puppet 5.5.22 → 6.0.0

data/lib/puppet/pops/validation/validator_factory_4_0.rb

@@ -27,18 +27,15 @@ class ValidatorFactory_4_0 < Factory
     # Configure each issue that should **not** be an error
     #
     # Validate as per the current runtime configuration
-    p[Issues::RT_NO_STORECONFIGS_EXPORT]     = Puppet[:storeconfigs] ? :ignore : :warning
-    p[Issues::RT_NO_STORECONFIGS]            = Puppet[:storeconfigs] ? :ignore : :warning
+    p[Issues::RT_NO_STORECONFIGS_EXPORT]      = Puppet[:storeconfigs] ? :ignore : :warning
+    p[Issues::RT_NO_STORECONFIGS]             = Puppet[:storeconfigs] ? :ignore : :warning
 
-    p[Issues::FUTURE_RESERVED_WORD]          = :deprecation
-    p[Issues::DEPRECATED_APP_ORCHESTRATION]  = :deprecation
+    p[Issues::FUTURE_RESERVED_WORD]           = :deprecation
 
-    p[Issues::DUPLICATE_KEY]                 = Puppet[:strict] == :off ? :ignore : Puppet[:strict]
-    p[Issues::NAME_WITH_HYPHEN]              = :error
-    p[Issues::EMPTY_RESOURCE_SPECIALIZATION] = :ignore
-    p[Issues::CLASS_NOT_VIRTUALIZABLE]       = Puppet[:strict] == :off ? :warning : Puppet[:strict]
-    p[Issues::ILLEGAL_DEFINITION_LOCATION]   = :deprecation
-    p[Issues::ILLEGAL_TOP_CONSTRUCT_LOCATION]   = :deprecation
+    p[Issues::DUPLICATE_KEY]                  = Puppet[:strict] == :off ? :ignore : Puppet[:strict]
+    p[Issues::NAME_WITH_HYPHEN]               = :error
+    p[Issues::EMPTY_RESOURCE_SPECIALIZATION]  = :ignore
+    p[Issues::CLASS_NOT_VIRTUALIZABLE]        = Puppet[:strict] == :off ? :warning : Puppet[:strict]
     p
   end
 end

data/lib/puppet/property.rb

@@ -209,7 +209,7 @@ class Puppet::Property < Puppet::Parameter
       else
         return "#{name} changed #{is_to_s(current_value)} to #{should_to_s(newvalue)}"
       end
-    rescue Puppet::Error
+    rescue Puppet::Error, Puppet::DevError
       raise
     rescue => detail
       message = _("Could not convert change '%{name}' to string: %{detail}") % { name: name, detail: detail }

data/lib/puppet/property/ensure.rb

@@ -56,7 +56,7 @@ class Puppet::Property::Ensure < Puppet::Property
       else
         return _('%{name} changed %{is} to %{should}') % { name: name, is: is_to_s(currentvalue), should: should_to_s(newvalue) }
       end
-    rescue Puppet::Error
+    rescue Puppet::Error, Puppet::DevError
       raise
     rescue => detail
       raise Puppet::DevError, _("Could not convert change %{name} to string: %{detail}") % { name: self.name, detail: detail }, detail.backtrace

data/lib/puppet/provider.rb

@@ -278,7 +278,12 @@ class Puppet::Provider
   # @see Provider.defaultfor
   # @api private
   def self.default_match
-    @defaults.find do |default|
+    return nil if some_default_match(@notdefaults) # Blacklist means this provider cannot be a default
+    some_default_match(@defaults)
+  end
+
+  def self.some_default_match(defaultlist)
+    defaultlist.find do |default|
       default.all? do |key, values|
         case key
           when :feature
@@ -329,6 +334,10 @@ class Puppet::Provider
     @defaults << hash
   end
 
+  def self.notdefaultfor(hash)
+    @notdefaults << hash
+  end
+
   # @return [Integer] Returns a numeric specificity for this provider based on how many requirements it has
   #  and number of _ancestors_. The higher the number the more specific the provider.
   # The number of requirements is based on the hash size of the matching {Provider.defaultfor}.
@@ -346,6 +355,7 @@ class Puppet::Provider
     # complexity of a provider).
     match = default_match
     length = match ? match.length : 0
+
     (length * 100) + ancestors.select { |a| a.is_a? Class }.length
   end
 
@@ -353,6 +363,7 @@ class Puppet::Provider
   # @return [void]
   def self.initvars
     @defaults = []
+    @notdefaults = []
     @commands = {}
   end
 
@@ -384,7 +395,7 @@ class Puppet::Provider
   # @raise [Puppet::DevError] Error indicating that the method should have been implemented by subclass.
   # @see prefetch
   def self.instances
-    raise Puppet::DevError, _("To support listing resources of this type the '%{provider}' provider needs to implement an 'instances' class method returning the current set of resources. We recommend porting your module to the simpler Resource API instead: https://puppet.com/search/docs?keys=resource+api") % { provider: self.name }
+    raise Puppet::DevError, _("Provider %{provider} has not defined the 'instances' class method") % { provider: self.name }
   end
 
   # Creates getter- and setter- methods for each property supported by the resource type.
@@ -610,3 +621,4 @@ class Puppet::Provider
   # @return [void]
   # @api public
 end
+

data/lib/puppet/provider/exec.rb

@@ -4,72 +4,71 @@ require 'puppet/util/execution'
 class Puppet::Provider::Exec < Puppet::Provider
   include Puppet::Util::Execution
 
-  def environment
-    env = {}
-
-    if (path = resource[:path])
-      env[:PATH] = path.join(File::PATH_SEPARATOR)
-    end
-
-    return env unless (envlist = resource[:environment])
-
-    envlist = [envlist] unless envlist.is_a? Array
-    envlist.each do |setting|
-      unless (match = /^(\w+)=((.|\n)+)$/.match(setting))
-        warning _("Cannot understand environment setting %{setting}") % { setting: setting.inspect }
-        next
-      end
-      var = match[1]
-      value = match[2]
-
-      if env.include?(var) || env.include?(var.to_sym)
-        warning _("Overriding environment setting '%{var}' with '%{value}'") % { var: var, value: value }
-      end
-
-      env[var] = value
-    end
-
-    env
-  end
-
   def run(command, check = false)
     output = nil
     sensitive = resource.parameters[:command].sensitive
 
     checkexe(command)
 
-    debug "Executing#{check ? " check": ""} '#{sensitive ? '[redacted]' : command}'"
+    if dir = resource[:cwd]
+      unless File.directory?(dir)
+        if check
+          dir = nil
+        else
+          self.fail _("Working directory '%{dir}' does not exist") % { dir: dir }
+        end
+      end
+    end
 
-    # Ruby 2.1 and later interrupt execution in a way that bypasses error
-    # handling by default. Passing Timeout::Error causes an exception to be
-    # raised that can be rescued inside of the block by cleanup routines.
-    #
-    # This is backwards compatible all the way to Ruby 1.8.7.
-    Timeout::timeout(resource[:timeout], Timeout::Error) do
-      cwd = resource[:cwd]
-      # It's ok if cwd is nil. In that case Puppet::Util::Execution.execute() simply will not attempt to
-      # change the working directory, which is exactly the right behavior when no cwd parameter is
-      # expressed on the resource.  Moreover, attempting to change to the directory that is already
-      # the working directory can fail under some circumstances, so avoiding the directory change attempt
-      # is preferable to defaulting cwd to that directory.
+    dir ||= Dir.pwd
 
-      # note that we are passing "false" for the "override_locale" parameter, which ensures that the user's
-      # default/system locale will be respected.  Callers may override this behavior by setting locale-related
-      # environment variables (LANG, LC_ALL, etc.) in their 'environment' configuration.
-      output = Puppet::Util::Execution.execute(
-        command,
-        :failonfail => false,
-        :combine => true,
-        :cwd => cwd,
-        :uid => resource[:user], :gid => resource[:group],
-        :override_locale => false,
-        :custom_environment => environment(),
-        :sensitive => sensitive
-      )
-    end
-    # The shell returns 127 if the command is missing.
-    if output.exitstatus == 127
-      raise ArgumentError, output
+    debug "Executing#{check ? " check": ""} '#{sensitive ? '[redacted]' : command}'"
+    begin
+      # Do our chdir
+      Dir.chdir(dir) do
+        environment = {}
+
+        environment[:PATH] = resource[:path].join(File::PATH_SEPARATOR) if resource[:path]
+
+        if envlist = resource[:environment]
+          envlist = [envlist] unless envlist.is_a? Array
+          envlist.each do |setting|
+            if setting =~ /^(\w+)=((.|\n)+)$/
+              env_name = $1
+              value = $2
+              if environment.include?(env_name) || environment.include?(env_name.to_sym)
+                warning _("Overriding environment setting '%{env_name}' with '%{value}'") % { env_name: env_name, value: value }
+              end
+              environment[env_name] = value
+            else
+              warning _("Cannot understand environment setting %{setting}") % { setting: setting.inspect }
+            end
+          end
+        end
+
+        # Ruby 2.1 and later interrupt execution in a way that bypasses error
+        # handling by default. Passing Timeout::Error causes an exception to be
+        # raised that can be rescued inside of the block by cleanup routines.
+        #
+        # This is backwards compatible all the way to Ruby 1.8.7.
+        Timeout::timeout(resource[:timeout], Timeout::Error) do
+          # note that we are passing "false" for the "override_locale" parameter, which ensures that the user's
+          # default/system locale will be respected.  Callers may override this behavior by setting locale-related
+          # environment variables (LANG, LC_ALL, etc.) in their 'environment' configuration.
+          output = Puppet::Util::Execution.execute(command, :failonfail => false, :combine => true,
+                                  :uid => resource[:user], :gid => resource[:group],
+                                  :override_locale => false,
+                                  :custom_environment => environment,
+                                  :sensitive => sensitive)
+        end
+        # The shell returns 127 if the command is missing.
+        if output.exitstatus == 127
+          raise ArgumentError, output
+        end
+
+      end
+    rescue Errno::ENOENT => detail
+      self.fail Puppet::Error, detail.to_s, detail
     end
 
     # Return output twice as processstatus was returned before, but only exitstatus was ever called.
@@ -92,6 +91,6 @@ class Puppet::Provider::Exec < Puppet::Provider
   def validatecmd(command)
     exe = extractexe(command)
     # if we're not fully qualified, require a path
-    self.fail _("'%{exe}' is not qualified and no path was specified. Please qualify the command or specify a path.") % { exe: exe } if !absolute_path?(exe) and resource[:path].nil?
+    self.fail _("'%{command}' is not qualified and no path was specified. Please qualify the command or specify a path.") % { command: command } if !absolute_path?(exe) and resource[:path].nil?
   end
 end

data/lib/puppet/provider/file/posix.rb

@@ -8,11 +8,6 @@ Puppet::Type.type(:file).provide :posix do
   include Puppet::Util::Warnings
 
   require 'etc'
-  require 'puppet/util/selinux'
-
-  def self.post_resource_eval
-    Selinux.matchpathcon_fini if Puppet::Util::SELinux.selinux_support?
-  end
 
   def uid2name(id)
     return id.to_s if id.is_a?(Symbol) or id.is_a?(String)

data/lib/puppet/provider/file/windows.rb

@@ -6,7 +6,7 @@ Puppet::Type.type(:file).provide :windows do
 
   include Puppet::Util::Warnings
 
-  if Puppet.features.microsoft_windows?
+  if Puppet::Util::Platform.windows?
     require 'puppet/util/windows'
     include Puppet::Util::Windows::Security
   end
@@ -71,9 +71,7 @@ Puppet::Type.type(:file).provide :windows do
 
   def mode=(value)
     begin
-      managing_owner = !resource[:owner].nil?
-      managing_group = !resource[:group].nil?
-      set_mode(value.to_i(8), resource[:path], true, managing_owner, managing_group)
+      set_mode(value.to_i(8), resource[:path])
     rescue => detail
       error = Puppet::Error.new(_("failed to set mode %{mode} on %{path}: %{message}") % { mode: mode, path: resource[:path], message: detail.message })
       error.set_backtrace detail.backtrace
@@ -88,52 +86,6 @@ Puppet::Type.type(:file).provide :windows do
     end
   end
 
-  # munge the windows group permissions if the user or group are set to SYSTEM
-  #
-  # when SYSTEM user is the group or user and the resoure is not managing them then treat
-  # the resource as insync if System has FullControl access.
-  #
-  # @param [String] current - the current mode returned by the resource
-  # @param [String] should  - what the mode should be
-  #
-  # @return [String, nil] munged mode or nil if the resource should be out of sync
-  def munge_windows_system_group(current, should)
-    [
-      {
-        'type'        => 'group',
-        'resource'    => resource[:group],
-        'set_to_user' => group,
-        'fullcontrol' => "070".to_i(8),
-        'remove_mask' => "707".to_i(8),
-        'should_mask' => (should[0].to_i(8) & "070".to_i(8)),
-      },
-      {
-        'type'        => 'owner',
-        'resource'    => resource[:owner],
-        'set_to_user' => owner,
-        'fullcontrol' => "700".to_i(8),
-        'remove_mask' => "077".to_i(8),
-        'should_mask' => (should[0].to_i(8) & "700".to_i(8)),
-      }
-    ].each do |mode_part|
-      if mode_part['resource'].nil? && (mode_part['set_to_user'] == Puppet::Util::Windows::SID::LocalSystem)
-        if (current.to_i(8) & mode_part['fullcontrol']) == mode_part['fullcontrol']
-          # Since the group is LocalSystem, and the permissions are FullControl,
-          # replace the value returned with the value expected. This will treat
-          # this specific situation as "insync"
-          current = ( (current.to_i(8) & mode_part['remove_mask']) | mode_part['should_mask'] ).to_s(8).rjust(4, '0')
-        else
-          # If the SYSTEM account does _not_ have FullControl in this scenario, we should
-          # force the resource out of sync no matter what.
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-          Puppet.debug _("%{resource_name}: %{mode_part_type} set to SYSTEM. SYSTEM permissions cannot be set below FullControl ('7')") % { resource_name: resource[:name], mode_part_type: mode_part['type']}
-          return nil
-        end
-      end
-    end
-    current
-  end
-
   attr_reader :file
   private
   def file

data/lib/puppet/provider/group/aix.rb

@@ -57,14 +57,8 @@ Puppet::Type.type(:group).provide :aix, :parent => Puppet::Provider::AixObject d
     # Define some Puppet Property => AIX Attribute (and vice versa)
     # conversion functions here. This is so we can unit test them.
 
-    def members_to_users(provider, members)
-      members = members.split(',') if members.is_a?(String)
-      unless provider.resource[:auth_membership]
-        current_members = provider.members
-        current_members = [] if current_members == :absent
-        members = (members + current_members).uniq
-      end
-
+    def members_to_users(members)
+      return members unless members.is_a?(Array)
       members.join(',')
     end
 
@@ -85,14 +79,4 @@ Puppet::Type.type(:group).provide :aix, :parent => Puppet::Provider::AixObject d
   # the resource methods (property getters + setters for our mapped
   # properties + a getter for the attributes property).
   mk_resource_methods
-
-  # We could add this to the top-level members property since the
-  # implementation is not platform-specific; however, it is best
-  # to do it this way so that we do not accidentally break something.
-  # This is ok for now, since we do plan on moving this and the
-  # auth_membership management over to the property class in a future
-  # Puppet release.
-  def members_insync?(current, should)
-    current.sort == @resource.parameter(:members).actual_should(current, should)
-  end
 end

data/lib/puppet/provider/group/groupadd.rb

@@ -28,9 +28,25 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     get(:gid)
   end
 
+  def findgroup(key, value)
+    group_file = "/etc/group"
+    group_keys = ['group_name', 'password', 'gid', 'user_list']
+    index = group_keys.index(key)
+    File.open(group_file) do |f|
+      f.each_line do |line|
+         group = line.split(":")
+         if group[index] == value
+             f.close
+             return group
+         end
+      end
+    end
+    false
+  end
+
   def localgid
-    group = findgroup(:group_name, resource[:name])
-    return group[:gid] if group
+    group = findgroup('group_name', resource[:name])
+    return group[2] if group
     false
   end
 
@@ -40,7 +56,7 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     # to ensure consistent behaviour of the useradd provider when
     # using both useradd and luseradd
     if not @resource.allowdupe? and @resource.forcelocal?
-       if @resource.should(:gid) and findgroup(:gid, @resource.should(:gid).to_s)
+       if @resource.should(:gid) and findgroup('gid', @resource.should(:gid).to_s)
            raise(Puppet::Error, _("GID %{resource} already exists, use allowdupe to force group creation") % { resource: @resource.should(:gid).to_s })
        end
     elsif @resource.allowdupe? and not @resource.forcelocal?
@@ -92,20 +108,4 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
       [command(:delete), @resource[:name]]
     end
   end
-
-  private
-
-  def findgroup(key, value)
-    group_file = "/etc/group"
-    group_keys = [:group_name, :password, :gid, :user_list]
-    index = group_keys.index(key)
-    @group_content ||= File.read(group_file)
-    @group_content.each_line do |line|
-      group = line.split(":")
-      if group[index] == value
-        return Hash[group_keys.zip(group)]
-      end
-    end
-    false
-  end
 end

data/lib/puppet/provider/group/windows_adsi.rb

@@ -23,12 +23,9 @@ Puppet::Type.type(:group).provide :windows_adsi do
     # Cannot use munge of the group property to canonicalize @should
     # since the default array_matching comparison is not commutative
 
+    current_sids = current.map(&:sid)
     # dupes automatically weeded out when hashes built
-    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current, true)
-    specified_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
-
-    current_sids = current_members.keys.to_a
-    specified_sids = specified_members.keys.to_a
+    specified_sids = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should).keys.to_a
 
     if @resource[:auth_membership]
       current_sids.sort == specified_sids.sort
@@ -52,7 +49,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
         account = sid.account
       end
       resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
-      sid.domain ? "#{sid.domain}\\#{account}" : account
+      "#{sid.domain}\\#{account}"
     end
     return users.join(',')
   end
@@ -66,11 +63,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
   end
 
   def members
-    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members, true)
-
-    # @members.keys returns an array of SIDs. We need to convert those SIDs into
-    # names so that `puppet resource` prints the right output.
-    members_to_s(@members.keys).split(',')
+    group.members
   end
 
   def members=(members)

data/lib/puppet/provider/nameservice.rb

@@ -172,10 +172,9 @@ class Puppet::Provider::NameService < Puppet::Provider
     end
 
     begin
-      sensitive = has_sensitive_data?
-      execute(self.addcmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment, :sensitive => sensitive})
+      execute(self.addcmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment})
       if feature?(:manages_password_age) && (cmd = passcmd)
-        execute(cmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment, :sensitive => sensitive})
+        execute(cmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment})
       end
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, _("Could not create %{resource} %{name}: %{detail}") % { resource: @resource.class.name, name: @resource.name, detail: detail }, detail.backtrace
@@ -248,7 +247,31 @@ class Puppet::Provider::NameService < Puppet::Provider
   # The list of all groups the user is a member of.  Different
   # user mgmt systems will need to override this method.
   def groups
-    Puppet::Util::POSIX.groups_of(@resource[:name]).join(',')
+    groups = []
+
+    # Reset our group list
+    Puppet::Etc.setgrent
+
+    user = @resource[:name]
+
+    # Now iterate across all of the groups, adding each one our
+    # user is a member of
+    while group = Puppet::Etc.getgrent
+      members = group.mem
+
+      groups << group.name if members.include? user
+    end
+
+    # We have to close the file, so each listing is a separate
+    # reading of the file.
+    Puppet::Etc.endgrent
+
+    uniq_groups = groups.uniq
+    if groups != uniq_groups
+      debug("Removing any duplicate group entries")
+    end
+    # remove any double listed groups
+    uniq_groups.join(",")
   end
 
   # Convert the Etc struct into a hash.
@@ -277,19 +300,13 @@ class Puppet::Provider::NameService < Puppet::Provider
     self.class.validate(param, value)
     cmd = modifycmd(param, munge(param, value))
     raise Puppet::DevError, _("Nameservice command must be an array") unless cmd.is_a?(Array)
-    sensitive = has_sensitive_data?(param)
     begin
-      execute(cmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment, :sensitive => sensitive})
+      execute(cmd, {:failonfail => true, :combine => true, :custom_environment => @custom_environment})
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, _("Could not set %{param} on %{resource}[%{name}]: %{detail}") % { param: param, resource: @resource.class.name, name: @resource.name, detail: detail }, detail.backtrace
     end
   end
 
-  #Derived classes can override to declare sensitive data so a flag can be passed to execute
-  def has_sensitive_data?(property = nil)
-    false
-  end
-
   # From overriding Puppet::Property#insync? Ruby Etc::getpwnam < 2.1.0 always
   # returns a struct with binary encoded string values, and >= 2.1.0 will return
   # binary encoded strings for values incompatible with current locale charset,