summaryrefslogtreecommitdiffstats
path: root/lib/puppet
Commit message (Collapse)AuthorAgeFilesLines
...
| * Fix for #3088 (catching Exception also traps SystemExit)Markus Roberts2010-01-2412-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | Changing rescues from the default to Exception (to catch errors that don't descend from StandardError) had the unintended consequence of catching (and suppressing) SystemExit. This patch restores the behavior of by reraising the exception. Of the other exceptions that fall through the same crack (NoMemoryError, SignalException, LoadError, Interrupt, NotImplementedError, and ScriptError) this patch also reraises NoMemoryError, SignalException, and Interrupt in the same way and leaves the rest captured.
| * Fix for #3093 (also need to be able to call pkgget_with_cat on class)Markus Roberts2010-01-221-2/+2
| | | | | | | | Fixed to deal with scopig issues.
| * Uncommeniting the fix for #3001Markus Roberts2010-01-211-1/+1
| |
| * Minimal fix for #3001 (failing to fetch metadata on dangling symlink)Markus Roberts2010-01-191-1/+1
| | | | | | | | | | | | | | FileTest.exists? returns false if the target of a symlink is missing; in such cases we still want to continue if the resource is a symlink, as we may be managing a dangling symlink. Continuing in such case either gives the desired behavior or a more specific/informative error message.
| * Fixing #2914 - pre/post hooks now work for transactionsLuke Kanies2010-01-183-4/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was built to be used with etckeeper to version control files in /etc, but can be used for essentially anything. This patch was built to be added to 0.25.4, so it's a least-modify approach. A better approach would be to refactor application/puppet.rb just a bit so it uses Configurer more. This is a simple patch - it just defines 'prerun_command' and 'postrun_command' settings, and runs the appropriate command around each transaction if they're set. Signed-off-by: Luke Kanies <luke@reductivelabs.com>
| * Fix for #3075 (sshkey host_aliases ignored)Markus Roberts2010-01-151-5/+5
| | | | | | | | | | | | | | In the alias --> host_aliases conversion, I overlooked parsed file provider for sshkeys. Now with tests.
| * Revert "Fix #2845 Cron entries using "special" parameter lose their title ↵James Turnbull2010-01-141-4/+9
| | | | | | | | | | | | | | | | when changed" This reverts commit c99f394bf8c10d13f3fa7d3ab7ab43ecf454c081. The fix broke cron jobs in 0.25.3 and was reverted for the 0.25.4 release.
* | Fix #3117 - cert fingerprinting uses a method not available in ruby <= 1.8.6Brice Figureau2010-01-281-1/+1
| | | | | | | | | | | | | | | | OpenSSL::Digest.hexdigest is not available on older ruby versions. This patch accesses directly to the digest instead (which hopefully support hexdigest). Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | First shot at the OpenSolaris pkg(5) providerMartin Englund2010-01-271-0/+114
| |
* | Feature #2839 - fingerprint certificateBrice Figureau2010-01-196-19/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds several things: * certificate fingerprinting in --list mode * a puppetca action called "--fingerprint" to display fingerprints of given certificates (or all including CSR) * a --fingerprint puppetd option to display client certificates * each time a CSR is generated, its fingerprint is displayed in the log It is also possible to use --digest in puppetca and puppetd to specify a specific digest algorithm. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Revert "Feature #2839 - fingerprint certificate"James Turnbull2010-01-193-46/+9
| | | | | | | | | | | | This reverts commit a9fb82b0026e75a670fec553b17de3b0f091c2a5. An older branch was pulled
* | Fixing #1054 - transaction reports are always sentLuke Kanies2010-01-183-64/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | This refactors how reports, catalogs, configurers, and transactions are all related - the Configurer class manages the report, both creating and sending it, so the transaction is now just responsible for adding data to it. I'm still a bit uncomfortable of the coupling between transactions, the report, and configurer, but it's better than it was. This also fixes #2944 and #2973. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Removing some unneeded validation code from Transaction.newLuke Kanies2010-01-181-8/+2
| | | | | | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* | Removing unused configurer codeLuke Kanies2010-01-181-6/+0
| | | | | | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* | Fix #2894 - exclude .pp files under modules files directoriesBrice Figureau2010-01-181-0/+1
| | | | | | | | | | | | | | | | | | | | Selinux modules files also ends in ".pp". Puppetdoc tries to parse them as if they are regular puppet files and then fails. This patch makes sure puppetdoc tells RDoc to exclude parsing .pp files in the modules files section. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Adapt to method name change since 8971d8Brice Figureau2010-01-181-3/+3
| | | | | | | | | | | | | | | | | | When the definition/hostclass/node AST types were removed, the parentclass method was renamed to 'parent'. This patch fixes the incorrect rdoc usage (and some deeper integration test so that it won't happen again). Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Feature #2839 - fingerprint certificateBrice Figureau2010-01-183-9/+46
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds two things: * certificate fingerprinting in --list mode * a puppetca action called "--fingerprint" to display fingerprints of given certificates It is also possible to use --digest to specify a specific digest algorithm. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Feature #2395 - revoke when cleaning a certificate with puppetcaBrice Figureau2010-01-181-0/+1
| | | | | | | | | | | | | | | | As the ticket says: "the certificates would still be valid even if cleaned, therefore, it makes more sense revoke them instead." Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Merge branch '0.25.x'James Turnbull2010-01-1363-485/+461
|\| | | | | | | | | | | Conflicts: lib/puppet/ssl/host.rb spec/spec_helper.rb
| * Reversion of pipe IO patch for testing on #3025Markus Roberts2010-01-121-39/+54
| |
| * Fix #1464 Mount complains about missing fieldsJesse Wolfe2010-01-121-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This family of errors could appear because Puppet parses every line in fstab into resources, even lines that are not specifically managed by Puppet, and fstab files are much more permissive than Puppet in what constitutes a valid mount. This change makes several fields optional that were previously mandatory. Also, it ignores lines in fstab that have fewer than the required number of parameters. Includes a more readable regex than the previous patch. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Fix #2845 Cron entries using "special" parameter lose their title when changedJesse Wolfe2010-01-121-9/+4
| | | | | | | | | | | | | | Merged the "freebsd_special" pattern into the other crontab records, since its definition was incomplete Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Fix #2887 'service' tests paths too earlyJesse Wolfe2010-01-082-16/+19
| | | | | | | | | | | | | | | | | | The 'service' type was testing to see if init script directories exist too early, causing failures if you expected to be able to create those directories via puppet. This patch moves that logic into the 'init' provider. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Fix for temporary file security wholeMarkus Roberts2010-01-055-7/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We create temporary files in /tmp/ with predictable names. These could be used by an attacker to DoS a box by setting a symlink to some other file (say, /etc/shadow) and waiting for us to overwrite it. The minimalistic solution employed by this patch is to wrap all such file writing with a paranoid wrapper that: 1) Check to see if the target exists 2) Issues a warning if it was a symlink 3) Deletes it 4) Waits (0.1 seconds if it was a file, 5 seconds if it was a symlink) 5) Opens the file with EXCL, which will fail if the file has come back. If this succeeds (as it normally will) it has exactly the same semantics as the original code (a must, as we are right at a release boundary). However, under no circumstances will it follow a preexisting symlink (the operating system guarantees this with EXCL) so the danger of an exploit has been converted into the possibility of a failure, with an appropriate warning.
| * Fix for #2999 (absent package handling on solaris)Markus Roberts2010-01-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | The fix for #2940 resulted in a behavior change that could be seen as a bug. This was consistent with many of the other providers (see #3000) but was not the desired behavior. This patch enhances the patch for #2940 to return {:ensure => :absent} as the present state in the case that the failure was due to the package not being installed (as opposed to a source/index failure, etc.). The other possibility would have been {:ensure => :purged}.
| * Fix typo in documentation: wheter vs. whether.Jeroen van Meeuwen2010-01-031-1/+1
| |
| * Partial rollback of refinements to fix for #2994Markus Roberts2010-01-021-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The fix for #2994 had been refined to only checksum links when @links was set to :follow to make the tests pass, but this caused partial reintroduction of the original issue since information about the source (the real file vs. followed link distinction) isn't available client side and thus there are paths on which @links winds up :managed when it had originally been :followed. In these cases the checksum is needed but not produced. Consequently, this patch relaxes the condition, and always tries to produce a checksum, with a rescue guard to gracefully handle cases where this is not possible (e.g. broken links).
| * Do not close stdout or stderr in execute.Ricky Zhou2010-01-021-9/+12
| | | | | | | | | | | | Closing stdout and stderr would sometimes cause failures when a program that is executed with squelched output tries to write to them. This reverts to the previous behavior of reopening them to /dev/null.
| * ReFix 2675 ending slash in directory should get stripped offJesse Wolfe2010-01-011-0/+4
| | | | | | | | | | | | | | | | | | There was an intermittent bug in Puppet::Parser::Resource::Reference, during initialization, and object could sometimes have its title set before its type is set. This prevented the title from going through type-specific canonicalization. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Use a pipe instead of a temp file for command output.Ricky Zhou2010-01-011-54/+36
| | | | | | | | | | | | This solves some SELinux issues with programs such as mount being denied from writing to temporary files and removes a race condition with temporary file creation.
| * Additional fix for #2994 (followed symlinks do not have checksums)Markus Roberts2010-01-011-6/+4
| | | | | | | | | | | | | | | | | | | | The first patch for #2994, to which this is an extension, exposed the fact that checksums were not being included in the metadata for followed links; checksums are needed for managing the contents of files that are represented on the server as links (links => follow). This patch adds checksums for followed links and tests to confirm that it works as expected.
| * Fix for #2995 (don't fail to load PSON when UTF-8 missing)Markus Roberts2009-12-312-18/+24
| | | | | | | | | | | | | | | | | | | | | | | | We don't actually rely on iconv's UTF-8 support, so its absence shouldn't cause the PSON feature to fail on system (e.g. HPUX) where it isn't fully implemented. This change exposed a dependency on library load order that was causing Puppet::Util::Log to raise an error. I've removed the dependency of Puppet::Type from Puppet::Util::Log. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Revert "Fix for #2731 (problem communicating with processes in SELinux)"James Turnbull2009-12-311-22/+51
| | | | | | | | | | | | Due to problems introduced on HP-UX (See #2997) This reverts commit 6ab2453d966d1d48e12d8a8cec34b9e460597d04.
| * Fix for #2995 (don't fail to load PSON when UTF-8 missing)Markus Roberts2009-12-301-1/+1
| | | | | | | | | | | | We don't actually rely on iconv's UTF-8 support, so its absence shouldn't cause the PSON feature to fail on system (e.g. HPUX) where it isn't fully implemented.
| * Fix for #2994 (undefined method "_file" message)Markus Roberts2009-12-291-1/+1
| | | | | | | | | | | | | | | | | | Attempting to call a constructed method name with a nil component (the checksum type in this case) causes an unhelpful error message in a case where either 1) the results were not needed anyway or 2) a more useful error message would otherwise be generated. It also opens (at least hypothetically) then possibility that some unrelated method (in this case "_file" would be called if it existed.
| * fix #2987 - check correct hash entryPeter Meier2009-12-251-1/+1
| | | | | | | | It looks like something got lost during transition to host_aliases.
| * Fix for #2967 (RFC-1123 problem and regression on wildcarded domains)Markus Roberts2009-12-241-1/+1
| | | | | | | | | | | | | | | | | | | | The core bug here was a regression introduced by my IPv6 patch. Wildcarded domains are stored as ["com","reductivelabs","*"] but the code in question was assuming it was in normal order. Added tests to prevet recurrence. Signed-off-by: Markus Roberts <Markus@reality.com>
| * Fixing failing testsMarkus Roberts2009-12-231-1/+0
| |
| * Fix for #2881 (ralsh doesn't find individual parsed resources)Markus Roberts2009-12-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rather than just creating a new featureless resource for cases like: ralsh host localhost.localdomain (and the analogous cases with other parsed resources such as ssh keys, etc), we first check to see if the appropriate provider can find a resource with the requested name. If so, we use it; if not we fall back to the featureless form. There are a number of potential shortcomings with this fix: * It may not be particularly performant if there are many resources to be parsed. * It always (and only) checks the first provider; perhaps it should try all providers of the appropriate type. * It only checks the name property, and not any aliases or host_aliases. Signed-off-by: Markus Roberts <Markus@reality.com>
| * Code smell reductionsMarkus Roberts2009-12-232-38/+10
| | | | | | | | | | | | These are a grab-bag of code simplification changes I made in the process of figuring out what was going on with #2881; they should all be absolutely behavior neutral.
| * Making provider/host/parser.rb compatible with host_aliasesMarkus Roberts2009-12-231-8/+8
| | | | | | | | | | When I changed the alias property of hosts to host_aliases I missed these changes in the parsed file provider.
| * Fixing #2964 updated resources cannot be collected until they are exported twiceMarkus Roberts2009-12-231-1/+1
| | | | | | | | | | | | | | This logic had a bug where it would not insert data if it had just been deleted. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Fix for #2731 (problem communicating with processes in SELinux)Markus Roberts2009-12-231-51/+22
| | | | | | | | | | | | | | | | | | | | In some cases communicating with child processes via temprary files is not viable. This is Ricky Zhou's patch from the ticket, which solves the problem by using the more normal system of pipes. It is a broader reaching change than suggested by the ticket (it affects all execs, not just SELinux) but IMHO is the right way to go. Signed-off-by: Markus Roberts <Markus@reality.com>
| * Fix for #2940 (propogating nil rather than reporting the error)Markus Roberts2009-12-231-3/+4
| |
| * A slide down the RFC-1123 slope towards MS Windows compatibility and chaosMarkus Roberts2009-12-222-5/+6
| |
| * Fix for #2943 (Make puppet --apply respect --preferred_serialization_format)Markus Roberts2009-12-211-1/+1
| | | | | | | | Signed-off-by: Markus Roberts <Markus@reality.com>
| * Fix #2816 MySQL server has gone awayJesse Wolfe2009-12-201-0/+1
| | | | | | | | | | | | As suggested in the ticket, set :reconnect to true. Our in-house Rails experts suggest that this is unlikely to cause any problems. The setting is silently ignored before Rails 2.3
| * Fix for #2813 (alias propety v. alias metapram)Markus Roberts2009-12-203-19/+17
| | | | | | | | | | | | | | Renamed :alias property to :host_aliases / :port_aliases (in the sidelined port code) and corrected the comments. Signed-off-by: Markus Roberts <Markus@reality.com>
| * Fix for #2765 (--no-fqdn regression in puppetrun)Markus Roberts2009-12-202-5/+8
| | | | | | | | | | | | | | | | | | This is basically the fix suggested on the ticket, cleaned up and ruby-ized, with tests. The only functional modification is leaving the default on entry2hash as --no-fqdn to preserve 0.25.1 behaviour as the default. Signed- ff-by: Markus Roberts <Markus@reality.com>
| * Fix for #2657 (retain old setting if config has syntax error)Markus Roberts2009-12-201-25/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This appears to be regression introduced by threading changes. The fix was to rearrange things to keep the old behaviour (don't clear the settings until you know the config file parses) and the new (don't nest calls to synchronize) by: 1. Splitting clear into two parts--clear, which works as before, and unsafe_clear which it calls and which expects synchronization to be handled externally. 2. Rearranging the code to recover the previous calling order 3. Trapping syntax errors and turning them into logged messages and a no-op effect. 4. Fixing reparse to not wrap a call to this code with a synchronize. 5. Tests. Signed-off-by: Markus Roberts <Markus@reality.com>
generated by cgit (git 2.34.1) at 2025-09-26 15:36:57 +0000