puppet 6.13.0 → 6.18.0

data/lib/puppet/pops/validation/checker4_0.rb

@@ -199,6 +199,11 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     end
   end
 
+  def check_Application(o)
+    check_NamedDefinition(o)
+    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
+  end
+
   def check_AssignmentExpression(o)
     case o.operator
     when '='
@@ -296,6 +301,7 @@ class Checker4_0 < Evaluator::LiteralEvaluator
   end
 
   def check_CapabilityMapping(o)
+    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
     ok =
     case o.component
     when Model::QualifiedReference
@@ -589,36 +595,40 @@ class Checker4_0 < Evaluator::LiteralEvaluator
   # @api private
   class Puppet::Util::FileNamespaceAdapter < Puppet::Pops::Adaptable::Adapter
     attr_accessor :file_to_namespace
+
+    def self.create_adapter(env)
+      adapter = super(env)
+      adapter.file_to_namespace = {}
+      adapter
+    end
   end
 
   def namespace_for_file(file)
     env = Puppet.lookup(:current_environment)
     return NO_NAMESPACE if env.nil?
 
-    Puppet::Util::FileNamespaceAdapter.adapt(env) do |adapter|
-      adapter.file_to_namespace ||= {}
+    adapter = Puppet::Util::FileNamespaceAdapter.adapt(env)
 
-      file_namespace = adapter.file_to_namespace[file]
-      return file_namespace unless file_namespace.nil? # No cache entry, so we do the calculation
+    file_namespace = adapter.file_to_namespace[file]
+    return file_namespace unless file_namespace.nil? # No cache entry, so we do the calculation
 
-      path = Pathname.new(file)
+    path = Pathname.new(file)
 
-      return adapter.file_to_namespace[file] = NO_NAMESPACE if path.extname != ".pp"
+    return adapter.file_to_namespace[file] = NO_NAMESPACE if path.extname != ".pp"
 
-      path = path.expand_path
+    path = path.expand_path
 
-      return adapter.file_to_namespace[file] = NO_NAMESPACE if initial_manifest?(path, env.manifest)
+    return adapter.file_to_namespace[file] = NO_NAMESPACE if initial_manifest?(path, env.manifest)
 
-      #All auto-loaded files from modules come from a module search path dir
-      relative_path = get_module_relative_path(path, env.full_modulepath)
+    #All auto-loaded files from modules come from a module search path dir
+    relative_path = get_module_relative_path(path, env.full_modulepath)
 
-      return adapter.file_to_namespace[file] = NO_NAMESPACE if relative_path == NO_PATH
+    return adapter.file_to_namespace[file] = NO_NAMESPACE if relative_path == NO_PATH
 
-      #If a file comes from a module, but isn't in the right place, always error
-      names = dir_to_names(relative_path)
+    #If a file comes from a module, but isn't in the right place, always error
+    names = dir_to_names(relative_path)
 
-      return adapter.file_to_namespace[file] = (names == BAD_MODULE_FILE ? BAD_MODULE_FILE : names.join("::").freeze)
-    end
+    return adapter.file_to_namespace[file] = (names == BAD_MODULE_FILE ? BAD_MODULE_FILE : names.join("::").freeze)
   end
 
   def initial_manifest?(path, manifest_setting)
@@ -865,6 +875,10 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     rvalue(o.matching_expr)
   end
 
+  def check_SiteDefinition(o)
+    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
+  end
+
   def check_UnaryExpression(o)
     rvalue(o.expr)
   end

data/lib/puppet/pops/validation/validator_factory_4_0.rb

@@ -31,6 +31,7 @@ class ValidatorFactory_4_0 < Factory
     p[Issues::RT_NO_STORECONFIGS]             = Puppet[:storeconfigs] ? :ignore : :warning
 
     p[Issues::FUTURE_RESERVED_WORD]           = :deprecation
+    p[Issues::DEPRECATED_APP_ORCHESTRATION]   = :deprecation
 
     p[Issues::DUPLICATE_KEY]                  = Puppet[:strict] == :off ? :ignore : Puppet[:strict]
     p[Issues::NAME_WITH_HYPHEN]               = :error

data/lib/puppet/provider/file/windows.rb

@@ -126,7 +126,7 @@ Puppet::Type.type(:file).provide :windows do
           # If the SYSTEM account does _not_ have FullControl in this scenario, we should
           # force the resource out of sync no matter what.
           #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-          Puppet.debug _("%{resource_name}: %{mode_part_type} set to SYSTEM. SYSTEM permissions cannot be set below FullControl ('7')") % { resource_name: resource[:name], mode_part_type: mode_part['type']}
+          Puppet.debug { _("%{resource_name}: %{mode_part_type} set to SYSTEM. SYSTEM permissions cannot be set below FullControl ('7')") % { resource_name: resource[:name], mode_part_type: mode_part['type']} }
           return nil
         end
       end

data/lib/puppet/provider/group/groupadd.rb

@@ -74,6 +74,14 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     cmd
   end
 
+  def validate_members(members)
+    members.each do |member|
+      member.split(',').each do |user|
+        Etc.getpwnam(user.strip)
+      end
+    end
+  end
+
   def modifycmd(param, value)
     if @resource.forcelocal? || @resource[:members]
       cmd = [command(:localmodify)]
@@ -83,6 +91,7 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     end
 
     if param == :members
+      validate_members(value)
       value = members_to_s(value)
       purge_members if @resource[:auth_membership] && !members.empty?
     end
@@ -118,10 +127,6 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     localmodify('-m', members_to_s(members), @resource.name)
   end
 
-  def member_valid?(user)
-    !!Etc.getpwnam(user)
-  end
-
   private
 
   def findgroup(key, value)

data/lib/puppet/provider/group/windows_adsi.rb

@@ -24,7 +24,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
     # since the default array_matching comparison is not commutative
 
     # dupes automatically weeded out when hashes built
-    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current)
+    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current, true)
     specified_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
 
     current_sids = current_members.keys.to_a
@@ -52,7 +52,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
         account = sid.account
       end
       resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
-      "#{sid.domain}\\#{account}"
+      sid.domain ? "#{sid.domain}\\#{account}" : account
     end
     return users.join(',')
   end
@@ -66,7 +66,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
   end
 
   def members
-    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members)
+    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members, true)
 
     # @members.keys returns an array of SIDs. We need to convert those SIDs into
     # names so that `puppet resource` prints the right output.

data/lib/puppet/provider/package/aix.rb

@@ -29,6 +29,15 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
 
   attr_accessor   :latest_info
 
+  STATE_CODE = {
+    'A' => :applied,
+    'B' => :broken,
+    'C' => :committed,
+    'E' => :efix_locked,
+    'O' => :obsolete,
+    '?' => :inconsistent,
+  }.freeze
+
   def self.srclistcmd(source)
     [ command(:installp), "-L", "-d", source ]
   end
@@ -97,6 +106,11 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
     if output =~ /^#{Regexp.escape(@resource[:name])}\s+.*\s+Already superseded by.*$/
       self.fail _("aix package provider is unable to downgrade packages")
     end
+
+    pkg_info = query
+    if pkg_info && [:broken, :inconsistent].include?(pkg_info[:status])
+      self.fail _("Package '%{name}' is in a %{status} state and requires manual intervention") % { name: @resource[:name], status: pkg_info[:status] }
+    end
   end
 
   def self.pkglist(hash = {})
@@ -108,8 +122,9 @@ Puppet::Type.type(:package).provide :aix, :parent => Puppet::Provider::Package d
     end
 
     begin
-      list = execute(cmd).scan(/^[^#][^:]*:([^:]*):([^:]*)/).collect { |n,e|
-        { :name => n, :ensure => e, :provider => self.name }
+      list = execute(cmd).scan(/^[^#][^:]*:([^:]*):([^:]*):[^:]*:[^:]*:([^:])/).collect { |n,e,s|
+        e = :absent if [:broken, :inconsistent].include?(STATE_CODE[s])
+        { :name => n, :ensure => e, :status => STATE_CODE[s], :provider => self.name }
       }
     rescue Puppet::ExecutionFailure => detail
       if hash[:pkgname]

data/lib/puppet/provider/package/apt.rb

@@ -1,7 +1,11 @@
+require 'puppet/util/package/version/range'
+require 'puppet/util/package/version/debian'
+
 Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
   # Provide sorting functionality
   include Puppet::Util::Package
-
+  DebianVersion = Puppet::Util::Package::Version::Debian
+  VersionRange  = Puppet::Util::Package::Version::Range
   desc "Package management via `apt-get`.
 
     This provider supports the `install_options` attribute, which allows command-line flags to be passed to apt-get.
@@ -12,6 +16,7 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
 
   commands :aptget => "/usr/bin/apt-get"
   commands :aptcache => "/usr/bin/apt-cache"
+  commands :aptmark => "/usr/bin/apt-mark"
   commands :preseed => "/usr/bin/debconf-set-selections"
 
   defaultfor :osfamily => :debian
@@ -26,6 +31,39 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
     false
   end
 
+  def self.instances
+    packages = super
+    manual_marks = aptmark('showmanual').split("\n")
+    packages.each do |package|
+      package.mark = :manual if manual_marks.include?(package.name)
+    end
+    packages
+  end
+
+  def query
+    hash = super
+    hash[:mark] = :manual if aptmark('showmanual').split("\n").include?(@resource[:name])
+    hash
+  end
+
+  def initialize(value={})
+    super(value)
+    @property_flush = {}
+  end
+
+  def mark=(value)
+    @property_flush[:mark] = value
+  end
+
+  def flush
+    # unless we are removing the package mark it if it hasn't already been marked
+    if @property_flush
+      unless @property_flush[:mark] || [:purge, :absent].include?(resource[:ensure])
+        aptmark('manual', resource[:name])
+      end
+    end
+  end
+
   # A derivative of DPKG; this is how most people actually manage
   # Debian boxes, and the only thing that differs is that it can
   # install packages from remote sites.
@@ -44,12 +82,44 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
     end
   end
 
+  def best_version(should_range)
+    available_versions = SortedSet.new
+
+    output = aptcache :madison, @resource[:name]
+    output.each_line do |line|
+      is = line.split('|')[1].strip
+      begin
+        is_version = DebianVersion.parse(is)
+        available_versions << is_version if should_range.include?(is_version)
+      rescue DebianVersion::ValidationFailure
+        Puppet.debug("Cannot parse #{is} as a debian version")
+      end
+    end
+
+    return available_versions.to_a.last unless available_versions.empty?
+
+    Puppet.debug("No available version for package #{@resource[:name]} is included in range #{should_range}")
+    should_range
+  end
+
   # Install a package using 'apt-get'.  This function needs to support
   # installing a specific version.
   def install
     self.run_preseed if @resource[:responsefile]
     should = @resource[:ensure]
 
+    if should.is_a?(String)
+      begin
+        should_range = VersionRange.parse(should, DebianVersion)
+
+        unless should_range.is_a?(VersionRange::Eq)
+          should = best_version(should_range)
+        end
+      rescue VersionRange::ValidationFailure, DebianVersion::ValidationFailure
+        Puppet.debug("Cannot parse #{should} as a debian version range, falling through")
+      end
+    end
+
     checkforcdrom
     cmd = %w{-q -y}
 
@@ -130,4 +200,31 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
   def install_options
     join_options(@resource[:install_options])
   end
+
+  def insync?(is)
+    # this is called after the generic version matching logic (insync? for the
+    # type), so we only get here if should != is
+
+    return false unless is && is != :absent
+
+    #if 'should' is a range and 'is' a debian version we should check if 'should' includes 'is'
+    should = @resource[:ensure]
+
+    return false unless is.is_a?(String) && should.is_a?(String)
+
+    begin
+      should_range = VersionRange.parse(should, DebianVersion)
+    rescue VersionRange::ValidationFailure, DebianVersion::ValidationFailure
+      Puppet.debug("Cannot parse #{should} as a debian version range")
+      return false
+    end
+
+    begin
+      is_version = DebianVersion.parse(is)
+    rescue DebianVersion::ValidationFailure
+      Puppet.debug("Cannot parse #{is} as a debian version")
+      return false
+    end
+    should_range.include?(is_version)
+  end
 end

data/lib/puppet/provider/package/aptitude.rb

@@ -16,7 +16,7 @@ Puppet::Type.type(:package).provide :aptitude, :parent => :apt, :source => :dpkg
     output = aptitude(*args)
 
     # Yay, stupid aptitude doesn't throw an error when the package is missing.
-    if args.include?(:install) and output =~ /Couldn't find any package/
+    if args.include?(:install) and output.to_s =~ /Couldn't find any package/
       raise Puppet::Error.new(
         _("Could not find package %{name}") % { name: self.name }
       )

data/lib/puppet/provider/package/dnfmodule.rb

@@ -12,7 +12,7 @@ require 'puppet/provider/package'
 
 Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
 
-  has_feature :installable, :uninstallable, :versionable, :supports_flavors
+  has_feature :installable, :uninstallable, :versionable, :supports_flavors, :disableable
   #has_feature :upgradeable
   # it's not (yet) feasible to make this upgradeable since module streams don't
   # always have matching version types (i.e. idm has streams DL1 and client,
@@ -34,14 +34,26 @@ Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
 
   def self.instances
     packages = []
-    cmd = "#{command(:dnf)} module list --installed -d 0 -e #{error_level}"
+    cmd = "#{command(:dnf)} module list -d 0 -e #{error_level}"
     execute(cmd).each_line do |line|
-      next unless line =~ /\[i\][, ]/  # get rid of non-package lines (including last Hint line)
-      line.gsub!(/\[[de]\]/, '')  # we don't care about default/enabled flags
+      # select only lines with actual packages since DNF clutters the output
+      next unless line =~ /\[[eix]\][, ]/
+      line.gsub!(/\[d\]/, '')  # we don't care about the default flag
+
+      flavor = if line.include?('[i]')
+                 line.split('[i]').first.split.last
+               else
+                 :absent
+               end
+
       packages << new(
         name: line.split[0],
-        ensure: line.split[1],
-        flavor: line.split('[i]').first.split.last,  # this is nasty
+        ensure: if line.include?('[x]')
+                  :disabled
+                else
+                  line.split[1]
+                end,
+        flavor: flavor,
         provider: name
       )
     end
@@ -55,28 +67,55 @@ Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
     pkg ? pkg.properties : nil
   end
 
-  def reset
-    execute([command(:dnf), 'module', 'reset', '-d', '0', '-e', self.class.error_level, '-y', @resource[:name]])
-  end
-
   # to install specific streams and profiles:
   # $ dnf module install module-name:stream/profile
   # $ dnf module install perl:5.24/minimal
   # if unspecified, they will be defaulted (see [d] param in dnf module list output)
   def install
-    args = @resource[:name]
     # ensure we start fresh (remove existing stream)
     uninstall unless [:absent, :purged].include?(@property_hash[:ensure])
+
+    args = @resource[:name].dup
     case @resource[:ensure]
     when true, false, Symbol
       # pass
     else
       args << ":#{@resource[:ensure]}"
     end
-    if @resource[:flavor]
-      args << "/#{@resource[:flavor]}"
+    args << "/#{@resource[:flavor]}" if @resource[:flavor]
+
+    if @resource[:enable_only] == true
+      enable(args)
+    else
+      begin
+        execute([command(:dnf), 'module', 'install', '-d', '0', '-e', self.class.error_level, '-y', args])
+      rescue Puppet::ExecutionFailure => e
+        # module has no default profile and no profile was requested, so just enable the stream
+        # DNF versions prior to 4.2.8 do not need this workaround
+        # see https://bugzilla.redhat.com/show_bug.cgi?id=1669527
+        if @resource[:flavor] == nil && e.message =~ /^missing groups or modules: #{Regexp.quote(@resource[:name])}$/
+          enable(args)
+        else
+          raise
+        end
+      end
+    end
+  end
+
+  # should only get here when @resource[ensure] is :disabled
+  def insync?(is)
+    if resource[:ensure] == :disabled
+      # in sync only if package is already disabled
+      pkg = self.class.instances.find do |package|
+        @resource[:name] == package.name && package.properties[:ensure] == :disabled
+      end
+      return true if pkg
     end
-    execute([command(:dnf), 'module', 'install', '-d', '0', '-e', self.class.error_level, '-y', args])
+    return false
+  end
+
+  def enable(args = @resource[:name])
+    execute([command(:dnf), 'module', 'enable', '-d', '0', '-e', self.class.error_level, '-y', args])
   end
 
   def uninstall
@@ -84,6 +123,14 @@ Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
     reset  # reset module to the default stream
   end
 
+  def disable(args = @resource[:name])
+    execute([command(:dnf), 'module', 'disable', '-d', '0', '-e', self.class.error_level, '-y', args])
+  end
+
+  def reset
+    execute([command(:dnf), 'module', 'reset', '-d', '0', '-e', self.class.error_level, '-y', @resource[:name]])
+  end
+
   def flavor
     @property_hash[:flavor]
   end