openvox 9.0.0.pre.beta1 → 9.0.0.pre.beta2

data/lib/puppet/transaction/report.rb

@@ -58,7 +58,7 @@ class Puppet::Transaction::Report
   # The id of the job responsible for this run.
   attr_accessor :job_id
 
-  # A master generated catalog uuid, useful for connecting a single catalog to multiple reports.
+  # A server generated catalog uuid, useful for connecting a single catalog to multiple reports.
   attr_accessor :catalog_uuid
 
   # Whether a cached catalog was used in the run, and if so, the reason that it was used.
@@ -111,13 +111,13 @@ class Puppet::Transaction::Report
   #
   attr_reader :status
 
-  # @return [String] The Puppet version in String form.
+  # @return [String] The OpenVox version in String form.
   # @see Puppet::version()
   #
   attr_reader :puppet_version
 
   # @return [Integer] report format version number.  This value is constant for
-  #    a given version of Puppet; it is incremented when a new release of Puppet
+  #    a given version of OpenVox; it is incremented when a new release of OpenVox
   #    changes the API for the various objects that make up a report.
   #
   attr_reader :report_format

data/lib/puppet/transaction.rb

@@ -5,7 +5,6 @@ require_relative '../puppet/util/tagging'
 require_relative '../puppet/util/skip_tags'
 require_relative '../puppet/application'
 require 'digest/sha1'
-require 'set' # rubocop:disable Lint/RedundantRequireStatement
 
 # the class that actually walks our resource/property tree, collects the changes,
 # and performs them

data/lib/puppet/type/exec.rb

@@ -13,11 +13,11 @@ module Puppet
 
       * The command itself is already idempotent. (For example, `apt-get update`.)
       * The exec has an `onlyif`, `unless`, or `creates` attribute, which prevents
-        Puppet from running the command unless some condition is met. The
+        OpenVox from running the command unless some condition is met. The
         `onlyif` and `unless` commands of an `exec` are used in the process of
         determining whether the `exec` is already in sync, therefore they must be run
-        during a noop Puppet run.
-      * The exec has `refreshonly => true`, which allows Puppet to run the
+        during a noop OpenVox run.
+      * The exec has `refreshonly => true`, which allows OpenVox to run the
         command only when some other resource is changed. (See the notes on refreshing
         below.)
 
@@ -40,7 +40,7 @@ module Puppet
       consider developing a custom resource type instead, as it is much
       more predictable and maintainable.
 
-      **Duplication:** Even though `command` is the namevar, Puppet allows
+      **Duplication:** Even though `command` is the namevar, OpenVox allows
       multiple `exec` resources with the same `command` value.
 
       **Refresh:** `exec` resources can respond to refresh events (via
@@ -65,9 +65,9 @@ module Puppet
       In short: If there's a possibility of your exec receiving refresh events,
       it is extremely important to make sure the run conditions are restricted.
 
-      **Autorequires:** If Puppet is managing an exec's cwd or the executable
+      **Autorequires:** If OpenVox is managing an exec's cwd or the executable
       file used in an exec's command, the exec resource autorequires those
-      files. If Puppet is managing the user that an exec should run as, the
+      files. If OpenVox is managing the user that an exec should run as, the
       exec resource autorequires that user."
 
     # Create a new check mechanism.  It's basically a parameter that
@@ -109,13 +109,13 @@ module Puppet
         both the cmd.exe shell and the .NET runtime cast them to signed
         integers. This means some tools will report negative numbers for exit
         codes above 2147483647. (For example, cmd.exe reports 4294967295 as -1.)
-        Since Puppet uses the plain Win32 APIs, it will report the very large
+        Since OpenVox uses the plain Win32 APIs, it will report the very large
         number instead of the negative number, which might not be what you
         expect if you got the exit code from a cmd.exe session.
 
         Microsoft recommends against using negative/very large exit codes, and
         you should avoid them when possible. To convert a negative exit code to
-        the positive one Puppet will use, add it to 4294967296."
+        the positive one OpenVox will use, add it to 4294967296."
 
       # Make output a bit prettier
       def change_to_s(currentvalue, newvalue)
@@ -202,11 +202,11 @@ module Puppet
         (meaning its return code does not match the specified code) then
         any output is logged at the `err` log level.
 
-        Multiple `exec` resources can use the same `command` value; Puppet
+        Multiple `exec` resources can use the same `command` value; OpenVox
         only uses the resource title to ensure `exec`s are unique.
 
         On *nix platforms, the command can be specified as an array of
-        strings and Puppet will invoke it using the more secure method of
+        strings and OpenVox will invoke it using the more secure method of
         parameterized system calls. For example, rather than executing the
         malicious injected code, this command will echo it out:
 
@@ -236,10 +236,10 @@ module Puppet
     newparam(:user) do
       desc "The user to run the command as.
 
-        > **Note:** Puppet cannot execute commands as other users on Windows.
+        > **Note:** OpenVox cannot execute commands as other users on Windows.
 
         Note that if you use this attribute, any error output is not captured
-        due to a bug within Ruby. If you use Puppet to create this user, the
+        due to a bug within Ruby. If you use OpenVox to create this user, the
         exec automatically requires the user, as long as it is specified by
         name.
 
@@ -258,7 +258,7 @@ module Puppet
     newparam(:group) do
       desc "The group to run the command as.  This seems to work quite
         haphazardly on different platforms -- it is a platform issue
-        not a Ruby or Puppet one, since the same variety exists when
+        not a Ruby or OpenVox one, since the same variety exists when
         running commands as different users in the shell."
       # Validation is handled by the SUIDManager class.
     end
@@ -282,7 +282,7 @@ module Puppet
 
     newparam(:refresh) do
       desc "An alternate command to run when the `exec` receives a refresh event
-        from another resource. By default, Puppet runs the main command again.
+        from another resource. By default, OpenVox runs the main command again.
         For more details, see the notes about refresh behavior above, in the
         description for this resource type.
 
@@ -422,7 +422,7 @@ module Puppet
         A file to look for before running the command. The command will
         only run if the file **doesn't exist.**
 
-        This parameter doesn't cause Puppet to create a file; it is only
+        This parameter doesn't cause OpenVox to create a file; it is only
         useful if **the command itself** creates a file.
 
             exec { 'tar -xf /Volumes/nfs02/important.tar':
@@ -435,7 +435,7 @@ module Puppet
         `important.tar`. If it is ever deleted, the exec will bring it
         back by re-extracting the tarball. If `important.tar` does **not**
         actually contain `myfile`, the exec will keep running every time
-        Puppet runs.
+        OpenVox runs.
 
         This parameter can also take an array of files, and the command will
         not run if **any** of these files exist. Consider this example:
@@ -459,7 +459,7 @@ module Puppet
     newcheck(:unless) do
       desc <<-'EOT'
         A test command that checks the state of the target system and restricts
-        when the `exec` can run. If present, Puppet runs this test command
+        when the `exec` can run. If present, OpenVox runs this test command
         first, then runs the main command unless the test has an exit code of 0
         (success). For example:
 
@@ -476,7 +476,7 @@ module Puppet
         must fully qualify the command's name.
 
         Since this command is used in the process of determining whether the
-        `exec` is already in sync, it must be run during a noop Puppet run.
+        `exec` is already in sync, it must be run during a noop OpenVox run.
 
         This parameter can also take an array of commands. For example:
 
@@ -522,7 +522,7 @@ module Puppet
     newcheck(:onlyif) do
       desc <<-'EOT'
         A test command that checks the state of the target system and restricts
-        when the `exec` can run. If present, Puppet runs this test command
+        when the `exec` can run. If present, OpenVox runs this test command
         first, and only runs the main command if the test has an exit code of 0
         (success). For example:
 
@@ -539,7 +539,7 @@ module Puppet
         must fully qualify the command's name.
 
         Since this command is used in the process of determining whether the
-        `exec` is already in sync, it must be run during a noop Puppet run.
+        `exec` is already in sync, it must be run during a noop OpenVox run.
 
         This parameter can also take an array of commands. For example:
 

data/lib/puppet/type/file/content.rb

@@ -37,8 +37,8 @@ module Puppet
           }
 
       ...but for larger files, this attribute is more useful when combined with the
-      [template](https://puppet.com/docs/puppet/latest/function.html#template)
-      or [file](https://puppet.com/docs/puppet/latest/function.html#file)
+      [template](https://docs.openvoxproject.org/openvox/latest/function.html#template)
+      or [file](https://docs.openvoxproject.org/openvox/latest/function.html#file)
       function.
     EOT
 
@@ -47,24 +47,14 @@ module Puppet
     munge do |value|
       if value == :absent
         value
-      elsif value.is_a?(String) && checksum?(value)
-        # XXX This is potentially dangerous because it means users can't write a file whose
-        # entire contents are a plain checksum unless it is a Binary content.
-        Puppet.puppet_deprecation_warning([
-          # TRANSLATORS "content" is an attribute and should not be translated
-          _('Using a checksum in a file\'s "content" property is deprecated.'),
-          # TRANSLATORS "filebucket" is a resource type and should not be translated. The quoted occurrence of "content" is an attribute and should not be translated.
-          _('The ability to use a checksum to retrieve content from the filebucket using the "content" property will be removed in a future release.'),
-          # TRANSLATORS "content" is an attribute and should not be translated.
-          _('The literal value of the "content" property will be written to the file.'),
-          # TRANSLATORS "static catalogs" should not be translated.
-          _('The checksum retrieval functionality is being replaced by the use of static catalogs.'),
-          _('See https://puppet.com/docs/puppet/latest/static_catalogs.html for more information.')
-        ].join(" "),
-                                          :file => @resource.file,
-                                          :line => @resource.line) if !@actual_content && !resource.parameter(:source)
+      elsif value.is_a?(String) && checksum?(value) && (@actual_content || resource.parameter(:source))
+        # The actual content is already known, either because it was
+        # previously set or because it comes from a source, and the value is
+        # its checksum.
         value
       else
+        # The value is the desired file content, even if it happens to look
+        # like a checksum.
         @actual_content = value.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? value.binary_buffer : value
         resource.parameter(:checksum).sum(@actual_content)
       end
@@ -150,31 +140,14 @@ module Puppet
 
     private
 
-    # the content is munged so if it's a checksum source_or_content is nil
-    # unless the checksum indirectly comes from source
+    # actual_content is only nil when the munged value is a checksum of
+    # content that comes from a source
     def each_chunk_from
       if actual_content.is_a?(String)
         yield actual_content
-      elsif content_is_really_a_checksum? && actual_content.nil?
-        yield read_file_from_filebucket
       elsif actual_content.nil?
         yield ''
       end
     end
-
-    def content_is_really_a_checksum?
-      checksum?(should)
-    end
-
-    def read_file_from_filebucket
-      dipper = resource.bucket
-      raise "Could not get filebucket from file" unless dipper
-
-      sum = should.sub(/\{\w+\}/, '')
-
-      dipper.getfile(sum)
-    rescue => detail
-      self.fail Puppet::Error, "Could not retrieve content for #{should} from filebucket: #{detail}", detail
-    end
   end
 end

data/lib/puppet/type/file/ensure.rb

@@ -21,14 +21,14 @@ module Puppet
       * `link` ensures the file is a symlink, and **requires** that you also
         set the `target` attribute. Symlinks are supported on all Posix
         systems and on Windows Vista / 2008 and higher. On Windows, managing
-        symlinks requires Puppet agent's user account to have the "Create
+        symlinks requires the OpenVox agent's user account to have the "Create
         Symbolic Links" privilege; this can be configured in the "User Rights
-        Assignment" section in the Windows policy editor. By default, Puppet
+        Assignment" section in the Windows policy editor. By default, the OpenVox
         agent runs as the Administrator account, which has this privilege.
 
-      Puppet avoids destroying directories unless the `force` attribute is set
+      OpenVox avoids destroying directories unless the `force` attribute is set
       to `true`. This means that if a file is currently a directory, setting
-      `ensure` to anything but `directory` or `present` will cause Puppet to
+      `ensure` to anything but `directory` or `present` will cause OpenVox to
       skip managing the resource and log either a notice or an error.
 
       There is one other non-standard value for `ensure`. If you specify the

data/lib/puppet/type/file/mode.rb

@@ -14,7 +14,7 @@ module Puppet
       notation. This value **must** be specified as a string; do not use
       un-quoted numbers to represent file modes.
 
-      If the mode is omitted (or explicitly set to `undef`), Puppet does not
+      If the mode is omitted (or explicitly set to `undef`), OpenVox does not
       enforce permissions on existing files and creates new files with
       permissions of `0644`.
 
@@ -22,7 +22,7 @@ module Puppet
       them to equivalent permissions for systems which represent permissions
       differently, including Windows. For detailed ACL controls on Windows,
       you can leave `mode` unmanaged and use
-      [the puppetlabs/acl module.](https://forge.puppetlabs.com/puppetlabs/acl)
+      [the puppetlabs/acl module.](https://forge.puppet.com/puppetlabs/acl)
 
       Numeric modes should use the standard octal notation of
       `<SETUID/SETGID/STICKY><OWNER><GROUP><OTHER>` (for example, "0644").
@@ -32,10 +32,10 @@ module Puppet
         execute/search = 1.
       * The setuid/setgid/sticky digit is also a sum, where setuid = 4, setgid = 2,
         and sticky = 1.
-      * The setuid/setgid/sticky digit is optional. If it is absent, Puppet will
+      * The setuid/setgid/sticky digit is optional. If it is absent, OpenVox will
         clear any existing setuid/setgid/sticky permissions. (So to make your intent
         clear, you should use at least four digits for numeric modes.)
-      * When specifying numeric permissions for directories, Puppet sets the search
+      * When specifying numeric permissions for directories, OpenVox sets the search
         permission wherever the read permission is set.
 
       Symbolic modes should be represented as a string of comma-separated

data/lib/puppet/type/file/selcontext.rb

@@ -86,10 +86,10 @@ module Puppet
   end
 
   Puppet::Type.type(:file).newparam(:selinux_ignore_defaults) do
-    desc "If this is set, Puppet will not call the SELinux function selabel_lookup to
+    desc "If this is set, OpenVox will not call the SELinux function selabel_lookup to
       supply defaults for the SELinux attributes (seluser, selrole,
       seltype, and selrange). In general, you should leave this set at its
-      default and only set it to true when you need Puppet to not try to fix
+      default and only set it to true when you need OpenVox to not try to fix
       SELinux labels automatically."
     newvalues(:true, :false)
 

data/lib/puppet/type/file/source.rb

@@ -20,7 +20,7 @@ module Puppet
       attribute is mutually exclusive with `content` and `target`. Allowed
       values are:
 
-      * `puppet:` URIs, which point to files in modules or Puppet file server
+      * `puppet:` URIs, which point to files in modules or OpenVox file server
       mount points.
       * Fully qualified paths to locally available files (including files on NFS
       shares or Windows mapped drives).
@@ -31,8 +31,8 @@ module Puppet
 
       `puppet:///modules/<MODULE NAME>/<FILE PATH>`
 
-      This will fetch a file from a module on the Puppet master (or from a
-      local module when using Puppet apply). Given a `modulepath` of
+      This will fetch a file from a module on the OpenVox server (or from a
+      local module when using puppet apply). Given a `modulepath` of
       `/etc/puppetlabs/code/modules`, the example above would resolve to
       `/etc/puppetlabs/code/modules/<MODULE NAME>/files/<FILE PATH>`.
 
@@ -46,28 +46,28 @@ module Puppet
       because HTTP servers do not transfer any metadata that translates to
       ownership or permission details.
 
-      Puppet determines if file content is synchronized by computing a checksum
+      OpenVox determines if file content is synchronized by computing a checksum
       for the local file and comparing it against the `checksum_value`
       parameter. If the `checksum_value` parameter is not specified for
-      `puppet` and `file` sources, Puppet computes a checksum based on its
-      `Puppet[:digest_algorithm]`. For `http(s)` sources, Puppet uses the
+      `puppet` and `file` sources, OpenVox computes a checksum based on its
+      `Puppet[:digest_algorithm]`. For `http(s)` sources, OpenVox uses the
       first HTTP header it recognizes out of the following list:
       `X-Checksum-Sha256`, `X-Checksum-Sha1`, `X-Checksum-Md5` or `Content-MD5`.
-      If the server response does not include one of these headers, Puppet
-      defaults to using the `Last-Modified` header. Puppet updates the local
+      If the server response does not include one of these headers, OpenVox
+      defaults to using the `Last-Modified` header. OpenVox updates the local
       file if the header is newer than the modified time (mtime) of the local
       file.
 
-      _HTTP_ URIs can include a user information component so that Puppet can
+      _HTTP_ URIs can include a user information component so that OpenVox can
       retrieve file metadata and content from HTTP servers that require HTTP Basic
       authentication. For example `https://<user>:<pass>@<server>:<port>/path/to/file.`
 
-      When connecting to _HTTPS_ servers, Puppet trusts CA certificates in the
-      puppet-agent certificate bundle and the Puppet CA. You can configure Puppet
+      When connecting to _HTTPS_ servers, OpenVox trusts CA certificates in the
+      puppet-agent certificate bundle and the OpenVox CA. You can configure OpenVox
       to trust additional CA certificates using the `Puppet[:ssl_trust_store]`
       setting.
 
-      Multiple `source` values can be specified as an array, and Puppet will
+      Multiple `source` values can be specified as an array, and OpenVox will
       use the first source that exists. This can be used to serve different
       files to different system types:
 
@@ -323,9 +323,9 @@ module Puppet
 
     def chunk_file_from_source(&block)
       if uri.scheme =~ /^https?/
-        # Historically puppet has not encoded the http(s) source URL before parsing
+        # Historically OpenVox has not encoded the http(s) source URL before parsing
         # it, for example, if the path contains spaces, then it must be URL encoded
-        # as %20 in the manifest. Puppet behaves the same when retrieving file
+        # as %20 in the manifest. OpenVox behaves the same when retrieving file
         # metadata via http(s), see Puppet::Indirector::FileMetadata::Http#find.
         url = URI.parse(metadata.source)
         get_from_http_source(url, &block)
@@ -347,7 +347,7 @@ module Puppet
 
   Puppet::Type.type(:file).newparam(:source_permissions) do
     desc <<-'EOT'
-      Whether (and how) Puppet should copy owner, group, and mode permissions from
+      Whether (and how) OpenVox should copy owner, group, and mode permissions from
       the `source` to `file` resources when the permissions are not explicitly
       specified. (In all cases, explicit permissions will take precedence.)
       Valid values are `use`, `use_when_creating`, and `ignore`:
@@ -355,10 +355,10 @@ module Puppet
       * `ignore` (the default) will never apply the owner, group, or mode from
         the `source` when managing a file. When creating new files without explicit
         permissions, the permissions they receive will depend on platform-specific
-        behavior. On POSIX, Puppet will use the umask of the user it is running as.
-        On Windows, Puppet will use the default DACL associated with the user it is
+        behavior. On POSIX, OpenVox will use the umask of the user it is running as.
+        On Windows, OpenVox will use the default DACL associated with the user it is
         running as.
-      * `use` will cause Puppet to apply the owner, group,
+      * `use` will cause OpenVox to apply the owner, group,
         and mode from the `source` to any files it is managing.
       * `use_when_creating` will only apply the owner, group, and mode from the
         `source` when creating a file; existing files will not have their permissions

data/lib/puppet/type/file.rb

@@ -27,11 +27,11 @@ Puppet::Type.newtype(:file) do
     downloaded from a remote source using the `source` attribute; the latter
     can also be used to recursively serve directories (when the `recurse`
     attribute is set to `true` or `local`). On Windows, note that file
-    contents are managed in binary mode; Puppet never automatically translates
+    contents are managed in binary mode; OpenVox never automatically translates
     line endings.
 
-    **Autorequires:** If Puppet is managing the user or group that owns a
-    file, the file resource will autorequire them. If Puppet is managing any
+    **Autorequires:** If OpenVox is managing the user or group that owns a
+    file, the file resource will autorequire them. If OpenVox is managing any
     parent directories of a file, the file resource autorequires them.
 
     Warning: Enabling `recurse` on directories containing large numbers of
@@ -80,11 +80,11 @@ Puppet::Type.newtype(:file) do
       (`File { backup => main }`), so it can affect all file resources.
 
       * If set to `false`, file content won't be backed up.
-      * If set to a string beginning with `.`, such as `.puppet-bak`, Puppet will
+      * If set to a string beginning with `.`, such as `.puppet-bak`, OpenVox will
         use copy the file in the same directory with that value as the extension
         of the backup. (A value of `true` is a synonym for `.puppet-bak`.)
-      * If set to any other string, Puppet will try to back up to a filebucket
-        with that title. Puppet automatically creates a **local** filebucket
+      * If set to any other string, OpenVox will try to back up to a filebucket
+        with that title. OpenVox automatically creates a **local** filebucket
         named `puppet` if one doesn't already exist. See the `filebucket` resource
         type for more details.
 
@@ -92,18 +92,25 @@ Puppet::Type.newtype(:file) do
 
       Backing up to a local filebucket isn't particularly useful. If you want
       to make organized use of backups, you will generally want to use the
-      primary Puppet server's filebucket service. This requires declaring a
+      primary OpenVox server's filebucket service. This requires declaring a
       filebucket resource and a resource default for the `backup` attribute
       in site.pp:
 
           # /etc/puppetlabs/puppet/manifests/site.pp
           filebucket { 'main':
             path   => false,                # This is required for remote filebuckets.
-            server => 'puppet.example.com', # Optional; defaults to the configured primary Puppet server.
+            server => 'puppet.example.com', # Optional; defaults to the configured primary OpenVox server.
           }
 
           File { backup => main, }
 
+      > **Note**: A central filebucket is shared by every node that backs up to it,
+        and stored content is addressed only by checksum, with no record of which
+        node submitted it. Treat anything backed up there as readable by every
+        certificate the server's `auth.conf` allows to reach the `file_bucket_file`
+        endpoint, and avoid pointing `backup` at a central filebucket for files whose
+        contents are sensitive. See the `filebucket` resource type for details.
+
       If you are using multiple primary servers, you will want to
       centralize the contents of the filebucket. Either configure your load
       balancer to direct all filebucket traffic to a single primary server, or use
@@ -149,7 +156,7 @@ Puppet::Type.newtype(:file) do
 
       * `false` --- The default behavior. The contents of the directory will not be
         automatically managed.
-      * `remote` --- If the `source` attribute is set, Puppet will automatically
+      * `remote` --- If the `source` attribute is set, OpenVox will automatically
         manage the contents of the source directory (or directories), ensuring
         that equivalent files and directories exist on the target system and
         that their contents match.
@@ -188,13 +195,13 @@ Puppet::Type.newtype(:file) do
   end
 
   newparam(:recurselimit) do
-    desc "How far Puppet should descend into subdirectories, when using
+    desc "How far OpenVox should descend into subdirectories, when using
       `ensure => directory` and either `recurse => true` or `recurse => remote`.
       The recursion limit affects which files will be copied from the `source`
       directory, as well as which files can be purged when `purge => true`.
 
       Setting `recurselimit => 0` is the same as setting `recurse => false` ---
-      Puppet will manage the directory, but all of its contents will be treated
+      OpenVox will manage the directory, but all of its contents will be treated
       as unmanaged.
 
       Setting `recurselimit => 1` will manage files and directories that are
@@ -241,7 +248,7 @@ Puppet::Type.newtype(:file) do
       whose content doesn't match what the `source` or `content` attribute
       specifies.  Setting this to false allows file resources to initialize files
       without overwriting future changes.  Note that this only affects content;
-      Puppet will still manage ownership and permissions."
+      OpenVox will still manage ownership and permissions."
     defaultto :true
   end
 
@@ -320,7 +327,7 @@ Puppet::Type.newtype(:file) do
   newparam(:show_diff, :boolean => true, :parent => Puppet::Parameter::Boolean) do
     desc "Whether to display differences when the file changes, defaulting to
         true.  This parameter is useful for files that may contain passwords or
-        other secret data, which might otherwise be included in Puppet reports or
+        other secret data, which might otherwise be included in OpenVox reports or
         other insecure outputs.  If the global `show_diff` setting
         is false, then no diffs will be shown even if this parameter is true."
 
@@ -353,14 +360,14 @@ Puppet::Type.newtype(:file) do
 
   newparam(:validate_cmd) do
     desc "A command for validating the file's syntax before replacing it. If
-      Puppet would need to rewrite a file due to new `source` or `content`, it
+      OpenVox would need to rewrite a file due to new `source` or `content`, it
       will check the new content's validity first. If validation fails, the file
       resource will fail.
 
       This command must have a fully qualified path, and should contain a
       percent (`%`) token where it would expect an input file. It must exit `0`
       if the syntax is correct, and non-zero otherwise. The command will be
-      run on the target system while applying the catalog, not on the primary Puppet server.
+      run on the target system while applying the catalog, not on the primary OpenVox server.
 
       Example:
 

data/lib/puppet/type/filebucket.rb

@@ -6,19 +6,18 @@ module Puppet
   Type.newtype(:filebucket) do
     @doc = <<-EOT
       A repository for storing and retrieving file content by cryptographic checksum. Can
-      be local to each agent node, or centralized on a primary Puppet server. All
-      puppet servers provide a filebucket service that agent nodes can access
+      be local to each agent node, or centralized on a primary OpenVox server. All
+      OpenVox servers provide a filebucket service that agent nodes can access
       via HTTP, but you must declare a filebucket resource before any agents
       will do so.
 
       Filebuckets are used for the following features:
 
       - **Content backups.** If the `file` type's `backup` attribute is set to
-        the name of a filebucket, Puppet will back up the _old_ content whenever
+        the name of a filebucket, OpenVox will back up the _old_ content whenever
         it rewrites a file; see the documentation for the `file` type for more
         details. These backups can be used for manual recovery of content, but
-        are more commonly used to display changes and differences in a tool like
-        Puppet Dashboard.
+        are more commonly used to display changes and differences.
 
       To use a central filebucket for backups, you will usually want to declare
       a filebucket resource and a resource default for the `backup` attribute
@@ -32,10 +31,25 @@ module Puppet
 
           File { backup => main, }
 
-      Puppet Servers automatically provide the filebucket service, so
+      OpenVox Servers automatically provide the filebucket service, so
       this will work in a default configuration. If you have a heavily
-      restricted Puppet Server `auth.conf` file, you may need to allow access to the
+      restricted OpenVox Server `auth.conf` file, you may need to allow access to the
       `file_bucket_file` endpoint.
+
+      > **Security note**: a central filebucket is shared by every node that backs
+        up to it. Content is addressed purely by checksum, and the service records no
+        association between stored content and the node that submitted it, so a
+        request for `/puppet/v3/file_bucket_file/<digest>/<checksum>` returns the
+        matching content to any client the server's `auth.conf` permits, regardless
+        of which node originally backed that file up. Retrieving content requires
+        knowing the checksum of the exact bytes, so this is not a general-purpose
+        read primitive, but you should treat a central filebucket as readable by
+        every certificate allowed to reach the endpoint and avoid backing up files
+        whose contents are sensitive. Since OpenVox 9 the default `auth.conf` grants
+        agents only the `HEAD` and `PUT` access they need in order to store backups,
+        and restricts `GET` to certificates carrying the `pp_cli_auth` extension. If
+        you restore remotely using some other administrative certificate, add a rule
+        of your own rather than widening the shipped one.
     EOT
 
     newparam(:name) do
@@ -98,7 +112,7 @@ module Puppet
     def mkbucket
       # Default is a local filebucket, if no server is given.
       # If the default path has been removed, too, then
-      # the puppetmaster is used as default server
+      # the OpenVox server is used as default server
 
       type = "local"
       args = {}

data/lib/puppet/type/group.rb

@@ -151,9 +151,9 @@ module Puppet
       desc "Configures the behavior of the `members` parameter.
 
         * `false` (default) --- The provided list of group members is partial,
-          and Puppet **ignores** any members that aren't listed there.
+          and OpenVox **ignores** any members that aren't listed there.
         * `true` --- The provided list of of group members is comprehensive, and
-          Puppet **purges** any members that aren't listed there."
+          OpenVox **purges** any members that aren't listed there."
       defaultto false
     end
 
@@ -162,7 +162,7 @@ module Puppet
         it is advisable to restrict names to the lowest common denominator,
         which is a maximum of 8 characters beginning with a letter.
 
-        Note that Puppet considers group names to be case-sensitive, regardless
+        Note that OpenVox considers group names to be case-sensitive, regardless
         of the platform's own rules; be sure to always use the same case when
         referring to a given group."
       isnamevar
@@ -197,10 +197,10 @@ module Puppet
     newparam(:attribute_membership) do
       desc "AIX only. Configures the behavior of the `attributes` parameter.
 
-        * `minimum` (default) --- The provided list of attributes is partial, and Puppet
+        * `minimum` (default) --- The provided list of attributes is partial, and OpenVox
           **ignores** any attributes that aren't listed there.
         * `inclusive` --- The provided list of attributes is comprehensive, and
-          Puppet **purges** any attributes that aren't listed there."
+          OpenVox **purges** any attributes that aren't listed there."
 
       newvalues(:inclusive, :minimum)
 

data/lib/puppet/type/notify.rb

@@ -5,7 +5,7 @@
 
 module Puppet
   Type.newtype(:notify) do
-    @doc = "Sends an arbitrary message, specified as a string, to the agent run-time log. It's important to note that the notify resource type is not idempotent. As a result, notifications are shown as a change on every Puppet run."
+    @doc = "Sends an arbitrary message, specified as a string, to the agent run-time log. It's important to note that the notify resource type is not idempotent. As a result, notifications are shown as a change on every OpenVox run."
 
     apply_to_all