puppet 5.3.4 → 6.29.0

data/lib/puppet/ssl/verifier.rb

@@ -0,0 +1,140 @@
+require 'puppet/ssl'
+
+# Verify an SSL connection.
+#
+# @api private
+class Puppet::SSL::Verifier
+
+  FIVE_MINUTES_AS_SECONDS = 5 * 60
+
+  attr_reader :ssl_context
+
+  # Create a verifier using an `ssl_context`.
+  #
+  # @param hostname [String] FQDN of the server we're attempting to connect to
+  # @param ssl_context [Puppet::SSL::SSLContext] ssl_context containing CA certs,
+  #   CRLs, etc needed to verify the server's certificate chain
+  def initialize(hostname, ssl_context)
+    @hostname = hostname
+    @ssl_context = ssl_context
+  end
+
+  # Return true if `self` is reusable with `verifier` meaning they
+  # are using the same `ssl_context`, so there's no loss of security
+  # when using a cached connection.
+  #
+  # @param verifier [Puppet::SSL::Verifier] the verifier to compare against
+  # @return [Boolean] return true if a cached connection can be used, false otherwise
+  def reusable?(verifier)
+    verifier.instance_of?(self.class) &&
+      verifier.ssl_context.object_id == @ssl_context.object_id
+  end
+
+  # Configure the `http` connection based on the current `ssl_context`.
+  #
+  # @param http [Net::HTTP] connection
+  # @api private
+  def setup_connection(http)
+    http.cert_store = @ssl_context[:store]
+    http.cert = @ssl_context[:client_cert]
+    http.key = @ssl_context[:private_key]
+    # default to VERIFY_PEER
+    http.verify_mode = if !@ssl_context[:verify_peer]
+                         OpenSSL::SSL::VERIFY_NONE
+                       else
+                         OpenSSL::SSL::VERIFY_PEER
+                       end
+    http.verify_callback = self
+  end
+
+  # This method is called if `Net::HTTP#start` raises an exception, which
+  # could be a result of an openssl error during cert verification, due
+  # to ruby's `Socket#post_connection_check`, or general SSL connection
+  # error.
+  #
+  # @param http [Net::HTTP] connection
+  # @param error [OpenSSL::SSL::SSLError] connection error
+  # @raise [Puppet::SSL::CertVerifyError] SSL connection failed due to a
+  #   verification error with the server's certificate or chain
+  # @raise [Puppet::Error] server hostname does not match certificate
+  # @raise [OpenSSL::SSL::SSLError] low-level SSL connection failure
+  # @api private
+  def handle_connection_error(http, error)
+    raise @last_error if @last_error
+
+    # ruby can pass SSL validation but fail post_connection_check
+    peer_cert = http.peer_cert
+    if peer_cert && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
+      raise Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+    else
+      raise error
+    end
+  end
+
+  # OpenSSL will call this method with the verification result for each cert in
+  # the server's chain, working from the root CA to the server's cert. If
+  # preverify_ok is `true`, then that cert passed verification. If it's `false`
+  # then the current verification error is contained in `store_context.error`.
+  # and the current cert is in `store_context.current_cert`.
+  #
+  # If this method returns `false`, then verification stops and ruby will raise
+  # an `OpenSSL::SSL::Error` with "certificate verification failed". If this
+  # method returns `true`, then verification continues.
+  #
+  # If this method ignores a verification error, such as the cert's CRL will be
+  # valid within the next 5 minutes, then this method may be called with a
+  # different verification error for the same cert.
+  #
+  # WARNING: If `store_context.error` returns `OpenSSL::X509::V_OK`, don't
+  # assume verification passed. Ruby 2.4+ implements certificate hostname
+  # checking by default, and if the cert doesn't match the hostname, then the
+  # error will be V_OK. Always use `preverify_ok` to determine if verification
+  # succeeded or not.
+  #
+  # @param preverify_ok [Boolean] if `true` the current certificate in `store_context`
+  #   was verified. Otherwise, check for the current error in `store_context.error`
+  # @param store_context [OpenSSL::X509::StoreContext] The context holding the
+  #   verification result for one certificate
+  # @return [Boolean] If `true`, continue verifying the chain, even if that means
+  #   ignoring the current verification error. If `false`, abort the connection.
+  #
+  # @api private
+  def call(preverify_ok, store_context)
+    return true if preverify_ok
+
+    peer_cert = store_context.current_cert
+
+    case store_context.error
+    when OpenSSL::X509::V_OK
+      # chain is from leaf to root, opposite of the order that `call` is invoked
+      chain_cert = store_context.chain.first
+
+      # ruby 2.4 doesn't compare certs based on value, so force to DER byte array
+      if peer_cert && chain_cert && peer_cert.to_der == chain_cert.to_der && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
+        @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+        return false
+      end
+
+    # ruby-openssl#74ef8c0cc56b840b772240f2ee2b0fc0aafa2743 now sets the
+    # store_context error when the cert is mismatched
+    when OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH
+      @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+      return false
+
+    when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
+      crl = store_context.current_crl
+      if crl && crl.last_update && crl.last_update < Time.now + FIVE_MINUTES_AS_SECONDS
+        Puppet.debug("Ignoring CRL not yet valid, current time #{Time.now.utc}, CRL last updated #{crl.last_update.utc}")
+        return true
+      end
+    end
+
+    # TRANSLATORS: `error` is an untranslated message from openssl describing why a certificate in the server's chain is invalid, and `subject` is the identity/name of the failed certificate
+    @last_error = Puppet::SSL::CertVerifyError.new(
+      _("certificate verify failed [%{error} for %{subject}]") %
+      { error: store_context.error_string, subject: peer_cert.subject.to_utf8 },
+      store_context.error, peer_cert
+    )
+    false
+  end
+end

data/lib/puppet/ssl/verifier_adapter.rb

@@ -0,0 +1,58 @@
+# Allows a `Puppet::SSL::Validator` to be used in situations where a
+# `Verifier` is required, while preserving the legacy validator behavior of:
+#
+# * Loading CA certs from `ssl_client_ca_auth` or `localcacert`
+# * Verifying each cert in the peer's chain is contained in the file
+#   loaded above.
+#
+class Puppet::SSL::VerifierAdapter
+  attr_reader :validator, :ssl_context
+
+  def initialize(validator)
+    @validator = validator
+
+    if validator.is_a?(Puppet::SSL::Validator::NoValidator)
+      ssl = Puppet::SSL::SSLProvider.new
+      @ssl_context = ssl.create_insecure_context
+    else
+      # nil means use the default SSLContext
+      @ssl_context = nil
+    end
+  end
+
+  # Return true if `self` is reusable with `verifier` meaning they
+  # are both using the same class of `Puppet::SSL::Validator`. In this
+  # case we only care the Validator class is the same. We can't require
+  # the same instances, because a new instance is created each time
+  # HttpPool.http_instance is called.
+  #
+  # @param verifier [Puppet::SSL::Verifier] the verifier to compare against
+  # @return [Boolean] return true if a cached connection can be used, false otherwise
+  def reusable?(verifier)
+    verifier.instance_of?(self.class) &&
+      verifier.validator.instance_of?(@validator.class)
+  end
+
+  # Configure the `http` connection based on the current `ssl_context`.
+  #
+  # @param http [Net::HTTP] connection
+  # @api private
+  def setup_connection(http)
+    @validator.setup_connection(http)
+  end
+
+  # Handle an SSL connection error.
+  #
+  # @param http [Net::HTTP] connection
+  # @param error [OpenSSL::SSL::SSLError] connection error
+  # @return (see Puppet::SSL::Verifier#handle_connection_error)
+  # @raise [Puppet::SSL::CertVerifyError] SSL connection failed due to a
+  #   verification error with the server's certificate or chain
+  # @raise [Puppet::Error] server hostname does not match certificate
+  # @raise [OpenSSL::SSL::SSLError] low-level SSL connection failure
+  def handle_connection_error(http, error)
+    raise @validator.last_error if @validator.respond_to?(:last_error) && @validator.last_error
+
+    Puppet::Util::SSL.handle_connection_error(error, @validator, http.address)
+  end
+end

data/lib/puppet/ssl.rb

@@ -1,13 +1,19 @@
 # Just to make the constants work out.
 require 'puppet'
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 
+# @api private
 module Puppet::SSL # :nodoc:
-  CA_NAME = "ca"
-  require 'puppet/ssl/configuration'
+  CA_NAME = "ca".freeze
   require 'puppet/ssl/host'
   require 'puppet/ssl/oids'
   require 'puppet/ssl/validator'
   require 'puppet/ssl/validator/no_validator'
   require 'puppet/ssl/validator/default_validator'
+  require 'puppet/ssl/error'
+  require 'puppet/ssl/ssl_context'
+  require 'puppet/ssl/verifier'
+  require 'puppet/ssl/verifier_adapter'
+  require 'puppet/ssl/ssl_provider'
+  require 'puppet/ssl/state_machine'
 end

data/lib/puppet/syntax_checkers/base64.rb

@@ -23,7 +23,7 @@ class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxCh
       # Do a strict decode64 on text with all whitespace stripped since the non strict version
       # simply skips all non base64 characters
       Base64.strict_decode64(cleaned_text)
-    rescue => e
+    rescue
       msg = if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
               _("Base64 syntax checker: Cannot parse invalid Base64 string - padding is not correct")
             else

data/lib/puppet/syntax_checkers/epp.rb

@@ -0,0 +1,34 @@
+# A syntax checker for JSON.
+# @api public
+require 'puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::EPP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for Puppet Language EPP syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new(_("EPP syntax checker: the text to check must be a String.")) unless text.is_a?(String)
+    raise ArgumentError.new(_("EPP syntax checker: the syntax identifier must be a String, e.g. pp")) unless syntax == 'epp'
+    raise ArgumentError.new(_("EPP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser::EvaluatingEppParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("EPP syntax checker: \"%{message}\"") % { message: e.message().slice(0,500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_EPP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/json.rb

@@ -20,7 +20,7 @@ class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChec
     #raise ArgumentError.new("Json syntax checker: location_info must be a Hash") unless location_info.is_a?(Hash)
 
     begin
-      JSON.parse(text)
+      Puppet::Util::Json.load(text)
     rescue => e
       # Cap the message to 100 chars and replace newlines
       msg = _("JSON syntax checker: Cannot parse invalid JSON string. \"%{message}\"") % { message: e.message().slice(0,100).gsub(/\r?\n/, "\\n") }

data/lib/puppet/syntax_checkers/pp.rb

@@ -0,0 +1,34 @@
+# A syntax checker for JSON.
+# @api public
+require 'puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::PP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for Puppet Language syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new(_("PP syntax checker: the text to check must be a String.")) unless text.is_a?(String)
+    raise ArgumentError.new(_("PP syntax checker: the syntax identifier must be a String, e.g. pp")) unless syntax == 'pp'
+    raise ArgumentError.new(_("PP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("PP syntax checker: \"%{message}\"") % { message: e.message().slice(0,500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_PP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/test/test_helper.rb

@@ -68,7 +68,14 @@ module Puppet::Test
     #  any individual tests.
     # @return nil
     def self.before_all_tests()
-      # Make sure that all of the setup is also done for any before(:all) blocks
+      # The process environment is a shared, persistent resource.
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
+      $old_env = Puppet::Util.get_environment(mode)
     end
 
     # Call this method once, at the end of a test run, when no more tests
@@ -113,20 +120,14 @@ module Puppet::Test
       indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
       indirections.each do |indirector|
         $saved_indirection_state[indirector.name] = {
-            :@terminus_class => indirector.instance_variable_get(:@terminus_class),
-            :@cache_class    => indirector.instance_variable_get(:@cache_class)
+          :@terminus_class => indirector.instance_variable_get(:@terminus_class).value,
+          :@cache_class    => indirector.instance_variable_get(:@cache_class).value,
+          # dup the termini hash so termini created and registered during
+          # the test aren't stored in our saved_indirection_state
+          :@termini        => indirector.instance_variable_get(:@termini).dup
         }
       end
 
-      # The process environment is a shared, persistent resource.
-      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
-      if (!!File::ALT_SEPARATOR)
-        mode = :windows
-      else
-        mode = :posix
-      end
-      $old_env = Puppet::Util.get_environment(mode)
-
       # So is the load_path
       $old_load_path = $LOAD_PATH.dup
 
@@ -134,15 +135,27 @@ module Puppet::Test
 
       Puppet.push_context(
         {
-          :trusted_information =>
-            Puppet::Context::TrustedInformation.new('local', 'testing', {}),
+          trusted_information:
+            Puppet::Context::TrustedInformation.new('local', 'testing', {}, { "trusted_testhelper" => true }),
+          ssl_context: Puppet::SSL::SSLContext.new(cacerts: []).freeze,
+          http_session: proc { Puppet.runtime[:http].create_session }
         },
         "Context for specs")
 
+      # trigger `require 'facter'`
+      Puppet.runtime[:facter]
+
       Puppet::Parser::Functions.reset
       Puppet::Application.clear!
       Puppet::Util::Profiler.clear
 
+      Puppet::SSL::Host.reset
+      Puppet::Rest::Routes.clear
+
+      Puppet::Node::Facts.indirection.terminus_class = :memory
+      facts = Puppet::Node::Facts.new(Puppet[:node_name_value])
+      Puppet::Node::Facts.indirection.save(facts)
+
       Puppet.clear_deprecation_warnings
     end
 
@@ -158,6 +171,7 @@ module Puppet::Test
 
       Puppet::Util::Storage.clear
       Puppet::Util::ExecutionStub.reset
+      Puppet.runtime.clear
 
       Puppet.clear_deprecation_warnings
 
@@ -168,7 +182,11 @@ module Puppet::Test
       indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
       indirections.each do |indirector|
         $saved_indirection_state.fetch(indirector.name, {}).each do |variable, value|
-          indirector.instance_variable_set(variable, value)
+          if variable == :@termini
+            indirector.instance_variable_set(variable, value)
+          else
+            indirector.instance_variable_get(variable).value = value
+          end
         end
       end
       $saved_indirection_state = nil
@@ -221,9 +239,6 @@ module Puppet::Test
       # Initialize "app defaults" settings to a good set of test values
       Puppet.settings.initialize_app_defaults(app_defaults_for_tests)
 
-      # Avoid opening ports to the outside world
-      Puppet.settings[:bindaddress] = "127.0.0.1"
-
       # We don't want to depend upon the reported domain name of the
       # machine running the tests, nor upon the DNS setup of that
       # domain.

data/lib/puppet/thread_local.rb

@@ -0,0 +1,7 @@
+require 'concurrent'
+
+# We want to use the pure Ruby implementation even on JRuby. If we use the Java
+# implementation of ThreadLocal, we end up leaking references to JRuby instances
+# and preventing them from being garbage collected.
+class Puppet::ThreadLocal < Concurrent::RubyThreadLocalVar
+end

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -86,7 +86,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
     # tags such as the type name to support implicit filtering as well as
     # explicit. Note that resource#tags returns a duplicate of the resource's
     # tags.
-    sentinel.tag(*resource.tags)
+    sentinel.merge_tags_from(resource)
     priority = @prioritizer.generate_priority_contained_in(resource, sentinel)
     @relationship_graph.add_vertex(sentinel, priority)
 
@@ -131,13 +131,13 @@ class Puppet::Transaction::AdditionalResourceGenerator
 
   def add_resource(res, parent_resource, priority=nil)
     if @catalog.resource(res.ref).nil?
-      res.tag(*parent_resource.tags)
+      res.merge_tags_from(parent_resource)
       if parent_resource.depthfirst?
         @catalog.add_resource_before(parent_resource, res)
       else
         @catalog.add_resource_after(parent_resource, res)
       end
-      @catalog.add_edge(@catalog.container_of(parent_resource), res)
+      @catalog.add_edge(@catalog.container_of(parent_resource), res) if @catalog.container_of(parent_resource)
       if @relationship_graph && priority
         # If we have a relationship_graph we should add the resource
         # to it (this is an eval_generate). If we don't, then the

data/lib/puppet/transaction/event.rb

@@ -1,18 +1,16 @@
 require 'puppet/transaction'
 require 'puppet/util/tagging'
 require 'puppet/util/logging'
-require 'puppet/util/methodhelper'
 require 'puppet/network/format_support'
 
 # A simple struct for storing what happens on the system.
 class Puppet::Transaction::Event
-  include Puppet::Util::MethodHelper
   include Puppet::Util::Tagging
   include Puppet::Util::Logging
   include Puppet::Network::FormatSupport
 
   ATTRIBUTES = [:name, :resource, :property, :previous_value, :desired_value, :historical_value, :status, :message, :file, :line, :source_description, :audited, :invalidate_refreshes, :redacted, :corrective_change]
-  attr_accessor *ATTRIBUTES
+  attr_accessor(*ATTRIBUTES)
   attr_accessor :time
   attr_reader :default_log_level
 
@@ -24,12 +22,41 @@ class Puppet::Transaction::Event
     obj
   end
 
-  def initialize(options = {})
-    @audited = false
-    @redacted = false
-    @corrective_change = false
+  def initialize(audited: false,
+                 corrective_change: false,
+                 desired_value: nil,
+                 file: nil,
+                 historical_value: nil,
+                 invalidate_refreshes: nil,
+                 line: nil,
+                 message: nil,
+                 name: nil,
+                 previous_value: nil,
+                 property: nil,
+                 redacted: false,
+                 resource: nil,
+                 source_description: nil,
+                 status: nil,
+                 tags: nil)
+
+    @audited = audited
+    @corrective_change = corrective_change
+    @desired_value = desired_value
+    @file = file
+    @historical_value = historical_value
+    @invalidate_refreshes = invalidate_refreshes
+    @line = line
+    @message = message
+    @name = name
+    @previous_value = previous_value
+    @redacted = redacted
+    @source_description = source_description
+    @tags = tags
+
+    self.property = property if property
+    self.resource = resource if resource
+    self.status = status if status
 
-    set_options(options)
     @time = Time.now
   end
 
@@ -71,13 +98,9 @@ class Puppet::Transaction::Event
       'redacted' => @redacted,
       'corrective_change' => @corrective_change,
     }
-    Puppet::Pops::Serialization::ToDataConverter.convert(hash, {
-      :rich_data => true,
-      :symbol_as_string => true,
-      :local_reference => false,
-      :type_by_reference => true,
-      :message_prefix => 'Event'
-    })
+    # Use the stringifying converter since rich data is not possible downstream.
+    # (This will destroy some data type information, but this is expected).
+    Puppet::Pops::Serialization::ToStringifiedConverter.convert(hash, :message_prefix => 'Event')
   end
 
   def property=(prop)
@@ -86,7 +109,8 @@ class Puppet::Transaction::Event
   end
 
   def resource=(res)
-    if res.respond_to?(:[]) and level = res[:loglevel]
+    level = res[:loglevel] if res.respond_to?(:[])
+    if level
       @default_log_level = level
     end
     @resource = res.to_s

data/lib/puppet/transaction/event_manager.rb

@@ -68,7 +68,8 @@ class Puppet::Transaction::EventManager
       received = (event.name != :restarted)
       relationship_graph.matching_edges(event, resource).each do |edge|
         received ||= true unless edge.target.is_a?(Puppet::Type.type(:whit))
-        next unless method = edge.callback
+        method = edge.callback
+        next unless method
         next unless edge.target.respond_to?(method)
 
         queue_events_for_resource(resource, edge.target, method, list)
@@ -114,7 +115,8 @@ class Puppet::Transaction::EventManager
   end
 
   def queued_events(resource)
-    return unless callbacks = @event_queues[resource]
+    callbacks = @event_queues[resource]
+    return unless callbacks
     callbacks.each do |callback, events|
       yield callback, events unless events.empty?
     end
@@ -147,17 +149,27 @@ class Puppet::Transaction::EventManager
     resource.send(callback)
 
     if not resource.is_a?(Puppet::Type.type(:whit))
-      resource.notice n_("Triggered '%{callback}' from %{count} event", "Triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
+      message = n_("Triggered '%{callback}' from %{count} event", "Triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
+      resource.notice message
+      add_callback_status_event(resource, callback, message, "success")
     end
+
     return true
   rescue => detail
-    resource.err _("Failed to call %{callback}: %{detail}") % { callback: callback, detail: detail }
-
+    resource_error_message = _("Failed to call %{callback}: %{detail}") % { callback: callback, detail: detail }
+    resource.err(resource_error_message)
     transaction.resource_status(resource).failed_to_restart = true
+    transaction.resource_status(resource).fail_with_event(resource_error_message)
     resource.log_exception(detail)
     return false
   end
 
+  def add_callback_status_event(resource, callback, message, status)
+    options = { message: message, status: status, name: callback.to_s }
+    event = resource.event options
+    transaction.resource_status(resource) << event if event
+  end
+
   def process_noop_events(resource, callback, events)
     resource.notice n_("Would have triggered '%{callback}' from %{count} event", "Would have triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
 

data/lib/puppet/transaction/persistence.rb

@@ -6,6 +6,26 @@ require 'puppet/util/yaml'
 # as calculating corrective_change).
 # @api private
 class Puppet::Transaction::Persistence
+
+  def self.allowed_classes
+    @allowed_classes ||= [
+      Symbol,
+      Time,
+      Regexp,
+      # URI is excluded, because it serializes all instance variables including the
+      # URI parser. Better to serialize the URL encoded representation.
+      SemanticPuppet::Version,
+      # SemanticPuppet::VersionRange has many nested classes and is unlikely to be
+      # used directly, so ignore it
+      Puppet::Pops::Time::Timestamp,
+      Puppet::Pops::Time::TimeData,
+      Puppet::Pops::Time::Timespan,
+      Puppet::Pops::Types::PBinaryType::Binary,
+      # Puppet::Pops::Types::PSensitiveType::Sensitive values are excluded from
+      # the persistence store, ignore it.
+    ].freeze
+  end
+
   def initialize
     @old_data = {}
     @new_data = {"resources" => {}}
@@ -62,9 +82,9 @@ class Puppet::Transaction::Persistence
     result = nil
     Puppet::Util.benchmark(:debug, _("Loaded transaction store file in %{seconds} seconds")) do
       begin
-        result = Puppet::Util::Yaml.load_file(filename, false, true)
+        result = Puppet::Util::Yaml.safe_load_file(filename, self.class.allowed_classes)
       rescue Puppet::Util::Yaml::YamlLoadError => detail
-        Puppet.log_exception(detail, _("Transaction store file %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail }, { :level => :warning })
+        Puppet.log_exception(detail, _("Transaction store file %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail })
 
         begin
           File.rename(filename, filename + ".bad")