puppet 6.0.5-x64-mingw32 → 8.8.1-x64-mingw32

data/lib/puppet/util/windows/access_control_list.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Windows Access Control List
 #
 # Represents a list of access control entries (ACEs).
@@ -25,7 +27,7 @@ class Puppet::Util::Windows::AccessControlList
   #
   # @yieldparam ace [Hash] the ace
   def each
-    @aces.each {|ace| yield ace}
+    @aces.each { |ace| yield ace }
   end
 
   # Allow the +sid+ to access a resource with the specified access +mask+.
@@ -69,8 +71,8 @@ class Puppet::Util::Windows::AccessControlList
           # flags except those affecting inheritance of the
           # ACE we're creating.
           inherit_mask = Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE |
-            Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE |
-            Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE
+                         Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE |
+                         Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE
           explicit_ace = Puppet::Util::Windows::AccessControlEntry.new(new_sid, ace.mask, ace.flags & inherit_mask, ace.type)
           aces_to_prepend << explicit_ace
         else
@@ -87,8 +89,9 @@ class Puppet::Util::Windows::AccessControlList
     if prepend_needed
       mask = Puppet::Util::Windows::File::STANDARD_RIGHTS_ALL | Puppet::Util::Windows::File::SPECIFIC_RIGHTS_ALL
       ace = Puppet::Util::Windows::AccessControlEntry.new(
-              Puppet::Util::Windows::SID::LocalSystem,
-              mask)
+        Puppet::Util::Windows::SID::LocalSystem,
+        mask
+      )
       @aces << ace
     end
 
@@ -97,7 +100,7 @@ class Puppet::Util::Windows::AccessControlList
   end
 
   def inspect
-    str = ""
+    str = ''.dup
     @aces.each do |ace|
       str << "  #{ace.inspect}\n"
     end
@@ -106,7 +109,7 @@ class Puppet::Util::Windows::AccessControlList
 
   def ==(other)
     self.class == other.class &&
-      self.to_a == other.to_a
+      to_a == other.to_a
   end
 
   alias eql? ==

data/lib/puppet/util/windows/adsi.rb

@@ -1,23 +1,38 @@
+# frozen_string_literal: true
+
 module Puppet::Util::Windows::ADSI
   require 'ffi'
 
+  # https://docs.microsoft.com/en-us/windows/win32/api/dsrole/ne-dsrole-dsrole_machine_role
+  STANDALONE_WORKSTATION = 0
+  MEMBER_WORKSTATION = 1
+  STANDALONE_SERVER = 2
+  MEMBER_SERVER = 3
+  BACKUP_DOMAIN_CONTROLLER = 4
+  PRIMARY_DOMAIN_CONTROLLER = 5
+
+  DOMAIN_ROLES = {
+    STANDALONE_WORKSTATION => :STANDALONE_WORKSTATION,
+    MEMBER_WORKSTATION => :MEMBER_WORKSTATION,
+    STANDALONE_SERVER => :STANDALONE_SERVER,
+    MEMBER_SERVER => :MEMBER_SERVER,
+    BACKUP_DOMAIN_CONTROLLER => :BACKUP_DOMAIN_CONTROLLER,
+    PRIMARY_DOMAIN_CONTROLLER => :PRIMARY_DOMAIN_CONTROLLER,
+  }
+
   class << self
     extend FFI::Library
 
     def connectable?(uri)
-      begin
-        !! connect(uri)
-      rescue
-        false
-      end
+      !!connect(uri)
+    rescue
+      false
     end
 
     def connect(uri)
-      begin
-        WIN32OLE.connect(uri)
-      rescue WIN32OLERuntimeError => e
-        raise Puppet::Error.new( _("ADSI connection error: %{e}") % { e: e }, e )
-      end
+      WIN32OLE.connect(uri)
+    rescue WIN32OLERuntimeError => e
+      raise Puppet::Error.new(_("ADSI connection error: %{e}") % { e: e }, e)
     end
 
     def create(name, resource_type)
@@ -39,8 +54,9 @@ module Puppet::Util::Windows::ADSI
             buffer_size.write_dword(max_length) # length in TCHARs
 
             if GetComputerNameW(buffer, buffer_size) == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new(_("Failed to get computer name"))
+              raise Puppet::Util::Windows::Error, _("Failed to get computer name")
             end
+
             @computer_name = buffer.read_wide_string(buffer_size.read_dword)
           end
         end
@@ -52,7 +68,7 @@ module Puppet::Util::Windows::ADSI
       "WinNT://#{host}"
     end
 
-    def wmi_resource_uri( host = '.' )
+    def wmi_resource_uri(host = '.')
       "winmgmts:{impersonationLevel=impersonate}!//#{host}/root/cimv2"
     end
 
@@ -63,7 +79,7 @@ module Puppet::Util::Windows::ADSI
     # account name with or without domain prefix
     # @api private
     def sid_uri_safe(sid)
-      return sid_uri(sid) if sid.kind_of?(Puppet::Util::Windows::SID::Principal)
+      return sid_uri(sid) if sid.is_a?(Puppet::Util::Windows::SID::Principal)
 
       begin
         sid = Puppet::Util::Windows::SID.name_to_principal(sid)
@@ -77,7 +93,7 @@ module Puppet::Util::Windows::ADSI
     # used for IAdsGroup::Add / IAdsGroup::Remove.  These URIs are not useable
     # to resolve an account with WIN32OLE.connect
     def sid_uri(sid)
-      raise Puppet::Error.new( _("Must use a valid SID::Principal") ) if !sid.kind_of?(Puppet::Util::Windows::SID::Principal)
+      raise Puppet::Error, _("Must use a valid SID::Principal") unless sid.is_a?(Puppet::Util::Windows::SID::Principal)
 
       "WinNT://#{sid.sid}"
     end
@@ -94,6 +110,14 @@ module Puppet::Util::Windows::ADSI
       wmi_connection.execquery(query)
     end
 
+    def domain_role
+      unless @domain_role
+        query_result = Puppet::Util::Windows::ADSI.execquery('select DomainRole from Win32_ComputerSystem').to_enum.first
+        @domain_role = DOMAIN_ROLES[query_result.DomainRole] if query_result
+      end
+      @domain_role
+    end
+
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
@@ -103,7 +127,7 @@ module Puppet::Util::Windows::ADSI
     # );
     ffi_lib :kernel32
     attach_function_private :GetComputerNameW,
-      [:lpwstr, :lpdword], :win32_bool
+                            [:lpwstr, :lpdword], :win32_bool
   end
 
   # Common base class shared by the User and Group
@@ -133,15 +157,15 @@ module Puppet::Util::Windows::ADSI
       end
 
       def parse_name(name)
-        if name =~ /\//
-          raise Puppet::Error.new( _("Value must be in DOMAIN\\%{object_class} style syntax") % { object_class: @object_class } )
+        if name =~ %r{/}
+          raise Puppet::Error, _("Value must be in DOMAIN\\%{object_class} style syntax") % { object_class: @object_class }
         end
 
         matches = name.scan(/((.*)\\)?(.*)/)
         domain = matches[0][1] || '.'
         account = matches[0][2]
 
-        return account, domain
+        [account, domain]
       end
 
       # returns Puppet::Util::Windows::SID::Principal[]
@@ -150,24 +174,31 @@ module Puppet::Util::Windows::ADSI
         sids = []
         adsi_child_collection.each do |m|
           sids << Puppet::Util::Windows::SID.ads_to_principal(m)
+        rescue Puppet::Util::Windows::Error => e
+          case e.code
+          when Puppet::Util::Windows::SID::ERROR_TRUSTED_RELATIONSHIP_FAILURE, Puppet::Util::Windows::SID::ERROR_TRUSTED_DOMAIN_FAILURE
+            sids << Puppet::Util::Windows::SID.unresolved_principal(m.name, m.sid)
+          else
+            raise e
+          end
         end
 
         sids
       end
 
-      def name_sid_hash(names)
+      def name_sid_hash(names, allow_unresolved = false)
         return {} if names.nil? || names.empty?
 
         sids = names.map do |name|
-          sid = Puppet::Util::Windows::SID.name_to_principal(name)
-          raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
+          sid = Puppet::Util::Windows::SID.name_to_principal(name, allow_unresolved)
+          raise Puppet::Error, _("Could not resolve name: %{name}") % { name: name } unless sid
+
           [sid.sid, sid]
         end
 
-        Hash[ sids ]
+        sids.to_h
       end
 
-
       def delete(name)
         Puppet::Util::Windows::ADSI.delete(name, @object_class)
       end
@@ -176,13 +207,20 @@ module Puppet::Util::Windows::ADSI
         well_known = false
         if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
           # Examples of SidType include SidTypeUser, SidTypeGroup
-          return true if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
+          if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
+            # Check if we're getting back a local user when domain-joined
+            return true unless [:MEMBER_WORKSTATION, :MEMBER_SERVER].include?(Puppet::Util::Windows::ADSI.domain_role)
+
+            # The resource domain and the computer name are not always case-matching
+            return sid.domain.casecmp(Puppet::Util::Windows::ADSI.computer_name) == 0
+          end
 
           # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
           # so try to resolve it
           # https://msdn.microsoft.com/en-us/library/cc234477.aspx
           well_known = sid.account_type == :SidTypeWellKnownGroup
           return false if sid.account_type != :SidTypeAlias && !well_known
+
           name_or_sid = "#{sid.domain}\\#{sid.account}"
         end
 
@@ -213,6 +251,7 @@ module Puppet::Util::Windows::ADSI
     end
 
     attr_reader :name
+
     def initialize(name, native_object = nil)
       @name = name
       @native_object = native_object
@@ -249,12 +288,10 @@ module Puppet::Util::Windows::ADSI
       rescue WIN32OLERuntimeError => e
         # ERROR_BAD_USERNAME 2202L from winerror.h
         if e.message =~ /8007089A/m
-          raise Puppet::Error.new(
-            _("Puppet is not able to create/delete domain %{object_class} objects with the %{object_class} resource.") % { object_class: object_class },
-          )
+          raise Puppet::Error, _("Puppet is not able to create/delete domain %{object_class} objects with the %{object_class} resource.") % { object_class: object_class }
         end
 
-        raise Puppet::Error.new( _("%{object_class} update failed: %{error}") % { object_class: object_class.capitalize, error: e }, e )
+        raise Puppet::Error.new(_("%{object_class} update failed: %{error}") % { object_class: object_class.capitalize, error: e }, e)
       end
       self
     end
@@ -263,7 +300,7 @@ module Puppet::Util::Windows::ADSI
   class User < ADSIObject
     extend FFI::Library
 
-    require 'puppet/util/windows/sid'
+    require_relative '../../../puppet/util/windows/sid'
 
     # https://msdn.microsoft.com/en-us/library/aa746340.aspx
     # IADsUser interface
@@ -280,7 +317,8 @@ module Puppet::Util::Windows::ADSI
 
       def create(name)
         # Windows error 1379: The specified local group already exists.
-        raise Puppet::Error.new(_("Cannot create user if group '%{name}' exists.") % { name: name }) if Puppet::Util::Windows::ADSI::Group.exists? name
+        raise Puppet::Error, _("Cannot create user if group '%{name}' exists.") % { name: name } if Puppet::Util::Windows::ADSI::Group.exists? name
+
         new(name, Puppet::Util::Windows::ADSI.create(name, @object_class))
       end
     end
@@ -290,7 +328,11 @@ module Puppet::Util::Windows::ADSI
     end
 
     def add_flag(flag_name, value)
-      flag = native_object.Get(flag_name) rescue 0
+      flag = begin
+        native_object.Get(flag_name)
+      rescue
+        0
+      end
 
       native_object.Put(flag_name, flag | value)
 
@@ -298,7 +340,7 @@ module Puppet::Util::Windows::ADSI
     end
 
     def password=(password)
-      if !password.nil?
+      unless password.nil?
         native_object.SetPassword(password)
         commit
       end
@@ -312,7 +354,11 @@ module Puppet::Util::Windows::ADSI
       # WIN32OLE objects aren't enumerable, so no map
       groups = []
       # Setting WIN32OLE.codepage ensures values are returned as UTF-8
-      native_object.Groups.each {|g| groups << g.Name} rescue nil
+      begin
+        native_object.Groups.each { |g| groups << g.Name }
+      rescue
+        nil
+      end
       groups
     end
 
@@ -330,14 +376,13 @@ module Puppet::Util::Windows::ADSI
     end
     alias remove_from_group remove_from_groups
 
-
     def add_group_sids(*sids)
-      group_names = sids.map { |s| s.domain_account }
+      group_names = sids.map(&:domain_account)
       add_to_groups(*group_names)
     end
 
     def remove_group_sids(*sids)
-      group_names = sids.map { |s| s.domain_account }
+      group_names = sids.map(&:domain_account)
       remove_from_groups(*group_names)
     end
 
@@ -354,18 +399,18 @@ module Puppet::Util::Windows::ADSI
 
       desired_groups = desired_groups.split(',').map(&:strip)
 
-      current_hash = Hash[ self.group_sids.map { |sid| [sid.sid, sid] } ]
+      current_hash = group_sids.to_h { |sid| [sid.sid, sid] }
       desired_hash = self.class.name_sid_hash(desired_groups)
 
       # First we add the user to all the groups it should be in but isn't
-      if !desired_groups.empty?
+      unless desired_groups.empty?
         groups_to_add = (desired_hash.keys - current_hash.keys).map { |sid| desired_hash[sid] }
         add_group_sids(*groups_to_add)
       end
 
       # Then we remove the user from all groups it is in but shouldn't be, if
       # that's been requested
-      if !minimum
+      unless minimum
         if desired_hash.empty?
           groups_to_remove = current_hash.values
         else
@@ -383,32 +428,32 @@ module Puppet::Util::Windows::ADSI
     #   https://support.microsoft.com/en-us/help/305144/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-pro
     # for the flag values.
     ADS_USERFLAGS = {
-      ADS_UF_SCRIPT:                                 0x0001,
-      ADS_UF_ACCOUNTDISABLE:                         0x0002,
-      ADS_UF_HOMEDIR_REQUIRED:                       0x0008,
-      ADS_UF_LOCKOUT:                                0x0010,                          
-      ADS_UF_PASSWD_NOTREQD:                         0x0020,                   
-      ADS_UF_PASSWD_CANT_CHANGE:                     0x0040,               
-      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:        0x0080,       
-      ADS_UF_TEMP_DUPLICATE_ACCOUNT:                 0x0100,           
-      ADS_UF_NORMAL_ACCOUNT:                         0x0200,                   
-      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT:              0x0800,        
-      ADS_UF_WORKSTATION_TRUST_ACCOUNT:              0x1000,        
-      ADS_UF_SERVER_TRUST_ACCOUNT:                   0x2000,             
-      ADS_UF_DONT_EXPIRE_PASSWD:                     0x10000,            
-      ADS_UF_MNS_LOGON_ACCOUNT:                      0x20000,               
-      ADS_UF_SMARTCARD_REQUIRED:                     0x40000,              
-      ADS_UF_TRUSTED_FOR_DELEGATION:                 0x80000,          
-      ADS_UF_NOT_DELEGATED:                          0x100000,                  
-      ADS_UF_USE_DES_KEY_ONLY:                       0x200000,               
-      ADS_UF_DONT_REQUIRE_PREAUTH:                   0x400000,               
-      ADS_UF_PASSWORD_EXPIRED:                       0x800000,               
+      ADS_UF_SCRIPT: 0x0001,
+      ADS_UF_ACCOUNTDISABLE: 0x0002,
+      ADS_UF_HOMEDIR_REQUIRED: 0x0008,
+      ADS_UF_LOCKOUT: 0x0010,
+      ADS_UF_PASSWD_NOTREQD: 0x0020,
+      ADS_UF_PASSWD_CANT_CHANGE: 0x0040,
+      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED: 0x0080,
+      ADS_UF_TEMP_DUPLICATE_ACCOUNT: 0x0100,
+      ADS_UF_NORMAL_ACCOUNT: 0x0200,
+      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT: 0x0800,
+      ADS_UF_WORKSTATION_TRUST_ACCOUNT: 0x1000,
+      ADS_UF_SERVER_TRUST_ACCOUNT: 0x2000,
+      ADS_UF_DONT_EXPIRE_PASSWD: 0x10000,
+      ADS_UF_MNS_LOGON_ACCOUNT: 0x20000,
+      ADS_UF_SMARTCARD_REQUIRED: 0x40000,
+      ADS_UF_TRUSTED_FOR_DELEGATION: 0x80000,
+      ADS_UF_NOT_DELEGATED: 0x100000,
+      ADS_UF_USE_DES_KEY_ONLY: 0x200000,
+      ADS_UF_DONT_REQUIRE_PREAUTH: 0x400000,
+      ADS_UF_PASSWORD_EXPIRED: 0x800000,
       ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: 0x1000000
     }
 
     def userflag_set?(flag)
       flag_value = ADS_USERFLAGS[flag] || 0
-      ! (self['UserFlags'] & flag_value).zero?
+      !(self['UserFlags'] & flag_value).zero?
     end
 
     # Common helper for set_userflags and unset_userflags.
@@ -451,21 +496,23 @@ module Puppet::Util::Windows::ADSI
     rescue WIN32OLERuntimeError => e
       # This OLE error code indicates the property can't be found in the cache
       raise e unless e.message =~ /8000500D/m
+
       false
     end
 
     # UNLEN from lmcons.h - https://stackoverflow.com/a/2155176
     MAX_USERNAME_LENGTH = 256
     def self.current_user_name
-      user_name = ''
+      user_name = ''.dup
       max_length = MAX_USERNAME_LENGTH + 1 # NULL terminated
       FFI::MemoryPointer.new(max_length * 2) do |buffer| # wide string
         FFI::MemoryPointer.new(:dword, 1) do |buffer_size|
           buffer_size.write_dword(max_length) # length in TCHARs
 
           if GetUserNameW(buffer, buffer_size) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(_("Failed to get user name"))
+            raise Puppet::Util::Windows::Error, _("Failed to get user name")
           end
+
           # buffer_size includes trailing NULL
           user_name = buffer.read_wide_string(buffer_size.read_dword - 1)
         end
@@ -474,6 +521,43 @@ module Puppet::Util::Windows::ADSI
       user_name
     end
 
+    # https://docs.microsoft.com/en-us/windows/win32/api/secext/ne-secext-extended_name_format
+    NameUnknown           = 0
+    NameFullyQualifiedDN  = 1
+    NameSamCompatible     = 2
+    NameDisplay           = 3
+    NameUniqueId          = 6
+    NameCanonical         = 7
+    NameUserPrincipal     = 8
+    NameCanonicalEx       = 9
+    NameServicePrincipal  = 10
+    NameDnsDomain         = 12
+    NameGivenName         = 13
+    NameSurname           = 14
+
+    def self.current_user_name_with_format(format)
+      user_name = ''.dup
+      max_length = 1024
+
+      FFI::MemoryPointer.new(:lpwstr, max_length * 2 + 1) do |buffer|
+        FFI::MemoryPointer.new(:dword, 1) do |buffer_size|
+          buffer_size.write_dword(max_length + 1)
+
+          if GetUserNameExW(format.to_i, buffer, buffer_size) == FFI::WIN32_FALSE
+            raise Puppet::Util::Windows::Error.new(_("Failed to get user name"), FFI.errno)
+          end
+
+          user_name = buffer.read_wide_string(buffer_size.read_dword).chomp
+        end
+      end
+
+      user_name
+    end
+
+    def self.current_sam_compatible_user_name
+      current_user_name_with_format(NameSamCompatible)
+    end
+
     def self.current_user_sid
       Puppet::Util::Windows::SID.name_to_principal(current_user_name)
     end
@@ -487,27 +571,33 @@ module Puppet::Util::Windows::ADSI
     # );
     ffi_lib :advapi32
     attach_function_private :GetUserNameW,
-      [:lpwstr, :lpdword], :win32_bool
+                            [:lpwstr, :lpdword], :win32_bool
+
+    # https://docs.microsoft.com/en-us/windows/win32/api/secext/nf-secext-getusernameexa
+    # BOOLEAN SEC_ENTRY GetUserNameExA(
+    #   EXTENDED_NAME_FORMAT NameFormat,
+    #   LPSTR                lpNameBuffer,
+    #   PULONG               nSize
+    # );type
+    ffi_lib :secur32
+    attach_function_private :GetUserNameExW, [:uint16, :lpwstr, :pointer], :win32_bool
   end
 
   class UserProfile
     def self.delete(sid)
-      begin
-        Puppet::Util::Windows::ADSI.wmi_connection.Delete("Win32_UserProfile.SID='#{sid}'")
-      rescue WIN32OLERuntimeError => e
-        # https://social.technet.microsoft.com/Forums/en/ITCG/thread/0f190051-ac96-4bf1-a47f-6b864bfacee5
-        # Prior to Vista SP1, there's no built-in way to programmatically
-        # delete user profiles (except for delprof.exe). So try to delete
-        # but warn if we fail
-        raise e unless e.message.include?('80041010')
+      Puppet::Util::Windows::ADSI.wmi_connection.Delete("Win32_UserProfile.SID='#{sid}'")
+    rescue WIN32OLERuntimeError => e
+      # https://social.technet.microsoft.com/Forums/en/ITCG/thread/0f190051-ac96-4bf1-a47f-6b864bfacee5
+      # Prior to Vista SP1, there's no built-in way to programmatically
+      # delete user profiles (except for delprof.exe). So try to delete
+      # but warn if we fail
+      raise e unless e.message.include?('80041010')
 
-        Puppet.warning _("Cannot delete user profile for '%{sid}' prior to Vista SP1") % { sid: sid }
-      end
+      Puppet.warning _("Cannot delete user profile for '%{sid}' prior to Vista SP1") % { sid: sid }
     end
   end
 
   class Group < ADSIObject
-
     # https://msdn.microsoft.com/en-us/library/aa706021.aspx
     # IADsGroup interface
     @object_class = 'group'
@@ -519,7 +609,8 @@ module Puppet::Util::Windows::ADSI
 
       def create(name)
         # Windows error 2224: The account already exists.
-        raise Puppet::Error.new( _("Cannot create group if user '%{name}' exists.") % { name: name } ) if Puppet::Util::Windows::ADSI::User.exists?(name)
+        raise Puppet::Error, _("Cannot create group if user '%{name}' exists.") % { name: name } if Puppet::Util::Windows::ADSI::User.exists?(name)
+
         new(name, Puppet::Util::Windows::ADSI.create(name, @object_class))
       end
     end
@@ -547,11 +638,11 @@ module Puppet::Util::Windows::ADSI
     def set_members(desired_members, inclusive = true)
       return if desired_members.nil?
 
-      current_hash = Hash[ self.member_sids.map { |sid| [sid.sid, sid] } ]
+      current_hash = member_sids.to_h { |sid| [sid.sid, sid] }
       desired_hash = self.class.name_sid_hash(desired_members)
 
       # First we add all missing members
-      if !desired_hash.empty?
+      unless desired_hash.empty?
         members_to_add = (desired_hash.keys - current_hash.keys).map { |sid| desired_hash[sid] }
         add_member_sids(*members_to_add)
       end

data/lib/puppet/util/windows/com.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'ffi'
 
 module Puppet::Util::Windows::COM
@@ -59,7 +61,7 @@ module Puppet::Util::Windows::COM
   # );
   ffi_lib :ole32
   attach_function_private :CoCreateInstance,
-    [:pointer, :lpunknown, :dword, :pointer, :lpvoid], :hresult
+                          [:pointer, :lpunknown, :dword, :pointer, :lpvoid], :hresult
 
   # code modified from Unknownr project https://github.com/rpeev/Unknownr
   # licensed under MIT
@@ -67,13 +69,13 @@ module Puppet::Util::Windows::COM
     def self.[](*args)
       spec, iid, *ifaces = args.reverse
 
-      spec.each { |name, signature| signature[0].unshift(:pointer) }
+      spec.each { |_name, signature| signature[0].unshift(:pointer) }
 
       Class.new(FFI::Struct) do
         const_set(:IID, iid)
 
         vtable = Class.new(FFI::Struct) do
-          vtable_hash = Hash[(ifaces.map { |iface| iface::VTBL::SPEC.to_a } << spec.to_a).flatten(1)]
+          vtable_hash = (ifaces.map { |iface| iface::VTBL::SPEC.to_a } << spec.to_a).flatten(1).to_h
           const_set(:SPEC, vtable_hash)
 
           layout(
@@ -120,7 +122,7 @@ module Puppet::Util::Windows::COM
 
       self
     ensure
-      instance.Release if instance && ! instance.null?
+      instance.Release if instance && !instance.null?
     end
   end
 
@@ -139,9 +141,10 @@ module Puppet::Util::Windows::COM
 
         self::VTBL.members.each do |name|
           define_method(name) do |*args|
-            if Puppet::Util::Windows::COM.FAILED(result = @vtbl[name].call(self, *args))
+            if Puppet::Util::Windows::COM.FAILED((result = @vtbl[name].call(self, *args)))
               raise Puppet::Util::Windows::Error.new(_("Failed to call %{klass}::%{name} with HRESULT: %{result}.") % { klass: self, name: name, result: result }, result)
             end
+
             result
           end
         end
@@ -180,9 +183,10 @@ module Puppet::Util::Windows::COM
 
         self::VTBL.members.each do |name|
           define_method(name) do |*args|
-            if Puppet::Util::Windows::COM.FAILED(result = @vtbl[name].call(self, *args))
+            if Puppet::Util::Windows::COM.FAILED((result = @vtbl[name].call(self, *args)))
               raise Puppet::Util::Windows::Error.new(_("Failed to call %{klass}::%{name} with HRESULT: %{result}.") % { klass: self, name: name, result: result }, result)
             end
+
             result
           end
         end
@@ -195,7 +199,6 @@ module Puppet::Util::Windows::COM
 
   IUnknown = Interface[
     FFI::WIN32::GUID['00000000-0000-0000-C000-000000000046'],
-
     QueryInterface: [[:pointer, :pointer], :hresult],
     AddRef: [[], :win32_ulong],
     Release: [[], :win32_ulong]