puppet 5.3.7 → 5.4.0

data/lib/puppet/transaction/report.rb

@@ -218,7 +218,7 @@ class Puppet::Transaction::Report
     @external_times ||= {}
     @host = Puppet[:node_name_value]
     @time = Time.now
-    @report_format = 7
+    @report_format = 8
     @puppet_version = Puppet.version
     @configuration_version = configuration_version
     @transaction_uuid = transaction_uuid
@@ -243,6 +243,7 @@ class Puppet::Transaction::Report
     @transaction_uuid = data['transaction_uuid']
     @environment = data['environment']
     @status = data['status']
+    @transaction_completed = data['transaction_completed']
     @noop = data['noop']
     @noop_pending = data['noop_pending']
     @host = data['host']
@@ -304,6 +305,7 @@ class Puppet::Transaction::Report
       'report_format' => @report_format,
       'puppet_version' => @puppet_version,
       'status' => @status,
+      'transaction_completed' => @transaction_completed,
       'noop' => @noop,
       'noop_pending' => @noop_pending,
       'environment' => @environment,

data/lib/puppet/type.rb

@@ -1336,9 +1336,9 @@ class Type
 
     def properties_to_audit(list)
       if !list.kind_of?(Array) && list.to_sym == :all
-        list = all_properties
+        all_properties
       else
-        list = Array(list).collect { |p| p.to_sym }
+        Array(list).collect { |p| p.to_sym }
       end
     end
   end
@@ -1538,12 +1538,25 @@ class Type
             :event => self.class.events,
             :callback => method
           }
-          self.debug { "subscribes to #{related_resource.ref}" }
         else
           # If there's no callback, there's no point in even adding
           # a label.
           subargs = nil
-          self.debug { "subscribes to #{related_resource.ref}" }
+        end
+
+        ## Corrected syntax of debug statement to reflect the way this was called.
+        # i.e. before, after, subscribe, notify
+        self.debug do
+          relation = case self.class.name
+          when "subscribe"
+            "subscribes"
+          when "notify"
+            "notifies"
+          else
+            self.class.name
+          end
+
+          "#{relation} to #{related_resource.ref}"
         end
 
         Puppet::Relationship.new(source, target, subargs)

data/lib/puppet/type/cron.rb

@@ -12,7 +12,7 @@ Puppet::Type.newtype(:cron) do
     by Puppet with cron resources.
 
     If an existing crontab entry happens to match the scheduling and command of a
-    cron resource that has never been synched, Puppet will defer to the existing
+    cron resource that has never been synced, Puppet will defer to the existing
     crontab entry and will not create a new entry tagged with the `# Puppet Name: `
     comment.
 

data/lib/puppet/type/exec.rb

@@ -256,10 +256,11 @@ module Puppet
     end
 
     newparam(:environment) do
-      desc "Any additional environment variables you want to set for a
-        command.  Note that if you use this to set PATH, it will override
-        the `path` attribute.  Multiple environment variables should be
-        specified as an array."
+      desc "An array of any additional environment variables you want to set for a
+        command. e.g.: `[ 'HOME=/root', 'MAIL=root@example.com']`
+        Note that if you use this to set PATH, it will override the `path`
+        attribute. Multiple environment variables should be specified as an
+        array."
 
       validate do |values|
         values = [values] unless values.is_a? Array

data/lib/puppet/type/file.rb

@@ -829,11 +829,11 @@ Puppet::Type.newtype(:file) do
 
     @stat = begin
       Puppet::FileSystem.send(method, self[:path])
-    rescue Errno::ENOENT => error
+    rescue Errno::ENOENT
       nil
-    rescue Errno::ENOTDIR => error
+    rescue Errno::ENOTDIR
       nil
-    rescue Errno::EACCES => error
+    rescue Errno::EACCES
       warning _("Could not stat; permission denied")
       nil
     end

data/lib/puppet/type/file/checksum.rb

@@ -9,12 +9,18 @@ Puppet::Type.type(:file).newparam(:checksum) do
 
     The default checksum type is md5."
 
-  newvalues "md5", "md5lite", "sha256", "sha256lite", "mtime", "ctime", "none"
+  newvalues "md5", "md5lite", "sha224", "sha256", "sha256lite", "sha384", "sha512", "mtime", "ctime", "none"
 
   defaultto do
     Puppet[:digest_algorithm].to_sym
   end
 
+  validate do |value|
+    if Puppet::Util::Platform.fips_enabled? && (value == :md5 || value == :md5lite)
+      raise ArgumentError, _("MD5 is not supported in FIPS mode")
+    end
+  end
+
   def sum(content)
     content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
     type = digest_algorithm()

data/lib/puppet/type/file/checksum_value.rb

@@ -6,9 +6,10 @@ module Puppet
     include Puppet::Util::Checksums
     include Puppet::DataSync
 
-    desc "The checksum of the source contents. Only md5 and sha256 are supported when
-      specifying this parameter. If this parameter is set, source_permissions will be
-      assumed to be false, and ownership and permissions will not be read from source."
+    desc "The checksum of the source contents. Only md5, sha256, sha224, sha384 and sha512
+      are supported when specifying this parameter. If this parameter is set, 
+      source_permissions will be assumed to be false, and ownership and permissions
+      will not be read from source."
 
     def insync?(is)
       # If checksum_value and source are specified, manage the file contents.

data/lib/puppet/type/group.rb

@@ -36,6 +36,9 @@ module Puppet
       newvalue(:absent) do
         provider.delete
       end
+
+      defaultto :present
+
     end
 
     newproperty(:gid) do

data/lib/puppet/type/k5login.rb

@@ -1,5 +1,6 @@
 # Plug-in type for handling k5login files
 require 'puppet/util'
+require 'puppet/util/selinux'
 
 Puppet::Type.newtype(:k5login) do
   @doc = "Manage the `.k5login` file for a user.  Specify the full path to
@@ -31,10 +32,60 @@ Puppet::Type.newtype(:k5login) do
     defaultto { "644" }
   end
 
+  # To manage the selinux user of the file
+  newproperty(:seluser) do
+    desc "What the SELinux user component of the context of the file should be.
+      Any valid SELinux user component is accepted.  For example `user_u`.
+      If not specified it defaults to the value returned by matchpathcon for
+      the file, if any exists.  Only valid on systems with SELinux support
+      enabled."
+
+    defaultto { "user_u" }
+  end
+
+  # To manage the selinux role of the file
+  newproperty(:selrole) do
+    desc "What the SELinux role component of the context of the file should be.
+      Any valid SELinux role component is accepted.  For example `role_r`.
+      If not specified it defaults to the value returned by matchpathcon for
+      the file, if any exists.  Only valid on systems with SELinux support
+      enabled."
+
+    defaultto { "object_r" }
+  end
+
+  # To manage the selinux type of the file
+  newproperty(:seltype) do
+    desc "What the SELinux type component of the context of the file should be.
+      Any valid SELinux type component is accepted.  For example `tmp_t`.
+      If not specified it defaults to the value returned by matchpathcon for
+      the file, if any exists.  Only valid on systems with SELinux support
+      enabled."
+
+    # to my knowledge, `krb5_home_t` is the only valid type for .k5login
+    defaultto { "krb5_home_t" }
+  end
+
+  # To manage the selinux range of the file
+  newproperty(:selrange) do
+    desc "What the SELinux range component of the context of the file should be.
+      Any valid SELinux range component is accepted.  For example `s0` or
+      `SystemHigh`.  If not specified it defaults to the value returned by
+      matchpathcon for the file, if any exists.  Only valid on systems with
+      SELinux support enabled and that have support for MCS (Multi-Category
+      Security)."
+
+    defaultto { "s0" }
+  end
+
+  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # 
+
   provide(:k5login) do
     desc "The k5login provider is the only provider for the k5login
       type."
 
+    include Puppet::Util::SELinux
+
     # Does this file exist?
     def exists?
       Puppet::FileSystem.exist?(@resource[:name])
@@ -78,6 +129,56 @@ Puppet::Type.newtype(:k5login) do
       File.chmod(Integer("0#{value}"), @resource[:name])
     end
 
+    # Set the file seluser
+    def seluser
+      if selinux_support?
+        context = get_selinux_current_context(@resource[:name])
+        return parse_selinux_context(:seluser, context)
+      end
+    end
+
+    def seluser=(value)
+      set_selinux_context(@resource[:name], value, :seluser)
+    end
+
+    # Set the file selrole
+    def selrole
+      if selinux_support?
+        context = get_selinux_current_context(@resource[:name])
+        return parse_selinux_context(:selrole, context)
+      end
+    end
+
+    # Set the file seltype
+    def selrole=(value)
+      set_selinux_context(@resource[:name], value, :selrole)
+    end
+
+    # Set the file seltype
+    def seltype
+      if selinux_support?
+        context = get_selinux_current_context(@resource[:name])
+        return parse_selinux_context(:seltype, context)
+      end
+    end
+
+    # Set the file selrange
+    def seltype=(value)
+      set_selinux_context(@resource[:name], value, :seltype)
+    end
+
+    # Set the file selrange
+    def selrange
+      if selinux_support?
+        context = get_selinux_current_context(@resource[:name])
+        return parse_selinux_context(:selrange, context)
+      end
+    end
+
+    def selrange=(value)
+      set_selinux_context(@resource[:name], value, :selrange)
+    end
+
     private
     def write(value)
       Puppet::Util.replace_file(@resource[:name], 0644) do |f|

data/lib/puppet/type/macauthorization.rb

@@ -1,7 +1,7 @@
 Puppet::Type.newtype(:macauthorization) do
 
   @doc = "Manage the Mac OS X authorization database. See the
-    [Apple developer site](https://developer.apple.com/documentation/Security/Conceptual/Security_Overview/Security_Services/chapter_4_section_5.html)
+    [Apple developer site](https://developer.apple.com/library/content/documentation/Security/Conceptual/Security_Overview/AuthenticationAndAuthorization/AuthenticationAndAuthorization.html)
     for more information.
 
     Note that authorization store directives with hyphens in their names have

data/lib/puppet/type/mount.rb

@@ -173,8 +173,12 @@ module Puppet
 
     newproperty(:options) do
       desc "A single string containing options for the mount, as they would
-        appear in fstab. For many platforms this is a comma delimited string.
-        Consult the fstab(5) man page for system-specific details."
+        appear in fstab on Linux. For many platforms this is a comma-delimited
+        string. Consult the fstab(5) man page for system-specific details.
+        AIX options other than dev, nodename, or vfs can be defined here. If
+        specified, AIX options of account, boot, check, free, mount, size,
+        type, vol, log, and quota must be ordered alphabetically at the end of
+        the list."
 
       validate do |value|
         raise Puppet::Error, _("options must not contain whitespace: %{value}") % { value: value } if value =~ /\s/

data/lib/puppet/type/tidy.rb

@@ -267,8 +267,10 @@ Puppet::Type.newtype(:tidy) do
     end
     found_files = files.find_all { |path| tidy?(path) }.collect { |path| mkfile(path) }
     result = found_files.each { |file| debug "Tidying #{file.ref}" }.sort { |a,b| b[:path] <=> a[:path] }
-    #TRANSLATORS "Tidy" is a program name and should not be translated
-    notice _("Tidying %{count} files") % { count: found_files.size }
+    if found_files.size > 0
+      #TRANSLATORS "Tidy" is a program name and should not be translated
+      notice _("Tidying %{count} files") % { count: found_files.size }
+    end
 
     # No need to worry about relationships if we don't have rmdirs; there won't be
     # any directories.
@@ -331,10 +333,10 @@ Puppet::Type.newtype(:tidy) do
   def stat(path)
     begin
       Puppet::FileSystem.lstat(path)
-    rescue Errno::ENOENT => error
+    rescue Errno::ENOENT
       info _("File does not exist")
       return nil
-    rescue Errno::EACCES => error
+    rescue Errno::EACCES
       #TRANSLATORS "stat" is a program name and should not be translated
       warning _("Could not stat; permission denied")
       return nil

data/lib/puppet/type/user.rb

@@ -212,44 +212,13 @@ module Puppet
         * OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When managing passwords
           on these systems, the `salt` and `iterations` attributes need to be specified as
           well as the password.
-        * Windows passwords can be managed only in cleartext, because there is no Windows
-          API for setting the password hash.
+        * Windows passwords can only be managed in cleartext, as there is no Windows API
+          for setting the password hash.
 
         [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
 
         Enclose any value that includes a dollar sign ($) in single quotes (') to avoid
-        accidental variable interpolation.
-
-        To redact passwords from reports to PuppetDB, use the `Sensitive` data type. For
-        example, this resource protects the password:
-
-        ```puppet
-        user { 'foo':
-          ensure   => present,
-          password => Sensitive("my secret password")
-        }
-        ```
-
-        This results in the password being redacted from the report, as in the
-        `previous_value`, `desired_value`, and `message` fields below.
-
-        ```yaml
-            events:
-            - !ruby/object:Puppet::Transaction::Event
-              audited: false
-              property: password
-              previous_value: "[redacted]"
-              desired_value: "[redacted]"
-              historical_value:
-              message: changed [redacted] to [redacted]
-              name: :password_changed
-              status: success
-              time: 2017-05-17 16:06:02.934398293 -07:00
-              redacted: true
-              corrective_change: false
-            corrective_change: false
-        ```
-        }
+        accidental variable interpolation.}
 
       validate do |value|
         raise ArgumentError, _("Passwords cannot include ':'") if value.is_a?(String) and value.include?(":")
@@ -310,6 +279,25 @@ module Puppet
       end
     end
 
+    newproperty(:password_warn_days, :required_features => :manages_password_age) do
+      desc "The number of days before a password is going to expire (see the maximum password age) during which the user should be warned."
+
+      munge do |value|
+        case value
+        when String
+          Integer(value)
+        else
+          value
+        end
+      end
+
+      validate do |value|
+        if value.to_s !~ /^-?\d+$/
+          raise ArgumentError, "Password warning days must be provided as a number."
+        end
+      end
+    end
+
     newproperty(:groups, :parent => Puppet::Property::List) do
       desc "The groups to which the user belongs.  The primary group should
         not be listed, and groups should be identified by name rather than by
@@ -418,10 +406,9 @@ module Puppet
     end
 
     newproperty(:expiry, :required_features => :manages_expiry) do
-      desc "The expiry date for this user. Must be provided in
-           a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
-           If you want to ensure the user account never expires,
-           you can pass the special value `absent`."
+      desc "The expiry date for this user. Provide as either the special
+           value `absent` to ensure that the account never expires, or as
+           a zero-padded YYYY-MM-DD format -- for example, 2010-02-19."
 
       newvalues :absent
       newvalues /^\d{4}-\d{2}-\d{2}$/
@@ -785,7 +772,7 @@ module Puppet
         # the name is stored in the 4th capture of the regex
         name = $4
         if name.empty?
-          key = $3.delete("\n")
+          $3.delete("\n")
           # If no comment is specified for this key, generate a unique internal
           # name. This uses the same rules as
           # provider/ssh_authorized_key/parsed (PUP-3357)

data/lib/puppet/type/yumrepo.rb

@@ -104,6 +104,15 @@ Puppet::Type.newtype(:yumrepo) do
     munge(&munge_yum_bool)
   end
 
+  newproperty(:payload_gpgcheck) do
+    desc "Whether to check the GPG signature of the packages payload.
+      #{YUM_BOOLEAN_DOC}
+      #{ABSENT_DOC}"
+
+    newvalues(YUM_BOOLEAN, :absent)
+    munge(&munge_yum_bool)
+  end
+
   newproperty(:repo_gpgcheck) do
     desc "Whether to check the GPG signature on repodata.
       #{YUM_BOOLEAN_DOC}

data/lib/puppet/type/zfs.rb

@@ -20,6 +20,10 @@ parent zfs instances, the zfs resource will autorequire them."
       desc "The aclmode property. Valid values are `discard`, `groupmask`, `passthrough`."
     end
 
+    newproperty(:acltype) do
+      desc "The acltype propery. Valid values are 'noacl' and 'posixacl'. Only supported on Linux."
+    end
+
     newproperty(:atime) do
       desc "The atime property. Valid values are `on`, `off`."
     end