puppet 5.5.22 → 6.0.0

data/lib/puppet/ssl/key.rb

@@ -28,11 +28,7 @@ DOC
   def initialize(name)
     super
 
-    if ca?
-      @password_file = Puppet[:capass]
-    else
-      @password_file = Puppet[:passfile]
-    end
+    @password_file = Puppet[:passfile]
   end
 
   def password

data/lib/puppet/ssl/oids.rb

@@ -101,10 +101,10 @@ module Puppet::SSL::Oids
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
   def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
-    if File.exist?(custom_oid_file) && File.readable?(custom_oid_file)
+    if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
       mapping = nil
       begin
-        mapping = YAML.load_file(custom_oid_file)
+        mapping = Puppet::Util::Yaml.safe_load_file(custom_oid_file, [Symbol])
       rescue => err
         raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': %{err}") % { custom_oid_file: custom_oid_file, err: err }, err.backtrace
       end
@@ -187,7 +187,7 @@ module Puppet::SSL::Oids
     else
       second_oid.index(first_oid) == 0
     end
-  rescue OpenSSL::ASN1::ASN1Error
+  rescue OpenSSL::ASN1::ASN1Error, TypeError
     false
   end
 end

data/lib/puppet/ssl/validator/default_validator.rb

@@ -9,28 +9,20 @@ require 'puppet/ssl'
 class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   attr_reader :peer_certs
   attr_reader :verify_errors
-  attr_reader :ssl_configuration
-  attr_reader :last_error
 
   FIVE_MINUTES_AS_SECONDS = 5 * 60
 
   # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
   #
-  # @param ssl_configuration [Puppet::SSL::Configuration] (a default configuration) ssl_configuration the SSL configuration to use
-  # @param ssl_host [Puppet::SSL::Host] The SSL host to use
+  # @param ca_path [String] Filepath for the cacert
   #
   # @api private
   #
   def initialize(
-      ssl_configuration = Puppet::SSL::Configuration.new(
-                                        Puppet[:localcacert], {
-                                          :ca_auth_file  => Puppet[:ssl_client_ca_auth]
-                                        }),
-      ssl_host = Puppet.lookup(:ssl_host))
+    ca_path = Puppet[:ssl_client_ca_auth] || Puppet[:localcacert])
 
     reset!
-    @ssl_configuration = ssl_configuration
-    @ssl_host = ssl_host
+    @ca_path = ca_path
   end
 
 
@@ -41,8 +33,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   def reset!
     @peer_certs = []
     @verify_errors = []
-    @hostname = nil
-    @last_error = nil
   end
 
   # Performs verification of the SSL connection and collection of the
@@ -73,7 +63,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   #
   def call(preverify_ok, store_context)
     current_cert = store_context.current_cert
-    @peer_certs << Puppet::SSL::Certificate.from_instance(current_cert)
+    @peer_certs << current_cert
 
     # We must make a copy since the scope of the store_context will be lost
     # across invocations of this method.
@@ -88,31 +78,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
       error_string = store_context.error_string || "OpenSSL error #{error}"
 
       case error
-      when OpenSSL::X509::V_OK
-        if @hostname
-          # chain is from leaf to root, opposite of the order that `call` is invoked
-          chain_cert = store_context.chain.first
-          peer_cert = @peer_certs.last
-
-          # ruby 2.4 doesn't compare certs based on value, so force to DER byte array
-          if peer_cert && chain_cert && peer_cert.content.to_der == chain_cert.to_der && !OpenSSL::SSL.verify_certificate_identity(peer_cert.content, @hostname)
-            valid_certnames = [peer_cert.name, *peer_cert.subject_alt_names].uniq
-            if valid_certnames.size > 1
-              expected_certnames = _("expected one of %{certnames}") % { certnames: valid_certnames.join(', ') }
-            else
-              expected_certnames = _("expected %{certname}") % { certname: valid_certnames.first }
-            end
-
-            msg = _("Server hostname '%{host}' did not match server certificate; %{expected_certnames}") % { host: @hostname, expected_certnames: expected_certnames }
-            @last_error = Puppet::Error.new(msg)
-            return false
-          else
-            @verify_errors << "#{error_string} for #{current_cert.subject}"
-          end
-        else
-          @verify_errors << "#{error_string} for #{current_cert.subject}"
-        end
-
       when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
         # current_crl can be nil
         # https://github.com/ruby/ruby/blob/ruby_1_9_3/ext/openssl/ossl_x509store.c#L501-L510
@@ -141,18 +106,17 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   #
   # @param [Net::HTTP] connection The connection to validate
   #
+  # @param [Puppet::SSL::Host] host The host object containing SSL data
   # @return [void]
   #
   # @api private
   #
-  def setup_connection(connection)
-    @hostname = connection.address
-
+  def setup_connection(connection, ssl_host = Puppet.lookup(:ssl_host))
     if ssl_certificates_are_present?
-      connection.cert_store = @ssl_host.ssl_store
-      connection.ca_file = @ssl_configuration.ca_auth_file
-      connection.cert = @ssl_host.certificate.content
-      connection.key = @ssl_host.key.content
+      connection.cert_store = ssl_host.ssl_store
+      connection.ca_file = @ca_path
+      connection.cert = ssl_host.certificate.content
+      connection.key = ssl_host.key.content
       connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
       connection.verify_callback = self
     else
@@ -160,13 +124,33 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
     end
   end
 
+  ##
+  # Decode a string of concatenated certificates
+  #
+  # @return [Array<OpenSSL::X509::Certificate>]
+  def decode_cert_bundle(bundle_str)
+    re = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
+    pem_ary = bundle_str.scan(re)
+    pem_ary.map do |pem_str|
+      OpenSSL::X509::Certificate.new(pem_str)
+    end
+  end
+
+  # read_file makes testing easier.
+  def read_file(path)
+    # https://www.ietf.org/rfc/rfc2459.txt defines the x509 V3 certificate format
+    # CA bundles are concatenated X509 certificates, but may also include
+    # comments, which could have UTF-8 characters
+    Puppet::FileSystem.read(path, :encoding => Encoding::UTF_8)
+  end
+
   # Validates the peer certificates against the authorized certificates.
   #
   # @api private
   #
   def valid_peer?
-    descending_cert_chain = @peer_certs.reverse.map {|c| c.content }
-    authz_ca_certs = ssl_configuration.ca_auth_certificates
+    descending_cert_chain = @peer_certs.reverse
+    authz_ca_certs = decode_cert_bundle(read_file(@ca_path))
 
     if not has_authz_peer_cert(descending_cert_chain, authz_ca_certs)
       msg = "The server presented a SSL certificate chain which does not include a " <<
@@ -198,6 +182,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # @api private
   #
   def ssl_certificates_are_present?
-    Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ssl_configuration.ca_auth_file)
+    Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ca_path)
   end
 end

data/lib/puppet/test/test_helper.rb

@@ -68,14 +68,7 @@ module Puppet::Test
     #  any individual tests.
     # @return nil
     def self.before_all_tests()
-      # The process environment is a shared, persistent resource.
-      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
-      if (!!File::ALT_SEPARATOR)
-        mode = :windows
-      else
-        mode = :posix
-      end
-      $old_env = Puppet::Util.get_environment(mode)
+      # Make sure that all of the setup is also done for any before(:all) blocks
     end
 
     # Call this method once, at the end of a test run, when no more tests
@@ -120,14 +113,20 @@ module Puppet::Test
       indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
       indirections.each do |indirector|
         $saved_indirection_state[indirector.name] = {
-          :@terminus_class => indirector.instance_variable_get(:@terminus_class),
-          :@cache_class    => indirector.instance_variable_get(:@cache_class),
-          # dup the termini hash so termini created and registered during
-          # the test aren't stored in our saved_indirection_state
-          :@termini        => indirector.instance_variable_get(:@termini).dup
+            :@terminus_class => indirector.instance_variable_get(:@terminus_class),
+            :@cache_class    => indirector.instance_variable_get(:@cache_class)
         }
       end
 
+      # The process environment is a shared, persistent resource.
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
+      $old_env = Puppet::Util.get_environment(mode)
+
       # So is the load_path
       $old_load_path = $LOAD_PATH.dup
 
@@ -145,11 +144,6 @@ module Puppet::Test
       Puppet::Util::Profiler.clear
 
       Puppet::SSL::Host.reset
-      Puppet::SSL::Host.ca_location = :none
-
-      Puppet::Node::Facts.indirection.terminus_class = :memory
-      facts = Puppet::Node::Facts.new(Puppet[:node_name_value])
-      Puppet::Node::Facts.indirection.save(facts)
 
       Puppet.clear_deprecation_warnings
     end

data/lib/puppet/transaction.rb

@@ -56,8 +56,6 @@ class Puppet::Transaction
     @prefetched_providers = Hash.new { |h,k| h[k] = {} }
 
     @prefetch_failed_providers = Hash.new { |h,k| h[k] = {} }
-
-    @failed_dependencies_already_notified = Set.new()
   end
 
   # Invoke the pre_run_check hook in every resource in the catalog.
@@ -293,9 +291,8 @@ class Puppet::Transaction
     if s && s.dependency_failed?
       # See above. --daniel 2011-06-06
       unless suppress_report then
-        s.failed_dependencies.find_all { |d| !(@failed_dependencies_already_notified.include?(d.ref)) }.each do |dep|
+        s.failed_dependencies.each do |dep|
           resource.notice _("Dependency %{dep} has failures: %{status}") % { dep: dep, status: resource_status(dep).failed }
-          @failed_dependencies_already_notified.add(dep.ref)
         end
       end
     end
@@ -358,17 +355,15 @@ class Puppet::Transaction
     Puppet.debug "Prefetching #{provider_class.name} resources for #{type_name}"
     begin
       provider_class.prefetch(resources)
-    rescue LoadError, Puppet::MissingCommand => detail
+    rescue Exception => detail
+      if !detail.is_a?(LoadError) && !detail.is_a?(Puppet::MissingCommand)
+        raise unless Puppet.settings[:future_features]
+        
+        @prefetch_failed_providers[type_name][provider_class.name] = true
+      end
       #TRANSLATORS `prefetch` is a function name and should not be translated
       message = _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail }
       Puppet.log_exception(detail, message)
-    rescue StandardError => detail
-      message = _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail }
-      Puppet.log_exception(detail, message)
-
-      raise unless Puppet.settings[:future_features]
-
-      @prefetch_failed_providers[type_name][provider_class.name] = true
     end
     @prefetched_providers[type_name][provider_class.name] = true
   end

data/lib/puppet/transaction/event.rb

@@ -1,12 +1,10 @@
 require 'puppet/transaction'
 require 'puppet/util/tagging'
 require 'puppet/util/logging'
-require 'puppet/util/methodhelper'
 require 'puppet/network/format_support'
 
 # A simple struct for storing what happens on the system.
 class Puppet::Transaction::Event
-  include Puppet::Util::MethodHelper
   include Puppet::Util::Tagging
   include Puppet::Util::Logging
   include Puppet::Network::FormatSupport
@@ -24,12 +22,41 @@ class Puppet::Transaction::Event
     obj
   end
 
-  def initialize(options = {})
-    @audited = false
-    @redacted = false
-    @corrective_change = false
+  def initialize(audited: false,
+                 corrective_change: false,
+                 desired_value: nil,
+                 file: nil,
+                 historical_value: nil,
+                 invalidate_refreshes: nil,
+                 line: nil,
+                 message: nil,
+                 name: nil,
+                 previous_value: nil,
+                 property: nil,
+                 redacted: false,
+                 resource: nil,
+                 source_description: nil,
+                 status: nil,
+                 tags: nil)
+
+    @audited = audited
+    @corrective_change = corrective_change
+    @desired_value = desired_value
+    @file = file
+    @historical_value = historical_value
+    @invalidate_refreshes = invalidate_refreshes
+    @line = line
+    @message = message
+    @name = name
+    @previous_value = previous_value
+    @redacted = redacted
+    @source_description = source_description
+    @tags = tags
+
+    self.property = property if property
+    self.resource = resource if resource
+    self.status = status if status
 
-    set_options(options)
     @time = Time.now
   end
 
@@ -71,13 +98,9 @@ class Puppet::Transaction::Event
       'redacted' => @redacted,
       'corrective_change' => @corrective_change,
     }
-    Puppet::Pops::Serialization::ToDataConverter.convert(hash, {
-      :rich_data => true,
-      :symbol_as_string => true,
-      :local_reference => false,
-      :type_by_reference => true,
-      :message_prefix => 'Event'
-    })
+    # Use the stringifying converter since rich data is not possible downstream.
+    # (This will destroy some data type information, but this is expected).
+    Puppet::Pops::Serialization::ToStringifiedConverter.convert(hash, :message_prefix => 'Event')
   end
 
   def property=(prop)

data/lib/puppet/transaction/event_manager.rb

@@ -147,27 +147,19 @@ class Puppet::Transaction::EventManager
     resource.send(callback)
 
     if not resource.is_a?(Puppet::Type.type(:whit))
-      message = n_("Triggered '%{callback}' from %{count} event", "Triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
-      resource.notice message
-      add_callback_status_event(resource, callback, message, "success")
+      resource.notice n_("Triggered '%{callback}' from %{count} event", "Triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
     end
-
     return true
   rescue => detail
     resource_error_message = _("Failed to call %{callback}: %{detail}") % { callback: callback, detail: detail }
-    resource.err(resource_error_message)
+    resource.err resource_error_message
+
     transaction.resource_status(resource).failed_to_restart = true
     transaction.resource_status(resource).fail_with_event(resource_error_message)
     resource.log_exception(detail)
     return false
   end
 
-  def add_callback_status_event(resource, callback, message, status)
-    options = { message: message, status: status, name: callback.to_s }
-    event = resource.event options
-    transaction.resource_status(resource) << event if event
-  end
-
   def process_noop_events(resource, callback, events)
     resource.notice n_("Would have triggered '%{callback}' from %{count} event", "Would have triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
 

data/lib/puppet/transaction/persistence.rb

@@ -62,7 +62,7 @@ class Puppet::Transaction::Persistence
     result = nil
     Puppet::Util.benchmark(:debug, _("Loaded transaction store file in %{seconds} seconds")) do
       begin
-        result = Puppet::Util::Yaml.load_file(filename, false, true)
+        result = Puppet::Util::Yaml.safe_load_file(filename, [Symbol])
       rescue Puppet::Util::Yaml::YamlLoadError => detail
         Puppet.log_exception(detail, _("Transaction store file %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail }, { :level => :warning })
 

data/lib/puppet/transaction/report.rb

@@ -346,7 +346,7 @@ class Puppet::Transaction::Report
     report = raw_summary
 
     ret = ""
-    report.keys.sort_by(&:to_s).each do |key|
+    report.keys.sort { |a,b| a.to_s <=> b.to_s }.each do |key|
       ret += "#{Puppet::Util::Metric.labelize(key)}:\n"
 
       report[key].keys.sort { |a,b|

data/lib/puppet/transaction/resource_harness.rb

@@ -99,7 +99,7 @@ class Puppet::Transaction::ResourceHarness
   # We persist the last known values for the properties of a resource after resource
   # application.
   # @param [Puppet::Type] resource resource whose values we are to persist.
-  # @param [ResourceApplicationContext] context the application context to operate on.
+  # @param [ResourceApplicationContent] context the application context to operate on.
   def persist_system_values(resource, context)
     param_to_event = {}
     context.status.events.each do |ev|
@@ -158,10 +158,7 @@ class Puppet::Transaction::ResourceHarness
       raise
     ensure
       if event
-        name = param.name.to_s
-        event.message ||= _("could not create change error message for %{name}") % { name: name }
-        event.calculate_corrective_change(@persistence.get_system_value(context.resource.ref, name))
-        event.message << ' (corrective)' if event.corrective_change
+        event.calculate_corrective_change(@persistence.get_system_value(context.resource.ref, param.name.to_s))
         context.record(event)
         event.send_log
         context.synced_params << param.name

data/lib/puppet/type.rb

@@ -110,10 +110,8 @@ class Type
 
   # Allow declaring that a type is actually a capability
   class << self
-    # @deprecated application orchestration will be removed in puppet 7
     attr_accessor :is_capability
 
-    # @deprecated application orchestration will be removed in puppet 7
     def is_capability?
       c = is_capability
       c.nil? ? false : c
@@ -125,8 +123,6 @@ class Type
   # represent application instances, this implementation always returns
   # +false+. Having this method though makes code checking whether a
   # resource is an application instance simpler
-  #
-  # @deprecated application orchestration will be removed in puppet 7
   def self.application?
       false
   end
@@ -830,6 +826,7 @@ class Type
   #
   def set_default(attr)
     return unless klass = self.class.attrclass(attr)
+    # TODO this is not a necessary check, as we define a class level attr_reader
     return unless klass.method_defined?(:default)
     return if @parameters.include?(klass.name)
 
@@ -1451,7 +1448,7 @@ class Type
           }
 
       Tags are useful for things like applying a subset of a host's configuration
-      with [the `tags` setting](https://puppet.com/docs/puppet/latest/configuration.html#tags)
+      with [the `tags` setting](/puppet/latest/configuration.html#tags)
       (e.g. `puppet agent --test --tags bootstrap`)."
 
     munge do |tags|
@@ -1671,7 +1668,6 @@ class Type
     }
   end
 
-  # @deprecated application orchestration will be removed in puppet 7
   newmetaparam(:export, :parent => RelationshipMetaparam, :attributes => {:direction => :out, :events => :NONE}) do
           desc <<EOS
 Export a capability resource.
@@ -1697,7 +1693,6 @@ web { server:
 EOS
   end
 
-  # @deprecated application orchestration will be removed in puppet 7
   newmetaparam(:consume, :parent => RelationshipMetaparam, :attributes => {:direction => :in, :events => :NONE}) do
           desc <<EOS
 Consume a capability resource.
@@ -1804,7 +1799,7 @@ end
     name = name.intern
 
     # If we don't have it yet, try loading it.
-    @providerloader.load(name) unless provider_hash.has_key?(name)
+    @providerloader.load(name, Puppet.lookup(:current_environment)) unless provider_hash.has_key?(name)
     provider_hash[name]
   end
 
@@ -1915,7 +1910,9 @@ end
         # Since we're mixing @doc with text from other sources, we must normalize
         # its indentation with scrub. But we don't need to manually scrub the
         # provider's doc string, since markdown_definitionlist sanitizes its inputs.
-        scrub(@doc) + "Available providers are:\n\n" + parenttype.providers.sort_by(&:to_s).collect { |i|
+        scrub(@doc) + "Available providers are:\n\n" + parenttype.providers.sort { |a,b|
+          a.to_s <=> b.to_s
+        }.collect { |i|
           markdown_definitionlist( i, scrub(parenttype().provider(i).doc) )
         }.join
       end
@@ -1969,7 +1966,7 @@ end
   # @return [Array<Puppet::Provider>] Returns an array of all suitable providers.
   #
   def self.suitableprovider
-    providerloader.loadall if provider_hash.empty?
+    providerloader.loadall(Puppet.lookup(:current_environment)) if provider_hash.empty?
     provider_hash.find_all { |name, provider|
       provider.suitable?
     }.collect { |name, provider|