puppet 3.8.7 → 4.0.0.rc1

data/lib/puppet/provider/nameservice/directoryservice.rb

@@ -11,7 +11,6 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
     #  e.g. Puppet::Type.type(:user).provide :directoryservice, :ds_path => "Users"
     #  This is referenced in the get_ds_path class method
     attr_writer :ds_path
-    attr_writer :macosx_version_major
   end
 
   initvars
@@ -87,20 +86,6 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
     @resource_type.name.to_s.capitalize + "s"
   end
 
-  def self.get_macosx_version_major
-    return @macosx_version_major if defined?(@macosx_version_major)
-    begin
-      product_version_major = Facter.value(:macosx_productversion_major)
-
-      fail("#{product_version_major} is not supported by the directoryservice provider") if %w{10.0 10.1 10.2 10.3 10.4}.include?(product_version_major)
-      @macosx_version_major = product_version_major
-      return @macosx_version_major
-    rescue Puppet::ExecutionFailure => detail
-      fail("Could not determine OS X version: #{detail}")
-    end
-  end
-
-
   def self.list_all_present
     # JJM: List all objects of this Puppet::Type already present on the system.
     begin
@@ -167,19 +152,11 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
       fail("Could not get report.  command execution failed.")
     end
 
-    # (#11593) Remove support for OS X 10.4 and earlier
-    fail_if_wrong_version
     dscl_plist = self.parse_dscl_plist_data(dscl_output)
 
     self.generate_attribute_hash(dscl_plist, *type_properties)
   end
 
-  def self.fail_if_wrong_version
-    if (Puppet::Util::Package.versioncmp(self.get_macosx_version_major, '10.5') == -1)
-      fail("Puppet does not support OS X versions < 10.5")
-    end
-  end
-
   def self.get_exec_preamble(ds_action, resource_name = nil)
     # JJM 2007-07-24
     #     DSCL commands are often repetitive and contain the same positional
@@ -188,8 +165,6 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
     #     This method spits out proper DSCL commands for us.
     #     We EXPECT name to be @resource[:name] when called from an instance object.
 
-    # (#11593) Remove support for OS X 10.4 and earlier
-    fail_if_wrong_version
     command_vector = [ command(:dscl), "-plist", "." ]
 
     # JJM: The actual action to perform.  See "man dscl"
@@ -208,120 +183,71 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
   end
 
   def self.set_password(resource_name, guid, password_hash)
-    # Use Puppet::Util::Package.versioncmp() to catch the scenario where a
-    # version '10.10' would be < '10.7' with simple string comparison. This
-    # if-statement only executes if the current version is less-than 10.7
-    if (Puppet::Util::Package.versioncmp(get_macosx_version_major, '10.7') == -1)
-      password_hash_file = "#{password_hash_dir}/#{guid}"
-      begin
-        File.open(password_hash_file, 'w') { |f| f.write(password_hash)}
-      rescue Errno::EACCES => detail
-        fail("Could not write to password hash file: #{detail}")
-      end
+    # 10.7 uses salted SHA512 password hashes which are 128 characters plus
+    # an 8 character salt. Previous versions used a SHA1 hash padded with
+    # zeroes. If someone attempts to use a password hash that worked with
+    # a previous version of OX X, we will fail early and warn them.
+    if password_hash.length != 136
+      fail("OS X 10.7 requires a Salted SHA512 hash password of 136 characters. \
+           Please check your password and try again.")
+    end
 
-      # NBK: For shadow hashes, the user AuthenticationAuthority must contain a value of
-      # ";ShadowHash;". The LKDC in 10.5 makes this more interesting though as it
-      # will dynamically generate ;Kerberosv5;;username@LKDC:SHA1 attributes if
-      # missing. Thus we make sure we only set ;ShadowHash; if it is missing, and
-      # we can do this with the merge command. This allows people to continue to
-      # use other custom AuthenticationAuthority attributes without stomping on them.
-      #
-      # There is a potential problem here in that we're only doing this when setting
-      # the password, and the attribute could get modified at other times while the
-      # hash doesn't change and so this doesn't get called at all... but
-      # without switching all the other attributes to merge instead of create I can't
-      # see a simple enough solution for this that doesn't modify the user record
-      # every single time. This should be a rather rare edge case. (famous last words)
-
-      dscl_vector = self.get_exec_preamble("-merge", resource_name)
-      dscl_vector << "AuthenticationAuthority" << ";ShadowHash;"
-      begin
-        execute(dscl_vector)
-      rescue Puppet::ExecutionFailure => detail
-        fail("Could not set AuthenticationAuthority.")
-      end
-    else
-      # 10.7 uses salted SHA512 password hashes which are 128 characters plus
-      # an 8 character salt. Previous versions used a SHA1 hash padded with
-      # zeroes. If someone attempts to use a password hash that worked with
-      # a previous version of OX X, we will fail early and warn them.
-      if password_hash.length != 136
-        fail("OS X 10.7 requires a Salted SHA512 hash password of 136 characters. \
-             Please check your password and try again.")
+    if Puppet::FileSystem.exist?("#{users_plist_dir}/#{resource_name}.plist")
+      # If a plist already exists in /var/db/dslocal/nodes/Default/users, then
+      # we will need to extract the binary plist from the 'ShadowHashData'
+      # key, log the new password into the resultant plist's 'SALTED-SHA512'
+      # key, and then save the entire structure back.
+      users_plist = Plist::parse_xml(plutil( '-convert', 'xml1', '-o', '/dev/stdout', \
+                                     "#{users_plist_dir}/#{resource_name}.plist"))
+
+      # users_plist['ShadowHashData'][0].string is actually a binary plist
+      # that's nested INSIDE the user's plist (which itself is a binary
+      # plist). If we encounter a user plist that DOESN'T have a
+      # ShadowHashData field, create one.
+      if users_plist['ShadowHashData']
+        password_hash_plist = users_plist['ShadowHashData'][0].string
+        converted_hash_plist = convert_binary_to_xml(password_hash_plist)
+      else
+        users_plist['ShadowHashData'] = [StringIO.new]
+        converted_hash_plist = {'SALTED-SHA512' => StringIO.new}
       end
 
-      if Puppet::FileSystem.exist?("#{users_plist_dir}/#{resource_name}.plist")
-        # If a plist already exists in /var/db/dslocal/nodes/Default/users, then
-        # we will need to extract the binary plist from the 'ShadowHashData'
-        # key, log the new password into the resultant plist's 'SALTED-SHA512'
-        # key, and then save the entire structure back.
-        users_plist = Plist::parse_xml(plutil( '-convert', 'xml1', '-o', '/dev/stdout', \
-                                       "#{users_plist_dir}/#{resource_name}.plist"))
+      # converted_hash_plist['SALTED-SHA512'].string expects a Base64 encoded
+      # string. The password_hash provided as a resource attribute is a
+      # hex value. We need to convert the provided hex value to a Base64
+      # encoded string to nest it in the converted hash plist.
+      converted_hash_plist['SALTED-SHA512'].string = \
+        password_hash.unpack('a2'*(password_hash.size/2)).collect { |i| i.hex.chr }.join
+
+      # Finally, we can convert the nested plist back to binary, embed it
+      # into the user's plist, and convert the resultant plist back to
+      # a binary plist.
+      changed_plist = convert_xml_to_binary(converted_hash_plist)
+      users_plist['ShadowHashData'][0].string = changed_plist
+      Plist::Emit.save_plist(users_plist, "#{users_plist_dir}/#{resource_name}.plist")
+      plutil('-convert', 'binary1', "#{users_plist_dir}/#{resource_name}.plist")
+    end
+  end
 
+  def self.get_password(guid, username)
+    if Puppet::FileSystem.exist?("#{users_plist_dir}/#{username}.plist")
+      # If a plist exists in /var/db/dslocal/nodes/Default/users, we will
+      # extract the binary plist from the 'ShadowHashData' key, decode the
+      # salted-SHA512 password hash, and then return it.
+      users_plist = Plist::parse_xml(plutil('-convert', 'xml1', '-o', '/dev/stdout', "#{users_plist_dir}/#{username}.plist"))
+      if users_plist['ShadowHashData']
         # users_plist['ShadowHashData'][0].string is actually a binary plist
         # that's nested INSIDE the user's plist (which itself is a binary
-        # plist). If we encounter a user plist that DOESN'T have a
-        # ShadowHashData field, create one.
-        if users_plist['ShadowHashData']
-          password_hash_plist = users_plist['ShadowHashData'][0].string
-          converted_hash_plist = convert_binary_to_xml(password_hash_plist)
-        else
-          users_plist['ShadowHashData'] = [StringIO.new]
-          converted_hash_plist = {'SALTED-SHA512' => StringIO.new}
-        end
+        # plist).
+        password_hash_plist = users_plist['ShadowHashData'][0].string
+        converted_hash_plist = convert_binary_to_xml(password_hash_plist)
 
-        # converted_hash_plist['SALTED-SHA512'].string expects a Base64 encoded
+        # converted_hash_plist['SALTED-SHA512'].string is a Base64 encoded
         # string. The password_hash provided as a resource attribute is a
-        # hex value. We need to convert the provided hex value to a Base64
-        # encoded string to nest it in the converted hash plist.
-        converted_hash_plist['SALTED-SHA512'].string = \
-          password_hash.unpack('a2'*(password_hash.size/2)).collect { |i| i.hex.chr }.join
-
-        # Finally, we can convert the nested plist back to binary, embed it
-        # into the user's plist, and convert the resultant plist back to
-        # a binary plist.
-        changed_plist = convert_xml_to_binary(converted_hash_plist)
-        users_plist['ShadowHashData'][0].string = changed_plist
-        Plist::Emit.save_plist(users_plist, "#{users_plist_dir}/#{resource_name}.plist")
-        plutil('-convert', 'binary1', "#{users_plist_dir}/#{resource_name}.plist")
-      end
-    end
-  end
-
-  def self.get_password(guid, username)
-    # Use Puppet::Util::Package.versioncmp() to catch the scenario where a
-    # version '10.10' would be < '10.7' with simple string comparison. This
-    # if-statement only executes if the current version is less-than 10.7
-    if (Puppet::Util::Package.versioncmp(get_macosx_version_major, '10.7') == -1)
-      password_hash = nil
-      password_hash_file = "#{password_hash_dir}/#{guid}"
-      if Puppet::FileSystem.exist?(password_hash_file) and File.file?(password_hash_file)
-        fail("Could not read password hash file at #{password_hash_file}") if not File.readable?(password_hash_file)
-        f = File.new(password_hash_file)
-        password_hash = f.read
-        f.close
-      end
-      password_hash
-    else
-      if Puppet::FileSystem.exist?("#{users_plist_dir}/#{username}.plist")
-        # If a plist exists in /var/db/dslocal/nodes/Default/users, we will
-        # extract the binary plist from the 'ShadowHashData' key, decode the
-        # salted-SHA512 password hash, and then return it.
-        users_plist = Plist::parse_xml(plutil('-convert', 'xml1', '-o', '/dev/stdout', "#{users_plist_dir}/#{username}.plist"))
-        if users_plist['ShadowHashData']
-          # users_plist['ShadowHashData'][0].string is actually a binary plist
-          # that's nested INSIDE the user's plist (which itself is a binary
-          # plist).
-          password_hash_plist = users_plist['ShadowHashData'][0].string
-          converted_hash_plist = convert_binary_to_xml(password_hash_plist)
-
-          # converted_hash_plist['SALTED-SHA512'].string is a Base64 encoded
-          # string. The password_hash provided as a resource attribute is a
-          # hex value. We need to convert the Base64 encoded string to a
-          # hex value and provide it back to Puppet.
-          password_hash = converted_hash_plist['SALTED-SHA512'].string.unpack("H*")[0]
-          password_hash
-        end
+        # hex value. We need to convert the Base64 encoded string to a
+        # hex value and provide it back to Puppet.
+        password_hash = converted_hash_plist['SALTED-SHA512'].string.unpack("H*")[0]
+        password_hash
       end
     end
   end

data/lib/puppet/provider/network_device.rb

@@ -20,6 +20,9 @@ class Puppet::Provider::NetworkDevice < Puppet::Provider
         resource.provider = new(device, :ensure => :absent)
       end
     end
+  rescue => detail
+    # Preserving behavior introduced in #6907
+    Puppet.log_exception(detail, "Could not perform network device prefetch: #{detail}")
   end
 
   def exists?

data/lib/puppet/provider/package/appdmg.rb

@@ -57,8 +57,8 @@ Puppet::Type.type(:package).provide(:appdmg, :parent => Puppet::Provider::Packag
       if %r{\A[A-Za-z][A-Za-z0-9+\-\.]*://} =~ cached_source
         cached_source = File.join(tmpdir, name)
         begin
-          curl "-o", cached_source, "-C", "-", "-k", "-L", "-s", "--url", source
-          Puppet.debug "Success: curl transfered [#{name}]"
+          curl "-o", cached_source, "-C", "-", "-L", "-s", "--url", source
+          Puppet.debug "Success: curl transferred [#{name}]"
         rescue Puppet::ExecutionFailure
           Puppet.debug "curl did not transfer [#{name}].  Falling back to slower open-uri transfer methods."
           cached_source = source
@@ -73,13 +73,16 @@ Puppet::Type.type(:package).provide(:appdmg, :parent => Puppet::Provider::Packag
             entity['mount-point']
           }.select { |mountloc|; mountloc }
           begin
+            found_app = false
             mounts.each do |fspath|
               Dir.entries(fspath).select { |f|
                 f =~ /\.app$/i
               }.each do |pkg|
+                found_app = true
                 installapp("#{fspath}/#{pkg}", name, source)
               end
             end
+            Puppet.debug "Unable to find .app in .appdmg. #{name} will not be installed." if !found_app
           ensure
             hdiutil "eject", mounts[0]
           end

data/lib/puppet/provider/package/apt.rb

@@ -94,7 +94,7 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
 
       preseed response
     else
-      self.info "No responsefile specified or non existant, not preseeding anything"
+      self.info "No responsefile specified or non existent, not preseeding anything"
     end
   end
 

data/lib/puppet/provider/package/fink.rb

@@ -61,7 +61,7 @@ Puppet::Type.type(:package).provide :fink, :parent => :dpkg, :source => :dpkg do
 
       preseed response
     else
-      self.info "No responsefile specified or non existant, not preseeding anything"
+      self.info "No responsefile specified or non existent, not preseeding anything"
     end
   end
 

data/lib/puppet/provider/package/openbsd.rb

@@ -149,18 +149,7 @@ Puppet::Type.type(:package).provide :openbsd, :parent => Puppet::Provider::Packa
 
     if @resource[:source][-1,1] == ::File::SEPARATOR
       e_vars = { 'PKG_PATH' => @resource[:source] }
-      # In case of a real update (i.e., the package already exists) then
-      # pkg_add(8) can handle the flavors. However, if we're actually
-      # installing with 'latest', we do need to handle the flavors.
-      # So we always need to handle flavors ourselves as to not break installs.
-      if latest and resource[:flavor]
-        full_name = "#{resource[:name]}--#{resource[:flavor]}"
-      elsif latest
-        # Don't depend on get_version for updates.
-        full_name = @resource[:name]
-      else
-        full_name = [ @resource[:name], get_version || @resource[:ensure], @resource[:flavor] ].join('-').chomp('-').chomp('-')
-      end
+      full_name = get_full_name(latest)
     else
       e_vars = {}
       full_name = @resource[:source]
@@ -176,6 +165,31 @@ Puppet::Type.type(:package).provide :openbsd, :parent => Puppet::Provider::Packa
     Puppet::Util.withenv(e_vars) { pkgadd cmd.flatten.compact }
   end
 
+  def get_full_name(latest = false)
+    # In case of a real update (i.e., the package already exists) then
+    # pkg_add(8) can handle the flavors. However, if we're actually
+    # installing with 'latest', we do need to handle the flavors. This is
+    # done so we can feed pkg_add(8) the full package name to install to
+    # prevent ambiguity.
+    if latest && resource[:flavor]
+      "#{resource[:name]}--#{resource[:flavor]}"
+    elsif latest
+      # Don't depend on get_version for updates.
+      @resource[:name]
+    else
+      # If :ensure contains a version, use that instead of looking it up.
+      # This allows for installing packages with the same stem, but multiple
+      # version such as openldap-server.
+      if /(\d[^-]*)$/.match(@resource[:ensure].to_s)
+        use_version = @resource[:ensure]
+      else
+        use_version = get_version
+      end
+
+      [ @resource[:name], use_version, @resource[:flavor]].join('-').gsub(/-+$/, '')
+    end
+  end
+
   def get_version
     execpipe([command(:pkginfo), "-I", @resource[:name]]) do |process|
       # our regex for matching pkg_info output

data/lib/puppet/provider/package/opkg.rb

@@ -40,7 +40,7 @@ Puppet::Type.type(:package).provide :opkg, :source => :opkg, :parent => Puppet::
   def install
     # OpenWrt package lists are ephemeral, make sure we have at least
     # some entries in the list directory for opkg to use
-    opkg('update') if Dir.entries('/var/opkg-lists/').size <= 2
+    opkg('update') if package_lists.size <= 2
 
     if @resource[:source]
       opkg( '--force-overwrite', 'install', @resource[:source] )
@@ -73,4 +73,9 @@ Puppet::Type.type(:package).provide :opkg, :source => :opkg, :parent => Puppet::
     }
   end
 
+  private
+
+  def package_lists
+    Dir.entries('/var/opkg-lists/')
+  end
 end

data/lib/puppet/provider/package/pacman.rb

@@ -9,19 +9,29 @@ Puppet::Type.type(:package).provide :pacman, :parent => Puppet::Provider::Packag
   These options should be specified as a string (e.g. '--flag'), a hash (e.g. {'--flag' => 'value'}),
   or an array where each element is either a string or a hash."
 
+  # If yaourt is installed, we can make use of it
+  def self.yaourt?
+    @yaourt ||= Puppet::FileSystem.exist?('/usr/bin/yaourt')
+  end
+
   commands :pacman => "/usr/bin/pacman"
   # Yaourt is a common AUR helper which, if installed, we can use to query the AUR
-  commands :yaourt => "/usr/bin/yaourt" if Puppet::FileSystem.exist? '/usr/bin/yaourt'
+  commands :yaourt => "/usr/bin/yaourt" if yaourt?
 
-  confine     :operatingsystem => :archlinux
-  defaultfor  :operatingsystem => :archlinux
+  confine     :operatingsystem => [:archlinux, :manjarolinux]
+  defaultfor  :operatingsystem => [:archlinux, :manjarolinux]
   has_feature :install_options
   has_feature :uninstall_options
   has_feature :upgradeable
+  has_feature :virtual_packages
 
-  # If yaourt is installed, we can make use of it
-  def yaourt?
-    return Puppet::FileSystem.exist?('/usr/bin/yaourt')
+  # Checks if a given name is a group
+  def self.group?(name)
+    begin
+      !pacman("-Sg", name).empty?
+    rescue Puppet::ExecutionFailure
+      fail("Error while determining if '#{@resource[:name]}' is a group")
+    end
   end
 
   # Install a package using 'pacman', or 'yaourt' if available.
@@ -35,135 +45,83 @@ Puppet::Type.type(:package).provide :pacman, :parent => Puppet::Provider::Packag
     end
 
     unless self.query
-      raise Puppet::ExecutionFailure.new("Could not find package %s" % self.name)
+      fail("Could not find package '#{@resource[:name]}'")
     end
   end
 
-  def install_from_repo
-    if yaourt?
-      cmd = %w{--noconfirm}
-      cmd += install_options if @resource[:install_options]
-      cmd << "-S" << @resource[:name]
-      yaourt *cmd
-    else
-      cmd = %w{--noconfirm --noprogressbar}
-      cmd += install_options if @resource[:install_options]
-      cmd << "-Sy" << @resource[:name]
-      pacman *cmd
-    end
-  end
-  private :install_from_repo
+  # Fetch the list of packages and package groups that are currently installed on the system.
+  # Only package groups that are fully installed are included. If a group adds packages over time, it will not
+  # be considered as fully installed any more, and we would install the new packages on the next run.
+  # If a group removes packages over time, nothing will happen. This is intended.
+  def self.instances
+    instances = []
 
-  def install_from_file
-    source = @resource[:source]
-    begin
-      source_uri = URI.parse source
-    rescue => detail
-      self.fail Puppet::Error, "Invalid source '#{source}': #{detail}", detail
+    # Get the installed packages
+    installed_packages = get_installed_packages
+    installed_packages.sort_by { |k, _| k }.each do |package, version|
+      instances << new(to_resource_hash(package, version))
     end
 
-    source = case source_uri.scheme
-    when nil then source
-    when /https?/i then source
-    when /ftp/i then source
-    when /file/i then source_uri.path
-    when /puppet/i
-      fail "puppet:// URL is not supported by pacman"
-    else
-      fail "Source #{source} is not supported by pacman"
+    # Get the installed groups
+    get_installed_groups(installed_packages).each do |group, version|
+      instances << new(to_resource_hash(group, version))
     end
-    pacman "--noconfirm", "--noprogressbar", "-Sy"
-    pacman "--noconfirm", "--noprogressbar", "-U", source
-  end
-  private :install_from_file
-
-  def self.listcmd
-    [command(:pacman), "-Q"]
-  end
 
-  # Pacman has a concept of package groups as well.
-  # Package groups have no versions.
-  def self.listgroupcmd
-    [command(:pacman), "-Qg"]
+    instances
   end
 
-  # Get installed packages (pacman -Q)
-  def self.installedpkgs
-    packages = []
+  # returns a hash package => version of installed packages
+  def self.get_installed_packages
     begin
-      execpipe(listcmd()) do |process|
+      packages = {}
+      execpipe([command(:pacman), "-Q"]) do |process|
         # pacman -Q output is 'packagename version-rel'
         regex = %r{^(\S+)\s(\S+)}
-        fields = [:name, :ensure]
-        hash = {}
-
-        process.each_line { |line|
+        process.each_line do |line|
           if match = regex.match(line)
-            fields.zip(match.captures) { |field,value|
-              hash[field] = value
-            }
-
-            hash[:provider] = self.name
-
-            packages << new(hash)
-
-            hash = {}
+            packages[match.captures[0]] = match.captures[1]
           else
-            warning("Failed to match line %s" % line)
+            warning("Failed to match line '#{line}'")
           end
-        }
+        end
       end
+      packages
     rescue Puppet::ExecutionFailure
-      return nil
+      fail("Error getting installed packages")
     end
-    packages
   end
 
-  # Get installed groups (pacman -Qg)
-  def self.installedgroups
-    packages = []
+  # returns a hash of group => version of installed groups
+  def self.get_installed_groups(installed_packages, filter = nil)
+    groups = {}
     begin
-      execpipe(listgroupcmd()) do |process|
-        # pacman -Qg output is 'groupname packagename'
-        # Groups need to be deduplicated
-        groups = Set[]
-
-        process.each_line { |line|
-          groups.add(line.split[0])
-        }
-
-        groups.each { |line|
-          hash = {
-            :name   => line,
-            :ensure => "1", # Groups don't have versions, so ensure => latest
-                            # will still cause a reinstall.
-            :provider => self.name
-          }
-          packages << new(hash)
-        }
+      # Build a hash of group name => list of packages
+      command = [command(:pacman), "-Sgg"]
+      command << filter if filter
+      execpipe(command) do |process|
+        process.each_line do |line|
+          name, package = line.split
+          packages = (groups[name] ||= [])
+          packages << package
+        end
       end
-    rescue Puppet::ExecutionFailure
-      return nil
-    end
-    packages
-  end
 
-  # Fetch the list of packages currently installed on the system.
-  def self.instances
-    packages = self.installedpkgs
-    groups   = self.installedgroups
-    result   = nil
-
-    if (!packages && !groups)
-      nil
-    elsif (packages && groups)
-      packages.concat(groups)
-    else
-      packages
+      # Remove any group that doesn't have all its packages installed
+      groups.delete_if do |_, packages|
+        !packages.all? { |package| installed_packages[package] }
+      end
+
+      # Replace the list of packages with a version string consisting of packages that make up the group
+      groups.each do |name, packages|
+        groups[name] = packages.sort.map {|package| "#{package} #{installed_packages[package]}"}.join ', '
+      end
+
+      groups
+    rescue Puppet::ExecutionFailure
+      fail("Error while getting installed groups")
     end
   end
 
-
   # Because Archlinux is a rolling release based distro, installing a package
   # should always result in the newest release.
   def update
@@ -173,20 +131,29 @@ Puppet::Type.type(:package).provide :pacman, :parent => Puppet::Provider::Packag
 
   # We rescue the main check from Pacman with a check on the AUR using yaourt, if installed
   def latest
+    # Synchronize the database
     pacman "-Sy"
-    pacman_check = true   # Query the main repos first
+
+    resource_name = @resource[:name]
+
+    # If target is a group, construct the group version
+    return pacman("-Sp", "--print-format", "%n %v", resource_name).lines.map{ |line| line.chomp }.sort.join(', ') if self.class.group?(resource_name)
+
+    # Start by querying with pacman first
+    # If that fails, retry using yaourt against the AUR
+    pacman_check = true
     begin
       if pacman_check
-        output = pacman "-Sp", "--print-format", "%v", @resource[:name]
+        output = pacman "-Sp", "--print-format", "%v", resource_name
         return output.chomp
       else
-        output = yaourt "-Qma", @resource[:name]
+        output = yaourt "-Qma", resource_name
         output.split("\n").each do |line|
           return line.split[1].chomp if line =~ /^aur/
         end
       end
     rescue Puppet::ExecutionFailure
-      if pacman_check and self.yaourt?
+      if pacman_check and self.class.yaourt?
         pacman_check = false # now try the AUR
         retry
       else
@@ -195,31 +162,56 @@ Puppet::Type.type(:package).provide :pacman, :parent => Puppet::Provider::Packag
     end
   end
 
-  # Querys the pacman master list for information about the package.
+  # Querys information for a package or package group
   def query
-    begin
-      output = pacman("-Qi", @resource[:name])
+    installed_packages = self.class.get_installed_packages
+    resource_name = @resource[:name]
 
-      if output =~ /Version.*:\s(.+)/
-        return { :ensure => $1 }
+    # Check for the resource being a group
+    version = self.class.get_installed_groups(installed_packages, resource_name)[resource_name]
+
+    if version
+      unless @resource.allow_virtual?
+        warning("#{resource_name} is a group, but allow_virtual is false.")
+        return nil
       end
-    rescue Puppet::ExecutionFailure
-      return {
-        :ensure => :purged,
-        :status => 'missing',
-        :name => @resource[:name],
-        :error => 'ok',
-      }
+    else
+      version = installed_packages[resource_name]
     end
-    nil
+
+    # Return nil if no package or group found
+    return nil unless version
+
+    self.class.to_resource_hash(resource_name, version)
+  end
+
+  def self.to_resource_hash(name, version)
+    {
+      :name     => name,
+      :ensure   => version,
+      :provider => self.name
+    }
   end
 
   # Removes a package from the system.
   def uninstall
+    resource_name = @resource[:name]
+
+    is_group = self.class.group?(resource_name)
+
+    fail("Refusing to uninstall package group #{resource_name}, because allow_virtual is false.") if is_group && !@resource.allow_virtual?
+
     cmd = %w{--noconfirm --noprogressbar}
     cmd += uninstall_options if @resource[:uninstall_options]
-    cmd << "-R" << @resource[:name]
-    pacman *cmd
+    cmd << "-R"
+    cmd << '-s' if is_group
+    cmd << resource_name
+
+    if self.class.yaourt?
+      yaourt *cmd
+    else
+      pacman *cmd
+    end
   end
 
   private
@@ -231,4 +223,44 @@ Puppet::Type.type(:package).provide :pacman, :parent => Puppet::Provider::Packag
   def uninstall_options
     join_options(@resource[:uninstall_options])
   end
+
+  def install_from_file
+    source = @resource[:source]
+    begin
+      source_uri = URI.parse source
+    rescue => detail
+      self.fail Puppet::Error, "Invalid source '#{source}': #{detail}", detail
+    end
+
+    source = case source_uri.scheme
+    when nil then source
+    when /https?/i then source
+    when /ftp/i then source
+    when /file/i then source_uri.path
+    when /puppet/i
+      fail "puppet:// URL is not supported by pacman"
+    else
+      fail "Source #{source} is not supported by pacman"
+    end
+    pacman "--noconfirm", "--noprogressbar", "-Sy"
+    pacman "--noconfirm", "--noprogressbar", "-U", source
+  end
+
+  def install_from_repo
+    resource_name = @resource[:name]
+
+    # Refuse to install if not allowing virtual packages and the resource is a group
+    fail("Refusing to install package group #{resource_name}, because allow_virtual is false.") if self.class.group?(resource_name) && !@resource.allow_virtual?
+
+    cmd = %w{--noconfirm --needed --noprogressbar}
+    cmd += install_options if @resource[:install_options]
+    cmd << "-Sy" << resource_name
+
+    if self.class.yaourt?
+      yaourt *cmd
+    else
+      pacman *cmd
+    end
+  end
+
 end