puppet 4.0.0 → 4.9.1

data/lib/puppet/type/scheduled_task.rb

@@ -102,6 +102,9 @@ Puppet::Type.newtype(:scheduled_task) do
           * `start_date` ---  The date when the trigger should first become active.
             Defaults to the current date. You should format dates as YYYY-MM-DD,
             although other date formats may work. (Under the hood, this uses `Date.parse`.)
+          * `minutes_interval` --- The repeat interval in minutes.
+          * `minutes_duration` --- The duration in minutes, needs to be greater than the
+            minutes_interval.
       * For `daily` triggers:
           * `every` --- How often the task should run, as a number of days. Defaults
             to 1. ("2" means every other day, "3" means every three days, etc.)
@@ -115,7 +118,7 @@ Puppet::Type.newtype(:scheduled_task) do
           * `months` --- Which months the task should run, as an array. Defaults to
             all months. Each month must be an integer between 1 and 12.
           * `on` **(Required)** --- Which days of the month the task should run,
-            as an array. Each day must beeither an integer between 1 and 31,
+            as an array. Each day must be either an integer between 1 and 31,
             or the special value `last,` which is always the last day of the month.
       * For `monthly` (by weekday) triggers:
           * `months` --- Which months the task should run, as an array. Defaults to
@@ -127,6 +130,7 @@ Puppet::Type.newtype(:scheduled_task) do
             when the task should run. Must be one of `first`, `second`, `third`,
             `fourth`, `fifth`, or `last`.
 
+
       Examples:
 
           # Run at 8am on the 1st, 15th, and last day of the month in January, March,
@@ -150,6 +154,15 @@ Puppet::Type.newtype(:scheduled_task) do
             day_of_week      => [mon],        # Must be specified
           }
 
+          # Run daily repeating every 30 minutes between 9am and 5pm (480 minutes) starting after August 31st, 2011.
+          trigger => {
+            schedule         => daily,
+            start_date       => '2011-08-31', # Defaults to current date
+            start_time       => '8:00',       # Must be specified
+            minutes_interval => 30,
+            minutes_duration => 480,
+          }
+
     EOT
 
     validate do |value|

data/lib/puppet/type/service.rb

@@ -42,6 +42,9 @@ module Puppet
 
     feature :flaggable, "The provider can pass flags to the service."
 
+    feature :maskable, "The provider can 'mask' the service.",
+      :methods => [:mask]
+
     newproperty(:enable, :required_features => :enableable) do
       desc "Whether a service should be enabled to start at boot.
         This property behaves quite differently depending on the platform;
@@ -60,10 +63,27 @@ module Puppet
         provider.manual_start
       end
 
+      # This only makes sense on systemd systems. Otherwise, it just defaults
+      # to disable.
+      newvalue(:mask, :event => :service_disabled, :required_features => :maskable) do
+        provider.mask
+      end
+
       def retrieve
         provider.enabled?
       end
 
+      # This only makes sense on systemd systems. Static services cannot be enabled
+      # or disabled manually.
+      def insync?(current)
+        if provider.respond_to?(:cached_enabled?) && provider.cached_enabled? == 'static'
+          Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
+          return true
+        end
+
+        super(current)
+      end
+
       validate do |value|
         if value == :manual and !Puppet.features.microsoft_windows?
           raise Puppet::Error.new("Setting enable to manual is only supported on Microsoft Windows.")
@@ -230,5 +250,9 @@ module Puppet
         debug "Skipping restart; service is not running"
       end
     end
+
+    def self.needs_ensure_retrieved
+      false
+    end
   end
 end

data/lib/puppet/type/ssh_authorized_key.rb

@@ -2,18 +2,20 @@ module Puppet
   Type.newtype(:ssh_authorized_key) do
     @doc = "Manages SSH authorized keys. Currently only type 2 keys are supported.
 
-      In their native habitat, SSH keys usually appear as a single long line. This
-      resource type requires you to split that line into several attributes. Thus, a
-      key that appears in your `~/.ssh/id_rsa.pub` file like this...
+      In their native habitat, SSH keys usually appear as a single long line, in
+      the format `<TYPE> <KEY> <NAME/COMMENT>`. This resource type requires you
+      to split that line into several attributes. Thus, a key that appears in
+      your `~/.ssh/id_rsa.pub` file like this...
 
-          ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAy5mtOAMHwA2ZAIfW6Ap70r+I4EclYHEec5xIN59ROUjss23Skb1OtjzYpVPaPH8mSdSmsN0JHaBLiRcu7stl4O8D8zA4mz/vw32yyQ/Kqaxw8l0K76k6t2hKOGqLTY4aFbFISV6GDh7MYLn8KU7cGp96J+caO5R5TqtsStytsUhSyqH+iIDh4e4+BrwTc6V4Y0hgFxaZV5d18mLA4EPYKeG5+zyBCVu+jueYwFqM55E0tHbfiaIN9IzdLV+7NEEfdLkp6w2baLKPqWUBmuvPF1Mn3FwaFLjVsMT3GQeMue6b3FtUdTDeyAYoTxrsRo/WnDkS6Pa3YhrFwjtUqXfdaQ== nick@magpie.puppetlabs.lan
+          ssh-rsa AAAAB3Nza[...]qXfdaQ== nick@magpie.example.com
 
       ...would translate to the following resource:
 
-          ssh_authorized_key { 'nick@magpie.puppetlabs.lan':
-            user => 'nick',
-            type => 'ssh-rsa',
-            key  => 'AAAAB3NzaC1yc2EAAAABIwAAAQEAy5mtOAMHwA2ZAIfW6Ap70r+I4EclYHEec5xIN59ROUjss23Skb1OtjzYpVPaPH8mSdSmsN0JHaBLiRcu7stl4O8D8zA4mz/vw32yyQ/Kqaxw8l0K76k6t2hKOGqLTY4aFbFISV6GDh7MYLn8KU7cGp96J+caO5R5TqtsStytsUhSyqH+iIDh4e4+BrwTc6V4Y0hgFxaZV5d18mLA4EPYKeG5+zyBCVu+jueYwFqM55E0tHbfiaIN9IzdLV+7NEEfdLkp6w2baLKPqWUBmuvPF1Mn3FwaFLjVsMT3GQeMue6b3FtUdTDeyAYoTxrsRo/WnDkS6Pa3YhrFwjtUqXfdaQ==',
+          ssh_authorized_key { 'nick@magpie.example.com':
+            ensure => present,
+            user   => 'nick',
+            type   => 'ssh-rsa',
+            key    => 'AAAAB3Nza[...]qXfdaQ==',
           }
 
       To ensure that only the currently approved keys are present, you can purge
@@ -36,8 +38,12 @@ module Puppet
     ensurable
 
     newparam(:name) do
-      desc "The SSH key comment. This attribute is currently used as a
-        system-wide primary key and therefore has to be unique."
+      desc "The SSH key comment. This can be anything, and doesn't need to match
+        the original comment from the `.pub` file.
+
+        Due to internal limitations, this must be unique across all user accounts;
+        if you want to specify one key for multiple users, you must use a different
+        comment for each instance."
 
       isnamevar
 
@@ -145,7 +151,7 @@ module Puppet
     end
 
     # regular expression suitable for use by a ParsedFile based provider
-    REGEX = /^(?:(.+) )?(ssh-dss|ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521) ([^ ]+) ?(.*)$/
+    REGEX = /^(?:(.+)\s+)?(ssh-dss|ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521)\s+([^ ]+)\s*(.*)$/
     def self.keyline_regex
       REGEX
     end

data/lib/puppet/type/sshkey.rb

@@ -1,8 +1,10 @@
 module Puppet
   Type.newtype(:sshkey) do
-    @doc = "Installs and manages ssh host keys.  At this point, this type
-      only knows how to install keys into `/etc/ssh/ssh_known_hosts`.  See
-      the `ssh_authorized_key` type to manage authorized keys."
+    @doc = "Installs and manages ssh host keys.  By default, this type will
+      install keys into `/etc/ssh/ssh_known_hosts`. To manage ssh keys in a
+      different `known_hosts` file, such as a user's personal `known_hosts`,
+      pass its path to the `target` parameter. See the `ssh_authorized_key`
+      type to manage authorized keys."
 
     ensurable
 

data/lib/puppet/type/stage.rb

@@ -2,7 +2,7 @@ Puppet::Type.newtype(:stage) do
   desc "A resource type for creating new run stages.  Once a stage is available,
     classes can be assigned to it by declaring them with the resource-like syntax
     and using
-    [the `stage` metaparameter](http://docs.puppetlabs.com/references/latest/metaparameter.html#stage).
+    [the `stage` metaparameter](https://docs.puppetlabs.com/puppet/latest/reference/metaparameter.html#stage).
 
     Note that new stages are not useful unless you also declare their order
     in relation to the default `main` stage.

data/lib/puppet/type/tidy.rb

@@ -16,6 +16,9 @@ Puppet::Type.newtype(:tidy) do
     actual deletion.
     "
 
+  # Tidy names are not isomorphic with the objects.
+  @isomorphic = false
+
   newparam(:path) do
     desc "The path to the file or directory to manage.  Must be fully
       qualified."
@@ -56,10 +59,10 @@ Puppet::Type.newtype(:tidy) do
 
       Example:
 
-          tidy { "/tmp":
-            age     => "1w",
+          tidy { '/tmp':
+            age     => '1w',
             recurse => 1,
-            matches => [ "[0-9]pub*.tmp", "*.temp", "tmpfile?" ]
+            matches => [ '[0-9]pub*.tmp', '*.temp', 'tmpfile?' ],
           }
 
       This removes files from `/tmp` if they are one week old or older,
@@ -73,7 +76,7 @@ Puppet::Type.newtype(:tidy) do
       Finally, note that you must now specify a non-zero/non-false value
       for recurse if matches is used, as matches only apply to files found
       by recursion (there's no reason to use static patterns match against
-      a statically determined path).  Requiering explicit recursion clears
+      a statically determined path).  Requiring explicit recursion clears
       up a common source of confusion.
     EOT
 
@@ -253,7 +256,9 @@ Puppet::Type.newtype(:tidy) do
     else
       files = [self[:path]]
     end
-    result = files.find_all { |path| tidy?(path) }.collect { |path| mkfile(path) }.each { |file| notice "Tidying #{file.ref}" }.sort { |a,b| b[:path] <=> a[:path] }
+    found_files = files.find_all { |path| tidy?(path) }.collect { |path| mkfile(path) }
+    result = found_files.each { |file| debug "Tidying #{file.ref}" }.sort { |a,b| b[:path] <=> a[:path] }
+    notice "Tidying #{found_files.size} files"
 
     # No need to worry about relationships if we don't have rmdirs; there won't be
     # any directories.

data/lib/puppet/type/user.rb

@@ -16,9 +16,10 @@ module Puppet
       about them.  It does not directly modify `/etc/passwd` or anything.
 
       **Autorequires:** If Puppet is managing the user's primary group (as
-      provided in the `gid` attribute), the user resource will autorequire
-      that group. If Puppet is managing any role accounts corresponding to the
-      user's roles, the user resource will autorequire those role accounts."
+      provided in the `gid` attribute) or any group listed in the `groups`
+      attribute then the user resource will autorequire that group. If Puppet
+      is managing any role accounts corresponding to the user's roles, the
+      user resource will autorequire those role accounts."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
@@ -170,8 +171,23 @@ module Puppet
 
     newproperty(:comment) do
       desc "A description of the user.  Generally the user's full name."
-      munge do |v|
-        v.respond_to?(:force_encoding) ? v.force_encoding(Encoding::ASCII_8BIT) : v
+      def insync?(is)
+        # nameservice provider requires special attention to encoding
+        # Overrides Puppet::Property#insync?
+        if !@should.empty? && provider.respond_to?(:comments_insync?)
+          return provider.comments_insync?(is, @should)
+        end
+        super(is)
+      end
+
+      # In the case that our comments have incompatible encodings, set external
+      # encoding to support concatenation for display.
+      # overrides Puppet::Property#change_to_s
+      def change_to_s(currentvalue, newvalue)
+        if newvalue.respond_to?(:force_encoding) && !Encoding.compatible?(currentvalue, newvalue)
+          return super(currentvalue, newvalue.dup.force_encoding(currentvalue.encoding))
+        end
+        super(currentvalue, newvalue)
       end
     end
 
@@ -183,25 +199,26 @@ module Puppet
     end
 
     newproperty(:password, :required_features => :manages_passwords) do
-      desc %q{The user's password, in whatever encrypted format the local
-        system requires.
-
-        * Most modern Unix-like systems use salted SHA1 password hashes. You can use
-          Puppet's built-in `sha1` function to generate a hash from a password.
-        * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
-        * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs [stdlib][]
-          module contains a `str2saltedsha512` function which can generate password
-          hashes for Lion.
-        * Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When
-          managing passwords on these systems the salt and iterations properties
-          need to be specified as well as the password.
+      desc %q{The user's password, in whatever encrypted format the local system
+        requires. Consult your operating system's documentation for acceptable password
+        encryption formats and requirements.
+
+        * Mac OS X 10.5 and 10.6, and some older Linux distributions, use salted SHA1
+          hashes. You can use Puppet's built-in `sha1` function to generate a salted SHA1
+          hash from a password.
+        * Mac OS X 10.7 (Lion), and many recent Linux distributions, use salted SHA512
+          hashes. The Puppet Labs [stdlib][] module contains a `str2saltedsha512` function
+          which can generate password hashes for these operating systems.
+        * OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When managing passwords
+          on these systems, the `salt` and `iterations` attributes need to be specified as
+          well as the password.
         * Windows passwords can only be managed in cleartext, as there is no Windows API
           for setting the password hash.
 
         [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
 
-        Be sure to enclose any value that includes a dollar sign ($) in single
-        quotes (') to avoid accidental variable interpolation.}
+        Enclose any value that includes a dollar sign ($) in single quotes (') to avoid
+        accidental variable interpolation.}
 
       validate do |value|
         raise ArgumentError, "Passwords cannot include ':'" if value.is_a?(String) and value.include?(":")
@@ -274,6 +291,38 @@ module Puppet
         raise ArgumentError, "Group names must be provided as an array, not a comma-separated list." if value.include?(",")
         raise ArgumentError, "Group names must not be empty. If you want to specify \"no groups\" pass an empty array" if value.empty?
       end
+
+      def change_to_s(currentvalue, newvalue)
+        newvalue = newvalue.split(",") if newvalue != :absent
+
+        if provider.respond_to?(:groups_to_s)
+          # for Windows ADSI
+          # de-dupe the "newvalue" when the sync event message is generated,
+          # due to final retrieve called after the resource has been modified
+          newvalue = provider.groups_to_s(newvalue).split(',').uniq
+        end
+
+        super(currentvalue, newvalue)
+      end
+
+      # override Puppet::Property::List#retrieve
+      def retrieve
+        if provider.respond_to?(:groups_to_s)
+          # Windows ADSI groups returns SIDs, but retrieve needs names
+          # must return qualified names for SIDs for "is" value and puppet resource
+          return provider.groups_to_s(provider.groups).split(',')
+        end
+
+        super
+      end
+
+      def insync?(current)
+        if provider.respond_to?(:groups_insync?)
+          return provider.groups_insync?(current, @should)
+        end
+
+        super(current)
+      end
     end
 
     newparam(:name) do
@@ -288,9 +337,14 @@ module Puppet
     end
 
     newparam(:membership) do
-      desc "Whether specified groups should be considered the **complete list**
-        (`inclusive`) or the **minimum list** (`minimum`) of groups to which
-        the user belongs. Defaults to `minimum`."
+      desc "If `minimum` is specified, Puppet will ensure that the user is a
+        member of all specified groups, but will not remove any other groups
+        that the user is a part of.
+
+        If `inclusive` is specified, Puppet will ensure that the user is a
+        member of **only** specified groups.
+
+        Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
@@ -550,14 +604,15 @@ module Puppet
     end
 
     newproperty(:salt, :required_features => :manages_password_salt) do
-      desc "This is the 32 byte salt used to generate the PBKDF2 password used in
+      desc "This is the 32-byte salt used to generate the PBKDF2 password used in
             OS X. This field is required for managing passwords on OS X >= 10.8."
     end
 
     newproperty(:iterations, :required_features => :manages_password_salt) do
       desc "This is the number of iterations of a chained computation of the
-            password hash (http://en.wikipedia.org/wiki/PBKDF2).  This parameter
-            is used in OS X. This field is required for managing passwords on OS X >= 10.8."
+            [PBKDF2 password hash](https://en.wikipedia.org/wiki/PBKDF2). This parameter
+            is used in OS X, and is required for managing passwords on OS X 10.8 and
+            newer."
 
       munge do |value|
         if value.is_a?(String) and value =~/^[-0-9]+$/

data/lib/puppet/type/yumrepo.rb

@@ -11,15 +11,25 @@ Puppet::Type.newtype(:yumrepo) do
 
     Continuation lines that yum supports (for the `baseurl`, for example)
     are not supported. This type does not attempt to read or verify the
-    exinstence of files listed in the `include` attribute."
+    existence of files listed in the `include` attribute."
 
   # Ensure yumrepos can be removed too.
   ensurable
   # Doc string for properties that can be made 'absent'
   ABSENT_DOC="Set this to `absent` to remove it from the file completely."
   # False can be false/0/no and True can be true/1/yes in yum.
-  YUM_BOOLEAN=/^(True|False|0|1|No|Yes)$/i
-  YUM_BOOLEAN_DOC="Valid values are: False/0/No or True/1/Yes."
+  YUM_BOOLEAN=/^(true|false|0|1|no|yes)$/
+  YUM_BOOLEAN_DOC="Valid values are: false/0/no or true/1/yes."
+
+  # Common munge logic for YUM_BOOLEAN values. Munges for two requirements:
+  # 1) Because of how regex validation works in Puppet::Parameter::Value,
+  # Boolean false and lowercase false will not be considered invalid. However,
+  # if the user specified false (or true), they meant False (or True).
+  # 2) In order for parameter removal to work correctly, when absent is passed
+  # as a string it needs to be munged back to a symbol.
+  munge_yum_bool = Proc.new do |val|
+    val.to_s == 'absent' ? :absent : val.to_s.capitalize
+  end
 
   VALID_SCHEMES = %w[file http https ftp]
 
@@ -81,6 +91,7 @@ Puppet::Type.newtype(:yumrepo) do
     #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:gpgcheck) do
@@ -90,6 +101,7 @@ Puppet::Type.newtype(:yumrepo) do
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:repo_gpgcheck) do
@@ -98,6 +110,7 @@ Puppet::Type.newtype(:yumrepo) do
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:gpgkey) do
@@ -167,7 +180,7 @@ Puppet::Type.newtype(:yumrepo) do
   newproperty(:includepkgs) do
     desc "List of shell globs. If this is set, only packages
       matching one of the globs will be considered for
-      update or install from this repo. #{ABSENT_DOC}"
+      update or install from this repository. #{ABSENT_DOC}"
 
     newvalues(/.*/, :absent)
   end
@@ -179,6 +192,7 @@ Puppet::Type.newtype(:yumrepo) do
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:failovermethod) do
@@ -194,6 +208,7 @@ Puppet::Type.newtype(:yumrepo) do
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:retries) do
@@ -231,6 +246,7 @@ Puppet::Type.newtype(:yumrepo) do
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:priority) do
@@ -302,11 +318,12 @@ Puppet::Type.newtype(:yumrepo) do
   end
 
   newproperty(:s3_enabled) do
-    desc "Access the repo via S3.
+    desc "Access the repository via S3.
       #{YUM_BOOLEAN_DOC}
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:sslcacert) do
@@ -323,18 +340,19 @@ Puppet::Type.newtype(:yumrepo) do
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:sslclientcert) do
     desc "Path  to the SSL client certificate yum should use to connect
-      to repos/remote sites. #{ABSENT_DOC}"
+      to repositories/remote sites. #{ABSENT_DOC}"
 
     newvalues(/.*/, :absent)
   end
 
   newproperty(:sslclientkey) do
     desc "Path to the SSL client key yum should use to connect
-      to repos/remote sites. #{ABSENT_DOC}"
+      to repositories/remote sites. #{ABSENT_DOC}"
 
     newvalues(/.*/, :absent)
   end
@@ -359,6 +377,7 @@ Puppet::Type.newtype(:yumrepo) do
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:assumeyes) do
@@ -367,10 +386,11 @@ Puppet::Type.newtype(:yumrepo) do
       #{ABSENT_DOC}"
 
     newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
   end
 
   newproperty(:deltarpm_percentage) do
-    desc "Percentage value that determines when to use deltas for this repo.
+    desc "Percentage value that determines when to use deltas for this repository.
       When the delta is larger than this percentage value of the package, the
       delta is not used.
       #{ABSENT_DOC}"

data/lib/puppet/type/zone.rb

@@ -282,11 +282,11 @@ end
 
       And then call that:
 
-          zone { myzone:
-            ip           => "bge0:192.168.0.23",
-            sysidcfg     => template("site/sysidcfg.erb"),
-            path         => "/opt/zones/myzone",
-            realhostname => "fully.qualified.domain.name"
+          zone { 'myzone':
+            ip           => 'bge0:192.168.0.23',
+            sysidcfg     => template('site/sysidcfg.erb'),
+            path         => '/opt/zones/myzone',
+            realhostname => 'fully.qualified.domain.name',
           }
 
       The `sysidcfg` only matters on the first booting of the zone,
@@ -343,7 +343,7 @@ end
 
   validate do
     return unless self[:ip]
-    # self[:ip] reflects the type passed from proeprty:ip.should. If we
+    # self[:ip] reflects the type passed from property:ip.should. If we
     # override it and pass @should, then we get an array here back.
     self[:ip].each do |ip|
       interface, address, router = ip.split(':')