puppet 6.21.1 → 6.22.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a276ad05a056a465b7a0a2c8a3c6e8ca1027a12614be90761c61c884237aefc8
-  data.tar.gz: 69bc653c7fcf75a6893083bd7fe216d8628e9f03e5a1ded3567f0f8f94891e8d
+  metadata.gz: a807e1e8a70b658cf3b5a430ef99e3cdea58da2ea4c0854c23c7fcf1ae8bd0c3
+  data.tar.gz: 37fb5485826b52ce246a27c9b2c5c79df4b281743842a33a087692e4b429abdc
 SHA512:
-  metadata.gz: 7e0ff67c06a24ed7a113c00b3fb60da8258940b8bf7642fa37bfd562200b169a928d7d0d8b35c6019f88f5155042c39f2bb3a3647ae8bd32e8472d83fa0139c5
-  data.tar.gz: 335aa790b52bf6c92f866c056f8b3103b583828d3c9face8a375c0488e683dd82bd51e2eaca88ec1c95e21291ce0781a5091e57d6eb92c5f86a2d7800f1a3cbb
+  metadata.gz: bdf22c7e19c448567811224ff61b29928894296ad31b24741083a29bddc0197e60e177576c20e76fd3fb983da968fb19d3d8c225657dc5071e610b406155460c
+  data.tar.gz: d50e5a0ce643431eb1d09ac77f67d1a3cca01f0044b822898cdc23b21d52713958cad91f0f185535f1025437a715797de4c2fdabf8c512c9f4b155fe7ee9b3ee

data/Gemfile

@@ -56,7 +56,7 @@ group(:development, optional: true) do
   gem 'memory_profiler', require: false, platforms: [:mri]
   gem 'pry', require: false, platforms: [:ruby]
   gem "racc", "1.4.9", require: false, platforms: [:ruby]
-  if RUBY_PLATFORM != 'java'
+  if RUBY_PLATFORM != 'java' && RUBY_VERSION.to_f >= 2.5
     gem 'ruby-prof', '>= 0.16.0', require: false
   end
 end

data/Gemfile.lock

@@ -1,7 +1,18 @@
+GIT
+  remote: git://github.com/ciprianbadescu/packaging
+  revision: 5f8d2bda941abfeeb8fb1731c9b1dd4d108f5d33
+  branch: maint/windows-signing
+  specs:
+    packaging (0.99.49.171.g5f8d2bd)
+      artifactory (~> 2)
+      csv (= 3.1.5)
+      rake (>= 12.3)
+      release-metrics
+
 PATH
   remote: .
   specs:
-    puppet (6.21.1)
+    puppet (6.22.1)
       CFPropertyList (~> 2.2)
       concurrent-ruby (~> 1.0)
       deep_merge (~> 1.0)
@@ -29,11 +40,11 @@ GEM
     deep_merge (1.2.1)
     diff-lcs (1.4.4)
     docopt (0.6.1)
-    facter (4.0.51)
+    facter (4.1.1)
       hocon (~> 1.3)
       thor (>= 1.0.1, < 2.0)
     fast_gettext (1.1.2)
-    ffi (1.14.2)
+    ffi (1.15.0)
     gettext (3.2.9)
       locale (>= 2.0.5)
       text (>= 1.3.0)
@@ -42,11 +53,11 @@ GEM
       gettext (>= 3.0.2, < 3.3.0)
       locale
     hashdiff (1.0.1)
-    hiera (3.6.0)
-    hiera-eyaml (3.2.0)
-      highline (~> 1.6.19)
+    hiera (3.7.0)
+    hiera-eyaml (3.2.1)
+      highline
       optimist
-    highline (1.6.21)
+    highline (2.0.3)
     hocon (1.3.1)
     hpricot (0.8.6)
     httpclient (2.8.3)
@@ -60,22 +71,17 @@ GEM
     multi_json (1.15.0)
     mustache (1.1.1)
     optimist (3.0.1)
-    packaging (0.99.75)
-      artifactory (~> 2)
-      csv (= 3.1.5)
-      rake (>= 12.3)
-      release-metrics
     parallel (1.20.1)
     parser (2.7.2.0)
       ast (~> 2.4.1)
     powerpack (0.1.3)
-    pry (0.14.0)
+    pry (0.14.1)
       coderay (~> 1.1)
       method_source (~> 1.0)
     public_suffix (4.0.6)
     puppet-resource_api (1.8.13)
       hocon (>= 1.0)
-    puppetserver-ca (1.9.1)
+    puppetserver-ca (1.9.4)
       facter (>= 2.0.1, < 5)
     racc (1.4.9)
     rainbow (2.2.2)
@@ -86,7 +92,7 @@ GEM
     release-metrics (1.1.0)
       csv
       docopt
-    rexml (3.2.4)
+    rexml (3.2.5)
     ronn (0.7.3)
       hpricot (>= 0.8.2)
       mustache (>= 0.7.0)
@@ -116,14 +122,14 @@ GEM
       unicode-display_width (~> 1.0, >= 1.0.1)
     rubocop-i18n (1.2.0)
       rubocop (~> 0.49.0)
-    ruby-prof (1.4.2)
+    ruby-prof (1.4.3)
     ruby-progressbar (1.11.0)
     semantic_puppet (1.0.3)
     text (1.3.1)
     thor (1.1.0)
     unicode-display_width (1.7.0)
     vcr (5.1.0)
-    webmock (3.11.2)
+    webmock (3.12.2)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
@@ -142,7 +148,7 @@ DEPENDENCIES
   memory_profiler
   minitar (~> 0.9)
   msgpack (~> 1.2)
-  packaging (~> 0.99)
+  packaging!
   pry
   puppet!
   puppet-resource_api (~> 1.5)

data/ext/project_data.yaml

@@ -41,7 +41,7 @@ gem_platform_dependencies:
     gem_runtime_dependencies:
       ffi: ['> 1.9.24', '< 2']
       # win32-xxxx gems are pinned due to PUP-6445
-      win32-dir: '= 0.4.9'
+      win32-dir: ['>= 0.4.9', '<= 0.7.2']
       win32-process: '= 0.7.5'
       # Use of win32-security is deprecated
       win32-security: '= 0.2.5'
@@ -51,7 +51,7 @@ gem_platform_dependencies:
     gem_runtime_dependencies:
       ffi: ['> 1.9.24', '< 2']
       # win32-xxxx gems are pinned due to PUP-6445
-      win32-dir: '= 0.4.9'
+      win32-dir: ['>= 0.4.9', '<= 0.7.2']
       win32-process: '= 0.7.5'
       # Use of win32-security is deprecated
       win32-security: '= 0.2.5'

data/lib/puppet/application/ssl.rb

@@ -74,6 +74,9 @@ ACTIONS
   `--localca` is specified, then also remove this host's local copy of the
   CA certificate(s) and CRL bundle. if `--target CERTNAME` is specified, then
   remove the files for the specified device on this host instead of this host.
+
+ * show:
+  Print the full-text version of this host's certificate.
 HELP
   end
 
@@ -142,11 +145,19 @@ HELP
       end
       @machine.ensure_client_certificate
       Puppet.notice(_("Completed SSL initialization"))
+    when 'show'
+      show(certname)
     else
       raise Puppet::Error, _("Unknown action '%{action}'") % { action: action }
     end
   end
 
+  def show(certname)
+    password = @cert_provider.load_private_key_password
+    ssl_context = @ssl_provider.load_context(certname: certname, password: password)
+    puts ssl_context.client_cert.to_text
+  end
+
   def submit_request(ssl_context)
     key = @cert_provider.load_private_key(Puppet[:certname])
     unless key

data/lib/puppet/defaults.rb

@@ -58,6 +58,18 @@ module Puppet
     end
   end
 
+  def self.default_cadir
+    return "" if Puppet::Util::Platform.windows?
+    old_ca_dir = "#{Puppet[:ssldir]}/ca"
+    new_ca_dir = '/etc/puppetlabs/puppetserver/ca'
+
+    if File.exist?("#{new_ca_dir}/ca_crt.pem")
+      new_ca_dir
+    else
+      old_ca_dir
+    end
+  end
+
   ############################################################################################
   # NOTE: For information about the available values for the ":type" property of settings,
   #   see the docs for Settings.define_settings
@@ -1085,6 +1097,14 @@ EOT
           certificate revocation checking and does not attempt to download the CRL.
         EOT
     },
+    :ciphers => {
+      :default => 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256',
+      :type => :string,
+      :desc => "The list of ciphersuites for TLS connections initiated by puppet. The
+                default value is chosen to support TLS 1.0 and up, but can be made
+                more restrictive if needed. The ciphersuites must be specified in OpenSSL
+                format, not IANA."
+    },
     :key_type => {
       :default => 'rsa',
       :type    => :enum,
@@ -1142,7 +1162,7 @@ EOT
       :desc    => "The name to use the Certificate Authority certificate.",
     },
     :cadir => {
-      :default => "$ssldir/ca",
+      :default => lambda { default_cadir },
       :type => :directory,
       :desc => "The root directory for the certificate authority.",
     },
@@ -1760,7 +1780,7 @@ EOT
     },
     :agent_disabled_lockfile => {
         :default    => "$statedir/agent_disabled.lock",
-        :type       => :file,
+        :type       => :string,
         :desc       => "A lock file to indicate that puppet agent runs have been administratively
           disabled.  File contains a JSON object with state information.",
     },

data/lib/puppet/environments.rb

@@ -225,6 +225,9 @@ module Puppet::Environments
     private
 
     def create_environment(name)
+      # interpolated modulepaths may be cached from prior environment instances
+      Puppet.settings.clear_environment_settings(name)
+
       env_symbol = name.intern
       setting_values = Puppet.settings.values(env_symbol, Puppet.settings.preferred_run_mode)
       env = Puppet::Node::Environment.create(
@@ -350,7 +353,19 @@ module Puppet::Environments
 
     # @!macro loader_list
     def list
-      @loader.list
+      # Evict all that have expired, in the same way as `get`
+      clear_all_expired
+
+      @loader.list.map do |env|
+        name = env.name
+        old_entry = @cache[name]
+        if old_entry
+          old_entry.value
+        else
+          add_entry(name, entry(env))
+          env
+        end
+      end
     end
 
     # @!macro loader_search_paths

data/lib/puppet/face/facts.rb

@@ -2,28 +2,20 @@ require 'puppet/indirector/face'
 require 'puppet/node/facts'
 require 'puppet/util/fact_dif'
 
-EXCLUDE_LIST = %w[facterversion
-  swapfree_mb swapsize_mb
-  load_averages\.*
-  memory\.swap\.available_bytes memory\.swap\.capacity memory\.swap\.total_bytes
-  memory\.swap\.used_bytes memory\.swap\.available
-  memory\.system\.available memory\.system\.available_bytes memory\.system\.capacity memory\.swap\.used
-  memory\.system\.total_bytes memory\.system\.used memory\.system\.used_bytes
-  memoryfree memoryfree_mb memorysize_mb
-  mountpoints\..* mtu_.* mountpoints\..*\.capacity
-  networking\.interfaces\..*\.mtu networking\.mtu partitions\..*\.filesystem
-  partitions\..*\.size_bytes partitions\..*\.mount partitions\..*\.uuid
-  disks\..*\.size_bytes
-  hypervisors\.lpar\.partition_number hypervisors\.xen\.privileged hypervisors\.zone\..* hypervisors\.ldom\..*
-  processors\.speed
-  ldom_.*
-  boardassettag dmi\.board\.asset_tag
-  blockdevice_.*_vendor blockdevice_.*_size
-  system_uptime\.days system_uptime\.hours system_uptime\.seconds system_uptime\.uptime
-  uptime_days uptime_hours uptime_seconds
-  system_profiler\.uptime
-  sp_uptime
-  uptime]
+EXCLUDE_LIST = %w[ ^facterversion$
+  ^load_averages\..*$
+  ^processors\.speed$
+  ^swapfree$ ^swapfree_mb$
+  ^memoryfree$ ^memoryfree_mb$
+  ^memory\.swap\.available_bytes$ ^memory\.swap\.used_bytes$
+  ^memory\.swap\.available$ ^memory\.swap\.capacity$ ^memory\.swap\.used$
+  ^memory\.system\.available_bytes$ ^memory\.system\.used_bytes$
+  ^memory\.system\.available$ ^memory\.system\.capacity$ ^memory\.system\.used$
+  ^mountpoints\..*\.available.*$ ^mountpoints\..*\.capacity$ ^mountpoints\..*\.used.*$
+  ^sp_uptime$ ^system_profiler\.uptime$
+  ^uptime$ ^uptime_days$ ^uptime_hours$ ^uptime_seconds$
+  ^system_uptime\.uptime$ ^system_uptime\.days$ ^system_uptime\.hours$ ^system_uptime\.seconds$
+]
 
 Puppet::Indirector::Face.define(:facts, '0.0.1') do
   copyright "Puppet Inc.", 2011
@@ -125,26 +117,132 @@ Puppet::Indirector::Face.define(:facts, '0.0.1') do
     $ puppet facts diff
     EOT
 
-    render_as :json
+    option("--structured") do
+      default_to { false }
+      summary _("Render the different facts as structured.")
+    end
+
+    option("--exclude " + _("<regex>")) do
+      summary _("Regex used to exclude specific facts from diff.")
+    end
 
     when_invoked do |*args|
+      options = args.pop
+
       Puppet.settings.preferred_run_mode = :agent
       Puppet::Node::Facts.indirection.terminus_class = :facter
 
       if Puppet::Util::Package.versioncmp(Facter.value('facterversion'), '4.0.0') < 0
-        facter3_result = Puppet::Node::Facts.indirection.find(Puppet.settings[:certname])
-        begin
-          require 'facter-ng'
-          facter4_result = Puppet::Node::Facts.indirection.find(Puppet.settings[:certname])
-        rescue LoadError
-          raise ArgumentError, 'facter-ng could not be loaded'
+        cmd_flags = '--render-as json --show-legacy'
+
+        # puppet/ruby are in PATH since it was updated in the wrapper script
+        puppet_show_cmd  = "puppet facts show"
+        if Puppet::Util::Platform.windows?
+          puppet_show_cmd = "ruby -S -- #{puppet_show_cmd}"
         end
-        fact_diff = FactDif.new(facter3_result.to_json, facter4_result.to_json, EXCLUDE_LIST)
+
+        facter_3_result = Puppet::Util::Execution.execute("#{puppet_show_cmd} --no-facterng #{cmd_flags}", combine: false)
+        facter_ng_result = Puppet::Util::Execution.execute("#{puppet_show_cmd} --facterng #{cmd_flags}", combine: false)
+
+        exclude_list = options[:exclude].nil? ? EXCLUDE_LIST : EXCLUDE_LIST + [ options[:exclude] ]
+        fact_diff = FactDif.new(facter_3_result, facter_ng_result, exclude_list, options[:structured])
         fact_diff.difs
       else
         Puppet.warning _("Already using Facter 4. To use `puppet facts diff` remove facterng from the .conf file or run `puppet config set facterng false`.")
         exit 0
       end
     end
+
+    when_rendering :console do |result|
+      case result
+      when Array, Hash
+        Puppet::Util::Json.dump(result, :pretty => true)
+      else
+        result
+      end
+    end
+  end
+
+  action(:show) do
+    summary _("Retrieve current node's facts.")
+    arguments _("[<facts>]")
+    description <<-'EOT'
+    Reads facts from the local system using `facter` terminus.
+    A query can be provided to retrieve just a specific fact or a set of facts.
+    EOT
+    returns "The output of facter with added puppet specific facts."
+    notes <<-'EOT'
+
+    EOT
+    examples <<-'EOT'
+    retrieve facts:
+
+    $ puppet facts show os
+    EOT
+
+    option("--config-file " + _("<path>")) do
+      default_to { nil }
+      summary _("The location of the config file for Facter.")
+    end
+
+    option("--custom-dir " + _("<path>")) do
+      default_to { nil }
+      summary _("The path to a directory that contains custom facts.")
+    end
+
+    option("--external-dir " + _("<path>")) do
+      default_to { nil }
+      summary _("The path to a directory that contains external facts.")
+    end
+
+    option("--no-block") do
+      summary _("Disable fact blocking mechanism.")
+    end
+
+    option("--no-cache") do
+      summary _("Disable fact caching mechanism.")
+    end
+
+    option("--show-legacy") do
+      summary _("Show legacy facts when querying all facts.")
+    end
+
+    option("--value-only") do
+      summary _("Show only the value when the action is called with a single query")
+    end
+
+    when_invoked do |*args|
+      options = args.pop
+
+      Puppet.settings.preferred_run_mode = :agent
+      Puppet::Node::Facts.indirection.terminus_class = :facter
+
+      if options[:value_only] && !args.count.eql?(1)
+        options[:value_only] = nil
+        Puppet.warning("Incorrect use of --value-only argument; it can only be used when querying for a single fact!")
+      end
+
+      options[:user_query] = args
+      options[:resolve_options] = true
+      result = Puppet::Node::Facts.indirection.find(Puppet.settings[:certname], options)
+
+      if options[:value_only]
+        result.values.values.first
+      else
+        result.values
+      end
+    end
+
+    when_rendering :console do |result|
+      # VALID_TYPES = [Integer, Float, TrueClass, FalseClass, NilClass, Symbol, String, Array, Hash].freeze
+      # from https://github.com/puppetlabs/facter/blob/4.0.49/lib/facter/custom_facts/util/normalization.rb#L8
+
+      case result
+      when Array, Hash
+        Puppet::Util::Json.dump(result, :pretty => true)
+      else # one of VALID_TYPES above
+        result
+      end
+    end
   end
 end

data/lib/puppet/file_system/memory_file.rb

@@ -7,6 +7,13 @@ class Puppet::FileSystem::MemoryFile
     new(path, :exist? => false, :executable? => false)
   end
 
+  def self.a_missing_directory(path)
+    new(path,
+        :exist? => false,
+        :executable? => false,
+        :directory? => true)
+  end
+
   def self.a_regular_file_containing(path, content)
     new(path, :exist? => true, :executable? => false, :content => content)
   end
@@ -18,7 +25,7 @@ class Puppet::FileSystem::MemoryFile
   def self.a_directory(path, children = [])
     new(path,
         :exist? => true,
-        :excutable? => true,
+        :executable? => true,
         :directory? => true,
         :children => children)
   end