puppet 6.12.0 → 6.17.0

data/lib/puppet/type/group.rb

@@ -22,7 +22,7 @@ module Puppet
     feature :system_groups,
       "The provider allows you to create system groups with lower GIDs."
 
-    feature :libuser,
+    feature :manages_local_users_and_groups,
       "Allows local groups to be managed on systems that also use some other
        remote Name Switch Service (NSS) method of managing accounts."
 
@@ -214,7 +214,7 @@ module Puppet
     end
 
     newparam(:forcelocal, :boolean => true,
-             :required_features => :libuser,
+             :required_features => :manages_local_users_and_groups,
              :parent => Puppet::Parameter::Boolean) do
       desc "Forces the management of local accounts when accounts are also
             being managed by some other Name Switch Service (NSS). For AIX, refer to the `ia_load_module` parameter.

data/lib/puppet/type/package.rb

@@ -51,17 +51,21 @@ module Puppet
         package database for installed version(s), and can select
         which out of a set of available versions of a package to
         install if asked."
+    feature :version_ranges, "The provider can ensure version ranges."
     feature :holdable, "The provider is capable of placing packages on hold
         such that they are not automatically upgraded as a result of
         other package dependencies unless explicit action is taken by
-        a user or another package. Held is considered a superset of
-        installed.",
-      :methods => [:hold]
+        a user or another package.",
+      :methods => [:hold, :unhold]
     feature :install_only, "The provider accepts options to only install packages never update (kernels, etc.)"
     feature :install_options, "The provider accepts options to be
       passed to the installer command."
     feature :uninstall_options, "The provider accepts options to be
       passed to the uninstaller command."
+    feature :disableable, "The provider can disable packages. This feature is used by specifying `disabled` as the
+      desired value for the package.",
+      :methods => [:disable]
+    feature :supports_flavors, "The provider accepts flavors, which are specific variants of packages."
     feature :package_settings, "The provider accepts package_settings to be
       ensured for the given package. The meaning and format of these settings is
       provider-specific.",
@@ -80,10 +84,12 @@ module Puppet
         specifying `purged` as the ensure value. This defaults to `installed`.
 
         Version numbers must match the full version to install, including
-        release if the provider uses a release moniker. Ranges or semver
-        patterns are not accepted except for the `gem` package provider. For
+        release if the provider uses a release moniker. For
         example, to install the bash package from the rpm
         `bash-4.1.2-29.el6.x86_64.rpm`, use the string `'4.1.2-29.el6'`.
+
+        On supported providers, version ranges can also be ensured. For example,
+        inequalities: `<2.0.0`, or intersections: `>1.0.0 <2.0.0`.
       EOT
 
       attr_accessor :latest
@@ -101,7 +107,11 @@ module Puppet
       end
 
       newvalue(:held, :event => :package_held, :required_features => :holdable) do
-        provider.hold
+        provider.deprecated_hold
+      end
+
+      newvalue(:disabled, :required_features => :disableable) do
+        provider.disable
       end
 
       # Alias the 'present' value.
@@ -151,7 +161,7 @@ module Puppet
         @should.each { |should|
           case should
           when :present
-            return true unless [:absent, :purged, :held].include?(is)
+            return true unless [:absent, :purged, :held, :disabled].include?(is)
           when :latest
             # Short-circuit packages that are not present
             return false if is == :absent || is == :purged
@@ -405,6 +415,16 @@ module Puppet
       end
     end
 
+    newproperty(:flavor, :required_features => :supports_flavors) do
+      desc "OpenBSD and DNF modules support 'flavors', which are
+        further specifications for which type of package you want."
+      validate do |value|
+        if [:disabled, "disabled"].include?(@resource[:ensure]) && value
+          raise ArgumentError, _('Cannot have both `ensure => disabled` and `flavor`')
+        end
+      end
+    end
+
     newparam(:source) do
       desc "Where to find the package file. This is only used by providers that don't
         automatically download packages from a central repository. (For example:
@@ -484,9 +504,27 @@ module Puppet
       newvalues(:true, :false)
     end
 
-    newparam(:flavor) do
-      desc "OpenBSD and DNF modules support 'flavors', which are
-        further specifications for which type of package you want."
+    newparam(:enable_only, :boolean => false, :parent => Puppet::Parameter::Boolean) do
+      desc <<-EOT
+        Tells `dnf module` to only enable a specific module, instead
+        of installing its default profile.
+
+        Modules with no default profile will be enabled automatically
+        without the use of this parameter.
+
+        Conflicts with the `flavor` property, which selects a profile
+        to install.
+      EOT
+      defaultto false
+
+      validate do |value|
+        if [true, :true, "true"].include?(value) && @resource[:flavor]
+          raise ArgumentError, _('Cannot have both `enable_only => true` and `flavor`')
+        end
+        if [:disabled, "disabled"].include?(@resource[:ensure])
+          raise ArgumentError, _('Cannot have both `ensure => disabled` and `enable_only => true`')
+        end
+      end
     end
 
     newparam(:install_only, :boolean => false, :parent => Puppet::Parameter::Boolean, :required_features => :install_only) do
@@ -625,5 +663,59 @@ module Puppet
         provider.reinstall
       end
     end
+
+    newproperty(:mark, :required_features => :holdable) do
+      mark_doc='Valid values are: hold/none'
+      desc <<-EOT
+        Set to hold to tell Debian apt/Solaris pkg to hold the package version
+
+        #{mark_doc}
+        Default is "none". Mark can be specified with or without `ensure`,
+        if `ensure` is missing will default to "present".
+
+        Mark cannot be specified together with "purged", "absent" or "held"
+        values for `ensure`.
+      EOT
+      newvalues(:hold, :none)
+      munge do |value|
+        case value
+        when "hold", :hold
+          :hold
+        when "none", :none
+          :none
+        else
+          raise ArgumentError, _('Invalid hold value %{value}. %{doc}') % { value: value.inspect, doc: mark_doc}
+        end
+      end
+
+      def insync?(is)
+        @should[0] == is
+      end
+
+      def should
+        @should[0] if @should && @should.is_a?(Array) && @should.size == 1
+      end
+
+      def retrieve
+        provider.properties[:mark]
+      end
+
+      def sync
+        if @should[0] == :hold
+          provider.hold
+        else
+          provider.unhold
+        end
+      end
+    end
+
+    validate do
+      if :held == @parameters[:ensure].should
+        warning '"ensure=>held" has been deprecated and will be removed in a future version, use "mark=hold" instead'
+      end
+      if @parameters[:mark] && [:absent, :purged, :held].include?(@parameters[:ensure].should)
+        raise ArgumentError, _('You cannot use "mark" property while "ensure" is one of ["absent", "purged", "held"]')
+      end
+    end
   end
 end

data/lib/puppet/type/service.rb

@@ -47,11 +47,17 @@ module Puppet
 
     feature :configurable_timeout, "The provider can specify a minumum timeout for syncing service properties"
 
+    feature :manages_logon_credentials, "The provider can specify the logon credentials used for a service"
+
     newproperty(:enable, :required_features => :enableable) do
       desc "Whether a service should be enabled to start at boot.
         This property behaves differently depending on the platform;
         wherever possible, it relies on local tools to enable or disable
-        a given service. Default values depend on the platform."
+        a given service. Default values depend on the platform.
+        
+        If you don't specify a value for the `enable` attribute, Puppet leaves
+        that aspect of the service alone and your operating system determines 
+        the behavior."
 
       newvalue(:true, :event => :service_enabled) do
         provider.enable
@@ -80,14 +86,8 @@ module Puppet
         provider.delayed_start
       end
 
-      # This only makes sense on systemd systems. Static services cannot be enabled
-      # or disabled manually.
       def insync?(current)
-        if provider.respond_to?(:cached_enabled?) && provider.cached_enabled? == 'static'
-          Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
-          return true
-        end
-
+        return provider.enabled_insync?(current) if provider.respond_to?(:enabled_insync?)
         super(current)
       end
 
@@ -118,6 +118,12 @@ module Puppet
       end
 
       def sync
+        property = @resource.property(:logonaccount)
+        if property
+          val = property.retrieve
+          property.sync unless property.safe_insync?(val)
+        end
+
         event = super()
 
         property = @resource.property(:enable)
@@ -130,6 +136,47 @@ module Puppet
       end
     end
 
+    newproperty(:logonaccount, :required_features => :manages_logon_credentials) do
+      desc "Specify an account for service logon"
+
+      munge do |value|
+        return value unless Puppet::Util::Platform.windows?
+        return 'LocalSystem' if Puppet::Util::Windows::User::localsystem?(value)
+
+        value.sub!(/^\.\\/, "#{Puppet::Util::Windows::ADSI.computer_name}\\")
+        user_information = Puppet::Util::Windows::SID.name_to_principal(value)
+        raise Puppet::Error.new("\"#{value}\" is not a valid account") unless user_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(user_information.account_type)
+
+        if user_information.domain == Puppet::Util::Windows::ADSI.computer_name
+          ".\\#{user_information.account}"
+        else
+          user_information.domain_account
+        end
+      end
+    end
+
+    newparam(:logonpassword, :required_features => :manages_logon_credentials) do
+      desc "Specify a password for service logon. Default value is an empty string (when logonaccount is specified)."
+
+      validate do |value|
+        raise Puppet::Error.new(_"The 'logonaccount' parameter is mandatory when setting 'logonpassword'.") unless @resource[:logonaccount]
+        raise ArgumentError, _("Passwords cannot include ':'") if value.is_a?(String) and value.include?(":")
+        return unless Puppet::Util::Platform.windows?
+
+        is_a_predefined_local_account = Puppet::Util::Windows::User::default_system_account?(@resource[:logonaccount]) || @resource[:logonaccount] == 'LocalSystem'
+
+        account_info = @resource[:logonaccount].split("\\")
+        able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], value, account_info[0]) unless is_a_predefined_local_account
+
+        raise Puppet::Error.new("The given password is invalid for user '#{@resource[:logonaccount]}'.") unless is_a_predefined_local_account || able_to_logon
+
+        provider.logonpassword=(value)
+      end
+
+      sensitive true
+      defaultto { @resource[:logonaccount] ? "" : nil }
+    end
+
     newproperty(:flags, :required_features => :flaggable) do
       desc "Specify a string of flags to pass to the startup script."
     end

data/lib/puppet/type/user.rb

@@ -51,7 +51,7 @@ module Puppet
     feature :manages_aix_lam,
       "The provider can manage AIX Loadable Authentication Module (LAM) system."
 
-    feature :libuser,
+    feature :manages_local_users_and_groups,
       "Allows local users to be managed on systems that also use some other
        remote Name Service Switch (NSS) method of managing accounts."
 
@@ -493,25 +493,6 @@ module Puppet
       provider.exists?
     end
 
-    def retrieve
-      absent = false
-      properties.inject({}) { |prophash, property|
-        current_value = :absent
-
-        if absent
-          prophash[property] = :absent
-        else
-          current_value = property.retrieve
-          prophash[property] = current_value
-        end
-
-        if property.name == :ensure and current_value == :absent
-          absent = true
-        end
-        prophash
-      }
-    end
-
     newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The roles the user has.  Multiple roles should be
         specified as an array."
@@ -688,7 +669,7 @@ module Puppet
     end
 
     newparam(:forcelocal, :boolean => true,
-            :required_features => :libuser,
+            :required_features => :manages_local_users_and_groups,
             :parent => Puppet::Parameter::Boolean) do
       desc "Forces the management of local accounts when accounts are also
             being managed by some other Name Service Switch (NSS). For AIX, refer to the `ia_load_module` parameter.
@@ -755,17 +736,11 @@ module Puppet
         value = test_sym if [:true, :false].include? test_sym
 
         return [] if value == :false
-        home = resource[:home]
-        if value == :true and not home
-          raise ArgumentError, _("purge_ssh_keys can only be true for users with a defined home directory")
-        end
+        home = resource[:home] || Dir.home(resource[:name])
 
         return [ "#{home}/.ssh/authorized_keys" ] if value == :true
         # value is an array - munge each value
         [ value ].flatten.map do |entry|
-          if entry =~ /^~|^%h/ and not home
-            raise ArgumentError, _("purge_ssh_keys value '%{value}' meta character ~ or %{home_placeholder} only allowed for users with a defined home directory") % { value: value, home_placeholder: '%h' }
-          end
           # make sure frozen value is duplicated by using a gsub, second mutating gsub! is then ok
           entry = entry.gsub(/^~\//, "#{home}/")
           entry.gsub!(/^%h\//, "#{home}/")

data/lib/puppet/util.rb

@@ -26,21 +26,20 @@ module Util
 
   extend Puppet::Util::SymbolicFileMode
 
-  def default_env
-    Puppet::Util::Platform.windows? ?
-      :windows :
-      :posix
-  end
-  module_function :default_env
+  DEFAULT_ENV = if Puppet::Util::Platform.windows?
+                  :windows
+                else
+                  :posix
+                end.freeze
 
   # @param name [String] The name of the environment variable to retrieve
   # @param mode [Symbol] Which operating system mode to use e.g. :posix or :windows.  Use nil to autodetect
   # @return [String] Value of the specified environment variable.  nil if it does not exist
   # @api private
-  def get_env(name, mode = default_env)
+  def get_env(name, mode = DEFAULT_ENV)
     if mode == :windows
-      Puppet::Util::Windows::Process.get_environment_strings.each do |key, value |
-        if name.casecmp(key) == 0 then
+      Puppet::Util::Windows::Process.get_environment_strings.find do |key, value|
+        if name.casecmp(key) == 0
           return value
         end
       end
@@ -54,7 +53,7 @@ module Util
   # @param mode [Symbol] Which operating system mode to use e.g. :posix or :windows.  Use nil to autodetect
   # @return [Hash] A hashtable of all environment variables
   # @api private
-  def get_environment(mode = default_env)
+  def get_environment(mode = DEFAULT_ENV)
     case mode
       when :posix
         ENV.to_hash
@@ -69,7 +68,7 @@ module Util
   # Removes all environment variables
   # @param mode [Symbol] Which operating system mode to use e.g. :posix or :windows.  Use nil to autodetect
   # @api private
-  def clear_environment(mode = default_env)
+  def clear_environment(mode = DEFAULT_ENV)
     case mode
       when :posix
         ENV.clear
@@ -87,7 +86,7 @@ module Util
   # @param value [String] The value to set the variable to.  nil deletes the environment variable
   # @param mode [Symbol] Which operating system mode to use e.g. :posix or :windows.  Use nil to autodetect
   # @api private
-  def set_env(name, value = nil, mode = default_env)
+  def set_env(name, value = nil, mode = DEFAULT_ENV)
     case mode
       when :posix
         ENV[name] = value
@@ -102,7 +101,7 @@ module Util
   # @param name [Hash] Environment variables to merge into the existing environment.  nil values will remove the variable
   # @param mode [Symbol] Which operating system mode to use e.g. :posix or :windows.  Use nil to autodetect
   # @api private
-  def merge_environment(env_hash, mode = default_env)
+  def merge_environment(env_hash, mode = DEFAULT_ENV)
     case mode
       when :posix
         env_hash.each { |name, val| ENV[name.to_s] = val }
@@ -296,6 +295,11 @@ module Util
   AbsolutePathWindows = %r!^(?:(?:[A-Z]:#{slash})|(?:#{slash}#{slash}#{label}#{slash}#{label})|(?:#{slash}#{slash}\?#{slash}#{label}))!io
   AbsolutePathPosix   = %r!^/!
   def absolute_path?(path, platform=nil)
+    unless path.is_a?(String)
+      Puppet.warning("Cannot check if #{path} is an absolute path because it is a '#{path.class}' and not a String'")
+      return false
+    end
+
     # Ruby only sets File::ALT_SEPARATOR on Windows and the Ruby standard
     # library uses that to test what platform it's on.  Normally in Puppet we
     # would use Puppet.features.microsoft_windows?, but this method needs to
@@ -356,7 +360,7 @@ module Util
 
     # CGI.unescape doesn't handle space rules properly in uri paths
     # URI.unescape does, but returns strings in their original encoding
-    path = URI.unescape(uri.path.encode(Encoding::UTF_8))
+    path = uri_unescape(uri.path.encode(Encoding::UTF_8))
 
     if Puppet::Util::Platform.windows? && uri.scheme == 'file'
       if uri.host && !uri.host.empty?
@@ -460,7 +464,18 @@ module Util
     # + should be left unencoded
     # URI::parse and URI::Generic.build don't like paths encoded with CGI.escape
     # URI.escape does not change / to %2F and : to %3A like CGI.escape
-    encoded += URI.escape(parts[:path]) unless parts[:path].nil?
+    #
+    # URI.escape is obsolete in Ruby 2.7. Ignore this error until we're able to
+    # switch to a different escape mechanism. If this is JRuby, we can't mask
+    # the error message, because this isn't thread safe. JRuby shouldn't be
+    # using Ruby 2.7 or raising the warning anyway.
+    orig_verbose = $VERBOSE
+    $VERBOSE = nil unless Puppet::Util::Platform.jruby?
+    begin
+      encoded += URI.escape(parts[:path]) unless parts[:path].nil?
+    ensure
+      $VERBOSE = orig_verbose unless Puppet::Util::Platform.jruby?
+    end
 
     # each query parameter
     if !parts[:query].nil?
@@ -479,6 +494,15 @@ module Util
   end
   module_function :uri_encode
 
+  def uri_unescape(path)
+    orig_verbose = $VERBOSE
+    $VERBOSE = nil unless Puppet::Util::Platform.jruby?
+    return URI.unescape(path)
+  ensure
+    $VERBOSE = orig_verbose unless Puppet::Util::Platform.jruby?
+  end
+  module_function :uri_unescape
+
   def safe_posix_fork(stdin=$stdin, stdout=$stdout, stderr=$stderr, &block)
     child_pid = Kernel.fork do
       STDIN.reopen(stdin)