puppet 5.3.4 → 6.29.0

data/lib/puppet/x509/cert_provider.rb

@@ -0,0 +1,355 @@
+require 'puppet/x509'
+
+# Class for loading and saving cert related objects.
+#
+# @api private
+class Puppet::X509::CertProvider
+  include Puppet::X509::PemStore
+
+  # Only allow printing ascii characters, excluding /
+  VALID_CERTNAME = /\A[ -.0-~]+\Z/
+  CERT_DELIMITERS = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
+  CRL_DELIMITERS = /-----BEGIN X509 CRL-----.*?-----END X509 CRL-----/m
+  EC_HEADER = /-----BEGIN EC PRIVATE KEY-----/
+
+  def initialize(capath: Puppet[:localcacert],
+                 crlpath: Puppet[:hostcrl],
+                 privatekeydir: Puppet[:privatekeydir],
+                 certdir: Puppet[:certdir],
+                 requestdir: Puppet[:requestdir],
+                 hostprivkey: Puppet.settings.set_by_config?(:hostprivkey) ? Puppet[:hostprivkey] : nil,
+                 hostcert: Puppet.settings.set_by_config?(:hostcert) ? Puppet[:hostcert] : nil)
+    @capath = capath
+    @crlpath = crlpath
+    @privatekeydir = privatekeydir
+    @certdir = certdir
+    @requestdir = requestdir
+    @hostprivkey = hostprivkey
+    @hostcert = hostcert
+  end
+
+  # Save `certs` to the configured `capath`.
+  #
+  # @param certs [Array<OpenSSL::X509::Certificate>] Array of CA certs to save
+  # @raise [Puppet::Error] if the certs cannot be saved
+  # @api private
+  def save_cacerts(certs)
+    save_pem(certs.map(&:to_pem).join, @capath, **permissions_for_setting(:localcacert))
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to save CA certificates to '%{capath}'") % {capath: @capath}, e)
+  end
+
+  # Load CA certs from the configured `capath`.
+  #
+  # @param required [Boolean] If true, raise if they are missing
+  # @return (see #load_cacerts_from_pem)
+  # @raise (see #load_cacerts_from_pem)
+  # @raise [Puppet::Error] if the certs cannot be loaded
+  # @api private
+  def load_cacerts(required: false)
+    pem = load_pem(@capath)
+    if !pem && required
+      raise Puppet::Error, _("The CA certificates are missing from '%{path}'") % { path: @capath }
+    end
+    pem ? load_cacerts_from_pem(pem) : nil
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to load CA certificates from '%{capath}'") % {capath: @capath}, e)
+  end
+
+  # Load PEM encoded CA certificates.
+  #
+  # @param pem [String] PEM encoded certificate(s)
+  # @return [Array<OpenSSL::X509::Certificate>] Array of CA certs
+  # @raise [OpenSSL::X509::CertificateError] The `pem` text does not contain a valid cert
+  # @api private
+  def load_cacerts_from_pem(pem)
+    # TRANSLATORS 'PEM' is an acronym and shouldn't be translated
+    raise OpenSSL::X509::CertificateError, _("Failed to parse CA certificates as PEM") if pem !~ CERT_DELIMITERS
+
+    pem.scan(CERT_DELIMITERS).map do |text|
+      OpenSSL::X509::Certificate.new(text)
+    end
+  end
+
+  # Save `crls` to the configured `crlpath`.
+  #
+  # @param crls [Array<OpenSSL::X509::CRL>] Array of CRLs to save
+  # @raise [Puppet::Error] if the CRLs cannot be saved
+  # @api private
+  def save_crls(crls)
+    save_pem(crls.map(&:to_pem).join, @crlpath, **permissions_for_setting(:hostcrl))
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to save CRLs to '%{crlpath}'") % {crlpath: @crlpath}, e)
+  end
+
+  # Load CRLs from the configured `crlpath` path.
+  #
+  # @param required [Boolean] If true, raise if they are missing
+  # @return (see #load_crls_from_pem)
+  # @raise (see #load_crls_from_pem)
+  # @raise [Puppet::Error] if the CRLs cannot be loaded
+  # @api private
+  def load_crls(required: false)
+    pem = load_pem(@crlpath)
+    if !pem && required
+      raise Puppet::Error, _("The CRL is missing from '%{path}'") % { path: @crlpath }
+    end
+    pem ? load_crls_from_pem(pem) : nil
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to load CRLs from '%{crlpath}'") % {crlpath: @crlpath}, e)
+  end
+
+  # Load PEM encoded CRL(s).
+  #
+  # @param pem [String] PEM encoded CRL(s)
+  # @return [Array<OpenSSL::X509::CRL>] Array of CRLs
+  # @raise [OpenSSL::X509::CRLError] The `pem` text does not contain a valid CRL
+  # @api private
+  def load_crls_from_pem(pem)
+    # TRANSLATORS 'PEM' is an acronym and shouldn't be translated
+    raise OpenSSL::X509::CRLError, _("Failed to parse CRLs as PEM") if pem !~ CRL_DELIMITERS
+
+    pem.scan(CRL_DELIMITERS).map do |text|
+      OpenSSL::X509::CRL.new(text)
+    end
+  end
+
+  # Return the time when the CRL was last updated.
+  #
+  # @return [Time, nil] Time when the CRL was last updated, or nil if we don't
+  #   have a CRL
+  def crl_last_update
+    stat = Puppet::FileSystem.stat(@crlpath)
+    Time.at(stat.mtime)
+  rescue Errno::ENOENT
+    nil
+  end
+
+  # Set the CRL last updated time.
+  #
+  # @param time [Time] The last updated time
+  #
+  def crl_last_update=(time)
+    Puppet::FileSystem.touch(@crlpath, mtime: time)
+  end
+
+  # Save named private key in the configured `privatekeydir`. For
+  # historical reasons, names are case insensitive.
+  #
+  # @param name [String] The private key identity
+  # @param key [OpenSSL::PKey::RSA] private key
+  # @param password [String, nil] If non-nil, derive an encryption key
+  #   from the password, and use that to encrypt the private key. If nil,
+  #   save the private key unencrypted.
+  # @raise [Puppet::Error] if the private key cannot be saved
+  # @api private
+  def save_private_key(name, key, password: nil)
+    pem = if password
+            cipher = OpenSSL::Cipher::AES.new(128, :CBC)
+            key.export(cipher, password)
+          else
+            key.to_pem
+          end
+    path = @hostprivkey || to_path(@privatekeydir, name)
+    save_pem(pem, path, **permissions_for_setting(:hostprivkey))
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to save private key for '%{name}'") % {name: name}, e)
+  end
+
+  # Load a private key from the configured `privatekeydir`. For
+  # historical reasons, names are case-insensitive.
+  #
+  # @param name [String] The private key identity
+  # @param required [Boolean] If true, raise if it is missing
+  # @param password [String, nil] If the private key is encrypted, decrypt
+  #   it using the password. If the key is encrypted, but a password is
+  #   not specified, then the key cannot be loaded.
+  # @return (see #load_private_key_from_pem)
+  # @raise (see #load_private_key_from_pem)
+  # @raise [Puppet::Error] if the private key cannot be loaded
+  # @api private
+  def load_private_key(name, required: false, password: nil)
+    path = @hostprivkey || to_path(@privatekeydir, name)
+    pem = load_pem(path)
+    if !pem && required
+      raise Puppet::Error, _("The private key is missing from '%{path}'") % { path: path }
+    end
+    pem ? load_private_key_from_pem(pem, password: password) : nil
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to load private key for '%{name}'") % {name: name}, e)
+  end
+
+  # Load a PEM encoded private key.
+  #
+  # @param pem [String] PEM encoded private key
+  # @param password [String, nil] If the private key is encrypted, decrypt
+  #   it using the password. If the key is encrypted, but a password is
+  #   not specified, then the key cannot be loaded.
+  # @return [OpenSSL::PKey::RSA, OpenSSL::PKey::EC] The private key
+  # @raise [OpenSSL::PKey::PKeyError] The `pem` text does not contain a valid key
+  # @api private
+  def load_private_key_from_pem(pem, password: nil)
+    # set a non-nil password to ensure openssl doesn't prompt
+    # but ruby 2.4.0 & 2.4.1 require at least 4 bytes due to
+    # https://github.com/ruby/openssl/commit/f38501249f33bff7ca9d208670b8cde695ea8b7b
+    # and corrected in https://github.com/ruby/openssl/commit/a896c3d1dfa090e92dec1abf8ac12843af6af721
+    password ||= '    '
+
+    # Can't use OpenSSL::PKey.read, because it's broken in MRI 2.3, doesn't exist
+    # in JRuby 9.1, and is broken in JRuby 9.2
+    begin
+      if pem =~ EC_HEADER
+        OpenSSL::PKey::EC.new(pem, password)
+      else
+        OpenSSL::PKey::RSA.new(pem, password)
+      end
+    rescue OpenSSL::PKey::PKeyError => e
+      if e.message =~ /Neither PUB key nor PRIV key/
+        raise OpenSSL::PKey::PKeyError, "Could not parse PKey: no start line"
+      else
+        raise e
+      end
+    end
+  end
+
+  # Load the private key password.
+  #
+  # @return [String, nil] The private key password as a binary string or nil
+  #   if there is none.
+  def load_private_key_password
+    Puppet::FileSystem.read(Puppet[:passfile], :encoding => Encoding::BINARY)
+  rescue Errno::ENOENT
+    nil
+  end
+
+  # Save a named client cert to the configured `certdir`.
+  #
+  # @param name [String] The client cert identity
+  # @param cert [OpenSSL::X509::Certificate] The cert to save
+  # @raise [Puppet::Error] if the client cert cannot be saved
+  # @api private
+  def save_client_cert(name, cert)
+    path = @hostcert || to_path(@certdir, name)
+    save_pem(cert.to_pem, path, **permissions_for_setting(:hostcert))
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to save client certificate for '%{name}'") % {name: name}, e)
+  end
+
+  # Load a named client cert from the configured `certdir`.
+  #
+  # @param name [String] The client cert identity
+  # @param required [Boolean] If true, raise it is missing
+  # @return (see #load_request_from_pem)
+  # @raise (see #load_client_cert_from_pem)
+  # @raise [Puppet::Error] if the client cert cannot be loaded
+  # @api private
+  def load_client_cert(name, required: false)
+    path = @hostcert || to_path(@certdir, name)
+    pem = load_pem(path)
+    if !pem && required
+      raise Puppet::Error, _("The client certificate is missing from '%{path}'") % { path: path }
+    end
+    pem ? load_client_cert_from_pem(pem) : nil
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to load client certificate for '%{name}'") % {name: name}, e)
+  end
+
+  # Load a PEM encoded certificate.
+  #
+  # @param pem [String] PEM encoded cert
+  # @return [OpenSSL::X509::Certificate] the certificate
+  # @raise [OpenSSL::X509::CertificateError] The `pem` text does not contain a valid cert
+  # @api private
+  def load_client_cert_from_pem(pem)
+    OpenSSL::X509::Certificate.new(pem)
+  end
+
+  # Create a certificate signing request (CSR).
+  #
+  # @param name [String] the request identity
+  # @param private_key [OpenSSL::PKey::RSA] private key
+  # @return [Puppet::X509::Request] The request
+  #
+  def create_request(name, private_key)
+    options = {}
+
+    if Puppet[:dns_alt_names] && Puppet[:dns_alt_names] != ''
+      options[:dns_alt_names] = Puppet[:dns_alt_names]
+    end
+
+    csr_attributes = Puppet::SSL::CertificateRequestAttributes.new(Puppet[:csr_attributes])
+    if csr_attributes.load
+      options[:csr_attributes] = csr_attributes.custom_attributes
+      options[:extension_requests] = csr_attributes.extension_requests
+    end
+
+    csr = Puppet::SSL::CertificateRequest.new(name)
+    csr.generate(private_key, options)
+  end
+
+  # Save a certificate signing request (CSR) to the configured `requestdir`.
+  #
+  # @param name [String] the request identity
+  # @param csr [OpenSSL::X509::Request] the request
+  # @raise [Puppet::Error] if the cert request cannot be saved
+  # @api private
+  def save_request(name, csr)
+    path = to_path(@requestdir, name)
+    save_pem(csr.to_pem, path, **permissions_for_setting(:hostcsr))
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to save certificate request for '%{name}'") % {name: name}, e)
+  end
+
+  # Load a named certificate signing request (CSR) from the configured `requestdir`.
+  #
+  # @param name [String] The request identity
+  # @return (see #load_request_from_pem)
+  # @raise (see #load_request_from_pem)
+  # @raise [Puppet::Error] if the cert request cannot be saved
+  # @api private
+  def load_request(name)
+    path = to_path(@requestdir, name)
+    pem = load_pem(path)
+    pem ? load_request_from_pem(pem) : nil
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to load certificate request for '%{name}'") % {name: name}, e)
+  end
+
+  # Delete a named certificate signing request (CSR) from the configured `requestdir`.
+  #
+  # @param name [String] The request identity
+  # @return [Boolean] true if the CSR was deleted
+  def delete_request(name)
+    path = to_path(@requestdir, name)
+    delete_pem(path)
+  rescue SystemCallError => e
+    raise Puppet::Error.new(_("Failed to delete certificate request for '%{name}'") % {name: name}, e)
+  end
+
+  # Load a PEM encoded certificate signing request (CSR).
+  #
+  # @param pem [String] PEM encoded request
+  # @return [OpenSSL::X509::Request] the request
+  # @raise [OpenSSL::X509::RequestError] The `pem` text does not contain a valid request
+  # @api private
+  def load_request_from_pem(pem)
+    OpenSSL::X509::Request.new(pem)
+  end
+
+  private
+
+  def to_path(base, name)
+    raise _("Certname %{name} must not contain unprintable or non-ASCII characters") % { name: name.inspect } unless name =~ VALID_CERTNAME
+    File.join(base, "#{name.downcase}.pem")
+  end
+
+  def permissions_for_setting(name)
+    setting = Puppet.settings.setting(name)
+    perm = { mode: setting.mode.to_i(8) }
+    if Puppet.features.root? && !Puppet::Util::Platform.windows?
+      perm[:owner] = setting.owner
+      perm[:group] = setting.group
+    end
+    perm
+  end
+end

data/lib/puppet/x509/pem_store.rb

@@ -0,0 +1,55 @@
+require 'puppet/x509'
+
+# Methods for managing PEM encoded files. While PEM encoded strings are
+# always ASCII, the files may contain user specified comments, so they are
+# UTF-8 encoded.
+#
+# @api private
+module Puppet::X509::PemStore
+  # Load a pem encoded object.
+  #
+  # @param path [String] file path
+  # @return [String, nil] The PEM encoded object or nil if the
+  #  path does not exist
+  # @raise [Errno::EACCES] if permission is denied
+  # @api private
+  def load_pem(path)
+    Puppet::FileSystem.read(path, encoding: 'UTF-8')
+  rescue Errno::ENOENT
+    nil
+  end
+
+  # Save pem encoded content to a file. If the file doesn't exist, it
+  # will be created. Otherwise, the file will be overwritten. In both
+  # cases the contents will be overwritten atomically so other
+  # processes don't see a partially written file.
+  #
+  # @param pem [String] The PEM encoded object to write
+  # @param path [String] The file path to write to
+  # @raise [Errno::EACCES] if permission is denied
+  # @raise [Errno::EPERM] if the operation cannot be completed
+  # @api private
+  def save_pem(pem, path, owner: nil, group: nil, mode: 0644)
+    Puppet::FileSystem.replace_file(path, mode) do |f|
+      f.set_encoding('UTF-8')
+      f.write(pem.encode('UTF-8'))
+    end
+
+    if !Puppet::Util::Platform.windows? && Puppet.features.root? && (owner || group)
+      FileUtils.chown(owner, group, path)
+    end
+  end
+
+  # Delete a pem encoded object, if it exists.
+  #
+  # @param path [String] The file path to delete
+  # @return [Boolean] Returns true if the file was deleted, false otherwise
+  # @raise [Errno::EACCES] if permission is denied
+  # @api private
+  def delete_pem(path)
+    Puppet::FileSystem.unlink(path)
+    true
+  rescue Errno::ENOENT
+    false
+  end
+end

data/lib/puppet/x509.rb

@@ -0,0 +1,7 @@
+require 'puppet'
+require 'puppet/ssl/openssl_loader'
+
+module Puppet::X509 # :nodoc:
+  require 'puppet/x509/pem_store'
+  require 'puppet/x509/cert_provider'
+end

data/lib/puppet.rb

@@ -1,15 +1,17 @@
 require 'puppet/version'
+require 'puppet/concurrent/synchronized'
 
-if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new("1.9.3")
-  raise LoadError, _("Puppet %{version} requires ruby 1.9.3 or greater.") % { version: Puppet.version }
+if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new("2.3.0")
+  raise LoadError, "Puppet #{Puppet.version} requires Ruby 2.3.0 or greater, found Ruby #{RUBY_VERSION.dup}."
 end
 
-Puppet::OLDEST_RECOMMENDED_RUBY_VERSION = '2.1.0'
+Puppet::OLDEST_RECOMMENDED_RUBY_VERSION = '2.3.0'
+
+$LOAD_PATH.extend(Puppet::Concurrent::Synchronized)
 
 # see the bottom of the file for further inclusions
 # Also see the new Vendor support - towards the end
 #
-require 'facter'
 require 'puppet/error'
 require 'puppet/util'
 require 'puppet/util/autoload'
@@ -22,6 +24,7 @@ require 'puppet/external/pson/common'
 require 'puppet/external/pson/version'
 require 'puppet/external/pson/pure'
 require 'puppet/gettext/config'
+require 'puppet/defaults'
 
 
 #------------------------------------------------------------
@@ -60,6 +63,14 @@ module Puppet
     @@settings
   end
 
+  # The puppetserver project has its own settings class that is thread-aware; this
+  # method is here to allow the puppetserver to define its own custom settings class
+  # for multithreaded puppet. It is not intended for use outside of the puppetserver
+  # implmentation.
+  def self.replace_settings_object(new_settings)
+    @@settings = new_settings
+  end
+
   # Get the value for a setting
   #
   # @param [Symbol] param the setting to retrieve
@@ -76,9 +87,6 @@ module Puppet
   require 'puppet/util/logging'
   extend Puppet::Util::Logging
 
-  # Setup facter's logging
-  Puppet::Util::Logging.setup_facter_logging!
-
   # The feature collection
   @features = Puppet::Util::Feature.new('puppet/feature')
 
@@ -87,6 +95,7 @@ module Puppet
 
   # Store a new default value.
   def self.define_settings(section, hash)
+    Puppet.deprecation_warning('The method Puppet.define_settings is deprecated and will be removed in a future release')
     @@settings.define_settings(section, hash)
   end
 
@@ -121,13 +130,14 @@ module Puppet
     Puppet::Util::RunMode[@@settings.preferred_run_mode]
   end
 
-  # Load all of the settings.
-  require 'puppet/defaults'
+  # Modify the settings with defaults defined in `initialize_default_settings` method in puppet/defaults.rb. This can
+  # be used in the initialization of new Puppet::Settings objects in the puppetserver project.
+  Puppet.initialize_default_settings!(settings)
 
   # Now that settings are loaded we have the code loaded to be able to issue
   # deprecation warnings. Warn if we're on a deprecated ruby version.
   if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new(Puppet::OLDEST_RECOMMENDED_RUBY_VERSION)
-    Puppet.deprecation_warning(_("Support for ruby version %{version} is deprecated and will be removed in a future release. See https://docs.puppet.com/puppet/latest/system_requirements.html#ruby for a list of supported ruby versions.") % { version: RUBY_VERSION })
+    Puppet.deprecation_warning(_("Support for ruby version %{version} is deprecated and will be removed in a future release. See https://puppet.com/docs/puppet/latest/system_requirements.html for a list of supported ruby versions.") % { version: RUBY_VERSION })
   end
 
   # Initialize puppet's settings. This is intended only for use by external tools that are not
@@ -137,19 +147,47 @@ module Puppet
   #
   # @api public
   # @param args [Array<String>] the command line arguments to use for initialization
+  # @param require_config [Boolean] controls loading of Puppet configuration files
+  # @param global_settings [Boolean] controls push to global context after settings object initialization
+  # @param runtime_implementations [Hash<Symbol, Object>] runtime implementations to register
   # @return [void]
-  def self.initialize_settings(args = [])
-    do_initialize_settings_for_run_mode(:user, args)
+  def self.initialize_settings(args = [], require_config = true, push_settings_globally = true, runtime_implementations = {})
+    do_initialize_settings_for_run_mode(:user, args, require_config, push_settings_globally, runtime_implementations)
+  end
+
+  def self.vendored_modules
+    dir = Puppet[:vendormoduledir]
+    if dir && File.directory?(dir)
+      Dir.entries(dir)
+        .reject { |f| f =~ /^\./ }
+        .map { |f| File.join(dir, f, "lib") }
+        .select { |d| FileTest.directory?(d) }
+    else
+      []
+    end
+  end
+  private_class_method :vendored_modules
+
+  def self.initialize_load_path
+    $LOAD_PATH.unshift(Puppet[:libdir])
+    $LOAD_PATH.concat(vendored_modules)
   end
+  private_class_method :initialize_load_path
 
   # private helper method to provide the implementation details of initializing for a run mode,
   #  but allowing us to control where the deprecation warning is issued
-  def self.do_initialize_settings_for_run_mode(run_mode, args)
-    Puppet.settings.initialize_global_settings(args)
+  def self.do_initialize_settings_for_run_mode(run_mode, args, require_config, push_settings_globally, runtime_implementations)
+    Puppet.settings.initialize_global_settings(args, require_config)
     run_mode = Puppet::Util::RunMode[run_mode]
     Puppet.settings.initialize_app_defaults(Puppet::Settings.app_defaults_for_run_mode(run_mode))
-    Puppet.push_context(Puppet.base_context(Puppet.settings), "Initial context after settings initialization")
-    Puppet::Parser::Functions.reset
+    if push_settings_globally
+      initialize_load_path
+      push_context_global(Puppet.base_context(Puppet.settings), "Initial context after settings initialization")
+      Puppet::Parser::Functions.reset
+    end
+    runtime_implementations.each_pair do |name, impl|
+      Puppet.runtime[name] = impl
+    end
   end
   private_class_method :do_initialize_settings_for_run_mode
 
@@ -157,27 +195,19 @@ module Puppet
   def self.initialize_facts
     # Add the puppetversion fact; this is done before generating the hash so it is
     # accessible to custom facts.
-    Facter.add(:puppetversion) do
+    Puppet.runtime[:facter].add(:puppetversion) do
       setcode { Puppet.version.to_s }
     end
 
-    Facter.add(:agent_specified_environment) do
+    Puppet.runtime[:facter].add(:agent_specified_environment) do
       setcode do
-        if Puppet.settings.set_by_config?(:environment)
-          Puppet[:environment]
-        end
+        Puppet.settings.set_by_cli(:environment) ||
+          Puppet.settings.set_in_section(:environment, :agent) ||
+          Puppet.settings.set_in_section(:environment, :main)
       end
     end
   end
 
-  # Create a new type.  Just proxy to the Type class.  The mirroring query
-  # code was deprecated in 2008, but this is still in heavy use.  I suppose
-  # this can count as a soft deprecation for the next dev. --daniel 2011-04-12
-  def self.newtype(name, options = {}, &block)
-    Puppet.deprecation_warning(_("Creating %{name} via Puppet.newtype is deprecated and will be removed in a future release. Use Puppet::Type.newtype instead.") % { name: name })
-    Puppet::Type.newtype(name, options, &block)
-  end
-
   # Load vendored (setup paths, and load what is needed upfront).
   # See the Vendor class for how to add additional vendored gems/code
   require "puppet/vendor"
@@ -211,13 +241,12 @@ module Puppet
 
     {
       :environments => Puppet::Environments::Cached.new(Puppet::Environments::Combined.new(*loaders)),
-      :http_pool => proc {
-        require 'puppet/network/http'
-        Puppet::Network::HTTP::NoCachePool.new
-      },
-      :ssl_host => proc { Puppet::SSL::Host.localhost },
-      :certificate_revocation => proc { Puppet[:certificate_revocation] },
-      :plugins => proc { Puppet::Plugins::Configuration.load_plugins }
+      :http_pool => proc { Puppet.runtime[:http].pool },
+      :ssl_context => proc { Puppet.runtime[:http].default_ssl_context },
+      :ssl_host => proc { Puppet::SSL::Host.localhost(true) },
+      :http_session => proc { Puppet.runtime[:http].create_session },
+      :plugins => proc { Puppet::Plugins::Configuration.load_plugins },
+      :rich_data => false
     }
   end
 
@@ -239,6 +268,14 @@ module Puppet
     @context.push(overrides, description)
   end
 
+  # Push something onto the the context and make it global across threads. This
+  # has the potential to convert threadlocal overrides earlier on the stack into
+  # global overrides.
+  # @api private
+  def self.push_context_global(overrides, description = '')
+    @context.unsafe_push_global(overrides, description)
+  end
+
   # Return to the previous context.
   # @raise [StackUnderflow] if the current context is the root
   # @api private
@@ -282,10 +319,17 @@ module Puppet
     @context.rollback(name)
   end
 
+  def self.runtime
+    @runtime
+  end
+
   require 'puppet/node'
 
   # The single instance used for normal operation
   @context = Puppet::Context.new(bootstrap_context)
+
+  require 'puppet/runtime'
+  @runtime = Puppet::Runtime.instance
 end
 
 # This feels weird to me; I would really like for us to get to a state where there is never a "require" statement
@@ -298,6 +342,7 @@ require 'puppet/type'
 require 'puppet/resource'
 require 'puppet/parser'
 require 'puppet/network'
+require 'puppet/x509'
 require 'puppet/ssl'
 require 'puppet/module'
 require 'puppet/data_binding'
@@ -305,3 +350,5 @@ require 'puppet/util/storage'
 require 'puppet/status'
 require 'puppet/file_bucket/file'
 require 'puppet/plugins/configuration'
+require 'puppet/pal/pal_api'
+require 'puppet/node/facts'

data/lib/puppet_pal.rb

@@ -0,0 +1,8 @@
+# Puppet as a Library "PAL"
+# This is the entry point when using PAL as a standalone library.
+#
+# This requires all of puppet because 'settings' and many other things are still required in PAL.
+# Eventually that will not be the case.
+#
+require 'puppet'
+require 'puppet/pal/pal_api'