puppet 5.3.7 → 5.4.0

data/lib/puppet/provider/zfs/zfs.rb

@@ -5,7 +5,7 @@ Puppet::Type.type(:zfs).provide(:zfs) do
 
   def self.instances
     zfs(:list, '-H').split("\n").collect do |line|
-      name,used,avail,refer,mountpoint = line.split(/\s+/)
+      name, _used, _avail, _refer, _mountpoint = line.split(/\s+/)
       new({:name => name, :ensure => :present})
     end
   end
@@ -42,13 +42,24 @@ Puppet::Type.type(:zfs).provide(:zfs) do
     end
   end
 
+  # On FreeBSD zoned is called jailed
+  def container_property
+    case Facter.value(:operatingsystem)
+      when "FreeBSD"
+        :jailed
+      else
+        :zoned
+    end
+  end
+
   PARAMETER_UNSET_OR_NOT_AVAILABLE = '-'
 
   # https://docs.oracle.com/cd/E19963-01/html/821-1448/gbscy.html
   # shareiscsi (added in build 120) was removed from S11 build 136
   # aclmode was removed from S11 in build 139 but it may have been added back
+  # acltype is for ZFS on Linux, and allows disabling or enabling POSIX ACLs
   # http://webcache.googleusercontent.com/search?q=cache:-p74K0DVsdwJ:developers.slashdot.org/story/11/11/09/2343258/solaris-11-released+&cd=13
-  [:aclmode, :shareiscsi].each do |field|
+  [:aclmode, :acltype, :shareiscsi].each do |field|
     # The zfs commands use the property value '-' to indicate that the
     # property is not set. We make use of this value to indicate that the
     # property is not set since it is not available. Conversely, if these
@@ -74,7 +85,7 @@ Puppet::Type.type(:zfs).provide(:zfs) do
    :mountpoint, :nbmand,  :primarycache, :quota, :readonly,
    :recordsize, :refquota, :refreservation, :reservation,
    :secondarycache, :setuid, :sharenfs, :sharesmb,
-   :snapdir, :version, :volsize, :vscan, :xattr, :zoned].each do |field|
+   :snapdir, :version, :volsize, :vscan, :xattr].each do |field|
     define_method(field) do
       zfs(:get, "-H", "-o", "value", field, @resource[:name]).strip
     end
@@ -84,5 +95,14 @@ Puppet::Type.type(:zfs).provide(:zfs) do
     end
   end
 
+
+  define_method(:zoned) do
+    zfs(:get, "-H", "-o", "value", container_property, @resource[:name]).strip
+  end
+
+  define_method("zoned=") do |should|
+    zfs(:set, "#{container_property}=#{should}", @resource[:name])
+  end
+
 end
 

data/lib/puppet/provider/zpool/zpool.rb

@@ -6,7 +6,7 @@ Puppet::Type.type(:zpool).provide(:zpool) do
   #NAME    SIZE  ALLOC   FREE    CAP  HEALTH  ALTROOT
   def self.instances
     zpool(:list, '-H').split("\n").collect do |line|
-      name, size, alloc, free, cap, health, altroot = line.split(/\s+/)
+      name, _size, _alloc, _free, _cap, _health, _altroot = line.split(/\s+/)
       new({:name => name, :ensure => :present})
     end
   end

data/lib/puppet/reference/configuration.rb

@@ -34,8 +34,6 @@ config = Puppet::Util::Reference.newreference(:configuration, :depth => 1, :doc
       val = 'Unix/Linux: /var/log/puppetlabs/puppet -- Windows: C:\ProgramData\PuppetLabs\puppet\var\log -- Non-root user: ~/.puppetlabs/var/log'
     elsif name.to_s == 'hiera_config'
       val = '$confdir/hiera.yaml. However, if a file exists at $codedir/hiera.yaml, Puppet uses that instead.'
-    elsif name.to_s == 'certname'
-      val = "the Host's fully qualified domain name, as determined by facter"
     end
 
     # Leave out the section information; it was apparently confusing people.

data/lib/puppet/reference/type.rb

@@ -79,7 +79,6 @@ Puppet::Util::Reference.newreference :type, :doc => "All Puppet resource types a
 
       raise _("Could not retrieve property %{sname} on type %{type_name}") % { sname: sname, type_name: type.name } unless property
 
-      doc = nil
       unless doc = property.doc
         $stderr.puts _("No docs for %{type}[%{sname}]") % { type: type, sname: sname }
         next

data/lib/puppet/resource.rb

@@ -257,7 +257,6 @@ class Puppet::Resource
               { type: (type[:type] || type["type"]).inspect, title: (type[:title] || type["title"]).inspect }
       end
 
-      environment = attributes[:environment]
       # In order to avoid an expensive search of 'known_resource_types" and
       # to obey/preserve the implementation of the resource's type - if the
       # given type is a resource type implementation (one of):
@@ -279,7 +278,7 @@ class Puppet::Resource
       end
       @exported = false
 
-      # Set things like strictness first.
+      # Set things like environment, strictness first.
       attributes.each do |attr, value|
         next if attr == :parameters
         send(attr.to_s + "=", value)

data/lib/puppet/resource/catalog.rb

@@ -595,7 +595,7 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
     transaction = Puppet::Transaction.new(self, options[:report], prioritizer)
     transaction.tags = options[:tags] if options[:tags]
     transaction.ignoreschedules = true if options[:ignoreschedules]
-    transaction.for_network_device = Puppet.lookup(:network_device) { nil } || options[:network_device]
+    transaction.for_network_device = options[:network_device]
 
     transaction
   end

data/lib/puppet/resource/status.rb

@@ -144,7 +144,6 @@ module Puppet
       # Puppet::Transaction::Event failure with the given message.
       # @param message [String] the reason for a status failure
       def fail_with_event(message)
-        failed = true
         add_event(@real_resource.event(:name => :resource_error, :status => "failure", :message => message))
       end
 

data/lib/puppet/resource/type.rb

@@ -43,7 +43,7 @@ class Puppet::Resource::Type
   #   :capability  - the type name of the capres produced/consumed
   #   :mappings    - a hash of attribute_name => Expression
   # These two attributes are populated in
-  # PopsBridge::instantiate_CapabilityMaping
+  # PopsBridge::instantiate_CapabilityMapping
 
   # Map from argument (aka parameter) names to Puppet Type
   # @return [Hash<Symbol, Puppet::Pops::Types::PAnyType] map from name to type
@@ -442,9 +442,9 @@ class Puppet::Resource::Type
   def convert_from_ast(name)
     value = name.value
     if value.is_a?(Puppet::Parser::AST::Regex)
-      name = value.value
+      value.value
     else
-      name = value
+      value
     end
   end
 
@@ -476,7 +476,7 @@ class Puppet::Resource::Type
       # Note we're doing something somewhat weird here -- we're setting
       # the class's namespace to its fully qualified name.  This means
       # anything inside that class starts looking in that namespace first.
-      @namespace, ignored_shortname = @type == :hostclass ? [@name, ''] : namesplit(@name)
+      @namespace, _ = @type == :hostclass ? [@name, ''] : namesplit(@name)
     end
   end
 

data/lib/puppet/resource/type_collection.rb

@@ -58,7 +58,7 @@ class Puppet::Resource::TypeCollection
 
   def add(instance)
     # return a merged instance, or the given
-    result = catch(:merged) {
+    catch(:merged) {
       send("add_#{instance.type}", instance)
       instance.resource_type_collection = self
       instance

data/lib/puppet/settings/base_setting.rb

@@ -98,7 +98,7 @@ class Puppet::Settings::BaseSetting
     @iscreated
   end
 
-  # short name for the celement
+  # short name for the element
   def short=(value)
     raise ArgumentError, _("Short names can only be one character.") if value.to_s.length != 1
     @short = value.to_s

data/lib/puppet/settings/environment_conf.rb

@@ -22,7 +22,6 @@ class Puppet::Settings::EnvironmentConf
   def self.load_from(path_to_env, global_module_path)
     path_to_env = File.expand_path(path_to_env)
     conf_file = File.join(path_to_env, 'environment.conf')
-    config = nil
 
     begin
       config = Puppet.settings.parse_file(conf_file)

data/lib/puppet/settings/ini_file.rb

@@ -12,7 +12,7 @@ class Puppet::Settings::IniFile
   def self.parse(config_fh)
     config = new([DefaultSection.new])
     config_fh.each_line do |line|
-      case line
+      case line.chomp
       when /^(\s*)\[([[:word:]]+)\](\s*)$/
         config.append(SectionLine.new($1, $2, $3))
       when /^(\s*)([[:word:]]+)(\s*=\s*)(.*?)(\s*)$/
@@ -34,6 +34,15 @@ class Puppet::Settings::IniFile
     @lines << line
   end
 
+  def delete(section, name)
+    delete_offset = @lines.index(setting(section, name))
+    next_offset = delete_offset + 1
+    if next_offset < @lines.length
+      @lines[next_offset].previous = @lines[delete_offset].previous
+    end
+    @lines.delete_at(delete_offset)
+  end
+
   def insert_after(line, new_line)
     new_line.previous = line
 
@@ -76,7 +85,30 @@ class Puppet::Settings::IniFile
     lines.select { |line| line.is_a?(SettingLine) }
   end
 
+  def settings_exist_in_default_section?
+    lines_in(DEFAULT_SECTION_NAME).any? { |line| line.is_a?(SettingLine) }
+  end
+
+  def section_exists_with_default_section_name?
+    section_lines.any? do |section|
+      !section.is_a?(DefaultSection) && section.name == DEFAULT_SECTION_NAME
+    end
+  end
+
+  def set_default_section_write_sectionline(value)
+    if index = @lines.find_index { |line| line.is_a?(DefaultSection) }
+      @lines[index].write_sectionline = true
+    end
+  end
+
   def write(fh)
+    # If no real section line for the default section exists, configure the
+    # DefaultSection object to write its section line. (DefaultSection objects
+    # don't write the section line unless explicitly configured to do so)
+    if settings_exist_in_default_section? && !section_exists_with_default_section_name?
+      set_default_section_write_sectionline(true)
+    end
+
     fh.truncate(0)
     fh.rewind
     @lines.each do |line|
@@ -99,6 +131,14 @@ class Puppet::Settings::IniFile
       end
     end
 
+    def delete(section_name, name)
+      setting = @config.setting(section_name, name)
+      if setting
+        @config.delete(section_name, name)
+        setting.to_s.chomp
+      end
+    end
+
     private
 
     def add_setting(section_name, name, value)
@@ -131,41 +171,55 @@ class Puppet::Settings::IniFile
   Line = Struct.new(:text) do
     include LineNumber
 
+    def to_s
+      text
+    end
+
     def write(fh)
-      fh.puts(text)
+      fh.puts(to_s)
     end
   end
 
   SettingLine = Struct.new(:prefix, :name, :infix, :value, :suffix) do
     include LineNumber
 
+    def to_s
+      "#{prefix}#{name}#{infix}#{value}#{suffix}"
+    end
+
     def write(fh)
-      fh.write(prefix)
-      fh.write(name)
-      fh.write(infix)
-      fh.write(value)
-      fh.puts(suffix)
+      fh.puts(to_s)
+    end
+
+    def ==(other)
+      super(other) && self.line_number == other.line_number
     end
   end
 
   SectionLine = Struct.new(:prefix, :name, :suffix) do
     include LineNumber
 
+    def to_s
+      "#{prefix}[#{name}]#{suffix}"
+    end
+
     def write(fh)
-      fh.write(prefix)
-      fh.write("[")
-      fh.write(name)
-      fh.write("]")
-      fh.puts(suffix)
+      fh.puts(to_s)
     end
   end
 
   class DefaultSection < SectionLine
+    attr_accessor :write_sectionline
+
     def initialize
+      @write_sectionline = false
       super("", DEFAULT_SECTION_NAME, "")
     end
 
     def write(fh)
+      if @write_sectionline
+        super(fh)
+      end
     end
   end
 end

data/lib/puppet/ssl/certificate_authority.rb

@@ -399,7 +399,7 @@ class Puppet::SSL::CertificateAuthority
 
       # Check for wildcards in the subjectAltName fields too.
       if csr.subject_alt_names.any? {|x| x.include? '*' }
-        raise CertificateSigningError.new(hostname), _("CSR '%{csr}' subjectAltName contains a wildcard, which is not allowed: %{alt_names}  To continue, this CSR needs to be cleaned.") % { csr: csr.name, alt_names: csr.subject_alt_names.join(', ') }
+        raise CertificateSigningError.new(hostname), _("CSR '%{csr}' subjectAltName contains a wildcard, which is not allowed: %{alt_names}.  To continue, this CSR needs to be cleaned.") % { csr: csr.name, alt_names: csr.subject_alt_names.join(', ') }
       end
     end
 

data/lib/puppet/ssl/certificate_request.rb

@@ -109,7 +109,7 @@ DOC
 
   def ext_value_to_ruby_value(asn1_arr)
     # A list of ASN1 types than can't be directly converted to a Ruby type
-    @non_convertable ||= [OpenSSL::ASN1::EndOfContent,
+    @non_convertible ||= [OpenSSL::ASN1::EndOfContent,
                           OpenSSL::ASN1::BitString,
                           OpenSSL::ASN1::Null,
                           OpenSSL::ASN1::Enumerated,
@@ -130,7 +130,7 @@ DOC
     # type, use the original ASN1 value. This is needed to work around a bug
     # in Ruby's OpenSSL library which doesn't convert the value of unknown
     # extension OIDs properly. See PUP-3560
-    if @non_convertable.include?(asn1_val.class) then
+    if @non_convertible.include?(asn1_val.class) then
       # Allows OpenSSL to take the ASN1 value and turn it into something Ruby understands
       OpenSSL::X509::Extension.new(asn1_arr.first.value, asn1_val.to_der).value
     else

data/lib/puppet/ssl/certificate_revocation_list.rb

@@ -1,5 +1,6 @@
 require 'puppet/ssl/base'
 require 'puppet/indirector'
+require 'puppet/ssl/certificate_signer'
 
 # Manage the CRL.
 class Puppet::SSL::CertificateRevocationList < Puppet::SSL::Base
@@ -105,6 +106,6 @@ private
   end
 
   def sign_with(cakey)
-    @content.sign(cakey, OpenSSL::Digest::SHA1.new)
+    Puppet::SSL::CertificateSigner.new.sign(@content, cakey)
   end
 end

data/lib/puppet/ssl/certificate_signer.rb

@@ -4,11 +4,22 @@
 #
 # @api private
 class Puppet::SSL::CertificateSigner
+
+  # @!attribute [r] digest
+  #   @return [OpenSSL::Digest]
+  attr_reader :digest
+
   def initialize
     if OpenSSL::Digest.const_defined?('SHA256')
       @digest = OpenSSL::Digest::SHA256
     elsif OpenSSL::Digest.const_defined?('SHA1')
       @digest = OpenSSL::Digest::SHA1
+    elsif OpenSSL::Digest.const_defined?('SHA512')
+      @digest = OpenSSL::Digest::SHA512
+    elsif OpenSSL::Digest.const_defined?('SHA384')
+      @digest = OpenSSL::Digest::SHA384
+    elsif OpenSSL::Digest.const_defined?('SHA224')
+      @digest = OpenSSL::Digest::SHA224
     else
       raise Puppet::Error,
         "No FIPS 140-2 compliant digest algorithm in OpenSSL::Digest"

data/lib/puppet/ssl/host.rb

@@ -211,7 +211,7 @@ DOC
     raise Puppet::Error, _("No private key with which to validate certificate with fingerprint: %{fingerprint}") % { fingerprint: certificate.fingerprint } unless key
     unless certificate.content.check_private_key(key.content)
       raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: certificate.fingerprint, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
-The certificate retrieved from the master does not match the agent's private key.
+The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root?
 Certificate fingerprint: %{fingerprint}
 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certificate.
 On the master:
@@ -320,7 +320,7 @@ ERROR_STRING
   # configurable
   # --jeffweiss 29 aug 2012
   def suitable_message_digest_algorithms
-    [:SHA1, :SHA256, :SHA512]
+    [:SHA1, :SHA224, :SHA256, :SHA384, :SHA512]
   end
 
   # Attempt to retrieve a cert, if we don't already have one.

data/lib/puppet/syntax_checkers/base64.rb

@@ -23,7 +23,7 @@ class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxCh
       # Do a strict decode64 on text with all whitespace stripped since the non strict version
       # simply skips all non base64 characters
       Base64.strict_decode64(cleaned_text)
-    rescue => e
+    rescue
       msg = if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
               _("Base64 syntax checker: Cannot parse invalid Base64 string - padding is not correct")
             else

data/lib/puppet/transaction.rb

@@ -28,7 +28,7 @@ class Puppet::Transaction
   # Handles most of the actual interacting with resources
   attr_reader :resource_harness
 
-  attr_reader :prefetched_providers
+  attr_reader :prefetched_providers, :prefetch_failed_providers
 
   # @!attribute [r] persistence
   #   @return [Puppet::Transaction::Persistence] persistence object for cross
@@ -54,6 +54,8 @@ class Puppet::Transaction
     @resource_harness = Puppet::Transaction::ResourceHarness.new(self)
 
     @prefetched_providers = Hash.new { |h,k| h[k] = {} }
+
+    @prefetch_failed_providers = Hash.new { |h,k| h[k] = {} }
   end
 
   # Invoke the pre_run_check hook in every resource in the catalog.
@@ -175,9 +177,9 @@ class Puppet::Transaction
       if resource.is_a?(Puppet::Type::Component)
         Puppet.warning _("Somehow left a component in the relationship graph")
       else
-        resource.info _("Starting to evaluate the resource") if Puppet[:evaltrace] and @catalog.host_config?
+        resource.info _("Starting to evaluate the resource") if Puppet[:evaltrace] && @catalog.host_config?
         seconds = thinmark { block.call(resource) }
-        resource.info _("Evaluated in %{seconds} seconds") % { seconds: "%0.2f" % seconds } if Puppet[:evaltrace] and @catalog.host_config?
+        resource.info _("Evaluated in %{seconds} seconds") % { seconds: "%0.2f" % seconds } if Puppet[:evaltrace] && @catalog.host_config?
       end
     end
 
@@ -231,7 +233,11 @@ class Puppet::Transaction
 
   def prefetch_if_necessary(resource)
     provider_class = resource.provider.class
-    return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
+    if !provider_class.respond_to?(:prefetch) or
+        prefetched_providers[resource.type][provider_class.name] or
+        prefetch_failed_providers[resource.type][provider_class.name]
+      return
+    end
 
     resources = resources_by_provider(resource.type, provider_class.name)
 
@@ -302,14 +308,20 @@ class Puppet::Transaction
   # up-front at failure time because the graph may be mutated as we
   # walk it.
   def propagate_failure(resource)
+
+    provider_class = resource.provider.class
+    s = resource_status(resource)
+    if prefetch_failed_providers[resource.type][provider_class.name] && !s.nil?
+      message = _("Prefetch failed for %{type_name} provider '%{name}'") % { type_name: resource.type, name: provider_class.name }
+      s.fail_with_event(message)
+    end
+
     failed = Set.new
     relationship_graph.direct_dependencies_of(resource).each do |dep|
-      if (s = resource_status(dep))
-        failed.merge(s.failed_dependencies) if s.dependency_failed?
-        if s.failed? || s.failed_to_restart?
-          failed.add(dep)
-        end
-      end
+      s = resource_status(dep)
+      next if s.nil?
+      failed.merge(s.failed_dependencies) if s.dependency_failed?
+      failed.add(dep) if s.failed? || s.failed_to_restart?
     end
     resource_status(resource).failed_dependencies = failed.to_a
   end
@@ -338,13 +350,20 @@ class Puppet::Transaction
   # types, just providers.
   def prefetch(provider_class, resources)
     type_name = provider_class.resource_type.name
-    return if @prefetched_providers[type_name][provider_class.name]
+    return if @prefetched_providers[type_name][provider_class.name] ||
+      @prefetch_failed_providers[type_name][provider_class.name]
     Puppet.debug "Prefetching #{provider_class.name} resources for #{type_name}"
     begin
       provider_class.prefetch(resources)
-    rescue LoadError, Puppet::MissingCommand => detail
+    rescue Exception => detail
+      if !detail.is_a?(LoadError) && !detail.is_a?(Puppet::MissingCommand)
+        raise unless Puppet.settings[:future_features]
+        
+        @prefetch_failed_providers[type_name][provider_class.name] = true
+      end
       #TRANSLATORS `prefetch` is a function name and should not be translated
-      Puppet.log_exception(detail, _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail })
+      message = _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail }
+      Puppet.log_exception(detail, message)
     end
     @prefetched_providers[type_name][provider_class.name] = true
   end
@@ -355,7 +374,7 @@ class Puppet::Transaction
 
   # Is the resource currently scheduled?
   def scheduled?(resource)
-    self.ignoreschedules or resource_harness.scheduled?(resource)
+    self.ignoreschedules || resource_harness.scheduled?(resource)
   end
 
   # Should this resource be skipped?
@@ -374,6 +393,10 @@ class Puppet::Transaction
       unless resource.class == Puppet::Type.type(:whit) then
         resource.warning _("Skipping because of failed dependencies")
       end
+    elsif resource_status(resource).failed? &&
+        @prefetch_failed_providers[resource.type][resource.provider.class.name]
+      #Do not try to evaluate a resource with a known failed provider
+      resource.warning _("Skipping because provider prefetch failed")
     elsif resource.virtual?
       resource.debug "Skipping because virtual"
     elsif !host_and_device_resource?(resource) && resource.appliable_to_host? && for_network_device