puppet 5.3.7-universal-darwin → 5.4.0-universal-darwin

data/lib/puppet/indirector/request.rb

@@ -197,19 +197,23 @@ class Puppet::Indirector::Request
     end
 
     # ... Fall back onto the default server.
-     bound_server = Puppet.lookup(:server) do
+    begin
+      bound_server = Puppet.lookup(:server)
+    rescue
       if primary_server = Puppet.settings[:server_list][0]
-        primary_server[0]
+        bound_server = primary_server[0]
       else
-        Puppet.settings[:server]
+        bound_server = Puppet.settings[:server]
       end
     end
 
-    bound_port = Puppet.lookup(:serverport) do
+    begin
+      bound_port = Puppet.lookup(:serverport)
+    rescue
       if primary_server = Puppet.settings[:server_list][0]
-        primary_server[1]
+        bound_port = primary_server[1]
       else
-        Puppet.settings[:masterport]
+        bound_port = Puppet.settings[:masterport]
       end
     end
     self.server = default_server || bound_server

data/lib/puppet/indirector/rest.rb

@@ -57,7 +57,9 @@ class Puppet::Indirector::REST < Puppet::Indirector::Terminus
     if setting && setting != :server && Puppet.settings.set_by_config?(setting)
       Puppet.settings[setting]
     else
-      server = Puppet.lookup(:server) do
+      begin
+        Puppet.lookup(:server)
+      rescue
         if primary_server = Puppet.settings[:server_list][0]
           Puppet.debug "Dynamically-bound server lookup failed; using first entry"
           primary_server[0]
@@ -67,7 +69,6 @@ class Puppet::Indirector::REST < Puppet::Indirector::Terminus
           Puppet.settings[setting]
         end
       end
-      server
     end
   end
 
@@ -83,21 +84,22 @@ class Puppet::Indirector::REST < Puppet::Indirector::Terminus
        (srv_setting && srv_setting != :server && Puppet.settings.set_by_config?(srv_setting))
       Puppet.settings[setting].to_i
     else
-      port = Puppet.lookup(:serverport) do
+      begin
+        Puppet.lookup(:serverport).to_i
+      rescue
         if primary_server = Puppet.settings[:server_list][0]
           Puppet.debug "Dynamically-bound port lookup failed; using first entry"
 
           # Port might not be set, so we want to fallback in that
           # case. We know we don't need to use `setting` here, since
           # the default value of every port setting is `masterport`
-          (primary_server[1] || Puppet.settings[:masterport])
+          (primary_server[1] || Puppet.settings[:masterport]).to_i
         else
           setting ||= :masterport
           Puppet.debug "Dynamically-bound port lookup failed; falling back to #{setting} setting"
-          Puppet.settings[setting]
+          Puppet.settings[setting].to_i
         end
       end
-      port.to_i
     end
   end
 
@@ -181,7 +183,7 @@ class Puppet::Indirector::REST < Puppet::Indirector::Terminus
       # While this way of handling the issue is not perfect, there is at least an error
       # that makes a user aware of the reason for the failure.
       #
-      content_type, body = parse_response(response)
+      _, body = parse_response(response)
       msg = _("Find %{uri} resulted in 404 with the message: %{body}") % { uri: elide(uri_with_query_string, 100), body: body }
       raise Puppet::Error, msg
     else
@@ -261,9 +263,7 @@ class Puppet::Indirector::REST < Puppet::Indirector::Terminus
   def handle_response(request, response)
     server_version = response[Puppet::Network::HTTP::HEADER_PUPPET_VERSION]
     if server_version
-      Puppet.lookup(:server_agent_version) do
-        Puppet.push_context(:server_agent_version => server_version)
-      end
+      Puppet.push_context({:server_agent_version => server_version})
       if SemanticPuppet::Version.parse(server_version).major < MAJOR_VERSION_JSON_DEFAULT &&
           Puppet[:preferred_serialization_format] != 'pson'
         #TRANSLATORS "PSON" should not be translated
@@ -318,8 +318,7 @@ class Puppet::Indirector::REST < Puppet::Indirector::Terminus
   # uncompress_body)
   def parse_response(response)
     if response['content-type']
-      [ response['content-type'].gsub(/\s*;.*$/,''),
-        body = uncompress_body(response) ]
+      [ response['content-type'].gsub(/\s*;.*$/,''), uncompress_body(response) ]
     else
       raise _("No content type in http response; cannot parse")
     end

data/lib/puppet/info_service/class_information_service.rb

@@ -59,7 +59,7 @@ class Puppet::InfoService::ClassInformationService
       {:classes =>
         parse_result.definitions.select {|d| d.is_a?(Puppet::Pops::Model::HostClassDefinition)}.map do |d|
           {:name   => d.name,
-           :params => params = d.parameters.map {|p| extract_param(p) }
+           :params => d.parameters.map {|p| extract_param(p) }
           }
         end
       }

data/lib/puppet/interface/action.rb

@@ -149,6 +149,17 @@ class Puppet::Interface::Action
     @render_as = value.to_sym
   end
 
+  # @api private
+  # @return [void]
+  def deprecate
+    @deprecated = true
+  end
+
+  # @api private
+  # @return [Boolean]
+  def deprecated?
+    @deprecated
+  end
 
   ########################################################################
   # Initially, this was defined to allow the @action.invoke pattern, which is

data/lib/puppet/interface/action_builder.rb

@@ -17,6 +17,14 @@ class Puppet::Interface::ActionBuilder
     new(face, name, &block).action
   end
 
+  # Deprecates the action
+  # @return [void]
+  # @api private
+  # @dsl Faces
+  def deprecate
+    @action.deprecate
+  end
+
   # Ideally the method we're defining here would be added to the action, and a
   # method on the face would defer to it, but we can't get scope correct, so
   # we stick with this. --daniel 2011-03-24

data/lib/puppet/interface/option_manager.rb

@@ -26,7 +26,7 @@ module Puppet::Interface::OptionManager
 
   # @api private
   def walk_inheritance_tree(start, sym)
-    result = (start ||= [])
+    result = (start || [])
     if self.is_a?(Class) and superclass.respond_to?(sym)
       result = superclass.send(sym) + result
     elsif self.class.respond_to?(sym)

data/lib/puppet/loaders.rb

@@ -13,12 +13,14 @@ module Puppet
       require 'puppet/pops/loader/static_loader'
       require 'puppet/pops/loader/runtime3_type_loader'
       require 'puppet/pops/loader/ruby_function_instantiator'
+      require 'puppet/pops/loader/ruby_data_type_instantiator'
       require 'puppet/pops/loader/puppet_function_instantiator'
       require 'puppet/pops/loader/type_definition_instantiator'
       require 'puppet/pops/loader/puppet_resource_type_impl_instantiator'
       require 'puppet/pops/loader/loader_paths'
       require 'puppet/pops/loader/simple_environment_loader'
       require 'puppet/pops/loader/predefined_loader'
+      require 'puppet/pops/loader/puppet_plan_instantiator'
     end
   end
 

data/lib/puppet/module.rb

@@ -334,7 +334,7 @@ class Puppet::Module
   def dependencies_as_modules
     dependent_modules = []
     dependencies and dependencies.each do |dep|
-      author, dep_name = dep["name"].split('/')
+      _, dep_name = dep["name"].split('/')
       found_module = environment.module(dep_name)
       dependent_modules << found_module if found_module
     end
@@ -457,7 +457,11 @@ class Puppet::Module
 
   def assert_validity
     if !Puppet::Module.is_module_directory_name?(@name) && !Puppet::Module.is_module_namespaced_name?(@name)
-      raise InvalidName, "Invalid module name #{@name}; module names must be alphanumeric (plus '-'), not '#{@name}'"
+      raise InvalidName, _(<<-ERROR_STRING).chomp % { name: @name }
+        Invalid module name '%{name}'; module names must match either:
+        An installed module name (ex. modulename) matching the expression /^[a-z][a-z0-9_]*$/ -or-
+        A namespaced module name (ex. author-modulename) matching the expression /^[a-zA-Z0-9]+[-][a-z][a-z0-9_]*$/
+      ERROR_STRING
     end
   end
 end

data/lib/puppet/module_tool/applications/builder.rb

@@ -2,6 +2,7 @@ require 'fileutils'
 require 'json'
 require 'puppet/file_system'
 require 'pathspec'
+require 'facter'
 
 module Puppet::ModuleTool
   module Applications
@@ -14,6 +15,9 @@ module Puppet::ModuleTool
       end
 
       def run
+        # Disallow anything that invokes md5 to avoid un-friendly termination due to FIPS
+        raise _("Module building is prohibited in FIPS mode.") if Facter.value(:fips_enabled)
+
         load_metadata!
         create_directory
         copy_contents

data/lib/puppet/module_tool/applications/installer.rb

@@ -52,6 +52,9 @@ module Puppet::ModuleTool
       end
 
       def run
+        # Disallow anything that invokes md5 to avoid un-friendly termination due to FIPS
+        raise _("Module install is prohibited in FIPS mode.") if Facter.value(:fips_enabled)
+
         name = @name.tr('/', '-')
         version = options[:version] || '>= 0.0.0'
 

data/lib/puppet/module_tool/applications/uninstaller.rb

@@ -16,6 +16,9 @@ module Puppet::ModuleTool
       end
 
       def run
+        # Disallow anything that invokes md5 to avoid un-friendly termination due to FIPS
+        raise _("Module uninstall is prohibited in FIPS mode.") if Facter.value(:fips_enabled)
+
         results = {
           :module_name       => @name,
           :requested_version => @version,

data/lib/puppet/module_tool/applications/unpacker.rb

@@ -76,7 +76,7 @@ module Puppet::ModuleTool
       # @api private
       def module_name
         metadata = JSON.parse((root_dir + 'metadata.json').read)
-        name = metadata['name'][/-(.*)/, 1]
+        metadata['name'][/-(.*)/, 1]
       end
 
       # @api private

data/lib/puppet/module_tool/applications/upgrader.rb

@@ -27,6 +27,9 @@ module Puppet::ModuleTool
       end
 
       def run
+        # Disallow anything that invokes md5 to avoid un-friendly termination due to FIPS
+        raise _("Module upgrade is prohibited in FIPS mode.") if Facter.value(:fips_enabled)
+
         name = @name.tr('/', '-')
         version = options[:version] || '>= 0.0.0'
 

data/lib/puppet/module_tool/installed_modules.rb

@@ -60,7 +60,7 @@ module Puppet::ModuleTool
         name = mod.forge_name.tr('/', '-')
         begin
           version = SemanticPuppet::Version.parse(mod.version)
-        rescue SemanticPuppet::Version::ValidationFailure => e
+        rescue SemanticPuppet::Version::ValidationFailure
           Puppet.warning _("%{module_name} (%{path}) has an invalid version number (%{version}). The version has been set to 0.0.0. If you are the maintainer for this module, please update the metadata.json with a valid Semantic Version (http://semver.org).") % { module_name: mod.name, path: mod.path, version: mod.version }
           version = SemanticPuppet::Version.parse("0.0.0")
         end

data/lib/puppet/module_tool/metadata.rb

@@ -200,7 +200,6 @@ module Puppet::ModuleTool
     #
     # @param value [Object] The value to be tested
     def validate_data_provider(value)
-      err = nil
       if value.is_a?(String)
         unless value =~ /^[a-zA-Z][a-zA-Z0-9_]*$/
           if value =~ /^[a-zA-Z]/

data/lib/puppet/network/authstore.rb

@@ -16,7 +16,7 @@ module Puppet
     # is provided, then the authstore is considered local and defaults to "true".
     def allowed?(name, ip)
       if name or ip
-        # This is probably unnecessary, and can cause some weirdnesses in
+        # This is probably unnecessary, and can cause some weirdness in
         # cases where we're operating over localhost but don't have a real
         # IP defined.
         raise Puppet::DevError, _("Name and IP must be passed to 'allowed?'") unless name and ip

data/lib/puppet/network/http/api/indirected_routes.rb

@@ -191,7 +191,7 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
       begin
         yield format
         true
-      rescue Puppet::Network::FormatHandler::FormatError => e
+      rescue Puppet::Network::FormatHandler::FormatError
         false
       end
     end

data/lib/puppet/network/http/connection.rb

@@ -5,7 +5,6 @@ require 'puppet/ssl/validator'
 require 'puppet/network/http'
 require 'uri'
 require 'date'
-require 'time'
 
 module Puppet::Network::HTTP
 
@@ -210,7 +209,7 @@ module Puppet::Network::HTTP
     # it by sleeping for the indicated number of seconds. The response is
     # returned unmodified if no Retry-After header is present.
     #
-    # @param response [Net::HTTPResponse] A response recieved from the
+    # @param response [Net::HTTPResponse] A response received from the
     #   HTTP client.
     #
     # @return [nil] Sleeps and returns nil if the response contained a
@@ -298,14 +297,7 @@ module Puppet::Network::HTTP
     end
 
     def execute_request(connection, request)
-      start = Time.now
       connection.request(request)
-    rescue EOFError => e
-      elapsed = (Time.now - start).to_f.round(3)
-      uri = @site.addr + request.path.split('?')[0]
-      eof = EOFError.new(_('request %{uri} interrupted after %{elapsed} seconds') % {uri: uri, elapsed: elapsed})
-      eof.set_backtrace(e.backtrace) unless e.backtrace.empty?
-      raise eof
     end
 
     def with_connection(site, &block)

data/lib/puppet/network/http/factory.rb

@@ -12,8 +12,6 @@ require 'puppet/util/http_proxy'
 class Puppet::Network::HTTP::Factory
   @@openssl_initialized = false
 
-  KEEP_ALIVE_TIMEOUT = 2**31 - 1
-
   def initialize
     # PUP-1411, make sure that openssl is initialized before we try to connect
     if ! @@openssl_initialized
@@ -39,7 +37,6 @@ class Puppet::Network::HTTP::Factory
     http.use_ssl = site.use_ssl?
     http.read_timeout = Puppet[:http_read_timeout]
     http.open_timeout = Puppet[:http_connect_timeout]
-    http.keep_alive_timeout = KEEP_ALIVE_TIMEOUT if http.respond_to?(:keep_alive_timeout=)
 
     if Puppet[:sourceaddress]
       if http.respond_to?(:local_host)

data/lib/puppet/network/http/webrick.rb

@@ -52,6 +52,7 @@ class Puppet::Network::HTTP::WEBrick
 
   # @api private
   def create_server(address, port)
+    address = nil if address == '*'
     arguments = {:BindAddress => address, :Port => port, :DoNotReverseLookup => true}
     arguments.merge!(setup_logger)
     arguments.merge!(setup_ssl)

data/lib/puppet/network/rights.rb

@@ -34,7 +34,7 @@ class Rights
 
   def is_forbidden_and_why?(name, args = {})
     res = :nomatch
-    right = @rights.find do |acl|
+    @rights.find do |acl|
       found = false
       # an acl can return :dunno, which means "I'm not qualified to answer your question,
       # please ask someone else". This is used when for instance an acl matches, but not for the

data/lib/puppet/node.rb

@@ -226,4 +226,57 @@ class Puppet::Node
     Puppet.warning(_("Trusted node data modified for node %{name}") % { name: name }) unless @trusted_data.nil?
     @trusted_data = data.freeze
   end
+
+  # Resurrects and sanitizes trusted information in the node by modifying it and setting
+  # the trusted_data in the node from parameters.
+  # This modifies the node
+  #
+  def sanitize
+    # Resurrect "trusted information" that comes from node/fact terminus.
+    # The current way this is done in puppet db (currently the only one)
+    # is to store the node parameter 'trusted' as a hash of the trusted information.
+    #
+    # Thus here there are two main cases:
+    # 1. This terminus was used in a real agent call (only meaningful if someone curls the request as it would
+    #  fail since the result is a hash of two catalogs).
+    # 2  It is a command line call with a given node that use a terminus that:
+    # 2.1 does not include a 'trusted' fact - use local from node trusted information
+    # 2.2 has a 'trusted' fact - this in turn could be
+    # 2.2.1 puppet db having stored trusted node data as a fact (not a great design)
+    # 2.2.2 some other terminus having stored a fact called "trusted" (most likely that would have failed earlier, but could
+    #       be spoofed).
+    #
+    # For the reasons above, the resurrection of trusted node data with authenticated => true is only performed
+    # if user is running as root, else it is resurrected as unauthenticated.
+    #
+    trusted_param = @parameters['trusted']
+    if trusted_param
+      # Blows up if it is a parameter as it will be set as $trusted by the compiler as if it was a variable
+      @parameters.delete('trusted')
+      unless trusted_param.is_a?(Hash) && %w{authenticated certname extensions}.all? {|key| trusted_param.has_key?(key) }
+        # trusted is some kind of garbage, do not resurrect
+        trusted_param = nil
+      end
+    else
+      # trusted may be Boolean false if set as a fact by someone
+      trusted_param = nil
+    end
+
+    # The options for node.trusted_data in priority order are:
+    # 1) node came with trusted_data so use that
+    # 2) else if there is :trusted_information in the puppet context
+    # 3) else if the node provided a 'trusted' parameter (parsed out above)
+    # 4) last, fallback to local node trusted information
+    #
+    # Note that trusted_data should be a hash, but (2) and (4) are not
+    # hashes, so we to_h at the end
+    if !trusted_data
+      trusted = Puppet.lookup(:trusted_information) do
+        trusted_param || Puppet::Context::TrustedInformation.local(self)
+      end
+
+      # Ruby 1.9.3 can't apply to_h to a hash, so check first
+      self.trusted_data = (trusted.is_a?(Hash) ? trusted : trusted.to_h)
+    end
+  end
 end

data/lib/puppet/node/environment.rb

@@ -295,7 +295,7 @@ class Puppet::Node::Environment
   # @param forge_name [String] The module name
   # @return [Puppet::Module, nil] The module if found, else nil
   def module_by_forge_name(forge_name)
-    author, modname = forge_name.split('/')
+    _, modname = forge_name.split('/')
     found_mod = self.module(modname)
     found_mod and found_mod.forge_name == forge_name ?
       found_mod :

data/lib/puppet/parameter/boolean.rb

@@ -1,7 +1,7 @@
 require 'puppet/coercion'
 
 # This specialized {Puppet::Parameter} handles Boolean options, accepting lots
-# of strings and symbols for both truthiness and falsehood.
+# of strings and symbols for both truth and falsehood.
 #
 class Puppet::Parameter::Boolean < Puppet::Parameter
   def unsafe_munge(value)