puppet 2.7.3 → 2.7.4

data/CHANGELOG

@@ -1,3 +1,169 @@
+2.7.4
+===
+47135fb Resist directory traversal attacks through indirections. (CVE-2011-3484)
+9dd18cf Updated CHANGELOG for 2.7.4rc3
+fe92f20 (#9440) Allow cron vars to have leading whitespace
+da69637 Fix failing spec for resource file
+7a39ca7 (#8667) Write out a list of resources that are managed by puppet agent
+bc40516 Fix order dependent spec failure in exec specs
+a20551f Updated CHANGELOG for 2.7.4rc2
+d59a0b3 Update certificate_spec.rb test to include spec_helper
+f325b40 Fix #7984 - GigabitEthernet/TenGigabitEthernet are uncorrectly parsed
+6cc15c2 Fix #7983 - Cisco uptime facts doesn't always work
+41302e9 Fixes #9143, allows macauthorization provider to work on OS X Lion 10.7
+5a3f24d Updated CHANGELOG for 2.7.4rc1
+04519a7 Revert "Merge pull request #100 from glarizza/tickets/2.7.x/9192_launchd_fix"
+769f2b2 Revert "Merge pull request #99 from nigelkersten/tickets/2.7.x/9143-make-macauthorization-work-on-lion"
+ff13d8d Add comment explaining helper method
+40f64e9 Add has_macosx_plist_overrides? method
+670d30c Fix ActiveRecord handling of symbols in query interpolation.
+51b0c00 Fixes #9143, allows macauthorization provider to work on OS X Lion 10.7
+a04051a (#9051) Move complex collect expression error into terminus.
+f7e526b (#8413) Only try to catch Process::Error if it's defined
+2c96286 Debug order-dependent test failures in CI / ActiveRecord.
+38070d5 Don't toggle storeconfigs back and forth.
+cf60243 One character typo, entire code path broken...
+40dc39c More protection against accidentally using sqlite3
+f898749 Save and restore indirector configuration around all tests.
+e3073ac (#9051) More storeconfigs test cleanup.
+51461de (#9051) Protect SQLite tests from running without gem.
+bb0380f (#8662) Don't rely on error message to detect UAC capable platform
+2ab5634 (#8413) Properly clean up stale pidfile on Windows
+cc958e1 (#8412) Add MSI package provider for use with Windows
+878ea25 (#8412) Add optional type-level validation of the source parameter
+dad075d Correct grammar in parameter comment
+4168a4c Clean up formatting & whitespace in Puppet::Type
+fd1d4b9 (#9051) de-ActiveRecord-ify Collection expressions.
+78e33cc (#9051) Port query tests into the indirection.
+65580e7 (#9051) Implement the `resource` terminus for StoreConfigs.
+89aaa51 (#9051) Make generic tagging imported resource origins.
+d5b295d (#9051) Whitespace cleanup for puppet/parser/collector
+611c466 (#9051) Dead code elimination in the compiler terminus.
+6e0ff6a (#9051) Get the compiler out of the ActiveRecord business.
+4d51680 (#9051) Implement the StoreConfigs indirection itself.
+d0357c8 (#9051) Add configuration around StoreConfigs indirection.
+8700682 (#9051) de-ActiveRecord-ify Collection expressions.
+4274e15 (#9174) Provide a helpful error when missing a gem and installing on Windows
+f53db3d Clean up formatting & whitespace in package type & providers
+6dff78c (#8489) Use File::PATH_SEPARATOR in path attribute of service type
+64dbd3b (#8489) Use File::PATH_SEPARATOR for path attribute of exec type
+3e40207 (#8489) Use File::PATH_SEPARATOR rather than ':' for factpath setting
+c469294 (#8489) Use File::PATH_SEPARATOR rather than ':' for args to puppet doc
+a2ced0f Properly determine file deletion in puppet/unit/util_spec.rb
+bc5f1e3 (#9051) Port query tests into the indirection.
+fa78e99 (#9051) Implement the `resource` terminus for StoreConfigs.
+f6b91be (#8140) Add an exec provider for Windows
+18c322a (#8410) Factor out a base class for exec providers
+cb53870 (#8410) Cleanup and fix Windows support in Puppet::Util.execute
+39a582b (#8410) Use absolute_path? for Puppet::Parameter::Path validation
+fb6df31 (#8410) Add a helper to Puppet::Util to determine absoluteness of a path
+c2a432a maint: Fix trailing whitespace in lib/puppet/util.rb
+fab2fe7 (#9051) Make generic tagging imported resource origins.
+5300368 (#9051) Whitespace cleanup for puppet/parser/collector
+6420ede (#9051) Dead code elimination in the compiler terminus.
+543f331 (#9051) Get the compiler out of the ActiveRecord business.
+4b55e72 (#9051) Implement the StoreConfigs indirection itself.
+0f207a8 (#8662) Don't manage internal file permissions on Windows
+47058ab (#8662) Skip user and group resources when applying settings on Windows
+2ac8790 (#8662) Fix Puppet.features.root? on Windows
+ccdd043 (#8662) Break circular feature dependency
+4b29f5f (#9051) Add configuration around StoreConfigs indirection.
+9f39cc4 maint: Stub spec test so directory is not created unnecessarily
+66fb531 Don't use non-1.8.5-compatible methods 'Object#tap' and 'Dir.mktmpdir'
+2091cbe maint: Fix build break due to recent merge from 2.7.x to master
+2681ca5 Fix posix exec provider spec failures on Windows
+3812fc3 (#5495) Remove dead Windows-specific code from posix exec provider
+b6ca78c Stop trying to make config directories in Windows specs
+4237cb1 (#8272) Add missing tests for Windows service provider methods.
+a32c8be (#8409) Add a default group provider for Windows
+4f7170a (#8408) Add a default user provider for Windows
+f19a0ea (#8408/8409) Add a Windows ADSI helper module
+6919d2c (#8663) Exclude exec timeout test on Windows
+8009209 (#8663) Exclude git rev-parse HEAD spec test on Windows
+a0013e4 Check for the appropriate permissions in File type tests on Windows
+58c7dac Remove :fails_on_windows from file type tests that no longer fail on Windows
+9f2a7b9 Disable file bucket diffing tests on Windows
+1e59b26 Always put a slash between the checksum and path in filebucket URLs
+37f87b7 Treat Windows absolute paths as absolute paths
+4a6d617 Consolidate test logic determining if a registered file is in the temp directory
+8c88918 Clarify logic and error messages when initializing Puppet::FileBucket::File
+2efaa85 Disable symlink related file tests on Windows
+7259e1e (#8644) Host provider on Windows
+328eaa2 (#8660) Fix destdir option on Windows
+088c7ac (#8660) Default config dir to %PROGRAMDATA% on Windows
+925af95 (#8663) Disable spec tests for unsupported functionality on Windows
+04965d7 (#8663) Drive letters are not valid absolute paths on Windows
+f4598ec (#8663) Update the run_mode spec test on Windows to match the code
+68bdc74 (#8663) The ssh_authorized_key type is not supported on Windows
+9fbb0be (#8663) Reenable spec tests on Windows that now pass
+c930152 (#8392) Disable master related tests on Windows
+28b1658 (#8272) Allow disabled Windows services to be started
+c69baf6 (#8272) Refactor specs for Windows service provider
+881c385 (#8272) Use symbols instead of booleans for enabled property on Windows
+9c575bd (#8272) Fixup logging in Windows service provider
+ad29bf6 Fix issue with forward and backslashes in Windows paths
+eaa7d92 Disable spec tests for unsupported functionality on Windows
+945bf74 Update certificate spec tests for Windows
+3be4d79 Add basic service provider for Windows
+d9a693d Regexp escape substituted commands in Windows wrapper script
+49d1e9d Rework Puppet::Util::Cacher to only expire using TTLs
+9849d56 Remove use of Puppet::Util::Cacher in Puppet::SSL::Host
+028b795 Remove dead uses of Puppet::Util::Cacher from autoloader
+7c4dbeb Remove Puppet::Util::Cacher use from Puppet::Indirector::Indirection
+d6e0b71 Remove caching from the catalog, types, and parameters
+d49dd9e Remove cached_attrs from Puppet::Type::File
+546e0f9 Remove Puppet::Util::Cacher usage from Puppet::Util::Settings
+b6b5498 Remove Util::Cacher usage from SSL::CertificateAuthority
+777b2f2 Remove unused require 'puppet/util/cacher' from Network::HttpPool
+41425bd Remove use of Util::Cacher from FileServing::Mount::File
+8d53090 Remove use of Util::Cacher in FileServing::Configuration
+3093047 Remove Puppet::Network::HttpPool keep_alive handling
+57d6217 Fix spec test failure on 1.9.2
+5d3a40f Maint: Fix miscellaneous tests
+ce0c258 Maint: Don't test for extended signals on Windows
+bdc9790 Maint: Tagged spec tests that are known to fail on Windows
+c26f3e5 Fix tests with "relative" paths on Windows
+bfeb337 (#8268) Require windows drive letters in absolute file paths
+fe81dec (#8489) Consistently use File::PATH_SEPARATOR
+a437812 (#8356) Specify setting type for color
+af2446a (#8268) Fix resource harness spec tests
+d9c3b0f (#8356) Color defaults to false on Windows
+9ebe500 Disable the master on Windows instead of blowing up with failed resources
+7467a08 (#7581) Provide more detailed error message when missing gems on Windows
+654de01 Maint: Correct docs for filebucket type and file's backup parameter
+b623826 Maint: Fix line wrapping in create_resources function
+fd7332b maint: remove inaccurate copyright and license statements.
+a8b27de Maint: Improve create_resources function's doc string
+5f22985 maint: Fix order dependent test failure
+7ac1093 (#8037) Fix incorrect example in Augeas type reference
+35c1006 (#9039) Update Augeas commands documentation
+2bf6721 Reset indirector state after configurer tests.
+e9b558d Fix posix exec provider spec failures on Windows
+b28bcb0 (#5495) Remove dead Windows-specific code from posix exec provider
+2297899 Do not leak indirector state from apply tests
+b52fbf4 (#8612) Clarify the function of the example for exec's "creates" parameter
+bb224dd (#8770) Don't fail to set supplementary groups when changing user to root
+2a0de12 (#8770) Always fully drop privileges when changing user
+00c4b25 (#8662) Migrate suidmanager test case to rspec
+d7c9c76 (#8740) Do not enumerate files in the root directory.
+39da99d (#4411) Explain that runinterval = 0 does not mean "never run"
+4146a33 Maint: Fix missing option text in puppet agent and arrange options alphabetically
+0e00473 (#3553) Explain that cron resources require time attributes
+769d432 (#8302) Improve documentation of exec providers
+76d45d2 (#7853) Clarify and complete docs for the tagmail report processor
+d60852b Maint: Mention that audit metaparameter will accept "all"
+51d989e Maint: Adjust wording for file type's content parameter
+a110d83 Maint: Fix poor documentation for versioncmp function.
+746a374 maint: Fix case sensitive require
+310bd55 maint: Add inspect app options to help
+3a19628 maint: Fix inspect help
+344aef9 (#8808) Fail Augeas resource when unable to save changes
+c209f62 Add document outlining preferred contribution methods
+839e7c9 (#7999) Add some basic tests of the systemd provider
+1cae354 (#7999) Add a service provider that manages systemd services natively
+3b152e4 (#7114) Fix value validation on options
+aa1b36f (#7114) Add tests for option property
+
 2.7.3
 ===
 7113448 (#4762) Ensure that clients on the moon can successfully connect.

data/install.rb

@@ -243,6 +243,14 @@ def prepare_installation
 
   if not InstallOptions.configdir.nil?
     configdir = InstallOptions.configdir
+  elsif $operatingsystem == "windows"
+    begin
+      require 'win32/dir'
+    rescue LoadError => e
+      puts "Cannot run on Microsoft Windows without the sys-admin, win32-process, win32-dir & win32-service gems: #{e}"
+      exit -1
+    end
+    configdir = File.join(Dir::COMMON_APPDATA, "PuppetLabs", "puppet", "etc")
   else
     configdir = "/etc/puppet"
   end
@@ -283,18 +291,18 @@ def prepare_installation
   if not InstallOptions.destdir.nil?
     destdir = InstallOptions.destdir
   # To be deprecated once people move over to using --destdir option
-  elsif ENV['DESTDIR'] != nil?
+  elsif not ENV['DESTDIR'].nil?
     destdir = ENV['DESTDIR']
     warn "DESTDIR is deprecated. Use --destdir instead."
   else
     destdir = ''
   end
 
-  configdir = "#{destdir}#{configdir}"
-  bindir = "#{destdir}#{bindir}"
-  sbindir = "#{destdir}#{sbindir}"
-  mandir = "#{destdir}#{mandir}"
-  sitelibdir = "#{destdir}#{sitelibdir}"
+  configdir = join(destdir, configdir)
+  bindir = join(destdir, bindir)
+  sbindir = join(destdir, sbindir)
+  mandir = join(destdir, mandir)
+  sitelibdir = join(destdir, sitelibdir)
 
   FileUtils.makedirs(configdir) if InstallOptions.configs
   FileUtils.makedirs(bindir)
@@ -313,6 +321,16 @@ def prepare_installation
   InstallOptions.man_dir  = mandir
 end
 
+##
+# Join two paths. On Windows, dir must be converted to a relative path,
+# by stripping the drive letter, but only if the basedir is not empty.
+#
+def join(basedir, dir)
+  return "#{basedir}#{dir[2..-1]}" if $operatingsystem == "windows" and basedir.length > 0 and dir.length > 2
+
+  "#{basedir}#{dir}"
+end
+
 ##
 # Build the rdoc documentation. Also, try to build the RI documentation.
 #
@@ -405,8 +423,10 @@ def install_binfile(from, op_file, target)
     if not installed_wrapper
       tmp_file2 = File.join(tmp_dir, '_tmp_wrapper')
       cwn = File.join(Config::CONFIG['bindir'], op_file)
-      cwv = CMD_WRAPPER.gsub('<ruby>', ruby.gsub(%r{/}) { "\\" }).gsub!('<command>', cwn.gsub(%r{/}) { "\\" } )
+      regex_safe_ruby = Regexp.escape(ruby.gsub(%r{/}) { "\\" })
+      regex_safe_cwn = Regexp.escape(cwn.gsub(%r{/}) { "\\" })
 
+      cwv = CMD_WRAPPER.gsub('<ruby>', regex_safe_ruby).gsub('<command>', regex_safe_cwn)
       File.open(tmp_file2, "wb") { |cw| cw.puts cwv }
       FileUtils.install(tmp_file2, File.join(target, "#{op_file}.bat"), :mode => 0755, :verbose => true)
 

data/lib/puppet/application/agent.rb

@@ -100,12 +100,11 @@ similar), or run interactively for testing purposes.
 
 USAGE
 -----
-puppet agent  [-D|--daemonize|--no-daemonize] [-d|--debug]
-  [--detailed-exitcodes] [--disable] [--enable] [-h|--help]
-  [--certname <host name>] [-l|--logdest syslog|<file>|console]
-  [-o|--onetime] [--serve <handler>] [-t|--test] [--noop]
-  [--digest <digest>] [--fingerprint] [-V|--version]
-  [-v|--verbose] [-w|--waitforcert <seconds>]
+puppet agent [--certname <name>] [-D|--daemonize|--no-daemonize]
+  [-d|--debug] [--detailed-exitcodes] [--digest <digest>] [--disable] [--enable]
+  [--fingerprint] [-h|--help] [-l|--logdest syslog|<file>|console]
+  [--no-client] [--noop] [-o|--onetime] [--serve <handler>] [-t|--test]
+  [-v|--verbose] [-V|--version] [-w|--waitforcert <seconds>]
 
 
 DESCRIPTION
@@ -172,6 +171,13 @@ full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet agent with
 '--genconfig'.
 
+* --certname:
+  Set the certname (unique ID) of the client. The master reads this
+  unique identifying string, which is usually set to the node's
+  fully-qualified domain name, to determine which configurations the
+  node will receive. Use this option to debug setup problems or
+  implement unusual node identification schemes.
+
 * --daemonize:
   Send the process into the background. This is the default.
 
@@ -181,17 +187,17 @@ configuration options can also be generated by running puppet agent with
 * --debug:
   Enable full debugging.
 
-* --digest:
-  Change the certificate fingerprinting digest algorithm. The default is
-  MD5. Valid values depends on the version of OpenSSL installed, but
-  should always at least contain MD5, MD2, SHA1 and SHA256.
-
 * --detailed-exitcodes:
   Provide transaction information via exit codes. If this is enabled, an exit
   code of '2' means there were changes, an exit code of '4' means there were
   failures during the transaction, and an exit code of '6' means there were both
   changes and failures.
 
+* --digest:
+  Change the certificate fingerprinting digest algorithm. The default is
+  MD5. Valid values depends on the version of OpenSSL installed, but
+  should always at least contain MD5, MD2, SHA1 and SHA256.
+
 * --disable:
   Disable working on the local system. This puts a lock file in place,
   causing 'puppet agent' not to work on the system until the lock file
@@ -212,12 +218,10 @@ configuration options can also be generated by running puppet agent with
 
   'puppet agent' exits after executing this.
 
-* --certname:
-  Set the certname (unique ID) of the client. The master reads this
-  unique identifying string, which is usually set to the node's
-  fully-qualified domain name, to determine which configurations the
-  node will receive. Use this option to debug setup problems or
-  implement unusual node identification schemes.
+* --fingerprint:
+  Display the current certificate or certificate signing request
+  fingerprint and then exit. Use the '--digest' option to change the
+  digest algorithm used.
 
 * --help:
   Print this help message
@@ -230,18 +234,19 @@ configuration options can also be generated by running puppet agent with
 * --no-client:
   Do not create a config client. This will cause the daemon to run
   without ever checking for its configuration automatically, and only
-  makes sense
+  makes sense when puppet agent is being run with listen = true in puppet.conf
+  or was started with the `--listen` option.
+
+* --noop:
+  Use 'noop' mode where the daemon runs in a no-op or dry-run mode. This
+  is useful for seeing what changes Puppet will make without actually
+  executing the changes.
 
 * --onetime:
   Run the configuration once. Runs a single (normally daemonized) Puppet
   run. Useful for interactively running puppet agent when used in
   conjunction with the --no-daemonize option.
 
-* --fingerprint:
-  Display the current certificate or certificate signing request
-  fingerprint and then exit. Use the '--digest' option to change the
-  digest algorithm used.
-
 * --serve:
   Start another type of server. By default, 'puppet agent' will start a
   service handler that allows authenticated and authorized remote nodes
@@ -256,11 +261,6 @@ configuration options can also be generated by running puppet agent with
   'verbose', 'ignorecache', 'no-daemonize', 'no-usecacheonfailure',
   'detailed-exit-codes', 'no-splay', and 'show_diff'.
 
-* --noop:
-  Use 'noop' mode where the daemon runs in a no-op or dry-run mode. This
-  is useful for seeing what changes Puppet will make without actually
-  executing the changes.
-
 * --verbose:
   Turn on verbose reporting.
 
@@ -290,7 +290,7 @@ Puppet agent accepts the following signals:
   Restart the puppet agent daemon.
 * SIGINT and SIGTERM:
   Shut down the puppet agent daemon.
-* SIGUSR1: 
+* SIGUSR1:
   Immediately retrieve and apply configurations from the puppet master.
 
 AUTHOR

data/lib/puppet/application/doc.rb

@@ -252,7 +252,7 @@ HELP
       @unknown_args.each do |option|
         # force absolute path for modulepath when passed on commandline
         if option[:opt]=="--modulepath" or option[:opt] == "--manifestdir"
-          option[:arg] = option[:arg].split(':').collect { |p| File.expand_path(p) }.join(':')
+          option[:arg] = option[:arg].split(File::PATH_SEPARATOR).collect { |p| File.expand_path(p) }.join(File::PATH_SEPARATOR)
         end
         Puppet.settings.handlearg(option[:opt], option[:arg])
       end

data/lib/puppet/application/inspect.rb

@@ -31,7 +31,7 @@ Prepares and submits an inspection report to the puppet master.
 
 USAGE
 -----
-puppet inspect
+puppet inspect [--archive_files] [--archive_file_server]
 
 
 DESCRIPTION
@@ -57,6 +57,14 @@ configuration file documentation at
 http://docs.puppetlabs.com/references/latest/configuration.html for
 the full list of acceptable settings.
 
+* --archive_files:
+  During an inspect run, whether to archive files whose contents are audited to
+  a file bucket.
+
+* --archive_file_server:
+  During an inspect run, the file bucket server to archive files to if
+  archive_files is set.  The default value is '$server'.
+
 
 AUTHOR
 ------

data/lib/puppet/application/master.rb

@@ -206,6 +206,8 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
   end
 
   def setup
+    raise Puppet::Error.new("Puppet master is not supported on Microsoft Windows") if Puppet.features.microsoft_windows?
+
     # Handle the logging settings.
     if options[:debug] or options[:verbose]
       if options[:debug]

data/lib/puppet/application/queue.rb

@@ -151,7 +151,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     require 'puppet/resource/catalog'
-    Puppet::Resource::Catalog.indirection.terminus_class = :active_record
+    Puppet::Resource::Catalog.indirection.terminus_class = :store_configs
 
     daemon.daemonize if Puppet[:daemonize]
 

data/lib/puppet/application/resource.rb

@@ -183,6 +183,9 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
         [ Puppet::Resource.indirection.save(Puppet::Resource.new( type, name, :parameters => params ), key) ]
       end
     else
+      if type == "file"
+        raise "Listing all file instances is not supported.  Please specify a file or directory, e.g. puppet resource file /etc"
+      end
       Puppet::Resource.indirection.search( key, {} )
     end.map(&format).join("\n")
 

data/lib/puppet/application.rb

@@ -215,11 +215,10 @@ class Application
     def find(name)
       klass = name.to_s.capitalize
 
-      # const_defined? is used before const_get since const_defined? will only
-      # check within our namespace, whereas const_get will check ancestor
-      # trees as well, resulting in unexpected behaviour.
-      if !self.const_defined?(klass)
-        puts "Unable to find application '#{name.to_s}'."
+      begin
+        require File.join('puppet', 'application', name.to_s.downcase)
+      rescue LoadError => e
+        puts "Unable to find application '#{name}'.  #{e}"
         Kernel::exit(1)
       end
 

data/lib/puppet/configurer.rb

@@ -102,6 +102,7 @@ class Puppet::Configurer
     catalog.finalize
     catalog.retrieval_duration = duration
     catalog.write_class_file
+    catalog.write_resource_file
     catalog
   end
 
@@ -161,10 +162,6 @@ class Puppet::Configurer
       # Make sure we forget the retained module_directories of any autoload
       # we might have used.
       Thread.current[:env_module_directories] = nil
-
-      # Now close all of our existing http connections, since there's no
-      # reason to leave them lying open.
-      Puppet::Network::HttpPool.clear_http_instances
     end
   ensure
     Puppet::Util::Log.close(report)

data/lib/puppet/defaults.rb

@@ -47,10 +47,14 @@ module Puppet
       exits.  Comma-separate multiple values.  For a list of all values,
       specify 'all'.  This feature is only available in Puppet versions
       higher than 0.18.4."],
-    :color => ["ansi", "Whether to use colors when logging to the console.
+    :color => {
+      :default => (Puppet.features.microsoft_windows? ? "false" : "ansi"),
+      :type    => :setting,
+      :desc    => "Whether to use colors when logging to the console.
       Valid values are `ansi` (equivalent to `true`), `html` (mostly
       used during testing with TextMate), and `false`, which produces
-      no color."],
+      no color.",
+    },
     :mkusers => [false,
       "Whether to create the necessary user and group that puppet agent will
       run as."],
@@ -437,9 +441,11 @@ module Puppet
       authorization system for `puppet master`."
     ],
     :ca => [true, "Wether the master should function as a certificate authority."],
-    :modulepath => {:default => "$confdir/modules:/usr/share/puppet/modules",
-      :desc => "The search path for modules as a colon-separated list of
-      directories.", :type => :setting }, # We don't want this to be considered a file, since it's multiple files.
+    :modulepath => {
+      :default => "$confdir/modules#{File::PATH_SEPARATOR}/usr/share/puppet/modules",
+      :desc => "The search path for modules as a list of directories separated by the '#{File::PATH_SEPARATOR}' character.",
+      :type => :setting # We don't want this to be considered a file, since it's multiple files.
+    },
     :ssl_client_header => ["HTTP_X_CLIENT_DN", "The header containing an authenticated
       client's SSL DN.  Only used with Mongrel.  This header must be set by the proxy
       to the authenticated client's SSL DN (e.g., `/CN=puppet.puppetlabs.com`).
@@ -533,6 +539,11 @@ module Puppet
         associated with the retrieved configuration.  Can be loaded in
         the separate `puppet` executable using the `--loadclasses`
         option."},
+    :resourcefile => { :default => "$statedir/resources.txt",
+      :owner => "root",
+      :mode => 0644,
+      :desc => "The file in which puppet agent stores a list of the resources
+        associated with the retrieved configuration."  },
     :puppetdlog => { :default => "$logdir/puppetd.log",
       :owner => "root",
       :mode => 0640,
@@ -545,7 +556,10 @@ module Puppet
     :puppetport => [8139, "Which port puppet agent listens on."],
     :noop => [false, "Whether puppet agent should be run in noop mode."],
     :runinterval => [1800, # 30 minutes
-      "How often puppet agent applies the client configuration; in seconds."],
+      "How often puppet agent applies the client configuration; in seconds.
+      Note that a runinterval of 0 means \"run continuously\" rather than
+      \"never run.\" If you want puppet agent to never run, you should start
+      it with the `--no-client` option."],
     :listen => [false, "Whether puppet agent should listen for
       connections.  If this is true, then puppet agent will accept incoming
       REST API requests, subject to the default ACLs and the ACLs set in 
@@ -678,7 +692,7 @@ module Puppet
 
     setdefaults(
     :main,
-    :factpath => {:default => "$vardir/lib/facter:$vardir/facts",
+    :factpath => {:default => "$vardir/lib/facter#{File::PATH_SEPARATOR}$vardir/facts",
       :desc => "Where Puppet should look for facts.  Multiple directories should
         be colon-separated, like normal PATH variables.",
 
@@ -821,20 +835,36 @@ module Puppet
   )
 
   setdefaults(:master,
-    :storeconfigs => {:default => false, :desc => "Whether to store each client's configuration.  This
-      requires ActiveRecord from Ruby on Rails.",
-      :call_on_define => true, # Call our hook with the default value, so we always get the libdir set.
+    :storeconfigs => {
+      :default => false,
+      :desc => "Whether to store each client's configuration, including catalogs, facts,
+and related data.  This also enables the import and export of resources in
+the Puppet language - a mechanism for exchange resources between nodes.
+
+By default this uses ActiveRecord and an SQL database to store and query
+the data; this, in turn, will depend on Rails being available.
+
+You can adjust the backend using the storeconfigs_backend setting.",
+      # Call our hook with the default value, so we always get the libdir set.
+      :call_on_define => true,
       :hook => proc do |value|
         require 'puppet/node'
         require 'puppet/node/facts'
         if value
-          require 'puppet/rails'
-          raise "StoreConfigs not supported without ActiveRecord 2.1 or higher" unless Puppet.features.rails?
-          Puppet::Resource::Catalog.indirection.cache_class = :active_record unless Puppet.settings[:async_storeconfigs]
-          Puppet::Node::Facts.indirection.cache_class = :active_record
-          Puppet::Node.indirection.cache_class = :active_record
+          Puppet.settings[:async_storeconfigs] or
+            Puppet::Resource::Catalog.indirection.cache_class = :store_configs
+          Puppet::Node::Facts.indirection.cache_class = :store_configs
+          Puppet::Node.indirection.cache_class = :store_configs
+
+          Puppet::Resource.indirection.terminus_class = :store_configs
         end
       end
+    },
+    :storeconfigs_backend => {
+      :default => "active_record",
+      :desc => "Configure the backend terminus used for StoreConfigs.
+By default, this uses the ActiveRecord store, which directly talks to the
+database from within the Puppet Master process."
     }
   )
 

data/lib/puppet/feature/base.rb

@@ -1,10 +1,35 @@
-#  Created by Luke Kanies on 2006-04-30.
-#  Copyright (c) 2006. All rights reserved.
-
 require 'puppet/util/feature'
 
 # Add the simple features, all in one file.
 
+# Order is important as some features depend on others
+
+# We have a syslog implementation
+Puppet.features.add(:syslog, :libs => ["syslog"])
+
+# We can use POSIX user functions
+Puppet.features.add(:posix) do
+  require 'etc'
+  Etc.getpwuid(0) != nil && Puppet.features.syslog?
+end
+
+# We can use Microsoft Windows functions
+Puppet.features.add(:microsoft_windows) do
+  begin
+    require 'sys/admin'
+    require 'win32/process'
+    require 'win32/dir'
+    require 'win32/service'
+    require 'win32ole'
+    require 'win32/api'
+    true
+  rescue LoadError => err
+    warn "Cannot run on Microsoft Windows without the sys-admin, win32-process, win32-dir & win32-service gems: #{err}" unless Puppet.features.posix?
+  end
+end
+
+raise Puppet::Error,"Cannot determine basic system flavour" unless Puppet.features.posix? or Puppet.features.microsoft_windows?
+
 # We've got LDAP available.
 Puppet.features.add(:ldap, :libs => ["ldap"])
 
@@ -33,20 +58,6 @@ Puppet.features.add(:rrd, :libs => ["RRD"])
 # We have OpenSSL
 Puppet.features.add(:openssl, :libs => ["openssl"])
 
-# We have a syslog implementation
-Puppet.features.add(:syslog, :libs => ["syslog"])
-
-# We can use POSIX user functions
-Puppet.features.add(:posix) do
-  require 'etc'
-  Etc.getpwuid(0) != nil && Puppet.features.syslog?
-end
-
-# We can use Microsoft Windows functions
-Puppet.features.add(:microsoft_windows, :libs => ["sys/admin", "win32/process", "win32/dir"])
-
-raise Puppet::Error,"Cannot determine basic system flavour" unless Puppet.features.posix? or Puppet.features.microsoft_windows?
-
 # We have CouchDB
 Puppet.features.add(:couchdb, :libs => ["couchrest"])
 

data/lib/puppet/feature/rails.rb

@@ -1,6 +1,3 @@
-#  Created by Luke Kanies on 2006-11-07.
-#  Copyright (c) 2006. All rights reserved.
-
 require 'puppet/util/feature'
 
 Puppet.features.rubygems?

data/lib/puppet/feature/rubygems.rb

@@ -1,6 +1,3 @@
-#  Created by Luke Kanies on 2006-11-07.
-#  Copyright (c) 2006. All rights reserved.
-
 require 'puppet/util/feature'
 
 Puppet.features.add(:rubygems, :libs => "rubygems")

data/lib/puppet/file_bucket/dipper.rb

@@ -35,11 +35,12 @@ class Puppet::FileBucket::Dipper
     begin
       file_bucket_file = Puppet::FileBucket::File.new(contents, :bucket_path => @local_path)
       files_original_path = absolutize_path(file)
-      dest_path = "#{@rest_path}#{file_bucket_file.name}#{files_original_path}"
+      dest_path = "#{@rest_path}#{file_bucket_file.name}/#{files_original_path}"
+      file_bucket_path = "#{@rest_path}#{file_bucket_file.checksum_type}/#{file_bucket_file.checksum_data}/#{files_original_path}"
 
       # Make a HEAD request for the file so that we don't waste time
       # uploading it if it already exists in the bucket.
-      unless Puppet::FileBucket::File.indirection.head("#{@rest_path}#{file_bucket_file.checksum_type}/#{file_bucket_file.checksum_data}#{files_original_path}")
+      unless Puppet::FileBucket::File.indirection.head(file_bucket_path)
         Puppet::FileBucket::File.indirection.save(file_bucket_file, dest_path)
       end