puppet 6.11.1 → 6.16.0

data/lib/puppet/transaction/report.rb

@@ -217,13 +217,13 @@ class Puppet::Transaction::Report
   end
 
   # @api private
-  def initialize(configuration_version=nil, environment=nil, transaction_uuid=nil, job_id=nil)
+  def initialize(configuration_version=nil, environment=nil, transaction_uuid=nil, job_id=nil, start_time=Time.now)
     @metrics = {}
     @logs = []
     @resource_statuses = {}
     @external_times ||= {}
     @host = Puppet[:node_name_value]
-    @time = Time.now
+    @time = start_time
     @report_format = 10
     @puppet_version = Puppet.version
     @configuration_version = configuration_version

data/lib/puppet/transaction/resource_harness.rb

@@ -101,7 +101,7 @@ class Puppet::Transaction::ResourceHarness
   # We persist the last known values for the properties of a resource after resource
   # application.
   # @param [Puppet::Type] resource resource whose values we are to persist.
-  # @param [ResourceApplicationContent] context the application context to operate on.
+  # @param [ResourceApplicationContext] context the application context to operate on.
   def persist_system_values(resource, context)
     param_to_event = {}
     context.status.events.each do |ev|

data/lib/puppet/type.rb

@@ -10,6 +10,7 @@ require 'puppet/metatype/manager'
 require 'puppet/util/errors'
 require 'puppet/util/logging'
 require 'puppet/util/tagging'
+require 'puppet/concurrent/lock'
 
 # see the bottom of the file for the rest of the inclusions
 
@@ -84,6 +85,11 @@ class Type
   # Comparing type instances.
   include Comparable
 
+  # These variables are used in Metatype::Manager for managing types
+  @types = {}
+  @manager_lock = Puppet::Concurrent::Lock.new
+  extend Puppet::MetaType::Manager
+
   # Compares this type against the given _other_ (type) and returns -1, 0, or +1 depending on the order.
   # @param other [Object] the object to compare against (produces nil, if not kind of Type}
   # @return [-1, 0, +1, nil] produces -1 if this type is before the given _other_ type, 0 if equals, and 1 if after.
@@ -1486,7 +1492,7 @@ class Type
           }
 
       Tags are useful for things like applying a subset of a host's configuration
-      with [the `tags` setting](/puppet/latest/configuration.html#tags)
+      with [the `tags` setting](https://puppet.com/docs/puppet/latest/configuration.html#tags)
       (e.g. `puppet agent --test --tags bootstrap`)."
 
     munge do |tags|
@@ -2284,7 +2290,6 @@ end
     #
     attr_accessor :self_refresh
     include Enumerable, Puppet::Util::ClassGen
-    include Puppet::MetaType::Manager
 
     include Puppet::Util
     include Puppet::Util::Logging

data/lib/puppet/type/file.rb

@@ -110,6 +110,19 @@ Puppet::Type.newtype(:file) do
       balancer to direct all filebucket traffic to a single master, or use
       something like an out-of-band rsync task to synchronize the content on all
       masters.
+
+      > **Note**: Enabling and using the backup option, and by extension the 
+        filebucket resource, requires appropriate planning and management to ensure 
+        that sufficient disk space is available for the file backups. Generally, you 
+        can implement this using one of the following two options:
+        - Use a `find` command and `crontab` entry to retain only the last X days 
+        of file backups. For example,
+        
+        ```shell script
+        find /opt/puppetlabs/server/data/puppetserver/bucket -type f -mtime +45 -atime +45 -print0 | xargs -0 rm
+        ```
+        
+        - Restrict the directory to a maximum size after which the oldest items are removed.
     EOT
 
     defaultto "puppet"

data/lib/puppet/type/file/data_sync.rb

@@ -42,7 +42,11 @@ module Puppet
           send resource[:loglevel], "[diff redacted]"
         else
           write_temporarily(param) do |path|
-            send resource[:loglevel], "\n" + diff(resource[:path], path)
+            diff_output = diff(resource[:path], path)
+            if diff_output.encoding == Encoding::BINARY || !diff_output.valid_encoding?
+              diff_output = "Binary files #{resource[:path]} and #{path} differ"
+            end
+            send resource[:loglevel], "\n" + diff_output
           end
         end
       end

data/lib/puppet/type/file/source.rb

@@ -2,10 +2,7 @@ require 'puppet/file_serving/content'
 require 'puppet/file_serving/metadata'
 require 'puppet/file_serving/terminus_helper'
 
-require 'puppet/util/http_proxy'
-require 'puppet/network/http'
-require 'puppet/network/http/api/indirected_routes'
-require 'puppet/network/http/compression'
+require 'puppet/http'
 
 module Puppet
   # Copy files from a local or remote source.  This state *only* does any work
@@ -14,11 +11,6 @@ module Puppet
   # this state, during retrieval, modifies the appropriate other states
   # so that things get taken care of appropriately.
   Puppet::Type.type(:file).newparam(:source) do
-    include Puppet::Network::HTTP::Compression.module
-
-    BINARY_MIME_TYPES = [
-      Puppet::Network::FormatHandler.format_for('binary').mime
-    ].join(', ').freeze
 
     attr_accessor :source, :local
     desc <<-'EOT'
@@ -55,6 +47,8 @@ module Puppet
       The `http` source uses the server `Content-MD5` header as a checksum to
       determine if the remote file has changed. If the server response does not
       include that header, Puppet defaults to using the `Last-Modified` header.
+      Puppet will update the local file if the header is newer than the modified
+      time (mtime) of the local file.
 
       Multiple `source` values can be specified as an array, and Puppet will
       use the first source that exists. This can be used to serve different
@@ -129,18 +123,6 @@ module Puppet
       metadata && metadata.checksum
     end
 
-    # Look up (if necessary) and return local content.
-    def content
-      return @content if @content
-      raise Puppet::DevError, _("No source for content was stored with the metadata") unless metadata.source
-
-      tmp = Puppet::FileServing::Content.indirection.find(metadata.source, :environment => resource.catalog.environment_instance, :links => resource[:links])
-      unless tmp
-        self.fail "Could not find any content at %s" % metadata.source
-      end
-      @content = tmp.content
-    end
-
     # Copy the values from the source to the resource.  Yay.
     def copy_source_values
       devfail "Somehow got asked to copy source values without any metadata" unless metadata
@@ -273,63 +255,72 @@ module Puppet
       end
     end
 
-    def each_chunk_from
-      if Puppet[:default_file_terminus] == :file_server
-        yield content
+    def each_chunk_from(&block)
+      if Puppet[:default_file_terminus] == :file_server && scheme == 'puppet' && (uri.host.nil? || uri.host.empty?)
+        chunk_file_from_disk(metadata.full_path, &block)
       elsif local?
-        chunk_file_from_disk { |chunk| yield chunk }
+        chunk_file_from_disk(full_path, &block)
       else
-        chunk_file_from_source { |chunk| yield chunk }
+        chunk_file_from_source(&block)
       end
     end
 
-    def chunk_file_from_disk
-      File.open(full_path, "rb") do |src|
+    def chunk_file_from_disk(local_path)
+      File.open(local_path, "rb") do |src|
         while chunk = src.read(8192) #rubocop:disable Lint/AssignmentInCondition
           yield chunk
         end
       end
     end
 
-    def get_from_puppet_source(source_uri, content_uri, &block)
-      options = { :environment => resource.catalog.environment_instance }
-      if content_uri
-        options[:code_id] = resource.catalog.code_id
-        request = Puppet::Indirector::Request.new(:static_file_content, :find, content_uri, nil, options)
-      else
-        request = Puppet::Indirector::Request.new(:file_content, :find, source_uri, nil, options)
-      end
+    def get_from_content_uri_source(url, &block)
+      session = Puppet.lookup(:http_session)
+      api = session.route_to(:fileserver, url: url)
 
-      request.do_request(:fileserver) do |req|
-        ssl_context = Puppet.lookup(:ssl_context)
-        connection = Puppet::Network::HttpPool.connection(req.server, req.port, ssl_context: ssl_context)
-        connection.request_get(Puppet::Network::HTTP::API::IndirectedRoutes.request_to_uri(req), add_accept_encoding({"Accept" => BINARY_MIME_TYPES}), &block)
-      end
+      api.get_static_file_content(
+        path: URI.unescape(url.path),
+        environment: resource.catalog.environment_instance.to_s,
+        code_id: resource.catalog.code_id,
+        &block
+      )
     end
 
-    def get_from_http_source(source_uri, &block)
-      Puppet::Util::HttpProxy.request_with_redirects(URI(source_uri), :get, &block)
+    def get_from_source_uri_source(url, &block)
+      session = Puppet.lookup(:http_session)
+      api = session.route_to(:fileserver, url: url)
+
+      api.get_file_content(
+        path: URI.unescape(url.path),
+        environment: resource.catalog.environment_instance.to_s,
+        &block
+      )
     end
 
-    def get_from_source(&block)
-      source_uri = metadata.source
-      if source_uri =~ /^https?:/
-        get_from_http_source(source_uri, &block)
-      else
-        get_from_puppet_source(source_uri, metadata.content_uri, &block)
+    def get_from_http_source(url, &block)
+      client = Puppet.runtime[:http]
+      client.get(url, options: {include_system_store: true}) do |response|
+        raise Puppet::HTTP::ResponseError.new(response) unless response.success?
+
+        response.read_body(&block)
       end
     end
 
-    def chunk_file_from_source
-      get_from_source do |response|
-        case response.code
-        when /^2/;  uncompress(response) { |uncompressor| response.read_body { |chunk| yield uncompressor.uncompress(chunk) } }
-        else
-          # Raise the http error if we didn't get a 'success' of some kind.
-          message = "Error #{response.code} on SERVER: #{(response.body||'').empty? ? response.message : uncompress_body(response)}"
-          raise Net::HTTPError.new(message, response)
-        end
+    def chunk_file_from_source(&block)
+      if uri.scheme =~ /^https?/
+        get_from_http_source(uri, &block)
+      elsif metadata.content_uri
+        content_url = URI.parse(Puppet::Util.uri_encode(metadata.content_uri))
+        get_from_content_uri_source(content_url, &block)
+      else
+        get_from_source_uri_source(uri, &block)
       end
+    rescue Puppet::HTTP::ResponseError => e
+      handle_response_error(e.response)
+    end
+
+    def handle_response_error(response)
+      message = "Error #{response.code} on SERVER: #{response.body.empty? ? response.reason : response.body}"
+      raise Net::HTTPError.new(message, response.nethttp)
     end
   end
 

data/lib/puppet/type/group.rb

@@ -22,7 +22,7 @@ module Puppet
     feature :system_groups,
       "The provider allows you to create system groups with lower GIDs."
 
-    feature :libuser,
+    feature :manages_local_users_and_groups,
       "Allows local groups to be managed on systems that also use some other
        remote Name Switch Service (NSS) method of managing accounts."
 
@@ -175,7 +175,8 @@ module Puppet
     end
 
     newparam(:ia_load_module, :required_features => :manages_aix_lam) do
-      desc "The name of the I&A module to use to manage this user"
+      desc "The name of the I&A module to use to manage this group.
+        This should be set to `files` if managing local groups."
     end
 
     newproperty(:attributes, :parent => Puppet::Property::KeyValue, :required_features => :manages_aix_lam) do
@@ -213,10 +214,10 @@ module Puppet
     end
 
     newparam(:forcelocal, :boolean => true,
-             :required_features => :libuser,
+             :required_features => :manages_local_users_and_groups,
              :parent => Puppet::Parameter::Boolean) do
       desc "Forces the management of local accounts when accounts are also
-            being managed by some other Name Switch Service (NSS).
+            being managed by some other Name Switch Service (NSS). For AIX, refer to the `ia_load_module` parameter.
             
             This option relies on your operating system's implementation of `luser*` commands, such as `luseradd` , `lgroupadd`, and `lusermod`. The `forcelocal` option could behave unpredictably in some circumstances. If the tools it depends on are not available, it might have no effect at all."
       defaultto false

data/lib/puppet/type/package.rb

@@ -51,17 +51,21 @@ module Puppet
         package database for installed version(s), and can select
         which out of a set of available versions of a package to
         install if asked."
+    feature :version_ranges, "The provider can ensure version ranges."
     feature :holdable, "The provider is capable of placing packages on hold
         such that they are not automatically upgraded as a result of
         other package dependencies unless explicit action is taken by
-        a user or another package. Held is considered a superset of
-        installed.",
-      :methods => [:hold]
+        a user or another package.",
+      :methods => [:hold, :unhold]
     feature :install_only, "The provider accepts options to only install packages never update (kernels, etc.)"
     feature :install_options, "The provider accepts options to be
       passed to the installer command."
     feature :uninstall_options, "The provider accepts options to be
       passed to the uninstaller command."
+    feature :disableable, "The provider can disable packages. This feature is used by specifying `disabled` as the
+      desired value for the package.",
+      :methods => [:disable]
+    feature :supports_flavors, "The provider accepts flavors, which are specific variants of packages."
     feature :package_settings, "The provider accepts package_settings to be
       ensured for the given package. The meaning and format of these settings is
       provider-specific.",
@@ -80,10 +84,12 @@ module Puppet
         specifying `purged` as the ensure value. This defaults to `installed`.
 
         Version numbers must match the full version to install, including
-        release if the provider uses a release moniker. Ranges or semver
-        patterns are not accepted except for the `gem` package provider. For
+        release if the provider uses a release moniker. For
         example, to install the bash package from the rpm
         `bash-4.1.2-29.el6.x86_64.rpm`, use the string `'4.1.2-29.el6'`.
+
+        On supported providers, version ranges can also be ensured. For example,
+        inequalities: `<2.0.0`, or intersections: `>1.0.0 <2.0.0`.
       EOT
 
       attr_accessor :latest
@@ -101,7 +107,11 @@ module Puppet
       end
 
       newvalue(:held, :event => :package_held, :required_features => :holdable) do
-        provider.hold
+        provider.deprecated_hold
+      end
+
+      newvalue(:disabled, :required_features => :disableable) do
+        provider.disable
       end
 
       # Alias the 'present' value.
@@ -151,7 +161,7 @@ module Puppet
         @should.each { |should|
           case should
           when :present
-            return true unless [:absent, :purged, :held].include?(is)
+            return true unless [:absent, :purged, :held, :disabled].include?(is)
           when :latest
             # Short-circuit packages that are not present
             return false if is == :absent || is == :purged
@@ -405,6 +415,16 @@ module Puppet
       end
     end
 
+    newproperty(:flavor, :required_features => :supports_flavors) do
+      desc "OpenBSD and DNF modules support 'flavors', which are
+        further specifications for which type of package you want."
+      validate do |value|
+        if [:disabled, "disabled"].include?(@resource[:ensure]) && value
+          raise ArgumentError, _('Cannot have both `ensure => disabled` and `flavor`')
+        end
+      end
+    end
+
     newparam(:source) do
       desc "Where to find the package file. This is only used by providers that don't
         automatically download packages from a central repository. (For example:
@@ -484,9 +504,27 @@ module Puppet
       newvalues(:true, :false)
     end
 
-    newparam(:flavor) do
-      desc "OpenBSD and DNF modules support 'flavors', which are
-        further specifications for which type of package you want."
+    newparam(:enable_only, :boolean => false, :parent => Puppet::Parameter::Boolean) do
+      desc <<-EOT
+        Tells `dnf module` to only enable a specific module, instead
+        of installing its default profile.
+
+        Modules with no default profile will be enabled automatically
+        without the use of this parameter.
+
+        Conflicts with the `flavor` property, which selects a profile
+        to install.
+      EOT
+      defaultto false
+
+      validate do |value|
+        if [true, :true, "true"].include?(value) && @resource[:flavor]
+          raise ArgumentError, _('Cannot have both `enable_only => true` and `flavor`')
+        end
+        if [:disabled, "disabled"].include?(@resource[:ensure])
+          raise ArgumentError, _('Cannot have both `ensure => disabled` and `enable_only => true`')
+        end
+      end
     end
 
     newparam(:install_only, :boolean => false, :parent => Puppet::Parameter::Boolean, :required_features => :install_only) do
@@ -625,5 +663,59 @@ module Puppet
         provider.reinstall
       end
     end
+
+    newproperty(:mark, :required_features => :holdable) do
+      mark_doc='Valid values are: hold/none'
+      desc <<-EOT
+        Set to hold to tell Debian apt/Solaris pkg to hold the package version
+
+        #{mark_doc}
+        Default is "none". Mark can be specified with or without `ensure`,
+        if `ensure` is missing will default to "present".
+
+        Mark cannot be specified together with "purged", "absent" or "held"
+        values for `ensure`.
+      EOT
+      newvalues(:hold, :none)
+      munge do |value|
+        case value
+        when "hold", :hold
+          :hold
+        when "none", :none
+          :none
+        else
+          raise ArgumentError, _('Invalid hold value %{value}. %{doc}') % { value: value.inspect, doc: mark_doc}
+        end
+      end
+
+      def insync?(is)
+        @should[0] == is
+      end
+
+      def should
+        @should[0] if @should && @should.is_a?(Array) && @should.size == 1
+      end
+
+      def retrieve
+        provider.properties[:mark]
+      end
+
+      def sync
+        if @should[0] == :hold
+          provider.hold
+        else
+          provider.unhold
+        end
+      end
+    end
+
+    validate do
+      if :held == @parameters[:ensure].should
+        warning '"ensure=>held" has been deprecated and will be removed in a future version, use "mark=hold" instead'
+      end
+      if @parameters[:mark] && [:absent, :purged, :held].include?(@parameters[:ensure].should)
+        raise ArgumentError, _('You cannot use "mark" property while "ensure" is one of ["absent", "purged", "held"]')
+      end
+    end
   end
 end