puppet 2.7.26 → 3.0.0.rc4

data/lib/puppet/ssl/configuration.rb

@@ -0,0 +1,32 @@
+require 'puppet/ssl'
+module Puppet
+module SSL
+  # Puppet::SSL::Configuration is intended to separate out the following concerns:
+  # * CA certificates that authenticate peers (ca_auth_file)
+  # * CA certificates that build trust but do not authenticate (ca_chain_file)
+  # * Who clients trust as distinct from who servers trust.  We should not
+  #   assume one single self signed CA cert for everyone.
+class Configuration
+  def initialize(localcacert, options={})
+    if (options[:ca_chain_file] and not options[:ca_auth_file])
+      raise ArgumentError, "The CA auth chain is required if the chain file is provided"
+    end
+    @localcacert = localcacert
+    @ca_chain_file = options[:ca_chain_file]
+    @ca_auth_file = options[:ca_auth_file]
+  end
+
+  # The ca_chain_file method is intended to return the PEM bundle of CA certs
+  # establishing trust but not used for peer authentication.
+  def ca_chain_file
+    @ca_chain_file || ca_auth_file
+  end
+
+  # The ca_auth_file method is intended to return the PEM bundle of CA certs
+  # used to authenticate peer connections.
+  def ca_auth_file
+    @ca_auth_file || @localcacert
+  end
+end
+end
+end

data/lib/puppet/ssl/host.rb

@@ -54,7 +54,7 @@ class Puppet::SSL::Host
     CertificateRequest.indirection.terminus_class = terminus
     CertificateRevocationList.indirection.terminus_class = terminus
 
-    host_map = {:ca => :file, :disabled_ca => nil, :file => nil, :rest => :rest}
+    host_map = {:ca => :file, :file => nil, :rest => :rest}
     if term = host_map[terminus]
       self.indirection.terminus_class = term
     else
@@ -94,7 +94,7 @@ class Puppet::SSL::Host
     # We are the CA, so we don't have read/write access to the normal certificates.
     :only => [:ca],
     # We have no CA, so we just look in the local file store.
-    :none => [:disabled_ca]
+    :none => [:file]
   }
 
   # Specify how we expect to interact with our certificate authority.
@@ -276,39 +276,14 @@ ERROR_STRING
     pson_hash[:state] = my_state
     pson_hash[:desired_state] = desired_state if desired_state
 
-    thing_to_use = (my_state == 'requested') ? certificate_request : my_cert
-
-    # this is for backwards-compatibility
-    # we should deprecate it and transition people to using
-    # pson[:fingerprints][:default]
-    # It appears that we have no internal consumers of this api
-    # --jeffweiss 30 aug 2012
-    pson_hash[:fingerprint] = thing_to_use.fingerprint
-    
-    # The above fingerprint doesn't tell us what message digest algorithm was used
-    # No problem, except that the default is changing between 2.7 and 3.0. Also, as
-    # we move to FIPS 140-2 compliance, MD5 is no longer allowed (and, gasp, will
-    # segfault in rubies older than 1.9.3)
-    # So, when we add the newer fingerprints, we're explicit about the hashing
-    # algorithm used.
-    # --jeffweiss 31 july 2012
-    pson_hash[:fingerprints] = {}
-    pson_hash[:fingerprints][:default] = thing_to_use.fingerprint
-    
-    suitable_message_digest_algorithms.each do |md| 
-      pson_hash[:fingerprints][md] = thing_to_use.fingerprint md
+    if my_state == 'requested'
+      pson_hash[:fingerprint] = certificate_request.fingerprint
+    else
+      pson_hash[:fingerprint] = my_cert.fingerprint
     end
-    pson_hash[:dns_alt_names] = thing_to_use.subject_alt_names
 
     pson_hash.to_pson(*args)
   end
-  
-  # eventually we'll probably want to move this somewhere else or make it
-  # configurable
-  # --jeffweiss 29 aug 2012
-  def suitable_message_digest_algorithms
-    [:SHA1, :SHA256, :SHA512]
-  end
 
   # Attempt to retrieve a cert, if we don't already have one.
   def wait_for_cert(time)
@@ -319,8 +294,7 @@ ERROR_STRING
     rescue SystemExit,NoMemoryError
       raise
     rescue Exception => detail
-      puts detail.backtrace if Puppet[:trace]
-      Puppet.err "Could not request certificate: #{detail}"
+      Puppet.log_exception(detail, "Could not request certificate: #{detail}")
       if time < 1
         puts "Exiting; failed to retrieve certificate and waitforcert is disabled"
         exit(1)
@@ -341,20 +315,18 @@ ERROR_STRING
         break if certificate
         Puppet.notice "Did not receive certificate"
       rescue StandardError => detail
-        puts detail.backtrace if Puppet[:trace]
-        Puppet.err "Could not request certificate: #{detail}"
+        Puppet.log_exception(detail, "Could not request certificate: #{detail}")
       end
     end
   end
 
   def state
-    my_cert = Puppet::SSL::Certificate.indirection.find(name)
     if certificate_request
       return 'requested'
     end
 
     begin
-      Puppet::SSL::CertificateAuthority.new.verify(my_cert)
+      Puppet::SSL::CertificateAuthority.new.verify(name)
       return 'signed'
     rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError
       return 'revoked'

data/lib/puppet/status.rb

@@ -14,12 +14,8 @@ class Puppet::Status
     @status.to_pson
   end
 
-  def self.from_pson(pson)
-    if pson.include?('status')
-      self.new(pson['status'])
-    else
-      self.new(pson)
-    end
+  def self.from_pson( pson )
+    self.new( pson )
   end
 
   def name

data/lib/puppet/test/test_helper.rb

@@ -66,18 +66,13 @@ module Puppet::Test
         }
       end
 
-      initialize_settings_before_each()
+      # The process environment is a shared, persistent resource.
+      $old_env = ENV.to_hash
 
-      # Longer keys are secure, but they sure make for some slow testing - both
-      # in terms of generating keys, and in terms of anything the next step down
-      # the line doing validation or whatever.  Most tests don't care how long
-      # or secure it is, just that it exists, so these are better and faster
-      # defaults, in testing only.
-      #
-      # I would make these even shorter, but OpenSSL doesn't support anything
-      # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
-      Puppet[:req_bits]  = 512
-      Puppet[:keylength] = 512
+      # So is the load_path
+      $old_load_path = $LOAD_PATH.dup
+
+      initialize_settings_before_each()
 
       Puppet::Node::Environment.clear
       Puppet::Parser::Functions.reset
@@ -88,11 +83,16 @@ module Puppet::Test
     # Call this method once per test, after execution of each individual test.
     # @return nil
     def self.after_each_test()
-      clear_settings_after_each()
+      Puppet.settings.send(:clear_everything_for_tests)
 
       Puppet::Util::Storage.clear
       Puppet::Util::ExecutionStub.reset
 
+      Puppet.clear_deprecation_warnings
+
+      # uncommenting and manipulating this can be useful when tracking down calls to deprecated code
+      #Puppet.log_deprecations_to_file("deprecations.txt", /^Puppet::Util.exec/)
+
       # Restore the indirector configuration.  See before hook.
       indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
       indirections.each do |indirector|
@@ -102,6 +102,15 @@ module Puppet::Test
       end
       $saved_indirection_state = nil
 
+      # Restore the global process environment.  Can't just assign because this
+      # is a magic variable, sadly, and doesn't do that™.  It is sufficiently
+      # faster to use the compare-then-set model to avoid excessive work that it
+      # justifies the complexity.  --daniel 2012-03-15
+      unless ENV.to_hash == $old_env
+        ENV.clear
+        $old_env.each {|k, v| ENV[k] = v }
+      end
+
 
       # Some tests can cause us to connect, in which case the lingering
       # connection is a resource that can cause unexpected failure in later
@@ -111,6 +120,10 @@ module Puppet::Test
       # introspect for this functionality.
       ActiveRecord::Base.remove_connection if defined?(ActiveRecord::Base)
 
+      # Restore the load_path late, to avoid messing with stubs from the test.
+      $LOAD_PATH.clear
+      $old_load_path.each {|x| $LOAD_PATH << x }
+
     end
 
 
@@ -119,23 +132,43 @@ module Puppet::Test
     #  of this class!)
     #########################################################################################
 
+    def self.app_defaults_for_tests()
+      {
+          :run_mode   => :user,
+          :logdir     => "/dev/null",
+          :confdir    => "/dev/null",
+          :vardir     => "/dev/null",
+          :rundir     => "/dev/null",
+          :hiera_config => "/dev/null",
+      }
+    end
+    private_class_method :app_defaults_for_tests
+
     def self.initialize_settings_before_each()
-      # these globals are set by Application
-      $puppet_application_mode = nil
-      $puppet_application_name = nil
-      # Set the confdir and vardir to gibberish so that tests
-      # have to be correctly mocked.
-      Puppet[:confdir] = "/dev/null"
-      Puppet[:vardir] = "/dev/null"
+      # Initialize "app defaults" settings to a good set of test values
+      app_defaults_for_tests.each do |key, value|
+        Puppet.settings.set_value(key, value, :application_defaults)
+      end
 
       # Avoid opening ports to the outside world
-      Puppet[:bindaddress] = "127.0.0.1"
-    end
-    private_class_method :initialize_settings_before_each
+      Puppet.settings[:bindaddress] = "127.0.0.1"
+
+      # We don't want to depend upon the reported domain name of the
+      # machine running the tests, nor upon the DNS setup of that
+      # domain.
+      Puppet.settings[:use_srv_records] = false
 
-    def self.clear_settings_after_each()
-      Puppet.settings.clear
+      # Longer keys are secure, but they sure make for some slow testing - both
+      # in terms of generating keys, and in terms of anything the next step down
+      # the line doing validation or whatever.  Most tests don't care how long
+      # or secure it is, just that it exists, so these are better and faster
+      # defaults, in testing only.
+      #
+      # I would make these even shorter, but OpenSSL doesn't support anything
+      # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
+      Puppet[:req_bits]  = 512
+      Puppet[:keylength] = 512
     end
-    private_class_method :clear_settings_after_each
+    private_class_method :initialize_settings_before_each
   end
 end

data/lib/puppet/transaction.rb

@@ -151,10 +151,9 @@ class Puppet::Transaction
     begin
       made = resource.eval_generate.uniq
       return false if made.empty?
-      made = made.inject({}) {|a,v| a[v.name] = v; a}
+      made = made.inject({}) {|a,v| a.merge(v.name => v) }
     rescue => detail
-      puts detail.backtrace if Puppet[:trace]
-      resource.err "Failed to generate additional resources using 'eval_generate: #{detail}"
+      resource.log_exception(detail, "Failed to generate additional resources using 'eval_generate: #{detail}")
       return false
     end
     made.values.each do |res|
@@ -203,8 +202,7 @@ class Puppet::Transaction
     begin
       made = resource.generate
     rescue => detail
-      puts detail.backtrace if Puppet[:trace]
-      resource.err "Failed to generate additional resources using 'generate': #{detail}"
+      resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
     end
     return unless made
     made = [made] unless made.is_a?(Array)
@@ -227,7 +225,7 @@ class Puppet::Transaction
 
   # Should we ignore tags?
   def ignore_tags?
-    ! (@catalog.host_config? or Puppet[:name] == "puppet")
+    ! @catalog.host_config? 
   end
 
   # this should only be called by a Puppet::Type::Component resource now
@@ -235,7 +233,7 @@ class Puppet::Transaction
   def initialize(catalog, report = nil)
     @catalog = catalog
 
-    @report = report || Puppet::Transaction::Report.new("apply", catalog.version, Puppet[:environment])
+    @report = report || Puppet::Transaction::Report.new("apply", catalog.version, catalog.environment)
 
     @event_manager = Puppet::Transaction::EventManager.new(self)
 
@@ -285,8 +283,7 @@ class Puppet::Transaction
     begin
       provider_class.prefetch(resources)
     rescue => detail
-      puts detail.backtrace if Puppet[:trace]
-      Puppet.err "Could not prefetch #{type_name} provider '#{provider_class.name}': #{detail}"
+      Puppet.log_exception(detail, "Could not prefetch #{type_name} provider '#{provider_class.name}': #{detail}")
     end
     @prefetched_providers[type_name][provider_class.name] = true
   end

data/lib/puppet/transaction/event.rb

@@ -1,14 +1,16 @@
 require 'puppet/transaction'
 require 'puppet/util/tagging'
 require 'puppet/util/logging'
+require 'puppet/util/methodhelper'
 
 # A simple struct for storing what happens on the system.
 class Puppet::Transaction::Event
+  include Puppet::Util::MethodHelper
   include Puppet::Util::Tagging
   include Puppet::Util::Logging
 
   ATTRIBUTES = [:name, :resource, :property, :previous_value, :desired_value, :historical_value, :status, :message, :file, :line, :source_description, :audited]
-  YAML_ATTRIBUTES = %w{@audited @property @previous_value @desired_value @historical_value @message @name @status @time}
+  YAML_ATTRIBUTES = %w{@audited @property @previous_value @desired_value @historical_value @message @name @status @time}.map(&:to_sym)
   attr_accessor *ATTRIBUTES
   attr_writer :tags
   attr_accessor :time
@@ -16,39 +18,26 @@ class Puppet::Transaction::Event
 
   EVENT_STATUSES = %w{noop success failure audit}
 
-  def self.from_pson(data)
-    obj = self.allocate
-    obj.initialize_from_hash(data)
-    obj
-  end
-
   def initialize(options = {})
     @audited = false
-    options.each { |attr, value| send(attr.to_s + "=", value) }
-
+    set_options(options)
     @time = Time.now
   end
 
-  def initialize_from_hash(data)
-    @audited = data['audited']
-    @property = data['property']
-    @previous_value = data['previous_value']
-    @desired_value = data['desired_value']
-    @historical_value = data['historical_value']
-    @message = data['message']
-    @name = data['name'].intern
-    @status = data['status']
-    @time = data['time']
-    @time = Time.parse(@time) if @time.is_a? String
-  end
-
   def property=(prop)
     @property = prop.to_s
   end
 
   def resource=(res)
-    if res.respond_to?(:[]) and level = res[:loglevel]
-      @default_log_level = level
+    begin
+      # In Ruby 1.8 looking up a symbol on a string gives nil; in 1.9 it will
+      # raise a TypeError, which we then catch.  This should work on both
+      # versions, for all that it is a bit naff. --daniel 2012-03-11
+      if res.respond_to?(:[]) and level = res[:loglevel]
+        @default_log_level = level
+      end
+    rescue TypeError => e
+      raise unless e.to_s == "can't convert Symbol into Integer"
     end
     @resource = res.to_s
   end

data/lib/puppet/transaction/event_manager.rb

@@ -101,7 +101,7 @@ class Puppet::Transaction::EventManager
     resource.err "Failed to call #{callback}: #{detail}"
 
     transaction.resource_status(resource).failed_to_restart = true
-    puts detail.backtrace if Puppet[:trace]
+    resource.log_exception(detail)
     return false
   end
 

data/lib/puppet/transaction/report.rb

@@ -19,12 +19,6 @@ class Puppet::Transaction::Report
     :yaml
   end
 
-  def self.from_pson(data)
-    obj = self.allocate
-    obj.initialize_from_hash(data)
-    obj
-  end
-
   def <<(msg)
     @logs << msg
     self
@@ -82,46 +76,13 @@ class Puppet::Transaction::Report
     @host = Puppet[:node_name_value]
     @time = Time.now
     @kind = kind
-    @report_format = 3
+    @report_format = 2
     @puppet_version = Puppet.version
     @configuration_version = configuration_version
     @environment = environment
     @status = 'failed' # assume failed until the report is finalized
   end
 
-  def initialize_from_hash(data)
-    @puppet_version = data['puppet_version']
-    @report_format = data['report_format']
-    @configuration_version = data['configuration_version']
-    @environment = data['environment']
-    @status = data['status']
-    @host = data['host']
-    @time = data['time']
-    if @time.is_a? String
-      @time = Time.parse(@time)
-    end
-    @kind = data['kind']
-
-    @metrics = {}
-    data['metrics'].each do |name, hash|
-      @metrics[name] = Puppet::Util::Metric.from_pson(hash)
-    end
-
-    @logs = data['logs'].map do |record|
-      Puppet::Util::Log.from_pson(record)
-    end
-
-    @resource_statuses = {}
-    data['resource_statuses'].map do |record|
-      if record[1] == {}
-        status = nil
-      else
-        status = Puppet::Resource::Status.from_pson(record[1])
-      end
-      @resource_statuses[record[0]] = status
-    end
-  end
-
   def name
     host
   end
@@ -180,7 +141,7 @@ class Puppet::Transaction::Report
   end
 
   def to_yaml_properties
-    (instance_variables - ["@external_times"])
+    instance_variables - [:@external_times]
   end
 
   private