puppet 4.0.0 → 4.5.0

data/lib/puppet/provider/user/directoryservice.rb

@@ -1,5 +1,5 @@
 require 'puppet'
-require 'plist'
+require 'puppet/util/plist' if Puppet.features.cfpropertylist?
 require 'base64'
 
 Puppet::Type.type(:user).provide :directoryservice do
@@ -13,11 +13,11 @@ Puppet::Type.type(:user).provide :directoryservice do
   commands :uuidgen      => '/usr/bin/uuidgen'
   commands :dsimport     => '/usr/bin/dsimport'
   commands :dscl         => '/usr/bin/dscl'
-  commands :plutil       => '/usr/bin/plutil'
   commands :dscacheutil  => '/usr/bin/dscacheutil'
 
   # Provider confines and defaults
   confine    :operatingsystem => :darwin
+  confine    :feature         => :cfpropertylist
   defaultfor :operatingsystem => :darwin
 
   # Need this to create getter/setter methods automagically
@@ -91,7 +91,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   # Return an array of hashes containing information about every user on
   # the system.
   def self.get_all_users
-    Plist.parse_xml(dscl '-plist', '.', 'readall', '/Users')
+    Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'readall', '/Users')
   end
 
   # This method accepts an individual user plist, passed as a hash, and
@@ -164,14 +164,14 @@ Puppet::Type.type(:user).provide :directoryservice do
   # Use dscl to retrieve an array of hashes containing attributes about all
   # of the local groups on the machine.
   def self.get_list_of_groups
-    @groups ||= Plist.parse_xml(dscl '-plist', '.', 'readall', '/Groups')
+    @groups ||= Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'readall', '/Groups')
   end
 
   # Perform a dscl lookup at the path specified for the specific keyname
   # value. The value returned is the first item within the array returned
   # from dscl
   def self.get_attribute_from_dscl(path, username, keyname)
-    Plist.parse_xml(dscl '-plist', '.', 'read', "/#{path}/#{username}", keyname)
+    Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'read', "/#{path}/#{username}", keyname)
   end
 
   # The plist embedded in the ShadowHashData key is a binary plist. The
@@ -179,40 +179,25 @@ Puppet::Type.type(:user).provide :directoryservice do
   # extract the binary plist, convert it to XML, and return it.
   def self.get_embedded_binary_plist(shadow_hash_data)
     embedded_binary_plist = Array(shadow_hash_data['dsAttrTypeNative:ShadowHashData'][0].delete(' ')).pack('H*')
-    convert_binary_to_xml(embedded_binary_plist)
-  end
-
-  # This method will accept a hash that has been returned from Plist::parse_xml
-  # and convert it to a binary plist (string value).
-  def self.convert_xml_to_binary(plist_data)
-    Puppet.debug('Converting XML plist to binary')
-    Puppet.debug('Executing: \'plutil -convert binary1 -o - -\'')
-    IO.popen('plutil -convert binary1 -o - -', 'r+') do |io|
-      io.write Plist::Emit.dump(plist_data)
-      io.close_write
-      @converted_plist = io.read
-    end
-    @converted_plist
-  end
-
-  # This method will accept a binary plist (as a string) and convert it to a
-  # hash via Plist::parse_xml.
-  def self.convert_binary_to_xml(plist_data)
-    Puppet.debug('Converting binary plist to XML')
-    Puppet.debug('Executing: \'plutil -convert xml1 -o - -\'')
-    IO.popen('plutil -convert xml1 -o - -', 'r+') do |io|
-      io.write plist_data
-      io.close_write
-      @converted_plist = io.read
-    end
-    Puppet.debug('Converting XML values to a hash.')
-    Plist::parse_xml(@converted_plist)
+    convert_binary_to_hash(embedded_binary_plist)
+  end
+
+  # This method will accept a hash and convert it to a binary plist (string value).
+  def self.convert_hash_to_binary(plist_data)
+    Puppet.debug('Converting plist hash to binary')
+    Puppet::Util::Plist.dump_plist(plist_data, :binary)
+  end
+
+  # This method will accept a binary plist (as a string) and convert it to a hash.
+  def self.convert_binary_to_hash(plist_data)
+    Puppet.debug('Converting binary plist to hash')
+    Puppet::Util::Plist.parse_plist(plist_data)
   end
 
   # The salted-SHA512 password hash in 10.7 is stored in the 'SALTED-SHA512'
   # key as binary data. That data is extracted and converted to a hex string.
   def self.get_salted_sha512(embedded_binary_plist)
-    embedded_binary_plist['SALTED-SHA512'].string.unpack("H*")[0]
+    embedded_binary_plist['SALTED-SHA512'].unpack("H*")[0]
   end
 
   # This method reads the passed embedded_binary_plist hash and returns values
@@ -222,7 +207,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   def self.get_salted_sha512_pbkdf2(field, embedded_binary_plist)
     case field
     when 'salt', 'entropy'
-      embedded_binary_plist['SALTED-SHA512-PBKDF2'][field].string.unpack('H*').first
+      embedded_binary_plist['SALTED-SHA512-PBKDF2'][field].unpack('H*').first
     when 'iterations'
       Integer(embedded_binary_plist['SALTED-SHA512-PBKDF2'][field])
     else
@@ -549,15 +534,16 @@ Puppet::Type.type(:user).provide :directoryservice do
   def get_users_plist(username)
     # This method will retrieve the data stored in a user's plist and
     # return it as a native Ruby hash.
-    Plist::parse_xml(plutil('-convert', 'xml1', '-o', '/dev/stdout', "#{users_plist_dir}/#{username}.plist"))
+    path = "#{users_plist_dir}/#{username}.plist"
+    Puppet::Util::Plist.read_plist_file(path)
   end
 
   # This method will return the binary plist that's embedded in the
   # ShadowHashData key of a user's plist, or false if it doesn't exist.
   def get_shadow_hash_data(users_plist)
     if users_plist['ShadowHashData']
-      password_hash_plist  = users_plist['ShadowHashData'][0].string
-      self.class.convert_binary_to_xml(password_hash_plist)
+      password_hash_plist  = users_plist['ShadowHashData'][0]
+      self.class.convert_binary_to_hash(password_hash_plist)
     else
       false
     end
@@ -568,22 +554,13 @@ Puppet::Type.type(:user).provide :directoryservice do
   # into the ShadowHashData key of the user's plist.
   def set_shadow_hash_data(users_plist, binary_plist)
     if users_plist.has_key?('ShadowHashData')
-      users_plist['ShadowHashData'][0].string = binary_plist
+      users_plist['ShadowHashData'][0] = binary_plist
     else
-      users_plist['ShadowHashData'] = [new_stringio_object(binary_plist)]
+      users_plist['ShadowHashData'] = [binary_plist]
     end
     write_users_plist_to_disk(users_plist)
   end
 
-  # This method returns a new StringIO object. Why does it exist?
-  # Well, StringIO objects have their own 'serial number', so when
-  # writing rspec tests it's difficult to compare StringIO objects
-  # due to this serial number. If this action is wrapped in its own
-  # method, it can be mocked for easier testing.
-  def new_stringio_object(value = '')
-    StringIO.new(value)
-  end
-
   # This method accepts an argument of a hex password hash, and base64
   # decodes it into a format that OS X 10.7 and 10.8 will store
   # in the user's plist.
@@ -598,17 +575,17 @@ Puppet::Type.type(:user).provide :directoryservice do
   def set_salted_sha512(users_plist, shadow_hash_data, value)
     unless shadow_hash_data
       shadow_hash_data = Hash.new
-      shadow_hash_data['SALTED-SHA512'] = new_stringio_object
+      shadow_hash_data['SALTED-SHA512'] = ''
     end
-    shadow_hash_data['SALTED-SHA512'].string = base64_decode_string(value)
-    binary_plist = self.class.convert_xml_to_binary(shadow_hash_data)
+    shadow_hash_data['SALTED-SHA512'] = base64_decode_string(value)
+    binary_plist = self.class.convert_hash_to_binary(shadow_hash_data)
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
   # This method accepts a passed value and one of three fields: 'salt',
   # 'entropy', or 'iterations'.  These fields correspond with the fields
   # utilized in a PBKDF2 password hashing system
-  # (see http://en.wikipedia.org/wiki/PBKDF2 ) where 'entropy' is the
+  # (see https://en.wikipedia.org/wiki/PBKDF2 ) where 'entropy' is the
   # password hash, 'salt' is the password hash salt value, and 'iterations'
   # is an integer recommended to be > 10,000. The remaining arguments are
   # the user's plist itself, and the shadow_hash_data hash containing the
@@ -618,8 +595,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     shadow_hash_data['SALTED-SHA512-PBKDF2'] = Hash.new unless shadow_hash_data['SALTED-SHA512-PBKDF2']
     case field
     when 'salt', 'entropy'
-      shadow_hash_data['SALTED-SHA512-PBKDF2'][field] =  new_stringio_object unless shadow_hash_data['SALTED-SHA512-PBKDF2'][field]
-      shadow_hash_data['SALTED-SHA512-PBKDF2'][field].string = base64_decode_string(value)
+      shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = base64_decode_string(value)
     when 'iterations'
       shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = Integer(value)
     else
@@ -633,15 +609,14 @@ Puppet::Type.type(:user).provide :directoryservice do
     # Convert shadow_hash_data to a binary plist, and call the
     # set_shadow_hash_data method to serialize and write the data
     # back to the user's plist.
-    binary_plist = self.class.convert_xml_to_binary(shadow_hash_data)
+    binary_plist = self.class.convert_hash_to_binary(shadow_hash_data)
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
   # This method will accept a plist in XML format, save it to disk, convert
   # the plist to a binary format, and flush the dscl cache.
   def write_users_plist_to_disk(users_plist)
-    Plist::Emit.save_plist(users_plist, "#{users_plist_dir}/#{@resource.name}.plist")
-    plutil'-convert', 'binary1', "#{users_plist_dir}/#{@resource.name}.plist"
+    Puppet::Util::Plist.write_plist_file(users_plist, "#{users_plist_dir}/#{@resource.name}.plist", :binary)
   end
 
   # This is a simple wrapper method for writing values to a file.

data/lib/puppet/provider/user/openbsd.rb

@@ -11,6 +11,7 @@ Puppet::Type.type(:user).provide :openbsd, :parent => :useradd do
            :password => "passwd"
 
   defaultfor :operatingsystem => :openbsd
+  confine    :operatingsystem => :openbsd
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos

data/lib/puppet/provider/user/pw.rb

@@ -8,6 +8,7 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
   has_features :manages_homedir, :allows_duplicates, :manages_passwords, :manages_expiry, :manages_shell
 
   defaultfor :operatingsystem => [:freebsd, :dragonfly]
+  confine    :operatingsystem => [:freebsd, :dragonfly]
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos

data/lib/puppet/provider/user/user_role_add.rb

@@ -167,10 +167,12 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
   end
 
   def password
-    shadow_entry[1] if shadow_entry
+    return :absent unless shadow_entry
+    shadow_entry[1]
   end
 
   def password_min_age
+    return :absent unless shadow_entry
     shadow_entry[3].empty? ? -1 : shadow_entry[3]
   end
 

data/lib/puppet/provider/user/windows_adsi.rb

@@ -8,18 +8,59 @@ Puppet::Type.type(:user).provide :windows_adsi do
 
   has_features :manages_homedir, :manages_passwords
 
+  def initialize(value={})
+    super(value)
+    @deleted = false
+  end
+
   def user
     @user ||= Puppet::Util::Windows::ADSI::User.new(@resource[:name])
   end
 
   def groups
-    user.groups.join(',')
+    @groups ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(user.groups)
+    @groups.keys
   end
 
   def groups=(groups)
     user.set_groups(groups, @resource[:membership] == :minimum)
   end
 
+  def groups_insync?(current, should)
+    return false unless current
+
+    # By comparing account SIDs we don't have to worry about case
+    # sensitivity, or canonicalization of account names.
+
+    # Cannot use munge of the group property to canonicalize @should
+    # since the default array_matching comparison is not commutative
+
+    # dupes automatically weeded out when hashes built
+    current_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current)
+    specified_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
+
+    if @resource[:membership] == :inclusive
+      current_users.keys.to_a == specified_users.keys.to_a
+    else
+      (specified_users.keys.to_a & current_users.keys.to_a) == specified_users.keys.to_a
+    end
+  end
+
+  def groups_to_s(groups)
+    return '' if groups.nil? || !groups.kind_of?(Array)
+    groups = groups.map do |group_name|
+      sid = Puppet::Util::Windows::SID.name_to_sid_object(group_name)
+      if sid.account =~ /\\/
+        account, _ = Puppet::Util::Windows::ADSI::Group.parse_name(sid.account)
+      else
+        account = sid.account
+      end
+      resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
+      "#{sid.domain}\\#{account}"
+    end
+    return groups.join(',')
+  end
+
   def create
     @user = Puppet::Util::Windows::ADSI::User.create(@resource[:name])
     @user.password = @resource[:password]
@@ -47,11 +88,13 @@ Puppet::Type.type(:user).provide :windows_adsi do
     if sid
       Puppet::Util::Windows::ADSI::UserProfile.delete(sid)
     end
+
+    @deleted = true
   end
 
   # Only flush if we created or modified a user, not deleted
   def flush
-    @user.commit if @user
+    @user.commit if @user && !@deleted
   end
 
   def comment

data/lib/puppet/provider/yumrepo/inifile.rb

@@ -74,9 +74,12 @@ Puppet::Type.type(:yumrepo).provide(:inifile) do
   def self.reposdir(conf='/etc/yum.conf', dirs=['/etc/yum.repos.d', '/etc/yum/repos.d'])
     reposdir = find_conf_value('reposdir', conf)
     # Use directories in reposdir if they are set instead of default
-    dirs = reposdir.split(",").map(&:strip) if reposdir
-    
-
+    if reposdir
+      # Follow the code from the yum/config.py
+      dirs = reposdir.gsub!("\n", ' ')
+      dirs = reposdir.gsub!(',', ' ')
+      dirs = reposdir.split
+    end
     dirs.select! { |dir| Puppet::FileSystem.exist?(dir) }
     if dirs.empty?
       Puppet.debug('No yum directories were found on the local filesystem')

data/lib/puppet/provider/zfs/zfs.rb

@@ -40,7 +40,7 @@ Puppet::Type.type(:zfs).provide(:zfs) do
 
   PARAMETER_UNSET_OR_NOT_AVAILABLE = '-'
 
-  # http://docs.oracle.com/cd/E19963-01/html/821-1448/gbscy.html
+  # https://docs.oracle.com/cd/E19963-01/html/821-1448/gbscy.html
   # shareiscsi (added in build 120) was removed from S11 build 136
   # aclmode was removed from S11 in build 139 but it may have been added back
   # http://webcache.googleusercontent.com/search?q=cache:-p74K0DVsdwJ:developers.slashdot.org/story/11/11/09/2343258/solaris-11-released+&cd=13

data/lib/puppet/provider/zone/solaris.rb

@@ -234,10 +234,10 @@ Puppet::Type.type(:zone).provide(:solaris) do
           end
           current[$1.intern] = $2
         else
-          Puppet.err "Ignoring '#{line}'"
+          err "Ignoring '#{line}'"
         end
       else
-        Puppet.debug "Ignoring zone output '#{line}'"
+        debug "Ignoring zone output '#{line}'"
       end
     end
 

data/lib/puppet/provider/zpool/zpool.rb

@@ -48,7 +48,7 @@ Puppet::Type.type(:zpool).provide(:zpool) do
   end
 
   def get_pool_data
-    # http://docs.oracle.com/cd/E19082-01/817-2271/gbcve/index.html
+    # https://docs.oracle.com/cd/E19082-01/817-2271/gbcve/index.html
     # we could also use zpool iostat -v mypool for a (little bit) cleaner output
     out = execute("zpool status #{@resource[:pool]}", :failonfail => false, :combine => false)
     zpool_data = out.lines.select { |line| line.index("\t") == 0 }.collect { |l| l.strip.split("\s")[0] }

data/lib/puppet/provider.rb

@@ -551,6 +551,11 @@ class Puppet::Provider
     "#{@resource}(provider=#{self.class.name})"
   end
 
+  # @return [String] Returns a human readable string with information about the resource and the provider.
+  def inspect
+    to_s
+  end
+
   # Makes providers comparable.
   include Comparable
   # Compares this provider against another provider.

data/lib/puppet/reference/configuration.rb

@@ -22,10 +22,16 @@ config = Puppet::Util::Reference.newreference(:configuration, :depth => 1, :doc
 
     # Now print the data about the item.
     val = object.default
-    if name.to_s == "vardir"
-      val = "/opt/puppetlabs/puppet/cache"
-    elsif name.to_s == "confdir"
-      val = "/etc/puppetlabs/puppet"
+    if name.to_s == 'vardir'
+      val = 'Unix/Linux: /opt/puppetlabs/puppet/cache -- Windows: C:\ProgramData\PuppetLabs\puppet\cache -- Non-root user: ~/.puppetlabs/opt/puppet/cache'
+    elsif name.to_s == 'confdir'
+      val = 'Unix/Linux: /etc/puppetlabs/puppet -- Windows: C:\ProgramData\PuppetLabs\puppet\etc -- Non-root user: ~/.puppetlabs/etc/puppet'
+    elsif name.to_s == 'codedir'
+      val = 'Unix/Linux: /etc/puppetlabs/code -- Windows: C:\ProgramData\PuppetLabs\code -- Non-root user: ~/.puppetlabs/etc/code'
+    elsif name.to_s == 'rundir'
+      val = 'Unix/Linux: /var/run/puppetlabs -- Windows: C:\ProgramData\PuppetLabs\puppet\var\run -- Non-root user: ~/.puppetlabs/var/run'
+    elsif name.to_s == 'logdir'
+      val = 'Unix/Linux: /var/log/puppetlabs/puppet -- Windows: C:\ProgramData\PuppetLabs\puppet\var\log -- Non-root user: ~/.puppetlabs/var/log'
     end
 
     # Leave out the section information; it was apparently confusing people.
@@ -67,7 +73,7 @@ config.header = <<EOT
 
 See the [configuration guide][confguide] for more details.
 
-[confguide]: http://docs.puppetlabs.com/guides/configuring.html
+[confguide]: http://docs.puppetlabs.com/puppet/latest/reference/config_about_settings.html
 
 * * *
 

data/lib/puppet/reference/indirection.rb

@@ -58,7 +58,7 @@ Values fetched from the terminus are written to the cache.
 
 ### Interaction with REST
 
-REST endpoints have the form `/{environment}/{indirection}/{key}`, where the indirection can be singular or plural, following normal English spelling rules.
+REST endpoints have the form `/{prefix}/{version}/{indirection}/{key}?environment={environment}`, where the indirection can be singular or plural, following normal English spelling rules.
 On the server side, REST responses are generated from the locally-configured endpoints.
 
 ### Indirections and Termini

data/lib/puppet/reference/providers.rb

@@ -1,9 +1,8 @@
-# This doesn't get stored in trac, since it changes every time.
 providers = Puppet::Util::Reference.newreference :providers, :title => "Provider Suitability Report", :depth => 1, :dynamic => true, :doc => "Which providers are valid for this machine" do
   types = []
   Puppet::Type.loadall
   Puppet::Type.eachtype do |klass|
-    next unless klass.providers.length > 0
+    next unless klass && klass.providers.length > 0
     types << klass
   end
   types.sort! { |a,b| a.name.to_s <=> b.name.to_s }
@@ -91,7 +90,7 @@ providers = Puppet::Util::Reference.newreference :providers, :title => "Provider
 
     ret << markdown_header(type.name.to_s + "_", 2)
 
-    ret << "[#{type.name}](http://docs.puppetlabs.com/references/stable/type.html##{type.name})\n\n"
+    ret << "[#{type.name}](https://docs.puppetlabs.com/puppet/latest/reference/type.html##{type.name})\n\n"
     ret << option("Default provider", default)
     ret << doctable(headers, table_data)
 

data/lib/puppet/reference/report.rb

@@ -5,19 +5,16 @@ report = Puppet::Util::Reference.newreference :report, :doc => "All available tr
 end
 
 report.header = "
-Puppet clients can report back to the server after each transaction.  This
-transaction report is sent as a YAML dump of the
-`Puppet::Transaction::Report` class and includes every log message that was
-generated during the transaction along with as many metrics as Puppet knows how
-to collect.  See [Reports and Reporting](http://docs.puppetlabs.com/guides/reporting.html) for more information on how to use reports.
+Puppet can generate a report after applying a catalog. This report includes
+events, log messages, resource statuses, and metrics and metadata about the run.
+Puppet agent sends its report to a Puppet master server, and Puppet apply
+processes its own reports.
 
-Currently, clients default to not sending in reports; you can enable reporting
-by setting the `report` parameter to true.
+Puppet master and Puppet apply will handle every report with a set of report
+processors, configurable with the `reports` setting in puppet.conf. This page
+documents the built-in report processors.
 
-To use a report, set the `reports` parameter on the server; multiple
-reports must be comma-separated.  You can also specify `none` to disable
-reports entirely.
-
-Puppet provides multiple report handlers that will process client reports:
+See [About Reporting](https://docs.puppetlabs.com/puppet/latest/reference/reporting_about.html)
+for more details.
 
 "

data/lib/puppet/reports.rb

@@ -54,7 +54,11 @@ class Puppet::Reports
   def self.register_report(name, options = {}, &block)
     name = name.intern
 
-    mod = genmodule(name, :extend => Puppet::Util::Docs, :hash => instance_hash(:report), :block => block)
+    mod = genmodule(name,
+                    :extend    => Puppet::Util::Docs,
+                    :hash      => instance_hash(:report),
+                    :overwrite => true,
+                    :block     => block)
 
     mod.useyaml = true if options[:useyaml]
 

data/lib/puppet/resource/capability_finder.rb

@@ -0,0 +1,102 @@
+#
+# A helper module to look a capability up from PuppetDB
+#
+# @todo lutter 2015-03-10: determine whether this should be based on
+# Puppet::Pops::Evaluator::Collectors, or at least use
+# Puppet::Util::Puppetdb::Http
+
+require 'net/http'
+require 'cgi'
+require 'json'
+
+# @api private
+module Puppet::Resource::CapabilityFinder
+
+  # Looks the capability resource from PuppetDB.
+  # @param environment [String] environment name
+  # @param code_id [String,nil] code_id of the catalog
+  # @param cap [Puppet::Type] the capability resource type instance
+  # @return [Puppet::Resource,nil] The found capability resource or `nil` if it could not be found
+  def self.find(environment, code_id, cap)
+    unless Puppet::Util.const_defined?('Puppetdb')
+      raise Puppet::DevError, 'PuppetDB is not available'
+    end
+
+    query_terms = [
+      'and',
+      ['=', 'type', cap.type.capitalize],
+      ['=', 'title', cap.title.to_s],
+      ['=', 'tag', "producer:#{environment}"]
+    ]
+
+    unless code_id.nil?
+      query_terms << ['in', 'certname',
+        ['extract', 'certname',
+          ['select_catalogs',
+            ['=', 'code_id', code_id]]]]
+    end
+
+    Puppet.notice "Capability lookup #{cap}]: #{query_terms}"
+
+    data = query_puppetdb(query_terms)
+
+    # The format of the response body is documented at
+    #   http://docs.puppetlabs.com/puppetdb/3.0/api/query/v4/resources.html#response-format
+    # In a nutshell, we expect to get an array of resources back. If the
+    # array is empty, the lookup failed and we return +nil+, if it
+    # contains exactly one, we turn that resource back into a Puppet
+    # ::Resource. If the array contains more than one entry, we have a
+    # bug in the overall system, as we allowed multiple capabilities with
+    # the same type and title to be produced in this environment.
+    unless data.is_a?(Array)
+      raise Puppet::DevError,
+      "Unexpected response from PuppetDB when looking up #{cap}: " +
+        "expected an Array but got #{data.inspect}"
+    end
+    if data.size > 1
+      raise Puppet::DevError,
+      "Unexpected response from PuppetDB when looking up #{cap}:\n" +
+        "expected exactly one resource but got #{data.size};\n" +
+        "returned data is:\n#{data.inspect}"
+    end
+
+    unless data.empty?
+      resource_hash = data.first
+      resource = Puppet::Resource.new(resource_hash['type'],
+                                      resource_hash['title'])
+      real_type = Puppet::Type.type(resource.type)
+      if real_type.nil?
+        fail Puppet::ParseError,
+          "Could not find resource type #{resource.type} returned from PuppetDB"
+      end
+      real_type.parameters.each do |param|
+        param = param.to_s
+        next if param == 'name'
+        if value = resource_hash['parameters'][param]
+          resource[param] = value
+        else
+          Puppet.debug "No capability value for #{resource}->#{param}"
+        end
+      end
+      return resource
+    end
+  end
+
+  def self.query_puppetdb(query)
+    # If using PuppetDB >= 4, use the API method query_puppetdb()
+    if Puppet::Util::Puppetdb.respond_to?(:query_puppetdb)
+      # PuppetDB 4 uses a unified query endpoint, so we have to specify what we're querying
+      Puppet::Util::Puppetdb.query_puppetdb(["from", "resources", query])
+    # For PuppetDB < 4, use the old internal method action()
+    else
+      url = "/pdb/query/v4/resource?query=#{CGI.escape(query.to_json)}"
+      response = Puppet::Util::Puppetdb::Http.action(url) do |conn, uri|
+        conn.get(uri, { 'Accept' => 'application/json'})
+      end
+      JSON.parse(response.body)
+    end
+  rescue JSON::JSONError => e
+    raise Puppet::DevError,
+      "Invalid JSON from PuppetDB when looking up #{cap}\n#{e}"
+  end
+end