puppet 6.0.10 → 6.1.0

data/README.md

@@ -45,10 +45,10 @@ in.
 For more complete docs on developing with Puppet, take a look at the
 rest of the [developer documents](https://github.com/puppetlabs/puppet/blob/master/docs/index.md).
 
-License
--------
+Licensing
+---------
 
-See [LICENSE](https://github.com/puppetlabs/puppet/blob/master/LICENSE) file.
+See [LICENSE](https://github.com/puppetlabs/puppet/blob/master/LICENSE) file. Puppet is licensed by Puppet, Inc. under the Apache license. Puppet, Inc. can be contacted at: info@puppet.com
 
 Support
 -------

data/lib/hiera/scope.rb

@@ -1,8 +1,5 @@
-require 'forwardable'
 class Hiera
   class Scope
-    extend Forwardable
-
     CALLING_CLASS = 'calling_class'.freeze
     CALLING_CLASS_PATH = 'calling_class_path'.freeze
     CALLING_MODULE = 'calling_module'.freeze
@@ -82,9 +79,5 @@ class Hiera
       end
     end
     private :find_hostclass
-
-    # This is needed for type conversion to work
-    def_delegators :@real, :call_function
-
   end
 end

data/lib/puppet.rb

@@ -1,7 +1,7 @@
 require 'puppet/version'
 
 if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new("2.3.0")
-  raise LoadError, "Puppet #{Puppet.version} requires Ruby 2.3.0 or greater, found Ruby #{RUBY_VERSION.dup}."
+  raise LoadError, _("Puppet %{version} requires ruby 2.3.0 or greater.") % { version: Puppet.version }
 end
 
 Puppet::OLDEST_RECOMMENDED_RUBY_VERSION = '2.3.0'
@@ -138,14 +138,14 @@ module Puppet
   # @api public
   # @param args [Array<String>] the command line arguments to use for initialization
   # @return [void]
-  def self.initialize_settings(args = [], require_config = true)
-    do_initialize_settings_for_run_mode(:user, args, require_config)
+  def self.initialize_settings(args = [])
+    do_initialize_settings_for_run_mode(:user, args)
   end
 
   # private helper method to provide the implementation details of initializing for a run mode,
   #  but allowing us to control where the deprecation warning is issued
-  def self.do_initialize_settings_for_run_mode(run_mode, args, require_config = true)
-    Puppet.settings.initialize_global_settings(args, require_config)
+  def self.do_initialize_settings_for_run_mode(run_mode, args)
+    Puppet.settings.initialize_global_settings(args)
     run_mode = Puppet::Util::RunMode[run_mode]
     Puppet.settings.initialize_app_defaults(Puppet::Settings.app_defaults_for_run_mode(run_mode))
     Puppet.push_context(Puppet.base_context(Puppet.settings), "Initial context after settings initialization")
@@ -297,3 +297,4 @@ require 'puppet/util/storage'
 require 'puppet/status'
 require 'puppet/file_bucket/file'
 require 'puppet/plugins/configuration'
+require 'puppet/pal/pal_api'

data/lib/puppet/application.rb

@@ -395,7 +395,7 @@ class Application
   end
 
   def setup_logs
-    handle_logdest_arg(Puppet[:logdest]) if !options[:setdest]
+    handle_logdest_arg(Puppet[:logdest])
 
     unless options[:setdest]
       if options[:debug] || options[:verbose]
@@ -418,14 +418,14 @@ class Application
   end
 
   def handle_logdest_arg(arg)
-    return if arg.nil?
+    return if options[:setdest] || arg.nil?
 
     begin
       Puppet[:logdest] = arg
       Puppet::Util::Log.newdestination(arg)
       options[:setdest] = true
     rescue => detail
-      Puppet.log_and_raise(detail, _("Could not set logdest to %{dest}.") % { dest: arg })
+      Puppet.log_exception(detail)
     end
   end
 

data/lib/puppet/application/cert.rb

@@ -36,10 +36,10 @@ unless the '--all' option is set.
   `openssl x509 -noout -text -in certificate.pem`
 
 * revoke:
-  Use `puppetserver ca revoke --cerntname NAME[,NAME...]`
+  Use `puppetserver ca revoke --certname NAME[,NAME...]`
 
 * sign:
-  Use `puppetserver ca sign --cerntname NAME[,NAME...]`
+  Use `puppetserver ca sign --certname NAME[,NAME...]`
 
 * verify:
   Use `puppet ssl verify [--certname NAME]`

data/lib/puppet/application/device.rb

@@ -254,112 +254,88 @@ Licensed under the Apache 2.0 License
         end
       end
       devices.collect do |devicename,device|
-        pool = Puppet::Network::HTTP::Pool.new(Puppet[:http_keepalive_timeout])
-        Puppet.override(:http_pool => pool) do
-          # TODO when we drop support for ruby < 2.5 we can remove the extra block here
-          begin
-            device_url = URI.parse(device.url)
-            # Handle nil scheme & port
-            scheme = "#{device_url.scheme}://" if device_url.scheme
-            port = ":#{device_url.port}" if device_url.port
-
-            # override local $vardir and $certname
-            Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
-            Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
-            Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
-            Puppet[:certname] = device.name
-            ssl_host = nil
-
-            # this will reload and recompute default settings and create device-specific sub vardir
-            Puppet.settings.use :main, :agent, :ssl
-
-            unless options[:resource] || options[:facts] || options[:apply]
-              # Since it's too complicated to fix properly in the default settings, we workaround for PUP-9642 here.
-              # See https://github.com/puppetlabs/puppet/pull/7483#issuecomment-483455997 for details.
-              # This has to happen after `settings.use` above, so the directory is created and before `setup_host` below, where the SSL
-              # routines would fail with access errors
-              if Puppet.features.root? && !Puppet::Util::Platform.windows?
-                user = Puppet::Type.type(:user).new(name: Puppet[:user]).exists? ? Puppet[:user] : nil
-                group = Puppet::Type.type(:group).new(name: Puppet[:group]).exists? ? Puppet[:group] : nil
-                Puppet.debug("Fixing perms for #{user}:#{group} on #{Puppet[:confdir]}")
-                FileUtils.chown(user, group, Puppet[:confdir]) if user || group
-              end
-
-              # ask for a ssl cert if needed, and setup the ssl system for this device.
-              ssl_host = setup_host(device.name)
-
-              unless options[:libdir]
-                Puppet.override(ssl_host: ssl_host) do
-                  Puppet::Configurer::PluginHandler.new.download_plugins(env) if Puppet::Configurer.should_pluginsync?
-                end
-              end
-            end
-
-            # this inits the device singleton, so that the facts terminus
-            # and the various network_device provider can use it
-            Puppet::Util::NetworkDevice.init(device)
-
-            if options[:resource]
-              type, name = parse_args(command_line.args)
-              Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-              resources = find_resources(type, name)
-              if options[:to_yaml]
-                text = resources.map do |resource|
-                  resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
-                end.join("\n")
-                text.prepend("#{type.downcase}:\n")
-              else
-                text = resources.map do |resource|
-                  resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
-                end.join("\n")
-              end
-              (puts text)
-              0
-            elsif options[:facts]
-              Puppet.info _("retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-              remote_facts = Puppet::Node::Facts.indirection.find(name, :environment => env)
-              # Give a proper name to the facts
-              remote_facts.name = remote_facts.values['clientcert']
-              renderer = Puppet::Network::FormatHandler.format(:console)
-              puts renderer.render(remote_facts)
-              0
-            elsif options[:apply]
-              # avoid reporting to server
-              Puppet::Transaction::Report.indirection.terminus_class = :yaml
-              Puppet::Resource::Catalog.indirection.cache_class = nil
-
-              require 'puppet/application/apply'
-              begin
-                Puppet[:node_terminus] = :plain
-                Puppet[:catalog_terminus] = :compiler
-                Puppet[:catalog_cache_terminus] = nil
-                Puppet[:facts_terminus] = :network_device
-                Puppet.override(:network_device => true) do
-                  Puppet::Application::Apply.new(Puppet::Util::CommandLine.new('puppet', ["apply", options[:apply]])).run_command
-                end
-              end
+        begin
+          device_url = URI.parse(device.url)
+          # Handle nil scheme & port
+          scheme = "#{device_url.scheme}://" if device_url.scheme
+          port = ":#{device_url.port}" if device_url.port
+
+          # override local $vardir and $certname
+          Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
+          Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
+          Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
+          Puppet[:certname] = device.name
+
+          unless options[:resource] || options[:facts] || options[:apply] || options[:libdir]
+            Puppet::Configurer::PluginHandler.new.download_plugins(env)
+          end
+          # this init the device singleton, so that the facts terminus
+          # and the various network_device provider can use it
+          Puppet::Util::NetworkDevice.init(device)
+
+          if options[:resource]
+            type, name = parse_args(command_line.args)
+            Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            resources = find_resources(type, name)
+            if options[:to_yaml]
+              text = resources.map do |resource|
+                resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
+              end.join("\n")
+              text.prepend("#{type.downcase}:\n")
             else
-              Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-
-              overrides = {}
-              overrides[:ssl_host] = ssl_host if ssl_host
-              Puppet.override(overrides) do
-                configurer = Puppet::Configurer.new
-                configurer.run(:network_device => true, :pluginsync => false)
+              text = resources.map do |resource|
+                resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
+              end.join("\n")
+            end
+            (puts text)
+            0
+          elsif options[:facts]
+            Puppet.info _("retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            remote_facts = Puppet::Node::Facts.indirection.find(name, :environment => env)
+            # Give a proper name to the facts
+            remote_facts.name = remote_facts.values['clientcert']
+            renderer = Puppet::Network::FormatHandler.format(:console)
+            puts renderer.render(remote_facts)
+            0
+          elsif options[:apply]
+            # ensure we have a cache folder structure exists for the device
+            FileUtils.mkdir_p(Puppet[:statedir]) unless File.directory?(Puppet[:statedir])
+            # avoid reporting to server
+            Puppet::Transaction::Report.indirection.terminus_class = :yaml
+            Puppet::Resource::Catalog.indirection.cache_class = nil
+
+            require 'puppet/application/apply'
+            begin
+              Puppet[:node_terminus] = :plain
+              Puppet[:catalog_terminus] = :compiler
+              Puppet[:catalog_cache_terminus] = nil
+              Puppet[:facts_terminus] = :network_device
+              Puppet.override(:network_device => true) do
+                Puppet::Application::Apply.new(Puppet::Util::CommandLine.new('puppet', ["apply", options[:apply]])).run_command
               end
             end
-          rescue => detail
-            Puppet.log_exception(detail)
-            # If we rescued an error, then we return 1 as the exit code
-            1
-          ensure
-            pool.close
-            Puppet[:libdir] = libdir
-            Puppet[:vardir] = vardir
-            Puppet[:confdir] = confdir
-            Puppet[:certname] = certname
-            Puppet::SSL::Host.reset
+          else
+            Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+            # this will reload and recompute default settings and create the devices sub vardir
+            Puppet.settings.use :main, :agent, :ssl
+            # ask for a ssl cert if needed, but at least
+            # setup the ssl system for this device.
+            setup_host(device.name)
+
+            require 'puppet/configurer'
+            configurer = Puppet::Configurer.new
+            configurer.run(:network_device => true, :pluginsync => Puppet::Configurer.should_pluginsync? && !options[:libdir])
           end
+        rescue => detail
+          Puppet.log_exception(detail)
+          # If we rescued an error, then we return 1 as the exit code
+          1
+        ensure
+          Puppet[:libdir] = libdir
+          Puppet[:vardir] = vardir
+          Puppet[:confdir] = confdir
+          Puppet[:certname] = certname
+          Puppet::SSL::Host.reset
         end
       end
     end
@@ -395,20 +371,16 @@ Licensed under the Apache 2.0 License
   end
 
   def setup_host(name)
-    host = Puppet::SSL::Host.new(name, true)
+    @host = Puppet::SSL::Host.new(name, true)
     waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
-    host.wait_for_cert(waitforcert)
-    host
+    @host.wait_for_cert(waitforcert)
   end
 
   def setup
     setup_logs
-
-    # setup global device-specific defaults; creates all necessary directories, etc
-    Puppet.settings.use :main, :agent, :device, :ssl
-
     if options[:apply] || options[:facts] || options[:resource]
       Puppet::Util::Log.newdestination(:console)
+      Puppet.settings.use :main, :agent, :ssl
     else
       args[:Server] = Puppet[:server]
       if options[:centrallogs]
@@ -418,6 +390,8 @@ Licensed under the Apache 2.0 License
         Puppet::Util::Log.newdestination(logdest)
       end
 
+      Puppet.settings.use :main, :agent, :device, :ssl
+
       Puppet::Transaction::Report.indirection.terminus_class = :rest
 
       if Puppet[:catalog_cache_terminus]

data/lib/puppet/application/filebucket.rb

@@ -107,13 +107,8 @@ configuration options can also be generated by running puppet with
   information and the bucket located at the '$bucketdir' setting
   by default.
 
-* --server_list:
-  A list of comma seperated servers; only the first entry is used for file storage.
-  This setting takes precidence over `server`.
-
 * --server:
-  The server to use for file storage. This setting is only used if `server_list`
-  is not set.
+  The server to send the file to, instead of locally.
 
 * --todate:
   (list only) Select bucket files until 'todate'.
@@ -289,15 +284,11 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       else
         if Puppet[:server_list] && !Puppet[:server_list].empty?
           server = Puppet[:server_list].first
-          #TRANSLATORS 'server_list' is the name of a setting and should not be translated
-          Puppet.debug _("Selected server from first entry of the `server_list` setting: %{server}:%{port}") % {server: server[0], port: server[1]}
           @client = Puppet::FileBucket::Dipper.new(
             :Server => server[0],
             :Port => server[1]
           )
         else
-          #TRANSLATORS 'server' is the name of a setting and should not be translated
-          Puppet.debug _("Selected server from the `server` setting: %{server}") % {server: Puppet[:server]}
           @client = Puppet::FileBucket::Dipper.new(:Server => Puppet[:server])
         end
       end

data/lib/puppet/application/ssl.rb

@@ -98,8 +98,6 @@ HELP
       Puppet.settings.use(:main, :agent)
     end
 
-    Puppet::SSL::Oids.register_puppet_oids
-
     action = command_line.args.first
     case action
     when 'submit_request'

data/lib/puppet/configurer.rb

@@ -226,14 +226,13 @@ class Puppet::Configurer
         # mode. We shouldn't try to do any failover in that case.
         if options[:catalog].nil? && do_failover
           server, port = find_functional_server
-          if server.nil?
-            raise Puppet::Error, _("Could not select a functional puppet master from server_list: '%{server_list}'") % { server_list: Puppet.settings.value(:server_list, Puppet[:environment].to_sym, true) }
-          else
-            #TRANSLATORS 'server_list' is the name of a setting and should not be translated
-            Puppet.debug _("Selected puppet server from the `server_list` setting: %{server}:%{port}") % { server: server, port: port }
-            report.master_used = "#{server}:#{port}"
-          end
           Puppet.override(server: server, serverport: port) do
+            if server
+              Puppet.debug _("Selected puppet server: %{server}:%{port}") % { server: server, port: port }
+              report.master_used = "#{server}:#{port}"
+            else
+              Puppet.warning _("Could not select a functional puppet server")
+            end
             completed = run_internal(options)
           end
         else
@@ -402,9 +401,9 @@ class Puppet::Configurer
 
         Puppet.debug(_("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %
                      { host: host, port: port, code: response.code, reason: response.message })
-      rescue => detail
-        #TRANSLATORS 'server_list' is the name of a setting and should not be translated
-        Puppet.debug _("Unable to connect to server from server_list setting: %{detail}") % {detail: detail}
+      rescue
+        # Nothing to see here
+        Puppet.debug(_("Puppet server %{host}:%{port} is unreachable") % { host: host, port: port })
       end
     end
     [nil, nil]

data/lib/puppet/confine/false.rb

@@ -1,12 +1,6 @@
-require 'puppet/confine/boolean'
+require 'puppet/confine'
 
 class Puppet::Confine::False < Puppet::Confine
-  include Puppet::Confine::Boolean
-
-  def passing_value
-    false
-  end
-
   def self.summarize(confines)
     confines.inject(0) { |count, confine| count + confine.summary }
   end

data/lib/puppet/confine/true.rb

@@ -1,12 +1,6 @@
-require 'puppet/confine/boolean'
+require 'puppet/confine'
 
 class Puppet::Confine::True < Puppet::Confine
-  include Puppet::Confine::Boolean
-
-  def passing_value
-    true
-  end
-
   def self.summarize(confines)
     confines.inject(0) { |count, confine| count + confine.summary }
   end

data/lib/puppet/defaults.rb

@@ -604,28 +604,14 @@ module Puppet
       :type       => :duration,
       :desc       => "The minimum time to wait between checking for updates in
       configuration files.  This timeout determines how quickly Puppet checks whether
-      a file (such as manifests or puppet.conf) has changed on disk. The default will
-      change in a future release to be 'unlimited', requiring a reload of the Puppet
-      service to pick up changes to its internal configuration. Currently we do not
-      accept a value of 'unlimited'. To reparse files within an environment in
-      Puppet Server please use the environment_cache endpoint",
-      :hook => proc do |val|
-        unless [0, 15, '15s'].include?(val)
-          Puppet.deprecation_warning(<<-WARNING)
-Fine grained control of filetimeouts is deprecated. In future
-releases this value will only determine if file content is cached.
-
-Valid values are 0 (never cache) and 15 (15 second minimum wait time).
-            WARNING
-        end
-      end
+      a file (such as manifests or templates) has changed on disk. #{AS_DURATION}",
     },
     :environment_timeout => {
       :default    => "0",
       :type       => :ttl,
       :desc       => "How long the Puppet master should cache data it loads from an
       environment.
-
+      #{AS_DURATION}
       A value of `0` will disable caching. This setting can also be set to
       `unlimited`, which will cache environments until the master is restarted
       or told to refresh the cache.
@@ -641,21 +627,15 @@ Valid values are 0 (never cache) and 15 (15 second minimum wait time).
       * With Puppet Server, you should refresh environments by calling the
         `environment-cache` API endpoint. See the docs for the Puppet Server
         administrative API.
+      * With a Rack Puppet master, you should restart the web server or the
+        application server. Passenger lets you touch a `restart.txt` file to
+        refresh an application without restarting Apache; see the Passenger docs
+        for details.
 
-      Any value other than `0` or `unlimited` is deprecated, since most Puppet
-      servers use a pool of Ruby interpreters which all have their own cache
-      timers. When these timers drift out of sync, agents can be served
-      inconsistent catalogs.",
-      :hook => proc do |val|
-        unless [0, 'unlimited', Float::INFINITY].include?(val)
-          Puppet.deprecation_warning(<<-WARNING)
-Fine grained control of environment timeouts is deprecated,
-please use `0` or `unlimited` to control default caching behavior
-and the environment-cache endpoint in Puppet Server's administrative
-API to expire the cache as needed
-          WARNING
-        end
-      end
+      We don't recommend using any value other than `0` or `unlimited`, since
+      most Puppet masters use a pool of Ruby interpreters which all have their
+      own cache timers. When these timers drift out of sync, agents can be served
+      inconsistent catalogs."
     },
     :environment_data_provider => {
       :desc       => "The name of a registered environment data provider used when obtaining environment
@@ -942,21 +922,21 @@ EOT
           Whether certificate revocation checking should be enabled, and what level of
           checking should be performed.
 
-          When certificate revocation is enabled, Puppet expects the contents of its CRL
-          to be one or more PEM-encoded CRLs concatenated together. When using a cert
-          bundle, CRLs for all CAs in the chain of trust must be included in the crl file.
-          The chain should be ordered from least to most authoritative, with the first CRL
-          listed being for the root of the chain and the last being for the leaf CA.
+          When certificate revocation is enabled Puppet expects the contents of its CRL
+          to be one or more PEM encoded CRLs concatenated together. When using a cert
+          bundle CRLs for all CAs in the chain of trust must be included in the crl file
+          with the first CRL listed being for the root of the chain, the last being for
+          the leaf CA.
 
-          When certificate_revocation is set to 'true' or 'chain', Puppet ensures
+          When certificate_revocation is set to 'true' or 'chain', Puppet will ensure
           that each CA in the chain of trust has not been revoked by its issuing CA.
 
-          When certificate_revocation is set to 'leaf', Puppet verifies certs against
-          the issuing CA's revocation list, but it does not verify the revocation status
-          of the issuing CA or any CA above it within the chain of trust.
+          When certificate_revocation is set to 'leaf', Puppet will verify certs against
+          the issuing CA's revocation list but not verify the revocation status of the
+          issuing CA or any CA above it within the chain of trust.
 
-          When certificate_revocation is set to 'false', Puppet disables all
-          certificate revocation checking and does not attempt to download the CRL.
+          When certificate_revocation is set to 'false', Puppet will disable all
+          certificate revocation checking and will not attempt to download the CRL.
         EOT
     },
     :digest_algorithm => {
@@ -1472,12 +1452,30 @@ EOT
     :server => {
       :default => "puppet",
       :desc => "The puppet master server to which the puppet agent should connect.",
+      :call_hook => :on_initialize_and_write,
+      :hook => proc { |value|
+        if Puppet.settings.set_by_config?(:server) && Puppet.settings.set_by_config?(:server_list)
+          #TRANSLATOR 'server' and 'server_list' are setting names and should not be translated
+          message = _('Attempted to set both server and server_list.')
+          message += ' ' + _('Server setting will not be used.')
+          Puppet.deprecation_warning(message, :SERVER_DUPLICATION)
+        end
+      }
     },
     :server_list => {
       :default => [],
       :type => :server_list,
       :desc => "The list of puppet master servers to which the puppet agent should connect,
         in the order that they will be tried.",
+      :call_hook => :on_initialize_and_write,
+      :hook => proc { |value|
+        if Puppet.settings.set_by_config?(:server) && Puppet.settings.set_by_config?(:server_list)
+          #TRANSLATOR 'server' and 'server_list' are setting names and should not be translated
+          message = _('Attempted to set both server and server_list.')
+          message += ' ' + _('Server setting will not be used.')
+          Puppet.deprecation_warning(message, :SERVER_DUPLICATION)
+        end
+      }
     },
     :use_srv_records => {
       :default    => false,
@@ -1950,16 +1948,6 @@ EOT
       referencing variables that are explicitly set to undef).
     EOT
     },
-   :func3x_check => {
-     :default => true,
-     :type => :boolean,
-     :desc => <<-'EOT'
-       Causes validation of loaded legacy Ruby functions (3x API) to raise errors about illegal constructs that
-       could cause harm or that simply does not work. This flag is on by default. This flag is made available
-       so that the validation can be turned off in case the method of validation is faulty - if encountered, please
-       file a bug report.
-     EOT
-     },
   :tasks => {
     :default => false,
     :type => :boolean,