puppet 6.0.0 → 6.1.0

data/lib/puppet/application/ssl.rb

@@ -2,6 +2,9 @@ require 'puppet/application'
 require 'puppet/ssl/oids'
 
 class Puppet::Application::Ssl < Puppet::Application
+
+  run_mode :agent
+
   def summary
     _("Manage SSL keys and certificates for puppet SSL clients")
   end
@@ -13,121 +16,202 @@ puppet-ssl(8) -- #{summary}
 
 SYNOPSIS
 --------
-Manage SSL keys and certificates for an SSL clients needed
+Manage SSL keys and certificates for SSL clients needing
 to communicate with a puppet infrastructure.
 
 USAGE
 -----
-puppet ssl <action> [--certname <NAME>]
+puppet ssl <action> [-h|--help] [-v|--verbose] [-d|--debug] [--localca] [--target CERTNAME]
+
+
+OPTIONS
+-------
+
+* --help:
+  Print this help messsge.
+
+* --verbose:
+  Print extra information.
+
+* --debug:
+  Enable full debugging.
+
+* --localca
+  Also clean the local CA certificate and CRL.
+
+* --target CERTNAME
+  Clean the specified device certificate instead of this host's certificate.
 
 ACTIONS
 -------
 
 * submit_request:
-  Generate a certificate signing request (CSR) and submit it to the CA. If a private and
-  public key pair already exist, they will be used to generate the CSR. Otherwise a new
-  key pair will be generated. If a CSR has already been submitted with the given `certname`,
-  then the operation will fail.
+  Generate a certificate signing request (CSR) and submit it to the CA. If
+  a private and public key pair already exist, they will be used to generate
+  the CSR. Otherwise a new key pair will be generated. If a CSR has already
+  been submitted with the given `certname`, then the operation will fail.
 
 * download_cert:
-  Download a certificate for this host. If the current private key matches the downloaded
-  certificate, then the certificate will be saved and used for subsequent requests. If
-  there is already an existing certificate, it will be overwritten.
+  Download a certificate for this host. If the current private key matches
+  the downloaded certificate, then the certificate will be saved and used
+  for subsequent requests. If there is already an existing certificate, it
+  will be overwritten.
 
 * verify:
-  Verify the private key and certificate are present and match, verify the certificate is
-  issued by a trusted CA, and check revocation status.
+  Verify the private key and certificate are present and match, verify the
+  certificate is issued by a trusted CA, and check revocation status.
+
+* clean:
+  Remove the private key and certificate related files for this host. If
+  `--localca` is specified, then also remove this host's local copy of the
+  CA certificate(s) and CRL bundle. if `--target CERTNAME` is specified, then
+  remove the files for the specified device on this host instead of this host.
 HELP
   end
 
-  option('--certname NAME') do |arg|
-    options[:certname] = arg
+  option('--target CERTNAME') do |arg|
+    options[:target] = arg.to_s
+  end
+  option('--localca')
+  option('--verbose', '-v')
+  option('--debug', '-d')
+
+  def setup_logs
+    set_log_level(options)
+    Puppet::Util::Log.newdestination(:console)
   end
 
   def main
     if command_line.args.empty?
-      puts help
-      exit(1)
+      raise Puppet::Error, _("An action must be specified.")
     end
 
-    Puppet.settings.use(:main, :agent)
-    host = Puppet::SSL::Host.new(options[:certname])
+    if options[:target]
+      # Override the following, as per lib/puppet/application/device.rb
+      Puppet[:certname] = options[:target]
+      Puppet[:confdir]  = File.join(Puppet[:devicedir], Puppet[:certname])
+      Puppet[:vardir]   = File.join(Puppet[:devicedir], Puppet[:certname])
+      host = Puppet::SSL::Host.new(Puppet[:certname], true)
+      Puppet.settings.use(:main, :agent, :device)
+    else
+      host = Puppet::SSL::Host.new(Puppet[:certname])
+      Puppet.settings.use(:main, :agent)
+    end
 
     action = command_line.args.first
     case action
     when 'submit_request'
       submit_request(host)
-      download_cert(host)
+      cert = download_cert(host)
+      unless cert
+        Puppet.info _("The certificate for '%{name}' has not yet been signed") % { name: host.name }
+      end
     when 'download_cert'
-      download_cert(host)
+      cert = download_cert(host)
+      unless cert
+        raise Puppet::Error, _("The certificate for '%{name}' has not yet been signed") % { name: host.name }
+      end
     when 'verify'
       verify(host)
+    when 'clean'
+      clean(host)
     else
-      puts "Unknown action '#{action}'"
-      exit(1)
+      raise Puppet::Error, _("Unknown action '%{action}'") % { action: action }
     end
-
-    exit(0)
   end
 
   def submit_request(host)
     host.ensure_ca_certificate
 
     host.submit_request
-    puts "Submitted certificate request for '#{host.name}' to https://#{Puppet[:ca_server]}:#{Puppet[:ca_port]}"
+    Puppet.notice _("Submitted certificate request for '%{name}' to https://%{server}:%{port}") % {
+      name: host.name, server: Puppet[:ca_server], port: Puppet[:ca_port]
+    }
   rescue => e
-    puts "Failed to submit certificate request: #{e.message}"
-    exit(1)
+    raise Puppet::Error.new(_("Failed to submit certificate request: %{message}") % { message: e.message }, e)
   end
 
   def download_cert(host)
     host.ensure_ca_certificate
 
-    puts "Downloading certificate '#{host.name}' from https://#{Puppet[:ca_server]}:#{Puppet[:ca_port]}"
-    if cert = host.download_host_certificate
-      puts "Downloaded certificate '#{host.name}' with fingerprint #{cert.fingerprint}"
-    else
-      puts "No certificate for '#{host.name}' on CA"
-    end
+    Puppet.info _("Downloading certificate '%{name}' from https://%{server}:%{port}") % {
+      name: host.name, server: Puppet[:ca_server], port: Puppet[:ca_port]
+    }
+    cert = host.download_host_certificate
+    return unless cert
+
+    Puppet.notice _("Downloaded certificate '%{name}' with fingerprint %{fingerprint}") % {
+      name: host.name, fingerprint: cert.fingerprint
+    }
+    cert
   rescue => e
-    puts "Failed to download certificate: #{e.message}"
-    exit(1)
+    raise Puppet::Error.new(_("Failed to download certificate: %{message}") % { message: e.message }, e)
   end
 
   def verify(host)
     host.ensure_ca_certificate
 
     key = host.key
-    unless key
-      puts "The host's private key is missing"
-      exit(1)
-    end
+    raise _("The host's private key is missing") unless key
 
     cert = host.check_for_certificate_on_disk(host.name)
-    unless cert
-      puts "The host's certificate is missing"
-      exit(1)
-    end
+    raise _("The host's certificate is missing") unless cert
 
     if cert.content.public_key.to_pem != key.content.public_key.to_pem
-      puts "The host's key does not match the certificate"
-      exit(1)
+      raise _("The host's key does not match the certificate")
     end
 
     store = host.ssl_store
     unless store.verify(cert.content)
-      puts "Failed to verify certificate '#{host.name}': #{store.error_string} (#{store.error})"
-      exit(1)
+      raise _("Failed to verify certificate '%{name}': %{message} (%{error})") % {
+        name: host.name, message: store.error_string, error: store.error
+      }
     end
 
-    puts "Verified certificate '#{host.name}'"
+    Puppet.notice _("Verified certificate '%{name}'") % {
+      name: host.name
+    }
     # store.chain.reverse.each_with_index do |issuer, i|
     #   indent = "  " * (i+1)
-    #   puts "#{indent}#{issuer.subject.to_s}"
+    #   Puppet.notice "#{indent}#{issuer.subject.to_s}"
     # end
-    exit(0)
   rescue => e
-    puts "Verify failed: #{e.message}"
-    exit(1)
+    raise Puppet::Error.new(_("Verify failed: %{message}") % { message: e.message }, e)
+  end
+
+  def clean(host)
+    # make sure cert has been removed from the CA
+    if host.name == Puppet[:ca_server]
+      cert =
+        begin
+          host.download_certificate_from_ca(host.name)
+        rescue => e
+          raise Puppet::Error.new(_("Failed to connect to the CA to determine if certificate %{certname} has been cleaned") % { certname: host.name }, e)
+        end
+
+      if cert
+        raise Puppet::Error, _(<<END) % { certname: host.name }
+The certificate %{certname} must be cleaned from the CA first. To fix this,
+run the following commands on the CA:
+  puppetserver ca clean --certname %{certname}
+  puppet ssl clean
+END
+      end
+    end
+
+    paths = {
+      'private key' => Puppet[:hostprivkey],
+      'public key'  => Puppet[:hostpubkey],
+      'certificate request' => File.join(Puppet[:requestdir], "#{Puppet[:certname]}.pem"),
+      'certificate' => Puppet[:hostcert],
+      'private key password file' => Puppet[:passfile]
+    }
+    paths.merge!('local CA certificate' => Puppet[:localcacert], 'local CRL' => Puppet[:hostcrl]) if options[:localca]
+    paths.each_pair do |label, path|
+      if Puppet::FileSystem.exist?(path)
+        Puppet::FileSystem.unlink(path)
+        Puppet.notice _("Removed %{label} %{path}") % { label: label, path: path }
+      end
+    end
   end
 end

data/lib/puppet/application.rb

@@ -395,6 +395,8 @@ class Application
   end
 
   def setup_logs
+    handle_logdest_arg(Puppet[:logdest])
+
     unless options[:setdest]
       if options[:debug] || options[:verbose]
         Puppet::Util::Log.newdestination(:console)
@@ -416,7 +418,10 @@ class Application
   end
 
   def handle_logdest_arg(arg)
+    return if options[:setdest] || arg.nil?
+
     begin
+      Puppet[:logdest] = arg
       Puppet::Util::Log.newdestination(arg)
       options[:setdest] = true
     rescue => detail

data/lib/puppet/configurer.rb

@@ -16,7 +16,7 @@ class Puppet::Configurer
   # For benchmarking
   include Puppet::Util
 
-  attr_reader :compile_time, :environment
+  attr_reader :environment
 
   # Provide more helpful strings to the logging that the Agent does
   def self.to_s
@@ -42,7 +42,6 @@ class Puppet::Configurer
   # Initialize and load storage
   def init_storage
       Puppet::Util::Storage.load
-      @compile_time ||= Puppet::Util::Storage.cache(:configuration)[:compile_time]
   rescue => detail
     Puppet.log_exception(detail, _("Removing corrupt state file %{file}: %{detail}") % { file: Puppet[:statefile], detail: detail })
     begin
@@ -397,7 +396,7 @@ class Puppet::Configurer
       port = server[1] || Puppet[:masterport]
       begin
         http = Puppet::Network::HttpPool.http_ssl_instance(host, port)
-        response = http.get('/status/v1/simple')
+        response = http.get('/status/v1/simple/master')
         return [host, port] if response.is_a?(Net::HTTPOK)
 
         Puppet.debug(_("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %

data/lib/puppet/defaults.rb

@@ -734,9 +734,8 @@ module Puppet
       :desc    => <<EOT,
 A comma-separated list of alternate DNS names for Puppet Server. These are extra
 hostnames (in addition to its `certname`) that the server is allowed to use when
-serving agents. Puppet checks this setting when automatically requesting a
-certificate for Puppet agent or Puppet Server, and when manually generating a
-certificate with `puppet cert generate`. These can be either IP or DNS, and the type
+serving agents. Puppet checks this setting when automatically creating a
+certificate for Puppet agent or Puppet Server. These can be either IP or DNS, and the type
 should be specified and followed with a colon. Untyped inputs will default to DNS.
 
 In order to handle agent requests at a given hostname (like
@@ -749,23 +748,12 @@ names.
 
 **Note:** The list of alternate names is locked in when the server's
 certificate is signed. If you need to change the list later, you can't just
-change this setting; you also need to:
-
-* On the server: Stop Puppet Server.
-* On the CA server: Revoke and clean the server's old certificate. (`puppet cert clean <NAME>`)
-  (Note `puppet cert clean` is deprecated and will be replaced with `puppetserver ca clean`
-  in Puppet 6.)
-* On the server: Delete the old certificate (and any old certificate signing requests)
-  from the [ssldir](https://puppet.com/docs/puppet/latest/dirs_ssldir.html).
-* On the server: Run `puppet agent -t --ca_server <CA HOSTNAME>` to request a new certificate
-* On the CA server: Sign the certificate request, explicitly allowing alternate names
-  (`puppet cert sign --allow-dns-alt-names <NAME>`). (Note `puppet cert sign` is deprecated
-  and will be replaced with `puppetserver ca sign` in Puppet 6.)
-* On the server: Run `puppet agent -t --ca_server <CA HOSTNAME>` to retrieve the cert.
-* On the server: Start Puppet Server again.
+change this setting; you also need to regenerate the certificate. For more
+information on that process, see the [cert regen docs]
+(https://puppet.com/docs/puppet/latest/ssl_regenerate_certificates.html).
 
 To see all the alternate names your servers are using, log into your CA server
-and run `puppet cert list -a`, then check the output for `(alt names: ...)`.
+and run `puppetserver ca list --all`, then check the output for `(alt names: ...)`.
 Most agent nodes should NOT have alternate names; the only certs that should
 have them are Puppet Server nodes that you want other agents to trust.
 EOT
@@ -777,7 +765,7 @@ EOT
 An optional file containing custom attributes to add to certificate signing
 requests (CSRs). You should ensure that this file does not exist on your CA
 puppet master; if it does, unwanted certificate extensions may leak into
-certificates created with the `puppet cert generate` command.
+certificates created with the `puppetserver ca generate` command.
 
 If present, this file must be a YAML hash containing a `custom_attributes` key
 and/or an `extension_requests` key. The value of each key must be a hash, where
@@ -863,7 +851,8 @@ EOT
       :mode => "0644",
       :owner => "service",
       :group => "service",
-      :desc => "Where individual hosts store and look for their certificate requests."
+      :deprecated  => :completely,
+      :desc => "This setting is deprecated."
     },
     :hostcert => {
       :default => "$certdir/$certname.pem",
@@ -975,6 +964,15 @@ EOT
           }
         end
       end
+    },
+    :logdest => {
+      :type      => :string,
+      :desc      => "Where to send log messages. Choose between 'syslog' (the POSIX syslog
+      service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
+      file."
+      # Sure would be nice to set the Puppet::Util::Log destination here in an :on_initialize_and_write hook,
+      # unfortunately we have a large number of tests that rely on the logging not resetting itself when the
+      # settings are initialized as they test what gets logged during settings initialization.
     }
   )
 
@@ -987,65 +985,41 @@ EOT
     :cadir => {
       :default => "$ssldir/ca",
       :type => :directory,
-      :owner => "service",
-      :group => "service",
-      :mode => "0755",
       :desc => "The root directory for the certificate authority.",
     },
     :cacert => {
       :default => "$cadir/ca_crt.pem",
       :type => :file,
-      :owner => "service",
-      :group => "service",
-      :mode => "0644",
       :desc => "The CA certificate.",
     },
     :cakey => {
       :default => "$cadir/ca_key.pem",
       :type => :file,
-      :owner => "service",
-      :group => "service",
-      :mode => "0640",
       :desc => "The CA private key.",
     },
     :capub => {
       :default => "$cadir/ca_pub.pem",
       :type => :file,
-      :owner => "service",
-      :group => "service",
-      :mode => "0644",
       :desc => "The CA public key.",
     },
     :cacrl => {
       :default => "$cadir/ca_crl.pem",
       :type => :file,
-      :owner => "service",
-      :group => "service",
-      :mode => "0644",
       :desc => "The certificate revocation list (CRL) for the CA.",
     },
     :csrdir => {
       :default => "$cadir/requests",
       :type => :directory,
-      :owner => "service",
-      :group => "service",
-      :mode  => "0755",
       :desc => "Where the CA stores certificate requests.",
     },
     :signeddir => {
       :default => "$cadir/signed",
       :type => :directory,
-      :owner => "service",
-      :group => "service",
-      :mode => "0755",
       :desc => "Where the CA stores signed certificates.",
     },
     :serial => {
       :default => "$cadir/serial",
       :type => :file,
-      :owner => "service",
-      :group => "service",
-      :mode => "0644",
       :desc => "Where the serial number for certificates is stored.",
     },
     :autosign => {
@@ -1070,7 +1044,7 @@ EOT
         and non-zero if the cert should not be autosigned.
 
         If a certificate request is not autosigned, it will persist for review. An admin
-        user can use the `puppet cert sign` command to manually sign it, or can delete
+        user can use the `puppetserver ca sign` command to manually sign it, or can delete
         the request.
 
         For info on autosign configuration files, see
@@ -1094,9 +1068,6 @@ EOT
     :cert_inventory => {
       :default => "$cadir/inventory.txt",
       :type => :file,
-      :mode => "0644",
-      :owner => "service",
-      :group => "service",
       :desc => "The inventory file. This is a text file to which the CA writes a
         complete listing of all certificates.",
     }
@@ -1410,7 +1381,20 @@ EOT
         with the running configuration.  In the case of puppet master,
         this file reflects the state discovered through interacting
         with clients."
-      },
+    },
+    :statettl => {
+      :default => "32d",
+      :type    => :ttl,
+      :desc    => "How long the Puppet agent should cache when a resource was last checked or synced.
+      #{AS_DURATION}
+      A value of `0` or `unlimited` will disable cache pruning.
+
+      This setting affects the usage of `schedule` resources, as the information
+      about when a resource was last checked (and therefore when it needs to be
+      checked again) is stored in the `statefile`. The `statettl` needs to be
+      large enough to ensure that a resource will not trigger multiple times
+      during a schedule due to its entry expiring from the cache."
+    },
     :transactionstorefile => {
       :default => "$statedir/transactionstore.yaml",
       :type => :file,

data/lib/puppet/etc.rb

@@ -103,6 +103,26 @@ module Puppet::Etc
       override_field_values_to_utf8(::Etc.getpwuid(id))
     end
 
+    # Etc::group returns a Ruby iterator that executes a block for
+    # each entry in the /etc/group file. The code-block is passed
+    # a Group struct. See getgrent above for more details.
+    def group
+      # The implementation here duplicates the logic in https://github.com/ruby/etc/blob/master/ext/etc/etc.c#L523-L537
+      # Note that we do not call ::Etc.group directly, because we
+      # want to use our wrappers for methods like getgrent, setgrent,
+      # endgrent, etc.
+      return getgrent unless block_given?
+
+      setgrent
+      begin
+        while cur_group = getgrent
+          yield cur_group
+        end
+      ensure
+        endgrent
+      end
+    end
+
     private
 
     # @api private

data/lib/puppet/face/config.rb

@@ -23,7 +23,7 @@ Puppet::Face.define(:config, '0.0.1') do
       The three most commonly used sections are 'main', 'master', and 'agent'.
       'Main' is the default, and is used by all Puppet applications. Other
       sections can override 'main' values for specific applications --- the
-      'master' section affects puppet master and puppet cert, and the 'agent'
+      'master' section affects Puppet Server, and the 'agent'
       section affects puppet agent.
 
       Less commonly used is the 'user' section, which affects puppet apply. Any
@@ -35,7 +35,7 @@ Puppet::Face.define(:config, '0.0.1') do
 
   action(:print) do
     summary _("Examine Puppet's current settings.")
-    arguments _("(all | <setting> [<setting> ...]")
+    arguments _("all | <setting> [<setting> ...]")
     description <<-'EOT'
       Prints the value of a single setting or a list of settings.
 
@@ -210,7 +210,7 @@ https://puppet.com/docs/puppet/latest/configuration.html#environment
 
   action(:delete) do
     summary _("Delete a Puppet setting.")
-    arguments _("(<setting>")
+    arguments _("<setting>")
     #TRANSLATORS 'main' is a specific section name and should not be translated
     description "Deletes a setting from the specified section. (The default is the section 'main')."
     notes <<-'EOT'

data/lib/puppet/face/key.rb

@@ -8,7 +8,7 @@ Puppet::Indirector::Face.define(:key, '0.0.1') do
   description <<-'EOT'
     This subcommand manages certificate private keys. Keys are created
     automatically by puppet agent and when certificate requests are generated
-    with 'puppet certificate generate'; it should not be necessary to use this
+    with 'puppet ssl submit_request'; it should not be necessary to use this
     subcommand directly.
   EOT
 

data/lib/puppet/face/node/clean.rb

@@ -59,7 +59,6 @@ Puppet::Face.define(:node, '0.0.1') do
   # clean signed cert for +host+
   def clean_cert(node)
     if Puppet.features.puppetserver_ca?
-      require 'puppetserver/ca/action/clean'
       Puppetserver::Ca::Action::Clean.new(LoggerIO.new).run({ 'certnames' => [node] })
     else
       Puppet.info _("Not managing %{node} certs as this host is not a CA") % { node: node }

data/lib/puppet/feature/base.rb

@@ -73,4 +73,4 @@ Puppet.features.add(:manages_symlinks) do
   end
 end
 
-Puppet.features.add(:puppetserver_ca, libs: ['puppetserver/ca'])
+Puppet.features.add(:puppetserver_ca, libs: ['puppetserver/ca', 'puppetserver/ca/action/clean'])

data/lib/puppet/file_bucket/dipper.rb

@@ -77,7 +77,7 @@ class Puppet::FileBucket::Dipper
           tmp_file.unlink
         end
       else
-        raise Puppet::Error, _("Please provide a file or checksum do diff with")
+        raise Puppet::Error, _("Please provide a file or checksum to diff with")
       end
     elsif file_a
       if checksum_b

data/lib/puppet/file_serving/fileset.rb

@@ -122,7 +122,7 @@ class Puppet::FileServing::Fileset
     def children
       return [] unless directory?
 
-      Dir.entries(path).
+      Dir.entries(path, encoding: Encoding::UTF_8).
         reject { |child| ignore?(child) }.
         collect { |child| down_level(child) }
     end

data/lib/puppet/functions/abs.rb

@@ -28,7 +28,7 @@
 # Integer($strval, 10, true) # Converts to absolute Integer using base 10 (decimal)
 # Integer($strval, 16, true) # Converts to absolute Integer using base 16 (hex)
 # Float($strval, true)       # Converts to absolute Float
-# ```puppet
+# ```
 #
 Puppet::Functions.create_function(:abs) do
   dispatch :on_numeric do

data/lib/puppet/functions/new.rb

@@ -608,7 +608,7 @@
 # | Format | String
 # | ------ | ------
 # | s      | Unquoted string, verbatim output of control chars.
-# | p      | Programmatic representation - strings are quoted, interior quotes and control chars are escaped.
+# | p      | Programmatic representation - strings are quoted, interior quotes and control chars are escaped. Selects single or double quotes based on content, or uses double quotes if alternative flag `#` is used.
 # | C      | Each `::` name segment capitalized, quoted if alternative flag `#` is used.
 # | c      | Capitalized string, quoted if alternative flag `#` is used.
 # | d      | Downcased string, quoted if alternative flag `#` is used.