puppet 6.0.0 → 6.1.0

data/lib/puppet/provider/service/systemd.rb

@@ -26,6 +26,8 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   defaultfor :operatingsystem => :amazon, :operatingsystemmajrelease => ["2"]
   defaultfor :operatingsystem => :debian, :operatingsystemmajrelease => ["8", "stretch/sid", "9", "buster/sid"]
 
+  defaultfor :operatingsystem => :LinuxMint
+  notdefaultfor :operatingsystem => :LinuxMint, :operatingsystemmajrelease => ["10", "11", "12", "13", "14", "15", "16", "17"] # These are using upstart
   defaultfor :operatingsystem => :ubuntu
   notdefaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["10.04", "12.04", "14.04", "14.10"] # These are using upstart
   defaultfor :operatingsystem => :cumuluslinux, :operatingsystemmajrelease => ["3"]
@@ -123,6 +125,21 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
     end
   end
 
+  # Define the daemon_reload? function to check if the unit is requiring to trigger a "systemctl daemon-reload"
+  # If the unit file is flagged with NeedDaemonReload=yes, then a systemd daemon-reload will be run.
+  # If multiple unit files have been updated, the first one flagged will trigger the daemon-reload for all of them.
+  # The others will be then flagged with NeedDaemonReload=no. So the command will run only once in a puppet run.
+  # This function is called only on start & restart unit options.
+  # Reference: (PUP-3483) Systemd provider doesn't scan for changed units
+  def daemon_reload?
+    cmd = [command(:systemctl), 'show', @resource[:name], '--property=NeedDaemonReload']
+    daemon_reload = execute(cmd, :failonfail => false).strip.split('=').last
+    if daemon_reload == 'yes'
+      daemon_reload_cmd = [command(:systemctl), 'daemon-reload']
+      execute(daemon_reload_cmd, :failonfail => false)
+    end
+  end
+
   def enable
     self.unmask
     systemctl_change_enable(:enable)
@@ -156,6 +173,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
 
   def restart
     begin
+      daemon_reload?
       super
     rescue Puppet::Error => e
       raise Puppet::Error.new(prepare_error_message(@resource[:name], 'restart', e))
@@ -164,6 +182,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
 
   def start
     begin
+      daemon_reload?
       super
     rescue Puppet::Error => e
       raise Puppet::Error.new(prepare_error_message(@resource[:name], 'start', e))

data/lib/puppet/provider/service/upstart.rb

@@ -17,6 +17,7 @@ Puppet::Type.type(:service).provide :upstart, :parent => :debian do
   ]
 
   defaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["10.04", "12.04", "14.04", "14.10"]
+  defaultfor :operatingsystem => :LinuxMint, :operatingsystemmajrelease => ["10", "11", "12", "13", "14", "15", "16", "17"]
 
   commands :start   => "/sbin/start",
            :stop    => "/sbin/stop",

data/lib/puppet/provider/service/windows.rb

@@ -15,6 +15,7 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
   confine    :operatingsystem => :windows
 
   has_feature :refreshable
+  has_feature :configurable_timeout
 
   def enable
     Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_AUTO_START )
@@ -35,6 +36,8 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
   end
 
   def enabled?
+    return :false unless Puppet::Util::Windows::Service.exists?(@resource[:name])
+
     start_type = Puppet::Util::Windows::Service.service_start_type(@resource[:name])
     debug("Service #{@resource[:name]} start type is #{start_type}")
     case start_type
@@ -54,6 +57,13 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
   end
 
   def start
+    if status == :paused
+      Puppet::Util::Windows::Service.resume(@resource[:name], timeout: @resource[:timeout])
+      return
+    end
+
+    # status == :stopped here
+
     if enabled? == :false
       # If disabled and not managing enable, respect disabled and fail.
       if @resource[:enable].nil?
@@ -66,21 +76,24 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
         manual_start
       end
     end
-    Puppet::Util::Windows::Service.start(@resource[:name])
+    Puppet::Util::Windows::Service.start(@resource[:name], timeout: @resource[:timeout])
   end
 
   def stop
-    Puppet::Util::Windows::Service.stop(@resource[:name])
+    Puppet::Util::Windows::Service.stop(@resource[:name], timeout: @resource[:timeout])
   end
 
   def status
+    return :stopped unless Puppet::Util::Windows::Service.exists?(@resource[:name])
+
     current_state = Puppet::Util::Windows::Service.service_state(@resource[:name])
     state = case current_state
       when :SERVICE_STOPPED,
-           :SERVICE_PAUSED,
-           :SERVICE_STOP_PENDING,
-           :SERVICE_PAUSE_PENDING
+           :SERVICE_STOP_PENDING
         :stopped
+      when :SERVICE_PAUSED,
+           :SERVICE_PAUSE_PENDING
+        :paused
       when :SERVICE_RUNNING,
            :SERVICE_CONTINUE_PENDING,
            :SERVICE_START_PENDING
@@ -92,6 +105,10 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
     return state
   end
 
+  def default_timeout
+    Puppet::Util::Windows::Service::DEFAULT_TIMEOUT
+  end
+
   # returns all providers for all existing services and startup state
   def self.instances
     services = []

data/lib/puppet/provider/user/aix.rb

@@ -10,6 +10,7 @@
 # See https://puppet.com/docs/puppet/latest/provider_development.html
 # for more information
 require 'puppet/provider/aix_object'
+require 'puppet/util/posix'
 require 'tempfile'
 require 'date'
 
@@ -76,13 +77,23 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
     # a String, etc. in the property. This routine does a final check to
     # ensure our value doesn't have whitespace before we convert it to
     # an attribute.
-    def groups_to_groups(groups)
+    def groups_property_to_attribute(groups)
       if groups =~ /\s/
         raise ArgumentError, _("Invalid value %{groups}: Groups must be comma separated!") % { groups: groups }
       end
 
       groups
     end
+
+    # We do not directly use the groups attribute value because that will
+    # always include the primary group, even if our user is not one of its
+    # members. Instead, we retrieve our property value by parsing the etc/group file,
+    # which matches what we do on our other POSIX platforms like Linux and Solaris.
+    #
+    # See https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.files/group_security.htm
+    def groups_attribute_to_property(provider, _groups)
+      Puppet::Util::POSIX.groups_of(provider.resource[:name]).join(',')
+    end
   end
 
   mapping puppet_property: :comment,
@@ -99,7 +110,8 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
           attribute_to_property: method(:pgrp_to_gid)
 
   mapping puppet_property: :groups, 
-          property_to_attribute: method(:groups_to_groups)
+          property_to_attribute: method(:groups_property_to_attribute),
+          attribute_to_property: method(:groups_attribute_to_property)
 
   mapping puppet_property: :home
   mapping puppet_property: :shell
@@ -121,6 +133,24 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   # properties + a getter for the attributes property).
   mk_resource_methods
 
+  # Setting the primary group (pgrp attribute) on AIX causes both the
+  # current and new primary groups to be included in our user's groups,
+  # which is undesirable behavior. Thus, this custom setter resets the
+  # 'groups' property back to its previous value after setting the primary
+  # group.
+  def gid=(value)
+    old_pgrp = gid
+    cur_groups = groups
+
+    set(:gid, value)
+
+    begin
+      self.groups = cur_groups
+    rescue Puppet::Error => detail
+      raise Puppet::Error, _("Could not reset the groups property back to %{cur_groups} after setting the primary group on %{resource}[%{name}]. This means that the previous primary group of %{old_pgrp} and the new primary group of %{new_pgrp} have been added to %{cur_groups}. You will need to manually reset the groups property if this is undesirable behavior. Detail: %{detail}") % { cur_groups: cur_groups, resource: @resource.class.name, name: @resource.name, old_pgrp: old_pgrp, new_pgrp: value, detail: detail }, detail.backtrace
+    end
+  end
+
   # Helper function that parses the password from the given
   # password filehandle. This is here to make testing easier
   # for #password since we cannot configure Mocha to mock out
@@ -213,6 +243,22 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   def create
     super
 
+    # We specify the 'groups' AIX attribute in AixObject's create method
+    # when creating our user. However, this does not always guarantee that
+    # our 'groups' property is set to the right value. For example, the
+    # primary group will always be included in the 'groups' property. This is
+    # bad if we're explicitly managing the 'groups' property under inclusive
+    # membership, and we are not specifying the primary group in the 'groups'
+    # property value.
+    #
+    # Setting the groups property here a second time will ensure that our user is
+    # created and in the right state. Note that this is an idempotent operation,
+    # so if AixObject's create method already set it to the right value, then this
+    # will noop.
+    if (groups = @resource.should(:groups))
+      self.groups = groups
+    end
+
     if (password = @resource.should(:password))
       self.password = password
     end

data/lib/puppet/provider/user/useradd.rb

@@ -134,15 +134,6 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     cmd
   end
 
-  def check_manage_expiry
-    cmd = []
-    if @resource[:expiry] and not @resource.forcelocal?
-      cmd << "-e #{@resource[:expiry]}"
-    end
-
-    cmd
-  end
-
   def check_system_users
     if self.class.system_users? and resource.system?
       ["-r"]
@@ -188,7 +179,8 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
 
   def modifycmd(param, value)
     if @resource.forcelocal?
-      if param == :groups
+      case param
+      when :groups, :expiry
         cmd = [command(:modify)]
       else
         cmd = [command(property_manages_password_age?(param) ? :localpassword : :localmodify)]

data/lib/puppet/provider/user/windows_adsi.rb

@@ -124,7 +124,15 @@ Puppet::Type.type(:user).provide :windows_adsi do
   end
 
   def password=(value)
-    user.password = value
+    if user.disabled?
+      warning _("The user account '%s' is disabled; puppet will not reset the password" % @resource[:name])
+    elsif user.locked_out?
+      warning _("The user account '%s' is locked out; puppet will not reset the password" % @resource[:name])
+    elsif user.expired?
+      warning _("The user account '%s' is expired; puppet will not reset the password" % @resource[:name])
+    else
+      user.password = value
+    end
   end
 
   def uid

data/lib/puppet/resource/catalog.rb

@@ -558,11 +558,7 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
     Puppet::FileSystem.open(resourcefile.value, resourcefile.mode.to_i(8), "w:UTF-8") do |f|
       to_print = resources.map do |resource|
         next unless resource.managed?
-        if resource.name_var
-          "#{resource.type}[#{resource[resource.name_var]}]"
-        else
-          "#{resource.ref.downcase}"
-        end
+        "#{resource.ref.downcase}"
       end.compact
       f.puts to_print.join("\n")
     end

data/lib/puppet/resource.rb

@@ -583,7 +583,9 @@ class Puppet::Resource
         delete(attribute)
       end
 
-      parameters_to_include = options[:parameters_to_include] || []
+      parameters_to_include = resource_type.parameters_to_include
+      parameters_to_include += options[:parameters_to_include] || []
+
       delete(attribute) unless properties.include?(attribute) || parameters_to_include.include?(attribute)
     end
     self

data/lib/puppet/ssl/host.rb

@@ -23,7 +23,7 @@ class Puppet::SSL::Host
   Certificate = Puppet::SSL::Certificate
   CertificateRequest = Puppet::SSL::CertificateRequest
 
-  attr_reader :name, :crl_path
+  attr_reader :name, :device, :crl_path
 
   attr_writer :key, :certificate, :certificate_request, :crl_usage
 
@@ -146,6 +146,17 @@ class Puppet::SSL::Host
     @certificate
   end
 
+  # The puppet parameters for commands output by the validate_ methods depend
+  # upon whether this is an agent or a device.
+
+  def clean_params
+    @device ? "--target #{Puppet[:certname]}" : ''
+  end
+
+  def puppet_params
+    @device ? "device -v --target #{Puppet[:certname]}" : 'agent -t'
+  end
+
   # Validate that our private key matches the specified certificate.
   #
   # @param [Puppet::SSL::Certificate] cert the certificate to check
@@ -154,16 +165,15 @@ class Puppet::SSL::Host
     raise Puppet::Error, _("No certificate to validate.") unless cert
     raise Puppet::Error, _("No private key with which to validate certificate with fingerprint: %{fingerprint}") % { fingerprint: cert.fingerprint } unless key
     unless cert.content.check_private_key(key.content)
-      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: cert.fingerprint, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
+      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: cert.fingerprint, cert_name: Puppet[:certname], clean_params: clean_params, puppet_params: puppet_params }
 The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root?
 Certificate fingerprint: %{fingerprint}
 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certificate.
 On the master:
-  puppet cert clean %{cert_name}
+  puppetserver ca clean --certname %{cert_name}
 On the agent:
-  1a. On most platforms: find %{ssl_dir} -name %{cert_name}.pem -delete
-  1b. On Windows: del "%{cert_dir}\\%{cert_name}.pem" /f
-  2. puppet agent -t
+  1. puppet ssl clean %{clean_params}
+  2. puppet %{puppet_params}
 ERROR_STRING
     end
   end
@@ -237,16 +247,15 @@ ERROR_STRING
 
   def validate_local_csr_with_key(csr, key)
     if key.content.public_key.to_s != csr.content.public_key.to_s
-      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: csr.fingerprint, csr_public_key: csr.content.public_key.to_text, agent_public_key: key.content.public_key.to_text, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
+      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: csr.fingerprint, csr_public_key: csr.content.public_key.to_text, agent_public_key: key.content.public_key.to_text, clean_params: clean_params, puppet_params: puppet_params }
 The local CSR does not match the agent's public key.
 CSR fingerprint: %{fingerprint}
 CSR public key: %{csr_public_key}
 Agent public key: %{agent_public_key}
 To fix this, remove the CSR from the agent and then start a puppet run, which will automatically regenerate a CSR.
 On the agent:
-  1a. On most platforms: find %{ssl_dir} -name %{cert_name}.pem -delete
-  1b. On Windows: del "%{cert_dir}\\%{cert_name}.pem" /f
-  2. puppet agent -t
+  1. puppet ssl clean %{clean_params}
+  2. puppet %{puppet_params}
 ERROR_STRING
     end
   end
@@ -254,25 +263,25 @@ ERROR_STRING
 
   def validate_csr_with_key(csr, key)
     if key.content.public_key.to_s != csr.content.public_key.to_s
-      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: csr.fingerprint, csr_public_key: csr.content.public_key.to_text, agent_public_key: key.content.public_key.to_text, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
+      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: csr.fingerprint, csr_public_key: csr.content.public_key.to_text, agent_public_key: key.content.public_key.to_text, cert_name: Puppet[:certname], clean_params: clean_params, puppet_params: puppet_params }
 The CSR retrieved from the master does not match the agent's public key.
 CSR fingerprint: %{fingerprint}
 CSR public key: %{csr_public_key}
 Agent public key: %{agent_public_key}
 To fix this, remove the CSR from both the master and the agent and then start a puppet run, which will automatically regenerate a CSR.
 On the master:
-  puppet cert clean %{cert_name}
+  puppetserver ca clean --certname %{cert_name}
 On the agent:
-  1a. On most platforms: find %{ssl_dir} -name %{cert_name}.pem -delete
-  1b. On Windows: del "%{cert_dir}\\%{cert_name}.pem" /f
-  2. puppet agent -t
+  1. puppet ssl clean %{clean_params}
+  2. puppet %{puppet_params}
 ERROR_STRING
     end
   end
   private :validate_csr_with_key
 
-  def initialize(name = nil)
+  def initialize(name = nil, device = false)
     @name = (name || Puppet[:certname]).downcase
+    @device = device
     Puppet::SSL::Base.validate_certname(@name)
     @key = @certificate = @certificate_request = nil
     @crl_usage = Puppet.settings[:certificate_revocation]
@@ -576,6 +585,7 @@ ERROR_STRING
       end
     end
   end
+  public :download_certificate_from_ca
 
   # Returns the file path for the named certificate, based on this host's
   # configuration.

data/lib/puppet/syntax_checkers/epp.rb

@@ -0,0 +1,34 @@
+# A syntax checker for JSON.
+# @api public
+require 'puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::EPP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for Puppet Language EPP syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new(_("EPP syntax checker: the text to check must be a String.")) unless text.is_a?(String)
+    raise ArgumentError.new(_("EPP syntax checker: the syntax identifier must be a String, e.g. pp")) unless syntax == 'epp'
+    raise ArgumentError.new(_("EPP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser::EvaluatingEppParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("EPP syntax checker: \"%{message}\"") % { message: e.message().slice(0,500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_EPP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/pp.rb

@@ -0,0 +1,34 @@
+# A syntax checker for JSON.
+# @api public
+require 'puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::PP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for Puppet Language syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new(_("PP syntax checker: the text to check must be a String.")) unless text.is_a?(String)
+    raise ArgumentError.new(_("PP syntax checker: the syntax identifier must be a String, e.g. pp")) unless syntax == 'pp'
+    raise ArgumentError.new(_("PP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("PP syntax checker: \"%{message}\"") % { message: e.message().slice(0,500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_PP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/transaction/event_manager.rb

@@ -147,12 +147,18 @@ class Puppet::Transaction::EventManager
     resource.send(callback)
 
     if not resource.is_a?(Puppet::Type.type(:whit))
-      resource.notice n_("Triggered '%{callback}' from %{count} event", "Triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
+      message = n_("Triggered '%{callback}' from %{count} event", "Triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
+      resource.notice message
+      add_callback_status_event(resource, callback, message, "success")
     end
+
     return true
   rescue => detail
     resource_error_message = _("Failed to call %{callback}: %{detail}") % { callback: callback, detail: detail }
     resource.err resource_error_message
+    if not resource.is_a?(Puppet::Type.type(:whit))
+      add_callback_status_event(resource, callback, resource_error_message, "failure")
+    end
 
     transaction.resource_status(resource).failed_to_restart = true
     transaction.resource_status(resource).fail_with_event(resource_error_message)
@@ -160,6 +166,12 @@ class Puppet::Transaction::EventManager
     return false
   end
 
+  def add_callback_status_event(resource, callback, message, status)
+    options = { message: message, status: status, name: callback.to_s }
+    event = resource.event options
+    transaction.resource_status(resource) << event if event
+  end
+
   def process_noop_events(resource, callback, events)
     resource.notice n_("Would have triggered '%{callback}' from %{count} event", "Would have triggered '%{callback}' from %{count} events", events.length) % { count: events.length, callback: callback }
 

data/lib/puppet/transaction/persistence.rb

@@ -64,7 +64,7 @@ class Puppet::Transaction::Persistence
       begin
         result = Puppet::Util::Yaml.safe_load_file(filename, [Symbol])
       rescue Puppet::Util::Yaml::YamlLoadError => detail
-        Puppet.log_exception(detail, _("Transaction store file %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail }, { :level => :warning })
+        Puppet.log_exception(detail, _("Transaction store file %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail })
 
         begin
           File.rename(filename, filename + ".bad")

data/lib/puppet/transaction/resource_harness.rb

@@ -158,7 +158,9 @@ class Puppet::Transaction::ResourceHarness
       raise
     ensure
       if event
-        event.calculate_corrective_change(@persistence.get_system_value(context.resource.ref, param.name.to_s))
+        name = param.name.to_s
+        event.message ||= _("could not create change error message for %{name}") % { name: name }
+        event.calculate_corrective_change(@persistence.get_system_value(context.resource.ref, name))
         context.record(event)
         event.send_log
         context.synced_params << param.name

data/lib/puppet/type/group.rb

@@ -87,6 +87,8 @@ module Puppet
         behavior can be configured with `auth_membership`."
 
       def change_to_s(currentvalue, newvalue)
+        newvalue = actual_should(currentvalue, newvalue)
+
         currentvalue = currentvalue.join(",") if currentvalue != :absent
         newvalue = newvalue.join(",")
         super(currentvalue, newvalue)
@@ -110,7 +112,33 @@ module Puppet
 
         super(currentvalue)
       end
-      alias :should_to_s :is_to_s
+
+      def should_to_s(newvalue)
+        is_to_s(actual_should(retrieve, newvalue))
+      end
+
+      # Calculates the actual should value given the current and
+      # new values. This is only used in should_to_s and change_to_s
+      # to fix the change notification issue reported in PUP-6542.
+      def actual_should(currentvalue, newvalue)
+        currentvalue = munge_members_value(currentvalue)
+        newvalue = munge_members_value(newvalue)
+
+        if @resource[:auth_membership]
+          newvalue.uniq.sort 
+        else
+          (currentvalue + newvalue).uniq.sort
+        end
+      end
+
+      # Useful helper to handle the possible property value types that we can
+      # both pass-in and return. It munges the value into an array
+      def munge_members_value(value)
+        return [] if value == :absent
+        return value.split(',') if value.is_a?(String)
+
+        value
+      end
 
       validate do |value|
         if provider.respond_to?(:member_valid?)

data/lib/puppet/type/package.rb

@@ -172,7 +172,7 @@ module Puppet
               when is == @latest
                 return true
               when is == :present
-                # This will only happen on retarded packaging systems
+                # This will only happen on packaging systems
                 # that can't query versions.
                 return true
               else
@@ -271,6 +271,10 @@ module Puppet
     providify
     paramclass(:provider).isnamevar
 
+    def self.parameters_to_include
+      [:provider]
+    end
+
     # We have more than one namevar, so we need title_patterns. However, we
     # cheat and set the patterns to map to name only and completely ignore
     # provider. So far, the logic that determines uniqueness appears to just

data/lib/puppet/type/resources.rb

@@ -87,6 +87,12 @@ Puppet::Type.newtype(:resources) do
     end
   end
 
+  WINDOWS_SYSTEM_SID_REGEXES =
+      # Administrator, Guest, Domain Admins, Schema Admins, Enterprise Admins.
+      # https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
+      [/S-1-5-21.+-500/, /S-1-5-21.+-501/, /S-1-5-21.+-512/, /S-1-5-21.+-518/,
+       /S-1-5-21.+-519/]
+
   def check(resource)
     @checkmethod ||= "#{self[:name]}_check"
     @hascheck ||= respond_to?(@checkmethod)
@@ -145,8 +151,12 @@ Puppet::Type.newtype(:resources) do
 
     return false if system_users.include?(resource[:name])
     return false if unless_uids && unless_uids.include?(current_uid)
-
-    current_uid > self[:unless_system_user]
+    if current_uid.is_a?(String)
+      # Windows user; is a system user if any regex matches.
+      WINDOWS_SYSTEM_SID_REGEXES.none? { |regex| current_uid =~ regex }
+    else
+      current_uid > self[:unless_system_user]
+    end
   end
 
   def system_users

data/lib/puppet/type/schedule.rb

@@ -46,6 +46,13 @@ module Puppet
           }
 
       This will cause resources to be applied every 30 minutes by default.
+
+      The `statettl` setting on the agent affects the ability of a schedule to
+      determine if a resource has already been checked. If the `statettl` is
+      set lower than the span of the associated schedule resource, then a
+      resource could be checked & applied multiple times in the schedule as
+      the information about when the resource was last checked will have
+      expired from the cache.
       EOT
 
     apply_to_all

data/lib/puppet/type/service.rb

@@ -45,6 +45,8 @@ module Puppet
     feature :maskable, "The provider can 'mask' the service.",
       :methods => [:mask]
 
+    feature :configurable_timeout, "The provider can specify a minumum timeout for syncing service properties"
+
     newproperty(:enable, :required_features => :enableable) do
       desc "Whether a service should be enabled to start at boot.
         This property behaves quite differently depending on the platform;
@@ -237,6 +239,16 @@ module Puppet
       desc "Specify a command to config a service, or a path to a manifest to do so."
     end
 
+    newparam(:timeout, :required_features => :configurable_timeout) do
+      desc "Specify an optional minimum timeout (in seconds) for puppet to wait when syncing service properties"
+      defaultto { provider.class.respond_to?(:default_timeout) ? provider.default_timeout : 10 }
+      validate do |value|
+        if (not value.is_a? Integer) || value < 1
+          raise Puppet::Error.new(_("\"%{value}\" is not a positive integer: the timeout parameter must be specified as a positive integer") % { value: value })
+        end
+      end
+    end
+
     # Basically just a synonym for restarting.  Used to respond
     # to events.
     def refresh