puppetserver-ca 2.4.0 → 2.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6df60141ee08a19cc170166263abff7028ee6085bf833981efad3458cef5ce26
-  data.tar.gz: 4da9da0d545605f13bd0dfa2a6272a301dfe46251d0277663e8d09e6d3f65a29
+  metadata.gz: 78b8703a01de06ec5c4a6202f8341662452f4d33d37c1390b558556ce817253d
+  data.tar.gz: eea0c603eee53c14a82de6b80f263014ca76261eb39fa2b679031ad6ecc69b1f
 SHA512:
-  metadata.gz: 15891316786fa4fcd63c3f86ac2f66051841fb3e680fe63e5d0d6ceb025241cc5c122ae1f3b2819c9b1063f7c1a166efd1ebd010b35921fb2c6f3fef2917da88
-  data.tar.gz: fee93fa98f038ab7eb660fe55ca466874221cb980e5794c8d32c7561a2dfa069cdc003046799b89ef99b0f6b7bc97b58928e788b1e057f5ef68362bd864c16c7
+  metadata.gz: 64ff93865e33b2dccd3f4308580278315d007b450611acdbb36631aabc9794d82b5f8973aa5872384f05146abe62dfa3290b5e3774f8816bafa4b70db7bf3fbc
+  data.tar.gz: 734dc57fa4e9f8ce390a966502ea8104cb7640aec4564759ca39c377fdaeb06ed8992fbab88dfa3ef5a2c24921e6400223e4bee2c902d0f4f92f676537f779c5

data/.github/workflows/mend.yaml

@@ -0,0 +1,37 @@
+name: mend_scan
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: checkout repo content
+      uses: actions/checkout@v2 # checkout the repository content to github runner.
+      with:
+        fetch-depth: 1
+    - name: setup ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: 2.7
+    - name: create lock
+      run: bundle lock
+    # install java
+    - uses: actions/setup-java@v3
+      with:
+        distribution: 'temurin' # See 'Supported distributions' for available options
+        java-version: '17'
+    # download mend
+    - name: download_mend
+      run: curl -o wss-unified-agent.jar https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar
+    - name: run mend
+      run: java -jar wss-unified-agent.jar
+      env:
+        WS_APIKEY: ${{ secrets.MEND_API_KEY }}
+        WS_WSS_URL: https://saas-eu.whitesourcesoftware.com/agent
+        WS_USERKEY: ${{ secrets.MEND_TOKEN }}
+        WS_PRODUCTNAME: Puppet Enterprise
+        WS_PROJECTNAME:  ${{ github.event.repository.name }}

data/.travis.yml

@@ -8,6 +8,8 @@ rvm:
   - 2.5
   - 2.6
   - 2.7
+  - 3.1
+  - 3.2
 before_install:
    gem install bundler -v 1.16.1 && (gem uninstall -v '>= 2' -i $(rvm gemdir)@global -ax bundler || true)
 script:

data/lib/puppetserver/ca/action/delete.rb

@@ -0,0 +1,286 @@
+require 'openssl'
+require 'optparse'
+require 'time'
+require 'puppetserver/ca/certificate_authority'
+require 'puppetserver/ca/config/puppet'
+require 'puppetserver/ca/errors'
+require 'puppetserver/ca/utils/cli_parsing'
+require 'puppetserver/ca/utils/file_system'
+require 'puppetserver/ca/utils/inventory'
+require 'puppetserver/ca/x509_loader'
+
+module Puppetserver
+  module Ca
+    module Action
+      class Delete
+        include Puppetserver::Ca::Utils
+
+        CERTNAME_BLOCKLIST = %w{--config --expired --revoked --all}
+
+        SUMMARY = 'Delete signed certificate(s) from disk'
+        BANNER = <<-BANNER
+Usage:
+  puppetserver ca delete [--help]
+  puppetserver ca delete [--config CONF] [--expired] [--revoked]
+                         [--certname NAME[,NAME]] [--all]
+
+Description:
+  Deletes signed certificates from disk. Once a certificate is
+  signed and delivered to a node, it no longer necessarily needs
+  to be stored on disk.
+
+Options:
+BANNER
+
+        def initialize(logger)
+          @logger = logger
+        end
+
+        def self.parser(parsed = {})
+          OptionParser.new do |opts|
+            opts.banner = BANNER
+            opts.on('--help', 'Display this command-specific help output') do |help|
+              parsed['help'] = true
+            end
+            opts.on('--config CONF', 'Path to puppet.conf') do |conf|
+              parsed['config'] = conf
+            end
+            opts.on('--expired', 'Delete expired signed certificates') do |expired|
+              parsed['expired'] = true
+            end
+            opts.on('--revoked', 'Delete signed certificates that have already been revoked') do |revoked|
+              parsed['revoked'] = true
+            end
+            opts.on('--certname NAME[,NAME]', Array,
+              'One or more comma-separated certnames for which to delete signed certificates') do |certs|
+              parsed['certname'] = [certs].flatten
+            end
+            opts.on('--all', 'Delete all signed certificates on disk') do |all|
+              parsed['all'] = true
+            end
+          end
+        end
+
+        def parse(args)
+          results = {}
+          parser = self.class.parser(results)
+
+          errors = CliParsing.parse_with_errors(parser, args)
+
+          if results['certname']
+            results['certname'].each do |certname|
+              if CERTNAME_BLOCKLIST.include?(certname)
+                errors << "    Cannot manage cert named `#{certname}` from "+
+                          "the CLI. If needed, use the HTTP API directly."
+              end
+            end
+          end
+
+          unless results['help'] || results['expired'] || results['revoked'] || results['certname'] || results['all']
+            errors << '  Must pass one of the valid flags to determine which certs to delete'
+          end
+
+          if results['all'] && (results['expired'] || results['revoked'] || results['certname'])
+            errors << '  The --all flag must not be used with --expired, --revoked, or --certname'
+          end
+
+          errors_were_handled = Errors.handle_with_usage(@logger, errors, parser.help)
+
+          exit_code = errors_were_handled ? 1 : nil
+          return results, exit_code
+        end
+
+        def run(args)
+          config = args['config']
+
+          # Validate the config path
+          if config
+            errors = FileSystem.validate_file_paths(config)
+            return 1 if Errors.handle_with_usage(@logger, errors)
+          end
+
+          # Validate puppet config setting
+          puppet = Config::Puppet.parse(config, @logger)
+          settings = puppet.settings
+          return 1 if Errors.handle_with_usage(@logger, puppet.errors)
+
+          # Validate that we are offline
+          return 1 if HttpClient.check_server_online(settings, @logger)
+
+          # Perform the desired action, keeping track if any errors occurred
+          errored = false
+          deleted_count = 0
+          cadir = settings[:cadir]
+          inventory_file_path = File.join(cadir, 'inventory.txt')
+
+          # Because --revoke has a potentially fatal error it can throw,
+          # process it first.
+          if args['revoked']
+            loader = X509Loader.new(settings[:cacert], settings[:cakey], settings[:cacrl])
+            verified_crls = loader.crls.select { |crl| crl.verify(loader.key) }
+            unless verified_crls.length == 1
+              @logger.err("Could not identify Puppet's CRL. Aborting delete action.")
+              return 1
+            end
+            crl = verified_crls.first
+
+            # First, search the inventory for the revoked serial. 
+            # If it matches the current serial for the cert, delete the cert.
+            # If it is an old serial for the certname, verify the file on disk
+            #   is not the serial that was revoked, and then ignore it. If the
+            #   file on disk does match that serial, delete it.
+            # If it isn't in the inventory, fall back to searching every cert on
+            #   disk for the given serial.
+            inventory, err = Inventory.parse_inventory_file(inventory_file_path, @logger)
+            revoked_serials = crl.revoked.map { |r| r.serial.to_i }
+            to_delete = []
+            revoked_serials.each do |revoked_serial|
+              current_serial = inventory.find { |k,v| v[:serial] == revoked_serial }
+              old_serial = inventory.find { |k,v| v[:old_serials].include?(revoked_serial) }
+              if current_serial
+                @logger.debug("#{revoked_serial} is the current serial for #{current_serial.first}")
+                to_delete << current_serial.first
+              elsif old_serial
+                @logger.debug("#{revoked_serial} appears to be an old serial for #{old_serial.first}. Verifying cert on disk is not the revoked serial.")
+                begin
+                  serial = get_cert_serial("#{cadir}/signed/#{old_serial.first}.pem")
+                  # This should never happen unless someone has messed with
+                  # the inventory.txt file or replaced the cert on disk with
+                  # an old one.
+                  to_delete << old_serial.first if serial == revoked_serial
+                rescue Exception => e
+                  @logger.err("Error reading serial from certificate for #{old_serial.first} with exception #{e}")
+                  errored = true
+                end
+              else
+                @logger.debug("Could not find #{revoked_serial} in inventory.txt. Searching certs on disk for this serial.")
+                begin
+                  certname = find_cert_with_serial(cadir, revoked_serial)
+                  if certname
+                    to_delete << certname
+                  else
+                    @logger.err("Could not find serial #{revoked_serial} in inventory.txt or in any certificate file currently on disk.")
+                    errored = true
+                  end
+                rescue Exception => e
+                  @logger.err("Error reading serial from certificates when trying to find certificate with serial #{revoked_serial} with exception #{e}")
+                  errored = true
+                end
+              end
+            end
+            # Because the CRL will likely contain certs that no longer exist on disk,
+            # don't show an error if we can't find the file.
+            count, err = delete_certs(cadir, to_delete, false)
+            errored ||= err
+            deleted_count += count
+          end
+
+          if args['expired']
+            # Delete expired certs found in inventory first since this is cheaper.
+            # Then, look for any certs not in the inventory, check if they
+            # are expired, then delete those.
+            inventory, err = Inventory.parse_inventory_file(inventory_file_path, @logger)
+            errored ||= err
+            expired_in_inventory = inventory.select { |k,v| v[:not_after] < Time.now }.map(&:first)
+            # Don't print errors if the cert is not found, since the inventory
+            # file can contain old entries that have already been deleted.
+            count, err = delete_certs(cadir, expired_in_inventory, false)
+            deleted_count += count
+            errored ||= err
+            other_certs_to_check = find_certs_not_in_inventory(cadir, inventory.map(&:first))
+            count, err = delete_expired_certs(cadir, other_certs_to_check)
+            deleted_count += count
+            errored ||= err
+          end
+
+          if args['certname']
+            count, errored = delete_certs(cadir, args['certname'])
+            deleted_count += count
+          end
+
+          if args['all']
+            certnames = Dir.glob("#{cadir}/signed/*.pem").map{ |c| File.basename(c, '.pem') }
+            # Since we don't run this with any other flags, we can set these variables directly
+            deleted_count, errored = delete_certs(cadir, certnames)
+          end
+
+          plural = deleted_count == 1 ? "" : "s"
+          @logger.inform("#{deleted_count} certificate#{plural} deleted.")
+          # If encountered non-fatal errors (an invalid entry in inventory.txt, cert not existing on disk)
+          # return 24. Returning 1 should be for fatal errors where we could not do any part of the action.
+          return errored ? 24 : 0
+        end
+
+        def find_certs_not_in_inventory(cadir, inventory_certnames)
+          all_cert_files = Dir.glob("#{cadir}/signed/*.pem").map { |f| File.basename(f, '.pem') }
+          all_cert_files - inventory_certnames
+        end
+
+        def delete_certs(cadir, certnames, error_on_not_found = true)
+          deleted = 0
+          errored = false
+          certnames.each do |cert|
+            path = "#{cadir}/signed/#{cert}.pem"
+            if File.exist?(path)
+              @logger.inform("Deleting certificate at #{path}")
+              File.delete(path)
+              deleted += 1
+            else
+              if error_on_not_found
+                @logger.err("Could not find certificate file at #{path}")
+                errored = true
+              end
+            end
+          end
+          [deleted, errored]
+        end
+
+        def delete_expired_certs(cadir, certnames)
+          deleted = 0
+          errored = false
+          files = certnames.map { |c| "#{cadir}/signed/#{c}.pem" }
+          files.each do |f|
+            # Shouldn't really be possible since we look for certs on disk
+            # before calling this function, but just in case.
+            unless File.exist?(f)
+              @logger.err("Could not find certificate file at #{f}")
+              errored = true
+              next
+            end
+            begin
+              cert = OpenSSL::X509::Certificate.new(File.read(f))
+            rescue OpenSSL::X509::CertificateError
+              @logger.err("Error reading certificate at #{f}")
+              errored = true
+              next
+            end
+            if cert.not_after < Time.now
+              @logger.inform("Deleting certificate at #{f}")
+              File.delete(f)
+              deleted += 1
+            end
+          end
+          [deleted, errored]
+        end
+
+        def get_cert_serial(file)
+          cert = OpenSSL::X509::Certificate.new(File.read(file))
+          cert.serial.to_i
+        end
+
+        def find_cert_with_serial(cadir, serial)
+          files = Dir.glob("#{cadir}/signed/*.pem")
+          files.each do |f|
+            begin
+              s = get_cert_serial(f)
+              return File.basename(f, '.pem') if s == serial # Remove .pem
+            rescue Exception => e
+              @logger.debug("Error reading certificate at #{f} with exception #{e}. Skipping this file.")
+            end
+          end
+          return nil
+        end
+      end
+    end
+  end
+end

data/lib/puppetserver/ca/action/prune.rb

@@ -6,6 +6,7 @@ require 'puppetserver/ca/utils/cli_parsing'
 require 'puppetserver/ca/utils/file_system'
 require 'puppetserver/ca/utils/config'
 require 'puppetserver/ca/x509_loader'
+require 'puppetserver/ca/config/puppet'
 
 module Puppetserver
   module Ca
@@ -13,15 +14,22 @@ module Puppetserver
       class Prune
         include Puppetserver::Ca::Utils
 
-        SUMMARY = "Prune the local CRL on disk to remove any duplicated certificates"
+        SUMMARY = "Prune the local CRL on disk to remove certificate entries"
         BANNER = <<-BANNER
 Usage:
   puppetserver ca prune [--help]
   puppetserver ca prune [--config]
+  puppetserver ca prune [--config] [--remove-duplicates]
+  puppetserver ca prune [--config] [--remove-expired]
+  puppetserver ca prune [--config] [--remove-entries] [--serial NUMBER[,NUMBER]] [--certname NAME[,NAME]]
 
 Description:
-  Prune the list of revoked certificates of any duplication within it.  This command
-  will only prune the CRL issued by Puppet's CA cert.
+  Prune the list of revoked certificates. If no options are provided or
+  --remove-duplicates is specified, prune CRL of any duplicate entries.
+  If --remove-expired is specified, remove expired entries from CRL.
+  If --remove-entries is specified, remove matching entries provided by
+  --serial and/or --certname values. This command will only prune the CRL
+  issued by Puppet's CA cert.
 
 Options:
 BANNER
@@ -32,6 +40,11 @@ BANNER
 
         def run(inputs)
           config_path = inputs['config']
+          remove_duplicates = inputs['remove-duplicates']
+          remove_expired = inputs['remove-expired']
+          remove_entries = inputs['remove-entries']
+          serialnumbers = inputs['serial']
+          certnames = inputs['certname']
           exit_code = 0
 
           # Validate the config path.
@@ -45,31 +58,57 @@ BANNER
           puppet.load(logger: @logger)
           return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
+          # Validate arguments
+          if (remove_entries && (!serialnumbers && !certnames))
+            return 1 if Errors.handle_with_usage(@logger,["--remove-entries option require --serial or --certname values"])
+          end
+
           # Validate that we are offline
           return 1 if HttpClient.check_server_online(puppet.settings, @logger)
 
           # Getting the CRL(s)
           loader = X509Loader.new(puppet.settings[:cacert], puppet.settings[:cakey], puppet.settings[:cacrl])
+          inventory_file = puppet.settings[:cert_inventory]
+          cadir = puppet.settings[:cadir]
 
           verified_crls = loader.crls.select { |crl| crl.verify(loader.key) }
+          number_of_removed_duplicates = 0
+          number_of_removed_crl_entries = 0
 
           if verified_crls.length == 1
             puppet_crl = verified_crls.first
             @logger.inform("Total number of certificates found in Puppet's CRL is: #{puppet_crl.revoked.length}.")
-            number_of_removed_duplicates = prune_CRL(puppet_crl)
 
-            if number_of_removed_duplicates > 0
+            if remove_entries
+              if serialnumbers
+                number_of_removed_crl_entries += prune_using_serial(puppet_crl, loader.key, serialnumbers)
+              end
+              if certnames
+                number_of_removed_crl_entries += prune_using_certname(puppet_crl, loader.key, inventory_file, cadir, certnames)
+              end
+            end
+
+            if remove_expired
+              number_of_removed_crl_entries += prune_expired(puppet_crl, loader.key, inventory_file, cadir)
+            end
+
+            if (remove_duplicates || (!remove_entries && !remove_expired))
+               number_of_removed_duplicates += prune_CRL(puppet_crl)
+            end
+
+
+            if (number_of_removed_duplicates > 0 || number_of_removed_crl_entries > 0)
               update_pruned_CRL(puppet_crl, loader.key)
               FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0644)
-              @logger.inform("Removed #{number_of_removed_duplicates} duplicated certs from Puppet's CRL.")
+              @logger.inform("Removed #{number_of_removed_duplicates} duplicated certs from Puppet's CRL.") if number_of_removed_duplicates > 0
+              @logger.inform("Removed #{number_of_removed_crl_entries} certs from Puppet's CRL.") if number_of_removed_crl_entries > 0
             else
-              @logger.inform("No duplicate revocations found in the CRL.")
+              @logger.inform("No matching revocations found in the CRL for pruning")
             end
           else
             @logger.err("Could not identify Puppet's CRL. Aborting prune action.")
             exit_code = 1
           end
-
           return exit_code
         end
 
@@ -106,6 +145,89 @@ BANNER
           crl.sign(pkey, OpenSSL::Digest::SHA256.new)
         end
 
+        def prune_using_serial(crl, key, serialnumbers)
+          removed_serials = []
+          revoked_list = crl.revoked
+          @logger.debug("Removing entries in CRL for issuer " \
+            "#{crl.issuer.to_s(OpenSSL::X509::Name::RFC2253)}") if @logger.debug?
+          serialnumbers.each do |serial|
+            if serial.match(/^(?:0[xX])?[A-Fa-f0-9]+$/)
+              revoked_list.delete_if do |revoked|
+                if revoked.serial == OpenSSL::BN.new(serial.hex)
+                  removed_serials.push(serial)
+                  true
+                end
+              end
+            end
+          end
+          crl.revoked = (revoked_list)
+          @logger.debug("Removed these CRL entries : #{removed_serials}") if @logger.debug?
+          return removed_serials.length
+        end
+
+        def prune_using_certname(crl, key, inventory_file, cadir, certnames)
+          serialnumbers = []
+          @logger.debug("Checking inventory file #{inventory_file} for matching cert names") if @logger.debug?
+          errors = FileSystem.validate_file_paths(inventory_file)
+          if errors.empty?
+            File.open(inventory_file).each_line do |line|
+              certnames.each do |certname|
+                if line.match(/\/CN=#{certname}$/) && line.split.length == 4
+                  serialnumbers.push(line.split.first)
+                  certnames.delete(certname)
+                end
+              end
+            end
+          else
+            @logger.warn "Reading inventory file at #{inventory_file} failed with error #{errors}"
+          end
+          if certnames
+            @logger.debug("Checking CA dir #{cadir} for matching cert names")
+            certnames.each do |certname|
+              cert_file = "#{cadir}/signed/#{certname}.pem"
+              if File.file?(cert_file)
+                raw = File.read(cert_file)
+                certificate = OpenSSL::X509::Certificate.new(raw)
+                serial = certificate.serial
+                serialnumbers.push(serial.to_s(16))
+              end
+            end
+            prune_using_serial(crl, key, serialnumbers)
+          end
+        end
+
+        def prune_expired (crl, key, inventory_file, cadir)
+          serialnumbers = []
+          signed_dir = "#{cadir}/signed"
+          @logger.debug("Checking inventory file #{inventory_file} for expired entries") if @logger.debug?
+          errors = FileSystem.validate_file_paths(inventory_file)
+          if errors.empty?
+            File.open(inventory_file).each_line do |line|
+              if line.match(/\/CN=.*$/) && line.split.length == 4
+                not_after = line.split[2]
+                begin
+                  not_after = Time.parse(line.split[2])
+                  serialnumbers.push(line.split.first) if not_after < Time.now
+                rescue ArgumentError
+                  @logger.warn "Invalid not_after time found in inventory.txt file at #{line}"
+                  next
+                end
+              end
+            end
+          else
+            @logger.warn "Reading inventory file at #{inventory_file} failed with error #{errors}"
+          end
+          @logger.debug("Checking CA dir #{cadir} for expired certs")
+          Dir.foreach(signed_dir) do |filename|
+            if File.extname(filename) == '.pem'
+              raw = File.read("#{signed_dir}/#{filename}")
+              certificate = OpenSSL::X509::Certificate.new(raw)
+              serialnumbers.push(certificate.serial.to_s(16)) if certificate.not_after < Time.now
+            end
+          end
+          prune_using_serial(crl, key, serialnumbers)
+        end
+
         def self.parser(parsed = {})
           OptionParser.new do |opts|
             opts.banner = BANNER
@@ -115,6 +237,21 @@ BANNER
             opts.on('--config CONF', 'Path to the puppet.conf file on disk') do |conf|
               parsed['config'] = conf
             end
+            opts.on('--remove-duplicates', 'Remove duplicate entries from CRL(default)') do |remove_duplicates|
+              parsed['remove-duplicates'] = true
+            end
+            opts.on('--remove-expired', 'Remove expired  entries from CRL') do |remove_expired|
+              parsed['remove-expired'] = true
+            end
+            opts.on('--remove-entries', 'Remove entries from CRL') do |remove_entries|
+              parsed['remove-entries'] = true
+            end
+            opts.on('--serial NUMBER[,NUMBER]', Array, 'Serial numbers(s) in HEX to be removed from CRL') do |serialnumbers|
+              parsed['serial'] = serialnumbers
+            end
+            opts.on('--certname NAME[,NAME]', Array, 'Name(s) of the cert(s) to be removed from CRL') do |certnames|
+              parsed['certname'] = certnames
+            end
           end
         end
 
@@ -134,4 +271,4 @@ BANNER
       end
     end
   end
-end
+end

data/lib/puppetserver/ca/cli.rb

@@ -1,6 +1,7 @@
 require 'optparse'
 
 require 'puppetserver/ca/action/clean'
+require 'puppetserver/ca/action/delete'
 require 'puppetserver/ca/action/generate'
 require 'puppetserver/ca/action/import'
 require 'puppetserver/ca/action/enable'
@@ -27,6 +28,7 @@ Puppet Server's built-in Certificate Authority
 BANNER
 
       ADMIN_ACTIONS = {
+        'delete'   => Action::Delete,
         'import'   => Action::Import,
         'setup'    => Action::Setup,
         'enable'   => Action::Enable,

data/lib/puppetserver/ca/utils/http_client.rb

@@ -10,17 +10,12 @@ module Puppetserver
       # Utilities for doing HTTPS against the CA that wraps Net::HTTP constructs
       class HttpClient
 
-        DEFAULT_HEADERS = {
-          'User-Agent'   => 'PuppetserverCaCli',
-          'Content-Type' => 'application/json',
-          'Accept'       => 'application/json'
-        }
-
         attr_reader :store
 
         # Not all connections require a client cert to be present.
         # For example, when querying the status endpoint.
         def initialize(logger, settings, with_client_cert: true)
+          @default_headers = make_headers(ENV['HOME'])
           @logger = logger
           @store = make_store(settings[:localcacert],
                               settings[:certificate_revocation],
@@ -52,7 +47,7 @@ module Puppetserver
         # The Connection object should have HTTP verbs defined on it that take
         # a body (and optional overrides). Returns whatever the block given returned.
         def with_connection(url, &block)
-          request = ->(conn) { block.call(Connection.new(conn, url, @logger)) }
+          request = ->(conn) { block.call(Connection.new(conn, url, @logger, @default_headers)) }
 
           begin
             Net::HTTP.start(url.host, url.port,
@@ -68,7 +63,22 @@ module Puppetserver
 
         private
 
-       def load_with_errors(path, setting, &block)
+        def make_headers(home)
+          headers = {
+            'User-Agent'   => 'PuppetserverCaCli',
+            'Content-Type' => 'application/json',
+            'Accept'       => 'application/json'
+          }
+
+          token_path = "#{home}/.puppetlabs/token"
+          if File.exist?(token_path)
+            headers['X-Authentication'] = File.read(token_path)
+          end
+
+          headers
+        end
+
+        def load_with_errors(path, setting, &block)
           begin
             content = File.read(path)
             block.call(content)
@@ -81,21 +91,23 @@ module Puppetserver
                     "Could not parse '#{setting}' at '#{path}'.\n" +
                     "  OpenSSL returned: #{e.message}")
           end
-       end
+        end
 
         # Helper class that wraps a Net::HTTP connection, a HttpClient::URL
         # and defines methods named after HTTP verbs that are called on the
         # saved connection, returning a Result.
         class Connection
-          def initialize(net_http_connection, url_struct, logger)
+
+          def initialize(net_http_connection, url_struct, logger, default_headers)
             @conn = net_http_connection
             @url = url_struct
             @logger = logger
+            @default_headers = default_headers
           end
 
-          def get(url_overide = nil, headers = {})
+          def get(url_overide = nil, header_overrides = {})
             url = url_overide || @url
-            headers = DEFAULT_HEADERS.merge(headers)
+            headers = @default_headers.merge(header_overrides)
 
             @logger.debug("Making a GET request at #{url.full_url}")
 
@@ -105,9 +117,9 @@ module Puppetserver
 
           end
 
-          def put(body, url_override = nil, headers = {})
+          def put(body, url_override = nil, header_overrides = {})
             url = url_override || @url
-            headers = DEFAULT_HEADERS.merge(headers)
+            headers = @default_headers.merge(header_overrides)
 
             @logger.debug("Making a PUT request at #{url.full_url}")
 
@@ -118,9 +130,9 @@ module Puppetserver
             Result.new(result.code, result.body)
           end
 
-          def delete(url_override = nil, headers = {})
+          def delete(url_override = nil, header_overrides = {})
             url = url_override || @url
-            headers = DEFAULT_HEADERS.merge(headers)
+            headers = @default_headers.merge(header_overrides)
 
             @logger.debug("Making a DELETE request at #{url.full_url}")
 

data/lib/puppetserver/ca/utils/inventory.rb

@@ -0,0 +1,84 @@
+require 'time'
+
+module Puppetserver
+  module Ca
+    module Utils
+      module Inventory
+
+        # Note that the inventory file may have multiple entries for the same certname,
+        # so it should only provide the latest cert for the given certname.
+        def self.parse_inventory_file(path, logger)
+          unless File.exist?(path)
+            logger.err("Could not find inventory at #{path}")
+            return [{}, true]
+          end
+          inventory = {}
+          errored = false
+          File.readlines(path).each do |line|
+            # Shouldn't be any blank lines, but skip them if there are
+            next if line.strip.empty?
+            
+            items = line.strip.split
+            if items.count != 4
+              logger.err("Invalid entry found in inventory.txt: #{line}")
+              errored = true
+              next
+            end
+            unless items[0].match(/^(?:0x)?[A-Fa-f0-9]+$/)
+              logger.err("Invalid serial found in inventory.txt line: #{line}")
+              errored = true
+              next
+            end
+            serial = items[0].hex
+            not_before = nil
+            not_after = nil
+            begin
+              not_before = Time.parse(items[1])
+            rescue ArgumentError
+              logger.err("Invalid not_before time found in inventory.txt line: #{line}")
+              errored = true
+              next
+            end
+            begin
+              not_after = Time.parse(items[2])
+            rescue ArgumentError
+              logger.err("Invalid not_after time found in inventory.txt line: #{line}")
+              errored = true
+              next
+            end
+            unless items[3].start_with?('/CN=')
+              logger.err("Invalid certname found in inventory.txt line: #{line}")
+              errored = true
+              next
+            end
+            certname = items[3][4..-1]
+
+            if !inventory.keys.include?(certname) 
+              inventory[certname] = {
+                :serial => serial,
+                :old_serials => [],
+                :not_before => not_before,
+                :not_after => not_after,
+              }
+            else
+              if not_after >= inventory[certname][:not_after]
+                # This is a newer cert than the one we currently have recorded,
+                # so save the previous serial in :old_serials
+                inventory[certname][:old_serials] << inventory[certname][:serial]
+                inventory[certname][:serial] = serial
+                inventory[certname][:not_before] = not_before
+                inventory[certname][:not_after] = not_after
+              else
+                # This somehow is an older cert (shouldn't really be possible as we just append
+                # to the file with each new cert and we are reading it order)
+                inventory[certname][:old_serials] << serial
+              end
+            end
+          end
+          [inventory, errored]
+        end
+      end
+    end
+  end
+end
+

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "2.4.0"
+    VERSION = "2.6.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.6.0
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-01-17 00:00:00.000000000 Z
+date: 2023-05-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter
@@ -80,7 +80,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/workflows/snyk.yaml"
+- ".github/workflows/mend.yaml"
 - ".gitignore"
 - ".rspec"
 - ".travis.yml"
@@ -96,6 +96,7 @@ files:
 - exe/puppetserver-ca
 - lib/puppetserver/ca.rb
 - lib/puppetserver/ca/action/clean.rb
+- lib/puppetserver/ca/action/delete.rb
 - lib/puppetserver/ca/action/enable.rb
 - lib/puppetserver/ca/action/generate.rb
 - lib/puppetserver/ca/action/import.rb
@@ -118,6 +119,7 @@ files:
 - lib/puppetserver/ca/utils/config.rb
 - lib/puppetserver/ca/utils/file_system.rb
 - lib/puppetserver/ca/utils/http_client.rb
+- lib/puppetserver/ca/utils/inventory.rb
 - lib/puppetserver/ca/utils/signing_digest.rb
 - lib/puppetserver/ca/version.rb
 - lib/puppetserver/ca/x509_loader.rb
@@ -141,7 +143,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.9
+rubygems_version: 3.4.12
 signing_key: 
 specification_version: 4
 summary: A simple CLI tool for interacting with Puppet Server's Certificate Authority

data/.github/workflows/snyk.yaml

@@ -1,31 +0,0 @@
----
-name: Snyk Monitor
-on:
-  push:
-    branches:
-      - main
-jobs:
-  snyk_monitor:
-    if: ${{ github.repository_owner == 'puppetlabs' }}
-    runs-on: ubuntu-latest
-    name: Snyk Monitor
-    steps:
-      - name: Checkout current PR
-        uses: actions/checkout@v2
-      - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: 2.7
-      - name: Install dependencies
-        run: bundle install --jobs 3 --retry 3
-      - name: Extract branch name
-        shell: bash
-        run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
-        id: extract_branch
-      - name: Run Snyk to check for vulnerabilities
-        uses: snyk/actions/ruby@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_FOSS_KEY }}
-        with:
-          command: monitor
-          args: --org=puppet-foss --project-name=${{ github.repository }}#${{ steps.extract_branch.outputs.branch }}