puppet 6.11.1 → 6.16.0

data/lib/puppet/environments.rb

@@ -1,3 +1,5 @@
+require 'puppet/concurrent/synchronized'
+
 # @api private
 module Puppet::Environments
 
@@ -184,6 +186,13 @@ module Puppet::Environments
       end
     end
 
+    def self.real_path(dir)
+      if Puppet::FileSystem.symlink?(dir) && Puppet[:versioned_environment_dirs]
+        dir = Puppet::FileSystem.expand_path(Puppet::FileSystem.readlink(dir))
+      end
+      return dir
+    end
+
     # @!macro loader_search_paths
     def search_paths
       ["file://#{@environment_dir}"]
@@ -191,27 +200,26 @@ module Puppet::Environments
 
     # @!macro loader_list
     def list
-      valid_directories.collect do |envdir|
-        name = Puppet::FileSystem.basename_string(envdir).intern
-
+      valid_environment_names.collect do |name|
         create_environment(name)
       end
     end
 
     # @!macro loader_get
     def get(name)
-      if valid_directory?(File.join(@environment_dir, name.to_s))
+      if validated_directory(File.join(@environment_dir, name.to_s))
         create_environment(name)
       end
     end
 
     # @!macro loader_get_conf
     def get_conf(name)
-      envdir = File.join(@environment_dir, name.to_s)
-      if valid_directory?(envdir)
-        return Puppet::Settings::EnvironmentConf.load_from(envdir, @global_module_path)
+      envdir = validated_directory(File.join(@environment_dir, name.to_s))
+      if envdir
+        Puppet::Settings::EnvironmentConf.load_from(envdir, @global_module_path)
+      else
+        nil
       end
-      nil
     end
 
     private
@@ -228,21 +236,22 @@ module Puppet::Environments
       env
     end
 
-    def valid_directory?(envdir)
-      name = Puppet::FileSystem.basename_string(envdir)
-      Puppet::FileSystem.directory?(envdir) &&
-         Puppet::Node::Environment.valid_name?(name)
-    end
-
-    def valid_directories
-      if Puppet::FileSystem.directory?(@environment_dir)
-        Puppet::FileSystem.children(@environment_dir).select do |child|
-          valid_directory?(child)
-        end
+    def validated_directory(envdir)
+      env_name = Puppet::FileSystem.basename_string(envdir)
+      envdir = Puppet::Environments::Directories.real_path(envdir)
+      if Puppet::FileSystem.directory?(envdir) && Puppet::Node::Environment.valid_name?(env_name)
+        envdir
       else
-        []
+        nil
       end
     end
+
+    def valid_environment_names
+      return [] unless Puppet::FileSystem.directory?(@environment_dir)
+      Puppet::FileSystem.children(@environment_dir).map do |child|
+        Puppet::FileSystem.basename_string(child).intern if validated_directory(child)
+      end.compact
+    end
   end
 
   # Combine together multiple loaders to act as one.
@@ -293,6 +302,7 @@ module Puppet::Environments
 
   class Cached
     include EnvironmentLoader
+    include Puppet::Concurrent::Synchronized
 
     class DefaultCacheExpirationService
       def created(env)

data/lib/puppet/error.rb

@@ -12,7 +12,7 @@ module Puppet
     # This module implements logging with a filename and line number. Use this
     # for errors that need to report a location in a non-ruby file that we
     # parse.
-    attr_accessor :line, :file, :pos
+    attr_accessor :line, :file, :pos, :puppetstack
 
     # May be called with 3 arguments for message, file, line, and exception, or
     # 4 args including the position on the line.
@@ -22,10 +22,18 @@ module Puppet
         original = pos
         pos = nil
       end
+
       super(message, original)
+
       @file = file unless (file.is_a?(String) && file.empty?)
       @line = line
       @pos = pos
+
+      if original && original.respond_to?(:puppetstack)
+        @puppetstack = original.puppetstack
+      else
+        @puppetstack = Puppet::Pops::PuppetStack.stacktrace()
+      end
     end
 
     def to_s

data/lib/puppet/face/facts.rb

@@ -75,13 +75,16 @@ Puppet::Indirector::Face.define(:facts, '0.0.1') do
         facts.name = Puppet[:node_name_value]
       end
 
-      Puppet::Node::Facts.indirection.terminus_class = :rest
-      server = Puppet::Node::Facts::Rest.server
-      Puppet.notice(_("Uploading facts for '%{node}' to: '%{server}'") % {
+      client = Puppet.runtime[:http]
+      session = client.create_session
+      puppet = session.route_to(:puppet)
+
+      Puppet.notice(_("Uploading facts for '%{node}' to '%{server}'") % {
                     node: Puppet[:node_name_value],
-                    server: server})
+                    server: puppet.url.hostname})
 
-      Puppet::Node::Facts.indirection.save(facts, nil, :environment => Puppet.lookup(:current_environment))
+      puppet.put_facts(Puppet[:node_name_value], facts: facts, environment: Puppet.lookup(:current_environment).name.to_s)
+      nil
     end
   end
 end

data/lib/puppet/face/help.rb

@@ -24,12 +24,19 @@ Puppet::Face.define(:help, '0.0.1') do
       summary _("The version of the subcommand for which to show help.")
     end
 
+    option "--ronn" do
+      summary _("Whether to render the help text in ronn format.")
+      default_to { false }
+    end
+
     default
     when_invoked do |*args|
       options = args.pop
 
-      if default_case?(args) || help_for_help?(args)
-        return erb('global.erb').result(binding)
+      unless options[:ronn]
+        if default_case?(args) || help_for_help?(args)
+          return erb('global.erb').result(binding)
+        end
       end
 
       if args.length > 2
@@ -54,9 +61,20 @@ Puppet::Face.define(:help, '0.0.1') do
         if actionname
           raise ArgumentError, _("The legacy subcommand '%{sub_command}' does not support supplying an action") % { sub_command: facename }
         end
+        # legacy apps already emit ronn output
         return render_application_help(facename)
       else
-        return render_face_help(facename, actionname, version)
+        if options[:ronn]
+          # Calling `puppet help <app> --ronn` normally calls this action with
+          # <app> as the first argument in the `args` array. However, if <app>
+          # happens to match the name of an action, like `puppet help help
+          # --ronn`, then face_base "eats" the argument and `args` will be
+          # empty. Rather than force users to type `puppet help help help
+          # --ronn`, default the facename to `:help`
+          render_face_man(facename || :help)
+        else
+          render_face_help(facename, actionname, version)
+        end
       end
     end
   end
@@ -69,6 +87,14 @@ Puppet::Face.define(:help, '0.0.1') do
     args.length == 1 && args.first == 'help'
   end
 
+  def render_face_man(facename)
+    # set 'face' as it's used in the erb processing.
+    face = Puppet::Face[facename.to_sym, :current]
+    # avoid unused variable warning
+    _face = face
+    erb('man.erb').result(binding)
+  end
+
   def render_application_help(applicationname)
     return Puppet::Application[applicationname].help
   rescue StandardError, LoadError => detail

data/lib/puppet/face/module/search.rb

@@ -5,6 +5,8 @@ Puppet::Face.define(:module, '1.0.0') do
   action(:search) do
     summary _("Search the Puppet Forge for a module.")
     description <<-EOT
+      This action has been deprecated. Please use the Puppet Forge to search for modules.
+
       Searches a repository for modules whose names, descriptions, or keywords
       match the provided search term.
     EOT
@@ -22,6 +24,7 @@ Puppet::Face.define(:module, '1.0.0') do
     arguments _("<search_term>")
 
     when_invoked do |term, options|
+      Puppet.deprecation_warning(_("This action has been deprecated. Please use the Puppet Forge to search for modules."))
       Puppet::ModuleTool.set_option_defaults options
       Puppet::ModuleTool::Applications::Searcher.new(term, Puppet::Forge.new(options[:module_repository] || Puppet[:module_repository]), options).run
     end
@@ -94,5 +97,7 @@ Puppet::Face.define(:module, '1.0.0') do
         highlight[format % [ name.sub('/', '-'), desc, "@#{author}", [keywords].flatten.join(' ') ]]
       end.join
     end
+
+    deprecate
   end
 end

data/lib/puppet/face/plugin.rb

@@ -41,10 +41,10 @@ Puppet::Face.define(:plugin, '0.0.1') do
     when_invoked do |options|
       remote_environment_for_plugins = Puppet::Node::Environment.remote(Puppet[:environment])
 
-      pool = Puppet::Network::HTTP::Pool.new(Puppet[:http_keepalive_timeout])
+      pool = Puppet.runtime[:http].pool
       Puppet.override(:http_pool => pool) do
         begin
-          handler = Puppet::Configurer::PluginHandler.new()
+          handler = Puppet::Configurer::PluginHandler.new
           handler.download_plugins(remote_environment_for_plugins)
         ensure
           pool.close

data/lib/puppet/file_serving/http_metadata.rb

@@ -18,7 +18,7 @@ class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
     checksum = http_response['content-md5']
     if checksum
       # convert base64 digest to hex
-      checksum = checksum.unpack("m0").first.unpack("H*").first
+      checksum = checksum.unpack("m").first.unpack("H*").first
       @checksums[:md5] = "{md5}#{checksum}"
     end
 

data/lib/puppet/file_system/file_impl.rb

@@ -80,7 +80,7 @@ class Puppet::FileSystem::FileImpl
   end
 
   def read(path, opts = {})
-    path.read(opts)
+    path.read(**opts)
   end
 
   def read_preserve_line_endings(path)
@@ -156,12 +156,14 @@ class Puppet::FileSystem::FileImpl
   end
 
   def replace_file(path, mode = nil)
-    mode ||= begin
-               stat = Puppet::FileSystem.lstat(path)
-               stat.mode & 07777
-             rescue Errno::ENOENT
-               0640
-             end
+    begin
+      stat = Puppet::FileSystem.lstat(path)
+      gid = stat.gid
+      uid = stat.uid
+      mode ||= stat.mode & 07777
+    rescue Errno::ENOENT
+      mode ||= 0640
+    end
 
     tempfile = Puppet::FileSystem::Uniquefile.new(Puppet::FileSystem.basename_string(path), Puppet::FileSystem.dir_string(path))
     begin
@@ -173,8 +175,10 @@ class Puppet::FileSystem::FileImpl
         tempfile.close
       end
 
-      chmod(mode, tempfile.path)
-      File.rename(tempfile.path, Puppet::FileSystem.path_string(path))
+      tempfile_path = tempfile.path
+      FileUtils.chown(uid, gid, tempfile_path) if uid && gid
+      chmod(mode, tempfile_path)
+      File.rename(tempfile_path, Puppet::FileSystem.path_string(path))
     ensure
       tempfile.close!
     end

data/lib/puppet/file_system/memory_file.rb

@@ -23,6 +23,10 @@ class Puppet::FileSystem::MemoryFile
         :children => children)
   end
 
+  def self.a_symlink(target_path, source_path)
+    new(target_path, :exist? => true, :symlink? => true, :source_path => source_path)
+  end
+
   def initialize(path, properties)
     @path = path
     @properties = properties
@@ -34,6 +38,8 @@ class Puppet::FileSystem::MemoryFile
   def directory?; @properties[:directory?]; end
   def exist?; @properties[:exist?]; end
   def executable?; @properties[:executable?]; end
+  def symlink?; @properties[:symlink?]; end
+  def source_path; @properties[:source_path]; end
 
   def each_line(&block)
     handle.each_line(&block)

data/lib/puppet/file_system/memory_impl.rb

@@ -23,6 +23,19 @@ class Puppet::FileSystem::MemoryImpl
     path.executable?
   end
 
+  def symlink?(path)
+    path.symlink?
+  end
+
+  def readlink(path)
+    path = path.path
+    link = find(path)
+    return Puppet::FileSystem::MemoryFile.a_missing_file(path) unless link
+    source = link.source_path
+    return Puppet::FileSystem::MemoryFile.a_missing_file(link) unless source
+    find(source) || Puppet::FileSystem::MemoryFile.a_missing_file(source)
+  end
+
   def children(path)
     path.children
   end

data/lib/puppet/file_system/uniquefile.rb

@@ -176,6 +176,10 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
       lock = tmpname + '.lock'
       mkdir(lock)
       yield
+    rescue Errno::ENOENT => e
+      ex = Errno::ENOENT.new("A directory component in #{lock} does not exist or is a dangling symbolic link")
+      ex.set_backtrace(e.backtrace)
+      raise ex
     ensure
       rmdir(lock) if Puppet::FileSystem.exist?(lock)
     end

data/lib/puppet/file_system/windows.rb

@@ -117,6 +117,7 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
   end
 
   # https://docs.microsoft.com/en-us/windows/desktop/debug/system-error-codes--0-499-
+  FILE_NOT_FOUND = 2
   ACCESS_DENIED = 5
   SHARING_VIOLATION = 32
   LOCK_VIOLATION = 33
@@ -132,12 +133,12 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
              dacl = secure_dacl(current_sid)
              dacl.allow(Puppet::Util::Windows::SID::BuiltinUsers, FILE_READ)
              dacl
-           when 0640, 0600
+           when 0660, 0640, 0600, 0440
              secure_dacl(current_sid)
            when nil
              get_dacl_from_file(path) || secure_dacl(current_sid)
            else
-             raise ArgumentError, "Only modes 0644, 0640 and 0600 are allowed"
+             raise ArgumentError, "#{mode} is invalid: Only modes 0644, 0640, 0660, and 0440 are allowed"
            end
 
 
@@ -180,9 +181,9 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
   def secure_dacl(current_sid)
     dacl = Puppet::Util::Windows::AccessControlList.new
     [
-     Puppet::Util::Windows::SID::LocalSystem,
-     Puppet::Util::Windows::SID::BuiltinAdministrators,
-     current_sid
+      Puppet::Util::Windows::SID::LocalSystem,
+      Puppet::Util::Windows::SID::BuiltinAdministrators,
+      current_sid
     ].uniq.map do |sid|
       dacl.allow(sid, FULL_CONTROL)
     end
@@ -193,11 +194,7 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
     sd = Puppet::Util::Windows::Security.get_security_descriptor(Puppet::FileSystem.path_string(path))
     sd.dacl
   rescue Puppet::Util::Windows::Error => e
-    if e.code == 2 # ERROR_FILE_NOT_FOUND
-      nil
-    else
-      raise e
-    end
+    raise e unless e.code == FILE_NOT_FOUND
   end
 
   def raise_if_symlinks_unsupported

data/lib/puppet/forge.rb

@@ -65,7 +65,7 @@ class Puppet::Forge < SemanticPuppet::Dependency::Source
       # make_http_request URI encodes parameters
       response = make_http_request(uri)
 
-      if response.code == '200'
+      if response.code == 200
         result = Puppet::Util::Json.load(response.body)
         uri = decode_uri(result['pagination']['next'])
         matches.concat result['results']
@@ -102,7 +102,7 @@ class Puppet::Forge < SemanticPuppet::Dependency::Source
       # make_http_request URI encodes parameters
       response = make_http_request(uri)
 
-      if response.code == '200'
+      if response.code == 200
         response = Puppet::Util::Json.load(response.body)
       else
         raise ResponseError.new(:uri => URI.parse(@host).merge(uri), :response => response)
@@ -207,7 +207,7 @@ class Puppet::Forge < SemanticPuppet::Dependency::Source
     def download(uri, destination)
       response = @source.make_http_request(uri, destination)
       destination.flush and destination.close
-      unless response.code == '200'
+      unless response.code == 200
         raise Puppet::Forge::Errors::ResponseError.new(:uri => uri, :response => response)
       end
     end

data/lib/puppet/forge/errors.rb

@@ -74,12 +74,12 @@ module Puppet::Forge::Errors
     # @option options [String] :uri The URI that failed
     # @option options [String] :input The user's input (e.g. module name)
     # @option options [String] :message Error from the API response (optional)
-    # @option options [Net::HTTPResponse] :response The original HTTP response
+    # @option options [Puppet::HTTP::Response] :response The original HTTP response
     def initialize(options)
       @uri     = options[:uri]
       @message = options[:message]
       response = options[:response]
-      @response = "#{response.code} #{response.message.strip}"
+      @response = "#{response.code} #{response.reason.strip}"
 
       begin
         body = Puppet::Util::Json.load(response.body)

data/lib/puppet/forge/repository.rb

@@ -15,24 +15,6 @@ class Puppet::Forge
 
     attr_reader :uri, :cache
 
-    # List of Net::HTTP exceptions to catch
-    NET_HTTP_EXCEPTIONS = [
-      EOFError,
-      Errno::ECONNABORTED,
-      Errno::ECONNREFUSED,
-      Errno::ECONNRESET,
-      Errno::EINVAL,
-      Errno::ETIMEDOUT,
-      Net::HTTPBadResponse,
-      Net::HTTPHeaderSyntaxError,
-      Net::ProtocolError,
-      SocketError,
-    ]
-
-    if Puppet.features.zlib?
-      NET_HTTP_EXCEPTIONS << Zlib::GzipFile::Error
-    end
-
     # Instantiate a new repository instance rooted at the +url+.
     # The library will report +for_agent+ in the User-Agent to the repository.
     def initialize(host, for_agent)
@@ -40,13 +22,41 @@ class Puppet::Forge
       @agent = for_agent
       @cache = Cache.new(self)
       @uri   = URI.parse(host)
+
+      ssl_provider = Puppet::SSL::SSLProvider.new
+      @ssl_context = ssl_provider.create_system_context(cacerts: [])
     end
 
     # Return a Net::HTTPResponse read for this +path+.
     def make_http_request(path, io = nil)
-      request = get_request_object(@uri.path.chomp('/')+path)
-      Puppet.debug "HTTP GET #{@host}#{request.path}"
-      return read_response(request, io)
+      raise ArgumentError, "Path must start with forward slash" unless path.start_with?('/')
+      begin
+        str = @uri.to_s
+        str.chomp!('/')
+        str += Puppet::Util.uri_encode(path)
+        uri = URI(str)
+
+        headers = { "User-Agent" => user_agent }
+        basic_auth = nil
+
+        if forge_authorization
+          headers["Authorization"] = forge_authorization
+        elsif @uri.user && @uri.password
+          basic_auth = {
+            user: @uri.user,
+            password: @uri.password
+          }
+        end
+
+        http = Puppet.runtime[:http]
+        response = http.get(uri, headers: headers, options: {basic_auth: basic_auth, ssl_context: @ssl_context})
+        io.write(response.body) if io.respond_to?(:write)
+        response
+      rescue Puppet::SSL::CertVerifyError => e
+        raise SSLVerifyError.new(:uri => @uri.to_s, :original => e.cause)
+      rescue => e
+        raise CommunicationError.new(:uri => @uri.to_s, :original => e)
+      end
     end
 
     def forge_authorization
@@ -57,71 +67,6 @@ class Puppet::Forge
       end
     end
 
-    # responsible for properly encoding a URI
-    def get_request_object(path)
-      headers = {
-        "User-Agent" => user_agent,
-      }
-
-      if Puppet.features.zlib?
-        headers = headers.merge({
-          "Accept-Encoding" => Puppet::Network::HTTP::Compression::ACCEPT_ENCODING
-        })
-      end
-
-      if forge_authorization
-        headers = headers.merge({"Authorization" => forge_authorization})
-      end
-
-      request = Net::HTTP::Get.new(Puppet::Util.uri_encode(path), headers)
-
-      unless @uri.user.nil? || @uri.password.nil? || forge_authorization
-        request.basic_auth(@uri.user, @uri.password)
-      end
-
-      return request
-    end
-
-    # Return a Net::HTTPResponse read from this HTTPRequest +request+.
-    #
-    # @param request [Net::HTTPRequest] request to make
-    # @return [Net::HTTPResponse] response from request
-    # @raise [Puppet::Forge::Errors::CommunicationError] if there is a network
-    #   related error
-    # @raise [Puppet::Forge::Errors::SSLVerifyError] if there is a problem
-    #  verifying the remote SSL certificate
-    def read_response(request, io = nil)
-      http_object = Puppet::Util::HttpProxy.get_http_object(uri)
-
-      http_object.start do |http|
-        response = http.request(request)
-
-        if Puppet.features.zlib?
-          if response && response.key?("content-encoding")
-            case response["content-encoding"]
-            when "gzip"
-              response.body = Zlib::GzipReader.new(StringIO.new(response.read_body), :encoding => "ASCII-8BIT").read
-              response.delete("content-encoding")
-            when "deflate"
-              response.body = Zlib::Inflate.inflate(response.read_body)
-              response.delete("content-encoding")
-            end
-          end
-        end
-
-        io.write(response.body) if io.respond_to? :write
-        response
-      end
-    rescue *NET_HTTP_EXCEPTIONS => e
-      raise CommunicationError.new(:uri => @uri.to_s, :original => e)
-    rescue OpenSSL::SSL::SSLError => e
-      if e.message =~ /certificate verify failed/
-        raise SSLVerifyError.new(:uri => @uri.to_s, :original => e)
-      else
-        raise e
-      end
-    end
-
     # Return the local file name containing the data downloaded from the
     # repository at +release+ (e.g. "myuser-mymodule").
     def retrieve(release)