puppet 3.4.3 → 3.5.0.rc1

data/lib/puppet/application/filebucket.rb

@@ -57,9 +57,9 @@ use your local file bucket by specifying '--local'.
 
 OPTIONS
 -------
-Note that any configuration parameter that's valid in the configuration
+Note that any setting that's valid in the configuration
 file is also a valid long argument. For example, 'ssldir' is a valid
-configuration parameter, so you can specify '--ssldir <directory>' as an
+setting, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at
@@ -129,7 +129,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     raise "You must specify a file to back up" unless args.length > 0
 
     args.each do |file|
-      unless Puppet::FileSystem::File.exist?(file)
+      unless Puppet::FileSystem.exist?(file)
         $stderr.puts "#{file}: no such file"
         next
       end

data/lib/puppet/application/kick.rb

@@ -102,9 +102,9 @@ about security settings.
 
 OPTIONS
 -------
-Note that any configuration parameter that's valid in the configuration
+Note that any setting that's valid in the configuration
 file is also a valid long argument. For example, 'ssldir' is a valid
-configuration parameter, so you can specify '--ssldir <directory>' as an
+setting, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at

data/lib/puppet/application/master.rb

@@ -170,7 +170,7 @@ Copyright (c) 2012 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
       puts PSON::pretty_generate(catalog.to_resource, :allow_nan => true, :max_nesting => false)
     rescue => detail
-      $stderr.puts detail
+      Puppet.log_exception(detail, "Failed to compile catalog for node #{options[:node]}: #{detail}")
       exit(30)
     end
     exit(0)

data/lib/puppet/application/queue.rb

@@ -42,13 +42,13 @@ class Puppet::Application::Queue < Puppet::Application
   def help
     <<-HELP
 
-puppet-queue(8) -- Queuing daemon for asynchronous storeconfigs
+puppet-queue(8) -- Deprecated queuing daemon for asynchronous storeconfigs
 ========
 
 SYNOPSIS
 --------
 Retrieves serialized storeconfigs records from a queue and processes
-them in order.
+them in order. THIS FEATURE IS DEPRECATED; use PuppetDB instead.
 
 
 USAGE
@@ -60,19 +60,19 @@ DESCRIPTION
 -----------
 This application runs as a daemon and processes storeconfigs data,
 retrieving the data from a stomp server message queue and writing it to
-a database.
+a database. It was once necessary as a workaround for the poor performance
+of ActiveRecord-based storeconfigs, but has been supplanted by the PuppetDB
+service, which gives better performance with less complexity.
 
-For more information, including instructions for properly setting up
-your puppet master and message queue, see the documentation on setting
-up asynchronous storeconfigs at:
-http://projects.puppetlabs.com/projects/1/wiki/Using_Stored_Configuration
+For more information, see the PuppetDB documentation at
+http://docs.puppetlabs.com/puppetdb/latest
 
 
 OPTIONS
 -------
-Note that any configuration parameter that's valid in the configuration
+Note that any setting that's valid in the configuration
 file is also a valid long argument. For example, 'server' is a valid
-configuration parameter, so you can specify '--server <servername>' as
+setting, so you can specify '--server <servername>' as
 an argument.
 
 See the configuration file documentation at

data/lib/puppet/application/resource.rb

@@ -71,9 +71,9 @@ and then apply the saved file as a Puppet transaction.
 
 OPTIONS
 -------
-Note that any configuration parameter that's valid in the configuration
+Note that any setting that's valid in the configuration
 file is also a valid long argument. For example, 'ssldir' is a valid
-configuration parameter, so you can specify '--ssldir <directory>' as an
+setting, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at

data/lib/puppet/bindings.rb

@@ -74,7 +74,7 @@ class Puppet::Bindings
   end
 
   def self.register_proc(name, block)
-    adapter = NamedBindingsAdapter.adapt(Environment.current)
+    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
     adapter[name] = block
   end
 
@@ -83,7 +83,7 @@ class Puppet::Bindings
   # @api public
   #
   def self.register(named_bindings)
-    adapter = NamedBindingsAdapter.adapt(Environment.current)
+    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
     adapter[named_bindings.name] = named_bindings
   end
 
@@ -91,7 +91,7 @@ class Puppet::Bindings
     entry = get(name)
     return entry unless entry.is_a?(Proc)
     named_bindings = Puppet::Pops::Binder::BindingsFactory.safe_named_bindings(name, scope, &entry).model
-    adapter = NamedBindingsAdapter.adapt(Environment.current)
+    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
     adapter[named_bindings.name] = named_bindings
     named_bindings
   end
@@ -102,7 +102,7 @@ class Puppet::Bindings
   # @api public
   #
   def self.get(name)
-    adapter = NamedBindingsAdapter.adapt(Environment.current)
+    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
     adapter[name]
   end
 
@@ -112,7 +112,7 @@ class Puppet::Bindings
 
   # Supports Enumerable iteration (k,v) over the named bindings hash.
   def self.each
-    adapter = NamedBindingsAdapter.adapt(Environment.current)
+    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
     adapter.each_pair {|k,v| yield k,v }
   end
 
@@ -144,4 +144,4 @@ class Puppet::Bindings
     end
   end
 
-end
+end

data/lib/puppet/configurer.rb

@@ -44,10 +44,10 @@ class Puppet::Configurer
   rescue => detail
     Puppet.log_exception(detail, "Removing corrupt state file #{Puppet[:statefile]}: #{detail}")
     begin
-      Puppet::FileSystem::File.unlink(Puppet[:statefile])
+      Puppet::FileSystem.unlink(Puppet[:statefile])
       retry
     rescue => detail
-      raise Puppet::Error.new("Cannot remove #{Puppet[:statefile]}: #{detail}")
+      raise Puppet::Error.new("Cannot remove #{Puppet[:statefile]}: #{detail}", detail)
     end
   end
 
@@ -148,20 +148,23 @@ class Puppet::Configurer
         query_options = get_facts(options)
       end
 
-      begin
-        if node = Puppet::Node.indirection.find(Puppet[:node_name_value],
-            :environment => @environment, :ignore_cache => true)
-          if node.environment.to_s != @environment
-            Puppet.warning "Local environment: \"#{@environment}\" doesn't match server specified node environment \"#{node.environment}\", switching agent to \"#{node.environment}\"."
-            @environment = node.environment.to_s
-            query_options = nil
+      # We only need to find out the environment to run in if we don't already have a catalog
+      unless options[:catalog]
+        begin
+          if node = Puppet::Node.indirection.find(Puppet[:node_name_value],
+              :environment => @environment, :ignore_cache => true)
+            if node.environment.to_s != @environment
+              Puppet.warning "Local environment: \"#{@environment}\" doesn't match server specified node environment \"#{node.environment}\", switching agent to \"#{node.environment}\"."
+              @environment = node.environment.to_s
+              query_options = nil
+            end
           end
+        rescue SystemExit,NoMemoryError
+          raise
+        rescue Exception => detail
+          Puppet.warning("Unable to fetch my node definition, but the agent run will continue:")
+          Puppet.warning(detail)
         end
-      rescue SystemExit,NoMemoryError
-        raise
-      rescue Exception => detail
-        Puppet.warning("Unable to fetch my node definition, but the agent run will continue:")
-        Puppet.warning(detail)
       end
 
       query_options = get_facts(options) unless query_options

data/lib/puppet/configurer/fact_handler.rb

@@ -23,7 +23,7 @@ module Puppet::Configurer::FactHandler
     rescue Exception => detail
       message = "Could not retrieve local facts: #{detail}"
       Puppet.log_exception(detail, message)
-      raise Puppet::Error, message
+      raise Puppet::Error, message, detail.backtrace
     end
   end
 

data/lib/puppet/confine/any.rb

@@ -0,0 +1,26 @@
+class Puppet::Confine::Any < Puppet::Confine
+  def self.summarize(confines)
+    confines.inject(0) { |count, confine| count + confine.summary }
+  end
+
+  def pass?(value)
+    !! value
+  end
+
+  def message(value)
+    "0 confines (of #{value.length}) were true"
+  end
+
+  def summary
+    result.find_all { |v| v == true }.length
+  end
+
+  def valid?
+    if @values.any? { |value| pass?(value) }
+      true
+    else
+      Puppet.debug("#{label}: #{message(@values)}")
+      false
+    end
+  end
+end

data/lib/puppet/confine/exists.rb

@@ -6,7 +6,7 @@ class Puppet::Confine::Exists < Puppet::Confine
   end
 
   def pass?(value)
-    value && (for_binary? ? which(value) : Puppet::FileSystem::File.exist?(value))
+    value && (for_binary? ? which(value) : Puppet::FileSystem.exist?(value))
   end
 
   def message(value)

data/lib/puppet/confiner.rb

@@ -13,6 +13,7 @@ module Puppet::Confiner
   # * `:true` => a predicate code block returning true
   # * `:false` => a predicate code block returning false
   # * `:feature` => name of system feature that must be present
+  # * `:any` => an array of expressions that will be ORed together
   #
   # @example
   #   confine :operatingsystem => [:redhat, :fedora]

data/lib/puppet/context.rb

@@ -0,0 +1,55 @@
+# Puppet::Context is a system for tracking services and contextual information
+# that puppet needs to be able to run. Values are "bound" in a context when it is created
+# and cannot be changed; however a child context can be created, using
+# {#override}, that provides a different value.
+#
+# @api private
+class Puppet::Context
+  require 'puppet/context/trusted_information'
+
+  class UndefinedBindingError < Puppet::Error; end
+  class StackUnderflow < Puppet::Error; end
+
+  # @api private
+  def initialize(initial_bindings)
+    @stack = []
+    @table = initial_bindings
+    @description = "root"
+  end
+
+  # @api private
+  def push(overrides, description = "")
+    @stack.push([@table, @description])
+    @table = @table.merge(overrides || {})
+    @description = description
+  end
+
+  # @api private
+  def pop
+    if @stack.empty?
+      raise(StackUnderflow, "Attempted to pop, but already at root of the context stack.")
+    else
+      (@table, @description) = @stack.pop
+    end
+  end
+
+  # @api private
+  def lookup(name, &block)
+    if @table.include?(name)
+      @table[name]
+    elsif block
+      block.call
+    else
+      raise UndefinedBindingError, "no '#{name}' in #{@table.inspect} at top of #{@stack.inspect}"
+    end
+  end
+
+  # @api private
+  def override(bindings, description = "", &block)
+    push(bindings, description)
+
+    yield
+  ensure
+    pop
+  end
+end

data/lib/puppet/context/trusted_information.rb

@@ -0,0 +1,56 @@
+# @api private
+class Puppet::Context::TrustedInformation
+  # one of 'remote', 'local', or false, where 'remote' is authenticated via cert,
+  # 'local' is trusted by virtue of running on the same machine (not a remote
+  # request), and false is an unauthenticated remote request.
+  #
+  # @return [String, Boolean]
+  attr_reader :authenticated
+
+  # The validated certificate name used for the request
+  #
+  # @return [String]
+  attr_reader :certname
+
+  # Extra information that comes from the trusted certificate's extensions.
+  #
+  # @return [Hash{Object => Object}]
+  attr_reader :extensions
+
+  def initialize(authenticated, certname, extensions)
+    @authenticated = authenticated.freeze
+    @certname = certname.freeze
+    @extensions = extensions.freeze
+  end
+
+  def self.remote(authenticated, node_name, certificate)
+    if authenticated
+      extensions = {}
+      if certificate.nil?
+        Puppet.info('TrustedInformation expected a certificate, but none was given.')
+      else
+        extensions = Hash[certificate.custom_extensions.collect do |ext|
+          [ext['oid'].freeze, ext['value'].freeze]
+        end]
+      end
+      new('remote', node_name, extensions)
+    else
+      new(false, nil, {})
+    end
+  end
+
+  def self.local(node)
+    # Always trust local data by picking up the available parameters.
+    client_cert = node ? node.parameters['clientcert'] : nil
+
+    new('local', client_cert, {})
+  end
+
+  def to_h
+    {
+      'authenticated'.freeze => authenticated,
+      'certname'.freeze => certname,
+      'extensions'.freeze => extensions
+    }.freeze
+  end
+end

data/lib/puppet/defaults.rb

@@ -196,6 +196,11 @@ module Puppet
           is used to find modules and much more.  For servers (i.e., `puppet master`)
           this provides the default environment for nodes we know nothing about."
     },
+    :environmentpath => {
+      :default => "$confdir/environments",
+      :desc    => "A path of environment directories",
+      :type    => :path,
+    },
     :diff_args => {
         :default  => default_diffargs,
         :desc     => "Which arguments to pass to the diff command when printing differences between
@@ -251,7 +256,7 @@ module Puppet
       :type       => :terminus,
       :default    => nil,
       :desc       => "How to store cached nodes.
-      Valid values are (none), 'json', 'yaml' or write only yaml ('write_only_yaml').
+      Valid values are (none), 'json', 'msgpack', 'yaml' or write only yaml ('write_only_yaml').
       The master application defaults to 'write_only_yaml', all others to none.",
     },
     :data_binding_terminus => {
@@ -266,8 +271,9 @@ module Puppet
     },
     :binder => {
       :default => false,
-      :desc    => "Turns the binding system on or off. This includes hiera-2 and data in modules.  The binding system aggregates data from
-      modules and other locations and makes them available for lookup.  The binding system is experimental and any or all of it may change.",
+      :desc    => "Turns the binding system on or off. This includes bindings in modules.
+        The binding system aggregates data from modules and other locations and makes them available for lookup.
+        The binding system is experimental and any or all of it may change.",
       :type    => :boolean,
     },
     :binder_config => {
@@ -286,7 +292,7 @@ module Puppet
     :catalog_cache_terminus => {
       :type       => :terminus,
       :default    => nil,
-      :desc       => "How to store cached catalogs. Valid values are 'json' and 'yaml'. The agent application defaults to 'json'."
+      :desc       => "How to store cached catalogs. Valid values are 'json', 'msgpack' and 'yaml'. The agent application defaults to 'json'."
     },
     :facts_terminus => {
       :default => 'facter',
@@ -358,11 +364,11 @@ module Puppet
         :hook     => proc do |value|
           if value
             # This reconfigures the termini for Node, Facts, and Catalog
-            Puppet.settings[:storeconfigs] = true
+            Puppet.settings.override_default(:storeconfigs, true)
 
             # But then we modify the configuration
             Puppet::Resource::Catalog.indirection.cache_class = :queue
-            Puppet.settings[:catalog_cache_terminus] = :queue
+            Puppet.settings.override_default(:catalog_cache_terminus, :queue)
           else
             raise "Cannot disable asynchronous storeconfigs in a running process"
           end
@@ -377,7 +383,7 @@ module Puppet
     `active_record` backend, but will disable external tools that search the storeconfigs database.
     Thinning catalogs is generally unnecessary when using PuppetDB to store catalogs.",
       :hook     => proc do |value|
-        Puppet.settings[:storeconfigs] = true if value
+        Puppet.settings.override_default(:storeconfigs, true) if value
         end
       },
     :config_version => {
@@ -421,6 +427,11 @@ module Puppet
       :type    => :boolean,
       :desc    => "Stores trusted node data in a hash called $trusted.
         When true also prevents $trusted from being overridden in any scope.",
+    },
+    :immutable_node_data => {
+      :default => '$trusted_node_data',
+      :type    => :boolean,
+      :desc    => "When true, also prevents $trusted and $facts from being overridden in any scope",
     }
   )
   Puppet.define_settings(:module_tool,
@@ -533,7 +544,9 @@ EOT
     :certdir => {
       :default => "$ssldir/certs",
       :type   => :directory,
+      :mode => 0755,
       :owner => "service",
+      :group => "service",
       :desc => "The certificate directory."
     },
     :ssldir => {
@@ -541,18 +554,23 @@ EOT
       :type   => :directory,
       :mode => 0771,
       :owner => "service",
+      :group => "service",
       :desc => "Where SSL certificates are kept."
     },
     :publickeydir => {
       :default => "$ssldir/public_keys",
       :type   => :directory,
+      :mode => 0755,
       :owner => "service",
+      :group => "service",
       :desc => "The public key directory."
     },
     :requestdir => {
       :default => "$ssldir/certificate_requests",
       :type => :directory,
+      :mode => 0755,
       :owner => "service",
+      :group => "service",
       :desc => "Where host certificate requests are stored."
     },
     :privatekeydir => {
@@ -560,6 +578,7 @@ EOT
       :type   => :directory,
       :mode => 0750,
       :owner => "service",
+      :group => "service",
       :desc => "The private key directory."
     },
     :privatedir => {
@@ -567,6 +586,7 @@ EOT
       :type   => :directory,
       :mode => 0750,
       :owner => "service",
+      :group => "service",
       :desc => "Where the client stores private certificate information."
     },
     :passfile => {
@@ -574,6 +594,7 @@ EOT
       :type   => :file,
       :mode => 0640,
       :owner => "service",
+      :group => "service",
       :desc => "Where puppet agent stores the password for its private key.
         Generally unused."
     },
@@ -582,6 +603,7 @@ EOT
       :type   => :file,
       :mode => 0644,
       :owner => "service",
+      :group => "service",
       :desc => "Where individual hosts store and look for their certificate requests."
     },
     :hostcert => {
@@ -589,13 +611,15 @@ EOT
       :type   => :file,
       :mode => 0644,
       :owner => "service",
+      :group => "service",
       :desc => "Where individual hosts store and look for their certificates."
     },
     :hostprivkey => {
       :default => "$privatekeydir/$certname.pem",
       :type   => :file,
-      :mode => 0600,
+      :mode => 0640,
       :owner => "service",
+      :group => "service",
       :desc => "Where individual hosts store and look for their private key."
     },
     :hostpubkey => {
@@ -603,6 +627,7 @@ EOT
       :type   => :file,
       :mode => 0644,
       :owner => "service",
+      :group => "service",
       :desc => "Where individual hosts store and look for their public key."
     },
     :localcacert => {
@@ -610,14 +635,16 @@ EOT
       :type   => :file,
       :mode => 0644,
       :owner => "service",
+      :group => "service",
       :desc => "Where each client stores the CA certificate."
     },
     :ssl_client_ca_auth => {
       :type  => :file,
       :mode  => 0644,
       :owner => "service",
+      :group => "service",
       :desc  => "Certificate authorities who issue server certificates.  SSL servers will not be
-        considered authentic unless they posses a certificate issued by an authority
+        considered authentic unless they possess a certificate issued by an authority
         listed in this file.  If this setting has no value then the Puppet master's CA
         certificate (localcacert) will be used."
     },
@@ -625,8 +652,9 @@ EOT
       :type  => :file,
       :mode  => 0644,
       :owner => "service",
+      :group => "service",
       :desc  => "Certificate authorities who issue client certificates.  SSL clients will not be
-        considered authentic unless they posses a certificate issued by an authority
+        considered authentic unless they possess a certificate issued by an authority
         listed in this file.  If this setting has no value then the Puppet master's CA
         certificate (localcacert) will be used."
     },
@@ -635,6 +663,7 @@ EOT
       :type   => :file,
       :mode => 0644,
       :owner => "service",
+      :group => "service",
       :desc => "Where the host's certificate revocation list can be found.
         This is distinct from the certificate authority's CRL."
     },
@@ -664,7 +693,7 @@ EOT
       :type => :directory,
       :owner => "service",
       :group => "service",
-      :mode => 0770,
+      :mode => 0755,
       :desc => "The root directory for the certificate authority."
     },
     :cacert => {
@@ -672,7 +701,7 @@ EOT
       :type => :file,
       :owner => "service",
       :group => "service",
-      :mode => 0660,
+      :mode => 0644,
       :desc => "The CA certificate."
     },
     :cakey => {
@@ -680,7 +709,7 @@ EOT
       :type => :file,
       :owner => "service",
       :group => "service",
-      :mode => 0660,
+      :mode => 0640,
       :desc => "The CA private key."
     },
     :capub => {
@@ -688,6 +717,7 @@ EOT
       :type => :file,
       :owner => "service",
       :group => "service",
+      :mode => 0644,
       :desc => "The CA public key."
     },
     :cacrl => {
@@ -695,8 +725,7 @@ EOT
       :type => :file,
       :owner => "service",
       :group => "service",
-      :mode => 0664,
-
+      :mode => 0644,
       :desc => "The certificate revocation list (CRL) for the CA. Will be used if present but otherwise ignored.",
     },
     :caprivatedir => {
@@ -704,7 +733,7 @@ EOT
       :type => :directory,
       :owner => "service",
       :group => "service",
-      :mode => 0770,
+      :mode => 0750,
       :desc => "Where the CA stores private certificate information."
     },
     :csrdir => {
@@ -712,6 +741,7 @@ EOT
       :type => :directory,
       :owner => "service",
       :group => "service",
+      :mode  => 0755,
       :desc => "Where the CA stores certificate requests"
     },
     :signeddir => {
@@ -719,7 +749,7 @@ EOT
       :type => :directory,
       :owner => "service",
       :group => "service",
-      :mode => 0770,
+      :mode => 0755,
       :desc => "Where the CA stores signed certificates."
     },
     :capass => {
@@ -727,7 +757,7 @@ EOT
       :type => :file,
       :owner => "service",
       :group => "service",
-      :mode => 0660,
+      :mode => 0640,
       :desc => "Where the CA stores the password for the private key."
     },
     :serial => {
@@ -775,7 +805,7 @@ EOT
     :ca_ttl => {
       :default    => "5y",
       :type       => :duration,
-      :desc       => "The default TTL for new certificates. If this setting is set, ca_days is ignored.
+      :desc       => "The default TTL for new certificates.
       #{AS_DURATION}"
     },
     :req_bits => {
@@ -841,7 +871,8 @@ EOT
     :manifest => {
       :default    => "$manifestdir/site.pp",
       :type       => :file,
-      :desc       => "The entry-point manifest for puppet master.",
+      :desc       => "The entry-point manifest file for puppet master or a directory of manifests
+        to be evaluated in alphabetical order.",
     },
     :code => {
       :default    => "",
@@ -902,9 +933,15 @@ EOT
       :type       => :boolean,
       :desc       => "Whether the master should function as a certificate authority.",
     },
-    :modulepath => {
+    :basemodulepath => {
       :default => "$confdir/modules#{File::PATH_SEPARATOR}/usr/share/puppet/modules",
       :type => :path,
+      :desc => "The base non-environment specific search path for modules, included
+      also in all directory environment and default legacy environment modulepaths.",
+    },
+    :modulepath => {
+      :default => "$basemodulepath",
+      :type => :path,
       :desc => "The search path for modules, as a list of directories separated by the system
         path separator character. (The POSIX path separator is ':', and the
         Windows path separator is ';'.)",
@@ -1189,7 +1226,7 @@ EOT
       :hook => proc { |value|
         if value
           Puppet.deprecation_warning "Setting 'catalog_format' is deprecated; use 'preferred_serialization_format' instead."
-          Puppet.settings[:preferred_serialization_format] = value
+          Puppet.settings.override_default(:preferred_serialization_format, value)
         end
       }
     },
@@ -1711,7 +1748,7 @@ EOT
         if value
           if not Puppet.settings[:async_storeconfigs]
             Puppet::Resource::Catalog.indirection.cache_class = :store_configs
-            Puppet.settings[:catalog_cache_terminus] = :store_configs
+            Puppet.settings.override_default(:catalog_cache_terminus, :store_configs)
           end
           Puppet::Node::Facts.indirection.cache_class = :store_configs
 
@@ -1754,19 +1791,46 @@ EOT
       :default => "current",
       :desc => <<-'EOT'
         Selects the parser to use for parsing puppet manifests (in puppet DSL
-        language/'.pp' files). Available choices are `current` (the default),
+        language/'.pp' files). Available choices are `current` (the default)
         and `future`.
 
         The `curent` parser means that the released version of the parser should
         be used.
 
         The `future` parser is a "time travel to the future" allowing early
-        exposure to new language features. What these fatures are will vary from
+        exposure to new language features. What these features are will vary from
         release to release and they may be invididually configurable.
 
         Available Since Puppet 3.2.
       EOT
     },
+    :evaluator => {
+      :default => "future",
+      :hook => proc do |value|
+        if !['future', 'current'].include?(value)
+          raise "evaluator can only be set to 'future' or 'current', got '#{value}'"
+        end
+      end,
+      :desc => <<-'EOT'
+        Which evaluator to use when compiling Puppet manifests. Valid values
+        are `current` and `future` (the default).
+
+        **Note:** This setting is only used when `parser = future`. It allows
+        testers to turn off the `future` evaluator when doing detailed tests and
+        comparisons of the new compilation system.
+
+        Evaluation is the second stage of catalog compilation. After the parser
+        converts a manifest to a model of expressions, the evaluator processes
+        each expression. (For example, a resource declaration signals the
+        evaluator to add a resource to the catalog).
+
+        The `future` parser and evaluator are slated to become default in Puppet
+        4. Their purpose is to add new features and improve consistency
+        and reliability.
+
+        Available Since Puppet 3.5.
+      EOT
+    },
    :max_errors => {
      :default => 10,
      :desc => <<-'EOT'
@@ -1790,8 +1854,15 @@ EOT
       warnings in case multiple errors have been detected. A value of 0 is the
       same as value 1. The count is per manifest.
     EOT
+    },
+  :strict_variables => {
+    :default => false,
+    :type => :boolean,
+    :desc => <<-'EOT'
+      Makes the parser raise errors when referencing unknown variables. (This does not affect
+      referencing variables that are explicitly set to undef).
+    EOT
     }
-
   )
   define_settings(:puppetdoc,
     :document_all => {