puppet 4.3.0 → 4.4.0

data/lib/puppet/resource.rb

@@ -438,19 +438,22 @@ class Puppet::Resource
     end
 
     missing_arguments.collect do |param, default|
-      # Using 'send' since this private method moved from here to type. The caller method is deprecated
-      # and doesn't really motivate making the callee public
-      external_value = resource_type.send(:lookup_external_default_for, param, scope)
-
-      if external_value.nil? && default.nil?
-        next
-      elsif external_value.nil?
-        value = default.safeevaluate(scope)
-      else
-        value = external_value
+      rtype = resource_type
+      if rtype.type == :hostclass
+        using_bound_value = false
+        catch(:no_such_key) do
+          bound_value = Puppet::Pops::Lookup.search_and_merge("#{rtype.name}::#{param}", Puppet::Pops::Lookup::Invocation.new(scope), nil)
+          # Assign bound value but don't let an undef trump a default expression
+          unless bound_value.nil? && !default.nil?
+            self[param.to_sym] = bound_value
+            using_bound_value = true
+          end
+        end
+      end
+      unless using_bound_value
+        next if default.nil?
+        self[param.to_sym] = default.safeevaluate(scope)
       end
-
-      self[param.to_sym] = value
       param
     end.compact
   end

data/lib/puppet/settings/config_file.rb

@@ -82,7 +82,7 @@ private
   def unique_sections_in(ini, file, allowed_section_names)
     ini.section_lines.collect do |section|
       if !allowed_section_names.empty? && !allowed_section_names.include?(section.name)
-        raise(Puppet::Error, "Illegal section '#{section.name}' in config file #{file} at line #{section.line_number}. The only valid puppet.conf sections are: [#{allowed_section_names.join(", ")}]. Please use the directory environments feature to specify environments. (See http://docs.puppetlabs.com/puppet/latest/reference/environments.html)")
+        raise(Puppet::Error, "Illegal section '#{section.name}' in config file #{file} at line #{section.line_number}. The only valid puppet.conf sections are: [#{allowed_section_names.join(", ")}]. Please use the directory environments feature to specify environments. (See https://docs.puppetlabs.com/puppet/latest/reference/environments.html)")
       end
       section.name
     end.uniq

data/lib/puppet/settings/environment_conf.rb

@@ -3,7 +3,7 @@
 class Puppet::Settings::EnvironmentConf
 
   ENVIRONMENT_CONF_ONLY_SETTINGS = [:modulepath, :manifest, :config_version].freeze
-  VALID_SETTINGS = (ENVIRONMENT_CONF_ONLY_SETTINGS + [:environment_timeout, :environment_data_provider]).freeze
+  VALID_SETTINGS = (ENVIRONMENT_CONF_ONLY_SETTINGS + [:environment_timeout, :environment_data_provider, :static_catalogs]).freeze
 
   # Given a path to a directory environment, attempts to load and parse an
   # environment.conf in ini format, and return an EnvironmentConf instance.
@@ -39,8 +39,8 @@ class Puppet::Settings::EnvironmentConf
   # Configuration values are exactly those returned by the environment object,
   # without interpolation.  This is a special case for the default configured
   # environment returned by the Puppet::Environments::StaticPrivate loader.
-  def self.static_for(environment, environment_timeout = 0)
-    Static.new(environment, environment_timeout)
+  def self.static_for(environment, environment_timeout = 0, static_catalogs = false)
+    Static.new(environment, environment_timeout, static_catalogs)
   end
 
   attr_reader :section, :path_to_env, :global_modulepath
@@ -108,6 +108,12 @@ class Puppet::Settings::EnvironmentConf
     end
   end
 
+  def static_catalogs
+    get_setting(:static_catalogs, Puppet.settings.value(:static_catalogs)) do |value|
+      value
+    end
+  end
+
   def config_version
     get_setting(:config_version) do |config_version|
       absolute(config_version)
@@ -141,7 +147,7 @@ class Puppet::Settings::EnvironmentConf
 
   def get_setting(setting_name, default = nil)
     value = raw_setting(setting_name)
-    value ||= default
+    value = default if value.nil?
     yield value
   end
 
@@ -161,10 +167,12 @@ class Puppet::Settings::EnvironmentConf
   class Static
     attr_reader :environment_timeout
     attr_reader :environment_data_provider
+    attr_reader :static_catalogs
 
-    def initialize(environment, environment_timeout, environment_data_provider = 'none')
+    def initialize(environment, environment_timeout, static_catalogs, environment_data_provider = 'none')
       @environment = environment
       @environment_timeout = environment_timeout
+      @static_catalogs = static_catalogs
       @environment_data_provider = environment_data_provider
     end
 

data/lib/puppet/settings.rb

@@ -1077,7 +1077,7 @@ Generated on #{Time.now}.
   #
   # @api private
   # @todo this code duplicates {Puppet::Util::RunMode#which_dir} as described
-  #   in {http://projects.puppetlabs.com/issues/16637 #16637}
+  #   in {https://projects.puppetlabs.com/issues/16637 #16637}
   def which_configuration_file
     if explicit_config_file? or Puppet.features.root? then
       return main_config_file

data/lib/puppet/ssl/certificate_factory.rb

@@ -62,7 +62,7 @@ module Puppet::SSL::CertificateFactory
   #   extensions to.
   # @param csr [OpenSSL::X509::Request] The CSR associated with the given
   #   certificate, which may specify requested extensions for the given cert.
-  #   See http://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
+  #   See https://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
   # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
   #   if this is a self signed certificate, or the X509 certificate of the CA if
   #   this is a CA signed certificate.
@@ -100,7 +100,7 @@ module Puppet::SSL::CertificateFactory
     # something went wrong up there. --daniel 2011-10-11
     defaults = { "nsComment" => "Puppet Ruby/OpenSSL Internal Certificate" }
 
-    # See http://www.openssl.org/docs/apps/x509v3_config.html
+    # See https://www.openssl.org/docs/apps/x509v3_config.html
     # for information about the special meanings of 'hash', 'keyid', 'issuer'
     override = {
       "subjectKeyIdentifier"   => "hash",
@@ -126,7 +126,7 @@ module Puppet::SSL::CertificateFactory
       # complaint that the issuer keyid can't be fetched, which breaks all
       # sorts of things in our test suite and, e.g., bootstrapping the CA.
       #
-      # http://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
+      # https://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
       # conforming CA we MAY omit the field if we are self-signed, which I
       # think gives us a pass in the specific case.
       #

data/lib/puppet/ssl/certificate_request.rb

@@ -23,7 +23,7 @@ require 'puppet/ssl/certificate_signer'
 #
 # This behavior is dictated by PKCS#9/RFC 2985 section 5.4.2.
 #
-# @see http://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
+# @see https://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
 #
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
@@ -193,7 +193,7 @@ DOC
   #
   # The format of CSR attributes is specified in PKCS#10/RFC 2986
   #
-  # @see http://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
+  # @see https://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
   #
   # @api public
   #
@@ -289,8 +289,8 @@ DOC
   # that in turn holds the elements. This is why we have to unpack an array
   # every time we unpack a Set/Seq.
   #
-  # @see http://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
-  # @see http://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
+  # @see https://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
+  # @see https://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
   #
   # @api private
   #

data/lib/puppet/ssl/certificate_signer.rb

@@ -1,6 +1,6 @@
 # Take care of signing a certificate in a FIPS 140-2 compliant manner.
 #
-# @see http://projects.puppetlabs.com/issues/17295
+# @see https://projects.puppetlabs.com/issues/17295
 #
 # @api private
 class Puppet::SSL::CertificateSigner

data/lib/puppet/ssl/validator/default_validator.rb

@@ -48,7 +48,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # chain being verified.
   #
   # From the [OpenSSL
-  # documentation](http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
+  # documentation](https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
   # The `verify_callback` function is used to control the behaviour when the
   # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
   # receives two arguments: preverify_ok indicates, whether the verification of

data/lib/puppet/test/test_helper.rb

@@ -121,7 +121,13 @@ module Puppet::Test
       end
 
       # The process environment is a shared, persistent resource.
-      $old_env = ENV.to_hash
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
+      $old_env = Puppet::Util.get_environment(mode)
 
       # So is the load_path
       $old_load_path = $LOAD_PATH.dup
@@ -171,13 +177,19 @@ module Puppet::Test
       end
       $saved_indirection_state = nil
 
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
       # Restore the global process environment.  Can't just assign because this
       # is a magic variable, sadly, and doesn't do that™.  It is sufficiently
       # faster to use the compare-then-set model to avoid excessive work that it
       # justifies the complexity.  --daniel 2012-03-15
-      unless ENV.to_hash == $old_env
-        ENV.clear
-        $old_env.each {|k, v| ENV[k] = v }
+      unless Puppet::Util.get_environment(mode) == $old_env
+        Puppet::Util.clear_environment(mode)
+        $old_env.each {|k, v| Puppet::Util.set_env(k, v, mode) }
       end
 
       # Restore the load_path late, to avoid messing with stubs from the test.

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -22,9 +22,10 @@ class Puppet::Transaction::AdditionalResourceGenerator
     end
     return unless generated
     generated = [generated] unless generated.is_a?(Array)
-    generated.collect do |res|
+    generated.collect! do |res|
       @catalog.resource(res.ref) || res
-    end.reverse_each do |res|
+    end
+    unless resource.depthfirst?
       # This is reversed becuase PUP-1963 changed how generated
       # resources were added to the catalog. It exists for backwards
       # compatibility only, and can probably be removed in Puppet 5
@@ -34,6 +35,9 @@ class Puppet::Transaction::AdditionalResourceGenerator
       # catalog one by one adjacent to the parent resource. This
       # causes an implicit reversal of their application order from
       # the old code. The reverse makes it all work like it did.
+      generated.reverse!
+    end
+    generated.each do |res|
       add_resource(res, resource)
 
       add_generated_directed_dependency(resource, res)
@@ -138,10 +142,10 @@ class Puppet::Transaction::AdditionalResourceGenerator
   def add_generated_directed_dependency(parent, child, label=nil)
     if parent.depthfirst?
       source = child
-      target = parent.to_resource
+      target = parent
     else
       source = parent
-      target = child.to_resource
+      target = child
     end
 
     # For each potential relationship metaparam, check if parent or
@@ -170,8 +174,22 @@ class Puppet::Transaction::AdditionalResourceGenerator
     }
 
     if not edge_exists
+      # We *cannot* use target.to_resource here!
+      #
+      # For reasons that are beyond my (and, perhaps, human)
+      # comprehension, to_resource will call retrieve. This is
+      # problematic if a generated resource needs the system to be
+      # changed by a previous resource (think a file on a path
+      # controlled by a mount resource).
+      #
+      # Instead of using to_resource, we just construct a resource as
+      # if the arguments to the Type instance had been passed to a
+      # Resource instead.
+      resource = ::Puppet::Resource.new(target.class, target.title,
+                                        :parameters => target.original_parameters)
+
       source[:before] ||= []
-      source[:before] << target
+      source[:before] << resource
     end
   end
 

data/lib/puppet/transaction/report.rb

@@ -48,6 +48,17 @@ class Puppet::Transaction::Report
   # @return [String] uuid
   attr_accessor :transaction_uuid
 
+  # The id of the code input to the compiler.
+  attr_accessor :code_id
+
+  # A master generated catalog uuid, useful for connecting a single catalog to multiple reports.
+  attr_accessor :catalog_uuid
+
+  # Whether a cached catalog was used in the run, and if so, the reason that it was used.
+  # @return [String] One of the values: 'not_used', 'explicitly_requested',
+  # or 'on_failure'
+  attr_accessor :cached_catalog_status
+
   # The host name for which the report is generated
   # @return [String] the host name
   attr_accessor :host
@@ -172,10 +183,13 @@ class Puppet::Transaction::Report
     @host = Puppet[:node_name_value]
     @time = Time.now
     @kind = kind
-    @report_format = 4
+    @report_format = 5
     @puppet_version = Puppet.version
     @configuration_version = configuration_version
     @transaction_uuid = transaction_uuid
+    @code_id = nil
+    @catalog_uuid = nil
+    @cached_catalog_status = nil
     @environment = environment
     @status = 'failed' # assume failed until the report is finalized
   end
@@ -190,6 +204,19 @@ class Puppet::Transaction::Report
     @status = data['status']
     @host = data['host']
     @time = data['time']
+
+    if catalog_uuid = data['catalog_uuid']
+      @catalog_uuid = catalog_uuid
+    end
+
+    if code_id = data['code_id']
+      @code_id = code_id
+    end
+
+    if cached_catalog_status = data['cached_catalog_status']
+      @cached_catalog_status = cached_catalog_status
+    end
+
     if @time.is_a? String
       @time = Time.parse(@time)
     end
@@ -221,6 +248,9 @@ class Puppet::Transaction::Report
       'time' => @time.iso8601(9),
       'configuration_version' => @configuration_version,
       'transaction_uuid' => @transaction_uuid,
+      'catalog_uuid' => @catalog_uuid,
+      'code_id' => @code_id,
+      'cached_catalog_status' => @cached_catalog_status,
       'report_format' => @report_format,
       'puppet_version' => @puppet_version,
       'kind' => @kind,

data/lib/puppet/transaction/resource_harness.rb

@@ -69,8 +69,6 @@ class Puppet::Transaction::ResourceHarness
   def perform_changes(resource, context)
     cache(resource, :checked, Time.now)
 
-    return [] if ! allow_changes?(resource)
-
     # Record the current state in state.yml.
     context.audited_params.each do |param|
       cache(resource, param, context.current_values[param])
@@ -96,29 +94,6 @@ class Puppet::Transaction::ResourceHarness
     capture_audit_events(resource, context)
   end
 
-  def allow_changes?(resource)
-    if resource.purging? and resource.deleting? and deps = relationship_graph.dependents(resource) \
-            and ! deps.empty? and deps.detect { |d| ! d.deleting? }
-      real_deps = deps.reject { |r| r.class.name == :whit }
-      if real_deps.empty?
-        true
-      else
-        deplabel = real_deps.collect { |r| r.ref }.join(",")
-        plurality = real_deps.length > 1 ? "":"s"
-        resource.warning "#{deplabel} still depend#{plurality} on me -- not purging"
-        false
-      end
-    else
-      true
-    end
-  end
-
-  # allow_changes? is only made public to enable the existing spec tests to run
-  # under rspec 3 (apparently rspec 2 didn't enforce access controls?). Please do not
-  # treat this as part of a public API.
-  # Possible future improvement: rewrite to not require access to private methods.
-  public :allow_changes?
-
   def sync_if_needed(param, context)
     historical_value = context.historical_values[param.name]
     current_value = context.current_values[param.name]

data/lib/puppet/transaction.rb

@@ -1,5 +1,6 @@
 require 'puppet'
 require 'puppet/util/tagging'
+require 'puppet/util/skip_tags'
 require 'puppet/application'
 require 'digest/sha1'
 require 'set'
@@ -185,6 +186,10 @@ class Puppet::Transaction
     super
   end
 
+  def skip_tags
+    @skip_tags ||= Puppet::Util::SkipTags.new(Puppet[:skip_tags]).tags
+  end
+
   def prefetch_if_necessary(resource)
     provider_class = resource.provider.class
     return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
@@ -339,7 +344,9 @@ class Puppet::Transaction
 
   # Should this resource be skipped?
   def skip?(resource)
-    if missing_tags?(resource)
+    if skip_tags?(resource)
+      resource.debug "Skipping with skip tags #{skip_tags.join(", ")}"
+    elsif missing_tags?(resource)
       resource.debug "Not tagged with #{tags.join(", ")}"
     elsif ! scheduled?(resource)
       resource.debug "Not scheduled"
@@ -375,6 +382,13 @@ class Puppet::Transaction
     not resource.tagged?(*tags)
   end
 
+  def skip_tags?(resource)
+    return false if ignore_tags?
+    return false if skip_tags.empty?
+
+    resource.tagged?(*skip_tags)
+  end
+
   def split_qualified_tags?
     false
   end
@@ -389,4 +403,3 @@ class Puppet::Transaction
 end
 
 require 'puppet/transaction/report'
-

data/lib/puppet/type/augeas.rb

@@ -5,7 +5,7 @@
 #   you may not use this file except in compliance with the License.
 #   You may obtain a copy of the License at
 #
-#       http://www.apache.org/licenses/LICENSE-2.0
+#       https://www.apache.org/licenses/LICENSE-2.0
 #
 #   Unless required by applicable law or agreed to in writing, software
 #   distributed under the License is distributed on an "AS IS" BASIS,

data/lib/puppet/type/cron.rb

@@ -18,29 +18,29 @@ Puppet::Type.newtype(:cron) do
 
     Example:
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
           hour    => 2,
-          minute  => 0
+          minute  => 0,
         }
 
     Note that all periodic attributes can be specified as an array of values:
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
-          hour    => [2, 4]
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
+          hour    => [2, 4],
         }
 
     ...or using ranges or the step syntax `*/2` (although there's no guarantee
     that your `cron` daemon supports these):
 
-        cron { logrotate:
-          command => "/usr/sbin/logrotate",
-          user    => root,
+        cron { 'logrotate':
+          command => '/usr/sbin/logrotate',
+          user    => 'root',
           hour    => ['2-4'],
-          minute  => '*/10'
+          minute  => '*/10',
         }
 
     An important note: _the Cron type will not reset parameters that are

data/lib/puppet/type/file/checksum_value.rb

@@ -0,0 +1,53 @@
+require 'puppet/util/checksums'
+require 'puppet/type/file/data_sync'
+
+module Puppet
+  Puppet::Type.type(:file).newproperty(:checksum_value) do
+    include Puppet::Util::Checksums
+    include Puppet::DataSync
+
+    desc "The checksum of the source contents. Only md5 and sha256 are supported when
+      specifying this parameter. If this parameter is set, source_permissions will be
+      assumed to be false, and ownership and permissions will not be read from source."
+
+    def insync?(is)
+      # If checksum_value and source are specified, manage the file contents.
+      # Otherwise the content property will manage syncing.
+      if resource.parameter(:source).nil?
+        return true
+      end
+
+      checksum_insync?(resource.parameter(:source), is, true) {|_is| super(_is)}
+    end
+
+    def property_matches?(current, desired)
+      return true if super(current, desired)
+      return date_matches?(resource.parameter(:checksum).value, current, desired)
+    end
+
+    def retrieve
+      # If checksum_value and source are specified, manage the file contents.
+      # Otherwise the content property will manage syncing. Don't compute the checksum twice.
+      if resource.parameter(:source).nil?
+        return nil
+      end
+
+      result = retrieve_checksum(resource)
+      # If the returned type matches the util/checksums format (prefixed with the type),
+      # strip the checksum type.
+      result = sumdata(result) if checksum?(result)
+      result
+    end
+
+    def sync
+      if resource.parameter(:source).nil?
+        devfail "checksum_value#sync should not be called without a source parameter"
+      end
+
+      # insync? only returns false if it expects to manage the file content,
+      # so instruct the resource to write its contents.
+      contents_sync(resource.parameter(:source))
+    end
+
+  end
+end