Puppet，是基于Ruby的一个工具，您可以集中管理每一个重要方面，您的系统使用的是跨平台的规范语言，管理所有的单独的元素通常聚集在不同的文件，如用户， CRON作业，和主机一起显然离散元素，如包装，服务和文件。

Puppet的简单陈述规范语言的能力提供了强大的classing制定了主机之间的相似之处，同时使他们能够提供尽可能具体的必要的，它依赖的先决条件和对象之间的关系清楚和明确。

2012-08-21发布了最新稳定版2.7.18，上个版本是2012-07-10的2.7.18 经过3个RC.只修正了几个安全Bug.其他产品线还是2012-07-10的2.6.17 下个产品系列3.0已发布了RC3.

完全改进请见 http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.19

Puppet 2.7.19 Release Notes

Ruby 1.9.3 has a different error when require fails.

The text of the error message when load fails has changed, resulting in the
test failing.  This adapts that to catch the different versions, allowing this
to pass in all cases.

(#15291) Add Vendor tag to Puppet spec file

Previously the spec file had no Vendor tag, which left it undefined. This
commit adds a Vendor tag that references the _host_vendor macro, so that it can
be easily set to 'Puppet Labs' internally and customized by users easily. The
Vendor tag makes it easier for users to tell where the package came from.

Add packaging support for fedora 17

This commit modifies the puppet.spec file to use
the ruby vendorlib instead of sitelib if building
for fedora 17, which ships with ruby 1.9. Mostly
borrowed from the official Fedora 17 package.

(#15471) Fix setting mode of last_run_summary

The writlock function didn't work with setting the mode on the
last_run_summary file. This backports some of the work in commit
7d8fd144949f21eff924602c2a6b7f130f1c0b69. Specifically, the changes
from using writelock to replace_file for saving the summary file. This
builds on top of the backport of getting replace_file to work on
windows.

(#15471) Ensure non-root can read report summary

The security fix for locking down the last_run_report, which contains
sensitive information, also locked down the last_run_summary, which does
not contain sensitive information. Unfortunately this file is often used
by monitoring systems so that they can track puppet runs. Since the
agent runs as root and the monitoring systems do not, this caused the
summary to become unreadable by the monitoring systems.

This commit returns the summary to being world readable which undoes
part of the change done in fd44bf5e6d0d360f6a493d663b653c121fa83c3f

Use Win32 API atomic replace in replace_file

The changes to enable Windows support in `replace_file` were not actually
complete, and it didn't work when the file didn't exist - because of
limitations of the emulation done on our side, rather than anything else.

Windows has a bunch of quirks, and Ruby doesn't actually abstract over the
underlying platform a great deal.  We can use the Windows API ReplaceFile, and
MoveFileEx, to achieve the desired behaviour though.

This adds even more conditional code inside the `replace_file` method to
handle multiple platforms - but it really isn't very clean.  Better to get
this working now, then refactor, though.

(#11868) Use Installer automation interface to query package state

Previously, Puppet recorded MSI packages it had installed in a YAML
file. However, if the file was deleted or the system modified, e.g.
Add/Remove Programs, then Puppet did not know the package state had
changed.

Also, if the name of the package did not change across versions, e.g.
VMware Tools, then puppet would report the package as insync even though
the installed version could be different than the one pointed to by the
source parameter.

Also, `msiexec.exe` returns non-zero exit codes when either the package
requests a reboot (194), the system requires a reboot (3010), e.g. due
to a locked file, or the system initiates a reboot (1641). This would
cause puppet to think the install failed, and it would try to reinstall
the packge the next time it ran (since the YAML file didn't get
updated).

This commit changes the msi package provider to use the `Installer`
Automation (COM) interface to query the state of the system[1]. It will
now accurately report on installed packages, even those it did not
install, including Puppet itself (#13444). If a package is removed via
Add/Remove Programs, Puppet will re-install it the next time it runs.

The MSI package provider will now warn in the various reboot scenarios,
but report the overall install/uninstall as successful (#14055).

When using the msi package resource, the resource title should match the
'ProductName' property in the MSI Property table, which is also the
value displayed in Add/Remove Programs, e.g.

    package { 'Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148':
      ensure => installed,
      ...
    }

In cases where the ProductName does not change across versions, e.g.
VMware Tools, you MUST use the PackageCode as the name of the resource
in order for puppet to accurately determine the state of the system:

    package { '{0E3AA38E-EAD3-4348-B5C5-051B6852CED6}':
      ensure => installed,
      ...
    }

You can obtain the PackageCode in ruby using:

    require 'win32ole'
    installer = WIN32OLE.new('WindowsInstaller.Installer')
    db = installer.OpenDatabase(path, 0)
    puts db.SummaryInformation.Property(9)

where <path> is the path to the MSI.

The msi provider does not automatically compare PackageCodes when
determining if the resource is insync, because the source MSI could be
on a network share, and we do not want to copy the potentially large
file just to see if changes need to be made.

The msi provider does not use the `Installer` interface to perform
install and uninstall, because I have not found a way to obtain useful
error codes when reboots are requested. Instead the methods
`InstallProduct` and `ConfigureProduct` raise exceptions with the
general 0x80020009 error, which means 'Exception occurred'. So for now
we continue to use msiexec.exe for install and uninstall, though the msi
provider may not uninstall multi-instance transforms correctly, since
the transform (MST) used to install the package needs to be respecified
during uninstall. This could be resolved by allowing uninstall_options
to be specified, or figuring out how to obtain useful error codes when
using the `Installer` interface.

[1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa369432(v=vs.85).aspx

(#14964) Unlink Tempfiles consistently across different ruby versions

The previous fix for #14964 relied on inconsisent behavior of ruby 1.8's
`Tempfile#close!` method, which is called by `close(true)`.  Although
the ruby documentation says `close!` is the same as `delete` followed by
`unlink`, the exact semantics are different.  The former calls the
Tempfile's finalizer callback directly and can raise an `Errno::EACCES`,
while `unlink` never does.

In ruby 1.9, the `Tempfile#close!` method was changed to call `unlink`,
making the two APIs consistent.  As a result, the begin-ensure block
added previously to fix #14964 was wrong.

Also, previously if the call to `read` failed, then the Tempfile would
not be closed and deleted until its finalizer ran.

This commit changes the `wait_for_output` method to close and unlink the
Tempfile in two steps.  The `unlink` method will not raise an
`Errno::EACCES` in either ruby 1.8 or 1.9.   It also changes the `read`
call to occur within the begin-ensure block, so that the Tempfile is
closed and unlinked as soon as we are done with it.

(Maint) Require the right file for md5

md5 doesn't exist on 1.9.3. It seems to have been an alias in previous
versions of ruby for digest/md5. Requiring the other file directly
allows this to work on all supported rubies.

Don’t allow resource titles which aren’t strings

It was possible to create resources whose titles weren't strings, by
using a variable containing a hash, or the result of a function which
doesn't return a string. This can cause problems resolving relationships
when the stringified version of the title differs between master and
agent.

Now we will only accept primitives, and will stringify them. That is:
string, symbol, number, boolean. Arrays or nested arrays will still be
flattened and used to create multiple resources. Any other value (for
instance: a hash) will cause a parse error.

Eliminate require calls at runtime.

Calling `require` is a surprisingly expensive operation, especially if
ActiveRecord has been loaded.  Consequently, the places where we do that in
the body of a function are hot-spots in the profile.

They are also, generally, pretty simple and clear wins: almost all of them can
simply require the library the first time they are loaded and everything will
work fine.

In my testing with a complex, real-world set of manifests this reduces time
spent by ~ 3 wall-clock seconds in require and all children.

Fix broken ability to remove resources from the catalog.

For the last forever, the Puppet catalog object has unable to remove resources
correctly - they used the wrong key to remove items from an internal map.

Because the test was broken we also ran into a situation where this simply
wasn't noticed - and, presumably, we simply didn't depend on this in the real
world enough to actually discover the failure.

This fixes that, as well as the bad test, to ensure that the feature works
correctly, and that it stays that way.

(#14962) PMT doesn’t support setting a relative modulepath

We previously fixed expansion for the target_dir, but this only worked when the
target_dir was set explicitly, it didn't support relative paths being passed in
the modulepath. This patch fixes that and adds tests.

As a side-effect, this should also fixes cases where the first modulepath
defined in the configuration file is relative.

It also corrects the tests previously applied for expanding the target_dir, as
it used to rely on expanding the target_dir before adding it to the modulepath.
This wasn't necessary, so now we don't bother testing that the targetdir is
expanded in the modulepath after being added.

Acceptance tests have been added for testing modulepath, with absolute
and relative paths.

(#15221) Create /etc/puppet/modules directory for puppet module tool

Previously, this directory was not created by the package,
which caused errors when the puppet module tool was used
to install modules. This commit updates the RPM spec file
to create this directory upon installation of the package.

(#13070) Mark files as loaded before we load

There is a loading cycle that occurs in some situations. It showed up as
not being able to describe certain types because the description
depended on the name of the type's class. For some reason (that is not
entirely clear) the multiple loading of code seems to cause the name of
the class to be wrong.

This patch changes it to mark the file as loaded first, so that we don't
get into a loading cycle.

Extract host validation in store report processor

Extract the validation step and refactor tests around this. Tests now don't
touch the filesystem which avoids a corner case on windows that caused test
failures.

Enforce “must not should” on Puppet::Type instances in tests.

Because we define a `should` method on Puppet::Type, and that conflicts with
the identically named method in RSpec, we have an alias for `must` defined in
the test helper.

Sadly, this isn't *complete*: if you call `should` on those instances you
actually get no failure, it just silently ignores your actual test.

This change monkey-patches Puppet::Type in the spec helper, and adds a type
check to fail hard if you supply something "illegal" as the argument to
Puppet::Type.

(#14531) Change default ensure value from symlink to link

If ensure on a file resource is omitted, puppet will set the should value
to :symlink in the initialize method of the file type but the ensure property
does not use :symlink but :link to identify a link.

As a result, puppet will always treat a resource with a specific target
property but no ensure property as out of sync:

    file { '/tmp/a':
      target => '/tmp/b',
    }

When puppet now calls sync on the ensure property, the fileresource
(`/tmp/a`) is removed first (method `remove_existing`) but we do not
execute the block passed to `newvalue(:link)` to recreate it. Because
there is no `newvalue(:symlink)` block, we instead run the block in
`newvalue(/./)` which is just a dummy and does nothing at all. As a
result puppet will *always* say it created something while in fact
making sure that the resource is *removed*.

Change the default ensure value from :symlink to :link if target is
set.

Upstart code cleanup, init provider improvement

This commit adds an is_init? function to the init provider, to prevent the init
provider from handling upstart jobs redundantly (which happens with services
such as network-interface and network-interface-security). It also adds tests
for the exlusion of instances in the upstart provider and exclusion of upstart
services from the init instances. It also cleans up some upstart provider code
(self.instances, self.search), eliminating redundant code and refactoring some
methods (upstart_status, status, normal_status).
This also removes the custom status command from upstart, which almost
certainly wasn't doing what it was expected. The upstart status command is
effective at gauging the status of upstart services.

Handle network-interface-security in upstart

Similar to network-interface, network-interface-security is an upstart job that
requires special handling to get status information. While network-interface
takes and interface argument, network-interface-security takes a job argument.
This commit adds that special case, and also updates the search method with a
corresponding special case so the jobs can be recognized as upstart jobs.

Add exclude list to upstart provider

The wait-for-state service seems to be a helper that is used by upstart, but
doesn't have a useful status or consistent way to call. Trying to use that
upstart service generally results in an error. This commit adds an exclude list
similar to the redhat provider so that services like 'wait-for-state' can be
excluded from the service instances.

(#15027, #15028, #15029) Fix upstart version parsing

A leading space in the --version argument would confuse upstart, and the
version returned would not always be a semantic version, which caused the
upstart provider to fail. This commit updates the initctl call to remove the
leading space from the --version argument, and also replaces the implicit
SemVer comparisons with wrapper functions that call out to
Puppet::Util::Package.versioncmp to do version comparisons. It also fixes a
subtly broken regex to grab the full version string.

(#13489) Synchronously start and stop services

Previously, we were using the `win32-service` gem to start and stop
services.  It uses Win32 APIs to programmatically send start and stop
requests.  The actual service starts/stops asynchronously with respect
to the request.  As a result, when refreshing a service, puppet would
issue a stop request, immediately followed by a start request, and that
would race as the service would often still be running when the start
request occurred, leading to 'An instance of the service is already
running'.

This commit changes the windows service provider to use `net.exe` to
start and stop services.  This command will block until the service
start/stops, and returns 0 on success, making it easy to adapt to the
provider command pattern.  The one downside is that the exit codes don't
have the same resolution that we can get via the `sc.exe` or by calling
the Service Control Manager programmatically.  But that is not too
critical because we do capture the output of the `net.exe` command, e.g.
'The service name is invalid.' and include it in the exception message.

(#14964) Don’t fail if we can’t unlink the Tempfile on Windows

Previously, if the exec resource created a process, e.g. start.exe, that
executed another process asynchronously, then the grandchild would inherit
the tempfile handle, preventing puppet from being able to unlink it. This
is not an issue on POSIX systems.

This commit changes the `wait_for_output` method to ignore Errno::EACCES
exceptions caused when closing and unlinking the stdout tempfile. The
behavior on POSIX systems is unchanged.

(#14860) Fix puppet cert exit status on failures

Without this patch applied the following command errors out but does not
correctly set the exit status:

    puppet cert generate foo.bar.com --dns_alt_names foo,foo.bar.com

The error returned is:

    err: Could not call generate: CSR 'pe-internal-broker-test'
      contains subject alternative names (DNS:pe-centos6, \
      DNS:pe-centos6.puppetlabs.vm, DNS:pe-internal-broker-test, \
      DNS:stomp), which are disallowed. Use `puppet cert \
      --allow-dns-alt-names sign pe-internal-broker-test` to sign this \
      request.

However, the exit status is 0.

This is a problem because we need to easily detect if certificate
generation from the command line failed or succeeded.  The most natural
and expected way to check this is by looking at the exit status.

The root cause of the problem is that
Puppet::SSL::CertificateAuthority::InterFace#apply incorrectly catches
and masks the exception raised by the generate method because it simply
logs an error with Puppet.err and continues along happily.

This patch fixes the problem by re-raising the error produced by
generate, allowing the application controller to catch the error
appropriately and exit with the non-zero exit status.

(#13379) Add path of pluginsync’d lenses to Augeas load_path automatically

The path $libdir/augeas/lenses is added to the Augeas load_path initialisation
option automatically to support lenses being pluginsynced.  Lenses should be
added into the <module>/lib/augeas/lenses directory inside a module.

The load_path parameter has been expanded to support an array of paths as well
as a colon-separated list.

Fixes for #10915 and #11200 – user provider for AIX

The user provider on AIX fails to set the password for local users using chpasswd. This commit includes the code in ticket #11200 suggested by Josh Cooper. It works in my environment (AIX 5.3 + 6.1). chpasswd can also return 1 even on success; it's not clear if this is by design, as the manpage doesn't mention it. The lack of output from chpasswd indicates success; if there's a problem it dumps output to stderr/stdout.


下载：http://downloads.puppetlabs.com/puppet/puppet-2.7.19.tar.gz