puppet 6.11.1 → 6.16.0

data/lib/puppet/provider/package/zypper.rb

@@ -2,7 +2,7 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
   desc "Support for SuSE `zypper` package manager. Found in SLES10sp2+ and SLES11.
 
     This provider supports the `install_options` attribute, which allows command-line flags to be passed to zypper.
-    These options should be specified as an array where each element is either a 
+    These options should be specified as an array where each element is either a
     string or a hash."
 
   has_feature :versionable, :install_options, :virtual_packages
@@ -50,6 +50,41 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
     execute(cmd, { :failonfail => false, :combine => true})
   end
 
+  def best_version(should)
+    if should.is_a?(String)
+      begin
+        should_range = Puppet::Util::Package::Version::Range.parse(should, Puppet::Util::Package::Version::Rpm)
+      rescue Puppet::Util::Package::Version::Range::ValidationFailure, Puppet::Util::Package::Version::Rpm::ValidationFailure
+        Puppet.debug("Cannot parse #{should} as a RPM version range")
+        return should
+      end
+
+      if should_range.is_a?(Puppet::Util::Package::Version::Range::Eq)
+        return should
+      end
+
+      sorted_versions = SortedSet.new
+
+      output = zypper('search', '--match-exact', '--type', 'package', '--uninstalled-only', '-s', @resource[:name])
+      output.lines.each do |line|
+        pkg_ver = line.split(/\s*\|\s*/)
+        next unless pkg_ver[1] == @resource[:name]
+        begin
+          rpm_version = Puppet::Util::Package::Version::Rpm.parse(pkg_ver[3])
+
+          sorted_versions << rpm_version if should_range.include?(rpm_version)
+        rescue Puppet::Util::Package::Version::Rpm::ValidationFailure
+          Puppet.debug("Cannot parse #{pkg_ver[3]} as a RPM version")
+        end
+      end
+
+      return sorted_versions.entries.last if sorted_versions.any?
+
+      Puppet.debug("No available version for package #{@resource[:name]} is included in range #{should_range}")
+      should
+    end
+  end
+
   # Install a package using 'zypper'.
   def install
     should = @resource.should(:ensure)
@@ -62,6 +97,7 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
       should = nil
     else
       # Add the package version
+      should = best_version(should)
       wanted = "#{wanted}-#{should}"
     end
 
@@ -89,6 +125,7 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
     options = []
     options << quiet
     options << '--no-gpg-check' unless inst_opts.delete('--no-gpg-check').nil?
+    options << '--no-gpg-checks' unless inst_opts.delete('--no-gpg-checks').nil?
     options << :install
 
     #zypper 0.6.13 (OpenSuSE 10.2) does not support auto agree with licenses
@@ -142,4 +179,25 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
     end
 
   end
+
+  def insync?(is)
+    return false if [:purged, :absent].include?(is)
+
+    should = @resource[:ensure]
+    if should.is_a?(String)
+      begin
+        should_version = Puppet::Util::Package::Version::Range.parse(should, Puppet::Util::Package::Version::Rpm)
+      rescue Puppet::Util::Package::Version::Range::ValidationFailure, Puppet::Util::Package::Version::Rpm::ValidationFailure
+        Puppet.debug("Cannot parse #{should} as a RPM version range")
+        return super
+      end
+
+      begin
+        is_version = Puppet::Util::Package::Version::Rpm.parse(is)
+        should_version.include?(is_version)
+      rescue Puppet::Util::Package::Version::Rpm::ValidationFailure
+        Puppet.debug("Cannot parse #{is} as a RPM version")
+      end
+    end
+  end
 end

data/lib/puppet/provider/package_targetable.rb

@@ -25,24 +25,25 @@ require 'puppet/provider/package'
 class Puppet::Provider::Package::Targetable < Puppet::Provider::Package
   # Prefetch our package list, yo.
   def self.prefetch(packages)
-    catalog_packages = packages.first[1]::catalog::resources.select{ |p| p.provider.class == self }
+    catalog_packages = packages.values.first.catalog.resources.select{ |p| p.provider.class == self }
     package_commands = catalog_packages.map { |catalog_package| catalog_package::original_parameters[:command] }.uniq
     package_commands.each do |command|
       instances(command).each do |instance|
         catalog_packages.each do |catalog_package|
-          if catalog_package[:name] == instance.name && catalog_package::original_parameters[:command] == command
+          if catalog_package[:name] == instance.name && catalog_package.original_parameters[:command] == command
             catalog_package.provider = instance
-            self.debug "Prefetched instance: %{name} via command: %{command}" % { name: instance.name, cmd: (command || :default)}
+            self.debug "Prefetched instance: %{name} via command: %{cmd}" % { name: instance.name, cmd: (command || :default) }
           end
         end
       end
     end
+    package_commands
   end
 
   # Returns the resource command or provider command.
 
   def resource_or_provider_command
-    resource::original_parameters[:command] || self.class.provider_command
+    resource.original_parameters[:command] || self.class.provider_command
   end
 
   # Targetable providers use has_command/is_optional to defer validation of provider suitability.

data/lib/puppet/provider/service/systemd.rb

@@ -25,12 +25,13 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   notdefaultfor :operatingsystem => :LinuxMint, :operatingsystemmajrelease => ["10", "11", "12", "13", "14", "15", "16", "17"] # These are using upstart
   defaultfor :operatingsystem => :ubuntu
   notdefaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["10.04", "12.04", "14.04", "14.10"] # These are using upstart
-  defaultfor :operatingsystem => :cumuluslinux, :operatingsystemmajrelease => ["3"]
+  defaultfor :operatingsystem => :cumuluslinux, :operatingsystemmajrelease => ["3", "4"]
 
   def self.instances
     i = []
     output = systemctl('list-unit-files', '--type', 'service', '--full', '--all',  '--no-pager')
-    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect)\s*$/i).each do |m|
+    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad|static)\s*$/i).each do |m|
+      Puppet.debug("#{m[0]} marked as bad by `systemctl`. It is recommended to be further checked.") if m[1] == "bad"
       i << new(:name => m[0])
     end
     return i
@@ -38,6 +39,22 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
     return []
   end
 
+  # Static services cannot be enabled or disabled manually. Indirect services 
+  # should not be enabled or disabled due to limitations in systemd (see 
+  # https://github.com/systemd/systemd/issues/6681).
+  def enabled_insync?(current)
+    case cached_enabled?[:output]
+    when 'static'
+      Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
+      return true
+    when 'indirect'
+      Puppet.debug("Service #{@resource[:name]} is in 'indirect' state and cannot be enabled/disabled")
+      return true
+    else
+      current == @resource[:enable]
+    end
+  end
+
   # This helper ensures that the enable state cache is always reset
   # after a systemctl enable operation. A particular service state is not guaranteed
   # after such an operation, so the cache must be emptied to prevent inconsistencies
@@ -69,12 +86,13 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def cached_enabled?
     return @cached_enabled if @cached_enabled
     cmd = [command(:systemctl), 'is-enabled', '--', @resource[:name]]
-    @cached_enabled = execute(cmd, :failonfail => false).strip
+    result = execute(cmd, :failonfail => false)
+    @cached_enabled = { output: result.chomp, exitcode: result.exitstatus }
   end
 
   def enabled?
-    output = cached_enabled?
-    code = $CHILD_STATUS.exitstatus
+    output = cached_enabled?[:output]
+    code = cached_enabled?[:exitcode]
 
     # The masked state is equivalent to the disabled state in terms of
     # comparison so we only care to check if it is masked if we want to keep

data/lib/puppet/provider/user/aix.rb

@@ -32,6 +32,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   has_features :manages_aix_lam
   has_features :manages_homedir, :manages_passwords, :manages_shell
   has_features :manages_expiry,  :manages_password_age
+  has_features :manages_local_users_and_groups
 
   class << self
     def group_provider

data/lib/puppet/provider/user/directoryservice.rb

@@ -387,7 +387,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0)
       assert_full_pbkdf2_password
 
-      sleep 2
+      sleep 3
       flush_dscl_cache
       users_plist = get_users_plist(@resource.name)
       shadow_hash_data = get_shadow_hash_data(users_plist)
@@ -404,7 +404,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0)
       assert_full_pbkdf2_password
 
-      sleep 2
+      sleep 3
       flush_dscl_cache
       users_plist = get_users_plist(@resource.name)
       shadow_hash_data = get_shadow_hash_data(users_plist)
@@ -435,8 +435,8 @@ Puppet::Type.type(:user).provide :directoryservice do
   ['home', 'uid', 'gid', 'comment', 'shell'].each do |setter_method|
     define_method("#{setter_method}=") do |value|
       if @property_hash[setter_method.intern]
-        if self.class.get_os_version == '10.14' && %w(home uid).include?(setter_method)
-          raise Puppet::Error, "OS X version 10\.14 does not allow changing #{setter_method} using puppet"
+        if self.class.get_os_version.split('.').last.to_i >= 14 && %w(home uid).include?(setter_method)
+          raise Puppet::Error, "OS X version #{self.class.get_os_version} does not allow changing #{setter_method} using puppet"
         end
         begin
           dscl '.', '-change', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], @property_hash[setter_method.intern], value
@@ -572,7 +572,32 @@ Puppet::Type.type(:user).provide :directoryservice do
     else
       users_plist['ShadowHashData'] = [binary_plist]
     end
-    write_users_plist_to_disk(users_plist)
+    if Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.15') < 0
+      write_users_plist_to_disk(users_plist)
+    else
+      write_and_import_shadow_hash_data(users_plist['ShadowHashData'].first)
+    end
+  end
+
+  # This method writes the ShadowHashData plist in a temporary file,
+  # then imports it using dsimport. macOS versions 10.15 and newer do
+  # not support directly managing binary plists, so we have to use an
+  # intermediary.
+  # dsimport is an archaic utilitary with hard-to-find documentation
+  #
+  # See http://web.archive.org/web/20090106120111/http://support.apple.com/kb/TA21305?viewlocale=en_US
+  # for information regarding the dsimport syntax
+  def write_and_import_shadow_hash_data(data_plist)
+    Tempfile.create("dsimport_#{@resource.name}", :encoding => Encoding::ASCII) do |dsimport_file|
+      dsimport_file.write <<-DSIMPORT
+0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData
+#{@resource.name}:#{Base64.strict_encode64(data_plist)}
+      DSIMPORT
+      dsimport_file.flush
+      # Delete the user's existing ShadowHashData, since dsimport appends, not replaces
+      dscl('.', 'delete', "/Users/#{@resource.name}", 'ShadowHashData')
+      dsimport(dsimport_file.path, '/Local/Default', 'M')
+    end
   end
 
   # This method accepts an argument of a hex password hash, and base64

data/lib/puppet/provider/user/hpux.rb

@@ -29,7 +29,7 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
 
   def modifycmd(param,value)
      cmd = super(param, value)
-     cmd << "-F"
+     cmd.insert(1,"-F")
      if trusted then
        # Append an additional command to reset the password age to 0
        # until a workaround with expiry module can be found for trusted

data/lib/puppet/provider/user/useradd.rb

@@ -21,7 +21,11 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
   options :expiry, :method => :sp_expire,
     :munge => proc { |value|
       if value == :absent
-        ''
+        if Facter.value(:operatingsystem)=='SLES' && Facter.value(:operatingsystemmajrelease) == "11"
+          -1
+        else
+          ''
+        end
       else
         case Facter.value(:operatingsystem)
         when 'Solaris'
@@ -43,7 +47,7 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     }
 
   optional_commands :localadd => "luseradd", :localdelete => "luserdel", :localmodify => "lusermod", :localpassword => "lchage"
-  has_feature :libuser if Puppet.features.libuser?
+  has_feature :manages_local_users_and_groups if Puppet.features.libuser?
 
   def exists?
     return !!localuid if @resource.forcelocal?
@@ -64,12 +68,11 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     passwd_file = "/etc/passwd"
     passwd_keys = [:account, :password, :uid, :gid, :gecos, :directory, :shell]
     index = passwd_keys.index(key)
-    File.open(passwd_file) do |f|
-      f.each_line do |line|
-        user = line.split(":")
-        if user[index] == value
-          return Hash[passwd_keys.zip(user)]
-        end
+    @passwd_content ||= File.read(passwd_file)
+    @passwd_content.each_line do |line|
+      user = line.split(":")
+      if user[index] == value
+        return Hash[passwd_keys.zip(user)]
       end
     end
     false

data/lib/puppet/reports/http.rb

@@ -20,19 +20,23 @@ Puppet::Reports.register_report(:http) do
     # (Puppet::Network::HTTP) but is used by Puppet Server's http client
     # (Puppet::Server::HttpClient) to track metrics on the request made to the
     # `reporturl` to store a report.
-    options = { :metric_id => [:puppet, :report, :http] }
+    options = {
+      :metric_id => [:puppet, :report, :http],
+      :include_system_store => Puppet[:report_include_system_store],
+    }
+
     if url.user && url.password
       options[:basic_auth] = {
-        :user => url.user,
-        :password => url.password
+        user: url.user,
+        password: url.password
       }
     end
-    use_ssl = url.scheme == 'https'
-    ssl_context = use_ssl ? Puppet.lookup(:ssl_context) : nil
-    conn = Puppet::Network::HttpPool.connection(url.host, url.port, use_ssl: use_ssl, ssl_context: ssl_context)
-    response = conn.post(url.path, self.to_yaml, headers, options)
-    unless response.kind_of?(Net::HTTPSuccess)
-      Puppet.err _("Unable to submit report to %{url} [%{code}] %{message}") % { url: Puppet[:reporturl].to_s, code: response.code, message: response.msg }
+
+    client = Puppet.runtime[:http]
+    client.post(url, self.to_yaml, headers: headers, options: options) do |response|
+      unless response.success?
+        Puppet.err _("Unable to submit report to %{url} [%{code}] %{message}") % { url: Puppet[:reporturl].to_s, code: response.code, message: response.reason }
+      end
     end
   end
 end

data/lib/puppet/reports/store.rb

@@ -32,7 +32,7 @@ Puppet::Reports.register_report(:store) do
     file = File.join(dir, name)
 
     begin
-      Puppet::Util.replace_file(file, 0640) do |fh|
+      Puppet::FileSystem.replace_file(file, 0640) do |fh|
         fh.print to_yaml
       end
     rescue => detail

data/lib/puppet/resource/type_collection.rb

@@ -1,6 +1,7 @@
 require 'puppet/parser/type_loader'
 require 'puppet/util/file_watcher'
 require 'puppet/util/warnings'
+require 'puppet/concurrent/lock'
 
 # @api private
 class Puppet::Resource::TypeCollection
@@ -28,6 +29,7 @@ class Puppet::Resource::TypeCollection
     @nodes = {}
     @notfound = {}
     @sites = []
+    @lock = Puppet::Concurrent::Lock.new
 
     # So we can keep a list and match the first-defined regex
     @node_list = []
@@ -225,25 +227,27 @@ class Puppet::Resource::TypeCollection
   # Resolve namespaces and find the given object.  Autoload it if
   # necessary.
   def find_or_load(name, type)
-    # Name is always absolute, but may start with :: which must be removed
-    fqname = (name[0,2] == COLON_COLON ? name[2..-1] : name)
-
-    result = send(type, fqname)
-    unless result
-      if @notfound[ fqname ] && Puppet[ :ignoremissingtypes ]
-        # do not try to autoload if we already tried and it wasn't conclusive
-        # as this is a time consuming operation. Warn the user.
-        # Check first if debugging is on since the call to debug_once is expensive
-        if Puppet[:debug]
-          debug_once _("Not attempting to load %{type} %{fqname} as this object was missing during a prior compilation") % { type: type, fqname: fqname }
+    @lock.synchronize do
+      # Name is always absolute, but may start with :: which must be removed
+      fqname = (name[0,2] == COLON_COLON ? name[2..-1] : name)
+
+      result = send(type, fqname)
+      unless result
+        if @notfound[ fqname ] && Puppet[ :ignoremissingtypes ]
+          # do not try to autoload if we already tried and it wasn't conclusive
+          # as this is a time consuming operation. Warn the user.
+          # Check first if debugging is on since the call to debug_once is expensive
+          if Puppet[:debug]
+            debug_once _("Not attempting to load %{type} %{fqname} as this object was missing during a prior compilation") % { type: type, fqname: fqname }
+          end
+        else
+          fqname = munge_name(fqname)
+          result = loader.try_load_fqname(type, fqname)
+          @notfound[ fqname ] = result.nil?
         end
-      else
-        fqname = munge_name(fqname)
-        result = loader.try_load_fqname(type, fqname)
-        @notfound[ fqname ] = result.nil?
       end
+      result
     end
-    result
   end
 
   def munge_name(name)

data/lib/puppet/runtime.rb

@@ -1,13 +1,32 @@
 require 'puppet/http'
+require 'singleton'
 
+# Provides access to runtime implementations.
+#
+# @api private
 class Puppet::Runtime
   include Singleton
 
   def initialize
-    @runtime_services = {}
+    @runtime_services = {
+      http: proc do
+        klass = Puppet::Network::HttpPool.http_client_class
+        if klass == Puppet::Network::HTTP::Connection ||
+           klass == Puppet::Network::HTTP::ConnectionAdapter
+          Puppet::HTTP::Client.new
+        else
+          Puppet::HTTP::ExternalClient.new(klass)
+        end
+      end
+    }
   end
   private :initialize
 
+  # Get a runtime implementation.
+  #
+  # @param name [Symbol] the name of the implementation
+  # @return [Object] the runtime implementation
+  # @api private
   def [](name)
     service = @runtime_services[name]
     raise ArgumentError, "Unknown service #{name}" unless service
@@ -19,7 +38,19 @@ class Puppet::Runtime
     end
   end
 
+  # Register a runtime implementation.
+  #
+  # @param name [Symbol] the name of the implementation
+  # @param impl [Object] the runtime implementation
+  # @api private
   def []=(name, impl)
     @runtime_services[name] = impl
   end
+
+  # Clears all implementations. This is used for testing.
+  #
+  # @api private
+  def clear
+    initialize
+  end
 end