puppet 6.0.5-x64-mingw32 → 8.8.1-x64-mingw32

data/lib/puppet/ssl/verifier.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl'
+
+# Verify an SSL connection.
+#
+# @api private
+class Puppet::SSL::Verifier
+  FIVE_MINUTES_AS_SECONDS = 5 * 60
+
+  attr_reader :ssl_context
+
+  # Create a verifier using an `ssl_context`.
+  #
+  # @param hostname [String] FQDN of the server we're attempting to connect to
+  # @param ssl_context [Puppet::SSL::SSLContext] ssl_context containing CA certs,
+  #   CRLs, etc needed to verify the server's certificate chain
+  # @api private
+  def initialize(hostname, ssl_context)
+    @hostname = hostname
+    @ssl_context = ssl_context
+  end
+
+  # Return true if `self` is reusable with `verifier` meaning they
+  # are using the same `ssl_context`, so there's no loss of security
+  # when using a cached connection.
+  #
+  # @param verifier [Puppet::SSL::Verifier] the verifier to compare against
+  # @return [Boolean] return true if a cached connection can be used, false otherwise
+  # @api private
+  def reusable?(verifier)
+    verifier.instance_of?(self.class) &&
+      verifier.ssl_context.equal?(@ssl_context) # same object?
+  end
+
+  # Configure the `http` connection based on the current `ssl_context`.
+  #
+  # @param http [Net::HTTP] connection
+  # @api private
+  def setup_connection(http)
+    http.cert_store = @ssl_context[:store]
+    http.cert = @ssl_context[:client_cert]
+    http.key = @ssl_context[:private_key]
+    # default to VERIFY_PEER
+    http.verify_mode = if !@ssl_context[:verify_peer]
+                         OpenSSL::SSL::VERIFY_NONE
+                       else
+                         OpenSSL::SSL::VERIFY_PEER
+                       end
+    http.verify_callback = self
+  end
+
+  # This method is called if `Net::HTTP#start` raises an exception, which
+  # could be a result of an openssl error during cert verification, due
+  # to ruby's `Socket#post_connection_check`, or general SSL connection
+  # error.
+  #
+  # @param http [Net::HTTP] connection
+  # @param error [OpenSSL::SSL::SSLError] connection error
+  # @raise [Puppet::SSL::CertVerifyError] SSL connection failed due to a
+  #   verification error with the server's certificate or chain
+  # @raise [Puppet::Error] server hostname does not match certificate
+  # @raise [OpenSSL::SSL::SSLError] low-level SSL connection failure
+  # @api private
+  def handle_connection_error(http, error)
+    raise @last_error if @last_error
+
+    # ruby can pass SSL validation but fail post_connection_check
+    peer_cert = http.peer_cert
+    if peer_cert && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
+      raise Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+    else
+      raise error
+    end
+  end
+
+  # OpenSSL will call this method with the verification result for each cert in
+  # the server's chain, working from the root CA to the server's cert. If
+  # preverify_ok is `true`, then that cert passed verification. If it's `false`
+  # then the current verification error is contained in `store_context.error`.
+  # and the current cert is in `store_context.current_cert`.
+  #
+  # If this method returns `false`, then verification stops and ruby will raise
+  # an `OpenSSL::SSL::Error` with "certificate verification failed". If this
+  # method returns `true`, then verification continues.
+  #
+  # If this method ignores a verification error, such as the cert's CRL will be
+  # valid within the next 5 minutes, then this method may be called with a
+  # different verification error for the same cert.
+  #
+  # WARNING: If `store_context.error` returns `OpenSSL::X509::V_OK`, don't
+  # assume verification passed. Ruby 2.4+ implements certificate hostname
+  # checking by default, and if the cert doesn't match the hostname, then the
+  # error will be V_OK. Always use `preverify_ok` to determine if verification
+  # succeeded or not.
+  #
+  # @param preverify_ok [Boolean] if `true` the current certificate in `store_context`
+  #   was verified. Otherwise, check for the current error in `store_context.error`
+  # @param store_context [OpenSSL::X509::StoreContext] The context holding the
+  #   verification result for one certificate
+  # @return [Boolean] If `true`, continue verifying the chain, even if that means
+  #   ignoring the current verification error. If `false`, abort the connection.
+  #
+  # @api private
+  def call(preverify_ok, store_context)
+    return true if preverify_ok
+
+    peer_cert = store_context.current_cert
+
+    case store_context.error
+    when OpenSSL::X509::V_OK
+      # chain is from leaf to root, opposite of the order that `call` is invoked
+      chain_cert = store_context.chain.first
+
+      # ruby 2.4 doesn't compare certs based on value, so force to DER byte array
+      if peer_cert && chain_cert && peer_cert.to_der == chain_cert.to_der && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
+        @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+        return false
+      end
+
+    # ruby-openssl#74ef8c0cc56b840b772240f2ee2b0fc0aafa2743 now sets the
+    # store_context error when the cert is mismatched
+    when OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH
+      @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+      return false
+
+    when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
+      crl = store_context.current_crl
+      if crl && crl.last_update && crl.last_update < Time.now + FIVE_MINUTES_AS_SECONDS
+        Puppet.debug("Ignoring CRL not yet valid, current time #{Time.now.utc}, CRL last updated #{crl.last_update.utc}")
+        return true
+      end
+    end
+
+    # TRANSLATORS: `error` is an untranslated message from openssl describing why a certificate in the server's chain is invalid, and `subject` is the identity/name of the failed certificate
+    @last_error = Puppet::SSL::CertVerifyError.new(
+      _("certificate verify failed [%{error} for %{subject}]") %
+      { error: store_context.error_string, subject: peer_cert.subject.to_utf8 },
+      store_context.error, peer_cert
+    )
+    false
+  end
+end

data/lib/puppet/ssl.rb

@@ -1,12 +1,25 @@
+# frozen_string_literal: true
+
 # Just to make the constants work out.
-require 'puppet'
-require 'openssl'
+require_relative '../puppet'
+require_relative 'ssl/openssl_loader'
 
-module Puppet::SSL # :nodoc:
+# Responsible for bootstrapping an agent's certificate and private key, generating
+# SSLContexts for use in making HTTPS connections, and handling CSR attributes and
+# certificate extensions.
+#
+# @see Puppet::SSL::SSLProvider
+# @api private
+module Puppet::SSL
   CA_NAME = "ca"
-  require 'puppet/ssl/host'
-  require 'puppet/ssl/oids'
-  require 'puppet/ssl/validator'
-  require 'puppet/ssl/validator/no_validator'
-  require 'puppet/ssl/validator/default_validator'
+
+  require_relative 'ssl/oids'
+  require_relative 'ssl/error'
+  require_relative 'ssl/ssl_context'
+  require_relative 'ssl/verifier'
+  require_relative 'ssl/ssl_provider'
+  require_relative 'ssl/state_machine'
+  require_relative 'ssl/certificate'
+  require_relative 'ssl/certificate_request'
+  require_relative 'ssl/certificate_request_attributes'
 end

data/lib/puppet/syntax_checkers/base64.rb

@@ -1,9 +1,10 @@
+# frozen_string_literal: true
+
 # A syntax checker for Base64.
 # @api public
-require 'puppet/syntax_checkers'
+require_relative '../../puppet/syntax_checkers'
 require 'base64'
 class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
-
   # Checks the text for BASE64 syntax issues and reports them to the given acceptor.
   # This checker allows the most relaxed form of Base64, including newlines and missing padding.
   # It also accept URLsafe input.
@@ -15,9 +16,10 @@ class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxCh
   # @api public
   #
   def check(text, syntax, acceptor, source_pos)
-    raise ArgumentError.new(_("Base64 syntax checker: the text to check must be a String.")) unless text.is_a?(String)
-    raise ArgumentError.new(_("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json")) unless syntax.is_a?(String)
-    raise ArgumentError.new(_("Base64 syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    raise ArgumentError, _("Base64 syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError, _("Base64 syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
     cleaned_text = text.gsub(/[\r?\n[:blank:]]/, '')
     begin
       # Do a strict decode64 on text with all whitespace stripped since the non strict version
@@ -33,7 +35,7 @@ class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxCh
       # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
       # and the issue code. (In this case especially, where there is only a single error message being issued).
       #
-      issue = Puppet::Pops::Issues::issue(:ILLEGAL_BASE64) { msg }
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_BASE64) { msg }
       acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
     end
   end

data/lib/puppet/syntax_checkers/epp.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# A syntax checker for JSON.
+# @api public
+require_relative '../../puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::EPP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+  # Checks the text for Puppet Language EPP syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError, _("EPP syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("EPP syntax checker: the syntax identifier must be a String, e.g. pp") unless syntax == 'epp'
+    raise ArgumentError, _("EPP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser::EvaluatingEppParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("EPP syntax checker: \"%{message}\"") % { message: e.message().slice(0, 500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_EPP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/json.rb

@@ -1,8 +1,9 @@
+# frozen_string_literal: true
+
 # A syntax checker for JSON.
 # @api public
-require 'puppet/syntax_checkers'
+require_relative '../../puppet/syntax_checkers'
 class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
-
   # Checks the text for JSON syntax issues and reports them to the given acceptor.
   #
   # Error messages from the checker are capped at 100 chars from the source text.
@@ -14,21 +15,20 @@ class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChec
   # @api public
   #
   def check(text, syntax, acceptor, source_pos)
-    raise ArgumentError.new(_("Json syntax checker: the text to check must be a String.")) unless text.is_a?(String)
-    raise ArgumentError.new(_("Json syntax checker: the syntax identifier must be a String, e.g. json, data+json")) unless syntax.is_a?(String)
-    raise ArgumentError.new(_("Json syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
-    #raise ArgumentError.new("Json syntax checker: location_info must be a Hash") unless location_info.is_a?(Hash)
+    raise ArgumentError, _("Json syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("Json syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError, _("Json syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
 
     begin
       Puppet::Util::Json.load(text)
     rescue => e
       # Cap the message to 100 chars and replace newlines
-      msg = _("JSON syntax checker: Cannot parse invalid JSON string. \"%{message}\"") % { message: e.message().slice(0,100).gsub(/\r?\n/, "\\n") }
+      msg = _("JSON syntax checker: Cannot parse invalid JSON string. \"%{message}\"") % { message: e.message().slice(0, 100).gsub(/\r?\n/, "\\n") }
 
       # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
       # and the issue code. (In this case especially, where there is only a single error message being issued).
       #
-      issue = Puppet::Pops::Issues::issue(:ILLEGAL_JSON) { msg }
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_JSON) { msg }
       acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
     end
   end

data/lib/puppet/syntax_checkers/pp.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# A syntax checker for JSON.
+# @api public
+require_relative '../../puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::PP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+  # Checks the text for Puppet Language syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError, _("PP syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("PP syntax checker: the syntax identifier must be a String, e.g. pp") unless syntax == 'pp'
+    raise ArgumentError, _("PP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("PP syntax checker: \"%{message}\"") % { message: e.message().slice(0, 500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_PP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # A name space for syntax checkers provided by Puppet.
 module Puppet::SyntaxCheckers
-end
+end

data/lib/puppet/test/test_helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'tmpdir'
 require 'fileutils'
 
@@ -33,7 +35,7 @@ module Puppet::Test
     # Call this method once, as early as possible, such as before loading tests
     # that call Puppet.
     # @return nil
-    def self.initialize()
+    def self.initialize
       # This meta class instance variable is used as a guard to ensure that
       # before_each, and after_each are only called once. This problem occurs
       # when there are more than one puppet test infrastructure orchestrator in use.
@@ -51,9 +53,9 @@ module Puppet::Test
       Dir.mkdir("#{@environmentpath}/production")
       owner = Process.pid
       Puppet.push_context(Puppet.base_context({
-        :environmentpath => @environmentpath,
-        :basemodulepath => "",
-      }), "Initial for specs")
+                                                :environmentpath => @environmentpath,
+                                                :basemodulepath => "",
+                                              }), "Initial for specs")
       Puppet::Parser::Functions.reset
 
       ObjectSpace.define_finalizer(Puppet.lookup(:environments), proc {
@@ -67,14 +69,15 @@ module Puppet::Test
     # Call this method once, when beginning a test run--prior to running
     #  any individual tests.
     # @return nil
-    def self.before_all_tests()
-      # Make sure that all of the setup is also done for any before(:all) blocks
+    def self.before_all_tests
+      # The process environment is a shared, persistent resource.
+      $old_env = ENV.to_hash
     end
 
     # Call this method once, at the end of a test run, when no more tests
     #  will be run.
     # @return nil
-    def self.after_all_tests()
+    def self.after_all_tests
     end
 
     # The name of the rollback mark used in the Puppet.context. This is what
@@ -84,7 +87,7 @@ module Puppet::Test
 
     # Call this method once per test, prior to execution of each individual test.
     # @return nil
-    def self.before_each_test()
+    def self.before_each_test
       # When using both rspec-puppet and puppet-rspec-helper, there are two packages trying
       # to be helpful and orchestrate the callback sequence. We let only the first win, the
       # second callback results in a no-op.
@@ -92,6 +95,7 @@ module Puppet::Test
       # only once.
       #
       return unless @@reentry_count == 0
+
       @@reentry_count = 1
 
       Puppet.mark_context(ROLLBACK_MARK)
@@ -113,20 +117,14 @@ module Puppet::Test
       indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
       indirections.each do |indirector|
         $saved_indirection_state[indirector.name] = {
-            :@terminus_class => indirector.instance_variable_get(:@terminus_class),
-            :@cache_class    => indirector.instance_variable_get(:@cache_class)
+          :@terminus_class => indirector.instance_variable_get(:@terminus_class).value,
+          :@cache_class => indirector.instance_variable_get(:@cache_class).value,
+          # dup the termini hash so termini created and registered during
+          # the test aren't stored in our saved_indirection_state
+          :@termini => indirector.instance_variable_get(:@termini).dup
         }
       end
 
-      # The process environment is a shared, persistent resource.
-      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
-      if (!!File::ALT_SEPARATOR)
-        mode = :windows
-      else
-        mode = :posix
-      end
-      $old_env = Puppet::Util.get_environment(mode)
-
       # So is the load_path
       $old_load_path = $LOAD_PATH.dup
 
@@ -134,91 +132,93 @@ module Puppet::Test
 
       Puppet.push_context(
         {
-          :trusted_information =>
-            Puppet::Context::TrustedInformation.new('local', 'testing', {}),
+          trusted_information:
+            Puppet::Context::TrustedInformation.new('local', 'testing', {}, { "trusted_testhelper" => true }),
+          ssl_context: Puppet::SSL::SSLContext.new(cacerts: []).freeze,
+          http_session: proc { Puppet.runtime[:http].create_session }
         },
-        "Context for specs")
+        "Context for specs"
+      )
+
+      # trigger `require 'facter'`
+      Puppet.runtime[:facter]
 
       Puppet::Parser::Functions.reset
       Puppet::Application.clear!
       Puppet::Util::Profiler.clear
 
-      Puppet::SSL::Host.reset
+      Puppet::Node::Facts.indirection.terminus_class = :memory
+      facts = Puppet::Node::Facts.new(Puppet[:node_name_value])
+      Puppet::Node::Facts.indirection.save(facts)
 
       Puppet.clear_deprecation_warnings
     end
 
     # Call this method once per test, after execution of each individual test.
     # @return nil
-    def self.after_each_test()
+    def self.after_each_test
       # Ensure that a matching tear down only happens once per completed setup
       # (see #before_each_test).
       return unless @@reentry_count == 1
+
       @@reentry_count = 0
 
       Puppet.settings.send(:clear_everything_for_tests)
 
       Puppet::Util::Storage.clear
       Puppet::Util::ExecutionStub.reset
+      Puppet.runtime.clear
 
       Puppet.clear_deprecation_warnings
 
       # uncommenting and manipulating this can be useful when tracking down calls to deprecated code
-      #Puppet.log_deprecations_to_file("deprecations.txt", /^Puppet::Util.exec/)
+      # Puppet.log_deprecations_to_file("deprecations.txt", /^Puppet::Util.exec/)
 
       # Restore the indirector configuration.  See before hook.
       indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
       indirections.each do |indirector|
         $saved_indirection_state.fetch(indirector.name, {}).each do |variable, value|
-          indirector.instance_variable_set(variable, value)
+          if variable == :@termini
+            indirector.instance_variable_set(variable, value)
+          else
+            indirector.instance_variable_get(variable).value = value
+          end
         end
       end
       $saved_indirection_state = nil
 
-      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
-      if (!!File::ALT_SEPARATOR)
-        mode = :windows
-      else
-        mode = :posix
-      end
-      # Restore the global process environment.  Can't just assign because this
-      # is a magic variable, sadly, and doesn't do that™.  It is sufficiently
-      # faster to use the compare-then-set model to avoid excessive work that it
-      # justifies the complexity.  --daniel 2012-03-15
-      unless Puppet::Util.get_environment(mode) == $old_env
-        Puppet::Util.clear_environment(mode)
-        $old_env.each {|k, v| Puppet::Util.set_env(k, v, mode) }
-      end
+      # Restore the global process environment.
+      ENV.replace($old_env)
 
       # Clear all environments
       Puppet.lookup(:environments).clear_all
 
       # Restore the load_path late, to avoid messing with stubs from the test.
       $LOAD_PATH.clear
-      $old_load_path.each {|x| $LOAD_PATH << x }
+      $old_load_path.each { |x| $LOAD_PATH << x }
 
       Puppet.rollback_context(ROLLBACK_MARK)
     end
 
-
     #########################################################################################
     # PRIVATE METHODS (not part of the public TestHelper API--do not call these from outside
     #  of this class!)
     #########################################################################################
 
-    def self.app_defaults_for_tests()
+    def self.app_defaults_for_tests
       {
-          :logdir     => "/dev/null",
-          :confdir    => "/dev/null",
-          :codedir    => "/dev/null",
-          :vardir     => "/dev/null",
-          :rundir     => "/dev/null",
-          :hiera_config => "/dev/null",
+        :logdir => "/dev/null",
+        :confdir => "/dev/null",
+        :publicdir => "/dev/null",
+        :codedir => "/dev/null",
+        :vardir => "/dev/null",
+        :rundir => "/dev/null",
+        :hiera_config => "/dev/null",
       }
     end
     private_class_method :app_defaults_for_tests
 
-    def self.initialize_settings_before_each()
+    def self.initialize_settings_before_each
       Puppet.settings.preferred_run_mode = "user"
       # Initialize "app defaults" settings to a good set of test values
       Puppet.settings.initialize_app_defaults(app_defaults_for_tests)

data/lib/puppet/thread_local.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+require 'concurrent'
+
+class Puppet::ThreadLocal < Concurrent::ThreadLocalVar
+end

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Adds additional resources to the catalog and relationship graph that are
 # generated by existing resources. There are two ways that a resource can
 # generate additional resources, either through the #generate method or the
@@ -18,6 +20,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
 
   def generate_additional_resources(resource)
     return unless resource.respond_to?(:generate)
+
     begin
       generated = resource.generate
     rescue => detail
@@ -25,6 +28,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
       resource.log_exception(detail, _("Failed to generate additional resources using 'generate': %{detail}") % { detail: detail })
     end
     return unless generated
+
     generated = [generated] unless generated.is_a?(Array)
     generated.collect! do |res|
       @catalog.resource(res.ref) || res
@@ -52,18 +56,19 @@ class Puppet::Transaction::AdditionalResourceGenerator
   def eval_generate(resource)
     return false unless resource.respond_to?(:eval_generate)
     raise Puppet::DevError, _("Depthfirst resources are not supported by eval_generate") if resource.depthfirst?
+
     begin
       generated = replace_duplicates_with_catalog_resources(resource.eval_generate)
       return false if generated.empty?
     rescue => detail
       @resources_failed_to_generate = true
-      #TRANSLATORS eval_generate is a method name and should be left untranslated
+      # TRANSLATORS eval_generate is a method name and should be left untranslated
       resource.log_exception(detail, _("Failed to generate additional resources using 'eval_generate': %{detail}") % { detail: detail })
       return false
     end
     add_resources(generated, resource)
 
-    made = Hash[generated.map(&:name).zip(generated)]
+    made = generated.map(&:name).zip(generated).to_h
     contain_generated_resources_in(resource, made)
     connect_resources_to_ancestors(resource, made)
 
@@ -129,7 +134,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
     end
   end
 
-  def add_resource(res, parent_resource, priority=nil)
+  def add_resource(res, parent_resource, priority = nil)
     if @catalog.resource(res.ref).nil?
       res.merge_tags_from(parent_resource)
       if parent_resource.depthfirst?
@@ -137,7 +142,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
       else
         @catalog.add_resource_after(parent_resource, res)
       end
-      @catalog.add_edge(@catalog.container_of(parent_resource), res)
+      @catalog.add_edge(@catalog.container_of(parent_resource), res) if @catalog.container_of(parent_resource)
       if @relationship_graph && priority
         # If we have a relationship_graph we should add the resource
         # to it (this is an eval_generate). If we don't, then the
@@ -152,7 +157,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
   # add correct edge for depth- or breadth- first traversal of
   # generated resource. Skip generating the edge if there is already
   # some sort of edge between the two resources.
-  def add_generated_directed_dependency(parent, child, label=nil)
+  def add_generated_directed_dependency(parent, child, label = nil)
     if parent.depthfirst?
       source = child
       target = parent
@@ -186,7 +191,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
       parent_contains || child_contains
     }
 
-    if not edge_exists
+    unless edge_exists
       # We *cannot* use target.to_resource here!
       #
       # For reasons that are beyond my (and, perhaps, human)
@@ -208,13 +213,13 @@ class Puppet::Transaction::AdditionalResourceGenerator
 
   # Copy an important relationships from the parent to the newly-generated
   # child resource.
-  def add_conditional_directed_dependency(parent, child, label=nil)
+  def add_conditional_directed_dependency(parent, child, label = nil)
     @relationship_graph.add_vertex(child)
     edge = parent.depthfirst? ? [child, parent] : [parent, child]
     if @relationship_graph.edge?(*edge.reverse)
       parent.debug "Skipping automatic relationship to #{child}"
     else
-      @relationship_graph.add_relationship(edge[0],edge[1],label)
+      @relationship_graph.add_relationship(edge[0], edge[1], label)
     end
   end
 end