puppet 6.0.5-x64-mingw32 → 8.8.1-x64-mingw32

data/lib/puppet/type/exec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Puppet
   Type.newtype(:exec) do
     include Puppet::Util::Execution
@@ -11,47 +13,64 @@ module Puppet
 
       * The command itself is already idempotent. (For example, `apt-get update`.)
       * The exec has an `onlyif`, `unless`, or `creates` attribute, which prevents
-        Puppet from running the command unless some condition is met.
-      * The exec has `refreshonly => true`, which only allows Puppet to run the
-        command when some other resource is changed. (See the notes on refreshing
+        Puppet from running the command unless some condition is met. The
+        `onlyif` and `unless` commands of an `exec` are used in the process of
+        determining whether the `exec` is already in sync, therefore they must be run
+        during a noop Puppet run.
+      * The exec has `refreshonly => true`, which allows Puppet to run the
+        command only when some other resource is changed. (See the notes on refreshing
         below.)
 
+      The state managed by an `exec` resource represents whether the specified command
+      _needs to be_ executed during the catalog run. The target state is always that
+      the command does not need to be executed. If the initial state is that the
+      command _does_ need to be executed, then successfully executing the command
+      transitions it to the target state.
+
+      The `unless`, `onlyif`, and `creates` properties check the initial state of the
+      resource. If one or more of these properties is specified, the exec might not
+      need to run. If the exec does not need to run, then the system is already in
+      the target state. In such cases, the exec is considered successful without
+      actually executing its command.
+
       A caution: There's a widespread tendency to use collections of execs to
       manage resources that aren't covered by an existing resource type. This
       works fine for simple tasks, but once your exec pile gets complex enough
       that you really have to think to understand what's happening, you should
-      consider developing a custom resource type instead, as it will be much
+      consider developing a custom resource type instead, as it is much
       more predictable and maintainable.
 
+      **Duplication:** Even though `command` is the namevar, Puppet allows
+      multiple `exec` resources with the same `command` value.
+
       **Refresh:** `exec` resources can respond to refresh events (via
       `notify`, `subscribe`, or the `~>` arrow). The refresh behavior of execs
       is non-standard, and can be affected by the `refresh` and
       `refreshonly` attributes:
 
-      * If `refreshonly` is set to true, the exec will _only_ run when it receives an
+      * If `refreshonly` is set to true, the exec runs _only_ when it receives an
         event. This is the most reliable way to use refresh with execs.
-      * If the exec already would have run and receives an event, it will run its
-        command **up to two times.** (If an `onlyif`, `unless`, or `creates` condition
-        is no longer met after the first run, the second run will not occur.)
-      * If the exec already would have run, has a `refresh` command, and receives an
-        event, it will run its normal command, then run its `refresh` command
-        (as long as any `onlyif`, `unless`, or `creates` conditions are still met
-        after the normal command finishes).
-      * If the exec would **not** have run (due to an `onlyif`, `unless`, or `creates`
-        attribute) and receives an event, it still will not run.
+      * If the exec has already run and then receives an event, it runs its
+        command **up to two times.** If an `onlyif`, `unless`, or `creates` condition
+        is no longer met after the first run, the second run does not occur.
+      * If the exec has already run, has a `refresh` command, and receives an
+        event, it runs its normal command. Then, if any `onlyif`, `unless`, or `creates`
+        conditions are still met, the exec runs its `refresh` command.
+      * If the exec has an `onlyif`, `unless`, or `creates` attribute that prevents it
+        from running, and it then receives an event, it still will not run.
       * If the exec has `noop => true`, would otherwise have run, and receives
-        an event from a non-noop resource, it will run once (or run its `refresh`
-        command instead, if it has one).
+        an event from a non-noop resource, it runs once. However, if it has a `refresh`
+        command, it runs that instead of its normal command.
 
       In short: If there's a possibility of your exec receiving refresh events,
-      it becomes doubly important to make sure the run conditions are restricted.
+      it is extremely important to make sure the run conditions are restricted.
 
       **Autorequires:** If Puppet is managing an exec's cwd or the executable
-      file used in an exec's command, the exec resource will autorequire those
+      file used in an exec's command, the exec resource autorequires those
       files. If Puppet is managing the user that an exec should run as, the
-      exec resource will autorequire that user."
+      exec resource autorequires that user."
 
-    # Create a new check mechanism.  It's basically just a parameter that
+    # Create a new check mechanism.  It's basically a parameter that
     # provides one extra 'check' method.
     def self.newcheck(name, options = {}, &block)
       @checks ||= {}
@@ -64,11 +83,9 @@ module Puppet
       @checks.keys
     end
 
-    newproperty(:returns, :array_matching => :all, :event => :executed_command) do |property|
+    newproperty(:returns, :array_matching => :all, :event => :executed_command) do |_property|
       include Puppet::Util::Execution
-      munge do |value|
-        value.to_s
-      end
+      munge(&:to_s)
 
       def event_name
         :executed_command
@@ -77,6 +94,7 @@ module Puppet
       defaultto "0"
 
       attr_reader :output
+
       desc "The expected exit code(s).  An error will be returned if the
         executed command has some other exit code. Can be specified as an array
         of acceptable exit codes or a single value.
@@ -111,57 +129,63 @@ module Puppet
         # value, which causes us to be treated as in_sync?, which means we
         # don't actually execute anything.  I think. --daniel 2011-03-10
         if @resource.check_all_attributes
-          return :notrun
+          :notrun
         else
-          return self.should
+          should
         end
       end
 
       # Actually execute the command.
       def sync
         event = :executed_command
-        tries = self.resource[:tries]
-        try_sleep = self.resource[:try_sleep]
+        tries = resource[:tries]
+        try_sleep = resource[:try_sleep]
 
         begin
           tries.times do |try|
             # Only add debug messages for tries > 1 to reduce log spam.
-            debug("Exec try #{try+1}/#{tries}") if tries > 1
-            @output, @status = provider.run(self.resource[:command])
-            break if self.should.include?(@status.exitstatus.to_s)
+            debug("Exec try #{try + 1}/#{tries}") if tries > 1
+            @output, @status = provider.run(resource[:command])
+            break if should.include?(@status.exitstatus.to_s)
+
             if try_sleep > 0 and tries > 1
               debug("Sleeping for #{try_sleep} seconds between tries")
               sleep try_sleep
             end
           end
-        rescue Timeout::Error
-          self.fail Puppet::Error, _("Command exceeded timeout"), $!
+        rescue Timeout::Error => e
+          self.fail Puppet::Error, _("Command exceeded timeout"), e
         end
 
-        if log = @resource[:logoutput]
+        log = @resource[:logoutput]
+        if log
           case log
           when :true
             log = @resource[:loglevel]
           when :on_failure
-            unless self.should.include?(@status.exitstatus.to_s)
-              log = @resource[:loglevel]
-            else
+            if should.include?(@status.exitstatus.to_s)
               log = :false
+            else
+              log = @resource[:loglevel]
             end
           end
           unless log == :false
-            @output.split(/\n/).each { |line|
-              self.send(log, line)
-            }
+            if @resource.parameter(:command).sensitive
+              send(log, "[output redacted]")
+            else
+              @output.split(/\n/).each { |line|
+                send(log, line)
+              }
+            end
           end
         end
 
-        unless self.should.include?(@status.exitstatus.to_s)
+        unless should.include?(@status.exitstatus.to_s)
           if @resource.parameter(:command).sensitive
             # Don't print sensitive commands in the clear
-            self.fail(_("[command redacted] returned %{status} instead of one of [%{expected}]") % { status: @status.exitstatus, expected: self.should.join(",") })
+            self.fail(_("[command redacted] returned %{status} instead of one of [%{expected}]") % { status: @status.exitstatus, expected: should.join(",") })
           else
-            self.fail(_("'%{cmd}' returned %{status} instead of one of [%{expected}]") % { cmd: self.resource[:command], status: @status.exitstatus, expected: self.should.join(",") })
+            self.fail(_("'%{cmd}' returned %{status} instead of one of [%{expected}]") % { cmd: resource[:command], status: @status.exitstatus, expected: should.join(",") })
           end
         end
 
@@ -176,10 +200,23 @@ module Puppet
         succeeds, any output produced will be logged at the instance's
         normal log level (usually `notice`), but if the command fails
         (meaning its return code does not match the specified code) then
-        any output is logged at the `err` log level."
+        any output is logged at the `err` log level.
+
+        Multiple `exec` resources can use the same `command` value; Puppet
+        only uses the resource title to ensure `exec`s are unique.
+
+        On *nix platforms, the command can be specified as an array of
+        strings and Puppet will invoke it using the more secure method of
+        parameterized system calls. For example, rather than executing the
+        malicious injected code, this command will echo it out:
+
+            command => ['/bin/echo', 'hello world; rm -rf /']
+      "
 
       validate do |command|
-        raise ArgumentError, _("Command must be a String, got value of class %{klass}") % { klass: command.class } unless command.is_a? String
+        unless command.is_a?(String) || command.is_a?(Array)
+          raise ArgumentError, _("Command must be a String or Array<String>, got value of class %{klass}") % { klass: command.class }
+        end
       end
     end
 
@@ -198,7 +235,7 @@ module Puppet
 
     newparam(:user) do
       desc "The user to run the command as.
-      
+
         > **Note:** Puppet cannot execute commands as other users on Windows.
 
         Note that if you use this attribute, any error output is not captured
@@ -297,8 +334,8 @@ module Puppet
         value = value.shift if value.is_a?(Array)
         begin
           value = Float(value)
-        rescue ArgumentError
-          raise ArgumentError, _("The timeout must be a number."), $!.backtrace
+        rescue ArgumentError => e
+          raise ArgumentError, _("The timeout must be a number."), e.backtrace
         end
         [value, 0.0].max
       end
@@ -314,12 +351,14 @@ module Puppet
 
       munge do |value|
         if value.is_a?(String)
-          unless value =~ /^[\d]+$/
+          unless value =~ /^\d+$/
             raise ArgumentError, _("Tries must be an integer")
           end
+
           value = Integer(value)
         end
         raise ArgumentError, _("Tries must be an integer >= 1") if value < 1
+
         value
       end
 
@@ -334,16 +373,17 @@ module Puppet
           unless value =~ /^[-\d.]+$/
             raise ArgumentError, _("try_sleep must be a number")
           end
+
           value = Float(value)
         end
         raise ArgumentError, _("try_sleep cannot be a negative number") if value < 0
+
         value
       end
 
       defaultto 0
     end
 
-
     newcheck(:refreshonly) do
       desc <<-'EOT'
         The command should only be run as a
@@ -373,11 +413,7 @@ module Puppet
       # on refresh.
       def check(value)
         # We have to invert the values.
-        if value == :true
-          false
-        else
-          true
-        end
+        value != :true
       end
     end
 
@@ -400,6 +436,14 @@ module Puppet
         back by re-extracting the tarball. If `important.tar` does **not**
         actually contain `myfile`, the exec will keep running every time
         Puppet runs.
+
+        This parameter can also take an array of files and the command will
+        not run if **any** of these files exist. For example:
+
+            creates => ['/tmp/file1', '/tmp/file2'],
+
+        will only run the command if both files don't exist.
+
       EOT
 
       accept_arrays
@@ -407,7 +451,9 @@ module Puppet
       # If the file exists, return false (i.e., don't run the command),
       # else return true
       def check(value)
-        ! Puppet::FileSystem.exist?(value)
+        # TRANSLATORS 'creates' is a parameter name and should not be translated
+        debug(_("Checking that 'creates' path '%{creates_path}' exists") % { creates_path: value })
+        !Puppet::FileSystem.exist?(value)
       end
     end
 
@@ -420,20 +466,27 @@ module Puppet
 
             exec { '/bin/echo root >> /usr/lib/cron/cron.allow':
               path   => '/usr/bin:/usr/sbin:/bin',
-              unless => 'grep root /usr/lib/cron/cron.allow 2>/dev/null',
+              unless => 'grep ^root$ /usr/lib/cron/cron.allow 2>/dev/null',
             }
 
         This would add `root` to the cron.allow file (on Solaris) unless
         `grep` determines it's already there.
 
         Note that this test command runs with the same `provider`, `path`,
-        `user`, and `group` as the main command. If the `path` isn't set, you
+        `user`, `cwd`, and `group` as the main command. If the `path` isn't set, you
         must fully qualify the command's name.
 
+        Since this command is used in the process of determining whether the
+        `exec` is already in sync, it must be run during a noop Puppet run.
+
         This parameter can also take an array of commands. For example:
 
             unless => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
+        or an array of arrays. For example:
+
+            unless => [['test', '-f', '/tmp/file1'], 'test -f /tmp/file2']
+
         This `exec` would only run if every command in the array has a
         non-zero exit code.
       EOT
@@ -455,9 +508,13 @@ module Puppet
           return false
         end
 
-        output.split(/\n/).each { |line|
-          self.debug(line)
-        }
+        if sensitive
+          debug("[output redacted]")
+        else
+          output.split(/\n/).each { |line|
+            debug(line)
+          }
+        end
 
         status.exitstatus != 0
       end
@@ -479,13 +536,20 @@ module Puppet
         This would run `logrotate` only if that test returns true.
 
         Note that this test command runs with the same `provider`, `path`,
-        `user`, and `group` as the main command. If the `path` isn't set, you
+        `user`, `cwd`, and `group` as the main command. If the `path` isn't set, you
         must fully qualify the command's name.
 
+        Since this command is used in the process of determining whether the
+        `exec` is already in sync, it must be run during a noop Puppet run.
+
         This parameter can also take an array of commands. For example:
 
             onlyif => ['test -f /tmp/file1', 'test -f /tmp/file2'],
 
+        or an array of arrays. For example:
+
+            onlyif => [['test', '-f', '/tmp/file1'], 'test -f /tmp/file2']
+
         This `exec` would only run if every command in the array has an
         exit code of 0 (success).
       EOT
@@ -507,9 +571,13 @@ module Puppet
           return false
         end
 
-        output.split(/\n/).each { |line|
-          self.debug(line)
-        }
+        if sensitive
+          debug("[output redacted]")
+        else
+          output.split(/\n/).each { |line|
+            debug(line)
+          }
+        end
 
         status.exitstatus == 0
       end
@@ -530,17 +598,24 @@ module Puppet
       reqs << self[:cwd] if self[:cwd]
 
       file_regex = Puppet::Util::Platform.windows? ? %r{^([a-zA-Z]:[\\/]\S+)} : %r{^(/\S+)}
+      cmd = self[:command]
+      cmd = cmd[0] if cmd.is_a? Array
 
-      self[:command].scan(file_regex) { |str|
-        reqs << str
-      }
+      if cmd.is_a?(Puppet::Pops::Evaluator::DeferredValue)
+        debug("The 'command' parameter is deferred and cannot be autorequired")
+      else
+        cmd.scan(file_regex) { |str|
+          reqs << str
+        }
 
-      self[:command].scan(/^"([^"]+)"/) { |str|
-        reqs << str
-      }
+        cmd.scan(/^"([^"]+)"/) { |str|
+          reqs << str
+        }
+      end
 
       [:onlyif, :unless].each { |param|
-        next unless tmp = self[param]
+        tmp = self[param]
+        next unless tmp
 
         tmp = [tmp] unless tmp.is_a? Array
 
@@ -550,7 +625,12 @@ module Puppet
           # fully qualified.  It might not be a bad idea to add
           # unqualified files, but, well, that's a bit more annoying
           # to do.
-          reqs += line.scan(file_regex)
+          line = line[0] if line.is_a? Array
+          if line.is_a?(Puppet::Pops::Evaluator::DeferredValue)
+            debug("The '#{param}' parameter is deferred and cannot be autorequired")
+          else
+            reqs += line.scan(file_regex)
+          end
         end
       }
 
@@ -562,7 +642,8 @@ module Puppet
 
     autorequire(:user) do
       # Autorequire users if they are specified by name
-      if user = self[:user] and user !~ /^\d+$/
+      user = self[:user]
+      if user && user !~ /^\d+$/
         user
       end
     end
@@ -577,12 +658,21 @@ module Puppet
     def check_all_attributes(refreshing = false)
       self.class.checks.each { |check|
         next if refreshing and check == :refreshonly
-        if @parameters.include?(check)
-          val = @parameters[check].value
-          val = [val] unless val.is_a? Array
-          val.each do |value|
-            return false unless @parameters[check].check(value)
-          end
+
+        next unless @parameters.include?(check)
+
+        val = @parameters[check].value
+        val = [val] unless val.is_a? Array
+        val.each do |value|
+          next if @parameters[check].check(value)
+
+          # Give a debug message so users can figure out what command would have been
+          # but don't print sensitive commands or parameters in the clear
+          cmdstring = @parameters[:command].sensitive ? "[command redacted]" : @parameters[:command].value
+
+          debug(_("'%{cmd}' won't be executed because of failed check '%{check}'") % { cmd: cmdstring, check: check })
+
+          return false
         end
       }
 
@@ -590,20 +680,21 @@ module Puppet
     end
 
     def output
-      if self.property(:returns).nil?
-        return nil
+      if property(:returns).nil?
+        nil
       else
-        return self.property(:returns).output
+        property(:returns).output
       end
     end
 
     # Run the command, or optionally run a separately-specified command.
     def refresh
-      if self.check_all_attributes(true)
-        if cmd = self[:refresh]
+      if check_all_attributes(true)
+        cmd = self[:refresh]
+        if cmd
           provider.run(cmd)
         else
-          self.property(:returns).sync
+          property(:returns).sync
         end
       end
     end
@@ -613,12 +704,27 @@ module Puppet
     end
 
     private
+
     def set_sensitive_parameters(sensitive_parameters)
-      # Respect sensitive commands
-      if sensitive_parameters.include?(:command)
-        sensitive_parameters.delete(:command)
-        parameter(:command).sensitive = true
+      # If any are sensitive, mark all as sensitive
+      sensitive = false
+      parameters_to_check = [:command, :unless, :onlyif]
+
+      parameters_to_check.each do |p|
+        if sensitive_parameters.include?(p)
+          sensitive_parameters.delete(p)
+          sensitive = true
+        end
+      end
+
+      if sensitive
+        parameters_to_check.each do |p|
+          if parameters.include?(p)
+            parameter(p).sensitive = true
+          end
+        end
       end
+
       super(sensitive_parameters)
     end
   end

data/lib/puppet/type/file/checksum.rb

@@ -1,4 +1,6 @@
-require 'puppet/util/checksums'
+# frozen_string_literal: true
+
+require_relative '../../../puppet/util/checksums'
 
 # Specify which checksum algorithm to use when checksumming
 # files.
@@ -7,9 +9,9 @@ Puppet::Type.type(:file).newparam(:checksum) do
 
   desc "The checksum type to use when determining whether to replace a file's contents.
 
-    The default checksum type is md5."
+    The default checksum type is #{Puppet.default_digest_algorithm}."
 
-  newvalues "md5", "md5lite", "sha224", "sha256", "sha256lite", "sha384", "sha512", "mtime", "ctime", "none"
+  newvalues(*Puppet::Util::Checksums.known_checksum_types)
 
   defaultto do
     Puppet[:digest_algorithm].to_sym
@@ -23,18 +25,18 @@ Puppet::Type.type(:file).newparam(:checksum) do
 
   def sum(content)
     content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
-    type = digest_algorithm()
+    type = digest_algorithm
     "{#{type}}" + send(type, content)
   end
 
   def sum_file(path)
-    type = digest_algorithm()
+    type = digest_algorithm
     method = type.to_s + "_file"
     "{#{type}}" + send(method, path).to_s
   end
 
   def sum_stream(&block)
-    type = digest_algorithm()
+    type = digest_algorithm
     method = type.to_s + "_stream"
     checksum = send(method, &block)
     "{#{type}}#{checksum}"

data/lib/puppet/type/file/checksum_value.rb

@@ -1,5 +1,7 @@
-require 'puppet/util/checksums'
-require 'puppet/type/file/data_sync'
+# frozen_string_literal: true
+
+require_relative '../../../puppet/util/checksums'
+require_relative '../../../puppet/type/file/data_sync'
 
 module Puppet
   Puppet::Type.type(:file).newproperty(:checksum_value) do
@@ -7,7 +9,7 @@ module Puppet
     include Puppet::DataSync
 
     desc "The checksum of the source contents. Only md5, sha256, sha224, sha384 and sha512
-      are supported when specifying this parameter. If this parameter is set, 
+      are supported when specifying this parameter. If this parameter is set,
       source_permissions will be assumed to be false, and ownership and permissions
       will not be read from source."
 
@@ -18,12 +20,13 @@ module Puppet
         return true
       end
 
-      checksum_insync?(resource.parameter(:source), is, true) {|_is| super(_is)}
+      checksum_insync?(resource.parameter(:source), is, true) { |inner| super(inner) }
     end
 
     def property_matches?(current, desired)
       return true if super(current, desired)
-      return date_matches?(resource.parameter(:checksum).value, current, desired)
+
+      date_matches?(resource.parameter(:checksum).value, current, desired)
     end
 
     def retrieve
@@ -49,6 +52,5 @@ module Puppet
       # so instruct the resource to write its contents.
       contents_sync(resource.parameter(:source))
     end
-
   end
 end