puppet 6.11.1-x64-mingw32 → 6.16.0-x64-mingw32

data/lib/puppet/pops/types/type_parser.rb

@@ -1,3 +1,5 @@
+require 'puppet/concurrent/thread_local_singleton'
+
 # This class provides parsing of Type Specification from a string into the Type
 # Model that is produced by the TypeFactory.
 #
@@ -8,9 +10,7 @@
 module Puppet::Pops
 module Types
 class TypeParser
-  def self.singleton
-    @singleton ||= TypeParser.new
-  end
+  extend Puppet::Concurrent::ThreadLocalSingleton
 
   # @api public
   def initialize

data/lib/puppet/pops/validation/checker4_0.rb

@@ -93,7 +93,7 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     o = container(idx)
     idx -= 1
     case o
-    when NilClass, Model::HostClassDefinition, Model::Program
+    when NilClass, Model::ApplyExpression, Model::HostClassDefinition, Model::Program
       # ok, stop scanning parents
     when Model::BlockExpression
       c = container(idx)

data/lib/puppet/pops/validation/tasks_checker.rb

@@ -40,7 +40,11 @@ class TasksChecker < Checker4_0
   end
 
   def check_NodeDefinition(o)
-    illegalTasksExpression(o)
+    if in_ApplyExpression?
+      super(o)
+    else
+      illegalTasksExpression(o)
+    end
   end
 
   def check_RelationshipExpression(o)

data/lib/puppet/provider/aix_object.rb

@@ -330,8 +330,10 @@ class Puppet::Provider::AixObject < Puppet::Provider
   end
 
   def ia_module_args
-    return [] unless @resource[:ia_load_module]
-    ["-R", @resource[:ia_load_module].to_s]
+    raise ArgumentError, _("Cannot have both 'forcelocal' and 'ia_load_module' at the same time!") if @resource[:ia_load_module] && @resource[:forcelocal]
+    return ["-R", @resource[:ia_load_module].to_s] if @resource[:ia_load_module]
+    return ["-R", "files"] if @resource[:forcelocal]
+    []
   end
 
   def lscmd

data/lib/puppet/provider/group/aix.rb

@@ -18,6 +18,7 @@ Puppet::Type.type(:group).provide :aix, :parent => Puppet::Provider::AixObject d
   # Provider features
   has_features :manages_aix_lam
   has_features :manages_members
+  has_features :manages_local_users_and_groups
 
   class << self
     # Used by the AIX user provider. Returns a hash of:

data/lib/puppet/provider/group/groupadd.rb

@@ -2,9 +2,7 @@ require 'puppet/provider/nameservice/objectadd'
 require 'puppet/util/libuser'
 
 Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameService::ObjectAdd do
-  desc "Group management via `groupadd` and its ilk. The default for most platforms.
-
-  "
+  desc "Group management via `groupadd` and its ilk. The default for most platforms."
 
   commands :add => "groupadd", :delete => "groupdel", :modify => "groupmod"
 
@@ -16,7 +14,9 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
 
   optional_commands :localadd => "lgroupadd", :localdelete => "lgroupdel", :localmodify => "lgroupmod"
 
-  has_feature :libuser if Puppet.features.libuser?
+  has_feature :manages_local_users_and_groups, :manages_members if Puppet.features.libuser?
+
+  options :members, :flag => '-M', :method => :mem
 
   def exists?
     return !!localgid if @resource.forcelocal?
@@ -28,25 +28,9 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     get(:gid)
   end
 
-  def findgroup(key, value)
-    group_file = "/etc/group"
-    group_keys = ['group_name', 'password', 'gid', 'user_list']
-    index = group_keys.index(key)
-    File.open(group_file) do |f|
-      f.each_line do |line|
-         group = line.split(":")
-         if group[index] == value
-             f.close
-             return group
-         end
-      end
-    end
-    false
-  end
-
   def localgid
-    group = findgroup('group_name', resource[:name])
-    return group[2] if group
+    group = findgroup(:group_name, resource[:name])
+    return group[:gid] if group
     false
   end
 
@@ -56,7 +40,7 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     # to ensure consistent behaviour of the useradd provider when
     # using both useradd and luseradd
     if not @resource.allowdupe? and @resource.forcelocal?
-       if @resource.should(:gid) and findgroup('gid', @resource.should(:gid).to_s)
+       if @resource.should(:gid) and findgroup(:gid, @resource.should(:gid).to_s)
            raise(Puppet::Error, _("GID %{resource} already exists, use allowdupe to force group creation") % { resource: @resource.should(:gid).to_s })
        end
     elsif @resource.allowdupe? and not @resource.forcelocal?
@@ -65,6 +49,11 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     []
   end
 
+  def create
+    super
+    set(:members, @resource[:members]) if @resource[:members]
+  end
+
   def addcmd
     if @resource.forcelocal?
       cmd = [command(:localadd)]
@@ -85,13 +74,28 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     cmd
   end
 
+  def validate_members(members)
+    members.each do |member|
+      member.split(',').each do |user|
+        Etc.getpwnam(user.strip)
+      end
+    end
+  end
+
   def modifycmd(param, value)
-    if @resource.forcelocal?
+    if @resource.forcelocal? || @resource[:members]
       cmd = [command(:localmodify)]
       @custom_environment = Puppet::Util::Libuser.getenv
     else
       cmd = [command(:modify)]
     end
+
+    if param == :members
+      validate_members(value)
+      value = members_to_s(value)
+      purge_members if @resource[:auth_membership] && !members.empty?
+    end
+
     cmd << flag(param) << value
     # TODO the group type only really manages gid, so there are currently no
     # tests for this behavior
@@ -109,4 +113,33 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
       [command(:delete), @resource[:name]]
     end
   end
+
+  def members_insync?(current, should)
+    current.uniq.sort == @resource.parameter(:members).actual_should(current, should)
+  end
+
+  def members_to_s(current)
+    return '' if current.nil? || !current.kind_of?(Array)
+    current.join(',')
+  end
+
+  def purge_members
+    localmodify('-m', members_to_s(members), @resource.name)
+  end
+
+  private
+
+  def findgroup(key, value)
+    group_file = "/etc/group"
+    group_keys = [:group_name, :password, :gid, :user_list]
+    index = group_keys.index(key)
+    @group_content ||= File.read(group_file)
+    @group_content.each_line do |line|
+      group = line.split(":")
+      if group[index] == value
+        return Hash[group_keys.zip(group)]
+      end
+    end
+    false
+  end
 end

data/lib/puppet/provider/group/windows_adsi.rb

@@ -24,7 +24,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
     # since the default array_matching comparison is not commutative
 
     # dupes automatically weeded out when hashes built
-    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current)
+    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current, true)
     specified_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
 
     current_sids = current_members.keys.to_a
@@ -52,7 +52,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
         account = sid.account
       end
       resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
-      "#{sid.domain}\\#{account}"
+      sid.domain ? "#{sid.domain}\\#{account}" : account
     end
     return users.join(',')
   end
@@ -66,7 +66,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
   end
 
   def members
-    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members)
+    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members, true)
 
     # @members.keys returns an array of SIDs. We need to convert those SIDs into
     # names so that `puppet resource` prints the right output.

data/lib/puppet/provider/package/aix.rb

@@ -29,6 +29,15 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
 
   attr_accessor   :latest_info
 
+  STATE_CODE = {
+    'A' => :applied,
+    'B' => :broken,
+    'C' => :committed,
+    'E' => :efix_locked,
+    'O' => :obsolete,
+    '?' => :inconsistent,
+  }.freeze
+
   def self.srclistcmd(source)
     [ command(:installp), "-L", "-d", source ]
   end
@@ -97,6 +106,11 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
     if output =~ /^#{Regexp.escape(@resource[:name])}\s+.*\s+Already superseded by.*$/
       self.fail _("aix package provider is unable to downgrade packages")
     end
+
+    pkg_info = query
+    if pkg_info && [:broken, :inconsistent].include?(pkg_info[:status])
+      self.fail _("Package '%{name}' is in a %{status} state and requires manual intervention") % { name: @resource[:name], status: pkg_info[:status] }
+    end
   end
 
   def self.pkglist(hash = {})
@@ -108,8 +122,9 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
     end
 
     begin
-      list = execute(cmd).scan(/^[^#][^:]*:([^:]*):([^:]*)/).collect { |n,e|
-        { :name => n, :ensure => e, :provider => self.name }
+      list = execute(cmd).scan(/^[^#][^:]*:([^:]*):([^:]*):[^:]*:[^:]*:([^:])/).collect { |n,e,s|
+        e = :absent if [:broken, :inconsistent].include?(STATE_CODE[s])
+        { :name => n, :ensure => e, :status => STATE_CODE[s], :provider => self.name }
       }
     rescue Puppet::ExecutionFailure => detail
       if hash[:pkgname]

data/lib/puppet/provider/package/apt.rb

@@ -1,7 +1,11 @@
+require 'puppet/util/package/version/range'
+require 'puppet/util/package/version/debian'
+
 Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
   # Provide sorting functionality
   include Puppet::Util::Package
-
+  DebianVersion = Puppet::Util::Package::Version::Debian
+  VersionRange  = Puppet::Util::Package::Version::Range
   desc "Package management via `apt-get`.
 
     This provider supports the `install_options` attribute, which allows command-line flags to be passed to apt-get.
@@ -44,12 +48,44 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
     end
   end
 
+  def best_version(should_range)
+    available_versions = SortedSet.new
+
+    output = aptcache :madison, @resource[:name]
+    output.each_line do |line|
+      is = line.split('|')[1].strip
+      begin
+        is_version = DebianVersion.parse(is)
+        available_versions << is_version if should_range.include?(is_version)
+      rescue DebianVersion::ValidationFailure
+        Puppet.debug("Cannot parse #{is} as a debian version")
+      end
+    end
+
+    return available_versions.to_a.last unless available_versions.empty?
+
+    Puppet.debug("No available version for package #{@resource[:name]} is included in range #{should_range}")
+    should_range
+  end
+
   # Install a package using 'apt-get'.  This function needs to support
   # installing a specific version.
   def install
     self.run_preseed if @resource[:responsefile]
     should = @resource[:ensure]
 
+    if should.is_a?(String)
+      begin
+        should_range = VersionRange.parse(should, DebianVersion)
+
+        unless should_range.is_a?(VersionRange::Eq)
+          should = best_version(should_range)
+        end
+      rescue VersionRange::ValidationFailure, DebianVersion::ValidationFailure
+        Puppet.debug("Cannot parse #{should} as a debian version range, falling through")
+      end
+    end
+
     checkforcdrom
     cmd = %w{-q -y}
 
@@ -75,7 +111,12 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
     cmd += install_options if @resource[:install_options]
     cmd << :install << str
 
-    aptget(*cmd)
+    self.unhold if self.properties[:mark] == :hold
+    begin
+      aptget(*cmd)
+    ensure
+      self.hold if @resource[:mark] == :hold
+    end
   end
 
   # What's the latest package version available?
@@ -106,12 +147,18 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
 
   def uninstall
     self.run_preseed if @resource[:responsefile]
-    aptget "-y", "-q", :remove, @resource[:name]
+    args = ['-y', '-q']
+    args << '--allow-change-held-packages' if self.properties[:mark] == :hold
+    args << :remove << @resource[:name]
+    aptget(*args)
   end
 
   def purge
     self.run_preseed if @resource[:responsefile]
-    aptget '-y', '-q', :remove, '--purge', @resource[:name]
+    args = ['-y', '-q']
+    args << '--allow-change-held-packages' if self.properties[:mark] == :hold
+    args << :remove << '--purge' << @resource[:name]
+    aptget(*args)
     # workaround a "bug" in apt, that already removed packages are not purged
     super
   end
@@ -119,4 +166,31 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
   def install_options
     join_options(@resource[:install_options])
   end
+
+  def insync?(is)
+    # this is called after the generic version matching logic (insync? for the
+    # type), so we only get here if should != is
+
+    return false unless is && is != :absent
+
+    #if 'should' is a range and 'is' a debian version we should check if 'should' includes 'is'
+    should = @resource[:ensure]
+
+    return false unless is.is_a?(String) && should.is_a?(String)
+
+    begin
+      should_range = VersionRange.parse(should, DebianVersion)
+    rescue VersionRange::ValidationFailure, DebianVersion::ValidationFailure
+      Puppet.debug("Cannot parse #{should} as a debian version range")
+      return false
+    end
+
+    begin
+      is_version = DebianVersion.parse(is)
+    rescue DebianVersion::ValidationFailure
+      Puppet.debug("Cannot parse #{is} as a debian version")
+      return false
+    end
+    should_range.include?(is_version)
+  end
 end

data/lib/puppet/provider/package/dnfmodule.rb

@@ -12,7 +12,7 @@ require 'puppet/provider/package'
 
 Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
 
-  has_feature :installable, :uninstallable, :versionable
+  has_feature :installable, :uninstallable, :versionable, :supports_flavors, :disableable
   #has_feature :upgradeable
   # it's not (yet) feasible to make this upgradeable since module streams don't
   # always have matching version types (i.e. idm has streams DL1 and client,
@@ -34,14 +34,26 @@ Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
 
   def self.instances
     packages = []
-    cmd = "#{command(:dnf)} module list --installed -d 0 -e #{error_level}"
+    cmd = "#{command(:dnf)} module list -d 0 -e #{error_level}"
     execute(cmd).each_line do |line|
-      next unless line =~ /\[i\][, ]/  # get rid of non-package lines (including last Hint line)
-      line.gsub!(/\[[de]\]/, '')  # we don't care about default/enabled flags
+      # select only lines with actual packages since DNF clutters the output
+      next unless line =~ /\[[eix]\][, ]/
+      line.gsub!(/\[d\]/, '')  # we don't care about the default flag
+
+      flavor = if line.include?('[i]')
+                 line.split('[i]').first.split.last
+               else
+                 :absent
+               end
+
       packages << new(
         name: line.split[0],
-        ensure: line.split[1],
-        flavor: line.split('[i]').first.split.last,  # this is nasty
+        ensure: if line.include?('[x]')
+                  :disabled
+                else
+                  line.split[1]
+                end,
+        flavor: flavor,
         provider: name
       )
     end
@@ -55,33 +67,75 @@ Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
     pkg ? pkg.properties : nil
   end
 
-  def reset
-    execute([command(:dnf), 'module', 'reset', '-d', '0', '-e', self.class.error_level, '-y', @resource[:name]])
-  end
-
   # to install specific streams and profiles:
   # $ dnf module install module-name:stream/profile
   # $ dnf module install perl:5.24/minimal
   # if unspecified, they will be defaulted (see [d] param in dnf module list output)
   def install
-    args = @resource[:name]
     # ensure we start fresh (remove existing stream)
     uninstall unless [:absent, :purged].include?(@property_hash[:ensure])
+
+    args = @resource[:name].dup
     case @resource[:ensure]
     when true, false, Symbol
       # pass
     else
       args << ":#{@resource[:ensure]}"
     end
-    if @resource[:flavor]
-      args << "/#{@resource[:flavor]}"
+    args << "/#{@resource[:flavor]}" if @resource[:flavor]
+
+    if @resource[:enable_only] == true
+      enable(args)
+    else
+      begin
+        execute([command(:dnf), 'module', 'install', '-d', '0', '-e', self.class.error_level, '-y', args])
+      rescue Puppet::ExecutionFailure => e
+        # module has no default profile and no profile was requested, so just enable the stream
+        # DNF versions prior to 4.2.8 do not need this workaround
+        # see https://bugzilla.redhat.com/show_bug.cgi?id=1669527
+        if @resource[:flavor] == nil && e.message =~ /^missing groups or modules: #{Regexp.quote(@resource[:name])}$/
+          enable(args)
+        else
+          raise
+        end
+      end
+    end
+  end
+
+  # should only get here when @resource[ensure] is :disabled
+  def insync?(is)
+    if resource[:ensure] == :disabled
+      # in sync only if package is already disabled
+      pkg = self.class.instances.find do |package|
+        @resource[:name] == package.name && package.properties[:ensure] == :disabled
+      end
+      return true if pkg
     end
-    execute([command(:dnf), 'module', 'install', '-d', '0', '-e', self.class.error_level, '-y', args])
+    return false
+  end
+
+  def enable(args = @resource[:name])
+    execute([command(:dnf), 'module', 'enable', '-d', '0', '-e', self.class.error_level, '-y', args])
   end
 
   def uninstall
     execute([command(:dnf), 'module', 'remove', '-d', '0', '-e', self.class.error_level, '-y', @resource[:name]])
     reset  # reset module to the default stream
   end
-end
 
+  def disable(args = @resource[:name])
+    execute([command(:dnf), 'module', 'disable', '-d', '0', '-e', self.class.error_level, '-y', args])
+  end
+
+  def reset
+    execute([command(:dnf), 'module', 'reset', '-d', '0', '-e', self.class.error_level, '-y', @resource[:name]])
+  end
+
+  def flavor
+    @property_hash[:flavor]
+  end
+
+  def flavor=(value)
+    install if flavor != @resource.should(:flavor)
+  end
+end