puppet 6.0.5-x64-mingw32 → 8.8.1-x64-mingw32

data/lib/puppet/type/package.rb

@@ -1,10 +1,13 @@
+# coding: utf-8
+# frozen_string_literal: true
+
 # Define the different packaging systems.  Each package system is implemented
 # in a module, which then gets used to individually extend each package object.
 # This allows packages to exist on the same machine using different packaging
 # systems.
 
-require 'puppet/parameter/package_options'
-require 'puppet/parameter/boolean'
+require_relative '../../puppet/parameter/package_options'
+require_relative '../../puppet/parameter/boolean'
 
 module Puppet
   Type.newtype(:package) do
@@ -20,8 +23,8 @@ module Puppet
       requires in order to function, and you must meet those requirements
       to use a given provider.
 
-      You can declare multiple package resources with the same `name`, as long
-      as they specify different providers and have unique titles.
+      You can declare multiple package resources with the same `name` as long
+      as they have unique titles, and specify different providers and commands.
 
       Note that you must use the _title_ to make a reference to a package
       resource; `Package[<NAME>]` is not a synonym for `Package[<TITLE>]` like
@@ -32,40 +35,47 @@ module Puppet
       resource will autorequire those files."
 
     feature :reinstallable, "The provider can reinstall packages.",
-      :methods => [:reinstall]
+            :methods => [:reinstall]
     feature :installable, "The provider can install packages.",
-      :methods => [:install]
+            :methods => [:install]
     feature :uninstallable, "The provider can uninstall packages.",
-      :methods => [:uninstall]
+            :methods => [:uninstall]
     feature :upgradeable, "The provider can upgrade to the latest version of a
         package.  This feature is used by specifying `latest` as the
         desired value for the package.",
-      :methods => [:update, :latest]
+            :methods => [:update, :latest]
     feature :purgeable, "The provider can purge packages.  This generally means
         that all traces of the package are removed, including
         existing configuration files.  This feature is thus destructive
         and should be used with the utmost care.",
-      :methods => [:purge]
+            :methods => [:purge]
     feature :versionable, "The provider is capable of interrogating the
         package database for installed version(s), and can select
         which out of a set of available versions of a package to
         install if asked."
+    feature :version_ranges, "The provider can ensure version ranges."
     feature :holdable, "The provider is capable of placing packages on hold
         such that they are not automatically upgraded as a result of
         other package dependencies unless explicit action is taken by
-        a user or another package. Held is considered a superset of
-        installed.",
-      :methods => [:hold]
+        a user or another package.",
+            :methods => [:hold, :unhold]
+    feature :install_only, "The provider accepts options to only install packages never update (kernels, etc.)"
     feature :install_options, "The provider accepts options to be
       passed to the installer command."
     feature :uninstall_options, "The provider accepts options to be
       passed to the uninstaller command."
+    feature :disableable, "The provider can disable packages. This feature is used by specifying `disabled` as the
+      desired value for the package.",
+            :methods => [:disable]
+    feature :supports_flavors, "The provider accepts flavors, which are specific variants of packages."
     feature :package_settings, "The provider accepts package_settings to be
       ensured for the given package. The meaning and format of these settings is
       provider-specific.",
-      :methods => [:package_settings_insync?, :package_settings, :package_settings=]
+            :methods => [:package_settings_insync?, :package_settings, :package_settings=]
     feature :virtual_packages, "The provider accepts virtual package names for install and uninstall."
 
+    feature :targetable, "The provider accepts a targeted package management command."
+
     ensurable do
       desc <<-EOT
         What state the package should be in. On packaging systems that can
@@ -76,10 +86,12 @@ module Puppet
         specifying `purged` as the ensure value. This defaults to `installed`.
 
         Version numbers must match the full version to install, including
-        release if the provider uses a release moniker. Ranges or semver
-        patterns are not accepted except for the `gem` package provider. For
+        release if the provider uses a release moniker. For
         example, to install the bash package from the rpm
         `bash-4.1.2-29.el6.x86_64.rpm`, use the string `'4.1.2-29.el6'`.
+
+        On supported providers, version ranges can also be ensured. For example,
+        inequalities: `<2.0.0`, or intersections: `>1.0.0 <2.0.0`.
       EOT
 
       attr_accessor :latest
@@ -96,8 +108,8 @@ module Puppet
         provider.purge
       end
 
-      newvalue(:held, :event => :package_held, :required_features => :holdable) do
-        provider.hold
+      newvalue(:disabled, :required_features => :disableable) do
+        provider.disable
       end
 
       # Alias the 'present' value.
@@ -107,7 +119,7 @@ module Puppet
         # Because yum always exits with a 0 exit code, there's a retrieve
         # in the "install" method.  So, check the current state now,
         # to compare against later.
-        current = self.retrieve
+        current = retrieve
         begin
           provider.update
         rescue => detail
@@ -128,7 +140,7 @@ module Puppet
           self.fail Puppet::Error, _("Could not update: %{detail}") % { detail: detail }, detail
         end
 
-        if self.retrieve == :absent
+        if retrieve == :absent
           :package_installed
         else
           :package_changed
@@ -147,14 +159,14 @@ module Puppet
         @should.each { |should|
           case should
           when :present
-            return true unless [:absent, :purged, :held].include?(is)
+            return true unless [:absent, :purged, :disabled].include?(is)
           when :latest
             # Short-circuit packages that are not present
             return false if is == :absent || is == :purged
 
             # Don't run 'latest' more than about every 5 minutes
             if @latest and ((Time.now.to_i - @lateststamp) / 60) < 5
-              #self.debug "Skipping latest check"
+              # self.debug "Skipping latest check"
             else
               begin
                 @latest = provider.latest
@@ -167,19 +179,18 @@ module Puppet
             end
 
             case
-              when is.is_a?(Array) && is.include?(@latest)
-                return true
-              when is == @latest
-                return true
-              when is == :present
-                # This will only happen on packaging systems
-                # that can't query versions.
-                return true
-              else
-                self.debug "#{@resource.name} #{is.inspect} is installed, latest is #{@latest.inspect}"
+            when is.is_a?(Array) && is.include?(@latest)
+              return true
+            when is == @latest
+              return true
+            when is == :present
+              # This will only happen on packaging systems
+              # that can't query versions.
+              return true
+            else
+              debug "#{@resource.name} #{is.inspect} is installed, latest is #{@latest.inspect}"
             end
 
-
           when :absent
             return true if is == :absent || is == :purged
           when :purged
@@ -232,7 +243,7 @@ module Puppet
       conditionally:
 
           # In the 'openssl' class
-          $ssl = $operatingsystem ? {
+          $ssl = $os['name'] ? {
             solaris => SMCossl,
             default => openssl
           }
@@ -244,7 +255,7 @@ module Puppet
 
           ...
 
-          $ssh = $operatingsystem ? {
+          $ssh = $os['name'] ? {
             solaris => SMCossh,
             default => openssh
           }
@@ -259,7 +270,7 @@ module Puppet
       isnamevar
 
       validate do |value|
-        if !value.is_a?(String)
+        unless value.is_a?(String)
           raise ArgumentError, _("Name must be a String not %{klass}") % { klass: value.class }
         end
       end
@@ -271,20 +282,59 @@ module Puppet
     providify
     paramclass(:provider).isnamevar
 
-    # We have more than one namevar, so we need title_patterns. However, we
-    # cheat and set the patterns to map to name only and completely ignore
-    # provider. So far, the logic that determines uniqueness appears to just
-    # "Do The Right Thing™" when the provider is explicitly set by the user.
+    def self.parameters_to_include
+      [:provider]
+    end
+
+    # Specify a targeted package management command.
+    newparam(:command, :required_features => :targetable) do
+      desc <<-EOT
+        The targeted command to use when managing a package:
+
+          package { 'mysql':
+            provider => gem,
+          }
+
+          package { 'mysql-opt':
+            name     => 'mysql',
+            provider => gem,
+            command  => '/opt/ruby/bin/gem',
+          }
+
+        Each provider defines a package management command; and uses the first
+        instance of the command found in the PATH.
+
+        Providers supporting the targetable feature allow you to specify the
+        absolute path of the package management command; useful when multiple
+        instances of the command are installed, or the command is not in the PATH.
+      EOT
+
+      isnamevar
+      defaultto :default
+    end
+
+    # We have more than one namevar, so we need title_patterns.
+    # However, we cheat and set the patterns to map to name only
+    # and completely ignore provider (and command, for targetable providers).
+    # So far, the logic that determines uniqueness appears to just
+    # "Do The Right Thing™" when provider (and command) are explicitly set.
     #
     # The following resources will be seen as unique by puppet:
     #
     #     # Uniqueness Key: ['mysql', nil]
-    #     package{'mysql': }
+    #     package {'mysql': }
+    #
+    #     # Uniqueness Key: ['mysql', 'gem', nil]
+    #     package {'gem-mysql':
+    #       name     => 'mysql,
+    #       provider => gem,
+    #     }
     #
-    #     # Uniqueness Key: ['mysql', 'gem']
-    #     package{'gem-mysql':
+    #     # Uniqueness Key: ['mysql', 'gem', '/opt/ruby/bin/gem']
+    #     package {'gem-mysql-opt':
     #       name     => 'mysql,
     #       provider => gem
+    #       command  => '/opt/ruby/bin/gem',
     #     }
     #
     # This does not handle the case where providers like 'yum' and 'rpm' should
@@ -293,10 +343,10 @@ module Puppet
     def self.title_patterns
       # This is the default title pattern for all types, except hard-wired to
       # set only name.
-      [ [ /(.*)/m, [ [:name] ] ] ]
+      [[/(.*)/m, [[:name]]]]
     end
 
-    newproperty(:package_settings, :required_features=>:package_settings) do
+    newproperty(:package_settings, :required_features => :package_settings) do
       desc "Settings that can change the contents or configuration of a package.
 
         The formatting and effects of package_settings are provider-specific; any
@@ -345,7 +395,7 @@ module Puppet
         end
       end
 
-      def is_to_s(currentvalue)
+      def is_to_s(currentvalue) # rubocop:disable Naming/PredicateName
         if provider.respond_to?(:package_settings_is_to_s)
           provider.package_settings_is_to_s(should, currentvalue)
         else
@@ -357,16 +407,26 @@ module Puppet
         if provider.respond_to?(:package_settings_change_to_s)
           provider.package_settings_change_to_s(currentvalue, newvalue)
         else
-          super(currentvalue,newvalue)
+          super(currentvalue, newvalue)
+        end
+      end
+    end
+
+    newproperty(:flavor, :required_features => :supports_flavors) do
+      desc "OpenBSD and DNF modules support 'flavors', which are
+        further specifications for which type of package you want."
+      validate do |value|
+        if [:disabled, "disabled"].include?(@resource[:ensure]) && value
+          raise ArgumentError, _('Cannot have both `ensure => disabled` and `flavor`')
         end
       end
     end
 
     newparam(:source) do
-      desc "Where to find the package file. This is only used by providers that don't
+      desc "Where to find the package file. This is mostly used by providers that don't
         automatically download packages from a central repository. (For example:
-        the `yum` and `apt` providers ignore this attribute, but the `rpm` and
-        `dpkg` providers require it.)
+        the `yum` provider ignores this attribute, `apt` provider uses it if present
+        and the `rpm` and `dpkg` providers require it.)
 
         Different providers accept different values for `source`. Most providers
         accept paths to local files stored on the target system. Some providers
@@ -441,9 +501,35 @@ module Puppet
       newvalues(:true, :false)
     end
 
-    newparam(:flavor) do
-      desc "OpenBSD supports 'flavors', which are further specifications for
-        which type of package you want."
+    newparam(:enable_only, :boolean => false, :parent => Puppet::Parameter::Boolean) do
+      desc <<-EOT
+        Tells `dnf module` to only enable a specific module, instead
+        of installing its default profile.
+
+        Modules with no default profile will be enabled automatically
+        without the use of this parameter.
+
+        Conflicts with the `flavor` property, which selects a profile
+        to install.
+      EOT
+      defaultto false
+
+      validate do |value|
+        if [true, :true, "true"].include?(value) && @resource[:flavor]
+          raise ArgumentError, _('Cannot have both `enable_only => true` and `flavor`')
+        end
+        if [:disabled, "disabled"].include?(@resource[:ensure])
+          raise ArgumentError, _('Cannot have both `ensure => disabled` and `enable_only => true`')
+        end
+      end
+    end
+
+    newparam(:install_only, :boolean => false, :parent => Puppet::Parameter::Boolean, :required_features => :install_only) do
+      desc <<-EOT
+        It should be set for packages that should only ever be installed,
+        never updated. Kernels in particular fall into this category.
+      EOT
+      defaultto false
     end
 
     newparam(:install_options, :parent => Puppet::Parameter::PackageOptions, :required_features => :install_options) do
@@ -497,18 +583,27 @@ module Puppet
     newparam(:allow_virtual, :boolean => true, :parent => Puppet::Parameter::Boolean, :required_features => :virtual_packages) do
       desc 'Specifies if virtual package names are allowed for install and uninstall.'
 
-      defaultto true
+      defaultto do
+        provider_class = provider.class
+        if provider_class.respond_to?(:defaultto_allow_virtual)
+          provider_class.defaultto_allow_virtual
+        else
+          true
+        end
+      end
     end
 
     autorequire(:file) do
       autos = []
       [:responsefile, :adminfile].each { |param|
-        if val = self[param]
+        val = self[param]
+        if val
           autos << val
         end
       }
 
-      if source = self[:source] and absolute_path?(source)
+      source = self[:source]
+      if source && absolute_path?(source)
         autos << source
       end
       autos
@@ -516,7 +611,8 @@ module Puppet
 
     # This only exists for testing.
     def clear
-      if obj = @parameters[:ensure]
+      obj = @parameters[:ensure]
+      if obj
         obj.latest = nil
       end
     end
@@ -556,13 +652,63 @@ module Puppet
     # that support the reinstall_on_refresh parameter.
     def refresh
       if provider.reinstallable? &&
-        @parameters[:reinstall_on_refresh].value == :true &&
-        @parameters[:ensure].value != :purged &&
-        @parameters[:ensure].value != :absent &&
-        @parameters[:ensure].value != :held
+         @parameters[:reinstall_on_refresh].value == :true &&
+         @parameters[:ensure].value != :purged &&
+         @parameters[:ensure].value != :absent
 
         provider.reinstall
       end
     end
+
+    newproperty(:mark, :required_features => :holdable) do
+      mark_doc = 'Valid values are: hold/none'
+      desc <<-EOT
+        Set to hold to tell Debian apt/Solaris pkg to hold the package version
+
+        #{mark_doc}
+        Default is "none". Mark can be specified with or without `ensure`,
+        if `ensure` is missing will default to "present".
+
+        Mark cannot be specified together with "purged", or "absent"
+        values for `ensure`.
+      EOT
+      newvalues(:hold, :none)
+      munge do |value|
+        case value
+        when "hold", :hold
+          :hold
+        when "none", :none
+          :none
+        else
+          raise ArgumentError, _('Invalid hold value %{value}. %{doc}') % { value: value.inspect, doc: mark_doc }
+        end
+      end
+
+      def insync?(is)
+        @should[0] == is
+      end
+
+      def should
+        @should[0] if @should && @should.is_a?(Array) && @should.size == 1
+      end
+
+      def retrieve
+        provider.properties[:mark]
+      end
+
+      def sync
+        if @should[0] == :hold
+          provider.hold
+        else
+          provider.unhold
+        end
+      end
+    end
+
+    validate do
+      if @parameters[:mark] && [:absent, :purged].include?(@parameters[:ensure].should)
+        raise ArgumentError, _('You cannot use "mark" property while "ensure" is one of ["absent", "purged"]')
+      end
+    end
   end
 end

data/lib/puppet/type/resources.rb

@@ -1,5 +1,7 @@
-require 'puppet'
-require 'puppet/parameter/boolean'
+# frozen_string_literal: true
+
+require_relative '../../puppet'
+require_relative '../../puppet/parameter/boolean'
 
 Puppet::Type.newtype(:resources) do
   @doc = "This is a metatype that can manage other resource types.  Any
@@ -7,6 +9,7 @@ Puppet::Type.newtype(:resources) do
     so you can purge unmanaged resources but set `noop` to true so the
     purging is only logged and does not actually happen."
 
+  apply_to_all
 
   newparam(:name) do
     desc "The name of the type to be managed."
@@ -15,7 +18,7 @@ Puppet::Type.newtype(:resources) do
       raise ArgumentError, _("Could not find resource type '%{name}'") % { name: name } unless Puppet::Type.type(name)
     end
 
-    munge { |v| v.to_s }
+    munge(&:to_s)
   end
 
   newparam(:purge, :boolean => true, :parent => Puppet::Parameter::Boolean) do
@@ -76,65 +79,63 @@ Puppet::Type.newtype(:resources) do
       value = [value] unless value.is_a? Array
       value.flatten.collect do |v|
         case v
-          when Integer
-            v
-          when String
-            Integer(v)
-          else
-            raise ArgumentError, _("Invalid value %{value}.") % { value: v.inspect }
+        when Integer
+          v
+        when String
+          Integer(v)
+        else
+          raise ArgumentError, _("Invalid value %{value}.") % { value: v.inspect }
         end
       end
     end
   end
 
   WINDOWS_SYSTEM_SID_REGEXES =
-      # Administrator, Guest, Domain Admins, Schema Admins, Enterprise Admins.
-      # https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
-      [/S-1-5-21.+-500/, /S-1-5-21.+-501/, /S-1-5-21.+-512/, /S-1-5-21.+-518/,
-       /S-1-5-21.+-519/]
+    # Administrator, Guest, Domain Admins, Schema Admins, Enterprise Admins.
+    # https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
+    [/S-1-5-21.+-500/, /S-1-5-21.+-501/, /S-1-5-21.+-512/, /S-1-5-21.+-518/,
+     /S-1-5-21.+-519/]
 
   def check(resource)
     @checkmethod ||= "#{self[:name]}_check"
     @hascheck ||= respond_to?(@checkmethod)
     if @hascheck
-      return send(@checkmethod, resource)
+      send(@checkmethod, resource)
     else
-      return true
+      true
     end
   end
 
   def able_to_ensure_absent?(resource)
-      resource[:ensure] = :absent
+    resource[:ensure] = :absent
   rescue ArgumentError, Puppet::Error
-      err _("The 'ensure' attribute on %{name} resources does not accept 'absent' as a value") % { name: self[:name] }
-      false
+    err _("The 'ensure' attribute on %{name} resources does not accept 'absent' as a value") % { name: self[:name] }
+    false
   end
 
   # Generate any new resources we need to manage.  This is pretty hackish
   # right now, because it only supports purging.
   def generate
-    return [] unless self.purge?
-    resource_type.instances.
-      reject { |r| catalog.resource_refs.include? r.ref }.
-      select { |r| check(r) }.
-      select { |r| r.class.validproperty?(:ensure) }.
-      select { |r| able_to_ensure_absent?(r) }.
-      each { |resource|
-        @parameters.each do |name, param|
-          resource[name] = param.value if param.metaparam?
-        end
-
-        # Mark that we're purging, so transactions can handle relationships
-        # correctly
-        resource.purging
-      }
+    return [] unless purge?
+
+    resource_type.instances
+                 .reject { |r| catalog.resource_refs.include? r.ref }
+                 .select { |r| check(r) }
+                 .select { |r| r.class.validproperty?(:ensure) }
+                 .select { |r| able_to_ensure_absent?(r) }
+                 .each { |resource|
+      resource.copy_metaparams(@parameters)
+      resource.purging
+    }
   end
 
   def resource_type
     unless defined?(@resource_type)
-      unless type = Puppet::Type.type(self[:name])
+      type = Puppet::Type.type(self[:name])
+      unless type
         raise Puppet::DevError, _("Could not find resource type")
       end
+
       @resource_type = type
     end
     @resource_type
@@ -144,6 +145,7 @@ Puppet::Type.newtype(:resources) do
   def user_check(resource)
     return true unless self[:name] == "user"
     return true unless self[:unless_system_user]
+
     resource[:audit] = :uid
     current_values = resource.retrieve_resource
     current_uid = current_values[resource.property(:uid)]
@@ -151,6 +153,7 @@ Puppet::Type.newtype(:resources) do
 
     return false if system_users.include?(resource[:name])
     return false if unless_uids && unless_uids.include?(current_uid)
+
     if current_uid.is_a?(String)
       # Windows user; is a system user if any regex matches.
       WINDOWS_SYSTEM_SID_REGEXES.none? { |regex| current_uid =~ regex }
@@ -160,7 +163,7 @@ Puppet::Type.newtype(:resources) do
   end
 
   def system_users
-    %w{root nobody bin noaccess daemon sys}
+    %w[root nobody bin noaccess daemon sys]
   end
 
   def self.system_users_max_uid
@@ -169,17 +172,16 @@ Puppet::Type.newtype(:resources) do
     # First try to read the minimum user id from login.defs
     if Puppet::FileSystem.exist?('/etc/login.defs')
       @system_users_max_uid = Puppet::FileSystem.each_line '/etc/login.defs' do |line|
-        break $1.to_i - 1 if line =~ /^\s*UID_MIN\s+(\d+)(\s*#.*)?$/
+        break Regexp.last_match(1).to_i - 1 if line =~ /^\s*UID_MIN\s+(\d+)(\s*#.*)?$/
       end
     end
 
     # Otherwise, use a sensible default based on the OS family
-    @system_users_max_uid ||= case Facter.value(:osfamily)
-      when 'OpenBSD', 'FreeBSD'
-        999
-      else
-        499
-    end
+    @system_users_max_uid ||=
+      case Puppet.runtime[:facter].value('os.family')
+      when 'OpenBSD', 'FreeBSD' then 999
+      else                           499
+      end
 
     @system_users_max_uid
   end