puppet 4.1.0 → 5.0.0

data/lib/puppet/provider/service/systemd.rb

@@ -1,19 +1,36 @@
-# Manage systemd services using /bin/systemctl
+# Manage systemd services using systemctl
 
 Puppet::Type.type(:service).provide :systemd, :parent => :base do
-  desc "Manages `systemd` services using `systemctl`."
+  desc "Manages `systemd` services using `systemctl`.
+
+  Because `systemd` defaults to assuming the `.service` unit type, the suffix
+  may be omitted.  Other unit types (such as `.path`) may be managed by
+  providing the proper suffix."
 
   commands :systemctl => "systemctl"
 
+  if Facter.value(:osfamily).downcase == 'debian'
+    # With multiple init systems on Debian, it is possible to have
+    # pieces of systemd around (e.g. systemctl) but not really be
+    # using systemd.  We do not do this on other platforms as it can
+    # cause issues when running in a chroot without /run mounted
+    # (PUP-5577)
+    confine :exists => "/run/systemd/system"
+  end
+
   defaultfor :osfamily => [:archlinux]
   defaultfor :osfamily => :redhat, :operatingsystemmajrelease => "7"
-  defaultfor :osfamily => :redhat, :operatingsystem => :fedora, :operatingsystemmajrelease => ["17", "18", "19", "20", "21"]
-  defaultfor :osfamily => :suse, :operatingsystemmajrelease => ["12", "13"]
+  defaultfor :osfamily => :redhat, :operatingsystem => :fedora
+  defaultfor :osfamily => :suse
+  defaultfor :osfamily => :coreos
+  defaultfor :operatingsystem => :debian, :operatingsystemmajrelease => ["8", "stretch/sid", "9", "buster/sid"]
+  defaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["15.04","15.10","16.04","16.10"]
+  defaultfor :operatingsystem => :cumuluslinux, :operatingsystemmajrelease => ["3"]
 
   def self.instances
     i = []
     output = systemctl('list-unit-files', '--type', 'service', '--full', '--all',  '--no-pager')
-    output.scan(/^(\S+)\s+(disabled|enabled)\s*$/i).each do |m|
+    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect)\s*$/i).each do |m|
       i << new(:name => m[0])
     end
     return i
@@ -21,35 +38,100 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
     return []
   end
 
+  # This helper ensures that the enable state cache is always reset
+  # after a systemctl enable operation. A particular service state is not guaranteed
+  # after such an operation, so the cache must be emptied to prevent inconsistencies
+  # in the provider's believed state of the service and the actual state.
+  # @param action [String,Symbol] One of 'enable', 'disable', 'mask' or 'unmask'
+  def systemctl_change_enable(action)
+    output = systemctl(action, @resource[:name])
+  rescue
+    raise Puppet::Error, "Could not #{action} #{self.name}: #{output}", $!.backtrace
+  ensure
+    @cached_enabled = nil
+  end
+
   def disable
-    output = systemctl(:disable, @resource[:name])
-  rescue Puppet::ExecutionFailure
-    raise Puppet::Error, "Could not disable #{self.name}: #{output}", $!.backtrace
+    systemctl_change_enable(:disable)
+  end
+
+  def get_start_link_count
+    # Start links don't include '.service'. Just search for the service name.
+    if @resource[:name].match(/\.service/)
+      link_name = @resource[:name].split('.')[0]
+    else
+      link_name = @resource[:name]
+    end
+
+    Dir.glob("/etc/rc*.d/S??#{link_name}").length
+  end
+
+  def cached_enabled?
+    return @cached_enabled if @cached_enabled
+    cmd = [command(:systemctl), 'is-enabled', @resource[:name]]
+    @cached_enabled = execute(cmd, :failonfail => false).strip
   end
 
   def enabled?
-    begin
-      systemctl("is-enabled", @resource[:name])
-    rescue Puppet::ExecutionFailure
-      return :false
+    output = cached_enabled?
+    code = $CHILD_STATUS.exitstatus
+
+    # The masked state is equivalent to the disabled state in terms of
+    # comparison so we only care to check if it is masked if we want to keep
+    # it masked.
+    #
+    # We only return :mask if we're trying to mask the service. This prevents
+    # flapping when simply trying to disable a masked service.
+    return :mask if (@resource[:enable] == :mask) && (output == 'masked')
+
+    # The indirect state indicates that the unit is not enabled.
+    return :false if output == 'indirect'
+    return :true if (code == 0)
+    if (output.empty?) && (code > 0) && (Facter.value(:osfamily).downcase == 'debian')
+      ret = debian_enabled?
+      return ret if ret
     end
 
-    :true
+    return :false
   end
 
-  def status
-    begin
-      systemctl("is-active", @resource[:name])
-    rescue Puppet::ExecutionFailure
-      return :stopped
+  # This method is required for Debian systems due to the way the SysVInit-Systemd
+  # compatibility layer works. When we are trying to manage a service which does not
+  # have a Systemd unit file, we need to go through the old init script to determine
+  # whether it is enabled or not. See PUP-5016 for more details.
+  #
+  def debian_enabled?
+    system("/usr/sbin/invoke-rc.d", "--quiet", "--query", @resource[:name], "start")
+    if [104, 106].include?($CHILD_STATUS.exitstatus)
+      return :true
+    elsif [101, 105].include?($CHILD_STATUS.exitstatus)
+      # 101 is action not allowed, which means we have to do the check manually.
+      # 105 is unknown, which generally means the initscript does not support query
+      # The debian policy states that the initscript should support methods of query
+      # For those that do not, perform the checks manually
+      # http://www.debian.org/doc/debian-policy/ch-opersys.html
+      if get_start_link_count >= 4
+        return :true
+      else
+        return :false
+      end
+    else
+      return :false
     end
-    return :running
   end
 
   def enable
-    output = systemctl("enable", @resource[:name])
-  rescue Puppet::ExecutionFailure
-    raise Puppet::Error, "Could not enable #{self.name}: #{output}", $!.backtrace
+    self.unmask
+    systemctl_change_enable(:enable)
+  end
+
+  def mask
+    self.disable
+    systemctl_change_enable(:mask)
+  end
+
+  def unmask
+    systemctl_change_enable(:unmask)
   end
 
   def restartcmd
@@ -57,11 +139,48 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   end
 
   def startcmd
+    self.unmask
     [command(:systemctl), "start", @resource[:name]]
   end
 
   def stopcmd
     [command(:systemctl), "stop", @resource[:name]]
   end
+
+  def statuscmd
+    [command(:systemctl), "is-active", @resource[:name]]
+  end
+
+  def restart
+    begin
+      super
+    rescue Puppet::Error => e
+      raise Puppet::Error.new(prepare_error_message(@resource[:name], 'restart', e))
+    end
+  end
+
+  def start
+    begin
+      super
+    rescue Puppet::Error => e
+      raise Puppet::Error.new(prepare_error_message(@resource[:name], 'start', e))
+    end
+  end
+
+  def stop
+    begin
+      super
+    rescue Puppet::Error => e
+      raise Puppet::Error.new(prepare_error_message(@resource[:name], 'stop', e))
+    end
+  end
+
+  def prepare_error_message(name, action, exception)
+    error_return = "Systemd #{action} for #{name} failed!\n"
+    journalctl_command = "journalctl -n 50 --since '5 minutes ago' -u #{name} --no-pager"
+    Puppet.debug("Runing journalctl command to get logs for systemd #{action} failure: #{journalctl_command}")
+    journalctl_output = execute(journalctl_command)
+    error_return << "journalctl log for #{name}:\n#{journalctl_output}"
+  end
 end
 

data/lib/puppet/provider/service/upstart.rb

@@ -1,5 +1,3 @@
-require 'semver'
-
 Puppet::Type.type(:service).provide :upstart, :parent => :debian do
   START_ON = /^\s*start\s+on/
   COMMENTED_START_ON = /^\s*#+\s*start\s+on/
@@ -18,7 +16,7 @@ Puppet::Type.type(:service).provide :upstart, :parent => :debian do
     Facter.value(:operatingsystem) == 'LinuxMint',
   ]
 
-  defaultfor :operatingsystem => :ubuntu
+  defaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["10.04", "12.04", "14.04", "14.10"]
 
   commands :start   => "/sbin/start",
            :stop    => "/sbin/stop",

data/lib/puppet/provider/ssh_authorized_key/parsed.rb

@@ -68,7 +68,7 @@ Puppet::Type.type(:ssh_authorized_key).provide(
     end
   end
 
-  # parse sshv2 option strings, wich is a comma separated list of
+  # Parse sshv2 option strings, which is a comma-separated list of
   # either key="values" elements or bare-word elements
   def self.parse_options(options)
     result = []

data/lib/puppet/provider/sshkey/parsed.rb

@@ -1,23 +1,14 @@
 require 'puppet/provider/parsedfile'
 
-known = nil
-case Facter.value(:operatingsystem)
-when "Darwin"; known = "/etc/ssh_known_hosts"
-else
-  known = "/etc/ssh/ssh_known_hosts"
-end
-
-
 Puppet::Type.type(:sshkey).provide(
   :parsed,
   :parent => Puppet::Provider::ParsedFile,
-  :default_target => known,
   :filetype => :flat
 ) do
   desc "Parse and generate host-wide known hosts files for SSH."
 
   text_line :comment, :match => /^#/
-  text_line :blank, :match => /^\s+/
+  text_line :blank, :match => /^\s*$/
 
   record_line :parsed, :fields => %w{name type key},
     :post_parse => proc { |hash|
@@ -36,5 +27,24 @@ Puppet::Type.type(:sshkey).provide(
   def self.default_mode
     0644
   end
+
+  def self.default_target
+    case Facter.value(:operatingsystem)
+    when "Darwin"
+      # Versions 10.11 and up use /etc/ssh/ssh_known_hosts
+      version = Facter.value(:macosx_productversion_major)
+      if version
+        if Puppet::Util::Package.versioncmp(version, '10.11') >= 0
+          "/etc/ssh/ssh_known_hosts"
+        else
+          "/etc/ssh_known_hosts"
+        end
+      else
+        "/etc/ssh_known_hosts"
+      end
+    else
+      "/etc/ssh/ssh_known_hosts"
+    end
+  end
 end
 

data/lib/puppet/provider/user/aix.rb

@@ -7,7 +7,7 @@
 #   but puppet does not allow it. There is a ticket open for that (#5431)
 # - AIX maximum password age is in WEEKs, not days
 #
-# See  http://docs.puppetlabs.com/guides/provider_development.html
+# See  https://docs.puppetlabs.com/guides/provider_development.html
 # for more information
 #
 # Author::    Hector Rivas Gandara <keymon@gmail.com>
@@ -56,7 +56,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   # Valid attributes to be managed by this provider.
   # It is a list with of hash
   #  :aix_attr      AIX command attribute name
-  #  :puppet_prop   Puppet propertie name
+  #  :puppet_prop   Puppet property name
   #  :to            Method to adapt puppet property to aix command value. Optional.
   #  :from          Method to adapt aix command value to puppet property. Optional
   self.attribute_mapping = [
@@ -167,7 +167,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
 
   # Check that a group exists and is valid
   def verify_group(value)
-    if value.is_a? Integer or value.is_a? Fixnum
+    if value.is_a? Integer
       groupname = groupname_by_id(value)
       raise ArgumentError, "AIX group must be a valid existing group" unless groupname
     else
@@ -216,7 +216,9 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
 
   def open_security_passwd
     # helper method for tests
-    File.open("/etc/security/passwd", 'r')
+    # AIX reference indicates this file is ASCII
+    # https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.files/passwd_security.htm
+    Puppet::FileSystem.open("/etc/security/passwd", nil, "r:ASCII")
   end
 
   #--------------------------------
@@ -255,7 +257,10 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
     user = @resource[:name]
 
     # Puppet execute does not support strings as input, only files.
-    tmpfile = Tempfile.new('puppet_#{user}_pw')
+    # The password is expected to be in an encrypted format given -e is specified:
+    # https://www.ibm.com/support/knowledgecenter/ssw_aix_71/com.ibm.aix.cmds1/chpasswd.htm
+    # /etc/security/passwd is specified as an ASCII file per the AIX documentation
+    tmpfile = Tempfile.new("puppet_#{user}_pw", :encoding => Encoding::ASCII)
     tmpfile << "#{user}:#{value}\n"
     tmpfile.close()
 
@@ -279,6 +284,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
 
   def managed_attribute_keys(hash)
     managed_attributes ||= @resource.original_parameters[:attributes] || hash.keys.map{|k| k.to_s}
+    managed_attributes = [managed_attributes] unless managed_attributes.is_a?(Array)
     managed_attributes.map {|attr| key, value = attr.split("="); key.strip.to_sym}
   end
 
@@ -289,7 +295,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   end
 
   def filter_attributes(hash)
-    # Return only managed attributtes.
+    # Return only managed attributes.
     managed_keys = managed_attribute_keys(hash)
     results = hash.select {
         |k,v| should_include?(k, managed_keys)

data/lib/puppet/provider/user/directoryservice.rb

@@ -1,5 +1,5 @@
 require 'puppet'
-require 'plist'
+require 'puppet/util/plist' if Puppet.features.cfpropertylist?
 require 'base64'
 
 Puppet::Type.type(:user).provide :directoryservice do
@@ -13,11 +13,11 @@ Puppet::Type.type(:user).provide :directoryservice do
   commands :uuidgen      => '/usr/bin/uuidgen'
   commands :dsimport     => '/usr/bin/dsimport'
   commands :dscl         => '/usr/bin/dscl'
-  commands :plutil       => '/usr/bin/plutil'
   commands :dscacheutil  => '/usr/bin/dscacheutil'
 
   # Provider confines and defaults
   confine    :operatingsystem => :darwin
+  confine    :feature         => :cfpropertylist
   defaultfor :operatingsystem => :darwin
 
   # Need this to create getter/setter methods automagically
@@ -91,7 +91,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   # Return an array of hashes containing information about every user on
   # the system.
   def self.get_all_users
-    Plist.parse_xml(dscl '-plist', '.', 'readall', '/Users')
+    Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'readall', '/Users')
   end
 
   # This method accepts an individual user plist, passed as a hash, and
@@ -100,7 +100,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   # supported by the user type.
   def self.generate_attribute_hash(input_hash)
     attribute_hash = {}
-    input_hash.keys.each do |key|
+    input_hash.each_key do |key|
       ds_attribute = key.sub("dsAttrTypeStandard:", "")
       next unless ds_to_ns_attribute_map.keys.include?(ds_attribute)
       ds_value = input_hash[key]
@@ -121,7 +121,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     end
     attribute_hash[:ensure]         = :present
     attribute_hash[:provider]       = :directoryservice
-    attribute_hash[:shadowhashdata] = get_attribute_from_dscl('Users', attribute_hash[:name], 'ShadowHashData')
+    attribute_hash[:shadowhashdata] = input_hash['dsAttrTypeNative:ShadowHashData']
 
     ##############
     # Get Groups #
@@ -141,16 +141,16 @@ Puppet::Type.type(:user).provide :directoryservice do
     ################################
     # Get Password/Salt/Iterations #
     ################################
-    if attribute_hash[:shadowhashdata].empty?
+    if attribute_hash[:shadowhashdata].nil? or attribute_hash[:shadowhashdata].empty?
       attribute_hash[:password] = '*'
     else
       embedded_binary_plist = get_embedded_binary_plist(attribute_hash[:shadowhashdata])
-      if embedded_binary_plist['SALTED-SHA512']
-        attribute_hash[:password] = get_salted_sha512(embedded_binary_plist)
-      else
+      if embedded_binary_plist['SALTED-SHA512-PBKDF2']
         attribute_hash[:password]   = get_salted_sha512_pbkdf2('entropy', embedded_binary_plist)
         attribute_hash[:salt]       = get_salted_sha512_pbkdf2('salt', embedded_binary_plist)
         attribute_hash[:iterations] = get_salted_sha512_pbkdf2('iterations', embedded_binary_plist)
+      elsif embedded_binary_plist['SALTED-SHA512']
+        attribute_hash[:password] = get_salted_sha512(embedded_binary_plist)
       end
     end
 
@@ -164,55 +164,40 @@ Puppet::Type.type(:user).provide :directoryservice do
   # Use dscl to retrieve an array of hashes containing attributes about all
   # of the local groups on the machine.
   def self.get_list_of_groups
-    @groups ||= Plist.parse_xml(dscl '-plist', '.', 'readall', '/Groups')
+    @groups ||= Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'readall', '/Groups')
   end
 
   # Perform a dscl lookup at the path specified for the specific keyname
   # value. The value returned is the first item within the array returned
   # from dscl
   def self.get_attribute_from_dscl(path, username, keyname)
-    Plist.parse_xml(dscl '-plist', '.', 'read', "/#{path}/#{username}", keyname)
+    Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'read', "/#{path}/#{username}", keyname)
   end
 
   # The plist embedded in the ShadowHashData key is a binary plist. The
   # plist library doesn't read binary plists, so we need to
   # extract the binary plist, convert it to XML, and return it.
   def self.get_embedded_binary_plist(shadow_hash_data)
-    embedded_binary_plist = Array(shadow_hash_data['dsAttrTypeNative:ShadowHashData'][0].delete(' ')).pack('H*')
-    convert_binary_to_xml(embedded_binary_plist)
-  end
-
-  # This method will accept a hash that has been returned from Plist::parse_xml
-  # and convert it to a binary plist (string value).
-  def self.convert_xml_to_binary(plist_data)
-    Puppet.debug('Converting XML plist to binary')
-    Puppet.debug('Executing: \'plutil -convert binary1 -o - -\'')
-    IO.popen('plutil -convert binary1 -o - -', 'r+') do |io|
-      io.write Plist::Emit.dump(plist_data)
-      io.close_write
-      @converted_plist = io.read
-    end
-    @converted_plist
-  end
-
-  # This method will accept a binary plist (as a string) and convert it to a
-  # hash via Plist::parse_xml.
-  def self.convert_binary_to_xml(plist_data)
-    Puppet.debug('Converting binary plist to XML')
-    Puppet.debug('Executing: \'plutil -convert xml1 -o - -\'')
-    IO.popen('plutil -convert xml1 -o - -', 'r+') do |io|
-      io.write plist_data
-      io.close_write
-      @converted_plist = io.read
-    end
-    Puppet.debug('Converting XML values to a hash.')
-    Plist::parse_xml(@converted_plist)
+    embedded_binary_plist = Array(shadow_hash_data[0].delete(' ')).pack('H*')
+    convert_binary_to_hash(embedded_binary_plist)
+  end
+
+  # This method will accept a hash and convert it to a binary plist (string value).
+  def self.convert_hash_to_binary(plist_data)
+    Puppet.debug('Converting plist hash to binary')
+    Puppet::Util::Plist.dump_plist(plist_data, :binary)
+  end
+
+  # This method will accept a binary plist (as a string) and convert it to a hash.
+  def self.convert_binary_to_hash(plist_data)
+    Puppet.debug('Converting binary plist to hash')
+    Puppet::Util::Plist.parse_plist(plist_data)
   end
 
   # The salted-SHA512 password hash in 10.7 is stored in the 'SALTED-SHA512'
   # key as binary data. That data is extracted and converted to a hex string.
   def self.get_salted_sha512(embedded_binary_plist)
-    embedded_binary_plist['SALTED-SHA512'].string.unpack("H*")[0]
+    embedded_binary_plist['SALTED-SHA512'].unpack("H*")[0]
   end
 
   # This method reads the passed embedded_binary_plist hash and returns values
@@ -222,7 +207,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   def self.get_salted_sha512_pbkdf2(field, embedded_binary_plist)
     case field
     when 'salt', 'entropy'
-      embedded_binary_plist['SALTED-SHA512-PBKDF2'][field].string.unpack('H*').first
+      embedded_binary_plist['SALTED-SHA512-PBKDF2'][field].unpack('H*').first
     when 'iterations'
       Integer(embedded_binary_plist['SALTED-SHA512-PBKDF2'][field])
     else
@@ -382,7 +367,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     # flushing the dscl cache to allow all dscl calls to get INTO the cache
     # first. This could be made faster (and avoid a sleep call) by finding
     # a way to enter calls into the dscl cache faster. A sleep time of 1
-    # second would intermittantly require a second Puppet run to set
+    # second would intermittently require a second Puppet run to set
     # properties, so 2 seconds seems to be the minimum working value.
     sleep 2
     flush_dscl_cache
@@ -549,15 +534,16 @@ Puppet::Type.type(:user).provide :directoryservice do
   def get_users_plist(username)
     # This method will retrieve the data stored in a user's plist and
     # return it as a native Ruby hash.
-    Plist::parse_xml(plutil('-convert', 'xml1', '-o', '/dev/stdout', "#{users_plist_dir}/#{username}.plist"))
+    path = "#{users_plist_dir}/#{username}.plist"
+    Puppet::Util::Plist.read_plist_file(path)
   end
 
   # This method will return the binary plist that's embedded in the
   # ShadowHashData key of a user's plist, or false if it doesn't exist.
   def get_shadow_hash_data(users_plist)
     if users_plist['ShadowHashData']
-      password_hash_plist  = users_plist['ShadowHashData'][0].string
-      self.class.convert_binary_to_xml(password_hash_plist)
+      password_hash_plist  = users_plist['ShadowHashData'][0]
+      self.class.convert_binary_to_hash(password_hash_plist)
     else
       false
     end
@@ -567,23 +553,15 @@ Puppet::Type.type(:user).provide :directoryservice do
   # password hash (and Salt/Iterations value if the OS is 10.8 or greater)
   # into the ShadowHashData key of the user's plist.
   def set_shadow_hash_data(users_plist, binary_plist)
+    binary_plist = Puppet::Util::Plist.string_to_blob(binary_plist)
     if users_plist.has_key?('ShadowHashData')
-      users_plist['ShadowHashData'][0].string = binary_plist
+      users_plist['ShadowHashData'][0] = binary_plist
     else
-      users_plist['ShadowHashData'] = [new_stringio_object(binary_plist)]
+      users_plist['ShadowHashData'] = [binary_plist]
     end
     write_users_plist_to_disk(users_plist)
   end
 
-  # This method returns a new StringIO object. Why does it exist?
-  # Well, StringIO objects have their own 'serial number', so when
-  # writing rspec tests it's difficult to compare StringIO objects
-  # due to this serial number. If this action is wrapped in its own
-  # method, it can be mocked for easier testing.
-  def new_stringio_object(value = '')
-    StringIO.new(value)
-  end
-
   # This method accepts an argument of a hex password hash, and base64
   # decodes it into a format that OS X 10.7 and 10.8 will store
   # in the user's plist.
@@ -598,17 +576,17 @@ Puppet::Type.type(:user).provide :directoryservice do
   def set_salted_sha512(users_plist, shadow_hash_data, value)
     unless shadow_hash_data
       shadow_hash_data = Hash.new
-      shadow_hash_data['SALTED-SHA512'] = new_stringio_object
+      shadow_hash_data['SALTED-SHA512'] = ''
     end
-    shadow_hash_data['SALTED-SHA512'].string = base64_decode_string(value)
-    binary_plist = self.class.convert_xml_to_binary(shadow_hash_data)
+    shadow_hash_data['SALTED-SHA512'] = base64_decode_string(value)
+    binary_plist = self.class.convert_hash_to_binary(shadow_hash_data)
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
   # This method accepts a passed value and one of three fields: 'salt',
   # 'entropy', or 'iterations'.  These fields correspond with the fields
   # utilized in a PBKDF2 password hashing system
-  # (see http://en.wikipedia.org/wiki/PBKDF2 ) where 'entropy' is the
+  # (see https://en.wikipedia.org/wiki/PBKDF2 ) where 'entropy' is the
   # password hash, 'salt' is the password hash salt value, and 'iterations'
   # is an integer recommended to be > 10,000. The remaining arguments are
   # the user's plist itself, and the shadow_hash_data hash containing the
@@ -618,8 +596,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     shadow_hash_data['SALTED-SHA512-PBKDF2'] = Hash.new unless shadow_hash_data['SALTED-SHA512-PBKDF2']
     case field
     when 'salt', 'entropy'
-      shadow_hash_data['SALTED-SHA512-PBKDF2'][field] =  new_stringio_object unless shadow_hash_data['SALTED-SHA512-PBKDF2'][field]
-      shadow_hash_data['SALTED-SHA512-PBKDF2'][field].string = base64_decode_string(value)
+      shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = Puppet::Util::Plist.string_to_blob(base64_decode_string(value))
     when 'iterations'
       shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = Integer(value)
     else
@@ -633,19 +610,19 @@ Puppet::Type.type(:user).provide :directoryservice do
     # Convert shadow_hash_data to a binary plist, and call the
     # set_shadow_hash_data method to serialize and write the data
     # back to the user's plist.
-    binary_plist = self.class.convert_xml_to_binary(shadow_hash_data)
+    binary_plist = self.class.convert_hash_to_binary(shadow_hash_data)
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
   # This method will accept a plist in XML format, save it to disk, convert
   # the plist to a binary format, and flush the dscl cache.
   def write_users_plist_to_disk(users_plist)
-    Plist::Emit.save_plist(users_plist, "#{users_plist_dir}/#{@resource.name}.plist")
-    plutil'-convert', 'binary1', "#{users_plist_dir}/#{@resource.name}.plist"
+    Puppet::Util::Plist.write_plist_file(users_plist, "#{users_plist_dir}/#{@resource.name}.plist", :binary)
   end
 
   # This is a simple wrapper method for writing values to a file.
   def write_to_file(filename, value)
+    Puppet.deprecation_warning("Puppet::Type.type(:user).provider(:directoryservice).write_to_file is deprecated and will be removed in Puppet 5.")
     begin
       File.open(filename, 'w') { |f| f.write(value)}
     rescue Errno::EACCES => detail

data/lib/puppet/provider/user/hpux.rb

@@ -3,7 +3,7 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
     switch to HP-UX's special `usermod` binary to work around the fact that
     its standard `usermod` cannot make changes while the user is logged in.
     New functionality provides for changing trusted computing passwords and
-    resetting password expirations under trusted computing"
+    resetting password expirations under trusted computing."
 
   defaultfor :operatingsystem => "hp-ux"
   confine :operatingsystem => "hp-ux"

data/lib/puppet/provider/user/ldap.rb

@@ -46,7 +46,7 @@ Puppet::Type.type(:user).provide :ldap, :parent => Puppet::Provider::Ldap do
 
   # Convert our gid to a group name, if necessary.
   def gid=(value)
-    value = group2id(value) unless [Fixnum, Bignum].include?(value.class)
+    value = group2id(value) unless value.is_a?(Integer)
 
     @property_hash[:gid] = value
   end

data/lib/puppet/provider/user/pw.rb

@@ -8,6 +8,7 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
   has_features :manages_homedir, :allows_duplicates, :manages_passwords, :manages_expiry, :manages_shell
 
   defaultfor :operatingsystem => [:freebsd, :dragonfly]
+  confine    :operatingsystem => [:freebsd, :dragonfly]
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos