puppet 4.0.0 → 5.0.0

data/lib/puppet/network/http/webrick.rb

@@ -21,13 +21,13 @@ class Puppet::Network::HTTP::WEBrick
 
     @server.mount('/', Puppet::Network::HTTP::WEBrickREST)
 
-    raise "WEBrick server is already listening" if @listening
+    raise _("WEBrick server is already listening") if @listening
     @listening = true
     @thread = Thread.new do
       @server.start do |sock|
         timeout = 10.0
         if ! IO.select([sock],nil,nil,timeout)
-          raise "Client did not send data within %.1f seconds of connecting" % timeout
+          raise _("Client did not send data within %.1f seconds of connecting") % timeout
         end
         sock.accept
         @server.run(sock)
@@ -37,7 +37,7 @@ class Puppet::Network::HTTP::WEBrick
   end
 
   def unlisten
-    raise "WEBrick server is not listening" unless @listening
+    raise _("WEBrick server is not listening") unless @listening
     @server.shutdown
     wait_for_shutdown
     @server = nil
@@ -73,7 +73,8 @@ class Puppet::Network::HTTP::WEBrick
     file = Puppet[:masterhttplog]
 
     # open the log manually to prevent file descriptor leak
-    file_io = ::File.open(file, "a+")
+    # webrick logged strings may contain UTF-8
+    file_io = ::File.open(file, "a+:UTF-8")
     file_io.sync = true
     if defined?(Fcntl::FD_CLOEXEC)
       file_io.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
@@ -96,7 +97,7 @@ class Puppet::Network::HTTP::WEBrick
     # Get the cached copy.  We know it's been generated, too.
     host = Puppet::SSL::Host.localhost
 
-    raise Puppet::Error, "Could not retrieve certificate for #{host.name} and not running on a valid certificate authority" unless host.certificate
+    raise Puppet::Error, _("Could not retrieve certificate for %{host} and not running on a valid certificate authority") % { value0: host.name } unless host.certificate
 
     results[:SSLPrivateKey] = host.key.content
     results[:SSLCertificate] = host.certificate.content
@@ -104,7 +105,7 @@ class Puppet::Network::HTTP::WEBrick
     results[:SSLEnable] = true
     results[:SSLOptions] = OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
 
-    raise Puppet::Error, "Could not find CA certificate" unless Puppet::SSL::Certificate.indirection.find(Puppet::SSL::CA_NAME)
+    raise Puppet::Error, _("Could not find CA certificate") unless Puppet::SSL::Certificate.indirection.find(Puppet::SSL::CA_NAME)
 
     results[:SSLCACertificateFile] = ssl_configuration.ca_auth_file
     results[:SSLVerifyClient] = OpenSSL::SSL::VERIFY_PEER

data/lib/puppet/network/rights.rb

@@ -53,19 +53,9 @@ class Rights
 
     # if we end up here, then that means we either didn't match or failed, in any
     # case will return an error to the outside world
-    host_description = args[:node] ? "#{args[:node]}(#{args[:ip]})" : args[:ip]
+    msg = "#{name} [#{args[:method]}]"
 
-    msg = "#{host_description} access to #{name} [#{args[:method]}]"
-
-    if args[:authenticated]
-      msg += " authenticated "
-    end
-
-    if right
-      msg += " at #{right.file}:#{right.line}"
-    end
-
-    AuthorizationError.new("Forbidden request: #{msg}")
+    AuthorizationError.new(_("Forbidden request: %{msg}") % { msg: msg })
   end
 
   def initialize
@@ -133,7 +123,7 @@ class Rights
         @name = name.gsub(/^~\s+/,'')
         @key = Regexp.new(@name)
       else
-        raise ArgumentError, "Unknown right type '#{name}'"
+        raise ArgumentError, _("Unknown right type '%{name}'") % { name: name }
       end
 
       super()
@@ -175,21 +165,21 @@ class Rights
     def restrict_method(m)
       m = m.intern if m.is_a?(String)
 
-      raise ArgumentError, "'#{m}' is not an allowed value for method directive" unless ALL.include?(m)
+      raise ArgumentError, _("'%{m}' is not an allowed value for method directive") % { m: m } unless ALL.include?(m)
 
       # if we were allowing all methods, then starts from scratch
       if @methods === ALL
         @methods = []
       end
 
-      raise ArgumentError, "'#{m}' is already in the '#{name}' ACL" if @methods.include?(m)
+      raise ArgumentError, _("'%{m}' is already in the '%{name}' ACL") % { m: m, name: name } if @methods.include?(m)
 
       @methods << m
     end
 
     def restrict_environment(environment)
       env = Puppet.lookup(:environments).get(environment)
-      raise ArgumentError, "'#{env}' is already in the '#{name}' ACL" if @environment.include?(env)
+      raise ArgumentError, _("'%{env}' is already in the '%{name}' ACL") % { env: env, name: name } if @environment.include?(env)
 
       @environment << env
     end
@@ -201,7 +191,7 @@ class Rights
       when "no", "off", "false", false, "all" ,"any", :all, :any
         authentication = false
       else
-        raise ArgumentError, "'#{name}' incorrect authenticated value: #{authentication}"
+        raise ArgumentError, _("'%{name}' incorrect authenticated value: %{authentication}") % { name: name, authentication: authentication }
       end
       @authentication = authentication
     end

data/lib/puppet/network/server.rb

@@ -22,13 +22,13 @@ class Puppet::Network::Server
   end
 
   def start
-    raise "Cannot listen -- already listening." if listening?
+    raise _("Cannot listen -- already listening.") if listening?
     @listening = true
     @http_server.listen(address, port)
   end
 
   def stop
-    raise "Cannot unlisten -- not currently listening." unless listening?
+    raise _("Cannot unlisten -- not currently listening.") unless listening?
     @http_server.unlisten
     @listening = false
   end

data/lib/puppet/node/environment.rb

@@ -48,7 +48,7 @@ class Puppet::Node::Environment
     obj.send(:initialize,
              name.intern,
              expand_dirs(extralibs() + modulepath),
-             manifest == NO_MANIFEST ? manifest : File.expand_path(manifest),
+             manifest == NO_MANIFEST ? manifest : Puppet::FileSystem.expand_path(manifest),
              config_version)
     obj
   end
@@ -85,6 +85,7 @@ class Puppet::Node::Environment
     @modulepath = modulepath
     @manifest = manifest
     @config_version = config_version
+    @modules_strict_semver = false
   end
 
   # Creates a new Puppet::Node::Environment instance, overriding any of the passed
@@ -166,6 +167,10 @@ class Puppet::Node::Environment
   #     (optional)
   attr_reader :config_version
 
+  # Cached loaders - management of value handled by Puppet::Pops::Loaders
+  # @api private
+  attr_accessor :loaders
+
   # Checks to make sure that this environment did not have a manifest set in
   # its original environment.conf if Puppet is configured with
   # +disable_per_environment_manifest+ set true.  If it did, the environment's
@@ -179,25 +184,52 @@ class Puppet::Node::Environment
   #   Puppet[:disable_per_environment_manifest] is true, and this environment's
   #   original environment.conf had a manifest setting that is not the
   #   Puppet[:default_manifest].
-  # @api private 
+  # @api private
   def conflicting_manifest_settings?
     return false if !Puppet[:disable_per_environment_manifest]
-    environment_conf = Puppet.lookup(:environments).get_conf(name)
-    original_manifest = environment_conf.raw_setting(:manifest)
+    original_manifest = configuration.raw_setting(:manifest)
     !original_manifest.nil? && !original_manifest.empty? && original_manifest != Puppet[:default_manifest]
   end
 
+  # @api private
+  def static_catalogs?
+    if @static_catalogs.nil?
+      environment_conf = Puppet.lookup(:environments).get_conf(name)
+      @static_catalogs = (environment_conf.nil? ? Puppet[:static_catalogs] : environment_conf.static_catalogs)
+    end
+    @static_catalogs
+  end
+
+  # Return the environment configuration
+  # @return [Puppet::Settings::EnvironmentConf] The configuration
+  #
+  # @api private
+  def configuration
+    Puppet.lookup(:environments).get_conf(name)
+  end
+
   # Checks the environment and settings for any conflicts
   # @return [Array<String>] an array of validation errors
   # @api public
   def validation_errors
     errors = []
     if conflicting_manifest_settings?
-      errors << "The 'disable_per_environment_manifest' setting is true, and the '#{name}' environment has an environment.conf manifest that conflicts with the 'default_manifest' setting."
+      errors << _("The 'disable_per_environment_manifest' setting is true, and the '%{env_name}' environment has an environment.conf manifest that conflicts with the 'default_manifest' setting.") % { env_name: name }
     end
     errors
   end
 
+  # Checks if this environment permits use of rich data types in the catalog
+  # @return [Boolean] `true` if rich data is permitted.
+  # @api private
+  def rich_data?
+    if @rich_data.nil?
+      environment_conf = Puppet.lookup(:environments).get_conf(name)
+      @rich_data = (environment_conf.nil? ? Puppet[:rich_data] : environment_conf.rich_data)
+    end
+    @rich_data
+  end
+
   # Return an environment-specific Puppet setting.
   #
   # @api public
@@ -208,6 +240,22 @@ class Puppet::Node::Environment
     Puppet.settings.value(param, self.name)
   end
 
+  # A SemanticPuppet::VersionRange version >= 1.0.0 will not include versions with pre-release
+  # identifiers unless that is explicitly declared. This may cause backward compatibility
+  # issues when resolving module dependencies and the flag is therefore set to `false` by default.
+  #
+  # @param flag [Boolean] set to true to resolve module dependencies using strict SemVer semantics
+  #
+  def modules_strict_semver=(flag)
+    @modules_strict_semver = flag
+  end
+
+  # @return [Boolean] the current value of the modules_strict_semver flag.
+  # @api public
+  def modules_strict_semver?
+    @modules_strict_semver
+  end
+
   # @api public
   # @return [Puppet::Resource::TypeCollection] The current global TypeCollection
   def known_resource_types
@@ -282,7 +330,7 @@ class Puppet::Node::Environment
 
       @modules = module_references.collect do |reference|
         begin
-          Puppet::Module.new(reference[:name], reference[:path], self)
+          Puppet::Module.new(reference[:name], reference[:path], self, modules_strict_semver?)
         rescue Puppet::Module::Error => e
           Puppet.log_exception(e)
           nil
@@ -318,13 +366,17 @@ class Puppet::Node::Environment
   def modules_by_path
     modules_by_path = {}
     modulepath.each do |path|
-      Dir.chdir(path) do
-        module_names = Dir.entries(path).select do |name|
-          Puppet::Module.is_module_directory?(name, path)
-        end
-        modules_by_path[path] = module_names.sort.map do |name|
-          Puppet::Module.new(name, File.join(path, name), self)
+      if Puppet::FileSystem.exist?(path)
+        Dir.chdir(path) do
+          module_names = Dir.entries(path).select do |name|
+            Puppet::Module.is_module_directory?(name, path)
+          end
+          modules_by_path[path] = module_names.sort.map do |name|
+            Puppet::Module.new(name, File.join(path, name), self, modules_strict_semver?)
+          end
         end
+      else
+        modules_by_path[path] = []
       end
     end
     modules_by_path
@@ -438,8 +490,8 @@ class Puppet::Node::Environment
   private
 
   def self.extralibs()
-    if ENV["PUPPETLIB"]
-      split_path(ENV["PUPPETLIB"])
+    if Puppet::Util.get_env('PUPPETLIB')
+      split_path(Puppet::Util.get_env('PUPPETLIB'))
     else
       []
     end
@@ -447,7 +499,7 @@ class Puppet::Node::Environment
 
   def self.expand_dirs(dirs)
     dirs.collect do |dir|
-      File.expand_path(dir)
+      Puppet::FileSystem.expand_path(dir)
     end
   end
 
@@ -488,16 +540,20 @@ class Puppet::Node::Environment
         parser.parse
       end
     end
+  rescue Puppet::ParseErrorWithIssue => detail
+    @known_resource_types.parse_failed = true
+    detail.environment = self.name
+    raise
   rescue => detail
     @known_resource_types.parse_failed = true
 
-    msg = "Could not parse for environment #{self}: #{detail}"
+    msg = _("Could not parse for environment %{env}: %{detail}") % { env: self, detail: detail }
     error = Puppet::Error.new(msg)
     error.set_backtrace(detail.backtrace)
     raise error
   end
 
-  # Return an empty toplevel hostclass to indicate that no file was loaded
+  # Return an empty top-level hostclass to indicate that no file was loaded
   #
   # @return [Puppet::Parser::AST::Hostclass]
   def empty_parse_result

data/lib/puppet/node/facts.rb

@@ -59,7 +59,7 @@ class Puppet::Node::Facts
     end
   end
 
-  # Sanitize fact values by converting everything not a string, boolean
+  # Sanitize fact values by converting everything not a string, Boolean
   # numeric, array or hash into strings.
   def sanitize
     values.each do |fact, value|
@@ -107,11 +107,6 @@ class Puppet::Node::Facts
     @timestamp = Time.now
   end
 
-  # @deprecated Use {#values} instead of this method.
-  def strip_internal
-    values
-  end
-
   private
 
   def sanitize_fact(fact)

data/lib/puppet/node.rb

@@ -9,6 +9,9 @@ class Puppet::Node
   # the node sources.
   extend Puppet::Indirector
 
+  # Asymmetric serialization/deserialization required in this class via to/from datahash
+  include Puppet::Util::PsychSupport
+
   # Use the node source as the indirection terminus.
   indirects :node, :terminus_setting => :node_terminus, :doc => "Where to find node information.
     A node is composed of its name, its facts, and its environment."
@@ -16,20 +19,30 @@ class Puppet::Node
   attr_accessor :name, :classes, :source, :ipaddress, :parameters, :trusted_data, :environment_name
   attr_reader :time, :facts
 
-  def self.from_data_hash(data)
-    raise ArgumentError, "No name provided in serialized data" unless name = data['name']
+  attr_reader :server_facts
+
+  ENVIRONMENT = 'environment'.freeze
+
+  def initialize_from_hash(data)
+    @name       = data['name']       || (raise ArgumentError, _("No name provided in serialized data"))
+    @classes    = data['classes']    || []
+    @parameters = data['parameters'] || {}
+    env_name = data['environment']
+    env_name = env_name.intern unless env_name.nil?
+    @environment_name = env_name
+    environment = env_name
+  end
 
+  def self.from_data_hash(data)
     node = new(name)
-    node.classes = data['classes']
-    node.parameters = data['parameters']
-    node.environment_name = data['environment']
+    node.initialize_from_hash(data)
     node
   end
 
   def to_data_hash
     result = {
       'name' => name,
-      'environment' => environment.name,
+      'environment' => environment.name.to_s,
     }
     result['classes'] = classes unless classes.empty?
     result['parameters'] = parameters unless parameters.empty?
@@ -40,7 +53,7 @@ class Puppet::Node
     if @environment
       @environment
     else
-      if env = parameters["environment"]
+      if env = parameters[ENVIRONMENT]
         self.environment = env
       elsif environment_name
         self.environment = environment_name
@@ -62,6 +75,13 @@ class Puppet::Node
     else
       @environment = env
     end
+
+    # Keep environment_name attribute and parameter in sync if they have been set
+    unless @environment.nil?
+      @parameters[ENVIRONMENT] = @environment.name.to_s if @parameters.include?(ENVIRONMENT)
+      self.environment_name = @environment.name if instance_variable_defined?(:@environment_name)
+    end
+    @environment
   end
 
   def has_environment_instance?
@@ -69,7 +89,7 @@ class Puppet::Node
   end
 
   def initialize(name, options = {})
-    raise ArgumentError, "Node names cannot be nil" unless name
+    raise ArgumentError, _("Node names cannot be nil") unless name
     @name = name
 
     if classes = options[:classes]
@@ -86,6 +106,8 @@ class Puppet::Node
 
     @facts = options[:facts]
 
+    @server_facts = {}
+
     if env = options[:environment]
       self.environment = env
     end
@@ -94,24 +116,45 @@ class Puppet::Node
   end
 
   # Merge the node facts with parameters from the node source.
-  def fact_merge
-    if @facts = Puppet::Node::Facts.indirection.find(name, :environment => environment)
+  # @api public
+  # @param facts [optional, Puppet::Node::Facts] facts to merge into node parameters.
+  #   Will query Facts indirection if not supplied.
+  # @raise [Puppet::Error] Raise on failure to retrieve facts if not supplied
+  # @return [nil]
+  def fact_merge(facts = nil)
+    begin
+      @facts = facts.nil? ? Puppet::Node::Facts.indirection.find(name, :environment => environment) : facts
+    rescue => detail
+      error = Puppet::Error.new(_("Could not retrieve facts for %{name}: %{detail}") % { name: name, detail: detail }, detail)
+      error.set_backtrace(detail.backtrace)
+      raise error
+    end
+
+    if !@facts.nil?
       @facts.sanitize
       merge(@facts.values)
     end
-  rescue => detail
-    error = Puppet::Error.new("Could not retrieve facts for #{name}: #{detail}")
-    error.set_backtrace(detail.backtrace)
-    raise error
   end
 
   # Merge any random parameters into our parameter list.
   def merge(params)
     params.each do |name, value|
-      @parameters[name] = value unless @parameters.include?(name)
+      if @parameters.include?(name)
+        Puppet::Util::Warnings.warnonce(_("The node parameter '%{param_name}' for node '%{node_name}' was already set to '%{value}'. It could not be set to '%{desired_value}'") % { param_name: name, node_name: @name, value: @parameters[name], desired_value: value })
+      else
+        @parameters[name] = value
+      end
     end
 
-    @parameters["environment"] ||= self.environment.name.to_s
+    @parameters[ENVIRONMENT] ||= self.environment.name.to_s
+  end
+
+  def add_server_facts(facts)
+    # Append the current environment to the list of server facts
+    @server_facts = facts.merge({ "environment" => self.environment.name.to_s})
+
+    # Merge the server facts into the parameters for the node
+    merge(facts)
   end
 
   # Calculate the list of names we might use for looking
@@ -128,7 +171,7 @@ class Puppet::Node
       if parameters["hostname"] and parameters["domain"]
         fqdn = parameters["hostname"] + "." + parameters["domain"]
       else
-        Puppet.warning "Host is missing hostname and/or domain: #{name}"
+        Puppet.warning _("Host is missing hostname and/or domain: %{name}") % { name: name }
       end
     end
 
@@ -160,7 +203,7 @@ class Puppet::Node
   # Ensures the data is frozen
   #
   def trusted_data=(data)
-    Puppet.warning("Trusted node data modified for node #{name}") unless @trusted_data.nil?
+    Puppet.warning(_("Trusted node data modified for node %{name}") % { name: name }) unless @trusted_data.nil?
     @trusted_data = data.freeze
   end
 end

data/lib/puppet/parameter/boolean.rb

@@ -1,6 +1,6 @@
 require 'puppet/coercion'
 
-# This specialized {Puppet::Parameter} handles boolean options, accepting lots
+# This specialized {Puppet::Parameter} handles Boolean options, accepting lots
 # of strings and symbols for both truthiness and falsehood.
 #
 class Puppet::Parameter::Boolean < Puppet::Parameter

data/lib/puppet/parameter/package_options.rb

@@ -19,7 +19,7 @@ class Puppet::Parameter::PackageOptions < Puppet::Parameter
       when String
         quote(val)
       else
-        fail("Expected either a string or hash of options")
+        fail(_("Expected either a string or hash of options"))
       end
     end
   end

data/lib/puppet/parameter/path.rb

@@ -24,10 +24,10 @@ class Puppet::Parameter::Path < Puppet::Parameter
   #
   def validate_path(paths)
     if paths.is_a?(Array) and ! self.class.arrays? then
-      fail "#{name} only accepts a single path, not an array of paths"
+      fail _("%{name} only accepts a single path, not an array of paths") % { name: name }
     end
 
-    fail("#{name} must be a fully qualified path") unless Array(paths).all? {|path| absolute_path?(path)}
+    fail(_("%{name} must be a fully qualified path") % { name: name }) unless Array(paths).all? {|path| absolute_path?(path)}
 
     paths
   end
@@ -50,7 +50,7 @@ class Puppet::Parameter::Path < Puppet::Parameter
   # @raise [Puppet::Error] if the given paths does not comply with the on/many paths rule.
   def unsafe_munge(paths)
     if paths.is_a?(Array) and ! self.class.arrays? then
-      fail "#{name} only accepts a single path, not an array of paths"
+      fail _("%{name} only accepts a single path, not an array of paths") % { name: name }
     end
     paths
   end

data/lib/puppet/parameter/value.rb

@@ -11,7 +11,7 @@ class Puppet::Parameter::Value
 
   # Adds an alias for this value.
   # Makes the given _name_ be an alias for this acceptable value.
-  # @param name [Symbol] the additonal alias this value should be known as
+  # @param name [Symbol] the additional alias this value should be known as
   # @api private
   #
   def alias(name)

data/lib/puppet/parameter/value_collection.rb

@@ -133,7 +133,7 @@ class Puppet::Parameter::ValueCollection
     call_opt = options[:call]
     unless call_opt.nil?
       devfail "Cannot use obsolete :call value '#{call_opt}' for property '#{self.class.name}'" unless call_opt == :none || call_opt == :instead
-      Puppet.deprecation_warning("Property option :call is deprecated and no longer used. Please remove it.")
+      Puppet.deprecation_warning(_("Property option :call is deprecated and no longer used. Please remove it."))
       options = options.reject { |k,v| k == :call }
     end
 
@@ -181,11 +181,11 @@ class Puppet::Parameter::ValueCollection
     return if empty?
 
     unless @values.detect { |name, v| v.match?(value) }
-      str = "Invalid value #{value.inspect}. "
+      str = _("Invalid value %{value}. ") % { value: value.inspect }
 
-      str += "Valid values are #{values.join(", ")}. " unless values.empty?
+      str += _("Valid values are %{value_list}. ") % { value_list: values.join(", ") } unless values.empty?
 
-      str += "Valid values match #{regexes.join(", ")}." unless regexes.empty?
+      str += _("Valid values match %{pattern}.") % { pattern: regexes.join(", ") } unless regexes.empty?
 
       raise ArgumentError, str
     end

data/lib/puppet/parameter.rb

@@ -295,6 +295,10 @@ class Puppet::Parameter
   #
   attr_accessor :parent
 
+  # @!attribute [rw] sensitive
+  #   @return [true, false] If this parameter has been tagged as sensitive.
+  attr_accessor :sensitive
+
   # Returns a string representation of the resource's containment path in
   # the catalog.
   # @return [String]
@@ -376,7 +380,7 @@ class Puppet::Parameter
     tmp
   end
 
-  # Returns an array of strings representing the containment heirarchy
+  # Returns an array of strings representing the containment hierarchy
   # (types/classes) that make up the path to the resource from the root
   # of the catalog.  This is mostly used for logging purposes.
   #
@@ -479,7 +483,7 @@ class Puppet::Parameter
   #   calls both validate and munge on the given value, so no late binding.
   #
   # The given value is validated and then munged (if munging has been specified). The result is store
-  # as the value of this arameter.
+  # as the value of this parameter.
   # @return [Object] The given `value` after munging.
   # @raise (see #validate)
   #
@@ -501,7 +505,7 @@ class Puppet::Parameter
 
   # @return [Array<Symbol>] Returns an array of the associated resource's symbolic tags (including the parameter itself).
   # Returns an array of the associated resource's symbolic tags (including the parameter itself).
-  # At a minimun, the array contains the name of the parameter. If the associated resource
+  # At a minimum, the array contains the name of the parameter. If the associated resource
   # has tags, these tags are also included in the array.
   # @todo The original comment says = _"The properties need to return tags so that logs correctly
   #   collect them."_ what if anything of that is of interest to document. Should tags and their relationship
@@ -522,40 +526,31 @@ class Puppet::Parameter
     name.to_s
   end
 
-  # Produces a String with the value formatted for display to a human.
-  # When the parameter value is a:
+  # Formats the given string and conditionally redacts the provided interpolation variables, depending on if
+  # this property is sensitive.
   #
-  # * **single valued parameter value** the result is produced on the
-  #   form `'value'` where _value_ is the string form of the parameter's value.
+  # @note Because the default implementation of Puppet::Property#is_to_s returns the current value as-is, it
+  #   doesn't necessarily return a string. For the sake of sanity we just cast everything to a string for
+  #   interpolation so we don't introduce issues with unexpected property values.
   #
-  # * **Array** the list of values is enclosed in `[]`, and
-  #   each produced value is separated by a comma.
+  # @see String#format
+  # @param fmt [String] The format string to interpolate.
+  # @param args [Array<String>] One or more strings to conditionally redact and interpolate into the format string.
   #
-  # * **Hash** value is output with keys in sorted order enclosed in `{}` with each entry formatted
-  #   on the form `'k' => v` where
-  #   `k` is the key in string form and _v_ is the value of the key. Entries are comma separated.
+  # @return [String]
+  def format(fmt, *args)
+    fmt % args.map { |arg| @sensitive ? "[redacted]" : arg.to_s }
+  end
+
+  # Produces a String with the value formatted for display to a human.
   #
-  # For both Array and Hash this method is called recursively to format contained values.
-  # @note this method does not protect against infinite structures.
+  # The output is created using the StringConverter with format '%#p' to produce
+  # human readable code that is understood by puppet.
   #
   # @return [String] The formatted value in string form.
   #
   def self.format_value_for_display(value)
-    if value.is_a? Array
-      formatted_values = value.collect {|v| format_value_for_display(v)}.join(', ')
-      "[#{formatted_values}]"
-    elsif value.is_a? Hash
-      # Sorting the hash keys for display is largely for having stable
-      # output to test against, but also helps when scanning for hash
-      # keys, since they will be in ASCIIbetical order.
-      hash = value.keys.sort {|a,b| a.to_s <=> b.to_s}.collect do |k|
-        "'#{k}' => #{format_value_for_display(value[k])}"
-      end.join(', ')
-
-      "{#{hash}}"
-    else
-      "'#{value}'"
-    end
+    Puppet::Pops::Types::StringConverter.convert(value, Puppet::Pops::Types::StringConverter::DEFAULT_PARAMETER_FORMAT)
   end
 
   # @comment Document post_compile_hook here as it does not exist anywhere (called from type if implemented)