puppet 3.6.1-x86-mingw32 → 3.6.2-x86-mingw32

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of puppet might be problematic. Click here for more details.

Files changed (38) hide show
  1. checksums.yaml +7 -0
  2. data/bin/puppet +4 -0
  3. data/ext/debian/puppetmaster-passenger.postinst +91 -41
  4. data/ext/rack/example-passenger-vhost.conf +4 -0
  5. data/lib/puppet/configurer/downloader.rb +3 -3
  6. data/lib/puppet/configurer/plugin_handler.rb +2 -1
  7. data/lib/puppet/defaults.rb +22 -3
  8. data/lib/puppet/indirector/facts/facter.rb +1 -1
  9. data/lib/puppet/network/http/webrick/rest.rb +9 -2
  10. data/lib/puppet/node/environment.rb +2 -0
  11. data/lib/puppet/parser/ast.rb +0 -1
  12. data/lib/puppet/parser/ast/collexpr.rb +1 -1
  13. data/lib/puppet/parser/functions.rb +26 -13
  14. data/lib/puppet/parser/resource.rb +11 -0
  15. data/lib/puppet/resource/catalog.rb +5 -2
  16. data/lib/puppet/settings.rb +53 -16
  17. data/lib/puppet/settings/array_setting.rb +17 -0
  18. data/lib/puppet/settings/base_setting.rb +22 -1
  19. data/lib/puppet/transaction.rb +1 -1
  20. data/lib/puppet/type/user.rb +4 -3
  21. data/lib/puppet/util/logging.rb +1 -0
  22. data/lib/puppet/util/tagging.rb +7 -6
  23. data/lib/puppet/version.rb +1 -1
  24. data/spec/integration/parser/compiler_spec.rb +28 -0
  25. data/spec/integration/parser/future_compiler_spec.rb +29 -0
  26. data/spec/integration/type/user_spec.rb +31 -0
  27. data/spec/unit/configurer/downloader_spec.rb +67 -35
  28. data/spec/unit/configurer/plugin_handler_spec.rb +1 -1
  29. data/spec/unit/indirector/facts/facter_spec.rb +2 -2
  30. data/spec/unit/node/environment_spec.rb +36 -0
  31. data/spec/unit/parser/functions_spec.rb +1 -4
  32. data/spec/unit/settings/array_setting_spec.rb +39 -0
  33. data/spec/unit/settings_spec.rb +69 -76
  34. data/spec/unit/type/user_spec.rb +13 -6
  35. data/spec/unit/util/logging_spec.rb +6 -0
  36. data/spec/unit/util/tagging_spec.rb +31 -0
  37. metadata +3131 -3163
  38. data/lib/puppet/parser/ast/tag.rb +0 -24
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA1:
3
+ metadata.gz: 21879b9e3ccac6b2b050699f0669a3f414ea0aa0
4
+ data.tar.gz: 146e873b7a9da3d3d438a9030fc5b351357da7b2
5
+ SHA512:
6
+ metadata.gz: 7ad887dfc49f8ef33736cbd5318bd9a9bfdddb08e70cee53a722bd0f46eff7bb94ec28d79f641eafa17d6ebbc9a838a8c0173eec5fba3430cb4e3c3b9d6f9a2a
7
+ data.tar.gz: dd4ba4797f74578f23b94cea60a7c70aa70ef3b5736d4a7dc6a808c0768f88136c11d8b1e98a90e91f56a098a0abe1f0e2918a46137403e8e092500994372a81
data/bin/puppet CHANGED
@@ -1,4 +1,8 @@
1
1
  #!/usr/bin/env ruby
2
2
 
3
+ # For security reasons, ensure that '.' is not on the load path
4
+ # This is primarily for 1.8.7 since 1.9.2+ doesn't put '.' on the load path
5
+ $LOAD_PATH.delete '.'
6
+
3
7
  require 'puppet/util/command_line'
4
8
  Puppet::Util::CommandLine.new.execute
@@ -3,6 +3,7 @@
3
3
  set -e
4
4
 
5
5
  sitename="puppetmaster"
6
+ apache2_version="$(dpkg-query --showformat='${Version}\n' --show apache2)"
6
7
 
7
8
  # The debian provided a2* utils in Apache 2.4 uses "site name" as
8
9
  # argument, while the version in Apache 2.2 uses "file name".
@@ -14,7 +15,6 @@ sitename="puppetmaster"
14
15
  # This will end in tears…
15
16
  # Can be removed when we only support apache >= 2.4
16
17
  apache2_puppetmaster_sitename() {
17
- apache2_version="$(dpkg-query --showformat='${Version}\n' --show apache2)"
18
18
  if dpkg --compare-versions "$apache2_version" gt "2.4~"; then
19
19
  echo "${sitename}.conf"
20
20
  else
@@ -49,6 +49,91 @@ update_vhost_for_passenger4() {
49
49
  fi
50
50
  }
51
51
 
52
+ # In Apache 2.2, if either the SSLCARevocationFile or SSLCARevocationPath
53
+ # directives were specified then the specified file(s) would be checked when
54
+ # establishing an SSL connection. Apache 2.4+ the SSLCARevocationCheck directive
55
+ # was added to control how CRLs were checked when verifying a connection and had
56
+ # a default value of none. This means that Apache defaults to ignoring CRLs even
57
+ # if paths are specified to CRL files.
58
+ #
59
+ # This function automatically uncomments the SSLCARevocationCheck directive when
60
+ # the currently installed version of Apache is 2.4.
61
+ update_vhost_for_apache24() {
62
+ if dpkg --compare-versions "$apache2_version" gt "2.4~"; then
63
+ sed -r -i \
64
+ -e "/# SSLCARevocationCheck/s/# //" \
65
+ $tempfile
66
+ fi
67
+ }
68
+
69
+ # Update an existing vhost definition with the SSLCARevocationCheck directive
70
+ # on Apache 2.4+. This scans an existing vhost file for the SSLCARevocationCheck
71
+ # directive and adds it to the file after the SSLCARevocationFile directive.
72
+ #
73
+ # See https://tickets.puppetlabs.com/browse/PUP-2533 for more information.
74
+ update_vhost_for_apache24_upgrade() {
75
+ APACHE2_SITE_FILE="/etc/apache2/sites-available/$(apache2_puppetmaster_sitename)"
76
+
77
+ if dpkg --compare-versions "$apache2_version" gt "2.4~"; then
78
+ if ! grep -q "^[[:space:]]*SSLCARevocationCheck" $APACHE2_SITE_FILE ; then
79
+ tempfile=$(mktemp)
80
+ sed -r \
81
+ -e "/SSLCARevocationFile/a\\ SSLCARevocationCheck chain" \
82
+ $APACHE2_SITE_FILE > $tempfile
83
+ mv $tempfile $APACHE2_SITE_FILE
84
+ fi
85
+ fi
86
+ }
87
+
88
+
89
+ create_initial_puppetmaster_vhost() {
90
+ # Check that puppet master --configprint works properly
91
+ # If it doesn't the following steps to update the vhost will produce a very unhelpful and broken vhost
92
+ if [ $(puppet master --configprint all 2>&1 | grep "Could not parse" | wc -l) != "0" ]; then
93
+ echo "Puppet config print not working properly, exiting"
94
+ exit 1
95
+ fi
96
+
97
+ # Initialize puppetmaster CA and generate the master certificate
98
+ # only if the host doesn't already have any puppet ssl certificate.
99
+ # The ssl key and cert need to be available (eg generated) before
100
+ # apache2 is configured and started since apache2 ssl configuration
101
+ # uses the puppetmaster ssl files.
102
+ if [ ! -e "$(puppet master --configprint hostcert)" ]; then
103
+ puppet cert generate $(puppet master --configprint certname)
104
+ fi
105
+
106
+ # Setup apache2 configuration files
107
+ APACHE2_SITE_FILE="/etc/apache2/sites-available/$(apache2_puppetmaster_sitename)"
108
+ if [ ! -e "${APACHE2_SITE_FILE}" ]; then
109
+ tempfile=$(mktemp)
110
+ sed -r \
111
+ -e "s|(SSLCertificateFile\s+).+$|\1$(puppet master --configprint hostcert)|" \
112
+ -e "s|(SSLCertificateKeyFile\s+).+$|\1$(puppet master --configprint hostprivkey)|" \
113
+ -e "s|(SSLCACertificateFile\s+).+$|\1$(puppet master --configprint localcacert)|" \
114
+ -e "s|(SSLCertificateChainFile\s+).+$|\1$(puppet master --configprint localcacert)|" \
115
+ -e "s|(SSLCARevocationFile\s+).+$|\1$(puppet master --configprint cacrl)|" \
116
+ -e "s|DocumentRoot /etc/puppet/rack/public|DocumentRoot /usr/share/puppet/rack/puppetmasterd/public|" \
117
+ -e "s|<Directory /etc/puppet/rack/>|<Directory /usr/share/puppet/rack/puppetmasterd/>|" \
118
+ /usr/share/puppetmaster-passenger/apache2.site.conf.tmpl > $tempfile
119
+ update_vhost_for_passenger4
120
+ update_vhost_for_apache24
121
+ mv $tempfile "${APACHE2_SITE_FILE}"
122
+ fi
123
+
124
+ # Enable needed modules
125
+ a2enmod ssl
126
+ a2enmod headers
127
+ a2ensite ${sitename}
128
+ restart_apache2
129
+ }
130
+
131
+ update_existing_puppetmaster_vhost() {
132
+ if dpkg --compare-versions "${1}" lt "3.6.2~"; then
133
+ update_vhost_for_apache24_upgrade
134
+ fi
135
+ }
136
+
52
137
  if [ "$1" = "configure" ]; then
53
138
 
54
139
  # Change the owner of the rack config.ru to be the puppet user
@@ -57,47 +142,12 @@ if [ "$1" = "configure" ]; then
57
142
  then
58
143
  dpkg-statoverride --update --add puppet puppet 0644 /usr/share/puppet/rack/puppetmasterd/config.ru
59
144
  fi
60
- # Setup passenger configuration
61
- if [ "$2" = "" ]; then
62
145
 
63
- # Check that puppet master --configprint works properly
64
- # If it doesn't the following steps to update the vhost will produce a very unhelpful and broken vhost
65
- if [ $(puppet master --configprint all 2>&1 | grep "Could not parse" | wc -l) != "0" ]; then
66
- echo "Puppet config print not working properly, exiting"
67
- exit 1
68
- fi
69
-
70
- # Initialize puppetmaster CA and generate the master certificate
71
- # only if the host doesn't already have any puppet ssl certificate.
72
- # The ssl key and cert need to be available (eg generated) before
73
- # apache2 is configured and started since apache2 ssl configuration
74
- # uses the puppetmaster ssl files.
75
- if [ ! -e "$(puppet master --configprint hostcert)" ]; then
76
- puppet cert generate $(puppet master --configprint certname)
77
- fi
78
-
79
- # Setup apache2 configuration files
80
- APACHE2_SITE_FILE="/etc/apache2/sites-available/$(apache2_puppetmaster_sitename)"
81
- if [ ! -e "${APACHE2_SITE_FILE}" ]; then
82
- tempfile=$(mktemp)
83
- sed -r \
84
- -e "s|(SSLCertificateFile\s+).+$|\1$(puppet master --configprint hostcert)|" \
85
- -e "s|(SSLCertificateKeyFile\s+).+$|\1$(puppet master --configprint hostprivkey)|" \
86
- -e "s|(SSLCACertificateFile\s+).+$|\1$(puppet master --configprint localcacert)|" \
87
- -e "s|(SSLCertificateChainFile\s+).+$|\1$(puppet master --configprint localcacert)|" \
88
- -e "s|(SSLCARevocationFile\s+).+$|\1$(puppet master --configprint cacrl)|" \
89
- -e "s|DocumentRoot /etc/puppet/rack/public|DocumentRoot /usr/share/puppet/rack/puppetmasterd/public|" \
90
- -e "s|<Directory /etc/puppet/rack/>|<Directory /usr/share/puppet/rack/puppetmasterd/>|" \
91
- /usr/share/puppetmaster-passenger/apache2.site.conf.tmpl > $tempfile
92
- update_vhost_for_passenger4
93
- mv $tempfile "${APACHE2_SITE_FILE}"
94
- fi
95
-
96
- # Enable needed modules
97
- a2enmod ssl
98
- a2enmod headers
99
- a2ensite ${sitename}
100
- restart_apache2
146
+ # Setup puppetmaster passenger vhost
147
+ if [ "$2" = "" ]; then
148
+ create_initial_puppetmaster_vhost
149
+ else
150
+ update_existing_puppetmaster_vhost $2
101
151
  fi
102
152
 
103
153
  # Fix CRL file on upgrade to use the CA crl file instead of the host crl.
@@ -29,6 +29,10 @@ Listen 8140
29
29
  # If Apache complains about invalid signatures on the CRL, you can try disabling
30
30
  # CRL checking by commenting the next line, but this is not recommended.
31
31
  SSLCARevocationFile /etc/puppet/ssl/ca/ca_crl.pem
32
+ # Apache 2.4 introduces the SSLCARevocationCheck directive and sets it to none
33
+ # which effectively disables CRL checking; if you are using Apache 2.4+ you must
34
+ # specify 'SSLCARevocationCheck chain' to actually use the CRL.
35
+ # SSLCARevocationCheck chain
32
36
  SSLVerifyClient optional
33
37
  SSLVerifyDepth 1
34
38
  # The `ExportCertData` option is needed for agent certificate expiration warnings
@@ -25,8 +25,8 @@ class Puppet::Configurer::Downloader
25
25
  files
26
26
  end
27
27
 
28
- def initialize(name, path, source, ignore = nil, environment = nil)
29
- @name, @path, @source, @ignore, @environment = name, path, source, ignore, environment
28
+ def initialize(name, path, source, ignore = nil, environment = nil, source_permissions = :ignore)
29
+ @name, @path, @source, @ignore, @environment, @source_permissions = name, path, source, ignore, environment, source_permissions
30
30
  end
31
31
 
32
32
  def catalog
@@ -51,7 +51,7 @@ class Puppet::Configurer::Downloader
51
51
  :path => path,
52
52
  :recurse => true,
53
53
  :source => source,
54
- :source_permissions => :ignore,
54
+ :source_permissions => @source_permissions,
55
55
  :tag => name,
56
56
  :purge => true,
57
57
  :force => true,
@@ -17,7 +17,8 @@ module Puppet::Configurer::PluginHandler
17
17
  Puppet[:pluginfactdest],
18
18
  Puppet[:pluginfactsource],
19
19
  Puppet[:pluginsignore],
20
- environment
20
+ environment,
21
+ :use
21
22
  )
22
23
  plugin_fact_downloader.evaluate
23
24
  end
@@ -58,6 +58,20 @@ module Puppet
58
58
  :type => :enum,
59
59
  :values => ["debug","info","notice","warning","err","alert","emerg","crit"],
60
60
  :desc => "Default logging level",
61
+ },
62
+ :disable_warnings => {
63
+ :default => [],
64
+ :type => :array,
65
+ :desc => "A list of warning types to disable. Currently the only warning type that can be
66
+ disabled are deprecations, but more warning types may be added later.",
67
+ :hook => proc do |value|
68
+ values = munge(value)
69
+ valid = %w[deprecations]
70
+ invalid = values - (values & valid)
71
+ if not invalid.empty?
72
+ raise ArgumentError, "Cannot disable unrecognized warning types #{invalid.inspect}. Valid values are #{valid.inspect}."
73
+ end
74
+ end
61
75
  }
62
76
  )
63
77
 
@@ -356,7 +370,7 @@ module Puppet
356
370
  a file (such as manifests or templates) has changed on disk. #{AS_DURATION}",
357
371
  },
358
372
  :environment_timeout => {
359
- :default => "5s",
373
+ :default => "3m",
360
374
  :type => :ttl,
361
375
  :desc => "The time to live for a cached environment. The time is either given #{AS_DURATION}, or
362
376
  the word 'unlimited' which causes the environment to be cached until the master is restarted."
@@ -414,6 +428,7 @@ module Puppet
414
428
  Setting a global value for config_version in puppet.conf is deprecated. Please set a
415
429
  per-environment value in environment.conf instead. For more info, see
416
430
  http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
431
+ :deprecated => :allowed_on_commandline,
417
432
  },
418
433
  :zlib => {
419
434
  :default => true,
@@ -897,7 +912,8 @@ EOT
897
912
  :type => :directory,
898
913
  :desc => "Used to build the default value of the `manifest` setting. Has no other purpose.
899
914
 
900
- This setting is deprecated."
915
+ This setting is deprecated.",
916
+ :deprecated => :completely,
901
917
  },
902
918
  :manifest => {
903
919
  :default => "$manifestdir/site.pp",
@@ -911,6 +927,7 @@ EOT
911
927
  environment's `manifests` directory as the main manifest, you can set
912
928
  `manifest` in environment.conf. For more info, see
913
929
  http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
930
+ :deprecated => :allowed_on_commandline,
914
931
  },
915
932
  :code => {
916
933
  :default => "",
@@ -998,6 +1015,7 @@ EOT
998
1015
  default modulepath of `<ACTIVE ENVIRONMENT'S MODULES DIR>:$basemodulepath`,
999
1016
  you can set `modulepath` in environment.conf. For more info, see
1000
1017
  http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
1018
+ :deprecated => :allowed_on_commandline,
1001
1019
  },
1002
1020
  :ssl_client_header => {
1003
1021
  :default => "HTTP_X_CLIENT_DN",
@@ -1825,7 +1843,8 @@ EOT
1825
1843
  :desc => "Where Puppet looks for template files. Can be a list of colon-separated
1826
1844
  directories.
1827
1845
 
1828
- This setting is deprecated. Please put your templates in modules instead."
1846
+ This setting is deprecated. Please put your templates in modules instead.",
1847
+ :deprecated => :completely,
1829
1848
  },
1830
1849
 
1831
1850
  :allow_variables_with_dashes => {
@@ -55,7 +55,7 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
55
55
  begin
56
56
  Puppet.info "Loading facts in #{fqfile}"
57
57
  ::Timeout::timeout(Puppet[:configtimeout]) do
58
- load file
58
+ load File.join('.', file)
59
59
  end
60
60
  rescue SystemExit,NoMemoryError
61
61
  raise
@@ -7,6 +7,10 @@ class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
7
7
 
8
8
  include Puppet::Network::HTTP::Handler
9
9
 
10
+ def self.mutex
11
+ @mutex ||= Mutex.new
12
+ end
13
+
10
14
  def initialize(server)
11
15
  raise ArgumentError, "server is required" unless server
12
16
  register([Puppet::Network::HTTP::API::V2.routes, Puppet::Network::HTTP::API::V1.routes])
@@ -26,9 +30,12 @@ class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
26
30
  params.merge(client_information(request))
27
31
  end
28
32
 
29
- # WEBrick uses a service method to respond to requests. Simply delegate to the handler response method.
33
+ # WEBrick uses a service method to respond to requests. Simply delegate to
34
+ # the handler response method.
30
35
  def service(request, response)
31
- process(request, response)
36
+ self.class.mutex.synchronize do
37
+ process(request, response)
38
+ end
32
39
  end
33
40
 
34
41
  def headers(request)
@@ -479,6 +479,8 @@ class Puppet::Node::Environment
479
479
  self.manifest == other.manifest
480
480
  end
481
481
 
482
+ alias eql? ==
483
+
482
484
  def hash
483
485
  [self.class, name, full_modulepath, manifest].hash
484
486
  end
@@ -125,6 +125,5 @@ require 'puppet/parser/ast/resource_override'
125
125
  require 'puppet/parser/ast/resource_reference'
126
126
  require 'puppet/parser/ast/resourceparam'
127
127
  require 'puppet/parser/ast/selector'
128
- require 'puppet/parser/ast/tag'
129
128
  require 'puppet/parser/ast/vardef'
130
129
  require 'puppet/parser/code_merger'
@@ -56,7 +56,7 @@ class CollExpr < AST::Branch
56
56
  return match, code
57
57
  end
58
58
 
59
- # Late binding evaluation of a collect expression (as done in 3x), but with proper Puppet Langauge
59
+ # Late binding evaluation of a collect expression (as done in 3x), but with proper Puppet Language
60
60
  # semantics for equals and include
61
61
  #
62
62
  def evaluate4x(scope)
@@ -17,8 +17,7 @@ module Puppet::Parser::Functions
17
17
  #
18
18
  # @api private
19
19
  def self.reset
20
- @functions = Hash.new { |h,k| h[k] = {} }
21
- @modules = Hash.new
20
+ @modules = {}
22
21
 
23
22
  # Runs a newfunction to create a function for each of the log levels
24
23
  Puppet::Util::Log.levels.each do |level|
@@ -44,7 +43,21 @@ module Puppet::Parser::Functions
44
43
  #
45
44
  # @api private
46
45
  def self.environment_module(env)
47
- @modules[env.name] ||= Module.new
46
+ @modules[env.name] ||= Module.new do
47
+ @metadata = {}
48
+
49
+ def self.all_function_info
50
+ @metadata
51
+ end
52
+
53
+ def self.get_function_info(name)
54
+ @metadata[name]
55
+ end
56
+
57
+ def self.add_function_info(name, info)
58
+ @metadata[name] = info
59
+ end
60
+ end
48
61
  end
49
62
 
50
63
  # Create a new Puppet DSL function.
@@ -144,7 +157,9 @@ module Puppet::Parser::Functions
144
157
  environment_module(environment).send(:define_method, real_fname, &block)
145
158
 
146
159
  fname = "function_#{name}"
147
- environment_module(environment).send(:define_method, fname) do |*args|
160
+ env_module = environment_module(environment)
161
+
162
+ env_module.send(:define_method, fname) do |*args|
148
163
  Puppet::Util::Profiler.profile("Called #{name}") do
149
164
  if args[0].is_a? Array
150
165
  if arity >= 0 and args[0].size != arity
@@ -162,7 +177,8 @@ module Puppet::Parser::Functions
162
177
  func = {:arity => arity, :type => ftype, :name => fname}
163
178
  func[:doc] = options[:doc] if options[:doc]
164
179
 
165
- add_function(name, func, environment)
180
+ env_module.add_function_info(name, func)
181
+
166
182
  func
167
183
  end
168
184
 
@@ -239,17 +255,14 @@ module Puppet::Parser::Functions
239
255
  private
240
256
 
241
257
  def merged_functions(environment)
242
- @functions[Puppet.lookup(:root_environment)].merge(@functions[environment])
243
- end
258
+ root = environment_module(Puppet.lookup(:root_environment))
259
+ env = environment_module(environment)
244
260
 
245
- def get_function(name, environment)
246
- name = name.intern
247
- merged_functions(environment)[name]
261
+ root.all_function_info.merge(env.all_function_info)
248
262
  end
249
263
 
250
- def add_function(name, func, environment)
251
- name = name.intern
252
- @functions[environment][name] = func
264
+ def get_function(name, environment)
265
+ environment_module(environment).get_function_info(name.intern) || environment_module(Puppet.lookup(:root_environment)).get_function_info(name.intern)
253
266
  end
254
267
  end
255
268
  end
@@ -191,6 +191,17 @@ class Puppet::Parser::Resource < Puppet::Resource
191
191
  copy_as_resource.to_ral
192
192
  end
193
193
 
194
+ # Is the receiver tagged with the given tags?
195
+ # This match takes into account the tags that a resource will inherit from its container
196
+ # but have not been set yet.
197
+ # It does *not* take tags set via resource defaults as these will *never* be set on
198
+ # the resource itself since all resources always have tags that are automatically
199
+ # assigned.
200
+ #
201
+ def tagged?(*tags)
202
+ super || ((scope_resource = scope.resource) && scope_resource != self && scope_resource.tagged?(tags))
203
+ end
204
+
194
205
  private
195
206
 
196
207
  # Add default values from our definition.