bolt 0.20.0 → 0.20.2

data/vendored/puppet/lib/puppet/indirector/errors.rb

@@ -0,0 +1,5 @@
+require 'puppet/error'
+
+module Puppet::Indirector
+  class ValidationError < Puppet::Error; end
+end

data/vendored/puppet/lib/puppet/indirector/exec.rb

@@ -0,0 +1,38 @@
+require 'puppet/indirector/terminus'
+require 'puppet/util'
+
+class Puppet::Indirector::Exec < Puppet::Indirector::Terminus
+  # Look for external node definitions.
+  def find(request)
+    name = request.key
+    external_command = command
+
+    # Make sure it's an array
+    raise Puppet::DevError, _("Exec commands must be an array") unless external_command.is_a?(Array)
+
+    # Make sure it's fully qualified.
+    raise ArgumentError, _("You must set the exec parameter to a fully qualified command") unless Puppet::Util.absolute_path?(external_command[0])
+
+    # Add our name to it.
+    external_command << name
+    begin
+      output = execute(external_command, :failonfail => true, :combine => false)
+    rescue Puppet::ExecutionFailure => detail
+      raise Puppet::Error, _("Failed to find %{name} via exec: %{detail}") % { name: name, detail: detail }, detail.backtrace
+    end
+
+    if output =~ /\A\s*\Z/ # all whitespace
+      Puppet.debug "Empty response for #{name} from #{self.name} terminus"
+      return nil
+    else
+      return output
+    end
+  end
+
+  private
+
+  # Proxy the execution, so it's easier to test.
+  def execute(command, arguments)
+    Puppet::Util::Execution.execute(command,arguments)
+  end
+end

data/vendored/puppet/lib/puppet/indirector/face.rb

@@ -0,0 +1,153 @@
+require 'puppet/face'
+
+class Puppet::Indirector::Face < Puppet::Face
+  option "--terminus _" + _("TERMINUS") do
+    summary _("The indirector terminus to use.")
+    description <<-EOT
+      Indirector faces expose indirected subsystems of Puppet. These
+      subsystems are each able to retrieve and alter a specific type of data
+      (with the familiar actions of `find`, `search`, `save`, and `destroy`)
+      from an arbitrary number of pluggable backends. In Puppet parlance,
+      these backends are called terminuses.
+
+      Almost all indirected subsystems have a `rest` terminus that interacts
+      with the puppet master's data. Most of them have additional terminuses
+      for various local data models, which are in turn used by the indirected
+      subsystem on the puppet master whenever it receives a remote request.
+
+      The terminus for an action is often determined by context, but
+      occasionally needs to be set explicitly. See the "Notes" section of this
+      face's manpage for more details.
+    EOT
+
+    before_action do |action, args, options|
+      set_terminus(options[:terminus])
+    end
+
+    after_action do |action, args, options|
+      indirection.reset_terminus_class
+    end
+  end
+
+  def self.indirections
+    Puppet::Indirector::Indirection.instances.collect { |t| t.to_s }.sort
+  end
+
+  def self.terminus_classes(indirection)
+    Puppet::Indirector::Terminus.terminus_classes(indirection.to_sym).collect { |t| t.to_s }.sort
+  end
+
+  def call_indirection_method(method, key, options)
+    begin
+      if method == :save
+        # key is really the instance to save
+        result = indirection.__send__(method, key, nil, options)
+      else
+        result = indirection.__send__(method, key, options)
+      end
+    rescue => detail
+      message = _("Could not call '%{method}' on '%{indirection}': %{detail}") % { method: method, indirection: indirection_name, detail: detail }
+      Puppet.log_exception(detail, message)
+      raise RuntimeError, message, detail.backtrace
+    end
+
+    return result
+  end
+
+  option "--extra " + _("HASH") do
+    summary _("Extra arguments to pass to the indirection request")
+    description <<-EOT
+      A terminus can take additional arguments to refine the operation, which
+      are passed as an arbitrary hash to the back-end.  Anything passed as
+      the extra value is just send direct to the back-end.
+    EOT
+    default_to do Hash.new end
+  end
+
+  action :destroy do
+    summary _("Delete an object.")
+    arguments _("<key>")
+    when_invoked {|key, options| call_indirection_method :destroy, key, options[:extra] }
+  end
+
+  action :find do
+    summary _("Retrieve an object by name.")
+    arguments _("[<key>]")
+    when_invoked do |*args|
+      # Default the key to Puppet[:certname] if none is supplied
+      if args.length == 1
+        key = Puppet[:certname]
+        options = args.last
+      else
+        key, options = *args
+      end
+      call_indirection_method :find, key, options[:extra]
+    end
+  end
+
+  action :save do
+    summary _("API only: create or overwrite an object.")
+    arguments _("<key>")
+    description <<-EOT
+      API only: create or overwrite an object. As the Faces framework does not
+      currently accept data from STDIN, save actions cannot currently be invoked
+      from the command line.
+    EOT
+    when_invoked {|key, options| call_indirection_method :save, key, options[:extra] }
+  end
+
+  action :search do
+    summary _("Search for an object or retrieve multiple objects.")
+    arguments _("<query>")
+    when_invoked {|key, options| call_indirection_method :search, key, options[:extra] }
+  end
+
+  # Print the configuration for the current terminus class
+  action :info do
+    summary _("Print the default terminus class for this face.")
+    description <<-EOT
+      Prints the default terminus class for this subcommand. Note that different
+      run modes may have different default termini; when in doubt, specify the
+      run mode with the '--run_mode' option.
+    EOT
+
+    when_invoked do |options|
+      if t = indirection.terminus_class
+        _("Run mode '%{mode}': %{terminus}") % { mode: Puppet.run_mode.name, terminus: t }
+      else
+        _("No default terminus class for run mode '%{mode}'") % { mode: Puppet.run_mode.name }
+      end
+    end
+  end
+
+  attr_accessor :from
+
+  def indirection_name
+    @indirection_name || name.to_sym
+  end
+
+  # Here's your opportunity to override the indirection name.  By default it
+  # will be the same name as the face.
+  def set_indirection_name(name)
+    @indirection_name = name
+  end
+
+  # Return an indirection associated with a face, if one exists;
+  # One usually does.
+  def indirection
+    unless @indirection
+      @indirection = Puppet::Indirector::Indirection.instance(indirection_name)
+      @indirection or raise _("Could not find terminus for %{indirection}") % { indirection: indirection_name }
+    end
+    @indirection
+  end
+
+  def set_terminus(from)
+    begin
+      indirection.terminus_class = from
+    rescue => detail
+      msg = _("Could not set '%{indirection}' terminus to '%{from}' (%{detail}); valid terminus types are %{types}") % { indirection: indirection.name, from: from, detail: detail, types: self.class.terminus_classes(indirection.name).join(", ") }
+      raise detail, msg, detail.backtrace
+    end
+  end
+end

data/vendored/puppet/lib/puppet/indirector/facts/facter.rb

@@ -0,0 +1,88 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/code'
+
+class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
+  desc "Retrieve facts from Facter.  This provides a somewhat abstract interface
+    between Puppet and Facter.  It's only `somewhat` abstract because it always
+    returns the local host's facts, regardless of what you attempt to find."
+
+  def allow_remote_requests?
+    false
+  end
+
+  def destroy(facts)
+    raise Puppet::DevError, _('You cannot destroy facts in the code store; it is only used for getting facts from Facter')
+  end
+
+  def save(facts)
+    raise Puppet::DevError, _('You cannot save facts to the code store; it is only used for getting facts from Facter')
+  end
+
+  # Lookup a host's facts up in Facter.
+  def find(request)
+    Facter.reset
+
+    # Note: we need to setup puppet's external search paths before adding the puppetversion
+    # fact. This is because in Facter 2.x, the first `Facter.add` causes Facter to create
+    # its directory loaders which cannot be changed, meaning other external facts won't
+    # be resolved. (PUP-4607)
+    self.class.setup_external_search_paths(request)
+    self.class.setup_search_paths(request)
+
+    # Initialize core Puppet facts, such as puppetversion
+    Puppet.initialize_facts
+
+    result = Puppet::Node::Facts.new(request.key, Facter.to_hash)
+    result.add_local_facts
+    result.sanitize
+    result
+  end
+
+  def self.setup_search_paths(request)
+    # Add any per-module fact directories to facter's search path
+    dirs = request.environment.modulepath.collect do |dir|
+      ['lib', 'plugins'].map do |subdirectory|
+        Dir.glob("#{dir}/*/#{subdirectory}/facter")
+      end
+    end.flatten + Puppet[:factpath].split(File::PATH_SEPARATOR)
+
+    dirs = dirs.select do |dir|
+      next false unless FileTest.directory?(dir)
+
+      # Even through we no longer directly load facts in the terminus,
+      # print out each .rb in the facts directory as module
+      # developers may find that information useful for debugging purposes
+      if Puppet::Util::Log.sendlevel?(:info)
+        Puppet.info _("Loading facts")
+        Dir.glob("#{dir}/*.rb").each do |file|
+          Puppet.debug "Loading facts from #{file}"
+        end
+      end
+
+      true
+    end
+
+    Facter.search(*dirs)
+  end
+
+  def self.setup_external_search_paths(request)
+    # Add any per-module external fact directories to facter's external search path
+    dirs = []
+    request.environment.modules.each do |m|
+      if m.has_external_facts?
+        dir = m.plugin_fact_directory
+        Puppet.debug "Loading external facts from #{dir}"
+        dirs << dir
+      end
+    end
+
+    # Add system external fact directory if it exists
+    if FileTest.directory?(Puppet[:pluginfactdest])
+      dir = Puppet[:pluginfactdest]
+      Puppet.debug "Loading external facts from #{dir}"
+      dirs << dir
+    end
+
+    Facter.search_external dirs
+  end
+end

data/vendored/puppet/lib/puppet/indirector/facts/memory.rb

@@ -0,0 +1,9 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/memory'
+
+class Puppet::Node::Facts::Memory < Puppet::Indirector::Memory
+  desc "Keep track of facts in memory but nowhere else.  This is used for
+    one-time compiles, such as what the stand-alone `puppet` does.
+    To use this terminus, you must load it with the data you want it
+    to contain."
+end

data/vendored/puppet/lib/puppet/indirector/facts/network_device.rb

@@ -0,0 +1,27 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/code'
+
+class Puppet::Node::Facts::NetworkDevice < Puppet::Indirector::Code
+  desc "Retrieve facts from a network device."
+
+  def allow_remote_requests?
+    false
+  end
+
+  # Look a device's facts up through the current device.
+  def find(request)
+    result = Puppet::Node::Facts.new(request.key, Puppet::Util::NetworkDevice.current.facts)
+
+    result.add_local_facts
+    result.sanitize
+    result
+  end
+
+  def destroy(facts)
+    raise Puppet::DevError, _("You cannot destroy facts in the code store; it is only used for getting facts from a remote device")
+  end
+
+  def save(facts)
+    raise Puppet::DevError, _("You cannot save facts to the code store; it is only used for getting facts from a remote device")
+  end
+end

data/vendored/puppet/lib/puppet/indirector/facts/rest.rb

@@ -0,0 +1,21 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/rest'
+
+class Puppet::Node::Facts::Rest < Puppet::Indirector::REST
+  desc "Find and save facts about nodes over HTTP via REST."
+
+  def save(request)
+    raise ArgumentError, _("PUT does not accept options") unless request.options.empty?
+
+    response = do_request(request) do |req|
+      http_put(req, IndirectedRoutes.request_to_uri(req), req.instance.render, headers.merge({ "Content-Type" => req.instance.mime }))
+    end
+
+    if is_http_200?(response)
+      content_type, body = parse_response(response)
+      deserialize_save(content_type, body)
+    else
+      raise convert_to_http_error(response)
+    end
+  end
+end

data/vendored/puppet/lib/puppet/indirector/facts/store_configs.rb

@@ -0,0 +1,11 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/store_configs'
+
+class Puppet::Node::Facts::StoreConfigs < Puppet::Indirector::StoreConfigs
+
+  desc %q{Part of the "storeconfigs" feature. Should not be directly set by end users.}
+
+  def allow_remote_requests?
+    false
+  end
+end

data/vendored/puppet/lib/puppet/indirector/facts/yaml.rb

@@ -0,0 +1,82 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/yaml'
+
+class Puppet::Node::Facts::Yaml < Puppet::Indirector::Yaml
+  desc "Store client facts as flat files, serialized using YAML, or
+    return deserialized facts from disk."
+
+  def search(request)
+    node_names = []
+    Dir.glob(yaml_dir_path).each do |file|
+      facts = YAML.load_file(file)
+      node_names << facts.name if node_matches?(facts, request.options)
+    end
+    node_names
+  end
+
+  private
+
+  # Return the path to a given node's file.
+  def yaml_dir_path
+    base = Puppet.run_mode.master? ? Puppet[:yamldir] : Puppet[:clientyamldir]
+    File.join(base, 'facts', '*.yaml')
+  end
+
+  def node_matches?(facts, options)
+    options.each do |key, value|
+      type, name, operator = key.to_s.split(".")
+      operator ||= 'eq'
+
+      return false unless node_matches_option?(type, name, operator, value, facts)
+    end
+    return true
+  end
+
+  def node_matches_option?(type, name, operator, value, facts)
+    case type
+    when "meta"
+      case name
+      when "timestamp"
+        compare_timestamp(operator, facts.timestamp, Time.parse(value))
+      end
+    when "facts"
+      compare_facts(operator, facts.values[name], value)
+    end
+  end
+
+  def compare_facts(operator, value1, value2)
+    return false unless value1
+
+    case operator
+    when "eq"
+      value1.to_s == value2.to_s
+    when "le"
+      value1.to_f <= value2.to_f
+    when "ge"
+      value1.to_f >= value2.to_f
+    when "lt"
+      value1.to_f < value2.to_f
+    when "gt"
+      value1.to_f > value2.to_f
+    when "ne"
+      value1.to_s != value2.to_s
+    end
+  end
+
+  def compare_timestamp(operator, value1, value2)
+    case operator
+    when "eq"
+      value1 == value2
+    when "le"
+      value1 <= value2
+    when "ge"
+      value1 >= value2
+    when "lt"
+      value1 < value2
+    when "gt"
+      value1 > value2
+    when "ne"
+      value1 != value2
+    end
+  end
+end

data/vendored/puppet/lib/puppet/indirector/file_bucket_file/file.rb

@@ -0,0 +1,262 @@
+require 'puppet/indirector/code'
+require 'puppet/file_bucket/file'
+require 'puppet/util/checksums'
+require 'puppet/util/diff'
+require 'fileutils'
+
+module Puppet::FileBucketFile
+  class File < Puppet::Indirector::Code
+    include Puppet::Util::Checksums
+    include Puppet::Util::Diff
+
+    desc "Store files in a directory set based on their checksums."
+
+    def find(request)
+      request.options[:bucket_path] ||= Puppet[:bucketdir]
+      # If filebucket mode is 'list'
+      if request.options[:list_all]
+        return nil unless ::File.exists?(request.options[:bucket_path])
+        return list(request)
+      end
+      checksum, files_original_path = request_to_checksum_and_path(request)
+      contents_file = path_for(request.options[:bucket_path], checksum, 'contents')
+      paths_file = path_for(request.options[:bucket_path], checksum, 'paths')
+
+      if Puppet::FileSystem.exist?(contents_file) && matches(paths_file, files_original_path)
+        if request.options[:diff_with]
+          other_contents_file = path_for(request.options[:bucket_path], request.options[:diff_with], 'contents')
+          raise _("could not find diff_with %{diff}") % { diff: request.options[:diff_with] } unless Puppet::FileSystem.exist?(other_contents_file)
+          raise _("Unable to diff on this platform") unless Puppet[:diff] != ""
+          return diff(Puppet::FileSystem.path_string(contents_file), Puppet::FileSystem.path_string(other_contents_file))
+        else
+          #TRANSLATORS "FileBucket" should not be translated
+          Puppet.info _("FileBucket read %{checksum}") % { checksum: checksum }
+          model.new(Puppet::FileSystem.binread(contents_file))
+        end
+      else
+        nil
+      end
+    end
+
+    def list(request)
+      if request.remote?
+        raise Puppet::Error, _("Listing remote file buckets is not allowed")
+      end
+
+      fromdate = request.options[:fromdate] || "0:0:0 1-1-1970"
+      todate = request.options[:todate] || Time.now.strftime("%F %T")
+      begin
+        to = Time.parse(todate)
+      rescue ArgumentError
+        raise Puppet::Error, _("Error while parsing 'todate'")
+      end
+      begin
+        from = Time.parse(fromdate)
+      rescue ArgumentError
+        raise Puppet::Error, _("Error while parsing 'fromdate'")
+      end
+      # Setting hash's default value to [], needed by the following loop
+      bucket = Hash.new {[]}
+      msg = ""
+      # Get all files with mtime between 'from' and 'to'
+      Pathname.new(request.options[:bucket_path]).find { |item|
+        if item.file? and item.basename.to_s == "paths"
+          filenames = item.read.strip.split("\n")
+          filestat = Time.parse(item.stat.mtime.to_s)
+          if from <= filestat and filestat <= to
+            filenames.each do |filename|
+              bucket[filename] += [[ item.stat.mtime , item.parent.basename ]]
+            end
+          end
+        end
+      }
+      # Sort the results
+      bucket.each { |filename, contents|
+        contents.sort_by! do |item|
+          # NOTE: Ruby 2.4 may reshuffle item order even if the keys in sequence are sorted already
+          item[0]
+        end
+      }
+      # Build the output message. Sorted by names then by dates
+      bucket.sort.each { |filename,contents|
+        contents.each { |mtime, chksum|
+          date = mtime.strftime("%F %T")
+          msg += "#{chksum} #{date} #{filename}\n"
+        }
+      }
+      return model.new(msg)
+    end
+
+    def head(request)
+      checksum, files_original_path = request_to_checksum_and_path(request)
+      contents_file = path_for(request.options[:bucket_path], checksum, 'contents')
+      paths_file = path_for(request.options[:bucket_path], checksum, 'paths')
+
+      Puppet::FileSystem.exist?(contents_file) && matches(paths_file, files_original_path)
+    end
+
+    def save(request)
+      instance = request.instance
+      _, files_original_path = request_to_checksum_and_path(request)
+      contents_file = path_for(instance.bucket_path, instance.checksum_data, 'contents')
+      paths_file = path_for(instance.bucket_path, instance.checksum_data, 'paths')
+
+      save_to_disk(instance, files_original_path, contents_file, paths_file)
+
+      # don't echo the request content back to the agent
+      model.new('')
+    end
+
+    def validate_key(request)
+      # There are no ACLs on filebucket files so validating key is not important
+    end
+
+    private
+
+    # @param paths_file [Object] Opaque file path
+    # @param files_original_path [String]
+    #
+    def matches(paths_file, files_original_path)
+      # Puppet will have already written the paths_file in the systems encoding
+      # given its possible that request.options[:bucket_path] or Puppet[:bucketdir]
+      # contained characters in an encoding that are not represented the
+      # same way when the bytes are decoded as UTF-8, continue using system encoding
+      Puppet::FileSystem.open(paths_file, 0640, 'a+:external') do |f|
+        path_match(f, files_original_path)
+      end
+    end
+
+    def path_match(file_handle, files_original_path)
+      return true unless files_original_path # if no path was provided, it's a match
+      file_handle.rewind
+      file_handle.each_line do |line|
+        return true if line.chomp == files_original_path
+      end
+      return false
+    end
+
+    # @param bucket_file [Puppet::FileBucket::File] IO object representing
+    #   content to back up
+    # @param files_original_path [String] Path to original source file on disk
+    # @param contents_file [Pathname] Opaque file path to intended backup
+    #   location
+    # @param paths_file [Pathname] Opaque file path to file containing source
+    #   file paths on disk
+    # @return [void]
+    # @raise [Puppet::FileBucket::BucketError] on possible sum collision between
+    #   existing and new backup
+    # @api private
+    def save_to_disk(bucket_file, files_original_path, contents_file, paths_file)
+      Puppet::Util.withumask(0007) do
+        unless Puppet::FileSystem.dir_exist?(paths_file)
+          Puppet::FileSystem.dir_mkpath(paths_file)
+        end
+
+        # Puppet will have already written the paths_file in the systems encoding
+        # given its possible that request.options[:bucket_path] or Puppet[:bucketdir]
+        # contained characters in an encoding that are not represented the
+        # same way when the bytes are decoded as UTF-8, continue using system encoding
+        Puppet::FileSystem.exclusive_open(paths_file, 0640, 'a+:external') do |f|
+          if Puppet::FileSystem.exist?(contents_file)
+            if verify_identical_file(contents_file, bucket_file)
+              #TRANSLATORS "FileBucket" should not be translated
+              Puppet.info _("FileBucket got a duplicate file %{file_checksum}") % { file_checksum: bucket_file.checksum }
+              # Don't touch the contents file on Windows, since we can't update the
+              # mtime of read-only files there.
+              if !Puppet::Util::Platform.windows?
+                Puppet::FileSystem.touch(contents_file)
+              end
+            elsif contents_file_matches_checksum?(contents_file, bucket_file.checksum_data, bucket_file.checksum_type)
+              # If the contents or sizes don't match, but the checksum does,
+              # then we've found a conflict (potential hash collision).
+              # Unlikely, but quite bad. Don't remove the file in case it's
+              # needed, but ask the user to validate.
+              # Note: Don't print the full path to the bucket file in the
+              # exception to avoid disclosing file system layout on server.
+              #TRANSLATORS "FileBucket" should not be translated
+              Puppet.err(_("Unable to verify existing FileBucket backup at '%{path}'.") % { path: contents_file.to_path })
+              raise Puppet::FileBucket::BucketError, _("Existing backup and new file have different content but same checksum, %{value}. Verify existing backup and remove if incorrect.") %
+                { value: bucket_file.checksum }
+            else
+              # PUP-1334 If the contents_file exists but does not match its
+              # checksum, our backup has been corrupted. Warn about overwriting
+              # it, and proceed with new backup.
+              Puppet.warning(_("Existing backup does not match its expected sum, %{sum}. Overwriting corrupted backup.") % { sum: bucket_file.checksum })
+              copy_bucket_file_to_contents_file(contents_file, bucket_file)
+            end
+          else
+            copy_bucket_file_to_contents_file(contents_file, bucket_file)
+          end
+
+          unless path_match(f, files_original_path)
+            f.seek(0, IO::SEEK_END)
+            f.puts(files_original_path)
+          end
+        end
+      end
+    end
+
+    def request_to_checksum_and_path(request)
+      checksum_type, checksum, path = request.key.split(/\//, 3)
+      if path == '' # Treat "md5/<checksum>/" like "md5/<checksum>"
+        path = nil
+      end
+      raise ArgumentError, _("Unsupported checksum type %{checksum_type}") % { checksum_type: checksum_type.inspect } if checksum_type != Puppet[:digest_algorithm]
+      expected = method(checksum_type + "_hex_length").call
+      raise _("Invalid checksum %{checksum}") % { checksum: checksum.inspect } if checksum !~ /^[0-9a-f]{#{expected}}$/
+      [checksum, path]
+    end
+
+    # @return [Object] Opaque path as constructed by the Puppet::FileSystem
+    #
+    def path_for(bucket_path, digest, subfile = nil)
+      bucket_path ||= Puppet[:bucketdir]
+
+      dir     = ::File.join(digest[0..7].split(""))
+      basedir = ::File.join(bucket_path, dir, digest)
+
+      Puppet::FileSystem.pathname(subfile ? ::File.join(basedir, subfile) : basedir)
+    end
+
+    # @param contents_file [Pathname] Opaque file path to intended backup
+    #   location
+    # @param bucket_file [Puppet::FileBucket::File] IO object representing
+    #   content to back up
+    # @return [Boolean] whether the data in contents_file is of the same size
+    #   and content as that in the bucket_file
+    # @api private
+    def verify_identical_file(contents_file, bucket_file)
+      (bucket_file.to_binary.bytesize == Puppet::FileSystem.size(contents_file)) &&
+        (bucket_file.stream() {|s| Puppet::FileSystem.compare_stream(contents_file, s) })
+    end
+
+    # @param contents_file [Pathname] Opaque file path to intended backup
+    #   location
+    # @param expected_checksum_data [String] expected value of checksum of type
+    #   checksum_type
+    # @param checksum_type [String] type of check sum of checksum_data, ie "md5"
+    # @return [Boolean] whether the checksum of the contents_file matches the
+    #   supplied checksum
+    # @api private
+    def contents_file_matches_checksum?(contents_file, expected_checksum_data, checksum_type)
+      contents_file_checksum_data = Puppet::Util::Checksums.method(:"#{checksum_type}_file").call(contents_file.to_path)
+      contents_file_checksum_data == expected_checksum_data
+    end
+
+    # @param contents_file [Pathname] Opaque file path to intended backup
+    #   location
+    # @param bucket_file [Puppet::FileBucket::File] IO object representing
+    #   content to back up
+    # @return [void]
+    # @api private
+    def copy_bucket_file_to_contents_file(contents_file, bucket_file)
+      Puppet::Util.replace_file(contents_file, 0440) do |of|
+        # PUP-1044 writes all of the contents
+        bucket_file.stream() do |src|
+          FileUtils.copy_stream(src, of)
+        end
+      end
+    end
+
+  end
+end