RubyGems - puppet-retrospec - Versions diffs - 1.5.0 → 1.6.0 - Mend

puppet-retrospec 1.5.0 → 1.6.0

Files changed (1848) hide show

data/vendor/gems/puppet-4.5.2/lib/puppet/settings/ini_file.rb DELETED

@@ -1,171 +0,0 @@
-# @api private
-class Puppet::Settings::IniFile
-  DEFAULT_SECTION_NAME = "main"
-  def self.update(config_fh, &block)
-    config = parse(config_fh)
-    manipulator = Manipulator.new(config)
-    yield manipulator
-    config.write(config_fh)
-  end
-  def self.parse(config_fh)
-    config = new([DefaultSection.new])
-    config_fh.each_line do |line|
-      case line
-      when /^(\s*)\[(\w+)\](\s*)$/
-        config.append(SectionLine.new($1, $2, $3))
-      when /^(\s*)(\w+)(\s*=\s*)(.*?)(\s*)$/
-        config.append(SettingLine.new($1, $2, $3, $4, $5))
-      else
-        config.append(Line.new(line))
-      end
-    end
-    config
-  end
-  def initialize(lines = [])
-    @lines = lines
-  end
-  def append(line)
-    line.previous = @lines.last
-    @lines << line
-  end
-  def insert_after(line, new_line)
-    new_line.previous = line
-    insertion_point = @lines.index(line)
-    @lines.insert(insertion_point + 1, new_line)
-    if @lines.length > insertion_point + 2
-      @lines[insertion_point + 2].previous = new_line
-    end
-  end
-  def section_lines
-    @lines.select { |line| line.is_a?(SectionLine) }
-  end
-  def section_line(name)
-    section_lines.find { |section| section.name == name }
-  end
-  def setting(section, name)
-    settings_in(lines_in(section)).find do |line|
-      line.name == name
-    end
-  end
-  def lines_in(section_name)
-    section_lines = []
-    current_section_name = DEFAULT_SECTION_NAME
-    @lines.each do |line|
-      if line.is_a?(SectionLine)
-        current_section_name = line.name
-      elsif current_section_name == section_name
-        section_lines << line
-      end
-    end
-    section_lines
-  end
-  def settings_in(lines)
-    lines.select { |line| line.is_a?(SettingLine) }
-  end
-  def write(fh)
-    fh.truncate(0)
-    fh.rewind
-    @lines.each do |line|
-      line.write(fh)
-    end
-    fh.flush
-  end
-  class Manipulator
-    def initialize(config)
-      @config = config
-    end
-    def set(section, name, value)
-      setting = @config.setting(section, name)
-      if setting
-        setting.value = value
-      else
-        add_setting(section, name, value)
-      end
-    end
-    private
-    def add_setting(section_name, name, value)
-      section = @config.section_line(section_name)
-      if section.nil?
-        previous_line = SectionLine.new("", section_name, "")
-        @config.append(previous_line)
-      else
-        previous_line = @config.settings_in(@config.lines_in(section_name)).last || section
-      end
-      @config.insert_after(previous_line, SettingLine.new("", name, " = ", value, ""))
-    end
-  end
-  module LineNumber
-    attr_accessor :previous
-    def line_number
-      line = 0
-      previous_line = previous
-      while previous_line
-        line += 1
-        previous_line = previous_line.previous
-      end
-      line
-    end
-  end
-  Line = Struct.new(:text) do
-    include LineNumber
-    def write(fh)
-      fh.puts(text)
-    end
-  end
-  SettingLine = Struct.new(:prefix, :name, :infix, :value, :suffix) do
-    include LineNumber
-    def write(fh)
-      fh.write(prefix)
-      fh.write(name)
-      fh.write(infix)
-      fh.write(value)
-      fh.puts(suffix)
-    end
-  end
-  SectionLine = Struct.new(:prefix, :name, :suffix) do
-    include LineNumber
-    def write(fh)
-      fh.write(prefix)
-      fh.write("[")
-      fh.write(name)
-      fh.write("]")
-      fh.puts(suffix)
-    end
-  end
-  class DefaultSection < SectionLine
-    def initialize
-      super("", DEFAULT_SECTION_NAME, "")
-    end
-    def write(fh)
-    end
-  end
-end

data/vendor/gems/puppet-4.5.2/lib/puppet/ssl/base.rb DELETED

@@ -1,140 +0,0 @@
-require 'openssl'
-require 'puppet/ssl'
-require 'puppet/ssl/digest'
-require 'puppet/util/ssl'
-# The base class for wrapping SSL instances.
-class Puppet::SSL::Base
-  # For now, use the YAML separator.
-  SEPARATOR = "\n---\n"
-  # Only allow printing ascii characters, excluding /
-  VALID_CERTNAME = /\A[ -.0-~]+\Z/
-  def self.from_multiple_s(text)
-    text.split(SEPARATOR).collect { |inst| from_s(inst) }
-  end
-  def self.to_multiple_s(instances)
-    instances.collect { |inst| inst.to_s }.join(SEPARATOR)
-  end
-  def self.wraps(klass)
-    @wrapped_class = klass
-  end
-  def self.wrapped_class
-    raise(Puppet::DevError, "#{self} has not declared what class it wraps") unless defined?(@wrapped_class)
-    @wrapped_class
-  end
-  def self.validate_certname(name)
-    raise "Certname #{name.inspect} must not contain unprintable or non-ASCII characters" unless name =~ VALID_CERTNAME
-  end
-  attr_accessor :name, :content
-  # Is this file for the CA?
-  def ca?
-    name == Puppet::SSL::Host.ca_name
-  end
-  def generate
-    raise Puppet::DevError, "#{self.class} did not override 'generate'"
-  end
-  def initialize(name)
-    @name = name.to_s.downcase
-    self.class.validate_certname(@name)
-  end
-  ##
-  # name_from_subject extracts the common name attribute from the subject of an
-  # x.509 certificate certificate
-  #
-  # @api private
-  #
-  # @param [OpenSSL::X509::Name] subject The full subject (distinguished name) of the x.509
-  #   certificate.
-  #
-  # @return [String] the name (CN) extracted from the subject.
-  def self.name_from_subject(subject)
-    Puppet::Util::SSL.cn_from_subject(subject)
-  end
-  # Create an instance of our Puppet::SSL::* class using a given instance of the wrapped class
-  def self.from_instance(instance, name = nil)
-    raise ArgumentError, "Object must be an instance of #{wrapped_class}, #{instance.class} given" unless instance.is_a? wrapped_class
-    raise ArgumentError, "Name must be supplied if it cannot be determined from the instance" if name.nil? and !instance.respond_to?(:subject)
-    name ||= name_from_subject(instance.subject)
-    result = new(name)
-    result.content = instance
-    result
-  end
-  # Convert a string into an instance
-  def self.from_s(string, name = nil)
-    instance = wrapped_class.new(string)
-    from_instance(instance, name)
-  end
-  # Read content from disk appropriately.
-  def read(path)
-    @content = wrapped_class.new(File.read(path))
-  end
-  # Convert our thing to pem.
-  def to_s
-    return "" unless content
-    content.to_pem
-  end
-  def to_data_hash
-    to_s
-  end
-  # Provide the full text of the thing we're dealing with.
-  def to_text
-    return "" unless content
-    content.to_text
-  end
-  def fingerprint(md = :SHA256)
-    mds = md.to_s.upcase
-    digest(mds).to_hex
-  end
-  def digest(algorithm=nil)
-    unless algorithm
-      algorithm = digest_algorithm
-    end
-    Puppet::SSL::Digest.new(algorithm, content.to_der)
-  end
-  def digest_algorithm
-    # The signature_algorithm on the X509 cert is a combination of the digest
-    # algorithm and the encryption algorithm
-    # e.g. md5WithRSAEncryption, sha256WithRSAEncryption
-    # Unfortunately there isn't a consistent pattern
-    # See RFCs 3279, 5758
-    digest_re = Regexp.union(
-      /ripemd160/i,
-      /md[245]/i,
-      /sha\d*/i
-    )
-    ln = content.signature_algorithm
-    if match = digest_re.match(ln)
-      match[0].downcase
-    else
-      raise Puppet::Error, "Unknown signature algorithm '#{ln}'"
-    end
-  end
-  private
-  def wrapped_class
-    self.class.wrapped_class
-  end
-end

data/vendor/gems/puppet-4.5.2/lib/puppet/ssl/certificate.rb DELETED

@@ -1,95 +0,0 @@
-require 'puppet/ssl/base'
-# Manage certificates themselves.  This class has no
-# 'generate' method because the CA is responsible
-# for turning CSRs into certificates; we can only
-# retrieve them from the CA (or not, as is often
-# the case).
-class Puppet::SSL::Certificate < Puppet::SSL::Base
-  # This is defined from the base class
-  wraps OpenSSL::X509::Certificate
-  extend Puppet::Indirector
-  indirects :certificate, :terminus_class => :file, :doc => <<DOC
-    This indirection wraps an `OpenSSL::X509::Certificate` object, representing a certificate (signed public key).
-    The indirection key is the certificate CN (generally a hostname).
-DOC
-  # Because of how the format handler class is included, this
-  # can't be in the base class.
-  def self.supported_formats
-    [:s]
-  end
-  def subject_alt_names
-    alts = content.extensions.find{|ext| ext.oid == "subjectAltName"}
-    return [] unless alts
-    alts.value.split(/\s*,\s*/)
-  end
-  def expiration
-    return nil unless content
-    content.not_after
-  end
-  # This name is what gets extracted from the subject before being passed
-  # to the constructor, so it's not downcased
-  def unmunged_name
-    self.class.name_from_subject(content.subject)
-  end
-  # Any extensions registered with custom OIDs as defined in module
-  # Puppet::SSL::Oids may be looked up here.
-  #
-  # A cert with a 'pp_uuid' extension having the value 'abcd' would return:
-  #
-  # [{ 'oid' => 'pp_uuid', 'value' => 'abcd'}]
-  #
-  # @return [Array<Hash{String => String}>] An array of two element hashes,
-  # with key/value pairs for the extension's oid, and its value.
-  def custom_extensions
-    custom_exts = content.extensions.select do |ext|
-      Puppet::SSL::Oids.subtree_of?('ppRegCertExt', ext.oid) or
-        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', ext.oid)
-    end
-    custom_exts.map do |ext|
-      {'oid' => ext.oid, 'value' => get_ext_val(ext.oid)}
-    end
-  end
-  private
-  # Extract the extensions sequence from the wrapped certificate's raw ASN.1 form
-  def exts_seq
-    # See RFC-2459 section 4.1 (https://tools.ietf.org/html/rfc2459#section-4.1)
-    # to see where this is defined. Essentially this is saying "in the first
-    # sequence in the certificate, find the item that's tagged with 3. This
-    # is where the extensions are stored."
-    @extensions_tag ||= 3
-    @exts_seq ||= OpenSSL::ASN1.decode(content.to_der).value[0].find do |data|
-      (data.tag == @extensions_tag) && (data.tag_class == :CONTEXT_SPECIFIC)
-    end.value[0]
-  end
-  # Get the DER parsed value of an X.509 extension by it's OID, or short name
-  # if one has been registered with OpenSSL.
-  def get_ext_val(oid)
-    ext_obj = exts_seq.value.find do |ext_seq|
-      ext_seq.value[0].value == oid
-    end
-    raw_val = ext_obj.value.last.value
-    begin
-      OpenSSL::ASN1.decode(raw_val).value
-    rescue OpenSSL::ASN1::ASN1Error
-      # This is required to maintain backward compatibility with the previous
-      # way trusted facts were signed. See PUP-3560
-      raw_val
-    end
-  end
-end

data/vendor/gems/puppet-4.5.2/lib/puppet/ssl/certificate_authority.rb DELETED

@@ -1,517 +0,0 @@
-require 'puppet/ssl/host'
-require 'puppet/ssl/certificate_request'
-require 'puppet/ssl/certificate_signer'
-require 'puppet/util'
-# The class that knows how to sign certificates.  It creates
-# a 'special' SSL::Host whose name is 'ca', thus indicating
-# that, well, it's the CA.  There's some magic in the
-# indirector/ssl_file terminus base class that does that
-# for us.
-#   This class mostly just signs certs for us, but
-# it can also be seen as a general interface into all of the
-# SSL stuff.
-class Puppet::SSL::CertificateAuthority
-  # We will only sign extensions on this whitelist, ever.  Any CSR with a
-  # requested extension that we don't recognize is rejected, against the risk
-  # that it will introduce some security issue through our ignorance of it.
-  #
-  # Adding an extension to this whitelist simply means we will consider it
-  # further, not that we will always accept a certificate with an extension
-  # requested on this list.
-  RequestExtensionWhitelist = %w{subjectAltName}
-  require 'puppet/ssl/certificate_factory'
-  require 'puppet/ssl/inventory'
-  require 'puppet/ssl/certificate_revocation_list'
-  require 'puppet/ssl/certificate_authority/interface'
-  require 'puppet/ssl/certificate_authority/autosign_command'
-  require 'puppet/network/authstore'
-  class CertificateVerificationError < RuntimeError
-    attr_accessor :error_code
-    def initialize(code)
-      @error_code = code
-    end
-  end
-  def self.singleton_instance
-    @singleton_instance ||= new
-  end
-  class CertificateSigningError < RuntimeError
-    attr_accessor :host
-    def initialize(host)
-      @host = host
-    end
-  end
-  def self.ca?
-    # running as ca? - ensure boolean answer
-    !!(Puppet[:ca] && Puppet.run_mode.master?)
-  end
-  # If this process can function as a CA, then return a singleton instance.
-  def self.instance
-    ca? ? singleton_instance : nil
-  end
-  attr_reader :name, :host
-  # If autosign is configured, autosign the csr we are passed.
-  # @param csr [Puppet::SSL::CertificateRequest] The csr to sign.
-  # @return [Void]
-  # @api private
-  def autosign(csr)
-    if autosign?(csr)
-      Puppet.info "Autosigning #{csr.name}"
-      sign(csr.name)
-    end
-  end
-  # Determine if a CSR can be autosigned by the autosign store or autosign command
-  #
-  # @param csr [Puppet::SSL::CertificateRequest] The CSR to check
-  # @return [true, false]
-  # @api private
-  def autosign?(csr)
-    auto = Puppet[:autosign]
-    decider = case auto
-      when false
-        AutosignNever.new
-      when true
-        AutosignAlways.new
-      else
-        file = Puppet::FileSystem.pathname(auto)
-        if Puppet::FileSystem.executable?(file)
-          Puppet::SSL::CertificateAuthority::AutosignCommand.new(auto)
-        elsif Puppet::FileSystem.exist?(file)
-          AutosignConfig.new(file)
-        else
-          AutosignNever.new
-        end
-      end
-    decider.allowed?(csr)
-  end
-  # Retrieves (or creates, if necessary) the certificate revocation list.
-  def crl
-    unless defined?(@crl)
-      unless @crl = Puppet::SSL::CertificateRevocationList.indirection.find(Puppet::SSL::CA_NAME)
-        @crl = Puppet::SSL::CertificateRevocationList.new(Puppet::SSL::CA_NAME)
-        @crl.generate(host.certificate.content, host.key.content)
-        Puppet::SSL::CertificateRevocationList.indirection.save(@crl)
-      end
-    end
-    @crl
-  end
-  # Delegates this to our Host class.
-  def destroy(name)
-    Puppet::SSL::Host.destroy(name)
-  end
-  # Generates a new certificate.
-  # @return Puppet::SSL::Certificate
-  def generate(name, options = {})
-    raise ArgumentError, "A Certificate already exists for #{name}" if Puppet::SSL::Certificate.indirection.find(name)
-    # Pass on any requested subjectAltName field.
-    san = options[:dns_alt_names]
-    host = Puppet::SSL::Host.new(name)
-    host.generate_certificate_request(:dns_alt_names => san)
-    # CSR may have been implicitly autosigned, generating a certificate
-    # Or sign explicitly
-    host.certificate || sign(name, !!san)
-  end
-  # Generate our CA certificate.
-  def generate_ca_certificate
-    generate_password unless password?
-    host.generate_key unless host.key
-    # Create a new cert request.  We do this specially, because we don't want
-    # to actually save the request anywhere.
-    request = Puppet::SSL::CertificateRequest.new(host.name)
-    # We deliberately do not put any subjectAltName in here: the CA
-    # certificate absolutely does not need them. --daniel 2011-10-13
-    request.generate(host.key)
-    # Create a self-signed certificate.
-    @certificate = sign(host.name, false, request)
-    # And make sure we initialize our CRL.
-    crl
-  end
-  def initialize
-    Puppet.settings.use :main, :ssl, :ca
-    @name = Puppet[:certname]
-    @host = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
-    setup
-  end
-  # Retrieve (or create, if necessary) our inventory manager.
-  def inventory
-    @inventory ||= Puppet::SSL::Inventory.new
-  end
-  # Generate a new password for the CA.
-  def generate_password
-    pass = ""
-    20.times { pass += (rand(74) + 48).chr }
-    begin
-      Puppet.settings.setting(:capass).open('w') { |f| f.print pass }
-    rescue Errno::EACCES => detail
-      raise Puppet::Error, "Could not write CA password: #{detail}", detail.backtrace
-    end
-    @password = pass
-    pass
-  end
-  # Lists the names of all signed certificates.
-  #
-  # @param name [Array<string>] filter to cerificate names
-  #
-  # @return [Array<String>]
-  def list(name='*')
-    list_certificates(name).collect { |c| c.name }
-  end
-  # Return all the certificate objects as found by the indirector
-  # API for PE license checking.
-  #
-  # Created to prevent the case of reading all certs from disk, getting
-  # just their names and verifying the cert for each name, which then
-  # causes the cert to again be read from disk.
-  #
-  # @author Jeff Weiss <jeff.weiss@puppetlabs.com>
-  # @api Puppet Enterprise Licensing
-  #
-  # @param name [Array<string>] filter to cerificate names
-  #
-  # @return [Array<Puppet::SSL::Certificate>]
-  def list_certificates(name='*')
-    Puppet::SSL::Certificate.indirection.search(name)
-  end
-  # Read the next serial from the serial file, and increment the
-  # file so this one is considered used.
-  def next_serial
-    serial = 1
-    Puppet.settings.setting(:serial).exclusive_open('a+') do |f|
-      f.rewind
-      serial = f.read.chomp.hex
-      if serial == 0
-        serial = 1
-      end
-      f.truncate(0)
-      f.rewind
-      # We store the next valid serial, not the one we just used.
-      f << "%04X" % (serial + 1)
-    end
-    serial
-  end
-  # Does the password file exist?
-  def password?
-    Puppet::FileSystem.exist?(Puppet[:capass])
-  end
-  # Print a given host's certificate as text.
-  def print(name)
-    (cert = Puppet::SSL::Certificate.indirection.find(name)) ? cert.to_text : nil
-  end
-  # Revoke a given certificate.
-  def revoke(name)
-    raise ArgumentError, "Cannot revoke certificates when the CRL is disabled" unless crl
-    cert = Puppet::SSL::Certificate.indirection.find(name)
-    serials = if cert
-                [cert.content.serial]
-              elsif name =~ /^0x[0-9A-Fa-f]+$/
-                [name.hex]
-              else
-                inventory.serials(name)
-              end
-    if serials.empty?
-      raise ArgumentError, "Could not find a serial number for #{name}"
-    end
-    serials.each do |s|
-      crl.revoke(s, host.key.content)
-    end
-  end
-  # This initializes our CA so it actually works.  This should be a private
-  # method, except that you can't any-instance stub private methods, which is
-  # *awesome*.  This method only really exists to provide a stub-point during
-  # testing.
-  def setup
-    generate_ca_certificate unless @host.certificate
-  end
-  # Sign a given certificate request.
-  def sign(hostname, allow_dns_alt_names = false, self_signing_csr = nil)
-    # This is a self-signed certificate
-    if self_signing_csr
-      # # This is a self-signed certificate, which is for the CA.  Since this
-      # # forces the certificate to be self-signed, anyone who manages to trick
-      # # the system into going through this path gets a certificate they could
-      # # generate anyway.  There should be no security risk from that.
-      csr = self_signing_csr
-      cert_type = :ca
-      issuer = csr.content
-    else
-      allow_dns_alt_names = true if hostname == Puppet[:certname].downcase
-      unless csr = Puppet::SSL::CertificateRequest.indirection.find(hostname)
-        raise ArgumentError, "Could not find certificate request for #{hostname}"
-      end
-      cert_type = :server
-      issuer = host.certificate.content
-      # Make sure that the CSR conforms to our internal signing policies.
-      # This will raise if the CSR doesn't conform, but just in case...
-      check_internal_signing_policies(hostname, csr, allow_dns_alt_names) or
-        raise CertificateSigningError.new(hostname), "CSR had an unknown failure checking internal signing policies, will not sign!"
-    end
-    cert = Puppet::SSL::Certificate.new(hostname)
-    cert.content = Puppet::SSL::CertificateFactory.
-      build(cert_type, csr, issuer, next_serial)
-    signer = Puppet::SSL::CertificateSigner.new
-    signer.sign(cert.content, host.key.content)
-    Puppet.notice "Signed certificate request for #{hostname}"
-    # Add the cert to the inventory before we save it, since
-    # otherwise we could end up with it being duplicated, if
-    # this is the first time we build the inventory file.
-    inventory.add(cert)
-    # Save the now-signed cert.  This should get routed correctly depending
-    # on the certificate type.
-    Puppet::SSL::Certificate.indirection.save(cert)
-    # And remove the CSR if this wasn't self signed.
-    Puppet::SSL::CertificateRequest.indirection.destroy(csr.name) unless self_signing_csr
-    cert
-  end
-  def check_internal_signing_policies(hostname, csr, allow_dns_alt_names)
-    # Reject unknown request extensions.
-    unknown_req = csr.request_extensions.reject do |x|
-      RequestExtensionWhitelist.include? x["oid"] or
-        Puppet::SSL::Oids.subtree_of?('ppRegCertExt', x["oid"], true) or
-        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', x["oid"], true)
-    end
-    if unknown_req and not unknown_req.empty?
-      names = unknown_req.map {|x| x["oid"] }.sort.uniq.join(", ")
-      raise CertificateSigningError.new(hostname), "CSR has request extensions that are not permitted: #{names}"
-    end
-    # Do not sign misleading CSRs
-    cn = csr.content.subject.to_a.assoc("CN")[1]
-    if hostname != cn
-      raise CertificateSigningError.new(hostname), "CSR subject common name #{cn.inspect} does not match expected certname #{hostname.inspect}"
-    end
-    if hostname !~ Puppet::SSL::Base::VALID_CERTNAME
-      raise CertificateSigningError.new(hostname), "CSR #{hostname.inspect} subject contains unprintable or non-ASCII characters"
-    end
-    # Wildcards: we don't allow 'em at any point.
-    #
-    # The stringification here makes the content visible, and saves us having
-    # to scrobble through the content of the CSR subject field to make sure it
-    # is what we expect where we expect it.
-    if csr.content.subject.to_s.include? '*'
-      raise CertificateSigningError.new(hostname), "CSR subject contains a wildcard, which is not allowed: #{csr.content.subject.to_s}"
-    end
-    unless csr.content.verify(csr.content.public_key)
-      raise CertificateSigningError.new(hostname), "CSR contains a public key that does not correspond to the signing key"
-    end
-    unless csr.subject_alt_names.empty?
-      # If you alt names are allowed, they are required. Otherwise they are
-      # disallowed. Self-signed certs are implicitly trusted, however.
-      unless allow_dns_alt_names
-        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains subject alternative names (#{csr.subject_alt_names.join(', ')}), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{csr.name}` to sign this request."
-      end
-      # If subjectAltNames are present, validate that they are only for DNS
-      # labels, not any other kind.
-      unless csr.subject_alt_names.all? {|x| x =~ /^DNS:/ }
-        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains a subjectAltName outside the DNS label space: #{csr.subject_alt_names.join(', ')}.  To continue, this CSR needs to be cleaned."
-      end
-      # Check for wildcards in the subjectAltName fields too.
-      if csr.subject_alt_names.any? {|x| x.include? '*' }
-        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' subjectAltName contains a wildcard, which is not allowed: #{csr.subject_alt_names.join(', ')}  To continue, this CSR needs to be cleaned."
-      end
-    end
-    return true                 # good enough for us!
-  end
-  # Utility method for optionally caching the X509 Store for verifying a
-  # large number of certificates in a short amount of time--exactly the
-  # case we have during PE license checking.
-  #
-  # @example Use the cached X509 store
-  #   x509store(:cache => true)
-  #
-  # @example Use a freshly create X509 store
-  #   x509store
-  #   x509store(:cache => false)
-  #
-  # @param [Hash] options the options used for retrieving the X509 Store
-  # @option options [Boolean] :cache whether or not to use a cached version
-  #   of the X509 Store
-  #
-  # @return [OpenSSL::X509::Store]
-  def x509_store(options = {})
-    if (options[:cache])
-      return @x509store unless @x509store.nil?
-      @x509store = create_x509_store
-    else
-      create_x509_store
-    end
-  end
-  private :x509_store
-  # Creates a brand new OpenSSL::X509::Store with the appropriate
-  # Certificate Revocation List and flags
-  #
-  # @return [OpenSSL::X509::Store]
-  def create_x509_store
-    store = OpenSSL::X509::Store.new()
-    store.add_file(Puppet[:cacert])
-    store.add_crl(crl.content) if self.crl
-    store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
-    if Puppet.settings[:certificate_revocation]
-      store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL | OpenSSL::X509::V_FLAG_CRL_CHECK
-    end
-    store
-  end
-  private :create_x509_store
-  # Utility method which is API for PE license checking.
-  # This is used rather than `verify` because
-  #  1) We have already read the certificate from disk into memory.
-  #     To read the certificate from disk again is just wasteful.
-  #  2) Because we're checking a large number of certificates against
-  #     a transient CertificateAuthority, we can relatively safely cache
-  #     the X509 Store that actually does the verification.
-  #
-  # Long running instances of CertificateAuthority will certainly
-  # want to use `verify` because it will recreate the X509 Store with
-  # the absolutely latest CRL.
-  #
-  # Additionally, this method explicitly returns a boolean whereas
-  # `verify` will raise an error if the certificate has been revoked.
-  #
-  # @author Jeff Weiss <jeff.weiss@puppetlabs.com>
-  # @api Puppet Enterprise Licensing
-  #
-  # @param cert [Puppet::SSL::Certificate] the certificate to check validity of
-  #
-  # @return [Boolean] true if signed, false if unsigned or revoked
-  def certificate_is_alive?(cert)
-    x509_store(:cache => true).verify(cert.content)
-  end
-  # Verify a given host's certificate. The certname is passed in, and
-  # the indirector will be used to locate the actual contents of the
-  # certificate with that name.
-  #
-  # @param name [String] certificate name to verify
-  #
-  # @raise [ArgumentError] if the certificate name cannot be found
-  #   (i.e. doesn't exist or is unsigned)
-  # @raise [CertificateVerficationError] if the certificate has been revoked
-  #
-  # @return [Boolean] true if signed, there are no cases where false is returned
-  def verify(name)
-    unless cert = Puppet::SSL::Certificate.indirection.find(name)
-      raise ArgumentError, "Could not find a certificate for #{name}"
-    end
-    store = x509_store
-    raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
-  end
-  def fingerprint(name, md = :SHA256)
-    unless cert = Puppet::SSL::Certificate.indirection.find(name) || Puppet::SSL::CertificateRequest.indirection.find(name)
-      raise ArgumentError, "Could not find a certificate or csr for #{name}"
-    end
-    cert.fingerprint(md)
-  end
-  # List the waiting certificate requests.
-  def waiting?
-    Puppet::SSL::CertificateRequest.indirection.search("*").collect { |r| r.name }
-  end
-  # @api private
-  class AutosignAlways
-    def allowed?(csr)
-      true
-    end
-  end
-  # @api private
-  class AutosignNever
-    def allowed?(csr)
-      false
-    end
-  end
-  # @api private
-  class AutosignConfig
-    def initialize(config_file)
-      @config = config_file
-    end
-    def allowed?(csr)
-      autosign_store.allowed?(csr.name, '127.1.1.1')
-    end
-    private
-    def autosign_store
-      auth = Puppet::Network::AuthStore.new
-      Puppet::FileSystem.each_line(@config) do |line|
-        next if line =~ /^\s*#/
-        next if line =~ /^\s*$/
-        auth.allow(line.chomp)
-      end
-      auth
-    end
-  end
-end