puppet 3.8.7 → 4.0.0

data/lib/puppet/settings.rb

@@ -34,8 +34,12 @@ class Puppet::Settings
   attr_accessor :files
   attr_reader :timer
 
-  # These are the settings that every app is required to specify; there are reasonable defaults defined in application.rb.
-  REQUIRED_APP_SETTINGS = [:logdir, :confdir, :vardir]
+  # These are the settings that every app is required to specify; there are
+  # reasonable defaults defined in application.rb.
+  REQUIRED_APP_SETTINGS = [:logdir, :confdir, :vardir, :codedir]
+
+  # The acceptable sections of the puppet.conf configuration file.
+  ALLOWED_SECTION_NAMES = ['main', 'master', 'agent', 'user'].freeze
 
   # This method is intended for puppet internal use only; it is a convenience method that
   # returns reasonable application default settings values for a given run_mode.
@@ -44,6 +48,7 @@ class Puppet::Settings
         :name     => run_mode.to_s,
         :run_mode => run_mode.name,
         :confdir  => run_mode.conf_dir,
+        :codedir  => run_mode.code_dir,
         :vardir   => run_mode.var_dir,
         :rundir   => run_mode.run_dir,
         :logdir   => run_mode.log_dir,
@@ -62,11 +67,11 @@ class Puppet::Settings
   end
 
   def self.hostname_fact()
-    Facter["hostname"].value
+    Facter.value :hostname
   end
 
   def self.domain_fact()
-    Facter["domain"].value
+    Facter.value :domain
   end
 
   def self.default_config_file_name
@@ -104,12 +109,6 @@ class Puppet::Settings
     @config_file_parser = Puppet::Settings::ConfigFile.new(@translate)
   end
 
-  # @param name [Symbol] The name of the setting to fetch
-  # @return [Puppet::Settings::BaseSetting] The setting object
-  def setting(name)
-    @config[name]
-  end
-
   # Retrieve a config value
   # @param param [Symbol] the name of the setting
   # @return [Object] the value of the setting
@@ -238,13 +237,6 @@ class Puppet::Settings
 
   def unsafe_flush_cache
     clearused
-
-    # Clear the list of environments, because they cache, at least, the module path.
-    # We *could* preferentially just clear them if the modulepath is changed,
-    # but we don't really know if, say, the vardir is changed and the modulepath
-    # is defined relative to it. We need the defined?(stuff) because of loading
-    # order issues.
-    Puppet::Node::Environment.clear if defined?(Puppet::Node) and defined?(Puppet::Node::Environment)
   end
   private :unsafe_flush_cache
 
@@ -385,7 +377,9 @@ class Puppet::Settings
     end
   end
 
-  # Return an object by name.
+  # Returns a given setting by name
+  # @param name [Symbol] The name of the setting to fetch
+  # @return [Puppet::Settings::BaseSetting] The setting object
   def setting(param)
     param = param.to_sym
     @config[param]
@@ -431,12 +425,6 @@ class Puppet::Settings
     @config.include?(name)
   end
 
-  # check to see if a short name is already defined
-  def shortinclude?(short)
-    short = short.intern if name.is_a? String
-    @shortnames.include?(short)
-  end
-
   # Prints the contents of a config file with the available config settings, or it
   # prints a single value of a config setting.
   def print_config_options
@@ -449,8 +437,8 @@ class Puppet::Settings
         val = val.inspect if val == ""
         hash[name] = val
       end
-      hash.sort { |a,b| a[0].to_s <=> b[0].to_s }.each do |name, val|
-        puts "#{name} = #{val}"
+      hash.sort { |a,b| a[0].to_s <=> b[0].to_s }.each do |name, v|
+        puts "#{name} = #{v}"
       end
     else
       val.split(/\s*,\s*/).sort.each do |v|
@@ -490,29 +478,6 @@ class Puppet::Settings
     (value(:configprint) != "" || value(:genconfig) || value(:genmanifest)) && true
   end
 
-  # Return a given object's file metadata.
-  def metadata(param)
-    if obj = @config[param.to_sym] and obj.is_a?(FileSetting)
-      {
-        :owner => obj.owner,
-        :group => obj.group,
-        :mode => obj.mode
-      }.delete_if { |key, value| value.nil? }
-    else
-      nil
-    end
-  end
-
-  # Make a directory with the appropriate user, group, and mode
-  def mkdir(default)
-    obj = get_config_file_default(default)
-
-    Puppet::Util::SUIDManager.asuser(obj.owner, obj.group) do
-      mode = obj.mode || 0750
-      Dir.mkdir(obj.value, mode)
-    end
-  end
-
   # The currently configured run mode that is preferred for constructing the application configuration.
   def preferred_run_mode
     @preferred_run_mode_name || :user
@@ -534,23 +499,9 @@ class Puppet::Settings
     mode
   end
 
-  # Return all of the settings associated with a given section.
-  def params(section = nil)
-    if section
-      section = section.intern if section.is_a? String
-      @config.find_all { |name, obj|
-        obj.section == section
-      }.collect { |name, obj|
-        name
-      }
-    else
-      @config.keys
-    end
-  end
-
   def parse_config(text, file = "text")
     begin
-      data = @config_file_parser.parse_file(file, text)
+      data = @config_file_parser.parse_file(file, text, ALLOWED_SECTION_NAMES)
     rescue => detail
       Puppet.log_exception(detail, "Could not parse #{file}: #{detail}")
       return
@@ -563,6 +514,11 @@ class Puppet::Settings
     # previous settings that may have come from config files.
     unsafe_clear(false, false)
 
+    # Screen settings which have been deprecated and removed from puppet.conf
+    # but are still valid on the command line and/or in environment.conf
+    screen_non_puppet_conf_settings(data)
+
+    # Make note of deprecated settings we will warn about later in initialization
     record_deprecations_from_puppet_conf(data)
 
     # And now we can repopulate with the values from our last parsing of the config files.
@@ -659,9 +615,8 @@ class Puppet::Settings
     # because multiple sections could set the same value
     # and I'm too lazy to only set the metadata once.
     if @configuration_file
-      searchpath.reverse.each do |source|
-        source = preferred_run_mode if source == :run_mode
-        if section = @configuration_file.sections[source]
+      searchpath(nil, preferred_run_mode).reverse.each do |source|
+        if source.type == :section && section = @configuration_file.sections[source.name]
           apply_metadata_from_section(section)
         end
       end
@@ -773,22 +728,24 @@ class Puppet::Settings
     self.use(*new)
   end
 
-  # The order in which to search for values.
-  def searchpath(environment = nil)
-    [:memory, :cli, environment, :run_mode, :main, :application_defaults, :overridden_defaults].compact
-  end
+  class SearchPathElement < Struct.new(:name, :type); end
 
-  # Get a list of objects per section
-  def sectionlist
-    sectionlist = []
-    self.each { |name, obj|
-      section = obj.section || "puppet"
-      sections[section] ||= []
-      sectionlist << section unless sectionlist.include?(section)
-      sections[section] << obj
-    }
-
-    return sectionlist, sections
+  # The order in which to search for values.
+  #
+  # @param environment [String,Symbol] symbolic reference to an environment name
+  # @param run_mode [Symbol] symbolic reference to a Puppet run mode
+  # @return [Array<SearchPathElement>]
+  # @api private
+  def searchpath(environment = nil, run_mode = preferred_run_mode)
+    searchpath = [
+      SearchPathElement.new(:memory, :values),
+      SearchPathElement.new(:cli, :values),
+    ]
+    searchpath << SearchPathElement.new(environment.intern, :environment) if environment
+    searchpath << SearchPathElement.new(run_mode, :section) if run_mode
+    searchpath << SearchPathElement.new(:main, :section)
+    searchpath << SearchPathElement.new(:application_defaults, :values)
+    searchpath << SearchPathElement.new(:overridden_defaults, :values)
   end
 
   def service_user_available?
@@ -823,20 +780,20 @@ class Puppet::Settings
     !@value_sets[:cli].lookup(param).nil?
   end
 
-  def set_value(param, value, type, options = {})
-    Puppet.deprecation_warning("Puppet.settings.set_value is deprecated. Use Puppet[]= instead.")
+  # Patches the value for a param in a section.
+  # This method is required to support the use case of unifying --dns-alt-names and
+  # --dns_alt_names in the certificate face. Ideally this should be cleaned up.
+  # See PUP-3684 for more information.
+  # For regular use of setting a value, the method `[]=` should be used.
+  # @api private
+  #
+  def patch_value(param, value, type)
     if @value_sets[type]
       @value_sets[type].set(param, value)
       unsafe_flush_cache
     end
   end
 
-  # Deprecated; use #define_settings instead
-  def setdefaults(section, defs)
-    Puppet.deprecation_warning("'setdefaults' is deprecated and will be removed; please call 'define_settings' instead")
-    define_settings(section, defs)
-  end
-
   # Define a group of settings.
   #
   # @param [Symbol] section a symbol to use for grouping multiple settings together into a conceptual unit.  This value
@@ -910,13 +867,13 @@ class Puppet::Settings
 
     catalog = Puppet::Resource::Catalog.new("Settings", Puppet::Node::Environment::NONE)
     @config.keys.find_all { |key| @config[key].is_a?(FileSetting) }.each do |key|
-      next if (key == :manifestdir && should_skip_manifestdir?())
       file = @config[key]
+      next if file.value.nil?
       next unless (sections.nil? or sections.include?(file.section))
       next unless resource = file.to_resource
       next if catalog.resource(resource.ref)
 
-      Puppet.debug("Using settings: adding file resource '#{key}': '#{resource.inspect}'")
+      Puppet.debug {"Using settings: adding file resource '#{key}': '#{resource.inspect}'"}
 
       catalog.add_resource(resource)
     end
@@ -927,13 +884,6 @@ class Puppet::Settings
     catalog
   end
 
-  def should_skip_manifestdir?()
-    setting = @config[:environmentpath]
-    !(setting.nil? || setting.value.nil? || setting.value.empty?)
-  end
-
-  private :should_skip_manifestdir?
-
   # Convert our list of config settings into a configuration file.
   def to_config
     str = %{The configuration file for #{Puppet.run_mode.name}.  Note that this file
@@ -1008,14 +958,6 @@ Generated on #{Time.now}.
     @config.has_key?(param)
   end
 
-  def uninterpolated_value(param, environment = nil)
-    Puppet.deprecation_warning("Puppet.settings.uninterpolated_value is deprecated. Use Puppet.settings.value instead")
-    param = param.to_sym
-    environment &&= environment.to_sym
-
-    values(environment, self.preferred_run_mode).lookup(param)
-  end
-
   # Retrieve an object that can be used for looking up values of configuration
   # settings.
   #
@@ -1071,8 +1013,8 @@ Generated on #{Time.now}.
   # 1. If there is an explicit configuration file, use that.  (--confdir or
   #    --config)
   # 2. If we're running as a root process, use the system puppet.conf
-  #    (usually /etc/puppet/puppet.conf)
-  # 3. Otherwise, use the user puppet.conf (usually ~/.puppet/puppet.conf)
+  #    (usually /etc/puppetlabs/puppet/puppet.conf)
+  # 3. Otherwise, use the user puppet.conf (usually ~/.puppetlabs/etc/puppet/puppet.conf)
   #
   # @api private
   # @todo this code duplicates {Puppet::Util::RunMode#which_dir} as described
@@ -1089,17 +1031,24 @@ Generated on #{Time.now}.
   # @param file [String] absolute path to the configuration file
   # @return [Puppet::Settings::ConfigFile::Conf]
   # @api private
-  def parse_file(file)
-    @config_file_parser.parse_file(file, read_file(file))
+  def parse_file(file, allowed_sections = [])
+    @config_file_parser.parse_file(file, read_file(file), allowed_sections)
   end
 
   private
 
   DEPRECATION_REFS = {
-    [:manifest, :modulepath, :config_version, :templatedir, :manifestdir] =>
-      "See http://links.puppetlabs.com/env-settings-deprecations"
+    # intentionally empty. This could be repopulated if we deprecate more settings
+    # and have reference links to associate with them
   }.freeze
 
+  def screen_non_puppet_conf_settings(puppet_conf)
+    puppet_conf.sections.values.each do |section|
+      forbidden = section.settings.select { |setting| Puppet::Settings::EnvironmentConf::ENVIRONMENT_CONF_ONLY_SETTINGS.include?(setting.name) }
+      raise(SettingsError, "Cannot set #{forbidden.map { |s| s.name }.join(", ")} settings in puppet.conf") if !forbidden.empty?
+    end
+  end
+
   # Record that we want to issue a deprecation warning later in the application
   # initialization cycle when we have settings bootstrapped to the point where
   # we can read the Puppet[:disable_warnings] setting.
@@ -1107,12 +1056,7 @@ Generated on #{Time.now}.
   # We are only recording warnings applicable to settings set in puppet.conf
   # itself.
   def record_deprecations_from_puppet_conf(puppet_conf)
-    conf_sections = puppet_conf.sections.inject([]) do |accum,entry|
-      accum << entry[1] if [:main, :master, :agent, :user].include?(entry[0])
-      accum
-    end
-
-    conf_sections.each do |section|
+    puppet_conf.sections.values.each do |section|
       section.settings.each do |conf_setting|
         if setting = self.setting(conf_setting.name)
           @deprecated_settings_that_have_been_configured << setting if setting.deprecated?
@@ -1142,17 +1086,6 @@ Generated on #{Time.now}.
     end
   end
 
-  def get_config_file_default(default)
-    obj = nil
-    unless obj = @config[default]
-      raise ArgumentError, "Unknown default #{default}"
-    end
-
-    raise ArgumentError, "Default #{default} is not a file" unless obj.is_a? FileSetting
-
-    obj
-  end
-
   def add_environment_resources(catalog, sections)
     path = self[:environmentpath]
     envdir = path.split(File::PATH_SEPARATOR).first if path
@@ -1191,28 +1124,18 @@ Generated on #{Time.now}.
 
   # Yield each search source in turn.
   def value_sets_for(environment, mode)
-    searchpath(environment).collect do |name|
-      case name
-      when :cli, :memory, :application_defaults, :overridden_defaults
-        @value_sets[name]
-      when :run_mode
-        if @configuration_file
-          section = @configuration_file.sections[mode]
-          if section
-            ValuesFromSection.new(mode, section)
-          end
+    searchpath(environment, mode).collect do |source|
+      case source.type
+      when :values
+        @value_sets[source.name]
+      when :section
+        if @configuration_file && section = @configuration_file.sections[source.name]
+          ValuesFromSection.new(source.name, section)
         end
+      when :environment
+        ValuesFromEnvironmentConf.new(source.name)
       else
-        values_from_section = nil
-        if @configuration_file
-          if section = @configuration_file.sections[name]
-            values_from_section = ValuesFromSection.new(name, section)
-          end
-        end
-        if values_from_section.nil? && global_defaults_initialized?
-          values_from_section = ValuesFromEnvironmentConf.new(name)
-        end
-        values_from_section
+        raise(Puppet::DevError, "Unknown searchpath case: #{source.type} for the #{source} settings path element.")
       end
     end.compact
   end
@@ -1280,8 +1203,8 @@ Generated on #{Time.now}.
     # @return [Object] The configuration setting value or nil if the setting is not known
     # @api public
     def lookup(name)
-      set = @value_sets.find do |set|
-        set.include?(name)
+      set = @value_sets.find do |value_set|
+        value_set.include?(name)
       end
       if set
         value = set.lookup(name)
@@ -1363,8 +1286,6 @@ Generated on #{Time.now}.
     end
 
     def ok_to_interpolate_environment(setting_name)
-      return true if Puppet.settings.value(:environmentpath, nil, true).empty?
-
       ENVIRONMENT_INTERPOLATION_ALLOWED.include?(setting_name.to_s)
     end
   end
@@ -1372,6 +1293,8 @@ Generated on #{Time.now}.
   class Values
     extend Forwardable
 
+    attr_reader :name
+
     def initialize(name, defaults)
       @name = name
       @values = {}
@@ -1395,9 +1318,15 @@ Generated on #{Time.now}.
 
       @values[name] = value
     end
+
+    def inspect
+      %Q{<#{self.class}:#{self.object_id} @name="#{@name}" @values="#{@values}">}
+    end
   end
 
   class ValuesFromSection
+    attr_reader :name
+
     def initialize(name, section)
       @name = name
       @section = section
@@ -1413,6 +1342,10 @@ Generated on #{Time.now}.
         setting.value
       end
     end
+
+    def inspect
+      %Q{<#{self.class}:#{self.object_id} @name="#{@name}" @section="#{@section}">}
+    end
   end
 
   # @api private
@@ -1421,6 +1354,10 @@ Generated on #{Time.now}.
       @environment_name = environment_name
     end
 
+    def name
+      @environment_name
+    end
+
     def include?(name)
       if Puppet::Settings::EnvironmentConf::VALID_SETTINGS.include?(name) && conf
         return true
@@ -1438,5 +1375,9 @@ Generated on #{Time.now}.
                   environments.get_conf(@environment_name)
                 end
     end
+
+    def inspect
+      %Q{<#{self.class}:#{self.object_id} @environment_name="#{@environment_name}" @conf="#{@conf}">}
+    end
   end
 end

data/lib/puppet/ssl/certificate.rb

@@ -32,13 +32,6 @@ DOC
     content.not_after
   end
 
-  def near_expiration?(interval = nil)
-    return false unless expiration
-    interval ||= Puppet[:certificate_expire_warning]
-    # Certificate expiration timestamps are always in UTC
-    expiration < Time.now.utc + interval
-  end
-
   # This name is what gets extracted from the subject before being passed
   # to the constructor, so it's not downcased
   def unmunged_name
@@ -60,6 +53,43 @@ DOC
         Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', ext.oid)
     end
 
-    custom_exts.map { |ext| {'oid' => ext.oid, 'value' => ext.value} }
+    custom_exts.map do |ext|
+      {'oid' => ext.oid, 'value' => get_ext_val(ext.oid)}
+    end
+  end
+
+  private
+
+
+  # Extract the extensions sequence from the wrapped certificate's raw ASN.1 form
+  def exts_seq
+    # See RFC-2459 section 4.1 (https://tools.ietf.org/html/rfc2459#section-4.1)
+    # to see where this is defined. Essentially this is saying "in the first
+    # sequence in the certificate, find the item that's tagged with 3. This
+    # is where the extensions are stored."
+    @extensions_tag ||= 3
+
+    @exts_seq ||= OpenSSL::ASN1.decode(content.to_der).value[0].find do |data|
+      (data.tag == @extensions_tag) && (data.tag_class == :CONTEXT_SPECIFIC)
+    end.value[0]
   end
+
+  # Get the DER parsed value of an X.509 extension by it's OID, or short name
+  # if one has been registered with OpenSSL.
+  def get_ext_val(oid)
+    ext_obj = exts_seq.value.find do |ext_seq|
+      ext_seq.value[0].value == oid
+    end
+
+    raw_val = ext_obj.value.last.value
+
+    begin
+      OpenSSL::ASN1.decode(raw_val).value
+    rescue OpenSSL::ASN1::ASN1Error
+      # This is required to maintain backward compatibility with the previous
+      # way trusted facts were signed. See PUP-3560
+      raw_val
+    end
+  end
+
 end

data/lib/puppet/ssl/certificate_authority/interface.rb

@@ -5,7 +5,7 @@ module Puppet
       # CA.  Its job is to provide a CLI-like interface to the CA class.
       class Interface
         INTERFACE_METHODS = [:destroy, :list, :revoke, :generate, :sign, :print, :verify, :fingerprint, :reinventory]
-
+        DESTRUCTIVE_METHODS = [:destroy, :revoke]
         SUBJECTLESS_METHODS = [:list, :reinventory]
 
         class InterfaceError < ArgumentError; end
@@ -18,6 +18,12 @@ module Puppet
             raise ArgumentError, "You must provide hosts or --all when using #{method}"
           end
 
+          destructive_subjects = [:signed, :all].include?(subjects)
+          if DESTRUCTIVE_METHODS.include?(method) && destructive_subjects
+            subject_text = (subjects == :all ? subjects : "all signed")
+            raise ArgumentError, "Refusing to #{method} #{subject_text} certs, provide an explicit list of certs to #{method}"
+          end
+
           # if the interface implements the method, use it instead of the ca's method
           if respond_to?(method)
             send(method, ca)

data/lib/puppet/ssl/certificate_factory.rb

@@ -6,12 +6,12 @@ require 'puppet/ssl'
 # @api private
 module Puppet::SSL::CertificateFactory
 
-  # Create, add extensions to, and sign a new X509 certificate.
+  # Create a new X509 certificate and add any needed extensions to the cert.
   #
   # @param cert_type [Symbol] The certificate type to create, which specifies
   #   what extensions are added to the certificate.
   #   One of (:ca, :terminalsubca, :server, :ocsp, :client)
-  # @param csr [OpenSSL::X509::Request] The signing request associated with
+  # @param csr [Puppet::SSL::CertificateRequest] The signing request associated with
   #   the certificate being created.
   # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
   #   if this is a self signed certificate, or the X509 certificate of the CA if
@@ -213,7 +213,7 @@ module Puppet::SSL::CertificateFactory
       # This is not an X509v3 extension which means that the extension
       # factory cannot generate it. We need to generate the extension
       # manually.
-      OpenSSL::X509::Extension.new(oid, val, crit)
+      OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(val).to_der, crit)
     end
   end
 end

data/lib/puppet/ssl/certificate_request.rb

@@ -107,6 +107,37 @@ DOC
     @content
   end
 
+  def ext_value_to_ruby_value(asn1_arr)
+    # A list of ASN1 types than can't be directly converted to a Ruby type
+    @non_convertable ||= [OpenSSL::ASN1::EndOfContent,
+                          OpenSSL::ASN1::BitString,
+                          OpenSSL::ASN1::Null,
+                          OpenSSL::ASN1::Enumerated,
+                          OpenSSL::ASN1::UTCTime,
+                          OpenSSL::ASN1::GeneralizedTime,
+                          OpenSSL::ASN1::Sequence,
+                          OpenSSL::ASN1::Set]
+
+    begin
+      # Attempt to decode the extension's DER data located in the original OctetString
+      asn1_val = OpenSSL::ASN1.decode(asn1_arr.last.value)
+    rescue OpenSSL::ASN1::ASN1Error
+      # This is to allow supporting the old-style of not DER encoding trusted facts
+      return asn1_arr.last.value
+    end
+
+    # If the extension value can not be directly converted to an atomic Ruby
+    # type, use the original ASN1 value. This is needed to work around a bug
+    # in Ruby's OpenSSL library which doesn't convert the value of unknown
+    # extension OIDs properly. See PUP-3560
+    if @non_convertable.include?(asn1_val.class) then
+      # Allows OpenSSL to take the ASN1 value and turn it into something Ruby understands
+      OpenSSL::X509::Extension.new(asn1_arr.first.value, asn1_val.to_der).value
+    else
+      asn1_val.value
+    end
+  end
+
   # Return the set of extensions requested on this CSR, in a form designed to
   # be useful to Ruby: an array of hashes.  Which, not coincidentally, you can pass
   # successfully to the OpenSSL constructor later, if you want.
@@ -128,7 +159,8 @@ DOC
     index = -1
     extensions.map do |ext_values|
       index += 1
-      context = "#{attribute.oid} extension index #{index}"
+
+      value = ext_value_to_ruby_value(ext_values)
 
       # OK, turn that into an extension, to unpack the content.  Lovely that
       # we have to swap the order of arguments to the underlying method, or
@@ -137,13 +169,9 @@ DOC
       # fixed component in the sequence.
       case ext_values.length
       when 2
-        ev = OpenSSL::X509::Extension.new(ext_values[0].value, ext_values[1].value)
-        { "oid" => ev.oid, "value" => ev.value }
-
+        {"oid" => ext_values[0].value, "value" => value}
       when 3
-        ev = OpenSSL::X509::Extension.new(ext_values[0].value, ext_values[2].value, ext_values[1].value)
-        { "oid" => ev.oid, "value" => ev.value, "critical" => ev.critical? }
-
+        {"oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value}
       else
         raise Puppet::Error, "In #{attribute.oid}, expected extension record #{index} to have two or three items, but found #{ext_values.length}"
       end
@@ -227,7 +255,7 @@ DOC
             raise Puppet::Error, "Cannot specify CSR extension request #{oid}: conflicts with internally used extension request"
           end
 
-          ext = OpenSSL::X509::Extension.new(oid, value.to_s, false)
+          ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
           extensions << ext
         rescue OpenSSL::X509::ExtensionError => e
           raise Puppet::Error, "Cannot create CSR with extension request #{oid}: #{e.message}", e.backtrace

data/lib/puppet/ssl/configuration.rb

@@ -4,23 +4,17 @@ module Puppet
 module SSL
   # Puppet::SSL::Configuration is intended to separate out the following concerns:
   # * CA certificates that authenticate peers (ca_auth_file)
-  # * CA certificates that build trust but do not authenticate (ca_chain_file)
   # * Who clients trust as distinct from who servers trust.  We should not
   #   assume one single self signed CA cert for everyone.
 class Configuration
   def initialize(localcacert, options={})
-    if (options[:ca_chain_file] and not options[:ca_auth_file])
-      raise ArgumentError, "The CA auth chain is required if the chain file is provided"
-    end
     @localcacert = localcacert
-    @ca_chain_file = options[:ca_chain_file]
     @ca_auth_file = options[:ca_auth_file]
   end
 
-  # The ca_chain_file method is intended to return the PEM bundle of CA certs
-  # establishing trust but not used for peer authentication.
+  # @deprecated Use {#ca_auth_file} instead.
   def ca_chain_file
-    @ca_chain_file || ca_auth_file
+    ca_auth_file
   end
 
   # The ca_auth_file method is intended to return the PEM bundle of CA certs