puppet 6.7.2 → 6.8.0

data/lib/puppet/util/windows/security.rb

@@ -200,6 +200,7 @@ module Puppet::Util::Windows::Security
     well_known_world_sid = Puppet::Util::Windows::SID::Everyone
     well_known_nobody_sid = Puppet::Util::Windows::SID::Nobody
     well_known_system_sid = Puppet::Util::Windows::SID::LocalSystem
+    well_known_app_packages_sid = Puppet::Util::Windows::SID::AllAppPackages
 
     mode = S_ISYSTEM_MISSING
 
@@ -234,6 +235,7 @@ module Puppet::Util::Windows::Security
         if (ace.mask & FILE::FILE_APPEND_DATA).nonzero?
           mode |= S_ISVTX
         end
+      when well_known_app_packages_sid
       when well_known_system_sid
       else
         #puts "Warning, unable to map SID into POSIX mode: #{ace.sid}"

data/lib/puppet/util/windows/sid.rb

@@ -46,6 +46,7 @@ module Puppet::Util::Windows
     PrintOperators              = 'S-1-5-32-550'
     BackupOperators             = 'S-1-5-32-551'
     Replicators                 = 'S-1-5-32-552'
+    AllAppPackages              = 'S-1-15-2-1'
 
     # Convert an account name, e.g. 'Administrators' into a SID string,
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '6.7.2'
+  PUPPETVERSION = '6.8.0'
 
   ##
   # version is a public API method intended to always provide a fast and

data/lib/puppet/x509/cert_provider.rb

@@ -191,22 +191,20 @@ class Puppet::X509::CertProvider
     # and corrected in https://github.com/ruby/openssl/commit/a896c3d1dfa090e92dec1abf8ac12843af6af721
     password ||= '    '
 
-    if Puppet::Util::Platform.jruby?
-      begin
-        if pem =~ EC_HEADER
-          OpenSSL::PKey::EC.new(pem, password)
-        else
-          OpenSSL::PKey::RSA.new(pem, password)
-        end
-      rescue OpenSSL::PKey::PKeyError => e
-        if e.message =~ /Neither PUB key nor PRIV key/
-          raise OpenSSL::PKey::PKeyError, "Could not parse PKey: no start line"
-        else
-          raise e
-        end
+    # Can't use OpenSSL::PKey.read, because it's broken in MRI 2.3, doesn't exist
+    # in JRuby 9.1, and is broken in JRuby 9.2
+    begin
+      if pem =~ EC_HEADER
+        OpenSSL::PKey::EC.new(pem, password)
+      else
+        OpenSSL::PKey::RSA.new(pem, password)
+      end
+    rescue OpenSSL::PKey::PKeyError => e
+      if e.message =~ /Neither PUB key nor PRIV key/
+        raise OpenSSL::PKey::PKeyError, "Could not parse PKey: no start line"
+      else
+        raise e
       end
-    else
-      OpenSSL::PKey.read(pem, password)
     end
   end
 

data/locales/puppet.pot

@@ -6,11 +6,11 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Puppet automation framework 6.6.0-15-gcd8d2d0\n"
+"Project-Id-Version: Puppet automation framework 6.7.1-42-gc60d6aa\n"
 "\n"
 "Report-Msgid-Bugs-To: https://tickets.puppetlabs.com\n"
-"POT-Creation-Date: 2019-06-28 23:18+0000\n"
-"PO-Revision-Date: 2019-06-28 23:18+0000\n"
+"POT-Creation-Date: 2019-07-25 21:35+0000\n"
+"PO-Revision-Date: 2019-07-25 21:35+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
@@ -182,19 +182,19 @@ msgstr ""
 msgid "The puppet agent daemon"
 msgstr ""
 
-#: ../lib/puppet/application/agent.rb:371
+#: ../lib/puppet/application/agent.rb:375
 msgid "Fingerprint asked but neither the certificate, nor the certificate request have been issued"
 msgstr ""
 
-#: ../lib/puppet/application/agent.rb:376
+#: ../lib/puppet/application/agent.rb:380
 msgid "Failed to generate fingerprint: %{message}"
 msgstr ""
 
-#: ../lib/puppet/application/agent.rb:399
+#: ../lib/puppet/application/agent.rb:403
 msgid "Starting Puppet client version %{version}"
 msgstr ""
 
-#: ../lib/puppet/application/agent.rb:415
+#: ../lib/puppet/application/agent.rb:419
 msgid "The puppet agent command does not take parameters"
 msgstr ""
 
@@ -479,7 +479,7 @@ msgstr ""
 msgid "Creating a new EC SSL key for %{name} using curve %{curve}"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:156 ../lib/puppet/ssl/key.rb:24
+#: ../lib/puppet/application/ssl.rb:156 ../lib/puppet/ssl/key.rb:26
 msgid "Creating a new SSL key for %{name}"
 msgstr ""
 
@@ -716,7 +716,11 @@ msgstr ""
 msgid "Certificate names must be lower case"
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:1010 ../lib/puppet/settings/enum_setting.rb:13 ../lib/puppet/settings/symbolic_enum_setting.rb:14
+#: ../lib/puppet/defaults.rb:934
+msgid "Setting 'ssl_client_ca_auth' is deprecated."
+msgstr ""
+
+#: ../lib/puppet/defaults.rb:1013 ../lib/puppet/settings/enum_setting.rb:13 ../lib/puppet/settings/symbolic_enum_setting.rb:14
 msgid "Invalid value '%{value}' for parameter %{name}. Allowed values are '%{allowed_values}'"
 msgstr ""
 
@@ -892,11 +896,11 @@ msgstr ""
 msgid "Outputs a dump of the internal template parse tree for debugging"
 msgstr ""
 
-#: ../lib/puppet/face/epp.rb:108 ../lib/puppet/face/parser.rb:105
+#: ../lib/puppet/face/epp.rb:108 ../lib/puppet/face/parser.rb:106
 msgid "A dump of the resulting AST model unless there are syntax or validation errors."
 msgstr ""
 
-#: ../lib/puppet/face/epp.rb:137 ../lib/puppet/face/epp.rb:309 ../lib/puppet/face/parser.rb:126
+#: ../lib/puppet/face/epp.rb:137 ../lib/puppet/face/epp.rb:309 ../lib/puppet/face/parser.rb:127
 msgid "<source>"
 msgstr ""
 
@@ -908,15 +912,15 @@ msgstr ""
 msgid "Whether or not to validate the parsed result, if no-validate only syntax errors are reported."
 msgstr ""
 
-#: ../lib/puppet/face/epp.rb:146 ../lib/puppet/face/parser.rb:135
+#: ../lib/puppet/face/epp.rb:146 ../lib/puppet/face/parser.rb:136
 msgid "<old, pn, or json>"
 msgstr ""
 
-#: ../lib/puppet/face/epp.rb:147 ../lib/puppet/face/parser.rb:136
+#: ../lib/puppet/face/epp.rb:147 ../lib/puppet/face/parser.rb:137
 msgid "Get result in 'old' (deprecated format), 'pn' (new format), or 'json' (new format in JSON)."
 msgstr ""
 
-#: ../lib/puppet/face/epp.rb:151 ../lib/puppet/face/parser.rb:140
+#: ../lib/puppet/face/epp.rb:151 ../lib/puppet/face/parser.rb:141
 msgid "Pretty print output. Only applicable together with --format pn or json"
 msgstr ""
 
@@ -924,7 +928,7 @@ msgstr ""
 msgid "Whether or not to show a file name header between files."
 msgstr ""
 
-#: ../lib/puppet/face/epp.rb:179 ../lib/puppet/face/parser.rb:152
+#: ../lib/puppet/face/epp.rb:179 ../lib/puppet/face/parser.rb:153
 msgid "No input to parse given on command line or stdin"
 msgstr ""
 
@@ -1413,34 +1417,34 @@ msgstr ""
 msgid "Nothing, or the first syntax error encountered."
 msgstr ""
 
-#: ../lib/puppet/face/parser.rb:49
+#: ../lib/puppet/face/parser.rb:50
 msgid "No manifest specified. Validating the default manifest %{manifest}"
 msgstr ""
 
-#: ../lib/puppet/face/parser.rb:65
+#: ../lib/puppet/face/parser.rb:66
 msgid ""
 "One or more file(s) specified did not exist:\n"
 "%{files}"
 msgstr ""
 
-#: ../lib/puppet/face/parser.rb:103
+#: ../lib/puppet/face/parser.rb:104
 msgid "Outputs a dump of the internal parse tree for debugging"
 msgstr ""
 
-#: ../lib/puppet/face/parser.rb:128
+#: ../lib/puppet/face/parser.rb:129
 msgid "dump one source expression given on the command line."
 msgstr ""
 
-#: ../lib/puppet/face/parser.rb:132
+#: ../lib/puppet/face/parser.rb:133
 msgid "Whether or not to validate the parsed result, if no-validate only syntax errors are reported"
 msgstr ""
 
-#: ../lib/puppet/face/parser.rb:168
+#: ../lib/puppet/face/parser.rb:169
 msgid ""
 "One or more file(s) specified did not exist:\n"
 msgstr ""
 
-#: ../lib/puppet/face/parser.rb:214
+#: ../lib/puppet/face/parser.rb:215
 msgid "For puppet parser validate"
 msgstr ""
 
@@ -1829,15 +1833,23 @@ msgstr ""
 msgid "Exception was: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/forge.rb:206
-msgid "Downloaded release for %{name} did not match expected checksum"
+#: ../lib/puppet/forge.rb:183
+msgid "Forge module is missing SHA256 and MD5 checksums"
+msgstr ""
+
+#: ../lib/puppet/forge.rb:217
+msgid "Module install using MD5 is prohibited in FIPS mode."
 msgstr ""
 
-#: ../lib/puppet/forge.rb:214 ../lib/puppet/module_tool/applications/unpacker.rb:58 ../lib/puppet/module_tool/local_tarball.rb:86
+#: ../lib/puppet/forge.rb:221
+msgid "Downloaded release for %{name} did not match expected checksum %{checksum}"
+msgstr ""
+
+#: ../lib/puppet/forge.rb:229 ../lib/puppet/module_tool/applications/unpacker.rb:58 ../lib/puppet/module_tool/local_tarball.rb:86
 msgid "Could not extract contents of module archive: %{message}"
 msgstr ""
 
-#: ../lib/puppet/forge.rb:231
+#: ../lib/puppet/forge.rb:246
 msgid "Cannot consider release %{name}-%{version}: %{error}"
 msgstr ""
 
@@ -2608,11 +2620,11 @@ msgstr ""
 msgid "Could not parse JSON data for %{name} %{key}: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/indirector/key/file.rb:28
+#: ../lib/puppet/indirector/key/file.rb:29
 msgid "Could not remove %{request} public key: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/indirector/key/file.rb:42
+#: ../lib/puppet/indirector/key/file.rb:43
 msgid "Could not write %{request}: %{detail}"
 msgstr ""
 
@@ -3203,23 +3215,19 @@ msgstr ""
 msgid "No file containing checksums found."
 msgstr ""
 
-#: ../lib/puppet/module_tool/applications/installer.rb:55
-msgid "Module install is prohibited in FIPS mode."
-msgstr ""
-
-#: ../lib/puppet/module_tool/applications/installer.rb:85 ../lib/puppet/module_tool/applications/upgrader.rb:102
+#: ../lib/puppet/module_tool/applications/installer.rb:82 ../lib/puppet/module_tool/applications/upgrader.rb:102
 msgid "Downloading from %{host} ..."
 msgstr ""
 
-#: ../lib/puppet/module_tool/applications/installer.rb:131 ../lib/puppet/module_tool/applications/upgrader.rb:140
+#: ../lib/puppet/module_tool/applications/installer.rb:128 ../lib/puppet/module_tool/applications/upgrader.rb:140
 msgid "Resolving dependencies ..."
 msgstr ""
 
-#: ../lib/puppet/module_tool/applications/installer.rb:161
+#: ../lib/puppet/module_tool/applications/installer.rb:158
 msgid "Preparing to install ..."
 msgstr ""
 
-#: ../lib/puppet/module_tool/applications/installer.rb:164
+#: ../lib/puppet/module_tool/applications/installer.rb:161
 msgid "Installing -- do not interrupt ..."
 msgstr ""
 
@@ -4044,50 +4052,50 @@ msgstr ""
 msgid "manifest_file or code_string cannot be given when configured_by_env is true"
 msgstr ""
 
-#: ../lib/puppet/pal/pal_impl.rb:206
+#: ../lib/puppet/pal/pal_impl.rb:214
 msgid "temporary environment name"
 msgstr ""
 
 #. TRANSLATORS: do not translate variable name string in these assertions
-#: ../lib/puppet/pal/pal_impl.rb:211
+#: ../lib/puppet/pal/pal_impl.rb:219
 msgid "A block must be given to 'in_tmp_environment'"
 msgstr ""
 
 #. TRANSLATORS terms in the assertions below are names of terms in code
-#: ../lib/puppet/pal/pal_impl.rb:265
+#: ../lib/puppet/pal/pal_impl.rb:273
 msgid "A block must be given to 'in_environment'"
 msgstr ""
 
 #. TRANSLATORS 'in_environment' is a name, do not translate
-#: ../lib/puppet/pal/pal_impl.rb:270
+#: ../lib/puppet/pal/pal_impl.rb:278
 msgid "The environment directory '%{env_dir}' does not exist"
 msgstr ""
 
-#: ../lib/puppet/pal/pal_impl.rb:293
+#: ../lib/puppet/pal/pal_impl.rb:301
 msgid "No directory found for the environment '%{env_name}' on the path '%{envpath}'"
 msgstr ""
 
-#: ../lib/puppet/pal/pal_impl.rb:347
+#: ../lib/puppet/pal/pal_impl.rb:355
 msgid "Given variables must be a hash, got %{type}"
 msgstr ""
 
-#: ../lib/puppet/pal/pal_impl.rb:353
+#: ../lib/puppet/pal/pal_impl.rb:361
 msgid "Given variable '%{varname}' has illegal name"
 msgstr ""
 
-#: ../lib/puppet/pal/pal_impl.rb:357
+#: ../lib/puppet/pal/pal_impl.rb:365
 msgid "Given value for '%{varname}' has illegal type - got: %{type}"
 msgstr ""
 
-#: ../lib/puppet/pal/pal_impl.rb:497
+#: ../lib/puppet/pal/pal_impl.rb:505
 msgid "Puppet Pal: %{what}"
 msgstr ""
 
-#: ../lib/puppet/pal/pal_impl.rb:511
+#: ../lib/puppet/pal/pal_impl.rb:519
 msgid "Cannot use '%{a_term}' and '%{b_term}' at the same time"
 msgstr ""
 
-#: ../lib/puppet/pal/pal_impl.rb:518
+#: ../lib/puppet/pal/pal_impl.rb:526
 msgid "A block must be given"
 msgstr ""
 
@@ -6671,11 +6679,11 @@ msgstr ""
 msgid "Cannot match %{line}"
 msgstr ""
 
-#: ../lib/puppet/provider/package/dpkg.rb:85
+#: ../lib/puppet/provider/package/dpkg.rb:87
 msgid "You cannot install dpkg packages without a source"
 msgstr ""
 
-#: ../lib/puppet/provider/package/dpkg.rb:110
+#: ../lib/puppet/provider/package/dpkg.rb:112
 msgid "source doesn't contain named package, but %{name}"
 msgstr ""
 
@@ -7736,15 +7744,15 @@ msgstr ""
 msgid "Server hostname '%{host}' did not match server certificate; %{expected_certnames}"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:152
+#: ../lib/puppet/ssl/host.rb:154
 msgid "No certificate to validate."
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:153
+#: ../lib/puppet/ssl/host.rb:155
 msgid "No private key with which to validate certificate with fingerprint: %{fingerprint}"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:155
+#: ../lib/puppet/ssl/host.rb:157
 msgid ""
 "The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root?\n"
 "Certificate fingerprint: %{fingerprint}\n"
@@ -7756,7 +7764,7 @@ msgid ""
 "  2. puppet %{puppet_params}\n"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:210
+#: ../lib/puppet/ssl/host.rb:212
 msgid ""
 "The CSR retrieved from the master does not match the agent's public key.\n"
 "CSR fingerprint: %{fingerprint}\n"
@@ -7770,53 +7778,57 @@ msgid ""
 "  2. puppet %{puppet_params}\n"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:264 ../lib/puppet/ssl/host.rb:285
+#: ../lib/puppet/ssl/host.rb:235
+msgid "Puppet::SSL::Host is deprecated and will be removed in a future release of Puppet."
+msgstr ""
+
+#: ../lib/puppet/ssl/host.rb:267 ../lib/puppet/ssl/host.rb:288
 msgid "Could not request certificate: %{message}"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:266
+#: ../lib/puppet/ssl/host.rb:269
 msgid "Exiting; failed to retrieve certificate and waitforcert is disabled"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:275
+#: ../lib/puppet/ssl/host.rb:278
 msgid "Exiting; no certificate found and waitforcert is disabled"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:283
+#: ../lib/puppet/ssl/host.rb:286
 msgid "Did not receive certificate"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:323
+#: ../lib/puppet/ssl/host.rb:326
 msgid "Response from the CA did not contain a valid certificate request: %{message}"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:329
+#: ../lib/puppet/ssl/host.rb:332
 msgid "Could not download certificate request: %{message}"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:356
+#: ../lib/puppet/ssl/host.rb:359
 msgid ""
 "Failed attempting to load CRL from %{crl_path}! The CRL below caused the error '%{error}':\n"
 "%{crl}"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:388 ../lib/puppet/ssl/state_machine.rb:119
+#: ../lib/puppet/ssl/host.rb:391 ../lib/puppet/ssl/state_machine.rb:119
 msgid "Could not download CRLs: %{message}"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:422
+#: ../lib/puppet/ssl/host.rb:425
 msgid "The certificate at %{file_path} is invalid. Could not load."
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:443
+#: ../lib/puppet/ssl/host.rb:446
 msgid "Response from the CA did not contain a valid certificate for %{cert_name}."
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:447
+#: ../lib/puppet/ssl/host.rb:450
 msgid "No certificate for %{cert_name} on CA"
 msgstr ""
 
-#: ../lib/puppet/ssl/host.rb:450
+#: ../lib/puppet/ssl/host.rb:453
 msgid "Could not download host certificate: %{message}"
 msgstr ""