puppet 6.14.0-universal-darwin → 6.19.0-universal-darwin

data/lib/puppet/provider/package/puppetserver_gem.rb

@@ -0,0 +1,180 @@
+unless Puppet::Util::Platform.jruby_fips?
+  require 'rubygems/commands/list_command'
+end
+require 'stringio'
+require 'uri'
+
+# Ruby gems support.
+Puppet::Type.type(:package).provide :puppetserver_gem, :parent => :gem do
+  desc "Puppet Server Ruby Gem support. If a URL is passed via `source`, then
+    that URL is appended to the list of remote gem repositories which by default
+    contains rubygems.org; To ensure that only the specified source is used also
+    pass `--clear-sources` in via `install_options`; if a source is present but
+    is not a valid URL, it will be interpreted as the path to a local gem file.
+    If source is not present at all, the gem will be installed from the default
+    gem repositories."
+
+  has_feature :versionable, :install_options, :uninstall_options
+
+  confine :feature => :hocon
+  # see SERVER-2578
+  confine :fips_enabled => false
+
+  # Define the default provider package command name, as the parent 'gem' provider is targetable.
+  # Required by Puppet::Provider::Package::Targetable::resource_or_provider_command
+
+  def self.provider_command
+    command(:puppetservercmd)
+  end
+
+  # The gem command uses HOME to locate a gemrc file.
+  # CommandDefiner in provider.rb will set failonfail, combine, and environment.
+
+  has_command(:puppetservercmd, '/opt/puppetlabs/bin/puppetserver') do
+    environment(HOME: ENV['HOME'])
+  end
+
+  def self.gemlist(options)
+    command_options = ['gem', 'list']
+
+    if options[:local]
+      command_options << '--local'
+    else
+      command_options << '--remote'
+    end
+
+    if options[:source]
+      command_options << '--source' << options[:source]
+    end
+
+    if options[:justme]
+      gem_regex = '\A' + options[:justme] + '\z'
+      command_options << gem_regex
+    end
+
+    if options[:local]
+      list = execute_rubygems_list_command(gem_regex)
+    else
+      begin
+        list = puppetservercmd(command_options)
+      rescue Puppet::ExecutionFailure => detail
+        raise Puppet::Error, _("Could not list gems: %{detail}") % { detail: detail }, detail.backtrace
+      end
+    end
+
+    # When `/tmp` is mounted `noexec`, `puppetserver gem list` will output:
+    # *** LOCAL GEMS ***
+    # causing gemsplit to output:
+    # Warning: Could not match *** LOCAL GEMS ***
+    gem_list = list
+                 .lines
+                 .select { |x| x =~ /^(\S+)\s+\((.+)\)/ }
+                 .map { |set| gemsplit(set) }
+
+    if options[:justme]
+      return gem_list.shift
+    else
+      return gem_list
+    end
+  end
+
+  def install(useversion = true)
+    command_options = ['gem', 'install']
+    command_options += install_options if resource[:install_options]
+
+    command_options << '-v' << resource[:ensure] if (!resource[:ensure].is_a? Symbol) && useversion
+
+    command_options << '--no-document'
+
+    if resource[:source]
+      begin
+        uri = URI.parse(resource[:source])
+      rescue => detail
+        self.fail Puppet::Error, _("Invalid source '%{uri}': %{detail}") % { uri: uri, detail: detail }, detail
+      end
+
+      case uri.scheme
+      when nil
+        # no URI scheme => interpret the source as a local file
+        command_options << resource[:source]
+      when /file/i
+        command_options << uri.path
+      when 'puppet'
+        # we don't support puppet:// URLs (yet)
+        raise Puppet::Error.new(_('puppet:// URLs are not supported as gem sources'))
+      else
+        # interpret it as a gem repository
+        command_options << '--source' << "#{resource[:source]}" << resource[:name]
+      end
+    else
+      command_options << resource[:name]
+    end
+
+    output = puppetservercmd(command_options)
+    # Apparently, some gem versions don't exit non-0 on failure.
+    self.fail _("Could not install: %{output}") % { output: output.chomp } if output.include?('ERROR')
+  end
+
+  def uninstall
+    command_options = ['gem', 'uninstall']
+    command_options << '--executables' << '--all' << resource[:name]
+    command_options += uninstall_options if resource[:uninstall_options]
+
+    output = puppetservercmd(command_options)
+    # Apparently, some gem versions don't exit non-0 on failure.
+    self.fail _("Could not uninstall: %{output}") % { output: output.chomp } if output.include?('ERROR')
+  end
+
+  private
+
+  # The puppetserver gem cli command is very slow, since it starts a JVM.
+  #
+  # Instead, for the list subcommand (which is executed with every puppet run),
+  # use the rubygems library from puppet ruby: setting GEM_HOME and GEM_PATH
+  # to the default values, or the values in the puppetserver configuration file.
+  #
+  # The rubygems library cannot access java platform gems,
+  # for example: json (1.8.3 java)
+  # but java platform gems should not be managed by this (or any) provider.
+
+  def self.execute_rubygems_list_command(gem_regex)
+    puppetserver_default_gem_home            = '/opt/puppetlabs/server/data/puppetserver/jruby-gems'
+    puppetserver_default_vendored_jruby_gems = '/opt/puppetlabs/server/data/puppetserver/vendored-jruby-gems'
+    puppet_default_vendor_gems               = '/opt/puppetlabs/puppet/lib/ruby/vendor_gems'
+    puppetserver_default_gem_path = [puppetserver_default_gem_home, puppetserver_default_vendored_jruby_gems, puppet_default_vendor_gems].join(':')
+
+    pe_puppetserver_conf_file = '/etc/puppetlabs/puppetserver/conf.d/pe-puppet-server.conf'
+    os_puppetserver_conf_file = '/etc/puppetlabs/puppetserver/puppetserver.conf'
+    puppetserver_conf_file = Facter.value(:pe_server_version) ? pe_puppetserver_conf_file : os_puppetserver_conf_file
+    puppetserver_conf = Hocon.load(puppetserver_conf_file)
+
+    gem_env = {}
+    if puppetserver_conf.empty? || puppetserver_conf.key?('jruby-puppet') == false
+      gem_env['GEM_HOME'] = puppetserver_default_gem_home
+      gem_env['GEM_PATH'] = puppetserver_default_gem_path
+    else
+      gem_env['GEM_HOME'] = puppetserver_conf['jruby-puppet'].key?('gem-home') ? puppetserver_conf['jruby-puppet']['gem-home'] : puppetserver_default_gem_home
+      gem_env['GEM_PATH'] = puppetserver_conf['jruby-puppet'].key?('gem-path') ? puppetserver_conf['jruby-puppet']['gem-path'].join(':') : puppetserver_default_gem_path
+    end
+    gem_env['GEM_SPEC_CACHE'] = "/tmp/#{$$}"
+    Gem.paths = gem_env
+
+    sio_inn = StringIO.new
+    sio_out = StringIO.new
+    sio_err = StringIO.new
+    stream_ui = Gem::StreamUI.new(sio_inn, sio_out, sio_err, false)
+    gem_list_cmd = Gem::Commands::ListCommand.new
+    gem_list_cmd.options[:domain] = :local
+    gem_list_cmd.options[:args] = [gem_regex] if gem_regex
+    gem_list_cmd.ui = stream_ui
+    gem_list_cmd.execute
+
+    # There is no method exclude default gems from the local gem list,
+    # for example: psych (default: 2.2.2)
+    # but default gems should not be managed by this (or any) provider.
+    gem_list = sio_out.string.lines.reject { |gem| gem =~ / \(default\: / }
+    gem_list.join("\n")
+  ensure
+    Gem.clear_paths
+  end
+end

data/lib/puppet/provider/package/rpm.rb

@@ -1,13 +1,17 @@
 require 'puppet/provider/package'
+require 'puppet/util/rpm_compare'
 
 # RPM packaging.  Should work anywhere that has rpm installed.
 Puppet::Type.type(:package).provide :rpm, :source => :rpm, :parent => Puppet::Provider::Package do
+  # provides Rpm parsing and comparison
+  include Puppet::Util::RpmCompare
+
   desc "RPM packaging support; should work anywhere with a working `rpm`
     binary.
 
     This provider supports the `install_options` and `uninstall_options`
     attributes, which allow command-line flags to be passed to rpm.
-These options should be specified as an array where each element is either a string or a hash."
+    These options should be specified as an array where each element is either a string or a hash."
 
   has_feature :versionable
   has_feature :install_options
@@ -23,31 +27,6 @@ These options should be specified as an array where each element is either a str
   self::NEVRA_FIELDS = [:name, :epoch, :version, :release, :arch]
   self::MULTIVERSION_SEPARATOR = "; "
 
-  ARCH_LIST = [
-    'noarch',
-    'i386',
-    'i686',
-    'ppc',
-    'ppc64',
-    'armv3l',
-    'armv4b',
-    'armv4l',
-    'armv4tl',
-    'armv5tel',
-    'armv5tejl',
-    'armv6l',
-    'armv7l',
-    'm68kmint',
-    's390',
-    's390x',
-    'ia64',
-    'x86_64',
-    'sh3',
-    'sh4',
-  ]
-
-  ARCH_REGEX = Regexp.new(ARCH_LIST.join('|\.'))
-
   commands :rpm => "rpm"
 
   if command('rpm')
@@ -204,200 +183,14 @@ These options should be specified as an array where each element is either a str
     join_options(resource[:uninstall_options])
   end
 
-  # This is an attempt at implementing RPM's
-  # lib/rpmvercmp.c rpmvercmp(a, b) in Ruby.
-  #
-  # Some of the things in here look REALLY
-  # UGLY and/or arbitrary. Our goal is to
-  # match how RPM compares versions, quirks
-  # and all.
-  #
-  # I've kept a lot of C-like string processing
-  # in an effort to keep this as identical to RPM
-  # as possible.
-  #
-  # returns 1 if str1 is newer than str2,
-  #         0 if they are identical
-  #        -1 if str1 is older than str2
-  def rpmvercmp(str1, str2)
-    return 0 if str1 == str2
-
-    front_strip_re = /^[^A-Za-z0-9~]+/
-
-    while str1.length > 0 or str2.length > 0
-      # trim anything that's in front_strip_re and != '~' off the beginning of each string
-      str1 = str1.gsub(front_strip_re, '')
-      str2 = str2.gsub(front_strip_re, '')
-
-      # "handle the tilde separator, it sorts before everything else"
-      if str1 =~ /^~/ && str2 =~ /^~/
-        # if they both have ~, strip it
-        str1 = str1[1..-1]
-        str2 = str2[1..-1]
-        next
-      elsif str1 =~ /^~/
-        return -1
-      elsif str2 =~ /^~/
-        return 1
-      end
-
-      break if str1.length == 0 or str2.length == 0
-
-      # "grab first completely alpha or completely numeric segment"
-      isnum = false
-      # if the first char of str1 is a digit, grab the chunk of continuous digits from each string
-      if str1 =~ /^[0-9]+/
-        if str1 =~ /^[0-9]+/
-          segment1 = $~.to_s
-          str1 = $~.post_match
-        else
-          segment1 = ''
-        end
-        if str2 =~ /^[0-9]+/
-          segment2 = $~.to_s
-          str2 = $~.post_match
-        else
-          segment2 = ''
-        end
-        isnum = true
-      # else grab the chunk of continuous alphas from each string (which may be '')
-      else
-        if str1 =~ /^[A-Za-z]+/
-          segment1 = $~.to_s
-          str1 = $~.post_match
-        else
-          segment1 = ''
-        end
-        if str2 =~ /^[A-Za-z]+/
-          segment2 = $~.to_s
-          str2 = $~.post_match
-        else
-          segment2 = ''
-        end
-      end
-
-      # if the segments we just grabbed from the strings are different types (i.e. one numeric one alpha),
-      # where alpha also includes ''; "numeric segments are always newer than alpha segments"
-      if segment2.length == 0
-        return 1 if isnum
-        return -1
-      end
-
-      if isnum
-        # "throw away any leading zeros - it's a number, right?"
-        segment1 = segment1.gsub(/^0+/, '')
-        segment2 = segment2.gsub(/^0+/, '')
-        # "whichever number has more digits wins"
-        return 1 if segment1.length > segment2.length
-        return -1 if segment1.length < segment2.length
-      end
-
-      # "strcmp will return which one is greater - even if the two segments are alpha
-      # or if they are numeric. don't return if they are equal because there might
-      # be more segments to compare"
-      rc = segment1 <=> segment2
-      return rc if rc != 0
-    end #end while loop
-
-    # if we haven't returned anything yet, "whichever version still has characters left over wins"
-    if str1.length > str2.length
-      return 1
-    elsif str1.length < str2.length
-      return -1
-    else
-      return 0
-    end
-  end
-
   def insync?(is)
     return false if [:purged, :absent].include?(is)
     return false if is.include?(self.class::MULTIVERSION_SEPARATOR) && !@resource[:install_only]
 
     should = resource[:ensure]
     is.split(self.class::MULTIVERSION_SEPARATOR).any? do |version|
-      0 == self.rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(version))
-    end
-  end
-
-  # parse a rpm "version" specification
-  # this re-implements rpm's
-  # rpmUtils.miscutils.stringToVersion() in ruby
-  def rpm_parse_evr(s)
-    ei = s.index(':')
-    if ei
-      e = s[0,ei]
-      s = s[ei+1,s.length]
-    else
-      e = nil
-    end
-    begin
-      e = String(Integer(e))
-    rescue
-      # If there are non-digits in the epoch field, default to nil
-      e = nil
-    end
-    ri = s.index('-')
-    if ri
-      v = s[0,ri]
-      r = s[ri+1,s.length]
-      arch = r.scan(ARCH_REGEX)[0]
-      if arch
-        a = arch.delete('.')
-        r.gsub!(ARCH_REGEX, '')
-      end
-    else
-      v = s
-      r = nil
-    end
-    return { :epoch => e, :version => v, :release => r, :arch => a }
-  end
-
-  # how rpm compares two package versions:
-  # rpmUtils.miscutils.compareEVR(), which massages data types and then calls
-  # rpm.labelCompare(), found in rpm.git/python/header-py.c, which
-  # sets epoch to 0 if null, then compares epoch, then ver, then rel
-  # using compare_values() and returns the first non-0 result, else 0.
-  # This function combines the logic of compareEVR() and labelCompare().
-  #
-  # "version_should" can be v, v-r, or e:v-r.
-  # "version_is" will always be at least v-r, can be e:v-r
-  def rpm_compareEVR(should_hash, is_hash)
-    # pass on to rpm labelCompare
-
-    if !should_hash[:epoch].nil?
-      rc = compare_values(should_hash[:epoch], is_hash[:epoch])
-      return rc unless rc == 0
-    end
-
-    rc = compare_values(should_hash[:version], is_hash[:version])
-    return rc unless rc == 0
-
-    # here is our special case, PUP-1244.
-    # if should_hash[:release] is nil (not specified by the user),
-    # and comparisons up to here are equal, return equal. We need to
-    # evaluate to whatever level of detail the user specified, so we
-    # don't end up upgrading or *downgrading* when not intended.
-    #
-    # This should NOT be triggered if we're trying to ensure latest.
-    return 0 if should_hash[:release].nil?
-
-    rc = compare_values(should_hash[:release], is_hash[:release])
-
-    return rc
-  end
-
-  # this method is a native implementation of the
-  # compare_values function in rpm's python bindings,
-  # found in python/header-py.c, as used by rpm.
-  def compare_values(s1, s2)
-    if s1.nil? && s2.nil?
-      return 0
-    elsif ( not s1.nil? ) && s2.nil?
-      return 1
-    elsif s1.nil? && (not s2.nil?)
-      return -1
+      0 == rpm_compareEVR(should, version)
     end
-    return rpmvercmp(s1, s2)
   end
 
   private

data/lib/puppet/provider/package/yum.rb

@@ -1,4 +1,11 @@
+require 'puppet/util/package/version/range'
+require 'puppet/util/package/version/rpm'
+require 'puppet/util/rpm_compare'
+
 Puppet::Type.type(:package).provide :yum, :parent => :rpm, :source => :rpm do
+  # provides Rpm parsing and comparison
+  include Puppet::Util::RpmCompare
+
   desc "Support via `yum`.
 
   Using this provider's `uninstallable` feature will not remove dependent packages. To
@@ -10,6 +17,9 @@ Puppet::Type.type(:package).provide :yum, :parent => :rpm, :source => :rpm do
 
   has_feature :install_options, :versionable, :virtual_packages, :install_only
 
+  RPM_VERSION       = Puppet::Util::Package::Version::Rpm
+  RPM_VERSION_RANGE = Puppet::Util::Package::Version::Range
+
   commands :cmd => "yum", :rpm => "rpm"
 
   if command('rpm')
@@ -25,6 +35,36 @@ Puppet::Type.type(:package).provide :yum, :parent => :rpm, :source => :rpm do
 defaultfor :operatingsystem => :amazon
 defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
 
+  def insync?(is)
+    return false if [:purged, :absent].include?(is)
+    return false if is.include?(self.class::MULTIVERSION_SEPARATOR) && !@resource[:install_only]
+
+    should = @resource[:ensure]
+    if should.is_a?(String)
+      begin
+        should_version = RPM_VERSION_RANGE.parse(should, RPM_VERSION)
+
+        if should_version.is_a?(RPM_VERSION_RANGE::Eq)
+          return super
+        end
+      rescue RPM_VERSION_RANGE::ValidationFailure, RPM_VERSION::ValidationFailure
+        Puppet.debug("Cannot parse #{should} as a RPM version range")
+        return super
+      end
+
+      is.split(self.class::MULTIVERSION_SEPARATOR).any? do |version|
+        begin
+          is_version = RPM_VERSION.parse(version)
+          should_version.include?(is_version)
+        rescue RPM_VERSION::ValidationFailure
+          Puppet.debug("Cannot parse #{is} as a RPM version")
+        end
+      end
+    end
+  end
+
+  VERSION_REGEX = /^(?:(\d+):)?(\S+)-(\S+)$/
+
   def self.prefetch(packages)
     raise Puppet::Error, _("The yum provider can only be used as root") if Process.euid != 0
     super
@@ -86,23 +126,24 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
   end
 
   def self.parse_updates(str)
-    # Strip off all content before the first blank line
-    body = str.partition(/^\s*\n/m).last
+    # Strip off all content that contains Obsoleting, Security: or Update
+    body = str.partition(/^(Obsoleting|Security:|Update)/).first
 
     updates = Hash.new { |h, k| h[k] = [] }
-    body.split.each_slice(3) do |tuple|
-      break if tuple[0] =~ /^(Obsoleting|Security:|Update)/
-      break unless tuple[1] =~ /^(?:(\d+):)?(\S+)-(\S+)$/
-      hash = update_to_hash(*tuple[0..1])
-      # Create entries for both the package name without a version and a
-      # version since yum considers those as mostly interchangeable.
-      short_name = hash[:name]
-      long_name  = "#{hash[:name]}.#{hash[:arch]}"
-
-      updates[short_name] << hash
-      updates[long_name] << hash
-    end
 
+    body.split(/^\s*\n/).each do |line|
+      line.split.each_slice(3) do |tuple|
+        next unless tuple[0].include?('.') && tuple[1] =~ VERSION_REGEX
+
+        hash = update_to_hash(*tuple[0..1])
+        # Create entries for both the package name without a version and a
+        # version since yum considers those as mostly interchangeable.
+        short_name = hash[:name]
+        long_name  = "#{hash[:name]}.#{hash[:arch]}"
+        updates[short_name] << hash
+        updates[long_name] << hash
+      end
+    end
     updates
   end
 
@@ -117,7 +158,7 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
       raise _("Failed to parse package name and architecture from '%{pkgname}'") % { pkgname: pkgname }
     end
 
-    match = pkgversion.match(/^(?:(\d+):)?(\S+)-(\S+)$/)
+    match = pkgversion.match(VERSION_REGEX)
     epoch = match[1] || '0'
     version = match[2]
     release = match[3]
@@ -151,6 +192,44 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
     'update'
   end
 
+  def best_version(should)
+    if should.is_a?(String)
+      begin
+        should_range = RPM_VERSION_RANGE.parse(should, RPM_VERSION)
+        if should_range.is_a?(RPM_VERSION_RANGE::Eq)
+          return should
+        end
+      rescue RPM_VERSION_RANGE::ValidationFailure, RPM_VERSION::ValidationFailure
+        Puppet.debug("Cannot parse #{should} as a RPM version range")
+        return should
+      end
+      sorted_versions = SortedSet.new
+      available_versions(@resource[:name]).each do |version|
+        begin
+          rpm_version = RPM_VERSION.parse(version)
+          sorted_versions << rpm_version if should_range.include?(rpm_version)
+        rescue RPM_VERSION::ValidationFailure
+          Puppet.debug("Cannot parse #{version} as a RPM version")
+        end
+      end
+
+      version = sorted_versions.entries.last
+
+      if version
+        version = version.to_s.sub(/^\d+:/, '')
+        return version
+      end
+
+      Puppet.debug("No available version for package #{@resource[:name]} is included in range #{should_range}")
+      should
+    end
+  end
+
+  def available_versions(package_name)
+    output = execute("yum list #{package_name} --showduplicates | sed -e '1,/Available Packages/ d' | awk '{print $2}'")
+    output.split("\n")
+  end
+
   def install
     wanted = @resource[:name]
     error_level = self.class.error_level
@@ -195,10 +274,11 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
         self.debug "Installing directly from #{wanted}"
       else
         # No explicit source was specified, so add the package version
+        should = best_version(should)
         wanted += "-#{should}"
-        if wanted.scan(ARCH_REGEX)
+        if wanted.scan(self.class::ARCH_REGEX)
           self.debug "Detected Arch argument in package! - Moving arch to end of version string"
-          wanted.gsub!(/(.+)(#{ARCH_REGEX})(.+)/,'\1\3\2')
+          wanted.gsub!(/(.+)(#{self.class::ARCH_REGEX})(.+)/,'\1\3\2')
         end
       end
       current_package = self.query
@@ -206,10 +286,10 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
         if @resource[:install_only]
           self.debug "Updating package #{@resource[:name]} from version #{current_package[:ensure]} to #{should} as install_only packages are never downgraded"
           operation = update_command
-        elsif rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(current_package[:ensure])) < 0
+        elsif rpm_compareEVR(should, current_package[:ensure]) < 0
           self.debug "Downgrading package #{@resource[:name]} from version #{current_package[:ensure]} to #{should}"
           operation = :downgrade
-        elsif rpm_compareEVR(rpm_parse_evr(should), rpm_parse_evr(current_package[:ensure])) > 0
+        elsif rpm_compareEVR(should, current_package[:ensure]) > 0
           self.debug "Upgrading package #{@resource[:name]} from version #{current_package[:ensure]} to #{should}"
           operation = update_command
         end
@@ -222,7 +302,7 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
     command = [command(:cmd)] + no_debug + ["-e", error_level, "-y", install_options, operation, wanted].compact
     output = execute(command)
 
-    if output =~ /^No package #{wanted} available\.$/
+    if output.to_s =~ /^No package #{wanted} available\.$/
       raise Puppet::Error, _("Could not find package %{wanted}") % { wanted: wanted }
     end
 
@@ -248,6 +328,7 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
       return "#{upd[:epoch]}:#{upd[:version]}-#{upd[:release]}"
     else
       # Yum didn't find updates, pretend the current version is the latest
+      self.debug "Yum didn't find updates, current version (#{properties[:ensure]}) is the latest"
       version = properties[:ensure]
       raise Puppet::DevError, _("Tried to get latest on a missing package") if version == :absent || version == :purged
       return version