puppet 4.10.9 → 4.10.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1c19dcf24ffdd82dc67550cce341c1ab7a7eb101
-  data.tar.gz: 7a0d6ea9246d361cbce8c3a317695bbbd3259a11
+  metadata.gz: c3f34ce4e9d4760a2970bc95c8c1c36ab05ea177
+  data.tar.gz: bfd8fecb20234127dcab39cc295567e8b02670a3
 SHA512:
-  metadata.gz: 2414fbc5362e40b5363ae062036ca6ce77865362e11a85291e8e300f35ce34bbe767a3f170db8cbe93445c3af4d349d0be986eca1232099ba0271df75d9e792b
-  data.tar.gz: e269546a3c53346b599e9d98217cb147b856ae57cd11fedde16cbfe71a93e3db243c53cde6b4f6e4a3ad3354eeb3e4f6cc43b234373a2245210871bbc953d68c
+  metadata.gz: 1a20d44ad5b9b2e4e7ce78ad0c408d93b2784879f535d666fab61dc34eb5f614c975014f558f05033e081a957f37abaadbb60a128fb5912ca6b69be7b724a8a3
+  data.tar.gz: 884979cbd607689c175759362aab573fc1bbc02f0d7bd78f6c3d975eeb93dd883bca614fa476628455b6123860dceb47ddc2039ca8dbb717ecff83e3fd87c15f

data/lib/puppet/agent.rb

@@ -1,6 +1,8 @@
 require 'puppet/application'
 require 'puppet/error'
 
+require 'timeout'
+
 # A general class for triggering a run of another
 # class.
 class Puppet::Agent
@@ -13,6 +15,10 @@ class Puppet::Agent
   require 'puppet/util/splayer'
   include Puppet::Util::Splayer
 
+  # Special exception class used to signal an agent run has timed out.
+  class RunTimeoutError < Exception
+  end
+
   attr_reader :client_class, :client, :should_fork
 
   def initialize(client_class, should_fork=true)
@@ -40,12 +46,26 @@ class Puppet::Agent
       splay client_options.fetch :splay, Puppet[:splay]
       result = run_in_fork(should_fork) do
         with_client(client_options[:transaction_uuid]) do |client|
+          client_args = client_options.merge(:pluginsync => Puppet::Configurer.should_pluginsync?)
           begin
-            client_args = client_options.merge(:pluginsync => Puppet::Configurer.should_pluginsync?)
-            lock { client.run(client_args) }
+            lock do
+              # NOTE: Timeout is pretty heinous as the location in which it
+              # throws an error is entirely unpredictable, which means that
+              # it can interrupt code blocks that perform cleanup or enforce
+              # sanity. The only thing a Puppet agent should do after this
+              # error is thrown is die with as much dignity as possible.
+              Timeout.timeout(Puppet[:runtimeout], RunTimeoutError) do
+                client.run(client_args)
+              end
+            end
           rescue Puppet::LockError
             Puppet.notice "Run of #{client_class} already in progress; skipping  (#{lockfile_path} exists)"
             return
+          rescue RunTimeoutError => detail
+            Puppet.log_exception(detail, _("Execution of %{client_class} did not complete within %{runtimeout} seconds and was terminated.") %
+              {client_class: client_class,
+              runtimeout: Puppet[:runtimeout]})
+            return 1
           rescue StandardError => detail
             Puppet.log_exception(detail, "Could not run #{client_class}: #{detail}")
           end

data/lib/puppet/application.rb

@@ -281,6 +281,23 @@ class Application
       @run_mode = Puppet::Util::RunMode[ mode_name || Puppet.settings.preferred_run_mode ]
     end
 
+    # Sets environment_mode name
+    # @param mode_name [Symbol] The name of the environment mode to run in. May
+    #   be one of :local, :remote, or :not_required. This impacts where the
+    #   application looks for its specified environment. If :not_required or
+    #   :remote are set, the application will not fail if the environment does
+    #   not exist on the local filesystem.
+    def environment_mode(mode_name)
+      raise Puppet::Error, _("Invalid environment mode '%{mode_name}'") % { mode_name: mode_name } unless [:local, :remote, :not_required].include?(mode_name)
+      @environment_mode = mode_name
+    end
+
+    # Gets environment_mode name. If none is set with `environment_mode=`,
+    # default to :local.
+    def get_environment_mode
+      @environment_mode || :local
+    end
+
     # This is for testing only
     def clear_everything_for_tests
       @run_mode = @banner = @run_status = @option_parser_commands = nil
@@ -343,7 +360,7 @@ class Application
       initialize_app_defaults
     end
 
-    Puppet::ApplicationSupport.push_application_context(self.class.run_mode)
+    Puppet::ApplicationSupport.push_application_context(self.class.run_mode, self.class.get_environment_mode)
 
     exit_on_fail("initialize")                                   { preinit }
     exit_on_fail("parse application options")                    { parse_options }

data/lib/puppet/application/agent.rb

@@ -38,6 +38,7 @@ class Puppet::Application::Agent < Puppet::Application
       :digest => 'SHA256',
       :graph => true,
       :fingerprint => false,
+      :sourceaddress => nil,
     }.each do |opt,val|
       options[opt] = val
     end
@@ -59,6 +60,8 @@ class Puppet::Application::Agent < Puppet::Application
   option("--fingerprint")
   option("--digest DIGEST")
 
+  option("--sourceaddress IP_ADDRESS")
+
   option("--detailed-exitcodes") do |arg|
     options[:detailed_exitcodes] = true
   end
@@ -90,8 +93,8 @@ USAGE
 -----
 puppet agent [--certname <NAME>] [-D|--daemonize|--no-daemonize]
   [-d|--debug] [--detailed-exitcodes] [--digest <DIGEST>] [--disable [MESSAGE]] [--enable]
-  [--fingerprint] [-h|--help] [-l|--logdest syslog|eventlog|<FILE>|console]
-  [--masterport <PORT>] [--noop] [-o|--onetime] [-t|--test]
+  [--fingerprint] [-h|--help] [-l|--logdest syslog|eventlog|<ABS FILEPATH>|console]
+  [--masterport <PORT>] [--noop] [-o|--onetime] [--sourceaddress <IP_ADDRESS>] [-t|--test]
   [-v|--verbose] [-V|--version] [-w|--waitforcert <SECONDS>]
 
 
@@ -261,6 +264,10 @@ generated by running puppet agent with '--genconfig'.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
+* --sourceaddress:
+  Set the source IP address for transactions. This defaults to automatically selected.
+  (This is a Puppet setting, and can go in puppet.conf.)
+
 * --test:
   Enable the most common options used for testing. These are 'onetime',
   'verbose', 'no-daemonize', 'no-usecacheonfailure', 'detailed-exitcodes',

data/lib/puppet/application/apply.rb

@@ -46,7 +46,7 @@ USAGE
 -----
 puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
   [-e|--execute] [--detailed-exitcodes] [-L|--loadclasses]
-  [-l|--logdest syslog|eventlog|<FILE>|console] [--noop]
+  [-l|--logdest syslog|eventlog|<ABS FILEPATH>|console] [--noop]
   [--catalog <catalog>] [--write-catalog-summary] <file>
 
 

data/lib/puppet/application/config.rb

@@ -1,4 +1,5 @@
 require 'puppet/application/face_base'
 
 class Puppet::Application::Config < Puppet::Application::FaceBase
+  environment_mode :not_required
 end

data/lib/puppet/application/device.rb

@@ -138,8 +138,7 @@ you can specify '--server <servername>' as an argument.
   valid JSON.
 
 * --user:
-  The user to run as. '--user=root' is required, even when run as root,
-  for runs that create device certificates or keys.
+  The user to run as.
 
 * --verbose:
   Turn on verbose reporting.

data/lib/puppet/application/filebucket.rb

@@ -107,38 +107,55 @@ configuration options can also be generated by running puppet with
 * --version:
   Print version information.
 
-
-EXAMPLE
--------
+EXAMPLES
+--------
+    ## Backup a file to the filebucket, then restore it to a temporary directory
     $ puppet filebucket backup /etc/passwd
     /etc/passwd: 429b225650b912a2ee067b0a4cf1e949
     $ puppet filebucket restore /tmp/passwd 429b225650b912a2ee067b0a4cf1e949
+
     ## Diff between two files in the filebucket
     $ puppet filebucket -l diff d43a6ecaa892a1962398ac9170ea9bf2 7ae322f5791217e031dc60188f4521ef
     1a2
     > again
-    ## Diff between the file in the filebucket and the current one
+
+    ## Diff between the file in the filebucket and a local file
     $ puppet filebucket -l diff d43a6ecaa892a1962398ac9170ea9bf2 /tmp/testFile
     1a2
     > again
+
+    ## Backup a file to the filebucket and observe that it keeps each backup separate
     $ puppet filebucket -l list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+
     $ echo again >> /tmp/TestFile
+
     $ puppet filebucket -l backup /tmp/TestFile
     /tmp/TestFile: 7ae322f5791217e031dc60188f4521ef
-    $ puppet filebucket -l  list
+
+    $ puppet filebucket -l list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
     7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+
+    ## List files in a filebucket within date ranges
     $ puppet filebucket -l -f 2015-01-01 -t 2015-01-11 list
     <Empty Output>
+
     $ puppet filebucket -l -f 2015-05-10 list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
     7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+
     $ puppet filebucket -l -f "2015-05-11 09:30:00" list
     7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+
     $ puppet filebucket -l -t "2015-05-11 09:30:00" list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
 
+    ## From a Puppet master, list files in the master bucketdir
+    $ puppet filebucket -b $(puppet config print bucketdir --section master) list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+
 AUTHOR
 ------
 Luke Kanies

data/lib/puppet/application/help.rb

@@ -1,4 +1,5 @@
 require 'puppet/application/face_base'
 
 class Puppet::Application::Help < Puppet::Application::FaceBase
+  environment_mode :not_required
 end

data/lib/puppet/application/inspect.rb

@@ -170,6 +170,8 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
       finishtime = Time.now
       @report.add_times("inspect", finishtime - inspect_starttime)
+
+      @report.transaction_completed = true
       @report.finalize_report
 
       begin

data/lib/puppet/application/lookup.rb

@@ -323,7 +323,6 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
     fact_file = options[:fact_file]
 
     if fact_file
-      original_facts = node.parameters
       if fact_file.end_with?("json")
         given_facts = JSON.parse(Puppet::FileSystem.read(fact_file, :encoding => 'utf-8'))
       else
@@ -333,8 +332,7 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
       unless given_facts.instance_of?(Hash)
         raise "Incorrect formatted data in #{fact_file} given via the --facts flag"
       end
-
-      node.parameters = original_facts.merge(given_facts)
+      node.add_extra_facts(given_facts)
     end
 
     Puppet[:code] = 'undef' unless options[:compile]

data/lib/puppet/application_support.rb

@@ -14,9 +14,11 @@ module Puppet
     # before being set in a pushed Puppet Context.
     #
     # @param run_mode [Puppet::Util::RunMode] Puppet's current Run Mode.
+    # @param environment_mode [Symbol] optional, Puppet's
+    #   current Environment Mode. Defaults to :local
     # @return [void]
     # @api private
-    def self.push_application_context(run_mode)
+    def self.push_application_context(run_mode, environment_mode = :local)
       Puppet.push_context(Puppet.base_context(Puppet.settings), "Update for application settings (#{run_mode})")
       # This use of configured environment is correct, this is used to establish
       # the defaults for an application that does not override, or where an override
@@ -25,6 +27,9 @@ module Puppet
       configured_environment_name = Puppet[:environment]
       if run_mode.name == :agent
         configured_environment = Puppet::Node::Environment.remote(configured_environment_name)
+      elsif environment_mode == :not_required
+        configured_environment =
+          Puppet.lookup(:environments).get(configured_environment_name) || Puppet::Node::Environment.remote(configured_environment_name)
       else
         configured_environment = Puppet.lookup(:environments).get!(configured_environment_name)
       end

data/lib/puppet/defaults.rb

@@ -296,10 +296,26 @@ module Puppet
     },
     :environment => {
         :default  => "production",
-        :desc     => "The environment Puppet is running in.  For clients
-          (e.g., `puppet agent`) this determines the environment itself, which
-          is used to find modules and much more.  For servers (i.e., `puppet master`)
-          this provides the default environment for nodes we know nothing about."
+        :desc     => "The environment in which Puppet is running. For clients,
+          such as `puppet agent`, this determines the environment itself, which
+          Puppet uses to find modules and much more. For servers, such as `puppet master`,
+          this provides the default environment for nodes that Puppet knows nothing about.
+
+          When defining an environment in the `[agent]` section, this refers to the
+          environment that the agent requests from the master. The environment doesn't
+          have to exist on the local filesystem because the agent fetches it from the
+          master. This definition is used when running `puppet agent`.
+
+          When defined in the `[user]` section, the environment refers to the path that
+          Puppet uses to search for code and modules related to its execution. This
+          requires the environment to exist locally on the filesystem where puppet is
+          being executed. Puppet subcommands, including `puppet module` and
+          `puppet apply`, use this definition.
+
+          Given that the context and effects vary depending on the
+          [config section](https://puppet.com/docs/puppet/latest/config_file_main.html#config-sections)
+          in which the `environment` setting is defined, do not set it globally.",
+        :short    => "E"
     },
     :environmentpath => {
       :default => "$codedir/environments",
@@ -1102,6 +1118,10 @@ EOT
             and monitoring systems to determine if a puppet process is still in
             the process table.",
       },
+      :sourceaddress => {
+        :default    => nil,
+        :desc       => "The address the agent should use to initiate requests.",
+      },
       :bindaddress => {
         :default    => "0.0.0.0",
         :desc       => "The address a listening server should bind to.",
@@ -1352,6 +1372,8 @@ EOT
         :default  => "$vardir/devices",
         :type     => :directory,
         :mode     => "0750",
+        :owner    => "service",
+        :group    => "service",
         :desc     => "The root directory of devices' $vardir.",
     },
     :deviceconfig => {
@@ -1521,6 +1543,13 @@ EOT
           \"never run.\" If you want puppet agent to never run, you should start
           it with the `--no-client` option. #{AS_DURATION}",
     },
+    :runtimeout => {
+      :default  => 0,
+      :type     => :duration,
+      :desc     => "The maximum amount of time an agent run is allowed to take.
+          A Puppet agent run that exceeds this timeout will be aborted.
+          Defaults to 0, which is unlimited. #{AS_DURATION}",
+    },
     :ca_server => {
       :default    => "$server",
       :desc       => "The server to use for certificate

data/lib/puppet/face/config.rb

@@ -106,6 +106,19 @@ Puppet::Face.define(:config, '0.0.1') do
     EOT
 
     when_invoked do |name, value, options|
+      if name == 'environment' && options[:section] == 'main'
+        Puppet.warning _(<<-EOM).chomp
+The environment should be set in either the `[user]`, `[agent]`, or `[master]`
+section. Variables set in the `[agent]` section are used when running
+`puppet agent`. Variables set in the `[user]` section are used when running
+various other puppet subcommands, like `puppet apply` and `puppet module`; these
+require the defined environment directory to exist locally. Set the config
+section by using the `--section` flag. For example,
+`puppet config --section user set environment foo`. For more information, see
+https://puppet.com/docs/puppet/latest/configuration.html#environment
+        EOM
+      end
+
       path = Puppet::FileSystem.pathname(Puppet.settings.which_configuration_file)
       Puppet::FileSystem.touch(path)
       Puppet::FileSystem.open(path, nil, 'r+:UTF-8') do |file|

data/lib/puppet/functions/each.rb

@@ -117,8 +117,11 @@ Puppet::Functions.create_function(:each) do
 
   def foreach_Hash_1(hash)
     enumerator = hash.each_pair
-    hash.size.times do
-      yield(enumerator.next)
+    begin
+      hash.size.times do
+        yield(enumerator.next)
+      end
+    rescue StopIteration
     end
     # produces the receiver
     hash
@@ -126,8 +129,11 @@ Puppet::Functions.create_function(:each) do
 
   def foreach_Hash_2(hash)
     enumerator = hash.each_pair
-    hash.size.times do
-      yield(*enumerator.next)
+    begin
+      hash.size.times do
+        yield(*enumerator.next)
+      end
+    rescue StopIteration
     end
     # produces the receiver
     hash

data/lib/puppet/functions/lookup.rb

@@ -91,8 +91,8 @@
 # merged hash. If the same key exists in multiple source hashes, Puppet will
 # recursively merge hash or array values (with duplicate values removed from
 # arrays). For conflicting scalar values, the highest-priority value will win.
-# * `{'strategy' => 'first|unique|hash'}` --- Same as the string versions of these
-# merge behaviors.
+# * `{'strategy' => 'first'}`, `{'strategy' => 'unique'}`,
+# or `{'strategy' => 'hash'}` --- Same as the string versions of these merge behaviors.
 # * `{'strategy' => 'deep', <DEEP OPTION> => <VALUE>, ...}` --- Same as `'deep'`,
 # but can adjust the merge with additional options. The available options are:
 #     * `'knockout_prefix'` (string or undef) --- A string prefix to indicate a

data/lib/puppet/functions/map.rb

@@ -88,11 +88,21 @@ Puppet::Functions.create_function(:map) do
   end
 
   def map_Hash_1(hash)
-    hash.map {|x, y| yield([x, y]) }
+    result = []
+    begin
+      hash.map {|x, y| result << yield([x, y]) }
+    rescue StopIteration
+    end
+    result
   end
 
   def map_Hash_2(hash)
-    hash.map {|x, y| yield(x, y) }
+    result = []
+    begin
+      hash.map {|x, y| result << yield(x, y) }
+    rescue StopIteration
+    end
+    result
   end
 
   def map_Enumerable_1(enumerable)

data/lib/puppet/functions/reduce.rb

@@ -94,6 +94,37 @@
 # # $combine contains [dabc, 10]
 # ~~~
 #
+# @example Using the `reduce` function to reduce a hash of hashes
+#
+# ~~~ puppet
+# # Reduce a hash of hashes $data, merging defaults into the inner hashes.
+# $data = {
+#   'connection1' => {
+#     'username' => 'user1',
+#     'password' => 'pass1',
+#   },
+#   'connection_name2' => {
+#     'username' => 'user2',
+#     'password' => 'pass2',
+#   },
+# }
+#
+# $defaults = {
+#   'maxActive' => '20',
+#   'maxWait'   => '10000',
+#   'username'  => 'defaultuser',
+#   'password'  => 'defaultpass',
+# }
+#
+# $merged = $data.reduce( {} ) |$memo, $x| {
+#   $memo + { $x[0] => $defaults + $data[$x[0]] }
+# }
+# # At the start of the lambda's first iteration, $memo is set to {}, and $x is set to
+# # the first [key, value] tuple. The key in $data is, therefore, given by $x[0]. In
+# # subsequent rounds, $memo retains the value returned by the expression, i.e.
+# # $memo + { $x[0] => $defaults + $data[$x[0]] }.
+# ~~~
+#
 # @since 4.0.0
 #
 Puppet::Functions.create_function(:reduce) do
@@ -111,11 +142,23 @@ Puppet::Functions.create_function(:reduce) do
 
   def reduce_without_memo(enumerable)
     enum = Puppet::Pops::Types::Iterable.asserted_iterable(self, enumerable)
-    enum.reduce {|memo, x| yield(memo, x) }
+    enum.reduce do |memo, x|
+      begin
+        yield(memo, x)
+      rescue StopIteration
+        return memo
+      end
+    end
   end
 
   def reduce_with_memo(enumerable, given_memo)
     enum = Puppet::Pops::Types::Iterable.asserted_iterable(self, enumerable)
-    enum.reduce(given_memo) {|memo, x| yield(memo, x) }
+    enum.reduce(given_memo) do |memo, x|
+      begin
+        yield(memo, x)
+      rescue StopIteration
+        return memo
+      end
+    end
   end
 end