puppet 7.9.0 → 7.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3a94d69b4fdb82daece239f631857956cb724f3f4582f50ecbec6a79dc83082
-  data.tar.gz: 3deb923bf30984f5543826b11c49d03d8b055c2135790447729e914e58840344
+  metadata.gz: 9c9a5ad10d1fe29d4c28a410c34cc28236cc3a678444e72cdbcbd824ead10f99
+  data.tar.gz: 104352f3f069d1f9043dc386f035f0c18da3bbc09f1715092b682a6508b97842
 SHA512:
-  metadata.gz: 9bcd1f23664896b430462ffc78a1fc63621017f76a96681f89e625685e58a2cc85ab06907b55320298864102c87f3bb621af73a057c63da8204927a6d7cabf84
-  data.tar.gz: a6f338d559652ebe22d656af5c6b4623a22bf69dea46bda83f676580b06595b5ed5fa02addb7b97bd1bafb4b332a53f4295d78ff02c2b08f593677055f9403dc
+  metadata.gz: 45dcb3ec19cc2b62b3a642a3adbe3697a08eee3f6f79158b30e4b32dfecc4eb908f4d0c7a22958606b2cf3ba4cfefc93f17108b1ec159e49bdb4ed18540538aa
+  data.tar.gz: d5efd563f4a3bd518883d6ed8b8721cff49b81b9f0ccc0a382bb3e96ac4262ebbfe6535a12451f6d6a4ff61399cc5e79aeb64e13832443998dba2fa0fb2702ba

data/Gemfile

@@ -53,7 +53,7 @@ end
 group(:development, optional: true) do
   gem 'memory_profiler', require: false, platforms: [:mri]
   gem 'pry', require: false, platforms: [:ruby]
-  gem "racc", "1.4.9", require: false, platforms: [:ruby]
+  gem "racc", "1.5.2", require: false, platforms: [:ruby]
   if RUBY_PLATFORM != 'java'
     gem 'ruby-prof', '>= 0.16.0', require: false
   end
@@ -63,7 +63,7 @@ group(:packaging) do
   gem 'packaging', *location_for(ENV['PACKAGING_LOCATION'] || '~> 0.99')
 end
 
-group(:documentation) do
+group(:documentation, optional: true) do
   gem 'gettext-setup', '~> 0.28', require: false, platforms: [:ruby]
   gem 'ronn', '~> 0.7.3', require: false, platforms: [:ruby]
 end

data/Gemfile.lock

@@ -1,9 +1,9 @@
 GIT
   remote: git://github.com/puppetlabs/packaging
-  revision: 4d6d51947f44bfa2fc282658836c15f69672e757
+  revision: 4c5359786cad0d12877e10e98948065bfeb3e304
   branch: 1.0.x
   specs:
-    packaging (0.99.78.4.g4d6d519)
+    packaging (0.103.0)
       artifactory (~> 2)
       csv (= 3.1.5)
       rake (>= 12.3)
@@ -12,7 +12,7 @@ GIT
 PATH
   remote: .
   specs:
-    puppet (7.9.0)
+    puppet (7.12.1)
       CFPropertyList (~> 2.2)
       concurrent-ruby (~> 1.0)
       deep_merge (~> 1.0)
@@ -40,11 +40,11 @@ GEM
     deep_merge (1.2.1)
     diff-lcs (1.4.4)
     docopt (0.6.1)
-    facter (4.2.2)
+    facter (4.2.5)
       hocon (~> 1.3)
       thor (>= 1.0.1, < 2.0)
     fast_gettext (1.1.2)
-    ffi (1.15.3)
+    ffi (1.15.4)
     gettext (3.2.9)
       locale (>= 2.0.5)
       text (>= 1.3.0)
@@ -70,7 +70,7 @@ GEM
     multi_json (1.15.0)
     mustache (1.1.1)
     optimist (3.0.1)
-    parallel (1.20.1)
+    parallel (1.21.0)
     parser (2.7.2.0)
       ast (~> 2.4.1)
     powerpack (0.1.3)
@@ -80,9 +80,9 @@ GEM
     public_suffix (4.0.6)
     puppet-resource_api (1.8.14)
       hocon (>= 1.0)
-    puppetserver-ca (2.2.0)
+    puppetserver-ca (2.3.5)
       facter (>= 2.0.1, < 5)
-    racc (1.4.9)
+    racc (1.5.2)
     rainbow (2.2.2)
       rake
     rake (13.0.6)
@@ -127,10 +127,10 @@ GEM
     semantic_puppet (1.0.4)
     text (1.3.1)
     thor (1.1.0)
-    unicode-display_width (1.7.0)
+    unicode-display_width (1.8.0)
     vcr (5.1.0)
-    webmock (3.13.0)
-      addressable (>= 2.3.6)
+    webmock (3.14.0)
+      addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     yard (0.9.26)
@@ -153,7 +153,7 @@ DEPENDENCIES
   puppet!
   puppet-resource_api (~> 1.5)
   puppetserver-ca (~> 2.0)
-  racc (= 1.4.9)
+  racc (= 1.5.2)
   rake (~> 13.0)
   rdoc (~> 6.0)
   ronn (~> 0.7.3)

data/{ext → examples}/nagios/check_puppet.rb

@@ -11,8 +11,8 @@ class CheckPuppet
 
   # default options
   OPTIONS = {
-    :statefile => "/var/lib/puppet/state/state.yaml",
-    :process   => "puppetd",
+    :statefile => "/opt/puppetlabs/puppet/cache/state/state.yaml",
+    :process   => "puppet",
     :interval  => 30,
   }
 

data/ext/README.md

@@ -0,0 +1,13 @@
+# `ext/` directory details 
+This directory contains files used internally when packaging [puppet](https://github.com/puppetlabs/puppet) and [puppet-agent](https://github.com/puppetlabs/puppet-agent)
+What follows is a more detailed description of each directory/file:
+* `debian/` - init scripts for puppet (used for Debian-based platforms that do not support systemd)
+* `hiera/hiera.yaml` - installed to `$codedir/environments/production`as a default Hiera configuration file
+* `osx/puppet.plist` - puppet launchd plist for macOS
+* `redhat/` -  init scripts for puppet (used for EL-based platforms that do not support systemd)
+* `solaris/smf/` - service manifests for Solaris 11
+* `suse/client.init` - init script for puppet (used for SUSE-based platforms that do not support systemd) 
+* `systemd/puppet.service` - systemd unit file for puppet
+* `windows/` - the puppet daemon for Windows, and other useful `.bat` helper wrappers
+* `build_defaults.yaml` - information pertaining to the puppetlabs build automation
+* `project_data.yaml` - information used when packaging the puppet gem

data/lib/puppet/application/agent.rb

@@ -334,6 +334,10 @@ generated by running puppet agent with '--genconfig'.
   specifying a time of 0.
   (This is a Puppet setting, and can go in puppet.conf.)
 
+* --write_catalog_summary
+  After compiling the catalog saves the resource list and classes list to the node
+  in the state directory named classes.txt and resources.txt
+  (This is a Puppet setting, and can go in puppet.conf.)
 
 EXAMPLE
 -------

data/lib/puppet/application/apply.rb

@@ -16,7 +16,9 @@ class Puppet::Application::Apply < Puppet::Application
   option("--use-nodes")
   option("--detailed-exitcodes")
 
-  option("--write-catalog-summary")
+  option("--write-catalog-summary") do |arg|
+    Puppet[:write_catalog_summary] = arg
+  end
 
   option("--catalog catalog",  "-c catalog") do |arg|
     options[:catalog] = arg
@@ -169,6 +171,7 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
   def app_defaults
     super.merge({
       :default_file_terminus => :file_server,
+      :write_catalog_summary => false
     })
   end
 
@@ -247,7 +250,22 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
 
         catalog.retrieval_duration = Time.now - starttime
 
-        if options[:write_catalog_summary]
+        # We accept either the global option `--write_catalog_summary`
+        # corresponding to the new setting, or the application option
+        # `--write-catalog-summary`. The latter is needed to maintain backwards
+        # compatibility.
+        #
+        # Puppet settings parse global options using PuppetOptionParser, but it
+        # only recognizes underscores, not dashes.
+        # The base application parses app specific options using ruby's builtin
+        # OptionParser. As of ruby 2.4, it will accept either underscores or
+        # dashes, but prefer dashes.
+        #
+        # So if underscores are used, the PuppetOptionParser will parse it and
+        # store that in Puppet[:write_catalog_summary]. If dashes are used,
+        # OptionParser will parse it, and set Puppet[:write_catalog_summary]. In
+        # either case, settings will contain the correct value.
+        if Puppet[:write_catalog_summary]
           catalog.write_class_file
           catalog.write_resource_file
         end

data/lib/puppet/application/resource.rb

@@ -225,21 +225,23 @@ Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License
   def find_or_save_resources(type, name, params)
     key = local_key(type, name)
 
-    if name
-      if params.empty?
-        [ Puppet::Resource.indirection.find( key ) ]
+    Puppet.override(stringify_rich: true) do
+      if name
+        if params.empty?
+          [ Puppet::Resource.indirection.find( key ) ]
+        else
+          resource = Puppet::Resource.new( type, name, :parameters => params )
+
+          # save returns [resource that was saved, transaction log from applying the resource]
+          save_result = Puppet::Resource.indirection.save(resource, key)
+          [ save_result.first ]
+        end
       else
-        resource = Puppet::Resource.new( type, name, :parameters => params )
-
-        # save returns [resource that was saved, transaction log from applying the resource]
-        save_result = Puppet::Resource.indirection.save(resource, key)
-        [ save_result.first ]
-      end
-    else
-      if type == "file"
-        raise _("Listing all file instances is not supported.  Please specify a file or directory, e.g. puppet resource file /etc")
+        if type == "file"
+          raise _("Listing all file instances is not supported.  Please specify a file or directory, e.g. puppet resource file /etc")
+        end
+        Puppet::Resource.indirection.search( key, {} )
       end
-      Puppet::Resource.indirection.search( key, {} )
     end
   end
 end

data/lib/puppet/concurrent/thread_local_singleton.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Puppet
   module Concurrent
     module ThreadLocalSingleton

data/lib/puppet/configurer.rb

@@ -91,7 +91,7 @@ class Puppet::Configurer
 
         if result
           # don't use use cached catalog if it doesn't match server specified environment
-          if @node_environment && result.environment != @environment
+          if result.environment != @environment
             Puppet.err _("Not using cached catalog because its environment '%{catalog_env}' does not match '%{local_env}'") % { catalog_env: result.environment, local_env: @environment }
             return nil
           end
@@ -118,14 +118,105 @@ class Puppet::Configurer
       catalog = result.to_ral
       catalog.finalize
       catalog.retrieval_duration = duration
-      catalog.write_class_file
-      catalog.write_resource_file
+
+      if Puppet[:write_catalog_summary]
+        catalog.write_class_file
+        catalog.write_resource_file
+      end
     end
     options[:report].add_times(:convert_catalog, catalog_conversion_time) if options[:report]
 
     catalog
   end
 
+  def warn_number_of_facts(size, max_number)
+    Puppet.warning _("The current total number of facts: %{size} exceeds the number of facts limit: %{max_size}") % { size: size, max_size: max_number }
+  end
+
+  def warn_fact_name_length(name, max_length)
+    Puppet.warning _("Fact %{name} with length: '%{length}' exceeds the length limit: %{limit}") % { name: name, length: name.to_s.bytesize, limit: max_length }
+  end
+
+  def warn_number_of_top_level_facts(size, max_number)
+    Puppet.warning _("The current number of top level facts: %{size} exceeds the top facts limit: %{max_size}") % { size: size, max_size: max_number }
+  end
+
+  def warn_fact_value_length(value, max_length)
+    Puppet.warning _("Fact value '%{value}' with the value length: '%{length}' exceeds the value length limit: %{max_length}") % { value: value, length:value.to_s.bytesize, max_length: max_length }
+  end
+
+  def warn_fact_payload_size(payload, max_size)
+    Puppet.warning _("Payload with the current size of: '%{payload}' exceeds the payload size limit: %{max_size}") % { payload: payload, max_size: max_size }
+  end
+
+  def check_fact_name_length(name, number_of_dots)
+    max_length = Puppet[:fact_name_length_soft_limit]
+    return if max_length.zero?
+
+    # rough byte size estimations of fact path as a postgresql btree index 
+    size_as_btree_index = 8 + (number_of_dots * 2) + name.to_s.bytesize
+    warn_fact_name_length(name, max_length) if size_as_btree_index > max_length
+  end
+
+  def check_fact_values_length(values)
+    max_length = Puppet[:fact_value_length_soft_limit]
+    return if max_length.zero?
+
+    warn_fact_value_length(values, max_length) if values.to_s.bytesize > max_length
+  end
+
+  def check_top_level_number_limit(size)
+    max_size = Puppet[:top_level_facts_soft_limit]
+    return if max_size.zero?
+
+    warn_number_of_top_level_facts(size, max_size) if size > max_size
+  end
+
+  def check_total_number_limit(size)
+    max_size = Puppet[:number_of_facts_soft_limit]
+    return if max_size.zero?
+
+    warn_number_of_facts(size, max_size) if size > max_size
+  end
+
+  def check_payload_size(payload)
+    max_size = Puppet[:payload_soft_limit]
+    return if max_size.zero?
+
+    warn_fact_payload_size(payload, max_size) if payload > max_size
+    Puppet.debug _("The size of the payload is %{payload}") % {payload: payload}
+  end
+
+  def parse_fact_name_and_value_limits(object, path = [])
+    case object
+    when Hash
+      object.each do |key, value|
+        path.push(key)
+        parse_fact_name_and_value_limits(value, path)
+        path.pop
+        @number_of_facts += 1
+      end
+    when Array
+      object.each_with_index do |e, idx|
+        path.push(idx)
+        parse_fact_name_and_value_limits(e, path)
+        path.pop
+      end
+    else
+      check_fact_name_length(path.join(), path.size)
+      check_fact_values_length(object)
+    end
+  end
+
+  def check_facts_limits(facts)
+    @number_of_facts = 0
+    check_top_level_number_limit(facts.size)
+
+    parse_fact_name_and_value_limits(facts)
+    check_total_number_limit(@number_of_facts)
+    Puppet.debug _("The total number of facts registered is %{number_of_facts}") % {number_of_facts: @number_of_facts}
+  end
+
   def get_facts(options)
     if options[:pluginsync]
       plugin_sync_time = thinmark do
@@ -148,7 +239,9 @@ class Puppet::Configurer
       # facts_for_uploading may set Puppet[:node_name_value] as a side effect
       facter_time = thinmark do
         facts = find_facts
+        check_facts_limits(facts.to_data_hash['values'])
         facts_hash = encode_facts(facts) # encode for uploading # was: facts_for_uploading
+        check_payload_size(facts_hash[:facts].bytesize)
       end
       options[:report].add_times(:fact_generation, facter_time) if options[:report]
     end
@@ -255,6 +348,7 @@ class Puppet::Configurer
 
   def run_internal(options)
     report = options[:report]
+    report.initial_environment = Puppet[:environment]
 
     if options[:start_time]
       startup_time = Time.now - options[:start_time]
@@ -294,69 +388,42 @@ class Puppet::Configurer
       configured_environment = Puppet[:environment] if Puppet.settings.set_by_config?(:environment)
 
       # We only need to find out the environment to run in if we don't already have a catalog
-      unless (cached_catalog || options[:catalog] || Puppet[:strict_environment_mode])
-        begin
-          node = nil
-          node_retr_time = thinmark do
-            node = Puppet::Node.indirection.find(Puppet[:node_name_value],
-              :environment => Puppet::Node::Environment.remote(@environment),
-              :configured_environment => configured_environment,
-              :ignore_cache => true,
-              :transaction_uuid => @transaction_uuid,
-              :fail_on_404 => true)
-          end
-          options[:report].add_times(:node_retrieval, node_retr_time)
-
-          if node
-            # If we have deserialized a node from a rest call, we want to set
-            # an environment instance as a simple 'remote' environment reference.
-            if !node.has_environment_instance? && node.environment_name
-              node.environment = Puppet::Node::Environment.remote(node.environment_name)
-            end
-
-            @node_environment = node.environment.to_s
-
-            if node.environment.to_s != @environment
-              Puppet.notice _("Local environment: '%{local_env}' doesn't match server specified node environment '%{node_env}', switching agent to '%{node_env}'.") % { local_env: @environment, node_env: node.environment }
-              @environment = node.environment.to_s
-              report.environment = @environment
-              query_options = nil
-              facts = nil
-
-              new_env = Puppet::Node::Environment.remote(@environment)
-              Puppet.push_context(
-                {
-                  current_environment: new_env,
-                  loaders: Puppet::Pops::Loaders.new(new_env, true)
-                },
-                "Local node environment #{@environment} for configurer transaction"
-              )
-            else
-              Puppet.info _("Using configured environment '%{env}'") % { env: @environment }
-            end
-          end
-        rescue StandardError => detail
-          Puppet.warning(_("Unable to fetch my node definition, but the agent run will continue:"))
-          Puppet.warning(detail)
+      unless (cached_catalog || options[:catalog] || Puppet.settings.set_by_cli?(:environment) || Puppet[:strict_environment_mode])
+        Puppet.debug(_("Environment not passed via CLI and no catalog was given, attempting to find out the last server-specified environment"))
+        initial_environment, loaded_last_environment = last_server_specified_environment
+
+        unless loaded_last_environment
+          Puppet.debug(_("Requesting environment from the server"))
+          initial_environment = current_server_specified_environment(@environment, configured_environment, options)
+        end
+
+        if initial_environment
+          @environment = initial_environment
+          report.environment = initial_environment
+
+          push_current_environment_and_loaders
+        else
+          Puppet.debug(_("Could not find a usable environment in the lastrunfile. Either the file does not exist, does not have the required keys, or the values of 'initial_environment' and 'converged_environment' are identical."))
         end
       end
 
+      Puppet.info _("Using environment '%{env}'") % { env: @environment }
+
       # This is to maintain compatibility with anyone using this class
       # aside from agent, apply, device.
       unless Puppet.lookup(:loaders) { nil }
-        new_env = Puppet::Node::Environment.remote(@environment)
-        Puppet.push_context(
-          {
-            current_environment: new_env,
-            loaders: Puppet::Pops::Loaders.new(new_env, true)
-          },
-          "Local node environment #{@environment} for configurer transaction"
-        )
+        push_current_environment_and_loaders
       end
 
+      temp_value = options[:pluginsync]
+
+      # only validate server environment if pluginsync is requested
+      options[:pluginsync] = valid_server_environment? if options[:pluginsync] == true
+
       query_options, facts = get_facts(options) unless query_options
+      options[:pluginsync] = temp_value
+
       query_options[:configured_environment] = configured_environment
-      options[:convert_for_node] = node
 
       catalog = prepare_and_retrieve_catalog(cached_catalog, facts, options, query_options)
       unless catalog
@@ -381,6 +448,8 @@ class Puppet::Configurer
         @environment = catalog.environment
         report.environment = @environment
 
+        push_current_environment_and_loaders
+
         query_options, facts = get_facts(options)
         query_options[:configured_environment] = configured_environment
 
@@ -454,6 +523,25 @@ class Puppet::Configurer
   end
   private :run_internal
 
+  def valid_server_environment?
+    session = Puppet.lookup(:http_session)
+    begin
+      fs = session.route_to(:fileserver)
+      fs.get_file_metadatas(path: URI(Puppet[:pluginsource]).path, recurse: :false, environment: @environment)
+      true
+    rescue Puppet::HTTP::ResponseError => detail
+      if detail.response.code == 404
+        Puppet.notice(_("Environment '%{environment}' not found on server, skipping initial pluginsync.") % { environment: @environment })
+      else
+        Puppet.log_exception(detail, detail.message)
+      end
+      false
+    rescue => detail
+      Puppet.log_exception(detail, detail.message)
+      false
+    end
+  end
+
   def find_functional_server
     begin
       session = Puppet.lookup(:http_session)
@@ -470,10 +558,88 @@ class Puppet::Configurer
   end
   private :find_functional_server
 
+  #
+  # @api private
+  #
+  # Read the last server-specified environment from the lastrunfile. The
+  # environment is considered to be server-specified if the values of
+  # `initial_environment` and `converged_environment` are different.
+  #
+  # @return [String, Boolean] An array containing a string with the environment
+  #   read from the lastrunfile in case the server is authoritative, and a
+  #   boolean marking whether the last environment was correctly loaded.
+  def last_server_specified_environment
+    return @last_server_specified_environment, @loaded_last_environment if @last_server_specified_environment
+
+    if Puppet::FileSystem.exist?(Puppet[:lastrunfile])
+      summary = Puppet::Util::Yaml.safe_load_file(Puppet[:lastrunfile])
+      return [nil, nil] unless summary['application']['run_mode'] == 'agent'
+      initial_environment = summary['application']['initial_environment']
+      converged_environment = summary['application']['converged_environment']
+      @last_server_specified_environment = converged_environment if initial_environment != converged_environment
+      Puppet.debug(_("Successfully loaded last environment from the lastrunfile"))
+      @loaded_last_environment = true
+    end
+
+    Puppet.debug(_("Found last server-specified environment: %{environment}") % { environment: @last_server_specified_environment }) if @last_server_specified_environment
+    [@last_server_specified_environment, @loaded_last_environment]
+  rescue => detail
+    Puppet.debug(_("Could not find last server-specified environment: %{detail}") % { detail: detail })
+    [nil, nil]
+  end
+  private :last_server_specified_environment
+
+  def current_server_specified_environment(current_environment, configured_environment, options)
+    return @server_specified_environment if @server_specified_environment
+
+    begin
+      node_retr_time = thinmark do
+        node = Puppet::Node.indirection.find(Puppet[:node_name_value],
+                                             :environment => Puppet::Node::Environment.remote(current_environment),
+                                             :configured_environment => configured_environment,
+                                             :ignore_cache => true,
+                                             :transaction_uuid => @transaction_uuid,
+                                             :fail_on_404 => true)
+
+        # The :rest node terminus returns a node with an environment_name, but not an
+        # environment instance. Attempting to get the environment instance will load
+        # it from disk, which will likely fail. So create a remote environment.
+        #
+        # The :plain node terminus returns a node with an environment, but not an
+        # environment_name.
+        if !node.has_environment_instance? && node.environment_name
+          node.environment = Puppet::Node::Environment.remote(node.environment_name)
+        end
+
+        @server_specified_environment = node.environment.to_s
+
+        if @server_specified_environment != @environment
+          Puppet.notice _("Local environment: '%{local_env}' doesn't match server specified node environment '%{node_env}', switching agent to '%{node_env}'.") % { local_env: @environment, node_env: @server_specified_environment }
+        end
+      end
+
+      options[:report].add_times(:node_retrieval, node_retr_time)
+
+      @server_specified_environment
+    rescue => detail
+      Puppet.warning(_("Unable to fetch my node definition, but the agent run will continue:"))
+      Puppet.warning(detail)
+      nil
+    end
+  end
+  private :current_server_specified_environment
+
   def send_report(report)
     puts report.summary if Puppet[:summarize]
     save_last_run_summary(report)
-    Puppet::Transaction::Report.indirection.save(report, nil, :environment => Puppet::Node::Environment.remote(@environment)) if Puppet[:report]
+    if Puppet[:report]
+      remote = Puppet::Node::Environment.remote(@environment)
+      begin
+        Puppet::Transaction::Report.indirection.save(report, nil, ignore_cache: true, environment: remote)
+      ensure
+        Puppet::Transaction::Report.indirection.save(report, nil, ignore_terminus: true, environment: remote)
+      end
+    end
   rescue => detail
     Puppet.log_exception(detail, _("Could not send report: %{detail}") % { detail: detail })
   end
@@ -496,7 +662,7 @@ class Puppet::Configurer
   # @return [false] If an exception is raised during fact generation or
   #   submission.
   def resubmit_facts
-    ::Facter.clear
+    Puppet.runtime[:facter].clear
     facts = find_facts
 
     client = Puppet.runtime[:http]
@@ -531,6 +697,17 @@ class Puppet::Configurer
     end
   end
 
+  def push_current_environment_and_loaders
+    new_env = Puppet::Node::Environment.remote(@environment)
+    Puppet.push_context(
+      {
+        :current_environment => new_env,
+        :loaders => Puppet::Pops::Loaders.new(new_env, true)
+      },
+      "Local node environment #{@environment} for configurer transaction"
+    )
+  end
+
   def retrieve_catalog_from_cache(query_options)
     result = nil
     @duration = thinmark do
@@ -558,6 +735,7 @@ class Puppet::Configurer
           # don't update cache until after environment converges
           :ignore_cache_save => true,
           :environment       => Puppet::Node::Environment.remote(@environment),
+          :check_environment => true,
           :fail_on_404       => true,
           :facts_for_catalog => facts
         )

data/lib/puppet/confine/variable.rb

@@ -18,7 +18,7 @@ class Puppet::Confine::Variable < Puppet::Confine
 
   # Retrieve the value from facter
   def facter_value
-    @facter_value ||= ::Facter.value(name).to_s.downcase
+    @facter_value ||= Puppet.runtime[:facter].value(name).to_s.downcase
   end
 
   def initialize(values)