puppet 5.5.22 → 6.0.0

data/install.rb

@@ -62,6 +62,24 @@ def do_configs(configs, target, strip = 'conf/')
     ocf = File.join(InstallOptions.config_dir, cf.gsub(/#{strip}/, ''))
     FileUtils.install(cf, ocf, {:mode => 0644, :preserve => true, :verbose => true})
   end
+
+  if $operatingsystem == 'windows'
+    src_dll = 'ext/windows/eventlog/puppetres.dll'
+    dst_dll = File.join(InstallOptions.bin_dir, 'puppetres.dll')
+    FileUtils.install(src_dll, dst_dll, {:mode => 0644, :preserve => true, :verbose => true})
+
+    require 'win32/registry'
+    include Win32::Registry::Constants
+
+    begin
+      Win32::Registry::HKEY_LOCAL_MACHINE.create('SYSTEM\CurrentControlSet\services\eventlog\Application\Puppet', KEY_ALL_ACCESS | 0x0100) do |reg|
+        reg.write_s('EventMessageFile', dst_dll.tr('/', '\\'))
+        reg.write_i('TypesSupported', 0x7)
+      end
+    rescue Win32::Registry::Error => e
+      warn "Failed to create puppet eventlog registry key: #{e}"
+    end
+  end
 end
 
 def do_bins(bins, target, strip = 's?bin/')
@@ -122,12 +140,12 @@ def check_prereqs
         facter_version = Facter.version.to_f
         if facter_version < MIN_FACTER_VERSION
           puts "Facter version: #{facter_version}; minimum required: #{MIN_FACTER_VERSION}; cannot install"
-          exit(-1)
+          exit -1
         end
       end
     rescue LoadError
       puts "Could not load #{pre}; cannot install"
-      exit(-1)
+      exit -1
     end
   }
 end
@@ -248,7 +266,7 @@ def prepare_installation
       require 'win32/dir'
     rescue LoadError => e
       puts "Cannot run on Microsoft Windows without the win32-process, win32-dir & win32-service gems: #{e}"
-      exit(-1)
+      exit -1
     end
   end
 
@@ -437,13 +455,13 @@ def install_binfile(from, op_file, target)
   if $operatingsystem == "windows" && InstallOptions.batch_files
     installed_wrapper = false
 
-    unless File.extname(from) =~ /\.(cmd|bat)/
-      if File.exist?("#{from}.bat")
+    unless File.extname(from).match(/\.(cmd|bat)/)
+      if File.exists?("#{from}.bat")
         FileUtils.install("#{from}.bat", File.join(target, "#{op_file}.bat"), :mode => 0755, :preserve => true, :verbose => true)
         installed_wrapper = true
       end
 
-      if File.exist?("#{from}.cmd")
+      if File.exists?("#{from}.cmd")
         FileUtils.install("#{from}.cmd", File.join(target, "#{op_file}.cmd"), :mode => 0755, :preserve => true, :verbose => true)
         installed_wrapper = true
       end

data/lib/hiera/scope.rb

@@ -1,8 +1,5 @@
-require 'forwardable'
 class Hiera
   class Scope
-    extend Forwardable
-
     CALLING_CLASS = 'calling_class'.freeze
     CALLING_CLASS_PATH = 'calling_class_path'.freeze
     CALLING_MODULE = 'calling_module'.freeze
@@ -82,9 +79,5 @@ class Hiera
       end
     end
     private :find_hostclass
-
-    # This is needed for type conversion to work
-    def_delegators :@real, :call_function
-
   end
 end

data/lib/puppet.rb

@@ -1,7 +1,7 @@
 require 'puppet/version'
 
-if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new("1.9.3")
-  raise LoadError, "Puppet #{Puppet.version} requires Ruby 1.9.3 or greater, found Ruby #{RUBY_VERSION.dup}."
+if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new("2.3.0")
+  raise LoadError, _("Puppet %{version} requires ruby 2.3.0 or greater.") % { version: Puppet.version }
 end
 
 Puppet::OLDEST_RECOMMENDED_RUBY_VERSION = '2.3.0'
@@ -22,7 +22,6 @@ require 'puppet/external/pson/common'
 require 'puppet/external/pson/version'
 require 'puppet/external/pson/pure'
 require 'puppet/gettext/config'
-require 'puppet/defaults'
 
 
 #------------------------------------------------------------
@@ -88,7 +87,6 @@ module Puppet
 
   # Store a new default value.
   def self.define_settings(section, hash)
-    Puppet.deprecation_warning('The method Puppet.define_settings is deprecated and will be removed in a future release')
     @@settings.define_settings(section, hash)
   end
 
@@ -123,9 +121,8 @@ module Puppet
     Puppet::Util::RunMode[@@settings.preferred_run_mode]
   end
 
-  # Modify the settings with defaults defined in `initialize_default_settings` method in puppet/defaults.rb. This can
-  # be used in the initialization of new Puppet::Settings objects in the puppetserver project.
-  Puppet.initialize_default_settings!(settings)
+  # Load all of the settings.
+  require 'puppet/defaults'
 
   # Now that settings are loaded we have the code loaded to be able to issue
   # deprecation warnings. Warn if we're on a deprecated ruby version.
@@ -141,14 +138,14 @@ module Puppet
   # @api public
   # @param args [Array<String>] the command line arguments to use for initialization
   # @return [void]
-  def self.initialize_settings(args = [], require_config = true)
-    do_initialize_settings_for_run_mode(:user, args, require_config)
+  def self.initialize_settings(args = [])
+    do_initialize_settings_for_run_mode(:user, args)
   end
 
   # private helper method to provide the implementation details of initializing for a run mode,
   #  but allowing us to control where the deprecation warning is issued
-  def self.do_initialize_settings_for_run_mode(run_mode, args, require_config = true)
-    Puppet.settings.initialize_global_settings(args, require_config)
+  def self.do_initialize_settings_for_run_mode(run_mode, args)
+    Puppet.settings.initialize_global_settings(args)
     run_mode = Puppet::Util::RunMode[run_mode]
     Puppet.settings.initialize_app_defaults(Puppet::Settings.app_defaults_for_run_mode(run_mode))
     Puppet.push_context(Puppet.base_context(Puppet.settings), "Initial context after settings initialization")
@@ -173,14 +170,6 @@ module Puppet
     end
   end
 
-  # Create a new type.  Just proxy to the Type class.  The mirroring query
-  # code was deprecated in 2008, but this is still in heavy use.  I suppose
-  # this can count as a soft deprecation for the next dev. --daniel 2011-04-12
-  def self.newtype(name, options = {}, &block)
-    Puppet.deprecation_warning(_("Creating %{name} via Puppet.newtype is deprecated and will be removed in a future release. Use Puppet::Type.newtype instead.") % { name: name })
-    Puppet::Type.newtype(name, options, &block)
-  end
-
   # Load vendored (setup paths, and load what is needed upfront).
   # See the Vendor class for how to add additional vendored gems/code
   require "puppet/vendor"
@@ -219,8 +208,8 @@ module Puppet
         Puppet::Network::HTTP::NoCachePool.new
       },
       :ssl_host => proc { Puppet::SSL::Host.localhost },
-      :certificate_revocation => proc { Puppet[:certificate_revocation] },
-      :plugins => proc { Puppet::Plugins::Configuration.load_plugins }
+      :plugins => proc { Puppet::Plugins::Configuration.load_plugins },
+      :rich_data => false
     }
   end
 

data/lib/puppet/agent.rb

@@ -61,15 +61,15 @@ class Puppet::Agent
             end
           rescue Puppet::LockError
             Puppet.notice _("Run of %{client_class} already in progress; skipping  (%{lockfile_path} exists)") % { client_class: client_class, lockfile_path: lockfile_path }
-            nil
+            return
           rescue RunTimeoutError => detail
             Puppet.log_exception(detail, _("Execution of %{client_class} did not complete within %{runtimeout} seconds and was terminated.") %
               {client_class: client_class,
               runtimeout: Puppet[:runtimeout]})
-            nil
+            return 1
           rescue StandardError => detail
             Puppet.log_exception(detail, _("Could not run %{client_class}: %{detail}") % { client_class: client_class, detail: detail })
-            nil
+            1
           end
         end
       end
@@ -95,9 +95,11 @@ class Puppet::Agent
         atForkHandler.child
         $0 = _("puppet agent: applying configuration")
         begin
-          exit(yield || 1)
+          exit(yield)
+        rescue SystemExit
+          exit(-1)
         rescue NoMemoryError
-          exit(254)
+          exit(-2)
         end
       end
     ensure
@@ -105,6 +107,12 @@ class Puppet::Agent
     end
 
     exit_code = Process.waitpid2(child_pid)
+    case exit_code[1].exitstatus
+    when -1
+      raise SystemExit
+    when -2
+      raise NoMemoryError
+    end
     exit_code[1].exitstatus
   end
 

data/lib/puppet/application.rb

@@ -183,7 +183,7 @@ class Application
 
     # used to declare code that handle an option
     def option(*options, &block)
-      long = options.find { |opt| opt =~ /^--/ }.gsub(/^--(?:\[no-\])?([^ =]+).*$/, '\1' ).tr('-','_')
+      long = options.find { |opt| opt =~ /^--/ }.gsub(/^--(?:\[no-\])?([^ =]+).*$/, '\1' ).gsub('-','_')
       fname = "handle_#{long}".intern
       if (block_given?)
         define_method(fname, &block)
@@ -209,7 +209,14 @@ class Application
     # @return [Array<String>] the names of available applications
     # @api public
     def available_application_names
-      @loader.files_to_load.map do |fn|
+      # Use our configured environment to load the application, as it may
+      # be in a module we installed locally, otherwise fallback to our
+      # current environment (*root*). Once we load the application the
+      # current environment will change from *root* to the application
+      # specific environment.
+      environment = Puppet.lookup(:environments).get(Puppet[:environment]) ||
+                    Puppet.lookup(:current_environment)
+      @loader.files_to_load(environment).map do |fn|
         ::File.basename(fn, '.rb')
       end.uniq
     end
@@ -388,8 +395,6 @@ class Application
   end
 
   def setup_logs
-    handle_logdest_arg(Puppet[:logdest]) if !options[:setdest]
-
     unless options[:setdest]
       if options[:debug] || options[:verbose]
         Puppet::Util::Log.newdestination(:console)
@@ -411,14 +416,11 @@ class Application
   end
 
   def handle_logdest_arg(arg)
-    return if arg.nil?
-
     begin
-      Puppet[:logdest] = arg
       Puppet::Util::Log.newdestination(arg)
       options[:setdest] = true
     rescue => detail
-      Puppet.log_and_raise(detail, _("Could not set logdest to %{dest}.") % { dest: arg })
+      Puppet.log_exception(detail)
     end
   end
 

data/lib/puppet/application/agent.rb

@@ -245,9 +245,7 @@ generated by running puppet agent with '--genconfig'.
 
 * --job-id:
   Attach the specified job id to the catalog request and the report used for
-  this agent run. This option only works when '--onetime' is used.  When using
-  Puppet Enterprise this flag should not be used as the orchestrator sets the
-  job-id for you and it must be unique.
+  this agent run. This option only works when '--onetime' is used.
 
 * --logdest:
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
@@ -346,8 +344,6 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       # Setup signal traps immediately after daemonization so we clean up the daemon
       daemon.set_signal_traps
 
-      log_config if Puppet[:daemonize]
-
       wait_for_certificates
 
       if Puppet[:onetime]
@@ -358,16 +354,6 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
     end
   end
 
-  def log_config
-    #skip also config reading and parsing if debug is not enabled
-    return unless Puppet::Util::Log.sendlevel?(:debug)
-
-    Puppet.settings.stringify_settings(:agent, :all).each_pair do |k,v|
-      next if k.include?("password") || v.to_s.empty?
-      Puppet.debug("Using setting: #{k}=#{v}")
-    end
-  end
-
   def fingerprint
     host = Puppet::SSL::Host.new
     unless cert = host.certificate || host.certificate_request
@@ -440,12 +426,8 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       Puppet::Resource::Catalog.indirection.cache_class = Puppet[:catalog_cache_terminus]
     end
 
-    if options[:fingerprint]
-      # in fingerprint mode we just need
-      # access to the local files and we don't need a ca
-      Puppet::SSL::Host.ca_location = :none
-    else
-      Puppet::SSL::Host.ca_location = :remote
+    # In fingerprint mode we don't need to set up the whole agent
+    unless options[:fingerprint]
       setup_agent
     end
   end

data/lib/puppet/application/apply.rb

@@ -260,25 +260,36 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
         catalog =
         begin
           Puppet::Resource::Catalog.indirection.find(node.name, :use_node => node)
-        rescue Puppet::Error
-          # already logged and handled by the compiler, including Puppet::ParseErrorWithIssue
+        rescue Puppet::ParseErrorWithIssue, Puppet::Error
+          # already logged and handled by the compiler for these two cases
           exit(1)
         end
 
-        # Translate it to a RAL catalog
-        catalog = catalog.to_ral
+        # Loaders are required when resolving deferred values and at the end
+        # when apply_catalog is called - it is therefore used around all of the
+        # required steps as it is expensive to set up loaders twice (once for
+        # resolution and once for the apply).
+        #
+        exit_status = Puppet.override(:loaders => Puppet::Pops::Loaders.new(apply_environment)) do
 
-        catalog.finalize
+          # Resolve all deferred values and replace them / mutate the catalog
+          Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog)
 
-        catalog.retrieval_duration = Time.now - starttime
+          # Translate it to a RAL catalog
+          catalog = catalog.to_ral
 
-        if options[:write_catalog_summary]
-          catalog.write_class_file
-          catalog.write_resource_file
-        end
+          catalog.finalize
 
-        exit_status = Puppet.override(:loaders => Puppet::Pops::Loaders.new(apply_environment)) { apply_catalog(catalog) }
+          catalog.retrieval_duration = Time.now - starttime
 
+          if options[:write_catalog_summary]
+            catalog.write_class_file
+            catalog.write_resource_file
+          end
+
+          #exit_status = Puppet.override(:loaders => Puppet::Pops::Loaders.new(apply_environment)) { apply_catalog(catalog) }
+          apply_catalog(catalog)
+        end
         if not exit_status
           exit(1)
         elsif options[:detailed_exitcodes] then
@@ -312,7 +323,6 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
-    handle_logdest_arg(Puppet[:logdest])
     Puppet::Util::Log.newdestination(:console) unless options[:setdest]
 
     Signal.trap(:INT) do

data/lib/puppet/application/cert.rb

@@ -1,5 +1,4 @@
 require 'puppet/application'
-require 'puppet/ssl/certificate_authority/interface'
 
 class Puppet::Application::Cert < Puppet::Application
 
@@ -100,219 +99,74 @@ class Puppet::Application::Cert < Puppet::Application
   end
 
   def summary
-    _("Manage certificates and requests (Deprecated)")
+    _("Manage certificates and requests (Disabled)")
   end
 
   def help
-    <<-HELP
+     <<-HELP
+This command is no longer functional, please use `puppetserver ca` instead.
 
 puppet-cert(8) -- #{summary}
 ========
 
-SYNOPSIS
---------
-Standalone certificate authority. Capable of generating certificates,
-but mostly used for signing certificate requests from puppet clients.
-
-
-USAGE
------
-puppet cert <action> [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
-  [--digest <digest>] [<host>]
-
-
-DESCRIPTION
------------
-Because the puppet master service defaults to not signing client
-certificate requests, this script is available for signing outstanding
-requests. It can be used to list outstanding requests and then either
-sign them individually or sign all of them.
-
 ACTIONS
 -------
-
 Every action except 'list' and 'generate' requires a hostname to act on,
 unless the '--all' option is set.
 
-The most important actions for day-to-day use are 'list' and 'sign'.
-
 * clean:
-  Revoke a host's certificate (if applicable) and remove all files
-  related to that host from puppet cert's storage. This is useful when
-  rebuilding hosts, since new certificate signing requests will only be
-  honored if puppet cert does not have a copy of a signed certificate
-  for that host. If '--all' is specified then all host certificates,
-  both signed and unsigned, will be removed.
+  Use `puppetserver ca clean --certname NAME[,NAME...]`
 
 * fingerprint:
-  Print the DIGEST (defaults to the signing algorithm) fingerprint of a
-  host's certificate.
+  Use openssl directly:
+  `openssl x509 -noout -fingerprint -<digest> -inform pem -in certificate.crt`
 
 * generate:
-  Generate a certificate for a named client. A certificate/keypair will
-  be generated for each client named on the command line.
+  Use `puppetserver ca generate --certname NAME[,NAME...]`
 
 * list:
-  List outstanding certificate requests. If '--all' is specified, signed
-  certificates are also listed, prefixed by '+', and revoked or invalid
-  certificates are prefixed by '-' (the verification outcome is printed
-  in parenthesis). If '--human-readable' or '-H' is specified,
-  certificates are formatted in a way to improve human scan-ability. If
-  '--machine-readable' or '-m' is specified, output is formatted concisely
-  for consumption by a script.
+  Use `puppetserver ca list [--all]`
 
 * print:
-  Print the full-text version of a host's certificate.
+  Use openssl directly:
+  `openssl x509 -noout -text -in certificate.pem`
 
 * revoke:
-  Revoke the certificate of a client. The certificate can be specified either
-  by its serial number (given as a hexadecimal number prefixed by '0x') or by its
-  hostname. The certificate is revoked by adding it to the Certificate Revocation
-  List given by the 'cacrl' configuration option. Note that the puppet master
-  needs to be restarted after revoking certificates.
+  Use `puppetserver ca revoke --cerntname NAME[,NAME...]`
 
 * sign:
-  Sign an outstanding certificate request. If '--interactive' or '-i' is
-  supplied the user will be prompted to confirm that they are signing the
-  correct certificate (recommended). If '--assume-yes' or '-y' is supplied
-  the interactive prompt will assume the answer of 'yes'.
+  Use `puppetserver ca sign --cerntname NAME[,NAME...]`
 
 * verify:
-  Verify the named certificate against the local CA certificate.
+  Use `puppet ssl verify [--certname NAME]`
 
 * reinventory:
-  Build an inventory of the issued certificates. This will destroy the current
-  inventory file specified by 'cert_inventory' and recreate it from the
-  certificates found in the 'certdir'. Ensure the puppet master is stopped
-  before running this action.
+  Removed.
 
 OPTIONS
 -------
-Note that any setting that's valid in the configuration
-file is also a valid long argument. For example, 'ssldir' is a valid
-setting, so you can specify '--ssldir <directory>' as an
-argument.
-
-See the configuration file documentation at
-https://puppet.com/docs/puppet/latest/configuration.html for the
-full list of acceptable parameters. A commented list of all
-configuration options can also be generated by running puppet cert with
-'--genconfig'.
-
-* --all:
-  Operate on all items. Currently only makes sense with the 'sign',
-  'list', and 'fingerprint' actions.
+There are a couple important notes about previously-supported options.
 
 * --allow-dns-alt-names:
-  Sign a certificate request even if it contains one or more alternate DNS
-  names. If this option isn't specified, 'puppet cert sign' will ignore any
-  requests that contain alternate names.
-
-  In general, ONLY certs intended for a Puppet master server should include
-  alternate DNS names, since Puppet agent relies on those names for identifying
-  its rightful server.
-
-  You can make Puppet agent request a certificate with alternate names by
-  setting 'dns_alt_names' in puppet.conf or specifying '--dns_alt_names' on the
-  command line. The output of 'puppet cert list' shows any requested alt names
-  for pending certificate requests.
+  In order to sign certificates with subject alternative names using
+  `puppetserver ca sign`, the `allow-subject-alt-names` setting must be
+  set to true in the `certificate-authority` section of Puppet Server's
+  config.
 
 * --allow-authorization-extensions:
-  Enable the signing of a request with authorization extensions. Such requests
-  are sensitive because they can be used to write access rules in Puppet Server.
-  Currently, this is the only means by which such requests can be signed.
-
-* --digest:
-  Set the digest for fingerprinting (defaults to the digest used when
-  signing the cert). Valid values depends on your openssl and openssl ruby
-  extension version.
-
-* --debug:
-  Enable full debugging.
-
-* --help:
-  Print this help message
-
-* --verbose:
-  Enable verbosity.
-
-* --version:
-  Print the puppet version number and exit.
-
-
-EXAMPLE
--------
-    $ puppet cert list
-    culain.madstop.com
-    $ puppet cert sign culain.madstop.com
-
-
-AUTHOR
-------
-Luke Kanies
-
-
-COPYRIGHT
----------
-Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
-
-    HELP
+  In order to sign certificates with authorization extensions using
+  `puppetserver ca sign`, the `allow-authorization-extensions` setting must be
+  set to true in the `certificate-authority` section of Puppet Server's
+  config.
+HELP
   end
 
   def main
-    if @all
-      hosts = :all
-    elsif @signed
-      hosts = :signed
-    else
-      hosts = command_line.args.collect { |h| h.downcase }
-    end
-    begin
-      if subcommand == :destroy
-        raise _("Refusing to destroy all certs, provide an explicit list of certs to destroy") if hosts == :all
-
-        signed_hosts = hosts - @ca.waiting?
-        apply(@ca, :revoke, options.merge(:to => signed_hosts)) unless signed_hosts.empty?
-      end
-      apply(@ca, subcommand, options.merge(:to => hosts, :digest => @digest))
-    rescue => detail
-      Puppet.log_exception(detail)
-      exit(24)
-    end
+    help
   end
 
   def setup
     deprecate
-
-    require 'puppet/ssl/certificate_authority'
-    exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
-
-    Puppet::SSL::Oids.register_puppet_oids
-    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])
-
-    Puppet::Util::Log.newdestination :console
-
-    if [:generate, :destroy].include? subcommand
-      Puppet::SSL::Host.ca_location = :local
-    else
-      Puppet::SSL::Host.ca_location = :only
-    end
-
-    # If we are generating, and the option came from the CLI, it gets added to
-    # the data.  This will do the right thing for non-local certificates, in
-    # that the command line but *NOT* the config file option will apply.
-    if subcommand == :generate
-      if Puppet.settings.set_by_cli?(:dns_alt_names)
-        options[:dns_alt_names] = Puppet[:dns_alt_names]
-      end
-    end
-
-    begin
-      @ca = Puppet::SSL::CertificateAuthority.new
-    rescue => detail
-      Puppet.log_exception(detail)
-      exit(23)
-    end
   end
 
   def parse_options
@@ -329,13 +183,4 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
     result
   end
-
-  # Create and run an applicator.  I wanted to build an interface where you could do
-  # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
-  def apply(ca, method, options)
-    raise ArgumentError, _("You must specify the hosts to apply to; valid values are an array or the symbol :all") unless options[:to]
-    applier = Puppet::SSL::CertificateAuthority::Interface.new(method, options)
-    applier.apply(ca)
-  end
-
 end