puppet 5.0.0 → 6.0.0

data/lib/puppet/ssl/key.rb

@@ -28,11 +28,7 @@ DOC
   def initialize(name)
     super
 
-    if ca?
-      @password_file = Puppet[:capass]
-    else
-      @password_file = Puppet[:passfile]
-    end
+    @password_file = Puppet[:passfile]
   end
 
   def password

data/lib/puppet/ssl/oids.rb

@@ -70,12 +70,18 @@ module Puppet::SSL::Oids
     ["1.3.6.1.4.1.34380.1.3.13", 'pp_auth_role', 'Puppet Node Role Name for Authorization'],
   ]
 
+  @did_register_puppet_oids = false
+
   # Register our custom Puppet OIDs with OpenSSL so they can be used as CSR
   # extensions. Without registering these OIDs, OpenSSL will fail when it
   # encounters such an extension in a CSR.
   def self.register_puppet_oids()
-    PUPPET_OIDS.each do |oid_defn|
-      OpenSSL::ASN1::ObjectId.register(*oid_defn)
+    if !@did_register_puppet_oids
+      PUPPET_OIDS.each do |oid_defn|
+        OpenSSL::ASN1::ObjectId.register(*oid_defn)
+      end
+
+      @did_register_puppet_oids = true
     end
   end
 
@@ -98,7 +104,7 @@ module Puppet::SSL::Oids
     if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
       mapping = nil
       begin
-        mapping = YAML.load_file(custom_oid_file)
+        mapping = Puppet::Util::Yaml.safe_load_file(custom_oid_file, [Symbol])
       rescue => err
         raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': %{err}") % { custom_oid_file: custom_oid_file, err: err }, err.backtrace
       end
@@ -181,7 +187,7 @@ module Puppet::SSL::Oids
     else
       second_oid.index(first_oid) == 0
     end
-  rescue OpenSSL::ASN1::ASN1Error
+  rescue OpenSSL::ASN1::ASN1Error, TypeError
     false
   end
 end

data/lib/puppet/ssl/validator/default_validator.rb

@@ -9,27 +9,20 @@ require 'puppet/ssl'
 class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   attr_reader :peer_certs
   attr_reader :verify_errors
-  attr_reader :ssl_configuration
 
   FIVE_MINUTES_AS_SECONDS = 5 * 60
 
   # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
   #
-  # @param ssl_configuration [Puppet::SSL::Configuration] (a default configuration) ssl_configuration the SSL configuration to use
-  # @param ssl_host [Puppet::SSL::Host] The SSL host to use
+  # @param ca_path [String] Filepath for the cacert
   #
   # @api private
   #
   def initialize(
-      ssl_configuration = Puppet::SSL::Configuration.new(
-                                        Puppet[:localcacert], {
-                                          :ca_auth_file  => Puppet[:ssl_client_ca_auth]
-                                        }),
-      ssl_host = Puppet.lookup(:ssl_host))
+    ca_path = Puppet[:ssl_client_ca_auth] || Puppet[:localcacert])
 
     reset!
-    @ssl_configuration = ssl_configuration
-    @ssl_host = ssl_host
+    @ca_path = ca_path
   end
 
 
@@ -70,7 +63,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   #
   def call(preverify_ok, store_context)
     current_cert = store_context.current_cert
-    @peer_certs << Puppet::SSL::Certificate.from_instance(current_cert)
+    @peer_certs << current_cert
 
     # We must make a copy since the scope of the store_context will be lost
     # across invocations of this method.
@@ -113,16 +106,17 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   #
   # @param [Net::HTTP] connection The connection to validate
   #
+  # @param [Puppet::SSL::Host] host The host object containing SSL data
   # @return [void]
   #
   # @api private
   #
-  def setup_connection(connection)
+  def setup_connection(connection, ssl_host = Puppet.lookup(:ssl_host))
     if ssl_certificates_are_present?
-      connection.cert_store = @ssl_host.ssl_store
-      connection.ca_file = @ssl_configuration.ca_auth_file
-      connection.cert = @ssl_host.certificate.content
-      connection.key = @ssl_host.key.content
+      connection.cert_store = ssl_host.ssl_store
+      connection.ca_file = @ca_path
+      connection.cert = ssl_host.certificate.content
+      connection.key = ssl_host.key.content
       connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
       connection.verify_callback = self
     else
@@ -130,13 +124,33 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
     end
   end
 
+  ##
+  # Decode a string of concatenated certificates
+  #
+  # @return [Array<OpenSSL::X509::Certificate>]
+  def decode_cert_bundle(bundle_str)
+    re = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
+    pem_ary = bundle_str.scan(re)
+    pem_ary.map do |pem_str|
+      OpenSSL::X509::Certificate.new(pem_str)
+    end
+  end
+
+  # read_file makes testing easier.
+  def read_file(path)
+    # https://www.ietf.org/rfc/rfc2459.txt defines the x509 V3 certificate format
+    # CA bundles are concatenated X509 certificates, but may also include
+    # comments, which could have UTF-8 characters
+    Puppet::FileSystem.read(path, :encoding => Encoding::UTF_8)
+  end
+
   # Validates the peer certificates against the authorized certificates.
   #
   # @api private
   #
   def valid_peer?
-    descending_cert_chain = @peer_certs.reverse.map {|c| c.content }
-    authz_ca_certs = ssl_configuration.ca_auth_certificates
+    descending_cert_chain = @peer_certs.reverse
+    authz_ca_certs = decode_cert_bundle(read_file(@ca_path))
 
     if not has_authz_peer_cert(descending_cert_chain, authz_ca_certs)
       msg = "The server presented a SSL certificate chain which does not include a " <<
@@ -168,6 +182,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # @api private
   #
   def ssl_certificates_are_present?
-    Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ssl_configuration.ca_auth_file)
+    Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ca_path)
   end
 end

data/lib/puppet/ssl.rb

@@ -4,7 +4,6 @@ require 'openssl'
 
 module Puppet::SSL # :nodoc:
   CA_NAME = "ca"
-  require 'puppet/ssl/configuration'
   require 'puppet/ssl/host'
   require 'puppet/ssl/oids'
   require 'puppet/ssl/validator'

data/lib/puppet/syntax_checkers/base64.rb

@@ -23,13 +23,12 @@ class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxCh
       # Do a strict decode64 on text with all whitespace stripped since the non strict version
       # simply skips all non base64 characters
       Base64.strict_decode64(cleaned_text)
-    rescue => e
-      if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
-        msg2 = _("padding is not correct")
-      else
-        msg2 = _("contains letters outside strict base 64 range (or whitespace)")
-      end
-      msg = _("Base64 syntax checker: Cannot parse invalid Base64 string - %{msg2}") % { msg2: msg2 }
+    rescue
+      msg = if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
+              _("Base64 syntax checker: Cannot parse invalid Base64 string - padding is not correct")
+            else
+              _("Base64 syntax checker: Cannot parse invalid Base64 string - contains letters outside strict base 64 range (or whitespace)")
+            end
 
       # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
       # and the issue code. (In this case especially, where there is only a single error message being issued).

data/lib/puppet/syntax_checkers/json.rb

@@ -20,7 +20,7 @@ class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChec
     #raise ArgumentError.new("Json syntax checker: location_info must be a Hash") unless location_info.is_a?(Hash)
 
     begin
-      JSON.parse(text)
+      Puppet::Util::Json.load(text)
     rescue => e
       # Cap the message to 100 chars and replace newlines
       msg = _("JSON syntax checker: Cannot parse invalid JSON string. \"%{message}\"") % { message: e.message().slice(0,100).gsub(/\r?\n/, "\\n") }

data/lib/puppet/test/test_helper.rb

@@ -143,6 +143,8 @@ module Puppet::Test
       Puppet::Application.clear!
       Puppet::Util::Profiler.clear
 
+      Puppet::SSL::Host.reset
+
       Puppet.clear_deprecation_warnings
     end
 
@@ -221,9 +223,6 @@ module Puppet::Test
       # Initialize "app defaults" settings to a good set of test values
       Puppet.settings.initialize_app_defaults(app_defaults_for_tests)
 
-      # Avoid opening ports to the outside world
-      Puppet.settings[:bindaddress] = "127.0.0.1"
-
       # We don't want to depend upon the reported domain name of the
       # machine running the tests, nor upon the DNS setup of that
       # domain.

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -86,7 +86,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
     # tags such as the type name to support implicit filtering as well as
     # explicit. Note that resource#tags returns a duplicate of the resource's
     # tags.
-    sentinel.tag(*resource.tags)
+    sentinel.merge_tags_from(resource)
     priority = @prioritizer.generate_priority_contained_in(resource, sentinel)
     @relationship_graph.add_vertex(sentinel, priority)
 
@@ -131,7 +131,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
 
   def add_resource(res, parent_resource, priority=nil)
     if @catalog.resource(res.ref).nil?
-      res.tag(*parent_resource.tags)
+      res.merge_tags_from(parent_resource)
       if parent_resource.depthfirst?
         @catalog.add_resource_before(parent_resource, res)
       else

data/lib/puppet/transaction/event.rb

@@ -1,18 +1,16 @@
 require 'puppet/transaction'
 require 'puppet/util/tagging'
 require 'puppet/util/logging'
-require 'puppet/util/methodhelper'
 require 'puppet/network/format_support'
 
 # A simple struct for storing what happens on the system.
 class Puppet::Transaction::Event
-  include Puppet::Util::MethodHelper
   include Puppet::Util::Tagging
   include Puppet::Util::Logging
   include Puppet::Network::FormatSupport
 
   ATTRIBUTES = [:name, :resource, :property, :previous_value, :desired_value, :historical_value, :status, :message, :file, :line, :source_description, :audited, :invalidate_refreshes, :redacted, :corrective_change]
-  attr_accessor *ATTRIBUTES
+  attr_accessor(*ATTRIBUTES)
   attr_accessor :time
   attr_reader :default_log_level
 
@@ -24,12 +22,41 @@ class Puppet::Transaction::Event
     obj
   end
 
-  def initialize(options = {})
-    @audited = false
-    @redacted = false
-    @corrective_change = false
+  def initialize(audited: false,
+                 corrective_change: false,
+                 desired_value: nil,
+                 file: nil,
+                 historical_value: nil,
+                 invalidate_refreshes: nil,
+                 line: nil,
+                 message: nil,
+                 name: nil,
+                 previous_value: nil,
+                 property: nil,
+                 redacted: false,
+                 resource: nil,
+                 source_description: nil,
+                 status: nil,
+                 tags: nil)
+
+    @audited = audited
+    @corrective_change = corrective_change
+    @desired_value = desired_value
+    @file = file
+    @historical_value = historical_value
+    @invalidate_refreshes = invalidate_refreshes
+    @line = line
+    @message = message
+    @name = name
+    @previous_value = previous_value
+    @redacted = redacted
+    @source_description = source_description
+    @tags = tags
+
+    self.property = property if property
+    self.resource = resource if resource
+    self.status = status if status
 
-    set_options(options)
     @time = Time.now
   end
 
@@ -71,13 +98,9 @@ class Puppet::Transaction::Event
       'redacted' => @redacted,
       'corrective_change' => @corrective_change,
     }
-    Puppet::Pops::Serialization::ToDataConverter.convert(hash, {
-      :rich_data => true,
-      :symbol_as_string => true,
-      :local_reference => false,
-      :type_by_reference => true,
-      :message_prefix => 'Event'
-    })
+    # Use the stringifying converter since rich data is not possible downstream.
+    # (This will destroy some data type information, but this is expected).
+    Puppet::Pops::Serialization::ToStringifiedConverter.convert(hash, :message_prefix => 'Event')
   end
 
   def property=(prop)

data/lib/puppet/transaction/event_manager.rb

@@ -151,9 +151,11 @@ class Puppet::Transaction::EventManager
     end
     return true
   rescue => detail
-    resource.err _("Failed to call %{callback}: %{detail}") % { callback: callback, detail: detail }
+    resource_error_message = _("Failed to call %{callback}: %{detail}") % { callback: callback, detail: detail }
+    resource.err resource_error_message
 
     transaction.resource_status(resource).failed_to_restart = true
+    transaction.resource_status(resource).fail_with_event(resource_error_message)
     resource.log_exception(detail)
     return false
   end

data/lib/puppet/transaction/persistence.rb

@@ -40,6 +40,14 @@ class Puppet::Transaction::Persistence
     @new_data["resources"][resource_name]["parameters"][param_name]["system_value"] = value
   end
 
+  def copy_skipped(resource_name)
+    @old_data["resources"] ||= {}
+    old_value = @old_data["resources"][resource_name]
+    if !old_value.nil?
+      @new_data["resources"][resource_name] = old_value
+    end
+  end
+
   # Load data from the persistence store on disk.
   def load
     filename = Puppet[:transactionstorefile]
@@ -52,9 +60,9 @@ class Puppet::Transaction::Persistence
     end
 
     result = nil
-    Puppet::Util.benchmark(:debug, _("Loaded transaction store file")) do
+    Puppet::Util.benchmark(:debug, _("Loaded transaction store file in %{seconds} seconds")) do
       begin
-        result = Puppet::Util::Yaml.load_file(filename, false, true)
+        result = Puppet::Util::Yaml.safe_load_file(filename, [Symbol])
       rescue Puppet::Util::Yaml::YamlLoadError => detail
         Puppet.log_exception(detail, _("Transaction store file %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail }, { :level => :warning })
 
@@ -81,4 +89,11 @@ class Puppet::Transaction::Persistence
   def save
     Puppet::Util::Yaml.dump(@new_data, Puppet[:transactionstorefile])
   end
+
+  # Use the catalog and run_mode to determine if persistence should be enabled or not
+  # @param [Puppet::Resource::Catalog] catalog catalog being processed
+  # @return [boolean] true if persistence is enabled
+  def enabled?(catalog)
+    catalog.host_config? && Puppet.run_mode.name == :agent
+  end
 end

data/lib/puppet/transaction/report.rb

@@ -130,6 +130,12 @@ class Puppet::Transaction::Report
   #
   attr_accessor :resources_failed_to_generate
 
+  # @return [Boolean] true if the transaction completed it's evaluate
+  #
+  attr_accessor :transaction_completed
+
+  TOTAL = "total".freeze
+
   def self.from_data_hash(data)
     obj = self.allocate
     obj.initialize_from_hash(data)
@@ -147,8 +153,12 @@ class Puppet::Transaction::Report
   end
 
   # @api private
-  def add_times(name, value)
-    @external_times[name] = value
+  def add_times(name, value, accumulate = true)
+    if @external_times[name] && accumulate
+      @external_times[name] += value
+    else
+      @external_times[name] = value
+    end
   end
 
   # @api private
@@ -171,6 +181,7 @@ class Puppet::Transaction::Report
   # @api private
   def compute_status(resource_metrics, change_metric)
     if resources_failed_to_generate ||
+       !transaction_completed ||
        (resource_metrics["failed"] || 0) > 0 ||
        (resource_metrics["failed_to_restart"] || 0) > 0
       'failed'
@@ -199,7 +210,7 @@ class Puppet::Transaction::Report
     resource_metrics = add_metric(:resources, calculate_resource_metrics)
     add_metric(:time, calculate_time_metrics)
     change_metric = calculate_change_metric
-    add_metric(:changes, {"total" => change_metric})
+    add_metric(:changes, {TOTAL => change_metric})
     add_metric(:events, calculate_event_metrics)
     @status = compute_status(resource_metrics, change_metric)
     @noop_pending = @resource_statuses.any? { |name,res| has_noop_events?(res) }
@@ -213,7 +224,7 @@ class Puppet::Transaction::Report
     @external_times ||= {}
     @host = Puppet[:node_name_value]
     @time = Time.now
-    @report_format = 7
+    @report_format = 10
     @puppet_version = Puppet.version
     @configuration_version = configuration_version
     @transaction_uuid = transaction_uuid
@@ -227,6 +238,7 @@ class Puppet::Transaction::Report
     @noop = Puppet[:noop]
     @noop_pending = false
     @corrective_change = false
+    @transaction_completed = false
   end
 
   # @api private
@@ -237,6 +249,7 @@ class Puppet::Transaction::Report
     @transaction_uuid = data['transaction_uuid']
     @environment = data['environment']
     @status = data['status']
+    @transaction_completed = data['transaction_completed']
     @noop = data['noop']
     @noop_pending = data['noop_pending']
     @host = data['host']
@@ -298,6 +311,7 @@ class Puppet::Transaction::Report
       'report_format' => @report_format,
       'puppet_version' => @puppet_version,
       'status' => @status,
+      'transaction_completed' => @transaction_completed,
       'noop' => @noop,
       'noop_pending' => @noop_pending,
       'environment' => @environment,
@@ -337,9 +351,9 @@ class Puppet::Transaction::Report
 
       report[key].keys.sort { |a,b|
         # sort by label
-        if a == :total
+        if a == TOTAL
           1
-        elsif b == :total
+        elsif b == TOTAL
           -1
         else
           report[key][a].to_s <=> report[key][b].to_s
@@ -367,7 +381,7 @@ class Puppet::Transaction::Report
       metric.values.each do |metric_name, label, value|
         report[key][metric_name.to_s] = value
       end
-      report[key]["total"] = 0 unless key == "time" or report[key].include?("total")
+      report[key][TOTAL] = 0 unless key == "time" or report[key].include?(TOTAL)
     end
     (report["time"] ||= {})["last_run"] = Time.now.tv_sec
     report
@@ -385,9 +399,15 @@ class Puppet::Transaction::Report
   #
   def exit_status
     status = 0
-    status |= 2 if @metrics["changes"]["total"] > 0
-    status |= 4 if @metrics["resources"]["failed"] > 0
-    status |= 4 if @metrics["resources"]["failed_to_restart"] > 0
+    if @metrics["changes"] && @metrics["changes"][TOTAL] &&
+        @metrics["resources"] && @metrics["resources"]["failed"] &&
+        @metrics["resources"]["failed_to_restart"]
+      status |= 2 if @metrics["changes"][TOTAL] > 0
+      status |= 4 if @metrics["resources"]["failed"] > 0
+      status |= 4 if @metrics["resources"]["failed_to_restart"] > 0
+    else
+      status = -1
+    end
     status
   end
 
@@ -408,7 +428,7 @@ class Puppet::Transaction::Report
     metrics = Hash.new(0)
     %w{total failure success}.each { |m| metrics[m] = 0 }
     resource_statuses.each do |name, status|
-      metrics["total"] += status.events.length
+      metrics[TOTAL] += status.events.length
       status.events.each do |event|
         metrics[event.status] += 1
       end
@@ -419,7 +439,7 @@ class Puppet::Transaction::Report
 
   def calculate_resource_metrics
     metrics = {}
-    metrics["total"] = resource_statuses.length
+    metrics[TOTAL] = resource_statuses.length
 
     # force every resource key in the report to be present
     # even if no resources is in this given state
@@ -439,16 +459,13 @@ class Puppet::Transaction::Report
   def calculate_time_metrics
     metrics = Hash.new(0)
     resource_statuses.each do |name, status|
-      type = Puppet::Resource.new(name).type
-      metrics[type.to_s.downcase] += status.evaluation_time if status.evaluation_time
+      metrics[status.resource_type.downcase] += status.evaluation_time if status.evaluation_time
     end
 
     @external_times.each do |name, value|
       metrics[name.to_s.downcase] = value
     end
 
-    metrics["total"] = metrics.values.inject(0) { |a,b| a+b }
-
     metrics
   end
 end

data/lib/puppet/transaction.rb

@@ -28,7 +28,7 @@ class Puppet::Transaction
   # Handles most of the actual interacting with resources
   attr_reader :resource_harness
 
-  attr_reader :prefetched_providers
+  attr_reader :prefetched_providers, :prefetch_failed_providers
 
   # @!attribute [r] persistence
   #   @return [Puppet::Transaction::Persistence] persistence object for cross
@@ -54,6 +54,8 @@ class Puppet::Transaction
     @resource_harness = Puppet::Transaction::ResourceHarness.new(self)
 
     @prefetched_providers = Hash.new { |h,k| h[k] = {} }
+
+    @prefetch_failed_providers = Hash.new { |h,k| h[k] = {} }
   end
 
   # Invoke the pre_run_check hook in every resource in the catalog.
@@ -93,7 +95,7 @@ class Puppet::Transaction
 
     perform_pre_run_checks
 
-    persistence.load if catalog.host_config?
+    persistence.load if persistence.enabled?(catalog)
 
     Puppet.info _("Applying configuration version '%{version}'") % { version: catalog.version } if catalog.version
 
@@ -145,7 +147,7 @@ class Puppet::Transaction
         end
       end
 
-      persistence.save if catalog.host_config?
+      persistence.save if persistence.enabled?(catalog)
     end
 
     # Graph cycles are returned as an array of arrays
@@ -175,9 +177,9 @@ class Puppet::Transaction
       if resource.is_a?(Puppet::Type::Component)
         Puppet.warning _("Somehow left a component in the relationship graph")
       else
-        resource.info _("Starting to evaluate the resource") if Puppet[:evaltrace] and @catalog.host_config?
+        resource.info _("Starting to evaluate the resource") if Puppet[:evaltrace] && @catalog.host_config?
         seconds = thinmark { block.call(resource) }
-        resource.info _("Evaluated in %0.2f seconds") % seconds if Puppet[:evaltrace] and @catalog.host_config?
+        resource.info _("Evaluated in %{seconds} seconds") % { seconds: "%0.2f" % seconds } if Puppet[:evaltrace] && @catalog.host_config?
       end
     end
 
@@ -187,6 +189,9 @@ class Puppet::Transaction
       report.resources_failed_to_generate = true
     end
 
+    # mark the end of transaction evaluate.
+    report.transaction_completed = true
+
     Puppet.debug "Finishing transaction #{object_id}"
   end
 
@@ -228,7 +233,11 @@ class Puppet::Transaction
 
   def prefetch_if_necessary(resource)
     provider_class = resource.provider.class
-    return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
+    if !provider_class.respond_to?(:prefetch) or
+        prefetched_providers[resource.type][provider_class.name] or
+        prefetch_failed_providers[resource.type][provider_class.name]
+      return
+    end
 
     resources = resources_by_provider(resource.type, provider_class.name)
 
@@ -262,6 +271,7 @@ class Puppet::Transaction
       resource_status(resource).skipped = true
       resource.debug("Resource is being skipped, unscheduling all events")
       event_manager.dequeue_all_events_for_resource(resource)
+      persistence.copy_skipped(resource.ref)
     else
       resource_status(resource).scheduled = true
       apply(resource, ancestor)
@@ -298,14 +308,20 @@ class Puppet::Transaction
   # up-front at failure time because the graph may be mutated as we
   # walk it.
   def propagate_failure(resource)
+
+    provider_class = resource.provider.class
+    s = resource_status(resource)
+    if prefetch_failed_providers[resource.type][provider_class.name] && !s.nil?
+      message = _("Prefetch failed for %{type_name} provider '%{name}'") % { type_name: resource.type, name: provider_class.name }
+      s.fail_with_event(message)
+    end
+
     failed = Set.new
     relationship_graph.direct_dependencies_of(resource).each do |dep|
-      if (s = resource_status(dep))
-        failed.merge(s.failed_dependencies) if s.dependency_failed?
-        if s.failed? || s.failed_to_restart?
-          failed.add(dep)
-        end
-      end
+      s = resource_status(dep)
+      next if s.nil?
+      failed.merge(s.failed_dependencies) if s.dependency_failed?
+      failed.add(dep) if s.failed? || s.failed_to_restart?
     end
     resource_status(resource).failed_dependencies = failed.to_a
   end
@@ -334,13 +350,20 @@ class Puppet::Transaction
   # types, just providers.
   def prefetch(provider_class, resources)
     type_name = provider_class.resource_type.name
-    return if @prefetched_providers[type_name][provider_class.name]
+    return if @prefetched_providers[type_name][provider_class.name] ||
+      @prefetch_failed_providers[type_name][provider_class.name]
     Puppet.debug "Prefetching #{provider_class.name} resources for #{type_name}"
     begin
       provider_class.prefetch(resources)
-    rescue LoadError, Puppet::MissingCommand => detail
+    rescue Exception => detail
+      if !detail.is_a?(LoadError) && !detail.is_a?(Puppet::MissingCommand)
+        raise unless Puppet.settings[:future_features]
+        
+        @prefetch_failed_providers[type_name][provider_class.name] = true
+      end
       #TRANSLATORS `prefetch` is a function name and should not be translated
-      Puppet.log_exception(detail, _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail })
+      message = _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail }
+      Puppet.log_exception(detail, message)
     end
     @prefetched_providers[type_name][provider_class.name] = true
   end
@@ -351,7 +374,7 @@ class Puppet::Transaction
 
   # Is the resource currently scheduled?
   def scheduled?(resource)
-    self.ignoreschedules or resource_harness.scheduled?(resource)
+    self.ignoreschedules || resource_harness.scheduled?(resource)
   end
 
   # Should this resource be skipped?
@@ -370,6 +393,10 @@ class Puppet::Transaction
       unless resource.class == Puppet::Type.type(:whit) then
         resource.warning _("Skipping because of failed dependencies")
       end
+    elsif resource_status(resource).failed? &&
+        @prefetch_failed_providers[resource.type][resource.provider.class.name]
+      #Do not try to evaluate a resource with a known failed provider
+      resource.warning _("Skipping because provider prefetch failed")
     elsif resource.virtual?
       resource.debug "Skipping because virtual"
     elsif !host_and_device_resource?(resource) && resource.appliable_to_host? && for_network_device