puppet 3.6.0 → 3.6.1

data/ext/rack/example-passenger-vhost.conf

@@ -18,8 +18,9 @@ Listen 8140
 
 <VirtualHost *:8140>
         SSLEngine on
-        SSLProtocol -ALL +SSLv3 +TLSv1
-        SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
+        SSLProtocol             ALL -SSLv2
+        SSLCipherSuite          ALL:!aNULL:!eNULL:!DES:!3DES:!IDEA:!SEED:!DSS:!PSK:!RC4:!MD5:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXP
+        SSLHonorCipherOrder     on
 
         SSLCertificateFile      /etc/puppet/ssl/certs/squigley.namespace.at.pem
         SSLCertificateKeyFile   /etc/puppet/ssl/private_keys/squigley.namespace.at.pem

data/lib/puppet.rb

@@ -234,6 +234,16 @@ module Puppet
     @context.override(bindings, description, &block)
   end
 
+  # @api private
+  def self.mark_context(name)
+    @context.mark(name)
+  end
+
+  # @api private
+  def self.rollback_context(name)
+    @context.rollback(name)
+  end
+
   require 'puppet/node'
 
   # The single instance used for normal operation

data/lib/puppet/agent.rb

@@ -11,7 +11,6 @@ class Puppet::Agent
 
   attr_reader :client_class, :client, :splayed, :should_fork
 
-  # Just so we can specify that we are "the" instance.
   def initialize(client_class, should_fork=true)
     @splayed = false
 

data/lib/puppet/application.rb

@@ -353,24 +353,22 @@ class Application
       plugin_hook('initialize_app_defaults') { initialize_app_defaults }
     end
 
-    Puppet.override(Puppet.base_context(Puppet.settings)) do
-      configured_environment = Puppet.lookup(:environments).get(Puppet[:environment])
-      configured_environment = configured_environment.override_from_commandline(Puppet.settings)
-
-      # Setup a new context using the app's configuration
-      Puppet.override({ :current_environment => configured_environment },
-                      "New base context and current environment from application's configuration") do
-        require 'puppet'
-        require 'puppet/util/instrumentation'
-        Puppet::Util::Instrumentation.init
-
-        exit_on_fail("initialize")                                   { plugin_hook('preinit')       { preinit } }
-        exit_on_fail("parse application options")                    { plugin_hook('parse_options') { parse_options } }
-        exit_on_fail("prepare for execution")                        { plugin_hook('setup')         { setup } }
-        exit_on_fail("configure routes from #{Puppet[:route_file]}") { configure_indirector_routes }
-        exit_on_fail("run")                                          { plugin_hook('run_command')   { run_command } }
-      end
-    end
+    Puppet.push_context(Puppet.base_context(Puppet.settings), "Update for application settings (#{self.class.run_mode})")
+    configured_environment = Puppet.lookup(:environments).get(Puppet[:environment])
+    configured_environment = configured_environment.override_from_commandline(Puppet.settings)
+
+    # Setup a new context using the app's configuration
+    Puppet.push_context({ :current_environment => configured_environment },
+                    "Update current environment from application's configuration")
+
+    require 'puppet/util/instrumentation'
+    Puppet::Util::Instrumentation.init
+
+    exit_on_fail("initialize")                                   { plugin_hook('preinit')       { preinit } }
+    exit_on_fail("parse application options")                    { plugin_hook('parse_options') { parse_options } }
+    exit_on_fail("prepare for execution")                        { plugin_hook('setup')         { setup } }
+    exit_on_fail("configure routes from #{Puppet[:route_file]}") { configure_indirector_routes }
+    exit_on_fail("run")                                          { plugin_hook('run_command')   { run_command } }
   end
 
   def main

data/lib/puppet/configurer.rb

@@ -22,13 +22,6 @@ class Puppet::Configurer
     "Puppet configuration client"
   end
 
-  class << self
-    # Puppet agent should only have one instance running, and we need a
-    # way to retrieve it.
-    attr_accessor :instance
-    include Puppet::Util
-  end
-
   def execute_postrun_command
     execute_from_setting(:postrun_command)
   end
@@ -51,11 +44,9 @@ class Puppet::Configurer
     end
   end
 
-  # Just so we can specify that we are "the" instance.
   def initialize
     Puppet.settings.use(:main, :ssl, :agent)
 
-    self.class.instance = self
     @running = false
     @splayed = false
     @environment = Puppet[:environment]
@@ -121,8 +112,6 @@ class Puppet::Configurer
   def apply_catalog(catalog, options)
     report = options[:report]
     report.configuration_version = catalog.version
-    report.transaction_uuid = @transaction_uuid
-    report.environment = @environment
 
     benchmark(:notice, "Finished catalog run") do
       catalog.apply(options)
@@ -132,15 +121,15 @@ class Puppet::Configurer
     report
   end
 
-  def get_transaction_uuid
-    { :transaction_uuid => @transaction_uuid }
-  end
-
   # The code that actually runs the catalog.
   # This just passes any options on to the catalog,
   # which accepts :tags and :ignoreschedules.
   def run(options = {})
-    options[:report] ||= Puppet::Transaction::Report.new("apply")
+    # We create the report pre-populated with default settings for
+    # environment and transaction_uuid very early, this is to ensure
+    # they are sent regardless of any catalog compilation failures or
+    # exceptions.
+    options[:report] ||= Puppet::Transaction::Report.new("apply", nil, @environment, @transaction_uuid)
     report = options[:report]
     init_storage
 
@@ -155,10 +144,12 @@ class Puppet::Configurer
       unless options[:catalog]
         begin
           if node = Puppet::Node.indirection.find(Puppet[:node_name_value],
-              :environment => @environment, :ignore_cache => true)
+              :environment => @environment, :ignore_cache => true, :transaction_uuid => @transaction_uuid,
+              :fail_on_404 => true)
             if node.environment.to_s != @environment
               Puppet.warning "Local environment: \"#{@environment}\" doesn't match server specified node environment \"#{node.environment}\", switching agent to \"#{node.environment}\"."
               @environment = node.environment.to_s
+              report.environment = @environment
               query_options = nil
             end
           end
@@ -172,8 +163,9 @@ class Puppet::Configurer
 
       query_options = get_facts(options) unless query_options
 
-      # add the transaction uuid to the catalog query options hash
-      query_options.merge! get_transaction_uuid if query_options
+      # get_facts returns nil during puppet apply
+      query_options ||= {}
+      query_options[:transaction_uuid] = @transaction_uuid
 
       unless catalog = prepare_and_retrieve_catalog(options, query_options)
         return nil
@@ -190,6 +182,7 @@ class Puppet::Configurer
         end
         Puppet.warning "Local environment: \"#{@environment}\" doesn't match server specified environment \"#{catalog.environment}\", restarting agent run with environment \"#{catalog.environment}\""
         @environment = catalog.environment
+        report.environment = @environment
         return nil unless catalog = prepare_and_retrieve_catalog(options, query_options)
         tries += 1
       end
@@ -247,7 +240,8 @@ class Puppet::Configurer
   def retrieve_catalog_from_cache(query_options)
     result = nil
     @duration = thinmark do
-      result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value], query_options.merge(:ignore_terminus => true, :environment => @environment))
+      result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value],
+        query_options.merge(:ignore_terminus => true, :environment => @environment))
     end
     Puppet.notice "Using cached catalog"
     result
@@ -259,7 +253,8 @@ class Puppet::Configurer
   def retrieve_new_catalog(query_options)
     result = nil
     @duration = thinmark do
-      result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value], query_options.merge(:ignore_cache => true, :environment => @environment))
+      result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value],
+        query_options.merge(:ignore_cache => true, :environment => @environment, :fail_on_404 => true))
     end
     result
   rescue SystemExit,NoMemoryError

data/lib/puppet/context.rb

@@ -14,26 +14,32 @@ class Puppet::Context
   class UndefinedBindingError < Puppet::Error; end
   class StackUnderflow < Puppet::Error; end
 
+  class UnknownRollbackMarkError < Puppet::Error; end
+  class DuplicateRollbackMarkError < Puppet::Error; end
+
   # @api private
   def initialize(initial_bindings)
-    @stack = []
     @table = initial_bindings
     @description = "root"
+    @id = 0
+    @rollbacks = {}
+    @stack = [[0, nil, nil]]
   end
 
   # @api private
   def push(overrides, description = "")
-    @stack.push([@table, @description])
+    @id += 1
+    @stack.push([@id, @table, @description])
     @table = @table.merge(overrides || {})
     @description = description
   end
 
   # @api private
   def pop
-    if @stack.empty?
+    if @stack[-1][0] == 0
       raise(StackUnderflow, "Attempted to pop, but already at root of the context stack.")
     else
-      (@table, @description) = @stack.pop
+      (_, @table, @description) = @stack.pop
     end
   end
 
@@ -51,10 +57,45 @@ class Puppet::Context
 
   # @api private
   def override(bindings, description = "", &block)
+    mark_point = "override over #{@stack[-1][0]}"
+    mark(mark_point)
     push(bindings, description)
 
     yield
   ensure
-    pop
+    rollback(mark_point)
+  end
+
+  # Mark a place on the context stack to later return to with {rollback}.
+  #
+  # @param name [Object] The identifier for the mark
+  #
+  # @api private
+  def mark(name)
+    if @rollbacks[name].nil?
+      @rollbacks[name] = @stack[-1][0]
+    else
+      raise DuplicateRollbackMarkError, "Mark for '#{name}' already exists"
+    end
+  end
+
+  # Roll back to a mark set by {mark}.
+  #
+  # Rollbacks can only reach a mark accessible via {pop}. If the mark is not on
+  # the current context stack the behavior of rollback is undefined.
+  #
+  # @param name [Object] The identifier for the mark
+  #
+  # @api private
+  def rollback(name)
+    if @rollbacks[name].nil?
+      raise UnknownRollbackMarkError, "Unknown mark '#{name}'"
+    end
+
+    while @stack[-1][0] != @rollbacks[name]
+      pop
+    end
+
+    @rollbacks.delete(name)
   end
 end

data/lib/puppet/indirector/catalog/compiler.rb

@@ -104,11 +104,12 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
   end
 
   # Turn our host name into a node object.
-  def find_node(name, environment)
+  def find_node(name, environment, transaction_uuid)
     Puppet::Util::Profiler.profile("Found node information") do
       node = nil
       begin
-        node = Puppet::Node.indirection.find(name, :environment => environment)
+        node = Puppet::Node.indirection.find(name, :environment => environment,
+                                             :transaction_uuid => transaction_uuid)
       rescue => detail
         message = "Failed when searching for node #{name}: #{detail}"
         Puppet.log_exception(detail, message)
@@ -143,7 +144,7 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
     # node's catalog with only one certificate and a modification to auth.conf
     # If no key is provided we can only compile the currently connected node.
     name = request.key || request.node
-    if node = find_node(name, request.environment)
+    if node = find_node(name, request.environment, request.options[:transaction_uuid])
       return node
     end
 

data/lib/puppet/indirector/rest.rb

@@ -105,18 +105,17 @@ class Puppet::Indirector::REST < Puppet::Indirector::Terminus
       result
 
     elsif is_http_404?(response)
-      # 404 gets special treatment as the indirector API can not produce a meaningful
+      return nil unless request.options[:fail_on_404]
+
+      # 404 can get special treatment as the indirector API can not produce a meaningful
       # reason to why something is not found - it may not be the thing the user is
       # expecting to find that is missing, but something else (like the environment).
-      # While this way of handling the issue is not perfect, there is at least a warning
+      # While this way of handling the issue is not perfect, there is at least an error
       # that makes a user aware of the reason for the failure.
       #
       content_type, body = parse_response(response)
       msg = "Find #{uri_with_query_string} resulted in 404 with the message: #{body}"
-      # warn_once
-      Puppet::Util::Warnings.maybe_log(msg, self.class){ Puppet.warning msg }
-      nil
-
+      raise Puppet::Error, msg
     else
       nil
     end

data/lib/puppet/network/http/route.rb

@@ -3,6 +3,8 @@ class Puppet::Network::HTTP::Route
     raise Puppet::Network::HTTP::Error::HTTPMethodNotAllowedError.new("method #{req.method} not allowed for route #{req.path}", Puppet::Network::HTTP::Issues::UNSUPPORTED_METHOD)
   end
 
+  NO_HANDLERS = [MethodNotAllowedHandler]
+
   attr_reader :path_matcher
 
   def self.path(path_matcher)
@@ -12,11 +14,12 @@ class Puppet::Network::HTTP::Route
   def initialize(path_matcher)
     @path_matcher = path_matcher
     @method_handlers = {
-      :GET => [MethodNotAllowedHandler],
-      :HEAD => [MethodNotAllowedHandler],
-      :OPTIONS => [MethodNotAllowedHandler],
-      :POST => [MethodNotAllowedHandler],
-      :PUT => [MethodNotAllowedHandler]
+      :GET => NO_HANDLERS,
+      :HEAD => NO_HANDLERS,
+      :OPTIONS => NO_HANDLERS,
+      :POST => NO_HANDLERS,
+      :PUT => NO_HANDLERS,
+      :DELETE => NO_HANDLERS
     }
     @chained = []
   end
@@ -46,6 +49,11 @@ class Puppet::Network::HTTP::Route
     return self
   end
 
+  def delete(*handlers)
+    @method_handlers[:DELETE] = handlers
+    return self
+  end
+
   def any(*handlers)
     @method_handlers.each do |method, registered_handlers|
       @method_handlers[method] = handlers
@@ -69,7 +77,8 @@ class Puppet::Network::HTTP::Route
   end
 
   def process(request, response)
-    @method_handlers[request.method.upcase.intern].each do |handler|
+    handlers = @method_handlers[request.method.upcase.intern] || NO_HANDLERS
+    handlers.each do |handler|
       handler.call(request, response)
     end
 

data/lib/puppet/parser/functions/epp.rb

@@ -36,6 +36,6 @@ scope where the `epp` function is called from.
   unless Puppet[:parser] == "future"
     raise ArgumentError, "epp(): function is only available when --parser future is in effect"
   end
-  Puppet::Pops::Evaluator::EppEvaluator.epp(self, arguments[0], self.compiler.environment.to_s, arguments[1])
+  Puppet::Pops::Evaluator::EppEvaluator.epp(self, arguments[0], self.compiler.environment, arguments[1])
 
 end

data/lib/puppet/pops/evaluator/access_operator.rb

@@ -530,6 +530,11 @@ class Puppet::Pops::Evaluator::AccessOperator
     blamed = keys.size == 0 ? @semantic : @semantic.keys[0]
     keys_orig_size = keys.size
 
+    if keys_orig_size == 0
+      fail(Puppet::Pops::Issues::BAD_TYPE_SLICE_ARITY, blamed,
+        :base_type => Puppet::Pops::Types::TypeCalculator.new().string(o), :min => 1, :max => -1, :actual => 0)
+    end
+
     # The result is an array if multiple classnames are given, or if classnames are specified with an array
     # (possibly multiple arrays, and nested arrays).
     result_type_array = keys.size > 1 || keys[0].is_a?(Array)
@@ -537,11 +542,6 @@ class Puppet::Pops::Evaluator::AccessOperator
     keys.flatten!
     keys.compact!
 
-    if keys_orig_size == 0
-      fail(Puppet::Pops::Issues::BAD_TYPE_SLICE_ARITY, blamed,
-        :base_type => Puppet::Pops::Types::TypeCalculator.new().string(o), :min => 1, :max => -1, :actual => 0)
-    end
-
     # If given keys  that were just a mix of empty/nil with empty array as a result.
     # As opposed to calling the function the wrong way (without any arguments), (configurable issue),
     # Return an empty array
@@ -551,40 +551,45 @@ class Puppet::Pops::Evaluator::AccessOperator
       return result_type_array ? [] : nil
     end
 
-    if ! o.class_name.nil?
+    if o.class_name.nil?
+      # The type argument may be a Resource Type - the Puppet Language allows a reference such as
+      # Class[Foo], and this is interpreted as Class[Resource[Foo]] - which is ok as long as the resource
+      # does not have a title. This should probably be deprecated.
+      #
+      result = keys.each_with_index.map do |c, i|
+        name = if c.is_a?(Puppet::Pops::Types::PResourceType) && !c.type_name.nil? && c.title.nil?
+                 # type_name is already downcase. Don't waste time trying to downcase again
+                 c.type_name
+               elsif c.is_a?(String)
+                 c.downcase
+               else
+                 fail(Puppet::Pops::Issues::ILLEGAL_HOSTCLASS_NAME, @semantic.keys[i], {:name => c})
+               end
+
+        if name =~ Puppet::Pops::Patterns::NAME
+          ctype = Puppet::Pops::Types::PHostClassType.new()
+          # Remove leading '::' since all references are global, and 3x runtime does the wrong thing
+          ctype.class_name = name.sub(/^::/, '')
+          ctype
+        else
+          fail(Issues::ILLEGAL_NAME, @semantic.keys[i], {:name=>c})
+        end
+      end
+    else
       # lookup class resource and return one or more parameter values
       resource = find_resource(scope, 'class', o.class_name)
-      unless resource
-        fail(Puppet::Pops::Issues::UNKNOWN_RESOURCE, @semantic, {:type_name => 'Class', :title => o.class_name})
-      end
-      result = keys.map do |k|
-        unless is_parameter_of_resource?(scope, resource, k)
-          fail(Puppet::Pops::Issues::UNKNOWN_RESOURCE_PARAMETER, @semantic,
-            {:type_name => 'Class', :title => o.class_name, :param_name=>k})
+      if resource
+        result = keys.map do |k|
+          if is_parameter_of_resource?(scope, resource, k)
+            get_resource_parameter_value(scope, resource, k)
+          else
+            fail(Puppet::Pops::Issues::UNKNOWN_RESOURCE_PARAMETER, @semantic,
+              {:type_name => 'Class', :title => o.class_name, :param_name=>k})
+          end
         end
-        get_resource_parameter_value(scope, resource, k)
-      end
-      return result_type_array ? result : result.pop
-    end
-
-    # The type argument may be a Resource Type - the Puppet Language allows a reference such as
-    # Class[Foo], and this is interpreted as Class[Resource[Foo]] - which is ok as long as the resource
-    # does not have a title. This should probably be deprecated.
-    #
-    result = keys.each_with_index.map do |c, i|
-      ctype = Puppet::Pops::Types::PHostClassType.new()
-      if c.is_a?(Puppet::Pops::Types::PResourceType) && !c.type_name.nil? && c.title.nil?
-        # Remove leading '::' since all references are global, and 3x runtime does the wrong thing
-        c = c.type_name.downcase.sub(/^::/, '')
-      end
-      unless c.is_a?(String)
-        fail(Puppet::Pops::Issues::ILLEGAL_HOSTCLASS_NAME, @semantic.keys[i], {:name => c})
-      end
-      if c !~ Puppet::Pops::Patterns::NAME
-        fail(Issues::ILLEGAL_NAME, @semantic.keys[i], {:name=>c})
+      else
+        fail(Puppet::Pops::Issues::UNKNOWN_RESOURCE, @semantic, {:type_name => 'Class', :title => o.class_name})
       end
-      ctype.class_name = c.downcase.sub(/^::/,'')
-      ctype
     end
 
     # returns single type as type, else an array of types