puppet 4.0.0 → 5.0.0

data/lib/puppet/type/ssh_authorized_key.rb

@@ -2,18 +2,20 @@ module Puppet
   Type.newtype(:ssh_authorized_key) do
     @doc = "Manages SSH authorized keys. Currently only type 2 keys are supported.
 
-      In their native habitat, SSH keys usually appear as a single long line. This
-      resource type requires you to split that line into several attributes. Thus, a
-      key that appears in your `~/.ssh/id_rsa.pub` file like this...
+      In their native habitat, SSH keys usually appear as a single long line, in
+      the format `<TYPE> <KEY> <NAME/COMMENT>`. This resource type requires you
+      to split that line into several attributes. Thus, a key that appears in
+      your `~/.ssh/id_rsa.pub` file like this...
 
-          ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAy5mtOAMHwA2ZAIfW6Ap70r+I4EclYHEec5xIN59ROUjss23Skb1OtjzYpVPaPH8mSdSmsN0JHaBLiRcu7stl4O8D8zA4mz/vw32yyQ/Kqaxw8l0K76k6t2hKOGqLTY4aFbFISV6GDh7MYLn8KU7cGp96J+caO5R5TqtsStytsUhSyqH+iIDh4e4+BrwTc6V4Y0hgFxaZV5d18mLA4EPYKeG5+zyBCVu+jueYwFqM55E0tHbfiaIN9IzdLV+7NEEfdLkp6w2baLKPqWUBmuvPF1Mn3FwaFLjVsMT3GQeMue6b3FtUdTDeyAYoTxrsRo/WnDkS6Pa3YhrFwjtUqXfdaQ== nick@magpie.puppetlabs.lan
+          ssh-rsa AAAAB3Nza[...]qXfdaQ== nick@magpie.example.com
 
       ...would translate to the following resource:
 
-          ssh_authorized_key { 'nick@magpie.puppetlabs.lan':
-            user => 'nick',
-            type => 'ssh-rsa',
-            key  => 'AAAAB3NzaC1yc2EAAAABIwAAAQEAy5mtOAMHwA2ZAIfW6Ap70r+I4EclYHEec5xIN59ROUjss23Skb1OtjzYpVPaPH8mSdSmsN0JHaBLiRcu7stl4O8D8zA4mz/vw32yyQ/Kqaxw8l0K76k6t2hKOGqLTY4aFbFISV6GDh7MYLn8KU7cGp96J+caO5R5TqtsStytsUhSyqH+iIDh4e4+BrwTc6V4Y0hgFxaZV5d18mLA4EPYKeG5+zyBCVu+jueYwFqM55E0tHbfiaIN9IzdLV+7NEEfdLkp6w2baLKPqWUBmuvPF1Mn3FwaFLjVsMT3GQeMue6b3FtUdTDeyAYoTxrsRo/WnDkS6Pa3YhrFwjtUqXfdaQ==',
+          ssh_authorized_key { 'nick@magpie.example.com':
+            ensure => present,
+            user   => 'nick',
+            type   => 'ssh-rsa',
+            key    => 'AAAAB3Nza[...]qXfdaQ==',
           }
 
       To ensure that only the currently approved keys are present, you can purge
@@ -36,8 +38,12 @@ module Puppet
     ensurable
 
     newparam(:name) do
-      desc "The SSH key comment. This attribute is currently used as a
-        system-wide primary key and therefore has to be unique."
+      desc "The SSH key comment. This can be anything, and doesn't need to match
+        the original comment from the `.pub` file.
+
+        Due to internal limitations, this must be unique across all user accounts;
+        if you want to specify one key for multiple users, you must use a different
+        comment for each instance."
 
       isnamevar
 
@@ -65,7 +71,7 @@ module Puppet
           the `name` attribute/resource title."
 
       validate do |value|
-        raise Puppet::Error, "Key must not contain whitespace: #{value}" if value =~ /\s/
+        raise Puppet::Error, _("Key must not contain whitespace: %{value}") % { value: value } if value =~ /\s/
       end
     end
 
@@ -106,25 +112,9 @@ module Puppet
 
       defaultto do :absent end
 
-      def is_to_s(value)
-        if value == :absent or value.include?(:absent)
-          super
-        else
-          value.join(",")
-        end
-      end
-
-      def should_to_s(value)
-        if value == :absent or value.include?(:absent)
-          super
-        else
-          value.join(",")
-        end
-      end
-
       validate do |value|
         unless value == :absent or value =~ /^[-a-z0-9A-Z_]+(?:=\".*?\")?$/
-          raise Puppet::Error, "Option #{value} is not valid. A single option must either be of the form 'option' or 'option=\"value\". Multiple options must be provided as an array"
+          raise Puppet::Error, _("Option %{value} is not valid. A single option must either be of the form 'option' or 'option=\"value\". Multiple options must be provided as an array") % { value: value }
         end
       end
     end
@@ -141,11 +131,11 @@ module Puppet
       return if @parameters.include?(:user)
 
       # If neither target nor user is defined, this is an error
-      raise Puppet::Error, "Attribute 'user' or 'target' is mandatory"
+      raise Puppet::Error, _("Attribute 'user' or 'target' is mandatory")
     end
 
     # regular expression suitable for use by a ParsedFile based provider
-    REGEX = /^(?:(.+) )?(ssh-dss|ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521) ([^ ]+) ?(.*)$/
+    REGEX = /^(?:(.+)\s+)?(ssh-dss|ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521)\s+([^ ]+)\s*(.*)$/
     def self.keyline_regex
       REGEX
     end

data/lib/puppet/type/sshkey.rb

@@ -1,8 +1,10 @@
 module Puppet
   Type.newtype(:sshkey) do
-    @doc = "Installs and manages ssh host keys.  At this point, this type
-      only knows how to install keys into `/etc/ssh/ssh_known_hosts`.  See
-      the `ssh_authorized_key` type to manage authorized keys."
+    @doc = "Installs and manages ssh host keys.  By default, this type will
+      install keys into `/etc/ssh/ssh_known_hosts`. To manage ssh keys in a
+      different `known_hosts` file, such as a user's personal `known_hosts`,
+      pass its path to the `target` parameter. See the `ssh_authorized_key`
+      type to manage authorized keys."
 
     ensurable
 
@@ -39,10 +41,10 @@ module Puppet
 
       validate do |value|
         if value =~ /\s/
-          raise Puppet::Error, "Aliases cannot include whitespace"
+          raise Puppet::Error, _("Aliases cannot include whitespace")
         end
         if value =~ /,/
-          raise Puppet::Error, "Aliases must be provided as an array, not a comma-separated list"
+          raise Puppet::Error, _("Aliases must be provided as an array, not a comma-separated list")
         end
       end
     end
@@ -53,8 +55,8 @@ module Puppet
       isnamevar
 
       validate do |value|
-        raise Puppet::Error, "Resourcename cannot include whitespaces" if value =~ /\s/
-        raise Puppet::Error, "No comma in resourcename allowed. If you want to specify aliases use the host_aliases property" if value.include?(',')
+        raise Puppet::Error, _("Resourcename cannot include whitespaces") if value =~ /\s/
+        raise Puppet::Error, _("No comma in resourcename allowed. If you want to specify aliases use the host_aliases property") if value.include?(',')
       end
     end
 

data/lib/puppet/type/stage.rb

@@ -2,7 +2,7 @@ Puppet::Type.newtype(:stage) do
   desc "A resource type for creating new run stages.  Once a stage is available,
     classes can be assigned to it by declaring them with the resource-like syntax
     and using
-    [the `stage` metaparameter](http://docs.puppetlabs.com/references/latest/metaparameter.html#stage).
+    [the `stage` metaparameter](https://docs.puppetlabs.com/puppet/latest/reference/metaparameter.html#stage).
 
     Note that new stages are not useful unless you also declare their order
     in relation to the default `main` stage.

data/lib/puppet/type/tidy.rb

@@ -16,6 +16,9 @@ Puppet::Type.newtype(:tidy) do
     actual deletion.
     "
 
+  # Tidy names are not isomorphic with the objects.
+  @isomorphic = false
+
   newparam(:path) do
     desc "The path to the file or directory to manage.  Must be fully
       qualified."
@@ -39,10 +42,10 @@ Puppet::Type.newtype(:tidy) do
       case newval
       when :true, :inf; true
       when :false; false
-      when Integer, Fixnum, Bignum; value
+      when Integer; value
       when /^\d+$/; Integer(value)
       else
-        raise ArgumentError, "Invalid recurse value #{value.inspect}"
+        raise ArgumentError, _("Invalid recurse value %{value}") % { value: value.inspect }
       end
     end
   end
@@ -56,10 +59,10 @@ Puppet::Type.newtype(:tidy) do
 
       Example:
 
-          tidy { "/tmp":
-            age     => "1w",
+          tidy { '/tmp':
+            age     => '1w',
             recurse => 1,
-            matches => [ "[0-9]pub*.tmp", "*.temp", "tmpfile?" ]
+            matches => [ '[0-9]pub*.tmp', '*.temp', 'tmpfile?' ],
           }
 
       This removes files from `/tmp` if they are one week old or older,
@@ -73,13 +76,13 @@ Puppet::Type.newtype(:tidy) do
       Finally, note that you must now specify a non-zero/non-false value
       for recurse if matches is used, as matches only apply to files found
       by recursion (there's no reason to use static patterns match against
-      a statically determined path).  Requiering explicit recursion clears
+      a statically determined path).  Requiring explicit recursion clears
       up a common source of confusion.
     EOT
 
     # Make sure we convert to an array.
     munge do |value|
-      fail "Tidy can't use matches with recurse 0, false, or undef" if "#{@resource[:recurse]}" =~ /^(0|false|)$/
+      fail _("Tidy can't use matches with recurse 0, false, or undef") if "#{@resource[:recurse]}" =~ /^(0|false|)$/
       [value].flatten
     end
 
@@ -118,7 +121,7 @@ Puppet::Type.newtype(:tidy) do
       if num = AgeConvertors[unit]
         return num * multi
       else
-        self.fail "Invalid age unit '#{unit}'"
+        self.fail _("Invalid age unit '%{unit}'") % { unit: unit }
       end
     end
 
@@ -137,7 +140,8 @@ Puppet::Type.newtype(:tidy) do
         multi = Integer($1)
         unit = :d
       else
-        self.fail "Invalid tidy age #{age}"
+        #TRANSLATORS tidy is the name of a program and should not be translated
+        self.fail _("Invalid tidy age %{age}") % { age: age }
       end
 
       convert(unit, multi)
@@ -158,7 +162,7 @@ Puppet::Type.newtype(:tidy) do
         num.times do result *= 1024 end
         return result
       else
-        self.fail "Invalid size unit '#{unit}'"
+        self.fail _("Invalid size unit '%{unit}'") % { unit: unit }
       end
     end
 
@@ -175,7 +179,8 @@ Puppet::Type.newtype(:tidy) do
         multi = Integer($1)
         unit = :k
       else
-        self.fail "Invalid tidy size #{age}"
+        #TRANSLATORS tidy is the name of a program and should not be translated
+        self.fail _("Invalid tidy size %{age}") % { age: age }
       end
 
       convert(unit, multi)
@@ -240,7 +245,7 @@ Puppet::Type.newtype(:tidy) do
     return [] unless stat(self[:path])
 
     case self[:recurse]
-    when Integer, Fixnum, Bignum, /^\d+$/
+    when Integer, /^\d+$/
       parameter = { :recurse => true, :recurselimit => self[:recurse] }
     when true, :true, :inf
       parameter = { :recurse => true }
@@ -253,7 +258,10 @@ Puppet::Type.newtype(:tidy) do
     else
       files = [self[:path]]
     end
-    result = files.find_all { |path| tidy?(path) }.collect { |path| mkfile(path) }.each { |file| notice "Tidying #{file.ref}" }.sort { |a,b| b[:path] <=> a[:path] }
+    found_files = files.find_all { |path| tidy?(path) }.collect { |path| mkfile(path) }
+    result = found_files.each { |file| debug "Tidying #{file.ref}" }.sort { |a,b| b[:path] <=> a[:path] }
+    #TRANSLATORS "Tidy" is a program name and should not be translated
+    notice _("Tidying %{count} files") % { count: found_files.size }
 
     # No need to worry about relationships if we don't have rmdirs; there won't be
     # any directories.
@@ -317,10 +325,11 @@ Puppet::Type.newtype(:tidy) do
     begin
       Puppet::FileSystem.lstat(path)
     rescue Errno::ENOENT => error
-      info "File does not exist"
+      info _("File does not exist")
       return nil
     rescue Errno::EACCES => error
-      warning "Could not stat; permission denied"
+      #TRANSLATORS "stat" is a program name and should not be translated
+      warning _("Could not stat; permission denied")
       return nil
     end
   end

data/lib/puppet/type/user.rb

@@ -16,9 +16,10 @@ module Puppet
       about them.  It does not directly modify `/etc/passwd` or anything.
 
       **Autorequires:** If Puppet is managing the user's primary group (as
-      provided in the `gid` attribute), the user resource will autorequire
-      that group. If Puppet is managing any role accounts corresponding to the
-      user's roles, the user resource will autorequire those role accounts."
+      provided in the `gid` attribute) or any group listed in the `groups`
+      attribute then the user resource will autorequire that group. If Puppet
+      is managing any role accounts corresponding to the user's roles, the
+      user resource will autorequire those role accounts."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
@@ -162,7 +163,7 @@ module Puppet
           end
         end
 
-        fail "Could not find group(s) #{@should.join(",")}" unless found
+        fail _("Could not find group(s) %{groups}") % { groups: @should.join(",") } unless found
 
         # Use the default event.
       end
@@ -170,8 +171,23 @@ module Puppet
 
     newproperty(:comment) do
       desc "A description of the user.  Generally the user's full name."
-      munge do |v|
-        v.respond_to?(:force_encoding) ? v.force_encoding(Encoding::ASCII_8BIT) : v
+      def insync?(is)
+        # nameservice provider requires special attention to encoding
+        # Overrides Puppet::Property#insync?
+        if !@should.empty? && provider.respond_to?(:comments_insync?)
+          return provider.comments_insync?(is, @should)
+        end
+        super(is)
+      end
+
+      # In the case that our comments have incompatible encodings, set external
+      # encoding to support concatenation for display.
+      # overrides Puppet::Property#change_to_s
+      def change_to_s(currentvalue, newvalue)
+        if newvalue.respond_to?(:force_encoding) && !Encoding.compatible?(currentvalue, newvalue)
+          return super(currentvalue, newvalue.dup.force_encoding(currentvalue.encoding))
+        end
+        super(currentvalue, newvalue)
       end
     end
 
@@ -183,43 +199,44 @@ module Puppet
     end
 
     newproperty(:password, :required_features => :manages_passwords) do
-      desc %q{The user's password, in whatever encrypted format the local
-        system requires.
-
-        * Most modern Unix-like systems use salted SHA1 password hashes. You can use
-          Puppet's built-in `sha1` function to generate a hash from a password.
-        * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
-        * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs [stdlib][]
-          module contains a `str2saltedsha512` function which can generate password
-          hashes for Lion.
-        * Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When
-          managing passwords on these systems the salt and iterations properties
-          need to be specified as well as the password.
+      desc %q{The user's password, in whatever encrypted format the local system
+        requires. Consult your operating system's documentation for acceptable password
+        encryption formats and requirements.
+
+        * Mac OS X 10.5 and 10.6, and some older Linux distributions, use salted SHA1
+          hashes. You can use Puppet's built-in `sha1` function to generate a salted SHA1
+          hash from a password.
+        * Mac OS X 10.7 (Lion), and many recent Linux distributions, use salted SHA512
+          hashes. The Puppet Labs [stdlib][] module contains a `str2saltedsha512` function
+          which can generate password hashes for these operating systems.
+        * OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When managing passwords
+          on these systems, the `salt` and `iterations` attributes need to be specified as
+          well as the password.
         * Windows passwords can only be managed in cleartext, as there is no Windows API
           for setting the password hash.
 
         [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
 
-        Be sure to enclose any value that includes a dollar sign ($) in single
-        quotes (') to avoid accidental variable interpolation.}
+        Enclose any value that includes a dollar sign ($) in single quotes (') to avoid
+        accidental variable interpolation.}
 
       validate do |value|
-        raise ArgumentError, "Passwords cannot include ':'" if value.is_a?(String) and value.include?(":")
+        raise ArgumentError, _("Passwords cannot include ':'") if value.is_a?(String) and value.include?(":")
       end
 
       def change_to_s(currentvalue, newvalue)
         if currentvalue == :absent
-          return "created password"
+          return _("created password")
         else
-          return "changed password"
+          return _("changed password")
         end
       end
 
       def is_to_s( currentvalue )
-        return '[old password hash redacted]'
+        return _('[old password hash redacted]')
       end
       def should_to_s( newvalue )
-        return '[new password hash redacted]'
+        return _('[new password hash redacted]')
       end
 
     end
@@ -238,7 +255,7 @@ module Puppet
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
-          raise ArgumentError, "Password minimum age must be provided as a number."
+          raise ArgumentError, _("Password minimum age must be provided as a number.")
         end
       end
     end
@@ -257,7 +274,7 @@ module Puppet
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
-          raise ArgumentError, "Password maximum age must be provided as a number."
+          raise ArgumentError, _("Password maximum age must be provided as a number.")
         end
       end
     end
@@ -269,10 +286,42 @@ module Puppet
 
       validate do |value|
         if value =~ /^\d+$/
-          raise ArgumentError, "Group names must be provided, not GID numbers."
+          raise ArgumentError, _("Group names must be provided, not GID numbers.")
         end
-        raise ArgumentError, "Group names must be provided as an array, not a comma-separated list." if value.include?(",")
-        raise ArgumentError, "Group names must not be empty. If you want to specify \"no groups\" pass an empty array" if value.empty?
+        raise ArgumentError, _("Group names must be provided as an array, not a comma-separated list.") if value.include?(",")
+        raise ArgumentError, _("Group names must not be empty. If you want to specify \"no groups\" pass an empty array") if value.empty?
+      end
+
+      def change_to_s(currentvalue, newvalue)
+        newvalue = newvalue.split(",") if newvalue != :absent
+
+        if provider.respond_to?(:groups_to_s)
+          # for Windows ADSI
+          # de-dupe the "newvalue" when the sync event message is generated,
+          # due to final retrieve called after the resource has been modified
+          newvalue = provider.groups_to_s(newvalue).split(',').uniq
+        end
+
+        super(currentvalue, newvalue)
+      end
+
+      # override Puppet::Property::List#retrieve
+      def retrieve
+        if provider.respond_to?(:groups_to_s)
+          # Windows ADSI groups returns SIDs, but retrieve needs names
+          # must return qualified names for SIDs for "is" value and puppet resource
+          return provider.groups_to_s(provider.groups).split(',')
+        end
+
+        super
+      end
+
+      def insync?(current)
+        if provider.respond_to?(:groups_insync?)
+          return provider.groups_insync?(current, @should)
+        end
+
+        super(current)
       end
     end
 
@@ -288,9 +337,14 @@ module Puppet
     end
 
     newparam(:membership) do
-      desc "Whether specified groups should be considered the **complete list**
-        (`inclusive`) or the **minimum list** (`minimum`) of groups to which
-        the user belongs. Defaults to `minimum`."
+      desc "If `minimum` is specified, Puppet will ensure that the user is a
+        member of all specified groups, but will not remove any other groups
+        that the user is a part of.
+
+        If `inclusive` is specified, Puppet will ensure that the user is a
+        member of **only** specified groups.
+
+        Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
@@ -321,7 +375,7 @@ module Puppet
 
       validate do |val|
         if munge(val)
-          raise ArgumentError, "User provider #{provider.class.name} can not manage home directories" if provider and not provider.class.manages_homedir?
+          raise ArgumentError, _("User provider %{name} can not manage home directories") % { name: provider.class.name } if provider and not provider.class.manages_homedir?
         end
       end
     end
@@ -337,7 +391,9 @@ module Puppet
 
       validate do |value|
         if value.intern != :absent and value !~ /^\d{4}-\d{2}-\d{2}$/
-          raise ArgumentError, "Expiry dates must be YYYY-MM-DD or the string \"absent\""
+          #TRANSLATORS YYYY-MM-DD represents a date with a four-digit year, a two-digit month, and a two-digit day,
+          #TRANSLATORS separated by dashes.
+          raise ArgumentError, _("Expiry dates must be YYYY-MM-DD or the string \"absent\"")
         end
       end
     end
@@ -414,9 +470,9 @@ module Puppet
 
       validate do |value|
         if value =~ /^\d+$/
-          raise ArgumentError, "Role names must be provided, not numbers"
+          raise ArgumentError, _("Role names must be provided, not numbers")
         end
-        raise ArgumentError, "Role names must be provided as an array, not a comma-separated list" if value.include?(",")
+        raise ArgumentError, _("Role names must be provided as an array, not a comma-separated list") if value.include?(",")
       end
     end
 
@@ -451,9 +507,9 @@ module Puppet
 
       validate do |value|
         if value =~ /^\d+$/
-          raise ArgumentError, "Auth names must be provided, not numbers"
+          raise ArgumentError, _("Auth names must be provided, not numbers")
         end
-        raise ArgumentError, "Auth names must be provided as an array, not a comma-separated list" if value.include?(",")
+        raise ArgumentError, _("Auth names must be provided as an array, not a comma-separated list") if value.include?(",")
       end
     end
 
@@ -477,9 +533,9 @@ module Puppet
 
       validate do |value|
         if value =~ /^\d+$/
-          raise ArgumentError, "Profile names must be provided, not numbers"
+          raise ArgumentError, _("Profile names must be provided, not numbers")
         end
-        raise ArgumentError, "Profile names must be provided as an array, not a comma-separated list" if value.include?(",")
+        raise ArgumentError, _("Profile names must be provided as an array, not a comma-separated list") if value.include?(",")
       end
     end
 
@@ -501,7 +557,7 @@ module Puppet
       end
 
       validate do |value|
-        raise ArgumentError, "Key/value pairs must be separated by an =" unless value.include?("=")
+        raise ArgumentError, _("Key/value pairs must be separated by an =") unless value.include?("=")
       end
     end
 
@@ -535,7 +591,7 @@ module Puppet
       end
 
       validate do |value|
-        raise ArgumentError, "Attributes value pairs must be separated by an =" unless value.include?("=")
+        raise ArgumentError, _("Attributes value pairs must be separated by an =") unless value.include?("=")
       end
     end
 
@@ -550,14 +606,15 @@ module Puppet
     end
 
     newproperty(:salt, :required_features => :manages_password_salt) do
-      desc "This is the 32 byte salt used to generate the PBKDF2 password used in
+      desc "This is the 32-byte salt used to generate the PBKDF2 password used in
             OS X. This field is required for managing passwords on OS X >= 10.8."
     end
 
     newproperty(:iterations, :required_features => :manages_password_salt) do
       desc "This is the number of iterations of a chained computation of the
-            password hash (http://en.wikipedia.org/wiki/PBKDF2).  This parameter
-            is used in OS X. This field is required for managing passwords on OS X >= 10.8."
+            [PBKDF2 password hash](https://en.wikipedia.org/wiki/PBKDF2). This parameter
+            is used in OS X, and is required for managing passwords on OS X 10.8 and
+            newer."
 
       munge do |value|
         if value.is_a?(String) and value =~/^[-0-9]+$/
@@ -607,14 +664,14 @@ module Puppet
         if value.is_a?(Array)
           value.each do |entry|
 
-            raise ArgumentError, "Each entry for purge_ssh_keys must be a string, not a #{entry.class}" unless entry.is_a?(String)
+            raise ArgumentError, _("Each entry for purge_ssh_keys must be a string, not a %{klass}") % { klass: entry.class } unless entry.is_a?(String)
 
             valid_home = Puppet::Util.absolute_path?(entry) || entry =~ %r{^~/|^%h/}
-            raise ArgumentError, "Paths to keyfiles must be absolute, not #{entry}" unless valid_home
+            raise ArgumentError, _("Paths to keyfiles must be absolute, not %{entry}") % { entry: entry } unless valid_home
           end
           return
         end
-        raise ArgumentError, "purge_ssh_keys must be true, false, or an array of file names, not #{value.inspect}"
+        raise ArgumentError, _("purge_ssh_keys must be true, false, or an array of file names, not %{value}") % { value: value.inspect }
       end
 
       munge do |value|
@@ -626,14 +683,14 @@ module Puppet
         return [] if value == :false
         home = resource[:home]
         if value == :true and not home
-          raise ArgumentError, "purge_ssh_keys can only be true for users with a defined home directory"
+          raise ArgumentError, _("purge_ssh_keys can only be true for users with a defined home directory")
         end
 
         return [ "#{home}/.ssh/authorized_keys" ] if value == :true
         # value is an array - munge each value
         [ value ].flatten.map do |entry|
           if entry =~ /^~|^%h/ and not home
-            raise ArgumentError, "purge_ssh_keys value '#{value}' meta character ~ or %h only allowed for users with a defined home directory"
+            raise ArgumentError, _("purge_ssh_keys value '%{value}' meta character ~ or %{home_placeholder} only allowed for users with a defined home directory") % { value: value, home_placeholder: '%h' }
           end
           entry.gsub!(/^~\//, "#{home}/")
           entry.gsub!(/^%h\//, "#{home}/")
@@ -647,7 +704,7 @@ module Puppet
 
       validate do |value|
         if value =~ /^\d+$/
-          raise ArgumentError, "Class name must be provided."
+          raise ArgumentError, _("Class name must be provided.")
         end
       end
     end
@@ -684,7 +741,9 @@ module Puppet
     def unknown_keys_in_file(keyfile)
       names = []
       name_index = 0
-      File.new(keyfile).each do |line|
+      # RFC 4716 specifies UTF-8 allowed in public key files per https://www.ietf.org/rfc/rfc4716.txt
+      # the authorized_keys file may contain UTF-8 comments
+      Puppet::FileSystem.open(keyfile, nil, 'r:UTF-8').each do |line|
         next unless line =~ Puppet::Type.type(:ssh_authorized_key).keyline_regex
         # the name is stored in the 4th capture of the regex
         name = $4