puppet 7.24.0-universal-darwin → 8.1.0-universal-darwin

data/lib/puppet/settings/enum_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::EnumSetting < Puppet::Settings::BaseSetting
   attr_accessor :values
 

data/lib/puppet/settings/environment_conf.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # Configuration settings for a single directory Environment.
 # @api private
 class Puppet::Settings::EnvironmentConf

data/lib/puppet/settings/errors.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # Exceptions for the settings module
 require_relative '../../puppet/error'
 

data/lib/puppet/settings/file_or_directory_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::FileOrDirectorySetting < Puppet::Settings::FileSetting
 
   def initialize(args)

data/lib/puppet/settings/file_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # A file.
 class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
   class SettingError < StandardError; end

data/lib/puppet/settings/http_extra_headers_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::HttpExtraHeadersSetting < Puppet::Settings::BaseSetting
 
   def type

data/lib/puppet/settings/ini_file.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # @api private
 class Puppet::Settings::IniFile
   DEFAULT_SECTION_NAME = "main"

data/lib/puppet/settings/integer_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::IntegerSetting < Puppet::Settings::BaseSetting
   def munge(value)
     return value if Integer === value

data/lib/puppet/settings/path_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::PathSetting < Puppet::Settings::StringSetting
   def munge(value)
     if value.is_a?(String)

data/lib/puppet/settings/port_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::PortSetting < Puppet::Settings::IntegerSetting
   def munge(value)
     value = super

data/lib/puppet/settings/priority_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/settings/base_setting'
 
 # A setting that represents a scheduling priority, and evaluates to an

data/lib/puppet/settings/server_list_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::ServerListSetting < Puppet::Settings::ArraySetting
 
   def type

data/lib/puppet/settings/string_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::StringSetting < Puppet::Settings::BaseSetting
   def type
     :string

data/lib/puppet/settings/symbolic_enum_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::SymbolicEnumSetting < Puppet::Settings::BaseSetting
   attr_accessor :values
 

data/lib/puppet/settings/terminus_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::Settings::TerminusSetting < Puppet::Settings::BaseSetting
   def munge(value)
     case value

data/lib/puppet/settings/ttl_setting.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # A setting that represents a span of time to live, and evaluates to Numeric
 # seconds to live where 0 means shortest possible time to live, a positive numeric value means time
 # to live in seconds, and the symbolic entry 'unlimited' is an infinite amount of time.

data/lib/puppet/settings/value_translator.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # Convert arguments into booleans, integers, or whatever.
 class Puppet::Settings::ValueTranslator
   def [](value)

data/lib/puppet/settings.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../puppet'
 require 'getoptlong'
 require_relative '../puppet/util/watched_file'
@@ -49,7 +50,7 @@ class Puppet::Settings
   # The acceptable sections of the puppet.conf configuration file.
   ALLOWED_SECTION_NAMES = ['main', 'server', 'master', 'agent', 'user'].freeze
 
-  NONE = 'none'.freeze
+  NONE = 'none'
 
   # This method is intended for puppet internal use only; it is a convenience method that
   # returns reasonable application default settings values for a given run_mode.
@@ -78,11 +79,11 @@ class Puppet::Settings
   end
 
   def self.hostname_fact()
-    Puppet.runtime[:facter].value :hostname
+    Puppet.runtime[:facter].value 'networking.hostname'
   end
 
   def self.domain_fact()
-    Puppet.runtime[:facter].value :domain
+    Puppet.runtime[:facter].value 'networking.domain'
   end
 
   def self.default_config_file_name
@@ -1400,7 +1401,7 @@ Generated on #{Time.now}.
   #
   # @api public
   class ChainedValues
-    ENVIRONMENT_SETTING = "environment".freeze
+    ENVIRONMENT_SETTING = "environment"
     ENVIRONMENT_INTERPOLATION_ALLOWED = ['config_version'].freeze
 
     # @see Puppet::Settings.values

data/lib/puppet/ssl/base.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl/openssl_loader'
 require_relative '../../puppet/ssl'
 require_relative '../../puppet/ssl/digest'

data/lib/puppet/ssl/certificate.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl/base'
 
 # Manage certificates themselves.  This class has no

data/lib/puppet/ssl/certificate_request.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl/base'
 require_relative '../../puppet/ssl/certificate_signer'
 
@@ -68,10 +69,7 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
     csr.public_key = if key.is_a?(OpenSSL::PKey::EC)
                        # EC#public_key doesn't follow the PKey API,
                        # see https://github.com/ruby/openssl/issues/29
-                       point = key.public_key
-                       pubkey = OpenSSL::PKey::EC.new(point.group)
-                       pubkey.public_key = point
-                       pubkey
+                       key
                      else
                        key.public_key
                      end

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl'
 require_relative '../../puppet/util/yaml'
 

data/lib/puppet/ssl/certificate_signer.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # Take care of signing a certificate in a FIPS 140-2 compliant manner.
 #
 # @see https://projects.puppetlabs.com/issues/17295

data/lib/puppet/ssl/digest.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 class Puppet::SSL::Digest
   attr_reader :digest
 

data/lib/puppet/ssl/error.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Puppet::SSL
   class SSLError < Puppet::Error; end
 

data/lib/puppet/ssl/oids.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl'
 
 # This module defines OIDs for use within Puppet.

data/lib/puppet/ssl/openssl_loader.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/util/platform'
 
 # This file should be required instead of writing `require 'openssl'`

data/lib/puppet/ssl/ssl_context.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl'
 
 module Puppet::SSL

data/lib/puppet/ssl/ssl_provider.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl'
 
 # SSL Provider creates `SSLContext` objects that can be used to create
@@ -235,7 +236,7 @@ class Puppet::SSL::SSLProvider
   def default_flags
     # checking the signature of the self-signed cert doesn't add any security,
     # but it's a sanity check to make sure the cert isn't corrupt. This option
-    # is only available in openssl 1.1+
+    # is not available in JRuby's OpenSSL library.
     if defined?(OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE)
       OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE
     else

data/lib/puppet/ssl/state_machine.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl'
 require_relative '../../puppet/util/pidlock'
 
@@ -49,14 +50,28 @@ class Puppet::SSL::StateMachine
     def next_state
       Puppet.debug("Loading CA certs")
 
+      force_crl_refresh = false
+
       cacerts = @cert_provider.load_cacerts
       if cacerts
         next_ctx = @ssl_provider.create_root_context(cacerts: cacerts, revocation: false)
+
+        now = Time.now
+        last_update = @cert_provider.ca_last_update
+        if needs_refresh?(now, last_update)
+          # set last updated time first, then make a best effort to refresh
+          @cert_provider.ca_last_update = now
+
+          # If we refresh the CA, then we need to force the CRL to be refreshed too,
+          # since if there is a new CA in the chain, then we need its CRL to check
+          # the full chain for revocation status.
+          next_ctx, force_crl_refresh = refresh_ca(next_ctx, last_update)
+        end
       else
         route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
         _, pem = route.get_certificate(Puppet::SSL::CA_NAME, ssl_context: @ssl_context)
         if @machine.ca_fingerprint
-          actual_digest = Puppet::SSL::Digest.new(@machine.digest, pem).to_hex
+          actual_digest = @machine.digest_as_hex(pem)
           expected_digest = @machine.ca_fingerprint.scan(/../).join(':').upcase
           if actual_digest == expected_digest
             Puppet.info(_("Verified CA bundle with digest (%{digest_type}) %{actual_digest}") %
@@ -73,7 +88,7 @@ class Puppet::SSL::StateMachine
         @cert_provider.save_cacerts(cacerts)
       end
 
-      NeedCRLs.new(@machine, next_ctx)
+      NeedCRLs.new(@machine, next_ctx, force_crl_refresh)
     rescue OpenSSL::X509::CertificateError => e
       Error.new(@machine, e.message, e)
     rescue Puppet::HTTP::ResponseError => e
@@ -83,6 +98,51 @@ class Puppet::SSL::StateMachine
         to_error(_('Could not download CA certificate: %{message}') % { message: e.message }, e)
       end
     end
+
+    private
+
+    def needs_refresh?(now, last_update)
+      return true if last_update.nil?
+
+      ca_ttl = Puppet[:ca_refresh_interval]
+      return false unless ca_ttl
+
+      now.to_i > last_update.to_i + ca_ttl
+    end
+
+    def refresh_ca(ssl_ctx, last_update)
+      Puppet.info(_("Refreshing CA certificate"))
+
+      # return the next_ctx containing the updated ca
+      [download_ca(ssl_ctx, last_update), true]
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 304
+        Puppet.info(_("CA certificate is unmodified, using existing CA certificate"))
+      else
+        Puppet.info(_("Failed to refresh CA certificate, using existing CA certificate: %{message}") % {message: e.message})
+      end
+
+      # return the original ssl_ctx
+      [ssl_ctx, false]
+    rescue Puppet::HTTP::HTTPError => e
+      Puppet.warning(_("Failed to refresh CA certificate, using existing CA certificate: %{message}") % {message: e.message})
+
+      # return the original ssl_ctx
+      [ssl_ctx, false]
+    end
+
+    def download_ca(ssl_ctx, last_update)
+      route = @machine.session.route_to(:ca, ssl_context: ssl_ctx)
+      _, pem = route.get_certificate(Puppet::SSL::CA_NAME, if_modified_since: last_update, ssl_context: ssl_ctx)
+      cacerts = @cert_provider.load_cacerts_from_pem(pem)
+      # verify cacerts before saving
+      next_ctx = @ssl_provider.create_root_context(cacerts: cacerts, revocation: false)
+      @cert_provider.save_cacerts(cacerts)
+
+      Puppet.info("Refreshed CA certificate: #{@machine.digest_as_hex(pem)}")
+
+      next_ctx
+    end
   end
 
   # If revocation is enabled, load CRLs or download them, using the CA bundle
@@ -92,6 +152,13 @@ class Puppet::SSL::StateMachine
   # for which we don't have a CRL
   #
   class NeedCRLs < SSLState
+    attr_reader :force_crl_refresh
+
+    def initialize(machine, ssl_context, force_crl_refresh = false)
+      super(machine, ssl_context)
+      @force_crl_refresh = force_crl_refresh
+    end
+
     def next_state
       Puppet.debug("Loading CRLs")
 
@@ -101,15 +168,12 @@ class Puppet::SSL::StateMachine
         if crls
           next_ctx = @ssl_provider.create_root_context(cacerts: ssl_context[:cacerts], crls: crls)
 
-          crl_ttl = Puppet[:crl_refresh_interval]
-          if crl_ttl
-            last_update = @cert_provider.crl_last_update
-            now = Time.now
-            if last_update.nil? || now.to_i > last_update.to_i + crl_ttl
-              # set last updated time first, then make a best effort to refresh
-              @cert_provider.crl_last_update = now
-              next_ctx = refresh_crl(next_ctx, last_update)
-            end
+          now = Time.now
+          last_update = @cert_provider.crl_last_update
+          if needs_refresh?(now, last_update)
+            # set last updated time first, then make a best effort to refresh
+            @cert_provider.crl_last_update = now
+            next_ctx = refresh_crl(next_ctx, last_update)
           end
         else
           next_ctx = download_crl(@ssl_context, nil)
@@ -132,6 +196,15 @@ class Puppet::SSL::StateMachine
 
     private
 
+    def needs_refresh?(now, last_update)
+      return true if @force_crl_refresh || last_update.nil?
+
+      crl_ttl = Puppet[:crl_refresh_interval]
+      return false unless crl_ttl
+
+      now.to_i > last_update.to_i + crl_ttl
+    end
+
     def refresh_crl(ssl_ctx, last_update)
       Puppet.info(_("Refreshing CRL"))
 
@@ -161,6 +234,8 @@ class Puppet::SSL::StateMachine
       next_ctx = @ssl_provider.create_root_context(cacerts: ssl_ctx[:cacerts], crls: crls)
       @cert_provider.save_crls(crls)
 
+      Puppet.info("Refreshed CRL: #{@machine.digest_as_hex(pem)}")
+
       next_ctx
     end
   end
@@ -440,6 +515,10 @@ class Puppet::SSL::StateMachine
     @lockfile.unlock
   end
 
+  def digest_as_hex(str)
+    Puppet::SSL::Digest.new(digest, str).to_hex
+  end
+
   private
 
   def run_machine(state, stop)

data/lib/puppet/ssl/verifier.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/ssl'
 
 # Verify an SSL connection.

data/lib/puppet/ssl.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # Just to make the constants work out.
 require_relative '../puppet'
 require_relative 'ssl/openssl_loader'
@@ -9,7 +10,7 @@ require_relative 'ssl/openssl_loader'
 # @see Puppet::SSL::SSLProvider
 # @api private
 module Puppet::SSL
-  CA_NAME = "ca".freeze
+  CA_NAME = "ca"
 
   require_relative 'ssl/oids'
   require_relative 'ssl/error'

data/lib/puppet/syntax_checkers/base64.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # A syntax checker for Base64.
 # @api public
 require_relative '../../puppet/syntax_checkers'

data/lib/puppet/syntax_checkers/epp.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # A syntax checker for JSON.
 # @api public
 require_relative '../../puppet/syntax_checkers'

data/lib/puppet/syntax_checkers/json.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # A syntax checker for JSON.
 # @api public
 require_relative '../../puppet/syntax_checkers'

data/lib/puppet/syntax_checkers/pp.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # A syntax checker for JSON.
 # @api public
 require_relative '../../puppet/syntax_checkers'

data/lib/puppet/syntax_checkers.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # A name space for syntax checkers provided by Puppet.
 module Puppet::SyntaxCheckers
 end

data/lib/puppet/test/test_helper.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'tmpdir'
 require 'fileutils'
 
@@ -69,13 +70,7 @@ module Puppet::Test
     # @return nil
     def self.before_all_tests()
       # The process environment is a shared, persistent resource.
-      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
-      if (!!File::ALT_SEPARATOR)
-        mode = :windows
-      else
-        mode = :posix
-      end
-      $old_env = Puppet::Util.get_environment(mode)
+      $old_env = ENV.to_hash
     end
 
     # Call this method once, at the end of a test run, when no more tests
@@ -188,20 +183,8 @@ module Puppet::Test
       end
       $saved_indirection_state = nil
 
-      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
-      if (!!File::ALT_SEPARATOR)
-        mode = :windows
-      else
-        mode = :posix
-      end
-      # Restore the global process environment.  Can't just assign because this
-      # is a magic variable, sadly, and doesn't do that™.  It is sufficiently
-      # faster to use the compare-then-set model to avoid excessive work that it
-      # justifies the complexity.  --daniel 2012-03-15
-      unless Puppet::Util.get_environment(mode) == $old_env
-        Puppet::Util.clear_environment(mode)
-        $old_env.each {|k, v| Puppet::Util.set_env(k, v, mode) }
-      end
+      # Restore the global process environment.
+      ENV.replace($old_env)
 
       # Clear all environments
       Puppet.lookup(:environments).clear_all

data/lib/puppet/thread_local.rb

@@ -1,7 +1,5 @@
+# frozen_string_literal: true
 require 'concurrent'
 
-# We want to use the pure Ruby implementation even on JRuby. If we use the Java
-# implementation of ThreadLocal, we end up leaking references to JRuby instances
-# and preventing them from being garbage collected.
-class Puppet::ThreadLocal < Concurrent::RubyThreadLocalVar
+class Puppet::ThreadLocal < Concurrent::ThreadLocalVar
 end

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # Adds additional resources to the catalog and relationship graph that are
 # generated by existing resources. There are two ways that a resource can
 # generate additional resources, either through the #generate method or the

data/lib/puppet/transaction/event.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/transaction'
 require_relative '../../puppet/util/tagging'
 require_relative '../../puppet/util/logging'

data/lib/puppet/transaction/event_manager.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/transaction'
 
 # This class stores, routes, and responds to events generated while evaluating

data/lib/puppet/transaction/persistence.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'yaml'
 require_relative '../../puppet/util/yaml'
 

data/lib/puppet/transaction/report.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet'
 require_relative '../../puppet/indirector'
 
@@ -139,7 +140,7 @@ class Puppet::Transaction::Report
   #
   attr_accessor :transaction_completed
 
-  TOTAL = "total".freeze
+  TOTAL = "total"
 
   def self.from_data_hash(data)
     obj = self.allocate
@@ -368,7 +369,7 @@ class Puppet::Transaction::Report
   def summary
     report = raw_summary
 
-    ret = ""
+    ret = String.new
     report.keys.sort_by(&:to_s).each do |key|
       ret += "#{Puppet::Util::Metric.labelize(key)}:\n"
 

data/lib/puppet/transaction/resource_harness.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../puppet/resource/status'
 
 class Puppet::Transaction::ResourceHarness

data/lib/puppet/transaction.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../puppet'
 require_relative '../puppet/util/tagging'
 require_relative '../puppet/util/skip_tags'

data/lib/puppet/trusted_external.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # A method for retrieving external trusted facts
 module Puppet::TrustedExternal
   def retrieve(certname)

data/lib/puppet/type/component.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 
 require_relative '../../puppet'
 require_relative '../../puppet/type'

data/lib/puppet/type/exec.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Puppet
   Type.newtype(:exec) do
     include Puppet::Util::Execution

data/lib/puppet/type/file/checksum.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../../puppet/util/checksums'
 
 # Specify which checksum algorithm to use when checksumming

data/lib/puppet/type/file/checksum_value.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../../puppet/util/checksums'
 require_relative '../../../puppet/type/file/data_sync'
 

data/lib/puppet/type/file/content.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'net/http'
 require 'uri'
 require 'tempfile'

data/lib/puppet/type/file/ctime.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Puppet
   Puppet::Type.type(:file).newproperty(:ctime) do
     desc %q{A read-only state to check the file ctime. On most modern \*nix-like

data/lib/puppet/type/file/data_sync.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../../puppet/util/checksums'
 require_relative '../../../puppet/util/diff'
 require 'date'

data/lib/puppet/type/file/ensure.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 
 module Puppet
   Puppet::Type.type(:file).ensurable do

data/lib/puppet/type/file/group.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative '../../../puppet/util/posix'
 
 module Puppet

data/lib/puppet/type/file/mode.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # Manage file modes.  This state should support different formats
 # for specification (e.g., u+rwx, or -0011), but for now only supports
 # specifying the full mode.

data/lib/puppet/type/file/mtime.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Puppet
   Puppet::Type.type(:file).newproperty(:mtime) do
     desc %q{A read-only state to check the file mtime. On \*nix-like systems, this

data/lib/puppet/type/file/owner.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Puppet
   Puppet::Type.type(:file).newproperty(:owner) do
     include Puppet::Util::Warnings