puppet 7.6.1-x86-mingw32 → 7.10.0-x86-mingw32

data/lib/puppet/application/script.rb

@@ -1,7 +1,7 @@
-require 'puppet/application'
-require 'puppet/configurer'
-require 'puppet/util/profiler/aggregate'
-require 'puppet/parser/script_compiler'
+require_relative '../../puppet/application'
+require_relative '../../puppet/configurer'
+require_relative '../../puppet/util/profiler/aggregate'
+require_relative '../../puppet/parser/script_compiler'
 
 class Puppet::Application::Script < Puppet::Application
 
@@ -71,7 +71,8 @@ configuration options can also be generated by running puppet with
   Where to send log messages. Choose between 'syslog' (the POSIX syslog
   service), 'eventlog' (the Windows Event Log), 'console', or the path to a log
   file. Defaults to 'console'.
-  Multiple destinations can be set using a comma separated list (eg: `/path/file1,console,/path/file2`)"
+  Multiple destinations can be set using a comma separated list
+  (eg: `/path/file1,console,/path/file2`)"
 
   A path ending with '.json' will receive structured output in JSON format. The
   log file will not have an ending ']' automatically written to it due to the

data/lib/puppet/application/ssl.rb

@@ -1,5 +1,5 @@
-require 'puppet/application'
-require 'puppet/ssl/oids'
+require_relative '../../puppet/application'
+require_relative '../../puppet/ssl/oids'
 
 class Puppet::Application::Ssl < Puppet::Application
 
@@ -117,6 +117,7 @@ HELP
     end
 
     Puppet::SSL::Oids.register_puppet_oids
+    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])
 
     certname = Puppet[:certname]
     action = command_line.args.first

data/lib/puppet/application_support.rb

@@ -1,9 +1,9 @@
 require 'yaml'
 
-require 'puppet'
-require 'puppet/node/environment'
-require 'puppet/file_system'
-require 'puppet/indirector'
+require_relative '../puppet'
+require_relative '../puppet/node/environment'
+require_relative '../puppet/file_system'
+require_relative '../puppet/indirector'
 
 module Puppet
   module ApplicationSupport

data/lib/puppet/compilable_resource_type.rb

@@ -1,4 +1,4 @@
-require 'puppet'
+require_relative '../puppet'
 # The CompilableResourceType module should be either included in a class or used as a class extension
 # to mark that the instance used as the 'resource type' of a resource instance
 # is an object that is compatible with Puppet::Type's API wrt. compiling.

data/lib/puppet/concurrent/lock.rb

@@ -1,4 +1,4 @@
-require 'puppet/concurrent/synchronized'
+require_relative '../../puppet/concurrent/synchronized'
 
 module Puppet
 module Concurrent

data/lib/puppet/configurer.rb

@@ -1,13 +1,13 @@
 # The client for interacting with the puppetmaster config server.
 require 'timeout'
-require 'puppet/util'
+require_relative '../puppet/util'
 require 'securerandom'
 #require 'puppet/parser/script_compiler'
-require 'puppet/pops/evaluator/deferred_resolver'
+require_relative '../puppet/pops/evaluator/deferred_resolver'
 
 class Puppet::Configurer
-  require 'puppet/configurer/fact_handler'
-  require 'puppet/configurer/plugin_handler'
+  require_relative 'configurer/fact_handler'
+  require_relative 'configurer/plugin_handler'
 
   include Puppet::Configurer::FactHandler
 
@@ -91,7 +91,7 @@ class Puppet::Configurer
 
         if result
           # don't use use cached catalog if it doesn't match server specified environment
-          if @node_environment && result.environment != @environment
+          if result.environment != @environment
             Puppet.err _("Not using cached catalog because its environment '%{catalog_env}' does not match '%{local_env}'") % { catalog_env: result.environment, local_env: @environment }
             return nil
           end
@@ -126,6 +126,94 @@ class Puppet::Configurer
     catalog
   end
 
+  def warn_number_of_facts(size, max_number)
+    Puppet.warning _("The current total number of facts: %{size} exceeds the number of facts limit: %{max_size}") % { size: size, max_size: max_number }
+  end
+
+  def warn_fact_name_length(name, max_length)
+    Puppet.warning _("Fact %{name} with length: '%{length}' exceeds the length limit: %{limit}") % { name: name, length: name.to_s.bytesize, limit: max_length }
+  end
+
+  def warn_number_of_top_level_facts(size, max_number)
+    Puppet.warning _("The current number of top level facts: %{size} exceeds the top facts limit: %{max_size}") % { size: size, max_size: max_number }
+  end
+
+  def warn_fact_value_length(value, max_length)
+    Puppet.warning _("Fact value '%{value}' with the value length: '%{length}' exceeds the value length limit: %{max_length}") % { value: value, length:value.to_s.bytesize, max_length: max_length }
+  end
+
+  def warn_fact_payload_size(payload, max_size)
+    Puppet.warning _("Payload with the current size of: '%{payload}' exceeds the payload size limit: %{max_size}") % { payload: payload, max_size: max_size }
+  end
+
+  def check_fact_name_length(name, number_of_dots)
+    max_length = Puppet[:fact_name_length_soft_limit]
+    return if max_length.zero?
+
+    # rough byte size estimations of fact path as a postgresql btree index 
+    size_as_btree_index = 8 + (number_of_dots * 2) + name.to_s.bytesize
+    warn_fact_name_length(name, max_length) if size_as_btree_index > max_length
+  end
+
+  def check_fact_values_length(values)
+    max_length = Puppet[:fact_value_length_soft_limit]
+    return if max_length.zero?
+
+    warn_fact_value_length(values, max_length) if values.to_s.bytesize > max_length
+  end
+
+  def check_top_level_number_limit(size)
+    max_size = Puppet[:top_level_facts_soft_limit]
+    return if max_size.zero?
+
+    warn_number_of_top_level_facts(size, max_size) if size > max_size
+  end
+
+  def check_total_number_limit(size)
+    max_size = Puppet[:number_of_facts_soft_limit]
+    return if max_size.zero?
+
+    warn_number_of_facts(size, max_size) if size > max_size
+  end
+
+  def check_payload_size(payload)
+    max_size = Puppet[:payload_soft_limit]
+    return if max_size.zero?
+
+    warn_fact_payload_size(payload, max_size) if payload > max_size
+    Puppet.debug _("The size of the payload is %{payload}") % {payload: payload}
+  end
+
+  def parse_fact_name_and_value_limits(object, path = [])
+    case object
+    when Hash
+      object.each do |key, value|
+        path.push(key)
+        parse_fact_name_and_value_limits(value, path)
+        path.pop
+        @number_of_facts += 1
+      end
+    when Array
+      object.each_with_index do |e, idx|
+        path.push(idx)
+        parse_fact_name_and_value_limits(e, path)
+        path.pop
+      end
+    else
+      check_fact_name_length(path.join(), path.size)
+      check_fact_values_length(object)
+    end
+  end
+
+  def check_facts_limits(facts)
+    @number_of_facts = 0
+    check_top_level_number_limit(facts.size)
+
+    parse_fact_name_and_value_limits(facts)
+    check_total_number_limit(@number_of_facts)
+    Puppet.debug _("The total number of facts registered is %{number_of_facts}") % {number_of_facts: @number_of_facts}
+  end
+
   def get_facts(options)
     if options[:pluginsync]
       plugin_sync_time = thinmark do
@@ -148,7 +236,9 @@ class Puppet::Configurer
       # facts_for_uploading may set Puppet[:node_name_value] as a side effect
       facter_time = thinmark do
         facts = find_facts
+        check_facts_limits(facts.to_data_hash['values'])
         facts_hash = encode_facts(facts) # encode for uploading # was: facts_for_uploading
+        check_payload_size(facts_hash[:facts].bytesize)
       end
       options[:report].add_times(:fact_generation, facter_time) if options[:report]
     end
@@ -255,6 +345,7 @@ class Puppet::Configurer
 
   def run_internal(options)
     report = options[:report]
+    report.initial_environment = Puppet[:environment]
 
     if options[:start_time]
       startup_time = Time.now - options[:start_time]
@@ -294,53 +385,18 @@ class Puppet::Configurer
       configured_environment = Puppet[:environment] if Puppet.settings.set_by_config?(:environment)
 
       # We only need to find out the environment to run in if we don't already have a catalog
-      unless (cached_catalog || options[:catalog] || Puppet[:strict_environment_mode])
-        begin
-          node = nil
-          node_retr_time = thinmark do
-            node = Puppet::Node.indirection.find(Puppet[:node_name_value],
-              :environment => Puppet::Node::Environment.remote(@environment),
-              :configured_environment => configured_environment,
-              :ignore_cache => true,
-              :transaction_uuid => @transaction_uuid,
-              :fail_on_404 => true)
-          end
-          options[:report].add_times(:node_retrieval, node_retr_time)
-
-          if node
-            # If we have deserialized a node from a rest call, we want to set
-            # an environment instance as a simple 'remote' environment reference.
-            if !node.has_environment_instance? && node.environment_name
-              node.environment = Puppet::Node::Environment.remote(node.environment_name)
-            end
-
-            @node_environment = node.environment.to_s
-
-            if node.environment.to_s != @environment
-              Puppet.notice _("Local environment: '%{local_env}' doesn't match server specified node environment '%{node_env}', switching agent to '%{node_env}'.") % { local_env: @environment, node_env: node.environment }
-              @environment = node.environment.to_s
-              report.environment = @environment
-              query_options = nil
-              facts = nil
-
-              new_env = Puppet::Node::Environment.remote(@environment)
-              Puppet.push_context(
-                {
-                  current_environment: new_env,
-                  loaders: Puppet::Pops::Loaders.new(new_env, true)
-                },
-                "Local node environment #{@environment} for configurer transaction"
-              )
-            else
-              Puppet.info _("Using configured environment '%{env}'") % { env: @environment }
-            end
-          end
-        rescue StandardError => detail
-          Puppet.warning(_("Unable to fetch my node definition, but the agent run will continue:"))
-          Puppet.warning(detail)
+      unless (cached_catalog || options[:catalog] || Puppet.settings.set_by_cli?(:environment) || Puppet[:strict_environment_mode])
+        Puppet.debug(_("Environment not passed via CLI and no catalog was given, attempting to find out the last server-specified environment"))
+        if last_server_specified_environment
+          @environment = last_server_specified_environment
+          report.environment = last_server_specified_environment
+        else
+          Puppet.debug(_("Could not find a usable environment in the lastrunfile. Either the file does not exist, does not have the required keys, or the values of 'initial_environment' and 'converged_environment' are identical."))
         end
       end
 
+      Puppet.info _("Using environment '%{env}'") % { env: @environment }
+
       # This is to maintain compatibility with anyone using this class
       # aside from agent, apply, device.
       unless Puppet.lookup(:loaders) { nil }
@@ -354,9 +410,15 @@ class Puppet::Configurer
         )
       end
 
+      temp_value = options[:pluginsync]
+
+      # only validate server environment if pluginsync is requested
+      options[:pluginsync] = valid_server_environment? if options[:pluginsync] == true
+
       query_options, facts = get_facts(options) unless query_options
+      options[:pluginsync] = temp_value
+
       query_options[:configured_environment] = configured_environment
-      options[:convert_for_node] = node
 
       catalog = prepare_and_retrieve_catalog(cached_catalog, facts, options, query_options)
       unless catalog
@@ -381,6 +443,15 @@ class Puppet::Configurer
         @environment = catalog.environment
         report.environment = @environment
 
+        new_env = Puppet::Node::Environment.remote(@environment)
+        Puppet.push_context(
+          {
+            :current_environment => new_env,
+            :loaders => Puppet::Pops::Loaders.new(new_env, true)
+          },
+          "Local node environment #{@environment} for configurer transaction"
+        )
+
         query_options, facts = get_facts(options)
         query_options[:configured_environment] = configured_environment
 
@@ -454,6 +525,25 @@ class Puppet::Configurer
   end
   private :run_internal
 
+  def valid_server_environment?
+    session = Puppet.lookup(:http_session)
+    begin
+      fs = session.route_to(:fileserver)
+      fs.get_file_metadatas(path: URI(Puppet[:pluginsource]).path, recurse: :false, environment: @environment)
+      true
+    rescue Puppet::HTTP::ResponseError => detail
+      if detail.response.code == 404
+        Puppet.notice(_("Environment '%{environment}' not found on server, skipping initial pluginsync.") % { environment: @environment })
+      else
+        Puppet.log_exception(detail, detail.message)
+      end
+      false
+    rescue => detail
+      Puppet.log_exception(detail, detail.message)
+      false
+    end
+  end
+
   def find_functional_server
     begin
       session = Puppet.lookup(:http_session)
@@ -470,6 +560,24 @@ class Puppet::Configurer
   end
   private :find_functional_server
 
+  def last_server_specified_environment
+    return @last_server_specified_environment if @last_server_specified_environment
+    if Puppet::FileSystem.exist?(Puppet[:lastrunfile])
+      summary = Puppet::Util::Yaml.safe_load_file(Puppet[:lastrunfile])
+      return unless summary.dig('application', 'run_mode') == 'agent'
+      initial_environment = summary.dig('application', 'initial_environment')
+      converged_environment = summary.dig('application', 'converged_environment')
+      @last_server_specified_environment = converged_environment if initial_environment != converged_environment
+    end
+
+    Puppet.debug(_("Found last server-specified environment: %{environment}") % { environment: @last_server_specified_environment }) if @last_server_specified_environment
+    @last_server_specified_environment
+  rescue => detail
+    Puppet.debug(_("Could not find last server-specified environment: %{detail}") % { detail: detail })
+    nil
+  end
+  private :last_server_specified_environment
+
   def send_report(report)
     puts report.summary if Puppet[:summarize]
     save_last_run_summary(report)
@@ -558,6 +666,7 @@ class Puppet::Configurer
           # don't update cache until after environment converges
           :ignore_cache_save => true,
           :environment       => Puppet::Node::Environment.remote(@environment),
+          :check_environment => true,
           :fail_on_404       => true,
           :facts_for_catalog => facts
         )

data/lib/puppet/configurer/downloader.rb

@@ -1,5 +1,5 @@
-require 'puppet/configurer'
-require 'puppet/resource/catalog'
+require_relative '../../puppet/configurer'
+require_relative '../../puppet/resource/catalog'
 
 class Puppet::Configurer::Downloader
   attr_reader :name, :path, :source, :ignore
@@ -73,7 +73,8 @@ class Puppet::Configurer::Downloader
       :purge => true,
       :force => true,
       :backup => false,
-      :noop => false
+      :noop => false,
+      :max_files => -1
     }
     if !Puppet::Util::Platform.windows?
       defargs[:owner] = Process.uid

data/lib/puppet/configurer/fact_handler.rb

@@ -1,7 +1,7 @@
-require 'puppet/indirector/facts/facter'
+require_relative '../../puppet/indirector/facts/facter'
 
-require 'puppet/configurer'
-require 'puppet/configurer/downloader'
+require_relative '../../puppet/configurer'
+require_relative '../../puppet/configurer/downloader'
 
 # Break out the code related to facts.  This module is
 # just included into the agent, but having it here makes it

data/lib/puppet/configurer/plugin_handler.rb

@@ -1,7 +1,7 @@
 # Break out the code related to plugins.  This module is
 # just included into the agent, but having it here makes it
 # easier to test.
-require 'puppet/configurer'
+require_relative '../../puppet/configurer'
 
 class Puppet::Configurer::PluginHandler
   SUPPORTED_LOCALES_MOUNT_AGENT_VERSION = Gem::Version.new("5.3.4")

data/lib/puppet/confine.rb

@@ -1,6 +1,6 @@
 # The class that handles testing whether our providers
 # actually work or not.
-require 'puppet/util'
+require_relative '../puppet/util'
 
 class Puppet::Confine
   include Puppet::Util

data/lib/puppet/confine/boolean.rb

@@ -1,4 +1,4 @@
-require 'puppet/confine'
+require_relative '../../puppet/confine'
 
 # Common module for the Boolean confines. It currently
 # contains just enough code to implement PUP-9336.

data/lib/puppet/confine/exists.rb

@@ -1,4 +1,4 @@
-require 'puppet/confine'
+require_relative '../../puppet/confine'
 
 class Puppet::Confine::Exists < Puppet::Confine
   def self.summarize(confines)

data/lib/puppet/confine/false.rb

@@ -1,4 +1,4 @@
-require 'puppet/confine/boolean'
+require_relative '../../puppet/confine/boolean'
 
 class Puppet::Confine::False < Puppet::Confine
   include Puppet::Confine::Boolean

data/lib/puppet/confine/feature.rb

@@ -1,4 +1,4 @@
-require 'puppet/confine'
+require_relative '../../puppet/confine'
 
 class Puppet::Confine::Feature < Puppet::Confine
   def self.summarize(confines)

data/lib/puppet/confine/true.rb

@@ -1,4 +1,4 @@
-require 'puppet/confine/boolean'
+require_relative '../../puppet/confine/boolean'
 
 class Puppet::Confine::True < Puppet::Confine
   include Puppet::Confine::Boolean

data/lib/puppet/confine/variable.rb

@@ -1,4 +1,4 @@
-require 'puppet/confine'
+require_relative '../../puppet/confine'
 
 # Require a specific value for a variable, either a Puppet setting
 # or a Facter value.  This class is a bit weird because the name