puppet 5.5.22 → 6.0.0

data/lib/puppet/application/describe.rb

@@ -64,7 +64,9 @@ class TypeDoc
 
   def list_types
     puts "These are the types known to puppet:\n"
-    @types.keys.sort_by(&:to_s).each do |name|
+    @types.keys.sort { |a, b|
+      a.to_s <=> b.to_s
+    }.each do |name|
       type = @types[name]
       s = type.doc.gsub(/\s+/, " ")
       n = s.index(". ")
@@ -147,14 +149,18 @@ class TypeDoc
   end
 
   def format_providers(type)
-    type.providers.sort_by(&:to_s).each { |prov|
+    type.providers.sort { |a,b|
+      a.to_s <=> b.to_s
+    }.each { |prov|
       puts "\n- **#{prov}**"
       puts @format.wrap(type.provider(prov).doc, :indent => 4, :scrub => true)
     }
   end
 
   def list_providers(type)
-    list = type.providers.sort_by(&:to_s).join(", ")
+    list = type.providers.sort { |a,b|
+      a.to_s <=> b.to_s
+    }.join(", ")
     puts @format.wrap(list, :indent => 4)
   end
 

data/lib/puppet/application/device.rb

@@ -1,5 +1,4 @@
 require 'puppet/application'
-require 'puppet/configurer'
 require 'puppet/util/network_device'
 
 class Puppet::Application::Device < Puppet::Application
@@ -54,10 +53,6 @@ class Puppet::Application::Device < Puppet::Application
     options[:detailed_exitcodes] = true
   end
 
-  option("--libdir LIBDIR") do |arg|
-    options[:libdir] = arg
-  end
-
   option("--apply MANIFEST") do |arg|
     options[:apply] = arg.to_s
   end
@@ -98,11 +93,10 @@ a scheduled task, or a similar tool.
 
 USAGE
 -----
-  puppet device [-h|--help] [-v|--verbose] [-d|--debug]
-                [-l|--logdest syslog|<file>|console] [--detailed-exitcodes]
-                [--deviceconfig <file>] [-w|--waitforcert <seconds>]
-                [--libdir <directory>]
-                [-a|--apply <file>] [-f|--facts] [-r|--resource <type> [name]]
+  puppet device [-d|--debug] [--detailed-exitcodes] [--deviceconfig <file>]
+                [-h|--help] [-l|--logdest syslog|<file>|console]
+                [-v|--verbose] [-w|--waitforcert <seconds>] [-f|--facts]
+                [-a|--apply <file>] [-r|--resource <type> [name]]
                 [-t|--target <device>] [--user=<user>] [-V|--version]
 
 
@@ -141,25 +135,9 @@ Note that any setting that's valid in the configuration file is also a valid
 long argument. For example, 'server' is a valid configuration parameter, so
 you can specify '--server <servername>' as an argument.
 
-* --help, -h:
-  Print this help message
-
-* --verbose, -v:
-  Turn on verbose reporting.
-
-* --debug, -d:
+* --debug:
   Enable full debugging.
 
-* --logdest, -l:
-  Where to send log messages. Choose between 'syslog' (the POSIX syslog
-  service), 'console', or the path to a log file. If debugging or verbosity is
-  enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
-
-  A path ending with '.json' will receive structured output in JSON format. The
-  log file will not have an ending ']' automatically written to it due to the
-  appending nature of logging. It must be appended manually to make the content
-  valid JSON.
-
 * --detailed-exitcodes:
   Provide transaction information via exit codes. If this is enabled, an exit
   code of '1' means at least one device had a compile failure, an exit code of
@@ -171,16 +149,18 @@ you can specify '--server <servername>' as an argument.
   Path to the device config file for puppet device.
   Default: $confdir/device.conf
 
-* --waitforcert, -w:
-  This option only matters for targets that do not yet have certificates
-  and it is enabled by default, with a value of 120 (seconds).  This causes
-  +puppet device+ to poll the server every 2 minutes and ask it to sign a
-  certificate request.  This is useful for the initial setup of a target.
-  You can turn off waiting for certificates by specifying a time of 0.
+* --help:
+  Print this help message
 
-* --libdir:
-  Override the per-device libdir with a local directory. Specifying a libdir also
-  disables pluginsync. This is useful for testing.
+* --logdest:
+  Where to send log messages. Choose between 'syslog' (the POSIX syslog
+  service), 'console', or the path to a log file. If debugging or verbosity is
+  enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
+
+  A path ending with '.json' will receive structured output in JSON format. The
+  log file will not have an ending ']' automatically written to it due to the
+  appending nature of logging. It must be appended manually to make the content
+  valid JSON.
 
 * --apply:
   Apply a manifest against a remote target. Target must be specified.
@@ -203,6 +183,16 @@ you can specify '--server <servername>' as an argument.
 * --user:
   The user to run as.
 
+* --verbose:
+  Turn on verbose reporting.
+
+* --waitforcert:
+  This option only matters for daemons that do not yet have certificates
+  and it is enabled by default, with a value of 120 (seconds).  This causes
+  +puppet agent+ to connect to the server every 2 minutes and ask it to sign a
+  certificate request.  This is useful for the initial setup of a puppet
+  client.  You can turn off waiting for certificates by specifying a time of 0.
+
 
 EXAMPLE
 -------
@@ -215,7 +205,7 @@ Brice Figureau
 
 COPYRIGHT
 ---------
-Copyright (c) 2011-2018 Puppet Inc., LLC
+Copyright (c) 2011 Puppet Inc., LLC
 Licensed under the Apache 2.0 License
       HELP
   end
@@ -232,12 +222,11 @@ Licensed under the Apache 2.0 License
       raise _("missing argument: --target is required when using --apply") if options[:target].nil?
       raise _("%{file} does not exist, cannot apply") % { file: options[:apply] } unless File.file?(options[:apply])
     end
-    libdir = Puppet[:libdir]
     vardir = Puppet[:vardir]
     confdir = Puppet[:confdir]
     certname = Puppet[:certname]
 
-    env = Puppet::Node::Environment.remote(Puppet[:environment])
+    env = Puppet.lookup(:environments).get(Puppet[:environment])
     returns = Puppet.override(:current_environment => env, :loaders => Puppet::Pops::Loaders.new(env)) do
       # find device list
       require 'puppet/util/network_device/config'
@@ -262,33 +251,10 @@ Licensed under the Apache 2.0 License
 
           # override local $vardir and $certname
           Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
-          Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
           Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
           Puppet[:certname] = device.name
 
-          unless options[:resource] || options[:facts] || options[:apply]
-            # this will reload and recompute default settings and create the devices sub vardir
-            Puppet.settings.use :main, :agent, :ssl
-
-            # Since it's too complicated to fix properly in the default settings, we workaround for PUP-9642 here.
-            # See https://github.com/puppetlabs/puppet/pull/7483#issuecomment-483455997 for details.
-            # This has to happen after `settings.use` above, so the directory is created and before `setup_host` below, where the SSL
-            # routines would fail with access errors
-            if Puppet.features.root? && !Puppet::Util::Platform.windows?
-              user = Puppet::Type.type(:user).new(name: Puppet[:user]).exists? ? Puppet[:user] : nil
-              group = Puppet::Type.type(:group).new(name: Puppet[:group]).exists? ? Puppet[:group] : nil
-              Puppet.debug("Fixing perms for #{user}:#{group} on #{Puppet[:confdir]}")
-              FileUtils.chown(user, group, Puppet[:confdir]) if user || group
-            end
-
-            # ask for a ssl cert if needed, and setup the ssl system for this device.
-            setup_host
-
-            # only pluginsync if we do not have a libdir specified on the command line
-            Puppet::Configurer::PluginHandler.new.download_plugins(env) unless options[:libdir]
-          end
-
-          # this inits the device singleton, so that the facts terminus
+          # this init the device singleton, so that the facts terminus
           # and the various network_device provider can use it
           Puppet::Util::NetworkDevice.init(device)
 
@@ -297,10 +263,10 @@ Licensed under the Apache 2.0 License
             Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
             resources = find_resources(type, name)
             if options[:to_yaml]
-              data = resources.map do |resource|
-                resource.prune_parameters(:parameters_to_include => @extra_params).to_hiera_hash
-              end.inject(:merge!)
-              text = YAML.dump(type.downcase => data)
+              text = resources.map do |resource|
+                resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
+              end.join("\n")
+              text.prepend("#{type.downcase}:\n")
             else
               text = resources.map do |resource|
                 resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
@@ -335,15 +301,21 @@ Licensed under the Apache 2.0 License
             end
           else
             Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            # this will reload and recompute default settings and create the devices sub vardir
+            Puppet.settings.use :main, :agent, :ssl
+            # ask for a ssl cert if needed, but at least
+            # setup the ssl system for this device.
+            setup_host
+
+            require 'puppet/configurer'
             configurer = Puppet::Configurer.new
-            configurer.run(:network_device => true, :pluginsync => Puppet::Configurer.should_pluginsync? && !options[:libdir])
+            configurer.run(:network_device => true, :pluginsync => Puppet::Configurer.should_pluginsync?)
           end
         rescue => detail
           Puppet.log_exception(detail)
           # If we rescued an error, then we return 1 as the exit code
           1
         ensure
-          Puppet[:libdir] = libdir
           Puppet[:vardir] = vardir
           Puppet[:confdir] = confdir
           Puppet[:certname] = certname
@@ -404,11 +376,6 @@ Licensed under the Apache 2.0 License
 
       Puppet.settings.use :main, :agent, :device, :ssl
 
-      # We need to specify a ca location for all of the SSL-related
-      # indirected classes to work; in fingerprint mode we just need
-      # access to the local files and we don't need a ca.
-      Puppet::SSL::Host.ca_location = :remote
-
       Puppet::Transaction::Report.indirection.terminus_class = :rest
 
       if Puppet[:catalog_cache_terminus]

data/lib/puppet/application/doc.rb

@@ -40,7 +40,8 @@ class Puppet::Application::Doc < Puppet::Application
 
   option("--list", "-l") do |arg|
     require 'puppet/util/reference'
-    puts Puppet::Util::Reference.references.collect { |r| Puppet::Util::Reference.reference(r).doc }.join("\n")
+    refs = Puppet::Util::Reference.references(Puppet.lookup(:current_environment))
+    puts refs.collect { |r| Puppet::Util::Reference.reference(r).doc }.join("\n")
     exit(0)
   end
 
@@ -154,7 +155,7 @@ HELP
     with_contents = options[:references].length <= 1
     exit_code = 0
     require 'puppet/util/reference'
-    options[:references].sort_by(&:to_s).each do |name|
+    options[:references].sort { |a,b| a.to_s <=> b.to_s }.each do |name|
       raise _("Could not find reference %{name}") % { name: name } unless section = Puppet::Util::Reference.reference(name)
 
       begin
@@ -198,7 +199,8 @@ HELP
     if options[:all]
       # Don't add dynamic references to the "all" list.
       require 'puppet/util/reference'
-      options[:references] = Puppet::Util::Reference.references.reject do |ref|
+      refs = Puppet::Util::Reference.references(Puppet.lookup(:current_environment))
+      options[:references] = refs.reject do |ref|
         Puppet::Util::Reference.reference(ref).dynamic?
       end
     end

data/lib/puppet/application/filebucket.rb

@@ -69,19 +69,6 @@ running as a user with valid Puppet certificates. Alternatively, you can
 use your local file bucket by specifying '--local', or by specifying
 '--bucket' with a local path.
 
-> **Note**: Enabling and using the backup option, and by extension the 
-  filebucket resource, requires appropriate planning and management to ensure 
-  that sufficient disk space is available for the file backups. Generally, you 
-  can implement this using one of the following two options:
-  - Use a `find` command and `crontab` entry to retain only the last X days 
-  of file backups. For example: 
-
-  ```shell
-  find /opt/puppetlabs/server/data/puppetserver/bucket -type f -mtime +45 -atime +45 -print0 | xargs -0 rm
-  ```
-
-  - Restrict the directory to a maximum size after which the oldest items are removed.
-
 
 OPTIONS
 -------
@@ -120,13 +107,8 @@ configuration options can also be generated by running puppet with
   information and the bucket located at the '$bucketdir' setting
   by default.
 
-* --server_list:
-  A list of comma seperated servers; only the first entry is used for file storage.
-  This setting takes precidence over `server`.
-
 * --server:
-  The server to use for file storage. This setting is only used if `server_list`
-  is not set.
+  The server to send the file to, instead of locally.
 
 * --todate:
   (list only) Select bucket files until 'todate'.
@@ -302,15 +284,11 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       else
         if Puppet[:server_list] && !Puppet[:server_list].empty?
           server = Puppet[:server_list].first
-          #TRANSLATORS 'server_list' is the name of a setting and should not be translated
-          Puppet.debug _("Selected server from first entry of the `server_list` setting: %{server}:%{port}") % {server: server[0], port: server[1]}
           @client = Puppet::FileBucket::Dipper.new(
             :Server => server[0],
             :Port => server[1]
           )
         else
-          #TRANSLATORS 'server' is the name of a setting and should not be translated
-          Puppet.debug _("Selected server from the `server` setting: %{server}") % {server: Puppet[:server]}
           @client = Puppet::FileBucket::Dipper.new(:Server => Puppet[:server])
         end
       end

data/lib/puppet/application/lookup.rb

@@ -283,7 +283,7 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
           'merge_hash_arrays' => !options[:merge_hash_arrays].nil?}
 
         if options[:prefix]
-          merge_options['knockout_prefix'] = options[:prefix]
+          merge_options.merge!({'knockout_prefix' => options[:prefix]})
         end
 
       else
@@ -353,7 +353,7 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
       if fact_file.end_with?("json")
         given_facts = Puppet::Util::Json.load(Puppet::FileSystem.read(fact_file, :encoding => 'utf-8'))
       else
-        given_facts = YAML.load(Puppet::FileSystem.read(fact_file, :encoding => 'utf-8'))
+        given_facts = Puppet::Util::Yaml.safe_load_file(fact_file)
       end
 
       unless given_facts.instance_of?(Hash)

data/lib/puppet/application/resource.rb

@@ -142,10 +142,10 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       resources = find_or_save_resources(type, name, params)
 
     if options[:to_yaml]
-      data = resources.map do |resource|
-        resource.prune_parameters(:parameters_to_include => @extra_params).to_hiera_hash
-      end.inject(:merge!)
-      text = YAML.dump(type.downcase => data)
+      text = resources.map do |resource|
+        resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
+      end.join("\n")
+      text.prepend("#{type.downcase}:\n")
     else
       text = resources.map do |resource|
         resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)

data/lib/puppet/application/script.rb

@@ -209,8 +209,8 @@ Copyright (c) 2017 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
           compiler.compile()
 
-        rescue Puppet::Error
-          # already logged and handled by the compiler, including Puppet::ParseErrorWithIssue
+        rescue Puppet::ParseErrorWithIssue, Puppet::Error
+          # already logged and handled by the compiler for these two cases
           exit(1)
         end
 
@@ -229,9 +229,9 @@ Copyright (c) 2017 Puppet Inc., LLC Licensed under the Apache 2.0 License
   end
 
   def setup
+
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
-    handle_logdest_arg(Puppet[:logdest])
     Puppet::Util::Log.newdestination(:console) unless options[:setdest]
 
     Signal.trap(:INT) do

data/lib/puppet/application/ssl.rb

@@ -0,0 +1,133 @@
+require 'puppet/application'
+require 'puppet/ssl/oids'
+
+class Puppet::Application::Ssl < Puppet::Application
+  def summary
+    _("Manage SSL keys and certificates for puppet SSL clients")
+  end
+
+  def help
+    <<-HELP
+puppet-ssl(8) -- #{summary}
+========
+
+SYNOPSIS
+--------
+Manage SSL keys and certificates for an SSL clients needed
+to communicate with a puppet infrastructure.
+
+USAGE
+-----
+puppet ssl <action> [--certname <NAME>]
+
+ACTIONS
+-------
+
+* submit_request:
+  Generate a certificate signing request (CSR) and submit it to the CA. If a private and
+  public key pair already exist, they will be used to generate the CSR. Otherwise a new
+  key pair will be generated. If a CSR has already been submitted with the given `certname`,
+  then the operation will fail.
+
+* download_cert:
+  Download a certificate for this host. If the current private key matches the downloaded
+  certificate, then the certificate will be saved and used for subsequent requests. If
+  there is already an existing certificate, it will be overwritten.
+
+* verify:
+  Verify the private key and certificate are present and match, verify the certificate is
+  issued by a trusted CA, and check revocation status.
+HELP
+  end
+
+  option('--certname NAME') do |arg|
+    options[:certname] = arg
+  end
+
+  def main
+    if command_line.args.empty?
+      puts help
+      exit(1)
+    end
+
+    Puppet.settings.use(:main, :agent)
+    host = Puppet::SSL::Host.new(options[:certname])
+
+    action = command_line.args.first
+    case action
+    when 'submit_request'
+      submit_request(host)
+      download_cert(host)
+    when 'download_cert'
+      download_cert(host)
+    when 'verify'
+      verify(host)
+    else
+      puts "Unknown action '#{action}'"
+      exit(1)
+    end
+
+    exit(0)
+  end
+
+  def submit_request(host)
+    host.ensure_ca_certificate
+
+    host.submit_request
+    puts "Submitted certificate request for '#{host.name}' to https://#{Puppet[:ca_server]}:#{Puppet[:ca_port]}"
+  rescue => e
+    puts "Failed to submit certificate request: #{e.message}"
+    exit(1)
+  end
+
+  def download_cert(host)
+    host.ensure_ca_certificate
+
+    puts "Downloading certificate '#{host.name}' from https://#{Puppet[:ca_server]}:#{Puppet[:ca_port]}"
+    if cert = host.download_host_certificate
+      puts "Downloaded certificate '#{host.name}' with fingerprint #{cert.fingerprint}"
+    else
+      puts "No certificate for '#{host.name}' on CA"
+    end
+  rescue => e
+    puts "Failed to download certificate: #{e.message}"
+    exit(1)
+  end
+
+  def verify(host)
+    host.ensure_ca_certificate
+
+    key = host.key
+    unless key
+      puts "The host's private key is missing"
+      exit(1)
+    end
+
+    cert = host.check_for_certificate_on_disk(host.name)
+    unless cert
+      puts "The host's certificate is missing"
+      exit(1)
+    end
+
+    if cert.content.public_key.to_pem != key.content.public_key.to_pem
+      puts "The host's key does not match the certificate"
+      exit(1)
+    end
+
+    store = host.ssl_store
+    unless store.verify(cert.content)
+      puts "Failed to verify certificate '#{host.name}': #{store.error_string} (#{store.error})"
+      exit(1)
+    end
+
+    puts "Verified certificate '#{host.name}'"
+    # store.chain.reverse.each_with_index do |issuer, i|
+    #   indent = "  " * (i+1)
+    #   puts "#{indent}#{issuer.subject.to_s}"
+    # end
+    exit(0)
+  rescue => e
+    puts "Verify failed: #{e.message}"
+    exit(1)
+  end
+end