puppet 4.1.0 → 4.10.0

data/lib/puppet/application/agent.rb

@@ -118,14 +118,14 @@ go into the background, attempt to get a signed certificate, and retrieve
 and apply its configuration every 30 minutes.
 
 Some flags are meant specifically for interactive use -- in particular,
-'test', 'tags' or 'fingerprint' are useful. 'test' enables verbose
-logging, causes the daemon to stay in the foreground, exits if the
-server's configuration is invalid (this happens if, for instance, you've
-left a syntax error on the server), and exits after running the
-configuration once (rather than hanging around as a long-running
-process).
-
-'tags' allows you to specify what portions of a configuration you want
+'test', 'tags' and 'fingerprint' are useful.
+
+'--test' does a single run in the foreground with verbose logging, then exits.
+It will also exit if it can't get a valid catalog. The exit code after running
+with '--test' is 0 if the catalog was successfully applied, and 1 if the run
+either failed or wasn't attempted (due to another run already in progress).
+
+'--tags' allows you to specify what portions of a configuration you want
 to apply. Puppet elements are tagged with all of the class or definition
 names that contain them, and you can use the 'tags' flag to specify one
 of these names, causing only configuration elements contained within
@@ -136,7 +136,7 @@ class, and call puppet with '--tags ntpd', which would only apply that
 small portion of the configuration during your testing, rather than
 applying the whole thing.
 
-'fingerprint' is a one-time flag. In this mode 'puppet agent' will run
+'--fingerprint' is a one-time flag. In this mode 'puppet agent' will run
 once and display on the console (and in the log) the current certificate
 (or certificate request) fingerprint. Providing the '--digest' option
 allows to use a different digest algorithm to generate the fingerprint.
@@ -155,7 +155,7 @@ specify '--server <servername>' as an argument. Boolean settings translate into
 '--setting' and '--no-setting' pairs.
 
 See the configuration file documentation at
-http://docs.puppetlabs.com/references/stable/configuration.html for the
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
 full list of acceptable settings. A commented list of all settings can also be
 generated by running puppet agent with '--genconfig'.
 
@@ -181,10 +181,20 @@ generated by running puppet agent with '--genconfig'.
   Enable full debugging.
 
 * --detailed-exitcodes:
-  Provide transaction information via exit codes. If this is enabled, an exit
-  code of '2' means there were changes, an exit code of '4' means there were
-  failures during the transaction, and an exit code of '6' means there were both
-  changes and failures.
+  Provide extra information about the run via exit codes; only works if '--test'
+  or '--onetime' is also specified. If enabled, 'puppet agent' will use the
+  following exit codes:
+
+  0: The run succeeded with no changes or failures; the system was already in
+  the desired state.
+
+  1: The run failed, or wasn't attempted due to another run already in progress.
+
+  2: The run succeeded, and some resources were changed.
+
+  4: The run succeeded, and some resources failed.
+
+  6: The run succeeded, and included both changes and failures.
 
 * --digest:
   Change the certificate fingerprinting digest algorithm. The default is
@@ -253,8 +263,8 @@ generated by running puppet agent with '--genconfig'.
 
 * --test:
   Enable the most common options used for testing. These are 'onetime',
-  'verbose', 'ignorecache', 'no-daemonize', 'no-usecacheonfailure',
-  'detailed-exitcodes', 'no-splay', and 'show_diff'.
+  'verbose', 'no-daemonize', 'no-usecacheonfailure', 'detailed-exitcodes',
+  'no-splay', 'show_diff', and 'no-use_cached_catalog'.
 
 * --verbose:
   Turn on verbose reporting.
@@ -312,6 +322,9 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
       # waiting for certificates so that we don't block
       daemon = daemonize_process_when(Puppet[:daemonize])
 
+      # Setup signal traps immediately after daemonization so we clean up the daemon
+      daemon.set_signal_traps
+
       wait_for_certificates
 
       if Puppet[:onetime]
@@ -336,7 +349,6 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
   end
 
   def onetime(daemon)
-    daemon.set_signal_traps
     begin
       exitstatus = daemon.agent.run
     rescue => detail
@@ -361,17 +373,19 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
   # Enable all of the most common test options.
   def setup_test
-    Puppet.settings.handlearg("--ignorecache")
     Puppet.settings.handlearg("--no-usecacheonfailure")
     Puppet.settings.handlearg("--no-splay")
     Puppet.settings.handlearg("--show_diff")
     Puppet.settings.handlearg("--no-daemonize")
+    Puppet.settings.handlearg("--no-use_cached_catalog")
     options[:verbose] = true
     Puppet[:onetime] = true
     options[:detailed_exitcodes] = true
   end
 
   def setup
+    raise ArgumentError, "The puppet agent command does not take parameters" unless command_line.args.empty?
+
     setup_test if options[:test]
 
     setup_logs
@@ -390,7 +404,9 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 
-    if Puppet[:catalog_cache_terminus]
+    if Puppet[:noop]
+      Puppet::Resource::Catalog.indirection.cache_class = nil
+    elsif Puppet[:catalog_cache_terminus]
       Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus]
     end
 

data/lib/puppet/application/apply.rb

@@ -3,6 +3,8 @@ require 'puppet/configurer'
 require 'puppet/util/profiler/aggregate'
 
 class Puppet::Application::Apply < Puppet::Application
+  require 'puppet/util/splayer'
+  include Puppet::Util::Splayer
 
   option("--debug","-d")
   option("--execute EXECUTE","-e") do |arg|
@@ -72,7 +74,7 @@ valid setting, so you can specify '--tags <class>,<tag>'
 as an argument.
 
 See the configuration file documentation at
-http://docs.puppetlabs.com/references/stable/configuration.html for the
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet with
 '--genconfig'.
@@ -81,10 +83,19 @@ configuration options can also be generated by running puppet with
   Enable full debugging.
 
 * --detailed-exitcodes:
-  Provide transaction information via exit codes. If this is enabled, an exit
-  code of '2' means there were changes, an exit code of '4' means there were
-  failures during the transaction, and an exit code of '6' means there were both
-  changes and failures.
+  Provide extra information about the run via exit codes. If enabled, 'puppet
+  apply' will use the following exit codes:
+
+  0: The run succeeded with no changes or failures; the system was already in
+  the desired state.
+
+  1: The run failed.
+
+  2: The run succeeded, and some resources were changed.
+
+  4: The run succeeded, and some resources failed.
+
+  6: The run succeeded, and included both changes and failures.
 
 * --help:
   Print this help message
@@ -164,7 +175,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     if options[:catalog] == "-"
       text = $stdin.read
     else
-      text = ::File.read(options[:catalog])
+      text = Puppet::FileSystem.read(options[:catalog], :encoding => 'utf-8')
     end
     catalog = read_catalog(text)
     apply_catalog(catalog)
@@ -180,6 +191,9 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
       Puppet.warning("Only one file can be applied per run.  Skipping #{command_line.args.join(', ')}") if command_line.args.size > 0
     end
 
+    # splay if needed
+    splay
+
     unless Puppet[:node_name_fact].empty?
       # Collect our facts.
       unless facts = Puppet::Node::Facts.indirection.find(Puppet[:node_name_value])
@@ -190,17 +204,25 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
       facts.name = Puppet[:node_name_value]
     end
 
-    configured_environment = Puppet.lookup(:current_environment)
+    # Find our Node
+    unless node = Puppet::Node.indirection.find(Puppet[:node_name_value])
+      raise "Could not find node #{Puppet[:node_name_value]}"
+    end
+
+    configured_environment = node.environment || Puppet.lookup(:current_environment)
+
     apply_environment = manifest ?
       configured_environment.override_with(:manifest => manifest) :
       configured_environment
 
-    Puppet.override({:current_environment => apply_environment}, "For puppet apply") do
-      # Find our Node
-      unless node = Puppet::Node.indirection.find(Puppet[:node_name_value])
-        raise "Could not find node #{Puppet[:node_name_value]}"
-      end
+    # Modify the node descriptor to use the special apply_environment.
+    # It is based on the actual environment from the node, or the locally
+    # configured environment if the node does not specify one.
+    # If a manifest file is passed on the command line, it overrides
+    # the :manifest setting of the apply_environment.
+    node.environment = apply_environment
 
+    Puppet.override({:current_environment => apply_environment}, "For puppet apply") do
       # Merge in the facts.
       node.merge(facts.values) if facts
 
@@ -217,7 +239,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
             $stderr.puts "#{file} is not readable"
             exit(63)
           end
-          node.classes = ::File.read(file).split(/[\s\n]+/)
+          node.classes = Puppet::FileSystem.read(file, :encoding => 'utf-8').split(/[\s\n]+/)
         end
       end
 
@@ -273,6 +295,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
   # Enable all of the most common test options.
   def setup_test
+    Puppet.settings.handlearg("--no-splay")
     Puppet.settings.handlearg("--show_diff")
     options[:verbose] = true
     options[:detailed_exitcodes] = true
@@ -290,13 +313,22 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
       exit(1)
     end
 
+    Puppet.settings.use :main, :agent, :ssl
+
+
+    if Puppet[:noop]
+      Puppet::Resource::Catalog.indirection.cache_class = nil
+    elsif Puppet[:catalog_cache_terminus]
+      Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus]
+    end
+
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 
     set_log_level
 
     if Puppet[:profile]
-      @profiler = Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:debug), "apply"))
+      @profiler = Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:info), "apply"))
     end
   end
 

data/lib/puppet/application/ca.rb

@@ -6,5 +6,6 @@ class Puppet::Application::Ca < Puppet::Application::FaceBase
 
   def setup
     Puppet::SSL::Oids.register_puppet_oids
+    super
   end
 end

data/lib/puppet/application/cert.rb

@@ -74,11 +74,31 @@ class Puppet::Application::Cert < Puppet::Application
     options[:allow_dns_alt_names] = value
   end
 
+  option("--[no-]allow-authorization-extensions") do |value|
+    options[:allow_authorization_extensions] = value
+  end
+
   option("--verbose", "-v") do |arg|
     options[:verbose] = true
     set_log_level
   end
 
+  option("--human-readable", "-H") do |arg|
+    options[:format] = :human
+  end
+
+  option("--machine-readable", "-m") do |arg|
+    options[:format] = :machine
+  end
+
+  option("--interactive", "-i") do |arg|
+    options[:interactive] = true
+  end
+
+  option("--assume-yes", "-y") do |arg|
+    options[:yes] = true
+  end
+
   def help
     <<-'HELP'
 
@@ -110,6 +130,8 @@ ACTIONS
 Every action except 'list' and 'generate' requires a hostname to act on,
 unless the '--all' option is set.
 
+The most important actions for day-to-day use are 'list' and 'sign'.
+
 * clean:
   Revoke a host's certificate (if applicable) and remove all files
   related to that host from puppet cert's storage. This is useful when
@@ -130,7 +152,10 @@ unless the '--all' option is set.
   List outstanding certificate requests. If '--all' is specified, signed
   certificates are also listed, prefixed by '+', and revoked or invalid
   certificates are prefixed by '-' (the verification outcome is printed
-  in parenthesis).
+  in parenthesis). If '--human-readable' or '-H' is specified,
+  certificates are formatted in a way to improve human scan-ability. If
+  '--machine-readable' or '-m' is specified, output is formatted concisely
+  for consumption by a script.
 
 * print:
   Print the full-text version of a host's certificate.
@@ -143,7 +168,10 @@ unless the '--all' option is set.
   needs to be restarted after revoking certificates.
 
 * sign:
-  Sign an outstanding certificate request.
+  Sign an outstanding certificate request. If '--interactive' or '-i' is
+  supplied the user will be prompted to confirm that they are signing the
+  correct certificate (recommended). If '--assume-yes' or '-y' is supplied
+  the interactive prompt will assume the answer of 'yes'.
 
 * verify:
   Verify the named certificate against the local CA certificate.
@@ -162,7 +190,7 @@ setting, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at
-http://docs.puppetlabs.com/references/stable/configuration.html for the
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet cert with
 '--genconfig'.
@@ -171,6 +199,25 @@ configuration options can also be generated by running puppet cert with
   Operate on all items. Currently only makes sense with the 'sign',
   'list', and 'fingerprint' actions.
 
+* --allow-dns-alt-names:
+  Sign a certificate request even if it contains one or more alternate DNS
+  names. If this option isn't specified, 'puppet cert sign' will ignore any
+  requests that contain alternate names.
+
+  In general, ONLY certs intended for a Puppet master server should include
+  alternate DNS names, since Puppet agent relies on those names for identifying
+  its rightful server.
+
+  You can make Puppet agent request a certificate with alternate names by
+  setting 'dns_alt_names' in puppet.conf or specifying '--dns_alt_names' on the
+  command line. The output of 'puppet cert list' shows any requested alt names
+  for pending certificate requests.
+
+* --allow-authorization-extensions:
+  Enable the signing of a request with authorization extensions. Such requests
+  are sensitive because they can be used to write access rules in Puppet Server.
+  Currently, this is the only means by which such requests can be signed.
+
 * --digest:
   Set the digest for fingerprinting (defaults to the digest used when
   signing the cert). Valid values depends on your openssl and openssl ruby
@@ -230,6 +277,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     Puppet::SSL::Oids.register_puppet_oids
+    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])
 
     Puppet::Util::Log.newdestination :console
 
@@ -267,6 +315,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
         exit
       end
     end
+
     result
   end
 

data/lib/puppet/application/device.rb

@@ -118,7 +118,7 @@ parameter, so you can specify '--server <servername>' as an argument.
   code of '1' means at least one device had a compile failure, an exit code of
   '2' means at least one device had resource changes, and an exit code of '4'
   means at least one device had resource failures. Exit codes of '3', '5', '6',
-  or '7' means that a bitwise combination of the preceeding exit codes happened.
+  or '7' means that a bitwise combination of the preceding exit codes happened.
 
 * --help:
   Print this help message
@@ -199,7 +199,7 @@ Licensed under the Apache 2.0 License
 
         require 'puppet/configurer'
         configurer = Puppet::Configurer.new
-        configurer.run(:network_device => true, :pluginsync => Puppet[:pluginsync])
+        configurer.run(:network_device => true, :pluginsync => Puppet::Configurer.should_pluginsync?)
       rescue => detail
         Puppet.log_exception(detail)
         # If we rescued an error, then we return 1 as the exit code

data/lib/puppet/application/face_base.rb

@@ -245,6 +245,10 @@ class Puppet::Application::FaceBase < Puppet::Application
       end
     end
 
+    if @face.deprecated?
+      Puppet.deprecation_warning("'puppet #{@face.name}' is deprecated and will be removed in a future release")
+    end
+
     result = @face.send(@action.name, *arguments)
     puts render(result, arguments) unless result.nil?
     status = true

data/lib/puppet/application/filebucket.rb

@@ -4,6 +4,8 @@ class Puppet::Application::Filebucket < Puppet::Application
 
   option("--bucket BUCKET","-b")
   option("--debug","-d")
+  option("--fromdate FROMDATE","-f")
+  option("--todate TODATE","-t")
   option("--local","-l")
   option("--remote","-r")
   option("--verbose","-v")
@@ -25,7 +27,8 @@ USAGE
 -----
 puppet filebucket <mode> [-h|--help] [-V|--version] [-d|--debug]
   [-v|--verbose] [-l|--local] [-r|--remote] [-s|--server <server>]
-  [-b|--bucket <directory>] <file> <file> ...
+  [-f|--fromdate <date>] [-t|--todate <date>] [-b|--bucket <directory>]
+  <file> <file> ...
 
 Puppet filebucket can operate in three modes, with only one mode per call:
 
@@ -43,6 +46,13 @@ restore:
   path to this argument; you are not restricted to restoring the content
   to its original location.
 
+diff:
+  Print a diff in unified format between two checksums in the filebucket
+  or between a checksum and its matching file.
+
+list:
+  List all files in the current local filebucket. Listing remote
+  filebuckets is not allowed.
 
 DESCRIPTION
 -----------
@@ -63,7 +73,7 @@ setting, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at
-http://docs.puppetlabs.com/references/stable/configuration.html for the
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet with
 '--genconfig'.
@@ -71,6 +81,9 @@ configuration options can also be generated by running puppet with
 * --debug:
   Enable full debugging.
 
+* --fromdate:
+  (list only) Select bucket files from 'fromdate'
+
 * --help:
   Print this help message
 
@@ -85,6 +98,9 @@ configuration options can also be generated by running puppet with
 * --server:
   The server to send the file to, instead of locally.
 
+* --todate:
+  (list only) Select bucket files until 'todate'
+
 * --verbose:
   Print extra information.
 
@@ -97,7 +113,31 @@ EXAMPLE
     $ puppet filebucket backup /etc/passwd
     /etc/passwd: 429b225650b912a2ee067b0a4cf1e949
     $ puppet filebucket restore /tmp/passwd 429b225650b912a2ee067b0a4cf1e949
-
+    ## Diff between two files in the filebucket
+    $ puppet filebucket -l diff d43a6ecaa892a1962398ac9170ea9bf2 7ae322f5791217e031dc60188f4521ef
+    1a2
+    > again
+    ## Diff between the file in the filebucket and the current one
+    $ puppet filebucket -l diff d43a6ecaa892a1962398ac9170ea9bf2 /tmp/testFile
+    1a2
+    > again
+    $ puppet filebucket -l list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    $ echo again >> /tmp/TestFile
+    $ puppet filebucket -l backup /tmp/TestFile
+    /tmp/TestFile: 7ae322f5791217e031dc60188f4521ef
+    $ puppet filebucket -l  list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+    $ puppet filebucket -l -f 2015-01-01 -t 2015-01-11 list
+    <Empty Output>
+    $ puppet filebucket -l -f 2015-05-10 list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+    $ puppet filebucket -l -f "2015-05-11 09:30:00" list
+    7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+    $ puppet filebucket -l -t "2015-05-11 09:30:00" list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
 
 AUTHOR
 ------
@@ -115,7 +155,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
   def run_command
     @args = command_line.args
     command = args.shift
-    return send(command) if %w{get backup restore}.include? command
+    return send(command) if %w{get backup restore diff list}.include? command
     help
   end
 
@@ -142,12 +182,47 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     end
   end
 
+  def list
+    fromdate = options[:fromdate]
+    todate = options[:todate]
+    out = @client.list(fromdate, todate)
+    print out
+  end
+
   def restore
     file = args.shift
     md5 = args.shift
     @client.restore(file, md5)
   end
 
+  def diff
+    raise Puppet::Error, "Need exactly two arguments: filebucket diff <file_a> <file_b>" unless args.count == 2
+    left = args.shift
+    right = args.shift
+    if Puppet::FileSystem.exist?(left)
+      # It's a file
+      file_a = left
+      checksum_a = nil
+    else
+      file_a = nil
+      checksum_a = left
+    end
+    if Puppet::FileSystem.exist?(right)
+      # It's a file
+      file_b = right
+      checksum_b = nil
+    else
+      file_b = nil
+      checksum_b = right
+    end
+    if (checksum_a || file_a) && (checksum_b || file_b)
+      Puppet.info("Comparing #{checksum_a} #{checksum_b} #{file_a} #{file_b}")
+      print @client.diff(checksum_a, checksum_b, file_a, file_b)
+    else
+      raise Puppet::Error, "Need exactly two arguments: filebucket diff <file_a> <file_b>"
+    end
+  end
+
   def setup
     Puppet::Log.newdestination(:console)
 
@@ -181,4 +256,3 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     end
   end
 end
-

data/lib/puppet/application/generate.rb

@@ -0,0 +1,5 @@
+require 'puppet/application/face_base'
+
+# The Generate application. 
+class Puppet::Application::Generate < Puppet::Application::FaceBase
+end

data/lib/puppet/application/inspect.rb

@@ -19,6 +19,7 @@ puppet-inspect(8) -- Send an inspection report
 
 SYNOPSIS
 --------
+Note: this command is deprecated
 
 Prepares and submits an inspection report to the puppet master.
 
@@ -48,7 +49,7 @@ OPTIONS
 Any configuration setting which is valid in the configuration file is
 also a valid long argument, e.g. '--server=master.domain.com'. See the
 configuration file documentation at
-http://docs.puppetlabs.com/references/latest/configuration.html for
+https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for
 the full list of acceptable settings.
 
 * --archive_files:
@@ -74,6 +75,8 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
   end
 
   def setup
+    deprecate
+
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     raise "Inspect requires reporting to be enabled. Set report=true in puppet.conf to enable reporting." unless Puppet[:report]
@@ -91,7 +94,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     set_log_level
 
     Puppet::Transaction::Report.indirection.terminus_class = :rest
-    Puppet::Resource::Catalog.indirection.terminus_class = :yaml
+    Puppet::Resource::Catalog.indirection.terminus_class = Puppet[:catalog_cache_terminus] || :json
   end
 
   def preinit