OpenVoxProject/openvox-server 9.0.1

on GitHub

Note: There is no 9.0.0 release and 9.0.1 is the first in the 9.x series

🎉 This is the first release in the OpenVox 9 series! Major thanks to the amazing Vox Pupuli community for making this release happen. This release would not exist without everyone who submitted pull requests, filed bugs, tested pre-releases, and joined the discussions about what should change. 🎉

Major changes:

• Updates JRuby to 10.1 to support Ruby 4
• Adds support for Java 25 and requires either Java 21 or 25
• Platforms removed vs. 8.x:
  • Debian 12
  • Ubuntu 25.04
  • Amazon Linux 2
  • Fedora 42

Breaking changes

• Java 21 or 25 is required. The package depends on a Java 25 or Java 21 runtime package (jre-25-headless or jre-21-headless on EL and Fedora, java-25-openjdk-headless or java-21-openjdk-headless on SLES, java-25-amazon-corretto-headless or java-21-amazon-corretto-headless on Amazon Linux, openjdk-25-jre-headless | openjdk-21-jre-headless on Debian and Ubuntu). Java 25 is preferred everywhere it exists. Some platforms such as EL 8 provide Java 21 only. The FIPS packages run on Java 21 only because the BouncyCastle FIPS libraries are certified up to Java 21. (#336, #675)
• systemd unit changes. The systemd unit runs the JVM directly through /opt/puppetlabs/server/apps/puppetserver/bin/java, a launcher that runs the first installed Java version from the supported list (25, then 21). The unit is Type=notify and systemd reports the service as started only after OpenVox Server is up. On systemd 253 or newer (Debian 13, Ubuntu 24.04 and 26.04, EL 10, Fedora, SLES 16) the unit is Type=notify-reload, whereas EL 8, EL 9, Amazon Linux 2023, SLES 15, Ubuntu 22.04, and the FIPS packages keep the puppetserver reload subcommand behind ExecReload. systemctl reload puppetserver works everywhere. The puppetserver start and puppetserver stop subcommands are removed, use systemctl. puppetserver foreground remains. (#628, #675)
• JAVA_BIN in the defaults file is optional. The shipped /etc/sysconfig/puppetserver and /etc/default/puppetserver no longer set it. An existing JAVA_BIN="/usr/bin/java" line from an 8.x install is ignored. Any other JAVA_BIN value is used as it is, so it must point at Java 21 or 25. JAVA_ARGS, JAVA_ARGS_CLI, and TK_ARGS work as before. The unit adds --add-opens java.base/sun.nio.ch=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --enable-native-access=ALL-UNNAMED through JAVA_ARGS_DIST, and -Djruby.logger.class=...Slf4jLogger is no longer part of the default JAVA_ARGS. (#613, #629)
• JRuby 10.1. Server side Ruby code (functions, report processors, custom types and providers used during compilation, gems installed with puppetserver gem) runs on JRuby 10.1, which targets Ruby 4.0. (#468, #525, #655)
• Filebucket reads require an administrative certificate. The default auth.conf allows GET and POST on /puppet/v3/file_bucket_file only to certificates with the pp_cli_auth extension. Agents keep HEAD and PUT, which is all they need to store backups. Sites that restore or diff filebucket content remotely with an ordinary agent certificate need their own rule for that certname. (#549)
• gettext is no longer vendored with the JRuby gems. (#98)
• The package requires openvox-agent 9.0.0 or newer (9.0.0-rc1 or newer in package terms). (#624)
• The pe_serverversion fact is removed. (#247)
• Reports are off by default on the server because of the agent change to the reports setting described above.

Other changes

• The server can clear its own environment cache after a code deployment: the default auth.conf allows DELETE /puppet-admin-api/v1/environment-cache for certificates with the pp_cli_auth extension, which the server's own certificate carries. This lets an r10k or g10k post-deploy hook call the API with the server's certificate. (#640)
• Requests that include the system trust store, such as report processors posting to external HTTPS endpoints, fall back to the PEM bundle at /opt/puppetlabs/puppet/ssl/cert.pem now that the agent runtime no longer ships a Java keystore. This fixes PKIX path building failed errors seen with the early 9.0 betas. (#558)
• puppetserver gem, puppetserver ruby, and puppetserver irb use JRuby's standard error logger again instead of printing debug logging, and puppetserver gem list works on Java 21 and newer. (#614, #613)
• The uberjar no longer contains JRuby's Windows binaries and rdoc, which makes it smaller. (#321)

CVEs fixed since 8.16.0

Note about FIPS packages

Currently, the FIPS packages ship an outdated version of the Bouncy Castle 1.x versions of the jars. The latest Bouncy Castle FIPS 1.x release has a small issue that could cause problems in a very constrained, non-default configuration, so we are not updating to it. Instead, openvox-server 9.1 will move to the Bouncy Castle FIPS 2.x line, which is the one fully certified for FIPS on Java 21.

What's Changed

Breaking Changes 🛠

• Update to jetty12 by @austb in #217
• remove pe_serverversion fact by @corporate-gadfly in #247
• Mark java 25 as supported & Drop support for Java 17 by @bastelfreak in #336
• CI: Stop building packages for Debian 11 & 12 by @bastelfreak in #343
• CI: Stop building on amazon-2 by @bastelfreak in #349
• JRUBY 10, YO by @Sharpie in #468
• Depend on openvox-agent >=9.0.0~beta1 by @Sharpie in #495
• Update Jruby 10.0.6.0 to 10.1.1.0 (MRI 3.4 -> 4.0) by @renovate[bot] in #525
• Restrict filebucket reads to pp_cli_auth certificates by @silug in #549
• drop gettext from jruby gems by @jcharaoui in #98
• Update to EZbake 4.1.0 by @Sharpie in #628

New Features 🎉

• exclude jruby windows binaries and rdoc artifacts from uberjar by @corporate-gadfly in #321
• Support podman in tasks/build.rake by @gregorynisbet-google in #227
• Inform trapperkeeper about service readiness by @bastelfreak in #465
• Rebrand Puppet Server -> OpenVox Server in docs and comments by @silug in #544
• openvox-agent: require 9.0.0~beta2 by @bastelfreak in #551
• Fall back to the vendored PEM CA bundle for the system trust store by @silug in #558
• packages: depend on openvox-agent >= 9.0.0~rc1 by @bastelfreak in #624
• allow primary to clean jrubies code cache after code deployment by @marcusdots in #640
• Update JRuby 10.1.1.0 -> 10.1.2.0 by @renovate[bot] in #655

Bug Fixes 🐛

• Download SLES RPM macros to aid in expansion of macros by @corporate-gadfly in #344
• isolate SLES RPM macros in /opt/suse-rpm-macros by @corporate-gadfly in #346
• add jruby-openssl 0.16.0 to vendored gems by @corporate-gadfly in #324
• Fix Jolokia 2.x configuration by @Sharpie in #377
• Ensure "gem install" works during FIPS builds by @Sharpie in #517
• Fix Resolv regression when querying IPv6 DNS servers by @Sharpie in #537
• fix: match pre-release tarballs by base version on upload by @slauger in #550
• Fix the report authorization test's is_pe? misfire by @silug in #557
• Revert "Inform trapperkeeper about service readiness" by @bastelfreak in #610
• Use StandardErrorLogger for ruby subcommands by @Sharpie in #614
• Add missing JRuby security flags for Java 21+ by @corporate-gadfly in #613

Dependency Updates ⬆️

• Update clj-rbac-client to 1.3.0 by @nmburgan in #303
• Update dependency ring:ring-core to v1.15.4 by @renovate[bot] in #309
• Update dependency org.clojure:tools.namespace to v1 by @renovate[bot] in #137
• Update dependency net.logstash.logback:logstash-logback-encoder to v9 by @renovate[bot] in #174
• Update dependency org.openvoxproject:trapperkeeper-webserver to v12.0.1 by @renovate[bot] in #308
• Update dependency org.openvoxproject:trapperkeeper-webserver to v12.0.2 by @renovate[bot] in #318
• Update dependency org.clojure:clojure to v1.12.5 by @renovate[bot] in #314
• Update slf4j-version to v2.0.18 by @renovate[bot] in #315
• Update dependency org.ow2.asm:asm to v9.10 by @renovate[bot] in #319
• Update dependency org.openvoxproject:trapperkeeper to v5.0.1 by @renovate[bot] in #298
• Update dependency org.ow2.asm:asm to v9.10.1 by @renovate[bot] in #327
• Update jackson-version to v2.21.4 by @renovate[bot] in #333
• Update logback-version to v1.5.33 by @renovate[bot] in #328
• Update dependency com.fasterxml.jackson.core:jackson-annotations to v2.22 by @renovate[bot] in #337
• Update dependency org.openvoxproject:trapperkeeper-webserver to v12.0.3 by @renovate[bot] in #340
• Update logback-version to v1.5.34 by @renovate[bot] in #339
• Update jackson-version to v2.22.0 by @renovate[bot] in #338
• Update dependency org.openvoxproject:trapperkeeper to v5.0.2 by @renovate[bot] in #364
• Update logback-version to v1.5.35 by @renovate[bot] in #369
• Update dependency ring:ring-core to v1.15.5 by @renovate[bot] in #373
• Update dependency org.openvoxproject:http-client to v2.3.1 by @renovate[bot] in #378
• openvoxserver-ca: Update 3.2.0->3.2.1 by @bastelfreak in #387
• Update logback-version to v1.5.37 (main) by @renovate[bot] in #396
• Update dependency org.openvoxproject:jruby-utils to v5.4.1 (main) by @renovate[bot] in #415
• Update dependency org.openvoxproject:trapperkeeper to v5.0.3 (main) by @renovate[bot] in #418
• feat: add vendored rubygem lists to renovate by @rwaffen in #439
• ci: fix renovate regex. by @rwaffen in #441
• Update dependency rake to v13.4.2 (main) by @renovate[bot] in #448
• Update EZbake version to 2.8.0 by @Sharpie in #466
• Update dependency ch.qos.logback.access:logback-access-jetty12 to v2.0.13 (main) by @renovate[bot] in #473
• Update dependency ch.qos.logback.access:logback-access-common to v2.0.13 (main) by @renovate[bot] in #472
• Update logback-version to v1.5.38 (main) by @renovate[bot] in #474
• Update dependency gettext to v3.5.2 (main) by @renovate[bot] in #442
• Update dependency locale to v2.1.5 (main) by @renovate[bot] in #443
• Update dependency org.openvoxproject:ssl-utils to v3.7.0 (main) by @renovate[bot] in #499
• Update dependency org.openvoxproject:http-client to v2.4.0 (main) by @renovate[bot] in #500
• Update dependency org.openvoxproject:trapperkeeper-webserver to v12.1.0 (main) by @renovate[bot] in #502
• Update dependency org.openvoxproject:trapperkeeper-authorization to v2.4.0 (main) by @renovate[bot] in #501
• Update dependency ch.qos.logback.access:logback-access-jetty12 to v2.0.14 (main) by @renovate[bot] in #521
• Update logback-version to v1.6.0 (main) by @renovate[bot] in #523
• Update dependency ch.qos.logback.access:logback-access-common to v2.0.14 (main) by @renovate[bot] in #520
• Update logback-version to v1.6.1 (main) by @renovate[bot] in #540
• Update dependency commons-codec:commons-codec to v1.22.1 (main) by @renovate[bot] in #542
• Update dependency openvoxserver-ca to v3.3.0 (main) by @renovate[bot] in #546
• Update dependency concurrent-ruby to v1.3.8 (main) by @renovate[bot] in #497
• Update logback-version to v1.6.2 (main) by @renovate[bot] in #562
• Update dependency prismatic:schema to v1.4.2 (main) by @renovate[bot] in #561
• Update dependency org.openvoxproject:clj-shell-utils to v2.2.1 (main) by @renovate[bot] in #563
• Update dependency org.openvoxproject:jruby-utils to v7.0.2 (main) by @renovate[bot] in #566
• Update dependency org.openvoxproject:i18n to v1.0.5 (main) by @renovate[bot] in #565
• Update dependency org.openvoxproject:comidi to v1.1.4 (main) by @renovate[bot] in #564
• Update dependency org.openvoxproject:trapperkeeper-filesystem-watcher to v1.6.1 (main) by @renovate[bot] in #577
• Update dependency org.openvoxproject:trapperkeeper-scheduler to v1.4.1 (main) by @renovate[bot] in #579
• Update dependency org.openvoxproject:http-client to v2.4.1 (main) by @renovate[bot] in #572
• Update dependency org.openvoxproject:trapperkeeper to v5.0.5 (main) by @renovate[bot] in #575
• Update dependency org.openvoxproject:trapperkeeper-metrics to v2.3.2 (main) by @renovate[bot] in #578
• Update dependency org.openvoxproject:trapperkeeper-authorization to v2.4.1 (main) - autoclosed by @renovate[bot] in #576
• Update dependency org.openvoxproject:kitchensink to v3.5.8 (main) by @renovate[bot] in #567
• Update dependency org.openvoxproject:ring-middleware to v2.2.1 (main) by @renovate[bot] in #573
• Update dependency org.openvoxproject:ssl-utils to v3.7.1 (main) by @renovate[bot] in #574
• Update dependency org.openvoxproject:trapperkeeper-webserver to v12.1.1 (main) by @renovate[bot] in #580
• Update dependency org.openvoxproject:trapperkeeper-status to v1.5.1 (main) by @renovate[bot] in #592
• Update dependency org.openvoxproject:trapperkeeper-comidi-metrics to v1.1.1 (main) by @renovate[bot] in #593
• Update jackson updates to v2.21.6 (main) by @renovate[bot] in #601
• Update logback-version to v1.6.3 (main) by @renovate[bot] in #602
• Update dependency ch.qos.logback.access:logback-access-common to v2.0.15 (main) by @renovate[bot] in #598
• Update dependency ch.qos.logback.access:logback-access-jetty12 to v2.0.15 (main) by @renovate[bot] in #599
• Update dependency org.openvoxproject:jruby-utils to v7.0.3 (main) by @renovate[bot] in #611
• Update dependency org.clojure:clojure to v1.12.6 (main) by @renovate[bot] in #618
• Update dependency org.openvoxproject:trapperkeeper to v5.0.6 (main) by @renovate[bot] in #620
• Update slf4j-version to v2.0.19 (main) by @renovate[bot] in #622
• Update dependency org.yaml:snakeyaml to v2.7 (main) by @renovate[bot] in #616
• Update dependency org.openvoxproject:trapperkeeper-metrics to v2.3.3 (main) by @renovate[bot] in #648
• Update jackson updates to v2.21.7 (main) by @renovate[bot] in #653
• Update slf4j-version to v2.0.20 (main) by @renovate[bot] in #659
• Update dependency org.openvoxproject:i18n to v1.0.6 (main) by @renovate[bot] in #658
• Update logback-version to v1.6.4 (main) by @renovate[bot] in #668
• Update dependency org.bouncycastle:bcpkix-jdk18on to v1.86 (main) by @renovate[bot] in #637

Other Changes

• Target openvox9 platform for main branch by @nmburgan in #296
• Update acceptance descriptions and defaults for OpenVox 9 by @nmburgan in #297
• Migrate config to use trapperkeeper-webserver by @nmburgan in #299
• Use Ruby 4 for builder image and cache it by @nmburgan in #311
• build: Switch to alma 10 / Java 21 / system Ruby by @bastelfreak in #330
• Provide --format='{{json .ID}}' when listing docker images. by @gregorynisbet-google in #332
• CI: Add Java 25 by @bastelfreak in #335
• feat: simplify container build by using ADD, list packages more readable by @rwaffen in #342
• Dockerfile: Dont install vim & Replace java-21-openjdk-devel->java-21-openjdk-headless by @bastelfreak in #345
• Readd workflow to backport PRs by @bastelfreak in #347
• CI: test building on Fedora 44 by @bastelfreak in #348
• Explicitly check out main branch during backports by @Sharpie in #379
• Add arm64 support to acceptance by @jpartlow in #374
• renovate: set automergeStrategy by @bastelfreak in #425
• Update jackson updates to v2.21.5 (main) by @renovate[bot] in #430
• Upgrade JRuby 9.4.12.1->9.4.15.0 by @Sharpie in #434
• Upgrade concurrent-ruby 1.3.5->1.3.7 by @Sharpie in #435
• fix regex to accept 3 multi-digit version string by @corporate-gadfly in #469
• Update acceptance tests for compatibility with latest OpenVox 9 by @Sharpie in #470
• acceptance: Run tests against Postgres 17 by @Sharpie in #479
• Build JARs with Java version based on branch by @Sharpie in #483
• Update dependency org.bouncycastle:bcpkix-jdk18on to v1.85 (main) by @renovate[bot] in #489
• Add acceptance test coverage for long certnames by @Sharpie in #509
• replace puppetlabs.com docs link with openvoxproject.org by @corporate-gadfly in #519
• Fix the filebucket read authorization test by @silug in #556
• Clean up obsolete Slf4jLogger configuration by @Sharpie in #629
• Use ezbake 4.2.0, declare supported Java versions, remove cruft by @nmburgan in #675
• Add jruby-openssl to gem list by @nmburgan in #676
• Smoke testing for PRs or local tests by @nmburgan in #679
• Gate the gem subcommand test on FIPS mode by @nmburgan in #681

New Contributors

• @austb made their first contribution in #217
• @gregorynisbet-google made their first contribution in #332
• @Tonguechaude made their first contribution in #334
• @silug made their first contribution in #427
• @marcusdots made their first contribution in #642

Full Changelog: 8.13.0...9.0.1