puppet 8.2.0-x64-mingw32 → 8.4.0-x64-mingw32

data/lib/puppet/application/ssl.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/application'
 require_relative '../../puppet/ssl/oids'
 
 class Puppet::Application::Ssl < Puppet::Application
-
   run_mode :agent
 
   def summary
@@ -11,74 +11,79 @@ class Puppet::Application::Ssl < Puppet::Application
   end
 
   def help
-    <<-HELP
-puppet-ssl(8) -- #{summary}
-========
-
-SYNOPSIS
---------
-Manage SSL keys and certificates for SSL clients needing
-to communicate with a puppet infrastructure.
-
-USAGE
------
-puppet ssl <action> [-h|--help] [-v|--verbose] [-d|--debug] [--localca] [--target CERTNAME]
-
-
-OPTIONS
--------
-
-* --help:
-  Print this help message.
-
-* --verbose:
-  Print extra information.
-
-* --debug:
-  Enable full debugging.
-
-* --localca
-  Also clean the local CA certificate and CRL.
-
-* --target CERTNAME
-  Clean the specified device certificate instead of this host's certificate.
-
-ACTIONS
--------
-
-* bootstrap:
-  Perform all of the steps necessary to request and download a client
-  certificate. If autosigning is disabled, then puppet will wait every
-  `waitforcert` seconds for its certificate to be signed. To only attempt
-  once and never wait, specify a time of 0. Since `waitforcert` is a
-  Puppet setting, it can be specified as a time interval, such as 30s,
-  5m, 1h.
-
-* submit_request:
-  Generate a certificate signing request (CSR) and submit it to the CA. If
-  a private and public key pair already exist, they will be used to generate
-  the CSR. Otherwise a new key pair will be generated. If a CSR has already
-  been submitted with the given `certname`, then the operation will fail.
-
-* download_cert:
-  Download a certificate for this host. If the current private key matches
-  the downloaded certificate, then the certificate will be saved and used
-  for subsequent requests. If there is already an existing certificate, it
-  will be overwritten.
-
-* verify:
-  Verify the private key and certificate are present and match, verify the
-  certificate is issued by a trusted CA, and check revocation status.
-
-* clean:
-  Remove the private key and certificate related files for this host. If
-  `--localca` is specified, then also remove this host's local copy of the
-  CA certificate(s) and CRL bundle. if `--target CERTNAME` is specified, then
-  remove the files for the specified device on this host instead of this host.
-
- * show:
-  Print the full-text version of this host's certificate.
-HELP
+    <<~HELP
+      puppet-ssl(8) -- #{summary}
+      ========
+      
+      SYNOPSIS
+      --------
+      Manage SSL keys and certificates for SSL clients needing
+      to communicate with a puppet infrastructure.
+      
+      USAGE
+      -----
+      puppet ssl <action> [-h|--help] [-v|--verbose] [-d|--debug] [--localca] [--target CERTNAME]
+      
+      
+      OPTIONS
+      -------
+      
+      * --help:
+        Print this help message.
+      
+      * --verbose:
+        Print extra information.
+      
+      * --debug:
+        Enable full debugging.
+      
+      * --localca
+        Also clean the local CA certificate and CRL.
+      
+      * --target CERTNAME
+        Clean the specified device certificate instead of this host's certificate.
+      
+      ACTIONS
+      -------
+      
+      * bootstrap:
+        Perform all of the steps necessary to request and download a client
+        certificate. If autosigning is disabled, then puppet will wait every
+        `waitforcert` seconds for its certificate to be signed. To only attempt
+        once and never wait, specify a time of 0. Since `waitforcert` is a
+        Puppet setting, it can be specified as a time interval, such as 30s,
+        5m, 1h.
+      
+      * submit_request:
+        Generate a certificate signing request (CSR) and submit it to the CA. If
+        a private and public key pair already exist, they will be used to generate
+        the CSR. Otherwise a new key pair will be generated. If a CSR has already
+        been submitted with the given `certname`, then the operation will fail.
+      
+      * generate_request:
+        Generate a certificate signing request (CSR). If
+        a private and public key pair already exist, they will be used to generate
+        the CSR. Otherwise a new key pair will be generated.
+      
+      * download_cert:
+        Download a certificate for this host. If the current private key matches
+        the downloaded certificate, then the certificate will be saved and used
+        for subsequent requests. If there is already an existing certificate, it
+        will be overwritten.
+      
+      * verify:
+        Verify the private key and certificate are present and match, verify the
+        certificate is issued by a trusted CA, and check revocation status.
+      
+      * clean:
+        Remove the private key and certificate related files for this host. If
+        `--localca` is specified, then also remove this host's local copy of the
+        CA certificate(s) and CRL bundle. if `--target CERTNAME` is specified, then
+        remove the files for the specified device on this host instead of this host.
+      
+       * show:
+        Print the full-text version of this host's certificate.
+    HELP
   end
 
   option('--target CERTNAME') do |arg|
@@ -137,9 +142,22 @@ HELP
       unless cert
         raise Puppet::Error, _("The certificate for '%{name}' has not yet been signed") % { name: certname }
       end
+    when 'generate_request'
+      generate_request(certname)
     when 'verify'
       verify(certname)
     when 'clean'
+      possible_extra_args = command_line.args.drop(1)
+      unless possible_extra_args.empty?
+        raise Puppet::Error, _(<<~END) % { args: possible_extra_args.join(' ')}
+          Extra arguments detected: %{args}
+          Did you mean to run:
+            puppetserver ca clean --certname <name>
+          Or:
+            puppet ssl clean --target <name>
+        END
+      end
+
       clean(certname)
     when 'bootstrap'
       if !Puppet::Util::Log.sendlevel?(:info)
@@ -163,13 +181,7 @@ HELP
   def submit_request(ssl_context)
     key = @cert_provider.load_private_key(Puppet[:certname])
     unless key
-      if Puppet[:key_type] == 'ec'
-        Puppet.info _("Creating a new EC SSL key for %{name} using curve %{curve}") % { name: Puppet[:certname], curve: Puppet[:named_curve] }
-        key = OpenSSL::PKey::EC.generate(Puppet[:named_curve])
-      else
-        Puppet.info _("Creating a new SSL key for %{name}") % { name: Puppet[:certname] }
-        key = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
-      end
+      key = create_key(Puppet[:certname])
       @cert_provider.save_private_key(Puppet[:certname], key)
     end
 
@@ -188,6 +200,20 @@ HELP
     raise Puppet::Error.new(_("Failed to submit certificate request: %{message}") % { message: e.message }, e)
   end
 
+  def generate_request(certname)
+    key = @cert_provider.load_private_key(certname)
+    unless key
+      key = create_key(certname)
+      @cert_provider.save_private_key(certname, key)
+    end
+
+    csr = @cert_provider.create_request(certname, key)
+    @cert_provider.save_request(certname, csr)
+    Puppet.notice _("Generated certificate request in '%{path}'") % { path: @cert_provider.to_path(Puppet[:requestdir], certname) }
+  rescue => e
+    raise Puppet::Error.new(_("Failed to generate certificate request: %{message}") % { message: e.message }, e)
+  end
+
   def download_cert(ssl_context)
     key = @cert_provider.load_private_key(Puppet[:certname])
 
@@ -249,18 +275,18 @@ HELP
       end
 
       if cert
-        raise Puppet::Error, _(<<END) % { certname: certname }
-The certificate %{certname} must be cleaned from the CA first. To fix this,
-run the following commands on the CA:
-  puppetserver ca clean --certname %{certname}
-  puppet ssl clean
-END
+        raise Puppet::Error, _(<<~END) % { certname: certname }
+          The certificate %{certname} must be cleaned from the CA first. To fix this,
+          run the following commands on the CA:
+            puppetserver ca clean --certname %{certname}
+            puppet ssl clean
+        END
       end
     end
 
     paths = {
       'private key' => Puppet[:hostprivkey],
-      'public key'  => Puppet[:hostpubkey],
+      'public key' => Puppet[:hostpubkey],
       'certificate request' => Puppet[:hostcsr],
       'certificate' => Puppet[:hostcert],
       'private key password file' => Puppet[:passfile]
@@ -286,4 +312,14 @@ END
   def create_route(ssl_context)
     @session.route_to(:ca, ssl_context: ssl_context)
   end
+
+  def create_key(certname)
+    if Puppet[:key_type] == 'ec'
+      Puppet.info _("Creating a new EC SSL key for %{name} using curve %{curve}") % { name: certname, curve: Puppet[:named_curve] }
+      OpenSSL::PKey::EC.generate(Puppet[:named_curve])
+    else
+      Puppet.info _("Creating a new SSL key for %{name}") % { name: certname }
+      OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
+    end
+  end
 end

data/lib/puppet/application.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require 'optparse'
 require_relative '../puppet/util/command_line'
 require_relative '../puppet/util/constant_inflector'
@@ -6,7 +7,6 @@ require_relative '../puppet/error'
 require_relative '../puppet/application_support'
 
 module Puppet
-
 # Defines an abstract Puppet application.
 #
 # # Usage
@@ -170,6 +170,7 @@ class Application
     # Thus, long-running background processes can potentially finish their work before a restart.
     def controlled_run(&block)
       return unless clear?
+
       result = block.call
       Process.kill(:HUP, $PID) if restart_requested?
       result
@@ -260,7 +261,7 @@ class Application
     # @param [String] class_name the fully qualified name of the class to try to load
     # @return [Class] the Class instance, or nil? if it could not be loaded.
     def try_load_class(class_name)
-        return self.const_defined?(class_name) ? const_get(class_name) : nil
+      return self.const_defined?(class_name) ? const_get(class_name) : nil
     end
     private :try_load_class
 
@@ -304,6 +305,7 @@ class Application
     # @api public
     def environment_mode(mode_name)
       raise Puppet::Error, _("Invalid environment mode '%{mode_name}'") % { mode_name: mode_name } unless [:local, :remote, :not_required].include?(mode_name)
+
       @environment_mode = mode_name
     end
 
@@ -327,13 +329,13 @@ class Application
   # Every app responds to --version
   # See also `lib/puppet/util/command_line.rb` for some special case early
   # handling of this.
-  option("--version", "-V") do |arg|
+  option("--version", "-V") do |_arg|
     puts "#{Puppet.version}"
     exit(0)
   end
 
   # Every app responds to --help
-  option("--help", "-h") do |v|
+  option("--help", "-h") do |_v|
     puts help
     exit(0)
   end
@@ -363,7 +365,7 @@ class Application
   # @api public
   def app_defaults
     Puppet::Settings.app_defaults_for_run_mode(self.class.run_mode).merge(
-        :name => name
+      :name => name
     )
   end
 
@@ -399,7 +401,6 @@ class Application
   # @return [void]
   # @api public
   def run
-
     # I don't really like the names of these lifecycle phases.  It would be nice to change them to some more meaningful
     # names, and make deprecated aliases.  --cprice 2012-03-16
 
@@ -503,9 +504,13 @@ class Application
   def log_runtime_environment(extra_info=nil)
     runtime_info = {
       'puppet_version' => Puppet.version,
-      'ruby_version'   => RUBY_VERSION,
-      'run_mode'       => self.class.run_mode.name,
+      'ruby_version' => RUBY_VERSION,
+      'run_mode' => self.class.run_mode.name
     }
+    unless Puppet::Util::Platform.jruby_fips?
+      runtime_info['openssl_version'] = "'#{OpenSSL::OPENSSL_VERSION}'"
+      runtime_info['openssl_fips'] = OpenSSL::OPENSSL_FIPS
+    end
     runtime_info['default_encoding'] = Encoding.default_external
     runtime_info.merge!(extra_info) unless extra_info.nil?
 

data/lib/puppet/application_support.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require 'yaml'
 
 require_relative '../puppet'
@@ -8,7 +9,6 @@ require_relative '../puppet/indirector'
 
 module Puppet
   module ApplicationSupport
-
     # Pushes a Puppet Context configured with a remote environment for an agent
     # (one that exists at the master end), and a regular environment for other
     # modes. The configuration is overridden with options from the command line

data/lib/puppet/coercion.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # Various methods used to coerce values into a canonical form.
 #
 # @api private
@@ -19,9 +20,9 @@ module Puppet::Coercion
     end
 
     case value
-    when true, :true, 'true', :yes, 'yes'
+    when true, :true, 'true', :yes, 'yes' # rubocop:disable Lint/BooleanSymbol
       true
-    when false, :false, 'false', :no, 'no'
+    when false, :false, 'false', :no, 'no' # rubocop:disable Lint/BooleanSymbol
       false
     else
       fail('expected a boolean value')

data/lib/puppet/compilable_resource_type.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../puppet'
 # The CompilableResourceType module should be either included in a class or used as a class extension
 # to mark that the instance used as the 'resource type' of a resource instance

data/lib/puppet/concurrent/lock.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/concurrent/synchronized'
 
 module Puppet
 module Concurrent
-
 # A simple lock that at the moment only does any locking on jruby
 class Lock
   include Puppet::Concurrent::Synchronized
@@ -11,7 +11,6 @@ class Lock
     yield
   end
 end
-
 end
 end
 

data/lib/puppet/concurrent/synchronized.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
+
 module Puppet
 module Concurrent
-
 # Including Puppet::Concurrent::Synchronized into a class when running on JRuby
 # causes all of its instance methods to be synchronized on the instance itself.
 # When running on MRI it has no effect.
@@ -11,6 +11,5 @@ if RUBY_PLATFORM == 'java'
 else
   module Synchronized; end
 end
-
 end
 end

data/lib/puppet/concurrent/thread_local_singleton.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Puppet
   module Concurrent
     module ThreadLocalSingleton

data/lib/puppet/concurrent.rb

@@ -1,3 +1,4 @@
 # frozen_string_literal: true
+
 module Puppet::Concurrent
 end

data/lib/puppet/configurer/downloader.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/configurer'
 require_relative '../../puppet/resource/catalog'
 
@@ -40,7 +41,6 @@ class Puppet::Configurer::Downloader
 
   def initialize(name, path, source, ignore = nil, environment = nil, source_permissions = :ignore)
     @name, @path, @source, @ignore, @environment, @source_permissions = name, path, source, ignore, environment, source_permissions
-
   end
 
   def file

data/lib/puppet/configurer/fact_handler.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/indirector/facts/facter'
 
 require_relative '../../puppet/configurer'
@@ -33,7 +34,7 @@ module Puppet::Configurer::FactHandler
   end
 
   def encode_facts(facts)
-    #facts = find_facts
+    # facts = find_facts
 
     # NOTE: :facts specified as parameters are URI encoded here,
     # then  encoded for a second time depending on their length:

data/lib/puppet/configurer/plugin_handler.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # Break out the code related to plugins.  This module is
 # just included into the agent, but having it here makes it
 # easier to test.

data/lib/puppet/configurer.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
+
 # The client for interacting with the puppetmaster config server.
 require 'timeout'
 require_relative '../puppet/util'
 require 'securerandom'
-#require 'puppet/parser/script_compiler'
+# require 'puppet/parser/script_compiler'
 require_relative '../puppet/pops/evaluator/deferred_resolver'
 
 class Puppet::Configurer
@@ -40,7 +41,7 @@ class Puppet::Configurer
 
   # Initialize and load storage
   def init_storage
-      Puppet::Util::Storage.load
+    Puppet::Util::Storage.load
   rescue => detail
     Puppet.log_exception(detail, _("Removing corrupt state file %{file}: %{detail}") % { file: Puppet[:statefile], detail: detail })
     begin
@@ -195,7 +196,6 @@ class Puppet::Configurer
         path.push(key)
         parse_fact_name_and_value_limits(value, path)
         path.pop
-        @number_of_facts += 1
       end
     when Array
       object.each_with_index do |e, idx|
@@ -206,6 +206,7 @@ class Puppet::Configurer
     else
       check_fact_name_length(path.join(), path.size)
       check_fact_values_length(object)
+      @number_of_facts += 1
     end
   end
 
@@ -329,7 +330,7 @@ class Puppet::Configurer
             raise Puppet::Error, detail
           end
         else
-          #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+          # TRANSLATORS 'server_list' is the name of a setting and should not be translated
           Puppet.debug _("Selected puppet server from the `server_list` setting: %{server}:%{port}") % { server: server, port: port }
           report.server_used = "#{server}:#{port}"
         end
@@ -445,6 +446,7 @@ class Puppet::Configurer
         if tries > 3
           raise Puppet::Error, _("Catalog environment didn't stabilize after %{tries} fetches, aborting run") % { tries: tries }
         end
+
         Puppet.notice _("Local environment: '%{local_env}' doesn't match server specified environment '%{catalog_env}', restarting agent run with environment '%{catalog_env}'") % { local_env: @environment, catalog_env: catalog.environment }
         @environment = catalog.environment
         report.environment = @environment
@@ -457,6 +459,7 @@ class Puppet::Configurer
         # if we get here, ignore the cached catalog
         catalog = prepare_and_retrieve_catalog(nil, facts, options, query_options)
         return nil unless catalog
+
         tries += 1
       end
 
@@ -504,7 +507,7 @@ class Puppet::Configurer
       Puppet.log_exception(detail, _("Failed to apply catalog: %{detail}") % { detail: detail })
       return nil
     ensure
-      execute_postrun_command or return nil
+      execute_postrun_command or return nil # rubocop:disable Lint/EnsureReturn
     end
   ensure
     if Puppet[:resubmit_facts]
@@ -528,7 +531,7 @@ class Puppet::Configurer
     session = Puppet.lookup(:http_session)
     begin
       fs = session.route_to(:fileserver)
-      fs.get_file_metadatas(path: URI(Puppet[:pluginsource]).path, recurse: :false, environment: @environment)
+      fs.get_file_metadatas(path: URI(Puppet[:pluginsource]).path, recurse: :false, environment: @environment) # rubocop:disable Lint/BooleanSymbol
       true
     rescue Puppet::HTTP::ResponseError => detail
       if detail.response.code == 404
@@ -556,7 +559,7 @@ class Puppet::Configurer
       Puppet.debug(_("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %
                    { host: e.response.url.host, port: e.response.url.port, code: e.response.code, reason: e.response.reason })
     rescue => detail
-      #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+      # TRANSLATORS 'server_list' is the name of a setting and should not be translated
       Puppet.debug _("Unable to connect to server from server_list setting: %{detail}") % {detail: detail}
     end
     [nil, nil]
@@ -579,6 +582,7 @@ class Puppet::Configurer
     if Puppet::FileSystem.exist?(Puppet[:lastrunfile])
       summary = Puppet::Util::Yaml.safe_load_file(Puppet[:lastrunfile])
       return [nil, nil] unless summary['application']['run_mode'] == 'agent'
+
       initial_environment = summary['application']['initial_environment']
       converged_environment = summary['application']['converged_environment']
       @last_server_specified_environment = converged_environment if initial_environment != converged_environment
@@ -665,8 +669,8 @@ class Puppet::Configurer
     puppet = session.route_to(:puppet)
 
     Puppet.info(_("Uploading facts for %{node} to %{server}") % {
-                  node: facts.name,
-                  server: puppet.url.hostname})
+      node: facts.name,
+      server: puppet.url.hostname})
 
     puppet.put_facts(facts.name, facts: facts, environment: Puppet.lookup(:current_environment).name.to_s)
 
@@ -710,7 +714,7 @@ class Puppet::Configurer
         Puppet[:node_name_value],
         query_options.merge(
           :ignore_terminus => true,
-          :environment     => Puppet::Node::Environment.remote(@environment)
+          :environment => Puppet::Node::Environment.remote(@environment)
         )
       )
     end
@@ -726,12 +730,12 @@ class Puppet::Configurer
       result = Puppet::Resource::Catalog.indirection.find(
         Puppet[:node_name_value],
         query_options.merge(
-          :ignore_cache      => true,
+          :ignore_cache => true,
           # don't update cache until after environment converges
           :ignore_cache_save => true,
-          :environment       => Puppet::Node::Environment.remote(@environment),
+          :environment => Puppet::Node::Environment.remote(@environment),
           :check_environment => true,
-          :fail_on_404       => true,
+          :fail_on_404 => true,
           :facts_for_catalog => facts
         )
       )

data/lib/puppet/confine/any.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 class Puppet::Confine::Any < Puppet::Confine
   def self.summarize(confines)
     confines.inject(0) { |count, confine| count + confine.summary }

data/lib/puppet/confine/boolean.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/confine'
 
 # Common module for the Boolean confines. It currently

data/lib/puppet/confine/exists.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/confine'
 
 class Puppet::Confine::Exists < Puppet::Confine

data/lib/puppet/confine/false.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/confine/boolean'
 
 class Puppet::Confine::False < Puppet::Confine

data/lib/puppet/confine/feature.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/confine'
 
 class Puppet::Confine::Feature < Puppet::Confine

data/lib/puppet/confine/true.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/confine/boolean'
 
 class Puppet::Confine::True < Puppet::Confine

data/lib/puppet/confine/variable.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../puppet/confine'
 
 # Require a specific value for a variable, either a Puppet setting

data/lib/puppet/confine.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # The class that handles testing whether our providers
 # actually work or not.
 require_relative '../puppet/util'
@@ -42,6 +43,7 @@ class Puppet::Confine
 
   # Mark that this confine is used for testing binary existence.
   attr_accessor :for_binary
+
   def for_binary?
     for_binary
   end