl/host'
+
+Puppet::Indirector::Face.define(:certificate, '0.0.1') do
+  copyright "Puppet Labs", 2011
+  license   "Apache 2 license; see COPYING"
+
+  summary "Provide access to the CA for certificate management."
+  description <<-EOT
+    This subcommand interacts with a local or remote Puppet certificate
+    authority. Currently, its behavior is not a full superset of `puppet
+    cert`; specifically, it is unable to mimic puppet cert's "clean" option,
+    and its "generate" action submits a CSR rather than creating a
+    signed certificate.
+  EOT
+
+  option "--ca-location LOCATION" do
+    required
+    summary "Which certificate authority to use (local or remote)."
+    description <<-EOT
+      Whether to act on the local certificate authority or one provided by a
+      remote puppet master. Allowed values are 'local' and 'remote.'
+
+      This option is required.
+    EOT
+
+    before_action do |action, args, options|
+      unless [:remote, :local, :only].include? options[:ca_location].to_sym
+        raise ArgumentError, "Valid values for ca-location are 'remote', 'local', 'only'."
+      end
+      Puppet::SSL::Host.ca_location = options[:ca_location].to_sym
+    end
+  end
+
+  action :generate do
+    summary "Generate a new certificate signing request."
+    arguments "<host>"
+    returns "Nothing."
+    description <<-EOT
+      Generates and submits a certificate signing request (CSR) for the
+      specified host. This CSR will then have to be signed by a user
+      with the proper authorization on the certificate authority.
+
+      Puppet agent usually handles CSR submission automatically. This action is
+      primarily useful for requesting certificates for individual users and
+      external applications.
+    EOT
+    examples <<-EOT
+      Request a certificate for "somenode" from the site's CA:
+
+      $ puppet certificate generate somenode.puppetlabs.lan --ca-location remote
+    EOT
+
+    # Duplicate the option here explicitly to distinguish if it was passed arg
+    # us vs. set in the config file.
+    option "--dns-alt-names NAMES" do
+      summary "Additional DNS names to add to the certificate request"
+      description Puppet.settings.setting(:dns_alt_names).desc
+    end
+
+    when_invoked do |name, options|
+      host = Puppet::SSL::Host.new(name)
+
+      # We have a weird case where we have --dns_alt_names from Puppet, but
+      # this option is --dns-alt-names. Until we can get rid of --dns-alt-names
+      # or do a global tr('-', '_'), we have to support both.
+      # In supporting both, we'll use Puppet[:dns_alt_names] if specified on
+      # command line. We'll use options[:dns_alt_names] if specified on
+      # command line. If both specified, we'll fail.
+      # jeffweiss 17 april 2012
+
+      global_setting_from_cli = Puppet.settings.set_by_cli?(:dns_alt_names) == true
+      raise ArgumentError, "Can't specify both --dns_alt_names and --dns-alt-names" if options[:dns_alt_names] and global_setting_from_cli
+      options[:dns_alt_names] = Puppet[:dns_alt_names] if global_setting_from_cli
+
+      # If dns_alt_names are specified via the command line, we will always add
+      # them. Otherwise, they will default to the config file setting iff this
+      # cert is for the host we're running on.
+
+      host.generate_certificate_request(:dns_alt_names => options[:dns_alt_names])
+    end
+  end
+
+  action :list do
+    summary "List all certificate signing requests."
+    returns <<-EOT
+      An array of #inspect output from CSR objects. This output is
+      currently messy, but does contain the names of nodes requesting
+      certificates. This action returns #inspect strings even when used
+      from the Ruby API.
+    EOT
+
+    when_invoked do |options|
+      Puppet::SSL::Host.indirection.search("*", {
+        :for => :certificate_request,
+      }).map { |h| h.inspect }
+    end
+  end
+
+  action :sign do
+    summary "Sign a certificate signing request for HOST."
+    arguments "<host>"
+    returns <<-EOT
+      A string that appears to be (but isn't) an x509 certificate.
+    EOT
+    examples <<-EOT
+      Sign somenode.puppetlabs.lan's certificate:
+
+      $ puppet certificate sign somenode.puppetlabs.lan --ca-location remote
+    EOT
+
+    option("--[no-]allow-dns-alt-names") do
+      summary "Whether or not to accept DNS alt names in the certificate request"
+    end
+
+    when_invoked do |name, options|
+      host = Puppet::SSL::Host.new(name)
+      if Puppet::SSL::Host.ca_location == :remote
+        if options[:allow_dns_alt_names]
+          raise ArgumentError, "--allow-dns-alt-names may not be specified with a remote CA"
+        end
+
+        host.desired_state = 'signed'
+        Puppet::SSL::Host.indirection.save(host)
+      else
+        # We have to do this case manually because we need to specify
+        # allow_dns_alt_names.
+        unless ca = Puppet::SSL::CertificateAuthority.instance
+          raise ArgumentError, "This process is not configured as a certificate authority"
+        end
+
+        ca.sign(name, options[:allow_dns_alt_names])
+      end
+    end
+  end
+
+  # Indirector action doc overrides
+  find = get_action(:find)
+  find.summary "Retrieve a certificate."
+  find.arguments "<host>"
+  find.render_as = :s
+  find.returns <<-EOT
+    An x509 SSL certificate.
+
+    Note that this action has a side effect of caching a copy of the
+    certificate in Puppet's `ssldir`.
+  EOT
+
+  destroy = get_action(:destroy)
+  destroy.summary "Delete a certificate."
+  destroy.arguments "<host>"
+  destroy.returns "Nothing."
+  destroy.description <<-EOT
+    Deletes a certificate. This action currently only works on the local CA.
+  EOT
+
+  get_action(:search).summary "Invalid for this subcommand."
+  get_action(:save).summary "Invalid for this subcommand."
+  get_action(:save).description "Invalid for this subcommand."
+end

data/vendor/gems/puppet-3.7.3/lib/puppet/face/certificate_request.rb

@@ -0,0 +1,53 @@
+require 'puppet/indirector/face'
+
+Puppet::Indirector::Face.define(:certificate_request, '0.0.1') do
+  copyright "Puppet Labs", 2011
+  license   "Apache 2 license; see COPYING"
+
+  summary "Manage certificate requests."
+  description <<-EOT
+    This subcommand retrieves and submits certificate signing requests (CSRs).
+  EOT
+
+  # Per-action doc overrides
+  get_action(:destroy).summary "Invalid for this subcommand."
+
+  find = get_action(:find)
+  find.summary "Retrieve a single CSR."
+  find.arguments "<host>"
+  find.render_as = :s
+  find.returns <<-EOT
+    A single certificate request. When used from the Ruby API, returns a
+    Puppet::SSL::CertificateRequest object.
+  EOT
+  find.examples <<-EOT
+    Retrieve a single CSR from the puppet master's CA:
+
+    $ puppet certificate_request find somenode.puppetlabs.lan --terminus rest
+  EOT
+
+  search = get_action(:search)
+  search.summary "Retrieve all outstanding CSRs."
+  search.arguments "<dummy_text>"
+  search.render_as = :s
+  search.returns <<-EOT
+    A list of certificate requests. When used from the Ruby API, returns an
+    array of Puppet::SSL::CertificateRequest objects.
+  EOT
+  search.short_description <<-EOT
+    Retrieves all outstanding certificate signing requests. Due to a known bug,
+    this action requires a dummy search key, the content of which is irrelevant.
+  EOT
+  search.notes <<-EOT
+    Although this action always returns all CSRs, it requires a dummy search
+    key; this is a known bug.
+  EOT
+  search.examples <<-EOT
+    Retrieve all CSRs from the local CA (similar to 'puppet cert list'):
+
+    $ puppet certificate_request search x --terminus ca
+  EOT
+
+  get_action(:save).summary "API only: submit a certificate signing request."
+  get_action(:save).arguments "<x509_CSR>"
+end

data/vendor/gems/puppet-3.7.3/lib/puppet/face/certificate_revocation_list.rb

@@ -0,0 +1,58 @@
+require 'puppet/indirector/face'
+
+Puppet::Indirector::Face.define(:certificate_revocation_list, '0.0.1') do
+  copyright "Puppet Labs", 2011
+  license   "Apache 2 license; see COPYING"
+
+  summary "Manage the list of revoked certificates."
+  description <<-EOT
+    This subcommand is primarily for retrieving the certificate revocation
+    list from the CA.
+  EOT
+
+  find = get_action(:find)
+  find.summary "Retrieve the certificate revocation list."
+  find.arguments "<dummy_text>"
+  find.render_as = :s
+  find.returns <<-EOT
+    The certificate revocation list. When used from the Ruby API: returns an
+    OpenSSL::X509::CRL object.
+  EOT
+  find.short_description <<-EOT
+    Retrieves the certificate revocation list. Due to a known bug, this action
+    requires a dummy argument, the content of which is irrelevant.
+  EOT
+  find.notes <<-EOT
+    Although this action always returns the CRL from the specified terminus, it
+    requires a dummy argument; this is a known bug.
+  EOT
+  find.examples <<-EXAMPLES
+    Retrieve a copy of the puppet master's CRL:
+
+    $ puppet certificate_revocation_list find crl --terminus rest
+  EXAMPLES
+
+  destroy = get_action(:destroy)
+  destroy.summary "Delete the certificate revocation list."
+  destroy.arguments "<dummy_text>"
+  destroy.returns "Nothing."
+  destroy.description <<-EOT
+    Deletes the certificate revocation list. This cannot be done over REST, but
+    it is possible to delete the locally cached copy or the local CA's copy of
+    the CRL.
+  EOT
+  destroy.short_description <<-EOT
+    Deletes the certificate revocation list. This cannot be done over REST, but
+    it is possible to delete the locally cached copy or the local CA's copy of
+    the CRL. Due to a known bug, this action requires a dummy argument, the
+    content of which is irrelevant.
+  EOT
+  destroy.notes <<-EOT
+    Although this action always deletes the CRL from the specified terminus, it
+    requires a dummy argument; this is a known bug.
+  EOT
+
+  get_action(:search).summary "Invalid for this subcommand."
+  get_action(:save).summary "Invalid for this subcommand."
+  get_action(:save).description "Invalid for this subcommand."
+end