puppet 4.4.0 → 4.5.0

data/lib/puppet/defaults.rb

@@ -115,12 +115,36 @@ module Puppet
         * `undefined_variables` --- disables warnings about non existing variables.",
       :hook      => proc do |value|
         values = munge(value)
-        valid   = %w[deprecations undefined_variables]
+        valid   = %w[deprecations undefined_variables undefined_resources]
         invalid = values - (values & valid)
         if not invalid.empty?
           raise ArgumentError, "Cannot disable unrecognized warning types #{invalid.inspect}. Valid values are #{valid.inspect}."
         end
       end
+    },
+    :strict => {
+      :default    => :warning,
+      :type       => :symbolic_enum,
+      :values     => [:off, :warning, :error],
+      :desc       => "The strictness level of puppet. Allowed values are:
+
+        * off     - do not perform extra validation, do not report
+        * warning - perform extra validation, report as warning (default)
+        * error   - perform extra validation, fail with error
+
+        The strictness level is for both language semantics and runtime
+        evaluation validation. In addition to controlling the behavior with
+        this master switch some individual warnings may also be controlled
+        by the disable_warnings setting.
+
+        No new validations will be added to a micro (x.y.z) release,
+        but may be added in minor releases (x.y.0). In major releases
+        it expected that most (if not all) strictness validation become
+        standard behavior.",
+      :hook    => proc do |value|
+        munge(value)
+        value.to_sym
+      end
     }
   )
 
@@ -290,7 +314,13 @@ module Puppet
     :always_cache_features => {
       :type     => :boolean,
       :default  => false,
+      :hook     => proc { |value|
+        Puppet.deprecation_warning "Setting 'always_cache_features' is
+deprecated and has been replaced by 'always_retry_plugins'."
+      },
       :desc     => <<-'EOT'
+        This setting is deprecated and has been replaced by always_retry_plugins.
+
         Affects how we cache attempts to load Puppet 'features'.  If false, then
         calls to `Puppet.features.<feature>?` will always attempt to load the
         feature (which can be an expensive operation) unless it has already been
@@ -306,6 +336,27 @@ module Puppet
         improvement for features that are checked frequently.
       EOT
     },
+    :always_retry_plugins => {
+        :type     => :boolean,
+        :default  => true,
+        :desc     => <<-'EOT'
+        Affects how we cache attempts to load Puppet resource types and features.  If
+        true, then calls to `Puppet.type.<type>?` `Puppet.feature.<feature>?`
+        will always attempt to load the type or feature (which can be an
+        expensive operation) unless it has already been loaded successfully.
+        This makes it possible for a single agent run to, e.g., install a
+        package that provides the underlying capabilities for a type or feature,
+        and then later load that type or feature during the same run (even if
+        the type or feature had been tested earlier and had not been available).
+
+        If this setting is set to false, then types and features will only be
+        checked once, and if they are not available, the negative result is
+        cached and returned for all subsequent attempts to load the type or
+        feature.  This behavior is almost always appropriate for the server,
+        and can result in a significant performance improvement for types and
+        features that are checked frequently.
+      EOT
+    },
     :diff_args => {
         :default  => lambda { default_diffargs },
         :desc     => "Which arguments to pass to the diff command when printing differences between
@@ -370,7 +421,16 @@ module Puppet
       :desc    => "Where to retrive information about data.",
     },
     :hiera_config => {
-      :default => "$codedir/hiera.yaml",
+      :default => lambda do
+        config = nil
+        codedir = Puppet.settings[:codedir]
+        if codedir.is_a?(String)
+          config = File.expand_path(File.join(codedir, 'hiera.yaml'))
+          config = nil unless Puppet::FileSystem.exist?(config)
+        end
+        config = File.expand_path(File.join(Puppet.settings[:confdir], 'hiera.yaml')) if config.nil?
+        config
+      end,
       :desc    => "The hiera configuration file. Puppet only reads this file on startup, so you must restart the puppet master every time you edit it.",
       :type    => :file,
     },
@@ -546,6 +606,10 @@ module Puppet
           :default  => false,
           :type     => :boolean,
           :desc     => "Whether the application management feature is on or off. You must restart Puppet Server after changing this setting.",
+          :hook     => proc do |value|
+            # Statically loaded resource types differ depending on setting
+            Puppet::Pops::Loaders.clear
+          end
       }
   )
 
@@ -606,22 +670,38 @@ module Puppet
     :dns_alt_names => {
       :default => '',
       :desc    => <<EOT,
-The comma-separated list of alternative DNS names to use for the local host.
-
-When the node generates a CSR for itself, these are added to the request
-as the desired `subjectAltName` in the certificate: additional DNS labels
-that the certificate is also valid answering as.
-
-This is generally required if you use a non-hostname `certname`, or if you
-want to use `puppet kick` or `puppet resource -H` and the primary certname
-does not match the DNS name you use to communicate with the host.
-
-This is unnecessary for agents, unless you intend to use them as a server for
-`puppet kick` or remote `puppet resource` management.
-
-It is rarely necessary for servers; it is usually helpful only if you need to
-have a pool of multiple load balanced masters, or for the same master to
-respond on two physically separate networks under different names.
+A comma-separated list of alternate DNS names for Puppet Server. These are extra
+hostnames (in addition to its `certname`) that the server is allowed to use when
+serving agents. Puppet checks this setting when automatically requesting a
+certificate for Puppet agent or Puppet Server, and when manually generating a
+certificate with `puppet cert generate`.
+
+In order to handle agent requests at a given hostname (like
+"puppet.example.com"), Puppet Server needs a certificate that proves it's
+allowed to use that name; if a server shows a certificate that doesn't include
+its hostname, Puppet agents will refuse to trust it. If you use a single
+hostname for Puppet traffic but load-balance it to multiple Puppet Servers, each
+of those servers needs to include the official hostname in its list of extra
+names.
+
+**Note:** The list of alternate names is locked in when the server's
+certificate is signed. If you need to change the list later, you can't just
+change this setting; you also need to:
+
+* On the server: Stop Puppet Server.
+* On the CA server: Revoke and clean the server's old certificate. (`puppet cert clean <NAME>`)
+* On the server: Delete the old certificate (and any old certificate signing requests)
+  from the [ssldir](https://docs.puppetlabs.com/puppet/latest/reference/dirs_ssldir.html).
+* On the server: Run `puppet agent -t --ca_server <CA HOSTNAME>` to request a new certificate
+* On the CA server: Sign the certificate request, explicitly allowing alternate names
+  (`puppet cert sign --allow-dns-alt-names <NAME>`).
+* On the server: Run `puppet agent -t --ca_server <CA HOSTNAME>` to retrieve the cert.
+* On the server: Start Puppet Server again.
+
+To see all the alternate names your servers are using, log into your CA server
+and run `puppet cert list -a`, then check the output for `(alt names: ...)`.
+Most agent nodes should NOT have alternate names; the only certs that should
+have them are Puppet Server nodes that you want other agents to trust.
 EOT
     },
     :csr_attributes => {
@@ -939,7 +1019,8 @@ EOT
     },
     :req_bits => {
       :default    => 4096,
-      :desc       => "The bit length of the certificates.",
+      :desc       => "This setting has no effect and will be removed in a future Puppet version.",
+      :deprecated => :completely,
     },
     :keylength => {
       :default    => 4096,
@@ -1310,7 +1391,7 @@ EOT
         For control over logging destinations, see the `--logdest` command line
         option in the manual pages for puppet master, puppet agent, and puppet
         apply. You can see man pages by running `puppet <SUBCOMMAND> --help`,
-        or read them online at https://docs.puppetlabs.com/references/latest/man/."
+        or read them online at https://docs.puppetlabs.com/puppet/latest/reference/man/."
     },
     :server => {
       :default => "puppet",
@@ -1355,7 +1436,7 @@ EOT
         event _would_ have been sent.
 
         **Important note:**
-        [The `noop` metaparameter](https://docs.puppetlabs.com/references/latest/metaparameter.html#noop)
+        [The `noop` metaparameter](https://docs.puppetlabs.com/puppet/latest/reference/metaparameter.html#noop)
         allows you to apply individual resources in noop mode, and will override
         the global value of the `noop` setting. This means a resource with
         `noop => false` _will_ be changed if necessary, even when running puppet
@@ -1425,10 +1506,8 @@ EOT
     :ignorecache => {
       :default    => false,
       :type       => :boolean,
-      :desc       => "Ignore cache and always recompile the configuration.  This is
-        useful for testing new configurations, where the local cache may in
-        fact be stale even if the timestamps are up to date - if the facts
-        change or if the server changes.",
+      :desc       => "This setting has no effect and will be removed in a future Puppet version.",
+      :deprecated => :completely,
     },
     :splaylimit => {
       :default    => "$runinterval",

data/lib/puppet/face/config.rb

@@ -9,7 +9,7 @@ Puppet::Face.define(:config, '0.0.1') do
 
   description "This subcommand can inspect and modify settings from Puppet's
     'puppet.conf' configuration file. For documentation about individual settings,
-    see https://docs.puppetlabs.com/references/latest/configuration.html."
+    see https://docs.puppetlabs.com/puppet/latest/reference/configuration.html."
 
   option "--section SECTION_NAME" do
     default_to { "main" }

data/lib/puppet/face/help/man.erb

@@ -23,7 +23,7 @@ settings, so you can specify `--server <servername>`, or
 `--run_mode <runmode>` as an argument.
 
 See the configuration file documentation at
-<https://docs.puppetlabs.com/references/stable/configuration.html> for the
+<https://docs.puppetlabs.com/puppet/latest/reference/configuration.html> for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet with
 `--genconfig`.

data/lib/puppet/file_system/uniquefile.rb

@@ -175,7 +175,7 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
       mkdir(lock)
       yield
     ensure
-      rmdir(lock) if lock
+      rmdir(lock) if Puppet::FileSystem.exist?(lock)
     end
 
     def mkdir(*args)
@@ -187,4 +187,4 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
     end
   end
 
-end
+end

data/lib/puppet/file_system/windows.rb

@@ -4,21 +4,7 @@ require 'puppet/util/windows'
 class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
 
   def exist?(path)
-    if ! Puppet.features.manages_symlinks?
-      return ::File.exist?(path)
-    end
-
-    path = path.to_str if path.respond_to?(:to_str) # support WatchedFile
-    path = path.to_s # support String and Pathname
-
-    begin
-      if Puppet::Util::Windows::File.symlink?(path)
-        path = Puppet::Util::Windows::File.readlink(path)
-      end
-      ! Puppet::Util::Windows::File.stat(path).nil?
-    rescue # generally INVALID_HANDLE_VALUE which means 'file not found'
-      false
-    end
+    return Puppet::Util::Windows::File.exist?(path)
   end
 
   def symlink(path, dest, options = {})

data/lib/puppet/functions/assert_type.rb

@@ -69,7 +69,7 @@ Puppet::Functions.create_function(:assert_type, Puppet::Functions::InternalFunct
   #
   def assert_type(type, value)
     unless Puppet::Pops::Types::TypeCalculator.instance?(type,value)
-      inferred_type = Puppet::Pops::Types::TypeCalculator.infer(value)
+      inferred_type = Puppet::Pops::Types::TypeCalculator.infer_set(value)
       if block_given?
         # Give the inferred type to allow richer comparison in the given block (if generalized
         # information is lost).

data/lib/puppet/functions/dig.rb

@@ -0,0 +1,39 @@
+# Returns a value for a sequence of given keys/indexes into a structure.
+# This function is used to "dig into" a complex data structure by
+# using a sequence of keys / indexes to access a value from which
+# the next key/index is accessed recursively.
+#
+# The first encountered `undef` value or key stops the "dig" and `undef` is returned.
+#
+# An error is raised if an attempt is made to "dig" into
+# something other than an `undef` (which immediately returns `undef`), an Array or a Hash. 
+#
+# @example Using `dig`
+#
+# ~~~ puppet
+# $data = {a => { b => [{x => 10, y => 20}, {x => 100, y => 200}]}}
+# notice $data.dig(a, b, 1, x)
+# ~~~
+#
+# Would notice the value 100.
+#
+# @since 4.5.0
+#
+Puppet::Functions.create_function(:dig) do
+  dispatch :dig do
+    param 'Optional[Collection]', :data
+    repeated_param 'Any', :arg
+  end
+
+  def dig(data, *args)
+    walked_path = []
+    args.reduce(data) do | d, k |
+      return nil if d.nil? || k.nil?
+      if !(d.is_a?(Array) || d.is_a?(Hash))
+        raise ArgumentError, "The given data does not contain a Collection at #{walked_path}, got '#{d.class}'"
+      end
+      walked_path << k
+      d[k]
+    end
+  end
+end

data/lib/puppet/functions/hiera_include.rb

@@ -1,7 +1,7 @@
 require 'hiera/puppet_function'
 
 # Assigns classes to a node using an
-# [array merge lookup](https://docs.puppetlabs.com/hiera/latest/lookup_types.htmlarray-merge)
+# [array merge lookup](https://docs.puppetlabs.com/hiera/latest/lookup_types.html#array-merge)
 # that retrieves the value for a user-specified key from Hiera's data.
 #
 # The `hiera_include` function requires:
@@ -26,7 +26,7 @@ require 'hiera/puppet_function'
 #     searching the rest of the hierarchy.
 #
 # The function uses an
-# [array merge lookup](https://docs.puppetlabs.com/hiera/latest/lookup_types.htmlarray-merge)
+# [array merge lookup](https://docs.puppetlabs.com/hiera/latest/lookup_types.html#array-merge)
 # to retrieve the `classes` array, so every node gets every class from the hierarchy.
 #
 # @example Using `hiera_include`

data/lib/puppet/functions/inline_epp.rb

@@ -28,7 +28,7 @@
 # `inline_epp` function fails to pass any required parameter.
 #
 # An inline EPP template should be written as a single-quoted string or
-# [heredoc](puppet/latest/reference/lang_data_string.html#heredocs).
+# [heredoc](/puppet/latest/reference/lang_data_string.html#heredocs).
 # A double-quoted string is subject to expression interpolation before the string
 # is parsed as an EPP template.
 #

data/lib/puppet/functions/lest.rb

@@ -0,0 +1,53 @@
+# Call a [lambda](https://docs.puppet.com/puppet/latest/reference/lang_lambdas.html)
+# (which should accept no arguments) if the argument given to the function is `undef`.
+# Returns the result of calling the lambda if the argument is `undef`, otherwwise the
+# given argument.
+#
+# The `lest` function is useful in a chain of `then` calls, or in general
+# as a guard against `undef` values. The function can be used to call `fail`, or to
+# return a default value.
+#
+# These two expressions are equivalent:
+# ~~~puppet
+# if $x == undef { do_things() }
+# lest($x) || { do_things() }
+# ~~
+#
+# @example Using `lest`
+#
+# ~~~ puppet
+# $data = {a => [ b, c ] }
+# notice $data.dig(a, b, c)
+#  .then |$x| { $x * 2 }
+#  .lest || { fail("no value for $data[a][b][c]" }
+# ~~~
+#
+# Would fail the operation because $data[a][b][c] results in `undef`
+#
+# In contrast - this example:
+#
+# ~~~ puppet
+# $data = {a => { b => { c => 10 } } }
+# notice $data.dig(a, b, c)
+#  .then |$x| { $x * 2 }
+#  .lest || { fail("no value for $data[a][b][c]" }
+# ~~~
+#
+# Would notice the value 20
+#
+# @since 4.5.0
+#
+Puppet::Functions.create_function(:lest) do
+  dispatch :lest do
+    param 'Any', :arg
+    block_param 'Callable[0,0]', :block
+  end
+
+  def lest(arg)
+    if arg.nil?
+      yield()
+    else
+      arg
+    end
+  end
+end

data/lib/puppet/functions/lookup.rb

@@ -100,9 +100,6 @@
 #     disables this feature.
 #     * `'sort_merged_arrays'` (boolean) --- Whether to sort all arrays that are
 #     merged together. Defaults to `false`.
-#     * `'unpack_arrays'` (string or undef) --- A delimiter string; Puppet will
-#     join merged arrays with this delimiter, then split them again. Defaults to
-#     `undef`, which disables this feature.
 #     * `'merge_hash_arrays'` (boolean) --- Whether to merge hashes within arrays.
 #     Defaults to `false`.
 #
@@ -125,54 +122,67 @@
 #
 # @since 4.0.0
 Puppet::Functions.create_function(:lookup, Puppet::Functions::InternalFunction) do
-  name_t = 'Variant[String,Array[String]]'
-  value_type_t = 'Type'
-  default_value_t = 'Any'
-  merge_t = 'Variant[String[1],Hash[String,Scalar]]'
-  block_t = "Callable[#{name_t}]"
-  option_pairs =
-      "value_type=>Optional[#{value_type_t}],"\
-      "default_value=>Optional[#{default_value_t}],"\
-      "override=>Optional[Hash[String,Any]],"\
-      "default_values_hash=>Optional[Hash[String,Any]],"\
-      "merge=>Optional[#{merge_t}]"
+
+  local_types do
+    type 'NameType         = Variant[String, Array[String]]'
+    type 'ValueType        = Type'
+    type 'DefaultValueType = Any'
+    type 'MergeType        = Variant[String[1], Hash[String, Scalar]]'
+    type 'BlockType        = Callable[NameType]'
+    type "OptionsWithName  = Struct[{\
+      name                => NameType,\
+      value_type          => Optional[ValueType],\
+      default_value       => Optional[DefaultValueType],\
+      override            => Optional[Hash[String,Any]],\
+      default_values_hash => Optional[Hash[String,Any]],\
+      merge               => Optional[MergeType]\
+    }]"
+    type "OptionsWithoutName = Struct[{\
+      value_type          => Optional[ValueType],\
+      default_value       => Optional[DefaultValueType],\
+      override            => Optional[Hash[String,Any]],\
+      default_values_hash => Optional[Hash[String,Any]],\
+      merge               => Optional[MergeType]\
+    }]"
+
+  end
 
   dispatch :lookup_1 do
     scope_param
-    param           name_t,       :name
-    optional_param  value_type_t, :value_type
-    optional_param  merge_t,      :merge
+    param           'NameType',       :name
+    optional_param  'ValueType',      :value_type
+    optional_param  'MergeType',      :merge
   end
 
   dispatch :lookup_2 do
     scope_param
-    param name_t,                     :name
-    param "Optional[#{value_type_t}]", :value_type
-    param "Optional[#{merge_t}]",      :merge
-    param default_value_t,            :default_value
+    param 'NameType',                 :name
+    param 'Optional[ValueType]',      :value_type
+    param 'Optional[MergeType]',      :merge
+    param 'DefaultValueType',         :default_value
   end
 
   dispatch :lookup_3 do
     scope_param
-    param           name_t,       :name
-    optional_param  value_type_t, :value_type
-    optional_param  merge_t,      :merge
-    required_block_param block_t, :block
+    param                'NameType',   :name
+    optional_param       'ValueType',  :value_type
+    optional_param       'MergeType',  :merge
+    required_block_param 'BlockType',  :block
   end
 
   # Lookup without name. Name then becomes a required entry in the options hash
   dispatch :lookup_4 do
     scope_param
-    param "Struct[{name=>#{name_t},#{option_pairs}}]", :options_hash
-    optional_block_param block_t, :block
+    param                'OptionsWithName', :options_hash
+    optional_block_param 'BlockType',       :block
   end
 
   # Lookup using name and options hash.
   dispatch :lookup_5 do
     scope_param
-    param 'Variant[String,Array[String]]', :name
-    param "Struct[{#{option_pairs}}]", :options_hash
-    optional_block_param block_t, :block
+    param                'Variant[String,Array[String]]', :name
+    param                'OptionsWithoutName',            :options_hash
+    optional_block_param 'BlockType',                     :block
   end
 
   def lookup_1(scope, name, value_type=nil, merge=nil)