puppet 5.3.4 → 6.29.0

data/lib/puppet/util/pidlock.rb

@@ -43,8 +43,23 @@ class Puppet::Util::Pidlock
     @lockfile.file_path
   end
 
+  private
+
+  def ps_argument_for_current_kernel
+    case Puppet.runtime[:facter].value(:kernel)
+      when "Linux"
+        "-eq"
+      when "AIX"
+        "-T"
+      else
+        "-p"
+    end
+  end
+
   def clear_if_stale
-    return @lockfile.unlock if lock_pid.nil?
+    pid = lock_pid
+    return @lockfile.unlock if pid == nil
+    return if Process.pid == pid
 
     errors = [Errno::ESRCH]
     # Win32::Process now throws SystemCallError. Since this could be
@@ -52,11 +67,36 @@ class Puppet::Util::Pidlock
     errors << SystemCallError if Puppet::Util::Platform.windows?
 
     begin
-      Process.kill(0, lock_pid)
+      Process.kill(0, pid)
     rescue *errors
-      @lockfile.unlock
+      return @lockfile.unlock
     end
-  end
-  private :clear_if_stale
 
+    # Ensure the process associated with this pid is our process. If
+    # not, we can unlock the lockfile. CLI arguments used for identifying
+    # on POSIX depend on the os and sometimes even version.
+    if Puppet.features.posix?
+      ps_argument = ps_argument_for_current_kernel
+
+      # Check, obtain and use the right ps argument
+      begin
+        procname = Puppet::Util::Execution.execute(["ps", ps_argument, pid, "-o", "comm="]).strip
+      rescue Puppet::ExecutionFailure
+        ps_argument = "-p"
+        procname = Puppet::Util::Execution.execute(["ps", ps_argument, pid, "-o", "comm="]).strip
+      end
+
+      args = Puppet::Util::Execution.execute(["ps", ps_argument, pid, "-o", "args="]).strip
+      @lockfile.unlock unless procname =~ /ruby/ && args =~ /puppet/ || procname =~ /puppet(-.*)?$/
+    elsif Puppet.features.microsoft_windows?
+      # On Windows, we're checking if the filesystem path name of the running
+      # process is our vendored ruby:
+      begin
+        exe_path = Puppet::Util::Windows::Process::get_process_image_name_by_pid(pid)
+        @lockfile.unlock unless exe_path =~ /\\bin\\ruby.exe$/
+      rescue Puppet::Util::Windows::Error => e
+        Puppet.debug("Failed to read pidfile #{file_path}: #{e.message}")
+      end
+    end
+  end
 end

data/lib/puppet/util/platform.rb

@@ -1,6 +1,9 @@
 module Puppet
   module Util
     module Platform
+      FIPS_STATUS_FILE = "/proc/sys/crypto/fips_enabled".freeze
+      WINDOWS_FIPS_REGISTRY_KEY = 'System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'.freeze
+
       def windows?
         # Ruby only sets File::ALT_SEPARATOR on Windows and the Ruby standard
         # library uses that to test what platform it's on. In some places we
@@ -11,12 +14,57 @@ module Puppet
       end
       module_function :windows?
 
+      def solaris?
+        RUBY_PLATFORM.include?('solaris')
+      end
+      module_function :solaris?
+
       def default_paths
         return [] if windows?
 
         %w{/usr/sbin /sbin}
       end
       module_function :default_paths
+
+      @fips_enabled = if windows?
+                        require 'win32/registry'
+
+                        begin
+                          Win32::Registry::HKEY_LOCAL_MACHINE.open(WINDOWS_FIPS_REGISTRY_KEY) do |reg|
+                            reg.values.first == 1
+                          end
+                        rescue Win32::Registry::Error
+                          false
+                        end
+                      else
+                        File.exist?(FIPS_STATUS_FILE) &&
+                          File.read(FIPS_STATUS_FILE, 1) == '1'
+                      end
+
+      def fips_enabled?
+        @fips_enabled
+      end
+      module_function :fips_enabled?
+
+      def self.jruby?
+        RUBY_PLATFORM == 'java'
+      end
+
+      def jruby_fips?
+        @@jruby_fips ||= if RUBY_PLATFORM == 'java'
+                           require 'java'
+
+                           begin
+                             require 'openssl'
+                             false
+                           rescue LoadError, NameError
+                             true
+                           end
+                         else
+                           false
+                         end
+      end
+      module_function :jruby_fips?
     end
   end
 end

data/lib/puppet/util/plist.rb

@@ -41,7 +41,7 @@ module Puppet::Util::Plist
 
         Puppet.debug "Plist #{file_path} ill-formatted, converting with plutil"
         begin
-          plist = Puppet::Util::Execution.execute(['/usr/bin/plutil', '-convert', 'xml1', '-o', '/dev/stdout', file_path],
+          plist = Puppet::Util::Execution.execute(['/usr/bin/plutil', '-convert', 'xml1', '-o', '-', file_path],
                                                   {:failonfail => true, :combine => true})
           return parse_plist(plist)
         rescue Puppet::ExecutionFailure => detail
@@ -56,6 +56,12 @@ module Puppet::Util::Plist
     # Read plist text using the CFPropertyList gem.
     def parse_plist(plist_data, file_path = '')
       bad_xml_doctype = /^.*<!DOCTYPE plist PUBLIC -\/\/Apple Computer.*$/
+      # Depending on where parse_plist is called from, plist_data can be either XML or binary.
+      # If we get XML, make sure ruby knows it's UTF-8 so we avoid invalid byte sequence errors.
+      if plist_data.include?('encoding="UTF-8"') && plist_data.encoding != Encoding::UTF_8
+        plist_data.force_encoding(Encoding::UTF_8)
+      end
+
       begin
         if plist_data =~ bad_xml_doctype
           plist_data.gsub!( bad_xml_doctype, plist_xml_doctype )
@@ -124,11 +130,11 @@ module Puppet::Util::Plist
 
     def to_format(format)
       if format.to_sym == :xml
-        plist_format = CFPropertyList::List::FORMAT_XML
+        CFPropertyList::List::FORMAT_XML
       elsif format.to_sym == :binary
-        plist_format = CFPropertyList::List::FORMAT_BINARY
+        CFPropertyList::List::FORMAT_BINARY
       elsif format.to_sym == :plain
-        plist_format = CFPropertyList::List::FORMAT_PLAIN
+        CFPropertyList::List::FORMAT_PLAIN
       else
         raise FormatError.new "Unknown plist format #{format}"
       end

data/lib/puppet/util/posix.rb

@@ -9,7 +9,62 @@ module Puppet::Util::POSIX
   # environment for "exec" runs
   USER_ENV_VARS = ['HOME', 'USER', 'LOGNAME']
 
+  class << self
+    # Returns an array of all the groups that the user's a member of.
+    def groups_of(user)
+      begin
+        require 'puppet/ffi/posix'
+        groups = get_groups_list(user)
+      rescue StandardError, LoadError => e
+        Puppet.debug("Falling back to Puppet::Etc.group: #{e.message}")
+
+        groups = []
+        Puppet::Etc.group do |group|
+          groups << group.name if group.mem.include?(user)
+        end
+      end
+
+      uniq_groups = groups.uniq
+      if uniq_groups != groups
+        Puppet.debug(_('Removing any duplicate group entries'))
+      end
+
+      uniq_groups
+    end
 
+    private
+    def get_groups_list(user)
+      raise LoadError, "The 'getgrouplist' method is not available" unless Puppet::FFI::POSIX::Functions.respond_to?(:getgrouplist)
+
+      user_gid = Puppet::Etc.getpwnam(user).gid
+      ngroups = Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS
+
+      while true do # rubocop:disable Lint/LiteralInCondition
+        FFI::MemoryPointer.new(:int) do |ngroups_ptr|
+          FFI::MemoryPointer.new(:uint, ngroups) do |groups_ptr|
+            old_ngroups = ngroups
+            ngroups_ptr.write_int(ngroups)
+
+            if Puppet::FFI::POSIX::Functions::getgrouplist(user, user_gid, groups_ptr, ngroups_ptr) != -1
+              groups_gids = groups_ptr.get_array_of_uint(0, ngroups_ptr.read_int)
+
+              result = []
+              groups_gids.each do |group_gid|
+                group_info = Puppet::Etc.getgrgid(group_gid)
+                result |= [group_info.name] if group_info.mem.include?(user)
+              end
+              return result
+            end
+
+            ngroups = ngroups_ptr.read_int
+            if ngroups <= old_ngroups
+              ngroups *= 2
+            end
+          end
+        end
+      end
+    end
+  end
 
   # Retrieve a field from a POSIX Etc object.  The id can be either an integer
   # or a name.  This only works for users and groups.  It's also broken on
@@ -119,16 +174,27 @@ module Puppet::Util::POSIX
       # pass
     end
     if field.is_a?(Integer)
-      return nil unless name = get_posix_field(location, :name, field)
+      name = get_posix_field(location, :name, field)
+      return nil unless name
       id = get_posix_field(location, id_field, name)
       check_value = id
     else
-      return nil unless id = get_posix_field(location, id_field, field)
+      id = get_posix_field(location, id_field, field)
+      return nil unless id
       name = get_posix_field(location, :name, id)
       check_value = name
     end
+
     if check_value != field
-      return search_posix_field(location, id_field, field)
+      check_value_id = get_posix_field(location, id_field, check_value) if check_value
+
+      if id == check_value_id
+        Puppet.debug("Multiple entries found for resource: '#{location}' with #{id_field}: #{id}")
+        return id
+      else
+        Puppet.debug("The value retrieved: '#{check_value}' is different than the required state: '#{field}', searching in all entries")
+        return search_posix_field(location, id_field, field)
+      end
     else
       return id
     end

data/lib/puppet/util/provider_features.rb

@@ -1,5 +1,4 @@
 # Provides feature definitions.
-require 'puppet/util/methodhelper'
 require 'puppet/util/docs'
 require 'puppet/util'
 # This module models provider features and handles checking whether the features
@@ -13,7 +12,6 @@ module Puppet::Util::ProviderFeatures
   # @todo Unclear what is api and what is private in this class
   class ProviderFeature
     include Puppet::Util
-    include Puppet::Util::MethodHelper
     include Puppet::Util::Docs
     attr_accessor :name, :docs, :methods
 
@@ -32,11 +30,10 @@ module Puppet::Util::ProviderFeatures
       end
     end
 
-    def initialize(name, docs, hash)
+    def initialize(name, docs, methods: nil)
       self.name = name.intern
       self.docs = docs
-      hash = symbolize_options(hash)
-      set_options(hash)
+      @methods = methods
     end
 
     private
@@ -65,7 +62,7 @@ module Puppet::Util::ProviderFeatures
     @features ||= {}
     raise Puppet::DevError, _("Feature %{name} is already defined") % { name: name } if @features.include?(name)
     begin
-      obj = ProviderFeature.new(name, docs, hash)
+      obj = ProviderFeature.new(name, docs, **hash)
       @features[obj.name] = obj
     rescue ArgumentError => detail
       error = ArgumentError.new(
@@ -81,7 +78,7 @@ module Puppet::Util::ProviderFeatures
     str = ""
     @features ||= {}
     return nil if @features.empty?
-    names = @features.keys.sort { |a,b| a.to_s <=> b.to_s }
+    names = @features.keys.sort_by(&:to_s)
     names.each do |name|
       doc = @features[name].docs.gsub(/\n\s+/, " ")
       str << "- *#{name}*: #{doc}\n"
@@ -130,9 +127,7 @@ module Puppet::Util::ProviderFeatures
       # Create a method that will list all functional features.
       @feature_module.send(:define_method, :features) do
         return false unless defined?(features)
-        features.keys.find_all { |n| feature?(n) }.sort { |a,b|
-          a.to_s <=> b.to_s
-        }
+        features.keys.find_all { |n| feature?(n) }.sort_by(&:to_s)
       end
 
       # Create a method that will determine if a provided list of

data/lib/puppet/util/rdoc/code_objects.rb

@@ -64,7 +64,8 @@ module RDoc
     # Adds a module called __nodes__ and adds nodes to it as classes
     #
     def add_node(name,superclass)
-      if cls = @nodes[name]
+      cls = @nodes[name]
+      if cls
         return cls
       end
       @node_container ||= add_module(NormalModule, "__nodes__")

data/lib/puppet/util/rdoc/generators/puppet_generator.rb

@@ -160,10 +160,12 @@ module Generators
         @allfiles << { "file" => file, "modules" => modules, "classes" => classes, "methods" => methods, "nodes" => nodes }
       end
 
-      # scan all classes to create the childs references
+      # scan all classes to create the child's references
       @allclasses.values.each do |klass|
-        if superklass = klass.context.superclass
-          if superklass = AllReferences[superklass] and (superklass.is_a?(HTMLPuppetClass) or superklass.is_a?(HTMLPuppetNode))
+        superklass = klass.context.superclass
+        if superklass
+          superklass = AllReferences[superklass]
+          if superklass && (superklass.is_a?(HTMLPuppetClass) || superklass.is_a?(HTMLPuppetNode))
             superklass.context.add_child(klass.context)
           end
         end
@@ -896,7 +898,7 @@ module Generators
 
     def find_symbol(symbol, method=nil)
       res = @context.parent.find_symbol(symbol, method)
-      res &&= res.viewer
+      res && res.viewer
     end
 
   end

data/lib/puppet/util/rdoc/parser/puppet_parser_core.rb

@@ -127,7 +127,7 @@ module RDoc::PuppetParserCore
     container, name  = get_class_or_module(container,name)
     mod = container.add_module(RDoc::PuppetModule, name)
     mod.record_location(@top_level)
-    mod.add_comment(comment, @input_file_name)
+    mod.add_comment(comment, @top_level)
 
     if @input_file_name =~ /\.rb$/
       parse_plugins(mod)
@@ -154,7 +154,7 @@ module RDoc::PuppetParserCore
         # fetch comments
         if line =~ /^[ \t]*# ?(.*)$/
           comments += $1 + "\n"
-        elsif line =~ /^[ \t]*Facter.add\(['"](.*?)['"]\)/
+        elsif line =~ /^[ \t]*(Facter.add|Puppet\.runtime\[:facter\].add)\(['"](.*?)['"]\)/
           current_fact = RDoc::Fact.new($1,{})
           look_for_directives_in(container, comments) unless comments.empty?
           current_fact.comment = comments

data/lib/puppet/util/rdoc/parser/puppet_parser_rdoc2.rb

@@ -8,7 +8,7 @@ module RDoc
     include PuppetParserCore
 
     def create_rdoc_preprocess
-      preprocess = Markup::PreProcess.new(@input_file_name, @options.rdoc_include)
+      Markup::PreProcess.new(@input_file_name, @options.rdoc_include)
     end
   end
 end

data/lib/puppet/util/rdoc.rb

@@ -30,8 +30,8 @@ module Puppet::Util::RDoc
     # replacing Ruby's normal / with \.  When RDoc generates relative paths it
     # uses relative_path_from that will generate errors when the slashes don't
     # properly match.  This is a workaround for that issue.
-    if Puppet.features.microsoft_windows? && RDoc::VERSION !~ /^[0-3]\./
-      options += [ "--root", Dir.pwd.gsub(/\\/, '/')]
+    if Puppet::Util::Platform.windows? && RDoc::VERSION !~ /^[0-3]\./
+      options += [ "--root", Dir.pwd.tr('\\', '/')]
     end
     options += files
 

data/lib/puppet/util/reference.rb

@@ -1,27 +1,21 @@
 require 'puppet/util/instance_loader'
-require 'puppet/util/methodhelper'
 require 'fileutils'
 
 # Manage Reference Documentation.
 class Puppet::Util::Reference
   include Puppet::Util
-  include Puppet::Util::MethodHelper
   include Puppet::Util::Docs
 
   extend Puppet::Util::InstanceLoader
 
   instance_load(:reference, 'puppet/reference')
 
-  def self.footer
-    "\n\n----------------\n\n" + _("*This page autogenerated on %{current_time}*\n") % { current_time: Time.now.to_s }
-  end
-
   def self.modes
     %w{pdf text}
   end
 
   def self.newreference(name, options = {}, &block)
-    ref = self.new(name, options, &block)
+    ref = self.new(name, **options, &block)
     instance_hash(:reference)[name.intern] = ref
 
     ref
@@ -62,9 +56,9 @@ class Puppet::Util::Reference
 
   end
 
-  def self.references
-    instance_loader(:reference).loadall
-    loaded_instances(:reference).sort { |a,b| a.to_s <=> b.to_s }
+  def self.references(environment)
+    instance_loader(:reference).loadall(environment)
+    loaded_instances(:reference).sort_by(&:to_s)
   end
 
   attr_accessor :page, :depth, :header, :title, :dynamic
@@ -82,9 +76,12 @@ class Puppet::Util::Reference
     self.dynamic
   end
 
-  def initialize(name, options = {}, &block)
+  def initialize(name, title: nil, depth: nil, dynamic: nil, doc: nil, &block)
     @name = name
-    set_options(options)
+    @title = title
+    @depth = depth
+    @dynamic = dynamic
+    @doc = doc
 
     meta_def(:generate, &block)
 
@@ -111,15 +108,12 @@ class Puppet::Util::Reference
   def to_markdown(withcontents = true)
     # First the header
     text = markdown_header(@title, 1)
-    #TRANSLATORS message accompanied by date of generation
-    text << _("\n\n**This page is autogenerated; any changes will get overwritten** *(last generated on %{current_time})*\n\n") % { current_time: Time.now.to_s }
+    text << _("\n\n**This page is autogenerated; any changes will get overwritten**\n\n")
 
     text << @header
 
     text << generate
 
-    text << self.class.footer if withcontents
-
     text
   end
 end

data/lib/puppet/util/resource_template.rb

@@ -53,7 +53,7 @@ class Puppet::Util::ResourceTemplate
 
   def set_resource_variables
     @resource.to_hash.each do |param, value|
-      var = "@#{param.to_s}"
+      var = "@#{param}"
       instance_variable_set(var, value)
     end
   end

data/lib/puppet/util/rpm_compare.rb

@@ -0,0 +1,193 @@
+module Puppet::Util::RpmCompare
+
+  ARCH_LIST = %w(
+    noarch i386 i686 ppc ppc64 armv3l armv4b armv4l armv4tl armv5tel
+    armv5tejl armv6l armv7l m68kmint s390 s390x ia64 x86_64 sh3 sh4
+  ).freeze
+
+  ARCH_REGEX = Regexp.new(ARCH_LIST.join('|\.'))
+
+  # This is an attempt at implementing RPM's
+  # lib/rpmvercmp.c rpmvercmp(a, b) in Ruby.
+  #
+  # Some of the things in here look REALLY
+  # UGLY and/or arbitrary. Our goal is to
+  # match how RPM compares versions, quirks
+  # and all.
+  #
+  # I've kept a lot of C-like string processing
+  # in an effort to keep this as identical to RPM
+  # as possible.
+  #
+  # returns 1 if str1 is newer than str2,
+  #         0 if they are identical
+  #        -1 if str1 is older than str2
+  def rpmvercmp(str1, str2)
+    return 0 if str1 == str2
+
+    front_strip_re = /^[^A-Za-z0-9~]+/
+
+    while str1.length > 0 or str2.length > 0
+      # trim anything that's in front_strip_re and != '~' off the beginning of each string
+      str1 = str1.gsub(front_strip_re, '')
+      str2 = str2.gsub(front_strip_re, '')
+
+      # "handle the tilde separator, it sorts before everything else"
+      if str1 =~ /^~/ && str2 =~ /^~/
+        # if they both have ~, strip it
+        str1 = str1[1..-1]
+        str2 = str2[1..-1]
+        next
+      elsif str1 =~ /^~/
+        return -1
+      elsif str2 =~ /^~/
+        return 1
+      end
+
+      break if str1.length == 0 or str2.length == 0
+
+      # "grab first completely alpha or completely numeric segment"
+      isnum = false
+      # if the first char of str1 is a digit, grab the chunk of continuous digits from each string
+      if str1 =~ /^[0-9]+/
+        if str1 =~ /^[0-9]+/
+          segment1 = $~.to_s
+          str1 = $~.post_match
+        else
+          segment1 = ''
+        end
+        if str2 =~ /^[0-9]+/
+          segment2 = $~.to_s
+          str2 = $~.post_match
+        else
+          segment2 = ''
+        end
+        isnum = true
+      # else grab the chunk of continuous alphas from each string (which may be '')
+      else
+        if str1 =~ /^[A-Za-z]+/
+          segment1 = $~.to_s
+          str1 = $~.post_match
+        else
+          segment1 = ''
+        end
+        if str2 =~ /^[A-Za-z]+/
+          segment2 = $~.to_s
+          str2 = $~.post_match
+        else
+          segment2 = ''
+        end
+      end
+
+      # if the segments we just grabbed from the strings are different types (i.e. one numeric one alpha),
+      # where alpha also includes ''; "numeric segments are always newer than alpha segments"
+      if segment2.length == 0
+        return 1 if isnum
+        return -1
+      end
+
+      if isnum
+        # "throw away any leading zeros - it's a number, right?"
+        segment1 = segment1.gsub(/^0+/, '')
+        segment2 = segment2.gsub(/^0+/, '')
+        # "whichever number has more digits wins"
+        return 1 if segment1.length > segment2.length
+        return -1 if segment1.length < segment2.length
+      end
+
+      # "strcmp will return which one is greater - even if the two segments are alpha
+      # or if they are numeric. don't return if they are equal because there might
+      # be more segments to compare"
+      rc = segment1 <=> segment2
+      return rc if rc != 0
+    end #end while loop
+
+    # if we haven't returned anything yet, "whichever version still has characters left over wins"
+    return 1 if str1.length > str2.length
+    return -1 if str1.length < str2.length
+    0
+  end
+
+  # parse a rpm "version" specification
+  # this re-implements rpm's
+  # rpmUtils.miscutils.stringToVersion() in ruby
+  def rpm_parse_evr(full_version)
+    epoch_index = full_version.index(':')
+    if epoch_index
+      epoch = full_version[0,epoch_index]
+      full_version = full_version[epoch_index+1,full_version.length]
+    else
+      epoch = nil
+    end
+    begin
+      epoch = String(Integer(epoch))
+    rescue
+      # If there are non-digits in the epoch field, default to nil
+      epoch = nil
+    end
+    release_index = full_version.index('-')
+    if release_index
+      version = full_version[0,release_index]
+      release = full_version[release_index+1,full_version.length]
+      arch = release.scan(ARCH_REGEX)[0]
+      if arch
+        architecture = arch.delete('.')
+        release.gsub!(ARCH_REGEX, '')
+      end
+    else
+      version = full_version
+      release = nil
+    end
+    return { :epoch => epoch, :version => version, :release => release, :arch => architecture }
+  end
+
+  # this method is a native implementation of the
+  # compare_values function in rpm's python bindings,
+  # found in python/header-py.c, as used by rpm.
+  def compare_values(s1, s2)
+    return 0 if s1.nil? && s2.nil?
+    return 1 if ( not s1.nil? ) && s2.nil?
+    return -1 if s1.nil? && (not s2.nil?)
+    return rpmvercmp(s1, s2)
+  end
+
+  # how rpm compares two package versions:
+  # rpmUtils.miscutils.compareEVR(), which massages data types and then calls
+  # rpm.labelCompare(), found in rpm.git/python/header-py.c, which
+  # sets epoch to 0 if null, then compares epoch, then ver, then rel
+  # using compare_values() and returns the first non-0 result, else 0.
+  # This function combines the logic of compareEVR() and labelCompare().
+  #
+  # "version_should" can be v, v-r, or e:v-r.
+  # "version_is" will always be at least v-r, can be e:v-r
+  #
+  # return 1: a is newer than b
+  #        0: a and b are the same version
+  #       -1: b is newer than a
+  def rpm_compareEVR(should, is)
+    # pass on to rpm labelCompare
+    should_hash = rpm_parse_evr(should)
+    is_hash = rpm_parse_evr(is)
+
+    if !should_hash[:epoch].nil?
+      rc = compare_values(should_hash[:epoch], is_hash[:epoch])
+      return rc unless rc == 0
+    end
+
+    rc = compare_values(should_hash[:version], is_hash[:version])
+    return rc unless rc == 0
+
+    # here is our special case, PUP-1244.
+    # if should_hash[:release] is nil (not specified by the user),
+    # and comparisons up to here are equal, return equal. We need to
+    # evaluate to whatever level of detail the user specified, so we
+    # don't end up upgrading or *downgrading* when not intended.
+    #
+    # This should NOT be triggered if we're trying to ensure latest.
+    return 0 if should_hash[:release].nil?
+
+    rc = compare_values(should_hash[:release], is_hash[:release])
+
+    return rc
+  end
+end