bolt 0.20.0 → 0.20.2

data/vendored/puppet/lib/puppet/provider/service/windows.rb

@@ -0,0 +1,106 @@
+# Windows Service Control Manager (SCM) provider
+
+Puppet::Type.type(:service).provide :windows, :parent => :service do
+
+  desc <<-EOT
+    Support for Windows Service Control Manager (SCM). This provider can
+    start, stop, enable, and disable services, and the SCM provides working
+    status methods for all services.
+
+    Control of service groups (dependencies) is not yet supported, nor is running
+    services as a specific user.
+  EOT
+
+  defaultfor :operatingsystem => :windows
+  confine    :operatingsystem => :windows
+
+  has_feature :refreshable
+
+  commands :net => 'net.exe'
+
+  def enable
+    w32ss = Win32::Service.configure( 'service_name' => @resource[:name], 'start_type' => Win32::Service::SERVICE_AUTO_START )
+    raise Puppet::Error.new("Win32 service enable of #{@resource[:name]} failed" ) if( w32ss.nil? )
+  rescue => detail
+    raise Puppet::Error.new("Cannot enable #{@resource[:name]}, error was: #{detail}", detail )
+  end
+
+  def disable
+    w32ss = Win32::Service.configure( 'service_name' => @resource[:name], 'start_type' => Win32::Service::SERVICE_DISABLED )
+    raise Puppet::Error.new("Win32 service disable of #{@resource[:name]} failed" ) if( w32ss.nil? )
+  rescue => detail
+    raise Puppet::Error.new("Cannot disable #{@resource[:name]}, error was: #{detail}", detail )
+  end
+
+  def manual_start
+    w32ss = Win32::Service.configure( 'service_name' => @resource[:name], 'start_type' => Win32::Service::SERVICE_DEMAND_START )
+    raise Puppet::Error.new("Win32 service manual enable of #{@resource[:name]} failed" ) if( w32ss.nil? )
+  rescue => detail
+    raise Puppet::Error.new("Cannot enable #{@resource[:name]} for manual start, error was: #{detail}", detail )
+  end
+
+  def enabled?
+    w32ss = Win32::Service.config_info( @resource[:name] )
+    raise Puppet::Error.new("Win32 service query of #{@resource[:name]} failed" ) unless( !w32ss.nil? && w32ss.instance_of?( Struct::ServiceConfigInfo ) )
+    debug("Service #{@resource[:name]} start type is #{w32ss.start_type}")
+    case w32ss.start_type
+      when Win32::Service.get_start_type(Win32::Service::SERVICE_AUTO_START),
+           Win32::Service.get_start_type(Win32::Service::SERVICE_BOOT_START),
+           Win32::Service.get_start_type(Win32::Service::SERVICE_SYSTEM_START)
+        :true
+      when Win32::Service.get_start_type(Win32::Service::SERVICE_DEMAND_START)
+        :manual
+      when Win32::Service.get_start_type(Win32::Service::SERVICE_DISABLED)
+        :false
+      else
+        raise Puppet::Error.new("Unknown start type: #{w32ss.start_type}")
+    end
+  rescue => detail
+    raise Puppet::Error.new("Cannot get start type for #{@resource[:name]}, error was: #{detail}", detail )
+  end
+
+  def start
+    if enabled? == :false
+      # If disabled and not managing enable, respect disabled and fail.
+      if @resource[:enable].nil?
+        raise Puppet::Error, "Will not start disabled service #{@resource[:name]} without managing enable. Specify 'enable => false' to override."
+      # Otherwise start. If enable => false, we will later sync enable and
+      # disable the service again.
+      elsif @resource[:enable] == :true
+        enable
+      else
+        manual_start
+      end
+    end
+
+    net(:start, @resource[:name])
+  rescue Puppet::ExecutionFailure => detail
+    raise Puppet::Error.new("Cannot start #{@resource[:name]}, error was: #{detail}", detail )
+  end
+
+  def stop
+    net(:stop, @resource[:name])
+  rescue Puppet::ExecutionFailure => detail
+    raise Puppet::Error.new("Cannot stop #{@resource[:name]}, error was: #{detail}", detail )
+  end
+
+  def status
+    w32ss = Win32::Service.status( @resource[:name] )
+    raise Puppet::Error.new("Win32 service query of #{@resource[:name]} failed" ) unless( !w32ss.nil? && w32ss.instance_of?( Struct::ServiceStatus ) )
+    state = case w32ss.current_state
+      when "stopped", "pause pending", "stop pending", "paused" then :stopped
+      when "running", "continue pending", "start pending"       then :running
+      else
+        raise Puppet::Error.new("Unknown service state '#{w32ss.current_state}' for service '#{@resource[:name]}'")
+    end
+    debug("Service #{@resource[:name]} is #{w32ss.current_state}")
+    return state
+  rescue => detail
+    raise Puppet::Error.new("Cannot get status of #{@resource[:name]}, error was: #{detail}", detail )
+  end
+
+  # returns all providers for all existing services and startup state
+  def self.instances
+    Win32::Service.services.collect { |s| new(:name => s.service_name) }
+  end
+end

data/vendored/puppet/lib/puppet/provider/ssh_authorized_key/parsed.rb

@@ -0,0 +1,105 @@
+require 'puppet/provider/parsedfile'
+
+Puppet::Type.type(:ssh_authorized_key).provide(
+  :parsed,
+  :parent         => Puppet::Provider::ParsedFile,
+  :filetype       => :flat,
+  :default_target => ''
+) do
+  desc "Parse and generate authorized_keys files for SSH."
+
+  text_line :comment, :match => /^\s*#/
+  text_line :blank, :match => /^\s*$/
+
+  record_line :parsed,
+    :fields   => %w{options type key name},
+    :optional => %w{options},
+    :rts => /^\s+/,
+    :match    => Puppet::Type.type(:ssh_authorized_key).keyline_regex,
+    :post_parse => proc { |h|
+      h[:name] = "" if h[:name] == :absent
+      h[:options] ||= [:absent]
+      h[:options] = Puppet::Type::Ssh_authorized_key::ProviderParsed.parse_options(h[:options]) if h[:options].is_a? String
+    },
+    :pre_gen => proc { |h|
+      # if this name was generated, don't write it back to disk
+      h[:name] = "" if h[:unnamed]
+      h[:options] = [] if h[:options].include?(:absent)
+      h[:options] = h[:options].join(',')
+    }
+
+  record_line :key_v1,
+    :fields   => %w{options bits exponent modulus name},
+    :optional => %w{options},
+    :rts      => /^\s+/,
+    :match    => /^(?:(.+) )?(\d+) (\d+) (\d+)(?: (.+))?$/
+
+  def dir_perm
+    0700
+  end
+
+  def file_perm
+    0600
+  end
+
+  def user
+    uid = Puppet::FileSystem.stat(target).uid
+    Etc.getpwuid(uid).name
+  end
+
+  def flush
+    raise Puppet::Error, "Cannot write SSH authorized keys without user"    unless @resource.should(:user)
+    raise Puppet::Error, "User '#{@resource.should(:user)}' does not exist" unless Puppet::Util.uid(@resource.should(:user))
+    # ParsedFile usually calls backup_target much later in the flush process,
+    # but our SUID makes that fail to open filebucket files for writing.
+    # Fortunately, there's already logic to make sure it only ever happens once,
+    # so calling it here suppresses the later attempt by our superclass's flush method.
+    self.class.backup_target(target)
+
+    Puppet::Util::SUIDManager.asuser(@resource.should(:user)) do
+        unless Puppet::FileSystem.exist?(dir = File.dirname(target))
+          Puppet.debug "Creating #{dir} as #{@resource.should(:user)}"
+          Dir.mkdir(dir, dir_perm)
+        end
+
+        super
+
+        File.chmod(file_perm, target)
+    end
+  end
+
+  # Parse sshv2 option strings, which is a comma-separated list of
+  # either key="values" elements or bare-word elements
+  def self.parse_options(options)
+    result = []
+    scanner = StringScanner.new(options)
+    while !scanner.eos?
+      scanner.skip(/[ \t]*/)
+      # scan a long option
+      if out = scanner.scan(/[-a-z0-9A-Z_]+=\".*?[^\\]\"/) or out = scanner.scan(/[-a-z0-9A-Z_]+/)
+        result << out
+      else
+        # found an unscannable token, let's abort
+        break
+      end
+      # eat a comma
+      scanner.skip(/[ \t]*,[ \t]*/)
+    end
+    result
+  end
+
+  def self.prefetch_hook(records)
+    name_index = 0
+    records.each do |record|
+      if record[:record_type] == :parsed && record[:name].empty?
+        record[:unnamed] = true
+        # Generate a unique ID for unnamed keys, in case they need purging.
+        # If you change this, you have to keep
+        # Puppet::Type::User#unknown_keys_in_file in sync! (PUP-3357)
+        record[:name] = "#{record[:target]}:unnamed-#{ name_index += 1 }"
+        Puppet.debug("generating name for on-disk ssh_authorized_key #{record[:key]}: #{record[:name]}")
+      end
+    end
+  end
+end
+

data/vendored/puppet/lib/puppet/provider/sshkey/parsed.rb

@@ -0,0 +1,50 @@
+require 'puppet/provider/parsedfile'
+
+Puppet::Type.type(:sshkey).provide(
+  :parsed,
+  :parent => Puppet::Provider::ParsedFile,
+  :filetype => :flat
+) do
+  desc "Parse and generate host-wide known hosts files for SSH."
+
+  text_line :comment, :match => /^#/
+  text_line :blank, :match => /^\s*$/
+
+  record_line :parsed, :fields => %w{name type key},
+    :post_parse => proc { |hash|
+      names = hash[:name].split(",", -1)
+      hash[:name]  = names.shift
+      hash[:host_aliases] = names
+    },
+    :pre_gen => proc { |hash|
+      if hash[:host_aliases]
+        hash[:name] = [hash[:name], hash[:host_aliases]].flatten.join(",")
+        hash.delete(:host_aliases)
+      end
+    }
+
+  # Make sure to use mode 644 if ssh_known_hosts is newly created
+  def self.default_mode
+    0644
+  end
+
+  def self.default_target
+    case Facter.value(:operatingsystem)
+    when "Darwin"
+      # Versions 10.11 and up use /etc/ssh/ssh_known_hosts
+      version = Facter.value(:macosx_productversion_major)
+      if version
+        if Puppet::Util::Package.versioncmp(version, '10.11') >= 0
+          "/etc/ssh/ssh_known_hosts"
+        else
+          "/etc/ssh_known_hosts"
+        end
+      else
+        "/etc/ssh_known_hosts"
+      end
+    else
+      "/etc/ssh/ssh_known_hosts"
+    end
+  end
+end
+

data/vendored/puppet/lib/puppet/provider/user/aix.rb

@@ -0,0 +1,383 @@
+#
+# User Puppet provider for AIX. It uses standard commands to manage users:
+#  mkuser, rmuser, lsuser, chuser
+#
+# Notes:
+# - AIX users can have expiry date defined with minute granularity,
+#   but puppet does not allow it. There is a ticket open for that (#5431)
+# - AIX maximum password age is in WEEKs, not days
+#
+# See  https://docs.puppetlabs.com/guides/provider_development.html
+# for more information
+#
+# Author::    Hector Rivas Gandara <keymon@gmail.com>
+#
+require 'puppet/provider/aixobject'
+require 'tempfile'
+require 'date'
+
+Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
+  desc "User management for AIX."
+
+  # This will the default provider for this platform
+  defaultfor :operatingsystem => :aix
+  confine :operatingsystem => :aix
+
+  # Commands that manage the element
+  commands :list      => "/usr/sbin/lsuser"
+  commands :add       => "/usr/bin/mkuser"
+  commands :delete    => "/usr/sbin/rmuser"
+  commands :modify    => "/usr/bin/chuser"
+
+  commands :lsgroup   => "/usr/sbin/lsgroup"
+  commands :chpasswd  => "/bin/chpasswd"
+
+  # Provider features
+  has_features :manages_aix_lam
+  has_features :manages_homedir, :manages_passwords, :manages_shell
+  has_features :manages_expiry,  :manages_password_age
+
+  # Attribute verification (TODO)
+  #verify :gid, "GID must be a string or int of a valid group" do |value|
+  #  value.is_a? String || value.is_a? Integer
+  #end
+  #
+  #verify :groups, "Groups must be comma-separated" do |value|
+  #  value !~ /\s/
+  #end
+
+  # User attributes to ignore from AIX output.
+  def self.attribute_ignore
+    ["name"]
+  end
+
+  # AIX attributes to properties mapping.
+  #
+  # Valid attributes to be managed by this provider.
+  # It is a list with of hash
+  #  :aix_attr      AIX command attribute name
+  #  :puppet_prop   Puppet property name
+  #  :to            Method to adapt puppet property to aix command value. Optional.
+  #  :from          Method to adapt aix command value to puppet property. Optional
+  self.attribute_mapping = [
+    {:aix_attr => :pgrp,       :puppet_prop => :gid,
+                                :to => :gid_to_attr,
+                                :from => :gid_from_attr },
+    {:aix_attr => :id,         :puppet_prop => :uid},
+    {:aix_attr => :groups,     :puppet_prop => :groups},
+    {:aix_attr => :home,       :puppet_prop => :home},
+    {:aix_attr => :shell,      :puppet_prop => :shell},
+    {:aix_attr => :expires,    :puppet_prop => :expiry,
+                                :to => :expiry_to_attr,
+                                :from => :expiry_from_attr },
+    {:aix_attr => :maxage,     :puppet_prop => :password_max_age},
+    {:aix_attr => :minage,     :puppet_prop => :password_min_age},
+    {:aix_attr => :pwdwarntime, :puppet_prop => :password_warn_days},
+    {:aix_attr => :attributes, :puppet_prop => :attributes},
+    { :aix_attr => :gecos,      :puppet_prop => :comment },
+  ]
+
+  #--------------
+  # Command definition
+
+  # Return the IA module arguments based on the resource param ia_load_module
+  def get_ia_module_args
+    if @resource[:ia_load_module]
+      ["-R", @resource[:ia_load_module].to_s]
+    else
+      []
+    end
+  end
+
+  # List groups and Ids
+  def lsgroupscmd(value=@resource[:name])
+    [command(:lsgroup)] +
+      self.get_ia_module_args +
+      ["-a", "id", value]
+  end
+
+  def lscmd(value=@resource[:name])
+    [self.class.command(:list), "-c"] + self.get_ia_module_args + [ value]
+  end
+
+  def lsallcmd()
+    lscmd("ALL")
+  end
+
+  def addcmd(extra_attrs = [])
+    # Here we use the @resource.to_hash to get the list of provided parameters
+    # Puppet does not call to self.<parameter>= method if it does not exists.
+    #
+    # It gets an extra list of arguments to add to the user.
+    [self.class.command(:add)] + self.get_ia_module_args +
+      self.hash2args(@resource.to_hash) +
+      extra_attrs + [@resource[:name]]
+  end
+
+  # Get modify command. Set translate=false if no mapping must be used.
+  # Needed for special properties like "attributes"
+  def modifycmd(hash = property_hash)
+    args = self.hash2args(hash)
+    return nil if args.empty?
+
+    [self.class.command(:modify)] + self.get_ia_module_args +
+      args + [@resource[:name]]
+  end
+
+  def deletecmd
+    [self.class.command(:delete)] + self.get_ia_module_args + [@resource[:name]]
+  end
+
+  #--------------
+  # We overwrite the create function to change the password after creation.
+  def create
+    super
+    # Reset the password if needed
+    self.password = @resource[:password] if @resource[:password]
+  end
+
+
+  def get_arguments(key, value, mapping, objectinfo)
+    # In the case of attributes, return a list of key=vlaue
+    if key == :attributes
+      unless value and value.is_a? Hash
+        raise Puppet::Error, _("Attributes must be a list of pairs key=value on %{class_name}[%{resource_name}]") %
+            { class_name: @resource.class.name, resource_name: @resource.name }
+      end
+      return value.map { |k,v| k.to_s.strip + "=" + v.to_s.strip}
+    end
+
+    super(key, value, mapping, objectinfo)
+  end
+
+  # Get the groupname from its id
+  def groupname_by_id(gid)
+    groupname=nil
+    execute(lsgroupscmd("ALL")).each_line { |entry|
+      attrs = self.parse_attr_list(entry, nil)
+      if attrs and attrs.include? :id and gid == attrs[:id].to_i
+        groupname = entry.split(" ")[0]
+      end
+    }
+    groupname
+  end
+
+  # Get the groupname from its id
+  def groupid_by_name(groupname)
+    attrs = self.parse_attr_list(execute(lsgroupscmd(groupname)).split("\n")[0], nil)
+    attrs ? attrs[:id].to_i : nil
+  end
+
+  # Check that a group exists and is valid
+  def verify_group(value)
+    if value.is_a? Integer
+      groupname = groupname_by_id(value)
+      #TRANSLATORS 'AIX' is the name of the operating system and should not be translated
+      raise ArgumentError, _("AIX group must be a valid existing group") unless groupname
+    else
+      #TRANSLATORS 'AIX' is the name of the operating system and should not be translated
+      raise ArgumentError, _("AIX group must be a valid existing group") unless groupid_by_name(value)
+      groupname = value
+    end
+    groupname
+  end
+
+  # The user's primary group.  Can be specified numerically or by name.
+  def gid_to_attr(value)
+    verify_group(value)
+  end
+
+  # Get the group gid from its name
+  def gid_from_attr(value)
+    groupid_by_name(value)
+  end
+
+  # The expiry date for this user. Must be provided in
+  # a zero padded YYYY-MM-DD HH:MM format
+  def expiry_to_attr(value)
+    # For chuser the expires parameter is a 10-character string in the MMDDhhmmyy format
+    # that is,"%m%d%H%M%y"
+    newdate = '0'
+    if value.is_a? String and value!="0000-00-00"
+      d = DateTime.parse(value, "%Y-%m-%d %H:%M")
+      newdate = d.strftime("%m%d%H%M%y")
+    end
+    newdate
+  end
+
+  def expiry_from_attr(value)
+    if value =~ /(..)(..)(..)(..)(..)/
+      #d= DateTime.parse("20#{$5}-#{$1}-#{$2} #{$3}:#{$4}")
+      #expiry_date = d.strftime("%Y-%m-%d %H:%M")
+      #expiry_date = d.strftime("%Y-%m-%d")
+      expiry_date = "20#{$5}-#{$1}-#{$2}"
+    else
+      unless value == '0'
+        #TRANSLATORS 'AIX' is the name of an operating system and should not be translated
+        Puppet.warn(_("Could not convert AIX expires date '%{value}' on %{class_name}[%{resource_name}]") %
+                        { value: value, class_name: @resource.class.name, resource_name: @resource.name })
+      end
+      expiry_date = :absent
+    end
+    expiry_date
+  end
+
+  def open_security_passwd
+    # helper method for tests
+    # AIX reference indicates this file is ASCII
+    # https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.files/passwd_security.htm
+    Puppet::FileSystem.open("/etc/security/passwd", nil, "r:ASCII")
+  end
+
+  #--------------------------------
+  # Getter and Setter
+  # When the provider is initialized, create getter/setter methods for each
+  # property our resource type supports.
+  # If setter or getter already defined it will not be overwritten
+
+  #- **password**
+  #    The user's password, in whatever encrypted format the local machine
+  #    requires. Be sure to enclose any value that includes a dollar sign ($)
+  #    in single quotes (').  Requires features manages_passwords.
+  #
+  # Retrieve the password parsing directly the /etc/security/passwd
+  def password
+    password = :absent
+    user = @resource[:name]
+    f = open_security_passwd
+    # Skip to the user
+    f.each_line { |l| break if l  =~ /^#{user}:\s*$/ }
+    if ! f.eof?
+      f.each_line { |l|
+        # If there is a new user stanza, stop
+        break if l  =~ /^\S*:\s*$/
+        # If the password= entry is found, return it, stripping trailing space
+        if l  =~ /^\s*password\s*=\s*(\S*)\s*$/
+          password = $1; break;
+        end
+      }
+    end
+    f.close()
+    return password
+  end
+
+  def password=(value)
+    user = @resource[:name]
+
+    # Puppet execute does not support strings as input, only files.
+    # The password is expected to be in an encrypted format given -e is specified:
+    # https://www.ibm.com/support/knowledgecenter/ssw_aix_71/com.ibm.aix.cmds1/chpasswd.htm
+    # /etc/security/passwd is specified as an ASCII file per the AIX documentation
+    tmpfile = Tempfile.new("puppet_#{user}_pw", :encoding => Encoding::ASCII)
+    tmpfile << "#{user}:#{value}\n"
+    tmpfile.close()
+
+    # Options '-e', '-c', use encrypted password and clear flags
+    # Must receive "user:enc_password" as input
+    # command, arguments = {:failonfail => true, :combine => true}
+    # Fix for bugs #11200 and #10915
+    cmd = [self.class.command(:chpasswd), get_ia_module_args, '-e', '-c', user].flatten
+    begin
+      output = execute(cmd, {:failonfail => false, :combine => true, :stdinfile => tmpfile.path })
+      # chpasswd can return 1, even on success (at least on AIX 6.1); empty output indicates success
+      if output != ""
+        raise Puppet::ExecutionFailure, "chpasswd said #{output}"
+      end
+    rescue Puppet::ExecutionFailure  => detail
+      raise Puppet::Error, "Could not set #{param} on #{@resource.class.name}[#{@resource.name}]: #{detail}", detail.backtrace
+    ensure
+      tmpfile.delete()
+    end
+  end
+
+  def managed_attribute_keys(hash)
+    managed_attributes ||= @resource.original_parameters[:attributes] || hash.keys.map{|k| k.to_s}
+    managed_attributes = [managed_attributes] unless managed_attributes.is_a?(Array)
+    managed_attributes.map {|attr| key, _ = attr.split("="); key.strip.to_sym}
+  end
+
+  def should_include?(key, managed_keys)
+    !self.class.attribute_mapping_from.include?(key) and
+            !self.class.attribute_ignore.include?(key) and
+            managed_keys.include?(key)
+  end
+
+  def filter_attributes(hash)
+    # Return only managed attributes.
+    managed_keys = managed_attribute_keys(hash)
+    results = hash.select {
+        |k,v| should_include?(k, managed_keys)
+      }.inject({}) {
+        |h, array| h[array[0]] = array[1]; h
+      }
+    results
+  end
+
+  def attributes
+    filter_attributes(getosinfo(false))
+  end
+
+  def attributes=(attr_hash)
+    #self.class.validate(param, value)
+    param = :attributes
+    cmd = modifycmd({param => filter_attributes(attr_hash)})
+    if cmd
+      begin
+        execute(cmd)
+      rescue Puppet::ExecutionFailure  => detail
+        raise Puppet::Error, "Could not set #{param} on #{@resource.class.name}[#{@resource.name}]: #{detail}", detail.backtrace
+      end
+    end
+  end
+
+  # UNSUPPORTED
+  #- **profile_membership**
+  #    Whether specified roles should be treated as the only roles
+  #    of which the user is a member or whether they should merely
+  #    be treated as the minimum membership list.  Valid values are
+  #    `inclusive`, `minimum`.
+  # UNSUPPORTED
+  #- **profiles**
+  #    The profiles the user has.  Multiple profiles should be
+  #    specified as an array.  Requires features manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **project**
+  #    The name of the project associated with a user  Requires features
+  #    manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **role_membership**
+  #    Whether specified roles should be treated as the only roles
+  #    of which the user is a member or whether they should merely
+  #    be treated as the minimum membership list.  Valid values are
+  #    `inclusive`, `minimum`.
+  # UNSUPPORTED
+  #- **roles**
+  #    The roles the user has.  Multiple roles should be
+  #    specified as an array.  Requires features manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **key_membership**
+  #    Whether specified key value pairs should be treated as the only
+  #    attributes
+  #    of the user or whether they should merely
+  #    be treated as the minimum list.  Valid values are `inclusive`,
+  #    `minimum`.
+  # UNSUPPORTED
+  #- **keys**
+  #    Specify user attributes in an array of keyvalue pairs  Requires features
+  #    manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **allowdupe**
+  #  Whether to allow duplicate UIDs.  Valid values are `true`, `false`.
+  # UNSUPPORTED
+  #- **auths**
+  #    The auths the user has.  Multiple auths should be
+  #    specified as an array.  Requires features manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **auth_membership**
+  #    Whether specified auths should be treated as the only auths
+  #    of which the user is a member or whether they should merely
+  #    be treated as the minimum membership list.  Valid values are
+  #    `inclusive`, `minimum`.
+  # UNSUPPORTED
+
+end