openvox 7.37.1

data/lib/puppet/confine/any.rb

@@ -0,0 +1,26 @@
+class Puppet::Confine::Any < Puppet::Confine
+  def self.summarize(confines)
+    confines.inject(0) { |count, confine| count + confine.summary }
+  end
+
+  def pass?(value)
+    !! value
+  end
+
+  def message(value)
+    "0 confines (of #{value.length}) were true"
+  end
+
+  def summary
+    result.find_all { |v| v == true }.length
+  end
+
+  def valid?
+    if @values.any? { |value| pass?(value) }
+      true
+    else
+      Puppet.debug { "#{label}: #{message(@values)}" }
+      false
+    end
+  end
+end

data/lib/puppet/confine/boolean.rb

@@ -0,0 +1,45 @@
+require_relative '../../puppet/confine'
+
+# Common module for the Boolean confines. It currently
+# contains just enough code to implement PUP-9336.
+class Puppet::Confine
+  module Boolean
+    # Returns the passing value for the Boolean confine.
+    def passing_value
+      raise NotImplementedError, "The Boolean confine %{confine} must provide the passing value." % { confine: self.class.name }
+    end
+
+    # The Boolean confines 'true' and 'false' let the user specify
+    # two types of values:
+    #     * A lambda for lazy evaluation. This would be something like
+    #         confine :true => lambda { true }
+    #
+    #     * A single Boolean value, or an array of Boolean values. This would
+    #     be something like
+    #         confine :true => true OR confine :true => [true, false, false, true]
+    #
+    # This override distinguishes between the two cases.
+    def values
+      # Note that Puppet::Confine's constructor ensures that @values
+      # will always be an array, even if a lambda's passed in. This is
+      # why we have the length == 1 check.
+      unless @values.length == 1 && @values.first.respond_to?(:call)
+        return @values
+      end
+
+      # We have a lambda. Here, we want to enforce "cache positive"
+      # behavior, which is to cache the result _if_ it evaluates to
+      # the passing value (i.e. the class name).
+
+      return @cached_value unless @cached_value.nil?
+
+      # Double negate to coerce the value into a Boolean
+      calculated_value = !! @values.first.call
+      if calculated_value == passing_value
+        @cached_value = [calculated_value]
+      end
+
+      [calculated_value]
+    end
+  end
+end

data/lib/puppet/confine/exists.rb

@@ -0,0 +1,19 @@
+require_relative '../../puppet/confine'
+
+class Puppet::Confine::Exists < Puppet::Confine
+  def self.summarize(confines)
+    confines.inject([]) { |total, confine| total + confine.summary }
+  end
+
+  def pass?(value)
+    value && (for_binary? ? which(value) : Puppet::FileSystem.exist?(value))
+  end
+
+  def message(value)
+    "file #{value} does not exist"
+  end
+
+  def summary
+    result.zip(values).inject([]) { |array, args| val, f = args; array << f unless val; array }
+  end
+end

data/lib/puppet/confine/false.rb

@@ -0,0 +1,25 @@
+require_relative '../../puppet/confine/boolean'
+
+class Puppet::Confine::False < Puppet::Confine
+  include Puppet::Confine::Boolean
+
+  def passing_value
+    false
+  end
+
+  def self.summarize(confines)
+    confines.inject(0) { |count, confine| count + confine.summary }
+  end
+
+  def pass?(value)
+    ! value
+  end
+
+  def message(value)
+    "true value when expecting false"
+  end
+
+  def summary
+    result.find_all { |v| v == false }.length
+  end
+end

data/lib/puppet/confine/feature.rb

@@ -0,0 +1,17 @@
+require_relative '../../puppet/confine'
+
+class Puppet::Confine::Feature < Puppet::Confine
+  def self.summarize(confines)
+    confines.collect { |c| c.values }.flatten.uniq.find_all { |value| ! confines[0].pass?(value) }
+  end
+
+  # Is the named feature available?
+  def pass?(value)
+    Puppet.features.send(value.to_s + "?")
+  end
+
+  def message(value)
+    "feature #{value} is missing"
+  end
+end
+

data/lib/puppet/confine/true.rb

@@ -0,0 +1,26 @@
+require_relative '../../puppet/confine/boolean'
+
+class Puppet::Confine::True < Puppet::Confine
+  include Puppet::Confine::Boolean
+
+  def passing_value
+    true
+  end
+
+  def self.summarize(confines)
+    confines.inject(0) { |count, confine| count + confine.summary }
+  end
+
+  def pass?(value)
+    # Double negate, so we only get true or false.
+    ! ! value
+  end
+
+  def message(value)
+    "false value when expecting true"
+  end
+
+  def summary
+    result.find_all { |v| v == true }.length
+  end
+end

data/lib/puppet/confine/variable.rb

@@ -0,0 +1,59 @@
+require_relative '../../puppet/confine'
+
+# Require a specific value for a variable, either a Puppet setting
+# or a Facter value.  This class is a bit weird because the name
+# is set explicitly by the ConfineCollection class -- from this class,
+# it's not obvious how the name would ever get set.
+class Puppet::Confine::Variable < Puppet::Confine
+  # Provide a hash summary of failing confines -- the key of the hash
+  # is the name of the confine, and the value is the missing yet required values.
+  # Only returns failed values, not all required values.
+  def self.summarize(confines)
+    result = Hash.new { |hash, key| hash[key] = [] }
+    confines.inject(result) { |total, confine| total[confine.name] += confine.values unless confine.valid?; total }
+  end
+
+  # This is set by ConfineCollection.
+  attr_accessor :name
+
+  # Retrieve the value from facter
+  def facter_value
+    @facter_value ||= Puppet.runtime[:facter].value(name).to_s.downcase
+  end
+
+  def initialize(values)
+    super
+    @values = @values.collect { |v| v.to_s.downcase }
+  end
+
+  def message(value)
+    "facter value '#{test_value}' for '#{self.name}' not in required list '#{values.join(",")}'"
+  end
+
+  # Compare the passed-in value to the retrieved value.
+  def pass?(value)
+    test_value.downcase.to_s == value.to_s.downcase
+  end
+
+  def reset
+    # Reset the cache.  We want to cache it during a given
+    # run, but not across runs.
+    @facter_value = nil
+  end
+
+  def valid?
+    @values.include?(test_value.to_s.downcase)
+  ensure
+    reset
+  end
+
+  private
+
+  def setting?
+    Puppet.settings.valid?(name)
+  end
+
+  def test_value
+    setting? ? Puppet.settings[name] : facter_value
+  end
+end

data/lib/puppet/confine.rb

@@ -0,0 +1,83 @@
+# The class that handles testing whether our providers
+# actually work or not.
+require_relative '../puppet/util'
+
+class Puppet::Confine
+  include Puppet::Util
+
+  @tests = {}
+
+  class << self
+    attr_accessor :name
+  end
+
+  def self.inherited(klass)
+    name = klass.to_s.split("::").pop.downcase.to_sym
+    raise "Test #{name} is already defined" if @tests.include?(name)
+
+    klass.name = name
+
+    @tests[name] = klass
+  end
+
+  def self.test(name)
+    unless @tests.include?(name)
+      begin
+        require "puppet/confine/#{name}"
+      rescue LoadError => detail
+        unless detail.to_s =~ /No such file|cannot load such file/i
+          Puppet.warning("Could not load confine test '#{name}': #{detail}")
+        end
+        # Could not find file
+        if !Puppet[:always_retry_plugins]
+          @tests[name] = nil
+        end
+      end
+    end
+    @tests[name]
+  end
+
+  attr_reader :values
+
+  # Mark that this confine is used for testing binary existence.
+  attr_accessor :for_binary
+  def for_binary?
+    for_binary
+  end
+
+  # Used for logging.
+  attr_accessor :label
+
+  def initialize(values)
+    values = [values] unless values.is_a?(Array)
+    @values = values
+  end
+
+  # Provide a hook for the message when there's a failure.
+  def message(value)
+    ""
+  end
+
+  # Collect the results of all of them.
+  def result
+    values.collect { |value| pass?(value) }
+  end
+
+  # Test whether our confine matches.
+  def valid?
+    values.each do |value|
+      unless pass?(value)
+        Puppet.debug { label + ": " + message(value) }
+        return false
+      end
+    end
+
+    return true
+  ensure
+    reset
+  end
+
+  # Provide a hook for subclasses.
+  def reset
+  end
+end

data/lib/puppet/confine_collection.rb

@@ -0,0 +1,51 @@
+# Manage a collection of confines, returning a boolean or
+# helpful information.
+require_relative '../puppet/confine'
+
+class Puppet::ConfineCollection
+  def confine(hash)
+    if hash.include?(:for_binary)
+      for_binary = true
+      hash.delete(:for_binary)
+    else
+      for_binary = false
+    end
+    hash.each do |test, values|
+      klass = Puppet::Confine.test(test)
+      if klass
+        @confines << klass.new(values)
+        @confines[-1].for_binary = true if for_binary
+      else
+        confine = Puppet::Confine.test(:variable).new(values)
+        confine.name = test
+        @confines << confine
+      end
+      @confines[-1].label = self.label
+    end
+  end
+
+  attr_reader :label
+  def initialize(label)
+    @label = label
+    @confines = []
+  end
+
+  # Return a hash of the whole confine set, used for the Provider
+  # reference.
+  def summary
+    confines = Hash.new { |hash, key| hash[key] = [] }
+    @confines.each { |confine| confines[confine.class] << confine }
+    result = {}
+    confines.each do |klass, list|
+      value = klass.summarize(list)
+      next if (value.respond_to?(:length) and value.length == 0) or (value == 0)
+      result[klass.name] = value
+
+    end
+    result
+  end
+
+  def valid?
+    ! @confines.detect { |c| ! c.valid? }
+  end
+end

data/lib/puppet/confiner.rb

@@ -0,0 +1,46 @@
+require_relative '../puppet/confine_collection'
+
+# The Confiner module contains methods for managing a Provider's confinement (suitability under given
+# conditions). The intent is to include this module in an object where confinement management is wanted.
+# It lazily adds an instance variable `@confine_collection` to the object where it is included.
+#
+module Puppet::Confiner
+  # Confines a provider to be suitable only under the given conditions.
+  # The hash describes a confine using mapping from symbols to values or predicate code.
+  #
+  # * _fact_name_ => value of fact (or array of facts)
+  # * `:exists` => the path to an existing file
+  # * `:true` => a predicate code block returning true
+  # * `:false` => a predicate code block returning false
+  # * `:feature` => name of system feature that must be present
+  # * `:any` => an array of expressions that will be ORed together
+  #
+  # @example
+  #   confine :operatingsystem => [:redhat, :fedora]
+  #   confine :true { ... }
+  #
+  # @param hash [Hash<{Symbol => Object}>] hash of confines
+  # @return [void]
+  # @api public
+  #
+  def confine(hash)
+    confine_collection.confine(hash)
+  end
+
+  # @return [Puppet::ConfineCollection] the collection of confines
+  # @api private
+  #
+  def confine_collection
+    @confine_collection ||= Puppet::ConfineCollection.new(self.to_s)
+  end
+
+  # Checks whether this implementation is suitable for the current platform (or returns a summary
+  # of all confines if short == false).
+  # @return [Boolean. Hash] Returns whether the confines are all valid (if short == true), or a hash of all confines
+  #   if short == false.
+  # @api public
+  #
+  def suitable?(short = true)
+    return(short ? confine_collection.valid? : confine_collection.summary)
+  end
+end

data/lib/puppet/context/trusted_information.rb

@@ -0,0 +1,120 @@
+require_relative '../../puppet/trusted_external'
+
+# @api private
+class Puppet::Context::TrustedInformation
+  # one of 'remote', 'local', or false, where 'remote' is authenticated via cert,
+  # 'local' is trusted by virtue of running on the same machine (not a remote
+  # request), and false is an unauthenticated remote request.
+  #
+  # @return [String, Boolean]
+  attr_reader :authenticated
+
+  # The validated certificate name used for the request
+  #
+  # @return [String]
+  attr_reader :certname
+
+  # Extra information that comes from the trusted certificate's extensions.
+  #
+  # @return [Hash{Object => Object}]
+  attr_reader :extensions
+
+  # The domain name derived from the validated certificate name
+  #
+  # @return [String]
+  attr_reader :domain
+
+  # The hostname derived from the validated certificate name
+  #
+  # @return [String]
+  attr_reader :hostname
+
+  def initialize(authenticated, certname, extensions, external = {})
+    @authenticated = authenticated.freeze
+    @certname = certname.freeze
+    @extensions = extensions.freeze
+    if @certname
+      hostname, domain = @certname.split('.', 2)
+    else
+      hostname = nil
+      domain = nil
+    end
+    @hostname = hostname.freeze
+    @domain = domain.freeze
+    @external = external.is_a?(Proc) ? external : external.freeze
+  end
+
+  def self.remote(authenticated, node_name, certificate)
+    external = proc { retrieve_trusted_external(node_name) }
+
+    if authenticated
+      extensions = {}
+      if certificate.nil?
+        Puppet.info(_('TrustedInformation expected a certificate, but none was given.'))
+      else
+        extensions = Hash[certificate.custom_extensions.collect do |ext|
+          [ext['oid'].freeze, ext['value'].freeze]
+        end]
+      end
+      new('remote', node_name, extensions, external)
+    else
+      new(false, nil, {}, external)
+    end
+  end
+
+  def self.local(node)
+    # Always trust local data by picking up the available parameters.
+    client_cert = node ? node.parameters['clientcert'] : nil
+    external = proc { retrieve_trusted_external(client_cert) }
+
+    new('local', client_cert, {}, external)
+  end
+
+  # Additional external facts loaded through `trusted_external_command`.
+  #
+  # @return [Hash]
+  def external
+    if @external.is_a?(Proc)
+      @external = @external.call.freeze
+    end
+    @external
+  end
+
+  def self.retrieve_trusted_external(certname)
+    deep_freeze(Puppet::TrustedExternal.retrieve(certname) || {})
+  end
+  private_class_method :retrieve_trusted_external
+
+  # Deeply freezes the given object. The object and its content must be of the types:
+  # Array, Hash, Numeric, Boolean, Regexp, NilClass, or String. All other types raises an Error.
+  # (i.e. if they are assignable to Puppet::Pops::Types::Data type).
+  def self.deep_freeze(object)
+    case object
+    when Array
+      object.each {|v| deep_freeze(v) }
+      object.freeze
+    when Hash
+      object.each {|k, v| deep_freeze(k); deep_freeze(v) }
+      object.freeze
+    when NilClass, Numeric, TrueClass, FalseClass
+      # do nothing
+    when String
+      object.freeze
+    else
+      raise Puppet::Error, _("Unsupported data type: '%{klass}'") % { klass: object.class }
+    end
+    object
+  end
+  private_class_method :deep_freeze
+
+  def to_h
+    {
+      'authenticated'.freeze => authenticated,
+      'certname'.freeze => certname,
+      'extensions'.freeze => extensions,
+      'hostname'.freeze => hostname,
+      'domain'.freeze => domain,
+      'external'.freeze => external,
+    }.freeze
+  end
+end