puppet 4.4.1 → 4.4.2

data/lib/puppet/application/ca.rb

@@ -6,5 +6,6 @@ class Puppet::Application::Ca < Puppet::Application::FaceBase
 
   def setup
     Puppet::SSL::Oids.register_puppet_oids
+    super
   end
 end

data/lib/puppet/application/lookup.rb

@@ -6,7 +6,7 @@ require 'puppet/parser/compiler'
 class Puppet::Application::Lookup < Puppet::Application
 
   RUN_HELP = "Run 'puppet lookup --help' for more details".freeze
-  DEEP_MERGE_OPTIONS = '--knock-out-prefix, --sort-merged-arrays, --unpack-arrays, and --merge-hash-arrays'.freeze
+  DEEP_MERGE_OPTIONS = '--knock-out-prefix, --sort-merged-arrays, and --merge-hash-arrays'.freeze
 
   run_mode :master
 
@@ -35,10 +35,6 @@ class Puppet::Application::Lookup < Puppet::Application
 
   option('--sort-merge-arrays')
 
-  option('--unpack-arrays DELIMITER') do |arg|
-    options[:unpack_arrays] = arg
-  end
-
   option('--merge-hash-arrays')
 
   option('--explain')
@@ -124,7 +120,7 @@ USAGE
 -----
 puppet lookup [--help] [--type <TYPESTRING>] [--merge unique|hash|deep]
   [--knock-out-prefix <PREFIX-STRING>] [--sort-merged-arrays]
-  [--unpack-arrays <STRING-VALUE>] [--merge-hash-arrays] [--explain]
+  [--merge-hash-arrays] [--explain]
   [--default <VALUE>] [--node <NODE-NAME>] [--facts <FILE>]
   [--compile]
   [--render-as s|json|yaml|binary|msgpack] <keys>
@@ -172,10 +168,6 @@ the puppet lookup function linked to above.
   Can be used with the 'deep' merge strategy. When this flag is used all
   merged arrays will be sorted.
 
-* --unpack-arrays <STRING-VALUE>
-  Can be used with the 'deep' merge strategy. Specify a string value used
-  as a deliminator to join all array values and then split them again.
-
 * --merge-hash-arrays
   Can be used with the 'deep' merge strategy. When this flag is used arrays
   and hashes will be merged.
@@ -225,7 +217,7 @@ EXAMPLE
   If you wanted to get the first value found for 'key_name_one' and 'key_name_two'
   within the scope of the agent.local node while merging values and knocking out
   the prefix 'foo' while merging, you would call lookup like this:
-  $ puppet lookup --node agent.local --merge deep --knock_out_prefix foo key_name_one key_name_two
+  $ puppet lookup --node agent.local --merge deep --knock-out-prefix foo key_name_one key_name_two
 
   If you wanted to lookup 'key_name' within the scope of the agent.local node,
   and return a default value of 'bar' if nothing was found, you would call
@@ -251,7 +243,7 @@ Copyright (c) 2015 Puppet Labs, LLC Licensed under the Apache 2.0 License
     #  raise "No node was given via the '--node' flag for the scope of the lookup.\n#{RUN_HELP}"
     #end
 
-    if (options[:sort_merge_arrays] || options[:merge_hash_arrays] || options[:prefix] || options[:unpack_arrays]) && options[:merge] != 'deep'
+    if (options[:sort_merge_arrays] || options[:merge_hash_arrays] || options[:prefix]) && options[:merge] != 'deep'
       raise "The options #{DEEP_MERGE_OPTIONS} are only available with '--merge deep'\n#{RUN_HELP}"
     end
 
@@ -275,10 +267,6 @@ Copyright (c) 2015 Puppet Labs, LLC Licensed under the Apache 2.0 License
           merge_options.merge!({'knockout_prefix' => options[:prefix]})
         end
 
-        if options[:unpack_arrays]
-          merge_options.merge!({'unpack_arrays' => options[:unpack_arrays]})
-        end
-
       else
         merge_options = {'strategy' => merge}
       end

data/lib/puppet/application/resource.rb

@@ -84,10 +84,6 @@ configuration options can also be generated by running puppet with
   Write the results of the query to a file, open the file in an editor,
   and read the file back in as an executable Puppet manifest.
 
-* --host:
-  When specified, connect to the resource server on the named host
-  and retrieve the list of resouces of the type specified.
-
 * --help:
   Print this help message.
 

data/lib/puppet/data_providers/hiera_interpolate.rb

@@ -100,10 +100,16 @@ module Puppet::DataProviders::HieraInterpolate
       throw :no_such_key if value.nil?
       if segment =~ /^[0-9]+$/
         segment = segment.to_i
-        raise Puppet::DataBinding::LookupError, "Data provider type mismatch: Got #{value.class.name} when Array was expected to enable lookup using key '#{segment}'" unless value.instance_of?(Array)
+        unless value.instance_of?(Array)
+          raise Puppet::DataBinding::LookupError,
+                "Data provider type mismatch: Got #{value.class.name} when Array was expected to enable lookup using key '#{segment}'"
+        end
         throw :no_such_key unless segment < value.size
       else
-        raise Puppet::DataBinding::LookupError, "Data provider type mismatch: Got #{value.class.name} when a non Array object that responds to '[]' was expected to enable lookup using key '#{segment}'" unless value.respond_to?(:'[]') && !value.instance_of?(Array)
+        unless value.respond_to?(:'[]') && !(value.instance_of?(Array) || value.instance_of?(String))
+          raise Puppet::DataBinding::LookupError,
+                "Data provider type mismatch: Got #{value.class.name} when a hash-like object was expected to enable lookup using key '#{segment}'"
+        end
         throw :no_such_key unless value.include?(segment)
       end
       value = value[segment]

data/lib/puppet/data_providers/json_data_provider_factory.rb

@@ -18,7 +18,7 @@ module Puppet::DataProviders
     include HieraInterpolate
 
     def initialize_data(path, lookup_invocation)
-      JSON.parse(File.read(path))
+      JSON.parse(Puppet::FileSystem.read(path, :encoding => 'utf-8'))
     rescue JSON::ParserError => ex
       # Filename not included in message, so we add it here.
       raise Puppet::DataBinding::LookupError, "Unable to parse (#{path}): #{ex.message}"

data/lib/puppet/defaults.rb

@@ -606,22 +606,38 @@ module Puppet
     :dns_alt_names => {
       :default => '',
       :desc    => <<EOT,
-The comma-separated list of alternative DNS names to use for the local host.
-
-When the node generates a CSR for itself, these are added to the request
-as the desired `subjectAltName` in the certificate: additional DNS labels
-that the certificate is also valid answering as.
-
-This is generally required if you use a non-hostname `certname`, or if you
-want to use `puppet kick` or `puppet resource -H` and the primary certname
-does not match the DNS name you use to communicate with the host.
-
-This is unnecessary for agents, unless you intend to use them as a server for
-`puppet kick` or remote `puppet resource` management.
-
-It is rarely necessary for servers; it is usually helpful only if you need to
-have a pool of multiple load balanced masters, or for the same master to
-respond on two physically separate networks under different names.
+A comma-separated list of alternate DNS names for Puppet Server. These are extra
+hostnames (in addition to its `certname`) that the server is allowed to use when
+serving agents. Puppet checks this setting when automatically requesting a
+certificate for Puppet agent or Puppet Server, and when manually generating a
+certificate with `puppet cert generate`.
+
+In order to handle agent requests at a given hostname (like
+"puppet.example.com"), Puppet Server needs a certificate that proves it's
+allowed to use that name; if a server shows a certificate that doesn't include
+its hostname, Puppet agents will refuse to trust it. If you use a single
+hostname for Puppet traffic but load-balance it to multiple Puppet Servers, each
+of those servers needs to include the official hostname in its list of extra
+names.
+
+**Note:** The list of alternate names is locked in when the server's
+certificate is signed. If you need to change the list later, you can't just
+change this setting; you also need to:
+
+* On the server: Stop Puppet Server.
+* On the CA server: Revoke and clean the server's old certificate. (`puppet cert clean <NAME>`)
+* On the server: Delete the old certificate (and any old certificate signing requests)
+  from the [ssldir](https://docs.puppetlabs.com/puppet/latest/reference/dirs_ssldir.html).
+* On the server: Run `puppet agent -t --ca_server <CA HOSTNAME>` to request a new certificate
+* On the CA server: Sign the certificate request, explicitly allowing alternate names
+  (`puppet cert sign --allow-dns-alt-names <NAME>`).
+* On the server: Run `puppet agent -t --ca_server <CA HOSTNAME>` to retrieve the cert.
+* On the server: Start Puppet Server again.
+
+To see all the alternate names your servers are using, log into your CA server
+and run `puppet cert list -a`, then check the output for `(alt names: ...)`.
+Most agent nodes should NOT have alternate names; the only certs that should
+have them are Puppet Server nodes that you want other agents to trust.
 EOT
     },
     :csr_attributes => {

data/lib/puppet/file_system/uniquefile.rb

@@ -175,7 +175,7 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
       mkdir(lock)
       yield
     ensure
-      rmdir(lock) if lock
+      rmdir(lock) if Puppet::FileSystem.exist?(lock)
     end
 
     def mkdir(*args)
@@ -187,4 +187,4 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
     end
   end
 
-end
+end

data/lib/puppet/file_system/windows.rb

@@ -4,21 +4,7 @@ require 'puppet/util/windows'
 class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
 
   def exist?(path)
-    if ! Puppet.features.manages_symlinks?
-      return ::File.exist?(path)
-    end
-
-    path = path.to_str if path.respond_to?(:to_str) # support WatchedFile
-    path = path.to_s # support String and Pathname
-
-    begin
-      if Puppet::Util::Windows::File.symlink?(path)
-        path = Puppet::Util::Windows::File.readlink(path)
-      end
-      ! Puppet::Util::Windows::File.stat(path).nil?
-    rescue # generally INVALID_HANDLE_VALUE which means 'file not found'
-      false
-    end
+    return Puppet::Util::Windows::File.exist?(path)
   end
 
   def symlink(path, dest, options = {})

data/lib/puppet/functions/assert_type.rb

@@ -69,7 +69,7 @@ Puppet::Functions.create_function(:assert_type, Puppet::Functions::InternalFunct
   #
   def assert_type(type, value)
     unless Puppet::Pops::Types::TypeCalculator.instance?(type,value)
-      inferred_type = Puppet::Pops::Types::TypeCalculator.infer(value)
+      inferred_type = Puppet::Pops::Types::TypeCalculator.infer_set(value)
       if block_given?
         # Give the inferred type to allow richer comparison in the given block (if generalized
         # information is lost).

data/lib/puppet/functions/lookup.rb

@@ -100,9 +100,6 @@
 #     disables this feature.
 #     * `'sort_merged_arrays'` (boolean) --- Whether to sort all arrays that are
 #     merged together. Defaults to `false`.
-#     * `'unpack_arrays'` (string or undef) --- A delimiter string; Puppet will
-#     join merged arrays with this delimiter, then split them again. Defaults to
-#     `undef`, which disables this feature.
 #     * `'merge_hash_arrays'` (boolean) --- Whether to merge hashes within arrays.
 #     Defaults to `false`.
 #

data/lib/puppet/indirector/catalog/compiler.rb

@@ -254,7 +254,8 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
       raise Puppet::Error, "Unable to find a common checksum type between agent '#{options[:checksum_type]}' and master '#{known_checksum_types}'." unless checksum_type
     end
 
-    str = "Compiled %s for #{node.name}" % [checksum_type ? 'static catalog' : 'catalog']
+    str = "Compiled %s for " % [checksum_type ? 'static catalog' : 'catalog']
+    str += node.name
     str += " in environment #{node.environment}" if node.environment
     config = nil
 

data/lib/puppet/indirector/msgpack.rb

@@ -58,7 +58,7 @@ class Puppet::Indirector::Msgpack < Puppet::Indirector::Terminus
     msgpack = nil
 
     begin
-      msgpack = File.read(file)
+      msgpack = Puppet::FileSystem.read(file, :encoding => 'utf-8')
     rescue Errno::ENOENT
       return nil
     rescue => detail

data/lib/puppet/indirector/terminus.rb

@@ -66,18 +66,18 @@ class Puppet::Indirector::Terminus
       # Yay, class/instance confusion.
       subclass.terminus_type = self.name
 
-      # Our subclass is specifically associated with an indirection.
+      # This subclass is specifically associated with an indirection.
       raise("Invalid name #{longname}") unless names.length > 0
-      indirection_name = names.pop.sub(/^[A-Z]/) { |i| i.downcase }.gsub(/[A-Z]/) { |i| "_#{i.downcase}" }.intern
+      processed_name = names.pop.sub(/^[A-Z]/) { |i| i.downcase }.gsub(/[A-Z]/) { |i| "_#{i.downcase}" }
 
-      if indirection_name == "" or indirection_name.nil?
+      if processed_name.empty?
         raise Puppet::DevError, "Could not discern indirection model from class constant"
       end
 
       # This will throw an exception if the indirection instance cannot be found.
       # Do this last, because it also registers the terminus type with the indirection,
       # which needs the above information.
-      subclass.indirection = indirection_name
+      subclass.indirection = processed_name.intern
 
       # And add this instance to the instance hash.
       Puppet::Indirector::Terminus.register_terminus_class(subclass)

data/lib/puppet/module.rb

@@ -48,7 +48,7 @@ class Puppet::Module
 
   def self.is_module_namespaced_name?(name)
     # it must match the full module name according to forge validator
-    return true if name =~ /^[a-zA-Z0-9]+[-][a-z][a-z0-9_]*$/   
+    return true if name =~ /^[a-zA-Z0-9]+[-][a-z][a-z0-9_]*$/
     return false
   end
 
@@ -90,7 +90,7 @@ class Puppet::Module
     return false unless Puppet::FileSystem.exist?(metadata_file)
 
     begin
-      metadata =  JSON.parse(File.read(metadata_file))
+      metadata =  JSON.parse(File.read(metadata_file, :encoding => 'utf-8'))
     rescue JSON::JSONError => e
       Puppet.debug("#{name} has an invalid and unparsable metadata.json file.  The parse error: #{e.message}")
       return false
@@ -145,7 +145,7 @@ class Puppet::Module
   end
 
   def load_metadata
-    @metadata = data = JSON.parse(File.read(metadata_file))
+    @metadata = data = JSON.parse(File.read(metadata_file, :encoding => 'utf-8'))
     @forge_name = data['name'].gsub('-', '/') if data['name']
 
     [:source, :author, :version, :license, :dependencies].each do |attr|

data/lib/puppet/module_tool/applications/builder.rb

@@ -65,9 +65,9 @@ module Puppet::ModuleTool
           gitignore = File.join(@path, '.gitignore')
 
           if File.file? pmtignore
-            @ignored_files = PathSpec.new File.read(pmtignore)
+            @ignored_files = PathSpec.new Puppet::FileSystem.read(pmtignore, :encoding => 'utf-8')
           elsif File.file? gitignore
-            @ignored_files = PathSpec.new File.read(gitignore)
+            @ignored_files = PathSpec.new Puppet::FileSystem.read(gitignore, :encoding => 'utf-8')
           else
             @ignored_files = PathSpec.new
           end

data/lib/puppet/network/auth_config_parser.rb

@@ -4,7 +4,7 @@ module Puppet::Network
 class AuthConfigParser
 
   def self.new_from_file(file)
-    self.new(File.read(file))
+    self.new(Puppet::FileSystem.read(file, :encoding => 'utf-8'))
   end
 
   def initialize(string)

data/lib/puppet/network/http/api/indirected_routes.rb

@@ -104,8 +104,6 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
       raise ArgumentError, "No request key specified in #{uri}"
     end
 
-    key = URI.unescape(key)
-
     [indirection, method, key, params]
   end
 

data/lib/puppet/network/http/rack/rest.rb

@@ -2,6 +2,7 @@ require 'openssl'
 require 'cgi'
 require 'puppet/network/http/handler'
 require 'puppet/util/ssl'
+require 'uri'
 
 class Puppet::Network::HTTP::RackREST
   include Puppet::Network::HTTP::Handler
@@ -79,7 +80,15 @@ class Puppet::Network::HTTP::RackREST
 
   # what path was requested? (this is, without any query parameters)
   def path(request)
-    request.path
+    # The value that Passenger provides for 'path' is escaped
+    # (URL percent-encoded), see
+    # https://github.com/phusion/passenger/blob/release-5.0.26/src/apache2_module/Hooks.cpp#L885
+    # for the implementation as hooked up to an Apache web server.  Code
+    # in the indirector / HTTP layer which consumes this path, however, assumes
+    # that it has already been unescaped, so it is unescaped here.
+    if request.path
+      URI.unescape(request.path)
+    end
   end
 
   # return the request body

data/lib/puppet/parser/functions/lookup.rb

@@ -101,9 +101,6 @@ but can adjust the merge with additional options. The available options are:
     disables this feature.
     * `'sort_merged_arrays'` (boolean) --- Whether to sort all arrays that are
     merged together. Defaults to `false`.
-    * `'unpack_arrays'` (string or undef) --- A delimiter string; Puppet will
-    join merged arrays with this delimiter, then split them again. Defaults to
-    `undef`, which disables this feature.
     * `'merge_hash_arrays'` (boolean) --- Whether to merge hashes within arrays.
     Defaults to `false`.
 

data/lib/puppet/pops/evaluator/access_operator.rb

@@ -293,6 +293,30 @@ class AccessOperator
     end
   end
 
+  def access_PIterableType(o, scope, keys)
+    keys.flatten!
+    if keys.size == 1
+      unless keys[0].is_a?(Types::PAnyType)
+        fail(Issues::BAD_TYPE_SLICE_TYPE, @semantic.keys[0], {:base_type => 'Iterable-Type', :actual => keys[0].class})
+      end
+      Types::PIterableType.new(keys[0])
+    else
+      fail(Issues::BAD_TYPE_SLICE_ARITY, @semantic, {:base_type => 'Iterable-Type', :min => 1, :actual => keys.size})
+    end
+  end
+
+  def access_PIteratorType(o, scope, keys)
+    keys.flatten!
+    if keys.size == 1
+      unless keys[0].is_a?(Types::PAnyType)
+        fail(Issues::BAD_TYPE_SLICE_TYPE, @semantic.keys[0], {:base_type => 'Iterator-Type', :actual => keys[0].class})
+      end
+      Types::PIteratorType.new(keys[0])
+    else
+      fail(Issues::BAD_TYPE_SLICE_ARITY, @semantic, {:base_type => 'Iterator-Type', :min => 1, :actual => keys.size})
+    end
+  end
+
   def access_PRuntimeType(o, scope, keys)
     keys.flatten!
     assert_keys(keys, o, 2, 2, String, String)
@@ -366,7 +390,7 @@ class AccessOperator
       fail(Issues::BAD_TYPE_SLICE_ARITY, @semantic,
         {:base_type => 'Collection-Type', :min => 1, :max => 2, :actual => keys.size})
     end
-    Types::PCollectionType.new(size_t)
+    Types::PCollectionType.new(nil, size_t)
   end
 
   # An Array can create a new Array type. It is not possible to create a collection of Array types.

data/lib/puppet/pops/evaluator/closure.rb

@@ -45,14 +45,19 @@ class Closure < CallableSignature
     if enforce_parameters
       # Push a temporary parameter scope used while resolving the parameter defaults
       @enclosing_scope.with_parameter_scope(parameter_names) do |param_scope|
-        args_hash.each { |k, v| param_scope[k] = v unless v.nil? && parameter_names.include?(k) }
+        # Assign all non-nil values, even those that represent non-existent paramaters.
+        args_hash.each { |k, v| param_scope[k] = v unless v.nil? }
         parameters.each do |p|
           name = p.name
-          # only set result of default expr if it is defined (it is otherwise not possible to differentiate
-          # between explicit undef and no default expression
           arg = args_hash[name]
-          if arg.nil? && !p.value.nil?
-            param_scope[name] = param_scope.evaluate(name, p.value, @enclosing_scope, @evaluator)
+          if arg.nil?
+            # Arg either wasn't given, or it was undef
+            if p.value.nil?
+              # No default. Assign nil if the args_hash included it
+              param_scope[name] = nil if args_hash.include?(name)
+            else
+              param_scope[name] = param_scope.evaluate(name, p.value, @enclosing_scope, @evaluator)
+            end
           end
         end
         args_hash = param_scope.to_hash

data/lib/puppet/pops/merge_strategy.rb

@@ -279,7 +279,6 @@ module Puppet::Pops
   #   hash.deep_merge!({:x => [1,2]}, {:knockout_prefix => '--'})
   #   - 'knockout_prefix' Set to string value to signify prefix which deletes elements from existing element. Defaults is _undef_
   #   - 'sort_merged_arrays' Set to _true_ to sort all arrays that are merged together. Default is _false_
-  #   - 'unpack_arrays' Set to string value used as a deliminator to join all array values and then split them again. Default is _undef_
   #   - 'merge_hash_arrays' Set to _true_ to merge hashes within arrays. Default is _false_
   #
   # Selected Options Details:
@@ -295,14 +294,6 @@ module Puppet::Pops
   #    dest   = {:x => [1,2,3]}
   #    dest.ko_deep_merge!(source)
   #    Results: {:x => ""}
-  # :unpack_arrays => The purpose of this is to permit compound elements to be passed
-  #   in as strings and to be converted into discrete array elements
-  #   irsource = {:x => ['1,2,3', '4']}
-  #   dest   = {:x => ['5','6','7,8']}
-  #   dest.deep_merge!(source, {:unpack_arrays => ','})
-  #   Results: {:x => ['1','2','3','4','5','6','7','8']}
-  #   Why: If receiving data from an HTML form, this makes it easy for a checkbox
-  #    to pass multiple values from within a single HTML element
   #
   # :merge_hash_arrays => merge hashes within arrays
   #   source = {:x => [{:y => 1}]}
@@ -335,7 +326,6 @@ module Puppet::Pops
           'merge_debug=>Optional[Boolean],'\
           'merge_hash_arrays=>Optional[Boolean],'\
           'sort_merge_arrays=>Optional[Boolean],'\
-          'unpack_arrays=>Optional[String]'\
           '}]')
     end