puppet 4.1.0 → 5.0.0

data/lib/puppet/util/suidmanager.rb

@@ -99,7 +99,7 @@ module Puppet::Util::SUIDManager
   # change to a different gid without root.
   def change_group(group, permanently=false)
     gid = convert_xid(:gid, group)
-    raise Puppet::Error, "No such group #{group}" unless gid
+    raise Puppet::Error, _("No such group %{group}") % { group: group } unless gid
 
     return if Process.egid == gid
 
@@ -115,7 +115,7 @@ module Puppet::Util::SUIDManager
   # supplementary groups will be set the to default groups for the new uid.
   def change_user(user, permanently=false)
     uid = convert_xid(:uid, user)
-    raise Puppet::Error, "No such user #{user}" unless uid
+    raise Puppet::Error, _("No such user %{user}") % { user: user } unless uid
 
     return if Process.euid == uid
 
@@ -142,10 +142,10 @@ module Puppet::Util::SUIDManager
   # Make sure the passed argument is a number.
   def convert_xid(type, id)
     map = {:gid => :group, :uid => :user}
-    raise ArgumentError, "Invalid id type #{type}" unless map.include?(type)
+    raise ArgumentError, _("Invalid id type %{type}") % { type: type } unless map.include?(type)
     ret = Puppet::Util.send(type, id)
     if ret == nil
-      raise Puppet::Error, "Invalid #{map[type]}: #{id}"
+      raise Puppet::Error, _("Invalid %{klass}: %{id}") % { klass: map[type], id: id }
     end
     ret
   end

data/lib/puppet/util/symbolic_file_mode.rb

@@ -34,14 +34,14 @@ module SymbolicFileMode
 
   def symbolic_mode_to_int(modification, to_mode = 0, is_a_directory = false)
     if modification.nil? or modification == '' then
-      raise Puppet::Error, "An empty mode string is illegal"
+      raise Puppet::Error, _("An empty mode string is illegal")
     end
     if modification =~ /^[0-7]+$/ then return modification.to_i(8) end
     if modification =~ /^\d+$/ then
-      raise Puppet::Error, "Numeric modes must be in octal, not decimal!"
+      raise Puppet::Error, _("Numeric modes must be in octal, not decimal!")
     end
 
-    fail "non-numeric current mode (#{to_mode.inspect})" unless to_mode.is_a?(Numeric)
+    fail _("non-numeric current mode (%{mode})") % { mode: to_mode.inspect } unless to_mode.is_a?(Numeric)
 
     original_mode = {
       's' => (to_mode & 07000) >> 9,
@@ -61,7 +61,7 @@ module SymbolicFileMode
     modification.split(/\s*,\s*/).each do |part|
       begin
         _, to, dsl = /^([ugoa]*)([-+=].*)$/.match(part).to_a
-        if dsl.nil? then raise Puppet::Error, 'Missing action' end
+        if dsl.nil? then raise Puppet::Error, _('Missing action') end
         to = "a" unless to and to.length > 0
 
         # We want a snapshot of the mode before we start messing with it to
@@ -76,7 +76,7 @@ module SymbolicFileMode
 
           action = '!'
           actions = {
-            '!' => lambda {|_,_| raise Puppet::Error, 'Missing operation (-, =, or +)' },
+            '!' => lambda {|_,_| raise Puppet::Error, _('Missing operation (-, =, or +)') },
             '=' => lambda {|m,v| m | v },
             '+' => lambda {|m,v| m | v },
             '-' => lambda {|m,v| m & ~v },
@@ -98,7 +98,7 @@ module SymbolicFileMode
             when 'X' then
               # Only meaningful in combination with "set" actions.
               if action != '+' then
-                raise Puppet::Error, "X only works with the '+' operator"
+                raise Puppet::Error, _("X only works with the '+' operator")
               end
 
               # As per the BSD manual page, set if this is a directory, or if
@@ -109,11 +109,11 @@ module SymbolicFileMode
               end
 
             when /[st]/ then
-              bit = SymbolicSpecialToBit[op][who] or fail "internal error"
+              bit = SymbolicSpecialToBit[op][who] or fail _("internal error")
               final_mode['s'] = actions[action].call(final_mode['s'], bit)
 
             else
-              raise Puppet::Error, 'Unknown operation'
+              raise Puppet::Error, _('Unknown operation')
             end
           end
 
@@ -128,7 +128,7 @@ module SymbolicFileMode
           rest = ''
         end
 
-        raise Puppet::Error, "#{e}#{rest} in symbolic mode #{modification.inspect}", e.backtrace
+        raise Puppet::Error, _("%{error}%{rest} in symbolic mode %{modification}") % { error: e, rest: rest, modification: modification.inspect }, e.backtrace
       end
     end
 

data/lib/puppet/util/tag_set.rb

@@ -16,14 +16,11 @@ class Puppet::Util::TagSet < Set
     self.new(data)
   end
 
+  # TODO: A method named #to_data_hash should not return an array
   def to_data_hash
     to_a
   end
 
-  def to_pson(*args)
-    to_data_hash.to_pson
-  end
-
   def join(*args)
     to_a.join(*args)
   end

data/lib/puppet/util/tagging.rb

@@ -1,7 +1,7 @@
 require 'puppet/util/tag_set'
 
 module Puppet::Util::Tagging
-  ValidTagRegex = /^[0-9A-Za-z_][0-9A-Za-z_:.-]*$/
+  ValidTagRegex = /\A[[:alnum:]_][[:alnum:]_:.-]*\Z/
 
   # Add a tag to the current tag set.
   # When a tag set is used for a scope, these tags will be added to all of
@@ -18,11 +18,13 @@ module Puppet::Util::Tagging
       if @tags.add?(name)
         # not seen before, so now we test if it is valid
         if name =~ ValidTagRegex
+          if split_qualified_tags?
           # avoid adding twice by first testing if the string contains '::'
-          @tags.merge(name.split('::')) if name.include?('::')
+            @tags.merge(name.split('::')) if name.include?('::')
+          end
         else
           @tags.delete(name)
-          fail(Puppet::ParseError, "Invalid tag '#{name}'")
+          fail(Puppet::ParseError, _("Invalid tag '%{name}'") % { name: name })
         end
       end
     end
@@ -106,6 +108,10 @@ module Puppet::Util::Tagging
 
   private
 
+  def split_qualified_tags?
+    true
+  end
+
   def new_tags
     Puppet::Util::TagSet.new
   end

data/lib/puppet/util/watcher/periodic_watcher.rb

@@ -1,8 +1,8 @@
 # Monitor a given watcher for changes on a periodic interval.
 class Puppet::Util::Watcher::PeriodicWatcher
   # @param watcher [Puppet::Util::Watcher::ChangeWatcher] a watcher for the value to watch
-  # @param timer [Puppet::Util::Watcher::Timer] A timer to determin when to
-  #   recheck the watcher. If the timout of the timer is negative, then the
+  # @param timer [Puppet::Util::Watcher::Timer] A timer to determine when to
+  #   recheck the watcher. If the timeout of the timer is negative, then the
   #   watched value is always considered to be changed
   def initialize(watcher, timer)
     @watcher = watcher

data/lib/puppet/util/windows/access_control_entry.rb

@@ -3,7 +3,7 @@
 # Represents an access control entry, which grants or denies a subject,
 # identified by a SID, rights to a securable object.
 #
-# @see http://msdn.microsoft.com/en-us/library/windows/desktop/aa374868(v=vs.85).aspx
+# @see https://msdn.microsoft.com/en-us/library/windows/desktop/aa374868(v=vs.85).aspx
 # @api private
 class Puppet::Util::Windows::AccessControlEntry
   require 'puppet/util/windows/security'
@@ -47,7 +47,7 @@ class Puppet::Util::Windows::AccessControlEntry
 
   # Returns true if this ACE applies to child directories.
   #
-  # @return [Boolean] true if the ACE applies to child direcories
+  # @return [Boolean] true if the ACE applies to child directories
   def container_inherit?
     (@flags & CONTAINER_INHERIT_ACE) == CONTAINER_INHERIT_ACE
   end

data/lib/puppet/util/windows/access_control_list.rb

@@ -2,7 +2,7 @@
 #
 # Represents a list of access control entries (ACEs).
 #
-# @see http://msdn.microsoft.com/en-us/library/windows/desktop/aa374872(v=vs.85).aspx
+# @see https://msdn.microsoft.com/en-us/library/windows/desktop/aa374872(v=vs.85).aspx
 # @api private
 class Puppet::Util::Windows::AccessControlList
   include Enumerable
@@ -76,7 +76,7 @@ class Puppet::Util::Windows::AccessControlList
         else
           new_ace.sid = new_sid
 
-          prepend_needed = old_sid == Win32::Security::SID::LocalSystem
+          prepend_needed = old_sid == Puppet::Util::Windows::SID::LocalSystem
         end
       end
       new_aces << new_ace
@@ -87,7 +87,7 @@ class Puppet::Util::Windows::AccessControlList
     if prepend_needed
       mask = Puppet::Util::Windows::File::STANDARD_RIGHTS_ALL | Puppet::Util::Windows::File::SPECIFIC_RIGHTS_ALL
       ace = Puppet::Util::Windows::AccessControlEntry.new(
-              Win32::Security::SID::LocalSystem,
+              Puppet::Util::Windows::SID::LocalSystem,
               mask)
       @aces << ace
     end

data/lib/puppet/util/windows/adsi.rb

@@ -16,7 +16,7 @@ module Puppet::Util::Windows::ADSI
       begin
         WIN32OLE.connect(uri)
       rescue WIN32OLERuntimeError => e
-        raise Puppet::Error.new( "ADSI connection error: #{e}", e )
+        raise Puppet::Error.new( _("ADSI connection error: %{e}") % { e: e }, e )
       end
     end
 
@@ -39,7 +39,7 @@ module Puppet::Util::Windows::ADSI
             buffer_size.write_dword(max_length) # length in TCHARs
 
             if GetComputerNameW(buffer, buffer_size) == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new("Failed to get computer name")
+              raise Puppet::Util::Windows::Error.new(_("Failed to get computer name"))
             end
             @computer_name = buffer.read_wide_string(buffer_size.read_dword)
           end
@@ -56,21 +56,30 @@ module Puppet::Util::Windows::ADSI
       "winmgmts:{impersonationLevel=impersonate}!//#{host}/root/cimv2"
     end
 
+    # This method should *only* be used to generate WinNT://<SID> style monikers
+    # used for IAdsGroup::Add / IAdsGroup::Remove.  These URIs are not usable
+    # to resolve an account with WIN32OLE.connect
+    # Valid input is a SID::Principal, S-X-X style SID string or any valid
+    # account name with or without domain prefix
     # @api private
     def sid_uri_safe(sid)
-      return sid_uri(sid) if sid.kind_of?(Win32::Security::SID)
+      return sid_uri(sid) if sid.kind_of?(Puppet::Util::Windows::SID::Principal)
 
       begin
-        sid = Win32::Security::SID.new(Win32::Security::SID.string_to_sid(sid))
+        sid = Puppet::Util::Windows::SID.name_to_sid_object(sid)
         sid_uri(sid)
-      rescue SystemCallError
+      rescue Puppet::Util::Windows::Error, Puppet::Error
         nil
       end
     end
 
+    # This method should *only* be used to generate WinNT://<SID> style monikers
+    # used for IAdsGroup::Add / IAdsGroup::Remove.  These URIs are not useable
+    # to resolve an account with WIN32OLE.connect
     def sid_uri(sid)
-      raise Puppet::Error.new( "Must use a valid SID object" ) if !sid.kind_of?(Win32::Security::SID)
-      "WinNT://#{sid.to_s}"
+      raise Puppet::Error.new( _("Must use a valid SID::Principal") ) if !sid.kind_of?(Puppet::Util::Windows::SID::Principal)
+
+      "WinNT://#{sid.sid}"
     end
 
     def uri(resource_name, resource_type, host = '.')
@@ -87,7 +96,7 @@ module Puppet::Util::Windows::ADSI
 
     ffi_convention :stdcall
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
     # BOOL WINAPI GetComputerName(
     #   _Out_    LPTSTR lpBuffer,
     #   _Inout_  LPDWORD lpnSize
@@ -98,10 +107,19 @@ module Puppet::Util::Windows::ADSI
   end
 
   module Shared
-    def uri(name, host = '.')
-      if sid_uri = Puppet::Util::Windows::ADSI.sid_uri_safe(name) then return sid_uri end
+    def localized_domains
+      @localized_domains ||= [
+        # localized version of BUILTIN
+        # for instance VORDEFINIERT on German Windows
+        Puppet::Util::Windows::SID.sid_to_name('S-1-5-32').upcase,
+        # localized version of NT AUTHORITY (can't use S-1-5)
+        # for instance AUTORITE NT on French Windows
+        Puppet::Util::Windows::SID.name_to_sid_object('SYSTEM').domain.upcase
+      ]
+    end
 
-      host = '.' if ['NT AUTHORITY', 'BUILTIN', Socket.gethostname].include?(host)
+    def uri(name, host = '.')
+      host = '.' if (localized_domains << Socket.gethostname.upcase).include?(host.upcase)
 
       # group or user
       account_type = self.name.split('::').last.downcase
@@ -111,7 +129,7 @@ module Puppet::Util::Windows::ADSI
 
     def parse_name(name)
       if name =~ /\//
-        raise Puppet::Error.new( "Value must be in DOMAIN\\user style syntax" )
+        raise Puppet::Error.new( _("Value must be in DOMAIN\\user style syntax") )
       end
 
       matches = name.scan(/((.*)\\)?(.*)/)
@@ -135,8 +153,8 @@ module Puppet::Util::Windows::ADSI
 
       sids = names.map do |name|
         sid = Puppet::Util::Windows::SID.name_to_sid_object(name)
-        raise Puppet::Error.new( "Could not resolve name: #{name}" ) if !sid
-        [sid.to_s, sid]
+        raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
+        [sid.sid, sid]
       end
 
       Hash[ sids ]
@@ -177,6 +195,8 @@ module Puppet::Util::Windows::ADSI
     end
 
     def [](attribute)
+      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+      # values are returned as UTF-8
       native_user.Get(attribute)
     end
 
@@ -191,12 +211,12 @@ module Puppet::Util::Windows::ADSI
         # ERROR_BAD_USERNAME 2202L from winerror.h
         if e.message =~ /8007089A/m
           raise Puppet::Error.new(
-           "Puppet is not able to create/delete domain users with the user resource.",
+           _("Puppet is not able to create/delete domain users with the user resource."),
            e
           )
         end
 
-        raise Puppet::Error.new( "User update failed: #{e}", e )
+        raise Puppet::Error.new( _("User update failed: %{e}") % { e: e }, e )
       end
       self
     end
@@ -214,8 +234,11 @@ module Puppet::Util::Windows::ADSI
     end
 
     def password=(password)
-      native_user.SetPassword(password)
-      commit
+      if !password.nil?
+        native_user.SetPassword(password)
+        commit
+      end
+
       fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
       add_flag("UserFlags", fADS_UF_DONT_EXPIRE_PASSWD)
     end
@@ -224,6 +247,8 @@ module Puppet::Util::Windows::ADSI
       # https://msdn.microsoft.com/en-us/library/aa746342.aspx
       # WIN32OLE objects aren't enumerable, so no map
       groups = []
+      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+      # values are returned as UTF-8
       native_user.Groups.each {|g| groups << g.Name} rescue nil
       groups
     end
@@ -244,20 +269,12 @@ module Puppet::Util::Windows::ADSI
 
 
     def add_group_sids(*sids)
-      group_names = []
-      sids.each do |sid|
-        group_names << Puppet::Util::Windows::SID.sid_to_name(sid)
-      end
-
+      group_names = sids.map { |s| s.domain_account }
       add_to_groups(*group_names)
     end
 
     def remove_group_sids(*sids)
-      group_names = []
-      sids.each do |sid|
-        group_names << Puppet::Util::Windows::SID.sid_to_name(sid)
-      end
-
+      group_names = sids.map { |s| s.domain_account }
       remove_from_groups(*group_names)
     end
 
@@ -270,7 +287,7 @@ module Puppet::Util::Windows::ADSI
 
       desired_groups = desired_groups.split(',').map(&:strip)
 
-      current_hash = Hash[ self.group_sids.map { |sid| [sid.to_s, sid] } ]
+      current_hash = Hash[ self.group_sids.map { |sid| [sid.sid, sid] } ]
       desired_hash = self.class.name_sid_hash(desired_groups)
 
       # First we add the user to all the groups it should be in but isn't
@@ -294,11 +311,11 @@ module Puppet::Util::Windows::ADSI
 
     def self.create(name)
       # Windows error 1379: The specified local group already exists.
-      raise Puppet::Error.new( "Cannot create user if group '#{name}' exists." ) if Puppet::Util::Windows::ADSI::Group.exists? name
+      raise Puppet::Error.new(_("Cannot create user if group '%{name}' exists.") % { name: name }) if Puppet::Util::Windows::ADSI::Group.exists? name
       new(name, Puppet::Util::Windows::ADSI.create(name, 'user'))
     end
 
-    # UNLEN from lmcons.h - http://stackoverflow.com/a/2155176
+    # UNLEN from lmcons.h - https://stackoverflow.com/a/2155176
     MAX_USERNAME_LENGTH = 256
     def self.current_user_name
       user_name = ''
@@ -308,7 +325,7 @@ module Puppet::Util::Windows::ADSI
           buffer_size.write_dword(max_length) # length in TCHARs
 
           if GetUserNameW(buffer, buffer_size) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new("Failed to get user name")
+            raise Puppet::Util::Windows::Error.new(_("Failed to get user name"))
           end
           # buffer_size includes trailing NULL
           user_name = buffer.read_wide_string(buffer_size.read_dword - 1)
@@ -318,10 +335,34 @@ module Puppet::Util::Windows::ADSI
       user_name
     end
 
-    def self.exists?(name)
-      Puppet::Util::Windows::ADSI::connectable?(User.uri(*User.parse_name(name)))
+    def self.current_user_sid
+      Puppet::Util::Windows::SID.name_to_sid_object(current_user_name)
     end
 
+    def self.exists?(name_or_sid)
+      well_known = false
+      if (sid = Puppet::Util::Windows::SID.name_to_sid_object(name_or_sid))
+        return true if sid.account_type == :SidTypeUser
+
+        # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
+        # so try to resolve it
+        # https://msdn.microsoft.com/en-us/library/cc234477.aspx
+        well_known = sid.account_type == :SidTypeWellKnownGroup
+        return false if sid.account_type != :SidTypeAlias && !well_known
+        name_or_sid = "#{sid.domain}\\#{sid.account}"
+      end
+
+      user = Puppet::Util::Windows::ADSI.connect(User.uri(*User.parse_name(name_or_sid)))
+      # otherwise, verify that the account is actually a User account
+      user.Class == 'User'
+    rescue
+      # special accounts like SYSTEM cannot resolve via moniker like WinNT://./SYSTEM,user
+      # and thus fail to connect - so given a validly resolved SID, this failure is ambiguous as it
+      # may indicate either a group like Service or an account like SYSTEM
+      well_known
+    end
+
+
     def self.delete(name)
       Puppet::Util::Windows::ADSI.delete(name, 'user')
     end
@@ -331,6 +372,8 @@ module Puppet::Util::Windows::ADSI
 
       users = []
       wql.each do |u|
+        # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+        # values are returned as UTF-8
         users << new(u.name)
       end
 
@@ -339,7 +382,7 @@ module Puppet::Util::Windows::ADSI
 
     ffi_convention :stdcall
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/ms724432(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724432(v=vs.85).aspx
     # BOOL WINAPI GetUserName(
     #   _Out_    LPTSTR lpBuffer,
     #   _Inout_  LPDWORD lpnSize
@@ -354,13 +397,13 @@ module Puppet::Util::Windows::ADSI
       begin
         Puppet::Util::Windows::ADSI.wmi_connection.Delete("Win32_UserProfile.SID='#{sid}'")
       rescue WIN32OLERuntimeError => e
-        # http://social.technet.microsoft.com/Forums/en/ITCG/thread/0f190051-ac96-4bf1-a47f-6b864bfacee5
-        # Prior to Vista SP1, there's no builtin way to programmatically
+        # https://social.technet.microsoft.com/Forums/en/ITCG/thread/0f190051-ac96-4bf1-a47f-6b864bfacee5
+        # Prior to Vista SP1, there's no built-in way to programmatically
         # delete user profiles (except for delprof.exe). So try to delete
         # but warn if we fail
         raise e unless e.message.include?('80041010')
 
-        Puppet.warning "Cannot delete user profile for '#{sid}' prior to Vista SP1"
+        Puppet.warning _("Cannot delete user profile for '%{sid}' prior to Vista SP1") % { sid: sid }
       end
     end
   end
@@ -398,12 +441,12 @@ module Puppet::Util::Windows::ADSI
         # ERROR_BAD_USERNAME 2202L from winerror.h
         if e.message =~ /8007089A/m
           raise Puppet::Error.new(
-            "Puppet is not able to create/delete domain groups with the group resource.",
+            _("Puppet is not able to create/delete domain groups with the group resource."),
             e
           )
         end
 
-        raise Puppet::Error.new( "Group update failed: #{e}", e )
+        raise Puppet::Error.new( _("Group update failed: %{error}") % { error: e }, e )
       end
       self
     end
@@ -423,6 +466,8 @@ module Puppet::Util::Windows::ADSI
     def members
       # WIN32OLE objects aren't enumerable, so no map
       members = []
+      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+      # values are returned as UTF-8
       native_group.Members.each {|m| members << m.Name}
       members
     end
@@ -434,7 +479,7 @@ module Puppet::Util::Windows::ADSI
     def set_members(desired_members, inclusive = true)
       return if desired_members.nil?
 
-      current_hash = Hash[ self.member_sids.map { |sid| [sid.to_s, sid] } ]
+      current_hash = Hash[ self.member_sids.map { |sid| [sid.sid, sid] } ]
       desired_hash = self.class.name_sid_hash(desired_members)
 
       # First we add all missing members
@@ -457,12 +502,30 @@ module Puppet::Util::Windows::ADSI
 
     def self.create(name)
       # Windows error 2224: The account already exists.
-      raise Puppet::Error.new( "Cannot create group if user '#{name}' exists." ) if Puppet::Util::Windows::ADSI::User.exists? name
+      raise Puppet::Error.new( _("Cannot create group if user '%{name}' exists.") % { name: name } ) if Puppet::Util::Windows::ADSI::User.exists? name
       new(name, Puppet::Util::Windows::ADSI.create(name, 'group'))
     end
 
-    def self.exists?(name)
-      Puppet::Util::Windows::ADSI.connectable?(Group.uri(name))
+    def self.exists?(name_or_sid)
+      well_known = false
+      if (sid = Puppet::Util::Windows::SID.name_to_sid_object(name_or_sid))
+        return true if sid.account_type == :SidTypeGroup
+
+        # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
+        # so try to resolve it
+        # https://msdn.microsoft.com/en-us/library/cc234477.aspx
+        well_known = sid.account_type == :SidTypeWellKnownGroup
+        return false if sid.account_type != :SidTypeAlias && !well_known
+        name_or_sid = "#{sid.domain}\\#{sid.account}"
+      end
+
+      user = Puppet::Util::Windows::ADSI.connect(Group.uri(*Group.parse_name(name_or_sid)))
+      user.Class == 'Group'
+    rescue
+      # special groups like Authenticated Users cannot resolve via moniker like WinNT://./Authenticated Users,group
+      # and thus fail to connect - so given a validly resolved SID, this failure is ambiguous as it
+      # may indicate either a group like Service or an account like SYSTEM
+      well_known
     end
 
     def self.delete(name)
@@ -470,10 +533,12 @@ module Puppet::Util::Windows::ADSI
     end
 
     def self.each(&block)
-      wql = Puppet::Util::Windows::ADSI.execquery( 'select name from win32_group where localaccount = "TRUE"' )
+      wql = Puppet::Util::Windows::ADSI.execquery('select name from win32_group where localaccount = "TRUE"')
 
       groups = []
       wql.each do |g|
+        # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+        # values are returned as UTF-8
         groups << new(g.name)
       end