puppet 4.1.0 → 5.0.0

data/lib/puppet/type/exec.rb

@@ -101,7 +101,7 @@ module Puppet
 
       # Make output a bit prettier
       def change_to_s(currentvalue, newvalue)
-        "executed successfully"
+        _("executed successfully")
       end
 
       # First verify that all of our checks pass.
@@ -135,7 +135,7 @@ module Puppet
             end
           end
         rescue Timeout::Error
-          self.fail Puppet::Error, "Command exceeded timeout", $!
+          self.fail Puppet::Error, _("Command exceeded timeout"), $!
         end
 
         if log = @resource[:logoutput]
@@ -157,7 +157,12 @@ module Puppet
         end
 
         unless self.should.include?(@status.exitstatus.to_s)
-          self.fail("#{self.resource[:command]} returned #{@status.exitstatus} instead of one of [#{self.should.join(",")}]")
+          if @resource.parameter(:command).sensitive
+            # Don't print sensitive commands in the clear
+            self.fail(_("[command redacted] returned %{status} instead of one of [%{expected}]") % { status: @status.exitstatus, expected: self.should.join(",") })
+          else
+            self.fail(_("'%{cmd}' returned %{status} instead of one of [%{expected}]") % { cmd: self.resource[:command], status: @status.exitstatus, expected: self.should.join(",") })
+          end
         end
 
         event
@@ -174,7 +179,7 @@ module Puppet
         any output is logged at the `err` log level."
 
       validate do |command|
-        raise ArgumentError, "Command must be a String, got value of class #{command.class}" unless command.is_a? String
+        raise ArgumentError, _("Command must be a String, got value of class %{klass}") % { klass: command.class } unless command.is_a? String
       end
     end
 
@@ -203,9 +208,9 @@ module Puppet
 
       validate do |user|
         if Puppet.features.microsoft_windows?
-          self.fail "Unable to execute commands as other users on Windows"
+          self.fail _("Unable to execute commands as other users on Windows")
         elsif !Puppet.features.root? && resource.current_username() != user
-          self.fail "Only root can execute commands as other users"
+          self.fail _("Only root can execute commands as other users")
         end
       end
     end
@@ -236,10 +241,14 @@ module Puppet
     end
 
     newparam(:refresh) do
-      desc "How to refresh this command.  By default, the exec is just
-        called again when it receives an event from another resource,
-        but this parameter allows you to define a different command
-        for refreshing."
+      desc "An alternate command to run when the `exec` receives a refresh event
+        from another resource. By default, Puppet runs the main command again.
+        For more details, see the notes about refresh behavior above, in the
+        description for this resource type.
+
+        Note that this alternate command runs with the same `provider`, `path`,
+        `user`, and `group` as the main command. If the `path` isn't set, you
+        must fully qualify the command's name."
 
       validate do |command|
         provider.validatecmd(command)
@@ -256,7 +265,7 @@ module Puppet
         values = [values] unless values.is_a? Array
         values.each do |value|
           unless value =~ /\w+=/
-            raise ArgumentError, "Invalid environment setting '#{value}'"
+            raise ArgumentError, _("Invalid environment setting '%{value}'") % { value: value }
           end
         end
       end
@@ -269,7 +278,7 @@ module Puppet
         if value =~ /^0?[0-7]{1,4}$/
           return value.to_i(8)
         else
-          raise Puppet::Error, "The umask specification is invalid: #{value.inspect}"
+          raise Puppet::Error, _("The umask specification is invalid: %{value}") % { value: value.inspect }
         end
       end
     end
@@ -285,7 +294,7 @@ module Puppet
         begin
           value = Float(value)
         rescue ArgumentError
-          raise ArgumentError, "The timeout must be a number.", $!.backtrace
+          raise ArgumentError, _("The timeout must be a number."), $!.backtrace
         end
         [value, 0.0].max
       end
@@ -303,11 +312,11 @@ module Puppet
       munge do |value|
         if value.is_a?(String)
           unless value =~ /^[\d]+$/
-            raise ArgumentError, "Tries must be an integer"
+            raise ArgumentError, _("Tries must be an integer")
           end
           value = Integer(value)
         end
-        raise ArgumentError, "Tries must be an integer >= 1" if value < 1
+        raise ArgumentError, _("Tries must be an integer >= 1") if value < 1
         value
       end
 
@@ -320,11 +329,11 @@ module Puppet
       munge do |value|
         if value.is_a?(String)
           unless value =~ /^[-\d.]+$/
-            raise ArgumentError, "try_sleep must be a number"
+            raise ArgumentError, _("try_sleep must be a number")
           end
           value = Float(value)
         end
-        raise ArgumentError, "try_sleep cannot be a negative number" if value < 0
+        raise ArgumentError, _("try_sleep cannot be a negative number") if value < 0
         value
       end
 
@@ -340,15 +349,15 @@ module Puppet
         other object; it is useful for triggering an action:
 
             # Pull down the main aliases file
-            file { "/etc/aliases":
-              source => "puppet://server/module/aliases"
+            file { '/etc/aliases':
+              source => 'puppet://server/module/aliases',
             }
 
             # Rebuild the database, but only when the file changes
             exec { newaliases:
-              path        => ["/usr/bin", "/usr/sbin"],
-              subscribe   => File["/etc/aliases"],
-              refreshonly => true
+              path        => ['/usr/bin', '/usr/sbin'],
+              subscribe   => File['/etc/aliases'],
+              refreshonly => true,
             }
 
         Note that only `subscribe` and `notify` can trigger actions, not `require`,
@@ -377,10 +386,10 @@ module Puppet
         This parameter doesn't cause Puppet to create a file; it is only
         useful if **the command itself** creates a file.
 
-            exec { "tar -xf /Volumes/nfs02/important.tar":
-              cwd     => "/var/tmp",
-              creates => "/var/tmp/myfile",
-              path    => ["/usr/bin", "/usr/sbin"]
+            exec { 'tar -xf /Volumes/nfs02/important.tar':
+              cwd     => '/var/tmp',
+              creates => '/var/tmp/myfile',
+              path    => ['/usr/bin', '/usr/sbin',],
             }
 
         In this example, `myfile` is assumed to be a file inside
@@ -401,21 +410,29 @@ module Puppet
 
     newcheck(:unless) do
       desc <<-'EOT'
-        If this parameter is set, then this `exec` will run unless
-        the command has an exit code of 0.  For example:
-
-            exec { "/bin/echo root >> /usr/lib/cron/cron.allow":
-              path   => "/usr/bin:/usr/sbin:/bin",
-              unless => "grep root /usr/lib/cron/cron.allow 2>/dev/null"
+        A test command that checks the state of the target system and restricts
+        when the `exec` can run. If present, Puppet runs this test command
+        first, then runs the main command unless the test has an exit code of 0
+        (success). For example:
+
+            exec { '/bin/echo root >> /usr/lib/cron/cron.allow':
+              path   => '/usr/bin:/usr/sbin:/bin',
+              unless => 'grep root /usr/lib/cron/cron.allow 2>/dev/null',
             }
 
         This would add `root` to the cron.allow file (on Solaris) unless
         `grep` determines it's already there.
 
-        Note that this command follows the same rules as the main command,
-        which is to say that it must be fully qualified if the path is not set.
-        It also uses the same provider as the main command, so any behavior
-        that differs by provider will match.
+        Note that this test command runs with the same `provider`, `path`,
+        `user`, and `group` as the main command. If the `path` isn't set, you
+        must fully qualify the command's name.
+
+        This parameter can also take an array of commands. For example:
+
+            unless => ['test -f /tmp/file1', 'test -f /tmp/file2'],
+
+        This `exec` would only run if every command in the array has a
+        non-zero exit code.
       EOT
 
       validate do |cmds|
@@ -431,7 +448,7 @@ module Puppet
         begin
           output, status = provider.run(value, true)
         rescue Timeout::Error
-          err "Check #{value.inspect} exceeded timeout"
+          err _("Check %{value} exceeded timeout") % { value: value.inspect }
           return false
         end
 
@@ -445,26 +462,29 @@ module Puppet
 
     newcheck(:onlyif) do
       desc <<-'EOT'
-        If this parameter is set, then this `exec` will only run if
-        the command has an exit code of 0.  For example:
-
-            exec { "logrotate":
-              path   => "/usr/bin:/usr/sbin:/bin",
-              onlyif => "test `du /var/log/messages | cut -f1` -gt 100000"
+        A test command that checks the state of the target system and restricts
+        when the `exec` can run. If present, Puppet runs this test command
+        first, and only runs the main command if the test has an exit code of 0
+        (success). For example:
+
+            exec { 'logrotate':
+              path     => '/usr/bin:/usr/sbin:/bin',
+              provider => shell,
+              onlyif   => 'test `du /var/log/messages | cut -f1` -gt 100000',
             }
 
-        This would run `logrotate` only if that test returned true.
+        This would run `logrotate` only if that test returns true.
 
-        Note that this command follows the same rules as the main command,
-        which is to say that it must be fully qualified if the path is not set.
-        It also uses the same provider as the main command, so any behavior
-        that differs by provider will match.
+        Note that this test command runs with the same `provider`, `path`,
+        `user`, and `group` as the main command. If the `path` isn't set, you
+        must fully qualify the command's name.
 
-        Also note that onlyif can take an array as its value, e.g.:
+        This parameter can also take an array of commands. For example:
 
-            onlyif => ["test -f /tmp/file1", "test -f /tmp/file2"]
+            onlyif => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
-        This will only run the exec if _all_ conditions in the array return true.
+        This `exec` would only run if every command in the array has an
+        exit code of 0 (success).
       EOT
 
       validate do |cmds|
@@ -480,7 +500,7 @@ module Puppet
         begin
           output, status = provider.run(value, true)
         rescue Timeout::Error
-          err "Check #{value.inspect} exceeded timeout"
+          err _("Check %{value} exceeded timeout") % { value: value.inspect }
           return false
         end
 
@@ -588,5 +608,15 @@ module Puppet
     def current_username
       Etc.getpwuid(Process.uid).name
     end
+
+    private
+    def set_sensitive_parameters(sensitive_parameters)
+      # Respect sensitive commands
+      if sensitive_parameters.include?(:command)
+        sensitive_parameters.delete(:command)
+        parameter(:command).sensitive = true
+      end
+      super(sensitive_parameters)
+    end
   end
 end

data/lib/puppet/type/file/checksum.rb

@@ -16,6 +16,7 @@ Puppet::Type.type(:file).newparam(:checksum) do
   end
 
   def sum(content)
+    content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
     type = digest_algorithm()
     "{#{type}}" + send(type, content)
   end

data/lib/puppet/type/file/checksum_value.rb

@@ -0,0 +1,53 @@
+require 'puppet/util/checksums'
+require 'puppet/type/file/data_sync'
+
+module Puppet
+  Puppet::Type.type(:file).newproperty(:checksum_value) do
+    include Puppet::Util::Checksums
+    include Puppet::DataSync
+
+    desc "The checksum of the source contents. Only md5 and sha256 are supported when
+      specifying this parameter. If this parameter is set, source_permissions will be
+      assumed to be false, and ownership and permissions will not be read from source."
+
+    def insync?(is)
+      # If checksum_value and source are specified, manage the file contents.
+      # Otherwise the content property will manage syncing.
+      if resource.parameter(:source).nil?
+        return true
+      end
+
+      checksum_insync?(resource.parameter(:source), is, true) {|_is| super(_is)}
+    end
+
+    def property_matches?(current, desired)
+      return true if super(current, desired)
+      return date_matches?(resource.parameter(:checksum).value, current, desired)
+    end
+
+    def retrieve
+      # If checksum_value and source are specified, manage the file contents.
+      # Otherwise the content property will manage syncing. Don't compute the checksum twice.
+      if resource.parameter(:source).nil?
+        return nil
+      end
+
+      result = retrieve_checksum(resource)
+      # If the returned type matches the util/checksums format (prefixed with the type),
+      # strip the checksum type.
+      result = sumdata(result) if checksum?(result)
+      result
+    end
+
+    def sync
+      if resource.parameter(:source).nil?
+        devfail "checksum_value#sync should not be called without a source parameter"
+      end
+
+      # insync? only returns false if it expects to manage the file content,
+      # so instruct the resource to write its contents.
+      contents_sync(resource.parameter(:source))
+    end
+
+  end
+end

data/lib/puppet/type/file/content.rb

@@ -1,18 +1,14 @@
 require 'net/http'
 require 'uri'
 require 'tempfile'
-require 'date'
 
 require 'puppet/util/checksums'
-require 'puppet/network/http'
-require 'puppet/network/http/api/indirected_routes'
-require 'puppet/network/http/compression'
+require 'puppet/type/file/data_sync.rb'
 
 module Puppet
   Puppet::Type.type(:file).newproperty(:content) do
-    include Puppet::Util::Diff
     include Puppet::Util::Checksums
-    include Puppet::Network::HTTP::Compression.module
+    include Puppet::DataSync
 
     attr_reader :actual_content
 
@@ -26,21 +22,21 @@ module Puppet
       With very small files, you can construct content strings directly in
       the manifest...
 
-          define resolve(nameserver1, nameserver2, domain, search) {
-              $str = "search $search
-                  domain $domain
-                  nameserver $nameserver1
-                  nameserver $nameserver2
+          define resolve($nameserver1, $nameserver2, $domain, $search) {
+              $str = "search ${search}
+                  domain ${domain}
+                  nameserver ${nameserver1}
+                  nameserver ${nameserver2}
                   "
 
-              file { "/etc/resolv.conf":
-                content => "$str",
+              file { '/etc/resolv.conf':
+                content => $str,
               }
           }
 
       ...but for larger files, this attribute is more useful when combined with the
-      [template](http://docs.puppetlabs.com/references/latest/function.html#template)
-      or [file](http://docs.puppetlabs.com/references/latest/function.html#file)
+      [template](https://docs.puppetlabs.com/puppet/latest/reference/function.html#template)
+      or [file](https://docs.puppetlabs.com/puppet/latest/reference/function.html#file)
       function.
     EOT
 
@@ -49,13 +45,13 @@ module Puppet
     munge do |value|
       if value == :absent
         value
-      elsif checksum?(value)
+      elsif value.is_a?(String) && checksum?(value)
         # XXX This is potentially dangerous because it means users can't write a file whose
-        # entire contents are a plain checksum
+        # entire contents are a plain checksum unless it is a Binary content.
         value
       else
-        @actual_content = value
-        resource.parameter(:checksum).sum(value)
+        @actual_content = value.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? value.binary_buffer : value
+        resource.parameter(:checksum).sum(@actual_content)
       end
     end
 
@@ -86,53 +82,29 @@ module Puppet
     # Also, fix #872: when content is used, and replace is true, the file
     # should be insync when it exists
     def insync?(is)
-      if resource.should_be_file?
-        return false if is == :absent
-      else
-        if resource[:ensure] == :present and resource[:content] and s = resource.stat
-          resource.warning "Ensure set to :present but file type is #{s.ftype} so no content will be synced"
-        end
-        return true
+      if resource[:source] && resource[:checksum_value]
+        # Asserts that nothing has changed since validate ran.
+        devfail "content property should not exist if source and checksum_value are specified"
       end
 
-      return true if ! @resource.replace?
-
-      result = super
-
-      if ! result and Puppet[:show_diff] and resource.show_diff?
-        write_temporarily do |path|
-          send @resource[:loglevel], "\n" + diff(@resource[:path], path)
-        end
-      end
-      result
+      contents_prop = resource.parameter(:source) || self
+      checksum_insync?(contents_prop, is, !resource[:content].nil?) {|_is| super(_is)}
     end
 
     def property_matches?(current, desired)
-      basic = super
-      # The inherited equality is always accepted, so use it if valid.
-      time_types = [:mtime, :ctime]
+      # If checksum_value is specified, it overrides comparing the content field.
       checksum_type = resource.parameter(:checksum).value
-      return basic if basic || !time_types.include?(checksum_type)
-      return false unless current && desired
-      begin
-        raise if !time_types.include?(sumtype(current).to_sym) || !time_types.include?(sumtype(desired).to_sym)
-        DateTime.parse(sumdata(current)) >= DateTime.parse(sumdata(desired))
-      rescue => detail
-        self.fail Puppet::Error, "Resource with checksum_type #{checksum_type} didn't contain a date in #{current} or #{desired}", detail.backtrace
+      if checksum_value = resource.parameter(:checksum_value)
+        desired = "{#{checksum_type}}#{checksum_value.value}"
       end
+
+      # The inherited equality is always accepted, so use it if valid.
+      return true if super(current, desired)
+      return date_matches?(checksum_type, current, desired)
     end
 
     def retrieve
-      return :absent unless stat = @resource.stat
-      ftype = stat.ftype
-      # Don't even try to manage the content on directories or links
-      return nil if ["directory","link"].include?(ftype)
-
-      begin
-        resource.parameter(:checksum).sum_file(resource[:path])
-      rescue => detail
-        raise Puppet::Error, "Could not read #{ftype} #{@resource.title}: #{detail}", detail.backtrace
-      end
+      retrieve_checksum(resource)
     end
 
     # Make sure we're also managing the checksum property.
@@ -146,93 +118,36 @@ module Puppet
 
     # Just write our content out to disk.
     def sync
-      return_event = @resource.stat ? :file_changed : :file_created
-
-      # We're safe not testing for the 'source' if there's no 'should'
-      # because we wouldn't have gotten this far if there weren't at least
-      # one valid value somewhere.
-      @resource.write(:content)
-
-      return_event
-    end
-
-    def write_temporarily
-      tempfile = Tempfile.new("puppet-file")
-      tempfile.open
-
-      write(tempfile)
-
-      tempfile.close
-
-      yield tempfile.path
-
-      tempfile.delete
+      contents_sync(resource.parameter(:source) || self)
     end
 
     def write(file)
       resource.parameter(:checksum).sum_stream { |sum|
-        each_chunk_from(actual_content || resource.parameter(:source)) { |chunk|
+        each_chunk_from { |chunk|
           sum << chunk
           file.print chunk
         }
       }
     end
 
+    private
+
     # the content is munged so if it's a checksum source_or_content is nil
     # unless the checksum indirectly comes from source
-    def each_chunk_from(source_or_content)
-      if source_or_content.is_a?(String)
-        yield source_or_content
-      elsif content_is_really_a_checksum? && source_or_content.nil?
+    def each_chunk_from
+      if actual_content.is_a?(String)
+        yield actual_content
+      elsif content_is_really_a_checksum? && actual_content.nil?
         yield read_file_from_filebucket
-      elsif source_or_content.nil?
+      elsif actual_content.nil?
         yield ''
-      elsif Puppet[:default_file_terminus] == :file_server
-        yield source_or_content.content
-      elsif source_or_content.local?
-        chunk_file_from_disk(source_or_content) { |chunk| yield chunk }
-      else
-        chunk_file_from_source(source_or_content) { |chunk| yield chunk }
       end
     end
 
-    private
-
     def content_is_really_a_checksum?
       checksum?(should)
     end
 
-    def chunk_file_from_disk(source_or_content)
-      File.open(source_or_content.full_path, "rb") do |src|
-        while chunk = src.read(8192)
-          yield chunk
-        end
-      end
-    end
-
-    def get_from_source(source_or_content, &block)
-      source = source_or_content.metadata.source
-      request = Puppet::Indirector::Request.new(:file_content, :find, source, nil, :environment => resource.catalog.environment_instance)
-
-      request.do_request(:fileserver) do |req|
-        connection = Puppet::Network::HttpPool.http_instance(req.server, req.port)
-        connection.request_get(Puppet::Network::HTTP::API::IndirectedRoutes.request_to_uri(req), add_accept_encoding({"Accept" => "binary"}), &block)
-      end
-    end
-
-
-    def chunk_file_from_source(source_or_content)
-      get_from_source(source_or_content) do |response|
-        case response.code
-        when /^2/;  uncompress(response) { |uncompressor| response.read_body { |chunk| yield uncompressor.uncompress(chunk) } }
-        else
-          # Raise the http error if we didn't get a 'success' of some kind.
-          message = "Error #{response.code} on SERVER: #{(response.body||'').empty? ? response.message : uncompress_body(response)}"
-          raise Net::HTTPError.new(message, response)
-        end
-      end
-    end
-
     def read_file_from_filebucket
       raise "Could not get filebucket from file" unless dipper = resource.bucket
       sum = should.sub(/\{\w+\}/, '')

data/lib/puppet/type/file/data_sync.rb

@@ -0,0 +1,92 @@
+require 'puppet/util/checksums'
+require 'puppet/util/diff'
+require 'date'
+require 'tempfile'
+
+module Puppet
+  module DataSync
+    include Puppet::Util::Checksums
+    include Puppet::Util::Diff
+
+    def write_temporarily(param)
+      tempfile = Tempfile.new("puppet-file")
+      tempfile.open
+
+      param.write(tempfile)
+
+      tempfile.close
+
+      yield tempfile.path
+    ensure
+      tempfile.delete if tempfile
+    end
+
+    def checksum_insync?(param, is, has_contents, &block)
+      resource = param.resource
+      if resource.should_be_file?
+        return false if is == :absent
+      else
+        if resource[:ensure] == :present && has_contents && (s = resource.stat)
+          resource.warning "Ensure set to :present but file type is #{s.ftype} so no content will be synced"
+        end
+        return true
+      end
+
+      return true if ! resource.replace?
+
+      is_insync = yield(is)
+
+      if show_diff?(!is_insync)
+        if param.sensitive
+          send resource[:loglevel], "[diff redacted]"
+        else
+          write_temporarily(param) do |path|
+            send resource[:loglevel], "\n" + diff(resource[:path], path)
+          end
+        end
+      end
+      is_insync
+    end
+
+    def show_diff?(has_changes)
+      has_changes && Puppet[:show_diff] && resource.show_diff?
+    end
+
+    def date_matches?(checksum_type, current, desired)
+      time_types = [:mtime, :ctime]
+      return false if !time_types.include?(checksum_type)
+      return false unless current && desired
+
+      begin
+        if checksum?(current) || checksum?(desired)
+          raise if !time_types.include?(sumtype(current).to_sym) || !time_types.include?(sumtype(desired).to_sym)
+          current = sumdata(current)
+          desired = sumdata(desired)
+        end
+        DateTime.parse(current) >= DateTime.parse(desired)
+      rescue => detail
+        self.fail Puppet::Error, "Resource with checksum_type #{checksum_type} didn't contain a date in #{current} or #{desired}", detail.backtrace
+      end
+    end
+
+    def retrieve_checksum(resource)
+      return :absent unless stat = resource.stat
+      ftype = stat.ftype
+      # Don't even try to manage the content on directories or links
+      return nil if ["directory","link"].include?(ftype)
+
+      begin
+        resource.parameter(:checksum).sum_file(resource[:path])
+      rescue => detail
+        raise Puppet::Error, "Could not read #{ftype} #{resource.title}: #{detail}", detail.backtrace
+      end
+    end
+
+    def contents_sync(param)
+      return_event = param.resource.stat ? :file_changed : :file_created
+      resource.write(param)
+      return_event
+    end
+
+  end
+end