puppet 6.27.0 → 7.0.0

data/lib/puppet/settings.rb

@@ -21,6 +21,8 @@ class Puppet::Settings
   require 'puppet/settings/file_or_directory_setting'
   require 'puppet/settings/path_setting'
   require 'puppet/settings/boolean_setting'
+  require 'puppet/settings/integer_setting'
+  require 'puppet/settings/port_setting'
   require 'puppet/settings/terminus_setting'
   require 'puppet/settings/duration_setting'
   require 'puppet/settings/ttl_setting'
@@ -32,7 +34,6 @@ class Puppet::Settings
   require 'puppet/settings/server_list_setting'
   require 'puppet/settings/http_extra_headers_setting'
   require 'puppet/settings/certificate_revocation_setting'
-  require 'puppet/settings/alias_setting'
 
   # local reference for convenience
   PuppetOptionParser = Puppet::Util::CommandLine::PuppetOptionParser
@@ -53,13 +54,14 @@ class Puppet::Settings
   # returns reasonable application default settings values for a given run_mode.
   def self.app_defaults_for_run_mode(run_mode)
     {
-        :name     => run_mode.to_s,
-        :run_mode => run_mode.name,
-        :confdir  => run_mode.conf_dir,
-        :codedir  => run_mode.code_dir,
-        :vardir   => run_mode.var_dir,
-        :rundir   => run_mode.run_dir,
-        :logdir   => run_mode.log_dir,
+        :name      => run_mode.to_s,
+        :run_mode  => run_mode.name,
+        :confdir   => run_mode.conf_dir,
+        :codedir   => run_mode.code_dir,
+        :vardir    => run_mode.var_dir,
+        :publicdir => run_mode.public_dir,
+        :rundir    => run_mode.run_dir,
+        :logdir    => run_mode.log_dir,
     }
   end
 
@@ -75,11 +77,11 @@ class Puppet::Settings
   end
 
   def self.hostname_fact()
-    Puppet.runtime[:facter].value :hostname
+    Facter.value :hostname
   end
 
   def self.domain_fact()
-    Puppet.runtime[:facter].value :domain
+    Facter.value :domain
   end
 
   def self.default_config_file_name
@@ -386,6 +388,19 @@ class Puppet::Settings
     call_hooks_deferred_to_application_initialization
     issue_deprecations
 
+    run_mode = Puppet::Util::RunMode[self.preferred_run_mode]
+    if run_mode.agent? || run_mode.server?
+      if self.set_in_section?(:masterport, run_mode.name) && !self.set_in_section?(:serverport, run_mode.name)
+        self[:serverport] = self[:masterport]
+      elsif self.set_by_config?(:masterport) && !self.set_by_config?(:serverport)
+        self[:serverport] = self[:masterport]
+      elsif self.set_in_section?(:serverport, run_mode.name) && !self.set_in_section?(:masterport, run_mode.name)
+        self[:masterport] = self[:serverport]
+      elsif self.set_by_config?(:serverport) && !self.set_by_config?(:masterport)
+        self[:masterport] = self[:serverport]
+      end
+    end
+
     REQUIRED_APP_SETTINGS.each do |key|
       create_ancestors(Puppet[key])
     end
@@ -720,6 +735,8 @@ class Puppet::Settings
       :file_or_directory => FileOrDirectorySetting,
       :path       => PathSetting,
       :boolean    => BooleanSetting,
+      :integer    => IntegerSetting,
+      :port       => PortSetting,
       :terminus   => TerminusSetting,
       :duration   => DurationSetting,
       :ttl        => TTLSetting,
@@ -730,8 +747,7 @@ class Puppet::Settings
       :autosign   => AutosignSetting,
       :server_list => ServerListSetting,
       :http_extra_headers => HttpExtraHeadersSetting,
-      :certificate_revocation => CertificateRevocationSetting,
-      :alias => AliasSetting
+      :certificate_revocation => CertificateRevocationSetting
   }
 
   # Create a new setting.  The value is passed in because it's used to determine
@@ -862,11 +878,7 @@ class Puppet::Settings
     if self[:user]
       user = Puppet::Type.type(:user).new :name => self[:user], :audit => :ensure
 
-      if user.suitable?
-        @service_user_available = user.exists?
-      else
-        raise Puppet::Error, (_("Cannot manage owner permissions, because the provider for '%{name}' is not functional") % { name: user })
-      end
+      @service_user_available = user.exists?
     else
       @service_user_available = false
     end
@@ -878,11 +890,7 @@ class Puppet::Settings
     if self[:group]
       group = Puppet::Type.type(:group).new :name => self[:group], :audit => :ensure
 
-      if group.suitable?
-        @service_group_available = group.exists?
-      else
-        raise Puppet::Error, (_("Cannot manage group permissions, because the provider for '%{name}' is not functional") % { name: group })
-      end
+      @service_group_available = group.exists?
     else
       @service_group_available = false
     end
@@ -891,16 +899,9 @@ class Puppet::Settings
   # Allow later inspection to determine if the setting was set on the
   # command line, or through some other code path.  Used for the
   # `dns_alt_names` option during cert generate. --daniel 2011-10-18
-  #
-  # @param param [String, Symbol] the setting to look up
-  # @return [Object, nil] the value of the setting or nil if unset
-  def set_by_cli(param)
-    param = param.to_sym
-    @value_sets[:cli].lookup(param)
-  end
-
   def set_by_cli?(param)
-    !!set_by_cli(param)
+    param = param.to_sym
+    !@value_sets[:cli].lookup(param).nil?
   end
 
   # Get values from a search path entry.
@@ -933,13 +934,9 @@ class Puppet::Settings
     end
   end
 
-  # Allow later inspection to determine if the setting was set in a specific
-  # section
-  #
-  # @param param [String, Symbol] the setting to look up
-  # @param section [Symbol] the section in which to look up the setting
-  # @return [Object, nil] the value of the setting or nil if unset
-  def set_in_section(param, section)
+  # Allow later inspection to determine if the setting was set by user
+  # config, rather than a default setting.
+  def set_in_section?(param, section)
     param = param.to_sym
     vals = searchpath_values(SearchPathElement.new(section, :section))
     if vals
@@ -947,10 +944,6 @@ class Puppet::Settings
     end
   end
 
-  def set_in_section?(param, section)
-    !!set_in_section(param, section)
-  end
-
   # Patches the value for a param in a section.
   # This method is required to support the use case of unifying --dns-alt-names and
   # --dns_alt_names in the certificate face. Ideally this should be cleaned up.
@@ -1097,41 +1090,48 @@ Generated on #{Time.now}.
   # Create the necessary objects to use a section.  This is idempotent;
   # you can 'use' a section as many times as you want.
   def use(*sections)
-    Puppet.warning(":master section deprecated in favor of :server section") if sections.include?(:master)
+    if Puppet[:settings_catalog]
+      sections = sections.collect { |s| s.to_sym }
+      sections = sections.reject { |s| @used.include?(s) }
 
-    # add :server if sections include :master or :master if sections include :server
-    sections |= [:master, :server] if (sections & [:master, :server]).any?
+      Puppet.warning(":master section deprecated in favor of :server section") if sections.include?(:master)
 
-    sections = sections.collect { |s| s.to_sym }
-    sections = sections.reject { |s| @used.include?(s) }
+      # add :server if sections include :master or :master if sections include :server
+      sections |= [:master, :server] if (sections & [:master, :server]).any?
 
-    return if sections.empty?
+      sections = sections.collect { |s| s.to_sym }
+      sections = sections.reject { |s| @used.include?(s) }
 
-    Puppet.debug { "Applying settings catalog for sections #{sections.join(', ')}" }
+      return if sections.empty?
 
-    begin
-      catalog = to_catalog(*sections).to_ral
-    rescue => detail
-      Puppet.log_and_raise(detail, "Could not create resources for managing Puppet's files and directories in sections #{sections.inspect}: #{detail}")
-    end
+      Puppet.debug { "Applying settings catalog for sections #{sections.join(', ')}" }
 
-    catalog.host_config = false
-    catalog.apply do |transaction|
-      if transaction.any_failed?
-        report = transaction.report
-        status_failures = report.resource_statuses.values.select { |r| r.failed? }
-        status_fail_msg = status_failures.
-          collect(&:events).
-          flatten.
-          select { |event| event.status == 'failure' }.
-          collect { |event| "#{event.resource}: #{event.message}" }.join("; ")
+      begin
+        catalog = to_catalog(*sections).to_ral
+      rescue => detail
+        Puppet.log_and_raise(detail, "Could not create resources for managing Puppet's files and directories in sections #{sections.inspect}: #{detail}")
+      end
 
-        raise "Got #{status_failures.length} failure(s) while initializing: #{status_fail_msg}"
+      catalog.host_config = false
+      catalog.apply do |transaction|
+        if transaction.any_failed?
+          report = transaction.report
+          status_failures = report.resource_statuses.values.select { |r| r.failed? }
+          status_fail_msg = status_failures.
+            collect(&:events).
+            flatten.
+            select { |event| event.status == 'failure' }.
+            collect { |event| "#{event.resource}: #{event.message}" }.join("; ")
+
+          raise "Got #{status_failures.length} failure(s) while initializing: #{status_fail_msg}"
+        end
       end
-    end
 
-    sections.each { |s| @used << s }
-    @used.uniq!
+      sections.each { |s| @used << s }
+      @used.uniq!
+    else
+      Puppet.debug("Skipping settings catalog for sections #{sections.join(', ')}")
+    end
   end
 
   def valid?(param)
@@ -1285,37 +1285,27 @@ Generated on #{Time.now}.
   end
 
   def add_environment_resources(catalog, sections)
+    path = self[:environmentpath]
+    envdir = path.split(File::PATH_SEPARATOR).first if path
     configured_environment = self[:environment]
-
-    if configured_environment == "production" && !production_environment_exists?
-      environment_path = self[:environmentpath]
-      first_environment_path = environment_path.split(File::PATH_SEPARATOR).first
-
-      if Puppet::FileSystem.exist?(first_environment_path)
-        production_environment_path = File.join(first_environment_path, configured_environment)
+    if configured_environment == "production" && envdir && Puppet::FileSystem.exist?(envdir)
+      configured_environment_path = File.join(envdir, configured_environment)
+      # If configured_environment_path is a symlink, assume the source path is being managed
+      # elsewhere, so don't do any of this configuration
+      if !Puppet::FileSystem.symlink?(configured_environment_path)
         parameters = { :ensure => 'directory' }
-        parameters[:mode] = '0750'
-        if Puppet.features.root?
-          parameters[:owner] = Puppet[:user] if service_user_available?
-          parameters[:group] = Puppet[:group] if service_group_available?
+        unless Puppet::FileSystem.exist?(configured_environment_path)
+          parameters[:mode] = '0750'
+          if Puppet.features.root?
+            parameters[:owner] = Puppet[:user] if service_user_available?
+            parameters[:group] = Puppet[:group] if service_group_available?
+          end
         end
-        catalog.add_resource(Puppet::Resource.new(:file, production_environment_path, :parameters => parameters))
+        catalog.add_resource(Puppet::Resource.new(:file, configured_environment_path, :parameters => parameters))
       end
     end
   end
 
-  def production_environment_exists?
-    environment_path = self[:environmentpath]
-    paths = environment_path.split(File::PATH_SEPARATOR)
-
-    paths.any? do |path|
-      # If expected_path is a symlink, assume the source path is being managed
-      # elsewhere, so accept it also as a valid production environment path
-      expected_path = File.join(path, 'production')
-      Puppet::FileSystem.directory?(expected_path) || Puppet::FileSystem.symlink?(expected_path)
-    end
-  end
-
   def add_user_resources(catalog, sections)
     return unless Puppet.features.root?
     return if Puppet::Util::Platform.windows?
@@ -1416,12 +1406,6 @@ Generated on #{Time.now}.
         end
       end
 
-      setting  = @defaults[name]
-      if setting.respond_to?(:alias_name)
-        val  = lookup(setting.alias_name)
-        return val if val
-      end
-
       @defaults[name].default
     end
 

data/lib/puppet/ssl/base.rb

@@ -1,7 +1,6 @@
 require 'puppet/ssl/openssl_loader'
 require 'puppet/ssl'
 require 'puppet/ssl/digest'
-require 'puppet/util/ssl'
 
 # The base class for wrapping SSL instances.
 class Puppet::SSL::Base
@@ -54,7 +53,9 @@ class Puppet::SSL::Base
   #
   # @return [String] the name (CN) extracted from the subject.
   def self.name_from_subject(subject)
-    Puppet::Util::SSL.cn_from_subject(subject)
+    if subject.respond_to? :to_a
+      (subject.to_a.assoc('CN') || [])[1]
+    end
   end
 
   # Create an instance of our Puppet::SSL::* class using a given instance of the wrapped class
@@ -82,15 +83,12 @@ class Puppet::SSL::Base
   # Read content from disk appropriately.
   def read(path)
     # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest
-    # Puppet::SSL::Key uses this, but also provides its own override
     # nothing derives from Puppet::SSL::Certificate, but it is called by a number of other SSL Indirectors:
     # Puppet::Indirector::CertificateStatus::File (.indirection.find)
     # Puppet::Network::HTTP::WEBrick (.indirection.find)
     # Puppet::Network::HTTP::RackREST (.from_instance)
     # Puppet::Network::HTTP::WEBrickREST (.from_instance)
-    # Puppet::SSL::Host (.indirection.find)
     # Puppet::SSL::Inventory (.indirection.search, implements its own add / rebuild / serials with encoding UTF8)
-    # Puppet::SSL::Validator::DefaultValidator (.from_instance) / Puppet::SSL::Validator::NoValidator does nothing
     @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII))
   end
 

data/lib/puppet/ssl/certificate.rb

@@ -11,12 +11,6 @@ class Puppet::SSL::Certificate < Puppet::SSL::Base
   # This is defined from the base class
   wraps OpenSSL::X509::Certificate
 
-  extend Puppet::Indirector
-  indirects :certificate, :terminus_class => :file, :doc => <<DOC
-    This indirection wraps an `OpenSSL::X509::Certificate` object, representing a certificate (signed public key).
-    The indirection key is the certificate CN (generally a hostname).
-DOC
-
   # Because of how the format handler class is included, this
   # can't be in the base class.
   def self.supported_formats

data/lib/puppet/ssl/certificate_request.rb

@@ -28,13 +28,6 @@ require 'puppet/ssl/certificate_signer'
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
 
-  extend Puppet::Indirector
-
-  indirects :certificate_request, :terminus_class => :file, :doc => <<DOC
-    This indirection wraps an `OpenSSL::X509::Request` object, representing a certificate signing request (CSR).
-    The indirection key is the certificate CN (generally a hostname).
-DOC
-
   # Because of how the format handler class is included, this
   # can't be in the base class.
   def self.supported_formats
@@ -47,8 +40,7 @@ DOC
 
   # Create a certificate request with our system settings.
   #
-  # @param key [OpenSSL::X509::Key, Puppet::SSL::Key] The key pair associated
-  #   with this CSR.
+  # @param key [OpenSSL::X509::Key] The private key associated with this CSR.
   # @param options [Hash]
   # @option options [String] :dns_alt_names A comma separated list of
   #   Subject Alternative Names to include in the CSR extension request.
@@ -64,9 +56,6 @@ DOC
   def generate(key, options = {})
     Puppet.info _("Creating a new SSL certificate request for %{name}") % { name: name }
 
-    # Support either an actual SSL key, or a Puppet key.
-    key = key.content if key.is_a?(Puppet::SSL::Key)
-
     # If we're a CSR for the CA, then use the real ca_name, rather than the
     # fake 'ca' name.  This is mostly for backward compatibility with 0.24.x,
     # but it's also just a good idea.

data/lib/puppet/ssl/certificate_signer.rb

@@ -27,6 +27,12 @@ class Puppet::SSL::CertificateSigner
     @digest
   end
 
+  # Sign a certificate signing request (CSR) with a private key.
+  #
+  # @param [OpenSSL::X509::Request] content The CSR to sign
+  # @param [OpenSSL::X509::PKey] key The private key to sign with
+  #
+  # @api private
   def sign(content, key)
     content.sign(key, @digest.new)
   end

data/lib/puppet/ssl/oids.rb

@@ -2,10 +2,11 @@ require 'puppet/ssl'
 
 # This module defines OIDs for use within Puppet.
 #
-# == ASN.1 Definition
+# # ASN.1 Definition
 #
 # The following is the formal definition of OIDs specified in this file.
 #
+# ```
 # puppetCertExtensions OBJECT IDENTIFIER ::= {iso(1) identified-organization(3)
 #    dod(6) internet(1) private(4) enterprise(1) 34380 1}
 #
@@ -22,6 +23,7 @@ require 'puppet/ssl'
 # pp_instance_id OBJECT IDENTIFIER ::= { registeredExtensions 2 }
 # pp_image_name OBJECT IDENTIFIER ::= { registeredExtensions 3 }
 # pp_preshared_key OBJECT IDENTIFIER ::= { registeredExtensions 4 }
+# ```
 #
 # @api private
 module Puppet::SSL::Oids

data/lib/puppet/ssl/ssl_provider.rb

@@ -3,6 +3,23 @@ require 'puppet/ssl'
 # SSL Provider creates `SSLContext` objects that can be used to create
 # secure connections.
 #
+# @example To load an SSLContext from an existing private key and related certs/crls:
+#   ssl_context = provider.load_context
+#
+# @example To load an SSLContext from an existing password-protected private key and related certs/crls:
+#   ssl_context = provider.load_context(password: 'opensesame')
+#
+# @example To create an SSLContext from in-memory certs and keys:
+#   cacerts = [<OpenSSL::X509::Certificate>]
+#   crls = [<OpenSSL::X509::CRL>]
+#   key = <OpenSSL::X509::PKey>
+#   cert = <OpenSSL::X509::Certificate>
+#   ssl_context = provider.create_context(cacerts: cacerts, crls: crls, private_key: key, client_cert: cert)
+#
+# @example To create an SSLContext to connect to non-puppet HTTPS servers:
+#   cacerts = [<OpenSSL::X509::Certificate>]
+#   ssl_context = provider.create_root_context(cacerts: cacerts)
+#
 # @api private
 class Puppet::SSL::SSLProvider
   # Create an insecure `SSLContext`. Connections made from the returned context
@@ -51,7 +68,8 @@ class Puppet::SSL::SSLProvider
   # @raise (see #create_context)
   # @api private
   def create_system_context(cacerts:, path: Puppet[:ssl_trust_store])
-    store = create_x509_store(cacerts, [], false, include_system_store: true)
+    store = create_x509_store(cacerts, [], false)
+    store.set_default_paths
 
     if path
       stat = Puppet::FileSystem.stat(path)
@@ -93,20 +111,19 @@ class Puppet::SSL::SSLProvider
   # @param client_cert [OpenSSL::X509::Certificate] client's cert whose public
   #   key matches the `private_key`
   # @param revocation [:chain, :leaf, false] revocation mode
-  # @param include_system_store [true, false] Also trust system CA
   # @return [Puppet::SSL::SSLContext] A context to use to create connections
   # @raise [Puppet::SSL::CertVerifyError] There was an issue with
   #   one of the certs or CRLs.
   # @raise [Puppet::SSL::SSLError] There was an issue with the
   #   `private_key`.
   # @api private
-  def create_context(cacerts:, crls:, private_key:, client_cert:, revocation: Puppet[:certificate_revocation], include_system_store: false)
+  def create_context(cacerts:, crls:, private_key:, client_cert:, revocation: Puppet[:certificate_revocation])
     raise ArgumentError, _("CA certs are missing") unless cacerts
     raise ArgumentError, _("CRLs are missing") unless crls
     raise ArgumentError, _("Private key is missing") unless private_key
     raise ArgumentError, _("Client cert is missing") unless client_cert
 
-    store = create_x509_store(cacerts, crls, revocation, include_system_store: include_system_store)
+    store = create_x509_store(cacerts, crls, revocation)
     client_chain = verify_cert_with_store(store, client_cert)
 
     if !private_key.is_a?(OpenSSL::PKey::RSA) && !private_key.is_a?(OpenSSL::PKey::EC)
@@ -134,13 +151,12 @@ class Puppet::SSL::SSLProvider
   # @param password [String, nil] If the private key is encrypted, decrypt
   #   it using the password. If the key is encrypted, but a password is
   #   not specified, then the key cannot be loaded.
-  # @param include_system_store [true, false] Also trust system CA
   # @return [Puppet::SSL::SSLContext] A context to use to create connections
   # @raise [Puppet::SSL::CertVerifyError] There was an issue with
   #   one of the certs or CRLs.
   # @raise [Puppet::Error] There was an issue with one of the required components.
   # @api private
-  def load_context(certname: Puppet[:certname], revocation: Puppet[:certificate_revocation], password: nil, include_system_store: false)
+  def load_context(certname: Puppet[:certname], revocation: Puppet[:certificate_revocation], password: nil)
     cert = Puppet::X509::CertProvider.new
     cacerts = cert.load_cacerts(required: true)
     crls = case revocation
@@ -152,7 +168,7 @@ class Puppet::SSL::SSLProvider
     private_key = cert.load_private_key(certname, required: true, password: password)
     client_cert = cert.load_client_cert(certname, required: true)
 
-    create_context(cacerts: cacerts, crls: crls,  private_key: private_key, client_cert: client_cert, revocation: revocation, include_system_store: include_system_store)
+    create_context(cacerts: cacerts, crls: crls,  private_key: private_key, client_cert: client_cert, revocation: revocation)
   rescue OpenSSL::PKey::PKeyError => e
     raise Puppet::SSL::SSLError.new(_("Failed to load private key for host '%{name}': %{message}") % { name: certname, message: e.message }, e)
   end
@@ -187,7 +203,7 @@ class Puppet::SSL::SSLProvider
     end
   end
 
-  def create_x509_store(roots, crls, revocation, include_system_store: false)
+  def create_x509_store(roots, crls, revocation)
     store = OpenSSL::X509::Store.new
     store.purpose = OpenSSL::X509::PURPOSE_ANY
     store.flags = default_flags | revocation_mode(revocation)
@@ -195,8 +211,6 @@ class Puppet::SSL::SSLProvider
     roots.each { |cert| store.add_cert(cert) }
     crls.each { |crl| store.add_crl(crl) }
 
-    store.set_default_paths if include_system_store
-
     store
   end
 

data/lib/puppet/ssl/state_machine.rb

@@ -10,7 +10,7 @@ require 'puppet/util/pidlock'
 # certs. This way we're sure about which SSLContext is being used during any
 # phase of the bootstrapping process.
 #
-# @private
+# @api private
 class Puppet::SSL::StateMachine
   class SSLState
     attr_reader :ssl_context
@@ -405,6 +405,7 @@ class Puppet::SSL::StateMachine
   #
   # @return [Puppet::SSL::SSLContext] initialized SSLContext
   # @raise [Puppet::Error] If we fail to generate an SSLContext
+  # @api private
   def ensure_ca_certificates
     final_state = run_machine(NeedLock.new(self), NeedKey)
     final_state.ssl_context
@@ -414,6 +415,7 @@ class Puppet::SSL::StateMachine
   #
   # @return [Puppet::SSL::SSLContext] initialized SSLContext
   # @raise [Puppet::Error] If we fail to generate an SSLContext
+  # @api private
   def ensure_client_certificate
     final_state = run_machine(NeedLock.new(self), Done)
     ssl_context = final_state.ssl_context

data/lib/puppet/ssl/verifier.rb

@@ -14,6 +14,7 @@ class Puppet::SSL::Verifier
   # @param hostname [String] FQDN of the server we're attempting to connect to
   # @param ssl_context [Puppet::SSL::SSLContext] ssl_context containing CA certs,
   #   CRLs, etc needed to verify the server's certificate chain
+  # @api private
   def initialize(hostname, ssl_context)
     @hostname = hostname
     @ssl_context = ssl_context
@@ -25,6 +26,7 @@ class Puppet::SSL::Verifier
   #
   # @param verifier [Puppet::SSL::Verifier] the verifier to compare against
   # @return [Boolean] return true if a cached connection can be used, false otherwise
+  # @api private
   def reusable?(verifier)
     verifier.instance_of?(self.class) &&
       verifier.ssl_context.object_id == @ssl_context.object_id
@@ -115,12 +117,6 @@ class Puppet::SSL::Verifier
         return false
       end
 
-    # ruby-openssl#74ef8c0cc56b840b772240f2ee2b0fc0aafa2743 now sets the
-    # store_context error when the cert is mismatched
-    when OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH
-      @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
-      return false
-
     when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
       crl = store_context.current_crl
       if crl && crl.last_update && crl.last_update < Time.now + FIVE_MINUTES_AS_SECONDS

data/lib/puppet/ssl.rb

@@ -2,18 +2,22 @@
 require 'puppet'
 require 'puppet/ssl/openssl_loader'
 
+# Responsible for bootstrapping an agent's certificate and private key, generating
+# SSLContexts for use in making HTTPS connections, and handling CSR attributes and
+# certificate extensions.
+#
+# @see Puppet::SSL::SSLProvider
 # @api private
-module Puppet::SSL # :nodoc:
+module Puppet::SSL
   CA_NAME = "ca".freeze
-  require 'puppet/ssl/host'
+
   require 'puppet/ssl/oids'
-  require 'puppet/ssl/validator'
-  require 'puppet/ssl/validator/no_validator'
-  require 'puppet/ssl/validator/default_validator'
   require 'puppet/ssl/error'
   require 'puppet/ssl/ssl_context'
   require 'puppet/ssl/verifier'
-  require 'puppet/ssl/verifier_adapter'
   require 'puppet/ssl/ssl_provider'
   require 'puppet/ssl/state_machine'
+  require 'puppet/ssl/certificate'
+  require 'puppet/ssl/certificate_request'
+  require 'puppet/ssl/certificate_request_attributes'
 end

data/lib/puppet/test/test_helper.rb

@@ -142,16 +142,11 @@ module Puppet::Test
         },
         "Context for specs")
 
-      # trigger `require 'facter'`
-      Puppet.runtime[:facter]
-
+      Puppet.runtime.clear
       Puppet::Parser::Functions.reset
       Puppet::Application.clear!
       Puppet::Util::Profiler.clear
 
-      Puppet::SSL::Host.reset
-      Puppet::Rest::Routes.clear
-
       Puppet::Node::Facts.indirection.terminus_class = :memory
       facts = Puppet::Node::Facts.new(Puppet[:node_name_value])
       Puppet::Node::Facts.indirection.save(facts)
@@ -171,7 +166,6 @@ module Puppet::Test
 
       Puppet::Util::Storage.clear
       Puppet::Util::ExecutionStub.reset
-      Puppet.runtime.clear
 
       Puppet.clear_deprecation_warnings
 
@@ -226,6 +220,7 @@ module Puppet::Test
       {
           :logdir     => "/dev/null",
           :confdir    => "/dev/null",
+          :publicdir  => "/dev/null",
           :codedir    => "/dev/null",
           :vardir     => "/dev/null",
           :rundir     => "/dev/null",

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -137,7 +137,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
       else
         @catalog.add_resource_after(parent_resource, res)
       end
-      @catalog.add_edge(@catalog.container_of(parent_resource), res) if @catalog.container_of(parent_resource)
+      @catalog.add_edge(@catalog.container_of(parent_resource), res)
       if @relationship_graph && priority
         # If we have a relationship_graph we should add the resource
         # to it (this is an eval_generate). If we don't, then the