puppet 5.0.0 → 6.0.0

data/ext/rack/config.ru

@@ -1,44 +0,0 @@
-# a config.ru, for use with every rack-compatible webserver.
-# SSL needs to be handled outside this, though.
-
-# if puppet is not in your RUBYLIB:
-# $LOAD_PATH.unshift('/opt/puppet/lib')
-
-$0 = "master"
-
-# if you want debugging:
-# ARGV << "--debug"
-
-ARGV << "--rack"
-
-# Rack applications typically don't start as root.  Set --confdir, --vardir,
-# --logdir, --rundir to prevent reading configuration from
-# ~/ based pathing.
-ARGV << "--confdir" << "/etc/puppetlabs/puppet"
-ARGV << "--vardir"  << "/opt/puppetlabs/server/data/puppetmaster"
-ARGV << "--logdir"  << "/var/log/puppetlabs/puppetmaster"
-ARGV << "--rundir"  << "/var/run/puppetlabs/puppetmaster"
-ARGV << "--codedir"  << "/etc/puppetlabs/code"
-
-# disable always_retry_plugsin as a performance improvement. This is safe for a master to
-# apply. This is intended to allow agents to recognize new features that may be
-# delivered during catalog compilation.
-ARGV << "--no-always_retry_plugins"
-
-# NOTE: it's unfortunate that we have to use the "CommandLine" class
-#  here to launch the app, but it contains some initialization logic
-#  (such as triggering the parsing of the config file) that is very
-#  important.  We should do something less nasty here when we've
-#  gotten our API and settings initialization logic cleaned up.
-#
-# Also note that the "$0 = master" line up near the top here is
-#  the magic that allows the CommandLine class to know that it's
-#  supposed to be running master.
-#
-# --cprice 2012-05-22
-
-require 'puppet/util/command_line'
-# we're usually running inside a Rack::Builder.new {} block,
-# therefore we need to call run *here*.
-run Puppet::Util::CommandLine.new.execute
-

data/ext/rack/example-passenger-vhost.conf

@@ -1,57 +0,0 @@
-# This Apache 2 virtual host config shows how to use Puppet as a Rack
-# application via Passenger. See
-# https://docs.puppetlabs.com/guides/passenger.html for more information.
-
-# You can also use the included config.ru file to run Puppet with other Rack
-# servers instead of Passenger.
-
-# you probably want to tune these settings
-PassengerHighPerformance on
-PassengerMaxPoolSize 12
-PassengerPoolIdleTime 1500
-# PassengerMaxRequests 1000
-PassengerStatThrottleRate 120
-RackAutoDetect Off
-RailsAutoDetect Off
-
-Listen 8140
-
-<VirtualHost *:8140>
-        SSLEngine on
-        SSLProtocol             ALL -SSLv2 -SSLv3
-        SSLCipherSuite          EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
-        SSLHonorCipherOrder     on
-
-        SSLCertificateFile      /etc/puppet/ssl/certs/squigley.namespace.at.pem
-        SSLCertificateKeyFile   /etc/puppet/ssl/private_keys/squigley.namespace.at.pem
-        SSLCertificateChainFile /etc/puppet/ssl/ca/ca_crt.pem
-        SSLCACertificateFile    /etc/puppet/ssl/ca/ca_crt.pem
-        # If Apache complains about invalid signatures on the CRL, you can try disabling
-        # CRL checking by commenting the next line, but this is not recommended.
-        SSLCARevocationFile     /etc/puppet/ssl/ca/ca_crl.pem
-        # Apache 2.4 introduces the SSLCARevocationCheck directive and sets it to none
-        # which effectively disables CRL checking; if you are using Apache 2.4+ you must
-        # specify 'SSLCARevocationCheck chain' to actually use the CRL.
-        # SSLCARevocationCheck chain
-        SSLVerifyClient optional
-        SSLVerifyDepth  1
-        # The `ExportCertData` option is needed for agent certificate expiration warnings
-        SSLOptions +StdEnvVars +ExportCertData
-
-        # This header needs to be set if using a loadbalancer or proxy
-        RequestHeader unset X-Forwarded-For
-
-        RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
-        RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
-        RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
-
-        DocumentRoot /etc/puppet/rack/public/
-        RackBaseURI /
-        <Directory /etc/puppet/rack/>
-                Options None
-                AllowOverride None
-                Order allow,deny
-                allow from all
-        </Directory>
-</VirtualHost>
-

data/lib/puppet/application/ca.rb

@@ -1,11 +0,0 @@
-require 'puppet/application/face_base'
-require 'puppet/ssl/oids'
-
-class Puppet::Application::Ca < Puppet::Application::FaceBase
-  run_mode :master
-
-  def setup
-    Puppet::SSL::Oids.register_puppet_oids
-    super
-  end
-end

data/lib/puppet/application/certificate.rb

@@ -1,17 +0,0 @@
-require 'puppet/application/indirection_base'
-require 'puppet/ssl/oids'
-
-class Puppet::Application::Certificate < Puppet::Application::IndirectionBase
-  def setup
-    Puppet::SSL::Oids.register_puppet_oids
-    location = Puppet::SSL::Host.ca_location
-    if location == :local && !Puppet::SSL::CertificateAuthority.ca?
-      # I'd prefer if this could be dealt with differently; ideally, run_mode should be set as
-      #  part of a class definition, and should not be modifiable beyond that.  This is one of
-      #  the cases where that isn't currently possible.
-      Puppet.settings.preferred_run_mode = "master"
-    end
-
-    super
-  end
-end

data/lib/puppet/application/certificate_request.rb

@@ -1,7 +0,0 @@
-require 'puppet/application/indirection_base'
-
-# NOTE: this is using an "old" naming convention (underscores instead of camel-case), for backwards
-#  compatibility with 2.7.x.  When the old naming convention is officially and publicly deprecated,
-#  this should be changed to camel-case.
-class Puppet::Application::Certificate_request < Puppet::Application::IndirectionBase
-end

data/lib/puppet/application/certificate_revocation_list.rb

@@ -1,7 +0,0 @@
-require 'puppet/application/indirection_base'
-
-# NOTE: this is using an "old" naming convention (underscores instead of camel-case), for backwards
-#  compatibility with 2.7.x.  When the old naming convention is officially and publicly deprecated,
-#  this should be changed to camel-case.
-class Puppet::Application::Certificate_revocation_list < Puppet::Application::IndirectionBase
-end

data/lib/puppet/application/master.rb

@@ -1,313 +0,0 @@
-require 'puppet/application'
-require 'puppet/daemon'
-require 'puppet/util/pidlock'
-
-class Puppet::Application::Master < Puppet::Application
-
-  run_mode :master
-
-  option("--debug", "-d")
-  option("--verbose", "-v")
-
-  # internal option, only to be used by ext/rack/config.ru
-  option("--rack")
-
-  option("--compile host",  "-c host") do |arg|
-    options[:node] = arg
-  end
-
-  option("--logdest DEST",  "-l DEST") do |arg|
-    handle_logdest_arg(arg)
-  end
-
-  option("--parseonly") do |args|
-    puts "--parseonly has been removed. Please use 'puppet parser validate <manifest>'"
-    exit 1
-  end
-
-  def help
-    <<-'HELP'
-
-puppet-master(8) -- The puppet master daemon
-========
-
-SYNOPSIS
---------
-The central puppet server. Functions as a certificate authority by
-default.
-
-
-USAGE
------
-puppet master [-D|--daemonize|--no-daemonize] [-d|--debug] [-h|--help]
-  [-l|--logdest syslog|<FILE>|console] [-v|--verbose] [-V|--version]
-  [--compile <NODE-NAME>]
-
-
-DESCRIPTION
------------
-This command starts an instance of puppet master, running as a daemon
-and using Ruby's built-in Webrick webserver. Puppet master can also be
-managed by other application servers; when this is the case, this
-executable is not used.
-
-
-OPTIONS
--------
-
-Note that any Puppet setting that's valid in the configuration file is also a
-valid long argument. For example, 'server' is a valid setting, so you can
-specify '--server <servername>' as an argument. Boolean settings translate into
-'--setting' and '--no-setting' pairs.
-
-See the configuration file documentation at
-https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
-full list of acceptable settings. A commented list of all settings can also be
-generated by running puppet master with '--genconfig'.
-
-* --daemonize:
-  Send the process into the background. This is the default.
-  (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
-  prefix for boolean settings on the command line.)
-
-* --no-daemonize:
-  Do not send the process into the background.
-  (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
-  prefix for boolean settings on the command line.)
-
-* --debug:
-  Enable full debugging.
-
-* --help:
-  Print this help message.
-
-* --logdest:
-  Where to send log messages. Choose between 'syslog' (the POSIX syslog
-  service), 'console', or the path to a log file. If debugging or verbosity is
-  enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
-
-  A path ending with '.json' will receive structured output in JSON format. The
-  log file will not have an ending ']' automatically written to it due to the
-  appending nature of logging. It must be appended manually to make the content
-  valid JSON.
-
-* --masterport:
-  The port on which to listen for traffic. The default port is 8140.
-  (This is a Puppet setting, and can go in puppet.conf.)
-
-* --verbose:
-  Enable verbosity.
-
-* --version:
-  Print the puppet version number and exit.
-
-* --compile:
-  Compile a catalogue and output it in JSON from the puppet master. Uses
-  facts contained in the $vardir/yaml/ directory to compile the catalog.
-
-
-EXAMPLE
--------
-  puppet master
-
-DIAGNOSTICS
------------
-
-When running as a standalone daemon, puppet master accepts the
-following signals:
-
-* SIGHUP:
-  Restart the puppet master server.
-* SIGINT and SIGTERM:
-  Shut down the puppet master server.
-* SIGUSR2:
-  Close file descriptors for log files and reopen them. Used with logrotate.
-
-AUTHOR
-------
-Luke Kanies
-
-
-COPYRIGHT
----------
-Copyright (c) 2012 Puppet Inc., LLC Licensed under the Apache 2.0 License
-
-    HELP
-  end
-
-  def app_defaults
-    super.merge({
-      :facts_terminus => 'yaml'
-    })
-  end
-
-  def preinit
-    Signal.trap(:INT) do
-      $stderr.puts _("Canceling startup")
-      exit(0)
-    end
-
-    # save ARGV to protect us from it being smashed later by something
-    @argv = ARGV.dup
-  end
-
-  def run_command
-    if options[:node]
-      compile
-    else
-      main
-    end
-  end
-
-  def compile
-    begin
-      unless catalog = Puppet::Resource::Catalog.indirection.find(options[:node])
-        raise _("Could not compile catalog for %{node}") % { node: options[:node] }
-      end
-
-      puts JSON::pretty_generate(catalog.to_resource, :allow_nan => true, :max_nesting => false)
-    rescue => detail
-      Puppet.log_exception(detail, _("Failed to compile catalog for node %{node}: %{detail}") % { node: options[:node], detail: detail })
-      exit(30)
-    end
-    exit(0)
-  end
-
-  def main
-    require 'etc'
-    # Make sure we've got a localhost ssl cert
-    Puppet::SSL::Host.localhost
-
-    # And now configure our server to *only* hit the CA for data, because that's
-    # all it will have write access to.
-    Puppet::SSL::Host.ca_location = :only if Puppet::SSL::CertificateAuthority.ca?
-
-    if Puppet.features.root?
-      if Puppet::Type.type(:user).new(:name => Puppet[:user]).exists?
-        begin
-          Puppet::Util.chuser
-        rescue => detail
-          Puppet.log_exception(detail, _("Could not change user to %{user}: %{detail}") % { user: Puppet[:user], detail: detail })
-          exit(39)
-        end
-      else
-        Puppet.err(_("Could not change user to %{user}. User does not exist and is required to continue.") % { user: Puppet[:user] })
-        exit(74)
-      end
-    end
-
-    if options[:rack]
-      Puppet.deprecation_warning(_("The Rack Puppet master server is deprecated and will be removed in a future release. Please use Puppet Server instead. See http://links.puppet.com/deprecate-rack-webrick-servers for more information."))
-      start_rack_master
-    else
-      Puppet.deprecation_warning(_("The WEBrick Puppet master server is deprecated and will be removed in a future release. Please use Puppet Server instead. See http://links.puppet.com/deprecate-rack-webrick-servers for more information."))
-      start_webrick_master
-    end
-  end
-
-  def setup_logs
-    set_log_level
-
-    if !options[:setdest]
-      if options[:node]
-        # We are compiling a catalog for a single node with '--compile' and logging
-        # has not already been configured via '--logdest' so log to the console.
-        Puppet::Util::Log.newdestination(:console)
-      elsif !(Puppet[:daemonize] or options[:rack])
-        # We are running a webrick master which has been explicitly foregrounded
-        # and '--logdest' has not been passed, assume users want to see logging
-        # and log to the console.
-        Puppet::Util::Log.newdestination(:console)
-      else
-        # No explicit log destination has been given with '--logdest' and we're
-        # either a daemonized webrick master or running under rack, log to syslog.
-        Puppet::Util::Log.newdestination(:syslog)
-      end
-    end
-  end
-
-  def setup_terminuses
-    require 'puppet/file_serving/content'
-    require 'puppet/file_serving/metadata'
-
-    Puppet::FileServing::Content.indirection.terminus_class = :file_server
-    Puppet::FileServing::Metadata.indirection.terminus_class = :file_server
-
-    Puppet::FileBucket::File.indirection.terminus_class = :file
-  end
-
-  def setup_ssl
-    # Configure all of the SSL stuff.
-    if Puppet::SSL::CertificateAuthority.ca?
-      Puppet::SSL::Host.ca_location = :local
-      Puppet.settings.use :ca
-      Puppet::SSL::CertificateAuthority.instance
-    else
-      Puppet::SSL::Host.ca_location = :none
-    end
-    Puppet::SSL::Oids.register_puppet_oids
-    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])
-  end
-
-  # Honor the :node_cache_terminus setting if users have specified it directly.
-  # We normally want this nil as use-cases for querying nodes should be going to
-  # PuppetDB.
-  # @see PUP-6060
-  # @return [void]
-  def setup_node_cache
-    Puppet::Node.indirection.cache_class = Puppet[:node_cache_terminus]
-  end
-
-  def setup
-    raise Puppet::Error.new(_("Puppet master is not supported on Microsoft Windows")) if Puppet.features.microsoft_windows?
-
-    setup_logs
-
-    exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
-
-    Puppet.settings.use :main, :master, :ssl, :metrics
-
-    setup_terminuses
-
-    setup_node_cache
-
-    setup_ssl
-  end
-
-  private
-
-  # Start a master that will be using WeBrick.
-  #
-  # This method will block until the master exits.
-  def start_webrick_master
-    require 'puppet/network/server'
-    daemon = Puppet::Daemon.new(Puppet::Util::Pidlock.new(Puppet[:pidfile]))
-
-    daemon.argv = @argv
-    daemon.server = Puppet::Network::Server.new(Puppet[:bindaddress], Puppet[:masterport])
-    daemon.daemonize if Puppet[:daemonize]
-
-    # Setup signal traps immediately after daemonization so we clean up the daemon
-    daemon.set_signal_traps
-
-    announce_start_of_master
-
-    daemon.start
-  end
-
-  # Start a master that will be used for a Rack container.
-  #
-  # This method immediately returns the Rack handler that must be returned to
-  # the calling Rack container
-  def start_rack_master
-    require 'puppet/network/http/rack'
-
-    announce_start_of_master
-
-    return Puppet::Network::HTTP::Rack.new()
-  end
-
-  def announce_start_of_master
-    Puppet.notice _("Starting Puppet master version %{version}") % { version: Puppet.version }
-  end
-end

data/lib/puppet/bindings.rb

@@ -1,147 +0,0 @@
-# This class allows registration of named bindings that are later contributed to a layer via
-# a binding scheme.
-#
-# The intended use is for a .rb file to be placed in confdir's or module's `lib/bindings` directory structure, with a
-# name corresponding to the symbolic bindings name.
-#
-# Here are two equivalent examples, the first using chained methods (which is compact for simple cases), and the
-# second which uses a block.
-#
-# @example MyModule's lib/bindings/mymodule/default.rb
-#   Puppet::Bindings.newbindings('mymodule::default') do
-#     bind.integer.named('meaning of life').to(42)
-#   end
-#
-# @example Using blocks
-#   Puppet::Bindings.newbindings('mymodule::default') do
-#     bind do
-#       integer
-#       name 'meaning of life'
-#       to 42
-#     end
-#   end
-#
-# If access is needed to the scope, this can be declared as a block parameter.
-# @example MyModule's lib/bindings/mymodule/default.rb with scope
-#   Puppet::Bindings.newbindings('mymodule::default') do |scope|
-#     bind.integer.named('meaning of life').to("#{scope['::fqdn']} also think it is 42")
-#   end
-#
-# If late evaluation is wanted, this can be achieved by binding a puppet expression.
-# @example binding a puppet expression
-#   Puppet::Bindings.newbindings('mymodule::default') do |scope|
-#     bind.integer.named('meaning of life').to(puppet_string("${::fqdn} also think it is 42")
-#   end
-#
-# It is allowed to define methods in the block given to `newbindings`, these can be used when
-# producing bindings. (Care should naturally be taken to not override any of the already defined methods).
-# @example defining method to be used while creating bindings
-#   Puppet::Bindings.newbindings('mymodule::default') do
-#     def square(x)
-#       x * x
-#     end
-#     bind.integer.named('meaning of life squared').to(square(42))
-#   end
-#
-# For all details see {Puppet::Pops::Binder::BindingsFactory}, which is used behind the scenes.
-# @api public
-#
-class Puppet::Bindings
-  extend Enumerable
-
-  Environment = Puppet::Node::Environment
-
-  # Constructs and registers a {Puppet::Pops::Binder::Bindings::NamedBindings NamedBindings} that later can be contributed
-  # to a bindings layer in a bindings configuration via a URI. The name is symbolic, fully qualified with module name, and at least one
-  # more qualifying name (where the name `default` is used in the default bindings configuration.
-  #
-  # The given block is called with a `self` bound to an instance of {Puppet::Pops::Binder::BindingsFactory::BindingsContainerBuilder}
-  # which most notably has a `#bind` method which it turn calls a block bound to an instance of
-  # {Puppet::Pops::Binder::BindingsFactory::BindingsBuilder}.
-  # Depending on the use-case a direct chaining method calls or nested blocks may be used.
-  #
-  # @example simple bindings
-  #   Puppet::Bindings.newbindings('mymodule::default') do
-  #     bind.name('meaning of life').to(42)
-  #     bind.integer.named('port').to(8080)
-  #     bind.integer.named('apache::port').to(8080)
-  #   end
-  #
-  # The block form is more suitable for longer, more complex forms of bindings.
-  #
-  def self.newbindings(name, &block)
-    register_proc(name, block)
-  end
-
-  def self.register_proc(name, block)
-    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
-    adapter[name] = block
-  end
-
-  # Registers a named_binding under its name
-  # @param named_bindings [Puppet::Pops::Binder::Bindings::NamedBindings] The named bindings to register.
-  # @api public
-  #
-  def self.register(named_bindings)
-    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
-    adapter[named_bindings.name] = named_bindings
-  end
-
-  def self.resolve(scope, name)
-    entry = get(name)
-    return entry unless entry.is_a?(Proc)
-    named_bindings = Puppet::Pops::Binder::BindingsFactory.safe_named_bindings(name, scope, &entry).model
-    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
-    adapter[named_bindings.name] = named_bindings
-    named_bindings
-  end
-
-  # Returns the named bindings with the given name, or nil if no such bindings have been registered.
-  # @param name [String] The fully qualified name of a binding to get
-  # @return [Proc, Puppet::Pops::Binder::Bindings::NamedBindings] a Proc producing named bindings, or a named bindings directly
-  # @api public
-  #
-  def self.get(name)
-    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
-    adapter[name]
-  end
-
-  def self.[](name)
-    get(name)
-  end
-
-  # Supports Enumerable iteration (k,v) over the named bindings hash.
-  def self.each
-    adapter = NamedBindingsAdapter.adapt(Puppet.lookup(:current_environment))
-    adapter.each_pair {|k,v| yield k,v }
-  end
-
-  # A NamedBindingsAdapter holds a map of name to Puppet::Pops::Binder::Bindings::NamedBindings.
-  # It is intended to be used as an association between an Environment and named bindings.
-  #
-  class NamedBindingsAdapter < Puppet::Pops::Adaptable::Adapter
-    def initialize()
-      @named_bindings = {}
-    end
-
-    def [](name)
-      @named_bindings[name]
-    end
-
-    def has_name?(name)
-      @named_bindings.has_key?
-    end
-
-    def []=(name, value)
-      unless value.is_a?(Puppet::Pops::Binder::Bindings::NamedBindings) || value.is_a?(Proc)
-        raise ArgumentError, "Given value must be a NamedBindings, or a Proc producing one, got: #{value.class}."
-      end
-      @named_bindings[name] = value
-    end
-
-    def each_pair(&block)
-      @named_bindings.each_pair(&block)
-    end
-  end
-
-end

data/lib/puppet/configurer/downloader_factory.rb

@@ -1,34 +0,0 @@
-require 'puppet/configurer'
-
-# Factory for <tt>Puppet::Configurer::Downloader</tt> objects.
-#
-# Puppet's pluginsync facilities can be used to download modules
-# and external facts, each with a different destination directory
-# and related settings.
-#
-# @api private
-#
-class Puppet::Configurer::DownloaderFactory
-  def create_plugin_downloader(environment)
-    plugin_downloader = Puppet::Configurer::Downloader.new(
-      "plugin",
-      Puppet[:plugindest],
-      Puppet[:pluginsource],
-      Puppet[:pluginsignore],
-      environment
-    )
-  end
-
-  def create_plugin_facts_downloader(environment)
-    source_permissions = Puppet.features.microsoft_windows? ? :ignore : :use
-
-    plugin_fact_downloader = Puppet::Configurer::Downloader.new(
-      "pluginfacts",
-      Puppet[:pluginfactdest],
-      Puppet[:pluginfactsource],
-      Puppet[:pluginsignore],
-      environment,
-      source_permissions
-    )
-  end
-end