puppet 4.10.0 → 5.0.0

data/lib/puppet/transaction.rb

@@ -43,7 +43,7 @@ class Puppet::Transaction
 
     @persistence = Puppet::Transaction::Persistence.new
 
-    @report = report || Puppet::Transaction::Report.new("apply", catalog.version, catalog.environment)
+    @report = report || Puppet::Transaction::Report.new(catalog.version, catalog.environment)
 
     @prioritizer = prioritizer
 
@@ -79,7 +79,7 @@ class Puppet::Transaction
       prerun_errors.each do |res, detail|
         res.log_exception(detail)
       end
-      raise Puppet::Error, "Some pre-run checks failed"
+      raise Puppet::Error, _("Some pre-run checks failed")
     end
   end
 
@@ -95,7 +95,7 @@ class Puppet::Transaction
 
     persistence.load if catalog.host_config?
 
-    Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
+    Puppet.info _("Applying configuration version '%{version}'") % { version: catalog.version } if catalog.version
 
     continue_while = lambda { !stop_processing? }
 
@@ -118,7 +118,7 @@ class Puppet::Transaction
       # is one, it must have been selected by the user.
       return if missing_tags?(resource)
       if resource.provider
-        resource.err "Provider #{resource.provider.class.name} is not functional on this host"
+        resource.err _("Provider %{name} is not functional on this host") % { name: resource.provider.class.name }
       else
         providerless_types << resource.type
       end
@@ -134,20 +134,35 @@ class Puppet::Transaction
     teardown = lambda do
       # Just once per type. No need to punish the user.
       providerless_types.uniq.each do |type|
-        Puppet.err "Could not find a suitable provider for #{type}"
+        Puppet.err _("Could not find a suitable provider for %{type}") % { type: type }
       end
 
       post_evalable_providers.each do |provider|
         begin
           provider.post_resource_eval
         rescue => detail
-          Puppet.log_exception(detail, "post_resource_eval failed for provider #{provider}")
+          Puppet.log_exception(detail, _("post_resource_eval failed for provider %{provider}") % { provider: provider })
         end
       end
 
       persistence.save if catalog.host_config?
     end
 
+    # Graph cycles are returned as an array of arrays
+    # - outer array is an array of cycles
+    # - each inner array is an array of resources involved in a cycle
+    # Short circuit resource evaluation if we detect cycle(s) in the graph. Mark
+    # each corresponding resource as failed in the report before we fail to
+    # ensure accurate reporting.
+    graph_cycle_handler = lambda do |cycles|
+      cycles.flatten.uniq.each do |resource|
+        # We add a failed resource event to the status to ensure accurate
+        # reporting through the event manager.
+        resource_status(resource).fail_with_event(_('resource is part of a dependency cycle'))
+      end
+      raise Puppet::Error, _('One or more resource dependency cycles detected in graph')
+    end
+
     # Generate the relationship graph, set up our generator to use it
     # for eval_generate, then kick off our traversal.
     generator.relationship_graph = relationship_graph
@@ -155,13 +170,14 @@ class Puppet::Transaction
                                 :pre_process => pre_process,
                                 :overly_deferred_resource_handler => overly_deferred_resource_handler,
                                 :canceled_resource_handler => canceled_resource_handler,
+                                :graph_cycle_handler => graph_cycle_handler,
                                 :teardown => teardown) do |resource|
       if resource.is_a?(Puppet::Type::Component)
-        Puppet.warning "Somehow left a component in the relationship graph"
+        Puppet.warning _("Somehow left a component in the relationship graph")
       else
-        resource.info "Starting to evaluate the resource" if Puppet[:evaltrace] and @catalog.host_config?
+        resource.info _("Starting to evaluate the resource") if Puppet[:evaltrace] and @catalog.host_config?
         seconds = thinmark { block.call(resource) }
-        resource.info "Evaluated in %0.2f seconds" % seconds if Puppet[:evaltrace] and @catalog.host_config?
+        resource.info _("Evaluated in %0.2f seconds") % seconds if Puppet[:evaltrace] and @catalog.host_config?
       end
     end
 
@@ -181,7 +197,9 @@ class Puppet::Transaction
 
   # Are there any failed resources in this transaction?
   def any_failed?
-    report.resource_statuses.values.detect { |status| status.failed? }
+    report.resource_statuses.values.detect { |status|
+      status.failed? || status.failed_to_restart?
+    }
   end
 
   # Find all of the changed resources.
@@ -229,9 +247,12 @@ class Puppet::Transaction
   def apply(resource, ancestor = nil)
     status = resource_harness.evaluate(resource)
     add_resource_status(status)
-    event_manager.queue_events(ancestor || resource, status.events) unless status.failed?
+    ancestor ||= resource
+    if !(status.failed? || status.failed_to_restart?)
+      event_manager.queue_events(ancestor, status.events)
+    end
   rescue => detail
-    resource.err "Could not evaluate: #{detail}"
+    resource.err _("Could not evaluate: %{detail}") % { detail: detail }
   end
 
   # Evaluate a single resource.
@@ -248,10 +269,6 @@ class Puppet::Transaction
     end
   end
 
-  def failed?(resource)
-    s = resource_status(resource) and s.failed?
-  end
-
   # Does this resource have any failed dependencies?
   def failed_dependencies?(resource)
     # When we introduced the :whit into the graph, to reduce the combinatorial
@@ -265,7 +282,7 @@ class Puppet::Transaction
       # See above. --daniel 2011-06-06
       unless suppress_report then
         s.failed_dependencies.each do |dep|
-          resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
+          resource.notice _("Dependency %{dep} has failures: %{status}") % { dep: dep, status: resource_status(dep).failed }
         end
       end
     end
@@ -285,7 +302,7 @@ class Puppet::Transaction
     relationship_graph.direct_dependencies_of(resource).each do |dep|
       if (s = resource_status(dep))
         failed.merge(s.failed_dependencies) if s.dependency_failed?
-        if s.failed?
+        if s.failed? || s.failed_to_restart?
           failed.add(dep)
         end
       end
@@ -322,7 +339,8 @@ class Puppet::Transaction
     begin
       provider_class.prefetch(resources)
     rescue LoadError, Puppet::MissingCommand => detail
-      Puppet.log_exception(detail, "Could not prefetch #{type_name} provider '#{provider_class.name}': #{detail}")
+      #TRANSLATORS `prefetch` is a function name and should not be translated
+      Puppet.log_exception(detail, _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail })
     end
     @prefetched_providers[type_name][provider_class.name] = true
   end
@@ -350,7 +368,7 @@ class Puppet::Transaction
       # like class and stage.  This is undesirable; while just skipping the
       # output isn't perfect, it is RC-safe. --daniel 2011-06-07
       unless resource.class == Puppet::Type.type(:whit) then
-        resource.warning "Skipping because of failed dependencies"
+        resource.warning _("Skipping because of failed dependencies")
       end
     elsif resource.virtual?
       resource.debug "Skipping because virtual"

data/lib/puppet/type/augeas.rb

@@ -164,7 +164,7 @@ Puppet::Type.newtype(:augeas) do
   validate do
     has_lens = !self[:lens].nil?
     has_incl = !self[:incl].nil?
-    self.fail "You must specify both the lens and incl parameters, or neither." if has_lens != has_incl
+    self.fail _("You must specify both the lens and incl parameters, or neither.") if has_lens != has_incl
   end
 
   newparam(:show_diff, :boolean => true, :parent => Puppet::Parameter::Boolean) do
@@ -188,7 +188,7 @@ Puppet::Type.newtype(:augeas) do
 
     # Make output a bit prettier
     def change_to_s(currentvalue, newvalue)
-      "executed successfully"
+      _("executed successfully")
     end
 
     # if the onlyif resource is provided, then the value is parsed.

data/lib/puppet/type/cron.rb

@@ -109,28 +109,23 @@ Puppet::Type.newtype(:cron) do
       false
     end
 
-    def should_to_s(newvalue = @should)
-      if newvalue
-        newvalue = [newvalue] unless newvalue.is_a?(Array)
-        if self.name == :command or newvalue[0].is_a? Symbol
-          newvalue[0]
-        else
-          newvalue.join(",")
+    def should_to_s(value = @should)
+      if value
+        if value.is_a?(Array) && (name == :command || value[0].is_a?(Symbol))
+          value = value[0]
         end
+        super(value)
       else
         nil
       end
     end
 
-    def is_to_s(currentvalue = @is)
-      if currentvalue
-        return currentvalue unless currentvalue.is_a?(Array)
-
-        if self.name == :command or currentvalue[0].is_a? Symbol
-          currentvalue[0]
-        else
-          currentvalue.join(",")
+    def is_to_s(value = @is)
+      if value
+        if value.is_a?(Array) && (name == :command || value[0].is_a?(Symbol))
+          value = value[0]
         end
+        super(value)
       else
         nil
       end
@@ -195,7 +190,7 @@ Puppet::Type.newtype(:cron) do
       if retval
         return retval.to_s
       else
-        self.fail "#{value} is not a valid #{self.class.name}"
+        self.fail _("%{value} is not a valid %{name}") % { value: value, name: self.class.name }
       end
     end
   end
@@ -253,7 +248,7 @@ Puppet::Type.newtype(:cron) do
     end
 
     validate do |value|
-      raise ArgumentError, "Invalid special schedule #{value.inspect}" unless specials.include?(value)
+      raise ArgumentError, _("Invalid special schedule %{value}") % { value: value.inspect } unless specials.include?(value)
     end
 
     def munge(value)
@@ -326,7 +321,7 @@ Puppet::Type.newtype(:cron) do
 
     validate do |value|
       unless value =~ /^\s*(\w+)\s*=\s*(.*)\s*$/ or value == :absent or value == "absent"
-        raise ArgumentError, "Invalid environment setting #{value.inspect}"
+        raise ArgumentError, _("Invalid environment setting %{value}") % { value: value.inspect }
       end
     end
 
@@ -338,18 +333,6 @@ Puppet::Type.newtype(:cron) do
       end
     end
 
-    def is_to_s(newvalue)
-      if newvalue
-        if newvalue.is_a?(Array)
-          newvalue.join(",")
-        else
-          newvalue
-        end
-      else
-        nil
-      end
-    end
-
     def should
       @should
     end
@@ -433,7 +416,7 @@ Puppet::Type.newtype(:cron) do
     [ :minute, :hour, :weekday, :monthday, :month ].each do |field|
       next unless self[field]
       next if self[field] == :absent
-      raise ArgumentError, "#{self.ref} cannot specify both a special schedule and a value for #{field}"
+      raise ArgumentError, _("%{cron} cannot specify both a special schedule and a value for %{field}") % { cron: self.ref, field: field }
     end
   end
 

data/lib/puppet/type/exec.rb

@@ -101,7 +101,7 @@ module Puppet
 
       # Make output a bit prettier
       def change_to_s(currentvalue, newvalue)
-        "executed successfully"
+        _("executed successfully")
       end
 
       # First verify that all of our checks pass.
@@ -135,7 +135,7 @@ module Puppet
             end
           end
         rescue Timeout::Error
-          self.fail Puppet::Error, "Command exceeded timeout", $!
+          self.fail Puppet::Error, _("Command exceeded timeout"), $!
         end
 
         if log = @resource[:logoutput]
@@ -159,9 +159,9 @@ module Puppet
         unless self.should.include?(@status.exitstatus.to_s)
           if @resource.parameter(:command).sensitive
             # Don't print sensitive commands in the clear
-            self.fail("[command redacted] returned #{@status.exitstatus} instead of one of [#{self.should.join(",")}]")
+            self.fail(_("[command redacted] returned %{status} instead of one of [%{expected}]") % { status: @status.exitstatus, expected: self.should.join(",") })
           else
-            self.fail("'#{self.resource[:command]}' returned #{@status.exitstatus} instead of one of [#{self.should.join(",")}]")
+            self.fail(_("'%{cmd}' returned %{status} instead of one of [%{expected}]") % { cmd: self.resource[:command], status: @status.exitstatus, expected: self.should.join(",") })
           end
         end
 
@@ -179,7 +179,7 @@ module Puppet
         any output is logged at the `err` log level."
 
       validate do |command|
-        raise ArgumentError, "Command must be a String, got value of class #{command.class}" unless command.is_a? String
+        raise ArgumentError, _("Command must be a String, got value of class %{klass}") % { klass: command.class } unless command.is_a? String
       end
     end
 
@@ -208,9 +208,9 @@ module Puppet
 
       validate do |user|
         if Puppet.features.microsoft_windows?
-          self.fail "Unable to execute commands as other users on Windows"
+          self.fail _("Unable to execute commands as other users on Windows")
         elsif !Puppet.features.root? && resource.current_username() != user
-          self.fail "Only root can execute commands as other users"
+          self.fail _("Only root can execute commands as other users")
         end
       end
     end
@@ -241,10 +241,14 @@ module Puppet
     end
 
     newparam(:refresh) do
-      desc "How to refresh this command.  By default, the exec is just
-        called again when it receives an event from another resource,
-        but this parameter allows you to define a different command
-        for refreshing."
+      desc "An alternate command to run when the `exec` receives a refresh event
+        from another resource. By default, Puppet runs the main command again.
+        For more details, see the notes about refresh behavior above, in the
+        description for this resource type.
+
+        Note that this alternate command runs with the same `provider`, `path`,
+        `user`, and `group` as the main command. If the `path` isn't set, you
+        must fully qualify the command's name."
 
       validate do |command|
         provider.validatecmd(command)
@@ -261,7 +265,7 @@ module Puppet
         values = [values] unless values.is_a? Array
         values.each do |value|
           unless value =~ /\w+=/
-            raise ArgumentError, "Invalid environment setting '#{value}'"
+            raise ArgumentError, _("Invalid environment setting '%{value}'") % { value: value }
           end
         end
       end
@@ -274,7 +278,7 @@ module Puppet
         if value =~ /^0?[0-7]{1,4}$/
           return value.to_i(8)
         else
-          raise Puppet::Error, "The umask specification is invalid: #{value.inspect}"
+          raise Puppet::Error, _("The umask specification is invalid: %{value}") % { value: value.inspect }
         end
       end
     end
@@ -290,7 +294,7 @@ module Puppet
         begin
           value = Float(value)
         rescue ArgumentError
-          raise ArgumentError, "The timeout must be a number.", $!.backtrace
+          raise ArgumentError, _("The timeout must be a number."), $!.backtrace
         end
         [value, 0.0].max
       end
@@ -308,11 +312,11 @@ module Puppet
       munge do |value|
         if value.is_a?(String)
           unless value =~ /^[\d]+$/
-            raise ArgumentError, "Tries must be an integer"
+            raise ArgumentError, _("Tries must be an integer")
           end
           value = Integer(value)
         end
-        raise ArgumentError, "Tries must be an integer >= 1" if value < 1
+        raise ArgumentError, _("Tries must be an integer >= 1") if value < 1
         value
       end
 
@@ -325,11 +329,11 @@ module Puppet
       munge do |value|
         if value.is_a?(String)
           unless value =~ /^[-\d.]+$/
-            raise ArgumentError, "try_sleep must be a number"
+            raise ArgumentError, _("try_sleep must be a number")
           end
           value = Float(value)
         end
-        raise ArgumentError, "try_sleep cannot be a negative number" if value < 0
+        raise ArgumentError, _("try_sleep cannot be a negative number") if value < 0
         value
       end
 
@@ -406,8 +410,10 @@ module Puppet
 
     newcheck(:unless) do
       desc <<-'EOT'
-        If this parameter is set, then this `exec` will run unless
-        the command has an exit code of 0.  For example:
+        A test command that checks the state of the target system and restricts
+        when the `exec` can run. If present, Puppet runs this test command
+        first, then runs the main command unless the test has an exit code of 0
+        (success). For example:
 
             exec { '/bin/echo root >> /usr/lib/cron/cron.allow':
               path   => '/usr/bin:/usr/sbin:/bin',
@@ -417,17 +423,16 @@ module Puppet
         This would add `root` to the cron.allow file (on Solaris) unless
         `grep` determines it's already there.
 
-        Note that this command follows the same rules as the main command,
-        such as which user and group it's run as.
-        This also means it must be fully qualified if the path is not set.
-        It also uses the same provider as the main command, so any behavior
-        that differs by provider will match.
+        Note that this test command runs with the same `provider`, `path`,
+        `user`, and `group` as the main command. If the `path` isn't set, you
+        must fully qualify the command's name.
 
-        Also note that unless can take an array as its value, e.g.:
+        This parameter can also take an array of commands. For example:
 
             unless => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
-        This will only run the exec if _all_ conditions in the array return false.
+        This `exec` would only run if every command in the array has a
+        non-zero exit code.
       EOT
 
       validate do |cmds|
@@ -443,7 +448,7 @@ module Puppet
         begin
           output, status = provider.run(value, true)
         rescue Timeout::Error
-          err "Check #{value.inspect} exceeded timeout"
+          err _("Check %{value} exceeded timeout") % { value: value.inspect }
           return false
         end
 
@@ -457,28 +462,29 @@ module Puppet
 
     newcheck(:onlyif) do
       desc <<-'EOT'
-        If this parameter is set, then this `exec` will only run if
-        the command has an exit code of 0.  For example:
+        A test command that checks the state of the target system and restricts
+        when the `exec` can run. If present, Puppet runs this test command
+        first, and only runs the main command if the test has an exit code of 0
+        (success). For example:
 
             exec { 'logrotate':
-              path   => '/usr/bin:/usr/sbin:/bin',
-              onlyif => 'test `du /var/log/messages | cut -f1` -gt 100000',
+              path     => '/usr/bin:/usr/sbin:/bin',
+              provider => shell,
+              onlyif   => 'test `du /var/log/messages | cut -f1` -gt 100000',
             }
 
-        This would run `logrotate` only if that test returned true.
-
-        Note that this command follows the same rules as the main command,
-        such as which user and group it's run as.
-        This also means it must be fully qualified if the path is not set.
+        This would run `logrotate` only if that test returns true.
 
-        It also uses the same provider as the main command, so any behavior
-        that differs by provider will match.
+        Note that this test command runs with the same `provider`, `path`,
+        `user`, and `group` as the main command. If the `path` isn't set, you
+        must fully qualify the command's name.
 
-        Also note that onlyif can take an array as its value, e.g.:
+        This parameter can also take an array of commands. For example:
 
             onlyif => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
-        This will only run the exec if _all_ conditions in the array return true.
+        This `exec` would only run if every command in the array has an
+        exit code of 0 (success).
       EOT
 
       validate do |cmds|
@@ -494,7 +500,7 @@ module Puppet
         begin
           output, status = provider.run(value, true)
         rescue Timeout::Error
-          err "Check #{value.inspect} exceeded timeout"
+          err _("Check %{value} exceeded timeout") % { value: value.inspect }
           return false
         end
 

data/lib/puppet/type/file/content.rb

@@ -22,7 +22,7 @@ module Puppet
       With very small files, you can construct content strings directly in
       the manifest...
 
-          define resolve(nameserver1, nameserver2, domain, search) {
+          define resolve($nameserver1, $nameserver2, $domain, $search) {
               $str = "search ${search}
                   domain ${domain}
                   nameserver ${nameserver1}

data/lib/puppet/type/file/group.rb

@@ -10,7 +10,7 @@ module Puppet
       On Windows, a user (such as "Administrator") can be set as a file's group
       and a group (such as "Administrators") can be set as a file's owner;
       however, a file's owner and group shouldn't be the same. (If the owner
-      is also the group, files with modes like `0640` will cause log churn, as
+      is also the group, files with modes like `"0640"` will cause log churn, as
       they will always appear out of sync.)
     EOT
 
@@ -31,11 +31,11 @@ module Puppet
 
     # We want to print names, not numbers
     def is_to_s(currentvalue)
-      provider.gid2name(currentvalue) || currentvalue
+      super(provider.gid2name(currentvalue) || currentvalue)
     end
 
     def should_to_s(newvalue)
-      provider.gid2name(newvalue) || newvalue
+      super(provider.gid2name(newvalue) || newvalue)
     end
   end
 end

data/lib/puppet/type/file/mode.rb

@@ -13,6 +13,10 @@ module Puppet
       notation. This value **must** be specified as a string; do not use
       un-quoted numbers to represent file modes.
 
+      If the mode is omitted (or explicitly set to `undef`), Puppet does not
+      enforce permissions on existing files and creates new files with
+      permissions of `0644`.
+
       The `file` type uses traditional Unix permission schemes and translates
       them to equivalent permissions for systems which represent permissions
       differently, including Windows. For detailed ACL controls on Windows,
@@ -20,7 +24,7 @@ module Puppet
       [the puppetlabs/acl module.](https://forge.puppetlabs.com/puppetlabs/acl)
 
       Numeric modes should use the standard octal notation of
-      `<SETUID/SETGID/STICKY><OWNER><GROUP><OTHER>` (e.g. '0644').
+      `<SETUID/SETGID/STICKY><OWNER><GROUP><OTHER>` (for example, "0644").
 
       * Each of the "owner," "group," and "other" digits should be a sum of the
         permissions for that class of users, where read = 4, write = 2, and
@@ -50,7 +54,7 @@ module Puppet
           * g (group's current permissions)
           * o (other's current permissions)
 
-      Thus, mode `0664` could be represented symbolically as either `a=r,ug+w`
+      Thus, mode `"0664"` could be represented symbolically as either `a=r,ug+w`
       or `ug=rw,o=r`.  However, symbolic modes are more expressive than numeric
       modes: a mode only affects the specified bits, so `mode => 'ug+w'` will
       set the user and group write bits, without affecting any other bits.
@@ -66,8 +70,8 @@ module Puppet
         `FILE_GENERIC_WRITE`, and `FILE_GENERIC_EXECUTE` access rights; a
         file's owner always has the `FULL_CONTROL` right
       * "Other" users can't have any permissions a file's group lacks,
-        and its group can't have any permissions its owner lacks; that is, 0644
-        is an acceptable mode, but 0464 is not.
+        and its group can't have any permissions its owner lacks; that is, "0644"
+        is an acceptable mode, but "0464" is not.
     EOT
 
     validate do |value|
@@ -157,7 +161,7 @@ module Puppet
     end
 
     def should_to_s(should_value)
-      should_value.rjust(4, "0")
+      "'#{should_value.rjust(4, '0')}'"
     end
 
     def is_to_s(currentvalue)
@@ -166,7 +170,7 @@ module Puppet
         # present to absent the mode will have a value of `:absent`.
         super
       else
-        currentvalue.rjust(4, "0")
+        "'#{currentvalue.rjust(4, '0')}'"
       end
     end
   end

data/lib/puppet/type/file/owner.rb

@@ -9,7 +9,7 @@ module Puppet
       On Windows, a group (such as "Administrators") can be set as a file's owner
       and a user (such as "Administrator") can be set as a file's group; however,
       a file's owner and group shouldn't be the same. (If the owner is also
-      the group, files with modes like `0640` will cause log churn, as they
+      the group, files with modes like `"0640"` will cause log churn, as they
       will always appear out of sync.)
     EOT
 
@@ -33,11 +33,11 @@ module Puppet
 
     # We want to print names, not numbers
     def is_to_s(currentvalue)
-      provider.uid2name(currentvalue) || currentvalue
+      super(provider.uid2name(currentvalue) || currentvalue)
     end
 
     def should_to_s(newvalue)
-      provider.uid2name(newvalue) || newvalue
+      super(provider.uid2name(newvalue) || newvalue)
     end
   end
 end

data/lib/puppet/type/file/selcontext.rb

@@ -29,7 +29,12 @@ module Puppet
     def retrieve
       return :absent unless @resource.stat
       context = self.get_selinux_current_context(@resource[:path])
-      parse_selinux_context(name, context)
+      is = parse_selinux_context(name, context)
+      if name == :selrange and selinux_support?
+        self.selinux_category_to_label(is)
+      else
+        is
+      end
     end
 
     def retrieve_default_context(property)
@@ -58,6 +63,18 @@ module Puppet
       end
     end
 
+    def unsafe_munge(should)
+      if not selinux_support?
+        return should
+      end
+
+      if name == :selrange
+        self.selinux_category_to_label(should)
+      else
+        should
+      end
+    end
+
     def sync
       self.set_selinux_context(@resource[:path], @should, name)
       :file_changed