puppet 5.0.0 → 6.0.0

data/lib/puppet/settings.rb

@@ -30,6 +30,7 @@ class Puppet::Settings
   require 'puppet/settings/value_translator'
   require 'puppet/settings/environment_conf'
   require 'puppet/settings/server_list_setting'
+  require 'puppet/settings/certificate_revocation_setting'
 
   # local reference for convenience
   PuppetOptionParser = Puppet::Util::CommandLine::PuppetOptionParser
@@ -255,7 +256,7 @@ class Puppet::Settings
   end
 
   def initialize_global_settings(args = [])
-    raise Puppet::DevError, "Attempting to initialize global default settings more than once!" if global_defaults_initialized?
+    raise Puppet::DevError, _("Attempting to initialize global default settings more than once!") if global_defaults_initialized?
 
     # The first two phases of the lifecycle of a puppet application are:
     # 1) Parse the command line options and handle any of them that are
@@ -451,6 +452,12 @@ class Puppet::Settings
   # Prints the contents of a config file with the available config settings, or it
   # prints a single value of a config setting.
   def print_config_options
+    if Puppet::Util::Log.sendlevel?(:info)
+      Puppet::Util::Log.newdestination(:console)
+      message = (_("Using --configprint is deprecated. Use 'puppet config <subcommand>' instead."))
+      Puppet.deprecation_warning(message)
+    end
+
     env = value(:environment)
     val = value(:configprint)
     if val == "all"
@@ -670,7 +677,8 @@ class Puppet::Settings
       :symbolic_enum   => SymbolicEnumSetting,
       :priority   => PrioritySetting,
       :autosign   => AutosignSetting,
-      :server_list => ServerListSetting
+      :server_list => ServerListSetting,
+      :certificate_revocation => CertificateRevocationSetting
   }
 
   # Create a new setting.  The value is passed in because it's used to determine
@@ -684,7 +692,7 @@ class Puppet::Settings
 
     if type = hash[:type]
       unless klass = SETTING_TYPES[type]
-        raise ArgumentError, "Invalid setting type '#{type}'"
+        raise ArgumentError, _("Invalid setting type '%{type}'") % { type: type }
       end
       hash.delete(:type)
     else
@@ -828,7 +836,7 @@ class Puppet::Settings
     when :environment
       ValuesFromEnvironmentConf.new(source.name)
     else
-      raise(Puppet::DevError, "Unknown searchpath case: #{source.type} for the #{source} settings path element.")
+      raise Puppet::DevError, _("Unknown searchpath case: %{source_type} for the %{source} settings path element.") % { source_type: source.type, source: source}
     end
   end
 
@@ -890,16 +898,16 @@ class Puppet::Settings
     section = section.to_sym
     call = []
     defs.each do |name, hash|
-      raise ArgumentError, "setting definition for '#{name}' is not a hash!" unless hash.is_a? Hash
+      raise ArgumentError, _("setting definition for '%{name}' is not a hash!") % { name: name } unless hash.is_a? Hash
 
       name = name.to_sym
       hash[:name] = name
       hash[:section] = section
-      raise ArgumentError, "Setting #{name} is already defined" if @config.include?(name)
+      raise ArgumentError, _("Setting %{name} is already defined") % { name: name } if @config.include?(name)
       tryconfig = newsetting(hash)
       if short = tryconfig.short
         if other = @shortnames[short]
-          raise ArgumentError, "Setting #{other.name} is already using short name '#{short}'"
+          raise ArgumentError, _("Setting %{name} is already using short name '%{short}'") % { name: other.name, short: short }
         end
         @shortnames[short] = tryconfig
       end
@@ -1156,9 +1164,14 @@ Generated on #{Time.now}.
       msg << " #{ref}" if ref
       Puppet.deprecation_warning(msg)
     when setting.completely_deprecated?
-      Puppet.deprecation_warning("Setting #{name} is deprecated. #{ref}", "setting-#{name}")
+      message = _("Setting %{name} is deprecated.") % { name: name }
+      message += " #{ref}"
+      Puppet.deprecation_warning(message, "setting-#{name}")
     when setting.allowed_on_commandline?
-      Puppet.deprecation_warning("Setting #{name} is deprecated in puppet.conf. #{ref}", "puppet-conf-setting-#{name}")
+      #TRANSLATORS 'puppet.conf' is a file name and should not be translated
+      message = _("Setting %{name} is deprecated in puppet.conf.") % { name: name }
+      message += " #{ref}"
+      Puppet.deprecation_warning(message, "puppet-conf-setting-#{name}")
     end
   end
 
@@ -1169,18 +1182,22 @@ Generated on #{Time.now}.
     if configured_environment == "production" && envdir && Puppet::FileSystem.exist?(envdir)
       configured_environment_path = File.join(envdir, configured_environment)
       if !Puppet::FileSystem.symlink?(configured_environment_path)
-        catalog.add_resource(
-          Puppet::Resource.new(:file,
-                               configured_environment_path,
-                               :parameters => { :ensure => 'directory' })
-        )
+        parameters = { :ensure => 'directory' }
+        unless Puppet::FileSystem.exist?(configured_environment_path)
+          parameters.merge!(:mode => '0750')
+          if Puppet.features.root?
+            parameters.merge!(:owner => Puppet[:user]) if service_user_available?
+            parameters.merge!(:group => Puppet[:group]) if service_group_available?
+          end
+        end
+        catalog.add_resource(Puppet::Resource.new(:file, configured_environment_path, :parameters => parameters))
       end
     end
   end
 
   def add_user_resources(catalog, sections)
     return unless Puppet.features.root?
-    return if Puppet.features.microsoft_windows?
+    return if Puppet::Util::Platform.windows?
     return unless self[:mkusers]
 
     @config.each do |name, setting|
@@ -1289,31 +1306,43 @@ Generated on #{Time.now}.
     # @api public
     def interpolate(name)
       setting = @defaults[name]
+      return nil unless setting
 
-      if setting
-        val = lookup(name)
-        # if we interpolate code, all hell breaks loose.
-        if name == :code
-          val
-        else
-          # Convert it if necessary
-          begin
-            val = convert(val, name)
-          rescue InterpolationError => err
-            # This happens because we don't have access to the param name when the
-            # exception is originally raised, but we want it in the message
-            raise InterpolationError, "Error converting value for param '#{name}': #{err}", err.backtrace
-          end
+      lookup_and_convert(name) do |val|
+        setting.munge(val)
+      end
+    end
 
-          setting.munge(val)
-        end
-      else
-        nil
+    def print(name)
+      setting = @defaults[name]
+      return nil unless setting
+
+      lookup_and_convert(name) do |val|
+        setting.print(val)
       end
     end
 
     private
 
+    def lookup_and_convert(name, &block)
+      val = lookup(name)
+      # if we interpolate code, all hell breaks loose.
+      if name == :code
+        val
+      else
+        # Convert it if necessary
+        begin
+          val = convert(val, name)
+        rescue InterpolationError => err
+          # This happens because we don't have access to the param name when the
+          # exception is originally raised, but we want it in the message
+          raise InterpolationError, _("Error converting value for param '%{name}': %{detail}") % { name: name, detail: err }, err.backtrace
+        end
+
+        yield val
+      end
+    end
+
     def convert(value, setting_name)
       case value
       when nil
@@ -1331,7 +1360,7 @@ Generated on #{Time.now}.
             elsif !(pval = interpolate(varname.to_sym)).nil?
               pval
             else
-              raise InterpolationError, "Could not find value for #{expression}"
+              raise InterpolationError, _("Could not find value for %{expression}") % { expression: expression }
             end
           else
             failed_environment_interpolation = true
@@ -1340,7 +1369,9 @@ Generated on #{Time.now}.
           interpolated_expression
         end
         if failed_environment_interpolation
-          Puppet.warning("You cannot interpolate $environment within '#{setting_name}' when using directory environments.  Its value will remain #{interpolated_value}.")
+          #TRANSLATORS '$environment' is a Puppet specific variable and should not be translated
+          Puppet.warning(_("You cannot interpolate $environment within '%{setting_name}' when using directory environments.") % { setting_name: setting_name } +
+                             ' ' + _("Its value will remain %{value}.") % { value: interpolated_value })
         end
         interpolated_value
       else
@@ -1371,8 +1402,7 @@ Generated on #{Time.now}.
       default = @defaults[name]
 
       if !default
-        raise ArgumentError,
-          "Attempt to assign a value to unknown setting #{name.inspect}"
+        raise ArgumentError, _("Attempt to assign a value to unknown setting %{name}") % { name: name.inspect }
       end
 
       # This little exception-handling dance ensures that a hook is
@@ -1389,7 +1419,7 @@ Generated on #{Time.now}.
         @values[name] = old_value
         raise e
       end
-     end
+    end
 
     def inspect
       %Q{<#{self.class}:#{self.object_id} @name="#{@name}" @values="#{@values}">}

data/lib/puppet/ssl/base.rb

@@ -24,7 +24,7 @@ class Puppet::SSL::Base
   end
 
   def self.wrapped_class
-    raise(Puppet::DevError, "#{self} has not declared what class it wraps") unless defined?(@wrapped_class)
+    raise(Puppet::DevError, _("%{name} has not declared what class it wraps") % { name: self }) unless defined?(@wrapped_class)
     @wrapped_class
   end
 
@@ -34,13 +34,8 @@ class Puppet::SSL::Base
 
   attr_accessor :name, :content
 
-  # Is this file for the CA?
-  def ca?
-    name == Puppet::SSL::Host.ca_name
-  end
-
   def generate
-    raise Puppet::DevError, "#{self.class} did not override 'generate'"
+    raise Puppet::DevError, _("%{class_name} did not override 'generate'") % { class_name: self.class }
   end
 
   def initialize(name)
@@ -64,8 +59,13 @@ class Puppet::SSL::Base
 
   # Create an instance of our Puppet::SSL::* class using a given instance of the wrapped class
   def self.from_instance(instance, name = nil)
-    raise ArgumentError, "Object must be an instance of #{wrapped_class}, #{instance.class} given" unless instance.is_a? wrapped_class
-    raise ArgumentError, "Name must be supplied if it cannot be determined from the instance" if name.nil? and !instance.respond_to?(:subject)
+    unless instance.is_a?(wrapped_class)
+      raise ArgumentError, _("Object must be an instance of %{class_name}, %{actual_class} given") %
+          { class_name: wrapped_class, actual_class: instance.class }
+    end
+    if name.nil? and !instance.respond_to?(:subject)
+      raise ArgumentError, _("Name must be supplied if it cannot be determined from the instance")
+    end
 
     name ||= name_from_subject(instance.subject)
     result = new(name)
@@ -81,18 +81,15 @@ class Puppet::SSL::Base
 
   # Read content from disk appropriately.
   def read(path)
-    # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest, Puppet::SSL::CertificateRevocationList
+    # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest
     # Puppet::SSL::Key uses this, but also provides its own override
     # nothing derives from Puppet::SSL::Certificate, but it is called by a number of other SSL Indirectors:
-    # Puppet::SSL::Certificate::DisabledCa (:find, :save, :destroy)
     # Puppet::Indirector::CertificateStatus::File (.indirection.find)
     # Puppet::Network::HTTP::WEBrick (.indirection.find)
     # Puppet::Network::HTTP::RackREST (.from_instance)
     # Puppet::Network::HTTP::WEBrickREST (.from_instance)
-    # Puppet::SSL::CertificateAuthority (.new, .indirection.find, .indirection.save)
     # Puppet::SSL::Host (.indirection.find)
     # Puppet::SSL::Inventory (.indirection.search, implements its own add / rebuild / serials with encoding UTF8)
-    # Puppet::SSL::CertificateAuthority::Interface (.indirection.find)
     # Puppet::SSL::Validator::DefaultValidator (.from_instance) / Puppet::SSL::Validator::NoValidator does nothing
     @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII))
   end

data/lib/puppet/ssl/certificate.rb

@@ -21,12 +21,16 @@ DOC
     [:s]
   end
 
-  def subject_alt_names
-    alts = content.extensions.find{|ext| ext.oid == "subjectAltName"}
+  def self.subject_alt_names_for(cert)
+    alts = cert.extensions.find{|ext| ext.oid == "subjectAltName"}
     return [] unless alts
     alts.value.split(/\s*,\s*/)
   end
 
+  def subject_alt_names
+    self.class.subject_alt_names_for(content)
+  end
+
   def expiration
     return nil unless content
     content.not_after

data/lib/puppet/ssl/certificate_request.rb

@@ -30,19 +30,7 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
 
   extend Puppet::Indirector
 
-  # If auto-signing is on, sign any certificate requests as they are saved.
-  module AutoSigner
-    def save(instance, key = nil)
-      super
-
-      # Try to autosign the CSR.
-      if ca = Puppet::SSL::CertificateAuthority.instance
-        ca.autosign(instance)
-      end
-    end
-  end
-
-  indirects :certificate_request, :terminus_class => :file, :extend => AutoSigner, :doc => <<DOC
+  indirects :certificate_request, :terminus_class => :file, :doc => <<DOC
     This indirection wraps an `OpenSSL::X509::Request` object, representing a certificate signing request (CSR).
     The indirection key is the certificate CN (generally a hostname).
 DOC
@@ -103,13 +91,17 @@ DOC
     raise Puppet::Error, _("CSR sign verification failed; you need to clean the certificate request for %{name} on the server") % { name: name } unless csr.verify(key.public_key)
 
     @content = csr
-    Puppet.info _("Certificate Request fingerprint (%{digest}): %{hex_digest}") % { digest: digest.name, hex_digest: digest.to_hex }
+
+    # we won't be able to get the digest on jruby
+    if @content.signature_algorithm
+      Puppet.info _("Certificate Request fingerprint (%{digest}): %{hex_digest}") % { digest: digest.name, hex_digest: digest.to_hex }
+    end
     @content
   end
 
   def ext_value_to_ruby_value(asn1_arr)
     # A list of ASN1 types than can't be directly converted to a Ruby type
-    @non_convertable ||= [OpenSSL::ASN1::EndOfContent,
+    @non_convertible ||= [OpenSSL::ASN1::EndOfContent,
                           OpenSSL::ASN1::BitString,
                           OpenSSL::ASN1::Null,
                           OpenSSL::ASN1::Enumerated,
@@ -130,7 +122,7 @@ DOC
     # type, use the original ASN1 value. This is needed to work around a bug
     # in Ruby's OpenSSL library which doesn't convert the value of unknown
     # extension OIDs properly. See PUP-3560
-    if @non_convertable.include?(asn1_val.class) then
+    if @non_convertible.include?(asn1_val.class) then
       # Allows OpenSSL to take the ASN1 value and turn it into something Ruby understands
       OpenSSL::X509::Extension.new(asn1_arr.first.value, asn1_val.to_der).value
     else
@@ -238,8 +230,6 @@ DOC
     end
   end
 
-  private
-
   PRIVATE_EXTENSIONS = [
     'subjectAltName', '2.5.29.17',
   ]
@@ -264,9 +254,17 @@ DOC
     end
 
     if options[:dns_alt_names]
-      names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
-      names = names.sort.uniq.map {|name| "DNS:#{name}" }.join(", ")
-      alt_names_ext = extension_factory.create_extension("subjectAltName", names, false)
+      raw_names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
+
+      parsed_names = raw_names.map do |name|
+        if !name.start_with?("IP:") && !name.start_with?("DNS:")
+          "DNS:#{name}"
+        else
+          name
+        end
+      end.sort.uniq.join(", ")
+
+      alt_names_ext = extension_factory.create_extension("subjectAltName", parsed_names, false)
 
       extensions << alt_names_ext
     end

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -21,7 +21,7 @@ class Puppet::SSL::CertificateRequestAttributes
   def load
     Puppet.info(_("csr_attributes file loading from %{path}") % { path: path })
     if Puppet::FileSystem.exist?(path)
-      hash = Puppet::Util::Yaml.load_file(path, {})
+      hash = Puppet::Util::Yaml.safe_load_file(path, [Symbol]) || {}
       if ! hash.is_a?(Hash)
         raise Puppet::Error, _("invalid CSR attributes, expected instance of Hash, received instance of %{klass}") % { klass: hash.class }
       end

data/lib/puppet/ssl/certificate_signer.rb

@@ -4,11 +4,22 @@
 #
 # @api private
 class Puppet::SSL::CertificateSigner
+
+  # @!attribute [r] digest
+  #   @return [OpenSSL::Digest]
+  attr_reader :digest
+
   def initialize
     if OpenSSL::Digest.const_defined?('SHA256')
       @digest = OpenSSL::Digest::SHA256
     elsif OpenSSL::Digest.const_defined?('SHA1')
       @digest = OpenSSL::Digest::SHA1
+    elsif OpenSSL::Digest.const_defined?('SHA512')
+      @digest = OpenSSL::Digest::SHA512
+    elsif OpenSSL::Digest.const_defined?('SHA384')
+      @digest = OpenSSL::Digest::SHA384
+    elsif OpenSSL::Digest.const_defined?('SHA224')
+      @digest = OpenSSL::Digest::SHA224
     else
       raise Puppet::Error,
         "No FIPS 140-2 compliant digest algorithm in OpenSSL::Digest"