puppet 3.8.7 → 4.0.0.rc1

data/lib/puppet/provider/service/runit.rb

@@ -39,7 +39,7 @@ Puppet::Type.type(:service).provide :runit, :parent => :daemontools do
   class << self
     # this is necessary to autodetect a valid resource
     # default path, since there is no standard for such directory.
-    def defpath(dummy_argument=:work_arround_for_ruby_GC_bug)
+    def defpath
       unless @defpath
         ["/etc/sv", "/var/lib/service"].each do |path|
           if Puppet::FileSystem.exist?(path)

data/lib/puppet/provider/service/systemd.rb

@@ -8,6 +8,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   defaultfor :osfamily => [:archlinux]
   defaultfor :osfamily => :redhat, :operatingsystemmajrelease => "7"
   defaultfor :osfamily => :redhat, :operatingsystem => :fedora, :operatingsystemmajrelease => ["17", "18", "19", "20", "21"]
+  defaultfor :osfamily => :suse, :operatingsystemmajrelease => ["12", "13"]
 
   def self.instances
     i = []

data/lib/puppet/provider/service/upstart.rb

@@ -14,6 +14,8 @@ Puppet::Type.type(:service).provide :upstart, :parent => :debian do
   confine :any => [
     Facter.value(:operatingsystem) == 'Ubuntu',
     (Facter.value(:osfamily) == 'RedHat' and Facter.value(:operatingsystemrelease) =~ /^6\./),
+    Facter.value(:operatingsystem) == 'Amazon',
+    Facter.value(:operatingsystem) == 'LinuxMint',
   ]
 
   defaultfor :operatingsystem => :ubuntu
@@ -352,8 +354,8 @@ private
   end
 
   def write_script_to(file, text)
-    Puppet::Util.replace_file(file, 0644) do |file|
-      file.write(text)
+    Puppet::Util.replace_file(file, 0644) do |f|
+      f.write(text)
     end
   end
 end

data/lib/puppet/provider/ssh_authorized_key/parsed.rb

@@ -53,7 +53,7 @@ Puppet::Type.type(:ssh_authorized_key).provide(
     # ParsedFile usually calls backup_target much later in the flush process,
     # but our SUID makes that fail to open filebucket files for writing.
     # Fortunately, there's already logic to make sure it only ever happens once,
-    # so calling it here supresses the later attempt by our superclass's flush method.
+    # so calling it here suppresses the later attempt by our superclass's flush method.
     self.class.backup_target(target)
 
     Puppet::Util::SUIDManager.asuser(@resource.should(:user)) do

data/lib/puppet/provider/user/aix.rb

@@ -294,7 +294,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
     results = hash.select {
         |k,v| should_include?(k, managed_keys)
       }.inject({}) {
-        |hash, array| hash[array[0]] = array[1]; hash
+        |h, array| h[array[0]] = array[1]; h
       }
     results
   end

data/lib/puppet/provider/user/directoryservice.rb

@@ -141,20 +141,16 @@ Puppet::Type.type(:user).provide :directoryservice do
     ################################
     # Get Password/Salt/Iterations #
     ################################
-    if (Puppet::Util::Package.versioncmp(get_os_version, '10.7') == -1)
-      attribute_hash[:password] = get_sha1(attribute_hash[:guid])
+    if attribute_hash[:shadowhashdata].empty?
+      attribute_hash[:password] = '*'
     else
-      if attribute_hash[:shadowhashdata].empty?
-        attribute_hash[:password] = '*'
+      embedded_binary_plist = get_embedded_binary_plist(attribute_hash[:shadowhashdata])
+      if embedded_binary_plist['SALTED-SHA512']
+        attribute_hash[:password] = get_salted_sha512(embedded_binary_plist)
       else
-        embedded_binary_plist = get_embedded_binary_plist(attribute_hash[:shadowhashdata])
-        if embedded_binary_plist['SALTED-SHA512']
-          attribute_hash[:password] = get_salted_sha512(embedded_binary_plist)
-        else
-          attribute_hash[:password]   = get_salted_sha512_pbkdf2('entropy', embedded_binary_plist)
-          attribute_hash[:salt]       = get_salted_sha512_pbkdf2('salt', embedded_binary_plist)
-          attribute_hash[:iterations] = get_salted_sha512_pbkdf2('iterations', embedded_binary_plist)
-        end
+        attribute_hash[:password]   = get_salted_sha512_pbkdf2('entropy', embedded_binary_plist)
+        attribute_hash[:salt]       = get_salted_sha512_pbkdf2('salt', embedded_binary_plist)
+        attribute_hash[:iterations] = get_salted_sha512_pbkdf2('iterations', embedded_binary_plist)
       end
     end
 
@@ -359,46 +355,42 @@ Puppet::Type.type(:user).provide :directoryservice do
   # method revolve around dscl. Any time you directly modify a user's plist,
   # you need to flush the cache that dscl maintains.
   def password=(value)
-    if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') == -1)
-      write_sha1_hash(value)
+    if self.class.get_os_version == '10.7'
+      if value.length != 136
+        raise Puppet::Error, "OS X 10.7 requires a Salted SHA512 hash password of 136 characters.  Please check your password and try again."
+      end
     else
-      if self.class.get_os_version == '10.7'
-        if value.length != 136
-          raise Puppet::Error, "OS X 10.7 requires a Salted SHA512 hash password of 136 characters.  Please check your password and try again."
-        end
-      else
-        if value.length != 256
-           raise Puppet::Error, "OS X versions > 10.7 require a Salted SHA512 PBKDF2 password hash of 256 characters. Please check your password and try again."
-        end
-
-        assert_full_pbkdf2_password
+      if value.length != 256
+         raise Puppet::Error, "OS X versions > 10.7 require a Salted SHA512 PBKDF2 password hash of 256 characters. Please check your password and try again."
       end
 
-      # Methods around setting the password on OS X are the ONLY methods that
-      # cannot use dscl (because the only way to set it via dscl is by passing
-      # a plaintext password - which is bad). Because of this, we have to change
-      # the user's plist directly. DSCL has its own caching mechanism, which
-      # means that every time we call dscl in this provider we're not directly
-      # changing values on disk (instead, those calls are cached and written
-      # to disk according to Apple's prioritization algorithms). When Puppet
-      # needs to set the password property on OS X > 10.6, the provider has to
-      # tell dscl to write its cache to disk before modifying the user's
-      # plist. The 'dscacheutil -flushcache' command does this. Another issue
-      # is how fast Puppet makes calls to dscl and how long it takes dscl to
-      # enter those calls into its cache. We have to sleep for 2 seconds before
-      # flushing the dscl cache to allow all dscl calls to get INTO the cache
-      # first. This could be made faster (and avoid a sleep call) by finding
-      # a way to enter calls into the dscl cache faster. A sleep time of 1
-      # second would intermittantly require a second Puppet run to set
-      # properties, so 2 seconds seems to be the minimum working value.
-      sleep 2
-      flush_dscl_cache
-      write_password_to_users_plist(value)
-
-      # Since we just modified the user's plist, we need to flush the ds cache
-      # again so dscl can pick up on the changes we made.
-      flush_dscl_cache
+      assert_full_pbkdf2_password
     end
+
+    # Methods around setting the password on OS X are the ONLY methods that
+    # cannot use dscl (because the only way to set it via dscl is by passing
+    # a plaintext password - which is bad). Because of this, we have to change
+    # the user's plist directly. DSCL has its own caching mechanism, which
+    # means that every time we call dscl in this provider we're not directly
+    # changing values on disk (instead, those calls are cached and written
+    # to disk according to Apple's prioritization algorithms). When Puppet
+    # needs to set the password property on OS X > 10.6, the provider has to
+    # tell dscl to write its cache to disk before modifying the user's
+    # plist. The 'dscacheutil -flushcache' command does this. Another issue
+    # is how fast Puppet makes calls to dscl and how long it takes dscl to
+    # enter those calls into its cache. We have to sleep for 2 seconds before
+    # flushing the dscl cache to allow all dscl calls to get INTO the cache
+    # first. This could be made faster (and avoid a sleep call) by finding
+    # a way to enter calls into the dscl cache faster. A sleep time of 1
+    # second would intermittantly require a second Puppet run to set
+    # properties, so 2 seconds seems to be the minimum working value.
+    sleep 2
+    flush_dscl_cache
+    write_password_to_users_plist(value)
+
+    # Since we just modified the user's plist, we need to flush the ds cache
+    # again so dscl can pick up on the changes we made.
+    flush_dscl_cache
   end
 
   # The iterations and salt properties, like the password property, can only
@@ -660,26 +652,4 @@ Puppet::Type.type(:user).provide :directoryservice do
       raise Puppet::Error, "Could not write to file #{filename}: #{detail}", detail.backtrace
     end
   end
-
-  def write_sha1_hash(value)
-    users_guid = self.class.get_attribute_from_dscl('Users', @resource.name, 'GeneratedUID')['dsAttrTypeStandard:GeneratedUID'][0]
-    password_hash_file = "#{self.class.password_hash_dir}/#{users_guid}"
-    write_to_file(password_hash_file, value)
-
-    # NBK: For shadow hashes, the user AuthenticationAuthority must contain a value of
-    # ";ShadowHash;". The LKDC in 10.5 makes this more interesting though as it
-    # will dynamically generate ;Kerberosv5;;username@LKDC:SHA1 attributes if
-    # missing. Thus we make sure we only set ;ShadowHash; if it is missing, and
-    # we can do this with the merge command. This allows people to continue to
-    # use other custom AuthenticationAuthority attributes without stomping on them.
-    #
-    # There is a potential problem here in that we're only doing this when setting
-    # the password, and the attribute could get modified at other times while the
-    # hash doesn't change and so this doesn't get called at all... but
-    # without switching all the other attributes to merge instead of create I can't
-    # see a simple enough solution for this that doesn't modify the user record
-    # every single time. This should be a rather rare edge case. (famous last words)
-
-    merge_attribute_with_dscl('Users', @resource.name, 'AuthenticationAuthority', ';ShadowHash;')
-  end
 end

data/lib/puppet/provider/user/hpux.rb

@@ -1,7 +1,9 @@
 Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   desc "User management for HP-UX. This provider uses the undocumented `-F`
     switch to HP-UX's special `usermod` binary to work around the fact that
-    its standard `usermod` cannot make changes while the user is logged in."
+    its standard `usermod` cannot make changes while the user is logged in.
+    New functionality provides for changing trusted computing passwords and
+    resetting password expirations under trusted computing"
 
   defaultfor :operatingsystem => "hp-ux"
   confine :operatingsystem => "hp-ux"
@@ -26,7 +28,19 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   end
 
   def modifycmd(param,value)
-    super.insert(1,"-F")
+     cmd = super(param, value)
+     cmd << "-F"
+     if trusted then
+       # Append an additional command to reset the password age to 0
+       # until a workaround with expiry module can be found for trusted
+       # computing.
+       cmd << ";"
+       cmd << "/usr/lbin/modprpw"
+       cmd << "-v"
+       cmd << "-l"
+       cmd << "#{resource.name}"
+     end
+     cmd
   end
 
   def password
@@ -63,4 +77,19 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
       return ent.passwd
     end
   end
+
+  def trusted
+    # Check to see if the HP-UX box is running in trusted compute mode
+    # UID for root should always be 0
+    trusted_sys = exec_getprpw('root','-m uid')
+    if trusted_sys.chomp == "uid=0"
+      return true
+    else
+      return false
+    end
+  end
+
+  def exec_getprpw(user,opts)
+    Puppet::Util::Execution.execute("/usr/lbin/getprpw #{opts} #{user}", { :combine => true })
+  end
 end

data/lib/puppet/provider/user/openbsd.rb

@@ -0,0 +1,74 @@
+require 'puppet/error'
+
+Puppet::Type.type(:user).provide :openbsd, :parent => :useradd do
+  desc "User management via `useradd` and its ilk for OpenBSD. Note that you
+    will need to install Ruby's shadow password library (package known as
+    `ruby-shadow`) if you wish to manage user passwords."
+
+  commands :add      => "useradd",
+           :delete   => "userdel",
+           :modify   => "usermod",
+           :password => "passwd"
+
+  defaultfor :operatingsystem => :openbsd
+
+  options :home, :flag => "-d", :method => :dir
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :password, :method => :sp_pwdp
+  options :loginclass, :flag => '-L', :method => :sp_loginclass
+  options :expiry, :method => :sp_expire,
+    :munge => proc { |value|
+      if value == :absent
+        ''
+      else
+        # OpenBSD uses a format like "january 1 1970"
+        Time.parse(value).strftime('%B %d %Y')
+      end
+    },
+    :unmunge => proc { |value|
+      if value == -1
+        :absent
+      else
+        # Expiry is days after 1970-01-01
+        (Date.new(1970,1,1) + value).strftime('%Y-%m-%d')
+      end
+    }
+
+  [:expiry, :password, :loginclass].each do |shadow_property|
+    define_method(shadow_property) do
+      if Puppet.features.libshadow?
+        if ent = Shadow::Passwd.getspnam(@resource.name)
+          method = self.class.option(shadow_property, :method)
+          # ruby-shadow may not be new enough (< 2.4.1) and therefore lack the
+          # sp_loginclass field.
+          begin
+            return unmunge(shadow_property, ent.send(method))
+          rescue => detail
+            Puppet.warning "ruby-shadow doesn't support #{method}"
+          end
+        end
+      end
+      :absent
+    end
+  end
+
+  has_features :manages_homedir, :manages_expiry, :system_users
+  has_features :manages_shell
+  if Puppet.features.libshadow?
+    has_features :manages_passwords, :manages_loginclass
+  end
+
+  def loginclass=(value)
+    set("loginclass", value)
+  end
+
+  def modifycmd(param, value)
+    cmd = super
+    if param == :groups
+      idx = cmd.index('-G')
+      cmd[idx] = '-S'
+    end
+    cmd
+  end
+end

data/lib/puppet/provider/user/pw.rb

@@ -8,7 +8,6 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
   has_features :manages_homedir, :allows_duplicates, :manages_passwords, :manages_expiry, :manages_shell
 
   defaultfor :operatingsystem => [:freebsd, :dragonfly]
-  confine    :operatingsystem => [:freebsd, :dragonfly]
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos

data/lib/puppet/provider/user/user_role_add.rb

@@ -167,12 +167,10 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
   end
 
   def password
-    return :absent unless shadow_entry
-    shadow_entry[1]
+    shadow_entry[1] if shadow_entry
   end
 
   def password_min_age
-    return :absent unless shadow_entry
     shadow_entry[3].empty? ? -1 : shadow_entry[3]
   end
 

data/lib/puppet/provider/user/windows_adsi.rb

@@ -8,11 +8,6 @@ Puppet::Type.type(:user).provide :windows_adsi do
 
   has_features :manages_homedir, :manages_passwords
 
-  def initialize(value={})
-    super(value)
-    @deleted = false
-  end
-
   def user
     @user ||= Puppet::Util::Windows::ADSI::User.new(@resource[:name])
   end
@@ -52,13 +47,11 @@ Puppet::Type.type(:user).provide :windows_adsi do
     if sid
       Puppet::Util::Windows::ADSI::UserProfile.delete(sid)
     end
-
-    @deleted = true
   end
 
   # Only flush if we created or modified a user, not deleted
   def flush
-    @user.commit if @user && !@deleted
+    @user.commit if @user
   end
 
   def comment
@@ -78,7 +71,7 @@ Puppet::Type.type(:user).provide :windows_adsi do
   end
 
   def password
-    user.password_is?( @resource[:password] ) ? @resource[:password] : :absent
+    user.password_is?( @resource[:password] ) ? @resource[:password] : nil
   end
 
   def password=(value)

data/lib/puppet/provider/yumrepo/inifile.rb

@@ -77,9 +77,7 @@ Puppet::Type.type(:yumrepo).provide(:inifile) do
     dirs = reposdir.split(",").map(&:strip) if reposdir
     
 
-    # We can't use the below due to Ruby 1.8.7
-    # dirs.select! { |dir| Puppet::FileSystem.exist?(dir) }
-    dirs.delete_if { |dir| ! Puppet::FileSystem.exist?(dir)  }
+    dirs.select! { |dir| Puppet::FileSystem.exist?(dir) }
     if dirs.empty?
       Puppet.debug('No yum directories were found on the local filesystem')
     end

data/lib/puppet/provider/zfs/zfs.rb

@@ -30,9 +30,10 @@ Puppet::Type.type(:zfs).provide(:zfs) do
   end
 
   def exists?
-    if zfs(:list).split("\n").detect { |line| line.split("\s")[0] == @resource[:name] }
+    begin
+      zfs(:list, @resource[:name])
       true
-    else
+    rescue Puppet::ExecutionFailure
       false
     end
   end

data/lib/puppet/provider/zone/solaris.rb

@@ -159,7 +159,7 @@ Puppet::Type.type(:zone).provide(:solaris) do
     end
   end
 
-  def install(dummy_argument=:work_arround_for_ruby_GC_bug)
+  def install
     if @resource[:clone] # TODO: add support for "-s snapshot"
       zoneadm :clone, @resource[:clone]
     elsif @resource[:install_args]
@@ -234,10 +234,10 @@ Puppet::Type.type(:zone).provide(:solaris) do
           end
           current[$1.intern] = $2
         else
-          err "Ignoring '#{line}'"
+          Puppet.err "Ignoring '#{line}'"
         end
       else
-        debug "Ignoring zone output '#{line}'"
+        Puppet.debug "Ignoring zone output '#{line}'"
       end
     end
 

data/lib/puppet/reference/configuration.rb

@@ -23,9 +23,9 @@ config = Puppet::Util::Reference.newreference(:configuration, :depth => 1, :doc
     # Now print the data about the item.
     val = object.default
     if name.to_s == "vardir"
-      val = "/var/lib/puppet"
+      val = "/opt/puppetlabs/puppet/cache"
     elsif name.to_s == "confdir"
-      val = "/etc/puppet"
+      val = "/etc/puppetlabs/puppet"
     end
 
     # Leave out the section information; it was apparently confusing people.
@@ -45,7 +45,8 @@ config.header = <<EOT
 * Each of these settings can be specified in `puppet.conf` or on the
   command line.
 * When using boolean settings on the command line, use `--setting` and
-  `--no-setting` instead of `--setting (true|false)`.
+  `--no-setting` instead of `--setting (true|false)`. (Using `--setting false`
+  results in "Error: Could not parse application options: needless argument".)
 * Settings can be interpolated as `$variables` in other settings; `$environment`
   is special, in that puppet master will interpolate each agent node's
   environment instead of its own.