puppet 6.4.0-universal-darwin → 6.4.1-universal-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c04885016a32e35902f8c53e594bcb39acd6ce3cbd6e4cc9264cb1822b5e6d9a
-  data.tar.gz: ac73c8d1d01ece6e6451061ec0ea15fc403991e0a31743fa0f2267e3a614cf10
+  metadata.gz: f25643d2940d8ccf7e9fd83059ef0adb73a4bb3e4b4304e72377e4dff2afea4b
+  data.tar.gz: 7e3a528903f8d67401e230208e5f6420760633896b23e49ef02c8debe3d1c5d8
 SHA512:
-  metadata.gz: 9cf129d33e6917b71f9bfe8a715edd5d747ea142a2e82f013c92f85991c2a6ff36352e349e178103729e1c6a207917b11053df0fa0a6dbbe031285e08bb54ee4
-  data.tar.gz: 03d77cf023b4985f3b7077d3f719be6199c7ca92b9290a9162590efa630e2eb8ed580693cd57c121d2444c8c8182ad7d08b0e45f64ff89eb5a720880d1ab8a41
+  metadata.gz: e8ea2b704c94ebf68853730fd0c3cc4a33567cd053ca256d1105dc83f0934175fdc7f0b55a972f9a71fe52e6a6e069907b474bd92790dc9d46f41c54f7a51c9e
+  data.tar.gz: 9f7b3d201a5ca9f17345eac9d342452ce1e12dd7c5a027c430f6fe14b79de6da1e16dc0d1b6e30fbaa9234cc98e6507641241c77fa3a91410346428f4445759c

data/Gemfile

@@ -36,7 +36,6 @@ end
 
 group(:test) do
   gem "json-schema", "~> 2.0", require: false
-  gem "mocha", '~> 1.5.0', require: false
   gem "rake", *location_for(ENV['RAKE_LOCATION'] || '~> 12.2')
   gem "rspec", "~> 3.1", require: false
   gem "rspec-its", "~> 1.1", require: false

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    puppet (6.4.0)
+    puppet (6.4.1)
       CFPropertyList (~> 2.2)
       facter (>= 2.4.0, < 4)
       fast_gettext (~> 1.1.2)
@@ -44,21 +44,18 @@ GEM
     json-schema (2.8.1)
       addressable (>= 2.4)
     locale (2.1.2)
-    memory_profiler (0.9.12)
-    metaclass (0.0.4)
+    memory_profiler (0.9.13)
     method_source (0.9.2)
     minitar (0.8)
-    mocha (1.5.0)
-      metaclass (~> 0.0.1)
     msgpack (1.2.9)
     multi_json (1.13.1)
     mustache (1.1.0)
     optimist (3.0.0)
-    packaging (0.99.24)
+    packaging (0.99.27)
       artifactory (~> 2)
       rake (~> 12.3)
-    parallel (1.14.0)
-    parser (2.6.2.0)
+    parallel (1.17.0)
+    parser (2.6.2.1)
       ast (~> 2.4.0)
     powerpack (0.1.2)
     pry (0.12.2)
@@ -90,7 +87,7 @@ GEM
     rspec-expectations (3.8.2)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.8.0)
-    rspec-its (1.2.0)
+    rspec-its (1.3.0)
       rspec-core (>= 3.0.0)
       rspec-expectations (>= 3.0.0)
     rspec-mocks (3.8.0)
@@ -117,7 +114,7 @@ GEM
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff
-    yard (0.9.18)
+    yard (0.9.19)
 
 PLATFORMS
   ruby
@@ -130,7 +127,6 @@ DEPENDENCIES
   json-schema (~> 2.0)
   memory_profiler
   minitar (~> 0.6)
-  mocha (~> 1.5.0)
   msgpack (~> 1.2)
   packaging (~> 0.99)
   pry

data/lib/puppet/application/device.rb

@@ -257,87 +257,101 @@ Licensed under the Apache 2.0 License
         end
       end
       devices.collect do |devicename,device|
-        begin
-          device_url = URI.parse(device.url)
-          # Handle nil scheme & port
-          scheme = "#{device_url.scheme}://" if device_url.scheme
-          port = ":#{device_url.port}" if device_url.port
-
-          # override local $vardir and $certname
-          Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
-          Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
-          Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
-          Puppet[:certname] = device.name
-
-          unless options[:resource] || options[:facts] || options[:apply] || options[:libdir]
-            Puppet::Configurer::PluginHandler.new.download_plugins(env)
-          end
-          # this init the device singleton, so that the facts terminus
-          # and the various network_device provider can use it
-          Puppet::Util::NetworkDevice.init(device)
-
-          if options[:resource]
-            type, name = parse_args(command_line.args)
-            Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-            resources = find_resources(type, name)
-            if options[:to_yaml]
-              text = resources.map do |resource|
-                resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
-              end.join("\n")
-              text.prepend("#{type.downcase}:\n")
-            else
-              text = resources.map do |resource|
-                resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
-              end.join("\n")
-            end
-            (puts text)
-            0
-          elsif options[:facts]
-            Puppet.info _("retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-            remote_facts = Puppet::Node::Facts.indirection.find(name, :environment => env)
-            # Give a proper name to the facts
-            remote_facts.name = remote_facts.values['clientcert']
-            renderer = Puppet::Network::FormatHandler.format(:console)
-            puts renderer.render(remote_facts)
-            0
-          elsif options[:apply]
-            # ensure we have a cache folder structure exists for the device
-            FileUtils.mkdir_p(Puppet[:statedir]) unless File.directory?(Puppet[:statedir])
-            # avoid reporting to server
-            Puppet::Transaction::Report.indirection.terminus_class = :yaml
-            Puppet::Resource::Catalog.indirection.cache_class = nil
-
-            require 'puppet/application/apply'
-            begin
-              Puppet[:node_terminus] = :plain
-              Puppet[:catalog_terminus] = :compiler
-              Puppet[:catalog_cache_terminus] = nil
-              Puppet[:facts_terminus] = :network_device
-              Puppet.override(:network_device => true) do
-                Puppet::Application::Apply.new(Puppet::Util::CommandLine.new('puppet', ["apply", options[:apply]])).run_command
+        pool = Puppet::Network::HTTP::Pool.new(Puppet[:http_keepalive_timeout])
+        Puppet.override(:http_pool => pool) do
+          # TODO when we drop support for ruby < 2.5 we can remove the extra block here
+          begin
+            device_url = URI.parse(device.url)
+            # Handle nil scheme & port
+            scheme = "#{device_url.scheme}://" if device_url.scheme
+            port = ":#{device_url.port}" if device_url.port
+
+            # override local $vardir and $certname
+            Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
+            Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
+            Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
+            Puppet[:certname] = device.name
+            ssl_context = nil
+
+            # this will reload and recompute default settings and create device-specific sub vardir
+            Puppet.settings.use :main, :agent, :ssl
+
+            unless options[:resource] || options[:facts] || options[:apply]
+              # ask for a ssl cert if needed, but at least
+              # setup the ssl system for this device.
+              ssl_context = setup_context
+
+              unless options[:libdir]
+                Puppet.override(ssl_context: ssl_context) do
+                  Puppet::Configurer::PluginHandler.new.download_plugins(env) if Puppet::Configurer.should_pluginsync?
+                end
               end
             end
-          else
-            Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
-            # this will reload and recompute default settings and create the devices sub vardir
-            Puppet.settings.use :main, :agent, :ssl
-            # ask for a ssl cert if needed, but at least
-            # setup the ssl system for this device.
-            setup_host(device.name)
 
-            require 'puppet/configurer'
-            configurer = Puppet::Configurer.new
-            configurer.run(:network_device => true, :pluginsync => Puppet::Configurer.should_pluginsync? && !options[:libdir])
+            # this init the device singleton, so that the facts terminus
+            # and the various network_device provider can use it
+            Puppet::Util::NetworkDevice.init(device)
+
+            if options[:resource]
+              type, name = parse_args(command_line.args)
+              Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+              resources = find_resources(type, name)
+              if options[:to_yaml]
+                text = resources.map do |resource|
+                  resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
+                end.join("\n")
+                text.prepend("#{type.downcase}:\n")
+              else
+                text = resources.map do |resource|
+                  resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
+                end.join("\n")
+              end
+              (puts text)
+              0
+            elsif options[:facts]
+              Puppet.info _("retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+              remote_facts = Puppet::Node::Facts.indirection.find(name, :environment => env)
+              # Give a proper name to the facts
+              remote_facts.name = remote_facts.values['clientcert']
+              renderer = Puppet::Network::FormatHandler.format(:console)
+              puts renderer.render(remote_facts)
+              0
+            elsif options[:apply]
+              # avoid reporting to server
+              Puppet::Transaction::Report.indirection.terminus_class = :yaml
+              Puppet::Resource::Catalog.indirection.cache_class = nil
+
+              require 'puppet/application/apply'
+              begin
+                Puppet[:node_terminus] = :plain
+                Puppet[:catalog_terminus] = :compiler
+                Puppet[:catalog_cache_terminus] = nil
+                Puppet[:facts_terminus] = :network_device
+                Puppet.override(:network_device => true) do
+                  Puppet::Application::Apply.new(Puppet::Util::CommandLine.new('puppet', ["apply", options[:apply]])).run_command
+                end
+              end
+            else
+              Puppet.info _("starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
+
+              overrides = {}
+              overrides[:ssl_context] = ssl_context if ssl_context
+              Puppet.override(overrides) do
+                configurer = Puppet::Configurer.new
+                configurer.run(:network_device => true, :pluginsync => false)
+              end
+            end
+          rescue => detail
+            Puppet.log_exception(detail)
+            # If we rescued an error, then we return 1 as the exit code
+            1
+          ensure
+            pool.close
+            Puppet[:libdir] = libdir
+            Puppet[:vardir] = vardir
+            Puppet[:confdir] = confdir
+            Puppet[:certname] = certname
           end
-        rescue => detail
-          Puppet.log_exception(detail)
-          # If we rescued an error, then we return 1 as the exit code
-          1
-        ensure
-          Puppet[:libdir] = libdir
-          Puppet[:vardir] = vardir
-          Puppet[:confdir] = confdir
-          Puppet[:certname] = certname
         end
       end
     end
@@ -372,17 +386,20 @@ Licensed under the Apache 2.0 License
     end
   end
 
-  def setup_host(name)
+  def setup_context
     waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : Puppet[:waitforcert])
-    sm = Puppet::SSL::StateMachine.new(certname: name, waitforcert: waitforcert)
+    sm = Puppet::SSL::StateMachine.new(waitforcert: waitforcert)
     sm.ensure_client_certificate
   end
 
   def setup
     setup_logs
+
+    # setup global device-specific defaults; creates all necessary directories, etc
+    Puppet.settings.use :main, :agent, :device, :ssl
+
     if options[:apply] || options[:facts] || options[:resource]
       Puppet::Util::Log.newdestination(:console)
-      Puppet.settings.use :main, :agent, :ssl
     else
       args[:Server] = Puppet[:server]
       if options[:centrallogs]
@@ -392,8 +409,6 @@ Licensed under the Apache 2.0 License
         Puppet::Util::Log.newdestination(logdest)
       end
 
-      Puppet.settings.use :main, :agent, :device, :ssl
-
       Puppet::Transaction::Report.indirection.terminus_class = :rest
 
       if Puppet[:catalog_cache_terminus]

data/lib/puppet/application/filebucket.rb

@@ -289,11 +289,15 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       else
         if Puppet[:server_list] && !Puppet[:server_list].empty?
           server = Puppet[:server_list].first
+          #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+          Puppet.debug _("Selected server from first entry of the `server_list` setting: %{server}:%{port}") % {server: server[0], port: server[1]}
           @client = Puppet::FileBucket::Dipper.new(
             :Server => server[0],
             :Port => server[1]
           )
         else
+          #TRANSLATORS 'server' is the name of a setting and should not be translated
+          Puppet.debug _("Selected server from the `server` setting: %{server}") % {server: Puppet[:server]}
           @client = Puppet::FileBucket::Dipper.new(:Server => Puppet[:server])
         end
       end

data/lib/puppet/application/ssl.rb

@@ -207,9 +207,9 @@ HELP
     ssl_context.client_chain.reverse.each_with_index do |cert, i|
       digest = Puppet::SSL::Digest.new('SHA256', cert.to_der)
       if i == ssl_context.client_chain.length - 1
-        Puppet.notice("Verified client certificate '#{cert.subject.to_s}' fingerprint #{digest}")
+        Puppet.notice("Verified client certificate '#{cert.subject.to_utf8}' fingerprint #{digest}")
       else
-        Puppet.notice("Verified CA certificate '#{cert.subject.to_s}' fingerprint #{digest}")
+        Puppet.notice("Verified CA certificate '#{cert.subject.to_utf8}' fingerprint #{digest}")
       end
     end
   end

data/lib/puppet/configurer.rb

@@ -229,7 +229,8 @@ class Puppet::Configurer
           if server.nil?
             raise Puppet::Error, _("Could not select a functional puppet master from server_list: '%{server_list}'") % { server_list: Puppet[:server_list] }
           else
-            Puppet.debug _("Selected puppet server: %{server}:%{port}") % { server: server, port: port }
+            #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+            Puppet.debug _("Selected puppet server from the `server_list` setting: %{server}:%{port}") % { server: server, port: port }
             report.master_used = "#{server}:#{port}"
           end
           Puppet.override(server: server, serverport: port) do
@@ -402,9 +403,9 @@ class Puppet::Configurer
 
         Puppet.debug(_("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %
                      { host: host, port: port, code: response.code, reason: response.message })
-      rescue
-        # Nothing to see here
-        Puppet.debug(_("Puppet server %{host}:%{port} is unreachable") % { host: host, port: port })
+      rescue => detail
+        #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+        Puppet.debug _("Unable to connect to server from server_list setting: %{detail}") % {detail: detail}
       end
     end
     [nil, nil]

data/lib/puppet/defaults.rb

@@ -606,14 +606,28 @@ module Puppet
       :type       => :duration,
       :desc       => "The minimum time to wait between checking for updates in
       configuration files.  This timeout determines how quickly Puppet checks whether
-      a file (such as manifests or templates) has changed on disk. #{AS_DURATION}",
+      a file (such as manifests or puppet.conf) has changed on disk. The default will
+      change in a future release to be 'unlimited', requiring a reload of the Puppet
+      service to pick up changes to its internal configuration. Currently we do not
+      accept a value of 'unlimited'. To reparse files within an environment in
+      Puppet Server please use the environment_cache endpoint",
+      :hook => proc do |val|
+        unless [0, 15, '15s'].include?(val)
+          Puppet.deprecation_warning(<<-WARNING)
+Fine grained control of filetimeouts is deprecated. In future
+releases this value will only determine if file content is cached.
+
+Valid values are 0 (never cache) and 15 (15 second minimum wait time).
+            WARNING
+        end
+      end
     },
     :environment_timeout => {
       :default    => "0",
       :type       => :ttl,
       :desc       => "How long the Puppet master should cache data it loads from an
       environment.
-      #{AS_DURATION}
+
       A value of `0` will disable caching. This setting can also be set to
       `unlimited`, which will cache environments until the master is restarted
       or told to refresh the cache.
@@ -629,15 +643,21 @@ module Puppet
       * With Puppet Server, you should refresh environments by calling the
         `environment-cache` API endpoint. See the docs for the Puppet Server
         administrative API.
-      * With a Rack Puppet master, you should restart the web server or the
-        application server. Passenger lets you touch a `restart.txt` file to
-        refresh an application without restarting Apache; see the Passenger docs
-        for details.
 
-      We don't recommend using any value other than `0` or `unlimited`, since
-      most Puppet masters use a pool of Ruby interpreters which all have their
-      own cache timers. When these timers drift out of sync, agents can be served
-      inconsistent catalogs."
+      Any value other than `0` or `unlimited` is deprecated, since most Puppet
+      servers use a pool of Ruby interpreters which all have their own cache
+      timers. When these timers drift out of sync, agents can be served
+      inconsistent catalogs.",
+      :hook => proc do |val|
+        unless [0, 'unlimited', Float::INFINITY].include?(val)
+          Puppet.deprecation_warning(<<-WARNING)
+Fine grained control of environment timeouts is deprecated,
+please use `0` or `unlimited` to control default caching behavior
+and the environment-cache endpoint in Puppet Server's administrative
+API to expire the cache as needed
+          WARNING
+        end
+      end
     },
     :environment_data_provider => {
       :desc       => "The name of a registered environment data provider used when obtaining environment
@@ -1055,7 +1075,9 @@ EOT
     :allow_duplicate_certs => {
       :default    => false,
       :type       => :boolean,
-      :desc       => "Whether to allow a new certificate request to overwrite an existing certificate.",
+      :desc       => "Whether to allow a new certificate request to overwrite an existing
+        certificate request. If true, then the old certificate must be cleaned using
+        `puppetserver ca clean`, and the new request signed using `puppetserver ca sign`."
     },
     :ca_ttl => {
       :default    => "5y",

data/lib/puppet/indirector/request.rb

@@ -3,12 +3,14 @@ require 'uri'
 require 'puppet/indirector'
 require 'puppet/network/resolver'
 require 'puppet/util/psych_support'
+require 'puppet/util/warnings'
 
 # This class encapsulates all of the information you need to make an
 # Indirection call, and as a result also handles REST calls.  It's somewhat
 # analogous to an HTTP Request object, except tuned for our Indirector.
 class Puppet::Indirector::Request
   include Puppet::Util::PsychSupport
+  include Puppet::Util::Warnings
 
   attr_accessor :key, :method, :options, :instance, :node, :ip, :authenticated, :ignore_cache, :ignore_cache_save, :ignore_terminus
 
@@ -200,26 +202,37 @@ class Puppet::Indirector::Request
       end
     end
 
-    # ... Fall back onto the default server.
-    bound_server = Puppet.lookup(:server) do
-      if primary_server = Puppet.settings[:server_list][0]
-        primary_server[0]
-      else
-        Puppet.settings[:server]
+    if default_server
+      self.server = default_server
+    else
+      self.server = Puppet.lookup(:server) do
+        if primary_server = Puppet.settings[:server_list][0]
+          #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+          debug_once _("Selected server from first entry of the `server_list` setting: %{server}") % {server: primary_server[0]}
+          primary_server[0]
+        else
+          #TRANSLATORS 'server' is the name of a setting and should not be translated
+          debug_once _("Selected server from the `server` setting: %{server}") % {server: Puppet.settings[:server]}
+          Puppet.settings[:server]
+        end
       end
     end
 
-    bound_port = Puppet.lookup(:serverport) do
-      if primary_server = Puppet.settings[:server_list][0]
-        primary_server[1]
-      else
-        Puppet.settings[:masterport]
+    if default_port
+      self.port = default_port
+    else
+      self.port = Puppet.lookup(:serverport) do
+        if primary_server = Puppet.settings[:server_list][0]
+          #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+          debug_once _("Selected port from the first entry of the `server_list` setting: %{port}") % {port: primary_server[1]}
+          primary_server[1]
+        else
+          #TRANSLATORS 'masterport' is the name of a setting and should not be translated
+          debug_once _("Selected port from the `masterport` setting: %{port}") % {port: Puppet.settings[:masterport]}
+          Puppet.settings[:masterport]
+        end
       end
     end
-    self.server = default_server || bound_server
-    self.port   = default_port || bound_port
-
-    Puppet.debug "No more servers left, falling back to #{self.server}:#{self.port}" if Puppet.settings[:use_srv_records]
 
     return yield(self)
   end