puppet 4.0.0 → 5.0.0

data/lib/puppet/application/apply.rb

@@ -3,6 +3,8 @@ require 'puppet/configurer'
 require 'puppet/util/profiler/aggregate'
 
 class Puppet::Application::Apply < Puppet::Application
+  require 'puppet/util/splayer'
+  include Puppet::Util::Splayer
 
   option("--debug","-d")
   option("--execute EXECUTE","-e") do |arg|
@@ -72,7 +74,7 @@ valid setting, so you can specify '--tags <class>,<tag>'
 as an argument.
 
 See the configuration file documentation at
-http://docs.puppetlabs.com/references/stable/configuration.html for the
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet with
 '--genconfig'.
@@ -81,10 +83,19 @@ configuration options can also be generated by running puppet with
   Enable full debugging.
 
 * --detailed-exitcodes:
-  Provide transaction information via exit codes. If this is enabled, an exit
-  code of '2' means there were changes, an exit code of '4' means there were
-  failures during the transaction, and an exit code of '6' means there were both
-  changes and failures.
+  Provide extra information about the run via exit codes. If enabled, 'puppet
+  apply' will use the following exit codes:
+
+  0: The run succeeded with no changes or failures; the system was already in
+  the desired state.
+
+  1: The run failed.
+
+  2: The run succeeded, and some resources were changed.
+
+  4: The run succeeded, and some resources failed.
+
+  6: The run succeeded, and included both changes and failures.
 
 * --help:
   Print this help message
@@ -99,6 +110,11 @@ configuration options can also be generated by running puppet with
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. Defaults to 'console'.
 
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
+
 * --noop:
   Use 'noop' mode where Puppet runs in a no-op or dry-run mode. This
   is useful for seeing what changes Puppet will make without actually
@@ -136,7 +152,7 @@ Luke Kanies
 
 COPYRIGHT
 ---------
-Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
+Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
     HELP
   end
@@ -159,10 +175,13 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     if options[:catalog] == "-"
       text = $stdin.read
     else
-      text = ::File.read(options[:catalog])
+      text = Puppet::FileSystem.read(options[:catalog], :encoding => 'utf-8')
+    end
+    env = Puppet.lookup(:environments).get(Puppet[:environment])
+    Puppet.override(:current_environment => env, :loaders => Puppet::Pops::Loaders.new(env)) do
+      catalog = read_catalog(text)
+      apply_catalog(catalog)
     end
-    catalog = read_catalog(text)
-    apply_catalog(catalog)
   end
 
   def main
@@ -171,50 +190,76 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
       Puppet[:code] = options[:code] || STDIN.read
     else
       manifest = command_line.args.shift
-      raise "Could not find file #{manifest}" unless Puppet::FileSystem.exist?(manifest)
-      Puppet.warning("Only one file can be applied per run.  Skipping #{command_line.args.join(', ')}") if command_line.args.size > 0
+      raise _("Could not find file %{manifest}") % { manifest: manifest } unless Puppet::FileSystem.exist?(manifest)
+      Puppet.warning(_("Only one file can be applied per run.  Skipping %{files}") % { files: command_line.args.join(', ') }) if command_line.args.size > 0
     end
 
+    # splay if needed
+    splay
+
     unless Puppet[:node_name_fact].empty?
       # Collect our facts.
       unless facts = Puppet::Node::Facts.indirection.find(Puppet[:node_name_value])
-        raise "Could not find facts for #{Puppet[:node_name_value]}"
+        raise _("Could not find facts for %{node}") % { node: Puppet[:node_name_value] }
       end
 
       Puppet[:node_name_value] = facts.values[Puppet[:node_name_fact]]
       facts.name = Puppet[:node_name_value]
     end
 
-    configured_environment = Puppet.lookup(:current_environment)
+    # Find our Node
+    unless node = Puppet::Node.indirection.find(Puppet[:node_name_value])
+      raise _("Could not find node %{node}") % { node: Puppet[:node_name_value] }
+    end
+
+    configured_environment = node.environment || Puppet.lookup(:current_environment)
+
     apply_environment = manifest ?
       configured_environment.override_with(:manifest => manifest) :
       configured_environment
 
-    Puppet.override({:current_environment => apply_environment}, "For puppet apply") do
-      # Find our Node
-      unless node = Puppet::Node.indirection.find(Puppet[:node_name_value])
-        raise "Could not find node #{Puppet[:node_name_value]}"
-      end
+    # Modify the node descriptor to use the special apply_environment.
+    # It is based on the actual environment from the node, or the locally
+    # configured environment if the node does not specify one.
+    # If a manifest file is passed on the command line, it overrides
+    # the :manifest setting of the apply_environment.
+    node.environment = apply_environment
 
+    #TRANSLATORS "puppet apply" is a program command and should not be translated
+    Puppet.override({:current_environment => apply_environment}, _("For puppet apply")) do
       # Merge in the facts.
       node.merge(facts.values) if facts
 
+      # Add server facts so $server_facts[environment] exists when doing a puppet apply
+      node.add_server_facts({})
+
       # Allow users to load the classes that puppet agent creates.
       if options[:loadclasses]
         file = Puppet[:classfile]
         if Puppet::FileSystem.exist?(file)
           unless FileTest.readable?(file)
-            $stderr.puts "#{file} is not readable"
+            $stderr.puts _("%{file} is not readable") % { file: file }
             exit(63)
           end
-          node.classes = ::File.read(file).split(/[\s\n]+/)
+          node.classes = Puppet::FileSystem.read(file, :encoding => 'utf-8').split(/[\s\n]+/)
         end
       end
 
       begin
-        # Compile our catalog
+        # Compile the catalog
         starttime = Time.now
-        catalog = Puppet::Resource::Catalog.indirection.find(node.name, :use_node => node)
+
+        # When compiling, the compiler traps and logs certain errors
+        # Those that do not lead to an immediate exit are caught by the general
+        # rule and gets logged.
+        #
+        catalog =
+        begin
+          Puppet::Resource::Catalog.indirection.find(node.name, :use_node => node)
+        rescue Puppet::ParseErrorWithIssue, Puppet::Error
+          # already logged and handled by the compiler for these two cases
+          exit(1)
+        end
 
         # Translate it to a RAL catalog
         catalog = catalog.to_ral
@@ -228,7 +273,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
           catalog.write_resource_file
         end
 
-        exit_status = apply_catalog(catalog)
+        exit_status = Puppet.override(:loaders => Puppet::Pops::Loaders.new(apply_environment)) { apply_catalog(catalog) }
 
         if not exit_status
           exit(1)
@@ -252,6 +297,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
   # Enable all of the most common test options.
   def setup_test
+    Puppet.settings.handlearg("--no-splay")
     Puppet.settings.handlearg("--show_diff")
     options[:verbose] = true
     options[:detailed_exitcodes] = true
@@ -265,28 +311,37 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     Puppet::Util::Log.newdestination(:console) unless options[:setdest]
 
     Signal.trap(:INT) do
-      $stderr.puts "Exiting"
+      $stderr.puts _("Exiting")
       exit(1)
     end
 
+    Puppet.settings.use :main, :agent, :ssl
+
+
+    if Puppet[:noop]
+      Puppet::Resource::Catalog.indirection.cache_class = nil
+    elsif Puppet[:catalog_cache_terminus]
+      Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus]
+    end
+
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 
     set_log_level
 
     if Puppet[:profile]
-      @profiler = Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:debug), "apply"))
+      @profiler = Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:info), "apply"))
     end
   end
 
   private
 
   def read_catalog(text)
+    format = Puppet::Resource::Catalog.default_format
     begin
-      catalog = Puppet::Resource::Catalog.convert_from(Puppet::Resource::Catalog.default_format,text)
-      catalog = Puppet::Resource::Catalog.pson_create(catalog) unless catalog.is_a?(Puppet::Resource::Catalog)
+      catalog = Puppet::Resource::Catalog.convert_from(format, text)
     rescue => detail
-      raise Puppet::Error, "Could not deserialize catalog from pson: #{detail}", detail.backtrace
+      raise Puppet::Error, _("Could not deserialize catalog from %{format}: %{detail}") % { format: format, detail: detail }, detail.backtrace
     end
 
     catalog.to_ral

data/lib/puppet/application/ca.rb

@@ -6,5 +6,6 @@ class Puppet::Application::Ca < Puppet::Application::FaceBase
 
   def setup
     Puppet::SSL::Oids.register_puppet_oids
+    super
   end
 end

data/lib/puppet/application/cert.rb

@@ -74,11 +74,31 @@ class Puppet::Application::Cert < Puppet::Application
     options[:allow_dns_alt_names] = value
   end
 
+  option("--[no-]allow-authorization-extensions") do |value|
+    options[:allow_authorization_extensions] = value
+  end
+
   option("--verbose", "-v") do |arg|
     options[:verbose] = true
     set_log_level
   end
 
+  option("--human-readable", "-H") do |arg|
+    options[:format] = :human
+  end
+
+  option("--machine-readable", "-m") do |arg|
+    options[:format] = :machine
+  end
+
+  option("--interactive", "-i") do |arg|
+    options[:interactive] = true
+  end
+
+  option("--assume-yes", "-y") do |arg|
+    options[:yes] = true
+  end
+
   def help
     <<-'HELP'
 
@@ -110,6 +130,8 @@ ACTIONS
 Every action except 'list' and 'generate' requires a hostname to act on,
 unless the '--all' option is set.
 
+The most important actions for day-to-day use are 'list' and 'sign'.
+
 * clean:
   Revoke a host's certificate (if applicable) and remove all files
   related to that host from puppet cert's storage. This is useful when
@@ -130,7 +152,10 @@ unless the '--all' option is set.
   List outstanding certificate requests. If '--all' is specified, signed
   certificates are also listed, prefixed by '+', and revoked or invalid
   certificates are prefixed by '-' (the verification outcome is printed
-  in parenthesis).
+  in parenthesis). If '--human-readable' or '-H' is specified,
+  certificates are formatted in a way to improve human scan-ability. If
+  '--machine-readable' or '-m' is specified, output is formatted concisely
+  for consumption by a script.
 
 * print:
   Print the full-text version of a host's certificate.
@@ -143,7 +168,10 @@ unless the '--all' option is set.
   needs to be restarted after revoking certificates.
 
 * sign:
-  Sign an outstanding certificate request.
+  Sign an outstanding certificate request. If '--interactive' or '-i' is
+  supplied the user will be prompted to confirm that they are signing the
+  correct certificate (recommended). If '--assume-yes' or '-y' is supplied
+  the interactive prompt will assume the answer of 'yes'.
 
 * verify:
   Verify the named certificate against the local CA certificate.
@@ -162,7 +190,7 @@ setting, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at
-http://docs.puppetlabs.com/references/stable/configuration.html for the
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet cert with
 '--genconfig'.
@@ -171,6 +199,25 @@ configuration options can also be generated by running puppet cert with
   Operate on all items. Currently only makes sense with the 'sign',
   'list', and 'fingerprint' actions.
 
+* --allow-dns-alt-names:
+  Sign a certificate request even if it contains one or more alternate DNS
+  names. If this option isn't specified, 'puppet cert sign' will ignore any
+  requests that contain alternate names.
+
+  In general, ONLY certs intended for a Puppet master server should include
+  alternate DNS names, since Puppet agent relies on those names for identifying
+  its rightful server.
+
+  You can make Puppet agent request a certificate with alternate names by
+  setting 'dns_alt_names' in puppet.conf or specifying '--dns_alt_names' on the
+  command line. The output of 'puppet cert list' shows any requested alt names
+  for pending certificate requests.
+
+* --allow-authorization-extensions:
+  Enable the signing of a request with authorization extensions. Such requests
+  are sensitive because they can be used to write access rules in Puppet Server.
+  Currently, this is the only means by which such requests can be signed.
+
 * --digest:
   Set the digest for fingerprinting (defaults to the digest used when
   signing the cert). Valid values depends on your openssl and openssl ruby
@@ -203,7 +250,7 @@ Luke Kanies
 
 COPYRIGHT
 ---------
-Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
+Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
     HELP
   end
@@ -230,6 +277,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     Puppet::SSL::Oids.register_puppet_oids
+    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])
 
     Puppet::Util::Log.newdestination :console
 
@@ -267,13 +315,14 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
         exit
       end
     end
+
     result
   end
 
   # Create and run an applicator.  I wanted to build an interface where you could do
   # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
   def apply(ca, method, options)
-    raise ArgumentError, "You must specify the hosts to apply to; valid values are an array or the symbol :all" unless options[:to]
+    raise ArgumentError, _("You must specify the hosts to apply to; valid values are an array or the symbol :all") unless options[:to]
     applier = Puppet::SSL::CertificateAuthority::Interface.new(method, options)
     applier.apply(ca)
   end

data/lib/puppet/application/describe.rb

@@ -11,7 +11,7 @@ class Formatter
     work = (opts[:scrub] ? scrub(txt) : txt)
     indent = (opts[:indent] ? opts[:indent] : 0)
     textLen = @width - indent
-    patt = Regexp.new("^(.{0,#{textLen}})[ \n]")
+    patt = Regexp.new("\\A(.{0,#{textLen}})[ \n]")
     prefix = " " * indent
 
     res = []
@@ -226,7 +226,7 @@ David Lutterkort
 
 COPYRIGHT
 ---------
-Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
+Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
     HELP
   end

data/lib/puppet/application/device.rb

@@ -19,7 +19,7 @@ class Puppet::Application::Device < Puppet::Application
   def preinit
     # Do an initial trap, so that cancels don't get a stack trace.
     Signal.trap(:INT) do
-      $stderr.puts "Cancelling startup"
+      $stderr.puts _("Cancelling startup")
       exit(0)
     end
 
@@ -30,6 +30,7 @@ class Puppet::Application::Device < Puppet::Application
       :debug => false,
       :centrallogs => false,
       :setdest => false,
+      :target => nil,
     }.each do |opt,val|
       options[opt] = val
     end
@@ -57,6 +58,10 @@ class Puppet::Application::Device < Puppet::Application
     @args[:Port] = arg
   end
 
+  option("--target DEVICE", "-t") do |arg|
+    options[:target] = arg.to_s
+  end
+
     def help
       <<-'HELP'
 
@@ -72,9 +77,10 @@ Currently must be run out periodically, using cron or something similar.
 
 USAGE
 -----
-  puppet device [-d|--debug] [--detailed-exitcodes] [-V|--version]
+  puppet device [-d|--debug] [--detailed-exitcodes] [--deviceconfig <file>]
                 [-h|--help] [-l|--logdest syslog|<file>|console]
                 [-v|--verbose] [-w|--waitforcert <seconds>]
+                [-t|--target <device>] [-V|--version]
 
 
 DESCRIPTION
@@ -118,15 +124,28 @@ parameter, so you can specify '--server <servername>' as an argument.
   code of '1' means at least one device had a compile failure, an exit code of
   '2' means at least one device had resource changes, and an exit code of '4'
   means at least one device had resource failures. Exit codes of '3', '5', '6',
-  or '7' means that a bitwise combination of the preceeding exit codes happened.
+  or '7' means that a bitwise combination of the preceding exit codes happened.
+
+* --deviceconfig:
+  Path to the device config file for puppet device.
+  Default: $confdir/device.conf
 
 * --help:
   Print this help message
 
 * --logdest:
-  Where to send messages.  Choose between syslog, the console, and a log file.
-  Defaults to sending messages to syslog, or the console if debugging or
-  verbosity is enabled.
+  Where to send log messages. Choose between 'syslog' (the POSIX syslog
+  service), 'console', or the path to a log file. If debugging or verbosity is
+  enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
+
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
+
+* --target:
+  Target a specific device/certificate in the device.conf. Doing so will perform a
+  device run against only that device/certificate.
 
 * --verbose:
   Turn on verbose reporting.
@@ -150,7 +169,7 @@ Brice Figureau
 
 COPYRIGHT
 ---------
-Copyright (c) 2011 Puppet Labs, LLC
+Copyright (c) 2011 Puppet Inc., LLC
 Licensed under the Apache 2.0 License
       HELP
     end
@@ -161,51 +180,62 @@ Licensed under the Apache 2.0 License
     confdir = Puppet[:confdir]
     certname = Puppet[:certname]
 
-    # find device list
-    require 'puppet/util/network_device/config'
-    devices = Puppet::Util::NetworkDevice::Config.devices
-    if devices.empty?
-      Puppet.err "No device found in #{Puppet[:deviceconfig]}"
-      exit(1)
-    end
-    returns = devices.collect do |devicename,device|
-      begin
-        device_url = URI.parse(device.url)
-        # Handle nil scheme & port
-        scheme = "#{device_url.scheme}://" if device_url.scheme
-        port = ":#{device_url.port}" if device_url.port
-        Puppet.info "starting applying configuration to #{device.name} at #{scheme}#{device_url.host}#{port}#{device_url.path}"
-
-        # override local $vardir and $certname
-        Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
-        Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
-        Puppet[:certname] = device.name
-
-        # this will reload and recompute default settings and create the devices sub vardir, or we hope so :-)
-        Puppet.settings.use :main, :agent, :ssl
-
-        # this init the device singleton, so that the facts terminus
-        # and the various network_device provider can use it
-        Puppet::Util::NetworkDevice.init(device)
-
-        # ask for a ssl cert if needed, but at least
-        # setup the ssl system for this device.
-        setup_host
-
-        require 'puppet/configurer'
-        configurer = Puppet::Configurer.new
-        configurer.run(:network_device => true, :pluginsync => Puppet[:pluginsync])
-      rescue => detail
-        Puppet.log_exception(detail)
-        # If we rescued an error, then we return 1 as the exit code
-        1
-      ensure
-        Puppet[:vardir] = vardir
-        Puppet[:confdir] = confdir
-        Puppet[:certname] = certname
-        Puppet::SSL::Host.reset
+    env = Puppet.lookup(:environments).get(Puppet[:environment])
+    returns = Puppet.override(:current_environment => env, :loaders => Puppet::Pops::Loaders.new(env)) do
+      # find device list
+      require 'puppet/util/network_device/config'
+      devices = Puppet::Util::NetworkDevice::Config.devices.dup
+      if options[:target]
+        devices.select! { |key, value| key == options[:target] }
+      end
+      if devices.empty?
+        if options[:target]
+          Puppet.err _("Target device / certificate '%{target}' not found in %{config}") % { target: options[:target], config: Puppet[:deviceconfig] }
+        else
+          Puppet.err _("No device found in %{config}") % { config: Puppet[:deviceconfig] }
+          exit(1)
+        end
+      end
+      devices.collect do |devicename,device|
+        begin
+          device_url = URI.parse(device.url)
+          # Handle nil scheme & port
+          scheme = "#{device_url.scheme}://" if device_url.scheme
+          port = ":#{device_url.port}" if device_url.port
+          Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+
+          # override local $vardir and $certname
+          Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
+          Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
+          Puppet[:certname] = device.name
+
+          # this will reload and recompute default settings and create the devices sub vardir, or we hope so :-)
+          Puppet.settings.use :main, :agent, :ssl
+
+          # this init the device singleton, so that the facts terminus
+          # and the various network_device provider can use it
+          Puppet::Util::NetworkDevice.init(device)
+
+          # ask for a ssl cert if needed, but at least
+          # setup the ssl system for this device.
+          setup_host
+
+          require 'puppet/configurer'
+          configurer = Puppet::Configurer.new
+          configurer.run(:network_device => true, :pluginsync => Puppet::Configurer.should_pluginsync?)
+        rescue => detail
+          Puppet.log_exception(detail)
+          # If we rescued an error, then we return 1 as the exit code
+          1
+        ensure
+          Puppet[:vardir] = vardir
+          Puppet[:confdir] = confdir
+          Puppet[:certname] = certname
+          Puppet::SSL::Host.reset
+        end
       end
     end
+
     if ! returns or returns.compact.empty?
       exit(1)
     elsif options[:detailed_exitcodes]

data/lib/puppet/application/doc.rb

@@ -25,7 +25,7 @@ class Puppet::Application::Doc < Puppet::Application
     if Puppet::Util::Reference.method_defined?(method)
       options[:format] = method
     else
-      raise "Invalid output format #{arg}"
+      raise _("Invalid output format %{arg}") % { arg: arg }
     end
   end
 
@@ -34,7 +34,7 @@ class Puppet::Application::Doc < Puppet::Application
     if Puppet::Util::Reference.modes.include?(arg) or arg.intern==:rdoc
       options[:mode] = arg.intern
     else
-      raise "Invalid output mode #{arg}"
+      raise _("Invalid output mode %{arg}") % { arg: arg }
     end
   end
 
@@ -57,7 +57,7 @@ puppet-doc(8) -- Generate Puppet references
 SYNOPSIS
 --------
 Generates a reference for all Puppet types. Largely meant for internal
-Puppet Labs use. (Deprecated)
+Puppet Inc. use. (Deprecated)
 
 
 USAGE
@@ -71,7 +71,7 @@ DESCRIPTION
 This deprecated command generates a Markdown document to stdout
 describing all installed Puppet types or all allowable arguments to
 puppet executables. It is largely meant for internal use and is used to
-generate the reference document available on the Puppet Labs web site.
+generate the reference document available on the Puppet Inc. web site.
 
 For Puppet module documentation (and all other use cases) this command
 has been superseded by the "puppet-strings"
@@ -104,7 +104,7 @@ Luke Kanies
 
 COPYRIGHT
 ---------
-Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
+Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
 HELP
   end
@@ -127,7 +127,7 @@ HELP
       files << ::File.dirname(env.manifest) if env.manifest != Puppet::Node::Environment::NO_MANIFEST
     end
     files += command_line.args
-    Puppet.info "scanning: #{files.inspect}"
+    Puppet.info _("scanning: %{files}") % { files: files.inspect }
 
     Puppet.settings[:document_all] = options[:all] || false
     begin
@@ -139,7 +139,7 @@ HELP
         Puppet::Util::RDoc.rdoc(options[:outputdir], files, options[:charset])
       end
     rescue => detail
-      Puppet.log_exception(detail, "Could not generate documentation: #{detail}")
+      Puppet.log_exception(detail, _("Could not generate documentation: %{detail}") % { detail: detail })
       exit_code = 1
     end
     exit exit_code
@@ -151,13 +151,13 @@ HELP
     exit_code = 0
     require 'puppet/util/reference'
     options[:references].sort { |a,b| a.to_s <=> b.to_s }.each do |name|
-      raise "Could not find reference #{name}" unless section = Puppet::Util::Reference.reference(name)
+      raise _("Could not find reference %{name}") % { name: name } unless section = Puppet::Util::Reference.reference(name)
 
       begin
         # Add the per-section text, but with no ToC
         text += section.send(options[:format], with_contents)
       rescue => detail
-        Puppet.log_exception(detail, "Could not generate reference #{name}: #{detail}")
+        Puppet.log_exception(detail, _("Could not generate reference %{name}: %{detail}") % { name: name, detail: detail })
         exit_code = 1
         next
       end