puppet 5.0.0 → 6.0.0

data/lib/puppet/application/face_base.rb

@@ -24,7 +24,7 @@ class Puppet::Application::FaceBase < Puppet::Application
     else
       puts Puppet::Face[:help, :current].help(face.name)
     end
-    exit
+    exit(0)
   end
 
   attr_accessor :face, :action, :type, :arguments, :render_as

data/lib/puppet/application/facts.rb

@@ -1,4 +1,9 @@
 require 'puppet/application/indirection_base'
 
 class Puppet::Application::Facts < Puppet::Application::IndirectionBase
+  # Allows `puppet facts` actions to be run against environments that
+  # don't exist locally, such as using the `--environment` flag to make a REST
+  # request to a specific environment on a master. There is no way to set this
+  # behavior per-action, so it must be set for the face as a whole.
+  environment_mode :not_required
 end

data/lib/puppet/application/filebucket.rb

@@ -12,10 +12,14 @@ class Puppet::Application::Filebucket < Puppet::Application
 
   attr :args
 
+  def summary
+    _("Store and retrieve files in a filebucket")
+  end
+
   def help
-    <<-'HELP'
+    <<-HELP
 
-puppet-filebucket(8) -- Store and retrieve files in a filebucket
+puppet-filebucket(8) -- #{summary}
 ========
 
 SYNOPSIS
@@ -62,7 +66,8 @@ central filebucket.
 Note that 'filebucket' defaults to using a network-based filebucket
 available on the server named 'puppet'. To use this, you'll have to be
 running as a user with valid Puppet certificates. Alternatively, you can
-use your local file bucket by specifying '--local'.
+use your local file bucket by specifying '--local', or by specifying
+'--bucket' with a local path.
 
 
 OPTIONS
@@ -73,33 +78,40 @@ setting, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at
-https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
+https://puppet.com/docs/puppet/latest/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet with
 '--genconfig'.
 
+* --bucket:
+  Specify a local filebucket path. This overrides the default path
+  set in '$clientbucketdir'.
+
 * --debug:
   Enable full debugging.
 
 * --fromdate:
-  (list only) Select bucket files from 'fromdate'
+  (list only) Select bucket files from 'fromdate'.
 
 * --help:
-  Print this help message
+  Print this help message.
 
 * --local:
-  Use the local filebucket. This will use the default configuration
-  information.
+  Use the local filebucket. This uses the default configuration
+  information and the bucket located at the '$clientbucketdir'
+  setting by default. If '--bucket' is set, puppet uses that
+  path instead.
 
 * --remote:
-  Use a remote filebucket. This will use the default configuration
-  information.
+  Use a remote filebucket. This uses the default configuration
+  information and the bucket located at the '$bucketdir' setting
+  by default.
 
 * --server:
   The server to send the file to, instead of locally.
 
 * --todate:
-  (list only) Select bucket files until 'todate'
+  (list only) Select bucket files until 'todate'.
 
 * --verbose:
   Print extra information.
@@ -107,37 +119,59 @@ configuration options can also be generated by running puppet with
 * --version:
   Print version information.
 
-
-EXAMPLE
--------
+EXAMPLES
+--------
+    ## Backup a file to the filebucket, then restore it to a temporary directory
     $ puppet filebucket backup /etc/passwd
     /etc/passwd: 429b225650b912a2ee067b0a4cf1e949
     $ puppet filebucket restore /tmp/passwd 429b225650b912a2ee067b0a4cf1e949
+
     ## Diff between two files in the filebucket
     $ puppet filebucket -l diff d43a6ecaa892a1962398ac9170ea9bf2 7ae322f5791217e031dc60188f4521ef
     1a2
     > again
-    ## Diff between the file in the filebucket and the current one
+
+    ## Diff between the file in the filebucket and a local file
     $ puppet filebucket -l diff d43a6ecaa892a1962398ac9170ea9bf2 /tmp/testFile
     1a2
     > again
+
+    ## Backup a file to the filebucket and observe that it keeps each backup separate
     $ puppet filebucket -l list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+
     $ echo again >> /tmp/TestFile
+
     $ puppet filebucket -l backup /tmp/TestFile
     /tmp/TestFile: 7ae322f5791217e031dc60188f4521ef
-    $ puppet filebucket -l  list
+
+    $ puppet filebucket -l list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
     7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+
+    ## List files in a filebucket within date ranges
     $ puppet filebucket -l -f 2015-01-01 -t 2015-01-11 list
     <Empty Output>
+
     $ puppet filebucket -l -f 2015-05-10 list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
     7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+
     $ puppet filebucket -l -f "2015-05-11 09:30:00" list
     7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
+
     $ puppet filebucket -l -t "2015-05-11 09:30:00" list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    ## Manage files in a specific local filebucket
+    $ puppet filebucket -b /tmp/TestBucket backup /tmp/TestFile2
+    /tmp/TestFile2: d41d8cd98f00b204e9800998ecf8427e
+    $ puppet filebucket -b /tmp/TestBucket list
+    d41d8cd98f00b204e9800998ecf8427e 2015-05-11 09:33:22 /tmp/TestFile2
+
+    ## From a Puppet master, list files in the master bucketdir
+    $ puppet filebucket -b $(puppet config print bucketdir --section master) list
+    d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
+    7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
 
 AUTHOR
 ------
@@ -245,10 +279,18 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
     require 'puppet/file_bucket/dipper'
     begin
       if options[:local] or options[:bucket]
-        path = options[:bucket] || Puppet[:bucketdir]
+        path = options[:bucket] || Puppet[:clientbucketdir]
         @client = Puppet::FileBucket::Dipper.new(:Path => path)
       else
-        @client = Puppet::FileBucket::Dipper.new(:Server => Puppet[:server])
+        if Puppet[:server_list] && !Puppet[:server_list].empty?
+          server = Puppet[:server_list].first
+          @client = Puppet::FileBucket::Dipper.new(
+            :Server => server[0],
+            :Port => server[1]
+          )
+        else
+          @client = Puppet::FileBucket::Dipper.new(:Server => Puppet[:server])
+        end
       end
     rescue => detail
       Puppet.log_exception(detail)

data/lib/puppet/application/help.rb

@@ -1,4 +1,5 @@
 require 'puppet/application/face_base'
 
 class Puppet::Application::Help < Puppet::Application::FaceBase
+  environment_mode :not_required
 end

data/lib/puppet/application/lookup.rb

@@ -95,10 +95,14 @@ class Puppet::Application::Lookup < Puppet::Application
     setup_terminuses
   end
 
+  def summary
+    _("Interactive Hiera lookup")
+  end
+
   def help
-    <<-'HELP'
+    <<-HELP
 
-puppet-lookup(8) -- Interactive Hiera lookup
+puppet-lookup(8) -- #{summary}
 ========
 
 SYNOPSIS
@@ -147,7 +151,7 @@ You can provide multiple lookup keys to this command, but it only returns a
 value for the first found key, omitting the rest.
 
 For more details about how Hiera works, see the Hiera documentation:
-https://docs.puppet.com/puppet/latest/hiera_intro.html
+https://puppet.com/docs/puppet/latest/hiera_intro.html
 
 OPTIONS
 -------
@@ -258,7 +262,7 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
     #  raise "No node was given via the '--node' flag for the scope of the lookup.\n#{RUN_HELP}"
     #end
 
-    if (options[:sort_merge_arrays] || options[:merge_hash_arrays] || options[:prefix]) && options[:merge] != 'deep'
+    if (options[:sort_merged_arrays] || options[:merge_hash_arrays] || options[:prefix]) && options[:merge] != 'deep'
       raise _("The options %{deep_merge_opts} are only available with '--merge deep'\n%{run_help}") % { deep_merge_opts: DEEP_MERGE_OPTIONS, run_help: RUN_HELP }
     end
 
@@ -275,7 +279,7 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
       if merge == 'deep'
         merge_options = {'strategy' => 'deep',
-          'sort_merge_arrays' => !options[:sort_merge_arrays].nil?,
+          'sort_merged_arrays' => !options[:sort_merged_arrays].nil?,
           'merge_hash_arrays' => !options[:merge_hash_arrays].nil?}
 
         if options[:prefix]
@@ -331,23 +335,31 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
       Puppet.settings[:facts_terminus] = 'facter'
     end
 
-    node = Puppet::Node.indirection.find(node) unless node.is_a?(Puppet::Node) # to allow unit tests to pass a node instance
+    unless node.is_a?(Puppet::Node) # to allow unit tests to pass a node instance
+      ni = Puppet::Node.indirection
+      tc = ni.terminus_class
+      if tc == :plain || options[:compile]
+        node = ni.find(node)
+      else
+        ni.terminus_class = :plain
+        node = ni.find(node)
+        ni.terminus_class = tc
+      end
+    end
 
     fact_file = options[:fact_file]
 
     if fact_file
-      original_facts = node.parameters
       if fact_file.end_with?("json")
-        given_facts = JSON.parse(Puppet::FileSystem.read(fact_file, :encoding => 'utf-8'))
+        given_facts = Puppet::Util::Json.load(Puppet::FileSystem.read(fact_file, :encoding => 'utf-8'))
       else
-        given_facts = YAML.load(Puppet::FileSystem.read(fact_file, :encoding => 'utf-8'))
+        given_facts = Puppet::Util::Yaml.safe_load_file(fact_file)
       end
 
       unless given_facts.instance_of?(Hash)
         raise _("Incorrect formatted data in %{fact_file} given via the --facts flag") % { fact_file: fact_file }
       end
-
-      node.parameters = original_facts.merge(given_facts)
+      node.add_extra_facts(given_facts)
     end
 
     Puppet[:code] = 'undef' unless options[:compile]

data/lib/puppet/application/resource.rb

@@ -21,17 +21,21 @@ class Puppet::Application::Resource < Puppet::Application
       types << t.name.to_s
     end
     puts types.sort
-    exit
+    exit(0)
   end
 
   option("--param PARAM", "-p") do |arg|
     @extra_params << arg.to_sym
   end
 
+  def summary
+    _("The resource abstraction layer shell")
+  end
+
   def help
-    <<-'HELP'
+    <<-HELP
 
-puppet-resource(8) -- The resource abstraction layer shell
+puppet-resource(8) -- #{summary}
 ========
 
 SYNOPSIS
@@ -72,7 +76,7 @@ setting, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at
-https://docs.puppetlabs.com/puppet/latest/reference/configuration.html for the
+https://puppet.com/docs/puppet/latest/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet with
 '--genconfig'.

data/lib/puppet/application/script.rb

@@ -0,0 +1,261 @@
+require 'puppet/application'
+require 'puppet/configurer'
+require 'puppet/util/profiler/aggregate'
+require 'puppet/parser/script_compiler'
+
+class Puppet::Application::Script < Puppet::Application
+
+  option("--debug","-d")
+  option("--execute EXECUTE","-e") do |arg|
+    options[:code] = arg
+  end
+  option("--test","-t")
+  option("--verbose","-v")
+
+  option("--logdest LOGDEST", "-l") do |arg|
+    handle_logdest_arg(arg)
+  end
+
+  def summary
+    _("Run a puppet manifests as a script without compiling a catalog")
+  end
+
+  def help
+    <<-HELP
+
+puppet-script(8) -- #{summary}
+========
+
+SYNOPSIS
+--------
+Runs a puppet language script without compiling a catalog.
+
+
+USAGE
+-----
+puppet script [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
+  [-e|--execute]
+  [-l|--logdest syslog|eventlog|<FILE>|console] [--noop]
+  <file>
+
+
+DESCRIPTION
+-----------
+This is a standalone puppet script runner tool; use it to run puppet code
+without compiling a catalog.
+
+When provided with a modulepath, via command line or config file, puppet
+script can load functions, types, tasks and plans from modules.
+
+OPTIONS
+-------
+Note that any setting that's valid in the configuration
+file is also a valid long argument. For example, 'environment' is a
+valid setting, so you can specify '--environment mytest'
+as an argument.
+
+See the configuration file documentation at
+https://puppet.com/docs/puppet/latest/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet with
+'--genconfig'.
+
+* --debug:
+  Enable full debugging.
+
+* --help:
+  Print this help message
+
+
+* --logdest:
+  Where to send log messages. Choose between 'syslog' (the POSIX syslog
+  service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
+  file. Defaults to 'console'.
+
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
+
+* --noop:
+  Use 'noop' mode where Puppet runs in a no-op or dry-run mode. This
+  is useful for seeing what changes Puppet will make without actually
+  executing the changes. Applies to tasks only.
+
+* --execute:
+  Execute a specific piece of Puppet code
+
+* --verbose:
+  Print extra information.
+
+EXAMPLE
+-------
+    $ puppet script -l /tmp/manifest.log manifest.pp
+    $ puppet script --modulepath=/root/dev/modules -e 'notice("hello world")'
+
+
+AUTHOR
+------
+Henrik Lindberg
+
+
+COPYRIGHT
+---------
+Copyright (c) 2017 Puppet Inc., LLC Licensed under the Apache 2.0 License
+
+    HELP
+  end
+
+  def app_defaults
+    super.merge({
+      :default_file_terminus => :file_server,
+    })
+  end
+
+  def run_command
+    if Puppet.features.bolt?
+      Puppet.override(:bolt_executor => Bolt::Executor.new) do
+        main
+      end
+    else
+      raise _("Bolt must be installed to use the script application")
+    end
+  end
+
+  def main
+    # The tasks feature is always on
+    Puppet[:tasks] = true
+
+    # Set the puppet code or file to use.
+    if options[:code] || command_line.args.length == 0
+      Puppet[:code] = options[:code] || STDIN.read
+    else
+      manifest = command_line.args.shift
+      raise _("Could not find file %{manifest}") % { manifest: manifest } unless Puppet::FileSystem.exist?(manifest)
+      Puppet.warning(_("Only one file can be used per run. Skipping %{files}") % { files: command_line.args.join(', ') }) if command_line.args.size > 0
+    end
+
+    unless Puppet[:node_name_fact].empty?
+      # Collect the facts specified for that node
+      unless facts = Puppet::Node::Facts.indirection.find(Puppet[:node_name_value])
+        raise _("Could not find facts for %{node}") % { node: Puppet[:node_name_value] }
+      end
+
+      Puppet[:node_name_value] = facts.values[Puppet[:node_name_fact]]
+      facts.name = Puppet[:node_name_value]
+    end
+
+    # Find the Node
+    unless node = Puppet::Node.indirection.find(Puppet[:node_name_value])
+      raise _("Could not find node %{node}") % { node: Puppet[:node_name_value] }
+    end
+
+    configured_environment = node.environment || Puppet.lookup(:current_environment)
+
+    apply_environment = manifest ?
+      configured_environment.override_with(:manifest => manifest) :
+      configured_environment
+
+    # Modify the node descriptor to use the special apply_environment.
+    # It is based on the actual environment from the node, or the locally
+    # configured environment if the node does not specify one.
+    # If a manifest file is passed on the command line, it overrides
+    # the :manifest setting of the apply_environment.
+    node.environment = apply_environment
+
+    # TRANSLATION, the string "For puppet script" is not user facing
+    Puppet.override({:current_environment => apply_environment}, "For puppet script") do
+      # Merge in the facts.
+      node.merge(facts.values) if facts
+
+      # Add server facts so $server_facts[environment] exists when doing a puppet script
+      # SCRIPT TODO: May be needed when running scripts under orchestrator. Leave it for now.
+      #
+      node.add_server_facts({})
+
+      begin
+        # Compile the catalog
+
+        # When compiling, the compiler traps and logs certain errors
+        # Those that do not lead to an immediate exit are caught by the general
+        # rule and gets logged.
+        #
+        begin
+          # support the following features when evaluating puppet code
+          # * $facts with facts from host running the script
+          # * $settings with 'settings::*' namespace populated, and '$settings::all_local' hash
+          # * $trusted as setup when using puppet apply
+          # * an environment
+          #
+
+          # fixup trusted information
+          node.sanitize()
+
+          compiler = Puppet::Parser::ScriptCompiler.new(node.environment, node.name)
+          topscope = compiler.topscope
+
+          # When scripting the trusted data are always local, but set them anyway
+          topscope.set_trusted(node.trusted_data)
+
+          # Server facts are always about the local node's version etc.
+          topscope.set_server_facts(node.server_facts)
+
+          # Set $facts for the node running the script
+          facts_hash = node.facts.nil? ? {} : node.facts.values
+          topscope.set_facts(facts_hash)
+
+          # create the $settings:: variables
+          topscope.merge_settings(node.environment.name, false)
+
+          compiler.compile()
+
+        rescue Puppet::ParseErrorWithIssue, Puppet::Error
+          # already logged and handled by the compiler for these two cases
+          exit(1)
+        end
+
+        exit(0)
+      rescue => detail
+        Puppet.log_exception(detail)
+        exit(1)
+      end
+    end
+
+  ensure
+    if @profiler
+      Puppet::Util::Profiler.remove_profiler(@profiler)
+      @profiler.shutdown
+    end
+  end
+
+  def setup
+
+    exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
+
+    Puppet::Util::Log.newdestination(:console) unless options[:setdest]
+
+    Signal.trap(:INT) do
+      $stderr.puts _("Exiting")
+      exit(1)
+    end
+
+    # TODO: This skips applying the settings catalog for these settings, but
+    # the effect of doing this is unknown. It may be that it only works if there is a puppet
+    # installed where a settings catalog have already been applied...
+    # This saves 1/5th of the startup time
+
+#    Puppet.settings.use :main, :agent, :ssl
+
+    # When running a script, the catalog is not relevant, and neither is caching of it
+    Puppet::Resource::Catalog.indirection.cache_class = nil
+
+    # we do not want the last report to be persisted
+    Puppet::Transaction::Report.indirection.cache_class = nil
+
+    set_log_level
+
+    if Puppet[:profile]
+      @profiler = Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:info), "script"))
+    end
+  end
+end

data/lib/puppet/application/ssl.rb

@@ -0,0 +1,133 @@
+require 'puppet/application'
+require 'puppet/ssl/oids'
+
+class Puppet::Application::Ssl < Puppet::Application
+  def summary
+    _("Manage SSL keys and certificates for puppet SSL clients")
+  end
+
+  def help
+    <<-HELP
+puppet-ssl(8) -- #{summary}
+========
+
+SYNOPSIS
+--------
+Manage SSL keys and certificates for an SSL clients needed
+to communicate with a puppet infrastructure.
+
+USAGE
+-----
+puppet ssl <action> [--certname <NAME>]
+
+ACTIONS
+-------
+
+* submit_request:
+  Generate a certificate signing request (CSR) and submit it to the CA. If a private and
+  public key pair already exist, they will be used to generate the CSR. Otherwise a new
+  key pair will be generated. If a CSR has already been submitted with the given `certname`,
+  then the operation will fail.
+
+* download_cert:
+  Download a certificate for this host. If the current private key matches the downloaded
+  certificate, then the certificate will be saved and used for subsequent requests. If
+  there is already an existing certificate, it will be overwritten.
+
+* verify:
+  Verify the private key and certificate are present and match, verify the certificate is
+  issued by a trusted CA, and check revocation status.
+HELP
+  end
+
+  option('--certname NAME') do |arg|
+    options[:certname] = arg
+  end
+
+  def main
+    if command_line.args.empty?
+      puts help
+      exit(1)
+    end
+
+    Puppet.settings.use(:main, :agent)
+    host = Puppet::SSL::Host.new(options[:certname])
+
+    action = command_line.args.first
+    case action
+    when 'submit_request'
+      submit_request(host)
+      download_cert(host)
+    when 'download_cert'
+      download_cert(host)
+    when 'verify'
+      verify(host)
+    else
+      puts "Unknown action '#{action}'"
+      exit(1)
+    end
+
+    exit(0)
+  end
+
+  def submit_request(host)
+    host.ensure_ca_certificate
+
+    host.submit_request
+    puts "Submitted certificate request for '#{host.name}' to https://#{Puppet[:ca_server]}:#{Puppet[:ca_port]}"
+  rescue => e
+    puts "Failed to submit certificate request: #{e.message}"
+    exit(1)
+  end
+
+  def download_cert(host)
+    host.ensure_ca_certificate
+
+    puts "Downloading certificate '#{host.name}' from https://#{Puppet[:ca_server]}:#{Puppet[:ca_port]}"
+    if cert = host.download_host_certificate
+      puts "Downloaded certificate '#{host.name}' with fingerprint #{cert.fingerprint}"
+    else
+      puts "No certificate for '#{host.name}' on CA"
+    end
+  rescue => e
+    puts "Failed to download certificate: #{e.message}"
+    exit(1)
+  end
+
+  def verify(host)
+    host.ensure_ca_certificate
+
+    key = host.key
+    unless key
+      puts "The host's private key is missing"
+      exit(1)
+    end
+
+    cert = host.check_for_certificate_on_disk(host.name)
+    unless cert
+      puts "The host's certificate is missing"
+      exit(1)
+    end
+
+    if cert.content.public_key.to_pem != key.content.public_key.to_pem
+      puts "The host's key does not match the certificate"
+      exit(1)
+    end
+
+    store = host.ssl_store
+    unless store.verify(cert.content)
+      puts "Failed to verify certificate '#{host.name}': #{store.error_string} (#{store.error})"
+      exit(1)
+    end
+
+    puts "Verified certificate '#{host.name}'"
+    # store.chain.reverse.each_with_index do |issuer, i|
+    #   indent = "  " * (i+1)
+    #   puts "#{indent}#{issuer.subject.to_s}"
+    # end
+    exit(0)
+  rescue => e
+    puts "Verify failed: #{e.message}"
+    exit(1)
+  end
+end