puppet 4.0.0 → 5.0.0

data/lib/puppet/transaction/resource_harness.rb

@@ -10,6 +10,7 @@ class Puppet::Transaction::ResourceHarness
 
   def initialize(transaction)
     @transaction = transaction
+    @persistence = transaction.persistence
   end
 
   def evaluate(resource)
@@ -46,12 +47,12 @@ class Puppet::Transaction::ResourceHarness
 
   def schedule(resource)
     unless resource.catalog
-      resource.warning "Cannot schedule without a schedule-containing catalog"
+      resource.warning _("Cannot schedule without a schedule-containing catalog")
       return nil
     end
 
     return nil unless name = resource[:schedule]
-    resource.catalog.resource(:schedule, name) || resource.fail("Could not find schedule #{name}")
+    resource.catalog.resource(:schedule, name) || resource.fail(_("Could not find schedule %{name}") % { name: name })
   end
 
   # Used mostly for scheduling and auditing at this point.
@@ -69,8 +70,6 @@ class Puppet::Transaction::ResourceHarness
   def perform_changes(resource, context)
     cache(resource, :checked, Time.now)
 
-    return [] if ! allow_changes?(resource)
-
     # Record the current state in state.yml.
     context.audited_params.each do |param|
       cache(resource, param, context.current_values[param])
@@ -94,25 +93,26 @@ class Puppet::Transaction::ResourceHarness
     end
 
     capture_audit_events(resource, context)
+    persist_system_values(resource, context)
   end
 
-  def allow_changes?(resource)
-    if resource.purging? and resource.deleting? and deps = relationship_graph.dependents(resource) \
-            and ! deps.empty? and deps.detect { |d| ! d.deleting? }
-      deplabel = deps.collect { |r| r.ref }.join(",")
-      plurality = deps.length > 1 ? "":"s"
-      resource.warning "#{deplabel} still depend#{plurality} on me -- not purging"
-      false
-    else
-      true
+  # We persist the last known values for the properties of a resource after resource
+  # application.
+  # @param [Puppet::Type] resource resource whose values we are to persist.
+  # @param [ResourceApplicationContent] context the application context to operate on.
+  def persist_system_values(resource, context)
+    param_to_event = {}
+    context.status.events.each do |ev|
+      param_to_event[ev.property] = ev
     end
-  end
 
-  # allow_changes? is only made public to enable the existing spec tests to run
-  # under rspec 3 (apparently rspec 2 didn't enforce access controls?). Please do not
-  # treat this as part of a public API.
-  # Possible future improvement: rewrite to not require access to private methods.
-  public :allow_changes?
+    context.system_value_params.each do |pname, param|
+      @persistence.set_system_value(resource.ref, pname.to_s,
+                                    new_system_value(param,
+                                                     param_to_event[pname.to_s],
+                                                     @persistence.get_system_value(resource.ref, pname.to_s)))
+    end
+  end
 
   def sync_if_needed(param, context)
     historical_value = context.historical_values[param.name]
@@ -123,7 +123,7 @@ class Puppet::Transaction::ResourceHarness
       if param.should && !param.safe_insync?(current_value)
         event = create_change_event(param, current_value, historical_value)
         if do_audit
-          event = audit_event(event, param)
+          event = audit_event(event, param, context)
         end
 
         brief_audit_message = audit_message(param, do_audit, historical_value, current_value)
@@ -144,16 +144,21 @@ class Puppet::Transaction::ResourceHarness
 
       event = create_change_event(param, current_value, historical_value)
       event.status = "failure"
-      event.message = "change from #{param.is_to_s(current_value)} to #{param.should_to_s(param.should)} failed: #{detail}"
+      event.message = param.format(_("change from %s to %s failed: "),
+                                   param.is_to_s(current_value),
+                                   param.should_to_s(param.should)) + detail.to_s
       event
     rescue Exception => detail
       # Execution will halt on Exceptions, they get raised to the application
       event = create_change_event(param, current_value, historical_value)
       event.status = "failure"
-      event.message = "change from #{param.is_to_s(current_value)} to #{param.should_to_s(param.should)} failed: #{detail}"
+      event.message = param.format(_("change from %s to %s failed: "),
+                                   param.is_to_s(current_value),
+                                   param.should_to_s(param.should)) + detail.to_s
       raise
     ensure
       if event
+        event.calculate_corrective_change(@persistence.get_system_value(context.resource.ref, param.name.to_s))
         context.record(event)
         event.send_log
         context.synced_params << param.name
@@ -162,12 +167,20 @@ class Puppet::Transaction::ResourceHarness
   end
 
   def create_change_event(property, current_value, historical_value)
-    event = property.event
-    event.previous_value = current_value
-    event.desired_value = property.should
-    event.historical_value = historical_value
+    options = {}
+    should = property.should
 
-    event
+    if property.sensitive
+      options[:previous_value] = current_value.nil? ? nil : '[redacted]'
+      options[:desired_value] = should.nil? ? nil : '[redacted]'
+      options[:historical_value] = historical_value.nil? ? nil : '[redacted]'
+    else
+      options[:previous_value] = current_value
+      options[:desired_value] = should
+      options[:historical_value] = historical_value
+    end
+
+    property.event(options)
   end
 
   # This method is an ugly hack because, given a Time object with nanosecond
@@ -182,11 +195,23 @@ class Puppet::Transaction::ResourceHarness
   end
   private :are_audited_values_equal
 
-  def audit_event(event, property)
+  # Populate an existing event with audit information.
+  #
+  # @param event [Puppet::Transaction::Event] The event to be populated.
+  # @param property [Puppet::Property] The property being audited.
+  # @param context [ResourceApplicationContext]
+  #
+  # @return [Puppet::Transaction::Event] The given event, populated with the audit information.
+  def audit_event(event, property, context)
     event.audited = true
     event.status = "audit"
-    if !are_audited_values_equal(event.historical_value, event.previous_value)
-      event.message = "audit change: previously recorded value #{property.is_to_s(event.historical_value)} has been changed to #{property.is_to_s(event.previous_value)}"
+
+    # The event we've been provided might have been redacted so we need to use the state stored within
+    # the resource application context to see if an event was actually generated.
+    if !are_audited_values_equal(context.historical_values[property.name], context.current_values[property.name])
+      event.message = property.format(_("audit change: previously recorded value %s has been changed to %s"),
+                 property.is_to_s(event.historical_value),
+                 property.is_to_s(event.previous_value))
     end
 
     event
@@ -194,20 +219,28 @@ class Puppet::Transaction::ResourceHarness
 
   def audit_message(param, do_audit, historical_value, current_value)
     if do_audit && historical_value && !are_audited_values_equal(historical_value, current_value)
-      " (previously recorded value was #{param.is_to_s(historical_value)})"
+      param.format(_(" (previously recorded value was %s)"), param.is_to_s(historical_value))
     else
       ""
     end
   end
 
   def noop(event, param, current_value, audit_message)
-    event.message = "current_value #{param.is_to_s(current_value)}, should be #{param.should_to_s(param.should)} (noop)#{audit_message}"
+    event.message = param.format(_("current_value %s, should be %s (noop)"),
+                                 param.is_to_s(current_value),
+                                 param.should_to_s(param.should)) + audit_message.to_s
     event.status = "noop"
   end
 
   def sync(event, param, current_value, audit_message)
     param.sync
-    event.message = "#{param.change_to_s(current_value, param.should)}#{audit_message}"
+    if param.sensitive
+      event.message = param.format(_("changed %s to %s"),
+                                   param.is_to_s(current_value),
+                                   param.should_to_s(param.should)) + audit_message.to_s
+    else
+      event.message = "#{param.change_to_s(current_value, param.should)}#{audit_message}"
+    end
     event.status = "success"
   end
 
@@ -219,30 +252,59 @@ class Puppet::Transaction::ResourceHarness
           event = audit_event(create_change_event(parameter,
                                                   context.current_values[param_name],
                                                   context.historical_values[param_name]),
-                              parameter)
+                              parameter, context)
           event.send_log
           context.record(event)
         end
       else
-        resource.property(param_name).notice "audit change: newly-recorded value #{context.current_values[param_name]}"
+        property = resource.property(param_name)
+        property.notice(property.format(_("audit change: newly-recorded value %s"), context.current_values[param_name]))
       end
     end
   end
 
+  # Given an event and its property, calculate the system_value to persist
+  # for future calculations.
+  # @param [Puppet::Transaction::Event] event event to use for processing
+  # @param [Puppet::Property] property correlating property
+  # @param [Object] old_system_value system_value from last transaction
+  # @return [Object] system_value to be used for next transaction
+  def new_system_value(property, event, old_system_value)
+    if event && event.status != "success"
+      # For non-success events, we persist the old_system_value if it is defined,
+      # or use the event previous_value.
+      # If we're using the event previous_value, we ensure that it's
+      # an array. This is needed because properties assume that their
+      # `should` value is an array, and we will use this value later
+      # on in property insync? logic.
+      event_value = [event.previous_value] unless event.previous_value.is_a?(Array)
+      old_system_value.nil? ? event_value : old_system_value
+    else
+      # For non events, or for success cases, we just want to store
+      # the parameters agent value.
+      # We use instance_variable_get here because we want this process to bypass any
+      # munging/unmunging or validation that the property might try to do, since those
+      # operations may not be correctly implemented for custom types.
+      property.instance_variable_get(:@should)
+    end
+  end
+
   # @api private
   ResourceApplicationContext = Struct.new(:resource,
                                           :current_values,
                                           :historical_values,
                                           :audited_params,
                                           :synced_params,
-                                          :status) do
+                                          :status,
+                                          :system_value_params) do
     def self.from_resource(resource, status)
       ResourceApplicationContext.new(resource,
                                      resource.retrieve_resource.to_hash,
                                      Puppet::Util::Storage.cache(resource).dup,
                                      (resource[:audit] || []).map { |p| p.to_sym },
                                      [],
-                                     status)
+                                     status,
+                                     resource.parameters.select { |n,p| p.is_a?(Puppet::Property) && !p.sensitive })
     end
 
     def resource_present?

data/lib/puppet/transaction.rb

@@ -1,5 +1,6 @@
 require 'puppet'
 require 'puppet/util/tagging'
+require 'puppet/util/skip_tags'
 require 'puppet/application'
 require 'digest/sha1'
 require 'set'
@@ -14,6 +15,7 @@ class Puppet::Transaction
   require 'puppet/transaction/event_manager'
   require 'puppet/transaction/resource_harness'
   require 'puppet/resource/status'
+  require 'puppet/transaction/persistence'
 
   attr_accessor :catalog, :ignoreschedules, :for_network_device
 
@@ -28,13 +30,20 @@ class Puppet::Transaction
 
   attr_reader :prefetched_providers
 
+  # @!attribute [r] persistence
+  #   @return [Puppet::Transaction::Persistence] persistence object for cross
+  #      transaction storage.
+  attr_reader :persistence
+
   include Puppet::Util
   include Puppet::Util::Tagging
 
   def initialize(catalog, report, prioritizer)
     @catalog = catalog
 
-    @report = report || Puppet::Transaction::Report.new("apply", catalog.version, catalog.environment)
+    @persistence = Puppet::Transaction::Persistence.new
+
+    @report = report || Puppet::Transaction::Report.new(catalog.version, catalog.environment)
 
     @prioritizer = prioritizer
 
@@ -70,7 +79,7 @@ class Puppet::Transaction
       prerun_errors.each do |res, detail|
         res.log_exception(detail)
       end
-      raise Puppet::Error, "Some pre-run checks failed"
+      raise Puppet::Error, _("Some pre-run checks failed")
     end
   end
 
@@ -79,12 +88,14 @@ class Puppet::Transaction
   # necessary events.
   def evaluate(&block)
     block ||= method(:eval_resource)
-    generator = AdditionalResourceGenerator.new(@catalog, relationship_graph, @prioritizer)
+    generator = AdditionalResourceGenerator.new(@catalog, nil, @prioritizer)
     @catalog.vertices.each { |resource| generator.generate_additional_resources(resource) }
 
     perform_pre_run_checks
 
-    Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
+    persistence.load if catalog.host_config?
+
+    Puppet.info _("Applying configuration version '%{version}'") % { version: catalog.version } if catalog.version
 
     continue_while = lambda { !stop_processing? }
 
@@ -107,7 +118,7 @@ class Puppet::Transaction
       # is one, it must have been selected by the user.
       return if missing_tags?(resource)
       if resource.provider
-        resource.err "Provider #{resource.provider.class.name} is not functional on this host"
+        resource.err _("Provider %{name} is not functional on this host") % { name: resource.provider.class.name }
       else
         providerless_types << resource.type
       end
@@ -123,32 +134,59 @@ class Puppet::Transaction
     teardown = lambda do
       # Just once per type. No need to punish the user.
       providerless_types.uniq.each do |type|
-        Puppet.err "Could not find a suitable provider for #{type}"
+        Puppet.err _("Could not find a suitable provider for %{type}") % { type: type }
       end
 
       post_evalable_providers.each do |provider|
         begin
           provider.post_resource_eval
         rescue => detail
-          Puppet.log_exception(detail, "post_resource_eval failed for provider #{provider}")
+          Puppet.log_exception(detail, _("post_resource_eval failed for provider %{provider}") % { provider: provider })
         end
       end
+
+      persistence.save if catalog.host_config?
+    end
+
+    # Graph cycles are returned as an array of arrays
+    # - outer array is an array of cycles
+    # - each inner array is an array of resources involved in a cycle
+    # Short circuit resource evaluation if we detect cycle(s) in the graph. Mark
+    # each corresponding resource as failed in the report before we fail to
+    # ensure accurate reporting.
+    graph_cycle_handler = lambda do |cycles|
+      cycles.flatten.uniq.each do |resource|
+        # We add a failed resource event to the status to ensure accurate
+        # reporting through the event manager.
+        resource_status(resource).fail_with_event(_('resource is part of a dependency cycle'))
+      end
+      raise Puppet::Error, _('One or more resource dependency cycles detected in graph')
     end
 
+    # Generate the relationship graph, set up our generator to use it
+    # for eval_generate, then kick off our traversal.
+    generator.relationship_graph = relationship_graph
     relationship_graph.traverse(:while => continue_while,
                                 :pre_process => pre_process,
                                 :overly_deferred_resource_handler => overly_deferred_resource_handler,
                                 :canceled_resource_handler => canceled_resource_handler,
+                                :graph_cycle_handler => graph_cycle_handler,
                                 :teardown => teardown) do |resource|
       if resource.is_a?(Puppet::Type::Component)
-        Puppet.warning "Somehow left a component in the relationship graph"
+        Puppet.warning _("Somehow left a component in the relationship graph")
       else
-        resource.info "Starting to evaluate the resource" if Puppet[:evaltrace] and @catalog.host_config?
+        resource.info _("Starting to evaluate the resource") if Puppet[:evaltrace] and @catalog.host_config?
         seconds = thinmark { block.call(resource) }
-        resource.info "Evaluated in %0.2f seconds" % seconds if Puppet[:evaltrace] and @catalog.host_config?
+        resource.info _("Evaluated in %0.2f seconds") % seconds if Puppet[:evaltrace] and @catalog.host_config?
       end
     end
 
+    # if one or more resources has attempted and failed to generate resources,
+    # report it
+    if generator.resources_failed_to_generate
+      report.resources_failed_to_generate = true
+    end
+
     Puppet.debug "Finishing transaction #{object_id}"
   end
 
@@ -159,7 +197,9 @@ class Puppet::Transaction
 
   # Are there any failed resources in this transaction?
   def any_failed?
-    report.resource_statuses.values.detect { |status| status.failed? }
+    report.resource_statuses.values.detect { |status|
+      status.failed? || status.failed_to_restart?
+    }
   end
 
   # Find all of the changed resources.
@@ -182,6 +222,10 @@ class Puppet::Transaction
     super
   end
 
+  def skip_tags
+    @skip_tags ||= Puppet::Util::SkipTags.new(Puppet[:skip_tags]).tags
+  end
+
   def prefetch_if_necessary(resource)
     provider_class = resource.provider.class
     return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
@@ -203,13 +247,17 @@ class Puppet::Transaction
   def apply(resource, ancestor = nil)
     status = resource_harness.evaluate(resource)
     add_resource_status(status)
-    event_manager.queue_events(ancestor || resource, status.events) unless status.failed?
+    ancestor ||= resource
+    if !(status.failed? || status.failed_to_restart?)
+      event_manager.queue_events(ancestor, status.events)
+    end
   rescue => detail
-    resource.err "Could not evaluate: #{detail}"
+    resource.err _("Could not evaluate: %{detail}") % { detail: detail }
   end
 
   # Evaluate a single resource.
   def eval_resource(resource, ancestor = nil)
+    propagate_failure(resource)
     if skip?(resource)
       resource_status(resource).skipped = true
       resource.debug("Resource is being skipped, unscheduling all events")
@@ -221,60 +269,45 @@ class Puppet::Transaction
     end
   end
 
-  def failed?(resource)
-    s = resource_status(resource) and s.failed?
-  end
-
   # Does this resource have any failed dependencies?
   def failed_dependencies?(resource)
-    # First make sure there are no failed dependencies.  To do this,
-    # we check for failures in any of the vertexes above us.  It's not
-    # enough to check the immediate dependencies, which is why we use
-    # a tree from the reversed graph.
-    found_failed = false
-
-
     # When we introduced the :whit into the graph, to reduce the combinatorial
     # explosion of edges, we also ended up reporting failures for containers
     # like class and stage.  This is undesirable; while just skipping the
     # output isn't perfect, it is RC-safe. --daniel 2011-06-07
     suppress_report = (resource.class == Puppet::Type.type(:whit))
 
-    relationship_graph.dependencies(resource).each do |dep|
-      next unless failed?(dep)
-      found_failed = true
-
+    s = resource_status(resource)
+    if s && s.dependency_failed?
       # See above. --daniel 2011-06-06
       unless suppress_report then
-        resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
+        s.failed_dependencies.each do |dep|
+          resource.notice _("Dependency %{dep} has failures: %{status}") % { dep: dep, status: resource_status(dep).failed }
+        end
       end
     end
 
-    found_failed
+    s && s.dependency_failed?
   end
 
-  # A general method for recursively generating new resources from a
-  # resource.
-  def generate_additional_resources(resource)
-    return unless resource.respond_to?(:generate)
-    begin
-      made = resource.generate
-    rescue => detail
-      resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
-    end
-    return unless made
-    made = [made] unless made.is_a?(Array)
-    made.uniq.each do |res|
-      begin
-        res.tag(*resource.tags)
-        @catalog.add_resource(res)
-        res.finish
-        add_conditional_directed_dependency(resource, res)
-        generate_additional_resources(res)
-      rescue Puppet::Resource::Catalog::DuplicateResourceError
-        res.info "Duplicate generated resource; skipping"
+  # We need to know if a resource has any failed dependencies before
+  # we try to process it. We keep track of this by keeping a list on
+  # each resource of the failed dependencies, and incrementally
+  # computing it as the union of the failed dependencies of each
+  # first-order dependency. We have to do this as-we-go instead of
+  # up-front at failure time because the graph may be mutated as we
+  # walk it.
+  def propagate_failure(resource)
+    failed = Set.new
+    relationship_graph.direct_dependencies_of(resource).each do |dep|
+      if (s = resource_status(dep))
+        failed.merge(s.failed_dependencies) if s.dependency_failed?
+        if s.failed? || s.failed_to_restart?
+          failed.add(dep)
+        end
       end
     end
+    resource_status(resource).failed_dependencies = failed.to_a
   end
 
   # Should we ignore tags?
@@ -306,7 +339,8 @@ class Puppet::Transaction
     begin
       provider_class.prefetch(resources)
     rescue LoadError, Puppet::MissingCommand => detail
-      Puppet.log_exception(detail, "Could not prefetch #{type_name} provider '#{provider_class.name}': #{detail}")
+      #TRANSLATORS `prefetch` is a function name and should not be translated
+      Puppet.log_exception(detail, _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail })
     end
     @prefetched_providers[type_name][provider_class.name] = true
   end
@@ -322,7 +356,9 @@ class Puppet::Transaction
 
   # Should this resource be skipped?
   def skip?(resource)
-    if missing_tags?(resource)
+    if skip_tags?(resource)
+      resource.debug "Skipping with skip tags #{skip_tags.join(", ")}"
+    elsif missing_tags?(resource)
       resource.debug "Not tagged with #{tags.join(", ")}"
     elsif ! scheduled?(resource)
       resource.debug "Not scheduled"
@@ -332,7 +368,7 @@ class Puppet::Transaction
       # like class and stage.  This is undesirable; while just skipping the
       # output isn't perfect, it is RC-safe. --daniel 2011-06-07
       unless resource.class == Puppet::Type.type(:whit) then
-        resource.warning "Skipping because of failed dependencies"
+        resource.warning _("Skipping because of failed dependencies")
       end
     elsif resource.virtual?
       resource.debug "Skipping because virtual"
@@ -358,6 +394,17 @@ class Puppet::Transaction
     not resource.tagged?(*tags)
   end
 
+  def skip_tags?(resource)
+    return false if ignore_tags?
+    return false if skip_tags.empty?
+
+    resource.tagged?(*skip_tags)
+  end
+
+  def split_qualified_tags?
+    false
+  end
+
   # These two methods are only made public to enable the existing spec tests to run
   # under rspec 3 (apparently rspec 2 didn't enforce access controls?). Please do not
   # treat these as part of a public API.
@@ -368,4 +415,3 @@ class Puppet::Transaction
 end
 
 require 'puppet/transaction/report'
-

data/lib/puppet/type/augeas.rb

@@ -5,7 +5,7 @@
 #   you may not use this file except in compliance with the License.
 #   You may obtain a copy of the License at
 #
-#       http://www.apache.org/licenses/LICENSE-2.0
+#       https://www.apache.org/licenses/LICENSE-2.0
 #
 #   Unless required by applicable law or agreed to in writing, software
 #   distributed under the License is distributed on an "AS IS" BASIS,
@@ -73,9 +73,17 @@ Puppet::Type.newtype(:augeas) do
 
   newparam (:onlyif) do
     desc "Optional augeas command and comparisons to control the execution of this type.
+
+      Note: `values` is not an actual augeas API command. It calls `match` to retrieve an array of paths
+             in <MATCH_PATH> and then `get` to retrieve the values from each of the returned paths.
+
       Supported onlyif syntax:
 
       * `get <AUGEAS_PATH> <COMPARATOR> <STRING>`
+      * `values <MATCH_PATH> include <STRING>`
+      * `values <MATCH_PATH> not_include <STRING>`
+      * `values <MATCH_PATH> == <AN_ARRAY>`
+      * `values <MATCH_PATH> != <AN_ARRAY>`
       * `match <MATCH_PATH> size <COMPARATOR> <INT>`
       * `match <MATCH_PATH> include <STRING>`
       * `match <MATCH_PATH> not_include <STRING>`
@@ -98,7 +106,7 @@ Puppet::Type.newtype(:augeas) do
     desc "The changes which should be applied to the filesystem. This
     can be a command or an array of commands. The following commands are supported:
 
-    * `set <PATH> <VALUE>` --- Sets the value `VALUE` at loction `PATH`
+    * `set <PATH> <VALUE>` --- Sets the value `VALUE` at location `PATH`
     * `setm <PATH> <SUB> <VALUE>` --- Sets multiple nodes (matching `SUB` relative to `PATH`) to `VALUE`
     * `rm <PATH>` --- Removes the node at location `PATH`
     * `remove <PATH>` --- Synonym for `rm`
@@ -109,6 +117,7 @@ Puppet::Type.newtype(:augeas) do
     * `insert <LABEL> <WHERE> <PATH>` --- Synonym for `ins`
     * `mv <PATH> <OTHER PATH>` --- Moves a node at `PATH` to the new location `OTHER PATH`
     * `move <PATH> <OTHER PATH>` --- Synonym for `mv`
+    * `rename <PATH> <LABEL>` --- Rename a node at `PATH` to a new `LABEL`
     * `defvar <NAME> <PATH>` --- Sets Augeas variable `$NAME` to `PATH`
     * `defnode <NAME> <PATH> <VALUE>` --- Sets Augeas variable `$NAME` to `PATH`, creating it with `VALUE` if needed
 
@@ -128,7 +137,7 @@ Puppet::Type.newtype(:augeas) do
 
   newparam(:force) do
     desc "Optional command to force the augeas type to execute even if it thinks changes
-    will not be made. This does not overide the `onlyif` parameter."
+    will not be made. This does not override the `onlyif` parameter."
 
     defaultto false
   end
@@ -155,7 +164,7 @@ Puppet::Type.newtype(:augeas) do
   validate do
     has_lens = !self[:lens].nil?
     has_incl = !self[:incl].nil?
-    self.fail "You must specify both the lens and incl parameters, or neither." if has_lens != has_incl
+    self.fail _("You must specify both the lens and incl parameters, or neither.") if has_lens != has_incl
   end
 
   newparam(:show_diff, :boolean => true, :parent => Puppet::Parameter::Boolean) do
@@ -179,11 +188,11 @@ Puppet::Type.newtype(:augeas) do
 
     # Make output a bit prettier
     def change_to_s(currentvalue, newvalue)
-      "executed successfully"
+      _("executed successfully")
     end
 
     # if the onlyif resource is provided, then the value is parsed.
-    # a return value of 0 will stop exection because it matches the
+    # a return value of 0 will stop execution because it matches the
     # default value.
     def retrieve
       if @resource.provider.need_to_run?()

data/lib/puppet/type/component.rb

@@ -71,6 +71,17 @@ Puppet::Type.newtype(:component) do
     reference.to_s
   end
 
+  # Overrides the default implementation to do nothing.
+  # This type contains data from class/define parameters, but does
+  # not have actual parameters or properties at the Type level. We can
+  # simply ignore anything flagged as sensitive here, since any
+  # contained resources will handle that sensitivity themselves. There
+  # is no risk of this information leaking into reports, since no
+  # Component instances survive the graph transmutation.
+  #
+  def set_sensitive_parameters(sensitive_parameters)
+  end
+
   private
 
   attr_reader :reference