puppet 5.5.18 → 5.5.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5da9776238650bcca14252d209b7f8ba7314e78d0690754a21398db41f795429
-  data.tar.gz: 1d1fb0ad2f7eba9d2c4ae353cf8140f6f60a8729b6af41c041a26334a7bd5876
+  metadata.gz: bc5413f27883bf1004eafe8d43015210b2dfeef6e7e6b78695cdb7f7f24506d1
+  data.tar.gz: a8e612c05fe679ecb35c885b12df8df7d9b8e777682660ce05673b5144ca0940
 SHA512:
-  metadata.gz: be59c9d47d620b4967c8dc4652b55ee58b5ebe5b0d9363d4e7a8f5261120d8b1a32b7c25a9f6e5ed0a91571067d6b5c16d5d0970b57813b857305c41b001b574
-  data.tar.gz: 923e8cb7a475b6a7b47d5b3d33458b55d7cafbd70d7da0003c7bbdac4eb7158685d34f5ec2d4e1f4a933105af451c847cb7a11f2c231cb83c7019b6f7784f56d
+  metadata.gz: 2a7b1fd9165e74a56765588b67c761f794a11df9727c82ae64859dbadf03ad49234302d4fe1f28a8b5aeae0ec391d24ffa81f33bf70ae547d1961169200702ff
+  data.tar.gz: 9e29ab6bb368bcc7fdcd7ef40316935cc9f5a6af24496139d1d59f6a416cdad5a5cf40b4f5842285a3416735def2e16af9254b5445ca9cfeecd12fbcaba151b4

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    puppet (5.5.18)
+    puppet (5.5.19)
       CFPropertyList (~> 2.2)
       facter (>= 2.4.0, < 4)
       fast_gettext (~> 1.1.2)
@@ -25,7 +25,7 @@ GEM
     csv (3.1.2)
     diff-lcs (1.3)
     docopt (0.6.1)
-    facter (2.5.6)
+    facter (2.5.7)
     fast_gettext (1.1.2)
     gettext (3.2.9)
       locale (>= 2.0.5)
@@ -36,7 +36,7 @@ GEM
       locale
     hashdiff (0.3.8)
     hiera (3.6.0)
-    hiera-eyaml (3.1.1)
+    hiera-eyaml (3.2.0)
       highline (~> 1.6.19)
       optimist
     highline (1.6.21)
@@ -44,21 +44,21 @@ GEM
     hpricot (0.8.6)
     json-schema (2.8.1)
       addressable (>= 2.4)
-    locale (2.1.2)
+    locale (2.1.3)
     memory_profiler (0.9.14)
     method_source (0.9.2)
     mocha (1.11.2)
-    msgpack (1.3.1)
+    msgpack (1.3.3)
     multi_json (1.14.1)
     mustache (1.1.1)
     net-ssh (4.2.0)
     optimist (3.0.0)
-    packaging (0.99.52)
+    packaging (0.99.58)
       artifactory (~> 2)
       rake (>= 12.3)
       release-metrics
     parallel (1.19.1)
-    parser (2.7.0.2)
+    parser (2.7.0.4)
       ast (~> 2.4.0)
     pathspec (0.2.1)
     powerpack (0.1.2)
@@ -66,7 +66,8 @@ GEM
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     puppet-lint (2.4.2)
-    puppet-syntax (2.6.0)
+    puppet-syntax (2.6.1)
+      puppet (>= 5)
       rake
     puppetlabs_spec_helper (2.14.1)
       mocha (~> 1.0)
@@ -75,7 +76,7 @@ GEM
       puppet-syntax (~> 2.0)
       rspec-puppet (~> 2.0)
     racc (1.4.9)
-    rack (1.6.12)
+    rack (1.6.13)
     rainbow (2.1.0)
     rake (12.3.3)
     rdiscount (2.2.0.1)
@@ -119,11 +120,11 @@ GEM
       unicode-display_width (~> 1.0, >= 1.0.1)
     rubocop-i18n (1.2.0)
       rubocop (~> 0.49.0)
-    ruby-prof (1.1.0)
+    ruby-prof (1.3.0)
     ruby-progressbar (1.10.1)
     safe_yaml (1.0.5)
     text (1.3.1)
-    unicode-display_width (1.6.0)
+    unicode-display_width (1.6.1)
     vcr (2.9.3)
     webmock (1.24.6)
       addressable (>= 2.3.6)

data/lib/puppet.rb

@@ -22,6 +22,7 @@ require 'puppet/external/pson/common'
 require 'puppet/external/pson/version'
 require 'puppet/external/pson/pure'
 require 'puppet/gettext/config'
+require 'puppet/defaults'
 
 
 #------------------------------------------------------------
@@ -87,6 +88,7 @@ module Puppet
 
   # Store a new default value.
   def self.define_settings(section, hash)
+    Puppet.deprecation_warning('The method Puppet.define_settings is deprecated and will be removed in a future release')
     @@settings.define_settings(section, hash)
   end
 
@@ -121,8 +123,9 @@ module Puppet
     Puppet::Util::RunMode[@@settings.preferred_run_mode]
   end
 
-  # Load all of the settings.
-  require 'puppet/defaults'
+  # Modify the settings with defaults defined in `initialize_default_settings` method in puppet/defaults.rb. This can
+  # be used in the initialization of new Puppet::Settings objects in the puppetserver project.
+  Puppet.initialize_default_settings!(settings)
 
   # Now that settings are loaded we have the code loaded to be able to issue
   # deprecation warnings. Warn if we're on a deprecated ruby version.

data/lib/puppet/application/filebucket.rb

@@ -69,6 +69,19 @@ running as a user with valid Puppet certificates. Alternatively, you can
 use your local file bucket by specifying '--local', or by specifying
 '--bucket' with a local path.
 
+> **Note**: Enabling and using the backup option, and by extension the 
+  filebucket resource, requires appropriate planning and management to ensure 
+  that sufficient disk space is available for the file backups. Generally, you 
+  can implement this using one of the following two options:
+  - Use a `find` command and `crontab` entry to retain only the last X days 
+  of file backups. For example: 
+
+  ```shell
+  find /opt/puppetlabs/server/data/puppetserver/bucket -type f -mtime +45 -atime +45 -print0 | xargs -0 rm
+  ```
+
+  - Restrict the directory to a maximum size after which the oldest items are removed.
+
 
 OPTIONS
 -------

data/lib/puppet/defaults.rb

@@ -39,7 +39,11 @@ module Puppet
 
   AS_DURATION = %q{This setting can be a time interval in seconds (30 or 30s), minutes (30m), hours (6h), days (2d), or years (5y).}
 
-  define_settings(:main,
+  # @api public
+  # @param args [Puppet::Settings] the settings object to define default settings for
+  # @return void
+  def self.initialize_default_settings!(settings)
+  settings.define_settings(:main,
     :confdir  => {
         :default  => nil,
         :type     => :directory,
@@ -76,7 +80,7 @@ module Puppet
     }
   )
 
-  define_settings(:main,
+  settings.define_settings(:main,
     :logdir => {
         :default  => nil,
         :type     => :directory,
@@ -167,7 +171,7 @@ module Puppet
     }
   )
 
-  define_settings(:main,
+  settings.define_settings(:main,
     :priority => {
       :default => nil,
       :type    => :priority,
@@ -488,12 +492,12 @@ module Puppet
     :hiera_config => {
       :default => lambda do
         config = nil
-        codedir = Puppet.settings[:codedir]
+        codedir = settings[:codedir]
         if codedir.is_a?(String)
           config = File.expand_path(File.join(codedir, 'hiera.yaml'))
           config = nil unless Puppet::FileSystem.exist?(config)
         end
-        config = File.expand_path(File.join(Puppet.settings[:confdir], 'hiera.yaml')) if config.nil?
+        config = File.expand_path(File.join(settings[:confdir], 'hiera.yaml')) if config.nil?
         config
       end,
       :desc    => "The hiera configuration file. Puppet only reads this file on startup, so you must restart the puppet master every time you edit it.",
@@ -547,7 +551,7 @@ module Puppet
     :http_proxy_password =>{
       :default    => "none",
       :hook       => proc do |value|
-        if Puppet.settings[:http_proxy_password] =~ /[@!# \/]/
+        if settings[:http_proxy_password] =~ /[@!# \/]/
           raise "Passwords set in the http_proxy_password setting must be valid as part of a URL, and any reserved characters must be URL-encoded. We received: #{value}"
         end
       end,
@@ -677,7 +681,7 @@ module Puppet
     }
   )
 
-  define_settings(:main,
+  settings.define_settings(:main,
       # Whether the application management feature is on or off - now deprecated and always on.
       :app_management => {
           :default  => false,
@@ -687,7 +691,7 @@ module Puppet
       }
   )
 
-  Puppet.define_settings(:module_tool,
+  settings.define_settings(:module_tool,
     :module_repository  => {
       :default  => 'https://forgeapi.puppet.com',
       :desc     => "The module repository",
@@ -710,7 +714,7 @@ module Puppet
     }
   )
 
-    Puppet.define_settings(
+    settings.define_settings(
     :main,
 
     # We have to downcase the fqdn, because the current ssl stuff (as opposed to in master) doesn't have good facilities for
@@ -803,13 +807,17 @@ This is useful for embedding a pre-shared key for autosigning policy executables
 ("challenge password") OID.
 
 Extension requests will be permanently embedded in the final certificate.
-Extension OIDs must be in the "ppRegCertExt" (`1.3.6.1.4.1.34380.1.1`) or
-"ppPrivCertExt" (`1.3.6.1.4.1.34380.1.2`) OID arcs. The ppRegCertExt arc is
+Extension OIDs must be in the "ppRegCertExt" (`1.3.6.1.4.1.34380.1.1`),
+"ppPrivCertExt" (`1.3.6.1.4.1.34380.1.2`), or
+"ppAuthCertExt" (`1.3.6.1.4.1.34380.1.3`) OID arcs. The ppRegCertExt arc is
 reserved for four of the most common pieces of data to embed: `pp_uuid` (`.1`),
 `pp_instance_id` (`.2`), `pp_image_name` (`.3`), and `pp_preshared_key` (`.4`)
 --- in the YAML file, these can be referred to by their short descriptive names
 instead of their full OID. The ppPrivCertExt arc is unregulated, and can be used
-for site-specific extensions.
+for site-specific extensions. The ppAuthCert arc is reserved for two pieces of
+data to embed: `pp_authorization` (`.1`) and `pp_auth_role` (`.13`). As with
+ppRegCertExt, in the YAML file, these can be referred to by their short
+descriptive name instead of their full OID.
 EOT
     },
     :certdir => {
@@ -998,7 +1006,7 @@ EOT
     }
   )
 
-    define_settings(
+    settings.define_settings(
     :ca,
     :ca_name => {
       :default    => "Puppet CA: $certname",
@@ -1146,7 +1154,7 @@ EOT
 
   # Define the config default.
 
-    define_settings(:application,
+    settings.define_settings(:application,
       :config_file_name => {
           :type     => :string,
           :default  => Puppet::Settings.default_config_file_name,
@@ -1176,7 +1184,7 @@ EOT
       }
   )
 
-  define_settings(:environment,
+  settings.define_settings(:environment,
     :manifest => {
       :default    => nil,
       :type       => :file_or_directory,
@@ -1219,7 +1227,7 @@ EOT
     }
   )
 
-  define_settings(:master,
+  settings.define_settings(:master,
     :user => {
       :default    => "puppet",
       :desc       => "The user Puppet Server will run as. Used to ensure
@@ -1289,13 +1297,23 @@ EOT
       overridden by more specific settings (see `ca_port`, `report_port`).",
     },
     :node_name => {
-      :default    => "cert",
+      :default    => 'cert',
+      :type       => :enum,
+      :values     => ['cert', 'facter'],
+      :deprecated => :completely,
+      :hook       => proc { |val|
+        if val != 'cert'
+          Puppet.deprecation_warning("The node_name setting is deprecated and will be removed in a future release.")
+        end
+      },
       :desc       => "How the puppet master determines the client's identity
       and sets the 'hostname', 'fqdn' and 'domain' facts for use in the manifest,
       in particular for determining which 'node' statement applies to the client.
       Possible values are 'cert' (use the subject's CN in the client's
       certificate) and 'facter' (use the hostname that the client
-      reported in its facts)",
+      reported in its facts).
+
+      This setting is deprecated, please use explicit fact matching for classification.",
     },
     :bucketdir => {
       :default => "$vardir/bucket",
@@ -1424,14 +1442,23 @@ EOT
       :desc       => "Where the fileserver configuration is stored.",
     },
     :strict_hostname_checking => {
-      :default    => false,
+      :default    => true,
+      :type       => :boolean,
       :desc       => "Whether to only search for the complete
-            hostname as it is in the certificate when searching for node information
-            in the catalogs.",
+        hostname as it is in the certificate when searching for node information
+        in the catalogs or to match dot delimited segments of the cert's certname
+        and the hostname, fqdn, and/or domain facts.
+
+        This setting is deprecated and will be removed in a future release.",
+      :hook => proc { |val|
+        if val != true
+          Puppet.deprecation_warning("Setting strict_hostname_checking to false is deprecated and will be removed in a future release. Please use regular expressions in your node declarations or explicit fact matching for classification (though be warned that fact based classification may be considered insecure).")
+        end
+      }
     }
   )
 
-  define_settings(:device,
+  settings.define_settings(:device,
     :devicedir =>  {
         :default  => "$vardir/devices",
         :type     => :directory,
@@ -1446,7 +1473,7 @@ EOT
     }
   )
 
-  define_settings(:agent,
+  settings.define_settings(:agent,
     :node_name_value => {
       :default => "$certname",
       :desc => "The explicit value used for the node name for all requests the agent
@@ -1832,7 +1859,7 @@ EOT
 
   # Plugin information.
 
-  define_settings(
+  settings.define_settings(
     :main,
     :plugindest => {
       :type       => :directory,
@@ -1886,7 +1913,7 @@ EOT
 
   # Central fact information.
 
-    define_settings(
+    settings.define_settings(
     :main,
     :factpath => {
       :type     => :path,
@@ -1903,7 +1930,7 @@ EOT
     }
   )
 
-  define_settings(
+  settings.define_settings(
     :transaction,
     :tags => {
       :default    => "",
@@ -1931,7 +1958,7 @@ EOT
     }
   )
 
-    define_settings(
+    settings.define_settings(
     :main,
     :external_nodes => {
         :default  => "none",
@@ -1956,7 +1983,7 @@ EOT
     }
     )
 
-        define_settings(
+        settings.define_settings(
         :ldap,
     :ldapssl => {
       :default  => false,
@@ -2025,7 +2052,7 @@ EOT
     }
   )
 
-  define_settings(:master,
+  settings.define_settings(:master,
     :storeconfigs => {
       :default  => false,
       :type     => :boolean,
@@ -2058,7 +2085,7 @@ EOT
     }
   )
 
-  define_settings(:parser,
+  settings.define_settings(:parser,
    :max_errors => {
      :default => 10,
      :desc => <<-'EOT'
@@ -2100,7 +2127,7 @@ EOT
     EOT
     }
   )
-  define_settings(:puppetdoc,
+  settings.define_settings(:puppetdoc,
     :document_all => {
         :default  => false,
         :type     => :boolean,
@@ -2109,7 +2136,7 @@ EOT
     }
   )
 
-  define_settings(
+  settings.define_settings(
     :main,
     :rich_data => {
       :default  => false,
@@ -2126,5 +2153,5 @@ EOT
       EOT
     }
   )
-
+  end
 end

data/lib/puppet/indirector/catalog/compiler.rb

@@ -387,9 +387,17 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
 
   # Initialize our server fact hash; we add these to each client, and they
   # won't change while we're running, so it's safe to cache the values.
+  #
+  # See also set_server_facts in Puppet::Server::Compiler in puppetserver.
   def set_server_facts
     @server_facts = {}
 
+    # Add our server Puppet Enterprise version, if available.
+    pe_version_file = '/opt/puppetlabs/server/pe_version'
+    if File.readable?(pe_version_file) and !File.zero?(pe_version_file)
+      @server_facts['pe_serverversion'] = File.read(pe_version_file).chomp
+    end
+
     # Add our server version to the fact list
     @server_facts["serverversion"] = Puppet.version.to_s
 

data/lib/puppet/network/http/connection.rb

@@ -198,6 +198,10 @@ module Puppet::Network::HTTP
               current_request[header] = value
             end
           when 429, 503
+            if connection.started?
+              Puppet.debug("Closing connection for #{current_site}")
+              connection.finish
+            end
             response = handle_retry_after(current_response)
           else
             response = current_response