puppet 4.5.3-universal-darwin → 4.6.1-universal-darwin

data/lib/puppet/type.rb

@@ -75,6 +75,7 @@ module Puppet
 #
 #
 class Type
+  extend Puppet::CompilableResourceType
   include Puppet::Util
   include Puppet::Util::Errors
   include Puppet::Util::Logging
@@ -90,9 +91,9 @@ class Type
   # @see Comparable
   #
   def <=>(other)
-    # We only order against other types, not arbitrary objects.
-    return nil unless other.is_a? Puppet::Type
-    # Our natural order is based on the reference name we use when comparing
+    # Order is only maintained against other types, not arbitrary objects.
+    # The natural order is based on the reference name used when comparing
+    return nil unless other.is_a?(Puppet::CompilableResourceType) || other.class.is_a?(Puppet::CompilableResourceType)
     # against other type instances.
     self.ref <=> other.ref
   end
@@ -600,7 +601,7 @@ class Type
     validattr?(name)
   end
 
-  # @return [Boolean] Returns true if the wanted state of the resoure is that it should be absent (i.e. to be deleted).
+  # @return [Boolean] Returns true if the wanted state of the resource is that it should be absent (i.e. to be deleted).
   def deleting?
     obj = @parameters[:ensure] and obj.should == :absent
   end
@@ -741,7 +742,7 @@ class Type
     (prop = @parameters[name] and prop.is_a?(Puppet::Property)) ? prop.should : nil
   end
 
-  # Registers an attribute to this resource type insance.
+  # Registers an attribute to this resource type instance.
   # Requires either the attribute name or class as its argument.
   # This is a noop if the named property/parameter is not supported
   # by this resource. Otherwise, an attribute instance is created
@@ -861,7 +862,7 @@ class Type
     self.class.name
   end
 
-  # @todo Comment says "Return a specific value for an attribute.", as opposed to what "An upspecific value"???
+  # @todo Comment says "Return a specific value for an attribute.", as opposed to what "An unspecific value"???
   # @todo is this the 'is' or the 'should' value?
   # @todo why is the return restricted to things that respond to :value? (Only non structural basic data types
   #   supported?
@@ -894,7 +895,7 @@ class Type
   # See the overview of this class for a longer explanation of the concept _isomorphism_.
   # Defaults to true.
   #
-  # @return [Boolan] true, if this type's name is isomorphic with the object
+  # @return [Boolean] true, if this type's name is isomorphic with the object
   def self.isomorphic?
     if defined?(@isomorphic)
       return @isomorphic
@@ -1052,7 +1053,7 @@ class Type
 
   # Retrieves the current value of all contained properties.
   # Parameters and meta-parameters are not included in the result.
-  # @todo As oposed to all non contained properties? How is this different than any of the other
+  # @todo As opposed to all non contained properties? How is this different than any of the other
   #   methods that also "gets" properties/parameters/etc. ?
   # @return [Puppet::Resource] array of all property values (mix of types)
   # @raise [fail???] if there is a provider and it is not suitable for the host this is evaluated for.
@@ -1152,7 +1153,7 @@ class Type
   # Retrieves all known instances.
   # @todo Retrieves them from where? Known to whom?
   # Either requires providers or must be overridden.
-  # @raise [Puppet::DevError] when there are no providers and the implementation has not overridded this method.
+  # @raise [Puppet::DevError] when there are no providers and the implementation has not overridden this method.
   def self.instances
     raise Puppet::DevError, "#{self.name} has no providers and has not overridden 'instances'" if provider_hash.empty?
 
@@ -1223,7 +1224,7 @@ class Type
   end
 
 
-  # Returns an array of strings representing the containment heirarchy
+  # Returns an array of strings representing the containment hierarchy
   # (types/classes) that make up the path to the resource from the root
   # of the catalog.  This is mostly used for logging purposes.
   #
@@ -1523,7 +1524,7 @@ class Type
         end
 
         # Are we requiring them, or vice versa?  See the method docs
-        # for futher info on this.
+        # for further info on this.
         if self.class.direction == :in
           source = related_resource
           target = @resource
@@ -1550,7 +1551,7 @@ class Type
     end
   end
 
-  # @todo document this, have no clue what this does... it retuns "RelationshipMetaparam.subclasses"
+  # @todo document this, have no clue what this does... it returns "RelationshipMetaparam.subclasses"
   #
   def self.relationship_params
     RelationshipMetaparam.subclasses
@@ -1558,7 +1559,7 @@ class Type
 
 
   # Note that the order in which the relationships params is defined
-  # matters.  The labelled params (notify and subcribe) must be later,
+  # matters.  The labeled params (notify and subscribe) must be later,
   # so that if both params are used, those ones win.  It's a hackish
   # solution, but it works.
 
@@ -2059,7 +2060,7 @@ end
   end
 
   # Provides iteration over added auto-requirements (see {autorequire}).
-  # @yieldparam type [String] the name of the type to autoriquire an instance of
+  # @yieldparam type [String] the name of the type to autorequire an instance of
   # @yieldparam block [Proc] a block producing one or several dependencies to auto require (see {autorequire}).
   # @yieldreturn [void]
   # @return [void]
@@ -2071,7 +2072,7 @@ end
   end
 
   # Provides iteration over added auto-requirements (see {autobefore}).
-  # @yieldparam type [String] the name of the type to autoriquire an instance of
+  # @yieldparam type [String] the name of the type to autorequire an instance of
   # @yieldparam block [Proc] a block producing one or several dependencies to auto require (see {autobefore}).
   # @yieldreturn [void]
   # @return [void]
@@ -2083,7 +2084,7 @@ end
   end
 
   # Provides iteration over added auto-requirements (see {autosubscribe}).
-  # @yieldparam type [String] the name of the type to autoriquire an instance of
+  # @yieldparam type [String] the name of the type to autorequire an instance of
   # @yieldparam block [Proc] a block producing one or several dependencies to auto require (see {autosubscribe}).
   # @yieldreturn [void]
   # @return [void]
@@ -2095,7 +2096,7 @@ end
   end
 
   # Provides iteration over added auto-requirements (see {autonotify}).
-  # @yieldparam type [String] the name of the type to autoriquire an instance of
+  # @yieldparam type [String] the name of the type to autorequire an instance of
   # @yieldparam block [Proc] a block producing one or several dependencies to auto require (see {autonotify}).
   # @yieldreturn [void]
   # @return [void]
@@ -2192,7 +2193,7 @@ end
   # @comment - these two comments were floating around here, and turned up as documentation
   #  for the attribute "title", much to my surprise and amusement. Clearly these comments
   #  are orphaned ... I think they can just be removed as what they say should be covered
-  #  by the now added yardoc. <irony>(Yo! to quote some of the other actual awsome specific comments applicable
+  #  by the now added yardoc. <irony>(Yo! to quote some of the other actual awesome specific comments applicable
   #  to objects called from elsewhere, or not. ;-)</irony>
   #
   # @comment Types (which map to resources in the languages) are entirely composed of
@@ -2271,7 +2272,7 @@ end
   # Returns the name of this type (if specified) or the parent type #to_s.
   # The returned name is on the form "Puppet::Type::<name>", where the first letter of name is
   # capitalized.
-  # @return [String] the fully qualified name Puppet::Type::<name> where the first letter of name is captialized
+  # @return [String] the fully qualified name Puppet::Type::<name> where the first letter of name is capitalized
   #
   def self.to_s
     if defined?(@name)
@@ -2393,6 +2394,47 @@ end
       adderrorcontext(error, detail)
       raise error
     end
+
+    set_sensitive_parameters(resource.sensitive_parameters)
+  end
+
+  protected
+
+  # Mark parameters associated with this type as sensitive, based on the associated resource.
+  #
+  # Currently, only instances of `Puppet::Property` can be easily marked for sensitive data handling
+  # and information redaction is limited to redacting events generated while synchronizing
+  # properties. While support for redaction will be broadened in the future we can't automatically
+  # deduce how to redact arbitrary parameters, so if a parameter is marked for redaction the best
+  # we can do is warn that we can't handle treating that parameter as sensitive and move on.
+  #
+  # In some unusual cases a given parameter will be marked as sensitive but that sensitive context
+  # needs to be transferred to another parameter. In this case resource types may need to override
+  # this method in order to copy the sensitive context from one parameter to another (and in the
+  # process force the early generation of a parameter that might otherwise be lazily generated.)
+  # See `Puppet::Type.type(:file)#set_sensitive_parameters` for an example of this.
+  #
+  # @note This method visibility is protected since it should only be called by #initialize, but is
+  #   marked as public as subclasses may need to override this method.
+  #
+  # @api public
+  #
+  # @param sensitive_parameters [Array<Symbol>] A list of parameters to mark as sensitive.
+  #
+  # @return [void]
+  def set_sensitive_parameters(sensitive_parameters)
+    sensitive_parameters.each do |name|
+      p = parameter(name)
+      if p.is_a?(Puppet::Property)
+        p.sensitive = true
+      elsif p.is_a?(Puppet::Parameter)
+        warning("Unable to mark '#{name}' as sensitive: #{name} is a parameter and not a property, and cannot be automatically redacted.")
+      elsif self.class.attrclass(name)
+        warning("Unable to mark '#{name}' as sensitive: the property itself was not assigned a value.")
+      else
+        err("Unable to mark '#{name}' as sensitive: the property itself is not defined on #{type}.")
+      end
+    end
   end
 
   private
@@ -2543,14 +2585,14 @@ end
     end
   end
 
-  # Returns the title of this object, or its name if title was not explicetly set.
+  # Returns the title of this object, or its name if title was not explicitly set.
   # If the title is not already set, it will be computed by looking up the {#name_var} and using
   # that value as the title.
   # @todo it is somewhat confusing that if the name_var is a valid parameter, it is assumed to
   #  be the name_var called :name, but if it is a property, it uses the name_var.
   #  It is further confusing as Type in some respects supports multiple namevars.
   #
-  # @return [String] Returns the title of this object, or its name if title was not explicetly set.
+  # @return [String] Returns the title of this object, or its name if title was not explicitly set.
   # @raise [??? devfail] if title is not set, and name_var can not be found.
   def title
     unless @title

data/lib/puppet/type/augeas.rb

@@ -106,7 +106,7 @@ Puppet::Type.newtype(:augeas) do
     desc "The changes which should be applied to the filesystem. This
     can be a command or an array of commands. The following commands are supported:
 
-    * `set <PATH> <VALUE>` --- Sets the value `VALUE` at loction `PATH`
+    * `set <PATH> <VALUE>` --- Sets the value `VALUE` at location `PATH`
     * `setm <PATH> <SUB> <VALUE>` --- Sets multiple nodes (matching `SUB` relative to `PATH`) to `VALUE`
     * `rm <PATH>` --- Removes the node at location `PATH`
     * `remove <PATH>` --- Synonym for `rm`
@@ -137,7 +137,7 @@ Puppet::Type.newtype(:augeas) do
 
   newparam(:force) do
     desc "Optional command to force the augeas type to execute even if it thinks changes
-    will not be made. This does not overide the `onlyif` parameter."
+    will not be made. This does not override the `onlyif` parameter."
 
     defaultto false
   end
@@ -192,7 +192,7 @@ Puppet::Type.newtype(:augeas) do
     end
 
     # if the onlyif resource is provided, then the value is parsed.
-    # a return value of 0 will stop exection because it matches the
+    # a return value of 0 will stop execution because it matches the
     # default value.
     def retrieve
       if @resource.provider.need_to_run?()

data/lib/puppet/type/cron.rb

@@ -446,7 +446,7 @@ Puppet::Type.newtype(:cron) do
   # @api public
   #
   # @note This overrides the Puppet::Type method in order to handle
-  #   an edge case that has so far been observed during testig only.
+  #   an edge case that has so far been observed during testing only.
   #   Without forcing the should-value for the user property to be
   #   identical to the original cron file, purging from a fixture
   #   will not work, because the user property defaults to the user

data/lib/puppet/type/file.rb

@@ -37,7 +37,9 @@ Puppet::Type.newtype(:file) do
     "The provider can manage symbolic links."
 
   def self.title_patterns
-    [ [ /^(.*?)\/*\Z/m, [ [ :path ] ] ] ]
+    # strip trailing slashes from path but allow the root directory, including
+    # for example "/" or "C:/"
+    [ [ %r{^(/|.+:/|.*[^/])/*\Z}m, [ [ :path ] ] ] ]
   end
 
   newparam(:path) do
@@ -885,6 +887,41 @@ Puppet::Type.newtype(:file) do
 
   private
 
+  # Carry the context of sensitive parameters to the the properties that will actually handle that
+  # sensitive data.
+  #
+  # The file type can accept file content from a number of origins and depending on the current
+  # state of the system different properties will be responsible for synchronizing the file
+  # content. This method handles the necessary mapping of originating parameters to the
+  # responsible parameters.
+  def set_sensitive_parameters(sensitive_parameters)
+    # If we have content that's marked as sensitive but the file doesn't exist then the ensure
+    # property will be responsible for syncing content, so we have to mark ensure as sensitive as well.
+    if sensitive_parameters.include?(:content)
+      # The `ensure` parameter is not guaranteed to be defined either and will be conditionally set when
+      # the `content` property is set, so we need to force the creation of the `ensure` property to
+      # set the sensitive context.
+      newattr(:ensure).sensitive = true
+    end
+
+    # The source parameter isn't actually a property but works by injecting information into the
+    # content property. In order to preserve the intended sensitive context we need to mark content
+    # as sensitive as well.
+    if sensitive_parameters.include?(:source)
+      sensitive_parameters.delete(:source)
+      parameter(:source).sensitive = true
+      # The `source` parameter will generate the `content` property when the resource state is retrieved
+      # but that's long after we've set the sensitive context. Force the early creation of the `content`
+      # attribute so we can mark it as sensitive.
+      newattr(:content).sensitive = true
+      # As noted above, making the `content` property sensitive requires making the `ensure` property
+      # sensitive as well.
+      newattr(:ensure).sensitive = true
+    end
+
+    super(sensitive_parameters)
+  end
+
   # @return [String] The type of the current file, cast to a string.
   def read_current_type
     stat_info = stat
@@ -968,7 +1005,7 @@ Puppet::Type.newtype(:file) do
     properties.each do |thing|
       next unless [:mode, :owner, :group, :seluser, :selrole, :seltype, :selrange].include?(thing.name)
 
-      # Make sure we get a new stat objct
+      # Make sure we get a new stat object
       @stat = :needs_stat
       currentvalue = thing.retrieve
       thing.sync unless thing.safe_insync?(currentvalue)

data/lib/puppet/type/file/data_sync.rb

@@ -34,14 +34,22 @@ module Puppet
 
       return true if ! resource.replace?
 
-      result = yield(is)
+      is_insync = yield(is)
 
-      if !result && Puppet[:show_diff] && resource.show_diff?
-        write_temporarily(param) do |path|
-          send resource[:loglevel], "\n" + diff(resource[:path], path)
+      if show_diff?(!is_insync)
+        if param.sensitive
+          send resource[:loglevel], "[diff redacted]"
+        else
+          write_temporarily(param) do |path|
+            send resource[:loglevel], "\n" + diff(resource[:path], path)
+          end
         end
       end
-      result
+      is_insync
+    end
+
+    def show_diff?(has_changes)
+      has_changes && Puppet[:show_diff] && resource.show_diff?
     end
 
     def date_matches?(checksum_type, current, desired)

data/lib/puppet/type/host.rb

@@ -17,7 +17,7 @@ module Puppet
 
       def valid_v6?(addr)
         # http://forums.dartware.com/viewtopic.php?t=452
-        # ...and, yes, it is this hard.  Doing it programatically is harder.
+        # ...and, yes, it is this hard. Doing it programmatically is harder.
         return true if addr =~ /^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*$/
 
         return false

data/lib/puppet/type/mount.rb

@@ -14,8 +14,7 @@ module Puppet
 
       **Autorequires:** If Puppet is managing any parents of a mount resource ---
       that is, other mount points higher up in the filesystem --- the child
-      mount will autorequire them. If Puppet is managing the file path of a
-      mount point, the mount resource will autorequire it.
+      mount will autorequire them.
 
       **Autobefores:**  If Puppet is managing any child file paths of a mount
       point, the mount resource will autobefore them."
@@ -297,14 +296,11 @@ module Puppet
       dependencies[0..-2]
     end
 
-    # Autorequire the mount point's file resource
-    autorequire(:file) { Pathname.new(self[:name]) }
-
     # Autobefore the mount point's child file paths
     autobefore(:file) do
       dependencies = []
       file_resources = catalog.resources.select { |resource| resource.type == :file }
-      children_file_resources = file_resources.select { |resource| File.expand_path(resource[:path]) =~ %r(#{self[:name]}/.) }
+      children_file_resources = file_resources.select { |resource| File.expand_path(resource[:path]) =~ %r(^#{self[:name]}/.) }
       children_file_resources.each do |child|
         dependencies.push Pathname.new(child[:path])
       end

data/lib/puppet/type/notify.rb

@@ -6,7 +6,7 @@ module Puppet
   Type.newtype(:notify) do
     @doc = "Sends an arbitrary message to the agent run-time log."
 
-    newproperty(:message) do
+    newproperty(:message, :idempotent => false) do
       desc "The message to be sent to the log."
       def sync
         case @resource["withpath"]

data/lib/puppet/type/package.rb

@@ -276,7 +276,7 @@ module Puppet
     # provider. So far, the logic that determines uniqueness appears to just
     # "Do The Right Thing™" when the provider is explicitly set by the user.
     #
-    # The following resources will be seen as uniqe by puppet:
+    # The following resources will be seen as unique by puppet:
     #
     #     # Uniqueness Key: ['mysql', nil]
     #     package{'mysql': }

data/lib/puppet/type/resources.rb

@@ -4,7 +4,7 @@ require 'puppet/parameter/boolean'
 Puppet::Type.newtype(:resources) do
   @doc = "This is a metatype that can manage other resource types.  Any
     metaparams specified here will be passed on to any generated resources,
-    so you can purge umanaged resources but set `noop` to true so the
+    so you can purge unmanaged resources but set `noop` to true so the
     purging is only logged and does not actually happen."
 
 

data/lib/puppet/type/scheduled_task.rb

@@ -118,7 +118,7 @@ Puppet::Type.newtype(:scheduled_task) do
           * `months` --- Which months the task should run, as an array. Defaults to
             all months. Each month must be an integer between 1 and 12.
           * `on` **(Required)** --- Which days of the month the task should run,
-            as an array. Each day must beeither an integer between 1 and 31,
+            as an array. Each day must be either an integer between 1 and 31,
             or the special value `last,` which is always the last day of the month.
       * For `monthly` (by weekday) triggers:
           * `months` --- Which months the task should run, as an array. Defaults to

data/lib/puppet/type/ssh_authorized_key.rb

@@ -6,14 +6,14 @@ module Puppet
       resource type requires you to split that line into several attributes. Thus, a
       key that appears in your `~/.ssh/id_rsa.pub` file like this...
 
-          ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAy5mtOAMHwA2ZAIfW6Ap70r+I4EclYHEec5xIN59ROUjss23Skb1OtjzYpVPaPH8mSdSmsN0JHaBLiRcu7stl4O8D8zA4mz/vw32yyQ/Kqaxw8l0K76k6t2hKOGqLTY4aFbFISV6GDh7MYLn8KU7cGp96J+caO5R5TqtsStytsUhSyqH+iIDh4e4+BrwTc6V4Y0hgFxaZV5d18mLA4EPYKeG5+zyBCVu+jueYwFqM55E0tHbfiaIN9IzdLV+7NEEfdLkp6w2baLKPqWUBmuvPF1Mn3FwaFLjVsMT3GQeMue6b3FtUdTDeyAYoTxrsRo/WnDkS6Pa3YhrFwjtUqXfdaQ== nick@magpie.puppetlabs.lan
+          ssh-rsa AAAAB3Nza[...]qXfdaQ== nick@magpie.puppetlabs.lan
 
       ...would translate to the following resource:
 
           ssh_authorized_key { 'nick@magpie.puppetlabs.lan':
             user => 'nick',
             type => 'ssh-rsa',
-            key  => 'AAAAB3NzaC1yc2EAAAABIwAAAQEAy5mtOAMHwA2ZAIfW6Ap70r+I4EclYHEec5xIN59ROUjss23Skb1OtjzYpVPaPH8mSdSmsN0JHaBLiRcu7stl4O8D8zA4mz/vw32yyQ/Kqaxw8l0K76k6t2hKOGqLTY4aFbFISV6GDh7MYLn8KU7cGp96J+caO5R5TqtsStytsUhSyqH+iIDh4e4+BrwTc6V4Y0hgFxaZV5d18mLA4EPYKeG5+zyBCVu+jueYwFqM55E0tHbfiaIN9IzdLV+7NEEfdLkp6w2baLKPqWUBmuvPF1Mn3FwaFLjVsMT3GQeMue6b3FtUdTDeyAYoTxrsRo/WnDkS6Pa3YhrFwjtUqXfdaQ==',
+            key  => 'AAAAB3Nza[...]qXfdaQ== nick@magpie.puppetlabs.lan',
           }
 
       To ensure that only the currently approved keys are present, you can purge

data/lib/puppet/type/tidy.rb

@@ -73,7 +73,7 @@ Puppet::Type.newtype(:tidy) do
       Finally, note that you must now specify a non-zero/non-false value
       for recurse if matches is used, as matches only apply to files found
       by recursion (there's no reason to use static patterns match against
-      a statically determined path).  Requiering explicit recursion clears
+      a statically determined path).  Requiring explicit recursion clears
       up a common source of confusion.
     EOT