puppet 6.16.0 → 6.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4018f79d6ed7cec0a98a08581c93649f2f6dfcc3e2c3ed935bb355bff419fc3a
-  data.tar.gz: 8d15e2550ba86245ff4f71e81314cf6ebbe675e69ad579cd1d866819ddc31c84
+  metadata.gz: ce222e2720882560d874607f4b7202a5421e58f904caceac7cd481385abee714
+  data.tar.gz: b55fadb67cb0a7427df5bcbaf0a40f2e24fd28332af599f68203806249027db4
 SHA512:
-  metadata.gz: 71691b6a2f761c59192373b34765a49512b3346b76833c5d3f28781e7f5c8f746e90028b2e3afa5ea14180f167951dedc299af9a1fa2ff4afab586a19301dbbd
-  data.tar.gz: 24f8394214605c6a5e90f3fa623b7a7887db060c082131e07b7c4859bcf07b3a4b5909e9340fccbb4348340716a425ae5d3fe8a1c74e620d24785159f0fc1ce9
+  metadata.gz: 300b054c35d6681fd46b0dc5873df43a93d2f3839750a92bcd49b178387c844b858cfa8b7785593632c4c487c59e50137ee07658b3122d949173659695674717
+  data.tar.gz: a17a857745b31fa04083bbf7476d399f9196b23288d83fff831f79aa06df630c282e9ebb85b9419d7930d816b94f3d8474a12628fceb039ca6f7f4e8dc599f10

data/Gemfile

@@ -3,9 +3,9 @@ source ENV['GEM_SOURCE'] || "https://rubygems.org"
 gemspec
 
 def location_for(place, fake_version = nil)
-  if place =~ /^(git[:@][^#]*)#(.*)/
+  if place.is_a?(String) && place =~ /^(git[:@][^#]*)#(.*)/
     [fake_version, { git: $1, branch: $2, require: false }].compact
-  elsif place =~ /^file:\/\/(.*)/
+  elsif place.is_a?(String) && place =~ /^file:\/\/(.*)/
     ['>= 0', { path: File.expand_path($1), require: false }]
   else
     [place, { require: false }]
@@ -19,6 +19,8 @@ gem "hiera", *location_for(ENV['HIERA_LOCATION']) if ENV.has_key?('HIERA_LOCATIO
 gem "semantic_puppet", *location_for(ENV['SEMANTIC_PUPPET_LOCATION'] || ["~> 1.0"])
 gem "puppet-resource_api", *location_for(ENV['RESOURCE_API_LOCATION'] || ["~> 1.5"])
 
+gem "scanf" if RUBY_VERSION.to_f >= 2.7
+
 group(:features) do
   gem 'diff-lcs', '~> 1.3', require: false
   gem 'hiera-eyaml', *location_for(ENV['HIERA_EYAML_LOCATION'])

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    puppet (6.16.0)
+    puppet (6.17.0)
       CFPropertyList (~> 2.2)
       concurrent-ruby (~> 1.0)
       deep_merge (~> 1.0)
@@ -20,16 +20,16 @@ GEM
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     artifactory (2.8.2)
-    ast (2.4.0)
-    coderay (1.1.2)
+    ast (2.4.1)
+    coderay (1.1.3)
     concurrent-ruby (1.1.6)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
     csv (3.1.5)
     deep_merge (1.2.1)
-    diff-lcs (1.3)
+    diff-lcs (1.4.4)
     docopt (0.6.1)
-    facter (4.0.25)
+    facter (4.0.29)
       hocon (~> 1.3)
       thor (>= 1.0.1, < 2.0)
     fast_gettext (1.1.2)
@@ -56,16 +56,16 @@ GEM
     method_source (1.0.0)
     minitar (0.9)
     msgpack (1.3.3)
-    multi_json (1.14.1)
+    multi_json (1.15.0)
     mustache (1.1.1)
     optimist (3.0.1)
-    packaging (0.99.61)
+    packaging (0.99.66)
       artifactory (~> 2)
       rake (>= 12.3)
       release-metrics
-    parallel (1.19.1)
-    parser (2.7.1.3)
-      ast (~> 2.4.0)
+    parallel (1.19.2)
+    parser (2.7.1.4)
+      ast (~> 2.4.1)
     powerpack (0.1.2)
     pry (0.13.1)
       coderay (~> 1.1)

data/README.md

@@ -25,10 +25,10 @@ which also includes orchestration features, a web console, and professional supp
 The PE documentation is [available here.](https://puppet.com/docs/pe/latest)
 
 To install an open source release of Puppet,
-[see the installation guide on the docs site.](https://puppet.com/docs/puppet/5.5/install_pre.html)
+[see the installation guide on the docs site.](https://puppet.com/docs/puppet/latest/installing_and_upgrading.html)
 
 If you need to run Puppet from source as a tester or developer,
-see the [Running Puppet from Source](https://docs.puppet.com/puppet/3.8/from_source.html) guide on the docs site.
+see the [Quick Start to Developing on Puppet](docs/quickstart.md) guide.
 
 ## Developing and Contributing
 

data/lib/puppet/agent.rb

@@ -64,10 +64,10 @@ class Puppet::Agent
             now = Time.now.to_i
             wait_for_lock_deadline ||= now + Puppet[:maxwaitforlock]
 
-            if Puppet[:waitforlock]  < 1
+            if Puppet[:waitforlock] < 1
               Puppet.notice _("Run of %{client_class} already in progress; skipping  (%{lockfile_path} exists)") % { client_class: client_class, lockfile_path: lockfile_path }
               nil
-            elsif now > wait_for_lock_deadline
+            elsif now >= wait_for_lock_deadline
               Puppet.notice _("Exiting now because the maxwaitforlock timeout has been exceeded.")
               nil
             else

data/lib/puppet/application/agent.rb

@@ -258,7 +258,9 @@ generated by running puppet agent with '--genconfig'.
 
 * --job-id:
   Attach the specified job id to the catalog request and the report used for
-  this agent run. This option only works when '--onetime' is used.
+  this agent run. This option only works when '--onetime' is used.  When using
+  Puppet Enterprise this flag should not be used as the orchestrator sets the
+  job-id for you and it must be unique.
 
 * --logdest:
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
@@ -363,8 +365,17 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       daemon.set_signal_traps
 
       log_config if Puppet[:daemonize]
-      
-      Puppet.override(ssl_context: wait_for_certificates) do
+
+      # run ssl state machine, waiting if needed
+      ssl_context = wait_for_certificates
+
+      # Each application is responsible for pushing loaders onto the context.
+      # Use the current environment that has already been established, though
+      # it may change later during the configurer run.
+      env = Puppet.lookup(:current_environment)
+      Puppet.override(ssl_context: ssl_context,
+                      current_environment: env,
+                      loaders: Puppet::Pops::Loaders.new(env, true)) do
         if Puppet[:onetime]
           onetime(daemon)
         else

data/lib/puppet/configurer.rb

@@ -303,6 +303,15 @@ class Puppet::Configurer
               report.environment = @environment
               query_options = nil
               facts = nil
+
+              new_env = Puppet::Node::Environment.remote(@environment)
+              Puppet.push_context(
+                {
+                  current_environment: new_env,
+                  loaders: Puppet::Pops::Loaders.new(new_env, true)
+                },
+                "Local node environment #{@environment} for configurer transaction"
+              )
             else
               Puppet.info _("Using configured environment '%{env}'") % { env: @environment }
             end
@@ -313,19 +322,18 @@ class Puppet::Configurer
         end
       end
 
-      current_environment = Puppet.lookup(:current_environment)
-      if current_environment.name == @environment.intern
-        local_node_environment = current_environment
-      else
-        local_node_environment = Puppet::Node::Environment.create(@environment,
-                                         current_environment.modulepath,
-                                         current_environment.manifest,
-                                         current_environment.config_version)
+      # This is to maintain compatibility with anyone using this class
+      # aside from agent, apply, device.
+      unless Puppet.lookup(:loaders) { nil }
+        new_env = Puppet::Node::Environment.remote(@environment)
+        Puppet.push_context(
+          {
+            current_environment: new_env,
+            loaders: Puppet::Pops::Loaders.new(new_env, true)
+          },
+          "Local node environment #{@environment} for configurer transaction"
+        )
       end
-      Puppet.push_context({
-        :current_environment => local_node_environment, 
-        :loaders => Puppet::Pops::Loaders.new(local_node_environment, true)
-      }, "Local node environment for configurer transaction")
 
       query_options, facts = get_facts(options) unless query_options
       query_options[:configured_environment] = configured_environment

data/lib/puppet/confine.rb

@@ -26,7 +26,7 @@ class Puppet::Confine
         require "puppet/confine/#{name}"
       rescue LoadError => detail
         unless detail.to_s =~ /No such file|cannot load such file/i
-          warn "Could not load confine test '#{name}': #{detail}"
+          Puppet.warning("Could not load confine test '#{name}': #{detail}")
         end
         # Could not find file
         if !Puppet[:always_retry_plugins]

data/lib/puppet/defaults.rb

@@ -347,8 +347,7 @@ module Puppet
       :default => "ansi",
       :type    => :string,
       :desc    => "Whether to use colors when logging to the console.  Valid values are
-        `ansi` (equivalent to `true`), `html`, and `false`, which produces no color.
-        Defaults to false on Windows, as its console does not support ansi colors.",
+        `ansi` (equivalent to `true`), `html`, and `false`, which produces no color."
     },
     :mkusers => {
         :default  => false,
@@ -590,13 +589,22 @@ module Puppet
     },
     :trusted_external_command => {
       :default  => nil,
-      :desc     => "The external trusted facts script to use.
+      :type     => :file_or_directory,
+      :desc     => "The external trusted facts script or directory to use.
         This setting's value can be set to the path to an executable command that
-        can produce external trusted facts. The command must:
+        can produce external trusted facts or to a directory containing those
+        executable commands. The command(s) must:
 
         * Take the name of a node as a command-line argument.
         * Return a JSON hash with the external trusted facts for this node.
-        * For unknown or invalid nodes, exit with a non-zero exit code.",
+        * For unknown or invalid nodes, exit with a non-zero exit code.
+
+        If the setting points to an executable command, then the external trusted
+        facts will be stored in the 'external' key of the trusted facts hash. Otherwise
+        for each executable file in the directory, the external trusted facts will be
+        stored in the `<basename>` key of the `trusted['external']` hash. For example,
+        if the files foo.rb and bar.sh are in the directory, then `trusted['external']`
+        will be the hash `{ 'foo' => <foo.rb output>, 'bar' => <bar.sh output> }`.",
     },
     :default_file_terminus => {
       :type       => :terminus,
@@ -992,6 +1000,15 @@ EOT
         and reject the CA certificate if the values do not match. This only applies
         during the first download of the CA certificate."
     },
+    :ssl_trust_store => {
+      :default => nil,
+      :type => :file,
+      :desc => "A file containing CA certificates in PEM format that puppet should trust
+        when making HTTPS requests. This **only** applies to https requests to non-puppet
+        infrastructure, such as retrieving file metadata and content from https file sources,
+        puppet module tool and the 'http' report processor. This setting is ignored when
+        making requests to puppet:// URLs such as catalog and report requests.",
+    },
     :ssl_client_ca_auth => {
       :type  => :file,
       :mode  => "0644",
@@ -1536,7 +1553,7 @@ EOT
     :statefile => {
       :default => "$statedir/state.yaml",
       :type => :file,
-      :mode => "0660",
+      :mode => "0640",
       :desc => "Where puppet agent and puppet master store state associated
         with the running configuration.  In the case of puppet master,
         this file reflects the state discovered through interacting
@@ -1558,7 +1575,7 @@ EOT
     :transactionstorefile => {
       :default => "$statedir/transactionstore.yaml",
       :type => :file,
-      :mode => "0660",
+      :mode => "0640",
       :desc => "Transactional storage file for persisting data between
         transactions for the purposes of infering information (such as
         corrective_change) on new data received."
@@ -1890,7 +1907,7 @@ EOT
       already ongoing puppet agent instance.
 
       This argument is by default disabled (value set to 0). In this case puppet agent will
-      immediatly exit if it cannot run at that moment. When a value other than 0 is set, this
+      immediately exit if it cannot run at that moment. When a value other than 0 is set, this
       can also be used in combination with the `maxwaitforlock` argument.
       #{AS_DURATION}",
     },

data/lib/puppet/file_serving/http_metadata.rb

@@ -15,6 +15,7 @@ class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
     # use a default mtime in case there is no usable HTTP header
     @checksums[:mtime] = "{mtime}#{Time.now}"
 
+    # RFC-1864, deprecated in HTTP/1.1 due to partial responses
     checksum = http_response['content-md5']
     if checksum
       # convert base64 digest to hex
@@ -22,6 +23,17 @@ class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
       @checksums[:md5] = "{md5}#{checksum}"
     end
 
+    {
+      md5: 'X-Checksum-Md5',
+      sha1: 'X-Checksum-Sha1',
+      sha256: 'X-Checksum-Sha256'
+    }.each_pair do |checksum_type, header|
+      checksum = http_response[header]
+      if checksum
+        @checksums[checksum_type] = "{#{checksum_type}}#{checksum}"
+      end
+    end
+
     last_modified = http_response['last-modified']
     if last_modified
       mtime = DateTime.httpdate(last_modified).to_time
@@ -39,7 +51,7 @@ class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
   def collect
     # Prefer the checksum_type from the indirector request options
     # but fall back to the alternative otherwise
-    [ @checksum_type, :md5, :sha256, :sha384, :sha512, :sha224, :mtime ].each do |type|
+    [ @checksum_type, :md5, :sha256, :sha1, :mtime ].each do |type|
       @checksum_type = type
       @checksum = @checksums[type]
       break if @checksum

data/lib/puppet/file_serving/metadata.rb

@@ -138,7 +138,10 @@ class Puppet::FileServing::Metadata < Puppet::FileServing::Base
     @source      = data.delete('source')
     @content_uri = data.delete('content_uri')
 
-    super(path, data.map { |k, v| [k.to_sym, v] }.to_h)
+    links = data.fetch('links', nil) || data.fetch(:links, nil)
+    relative_path = data.fetch('relative_path', nil) || data.fetch(:relative_path, nil)
+    source = @source || data.fetch(:source, nil)
+    super(path, links: links, relative_path: relative_path, source: source)
   end
 
   def to_data_hash

data/lib/puppet/file_serving/terminus_selector.rb

@@ -7,11 +7,6 @@ module Puppet::FileServing::TerminusSelector
   def select(request)
     # We rely on the request's parsing of the URI.
 
-    # Short-circuit to :file if it's a fully-qualified path or specifies a 'file' protocol.
-    if Puppet::Util.absolute_path?(request.key)
-      return :file
-    end
-
     case request.protocol
     when "file"
       :file
@@ -21,10 +16,14 @@ module Puppet::FileServing::TerminusSelector
       else
         Puppet[:default_file_terminus]
       end
-   when "http","https"
-     :http
+    when "http","https"
+      :http
     when nil
-      :file_server
+      if Puppet::Util.absolute_path?(request.key)
+        :file
+      else
+        :file_server
+      end
     else
       raise ArgumentError, _("URI protocol '%{protocol}' is not currently supported for file serving") % { protocol: request.protocol }
     end

data/lib/puppet/file_system/file_impl.rb

@@ -124,7 +124,7 @@ class Puppet::FileSystem::FileImpl
   end
 
   def symlink(path, dest, options = {})
-    FileUtils.symlink(path, dest, options)
+    FileUtils.symlink(path, dest, **options)
   end
 
   def symlink?(path)

data/lib/puppet/file_system/uniquefile.rb

@@ -124,11 +124,7 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
       opts = []
     end
     tmpdir, = *rest
-    if $SAFE > 0 and tmpdir.tainted?
-      tmpdir = '/tmp'
-    else
-      tmpdir ||= tmpdir()
-    end
+    tmpdir ||= tmpdir()
     n = nil
     begin
       path = File.expand_path(make_tmpname(basename, n), tmpdir)
@@ -154,18 +150,14 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
 
   def tmpdir
     tmp = '.'
-    if $SAFE > 0
-      @@systmpdir
-    else
-      for dir in [ Puppet::Util.get_env('TMPDIR'), Puppet::Util.get_env('TMP'), Puppet::Util.get_env('TEMP'), @@systmpdir, '/tmp']
-        stat = File.stat(dir) if dir
-        if stat && stat.directory? && stat.writable?
-          tmp = dir
-          break
-        end rescue nil
-      end
-      File.expand_path(tmp)
+    for dir in [ Puppet::Util.get_env('TMPDIR'), Puppet::Util.get_env('TMP'), Puppet::Util.get_env('TEMP'), @@systmpdir, '/tmp']
+      stat = File.stat(dir) if dir
+      if stat && stat.directory? && stat.writable?
+        tmp = dir
+        break
+      end rescue nil
     end
+    File.expand_path(tmp)
   end
 
 

data/lib/puppet/forge.rb

@@ -254,6 +254,6 @@ class Puppet::Forge < SemanticPuppet::Dependency::Source
   def decode_uri(uri)
     return if uri.nil?
 
-    URI.decode(uri.tr('+', ' '))
+    Puppet::Util.uri_unescape(uri.tr('+', ' '))
   end
 end

data/lib/puppet/forge/cache.rb

@@ -25,7 +25,7 @@ class Puppet::Forge
         unless cached_file.file?
           if uri.scheme == 'file'
             # CGI.unescape butchers Uris that are escaped properly
-            FileUtils.cp(URI.unescape(uri.path), cached_file)
+            FileUtils.cp(Puppet::Util.uri_unescape(uri.path), cached_file)
           else
             # TODO: Handle HTTPS; probably should use repository.contact
             data = read_retrieve(uri)

data/lib/puppet/forge/repository.rb

@@ -37,19 +37,15 @@ class Puppet::Forge
         uri = URI(str)
 
         headers = { "User-Agent" => user_agent }
-        basic_auth = nil
 
         if forge_authorization
+          uri.user = nil
+          uri.password = nil
           headers["Authorization"] = forge_authorization
-        elsif @uri.user && @uri.password
-          basic_auth = {
-            user: @uri.user,
-            password: @uri.password
-          }
         end
 
         http = Puppet.runtime[:http]
-        response = http.get(uri, headers: headers, options: {basic_auth: basic_auth, ssl_context: @ssl_context})
+        response = http.get(uri, headers: headers, options: {ssl_context: @ssl_context})
         io.write(response.body) if io.respond_to?(:write)
         response
       rescue Puppet::SSL::CertVerifyError => e

data/lib/puppet/http/client.rb

@@ -290,6 +290,11 @@ class Puppet::HTTP::Client
     redirector = Puppet::HTTP::Redirector.new(options.fetch(:redirect_limit, @default_redirect_limit))
 
     basic_auth = options.fetch(:basic_auth, nil)
+    unless basic_auth
+      if request.uri.user && request.uri.password
+        basic_auth = { user: request.uri.user, password: request.uri.password }
+      end
+    end
 
     redirects = 0
     retries = 0