puppet 3.4.3 → 3.5.0.rc1

data/lib/puppet/ssl/certificate_authority/interface.rb

@@ -45,7 +45,7 @@ module Puppet
 
         # List the hosts.
         def list(ca)
-          signed = ca.list
+          signed = ca.list if [:signed, :all].include?(subjects)
           requests = ca.waiting?
 
           case subjects
@@ -57,6 +57,7 @@ module Puppet
             hosts = requests
           else
             hosts = subjects
+            signed = ca.list(hosts)
           end
 
           certs = {:signed => {}, :invalid => {}, :request => {}}
@@ -72,7 +73,7 @@ module Puppet
 
             if verify_error
               certs[:invalid][host] = [ Puppet::SSL::Certificate.indirection.find(host), verify_error ]
-            elsif signed.include?(host)
+            elsif (signed and signed.include?(host))
               certs[:signed][host]  = Puppet::SSL::Certificate.indirection.find(host)
             else
               certs[:request][host] = Puppet::SSL::CertificateRequest.indirection.find(host)

data/lib/puppet/ssl/certificate_factory.rb

@@ -1,8 +1,29 @@
 require 'puppet/ssl'
 
-# The tedious class that does all the manipulations to the
-# certificate to correctly sign it.  Yay.
+# This class encapsulates the logic of creating and adding extensions to X509
+# certificates.
+#
+# @api private
 module Puppet::SSL::CertificateFactory
+
+  # Create, add extensions to, and sign a new X509 certificate.
+  #
+  # @param cert_type [Symbol] The certificate type to create, which specifies
+  #   what extensions are added to the certificate.
+  #   One of (:ca, :terminalsubca, :server, :ocsp, :client)
+  # @param csr [OpenSSL::X509::Request] The signing request associated with
+  #   the certificate being created.
+  # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
+  #   if this is a self signed certificate, or the X509 certificate of the CA if
+  #   this is a CA signed certificate.
+  # @param serial [Integer] The serial number for the given certificate, which
+  #   MUST be unique for the given CA.
+  # @param ttl [String] The duration of the validity for the given certificate.
+  #   defaults to Puppet[:ca_ttl]
+  #
+  # @api public
+  #
+  # @return [OpenSSL::X509::Certificate]
   def self.build(cert_type, csr, issuer, serial, ttl = nil)
     # Work out if we can even build the requested type of certificate.
     build_extensions = "build_#{cert_type.to_s}_extensions"
@@ -35,9 +56,27 @@ module Puppet::SSL::CertificateFactory
 
   private
 
+  # Add X509v3 extensions to the given certificate.
+  #
+  # @param cert [OpenSSL::X509::Certificate] The certificate to add the
+  #   extensions to.
+  # @param csr [OpenSSL::X509::Request] The CSR associated with the given
+  #   certificate, which may specify requested extensions for the given cert.
+  #   See http://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
+  # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
+  #   if this is a self signed certificate, or the X509 certificate of the CA if
+  #   this is a CA signed certificate.
+  # @param extensions [Hash<String, Array<String> | String>] The extensions to
+  #   add to the certificate, based on the certificate type being created (CA,
+  #   server, client, etc)
+  #
+  # @api private
+  #
+  # @return [void]
   def self.add_extensions_to(cert, csr, issuer, extensions)
-    ef = OpenSSL::X509::ExtensionFactory.
-      new(cert, issuer.is_a?(OpenSSL::X509::Request) ? cert : issuer)
+    ef = OpenSSL::X509::ExtensionFactory.new
+    ef.subject_certificate = cert
+    ef.issuer_certificate  = issuer.is_a?(OpenSSL::X509::Request) ? cert : issuer
 
     # Extract the requested extensions from the CSR.
     requested_exts = csr.request_extensions.inject({}) do |hash, re|
@@ -60,7 +99,13 @@ module Puppet::SSL::CertificateFactory
     # certificate through where the CA constraint was true, though, if
     # something went wrong up there. --daniel 2011-10-11
     defaults = { "nsComment" => "Puppet Ruby/OpenSSL Internal Certificate" }
-    override = { "subjectKeyIdentifier" => "hash" }
+
+    # See http://www.openssl.org/docs/apps/x509v3_config.html
+    # for information about the special meanings of 'hash', 'keyid', 'issuer'
+    override = {
+      "subjectKeyIdentifier"   => "hash",
+      "authorityKeyIdentifier" => "keyid,issuer"
+    }
 
     exts = [defaults, requested_exts, extensions, override].
       inject({}) {|ret, val| ret.merge(val) }

data/lib/puppet/ssl/certificate_request.rb

@@ -205,7 +205,7 @@ DOC
         csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
         Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
       rescue OpenSSL::X509::AttributeError => e
-        raise Puppet::Error, "Cannot create CSR with attribute #{oid}: #{e.message}"
+        raise Puppet::Error, "Cannot create CSR with attribute #{oid}: #{e.message}", e.backtrace
       end
     end
   end
@@ -230,7 +230,7 @@ DOC
           ext = OpenSSL::X509::Extension.new(oid, value.to_s, false)
           extensions << ext
         rescue OpenSSL::X509::ExtensionError => e
-          raise Puppet::Error, "Cannot create CSR with extension request #{oid}: #{e.message}"
+          raise Puppet::Error, "Cannot create CSR with extension request #{oid}: #{e.message}", e.backtrace
         end
       end
     end

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -20,7 +20,7 @@ class Puppet::SSL::CertificateRequestAttributes
   # @raise [Puppet::Error] if there are unexpected attribute keys
   def load
     Puppet.info("csr_attributes file loading from #{path}")
-    if Puppet::FileSystem::File.exist?(path)
+    if Puppet::FileSystem.exist?(path)
       hash = Puppet::Util::Yaml.load_file(path, {})
       if ! hash.is_a?(Hash)
         raise Puppet::Error, "invalid CSR attributes, expected instance of Hash, received instance of #{hash.class}"

data/lib/puppet/ssl/certificate_revocation_list.rb

@@ -60,13 +60,15 @@ DOC
 private
 
   def create_crl_issued_by(cert)
+    ef = OpenSSL::X509::ExtensionFactory.new(cert)
     @content = wrapped_class.new
     @content.issuer = cert.subject
+    @content.add_extension(ef.create_ext("authorityKeyIdentifier", "keyid:always"))
     @content.version = 1
   end
 
   def start_at_initial_crl_number
-    @content.extensions = [crl_number_of(0)]
+    @content.add_extension(crl_number_of(0))
   end
 
   def add_certificate_revocation_for(serial, reason, time)

data/lib/puppet/ssl/host.rb

@@ -118,14 +118,19 @@ DOC
     indirection.destroy(name)
   end
 
-  def self.from_pson(pson)
-    instance = new(pson["name"])
-    if pson["desired_state"]
-      instance.desired_state = pson["desired_state"]
+  def self.from_data_hash(data)
+    instance = new(data["name"])
+    if data["desired_state"]
+      instance.desired_state = data["desired_state"]
     end
     instance
   end
 
+  def self.from_pson(pson)
+    Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
+    self.from_data_hash(pson)
+  end
+
   # Puppet::SSL::Host is actually indirected now so the original implementation
   # has been moved into the certificate_status indirector.  This method does not
   # appear to be in use in `puppet cert -l`.
@@ -307,10 +312,6 @@ ERROR_STRING
     result
   end
 
-  def to_pson(*args)
-    to_data_hash.to_pson(*args)
-  end
-
   # eventually we'll probably want to move this somewhere else or make it
   # configurable
   # --jeffweiss 29 aug 2012

data/lib/puppet/ssl/inventory.rb

@@ -37,7 +37,7 @@ class Puppet::SSL::Inventory
 
   # Find the serial number for a given certificate.
   def serial(name)
-    return nil unless Puppet::FileSystem::File.exist?(@path)
+    return nil unless Puppet::FileSystem.exist?(@path)
 
     File.readlines(@path).each do |line|
       next unless line =~ /^(\S+).+\/CN=#{name}$/

data/lib/puppet/ssl/key.rb

@@ -36,7 +36,7 @@ DOC
   end
 
   def password
-    return nil unless password_file and Puppet::FileSystem::File.exist?(password_file)
+    return nil unless password_file and Puppet::FileSystem.exist?(password_file)
 
     ::File.read(password_file)
   end

data/lib/puppet/ssl/validator/default_validator.rb

@@ -148,6 +148,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # @api private
   #
   def ssl_certificates_are_present?
-    Puppet::FileSystem::File.exist?(Puppet[:hostcert]) && Puppet::FileSystem::File.exist?(@ssl_configuration.ca_auth_file)
+    Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ssl_configuration.ca_auth_file)
   end
 end

data/lib/puppet/status.rb

@@ -14,16 +14,17 @@ class Puppet::Status
     @status
   end
 
-  def to_pson(*args)
-    @status.to_pson
+  def self.from_data_hash(data)
+    if data.include?('status')
+      self.new(data['status'])
+    else
+      self.new(data)
+    end
   end
 
   def self.from_pson(pson)
-    if pson.include?('status')
-      self.new(pson['status'])
-    else
-      self.new(pson)
-    end
+    Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
+    self.from_data_hash(pson)
   end
 
   def name

data/lib/puppet/test/test_helper.rb

@@ -1,5 +1,8 @@
 require 'puppet/indirector/data_binding/hiera'
 
+require 'tmpdir'
+require 'fileutils'
+
 module Puppet::Test
   # This class is intended to provide an API to be used by external projects
   #  when they are running tests that depend on puppet core.  This should
@@ -33,26 +36,39 @@ module Puppet::Test
     # that call Puppet.
     # @return nil
     def self.initialize()
-      initialize_settings_before_each
+      owner = Process.pid
+      @environmentdir = Dir.mktmpdir('environments')
+      Puppet.push_context(Puppet.base_context({
+        :environmentpath => @environmentdir,
+        :basemodulepath => "",
+        :manifest => "/dev/null"
+      }), "Initial for specs")
+      Puppet::Parser::Functions.reset
+
+      ObjectSpace.define_finalizer(Puppet.lookup(:environments), proc {
+        if Process.pid == owner
+          FileUtils.rm_rf(@environmentdir)
+        end
+      })
     end
 
     # Call this method once, when beginning a test run--prior to running
     #  any individual tests.
     # @return nil
     def self.before_all_tests()
-
+      # Make sure that all of the setup is also done for any before(:all) blocks
     end
 
     # Call this method once, at the end of a test run, when no more tests
     #  will be run.
     # @return nil
     def self.after_all_tests()
-
     end
 
     # Call this method once per test, prior to execution of each invididual test.
     # @return nil
     def self.before_each_test()
+
       # We need to preserve the current state of all our indirection cache and
       # terminus classes.  This is pretty important, because changes to these
       # are global and lead to order dependencies in our testing.
@@ -83,8 +99,15 @@ module Puppet::Test
 
       initialize_settings_before_each()
 
-      Puppet::Node::Environment.clear
+      Puppet.push_context(
+        {
+          :trusted_information =>
+            Puppet::Context::TrustedInformation.new('local', 'testing', {}),
+        },
+        "Context for specs")
+
       Puppet::Parser::Functions.reset
+      Puppet::Node::Environment.clear
       Puppet::Application.clear!
       Puppet::Util::Profiler.clear
 
@@ -137,6 +160,7 @@ module Puppet::Test
       $LOAD_PATH.clear
       $old_load_path.each {|x| $LOAD_PATH << x }
 
+      Puppet.pop_context
     end
 
 
@@ -179,6 +203,13 @@ module Puppet::Test
       # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
       Puppet[:req_bits]  = 512
       Puppet[:keylength] = 512
+
+      # Although we setup a testing context during initialization, some tests
+      # will end up creating their own context using the real context objects
+      # and use the setting for the environments. In order to avoid those tests
+      # having to deal with a missing environmentpath we can just set it right
+      # here.
+      Puppet[:environmentpath] = @environmentpath
     end
     private_class_method :initialize_settings_before_each
   end

data/lib/puppet/transaction/event.rb

@@ -19,12 +19,17 @@ class Puppet::Transaction::Event
 
   EVENT_STATUSES = %w{noop success failure audit}
 
-  def self.from_pson(data)
+  def self.from_data_hash(data)
     obj = self.allocate
     obj.initialize_from_hash(data)
     obj
   end
 
+  def self.from_pson(data)
+    Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
+    self.from_data_hash(data)
+  end
+
   def initialize(options = {})
     @audited = false
 
@@ -59,10 +64,6 @@ class Puppet::Transaction::Event
     }
   end
 
-  def to_pson(*args)
-    to_data_hash.to_pson(*args)
-  end
-
   def property=(prop)
     @property = prop.to_s
   end

data/lib/puppet/transaction/report.rb

@@ -57,8 +57,7 @@ class Puppet::Transaction::Report
   attr_accessor :environment
 
   # A hash with a map from resource to status
-  # @return [Hash<{String => String}>] Resource name to status string.
-  # @todo Uncertain if the types in the hash are correct...
+  # @return [Hash{String => Puppet::Resource::Status}] Resource name to status.
   attr_reader :resource_statuses
 
   # A list of log messages.
@@ -98,12 +97,17 @@ class Puppet::Transaction::Report
   #
   attr_reader :report_format
 
-  def self.from_pson(data)
+  def self.from_data_hash(data)
     obj = self.allocate
     obj.initialize_from_hash(data)
     obj
   end
 
+  def self.from_pson(data)
+    Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
+    self.from_data_hash(data)
+  end
+
   def as_logging_destination(&block)
     Puppet::Util::Log.with_destination(self, &block)
   end
@@ -198,11 +202,11 @@ class Puppet::Transaction::Report
 
     @metrics = {}
     data['metrics'].each do |name, hash|
-      @metrics[name] = Puppet::Util::Metric.from_pson(hash)
+      @metrics[name] = Puppet::Util::Metric.from_data_hash(hash)
     end
 
     @logs = data['logs'].map do |record|
-      Puppet::Util::Log.from_pson(record)
+      Puppet::Util::Log.from_data_hash(record)
     end
 
     @resource_statuses = {}
@@ -210,7 +214,7 @@ class Puppet::Transaction::Report
       if record[1] == {}
         status = nil
       else
-        status = Puppet::Resource::Status.from_pson(record[1])
+        status = Puppet::Resource::Status.from_data_hash(record[1])
       end
       @resource_statuses[record[0]] = status
     end
@@ -234,10 +238,6 @@ class Puppet::Transaction::Report
     }
   end
 
-  def to_pson
-    to_data_hash.to_pson
-  end
-
   # @return [String] the host name
   # @api public
   #

data/lib/puppet/type.rb

@@ -1182,6 +1182,7 @@ class Type
     # Now create our resource.
     resource = Puppet::Resource.new(self.name, title)
     resource.catalog = hash.delete(:catalog)
+    resource.resource_type = self
 
     hash.each do |param, value|
       resource[param] = value
@@ -2427,6 +2428,3 @@ end
 end
 
 require 'puppet/provider'
-
-# Always load these types.
-Puppet::Type.type(:component)

data/lib/puppet/type/augeas.rb

@@ -139,7 +139,8 @@ Puppet::Type.newtype(:augeas) do
 
   newparam(:lens) do
     desc "Use a specific lens, e.g. `Hosts.lns`. When this parameter is set, you
-      must also set the `incl` parameter to indicate which file to load."
+      must also set the `incl` parameter to indicate which file to load.
+      The Augeas documentation includes [a list of available lenses](http://augeas.net/stock_lenses.html)."
   end
 
   newparam(:incl) do

data/lib/puppet/type/cron.rb

@@ -7,15 +7,14 @@ Puppet::Type.newtype(:cron) do
     Installs and manages cron jobs.  Every cron resource requires a command
     and user attribute, as well as at least one periodic attribute (hour,
     minute, month, monthday, weekday, or special).  While the name of the cron
-    job is not part of the actual job, it is used by Puppet to store and
-    retrieve it.
+    job is not part of the actual job, the name is stored in a comment beginning with
+    `# Puppet Name: `. These comments are used to match crontab entries created by
+    Puppet with cron resources.
 
-    If you specify a cron resource that duplicates the scheduling and command
-    used by an existing crontab entry, then Puppet will take no action and
-    defers to the existing crontab entry.  If the duplicate cron resource
-    specifies `ensure => absent`, all existing duplicated crontab entries will
-    be removed.  Specifying multiple duplicate cron resources with different
-    `ensure` states will result in undefined behavior.
+    If an existing crontab entry happens to match the scheduling and command of a
+    cron resource that has never been synched, Puppet will defer to the existing
+    crontab entry and will not create a new entry tagged with the `# Puppet Name: `
+    comment.
 
     Example:
 
@@ -234,9 +233,7 @@ Puppet::Type.newtype(:cron) do
     end
 
     def munge(value)
-      value.sub!(/^\s+/, '')
-      value.sub!(/\s+$/, '')
-      value
+      value.strip
     end
   end
 
@@ -409,10 +406,43 @@ Puppet::Type.newtype(:cron) do
     }
   end
 
+  validate do
+    return true unless self[:special]
+    return true if self[:special] == :absent
+    # there is a special schedule in @should, so we don't want to see
+    # any numeric should values
+    [ :minute, :hour, :weekday, :monthday, :month ].each do |field|
+      next unless self[field]
+      next if self[field] == :absent
+      raise ArgumentError, "#{self.ref} cannot specify both a special schedule and a value for #{field}"
+    end
+  end
+
   # We have to reorder things so that :provide is before :target
 
   attr_accessor :uid
 
+  # Marks the resource as "being purged".
+  #
+  # @api public
+  #
+  # @note This overrides the Puppet::Type method in order to handle
+  #   an edge case that has so far been observed during testig only.
+  #   Without forcing the should-value for the user property to be
+  #   identical to the original cron file, purging from a fixture
+  #   will not work, because the user property defaults to the user
+  #   running the test. It is not clear whether this scenario can apply
+  #   during normal operation.
+  #
+  # @note Also, when not forcing the should-value for the target
+  #   property, unpurged file content (such as comments) can end up
+  #   being written to the default target (i.e. the current login name).
+  def purging
+    self[:target] = provider.property_hash[:target]
+    self[:user] = provider.property_hash[:target]
+    super
+  end
+
   def value(name)
     name = name.intern
     ret = nil