puppet 5.5.22 → 6.0.0

data/lib/puppet/util/windows/sid.rb

@@ -46,7 +46,6 @@ module Puppet::Util::Windows
     PrintOperators              = 'S-1-5-32-550'
     BackupOperators             = 'S-1-5-32-551'
     Replicators                 = 'S-1-5-32-552'
-    AllAppPackages              = 'S-1-15-2-1'
 
     # Convert an account name, e.g. 'Administrators' into a SID string,
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',
@@ -64,7 +63,7 @@ module Puppet::Util::Windows
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
     # SID object. Returns nil if the account doesn't exist.
     # This method returns a SID::Principal with the account, domain, SID, etc
-    def name_to_principal(name, allow_unresolved = false)
+    def name_to_principal(name)
       # Apparently, we accept a symbol..
       name = name.to_s.strip if name
 
@@ -79,7 +78,7 @@ module Puppet::Util::Windows
 
       raw_sid_bytes ? Principal.lookup_account_sid(raw_sid_bytes) : Principal.lookup_account_name(name)
     rescue
-      (allow_unresolved && raw_sid_bytes) ? unresolved_principal(name, raw_sid_bytes) : nil
+      nil
     end
     module_function :name_to_principal
     class << self; alias name_to_sid_object name_to_principal; end
@@ -236,7 +235,7 @@ module Puppet::Util::Windows
     # @api private
     def self.unresolved_principal(name, sid_bytes)
       Principal.new(
-        name, # account
+        name + " (unresolvable)", # account
         sid_bytes, # sid_bytes
         name, # sid string
         nil, #domain

data/lib/puppet/util/windows/user.rb

@@ -8,11 +8,13 @@ module Puppet::Util::Windows::User
   extend FFI::Library
 
   def admin?
-    return false unless check_token_membership
+    elevated_supported = Puppet::Util::Windows::Process.supports_elevated_security?
 
     # if Vista or later, check for unrestricted process token
-    elevated_supported = Puppet::Util::Windows::Process.supports_elevated_security?
-    return elevated_supported ? Puppet::Util::Windows::Process.elevated_security? : true
+    return Puppet::Util::Windows::Process.elevated_security? if elevated_supported
+
+    # otherwise 2003 or less
+    check_token_membership
   end
   module_function :admin?
 
@@ -75,18 +77,15 @@ module Puppet::Util::Windows::User
   module_function :password_is?
 
   def logon_user(name, password, &block)
-    fLOGON32_PROVIDER_DEFAULT = 0
-    fLOGON32_LOGON_INTERACTIVE = 2
     fLOGON32_LOGON_NETWORK = 3
+    fLOGON32_PROVIDER_DEFAULT = 0
 
     token = nil
     begin
       FFI::MemoryPointer.new(:handle, 1) do |token_pointer|
-        #try logon using network else try logon using interactive mode
-        if logon_user_by_logon_type(name, password, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
-          if logon_user_by_logon_type(name, password, fLOGON32_LOGON_INTERACTIVE, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(_("Failed to logon user %{name}") % {name: name.inspect})
-          end
+        if LogonUserW(wide_string(name), wide_string('.'), password.nil? ? FFI::Pointer::NULL : wide_string(password),
+            fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
+          raise Puppet::Util::Windows::Error.new(_("Failed to logon user %{name}") % { name: name.inspect })
         end
 
         yield token = token_pointer.read_handle
@@ -98,15 +97,8 @@ module Puppet::Util::Windows::User
     # token has been closed by this point
     true
   end
-
   module_function :logon_user
 
-  def self.logon_user_by_logon_type(name, password, logon_type, logon_provider, token)
-    LogonUserW(wide_string(name), wide_string('.'), password.nil? ? FFI::Pointer::NULL : wide_string(password), logon_type, logon_provider, token)
-  end
-
-  private_class_method :logon_user_by_logon_type
-
   def load_profile(user, password)
     logon_user(user, password) do |token|
       FFI::MemoryPointer.from_string_to_wide_string(user) do |lpUserName|

data/lib/puppet/util/yaml.rb

@@ -1,15 +1,51 @@
 require 'yaml'
 
 module Puppet::Util::Yaml
-  if defined?(::Psych::SyntaxError)
-    YamlLoadExceptions = [::StandardError, ::Psych::SyntaxError]
-  else
-    YamlLoadExceptions = [::StandardError]
-  end
+  YamlLoadExceptions = [::StandardError, ::Psych::Exception]
 
   class YamlLoadError < Puppet::Error; end
 
+  # Safely load the content as YAML. By default only the following
+  # classes can be deserialized:
+  #
+  # * TrueClass
+  # * FalseClass
+  # * NilClass
+  # * Numeric
+  # * String
+  # * Array
+  # * Hash
+  #
+  # Attempting to deserialize other classes will raise an YamlLoadError
+  # exception unless they are specified in the array of *allowed_classes*.
+  # @param [String] yaml The yaml content to parse.
+  # @param [Array] allowed_classes Additional list of classes that can be deserialized.
+  # @param [String] filename The filename to load from, used if an exception is raised.
+  # @raise [YamlLoadException] If deserialization fails.
+  # @return The parsed YAML, which can be Hash, Array or scalar types.
+  def self.safe_load(yaml, allowed_classes = [], filename = nil)
+    data = YAML.safe_load(yaml, allowed_classes, [], true, filename)
+    data = false if data.nil?
+    data
+  rescue ::Psych::DisallowedClass => detail
+    path = filename ? "(#{filename})" : "(<unknown>)"
+    raise YamlLoadError.new("#{path}: #{detail.message}", detail)
+  rescue *YamlLoadExceptions => detail
+    raise YamlLoadError.new(detail.message, detail)
+  end
+
+  # Safely load the content from a file as YAML.
+  #
+  # @see Puppet::Util::Yaml.safe_load
+  def self.safe_load_file(filename, allowed_classes = [])
+    yaml = Puppet::FileSystem.read(filename, :encoding => 'bom|utf-8')
+    safe_load(yaml, allowed_classes, filename)
+  end
+
+  # @deprecated Use {#safe_load_file} instead.
   def self.load_file(filename, default_value = false, strip_classes = false)
+    Puppet.deprecation_warning(_("Puppet::Util::Yaml.load_file is deprecated. Use safe_load_file instead."))
+
     if(strip_classes) then
       data = YAML::parse_file(filename)
       data.root.each do |o|

data/lib/puppet/vendor.rb

@@ -45,7 +45,7 @@ module Puppet
       #
       def load_vendored
         Dir.entries(vendor_dir).each do |entry|
-          if entry =~ /load_(\w+?)\.rb$/
+          if entry.match(/load_(\w+?)\.rb$/)
             load_entry entry
           end
         end

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '5.5.22'
+  PUPPETVERSION = '6.0.0'
 
   ##
   # version is a public API method intended to always provide a fast and

data/lib/puppet_pal.rb

@@ -3,6 +3,7 @@
 # Yes, this requires all of puppet for now because 'settings' and many other things...
 require 'puppet'
 require 'puppet/parser/script_compiler'
+require 'puppet/parser/catalog_compiler'
 
 # This is the main entry point for "Puppet As a Library" PAL.
 # This file should be required instead of "puppet"
@@ -175,7 +176,7 @@ module Pal
     #
     def parse_file(file)
       unless file.is_a?(String)
-        raise ArgumentError, _("The argument 'file' must be a String, got %{type}") % { type: puppet_code.class }
+        raise ArgumentError, _("The argument 'file' must be a String, got %{type}") % { type: file.class }
       end
       internal_evaluator.parse_file(file)
     end
@@ -217,6 +218,13 @@ module Pal
       call_function('new', t, *arguments)
     end
 
+    # Returns true if this is a compiler that compiles a catalog.
+    # This implementation returns `false`
+    # @return Boolan false
+    def has_catalog?
+      false
+    end
+
     protected
 
     def list_loadable_kind(kind, filter_regex = nil, error_collector = nil)
@@ -301,6 +309,131 @@ module Pal
     end
   end
 
+  # A CatalogCompiler is a compiler that builds a catalog of resources and dependencies as a side effect of
+  # evaluating puppet language code.
+  # When the compilation of the given input manifest(s)/code string/file is finished the catalog is complete
+  # for encoding and use. It is also possible to evaluate more strings within the same compilation context to
+  # add or remove things from the catalog.
+  #
+  # @api public
+  class CatalogCompiler < Compiler
+
+    # @api private
+    def catalog
+      internal_compiler.catalog
+    end
+    private :catalog
+
+    # Returns true if this is a compiler that compiles a catalog.
+    # This implementation returns `true`
+    # @return [Boolean] true
+    # @api public
+    def has_catalog?
+      true
+    end
+
+    # Calls a block of code and yields a configured `JsonCatalogEncoder` to the block.
+    # @example Get resulting catalog as pretty printed Json
+    #   Puppet::Pal.in_environment(...) do |pal|
+    #     pal.with_catalog_compiler(...) do |compiler|
+    #       compiler.with_json_encoding {| encoder | encoder.encode
+    #     end
+    #   end
+    #
+    # @api public
+    #
+    def with_json_encoding(pretty: true, exclude_virtual: true)
+      yield JsonCatalogEncoder.new(catalog, pretty: pretty, exclude_virtual: exclude_virtual)
+    end
+
+    # Evaluates an AST obtained from `parse_string` or `parse_file` in topscope.
+    # If the ast is a `Puppet::Pops::Model::Program` (what is returned from the `parse` methods, any definitions
+    # in the program (that is, any function, plan, etc. that is defined will be made available for use).
+    #
+    # @param ast [Puppet::Pops::Model::PopsObject] typically the returned `Program` from the parse methods, but can be any `Expression`
+    # @returns [Object] whatever the ast evaluates to
+    #
+    def evaluate(ast)
+      if ast.is_a?(Puppet::Pops::Model::Program)
+        bridged = Puppet::Parser::AST::PopsBridge::Program.new(ast)
+        # define all catalog types
+        internal_compiler.environment.known_resource_types.import_ast(bridged, "")
+        bridged.evaluate(internal_compiler.topscope)
+      else
+        internal_evaluator.evaluate(topscope, ast)
+      end
+    end
+
+  end
+
+  # The JsonCatalogEncoder is a wrapper around a catalog produced by the Pal::CatalogCompiler.with_json_encoding
+  # method.
+  # It allows encoding the entire catalog or an individual resource as Rich Data Json.
+  #
+  # @api public
+  #
+  class JsonCatalogEncoder
+    # Is the resulting Json pretty printed or not.
+    attr_reader :pretty
+
+    # Should unrealized virtual resources be included in the result or not.
+    attr_reader :exclude_virtual
+
+    # The internal catalog being build - what this class wraps with a public API.
+    attr_reader :catalog
+    private :catalog
+
+    # Do not instantiate this class directly! Use the `Pal::CatalogCompiler#with_json_encoding` method
+    # instead.
+    #
+    # @param catalog [Puppet::Resource::Catalog] the internal catalog that this class wraps
+    # @param pretty [Boolean] (true), if the resulting JSON should be pretty printed or not
+    # @param exclude_virtual [Boolean] (true), if the resulting catalog should contain unrealzed virtual resources or not
+    #
+    # @api private
+    #
+    def initialize(catalog, pretty: true, exclude_virtual: true)
+      @catalog = catalog
+      @pretty = pretty
+      @exclude_virtual = exclude_virtual
+    end
+
+    # Encodes the entire catalog as a rich-data Json catalog.
+    # @return String The catalog in Json format using rich data format
+    # @api public
+    #
+    def encode
+      possibly_filtered_catalog.to_json(:pretty => pretty)
+    end
+
+    # Returns one particular resource as a Json string, or returns nil if resource was not found.
+    # @param type [String] the name of the puppet type (case independent)
+    # @param title [String] the title of the wanted resource
+    # @return [String] the resulting Json text
+    # @api public
+    #
+    def encode_resource(type, title)
+      # Ensure that both type and title are given since the underlying API will do mysterious things
+      # if 'title' is nil. (Other assertions are made by the catalog when looking up the resource).
+      #
+      # TRANSLATORS 'type' and 'title' are internal parameter names - do not translate
+      raise ArgumentError, _("Both type and title must be given") if type.nil? or title.nil?
+      r = possibly_filtered_catalog.resource(type, title)
+      return nil if r.nil?
+      r.to_data_hash.to_json(:pretty => pretty)
+    end
+
+    # Applies a filter for virtual resources and returns filtered catalog
+    # or the catalog itself if filtering was not needed.
+    # The result is cached.
+    # @api private
+    #
+    def possibly_filtered_catalog
+      @filtered ||= (exclude_virtual ? catalog.filter { |r| r.virtual? } : catalog)
+    end
+    private :possibly_filtered_catalog
+  end
+
   # A FunctionSignature is returned from `function_signature`. Its purpose is to answer questions about the function's parameters
   # and if it can be called with a set of parameters.
   #
@@ -534,7 +667,7 @@ module Pal
 
     # If manifest_file is nil, the #main method will use the env configured manifest
     # to do things in the block while a Script Compiler is in effect
-    main(manifest_file, facts, variables, &block)
+    main(manifest_file, facts, variables, :script, &block)
   end
 
   # Evaluates a Puppet Language script string.
@@ -561,6 +694,74 @@ module Pal
     end
   end
 
+  # Defines a context in which multiple operations in an env with a catalog producing compiler can be performed
+  # in a given block.
+  # The calls that takes place to PAL inside of the given block are all with the same instance of the compiler.
+  # The parameter `configured_by_env` makes it possible to either use the configuration in the environment, or specify
+  # `manifest_file` or `code_string` manually. If neither is given, an empty `code_string` is used.
+  #
+  # @example define a catalog compiler without any initial logic
+  #   pal.with_catalog_compiler do | compiler |
+  #     # do things with compiler
+  #   end
+  #
+  # @example define a catalog compiler with a code_string containing initial logic
+  #   pal.with_catalog_compiler(code_string: '$myglobal_var = 42')  do | compiler |
+  #     # do things with compiler
+  #   end
+  #
+  # @param configured_by_env [Boolean] when true the environment's settings are used, otherwise the
+  #   given `manifest_file` or `code_string`
+  # @param manifest_file [String] a Puppet Language file to load and evaluate before calling the given block, mutually exclusive
+  #   with `code_string`
+  # @param code_string [String] a Puppet Language source string to load and evaluate before calling the given block, mutually
+  #   exclusive with `manifest_file`
+  # @param facts [Hash] optional map of fact name to fact value - if not given will initialize the facts (which is a slow operation)
+  #   If given at the environment level, the facts given here are merged with higher priority.
+  # @param variables [Hash] optional map of fully qualified variable name to value. If given at the environment level, the variables
+  #   given here are merged with higher priority.
+  # @param block [Proc] the block performing operations on compiler
+  # @return [Object] what the block returns
+  # @yieldparam [Puppet::Pal::CatalogCompiler] compiler, a CatalogCompiler to perform operations on.
+  #
+  def self.with_catalog_compiler(
+    configured_by_env: false,
+      manifest_file:     nil,
+      code_string:       nil,
+      facts:             nil,
+      variables:         nil,
+      &block
+  )
+    # TRANSLATORS: do not translate variable name strings in these assertions
+    assert_mutually_exclusive(manifest_file, code_string, 'manifest_file', 'code_string')
+    assert_non_empty_string(manifest_file, 'manifest_file', true)
+    assert_non_empty_string(code_string, 'code_string', true)
+    assert_type(T_BOOLEAN, configured_by_env, "configured_by_env", false)
+
+    if configured_by_env
+      unless manifest_file.nil? && code_string.nil?
+        # TRANSLATORS: do not translate the variable names in this error message
+        raise ArgumentError, _("manifest_file or code_string cannot be given when configured_by_env is true")
+      end
+      # Use the manifest setting
+      manifest_file = Puppet[:manifest]
+    else
+      # An "undef" code_string is the only way to override Puppet[:manifest] & Puppet[:code] settings since an
+      # empty string is taken as Puppet[:code] not being set.
+      #
+      if manifest_file.nil? && code_string.nil?
+        code_string = 'undef'
+      end
+    end
+
+    Puppet[:tasks] = false
+    # After the assertions, if code_string is non nil - it has the highest precedence
+    Puppet[:code] = code_string unless code_string.nil?
+
+    # If manifest_file is nil, the #main method will use the env configured manifest
+    # to do things in the block while a Script Compiler is in effect
+    main(manifest_file, facts, variables, :catalog, &block)
+  end
 
   # Defines the context in which to perform puppet operations (evaluation, etc)
   # The code to evaluate in this context is given in a block.
@@ -743,7 +944,7 @@ module Pal
   # Picks up information from the puppet context and configures a script compiler which is given to
   # the provided block
   #
-  def self.main(manifest, facts, variables)
+  def self.main(manifest, facts, variables, internal_compiler_class)
     # Configure the load path
     env = Puppet.lookup(:pal_env)
     env.each_plugin_directory do |dir|
@@ -796,40 +997,51 @@ module Pal
         # fixup trusted information
         node.sanitize()
 
-        compiler = Puppet::Parser::ScriptCompiler.new(node.environment, node.name)
+        compiler = create_internal_compiler(internal_compiler_class, node)
+        # compiler = Puppet::Parser::ScriptCompiler.new(node.environment, node.name)
         topscope = compiler.topscope
 
         # When scripting the trusted data are always local, but set them anyway
-        topscope.set_trusted(node.trusted_data)
+        # When compiling for a catalog, the catalog compiler does this
+        unless internal_compiler_class == :catalog
+          topscope.set_trusted(node.trusted_data)
 
-        # Server facts are always about the local node's version etc.
-        topscope.set_server_facts(node.server_facts)
+          # Server facts are always about the local node's version etc.
+          topscope.set_server_facts(node.server_facts)
 
-        # Set $facts for the node running the script
-        facts_hash = node.facts.nil? ? {} : node.facts.values
-        topscope.set_facts(facts_hash)
+          # Set $facts for the node running the script
+          facts_hash = node.facts.nil? ? {} : node.facts.values
+          topscope.set_facts(facts_hash)
 
-        # create the $settings:: variables
-        topscope.merge_settings(node.environment.name, false)
+          # create the $settings:: variables
+          topscope.merge_settings(node.environment.name, false)
+        end
 
         add_variables(topscope, pal_variables)
 
-        # compiler.compile(&block)
-        compiler.compile do | internal_compiler |
-          # wrap the internal compiler to prevent it from leaking in the PAL API
-          if block_given?
-            script_compiler = ScriptCompiler.new(internal_compiler)
+        case internal_compiler_class
+        when :script
+          pal_compiler = ScriptCompiler.new(compiler)
+          overrides[:pal_script_compiler] = overrides[:pal_compiler] = pal_compiler
+        when :catalog
+          pal_compiler = CatalogCompiler.new(compiler)
+          overrides[:pal_catalog_compiler] = overrides[:pal_compiler] = pal_compiler
+        end
 
-            # Make compiler available to Puppet#lookup
-            overrides[:pal_script_compiler] = script_compiler
-            Puppet.override(overrides, "PAL::with_script_compiler") do # TRANSLATORS: Do not translate, symbolic name
-              yield(script_compiler)
+        # Make compiler available to Puppet#lookup and injection in functions
+        # TODO: The compiler instances should be available under non PAL use as well!
+        # TRANSLATORS: Do not translate, symbolic name
+        Puppet.override(overrides, "PAL::with_#{internal_compiler_class}_compiler") do
+          compiler.compile do | compiler_yield |
+            # wrap the internal compiler to prevent it from leaking in the PAL API
+            if block_given?
+              yield(pal_compiler)
             end
           end
         end
 
-      rescue Puppet::Error
-        # already logged and handled by the compiler, including Puppet::ParseErrorWithIssue
+      rescue Puppet::ParseErrorWithIssue, Puppet::Error
+        # already logged and handled by the compiler for these two cases
         raise
 
       rescue => detail
@@ -840,6 +1052,17 @@ module Pal
   end
   private_class_method :main
 
+  def self.create_internal_compiler(compiler_class_reference, node)
+    case compiler_class_reference
+    when :script
+      Puppet::Parser::ScriptCompiler.new(node.environment, node.name)
+    when :catalog
+      Puppet::Parser::CatalogCompiler.new(node)
+    else
+      raise ArgumentError, "Internal Error: Invalid compiler type requested."
+    end
+  end
+
   T_STRING = Puppet::Pops::Types::PStringType::NON_EMPTY
   T_STRING_ARRAY = Puppet::Pops::Types::TypeFactory.array_of(T_STRING)
   T_ANY_ARRAY = Puppet::Pops::Types::TypeFactory.array_of_any