puppet 5.3.4 → 6.29.0

data/lib/puppet/type/exec.rb

@@ -11,47 +11,64 @@ module Puppet
 
       * The command itself is already idempotent. (For example, `apt-get update`.)
       * The exec has an `onlyif`, `unless`, or `creates` attribute, which prevents
-        Puppet from running the command unless some condition is met.
-      * The exec has `refreshonly => true`, which only allows Puppet to run the
-        command when some other resource is changed. (See the notes on refreshing
-        below.)
+        Puppet from running the command unless some condition is met. The
+        `onlyif` and `unless` commands of an `exec` are used in the process of
+        determining whether the `exec` is already in sync, therefore they must be run
+        during a noop Puppet run.
+      * The exec has `refreshonly => true`, which allows Puppet to run the
+        command only when some other resource is changed. (See the notes on refreshing
+        below.) 
+        
+      The state managed by an `exec` resource represents whether the specified command
+      _needs to be_ executed during the catalog run. The target state is always that
+      the command does not need to be executed. If the initial state is that the
+      command _does_ need to be executed, then successfully executing the command
+      transitions it to the target state.
+      
+      The `unless`, `onlyif`, and `creates` properties check the initial state of the
+      resource. If one or more of these properties is specified, the exec might not
+      need to run. If the exec does not need to run, then the system is already in
+      the target state. In such cases, the exec is considered successful without 
+      actually executing its command.
 
       A caution: There's a widespread tendency to use collections of execs to
       manage resources that aren't covered by an existing resource type. This
       works fine for simple tasks, but once your exec pile gets complex enough
       that you really have to think to understand what's happening, you should
-      consider developing a custom resource type instead, as it will be much
+      consider developing a custom resource type instead, as it is much
       more predictable and maintainable.
 
+      **Duplication:** Even though `command` is the namevar, Puppet allows
+      multiple `exec` resources with the same `command` value.
+
       **Refresh:** `exec` resources can respond to refresh events (via
       `notify`, `subscribe`, or the `~>` arrow). The refresh behavior of execs
       is non-standard, and can be affected by the `refresh` and
       `refreshonly` attributes:
 
-      * If `refreshonly` is set to true, the exec will _only_ run when it receives an
+      * If `refreshonly` is set to true, the exec runs _only_ when it receives an
         event. This is the most reliable way to use refresh with execs.
-      * If the exec already would have run and receives an event, it will run its
-        command **up to two times.** (If an `onlyif`, `unless`, or `creates` condition
-        is no longer met after the first run, the second run will not occur.)
-      * If the exec already would have run, has a `refresh` command, and receives an
-        event, it will run its normal command, then run its `refresh` command
-        (as long as any `onlyif`, `unless`, or `creates` conditions are still met
-        after the normal command finishes).
-      * If the exec would **not** have run (due to an `onlyif`, `unless`, or `creates`
-        attribute) and receives an event, it still will not run.
+      * If the exec has already run and then receives an event, it runs its
+        command **up to two times.** If an `onlyif`, `unless`, or `creates` condition
+        is no longer met after the first run, the second run does not occur.
+      * If the exec has already run, has a `refresh` command, and receives an
+        event, it runs its normal command. Then, if any `onlyif`, `unless`, or `creates`
+        conditions are still met, the exec runs its `refresh` command.
+      * If the exec has an `onlyif`, `unless`, or `creates` attribute that prevents it
+        from running, and it then receives an event, it still will not run.
       * If the exec has `noop => true`, would otherwise have run, and receives
-        an event from a non-noop resource, it will run once (or run its `refresh`
-        command instead, if it has one).
+        an event from a non-noop resource, it runs once. However, if it has a `refresh`
+        command, it runs that instead of its normal command.
 
       In short: If there's a possibility of your exec receiving refresh events,
-      it becomes doubly important to make sure the run conditions are restricted.
+      it is extremely important to make sure the run conditions are restricted.
 
       **Autorequires:** If Puppet is managing an exec's cwd or the executable
-      file used in an exec's command, the exec resource will autorequire those
+      file used in an exec's command, the exec resource autorequires those
       files. If Puppet is managing the user that an exec should run as, the
-      exec resource will autorequire that user."
+      exec resource autorequires that user."
 
-    # Create a new check mechanism.  It's basically just a parameter that
+    # Create a new check mechanism.  It's basically a parameter that
     # provides one extra 'check' method.
     def self.newcheck(name, options = {}, &block)
       @checks ||= {}
@@ -78,8 +95,8 @@ module Puppet
 
       attr_reader :output
       desc "The expected exit code(s).  An error will be returned if the
-        executed command has some other exit code.  Defaults to 0. Can be
-        specified as an array of acceptable exit codes or a single value.
+        executed command has some other exit code. Can be specified as an array
+        of acceptable exit codes or a single value.
 
         On POSIX systems, exit codes are always integers between 0 and 255.
 
@@ -138,7 +155,8 @@ module Puppet
           self.fail Puppet::Error, _("Command exceeded timeout"), $!
         end
 
-        if log = @resource[:logoutput]
+        log = @resource[:logoutput]
+        if log
           case log
           when :true
             log = @resource[:loglevel]
@@ -150,9 +168,13 @@ module Puppet
             end
           end
           unless log == :false
-            @output.split(/\n/).each { |line|
-              self.send(log, line)
-            }
+            if @resource.parameter(:command).sensitive
+              self.send(log, "[output redacted]")
+            else
+              @output.split(/\n/).each { |line|
+                self.send(log, line)
+              }
+            end
           end
         end
 
@@ -176,10 +198,23 @@ module Puppet
         succeeds, any output produced will be logged at the instance's
         normal log level (usually `notice`), but if the command fails
         (meaning its return code does not match the specified code) then
-        any output is logged at the `err` log level."
+        any output is logged at the `err` log level.
+
+        Multiple `exec` resources can use the same `command` value; Puppet
+        only uses the resource title to ensure `exec`s are unique.
+
+        On *nix platforms, the command can be specified as an array of
+        strings and Puppet will invoke it using the more secure method of
+        parameterized system calls. For example, rather than executing the
+        malicious injected code, this command will echo it out:
+
+            command => ['/bin/echo', 'hello world; rm -rf /']
+      "
 
       validate do |command|
-        raise ArgumentError, _("Command must be a String, got value of class %{klass}") % { klass: command.class } unless command.is_a? String
+        unless command.is_a?(String) || command.is_a?(Array)
+          raise ArgumentError, _("Command must be a String or Array<String>, got value of class %{klass}") % { klass: command.class }
+        end
       end
     end
 
@@ -197,17 +232,20 @@ module Puppet
     end
 
     newparam(:user) do
-      desc "The user to run the command as.  Note that if you
-        use this then any error output is not currently captured.  This
-        is because of a bug within Ruby.  If you are using Puppet to
-        create this user, the exec will automatically require the user,
-        as long as it is specified by name.
+      desc "The user to run the command as.
 
-        Please note that the $HOME environment variable is not automatically set
-        when using this attribute."
+        > **Note:** Puppet cannot execute commands as other users on Windows.
+
+        Note that if you use this attribute, any error output is not captured
+        due to a bug within Ruby. If you use Puppet to create this user, the
+        exec automatically requires the user, as long as it is specified by
+        name.
+
+        The $HOME environment variable is not automatically set when using
+        this attribute."
 
       validate do |user|
-        if Puppet.features.microsoft_windows?
+        if Puppet::Util::Platform.windows?
           self.fail _("Unable to execute commands as other users on Windows")
         elsif !Puppet.features.root? && resource.current_username() != user
           self.fail _("Only root can execute commands as other users")
@@ -230,7 +268,7 @@ module Puppet
 
     newparam(:logoutput) do
       desc "Whether to log command output in addition to logging the
-        exit code.  Defaults to `on_failure`, which only logs the output
+        exit code. Defaults to `on_failure`, which only logs the output
         when the command has an exit code that does not match any value
         specified by the `returns` attribute. As with any resource type,
         the log level can be controlled with the `loglevel` metaparameter."
@@ -256,10 +294,11 @@ module Puppet
     end
 
     newparam(:environment) do
-      desc "Any additional environment variables you want to set for a
-        command.  Note that if you use this to set PATH, it will override
-        the `path` attribute.  Multiple environment variables should be
-        specified as an array."
+      desc "An array of any additional environment variables you want to set for a
+        command, such as `[ 'HOME=/root', 'MAIL=root@example.com']`.
+        Note that if you use this to set PATH, it will override the `path`
+        attribute. Multiple environment variables should be specified as an
+        array."
 
       validate do |values|
         values = [values] unless values.is_a? Array
@@ -304,10 +343,9 @@ module Puppet
 
     newparam(:tries) do
       desc "The number of times execution of the command should be tried.
-        Defaults to '1'. This many attempts will be made to execute
-        the command until an acceptable return code is returned.
-        Note that the timeout parameter applies to each try rather than
-        to the complete set of tries."
+        This many attempts will be made to execute the command until an
+        acceptable return code is returned. Note that the timeout parameter
+        applies to each try rather than to the complete set of tries."
 
       munge do |value|
         if value.is_a?(String)
@@ -404,6 +442,8 @@ module Puppet
       # If the file exists, return false (i.e., don't run the command),
       # else return true
       def check(value)
+        #TRANSLATORS 'creates' is a parameter name and should not be translated
+        debug(_("Checking that 'creates' path '%{creates_path}' exists") % { creates_path: value })
         ! Puppet::FileSystem.exist?(value)
       end
     end
@@ -417,20 +457,27 @@ module Puppet
 
             exec { '/bin/echo root >> /usr/lib/cron/cron.allow':
               path   => '/usr/bin:/usr/sbin:/bin',
-              unless => 'grep root /usr/lib/cron/cron.allow 2>/dev/null',
+              unless => 'grep ^root$ /usr/lib/cron/cron.allow 2>/dev/null',
             }
 
         This would add `root` to the cron.allow file (on Solaris) unless
         `grep` determines it's already there.
 
         Note that this test command runs with the same `provider`, `path`,
-        `user`, and `group` as the main command. If the `path` isn't set, you
+        `user`, `cwd`, and `group` as the main command. If the `path` isn't set, you
         must fully qualify the command's name.
 
+        Since this command is used in the process of determining whether the
+        `exec` is already in sync, it must be run during a noop Puppet run.
+
         This parameter can also take an array of commands. For example:
 
             unless => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
+        or an array of arrays. For example:
+
+            unless => [['test', '-f', '/tmp/file1'], 'test -f /tmp/file2']
+
         This `exec` would only run if every command in the array has a
         non-zero exit code.
       EOT
@@ -452,9 +499,13 @@ module Puppet
           return false
         end
 
-        output.split(/\n/).each { |line|
-          self.debug(line)
-        }
+        if sensitive
+          self.debug("[output redacted]")
+        else
+          output.split(/\n/).each { |line|
+            self.debug(line)
+          }
+        end
 
         status.exitstatus != 0
       end
@@ -476,13 +527,20 @@ module Puppet
         This would run `logrotate` only if that test returns true.
 
         Note that this test command runs with the same `provider`, `path`,
-        `user`, and `group` as the main command. If the `path` isn't set, you
+        `user`, `cwd`, and `group` as the main command. If the `path` isn't set, you
         must fully qualify the command's name.
 
+        Since this command is used in the process of determining whether the
+        `exec` is already in sync, it must be run during a noop Puppet run.
+
         This parameter can also take an array of commands. For example:
 
             onlyif => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
+        or an array of arrays. For example:
+
+            onlyif => [['test', '-f', '/tmp/file1'], 'test -f /tmp/file2']
+
         This `exec` would only run if every command in the array has an
         exit code of 0 (success).
       EOT
@@ -504,9 +562,13 @@ module Puppet
           return false
         end
 
-        output.split(/\n/).each { |line|
-          self.debug(line)
-        }
+        if sensitive
+          self.debug("[output redacted]")
+        else
+          output.split(/\n/).each { |line|
+            self.debug(line)
+          }
+        end
 
         status.exitstatus == 0
       end
@@ -526,18 +588,21 @@ module Puppet
       # Stick the cwd in there if we have it
       reqs << self[:cwd] if self[:cwd]
 
-      file_regex = Puppet.features.microsoft_windows? ? %r{^([a-zA-Z]:[\\/]\S+)} : %r{^(/\S+)}
+      file_regex = Puppet::Util::Platform.windows? ? %r{^([a-zA-Z]:[\\/]\S+)} : %r{^(/\S+)}
+      cmd = self[:command]
+      cmd = cmd[0] if cmd.is_a? Array
 
-      self[:command].scan(file_regex) { |str|
+      cmd.scan(file_regex) { |str|
         reqs << str
       }
 
-      self[:command].scan(/^"([^"]+)"/) { |str|
+      cmd.scan(/^"([^"]+)"/) { |str|
         reqs << str
       }
 
       [:onlyif, :unless].each { |param|
-        next unless tmp = self[param]
+        tmp = self[param]
+        next unless tmp
 
         tmp = [tmp] unless tmp.is_a? Array
 
@@ -547,6 +612,7 @@ module Puppet
           # fully qualified.  It might not be a bad idea to add
           # unqualified files, but, well, that's a bit more annoying
           # to do.
+          line = line[0] if line.is_a? Array
           reqs += line.scan(file_regex)
         end
       }
@@ -559,7 +625,8 @@ module Puppet
 
     autorequire(:user) do
       # Autorequire users if they are specified by name
-      if user = self[:user] and user !~ /^\d+$/
+      user = self[:user]
+      if user && user !~ /^\d+$/
         user
       end
     end
@@ -578,7 +645,15 @@ module Puppet
           val = @parameters[check].value
           val = [val] unless val.is_a? Array
           val.each do |value|
-            return false unless @parameters[check].check(value)
+            if !@parameters[check].check(value)
+              # Give a debug message so users can figure out what command would have been
+              # but don't print sensitive commands or parameters in the clear
+              cmdstring = @parameters[:command].sensitive ? "[command redacted]" : @parameters[:command].value
+
+              debug(_("'%{cmd}' won't be executed because of failed check '%{check}'") % { cmd: cmdstring, check: check })
+
+              return false
+            end
           end
         end
       }
@@ -597,7 +672,8 @@ module Puppet
     # Run the command, or optionally run a separately-specified command.
     def refresh
       if self.check_all_attributes(true)
-        if cmd = self[:refresh]
+        cmd = self[:refresh]
+        if cmd
           provider.run(cmd)
         else
           self.property(:returns).sync
@@ -611,11 +687,25 @@ module Puppet
 
     private
     def set_sensitive_parameters(sensitive_parameters)
-      # Respect sensitive commands
-      if sensitive_parameters.include?(:command)
-        sensitive_parameters.delete(:command)
-        parameter(:command).sensitive = true
+      # If any are sensitive, mark all as sensitive
+      sensitive = false
+      parameters_to_check = [:command, :unless, :onlyif]
+
+      parameters_to_check.each do |p|
+        if sensitive_parameters.include?(p)
+          sensitive_parameters.delete(p)
+          sensitive = true
+        end
       end
+
+      if sensitive
+        parameters_to_check.each do |p|
+          if parameters.include?(p)
+            parameter(p).sensitive = true
+          end
+        end
+      end
+
       super(sensitive_parameters)
     end
   end

data/lib/puppet/type/file/checksum.rb

@@ -9,26 +9,32 @@ Puppet::Type.type(:file).newparam(:checksum) do
 
     The default checksum type is md5."
 
-  newvalues "md5", "md5lite", "sha256", "sha256lite", "mtime", "ctime", "none"
+  newvalues(*Puppet::Util::Checksums.known_checksum_types)
 
   defaultto do
     Puppet[:digest_algorithm].to_sym
   end
 
+  validate do |value|
+    if Puppet::Util::Platform.fips_enabled? && (value == :md5 || value == :md5lite)
+      raise ArgumentError, _("MD5 is not supported in FIPS mode")
+    end
+  end
+
   def sum(content)
     content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
-    type = digest_algorithm()
+    type = digest_algorithm
     "{#{type}}" + send(type, content)
   end
 
   def sum_file(path)
-    type = digest_algorithm()
+    type = digest_algorithm
     method = type.to_s + "_file"
     "{#{type}}" + send(method, path).to_s
   end
 
   def sum_stream(&block)
-    type = digest_algorithm()
+    type = digest_algorithm
     method = type.to_s + "_stream"
     checksum = send(method, &block)
     "{#{type}}#{checksum}"

data/lib/puppet/type/file/checksum_value.rb

@@ -6,9 +6,10 @@ module Puppet
     include Puppet::Util::Checksums
     include Puppet::DataSync
 
-    desc "The checksum of the source contents. Only md5 and sha256 are supported when
-      specifying this parameter. If this parameter is set, source_permissions will be
-      assumed to be false, and ownership and permissions will not be read from source."
+    desc "The checksum of the source contents. Only md5, sha256, sha224, sha384 and sha512
+      are supported when specifying this parameter. If this parameter is set, 
+      source_permissions will be assumed to be false, and ownership and permissions
+      will not be read from source."
 
     def insync?(is)
       # If checksum_value and source are specified, manage the file contents.

data/lib/puppet/type/file/content.rb

@@ -35,8 +35,8 @@ module Puppet
           }
 
       ...but for larger files, this attribute is more useful when combined with the
-      [template](https://docs.puppetlabs.com/puppet/latest/reference/function.html#template)
-      or [file](https://docs.puppetlabs.com/puppet/latest/reference/function.html#file)
+      [template](https://puppet.com/docs/puppet/latest/function.html#template)
+      or [file](https://puppet.com/docs/puppet/latest/function.html#file)
       function.
     EOT
 
@@ -48,6 +48,19 @@ module Puppet
       elsif value.is_a?(String) && checksum?(value)
         # XXX This is potentially dangerous because it means users can't write a file whose
         # entire contents are a plain checksum unless it is a Binary content.
+        Puppet.puppet_deprecation_warning([
+            #TRANSLATORS "content" is an attribute and should not be translated
+            _('Using a checksum in a file\'s "content" property is deprecated.'),
+            #TRANSLATORS "filebucket" is a resource type and should not be translated. The quoted occurrence of "content" is an attribute and should not be translated.
+            _('The ability to use a checksum to retrieve content from the filebucket using the "content" property will be removed in a future release.'),
+            #TRANSLATORS "content" is an attribute and should not be translated.
+            _('The literal value of the "content" property will be written to the file.'),
+            #TRANSLATORS "static catalogs" should not be translated.
+            _('The checksum retrieval functionality is being replaced by the use of static catalogs.'),
+            _('See https://puppet.com/docs/puppet/latest/static_catalogs.html for more information.')].join(" "),
+            :file => @resource.file,
+            :line => @resource.line
+        ) if !@actual_content && !resource.parameter(:source)
         value
       else
         @actual_content = value.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? value.binary_buffer : value
@@ -58,7 +71,9 @@ module Puppet
     # Checksums need to invert how changes are printed.
     def change_to_s(currentvalue, newvalue)
       # Our "new" checksum value is provided by the source.
-      if source = resource.parameter(:source) and tmp = source.checksum
+      source = resource.parameter(:source) 
+      tmp = source.checksum if source
+      if tmp
         newvalue = tmp
       end
       if currentvalue == :absent
@@ -94,7 +109,8 @@ module Puppet
     def property_matches?(current, desired)
       # If checksum_value is specified, it overrides comparing the content field.
       checksum_type = resource.parameter(:checksum).value
-      if checksum_value = resource.parameter(:checksum_value)
+      checksum_value = resource.parameter(:checksum_value)
+      if checksum_value
         desired = "{#{checksum_type}}#{checksum_value.value}"
       end
 
@@ -109,9 +125,8 @@ module Puppet
 
     # Make sure we're also managing the checksum property.
     def should=(value)
-      # treat the value as a bytestring, in Ruby versions that support it, regardless of the encoding
-      # in which it has been supplied
-      value = value.dup.force_encoding(Encoding::ASCII_8BIT) if value.respond_to?(:force_encoding)
+      # treat the value as a bytestring
+      value = value.b if value.is_a?(String)
       @resource.newattr(:checksum) unless @resource.parameter(:checksum)
       super
     end
@@ -149,7 +164,8 @@ module Puppet
     end
 
     def read_file_from_filebucket
-      raise "Could not get filebucket from file" unless dipper = resource.bucket
+      dipper = resource.bucket
+      raise "Could not get filebucket from file" unless dipper
       sum = should.sub(/\{\w+\}/, '')
 
       dipper.getfile(sum)

data/lib/puppet/type/file/ctime.rb

@@ -6,7 +6,8 @@ module Puppet
 
     def retrieve
       current_value = :absent
-      if stat = @resource.stat
+      stat = @resource.stat
+      if stat
         current_value = stat.ctime
       end
       current_value

data/lib/puppet/type/file/data_sync.rb

@@ -42,7 +42,11 @@ module Puppet
           send resource[:loglevel], "[diff redacted]"
         else
           write_temporarily(param) do |path|
-            send resource[:loglevel], "\n" + diff(resource[:path], path)
+            diff_output = diff(resource[:path], path)
+            if diff_output.encoding == Encoding::BINARY || !diff_output.valid_encoding?
+              diff_output = "Binary files #{resource[:path]} and #{path} differ"
+            end
+            send resource[:loglevel], "\n" + diff_output
           end
         end
       end
@@ -71,10 +75,11 @@ module Puppet
     end
 
     def retrieve_checksum(resource)
-      return :absent unless stat = resource.stat
+      stat = resource.stat
+      return :absent unless stat
       ftype = stat.ftype
       # Don't even try to manage the content on directories or links
-      return nil if ["directory","link"].include?(ftype)
+      return nil if ['directory', 'link', 'fifo', 'socket'].include?(ftype)
 
       begin
         resource.parameter(:checksum).sum_file(resource[:path])

data/lib/puppet/type/file/ensure.rb

@@ -47,7 +47,7 @@ module Puppet
 
       However, we recommend using `link` and `target` explicitly, since this
       behavior can be harder to read and is
-      [deprecated](https://docs.puppetlabs.com/puppet/4.3/reference/deprecated_language.html)
+      [deprecated](https://docs.puppet.com/puppet/4.3/deprecated_language.html)
       as of Puppet 4.3.0.
     EOT
 
@@ -62,9 +62,8 @@ module Puppet
 
     newvalue(:file, :event => :file_created) do
       # Make sure we're not managing the content some other way
-      if property = @resource.property(:content)
-        property.sync
-      elsif property = @resource.property(:checksum_value)
+      property = @resource.property(:content) || @resource.property(:checksum_value)
+      if property
         property.sync
       else
         @resource.write
@@ -99,7 +98,8 @@ module Puppet
 
 
     newvalue(:link, :event => :link_created, :required_features => :manages_symlinks) do
-      fail "Cannot create a symlink without a target" unless property = resource.property(:target)
+      property = resource.property(:target)
+      fail "Cannot create a symlink without a target" unless property
       property.retrieve
       property.mklink
     end
@@ -120,11 +120,13 @@ module Puppet
     def change_to_s(currentvalue, newvalue)
       return super unless [:file, :present].include?(newvalue)
 
-      return super unless property = @resource.property(:content)
+      property = @resource.property(:content)
+      return super unless property
 
       # We know that content is out of sync if we're here, because
       # it's essentially equivalent to 'ensure' in the transaction.
-      if source = @resource.parameter(:source)
+      source = @resource.parameter(:source)
+      if source
         should = source.checksum
       else
         should = property.should
@@ -166,7 +168,8 @@ module Puppet
     end
 
     def retrieve
-      if stat = @resource.stat
+      stat = @resource.stat
+      if stat
         return stat.ftype.intern
       else
         if self.should == :false