puppet 2.7.9 → 2.7.11

data/conf/redhat/puppet.spec

@@ -5,7 +5,7 @@
 %global confdir conf/redhat
 
 Name:           puppet
-Version:        2.7.9
+Version:        2.7.10
 #Release:        0.1rc1%{?dist}
 Release:        1%{?dist}
 Summary:        A network tool for managing many disparate systems
@@ -285,6 +285,9 @@ fi
 rm -rf %{buildroot}
 
 %changelog
+* Wed Jan 25 2012 Michael Stahnke <stahnma@puppetlabs.com> - 2.7.10-1
+- Update for 2.7.10
+
 * Fri Dec 9 2011 Matthaus Litteken <matthaus@puppetlabs.com> - 2.7.9-1
 - Update for 2.7.9
 
@@ -325,6 +328,12 @@ rm -rf %{buildroot}
 * Wed Jul 06 2011 Michael Stahnke <stahnma@puppetlabs.com> - 2.7.2-0.1.rc1
 - Update to 2.7.2rc1
 
+* Mon Dec 12 2011 Matthaus Litteken <matthaus@puppetlabs.com> - 2.6.13-1
+- Release of 2.6.13
+
+* Fri Oct 21 2011 Michael Stahnke <stahnma@puppetlabs.com> - 2.6.12-1
+- CVE-2011-3872 fixes
+
 * Wed Jun 15 2011 Todd Zullinger <tmz@pobox.com> - 2.6.9-0.1.rc1
 - Update rc versioning to ensure 2.6.9 final is newer to rpm
 - sync changes with Fedora/EPEL

data/conf/solaris/pkginfo

@@ -1,6 +1,6 @@
 PKG=CSWpuppet
 NAME=puppet - System Automation Framework
-VERSION=2.7.8
+VERSION=2.7.10
 CATEGORY=application
 VENDOR=http://projects.puppetlabs.com/projects/puppet
 EMAIL=info@puppetlabs.com

data/conf/suse/puppet.spec

@@ -4,13 +4,13 @@
 
 Summary: A network tool for managing many disparate systems
 Name: puppet
-Version: 2.7.8
-Release: 0.1rc1%{?dist}
+Version: 2.7.10
+Release: 1%{?dist}
 License: Apache 2.0
 Group:    Productivity/Networking/System
 
 URL: http://puppetlabs.com/projects/puppet/
-Source0: http://puppetlabs.com/downloads/puppet/%{name}-%{version}rc1.tar.gz
+Source0: http://puppetlabs.com/downloads/puppet/%{name}-%{version}.tar.gz
 
 PreReq: %{insserv_prereq} %{fillup_prereq}
 Requires: ruby >= 1.8.2
@@ -35,7 +35,7 @@ Provides the central puppet server daemon which provides manifests to clients.
 The server can also function as a certificate authority and file server.
 
 %prep
-%setup -q -n %{name}-%{version}rc1
+%setup -q -n %{name}-%{version}
 
 %build
 for f in bin/* sbin/*; do
@@ -136,6 +136,9 @@ find %{buildroot}%{ruby_sitelibdir} -type f -perm +ugo+x -exec chmod a-x '{}' \;
 %{__rm} -rf %{buildroot}
 
 %changelog
+* Wed Jan 25 2012 Michael Stahnke <stahnma@puppetlabs.com> - 2.7.10-1
+- Update for 2.7.10
+
 * Wed Nov 30 2011 Michael Stahnke <stahnma@puppetlabs.com> - 2.7.8-0.1rc1
 - Update for 2.7.8rc1
 

data/ext/envpuppet.bat

@@ -0,0 +1,13 @@
+@echo off
+SETLOCAL
+
+REM net use Z: "\\vmware-host\Shared Folders" /persistent:yes
+
+SET PUPPET_DIR=%~dp0..
+SET FACTER_DIR=%PUPPET_DIR%\..\facter
+
+SET PATH=%PUPPET_DIR%\bin;%FACTER_DIR%\bin;%PATH%
+SET RUBYLIB=%PUPPET_DIR%\lib;%FACTER_DIR%\lib;%RUBYLIB%
+SET RUBYLIB=%RUBYLIB:\=/%
+
+ruby -S %*

data/ext/rack/files/apache2.conf

@@ -26,6 +26,10 @@ Listen 8140
         SSLVerifyDepth  1
         SSLOptions +StdEnvVars
 
+        RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
+        RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
+        RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
+
         DocumentRoot /etc/puppet/rack/public/
         RackBaseURI /
         <Directory /etc/puppet/rack/>

data/install.rb

@@ -422,16 +422,12 @@ def install_binfile(from, op_file, target)
 
     if not installed_wrapper
       tmp_file2 = File.join(tmp_dir, '_tmp_wrapper')
-      cwn = File.join(Config::CONFIG['bindir'], op_file)
       cwv = <<-EOS
 @echo off
-if "%OS%"=="Windows_NT" goto WinNT
-#{ruby} -x "#{cwn}" %1 %2 %3 %4 %5 %6 %7 %8 %9
-goto done
-:WinNT
-#{ruby} -x "#{cwn}" %*
-goto done
-:done
+setlocal
+set RUBY_BIN=%~dp0
+set RUBY_BIN=%RUBY_BIN:\\=/%
+"%RUBY_BIN%ruby.exe" -x "%RUBY_BIN%puppet" %*
 EOS
       File.open(tmp_file2, "w") { |cw| cw.puts cwv }
       FileUtils.install(tmp_file2, File.join(target, "#{op_file}.bat"), :mode => 0755, :verbose => true)

data/lib/puppet.rb

@@ -24,7 +24,7 @@ require 'puppet/util/run_mode'
 # it's also a place to find top-level commands like 'debug'
 
 module Puppet
-  PUPPETVERSION = '2.7.9'
+  PUPPETVERSION = '2.7.11'
 
   def Puppet.version
     PUPPETVERSION

data/lib/puppet/agent.rb

@@ -8,6 +8,9 @@ class Puppet::Agent
   require 'puppet/agent/locker'
   include Puppet::Agent::Locker
 
+  require 'puppet/agent/disabler'
+  include Puppet::Agent::Disabler
+
   attr_reader :client_class, :client, :splayed
 
   # Just so we can specify that we are "the" instance.
@@ -31,6 +34,10 @@ class Puppet::Agent
       Puppet.notice "Run of #{client_class} already in progress; skipping"
       return
     end
+    if disabled?
+      Puppet.notice "Skipping run of #{client_class}; administratively disabled: #{disable_message}"
+      return
+    end
     result = nil
     block_run = Puppet::Application.controlled_run do
       splay

data/lib/puppet/agent/disabler.rb

@@ -0,0 +1,27 @@
+require 'puppet/util/anonymous_filelock'
+
+module Puppet::Agent::Disabler
+  # Let the daemon run again, freely in the filesystem.
+  def enable
+    disable_lockfile.unlock
+  end
+
+  # Stop the daemon from making any catalog runs.
+  def disable(msg='')
+    disable_lockfile.lock(msg)
+  end
+
+  def disable_lockfile
+    @disable_lockfile ||= Puppet::Util::AnonymousFilelock.new(lockfile_path+".disabled")
+
+    @disable_lockfile
+  end
+
+  def disabled?
+    disable_lockfile.locked?
+  end
+
+  def disable_message
+    disable_lockfile.message
+  end
+end

data/lib/puppet/agent/locker.rb

@@ -3,16 +3,6 @@ require 'puppet/util/pidlock'
 # Break out the code related to locking the agent.  This module is just
 # included into the agent, but having it here makes it easier to test.
 module Puppet::Agent::Locker
-  # Let the daemon run again, freely in the filesystem.
-  def enable
-    lockfile.unlock(:anonymous => true)
-  end
-
-  # Stop the daemon from making any catalog runs.
-  def disable
-    lockfile.lock(:anonymous => true)
-  end
-
   # Yield if we get a lock, else do nothing.  Return
   # true/false depending on whether we get the lock.
   def lock

data/lib/puppet/application.rb

@@ -263,12 +263,15 @@ class Application
   end
 
   def initialize(command_line = nil)
+
     require 'puppet/util/command_line'
     @command_line = command_line || Puppet::Util::CommandLine.new
     set_run_mode self.class.run_mode
     @options = {}
 
     require 'puppet'
+    require 'puppet/util/instrumentation'
+    Puppet::Util::Instrumentation.init
   end
 
   # WARNING: This is a totally scary, frightening, and nasty internal API.  We

data/lib/puppet/application/agent.rb

@@ -39,7 +39,12 @@ class Puppet::Application::Agent < Puppet::Application
   end
 
   option("--centrallogging")
-  option("--disable")
+
+  option("--disable [MESSAGE]") do |message|
+    options[:disable] = true
+    options[:disable_message] = message
+  end
+
   option("--enable")
   option("--debug","-d")
   option("--fqdn FQDN","-f")
@@ -101,7 +106,7 @@ similar), or run interactively for testing purposes.
 USAGE
 -----
 puppet agent [--certname <name>] [-D|--daemonize|--no-daemonize]
-  [-d|--debug] [--detailed-exitcodes] [--digest <digest>] [--disable] [--enable]
+  [-d|--debug] [--detailed-exitcodes] [--digest <digest>] [--disable [message]] [--enable]
   [--fingerprint] [-h|--help] [-l|--logdest syslog|<file>|console]
   [--no-client] [--noop] [-o|--onetime] [--serve <handler>] [-t|--test]
   [-v|--verbose] [-V|--version] [-w|--waitforcert <seconds>]
@@ -205,6 +210,9 @@ configuration options can also be generated by running puppet agent with
   not want the central configuration to override the local state until
   everything is tested and committed.
 
+  Disable can also take an optional message that will be reported by the
+  'puppet agent' at the next disabled run.
+
   'puppet agent' uses the same lock file while it is running, so no more
   than one 'puppet agent' process is working at a time.
 
@@ -339,6 +347,8 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
       Puppet.err detail.to_s
     end
 
+    @daemon.stop(:exit => false)
+
     if not report
       exit(1)
     elsif options[:detailed_exitcodes] then
@@ -384,7 +394,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     if options[:enable]
       agent.enable
     elsif options[:disable]
-      agent.disable
+      agent.disable(options[:disable_message] || 'reason not specified')
     end
     exit(0)
   end

data/lib/puppet/application/apply.rb

@@ -182,12 +182,12 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
       Puppet[:manifest] = manifest
     end
 
-    # Collect our facts.
-    unless facts = Puppet::Node::Facts.indirection.find(Puppet[:node_name_value])
-      raise "Could not find facts for #{Puppet[:node_name_value]}"
-    end
-
     unless Puppet[:node_name_fact].empty?
+      # Collect our facts.
+      unless facts = Puppet::Node::Facts.indirection.find(Puppet[:node_name_value])
+        raise "Could not find facts for #{Puppet[:node_name_value]}"
+      end
+
       Puppet[:node_name_value] = facts.values[Puppet[:node_name_fact]]
       facts.name = Puppet[:node_name_value]
     end
@@ -198,7 +198,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     end
 
     # Merge in the facts.
-    node.merge(facts.values)
+    node.merge(facts.values) if facts
 
     # Allow users to load the classes that puppet agent creates.
     if options[:loadclasses]

data/lib/puppet/application/cert.rb

@@ -17,11 +17,11 @@ class Puppet::Application::Cert < Puppet::Application
     @subcommand = (sub == :clean ? :destroy : sub)
   end
 
-  option("--clean", "-c") do
+  option("--clean", "-c") do |arg|
     self.subcommand = "destroy"
   end
 
-  option("--all", "-a") do
+  option("--all", "-a") do |arg|
     @all = true
   end
 
@@ -29,7 +29,7 @@ class Puppet::Application::Cert < Puppet::Application
     @digest = arg
   end
 
-  option("--signed", "-s") do
+  option("--signed", "-s") do |arg|
     @signed = true
   end
 
@@ -39,7 +39,7 @@ class Puppet::Application::Cert < Puppet::Application
 
   require 'puppet/ssl/certificate_authority/interface'
   Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject {|m| m == :destroy }.each do |method|
-    option("--#{method.to_s.gsub('_','-')}", "-#{method.to_s[0,1]}") do
+    option("--#{method.to_s.gsub('_','-')}", "-#{method.to_s[0,1]}") do |arg|
       self.subcommand = method
     end
   end
@@ -48,7 +48,7 @@ class Puppet::Application::Cert < Puppet::Application
     options[:allow_dns_alt_names] = value
   end
 
-  option("--verbose", "-v") do
+  option("--verbose", "-v") do |arg|
     Puppet::Util::Log.level = :info
   end
 

data/lib/puppet/application/instrumentation_data.rb

@@ -0,0 +1,4 @@
+require 'puppet/application/indirection_base'
+
+class Puppet::Application::Instrumentation_data < Puppet::Application::IndirectionBase
+end

data/lib/puppet/application/instrumentation_listener.rb

@@ -0,0 +1,4 @@
+require 'puppet/application/indirection_base'
+
+class Puppet::Application::Instrumentation_listener < Puppet::Application::IndirectionBase
+end

data/lib/puppet/application/instrumentation_probe.rb

@@ -0,0 +1,4 @@
+require 'puppet/application/indirection_base'
+
+class Puppet::Application::Instrumentation_probe < Puppet::Application::IndirectionBase
+end

data/lib/puppet/configurer.rb

@@ -178,7 +178,9 @@ class Puppet::Configurer
   end
 
   def save_last_run_summary(report)
-    Puppet::Util::FileLocking.writelock(Puppet[:lastrunfile], 0660) do |file|
+    mode = Puppet.settings.setting(:lastrunfile).mode
+    Puppet::Util::FileLocking.writelock(Puppet[:lastrunfile]) do |file|
+      file.chmod(mode)
       file.print YAML.dump(report.raw_summary)
     end
   rescue => detail

data/lib/puppet/configurer/downloader.rb

@@ -63,14 +63,16 @@ class Puppet::Configurer::Downloader
 
   private
 
+  require 'sys/admin' if Puppet.features.microsoft_windows?
+
   def default_arguments
     {
       :path => path,
       :recurse => true,
       :source => source,
       :tag => name,
-      :owner => Process.uid,
-      :group => Process.gid,
+      :owner => Puppet.features.microsoft_windows? ? Sys::Admin.get_login : Process.uid,
+      :group => Puppet.features.microsoft_windows? ? 'S-1-0-0' : Process.gid,
       :purge => true,
       :force => true,
       :backup => false,

data/lib/puppet/configurer/fact_handler.rb

@@ -15,7 +15,6 @@ module Puppet::Configurer::FactHandler
     # finding facts and the 'rest' terminus for caching them.  Thus, we'll
     # compile them and then "cache" them on the server.
     begin
-      reload_facter
       facts = Puppet::Node::Facts.indirection.find(Puppet[:node_name_value])
       unless Puppet[:node_name_fact].empty?
         Puppet[:node_name_value] = facts.values[Puppet[:node_name_fact]]
@@ -54,24 +53,4 @@ module Puppet::Configurer::FactHandler
 
     Puppet::Configurer::Downloader.new("fact", Puppet[:factdest], Puppet[:factsource], Puppet[:factsignore]).evaluate
   end
-
-  # Clear out all of the loaded facts and reload them from disk.
-  # NOTE: This is clumsy and shouldn't be required for later (1.5.x) versions
-  # of Facter.
-  def reload_facter
-    Facter.clear
-
-    # Reload everything.
-    if Facter.respond_to? :loadfacts
-      Facter.loadfacts
-    elsif Facter.respond_to? :load
-      Facter.load
-    else
-      Puppet.warning "You should upgrade your version of Facter to at least 1.3.8"
-    end
-
-    # This loads all existing facts and any new ones.  We have to remove and
-    # reload because there's no way to unload specific facts.
-    Puppet::Node::Facts::Facter.load_fact_plugins
-  end
 end

data/lib/puppet/daemon.rb

@@ -33,9 +33,9 @@ class Puppet::Daemon
       Puppet::Util::Log.reopen
     rescue => detail
       Puppet.err "Could not start #{Puppet[:name]}: #{detail}"
-      Puppet::Util::secure_open("/tmp/daemonout", "w") { |f|
+      Puppet::Util::replace_file("/tmp/daemonout", 0644) do |f|
         f.puts "Could not start #{Puppet[:name]}: #{detail}"
-      }
+      end
       exit(12)
     end
   end
@@ -74,8 +74,7 @@ class Puppet::Daemon
   # Remove the pid file for our daemon.
   def remove_pidfile
     Puppet::Util.synchronize_on(Puppet[:name],Sync::EX) do
-      locker = Puppet::Util::Pidlock.new(pidfile)
-      locker.unlock or Puppet.err "Could not remove PID file #{pidfile}" if locker.locked?
+      Puppet::Util::Pidlock.new(pidfile).unlock
     end
   end
 

data/lib/puppet/defaults.rb

@@ -709,11 +709,11 @@ EOT
       "Whether to send reports after every transaction."
     ],
     :lastrunfile =>  { :default => "$statedir/last_run_summary.yaml",
-      :mode => 0660,
+      :mode => 0644,
       :desc => "Where puppet agent stores the last run report summary in yaml format."
     },
     :lastrunreport =>  { :default => "$statedir/last_run_report.yaml",
-      :mode => 0660,
+      :mode => 0644,
       :desc => "Where puppet agent stores the last run report in yaml format."
     },
     :graph => [false, "Whether to create dot graph files for the different