puppet 4.1.0 → 4.10.0

data/lib/puppet/provider/group/directoryservice.rb

@@ -9,4 +9,14 @@ Puppet::Type.type(:group).provide :directoryservice, :parent => Puppet::Provider
   confine :operatingsystem => :darwin
   defaultfor :operatingsystem => :darwin
   has_feature :manages_members
+
+  def members_insync?(current, should)
+    return false unless current
+    if current == :absent
+      return should.empty?
+    else
+      return current.sort.uniq == should.sort.uniq
+    end
+  end
+
 end

data/lib/puppet/provider/group/pw.rb

@@ -7,6 +7,7 @@ Puppet::Type.type(:group).provide :pw, :parent => Puppet::Provider::NameService:
   has_features :manages_members
 
   defaultfor :operatingsystem => [:freebsd, :dragonfly]
+  confine    :operatingsystem => [:freebsd, :dragonfly]
 
   options :members, :flag => "-M", :method => :mem
 

data/lib/puppet/provider/group/windows_adsi.rb

@@ -27,10 +27,13 @@ Puppet::Type.type(:group).provide :windows_adsi do
     current_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current)
     specified_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
 
+    current_sids = current_users.keys.to_a
+    specified_sids = specified_users.keys.to_a
+
     if @resource[:auth_membership]
-      current_users == specified_users
+      current_sids.sort == specified_sids.sort
     else
-      (specified_users.keys.to_a & current_users.keys.to_a) == specified_users.keys.to_a
+      (specified_sids & current_sids) == specified_sids
     end
   end
 
@@ -38,17 +41,26 @@ Puppet::Type.type(:group).provide :windows_adsi do
     return '' if users.nil? or !users.kind_of?(Array)
     users = users.map do |user_name|
       sid = Puppet::Util::Windows::SID.name_to_sid_object(user_name)
+      if !sid
+        resource.debug("#{user_name} (unresolvable to SID)")
+        next user_name
+      end
+
       if sid.account =~ /\\/
         account, _ = Puppet::Util::Windows::ADSI::User.parse_name(sid.account)
       else
         account = sid.account
       end
-      resource.debug("#{sid.domain}\\#{account} (#{sid.to_s})")
+      resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
       "#{sid.domain}\\#{account}"
     end
     return users.join(',')
   end
 
+  def member_valid?(user_name)
+    ! Puppet::Util::Windows::SID.name_to_sid_object(user_name).nil?
+  end
+
   def group
     @group ||= Puppet::Util::Windows::ADSI::Group.new(@resource[:name])
   end

data/lib/puppet/provider/macauthorization/macauthorization.rb

@@ -1,5 +1,5 @@
 require 'facter'
-require 'plist'
+require 'puppet/util/plist' if Puppet.features.cfpropertylist?
 require 'puppet'
 require 'tempfile'
 
@@ -12,6 +12,7 @@ Puppet::Type.type(:macauthorization).provide :macauthorization, :parent => Puppe
   commands :security => "/usr/bin/security"
 
   confine :operatingsystem => :darwin
+  confine :feature         => :cfpropertylist
 
   defaultfor :operatingsystem => :darwin
 
@@ -50,7 +51,7 @@ Puppet::Type.type(:macauthorization).provide :macauthorization, :parent => Puppe
     end
 
     def populate_rules_rights
-      auth_plist = Plist::parse_xml(AuthDB)
+      auth_plist = Puppet::Util::Plist.parse_plist(AuthDB)
       raise Puppet::Error.new("Cannot parse: #{AuthDB}") if not auth_plist
       self.rights = auth_plist["rights"].dup
       self.rules = auth_plist["rules"].dup
@@ -124,12 +125,12 @@ Puppet::Type.type(:macauthorization).provide :macauthorization, :parent => Puppe
   end
 
   def destroy_rule
-    authdb = Plist::parse_xml(AuthDB)
+    authdb = Puppet::Util::Plist.parse_plist(AuthDB)
     authdb_rules = authdb["rules"].dup
     if authdb_rules[resource[:name]]
       begin
         authdb["rules"].delete(resource[:name])
-        Plist::Emit.save_plist(authdb, AuthDB)
+        Puppet::Util::Plist.write_plist_file(authdb, AuthDB)
       rescue Errno::EACCES => e
         raise Puppet::Error.new("Error saving #{AuthDB}: #{e}", e)
       end
@@ -140,11 +141,11 @@ Puppet::Type.type(:macauthorization).provide :macauthorization, :parent => Puppe
     # first we re-read the right just to make sure we're in sync for
     # values that weren't specified in the manifest. As we're supplying
     # the whole plist when specifying the right it seems safest to be
-    # paranoid given the low cost of quering the db once more.
+    # paranoid given the low cost of querying the db once more.
     cmds = []
     cmds << :security << "authorizationdb" << "read" << resource[:name]
     output = execute(cmds, :failonfail => false, :combine => false)
-    current_values = Plist::parse_xml(output)
+    current_values = Puppet::Util::Plist.parse_plist(output)
     current_values ||= {}
     specified_values = convert_plist_to_native_attributes(@property_hash)
 
@@ -155,7 +156,7 @@ Puppet::Type.type(:macauthorization).provide :macauthorization, :parent => Puppe
   end
 
   def flush_rule
-    authdb = Plist::parse_xml(AuthDB)
+    authdb = Puppet::Util::Plist.parse_plist(AuthDB)
     authdb_rules = authdb["rules"].dup
     current_values = {}
     current_values = authdb_rules[resource[:name]] if authdb_rules[resource[:name]]
@@ -171,7 +172,7 @@ Puppet::Type.type(:macauthorization).provide :macauthorization, :parent => Puppe
     values = convert_plist_to_native_attributes(values)
     tmp = Tempfile.new('puppet_macauthorization')
     begin
-      Plist::Emit.save_plist(values, tmp.path)
+      Puppet::Util::Plist.write_plist_file(values, tmp.path)
       cmds = []
       cmds << :security << "authorizationdb" << "write" << name
       execute(cmds, :failonfail => false, :combine => false, :stdinfile => tmp.path.to_s)
@@ -189,11 +190,11 @@ Puppet::Type.type(:macauthorization).provide :macauthorization, :parent => Puppe
     # support modifying rules at all so we have to twiddle the whole
     # plist... :( See Apple Bug #6386000
     values = convert_plist_to_native_attributes(values)
-    authdb = Plist::parse_xml(AuthDB)
+    authdb = Puppet::Util::Plist.parse_plist(AuthDB)
     authdb["rules"][name] = values
 
     begin
-      Plist::Emit.save_plist(authdb, AuthDB)
+      Puppet::Util::Plist.write_plist_file(authdb, AuthDB)
     rescue
       raise Puppet::Error.new("Error writing to: #{AuthDB}")
     end

data/lib/puppet/provider/mailalias/aliases.rb

@@ -34,7 +34,7 @@ Puppet::Type.type(:mailalias).provide(
       if record[:recipient]
 	dest = record[:recipient].collect do |d|
 	  # Quote aliases that have non-alpha chars
-	  if d =~ /[^-\w@.]/
+	  if d =~ /[^-+\w@.]/
 	    '"%s"' % d
 	  else
 	    d

data/lib/puppet/provider/mcx/mcxcontent.rb

@@ -36,7 +36,7 @@ Puppet::Type.type(:mcx).provide :mcxcontent, :parent => Puppet::Provider do
 
   def self.instances
     mcx_list = []
-    TypeMap.keys.each do |ds_type|
+    TypeMap.each_key do |ds_type|
       ds_path = "/Local/Default/#{TypeMap[ds_type]}"
       output = dscl 'localhost', '-list', ds_path
       member_list = output.split
@@ -116,7 +116,8 @@ Puppet::Type.type(:mcx).provide :mcxcontent, :parent => Puppet::Provider do
       dscl 'localhost', '-mcxdelete', ds_path
     end
 
-    tmp = Tempfile.new('puppet_mcx')
+    # val being passed in is resource[:content] which should be UTF-8
+    tmp = Tempfile.new('puppet_mcx', :encoding => Encoding::UTF_8)
     begin
       tmp << val
       tmp.flush
@@ -133,13 +134,13 @@ Puppet::Type.type(:mcx).provide :mcxcontent, :parent => Puppet::Provider do
     ds_type = name.split('/')[1]
     unless ds_type
       raise MCXContentProviderException,
-      "Coult not parse ds_type from resource name '#{name}'.  Specify with ds_type parameter."
+      "Could not parse ds_type from resource name '#{name}'.  Specify with ds_type parameter."
     end
     # De-pluralize and downcase.
     ds_type = ds_type.chop.downcase.to_sym
     unless TypeMap.key? ds_type
       raise MCXContentProviderException,
-      "Coult not parse ds_type from resource name '#{name}'.  Specify with ds_type parameter."
+      "Could not parse ds_type from resource name '#{name}'.  Specify with ds_type parameter."
     end
     ds_type
   end

data/lib/puppet/provider/mount/parsed.rb

@@ -61,7 +61,7 @@ Puppet::Type.type(:mount).provide(
           ret[filesystem_index] = filesystem_stanza.join("\n") if filesystem_stanza
           filesystem_stanza = Array(line)
           filesystem_index = i
-          # Eat the preceeding blank line
+          # Eat the preceding blank line
           ret[i-1] = nil if i > 0 and ret[i-1] and ret[i-1].match(%r{^\s*$})
           nil
         elsif line.match(%r{^(\s*\*.*|\s*)$})
@@ -178,7 +178,21 @@ Puppet::Type.type(:mount).provide(
       end
     end
   else
-    record_line self.name, :fields => @fields, :separator => /\s+/, :joiner => "\t", :optional => optional_fields
+    record_line self.name, :fields => @fields, :separator => /\s+/, :joiner => "\t", :optional => optional_fields, :block_eval => :instance do
+      def pre_gen(record)
+        if !record[:options] || record[:options].empty?
+          if Facter.value(:kernel) == 'Linux'
+            record[:options] = 'defaults'
+          else
+            raise Puppet::Error, "Mount[#{record[:name]}]: Field 'options' is required"
+          end
+        end
+        if !record[:fstype] || record[:fstype].empty?
+          raise Puppet::Error, "Mount[#{record[:name]}]: Field 'fstype' is required"
+        end
+        record
+      end
+    end
   end
 
   # Every entry in fstab is :unmounted until we can prove different

data/lib/puppet/provider/nameservice/directoryservice.rb

@@ -1,6 +1,6 @@
 require 'puppet'
 require 'puppet/provider/nameservice'
-require 'plist'
+require 'puppet/util/plist' if Puppet.features.cfpropertylist?
 require 'fileutils'
 
 class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameService
@@ -18,10 +18,16 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
   commands :dscl => "/usr/bin/dscl"
   commands :dseditgroup => "/usr/sbin/dseditgroup"
   commands :sw_vers => "/usr/bin/sw_vers"
-  commands :plutil => '/usr/bin/plutil'
   confine :operatingsystem => :darwin
+  confine :feature         => :cfpropertylist
   defaultfor :operatingsystem => :darwin
 
+  # There is no generalized mechanism for provider cache management, but we can
+  # use post_resource_eval, which will be run for each suitable provider at the
+  # end of each transaction. Use this to clear @all_present after each run.
+  def self.post_resource_eval
+    @all_present = nil
+  end
 
   # JJM 2007-07-25: This map is used to map NameService attributes to their
   #     corresponding DirectoryService attribute names.
@@ -63,7 +69,7 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
   def self.instances
     # JJM Class method that provides an array of instance objects of this
     #     type.
-    # JJM: Properties are dependent on the Puppet::Type we're managine.
+    # JJM: Properties are dependent on the Puppet::Type we're managing.
     type_property_array = [:name] + @resource_type.validproperties
 
     # Create a new instance of this Puppet::Type for each object present
@@ -87,22 +93,24 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
   end
 
   def self.list_all_present
-    # JJM: List all objects of this Puppet::Type already present on the system.
-    begin
-      dscl_output = execute(get_exec_preamble("-list"))
-    rescue Puppet::ExecutionFailure
-      fail("Could not get #{@resource_type.name} list from DirectoryService")
+    @all_present ||= begin
+      # JJM: List all objects of this Puppet::Type already present on the system.
+      begin
+        dscl_output = execute(get_exec_preamble("-list"))
+      rescue Puppet::ExecutionFailure
+        fail("Could not get #{@resource_type.name} list from DirectoryService")
+      end
+      dscl_output.split("\n")
     end
-    dscl_output.split("\n")
   end
 
   def self.parse_dscl_plist_data(dscl_output)
-    Plist.parse_xml(dscl_output)
+    Puppet::Util::Plist.parse_plist(dscl_output)
   end
 
   def self.generate_attribute_hash(input_hash, *type_properties)
     attribute_hash = {}
-    input_hash.keys.each do |key|
+    input_hash.each_key do |key|
       ds_attribute = key.sub("dsAttrTypeStandard:", "")
       next unless (ds_to_ns_attribute_map.keys.include?(ds_attribute) and type_properties.include? ds_to_ns_attribute_map[ds_attribute])
       ds_value = input_hash[key]
@@ -126,7 +134,7 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
 
     # NBK: need to read the existing password here as it's not actually
     # stored in the user record. It is stored at a path that involves the
-    # UUID of the user record for non-Mobile local acccounts.
+    # UUID of the user record for non-Mobile local accounts.
     # Mobile Accounts are out of scope for this provider for now
     attribute_hash[:password] = self.get_password(attribute_hash[:guid], attribute_hash[:name]) if @resource_type.validproperties.include?(:password) and Puppet.features.root?
     attribute_hash
@@ -160,15 +168,15 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
   def self.get_exec_preamble(ds_action, resource_name = nil)
     # JJM 2007-07-24
     #     DSCL commands are often repetitive and contain the same positional
-    #     arguments over and over. See http://developer.apple.com/documentation/Porting/Conceptual/PortingUnix/additionalfeatures/chapter_10_section_9.html
+    #     arguments over and over. See https://developer.apple.com/documentation/Porting/Conceptual/PortingUnix/additionalfeatures/chapter_10_section_9.html
     #     for an example of what I mean.
     #     This method spits out proper DSCL commands for us.
     #     We EXPECT name to be @resource[:name] when called from an instance object.
 
     command_vector = [ command(:dscl), "-plist", "." ]
 
-    # JJM: The actual action to perform.  See "man dscl"
-    #      Common actiosn: -create, -delete, -merge, -append, -passwd
+    # JJM: The actual action to perform. See "man dscl".
+    #      Common actions: -create, -delete, -merge, -append, -passwd
     command_vector << ds_action
     # JJM: get_ds_path will spit back "Users" or "Groups",
     # etc...  Depending on the Puppet::Type of our self.
@@ -186,98 +194,83 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
     # 10.7 uses salted SHA512 password hashes which are 128 characters plus
     # an 8 character salt. Previous versions used a SHA1 hash padded with
     # zeroes. If someone attempts to use a password hash that worked with
-    # a previous version of OX X, we will fail early and warn them.
+    # a previous version of OS X, we will fail early and warn them.
     if password_hash.length != 136
       fail("OS X 10.7 requires a Salted SHA512 hash password of 136 characters. \
            Please check your password and try again.")
     end
 
-    if Puppet::FileSystem.exist?("#{users_plist_dir}/#{resource_name}.plist")
+    plist_file = "#{users_plist_dir}/#{resource_name}.plist"
+    if Puppet::FileSystem.exist?(plist_file)
       # If a plist already exists in /var/db/dslocal/nodes/Default/users, then
       # we will need to extract the binary plist from the 'ShadowHashData'
       # key, log the new password into the resultant plist's 'SALTED-SHA512'
       # key, and then save the entire structure back.
-      users_plist = Plist::parse_xml(plutil( '-convert', 'xml1', '-o', '/dev/stdout', \
-                                     "#{users_plist_dir}/#{resource_name}.plist"))
+      users_plist = Puppet::Util::Plist.read_plist_file(plist_file)
 
-      # users_plist['ShadowHashData'][0].string is actually a binary plist
+      # users_plist['ShadowHashData'][0] is actually a binary plist
       # that's nested INSIDE the user's plist (which itself is a binary
       # plist). If we encounter a user plist that DOESN'T have a
       # ShadowHashData field, create one.
       if users_plist['ShadowHashData']
-        password_hash_plist = users_plist['ShadowHashData'][0].string
-        converted_hash_plist = convert_binary_to_xml(password_hash_plist)
+        password_hash_plist = users_plist['ShadowHashData'][0]
+        converted_hash_plist = convert_binary_to_hash(password_hash_plist)
       else
-        users_plist['ShadowHashData'] = [StringIO.new]
-        converted_hash_plist = {'SALTED-SHA512' => StringIO.new}
+        users_plist['ShadowHashData'] = ''
+        converted_hash_plist = {'SALTED-SHA512' => ''}
       end
 
-      # converted_hash_plist['SALTED-SHA512'].string expects a Base64 encoded
+      # converted_hash_plist['SALTED-SHA512'] expects a Base64 encoded
       # string. The password_hash provided as a resource attribute is a
       # hex value. We need to convert the provided hex value to a Base64
       # encoded string to nest it in the converted hash plist.
-      converted_hash_plist['SALTED-SHA512'].string = \
+      converted_hash_plist['SALTED-SHA512'] = \
         password_hash.unpack('a2'*(password_hash.size/2)).collect { |i| i.hex.chr }.join
 
       # Finally, we can convert the nested plist back to binary, embed it
       # into the user's plist, and convert the resultant plist back to
       # a binary plist.
-      changed_plist = convert_xml_to_binary(converted_hash_plist)
-      users_plist['ShadowHashData'][0].string = changed_plist
-      Plist::Emit.save_plist(users_plist, "#{users_plist_dir}/#{resource_name}.plist")
-      plutil('-convert', 'binary1', "#{users_plist_dir}/#{resource_name}.plist")
+      changed_plist = convert_hash_to_binary(converted_hash_plist)
+      users_plist['ShadowHashData'][0] = changed_plist
+      Puppet::Util::Plist.write_plist_file(users_plist, plist_file, :binary)
     end
   end
 
   def self.get_password(guid, username)
-    if Puppet::FileSystem.exist?("#{users_plist_dir}/#{username}.plist")
+    plist_file = "#{users_plist_dir}/#{username}.plist"
+    if Puppet::FileSystem.exist?(plist_file)
       # If a plist exists in /var/db/dslocal/nodes/Default/users, we will
       # extract the binary plist from the 'ShadowHashData' key, decode the
       # salted-SHA512 password hash, and then return it.
-      users_plist = Plist::parse_xml(plutil('-convert', 'xml1', '-o', '/dev/stdout', "#{users_plist_dir}/#{username}.plist"))
+      users_plist = Puppet::Util::Plist.read_plist_file(plist_file)
+
       if users_plist['ShadowHashData']
-        # users_plist['ShadowHashData'][0].string is actually a binary plist
+        # users_plist['ShadowHashData'][0] is actually a binary plist
         # that's nested INSIDE the user's plist (which itself is a binary
         # plist).
-        password_hash_plist = users_plist['ShadowHashData'][0].string
-        converted_hash_plist = convert_binary_to_xml(password_hash_plist)
+        password_hash_plist = users_plist['ShadowHashData'][0]
+        converted_hash_plist = convert_binary_to_hash(password_hash_plist)
 
-        # converted_hash_plist['SALTED-SHA512'].string is a Base64 encoded
+        # converted_hash_plist['SALTED-SHA512'] is a Base64 encoded
         # string. The password_hash provided as a resource attribute is a
         # hex value. We need to convert the Base64 encoded string to a
         # hex value and provide it back to Puppet.
-        password_hash = converted_hash_plist['SALTED-SHA512'].string.unpack("H*")[0]
+        password_hash = converted_hash_plist['SALTED-SHA512'].unpack("H*")[0]
         password_hash
       end
     end
   end
 
-  # This method will accept a hash that has been returned from Plist::parse_xml
-  # and convert it to a binary plist (string value).
-  def self.convert_xml_to_binary(plist_data)
-    Puppet.debug('Converting XML plist to binary')
-    Puppet.debug('Executing: \'plutil -convert binary1 -o - -\'')
-    IO.popen('plutil -convert binary1 -o - -', 'r+') do |io|
-      io.write plist_data.to_plist
-      io.close_write
-      @converted_plist = io.read
-    end
-    @converted_plist
+  # This method will accept a hash and convert it to a binary plist (string value).
+  def self.convert_hash_to_binary(plist_data)
+    Puppet.debug('Converting plist hash to binary')
+    Puppet::Util::Plist.dump_plist(plist_data, :binary)
   end
 
-  # This method will accept a binary plist (as a string) and convert it to a
-  # hash via Plist::parse_xml.
-  def self.convert_binary_to_xml(plist_data)
-    Puppet.debug('Converting binary plist to XML')
-    Puppet.debug('Executing: \'plutil -convert xml1 -o - -\'')
-    IO.popen('plutil -convert xml1 -o - -', 'r+') do |io|
-      io.write plist_data
-      io.close_write
-      @converted_plist = io.read
-    end
-    Puppet.debug('Converting XML values to a hash.')
-    @plist_hash = Plist::parse_xml(@converted_plist)
-    @plist_hash
+  # This method will accept a binary plist (as a string) and convert it to a hash.
+  def self.convert_binary_to_hash(plist_data)
+    Puppet.debug('Converting binary plist to hash')
+    Puppet::Util::Plist.parse_plist(plist_data)
   end
 
   # Unlike most other *nixes, OS X doesn't provide built in functionality
@@ -333,7 +326,7 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
     exec_arg_vector << ns_to_ds_attribute_map[:guid]
     begin
       guid_output = execute(exec_arg_vector)
-      guid_plist = Plist.parse_xml(guid_output)
+      guid_plist = Puppet::Util::Plist.parse_plist(guid_output)
       # Although GeneratedUID like all DirectoryService values can be multi-valued
       # according to the schema, in practice user accounts cannot have multiple UUIDs
       # otherwise Bad Things Happen, so we just deal with the first value.

data/lib/puppet/provider/nameservice.rb

@@ -52,14 +52,14 @@ class Puppet::Provider::NameService < Puppet::Provider
     # for both users and groups.
     def listbyname
       names = []
-      Etc.send("set#{section()}ent")
+      Puppet::Etc.send("set#{section()}ent")
       begin
-        while ent = Etc.send("get#{section()}ent")
+        while ent = Puppet::Etc.send("get#{section()}ent")
           names << ent.name
           yield ent.name if block_given?
         end
       ensure
-        Etc.send("end#{section()}ent")
+        Puppet::Etc.send("end#{section()}ent")
       end
 
       names
@@ -146,7 +146,7 @@ class Puppet::Provider::NameService < Puppet::Provider
       # other, more convenient enumerator for these, so we fake one with this
       # loop.  Thanks, Ruby, for your awesome abstractions. --daniel 2012-03-23
       highest = []
-      Etc.send(database) {|entry| highest << entry.send(method) }
+      Puppet::Etc.send(database) {|entry| highest << entry.send(method) }
       highest = highest.reject {|x| x > 65000 }.max
 
       @prevauto = highest || 1000
@@ -226,7 +226,7 @@ class Puppet::Provider::NameService < Puppet::Provider
     if @objectinfo.nil? or refresh == true
       @etcmethod ||= ("get" + self.class.section.to_s + "nam").intern
       begin
-        @objectinfo = Etc.send(@etcmethod, @resource[:name])
+        @objectinfo = Puppet::Etc.send(@etcmethod, @resource[:name])
       rescue ArgumentError
         @objectinfo = nil
       end
@@ -242,13 +242,13 @@ class Puppet::Provider::NameService < Puppet::Provider
     groups = []
 
     # Reset our group list
-    Etc.setgrent
+    Puppet::Etc.setgrent
 
     user = @resource[:name]
 
     # Now iterate across all of the groups, adding each one our
     # user is a member of
-    while group = Etc.getgrent
+    while group = Puppet::Etc.getgrent
       members = group.mem
 
       groups << group.name if members.include? user
@@ -256,7 +256,7 @@ class Puppet::Provider::NameService < Puppet::Provider
 
     # We have to close the file, so each listing is a separate
     # reading of the file.
-    Etc.endgrent
+    Puppet::Etc.endgrent
 
     groups.join(",")
   end
@@ -288,5 +288,20 @@ class Puppet::Provider::NameService < Puppet::Provider
       raise Puppet::Error, "Could not set #{param} on #{@resource.class.name}[#{@resource.name}]: #{detail}", detail.backtrace
     end
   end
+
+  # From overriding Puppet::Property#insync? Ruby Etc::getpwnam < 2.1.0 always
+  # returns a struct with binary encoded string values, and >= 2.1.0 will return
+  # binary encoded strings for values incompatible with current locale charset,
+  # or Encoding.default_external if compatible. Compare a "should" value with
+  # encoding of "current" value, to avoid unnecessary property syncs and
+  # comparison of strings with different encodings. (PUP-6777)
+  #
+  # return basic string comparison after re-encoding (same as
+  # Puppet::Property#property_matches)
+  def comments_insync?(current, should)
+    # we're only doing comparison here so don't mutate the string
+    desired = should[0].to_s.dup
+    current == desired.force_encoding(current.encoding)
+  end
 end
 

data/lib/puppet/provider/package/appdmg.rb

@@ -7,16 +7,18 @@
 # and are easier to manage.
 #
 # Note: the 'apple' Provider checks for the package name
-# in /L/Receipts.  Since we possibly install multiple apps's from
+# in /L/Receipts.  Since we possibly install multiple apps from
 # a single source, we treat the source .app.dmg file as the package name.
 # As a result, we store installed .app.dmg file names
 # in /var/db/.puppet_appdmg_installed_<name>
 
 require 'puppet/provider/package'
+require 'puppet/util/plist' if Puppet.features.cfpropertylist?
 Puppet::Type.type(:package).provide(:appdmg, :parent => Puppet::Provider::Package) do
   desc "Package management which copies application bundles to a target."
 
   confine :operatingsystem => :darwin
+  confine :feature         => :cfpropertylist
 
   commands :hdiutil => "/usr/bin/hdiutil"
   commands :curl => "/usr/bin/curl"
@@ -42,7 +44,7 @@ Puppet::Type.type(:package).provide(:appdmg, :parent => Puppet::Provider::Packag
   def self.installapp(source, name, orig_source)
     appname = File.basename(source);
     ditto "--rsrc", source, "/Applications/#{appname}"
-    File.open("/var/db/.puppet_appdmg_installed_#{name}", "w") do |t|
+    Puppet::FileSystem.open("/var/db/.puppet_appdmg_installed_#{name}", nil, "w:UTF-8") do |t|
       t.print "name: '#{name}'\n"
       t.print "source: '#{orig_source}'\n"
     end
@@ -50,7 +52,6 @@ Puppet::Type.type(:package).provide(:appdmg, :parent => Puppet::Provider::Packag
 
   def self.installpkgdmg(source, name)
     require 'open-uri'
-    require 'plist'
     cached_source = source
     tmpdir = Dir.mktmpdir
     begin
@@ -67,7 +68,7 @@ Puppet::Type.type(:package).provide(:appdmg, :parent => Puppet::Provider::Packag
 
       open(cached_source) do |dmg|
         xml_str = hdiutil "mount", "-plist", "-nobrowse", "-readonly", "-mountrandom", "/tmp", dmg.path
-          ptable = Plist::parse_xml xml_str
+          ptable = Puppet::Util::Plist::parse_plist(xml_str)
           # JJM Filter out all mount-paths into a single array, discard the rest.
           mounts = ptable['system-entities'].collect { |entity|
             entity['mount-point']
@@ -99,10 +100,10 @@ Puppet::Type.type(:package).provide(:appdmg, :parent => Puppet::Provider::Packag
   def install
     source = nil
     unless source = @resource[:source]
-      self.fail "Mac OS X PKG DMG's must specify a package source."
+      self.fail "Mac OS X PKG DMGs must specify a package source."
     end
     unless name = @resource[:name]
-      self.fail "Mac OS X PKG DMG's must specify a package name."
+      self.fail "Mac OS X PKG DMGs must specify a package name."
     end
     self.class.installpkgdmg(source,name)
   end

data/lib/puppet/provider/package/apple.rb

@@ -2,7 +2,7 @@ require 'puppet/provider/package'
 
 # OS X Packaging sucks.  We can install packages, but that's about it.
 Puppet::Type.type(:package).provide :apple, :parent => Puppet::Provider::Package do
-  desc "Package management based on OS X's builtin packaging system.  This is
+  desc "Package management based on OS X's built-in packaging system.  This is
     essentially the simplest and least functional package system in existence --
     it only supports installation; no deletion or upgrades.  The provider will
     automatically add the `.pkg` extension, so leave that off when specifying

data/lib/puppet/provider/package/dnf.rb

@@ -0,0 +1,46 @@
+Puppet::Type.type(:package).provide :dnf, :parent => :yum do
+  desc "Support via `dnf`.
+
+  Using this provider's `uninstallable` feature will not remove dependent packages. To
+  remove dependent packages with this provider use the `purgeable` feature, but note this
+  feature is destructive and should be used with the utmost care.
+
+  This provider supports the `install_options` attribute, which allows command-line flags to be passed to dnf.
+  These options should be specified as a string (e.g. '--flag'), a hash (e.g. {'--flag' => 'value'}),
+  or an array where each element is either a string or a hash."
+
+  has_feature :install_options, :versionable, :virtual_packages
+
+  commands :cmd => "dnf", :rpm => "rpm"
+
+  # Note: this confine was borrowed from the Yum provider. The
+  # original purpose (from way back in 2007) was to make sure we
+  # never try to use RPM on a machine without it. We think this
+  # has probably become obsolete with the way `commands` work, so
+  # we should investigate removing it at some point.
+  if command('rpm')
+    confine :true => begin
+      rpm('--version')
+      rescue Puppet::ExecutionFailure
+        false
+      else
+        true
+      end
+  end
+
+  defaultfor :operatingsystem => :fedora, :operatingsystemmajrelease => ['22', '23', '24', '25']
+
+  def self.update_command
+    # In DNF, update is deprecated for upgrade
+    'upgrade'
+  end
+
+  # The value to pass to DNF as its error output level.
+  # DNF differs from Yum slightly with regards to error outputting.
+  #
+  # @param None
+  # @return [String]
+  def self.error_level
+    '1'
+  end
+end