puppet 3.6.2 → 3.7.0

data/lib/puppet/settings/base_setting.rb

@@ -122,6 +122,9 @@ class Puppet::Settings::BaseSetting
   end
 
   def default(check_application_defaults_first = false)
+    if @default.is_a? Proc
+      @default = @default.call
+    end
     return @default unless check_application_defaults_first
     return @settings.value(name, :application_defaults, true) || @default
   end
@@ -152,9 +155,12 @@ class Puppet::Settings::BaseSetting
     str.gsub(/^/, "    ")
   end
 
-  # Retrieves the value, or if it's not set, retrieves the default.
-  def value
-    @settings.value(self.name)
+  # @param bypass_interpolation [Boolean] Set this true to skip the
+  #   interpolation step, returning the raw setting value.  Defaults to false.
+  # @return [String] Retrieves the value, or if it's not set, retrieves the default.
+  # @api public
+  def value(bypass_interpolation = false)
+    @settings.value(self.name, nil, bypass_interpolation)
   end
 
   # Modify the value when it is first evaluated

data/lib/puppet/settings/environment_conf.rb

@@ -51,8 +51,32 @@ class Puppet::Settings::EnvironmentConf
   end
 
   def manifest
-    get_setting(:manifest, File.join(@path_to_env, "manifests")) do |manifest|
-      absolute(manifest)
+    puppet_conf_manifest = Pathname.new(Puppet.settings.value(:default_manifest))
+    disable_per_environment_manifest = Puppet.settings.value(:disable_per_environment_manifest)
+
+    fallback_manifest_directory =
+    if puppet_conf_manifest.absolute?
+      puppet_conf_manifest.to_s
+    else
+      File.join(@path_to_env, puppet_conf_manifest.to_s)
+    end
+
+    if disable_per_environment_manifest
+      environment_conf_manifest = absolute(raw_setting(:manifest))
+      if environment_conf_manifest && fallback_manifest_directory != environment_conf_manifest
+        errmsg = ["The 'disable_per_environment_manifest' setting is true, but the",
+        "environment located at #{@path_to_env} has a manifest setting in its",
+        "environment.conf of '#{environment_conf_manifest}' which does not match",
+        "the default_manifest setting '#{puppet_conf_manifest}'. If this",
+        "environment is expecting to find modules in",
+        "'#{environment_conf_manifest}', they will not be available!"]
+        Puppet.err(errmsg.join(' '))
+      end
+      fallback_manifest_directory.to_s
+    else
+      get_setting(:manifest, fallback_manifest_directory) do |manifest|
+        absolute(manifest)
+      end
     end
   end
 
@@ -82,6 +106,11 @@ class Puppet::Settings::EnvironmentConf
     end
   end
 
+  def raw_setting(setting_name)
+    setting = section.setting(setting_name) if section
+    setting.value if setting
+  end
+
   private
 
   def self.validate(path_to_conf_file, config)
@@ -103,8 +132,7 @@ class Puppet::Settings::EnvironmentConf
   end
 
   def get_setting(setting_name, default = nil)
-    setting = section.setting(setting_name) if section
-    value = setting.value if setting
+    value = raw_setting(setting_name)
     value ||= default
     yield value
   end

data/lib/puppet/settings/file_setting.rb

@@ -219,7 +219,15 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
     Puppet::Util::SUIDManager.asuser(*chown) do
       # Update the umask to make non-executable files
       Puppet::Util.withumask(File.umask ^ 0111) do
-        yield mode ? mode.to_i : 0640
+        mode = case mode.class
+                 when String
+                   mode.to_i(8)
+                 when NilClass
+                   0640
+                 else
+                   mode
+                 end
+        yield mode
       end
     end
   end

data/lib/puppet/settings/priority_setting.rb

@@ -5,12 +5,12 @@ require 'puppet/settings/base_setting'
 class Puppet::Settings::PrioritySetting < Puppet::Settings::BaseSetting
   PRIORITY_MAP =
     if Puppet::Util::Platform.windows?
-      require 'win32/process'
+      require 'puppet/util/windows/process'
       {
-        :high    => Process::HIGH_PRIORITY_CLASS,
-        :normal  => Process::NORMAL_PRIORITY_CLASS,
-        :low     => Process::BELOW_NORMAL_PRIORITY_CLASS,
-        :idle    => Process::IDLE_PRIORITY_CLASS
+        :high    => Puppet::Util::Windows::Process::HIGH_PRIORITY_CLASS,
+        :normal  => Puppet::Util::Windows::Process::NORMAL_PRIORITY_CLASS,
+        :low     => Puppet::Util::Windows::Process::BELOW_NORMAL_PRIORITY_CLASS,
+        :idle    => Puppet::Util::Windows::Process::IDLE_PRIORITY_CLASS
       }
     else
       {

data/lib/puppet/ssl.rb

@@ -4,6 +4,7 @@ require 'openssl'
 
 module Puppet::SSL # :nodoc:
   CA_NAME = "ca"
+  require 'puppet/ssl/configuration'
   require 'puppet/ssl/host'
   require 'puppet/ssl/oids'
   require 'puppet/ssl/validator'

data/lib/puppet/ssl/certificate_authority.rb

@@ -243,14 +243,23 @@ class Puppet::SSL::CertificateAuthority
   def revoke(name)
     raise ArgumentError, "Cannot revoke certificates when the CRL is disabled" unless crl
 
-    if cert = Puppet::SSL::Certificate.indirection.find(name)
-      serial = cert.content.serial
-    elsif name =~ /^0x[0-9A-Fa-f]+$/
-      serial = name.hex
-    elsif ! serial = inventory.serial(name)
+    cert = Puppet::SSL::Certificate.indirection.find(name)
+
+    serials = if cert
+                [cert.content.serial]
+              elsif name =~ /^0x[0-9A-Fa-f]+$/
+                [name.hex]
+              else
+                inventory.serials(name)
+              end
+
+    if serials.empty?
       raise ArgumentError, "Could not find a serial number for #{name}"
     end
-    crl.revoke(serial, host.key.content)
+
+    serials.each do |s|
+      crl.revoke(s, host.key.content)
+    end
   end
 
   # This initializes our CA so it actually works.  This should be a private

data/lib/puppet/ssl/certificate_authority/autosign_command.rb

@@ -1,4 +1,5 @@
 require 'puppet/ssl/certificate_authority'
+require 'puppet/file_system/uniquefile'
 
 # This class wraps a given command and invokes it with a CSR name and body to
 # determine if the given CSR should be autosigned
@@ -21,7 +22,7 @@ class Puppet::SSL::CertificateAuthority::AutosignCommand
     name = csr.name
     cmd = [@path, name]
 
-    output = Puppet::FileSystem::Tempfile.open('puppet-csr') do |csr_file|
+    output = Puppet::FileSystem::Uniquefile.open_tmp('puppet-csr') do |csr_file|
       csr_file.write(csr.to_s)
       csr_file.flush
 

data/lib/puppet/ssl/host.rb

@@ -222,8 +222,9 @@ To fix this, remove the certificate from both the master and the agent and then
 On the master:
   puppet cert clean #{Puppet[:certname]}
 On the agent:
-  rm -f #{Puppet[:hostcert]}
-  puppet agent -t
+  1a. On most platforms: find #{Puppet[:ssldir]} -name #{Puppet[:certname]}.pem -delete
+  1b. On Windows: del "#{Puppet[:ssldir]}/#{Puppet[:certname]}.pem" /f
+  2. puppet agent -t
 ERROR_STRING
     end
   end

data/lib/puppet/ssl/inventory.rb

@@ -37,14 +37,19 @@ class Puppet::SSL::Inventory
 
   # Find the serial number for a given certificate.
   def serial(name)
+    Puppet.deprecation_warning 'Inventory#serial is deprecated, use Inventory#serials instead.'
     return nil unless Puppet::FileSystem.exist?(@path)
+    serials(name).first
+  end
 
-    File.readlines(@path).each do |line|
-      next unless line =~ /^(\S+).+\/CN=#{name}$/
-
-      return Integer($1)
-    end
+  # Find all serial numbers for a given certificate. If none can be found, returns
+  # an empty array.
+  def serials(name)
+    return [] unless Puppet::FileSystem.exist?(@path)
 
-    return nil
+    File.readlines(@path).collect do |line|
+      /^(\S+).+\/CN=#{name}$/.match(line)
+    end.compact.map { |m| Integer(m[1]) }
   end
+
 end

data/lib/puppet/ssl/validator/default_validator.rb

@@ -1,4 +1,5 @@
 require 'openssl'
+require 'puppet/ssl'
 
 # Perform peer certificate verification against the known CA.
 # If there is no CA information known, then no verification is performed

data/lib/puppet/ssl/validator/no_validator.rb

@@ -1,3 +1,6 @@
+require 'openssl'
+require 'puppet/ssl'
+
 # Performs no SSL verification
 # @api private
 #

data/lib/puppet/transaction.rb

@@ -47,6 +47,33 @@ class Puppet::Transaction
     @prefetched_providers = Hash.new { |h,k| h[k] = {} }
   end
 
+  # Invoke the pre_run_check hook in every resource in the catalog.
+  # This should (only) be called by Transaction#evaluate before applying
+  # the catalog.
+  #
+  # @see Puppet::Transaction#evaluate
+  # @see Puppet::Type#pre_run_check
+  # @raise [Puppet::Error] If any pre-run checks failed.
+  # @return [void]
+  def perform_pre_run_checks
+    prerun_errors = {}
+
+    @catalog.vertices.each do |res|
+      begin
+        res.pre_run_check
+      rescue Puppet::Error => detail
+        prerun_errors[res] = detail
+      end
+    end
+
+    unless prerun_errors.empty?
+      prerun_errors.each do |res, detail|
+        res.log_exception(detail)
+      end
+      raise Puppet::Error, "Some pre-run checks failed"
+    end
+  end
+
   # This method does all the actual work of running a transaction.  It
   # collects all of the changes, executes them, and responds to any
   # necessary events.
@@ -55,6 +82,8 @@ class Puppet::Transaction
     generator = AdditionalResourceGenerator.new(@catalog, relationship_graph, @prioritizer)
     @catalog.vertices.each { |resource| generator.generate_additional_resources(resource) }
 
+    perform_pre_run_checks
+
     Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
 
     continue_while = lambda { !stop_processing? }

data/lib/puppet/transaction/resource_harness.rb

@@ -164,10 +164,23 @@ class Puppet::Transaction::ResourceHarness
     event
   end
 
+  # This method is an ugly hack because, given a Time object with nanosecond
+  # resolution, roundtripped through YAML serialization, the Time object will
+  # be truncated to microseconds.
+  # For audit purposes, this code special cases this comparison, and compares
+  # the two objects by their second and microsecond components. tv_sec is the
+  # number of seconds since the epoch, and tv_usec is only the microsecond
+  # portion of time.  This compare satisfies compatibility requirements for
+  # Ruby 1.8.7, where to_r does not exist on the Time class.
+  def are_audited_values_equal(a, b)
+    a == b || (a.is_a?(Time) && b.is_a?(Time) && a.tv_sec == b.tv_sec && a.tv_usec == b.tv_usec)
+  end
+  private :are_audited_values_equal
+
   def audit_event(event, property)
     event.audited = true
     event.status = "audit"
-    if event.historical_value != event.previous_value
+    if !are_audited_values_equal(event.historical_value, event.previous_value)
       event.message = "audit change: previously recorded value #{property.is_to_s(event.historical_value)} has been changed to #{property.is_to_s(event.previous_value)}"
     end
 
@@ -175,7 +188,7 @@ class Puppet::Transaction::ResourceHarness
   end
 
   def audit_message(param, do_audit, historical_value, current_value)
-    if do_audit && historical_value && historical_value != current_value
+    if do_audit && historical_value && !are_audited_values_equal(historical_value, current_value)
       " (previously recorded value was #{param.is_to_s(historical_value)})"
     else
       ""
@@ -196,7 +209,7 @@ class Puppet::Transaction::ResourceHarness
   def capture_audit_events(resource, context)
     context.audited_params.each do |param_name|
       if context.historical_values.include?(param_name)
-        if context.historical_values[param_name] != context.current_values[param_name] && !context.synced_params.include?(param_name)
+        if !are_audited_values_equal(context.historical_values[param_name], context.current_values[param_name]) && !context.synced_params.include?(param_name)
           parameter = resource.parameter(param_name)
           event = audit_event(create_change_event(parameter,
                                                   context.current_values[param_name],

data/lib/puppet/type.rb

@@ -297,9 +297,8 @@ class Type
   end
 
   # Returns the documentation for a given meta-parameter of this type.
-  # @todo the type for the param metaparam
-  # @param metaparam [??? Puppet::Parameter] the meta-parameter to get documentation for.
-  # @return [String] the documentation associated with the given meta-parameter, or nil of not such documentation
+  # @param metaparam [Puppet::Parameter] the meta-parameter to get documentation for.
+  # @return [String] the documentation associated with the given meta-parameter, or nil of no such documentation
   #   exists.
   # @raise if the given metaparam is not a meta-parameter in this type
   #
@@ -308,7 +307,7 @@ class Type
   end
 
   # Creates a new meta-parameter.
-  # This creates a new meta-parameter that is added to all types.
+  # This creates a new meta-parameter that is added to this and all inheriting types.
   # @param name [Symbol] the name of the parameter
   # @param options [Hash] a hash with options.
   # @option options [Class<inherits Puppet::Parameter>] :parent (Puppet::Parameter) the super class of this parameter
@@ -349,9 +348,9 @@ class Type
     param
   end
 
-  # Returns parameters that act as a key.
+  # Returns the list of parameters that comprise the composite key / "uniqueness key".
   # All parameters that return true from #isnamevar? or is named `:name` are included in the returned result.
-  # @todo would like a better explanation
+  # @see uniqueness_key
   # @return [Array<Puppet::Parameter>] WARNING: this return type is uncertain
   def self.key_attribute_parameters
     @key_attribute_parameters ||= (
@@ -361,8 +360,9 @@ class Type
     )
   end
 
-  # Returns cached {key_attribute_parameters} names
-  # @todo what is a 'key_attribute' ?
+  # Returns cached {key_attribute_parameters} names.
+  # Key attributes are properties and parameters that comprise a composite key
+  # or "uniqueness key".
   # @return [Array<String>] cached key_attribute names
   #
   def self.key_attributes
@@ -408,8 +408,9 @@ class Type
     end
   end
 
-  # Produces a _uniqueness_key_
-  # @todo Explain what a uniqueness_key is
+  # Produces a resource's _uniqueness_key_ (or composite key).
+  # This key is an array of all key attributes' values. Each distinct tuple must be unique for each resource type.
+  # @see key_attributes
   # @return [Object] an object that is a _uniqueness_key_ for this object
   #
   def uniqueness_key
@@ -661,10 +662,8 @@ class Type
     nil
   end
 
-  # Removes a property from the object; useful in testing or in cleanup
+  # Removes an attribute from the object; useful in testing or in cleanup
   # when an error has been encountered
-  # @todo Incomprehensible - the comment says "Remove a property", the code refers to @parameters, and
-  #   the method parameter is called "attr" - What is it, property, parameter, both (i.e an attribute) or what?
   # @todo Don't know what the attr is (name or Property/Parameter?). Guessing it is a String name...
   # @todo Is it possible to delete a meta-parameter?
   # @todo What does delete mean? Is it deleted from the type or is its value state 'is'/'should' deleted?
@@ -680,9 +679,7 @@ class Type
     end
   end
 
-  # Iterates over the existing properties.
-  # @todo what does this mean? As opposed to iterating over the "non existing properties" ??? Is it an
-  #   iteration over those properties that have state? CONFUSING.
+  # Iterates over the properties that were set on this resource.
   # @yieldparam property [Puppet::Property] each property
   # @return [void]
   def eachproperty
@@ -725,18 +722,18 @@ class Type
     (prop = @parameters[name] and prop.is_a?(Puppet::Property)) ? prop.should : nil
   end
 
-  # Creates an instance to represent/manage the given attribute.
-  # Requires either the attribute name or class as the first argument, then an optional hash of
-  # attributes to set during initialization.
-  # @todo The original comment is just wrong - the method does not accept a hash of options
-  # @todo Detective work required; this method interacts with provider to ask if it supports a parameter of
-  #   the given class. it then returns the parameter if it exists, otherwise creates a parameter
-  #    with its :resource => self.
+  # Registers an attribute to this resource type insance.
+  # Requires either the attribute name or class as its argument.
+  # This is a noop if the named property/parameter is not supported
+  # by this resource. Otherwise, an attribute instance is created
+  # and kept in this resource's parameters hash.
   # @overload newattr(name)
-  #   @param name [String] Unclear what name is (probably a symbol) - Needs investigation.
+  #   @param name [Symbol] symbolic name of the attribute
   # @overload newattr(klass)
-  #   @param klass [Class] a class supported as an attribute class - Needs clarification what that means.
-  # @return [???] Probably returns a new instance of the class - Needs investigation.
+  #   @param klass [Class] a class supported as an attribute class, i.e. a subclass of
+  #     Parameter or Property
+  # @return [Object] An instance of the named Parameter or Property class associated
+  #   to this resource type instance, or nil if the attribute is not supported
   #
   def newattr(name)
     if name.is_a?(Class)
@@ -773,17 +770,17 @@ class Type
     @parameters[name.to_sym]
   end
 
-  # Returns a shallow copy of this object's hash of parameters.
-  # @todo Add that this is not only "parameters", but also "properties" and "meta-parameters" ?
+  # Returns a shallow copy of this object's hash of attributes by name.
+  # Note that his not only comprises parameters, but also properties and metaparameters.
   # Changes to the contained parameters will have an effect on the parameters of this type, but changes to
   # the returned hash does not.
-  # @return [Hash{String => Puppet:???Parameter}] a new hash being a shallow copy of the parameters map name to parameter
+  # @return [Hash{String => Object}] a new hash being a shallow copy of the parameters map name to parameter
   def parameters
     @parameters.dup
   end
 
-  # @return [Boolean] Returns whether the property given by name is defined or not.
-  # @todo what does it mean to be defined?
+  # @return [Boolean] Returns whether the attribute given by name has been added
+  #   to this resource or not.
   def propertydefined?(name)
     name = name.intern unless name.is_a? Symbol
     @parameters.include?(name)
@@ -967,6 +964,22 @@ class Type
     []
   end
 
+  # Lifecycle method for a resource. This is called during graph creation.
+  # It should perform any consistency checking of the catalog and raise a
+  # Puppet::Error if the transaction should be aborted.
+  #
+  # It differs from the validate method, since it is called later during
+  # initialization and can rely on self.catalog to have references to all
+  # resources that comprise the catalog.
+  #
+  # @see Puppet::Transaction#add_vertex
+  # @raise [Puppet::Error] If the pre-run check failed.
+  # @return [void]
+  # @abstract a resource type may implement this method to perform
+  #   validation checks that can query the complete catalog
+  def pre_run_check
+  end
+
   # Flushes the provider if supported by the provider, else no action.
   # This is called by the transaction.
   # @todo What does Flushing the provider mean? Why is it interesting to know that this is
@@ -1026,7 +1039,7 @@ class Type
   def retrieve
     fail "Provider #{provider.class.name} is not functional on this host" if self.provider.is_a?(Puppet::Provider) and ! provider.class.suitable?
 
-    result = Puppet::Resource.new(type, title)
+    result = Puppet::Resource.new(self.class, title)
 
     # Provide the name, so we know we'll always refer to a real thing
     result[:name] = self[:name] unless self[:name] == title
@@ -1061,7 +1074,7 @@ class Type
   # @api private
   def retrieve_resource
     resource = retrieve
-    resource = Resource.new(type, title, :parameters => resource) if resource.is_a? Hash
+    resource = Resource.new(self.class, title, :parameters => resource) if resource.is_a? Hash
     resource
   end
 
@@ -1180,9 +1193,8 @@ class Type
     raise Puppet::Error, "Title or name must be provided" unless title
 
     # Now create our resource.
-    resource = Puppet::Resource.new(self.name, title)
+    resource = Puppet::Resource.new(self, title)
     resource.catalog = hash.delete(:catalog)
-    resource.resource_type = self
 
     hash.each do |param, value|
       resource[param] = value
@@ -1314,7 +1326,19 @@ class Type
   newmetaparam(:loglevel) do
     desc "Sets the level that information will be logged.
       The log levels have the biggest impact when logs are sent to
-      syslog (which is currently the default)."
+      syslog (which is currently the default).
+
+      The order of the log levels, in decreasing priority, is:
+
+      * `crit`
+      * `emerg`
+      * `alert`
+      * `err`
+      * `warning`
+      * `notice`
+      * `info` / `verbose`
+      * `debug`
+      "
     defaultto :notice
 
     newvalues(*Puppet::Util::Log.levels)
@@ -1810,8 +1834,8 @@ class Type
         }.join
       end
 
-      # @todo this does what? where and how?
-      # @return [String] the name of the provider
+      # For each resource, the provider param defaults to
+      # the type's default provider
       defaultto {
         prov = @resource.class.defaultprovider
         prov.name if prov
@@ -1912,11 +1936,12 @@ class Type
   # All of the relationship code.
 
   # Adds a block producing a single name (or list of names) of the given resource type name to autorequire.
+  # Resources in the catalog that have the named type and a title that is included in the result will be linked
+  # to the calling resource as a requirement.
+  #
   # @example Autorequire the files File['foo', 'bar']
   #   autorequire( 'file', {|| ['foo', 'bar'] })
   #
-  # @todo original = _"Specify a block for generating a list of objects to autorequire.
-  #   This makes it so that you don't have to manually specify things that you clearly require."_
   # @param name [String] the name of a type of which one or several resources should be autorequired e.g. "file"
   # @yield [ ] a block returning list of names of given type to auto require
   # @yieldreturn [String, Array<String>] one or several resource names for the named type
@@ -1979,12 +2004,9 @@ class Type
     reqs
   end
 
-  # Builds the dependencies associated with an individual object.
-  # @todo Which object is the "individual object", as opposed to "object as a group?" or should it simply
-  #   be "this object" as in "this resource" ?
-  # @todo Does this method "build dependencies" or "build what it depends on" ... CONFUSING
+  # Builds the dependencies associated with this resource.
   #
-  # @return [Array<???>] list of WHAT? resources? edges?
+  # @return [Array<Puppet::Relationship>] list of relationships to other resources
   def builddepends
     # Handle the requires
     self.class.relationship_params.collect do |klass|
@@ -1994,8 +2016,8 @@ class Type
     end.flatten.reject { |r| r.nil? }
   end
 
-  # Sets the initial list of tags...
-  # @todo The initial list of tags, that ... that what?
+  # Sets the initial list of tags to associate to this resource.
+  #
   # @return [void] ???
   def tags=(list)
     tag(self.class.name)
@@ -2386,8 +2408,8 @@ class Type
     self.ref
   end
 
-  # @todo What to resource? Which one of the resource forms is prroduced? returned here?
-  # @return [??? Resource] a resource that WHAT???
+  # Convert this resource type instance to a Puppet::Resource.
+  # @return [Puppet::Resource] Returns a serializable representation of this resource
   #
   def to_resource
     resource = self.retrieve_resource