puppet 5.0.0 → 6.0.0

data/lib/puppet/face/certificate.rb

@@ -1,165 +0,0 @@
-require 'puppet/indirector/face'
-require 'puppet/ssl/host'
-
-Puppet::Indirector::Face.define(:certificate, '0.0.1') do
-  copyright "Puppet Inc.", 2011
-  license   _("Apache 2 license; see COPYING")
-
-  summary _("Provide access to the CA for certificate management.")
-  description <<-EOT
-    This subcommand interacts with a local or remote Puppet certificate
-    authority. Currently, its behavior is not a full superset of `puppet
-    cert`; specifically, it is unable to mimic puppet cert's "clean" option,
-    and its "generate" action submits a CSR rather than creating a
-    signed certificate.
-  EOT
-
-  option "--ca-location " + _("LOCATION") do
-    required
-    summary _("Which certificate authority to use (local or remote).")
-    description <<-EOT
-      Whether to act on the local certificate authority or one provided by a
-      remote puppet master. Allowed values are 'local' and 'remote.'
-
-      This option is required.
-    EOT
-
-    before_action do |action, args, options|
-      unless [:remote, :local, :only].include? options[:ca_location].to_sym
-        raise ArgumentError, _("Valid values for ca-location are 'remote', 'local', 'only'.")
-      end
-      Puppet::SSL::Host.ca_location = options[:ca_location].to_sym
-    end
-  end
-
-  action :generate do
-    summary _("Generate a new certificate signing request.")
-    arguments _("<host>")
-    returns "Nothing."
-    description <<-EOT
-      Generates and submits a certificate signing request (CSR) for the
-      specified host. This CSR will then have to be signed by a user
-      with the proper authorization on the certificate authority.
-
-      Puppet agent usually handles CSR submission automatically. This action is
-      primarily useful for requesting certificates for individual users and
-      external applications.
-    EOT
-    examples <<-EOT
-      Request a certificate for "somenode" from the site's CA:
-
-      $ puppet certificate generate somenode.puppetlabs.lan --ca-location remote
-    EOT
-
-    # Duplicate the option here explicitly to distinguish if it was passed arg
-    # us vs. set in the config file.
-    option "--dns-alt-names "+ _("NAMES") do
-      summary _("Additional DNS names to add to the certificate request")
-      description Puppet.settings.setting(:dns_alt_names).desc
-    end
-
-    when_invoked do |name, options|
-      host = Puppet::SSL::Host.new(name)
-
-      # We have a weird case where we have --dns_alt_names from Puppet, but
-      # this option is --dns-alt-names. Until we can get rid of --dns-alt-names
-      # or do a global tr('-', '_'), we have to support both.
-      # In supporting both, we'll use Puppet[:dns_alt_names] if specified on
-      # command line. We'll use options[:dns_alt_names] if specified on
-      # command line. If both specified, we'll fail.
-      # jeffweiss 17 april 2012
-
-      global_setting_from_cli = Puppet.settings.set_by_cli?(:dns_alt_names) == true
-      raise ArgumentError, _("Can't specify both --dns_alt_names and --dns-alt-names") if options[:dns_alt_names] and global_setting_from_cli
-      options[:dns_alt_names] = Puppet[:dns_alt_names] if global_setting_from_cli
-
-      # If dns_alt_names are specified via the command line, we will always add
-      # them. Otherwise, they will default to the config file setting iff this
-      # cert is for the host we're running on.
-
-      unless Puppet::FileSystem.exist?(Puppet[:hostcert])
-        Puppet.push_context({:ssl_host => host})
-      end
-
-      host.generate_certificate_request(:dns_alt_names => options[:dns_alt_names])
-    end
-  end
-
-  action :list do
-    summary _("List all certificate signing requests.")
-    returns <<-EOT
-      An array of #inspect output from CSR objects. This output is
-      currently messy, but does contain the names of nodes requesting
-      certificates. This action returns #inspect strings even when used
-      from the Ruby API.
-    EOT
-
-    when_invoked do |options|
-      Puppet::SSL::Host.indirection.search("*", {
-        :for => :certificate_request,
-      }).map { |h| h.inspect }
-    end
-  end
-
-  action :sign do
-    summary _("Sign a certificate signing request for HOST.")
-    arguments _("<host>")
-    returns <<-EOT
-      A string that appears to be (but isn't) an x509 certificate.
-    EOT
-    examples <<-EOT
-      Sign somenode.puppetlabs.lan's certificate:
-
-      $ puppet certificate sign somenode.puppetlabs.lan --ca-location remote
-    EOT
-
-    option("--[no-]allow-dns-alt-names") do
-      summary _("Whether or not to accept DNS alt names in the certificate request")
-    end
-
-    when_invoked do |name, options|
-      host = Puppet::SSL::Host.new(name)
-      if Puppet::SSL::Host.ca_location == :remote
-        if options[:allow_dns_alt_names]
-          raise ArgumentError, _("--allow-dns-alt-names may not be specified with a remote CA")
-        end
-
-        host.desired_state = 'signed'
-        Puppet::SSL::Host.indirection.save(host)
-      else
-        # We have to do this case manually because we need to specify
-        # allow_dns_alt_names.
-        unless ca = Puppet::SSL::CertificateAuthority.instance
-          raise ArgumentError, _("This process is not configured as a certificate authority")
-        end
-
-        signing_options = {allow_dns_alt_names: options[:allow_dns_alt_names]}
-
-        ca.sign(name, signing_options)
-      end
-    end
-  end
-
-  # Indirector action doc overrides
-  find = get_action(:find)
-  find.summary _("Retrieve a certificate.")
-  find.arguments _("<host>")
-  find.render_as = :s
-  find.returns <<-EOT
-    An x509 SSL certificate.
-
-    Note that this action has a side effect of caching a copy of the
-    certificate in Puppet's `ssldir`.
-  EOT
-
-  destroy = get_action(:destroy)
-  destroy.summary _("Delete a certificate.")
-  destroy.arguments _("<host>")
-  destroy.returns "Nothing."
-  destroy.description <<-EOT
-    Deletes a certificate. This action currently only works on the local CA.
-  EOT
-
-  deactivate_action(:search)
-  deactivate_action(:save)
-end

data/lib/puppet/face/certificate_request.rb

@@ -1,56 +0,0 @@
-require 'puppet/indirector/face'
-
-Puppet::Indirector::Face.define(:certificate_request, '0.0.1') do
-  copyright "Puppet Inc.", 2011
-  license   "Apache 2 license; see COPYING"
-
-  summary "Manage certificate requests."
-  description <<-EOT
-    This subcommand retrieves and submits certificate signing requests (CSRs).
-  EOT
-
-  deactivate_action(:destroy)
-
-  find = get_action(:find)
-  find.summary "Retrieve a single CSR."
-  find.arguments "[<host>]"
-  find.render_as = :s
-  find.returns <<-EOT
-    A single certificate request. When used from the Ruby API, returns a
-    Puppet::SSL::CertificateRequest object.
-
-    Defaults to the current nodes certname.
-  EOT
-  find.examples <<-EOT
-    Retrieve a single CSR from the puppet master's CA:
-
-    $ puppet certificate_request find somenode.puppetlabs.lan --terminus rest
-  EOT
-
-  search = get_action(:search)
-  search.summary "Retrieve all outstanding CSRs."
-  search.arguments "<dummy_text>"
-  search.render_as = :s
-  search.returns <<-EOT
-    A list of certificate requests. When used from the Ruby API, returns an
-    array of Puppet::SSL::CertificateRequest objects.
-  EOT
-  search.short_description <<-EOT
-    Retrieves all outstanding certificate signing requests. Due to a known bug,
-    this action requires a dummy search key, the content of which is irrelevant.
-  EOT
-  search.notes <<-EOT
-    Although this action always returns all CSRs, it requires a dummy search
-    key; this is a known bug.
-  EOT
-  search.examples <<-EOT
-    Retrieve all CSRs from the local CA (similar to 'puppet cert list'):
-
-    $ puppet certificate_request search x --terminus ca
-  EOT
-
-  get_action(:save).summary "API only: submit a certificate signing request."
-  get_action(:save).arguments "<x509_CSR>"
-
-  deprecate
-end

data/lib/puppet/face/certificate_revocation_list.rb

@@ -1,56 +0,0 @@
-require 'puppet/indirector/face'
-
-Puppet::Indirector::Face.define(:certificate_revocation_list, '0.0.1') do
-  copyright "Puppet Inc.", 2011
-  license   "Apache 2 license; see COPYING"
-
-  summary "Manage the list of revoked certificates."
-  description <<-EOT
-    This subcommand is primarily for retrieving the certificate revocation
-    list from the CA.
-  EOT
-
-  find = get_action(:find)
-  find.summary "Retrieve the certificate revocation list."
-  find.render_as = :s
-  find.returns <<-EOT
-    The certificate revocation list. When used from the Ruby API: returns an
-    OpenSSL::X509::CRL object.
-  EOT
-  find.short_description <<-EOT
-    Retrieves the certificate revocation list.
-  EOT
-  find.notes <<-EOT
-    Although this action always returns the CRL from the specified terminus.
-  EOT
-  find.examples <<-EXAMPLES
-    Retrieve a copy of the puppet master's CRL:
-
-    $ puppet certificate_revocation_list find --terminus rest
-  EXAMPLES
-
-  destroy = get_action(:destroy)
-  destroy.summary "Delete the certificate revocation list."
-  destroy.arguments "<dummy_text>"
-  destroy.returns "Nothing."
-  destroy.description <<-EOT
-    Deletes the certificate revocation list. This cannot be done over REST, but
-    it is possible to delete the locally cached copy or the local CA's copy of
-    the CRL.
-  EOT
-  destroy.short_description <<-EOT
-    Deletes the certificate revocation list. This cannot be done over REST, but
-    it is possible to delete the locally cached copy or the local CA's copy of
-    the CRL. Due to a known bug, this action requires a dummy argument, the
-    content of which is irrelevant.
-  EOT
-  destroy.notes <<-EOT
-    Although this action always deletes the CRL from the specified terminus, it
-    requires a dummy argument; this is a known bug.
-  EOT
-
-  deactivate_action(:search)
-  deactivate_action(:save)
-
-  deprecate
-end

data/lib/puppet/feature/rack.rb

@@ -1,19 +0,0 @@
-require 'puppet/util/feature'
-
-# See if we have rack available, an HTTP Application Stack
-# Explicitly depend on rack library version >= 1.0.0
-Puppet.features.add(:rack) do
-  require 'rack'
-
-  if ! (defined?(::Rack) and defined?(::Rack.release))
-    false
-  else
-    major_version = ::Rack.release.split('.')[0].to_i
-    if major_version >= 1
-      true
-    else
-      false
-    end
-  end
-end
-

data/lib/puppet/graph/random_prioritizer.rb

@@ -1,16 +0,0 @@
-# Assign a random priority to items.
-#
-# @api private
-class Puppet::Graph::RandomPrioritizer < Puppet::Graph::Prioritizer
-  def generate_priority_for(key)
-    if priority_of(key).nil?
-      record_priority_for(key, SecureRandom.uuid)
-    else
-      priority_of(key)
-    end
-  end
-
-  def generate_priority_contained_in(container, key)
-    generate_priority_for(key)
-  end
-end

data/lib/puppet/graph/title_hash_prioritizer.rb

@@ -1,16 +0,0 @@
-# Prioritize keys, which must be Puppet::Resources, based on a static hash of
-# the key's ref. This prioritizer does not take containment into account.
-#
-# @api private
-require 'digest/sha1'
-
-class Puppet::Graph::TitleHashPrioritizer < Puppet::Graph::Prioritizer
-  def generate_priority_for(resource)
-    record_priority_for(resource,
-                        Digest::SHA1.hexdigest("NaCl, MgSO4 (salts) and then #{resource.ref}"))
-  end
-
-  def generate_priority_contained_in(container, resource)
-    generate_priority_for(resource)
-  end
-end

data/lib/puppet/indirector/certificate/ca.rb

@@ -1,9 +0,0 @@
-require 'puppet/indirector/ssl_file'
-require 'puppet/ssl/certificate'
-
-class Puppet::SSL::Certificate::Ca < Puppet::Indirector::SslFile
-  desc "Manage the CA collection of signed SSL certificates on disk."
-
-  store_in :signeddir
-  store_ca_at :cacert
-end

data/lib/puppet/indirector/certificate/disabled_ca.rb

@@ -1,22 +0,0 @@
-require 'puppet/indirector/code'
-require 'puppet/ssl/certificate'
-
-class Puppet::SSL::Certificate::DisabledCa < Puppet::Indirector::Code
-  desc "Manage SSL certificates on disk, but reject any remote access
-to the SSL data store.  Used when a master has an explicitly disabled
-CA to prevent clients getting confusing 'success' behaviour."
-
-  def initialize
-    @file = Puppet::SSL::Certificate.indirection.terminus(:file)
-  end
-
-  [:find, :head, :search, :save, :destroy].each do |name|
-    define_method(name) do |request|
-      if request.remote?
-        raise Puppet::Error, _("this master is not a CA")
-      else
-        @file.send(name, request)
-      end
-    end
-  end
-end

data/lib/puppet/indirector/certificate_request/ca.rb

@@ -1,22 +0,0 @@
-require 'puppet/indirector/ssl_file'
-require 'puppet/ssl/certificate_request'
-
-class Puppet::SSL::CertificateRequest::Ca < Puppet::Indirector::SslFile
-  desc "Manage the CA collection of certificate requests on disk."
-
-  store_in :csrdir
-
-  def save(request)
-    if host = Puppet::SSL::Host.indirection.find(request.key)
-      if Puppet[:allow_duplicate_certs]
-        Puppet.notice _("%{request} already has a %{host} certificate; new certificate will overwrite it") % { request: request.key, host: host.state }
-      else
-        raise _("%{request} already has a %{host} certificate; ignoring certificate request") % { request: request.key, host: host.state }
-      end
-    end
-
-    result = super
-    Puppet.notice _("%{request} has a waiting certificate request") % { request: request.key }
-    result
-  end
-end

data/lib/puppet/indirector/certificate_request/disabled_ca.rb

@@ -1,22 +0,0 @@
-require 'puppet/indirector/code'
-require 'puppet/ssl/certificate_request'
-
-class Puppet::SSL::CertificateRequest::DisabledCa < Puppet::Indirector::Code
-  desc "Manage SSL certificate requests on disk, but reject any remote access
-to the SSL data store. Used when a master has an explicitly disabled CA to
-prevent clients getting confusing 'success' behaviour."
-
-  def initialize
-    @file = Puppet::SSL::CertificateRequest.indirection.terminus(:file)
-  end
-
-  [:find, :head, :search, :save, :destroy].each do |name|
-    define_method(name) do |request|
-      if request.remote?
-        raise Puppet::Error, _("this master is not a CA")
-      else
-        @file.send(name, request)
-      end
-    end
-  end
-end

data/lib/puppet/indirector/certificate_revocation_list/ca.rb

@@ -1,8 +0,0 @@
-require 'puppet/indirector/ssl_file'
-require 'puppet/ssl/certificate_revocation_list'
-
-class Puppet::SSL::CertificateRevocationList::Ca < Puppet::Indirector::SslFile
-  desc "Manage the CA collection of certificate requests on disk."
-
-  store_at :cacrl
-end

data/lib/puppet/indirector/certificate_revocation_list/disabled_ca.rb

@@ -1,22 +0,0 @@
-require 'puppet/indirector/code'
-require 'puppet/ssl/certificate_revocation_list'
-
-class Puppet::SSL::CertificateRevocationList::DisabledCa < Puppet::Indirector::Code
-  desc "Manage SSL certificate revocation lists, but reject any remote access
-to the SSL data store. Used when a master has an explicitly disabled CA to
-prevent clients getting confusing 'success' behaviour."
-
-  def initialize
-    @file = Puppet::SSL::CertificateRevocationList.indirection.terminus(:file)
-  end
-
-  [:find, :head, :search, :save, :destroy].each do |name|
-    define_method(name) do |request|
-      if request.remote?
-        raise Puppet::Error, _("this master is not a CA")
-      else
-        @file.send(name, request)
-      end
-    end
-  end
-end

data/lib/puppet/indirector/certificate_revocation_list/file.rb

@@ -1,8 +0,0 @@
-require 'puppet/indirector/ssl_file'
-require 'puppet/ssl/certificate_revocation_list'
-
-class Puppet::SSL::CertificateRevocationList::File < Puppet::Indirector::SslFile
-  desc "Manage the global certificate revocation list."
-
-  store_at :hostcrl
-end

data/lib/puppet/indirector/certificate_revocation_list/rest.rb

@@ -1,10 +0,0 @@
-require 'puppet/ssl/certificate_revocation_list'
-require 'puppet/indirector/rest'
-
-class Puppet::SSL::CertificateRevocationList::Rest < Puppet::Indirector::REST
-  desc "Find and save certificate revocation lists over HTTP via REST."
-
-  use_server_setting(:ca_server)
-  use_port_setting(:ca_port)
-  use_srv_service(:ca)
-end

data/lib/puppet/indirector/certificate_status/file.rb

@@ -1,91 +0,0 @@
-require 'puppet'
-require 'puppet/indirector/certificate_status'
-require 'puppet/ssl/certificate'
-require 'puppet/ssl/certificate_authority'
-require 'puppet/ssl/certificate_request'
-require 'puppet/ssl/host'
-require 'puppet/ssl/key'
-
-class Puppet::Indirector::CertificateStatus::File < Puppet::Indirector::Code
-
-  desc "Manipulate certificate status on the local filesystem. Only functional
-    on the CA."
-
-  def ca
-    raise ArgumentError, _("This process is not configured as a certificate authority") unless Puppet::SSL::CertificateAuthority.ca?
-    Puppet::SSL::CertificateAuthority.new
-  end
-
-  def destroy(request)
-    deleted = []
-    [
-      Puppet::SSL::Certificate,
-      Puppet::SSL::CertificateRequest,
-      Puppet::SSL::Key,
-    ].collect do |part|
-      if part.indirection.destroy(request.key)
-        deleted << "#{part}"
-      end
-    end
-
-    return _("Nothing was deleted") if deleted.empty?
-    _("Deleted for %{request}: %{deleted}") % { request: request.key, deleted: deleted.join(", ") }
-  end
-
-  def save(request)
-    if request.instance.desired_state == "signed"
-      certificate_request = Puppet::SSL::CertificateRequest.indirection.find(request.key)
-      raise Puppet::Error, _("Cannot sign for host %{request} without a certificate request") % { request: request.key } unless certificate_request
-      ca.sign(request.key)
-    elsif request.instance.desired_state == "revoked"
-      certificate = Puppet::SSL::Certificate.indirection.find(request.key)
-      raise Puppet::Error, _("Cannot revoke host %{request} because has it doesn't have a signed certificate") % { request: request.key } unless certificate
-      ca.revoke(request.key)
-    else
-      raise Puppet::Error, _("State %{state} invalid; Must specify desired state of 'signed' or 'revoked' for host %{request}") % { state: request.instance.desired_state, request: request.key }
-    end
-
-  end
-
-  def search(request)
-    # Support historic interface wherein users provide classes to filter
-    # the search.  When used via the REST API, the arguments must be
-    # a Symbol or an Array containing Symbol objects.
-    klasses = case request.options[:for]
-    when Class
-      [request.options[:for]]
-    when nil
-      [
-        Puppet::SSL::Certificate,
-        Puppet::SSL::CertificateRequest,
-        Puppet::SSL::Key,
-      ]
-    else
-      [request.options[:for]].flatten.map do |klassname|
-        indirection.class.model(klassname.to_sym)
-      end
-    end
-
-    klasses.collect do |klass|
-      klass.indirection.search(request.key, request.options)
-    end.flatten.collect do |result|
-      result.name
-    end.uniq.collect &Puppet::SSL::Host.method(:new)
-  end
-
-  def find(request)
-    ssl_host = Puppet::SSL::Host.new(request.key)
-    public_key = Puppet::SSL::Certificate.indirection.find(request.key)
-
-    if ssl_host.certificate_request || public_key
-      ssl_host
-    else
-      nil
-    end
-  end
-
-  def validate_key(request)
-    # We only use desired_state from the instance and use request.key
-    # otherwise, so the name does not need to match
-  end
-end

data/lib/puppet/indirector/certificate_status/rest.rb

@@ -1,11 +0,0 @@
-require 'puppet/ssl/host'
-require 'puppet/indirector/rest'
-require 'puppet/indirector/certificate_status'
-
-class Puppet::Indirector::CertificateStatus::Rest < Puppet::Indirector::REST
-  desc "Sign, revoke, search for, or clean certificates & certificate requests over HTTP."
-
-  use_server_setting(:ca_server)
-  use_port_setting(:ca_port)
-  use_srv_service(:ca)
-end

data/lib/puppet/indirector/certificate_status.rb

@@ -1,4 +0,0 @@
-require 'puppet/indirector'
-
-class Puppet::Indirector::CertificateStatus
-end

data/lib/puppet/indirector/key/ca.rb

@@ -1,16 +0,0 @@
-require 'puppet/indirector/ssl_file'
-require 'puppet/ssl/key'
-
-class Puppet::SSL::Key::Ca < Puppet::Indirector::SslFile
-  desc "Manage the CA's private key on disk. This terminus works with the
-    CA key *only*, because that's the only key that the CA ever interacts
-    with."
-
-  store_in :privatekeydir
-
-  store_ca_at :cakey
-
-  def allow_remote_requests?
-    false
-  end
-end

data/lib/puppet/indirector/key/disabled_ca.rb

@@ -1,22 +0,0 @@
-require 'puppet/indirector/code'
-require 'puppet/ssl/key'
-
-class Puppet::SSL::Key::DisabledCa < Puppet::Indirector::Code
-  desc "Manage the CA private key, but reject any remote access
-to the SSL data store. Used when a master has an explicitly disabled CA to
-prevent clients getting confusing 'success' behaviour."
-
-  def initialize
-    @file = Puppet::SSL::Key.indirection.terminus(:file)
-  end
-
-  [:find, :head, :search, :save, :destroy].each do |name|
-    define_method(name) do |request|
-      if request.remote?
-        raise Puppet::Error, _("this master is not a CA")
-      else
-        @file.send(name, request)
-      end
-    end
-  end
-end