puppet 4.0.0 → 5.0.0

data/lib/puppet/indirector/file_bucket_file/file.rb

@@ -1,15 +1,23 @@
 require 'puppet/indirector/code'
 require 'puppet/file_bucket/file'
 require 'puppet/util/checksums'
+require 'puppet/util/diff'
 require 'fileutils'
 
 module Puppet::FileBucketFile
   class File < Puppet::Indirector::Code
     include Puppet::Util::Checksums
+    include Puppet::Util::Diff
 
     desc "Store files in a directory set based on their checksums."
 
     def find(request)
+      request.options[:bucket_path] ||= Puppet[:bucketdir]
+      # If filebucket mode is 'list'
+      if request.options[:list_all]
+        return nil unless ::File.exists?(request.options[:bucket_path])
+        return list(request)
+      end
       checksum, files_original_path = request_to_checksum_and_path(request)
       contents_file = path_for(request.options[:bucket_path], checksum, 'contents')
       paths_file = path_for(request.options[:bucket_path], checksum, 'paths')
@@ -17,10 +25,11 @@ module Puppet::FileBucketFile
       if Puppet::FileSystem.exist?(contents_file) && matches(paths_file, files_original_path)
         if request.options[:diff_with]
           other_contents_file = path_for(request.options[:bucket_path], request.options[:diff_with], 'contents')
-          raise "could not find diff_with #{request.options[:diff_with]}" unless Puppet::FileSystem.exist?(other_contents_file)
-          return `diff #{Puppet::FileSystem.path_string(contents_file).inspect} #{Puppet::FileSystem.path_string(other_contents_file).inspect}`
+          raise _("could not find diff_with %{diff}") % { diff: request.options[:diff_with] } unless Puppet::FileSystem.exist?(other_contents_file)
+          raise _("Unable to diff on this platform") unless Puppet[:diff] != ""
+          return diff(Puppet::FileSystem.path_string(contents_file), Puppet::FileSystem.path_string(other_contents_file))
         else
-          Puppet.info "FileBucket read #{checksum}"
+          Puppet.info _("FileBucket read %{checksum}") % { checksum: checksum }
           model.new(Puppet::FileSystem.binread(contents_file))
         end
       else
@@ -28,6 +37,55 @@ module Puppet::FileBucketFile
       end
     end
 
+    def list(request)
+      if request.remote?
+        raise Puppet::Error, _("Listing remote file buckets is not allowed")
+      end
+
+      fromdate = request.options[:fromdate] || "0:0:0 1-1-1970"
+      todate = request.options[:todate] || Time.now.strftime("%F %T")
+      begin
+        to = Time.parse(todate)
+      rescue ArgumentError
+        raise Puppet::Error, _("Error while parsing 'todate'")
+      end
+      begin
+        from = Time.parse(fromdate)
+      rescue ArgumentError
+        raise Puppet::Error, _("Error while parsing 'fromdate'")
+      end
+      # Setting hash's default value to [], needed by the following loop
+      bucket = Hash.new {[]}
+      msg = ""
+      # Get all files with mtime between 'from' and 'to'
+      Pathname.new(request.options[:bucket_path]).find { |item|
+        if item.file? and item.basename.to_s == "paths"
+          filenames = item.read.strip.split("\n")
+          filestat = Time.parse(item.stat.mtime.to_s)
+          if from <= filestat and filestat <= to
+            filenames.each do |filename|
+              bucket[filename] += [[ item.stat.mtime , item.parent.basename ]]
+            end
+          end
+        end
+      }
+      # Sort the results
+      bucket.each { |filename, contents|
+        contents.sort_by! do |item|
+          # NOTE: Ruby 2.4 may reshuffle item order even if the keys in sequence are sorted already
+          item[0]
+        end
+      }
+      # Build the output message. Sorted by names then by dates
+      bucket.sort.each { |filename,contents|
+        contents.each { |mtime, chksum|
+          date = mtime.strftime("%F %T")
+          msg += "#{chksum} #{date} #{filename}\n"
+        }
+      }
+      return model.new(msg)
+    end
+
     def head(request)
       checksum, files_original_path = request_to_checksum_and_path(request)
       contents_file = path_for(request.options[:bucket_path], checksum, 'contents')
@@ -58,7 +116,11 @@ module Puppet::FileBucketFile
     # @param files_original_path [String]
     #
     def matches(paths_file, files_original_path)
-      Puppet::FileSystem.open(paths_file, 0640, 'a+') do |f|
+      # Puppet will have already written the paths_file in the systems encoding
+      # given its possible that request.options[:bucket_path] or Puppet[:bucketdir]
+      # contained characters in an encoding that are not represented the
+      # same way when the bytes are decoded as UTF-8, continue using system encoding
+      Puppet::FileSystem.open(paths_file, 0640, 'a+:external') do |f|
         path_match(f, files_original_path)
       end
     end
@@ -72,26 +134,51 @@ module Puppet::FileBucketFile
       return false
     end
 
-    # @param contents_file [Object] Opaque file path
-    # @param paths_file [Object] Opaque file path
-    #
+    # @param bucket_file [Puppet::FileBucket::File] IO object representing
+    #   content to back up
+    # @param files_original_path [String] Path to original source file on disk
+    # @param contents_file [Pathname] Opaque file path to intended backup
+    #   location
+    # @param paths_file [Pathname] Opaque file path to file containing source
+    #   file paths on disk
+    # @return [void]
+    # @raise [Puppet::FileBucket::BucketError] on possible sum collision between
+    #   existing and new backup
+    # @api private
     def save_to_disk(bucket_file, files_original_path, contents_file, paths_file)
       Puppet::Util.withumask(0007) do
         unless Puppet::FileSystem.dir_exist?(paths_file)
           Puppet::FileSystem.dir_mkpath(paths_file)
         end
 
-        Puppet::FileSystem.exclusive_open(paths_file, 0640, 'a+') do |f|
+        # Puppet will have already written the paths_file in the systems encoding
+        # given its possible that request.options[:bucket_path] or Puppet[:bucketdir]
+        # contained characters in an encoding that are not represented the
+        # same way when the bytes are decoded as UTF-8, continue using system encoding
+        Puppet::FileSystem.exclusive_open(paths_file, 0640, 'a+:external') do |f|
           if Puppet::FileSystem.exist?(contents_file)
-            verify_identical_file!(contents_file, bucket_file)
-            Puppet::FileSystem.touch(contents_file)
-          else
-            Puppet::FileSystem.open(contents_file, 0440, 'wb') do |of|
-              # PUP-1044 writes all of the contents
-              bucket_file.stream() do |src|
-                FileUtils.copy_stream(src, of)
-              end
+            if verify_identical_file(contents_file, bucket_file)
+              Puppet.info "FileBucket got a duplicate file #{bucket_file.checksum}"
+              Puppet::FileSystem.touch(contents_file)
+            elsif contents_file_matches_checksum?(contents_file, bucket_file.checksum_data, bucket_file.checksum_type)
+              # If the contents or sizes don't match, but the checksum does,
+              # then we've found a conflict (potential hash collision).
+              # Unlikely, but quite bad. Don't remove the file in case it's
+              # needed, but ask the user to validate.
+              # Note: Don't print the full path to the bucket file in the
+              # exception to avoid disclosing file system layout on server.
+              Puppet.err(_("Unable to verify existing FileBucket backup at '%{path}'.") % { path: contents_file.to_path })
+              raise Puppet::FileBucket::BucketError, _("Existing backup and new file have different content but same checksum, %{value}. Verify existing backup and remove if incorrect.") %
+                { value: bucket_file.checksum }
+            else
+              # PUP-1334 If the contents_file exists but does not match its
+              # checksum, our backup has been corrupted. Warn about overwriting
+              # it, and proceed with new backup.
+              Puppet.warning(_("Existing backup does not match its expected sum, %{sum}. Overwriting corrupted backup.") % { sum: bucket_file.checksum })
+              copy_bucket_file_to_contents_file(contents_file, bucket_file)
             end
+          else
+            copy_bucket_file_to_contents_file(contents_file, bucket_file)
           end
 
           unless path_match(f, files_original_path)
@@ -107,9 +194,9 @@ module Puppet::FileBucketFile
       if path == '' # Treat "md5/<checksum>/" like "md5/<checksum>"
         path = nil
       end
-      raise ArgumentError, "Unsupported checksum type #{checksum_type.inspect}" if checksum_type != Puppet[:digest_algorithm]
+      raise ArgumentError, _("Unsupported checksum type %{checksum_type}") % { checksum_type: checksum_type.inspect } if checksum_type != Puppet[:digest_algorithm]
       expected = method(checksum_type + "_hex_length").call
-      raise "Invalid checksum #{checksum.inspect}" if checksum !~ /^[0-9a-f]{#{expected}}$/
+      raise _("Invalid checksum %{checksum}") % { checksum: checksum.inspect } if checksum !~ /^[0-9a-f]{#{expected}}$/
       [checksum, path]
     end
 
@@ -124,19 +211,45 @@ module Puppet::FileBucketFile
       Puppet::FileSystem.pathname(subfile ? ::File.join(basedir, subfile) : basedir)
     end
 
-    # @param contents_file [Object] Opaque file path
-    # @param bucket_file [IO]
-    def verify_identical_file!(contents_file, bucket_file)
-      if bucket_file.size == Puppet::FileSystem.size(contents_file)
-        if bucket_file.stream() {|s| Puppet::FileSystem.compare_stream(contents_file, s) }
-          Puppet.info "FileBucket got a duplicate file #{bucket_file.checksum}"
-          return
+    # @param contents_file [Pathname] Opaque file path to intended backup
+    #   location
+    # @param bucket_file [Puppet::FileBucket::File] IO object representing
+    #   content to back up
+    # @return [Boolean] whether the data in contents_file is of the same size
+    #   and content as that in the bucket_file
+    # @api private
+    def verify_identical_file(contents_file, bucket_file)
+      (bucket_file.size == Puppet::FileSystem.size(contents_file)) &&
+        (bucket_file.stream() {|s| Puppet::FileSystem.compare_stream(contents_file, s) })
+    end
+
+    # @param contents_file [Pathname] Opaque file path to intended backup
+    #   location
+    # @param expected_checksum_data [String] expected value of checksum of type
+    #   checksum_type
+    # @param checksum_type [String] type of check sum of checksum_data, ie "md5"
+    # @return [Boolean] whether the checksum of the contents_file matches the
+    #   supplied checksum
+    # @api private
+    def contents_file_matches_checksum?(contents_file, expected_checksum_data, checksum_type)
+      contents_file_checksum_data = Puppet::Util::Checksums.method(:"#{checksum_type}_file").call(contents_file.to_path)
+      contents_file_checksum_data == expected_checksum_data
+    end
+
+    # @param contents_file [Pathname] Opaque file path to intended backup
+    #   location
+    # @param bucket_file [Puppet::FileBucket::File] IO object representing
+    #   content to back up
+    # @return [void]
+    # @api private
+    def copy_bucket_file_to_contents_file(contents_file, bucket_file)
+      Puppet::FileSystem.open(contents_file, 0440, 'wb') do |of|
+        # PUP-1044 writes all of the contents
+        bucket_file.stream() do |src|
+          FileUtils.copy_stream(src, of)
         end
       end
-
-      # If the contents or sizes don't match, then we've found a conflict.
-      # Unlikely, but quite bad.
-      raise Puppet::FileBucket::BucketError, "Got passed new contents for sum #{bucket_file.checksum}"
     end
+
   end
 end

data/lib/puppet/indirector/file_content/http.rb

@@ -0,0 +1,15 @@
+require 'puppet/file_serving/metadata'
+require 'puppet/indirector/generic_http'
+
+class Puppet::Indirector::FileContent::Http < Puppet::Indirector::GenericHttp
+  desc "Retrieve file contents from a remote HTTP server."
+
+  include Puppet::FileServing::TerminusHelper
+
+  @http_method = :get
+
+  def find(request)
+    response = super
+    model.from_binary(response.body)
+  end
+end

data/lib/puppet/indirector/file_metadata/http.rb

@@ -0,0 +1,27 @@
+require 'puppet/file_serving/http_metadata'
+require 'puppet/indirector/generic_http'
+require 'puppet/indirector/file_metadata'
+require 'net/http'
+
+class Puppet::Indirector::FileMetadata::Http < Puppet::Indirector::GenericHttp
+  desc "Retrieve file metadata from a remote HTTP server."
+
+  include Puppet::FileServing::TerminusHelper
+
+  @http_method = :head
+
+  def find(request)
+    head = super
+
+    if head.is_a?(Net::HTTPSuccess)
+      metadata = Puppet::FileServing::HttpMetadata.new(head)
+      metadata.checksum_type = request.options[:checksum_type] if request.options[:checksum_type]
+      metadata.collect
+      metadata
+    end
+  end
+
+  def search(request)
+    raise Puppet::Error, _("cannot lookup multiple files")
+  end
+end

data/lib/puppet/indirector/file_server.rb

@@ -15,7 +15,15 @@ class Puppet::Indirector::FileServer < Puppet::Indirector::Terminus
 
     # If we're not serving this mount, then access is denied.
     return false unless mount
-    mount.allowed?(request.node, request.ip)
+
+    # If there are no auth directives or there is an 'allow *' directive, then
+    # access is allowed.
+    if mount.empty? || mount.globalallow?
+      return true
+    end
+
+    Puppet.err _("Denying %{method} request for %{desc} on fileserver mount '%{mount_name}'. Use of auth directives for 'fileserver.conf' mount points is no longer supported. Remove these directives and use the 'auth.conf' file instead for access control.") % { method: request.method, desc: request.description, mount_name: mount.name }
+    return false
   end
 
   # Find our key using the fileserver.
@@ -36,7 +44,7 @@ class Puppet::Indirector::FileServer < Puppet::Indirector::Terminus
     mount, relative_path = configuration.split_path(request)
 
     unless mount and paths = mount.search(relative_path, request)
-      Puppet.info "Could not find filesystem info for file '#{request.key}' in environment #{request.environment}"
+      Puppet.info _("Could not find filesystem info for file '%{request}' in environment %{env}") % { request: request.key, env: request.environment }
       return nil
     end
     path2instances(request, *paths)

data/lib/puppet/indirector/generic_http.rb

@@ -0,0 +1,16 @@
+require 'puppet/file_serving/terminus_helper'
+require 'puppet/util/http_proxy'
+
+class Puppet::Indirector::GenericHttp < Puppet::Indirector::Terminus
+  desc "Retrieve data from a remote HTTP server."
+
+  class <<self
+    attr_accessor :http_method
+  end
+
+  def find(request)
+    uri = URI(request.uri)
+    method = self.class.http_method
+    Puppet::Util::HttpProxy.request_with_redirects(uri,method)
+  end
+end

data/lib/puppet/indirector/hiera.rb

@@ -4,7 +4,8 @@ require 'hiera/scope'
 class Puppet::Indirector::Hiera < Puppet::Indirector::Terminus
   def initialize(*args)
     if ! Puppet.features.hiera?
-      raise "Hiera terminus not supported without hiera library"
+      #TRANSLATORS "Hiera" is the name of a code library and should not be translated
+      raise _("Hiera terminus not supported without hiera library")
     end
     super
   end
@@ -18,11 +19,14 @@ class Puppet::Indirector::Hiera < Puppet::Indirector::Terminus
   def find(request)
     not_found = Object.new
     options = request.options
+    Puppet.debug { "Performing a hiera indirector lookup of #{request.key} with options #{options.inspect}" }
     value = hiera.lookup(request.key, not_found, Hiera::Scope.new(options[:variables]), nil, convert_merge(options[:merge]))
     throw :no_such_key if value.equal?(not_found)
     value
   rescue *DataBindingExceptions => detail
-    raise Puppet::DataBinding::LookupError.new(detail.message, detail)
+    error = Puppet::DataBinding::LookupError.new("DataBinding 'hiera': #{detail.message}")
+    error.set_backtrace(detail.backtrace)
+    raise error
   end
 
   private
@@ -34,8 +38,11 @@ class Puppet::Indirector::Hiera < Puppet::Indirector::Terminus
   def convert_merge(merge)
     case merge
     when nil
+    when 'first'
       # Nil is OK. Defaults to Hiera :priority
       nil
+    when Puppet::Pops::MergeStrategy
+      convert_merge(merge.configuration)
     when 'unique'
       # Equivalent to Hiera :array
       :array
@@ -57,7 +64,8 @@ class Puppet::Indirector::Hiera < Puppet::Indirector::Terminus
         convert_merge(strategy)
       end
     else
-      raise Puppet::DataBinding::LookupError, "Unrecognized value for request 'merge' parameter: '#{merge}'"
+      #TRANSLATORS "merge" is a parameter name and should not be translated
+      raise Puppet::DataBinding::LookupError, _("Unrecognized value for request 'merge' parameter: '%{merge}'") % { merge: merge }
     end
   end
 
@@ -68,7 +76,7 @@ class Puppet::Indirector::Hiera < Puppet::Indirector::Terminus
     if Puppet::FileSystem.exist?(hiera_config)
       config = Hiera::Config.load(hiera_config)
     else
-      Puppet.warning "Config file #{hiera_config} not found, using Hiera defaults"
+      Puppet.warning _("Config file %{hiera_config} not found, using Hiera defaults") % { hiera_config: hiera_config }
     end
 
     config[:logger] = 'puppet'

data/lib/puppet/indirector/indirection.rb

@@ -60,7 +60,8 @@ class Puppet::Indirector::Indirection
 
   # Set the time-to-live for instances created through this indirection.
   def ttl=(value)
-    raise ArgumentError, "Indirection TTL must be an integer" unless value.is_a?(Fixnum)
+    #TRANSLATORS "TTL" stands for "time to live" and refers to a duration of time
+    raise ArgumentError, _("Indirection TTL must be an integer") unless value.is_a?(Integer)
     @ttl = value
   end
 
@@ -165,7 +166,7 @@ class Puppet::Indirector::Indirection
 
     return nil unless instance = cache.find(request(:find, key, nil, options))
 
-    Puppet.info "Expiring the #{self.name} cache of #{instance.name}"
+    Puppet.info _("Expiring the %{cache} cache of %{instance}") % { cache: self.name, instance: instance.name }
 
     # Set an expiration date in the past
     instance.expiration = Time.now - 60
@@ -195,17 +196,26 @@ class Puppet::Indirector::Indirection
       if not result.nil?
         result.expiration ||= self.expiration if result.respond_to?(:expiration)
         if cache?
-          Puppet.info "Caching #{self.name} for #{request.key}"
-          cache.save request(:save, key, result, options)
+          Puppet.info _("Caching %{indirection} for %{request}") % { indirection: self.name, request: request.key }
+          begin
+            cache.save request(:save, key, result, options)
+          rescue => detail
+            Puppet.log_exception(detail)
+            raise detail
+          end
         end
 
         filtered = result
         if terminus.respond_to?(:filter)
-          Puppet::Util::Profiler.profile("Filtered result for #{self.name} #{request.key}", [:indirector, :filter, self.name, request.key]) do
-            filtered = terminus.filter(result)
+          Puppet::Util::Profiler.profile(_("Filtered result for %{indirection} %{request}") % { indirection: self.name, request: request.key }, [:indirector, :filter, self.name, request.key]) do
+            begin
+              filtered = terminus.filter(result)
+            rescue Puppet::Error => detail
+              Puppet.log_exception(detail)
+              raise detail
+            end
           end
         end
-
         filtered
       end
     end
@@ -226,14 +236,14 @@ class Puppet::Indirector::Indirection
     # See if our instance is in the cache and up to date.
     return nil unless cache? and ! request.ignore_cache? and cached = cache.find(request)
     if cached.expired?
-      Puppet.info "Not using expired #{self.name} for #{request.key} from cache; expired at #{cached.expiration}"
+      Puppet.info _("Not using expired %{indirection} for %{request} from cache; expired at %{expiration}") % { indirection: self.name, request: request.key, expiration: cached.expiration }
       return nil
     end
 
     Puppet.debug "Using cached #{self.name} for #{request.key}"
     cached
   rescue => detail
-    Puppet.log_exception(detail, "Cached #{self.name} for #{request.key} failed: #{detail}")
+    Puppet.log_exception(detail, _("Cached %{indirection} for %{request} failed: %{detail}") % { indirection: self.name, request: request.key, detail: detail })
     nil
   end
 
@@ -300,16 +310,13 @@ class Puppet::Indirector::Indirection
     end
   end
 
-  # Setup a request, pick the appropriate terminus, check the request's authorization, and return it.
+  # Pick the appropriate terminus, check the request's authorization, and return it.
+  # @param [Puppet::Indirector::Request] request instance
+  # @return [Puppet::Indirector::Terminus] terminus instance (usually a subclass
+  #   of Puppet::Indirector::Terminus) for this request
   def prepare(request)
     # Pick our terminus.
-    if respond_to?(:select_terminus)
-      unless terminus_name = select_terminus(request)
-        raise ArgumentError, "Could not determine appropriate terminus for #{request.description}"
-      end
-    else
-      terminus_name = terminus_class
-    end
+    terminus_name = terminus_class
 
     dest_terminus = terminus(terminus_name)
     check_authorization(request, dest_terminus)
@@ -322,7 +329,7 @@ class Puppet::Indirector::Indirection
   def make_terminus(terminus_class)
     # Load our terminus class.
     unless klass = Puppet::Indirector::Terminus.terminus_class(self.name, terminus_class)
-      raise ArgumentError, "Could not find terminus #{terminus_class} for indirection #{self.name}"
+      raise ArgumentError, _("Could not find terminus %{terminus_class} for indirection %{indirection}") % { terminus_class: terminus_class, indirection: self.name }
     end
     klass.new
   end

data/lib/puppet/indirector/json.rb

@@ -4,8 +4,7 @@ require 'puppet/util'
 # The base class for JSON indirection terminus implementations.
 #
 # This should generally be preferred to the YAML base for any future
-# implementations, since it is ~ three times faster despite being pure Ruby
-# rather than a C implementation.
+# implementations, since it is faster and can load untrusted data safely.
 class Puppet::Indirector::JSON < Puppet::Indirector::Terminus
   def find(request)
     load_json_from_file(path(request.key), request.key)
@@ -15,16 +14,16 @@ class Puppet::Indirector::JSON < Puppet::Indirector::Terminus
     filename = path(request.key)
     FileUtils.mkdir_p(File.dirname(filename))
 
-    Puppet::Util.replace_file(filename, 0660) {|f| f.print to_json(request.instance) }
+    Puppet::Util.replace_file(filename, 0660) {|f| f.print to_json(request.instance).force_encoding(Encoding::BINARY) }
   rescue TypeError => detail
-    Puppet.log_exception "Could not save #{self.name} #{request.key}: #{detail}"
+    Puppet.log_exception(detail, _("Could not save %{json} %{request}: %{detail}") % { json: self.name, request: request.key, detail: detail })
   end
 
   def destroy(request)
     Puppet::FileSystem.unlink(path(request.key))
   rescue => detail
     unless detail.is_a? Errno::ENOENT
-      raise Puppet::Error, "Could not destroy #{self.name} #{request.key}: #{detail}", detail.backtrace
+      raise Puppet::Error, _("Could not destroy %{json} %{request}: %{detail}") % { json: self.name, request: request.key, detail: detail }, detail.backtrace
     end
     1                           # emulate success...
   end
@@ -38,8 +37,8 @@ class Puppet::Indirector::JSON < Puppet::Indirector::Terminus
   # Return the path to a given node's file.
   def path(name, ext = '.json')
     if name =~ Puppet::Indirector::BadNameRegexp then
-      Puppet.crit("directory traversal detected in #{self.class}: #{name.inspect}")
-      raise ArgumentError, "invalid key"
+      Puppet.crit(_("directory traversal detected in %{json}: %{name}") % { json: self.class, name: name.inspect })
+      raise ArgumentError, _("invalid key")
     end
 
     base = Puppet.run_mode.master? ? Puppet[:server_datadir] : Puppet[:client_datadir]
@@ -52,25 +51,25 @@ class Puppet::Indirector::JSON < Puppet::Indirector::Terminus
     json = nil
 
     begin
-      json = File.read(file)
+      json = Puppet::FileSystem.read(file, :encoding => Encoding::BINARY)
     rescue Errno::ENOENT
       return nil
     rescue => detail
-      raise Puppet::Error, "Could not read JSON data for #{indirection.name} #{key}: #{detail}", detail.backtrace
+      raise Puppet::Error, _("Could not read JSON data for %{name} %{key}: %{detail}") % { name: indirection.name, key: key, detail: detail }, detail.backtrace
     end
 
     begin
       return from_json(json)
     rescue => detail
-      raise Puppet::Error, "Could not parse JSON data for #{indirection.name} #{key}: #{detail}", detail.backtrace
+      raise Puppet::Error, _("Could not parse JSON data for %{name} %{key}: %{detail}") % { name: indirection.name, key: key, detail: detail }, detail.backtrace
     end
   end
 
   def from_json(text)
-    model.convert_from('pson', text)
+    model.convert_from('json', text.force_encoding(Encoding::UTF_8))
   end
 
   def to_json(object)
-    object.render('pson')
+    object.render('json')
   end
 end

data/lib/puppet/indirector/key/ca.rb

@@ -2,8 +2,8 @@ require 'puppet/indirector/ssl_file'
 require 'puppet/ssl/key'
 
 class Puppet::SSL::Key::Ca < Puppet::Indirector::SslFile
-  desc "Manage the CA's private on disk.  This terminus *only* works
-    with the CA key, because that's the only key that the CA ever interacts
+  desc "Manage the CA's private key on disk. This terminus works with the
+    CA key *only*, because that's the only key that the CA ever interacts
     with."
 
   store_in :privatekeydir

data/lib/puppet/indirector/key/disabled_ca.rb

@@ -13,7 +13,7 @@ prevent clients getting confusing 'success' behaviour."
   [:find, :head, :search, :save, :destroy].each do |name|
     define_method(name) do |request|
       if request.remote?
-        raise Puppet::Error, "this master is not a CA"
+        raise Puppet::Error, _("this master is not a CA")
       else
         @file.send(name, request)
       end

data/lib/puppet/indirector/key/file.rb

@@ -30,7 +30,7 @@ class Puppet::SSL::Key::File < Puppet::Indirector::SslFile
     begin
       Puppet::FileSystem.unlink(key_path)
     rescue => detail
-      raise Puppet::Error, "Could not remove #{request.key} public key: #{detail}", detail.backtrace
+      raise Puppet::Error, _("Could not remove %{request} public key: %{detail}") % { request: request.key, detail: detail }, detail.backtrace
     end
   end
 
@@ -39,11 +39,12 @@ class Puppet::SSL::Key::File < Puppet::Indirector::SslFile
     super
 
     begin
-      Puppet.settings.setting(:publickeydir).open_file(public_key_path(request.key), 'w') do |f|
+      # RFC 1421 states PEM is 7-bit ASCII https://tools.ietf.org/html/rfc1421
+      Puppet.settings.setting(:publickeydir).open_file(public_key_path(request.key), 'w:ASCII') do |f|
         f.print request.instance.content.public_key.to_pem
       end
     rescue => detail
-      raise Puppet::Error, "Could not write #{request.key}: #{detail}", detail.backtrace
+      raise Puppet::Error, _("Could not write %{request}: %{detail}") % { request: request.key, detail: detail }, detail.backtrace
     end
   end
 end

data/lib/puppet/indirector/ldap.rb

@@ -30,7 +30,7 @@ class Puppet::Indirector::Ldap < Puppet::Indirector::Terminus
   # Find the ldap node, return the class list and parent node specially,
   # and everything else in a parameter hash.
   def ldapsearch(filter)
-    raise ArgumentError.new("You must pass a block to ldapsearch") unless block_given?
+    raise ArgumentError.new(_("You must pass a block to ldapsearch")) unless block_given?
 
     found = false
     count = 0
@@ -47,10 +47,10 @@ class Puppet::Indirector::Ldap < Puppet::Indirector::Terminus
         # Try reconnecting to ldap if we get an exception and we haven't yet retried.
         count += 1
         @connection = nil
-        Puppet.warning "Retrying LDAP connection"
+        Puppet.warning _("Retrying LDAP connection")
         retry
       else
-        error = Puppet::Error.new("LDAP Search failed")
+        error = Puppet::Error.new(_("LDAP Search failed"))
         error.set_backtrace(detail.backtrace)
         raise error
       end
@@ -62,13 +62,14 @@ class Puppet::Indirector::Ldap < Puppet::Indirector::Terminus
   # Create an ldap connection.
   def connection
     unless @connection
-      raise Puppet::Error, "Could not set up LDAP Connection: Missing ruby/ldap libraries" unless Puppet.features.ldap?
+      #TRANSLATORS "ruby/ldap libraries" are code dependencies
+      raise Puppet::Error, _("Could not set up LDAP Connection: Missing ruby/ldap libraries") unless Puppet.features.ldap?
       begin
         conn = Puppet::Util::Ldap::Connection.instance
         conn.start
         @connection = conn.connection
       rescue => detail
-        message = "Could not connect to LDAP: #{detail}"
+        message = _("Could not connect to LDAP: %{detail}") % { detail: detail }
         Puppet.log_exception(detail, message)
         raise Puppet::Error, message, detail.backtrace
       end

data/lib/puppet/indirector/memory.rb

@@ -11,7 +11,7 @@ class Puppet::Indirector::Memory < Puppet::Indirector::Terminus
   end
 
   def destroy(request)
-    raise ArgumentError.new("Could not find #{request.key} to destroy") unless @instances.include?(request.key)
+    raise ArgumentError.new(_("Could not find %{request} to destroy") % { request: request.key }) unless @instances.include?(request.key)
     @instances.delete(request.key)
   end