puppet 2.6.18 → 2.7.1

data/LICENSE

@@ -1,17 +1,17 @@
-Puppet - Automating Configuration Management. Copyright (C) 2005 Puppet Labs LLC
+   Puppet - Automating Configuration Management.
 
-Puppet Labs can be contacted at: info@puppetlabs.com
+   Copyright (C) 2011 Puppet Labs Inc
 
-This program and entire repository is free software; you can
-redistribute it and/or modify it under the terms of the GNU
-General Public License Version 2 as published by the Free Software
-Foundation.
+   Puppet Labs can be contacted at: info@puppetlabs.com
 
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
 
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/README.md

@@ -13,10 +13,11 @@ Installation
 
 Generally, you need the following things installed:
 
-* A supported Ruby version. Ruby 1.8.5 and 1.8.7 are fully supported; Ruby 1.8.1
-  is supported on a best-effort basis for agent use only. Other versions of Ruby
-  are used at your own risk, and Ruby 1.8.6 is not recommended for compatibility
-  reasons.
+* A supported Ruby version. Ruby 1.8.5, 1.8.7, and 1.9.2 are fully supported
+  (with a handful of known issues under 1.9.2); Ruby 1.8.1 is supported on a
+  best-effort basis for agent use only. Other versions of Ruby are used at your
+  own risk, and Ruby 1.8.6, 1.9.0, and 1.9.1 are not recommended for
+  compatibility reasons.
 
 * The Ruby OpenSSL library.  For some reason, this often isn't included
   in the main ruby distributions.  You can test for it by running
@@ -29,11 +30,6 @@ Generally, you need the following things installed:
   available separately.  You could probably just compile and install that one
   library, though.
 
-* The Ruby XMLRPC client and server libraries.  For some reason, this often
-  isn't included in the main ruby distributions.  You can test for it by
-  running 'ruby -rxmlrpc/client -e "puts :yep"'.  If that errors out, you're missing
-  the library.
-
 * Facter => 1.5.1 (available via your package manager or from the [Facter site](http://puppetlabs.com/projects/facter).
 
 License

data/Rakefile

@@ -49,5 +49,5 @@ end
 
 desc "Run the unit tests"
 task :unit do
-    sh "cd test; rake"
+  Dir.chdir("test") { sh "rake" }
 end

data/conf/auth.conf

@@ -53,15 +53,20 @@ path ~ ^/catalog/([^/]+)$
 method find
 allow $1
 
+# allow nodes to retrieve their own node definition
+path ~ ^/node/([^/]+)$
+method find
+allow $1
+
 # allow all nodes to access the certificates services
 path /certificate_revocation_list/ca
 method find
 allow *
 
-# allow all nodes to store their own reports
-path ~ ^/report/([^/]+)$
+# allow all nodes to store their reports
+path /report
 method save
-allow $1
+allow *
 
 # inconditionnally allow access to all files services
 # which means in practice that fileserver.conf will

data/conf/redhat/puppet.spec

@@ -5,13 +5,13 @@
 %global confdir conf/redhat
 
 Name:           puppet
-Version:        2.6.18
+Version:        2.6.0
 Release:        1%{?dist}
 Summary:        A network tool for managing many disparate systems
-License:        GPLv2
+License:        Apache 2.0
 URL:            http://puppetlabs.com
 Source0:        http://puppetlabs.com/downloads/%{name}/%{name}-%{version}.tar.gz
-Source1:        http://puppetlabs.com/downloads/%{name}/%{name}-%{version}.tar.gz.asc
+Source1:        http://puppetlabs.com/downloads/%{name}/%{name}-%{version}.tar.gz.sign
 
 Group:          System Environment/Base
 
@@ -27,11 +27,11 @@ Requires:       ruby-shadow
 %endif
 
 # Pull in ruby selinux bindings where available
-%if 0%{?fedora} || 0%{?rhel} >= 6
-%{!?_without_selinux:Requires: ruby(selinux), libselinux-utils}
+%if 0%{?fedora} >= 12 || 0%{?rhel} >= 6
+%{!?_without_selinux:Requires: ruby(selinux)}
 %else
-%if 0%{?rhel} && 0%{?rhel} == 5
-%{!?_without_selinux:Requires: libselinux-ruby, libselinux-utils}
+%if 0%{?fedora} || 0%{?rhel} >= 5
+%{!?_without_selinux:Requires: libselinux-ruby}
 %endif
 %endif
 
@@ -65,8 +65,8 @@ Provides the central puppet server daemon which provides manifests to clients.
 The server can also function as a certificate authority and file server.
 
 %prep
-%setup -q -n %{name}-%{version}
-patch -s -p1 < conf/redhat/rundir-perms.patch
+%setup -q
+patch -p1 < conf/redhat/rundir-perms.patch
 
 
 %build
@@ -102,6 +102,7 @@ install -Dp -m0644 %{confdir}/server.sysconfig %{buildroot}%{_sysconfdir}/syscon
 install -Dp -m0755 %{confdir}/server.init %{buildroot}%{_initrddir}/puppetmaster
 install -Dp -m0644 %{confdir}/fileserver.conf %{buildroot}%{_sysconfdir}/puppet/fileserver.conf
 install -Dp -m0644 %{confdir}/puppet.conf %{buildroot}%{_sysconfdir}/puppet/puppet.conf
+install -Dp -m0644 conf/auth.conf %{buildroot}%{_sysconfdir}/puppet/auth.conf
 install -Dp -m0644 %{confdir}/logrotate %{buildroot}%{_sysconfdir}/logrotate.d/puppet
 
 # We need something for these ghosted files, otherwise rpmbuild
@@ -127,16 +128,9 @@ vimdir=%{buildroot}%{_datadir}/vim/vimfiles
 install -Dp -m0644 ext/vim/ftdetect/puppet.vim $vimdir/ftdetect/puppet.vim
 install -Dp -m0644 ext/vim/syntax/puppet.vim $vimdir/syntax/puppet.vim
 
-%if 0%{?fedora} >= 15
-# Setup tmpfiles.d config
-mkdir -p %{buildroot}%{_sysconfdir}/tmpfiles.d
-echo "D /var/run/%{name} 0755 %{name} %{name} -" > \
-    %{buildroot}%{_sysconfdir}/tmpfiles.d/%{name}.conf
-%endif
-
 %files
 %defattr(-, root, root, 0755)
-%doc CHANGELOG COPYING LICENSE README.md README.queueing examples
+%doc CHANGELOG COPYING LICENSE README README.queueing examples
 %{_bindir}/pi
 %{_bindir}/puppet
 %{_bindir}/ralsh
@@ -147,9 +141,6 @@ echo "D /var/run/%{name} 0755 %{name} %{name} -" > \
 %{ruby_sitelibdir}/*
 %{_initrddir}/puppet
 %dir %{_sysconfdir}/puppet
-%if 0%{?fedora} >= 15
-%config(noreplace) %{_sysconfdir}/tmpfiles.d/%{name}.conf
-%endif
 %config(noreplace) %{_sysconfdir}/sysconfig/puppet
 %config(noreplace) %{_sysconfdir}/puppet/puppet.conf
 %config(noreplace) %{_sysconfdir}/puppet/auth.conf
@@ -194,48 +185,27 @@ echo "D /var/run/%{name} 0755 %{name} %{name} -" > \
 getent group puppet &>/dev/null || groupadd -r puppet -g 52 &>/dev/null
 getent passwd puppet &>/dev/null || \
 useradd -r -u 52 -g puppet -d %{_localstatedir}/lib/puppet -s /sbin/nologin \
-    -c "Puppet" puppet &>/dev/null
+    -c "Puppet" puppet &>/dev/null || :
 # ensure that old setups have the right puppet home dir
 if [ $1 -gt 1 ] ; then
-  usermod -d %{_localstatedir}/lib/puppet puppet &>/dev/null
+  usermod -d %{_localstatedir}/lib/puppet puppet &>/dev/null || :
 fi
-exit 0
 
 %post
 /sbin/chkconfig --add puppet || :
-if [ "$1" -ge 1 ]; then
-  # The pidfile changed from 0.25.x to 2.6.x, handle upgrades without leaving
-  # the old process running.
-  oldpid="%{_localstatedir}/run/puppet/puppetd.pid"
-  newpid="%{_localstatedir}/run/puppet/agent.pid"
-  if [ -s "$oldpid" -a ! -s "$newpid" ]; then
-    (kill $(< "$oldpid") && rm -f "$oldpid" && \
-      /sbin/service puppet start) >/dev/null 2>&1 || :
-  fi
-fi
 
 %post server
 /sbin/chkconfig --add puppetmaster || :
-if [ "$1" -ge 1 ]; then
-  # The pidfile changed from 0.25.x to 2.6.x, handle upgrades without leaving
-  # the old process running.
-  oldpid="%{_localstatedir}/run/puppet/puppetmasterd.pid"
-  newpid="%{_localstatedir}/run/puppet/master.pid"
-  if [ -s "$oldpid" -a ! -s "$newpid" ]; then
-    (kill $(< "$oldpid") && rm -f "$oldpid" && \
-      /sbin/service puppetmaster start) >/dev/null 2>&1 || :
-  fi
-fi
 
 %preun
 if [ "$1" = 0 ] ; then
-  /sbin/service puppet stop >/dev/null 2>&1
+  /sbin/service puppet stop > /dev/null 2>&1
   /sbin/chkconfig --del puppet || :
 fi
 
 %preun server
 if [ "$1" = 0 ] ; then
-  /sbin/service puppetmaster stop >/dev/null 2>&1
+  /sbin/service puppetmaster stop > /dev/null 2>&1
   /sbin/chkconfig --del puppetmaster || :
 fi
 
@@ -246,86 +216,27 @@ fi
 
 %postun server
 if [ "$1" -ge 1 ]; then
-  /sbin/service puppetmaster condrestart >/dev/null 2>&1 || :
+  /sbin/service puppetmaster condrestart > /dev/null 2>&1 || :
 fi
 
 %clean
 rm -rf %{buildroot}
 
 %changelog
-* Sun Mar 10 2013 Matthaus Owens <matthaus@puppetlabs.com> - 2.6.18-1
-- Update for 2.6.18 (CVE-2013-1640, CVE-2013-1652, CVE-2013-1654, CVE-2013-2274, CVE-2013-2275)
-
-* Mon Jul 19 2012 Moses Mendoza <moses@puppetlabs.com> - 2.6.17-1
-- Update for 2.6.17
-
-* Mon Dec 12 2011 Matthaus Litteken <matthaus@puppetlabs.com> - 2.6.13-1
-- Release of 2.6.13
-
-* Fri Oct 21 2011 Michael Stahnke <stahnma@puppetlabs.com> - 2.6.12-1
-- CVE-2011-3872 fixes
-
-* Fri Sep 30 2011 Michael Stahnke <stahnma@puppetlabs.com> - 2.6.11-1
-- CVE-2011-3869, 3870, 3871
-
-* Wed Sep 28 2011 Michael Stahnke <stahnma@puppetlabs.com> - 2.6.10-1
-- Fix for CVE-2011-3484
-
-* Tue Jun 21 2011 Michael Stahnke <stahnma@puppetlabs.com> - 2.6.9-1
-- Release of 2.6.9
-
-* Wed Jun 15 2011 Todd Zullinger <tmz@pobox.com> - 2.6.9-0.1.rc1
-- Update rc versioning to ensure 2.6.9 final is newer to rpm
-- sync changes with Fedora/EPEL
-
-* Tue Jun 14 2011 Michael Stahnke <stahnma@puppetlabs.com> - 2.6.9rc1-1
-- Update to 2.6.9rc1
-
-* Thu Apr 14 2011 Todd Zullinger <tmz@pobox.com> - 2.6.8-1
-- Update to 2.6.8
-
-* Thu Mar 24 2011 Todd Zullinger <tmz@pobox.com> - 2.6.7-1
-- Update to 2.6.7
-
-* Wed Mar 16 2011 Todd Zullinger <tmz@pobox.com> - 2.6.6-1
-- Update to 2.6.6
-- Ensure %%pre exits cleanly
-- Fix License tag, puppet is now GPLv2 only
+* Tue Jul 20 2010 Todd Zullinger <tmz@pobox.com> - 2.6.0-1
+- Update to 2.6.0
 - Create and own /usr/share/puppet/modules (#615432)
-- Properly restart puppet agent/master daemons on upgrades from 0.25.x
-- Require libselinux-utils when selinux support is enabled
-- Support tmpfiles.d for Fedora >= 15 (#656677)
-
-* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.25.5-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
 
-* Mon May 17 2010 Todd Zullinger <tmz@pobox.com> - 0.25.5-1
+* Mon May 03 2010 Todd Zullinger <tmz@pobox.com> - 0.25.5-1
 - Update to 0.25.5
 - Adjust selinux conditional for EL-6
 - Apply rundir-perms patch from tarball rather than including it separately
-- Update URL's to reflect the new puppetlabs.com domain
 
-* Fri Jan 29 2010 Todd Zullinger <tmz@pobox.com> - 0.25.4-1
-- Update to 0.25.4
-
-* Tue Jan 19 2010 Todd Zullinger <tmz@pobox.com> - 0.25.3-2
-- Apply upstream patch to fix cron resources (upstream #2845)
-
-* Mon Jan 11 2010 Todd Zullinger <tmz@pobox.com> - 0.25.3-1
-- Update to 0.25.3
-
-* Tue Jan 05 2010 Todd Zullinger <tmz@pobox.com> - 0.25.2-1.1
-- Replace %%define with %%global for macros
-
-* Tue Jan 05 2010 Todd Zullinger <tmz@pobox.com> - 0.25.2-1
+* Fri Jan 01 2010 Todd Zullinger <tmz@pobox.com> - 0.25.2-1
 - Update to 0.25.2
-- Fixes CVE-2010-0156, tmpfile security issue (#502881)
 - Install auth.conf, puppetqd manpage, and queuing examples/docs
 
-* Wed Nov 25 2009 Jeroen van Meeuwen <j.van.meeuwen@ogd.nl> - 0.25.1-1
-- New upstream version
-
-* Tue Oct 27 2009 Todd Zullinger <tmz@pobox.com> - 0.25.1-0.3
+* Tue Oct 20 2009 Todd Zullinger <tmz@pobox.com> - 0.25.1-1
 - Update to 0.25.1
 - Include the pi program and man page (R.I.Pienaar)
 

data/conf/solaris/pkginfo

@@ -1,7 +1,6 @@
 PKG=CSWpuppet
 NAME=puppet - System Automation Framework
-VERSION=0.23.0
+VERSION=2.7.0
 CATEGORY=application
-VENDOR=http://reductivelabs.com/projects/puppet
-HOTLINE=http://reductivelabs.com/cgi-bin/puppet.cgi
-EMAIL=luke@madstop.com
+VENDOR=http://projects.puppetlabs.com/projects/puppet
+EMAIL=luke@puppetlabs.com

data/conf/suse/puppet.spec

@@ -6,7 +6,7 @@ Summary: A network tool for managing many disparate systems
 Name: puppet
 Version: 2.6.1
 Release: 1%{?dist}
-License: GPL
+License: Apache 2.0
 Group:    Productivity/Networking/System
 
 URL: http://puppetlabs.com/projects/puppet/

data/ext/cert_inspector

@@ -0,0 +1,140 @@
+#!/usr/bin/env ruby
+require 'openssl'
+
+class X509Collector
+  include Enumerable
+
+  def initialize
+    @collected_data = {}
+  end
+
+  def interpret_contents(contents)
+    cls = case contents.split("\n")[0]
+          when /BEGIN X509 CRL/ then OpenSSL::X509::CRL
+          when /BEGIN CERTIFICATE REQUEST/ then OpenSSL::X509::Request
+          when /BEGIN CERTIFICATE/ then OpenSSL::X509::Certificate
+          when /BEGIN RSA (PRIVATE|PUBLIC) KEY/ then OpenSSL::PKey::RSA
+          else return nil
+          end
+    cls.new(contents)
+  rescue
+    nil
+  end
+
+  def expected_non_x509_files
+    ['inventory.txt', 'ca.pass', 'serial']
+  end
+
+  def investigate_path(path)
+    if File.directory?(path)
+      Dir.foreach(path) do |x|
+        next if ['.', '..'].include? x
+        investigate_path File.join(path, x)
+      end
+    else
+      contents = File.read path
+      meaning = interpret_contents contents
+      unless meaning || expected_non_x509_files.include?(File.basename(path))
+        puts "WARNING: file #{path.inspect} could not be interpreted"
+      end
+      @collected_data[path] = meaning if meaning
+    end
+  end
+
+  def each(&block)
+    @collected_data.each(&block)
+  end
+
+  def extract_public_key_info(path, meaning)
+    case meaning
+    when OpenSSL::PKey::RSA
+      if meaning.private?
+        [meaning.public_key, 2, path]
+      else
+        [meaning, 3, path]
+      end
+    when OpenSSL::X509::Certificate
+      [meaning.public_key, 0, meaning.subject.to_s]
+    when OpenSSL::X509::Request
+      [meaning.public_key, 1, meaning.subject.to_s]
+    end
+  end
+
+  def who_signed(meaning, key_names, keys)
+    signing_key = keys.find { |key| meaning.verify(key) }
+    if signing_key then "#{key_names[signing_key.to_s]}" else "???" end
+  end
+
+  def explain(meaning, key_names, keys)
+    case meaning
+    when OpenSSL::PKey::RSA
+      if meaning.private?
+        "Private key for #{key_names[meaning.public_key.to_s]}"
+      else
+        "Public key for #{key_names[meaning.public_key.to_s]}"
+      end
+    when OpenSSL::X509::Certificate
+      signature_desc = who_signed(meaning, key_names, keys)
+      "Certificate assigning name #{meaning.subject.to_s} to #{key_names[meaning.public_key.to_s]}\n    serial number #{meaning.serial}\n    issued by #{meaning.issuer.to_s}\n    signed by #{signature_desc}"
+    when OpenSSL::X509::Request
+      signature_desc = who_signed(meaning, key_names, keys)
+      "Certificate request for #{meaning.subject.to_s} having key #{key_names[meaning.public_key.to_s]}\n    signed by #{signature_desc}"
+    when OpenSSL::X509::CRL
+      signature_desc = who_signed(meaning, key_names, keys)
+      revoked_serial_numbers = meaning.revoked.map { |r| r.serial }
+      revoked_desc = if revoked_serial_numbers.count > 0 then "serial numbers #{revoked_serial_numbers.inspect}" else "nothing" end
+      "Certificate revocation list revoking #{revoked_desc}\n    issued by #{meaning.issuer.to_s}\n    signed by #{signature_desc}"
+    else
+      "Unknown"
+    end
+  end
+
+  # Yield unique public keys, with a canonical name for each.
+  def collect_public_keys
+    key_data = {} # pem => (priority, name, public_key)
+    @collected_data.collect do |path, meaning|
+      begin
+        next unless public_key_info = extract_public_key_info(path, meaning)
+        public_key, priority, name = public_key_info
+        pem = public_key.to_s
+        existing_priority, existing_name, existing_public_key = key_data[pem]
+        next if existing_priority and existing_priority < priority
+        key_data[pem] = priority, name, public_key
+      rescue
+        puts "exception!"
+      end
+    end
+    name_to_key_hash = {}
+    key_data.each do |pem, data|
+      priority, name, public_key = data
+      if name_to_key_hash[name]
+        suffix_num = 2
+        while name_to_key_hash[name + " (#{suffix_num})"]
+          suffix_num += 1
+        end
+        name = name + " (#{suffix_num})"
+      end
+      name_to_key_hash[name] = public_key
+    end
+    key_names = {}
+    keys = []
+    name_to_key_hash.each do |name, public_key|
+      key_names[public_key.to_s] = "key<#{name}>"
+      keys << public_key
+    end
+    [key_names, keys]
+  end
+end
+
+collector = X509Collector.new
+ARGV.each do |path|
+  collector.investigate_path(path)
+end
+key_names, keys = collector.collect_public_keys
+collector.map do |path, meaning|
+  [collector.explain(meaning, key_names, keys), path]
+end.sort.each do |description, path|
+  puts "#{path}:"
+  puts "  #{description}"
+  puts
+end