puppet 5.3.4 → 6.29.0

data/lib/puppet/face/node/clean.rb

@@ -14,6 +14,7 @@ Puppet::Face.define(:node, '0.0.1') do
 
       <Reports> - ($vardir/reports/node.domain)
 
+      NOTE: this action now cleans up certs via Puppet Server's CA API. A running server is required for certs to be cleaned.
     EOT
 
     when_invoked do |*args|
@@ -25,15 +26,9 @@ Puppet::Face.define(:node, '0.0.1') do
       # definition, and should not be modifiable beyond that.  This is one of
       # the only places left in the code that tries to manipulate it. Other
       # parts of code that handle certificates behave differently if the
-      # run_mode is master. Those other behaviors are needed for cleaning the
+      # run_mode is server. Those other behaviors are needed for cleaning the
       # certificates correctly.
-      Puppet.settings.preferred_run_mode = "master"
-
-      if Puppet::SSL::CertificateAuthority.ca?
-        Puppet::SSL::Host.ca_location = :local
-      else
-        Puppet::SSL::Host.ca_location = :none
-      end
+      Puppet.settings.preferred_run_mode = "server"
 
       Puppet::Node::Facts.indirection.terminus_class = :yaml
       Puppet::Node::Facts.indirection.cache_class = :yaml
@@ -51,12 +46,31 @@ Puppet::Face.define(:node, '0.0.1') do
     clean_reports(node)
   end
 
+  class LoggerIO
+    def debug(message)
+      Puppet.debug(message)
+    end
+
+    # Notice: For Puppet 6.x, the function below does not matter as it
+    # does not have any functionality.  But we decided to keep it here
+    # for the ease of merge up to 7.x and having the same code base.
+    def warn(message)
+      Puppet.warning(message) unless message =~ /cadir is currently configured to be inside/
+    end
+
+    def err(message)
+      Puppet.err(message) unless message =~ /^\s*Error:\s*/
+    end
+
+    def inform(message)
+      Puppet.notice(message)
+    end
+  end
+
   # clean signed cert for +host+
   def clean_cert(node)
-    if Puppet::SSL::CertificateAuthority.ca?
-      Puppet::Face[:ca, :current].revoke(node)
-      Puppet::Face[:ca, :current].destroy(node)
-      Puppet.info _("%{node} certificates removed from ca") % { node: node }
+    if Puppet.features.puppetserver_ca?
+      Puppetserver::Ca::Action::Clean.new(LoggerIO.new).run({ 'certnames' => [node] })
     else
       Puppet.info _("Not managing %{node} certs as this host is not a CA") % { node: node }
     end

data/lib/puppet/face/node.rb

@@ -32,11 +32,11 @@ Puppet::Indirector::Face.define(:node, '0.0.1') do
 
     $ puppet node find somenode.puppetlabs.lan --terminus plain --render-as yaml
 
-    Retrieve a node using the puppet master's configured ENC:
+    Retrieve a node using the Puppet Server's configured ENC:
 
-    $ puppet node find somenode.puppetlabs.lan --terminus exec --run_mode master --render-as yaml
+    $ puppet node find somenode.puppetlabs.lan --terminus exec --run_mode server --render-as yaml
 
-    Retrieve the same node from the puppet master:
+    Retrieve the same node from the Puppet Server:
 
     $ puppet node find somenode.puppetlabs.lan --terminus rest --render-as yaml
   EOT

data/lib/puppet/face/parser.rb

@@ -11,6 +11,7 @@ Puppet::Face.define(:parser, '0.0.1') do
     summary _("Validate the syntax of one or more Puppet manifests.")
     arguments _("[<manifest>] [<manifest> ...]")
     returns _("Nothing, or the first syntax error encountered.")
+
     description <<-'EOT'
       This action validates Puppet DSL syntax without compiling a catalog or
       syncing any resources. If no manifest files are provided, it will
@@ -34,42 +35,87 @@ Puppet::Face.define(:parser, '0.0.1') do
       $ cat init.pp | puppet parser validate
     EOT
     when_invoked do |*args|
-      args.pop
-      files = args
+      files = args.slice(0..-2)
+
+      parse_errors = {}
+
       if files.empty?
         if not STDIN.tty?
           Puppet[:code] = STDIN.read
-          validate_manifest
+          error = validate_manifest(nil)
+          parse_errors['STDIN'] = error if error
         else
           manifest = Puppet.lookup(:current_environment).manifest
           files << manifest
           Puppet.notice _("No manifest specified. Validating the default manifest %{manifest}") % { manifest: manifest }
         end
       end
+
       missing_files = []
+
       files.each do |file|
         if Puppet::FileSystem.exist?(file)
-          validate_manifest(file)
+          error = validate_manifest(file)
+          parse_errors[file] = error if error
         else
           missing_files << file
         end
       end
+
       unless missing_files.empty?
         raise Puppet::Error, _("One or more file(s) specified did not exist:\n%{files}") % { files: missing_files.collect {|f| " " * 3 + f + "\n"} }
       end
-      nil
+
+      parse_errors
+    end
+
+    when_rendering :console do |errors|
+      unless errors.empty?
+        errors.each { |_, error| Puppet.log_exception(error) }
+
+        exit(1)
+      end
+
+      # Prevent face_base renderer from outputting "null"
+      exit(0)
+    end
+
+    when_rendering :json do |errors|
+      unless errors.empty?
+        ignore_error_keys = [ :arguments, :environment, :node ]
+
+        data = errors.map do |file, error|
+          file_errors = error.to_h.reject { |k, _| ignore_error_keys.include?(k) }
+          [file, file_errors]
+        end.to_h
+
+        puts Puppet::Util::Json.dump(Puppet::Pops::Serialization::ToDataConverter.convert(data, rich_data: false, symbol_as_string: true), :pretty => true)
+
+        exit(1)
+      end
+
+      # Prevent face_base renderer from outputting "null"
+      exit(0)
     end
   end
 
 
   action (:dump) do
     summary _("Outputs a dump of the internal parse tree for debugging")
-    arguments "-e " + _("<source>| [<manifest> ...] ")
+    arguments "[--format <old|pn|json>] [--pretty] { -e <source> | [<templates> ...] } "
     returns _("A dump of the resulting AST model unless there are syntax or validation errors.")
     description <<-'EOT'
       This action parses and validates the Puppet DSL syntax without compiling a catalog
       or syncing any resources.
 
+      The output format can be controlled using the --format <old|pn|json> where:
+      * 'old' is the default, but now deprecated format which is not API.
+      * 'pn' is the Puppet Extended S-Expression Notation.
+      * 'json' outputs the same graph as 'pn' but with JSON syntax.
+
+      The output will be "pretty printed" when the option --pretty is given together with --format 'pn' or 'json'.
+      This option has no effect on the 'old' format.
+
       The command accepts one or more manifests (.pp) files, or an -e followed by the puppet
       source text.
       If no arguments are given, the stdin is read (unless it is attached to a terminal)
@@ -87,6 +133,14 @@ Puppet::Face.define(:parser, '0.0.1') do
       summary _("Whether or not to validate the parsed result, if no-validate only syntax errors are reported")
     end
 
+    option('--format ' + _('<old, pn, or json>')) do
+      summary _("Get result in 'old' (deprecated format), 'pn' (new format), or 'json' (new format in JSON).")
+    end
+
+    option('--pretty') do
+      summary _('Pretty print output. Only applicable together with --format pn or json')
+    end
+
     when_invoked do |*args|
       require 'puppet/pops'
       options = args.pop
@@ -99,7 +153,6 @@ Puppet::Face.define(:parser, '0.0.1') do
           raise Puppet::Error, _("No input to parse given on command line or stdin")
         end
       else
-        missing_files = []
         files = args
         available_files = files.select do |file|
           Puppet::FileSystem.exist?(file)
@@ -121,7 +174,6 @@ Puppet::Face.define(:parser, '0.0.1') do
 
   def dump_parse(source, filename, options, show_filename = true)
     output = ""
-    dumper = Puppet::Pops::Model::ModelTreeDumper.new
     evaluating_parser = Puppet::Pops::Parser::EvaluatingParser.new
     begin
       if options[:validate]
@@ -133,7 +185,19 @@ Puppet::Face.define(:parser, '0.0.1') do
       if show_filename
         output << "--- #{filename}"
       end
-      output << dumper.dump(parse_result) << "\n"
+      fmt = options[:format]
+      if fmt.nil? || fmt == 'old'
+        output << Puppet::Pops::Model::ModelTreeDumper.new.dump(parse_result) << "\n"
+      else
+        require 'puppet/pops/pn'
+        pn = Puppet::Pops::Model::PNTransformer.transform(parse_result)
+        case fmt
+        when 'json'
+          options[:pretty] ? JSON.pretty_unparse(pn.to_data) : JSON.dump(pn.to_data)
+        else
+          pn.format(options[:pretty] ? Puppet::Pops::PN::Indent.new('  ') : nil, output)
+        end
+      end
     rescue Puppet::ParseError => detail
       if show_filename
         Puppet.err("--- #{filename}")
@@ -147,15 +211,17 @@ Puppet::Face.define(:parser, '0.0.1') do
   def validate_manifest(manifest = nil)
     env = Puppet.lookup(:current_environment)
     loaders = Puppet::Pops::Loaders.new(env)
+
     Puppet.override( {:loaders => loaders } , _('For puppet parser validate')) do
       begin
         validation_environment = manifest ? env.override_with(:manifest => manifest) : env
         validation_environment.check_for_reparse
         validation_environment.known_resource_types.clear
-      rescue => detail
-        Puppet.log_exception(detail)
-        exit(1)
+      rescue Puppet::ParseError => parse_error
+        return parse_error
       end
     end
+
+    nil
   end
 end

data/lib/puppet/face/plugin.rb

@@ -1,5 +1,4 @@
 require 'puppet/face'
-require 'puppet/configurer/downloader_factory'
 require 'puppet/configurer/plugin_handler'
 
 Puppet::Face.define(:plugin, '0.0.1') do
@@ -42,9 +41,15 @@ Puppet::Face.define(:plugin, '0.0.1') do
     when_invoked do |options|
       remote_environment_for_plugins = Puppet::Node::Environment.remote(Puppet[:environment])
 
-      factory = Puppet::Configurer::DownloaderFactory.new
-      handler = Puppet::Configurer::PluginHandler.new(factory)
-      handler.download_plugins(remote_environment_for_plugins)
+      pool = Puppet.runtime[:http].pool
+      Puppet.override(:http_pool => pool) do
+        begin
+          handler = Puppet::Configurer::PluginHandler.new
+          handler.download_plugins(remote_environment_for_plugins)
+        ensure
+          pool.close
+        end
+      end
     end
 
     when_rendering :console do |value|

data/lib/puppet/face/status.rb

@@ -26,7 +26,7 @@ Puppet::Indirector::Face.define(:status, '0.0.1') do
 
     Over REST, this action will query the configured puppet master by default.
     To query other servers, including puppet agent nodes started with the
-    <--listen> option, you can set the global <--server> and <--masterport>
+    <--listen> option, you can set the global <--server> and <--serverport>
     options on the command line; note that agent nodes listen on port 8139.
   EOT
   find.short_description <<-EOT
@@ -38,7 +38,7 @@ Puppet::Indirector::Face.define(:status, '0.0.1') do
     This action requires that the server's `auth.conf` file allow find
     access to the `status` REST terminus. Puppet agent does not use this
     facility, and it is turned off by default. See
-    <https://docs.puppetlabs.com/puppet/latest/reference/config_file_auth.html>
+    <https://puppet.com/docs/puppet/latest/config_file_auth.html>
     for more details.
   EOT
   find.examples <<-'EOT'
@@ -46,6 +46,6 @@ Puppet::Indirector::Face.define(:status, '0.0.1') do
 
     $ puppet status find --terminus rest
   EOT
-  
+
   deprecate
 end

data/lib/puppet/facter_impl.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+#
+# @api private
+# Default Facter implementation that delegates to Facter API
+#
+
+module Puppet
+  class FacterImpl
+    def initialize
+      require 'facter'
+
+      setup_logging
+    end
+
+    def value(fact_name)
+      ::Facter.value(fact_name)
+    end
+
+    def add(name, &block)
+      ::Facter.add(name, &block)
+    end
+
+    def to_hash
+      ::Facter.to_hash
+    end
+
+    def clear
+      ::Facter.clear
+    end
+
+    def reset
+      ::Facter.reset
+    end
+
+    def resolve(options)
+      ::Facter.resolve(options)
+    end
+
+    def search_external(dirs)
+      ::Facter.search_external(dirs)
+    end
+
+    def search(*dirs)
+      ::Facter.search(*dirs)
+    end
+
+    def trace(value)
+      ::Facter.trace(value) if ::Facter.respond_to? :trace
+    end
+
+    def debugging(value)
+      ::Facter.debugging(value) if ::Facter.respond_to?(:debugging)
+    end
+
+    def load_external?
+      ::Facter.respond_to?(:load_external)
+    end
+
+    def load_external(value)
+      ::Facter.load_external(value) if self.load_external?
+    end
+
+    private
+
+    def setup_logging
+      return unless ::Facter.respond_to? :on_message
+
+      ::Facter.on_message do |level, message|
+        case level
+        when :trace, :debug
+          level = :debug
+        when :info
+          # Same as Puppet
+        when :warn
+          level = :warning
+        when :error
+          level = :err
+        when :fatal
+          level = :crit
+        else
+          next
+        end
+
+        Puppet::Util::Log.create(
+          {
+            :level => level,
+            :source => 'Facter',
+            :message => message
+          }
+        )
+        nil
+      end
+    end
+  end
+end

data/lib/puppet/feature/base.rb

@@ -14,28 +14,7 @@ Puppet.features.add(:posix) do
 end
 
 # We can use Microsoft Windows functions
-Puppet.features.add(:microsoft_windows) do
-  begin
-    # ruby
-    require 'Win32API' # case matters in this require!
-
-    # Note: Setting codepage here globally ensures all strings returned via
-    # WIN32OLE (Ruby's late-bound COM support) are encoded in Encoding::UTF_8
-    #
-    # Also, this does not modify the value of WIN32OLE.locale - which defaults
-    # to 2048 (at least on US English Windows) and is not listed in the MS
-    # locales table, here: https://msdn.microsoft.com/en-us/library/ms912047(v=winembedded.10).aspx
-    require 'win32ole' ; WIN32OLE.codepage = WIN32OLE::CP_UTF8
-    # gems
-    require 'win32/process'
-    require 'win32/dir'
-    require 'win32/service'
-    true
-  rescue LoadError => err
-    #TRANSLATORS "win32-process", "win32-dir", and "win32-service" are program names and should not be translated
-    warn _("Cannot run on Microsoft Windows without the win32-process, win32-dir and win32-service gems: %{err}") % { err: err } unless Puppet.features.posix?
-  end
-end
+Puppet.features.add(:microsoft_windows) { Puppet::Util::Platform.windows? }
 
 raise Puppet::Error,_("Cannot determine basic system flavour") unless Puppet.features.posix? or Puppet.features.microsoft_windows?
 
@@ -49,14 +28,14 @@ Puppet.features.add(:usage, :libs => %w{rdoc/ri/ri_paths rdoc/usage})
 Puppet.features.add(:libshadow, :libs => ["shadow"])
 
 # We're running as root.
-Puppet.features.add(:root) { require 'puppet/util/suidmanager'; Puppet::Util::SUIDManager.root? }
+Puppet.features.add(:root) do
+  require 'puppet/util/suidmanager'
+  Puppet::Util::SUIDManager.root?
+end
 
 # We have lcs diff
 Puppet.features.add :diff, :libs => %w{diff/lcs diff/lcs/hunk}
 
-# We have augeas
-Puppet.features.add(:augeas, :libs => ["augeas"])
-
 # We have OpenSSL
 Puppet.features.add(:openssl, :libs => ["openssl"])
 
@@ -83,8 +62,8 @@ Puppet.features.add(:manages_symlinks) do
           attach_function :CreateSymbolicLinkW, [:lpwstr, :lpwstr, :dword], :boolean
 
           true
-        rescue LoadError => err
-          Puppet.debug("CreateSymbolicLink is not available")
+        rescue LoadError
+          Puppet.debug { "CreateSymbolicLink is not available" }
           false
         end
       end
@@ -93,3 +72,5 @@ Puppet.features.add(:manages_symlinks) do
     WindowsSymlink.is_implemented
   end
 end
+
+Puppet.features.add(:puppetserver_ca, libs: ['puppetserver/ca', 'puppetserver/ca/action/clean'])

data/lib/puppet/feature/bolt.rb

@@ -0,0 +1,3 @@
+require 'puppet/util/feature'
+
+Puppet.features.add(:bolt, :libs => ['bolt'])

data/lib/puppet/feature/eventlog.rb

@@ -1,5 +1,5 @@
 require 'puppet/util/feature'
 
-if Puppet.features.microsoft_windows?
+if Puppet::Util::Platform.windows?
   Puppet.features.add(:eventlog)
 end

data/lib/puppet/ffi/posix/constants.rb

@@ -0,0 +1,14 @@
+require 'puppet/ffi/posix'
+
+module Puppet::FFI::POSIX
+  module Constants
+    extend FFI::Library
+  
+    # Maximum number of supplementary groups (groups
+    # that a user can be in plus its primary group)
+    # (64 + 1 primary group)
+    # Chosen a reasonable middle number from the list
+    # https://www.j3e.de/ngroups.html
+    MAXIMUM_NUMBER_OF_GROUPS = 65
+  end
+end

data/lib/puppet/ffi/posix/functions.rb

@@ -0,0 +1,24 @@
+require 'puppet/ffi/posix'
+
+module Puppet::FFI::POSIX
+  module Functions
+
+    extend FFI::Library
+
+    ffi_convention :stdcall
+
+    # https://man7.org/linux/man-pages/man3/getgrouplist.3.html
+    # int getgrouplist (
+    #   const char *user,
+    #   gid_t group,
+    #   gid_t *groups,
+    #   int *ngroups
+    # );
+    begin
+      ffi_lib FFI::Library::LIBC
+      attach_function :getgrouplist, [:string, :uint, :pointer, :pointer], :int
+    rescue FFI::NotFoundError
+      # Do nothing
+    end
+  end
+end

data/lib/puppet/ffi/posix.rb

@@ -0,0 +1,10 @@
+require 'ffi'
+
+module Puppet
+  module FFI
+    module POSIX
+      require 'puppet/ffi/posix/functions'
+      require 'puppet/ffi/posix/constants'
+    end
+  end
+end

data/lib/puppet/file_bucket/dipper.rb

@@ -16,8 +16,7 @@ class Puppet::FileBucket::Dipper
   def initialize(hash = {})
     # Emulate the XMLRPC client
     server      = hash[:Server]
-    port        = hash[:Port] || Puppet[:masterport]
-    environment = Puppet[:environment]
+    port        = hash[:Port] || Puppet[:serverport]
 
     if hash.include?(:Path)
       @local_path = hash[:Path]
@@ -46,7 +45,7 @@ class Puppet::FileBucket::Dipper
 
       # Make a HEAD request for the file so that we don't waste time
       # uploading it if it already exists in the bucket.
-      unless Puppet::FileBucket::File.indirection.head(file_bucket_path)
+      unless Puppet::FileBucket::File.indirection.head(file_bucket_path, :bucket_path => file_bucket_file.bucket_path)
         Puppet::FileBucket::File.indirection.save(file_bucket_file, dest_path)
       end
 
@@ -78,7 +77,7 @@ class Puppet::FileBucket::Dipper
           tmp_file.unlink
         end
       else
-        raise Puppet::Error, _("Please provide a file or checksum do diff with")
+        raise Puppet::Error, _("Please provide a file or checksum to diff with")
       end
     elsif file_a
       if checksum_b
@@ -127,7 +126,8 @@ class Puppet::FileBucket::Dipper
     end
 
     if restore
-      if newcontents = get_bucket_file(sum)
+      newcontents = get_bucket_file(sum)
+      if newcontents
         newsum = newcontents.checksum_data
         changed = nil
         if Puppet::FileSystem.exist?(file_handle) and ! Puppet::FileSystem.writable?(file_handle)

data/lib/puppet/file_bucket/file.rb

@@ -74,8 +74,6 @@ class Puppet::FileBucket::File
     self.new(contents)
   end
 
-  private
-
   class StringContents
     def initialize(content)
       @contents = content;

data/lib/puppet/file_serving/base.rb

@@ -1,12 +1,9 @@
 require 'puppet/file_serving'
 require 'puppet/util'
-require 'puppet/util/methodhelper'
 
 # The base class for Content and Metadata; provides common
 # functionality like the behaviour around links.
 class Puppet::FileServing::Base
-  include Puppet::Util::MethodHelper
-
   # This is for external consumers to store the source that was used
   # to retrieve the metadata.
   attr_accessor :source
@@ -22,23 +19,26 @@ class Puppet::FileServing::Base
   # Return the full path to our file.  Fails if there's no path set.
   def full_path
     if relative_path.nil? or relative_path == "" or relative_path == "."
-       full_path = path
-     else
-       full_path = File.join(path, relative_path)
-     end
+      full_path = path
+    else
+      full_path = File.join(path, relative_path)
+    end
 
-     if Puppet.features.microsoft_windows?
-       # Replace multiple slashes as long as they aren't at the beginning of a filename
-       full_path.gsub(%r{(./)/+}, '\1')
-     else
-       full_path.gsub(%r{//+}, '/')
-     end
+    if Puppet::Util::Platform.windows?
+      # Replace multiple slashes as long as they aren't at the beginning of a filename
+      full_path.gsub(%r{(./)/+}, '\1')
+    else
+      full_path.gsub(%r{//+}, '/')
+    end
   end
 
-  def initialize(path, options = {})
+  def initialize(path, links: nil, relative_path: nil, source: nil)
     self.path = path
     @links = :manage
-    set_options(options)
+
+    self.links = links if links
+    self.relative_path = relative_path if relative_path
+    self.source = source if source
   end
 
   # Determine how we deal with links.
@@ -81,6 +81,6 @@ class Puppet::FileServing::Base
   end
 
   def self.absolute?(path)
-    Puppet::Util.absolute_path?(path, :posix) or (Puppet.features.microsoft_windows? and Puppet::Util.absolute_path?(path, :windows))
+    Puppet::Util.absolute_path?(path, :posix) || (Puppet::Util::Platform.windows? && Puppet::Util.absolute_path?(path, :windows))
   end
 end

data/lib/puppet/file_serving/configuration/parser.rb

@@ -104,6 +104,8 @@ class Puppet::FileServing::Configuration::Parser
       mount = Mount::Modules.new(name)
     when "plugins"
       mount = Mount::Plugins.new(name)
+    when "scripts"
+      mount = Mount::Scripts.new(name)
     when "tasks"
       mount = Mount::Tasks.new(name)
     when "locales"

data/lib/puppet/file_serving/configuration.rb

@@ -6,6 +6,7 @@ require 'puppet/file_serving/mount/modules'
 require 'puppet/file_serving/mount/plugins'
 require 'puppet/file_serving/mount/locales'
 require 'puppet/file_serving/mount/pluginfacts'
+require 'puppet/file_serving/mount/scripts'
 require 'puppet/file_serving/mount/tasks'
 
 class Puppet::FileServing::Configuration
@@ -55,7 +56,8 @@ class Puppet::FileServing::Configuration
     raise(ArgumentError, _("Cannot find file: Invalid mount '%{mount_name}'") % { mount_name: mount_name }) unless mount_name =~ %r{^[-\w]+$}
     raise(ArgumentError, _("Cannot find file: Invalid relative path '%{path}'") % { path: path }) if path and path.split('/').include?('..')
 
-    return nil unless mount = find_mount(mount_name, request.environment)
+    mount = find_mount(mount_name, request.environment)
+    return nil unless mount
     if mount.name == "modules" and mount_name != "modules"
       # yay backward-compatibility
       path = "#{mount_name}/#{path}"
@@ -86,6 +88,8 @@ class Puppet::FileServing::Configuration
     @mounts["locales"].allow('*') if @mounts["locales"].empty?
     @mounts["pluginfacts"] ||= Mount::PluginFacts.new("pluginfacts")
     @mounts["pluginfacts"].allow('*') if @mounts["pluginfacts"].empty?
+    @mounts["scripts"] ||= Mount::Scripts.new("scripts")
+    @mounts["scripts"].allow('*') if @mounts["scripts"].empty?
     @mounts["tasks"] ||= Mount::Tasks.new("tasks")
     @mounts["tasks"].allow('*') if @mounts["tasks"].empty?
   end