puppet 6.8.1 → 6.9.0

data/lib/puppet/face/help.rb

@@ -196,7 +196,7 @@ Puppet::Face.define(:help, '0.0.1') do
   #private :horribly_extract_summary_from
 
   def exclude_from_docs?(appname)
-    %w{face_base indirection_base cert key man plugin report status}.include? appname
+    %w{face_base indirection_base cert key man report status}.include? appname
   end
   # This should absolutely be a private method, but for some reason it appears
   #  that you can't use the 'private' keyword inside of a Face definition.

data/lib/puppet/face/plugin.rb

@@ -41,8 +41,15 @@ Puppet::Face.define(:plugin, '0.0.1') do
     when_invoked do |options|
       remote_environment_for_plugins = Puppet::Node::Environment.remote(Puppet[:environment])
 
-      handler = Puppet::Configurer::PluginHandler.new()
-      handler.download_plugins(remote_environment_for_plugins)
+      pool = Puppet::Network::HTTP::Pool.new(Puppet[:http_keepalive_timeout])
+      Puppet.override(:http_pool => pool) do
+        begin
+          handler = Puppet::Configurer::PluginHandler.new()
+          handler.download_plugins(remote_environment_for_plugins)
+        ensure
+          pool.close
+        end
+      end
     end
 
     when_rendering :console do |value|

data/lib/puppet/forge/repository.rb

@@ -1,4 +1,4 @@
-require 'net/https'
+require 'puppet/ssl/openssl_loader'
 require 'digest/sha1'
 require 'uri'
 require 'puppet/util/http_proxy'

data/lib/puppet/functions/regsubst.rb

@@ -1,42 +1,34 @@
 # Performs regexp replacement on a string or array of strings.
-#
-# @param target [String, Array[String]]
-#      The string or array of strings to operate on.  If an array, the replacement will be
-#      performed on each of the elements in the array, and the return value will be an array.
-# @param pattern [String, Regexp, Type[Regexp]]
-#      The regular expression matching the target string.  If you want it anchored at the start
-#      and or end of the string, you must do that with ^ and $ yourself.
-# @param replacement [String, Hash[String, String]]
-#      Replacement string. Can contain backreferences to what was matched using \\0 (whole match),
-#      \\1 (first set of parentheses), and so on.
-#      If the second argument is a Hash, and the matched text is one of its keys, the corresponding value is the replacement string.
-# @param flags [Optional[Pattern[/^[GEIM]*$/]], Pattern[/^G?$/]]
-#      Optional. String of single letter flags for how the regexp is interpreted (E, I, and M cannot be used
-#      if pattern is a precompiled regexp):
-#        - *E*         Extended regexps
-#        - *I*         Ignore case in regexps
-#        - *M*         Multiline regexps
-#        - *G*         Global replacement; all occurrences of the regexp in each target string will be replaced.  Without this, only the first occurrence will be replaced.
-# @param encoding [Enum['N','E','S','U']]
-#      Optional. How to handle multibyte characters when compiling the regexp (must not be used when pattern is a
-#      precompiled regexp). A single-character string with the following values:
-#        - *N*         None
-#        - *E*         EUC
-#        - *S*         SJIS
-#        - *U*         UTF-8
-# @return [Array[String], String] The result of the substitution. Result type is the same as for the target parameter.
-#
-# @example Get the third octet from the node's IP address:
-#   ```puppet
-#   $i3 = regsubst($ipaddress,'^(\\d+)\\.(\\d+)\\.(\\d+)\\.(\\d+)$','\\3')
-#   ```
-#
-# @example Put angle brackets around each octet in the node's IP address:
-#   ```puppet
-#   $x = regsubst($ipaddress, /([0-9]+)/, '<\\1>', 'G')
-#   ```
-#
 Puppet::Functions.create_function(:regsubst) do
+  # @param target [String]
+  #      The string or array of strings to operate on.  If an array, the replacement will be
+  #      performed on each of the elements in the array, and the return value will be an array.
+  # @param pattern [String, Regexp, Type[Regexp]]
+  #      The regular expression matching the target string.  If you want it anchored at the start
+  #      and or end of the string, you must do that with ^ and $ yourself.
+  # @param replacement [String, Hash[String, String]]
+  #      Replacement string. Can contain backreferences to what was matched using \\0 (whole match),
+  #      \\1 (first set of parentheses), and so on.
+  #      If the second argument is a Hash, and the matched text is one of its keys, the corresponding value is the replacement string.
+  # @param flags [Optional[Pattern[/^[GEIM]*$/]], Pattern[/^G?$/]]
+  #      Optional. String of single letter flags for how the regexp is interpreted (E, I, and M cannot be used
+  #      if pattern is a precompiled regexp):
+  #        - *E*         Extended regexps
+  #        - *I*         Ignore case in regexps
+  #        - *M*         Multiline regexps
+  #        - *G*         Global replacement; all occurrences of the regexp in each target string will be replaced.  Without this, only the first occurrence will be replaced.
+  # @param encoding [Enum['N','E','S','U']]
+  #      Optional. How to handle multibyte characters when compiling the regexp (must not be used when pattern is a
+  #      precompiled regexp). A single-character string with the following values:
+  #        - *N*         None
+  #        - *E*         EUC
+  #        - *S*         SJIS
+  #        - *U*         UTF-8
+  # @return [Array[String], String] The result of the substitution. Result type is the same as for the target parameter.
+  # @example Get the third octet from the node's IP address:
+  #   ```puppet
+  #   $i3 = regsubst($ipaddress,'^(\\d+)\\.(\\d+)\\.(\\d+)\\.(\\d+)$','\\3')
+  #   ```
   dispatch :regsubst_string do
     param          'Variant[Array[String],String]',       :target
     param          'String',                              :pattern
@@ -45,6 +37,35 @@ Puppet::Functions.create_function(:regsubst) do
     optional_param "Enum['N','E','S','U']",               :encoding
   end
 
+  # @param target [String, Array[String]]
+  #      The string or array of strings to operate on.  If an array, the replacement will be
+  #      performed on each of the elements in the array, and the return value will be an array.
+  # @param pattern [Regexp, Type[Regexp]]
+  #      The regular expression matching the target string.  If you want it anchored at the start
+  #      and or end of the string, you must do that with ^ and $ yourself.
+  # @param replacement [String, Hash[String, String]]
+  #      Replacement string. Can contain backreferences to what was matched using \\0 (whole match),
+  #      \\1 (first set of parentheses), and so on.
+  #      If the second argument is a Hash, and the matched text is one of its keys, the corresponding value is the replacement string.
+  # @param flags [Optional[Pattern[/^[GEIM]*$/]], Pattern[/^G?$/]]
+  #      Optional. String of single letter flags for how the regexp is interpreted (E, I, and M cannot be used
+  #      if pattern is a precompiled regexp):
+  #        - *E*         Extended regexps
+  #        - *I*         Ignore case in regexps
+  #        - *M*         Multiline regexps
+  #        - *G*         Global replacement; all occurrences of the regexp in each target string will be replaced.  Without this, only the first occurrence will be replaced.
+  # @param encoding [Enum['N','E','S','U']]
+  #      Optional. How to handle multibyte characters when compiling the regexp (must not be used when pattern is a
+  #      precompiled regexp). A single-character string with the following values:
+  #        - *N*         None
+  #        - *E*         EUC
+  #        - *S*         SJIS
+  #        - *U*         UTF-8
+  # @return [Array[String], String] The result of the substitution. Result type is the same as for the target parameter.
+  # @example Put angle brackets around each octet in the node's IP address:
+  #   ```puppet
+  #   $x = regsubst($ipaddress, /([0-9]+)/, '<\\1>', 'G')
+  #   ```
   dispatch :regsubst_regexp do
     param          'Variant[Array[String],String]',       :target
     param          'Variant[Regexp,Type[Regexp]]',        :pattern

data/lib/puppet/indirector/catalog/compiler.rb

@@ -401,24 +401,28 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
 
     # And then add the server name and IP
     {"servername" => "fqdn",
-      "serverip" => "ipaddress"
+      "serverip"  => "ipaddress",
+      "serverip6" => "ipaddress6"
     }.each do |var, fact|
       value = Facter.value(fact)
-      if value
+      if !value.nil?
         @server_facts[var] = value
-      else
-        Puppet.warning _("Could not retrieve fact %{fact}") % { fact: fact }
       end
     end
 
     if @server_facts["servername"].nil?
       host = Facter.value(:hostname)
-      domain = Facter.value(:domain)
-      if domain
+      if host.nil?
+        Puppet.warning _("Could not retrieve fact servername")
+      elsif domain = Facter.value(:domain) #rubocop:disable Lint/AssignmentInCondition
         @server_facts["servername"] = [host, domain].join(".")
       else
         @server_facts["servername"] = host
       end
     end
+
+    if @server_facts["serverip"].nil? && @server_facts["serverip6"].nil?
+      Puppet.warning _("Could not retrieve either serverip or serverip6 fact")
+    end
   end
 end

data/lib/puppet/module_tool/applications/uninstaller.rb

@@ -15,9 +15,6 @@ module Puppet::ModuleTool
       end
 
       def run
-        # Disallow anything that invokes md5 to avoid un-friendly termination due to FIPS
-        raise _("Module uninstall is prohibited in FIPS mode.") if Facter.value(:fips_enabled)
-
         results = {
           :module_name       => @name,
           :requested_version => @version,
@@ -92,6 +89,8 @@ module Puppet::ModuleTool
         mod = @installed.first
 
         unless @ignore_changes
+          raise _("Either the `--ignore_changes` or `--force` argument must be specified to uninstall modules when running in FIPS mode.") if Facter.value(:fips_enabled)
+
           changes = begin
             Puppet::ModuleTool::Applications::Checksummer.run(mod.path)
           rescue ArgumentError

data/lib/puppet/network/http/connection.rb

@@ -1,4 +1,4 @@
-require 'net/https'
+require 'puppet/ssl/openssl_loader'
 require 'puppet/ssl/host'
 require 'puppet/ssl/validator'
 require 'puppet/network/http'

data/lib/puppet/network/http/factory.rb

@@ -1,4 +1,4 @@
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 require 'net/http'
 require 'puppet/util/http_proxy'
 

data/lib/puppet/network/http_pool.rb

@@ -1,4 +1,5 @@
 require 'puppet/network/http/connection'
+require 'puppet/util/platform'
 
 module Puppet::Network; end
 

data/lib/puppet/provider/package/dnf.rb

@@ -9,7 +9,7 @@ Puppet::Type.type(:package).provide :dnf, :parent => :yum do
   These options should be specified as an array where each element is either
    a string or a hash."
 
-  has_feature :install_options, :versionable, :virtual_packages
+  has_feature :install_options, :versionable, :virtual_packages, :install_only
 
   commands :cmd => "dnf", :rpm => "rpm"
 

data/lib/puppet/provider/package/rpm.rb

@@ -13,6 +13,7 @@ These options should be specified as an array where each element is either a str
   has_feature :install_options
   has_feature :uninstall_options
   has_feature :virtual_packages
+  has_feature :install_only
 
   # Note: self:: is required here to keep these constants in the context of what will
   # eventually become this Puppet::Type::Package::ProviderRpm class.
@@ -20,6 +21,7 @@ These options should be specified as an array where each element is either a str
   self::NEVRA_FORMAT = %Q{%{NAME} %|EPOCH?{%{EPOCH}}:{0}| %{VERSION} %{RELEASE} %{ARCH}\\n}
   self::NEVRA_REGEX  = %r{^'?(\S+) (\S+) (\S+) (\S+) (\S+)$}
   self::NEVRA_FIELDS = [:name, :epoch, :version, :release, :arch]
+  self::MULTIVERSION_SEPARATOR = "; "
 
   ARCH_LIST = [
     'noarch',
@@ -79,12 +81,9 @@ These options should be specified as an array where each element is either a str
 
     # list out all of the packages
     begin
-      execpipe("#{command(:rpm)} -qa #{nosignature} #{nodigest} --qf '#{self::NEVRA_FORMAT}'") { |process|
+      execpipe("#{command(:rpm)} -qa #{nosignature} #{nodigest} --qf '#{self::NEVRA_FORMAT}' | sort") { |process|
         # now turn each returned line into a package object
-        process.each_line { |line|
-          hash = nevra_to_hash(line)
-          packages << new(hash) unless hash.empty?
-        }
+        nevra_to_multiversion_hash(process).each { |hash| packages << new(hash) }
       }
     rescue Puppet::ExecutionFailure
       raise Puppet::Error, _("Failed to list packages"), $!.backtrace
@@ -100,7 +99,7 @@ These options should be specified as an array where each element is either a str
     #NOTE: Prior to a fix for issue 1243, this method potentially returned a cached value
     #IF YOU CALL THIS METHOD, IT WILL CALL RPM
     #Use get(:property) to check if cached values are available
-    cmd = ["-q",  @resource[:name], "#{self.class.nosignature}", "#{self.class.nodigest}", "--qf", "'#{self.class::NEVRA_FORMAT}'"]
+    cmd = ["-q",  @resource[:name], "#{self.class.nosignature}", "#{self.class.nodigest}", "--qf", "#{self.class::NEVRA_FORMAT}"]
 
     begin
       output = rpm(*cmd)
@@ -117,9 +116,7 @@ These options should be specified as an array where each element is either a str
         return nil
       end
     end
-    # FIXME: We could actually be getting back multiple packages
-    # for multilib and this will only return the first such package
-    @property_hash.update(self.class.nevra_to_hash(output))
+    @property_hash.update(self.class.nevra_to_multiversion_hash(output))
 
     @property_hash.dup
   end
@@ -131,8 +128,8 @@ These options should be specified as an array where each element is either a str
       @resource.fail _("RPMs must specify a package source")
     end
 
-    cmd = [command(:rpm), "-q", "--qf", "'#{self.class::NEVRA_FORMAT}'", "-p", source]
-    h = self.class.nevra_to_hash(execute(cmd))
+    cmd = [command(:rpm), "-q", "--qf", "#{self.class::NEVRA_FORMAT}", "-p", source]
+    h = self.class.nevra_to_multiversion_hash(execute(cmd))
     h[:ensure]
   rescue Puppet::ExecutionFailure => e
     raise Puppet::Error, e.message, e.backtrace
@@ -170,7 +167,11 @@ These options should be specified as an array where each element is either a str
       if @resource[:name].start_with? nav
         identifier = nav
       else
-        identifier = name
+        if @resource[:install_only]
+          identifier = get(:ensure).split(self.class::MULTIVERSION_SEPARATOR).map { |ver| "#{name}-#{ver}" }
+        else
+          identifier = name
+        end
       end
     end
     # If an arch is specified in the resource, uninstall that arch,
@@ -310,8 +311,12 @@ These options should be specified as an array where each element is either a str
 
   def insync?(is)
     return false if [:purged, :absent].include?(is)
+    return false if is.include?(self.class::MULTIVERSION_SEPARATOR) && !@resource[:install_only]
+
     should = resource[:ensure]
-    0 == rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(is))
+    is.split(self.class::MULTIVERSION_SEPARATOR).any? do |version|
+      0 == self.rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(version))
+    end
   end
 
   # parse a rpm "version" specification
@@ -416,4 +421,37 @@ These options should be specified as an array where each element is either a str
 
     return hash
   end
+
+  # @param line [String] multiple lines of rpm package query information
+  # @return list of [Hash] of NEVRA_FIELDS strings parsed from package info
+  # or an empty list if we failed to parse
+  # @api private
+  def self.nevra_to_multiversion_hash(multiline)
+    list = []
+    multiversion_hash = {}
+    multiline.each_line do |line|
+      hash = self.nevra_to_hash(line)
+      if !hash.empty?
+        if multiversion_hash.empty?
+          multiversion_hash = hash.dup
+          next
+        end
+
+        if multiversion_hash[:name] != hash[:name]
+          list << multiversion_hash
+          multiversion_hash = hash.dup
+          next
+        end
+
+        if !multiversion_hash[:ensure].include?(hash[:ensure])
+          multiversion_hash[:ensure].concat("#{self::MULTIVERSION_SEPARATOR}#{hash[:ensure]}")
+        end
+      end
+    end
+    list << multiversion_hash if multiversion_hash
+    if list.size == 1
+      return list[0]
+    end
+    return list
+  end
 end

data/lib/puppet/provider/package/yum.rb

@@ -8,7 +8,7 @@ Puppet::Type.type(:package).provide :yum, :parent => :rpm, :source => :rpm do
   This provider supports the `install_options` attribute, which allows command-line flags to be passed to yum.
   These options should be specified as an array where each element is either a string or a hash."
 
-  has_feature :install_options, :versionable, :virtual_packages
+  has_feature :install_options, :versionable, :virtual_packages, :install_only
 
   commands :cmd => "yum", :rpm => "rpm"
 
@@ -203,7 +203,10 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
       end
       current_package = self.query
       if current_package
-        if rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(current_package[:ensure])) < 0
+        if @resource[:install_only]
+          self.debug "Updating package #{@resource[:name]} from version #{current_package[:ensure]} to #{should} as install_only packages are never downgraded"
+          operation = update_command
+        elsif rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(current_package[:ensure])) < 0
           self.debug "Downgrading package #{@resource[:name]} from version #{current_package[:ensure]} to #{should}"
           operation = :downgrade
         elsif rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(current_package[:ensure])) > 0
@@ -228,10 +231,11 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
       is = self.query
       raise Puppet::Error, _("Could not find package %{name}") % { name: self.name } unless is
 
+      version = is[:ensure]
       # FIXME: Should we raise an exception even if should == :latest
       # and yum updated us to a version other than @param_hash[:ensure] ?
-      vercmp_result = rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(is[:ensure]))
-      raise Puppet::Error, _("Failed to update to version %{should}, got version %{version} instead") % { should: should, version: is[:ensure] } if vercmp_result != 0
+      raise Puppet::Error, _("Failed to update to version %{should}, got version %{version} instead") % { should: should, version: version } unless
+        insync?(version)
     end
   end
 

data/lib/puppet/provider/service/systemd.rb

@@ -11,7 +11,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
 
   commands :systemctl => "systemctl"
 
-  confine :true => Puppet::FileSystem.exist?('/proc/1/exe') && Puppet::FileSystem.readlink('/proc/1/exe').include?('systemd')
+  confine :true => Puppet::FileSystem.exist?('/proc/1/comm') && Puppet::FileSystem.read('/proc/1/comm').include?('systemd')
 
   defaultfor :osfamily => [:archlinux]
   defaultfor :osfamily => :redhat, :operatingsystemmajrelease => ["7", "8"]

data/lib/puppet/settings.rb

@@ -84,6 +84,46 @@ class Puppet::Settings
     "puppet.conf"
   end
 
+  def stringify_settings(section, settings = :all)
+    values_from_the_selected_section =
+      values(nil, section.to_sym)
+
+    loader_settings = {
+      :environmentpath => values_from_the_selected_section.interpolate(:environmentpath),
+      :basemodulepath => values_from_the_selected_section.interpolate(:basemodulepath),
+    }
+
+    Puppet.override(Puppet.base_context(loader_settings),
+                    _("New environment loaders generated from the requested section.")) do
+      # And now we can lookup values that include those from environments configured from
+      # the requested section
+      values = values(Puppet[:environment].to_sym, section.to_sym)
+
+      to_be_rendered = {}
+      settings = Puppet.settings.to_a.collect(&:first) if settings == :all
+      settings.sort.each do |setting_name|
+        to_be_rendered[setting_name] = values.print(setting_name.to_sym)
+      end
+
+      stringifyhash(to_be_rendered)
+    end
+  end
+
+  def stringifyhash(hash)
+    newhash = {}
+    hash.each do |key, val|
+      key = key.to_s
+      if val.is_a? Hash
+        newhash[key] = stringifyhash(val)
+      elsif val.is_a? Symbol
+        newhash[key] = val.to_s
+      else
+        newhash[key] = val
+      end
+    end
+    newhash
+  end
+
   # Create a new collection of config settings.
   def initialize
     @config = {}

data/lib/puppet/ssl.rb

@@ -1,6 +1,6 @@
 # Just to make the constants work out.
 require 'puppet'
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 
 module Puppet::SSL # :nodoc:
   CA_NAME = "ca".freeze