puppet 4.1.0 → 4.10.0

data/lib/puppet/type/augeas.rb

@@ -5,7 +5,7 @@
 #   you may not use this file except in compliance with the License.
 #   You may obtain a copy of the License at
 #
-#       http://www.apache.org/licenses/LICENSE-2.0
+#       https://www.apache.org/licenses/LICENSE-2.0
 #
 #   Unless required by applicable law or agreed to in writing, software
 #   distributed under the License is distributed on an "AS IS" BASIS,
@@ -73,9 +73,17 @@ Puppet::Type.newtype(:augeas) do
 
   newparam (:onlyif) do
     desc "Optional augeas command and comparisons to control the execution of this type.
+
+      Note: `values` is not an actual augeas API command. It calls `match` to retrieve an array of paths
+             in <MATCH_PATH> and then `get` to retrieve the values from each of the returned paths.
+
       Supported onlyif syntax:
 
       * `get <AUGEAS_PATH> <COMPARATOR> <STRING>`
+      * `values <MATCH_PATH> include <STRING>`
+      * `values <MATCH_PATH> not_include <STRING>`
+      * `values <MATCH_PATH> == <AN_ARRAY>`
+      * `values <MATCH_PATH> != <AN_ARRAY>`
       * `match <MATCH_PATH> size <COMPARATOR> <INT>`
       * `match <MATCH_PATH> include <STRING>`
       * `match <MATCH_PATH> not_include <STRING>`
@@ -98,7 +106,7 @@ Puppet::Type.newtype(:augeas) do
     desc "The changes which should be applied to the filesystem. This
     can be a command or an array of commands. The following commands are supported:
 
-    * `set <PATH> <VALUE>` --- Sets the value `VALUE` at loction `PATH`
+    * `set <PATH> <VALUE>` --- Sets the value `VALUE` at location `PATH`
     * `setm <PATH> <SUB> <VALUE>` --- Sets multiple nodes (matching `SUB` relative to `PATH`) to `VALUE`
     * `rm <PATH>` --- Removes the node at location `PATH`
     * `remove <PATH>` --- Synonym for `rm`
@@ -109,6 +117,7 @@ Puppet::Type.newtype(:augeas) do
     * `insert <LABEL> <WHERE> <PATH>` --- Synonym for `ins`
     * `mv <PATH> <OTHER PATH>` --- Moves a node at `PATH` to the new location `OTHER PATH`
     * `move <PATH> <OTHER PATH>` --- Synonym for `mv`
+    * `rename <PATH> <LABEL>` --- Rename a node at `PATH` to a new `LABEL`
     * `defvar <NAME> <PATH>` --- Sets Augeas variable `$NAME` to `PATH`
     * `defnode <NAME> <PATH> <VALUE>` --- Sets Augeas variable `$NAME` to `PATH`, creating it with `VALUE` if needed
 
@@ -128,7 +137,7 @@ Puppet::Type.newtype(:augeas) do
 
   newparam(:force) do
     desc "Optional command to force the augeas type to execute even if it thinks changes
-    will not be made. This does not overide the `onlyif` parameter."
+    will not be made. This does not override the `onlyif` parameter."
 
     defaultto false
   end
@@ -183,7 +192,7 @@ Puppet::Type.newtype(:augeas) do
     end
 
     # if the onlyif resource is provided, then the value is parsed.
-    # a return value of 0 will stop exection because it matches the
+    # a return value of 0 will stop execution because it matches the
     # default value.
     def retrieve
       if @resource.provider.need_to_run?()

data/lib/puppet/type/component.rb

@@ -71,6 +71,17 @@ Puppet::Type.newtype(:component) do
     reference.to_s
   end
 
+  # Overrides the default implementation to do nothing.
+  # This type contains data from class/define parameters, but does
+  # not have actual parameters or properties at the Type level. We can
+  # simply ignore anything flagged as sensitive here, since any
+  # contained resources will handle that sensitivity themselves. There
+  # is no risk of this information leaking into reports, since no
+  # Component instances survive the graph transmutation.
+  #
+  def set_sensitive_parameters(sensitive_parameters)
+  end
+
   private
 
   attr_reader :reference

data/lib/puppet/type/cron.rb

@@ -18,29 +18,29 @@ Puppet::Type.newtype(:cron) do
 
     Example:
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
           hour    => 2,
-          minute  => 0
+          minute  => 0,
         }
 
     Note that all periodic attributes can be specified as an array of values:
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
-          hour    => [2, 4]
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
+          hour    => [2, 4],
         }
 
     ...or using ranges or the step syntax `*/2` (although there's no guarantee
     that your `cron` daemon supports these):
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
           hour    => ['2-4'],
-          minute  => '*/10'
+          minute  => '*/10',
         }
 
     An important note: _the Cron type will not reset parameters that are
@@ -446,7 +446,7 @@ Puppet::Type.newtype(:cron) do
   # @api public
   #
   # @note This overrides the Puppet::Type method in order to handle
-  #   an edge case that has so far been observed during testig only.
+  #   an edge case that has so far been observed during testing only.
   #   Without forcing the should-value for the user property to be
   #   identical to the original cron file, purging from a fixture
   #   will not work, because the user property defaults to the user

data/lib/puppet/type/exec.rb

@@ -157,7 +157,12 @@ module Puppet
         end
 
         unless self.should.include?(@status.exitstatus.to_s)
-          self.fail("#{self.resource[:command]} returned #{@status.exitstatus} instead of one of [#{self.should.join(",")}]")
+          if @resource.parameter(:command).sensitive
+            # Don't print sensitive commands in the clear
+            self.fail("[command redacted] returned #{@status.exitstatus} instead of one of [#{self.should.join(",")}]")
+          else
+            self.fail("'#{self.resource[:command]}' returned #{@status.exitstatus} instead of one of [#{self.should.join(",")}]")
+          end
         end
 
         event
@@ -340,15 +345,15 @@ module Puppet
         other object; it is useful for triggering an action:
 
             # Pull down the main aliases file
-            file { "/etc/aliases":
-              source => "puppet://server/module/aliases"
+            file { '/etc/aliases':
+              source => 'puppet://server/module/aliases',
             }
 
             # Rebuild the database, but only when the file changes
             exec { newaliases:
-              path        => ["/usr/bin", "/usr/sbin"],
-              subscribe   => File["/etc/aliases"],
-              refreshonly => true
+              path        => ['/usr/bin', '/usr/sbin'],
+              subscribe   => File['/etc/aliases'],
+              refreshonly => true,
             }
 
         Note that only `subscribe` and `notify` can trigger actions, not `require`,
@@ -377,10 +382,10 @@ module Puppet
         This parameter doesn't cause Puppet to create a file; it is only
         useful if **the command itself** creates a file.
 
-            exec { "tar -xf /Volumes/nfs02/important.tar":
-              cwd     => "/var/tmp",
-              creates => "/var/tmp/myfile",
-              path    => ["/usr/bin", "/usr/sbin"]
+            exec { 'tar -xf /Volumes/nfs02/important.tar':
+              cwd     => '/var/tmp',
+              creates => '/var/tmp/myfile',
+              path    => ['/usr/bin', '/usr/sbin',],
             }
 
         In this example, `myfile` is assumed to be a file inside
@@ -404,18 +409,25 @@ module Puppet
         If this parameter is set, then this `exec` will run unless
         the command has an exit code of 0.  For example:
 
-            exec { "/bin/echo root >> /usr/lib/cron/cron.allow":
-              path   => "/usr/bin:/usr/sbin:/bin",
-              unless => "grep root /usr/lib/cron/cron.allow 2>/dev/null"
+            exec { '/bin/echo root >> /usr/lib/cron/cron.allow':
+              path   => '/usr/bin:/usr/sbin:/bin',
+              unless => 'grep root /usr/lib/cron/cron.allow 2>/dev/null',
             }
 
         This would add `root` to the cron.allow file (on Solaris) unless
         `grep` determines it's already there.
 
         Note that this command follows the same rules as the main command,
-        which is to say that it must be fully qualified if the path is not set.
+        such as which user and group it's run as.
+        This also means it must be fully qualified if the path is not set.
         It also uses the same provider as the main command, so any behavior
         that differs by provider will match.
+
+        Also note that unless can take an array as its value, e.g.:
+
+            unless => ['test -f /tmp/file1', 'test -f /tmp/file2'],
+
+        This will only run the exec if _all_ conditions in the array return false.
       EOT
 
       validate do |cmds|
@@ -448,21 +460,23 @@ module Puppet
         If this parameter is set, then this `exec` will only run if
         the command has an exit code of 0.  For example:
 
-            exec { "logrotate":
-              path   => "/usr/bin:/usr/sbin:/bin",
-              onlyif => "test `du /var/log/messages | cut -f1` -gt 100000"
+            exec { 'logrotate':
+              path   => '/usr/bin:/usr/sbin:/bin',
+              onlyif => 'test `du /var/log/messages | cut -f1` -gt 100000',
             }
 
         This would run `logrotate` only if that test returned true.
 
         Note that this command follows the same rules as the main command,
-        which is to say that it must be fully qualified if the path is not set.
+        such as which user and group it's run as.
+        This also means it must be fully qualified if the path is not set.
+
         It also uses the same provider as the main command, so any behavior
         that differs by provider will match.
 
         Also note that onlyif can take an array as its value, e.g.:
 
-            onlyif => ["test -f /tmp/file1", "test -f /tmp/file2"]
+            onlyif => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
         This will only run the exec if _all_ conditions in the array return true.
       EOT
@@ -588,5 +602,15 @@ module Puppet
     def current_username
       Etc.getpwuid(Process.uid).name
     end
+
+    private
+    def set_sensitive_parameters(sensitive_parameters)
+      # Respect sensitive commands
+      if sensitive_parameters.include?(:command)
+        sensitive_parameters.delete(:command)
+        parameter(:command).sensitive = true
+      end
+      super(sensitive_parameters)
+    end
   end
 end

data/lib/puppet/type/file/checksum.rb

@@ -16,6 +16,7 @@ Puppet::Type.type(:file).newparam(:checksum) do
   end
 
   def sum(content)
+    content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
     type = digest_algorithm()
     "{#{type}}" + send(type, content)
   end

data/lib/puppet/type/file/checksum_value.rb

@@ -0,0 +1,53 @@
+require 'puppet/util/checksums'
+require 'puppet/type/file/data_sync'
+
+module Puppet
+  Puppet::Type.type(:file).newproperty(:checksum_value) do
+    include Puppet::Util::Checksums
+    include Puppet::DataSync
+
+    desc "The checksum of the source contents. Only md5 and sha256 are supported when
+      specifying this parameter. If this parameter is set, source_permissions will be
+      assumed to be false, and ownership and permissions will not be read from source."
+
+    def insync?(is)
+      # If checksum_value and source are specified, manage the file contents.
+      # Otherwise the content property will manage syncing.
+      if resource.parameter(:source).nil?
+        return true
+      end
+
+      checksum_insync?(resource.parameter(:source), is, true) {|_is| super(_is)}
+    end
+
+    def property_matches?(current, desired)
+      return true if super(current, desired)
+      return date_matches?(resource.parameter(:checksum).value, current, desired)
+    end
+
+    def retrieve
+      # If checksum_value and source are specified, manage the file contents.
+      # Otherwise the content property will manage syncing. Don't compute the checksum twice.
+      if resource.parameter(:source).nil?
+        return nil
+      end
+
+      result = retrieve_checksum(resource)
+      # If the returned type matches the util/checksums format (prefixed with the type),
+      # strip the checksum type.
+      result = sumdata(result) if checksum?(result)
+      result
+    end
+
+    def sync
+      if resource.parameter(:source).nil?
+        devfail "checksum_value#sync should not be called without a source parameter"
+      end
+
+      # insync? only returns false if it expects to manage the file content,
+      # so instruct the resource to write its contents.
+      contents_sync(resource.parameter(:source))
+    end
+
+  end
+end

data/lib/puppet/type/file/content.rb

@@ -1,18 +1,14 @@
 require 'net/http'
 require 'uri'
 require 'tempfile'
-require 'date'
 
 require 'puppet/util/checksums'
-require 'puppet/network/http'
-require 'puppet/network/http/api/indirected_routes'
-require 'puppet/network/http/compression'
+require 'puppet/type/file/data_sync.rb'
 
 module Puppet
   Puppet::Type.type(:file).newproperty(:content) do
-    include Puppet::Util::Diff
     include Puppet::Util::Checksums
-    include Puppet::Network::HTTP::Compression.module
+    include Puppet::DataSync
 
     attr_reader :actual_content
 
@@ -27,20 +23,20 @@ module Puppet
       the manifest...
 
           define resolve(nameserver1, nameserver2, domain, search) {
-              $str = "search $search
-                  domain $domain
-                  nameserver $nameserver1
-                  nameserver $nameserver2
+              $str = "search ${search}
+                  domain ${domain}
+                  nameserver ${nameserver1}
+                  nameserver ${nameserver2}
                   "
 
-              file { "/etc/resolv.conf":
-                content => "$str",
+              file { '/etc/resolv.conf':
+                content => $str,
               }
           }
 
       ...but for larger files, this attribute is more useful when combined with the
-      [template](http://docs.puppetlabs.com/references/latest/function.html#template)
-      or [file](http://docs.puppetlabs.com/references/latest/function.html#file)
+      [template](https://docs.puppetlabs.com/puppet/latest/reference/function.html#template)
+      or [file](https://docs.puppetlabs.com/puppet/latest/reference/function.html#file)
       function.
     EOT
 
@@ -49,13 +45,13 @@ module Puppet
     munge do |value|
       if value == :absent
         value
-      elsif checksum?(value)
+      elsif value.is_a?(String) && checksum?(value)
         # XXX This is potentially dangerous because it means users can't write a file whose
-        # entire contents are a plain checksum
+        # entire contents are a plain checksum unless it is a Binary content.
         value
       else
-        @actual_content = value
-        resource.parameter(:checksum).sum(value)
+        @actual_content = value.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? value.binary_buffer : value
+        resource.parameter(:checksum).sum(@actual_content)
       end
     end
 
@@ -86,53 +82,29 @@ module Puppet
     # Also, fix #872: when content is used, and replace is true, the file
     # should be insync when it exists
     def insync?(is)
-      if resource.should_be_file?
-        return false if is == :absent
-      else
-        if resource[:ensure] == :present and resource[:content] and s = resource.stat
-          resource.warning "Ensure set to :present but file type is #{s.ftype} so no content will be synced"
-        end
-        return true
+      if resource[:source] && resource[:checksum_value]
+        # Asserts that nothing has changed since validate ran.
+        devfail "content property should not exist if source and checksum_value are specified"
       end
 
-      return true if ! @resource.replace?
-
-      result = super
-
-      if ! result and Puppet[:show_diff] and resource.show_diff?
-        write_temporarily do |path|
-          send @resource[:loglevel], "\n" + diff(@resource[:path], path)
-        end
-      end
-      result
+      contents_prop = resource.parameter(:source) || self
+      checksum_insync?(contents_prop, is, !resource[:content].nil?) {|_is| super(_is)}
     end
 
     def property_matches?(current, desired)
-      basic = super
-      # The inherited equality is always accepted, so use it if valid.
-      time_types = [:mtime, :ctime]
+      # If checksum_value is specified, it overrides comparing the content field.
       checksum_type = resource.parameter(:checksum).value
-      return basic if basic || !time_types.include?(checksum_type)
-      return false unless current && desired
-      begin
-        raise if !time_types.include?(sumtype(current).to_sym) || !time_types.include?(sumtype(desired).to_sym)
-        DateTime.parse(sumdata(current)) >= DateTime.parse(sumdata(desired))
-      rescue => detail
-        self.fail Puppet::Error, "Resource with checksum_type #{checksum_type} didn't contain a date in #{current} or #{desired}", detail.backtrace
+      if checksum_value = resource.parameter(:checksum_value)
+        desired = "{#{checksum_type}}#{checksum_value.value}"
       end
+
+      # The inherited equality is always accepted, so use it if valid.
+      return true if super(current, desired)
+      return date_matches?(checksum_type, current, desired)
     end
 
     def retrieve
-      return :absent unless stat = @resource.stat
-      ftype = stat.ftype
-      # Don't even try to manage the content on directories or links
-      return nil if ["directory","link"].include?(ftype)
-
-      begin
-        resource.parameter(:checksum).sum_file(resource[:path])
-      rescue => detail
-        raise Puppet::Error, "Could not read #{ftype} #{@resource.title}: #{detail}", detail.backtrace
-      end
+      retrieve_checksum(resource)
     end
 
     # Make sure we're also managing the checksum property.
@@ -146,93 +118,36 @@ module Puppet
 
     # Just write our content out to disk.
     def sync
-      return_event = @resource.stat ? :file_changed : :file_created
-
-      # We're safe not testing for the 'source' if there's no 'should'
-      # because we wouldn't have gotten this far if there weren't at least
-      # one valid value somewhere.
-      @resource.write(:content)
-
-      return_event
-    end
-
-    def write_temporarily
-      tempfile = Tempfile.new("puppet-file")
-      tempfile.open
-
-      write(tempfile)
-
-      tempfile.close
-
-      yield tempfile.path
-
-      tempfile.delete
+      contents_sync(resource.parameter(:source) || self)
     end
 
     def write(file)
       resource.parameter(:checksum).sum_stream { |sum|
-        each_chunk_from(actual_content || resource.parameter(:source)) { |chunk|
+        each_chunk_from { |chunk|
           sum << chunk
           file.print chunk
         }
       }
     end
 
+    private
+
     # the content is munged so if it's a checksum source_or_content is nil
     # unless the checksum indirectly comes from source
-    def each_chunk_from(source_or_content)
-      if source_or_content.is_a?(String)
-        yield source_or_content
-      elsif content_is_really_a_checksum? && source_or_content.nil?
+    def each_chunk_from
+      if actual_content.is_a?(String)
+        yield actual_content
+      elsif content_is_really_a_checksum? && actual_content.nil?
         yield read_file_from_filebucket
-      elsif source_or_content.nil?
+      elsif actual_content.nil?
         yield ''
-      elsif Puppet[:default_file_terminus] == :file_server
-        yield source_or_content.content
-      elsif source_or_content.local?
-        chunk_file_from_disk(source_or_content) { |chunk| yield chunk }
-      else
-        chunk_file_from_source(source_or_content) { |chunk| yield chunk }
       end
     end
 
-    private
-
     def content_is_really_a_checksum?
       checksum?(should)
     end
 
-    def chunk_file_from_disk(source_or_content)
-      File.open(source_or_content.full_path, "rb") do |src|
-        while chunk = src.read(8192)
-          yield chunk
-        end
-      end
-    end
-
-    def get_from_source(source_or_content, &block)
-      source = source_or_content.metadata.source
-      request = Puppet::Indirector::Request.new(:file_content, :find, source, nil, :environment => resource.catalog.environment_instance)
-
-      request.do_request(:fileserver) do |req|
-        connection = Puppet::Network::HttpPool.http_instance(req.server, req.port)
-        connection.request_get(Puppet::Network::HTTP::API::IndirectedRoutes.request_to_uri(req), add_accept_encoding({"Accept" => "binary"}), &block)
-      end
-    end
-
-
-    def chunk_file_from_source(source_or_content)
-      get_from_source(source_or_content) do |response|
-        case response.code
-        when /^2/;  uncompress(response) { |uncompressor| response.read_body { |chunk| yield uncompressor.uncompress(chunk) } }
-        else
-          # Raise the http error if we didn't get a 'success' of some kind.
-          message = "Error #{response.code} on SERVER: #{(response.body||'').empty? ? response.message : uncompress_body(response)}"
-          raise Net::HTTPError.new(message, response)
-        end
-      end
-    end
-
     def read_file_from_filebucket
       raise "Could not get filebucket from file" unless dipper = resource.bucket
       sum = should.sub(/\{\w+\}/, '')

data/lib/puppet/type/file/data_sync.rb

@@ -0,0 +1,92 @@
+require 'puppet/util/checksums'
+require 'puppet/util/diff'
+require 'date'
+require 'tempfile'
+
+module Puppet
+  module DataSync
+    include Puppet::Util::Checksums
+    include Puppet::Util::Diff
+
+    def write_temporarily(param)
+      tempfile = Tempfile.new("puppet-file")
+      tempfile.open
+
+      param.write(tempfile)
+
+      tempfile.close
+
+      yield tempfile.path
+    ensure
+      tempfile.delete if tempfile
+    end
+
+    def checksum_insync?(param, is, has_contents, &block)
+      resource = param.resource
+      if resource.should_be_file?
+        return false if is == :absent
+      else
+        if resource[:ensure] == :present && has_contents && (s = resource.stat)
+          resource.warning "Ensure set to :present but file type is #{s.ftype} so no content will be synced"
+        end
+        return true
+      end
+
+      return true if ! resource.replace?
+
+      is_insync = yield(is)
+
+      if show_diff?(!is_insync)
+        if param.sensitive
+          send resource[:loglevel], "[diff redacted]"
+        else
+          write_temporarily(param) do |path|
+            send resource[:loglevel], "\n" + diff(resource[:path], path)
+          end
+        end
+      end
+      is_insync
+    end
+
+    def show_diff?(has_changes)
+      has_changes && Puppet[:show_diff] && resource.show_diff?
+    end
+
+    def date_matches?(checksum_type, current, desired)
+      time_types = [:mtime, :ctime]
+      return false if !time_types.include?(checksum_type)
+      return false unless current && desired
+
+      begin
+        if checksum?(current) || checksum?(desired)
+          raise if !time_types.include?(sumtype(current).to_sym) || !time_types.include?(sumtype(desired).to_sym)
+          current = sumdata(current)
+          desired = sumdata(desired)
+        end
+        DateTime.parse(current) >= DateTime.parse(desired)
+      rescue => detail
+        self.fail Puppet::Error, "Resource with checksum_type #{checksum_type} didn't contain a date in #{current} or #{desired}", detail.backtrace
+      end
+    end
+
+    def retrieve_checksum(resource)
+      return :absent unless stat = resource.stat
+      ftype = stat.ftype
+      # Don't even try to manage the content on directories or links
+      return nil if ["directory","link"].include?(ftype)
+
+      begin
+        resource.parameter(:checksum).sum_file(resource[:path])
+      rescue => detail
+        raise Puppet::Error, "Could not read #{ftype} #{resource.title}: #{detail}", detail.backtrace
+      end
+    end
+
+    def contents_sync(param)
+      return_event = param.resource.stat ? :file_changed : :file_created
+      resource.write(param)
+      return_event
+    end
+
+  end
+end