puppet 4.10.10-universal-darwin → 4.10.11-universal-darwin

data/lib/puppet/util/windows/principal.rb

@@ -32,9 +32,10 @@ module Puppet::Util::Windows::SID
         @sid_bytes == compare.sid_bytes
     end
 
-    # added for backward compatibility
+    # returns authority qualified account name
+    # prefer to compare Principal instances with == operator or by #sid
     def to_s
-      @sid
+      @domain_account
     end
 
     # = 8 + max sub identifiers (15) * 4
@@ -64,14 +65,14 @@ module Puppet::Util::Windows::SID
                 last_error = FFI.errno
 
                 if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
-                  raise Puppet::Util::Windows::Error.new('Failed to call LookupAccountNameW', last_error)
+                  raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name}, last_error)
                 end
 
                 FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
                   if LookupAccountNameW(system_name_ptr, account_name_ptr,
                       sid_ptr, sid_length_ptr,
                       domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
-                   raise Puppet::Util::Windows::Error.new('Failed to call LookupAccountNameW')
+                  raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name} )
                   end
 
                   # with a SID returned, loop back through lookup_account_sid to retrieve official name
@@ -93,7 +94,8 @@ module Puppet::Util::Windows::SID
     def self.lookup_account_sid(system_name = nil, sid_bytes)
       system_name_ptr = FFI::Pointer::NULL
       if (sid_bytes.nil? || (!sid_bytes.is_a? Array) || (sid_bytes.length == 0))
-        raise Puppet::Util::Windows::Error.new('Byte array for lookup_account_sid must not be nil and must be at least 1 byte long')
+        #TRANSLATORS `lookup_account_sid` is a variable name and should not be translated
+        raise Puppet::Util::Windows::Error.new(_('Byte array for lookup_account_sid must not be nil and must be at least 1 byte long'))
       end
 
       begin
@@ -115,14 +117,14 @@ module Puppet::Util::Windows::SID
                 last_error = FFI.errno
 
                 if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
-                  raise Puppet::Util::Windows::Error.new('Failed to call LookupAccountSidW', last_error)
+                  raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes}, last_error)
                 end
 
                 FFI::MemoryPointer.new(:lpwstr, name_length_ptr.read_dword) do |name_ptr|
                   FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
                     if LookupAccountSidW(system_name_ptr, sid_ptr, name_ptr, name_length_ptr,
                         domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
-                     raise Puppet::Util::Windows::Error.new('Failed to call LookupAccountSidW')
+                     raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes} )
                     end
 
                     return new(

data/lib/puppet/util/windows/sid.rb

@@ -52,18 +52,18 @@ module Puppet::Util::Windows
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
     # SID. Returns nil if the account doesn't exist.
     def name_to_sid(name)
-      sid = name_to_sid_object(name)
+      sid = name_to_principal(name)
 
       sid ? sid.sid : nil
     end
     module_function :name_to_sid
 
-    # Convert an account name, e.g. 'Administrators' into a SID object,
+    # Convert an account name, e.g. 'Administrators' into a Principal::SID object,
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
     # SID object. Returns nil if the account doesn't exist.
     # This method returns a SID::Principal with the account, domain, SID, etc
-    def name_to_sid_object(name)
+    def name_to_principal(name)
       # Apparently, we accept a symbol..
       name = name.to_s.strip if name
 
@@ -81,21 +81,50 @@ module Puppet::Util::Windows
     rescue
       nil
     end
-    module_function :name_to_sid_object
+    module_function :name_to_principal
+    class << self; alias name_to_sid_object name_to_principal; end
 
-    # Converts an octet string array of bytes to a SID object,
+    # Converts an octet string array of bytes to a SID::Principal object,
     # e.g. [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] is the representation for
     # S-1-5-18, the local 'SYSTEM' account.
     # Raises an Error for nil or non-array input.
     # This method returns a SID::Principal with the account, domain, SID, etc
-    def octet_string_to_sid_object(bytes)
+    def octet_string_to_principal(bytes)
       if !bytes || !bytes.respond_to?('pack') || bytes.empty?
         raise Puppet::Util::Windows::Error.new("Octet string must be an array of bytes")
       end
 
       Principal.lookup_account_sid(bytes)
     end
-    module_function :octet_string_to_sid_object
+    module_function :octet_string_to_principal
+    class << self; alias octet_string_to_sid_object octet_string_to_principal; end
+
+    # Converts a COM instance of IAdsUser or IAdsGroup to a SID::Principal object,
+    # Raises an Error for nil or an object without an objectSID / Name property.
+    # This method returns a SID::Principal with the account, domain, SID, etc
+    # This method will return instances even when the SID is unresolvable, as
+    # may be the case when domain users have been added to local groups, but
+    # removed from the domain
+    def ads_to_principal(ads_object)
+      if !ads_object || !ads_object.respond_to?(:ole_respond_to?) ||
+        !ads_object.ole_respond_to?(:objectSID) || !ads_object.ole_respond_to?(:Name)
+        raise Puppet::Error.new("ads_object must be an IAdsUser or IAdsGroup instance")
+      end
+      octet_string_to_principal(ads_object.objectSID)
+    rescue Puppet::Util::Windows::Error => e
+      # if the error is not a lookup / mapping problem, immediately re-raise
+      raise if e.code != ERROR_NONE_MAPPED
+
+      # if the Name property isn't formatted like a SID, OR
+      if !valid_sid?(ads_object.Name) ||
+        # if the objectSID doesn't match the Name property, also raise
+        ((converted = octet_string_to_sid_string(ads_object.objectSID)) != ads_object.Name)
+        raise Puppet::Error.new("ads_object Name: #{ads_object.Name} invalid or does not match objectSID: #{ads_object.objectSID} (#{converted})", e)
+      end
+
+      unresolved_principal(ads_object.Name, ads_object.objectSID)
+    end
+    module_function :ads_to_principal
 
     # Convert a SID string, e.g. "S-1-5-32-544" to a name,
     # e.g. 'BUILTIN\Administrators'. Returns nil if an account
@@ -193,6 +222,30 @@ module Puppet::Util::Windows
     end
     module_function :get_length_sid
 
+    def octet_string_to_sid_string(sid_bytes)
+      sid_string = nil
+
+      FFI::MemoryPointer.new(:byte, sid_bytes.length) do |sid_ptr|
+        sid_ptr.write_array_of_uchar(sid_bytes)
+        sid_string = Puppet::Util::Windows::SID.sid_ptr_to_string(sid_ptr)
+      end
+
+      sid_string
+    end
+    module_function :octet_string_to_sid_string
+
+    # @api private
+    def self.unresolved_principal(name, sid_bytes)
+      Principal.new(
+        name + " (unresolvable)", # account
+        sid_bytes, # sid_bytes
+        name, # sid string
+        nil, #domain
+        # https://msdn.microsoft.com/en-us/library/cc245534.aspx?f=255&MSPPError=-2147217396
+        # Indicates that the type of object could not be determined. For example, no object with that SID exists.
+        :SidTypeUnknown)
+    end
+
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379151(v=vs.85).aspx

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '4.10.10'
+  PUPPETVERSION = '4.10.11'
 
   ##
   # version is a public API method intended to always provide a fast and

data/locales/puppet.pot

@@ -6,11 +6,11 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Puppet automation framework 4.10.9-68-gf02ce86\n"
+"Project-Id-Version: Puppet automation framework 4.10.10-130-ge450355\n"
 "\n"
 "Report-Msgid-Bugs-To: https://tickets.puppetlabs.com\n"
-"POT-Creation-Date: 2018-01-03 19:17+0000\n"
-"PO-Revision-Date: 2018-01-03 19:17+0000\n"
+"POT-Creation-Date: 2018-03-19 17:44+0000\n"
+"PO-Revision-Date: 2018-03-19 17:44+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
@@ -31,6 +31,10 @@ msgstr ""
 msgid "`puppet %{name}` is deprecated and will be removed in a future release."
 msgstr ""
 
+#: ../lib/puppet/application/cert.rb:268
+msgid "Refusing to destroy all certs, provide an explicit list of certs to destroy"
+msgstr ""
+
 #: ../lib/puppet/defaults.rb:1749
 msgid "Setting 'archive_files' is deprecated. It will be removed in a future release along with the `inspect` command."
 msgstr ""
@@ -146,6 +150,10 @@ msgstr ""
 msgid "GettextSetup initialization for %{module_name} failed with: %{error_message}"
 msgstr ""
 
+#: ../lib/puppet/network/http/connection.rb:214
+msgid "request %{uri} interrupted after %{elapsed} seconds"
+msgstr ""
+
 #: ../lib/puppet/pops/lookup/environment_data_provider.rb:20
 msgid "hiera.yaml version 3 found at the environment root was ignored"
 msgstr ""
@@ -178,15 +186,75 @@ msgstr ""
 msgid "%{value} is not valid UTF-8 and result of overriding encoding would be invalid."
 msgstr ""
 
-#. TRANSLATORS message accompanied by date of generation
-#: ../lib/puppet/util/reference.rb:17
-msgid "This page autogenerated on "
-msgstr ""
-
-#. TRANSLATORS message accompanied by date of generation
-#: ../lib/puppet/util/reference.rb:116
+#: ../lib/puppet/util/reference.rb:111
 msgid ""
 "\n"
 "\n"
-"**This page is autogenerated; any changes will get overwritten** *(last generated on "
+"**This page is autogenerated; any changes will get overwritten**\n"
+"\n"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:19
+msgid "ADSI connection error: %{e}"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:42
+msgid "Failed to get computer name"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:80
+msgid "Must use a valid SID::Principal"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:132
+msgid "Value must be in DOMAIN\\user style syntax"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:158
+msgid "Could not resolve name: %{name}"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:216
+msgid "Puppet is not able to create/delete domain users with the user resource."
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:221
+msgid "User update failed: %{e}"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:316
+msgid "Cannot create user if group '%{name}' exists."
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:330
+msgid "Failed to get user name"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:408
+msgid "Cannot delete user profile for '%{sid}' prior to Vista SP1"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:446
+msgid "Puppet is not able to create/delete domain groups with the group resource."
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:451
+msgid "Group update failed: %{error}"
+msgstr ""
+
+#: ../lib/puppet/util/windows/adsi.rb:502
+msgid "Cannot create group if user '%{name}' exists."
+msgstr ""
+
+#: ../lib/puppet/util/windows/principal.rb:68 ../lib/puppet/util/windows/principal.rb:75
+msgid "Failed to call LookupAccountNameW with account: %{account_name}"
+msgstr ""
+
+#. TRANSLATORS `lookup_account_sid` is a variable name and should not be translated
+#: ../lib/puppet/util/windows/principal.rb:98
+msgid "Byte array for lookup_account_sid must not be nil and must be at least 1 byte long"
+msgstr ""
+
+#: ../lib/puppet/util/windows/principal.rb:120 ../lib/puppet/util/windows/principal.rb:127
+msgid "Failed to call LookupAccountSidW with bytes: %{sid_bytes}"
 msgstr ""

data/man/man5/puppet.conf.5

@@ -1,8 +1,8 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPETCONF" "5" "January 2018" "Puppet Labs, LLC" "Puppet manual"
-\fBThis page is autogenerated; any changes will get overwritten\fR \fI(last generated on 2018\-01\-12 16:59:36 \-0600)\fR
+.TH "PUPPETCONF" "5" "April 2018" "Puppet, Inc." "Puppet manual"
+\fBThis page is autogenerated; any changes will get overwritten\fR
 .
 .SH "Configuration Settings"
 .
@@ -326,7 +326,7 @@ The special value \fBca\fR is reserved, and can\'t be used as the certname for a
 Defaults to the node\'s fully qualified domain name\.
 .
 .IP "\(bu" 4
-\fIDefault\fR: jories\-macbook\-air\.local
+\fIDefault\fR: the Host\'s fully qualified domain name, as determined by facter
 .
 .IP "" 0
 .
@@ -942,7 +942,7 @@ The time to wait for one block to be read from an HTTP connection\. If nothing i
 The HTTP User\-Agent string to send when making network requests\.
 .
 .IP "\(bu" 4
-\fIDefault\fR: Puppet/4\.10\.9 Ruby/2\.3\.1\-p112 (x86_64\-darwin15)
+\fIDefault\fR: Puppet/4\.10\.11 Ruby/2\.3\.1\-p112 (x86_64\-linux)
 .
 .IP "" 0
 .
@@ -1710,7 +1710,7 @@ The maximum time to delay before runs\. Defaults to being the same as the run in
 The domain which will be queried to find the SRV records of servers to use\.
 .
 .IP "\(bu" 4
-\fIDefault\fR: local
+\fIDefault\fR: delivery\.puppetlabs\.net
 .
 .IP "" 0
 .
@@ -1976,6 +1976,4 @@ The directory in which YAML data is stored, usually in a subdirectory\.
 \fIDefault\fR: $vardir/yaml
 .
 .IP "" 0
-.
-.P
-\fIThis page autogenerated on 2018\-01\-12 16:59:36 \-0600\fR
+

data/man/man8/extlookup2hiera.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "EXTLOOKUP2HIERA" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "EXTLOOKUP2HIERA" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBextlookup2hiera\fR

data/man/man8/puppet-agent.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-AGENT" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-AGENT" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-agent\fR \- The puppet agent daemon

data/man/man8/puppet-apply.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-APPLY" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-APPLY" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-apply\fR \- Apply Puppet manifests locally

data/man/man8/puppet-ca.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CA" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-CA" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-ca\fR \- Local Puppet Certificate Authority management\.

data/man/man8/puppet-catalog.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CATALOG" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-CATALOG" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-catalog\fR \- Compile, save, view, and convert catalogs\.

data/man/man8/puppet-cert.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CERT" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-CERT" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-cert\fR \- Manage certificates and requests

data/man/man8/puppet-certificate.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CERTIFICATE" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-CERTIFICATE" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-certificate\fR \- Provide access to the CA for certificate management\.

data/man/man8/puppet-certificate_request.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CERTIFICATE_REQUEST" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-CERTIFICATE_REQUEST" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-certificate_request\fR \- Manage certificate requests\.

data/man/man8/puppet-certificate_revocation_list.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CERTIFICATE_REVOCATION_LIST" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-CERTIFICATE_REVOCATION_LIST" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-certificate_revocation_list\fR \- Manage the list of revoked certificates\.

data/man/man8/puppet-config.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CONFIG" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-CONFIG" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-config\fR \- Interact with Puppet\'s settings\.

data/man/man8/puppet-describe.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DESCRIBE" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-DESCRIBE" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-describe\fR \- Display help about resource types

data/man/man8/puppet-device.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DEVICE" "8" "January 2018" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-DEVICE" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-device\fR \- Manage remote network devices