puppet 4.5.3-universal-darwin → 4.6.1-universal-darwin

data/lib/puppet/provider/ssh_authorized_key/parsed.rb

@@ -68,7 +68,7 @@ Puppet::Type.type(:ssh_authorized_key).provide(
     end
   end
 
-  # parse sshv2 option strings, wich is a comma separated list of
+  # Parse sshv2 option strings, which is a comma-separated list of
   # either key="values" elements or bare-word elements
   def self.parse_options(options)
     result = []

data/lib/puppet/provider/user/aix.rb

@@ -56,7 +56,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   # Valid attributes to be managed by this provider.
   # It is a list with of hash
   #  :aix_attr      AIX command attribute name
-  #  :puppet_prop   Puppet propertie name
+  #  :puppet_prop   Puppet property name
   #  :to            Method to adapt puppet property to aix command value. Optional.
   #  :from          Method to adapt aix command value to puppet property. Optional
   self.attribute_mapping = [
@@ -279,6 +279,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
 
   def managed_attribute_keys(hash)
     managed_attributes ||= @resource.original_parameters[:attributes] || hash.keys.map{|k| k.to_s}
+    managed_attributes = [managed_attributes] unless managed_attributes.is_a?(Array)
     managed_attributes.map {|attr| key, value = attr.split("="); key.strip.to_sym}
   end
 
@@ -289,7 +290,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   end
 
   def filter_attributes(hash)
-    # Return only managed attributtes.
+    # Return only managed attributes.
     managed_keys = managed_attribute_keys(hash)
     results = hash.select {
         |k,v| should_include?(k, managed_keys)

data/lib/puppet/provider/user/directoryservice.rb

@@ -141,7 +141,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     ################################
     # Get Password/Salt/Iterations #
     ################################
-    if attribute_hash[:shadowhashdata].empty?
+    if attribute_hash[:shadowhashdata].nil? or attribute_hash[:shadowhashdata].empty?
       attribute_hash[:password] = '*'
     else
       embedded_binary_plist = get_embedded_binary_plist(attribute_hash[:shadowhashdata])
@@ -367,7 +367,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     # flushing the dscl cache to allow all dscl calls to get INTO the cache
     # first. This could be made faster (and avoid a sleep call) by finding
     # a way to enter calls into the dscl cache faster. A sleep time of 1
-    # second would intermittantly require a second Puppet run to set
+    # second would intermittently require a second Puppet run to set
     # properties, so 2 seconds seems to be the minimum working value.
     sleep 2
     flush_dscl_cache
@@ -553,6 +553,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   # password hash (and Salt/Iterations value if the OS is 10.8 or greater)
   # into the ShadowHashData key of the user's plist.
   def set_shadow_hash_data(users_plist, binary_plist)
+    binary_plist = Puppet::Util::Plist.string_to_blob(binary_plist)
     if users_plist.has_key?('ShadowHashData')
       users_plist['ShadowHashData'][0] = binary_plist
     else
@@ -595,7 +596,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     shadow_hash_data['SALTED-SHA512-PBKDF2'] = Hash.new unless shadow_hash_data['SALTED-SHA512-PBKDF2']
     case field
     when 'salt', 'entropy'
-      shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = base64_decode_string(value)
+      shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = Puppet::Util::Plist.string_to_blob(base64_decode_string(value))
     when 'iterations'
       shadow_hash_data['SALTED-SHA512-PBKDF2'][field] = Integer(value)
     else

data/lib/puppet/provider/user/hpux.rb

@@ -3,7 +3,7 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
     switch to HP-UX's special `usermod` binary to work around the fact that
     its standard `usermod` cannot make changes while the user is logged in.
     New functionality provides for changing trusted computing passwords and
-    resetting password expirations under trusted computing"
+    resetting password expirations under trusted computing."
 
   defaultfor :operatingsystem => "hp-ux"
   confine :operatingsystem => "hp-ux"

data/lib/puppet/provider/user/user_role_add.rb

@@ -161,7 +161,7 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
     return @shadow_entry if defined? @shadow_entry
     @shadow_entry = File.readlines(target_file_path).
       reject { |r| r =~ /^[^\w]/ }.
-      # PUP-229 dont suppress the empty fields
+      # PUP-229: don't suppress the empty fields
       collect { |l| l.chomp.split(':', -1) }.
       find { |user, _| user == @resource[:name] }
   end

data/lib/puppet/provider/user/windows_adsi.rb

@@ -117,6 +117,9 @@ Puppet::Type.type(:user).provide :windows_adsi do
   end
 
   def password
+    # avoid a LogonUserW style password check when the resource is not yet
+    # populated with a password (as is the case with `puppet resource user`)
+    return nil if @resource[:password].nil?
     user.password_is?( @resource[:password] ) ? @resource[:password] : nil
   end
 

data/lib/puppet/provider/zfs/zfs.rb

@@ -47,7 +47,7 @@ Puppet::Type.type(:zfs).provide(:zfs) do
   [:aclmode, :shareiscsi].each do |field|
     # The zfs commands use the property value '-' to indicate that the
     # property is not set. We make use of this value to indicate that the
-    # property is not set since it is not avaliable. Conversely, if these
+    # property is not set since it is not available. Conversely, if these
     # properties are attempted to be unset, and resulted in an error, our
     # best bet is to catch the exception and continue.
     define_method(field) do

data/lib/puppet/reference/type.rb

@@ -36,7 +36,7 @@ Puppet::Util::Reference.newreference :type, :doc => "All Puppet resource types a
 - *Providers* provide low-level functionality for a given resource type.  This is
   usually in the form of calling out to external commands.
 
-  When required binaries are specified for providers, fully qualifed paths
+  When required binaries are specified for providers, fully qualified paths
   indicate that the binary must exist at that specific path and unqualified
   binaries indicate that Puppet will search for the binary using the shell
   path.

data/lib/puppet/resource.rb

@@ -14,6 +14,11 @@ class Puppet::Resource
   attr_accessor :file, :line, :catalog, :exported, :virtual, :strict
   attr_reader :type, :title
 
+  # @!attribute [rw] sensitive_parameters
+  #   @api private
+  #   @return [Array<Symbol>] A list of parameters to be treated as sensitive
+  attr_accessor :sensitive_parameters
+
   # @deprecated
   attr_accessor :validate_parameters
 
@@ -36,6 +41,10 @@ class Puppet::Resource
       params.each { |param, value| resource[param] = value }
     end
 
+    if sensitive_parameters = data['sensitive_parameters']
+      resource.sensitive_parameters = sensitive_parameters.map(&:to_sym)
+    end
+
     if tags = data['tags']
       tags.each { |tag| resource.tag(tag) }
     end
@@ -74,6 +83,8 @@ class Puppet::Resource
 
     data["parameters"] = params unless params.empty?
 
+    data["sensitive_parameters"] = sensitive_parameters unless sensitive_parameters.empty?
+
     data
   end
 
@@ -141,12 +152,14 @@ class Puppet::Resource
 
   # Compatibility method.
   def builtin?
+    # TODO: should be deprecated (was only used in one place in puppet codebase)
     builtin_type?
   end
 
   # Is this a builtin resource type?
   def builtin_type?
-    resource_type.is_a?(Class)
+    # Note - old implementation only checked if the resource_type was a Class
+    resource_type.is_a?(Puppet::CompilableResourceType)
   end
 
   # Iterate over each param/value pair, as required for Enumerable.
@@ -197,6 +210,7 @@ class Puppet::Resource
   # @api public
   def initialize(type, title = nil, attributes = {})
     @parameters = {}
+    @sensitive_parameters = []
     if type.is_a?(Puppet::Resource)
       # Copy constructor. Let's avoid munging, extracting, tagging, etc
       src = type
@@ -224,6 +238,7 @@ class Puppet::Resource
 
         self[p] = v
       end
+      @sensitive_parameters.replace(type.sensitive_parameters)
     else
       if type.is_a?(Hash)
         raise ArgumentError, "Puppet::Resource.new does not take a hash as the first argument. "+
@@ -231,12 +246,23 @@ class Puppet::Resource
       end
 
       environment = attributes[:environment]
-      if type.is_a?(Class) && type < Puppet::Type
-        # Set the resource type to avoid an expensive `known_resource_types`
-        # lookup.
+      # In order to avoid an expensive search of 'known_resource_types" and
+      # to obey/preserve the implementation of the resource's type - if the
+      # given type is a resource type implementation (one of):
+      #   * a "classic" 3.x ruby plugin
+      #   * a compatible implementation (e.g. loading from pcore metadata)
+      #   * a resolved user defined type
+      # 
+      # ...then, modify the parameters to the "old" (agent side compatible) way
+      # of describing the type/title with string/symbols.
+      #
+      # TODO: Further optimizations should be possible as the "type juggling" is
+      # not needed when the type implementation is known.
+      # 
+      if type.is_a?(Puppet::CompilableResourceType) || type.is_a?(Puppet::Resource::Type)
+        # set the resource type implementation
         self.resource_type = type
-        # From this point on, the constructor behaves the same as if `type` had
-        # been passed as a symbol.
+        # set the type name to the symbolic name
         type = type.name
       end
 
@@ -584,7 +610,7 @@ class Puppet::Resource
   def parse_title
     h = {}
     type = resource_type
-    if type.respond_to? :title_patterns
+    if type.respond_to?(:title_patterns) && !type.title_patterns.nil?
       type.title_patterns.each { |regexp, symbols_and_lambdas|
         if captures = regexp.match(title.to_s)
           symbols_and_lambdas.zip(captures[1..-1]).each do |symbol_and_lambda,capture|

data/lib/puppet/resource/capability_finder.rb

@@ -12,7 +12,11 @@ require 'json'
 # @api private
 module Puppet::Resource::CapabilityFinder
 
-  # Looks the capability resource from PuppetDB.
+  # Looks up a capability resource from PuppetDB. Capability resources are
+  # required to be unique per environment and code id. If multiple copies of a
+  # capability resource are found, the one matching the current code id is
+  # used.
+  #
   # @param environment [String] environment name
   # @param code_id [String,nil] code_id of the catalog
   # @param cap [Puppet::Type] the capability resource type instance
@@ -22,6 +26,29 @@ module Puppet::Resource::CapabilityFinder
       raise Puppet::DevError, 'PuppetDB is not available'
     end
 
+    resources = search(environment, nil, cap)
+
+    if resources.size > 1 && code_id
+      Puppet.debug "Found multiple resources when looking up capability #{cap}, filtering by code id #{code_id}"
+      resources = search(environment, code_id, cap)
+    end
+
+    if resources.size > 1
+      raise Puppet::DevError,
+        "Unexpected response from PuppetDB when looking up #{cap}:\n" \
+        "expected exactly one resource but got #{resources.size};\n" \
+        "returned data is:\n#{resources.inspect}"
+    end
+
+    if resource_hash = resources.first
+      instantiate_resource(resource_hash)
+    else
+      Puppet.debug "Could not find capability resource #{cap} in PuppetDB"
+      nil
+    end
+  end
+
+  def self.search(environment, code_id, cap)
     query_terms = [
       'and',
       ['=', 'type', cap.type.capitalize],
@@ -36,67 +63,60 @@ module Puppet::Resource::CapabilityFinder
             ['=', 'code_id', code_id]]]]
     end
 
-    Puppet.notice "Capability lookup #{cap}]: #{query_terms}"
+    Puppet.notice "Looking up capability #{cap} in PuppetDB: #{query_terms}"
 
-    data = query_puppetdb(query_terms)
-
-    # The format of the response body is documented at
-    #   http://docs.puppetlabs.com/puppetdb/3.0/api/query/v4/resources.html#response-format
-    # In a nutshell, we expect to get an array of resources back. If the
-    # array is empty, the lookup failed and we return +nil+, if it
-    # contains exactly one, we turn that resource back into a Puppet
-    # ::Resource. If the array contains more than one entry, we have a
-    # bug in the overall system, as we allowed multiple capabilities with
-    # the same type and title to be produced in this environment.
-    unless data.is_a?(Array)
-      raise Puppet::DevError,
-      "Unexpected response from PuppetDB when looking up #{cap}: " +
-        "expected an Array but got #{data.inspect}"
-    end
-    if data.size > 1
-      raise Puppet::DevError,
-      "Unexpected response from PuppetDB when looking up #{cap}:\n" +
-        "expected exactly one resource but got #{data.size};\n" +
-        "returned data is:\n#{data.inspect}"
-    end
+    query_puppetdb(query_terms)
+  end
 
-    unless data.empty?
-      resource_hash = data.first
-      resource = Puppet::Resource.new(resource_hash['type'],
-                                      resource_hash['title'])
-      real_type = Puppet::Type.type(resource.type)
-      if real_type.nil?
-        fail Puppet::ParseError,
-          "Could not find resource type #{resource.type} returned from PuppetDB"
-      end
-      real_type.parameters.each do |param|
-        param = param.to_s
-        next if param == 'name'
-        if value = resource_hash['parameters'][param]
-          resource[param] = value
-        else
-          Puppet.debug "No capability value for #{resource}->#{param}"
+  def self.query_puppetdb(query)
+    begin
+      # If using PuppetDB >= 4, use the API method query_puppetdb()
+      result = if Puppet::Util::Puppetdb.respond_to?(:query_puppetdb)
+        # PuppetDB 4 uses a unified query endpoint, so we have to specify what we're querying
+        Puppet::Util::Puppetdb.query_puppetdb(["from", "resources", query])
+      # For PuppetDB < 4, use the old internal method action()
+      else
+        url = "/pdb/query/v4/resource?query=#{CGI.escape(query.to_json)}"
+        response = Puppet::Util::Puppetdb::Http.action(url) do |conn, uri|
+          conn.get(uri, { 'Accept' => 'application/json'})
         end
+        JSON.parse(response.body)
+      end
+
+      # The format of the response body is documented at
+      #   http://docs.puppetlabs.com/puppetdb/3.0/api/query/v4/resources.html#response-format
+      unless result.is_a?(Array)
+        raise Puppet::DevError,
+        "Unexpected response from PuppetDB when looking up #{cap}: " \
+          "expected an Array but got #{result.inspect}"
       end
-      return resource
+
+      result
+    rescue JSON::JSONError => e
+      raise Puppet::DevError,
+        "Invalid JSON from PuppetDB when looking up #{cap}\n#{e}"
     end
   end
 
-  def self.query_puppetdb(query)
-    # If using PuppetDB >= 4, use the API method query_puppetdb()
-    if Puppet::Util::Puppetdb.respond_to?(:query_puppetdb)
-      # PuppetDB 4 uses a unified query endpoint, so we have to specify what we're querying
-      Puppet::Util::Puppetdb.query_puppetdb(["from", "resources", query])
-    # For PuppetDB < 4, use the old internal method action()
-    else
-      url = "/pdb/query/v4/resource?query=#{CGI.escape(query.to_json)}"
-      response = Puppet::Util::Puppetdb::Http.action(url) do |conn, uri|
-        conn.get(uri, { 'Accept' => 'application/json'})
+  private
+
+  def self.instantiate_resource(resource_hash)
+    resource = Puppet::Resource.new(resource_hash['type'],
+                                    resource_hash['title'])
+    real_type = Puppet::Type.type(resource.type)
+    if real_type.nil?
+      fail Puppet::ParseError,
+        "Could not find resource type #{resource.type} returned from PuppetDB"
+    end
+    real_type.parameters.each do |param|
+      param = param.to_s
+      next if param == 'name'
+      if value = resource_hash['parameters'][param]
+        resource[param] = value
+      else
+        Puppet.debug "No capability value for #{resource}->#{param}"
       end
-      JSON.parse(response.body)
     end
-  rescue JSON::JSONError => e
-    raise Puppet::DevError,
-      "Invalid JSON from PuppetDB when looking up #{cap}\n#{e}"
+    return resource
   end
 end

data/lib/puppet/resource/status.rb

@@ -30,7 +30,7 @@ module Puppet
       attr_accessor :evaluation_time
 
       # Boolean status types set while evaluating `@real_resource`.
-      STATES = [:skipped, :failed, :failed_to_restart, :restarted, :changed, :out_of_sync, :scheduled]
+      STATES = [:skipped, :failed, :failed_to_restart, :restarted, :changed, :out_of_sync, :scheduled, :corrective_change]
       attr_accessor *STATES
 
       # @!attribute [r] source_description
@@ -83,6 +83,10 @@ module Puppet
       #     while evaluating `@real_resource`.
       attr_reader :events
 
+      # @!attribute [r] corrective_change
+      #   @return [Boolean] true if the resource contained a corrective change.
+      attr_reader :corrective_change
+
       # @!attribute [rw] failed_dependencies
       #   @return [Array<Puppet::Resource>] A cache of all
       #   dependencies of this resource that failed to apply.
@@ -130,6 +134,9 @@ module Puppet
           @out_of_sync_count += 1
           @out_of_sync = true
         end
+        if event.corrective_change
+          @corrective_change = true
+        end
       end
 
       def failed_because(detail)
@@ -153,6 +160,7 @@ module Puppet
         @out_of_sync = false
         @skipped = false
         @failed = false
+        @corrective_change = false
 
         @file = resource.file
         @line = resource.line
@@ -181,7 +189,7 @@ module Puppet
         @changed = data['changed']
         @skipped = data['skipped']
         @failed = data['failed']
-
+        @corrective_change = data['corrective_change']
         @events = data['events'].map do |event|
           # in YAML (for reports) we serialize this as an object, but
           # in PSON it becomes a hash. Depending on where we came from
@@ -212,6 +220,7 @@ module Puppet
           'change_count' => @change_count,
           'out_of_sync_count' => @out_of_sync_count,
           'events' => @events,
+          'corrective_change' => @corrective_change,
         }
       end
 

data/lib/puppet/settings.rb

@@ -29,6 +29,7 @@ class Puppet::Settings
   require 'puppet/settings/config_file'
   require 'puppet/settings/value_translator'
   require 'puppet/settings/environment_conf'
+  require 'puppet/settings/server_list_setting'
 
   # local reference for convenience
   PuppetOptionParser = Puppet::Util::CommandLine::PuppetOptionParser
@@ -667,6 +668,7 @@ class Puppet::Settings
       :symbolic_enum   => SymbolicEnumSetting,
       :priority   => PrioritySetting,
       :autosign   => AutosignSetting,
+      :server_list => ServerListSetting
   }
 
   # Create a new setting.  The value is passed in because it's used to determine
@@ -876,7 +878,7 @@ class Puppet::Settings
   #           also supports additional options such as "mode", "owner", "group"
   #       :directory - A (single) directory path; puppet may attempt to create this file depending on how the settings are used.  This type
   #           also supports additional options such as "mode", "owner", "group"
-  #       :path - This is intended to be used for settings whose value can contain multiple directory paths, respresented
+  #       :path - This is intended to be used for settings whose value can contain multiple directory paths, represented
   #           as strings separated by the system path separator (e.g. system path, module path, etc.).
   #     [:mode] => an (optional) octal value to be used as the permissions/mode for :file and :directory settings
   #     [:owner] => optional owner username/uid for :file and :directory settings
@@ -1360,12 +1362,21 @@ Generated on #{Time.now}.
           "Attempt to assign a value to unknown setting #{name.inspect}"
       end
 
-      if default.has_hook?
-        default.handle(value)
-      end
-
+      # This little exception-handling dance ensures that a hook is
+      # able to check whether a value for itself has been explicitly
+      # set, while still preserving the existing value if the hook
+      # throws (as was existing behavior)
+      old_value = @values[name]
       @values[name] = value
-    end
+      begin
+        if default.has_hook?
+          default.handle(value)
+        end
+      rescue Exception => e
+        @values[name] = old_value
+        raise e
+      end
+     end
 
     def inspect
       %Q{<#{self.class}:#{self.object_id} @name="#{@name}" @values="#{@values}">}