puppet 5.5.16 → 5.5.21

data/lib/puppet/pops/types/type_calculator.rb

@@ -120,6 +120,30 @@ class TypeCalculator
     singleton.infer(o)
   end
 
+  # Infers a type if given object may have callable members, else returns nil.
+  # Caller must check for nil or if returned type supports members.
+  # This is a much cheaper call than doing a call to the general infer(o) method.
+  #
+  # @api private
+  def self.infer_callable_methods_t(o)
+    # If being a value that cannot have Pcore based methods callable from Puppet Language
+    if (o.is_a?(String) ||
+      o.is_a?(Numeric) ||
+      o.is_a?(TrueClass) ||
+      o.is_a?(FalseClass) ||
+      o.is_a?(Regexp) ||
+      o.instance_of?(Array) ||
+      o.instance_of?(Hash) ||
+      Types::PUndefType::DEFAULT.instance?(o)
+      )
+      return nil
+    end
+    # For other objects (e.g. PObjectType instances, and runtime types) full inference needed, since that will
+    # cover looking into the runtime type registry.
+    #
+    infer(o)
+  end
+
   # @api public
   def self.generalize(o)
     singleton.generalize(o)

data/lib/puppet/pops/types/types.rb

@@ -340,7 +340,7 @@ class PAnyType < TypedModelObject
   # @raises ArgumentError
   #
   def self.new_function(type)
-    raise ArgumentError.new("Creation of new instance of type '#{type.to_s}' is not supported")
+    raise ArgumentError.new("Creation of new instance of type '#{type}' is not supported")
   end
 
   # Answers the question if instances of this type can represent themselves as a string that
@@ -1268,7 +1268,7 @@ class PFloatType < PNumericType
         else
           begin
             # support a binary as float
-            if from[0] == '0' && from[1].downcase == 'b'
+            if from[0] == '0' && from[1].casecmp('b').zero?
               from = Integer(from)
             end
             Float(from)
@@ -1699,7 +1699,7 @@ class PRegexpType < PScalarType
   # @param regexp [Regexp] the regular expression
   # @return [String] the Regexp as a slash delimited string with slashes escaped
   def self.regexp_to_s_with_delimiters(regexp)
-    regexp.options == 0 ? regexp.inspect : "/#{regexp.to_s}/"
+    regexp.options == 0 ? regexp.inspect : "/#{regexp}/"
   end
 
   # @param regexp [Regexp] the regular expression

data/lib/puppet/pops/validation/checker4_0.rb

@@ -194,6 +194,11 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     end
   end
 
+  def check_Application(o)
+    check_NamedDefinition(o)
+    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
+  end
+
   def check_AssignmentExpression(o)
     case o.operator
     when '='
@@ -291,6 +296,7 @@ class Checker4_0 < Evaluator::LiteralEvaluator
   end
 
   def check_CapabilityMapping(o)
+    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
     ok =
     case o.component
     when Model::QualifiedReference
@@ -850,6 +856,10 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     rvalue(o.matching_expr)
   end
 
+  def check_SiteDefinition(o)
+    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
+  end
+
   def check_UnaryExpression(o)
     rvalue(o.expr)
   end

data/lib/puppet/pops/validation/validator_factory_4_0.rb

@@ -31,6 +31,7 @@ class ValidatorFactory_4_0 < Factory
     p[Issues::RT_NO_STORECONFIGS]            = Puppet[:storeconfigs] ? :ignore : :warning
 
     p[Issues::FUTURE_RESERVED_WORD]          = :deprecation
+    p[Issues::DEPRECATED_APP_ORCHESTRATION]  = :deprecation
 
     p[Issues::DUPLICATE_KEY]                 = Puppet[:strict] == :off ? :ignore : Puppet[:strict]
     p[Issues::NAME_WITH_HYPHEN]              = :error

data/lib/puppet/property.rb

@@ -209,7 +209,7 @@ class Puppet::Property < Puppet::Parameter
       else
         return "#{name} changed #{is_to_s(current_value)} to #{should_to_s(newvalue)}"
       end
-    rescue Puppet::Error, Puppet::DevError
+    rescue Puppet::Error
       raise
     rescue => detail
       message = _("Could not convert change '%{name}' to string: %{detail}") % { name: name, detail: detail }

data/lib/puppet/property/ensure.rb

@@ -56,7 +56,7 @@ class Puppet::Property::Ensure < Puppet::Property
       else
         return _('%{name} changed %{is} to %{should}') % { name: name, is: is_to_s(currentvalue), should: should_to_s(newvalue) }
       end
-    rescue Puppet::Error, Puppet::DevError
+    rescue Puppet::Error
       raise
     rescue => detail
       raise Puppet::DevError, _("Could not convert change %{name} to string: %{detail}") % { name: self.name, detail: detail }, detail.backtrace

data/lib/puppet/provider/augeas/augeas.rb

@@ -103,7 +103,7 @@ Puppet::Type.type(:augeas).provide(:augeas) do
             inSingleTick = !inSingleTick if ch == "'"
             inDoubleTick = !inDoubleTick if ch == "\""
             fail(_("unmatched [")) if nbracket < 0
-          end until ((nbracket == 0 && !inSingleTick && !inDoubleTick && (ch =~ /\s/)) || sc.eos?)
+          end until ((nbracket == 0 && !inSingleTick && !inDoubleTick && (ch =~ /\s/)) || sc.eos?) # rubocop:disable Lint/Loop
             len = sc.pos - start
             len -= 1 unless sc.eos?
           unless p = sc.string[start, len]

data/lib/puppet/provider/cron/crontab.rb

@@ -212,7 +212,7 @@ Puppet::Type.type(:cron).provide(:crontab, :parent => Puppet::Provider::ParsedFi
         else
           cmd_string = record[:command].gsub(/\s+/, "_")
           index = ( @name_index += 1 )
-          record[:name] = "unmanaged:#{cmd_string}-#{ index.to_s }"
+          record[:name] = "unmanaged:#{cmd_string}-#{ index }"
           record[:unmanaged] = true
         end
         if envs.nil? or envs.empty?

data/lib/puppet/provider/exec.rb

@@ -47,7 +47,11 @@ class Puppet::Provider::Exec < Puppet::Provider
     # This is backwards compatible all the way to Ruby 1.8.7.
     Timeout::timeout(resource[:timeout], Timeout::Error) do
       cwd = resource[:cwd]
-      cwd ||= Dir.pwd
+      # It's ok if cwd is nil. In that case Puppet::Util::Execution.execute() simply will not attempt to
+      # change the working directory, which is exactly the right behavior when no cwd parameter is
+      # expressed on the resource.  Moreover, attempting to change to the directory that is already
+      # the working directory can fail under some circumstances, so avoiding the directory change attempt
+      # is preferable to defaulting cwd to that directory.
 
       # note that we are passing "false" for the "override_locale" parameter, which ensures that the user's
       # default/system locale will be respected.  Callers may override this behavior by setting locale-related
@@ -88,6 +92,6 @@ class Puppet::Provider::Exec < Puppet::Provider
   def validatecmd(command)
     exe = extractexe(command)
     # if we're not fully qualified, require a path
-    self.fail _("'%{command}' is not qualified and no path was specified. Please qualify the command or specify a path.") % { command: command } if !absolute_path?(exe) and resource[:path].nil?
+    self.fail _("'%{exe}' is not qualified and no path was specified. Please qualify the command or specify a path.") % { exe: exe } if !absolute_path?(exe) and resource[:path].nil?
   end
 end

data/lib/puppet/provider/file/posix.rb

@@ -8,6 +8,11 @@ Puppet::Type.type(:file).provide :posix do
   include Puppet::Util::Warnings
 
   require 'etc'
+  require 'puppet/util/selinux'
+
+  def self.post_resource_eval
+    Selinux.matchpathcon_fini if Puppet::Util::SELinux.selinux_support?
+  end
 
   def uid2name(id)
     return id.to_s if id.is_a?(Symbol) or id.is_a?(String)

data/lib/puppet/provider/group/groupadd.rb

@@ -28,25 +28,9 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     get(:gid)
   end
 
-  def findgroup(key, value)
-    group_file = "/etc/group"
-    group_keys = ['group_name', 'password', 'gid', 'user_list']
-    index = group_keys.index(key)
-    File.open(group_file) do |f|
-      f.each_line do |line|
-         group = line.split(":")
-         if group[index] == value
-             f.close
-             return group
-         end
-      end
-    end
-    false
-  end
-
   def localgid
-    group = findgroup('group_name', resource[:name])
-    return group[2] if group
+    group = findgroup(:group_name, resource[:name])
+    return group[:gid] if group
     false
   end
 
@@ -56,7 +40,7 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     # to ensure consistent behaviour of the useradd provider when
     # using both useradd and luseradd
     if not @resource.allowdupe? and @resource.forcelocal?
-       if @resource.should(:gid) and findgroup('gid', @resource.should(:gid).to_s)
+       if @resource.should(:gid) and findgroup(:gid, @resource.should(:gid).to_s)
            raise(Puppet::Error, _("GID %{resource} already exists, use allowdupe to force group creation") % { resource: @resource.should(:gid).to_s })
        end
     elsif @resource.allowdupe? and not @resource.forcelocal?
@@ -108,4 +92,20 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
       [command(:delete), @resource[:name]]
     end
   end
+
+  private
+
+  def findgroup(key, value)
+    group_file = "/etc/group"
+    group_keys = [:group_name, :password, :gid, :user_list]
+    index = group_keys.index(key)
+    @group_content ||= File.read(group_file)
+    @group_content.each_line do |line|
+      group = line.split(":")
+      if group[index] == value
+        return Hash[group_keys.zip(group)]
+      end
+    end
+    false
+  end
 end

data/lib/puppet/provider/group/windows_adsi.rb

@@ -24,7 +24,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
     # since the default array_matching comparison is not commutative
 
     # dupes automatically weeded out when hashes built
-    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current)
+    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current, true)
     specified_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
 
     current_sids = current_members.keys.to_a
@@ -52,7 +52,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
         account = sid.account
       end
       resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
-      "#{sid.domain}\\#{account}"
+      sid.domain ? "#{sid.domain}\\#{account}" : account
     end
     return users.join(',')
   end
@@ -66,7 +66,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
   end
 
   def members
-    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members)
+    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members, true)
 
     # @members.keys returns an array of SIDs. We need to convert those SIDs into
     # names so that `puppet resource` prints the right output.

data/lib/puppet/provider/mailalias/aliases.rb

@@ -12,7 +12,7 @@ Puppet::Type.type(:mailalias).provide(
   record_line :aliases, :fields => %w{name recipient}, :separator => /\s*:\s*/, :block_eval => :instance do
     def post_parse(record)
       if record[:recipient]
-	record[:recipient] = record[:recipient].split(/\s*,\s*/).collect { |d| d.gsub(/^['"]|['"]$/, '') }
+        record[:recipient] = record[:recipient].split(/\s*,\s*(?=(?:[^\"]*\"[^\"]*\")*[^\"]*$)/).collect { |d| d.gsub(/^['"]|['"]$/, '') }
       end
       record
     end

data/lib/puppet/provider/mount.rb

@@ -30,7 +30,7 @@ module Puppet::Provider::Mount
     supports_remounts = (resource[:remounts] == :true)
     if supports_remounts && os == 'AIX'
       remount_with_option("remount")
-    elsif os.match(/^(FreeBSD|DragonFly|OpenBSD)$/)
+    elsif os =~ /^(FreeBSD|DragonFly|OpenBSD)$/
       remount_with_option("update")
     elsif supports_remounts
       mountcmd "-o", "remount", resource[:name]

data/lib/puppet/provider/mount/parsed.rb

@@ -56,15 +56,15 @@ Puppet::Type.type(:mount).provide(
       filesystem_index = 0
       ret = Array.new
       lines.each_with_index do |line,i|
-        if line.match(%r{^\S+:})
+        if line =~ %r{^\S+:}
           # Begin new filesystem stanza and save the index
           ret[filesystem_index] = filesystem_stanza.join("\n") if filesystem_stanza
           filesystem_stanza = Array(line)
           filesystem_index = i
           # Eat the preceding blank line
-          ret[i-1] = nil if i > 0 and ret[i-1] and ret[i-1].match(%r{^\s*$})
+          ret[i-1] = nil if i > 0 and ret[i-1] and ret[i-1] =~ %r{^\s*$}
           nil
-        elsif line.match(%r{^(\s*\*.*|\s*)$})
+        elsif line =~ %r{^(\s*\*.*|\s*)$}
           # Just a comment or blank line; add in place
           ret[i] = line
         else
@@ -75,7 +75,7 @@ Puppet::Type.type(:mount).provide(
       # Add the final stanza to the return
       ret[filesystem_index] = filesystem_stanza.join("\n") if filesystem_stanza
       ret = ret.compact.flatten
-      ret.reject { |line| line.match(/^\* HEADER/) }
+      ret.reject { |line| line =~ /^\* HEADER/ }
     end
     def self.header
       super.gsub(/^#/,'*')
@@ -104,7 +104,7 @@ Puppet::Type.type(:mount).provide(
         special_options = Array.new
         result[:name] = memo[:name].sub(%r{:\s*$},'').strip
         memo.each do |_,k_v|
-          if k_v and k_v.is_a?(String) and k_v.match("=")
+          if k_v and k_v.is_a?(String) and k_v.include?("=")
             attr_name, attr_value = k_v.split("=",2).map(&:strip)
             if attr_map_name = property_map[attr_name.to_sym]
               # These are normal "options" options (see `man filesystems`)
@@ -135,10 +135,10 @@ Puppet::Type.type(:mount).provide(
       def to_line(result)
         output = Array.new
         output << "#{result[:name]}:"
-        if result[:device] and result[:device].match(%r{^/})
+        if result[:device] and result[:device] =~ %r{^/}
           output << "\tdev\t\t= #{result[:device]}"
         elsif result[:device] and result[:device] != :absent
-          if ! result[:device].match(%{^.+:/})
+          if ! result[:device] =~ %{^.+:/}
             # Just skip this entry; it was malformed to begin with
             Puppet.err _("Mount[%{name}]: Field 'device' must be in the format of <absolute path> or <host>:<absolute path>") % { name: result[:name] }
             return result[:line]
@@ -161,7 +161,7 @@ Puppet::Type.type(:mount).provide(
         if result[:options]
           options = result[:options].split(',')
           special_options = options.select do |x|
-            x.match('=') and
+            x.include?('=') and
               ["account", "boot", "check", "free", "mount", "size", "type",
                "vol", "log", "quota"].include? x.split('=').first
           end

data/lib/puppet/provider/nameservice.rb

@@ -172,9 +172,10 @@ class Puppet::Provider::NameService < Puppet::Provider
     end
 
     begin
-      execute(self.addcmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment})
+      sensitive = has_sensitive_data?
+      execute(self.addcmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment, :sensitive => sensitive})
       if feature?(:manages_password_age) && (cmd = passcmd)
-        execute(cmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment})
+        execute(cmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment, :sensitive => sensitive})
       end
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, _("Could not create %{resource} %{name}: %{detail}") % { resource: @resource.class.name, name: @resource.name, detail: detail }, detail.backtrace
@@ -276,13 +277,19 @@ class Puppet::Provider::NameService < Puppet::Provider
     self.class.validate(param, value)
     cmd = modifycmd(param, munge(param, value))
     raise Puppet::DevError, _("Nameservice command must be an array") unless cmd.is_a?(Array)
+    sensitive = has_sensitive_data?(param)
     begin
-      execute(cmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment})
+      execute(cmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment, :sensitive => sensitive})
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, _("Could not set %{param} on %{resource}[%{name}]: %{detail}") % { param: param, resource: @resource.class.name, name: @resource.name, detail: detail }, detail.backtrace
     end
   end
 
+  #Derived classes can override to declare sensitive data so a flag can be passed to execute
+  def has_sensitive_data?(property = nil)
+    false
+  end
+
   # From overriding Puppet::Property#insync? Ruby Etc::getpwnam < 2.1.0 always
   # returns a struct with binary encoded string values, and >= 2.1.0 will return
   # binary encoded strings for values incompatible with current locale charset,

data/lib/puppet/provider/nameservice/directoryservice.rb

@@ -289,7 +289,7 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
     end
     dscl_out = dscl(dscl_args)
     # We're ok with throwing away negative uids here.
-    ids = dscl_out.split.compact.collect { |l| l.to_i if l.match(/^\d+$/) }
+    ids = dscl_out.split.compact.collect { |l| l.to_i if l =~ /^\d+$/ }
     ids.compact!.sort! { |a,b| a.to_f <=> b.to_f }
     # We're just looking for an unused id in our sorted array.
     ids.each_index do |i|

data/lib/puppet/provider/nameservice/pw.rb

@@ -3,13 +3,13 @@ require 'puppet/provider/nameservice/objectadd'
 class Puppet::Provider::NameService
   class PW < ObjectAdd
     def deletecmd
-      [command(:pw), "#{@resource.class.name.to_s}del", @resource[:name]]
+      [command(:pw), "#{@resource.class.name}del", @resource[:name]]
     end
 
     def modifycmd(param, value)
       cmd = [
           command(:pw),
-          "#{@resource.class.name.to_s}mod",
+          "#{@resource.class.name}mod",
           @resource[:name],
           flag(param),
           munge(param, value)

data/lib/puppet/provider/package/aix.rb

@@ -29,6 +29,15 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
 
   attr_accessor   :latest_info
 
+  STATE_CODE = {
+    'A' => :applied,
+    'B' => :broken,
+    'C' => :committed,
+    'E' => :efix_locked,
+    'O' => :obsolete,
+    '?' => :inconsistent,
+  }.freeze
+
   def self.srclistcmd(source)
     [ command(:installp), "-L", "-d", source ]
   end
@@ -96,6 +105,11 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
     if output =~ /^#{Regexp.escape(@resource[:name])}\s+.*\s+Already superseded by.*$/
       self.fail _("aix package provider is unable to downgrade packages")
     end
+
+    pkg_info = query
+    if pkg_info && [:broken, :inconsistent].include?(pkg_info[:status])
+      self.fail _("Package '%{name}' is in a %{status} state and requires manual intervention") % { name: @resource[:name], status: pkg_info[:status] }
+    end
   end
 
   def self.pkglist(hash = {})
@@ -106,8 +120,9 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
     end
 
     begin
-      list = execute(cmd).scan(/^[^#][^:]*:([^:]*):([^:]*)/).collect { |n,e|
-        { :name => n, :ensure => e, :provider => self.name }
+      list = execute(cmd).scan(/^[^#][^:]*:([^:]*):([^:]*):[^:]*:[^:]*:([^:])/).collect { |n,e,s|
+        e = :absent if [:broken, :inconsistent].include?(STATE_CODE[s])
+        { :name => n, :ensure => e, :status => STATE_CODE[s], :provider => self.name }
       }
     rescue Puppet::ExecutionFailure => detail
       if hash[:pkgname]

data/lib/puppet/provider/package/apt.rb

@@ -70,7 +70,12 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
     cmd += install_options if @resource[:install_options]
     cmd << :install << str
 
-    aptget(*cmd)
+    self.unhold if self.properties[:mark] == :hold
+    begin
+      aptget(*cmd)
+    ensure
+      self.hold if @resource[:mark] == :hold
+    end
   end
 
   # What's the latest package version available?
@@ -100,12 +105,18 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
 
   def uninstall
     self.run_preseed if @resource[:responsefile]
-    aptget "-y", "-q", :remove, @resource[:name]
+    args = ['-y', '-q']
+    args << '--allow-change-held-packages' if self.properties[:mark] == :hold
+    args << :remove << @resource[:name]
+    aptget(*args)
   end
 
   def purge
     self.run_preseed if @resource[:responsefile]
-    aptget '-y', '-q', :remove, '--purge', @resource[:name]
+    args = ['-y', '-q']
+    args << '--allow-change-held-packages' if self.properties[:mark] == :hold
+    args << :remove << '--purge' << @resource[:name]
+    aptget(*args)
     # workaround a "bug" in apt, that already removed packages are not purged
     super
   end