puppet 7.12.1 → 7.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c9a5ad10d1fe29d4c28a410c34cc28236cc3a678444e72cdbcbd824ead10f99
-  data.tar.gz: 104352f3f069d1f9043dc386f035f0c18da3bbc09f1715092b682a6508b97842
+  metadata.gz: 45045b95a6ecb2a310d7114e78c48e812cbaa18e396eba63a399b3f6221e947e
+  data.tar.gz: 9196874c694b632b984fd0fc7b2304a2a2b6551328cbb81d62f664c282bd0ba9
 SHA512:
-  metadata.gz: 45dcb3ec19cc2b62b3a642a3adbe3697a08eee3f6f79158b30e4b32dfecc4eb908f4d0c7a22958606b2cf3ba4cfefc93f17108b1ec159e49bdb4ed18540538aa
-  data.tar.gz: d5efd563f4a3bd518883d6ed8b8721cff49b81b9f0ccc0a382bb3e96ac4262ebbfe6535a12451f6d6a4ff61399cc5e79aeb64e13832443998dba2fa0fb2702ba
+  metadata.gz: e318a7303b592cb3b2cd0dd26c5e7b8ea57ab410aa79bd77c06acf60509d6f2fb5a55bf4fbea9aeeb8e4f660dd3f3c2c65062b3f0a0a3ba806c713264140b24a
+  data.tar.gz: e23422e5834aa7eedbc7e25bcaaf04d9ca3a48604c94d2c84085348cc1c41aad33299e0de3a247f9769222ba7d67b55de0deeab96037245b3214ef903d8bbbaa

data/Gemfile

@@ -3,7 +3,7 @@ source ENV['GEM_SOURCE'] || "https://rubygems.org"
 gemspec
 
 def location_for(place, fake_version = nil)
-  if place.is_a?(String) && place =~ /^(git[:@][^#]*)#(.*)/
+  if place.is_a?(String) && place =~ /^((?:git[:@]|https:)[^#]*)#(.*)/
     [fake_version, { git: $1, branch: $2, require: false }].compact
   elsif place.is_a?(String) && place =~ /^file:\/\/(.*)/
     ['>= 0', { path: File.expand_path($1), require: false }]

data/Gemfile.lock

@@ -1,9 +1,10 @@
 GIT
-  remote: git://github.com/puppetlabs/packaging
-  revision: 4c5359786cad0d12877e10e98948065bfeb3e304
+  remote: https://github.com/puppetlabs/packaging
+  revision: 98613aaebad419700b4c37163fe3bbc612f2239d
   branch: 1.0.x
   specs:
-    packaging (0.103.0)
+    packaging (0.104.0.4.g98613aa)
+      apt_stage_artifacts
       artifactory (~> 2)
       csv (= 3.1.5)
       rake (>= 12.3)
@@ -12,12 +13,12 @@ GIT
 PATH
   remote: .
   specs:
-    puppet (7.12.1)
+    puppet (7.13.1)
       CFPropertyList (~> 2.2)
       concurrent-ruby (~> 1.0)
       deep_merge (~> 1.0)
       facter (>= 2.4.0, < 5)
-      fast_gettext (~> 1.1)
+      fast_gettext (>= 1.1, < 3)
       hiera (>= 3.2.1, < 4)
       locale (~> 2.1)
       multi_json (~> 1.13)
@@ -30,6 +31,8 @@ GEM
     CFPropertyList (2.3.6)
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
+    apt_stage_artifacts (0.10.1)
+      docopt
     artifactory (2.8.2)
     ast (2.4.2)
     coderay (1.1.3)
@@ -87,7 +90,7 @@ GEM
       rake
     rake (13.0.6)
     rdiscount (2.2.0.2)
-    rdoc (6.3.2)
+    rdoc (6.3.3)
     release-metrics (1.1.0)
       csv
       docopt
@@ -111,7 +114,7 @@ GEM
     rspec-mocks (3.10.2)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
-    rspec-support (3.10.2)
+    rspec-support (3.10.3)
     rubocop (0.49.1)
       parallel (~> 1.10)
       parser (>= 2.3.3.1, < 3.0)
@@ -133,7 +136,9 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    yard (0.9.26)
+    webrick (1.7.0)
+    yard (0.9.27)
+      webrick (~> 1.7.0)
 
 PLATFORMS
   ruby

data/ext/project_data.yaml

@@ -21,7 +21,7 @@ gem_runtime_dependencies:
   facter: ['> 2.0.1', '< 5']
   hiera: ['>= 3.2.1', '< 4']
   semantic_puppet: '~> 1.0'
-  fast_gettext: '~> 1.1'
+  fast_gettext: ['>= 1.1', '< 3']
   locale: '~> 2.1'
   multi_json: '~> 1.10'
   puppet-resource_api: '~>1.5'

data/lib/puppet/application/lookup.rb

@@ -7,6 +7,7 @@ class Puppet::Application::Lookup < Puppet::Application
 
   RUN_HELP = _("Run 'puppet lookup --help' for more details").freeze
   DEEP_MERGE_OPTIONS = '--knock-out-prefix, --sort-merged-arrays, and --merge-hash-arrays'.freeze
+  TRUSTED_INFORMATION_FACTS = ["hostname", "domain", "fqdn", "clientcert"].freeze
 
   run_mode :server
 
@@ -54,11 +55,7 @@ class Puppet::Application::Lookup < Puppet::Application
   end
 
   option('--facts FACT_FILE') do |arg|
-    if %w{.yaml .yml .json}.include?(arg.match(/\.[^.]*$/)[0])
-      options[:fact_file] = arg
-    else
-      raise _("The --fact file only accepts yaml and json files.\n%{run_help}") % { run_help: RUN_HELP }
-    end
+    options[:fact_file] = arg
   end
 
   def app_defaults
@@ -137,7 +134,9 @@ DESCRIPTION
 The lookup command is a CLI for Puppet's 'lookup()' function. It searches your
 Hiera data and returns a value for the requested lookup key, so you can test and
 explore your data. It is a modern replacement for the 'hiera' command.
-
+Lookup uses the setting for global hiera.yaml from puppet's config,
+and the environment to find the environment level hiera.yaml as well as the
+resulting modulepath for the environment (for hiera.yaml files in modules).
 Hiera usually relies on a node's facts to locate the relevant data sources. By
 default, 'puppet lookup' uses facts from the node you run the command on, but
 you can get data for any other node with the '--node <NAME>' option. If
@@ -186,7 +185,8 @@ OPTIONS
 * --environment <ENV>
   Like with most Puppet commands, you can specify an environment on the command
   line. This is important for lookup because different environments can have
-  different Hiera data.
+  different Hiera data. This environment will be always be the one used regardless
+  of any other factors.
 
 * --merge first|unique|hash|deep:
   Specify the merge behavior, overriding any merge behavior from the data's
@@ -237,6 +237,13 @@ EXAMPLE
   To look up 'key_name' using the Puppet Server node's facts:
   $ puppet lookup key_name
 
+  To look up 'key_name' using the Puppet Server node's arbitrary variables from a manifest, and 
+  classify the node if applicable:
+  $ puppet lookup key_name --compile
+
+  To look up 'key_name' using the Puppet Server node's facts, overridden by facts given in a file:
+  $ puppet lookup key_name --facts fact_file.yaml
+
   To look up 'key_name' with agent.local's facts:
   $ puppet lookup --node agent.local key_name
 
@@ -341,31 +348,60 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
       Puppet.settings[:facts_terminus] = 'facter'
     end
 
-    unless node.is_a?(Puppet::Node) # to allow unit tests to pass a node instance
-      ni = Puppet::Node.indirection
-      tc = ni.terminus_class
-      if tc == :plain || options[:compile]
-        node = ni.find(node)
-      else
-        ni.terminus_class = :plain
-        node = ni.find(node)
-        ni.terminus_class = tc
-      end
-    end
-
     fact_file = options[:fact_file]
 
     if fact_file
-      if fact_file.end_with?("json")
-        given_facts = Puppet::Util::Json.load(Puppet::FileSystem.read(fact_file, :encoding => 'utf-8'))
-      else
+      if fact_file.end_with?('.json')
+        given_facts = Puppet::Util::Json.load_file(fact_file)
+      elsif fact_file.end_with?('.yml', '.yaml')
         given_facts = Puppet::Util::Yaml.safe_load_file(fact_file)
+      else
+        given_facts = Puppet::Util::Json.load_file_if_valid(fact_file)
+        given_facts = Puppet::Util::Yaml.safe_load_file_if_valid(fact_file) unless given_facts
       end
 
       unless given_facts.instance_of?(Hash)
-        raise _("Incorrect formatted data in %{fact_file} given via the --facts flag") % { fact_file: fact_file }
+        raise _("Incorrectly formatted data in %{fact_file} given via the --facts flag (only accepts yaml and json files)") % { fact_file: fact_file }
+      end
+
+      if TRUSTED_INFORMATION_FACTS.any? { |key| given_facts.key? key }
+        unless TRUSTED_INFORMATION_FACTS.all? { |key| given_facts.key? key }
+          raise _("When overriding any of the %{trusted_facts_list} facts with %{fact_file} "\
+            "given via the --facts flag, they must all be overridden.") % { fact_file: fact_file ,trusted_facts_list: TRUSTED_INFORMATION_FACTS.join(',')}
+        end
       end
-      node.add_extra_facts(given_facts)
+    end
+
+    unless node.is_a?(Puppet::Node) # to allow unit tests to pass a node instance
+      facts = retrieve_node_facts(node, given_facts) 
+      if Puppet.settings.set_by_cli?('environment')
+        node = Puppet::Node.new(node, :classes => nil, :parameters => nil, :facts => facts, :environment => Puppet.settings.value('environment'))
+      else
+        ni = Puppet::Node.indirection
+        tc = ni.terminus_class
+
+        service = Puppet.runtime[:http]
+        session = service.create_session
+        cert = session.route_to(:ca)
+
+        _, x509 = cert.get_certificate(node)
+        cert = OpenSSL::X509::Certificate.new(x509)
+
+        Puppet::SSL::Oids.register_puppet_oids
+        trusted = Puppet::Context::TrustedInformation.remote(true, facts.values['certname'] || node, Puppet::SSL::Certificate.from_instance(cert))
+
+        Puppet.override(trusted_information: trusted) do
+          if tc == :plain || options[:compile]
+            node = ni.find(node, facts: facts)
+          else
+            ni.terminus_class = :plain
+            node = ni.find(node, facts: facts)
+            ni.terminus_class = tc
+          end
+        end
+      end
+    else
+      node.add_extra_facts(given_facts) if given_facts
     end
 
     Puppet[:code] = 'undef' unless options[:compile]
@@ -378,4 +414,16 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
       compiler.compile { |catalog| yield(compiler.topscope); catalog }
     end
   end
+
+  def retrieve_node_facts(node, given_facts)
+    facts = Puppet::Node::Facts.indirection.find(node, :environment => Puppet.lookup(:current_environment))
+
+    facts = Puppet::Node::Facts.new(node, {}) if facts.nil?
+    facts.add_extra_values(given_facts) if given_facts
+
+    if facts.values.empty?
+      raise _("No facts available for target node: %{node}") % { node: node}
+    end
+    facts
+  end
 end

data/lib/puppet/concurrent/thread_local_singleton.rb

@@ -5,10 +5,12 @@ module Puppet
       def singleton
         key = (name + ".singleton").intern
         thread = Thread.current
-        unless thread.thread_variable?(key)
-          thread.thread_variable_set(key, new)
+        value = thread.thread_variable_get(key)
+        if value.nil?
+          value = new
+          thread.thread_variable_set(key, value)
         end
-        thread.thread_variable_get(key)
+        value
       end
     end
   end

data/lib/puppet/defaults.rb

@@ -1983,7 +1983,9 @@ EOT
       :call_hook => :on_initialize_and_write, # Call our hook with the default value, so we always get the value added to facter.
       :hook => proc do |value|
         paths = value.split(File::PATH_SEPARATOR)
-        Puppet.runtime[:facter].search(*paths)
+        facter = Puppet.runtime[:facter]
+        facter.reset
+        facter.search(*paths)
       end
     }
   )

data/lib/puppet/file_serving/metadata.rb

@@ -118,6 +118,9 @@ class Puppet::FileServing::Metadata < Puppet::FileServing::Base
     when "link"
       @destination = Puppet::FileSystem.readlink(real_path)
       @checksum = ("{#{@checksum_type}}") + send("#{@checksum_type}_file", real_path).to_s rescue nil
+    when "fifo", "socket"
+      @checksum_type = "none"
+      @checksum = ("{#{@checksum_type}}") + send("#{@checksum_type}_file", real_path).to_s
     else
       raise ArgumentError, _("Cannot manage files of type %{file_type}") % { file_type: stat.ftype }
     end

data/lib/puppet/file_system/file_impl.rb

@@ -130,23 +130,23 @@ class Puppet::FileSystem::FileImpl
   end
 
   def symlink?(path)
-    File.symlink?(path)
+    ::File.symlink?(path)
   end
 
   def readlink(path)
-    File.readlink(path)
+    ::File.readlink(path)
   end
 
   def unlink(*paths)
-    File.unlink(*paths)
+    ::File.unlink(*paths)
   end
 
   def stat(path)
-    File.stat(path)
+    ::File.stat(path)
   end
 
   def lstat(path)
-    File.lstat(path)
+    ::File.lstat(path)
   end
 
   def compare_stream(path, stream)
@@ -159,7 +159,7 @@ class Puppet::FileSystem::FileImpl
 
   def replace_file(path, mode = nil)
     begin
-      stat = Puppet::FileSystem.lstat(path)
+      stat = lstat(path)
       gid = stat.gid
       uid = stat.uid
       mode ||= stat.mode & 07777
@@ -180,7 +180,7 @@ class Puppet::FileSystem::FileImpl
       tempfile_path = tempfile.path
       FileUtils.chown(uid, gid, tempfile_path) if uid && gid
       chmod(mode, tempfile_path)
-      File.rename(tempfile_path, Puppet::FileSystem.path_string(path))
+      ::File.rename(tempfile_path, path_string(path))
     ensure
       tempfile.close!
     end

data/lib/puppet/file_system/jruby.rb

@@ -14,7 +14,7 @@ class Puppet::FileSystem::JRuby < Puppet::FileSystem::Posix
   def replace_file(path, mode = nil, &block)
     # MRI Ruby rename checks if destination is a directory and raises, while
     # JRuby removes the directory and replaces the file.
-    if Puppet::FileSystem.directory?(path)
+    if directory?(path)
       raise Errno::EISDIR, _("Is a directory: %{directory}") % { directory: path }
     end
 

data/lib/puppet/file_system/path_pattern.rb

@@ -5,10 +5,9 @@ module Puppet::FileSystem
   class PathPattern
     class InvalidPattern < Puppet::Error; end
 
-    TRAVERSAL = /^\.\.$/
+    DOTDOT = '..'.freeze
     ABSOLUTE_UNIX = /^\//
     ABSOLUTE_WINDOWS = /^[a-z]:/i
-    #ABSOLUT_VODKA #notappearinginthisclass
     CURRENT_DRIVE_RELATIVE_WINDOWS = /^\\/
 
     def self.relative(pattern)
@@ -32,11 +31,11 @@ module Puppet::FileSystem
     end
 
     def glob
-      Dir.glob(pathname.to_s)
+      Dir.glob(@pathstr)
     end
 
     def to_s
-      pathname.to_s
+      @pathstr
     end
 
     protected
@@ -46,13 +45,9 @@ module Puppet::FileSystem
     private
 
     def validate
-      @pathname.each_filename do |e|
-        if e =~ TRAVERSAL
-          raise(InvalidPattern, _("PathPatterns cannot be created with directory traversals."))
-        end
-      end
-      case @pathname.to_s
-      when CURRENT_DRIVE_RELATIVE_WINDOWS
+      if @pathstr.split(Pathname::SEPARATOR_PAT).any? { |f| f == DOTDOT }
+        raise(InvalidPattern, _("PathPatterns cannot be created with directory traversals."))
+      elsif @pathstr.match?(CURRENT_DRIVE_RELATIVE_WINDOWS)
         raise(InvalidPattern, _("A PathPattern cannot be a Windows current drive relative path."))
       end
     end
@@ -60,6 +55,7 @@ module Puppet::FileSystem
     def initialize(pattern)
       begin
         @pathname = Pathname.new(pattern.strip)
+        @pathstr = @pathname.to_s
       rescue ArgumentError => error
         raise InvalidPattern.new(_("PathPatterns cannot be created with a zero byte."), error)
       end
@@ -74,10 +70,9 @@ module Puppet::FileSystem
 
     def validate
       super
-      case @pathname.to_s
-      when ABSOLUTE_WINDOWS
+      if @pathstr.match?(ABSOLUTE_WINDOWS)
         raise(InvalidPattern, _("A relative PathPattern cannot be prefixed with a drive."))
-      when ABSOLUTE_UNIX
+      elsif @pathstr.match?(ABSOLUTE_UNIX)
         raise(InvalidPattern, _("A relative PathPattern cannot be an absolute path."))
       end
     end
@@ -90,7 +85,7 @@ module Puppet::FileSystem
 
     def validate
       super
-      if @pathname.to_s !~ ABSOLUTE_UNIX and @pathname.to_s !~ ABSOLUTE_WINDOWS
+      if !@pathstr.match?(ABSOLUTE_UNIX) && !@pathstr.match?(ABSOLUTE_WINDOWS)
         raise(InvalidPattern, _("An absolute PathPattern cannot be a relative path."))
       end
     end

data/lib/puppet/file_system/uniquefile.rb

@@ -127,7 +127,7 @@ class Puppet::FileSystem::Uniquefile < DelegateClass(File)
     tmpdir ||= tmpdir()
     n = nil
     begin
-      path = File.expand_path(make_tmpname(basename, n), tmpdir)
+      path = File.join(tmpdir, make_tmpname(basename, n))
       yield(path, n, *opts)
     rescue Errno::EEXIST
       n ||= 0

data/lib/puppet/file_system/windows.rb

@@ -123,7 +123,7 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
   LOCK_VIOLATION = 33
 
   def replace_file(path, mode = nil)
-    if Puppet::FileSystem.directory?(path)
+    if directory?(path)
       raise Errno::EISDIR, _("Is a directory: %{directory}") % { directory: path }
     end
 
@@ -159,14 +159,14 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
       end
 
       set_dacl(tempfile.path, dacl) if dacl
-      File.rename(tempfile.path, Puppet::FileSystem.path_string(path))
+      ::File.rename(tempfile.path, path_string(path))
     ensure
       tempfile.close!
     end
   rescue Puppet::Util::Windows::Error => e
     case e.code
     when ACCESS_DENIED, SHARING_VIOLATION, LOCK_VIOLATION
-      raise Errno::EACCES.new(Puppet::FileSystem.path_string(path), e)
+      raise Errno::EACCES.new(path_string(path), e)
     else
       raise SystemCallError.new(e.message)
     end
@@ -193,7 +193,7 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
   end
 
   def get_dacl_from_file(path)
-    sd = Puppet::Util::Windows::Security.get_security_descriptor(Puppet::FileSystem.path_string(path))
+    sd = Puppet::Util::Windows::Security.get_security_descriptor(path_string(path))
     sd.dacl
   rescue Puppet::Util::Windows::Error => e
     raise e unless e.code == FILE_NOT_FOUND

data/lib/puppet/file_system.rb

@@ -397,7 +397,7 @@ module Puppet::FileSystem
   # @api public
   #
   def self.chmod(mode, path)
-    @impl.chmod(mode, path)
+    @impl.chmod(mode, assert_path(path))
   end
 
   # Replace the contents of a file atomically, creating the file if necessary.

data/lib/puppet/functions/versioncmp.rb

@@ -8,6 +8,9 @@ require_relative '../../puppet/util/package'
 #
 # Where a and b are arbitrary version strings.
 #
+# Optional parameter ignore_trailing_zeroes is used to ignore unnecessary
+# trailing version numbers like .0 or .0.00
+#
 # This function returns:
 #
 # * `1` if version a is greater than version b
@@ -28,9 +31,10 @@ Puppet::Functions.create_function(:versioncmp) do
   dispatch :versioncmp do
     param 'String', :a
     param 'String', :b
+    optional_param 'Boolean', :ignore_trailing_zeroes
   end
 
-  def versioncmp(a, b)
-    Puppet::Util::Package.versioncmp(a, b)
+  def versioncmp(a, b, ignore_trailing_zeroes = false)
+    Puppet::Util::Package.versioncmp(a, b, ignore_trailing_zeroes)
   end
 end

data/lib/puppet/graph/simple_graph.rb

@@ -38,11 +38,12 @@ class Puppet::Graph::SimpleGraph
     @downstream_from.clear
   end
 
-  # Which resources depend upon the given resource.
+  # Which resources the given resource depends on.
   def dependencies(resource)
     vertex?(resource) ? upstream_from_vertex(resource).keys : []
   end
 
+  # Which resources depend upon the given resource.
   def dependents(resource)
     vertex?(resource) ? downstream_from_vertex(resource).keys : []
   end

data/lib/puppet/pops/parser/code_merger.rb

@@ -11,17 +11,17 @@ class Puppet::Pops::Parser::CodeMerger
     # PUP-5299, some sites have thousands of entries, and run out of stack when evaluating - the logic
     # below maps the logic as flatly as possible.
     #
-    children = parse_results.select {|x| !x.nil? && x.code}.reduce([]) do |memo, parsed_class|
+    children = parse_results.select {|x| !x.nil? && x.code}.flat_map do |parsed_class|
       case parsed_class.code
       when Puppet::Parser::AST::BlockExpression
         # the BlockExpression wraps a single 4x instruction that is most likely wrapped in a Factory
-        memo + parsed_class.code.children.map {|c| c.is_a?(Puppet::Pops::Model::Factory) ? c.model : c }
+        parsed_class.code.children.map {|c| c.is_a?(Puppet::Pops::Model::Factory) ? c.model : c }
       when Puppet::Pops::Model::Factory
         # If it is a 4x instruction wrapped in a Factory
-        memo + parsed_class.code.model
+        parsed_class.code.model
       else
         # It is the instruction directly
-        memo << parsed_class.code
+        parsed_class.code
       end
     end
     Puppet::Parser::AST::BlockExpression.new(:children => children)

data/lib/puppet/pops/parser/egrammar.ra

@@ -863,6 +863,8 @@ keyword
   | ATTR
   | FUNCTION
   | PRIVATE
+  | PLAN
+  | APPLY
 
 nil
   : { result = nil}