puppet 4.10.12-universal-darwin → 5.0.0-universal-darwin

data/lib/puppet/context.rb

@@ -38,7 +38,7 @@ class Puppet::Context
   # @api private
   def pop
     if @stack[-1][0] == 0
-      raise(StackUnderflow, "Attempted to pop, but already at root of the context stack.")
+      raise(StackUnderflow, _("Attempted to pop, but already at root of the context stack."))
     else
       (_, @table, @description) = @stack.pop
     end
@@ -52,7 +52,7 @@ class Puppet::Context
     elsif block
       block.call
     else
-      raise UndefinedBindingError, "no '#{name}' in #{@table.inspect} at top of #{@stack.inspect}"
+      raise UndefinedBindingError, _("no '%{name}' in %{table} at top of %{stack}") % { name: name, table: @table.inspect, stack: @stack.inspect }
     end
   end
 
@@ -77,7 +77,7 @@ class Puppet::Context
     if @ignores.include?(name)
       @ignores.delete(name)
     else
-      raise UndefinedBindingError, "no '#{name}' in ignores #{@ignores.inspect} at top of #{@stack.inspect}"
+      raise UndefinedBindingError, _("no '%{name}' in ignores %{ignores} at top of %{stack}") % { name: name, ignores: @ignores.inspect, stack: @stack.inspect }
     end
   end
 
@@ -90,7 +90,7 @@ class Puppet::Context
     if @rollbacks[name].nil?
       @rollbacks[name] = @stack[-1][0]
     else
-      raise DuplicateRollbackMarkError, "Mark for '#{name}' already exists"
+      raise DuplicateRollbackMarkError, _("Mark for '%{name}' already exists") % { name: name }
     end
   end
 
@@ -104,7 +104,7 @@ class Puppet::Context
   # @api private
   def rollback(name)
     if @rollbacks[name].nil?
-      raise UnknownRollbackMarkError, "Unknown mark '#{name}'"
+      raise UnknownRollbackMarkError, _("Unknown mark '%{name}'") % { name: name }
     end
 
     while @stack[-1][0] != @rollbacks[name]

data/lib/puppet/context/trusted_information.rb

@@ -45,7 +45,7 @@ class Puppet::Context::TrustedInformation
     if authenticated
       extensions = {}
       if certificate.nil?
-        Puppet.info('TrustedInformation expected a certificate, but none was given.')
+        Puppet.info(_('TrustedInformation expected a certificate, but none was given.'))
       else
         extensions = Hash[certificate.custom_extensions.collect do |ext|
           [ext['oid'].freeze, ext['value'].freeze]

data/lib/puppet/defaults.rb

@@ -15,26 +15,6 @@ module Puppet
 
   AS_DURATION = %q{This setting can be a time interval in seconds (30 or 30s), minutes (30m), hours (6h), days (2d), or years (5y).}
 
-  # This is defined first so that the facter implementation is replaced before other setting defaults are evaluated.
-  define_settings(:main,
-    :cfacter => {
-        :default => false,
-        :type    => :boolean,
-        :desc    => 'Whether to enable a pre-Facter 3.0 release of native Facter (distributed as
-          the "cfacter" package). This is not necessary if Facter 3.0 or later is installed.
-          This setting is deprecated, as Facter 3 is now the default in puppet-agent.',
-        :hook    => proc do |value|
-          return unless value
-          raise ArgumentError, 'facter has already evaluated facts.' if Facter.instance_variable_get(:@collection)
-          raise ArgumentError, 'cfacter version 0.2.0 or later is not installed.' unless Puppet.features.cfacter?
-          CFacter.initialize
-
-          # Setup Facter's logging again now that native facter is initialized
-          Puppet::Util::Logging.setup_facter_logging!
-        end
-    }
-  )
-
   define_settings(:main,
     :confdir  => {
         :default  => nil,
@@ -296,26 +276,10 @@ module Puppet
     },
     :environment => {
         :default  => "production",
-        :desc     => "The environment in which Puppet is running. For clients,
-          such as `puppet agent`, this determines the environment itself, which
-          Puppet uses to find modules and much more. For servers, such as `puppet master`,
-          this provides the default environment for nodes that Puppet knows nothing about.
-
-          When defining an environment in the `[agent]` section, this refers to the
-          environment that the agent requests from the master. The environment doesn't
-          have to exist on the local filesystem because the agent fetches it from the
-          master. This definition is used when running `puppet agent`.
-
-          When defined in the `[user]` section, the environment refers to the path that
-          Puppet uses to search for code and modules related to its execution. This
-          requires the environment to exist locally on the filesystem where puppet is
-          being executed. Puppet subcommands, including `puppet module` and
-          `puppet apply`, use this definition.
-
-          Given that the context and effects vary depending on the
-          [config section](https://puppet.com/docs/puppet/latest/config_file_main.html#config-sections)
-          in which the `environment` setting is defined, do not set it globally.",
-        :short    => "E"
+        :desc     => "The environment Puppet is running in.  For clients
+          (e.g., `puppet agent`) this determines the environment itself, which
+          is used to find modules and much more.  For servers (i.e., `puppet master`)
+          this provides the default environment for nodes we know nothing about."
     },
     :environmentpath => {
       :default => "$codedir/environments",
@@ -328,31 +292,6 @@ module Puppet
         <https://docs.puppet.com/puppet/latest/reference/environments.html>",
       :type    => :path,
     },
-    :always_cache_features => {
-      :type     => :boolean,
-      :default  => false,
-      :hook     => proc { |value|
-        Puppet.deprecation_warning "Setting 'always_cache_features' is
-deprecated and has been replaced by 'always_retry_plugins'."
-      },
-      :desc     => <<-'EOT'
-        This setting is deprecated and has been replaced by always_retry_plugins.
-
-        Affects how we cache attempts to load Puppet 'features'.  If false, then
-        calls to `Puppet.features.<feature>?` will always attempt to load the
-        feature (which can be an expensive operation) unless it has already been
-        loaded successfully.  This makes it possible for a single agent run to,
-        e.g., install a package that provides the underlying capabilities for
-        a feature, and then later load that feature during the same run (even if
-        the feature had been tested earlier and had not been available).
-
-        If this setting is set to true, then features will only be checked once,
-        and if they are not available, the negative result is cached and returned
-        for all subsequent attempts to load the feature.  This behavior is almost
-        always appropriate for the server, and can result in a significant performance
-        improvement for features that are checked frequently.
-      EOT
-    },
     :always_retry_plugins => {
         :type     => :boolean,
         :default  => true,
@@ -451,8 +390,7 @@ deprecated and has been replaced by 'always_retry_plugins'."
       :type       => :terminus,
       :default    => nil,
       :desc       => "How to store cached nodes.
-      Valid values are (none), 'json', 'msgpack', 'yaml' or write only yaml ('write_only_yaml').
-      The master application defaults to 'write_only_yaml', all others to none.",
+      Valid values are (none), 'json', 'msgpack', 'yaml' or write only yaml ('write_only_yaml').",
     },
     :data_binding_terminus => {
       :type    => :terminus,
@@ -642,14 +580,11 @@ deprecated and has been replaced by 'always_retry_plugins'."
           class, or definition other than in the site manifest.",
     },
     :trusted_server_facts => {
-      :default => false,
+      :default => true,
       :type    => :boolean,
-      :desc    => "When enabled, Puppet creates a protected top-scope variable called $server_facts.
-        This variable name can't be re-used in any local scope, and can't be overridden
-        by agent-provided facts.
-
-        The $server_facts variable is a hash, containing server-provided information
-        like the current node's environment and the version of Puppet running on the server.",
+      :deprecated => :completely,
+      :desc    => "The 'trusted_server_facts' setting is deprecated and has no effect as the
+        feature this enabled is now always on. The setting will be removed in a future version of puppet.",
     },
     :preview_outputdir => {
       :default => '$vardir/preview',
@@ -662,14 +597,12 @@ deprecated and has been replaced by 'always_retry_plugins'."
   )
 
   define_settings(:main,
+      # Whether the application management feature is on or off - now deprecated and always on.
       :app_management => {
           :default  => false,
           :type     => :boolean,
-          :desc     => "Whether the application management feature is on or off. You must restart Puppet Server after changing this setting.",
-          :hook     => proc do |value|
-            # Statically loaded resource types differ depending on setting
-            Puppet::Pops::Loaders.clear
-          end
+          :desc       => "This setting has no effect and will be removed in a future Puppet version.",
+          :deprecated => :completely,
       }
   )
 
@@ -720,13 +653,13 @@ deprecated and has been replaced by 'always_retry_plugins'."
         for more details.)
 
         * For best compatibility, you should limit the value of `certname` to
-          only use letters, numbers, periods, underscores, and dashes. (That is,
+          only use lowercase letters, numbers, periods, underscores, and dashes. (That is,
           it should match `/\A[a-z0-9._-]+\Z/`.)
         * The special value `ca` is reserved, and can't be used as the certname
           for a normal node.
 
         Defaults to the node's fully qualified domain name.",
-      :hook => proc { |value| raise(ArgumentError, "Certificate names must be lower case; see #1168") unless value == value.downcase }},
+      :hook => proc { |value| raise(ArgumentError, "Certificate names must be lower case") unless value == value.downcase }},
     :dns_alt_names => {
       :default => '',
       :desc    => <<EOT,
@@ -1077,11 +1010,6 @@ EOT
       :desc       => "The default TTL for new certificates.
       #{AS_DURATION}"
     },
-    :req_bits => {
-      :default    => 4096,
-      :desc       => "This setting has no effect and will be removed in a future Puppet version.",
-      :deprecated => :completely,
-    },
     :keylength => {
       :default    => 4096,
       :desc       => "The bit length of keys.",
@@ -1118,10 +1046,6 @@ EOT
             and monitoring systems to determine if a puppet process is still in
             the process table.",
       },
-      :sourceaddress => {
-        :default    => nil,
-        :desc       => "The address the agent should use to initiate requests.",
-      },
       :bindaddress => {
         :default    => "0.0.0.0",
         :desc       => "The address a listening server should bind to.",
@@ -1270,13 +1194,7 @@ EOT
       :desc       => "File that provides mapping between custom SSL oids and user-friendly names"
     },
     :basemodulepath => {
-      :default => lambda do
-        if Puppet::Util::Platform.windows?
-          '$codedir/modules'
-        else
-          '$codedir/modules:/opt/puppetlabs/puppet/modules'
-        end
-      end,
+      :default => "$codedir/modules#{File::PATH_SEPARATOR}/opt/puppetlabs/puppet/modules",
       :type => :path,
       :desc => "The search path for **global** modules. Should be specified as a
         list of directories separated by the system path separator character. (The
@@ -1378,8 +1296,6 @@ EOT
         :default  => "$vardir/devices",
         :type     => :directory,
         :mode     => "0750",
-        :owner    => "service",
-        :group    => "service",
         :desc     => "The root directory of devices' $vardir.",
     },
     :deviceconfig => {
@@ -1395,7 +1311,7 @@ EOT
         makes to the master. WARNING: This setting is mutually exclusive with
         node_name_fact.  Changing this setting also requires changes to the default
         auth.conf configuration on the Puppet Master.  Please see
-        http://links.puppetlabs.com/node_name_value for more information."
+        http://links.puppet.com/node_name_value for more information."
     },
     :node_name_fact => {
       :default => "",
@@ -1403,7 +1319,7 @@ EOT
         makes to the master. WARNING: This setting is mutually exclusive with
         node_name_value.  Changing this setting also requires changes to the default
         auth.conf configuration on the Puppet Master.  Please see
-        http://links.puppetlabs.com/node_name_fact for more information.",
+        http://links.puppet.com/node_name_fact for more information.",
       :hook => proc do |value|
         if !value.empty? and Puppet[:node_name_value] != Puppet[:certname]
           raise "Cannot specify both the node_name_value and node_name_fact settings"
@@ -1549,13 +1465,6 @@ EOT
           \"never run.\" If you want puppet agent to never run, you should start
           it with the `--no-client` option. #{AS_DURATION}",
     },
-    :runtimeout => {
-      :default  => 0,
-      :type     => :duration,
-      :desc     => "The maximum amount of time an agent run is allowed to take.
-          A Puppet agent run that exceeds this timeout will be aborted.
-          Defaults to 0, which is unlimited. #{AS_DURATION}",
-    },
     :ca_server => {
       :default    => "$server",
       :desc       => "The server to use for certificate
@@ -1567,7 +1476,7 @@ EOT
       :desc       => "The port to use for the certificate authority.",
     },
     :preferred_serialization_format => {
-      :default    => "pson",
+      :default    => "json",
       :desc       => "The preferred means of serializing
       ruby instances for passing over the wire.  This won't guarantee that all
       instances will be serialized using this method, since not all classes
@@ -1745,28 +1654,6 @@ EOT
     }
   )
 
-  define_settings(:inspect,
-    :archive_files => {
-        :type     => :boolean,
-        :default  => false,
-        :desc     => "During an inspect run, whether to archive files whose contents are audited to a file bucket. Note that the `inspect` command is deprecated.",
-        :hook => proc { |value|
-          if Puppet[:strict] != :off
-            Puppet.deprecation_warning(_("Setting 'archive_files' is deprecated. It will be removed in a future release along with the `inspect` command."))
-          end
-        }
-    },
-    :archive_file_server => {
-        :default  => "$server",
-        :desc     => "During an inspect run, the file bucket server to archive files to if archive_files is set. Note that the `inspect` command is deprecated.",
-        :hook => proc { |value|
-          if Puppet[:strict] != :off
-            Puppet.deprecation_warning(_("Setting 'archive_file_server' is deprecated. It will be removed in a future release along with the `inspect` command."))
-          end
-        }
-    }
-  )
-
   # Plugin information.
 
   define_settings(

data/lib/puppet/environments.rb

@@ -297,7 +297,7 @@ module Puppet::Environments
     end
 
     # Returns the end of time (the next Mesoamerican Long Count cycle-end after 2012 (5125+2012) = 7137,
-    # or for a 32 bit machine using Ruby < 1.9.3, the year 2038.
+    # of for a 32 bit machine using Ruby < 1.9.3, the year 2038.
     def self.end_of_time
       begin
         Time.gm(7137)

data/lib/puppet/error.rb

@@ -3,7 +3,7 @@ module Puppet
   class Error < RuntimeError
     attr_accessor :original
     def initialize(message, original=nil)
-      super(message)
+      super(Puppet::Util::CharacterEncoding.scrub(message))
       @original = original
     end
   end

data/lib/puppet/external/nagios/grammar.ry

@@ -52,7 +52,7 @@ require 'strscan'
 class ::Nagios::Parser::SyntaxError < RuntimeError; end
 
 def parse(src)
-  if (RUBY_VERSION < '2.1.0') && src.respond_to?("force_encoding") then
+  if src.respond_to?("force_encoding") then
     src.force_encoding("ASCII-8BIT")
   end
   @ss = StringScanner.new(src)

data/lib/puppet/external/nagios/parser.rb

@@ -14,7 +14,7 @@ require 'strscan'
 class ::Nagios::Parser::SyntaxError < RuntimeError; end
 
 def parse(src)
-  if (RUBY_VERSION < '2.1.0') && src.respond_to?("force_encoding") then
+  if src.respond_to?("force_encoding") then
     src.force_encoding("ASCII-8BIT")
   end
   @ss = StringScanner.new(src)

data/lib/puppet/external/pson/common.rb

@@ -1,5 +1,9 @@
 require 'puppet/external/pson/version'
 
+# PSON is a vendored version of pure_json v1.1.9 plus puppet patches. It
+# is deprecated and should not be used for future work. Use JSON instead.
+#
+# @deprecated
 module PSON
   class << self
     # If _object_ is string-like parse the string and return the parsed result

data/lib/puppet/face/ca.rb

@@ -2,9 +2,9 @@ require 'puppet/face'
 
 Puppet::Face.define(:ca, '0.1.0') do
   copyright "Puppet Inc.", 2011
-  license   "Apache 2 license; see COPYING"
+  license   _("Apache 2 license; see COPYING")
 
-  summary "Local Puppet Certificate Authority management."
+  summary _("Local Puppet Certificate Authority management.")
 
   description <<-TEXT
     This provides local management of the Puppet Certificate Authority.
@@ -14,7 +14,7 @@ Puppet::Face.define(:ca, '0.1.0') do
   TEXT
 
   action :list do
-    summary "List certificates and/or certificate requests."
+    summary _("List certificates and/or certificate requests.")
 
     description <<-TEXT
       This will list the current certificates and certificate signing requests
@@ -23,23 +23,23 @@ Puppet::Face.define(:ca, '0.1.0') do
     TEXT
 
     option "--[no-]all" do
-      summary "Include all certificates and requests."
+      summary _("Include all certificates and requests.")
     end
 
     option "--[no-]pending" do
-      summary "Include pending certificate signing requests."
+      summary _("Include pending certificate signing requests.")
     end
 
     option "--[no-]signed" do
-      summary "Include signed certificates."
+      summary _("Include signed certificates.")
     end
 
-    option "--digest ALGORITHM" do
-      summary "The hash algorithm to use when displaying the fingerprint"
+    option "--digest " + _("ALGORITHM") do
+      summary _("The hash algorithm to use when displaying the fingerprint")
     end
 
-    option "--subject PATTERN" do
-      summary "Only list if the subject matches PATTERN."
+    option "--subject " + _("PATTERN") do
+      summary _("Only list if the subject matches PATTERN.")
 
       description <<-TEXT
         Only include certificates or requests where subject matches PATTERN.
@@ -50,9 +50,11 @@ Puppet::Face.define(:ca, '0.1.0') do
     end
 
     when_invoked do |options|
-      raise "Not a CA" unless Puppet::SSL::CertificateAuthority.ca?
+      #TRANSLATORS "CA" stands for "certificate authority"
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
       unless ca = Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        #TRANSLATORS "CA" stands for "certificate authority"
+        raise _("Unable to fetch the CA")
       end
       Puppet::SSL::Host.ca_location = :only
 
@@ -77,7 +79,7 @@ Puppet::Face.define(:ca, '0.1.0') do
 
     when_rendering :console do |hosts, options|
       unless ca = Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        raise _("Unable to fetch the CA")
       end
 
       length = hosts.map{|x| x.name.length }.max.to_i + 1
@@ -99,11 +101,11 @@ Puppet::Face.define(:ca, '0.1.0') do
   end
 
   action :destroy do
-    summary "Destroy named certificate or pending certificate request."
+    summary _("Destroy named certificate or pending certificate request.")
     when_invoked do |host, options|
-      raise "Not a CA" unless Puppet::SSL::CertificateAuthority.ca?
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
       unless ca = Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        raise _("Unable to fetch the CA")
       end
       Puppet::SSL::Host.ca_location = :local
 
@@ -112,11 +114,11 @@ Puppet::Face.define(:ca, '0.1.0') do
   end
 
   action :revoke do
-    summary "Add certificate to certificate revocation list."
+    summary _("Add certificate to certificate revocation list.")
     when_invoked do |host, options|
-      raise "Not a CA" unless Puppet::SSL::CertificateAuthority.ca?
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
       unless ca = Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        raise _("Unable to fetch the CA")
       end
       Puppet::SSL::Host.ca_location = :only
 
@@ -127,22 +129,22 @@ Puppet::Face.define(:ca, '0.1.0') do
         # destroy action.  The underlying tools could be nicer for that sort
         # of thing; they have fairly inconsistent reporting of failures.
         raise unless e.to_s =~ /Could not find a serial number for /
-        "Nothing was revoked"
+        _("Nothing was revoked")
       end
     end
   end
 
   action :generate do
-    summary "Generate a certificate for a named client."
-    option "--dns-alt-names NAMES" do
-      summary "Additional DNS names to add to the certificate request"
+    summary _("Generate a certificate for a named client.")
+    option "--dns-alt-names " + _("NAMES") do
+      summary _("Additional DNS names to add to the certificate request")
       description Puppet.settings.setting(:dns_alt_names).desc
     end
 
     when_invoked do |host, options|
-      raise "Not a CA" unless Puppet::SSL::CertificateAuthority.ca?
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
       unless ca = Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        raise _("Unable to fetch the CA")
       end
       Puppet::SSL::Host.ca_location = :local
 
@@ -150,13 +152,13 @@ Puppet::Face.define(:ca, '0.1.0') do
         ca.generate(host, :dns_alt_names => options[:dns_alt_names])
       rescue RuntimeError => e
         if e.to_s =~ /already has a requested certificate/
-          "#{host} already has a certificate request; use sign instead"
+          _("%{host} already has a certificate request; use sign instead") % { host: host }
         else
           raise
         end
       rescue ArgumentError => e
         if e.to_s =~ /A Certificate already exists for /
-          "#{host} already has a certificate"
+          _("%{host} already has a certificate") % { host: host }
         else
           raise
         end
@@ -165,15 +167,15 @@ Puppet::Face.define(:ca, '0.1.0') do
   end
 
   action :sign do
-    summary "Sign an outstanding certificate request."
+    summary _("Sign an outstanding certificate request.")
     option("--[no-]allow-dns-alt-names") do
-      summary "Whether or not to accept DNS alt names in the certificate request"
+      summary _("Whether or not to accept DNS alt names in the certificate request")
     end
 
     when_invoked do |host, options|
-      raise "Not a CA" unless Puppet::SSL::CertificateAuthority.ca?
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
       unless ca = Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        raise _("Unable to fetch the CA")
       end
       Puppet::SSL::Host.ca_location = :only
 
@@ -193,11 +195,11 @@ Puppet::Face.define(:ca, '0.1.0') do
   end
 
   action :print do
-    summary "Print the full-text version of a host's certificate."
+    summary _("Print the full-text version of a host's certificate.")
     when_invoked do |host, options|
-      raise "Not a CA" unless Puppet::SSL::CertificateAuthority.ca?
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
       unless ca = Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        raise _("Unable to fetch the CA")
       end
       Puppet::SSL::Host.ca_location = :only
 
@@ -206,15 +208,18 @@ Puppet::Face.define(:ca, '0.1.0') do
   end
 
   action :fingerprint do
-    summary "Print the DIGEST (defaults to the signing algorithm) fingerprint of a host's certificate."
-    option "--digest ALGORITHM" do
-      summary "The hash algorithm to use when displaying the fingerprint"
+    #TRANSLATORS "DIGEST" refers to a hash algorithm
+    summary _("Print the DIGEST (defaults to the signing algorithm) fingerprint of a host's certificate.")
+    option "--digest " + _("ALGORITHM") do
+      summary _("The hash algorithm to use when displaying the fingerprint")
     end
 
     when_invoked do |host, options|
-      raise "Not a CA" unless Puppet::SSL::CertificateAuthority.ca?
+      #TRANSLATORS "CA" stands for "certificate authority"
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
       unless Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        #TRANSLATORS "CA" stands for "certificate authority"
+        raise _("Unable to fetch the CA")
       end
       Puppet::SSL::Host.ca_location = :only
 
@@ -229,9 +234,11 @@ Puppet::Face.define(:ca, '0.1.0') do
   action :verify do
     summary "Verify the named certificate against the local CA certificate."
     when_invoked do |host, options|
-      raise "Not a CA" unless Puppet::SSL::CertificateAuthority.ca?
+      #TRANSLATORS "CA" stands for "certificate authority"
+      raise _("Not a CA") unless Puppet::SSL::CertificateAuthority.ca?
       unless ca = Puppet::SSL::CertificateAuthority.instance
-        raise "Unable to fetch the CA"
+        #TRANSLATORS "CA" stands for "certificate authority"
+        raise _("Unable to fetch the CA")
       end
       Puppet::SSL::Host.ca_location = :only
 
@@ -250,7 +257,7 @@ Puppet::Face.define(:ca, '0.1.0') do
       if value[:valid]
         nil
       else
-        "Could not verify #{value[:host]}: #{value[:error]}"
+        _("Could not verify %{host}: %{error}") % { host: value[:host], error: value[:error] }
       end
     end
   end