标签：#puppet

AI-Powered Privacy Policy Generators LLM‑driven privacy policy generators have moved from experimental prototypes to production‑grade services in 2026, offering on‑demand, jurisdiction‑aware drafts that can be directly embedded into compliance pipelines. Tools such as PrivacyGPT and PolicyCraft combine retrieval‑augmented generation with rule‑extraction models, turning natural‑language privacy intents into enforceable policy clauses that can be exported as JSON‑LD or plain‑text templates. Deep Dive Architecture PrivacyGPT leverages a hybrid architecture: a domain‑specific transformer fine‑tuned on 10 million privacy statements, paired with a deterministic rule engine that maps extracted obligations to GDPR, CCPA, and emerging AI‑Act provisions. PolicyCraft adds a feedback loop where the generated draft is automatically validated against an internal compliance knowledge graph; mismatches trigger a self‑correcting prompt that iteratively refines the text until a confidence score above 92 % is achieved. Real-World Engineering Examples A fintech startup integrated PrivacyGPT via its CI/CD pipeline; each pull request that modifies data‑collection code triggers an API call that updates the “Data Retention” clause, keeping the public policy in sync with code changes. A multinational e‑commerce platform deployed PolicyCraft to generate locale‑specific consent banners; the system produced 27 variants in under five minutes, each certified against the EU’s Digital Services Act. Zero‑Trust Architecture for Rule Enforcement Zero‑trust architecture (ZTA) starts from the assumption that no network segment—whether on‑prem, cloud, or edge—can be implicitly trusted. Instead of a perimeter, every request is evaluated against a continuously refreshed identity profile that fuses user credentials, device posture, and behavioral risk scores. In practice, this means deploying a Policy Decision Point (PDP) that consumes attributes from an identity provider, a device‑trust service, and a tel

Did you know there's a new major version in town for Puppet Core? You might have heard about it through the grapevine or in the Are You Ready for Puppet 9? webinar that @gpatton and I recently hosted. The wait is over and Puppet Core 9.0.0 is now available alongside Puppet Core 8.21.0. Puppet Core 9 introduces significant runtime and platform changes, moving to Ruby 4.0, OpenSSL 3.5, and other changes, but the essential Puppet under the hood is largely unchanged from Puppet 8. The majority of upgrade effort will center on Ruby 4 compatibility and runtime dependency changes rather than Puppet language changes. If you are staying on the Puppet Core 8.x release track, the latest Puppet Core 8.21 delivers the basic support fixes and security improvements you might need without the major dependency changes found in Puppet Core 9. What matters most for the admins Before upgrading to Puppet Core 9: Test custom facts, functions, types, and providers against Ruby 4.0. Validate any Forge modules you use for Ruby 4 compatibility. Review integrations that depend on OpenSSL behavior. Verify any workflows that still rely on SHA-1. Confirm managed nodes are running supported operating systems. Review any custom code that depends on PSON or multi_json . Check deferred function behavior if you have custom types or providers. Perforce will be rolling out updates to Puppetlabs modules on the Forge based on their priority tier and dependencies. The first batch of these should be rolling out soon. Puppet Core 9.0 highlights These are a few highlights I pulled from the release notes. Make sure to reference the full 9.0 release notes to get all the details about what has changed! Ruby updated to 4.0.5: With a new Ruby baseline some deprecated syntax from older Ruby versions will no longer be compatible. This is the primary focus area for upgrades as you will want to validate your custom code and modules. The latest PDK 3.8.0 introduced some Ruby 4 validators to help you update your syntax

If you've ever tried to turn a modern web page into a PDF programmatically, you've probably hit the wall: the file comes out blank, half-empty, or frozen on a loading spinner. The page looks perfect in the browser, so what gives? The answer is timing. Most PDF approaches grab the HTML before the JavaScript has rendered the content. On a server-rendered page that's fine — the markup is already there. On a React/Vue/Angular app, the server sends an near-empty shell and the browser builds the DOM afterward. Capture too early and you save the shell. Here's how to do it properly. Why the naive approaches fail wkhtmltopdf is the classic Google answer. It's fast and it's been around forever, but it uses an ancient WebKit build with effectively no modern JavaScript support. For a static page it's fine. For anything client-rendered, it captures the empty state. Browser window.print() / Ctrl+P works because it is a real browser — but it's manual, single-page, and impossible to automate cleanly at scale. Hitting the raw HTML with an HTTP client (axios/fetch then pipe to a PDF lib) has the same fatal flaw as wkhtmltopdf : no JS execution, no rendered content. What you actually need is a real browser engine that runs the page's JavaScript, waits for it to settle, and then prints. That's Puppeteer. The Puppeteer approach Puppeteer drives a headless Chromium. It executes the page exactly like a normal Chrome tab, so whatever renders on screen is what you capture. const puppeteer = require ( ' puppeteer ' ); async function pageToPdf ( url , outPath ) { const browser = await puppeteer . launch ({ args : [ ' --no-sandbox ' , ' --disable-setuid-sandbox ' ], // needed in most containers }); const page = await browser . newPage (); await page . goto ( url , { waitUntil : ' networkidle0 ' , timeout : 60000 }); await page . pdf ({ path : outPath , format : ' A4 ' , printBackground : true , // otherwise CSS backgrounds/colors are dropped margin : { top : ' 20px ' , bottom : ' 20px ' , left

The tech world has been building up towards the shift to a fully agentic development life cycle for a few years now. AI is changing how software gets built. Across the Puppet ecosystem, we're seeing a shift toward more agentic engineering workflows. AI helps generate code, shape documentation, and accelerate how Puppet modules evolve. This brings real benefits in speed and consistency, but it also raises important questions from the community: How are AI-generated changes validated? How do you ensure consistency across modules? What does this mean for contributors and maintainers? These are exactly the kinds of questions we should be asking! This article will outline how Perforce and the Puppet team are approaching the use of AI in our open source modules and repositories. How We Build Trust in AI-Assisted Contributions At Perforce, AI is a core part of our process and our teams operate within a defined, governed framework for development. We don’t rely on trust in the tool itself. We rely on the processes around it. Whether a change is written by a person, generated with AI, or some mix of both, they are held to the same standards before it’s accepted and released. In practice, that means: Human review is always the gate: Every change is reviewed by maintainers. AI can assist, but it doesn’t replace accountability. AI works within established patterns: AI-generated code isn’t created in isolation. It’s guided by the same module structures, conventions, and expectations that already exist across the ecosystem. Validation is continuous and enforced: AI doesn’t change our standards. It reinforces them. AI-generated changes go through the same checks as any other contribution: Test suites Integration validation Functional verification AI output is a starting point, not a final artifact: Generated code is iterated on, refined, and aligned before acceptance. We treat AI as an accelerator, not an authority. The community plays an important role Open source means visibilit

Cross-posted from the HTML to Image blog , where the original lives. Browsershot is the package most Laravel developers reach for when they need to turn HTML into an image. It wraps Puppeteer, drives real Chrome and produces pixel-accurate output. On your machine it works first time. Then you deploy, and the first render throws Failed to launch the browser process! . The problem is not Browsershot's code. The problem is what it demands from the machine it runs on. What Browsershot actually asks of your server Browsershot is a PHP package with a second runtime hiding inside it. To run it in production you need Node.js, the Puppeteer npm package, a Chrome or Chromium binary, the long tail of shared libraries Chrome links against ( libnss3 , libatk , libgbm and friends on a slim Debian image) and a font set wide enough to cover whatever your templates contain, emoji included. That is manageable on a full VPS you control. It falls apart in the places Laravel apps increasingly run: Laravel Vapor and serverless. The PHP Lambda runtime ships neither Node nor Chrome, and you cannot apt-get your way out of a Lambda. The Puppeteer on Lambda guide covers just how deep that particular hole goes. Shared and managed hosting. No root, no system packages, no browser binary. Browsershot is simply off the table. Slim Docker images. php:8.3-fpm-alpine carries none of Chrome's dependencies. Adding Chromium, its libraries and fonts costs a few hundred megabytes and a permanent maintenance line in your Dockerfile. CI pipelines , where every job downloads a browser before your test suite can touch a render. The dependency does not stay contained either. Even Spatie's newer packages inherit it: spatie/laravel-og-image renders through laravel-screenshot , which drives Browsershot underneath, so the Node and Chrome requirement follows the whole family wherever it goes. The usual workarounds The first workaround is the fat container: bake Chromium, the shared libraries and a font stack into y

The latest Puppet Enterprise releases are out and this one has a huge load of improvements, fixes, and security patches included! Puppet Enterprise (PE) 2025.11 released! The full PE 2025.11 release notes are always the best way to get a full detail on what has changed, but here are some highlights of PE 2025.11! Certificate Authority (CA): Database-backed Storage This new optional feature adds support for storing CA data in a PostgreSQL database instead of the file system. This improves performance and reliability and introduces API-driven capabilities and enhanced backup and recovery handling. PostgreSQL 17 Supported PE-managed installations will automatically upgrade from verson 14 to 17 as part of the upgrade process, or you can update yourself before upgrading to PE 2025.11 Infra Assistant Goes GPT-5 GPT-5 series models are now running under the hood of Infra Assistant, improving the quality of responses and the consistency for queries. Advanced Patching Enhancements The advanced patching feature now has improvements across a variety of areas New puppet_run_concurrency setting allows you to get better performance out of patch group enrollment Improved validation of scheduled and immediate jobs to reduce risk of unintended or skipped executions. Cron scheduling has better user experience and improved validation across features. New configurable option to enable Puppet to run after patch jobs to refresh pe_patch facts New Endpoints for Classifier and Activity Service APIs The Classifier API introduced new tags , add-tags and remove-tags endpoints to manage node group tags. The Activity service API now has subscriptions endpoints to create subscriptions, list subscriptions, or fetch/delete a specific subscription. Agent Platform Updates, Resolved Issues, and Security Fixes The macOS 26 platform is now supported for both ARM and x86_64, while support has been removed for Ubuntu 18.04 and Ubuntu 20.04. Nearly 60 CVEs were addressed in this release, along with many r

This time around we look back at May 2026 and the 11 Puppetlabs module releases on the Forge, with an emphasis on the changes most likely to matter in active environments. Highlighted Updates New Windows audit policy module released! The new audit_policy module has been released by Perforce as a Ruby replacement for the generated DSC community auditpolicydsc module . This module uses Puppet Resources API for managing Windows audit policy using auditpol.exe ruby_task_helper Dependency Bound Update Five Bolt-adjacent modules all bumped the ruby_task_helper upper bound to < 2.0.0 in a coordinated maintenance pass, helping with dependency resolution failures when using Bolt 5.x. Affected modules: vault, terraform, http_request, gcloud_inventory, azure_inventory. CentOS 9 Support Multiple modules added explicit CentOS 9 compatibility, expanding the Linux platform coverage in line with the broader Puppet ecosystem push. Affected modules: concat, inifile. What Updates Happened to Puppetlabs Modules in May 2026? The following is an alphabetical listing of modules which received updates in May 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available. apt 11.3.1 📅 Latest release: 2026-05-19 (🌐 View on the Forge ) This release introduced an explicit hash value syntax while also adding a param to support purging keyrings and other community contributions. Includes monthly releases: 11.3.1 (2026-05-19), 11.3.0 (2026-05-18). Use explicit hash value syntax instead of shorthand #1285 ( SugatD ) Add param for purging keyrings #1266 ( bwitt ) Include components when suite does not end with slash #1259 ( bwitt ) Bugfix - sources format and ensure => absent fails #1243 ( traylenator ) fix: allow plus signs in ppa #1222 ( moritz-makandra ) Fix and improve DEB822-style template #1212 ( smortex ) audit_policy 1.0.0 🌟 New Module: 2026-05-29 (🌐 View on the Forge ) This new module allows you to manage Windows audit pol