puppet 6.29.0 → 7.0.0

data/conf/auth.conf

@@ -1,150 +0,0 @@
-# This is the default auth.conf file, which implements the default rules
-# used by the puppet master. (That is, the rules below will still apply
-# even if this file is deleted.)
-#
-# The ACLs are evaluated in top-down order. More specific stanzas should
-# be towards the top of the file and more general ones at the bottom;
-# otherwise, the general rules may "steal" requests that should be
-# governed by the specific rules.
-#
-# See https://puppet.com/docs/puppet/latest/config_file_auth.html
-# for a more complete description of auth.conf's behavior.
-#
-# Supported syntax:
-# Each stanza in auth.conf starts with a path to match, followed
-# by optional modifiers, and finally, a series of allow or deny
-# directives.
-#
-# Example Stanza
-# ---------------------------------
-# path /path/to/resource     # simple prefix match
-# # path ~ regex             # alternately, regex match
-# [environment envlist]
-# [method methodlist]
-# [auth[enthicated] {yes|no|on|off|any}]
-# allow [host|backreference|*|regex]
-# deny [host|backreference|*|regex]
-# allow_ip [ip|cidr|ip_wildcard|*]
-# deny_ip [ip|cidr|ip_wildcard|*]
-#
-# The path match can either be a simple prefix match or a regular
-# expression. `path /file` would match both `/file_metadata` and
-# `/file_content`. Regex matches allow the use of backreferences
-# in the allow/deny directives.
-#
-# The regex syntax is the same as for Ruby regex, and captures backreferences
-# for use in the `allow` and `deny` lines of that stanza
-#
-# Examples:
-#
-# path ~ ^/puppet/v3/path/to/resource    # Equivalent to `path /puppet/v3/path/to/resource`.
-# allow *                                # Allow all authenticated nodes (since auth
-#                                        # defaults to `yes`).
-#
-# path ~ ^/puppet/v3/catalog/([^/]+)$    # Permit nodes to access their own catalog (by
-# allow $1                               # certname), but not any other node's catalog.
-#
-# path ~ ^/puppet/v3/file_(metadata|content)/extra_files/  # Only allow certain nodes to
-# auth yes                                                 # access the "extra_files"
-# allow /^(.+)\.example\.com$/                             # mount point; note this must
-# allow_ip 192.168.100.0/24                                # go ABOVE the "/file" rule,
-#                                                          # since it is more specific.
-#
-# environment:: restrict an ACL to a comma-separated list of environments
-# method:: restrict an ACL to a comma-separated list of HTTP methods
-# auth:: restrict an ACL to an authenticated or unauthenticated request
-# the default when unspecified is to restrict the ACL to authenticated requests
-# (ie exactly as if auth yes was present).
-#
-
-# CONTROLLING FILE ACCESS (previously in fileserver.conf)
-
-# In previous versions of Puppet, you controlled file access by adding
-# rules to fileserver.conf. In Puppet 5 with Puppet Server, you can control
-# file access in auth.conf by controlling the /file_metadata(s)/<mount point>,
-# /file_content(s)/<mount point>, and /static_file_content/<file> paths. See the
-# Puppet Server documentation at
-# https://puppet.com/docs/puppetserver/latest/config_file_auth.html.
-#
-# If you are not using Puppet Server, or are using Puppet Server but with the
-# "jruby-puppet.use-legacy-auth-conf" setting set to "true", you could set the
-# desired file access in a new rule in this file. For example:
-#
-# path ~ ^/file_(metadata|content)s?/extra_files/
-# auth yes
-# allow /^(.+)\.example\.com$/
-# allow_ip 192.168.100.0/24
-#
-# If added to auth.conf BEFORE the default "path /file" rule, this rule
-# will add stricter restrictions to the extra_files mount point.
-
-### Authenticated ACLs - these rules apply only when the client
-### has a valid certificate and is thus authenticated
-
-path /puppet/v3/environments
-method find
-allow *
-
-# allow nodes to retrieve their own catalog
-path ~ ^/puppet/v3/catalog/([^/]+)$
-method find
-allow $1
-
-# allow nodes to retrieve their own node definition
-path ~ ^/puppet/v3/node/([^/]+)$
-method find
-allow $1
-
-# allow all nodes to store their own reports
-path ~ ^/puppet/v3/report/([^/]+)$
-method save
-allow $1
-
-# allow all nodes to update their own facts
-path ~ ^/puppet/v3/facts/([^/]+)$
-method save
-allow $1
-
-# Allow all nodes to access all file services; this is necessary for
-# pluginsync, file serving from modules, and file serving from custom
-# mount points (see fileserver.conf). Note that the `/file` prefix matches
-# requests to both the file_metadata and file_content paths. See "Examples"
-# above if you need more granular access control for custom mount points.
-path /puppet/v3/file
-allow *
-
-path /puppet/v3/status
-method find
-allow *
-
-# allow all nodes to access the certificates services
-path /puppet-ca/v1/certificate_revocation_list/ca
-method find
-allow *
-
-### Unauthenticated ACLs, for clients without valid certificates; authenticated
-### clients can also access these paths, though they rarely need to.
-
-# allow access to the CA certificate; unauthenticated nodes need this
-# in order to validate the puppet master's certificate
-path /puppet-ca/v1/certificate/ca
-auth any
-method find
-allow *
-
-# allow nodes to retrieve the certificate they requested earlier
-path /puppet-ca/v1/certificate/
-auth any
-method find
-allow *
-
-# allow nodes to request a new certificate
-path /puppet-ca/v1/certificate_request
-auth any
-method find, save
-allow *
-
-# deny everything else; this ACL is not strictly necessary, but
-# illustrates the default policy.
-path /
-auth any

data/ext/README.md

@@ -1,13 +0,0 @@
-# `ext/` directory details 
-This directory contains files used internally when packaging [puppet](https://github.com/puppetlabs/puppet) and [puppet-agent](https://github.com/puppetlabs/puppet-agent)
-What follows is a more detailed description of each directory/file:
-* `debian/` - init scripts for puppet (used for Debian-based platforms that do not support systemd)
-* `hiera/hiera.yaml` - installed to `$codedir/environments/production`as a default Hiera configuration file
-* `osx/puppet.plist` - puppet launchd plist for macOS
-* `redhat/` -  init scripts for puppet (used for EL-based platforms that do not support systemd)
-* `solaris/smf/` - service manifests for Solaris 11
-* `suse/client.init` - init script for puppet (used for SUSE-based platforms that do not support systemd) 
-* `systemd/puppet.service` - systemd unit file for puppet
-* `windows/` - the puppet daemon for Windows, and other useful `.bat` helper wrappers
-* `build_defaults.yaml` - information pertaining to the puppetlabs build automation
-* `project_data.yaml` - information used when packaging the puppet gem

data/lib/puppet/application/cert.rb

@@ -1,76 +0,0 @@
-require 'puppet/application'
-
-class Puppet::Application::Cert < Puppet::Application
-
-  def summary
-    _("Manage certificates and requests (Disabled)")
-  end
-
-  def help
-     <<-HELP
-This command is no longer functional, please use `puppetserver ca` instead.
-
-puppet-cert(8) -- #{summary}
-========
-
-ACTIONS
--------
-Every action except 'list' and 'generate' requires a hostname to act on,
-unless the '--all' option is set.
-
-* clean:
-  Use `puppetserver ca clean --certname NAME[,NAME...]`
-
-* fingerprint:
-  Use openssl directly:
-  `openssl x509 -noout -fingerprint -<digest> -inform pem -in certificate.crt`
-
-* generate:
-  Use `puppetserver ca generate --certname NAME[,NAME...]`
-
-* list:
-  Use `puppetserver ca list [--all]`
-
-* print:
-  Use openssl directly:
-  `openssl x509 -noout -text -in certificate.pem`
-
-* revoke:
-  Use `puppetserver ca revoke --certname NAME[,NAME...]`
-
-* sign:
-  Use `puppetserver ca sign --certname NAME[,NAME...]`
-
-* verify:
-  Use `puppet ssl verify [--certname NAME]`
-
-* reinventory:
-  Removed.
-
-OPTIONS
--------
-There are a couple important notes about previously-supported options.
-
-* --allow-dns-alt-names:
-  In order to sign certificates with subject alternative names using
-  `puppetserver ca sign`, the `allow-subject-alt-names` setting must be
-  set to true in the `certificate-authority` section of Puppet Server's
-  config.
-
-* --allow-authorization-extensions:
-  In order to sign certificates with authorization extensions using
-  `puppetserver ca sign`, the `allow-authorization-extensions` setting must be
-  set to true in the `certificate-authority` section of Puppet Server's
-  config.
-HELP
-  end
-
-  def setup
-    deprecate
-  end
-
-  def parse_options
-    puts help
-    exit 1
-  end
-end

data/lib/puppet/application/key.rb

@@ -1,4 +0,0 @@
-require 'puppet/application/indirection_base'
-
-class Puppet::Application::Key < Puppet::Application::IndirectionBase
-end

data/lib/puppet/application/man.rb

@@ -1,4 +0,0 @@
-require 'puppet/application/face_base'
-
-class Puppet::Application::Man < Puppet::Application::FaceBase
-end

data/lib/puppet/application/status.rb

@@ -1,4 +0,0 @@
-require 'puppet/application/indirection_base'
-
-class Puppet::Application::Status < Puppet::Application::IndirectionBase
-end

data/lib/puppet/face/key.rb

@@ -1,16 +0,0 @@
-require 'puppet/indirector/face'
-
-Puppet::Indirector::Face.define(:key, '0.0.1') do
-  copyright "Puppet Inc.", 2011
-  license   _("Apache 2 license; see COPYING")
-
-  summary _("Create, save, and remove certificate keys.")
-  description <<-'EOT'
-    This subcommand manages certificate private keys. Keys are created
-    automatically by puppet agent and when certificate requests are generated
-    with 'puppet ssl submit_request'; it should not be necessary to use this
-    subcommand directly.
-  EOT
-
-  deprecate
-end

data/lib/puppet/face/man.rb

@@ -1,145 +0,0 @@
-require 'puppet/face'
-require 'puppet/util'
-require 'pathname'
-require 'erb'
-
-Puppet::Face.define(:man, '0.0.1') do
-  copyright "Puppet Inc.", 2011
-  license   _("Apache 2 license; see COPYING")
-
-  summary _("Display Puppet manual pages.")
-
-  description <<-EOT
-    Please use the command 'puppet help <subcommand>' or the system manpage system
-    'man puppet-<subcommand>' to display information about Puppet subcommands. The
-    deprecated man subcommand displays manual pages for all Puppet subcommands. If
-    the `ronn` gem (<https://github.com/rtomayko/ronn/>) is installed on your
-    system, puppet man will display fully-formatted man pages. If `ronn` is not
-    available, puppet man will display the raw (but human-readable) source text
-    in a pager.
-  EOT
-
-  notes <<-EOT
-    The pager used for display will be the first found of `$MANPAGER`, `$PAGER`,
-    `less`, `most`, or `more`.
-  EOT
-
-  action(:man) do
-    summary _("Display the manual page for a Puppet subcommand.")
-    arguments _("<subcommand>")
-    #TRANSLATORS '--render-as s' is a command line option and should not be translated
-    returns _(<<-'EOT')
-      The man data, in Markdown format, suitable for consumption by Ronn.
-
-      RENDERING ISSUES: To skip fancy formatting and output the raw Markdown
-      text (e.g. for use in a pipeline), call this action with '--render-as s'.
-    EOT
-    examples <<-'EOT'
-      View the installed manual page for the subcommand 'config':
-
-      $ man puppet-config
-
-      (Deprecated) View the manual page for the subcommand 'config':
-
-      $ puppet man config
-    EOT
-
-    default
-    when_invoked do |*args|
-      # 'args' is an array of the subcommand and arguments from the command line and an options hash
-      # [<arg1>, ..., {options}]
-      _options = args.pop
-
-      unless valid_command_line?(args)
-        print_man_help
-        #TRANSLATORS 'puppet man' is a specific command line and should not be translated
-        raise ArgumentError, _("The 'puppet man' command takes a single subcommand to review the subcommand's manpage")
-      end
-
-      manpage = args.first
-      if default_case?(manpage)
-        print_man_help
-        return nil
-      end
-
-      if legacy_applications.include?(manpage)
-        return Puppet::Application[manpage].help
-      end
-
-      # set 'face' as it's used in the erb processing.
-      face = Puppet::Face[manpage.to_sym, :current]
-      _face = face # suppress the unused variable warning
-
-      file = (Pathname(__FILE__).dirname + "help" + 'man.erb')
-      erb = ERB.new(file.read, nil, '-')
-      erb.filename = file.to_s
-
-      # Run the ERB template in our current binding, including all the local
-      # variables we established just above. --daniel 2011-04-11
-      return erb.result(binding)
-    end
-
-    when_rendering :console do |text|
-      # OK, if we have Ronn on the path we can delegate to it and override the
-      # normal output process.  Otherwise delegate to a pager on the raw text,
-      # otherwise we finally just delegate to our parent.  Oh, well.
-
-      # These are the same options for less that git normally uses.
-      # -R : Pass through color control codes (allows display of colors)
-      # -X : Don't init/deinit terminal (leave display on screen on exit)
-      # -F : automatically exit if display fits entirely on one screen
-      # -S : don't wrap long lines
-      ENV['LESS'] ||= 'FRSX'
-
-      ronn  = Puppet::Util.which('ronn')
-      pager = [ENV['MANPAGER'], ENV['PAGER'], 'less', 'most', 'more'].
-        detect {|x| x and x.length > 0 and Puppet::Util.which(x) }
-
-      if ronn
-        # ronn is a stupid about pager selection, we can be smarter. :)
-        ENV['PAGER'] = pager if pager
-
-        args  = "--man --manual='Puppet Manual' --organization='Puppet Inc., LLC'"
-        # manual pages could contain UTF-8 text
-        IO.popen("#{ronn} #{args}", 'w:UTF-8') do |fh| fh.write text end
-
-        ''                      # suppress local output, neh?
-      elsif pager
-        # manual pages could contain UTF-8 text
-        IO.popen(pager, 'w:UTF-8') do |fh| fh.write text end
-        ''
-      else
-        text
-      end
-    end
-  end
-
-  def valid_command_line?(args)
-    # not too many arguments
-    # This allows the command line case of "puppet man man man" to not throw an error because face_based eats
-    # one of the "man"'s, which means this command line ends up looking like this in the code: 'manface.man("man")'
-    # However when we generate manpages, we do the same call. So we have to allow it and generate the real manpage.
-    args.length <= 1
-  end
-
-  # by default, if you ask for the man manpage "puppet man man" face_base removes the "man" from the args that we
-  # are passed, so we get nil instead
-  def default_case?(manpage)
-    manpage.nil?
-  end
-
-  def print_man_help
-    puts Puppet::Face[:help, :current].help(:man)
-  end
-
-  def legacy_applications
-    # The list of applications, less those that are duplicated as a face.
-    Puppet::Application.available_application_names.reject do |appname|
-      Puppet::Face.face? appname.to_sym, :current or
-        # ...this is a nasty way to exclude non-applications. :(
-        %w{face_base indirection_base}.include? appname
-    end
-  end
-
-  deprecate
-end

data/lib/puppet/face/module/build.rb

@@ -1,14 +0,0 @@
-Puppet::Face.define(:module, '1.0.0') do
-  action(:build) do
-    summary _("Build a module release package.")
-    #TRANSLATORS 'Puppet Development Kit' is the name of the software package replacing this action and should not be translated.
-    description _("This action has been replaced by Puppet Development Kit. For more information visit https://puppet.com/docs/pdk/latest/pdk.html.")
-
-    when_invoked do |*args|
-      #TRANSLATORS 'Puppet Development Kit' is the name of the software package replacing this action and should not be translated.
-      raise _("This action has been replaced by Puppet Development Kit. For more information visit https://puppet.com/docs/pdk/latest/pdk.html.")
-    end
-
-    deprecate
-  end
-end

data/lib/puppet/face/module/generate.rb

@@ -1,14 +0,0 @@
-Puppet::Face.define(:module, '1.0.0') do
-  action(:generate) do
-    summary _("Generate boilerplate for a new module.")
-    #TRANSLATORS 'Puppet Development Kit' is the name of the software package replacing this action and should not be translated.
-    description _("This action has been replaced by Puppet Development Kit. For more information visit https://puppet.com/docs/pdk/latest/pdk.html.")
-
-    when_invoked do |*args|
-      #TRANSLATORS 'Puppet Development Kit' is the name of the software package replacing this action and should not be translated.
-      raise _("This action has been replaced by Puppet Development Kit. For more information visit https://puppet.com/docs/pdk/latest/pdk.html.")
-    end
-
-    deprecate
-  end
-end

data/lib/puppet/face/module/search.rb

@@ -1,103 +0,0 @@
-require 'puppet/util/terminal'
-require 'puppet/forge'
-
-Puppet::Face.define(:module, '1.0.0') do
-  action(:search) do
-    summary _("Search the Puppet Forge for a module.")
-    description <<-EOT
-      This action has been deprecated. Please use the Puppet Forge to search for modules.
-
-      Searches a repository for modules whose names, descriptions, or keywords
-      match the provided search term.
-    EOT
-
-    returns _("Array of module metadata hashes")
-
-    examples <<-EOT
-      Search the Puppet Forge for a module:
-
-      $ puppet module search puppetlabs
-      NAME          DESCRIPTION                          AUTHOR             KEYWORDS
-      bacula        This is a generic Apache module      @puppetlabs        backups
-    EOT
-
-    arguments _("<search_term>")
-
-    when_invoked do |term, options|
-      Puppet.deprecation_warning(_("This action has been deprecated. Please use the Puppet Forge to search for modules."))
-      Puppet::ModuleTool.set_option_defaults options
-      Puppet::ModuleTool::Applications::Searcher.new(term, Puppet::Forge.new(options[:module_repository] || Puppet[:module_repository]), options).run
-    end
-
-    when_rendering :console do |results, term, options|
-      if results[:result] == :failure
-        raise results[:error][:multiline]
-      end
-
-      return _("No results found for '%{term}'.") % { term: term } if results[:answers].empty?
-
-      padding = '  '
-      headers = {
-        'full_name' => 'NAME',
-        'desc'      => 'DESCRIPTION',
-        'author'    => 'AUTHOR',
-        'tag_list'  => 'KEYWORDS',
-      }
-
-      min_widths = Hash[ *headers.map { |k,v| [k, v.length] }.flatten ]
-      min_widths['full_name'] = min_widths['author'] = 12
-
-      min_width = min_widths.inject(0) { |sum,pair| sum + pair.last } + (padding.length * (headers.length - 1))
-
-      terminal_width = [Puppet::Util::Terminal.width, min_width].max
-
-      columns = results[:answers].inject(min_widths) do |hash, result|
-        deprecated_buffer = result['deprecated_at'].nil? ? 0 : 11 # ' DEPRECATED'.length
-
-        {
-          'full_name' => [ hash['full_name'], result['full_name'].length + deprecated_buffer ].max,
-          'desc'      => [ hash['desc'],      result['desc'].length               ].max,
-          'author'    => [ hash['author'],    "@#{result['author']}".length       ].max,
-          'tag_list'  => [ hash['tag_list'],  result['tag_list'].join(' ').length ].max,
-        }
-      end
-
-      flex_width = terminal_width - columns['full_name'] - columns['author'] - (padding.length * (headers.length - 1))
-      tag_lists = results[:answers].map { |r| r['tag_list'] }
-
-      while (columns['tag_list'] > flex_width / 3)
-        longest_tag_list = tag_lists.sort_by { |tl| tl.join(' ').length }.last
-        break if [ [], [term] ].include? longest_tag_list
-        longest_tag_list.delete(longest_tag_list.sort_by { |t| t == term ? -1 : t.length }.last)
-        columns['tag_list'] =  tag_lists.map { |tl| tl.join(' ').length }.max
-      end
-
-      columns['tag_list'] = [
-        flex_width / 3,
-        tag_lists.map { |tl| tl.join(' ').length }.max,
-      ].max
-      columns['desc'] = flex_width - columns['tag_list']
-
-      format = %w{full_name desc author tag_list}.map do |k|
-        "%-#{ [ columns[k], min_widths[k] ].max }s"
-      end.join(padding) + "\n"
-
-      highlight = proc do |s|
-        s = s.gsub(term, colorize(:green, term))
-        s = s.gsub(term.tr('/', '-'), colorize(:green, term.tr('/', '-'))) if term =~ /\//
-        s = s.gsub(' DEPRECATED', colorize(:red, ' DEPRECATED'))
-        s
-      end
-
-      format % [ headers['full_name'], headers['desc'], headers['author'], headers['tag_list'] ] +
-      results[:answers].map do |match|
-        name, desc, author, keywords = %w{full_name desc author tag_list}.map { |k| match[k] }
-        name += ' DEPRECATED' unless match['deprecated_at'].nil?
-        desc = desc[0...(columns['desc'] - 3)] + '...' if desc.length > columns['desc']
-        highlight[format % [ name.sub('/', '-'), desc, "@#{author}", [keywords].flatten.join(' ') ]]
-      end.join
-    end
-
-    deprecate
-  end
-end

data/lib/puppet/face/status.rb

@@ -1,51 +0,0 @@
-require 'puppet/indirector/face'
-
-Puppet::Indirector::Face.define(:status, '0.0.1') do
-  copyright "Puppet Inc.", 2011
-  license   _("Apache 2 license; see COPYING")
-
-  summary _("View puppet server status.")
-
-  deactivate_action(:destroy)
-  deactivate_action(:save)
-  deactivate_action(:search)
-
-  find = get_action(:find)
-  find.default = true
-  find.summary _("Check status of puppet master server.")
-  #TRANSLATORS the string 'Puppet::Status' is a Puppet language object and should not be translated
-  find.returns _(<<-'EOT')
-    A "true" response or a low-level connection error. When used from the Ruby
-    API: returns a Puppet::Status object.
-  EOT
-  find.description <<-'EOT'
-    Checks whether a Puppet server is properly receiving and processing
-    HTTP requests. This action is only useful when used with '--terminus
-    rest'; when invoked with the `local` terminus, `find` will always
-    return true.
-
-    Over REST, this action will query the configured puppet master by default.
-    To query other servers, including puppet agent nodes started with the
-    <--listen> option, you can set the global <--server> and <--serverport>
-    options on the command line; note that agent nodes listen on port 8139.
-  EOT
-  find.short_description <<-EOT
-    Checks whether a Puppet server is properly receiving and processing HTTP
-    requests. This action is only useful when used with '--terminus rest',
-    and will always return true when invoked locally.
-  EOT
-  find.notes <<-'EOT'
-    This action requires that the server's `auth.conf` file allow find
-    access to the `status` REST terminus. Puppet agent does not use this
-    facility, and it is turned off by default. See
-    <https://puppet.com/docs/puppet/latest/config_file_auth.html>
-    for more details.
-  EOT
-  find.examples <<-'EOT'
-    Check the status of the configured puppet master:
-
-    $ puppet status find --terminus rest
-  EOT
-
-  deprecate
-end