puppet 4.2.0 → 4.3.0

data/install.rb

@@ -33,13 +33,6 @@ require 'rbconfig'
 require 'find'
 require 'fileutils'
 require 'tempfile'
-begin
-  require 'ftools' # apparently on some system ftools doesn't get loaded
-  $haveftools = true
-rescue LoadError
-  puts "ftools not found.  Using FileUtils instead.."
-  $haveftools = false
-end
 require 'optparse'
 require 'ostruct'
 
@@ -67,21 +60,13 @@ def do_configs(configs, target, strip = 'conf/')
   Dir.mkdir(target) unless File.directory? target
   configs.each do |cf|
     ocf = File.join(InstallOptions.config_dir, cf.gsub(/#{strip}/, ''))
-    if $haveftools
-      File.install(cf, ocf, 0644, true)
-    else
-      FileUtils.install(cf, ocf, {:mode => 0644, :preserve => true, :verbose => true})
-    end
+    FileUtils.install(cf, ocf, {:mode => 0644, :preserve => true, :verbose => true})
   end
 
   if $operatingsystem == 'windows'
     src_dll = 'ext/windows/eventlog/puppetres.dll'
     dst_dll = File.join(InstallOptions.bin_dir, 'puppetres.dll')
-    if $haveftools
-      File.install(src_dll, dst_dll, 0644, true)
-    else
-      FileUtils.install(src_dll, dst_dll, {:mode => 0644, :preserve => true, :verbose => true})
-    end
+    FileUtils.install(src_dll, dst_dll, {:mode => 0644, :preserve => true, :verbose => true})
 
     require 'win32/registry'
     include Win32::Registry::Constants
@@ -110,15 +95,9 @@ def do_libs(libs, strip = 'lib/')
     next if File.directory? lf
     olf = File.join(InstallOptions.site_dir, lf.sub(/^#{strip}/, ''))
     op = File.dirname(olf)
-    if $haveftools
-      File.makedirs(op, true)
-      File.chmod(0755, op)
-      File.install(lf, olf, 0644, true)
-    else
-      FileUtils.makedirs(op, {:mode => 0755, :verbose => true})
-      FileUtils.chmod(0755, op)
-      FileUtils.install(lf, olf, {:mode => 0644, :preserve => true, :verbose => true})
-    end
+    FileUtils.makedirs(op, {:mode => 0755, :verbose => true})
+    FileUtils.chmod(0755, op)
+    FileUtils.install(lf, olf, {:mode => 0644, :preserve => true, :verbose => true})
   end
 end
 
@@ -126,15 +105,9 @@ def do_man(man, strip = 'man/')
   man.each do |mf|
     omf = File.join(InstallOptions.man_dir, mf.gsub(/#{strip}/, ''))
     om = File.dirname(omf)
-    if $haveftools
-      File.makedirs(om, true)
-      File.chmod(0755, om)
-      File.install(mf, omf, 0644, true)
-    else
-      FileUtils.makedirs(om, {:mode => 0755, :verbose => true})
-      FileUtils.chmod(0755, om)
-      FileUtils.install(mf, omf, {:mode => 0644, :preserve => true, :verbose => true})
-    end
+    FileUtils.makedirs(om, {:mode => 0755, :verbose => true})
+    FileUtils.chmod(0755, om)
+    FileUtils.install(mf, omf, {:mode => 0644, :preserve => true, :verbose => true})
     gzip = %x{which gzip}
     gzip.chomp!
     %x{#{gzip} -f #{omf}}
@@ -166,14 +139,13 @@ end
 # Prepare the file installation.
 #
 def prepare_installation
-  $operatingsystem = Facter.value :operatingsystem
-
   InstallOptions.configs = true
+  InstallOptions.check_prereqs = true
 
   # Only try to do docs if we're sure they have rdoc
   if $haverdoc
     InstallOptions.rdoc  = true
-    InstallOptions.ri  = $operatingsystem != "windows"
+    InstallOptions.ri  = true
   else
     InstallOptions.rdoc  = false
     InstallOptions.ri  = false
@@ -226,6 +198,9 @@ def prepare_installation
     opts.on('--mandir[=OPTIONAL]', 'Installation directory for man pages', 'overrides RbConfig::CONFIG["mandir"]') do |mandir|
       InstallOptions.mandir = mandir
     end
+    opts.on('--[no-]check-prereqs', 'Prevents validation of prerequisite libraries', 'Default on') do |prereq|
+      InstallOptions.check_prereqs = prereq
+    end
     opts.on('--quick', 'Performs a quick installation. Only the', 'installation is done.') do |quick|
       InstallOptions.rdoc    = false
       InstallOptions.ri      = false
@@ -256,6 +231,13 @@ def prepare_installation
     RbConfig::CONFIG['bindir'] = "/usr/bin"
   end
 
+  # Here we only set $operatingsystem if we have opted to check for prereqs.
+  # Otherwise facter won't be guaranteed to be present.
+  if InstallOptions.check_prereqs
+    check_prereqs
+    $operatingsystem = Facter.value :operatingsystem
+  end
+
   if not InstallOptions.configdir.nil?
     configdir = InstallOptions.configdir
   elsif $operatingsystem == "windows"
@@ -395,6 +377,7 @@ end
 
 def build_ri(files)
   return unless $haverdoc
+  return if $operatingsystem == "windows"
   begin
     ri = RDoc::RDoc.new
     #ri.document(["--ri-site", "--merge"] + files)
@@ -473,7 +456,6 @@ FileUtils.cd File.dirname(__FILE__) do
   man   = glob(%w{man/man[0-9]/*})
   libs  = glob(%w{lib/**/*})
 
-  check_prereqs
   prepare_installation
 
   #build_rdoc(rdoc) if InstallOptions.rdoc

data/lib/hiera/puppet_function.rb

@@ -43,13 +43,13 @@ class Hiera::PuppetFunction < Puppet::Functions::InternalFunction
   end
 
   def hiera_no_default(scope, key)
-    post_lookup(key, lookup(scope, key, nil, nil))
+    post_lookup(scope, key, lookup(scope, key, nil, nil))
   end
 
   def hiera_with_default(scope, key, default, override = nil)
     undefined = (@@undefined_value ||= Object.new)
     result = lookup(scope, key, undefined, override)
-    post_lookup(key, result.equal?(undefined) ? default : result)
+    post_lookup(scope, key, result.equal?(undefined) ? default : result)
   end
 
   def hiera_block1(scope, key, &default_block)
@@ -63,20 +63,20 @@ class Hiera::PuppetFunction < Puppet::Functions::InternalFunction
   def common(scope, key, override, default_block)
     undefined = (@@undefined_value ||= Object.new)
     result = lookup(scope, key, undefined, override)
-    post_lookup(key, result.equal?(undefined) ? default_block.call(key) : result)
+    post_lookup(scope, key, result.equal?(undefined) ? default_block.call(key) : result)
   end
 
   private :common
 
   def lookup(scope, key, default, override)
-    HieraPuppet.lookup(key, default,scope, override, merge_type)
+    HieraPuppet.lookup(key, default, scope, override, merge_type)
   end
 
   def merge_type
     :priority
   end
 
-  def post_lookup(key, result)
+  def post_lookup(scope, key, result)
     result
   end
 end

data/lib/puppet/agent/locker.rb

@@ -1,4 +1,5 @@
 require 'puppet/util/pidlock'
+require 'puppet/error'
 
 # This module is responsible for encapsulating the logic for "locking" the
 # puppet agent during a catalog run; in other words, keeping track of enough
@@ -12,8 +13,8 @@ require 'puppet/util/pidlock'
 # For more information, please see docs on the website.
 #  http://links.puppetlabs.com/agent_lockfiles
 module Puppet::Agent::Locker
-  # Yield if we get a lock, else do nothing.  Return
-  # true/false depending on whether we get the lock.
+  # Yield if we get a lock, else raise Puppet::LockError. Return
+  # value of block yielded.
   def lock
     if lockfile.lock
       begin
@@ -21,10 +22,18 @@ module Puppet::Agent::Locker
       ensure
         lockfile.unlock
       end
+    else
+      fail Puppet::LockError, 'Failed to aquire lock'
     end
   end
 
+  # @deprecated
   def running?
+    Puppet.deprecation_warning <<-ENDHEREDOC
+Puppet::Agent::Locker.running? is deprecated as it is inherently unsafe.
+The only safe way to know if the lock is locked is to try lock and perform some
+action and then handle the LockError that may result.
+ENDHEREDOC
     lockfile.locked?
   end
 

data/lib/puppet/agent.rb

@@ -1,4 +1,5 @@
 require 'puppet/application'
+require 'puppet/error'
 
 # A general class for triggering a run of another
 # class.
@@ -29,10 +30,6 @@ class Puppet::Agent
 
   # Perform a run with our client.
   def run(client_options = {})
-    if running?
-      Puppet.notice "Run of #{client_class} already in progress; skipping  (#{lockfile_path} exists)"
-      return
-    end
     if disabled?
       Puppet.notice "Skipping run of #{client_class}; administratively disabled (Reason: '#{disable_message}');\nUse 'puppet agent --enable' to re-enable."
       return
@@ -46,6 +43,9 @@ class Puppet::Agent
           begin
             client_args = client_options.merge(:pluginsync => Puppet[:pluginsync])
             lock { client.run(client_args) }
+          rescue Puppet::LockError
+            Puppet.notice "Run of #{client_class} already in progress; skipping  (#{lockfile_path} exists)"
+            return
           rescue StandardError => detail
             Puppet.log_exception(detail, "Could not run #{client_class}: #{detail}")
           end

data/lib/puppet/application/agent.rb

@@ -118,14 +118,14 @@ go into the background, attempt to get a signed certificate, and retrieve
 and apply its configuration every 30 minutes.
 
 Some flags are meant specifically for interactive use -- in particular,
-'test', 'tags' or 'fingerprint' are useful. 'test' enables verbose
-logging, causes the daemon to stay in the foreground, exits if the
-server's configuration is invalid (this happens if, for instance, you've
-left a syntax error on the server), and exits after running the
-configuration once (rather than hanging around as a long-running
-process).
-
-'tags' allows you to specify what portions of a configuration you want
+'test', 'tags' and 'fingerprint' are useful.
+
+'--test' does a single run in the foreground with verbose logging, then exits.
+It will also exit if it can't get a valid catalog. The exit code after running
+with '--test' is 0 if the catalog was successfully applied, and 1 if the run
+either failed or wasn't attempted (due to another run already in progress).
+
+'--tags' allows you to specify what portions of a configuration you want
 to apply. Puppet elements are tagged with all of the class or definition
 names that contain them, and you can use the 'tags' flag to specify one
 of these names, causing only configuration elements contained within
@@ -136,7 +136,7 @@ class, and call puppet with '--tags ntpd', which would only apply that
 small portion of the configuration during your testing, rather than
 applying the whole thing.
 
-'fingerprint' is a one-time flag. In this mode 'puppet agent' will run
+'--fingerprint' is a one-time flag. In this mode 'puppet agent' will run
 once and display on the console (and in the log) the current certificate
 (or certificate request) fingerprint. Providing the '--digest' option
 allows to use a different digest algorithm to generate the fingerprint.
@@ -181,10 +181,20 @@ generated by running puppet agent with '--genconfig'.
   Enable full debugging.
 
 * --detailed-exitcodes:
-  Provide transaction information via exit codes. If this is enabled, an exit
-  code of '2' means there were changes, an exit code of '4' means there were
-  failures during the transaction, and an exit code of '6' means there were both
-  changes and failures.
+  Provide extra information about the run via exit codes; only works if '--test'
+  or '--onetime' is also specified. If enabled, 'puppet agent' will use the
+  following exit codes:
+
+  0: The run succeeded with no changes or failures; the system was already in
+  the desired state.
+
+  1: The run failed, or wasn't attempted due to another run already in progress.
+
+  2: The run succeeded, and some resources were changed.
+
+  4: The run succeeded, and some resources failed.
+
+  6: The run succeeded, and included both changes and failures.
 
 * --digest:
   Change the certificate fingerprinting digest algorithm. The default is
@@ -312,6 +322,9 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
       # waiting for certificates so that we don't block
       daemon = daemonize_process_when(Puppet[:daemonize])
 
+      # Setup signal traps immediately after daemonization so we clean up the daemon
+      daemon.set_signal_traps
+
       wait_for_certificates
 
       if Puppet[:onetime]
@@ -336,7 +349,6 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
   end
 
   def onetime(daemon)
-    daemon.set_signal_traps
     begin
       exitstatus = daemon.agent.run
     rescue => detail
@@ -372,6 +384,8 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
   end
 
   def setup
+    raise ArgumentError, "The puppet agent command does not take parameters" unless command_line.args.empty?
+
     setup_test if options[:test]
 
     setup_logs

data/lib/puppet/application/apply.rb

@@ -83,10 +83,19 @@ configuration options can also be generated by running puppet with
   Enable full debugging.
 
 * --detailed-exitcodes:
-  Provide transaction information via exit codes. If this is enabled, an exit
-  code of '2' means there were changes, an exit code of '4' means there were
-  failures during the transaction, and an exit code of '6' means there were both
-  changes and failures.
+  Provide extra information about the run via exit codes. If enabled, 'puppet
+  apply' will use the following exit codes:
+
+  0: The run succeeded with no changes or failures; the system was already in
+  the desired state.
+
+  1: The run failed.
+
+  2: The run succeeded, and some resources were changed.
+
+  4: The run succeeded, and some resources failed.
+
+  6: The run succeeded, and included both changes and failures.
 
 * --help:
   Print this help message
@@ -306,6 +315,10 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
     Puppet.settings.use :main, :agent, :ssl
 
+    if Puppet[:catalog_cache_terminus]
+      Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus]
+    end
+
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 

data/lib/puppet/application/cert.rb

@@ -110,6 +110,8 @@ ACTIONS
 Every action except 'list' and 'generate' requires a hostname to act on,
 unless the '--all' option is set.
 
+The most important actions for day-to-day use are 'list' and 'sign'.
+
 * clean:
   Revoke a host's certificate (if applicable) and remove all files
   related to that host from puppet cert's storage. This is useful when
@@ -171,6 +173,20 @@ configuration options can also be generated by running puppet cert with
   Operate on all items. Currently only makes sense with the 'sign',
   'list', and 'fingerprint' actions.
 
+* --allow-dns-alt-names:
+  Sign a certificate request even if it contains one or more alternate DNS
+  names. If this option isn't specified, 'puppet cert sign' will ignore any
+  requests that contain alternate names.
+
+  In general, ONLY certs intended for a Puppet master server should include
+  alternate DNS names, since Puppet agent relies on those names for identifying
+  its rightful server.
+
+  You can make Puppet agent request a certificate with alternate names by
+  setting 'dns_alt_names' in puppet.conf or specifying '--dns_alt_names' on the
+  command line. The output of 'puppet cert list' shows any requested alt names
+  for pending certificate requests.
+
 * --digest:
   Set the digest for fingerprinting (defaults to the digest used when
   signing the cert). Valid values depends on your openssl and openssl ruby

data/lib/puppet/application/filebucket.rb

@@ -4,6 +4,8 @@ class Puppet::Application::Filebucket < Puppet::Application
 
   option("--bucket BUCKET","-b")
   option("--debug","-d")
+  option("--fromdate FROMDATE","-f")
+  option("--todate TODATE","-t")
   option("--local","-l")
   option("--remote","-r")
   option("--verbose","-v")
@@ -25,7 +27,8 @@ USAGE
 -----
 puppet filebucket <mode> [-h|--help] [-V|--version] [-d|--debug]
   [-v|--verbose] [-l|--local] [-r|--remote] [-s|--server <server>]
-  [-b|--bucket <directory>] <file> <file> ...
+  [-f|--fromdate <date>] [-t|--todate <date>] [-b|--bucket <directory>]
+  <file> <file> ...
 
 Puppet filebucket can operate in three modes, with only one mode per call:
 
@@ -43,6 +46,13 @@ restore:
   path to this argument; you are not restricted to restoring the content
   to its original location.
 
+diff:
+  Print a diff in unified format between two checksums in the filebucket
+  or between a checksum and its matching file.
+
+list:
+  List all files in the current local filebucket. Listing remote
+  filebuckets is not allowed.
 
 DESCRIPTION
 -----------
@@ -71,6 +81,9 @@ configuration options can also be generated by running puppet with
 * --debug:
   Enable full debugging.
 
+* --fromdate:
+  (list only) Select bucket files from 'fromdate'
+
 * --help:
   Print this help message
 
@@ -85,6 +98,9 @@ configuration options can also be generated by running puppet with
 * --server:
   The server to send the file to, instead of locally.
 
+* --todate:
+  (list only) Select bucket files until 'todate'
+
 * --verbose:
   Print extra information.
 
@@ -97,7 +113,31 @@ EXAMPLE
     $ puppet filebucket backup /etc/passwd
     /etc/passwd: 429b225650b912a2ee067b0a4cf1e949
     $ puppet filebucket restore /tmp/passwd 429b225650b912a2ee067b0a4cf1e949
-
+    ## Diff between two files in the filebucket
+    $ puppet filebucket -l diff d43a6ecaa892a1962398ac9170ea9bf2 7ae322f5791217e031dc60188f4521ef
+    1a2
+    > again
+    ## Diff between the file in the filebucket and the current one
+    $ puppet filebucket -l diff d43a6ecaa892a1962398ac9170ea9bf2 /tmp/testFile
+    1a2
+    > again
+    $ puppet filebucket -l list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    $ echo again >> /tmp/TestFile
+    $ puppet filebucket -l backup /tmp/TestFile
+    /tmp/TestFile: 7ae322f5791217e031dc60188f4521ef
+    $ puppet filebucket -l  list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+    $ puppet filebucket -l -f 2015-01-01 -t 2015-01-11 list
+    <Empty Output>
+    $ puppet filebucket -l -f 2015-05-10 list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+    $ puppet filebucket -l -f "2015-05-11 09:30:00" list
+    7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+    $ puppet filebucket -l -t "2015-05-11 09:30:00" list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
 
 AUTHOR
 ------
@@ -115,7 +155,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
   def run_command
     @args = command_line.args
     command = args.shift
-    return send(command) if %w{get backup restore}.include? command
+    return send(command) if %w{get backup restore diff list}.include? command
     help
   end
 
@@ -142,12 +182,47 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     end
   end
 
+  def list
+    fromdate = options[:fromdate]
+    todate = options[:todate]
+    out = @client.list(fromdate, todate)
+    print out
+  end
+
   def restore
     file = args.shift
     md5 = args.shift
     @client.restore(file, md5)
   end
 
+  def diff
+    raise Puppet::Error, "Need exactly two arguments: filebucket diff <file_a> <file_b>" unless args.count == 2
+    left = args.shift
+    right = args.shift
+    if Puppet::FileSystem.exist?(left)
+      # It's a file
+      file_a = left
+      checksum_a = nil
+    else
+      file_a = nil
+      checksum_a = left
+    end
+    if Puppet::FileSystem.exist?(right)
+      # It's a file
+      file_b = right
+      checksum_b = nil
+    else
+      file_b = nil
+      checksum_b = right
+    end
+    if (checksum_a || file_a) && (checksum_b || file_b)
+      Puppet.info("Comparing #{checksum_a} #{checksum_b} #{file_a} #{file_b}")
+      print @client.diff(checksum_a, checksum_b, file_a, file_b)
+    else
+      raise Puppet::Error, "Need exactly two arguments: filebucket diff <file_a> <file_b>"
+    end
+  end
+
   def setup
     Puppet::Log.newdestination(:console)
 
@@ -181,4 +256,3 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     end
   end
 end
-