puppet 4.0.0 → 4.5.0

data/lib/puppet/ssl/certificate_factory.rb

@@ -62,7 +62,7 @@ module Puppet::SSL::CertificateFactory
   #   extensions to.
   # @param csr [OpenSSL::X509::Request] The CSR associated with the given
   #   certificate, which may specify requested extensions for the given cert.
-  #   See http://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
+  #   See https://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
   # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
   #   if this is a self signed certificate, or the X509 certificate of the CA if
   #   this is a CA signed certificate.
@@ -100,7 +100,7 @@ module Puppet::SSL::CertificateFactory
     # something went wrong up there. --daniel 2011-10-11
     defaults = { "nsComment" => "Puppet Ruby/OpenSSL Internal Certificate" }
 
-    # See http://www.openssl.org/docs/apps/x509v3_config.html
+    # See https://www.openssl.org/docs/apps/x509v3_config.html
     # for information about the special meanings of 'hash', 'keyid', 'issuer'
     override = {
       "subjectKeyIdentifier"   => "hash",
@@ -126,7 +126,7 @@ module Puppet::SSL::CertificateFactory
       # complaint that the issuer keyid can't be fetched, which breaks all
       # sorts of things in our test suite and, e.g., bootstrapping the CA.
       #
-      # http://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
+      # https://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
       # conforming CA we MAY omit the field if we are self-signed, which I
       # think gives us a pass in the specific case.
       #

data/lib/puppet/ssl/certificate_request.rb

@@ -23,7 +23,7 @@ require 'puppet/ssl/certificate_signer'
 #
 # This behavior is dictated by PKCS#9/RFC 2985 section 5.4.2.
 #
-# @see http://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
+# @see https://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
 #
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
@@ -193,7 +193,7 @@ DOC
   #
   # The format of CSR attributes is specified in PKCS#10/RFC 2986
   #
-  # @see http://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
+  # @see https://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
   #
   # @api public
   #
@@ -289,8 +289,8 @@ DOC
   # that in turn holds the elements. This is why we have to unpack an array
   # every time we unpack a Set/Seq.
   #
-  # @see http://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
-  # @see http://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
+  # @see https://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
+  # @see https://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
   #
   # @api private
   #

data/lib/puppet/ssl/certificate_signer.rb

@@ -1,6 +1,6 @@
 # Take care of signing a certificate in a FIPS 140-2 compliant manner.
 #
-# @see http://projects.puppetlabs.com/issues/17295
+# @see https://projects.puppetlabs.com/issues/17295
 #
 # @api private
 class Puppet::SSL::CertificateSigner

data/lib/puppet/ssl/oids.rb

@@ -48,7 +48,15 @@ module Puppet::SSL::Oids
     ["1.3.6.1.4.1.34380.1.1.15", 'pp_department', 'Puppet Node Department Name'],
     ["1.3.6.1.4.1.34380.1.1.16", 'pp_cluster', 'Puppet Node Cluster Name'],
     ["1.3.6.1.4.1.34380.1.1.17", 'pp_provisioner', 'Puppet Node Provisioner Name'],
-    
+    ["1.3.6.1.4.1.34380.1.1.18", 'pp_region', 'Puppet Node Region Name'],
+    ["1.3.6.1.4.1.34380.1.1.19", 'pp_datacenter', 'Puppet Node Datacenter Name'],
+    ["1.3.6.1.4.1.34380.1.1.20", 'pp_zone', 'Puppet Node Zone Name'],
+    ["1.3.6.1.4.1.34380.1.1.21", 'pp_network', 'Puppet Node Network Name'],
+    ["1.3.6.1.4.1.34380.1.1.22", 'pp_securitypolicy', 'Puppet Node Security Policy Name'],
+    ["1.3.6.1.4.1.34380.1.1.23", 'pp_cloudplatform', 'Puppet Node Cloud Platform Name'],
+    ["1.3.6.1.4.1.34380.1.1.24", 'pp_apptier', 'Puppet Node Application Tier'],
+    ["1.3.6.1.4.1.34380.1.1.25", 'pp_hostname', 'Puppet Node Hostname'],
+
     ["1.3.6.1.4.1.34380.1.2", 'ppPrivCertExt', 'Puppet Private Certificate Extension'],
   ]
 
@@ -61,7 +69,7 @@ module Puppet::SSL::Oids
     end
   end
 
-  # Parse and load custom OID mapping file that enables custom OIDs to be resolved
+  # Parse custom OID mapping file that enables custom OIDs to be resolved
   # into user-friendly names.
   #
   # @param custom_oid_file [String] File to obtain custom OIDs mapping from
@@ -76,7 +84,7 @@ module Puppet::SSL::Oids
   #  '1.3.6.1.4.1.34380.1.2.1.2':
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
-  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+  def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
     if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
       mapping = nil
       begin
@@ -102,6 +110,28 @@ module Puppet::SSL::Oids
         oid_defns << [oid, shortname, longname]
       end
 
+      oid_defns
+    end
+  end
+
+  # Load custom OID mapping file that enables custom OIDs to be resolved
+  # into user-friendly names.
+  #
+  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
+  # @param map_key [String] Hash key in which custom OIDs mapping is stored
+  #
+  # @example Custom OID mapping file
+  # ---
+  # oid_mapping:
+  #  '1.3.6.1.4.1.34380.1.2.1.1':
+  #    shortname : 'myshortname'
+  #    longname  : 'Long name'
+  #  '1.3.6.1.4.1.34380.1.2.1.2':
+  #    shortname: 'myothershortname'
+  #    longname: 'Other Long name'
+  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+    oid_defns = parse_custom_oid_file(custom_oid_file, map_key)
+    unless oid_defns.nil?
       begin
         oid_defns.each do |oid_defn|
           OpenSSL::ASN1::ObjectId.register(*oid_defn)

data/lib/puppet/ssl/validator/default_validator.rb

@@ -48,7 +48,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # chain being verified.
   #
   # From the [OpenSSL
-  # documentation](http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
+  # documentation](https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
   # The `verify_callback` function is used to control the behaviour when the
   # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
   # receives two arguments: preverify_ok indicates, whether the verification of

data/lib/puppet/test/test_helper.rb

@@ -121,7 +121,13 @@ module Puppet::Test
       end
 
       # The process environment is a shared, persistent resource.
-      $old_env = ENV.to_hash
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
+      $old_env = Puppet::Util.get_environment(mode)
 
       # So is the load_path
       $old_load_path = $LOAD_PATH.dup
@@ -171,13 +177,19 @@ module Puppet::Test
       end
       $saved_indirection_state = nil
 
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
       # Restore the global process environment.  Can't just assign because this
       # is a magic variable, sadly, and doesn't do that™.  It is sufficiently
       # faster to use the compare-then-set model to avoid excessive work that it
       # justifies the complexity.  --daniel 2012-03-15
-      unless ENV.to_hash == $old_env
-        ENV.clear
-        $old_env.each {|k, v| ENV[k] = v }
+      unless Puppet::Util.get_environment(mode) == $old_env
+        Puppet::Util.clear_environment(mode)
+        $old_env.each {|k, v| Puppet::Util.set_env(k, v, mode) }
       end
 
       # Restore the load_path late, to avoid messing with stubs from the test.
@@ -226,7 +238,6 @@ module Puppet::Test
       #
       # I would make these even shorter, but OpenSSL doesn't support anything
       # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
-      Puppet[:req_bits]  = 512
       Puppet[:keylength] = 512
 
       # Although we setup a testing context during initialization, some tests

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -5,6 +5,8 @@
 #
 # @api private
 class Puppet::Transaction::AdditionalResourceGenerator
+  attr_writer :relationship_graph
+
   def initialize(catalog, relationship_graph, prioritizer)
     @catalog = catalog
     @relationship_graph = relationship_graph
@@ -20,13 +22,25 @@ class Puppet::Transaction::AdditionalResourceGenerator
     end
     return unless generated
     generated = [generated] unless generated.is_a?(Array)
-    generated.collect do |res|
+    generated.collect! do |res|
       @catalog.resource(res.ref) || res
-    end.each do |res|
-      priority = @prioritizer.generate_priority_contained_in(resource, res)
-      add_resource(res, resource, priority)
+    end
+    unless resource.depthfirst?
+      # This is reversed becuase PUP-1963 changed how generated
+      # resources were added to the catalog. It exists for backwards
+      # compatibility only, and can probably be removed in Puppet 5
+      #
+      # Previously, resources were given sequential priorities in the
+      # relationship graph. Post-1963, resources are added to the
+      # catalog one by one adjacent to the parent resource. This
+      # causes an implicit reversal of their application order from
+      # the old code. The reverse makes it all work like it did.
+      generated.reverse!
+    end
+    generated.each do |res|
+      add_resource(res, resource)
 
-      add_conditional_directed_dependency(resource, res)
+      add_generated_directed_dependency(resource, res)
       generate_additional_resources(res)
     end
   end
@@ -102,16 +116,83 @@ class Puppet::Transaction::AdditionalResourceGenerator
     end
   end
 
-  def add_resource(res, parent_resource, priority)
+  def add_resource(res, parent_resource, priority=nil)
     if @catalog.resource(res.ref).nil?
       res.tag(*parent_resource.tags)
-      @catalog.add_resource(res)
-      @relationship_graph.add_vertex(res, priority)
+      if parent_resource.depthfirst?
+        @catalog.add_resource_before(parent_resource, res)
+      else
+        @catalog.add_resource_after(parent_resource, res)
+      end
       @catalog.add_edge(@catalog.container_of(parent_resource), res)
+      if @relationship_graph && priority
+        # If we have a relationship_graph we should add the resource
+        # to it (this is an eval_generate). If we don't, then the
+        # relationship_graph has not yet been created and we can skip
+        # adding it.
+        @relationship_graph.add_vertex(res, priority)
+      end
       res.finish
     end
   end
 
+  # add correct edge for depth- or breadth- first traversal of
+  # generated resource. Skip generating the edge if there is already
+  # some sort of edge between the two resources.
+  def add_generated_directed_dependency(parent, child, label=nil)
+    if parent.depthfirst?
+      source = child
+      target = parent
+    else
+      source = parent
+      target = child
+    end
+
+    # For each potential relationship metaparam, check if parent or
+    # child references the other. If there are none, we should add our
+    # edge.
+    edge_exists = Puppet::Type.relationship_params.any? { |param|
+      param_sym = param.name.to_sym
+
+      if parent[param_sym]
+        parent_contains = parent[param_sym].any? { |res|
+          res.ref == child.ref
+        }
+      else
+        parent_contains = false
+      end
+
+      if child[param_sym]
+        child_contains = child[param_sym].any? { |res|
+          res.ref == parent.ref
+        }
+      else
+        child_contains = false
+      end
+
+      parent_contains || child_contains
+    }
+
+    if not edge_exists
+      # We *cannot* use target.to_resource here!
+      #
+      # For reasons that are beyond my (and, perhaps, human)
+      # comprehension, to_resource will call retrieve. This is
+      # problematic if a generated resource needs the system to be
+      # changed by a previous resource (think a file on a path
+      # controlled by a mount resource).
+      #
+      # Instead of using to_resource, we just construct a resource as
+      # if the arguments to the Type instance had been passed to a
+      # Resource instead.
+      resource = ::Puppet::Resource.new(target.class, target.title,
+                                        :parameters => target.original_parameters)
+
+      source[:before] ||= []
+      source[:before] << resource
+    end
+  end
+
   # Copy an important relationships from the parent to the newly-generated
   # child resource.
   def add_conditional_directed_dependency(parent, child, label=nil)

data/lib/puppet/transaction/report.rb

@@ -48,6 +48,17 @@ class Puppet::Transaction::Report
   # @return [String] uuid
   attr_accessor :transaction_uuid
 
+  # The id of the code input to the compiler.
+  attr_accessor :code_id
+
+  # A master generated catalog uuid, useful for connecting a single catalog to multiple reports.
+  attr_accessor :catalog_uuid
+
+  # Whether a cached catalog was used in the run, and if so, the reason that it was used.
+  # @return [String] One of the values: 'not_used', 'explicitly_requested',
+  # or 'on_failure'
+  attr_accessor :cached_catalog_status
+
   # The host name for which the report is generated
   # @return [String] the host name
   attr_accessor :host
@@ -172,10 +183,13 @@ class Puppet::Transaction::Report
     @host = Puppet[:node_name_value]
     @time = Time.now
     @kind = kind
-    @report_format = 4
+    @report_format = 5
     @puppet_version = Puppet.version
     @configuration_version = configuration_version
     @transaction_uuid = transaction_uuid
+    @code_id = nil
+    @catalog_uuid = nil
+    @cached_catalog_status = nil
     @environment = environment
     @status = 'failed' # assume failed until the report is finalized
   end
@@ -190,6 +204,19 @@ class Puppet::Transaction::Report
     @status = data['status']
     @host = data['host']
     @time = data['time']
+
+    if catalog_uuid = data['catalog_uuid']
+      @catalog_uuid = catalog_uuid
+    end
+
+    if code_id = data['code_id']
+      @code_id = code_id
+    end
+
+    if cached_catalog_status = data['cached_catalog_status']
+      @cached_catalog_status = cached_catalog_status
+    end
+
     if @time.is_a? String
       @time = Time.parse(@time)
     end
@@ -221,6 +248,9 @@ class Puppet::Transaction::Report
       'time' => @time.iso8601(9),
       'configuration_version' => @configuration_version,
       'transaction_uuid' => @transaction_uuid,
+      'catalog_uuid' => @catalog_uuid,
+      'code_id' => @code_id,
+      'cached_catalog_status' => @cached_catalog_status,
       'report_format' => @report_format,
       'puppet_version' => @puppet_version,
       'kind' => @kind,

data/lib/puppet/transaction/resource_harness.rb

@@ -69,8 +69,6 @@ class Puppet::Transaction::ResourceHarness
   def perform_changes(resource, context)
     cache(resource, :checked, Time.now)
 
-    return [] if ! allow_changes?(resource)
-
     # Record the current state in state.yml.
     context.audited_params.each do |param|
       cache(resource, param, context.current_values[param])
@@ -96,24 +94,6 @@ class Puppet::Transaction::ResourceHarness
     capture_audit_events(resource, context)
   end
 
-  def allow_changes?(resource)
-    if resource.purging? and resource.deleting? and deps = relationship_graph.dependents(resource) \
-            and ! deps.empty? and deps.detect { |d| ! d.deleting? }
-      deplabel = deps.collect { |r| r.ref }.join(",")
-      plurality = deps.length > 1 ? "":"s"
-      resource.warning "#{deplabel} still depend#{plurality} on me -- not purging"
-      false
-    else
-      true
-    end
-  end
-
-  # allow_changes? is only made public to enable the existing spec tests to run
-  # under rspec 3 (apparently rspec 2 didn't enforce access controls?). Please do not
-  # treat this as part of a public API.
-  # Possible future improvement: rewrite to not require access to private methods.
-  public :allow_changes?
-
   def sync_if_needed(param, context)
     historical_value = context.historical_values[param.name]
     current_value = context.current_values[param.name]

data/lib/puppet/transaction.rb

@@ -1,5 +1,6 @@
 require 'puppet'
 require 'puppet/util/tagging'
+require 'puppet/util/skip_tags'
 require 'puppet/application'
 require 'digest/sha1'
 require 'set'
@@ -79,7 +80,7 @@ class Puppet::Transaction
   # necessary events.
   def evaluate(&block)
     block ||= method(:eval_resource)
-    generator = AdditionalResourceGenerator.new(@catalog, relationship_graph, @prioritizer)
+    generator = AdditionalResourceGenerator.new(@catalog, nil, @prioritizer)
     @catalog.vertices.each { |resource| generator.generate_additional_resources(resource) }
 
     perform_pre_run_checks
@@ -135,6 +136,9 @@ class Puppet::Transaction
       end
     end
 
+    # Generate the relationship graph, set up our generator to use it
+    # for eval_generate, then kick off our traversal.
+    generator.relationship_graph = relationship_graph
     relationship_graph.traverse(:while => continue_while,
                                 :pre_process => pre_process,
                                 :overly_deferred_resource_handler => overly_deferred_resource_handler,
@@ -182,6 +186,10 @@ class Puppet::Transaction
     super
   end
 
+  def skip_tags
+    @skip_tags ||= Puppet::Util::SkipTags.new(Puppet[:skip_tags]).tags
+  end
+
   def prefetch_if_necessary(resource)
     provider_class = resource.provider.class
     return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
@@ -210,6 +218,7 @@ class Puppet::Transaction
 
   # Evaluate a single resource.
   def eval_resource(resource, ancestor = nil)
+    propagate_failure(resource)
     if skip?(resource)
       resource_status(resource).skipped = true
       resource.debug("Resource is being skipped, unscheduling all events")
@@ -227,54 +236,43 @@ class Puppet::Transaction
 
   # Does this resource have any failed dependencies?
   def failed_dependencies?(resource)
-    # First make sure there are no failed dependencies.  To do this,
-    # we check for failures in any of the vertexes above us.  It's not
-    # enough to check the immediate dependencies, which is why we use
-    # a tree from the reversed graph.
-    found_failed = false
-
-
     # When we introduced the :whit into the graph, to reduce the combinatorial
     # explosion of edges, we also ended up reporting failures for containers
     # like class and stage.  This is undesirable; while just skipping the
     # output isn't perfect, it is RC-safe. --daniel 2011-06-07
     suppress_report = (resource.class == Puppet::Type.type(:whit))
 
-    relationship_graph.dependencies(resource).each do |dep|
-      next unless failed?(dep)
-      found_failed = true
-
+    s = resource_status(resource)
+    if s && s.dependency_failed?
       # See above. --daniel 2011-06-06
       unless suppress_report then
-        resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
+        s.failed_dependencies.each do |dep|
+          resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
+        end
       end
     end
 
-    found_failed
+    s && s.dependency_failed?
   end
 
-  # A general method for recursively generating new resources from a
-  # resource.
-  def generate_additional_resources(resource)
-    return unless resource.respond_to?(:generate)
-    begin
-      made = resource.generate
-    rescue => detail
-      resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
-    end
-    return unless made
-    made = [made] unless made.is_a?(Array)
-    made.uniq.each do |res|
-      begin
-        res.tag(*resource.tags)
-        @catalog.add_resource(res)
-        res.finish
-        add_conditional_directed_dependency(resource, res)
-        generate_additional_resources(res)
-      rescue Puppet::Resource::Catalog::DuplicateResourceError
-        res.info "Duplicate generated resource; skipping"
+  # We need to know if a resource has any failed dependencies before
+  # we try to process it. We keep track of this by keeping a list on
+  # each resource of the failed dependencies, and incrementally
+  # computing it as the union of the failed dependencies of each
+  # first-order dependency. We have to do this as-we-go instead of
+  # up-front at failure time because the graph may be mutated as we
+  # walk it.
+  def propagate_failure(resource)
+    failed = Set.new
+    relationship_graph.direct_dependencies_of(resource).each do |dep|
+      if (s = resource_status(dep))
+        failed.merge(s.failed_dependencies) if s.dependency_failed?
+        if s.failed?
+          failed.add(dep)
+        end
       end
     end
+    resource_status(resource).failed_dependencies = failed.to_a
   end
 
   # Should we ignore tags?
@@ -322,7 +320,9 @@ class Puppet::Transaction
 
   # Should this resource be skipped?
   def skip?(resource)
-    if missing_tags?(resource)
+    if skip_tags?(resource)
+      resource.debug "Skipping with skip tags #{skip_tags.join(", ")}"
+    elsif missing_tags?(resource)
       resource.debug "Not tagged with #{tags.join(", ")}"
     elsif ! scheduled?(resource)
       resource.debug "Not scheduled"
@@ -358,6 +358,17 @@ class Puppet::Transaction
     not resource.tagged?(*tags)
   end
 
+  def skip_tags?(resource)
+    return false if ignore_tags?
+    return false if skip_tags.empty?
+
+    resource.tagged?(*skip_tags)
+  end
+
+  def split_qualified_tags?
+    false
+  end
+
   # These two methods are only made public to enable the existing spec tests to run
   # under rspec 3 (apparently rspec 2 didn't enforce access controls?). Please do not
   # treat these as part of a public API.
@@ -368,4 +379,3 @@ class Puppet::Transaction
 end
 
 require 'puppet/transaction/report'
-

data/lib/puppet/type/augeas.rb

@@ -5,7 +5,7 @@
 #   you may not use this file except in compliance with the License.
 #   You may obtain a copy of the License at
 #
-#       http://www.apache.org/licenses/LICENSE-2.0
+#       https://www.apache.org/licenses/LICENSE-2.0
 #
 #   Unless required by applicable law or agreed to in writing, software
 #   distributed under the License is distributed on an "AS IS" BASIS,
@@ -73,9 +73,17 @@ Puppet::Type.newtype(:augeas) do
 
   newparam (:onlyif) do
     desc "Optional augeas command and comparisons to control the execution of this type.
+
+      Note: `values` is not an actual augeas API command. It calls `match` to retrieve an array of paths
+             in <MATCH_PATH> and then `get` to retrieve the values from each of the returned paths.
+
       Supported onlyif syntax:
 
       * `get <AUGEAS_PATH> <COMPARATOR> <STRING>`
+      * `values <MATCH_PATH> include <STRING>`
+      * `values <MATCH_PATH> not_include <STRING>`
+      * `values <MATCH_PATH> == <AN_ARRAY>`
+      * `values <MATCH_PATH> != <AN_ARRAY>`
       * `match <MATCH_PATH> size <COMPARATOR> <INT>`
       * `match <MATCH_PATH> include <STRING>`
       * `match <MATCH_PATH> not_include <STRING>`
@@ -109,6 +117,7 @@ Puppet::Type.newtype(:augeas) do
     * `insert <LABEL> <WHERE> <PATH>` --- Synonym for `ins`
     * `mv <PATH> <OTHER PATH>` --- Moves a node at `PATH` to the new location `OTHER PATH`
     * `move <PATH> <OTHER PATH>` --- Synonym for `mv`
+    * `rename <PATH> <LABEL>` --- Rename a node at `PATH` to a new `LABEL`
     * `defvar <NAME> <PATH>` --- Sets Augeas variable `$NAME` to `PATH`
     * `defnode <NAME> <PATH> <VALUE>` --- Sets Augeas variable `$NAME` to `PATH`, creating it with `VALUE` if needed
 

data/lib/puppet/type/cron.rb

@@ -18,29 +18,29 @@ Puppet::Type.newtype(:cron) do
 
     Example:
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
           hour    => 2,
-          minute  => 0
+          minute  => 0,
         }
 
     Note that all periodic attributes can be specified as an array of values:
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
-          hour    => [2, 4]
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
+          hour    => [2, 4],
         }
 
     ...or using ranges or the step syntax `*/2` (although there's no guarantee
     that your `cron` daemon supports these):
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
           hour    => ['2-4'],
-          minute  => '*/10'
+          minute  => '*/10',
         }
 
     An important note: _the Cron type will not reset parameters that are