Puppet 2.7.8 is available. 2.7.8 contains everything that was being previewed in the 2.7.7rc series as well as some new content.
Key highlight in this release (beyond items from 2.7.7rc series) are: * Allow providers to be selected in the run they become suitable * Showdiff is now not auto-enabled when running in noop mode * Provide default subjectAltNames while bootstrapping master (defaulting to puppet and puppet.<domain>) * Allow optional trailing comma in argument lists. * Output 4-digit file modes in File type Release Notes for 2.7.8 series -- https://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes This release is available for download at: http://downloads.puppetlabs.com/puppet/ See the Verifying Puppet Download section at: http://projects.puppetlabs.com/projects/puppet/wiki/Downloading_Puppet Please report feedback via the Puppet Labs Redmine site, using an affected version of 2.7.8 http://projects.puppetlabs.com/projects/puppet Documentation is available at: http://docs.puppetlabs.com/index.html # 2.7.8 === ##10739 Provide default subjectAltNames while bootstrapping master Prior to #2848 (CVE-2011-3872), if Puppet[:certdnsnames] was not set, puppet would add default subjectAltNames to any non-CA cert it signed, including agent certs. The subjectAltNames were of the form: DNS:puppet, DNS:<fqdn>, DNS:puppet.<domain> The fix for #2848, prevented subjectAltNames from ever being implicitly added at signing time. But during this change, the default subjectAltNames behavior was accidentally removed. This commit restores the 'defaulting' behavior that existed previously, but only when bootstrapping the initial master. Additionally, default subjectAltNames are only ever added when generating the master's certificate signing request, not at signing time. This is important, because it ensures all subjectAltNames originate from the CSR and are subject to our internal signing policy. The code now requires that all of the following be true in order to add default subjectAltNames to the CSR: 1. We are a CA and master 2. We're signing the master's cert, not self-signing the CA 3. The CSR is for the current host 4. No subjectAltNames have been specified, e.g. Puppet[:dns_alt_names] 5. The master can resolve its fqdn These should only ever be true when bootstrapping the initial master. In particular, it should never be true for the CA's self-signed cert, for remote agents, or for servers that are either masters or CAs, but not both. The fqdn requirement existed previously, and so the same behavior has been restored. Note if Puppet[:dns_alt_names] are specified when bootstrapping the master, then we do not merge the default options -- it's either one of the other, but not both. #2744 Don't automatically enable show_diff in noop mode As of 845825a, file diffs are now logged, rather than printed to console. Because log messages may be stored and more broadly readable, we no longer implicitly set show_diff in noop mode. ##6907 Allow providers to be selected in the run they become suitable Previously, if a resource did not specify its provider, it would be assigned the most appropriate suitable provider (typically the default). If no provider was suitable, the run would fail before it even began. This meant that a provider which was going to have its requirements delivered during the run could not be used in that run. In the case that an unsuitable provider was explicitly specified, this would only work in certain conditions. Suitability was lazily checked, which meant the resources installing the provider had to come before the resources using it. If this weren't true (because the dependencies weren't specified), those resources would still fail. Now, we will instead *wait* for the provider to become suitable. Similarly, if no provider is specified, we wait for a suitable provider to become available. We accomplish this by deferring unsuitable resources when they are encountered. Once we are out of suitable resources, we re-enqueue our previously-unsuitable resources and check them again. If some are now suitable, we evaluate them as normally, deferring the rest. If all our deferred resources are still deferred, they all fail, and we continue on with their dependents (which will all be marked as skipped due to failed dependencies). This allows providers to be used in the same run as resources using them, without needing to specify any dependencies between resources using the provider and resources installing the provider. Naturally, if the resources installing the provider depend on resources using the provider, the run cannot succeed. Previously, if we chose to use an unsuitable provider, we would not prefetch it because it wasn't suitable at the beginning of the run. Now, we lazily prefetch, waiting until the first resource of a particular provider is evaluated. If the provider we are prefetching is also the default provider for its type, we also find resources of that type with no specified provider, and assign them the default provider. This allows us to avoid prefetching the same provider twice (once for resources explicitly using it, and once for resources implicitly using it because it's the default). ##6335 Allow optional trailing comma in argument lists. Support optional comma at the end arguments lists for parameterized class and user defined resources. This makes it behave similar to resource attributes. ##7274 Output 4-digit file modes in File type When updating file mode, output 4 digit file mode instead of omitting the leading 0, i.e. 0755 instead of 755. This fully represents the file mode, and lessens the likelihood of someone incorrectly setting the mode on a file by copy/pasting the incomplete mode specification. # Full Changelog === e4ee794 (#10739) Provide default subjectAltNames while bootstrapping master 2dedee6 (#2744) Don't automatically enable show_diff in noop mode ef78358 Give variables more descriptive names cd3d4ea maint: Rename xgenerate to add_dynamically_generated_resources 000a2d8 (#6907) Prefetch unsuitable providers 70114e9 (#6907) Allow providers to be selected in the run they become suitable a0ee5c7 maint: Fix incorrect whitespace 4e8a73c Fix description in service provider test for FreeBSD a2eab4f (#6697) Set service provider default path to /etc/rc.d on Archlinux da75795 (#6335) Allow optional trailing comma in argument lists. 47c786e Update CHANGELOG and packaging for 2.7.7 final 8030428 (#8255) Always use string modes when creating resources from FileSetting settings c804346 (#7274) Output 4-digit file modes in File type 220f2ba (#10799) Regexp escaping too much 4462eb5 Merged 2.6.x into 2.7x 67e048b Updated CHANGELOG for 2.7.7rc2 93aca5a maint: Fix failing specs for Windows exec provider 7f3a1bb (#9617) Use an RbTreeMap to store ready resources 9eff0f4 (#9671) Implement RbTreeMap#each recursively, and #first/#last explicitly 5f7f467 (#9671) Return nodes from internal RbTreeMap recursion 1dc9c72 (#9671) Stop tracking size and height of nodes in RbTreeMap f180f9b (#9617) Add a red-black tree map c62e949 (#9617) Keep track of blockers for resources when traversing 2cb6d72 (#9671) Generated resources should not depend on the completed_ whit a5845b7 (#9671) Exit early from #eval_generate if nothing is created 7002eff (#9617) Be smarter about finding parents when eval_generating 11fda78 maint: Don't File#expand_path when unmunging file paths ad4316a (#9671) Use Array#concat rather than += 20260f3 maint: Correct the spelling of sentinel 4f03384 (#10614) Detect when trying to managing ACLs on a non-ACL volume 37b9f0f (#10614) Provide default metadata values for Windows ACLs 1cb37c9 (#10614) Add method for detecting Windows volumes that support ACLs c9ee5a0 (#10614) Fix setting and clearing read-only attribute on Windows ed27a90 (#10614) Fix error checking for Windows BOOL return values 7f0756d (#10727) Don't rely on Kernel#Pathname 23379d0 (#10614) Detect when trying to managing ACLs on a non-ACL volume 374fee5 (#10614) Provide default metadata values for Windows ACLs f60e889 (#10614) Add method for detecting Windows volumes that support ACLs 1371dbd (#10614) Fix setting and clearing read-only attribute on Windows 7eb0197 (#10614) Fix error checking for Windows BOOL return values 9dfd011 (#5617) Puppet queue logging 0a34697 (#2744) Display file diffs through the Puppet log system. 0c28238 (#9508) Be explicit is setting `auth any` for default ACLs. f140eca Updated CHANGELOG for 2.7.7rc1 057cda6 (#9508) Default ACL of `auth any` makes sense where we had `auth no` 78670ed (#9983) Checksum file in binary mode when storing to filebucket da11a78 (#9983) Serve file content in binary mode 13f1054 (#9983) Read file content from disk using binary mode 4b4bb8b (#9983) Use binary mode when reading and writing FileBucketFiles 899833b (#9983) Read file content in binary mode when backing up dc8bcf8 (#9983) Restore files in binary mode 489a679 (#9983) Checksum files in binary mode f7bfa05 (#9983) Add method for reading binary files 674068a (#10269) Make directories executable so they can be cleaned up fd747cc (#10365) Add pending test when file overwrites an executable directory fe30d8f (#10315) Add pending tests when following symlinks a22c7aa Maint: Fix test breakage 8576e86 (#10269) Search bit not set on newly created directories a91cfa1 maint: Fix failing spec on old version of rspec 428e08c Stub File.open to not touch the disk aa2a762 (#10289) Add an ext script to upload facts to inventory server a97337f (#10346) Fix storeconfigs spec failures when run alone 5129d38 (#10289) Add a safe alternative to REST for inventory service 5c4daa4 (#7601) Use definition lists in indirection references 7df46a2 (#7601) Use definition lists in type references ad97dc9 (#7601) Add markdown_definitionlist method to reference.rb 455c9aa Maint: Revise reference text for most types and providers ced8e19 (#7601) Remove unnecessarily abstracted paramwrap method a6957ac (#7601) Rename "h" method to "markdown_header" 7a0ade6 (#7601) Use << instead of += in references 7d65796 (#9109) Retrieve request parameters from the request body for POSTs 5a2952c (maint) Fix CA-related specs failing on Windows 42fb76e Fix typo in report debug message eab5965 missing includes in network XML-RPC handlers 7514d32 missing includes in network XML-RPC handlers 614526a (#10244) Restore Mongrel XMLRPC functionality 397a506 (#10244) Restore Mongrel XMLRPC functionality fcaf7c5 Updated CHANGELOG for 2.6.12 f51d221 Improve the error message when a CSR is rejected d551747 Allow a master to bootstrap itself with dns_alt_names and autosign 0405196 (maint) Remove ssl dir before starting a master with DNS alt names 3ed6499 Backport Enumerable#count to Rubies < 1.8.7 5f44c23 More 1.8.5 compatibility fixes. ef1b960 Better 1.8.5 compatible implementation of `lines`. 246e875 (#2848) Config options require '_', not '-'. 3bdeb3a Ruby 1.8.5 compatibility changes in tests and code. 6866d4b Add `lines` alias for `each_line` in Ruby 1.8.5. 2f9ec3c s/not_to/should_not/ for older versions of RSpec 2. 56320ea (#2848) Eliminate redundant `master_dns_alt_names`. de19861 (#2848) Remove the legacy SSLCertificates code cf008a6 (#2848) Rework the xmlrpc CA handler to use the modern SSL code 32be180 (#2848) Remove unused xmlrpc code 5f2a44d (#2848) Consistent return values from `subject_alt_names` accessors. 5e507f2 (#2848) Consistently use `subject_alt_names` as accessor name. 5ac2417 (#2848) Don't strip the subjectAltName label when listing. 44cf3a2 (#2848) Don't enable `emailProtection` for server keys. d66def9 (#2848) Only mark `subjectAltName` critical if `subject` is empty. 8174047 (#2848) Migrate `dns-alt-names` back to settings. f18df2b Wire up the `setbycli` slot in Puppet settings. efa61f2 (#2848) rename subject-alt-name option to dns-alt-names f103b20 (#2848) Rename `certdnsnames` to match new behaviour. 363b47b (#2848) Use `certdnsnames` when bootstrapping a local master. 49334ff (#2848) CSR subjectAltNames handling while signing. 5f2af93 (#2848) List subject alt names in output of puppet cert --list bb475ec (#7224) Add a helper to Puppet::SSL::Certificate to retrieve alternate names bab9310 (#2848) Rewrite SSL Certificate Factory, fixing `subjectAltName` leak. fca1ff0 (#2848) Reject unknown (== all) extensions on the CSR. 443a756 (#2848) extract the subjectAltName value from the CSR. 66101f1 (#2848) Set `certdnsnames` values into the CSR. 77b814f (#6928) Don't blow up when the method is undefined... 5427f1e (#6928) backport Symbol#to_proc for Ruby < 1.8.7 6ef1d3a (#6371) Update lastchg field in shadow file on Solaris. c343615 (#10161) Parenthesize method arguments 5721ab9 Maint: Remove duplicate path extension code edc721e (#9636) Always set $CHILD_STATUS when executing on Windows 448d5db (#9636) Fix PATHEXT resolution for paths other than system32 424379d (#9996) Restore functionality for multi-line commands in exec resources ad98d47 (#9831) Standardize Windows provider confining cf8fae2 (#9832) General StoreConfigs regression. 1e8a2cd (#9607) Only validate package source when it is set or needed 0258096 (#9461) Resolve executables using PATHEXT on Windows d78afda (#9938) Allow directory sticky-ness to be set 23b4864 Maint: Document tag metaparameter's ability to take an array b3c0f1d Stub method for getting roles from the user provider 006a128 Set vardir so that msi package provider runs on Windows 4185b4e Add Windows-specific tests when user parameter specified in exec aab6b40 Disable mount provider tests on Windows 58f97e3 Update test due to lack of 'true' on Windows 1fd90c3 Change tests to not use 'mount' provider 220f5e0 Added 'touch' method enabling tests to run on Windows ca0bc4f Change test to not call 'rm -rf' 1883455 Remove 'fails_on_windows' tag for passing tests 0d7c797 (#8414) Create scheduled_task type for use with Windows scheduled tasks 4ddef89 (#8414) Require win32-taskscheduler gem on Windows 0ecf3ab Add ability to look up fully qualified local accounts using Puppet::Util::Adsi.sid_for_account 23d5aeb Add support for displaying hashes to Puppet::Parameter.format_value_for_display f0c3414 Move parameter formatting rules into helper method 845e05b Wrap long lines in Type::Package 18d65ec Whitespace cleanup in Type::SshAuthorizedKey b2e2175 Include necessary Facter stubs f5bc897 Remove test dependencies on QUANTITY of calls 51adf31 Reset the @macosx_version_major variable 4b9dfdd Reset the @job_list variable between tests 446a5bf Remove use of defined?() 0e4079d Use memoization instead of 'unless' 9d504ff (#9796) ssh_authorized_key supports whitespace again 122b8c2 (#9459) Fix problems with Windows 'user' and 'group' providers. ee107cf Use instance variable for job_list d1e0fa1 Refactor launchd provider spec tests 3440c10 Refactor status method 62b8d6b Deprecation Warning if using Facter <= 1.5.5 8a50c3a Test prefetching f09d264 Stub call to Facter a6bc5a5 Optimize @product_version variable af42ff8 Documentation Commit 55610bf Whitespace Commit cf3d378 Change method used to get Fact Value ce776b0 Revert launchd_spec f65b111 Rearrange launchd provider ed90957 First attempt at launchd spec 637b57b Implement Caching 60482f4 Whitespace and Alignment Commit 5b52bd6 Bring up to date with topic branch 27057a6 Maint: Fix the "provider" parameter documentation -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
