puppet 7.4.1 → 7.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1dc7fca54856073eca2fb108213f2870e9d9cbe9c176bf4c0ff1820182aa1487
-  data.tar.gz: 0e73ef249f8a19167ba68b84e3d8ddf2a5fcf82a5689d7955ed777feff43c5cf
+  metadata.gz: d0c46be8ea84f210c98907f78f8fa7e67ddfe3500e77a8a1ab503f28f1887285
+  data.tar.gz: e237a260fc5fb15474bd6713dad901fc7af6199d3da584aadb3c15cbff45886b
 SHA512:
-  metadata.gz: 313206ed5d0288d41c429eaef41b6507afd490298ff4b549bae911dffcbd06c2a1579329e4cf9ae94d5a1c2888d981c51730ec38450298cfd63b35f07cd34ca3
-  data.tar.gz: a9204bfb79227de4126b352a12dce922723de2910c621ebfa28e220756440c3b76f34d4e489e7c5d898a93a9f79297c044ac3bb8dff420279493dc8f75098a1a
+  metadata.gz: 8cea314360893199a90e60d9da0a393f7caae00ec554bfa643d4b66a254d1a71a520eb5f0fd4b28adec1869c1ac693362613aea38c747c3c7b9f75f8af720bea
+  data.tar.gz: 9df0489d6c2160814c17c28af8b151aa81175fb8919e4d80552733ad7657e22147da2743ac6780f786481d923f7f2e6044b88fc80ec9c570105b63f5ac1c1d85

data/Gemfile.lock

@@ -1,7 +1,18 @@
+GIT
+  remote: git://github.com/ciprianbadescu/packaging
+  revision: 5f8d2bda941abfeeb8fb1731c9b1dd4d108f5d33
+  branch: maint/windows-signing
+  specs:
+    packaging (0.99.49.171.g5f8d2bd)
+      artifactory (~> 2)
+      csv (= 3.1.5)
+      rake (>= 12.3)
+      release-metrics
+
 PATH
   remote: .
   specs:
-    puppet (7.4.1)
+    puppet (7.5.0)
       CFPropertyList (~> 2.2)
       concurrent-ruby (~> 1.0)
       deep_merge (~> 1.0)
@@ -33,7 +44,7 @@ GEM
       hocon (~> 1.3)
       thor (>= 1.0.1, < 2.0)
     fast_gettext (1.1.2)
-    ffi (1.14.2)
+    ffi (1.15.0)
     gettext (3.2.9)
       locale (>= 2.0.5)
       text (>= 1.3.0)
@@ -43,10 +54,10 @@ GEM
       locale
     hashdiff (1.0.1)
     hiera (3.6.0)
-    hiera-eyaml (3.2.0)
-      highline (~> 1.6.19)
+    hiera-eyaml (3.2.1)
+      highline
       optimist
-    highline (1.6.21)
+    highline (2.0.3)
     hocon (1.3.1)
     hpricot (0.8.6)
     json-schema (2.8.1)
@@ -59,11 +70,6 @@ GEM
     multi_json (1.15.0)
     mustache (1.1.1)
     optimist (3.0.1)
-    packaging (0.99.75)
-      artifactory (~> 2)
-      csv (= 3.1.5)
-      rake (>= 12.3)
-      release-metrics
     parallel (1.20.1)
     parser (2.7.2.0)
       ast (~> 2.4.1)
@@ -115,7 +121,7 @@ GEM
       unicode-display_width (~> 1.0, >= 1.0.1)
     rubocop-i18n (1.2.0)
       rubocop (~> 0.49.0)
-    ruby-prof (1.4.2)
+    ruby-prof (1.4.3)
     ruby-progressbar (1.11.0)
     scanf (1.0.0)
     semantic_puppet (1.0.3)
@@ -123,7 +129,7 @@ GEM
     thor (1.1.0)
     unicode-display_width (1.7.0)
     vcr (5.1.0)
-    webmock (3.11.2)
+    webmock (3.12.1)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
@@ -142,7 +148,7 @@ DEPENDENCIES
   memory_profiler
   minitar (~> 0.9)
   msgpack (~> 1.2)
-  packaging (~> 0.99)
+  packaging!
   pry
   puppet!
   puppet-resource_api (~> 1.5)

data/lib/puppet/application/ssl.rb

@@ -74,6 +74,9 @@ ACTIONS
   `--localca` is specified, then also remove this host's local copy of the
   CA certificate(s) and CRL bundle. if `--target CERTNAME` is specified, then
   remove the files for the specified device on this host instead of this host.
+
+ * show:
+  Print the full-text version of this host's certificate.
 HELP
   end
 
@@ -142,11 +145,19 @@ HELP
       end
       @machine.ensure_client_certificate
       Puppet.notice(_("Completed SSL initialization"))
+    when 'show'
+      show(certname)
     else
       raise Puppet::Error, _("Unknown action '%{action}'") % { action: action }
     end
   end
 
+  def show(certname)
+    password = @cert_provider.load_private_key_password
+    ssl_context = @ssl_provider.load_context(certname: certname, password: password)
+    puts ssl_context.client_cert.to_text
+  end
+
   def submit_request(ssl_context)
     key = @cert_provider.load_private_key(Puppet[:certname])
     unless key

data/lib/puppet/defaults.rb

@@ -1033,6 +1033,14 @@ EOT
           certificate revocation checking and does not attempt to download the CRL.
         EOT
     },
+    :ciphers => {
+      :default => 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256',
+      :type => :string,
+      :desc => "The list of ciphersuites for TLS connections initiated by puppet. The
+                default value is chosen to support TLS 1.0 and up, but can be made
+                more restrictive if needed. The ciphersuites must be specified in OpenSSL
+                format, not IANA."
+    },
     :key_type => {
       :default => 'rsa',
       :type    => :enum,

data/lib/puppet/environments.rb

@@ -225,6 +225,9 @@ module Puppet::Environments
     private
 
     def create_environment(name)
+      # interpolated modulepaths may be cached from prior environment instances
+      Puppet.settings.clear_environment_settings(name)
+
       env_symbol = name.intern
       setting_values = Puppet.settings.values(env_symbol, Puppet.settings.preferred_run_mode)
       env = Puppet::Node::Environment.create(
@@ -350,7 +353,19 @@ module Puppet::Environments
 
     # @!macro loader_list
     def list
-      @loader.list
+      # Evict all that have expired, in the same way as `get`
+      clear_all_expired
+
+      @loader.list.map do |env|
+        name = env.name
+        old_entry = @cache[name]
+        if old_entry
+          old_entry.value
+        else
+          add_entry(name, entry(env))
+          env
+        end
+      end
     end
 
     # @!macro loader_search_paths

data/lib/puppet/ffi/windows/api_types.rb

@@ -20,7 +20,7 @@ module Puppet::FFI::Windows
 
     class ::FFI::Pointer
       NULL_HANDLE = 0
-      WCHAR_NULL = "\0\0".encode('UTF-16LE').freeze
+      WCHAR_NULL = "\0\0".force_encoding('UTF-16LE').freeze
 
       def self.from_string_to_wide_string(str, &block)
         str = Puppet::Util::Windows::String.wide_string(str)

data/lib/puppet/file_system/memory_file.rb

@@ -7,6 +7,13 @@ class Puppet::FileSystem::MemoryFile
     new(path, :exist? => false, :executable? => false)
   end
 
+  def self.a_missing_directory(path)
+    new(path,
+        :exist? => false,
+        :executable? => false,
+        :directory? => true)
+  end
+
   def self.a_regular_file_containing(path, content)
     new(path, :exist? => true, :executable? => false, :content => content)
   end
@@ -18,7 +25,7 @@ class Puppet::FileSystem::MemoryFile
   def self.a_directory(path, children = [])
     new(path,
         :exist? => true,
-        :excutable? => true,
+        :executable? => true,
         :directory? => true,
         :children => children)
   end

data/lib/puppet/file_system/windows.rb

@@ -128,6 +128,8 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
     end
 
     current_sid = Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name)
+    current_sid = Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_sam_compatible_user_name) unless current_sid
+
     dacl = case mode
            when 0644
              dacl = secure_dacl(current_sid)

data/lib/puppet/http/factory.rb

@@ -26,6 +26,10 @@ class Puppet::HTTP::Factory
 
     http = Puppet::HTTP::Proxy.proxy(URI(site.addr))
     http.use_ssl = site.use_ssl?
+    if site.use_ssl?
+      http.min_version = OpenSSL::SSL::TLS1_VERSION if http.respond_to?(:min_version)
+      http.ciphers = Puppet[:ciphers]
+    end
     http.read_timeout = Puppet[:http_read_timeout]
     http.open_timeout = Puppet[:http_connect_timeout]
     http.keep_alive_timeout = KEEP_ALIVE_TIMEOUT if http.respond_to?(:keep_alive_timeout=)

data/lib/puppet/network/http.rb

@@ -3,8 +3,11 @@ module Puppet::Network::HTTP
   HEADER_ENABLE_PROFILING = "X-Puppet-Profiling"
   HEADER_PUPPET_VERSION = "X-Puppet-Version"
 
-  MASTER_URL_PREFIX = "/puppet"
-  MASTER_URL_VERSIONS = "v3"
+  SERVER_URL_PREFIX = "/puppet"
+  SERVER_URL_VERSIONS = "v3"
+
+  MASTER_URL_PREFIX = SERVER_URL_PREFIX
+  MASTER_URL_VERSIONS = SERVER_URL_VERSIONS
 
   CA_URL_PREFIX = "/puppet-ca"
   CA_URL_VERSIONS = "v1"

data/lib/puppet/network/http/api.rb

@@ -18,18 +18,22 @@ class Puppet::Network::HTTP::API
                                                                       "Note that Puppet 3 agents aren't compatible with this version; if you're " +
                                                                       "running Puppet 3, you must either upgrade your agents to match the server " +
                                                                       "or point them to a server running Puppet 3.\n\n" +
-                                                                      "Master Info:\n" +
+                                                                      "Server Info:\n" +
                                                                       "  Puppet version: #{Puppet.version}\n" +
-                                                                      "  Supported /puppet API versions: #{Puppet::Network::HTTP::MASTER_URL_VERSIONS}\n",
+                                                                      "  Supported /puppet API versions: #{Puppet::Network::HTTP::SERVER_URL_VERSIONS}\n",
                                                                   Puppet::Network::HTTP::Issues::HANDLER_NOT_FOUND)
       end)
   end
 
-  def self.master_routes
-    master_prefix = Regexp.new("^#{Puppet::Network::HTTP::MASTER_URL_PREFIX}/")
-    Puppet::Network::HTTP::Route.path(master_prefix).
+  def self.server_routes
+    server_prefix = Regexp.new("^#{Puppet::Network::HTTP::SERVER_URL_PREFIX}/")
+    Puppet::Network::HTTP::Route.path(server_prefix).
       any.
-      chain(Puppet::Network::HTTP::API::Master::V3.routes,
+      chain(Puppet::Network::HTTP::API::Server::V3.routes,
             Puppet::Network::HTTP::API.not_found)
   end
+
+  def self.master_routes
+    server_routes
+  end
 end

data/lib/puppet/network/http/api/master.rb

@@ -1,2 +1,3 @@
-module Puppet::Network::HTTP::API::Master
-end
+require 'puppet/network/http/api/server'
+
+Puppet::Network::HTTP::API::Master = Puppet::Network::HTTP::API::Server

data/lib/puppet/network/http/api/master/v3.rb

@@ -1,26 +1,3 @@
-class Puppet::Network::HTTP::API::Master::V3
-  require 'puppet/network/http/api/master/v3/environments'
-  require 'puppet/network/http/api/indirected_routes'
+require 'puppet/network/http/api/master'
+require 'puppet/network/http/api/server/v3'
 
-  def self.wrap(&block)
-    lambda do |request, response|
-      Puppet::Network::Authorization.check_external_authorization(request.method, request.path)
-
-      block.call.call(request, response)
-    end
-  end
-
-  INDIRECTED = Puppet::Network::HTTP::Route.
-      path(/.*/).
-      any(wrap { Puppet::Network::HTTP::API::IndirectedRoutes.new } )
-
-  ENVIRONMENTS = Puppet::Network::HTTP::Route.
-      path(%r{^/environments$}).
-      get(wrap { Environments.new(Puppet.lookup(:environments)) } )
-
-  def self.routes
-    Puppet::Network::HTTP::Route.path(%r{v3}).
-        any.
-        chain(ENVIRONMENTS, INDIRECTED)
-  end
-end

data/lib/puppet/network/http/api/master/v3/environments.rb

@@ -1,34 +1,3 @@
-require 'puppet/util/json'
+require 'puppet/network/http/api/master'
+require 'puppet/network/http/api/server/v3/environments'
 
-class Puppet::Network::HTTP::API::Master::V3::Environments
-  def initialize(env_loader)
-    @env_loader = env_loader
-  end
-
-  def call(request, response)
-    response.respond_with(200, "application/json", Puppet::Util::Json.dump({
-      "search_paths" => @env_loader.search_paths,
-      "environments" => Hash[@env_loader.list.collect do |env|
-        [env.name, {
-          "settings" => {
-            "modulepath" => env.full_modulepath,
-            "manifest" => env.manifest,
-            "environment_timeout" => timeout(env),
-            "config_version" => env.config_version || '',
-          }
-        }]
-      end]
-    }))
-  end
-
-  private
-
-  def timeout(env)
-    ttl = @env_loader.get_conf(env.name).environment_timeout
-    if ttl == Float::INFINITY
-      "unlimited"
-    else
-      ttl
-    end
-  end
-end

data/lib/puppet/network/http/api/server.rb

@@ -0,0 +1,10 @@
+module Puppet
+  module Network
+    module HTTP
+      class API
+        module Server
+        end
+      end
+    end
+  end
+end

data/lib/puppet/network/http/api/server/v3.rb

@@ -0,0 +1,39 @@
+require 'puppet/network/http/api/server/v3/environments'
+require 'puppet/network/http/api/indirected_routes'
+
+module Puppet
+  module Network
+    module HTTP
+      class API
+        module Server
+          class V3
+
+            def self.wrap(&block)
+              lambda do |request, response|
+                Puppet::Network::Authorization.
+                  check_external_authorization(request.method,
+                                               request.path)
+
+                block.call.call(request, response)
+              end
+            end
+
+            INDIRECTED = Puppet::Network::HTTP::Route.
+                path(/.*/).
+                any(wrap { Puppet::Network::HTTP::API::IndirectedRoutes.new } )
+
+            ENVIRONMENTS = Puppet::Network::HTTP::Route.
+                path(%r{^/environments$}).
+                get(wrap { Environments.new(Puppet.lookup(:environments)) } )
+
+            def self.routes
+              Puppet::Network::HTTP::Route.path(%r{v3}).
+                  any.
+                  chain(ENVIRONMENTS, INDIRECTED)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/puppet/network/http/api/server/v3/environments.rb

@@ -0,0 +1,48 @@
+require 'puppet/util/json'
+
+module Puppet
+  module Network
+    module HTTP
+      class API
+        module Server
+          class V3
+            class Environments
+
+              def initialize(env_loader)
+                @env_loader = env_loader
+              end
+
+              def call(request, response)
+                response.respond_with(200, "application/json", Puppet::Util::Json.dump({
+                  "search_paths" => @env_loader.search_paths,
+                  "environments" => Hash[@env_loader.list.collect do |env|
+                    [env.name, {
+                      "settings" => {
+                        "modulepath" => env.full_modulepath,
+                        "manifest" => env.manifest,
+                        "environment_timeout" => timeout(env),
+                        "config_version" => env.config_version || '',
+                      }
+                    }]
+                  end]
+                }))
+              end
+
+              private
+
+              def timeout(env)
+                ttl = @env_loader.get_conf(env.name).environment_timeout
+                if ttl == Float::INFINITY
+                  "unlimited"
+                else
+                  ttl
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end
+