puppet 6.13.0-x86-mingw32 → 6.18.0-x86-mingw32

data/lib/puppet/provider/package/zypper.rb

@@ -2,7 +2,7 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
   desc "Support for SuSE `zypper` package manager. Found in SLES10sp2+ and SLES11.
 
     This provider supports the `install_options` attribute, which allows command-line flags to be passed to zypper.
-    These options should be specified as an array where each element is either a 
+    These options should be specified as an array where each element is either a
     string or a hash."
 
   has_feature :versionable, :install_options, :virtual_packages
@@ -50,6 +50,41 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
     execute(cmd, { :failonfail => false, :combine => true})
   end
 
+  def best_version(should)
+    if should.is_a?(String)
+      begin
+        should_range = Puppet::Util::Package::Version::Range.parse(should, Puppet::Util::Package::Version::Rpm)
+      rescue Puppet::Util::Package::Version::Range::ValidationFailure, Puppet::Util::Package::Version::Rpm::ValidationFailure
+        Puppet.debug("Cannot parse #{should} as a RPM version range")
+        return should
+      end
+
+      if should_range.is_a?(Puppet::Util::Package::Version::Range::Eq)
+        return should
+      end
+
+      sorted_versions = SortedSet.new
+
+      output = zypper('search', '--match-exact', '--type', 'package', '--uninstalled-only', '-s', @resource[:name])
+      output.lines.each do |line|
+        pkg_ver = line.split(/\s*\|\s*/)
+        next unless pkg_ver[1] == @resource[:name]
+        begin
+          rpm_version = Puppet::Util::Package::Version::Rpm.parse(pkg_ver[3])
+
+          sorted_versions << rpm_version if should_range.include?(rpm_version)
+        rescue Puppet::Util::Package::Version::Rpm::ValidationFailure
+          Puppet.debug("Cannot parse #{pkg_ver[3]} as a RPM version")
+        end
+      end
+
+      return sorted_versions.entries.last if sorted_versions.any?
+
+      Puppet.debug("No available version for package #{@resource[:name]} is included in range #{should_range}")
+      should
+    end
+  end
+
   # Install a package using 'zypper'.
   def install
     should = @resource.should(:ensure)
@@ -62,6 +97,7 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
       should = nil
     else
       # Add the package version
+      should = best_version(should)
       wanted = "#{wanted}-#{should}"
     end
 
@@ -89,6 +125,7 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
     options = []
     options << quiet
     options << '--no-gpg-check' unless inst_opts.delete('--no-gpg-check').nil?
+    options << '--no-gpg-checks' unless inst_opts.delete('--no-gpg-checks').nil?
     options << :install
 
     #zypper 0.6.13 (OpenSuSE 10.2) does not support auto agree with licenses
@@ -142,4 +179,28 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
     end
 
   end
+
+  def insync?(is)
+    return false if [:purged, :absent].include?(is)
+
+    should = @resource[:ensure]
+    if should.is_a?(String)
+      begin
+        should_version = Puppet::Util::Package::Version::Range.parse(should, Puppet::Util::Package::Version::Rpm)
+        if should_version.is_a?(RPM_VERSION_RANGE::Eq)
+          return super
+        end
+      rescue Puppet::Util::Package::Version::Range::ValidationFailure, Puppet::Util::Package::Version::Rpm::ValidationFailure
+        Puppet.debug("Cannot parse #{should} as a RPM version range")
+        return super
+      end
+
+      begin
+        is_version = Puppet::Util::Package::Version::Rpm.parse(is)
+        should_version.include?(is_version)
+      rescue Puppet::Util::Package::Version::Rpm::ValidationFailure
+        Puppet.debug("Cannot parse #{is} as a RPM version")
+      end
+    end
+  end
 end

data/lib/puppet/provider/service/systemd.rb

@@ -30,7 +30,8 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def self.instances
     i = []
     output = systemctl('list-unit-files', '--type', 'service', '--full', '--all',  '--no-pager')
-    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect)\s*$/i).each do |m|
+    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad|static)\s*$/i).each do |m|
+      Puppet.debug("#{m[0]} marked as bad by `systemctl`. It is recommended to be further checked.") if m[1] == "bad"
       i << new(:name => m[0])
     end
     return i
@@ -38,6 +39,22 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
     return []
   end
 
+  # Static services cannot be enabled or disabled manually. Indirect services 
+  # should not be enabled or disabled due to limitations in systemd (see 
+  # https://github.com/systemd/systemd/issues/6681).
+  def enabled_insync?(current)
+    case cached_enabled?[:output]
+    when 'static'
+      Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
+      return true
+    when 'indirect'
+      Puppet.debug("Service #{@resource[:name]} is in 'indirect' state and cannot be enabled/disabled")
+      return true
+    else
+      current == @resource[:enable]
+    end
+  end
+
   # This helper ensures that the enable state cache is always reset
   # after a systemctl enable operation. A particular service state is not guaranteed
   # after such an operation, so the cache must be emptied to prevent inconsistencies
@@ -69,12 +86,13 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def cached_enabled?
     return @cached_enabled if @cached_enabled
     cmd = [command(:systemctl), 'is-enabled', '--', @resource[:name]]
-    @cached_enabled = execute(cmd, :failonfail => false).strip
+    result = execute(cmd, :failonfail => false)
+    @cached_enabled = { output: result.chomp, exitcode: result.exitstatus }
   end
 
   def enabled?
-    output = cached_enabled?
-    code = $CHILD_STATUS.exitstatus
+    output = cached_enabled?[:output]
+    code = cached_enabled?[:exitcode]
 
     # The masked state is equivalent to the disabled state in terms of
     # comparison so we only care to check if it is masked if we want to keep

data/lib/puppet/provider/service/windows.rb

@@ -14,29 +14,28 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
   defaultfor :operatingsystem => :windows
   confine    :operatingsystem => :windows
 
-  has_feature :refreshable
-  has_feature :configurable_timeout
+  has_feature :refreshable, :configurable_timeout, :manages_logon_credentials
 
   def enable
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_AUTO_START )
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {startup_type: :SERVICE_AUTO_START})
   rescue => detail
     raise Puppet::Error.new(_("Cannot enable %{resource_name}, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
 
   def disable
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_DISABLED )
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {startup_type: :SERVICE_DISABLED})
   rescue => detail
     raise Puppet::Error.new(_("Cannot disable %{resource_name}, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
 
   def manual_start
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_DEMAND_START )
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {startup_type: :SERVICE_DEMAND_START})
   rescue => detail
     raise Puppet::Error.new(_("Cannot enable %{resource_name} for manual start, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
 
   def delayed_start
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_AUTO_START, true )
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {startup_type: :SERVICE_AUTO_START, delayed: true})
   rescue => detail
     raise Puppet::Error.new(_("Cannot enable %{resource_name} for delayed start, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
@@ -110,7 +109,10 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
         raise Puppet::Error.new(_("Unknown service state '%{current_state}' for service '%{resource_name}'") % { current_state: current_state, resource_name: @resource[:name] })
     end
     debug("Service #{@resource[:name]} is #{current_state}")
-    return state
+    state
+  rescue => detail
+    Puppet.warning("Status for service #{@resource[:name]} could not be retrieved: #{detail}")
+    :stopped
   end
 
   def default_timeout
@@ -125,4 +127,18 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
     end
     services
   end
+
+  def logonaccount
+    return unless Puppet::Util::Windows::Service.exists?(@resource[:name])
+    Puppet::Util::Windows::Service.logon_account(@resource[:name])
+  end
+
+  def logonaccount=(value)
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {logon_account: value, logon_password: @resource[:logonpassword]})
+    restart if @resource[:ensure] == :running && [:running, :paused].include?(status)
+  end
+
+  def logonpassword=(value)
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {logon_password: value})
+  end
 end

data/lib/puppet/provider/user/aix.rb

@@ -288,7 +288,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   # UNSUPPORTED
   #- **roles**
   #    The roles the user has.  Multiple roles should be
-  #    specified as an array.  Requires features manages_solaris_rbac.
+  #    specified as an array.  Requires features manages_roles.
   # UNSUPPORTED
   #- **key_membership**
   #    Whether specified key value pairs should be treated as the only

data/lib/puppet/provider/user/user_role_add.rb

@@ -33,7 +33,7 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
     set("shell", value)
   end
 
-  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords, :manages_password_age, :manages_shell
+  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_roles, :manages_passwords, :manages_password_age, :manages_shell
 
   def check_valid_shell
     unless File.exist?(@resource.should(:shell))

data/lib/puppet/provider/user/useradd.rb

@@ -21,7 +21,11 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
   options :expiry, :method => :sp_expire,
     :munge => proc { |value|
       if value == :absent
-        ''
+        if Facter.value(:operatingsystem)=='SLES' && Facter.value(:operatingsystemmajrelease) == "11"
+          -1
+        else
+          ''
+        end
       else
         case Facter.value(:operatingsystem)
         when 'Solaris'
@@ -134,10 +138,17 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
 
   def check_manage_home
     cmd = []
-    if @resource.managehome? && (!@resource.forcelocal?)
-      cmd << "-m"
-    elsif (!@resource.managehome?) && Facter.value(:osfamily) == 'RedHat'
-      cmd << "-M"
+    if @resource.managehome?
+      # libuser does not implement the -m flag
+      cmd << "-m" unless @resource.forcelocal?
+    else
+      osfamily = Facter.value(:osfamily)
+      osversion = Facter.value(:operatingsystemmajrelease).to_i
+      # SLES 11 uses pwdutils instead of shadow, which does not have -M
+      # Solaris and OpenBSD use different useradd flavors
+      unless osfamily =~ /Solaris|OpenBSD/ || osfamily == 'Suse' && osversion <= 11
+        cmd << "-M"
+      end
     end
     cmd
   end

data/lib/puppet/provider/user/windows_adsi.rb

@@ -6,7 +6,7 @@ Puppet::Type.type(:user).provide :windows_adsi do
   defaultfor :operatingsystem => :windows
   confine    :operatingsystem => :windows
 
-  has_features :manages_homedir, :manages_passwords
+  has_features :manages_homedir, :manages_passwords, :manages_roles
 
   def initialize(value={})
     super(value)
@@ -17,6 +17,23 @@ Puppet::Type.type(:user).provide :windows_adsi do
     @user ||= Puppet::Util::Windows::ADSI::User.new(@resource[:name])
   end
 
+  def roles
+    Puppet::Util::Windows::User::get_rights(@resource[:name])
+  end
+
+  def roles=(value)
+    current = roles.split(',')
+    should  = value.split(',')
+
+    add_list = should - current
+    Puppet::Util::Windows::User::set_rights(@resource[:name], add_list) unless add_list.empty?
+
+    if @resource[:role_membership] == :inclusive
+      remove_list = current - should
+      Puppet::Util::Windows::User::remove_rights(@resource[:name], remove_list) unless remove_list.empty?
+    end
+  end
+
   def groups
     @groups ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(user.groups)
     @groups.keys

data/lib/puppet/reports/http.rb

@@ -20,19 +20,25 @@ Puppet::Reports.register_report(:http) do
     # (Puppet::Network::HTTP) but is used by Puppet Server's http client
     # (Puppet::Server::HttpClient) to track metrics on the request made to the
     # `reporturl` to store a report.
-    options = { :metric_id => [:puppet, :report, :http] }
+    options = {
+      :metric_id => [:puppet, :report, :http],
+      :include_system_store => Puppet[:report_include_system_store],
+    }
+
+    # Puppet's http client implementation accepts userinfo in the URL
+    # but puppetserver's does not. So pass credentials explicitly.
     if url.user && url.password
       options[:basic_auth] = {
-        :user => url.user,
-        :password => url.password
+        user: url.user,
+        password: url.password
       }
     end
-    use_ssl = url.scheme == 'https'
-    ssl_context = use_ssl ? Puppet.lookup(:ssl_context) : nil
-    conn = Puppet::Network::HttpPool.connection(url.host, url.port, use_ssl: use_ssl, ssl_context: ssl_context)
-    response = conn.post(url.path, self.to_yaml, headers, options)
-    unless response.kind_of?(Net::HTTPSuccess)
-      Puppet.err _("Unable to submit report to %{url} [%{code}] %{message}") % { url: Puppet[:reporturl].to_s, code: response.code, message: response.msg }
+
+    client = Puppet.runtime[:http]
+    client.post(url, self.to_yaml, headers: headers, options: options) do |response|
+      unless response.success?
+        Puppet.err _("Unable to submit report to %{url} [%{code}] %{message}") % { url: Puppet[:reporturl].to_s, code: response.code, message: response.reason }
+      end
     end
   end
 end

data/lib/puppet/resource.rb

@@ -628,7 +628,8 @@ class Puppet::Resource
   def self.extract_type_and_title(argtype, argtitle)
     if (argtype.nil? || argtype == :component || argtype == :whit) &&
           argtitle =~ /^([^\[\]]+)\[(.+)\]$/m                  then [ $1,                 $2            ]
-    elsif argtitle.nil? && argtype =~ /^([^\[\]]+)\[(.+)\]$/m  then [ $1,                 $2            ]
+    elsif argtitle.nil? && argtype.is_a?(String) &&
+          argtype =~ /^([^\[\]]+)\[(.+)\]$/m                   then [ $1,                 $2            ]
     elsif argtitle                                             then [ argtype,            argtitle      ]
     elsif argtype.is_a?(Puppet::Type)                          then [ argtype.class.name, argtype.title ]
     else  raise ArgumentError, _("No title provided and %{type} is not a valid resource reference") % { type: argtype.inspect }

data/lib/puppet/resource/type.rb

@@ -11,6 +11,7 @@ class Puppet::Resource::Type
   include Puppet::Util::Warnings
   include Puppet::Util::Errors
 
+  # @deprecated application orchestration will be removed in puppet 7 (capability_mapping, application, site)
   RESOURCE_KINDS = [:hostclass, :node, :definition, :capability_mapping, :application, :site]
 
   # Map the names used in our documentation to the names used internally
@@ -69,6 +70,8 @@ class Puppet::Resource::Type
 
   # Evaluate the resources produced by the given resource. These resources are
   # evaluated in a separate but identical scope from the rest of the resource.
+  #
+  # @deprecated application orchestration will be removed in puppet 7
   def evaluate_produces(resource, scope)
     # Only defined types and classes can produce capabilities
     return unless definition? || hostclass?
@@ -161,19 +164,23 @@ class Puppet::Resource::Type
     @module_name = options[:module_name]
   end
 
+  # @deprecated application orchestration will be removed in puppet 7
   def produces
     @produces || EMPTY_ARRAY
   end
 
+  # @deprecated application orchestration will be removed in puppet 7
   def consumes
     @consumes || EMPTY_ARRAY
   end
 
+  # @deprecated application orchestration will be removed in puppet 7
   def add_produces(blueprint)
     @produces ||= []
     @produces << blueprint
   end
 
+  # @deprecated application orchestration will be removed in puppet 7
   def add_consumes(blueprint)
     @consumes ||= []
     @consumes << blueprint
@@ -235,6 +242,7 @@ class Puppet::Resource::Type
     when :node
       :node
     when :site
+      # @deprecated application orchestration will be removed in puppet 7
       :site
     end
 

data/lib/puppet/resource/type_collection.rb

@@ -1,6 +1,7 @@
 require 'puppet/parser/type_loader'
 require 'puppet/util/file_watcher'
 require 'puppet/util/warnings'
+require 'puppet/concurrent/lock'
 
 # @api private
 class Puppet::Resource::TypeCollection
@@ -28,6 +29,7 @@ class Puppet::Resource::TypeCollection
     @nodes = {}
     @notfound = {}
     @sites = []
+    @lock = Puppet::Concurrent::Lock.new
 
     # So we can keep a list and match the first-defined regex
     @node_list = []
@@ -225,25 +227,27 @@ class Puppet::Resource::TypeCollection
   # Resolve namespaces and find the given object.  Autoload it if
   # necessary.
   def find_or_load(name, type)
-    # Name is always absolute, but may start with :: which must be removed
-    fqname = (name[0,2] == COLON_COLON ? name[2..-1] : name)
-
-    result = send(type, fqname)
-    unless result
-      if @notfound[ fqname ] && Puppet[ :ignoremissingtypes ]
-        # do not try to autoload if we already tried and it wasn't conclusive
-        # as this is a time consuming operation. Warn the user.
-        # Check first if debugging is on since the call to debug_once is expensive
-        if Puppet[:debug]
-          debug_once _("Not attempting to load %{type} %{fqname} as this object was missing during a prior compilation") % { type: type, fqname: fqname }
+    @lock.synchronize do
+      # Name is always absolute, but may start with :: which must be removed
+      fqname = (name[0,2] == COLON_COLON ? name[2..-1] : name)
+
+      result = send(type, fqname)
+      unless result
+        if @notfound[ fqname ] && Puppet[ :ignoremissingtypes ]
+          # do not try to autoload if we already tried and it wasn't conclusive
+          # as this is a time consuming operation. Warn the user.
+          # Check first if debugging is on since the call to debug_once is expensive
+          if Puppet[:debug]
+            debug_once _("Not attempting to load %{type} %{fqname} as this object was missing during a prior compilation") % { type: type, fqname: fqname }
+          end
+        else
+          fqname = munge_name(fqname)
+          result = loader.try_load_fqname(type, fqname)
+          @notfound[ fqname ] = result.nil?
         end
-      else
-        fqname = munge_name(fqname)
-        result = loader.try_load_fqname(type, fqname)
-        @notfound[ fqname ] = result.nil?
       end
+      result
     end
-    result
   end
 
   def munge_name(name)