puppet 4.4.0 → 4.5.0

data/lib/puppet/test/test_helper.rb

@@ -238,7 +238,6 @@ module Puppet::Test
       #
       # I would make these even shorter, but OpenSSL doesn't support anything
       # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
-      Puppet[:req_bits]  = 512
       Puppet[:keylength] = 512
 
       # Although we setup a testing context during initialization, some tests

data/lib/puppet/transaction.rb

@@ -275,30 +275,6 @@ class Puppet::Transaction
     resource_status(resource).failed_dependencies = failed.to_a
   end
 
-  # A general method for recursively generating new resources from a
-  # resource.
-  def generate_additional_resources(resource)
-    return unless resource.respond_to?(:generate)
-    begin
-      made = resource.generate
-    rescue => detail
-      resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
-    end
-    return unless made
-    made = [made] unless made.is_a?(Array)
-    made.uniq.each do |res|
-      begin
-        res.tag(*resource.tags)
-        @catalog.add_resource(res)
-        res.finish
-        add_conditional_directed_dependency(resource, res)
-        generate_additional_resources(res)
-      rescue Puppet::Resource::Catalog::DuplicateResourceError
-        res.info "Duplicate generated resource; skipping"
-      end
-    end
-  end
-
   # Should we ignore tags?
   def ignore_tags?
     ! @catalog.host_config?

data/lib/puppet/type/exec.rb

@@ -340,15 +340,15 @@ module Puppet
         other object; it is useful for triggering an action:
 
             # Pull down the main aliases file
-            file { "/etc/aliases":
-              source => "puppet://server/module/aliases"
+            file { '/etc/aliases':
+              source => 'puppet://server/module/aliases',
             }
 
             # Rebuild the database, but only when the file changes
             exec { newaliases:
-              path        => ["/usr/bin", "/usr/sbin"],
-              subscribe   => File["/etc/aliases"],
-              refreshonly => true
+              path        => ['/usr/bin', '/usr/sbin'],
+              subscribe   => File['/etc/aliases'],
+              refreshonly => true,
             }
 
         Note that only `subscribe` and `notify` can trigger actions, not `require`,
@@ -377,10 +377,10 @@ module Puppet
         This parameter doesn't cause Puppet to create a file; it is only
         useful if **the command itself** creates a file.
 
-            exec { "tar -xf /Volumes/nfs02/important.tar":
-              cwd     => "/var/tmp",
-              creates => "/var/tmp/myfile",
-              path    => ["/usr/bin", "/usr/sbin"]
+            exec { 'tar -xf /Volumes/nfs02/important.tar':
+              cwd     => '/var/tmp',
+              creates => '/var/tmp/myfile',
+              path    => ['/usr/bin', '/usr/sbin',],
             }
 
         In this example, `myfile` is assumed to be a file inside
@@ -404,9 +404,9 @@ module Puppet
         If this parameter is set, then this `exec` will run unless
         the command has an exit code of 0.  For example:
 
-            exec { "/bin/echo root >> /usr/lib/cron/cron.allow":
-              path   => "/usr/bin:/usr/sbin:/bin",
-              unless => "grep root /usr/lib/cron/cron.allow 2>/dev/null"
+            exec { '/bin/echo root >> /usr/lib/cron/cron.allow':
+              path   => '/usr/bin:/usr/sbin:/bin',
+              unless => 'grep root /usr/lib/cron/cron.allow 2>/dev/null',
             }
 
         This would add `root` to the cron.allow file (on Solaris) unless
@@ -420,7 +420,7 @@ module Puppet
 
         Also note that unless can take an array as its value, e.g.:
 
-            unless => ["test -f /tmp/file1", "test -f /tmp/file2"]
+            unless => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
         This will only run the exec if _all_ conditions in the array return false.
       EOT
@@ -455,9 +455,9 @@ module Puppet
         If this parameter is set, then this `exec` will only run if
         the command has an exit code of 0.  For example:
 
-            exec { "logrotate":
-              path   => "/usr/bin:/usr/sbin:/bin",
-              onlyif => "test `du /var/log/messages | cut -f1` -gt 100000"
+            exec { 'logrotate':
+              path   => '/usr/bin:/usr/sbin:/bin',
+              onlyif => 'test `du /var/log/messages | cut -f1` -gt 100000',
             }
 
         This would run `logrotate` only if that test returned true.
@@ -471,7 +471,7 @@ module Puppet
 
         Also note that onlyif can take an array as its value, e.g.:
 
-            onlyif => ["test -f /tmp/file1", "test -f /tmp/file2"]
+            onlyif => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
         This will only run the exec if _all_ conditions in the array return true.
       EOT

data/lib/puppet/type/file/content.rb

@@ -23,20 +23,20 @@ module Puppet
       the manifest...
 
           define resolve(nameserver1, nameserver2, domain, search) {
-              $str = "search $search
-                  domain $domain
-                  nameserver $nameserver1
-                  nameserver $nameserver2
+              $str = "search ${search}
+                  domain ${domain}
+                  nameserver ${nameserver1}
+                  nameserver ${nameserver2}
                   "
 
-              file { "/etc/resolv.conf":
-                content => "$str",
+              file { '/etc/resolv.conf':
+                content => $str,
               }
           }
 
       ...but for larger files, this attribute is more useful when combined with the
-      [template](https://docs.puppetlabs.com/references/latest/function.html#template)
-      or [file](https://docs.puppetlabs.com/references/latest/function.html#file)
+      [template](https://docs.puppetlabs.com/puppet/latest/reference/function.html#template)
+      or [file](https://docs.puppetlabs.com/puppet/latest/reference/function.html#file)
       function.
     EOT
 

data/lib/puppet/type/file/ensure.rb

@@ -36,13 +36,13 @@ module Puppet
 
           # Equivalent resources:
 
-          file { "/etc/inetd.conf":
-            ensure => "/etc/inet/inetd.conf",
+          file { '/etc/inetd.conf':
+            ensure => '/etc/inet/inetd.conf',
           }
 
-          file { "/etc/inetd.conf":
+          file { '/etc/inetd.conf':
             ensure => link,
-            target => "/etc/inet/inetd.conf",
+            target => '/etc/inet/inetd.conf',
           }
 
       However, we recommend using `link` and `target` explicitly, since this

data/lib/puppet/type/file/source.rb

@@ -52,11 +52,11 @@ module Puppet
       use the first source that exists. This can be used to serve different
       files to different system types:
 
-          file { "/etc/nfs.conf":
+          file { '/etc/nfs.conf':
             source => [
-              "puppet:///modules/nfs/conf.$host",
-              "puppet:///modules/nfs/conf.$operatingsystem",
-              "puppet:///modules/nfs/conf"
+              "puppet:///modules/nfs/conf.${host}",
+              "puppet:///modules/nfs/conf.${operatingsystem}",
+              'puppet:///modules/nfs/conf'
             ]
           }
 

data/lib/puppet/type/file/target.rb

@@ -7,9 +7,9 @@ module Puppet
       Symlink targets can be relative, as well as absolute:
 
           # (Useful on Solaris)
-          file { \"/etc/inetd.conf\":
+          file { '/etc/inetd.conf':
             ensure => link,
-            target => \"inet/inetd.conf\",
+            target => 'inet/inetd.conf',
           }
 
       Directories of symlinks can be served recursively by instead using the

data/lib/puppet/type/file.rb

@@ -236,11 +236,9 @@ Puppet::Type.newtype(:file) do
 
   newparam(:links) do
     desc "How to handle links during file actions.  During file copying,
-      `follow` will copy the target file instead of the link, `manage`
-      will copy the link itself, and `ignore` will just pass it by.
-      When not copying, `manage` and `ignore` behave equivalently
-      (because you cannot really ignore links entirely during local
-      recursion), and `follow` will manage the file to which the link points."
+      `follow` will copy the target file instead of the link and `manage`
+      will copy the link itself. When not copying, `manage` will manage
+      the link, and `follow` will manage the file to which the link points."
 
     newvalues(:follow, :manage)
 
@@ -856,6 +854,18 @@ Puppet::Type.newtype(:file) do
         devfail 'a property should have been provided if write_temporary_file? returned true' if property.nil?
         content_checksum = property.write(file)
         file.flush
+        begin
+          file.fsync
+        rescue NotImplementedError
+          # fsync may not be implemented by Ruby on all platforms, but
+          # there is absolutely no recovery path if we detect that.  So, we just
+          # ignore the return code.
+          #
+          # However, don't be fooled: that is accepting that we are running in
+          # an unsafe fashion.  If you are porting to a new platform don't stub
+          # that out.
+        end
+
         fail_if_checksum_is_wrong(file.path, content_checksum) if validate_checksum?
         if self[:validate_cmd]
           output = Puppet::Util::Execution.execute(self[:validate_cmd].gsub(self[:validate_replacement], file.path), :failonfail => true, :combine => true)

data/lib/puppet/type/filebucket.rb

@@ -21,7 +21,7 @@ module Puppet
         puppet master's filebucket with the _desired_ content for each file,
         then instructs the agent to retrieve the content for a specific
         checksum. For more details,
-        [see the `static_compiler` section in the catalog indirection docs](https://docs.puppetlabs.com/references/latest/indirection.html#catalog).
+        [see the `static_compiler` section in the catalog indirection docs](https://docs.puppetlabs.com/puppet/latest/reference/indirection.html#catalog).
 
       To use a central filebucket for backups, you will usually want to declare
       a filebucket resource and a resource default for the `backup` attribute

data/lib/puppet/type/mount.rb

@@ -14,7 +14,11 @@ module Puppet
 
       **Autorequires:** If Puppet is managing any parents of a mount resource ---
       that is, other mount points higher up in the filesystem --- the child
-      mount will autorequire them."
+      mount will autorequire them. If Puppet is managing the file path of a
+      mount point, the mount resource will autorequire it.
+
+      **Autobefores:**  If Puppet is managing any child file paths of a mount
+      point, the mount resource will autobefore them."
 
     feature :refreshable, "The provider can remount the filesystem.",
       :methods => [:remount]
@@ -293,5 +297,18 @@ module Puppet
       dependencies[0..-2]
     end
 
+    # Autorequire the mount point's file resource
+    autorequire(:file) { Pathname.new(self[:name]) }
+
+    # Autobefore the mount point's child file paths
+    autobefore(:file) do
+      dependencies = []
+      file_resources = catalog.resources.select { |resource| resource.type == :file }
+      children_file_resources = file_resources.select { |resource| File.expand_path(resource[:path]) =~ %r(#{self[:name]}/.) }
+      children_file_resources.each do |child|
+        dependencies.push Pathname.new(child[:path])
+      end
+      dependencies
+    end
   end
 end

data/lib/puppet/type/package.rb

@@ -238,8 +238,8 @@ module Puppet
           }
 
           package { 'openssl':
+            ensure => installed,
             name   => $ssl,
-            ensure => installed
           }
 
           . etc. .
@@ -250,9 +250,9 @@ module Puppet
           }
 
           package { 'openssh':
-            name    => $ssh
             ensure  => installed,
-            require => Package['openssl']
+            name    => $ssh,
+            require => Package['openssl'],
           }
 
       "

data/lib/puppet/type/schedule.rb

@@ -2,7 +2,7 @@ module Puppet
   Type.newtype(:schedule) do
     @doc = <<-'EOT'
       Define schedules for Puppet. Resources can be limited to a schedule by using the
-      [`schedule`](https://docs.puppetlabs.com/references/latest/metaparameter.html#schedule)
+      [`schedule`](https://docs.puppetlabs.com/puppet/latest/reference/metaparameter.html#schedule)
       metaparameter.
 
       Currently, **schedules can only be used to stop a resource from being
@@ -24,7 +24,7 @@ module Puppet
       the hours of two and 4 AM, then you would use this schedule:
 
           schedule { 'maint':
-            range  => "2 - 4",
+            range  => '2 - 4',
             period => daily,
             repeat => 1,
           }
@@ -57,10 +57,10 @@ module Puppet
 
             schedule { 'everyday':
               period => daily,
-              range  => "2 - 4",
+              range  => '2 - 4',
             }
 
-            exec { "/usr/bin/apt-get update":
+            exec { '/usr/bin/apt-get update':
               schedule => 'everyday',
             }
 
@@ -77,7 +77,7 @@ module Puppet
         separator. For instance:
 
             schedule { 'maintenance':
-              range => "1:30 - 4:30",
+              range => '1:30 - 4:30',
             }
 
         This is mostly useful for restricting certain resources to being

data/lib/puppet/type/service.rb

@@ -73,6 +73,17 @@ module Puppet
         provider.enabled?
       end
 
+      # This only makes sense on systemd systems. Static services cannot be enabled
+      # or disabled manually.
+      def insync?(current)
+        if provider.respond_to?(:cached_enabled?) && provider.cached_enabled? == 'static'
+          Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
+          return true
+        end
+
+        super(current)
+      end
+
       validate do |value|
         if value == :manual and !Puppet.features.microsoft_windows?
           raise Puppet::Error.new("Setting enable to manual is only supported on Microsoft Windows.")
@@ -239,5 +250,9 @@ module Puppet
         debug "Skipping restart; service is not running"
       end
     end
+
+    def self.needs_ensure_retrieved
+      false
+    end
   end
 end

data/lib/puppet/type/sshkey.rb

@@ -1,8 +1,10 @@
 module Puppet
   Type.newtype(:sshkey) do
-    @doc = "Installs and manages ssh host keys.  At this point, this type
-      only knows how to install keys into `/etc/ssh/ssh_known_hosts`.  See
-      the `ssh_authorized_key` type to manage authorized keys."
+    @doc = "Installs and manages ssh host keys.  By default, this type will
+      install keys into `/etc/ssh/ssh_known_hosts`. To manage ssh keys in a
+      different `known_hosts` file, such as a user's personal `known_hosts`,
+      pass its path to the `target` parameter. See the `ssh_authorized_key`
+      type to manage authorized keys."
 
     ensurable
 

data/lib/puppet/type/stage.rb

@@ -2,7 +2,7 @@ Puppet::Type.newtype(:stage) do
   desc "A resource type for creating new run stages.  Once a stage is available,
     classes can be assigned to it by declaring them with the resource-like syntax
     and using
-    [the `stage` metaparameter](https://docs.puppetlabs.com/references/latest/metaparameter.html#stage).
+    [the `stage` metaparameter](https://docs.puppetlabs.com/puppet/latest/reference/metaparameter.html#stage).
 
     Note that new stages are not useful unless you also declare their order
     in relation to the default `main` stage.

data/lib/puppet/type/tidy.rb

@@ -56,10 +56,10 @@ Puppet::Type.newtype(:tidy) do
 
       Example:
 
-          tidy { "/tmp":
-            age     => "1w",
+          tidy { '/tmp':
+            age     => '1w',
             recurse => 1,
-            matches => [ "[0-9]pub*.tmp", "*.temp", "tmpfile?" ]
+            matches => [ '[0-9]pub*.tmp', '*.temp', 'tmpfile?' ],
           }
 
       This removes files from `/tmp` if they are one week old or older,

data/lib/puppet/type/zone.rb

@@ -282,11 +282,11 @@ end
 
       And then call that:
 
-          zone { myzone:
-            ip           => "bge0:192.168.0.23",
-            sysidcfg     => template("site/sysidcfg.erb"),
-            path         => "/opt/zones/myzone",
-            realhostname => "fully.qualified.domain.name"
+          zone { 'myzone':
+            ip           => 'bge0:192.168.0.23',
+            sysidcfg     => template('site/sysidcfg.erb'),
+            path         => '/opt/zones/myzone',
+            realhostname => 'fully.qualified.domain.name',
           }
 
       The `sysidcfg` only matters on the first booting of the zone,

data/lib/puppet/type.rb

@@ -1044,6 +1044,12 @@ class Type
     insync
   end
 
+  # Says if the ensure property should be retrieved if the resource is ensurable
+  # Defaults to true. Some resource type classes can override it
+  def self.needs_ensure_retrieved
+    true
+  end
+
   # Retrieves the current value of all contained properties.
   # Parameters and meta-parameters are not included in the result.
   # @todo As oposed to all non contained properties? How is this different than any of the other
@@ -1058,7 +1064,7 @@ class Type
     # Provide the name, so we know we'll always refer to a real thing
     result[:name] = self[:name] unless self[:name] == title
 
-    if ensure_prop = property(:ensure) or (self.class.validattr?(:ensure) and ensure_prop = newattr(:ensure))
+    if ensure_prop = property(:ensure) or (self.class.needs_ensure_retrieved and self.class.validattr?(:ensure) and ensure_prop = newattr(:ensure))
       result[:ensure] = ensure_state = ensure_prop.retrieve
     else
       ensure_state = nil
@@ -1246,7 +1252,7 @@ class Type
       event _would_ have been sent.
 
       **Important note:**
-      [The `noop` setting](https://docs.puppetlabs.com/references/latest/configuration.html#noop)
+      [The `noop` setting](https://docs.puppetlabs.com/puppet/latest/reference/configuration.html#noop)
       allows you to globally enable or disable noop mode, but it will _not_ override
       the `noop` metaparameter on individual resources. That is, the value of the
       global `noop` setting will _only_ affect resources that do not have an explicit
@@ -1266,7 +1272,7 @@ class Type
       The value of this metaparameter must be the `name` of a `schedule`
       resource. This means you must declare a schedule resource, then
       refer to it by name; see
-      [the docs for the `schedule` type](https://docs.puppetlabs.com/references/latest/type.html#schedule)
+      [the docs for the `schedule` type](https://docs.puppetlabs.com/puppet/latest/reference/type.html#schedule)
       for more info.
 
           schedule { 'everyday':
@@ -1441,7 +1447,7 @@ class Type
           }
 
       Tags are useful for things like applying a subset of a host's configuration
-      with [the `tags` setting](/references/latest/configuration.html#tags)
+      with [the `tags` setting](/puppet/latest/reference/configuration.html#tags)
       (e.g. `puppet agent --test --tags bootstrap`)."
 
     munge do |tags|
@@ -1531,12 +1537,12 @@ class Type
             :event => self.class.events,
             :callback => method
           }
-          self.debug("subscribes to #{related_resource.ref}")
+          self.debug { "subscribes to #{related_resource.ref}" }
         else
           # If there's no callback, there's no point in even adding
           # a label.
           subargs = nil
-          self.debug("requires #{related_resource.ref}")
+          self.debug { "subscribes to #{related_resource.ref}" }
         end
 
         Puppet::Relationship.new(source, target, subargs)
@@ -1630,7 +1636,7 @@ class Type
       By default, all classes are declared in the `main` stage. To assign a class
       to a different stage, you must:
 
-      * Declare the new stage as a [`stage` resource](https://docs.puppetlabs.com/references/latest/type.html#stage).
+      * Declare the new stage as a [`stage` resource](https://docs.puppetlabs.com/puppet/latest/reference/type.html#stage).
       * Declare an order relationship between the new stage and the `main` stage.
       * Use the resource-like syntax to declare the class, and set the `stage`
         metaparameter to the name of the desired stage.

data/lib/puppet/util/feature.rb

@@ -32,7 +32,7 @@ class Puppet::Util::Feature
       #    configured to always cache
       if block_given?     ||
           @results[name]  ||
-          (@results.has_key?(name) and Puppet[:always_cache_features])
+          (@results.has_key?(name) && (Puppet[:always_cache_features] || !Puppet[:always_retry_plugins]))
         @results[name]
       else
         @results[name] = test(name, options)

data/lib/puppet/util/monkey_patches.rb

@@ -20,6 +20,14 @@ end
 
 class Symbol
   def <=> (other)
+    if (other.class != Symbol)
+      case Puppet[:strict]
+      when :warning
+        Puppet.warn_once('deprecation', 'symbol_comparison', 'Comparing Symbols to non-Symbol values is deprecated')
+      when :error
+        raise ArgumentError.new("Comparing Symbols to non-Symbol values is no longer allowed")
+      end
+    end
     self.to_s <=> other.to_s
   end
 
@@ -114,15 +122,20 @@ if Puppet::Util::Platform.windows?
   require 'openssl'
 
   class OpenSSL::X509::Store
+    @puppet_certs_loaded = false
     alias __original_set_default_paths set_default_paths
     def set_default_paths
       # This can be removed once openssl integrates with windows
       # cert store, see https://rt.openssl.org/Ticket/Display.html?id=2158
-      Puppet::Util::Windows::RootCerts.instance.to_a.uniq.each do |x509|
-        begin
-          add_cert(x509)
-        rescue OpenSSL::X509::StoreError => e
-          warn "Failed to add #{x509.subject.to_s}"
+      unless @puppet_certs_loaded
+        @puppet_certs_loaded = true
+
+        Puppet::Util::Windows::RootCerts.instance.to_a.uniq { |cert| cert.to_der }.each do |x509|
+          begin
+            add_cert(x509)
+          rescue OpenSSL::X509::StoreError => e
+            warn "Failed to add #{x509.subject.to_s}"
+          end
         end
       end
 

data/lib/puppet/util/network_device/cisco/device.rb

@@ -47,7 +47,13 @@ class Puppet::Util::NetworkDevice::Cisco::Device < Puppet::Util::NetworkDevice::
   end
 
   def execute(cmd)
-    transport.command(cmd)
+    transport.command(cmd) do |out|
+      if out =~ /^%/mo or out =~ /^Command rejected:/mo
+        # strip off the command just sent
+        error = out.sub(cmd,'')
+        Puppet.err "Error while executing '#{cmd}', device returned: #{error}"
+      end
+    end
   end
 
   def login
@@ -209,6 +215,12 @@ class Puppet::Util::NetworkDevice::Cisco::Device < Puppet::Util::NetworkDevice::
       return
     end
 
+    # Cisco VLANs are supposed to be alphanumeric only
+    if should[:description] =~ /[^\w]/
+      Puppet.err "Invalid VLAN name '#{should[:description]}' for Cisco device.\nVLAN name must be alphanumeric, no spaces or special characters."
+      return
+    end
+    
     # We're creating or updating an entry
     execute("conf t")
     execute("vlan #{id}")
@@ -250,12 +262,10 @@ class Puppet::Util::NetworkDevice::Cisco::Device < Puppet::Util::NetworkDevice::
         else
           raise "Unknown switchport encapsulation: #{$1} for #{interface}"
         end
-      when /^Access Mode VLAN:\s+(.*) \(\(Inactive\)\)$/
-        # nothing
-      when /^Access Mode VLAN:\s+(.*) \(.*\)$/
-        trunking[:access_vlan] = $1 if trunking[:mode] != :trunk
+      when /^Access Mode VLAN:\s+(.*) \((.*)\)$/
+        trunking[:access_vlan] = $1 if $2 != '(Inactive)'
       when /^Trunking Native Mode VLAN:\s+(.*) \(.*\)$/
-        trunking[:native_vlan] = $1 if trunking[:mode] != :access
+        trunking[:native_vlan] = $1
       when /^Trunking VLANs Enabled:\s+(.*)$/
         next if trunking[:mode] == :access
         vlans = $1

data/lib/puppet/util/network_device/cisco/interface.rb

@@ -45,11 +45,6 @@ class Puppet::Util::NetworkDevice::Cisco::Interface
         should[:access_vlan] = should[:native_vlan]
       end
 
-      # Don't change non-operational mode parameters
-      next if property == :access_vlan and should[:mode] == :trunk
-      next if property == :native_vlan and should[:mode] == :access
-      next if property == :encapsulation and should[:mode] == :access
-
       Puppet.debug("comparing #{property}: #{is[property]} == #{should[property]}")
 
       # They're equal, so do nothing.
@@ -89,7 +84,11 @@ class Puppet::Util::NetworkDevice::Cisco::Interface
 
   def command(command)
     transport.command(command) do |out|
-      Puppet.err "Error while executing #{command}, device returned #{out}" if out =~ /^%/mo
+      if out =~ /^%/mo or out =~ /^Command rejected:/mo
+        # strip off the command just sent
+        error = out.sub(command,'')
+        Puppet.err "Error while executing '#{command}', device returned: #{error}"
+      end
     end
   end
 end

data/lib/puppet/util/plist.rb

@@ -115,16 +115,16 @@ module Puppet::Util::Plist
       begin
         plist_to_save       = CFPropertyList::List.new
         plist_to_save.value = CFPropertyList.guess(plist)
-        plist_to_save.save(file_path, to_format(format))
+        plist_to_save.save(file_path, to_format(format), :formatted => true)
       rescue IOError => e
-        Puppet.error("Unable to write the file #{file_path}. #{e.inspect}")
+        Puppet.err("Unable to write the file #{file_path}. #{e.inspect}")
       end
     end
 
     def dump_plist(plist_data, format = :xml)
       plist_to_save       = CFPropertyList::List.new
       plist_to_save.value = CFPropertyList.guess(plist_data)
-      plist_to_save.to_str(to_format(format))
+      plist_to_save.to_str(to_format(format), :formatted => true)
     end
   end
 end