puppet 6.4.5-universal-darwin → 6.5.0-universal-darwin

data/install.rb

@@ -62,6 +62,24 @@ def do_configs(configs, target, strip = 'conf/')
     ocf = File.join(InstallOptions.config_dir, cf.gsub(/#{strip}/, ''))
     FileUtils.install(cf, ocf, {:mode => 0644, :preserve => true, :verbose => true})
   end
+
+  if $operatingsystem == 'windows'
+    src_dll = 'ext/windows/eventlog/puppetres.dll'
+    dst_dll = File.join(InstallOptions.bin_dir, 'puppetres.dll')
+    FileUtils.install(src_dll, dst_dll, {:mode => 0644, :preserve => true, :verbose => true})
+
+    require 'win32/registry'
+    include Win32::Registry::Constants
+
+    begin
+      Win32::Registry::HKEY_LOCAL_MACHINE.create('SYSTEM\CurrentControlSet\services\eventlog\Application\Puppet', KEY_ALL_ACCESS | 0x0100) do |reg|
+        reg.write_s('EventMessageFile', dst_dll.tr('/', '\\'))
+        reg.write_i('TypesSupported', 0x7)
+      end
+    rescue Win32::Registry::Error => e
+      warn "Failed to create puppet eventlog registry key: #{e}"
+    end
+  end
 end
 
 def do_bins(bins, target, strip = 's?bin/')
@@ -122,12 +140,12 @@ def check_prereqs
         facter_version = Facter.version.to_f
         if facter_version < MIN_FACTER_VERSION
           puts "Facter version: #{facter_version}; minimum required: #{MIN_FACTER_VERSION}; cannot install"
-          exit(-1)
+          exit -1
         end
       end
     rescue LoadError
       puts "Could not load #{pre}; cannot install"
-      exit(-1)
+      exit -1
     end
   }
 end
@@ -248,7 +266,7 @@ def prepare_installation
       require 'win32/dir'
     rescue LoadError => e
       puts "Cannot run on Microsoft Windows without the win32-process, win32-dir & win32-service gems: #{e}"
-      exit(-1)
+      exit -1
     end
   end
 
@@ -437,13 +455,13 @@ def install_binfile(from, op_file, target)
   if $operatingsystem == "windows" && InstallOptions.batch_files
     installed_wrapper = false
 
-    unless File.extname(from) =~ /\.(cmd|bat)/
-      if File.exist?("#{from}.bat")
+    unless File.extname(from).match(/\.(cmd|bat)/)
+      if File.exists?("#{from}.bat")
         FileUtils.install("#{from}.bat", File.join(target, "#{op_file}.bat"), :mode => 0755, :preserve => true, :verbose => true)
         installed_wrapper = true
       end
 
-      if File.exist?("#{from}.cmd")
+      if File.exists?("#{from}.cmd")
         FileUtils.install("#{from}.cmd", File.join(target, "#{op_file}.cmd"), :mode => 0755, :preserve => true, :verbose => true)
         installed_wrapper = true
       end

data/lib/puppet.rb

@@ -209,8 +209,10 @@ module Puppet
       },
       :ssl_context => proc {
         begin
+          cert = Puppet::X509::CertProvider.new
+          password = cert.load_private_key_password
           ssl = Puppet::SSL::SSLProvider.new
-          ssl.load_context(certname: Puppet[:certname])
+          ssl.load_context(certname: Puppet[:certname], password: password)
         rescue => e
           # TRANSLATORS: `message` is an already translated string of why SSL failed to initialize
           Puppet.log_exception(e, _("Failed to initialize SSL: %{message}") % { message: e.message })

data/lib/puppet/application.rb

@@ -183,7 +183,7 @@ class Application
 
     # used to declare code that handle an option
     def option(*options, &block)
-      long = options.find { |opt| opt =~ /^--/ }.gsub(/^--(?:\[no-\])?([^ =]+).*$/, '\1' ).tr('-','_')
+      long = options.find { |opt| opt =~ /^--/ }.gsub(/^--(?:\[no-\])?([^ =]+).*$/, '\1' ).gsub('-','_')
       fname = "handle_#{long}".intern
       if (block_given?)
         define_method(fname, &block)

data/lib/puppet/application/agent.rb

@@ -347,45 +347,22 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       # Setup signal traps immediately after daemonization so we clean up the daemon
       daemon.set_signal_traps
 
-      log_config if Puppet[:daemonize]
-
-      wait_for_certificates
-
-      if Puppet[:onetime]
-        onetime(daemon)
-      else
-        main(daemon)
+      Puppet.override(ssl_context: wait_for_certificates) do
+        if Puppet[:onetime]
+          onetime(daemon)
+        else
+          main(daemon)
+        end
       end
     end
   end
 
-  def log_config
-    #skip also config reading and parsing if debug is not enabled
-    return unless Puppet::Util::Log.sendlevel?(:debug)
-
-    Puppet.settings.stringify_settings(:agent, :all).each_pair do |k,v|
-      next if k.include?("password") || v.to_s.empty?
-      Puppet.debug("Using setting: #{k}=#{v}")
-    end
-  end
-
   def fingerprint
-    Puppet::Util::Log.newdestination(:console)
-    cert_provider = Puppet::X509::CertProvider.new
-    client_cert = cert_provider.load_client_cert(Puppet[:certname])
-    if client_cert
-      puts Puppet::SSL::Digest.new(options[:digest].to_s, client_cert.to_der).to_s
-    else
-      csr = cert_provider.load_request(Puppet[:certname])
-      if csr
-        puts Puppet::SSL::Digest.new(options[:digest].to_s, csr.to_der).to_s
-      else
-        $stderr.puts _("Fingerprint asked but neither the certificate, nor the certificate request have been issued")
-        exit(1)
-      end
-    end
-  rescue => e
-    Puppet.log_exception(e, _("Failed to generate fingerprint: %{message}") % {message: e.message})
+    sm = Puppet::SSL::StateMachine.new(onetime: true)
+    ssl_context = sm.ensure_client_certificate
+    puts Puppet::SSL::Digest.new(options[:digest].to_s, ssl_context.client_cert.to_der).to_s
+  rescue
+    $stderr.puts _("Fingerprint asked but no certificate nor certificate request have yet been issued")
     exit(1)
   end
 

data/lib/puppet/application/apply.rb

@@ -72,15 +72,15 @@ manifests.
 
 OPTIONS
 -------
-Note that any setting that's valid in the configuration
-file is also a valid long argument. For example, 'tags' is a
+Any setting that's valid in the configuration
+file is a valid long argument for puppet apply. For example, 'tags' is a
 valid setting, so you can specify '--tags <class>,<tag>'
 as an argument.
 
 See the configuration file documentation at
 https://puppet.com/docs/puppet/latest/configuration.html for the
-full list of acceptable parameters. A commented list of all
-configuration options can also be generated by running puppet with
+full list of acceptable parameters. You can generate a commented list of all
+configuration options by running puppet with
 '--genconfig'.
 
 * --debug:
@@ -230,8 +230,8 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
         catalog =
         begin
           Puppet::Resource::Catalog.indirection.find(node.name, :use_node => node)
-        rescue Puppet::Error
-          # already logged and handled by the compiler, including Puppet::ParseErrorWithIssue
+        rescue Puppet::ParseErrorWithIssue, Puppet::Error
+          # already logged and handled by the compiler for these two cases
           exit(1)
         end
 

data/lib/puppet/application/describe.rb

@@ -64,7 +64,9 @@ class TypeDoc
 
   def list_types
     puts "These are the types known to puppet:\n"
-    @types.keys.sort_by(&:to_s).each do |name|
+    @types.keys.sort { |a, b|
+      a.to_s <=> b.to_s
+    }.each do |name|
       type = @types[name]
       s = type.doc.gsub(/\s+/, " ")
       n = s.index(". ")
@@ -147,14 +149,18 @@ class TypeDoc
   end
 
   def format_providers(type)
-    type.providers.sort_by(&:to_s).each { |prov|
+    type.providers.sort { |a,b|
+      a.to_s <=> b.to_s
+    }.each { |prov|
       puts "\n- **#{prov}**"
       puts @format.wrap(type.provider(prov).doc, :indent => 4, :scrub => true)
     }
   end
 
   def list_providers(type)
-    list = type.providers.sort_by(&:to_s).join(", ")
+    list = type.providers.sort { |a,b|
+      a.to_s <=> b.to_s
+    }.join(", ")
     puts @format.wrap(list, :indent => 4)
   end
 

data/lib/puppet/application/device.rb

@@ -238,7 +238,6 @@ Licensed under the Apache 2.0 License
     libdir = Puppet[:libdir]
     vardir = Puppet[:vardir]
     confdir = Puppet[:confdir]
-    ssldir = Puppet[:ssldir]
     certname = Puppet[:certname]
 
     env = Puppet::Node::Environment.remote(Puppet[:environment])
@@ -268,23 +267,15 @@ Licensed under the Apache 2.0 License
             port = ":#{device_url.port}" if device_url.port
 
             # override local $vardir and $certname
-            Puppet[:ssldir] = ::File.join(Puppet[:deviceconfdir], device.name, 'ssl')
             Puppet[:confdir] = ::File.join(Puppet[:devicedir], device.name)
             Puppet[:libdir] = options[:libdir] || ::File.join(Puppet[:devicedir], device.name, 'lib')
             Puppet[:vardir] = ::File.join(Puppet[:devicedir], device.name)
             Puppet[:certname] = device.name
             ssl_context = nil
 
-            # create device directory under $deviceconfdir
-            Puppet::FileSystem.dir_mkpath(Puppet[:ssldir]) unless Puppet::FileSystem.dir_exist?(Puppet[:ssldir])
-
             # this will reload and recompute default settings and create device-specific sub vardir
             Puppet.settings.use :main, :agent, :ssl
 
-            # Workaround for PUP-8736: store ssl certs outside the cache directory to prevent accidental removal and keep the old path as symlink
-            optssldir = File.join(Puppet[:confdir], 'ssl')
-            Puppet::FileSystem.symlink(Puppet[:ssldir], optssldir) unless Puppet::FileSystem.exist?(optssldir)
-
             unless options[:resource] || options[:facts] || options[:apply]
               # Since it's too complicated to fix properly in the default settings, we workaround for PUP-9642 here.
               # See https://github.com/puppetlabs/puppet/pull/7483#issuecomment-483455997 for details.
@@ -315,10 +306,10 @@ Licensed under the Apache 2.0 License
               Puppet.info _("retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}") % { resource: type, target: device.name, scheme: scheme, url_host: device_url.host, port: port, url_path: device_url.path }
               resources = find_resources(type, name)
               if options[:to_yaml]
-                data = resources.map do |resource|
-                  resource.prune_parameters(:parameters_to_include => @extra_params).to_hiera_hash
-                end.inject(:merge!)
-                text = YAML.dump(type.downcase => data)
+                text = resources.map do |resource|
+                  resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
+                end.join("\n")
+                text.prepend("#{type.downcase}:\n")
               else
                 text = resources.map do |resource|
                   resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)
@@ -368,7 +359,6 @@ Licensed under the Apache 2.0 License
             Puppet[:libdir] = libdir
             Puppet[:vardir] = vardir
             Puppet[:confdir] = confdir
-            Puppet[:ssldir] = ssldir
             Puppet[:certname] = certname
           end
         end

data/lib/puppet/application/doc.rb

@@ -155,7 +155,7 @@ HELP
     with_contents = options[:references].length <= 1
     exit_code = 0
     require 'puppet/util/reference'
-    options[:references].sort_by(&:to_s).each do |name|
+    options[:references].sort { |a,b| a.to_s <=> b.to_s }.each do |name|
       raise _("Could not find reference %{name}") % { name: name } unless section = Puppet::Util::Reference.reference(name)
 
       begin

data/lib/puppet/application/lookup.rb

@@ -33,7 +33,7 @@ class Puppet::Application::Lookup < Puppet::Application
     options[:prefix] = arg
   end
 
-  option('--sort-merge-arrays')
+  option('--sort-merged-arrays')
 
   option('--merge-hash-arrays')
 
@@ -283,7 +283,7 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
           'merge_hash_arrays' => !options[:merge_hash_arrays].nil?}
 
         if options[:prefix]
-          merge_options['knockout_prefix'] = options[:prefix]
+          merge_options.merge!({'knockout_prefix' => options[:prefix]})
         end
 
       else

data/lib/puppet/application/resource.rb

@@ -142,10 +142,10 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
       resources = find_or_save_resources(type, name, params)
 
     if options[:to_yaml]
-      data = resources.map do |resource|
-        resource.prune_parameters(:parameters_to_include => @extra_params).to_hiera_hash
-      end.inject(:merge!)
-      text = YAML.dump(type.downcase => data)
+      text = resources.map do |resource|
+        resource.prune_parameters(:parameters_to_include => @extra_params).to_hierayaml.force_encoding(Encoding.default_external)
+      end.join("\n")
+      text.prepend("#{type.downcase}:\n")
     else
       text = resources.map do |resource|
         resource.prune_parameters(:parameters_to_include => @extra_params).to_manifest.force_encoding(Encoding.default_external)

data/lib/puppet/application/script.rb

@@ -212,8 +212,8 @@ Copyright (c) 2017 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
           compiler.compile()
 
-        rescue Puppet::Error
-          # already logged and handled by the compiler, including Puppet::ParseErrorWithIssue
+        rescue Puppet::ParseErrorWithIssue, Puppet::Error
+          # already logged and handled by the compiler for these two cases
           exit(1)
         end
 

data/lib/puppet/application/ssl.rb

@@ -112,8 +112,6 @@ HELP
       Puppet.settings.use(:main, :agent)
     end
 
-    Puppet::SSL::Oids.register_puppet_oids
-
     certname = Puppet[:certname]
     action = command_line.args.first
     case action
@@ -149,8 +147,13 @@ HELP
   def submit_request(ssl_context)
     key = @cert_provider.load_private_key(Puppet[:certname])
     unless key
-      Puppet.info _("Creating a new SSL key for %{name}") % { name: Puppet[:certname] }
-      key = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
+      if Puppet[:key_type] == 'ec'
+        Puppet.info _("Creating a new EC SSL key for %{name} using curve %{curve}") % { name: Puppet[:certname], curve: Puppet[:named_curve] }
+        key = OpenSSL::PKey::EC.generate(Puppet[:named_curve])
+      else
+        Puppet.info _("Creating a new SSL key for %{name}") % { name: Puppet[:certname] }
+        key = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
+      end
       @cert_provider.save_private_key(Puppet[:certname], key)
     end
 
@@ -203,7 +206,8 @@ HELP
   end
 
   def verify(certname)
-    ssl_context = @ssl_provider.load_context(certname: certname)
+    password = @cert_provider.load_private_key_password
+    ssl_context = @ssl_provider.load_context(certname: certname, password: password)
 
     # print from root to client
     ssl_context.client_chain.reverse.each_with_index do |cert, i|
@@ -249,10 +253,7 @@ END
       'certificate' => Puppet[:hostcert],
       'private key password file' => Puppet[:passfile]
     }
-    if options[:localca]
-      paths['local CA certificate'] = Puppet[:localcacert]
-      paths['local CRL'] = Puppet[:hostcrl]
-    end
+    paths.merge!('local CA certificate' => Puppet[:localcacert], 'local CRL' => Puppet[:hostcrl]) if options[:localca]
     paths.each_pair do |label, path|
       if Puppet::FileSystem.exist?(path)
         Puppet::FileSystem.unlink(path)

data/lib/puppet/configurer.rb

@@ -148,10 +148,9 @@ class Puppet::Configurer
     facts_hash
   end
 
-  def prepare_and_retrieve_catalog(cached_catalog, options, query_options)
+  def prepare_and_retrieve_catalog(options, query_options)
     # set report host name now that we have the fact
     options[:report].host = Puppet[:node_name_value]
-
     query_options[:transaction_uuid] = @transaction_uuid
     query_options[:job_id] = @job_id
     query_options[:static_catalog] = @static_catalog
@@ -161,19 +160,26 @@ class Puppet::Configurer
     query_options[:checksum_type] = @checksum_type.join('.')
 
     # apply passes in ral catalog
-    catalog = cached_catalog || options[:catalog]
-    unless catalog
-      # retrieve_catalog returns resource catalog
-      catalog = retrieve_catalog(query_options)
-      Puppet.err _("Could not retrieve catalog; skipping run") unless catalog
-    end
-    catalog
+    catalog = options.delete(:catalog)
+    return catalog if catalog
+
+    # retrieve_catalog returns json catalog
+    catalog = retrieve_catalog(query_options)
+    return convert_catalog(catalog, @duration, options) if catalog
+
+    Puppet.err _("Could not retrieve catalog; skipping run")
+    nil
   end
 
   def prepare_and_retrieve_catalog_from_cache(options = {})
     result = retrieve_catalog_from_cache({:transaction_uuid => @transaction_uuid, :static_catalog => @static_catalog})
-    Puppet.info _("Using cached catalog from environment '%{catalog_env}'") % { catalog_env: result.environment } if result
-    result
+    if result
+      Puppet.info _("Using cached catalog from environment '%{catalog_env}'") % { catalog_env: result.environment }
+      # get facts now so that the convert_catalog method can resolve deferred values
+      get_facts(options)
+      return convert_catalog(result, @duration, options)
+    end
+    nil
   end
 
   # Apply supplied catalog and return associated application report
@@ -251,12 +257,13 @@ class Puppet::Configurer
       Puppet::GettextConfig.reset_text_domain('agent')
       Puppet::ModuleTranslations.load_from_vardir(Puppet[:vardir])
 
-      if cached_catalog = prepare_and_retrieve_catalog_from_cache(options)
+      if catalog = prepare_and_retrieve_catalog_from_cache(options)
+        options[:catalog] = catalog
         @cached_catalog_status = 'explicitly_requested'
 
-        if @environment != cached_catalog.environment && !Puppet[:strict_environment_mode]
-          Puppet.notice _("Local environment: '%{local_env}' doesn't match the environment of the cached catalog '%{catalog_env}', switching agent to '%{catalog_env}'.") % { local_env: @environment, catalog_env: cached_catalog.environment }
-          @environment = cached_catalog.environment
+        if @environment != catalog.environment && !Puppet[:strict_environment_mode]
+          Puppet.notice _("Local environment: '%{local_env}' doesn't match the environment of the cached catalog '%{catalog_env}', switching agent to '%{catalog_env}'.") % { local_env: @environment, catalog_env: catalog.environment }
+          @environment = catalog.environment
         end
 
         report.environment = @environment
@@ -277,7 +284,7 @@ class Puppet::Configurer
       configured_environment = Puppet[:environment] if Puppet.settings.set_by_config?(:environment)
 
       # We only need to find out the environment to run in if we don't already have a catalog
-      unless (cached_catalog || options[:catalog] || Puppet[:strict_environment_mode])
+      unless (options[:catalog] || Puppet[:strict_environment_mode])
         begin
           node = nil
           node_retr_time = thinmark do
@@ -332,7 +339,7 @@ class Puppet::Configurer
       query_options[:configured_environment] = configured_environment
       options[:convert_for_node] = node
 
-      unless catalog = prepare_and_retrieve_catalog(cached_catalog, options, query_options)
+      unless catalog = prepare_and_retrieve_catalog(options, query_options)
         return nil
       end
 
@@ -357,37 +364,16 @@ class Puppet::Configurer
         query_options = get_facts(options)
         query_options[:configured_environment] = configured_environment
 
-        # if we get here, ignore the cached catalog
-        return nil unless catalog = prepare_and_retrieve_catalog(nil, options, query_options)
+        return nil unless catalog = prepare_and_retrieve_catalog(options, query_options)
         tries += 1
       end
 
-      # now that environment has converged, convert resource catalog into ral catalog
-      # unless we were given a RAL catalog
-      if !cached_catalog && options[:catalog]
-        ral_catalog = options[:catalog]
-      else
-        # REMIND @duration is the time spent loading the last catalog, and doesn't
-        # account for things like we failed to download and fell back to the cache
-        ral_catalog = convert_catalog(catalog, @duration, options)
-
-        # If not noop, commit the cached resource catalog (not ral catalog). Ideally
-        # we'd just copy the downloaded response body, instead of serializing the
-        # in-memory catalog, but that's hard due to the indirector.
-        indirection = Puppet::Resource::Catalog.indirection
-        if !Puppet[:noop] && indirection.cache?
-          request = indirection.request(:save, nil, catalog, environment: Puppet::Node::Environment.remote(catalog.environment))
-          Puppet.info("Caching catalog for #{request.key}")
-          indirection.cache.save(request)
-        end
-      end
-
       execute_prerun_command or return nil
 
-      options[:report].code_id = ral_catalog.code_id
-      options[:report].catalog_uuid = ral_catalog.catalog_uuid
+      options[:report].code_id = catalog.code_id
+      options[:report].catalog_uuid = catalog.catalog_uuid
       options[:report].cached_catalog_status = @cached_catalog_status
-      apply_catalog(ral_catalog, options)
+      apply_catalog(catalog, options)
       true
     rescue => detail
       Puppet.log_exception(detail, _("Failed to apply catalog: %{detail}") % { detail: detail })
@@ -396,14 +382,6 @@ class Puppet::Configurer
       execute_postrun_command or return nil
     end
   ensure
-    if Puppet[:resubmit_facts]
-      # TODO: Should mark the report as "failed" if an error occurs and
-      #       resubmit_facts returns false. There is currently no API for this.
-      resubmit_facts_time = thinmark { resubmit_facts }
-
-      report.add_times(:resubmit_facts, resubmit_facts_time)
-    end
-
     report.cached_catalog_status ||= @cached_catalog_status
     report.add_times(:total, Time.now - start)
     report.finalize_report
@@ -451,40 +429,6 @@ class Puppet::Configurer
     Puppet.log_exception(detail, _("Could not save last run local report: %{detail}") % { detail: detail })
   end
 
-  # Submit updated facts to the Puppet Server
-  #
-  # This method will clear all current fact values, load a fresh set of
-  # fact data, and then submit it to the Puppet Server.
-  #
-  # @return [true] If fact submission succeeds.
-  # @return [false] If an exception is raised during fact generation or
-  #   submission.
-  def resubmit_facts
-    ::Facter.clear
-    facts = find_facts
-
-    saved_fact_terminus = Puppet::Node::Facts.indirection.terminus_class
-    begin
-      Puppet::Node::Facts.indirection.terminus_class = :rest
-
-      server = Puppet::Node::Facts::Rest.server
-      Puppet.info(_("Uploading facts for %{node} to %{server}") % {
-                    node: facts.name,
-                    server: server})
-
-      Puppet::Node::Facts.indirection.save(facts, nil, :environment => Puppet::Node::Environment.remote(@environment))
-
-      return true
-    ensure
-      Puppet::Node::Facts.indirection.terminus_class = saved_fact_terminus
-    end
-  rescue => detail
-    Puppet.log_exception(detail, _("Failed to submit facts: %{detail}") %
-                                 { detail: detail })
-
-    return false
-  end
-
   private
 
   def execute_from_setting(setting)
@@ -523,8 +467,8 @@ class Puppet::Configurer
         Puppet[:node_name_value],
         query_options.merge(
           :ignore_cache      => true,
-          # don't update cache until after environment converges
-          :ignore_cache_save => true,
+          # We never want to update the cached Catalog if we're running in noop mode.
+          :ignore_cache_save => Puppet[:noop],
           :environment       => Puppet::Node::Environment.remote(@environment),
           :fail_on_404       => true
         )