puppet 4.8.2-x64-mingw32 → 4.9.0-x64-mingw32

data/lib/puppet/settings/file_or_directory_setting.rb

@@ -22,6 +22,12 @@ class Puppet::Settings::FileOrDirectorySetting < Puppet::Settings::FileSetting
   end
 
   # @api private
+  #
+  # @param option [String] Extra file operation mode information to use
+  #   (defaults to read-only mode 'r')
+  #   This is the standard mechanism Ruby uses in the IO class, and therefore
+  #   encoding may be explicitly like fmode : encoding or fmode : "BOM|UTF-*"
+  #   for example, a:ASCII or w+:UTF-8
   def open_file(filename, option = 'r', &block)
     if type == :file
       super

data/lib/puppet/settings/file_setting.rb

@@ -185,6 +185,11 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
   end
 
   # @api private
+  # @param option [String] Extra file operation mode information to use
+  #   (defaults to read-only mode 'r')
+  #   This is the standard mechanism Ruby uses in the IO class, and therefore
+  #   encoding may be explicitly like fmode : encoding or fmode : "BOM|UTF-*"
+  #   for example, a:ASCII or w+:UTF-8
   def exclusive_open(option = 'r', &block)
     controlled_access do |mode|
       Puppet::FileSystem.exclusive_open(file(), mode, option, &block)
@@ -192,6 +197,11 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
   end
 
   # @api private
+  # @param option [String] Extra file operation mode information to use
+  #   (defaults to read-only mode 'r')
+  #   This is the standard mechanism Ruby uses in the IO class, and therefore
+  #   encoding may be explicitly like fmode : encoding or fmode : "BOM|UTF-*"
+  #   for example, a:ASCII or w+:UTF-8
   def open(option = 'r', &block)
     controlled_access do |mode|
       Puppet::FileSystem.open(file, mode, option, &block)

data/lib/puppet/ssl/certificate_authority.rb

@@ -189,7 +189,7 @@ class Puppet::SSL::CertificateAuthority
   #
   # @return [Array<String>]
   def list(name='*')
-    list_certificates(name).collect { |c| c.name }
+    Puppet::SSL::Certificate.indirection.search(name).collect { |c| c.name }
   end
 
   # Return all the certificate objects as found by the indirector
@@ -205,7 +205,10 @@ class Puppet::SSL::CertificateAuthority
   # @param name [Array<string>] filter to cerificate names
   #
   # @return [Array<Puppet::SSL::Certificate>]
+  #
+  # @deprecated Use Puppet::SSL::CertificateAuthority#list or Puppet Server Certificate status API
   def list_certificates(name='*')
+    Puppet.deprecation_warning("Puppet::SSL::CertificateAuthority#list_certificates is deprecated. Please use Puppet::SSL::CertificateAuthority#list or the certificate status API to query certificate information. See https://docs.puppet.com/puppet/latest/http_api/http_certificate_status.html")
     Puppet::SSL::Certificate.indirection.search(name)
   end
 
@@ -417,6 +420,11 @@ class Puppet::SSL::CertificateAuthority
   #   of the X509 Store
   #
   # @return [OpenSSL::X509::Store]
+  #
+  # @deprecated Strictly speaking, #x509_store is marked API private, so we
+  #   don't need to publicly deprecate it. But it marked as deprecated here to
+  #   avoid the exceedingly small chance that someone comes in and uses it from
+  #   within this class before it is removed.
   def x509_store(options = {})
     if (options[:cache])
       return @x509store unless @x509store.nil?
@@ -464,7 +472,10 @@ class Puppet::SSL::CertificateAuthority
   # @param cert [Puppet::SSL::Certificate] the certificate to check validity of
   #
   # @return [Boolean] true if signed, false if unsigned or revoked
+  #
+  # @deprecated use Puppet::SSL::CertificateAuthority#verify or Puppet Server certificate status API
   def certificate_is_alive?(cert)
+    Puppet.deprecation_warning("Puppet::SSL::CertificateAuthority#certificate_is_alive? is deprecated. Please use Puppet::SSL::CertificateAuthority#verify or the certificate status API to query certificate information. See https://docs.puppet.com/puppet/latest/http_api/http_certificate_status.html")
     x509_store(:cache => true).verify(cert.content)
   end
 
@@ -483,7 +494,7 @@ class Puppet::SSL::CertificateAuthority
     unless cert = Puppet::SSL::Certificate.indirection.find(name)
       raise ArgumentError, "Could not find a certificate for #{name}"
     end
-    store = x509_store
+    store = create_x509_store
 
     raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
   end

data/lib/puppet/ssl/host.rb

@@ -227,7 +227,29 @@ ERROR_STRING
   # Generate all necessary parts of our ssl host.
   def generate
     generate_key unless key
-    generate_certificate_request unless certificate_request
+    # ask indirector to find any existing requests and download them
+    existing_request = certificate_request
+
+    # if CSR downloaded from master, but the local keypair was just generated and
+    # does not match the public key in the CSR, fail hard
+    if !existing_request.nil? &&
+      (key.content.public_key.to_s != existing_request.content.public_key.to_s)
+
+      raise Puppet::Error, <<ERROR_STRING
+The CSR retrieved from the master does not match the agent's public key.
+CSR fingerprint: #{existing_request.fingerprint}
+CSR public key: #{existing_request.content.public_key.to_text}
+Agent public key: #{key.content.public_key.to_text}
+To fix this, remove the CSR from both the master and the agent and then start a puppet run, which will automatically regenerate a CSR.
+On the master:
+  puppet cert clean #{Puppet[:certname]}
+On the agent:
+  1a. On most platforms: find #{Puppet[:ssldir]} -name #{Puppet[:certname]}.pem -delete
+  1b. On Windows: del "#{Puppet[:certdir].gsub('/', '\\')}\\#{Puppet[:certname]}.pem" /f
+  2. puppet agent -t
+ERROR_STRING
+    end
+    generate_certificate_request unless existing_request
 
     # If we can get a CA instance, then we're a valid CA, and we
     # should use it to sign our request; else, just try to read

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -79,6 +79,13 @@ class Puppet::Transaction::AdditionalResourceGenerator
 
   def contain_generated_resources_in(resource, made)
     sentinel = Puppet::Type.type(:whit).new(:name => "completed_#{resource.title}", :catalog => resource.catalog)
+    # Tag the completed whit with all of the tags of the generating resource
+    # except the type name to allow event propogation to succeed beyond the whit
+    # "boundary" when filtering resources with tags. We include auto-generated
+    # tags such as the type name to support implicit filtering as well as
+    # explicit. Note that resource#tags returns a duplicate of the resource's
+    # tags.
+    sentinel.tag(*resource.tags)
     priority = @prioritizer.generate_priority_contained_in(resource, sentinel)
     @relationship_graph.add_vertex(sentinel, priority)
 

data/lib/puppet/type/user.rb

@@ -171,10 +171,23 @@ module Puppet
 
     newproperty(:comment) do
       desc "A description of the user.  Generally the user's full name."
-      if RUBY_VERSION < "2.1.0"
-        munge do |v|
-          v.respond_to?(:force_encoding) ? v.force_encoding(Encoding::ASCII_8BIT) : v
+      def insync?(is)
+        # nameservice provider requires special attention to encoding
+        # Overrides Puppet::Property#insync?
+        if !@should.empty? && provider.respond_to?(:comments_insync?)
+          return provider.comments_insync?(is, @should)
+        end
+        super(is)
+      end
+
+      # In the case that our comments have incompatible encodings, set external
+      # encoding to support concatenation for display.
+      # overrides Puppet::Property#change_to_s
+      def change_to_s(currentvalue, newvalue)
+        if newvalue.respond_to?(:force_encoding) && !Encoding.compatible?(currentvalue, newvalue)
+          return super(currentvalue, newvalue.dup.force_encoding(currentvalue.encoding))
         end
+        super(currentvalue, newvalue)
       end
     end
 

data/lib/puppet/util.rb

@@ -450,6 +450,7 @@ module Util
 
     begin
       file     = Puppet::FileSystem.pathname(file)
+      # encoding for Uniquefile is not important here because the caller writes to it as it sees fit
       tempfile = Puppet::FileSystem::Uniquefile.new(Puppet::FileSystem.basename_string(file), Puppet::FileSystem.dir_string(file))
 
       # Set properties of the temporary file before we write the content, because

data/lib/puppet/util/execution.rb

@@ -184,9 +184,9 @@ module Puppet::Util::Execution
     null_file = Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null'
 
     begin
-      stdin = File.open(options[:stdinfile] || null_file, 'r')
-      stdout = options[:squelch] ? File.open(null_file, 'w') : Puppet::FileSystem::Uniquefile.new('puppet')
-      stderr = options[:combine] ? stdout : File.open(null_file, 'w')
+      stdin = Puppet::FileSystem.open(options[:stdinfile] || null_file, nil, 'r')
+      stdout = options[:squelch] ? Puppet::FileSystem.open(null_file, nil, 'w') : Puppet::FileSystem::Uniquefile.new('puppet')
+      stderr = options[:combine] ? stdout : Puppet::FileSystem.open(null_file, nil, 'w')
 
       exec_args = [command, options, stdin, stdout, stderr]
 

data/lib/puppet/util/filetype.rb

@@ -105,7 +105,9 @@ class Puppet::Util::FileType
     # Read the file.
     def read
       if Puppet::FileSystem.exist?(@path)
-        File.read(@path)
+        # this code path is used by many callers so the original default is
+        # being explicitly preserved
+        Puppet::FileSystem.read(@path, :encoding => Encoding.default_external)
       else
         return nil
       end
@@ -118,7 +120,8 @@ class Puppet::Util::FileType
 
     # Overwrite the file.
     def write(text)
-      tf = Tempfile.new("puppet")
+      # this file is managed by the OS and should be using system encoding
+      tf = Tempfile.new("puppet", :encoding => Encoding.default_external)
       tf.print text; tf.flush
       File.chmod(@default_mode, tf.path) if @default_mode
       FileUtils.cp(tf.path, @path)
@@ -197,7 +200,8 @@ class Puppet::Util::FileType
     # Overwrite a specific @path's cron tab; must be passed the @path name
     # and the text with which to create the cron tab.
     def write(text)
-      IO.popen("#{cmdbase()} -", "w") { |p|
+      # this file is managed by the OS and should be using system encoding
+      IO.popen("#{cmdbase()} -", "w", :encoding => Encoding.default_external) { |p|
         p.print text
       }
     end
@@ -242,7 +246,8 @@ class Puppet::Util::FileType
     # Overwrite a specific @path's cron tab; must be passed the @path name
     # and the text with which to create the cron tab.
     def write(text)
-      output_file = Tempfile.new("puppet_suntab")
+      # this file is managed by the OS and should be using system encoding
+      output_file = Tempfile.new("puppet_suntab", :encoding => Encoding.default_external)
       begin
         output_file.print text
         output_file.close
@@ -284,7 +289,8 @@ class Puppet::Util::FileType
     # Overwrite a specific @path's cron tab; must be passed the @path name
     # and the text with which to create the cron tab.
     def write(text)
-      output_file = Tempfile.new("puppet_aixtab")
+      # this file is managed by the OS and should be using system encoding
+      output_file = Tempfile.new("puppet_aixtab", :encoding => Encoding.default_external)
 
       begin
         output_file.print text

data/lib/puppet/util/logging.rb

@@ -224,7 +224,8 @@ module Logging
     # find the same offender, and we'd end up logging it again.
     $logged_deprecation_warnings ||= {}
 
-    File.open(deprecations_file, "a") do |f|
+    # Deprecation messages are UTF-8 as they are produced by Ruby
+    Puppet::FileSystem.open(deprecations_file, nil, "a:UTF-8") do |f|
       if ($deprecation_warnings) then
         $deprecation_warnings.each do |offender, message|
           if (! $logged_deprecation_warnings.has_key?(offender)) then

data/lib/puppet/util/network_device/config.rb

@@ -59,7 +59,7 @@ class Puppet::Util::NetworkDevice::Config
             device.options = { :debug => false }
             Puppet.debug "found device: #{device.name} at #{device.line}"
             devices[name] = device
-          when /^\s*(type|url|debug)(\s+(.+))*$/
+          when /^\s*(type|url|debug)(\s+(.+)\s*)*$/
             parse_directive(device, $1, $3, count)
           else
             raise Puppet::Error, "Invalid line #{count}: #{line}"

data/lib/puppet/util/plist.rb

@@ -78,6 +78,12 @@ module Puppet::Util::Plist
     # stubbing purposes
     #
     # @api private
+    #
+    # @param args [String] Extra file operation mode information to use
+    #   (defaults to read-only mode 'r')
+    #   This is the standard mechanism Ruby uses in the IO class, and therefore
+    #   encoding may be explicitly like fmode : encoding or fmode : "BOM|UTF-*"
+    #   for example, a:ASCII or w+:UTF-8
     def open_file_with_args(file, args)
       File.open(file, args).read
     end

data/lib/puppet/util/profiler/aggregate.rb

@@ -42,7 +42,7 @@ class Puppet::Util::Profiler::Aggregate < Puppet::Util::Profiler::WallClock
   end
 
   def print_metrics(metrics_hash, prefix)
-    metrics_hash.sort_by {|k,v| v.time }.reverse.each do |k,v|
+    metrics_hash.sort_by {|k,v| v.time }.reverse_each do |k,v|
       @logger.call("#{prefix}#{k}: #{v.time} s (#{v.count} calls)")
       print_metrics(metrics_hash[k], "#{prefix}#{k} -> ")
     end

data/lib/puppet/util/rdoc/generators/puppet_generator.rb

@@ -225,7 +225,7 @@ module Generators
         'style_url'  => style_url('', @options.css),
       }
 
-      File.open(filename, "w") do |f|
+      Puppet::FileSystem.open(filename, nil, "w:UTF-8") do |f|
         template.write_html_on(f, values)
       end
     end
@@ -301,7 +301,7 @@ module Generators
       values["plugins"] = res4 if res4.size>0
       values["nodes"] = res5 if res5.size>0
 
-      File.open(filename, "w") do |f|
+      Puppet::FileSystem.open(filename, nil, "w:UTF-8") do |f|
         template.write_html_on(f, values)
       end
     end

data/lib/puppet/util/rdoc/parser/puppet_parser_core.rb

@@ -104,7 +104,8 @@ module RDoc::PuppetParserCore
     comment = ""
     %w{README README.rdoc}.each do |rfile|
       readme = File.join(File.dirname(File.dirname(@input_file_name)), rfile)
-      comment = File.open(readme,"r") { |f| f.read } if FileTest.readable?(readme)
+      # module README should be UTF-8, not default system encoding
+      comment = File.open(readme,"r:UTF-8") { |f| f.read } if FileTest.readable?(readme)
     end
     look_for_directives_in(container, comment) unless comment.empty?
 

data/lib/puppet/util/windows/adsi.rb

@@ -195,10 +195,9 @@ module Puppet::Util::Windows::ADSI
     end
 
     def [](attribute)
-      value = native_user.Get(attribute)
-      # Rubys WIN32OLE errantly converts UTF-16 values to Encoding.default_external
-      return value.encode(Encoding::UTF_8) if value.is_a?(String)
-      value
+      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+      # values are returned as UTF-8
+      native_user.Get(attribute)
     end
 
     def []=(attribute, value)
@@ -248,8 +247,9 @@ module Puppet::Util::Windows::ADSI
       # https://msdn.microsoft.com/en-us/library/aa746342.aspx
       # WIN32OLE objects aren't enumerable, so no map
       groups = []
-      # Rubys WIN32OLE errantly converts UTF-16 values to Encoding.default_external
-      native_user.Groups.each {|g| groups << g.Name.encode(Encoding::UTF_8)} rescue nil
+      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+      # values are returned as UTF-8
+      native_user.Groups.each {|g| groups << g.Name} rescue nil
       groups
     end
 
@@ -372,8 +372,9 @@ module Puppet::Util::Windows::ADSI
 
       users = []
       wql.each do |u|
-        # Rubys WIN32OLE errantly converts UTF-16 values to Encoding.default_external
-        users << new(u.name.encode(Encoding::UTF_8))
+        # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+        # values are returned as UTF-8
+        users << new(u.name)
       end
 
       users.each(&block)
@@ -465,8 +466,9 @@ module Puppet::Util::Windows::ADSI
     def members
       # WIN32OLE objects aren't enumerable, so no map
       members = []
-      # Rubys WIN32OLE errantly converts UTF-16 values to Encoding.default_external
-      native_group.Members.each {|m| members << m.Name.encode(Encoding::UTF_8)}
+      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+      # values are returned as UTF-8
+      native_group.Members.each {|m| members << m.Name}
       members
     end
 
@@ -535,8 +537,9 @@ module Puppet::Util::Windows::ADSI
 
       groups = []
       wql.each do |g|
-        # Rubys WIN32OLE errantly converts UTF-16 values to Encoding.default_external
-        groups << new(g.name.encode(Encoding::UTF_8))
+        # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+        # values are returned as UTF-8
+        groups << new(g.name)
       end
 
       groups.each(&block)

data/lib/puppet/vendor/load_semantic_puppet.rb

@@ -0,0 +1 @@
+$: << File.join([File.dirname(__FILE__), "semantic_puppet/lib"])

data/lib/puppet/vendor/pathspec/lib/pathspec.rb

@@ -75,7 +75,8 @@ class PathSpec
 
   # Generate specs from a filename, such as a .gitignore
   def self.from_filename(filename, type=:git)
-    self.from_lines(File.open(filename, 'r'))
+    # .gitignore is a UTF-8 file
+    self.from_lines(File.open(filename, 'r', :encoding => Encoding::UTF_8), type)
   end
 
   def self.from_lines(lines, type=:git)

data/lib/puppet/vendor/require_vendored.rb

@@ -1,7 +1,6 @@
 # This adds upfront requirements on vendored code found under lib/vendor/x
 # Add one requirement per vendored package (or a comment if it is loaded on demand).
 
-# The vendored library 'semantic' is loaded on demand.
 # The vendored library 'rgen' is loaded on demand.
 # The vendored library 'pathspec' is loaded on demand.
 # The vendored library 'deep_merge' is loaded on demand.

data/lib/puppet/vendor/semantic_puppet/lib/semantic_puppet.rb

@@ -0,0 +1,17 @@
+begin
+  require 'gettext-setup'
+rescue LoadError
+  def _(msg)
+    msg
+  end
+end
+
+module SemanticPuppet
+  if defined?(GettextSetup)
+    GettextSetup.initialize(File.absolute_path('semantic_puppet/locales', File.dirname(__FILE__)))
+  end
+
+  autoload :Version, 'semantic_puppet/version'
+  autoload :VersionRange, 'semantic_puppet/version_range'
+  autoload :Dependency, 'semantic_puppet/dependency'
+end

data/lib/puppet/vendor/{semantic/lib/semantic → semantic_puppet/lib/semantic_puppet}/dependency.rb

@@ -1,15 +1,15 @@
-require 'semantic'
+require 'semantic_puppet'
 
-module Semantic
+module SemanticPuppet
   module Dependency
     extend self
 
-    autoload :Graph,         'semantic/dependency/graph'
-    autoload :GraphNode,     'semantic/dependency/graph_node'
-    autoload :ModuleRelease, 'semantic/dependency/module_release'
-    autoload :Source,        'semantic/dependency/source'
+    autoload :Graph,         'semantic_puppet/dependency/graph'
+    autoload :GraphNode,     'semantic_puppet/dependency/graph_node'
+    autoload :ModuleRelease, 'semantic_puppet/dependency/module_release'
+    autoload :Source,        'semantic_puppet/dependency/source'
 
-    autoload :UnsatisfiableGraph, 'semantic/dependency/unsatisfiable_graph'
+    autoload :UnsatisfiableGraph, 'semantic_puppet/dependency/unsatisfiable_graph'
 
     # @!group Sources
 

data/lib/puppet/vendor/{semantic/lib/semantic → semantic_puppet/lib/semantic_puppet}/dependency/graph.rb

@@ -1,6 +1,6 @@
-require 'semantic/dependency'
+require 'semantic_puppet/dependency'
 
-module Semantic
+module SemanticPuppet
   module Dependency
     class Graph
       include GraphNode

data/lib/puppet/vendor/{semantic/lib/semantic → semantic_puppet/lib/semantic_puppet}/dependency/graph_node.rb

@@ -1,7 +1,7 @@
-require 'semantic/dependency'
+require 'semantic_puppet/dependency'
 require 'set'
 
-module Semantic
+module SemanticPuppet
   module Dependency
     module GraphNode
       include Comparable