puppet 6.13.0 → 6.18.0

data/lib/puppet/environments.rb

@@ -247,11 +247,10 @@ module Puppet::Environments
     end
 
     def valid_environment_names
-      if Puppet::FileSystem.directory?(@environment_dir)
-        Puppet::FileSystem.children(@environment_dir).map do |child|
-          Puppet::FileSystem.basename_string(child).intern if validated_directory(child)
-        end.compact
-      end
+      return [] unless Puppet::FileSystem.directory?(@environment_dir)
+      Puppet::FileSystem.children(@environment_dir).map do |child|
+        Puppet::FileSystem.basename_string(child).intern if validated_directory(child)
+      end.compact
     end
   end
 

data/lib/puppet/face/facts.rb

@@ -75,7 +75,7 @@ Puppet::Indirector::Face.define(:facts, '0.0.1') do
         facts.name = Puppet[:node_name_value]
       end
 
-      client = Puppet.runtime['http']
+      client = Puppet.runtime[:http]
       session = client.create_session
       puppet = session.route_to(:puppet)
 

data/lib/puppet/face/help.rb

@@ -24,12 +24,19 @@ Puppet::Face.define(:help, '0.0.1') do
       summary _("The version of the subcommand for which to show help.")
     end
 
+    option "--ronn" do
+      summary _("Whether to render the help text in ronn format.")
+      default_to { false }
+    end
+
     default
     when_invoked do |*args|
       options = args.pop
 
-      if default_case?(args) || help_for_help?(args)
-        return erb('global.erb').result(binding)
+      unless options[:ronn]
+        if default_case?(args) || help_for_help?(args)
+          return erb('global.erb').result(binding)
+        end
       end
 
       if args.length > 2
@@ -54,9 +61,20 @@ Puppet::Face.define(:help, '0.0.1') do
         if actionname
           raise ArgumentError, _("The legacy subcommand '%{sub_command}' does not support supplying an action") % { sub_command: facename }
         end
+        # legacy apps already emit ronn output
         return render_application_help(facename)
       else
-        return render_face_help(facename, actionname, version)
+        if options[:ronn]
+          # Calling `puppet help <app> --ronn` normally calls this action with
+          # <app> as the first argument in the `args` array. However, if <app>
+          # happens to match the name of an action, like `puppet help help
+          # --ronn`, then face_base "eats" the argument and `args` will be
+          # empty. Rather than force users to type `puppet help help help
+          # --ronn`, default the facename to `:help`
+          render_face_man(facename || :help)
+        else
+          render_face_help(facename, actionname, version)
+        end
       end
     end
   end
@@ -69,6 +87,14 @@ Puppet::Face.define(:help, '0.0.1') do
     args.length == 1 && args.first == 'help'
   end
 
+  def render_face_man(facename)
+    # set 'face' as it's used in the erb processing.
+    face = Puppet::Face[facename.to_sym, :current]
+    # avoid unused variable warning
+    _face = face
+    erb('man.erb').result(binding)
+  end
+
   def render_application_help(applicationname)
     return Puppet::Application[applicationname].help
   rescue StandardError, LoadError => detail

data/lib/puppet/face/module/search.rb

@@ -5,6 +5,8 @@ Puppet::Face.define(:module, '1.0.0') do
   action(:search) do
     summary _("Search the Puppet Forge for a module.")
     description <<-EOT
+      This action has been deprecated. Please use the Puppet Forge to search for modules.
+
       Searches a repository for modules whose names, descriptions, or keywords
       match the provided search term.
     EOT
@@ -22,6 +24,7 @@ Puppet::Face.define(:module, '1.0.0') do
     arguments _("<search_term>")
 
     when_invoked do |term, options|
+      Puppet.deprecation_warning(_("This action has been deprecated. Please use the Puppet Forge to search for modules."))
       Puppet::ModuleTool.set_option_defaults options
       Puppet::ModuleTool::Applications::Searcher.new(term, Puppet::Forge.new(options[:module_repository] || Puppet[:module_repository]), options).run
     end
@@ -94,5 +97,7 @@ Puppet::Face.define(:module, '1.0.0') do
         highlight[format % [ name.sub('/', '-'), desc, "@#{author}", [keywords].flatten.join(' ') ]]
       end.join
     end
+
+    deprecate
   end
 end

data/lib/puppet/face/plugin.rb

@@ -41,10 +41,10 @@ Puppet::Face.define(:plugin, '0.0.1') do
     when_invoked do |options|
       remote_environment_for_plugins = Puppet::Node::Environment.remote(Puppet[:environment])
 
-      pool = Puppet::Network::HTTP::Pool.new(Puppet[:http_keepalive_timeout])
+      pool = Puppet.runtime[:http].pool
       Puppet.override(:http_pool => pool) do
         begin
-          handler = Puppet::Configurer::PluginHandler.new()
+          handler = Puppet::Configurer::PluginHandler.new
           handler.download_plugins(remote_environment_for_plugins)
         ensure
           pool.close

data/lib/puppet/feature/base.rb

@@ -63,7 +63,7 @@ Puppet.features.add(:manages_symlinks) do
 
           true
         rescue LoadError
-          Puppet.debug("CreateSymbolicLink is not available")
+          Puppet.debug { "CreateSymbolicLink is not available" }
           false
         end
       end

data/lib/puppet/file_serving/http_metadata.rb

@@ -15,13 +15,25 @@ class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
     # use a default mtime in case there is no usable HTTP header
     @checksums[:mtime] = "{mtime}#{Time.now}"
 
+    # RFC-1864, deprecated in HTTP/1.1 due to partial responses
     checksum = http_response['content-md5']
     if checksum
       # convert base64 digest to hex
-      checksum = checksum.unpack("m0").first.unpack("H*").first
+      checksum = checksum.unpack("m").first.unpack("H*").first
       @checksums[:md5] = "{md5}#{checksum}"
     end
 
+    {
+      md5: 'X-Checksum-Md5',
+      sha1: 'X-Checksum-Sha1',
+      sha256: 'X-Checksum-Sha256'
+    }.each_pair do |checksum_type, header|
+      checksum = http_response[header]
+      if checksum
+        @checksums[checksum_type] = "{#{checksum_type}}#{checksum}"
+      end
+    end
+
     last_modified = http_response['last-modified']
     if last_modified
       mtime = DateTime.httpdate(last_modified).to_time
@@ -39,7 +51,7 @@ class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
   def collect
     # Prefer the checksum_type from the indirector request options
     # but fall back to the alternative otherwise
-    [ @checksum_type, :md5, :sha256, :sha384, :sha512, :sha224, :mtime ].each do |type|
+    [ @checksum_type, :md5, :sha256, :sha1, :mtime ].each do |type|
       @checksum_type = type
       @checksum = @checksums[type]
       break if @checksum

data/lib/puppet/file_serving/metadata.rb

@@ -138,7 +138,10 @@ class Puppet::FileServing::Metadata < Puppet::FileServing::Base
     @source      = data.delete('source')
     @content_uri = data.delete('content_uri')
 
-    super(path, data.map { |k, v| [k.to_sym, v] }.to_h)
+    links = data.fetch('links', nil) || data.fetch(:links, nil)
+    relative_path = data.fetch('relative_path', nil) || data.fetch(:relative_path, nil)
+    source = @source || data.fetch(:source, nil)
+    super(path, links: links, relative_path: relative_path, source: source)
   end
 
   def to_data_hash

data/lib/puppet/file_serving/mount/locales.rb

@@ -17,14 +17,13 @@ class Puppet::FileServing::Mount::Locales < Puppet::FileServing::Mount
   def search(relative_path, request)
     # We currently only support one kind of search on locales - return
     # them all.
-    Puppet.debug("Warning: calling Locales.search with empty module path.") if request.environment.modules.empty?
     paths = request.environment.modules.find_all { |mod| mod.locales? }.collect { |mod| mod.locale_directory }
     if paths.empty?
       # If the modulepath is valid then we still need to return a valid root
       # directory for the search, but make sure nothing inside it is
       # returned.
       request.options[:recurse] = false
-      request.environment.modulepath.empty? ? nil : request.environment.modulepath
+      request.environment.modulepath.empty? ? [Puppet[:codedir]] : request.environment.modulepath
     else
       paths
     end

data/lib/puppet/file_serving/mount/pluginfacts.rb

@@ -17,14 +17,13 @@ class Puppet::FileServing::Mount::PluginFacts < Puppet::FileServing::Mount
   def search(relative_path, request)
     # We currently only support one kind of search on plugins - return
     # them all.
-    Puppet.debug("Warning: calling Plugins.search with empty module path.") if request.environment.modules.empty?
     paths = request.environment.modules.find_all { |mod| mod.pluginfacts? }.collect { |mod| mod.plugin_fact_directory }
     if paths.empty?
       # If the modulepath is valid then we still need to return a valid root
       # directory for the search, but make sure nothing inside it is
       # returned.
       request.options[:recurse] = false
-      request.environment.modulepath.empty? ? nil : request.environment.modulepath
+      request.environment.modulepath.empty? ? [Puppet[:codedir]] : request.environment.modulepath
     else
       paths
     end

data/lib/puppet/file_serving/mount/plugins.rb

@@ -17,14 +17,13 @@ class Puppet::FileServing::Mount::Plugins < Puppet::FileServing::Mount
   def search(relative_path, request)
     # We currently only support one kind of search on plugins - return
     # them all.
-    Puppet.debug("Warning: calling Plugins.search with empty module path.") if request.environment.modules.empty?
     paths = request.environment.modules.find_all { |mod| mod.plugins? }.collect { |mod| mod.plugin_directory }
     if paths.empty?
       # If the modulepath is valid then we still need to return a valid root
       # directory for the search, but make sure nothing inside it is
       # returned.
       request.options[:recurse] = false
-      request.environment.modulepath.empty? ? nil : request.environment.modulepath
+      request.environment.modulepath.empty? ? [Puppet[:codedir]] : request.environment.modulepath
     else
       paths
     end

data/lib/puppet/file_serving/terminus_selector.rb

@@ -7,11 +7,6 @@ module Puppet::FileServing::TerminusSelector
   def select(request)
     # We rely on the request's parsing of the URI.
 
-    # Short-circuit to :file if it's a fully-qualified path or specifies a 'file' protocol.
-    if Puppet::Util.absolute_path?(request.key)
-      return :file
-    end
-
     case request.protocol
     when "file"
       :file
@@ -21,10 +16,14 @@ module Puppet::FileServing::TerminusSelector
       else
         Puppet[:default_file_terminus]
       end
-   when "http","https"
-     :http
+    when "http","https"
+      :http
     when nil
-      :file_server
+      if Puppet::Util.absolute_path?(request.key)
+        :file
+      else
+        :file_server
+      end
     else
       raise ArgumentError, _("URI protocol '%{protocol}' is not currently supported for file serving") % { protocol: request.protocol }
     end

data/lib/puppet/file_system/file_impl.rb

@@ -54,12 +54,12 @@ class Puppet::FileSystem::FileImpl
     while !written
       ::File.open(path, options, mode) do |rf|
         if rf.flock(::File::LOCK_EX|::File::LOCK_NB)
-          Puppet.debug(_("Locked '%{path}'") % { path: path })
+          Puppet.debug{ _("Locked '%{path}'") % { path: path } }
           yield rf
           written = true
-          Puppet.debug(_("Unlocked '%{path}'") % { path: path })
+          Puppet.debug{ _("Unlocked '%{path}'") % { path: path } }
         else
-          Puppet.debug("Failed to lock '%s' retrying in %.2f milliseconds" % [path, wait * 1000])
+          Puppet.debug{ "Failed to lock '%s' retrying in %.2f milliseconds" % [path, wait * 1000] }
           sleep wait
           timeout -= wait
           wait *= 2
@@ -80,7 +80,7 @@ class Puppet::FileSystem::FileImpl
   end
 
   def read(path, opts = {})
-    path.read(opts)
+    path.read(**opts)
   end
 
   def read_preserve_line_endings(path)
@@ -124,7 +124,7 @@ class Puppet::FileSystem::FileImpl
   end
 
   def symlink(path, dest, options = {})
-    FileUtils.symlink(path, dest, options)
+    FileUtils.symlink(path, dest, **options)
   end
 
   def symlink?(path)
@@ -156,12 +156,14 @@ class Puppet::FileSystem::FileImpl
   end
 
   def replace_file(path, mode = nil)
-    mode ||= begin
-               stat = Puppet::FileSystem.lstat(path)
-               stat.mode & 07777
-             rescue Errno::ENOENT
-               0640
-             end
+    begin
+      stat = Puppet::FileSystem.lstat(path)
+      gid = stat.gid
+      uid = stat.uid
+      mode ||= stat.mode & 07777
+    rescue Errno::ENOENT
+      mode ||= 0640
+    end
 
     tempfile = Puppet::FileSystem::Uniquefile.new(Puppet::FileSystem.basename_string(path), Puppet::FileSystem.dir_string(path))
     begin
@@ -173,8 +175,10 @@ class Puppet::FileSystem::FileImpl
         tempfile.close
       end
 
-      chmod(mode, tempfile.path)
-      File.rename(tempfile.path, Puppet::FileSystem.path_string(path))
+      tempfile_path = tempfile.path
+      FileUtils.chown(uid, gid, tempfile_path) if uid && gid
+      chmod(mode, tempfile_path)
+      File.rename(tempfile_path, Puppet::FileSystem.path_string(path))
     ensure
       tempfile.close!
     end

data/lib/puppet/file_system/uniquefile.rb

@@ -124,11 +124,7 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
       opts = []
     end
     tmpdir, = *rest
-    if $SAFE > 0 and tmpdir.tainted?
-      tmpdir = '/tmp'
-    else
-      tmpdir ||= tmpdir()
-    end
+    tmpdir ||= tmpdir()
     n = nil
     begin
       path = File.expand_path(make_tmpname(basename, n), tmpdir)
@@ -154,18 +150,14 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
 
   def tmpdir
     tmp = '.'
-    if $SAFE > 0
-      @@systmpdir
-    else
-      for dir in [ Puppet::Util.get_env('TMPDIR'), Puppet::Util.get_env('TMP'), Puppet::Util.get_env('TEMP'), @@systmpdir, '/tmp']
-        stat = File.stat(dir) if dir
-        if stat && stat.directory? && stat.writable?
-          tmp = dir
-          break
-        end rescue nil
-      end
-      File.expand_path(tmp)
+    for dir in [ Puppet::Util.get_env('TMPDIR'), Puppet::Util.get_env('TMP'), Puppet::Util.get_env('TEMP'), @@systmpdir, '/tmp']
+      stat = File.stat(dir) if dir
+      if stat && stat.directory? && stat.writable?
+        tmp = dir
+        break
+      end rescue nil
     end
+    File.expand_path(tmp)
   end
 
 
@@ -176,6 +168,10 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
       lock = tmpname + '.lock'
       mkdir(lock)
       yield
+    rescue Errno::ENOENT => e
+      ex = Errno::ENOENT.new("A directory component in #{lock} does not exist or is a dangling symbolic link")
+      ex.set_backtrace(e.backtrace)
+      raise ex
     ensure
       rmdir(lock) if Puppet::FileSystem.exist?(lock)
     end

data/lib/puppet/forge.rb

@@ -254,6 +254,6 @@ class Puppet::Forge < SemanticPuppet::Dependency::Source
   def decode_uri(uri)
     return if uri.nil?
 
-    URI.decode(uri.tr('+', ' '))
+    Puppet::Util.uri_unescape(uri.tr('+', ' '))
   end
 end

data/lib/puppet/forge/cache.rb

@@ -25,7 +25,7 @@ class Puppet::Forge
         unless cached_file.file?
           if uri.scheme == 'file'
             # CGI.unescape butchers Uris that are escaped properly
-            FileUtils.cp(URI.unescape(uri.path), cached_file)
+            FileUtils.cp(Puppet::Util.uri_unescape(uri.path), cached_file)
           else
             # TODO: Handle HTTPS; probably should use repository.contact
             data = read_retrieve(uri)

data/lib/puppet/forge/repository.rb

@@ -37,18 +37,15 @@ class Puppet::Forge
         uri = URI(str)
 
         headers = { "User-Agent" => user_agent }
-        user = nil
-        password = nil
 
         if forge_authorization
+          uri.user = nil
+          uri.password = nil
           headers["Authorization"] = forge_authorization
-        elsif @uri.user && @uri.password
-          user = @uri.user
-          password = @uri.password
         end
 
-        http = Puppet.runtime['http']
-        response = http.get(uri, headers: headers, user: user, password: password, ssl_context: @ssl_context)
+        http = Puppet.runtime[:http]
+        response = http.get(uri, headers: headers, options: {ssl_context: @ssl_context})
         io.write(response.body) if io.respond_to?(:write)
         response
       rescue Puppet::SSL::CertVerifyError => e

data/lib/puppet/functions/call.rb

@@ -51,7 +51,7 @@
 #
 # Would notice the value of `$facts['processors']['count']` at the time when the `call` is made.
 #
-# * Deferred values supported since Puppet 5.6.0
+# * Deferred values supported since Puppet 6.0
 #
 # @since 5.0.0
 #

data/lib/puppet/functions/eyaml_lookup_key.rb

@@ -39,7 +39,7 @@ Puppet::Functions.create_function(:eyaml_lookup_key) do
       context.cache(nil, raw_data)
     end
     context.not_found unless raw_data.include?(key)
-    context.cache(key, decrypt_value(raw_data[key], context, options))
+    context.cache(key, decrypt_value(raw_data[key], context, options, key))
   end
 
   def load_data_hash(options, context)
@@ -62,22 +62,22 @@ Puppet::Functions.create_function(:eyaml_lookup_key) do
     end
   end
 
-  def decrypt_value(value, context, options)
+  def decrypt_value(value, context, options, key)
     case value
     when String
-      decrypt(value, context, options)
+      decrypt(value, context, options, key)
     when Hash
       result = {}
-      value.each_pair { |k, v| result[context.interpolate(k)] = decrypt_value(v, context, options) }
+      value.each_pair { |k, v| result[context.interpolate(k)] = decrypt_value(v, context, options, key) }
       result
     when Array
-      value.map { |v| decrypt_value(v, context, options) }
+      value.map { |v| decrypt_value(v, context, options, key) }
     else
       value
     end
   end
 
-  def decrypt(data, context, options)
+  def decrypt(data, context, options, key)
     if encrypted?(data)
       # Options must be set prior to each call to #parse since they end up as static variables in
       # the Options class. They cannot be set once before #decrypt_value is called, since each #decrypt
@@ -85,8 +85,13 @@ Puppet::Functions.create_function(:eyaml_lookup_key) do
       # config.
       #
       Hiera::Backend::Eyaml::Options.set(options)
-      tokens = Hiera::Backend::Eyaml::Parser::ParserFactory.hiera_backend_parser.parse(data)
-      data = tokens.map(&:to_plain_text).join.chomp
+      begin
+        tokens = Hiera::Backend::Eyaml::Parser::ParserFactory.hiera_backend_parser.parse(data)
+        data = tokens.map(&:to_plain_text).join.chomp
+      rescue StandardError => ex
+        raise Puppet::DataBinding::LookupError,
+          _("hiera-eyaml backend error decrypting %{data} when looking up %{key} in %{path}. Error was %{message}") % { data: data, key: key, path: options['path'], message: ex.message }
+      end
     end
     context.interpolate(data)
   end