puppet 6.18.0-x86-mingw32 → 6.21.1-x86-mingw32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3a421a136fd994beaae6beec099968982c0073946e7cc02fc03a760e071e024
-  data.tar.gz: ec0d6af5176799cad98d02d82f93b3fc17bbc71207a1422fa249c85d4f61f65c
+  metadata.gz: 9cdfc9ad60e48b32a438621e76474941e6d32f2f7876b256bfa1993d25913bc8
+  data.tar.gz: 1dba883ce075c934f8ad5effa1d0b50c7948fe66e1134f48dec25c0381b4016e
 SHA512:
-  metadata.gz: 3fd0384b11647ff2a6996e48b843927dc85b22f20ca7accea06acbb75b1b4f455cac0eda1bf4524b6d98696284901bb38ac3e0ce2d62fa7184abfb5193cb7bcd
-  data.tar.gz: 15e9a585b45e2f5525fa96f52b8188a9859002aa885e54b118ce9d80c92d1c1df3bc6bd2dbc63117a8c904eb7fa2ddfa7069c5555d488fab3e74ebb0c60baa5d
+  metadata.gz: 64d8f3c27432f447545212b678c900492b166d5439389fab57ab23f022f11f566fd2543a3119e377f3df862678572831bd13308a96f2337529d91d8e3bdd9b38
+  data.tar.gz: 797fd13dad8decea235e88f2a2ed7139f5eb406634923b53cf68bcf1507912366661500de06cae074f4608eb57e5be538229d416dbd5cab07d20f91e12805c40

data/CODEOWNERS

@@ -1,23 +1,9 @@
-# default to platform-core
-* @puppetlabs/platform-core @puppetlabs/puppetserver-maintainers
-
-# Night's Watch
-/lib/puppet/type/group @puppetlabs/night-s-watch
-/lib/puppet/type/package @puppetlabs/night-s-watch
-/lib/puppet/type/service @puppetlabs/night-s-watch
-/lib/puppet/type/user @puppetlabs/night-s-watch
-/lib/puppet/provider/group @puppetlabs/night-s-watch
-/lib/puppet/provider/package @puppetlabs/night-s-watch
-/lib/puppet/provider/service @puppetlabs/night-s-watch
-/lib/puppet/provider/user @puppetlabs/night-s-watch
+# defaults
+* @puppetlabs/platform-core @puppetlabs/puppetserver-maintainers @puppetlabs/night-s-watch
 
 # PAL
 /lib/puppet/pal @puppetlabs/bolt
 
-# puppet device
-/lib/puppet/application/device.rb @puppetlabs/networking
-/lib/puppet/util/network_device @puppetlabs/networking
-
 # puppet module
 /lib/puppet/application/module.rb @puppetlabs/pdk
 /lib/puppet/face/module @puppetlabs/pdk

data/Gemfile

@@ -38,9 +38,11 @@ group(:features) do
 end
 
 group(:test) do
+  gem "ffi", require: false
   gem "json-schema", "~> 2.0", require: false
   gem "rake", *location_for(ENV['RAKE_LOCATION'] || '~> 12.2')
   gem "rspec", "~> 3.1", require: false
+  gem "rspec-expectations", ["~> 3.9", "!= 3.9.3"]
   gem "rspec-its", "~> 1.1", require: false
   gem 'vcr', '~> 5.0', require: false
   gem 'webmock', '~> 3.0', require: false

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    puppet (6.18.0)
+    puppet (6.21.1)
       CFPropertyList (~> 2.2)
       concurrent-ruby (~> 1.0)
       deep_merge (~> 1.0)
@@ -20,19 +20,20 @@ GEM
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     artifactory (2.8.2)
-    ast (2.4.1)
+    ast (2.4.2)
     coderay (1.1.3)
-    concurrent-ruby (1.1.7)
-    crack (0.4.3)
-      safe_yaml (~> 1.0.0)
+    concurrent-ruby (1.1.8)
+    crack (0.4.5)
+      rexml
     csv (3.1.5)
     deep_merge (1.2.1)
     diff-lcs (1.4.4)
     docopt (0.6.1)
-    facter (4.0.35)
+    facter (4.0.51)
       hocon (~> 1.3)
       thor (>= 1.0.1, < 2.0)
     fast_gettext (1.1.2)
+    ffi (1.14.2)
     gettext (3.2.9)
       locale (>= 2.0.5)
       text (>= 1.3.0)
@@ -52,59 +53,60 @@ GEM
     json-schema (2.8.1)
       addressable (>= 2.4)
     locale (2.1.3)
-    memory_profiler (0.9.14)
+    memory_profiler (1.0.0)
     method_source (1.0.0)
     minitar (0.9)
-    msgpack (1.3.3)
+    msgpack (1.4.2)
     multi_json (1.15.0)
     mustache (1.1.1)
     optimist (3.0.1)
-    packaging (0.99.68)
+    packaging (0.99.75)
       artifactory (~> 2)
       csv (= 3.1.5)
       rake (>= 12.3)
       release-metrics
-    parallel (1.19.2)
-    parser (2.7.1.4)
+    parallel (1.20.1)
+    parser (2.7.2.0)
       ast (~> 2.4.1)
-    powerpack (0.1.2)
-    pry (0.13.1)
+    powerpack (0.1.3)
+    pry (0.14.0)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    public_suffix (4.0.5)
+    public_suffix (4.0.6)
     puppet-resource_api (1.8.13)
       hocon (>= 1.0)
-    puppetserver-ca (1.8.0)
+    puppetserver-ca (1.9.1)
       facter (>= 2.0.1, < 5)
     racc (1.4.9)
     rainbow (2.2.2)
       rake
     rake (12.3.3)
     rdiscount (2.2.0.2)
-    rdoc (6.2.1)
+    rdoc (6.3.0)
     release-metrics (1.1.0)
       csv
       docopt
+    rexml (3.2.4)
     ronn (0.7.3)
       hpricot (>= 0.8.2)
       mustache (>= 0.7.0)
       rdiscount (>= 1.5.8)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.2)
-      rspec-support (~> 3.9.3)
-    rspec-expectations (3.9.2)
+    rspec (3.10.0)
+      rspec-core (~> 3.10.0)
+      rspec-expectations (~> 3.10.0)
+      rspec-mocks (~> 3.10.0)
+    rspec-core (3.10.1)
+      rspec-support (~> 3.10.0)
+    rspec-expectations (3.10.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
+      rspec-support (~> 3.10.0)
     rspec-its (1.3.0)
       rspec-core (>= 3.0.0)
       rspec-expectations (>= 3.0.0)
-    rspec-mocks (3.9.1)
+    rspec-mocks (3.10.2)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.3)
+      rspec-support (~> 3.10.0)
+    rspec-support (3.10.2)
     rubocop (0.49.1)
       parallel (~> 1.10)
       parser (>= 2.3.3.1, < 3.0)
@@ -114,25 +116,25 @@ GEM
       unicode-display_width (~> 1.0, >= 1.0.1)
     rubocop-i18n (1.2.0)
       rubocop (~> 0.49.0)
-    ruby-prof (1.4.1)
-    ruby-progressbar (1.10.1)
-    safe_yaml (1.0.5)
-    semantic_puppet (1.0.2)
+    ruby-prof (1.4.2)
+    ruby-progressbar (1.11.0)
+    semantic_puppet (1.0.3)
     text (1.3.1)
-    thor (1.0.1)
+    thor (1.1.0)
     unicode-display_width (1.7.0)
     vcr (5.1.0)
-    webmock (3.8.3)
+    webmock (3.11.2)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    yard (0.9.25)
+    yard (0.9.26)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   diff-lcs (~> 1.3)
+  ffi
   gettext-setup (~> 0.28)
   hiera-eyaml
   hocon (~> 1.0)
@@ -150,6 +152,7 @@ DEPENDENCIES
   rdoc (~> 6.0)
   ronn (~> 0.7.3)
   rspec (~> 3.1)
+  rspec-expectations (~> 3.9, != 3.9.3)
   rspec-its (~> 1.1)
   rubocop (~> 0.49)
   rubocop-i18n (~> 1.2.0)

data/README.md

@@ -1,7 +1,6 @@
 # Puppet
 
-[![Travis Status](https://travis-ci.com/puppetlabs/puppet.svg?branch=master)](https://travis-ci.com/puppetlabs/puppet)
-[![Appveyor Status](https://ci.appveyor.com/api/projects/status/cvhpypd4504sevqq/branch/master?svg=true)](https://ci.appveyor.com/project/puppetlabs/puppet/branch/master)
+![RSpec tests](https://github.com/puppetlabs/puppet/workflows/RSpec%20tests/badge.svg)
 [![Gem Version](https://badge.fury.io/rb/puppet.svg)](https://badge.fury.io/rb/puppet)
 [![Inline docs](https://inch-ci.org/github/puppetlabs/puppet.svg)](https://inch-ci.org/github/puppetlabs/puppet)
 

data/Rakefile

@@ -61,12 +61,8 @@ end
 desc "verify that commit messages match CONTRIBUTING.md requirements"
 task(:commits) do
   # This rake task looks at the summary from every commit from this branch not
-  # in the branch targeted for a PR. This is accomplished by using the
-  # TRAVIS_COMMIT_RANGE environment variable, which is present in travis CI and
-  # populated with the range of commits the PR contains. If not available, this
-  # falls back to `master..HEAD` as a next best bet as `master` is unlikely to
-  # ever be absent.
-  commit_range = ENV['TRAVIS_COMMIT_RANGE'].nil? ? 'master..HEAD' : ENV['TRAVIS_COMMIT_RANGE'].sub(/\.\.\./, '..')
+  # in the branch targeted for a PR.
+  commit_range = 'HEAD^..HEAD'
   puts "Checking commits #{commit_range}"
   %x{git log --no-merges --pretty=%s #{commit_range}}.each_line do |commit_summary|
     # This regex tests for the currently supported commit summary tokens: maint, doc, packaging, or pup-<number>.
@@ -91,12 +87,8 @@ end
 
 desc "verify that changed files are clean of Ruby warnings"
 task(:warnings) do
-  # This rake task looks at all files modified in this branch. This is
-  # accomplished by using the TRAVIS_COMMIT_RANGE environment variable, which
-  # is present in travis CI and populated with the range of commits the PR
-  # contains. If not available, this falls back to `master..HEAD` as a next
-  # best bet as `master` is unlikely to ever be absent.
-  commit_range = ENV['TRAVIS_COMMIT_RANGE'].nil? ? 'master...HEAD' : ENV['TRAVIS_COMMIT_RANGE']
+  # This rake task looks at all files modified in this branch.
+  commit_range = 'HEAD^..HEAD'
   ruby_files_ok = true
   puts "Checking modified files #{commit_range}"
   %x{git diff --diff-filter=ACM --name-only #{commit_range}}.each_line do |modified_file|

data/lib/puppet/agent/locker.rb

@@ -27,14 +27,7 @@ module Puppet::Agent::Locker
     end
   end
 
-  # @deprecated
   def running?
-    #TRANSLATORS 'Puppet::Agent::Locker.running?' is a method name and should not be translated
-    message = _('Puppet::Agent::Locker.running? is deprecated as it is inherently unsafe.')
-    #TRANSLATORS 'LockError' should not be translated
-    message += ' ' + _('The only safe way to know if the lock is locked is to try lock and perform some '\
-                       'action and then handle the LockError that may result.')
-    Puppet.deprecation_warning(message)
     lockfile.locked?
   end
 

data/lib/puppet/application.rb

@@ -420,12 +420,16 @@ class Application
   def handle_logdest_arg(arg)
     return if arg.nil?
 
-    begin
-      Puppet[:logdest] = arg
-      Puppet::Util::Log.newdestination(arg)
-      options[:setdest] = true
-    rescue => detail
-      Puppet.log_and_raise(detail, _("Could not set logdest to %{dest}.") % { dest: arg })
+    logdest = arg.split(',').map!(&:strip)
+    Puppet[:logdest] = arg
+
+    logdest.each do |dest|
+      begin
+        Puppet::Util::Log.newdestination(dest)
+        options[:setdest] = true
+      rescue => detail
+        Puppet.log_and_raise(detail, _("Could not set logdest to %{dest}.") % { dest: arg })
+      end
     end
   end
 

data/lib/puppet/application/agent.rb

@@ -103,7 +103,7 @@ USAGE
 puppet agent [--certname <NAME>] [-D|--daemonize|--no-daemonize]
   [-d|--debug] [--detailed-exitcodes] [--digest <DIGEST>] [--disable [MESSAGE]] [--enable]
   [--fingerprint] [-h|--help] [-l|--logdest syslog|eventlog|<ABS FILEPATH>|console]
-  [--masterport <PORT>] [--noop] [-o|--onetime] [--sourceaddress <IP_ADDRESS>] [-t|--test]
+  [--serverport <PORT>] [--noop] [-o|--onetime] [--sourceaddress <IP_ADDRESS>] [-t|--test]
   [-v|--verbose] [-V|--version] [-w|--waitforcert <SECONDS>]
 
 
@@ -267,6 +267,7 @@ generated by running puppet agent with '--genconfig'.
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. If debugging or verbosity is enabled, this defaults to 'console'.
   Otherwise, it defaults to 'syslog' on POSIX systems and 'eventlog' on Windows.
+  Multiple destinations can be set using a comma separated list (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the
@@ -277,8 +278,9 @@ generated by running puppet agent with '--genconfig'.
   format.
 
 * --masterport:
-  The port on which to contact the puppet master.
-  (This is a Puppet setting, and can go in puppet.conf.)
+  The port on which to contact the Puppet Server.
+  (This is a Puppet setting, and can go in puppet.conf.
+  Deprecated in favor of the 'serverport' setting.)
 
 * --noop:
   Use 'noop' mode where the daemon runs in a no-op or dry-run mode. This
@@ -294,6 +296,10 @@ generated by running puppet agent with '--genconfig'.
   (This is a Puppet setting, and can go in puppet.conf. Note the special 'no-'
   prefix for boolean settings on the command line.)
 
+* --serverport:
+  The port on which to contact the Puppet Server.
+  (This is a Puppet setting, and can go in puppet.conf.)
+
 * --sourceaddress:
   Set the source IP address for transactions. This defaults to automatically selected.
   (This is a Puppet setting, and can go in puppet.conf.)

data/lib/puppet/application/apply.rb

@@ -113,6 +113,7 @@ configuration options by running puppet with
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. Defaults to 'console'.
+  Multiple destinations can be set using a comma separated list (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the
@@ -236,7 +237,7 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
         end
 
         # Resolve all deferred values and replace them / mutate the catalog
-        Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog)
+        Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog, apply_environment)
 
         # Translate it to a RAL catalog
         catalog = catalog.to_ral
@@ -330,7 +331,7 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
         raise Puppet::Error, _("Could not deserialize catalog from %{format}: %{detail}") % { format: format, detail: detail }, detail.backtrace
       end
       # Resolve all deferred values and replace them / mutate the catalog
-      Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog)
+      Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(node.facts, catalog, configured_environment)
 
       catalog.to_ral
     end

data/lib/puppet/application/device.rb

@@ -155,6 +155,7 @@ you can specify '--server <servername>' as an argument.
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'console', or the path to a log file. If debugging or verbosity is
   enabled, this defaults to 'console'. Otherwise, it defaults to 'syslog'.
+  Multiple destinations can be set using a comma separated list (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the

data/lib/puppet/application/doc.rb

@@ -1,7 +1,7 @@
 require 'puppet/application'
 
 class Puppet::Application::Doc < Puppet::Application
-  run_mode :master
+  run_mode :server
 
   attr_accessor :unknown_args, :manifest
 

data/lib/puppet/application/filebucket.rb

@@ -186,8 +186,8 @@ EXAMPLES
     $ puppet filebucket -b /tmp/TestBucket list
     d41d8cd98f00b204e9800998ecf8427e 2015-05-11 09:33:22 /tmp/TestFile2
 
-    ## From a Puppet master, list files in the master bucketdir
-    $ puppet filebucket -b $(puppet config print bucketdir --section master) list
+    ## From a Puppet Server, list files in the server bucketdir
+    $ puppet filebucket -b $(puppet config print bucketdir --section server) list
     d43a6ecaa892a1962398ac9170ea9bf2 2015-05-11 09:27:56 /tmp/TestFile
     7ae322f5791217e031dc60188f4521ef 2015-05-11 09:52:15 /tmp/TestFile
 

data/lib/puppet/application/lookup.rb

@@ -8,7 +8,7 @@ class Puppet::Application::Lookup < Puppet::Application
   RUN_HELP = _("Run 'puppet lookup --help' for more details").freeze
   DEEP_MERGE_OPTIONS = '--knock-out-prefix, --sort-merged-arrays, and --merge-hash-arrays'.freeze
 
-  run_mode :master
+  run_mode :server
 
   # Options for lookup
   option('--merge TYPE') do |arg|
@@ -92,12 +92,12 @@ class Puppet::Application::Lookup < Puppet::Application
 
     if options[:node]
       Puppet::Util.skip_external_facts do
-        Puppet.settings.use :main, :master, :ssl, :metrics
+        Puppet.settings.use :main, :server, :ssl, :metrics
       end
     else
-      Puppet.settings.use :main, :master, :ssl, :metrics
+      Puppet.settings.use :main, :server, :ssl, :metrics
     end
-    
+
     setup_terminuses
   end
 
@@ -371,7 +371,7 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
     Puppet[:code] = 'undef' unless options[:compile]
     compiler = Puppet::Parser::Compiler.new(node)
     if options[:node]
-      Puppet::Util.skip_external_facts do 
+      Puppet::Util.skip_external_facts do
         compiler.compile { |catalog| yield(compiler.topscope); catalog }
       end
     else

data/lib/puppet/application/script.rb

@@ -71,6 +71,7 @@ configuration options can also be generated by running puppet with
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. Defaults to 'console'.
+  Multiple destinations can be set using a comma separated list (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the

data/lib/puppet/application_support.rb

@@ -53,6 +53,13 @@ module Puppet
       route_file = Puppet[:route_file]
       if Puppet::FileSystem.exist?(route_file)
         routes = Puppet::Util::Yaml.safe_load_file(route_file, [Symbol])
+        if routes["server"] && routes["master"]
+          Puppet.warning("Route file #{route_file} contains both server and master route settings.")
+        elsif routes["server"] && !routes["master"]
+          routes["master"] = routes["server"]
+        elsif routes["master"] && !routes["server"]
+          routes["server"] = routes["master"]
+        end
         application_routes = routes[application_name]
         Puppet::Indirector.configure_routes(application_routes) if application_routes
       end

data/lib/puppet/configurer.rb

@@ -53,6 +53,7 @@ class Puppet::Configurer
   def initialize(transaction_uuid = nil, job_id = nil)
     @running = false
     @splayed = false
+    @running_failure = false
     @cached_catalog_status = 'not_used'
     @environment = Puppet[:environment]
     @transaction_uuid = transaction_uuid || SecureRandom.uuid
@@ -65,9 +66,16 @@ class Puppet::Configurer
   # Get the remote catalog, yo.  Returns nil if no catalog can be found.
   def retrieve_catalog(facts, query_options)
     query_options ||= {}
-    result = retrieve_catalog_from_cache(query_options) if Puppet[:use_cached_catalog]
+    if Puppet[:use_cached_catalog] || @running_failure
+      result = retrieve_catalog_from_cache(query_options)
+    end
+
     if result
-      @cached_catalog_status = 'explicitly_requested'
+      if Puppet[:use_cached_catalog]
+        @cached_catalog_status = 'explicitly_requested'
+      elsif @running_failure
+        @cached_catalog_status = 'on_failure'
+      end
 
       Puppet.info _("Using cached catalog from environment '%{environment}'") % { environment: result.environment }
     else
@@ -104,7 +112,7 @@ class Puppet::Configurer
     catalog_conversion_time = thinmark do
       # Will mutate the result and replace all Deferred values with resolved values
       if facts
-        Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(facts, result)
+        Puppet::Pops::Evaluator::DeferredResolver.resolve_and_replace(facts, result, Puppet.lookup(:current_environment))
       end
 
       catalog = result.to_ral
@@ -216,9 +224,22 @@ class Puppet::Configurer
         if options[:catalog].nil? && do_failover
           server, port = find_functional_server
           if server.nil?
-            raise Puppet::Error, _("Could not select a functional puppet master from server_list: '%{server_list}'") % { server_list: Puppet.settings.value(:server_list, Puppet[:environment].to_sym, true) }
+            detail = _("Could not select a functional puppet server from server_list: '%{server_list}'") % { server_list: Puppet.settings.value(:server_list, Puppet[:environment].to_sym, true) }
+            if Puppet[:usecacheonfailure]
+              options[:pluginsync] = false
+              @running_failure = true
+
+              server = Puppet[:server_list].first[0]
+              port = Puppet[:server_list].first[1] || Puppet[:serverport]
+
+              Puppet.err(detail)
+            else
+              raise Puppet::Error, detail
+            end
           else
-            report.master_used = "#{server}:#{port}"
+            #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+            Puppet.debug _("Selected puppet server from the `server_list` setting: %{server}:%{port}") % { server: server, port: port }
+            report.server_used = "#{server}:#{port}"
           end
           Puppet.override(server: server, serverport: port) do
             completed = run_internal(options)
@@ -376,16 +397,29 @@ class Puppet::Configurer
       if !cached_catalog && options[:catalog]
         ral_catalog = options[:catalog]
       else
+        # Ordering here matters. We have to resolve deferred resources in the
+        # resource catalog, convert the resource catalog to a RAL catalog (which
+        # triggers type/provider validation), and only if that is successful,
+        # should we cache the *original* resource catalog. However, deferred
+        # evaluation mutates the resource catalog, so we need to make a copy of
+        # it here. If PUP-9323 is ever implemented so that we resolve deferred
+        # resources in the RAL catalog as they are needed, then we could eliminate
+        # this step.
+        catalog_to_cache = Puppet.override(:rich_data => Puppet[:rich_data]) do
+          Puppet::Resource::Catalog.from_data_hash(catalog.to_data_hash)
+        end
+
         # REMIND @duration is the time spent loading the last catalog, and doesn't
         # account for things like we failed to download and fell back to the cache
         ral_catalog = convert_catalog(catalog, @duration, facts, options)
 
-        # If not noop, commit the cached resource catalog (not ral catalog). Ideally
+        # Validation succeeded, so commit the `catalog_to_cache` for non-noop runs. Don't
+        # commit `catalog` since it contains the result of deferred evaluation. Ideally
         # we'd just copy the downloaded response body, instead of serializing the
         # in-memory catalog, but that's hard due to the indirector.
         indirection = Puppet::Resource::Catalog.indirection
         if !Puppet[:noop] && indirection.cache?
-          request = indirection.request(:save, nil, catalog, environment: Puppet::Node::Environment.remote(catalog.environment))
+          request = indirection.request(:save, nil, catalog_to_cache, environment: Puppet::Node::Environment.remote(catalog_to_cache.environment))
           Puppet.info("Caching catalog for #{request.key}")
           indirection.cache.save(request)
         end
@@ -538,6 +572,14 @@ class Puppet::Configurer
   end
 
   def download_plugins(remote_environment_for_plugins)
-    @handler.download_plugins(remote_environment_for_plugins)
+    begin
+      @handler.download_plugins(remote_environment_for_plugins)
+    rescue Puppet::Error => detail
+      if !Puppet[:ignore_plugin_errors] && Puppet[:usecacheonfailure]
+        @running_failure = true
+      else
+        raise detail
+      end
+    end
   end
 end