puppet 0.25.5 → 2.6.0

data/lib/puppet/ssl/inventory.rb

@@ -3,50 +3,50 @@ require 'puppet/ssl/certificate'
 
 # Keep track of all of our known certificates.
 class Puppet::SSL::Inventory
-    attr_reader :path
+  attr_reader :path
 
-    # Add a certificate to our inventory.
-    def add(cert)
-        cert = cert.content if cert.is_a?(Puppet::SSL::Certificate)
+  # Add a certificate to our inventory.
+  def add(cert)
+    cert = cert.content if cert.is_a?(Puppet::SSL::Certificate)
 
-        # Create our file, if one does not already exist.
-        rebuild unless FileTest.exist?(@path)
+    # Create our file, if one does not already exist.
+    rebuild unless FileTest.exist?(@path)
 
-        Puppet.settings.write(:cert_inventory, "a") do |f|
-            f.print format(cert)
-        end
+    Puppet.settings.write(:cert_inventory, "a") do |f|
+      f.print format(cert)
     end
+  end
 
-    # Format our certificate for output.
-    def format(cert)
-        iso = '%Y-%m-%dT%H:%M:%S%Z'
-        return "0x%04x %s %s %s\n" % [cert.serial,  cert.not_before.strftime(iso), cert.not_after.strftime(iso), cert.subject]
-    end
-
-    def initialize
-        @path = Puppet[:cert_inventory]
-    end
+  # Format our certificate for output.
+  def format(cert)
+    iso = '%Y-%m-%dT%H:%M:%S%Z'
+    "0x%04x %s %s %s\n" % [cert.serial,  cert.not_before.strftime(iso), cert.not_after.strftime(iso), cert.subject]
+  end
 
-    # Rebuild the inventory from scratch.  This should happen if
-    # the file is entirely missing or if it's somehow corrupted.
-    def rebuild
-        Puppet.notice "Rebuilding inventory file"
+  def initialize
+    @path = Puppet[:cert_inventory]
+  end
 
-        Puppet.settings.write(:cert_inventory) do |f|
-            f.print "# Inventory of signed certificates\n# SERIAL NOT_BEFORE NOT_AFTER SUBJECT\n"
-        end
+  # Rebuild the inventory from scratch.  This should happen if
+  # the file is entirely missing or if it's somehow corrupted.
+  def rebuild
+    Puppet.notice "Rebuilding inventory file"
 
-        Puppet::SSL::Certificate.search("*").each { |cert| add(cert) }
+    Puppet.settings.write(:cert_inventory) do |f|
+      f.print "# Inventory of signed certificates\n# SERIAL NOT_BEFORE NOT_AFTER SUBJECT\n"
     end
 
-    # Find the serial number for a given certificate.
-    def serial(name)
-        return nil unless FileTest.exist?(@path)
+    Puppet::SSL::Certificate.search("*").each { |cert| add(cert) }
+  end
+
+  # Find the serial number for a given certificate.
+  def serial(name)
+    return nil unless FileTest.exist?(@path)
 
-        File.readlines(@path).each do |line|
-            next unless line =~ /^(\S+).+\/CN=#{name}$/
+    File.readlines(@path).each do |line|
+      next unless line =~ /^(\S+).+\/CN=#{name}$/
 
-            return Integer($1)
-        end
+      return Integer($1)
     end
+  end
 end

data/lib/puppet/ssl/key.rb

@@ -3,54 +3,54 @@ require 'puppet/indirector'
 
 # Manage private and public keys as a pair.
 class Puppet::SSL::Key < Puppet::SSL::Base
-    wraps OpenSSL::PKey::RSA
+  wraps OpenSSL::PKey::RSA
 
-    extend Puppet::Indirector
-    indirects :key, :terminus_class => :file
+  extend Puppet::Indirector
+  indirects :key, :terminus_class => :file
 
-    # Because of how the format handler class is included, this
-    # can't be in the base class.
-    def self.supported_formats
-        [:s]
-    end
+  # Because of how the format handler class is included, this
+  # can't be in the base class.
+  def self.supported_formats
+    [:s]
+  end
 
-    attr_accessor :password_file
+  attr_accessor :password_file
 
-    # Knows how to create keys with our system defaults.
-    def generate
-        Puppet.info "Creating a new SSL key for %s" % name
-        @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
-    end
+  # Knows how to create keys with our system defaults.
+  def generate
+    Puppet.info "Creating a new SSL key for #{name}"
+    @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
+  end
 
-    def initialize(name)
-        super
+  def initialize(name)
+    super
 
-        if ca?
-            @password_file = Puppet[:capass]
-        else
-            @password_file = Puppet[:passfile]
-        end
+    if ca?
+      @password_file = Puppet[:capass]
+    else
+      @password_file = Puppet[:passfile]
     end
+  end
 
-    def password
-        return nil unless password_file and FileTest.exist?(password_file)
+  def password
+    return nil unless password_file and FileTest.exist?(password_file)
 
-        ::File.read(password_file)
-    end
+    ::File.read(password_file)
+  end
 
-    # Optionally support specifying a password file.
-    def read(path)
-        return super unless password_file
+  # Optionally support specifying a password file.
+  def read(path)
+    return super unless password_file
 
-        #@content = wrapped_class.new(::File.read(path), password)
-        @content = wrapped_class.new(::File.read(path), password)
-    end
+    #@content = wrapped_class.new(::File.read(path), password)
+    @content = wrapped_class.new(::File.read(path), password)
+  end
 
-    def to_s
-        if pass = password
-            @content.export(OpenSSL::Cipher::DES.new(:EDE3, :CBC), pass)
-        else
-            return super
-        end
+  def to_s
+    if pass = password
+      @content.export(OpenSSL::Cipher::DES.new(:EDE3, :CBC), pass)
+    else
+      return super
     end
+  end
 end

data/lib/puppet/sslcertificates.rb

@@ -5,141 +5,142 @@ require 'puppet'
 raise Puppet::Error, "You must have the Ruby openssl library installed" unless Puppet.features.openssl?
 
 module Puppet::SSLCertificates
-    #def self.mkcert(type, name, dnsnames, ttl, issuercert, issuername, serial, publickey)
-    def self.mkcert(hash)
-        [:type, :name, :ttl, :issuer, :serial, :publickey].each { |param|
-            unless hash.include?(param)
-                raise ArgumentError, "mkcert called without %s" % param
-            end
-        }
-
-        cert = OpenSSL::X509::Certificate.new
-        # Make the certificate valid as of yesterday, because
-        # so many people's clocks are out of sync.
-        from = Time.now - (60*60*24)
-
-        cert.subject = hash[:name]
-        if hash[:issuer]
-            cert.issuer = hash[:issuer].subject
-        else
-            # we're a self-signed cert
-            cert.issuer = hash[:name]
-        end
-        cert.not_before = from
-        cert.not_after = from + hash[:ttl]
-        cert.version = 2 # X509v3
-
-        cert.public_key = hash[:publickey]
-        cert.serial = hash[:serial]
-
-        basic_constraint = nil
-        key_usage = nil
-        ext_key_usage = nil
-        subject_alt_name = []
-
-        ef = OpenSSL::X509::ExtensionFactory.new
-
-        ef.subject_certificate = cert
-
-        if hash[:issuer]
-            ef.issuer_certificate = hash[:issuer]
-        else
-            ef.issuer_certificate = cert
-        end
-
-        ex = []
-        case hash[:type]
-        when :ca
-            basic_constraint = "CA:TRUE"
-            key_usage = %w{cRLSign keyCertSign}
-        when :terminalsubca
-            basic_constraint = "CA:TRUE,pathlen:0"
-            key_usage = %w{cRLSign keyCertSign}
-        when :server
-            basic_constraint = "CA:FALSE"
-            dnsnames = Puppet[:certdnsnames]
-            name = hash[:name].to_s.sub(%r{/CN=},'')
-            if dnsnames != ""
-                dnsnames.split(':').each { |d| subject_alt_name << 'DNS:' + d }
-                subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
-            elsif name == Facter.value(:fqdn) # we're a CA server, and thus probably the server
-                subject_alt_name << 'DNS:' + "puppet" # Add 'puppet' as an alias
-                subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
-                subject_alt_name << 'DNS:' + name.sub(/^[^.]+./, "puppet.") # add puppet.domain as an alias
-            end
-            key_usage = %w{digitalSignature keyEncipherment}
-            ext_key_usage = %w{serverAuth clientAuth emailProtection}
-        when :ocsp
-            basic_constraint = "CA:FALSE"
-            key_usage = %w{nonRepudiation digitalSignature}
-            ext_key_usage = %w{serverAuth OCSPSigning}
-        when :client
-            basic_constraint = "CA:FALSE"
-            key_usage = %w{nonRepudiation digitalSignature keyEncipherment}
-            ext_key_usage = %w{clientAuth emailProtection}
-            ex << ef.create_extension("nsCertType", "client,email")
-        else
-            raise Puppet::Error, "unknown cert type '%s'" % hash[:type]
-        end
+  #def self.mkcert(type, name, dnsnames, ttl, issuercert, issuername, serial, publickey)
+  def self.mkcert(hash)
+    [:type, :name, :ttl, :issuer, :serial, :publickey].each { |param|
+      raise ArgumentError, "mkcert called without #{param}" unless hash.include?(param)
+    }
+
+    cert = OpenSSL::X509::Certificate.new
+    # Make the certificate valid as of yesterday, because
+    # so many people's clocks are out of sync.
+    from = Time.now - (60*60*24)
+
+    cert.subject = hash[:name]
+    if hash[:issuer]
+      cert.issuer = hash[:issuer].subject
+    else
+      # we're a self-signed cert
+      cert.issuer = hash[:name]
+    end
+    cert.not_before = from
+    cert.not_after = from + hash[:ttl]
+    cert.version = 2 # X509v3
 
-        ex << ef.create_extension("nsComment",
-                                  "Puppet Ruby/OpenSSL Generated Certificate")
-        ex << ef.create_extension("basicConstraints", basic_constraint, true)
-        ex << ef.create_extension("subjectKeyIdentifier", "hash")
+    cert.public_key = hash[:publickey]
+    cert.serial = hash[:serial]
 
-        ex << ef.create_extension("keyUsage", key_usage.join(",")) if key_usage
-        ex << ef.create_extension("extendedKeyUsage", ext_key_usage.join(",")) if ext_key_usage
-        ex << ef.create_extension("subjectAltName", subject_alt_name.join(",")) if ! subject_alt_name.empty?
+    basic_constraint = nil
+    key_usage = nil
+    ext_key_usage = nil
+    subject_alt_name = []
 
-        #if @ca_config[:cdp_location] then
-        #  ex << ef.create_extension("crlDistributionPoints",
-        #                            @ca_config[:cdp_location])
-        #end
+    ef = OpenSSL::X509::ExtensionFactory.new
 
-        #if @ca_config[:ocsp_location] then
-        #  ex << ef.create_extension("authorityInfoAccess",
-        #                            "OCSP;" << @ca_config[:ocsp_location])
-        #end
-        cert.extensions = ex
+    ef.subject_certificate = cert
 
-        # for some reason this _must_ be the last extension added
-        ex << ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") if hash[:type] == :ca
+    if hash[:issuer]
+      ef.issuer_certificate = hash[:issuer]
+    else
+      ef.issuer_certificate = cert
+    end
 
-        return cert
+    ex = []
+    case hash[:type]
+    when :ca
+      basic_constraint = "CA:TRUE"
+      key_usage = %w{cRLSign keyCertSign}
+    when :terminalsubca
+      basic_constraint = "CA:TRUE,pathlen:0"
+      key_usage = %w{cRLSign keyCertSign}
+    when :server
+      basic_constraint = "CA:FALSE"
+      dnsnames = Puppet[:certdnsnames]
+      name = hash[:name].to_s.sub(%r{/CN=},'')
+      if dnsnames != ""
+        dnsnames.split(':').each { |d| subject_alt_name << 'DNS:' + d }
+        subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+      elsif name == Facter.value(:fqdn) # we're a CA server, and thus probably the server
+        subject_alt_name << 'DNS:' + "puppet" # Add 'puppet' as an alias
+        subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+        subject_alt_name << 'DNS:' + name.sub(/^[^.]+./, "puppet.") # add puppet.domain as an alias
+      end
+      key_usage = %w{digitalSignature keyEncipherment}
+      ext_key_usage = %w{serverAuth clientAuth emailProtection}
+    when :ocsp
+      basic_constraint = "CA:FALSE"
+      key_usage = %w{nonRepudiation digitalSignature}
+      ext_key_usage = %w{serverAuth OCSPSigning}
+    when :client
+      basic_constraint = "CA:FALSE"
+      key_usage = %w{nonRepudiation digitalSignature keyEncipherment}
+      ext_key_usage = %w{clientAuth emailProtection}
+      ex << ef.create_extension("nsCertType", "client,email")
+    else
+      raise Puppet::Error, "unknown cert type '#{hash[:type]}'"
     end
 
-    def self.mkhash(dir, cert, certfile)
-        # Make sure the hash is zero-padded to 8 chars
-        hash = "%08x" % cert.issuer.hash
-        hashpath = nil
-        10.times { |i|
-            path = File.join(dir, "%s.%s" % [hash, i])
-            if FileTest.exists?(path)
-                if FileTest.symlink?(path)
-                    dest = File.readlink(path)
-                    if dest == certfile
-                        # the correct link already exists
-                        hashpath = path
-                        break
-                    else
-                        next
-                    end
-                else
-                    next
-                end
-            end
-
-            File.symlink(certfile, path)
 
+      ex << ef.create_extension(
+        "nsComment",
+
+          "Puppet Ruby/OpenSSL Generated Certificate")
+    ex << ef.create_extension("basicConstraints", basic_constraint, true)
+    ex << ef.create_extension("subjectKeyIdentifier", "hash")
+
+    ex << ef.create_extension("keyUsage", key_usage.join(",")) if key_usage
+    ex << ef.create_extension("extendedKeyUsage", ext_key_usage.join(",")) if ext_key_usage
+    ex << ef.create_extension("subjectAltName", subject_alt_name.join(",")) if ! subject_alt_name.empty?
+
+    #if @ca_config[:cdp_location] then
+    #  ex << ef.create_extension("crlDistributionPoints",
+    #                            @ca_config[:cdp_location])
+    #end
+
+    #if @ca_config[:ocsp_location] then
+    #  ex << ef.create_extension("authorityInfoAccess",
+    #                            "OCSP;" << @ca_config[:ocsp_location])
+    #end
+    cert.extensions = ex
+
+    # for some reason this _must_ be the last extension added
+    ex << ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") if hash[:type] == :ca
+
+    cert
+  end
+
+  def self.mkhash(dir, cert, certfile)
+    # Make sure the hash is zero-padded to 8 chars
+    hash = "%08x" % cert.issuer.hash
+    hashpath = nil
+    10.times { |i|
+      path = File.join(dir, "#{hash}.#{i}")
+      if FileTest.exists?(path)
+        if FileTest.symlink?(path)
+          dest = File.readlink(path)
+          if dest == certfile
+            # the correct link already exists
             hashpath = path
             break
-        }
+          else
+            next
+          end
+        else
+          next
+        end
+      end
 
+      File.symlink(certfile, path)
 
-        return hashpath
-    end
-    require 'puppet/sslcertificates/certificate'
-    require 'puppet/sslcertificates/inventory'
-    require 'puppet/sslcertificates/ca'
+      hashpath = path
+      break
+    }
+
+
+    hashpath
+  end
+  require 'puppet/sslcertificates/certificate'
+  require 'puppet/sslcertificates/inventory'
+  require 'puppet/sslcertificates/ca'
 end
 

data/lib/puppet/sslcertificates/ca.rb

@@ -1,398 +1,381 @@
 require 'sync'
 
 class Puppet::SSLCertificates::CA
-    include Puppet::Util::Warnings
+  include Puppet::Util::Warnings
 
-    Certificate = Puppet::SSLCertificates::Certificate
-    attr_accessor :keyfile, :file, :config, :dir, :cert, :crl
+  Certificate = Puppet::SSLCertificates::Certificate
+  attr_accessor :keyfile, :file, :config, :dir, :cert, :crl
 
-    def certfile
-        @config[:cacert]
-    end
+  def certfile
+    @config[:cacert]
+  end
+
+  # Remove all traces of a given host.  This is kind of hackish, but, eh.
+  def clean(host)
+    host = host.downcase
+    [:csrdir, :signeddir, :publickeydir, :privatekeydir, :certdir].each do |name|
+      dir = Puppet[name]
 
-    # Remove all traces of a given host.  This is kind of hackish, but, eh.
-    def clean(host)
-        host = host.downcase
-        [:csrdir, :signeddir, :publickeydir, :privatekeydir, :certdir].each do |name|
-            dir = Puppet[name]
-
-            file = File.join(dir, host + ".pem")
-
-            if FileTest.exists?(file)
-                begin
-                    if Puppet[:name] == "puppetca"
-                        puts "Removing %s" % file
-                    else
-                        Puppet.info "Removing %s" % file
-                    end
-                    File.unlink(file)
-                rescue => detail
-                    raise Puppet::Error, "Could not delete %s: %s" %
-                        [file, detail]
-                end
-            end
+      file = File.join(dir, host + ".pem")
 
+      if FileTest.exists?(file)
+        begin
+          if Puppet[:name] == "cert"
+            puts "Removing #{file}"
+          else
+            Puppet.info "Removing #{file}"
+          end
+          File.unlink(file)
+        rescue => detail
+          raise Puppet::Error, "Could not delete #{file}: #{detail}"
         end
-    end
+      end
 
-    def host2csrfile(hostname)
-        File.join(Puppet[:csrdir], [hostname.downcase, "pem"].join("."))
     end
-
-    # this stores signed certs in a directory unrelated to
-    # normal client certs
-    def host2certfile(hostname)
-        File.join(Puppet[:signeddir], [hostname.downcase, "pem"].join("."))
+  end
+
+  def host2csrfile(hostname)
+    File.join(Puppet[:csrdir], [hostname.downcase, "pem"].join("."))
+  end
+
+  # this stores signed certs in a directory unrelated to
+  # normal client certs
+  def host2certfile(hostname)
+    File.join(Puppet[:signeddir], [hostname.downcase, "pem"].join("."))
+  end
+
+  # Turn our hostname into a Name object
+  def thing2name(thing)
+    thing.subject.to_a.find { |ary|
+      ary[0] == "CN"
+    }[1]
+  end
+
+  def initialize(hash = {})
+    Puppet.settings.use(:main, :ca, :ssl)
+    self.setconfig(hash)
+
+    if Puppet[:capass]
+      if FileTest.exists?(Puppet[:capass])
+        #puts "Reading #{Puppet[:capass]}"
+        #system "ls -al #{Puppet[:capass]}"
+        #File.read Puppet[:capass]
+        @config[:password] = self.getpass
+      else
+        # Don't create a password if the cert already exists
+        @config[:password] = self.genpass unless FileTest.exists?(@config[:cacert])
+      end
     end
 
-    # Turn our hostname into a Name object
-    def thing2name(thing)
-        thing.subject.to_a.find { |ary|
-            ary[0] == "CN"
-        }[1]
+    self.getcert
+    init_crl
+    unless FileTest.exists?(@config[:serial])
+      Puppet.settings.write(:serial) do |f|
+        f << "%04X" % 1
+      end
     end
+  end
 
-    def initialize(hash = {})
-        Puppet.settings.use(:main, :ca, :ssl)
-        self.setconfig(hash)
-
-        if Puppet[:capass]
-            if FileTest.exists?(Puppet[:capass])
-                #puts "Reading %s" % Puppet[:capass]
-                #system "ls -al %s" % Puppet[:capass]
-                #File.read Puppet[:capass]
-                @config[:password] = self.getpass
-            else
-                # Don't create a password if the cert already exists
-                unless FileTest.exists?(@config[:cacert])
-                    @config[:password] = self.genpass
-                end
-            end
-        end
+  # Generate a new password for the CA.
+  def genpass
+    pass = ""
+    20.times { pass += (rand(74) + 48).chr }
 
-        self.getcert
-        init_crl
-        unless FileTest.exists?(@config[:serial])
-            Puppet.settings.write(:serial) do |f|
-                f << "%04X" % 1
-            end
-        end
+    begin
+      Puppet.settings.write(:capass) { |f| f.print pass }
+    rescue Errno::EACCES => detail
+      raise Puppet::Error, detail.to_s
     end
-
-    # Generate a new password for the CA.
-    def genpass
-        pass = ""
-        20.times { pass += (rand(74) + 48).chr }
-
-        begin
-            Puppet.settings.write(:capass) { |f| f.print pass }
-        rescue Errno::EACCES => detail
-            raise Puppet::Error, detail.to_s
-        end
-        return pass
+    pass
+  end
+
+  # Get the CA password.
+  def getpass
+    if @config[:capass] and File.readable?(@config[:capass])
+      return File.read(@config[:capass])
+    else
+      raise Puppet::Error, "Could not decrypt CA key with password: #{detail}"
     end
-
-    # Get the CA password.
-    def getpass
-        if @config[:capass] and File.readable?(@config[:capass])
-            return File.read(@config[:capass])
-        else
-            raise Puppet::Error, "Could not decrypt CA key with password: %s" % detail
-        end
+  end
+
+  # Get the CA cert.
+  def getcert
+    if FileTest.exists?(@config[:cacert])
+      @cert = OpenSSL::X509::Certificate.new(
+        File.read(@config[:cacert])
+      )
+    else
+      self.mkrootcert
     end
-
-    # Get the CA cert.
-    def getcert
-        if FileTest.exists?(@config[:cacert])
-            @cert = OpenSSL::X509::Certificate.new(
-                File.read(@config[:cacert])
-            )
-        else
-            self.mkrootcert
-        end
+  end
+
+  # Retrieve a client's CSR.
+  def getclientcsr(host)
+    csrfile = host2csrfile(host)
+    return nil unless File.exists?(csrfile)
+
+    OpenSSL::X509::Request.new(File.read(csrfile))
+  end
+
+  # Retrieve a client's certificate.
+  def getclientcert(host)
+    certfile = host2certfile(host)
+    return [nil, nil] unless File.exists?(certfile)
+
+    [OpenSSL::X509::Certificate.new(File.read(certfile)), @cert]
+  end
+
+  # List certificates waiting to be signed.  This returns a list of hostnames, not actual
+  # files -- the names can be converted to full paths with host2csrfile.
+  def list(dummy_argument=:work_arround_for_ruby_GC_bug)
+    return Dir.entries(Puppet[:csrdir]).find_all { |file|
+      file =~ /\.pem$/
+    }.collect { |file|
+      file.sub(/\.pem$/, '')
+    }
+  end
+
+  # List signed certificates.  This returns a list of hostnames, not actual
+  # files -- the names can be converted to full paths with host2csrfile.
+  def list_signed(dummy_argument=:work_arround_for_ruby_GC_bug)
+    return Dir.entries(Puppet[:signeddir]).find_all { |file|
+      file =~ /\.pem$/
+    }.collect { |file|
+      file.sub(/\.pem$/, '')
+    }
+  end
+
+  # Create the root certificate.
+  def mkrootcert
+    # Make the root cert's name the FQDN of the host running the CA.
+    name = Facter["hostname"].value
+    if domain = Facter["domain"].value
+      name += ".#{domain}"
     end
 
-    # Retrieve a client's CSR.
-    def getclientcsr(host)
-        csrfile = host2csrfile(host)
-        unless File.exists?(csrfile)
-            return nil
-        end
-
-        return OpenSSL::X509::Request.new(File.read(csrfile))
+          cert = Certificate.new(
+                
+      :name => name,
+      :cert => @config[:cacert],
+      :encrypt => @config[:capass],
+      :key => @config[:cakey],
+      :selfsign => true,
+      :ttl => ttl,
+        
+      :type => :ca
+    )
+
+    # This creates the cakey file
+    Puppet::Util::SUIDManager.asuser(Puppet[:user], Puppet[:group]) do
+      @cert = cert.mkselfsigned
     end
-
-    # Retrieve a client's certificate.
-    def getclientcert(host)
-        certfile = host2certfile(host)
-        unless File.exists?(certfile)
-            return [nil, nil]
-        end
-
-        return [OpenSSL::X509::Certificate.new(File.read(certfile)), @cert]
+    Puppet.settings.write(:cacert) do |f|
+      f.puts @cert.to_pem
     end
-
-    # List certificates waiting to be signed.  This returns a list of hostnames, not actual
-    # files -- the names can be converted to full paths with host2csrfile.
-    def list(dummy_argument=:work_arround_for_ruby_GC_bug)
-        return Dir.entries(Puppet[:csrdir]).find_all { |file|
-            file =~ /\.pem$/
-        }.collect { |file|
-            file.sub(/\.pem$/, '')
-        }
+    Puppet.settings.write(:capub) do |f|
+      f.puts @cert.public_key
     end
-
-    # List signed certificates.  This returns a list of hostnames, not actual
-    # files -- the names can be converted to full paths with host2csrfile.
-    def list_signed(dummy_argument=:work_arround_for_ruby_GC_bug)
-        return Dir.entries(Puppet[:signeddir]).find_all { |file|
-            file =~ /\.pem$/
-        }.collect { |file|
-            file.sub(/\.pem$/, '')
-        }
+    cert
+  end
+
+  def removeclientcsr(host)
+    csrfile = host2csrfile(host)
+    raise Puppet::Error, "No certificate request for #{host}" unless File.exists?(csrfile)
+
+    File.unlink(csrfile)
+  end
+
+  # Revoke the certificate with serial number SERIAL issued by this
+  # CA. The REASON must be one of the OpenSSL::OCSP::REVOKED_* reasons
+  def revoke(serial, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
+    time = Time.now
+    revoked = OpenSSL::X509::Revoked.new
+    revoked.serial = serial
+    revoked.time = time
+    enum = OpenSSL::ASN1::Enumerated(reason)
+    ext = OpenSSL::X509::Extension.new("CRLReason", enum)
+    revoked.add_extension(ext)
+    @crl.add_revoked(revoked)
+    store_crl
+  end
+
+  # Take the Puppet config and store it locally.
+  def setconfig(hash)
+    @config = {}
+    Puppet.settings.params("ca").each { |param|
+      param = param.intern if param.is_a? String
+      if hash.include?(param)
+        @config[param] = hash[param]
+        Puppet[param] = hash[param]
+        hash.delete(param)
+      else
+        @config[param] = Puppet[param]
+      end
+    }
+
+    if hash.include?(:password)
+      @config[:password] = hash[:password]
+      hash.delete(:password)
     end
 
-    # Create the root certificate.
-    def mkrootcert
-        # Make the root cert's name the FQDN of the host running the CA.
-        name = Facter["hostname"].value
-        if domain = Facter["domain"].value
-            name += "." + domain
-        end
-        cert = Certificate.new(
-            :name => name,
-            :cert => @config[:cacert],
-            :encrypt => @config[:capass],
-            :key => @config[:cakey],
-            :selfsign => true,
-            :ttl => ttl,
-            :type => :ca
-        )
+    raise ArgumentError, "Unknown parameters #{hash.keys.join(",")}" if hash.length > 0
 
-        # This creates the cakey file
-        Puppet::Util::SUIDManager.asuser(Puppet[:user], Puppet[:group]) do
-            @cert = cert.mkselfsigned
-        end
-        Puppet.settings.write(:cacert) do |f|
-            f.puts @cert.to_pem
-        end
-        Puppet.settings.write(:capub) do |f|
-            f.puts @cert.public_key
-        end
-        return cert
-    end
+    [:cadir, :csrdir, :signeddir].each { |dir|
+      raise Puppet::DevError, "#{dir} is undefined" unless @config[dir]
+    }
+  end
 
-    def removeclientcsr(host)
-        csrfile = host2csrfile(host)
-        unless File.exists?(csrfile)
-            raise Puppet::Error, "No certificate request for %s" % host
-        end
-
-        File.unlink(csrfile)
+  # Sign a given certificate request.
+  def sign(csr)
+    unless csr.is_a?(OpenSSL::X509::Request)
+      raise Puppet::Error,
+        "CA#sign only accepts OpenSSL::X509::Request objects, not #{csr.class}"
     end
 
-    # Revoke the certificate with serial number SERIAL issued by this
-    # CA. The REASON must be one of the OpenSSL::OCSP::REVOKED_* reasons
-    def revoke(serial, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
-        time = Time.now
-        revoked = OpenSSL::X509::Revoked.new
-        revoked.serial = serial
-        revoked.time = time
-        enum = OpenSSL::ASN1::Enumerated(reason)
-        ext = OpenSSL::X509::Extension.new("CRLReason", enum)
-        revoked.add_extension(ext)
-        @crl.add_revoked(revoked)
-        store_crl
-    end
+    raise Puppet::Error, "CSR sign verification failed" unless csr.verify(csr.public_key)
 
-    # Take the Puppet config and store it locally.
-    def setconfig(hash)
-        @config = {}
-        Puppet.settings.params("ca").each { |param|
-            param = param.intern if param.is_a? String
-            if hash.include?(param)
-                @config[param] = hash[param]
-                Puppet[param] = hash[param]
-                hash.delete(param)
-            else
-                @config[param] = Puppet[param]
-            end
-        }
-
-        if hash.include?(:password)
-            @config[:password] = hash[:password]
-            hash.delete(:password)
-        end
+    serial = nil
+    Puppet.settings.readwritelock(:serial) { |f|
+      serial = File.read(@config[:serial]).chomp.hex
+      # increment the serial
+      f << "%04X" % (serial + 1)
+    }
 
-        if hash.length > 0
-            raise ArgumentError, "Unknown parameters %s" % hash.keys.join(",")
-        end
 
-        [:cadir, :csrdir, :signeddir].each { |dir|
-            unless @config[dir]
-                raise Puppet::DevError, "%s is undefined" % dir
-            end
-        }
-    end
+          newcert = Puppet::SSLCertificates.mkcert(
+                
+      :type => :server,
+      :name => csr.subject,
+      :ttl => ttl,
+      :issuer => @cert,
+      :serial => serial,
+        
+      :publickey => csr.public_key
+    )
 
-    # Sign a given certificate request.
-    def sign(csr)
-        unless csr.is_a?(OpenSSL::X509::Request)
-            raise Puppet::Error,
-                "CA#sign only accepts OpenSSL::X509::Request objects, not %s" %
-                csr.class
-        end
 
-        unless csr.verify(csr.public_key)
-            raise Puppet::Error, "CSR sign verification failed"
-        end
+    sign_with_key(newcert)
 
-        serial = nil
-        Puppet.settings.readwritelock(:serial) { |f|
-            serial = File.read(@config[:serial]).chomp.hex
-            # increment the serial
-            f << "%04X" % (serial + 1)
-        }
-
-        newcert = Puppet::SSLCertificates.mkcert(
-            :type => :server,
-            :name => csr.subject,
-            :ttl => ttl,
-            :issuer => @cert,
-            :serial => serial,
-            :publickey => csr.public_key
-        )
+    self.storeclientcert(newcert)
 
+    [newcert, @cert]
+  end
 
-        sign_with_key(newcert)
+  # Store the client's CSR for later signing.  This is called from
+  # server/ca.rb, and the CSRs are deleted once the certificate is actually
+  # signed.
+  def storeclientcsr(csr)
+    host = thing2name(csr)
 
-        self.storeclientcert(newcert)
+    csrfile = host2csrfile(host)
+    raise Puppet::Error, "Certificate request for #{host} already exists" if File.exists?(csrfile)
 
-        return [newcert, @cert]
+    Puppet.settings.writesub(:csrdir, csrfile) do |f|
+      f.print csr.to_pem
     end
+  end
 
-    # Store the client's CSR for later signing.  This is called from
-    # server/ca.rb, and the CSRs are deleted once the certificate is actually
-    # signed.
-    def storeclientcsr(csr)
-        host = thing2name(csr)
+  # Store the certificate that we generate.
+  def storeclientcert(cert)
+    host = thing2name(cert)
 
-        csrfile = host2csrfile(host)
-        if File.exists?(csrfile)
-            raise Puppet::Error, "Certificate request for %s already exists" % host
-        end
+    certfile = host2certfile(host)
+    Puppet.notice "Overwriting signed certificate #{certfile} for #{host}" if File.exists?(certfile)
 
-        Puppet.settings.writesub(:csrdir, csrfile) do |f|
-            f.print csr.to_pem
-        end
+    Puppet::SSLCertificates::Inventory::add(cert)
+    Puppet.settings.writesub(:signeddir, certfile) do |f|
+      f.print cert.to_pem
     end
-
-    # Store the certificate that we generate.
-    def storeclientcert(cert)
-        host = thing2name(cert)
-
-        certfile = host2certfile(host)
-        if File.exists?(certfile)
-            Puppet.notice "Overwriting signed certificate %s for %s" %
-                [certfile, host]
-        end
-
-        Puppet::SSLCertificates::Inventory::add(cert)
-        Puppet.settings.writesub(:signeddir, certfile) do |f|
-            f.print cert.to_pem
+  end
+
+  # TTL for new certificates in seconds. If config param :ca_ttl is set,
+  # use that, otherwise use :ca_days for backwards compatibility
+  def ttl
+    days = @config[:ca_days]
+    if days && days.size > 0
+      warnonce "Parameter ca_ttl is not set. Using depecated ca_days instead."
+      return @config[:ca_days] * 24 * 60 * 60
+    else
+      ttl = @config[:ca_ttl]
+      if ttl.is_a?(String)
+        unless ttl =~ /^(\d+)(y|d|h|s)$/
+          raise ArgumentError, "Invalid ca_ttl #{ttl}"
         end
-    end
-
-    # TTL for new certificates in seconds. If config param :ca_ttl is set,
-    # use that, otherwise use :ca_days for backwards compatibility
-    def ttl
-        days = @config[:ca_days]
-        if days && days.size > 0
-            warnonce "Parameter ca_ttl is not set. Using depecated ca_days instead."
-            return @config[:ca_days] * 24 * 60 * 60
+        case $2
+        when 'y'
+          unit = 365 * 24 * 60 * 60
+        when 'd'
+          unit = 24 * 60 * 60
+        when 'h'
+          unit = 60 * 60
+        when 's'
+          unit = 1
         else
-            ttl = @config[:ca_ttl]
-            if ttl.is_a?(String)
-                unless ttl =~ /^(\d+)(y|d|h|s)$/
-                    raise ArgumentError, "Invalid ca_ttl #{ttl}"
-                end
-                case $2
-                when 'y'
-                    unit = 365 * 24 * 60 * 60
-                when 'd'
-                    unit = 24 * 60 * 60
-                when 'h'
-                    unit = 60 * 60
-                when 's'
-                    unit = 1
-                else
-                    raise ArgumentError, "Invalid unit for ca_ttl #{ttl}"
-                end
-                return $1.to_i * unit
-            else
-                return ttl
-            end
+          raise ArgumentError, "Invalid unit for ca_ttl #{ttl}"
         end
+        return $1.to_i * unit
+      else
+        return ttl
+      end
     end
-
-    private
-    def init_crl
-        if FileTest.exists?(@config[:cacrl])
-            @crl = OpenSSL::X509::CRL.new(
-                File.read(@config[:cacrl])
-            )
-        else
-            # Create new CRL
-            @crl = OpenSSL::X509::CRL.new
-            @crl.issuer = @cert.subject
-            @crl.version = 1
-            store_crl
-            @crl
-        end
+  end
+
+  private
+  def init_crl
+    if FileTest.exists?(@config[:cacrl])
+      @crl = OpenSSL::X509::CRL.new(
+        File.read(@config[:cacrl])
+      )
+    else
+      # Create new CRL
+      @crl = OpenSSL::X509::CRL.new
+      @crl.issuer = @cert.subject
+      @crl.version = 1
+      store_crl
+      @crl
     end
-
-    def store_crl
-        # Increment the crlNumber
-        e = @crl.extensions.find { |e| e.oid == 'crlNumber' }
-        ext = @crl.extensions.reject { |e| e.oid == 'crlNumber' }
-        crlNum = OpenSSL::ASN1::Integer(e ? e.value.to_i + 1 : 0)
-        ext << OpenSSL::X509::Extension.new("crlNumber", crlNum)
-        @crl.extensions = ext
-
-        # Set last/next update
-        now = Time.now
-        @crl.last_update = now
-        # Keep CRL valid for 5 years
-        @crl.next_update = now + 5 * 365*24*60*60
-
-        sign_with_key(@crl)
-        Puppet.settings.write(:cacrl) do |f|
-            f.puts @crl.to_pem
-        end
+  end
+
+  def store_crl
+    # Increment the crlNumber
+    e = @crl.extensions.find { |e| e.oid == 'crlNumber' }
+    ext = @crl.extensions.reject { |e| e.oid == 'crlNumber' }
+    crlNum = OpenSSL::ASN1::Integer(e ? e.value.to_i + 1 : 0)
+    ext << OpenSSL::X509::Extension.new("crlNumber", crlNum)
+    @crl.extensions = ext
+
+    # Set last/next update
+    now = Time.now
+    @crl.last_update = now
+    # Keep CRL valid for 5 years
+    @crl.next_update = now + 5 * 365*24*60*60
+
+    sign_with_key(@crl)
+    Puppet.settings.write(:cacrl) do |f|
+      f.puts @crl.to_pem
+    end
+  end
+
+  def sign_with_key(signable, digest = OpenSSL::Digest::SHA1.new)
+    cakey = nil
+    if @config[:password]
+      begin
+        cakey = OpenSSL::PKey::RSA.new(
+          File.read(@config[:cakey]), @config[:password]
+        )
+      rescue
+        raise Puppet::Error,
+          "Decrypt of CA private key with password stored in @config[:capass] not possible"
+      end
+    else
+      cakey = OpenSSL::PKey::RSA.new(
+        File.read(@config[:cakey])
+      )
     end
 
-    def sign_with_key(signable, digest = OpenSSL::Digest::SHA1.new)
-        cakey = nil
-        if @config[:password]
-            begin
-                cakey = OpenSSL::PKey::RSA.new(
-                    File.read(@config[:cakey]), @config[:password]
-                )
-            rescue
-                raise Puppet::Error,
-                    "Decrypt of CA private key with password stored in @config[:capass] not possible"
-            end
-        else
-            cakey = OpenSSL::PKey::RSA.new(
-                File.read(@config[:cakey])
-            )
-        end
-
-        unless @cert.check_private_key(cakey)
-            raise Puppet::Error, "CA Certificate is invalid"
-        end
+    raise Puppet::Error, "CA Certificate is invalid" unless @cert.check_private_key(cakey)
 
-        signable.sign(cakey, digest)
-    end
+    signable.sign(cakey, digest)
+  end
 end