puppet 2.7.26 → 3.0.0.rc4

data/lib/puppet/provider/augeas/augeas.rb

@@ -24,7 +24,7 @@ Puppet::Type.type(:augeas).provide(:augeas) do
   include Puppet::Util::Diff
   include Puppet::Util::Package
 
-  confine :feature => :augeas
+  confine :true => Puppet.features.augeas?
 
   has_features :parse_commands, :need_to_run?,:execute_changes
 
@@ -145,7 +145,13 @@ Puppet::Type.type(:augeas).provide(:augeas) do
     unless @aug
       flags = Augeas::NONE
       flags = Augeas::TYPE_CHECK if resource[:type_check] == :true
-      flags |= Augeas::NO_MODL_AUTOLOAD if resource[:incl]
+
+      if resource[:incl]
+        flags |= Augeas::NO_MODL_AUTOLOAD
+      else
+        flags |= Augeas::NO_LOAD
+      end
+
       root = resource[:root]
       load_path = get_load_path(resource)
       debug("Opening augeas with root #{root}, lens path #{load_path}, flags #{flags}")
@@ -153,11 +159,33 @@ Puppet::Type.type(:augeas).provide(:augeas) do
 
       debug("Augeas version #{get_augeas_version} is installed") if versioncmp(get_augeas_version, "0.3.6") >= 0
 
+      # Optimize loading if the context is given and it's a simple path,
+      # requires the glob function from Augeas 0.8.2 or up
+      glob_avail = !aug.match("/augeas/version/pathx/functions/glob").empty?
+      opt_ctx = resource[:context].match("^/files/[^'\"\\[\\]]+$") if resource[:context]
+
+      restricted = false
       if resource[:incl]
         aug.set("/augeas/load/Xfm/lens", resource[:lens])
         aug.set("/augeas/load/Xfm/incl", resource[:incl])
-        aug.load
+        restricted = true
+      elsif glob_avail and opt_ctx
+        restricted = true
+        # Optimize loading if the context is given, requires the glob function
+        # from Augeas 0.8.2 or up
+        ctx_path = resource[:context].sub(/^\/files(.*?)\/?$/, '\1/')
+        load_path = "/augeas/load/*['%s' !~ glob(incl) + regexp('/.*')]" % ctx_path
+
+        if aug.match(load_path).size < aug.match("/augeas/load/*").size
+          aug.rm(load_path)
+          restricted = true
+        else
+          # This will occur if the context is less specific than any glob
+          debug("Unable to optimize files loaded by context path, no glob matches")
+        end
       end
+      aug.load
+      print_load_errors(:warning => restricted)
     end
     @aug
   end
@@ -279,6 +307,33 @@ Puppet::Type.type(:augeas).provide(:augeas) do
     @aug.set("/augeas/save", mode)
   end
 
+  def print_load_errors(args={})
+    errors = @aug.match("/augeas//error")
+    unless errors.empty?
+      if args[:warning]
+        warning("Loading failed for one or more files, see debug for /augeas//error output")
+      else
+        debug("Loading failed for one or more files, output from /augeas//error:")
+      end
+    end
+    print_errors(errors)
+  end
+
+  def print_put_errors
+    errors = @aug.match("/augeas//error[. = 'put_failed']")
+    debug("Put failed on one or more files, output from /augeas//error:") unless errors.empty?
+    print_errors(errors)
+  end
+
+  def print_errors(errors)
+    errors.each do |errnode|
+      @aug.match("#{errnode}/*").each do |subnode|
+        subvalue = @aug.get(subnode)
+        debug("#{subnode} = #{subvalue}")
+      end
+    end
+  end
+
   # Determines if augeas acutally needs to run.
   def need_to_run?
     force = resource[:force]
@@ -310,7 +365,10 @@ Puppet::Type.type(:augeas).provide(:augeas) do
           set_augeas_save_mode(SAVE_NEWFILE)
           do_execute_changes
           save_result = @aug.save
-          fail("Save failed with return code #{save_result}") unless save_result
+          unless save_result
+            print_put_errors
+            fail("Save failed with return code #{save_result}, see debug")
+          end
 
           saved_files = @aug.match("/augeas/events/saved")
           if saved_files.size > 0
@@ -349,8 +407,10 @@ Puppet::Type.type(:augeas).provide(:augeas) do
     set_augeas_save_mode(SAVE_OVERWRITE) if versioncmp(get_augeas_version, "0.3.6") >= 0
     @aug.load
     do_execute_changes
-    success = @aug.save
-    fail("Save failed with return code #{success}") if success != true
+        unless @aug.save
+          print_put_errors
+          fail("Save failed with return code #{success}, see debug")
+        end
 
     :executed
   ensure

data/lib/puppet/provider/command.rb

@@ -0,0 +1,25 @@
+# A command that can be executed on the system
+class Puppet::Provider::Command
+  attr_reader :executable
+  attr_reader :name
+
+  # @param [String] name A way of referencing the name
+  # @param [String] executable The path to the executable file
+  # @param resolver An object for resolving the executable to an absolute path (usually Puppet::Util)
+  # @param executor An object for performing the actual execution of the command (usually Puppet::Util::Execution)
+  # @param [Hash] options Extra options to be used when executing (see Puppet::Util::Execution#execute)
+  def initialize(name, executable, resolver, executor, options = {})
+    @name = name
+    @executable = executable
+    @resolver = resolver
+    @executor = executor
+    @options = options
+  end
+
+  # @param [Array<String>] Any command line arguments to pass to the executable
+  # @returns The output from the command
+  def execute(*args)
+    resolved_executable = @resolver.which(@executable) or raise Puppet::Error, "Command #{@name} is missing"
+    @executor.execute([resolved_executable] + args, @options)
+  end
+end

data/lib/puppet/provider/cron/crontab.rb

@@ -1,6 +1,6 @@
 require 'puppet/provider/parsedfile'
 
-tab = case Facter.value(:operatingsystem)
+tab = case Facter.value(:osfamily)
   when "Solaris"
     :suntab
   when "AIX"

data/lib/puppet/provider/exec.rb

@@ -47,16 +47,21 @@ class Puppet::Provider::Exec < Puppet::Provider
           end
         end
 
-        withenv environment do
-          Timeout::timeout(resource[:timeout]) do
-            output, status = Puppet::Util::SUIDManager.
-              run_and_capture(command, resource[:user], resource[:group])
-          end
-          # The shell returns 127 if the command is missing.
-          if status.exitstatus == 127
-            raise ArgumentError, output
-          end
+
+        Timeout::timeout(resource[:timeout]) do
+          # note that we are passing "false" for the "override_locale" parameter, which ensures that the user's
+          # default/system locale will be respected.  Callers may override this behavior by setting locale-related
+          # environment variables (LANG, LC_ALL, etc.) in their 'environment' configuration.
+          output, status = Puppet::Util::SUIDManager.
+              run_and_capture(command, resource[:user], resource[:group],
+                              :override_locale => false,
+                              :custom_environment => environment)
         end
+        # The shell returns 127 if the command is missing.
+        if status.exitstatus == 127
+          raise ArgumentError, output
+        end
+
       end
     rescue Errno::ENOENT => detail
       self.fail detail.to_s

data/lib/puppet/provider/exec/posix.rb

@@ -27,7 +27,7 @@ Puppet::Type.type(:exec).provide :posix, :parent => Puppet::Provider::Exec do
     end
 
     if resource[:path]
-      withenv :PATH => resource[:path].join(File::PATH_SEPARATOR) do
+      Puppet::Util.withenv :PATH => resource[:path].join(File::PATH_SEPARATOR) do
         return if which(exe)
       end
     end

data/lib/puppet/provider/exec/windows.rb

@@ -1,12 +1,11 @@
 require 'puppet/provider/exec'
 
 Puppet::Type.type(:exec).provide :windows, :parent => Puppet::Provider::Exec do
-  include Puppet::Util::Execution
 
   confine    :operatingsystem => :windows
   defaultfor :operatingsystem => :windows
 
-  desc <<-'EOT'
+  desc <<-EOT
     Execute external binaries on Windows systems. As with the `posix`
     provider, this provider directly calls the command with the arguments
     given, without passing it through a shell or performing any interpolation.
@@ -46,7 +45,7 @@ Puppet::Type.type(:exec).provide :windows, :parent => Puppet::Provider::Exec do
     end
 
     if resource[:path]
-      withenv :PATH => resource[:path].join(File::PATH_SEPARATOR) do
+      Puppet::Util.withenv :PATH => resource[:path].join(File::PATH_SEPARATOR) do
         return if which(exe)
       end
     end

data/lib/puppet/provider/file/windows.rb

@@ -11,19 +11,38 @@ Puppet::Type.type(:file).provide :windows do
     include Puppet::Util::Windows::Security
   end
 
-  # Determine if the account is valid, and if so, return the UID
-  def name2id(value)
-    Puppet::Util::Windows::Security.name_to_sid(value)
-  end
+  ERROR_INVALID_SID_STRUCTURE = 1337
 
-  # If it's a valid SID, get the name. Otherwise, it's already a name,
-  # so just return it.
   def id2name(id)
-    if Puppet::Util::Windows::Security.valid_sid?(id)
-      Puppet::Util::Windows::Security.sid_to_name(id)
-    else
-      id
+    # If it's a valid sid, get the name. Otherwise, it's already a name, so
+    # just return it.
+    begin
+      if string_to_sid_ptr(id)
+        name = nil
+        Puppet::Util::ADSI.execquery(
+          "SELECT Name FROM Win32_Account WHERE SID = '#{id}'
+           AND LocalAccount = true"
+        ).each { |a| name ||= a.name }
+        return name
+      end
+    rescue Puppet::Util::Windows::Error => e
+      raise unless e.code == ERROR_INVALID_SID_STRUCTURE
     end
+
+    id
+  end
+
+  # Determine if the account is valid, and if so, return the UID
+  def name2id(value)
+    # If it's a valid sid, then return it. Else, it's a name we need to convert
+    # to sid.
+    begin
+      return value if string_to_sid_ptr(value)
+    rescue Puppet::Util::Windows::Error => e
+      raise unless e.code == ERROR_INVALID_SID_STRUCTURE
+    end
+
+    Puppet::Util::ADSI.sid_for_account(value) rescue nil
   end
 
   # We use users and groups interchangeably, so use the same methods for both

data/lib/puppet/provider/group/groupadd.rb

@@ -7,7 +7,7 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
 
   commands :add => "groupadd", :delete => "groupdel", :modify => "groupmod"
 
-  has_feature :system_groups unless %w{HP-UX Solaris}.include? Facter.value(:operatingsystem)
+  has_feature :system_groups
 
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
@@ -21,9 +21,10 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
       end
     end
     cmd << "-o" if @resource.allowdupe?
-    cmd << "-r" if @resource.system? and self.class.system_groups?
+    cmd << "-r" if @resource.system?
     cmd << @resource[:name]
 
     cmd
   end
 end
+

data/lib/puppet/provider/group/ldap.rb

@@ -12,7 +12,7 @@ Puppet::Type.type(:group).provide :ldap, :parent => Puppet::Provider::Ldap do
     not specify one, but it is a potentially expensive operation, as it
     iterates across all existing groups to pick the appropriate next one."
 
-  confine :feature => :ldap, :false => (Puppet[:ldapuser] == "")
+  confine :true => Puppet.features.ldap?, :false => (Puppet[:ldapuser] == "")
 
   # We're mapping 'members' here because we want to make it
   # easy for the ldap user provider to manage groups.  This

data/lib/puppet/provider/group/windows_adsi.rb

@@ -41,7 +41,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
   end
 
   def gid
-    Puppet::Util::Windows::Security.name_to_sid(@resource[:name])
+    Puppet::Util::ADSI.sid_for_account(@resource[:name])
   end
 
   def gid=(value)

data/lib/puppet/provider/host/parsed.rb

@@ -1,7 +1,7 @@
 require 'puppet/provider/parsedfile'
 
 hosts = nil
-case Facter.value(:operatingsystem)
+case Facter.value(:osfamily)
 when "Solaris"; hosts = "/etc/inet/hosts"
 when "windows"
   require 'win32/resolv'

data/lib/puppet/provider/ldap.rb

@@ -46,11 +46,7 @@ class Puppet::Provider::Ldap < Puppet::Provider
     @property_hash[:ensure] = :present
     self.class.resource_type.validproperties.each do |property|
       if val = resource.should(property)
-        if property.to_s == 'gid'
-          self.gid = val
-        else
-          @property_hash[property] = val
-        end
+        @property_hash[property] = val
       end
     end
   end

data/lib/puppet/provider/mount/parsed.rb

@@ -2,7 +2,7 @@ require 'puppet/provider/parsedfile'
 require 'puppet/provider/mount'
 
 fstab = nil
-case Facter.value(:operatingsystem)
+case Facter.value(:osfamily)
 when "Solaris"; fstab = "/etc/vfstab"
 else
   fstab = "/etc/fstab"
@@ -18,7 +18,7 @@ Puppet::Type.type(:mount).provide(
 
   commands :mountcmd => "mount", :umount => "umount"
 
-  case Facter.value(:operatingsystem)
+  case Facter.value(:osfamily)
   when "Solaris"
     @fields = [:device, :blockdevice, :name, :fstype, :pass, :atboot, :options]
   else
@@ -88,7 +88,7 @@ Puppet::Type.type(:mount).provide(
 
   def self.mountinstances
     # XXX: Will not work for mount points that have spaces in path (does fstab support this anyways?)
-    regex = case Facter.value(:operatingsystem)
+    regex = case Facter.value(:osfamily) 
       when "Darwin"
         / on (?:\/private\/var\/automount)?(\S*)/
       when "Solaris", "HP-UX"

data/lib/puppet/provider/nameservice.rb

@@ -115,7 +115,7 @@ class Puppet::Provider::NameService < Puppet::Provider
     field = field.intern
     id_generators = {:user => :uid, :group => :gid}
     if id_generators[@resource.class.name] == field
-      return autogen_id(field)
+      return self.class.autogen_id(field, @resource.class.name)
     else
       if value = self.class.autogen_default(field)
         return value
@@ -127,33 +127,33 @@ class Puppet::Provider::NameService < Puppet::Provider
     end
   end
 
-  # Autogenerate either a uid or a gid.  This is hard-coded: we can only
-  # generate one field type per class.
-  def autogen_id(field)
-    highest = 0
-
-    group = method = nil
-    case @resource.class.name
-    when :user; group = :passwd; method = :uid
-    when :group; group = :group; method = :gid
+  # Autogenerate either a uid or a gid.  This is not very flexible: we can
+  # only generate one field type per class, and get kind of confused if asked
+  # for both.
+  def self.autogen_id(field, resource_type)
+    # Figure out what sort of value we want to generate.
+    case resource_type
+    when :user;   database = :passwd;  method = :uid
+    when :group;  database = :group;   method = :gid
     else
       raise Puppet::DevError, "Invalid resource name #{resource}"
     end
 
-    # Make sure we don't use the same value multiple times
-    if defined?(@@prevauto)
-      @@prevauto += 1
-    else
-      Etc.send(group) { |obj|
-        if obj.gid > highest
-          highest = obj.send(method) unless obj.send(method) > 65000
-        end
-      }
-
-      @@prevauto = highest + 1
+    # Initialize from the data set, if needed.
+    unless @prevauto
+      # Sadly, Etc doesn't return an enumerator, it just invokes the block
+      # given, or returns the first record from the database.  There is no
+      # other, more convenient enumerator for these, so we fake one with this
+      # loop.  Thanks, Ruby, for your awesome abstractions. --daniel 2012-03-23
+      highest = []
+      Etc.send(database) {|entry| highest << entry.send(method) }
+      highest = highest.reject {|x| x > 65000 }.max
+
+      @prevauto = highest || 1000
     end
 
-    @@prevauto
+    # ...and finally increment and return the next value.
+    @prevauto += 1
   end
 
   def create

data/lib/puppet/provider/nameservice/directoryservice.rb

@@ -1,11 +1,9 @@
 require 'puppet'
 require 'puppet/provider/nameservice'
 require 'facter/util/plist'
-require 'cgi'
 require 'fileutils'
 
-class Puppet::Provider::NameService
-class DirectoryService < Puppet::Provider::NameService
+class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameService
   # JJM: Dive into the singleton_class
   class << self
     # JJM: This allows us to pass information when calling
@@ -32,37 +30,36 @@ class DirectoryService < Puppet::Provider::NameService
   # JJM: Note, this is de-coupled from the Puppet::Type, and must
   #     be actively maintained.  There may also be collisions with different
   #     types (Users, Groups, Mounts, Hosts, etc...)
-  @@ds_to_ns_attribute_map = {
-    'RecordName' => :name,
-    'PrimaryGroupID' => :gid,
-    'NFSHomeDirectory' => :home,
-    'UserShell' => :shell,
-    'UniqueID' => :uid,
-    'RealName' => :comment,
-    'Password' => :password,
-    'GeneratedUID' => :guid,
-    'IPAddress'    => :ip_address,
-    'ENetAddress'  => :en_address,
-    'GroupMembership' => :members,
-  }
+  def ds_to_ns_attribute_map; self.class.ds_to_ns_attribute_map; end
+  def self.ds_to_ns_attribute_map
+    {
+      'RecordName' => :name,
+      'PrimaryGroupID' => :gid,
+      'NFSHomeDirectory' => :home,
+      'UserShell' => :shell,
+      'UniqueID' => :uid,
+      'RealName' => :comment,
+      'Password' => :password,
+      'GeneratedUID' => :guid,
+      'IPAddress'    => :ip_address,
+      'ENetAddress'  => :en_address,
+      'GroupMembership' => :members,
+    }
+  end
+
   # JJM The same table as above, inverted.
-  @@ns_to_ds_attribute_map = {
-    :name => 'RecordName',
-    :gid => 'PrimaryGroupID',
-    :home => 'NFSHomeDirectory',
-    :shell => 'UserShell',
-    :uid => 'UniqueID',
-    :comment => 'RealName',
-    :password => 'Password',
-    :guid => 'GeneratedUID',
-    :en_address => 'ENetAddress',
-    :ip_address => 'IPAddress',
-    :members => 'GroupMembership',
-  }
-
-  @@password_hash_dir = "/var/db/shadow/hash"
-  @@users_plist_dir    = '/var/db/dslocal/nodes/Default/users'
+  def ns_to_ds_attribute_map; self.class.ns_to_ds_attribute_map end
+  def self.ns_to_ds_attribute_map
+    @ns_to_ds_attribute_map ||= ds_to_ns_attribute_map.invert
+  end
 
+  def self.password_hash_dir
+    '/var/db/shadow/hash'
+  end
+
+  def self.users_plist_dir
+    '/var/db/dslocal/nodes/Default/users'
+  end
 
   def self.instances
     # JJM Class method that provides an array of instance objects of this
@@ -96,16 +93,9 @@ class DirectoryService < Puppet::Provider::NameService
       # Make sure we've loaded all of the facts
       Facter.loadfacts
 
-      if Facter.value(:macosx_productversion_major)
-        product_version_major = Facter.value(:macosx_productversion_major)
-      else
-        # TODO: remove this code chunk once we require Facter 1.5.5 or higher.
-        Puppet.warning("DEPRECATION WARNING: Future versions of the directoryservice provider will require Facter 1.5.5 or newer.")
-        product_version = Facter.value(:macosx_productversion)
-        fail("Could not determine OS X version from Facter") if product_version.nil?
-        product_version_major = product_version.scan(/(\d+)\.(\d+)./).join(".")
-      end
-      fail("#{product_version_major} is not supported by the directoryservice provider") if %w{10.0 10.1 10.2 10.3}.include?(product_version_major)
+      product_version_major = Facter.value(:macosx_productversion_major)
+
+      fail("#{product_version_major} is not supported by the directoryservice provider") if %w{10.0 10.1 10.2 10.3 10.4}.include?(product_version_major)
       @macosx_version_major = product_version_major
       return @macosx_version_major
     rescue Puppet::ExecutionFailure => detail
@@ -124,46 +114,6 @@ class DirectoryService < Puppet::Provider::NameService
     dscl_output.split("\n")
   end
 
-  def self.parse_dscl_url_data(dscl_output)
-    # we need to construct a Hash from the dscl -url output to match
-    # that returned by the dscl -plist output for 10.5+ clients.
-    #
-    # Nasty assumptions:
-    #   a) no values *end* in a colon ':', only keys
-    #   b) if a line ends in a colon and the next line does start with
-    #      a space, then the second line is a value of the first.
-    #   c) (implied by (b)) keys don't start with spaces.
-
-    dscl_plist = {}
-    dscl_output.split("\n").inject([]) do |array, line|
-      if line =~ /^\s+/   # it's a value
-        array[-1] << line # add the value to the previous key
-      else
-        array << line
-      end
-      array
-    end.compact
-
-    dscl_output.each do |line|
-      # This should be a 'normal' entry. key and value on one line.
-      # We split on ': ' to deal with keys/values with a colon in them.
-      split_array = line.split(/:\s+/)
-      key = split_array.first
-      value = CGI::unescape(split_array.last.strip.chomp)
-      # We need to treat GroupMembership separately as it is currently
-      # the only attribute we care about multiple values for, and
-      # the values can never contain spaces (shortnames)
-      # We also make every value an array to be consistent with the
-      # output of dscl -plist under 10.5
-      if key == "GroupMembership"
-        dscl_plist[key] = value.split(/\s/)
-      else
-        dscl_plist[key] = [value]
-      end
-    end
-    dscl_plist
-  end
-
   def self.parse_dscl_plist_data(dscl_output)
     Plist.parse_xml(dscl_output)
   end
@@ -172,9 +122,9 @@ class DirectoryService < Puppet::Provider::NameService
     attribute_hash = {}
     input_hash.keys.each do |key|
       ds_attribute = key.sub("dsAttrTypeStandard:", "")
-      next unless (@@ds_to_ns_attribute_map.keys.include?(ds_attribute) and type_properties.include? @@ds_to_ns_attribute_map[ds_attribute])
+      next unless (ds_to_ns_attribute_map.keys.include?(ds_attribute) and type_properties.include? ds_to_ns_attribute_map[ds_attribute])
       ds_value = input_hash[key]
-      case @@ds_to_ns_attribute_map[ds_attribute]
+      case ds_to_ns_attribute_map[ds_attribute]
         when :members
           ds_value = ds_value # only members uses arrays so far
         when :gid, :uid
@@ -189,7 +139,7 @@ class DirectoryService < Puppet::Provider::NameService
           end
         else ds_value = ds_value[0]
       end
-      attribute_hash[@@ds_to_ns_attribute_map[ds_attribute]] = ds_value
+      attribute_hash[ds_to_ns_attribute_map[ds_attribute]] = ds_value
     end
 
     # NBK: need to read the existing password here as it's not actually
@@ -220,21 +170,17 @@ class DirectoryService < Puppet::Provider::NameService
       fail("Could not get report.  command execution failed.")
     end
 
-    # Two code paths is ugly, but until we can drop 10.4 support we don't
-    # have a lot of choice. Ultimately this should all be done using Ruby
-    # to access the DirectoryService APIs directly, but that's simply not
-    # feasible for a while yet.
-    if self.get_macosx_version_major > "10.4"
-      dscl_plist = self.parse_dscl_plist_data(dscl_output)
-    elsif self.get_macosx_version_major == "10.4"
-      dscl_plist = self.parse_dscl_url_data(dscl_output)
-    else
-      fail("Puppet does not support OS X versions < 10.4")
-    end
+    # (#11593) Remove support for OS X 10.4 and earlier
+    fail_if_wrong_version
+    dscl_plist = self.parse_dscl_plist_data(dscl_output)
 
     self.generate_attribute_hash(dscl_plist, *type_properties)
   end
 
+  def self.fail_if_wrong_version
+    fail("Puppet does not support OS X versions < 10.5") unless self.get_macosx_version_major >= "10.5"
+  end
+
   def self.get_exec_preamble(ds_action, resource_name = nil)
     # JJM 2007-07-24
     #     DSCL commands are often repetitive and contain the same positional
@@ -243,17 +189,9 @@ class DirectoryService < Puppet::Provider::NameService
     #     This method spits out proper DSCL commands for us.
     #     We EXPECT name to be @resource[:name] when called from an instance object.
 
-    # 10.4 doesn't support the -plist option for dscl, and 10.5 has a
-    # different format for the -url output with objects with spaces in
-    # their values. *sigh*. Use -url for 10.4 in the hope this can be
-    # deprecated one day, and use -plist for 10.5 and higher.
-    if self.get_macosx_version_major > "10.4"
-      command_vector = [ command(:dscl), "-plist", "." ]
-    elsif self.get_macosx_version_major == "10.4"
-      command_vector = [ command(:dscl), "-url", "." ]
-    else
-      fail("Puppet does not support OS X versions < 10.4")
-    end
+    # (#11593) Remove support for OS X 10.4 and earlier
+    fail_if_wrong_version
+    command_vector = [ command(:dscl), "-plist", "." ]
 
     # JJM: The actual action to perform.  See "man dscl"
     #      Common actiosn: -create, -delete, -merge, -append, -passwd
@@ -275,7 +213,7 @@ class DirectoryService < Puppet::Provider::NameService
     # version '10.10' would be < '10.7' with simple string comparison. This
     # if-statement only executes if the current version is less-than 10.7
     if (Puppet::Util::Package.versioncmp(get_macosx_version_major, '10.7') == -1)
-      password_hash_file = "#{@@password_hash_dir}/#{guid}"
+      password_hash_file = "#{password_hash_dir}/#{guid}"
       begin
         File.open(password_hash_file, 'w') { |f| f.write(password_hash)}
       rescue Errno::EACCES => detail
@@ -313,13 +251,13 @@ class DirectoryService < Puppet::Provider::NameService
              Please check your password and try again.")
       end
 
-      if File.exists?("#{@@users_plist_dir}/#{resource_name}.plist")
+      if File.exists?("#{users_plist_dir}/#{resource_name}.plist")
         # If a plist already exists in /var/db/dslocal/nodes/Default/users, then
         # we will need to extract the binary plist from the 'ShadowHashData'
         # key, log the new password into the resultant plist's 'SALTED-SHA512'
         # key, and then save the entire structure back.
         users_plist = Plist::parse_xml(plutil( '-convert', 'xml1', '-o', '/dev/stdout', \
-                                       "#{@@users_plist_dir}/#{resource_name}.plist"))
+                                       "#{users_plist_dir}/#{resource_name}.plist"))
 
         # users_plist['ShadowHashData'][0].string is actually a binary plist
         # that's nested INSIDE the user's plist (which itself is a binary
@@ -345,8 +283,8 @@ class DirectoryService < Puppet::Provider::NameService
         # a binary plist.
         changed_plist = convert_xml_to_binary(converted_hash_plist)
         users_plist['ShadowHashData'][0].string = changed_plist
-        Plist::Emit.save_plist(users_plist, "#{@@users_plist_dir}/#{resource_name}.plist")
-        plutil('-convert', 'binary1', "#{@@users_plist_dir}/#{resource_name}.plist")
+        Plist::Emit.save_plist(users_plist, "#{users_plist_dir}/#{resource_name}.plist")
+        plutil('-convert', 'binary1', "#{users_plist_dir}/#{resource_name}.plist")
       end
     end
   end
@@ -357,7 +295,7 @@ class DirectoryService < Puppet::Provider::NameService
     # if-statement only executes if the current version is less-than 10.7
     if (Puppet::Util::Package.versioncmp(get_macosx_version_major, '10.7') == -1)
       password_hash = nil
-      password_hash_file = "#{@@password_hash_dir}/#{guid}"
+      password_hash_file = "#{password_hash_dir}/#{guid}"
       if File.exists?(password_hash_file) and File.file?(password_hash_file)
         fail("Could not read password hash file at #{password_hash_file}") if not File.readable?(password_hash_file)
         f = File.new(password_hash_file)
@@ -366,11 +304,11 @@ class DirectoryService < Puppet::Provider::NameService
       end
       password_hash
     else
-      if File.exists?("#{@@users_plist_dir}/#{username}.plist")
+      if File.exists?("#{users_plist_dir}/#{username}.plist")
         # If a plist exists in /var/db/dslocal/nodes/Default/users, we will
         # extract the binary plist from the 'ShadowHashData' key, decode the
         # salted-SHA512 password hash, and then return it.
-        users_plist = Plist::parse_xml(plutil('-convert', 'xml1', '-o', '/dev/stdout', "#{@@users_plist_dir}/#{username}.plist"))
+        users_plist = Plist::parse_xml(plutil('-convert', 'xml1', '-o', '/dev/stdout', "#{users_plist_dir}/#{username}.plist"))
         if users_plist['ShadowHashData']
           # users_plist['ShadowHashData'][0].string is actually a binary plist
           # that's nested INSIDE the user's plist (which itself is a binary
@@ -467,14 +405,14 @@ class DirectoryService < Puppet::Provider::NameService
 
   def password=(passphrase)
     exec_arg_vector = self.class.get_exec_preamble("-read", @resource.name)
-    exec_arg_vector << @@ns_to_ds_attribute_map[:guid]
+    exec_arg_vector << ns_to_ds_attribute_map[:guid]
     begin
       guid_output = execute(exec_arg_vector)
       guid_plist = Plist.parse_xml(guid_output)
       # Although GeneratedUID like all DirectoryService values can be multi-valued
       # according to the schema, in practice user accounts cannot have multiple UUIDs
       # otherwise Bad Things Happen, so we just deal with the first value.
-      guid = guid_plist["dsAttrTypeStandard:#{@@ns_to_ds_attribute_map[:guid]}"][0]
+      guid = guid_plist["dsAttrTypeStandard:#{ns_to_ds_attribute_map[:guid]}"][0]
       self.class.set_password(@resource.name, guid, passphrase)
     rescue Puppet::ExecutionFailure => detail
       fail("Could not set #{param} on #{@resource.class.name}[#{@resource.name}]: #{detail}")
@@ -500,7 +438,7 @@ class DirectoryService < Puppet::Provider::NameService
       exec_arg_vector = self.class.get_exec_preamble("-create", @resource[:name])
       # JJM: The following line just maps the NS name to the DS name
       #      e.g. { :uid => 'UniqueID' }
-      exec_arg_vector << @@ns_to_ds_attribute_map[param.intern]
+      exec_arg_vector << ns_to_ds_attribute_map[param.intern]
       # JJM: The following line sends the actual value to set the property to
       exec_arg_vector << value.to_s
       begin
@@ -529,7 +467,7 @@ class DirectoryService < Puppet::Provider::NameService
     guid = %x{/usr/bin/uuidgen}.chomp
 
     exec_arg_vector = self.class.get_exec_preamble("-create", @resource[:name])
-    exec_arg_vector << @@ns_to_ds_attribute_map[:guid] << guid
+    exec_arg_vector << ns_to_ds_attribute_map[:guid] << guid
     begin
       execute(exec_arg_vector)
     rescue Puppet::ExecutionFailure => detail
@@ -555,7 +493,7 @@ class DirectoryService < Puppet::Provider::NameService
           add_members(nil, value)
         else
           exec_arg_vector = self.class.get_exec_preamble("-create", @resource[:name])
-          exec_arg_vector << @@ns_to_ds_attribute_map[property.intern]
+          exec_arg_vector << ns_to_ds_attribute_map[property.intern]
           next if property == :password  # skip setting the password here
           exec_arg_vector << value.to_s
           begin
@@ -648,5 +586,4 @@ class DirectoryService < Puppet::Provider::NameService
     @property_value_cache_hash
   end
 end
-end