puppet 4.3.0 → 4.4.0

data/lib/puppet/provider/sshkey/parsed.rb

@@ -8,7 +8,7 @@ Puppet::Type.type(:sshkey).provide(
   desc "Parse and generate host-wide known hosts files for SSH."
 
   text_line :comment, :match => /^#/
-  text_line :blank, :match => /^\s+/
+  text_line :blank, :match => /^\s*$/
 
   record_line :parsed, :fields => %w{name type key},
     :post_parse => proc { |hash|

data/lib/puppet/provider/user/aix.rb

@@ -7,7 +7,7 @@
 #   but puppet does not allow it. There is a ticket open for that (#5431)
 # - AIX maximum password age is in WEEKs, not days
 #
-# See  http://docs.puppetlabs.com/guides/provider_development.html
+# See  https://docs.puppetlabs.com/guides/provider_development.html
 # for more information
 #
 # Author::    Hector Rivas Gandara <keymon@gmail.com>

data/lib/puppet/provider/user/directoryservice.rb

@@ -1,5 +1,5 @@
 require 'puppet'
-require 'plist'
+require 'puppet/util/plist' if Puppet.features.cfpropertylist?
 require 'base64'
 
 Puppet::Type.type(:user).provide :directoryservice do
@@ -13,11 +13,11 @@ Puppet::Type.type(:user).provide :directoryservice do
   commands :uuidgen      => '/usr/bin/uuidgen'
   commands :dsimport     => '/usr/bin/dsimport'
   commands :dscl         => '/usr/bin/dscl'
-  commands :plutil       => '/usr/bin/plutil'
   commands :dscacheutil  => '/usr/bin/dscacheutil'
 
   # Provider confines and defaults
   confine    :operatingsystem => :darwin
+  confine    :feature         => :cfpropertylist
   defaultfor :operatingsystem => :darwin
 
   # Need this to create getter/setter methods automagically
@@ -91,7 +91,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   # Return an array of hashes containing information about every user on
   # the system.
   def self.get_all_users
-    Plist.parse_xml(dscl '-plist', '.', 'readall', '/Users')
+    Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'readall', '/Users')
   end
 
   # This method accepts an individual user plist, passed as a hash, and
@@ -164,14 +164,14 @@ Puppet::Type.type(:user).provide :directoryservice do
   # Use dscl to retrieve an array of hashes containing attributes about all
   # of the local groups on the machine.
   def self.get_list_of_groups
-    @groups ||= Plist.parse_xml(dscl '-plist', '.', 'readall', '/Groups')
+    @groups ||= Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'readall', '/Groups')
   end
 
   # Perform a dscl lookup at the path specified for the specific keyname
   # value. The value returned is the first item within the array returned
   # from dscl
   def self.get_attribute_from_dscl(path, username, keyname)
-    Plist.parse_xml(dscl '-plist', '.', 'read', "/#{path}/#{username}", keyname)
+    Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'read', "/#{path}/#{username}", keyname)
   end
 
   # The plist embedded in the ShadowHashData key is a binary plist. The
@@ -179,40 +179,25 @@ Puppet::Type.type(:user).provide :directoryservice do
   # extract the binary plist, convert it to XML, and return it.
   def self.get_embedded_binary_plist(shadow_hash_data)
     embedded_binary_plist = Array(shadow_hash_data['dsAttrTypeNative:ShadowHashData'][0].delete(' ')).pack('H*')
-    convert_binary_to_xml(embedded_binary_plist)
-  end
-
-  # This method will accept a hash that has been returned from Plist::parse_xml
-  # and convert it to a binary plist (string value).
-  def self.convert_xml_to_binary(plist_data)
-    Puppet.debug('Converting XML plist to binary')
-    Puppet.debug('Executing: \'plutil -convert binary1 -o - -\'')
-    IO.popen('plutil -convert binary1 -o - -', 'r+') do |io|
-      io.write Plist::Emit.dump(plist_data)
-      io.close_write
-      @converted_plist = io.read
-    end
-    @converted_plist
-  end
-
-  # This method will accept a binary plist (as a string) and convert it to a
-  # hash via Plist::parse_xml.
-  def self.convert_binary_to_xml(plist_data)
-    Puppet.debug('Converting binary plist to XML')
-    Puppet.debug('Executing: \'plutil -convert xml1 -o - -\'')
-    IO.popen('plutil -convert xml1 -o - -', 'r+') do |io|
-      io.write plist_data
-      io.close_write
-      @converted_plist = io.read
-    end
-    Puppet.debug('Converting XML values to a hash.')
-    Plist::parse_xml(@converted_plist)
+    convert_binary_to_hash(embedded_binary_plist)
+  end
+
+  # This method will accept a hash and convert it to a binary plist (string value).
+  def self.convert_hash_to_binary(plist_data)
+    Puppet.debug('Converting plist hash to binary')
+    Puppet::Util::Plist.dump_plist(plist_data, :binary)
+  end
+
+  # This method will accept a binary plist (as a string) and convert it to a hash.
+  def self.convert_binary_to_hash(plist_data)
+    Puppet.debug('Converting binary plist to hash')
+    Puppet::Util::Plist.parse_plist(plist_data)
   end
 
   # The salted-SHA512 password hash in 10.7 is stored in the 'SALTED-SHA512'
   # key as binary data. That data is extracted and converted to a hex string.
   def self.get_salted_sha512(embedded_binary_plist)
-    embedded_binary_plist['SALTED-SHA512'].string.unpack("H*")[0]
+    embedded_binary_plist['SALTED-SHA512'].unpack("H*")[0]
   end
 
   # This method reads the passed embedded_binary_plist hash and returns values
@@ -222,7 +207,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   def self.get_salted_sha512_pbkdf2(field, embedded_binary_plist)
     case field
     when 'salt', 'entropy'
-      embedded_binary_plist['SALTED-SHA512-PBKDF2'][field].string.unpack('H*').first
+      embedded_binary_plist['SALTED-SHA512-PBKDF2'][field].unpack('H*').first
     when 'iterations'
       Integer(embedded_binary_plist['SALTED-SHA512-PBKDF2'][field])
     else
@@ -549,15 +534,16 @@ Puppet::Type.type(:user).provide :directoryservice do
   def get_users_plist(username)
     # This method will retrieve the data stored in a user's plist and
     # return it as a native Ruby hash.
-    Plist::parse_xml(plutil('-convert', 'xml1', '-o', '/dev/stdout', "#{users_plist_dir}/#{username}.plist"))
+    path = "#{users_plist_dir}/#{username}.plist"
+    Puppet::Util::Plist.read_plist_file(path)
   end
 
   # This method will return the binary plist that's embedded in the
   # ShadowHashData key of a user's plist, or false if it doesn't exist.
   def get_shadow_hash_data(users_plist)
     if users_plist['ShadowHashData']
-      password_hash_plist  = users_plist['ShadowHashData'][0].string
-      self.class.convert_binary_to_xml(password_hash_plist)
+      password_hash_plist  = users_plist['ShadowHashData'][0]
+      self.class.convert_binary_to_hash(password_hash_plist)
     else
       false
     end
@@ -568,22 +554,13 @@ Puppet::Type.type(:user).provide :directoryservice do
   # into the ShadowHashData key of the user's plist.
   def set_shadow_hash_data(users_plist, binary_plist)
     if users_plist.has_key?('ShadowHashData')
-      users_plist['ShadowHashData'][0].string = binary_plist
+      users_plist['ShadowHashData'][0] = binary_plist
     else
-      users_plist['ShadowHashData'] = [new_stringio_object(binary_plist)]
+      users_plist['ShadowHashData'] = [binary_plist]
     end
     write_users_plist_to_disk(users_plist)
   end
 
-  # This method returns a new StringIO object. Why does it exist?
-  # Well, StringIO objects have their own 'serial number', so when
-  # writing rspec tests it's difficult to compare StringIO objects
-  # due to this serial number. If this action is wrapped in its own
-  # method, it can be mocked for easier testing.
-  def new_stringio_object(value = '')
-    StringIO.new(value)
-  end
-
   # This method accepts an argument of a hex password hash, and base64
   # decodes it into a format that OS X 10.7 and 10.8 will store
   # in the user's plist.
@@ -598,17 +575,17 @@ Puppet::Type.type(:user).provide :directoryservice do
   def set_salted_sha512(users_plist, shadow_hash_data, value)
     unless shadow_hash_data
       shadow_hash_data = Hash.new
-      shadow_hash_data['SALTED-SHA512'] = new_stringio_object
+      shadow_hash_data['SALTED-SHA512'] = ''
     end
-    shadow_hash_data['SALTED-SHA512'].string = base64_decode_string(value)
-    binary_plist = self.class.convert_xml_to_binary(shadow_hash_data)
+    shadow_hash_data['SALTED-SHA512'] = base64_decode_string(value)
+    binary_plist = self.class.convert_hash_to_binary(shadow_hash_data)
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
   # This method accepts a passed value and one of three fields: 'salt',
   # 'entropy', or 'iterations'.  These fields correspond with the fields
   # utilized in a PBKDF2 password hashing system
-  # (see http://en.wikipedia.org/wiki/PBKDF2 ) where 'entropy' is the
+  # (see https://en.wikipedia.org/wiki/PBKDF2 ) where 'entropy' is the
   # password hash, 'salt' is the password hash salt value, and 'iterations'
   # is an integer recommended to be > 10,000. The remaining arguments are
   # the user's plist itself, and the shadow_hash_data hash containing the
@@ -618,8 +595,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     shadow_hash_data['SALTED-SHA512-PBKDF2'] = Hash.new unless shadow_hash_data['SALTED-SHA512-PBKDF2']
     case field
     when 'salt', 'entropy'
-      shadow_hash_data['SALTED-SHA512-PBKDF2'][field] =  new_stringio_object unless shadow_hash_data['SALTED-SHA512-PBKDF2'][field]
-      shadow_hash_data['SALTED-SHA512-PBKDF2'][field].string = base64_decode_string(value)
+      shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = base64_decode_string(value)
     when 'iterations'
       shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = Integer(value)
     else
@@ -633,15 +609,14 @@ Puppet::Type.type(:user).provide :directoryservice do
     # Convert shadow_hash_data to a binary plist, and call the
     # set_shadow_hash_data method to serialize and write the data
     # back to the user's plist.
-    binary_plist = self.class.convert_xml_to_binary(shadow_hash_data)
+    binary_plist = self.class.convert_hash_to_binary(shadow_hash_data)
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
   # This method will accept a plist in XML format, save it to disk, convert
   # the plist to a binary format, and flush the dscl cache.
   def write_users_plist_to_disk(users_plist)
-    Plist::Emit.save_plist(users_plist, "#{users_plist_dir}/#{@resource.name}.plist")
-    plutil'-convert', 'binary1', "#{users_plist_dir}/#{@resource.name}.plist"
+    Puppet::Util::Plist.write_plist_file(users_plist, "#{users_plist_dir}/#{@resource.name}.plist", :binary)
   end
 
   # This is a simple wrapper method for writing values to a file.

data/lib/puppet/provider/user/windows_adsi.rb

@@ -40,7 +40,7 @@ Puppet::Type.type(:user).provide :windows_adsi do
     specified_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
 
     if @resource[:membership] == :inclusive
-      current_users == specified_users
+      current_users.keys.to_a == specified_users.keys.to_a
     else
       (specified_users.keys.to_a & current_users.keys.to_a) == specified_users.keys.to_a
     end
@@ -55,7 +55,7 @@ Puppet::Type.type(:user).provide :windows_adsi do
       else
         account = sid.account
       end
-      resource.debug("#{sid.domain}\\#{account} (#{sid.to_s})")
+      resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
       "#{sid.domain}\\#{account}"
     end
     return groups.join(',')

data/lib/puppet/provider/yumrepo/inifile.rb

@@ -74,9 +74,12 @@ Puppet::Type.type(:yumrepo).provide(:inifile) do
   def self.reposdir(conf='/etc/yum.conf', dirs=['/etc/yum.repos.d', '/etc/yum/repos.d'])
     reposdir = find_conf_value('reposdir', conf)
     # Use directories in reposdir if they are set instead of default
-    dirs = reposdir.split(",").map(&:strip) if reposdir
-    
-
+    if reposdir
+      # Follow the code from the yum/config.py
+      dirs = reposdir.gsub!("\n", ' ')
+      dirs = reposdir.gsub!(',', ' ')
+      dirs = reposdir.split
+    end
     dirs.select! { |dir| Puppet::FileSystem.exist?(dir) }
     if dirs.empty?
       Puppet.debug('No yum directories were found on the local filesystem')

data/lib/puppet/provider/zfs/zfs.rb

@@ -40,7 +40,7 @@ Puppet::Type.type(:zfs).provide(:zfs) do
 
   PARAMETER_UNSET_OR_NOT_AVAILABLE = '-'
 
-  # http://docs.oracle.com/cd/E19963-01/html/821-1448/gbscy.html
+  # https://docs.oracle.com/cd/E19963-01/html/821-1448/gbscy.html
   # shareiscsi (added in build 120) was removed from S11 build 136
   # aclmode was removed from S11 in build 139 but it may have been added back
   # http://webcache.googleusercontent.com/search?q=cache:-p74K0DVsdwJ:developers.slashdot.org/story/11/11/09/2343258/solaris-11-released+&cd=13

data/lib/puppet/provider/zpool/zpool.rb

@@ -48,7 +48,7 @@ Puppet::Type.type(:zpool).provide(:zpool) do
   end
 
   def get_pool_data
-    # http://docs.oracle.com/cd/E19082-01/817-2271/gbcve/index.html
+    # https://docs.oracle.com/cd/E19082-01/817-2271/gbcve/index.html
     # we could also use zpool iostat -v mypool for a (little bit) cleaner output
     out = execute("zpool status #{@resource[:pool]}", :failonfail => false, :combine => false)
     zpool_data = out.lines.select { |line| line.index("\t") == 0 }.collect { |l| l.strip.split("\s")[0] }

data/lib/puppet/reference/configuration.rb

@@ -73,7 +73,7 @@ config.header = <<EOT
 
 See the [configuration guide][confguide] for more details.
 
-[confguide]: http://docs.puppetlabs.com/guides/configuring.html
+[confguide]: http://docs.puppetlabs.com/puppet/latest/reference/config_about_settings.html
 
 * * *
 

data/lib/puppet/reference/providers.rb

@@ -91,7 +91,7 @@ providers = Puppet::Util::Reference.newreference :providers, :title => "Provider
 
     ret << markdown_header(type.name.to_s + "_", 2)
 
-    ret << "[#{type.name}](http://docs.puppetlabs.com/references/stable/type.html##{type.name})\n\n"
+    ret << "[#{type.name}](https://docs.puppetlabs.com/references/stable/type.html##{type.name})\n\n"
     ret << option("Default provider", default)
     ret << doctable(headers, table_data)
 

data/lib/puppet/resource/capability_finder.rb

@@ -35,15 +35,10 @@ module Puppet::Resource::CapabilityFinder
           ['select_catalogs',
             ['=', 'code_id', code_id]]]]
     end
-    query = query_terms.to_json
 
-    Puppet.notice "Capability lookup #{cap}]: #{query}"
+    Puppet.notice "Capability lookup #{cap}]: #{query_terms}"
 
-    http = Puppet::Util.const_get('Puppetdb').const_get('Http')
-    response = http.action("/pdb/query/v4/resources?query=#{CGI.escape(query)}") do |conn, uri|
-      conn.get(uri, { 'Accept' => 'application/json'})
-    end
-    json = response.body
+    data = query_puppetdb(query_terms)
 
     # The format of the response body is documented at
     #   http://docs.puppetlabs.com/puppetdb/3.0/api/query/v4/resources.html#response-format
@@ -53,12 +48,6 @@ module Puppet::Resource::CapabilityFinder
     # ::Resource. If the array contains more than one entry, we have a
     # bug in the overall system, as we allowed multiple capabilities with
     # the same type and title to be produced in this environment.
-    begin
-      data = JSON.parse(json)
-    rescue JSON::JSONError => e
-      raise Puppet::DevError,
-      "Invalid JSON from PuppetDB when looking up #{cap}\n#{e}\nRaw JSON was:\n#{json}"
-    end
     unless data.is_a?(Array)
       raise Puppet::DevError,
       "Unexpected response from PuppetDB when looking up #{cap}: " +
@@ -92,4 +81,22 @@ module Puppet::Resource::CapabilityFinder
       return resource
     end
   end
+
+  def self.query_puppetdb(query)
+    # If using PuppetDB >= 4, use the API method query_puppetdb()
+    if Puppet::Util::Puppetdb.respond_to?(:query_puppetdb)
+      # PuppetDB 4 uses a unified query endpoint, so we have to specify what we're querying
+      Puppet::Util::Puppetdb.query_puppetdb(["from", "resources", query])
+    # For PuppetDB < 4, use the old internal method action()
+    else
+      url = "/pdb/query/v4/resource?query=#{CGI.escape(query.to_json)}"
+      response = Puppet::Util::Puppetdb::Http.action(url) do |conn, uri|
+        conn.get(uri, { 'Accept' => 'application/json'})
+      end
+      JSON.parse(response.body)
+    end
+  rescue JSON::JSONError => e
+    raise Puppet::DevError,
+      "Invalid JSON from PuppetDB when looking up #{cap}\n#{e}"
+  end
 end

data/lib/puppet/resource/catalog.rb

@@ -3,6 +3,7 @@ require 'puppet/indirector'
 require 'puppet/transaction'
 require 'puppet/util/tagging'
 require 'puppet/graph'
+require 'securerandom'
 
 require 'puppet/resource/capability_finder'
 
@@ -32,6 +33,22 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
   # The id of the code input to the compiler.
   attr_accessor :code_id
 
+  # The UUID of the catalog
+  attr_accessor :catalog_uuid
+
+  # @return [Integer] catalog format version number. This value is constant
+  #  for a given version of Puppet; it is incremented when a new release of
+  #  Puppet changes the API for the various objects that make up the catalog.
+  attr_accessor :catalog_format
+
+  # Inlined file metadata for non-recursive find
+  # A hash of title => metadata
+  attr_accessor :metadata
+
+  # Inlined file metadata for recursive search
+  # A hash of title => { source => [metadata, ...] }
+  attr_accessor :recursive_metadata
+
   # How long this catalog took to retrieve.  Used for reporting stats.
   attr_accessor :retrieval_duration
 
@@ -272,6 +289,10 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
   def initialize(name = nil, environment = Puppet::Node::Environment::NONE, code_id = nil)
     super()
     @name = name
+    @catalog_uuid = SecureRandom.uuid
+    @catalog_format = 1
+    @metadata = {}
+    @recursive_metadata = {}
     @classes = []
     @resource_table = {}
     @resources = []
@@ -379,6 +400,12 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
       result.code_id = code_id
     end
 
+    if catalog_uuid = data['catalog_uuid']
+      result.catalog_uuid = catalog_uuid
+    end
+
+    result.catalog_format = data['catalog_format'] || 0
+
     if environment = data['environment']
       result.environment = environment
       result.environment_instance = Puppet::Node::Environment.remote(environment.to_sym)
@@ -411,20 +438,46 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
       result.add_class(*classes)
     end
 
+    if metadata = data['metadata']
+      result.metadata = metadata.inject({}) { |h, (k, v)| h[k] = Puppet::FileServing::Metadata.from_data_hash(v); h }
+    end
+
+    if recursive_metadata = data['recursive_metadata']
+      result.recursive_metadata = recursive_metadata.inject({}) do |h, (title, source_to_meta_hash)|
+        h[title] = source_to_meta_hash.inject({}) do |inner_h, (source, metas)|
+          inner_h[source] = metas.map {|meta| Puppet::FileServing::Metadata.from_data_hash(meta)}
+          inner_h
+        end
+        h
+      end
+    end
+
     result
   end
 
   def to_data_hash
+    metadata_hash = metadata.inject({}) { |h, (k, v)| h[k] = v.to_data_hash; h }
+    recursive_metadata_hash = recursive_metadata.inject({}) do |h, (title, source_to_meta_hash)|
+      h[title] = source_to_meta_hash.inject({}) do |inner_h, (source, metas)|
+        inner_h[source] = metas.map {|meta| meta.to_data_hash}
+        inner_h
+      end
+      h
+    end
+
     {
       'tags'      => tags,
       'name'      => name,
       'version'   => version,
       'code_id'   => code_id,
-      'environment' => environment.to_s,
+      'catalog_uuid' => catalog_uuid,
+      'catalog_format' => catalog_format,
+      'environment'  => environment.to_s,
       'resources' => @resources.collect { |v| @resource_table[v].to_data_hash },
       'edges'     => edges.   collect { |e| e.to_data_hash },
-      'classes'   => classes
-    }
+      'classes'   => classes,
+    }.merge(metadata_hash.empty? ? {} : {'metadata' => metadata_hash})
+     .merge(recursive_metadata_hash.empty? ? {} : {'recursive_metadata' => recursive_metadata_hash})
   end
 
   # Convert our catalog into a RAL catalog.
@@ -536,6 +589,10 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
 
     result.version = self.version
     result.code_id = self.code_id
+    result.catalog_uuid = self.catalog_uuid
+    result.catalog_format = self.catalog_format
+    result.metadata = self.metadata
+    result.recursive_metadata = self.recursive_metadata
 
     map = {}
     resources.each do |resource|

data/lib/puppet/resource/status.rb

@@ -1,5 +1,6 @@
 require 'time'
 require 'puppet/network/format_support'
+require 'puppet/util/psych_support'
 
 module Puppet
   class Resource
@@ -11,6 +12,7 @@ module Puppet
     #
     # @api private
     class Status
+      include Puppet::Util::PsychSupport
       include Puppet::Util::Tagging
       include Puppet::Network::FormatSupport
 
@@ -181,7 +183,14 @@ module Puppet
         @failed = data['failed']
 
         @events = data['events'].map do |event|
-          Puppet::Transaction::Event.from_data_hash(event)
+          # in YAML (for reports) we serialize this as an object, but
+          # in PSON it becomes a hash. Depending on where we came from
+          # we might not need to deserialize it.
+          if event.class == Puppet::Transaction::Event
+            event
+          else
+            Puppet::Transaction::Event.from_data_hash(event)
+          end
         end
       end
 
@@ -194,7 +203,7 @@ module Puppet
           'resource_type' => @resource_type,
           'containment_path' => @containment_path,
           'evaluation_time' => @evaluation_time,
-          'tags' => @tags,
+          'tags' => @tags.to_a,
           'time' => @time.iso8601(9),
           'failed' => @failed,
           'changed' => @changed,

data/lib/puppet/resource/type.rb

@@ -174,12 +174,9 @@ class Puppet::Resource::Type
 
     if code
       if @match # Only bother setting up the ephemeral scope if there are match variables to add into it
-        begin
-          elevel = scope.ephemeral_level
+        scope.with_guarded_scope do
           scope.ephemeral_from(@match, file, line)
           code.safeevaluate(scope)
-        ensure
-          scope.unset_ephemeral_var(elevel)
         end
       else
         code.safeevaluate(scope)
@@ -346,18 +343,23 @@ class Puppet::Resource::Type
   end
 
   # Validate and set any arguments passed by the resource as variables in the scope.
+  #
+  # This method is known to only be used on the server/compile side.
+  #
   # @param resource [Puppet::Parser::Resource] the resource
   # @param scope [Puppet::Parser::Scope] the scope
   #
   # @api private
   def set_resource_parameters(resource, scope)
     # Inject parameters from using external lookup
+    modname = resource[:module_name] || module_name
+    scope[MODULE_NAME] = modname unless modname.nil?
+    caller_name = resource[:caller_module_name] || scope.parent_module_name
+    scope[CALLER_MODULE_NAME] = caller_name unless caller_name.nil?
+
     resource.add_parameters_from_consume
     inject_external_parameters(resource, scope)
 
-    resource_hash = {}
-    resource.each { |k, v| resource_hash[k.to_s] = v.value unless k == :name || k == :title }
-
     if @type == :hostclass
       scope[TITLE] = resource.title.to_s.downcase
       scope[NAME] =  resource.name.to_s.downcase
@@ -365,17 +367,21 @@ class Puppet::Resource::Type
       scope[TITLE] = resource.title
       scope[NAME] =  resource.name
     end
+    scope.class_set(self.name,scope) if hostclass? || node?
 
-    modname = resource_hash[MODULE_NAME] || module_name
-    scope[MODULE_NAME] = modname unless modname.nil?
-    caller_name = resource_hash[CALLER_MODULE_NAME] || scope.parent_module_name
-    scope[CALLER_MODULE_NAME] = caller_name unless caller_name.nil?
+    param_hash = scope.with_parameter_scope(arguments.keys) do |param_scope|
+      # Assign directly to the parameter scope to avoid scope parameter validation at this point. It
+      # will happen anyway when the values are assigned to the scope after the parameter scoped has
+      # been popped.
+      resource.each { |k, v| param_scope[k.to_s] = v.value unless k == :name || k == :title }
+      assign_defaults(resource, param_scope, scope)
+      param_scope.to_hash
+    end
 
-    scope.class_set(self.name,scope) if hostclass? || node?
+    validate_resource_hash(resource, param_hash)
 
-    assign_defaults(resource, scope, resource_hash)
-    validate_resource_hash(resource, resource_hash)
-    resource_hash.each { |param, value| exceptwrap { scope[param] = value }}
+    # Assign parameter values to current scope
+    param_hash.each { |param, value| exceptwrap { scope[param] = value }}
   end
 
   # Lookup and inject parameters from external scope
@@ -385,28 +391,30 @@ class Puppet::Resource::Type
     # Only lookup parameters for host classes
     return unless type == :hostclass
     parameters = resource.parameters
-    arguments.each do |param_name, _|
-      name = param_name.to_sym
-      next if parameters.include?(name)
-      value = lookup_external_default_for(param_name, scope)
-      resource[name] = value unless value.nil?
+    arguments.each do |param_name, default|
+      sym_name = param_name.to_sym
+      param = parameters[sym_name]
+      next unless param.nil? || param.value.nil?
+      catch(:no_such_key) do
+        bound_value = Puppet::Pops::Lookup.search_and_merge("#{name}::#{param_name}", Puppet::Pops::Lookup::Invocation.new(scope), nil)
+        # Assign bound value but don't let an undef trump a default expression
+        resource[sym_name] = bound_value unless bound_value.nil? && !default.nil?
+      end
     end
   end
   private :inject_external_parameters
 
-  def assign_defaults(resource, scope, resource_hash)
+  def assign_defaults(resource, param_scope, scope)
     return unless resource.is_a?(Puppet::Parser::Resource)
     parameters = resource.parameters
-    hashed_types = parameter_struct.hashed_elements
     arguments.each do |param_name, default|
       next if default.nil?
       name = param_name.to_sym
       param = parameters[name]
       next unless param.nil? || param.value.nil?
-
-      value = default.safeevaluate(scope)
+      value = exceptwrap { param_scope.evaluate3x(param_name, default, scope) }
       resource[name] = value
-      resource_hash[param_name] = value
+      param_scope[param_name] = value
     end
   end
   private :assign_defaults
@@ -551,21 +559,4 @@ class Puppet::Resource::Type
     type_factory.struct(members)
   end
   private :create_params_struct
-
-  # Consult external data bindings for class parameter values which must be
-  # namespaced in the backend.
-  #
-  # Example:
-  #
-  #   class foo($port=0){ ... }
-  #
-  # We make a request to the backend for the key 'foo::port' not 'foo'
-  #
-  def lookup_external_default_for(param, scope)
-    if type == :hostclass
-      catch(:no_such_key) { return Puppet::Pops::Lookup.search_and_merge("#{name}::#{param}", Puppet::Pops::Lookup::Invocation.new(scope), nil) }
-    end
-    nil
-  end
-  private :lookup_external_default_for
 end