puppet 3.8.7 → 4.0.0

data/lib/puppet/provider/user/directoryservice.rb

@@ -1,5 +1,5 @@
 require 'puppet'
-require 'facter/util/plist'
+require 'plist'
 require 'base64'
 
 Puppet::Type.type(:user).provide :directoryservice do
@@ -141,20 +141,16 @@ Puppet::Type.type(:user).provide :directoryservice do
     ################################
     # Get Password/Salt/Iterations #
     ################################
-    if (Puppet::Util::Package.versioncmp(get_os_version, '10.7') == -1)
-      attribute_hash[:password] = get_sha1(attribute_hash[:guid])
+    if attribute_hash[:shadowhashdata].empty?
+      attribute_hash[:password] = '*'
     else
-      if attribute_hash[:shadowhashdata].empty?
-        attribute_hash[:password] = '*'
+      embedded_binary_plist = get_embedded_binary_plist(attribute_hash[:shadowhashdata])
+      if embedded_binary_plist['SALTED-SHA512']
+        attribute_hash[:password] = get_salted_sha512(embedded_binary_plist)
       else
-        embedded_binary_plist = get_embedded_binary_plist(attribute_hash[:shadowhashdata])
-        if embedded_binary_plist['SALTED-SHA512']
-          attribute_hash[:password] = get_salted_sha512(embedded_binary_plist)
-        else
-          attribute_hash[:password]   = get_salted_sha512_pbkdf2('entropy', embedded_binary_plist)
-          attribute_hash[:salt]       = get_salted_sha512_pbkdf2('salt', embedded_binary_plist)
-          attribute_hash[:iterations] = get_salted_sha512_pbkdf2('iterations', embedded_binary_plist)
-        end
+        attribute_hash[:password]   = get_salted_sha512_pbkdf2('entropy', embedded_binary_plist)
+        attribute_hash[:salt]       = get_salted_sha512_pbkdf2('salt', embedded_binary_plist)
+        attribute_hash[:iterations] = get_salted_sha512_pbkdf2('iterations', embedded_binary_plist)
       end
     end
 
@@ -179,7 +175,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   end
 
   # The plist embedded in the ShadowHashData key is a binary plist. The
-  # facter/util/plist library doesn't read binary plists, so we need to
+  # plist library doesn't read binary plists, so we need to
   # extract the binary plist, convert it to XML, and return it.
   def self.get_embedded_binary_plist(shadow_hash_data)
     embedded_binary_plist = Array(shadow_hash_data['dsAttrTypeNative:ShadowHashData'][0].delete(' ')).pack('H*')
@@ -359,46 +355,42 @@ Puppet::Type.type(:user).provide :directoryservice do
   # method revolve around dscl. Any time you directly modify a user's plist,
   # you need to flush the cache that dscl maintains.
   def password=(value)
-    if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') == -1)
-      write_sha1_hash(value)
+    if self.class.get_os_version == '10.7'
+      if value.length != 136
+        raise Puppet::Error, "OS X 10.7 requires a Salted SHA512 hash password of 136 characters.  Please check your password and try again."
+      end
     else
-      if self.class.get_os_version == '10.7'
-        if value.length != 136
-          raise Puppet::Error, "OS X 10.7 requires a Salted SHA512 hash password of 136 characters.  Please check your password and try again."
-        end
-      else
-        if value.length != 256
-           raise Puppet::Error, "OS X versions > 10.7 require a Salted SHA512 PBKDF2 password hash of 256 characters. Please check your password and try again."
-        end
-
-        assert_full_pbkdf2_password
+      if value.length != 256
+         raise Puppet::Error, "OS X versions > 10.7 require a Salted SHA512 PBKDF2 password hash of 256 characters. Please check your password and try again."
       end
 
-      # Methods around setting the password on OS X are the ONLY methods that
-      # cannot use dscl (because the only way to set it via dscl is by passing
-      # a plaintext password - which is bad). Because of this, we have to change
-      # the user's plist directly. DSCL has its own caching mechanism, which
-      # means that every time we call dscl in this provider we're not directly
-      # changing values on disk (instead, those calls are cached and written
-      # to disk according to Apple's prioritization algorithms). When Puppet
-      # needs to set the password property on OS X > 10.6, the provider has to
-      # tell dscl to write its cache to disk before modifying the user's
-      # plist. The 'dscacheutil -flushcache' command does this. Another issue
-      # is how fast Puppet makes calls to dscl and how long it takes dscl to
-      # enter those calls into its cache. We have to sleep for 2 seconds before
-      # flushing the dscl cache to allow all dscl calls to get INTO the cache
-      # first. This could be made faster (and avoid a sleep call) by finding
-      # a way to enter calls into the dscl cache faster. A sleep time of 1
-      # second would intermittantly require a second Puppet run to set
-      # properties, so 2 seconds seems to be the minimum working value.
-      sleep 2
-      flush_dscl_cache
-      write_password_to_users_plist(value)
-
-      # Since we just modified the user's plist, we need to flush the ds cache
-      # again so dscl can pick up on the changes we made.
-      flush_dscl_cache
+      assert_full_pbkdf2_password
     end
+
+    # Methods around setting the password on OS X are the ONLY methods that
+    # cannot use dscl (because the only way to set it via dscl is by passing
+    # a plaintext password - which is bad). Because of this, we have to change
+    # the user's plist directly. DSCL has its own caching mechanism, which
+    # means that every time we call dscl in this provider we're not directly
+    # changing values on disk (instead, those calls are cached and written
+    # to disk according to Apple's prioritization algorithms). When Puppet
+    # needs to set the password property on OS X > 10.6, the provider has to
+    # tell dscl to write its cache to disk before modifying the user's
+    # plist. The 'dscacheutil -flushcache' command does this. Another issue
+    # is how fast Puppet makes calls to dscl and how long it takes dscl to
+    # enter those calls into its cache. We have to sleep for 2 seconds before
+    # flushing the dscl cache to allow all dscl calls to get INTO the cache
+    # first. This could be made faster (and avoid a sleep call) by finding
+    # a way to enter calls into the dscl cache faster. A sleep time of 1
+    # second would intermittantly require a second Puppet run to set
+    # properties, so 2 seconds seems to be the minimum working value.
+    sleep 2
+    flush_dscl_cache
+    write_password_to_users_plist(value)
+
+    # Since we just modified the user's plist, we need to flush the ds cache
+    # again so dscl can pick up on the changes we made.
+    flush_dscl_cache
   end
 
   # The iterations and salt properties, like the password property, can only
@@ -660,26 +652,4 @@ Puppet::Type.type(:user).provide :directoryservice do
       raise Puppet::Error, "Could not write to file #{filename}: #{detail}", detail.backtrace
     end
   end
-
-  def write_sha1_hash(value)
-    users_guid = self.class.get_attribute_from_dscl('Users', @resource.name, 'GeneratedUID')['dsAttrTypeStandard:GeneratedUID'][0]
-    password_hash_file = "#{self.class.password_hash_dir}/#{users_guid}"
-    write_to_file(password_hash_file, value)
-
-    # NBK: For shadow hashes, the user AuthenticationAuthority must contain a value of
-    # ";ShadowHash;". The LKDC in 10.5 makes this more interesting though as it
-    # will dynamically generate ;Kerberosv5;;username@LKDC:SHA1 attributes if
-    # missing. Thus we make sure we only set ;ShadowHash; if it is missing, and
-    # we can do this with the merge command. This allows people to continue to
-    # use other custom AuthenticationAuthority attributes without stomping on them.
-    #
-    # There is a potential problem here in that we're only doing this when setting
-    # the password, and the attribute could get modified at other times while the
-    # hash doesn't change and so this doesn't get called at all... but
-    # without switching all the other attributes to merge instead of create I can't
-    # see a simple enough solution for this that doesn't modify the user record
-    # every single time. This should be a rather rare edge case. (famous last words)
-
-    merge_attribute_with_dscl('Users', @resource.name, 'AuthenticationAuthority', ';ShadowHash;')
-  end
 end

data/lib/puppet/provider/user/hpux.rb

@@ -1,7 +1,9 @@
 Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   desc "User management for HP-UX. This provider uses the undocumented `-F`
     switch to HP-UX's special `usermod` binary to work around the fact that
-    its standard `usermod` cannot make changes while the user is logged in."
+    its standard `usermod` cannot make changes while the user is logged in.
+    New functionality provides for changing trusted computing passwords and
+    resetting password expirations under trusted computing"
 
   defaultfor :operatingsystem => "hp-ux"
   confine :operatingsystem => "hp-ux"
@@ -26,7 +28,19 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   end
 
   def modifycmd(param,value)
-    super.insert(1,"-F")
+     cmd = super(param, value)
+     cmd << "-F"
+     if trusted then
+       # Append an additional command to reset the password age to 0
+       # until a workaround with expiry module can be found for trusted
+       # computing.
+       cmd << ";"
+       cmd << "/usr/lbin/modprpw"
+       cmd << "-v"
+       cmd << "-l"
+       cmd << "#{resource.name}"
+     end
+     cmd
   end
 
   def password
@@ -63,4 +77,19 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
       return ent.passwd
     end
   end
+
+  def trusted
+    # Check to see if the HP-UX box is running in trusted compute mode
+    # UID for root should always be 0
+    trusted_sys = exec_getprpw('root','-m uid')
+    if trusted_sys.chomp == "uid=0"
+      return true
+    else
+      return false
+    end
+  end
+
+  def exec_getprpw(user,opts)
+    Puppet::Util::Execution.execute("/usr/lbin/getprpw #{opts} #{user}", { :combine => true })
+  end
 end

data/lib/puppet/provider/user/openbsd.rb

@@ -0,0 +1,74 @@
+require 'puppet/error'
+
+Puppet::Type.type(:user).provide :openbsd, :parent => :useradd do
+  desc "User management via `useradd` and its ilk for OpenBSD. Note that you
+    will need to install Ruby's shadow password library (package known as
+    `ruby-shadow`) if you wish to manage user passwords."
+
+  commands :add      => "useradd",
+           :delete   => "userdel",
+           :modify   => "usermod",
+           :password => "passwd"
+
+  defaultfor :operatingsystem => :openbsd
+
+  options :home, :flag => "-d", :method => :dir
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :password, :method => :sp_pwdp
+  options :loginclass, :flag => '-L', :method => :sp_loginclass
+  options :expiry, :method => :sp_expire,
+    :munge => proc { |value|
+      if value == :absent
+        ''
+      else
+        # OpenBSD uses a format like "january 1 1970"
+        Time.parse(value).strftime('%B %d %Y')
+      end
+    },
+    :unmunge => proc { |value|
+      if value == -1
+        :absent
+      else
+        # Expiry is days after 1970-01-01
+        (Date.new(1970,1,1) + value).strftime('%Y-%m-%d')
+      end
+    }
+
+  [:expiry, :password, :loginclass].each do |shadow_property|
+    define_method(shadow_property) do
+      if Puppet.features.libshadow?
+        if ent = Shadow::Passwd.getspnam(@resource.name)
+          method = self.class.option(shadow_property, :method)
+          # ruby-shadow may not be new enough (< 2.4.1) and therefore lack the
+          # sp_loginclass field.
+          begin
+            return unmunge(shadow_property, ent.send(method))
+          rescue => detail
+            Puppet.warning "ruby-shadow doesn't support #{method}"
+          end
+        end
+      end
+      :absent
+    end
+  end
+
+  has_features :manages_homedir, :manages_expiry, :system_users
+  has_features :manages_shell
+  if Puppet.features.libshadow?
+    has_features :manages_passwords, :manages_loginclass
+  end
+
+  def loginclass=(value)
+    set("loginclass", value)
+  end
+
+  def modifycmd(param, value)
+    cmd = super
+    if param == :groups
+      idx = cmd.index('-G')
+      cmd[idx] = '-S'
+    end
+    cmd
+  end
+end

data/lib/puppet/provider/user/pw.rb

@@ -8,7 +8,6 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
   has_features :manages_homedir, :allows_duplicates, :manages_passwords, :manages_expiry, :manages_shell
 
   defaultfor :operatingsystem => [:freebsd, :dragonfly]
-  confine    :operatingsystem => [:freebsd, :dragonfly]
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos

data/lib/puppet/provider/user/user_role_add.rb

@@ -167,12 +167,10 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
   end
 
   def password
-    return :absent unless shadow_entry
-    shadow_entry[1]
+    shadow_entry[1] if shadow_entry
   end
 
   def password_min_age
-    return :absent unless shadow_entry
     shadow_entry[3].empty? ? -1 : shadow_entry[3]
   end
 

data/lib/puppet/provider/user/windows_adsi.rb

@@ -8,11 +8,6 @@ Puppet::Type.type(:user).provide :windows_adsi do
 
   has_features :manages_homedir, :manages_passwords
 
-  def initialize(value={})
-    super(value)
-    @deleted = false
-  end
-
   def user
     @user ||= Puppet::Util::Windows::ADSI::User.new(@resource[:name])
   end
@@ -52,13 +47,11 @@ Puppet::Type.type(:user).provide :windows_adsi do
     if sid
       Puppet::Util::Windows::ADSI::UserProfile.delete(sid)
     end
-
-    @deleted = true
   end
 
   # Only flush if we created or modified a user, not deleted
   def flush
-    @user.commit if @user && !@deleted
+    @user.commit if @user
   end
 
   def comment
@@ -78,7 +71,7 @@ Puppet::Type.type(:user).provide :windows_adsi do
   end
 
   def password
-    user.password_is?( @resource[:password] ) ? @resource[:password] : :absent
+    user.password_is?( @resource[:password] ) ? @resource[:password] : nil
   end
 
   def password=(value)

data/lib/puppet/provider/yumrepo/inifile.rb

@@ -77,9 +77,7 @@ Puppet::Type.type(:yumrepo).provide(:inifile) do
     dirs = reposdir.split(",").map(&:strip) if reposdir
     
 
-    # We can't use the below due to Ruby 1.8.7
-    # dirs.select! { |dir| Puppet::FileSystem.exist?(dir) }
-    dirs.delete_if { |dir| ! Puppet::FileSystem.exist?(dir)  }
+    dirs.select! { |dir| Puppet::FileSystem.exist?(dir) }
     if dirs.empty?
       Puppet.debug('No yum directories were found on the local filesystem')
     end

data/lib/puppet/provider/zfs/zfs.rb

@@ -30,9 +30,10 @@ Puppet::Type.type(:zfs).provide(:zfs) do
   end
 
   def exists?
-    if zfs(:list).split("\n").detect { |line| line.split("\s")[0] == @resource[:name] }
+    begin
+      zfs(:list, @resource[:name])
       true
-    else
+    rescue Puppet::ExecutionFailure
       false
     end
   end

data/lib/puppet/provider/zone/solaris.rb

@@ -159,7 +159,7 @@ Puppet::Type.type(:zone).provide(:solaris) do
     end
   end
 
-  def install(dummy_argument=:work_arround_for_ruby_GC_bug)
+  def install
     if @resource[:clone] # TODO: add support for "-s snapshot"
       zoneadm :clone, @resource[:clone]
     elsif @resource[:install_args]
@@ -234,10 +234,10 @@ Puppet::Type.type(:zone).provide(:solaris) do
           end
           current[$1.intern] = $2
         else
-          err "Ignoring '#{line}'"
+          Puppet.err "Ignoring '#{line}'"
         end
       else
-        debug "Ignoring zone output '#{line}'"
+        Puppet.debug "Ignoring zone output '#{line}'"
       end
     end
 

data/lib/puppet/provider.rb

@@ -64,14 +64,6 @@ class Puppet::Provider
     # @return [???] The source is WHAT?
     attr_writer :source
 
-    # @todo Original = _"LAK 2007-05-09: Keep the model stuff around for backward compatibility"_
-    #   Is this really needed? The comment about backwards compatibility was made in 2007.
-    #
-    # @return [???] A model kept for backwards compatibility.
-    # @api private
-    # @deprecated This attribute is available for backwards compatibility reasons.
-    attr_reader :model
-
     # @todo What is this type? A reference to a Puppet::Type ?
     # @return [Puppet::Type] the resource type (that this provider is ... WHAT?)
     #
@@ -99,11 +91,6 @@ class Puppet::Provider
     attr_writer :doc
   end
 
-  # @todo original = _"LAK 2007-05-09: Keep the model stuff around for backward compatibility"_, why is it
-  #   both here (instance) and at class level? Is this a different model?
-  # @return [???] model is WHAT?
-  attr_reader :model
-
   # @return [???] This resource is what? Is an instance of a provider attached to one particular Puppet::Resource?
   #
   attr_accessor :resource
@@ -391,31 +378,6 @@ class Puppet::Provider
     raise Puppet::DevError, "Provider #{self.name} has not defined the 'instances' class method"
   end
 
-  # Creates the methods for a given command.
-  # @api private
-  # @deprecated Use {commands}, {optional_commands}, or {has_command} instead. This was not meant to be part of a public API
-  def self.make_command_methods(name)
-    Puppet.deprecation_warning "Provider.make_command_methods is deprecated; use Provider.commands or Provider.optional_commands instead for creating command methods"
-
-    # Now define a method for that command
-    unless singleton_class.method_defined?(name)
-      meta_def(name) do |*args|
-        # This might throw an ExecutionFailure, but the system above
-        # will catch it, if so.
-        command = Puppet::Provider::Command.new(name, command(name), Puppet::Util, Puppet::Util::Execution)
-        return command.execute(*args)
-      end
-
-      # And then define an instance method that just calls the class method.
-      # We need both, so both instances and classes can easily run the commands.
-      unless method_defined?(name)
-        define_method(name) do |*args|
-          self.class.send(name, *args)
-        end
-      end
-    end
-  end
-
   # Creates getter- and setter- methods for each property supported by the resource type.
   # Call this method to generate simple accessors for all properties supported by the
   # resource type. These simple accessors lookup and sets values in the property hash.
@@ -493,17 +455,6 @@ class Puppet::Provider
     !!satisfies?(*features)
   end
 
-#    def self.to_s
-#        unless defined?(@str)
-#            if self.resource_type
-#                @str = "#{resource_type.name} provider #{self.name}"
-#            else
-#                @str = "unattached provider #{self.name}"
-#            end
-#        end
-#        @str
-#    end
-
   dochook(:defaults) do
     if @defaults.length > 0
       return @defaults.collect do |d|
@@ -533,7 +484,6 @@ class Puppet::Provider
   # Clears this provider instance to allow GC to clean up.
   def clear
     @resource = nil
-    @model = nil
   end
 
   # (see command)
@@ -565,8 +515,6 @@ class Puppet::Provider
       @property_hash = resource
     elsif resource
       @resource = resource
-      # LAK 2007-05-09: Keep the model stuff around for backward compatibility
-      @model = resource
       @property_hash = {}
     else
       @property_hash = {}

data/lib/puppet/reference/configuration.rb

@@ -23,9 +23,9 @@ config = Puppet::Util::Reference.newreference(:configuration, :depth => 1, :doc
     # Now print the data about the item.
     val = object.default
     if name.to_s == "vardir"
-      val = "/var/lib/puppet"
+      val = "/opt/puppetlabs/puppet/cache"
     elsif name.to_s == "confdir"
-      val = "/etc/puppet"
+      val = "/etc/puppetlabs/puppet"
     end
 
     # Leave out the section information; it was apparently confusing people.
@@ -45,7 +45,8 @@ config.header = <<EOT
 * Each of these settings can be specified in `puppet.conf` or on the
   command line.
 * When using boolean settings on the command line, use `--setting` and
-  `--no-setting` instead of `--setting (true|false)`.
+  `--no-setting` instead of `--setting (true|false)`. (Using `--setting false`
+  results in "Error: Could not parse application options: needless argument".)
 * Settings can be interpolated as `$variables` in other settings; `$environment`
   is special, in that puppet master will interpolate each agent node's
   environment instead of its own.

data/lib/puppet/reference/metaparameter.rb

@@ -1,13 +1,4 @@
 Puppet::Util::Reference.newreference :metaparameter, :doc => "All Puppet metaparameters and all their details" do
-  types = {}
-  Puppet::Type.loadall
-
-  Puppet::Type.eachtype { |type|
-    next if type.name == :puppet
-    next if type.name == :component
-    types[type.name] = type
-  }
-
   str = %{
 
 Metaparameters are attributes that work with any resource type, including custom

data/lib/puppet/reference/providers.rb

@@ -91,7 +91,7 @@ providers = Puppet::Util::Reference.newreference :providers, :title => "Provider
 
     ret << markdown_header(type.name.to_s + "_", 2)
 
-    ret << "[#{type.name}](#{"http://docs.puppetlabs.com/references/stable/type.html##{type.name}"})\n\n"
+    ret << "[#{type.name}](http://docs.puppetlabs.com/references/stable/type.html##{type.name})\n\n"
     ret << option("Default provider", default)
     ret << doctable(headers, table_data)
 

data/lib/puppet/reference/type.rb

@@ -3,7 +3,6 @@ Puppet::Util::Reference.newreference :type, :doc => "All Puppet resource types a
   Puppet::Type.loadall
 
   Puppet::Type.eachtype { |type|
-    next if type.name == :puppet
     next if type.name == :component
     next if type.name == :whit
     types[type.name] = type
@@ -21,9 +20,9 @@ Puppet::Util::Reference.newreference :type, :doc => "All Puppet resource types a
   In the following code:
 
       file { "/etc/passwd":
-        owner => root,
-        group => root,
-        mode  => 644
+        owner => "root",
+        group => "root",
+        mode  => "0644"
       }
 
   `/etc/passwd` is considered the title of the file object (used for things like
@@ -95,19 +94,18 @@ Puppet::Util::Reference.newreference :type, :doc => "All Puppet resource types a
     str << markdown_header("Parameters", 4) + "\n"
     type.parameters.sort { |a,b|
       a.to_s <=> b.to_s
-    }.each { |name,param|
-      #docs[name] = indent(scrub(type.paramdoc(name)), $tab)
-      docs[name] = scrub(type.paramdoc(name))
+    }.each { |type_name, param|
+      docs[type_name] = scrub(type.paramdoc(type_name))
     }
 
     additional_key_attributes = type.key_attributes - [:name]
     docs.sort { |a, b|
       a[0].to_s <=> b[0].to_s
-    }.each { |name, doc|
-      if additional_key_attributes.include?(name)
+    }.each { |type_name, doc|
+      if additional_key_attributes.include?(type_name)
         doc = "(**Namevar:** If omitted, this parameter's value defaults to the resource's title.)\n\n" + doc
       end
-      str << markdown_definitionlist(name, doc)
+      str << markdown_definitionlist(type_name, doc)
     }
     str << "\n"
   }

data/lib/puppet/relationship.rb

@@ -1,13 +1,14 @@
 # subscriptions are permanent associations determining how different
 # objects react to an event
 
-require 'puppet/util/pson'
-
 # This is Puppet's class for modeling edges in its configuration graph.
 # It used to be a subclass of GRATR::Edge, but that class has weird hash
 # overrides that dramatically slow down the graphing.
 class Puppet::Relationship
-  extend Puppet::Util::Pson
+
+  # FormatSupport for serialization methods
+  include Puppet::Network::FormatSupport
+
   attr_accessor :source, :target, :callback
 
   attr_reader :event
@@ -27,11 +28,6 @@ class Puppet::Relationship
     new(source, target, args)
   end
 
-  def self.from_pson(pson)
-    Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
-    self.from_data_hash(pson)
-  end
-
   def event=(event)
     raise ArgumentError, "You must pass a callback for non-NONE events" if event != :NONE and ! callback
     @event = event
@@ -88,15 +84,6 @@ class Puppet::Relationship
     data
   end
 
-  # This doesn't include document type as it is part of a catalog
-  def to_pson_data_hash
-    to_data_hash
-  end
-
-  def to_pson(*args)
-    to_data_hash.to_pson(*args)
-  end
-
   def to_s
     ref
   end