puppet 3.1.1 → 3.2.0.rc1

data/lib/puppet/type/cron.rb

@@ -10,11 +10,12 @@ Puppet::Type.newtype(:cron) do
     job is not part of the actual job, it is used by Puppet to store and
     retrieve it.
 
-    If you specify a cron job that matches an existing job in every way
-    except name, then the jobs will be considered equivalent and the
-    new name will be permanently associated with that job.  Once this
-    association is made and synced to disk, you can then manage the job
-    normally (e.g., change the schedule of the job).
+    If you specify a cron resource that duplicates the scheduling and command
+    used by an existing crontab entry, then Puppet will take no action and
+    defers to the existing crontab entry.  If the duplicate cron resource
+    specifies `ensure => absent`, all existing duplicated crontab entries will
+    be removed.  Specifying multiple duplicate cron resources with different
+    `ensure` states will result in undefined behavior.
 
     Example:
 
@@ -42,6 +43,13 @@ Puppet::Type.newtype(:cron) do
           hour    => ['2-4'],
           minute  => '*/10'
         }
+
+    An important note: _the Cron type will not reset parameters that are
+    removed from a manifest_. For example, removing a `minute => 10` parameter
+    will not reset the minute component of the associated cronjob to `*`.
+    These changes must be expressed by setting the parameter to
+    `minute => absent` because Puppet only manages parameters that are out of
+    sync with manifest entries.
   EOT
   ensurable
 
@@ -224,6 +232,12 @@ Puppet::Type.newtype(:cron) do
         nil
       end
     end
+
+    def munge(value)
+      value.sub!(/^\s+/, '')
+      value.sub!(/\s+$/, '')
+      value
+    end
   end
 
   newproperty(:special) do
@@ -364,7 +378,7 @@ Puppet::Type.newtype(:cron) do
   end
 
   newproperty(:target) do
-    desc "The username that will own the cron entry. Defaults to 
+    desc "The username that will own the cron entry. Defaults to
     the value of $USER for the shell that invoked Puppet, or root if $USER
     is empty."
 
@@ -417,5 +431,3 @@ Puppet::Type.newtype(:cron) do
   end
 end
 
-
-

data/lib/puppet/type/exec.rb

@@ -137,6 +137,10 @@ module Puppet
         normal log level (usually `notice`), but if the command fails
         (meaning its return code does not match the specified code) then
         any output is logged at the `err` log level."
+
+      validate do |command|
+        raise ArgumentError, "Command must be a String, got value of class #{command.class}" unless command.is_a? String
+      end
     end
 
     newparam(:path) do
@@ -180,9 +184,11 @@ module Puppet
     end
 
     newparam(:logoutput) do
-      desc "Whether to log output.  Defaults to `on_failure`, which only logs
-        the output when the command has a non-zero exit code.  In addition to
-        the values below, you may set this attribute to any legal log level."
+      desc "Whether to log command output in addition to logging the
+        exit code.  Defaults to `on_failure`, which only logs the output
+        when the command has an exit code that does not match any value
+        specified by the `returns` attribute.  In addition to the values
+        below, you may set this attribute to any legal log level."
 
       defaultto :on_failure
 

data/lib/puppet/type/file.rb

@@ -245,6 +245,18 @@ Puppet::Type.newtype(:file) do
     newvalues(:first, :all)
   end
 
+  newparam(:show_diff, :boolean => true) do
+    desc "Whether to display differences when the file changes, defaulting to
+        true.  This parameter is useful for files that may contain passwords or
+        other secret data, which might otherwise be included in Puppet reports or
+        other insecure outputs.  If the global ``show_diff` configuration parameter
+        is false, then no diffs will be shown even if this parameter is true."
+
+    defaultto :true
+
+    newvalues(:true, :false)
+  end
+
   # Autorequire the nearest ancestor directory found in the catalog.
   autorequire(:file) do
     req = []
@@ -471,6 +483,11 @@ Puppet::Type.newtype(:file) do
     @parameters.include?(:purge) and (self[:purge] == :true or self[:purge] == "true")
   end
 
+  # Should we be showing diffs?
+  def show_diff?
+    @parameters.include?(:show_diff) and (self[:show_diff] == :true or self[:show_diff] == "true")
+  end
+
   # Recursively generate a list of file resources, which will
   # be used to copy remote files, manage local files, and/or make links
   # to map to another directory.
@@ -597,34 +614,35 @@ Puppet::Type.newtype(:file) do
     )
   end
 
-  # Remove any existing data.  This is only used when dealing with
-  # links or directories.
+  # Back up and remove the file or directory at `self[:path]`.
+  #
+  # @param  [Symbol] should The file type replacing the current content.
+  # @return [Boolean] True if the file was removed, else False
+  # @raises [fail???] If the current file isn't one of %w{file link directory} and can't be removed.
   def remove_existing(should)
-    return unless s = stat
+    wanted_type = should.to_s
+    current_type = read_current_type
+
+    if current_type.nil?
+      return false
+    end
 
-    self.fail "Could not back up; will not replace" unless perform_backup
+    if can_backup?(current_type)
+      backup_existing
+    end
 
-    unless should.to_s == "link"
-      return if s.ftype.to_s == should.to_s
+    if wanted_type != "link" and current_type == wanted_type
+      return false
     end
 
-    case s.ftype
+    case current_type
     when "directory"
-      if self[:force] == :true
-        debug "Removing existing directory for replacement with #{should}"
-        FileUtils.rmtree(self[:path])
-      else
-        notice "Not removing directory; use 'force' to override"
-        return
-      end
+      return remove_directory(wanted_type)
     when "link", "file"
-      debug "Removing existing #{s.ftype} for replacement with #{should}"
-      ::File.unlink(self[:path])
+      return remove_file(current_type, wanted_type)
     else
-      self.fail "Could not back up files of type #{s.ftype}"
+      self.fail "Could not back up files of type #{current_type}"
     end
-    @stat = :needs_stat
-    true
   end
 
   def retrieve
@@ -746,6 +764,64 @@ Puppet::Type.newtype(:file) do
 
   private
 
+  # @return [String] The type of the current file, cast to a string.
+  def read_current_type
+    stat_info = stat
+    if stat_info
+      stat_info.ftype.to_s
+    else
+      nil
+    end
+  end
+
+  # @return [Boolean] If the current file can be backed up and needs to be backed up.
+  def can_backup?(type)
+    if type == "directory" and self[:force] == :false
+      # (#18110) Directories cannot be removed without :force, so it doesn't
+      # make sense to back them up.
+      false
+    else
+      true
+    end
+  end
+
+  # @return [Boolean] True if the directory was removed
+  # @api private
+  def remove_directory(wanted_type)
+    if self[:force] == :true
+      debug "Removing existing directory for replacement with #{wanted_type}"
+      FileUtils.rmtree(self[:path])
+      stat_needed
+      true
+    else
+      notice "Not removing directory; use 'force' to override"
+      false
+    end
+  end
+
+  # @return [Boolean] if the file was removed (which is always true currently)
+  # @api private
+  def remove_file(current_type, wanted_type)
+    debug "Removing existing #{current_type} for replacement with #{wanted_type}"
+    ::File.unlink(self[:path])
+    stat_needed
+    true
+  end
+
+  def stat_needed
+    @stat = :needs_stat
+  end
+
+  # Back up the existing file at a given prior to it being removed
+  # @api private
+  # @raise [Puppet::Error] if the file backup failed
+  # @return [void]
+  def backup_existing
+    unless perform_backup
+      raise Puppet::Error, "Could not back up; will not replace"
+    end
+  end
+
   # Should we validate the checksum of the file we're writing?
   def validate_checksum?
     self[:checksum] !~ /time/
@@ -766,8 +842,6 @@ Puppet::Type.newtype(:file) do
     (content = property(:content)) && content.write(file)
   end
 
-  private
-
   def write_temporary_file?
     # unfortunately we don't know the source file size before fetching it
     # so let's assume the file won't be empty

data/lib/puppet/type/file/content.rb

@@ -107,7 +107,7 @@ module Puppet
 
       result = super
 
-      if ! result and Puppet[:show_diff]
+      if ! result and Puppet[:show_diff] and resource.show_diff?
         write_temporarily do |path|
           notice "\n" + diff(@resource[:path], path)
         end

data/lib/puppet/type/file/mode.rb

@@ -144,7 +144,13 @@ module Puppet
     end
 
     def is_to_s(currentvalue)
-      currentvalue.rjust(4, "0")
+      if currentvalue == :absent
+        # This can occur during audits---if a file is transitioning from
+        # present to absent the mode will have a value of `:absent`.
+        super
+      else
+        currentvalue.rjust(4, "0")
+      end
     end
   end
 end

data/lib/puppet/type/file/source.rb

@@ -101,7 +101,7 @@ module Puppet
       return @content if @content
       raise Puppet::DevError, "No source for content was stored with the metadata" unless metadata.source
 
-      unless tmp = Puppet::FileServing::Content.indirection.find(metadata.source, :environment => resource.catalog.environment)
+      unless tmp = Puppet::FileServing::Content.indirection.find(metadata.source, :environment => resource.catalog.environment, :links => resource[:links])
         fail "Could not find any content at %s" % metadata.source
       end
       @content = tmp.content
@@ -154,7 +154,7 @@ module Puppet
       return nil unless value
       value.each do |source|
         begin
-          if data = Puppet::FileServing::Metadata.indirection.find(source, :environment => resource.catalog.environment)
+          if data = Puppet::FileServing::Metadata.indirection.find(source, :environment => resource.catalog.environment, :links => resource[:links])
             @metadata = data
             @metadata.source = source
             break

data/lib/puppet/type/group.rb

@@ -21,6 +21,10 @@ module Puppet
     feature :system_groups,
       "The provider allows you to create system groups with lower GIDs."
 
+    feature :libuser,
+      "Allows local groups to be managed on systems that also use some other
+       remote NSS method of managing accounts."
+
     ensurable do
       desc "Create or remove the group."
 
@@ -146,6 +150,13 @@ module Puppet
       defaultto false
     end
 
+    newparam(:forcelocal, :boolean => true, :required_features => :libuser ) do
+      desc "Forces the mangement of local accounts when accounts are also
+            being managed by some other NSS"
+      newvalues(:true, :false)
+      defaultto false
+    end
+
     # This method has been exposed for puppet to manage users and groups of
     # files in its settings and should not be considered available outside of
     # puppet.

data/lib/puppet/type/scheduled_task.rb

@@ -62,7 +62,11 @@ Puppet::Type.newtype(:scheduled_task) do
       completed successfully'.  It is recommended that you either
       choose another user to run the scheduled task, or alter the
       security policy to allow v1 scheduled tasks to run as the
-      'SYSTEM' account.  Defaults to 'SYSTEM'."
+      'SYSTEM' account.  Defaults to 'SYSTEM'.
+
+      Please also note that Puppet must be running as a privileged user
+      in order to manage `scheduled_task` resources. Running as an
+      unprivileged user will result in 'access denied' errors."
 
     defaultto :system
 

data/lib/puppet/type/service.rb

@@ -71,7 +71,7 @@ module Puppet
         provider.stop
       end
 
-      newvalue(:running, :event => :service_started) do
+      newvalue(:running, :event => :service_started, :invalidate_refreshes => true) do
         provider.start
       end
 

data/lib/puppet/type/ssh_authorized_key.rb

@@ -27,8 +27,8 @@ module Puppet
     end
 
     newproperty(:key) do
-      desc "The public key itself; generally a long string of hex characters. The key attribute 
-      may not contain whitespace: Omit key headers (e.g. 'ssh-rsa') and key identifiers 
+      desc "The public key itself; generally a long string of hex characters. The key attribute
+      may not contain whitespace: Omit key headers (e.g. 'ssh-rsa') and key identifiers
       (e.g. 'joe@joescomputer.local') found in the public key file."
 
       validate do |value|

data/lib/puppet/type/user.rb

@@ -23,7 +23,7 @@ module Puppet
       "The provider supports duplicate users with the same UID."
 
     feature :manages_homedir,
-      "The provider can create and remove home directories."
+      "The provider can create, remove, and update home directories."
 
     feature :manages_passwords,
       "The provider can modify user passwords, by accepting a password
@@ -49,6 +49,10 @@ module Puppet
     feature :manages_aix_lam,
       "The provider can manage AIX Loadable Authentication Module (LAM) system."
 
+    feature :libuser,
+      "Allows local users to be managed on systems that also use some other
+       remote NSS method of managing accounts."
+
     newproperty(:ensure, :parent => Puppet::Property::Ensure) do
       newvalue(:present, :event => :user_created) do
         provider.create
@@ -299,8 +303,10 @@ module Puppet
 
     newparam(:managehome, :boolean => true) do
       desc "Whether to manage the home directory when managing the user.
-        This will create the home directory when `ensure => present`, and
-        delete the home directory when `ensure => absent`. Defaults to `false`."
+        This will create the home directory when `ensure => present`,
+        delete the home directory when `ensure => absent`. Linux only:
+        this will update the user's home directory when the `home` property
+        changes. Defaults to `false`."
 
       newvalues(:true, :false)
 
@@ -315,11 +321,16 @@ module Puppet
 
     newproperty(:expiry, :required_features => :manages_expiry) do
       desc "The expiry date for this user. Must be provided in
-           a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19."
+           a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
+           If you want to make sure the user account does never
+           expire, you can pass the special value `absent`."
+
+      newvalues :absent
+      newvalues /^\d{4}-\d{2}-\d{2}$/
 
       validate do |value|
-        if value !~ /^\d{4}-\d{2}-\d{2}$/
-          raise ArgumentError, "Expiry dates must be YYYY-MM-DD"
+        if value.intern != :absent and value !~ /^\d{4}-\d{2}-\d{2}$/
+          raise ArgumentError, "Expiry dates must be YYYY-MM-DD or the string \"absent\""
         end
       end
     end
@@ -549,5 +560,12 @@ module Puppet
         end
       end
     end
+
+    newparam(:forcelocal, :boolean => true, :required_features => :libuser ) do
+      desc "Forces the mangement of local accounts when accounts are also
+            being managed by some other NSS"
+      newvalues(:true, :false)
+      defaultto false
+    end
   end
 end

data/lib/puppet/util.rb

@@ -481,7 +481,7 @@ module Util
         retry
       end
     else
-      File.rename(tempfile.path, file)
+      File.rename(tempfile.path, file.to_s)
     end
 
     # Ideally, we would now fsync the directory as well, but Ruby doesn't
@@ -519,7 +519,17 @@ module Util
   end
   module_function :exit_on_fail
 
-
+  def deterministic_rand(seed,max)
+    if defined?(Random) == 'constant' && Random.class == Class
+      Random.new(seed).rand(max).to_s
+    else
+      srand(seed)
+      result = rand(max).to_s
+      srand()
+      result
+    end
+  end
+  module_function :deterministic_rand
 
 
   #######################################################################################################

data/lib/puppet/util/classgen.rb

@@ -34,7 +34,7 @@ module Puppet::Util::ClassGen
     genthing(name, Class, options, block)
   end
 
-  # Creates a new module.  
+  # Creates a new module.
   # @param name [String] the name of the generated module
   # @param optinos [Hash] hash with options
   # @option options [Array<Class>] :array if specified, the generated class is appended to this array
@@ -148,10 +148,10 @@ module Puppet::Util::ClassGen
   # @api private
   #
   def is_constant_defined?(const)
-    if ::RUBY_VERSION =~ /1.9/
-      const_defined?(const, false)
-    else
+    if ::RUBY_VERSION =~ /^1.8/
       const_defined?(const)
+    else
+      const_defined?(const, false)
     end
   end