puppet 6.25.1 → 7.0.0

data/ext/debian/puppet-el.emacsen-install

@@ -0,0 +1,25 @@
+#!/bin/sh
+#
+# emacsen install script for the Debian GNU/Linux puppet-el package
+
+FLAVOR=$1
+PACKAGE=puppet-el
+
+ELDIR=/usr/share/emacs/site-lisp/
+ELCDIR=/usr/share/${FLAVOR}/site-lisp/${PACKAGE}
+ELFILE="puppet-mode.el"
+FLAGS="-batch -no-site-file -l path.el -f batch-byte-compile"
+
+if [ ${FLAVOR} != emacs ]; then
+  echo install/${PACKAGE}: Byte-compiling for ${FLAVOR}
+
+  install -m 755 -d ${ELCDIR}
+  cd ${ELDIR}
+  cp ${ELFILE} ${ELCDIR}
+  cd ${ELCDIR}
+  cat << EOF > path.el
+(setq load-path (cons "." load-path) byte-compile-warnings nil)
+EOF
+  ${FLAVOR} ${FLAGS} ${ELFILE}
+  rm -f ${ELFILE} path.el
+fi

data/ext/debian/puppet-el.emacsen-remove

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+FLAVOR=$1
+PACKAGE=puppet-el
+ELCFILE=puppet-mode.elc
+
+if [ ${FLAVOR} != emacs ]; then
+  echo remove/${PACKAGE}: Purging byte-compiled files for ${FLAVOR}
+  rm -f /usr/share/${FLAVOR}/site-lisp/${ELCFILE}
+fi

data/ext/debian/puppet-el.emacsen-startup

@@ -0,0 +1,9 @@
+;; -*-emacs-lisp-*-
+;;
+;; Emacs startup file for the Debian GNU/Linux puppet-el package
+
+(autoload 'puppet-mode "puppet-mode" "Major mode for editing puppet manifests")
+
+(add-to-list 'auto-mode-alist '("\\.pp$" . puppet-mode))
+
+

data/ext/debian/puppet-el.install

@@ -0,0 +1 @@
+ext/emacs/puppet-mode.el usr/share/emacs/site-lisp

data/ext/debian/puppet-testsuite.install

@@ -0,0 +1,2 @@
+spec/* /usr/share/puppet-testsuite/spec
+Rakefile /usr/share/puppet-testsuite/

data/ext/debian/puppet-testsuite.lintian-overrides

@@ -0,0 +1,4 @@
+# Upstream distributes it like this
+puppet-testsuite binary: executable-not-elf-or-script
+puppet-testsuite binary: script-not-executable
+puppet-testsuite binary: unusual-interpreter

data/ext/debian/puppet.lintian-overrides

@@ -0,0 +1,3 @@
+# Man pages are automatically generated, not much to do here
+puppet binary: manpage-has-bad-whatis-entry
+puppet binary: manpage-has-errors-from-man

data/ext/debian/puppet.logrotate

@@ -0,0 +1,20 @@
+/var/log/puppetlabs/masterhttp.log /var/log/puppet/masterhttp.log {
+  compress
+  rotate 4
+  missingok
+  notifempty
+  nocreate
+}
+
+/var/log/puppetlabs/puppetd.log /var/log/puppet/puppetd.log {
+  compress
+  rotate 4
+  missingok
+  notifempty
+  nocreate
+  sharedscripts
+  postrotate
+   ([ -x /etc/init.d/puppet ] && /etc/init.d/puppet reload > /dev/null 2>&1) ||
+    ([ -x /usr/bin/systemctl ] && /usr/bin/systemctl kill -s USR2 puppet.service > /dev/null 2>&1) || true
+  endscript
+}

data/ext/debian/puppet.postinst

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -e
+
+# Remove renamed configuration files which are now handled by other
+# packages
+if dpkg-maintscript-helper supports rm_conffile 2>/dev/null; then
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/logrotate.d/puppet 2.6.4-2 puppet -- "$@"
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/logcheck/ignore.d.server/puppet 2.6.4-2 puppet -- "$@"
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/emacs/site-start.d/50puppet-mode-init.el 2.6.4-2 puppet -- "$@"
+
+fi
+
+#DEBHELPER#

data/ext/debian/puppet.postrm

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -e
+
+# Remove renamed configuration files which are now handled by other
+# packages
+if dpkg-maintscript-helper supports rm_conffile 2>/dev/null; then
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/logrotate.d/puppet 2.6.4-2 puppet -- "$@"
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/logcheck/ignore.d.server/puppet 2.6.4-2 puppet -- "$@"
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/emacs/site-start.d/50puppet-mode-init.el 2.6.4-2 puppet -- "$@"
+
+fi
+
+#DEBHELPER#

data/ext/debian/puppet.preinst

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -e
+
+# Remove renamed configuration files which are now handled by other
+# packages
+if dpkg-maintscript-helper supports rm_conffile 2>/dev/null; then
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/logrotate.d/puppet 2.6.4-2 puppet -- "$@"
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/logcheck/ignore.d.server/puppet 2.6.4-2 puppet -- "$@"
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/emacs/site-start.d/50puppet-mode-init.el 2.6.4-2 puppet -- "$@"
+
+fi
+
+#DEBHELPER#

data/ext/debian/puppetmaster-common.install

@@ -0,0 +1,2 @@
+debian/fileserver.conf etc/puppet
+conf/auth.conf etc/puppet

data/ext/debian/puppetmaster-common.manpages

@@ -0,0 +1,2 @@
+man/man8/puppet-ca.8
+man/man8/puppet-master.8

data/ext/debian/puppetmaster-common.postinst

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -e
+
+rm -f /etc/init.d/puppetqd
+rm -f /etc/default/puppetqd

data/ext/debian/puppetmaster-passenger.dirs

@@ -0,0 +1,4 @@
+usr/share/puppet/rack/puppetmasterd
+usr/share/puppet/rack/puppetmasterd/public
+usr/share/puppet/rack/puppetmasterd/tmp
+usr/share/puppetmaster-passenger/

data/ext/debian/puppetmaster-passenger.postinst

@@ -0,0 +1,162 @@
+#!/bin/sh
+
+set -e
+
+sitename="puppetmaster"
+apache2_version="$(dpkg-query --showformat='${Version}\n' --show apache2)"
+
+# The debian provided a2* utils in Apache 2.4 uses "site name" as
+# argument, while the version in Apache 2.2 uses "file name".
+#
+# For added fun, the Apache 2.4 version requires files to have a
+# ".conf" suffix, but this must be stripped when using it as argument
+# for the a2* utilities.
+#
+# This will end in tears…
+# Can be removed when we only support apache >= 2.4
+apache2_puppetmaster_sitename() {
+    if dpkg --compare-versions "$apache2_version" gt "2.4~"; then
+        echo "${sitename}.conf"
+    else
+        echo "${sitename}"
+    fi
+}
+
+# Can be removed when we only support apache >= 2.4
+restart_apache2() {
+    if [ -x "/etc/init.d/apache2" ]; then
+        # Seems that a restart is needed. reload breaks ssl apparently.
+        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+            invoke-rc.d apache2 restart || exit $?
+        else
+            /etc/init.d/apache2 restart || exit $?
+        fi
+    fi
+}
+
+# We may need to update the passenger directives in the apache vhost because
+# RailsAutoDetect and RackAutoDetect were removed in passenger 4.0.0
+#       see http://www.modrails.com/documentation/Users%20guide%20Apache.html#_railsautodetect_rackautodetect_and_wsgiautodetect
+update_vhost_for_passenger4() {
+    # Get passenger version from dpkg.
+    # This will end in tears…
+    passenger_version="$(dpkg-query --showformat='${Version}\n' --show libapache2-mod-passenger)"
+    if dpkg --compare-versions "$passenger_version" gt "4.0~"; then
+        sed -r -i \
+            -e "/RailsAutoDetect/d" \
+            -e "/RackAutoDetect/d" \
+            $tempfile
+    fi
+}
+
+# In Apache 2.2, if either the SSLCARevocationFile or SSLCARevocationPath
+# directives were specified then the specified file(s) would be checked when
+# establishing an SSL connection. Apache 2.4+ the SSLCARevocationCheck directive
+# was added to control how CRLs were checked when verifying a connection and had
+# a default value of none.  This means that Apache defaults to ignoring CRLs even
+# if paths are specified to CRL files.
+#
+# This function automatically uncomments the SSLCARevocationCheck directive when
+# the currently installed version of Apache is 2.4.
+update_vhost_for_apache24() {
+    if dpkg --compare-versions "$apache2_version" gt "2.4~"; then
+        sed -r -i \
+            -e "/# SSLCARevocationCheck/s/# //" \
+        $tempfile
+    fi
+}
+
+# Update an existing vhost definition with the SSLCARevocationCheck directive
+# on Apache 2.4+. This scans an existing vhost file for the SSLCARevocationCheck
+# directive and adds it to the file after the SSLCARevocationFile directive.
+#
+# See https://tickets.puppetlabs.com/browse/PUP-2533 for more information.
+update_vhost_for_apache24_upgrade() {
+    APACHE2_SITE_FILE="/etc/apache2/sites-available/$(apache2_puppetmaster_sitename)"
+
+    if dpkg --compare-versions "$apache2_version" gt "2.4~"; then
+        if ! grep -q "^[[:space:]]*SSLCARevocationCheck" $APACHE2_SITE_FILE ; then
+            tempfile=$(mktemp)
+            sed -r \
+                -e "/SSLCARevocationFile/a\\        SSLCARevocationCheck chain" \
+                $APACHE2_SITE_FILE > $tempfile
+            mv $tempfile $APACHE2_SITE_FILE
+        fi
+    fi
+}
+
+
+create_initial_puppetmaster_vhost() {
+    # Check that puppet master --configprint works properly
+    # If it doesn't the following steps to update the vhost will produce a very unhelpful and broken vhost
+    if [ $(puppet master --configprint all 2>&1 | grep "Could not parse" | wc -l) != "0" ]; then
+        echo "Puppet config print not working properly, exiting"
+        exit 1
+    fi
+
+    # Initialize puppetmaster CA and generate the master certificate
+    # only if the host doesn't already have any puppet ssl certificate.
+    # The ssl key and cert need to be available (eg generated) before
+    # apache2 is configured and started since apache2 ssl configuration
+    # uses the puppetmaster ssl files.
+    if [ ! -e "$(puppet master --configprint hostcert)" ]; then
+        puppet cert generate $(puppet master --configprint certname)
+    fi
+
+    # Setup apache2 configuration files
+    APACHE2_SITE_FILE="/etc/apache2/sites-available/$(apache2_puppetmaster_sitename)"
+    if  [ ! -e "${APACHE2_SITE_FILE}" ]; then
+        tempfile=$(mktemp)
+        sed -r \
+            -e "s|(SSLCertificateFile\s+).+$|\1$(puppet master --configprint hostcert)|" \
+            -e "s|(SSLCertificateKeyFile\s+).+$|\1$(puppet master --configprint hostprivkey)|" \
+            -e "s|(SSLCACertificateFile\s+).+$|\1$(puppet master --configprint localcacert)|" \
+            -e "s|(SSLCertificateChainFile\s+).+$|\1$(puppet master --configprint localcacert)|" \
+            -e "s|(SSLCARevocationFile\s+).+$|\1$(puppet master --configprint cacrl)|" \
+            -e "s|DocumentRoot /etc/puppet/rack/public|DocumentRoot /usr/share/puppet/rack/puppetmasterd/public|" \
+            -e "s|<Directory /etc/puppet/rack/>|<Directory /usr/share/puppet/rack/puppetmasterd/>|" \
+            /usr/share/puppetmaster-passenger/apache2.site.conf.tmpl > $tempfile
+        update_vhost_for_passenger4
+        update_vhost_for_apache24
+        mv $tempfile "${APACHE2_SITE_FILE}"
+    fi
+
+    # Enable needed modules
+    a2enmod ssl
+    a2enmod headers
+    a2ensite ${sitename}
+    restart_apache2
+}
+
+update_existing_puppetmaster_vhost() {
+    if dpkg --compare-versions "${1}" lt "3.6.2~"; then
+        update_vhost_for_apache24_upgrade
+    fi
+}
+
+if [ "$1" = "configure" ]; then
+
+    # Change the owner of the rack config.ru to be the puppet user
+    # because passenger will suid to that user, see #577366
+    if ! dpkg-statoverride --list /usr/share/puppet/rack/puppetmasterd/config.ru >/dev/null 2>&1
+    then
+        dpkg-statoverride --update --add puppet puppet 0644 /usr/share/puppet/rack/puppetmasterd/config.ru
+    fi
+
+    # Setup puppetmaster passenger vhost
+    if [ "$2" = "" ]; then
+        create_initial_puppetmaster_vhost
+    else
+        update_existing_puppetmaster_vhost $2
+    fi
+
+    # Fix CRL file on upgrade to use the CA crl file instead of the host crl.
+    if dpkg --compare-versions "$2" lt-nl "2.6.1-1"; then
+        if [ -e /etc/apache2/sites-available/puppetmaster ]; then
+            sed -r -i 's|SSLCARevocationFile[[:space:]]+/var/lib/puppet/ssl/crl.pem$|SSLCARevocationFile /var/lib/puppet/ssl/ca/ca_crl.pem|' /etc/apache2/sites-available/puppetmaster
+            restart_apache2
+        fi
+    fi
+fi
+
+#DEBHELPER#

data/ext/debian/puppetmaster-passenger.postrm

@@ -0,0 +1,61 @@
+#!/bin/sh
+
+set -e
+
+sitename="puppetmaster"
+
+# The debian provided a2* utils in Apache 2.4 uses "site name" as
+# argument, while the version in Apache 2.2 uses "file name".
+#
+# For added fun, the Apache 2.4 version requires files to have a
+# ".conf" suffix, but this must be stripped when using it as argument
+# for the a2* utilities.
+#
+# This will end in tears…
+# Can be removed when we only support apache >= 2.4
+apache2_puppetmaster_sitename() {
+    apache2_version="$(dpkg-query --showformat='${Version}\n' --show apache2)"
+    if dpkg --compare-versions "$apache2_version" gt "2.4~"; then
+        echo "${sitename}.conf"
+    else
+        echo "${sitename}"
+    fi
+}
+
+# Can be removed when we only support apache >= 2.4
+restart_apache2() {
+    if [ -x "/etc/init.d/apache2" ]; then
+        # Seems that a restart is needed. reload breaks ssl apparently.
+        if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+            invoke-rc.d apache2 restart || exit $?
+        else
+            /etc/init.d/apache2 restart || exit $?
+        fi
+    fi
+}
+
+case "$1" in
+    purge)
+        if dpkg-statoverride --list /usr/share/puppet/rack/puppetmasterd/config.ru >/dev/null 2>&1
+        then
+            dpkg-statoverride --remove /usr/share/puppet/rack/puppetmasterd/config.ru
+        fi
+        # Remove the puppetmaster site configuration on purge
+        rm -f /etc/apache2/sites-available/$(apache2_puppetmaster_sitename)
+    ;;
+    remove)
+        # Disable the puppetmaster apache2 site configuration on package removal
+        a2dissite ${sitename}
+        restart_apache2
+    ;;
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+        ;;
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+
+esac
+
+#DEBHELPER#
+
+exit 0

data/ext/debian/puppetmaster.README.debian

@@ -0,0 +1,17 @@
+By default, the puppetmaster package is configured in
+/etc/default/puppetmaster to use the WEBrick server included in
+the application. This server is single-threaded, very slow, and tends
+to fall over when you get close to 30 nodes. You will start to see
+connection-reset or End-of-file errors when this happens.
+
+For production deployments, use a server that can scale better than WEBrick,
+such as Passenger (aka mod_rails), with a front-end web-proxy such as Apache.
+
+To run Passenger with Apache, install the puppetmaster-passenger package. It
+automatically sets up an apache2 virtual host that runs puppetmaster under
+Passenger.
+
+For more information, see https://puppet.com/docs/puppet/latest/passenger.html.
+For information about the Puppet-designed Puppet Server, which deprecates
+the Passenger/Apache stack, see
+https://puppet.com/docs/puppetserver/latest/.

data/ext/debian/puppetmaster.default

@@ -0,0 +1,14 @@
+# Defaults for puppetmaster - sourced by /etc/init.d/puppetmaster
+
+# Enable puppetmaster service? 
+# Setting this to "yes" allows the puppet master service to run.
+# Setting this to "no" keeps the puppet master service from running.
+#
+# If you are using Passenger, you should have this set to "no."
+START=yes
+
+# Startup options
+DAEMON_OPTS=""
+
+# On what port should the puppet master listen? (default: 8140)
+PORT=8140

data/ext/debian/puppetmaster.init

@@ -0,0 +1,137 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides:          puppetmaster
+# Required-Start:    $network $named $remote_fs $syslog
+# Required-Stop:     $network $named $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+### END INIT INFO
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/bin/puppet
+DAEMON_OPTS=""
+NAME=master
+DESC="puppet master"
+
+test -x $DAEMON || exit 0
+
+[ -r /etc/default/puppetmaster ] && . /etc/default/puppetmaster
+
+. /lib/lsb/init-functions
+
+if [ ! -d /var/run/puppet ]; then
+    mkdir -p /var/run/puppet
+fi
+
+chown puppet:puppet /var/run/puppetlabs
+
+mongrel_warning="The mongrel servertype is no longer built-in to Puppet. It
+appears as though mongrel is being used, as the number of puppetmasters is
+greater than one. Starting the puppetmaster service will not behave as expected
+until this is resolved. Only the first port has been used in the service, and
+only one puppetmaster has been started. These settings are defined in
+/etc/default/puppetmaster"
+
+
+# Warn about removed and unsupported mongrel servertype
+if ([ -n "$PUPPETMASTERS" ] && [ ${PUPPETMASTERS} -gt 1 ]) || [ "${SERVERTYPE}" = "mongrel" ]; then
+    echo $mongrel_warning
+    echo
+fi
+
+is_true() {
+    if [ "x$1" = "xtrue" -o "x$1" = "xyes" -o "x$1" = "x0" ] ; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+start_puppet_master() {
+    if is_true "$START" ; then
+        start-stop-daemon --start --quiet --pidfile /var/run/puppetlabs/${NAME}.pid \
+            --startas $DAEMON -- $NAME $DAEMON_OPTS --masterport=$PORT
+    else
+        echo ""
+        echo "puppetmaster not configured to start, please edit /etc/default/puppetmaster to enable"
+    fi
+}
+
+stop_puppet_master() {
+    start-stop-daemon --stop --retry TERM/10/KILL/5 --quiet --oknodo --pidfile /var/run/puppetlabs/${NAME}.pid
+}
+
+status_puppet_master() {
+    if ( ! type status_of_proc > /dev/null 2>&1 ) ; then
+        status_of_proc() {
+            local pidfile daemon name status
+            pidfile=
+            OPTIND=1
+            while getopts p: opt ; do
+                case "$opt" in
+                    p)  pidfile="$OPTARG";;
+                esac
+            done
+            shift $(($OPTIND - 1))
+
+            if [ -n "$pidfile" ]; then
+                pidfile="-p $pidfile"
+            fi
+            daemon="$1"
+            name="$2"
+
+            status="0"
+            pidofproc $pidfile $daemon >/dev/null || status="$?"
+            if [ "$status" = 0 ]; then
+                log_success_msg "$name is running"
+                return 0
+            elif [ "$status" = 4 ]; then
+                log_failure_msg "could not access PID file for $name"
+                return $status
+            else
+                log_failure_msg "$name is not running"
+                return $status
+            fi
+        }
+    fi
+
+    if is_true "$START" ; then
+        status_of_proc -p "/var/run/puppetlabs/${NAME}.pid" "${DAEMON}" "${NAME}"
+    else
+        echo ""
+        echo "puppetmaster not configured to start"
+        status_of_proc -p "/var/run/puppetlabs/${NAME}.pid" "${DAEMON}" "${NAME}"
+    fi
+}
+
+
+case "$1" in
+    start)
+        log_begin_msg "Starting $DESC"
+        start_puppet_master
+        log_end_msg $?
+        ;;
+    stop)
+        log_begin_msg "Stopping $DESC"
+        stop_puppet_master
+        log_end_msg $?
+        ;;
+    reload)
+        # Do nothing, as Puppetmaster rechecks its config automatically
+        ;;
+    status)
+        status_puppet_master
+        ;;
+    restart|force-reload)
+        log_begin_msg "Restarting $DESC"
+        stop_puppet_master
+        start_puppet_master
+        log_end_msg $?
+        ;;
+    *)
+        echo "Usage: $0 {start|stop|status|restart|force-reload}" >&2
+        exit 1
+        ;;
+esac
+
+# vim: tabstop=4:softtabstop=4:shiftwidth=4:expandtab

data/ext/debian/puppetmaster.lintian-overrides

@@ -0,0 +1,3 @@
+# Man pages are automatically generated, not much to do here
+puppetmaster binary: manpage-has-bad-whatis-entry
+puppetmaster binary: manpage-has-errors-from-man

data/ext/debian/puppetmaster.postinst

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -e
+
+# Remove renamed configuration files which are now handled by other
+# packages
+if dpkg-maintscript-helper supports rm_conffile 2>/dev/null; then
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/logrotate.d/puppetmaster 2.7.16-1puppetlabs1 puppetmaster -- "$@"
+
+# For systems with dpkg < 1.15.7-2
+else
+
+    if [ -f /etc/logrotate.d/puppetmaster ]; then
+        rm /etc/logrotate.d/puppetmaster || true
+    fi
+fi
+
+#DEBHELPER#

data/ext/debian/puppetmaster.postrm

@@ -0,0 +1,5 @@
+#!/bin/sh -e
+
+#DEBHELPER#
+
+exit 0

data/ext/debian/puppetmaster.preinst

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e
+
+# Remove renamed configuration files which are now handled by other
+# packages
+if dpkg-maintscript-helper supports rm_conffile 2>/dev/null; then
+
+    dpkg-maintscript-helper rm_conffile \
+        /etc/logrotate.d/puppetmaster 2.7.16-1puppetlabs1 puppetmaster -- "$@"
+
+
+# For systems with dpkg < 1.15.7-2
+else
+
+    if [ -f /etc/logrotate.d/puppetmaster ]; then
+        rm /etc/logrotate.d/puppetmaster || true
+    fi
+fi
+
+
+#DEBHELPER#