puppet-retrospec 1.5.0 → 1.6.0

data/vendor/pup410/lib/puppet/type/resources.rb

@@ -0,0 +1,180 @@
+require 'puppet'
+require 'puppet/parameter/boolean'
+
+Puppet::Type.newtype(:resources) do
+  @doc = "This is a metatype that can manage other resource types.  Any
+    metaparams specified here will be passed on to any generated resources,
+    so you can purge unmanaged resources but set `noop` to true so the
+    purging is only logged and does not actually happen."
+
+
+  newparam(:name) do
+    desc "The name of the type to be managed."
+
+    validate do |name|
+      raise ArgumentError, "Could not find resource type '#{name}'" unless Puppet::Type.type(name)
+    end
+
+    munge { |v| v.to_s }
+  end
+
+  newparam(:purge, :boolean => true, :parent => Puppet::Parameter::Boolean) do
+    desc "Whether to purge unmanaged resources.  When set to `true`, this will
+      delete any resource that is not specified in your configuration and is not
+      autorequired by any managed resources. **Note:** The `ssh_authorized_key`
+      resource type can't be purged this way; instead, see the `purge_ssh_keys`
+      attribute of the `user` type."
+
+    defaultto :false
+
+    validate do |value|
+      if munge(value)
+        unless @resource.resource_type.respond_to?(:instances)
+          raise ArgumentError, "Purging resources of type #{@resource[:name]} is not supported, since they cannot be queried from the system"
+        end
+        raise ArgumentError, "Purging is only supported on types that accept 'ensure'" unless @resource.resource_type.validproperty?(:ensure)
+      end
+    end
+  end
+
+  newparam(:unless_system_user) do
+    desc "This keeps system users from being purged.  By default, it
+      does not purge users whose UIDs are less than the minimum UID for the system (typically 500 or 1000), but you can specify
+      a different UID as the inclusive limit."
+
+    newvalues(:true, :false, /^\d+$/)
+
+    munge do |value|
+      case value
+      when /^\d+/
+        Integer(value)
+      when :true, true
+        @resource.class.system_users_max_uid
+      when :false, false
+        false
+      when Integer; value
+      else
+        raise ArgumentError, "Invalid value #{value.inspect}"
+      end
+    end
+
+    defaultto {
+      if @resource[:name] == "user"
+        @resource.class.system_users_max_uid
+      else
+        nil
+      end
+    }
+  end
+
+  newparam(:unless_uid) do
+    desc 'This keeps specific uids or ranges of uids from being purged when purge is true.
+      Accepts integers, integer strings, and arrays of integers or integer strings.
+      To specify a range of uids, consider using the range() function from stdlib.'
+
+    munge do |value|
+      value = [value] unless value.is_a? Array
+      value.flatten.collect do |v|
+        case v
+          when Integer
+            v
+          when String
+            Integer(v)
+          else
+            raise ArgumentError, "Invalid value #{v.inspect}."
+        end
+      end
+    end
+  end
+
+  def check(resource)
+    @checkmethod ||= "#{self[:name]}_check"
+    @hascheck ||= respond_to?(@checkmethod)
+    if @hascheck
+      return send(@checkmethod, resource)
+    else
+      return true
+    end
+  end
+
+  def able_to_ensure_absent?(resource)
+      resource[:ensure] = :absent
+  rescue ArgumentError, Puppet::Error
+      err "The 'ensure' attribute on #{self[:name]} resources does not accept 'absent' as a value"
+      false
+  end
+
+  # Generate any new resources we need to manage.  This is pretty hackish
+  # right now, because it only supports purging.
+  def generate
+    return [] unless self.purge?
+    resource_type.instances.
+      reject { |r| catalog.resource_refs.include? r.ref }.
+      select { |r| check(r) }.
+      select { |r| r.class.validproperty?(:ensure) }.
+      select { |r| able_to_ensure_absent?(r) }.
+      each { |resource|
+        @parameters.each do |name, param|
+          resource[name] = param.value if param.metaparam?
+        end
+
+        # Mark that we're purging, so transactions can handle relationships
+        # correctly
+        resource.purging
+      }
+  end
+
+  def resource_type
+    unless defined?(@resource_type)
+      unless type = Puppet::Type.type(self[:name])
+        raise Puppet::DevError, "Could not find resource type"
+      end
+      @resource_type = type
+    end
+    @resource_type
+  end
+
+  # Make sure we don't purge users with specific uids
+  def user_check(resource)
+    return true unless self[:name] == "user"
+    return true unless self[:unless_system_user]
+    resource[:audit] = :uid
+    current_values = resource.retrieve_resource
+    current_uid = current_values[resource.property(:uid)]
+    unless_uids = self[:unless_uid]
+
+    return false if system_users.include?(resource[:name])
+    return false if unless_uids && unless_uids.include?(current_uid)
+
+    current_uid > self[:unless_system_user]
+  end
+
+  def system_users
+    %w{root nobody bin noaccess daemon sys}
+  end
+
+  def self.system_users_max_uid
+    return @system_users_max_uid if @system_users_max_uid
+
+    # First try to read the minimum user id from login.defs
+    if Puppet::FileSystem.exist?('/etc/login.defs')
+      @system_users_max_uid = Puppet::FileSystem.each_line '/etc/login.defs' do |line|
+        break $1.to_i - 1 if line =~ /^\s*UID_MIN\s+(\d+)(\s*#.*)?$/
+      end
+    end
+
+    # Otherwise, use a sensible default based on the OS family
+    @system_users_max_uid ||= case Facter.value(:osfamily)
+      when 'OpenBSD', 'FreeBSD'
+        999
+      else
+        499
+    end
+
+    @system_users_max_uid
+  end
+
+  def self.reset_system_users_max_uid!
+    @system_users_max_uid = nil
+  end
+end

data/vendor/pup410/lib/puppet/type/scheduled_task.rb

@@ -0,0 +1,184 @@
+require 'puppet/util'
+
+Puppet::Type.newtype(:scheduled_task) do
+  include Puppet::Util
+
+  @doc = "Installs and manages Windows Scheduled Tasks.  All attributes
+    except `name`, `command`, and `trigger` are optional; see the description
+    of the `trigger` attribute for details on setting schedules."
+
+  ensurable
+
+  newproperty(:enabled) do
+    desc "Whether the triggers for this task should be enabled. This attribute
+      affects every trigger for the task; triggers cannot be enabled or
+      disabled individually."
+
+    newvalue(:true,  :event => :task_enabled)
+    newvalue(:false, :event => :task_disabled)
+
+    defaultto(:true)
+  end
+
+  newparam(:name) do
+    desc "The name assigned to the scheduled task.  This will uniquely
+      identify the task on the system."
+
+    isnamevar
+  end
+
+  newproperty(:command) do
+    desc "The full path to the application to run, without any arguments."
+
+    validate do |value|
+      raise Puppet::Error.new('Must be specified using an absolute path.') unless absolute_path?(value)
+    end
+    munge do |value|
+      # windows converts slashes to backslashes, so the *is* value
+      # has backslashes. Do the same for the *should* value, so that
+      # we are slash-insensitive. See #13009
+      File.expand_path(value).gsub(/\//, '\\')
+    end
+  end
+
+  newproperty(:working_dir) do
+    desc "The full path of the directory in which to start the command."
+
+    validate do |value|
+      raise Puppet::Error.new('Must be specified using an absolute path.') unless absolute_path?(value)
+    end
+  end
+
+  newproperty(:arguments) do
+    desc "Any arguments or flags that should be passed to the command. Multiple arguments
+      should be specified as a space-separated string."
+  end
+
+  newproperty(:user) do
+    desc "The user to run the scheduled task as.  Please note that not
+      all security configurations will allow running a scheduled task
+      as 'SYSTEM', and saving the scheduled task under these
+      conditions will fail with a reported error of 'The operation
+      completed successfully'.  It is recommended that you either
+      choose another user to run the scheduled task, or alter the
+      security policy to allow v1 scheduled tasks to run as the
+      'SYSTEM' account.  Defaults to 'SYSTEM'.
+
+      Please also note that Puppet must be running as a privileged user
+      in order to manage `scheduled_task` resources. Running as an
+      unprivileged user will result in 'access denied' errors."
+
+    defaultto :system
+
+    def insync?(current)
+      provider.user_insync?(current, @should)
+    end
+  end
+
+  newparam(:password) do
+    desc "The password for the user specified in the 'user' attribute.
+      This is only used if specifying a user other than 'SYSTEM'.
+      Since there is no way to retrieve the password used to set the
+      account information for a task, this parameter will not be used
+      to determine if a scheduled task is in sync or not."
+  end
+
+  newproperty(:trigger, :array_matching => :all) do
+    desc <<-'EOT'
+      One or more triggers defining when the task should run. A single trigger is
+      represented as a hash, and multiple triggers can be specified with an array of
+      hashes.
+
+      A trigger can contain the following keys:
+
+      * For all triggers:
+          * `schedule` **(Required)** --- What kind of trigger this is.
+            Valid values are `daily`, `weekly`, `monthly`, or `once`. Each kind
+            of trigger is configured with a different set of keys; see the
+            sections below. (`once` triggers only need a start time/date.)
+          * `start_time` **(Required)** --- The time of day when the trigger should
+            first become active. Several time formats will work, but we
+            suggest 24-hour time formatted as HH:MM.
+          * `start_date` ---  The date when the trigger should first become active.
+            Defaults to the current date. You should format dates as YYYY-MM-DD,
+            although other date formats may work. (Under the hood, this uses `Date.parse`.)
+          * `minutes_interval` --- The repeat interval in minutes.
+          * `minutes_duration` --- The duration in minutes, needs to be greater than the
+            minutes_interval.
+      * For `daily` triggers:
+          * `every` --- How often the task should run, as a number of days. Defaults
+            to 1. ("2" means every other day, "3" means every three days, etc.)
+      * For `weekly` triggers:
+          * `every` --- How often the task should run, as a number of weeks. Defaults
+            to 1. ("2" means every other week, "3" means every three weeks, etc.)
+          * `day_of_week` --- Which days of the week the task should run, as an array.
+            Defaults to all days. Each day must be one of `mon`, `tues`,
+            `wed`, `thurs`, `fri`, `sat`, `sun`, or `all`.
+      * For `monthly` (by date) triggers:
+          * `months` --- Which months the task should run, as an array. Defaults to
+            all months. Each month must be an integer between 1 and 12.
+          * `on` **(Required)** --- Which days of the month the task should run,
+            as an array. Each day must be either an integer between 1 and 31,
+            or the special value `last,` which is always the last day of the month.
+      * For `monthly` (by weekday) triggers:
+          * `months` --- Which months the task should run, as an array. Defaults to
+            all months. Each month must be an integer between 1 and 12.
+          * `day_of_week` **(Required)** --- Which day of the week the task should
+            run, as an array with only one element. Each day must be one of `mon`,
+            `tues`, `wed`, `thurs`, `fri`, `sat`, `sun`, or `all`.
+          * `which_occurrence` **(Required)** --- The occurrence of the chosen weekday
+            when the task should run. Must be one of `first`, `second`, `third`,
+            `fourth`, `fifth`, or `last`.
+
+
+      Examples:
+
+          # Run at 8am on the 1st, 15th, and last day of the month in January, March,
+          # May, July, September, and November, starting after August 31st, 2011.
+          trigger => {
+            schedule   => monthly,
+            start_date => '2011-08-31',   # Defaults to current date
+            start_time => '08:00',        # Must be specified
+            months     => [1,3,5,7,9,11], # Defaults to all
+            on         => [1, 15, last],  # Must be specified
+          }
+
+          # Run at 8am on the first Monday of the month for January, March, and May,
+          # starting after August 31st, 2011.
+          trigger => {
+            schedule         => monthly,
+            start_date       => '2011-08-31', # Defaults to current date
+            start_time       => '08:00',      # Must be specified
+            months           => [1,3,5],      # Defaults to all
+            which_occurrence => first,        # Must be specified
+            day_of_week      => [mon],        # Must be specified
+          }
+
+          # Run daily repeating every 30 minutes between 9am and 5pm (480 minutes) starting after August 31st, 2011.
+          trigger => {
+            schedule         => daily,
+            start_date       => '2011-08-31', # Defaults to current date
+            start_time       => '8:00',       # Must be specified
+            minutes_interval => 30,
+            minutes_duration => 480,
+          }
+
+    EOT
+
+    validate do |value|
+      provider.validate_trigger(value)
+    end
+
+    def insync?(current)
+      provider.trigger_insync?(current, @should)
+    end
+
+    def should_to_s(new_value=@should)
+      self.class.format_value_for_display(new_value)
+    end
+
+    def is_to_s(current_value=@is)
+      self.class.format_value_for_display(current_value)
+    end
+  end
+end

data/vendor/pup410/lib/puppet/type/ssh_authorized_key.rb

@@ -0,0 +1,159 @@
+module Puppet
+  Type.newtype(:ssh_authorized_key) do
+    @doc = "Manages SSH authorized keys. Currently only type 2 keys are supported.
+
+      In their native habitat, SSH keys usually appear as a single long line, in
+      the format `<TYPE> <KEY> <NAME/COMMENT>`. This resource type requires you
+      to split that line into several attributes. Thus, a key that appears in
+      your `~/.ssh/id_rsa.pub` file like this...
+
+          ssh-rsa AAAAB3Nza[...]qXfdaQ== nick@magpie.example.com
+
+      ...would translate to the following resource:
+
+          ssh_authorized_key { 'nick@magpie.example.com':
+            ensure => present,
+            user   => 'nick',
+            type   => 'ssh-rsa',
+            key    => 'AAAAB3Nza[...]qXfdaQ==',
+          }
+
+      To ensure that only the currently approved keys are present, you can purge
+      unmanaged SSH keys on a per-user basis. Do this with the `user` resource
+      type's `purge_ssh_keys` attribute:
+
+          user { 'nick':
+            ensure         => present,
+            purge_ssh_keys => true,
+          }
+
+      This will remove any keys in `~/.ssh/authorized_keys` that aren't being
+      managed with `ssh_authorized_key` resources. See the documentation of the
+      `user` type for more details.
+
+      **Autorequires:** If Puppet is managing the user account in which this
+      SSH key should be installed, the `ssh_authorized_key` resource will autorequire
+      that user."
+
+    ensurable
+
+    newparam(:name) do
+      desc "The SSH key comment. This can be anything, and doesn't need to match
+        the original comment from the `.pub` file.
+
+        Due to internal limitations, this must be unique across all user accounts;
+        if you want to specify one key for multiple users, you must use a different
+        comment for each instance."
+
+      isnamevar
+
+    end
+
+    newproperty(:type) do
+      desc "The encryption type used."
+
+      newvalues :'ssh-dss', :'ssh-rsa', :'ecdsa-sha2-nistp256', :'ecdsa-sha2-nistp384', :'ecdsa-sha2-nistp521', :'ssh-ed25519'
+
+      aliasvalue(:dsa, :'ssh-dss')
+      aliasvalue(:ed25519, :'ssh-ed25519')
+      aliasvalue(:rsa, :'ssh-rsa')
+    end
+
+    newproperty(:key) do
+      desc "The public key itself; generally a long string of hex characters. The `key`
+        attribute may not contain whitespace.
+
+        Make sure to omit the following in this attribute (and specify them in
+        other attributes):
+
+        * Key headers (e.g. 'ssh-rsa') --- put these in the `type` attribute.
+        * Key identifiers / comments (e.g. 'joe@joescomputer.local') --- put these in
+          the `name` attribute/resource title."
+
+      validate do |value|
+        raise Puppet::Error, "Key must not contain whitespace: #{value}" if value =~ /\s/
+      end
+    end
+
+    newproperty(:user) do
+      desc "The user account in which the SSH key should be installed. The resource
+        will autorequire this user if it is being managed as a `user` resource."
+    end
+
+    newproperty(:target) do
+      desc "The absolute filename in which to store the SSH key. This
+        property is optional and should only be used in cases where keys
+        are stored in a non-standard location (i.e.` not in
+        `~user/.ssh/authorized_keys`)."
+
+      defaultto :absent
+
+      def should
+        return super if defined?(@should) and @should[0] != :absent
+
+        return nil unless user = resource[:user]
+
+        begin
+          return File.expand_path("~#{user}/.ssh/authorized_keys")
+        rescue
+          Puppet.debug "The required user is not yet present on the system"
+          return nil
+        end
+      end
+
+      def insync?(is)
+        is == should
+      end
+    end
+
+    newproperty(:options, :array_matching => :all) do
+      desc "Key options; see sshd(8) for possible values. Multiple values
+        should be specified as an array."
+
+      defaultto do :absent end
+
+      def is_to_s(value)
+        if value == :absent or value.include?(:absent)
+          super
+        else
+          value.join(",")
+        end
+      end
+
+      def should_to_s(value)
+        if value == :absent or value.include?(:absent)
+          super
+        else
+          value.join(",")
+        end
+      end
+
+      validate do |value|
+        unless value == :absent or value =~ /^[-a-z0-9A-Z_]+(?:=\".*?\")?$/
+          raise Puppet::Error, "Option #{value} is not valid. A single option must either be of the form 'option' or 'option=\"value\". Multiple options must be provided as an array"
+        end
+      end
+    end
+
+    autorequire(:user) do
+      should(:user) if should(:user)
+    end
+
+    validate do
+      # Go ahead if target attribute is defined
+      return if @parameters[:target].shouldorig[0] != :absent
+
+      # Go ahead if user attribute is defined
+      return if @parameters.include?(:user)
+
+      # If neither target nor user is defined, this is an error
+      raise Puppet::Error, "Attribute 'user' or 'target' is mandatory"
+    end
+
+    # regular expression suitable for use by a ParsedFile based provider
+    REGEX = /^(?:(.+)\s+)?(ssh-dss|ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521)\s+([^ ]+)\s*(.*)$/
+    def self.keyline_regex
+      REGEX
+    end
+  end
+end