puppet 4.7.1-universal-darwin → 4.8.0-universal-darwin

data/lib/puppet/resource/catalog.rb

@@ -358,13 +358,18 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
     result = @resource_table[title_key]
     if result.nil?
       # an instance has to be created in order to construct the unique key used when
-      # searching for aliases.
-      unless @aliases.empty? && !Puppet[:app_management]
+      # searching for aliases, or when app_management is active and nothing is found in
+      # which case it is needed by the CapabilityFinder.
+      res = nil
+      app_mgnt = Puppet[:app_management]
+      if app_mgnt || !@aliases.empty?
         res = Puppet::Resource.new(type, title, { :environment => @environment_instance })
-        result = @resource_table[[type_name, res.uniqueness_key].flatten]
+
+        # No need to build the uniqueness key unless there are aliases
+        result = @resource_table[[type_name, res.uniqueness_key].flatten] unless @aliases.empty?
       end
 
-      if result.nil? && Puppet[:app_management]
+      if result.nil? && app_mgnt
         resource_type = res.resource_type
         if resource_type && resource_type.is_capability?
           # @todo lutter 2015-03-10: this assumes that it is legal to just
@@ -419,8 +424,13 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
     end
 
     if resources = data['resources']
+      # TODO: The deserializer needs a loader in order to deserialize types defined using the puppet language.
+      json_deserializer = nil
+      if Puppet[:rich_data] || result.environment_instance && result.environment_instance.rich_data?
+        json_deserializer = Puppet::Pops::Serialization::Deserializer.new(Puppet::Pops::Serialization::JSON::Reader.new([]), nil)
+      end
       result.add_resource(*resources.collect do |res|
-        Puppet::Resource.from_data_hash(res)
+        Puppet::Resource.from_data_hash(res, json_deserializer)
       end)
     end
 
@@ -472,6 +482,15 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
       h
     end
 
+    resources = if @resources.empty?
+        []
+      elsif environment_instance.rich_data?
+        json_serializer = Puppet::Pops::Serialization::Serializer.new(Puppet::Pops::Serialization::JSON::Writer.new(''))
+        @resources.collect { |v| @resource_table[v].to_data_hash(json_serializer) }
+      else
+        @resources.collect { |v| @resource_table[v].to_data_hash }
+      end
+
     {
       'tags'      => tags,
       'name'      => name,
@@ -480,7 +499,7 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
       'catalog_uuid' => catalog_uuid,
       'catalog_format' => catalog_format,
       'environment'  => environment.to_s,
-      'resources' => @resources.collect { |v| @resource_table[v].to_data_hash },
+      'resources' => resources,
       'edges'     => edges.   collect { |e| e.to_data_hash },
       'classes'   => classes,
     }.merge(metadata_hash.empty? ? {} : {'metadata' => metadata_hash})

data/lib/puppet/resource/type.rb

@@ -130,7 +130,9 @@ class Puppet::Resource::Type
       if blueprint.nil?
         raise Puppet::ParseError, "Resource type #{resource.type} does not produce #{ex.type}"
       end
-      produced_resource = Puppet::Parser::Resource.new(ex.type, ex.title, :scope => scope, :source => self)
+      t = ex.type
+      t = Puppet::Pops::Evaluator::Runtime3ResourceSupport.find_resource_type(scope, t) unless t == 'class' || t == 'node'
+      produced_resource = Puppet::Parser::Resource.new(t, ex.title, :scope => scope, :source => self)
 
       produced_resource.resource_type.parameters.each do |name|
         next if name == :name

data/lib/puppet/settings.rb

@@ -1430,7 +1430,7 @@ Generated on #{Time.now}.
     end
 
     def conf
-      @conf ||= if environments = Puppet.lookup(:environments)
+      @conf ||= if environments = Puppet.lookup(:environments) { nil }
                   environments.get_conf(@environment_name)
                 end
     end

data/lib/puppet/settings/environment_conf.rb

@@ -3,7 +3,7 @@
 class Puppet::Settings::EnvironmentConf
 
   ENVIRONMENT_CONF_ONLY_SETTINGS = [:modulepath, :manifest, :config_version].freeze
-  VALID_SETTINGS = (ENVIRONMENT_CONF_ONLY_SETTINGS + [:environment_timeout, :environment_data_provider, :static_catalogs]).freeze
+  VALID_SETTINGS = (ENVIRONMENT_CONF_ONLY_SETTINGS + [:environment_timeout, :environment_data_provider, :static_catalogs, :rich_data]).freeze
 
   # Given a path to a directory environment, attempts to load and parse an
   # environment.conf in ini format, and return an EnvironmentConf instance.
@@ -39,8 +39,8 @@ class Puppet::Settings::EnvironmentConf
   # Configuration values are exactly those returned by the environment object,
   # without interpolation.  This is a special case for the default configured
   # environment returned by the Puppet::Environments::StaticPrivate loader.
-  def self.static_for(environment, environment_timeout = 0, static_catalogs = false)
-    Static.new(environment, environment_timeout, static_catalogs)
+  def self.static_for(environment, environment_timeout = 0, static_catalogs = false, rich_data = false)
+    Static.new(environment, environment_timeout, static_catalogs, 'none', rich_data)
   end
 
   attr_reader :section, :path_to_env, :global_modulepath
@@ -108,6 +108,12 @@ class Puppet::Settings::EnvironmentConf
     end
   end
 
+  def rich_data
+    get_setting(:rich_data, Puppet.settings.value(:rich_data)) do |value|
+      value
+    end
+  end
+
   def static_catalogs
     get_setting(:static_catalogs, Puppet.settings.value(:static_catalogs)) do |value|
       value
@@ -167,13 +173,15 @@ class Puppet::Settings::EnvironmentConf
   class Static
     attr_reader :environment_timeout
     attr_reader :environment_data_provider
+    attr_reader :rich_data
     attr_reader :static_catalogs
 
-    def initialize(environment, environment_timeout, static_catalogs, environment_data_provider = 'none')
+    def initialize(environment, environment_timeout, static_catalogs, environment_data_provider = 'none', rich_data = false)
       @environment = environment
       @environment_timeout = environment_timeout
       @static_catalogs = static_catalogs
       @environment_data_provider = environment_data_provider
+      @rich_data = rich_data
     end
 
     def manifest

data/lib/puppet/syntax_checkers/base64.rb

@@ -0,0 +1,41 @@
+# A syntax checker for Base64.
+# @api public
+require 'puppet/syntax_checkers'
+require 'base64'
+class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for BASE64 syntax issues and reports them to the given acceptor.
+  # This checker allows the most relaxed form of Base64, including newlines and missing padding.
+  # It also accept URLsafe input.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (e.g. 'base64', 'text/xxx+base64')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new("Base64 syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError.new("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError.new("Base64 syntax checker: invalid Acceptor, got: '#{acceptor.class.name}'.") unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    cleaned_text = text.gsub(/[\r?\n[:blank:]]/, '')
+    begin
+      # Do a strict decode64 on text with all whitespace stripped since the non strict version
+      # simply skips all non base64 characters
+      Base64.strict_decode64(cleaned_text)
+    rescue => e
+      if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
+        msg2 = "padding is not correct"
+      else
+        msg2 = "contains letters outside strict base 64 range (or whitespace)"
+      end
+      msg = "Base64 syntax checker: Cannot parse invalid Base64 string - #{msg2}"
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_BASE64) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.locator.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/json.rb

@@ -4,8 +4,6 @@ require 'puppet/syntax_checkers'
 class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
 
   # Checks the text for JSON syntax issues and reports them to the given acceptor.
-  # This implementation is abstract, it raises {NotImplementedError} since a subclass should have implemented the
-  # method.
   #
   # Error messages from the checker are capped at 100 chars from the source text.
   #

data/lib/puppet/transaction.rb

@@ -165,6 +165,12 @@ class Puppet::Transaction
       end
     end
 
+    # if one or more resources has attempted and failed to generate resources,
+    # report it
+    if generator.resources_failed_to_generate
+      report.resources_failed_to_generate = true
+    end
+
     Puppet.debug "Finishing transaction #{object_id}"
   end
 

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -6,11 +6,14 @@
 # @api private
 class Puppet::Transaction::AdditionalResourceGenerator
   attr_writer :relationship_graph
+  # [boolean] true if any resource has attempted and failed to generate resources
+  attr_reader :resources_failed_to_generate
 
   def initialize(catalog, relationship_graph, prioritizer)
     @catalog = catalog
     @relationship_graph = relationship_graph
     @prioritizer = prioritizer
+    @resources_failed_to_generate = false
   end
 
   def generate_additional_resources(resource)
@@ -18,6 +21,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
     begin
       generated = resource.generate
     rescue => detail
+      @resources_failed_to_generate = true
       resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
     end
     return unless generated
@@ -52,6 +56,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
       generated = replace_duplicates_with_catalog_resources(resource.eval_generate)
       return false if generated.empty?
     rescue => detail
+      @resources_failed_to_generate = true
       resource.log_exception(detail, "Failed to generate additional resources using 'eval_generate': #{detail}")
       return false
     end

data/lib/puppet/transaction/report.rb

@@ -127,6 +127,11 @@ class Puppet::Transaction::Report
   #      corrective changes.
   attr_reader :corrective_change
 
+  # @return [Boolean] true if one or more resources attempted to generate
+  #   resources and failed
+  #
+  attr_accessor :resources_failed_to_generate
+
   def self.from_data_hash(data)
     obj = self.allocate
     obj.initialize_from_hash(data)
@@ -167,7 +172,7 @@ class Puppet::Transaction::Report
 
   # @api private
   def compute_status(resource_metrics, change_metric)
-    if (resource_metrics["failed"] || 0) > 0
+    if resources_failed_to_generate || (resource_metrics["failed"] || 0) > 0
       'failed'
     elsif change_metric > 0
       'changed'
@@ -381,7 +386,7 @@ class Puppet::Transaction::Report
   # @api private
   #
   def to_yaml_properties
-    super - [:@external_times]
+    super - [:@external_times, :@resources_failed_to_generate]
   end
 
   def self.supported_formats

data/lib/puppet/type.rb

@@ -113,7 +113,8 @@ class Type
     attr_accessor :is_capability
 
     def is_capability?
-      is_capability
+      c = is_capability
+      c.nil? ? false : c
     end
   end
 

data/lib/puppet/type/file/checksum.rb

@@ -16,6 +16,7 @@ Puppet::Type.type(:file).newparam(:checksum) do
   end
 
   def sum(content)
+    content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
     type = digest_algorithm()
     "{#{type}}" + send(type, content)
   end

data/lib/puppet/type/file/content.rb

@@ -45,13 +45,13 @@ module Puppet
     munge do |value|
       if value == :absent
         value
-      elsif checksum?(value)
+      elsif value.is_a?(String) && checksum?(value)
         # XXX This is potentially dangerous because it means users can't write a file whose
-        # entire contents are a plain checksum
+        # entire contents are a plain checksum unless it is a Binary content.
         value
       else
-        @actual_content = value
-        resource.parameter(:checksum).sum(value)
+        @actual_content = value.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? value.binary_buffer : value
+        resource.parameter(:checksum).sum(@actual_content)
       end
     end
 

data/lib/puppet/type/mount.rb

@@ -176,6 +176,50 @@ module Puppet
         appear in fstab. For many platforms this is a comma delimited string.
         Consult the fstab(5) man page for system-specific details."
 
+          def insync?(is)
+
+            if @resource[:ensure] == :mounted && !provider.property_hash[:live_options].nil?
+
+              # The mount options according to /etc/fstab. It is possible for puppet to
+              # update this file to reflect new options even if the remount to update
+              # the options has actually failed
+              fstab_options = provider.property_hash[:options] || ''
+              # The mount options according to the output of the 'mount' command. These will
+              # always reflect the options of the actual mounted device
+              mount_options = provider.property_hash[:live_options] || ''
+              # The desired mount options that have been specified in the puppet manifest
+              resource_options = @resource[:options] || ''
+
+              mount_list = mount_options.split(',')
+              resource_list = resource_options.split(',')
+              # Remove the string 'defaults' from the list of resources, because when
+              # we are comparing against the mount command output 'defaults' will be
+              # expanded into the full list of default options for the OS and file system
+              resource_list.delete('defaults')
+
+              # Do the options in fstab match the options that the user has defined?
+              if fstab_options != resource_options
+                return false
+              end
+
+              # Do the options provided by the 'mount' command match the options that
+              # the user has defined? We have to check this too because fstab could provide
+              # a false positive if a remount has failed
+              #
+              # We want to see if the mount command options contain the list of user
+              # specified options from the manifest. The reason we cannot do a 1:1
+              # comparison is because the expanded list of default options may be included
+              # in the mount output. These vary between OS and file system so since we don't
+              # have a good way to find out what they are, just check for the specific options
+              # the user has specified
+              if !(resource_list - mount_list).empty?
+                return false
+              end
+            end
+
+            super
+          end
+
       validate do |value|
         raise Puppet::Error, "options must not contain whitespace: #{value}" if value =~ /\s/
         raise Puppet::Error, "options must not be an empty string" if value.empty?

data/lib/puppet/type/ssh_authorized_key.rb

@@ -151,7 +151,7 @@ module Puppet
     end
 
     # regular expression suitable for use by a ParsedFile based provider
-    REGEX = /^(?:(.+) )?(ssh-dss|ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521) ([^ ]+) ?(.*)$/
+    REGEX = /^(?:(.+)\s+)?(ssh-dss|ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521)\s+([^ ]+)\s*(.*)$/
     def self.keyline_regex
       REGEX
     end

data/lib/puppet/type/tidy.rb

@@ -16,6 +16,9 @@ Puppet::Type.newtype(:tidy) do
     actual deletion.
     "
 
+  # Tidy names are not isomorphic with the objects.
+  @isomorphic = false
+
   newparam(:path) do
     desc "The path to the file or directory to manage.  Must be fully
       qualified."

data/lib/puppet/type/user.rb

@@ -16,9 +16,10 @@ module Puppet
       about them.  It does not directly modify `/etc/passwd` or anything.
 
       **Autorequires:** If Puppet is managing the user's primary group (as
-      provided in the `gid` attribute), the user resource will autorequire
-      that group. If Puppet is managing any role accounts corresponding to the
-      user's roles, the user resource will autorequire those role accounts."
+      provided in the `gid` attribute) or any group listed in the `groups`
+      attribute then the user resource will autorequire that group. If Puppet
+      is managing any role accounts corresponding to the user's roles, the
+      user resource will autorequire those role accounts."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
@@ -323,9 +324,14 @@ module Puppet
     end
 
     newparam(:membership) do
-      desc "Whether specified groups should be considered the **complete list**
-        (`inclusive`) or the **minimum list** (`minimum`) of groups to which
-        the user belongs. Defaults to `minimum`."
+      desc "If `minimum` is specified, Puppet will ensure that the user is a
+        member of all specified groups, but will not remove any other groups
+        that the user is a part of.
+
+        If `inclusive` is specified, Puppet will ensure that the user is a
+        member of **only** specified groups.
+
+        Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 

data/lib/puppet/util/log.rb

@@ -245,6 +245,31 @@ class Puppet::Util::Log
     obj
   end
 
+  # Log output using scope and level
+  #
+  # @param [Puppet::Parser::Scope] scope
+  # @param [Symbol] level log level
+  # @param [Array<Object>] vals the values to log (will be converted to string and joined with space)
+  #
+  def self.log_func(scope, level, vals)
+    # NOTE: 3x, does this: vals.join(" ")
+    # New implementation uses the evaluator to get proper formatting per type
+    vals = vals.map { |v| Puppet::Pops::Evaluator::EvaluatorImpl.new.string(v, scope) }
+
+    # Bypass Puppet.<level> call since it picks up source from "self" which is not applicable in the 4x
+    # Function API.
+    # TODO: When a function can obtain the file, line, pos of the call merge those in (3x supports
+    #       options :file, :line. (These were never output when calling the 3x logging functions since
+    #       3x scope does not know about the calling location at that detailed level, nor do they
+    #       appear in a report to stdout/error when included). Now, the output simply uses scope (like 3x)
+    #       as this is good enough, but does not reflect the true call-stack, but is a rough estimate
+    #       of where the logging call originates from).
+    #
+    Puppet::Util::Log.create({:level => level, :source => scope, :message => vals.join(" ")})
+    nil
+  end
+
+
   attr_accessor :time, :remote, :file, :line, :pos, :source, :issue_code, :environment, :node, :backtrace
   attr_reader :level, :message
 

data/lib/puppet/util/plist.rb

@@ -54,9 +54,14 @@ module Puppet::Util::Plist
     # Read plist text using the CFPropertyList gem.
     def parse_plist(plist_data, file_path = '')
       bad_xml_doctype = /^.*<!DOCTYPE plist PUBLIC -\/\/Apple Computer.*$/
-      if plist_data =~ bad_xml_doctype
-        plist_data.gsub!( bad_xml_doctype, plist_xml_doctype )
-        Puppet.debug("Had to fix plist with incorrect DOCTYPE declaration: #{file_path}")
+      begin
+        if plist_data =~ bad_xml_doctype
+          plist_data.gsub!( bad_xml_doctype, plist_xml_doctype )
+          Puppet.debug("Had to fix plist with incorrect DOCTYPE declaration: #{file_path}")
+        end
+      rescue ArgumentError => e
+        Puppet.debug "Failed with #{e.class} on #{file_path}: #{e.inspect}"
+        return nil
       end
 
       begin