puppet 4.0.0 → 4.9.1

data/lib/puppet/transaction.rb

@@ -1,5 +1,6 @@
 require 'puppet'
 require 'puppet/util/tagging'
+require 'puppet/util/skip_tags'
 require 'puppet/application'
 require 'digest/sha1'
 require 'set'
@@ -14,6 +15,7 @@ class Puppet::Transaction
   require 'puppet/transaction/event_manager'
   require 'puppet/transaction/resource_harness'
   require 'puppet/resource/status'
+  require 'puppet/transaction/persistence'
 
   attr_accessor :catalog, :ignoreschedules, :for_network_device
 
@@ -28,12 +30,19 @@ class Puppet::Transaction
 
   attr_reader :prefetched_providers
 
+  # @!attribute [r] persistence
+  #   @return [Puppet::Transaction::Persistence] persistence object for cross
+  #      transaction storage.
+  attr_reader :persistence
+
   include Puppet::Util
   include Puppet::Util::Tagging
 
   def initialize(catalog, report, prioritizer)
     @catalog = catalog
 
+    @persistence = Puppet::Transaction::Persistence.new
+
     @report = report || Puppet::Transaction::Report.new("apply", catalog.version, catalog.environment)
 
     @prioritizer = prioritizer
@@ -79,11 +88,13 @@ class Puppet::Transaction
   # necessary events.
   def evaluate(&block)
     block ||= method(:eval_resource)
-    generator = AdditionalResourceGenerator.new(@catalog, relationship_graph, @prioritizer)
+    generator = AdditionalResourceGenerator.new(@catalog, nil, @prioritizer)
     @catalog.vertices.each { |resource| generator.generate_additional_resources(resource) }
 
     perform_pre_run_checks
 
+    persistence.load if catalog.host_config?
+
     Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
 
     continue_while = lambda { !stop_processing? }
@@ -133,8 +144,13 @@ class Puppet::Transaction
           Puppet.log_exception(detail, "post_resource_eval failed for provider #{provider}")
         end
       end
+
+      persistence.save if catalog.host_config?
     end
 
+    # Generate the relationship graph, set up our generator to use it
+    # for eval_generate, then kick off our traversal.
+    generator.relationship_graph = relationship_graph
     relationship_graph.traverse(:while => continue_while,
                                 :pre_process => pre_process,
                                 :overly_deferred_resource_handler => overly_deferred_resource_handler,
@@ -149,6 +165,12 @@ class Puppet::Transaction
       end
     end
 
+    # if one or more resources has attempted and failed to generate resources,
+    # report it
+    if generator.resources_failed_to_generate
+      report.resources_failed_to_generate = true
+    end
+
     Puppet.debug "Finishing transaction #{object_id}"
   end
 
@@ -182,6 +204,10 @@ class Puppet::Transaction
     super
   end
 
+  def skip_tags
+    @skip_tags ||= Puppet::Util::SkipTags.new(Puppet[:skip_tags]).tags
+  end
+
   def prefetch_if_necessary(resource)
     provider_class = resource.provider.class
     return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
@@ -210,6 +236,7 @@ class Puppet::Transaction
 
   # Evaluate a single resource.
   def eval_resource(resource, ancestor = nil)
+    propagate_failure(resource)
     if skip?(resource)
       resource_status(resource).skipped = true
       resource.debug("Resource is being skipped, unscheduling all events")
@@ -227,54 +254,43 @@ class Puppet::Transaction
 
   # Does this resource have any failed dependencies?
   def failed_dependencies?(resource)
-    # First make sure there are no failed dependencies.  To do this,
-    # we check for failures in any of the vertexes above us.  It's not
-    # enough to check the immediate dependencies, which is why we use
-    # a tree from the reversed graph.
-    found_failed = false
-
-
     # When we introduced the :whit into the graph, to reduce the combinatorial
     # explosion of edges, we also ended up reporting failures for containers
     # like class and stage.  This is undesirable; while just skipping the
     # output isn't perfect, it is RC-safe. --daniel 2011-06-07
     suppress_report = (resource.class == Puppet::Type.type(:whit))
 
-    relationship_graph.dependencies(resource).each do |dep|
-      next unless failed?(dep)
-      found_failed = true
-
+    s = resource_status(resource)
+    if s && s.dependency_failed?
       # See above. --daniel 2011-06-06
       unless suppress_report then
-        resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
+        s.failed_dependencies.each do |dep|
+          resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
+        end
       end
     end
 
-    found_failed
+    s && s.dependency_failed?
   end
 
-  # A general method for recursively generating new resources from a
-  # resource.
-  def generate_additional_resources(resource)
-    return unless resource.respond_to?(:generate)
-    begin
-      made = resource.generate
-    rescue => detail
-      resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
-    end
-    return unless made
-    made = [made] unless made.is_a?(Array)
-    made.uniq.each do |res|
-      begin
-        res.tag(*resource.tags)
-        @catalog.add_resource(res)
-        res.finish
-        add_conditional_directed_dependency(resource, res)
-        generate_additional_resources(res)
-      rescue Puppet::Resource::Catalog::DuplicateResourceError
-        res.info "Duplicate generated resource; skipping"
+  # We need to know if a resource has any failed dependencies before
+  # we try to process it. We keep track of this by keeping a list on
+  # each resource of the failed dependencies, and incrementally
+  # computing it as the union of the failed dependencies of each
+  # first-order dependency. We have to do this as-we-go instead of
+  # up-front at failure time because the graph may be mutated as we
+  # walk it.
+  def propagate_failure(resource)
+    failed = Set.new
+    relationship_graph.direct_dependencies_of(resource).each do |dep|
+      if (s = resource_status(dep))
+        failed.merge(s.failed_dependencies) if s.dependency_failed?
+        if s.failed?
+          failed.add(dep)
+        end
       end
     end
+    resource_status(resource).failed_dependencies = failed.to_a
   end
 
   # Should we ignore tags?
@@ -322,7 +338,9 @@ class Puppet::Transaction
 
   # Should this resource be skipped?
   def skip?(resource)
-    if missing_tags?(resource)
+    if skip_tags?(resource)
+      resource.debug "Skipping with skip tags #{skip_tags.join(", ")}"
+    elsif missing_tags?(resource)
       resource.debug "Not tagged with #{tags.join(", ")}"
     elsif ! scheduled?(resource)
       resource.debug "Not scheduled"
@@ -358,6 +376,17 @@ class Puppet::Transaction
     not resource.tagged?(*tags)
   end
 
+  def skip_tags?(resource)
+    return false if ignore_tags?
+    return false if skip_tags.empty?
+
+    resource.tagged?(*skip_tags)
+  end
+
+  def split_qualified_tags?
+    false
+  end
+
   # These two methods are only made public to enable the existing spec tests to run
   # under rspec 3 (apparently rspec 2 didn't enforce access controls?). Please do not
   # treat these as part of a public API.
@@ -368,4 +397,3 @@ class Puppet::Transaction
 end
 
 require 'puppet/transaction/report'
-

data/lib/puppet/type/augeas.rb

@@ -5,7 +5,7 @@
 #   you may not use this file except in compliance with the License.
 #   You may obtain a copy of the License at
 #
-#       http://www.apache.org/licenses/LICENSE-2.0
+#       https://www.apache.org/licenses/LICENSE-2.0
 #
 #   Unless required by applicable law or agreed to in writing, software
 #   distributed under the License is distributed on an "AS IS" BASIS,
@@ -73,9 +73,17 @@ Puppet::Type.newtype(:augeas) do
 
   newparam (:onlyif) do
     desc "Optional augeas command and comparisons to control the execution of this type.
+
+      Note: `values` is not an actual augeas API command. It calls `match` to retrieve an array of paths
+             in <MATCH_PATH> and then `get` to retrieve the values from each of the returned paths.
+
       Supported onlyif syntax:
 
       * `get <AUGEAS_PATH> <COMPARATOR> <STRING>`
+      * `values <MATCH_PATH> include <STRING>`
+      * `values <MATCH_PATH> not_include <STRING>`
+      * `values <MATCH_PATH> == <AN_ARRAY>`
+      * `values <MATCH_PATH> != <AN_ARRAY>`
       * `match <MATCH_PATH> size <COMPARATOR> <INT>`
       * `match <MATCH_PATH> include <STRING>`
       * `match <MATCH_PATH> not_include <STRING>`
@@ -98,7 +106,7 @@ Puppet::Type.newtype(:augeas) do
     desc "The changes which should be applied to the filesystem. This
     can be a command or an array of commands. The following commands are supported:
 
-    * `set <PATH> <VALUE>` --- Sets the value `VALUE` at loction `PATH`
+    * `set <PATH> <VALUE>` --- Sets the value `VALUE` at location `PATH`
     * `setm <PATH> <SUB> <VALUE>` --- Sets multiple nodes (matching `SUB` relative to `PATH`) to `VALUE`
     * `rm <PATH>` --- Removes the node at location `PATH`
     * `remove <PATH>` --- Synonym for `rm`
@@ -109,6 +117,7 @@ Puppet::Type.newtype(:augeas) do
     * `insert <LABEL> <WHERE> <PATH>` --- Synonym for `ins`
     * `mv <PATH> <OTHER PATH>` --- Moves a node at `PATH` to the new location `OTHER PATH`
     * `move <PATH> <OTHER PATH>` --- Synonym for `mv`
+    * `rename <PATH> <LABEL>` --- Rename a node at `PATH` to a new `LABEL`
     * `defvar <NAME> <PATH>` --- Sets Augeas variable `$NAME` to `PATH`
     * `defnode <NAME> <PATH> <VALUE>` --- Sets Augeas variable `$NAME` to `PATH`, creating it with `VALUE` if needed
 
@@ -128,7 +137,7 @@ Puppet::Type.newtype(:augeas) do
 
   newparam(:force) do
     desc "Optional command to force the augeas type to execute even if it thinks changes
-    will not be made. This does not overide the `onlyif` parameter."
+    will not be made. This does not override the `onlyif` parameter."
 
     defaultto false
   end
@@ -183,7 +192,7 @@ Puppet::Type.newtype(:augeas) do
     end
 
     # if the onlyif resource is provided, then the value is parsed.
-    # a return value of 0 will stop exection because it matches the
+    # a return value of 0 will stop execution because it matches the
     # default value.
     def retrieve
       if @resource.provider.need_to_run?()

data/lib/puppet/type/component.rb

@@ -71,6 +71,17 @@ Puppet::Type.newtype(:component) do
     reference.to_s
   end
 
+  # Overrides the default implementation to do nothing.
+  # This type contains data from class/define parameters, but does
+  # not have actual parameters or properties at the Type level. We can
+  # simply ignore anything flagged as sensitive here, since any
+  # contained resources will handle that sensitivity themselves. There
+  # is no risk of this information leaking into reports, since no
+  # Component instances survive the graph transmutation.
+  #
+  def set_sensitive_parameters(sensitive_parameters)
+  end
+
   private
 
   attr_reader :reference

data/lib/puppet/type/cron.rb

@@ -18,29 +18,29 @@ Puppet::Type.newtype(:cron) do
 
     Example:
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
           hour    => 2,
-          minute  => 0
+          minute  => 0,
         }
 
     Note that all periodic attributes can be specified as an array of values:
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
-          hour    => [2, 4]
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
+          hour    => [2, 4],
         }
 
     ...or using ranges or the step syntax `*/2` (although there's no guarantee
     that your `cron` daemon supports these):
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
           hour    => ['2-4'],
-          minute  => '*/10'
+          minute  => '*/10',
         }
 
     An important note: _the Cron type will not reset parameters that are
@@ -446,7 +446,7 @@ Puppet::Type.newtype(:cron) do
   # @api public
   #
   # @note This overrides the Puppet::Type method in order to handle
-  #   an edge case that has so far been observed during testig only.
+  #   an edge case that has so far been observed during testing only.
   #   Without forcing the should-value for the user property to be
   #   identical to the original cron file, purging from a fixture
   #   will not work, because the user property defaults to the user

data/lib/puppet/type/exec.rb

@@ -340,15 +340,15 @@ module Puppet
         other object; it is useful for triggering an action:
 
             # Pull down the main aliases file
-            file { "/etc/aliases":
-              source => "puppet://server/module/aliases"
+            file { '/etc/aliases':
+              source => 'puppet://server/module/aliases',
             }
 
             # Rebuild the database, but only when the file changes
             exec { newaliases:
-              path        => ["/usr/bin", "/usr/sbin"],
-              subscribe   => File["/etc/aliases"],
-              refreshonly => true
+              path        => ['/usr/bin', '/usr/sbin'],
+              subscribe   => File['/etc/aliases'],
+              refreshonly => true,
             }
 
         Note that only `subscribe` and `notify` can trigger actions, not `require`,
@@ -377,10 +377,10 @@ module Puppet
         This parameter doesn't cause Puppet to create a file; it is only
         useful if **the command itself** creates a file.
 
-            exec { "tar -xf /Volumes/nfs02/important.tar":
-              cwd     => "/var/tmp",
-              creates => "/var/tmp/myfile",
-              path    => ["/usr/bin", "/usr/sbin"]
+            exec { 'tar -xf /Volumes/nfs02/important.tar':
+              cwd     => '/var/tmp',
+              creates => '/var/tmp/myfile',
+              path    => ['/usr/bin', '/usr/sbin',],
             }
 
         In this example, `myfile` is assumed to be a file inside
@@ -404,18 +404,25 @@ module Puppet
         If this parameter is set, then this `exec` will run unless
         the command has an exit code of 0.  For example:
 
-            exec { "/bin/echo root >> /usr/lib/cron/cron.allow":
-              path   => "/usr/bin:/usr/sbin:/bin",
-              unless => "grep root /usr/lib/cron/cron.allow 2>/dev/null"
+            exec { '/bin/echo root >> /usr/lib/cron/cron.allow':
+              path   => '/usr/bin:/usr/sbin:/bin',
+              unless => 'grep root /usr/lib/cron/cron.allow 2>/dev/null',
             }
 
         This would add `root` to the cron.allow file (on Solaris) unless
         `grep` determines it's already there.
 
         Note that this command follows the same rules as the main command,
-        which is to say that it must be fully qualified if the path is not set.
+        such as which user and group it's run as.
+        This also means it must be fully qualified if the path is not set.
         It also uses the same provider as the main command, so any behavior
         that differs by provider will match.
+
+        Also note that unless can take an array as its value, e.g.:
+
+            unless => ['test -f /tmp/file1', 'test -f /tmp/file2'],
+
+        This will only run the exec if _all_ conditions in the array return false.
       EOT
 
       validate do |cmds|
@@ -448,21 +455,23 @@ module Puppet
         If this parameter is set, then this `exec` will only run if
         the command has an exit code of 0.  For example:
 
-            exec { "logrotate":
-              path   => "/usr/bin:/usr/sbin:/bin",
-              onlyif => "test `du /var/log/messages | cut -f1` -gt 100000"
+            exec { 'logrotate':
+              path   => '/usr/bin:/usr/sbin:/bin',
+              onlyif => 'test `du /var/log/messages | cut -f1` -gt 100000',
             }
 
         This would run `logrotate` only if that test returned true.
 
         Note that this command follows the same rules as the main command,
-        which is to say that it must be fully qualified if the path is not set.
+        such as which user and group it's run as.
+        This also means it must be fully qualified if the path is not set.
+
         It also uses the same provider as the main command, so any behavior
         that differs by provider will match.
 
         Also note that onlyif can take an array as its value, e.g.:
 
-            onlyif => ["test -f /tmp/file1", "test -f /tmp/file2"]
+            onlyif => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
         This will only run the exec if _all_ conditions in the array return true.
       EOT

data/lib/puppet/type/file/checksum.rb

@@ -16,6 +16,7 @@ Puppet::Type.type(:file).newparam(:checksum) do
   end
 
   def sum(content)
+    content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
     type = digest_algorithm()
     "{#{type}}" + send(type, content)
   end

data/lib/puppet/type/file/checksum_value.rb

@@ -0,0 +1,53 @@
+require 'puppet/util/checksums'
+require 'puppet/type/file/data_sync'
+
+module Puppet
+  Puppet::Type.type(:file).newproperty(:checksum_value) do
+    include Puppet::Util::Checksums
+    include Puppet::DataSync
+
+    desc "The checksum of the source contents. Only md5 and sha256 are supported when
+      specifying this parameter. If this parameter is set, source_permissions will be
+      assumed to be false, and ownership and permissions will not be read from source."
+
+    def insync?(is)
+      # If checksum_value and source are specified, manage the file contents.
+      # Otherwise the content property will manage syncing.
+      if resource.parameter(:source).nil?
+        return true
+      end
+
+      checksum_insync?(resource.parameter(:source), is, true) {|_is| super(_is)}
+    end
+
+    def property_matches?(current, desired)
+      return true if super(current, desired)
+      return date_matches?(resource.parameter(:checksum).value, current, desired)
+    end
+
+    def retrieve
+      # If checksum_value and source are specified, manage the file contents.
+      # Otherwise the content property will manage syncing. Don't compute the checksum twice.
+      if resource.parameter(:source).nil?
+        return nil
+      end
+
+      result = retrieve_checksum(resource)
+      # If the returned type matches the util/checksums format (prefixed with the type),
+      # strip the checksum type.
+      result = sumdata(result) if checksum?(result)
+      result
+    end
+
+    def sync
+      if resource.parameter(:source).nil?
+        devfail "checksum_value#sync should not be called without a source parameter"
+      end
+
+      # insync? only returns false if it expects to manage the file content,
+      # so instruct the resource to write its contents.
+      contents_sync(resource.parameter(:source))
+    end
+
+  end
+end