puppet 6.0.5-universal-darwin → 6.0.7-universal-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d34c5ebd73a762d6df54fc3ed4853b1de7c34e05918a745ef4a2c36065828a4d
-  data.tar.gz: 114ef1d3984ce2ae4238259557df37bc545c3070786ddeb3371e38c384ceee8e
+  metadata.gz: e9b0abe8f12d35a9437fc00187d27be462a7b43e9baa539a1e660bea9d2376a5
+  data.tar.gz: 2a55d679f455fef6aa96927b35230567c8f1b042b5741473a2dc32beaaf38b94
 SHA512:
-  metadata.gz: e88e63a3839496a24a80a696ef210a0930e4192cd284700b7b87fb48f080140852b718b9c2cf7209b52579c01cc70a2bb4b6ef5a805d2f0df727bedb4192551f
-  data.tar.gz: 4ae4dd93f729f447cf501775eaaa9b22b00dffd74b2bb5de0d707b6bb315b81ba75a0543be1148c29b760ac598b7fe7aba4bdc3376e838162b978a981ad59100
+  metadata.gz: feff05eebd5cc5056776006c5d15626e8a95b37dd7e3a297cded1c2175452c17f2dd5171ef04fcabb458e05e048abbe600a2b0450893452197bcb5a91b83ac83
+  data.tar.gz: 278932fd19dcbaddbc3befdea5f1f2f361b29bd92cdfdfe00387d580930e6d118f22c4d1cfd9a7f5979c28404d14ebcb6b0805f8c7e2e61f7276f13c13c079e1

data/CODEOWNERS

@@ -0,0 +1,30 @@
+# default to platform-core
+* @puppetlabs/platform-core
+
+# platform-os
+/lib/puppet/type/group @puppetlabs/platform-os
+/lib/puppet/type/package @puppetlabs/platform-os
+/lib/puppet/type/service @puppetlabs/platform-os
+/lib/puppet/type/user @puppetlabs/platform-os
+/lib/puppet/provider/group @puppetlabs/platform-os
+/lib/puppet/provider/package @puppetlabs/platform-os
+/lib/puppet/provider/service @puppetlabs/platform-os
+/lib/puppet/provider/user @puppetlabs/platform-os
+
+# language
+/lib/puppet/datatypes @puppetlabs/language
+/lib/puppet/functions @puppetlabs/language
+/lib/puppet/pal @puppetlabs/language
+/lib/puppet/parser @puppetlabs/language
+/lib/puppet/pops @puppetlabs/language
+/lib/puppet/syntax_checkers @puppetlabs/language
+
+# puppet device
+/lib/puppet/application/device.rb @puppetlabs/networking
+/lib/puppet/util/network_device @puppetlabs/networking
+
+# puppet module
+/lib/puppet/application/module.rb @puppetlabs/pdk
+/lib/puppet/face/module @puppetlabs/pdk
+/lib/puppet/forge @puppetlabs/pdk
+/lib/puppet/module_tool @puppetlabs/pdk

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    puppet (6.0.5)
+    puppet (6.0.7)
       CFPropertyList (~> 2.2)
       facter (>= 2.4.0, < 4)
       fast_gettext (~> 1.1.2)
@@ -15,7 +15,7 @@ GEM
   remote: https://artifactory.delivery.puppetlabs.net/artifactory/api/gems/rubygems/
   specs:
     CFPropertyList (2.3.6)
-    addressable (2.5.2)
+    addressable (2.6.0)
       public_suffix (>= 2.0.2, < 4.0)
     artifactory (2.8.2)
     ast (2.4.0)
@@ -34,9 +34,9 @@ GEM
       locale
     hashdiff (0.3.8)
     hiera (3.5.0)
-    hiera-eyaml (2.1.0)
+    hiera-eyaml (3.0.0)
       highline (~> 1.6.19)
-      trollop (~> 2.0)
+      optimist
     highline (1.6.21)
     hocon (1.2.5)
     hpricot (0.8.6)
@@ -50,23 +50,24 @@ GEM
     minitar (0.8)
     mocha (1.5.0)
       metaclass (~> 0.0.1)
-    msgpack (1.2.6)
+    msgpack (1.2.9)
     multi_json (1.13.1)
     mustache (1.1.0)
-    packaging (0.99.21)
+    optimist (3.0.0)
+    packaging (0.99.24)
       artifactory (~> 2)
       rake (~> 12.3)
-    parallel (1.12.1)
-    parser (2.5.3.0)
+    parallel (1.14.0)
+    parser (2.6.2.0)
       ast (~> 2.4.0)
     powerpack (0.1.2)
     pry (0.12.2)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     public_suffix (3.0.3)
-    puppet-resource_api (1.6.2)
+    puppet-resource_api (1.8.1)
       hocon (>= 1.0)
-    puppetserver-ca (1.2.1)
+    puppetserver-ca (1.3.1)
       facter (>= 2.0.1, < 4)
     racc (1.4.9)
     rainbow (2.2.2)
@@ -107,17 +108,16 @@ GEM
       rubocop (~> 0.49.0)
     ruby-prof (0.17.0)
     ruby-progressbar (1.10.0)
-    safe_yaml (1.0.4)
+    safe_yaml (1.0.5)
     semantic_puppet (1.0.2)
     text (1.3.1)
-    trollop (2.9.9)
-    unicode-display_width (1.4.1)
+    unicode-display_width (1.5.0)
     vcr (2.9.3)
     webmock (1.24.6)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff
-    yard (0.9.16)
+    yard (0.9.18)
 
 PLATFORMS
   ruby

data/lib/puppet.rb

@@ -138,14 +138,14 @@ module Puppet
   # @api public
   # @param args [Array<String>] the command line arguments to use for initialization
   # @return [void]
-  def self.initialize_settings(args = [])
-    do_initialize_settings_for_run_mode(:user, args)
+  def self.initialize_settings(args = [], require_config = true)
+    do_initialize_settings_for_run_mode(:user, args, require_config)
   end
 
   # private helper method to provide the implementation details of initializing for a run mode,
   #  but allowing us to control where the deprecation warning is issued
-  def self.do_initialize_settings_for_run_mode(run_mode, args)
-    Puppet.settings.initialize_global_settings(args)
+  def self.do_initialize_settings_for_run_mode(run_mode, args, require_config = true)
+    Puppet.settings.initialize_global_settings(args, require_config)
     run_mode = Puppet::Util::RunMode[run_mode]
     Puppet.settings.initialize_app_defaults(Puppet::Settings.app_defaults_for_run_mode(run_mode))
     Puppet.push_context(Puppet.base_context(Puppet.settings), "Initial context after settings initialization")

data/lib/puppet/application.rb

@@ -425,7 +425,7 @@ class Application
       Puppet::Util::Log.newdestination(arg)
       options[:setdest] = true
     rescue => detail
-      Puppet.log_exception(detail)
+      Puppet.log_and_raise(detail, _("Could not set logdest to %{dest}.") % { dest: arg })
     end
   end
 

data/lib/puppet/application/filebucket.rb

@@ -107,8 +107,13 @@ configuration options can also be generated by running puppet with
   information and the bucket located at the '$bucketdir' setting
   by default.
 
+* --server_list:
+  A list of comma seperated servers; only the first entry is used for file storage.
+  This setting takes precidence over `server`.
+
 * --server:
-  The server to send the file to, instead of locally.
+  The server to use for file storage. This setting is only used if `server_list`
+  is not set.
 
 * --todate:
   (list only) Select bucket files until 'todate'.

data/lib/puppet/configurer.rb

@@ -226,13 +226,13 @@ class Puppet::Configurer
         # mode. We shouldn't try to do any failover in that case.
         if options[:catalog].nil? && do_failover
           server, port = find_functional_server
+          if server.nil?
+            raise Puppet::Error, _("Could not select a functional puppet master from server_list: '%{server_list}'") % { server_list: Puppet[:server_list] }
+          else
+            Puppet.debug _("Selected puppet server: %{server}:%{port}") % { server: server, port: port }
+            report.master_used = "#{server}:#{port}"
+          end
           Puppet.override(server: server, serverport: port) do
-            if server
-              Puppet.debug _("Selected puppet server: %{server}:%{port}") % { server: server, port: port }
-              report.master_used = "#{server}:#{port}"
-            else
-              Puppet.warning _("Could not select a functional puppet server")
-            end
             completed = run_internal(options)
           end
         else

data/lib/puppet/confine/boolean.rb

@@ -0,0 +1,45 @@
+require 'puppet/confine'
+
+# Common module for the Boolean confines. It currently
+# contains just enough code to implement PUP-9336.
+class Puppet::Confine
+  module Boolean
+    # Returns the passing value for the Boolean confine.
+    def passing_value
+      raise NotImplementedError, "The Boolean confine %{confine} must provide the passing value." % { confine: self.class.name }
+    end
+
+    # The Boolean confines 'true' and 'false' let the user specify
+    # two types of values:
+    #     * A lambda for lazy evaluation. This would be something like
+    #         confine :true => lambda { true }
+    #
+    #     * A single Boolean value, or an array of Boolean values. This would
+    #     be something like
+    #         confine :true => true OR confine :true => [true, false, false, true]
+    #
+    # This override distinguishes between the two cases.
+    def values
+      # Note that Puppet::Confine's constructor ensures that @values
+      # will always be an array, even if a lambda's passed in. This is
+      # why we have the length == 1 check.
+      unless @values.length == 1 && @values.first.respond_to?(:call)
+        return @values
+      end
+
+      # We have a lambda. Here, we want to enforce "cache positive"
+      # behavior, which is to cache the result _if_ it evaluates to
+      # the passing value (i.e. the class name).
+
+      return @cached_value unless @cached_value.nil?
+
+      # Double negate to coerce the value into a Boolean
+      calculated_value = !! @values.first.call
+      if calculated_value == passing_value
+        @cached_value = [calculated_value]
+      end
+
+      [calculated_value]
+    end
+  end
+end

data/lib/puppet/confine/false.rb

@@ -1,6 +1,12 @@
-require 'puppet/confine'
+require 'puppet/confine/boolean'
 
 class Puppet::Confine::False < Puppet::Confine
+  include Puppet::Confine::Boolean
+
+  def passing_value
+    false
+  end
+
   def self.summarize(confines)
     confines.inject(0) { |count, confine| count + confine.summary }
   end

data/lib/puppet/confine/true.rb

@@ -1,6 +1,12 @@
-require 'puppet/confine'
+require 'puppet/confine/boolean'
 
 class Puppet::Confine::True < Puppet::Confine
+  include Puppet::Confine::Boolean
+
+  def passing_value
+    true
+  end
+
   def self.summarize(confines)
     confines.inject(0) { |count, confine| count + confine.summary }
   end

data/lib/puppet/defaults.rb

@@ -922,21 +922,21 @@ EOT
           Whether certificate revocation checking should be enabled, and what level of
           checking should be performed.
 
-          When certificate revocation is enabled Puppet expects the contents of its CRL
-          to be one or more PEM encoded CRLs concatenated together. When using a cert
-          bundle CRLs for all CAs in the chain of trust must be included in the crl file
-          with the first CRL listed being for the root of the chain, the last being for
-          the leaf CA.
+          When certificate revocation is enabled, Puppet expects the contents of its CRL
+          to be one or more PEM-encoded CRLs concatenated together. When using a cert
+          bundle, CRLs for all CAs in the chain of trust must be included in the crl file.
+          The chain should be ordered from least to most authoritative, with the first CRL
+          listed being for the root of the chain and the last being for the leaf CA.
 
-          When certificate_revocation is set to 'true' or 'chain', Puppet will ensure
+          When certificate_revocation is set to 'true' or 'chain', Puppet ensures
           that each CA in the chain of trust has not been revoked by its issuing CA.
 
-          When certificate_revocation is set to 'leaf', Puppet will verify certs against
-          the issuing CA's revocation list but not verify the revocation status of the
-          issuing CA or any CA above it within the chain of trust.
+          When certificate_revocation is set to 'leaf', Puppet verifies certs against
+          the issuing CA's revocation list, but it does not verify the revocation status
+          of the issuing CA or any CA above it within the chain of trust.
 
-          When certificate_revocation is set to 'false', Puppet will disable all
-          certificate revocation checking and will not attempt to download the CRL.
+          When certificate_revocation is set to 'false', Puppet disables all
+          certificate revocation checking and does not attempt to download the CRL.
         EOT
     },
     :digest_algorithm => {
@@ -1452,30 +1452,12 @@ EOT
     :server => {
       :default => "puppet",
       :desc => "The puppet master server to which the puppet agent should connect.",
-      :call_hook => :on_initialize_and_write,
-      :hook => proc { |value|
-        if Puppet.settings.set_by_config?(:server) && Puppet.settings.set_by_config?(:server_list)
-          #TRANSLATOR 'server' and 'server_list' are setting names and should not be translated
-          message = _('Attempted to set both server and server_list.')
-          message += ' ' + _('Server setting will not be used.')
-          Puppet.deprecation_warning(message, :SERVER_DUPLICATION)
-        end
-      }
     },
     :server_list => {
       :default => [],
       :type => :server_list,
       :desc => "The list of puppet master servers to which the puppet agent should connect,
         in the order that they will be tried.",
-      :call_hook => :on_initialize_and_write,
-      :hook => proc { |value|
-        if Puppet.settings.set_by_config?(:server) && Puppet.settings.set_by_config?(:server_list)
-          #TRANSLATOR 'server' and 'server_list' are setting names and should not be translated
-          message = _('Attempted to set both server and server_list.')
-          message += ' ' + _('Server setting will not be used.')
-          Puppet.deprecation_warning(message, :SERVER_DUPLICATION)
-        end
-      }
     },
     :use_srv_records => {
       :default    => false,
@@ -1948,6 +1930,16 @@ EOT
       referencing variables that are explicitly set to undef).
     EOT
     },
+   :func3x_check => {
+     :default => true,
+     :type => :boolean,
+     :desc => <<-'EOT'
+       Causes validation of loaded legacy Ruby functions (3x API) to raise errors about illegal constructs that
+       could cause harm or that simply does not work. This flag is on by default. This flag is made available
+       so that the validation can be turned off in case the method of validation is faulty - if encountered, please
+       file a bug report.
+     EOT
+     },
   :tasks => {
     :default => false,
     :type => :boolean,

data/lib/puppet/functions/call.rb

@@ -69,7 +69,8 @@ Puppet::Functions.create_function(:call, Puppet::Functions::InternalFunction) do
   end
 
   def call_impl_block(scope, function_name, *args, &block)
-    call_function_with_scope(scope, function_name, *args, &block)
+    # The call function must be able to call functions loaded by any loader visible from the calling scope.
+    Puppet::Pops::Parser::EvaluatingParser.new.evaluator.external_call_function(function_name, args, scope, &block)
   end
 
   def call_deferred(scope, deferred)

data/lib/puppet/network/http/connection.rb

@@ -298,12 +298,22 @@ module Puppet::Network::HTTP
     def execute_request(connection, request)
       start = Time.now
       connection.request(request)
-    rescue EOFError => e
+    rescue => exception
       elapsed = (Time.now - start).to_f.round(3)
-      uri = @site.addr + request.path.split('?')[0]
-      eof = EOFError.new(_('request %{uri} interrupted after %{elapsed} seconds') % {uri: uri, elapsed: elapsed})
-      eof.set_backtrace(e.backtrace) unless e.backtrace.empty?
-      raise eof
+      uri = [@site.addr, request.path.split('?')[0]].join('/')
+      eclass = exception.class
+
+      err = case exception
+            when EOFError
+              eclass.new(_('request %{uri} interrupted after %{elapsed} seconds') % {uri: uri, elapsed: elapsed})
+            when Timeout::Error
+              eclass.new(_('request %{uri} timed out after %{elapsed} seconds') % {uri: uri, elapsed: elapsed})
+            else
+              eclass.new(_('request %{uri} failed: %{msg}') % {uri: uri, msg: exception.message})
+            end
+
+      err.set_backtrace(exception.backtrace) unless exception.backtrace.empty?
+      raise err
     end
 
     def with_connection(site, &block)

data/lib/puppet/pops/issues.rb

@@ -760,6 +760,10 @@ module Issues
     _("An escape char for @() may only appear once. Got '%{escapes}'") % { escapes: escapes.join(', ') }
   end
 
+  HEREDOC_DIRTY_MARGIN = hard_issue :HEREDOC_DIRTY_MARGIN, :heredoc_line do
+    _("Heredoc with text in the margin is not allowed (line %{heredoc_line} in this heredoc)") % { heredoc_line: heredoc_line }
+  end
+
   ILLEGAL_BOM = hard_issue :ILLEGAL_BOM, :format_name, :bytes do
     _("Illegal %{format} Byte Order mark at beginning of input: %{bom} - remove these from the puppet source") % { format: format_name, bom: bytes }
   end

data/lib/puppet/pops/loader/ruby_legacy_function_instantiator.rb

@@ -1,7 +1,10 @@
 # The RubyLegacyFunctionInstantiator instantiates a Puppet::Functions::Function given the ruby source
 # that calls Puppet::Functions.create_function.
 #
+require 'ripper'
 class Puppet::Pops::Loader::RubyLegacyFunctionInstantiator
+  UNKNOWN = '<unknown>'.freeze
+
   # Produces an instance of the Function class with the given typed_name, or fails with an error if the
   # given ruby source does not produce this instance when evaluated.
   #
@@ -13,9 +16,15 @@ class Puppet::Pops::Loader::RubyLegacyFunctionInstantiator
   # @return [Puppet::Pops::Functions.Function] - an instantiated function with global scope closure associated with the given loader
   #
   def self.create(loader, typed_name, source_ref, ruby_code_string)
-    unless ruby_code_string.is_a?(String) && ruby_code_string =~ /Puppet\:\:Parser\:\:Functions.*newfunction/m
-      raise ArgumentError, _("The code loaded from %{source_ref} does not seem to be a Puppet 3x API function - no 'newfunction' call.") % { source_ref: source_ref }
+    # When func3x turned on, assert content by parsing, when turned off continue with (legacy) undefined behavior
+    if Puppet[:func3x_check]
+      assertion_result = []
+      assert_code(ruby_code_string, assertion_result)
+      unless ruby_code_string.is_a?(String) && assertion_result.include?(:found_newfunction)
+        raise ArgumentError, _("The code loaded from %{source_ref} does not seem to be a Puppet 3x API function - no 'newfunction' call.") % { source_ref: source_ref }
+      end
     end
+
     # make the private loader available in a binding to allow it to be passed on
     loader_for_function = loader.private_loader
     here = get_binding(loader_for_function)
@@ -26,14 +35,14 @@ class Puppet::Pops::Loader::RubyLegacyFunctionInstantiator
     environment = Puppet.lookup(:current_environment)
     func_info = Puppet::Parser::Functions.environment_module(environment).get_function_info(typed_name.name.to_sym)
     if func_info.nil?
-      # This will to do the 3x loading and define the "function_<name>" and "real_function_<name>" methods
+      # This will do the 3x loading and define the "function_<name>" and "real_function_<name>" methods
       # in the anonymous module used to hold function definitions.
       #
       func_info = eval(ruby_code_string, here, source_ref, 1)
 
       # Validate what was loaded
       unless func_info.is_a?(Hash)
-        # TRANSLATORS - the word 'newfunction' shoud not be translated as it is a method name.
+        # TRANSLATORS - the word 'newfunction' should not be translated as it is a method name.
         raise ArgumentError, _("Illegal legacy function definition! The code loaded from %{source_ref} did not return the result of calling 'newfunction'. Got '%{klass}'") % { source_ref: source_ref, klass: func_info.class }
       end
       unless func_info[:name] == "function_#{typed_name.name()}"
@@ -60,4 +69,51 @@ class Puppet::Pops::Loader::RubyLegacyFunctionInstantiator
     binding
   end
   private_class_method :get_binding
+
+  def self.assert_code(code_string, result)
+    ripped = Ripper.sexp(code_string)
+    return if ripped.nil?  # Let the next real parse crash and tell where and what is wrong
+    ripped.each {|x| walk(x, result) }
+  end
+  private_class_method :assert_code
+
+  def self.walk(x, result)
+    return unless x.is_a?(Array)
+    first = x[0]
+    case first
+    when :fcall, :call
+      # Ripper returns a :fcall for a function call in a module (want to know there is a call to newfunction()).
+      # And it returns :call for a qualified named call
+      identity_part = find_identity(x)
+      result << :found_newfunction if identity_part.is_a?(Array) && identity_part[1] == 'newfunction'
+    when :def, :defs
+      # There should not be any calls to def in a 3x function
+      mname, mline = extract_name_line(find_identity(x))
+      raise SecurityError, _("Illegal method definition of method '%{method_name}' on line %{line}' in legacy function. See %{url} for more information") % { 
+        method_name: mname,
+        line: mline,
+        url: "https://puppet.com/docs/puppet/latest/functions_refactor_legacy.html"
+      }
+    end
+    x.each {|v| walk(v, result) }
+  end
+  private_class_method :walk
+
+  def self.find_identity(rast)
+    rast.find{|x| x.is_a?(Array) && x[0] == :@ident }
+  end
+  private_class_method :find_identity
+
+  # Extracts the method name and line number from the Ripper Rast for an id entry.
+  # The expected input (a result from Ripper :@ident entry) is an array with:
+  # [0] == :def (or :defs for self.def)
+  # [1] == method name
+  # [2] == [ <filename>, <linenumber> ]
+  #
+  # Returns an Array; a tuple with method name and line number or "<unknown>" if either is missing, or format is not the expected
+  #
+  def self.extract_name_line(x)
+    (x.is_a?(Array) ? [ x[1], x[2].is_a?(Array) ? x[2][1] : nil] : [nil, nil]).map {|v| v.nil? ? UNKNOWN : v }
+  end
+  private_class_method :extract_name_line
 end