puppet 6.10.1 → 6.11.0

data/lib/puppet/rest/errors.rb

@@ -1,3 +1,4 @@
+# @deprecated Use {Puppet::HTTP::Client} instead.
 module Puppet::Rest
   class ResponseError < Puppet::Error
     attr_reader :response

data/lib/puppet/rest/response.rb

@@ -1,3 +1,4 @@
+# @deprecated Use {Puppet::HTTP::Client} instead.
 module Puppet::Rest
   # This is a wrapper for the HTTP::Message class of the HTTPClient
   # gem. It is designed to wrap a message sent as an HTTP response.

data/lib/puppet/rest/route.rb

@@ -1,6 +1,7 @@
 require 'uri'
 require 'puppet/util/connection'
 
+# @deprecated Use {Puppet::HTTP::Client} instead.
 module Puppet::Rest
   class Route
     attr_reader :server

data/lib/puppet/rest/routes.rb

@@ -3,6 +3,7 @@ require 'puppet/rest/route'
 require 'puppet/network/http_pool'
 require 'puppet/network/http/compression'
 
+# @deprecated Use {Puppet::HTTP::Client} instead.
 module Puppet::Rest
   module Routes
     extend Puppet::Network::HTTP::Compression.module
@@ -10,6 +11,8 @@ module Puppet::Rest
     ACCEPT_ENCODING = 'gzip;q=1.0,deflate;q=0.6,identity;q=0.3'
 
     def self.ca
+      Puppet.deprecation_warning("Puppet::Rest::Routes is deprecated, use Puppet::HTTP::Client instead")
+
       @ca ||= Route.new(api: '/puppet-ca/v1/',
                         server_setting: :ca_server,
                         port_setting: :ca_port,

data/lib/puppet/runtime.rb

@@ -0,0 +1,25 @@
+require 'puppet/http'
+
+class Puppet::Runtime
+  include Singleton
+
+  def initialize
+    @runtime_services = {}
+  end
+  private :initialize
+
+  def [](name)
+    service = @runtime_services[name]
+    raise ArgumentError, "Unknown service #{name}" unless service
+
+    if service.is_a?(Proc)
+      @runtime_services[name] = service.call
+    else
+      service
+    end
+  end
+
+  def []=(name, impl)
+    @runtime_services[name] = impl
+  end
+end

data/lib/puppet/settings.rb

@@ -1242,10 +1242,10 @@ Generated on #{Time.now}.
       if !Puppet::FileSystem.symlink?(configured_environment_path)
         parameters = { :ensure => 'directory' }
         unless Puppet::FileSystem.exist?(configured_environment_path)
-          parameters.merge!(:mode => '0750')
+          parameters[:mode] = '0750'
           if Puppet.features.root?
-            parameters.merge!(:owner => Puppet[:user]) if service_user_available?
-            parameters.merge!(:group => Puppet[:group]) if service_group_available?
+            parameters[:owner] = Puppet[:user] if service_user_available?
+            parameters[:group] = Puppet[:group] if service_group_available?
           end
         end
         catalog.add_resource(Puppet::Resource.new(:file, configured_environment_path, :parameters => parameters))

data/lib/puppet/settings/environment_conf.rb

@@ -159,6 +159,7 @@ class Puppet::Settings::EnvironmentConf
 
     return valid
   end
+  private_class_method :validate
 
   def get_setting(setting_name, default = nil)
     value = raw_setting(setting_name)

data/lib/puppet/ssl/host.rb

@@ -279,7 +279,7 @@ ERROR_STRING
       exit(1)
     end
 
-    while true
+    loop do
       sleep time
       begin
         break if certificate

data/lib/puppet/ssl/oids.rb

@@ -101,7 +101,7 @@ module Puppet::SSL::Oids
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
   def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
-    if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
+    if File.exist?(custom_oid_file) && File.readable?(custom_oid_file)
       mapping = nil
       begin
         mapping = Puppet::Util::Yaml.safe_load_file(custom_oid_file, [Symbol])

data/lib/puppet/ssl/state_machine.rb

@@ -44,7 +44,8 @@ class Puppet::SSL::StateMachine
       if cacerts
         next_ctx = @ssl_provider.create_root_context(cacerts: cacerts, revocation: false)
       else
-        pem = Puppet::Rest::Routes.get_certificate(Puppet::SSL::CA_NAME, @ssl_context)
+        route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
+        pem = route.get_certificate(Puppet::SSL::CA_NAME, ssl_context: @ssl_context)
         if @machine.ca_fingerprint
           actual_digest = Puppet::SSL::Digest.new(@machine.digest, pem).to_hex
           expected_digest = @machine.ca_fingerprint.scan(/../).join(':').upcase
@@ -66,8 +67,8 @@ class Puppet::SSL::StateMachine
       NeedCRLs.new(@machine, next_ctx)
     rescue OpenSSL::X509::CertificateError => e
       Error.new(@machine, e.message, e)
-    rescue Puppet::Rest::ResponseError => e
-      if e.response.code.to_i == 404
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 404
         to_error(_('CA certificate is missing from the server'), e)
       else
         to_error(_('Could not download CA certificate: %{message}') % { message: e.message }, e)
@@ -112,8 +113,8 @@ class Puppet::SSL::StateMachine
       NeedKey.new(@machine, next_ctx)
     rescue OpenSSL::X509::CRLError => e
       Error.new(@machine, e.message, e)
-    rescue Puppet::Rest::ResponseError => e
-      if e.response.code.to_i == 404
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 404
         to_error(_('CRL is missing from the server'), e)
       else
         to_error(_('Could not download CRLs: %{message}') % { message: e.message }, e)
@@ -127,8 +128,8 @@ class Puppet::SSL::StateMachine
 
       # return the next_ctx containing the updated crl
       download_crl(ssl_ctx, last_update)
-    rescue Puppet::Rest::ResponseError => e
-      if e.response.code.to_i == 304
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 304
         Puppet.info(_("CRL is unmodified, using existing CRL"))
       else
         Puppet.info(_("Failed to refresh CRL, using existing CRL: %{message}") % {message: e.message})
@@ -136,7 +137,7 @@ class Puppet::SSL::StateMachine
 
       # return the original ssl_ctx
       ssl_ctx
-    rescue SystemCallError => e
+    rescue Puppet::HTTP::HTTPError => e
       Puppet.warning(_("Failed to refresh CRL, using existing CRL: %{message}") % {message: e.message})
 
       # return the original ssl_ctx
@@ -144,7 +145,8 @@ class Puppet::SSL::StateMachine
     end
 
     def download_crl(ssl_ctx, last_update)
-      pem = Puppet::Rest::Routes.get_crls(Puppet::SSL::CA_NAME, ssl_ctx, if_modified_since: last_update)
+      route = @machine.session.route_to(:ca, ssl_context: ssl_ctx)
+      pem = route.get_certificate_revocation_list(if_modified_since: last_update, ssl_context: ssl_ctx)
       crls = @cert_provider.load_crls_from_pem(pem)
       # verify crls before saving
       next_ctx = @ssl_provider.create_root_context(cacerts: ssl_ctx[:cacerts], crls: crls)
@@ -211,11 +213,12 @@ class Puppet::SSL::StateMachine
       Puppet.debug(_("Generating and submitting a CSR"))
 
       csr = @cert_provider.create_request(Puppet[:certname], @private_key)
-      Puppet::Rest::Routes.put_certificate_request(csr.to_pem, Puppet[:certname], @ssl_context)
+      route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
+      route.put_certificate_request(Puppet[:certname], csr, ssl_context: @ssl_context)
       @cert_provider.save_request(Puppet[:certname], csr)
       NeedCert.new(@machine, @ssl_context, @private_key)
-    rescue Puppet::Rest::ResponseError => e
-      if e.response.code.to_i == 400
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 400
         NeedCert.new(@machine, @ssl_context, @private_key)
       else
         to_error(_("Failed to submit the CSR, HTTP response was %{code}") % { code: e.response.code }, e)
@@ -229,9 +232,11 @@ class Puppet::SSL::StateMachine
     def next_state
       Puppet.debug(_("Downloading client certificate"))
 
+      route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
       cert = OpenSSL::X509::Certificate.new(
-        Puppet::Rest::Routes.get_certificate(Puppet[:certname], @ssl_context)
+        route.get_certificate(Puppet[:certname], ssl_context: @ssl_context)
       )
+      Puppet.info _("Downloaded certificate for %{name} from %{url}") % { name: Puppet[:certname], url: route.url }
       # verify client cert before saving
       next_ctx = @ssl_provider.create_context(
         cacerts: @ssl_context.cacerts, crls: @ssl_context.crls, private_key: @private_key, client_cert: cert
@@ -243,8 +248,8 @@ class Puppet::SSL::StateMachine
       Error.new(@machine, e.message, e)
     rescue OpenSSL::X509::CertificateError => e
       Error.new(@machine, _("Failed to parse certificate: %{message}") % {message: e.message}, e)
-    rescue Puppet::Rest::ResponseError => e
-      if e.response.code.to_i == 404
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 404
         Puppet.info(_("Certificate for %{certname} has not been signed yet") % {certname: Puppet[:certname]})
         $stdout.puts _("Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}).") % { name: Puppet[:certname] }
         Wait.new(@machine)
@@ -277,6 +282,7 @@ class Puppet::SSL::StateMachine
 
         # our ssl directory may have been cleaned while we were
         # sleeping, start over from the top
+        @machine.session = Puppet.runtime['http'].create_session
         NeedCACerts.new(@machine)
       end
     end
@@ -305,6 +311,7 @@ class Puppet::SSL::StateMachine
   class Done < SSLState; end
 
   attr_reader :waitforcert, :wait_deadline, :cert_provider, :ssl_provider, :ca_fingerprint, :digest
+  attr_accessor :session
 
   # Construct a state machine to manage the SSL initialization process. By
   # default, if the state machine encounters an exception, it will log the
@@ -343,6 +350,7 @@ class Puppet::SSL::StateMachine
     @lockfile = lockfile
     @digest = digest
     @ca_fingerprint = ca_fingerprint
+    @session = Puppet.runtime['http'].create_session
   end
 
   # Run the state machine for CA certs and CRLs.

data/lib/puppet/test/test_helper.rb

@@ -135,7 +135,7 @@ module Puppet::Test
       Puppet.push_context(
         {
           trusted_information:
-            Puppet::Context::TrustedInformation.new('local', 'testing', {}),
+            Puppet::Context::TrustedInformation.new('local', 'testing', {}, { "trusted_testhelper" => true }),
           ssl_context: Puppet::SSL::SSLContext.new(cacerts: []).freeze
         },
         "Context for specs")

data/lib/puppet/transaction/report.rb

@@ -346,7 +346,7 @@ class Puppet::Transaction::Report
     report = raw_summary
 
     ret = ""
-    report.keys.sort { |a,b| a.to_s <=> b.to_s }.each do |key|
+    report.keys.sort_by(&:to_s).each do |key|
       ret += "#{Puppet::Util::Metric.labelize(key)}:\n"
 
       report[key].keys.sort { |a,b|

data/lib/puppet/trusted_external.rb

@@ -0,0 +1,13 @@
+# A method for retrieving external trusted facts
+module Puppet::TrustedExternal
+  def retrieve(certname)
+    command = Puppet[:trusted_external_command]
+    return nil unless command
+    result = Puppet::Util::Execution.execute([command, certname], {
+      :combine => false,
+      :failonfail => true,
+    })
+    JSON.parse(result)
+  end
+  module_function :retrieve
+end

data/lib/puppet/type.rb

@@ -1952,9 +1952,7 @@ end
         # Since we're mixing @doc with text from other sources, we must normalize
         # its indentation with scrub. But we don't need to manually scrub the
         # provider's doc string, since markdown_definitionlist sanitizes its inputs.
-        scrub(@doc) + "Available providers are:\n\n" + parenttype.providers.sort { |a,b|
-          a.to_s <=> b.to_s
-        }.collect { |i|
+        scrub(@doc) + "Available providers are:\n\n" + parenttype.providers.sort_by(&:to_s).collect { |i|
           markdown_definitionlist( i, scrub(parenttype().provider(i).doc) )
         }.join
       end

data/lib/puppet/type/exec.rb

@@ -165,9 +165,13 @@ module Puppet
             end
           end
           unless log == :false
-            @output.split(/\n/).each { |line|
-              self.send(log, line)
-            }
+            if @resource.parameter(:command).sensitive
+              self.send(log, "[output redacted]")
+            else
+              @output.split(/\n/).each { |line|
+                self.send(log, line)
+              }
+            end
           end
         end
 

data/lib/puppet/type/file.rb

@@ -605,8 +605,7 @@ Puppet::Type.newtype(:file) do
     # remote system.
     mark_children_for_purging(children) if self.purge?
 
-    # REVISIT: sort_by is more efficient?
-    result = children.values.sort { |a, b| a[:path] <=> b[:path] }
+    result = children.values.sort_by { |a| a[:path] }
     remove_less_specific_files(result)
   end
 

data/lib/puppet/type/file/source.rb

@@ -220,11 +220,11 @@ module Puppet
     end
 
     def server?
-       uri and uri.host
+       uri && uri.host && !uri.host.empty?
     end
 
     def server
-      (uri and uri.host) or Puppet.settings[:server]
+      server? ? uri.host : Puppet.settings[:server]
     end
 
     def port

data/lib/puppet/type/package.rb

@@ -485,8 +485,8 @@ module Puppet
     end
 
     newparam(:flavor) do
-      desc "OpenBSD supports 'flavors', which are further specifications for
-        which type of package you want."
+      desc "OpenBSD and DNF modules support 'flavors', which are
+        further specifications for which type of package you want."
     end
 
     newparam(:install_only, :boolean => false, :parent => Puppet::Parameter::Boolean, :required_features => :install_only) do
@@ -548,7 +548,14 @@ module Puppet
     newparam(:allow_virtual, :boolean => true, :parent => Puppet::Parameter::Boolean, :required_features => :virtual_packages) do
       desc 'Specifies if virtual package names are allowed for install and uninstall.'
 
-      defaultto true
+      defaultto do
+        provider_class = provider.class
+        if provider_class.respond_to?(:defaultto_allow_virtual)
+          provider_class.defaultto_allow_virtual
+        else
+          true
+        end
+      end
     end
 
     autorequire(:file) do

data/lib/puppet/type/schedule.rb

@@ -338,7 +338,7 @@ module Puppet
       end
 
       def weekday_integer?(value)
-        value.is_a?(Integer) && (0..6).include?(value)
+        value.is_a?(Integer) && (0..6).cover?(value)
       end
 
       def weekday_string?(value)

data/lib/puppet/type/service.rb

@@ -231,7 +231,7 @@ module Puppet
       desc "The control variable used to manage services (originally for HP-UX).
         Defaults to the upcased service name plus `START` replacing dots with
         underscores, for those providers that support the `controllable` feature."
-      defaultto { resource.name.gsub(".","_").upcase + "_START" if resource.provider.controllable? }
+      defaultto { resource.name.tr(".","_").upcase + "_START" if resource.provider.controllable? }
     end
 
     newparam :hasrestart do

data/lib/puppet/util.rb

@@ -324,7 +324,7 @@ module Util
     params = { :scheme => 'file' }
 
     if Puppet::Util::Platform.windows?
-      path = path.gsub(/\\/, '/')
+      path = path.tr('\\', '/')
 
       unc = /^\/\/([^\/]+)(\/.+)/.match(path)
       if unc
@@ -359,7 +359,7 @@ module Util
     path = URI.unescape(uri.path.encode(Encoding::UTF_8))
 
     if Puppet::Util::Platform.windows? && uri.scheme == 'file'
-      if uri.host
+      if uri.host && !uri.host.empty?
         path = "//#{uri.host}" + path # UNC
       else
         path.sub!(/^\//, '')

data/lib/puppet/util/command_line/trollop.rb

@@ -215,7 +215,7 @@ class Parser
     opts[:type] = opts[:type] || type_from_default || :flag
 
     ## fill in :long
-    opts[:long] = opts[:long] ? opts[:long].to_s : name.to_s.gsub("_", "-")
+    opts[:long] = opts[:long] ? opts[:long].to_s : name.to_s.tr("_", "-")
     opts[:long] =
       case opts[:long]
       when /^--([^-].*)$/

data/lib/puppet/util/http_proxy.rb

@@ -1,6 +1,6 @@
 require 'uri'
 require 'puppet/ssl/openssl_loader'
-require 'puppet/network/http'
+require 'puppet/http'
 
 module Puppet::Util::HttpProxy
   def self.proxy(uri)
@@ -52,14 +52,6 @@ module Puppet::Util::HttpProxy
       host, port = d.split(':')
       host = Regexp.escape(host).gsub('\*', '.*')
 
-      #If the host of this no_proxy value starts with '.', this entry is
-      #a domain level entry. Don't pin the regex to the beginning of the entry.
-      #If it does not start with a '.' then it is a host specific entry and
-      #should be matched to the destination starting at the beginning.
-      unless host =~ /^\\\./
-        host = "^#{host}"
-      end
-
       #If this no_proxy entry specifies a port, we want to match it against
       #the destination port.  Otherwise just match hosts.
       if port
@@ -195,7 +187,7 @@ module Puppet::Util::HttpProxy
 
       headers = { 'Accept' => '*/*', 'User-Agent' => Puppet[:http_user_agent] }
       if Puppet.features.zlib?
-        headers.merge!({"Accept-Encoding" => Puppet::Network::HTTP::Compression::ACCEPT_ENCODING})
+        headers["Accept-Encoding"] = Puppet::HTTP::ACCEPT_ENCODING
       end
 
       response = proxy.send(:head, current_uri, headers)

data/lib/puppet/util/log.rb

@@ -175,7 +175,7 @@ class Puppet::Util::Log
     # We only select the last 10 callers in the stack to avoid being spammy
     message = _("Received a Log attribute with invalid encoding:%{log_message}") %
         { log_message: Puppet::Util::CharacterEncoding.convert_to_utf_8(str.dump)}
-    message += '\n' + _("Backtrace:\n%{backtrace}") % { backtrace: caller[0..10].join("\n") }
+    message += '\n' + _("Backtrace:\n%{backtrace}") % { backtrace: caller(1, 10).join("\n") }
     message
   end
   private_class_method :coerce_string
@@ -395,7 +395,7 @@ class Puppet::Util::Log
   end
 
   def to_report
-    "#{time} #{source} (#{level}): #{to_s}"
+    "#{time} #{source} (#{level}): #{self}"
   end
 
   def to_s

data/lib/puppet/util/log/destinations.rb

@@ -34,7 +34,7 @@ Puppet::Util::Log.newdesttype :syslog do
       end
     else
       msg.to_s.split("\n").each do |line|
-        @syslog.send(msg.level, "(%s) %s" % [msg.source.to_s.gsub("%", ""),
+        @syslog.send(msg.level, "(%s) %s" % [msg.source.to_s.delete("%"),
             line.gsub("%", '%%')
           ]
         )
@@ -78,7 +78,7 @@ Puppet::Util::Log.newdesttype :file do
 
     # create the log file, if it doesn't already exist
     need_array_start = false
-    file_exists = File.exists?(path)
+    file_exists = Puppet::FileSystem.exist?(path)
     if @json == 1
       need_array_start = true
       if file_exists