puppet 6.14.0 → 6.19.0

data/lib/puppet/pal/catalog_compiler.rb

@@ -97,6 +97,11 @@ module Pal
       internal_compiler.evaluate_additions
     end
 
+    # Attempts to evaluate AST for node defnintions https://puppet.com/docs/puppet/latest/lang_node_definitions.html
+    # if there are any.
+    def evaluate_ast_node
+      internal_compiler.evaluate_ast_node
+    end
   end
 
 end

data/lib/puppet/pal/pal_impl.rb

@@ -49,6 +49,7 @@ module Pal
   #   If given at the environment level, the facts given here are merged with higher priority.
   # @param variables [Hash] optional map of fully qualified variable name to value. If given at the environment level, the variables
   #   given here are merged with higher priority.
+  # @param set_local_facts [Boolean] when true, the $facts, $server_facts, and $trusted variables are set for the scope.
   # @param block [Proc] the block performing operations on compiler
   # @return [Object] what the block returns
   # @yieldparam [Puppet::Pal::ScriptCompiler] compiler, a ScriptCompiler to perform operations on.
@@ -59,6 +60,7 @@ module Pal
       code_string:       nil,
       facts:             nil,
       variables:         nil,
+      set_local_facts:   true,
       &block
     )
     # TRANSLATORS: do not translate variable name strings in these assertions
@@ -91,7 +93,7 @@ module Pal
 
     # If manifest_file is nil, the #main method will use the env configured manifest
     # to do things in the block while a Script Compiler is in effect
-    main(manifest_file, facts, variables, :script, &block)
+    main(manifest_file, facts, variables, :script, set_local_facts, &block)
   ensure
     Puppet[:tasks] = previous_tasks_value
     Puppet[:code] = previous_code_value
@@ -191,7 +193,7 @@ module Pal
 
     # If manifest_file is nil, the #main method will use the env configured manifest
     # to do things in the block while a Script Compiler is in effect
-    main(manifest_file, facts, variables, :catalog, &block)
+    main(manifest_file, facts, variables, :catalog, false, &block)
   ensure
     # Clean up after ourselves
     Puppet[:tasks] = previous_tasks_value
@@ -379,7 +381,13 @@ module Pal
   # Picks up information from the puppet context and configures a script compiler which is given to
   # the provided block
   #
-  def self.main(manifest, facts, variables, internal_compiler_class)
+  def self.main(
+    manifest,
+    facts,
+    variables,
+    internal_compiler_class,
+    set_local_facts
+  )
     # Configure the load path
     env = Puppet.lookup(:pal_env)
     env.each_plugin_directory do |dir|
@@ -422,45 +430,32 @@ module Pal
     # TRANSLATORS, the string "For puppet PAL" is not user facing
     Puppet.override({:current_environment => apply_environment}, "For puppet PAL") do
       begin
-        # support the following features when evaluating puppet code
-        # * $facts with facts from host running the script
-        # * $settings with 'settings::*' namespace populated, and '$settings::all_local' hash
-        # * $trusted as setup when using puppet apply
-        # * an environment
-        #
-
-        # fixup trusted information
         node.sanitize()
-
         compiler = create_internal_compiler(internal_compiler_class, node)
-        # compiler = Puppet::Parser::ScriptCompiler.new(node.environment, node.name)
-        topscope = compiler.topscope
 
-        # When scripting the trusted data are always local, but set them anyway
+        case internal_compiler_class
+        when :script
+          pal_compiler = ScriptCompiler.new(compiler)
+          overrides[:pal_script_compiler] = overrides[:pal_compiler] = pal_compiler
+        when :catalog
+          pal_compiler = CatalogCompiler.new(compiler)
+          overrides[:pal_catalog_compiler] = overrides[:pal_compiler] = pal_compiler
+        end
+
+        # When scripting the trusted data are always local; default is to set them anyway
         # When compiling for a catalog, the catalog compiler does this
-        unless internal_compiler_class == :catalog
-          topscope.set_trusted(node.trusted_data)
+        if set_local_facts
+          compiler.topscope.set_trusted(node.trusted_data)
 
           # Server facts are always about the local node's version etc.
-          topscope.set_server_facts(node.server_facts)
+          compiler.topscope.set_server_facts(node.server_facts)
 
           # Set $facts for the node running the script
           facts_hash = node.facts.nil? ? {} : node.facts.values
-          topscope.set_facts(facts_hash)
+          compiler.topscope.set_facts(facts_hash)
 
           # create the $settings:: variables
-          topscope.merge_settings(node.environment.name, false)
-        end
-
-        add_variables(topscope, pal_variables)
-
-        case internal_compiler_class
-        when :script
-          pal_compiler = ScriptCompiler.new(compiler)
-          overrides[:pal_script_compiler] = overrides[:pal_compiler] = pal_compiler
-        when :catalog
-          pal_compiler = CatalogCompiler.new(compiler)
-          overrides[:pal_catalog_compiler] = overrides[:pal_compiler] = pal_compiler
+          compiler.topscope.merge_settings(node.environment.name, false)
         end
 
         # Make compiler available to Puppet#lookup and injection in functions
@@ -468,6 +463,10 @@ module Pal
         # TRANSLATORS: Do not translate, symbolic name
         Puppet.override(overrides, "PAL::with_#{internal_compiler_class}_compiler") do
           compiler.compile do | compiler_yield |
+            # In case the varaibles passed to the compiler are PCore types defined in modules, they
+            # need to be deserialized and added from within the this scope, so that loaders are
+            # available during deserizlization.
+            add_variables(compiler.topscope, Puppet::Pops::Serialization::FromDataConverter.convert(pal_variables))
             # wrap the internal compiler to prevent it from leaking in the PAL API
             if block_given?
               yield(pal_compiler)

data/lib/puppet/parameter.rb

@@ -429,7 +429,7 @@ class Puppet::Parameter
     begin
       ret = unsafe_munge(value)
     rescue Puppet::Error => detail
-      Puppet.debug "Reraising #{detail}"
+      Puppet.debug { "Reraising #{detail}" }
       raise
     rescue => detail
       raise Puppet::DevError, _("Munging failed for value %{value} in class %{class_name}: %{detail}") % { value: value.inspect, class_name: self.name, detail: detail }, detail.backtrace

data/lib/puppet/parser/ast/leaf.rb

@@ -17,17 +17,17 @@ class Puppet::Parser::AST::Leaf < Puppet::Parser::AST
     @value.to_s unless @value.nil?
   end
 
-  def initialize(value: nil, **options)
+  def initialize(value: nil, file: nil, line: nil, pos: nil)
     @value = value
-    super(**options)
+    super(file: file, line: line, pos: pos)
   end
 end
 
 # Host names, either fully qualified or just the short name, or even a regex
 #
 class Puppet::Parser::AST::HostName < Puppet::Parser::AST::Leaf
-  def initialize(hash)
-    super
+  def initialize(value: nil, file: nil, line: nil, pos: nil)
+    super(value: value, file: file, line: line, pos: pos)
 
     # Note that this is an AST::Regex, not a Regexp
     unless @value.is_a?(Regex)
@@ -51,7 +51,7 @@ end
 
 class Puppet::Parser::AST::Regex < Puppet::Parser::AST::Leaf
   def initialize(hash)
-    super
+    super(**hash)
     # transform value from hash options unless it is already a regular expression
     @value = Regexp.new(@value) unless @value.is_a?(Regexp)
   end

data/lib/puppet/parser/ast/pops_bridge.rb

@@ -57,10 +57,6 @@ class Puppet::Parser::AST::PopsBridge
   end
 
   class ExpressionSupportingReturn < Expression
-    def initialize args
-      super
-    end
-
     def evaluate(scope)
       return catch(:return) do
         return catch(:next) do

data/lib/puppet/parser/compiler.rb

@@ -348,6 +348,34 @@ class Puppet::Parser::Compiler
     end
   end
 
+
+  # If ast nodes are enabled, then see if we can find and evaluate one.
+  #
+  # @api private
+  def evaluate_ast_node
+    krt = environment.known_resource_types
+    return unless krt.nodes? #ast_nodes?
+
+    # Now see if we can find the node.
+    astnode = nil
+    @node.names.each do |name|
+      astnode = krt.node(name.to_s.downcase)
+      break if astnode
+    end
+
+    unless (astnode ||= krt.node("default"))
+      raise Puppet::ParseError, _("Could not find node statement with name 'default' or '%{names}'") % { names: node.names.join(", ") }
+    end
+
+    # Create a resource to model this node, and then add it to the list
+    # of resources.
+    resource = astnode.ensure_in_catalog(topscope)
+
+    resource.evaluate
+
+    @node_scope = topscope.class_scope(astnode)
+  end
+
   # Evaluates each specified class in turn. If there are any classes that
   # can't be found, an error is raised. This method really just creates resource objects
   # that point back to the classes, and then the resources are themselves
@@ -420,7 +448,7 @@ class Puppet::Parser::Compiler
   # using the top scope.
   def newscope(parent, options = {})
     parent ||= topscope
-    scope = Puppet::Parser::Scope.new(self, options)
+    scope = Puppet::Parser::Scope.new(self, **options)
     scope.parent = parent
     scope
   end
@@ -486,31 +514,6 @@ class Puppet::Parser::Compiler
     krt.capability_mappings.clear # No longer needed
   end
 
-  # If ast nodes are enabled, then see if we can find and evaluate one.
-  def evaluate_ast_node
-    krt = environment.known_resource_types
-    return unless krt.nodes? #ast_nodes?
-
-    # Now see if we can find the node.
-    astnode = nil
-    @node.names.each do |name|
-      astnode = krt.node(name.to_s.downcase)
-      break if astnode
-    end
-
-    unless (astnode ||= krt.node("default"))
-      raise Puppet::ParseError, _("Could not find node statement with name 'default' or '%{names}'") % { names: node.names.join(", ") }
-    end
-
-    # Create a resource to model this node, and then add it to the list
-    # of resources.
-    resource = astnode.ensure_in_catalog(topscope)
-
-    resource.evaluate
-
-    @node_scope = topscope.class_scope(astnode)
-  end
-
   # Evaluate our collections and return true if anything returned an object.
   # The 'true' is used to continue a loop, so it's important.
   def evaluate_collections
@@ -777,13 +780,7 @@ class Puppet::Parser::Compiler
   SETTINGS = 'settings'.freeze
 
   def create_settings_scope
-    resource_types = environment.known_resource_types
-    settings_type = resource_types.hostclass(SETTINGS)
-    if settings_type.nil?
-      settings_type = Puppet::Resource::Type.new(:hostclass, SETTINGS)
-      resource_types.add(settings_type)
-    end
-
+    settings_type = create_settings_type
     settings_resource = Puppet::Parser::Resource.new('class', SETTINGS, :scope => @topscope)
 
     @catalog.add_resource(settings_resource)
@@ -794,6 +791,19 @@ class Puppet::Parser::Compiler
     scope.merge_settings(environment.name)
   end
 
+  def create_settings_type
+    environment.lock.synchronize do
+      resource_types = environment.known_resource_types
+      settings_type = resource_types.hostclass(SETTINGS)
+      if settings_type.nil?
+        settings_type = Puppet::Resource::Type.new(:hostclass, SETTINGS)
+        resource_types.add(settings_type)
+      end
+
+      settings_type
+    end
+  end
+
   # Return an array of all of the unevaluated resources.  These will be definitions,
   # which need to get evaluated into native resources.
   def unevaluated_resources

data/lib/puppet/parser/compiler/catalog_validator/env_relationship_validator.rb

@@ -1,6 +1,8 @@
 class Puppet::Parser::Compiler
   # Validator that asserts that all capability resources that are referenced by 'consume' or 'require' has
   # been exported by some other resource in the environment
+  #
+  # @deprecated application orchestration will be removed in puppet 7
   class CatalogValidator::EnvironmentRelationshipValidator < CatalogValidator
 
     def validate

data/lib/puppet/parser/compiler/catalog_validator/site_validator.rb

@@ -1,5 +1,7 @@
 class Puppet::Parser::Compiler
   # Validator that asserts that only application components can appear inside a site.
+  #
+  # @deprecated application orchestration will be removed in puppet 7
   class CatalogValidator::SiteValidator < CatalogValidator
     def self.validation_stage?(stage)
       PRE_FINISH.equal?(stage)

data/lib/puppet/parser/environment_compiler.rb

@@ -1,5 +1,6 @@
 require 'puppet/parser/compiler'
 
+# @deprecated application orchestration will be removed in puppet 7
 class Puppet::Parser::EnvironmentCompiler < Puppet::Parser::Compiler
   def self.compile(env, code_id=nil)
     begin
@@ -16,7 +17,7 @@ class Puppet::Parser::EnvironmentCompiler < Puppet::Parser::Compiler
   end
 
   def initialize(node, options = {})
-    super
+    super(node, **options)
     @overridden_functions = {}
   end
 
@@ -54,6 +55,8 @@ class Puppet::Parser::EnvironmentCompiler < Puppet::Parser::Compiler
   end
 
   def compile
+    Puppet.deprecation_warning("Application orchestration is deprecated. See https://puppet.com/docs/puppet/5.5/deprecated_language.html")
+
     add_function_overrides
     begin
       Puppet.override(@context_overrides, _("For compiling environment catalog %{env}") % { env: environment.name }) do

data/lib/puppet/parser/functions.rb

@@ -1,6 +1,7 @@
 require 'puppet/util/autoload'
 require 'puppet/parser/scope'
 require 'puppet/pops/adaptable'
+require 'puppet/concurrent/lock'
 
 # A module for managing parser functions.  Each specified function
 # is added to a central module that then gets included into the Scope
@@ -76,15 +77,10 @@ module Puppet::Parser::Functions
   # @api private
   class AnonymousModuleAdapter < Puppet::Pops::Adaptable::Adapter
     attr_accessor :module
-  end
 
-  # Get the module that functions are mixed into corresponding to an
-  # environment
-  #
-  # @api private
-  def self.environment_module(env)
-    AnonymousModuleAdapter.adapt(env) do |a|
-      a.module ||= Module.new do
+    def self.create_adapter(env)
+      adapter = super(env)
+      adapter.module = Module.new do
         @metadata = {}
 
         def self.all_function_info
@@ -99,7 +95,20 @@ module Puppet::Parser::Functions
           @metadata[name] = info
         end
       end
-    end.module
+      adapter
+    end
+  end
+
+  @environment_module_lock = Puppet::Concurrent::Lock.new
+
+  # Get the module that functions are mixed into corresponding to an
+  # environment
+  #
+  # @api private
+  def self.environment_module(env)
+    @environment_module_lock.synchronize do
+      AnonymousModuleAdapter.adapt(env).module
+    end
   end
 
   # Create a new Puppet DSL function.

data/lib/puppet/parser/functions/create_resources.rb

@@ -1,5 +1,9 @@
 Puppet::Parser::Functions::newfunction(:create_resources, :arity => -3, :doc => <<-'ENDHEREDOC') do |args|
     Converts a hash into a set of resources and adds them to the catalog.
+    
+    **Note**: Use this function selectively. It's generally better to write resources in
+     [Puppet](https://puppet.com/docs/puppet/latest/lang_resources.html), as
+     resources created with `create_resource` are difficult to read and troubleshoot.
 
     This function takes two mandatory arguments: a resource type, and a hash describing
     a set of resources. The hash should be in the form `{title => {parameters} }`:
@@ -33,7 +37,7 @@ Puppet::Parser::Functions::newfunction(:create_resources, :arity => -3, :doc =>
     as native resources.
 
     Virtual and Exported resources may be created by prefixing the type name
-    with @ or @@ respectively.  For example, the $myusers hash may be exported
+    with @ or @@ respectively. For example, the $myusers hash may be exported
     in the following manner:
 
         create_resources("@@user", $myusers)
@@ -42,9 +46,9 @@ Puppet::Parser::Functions::newfunction(:create_resources, :arity => -3, :doc =>
 
         create_resources("@user", $myusers)
 
-    Note that `create_resources` will filter out parameter values that are `undef` so that normal
-    data binding and puppet default value expressions are considered (in that order) for the
-    final value of a parameter (just as when setting a parameter to `undef` in a puppet language
+    Note that `create_resources` filters out parameter values that are `undef` so that normal
+    data binding and Puppet default value expressions are considered (in that order) for the
+    final value of a parameter (just as when setting a parameter to `undef` in a Puppet language
     resource declaration).
   ENDHEREDOC
   if Puppet[:tasks]
@@ -63,9 +67,9 @@ Puppet::Parser::Functions::newfunction(:create_resources, :arity => -3, :doc =>
   defaults ||= {}
   type_name = type.sub(/^@{1,2}/, '').downcase
 
-  # Get file/line information from the puppet stack (where call comes from in puppet source)
-  # If relayed via other puppet functions in ruby that do not nest their calls, the source position
-  # will be in the original puppet source.
+  # Get file/line information from the Puppet stack (where call comes from in Puppet source)
+  # If relayed via other Puppet functions in ruby that do not nest their calls, the source position
+  # will be in the original Puppet source.
   #
   file, line = Puppet::Pops::PuppetStack.top_of_stack
 

data/lib/puppet/parser/functions/filter.rb

@@ -43,6 +43,7 @@ as an array in the form `[key, value]` and returns a hash containing the results
 $data = { "orange" => 0, "blueberry" => 1, "raspberry" => 2 }
 $filtered_data = $data.filter |$items| { $items[0] =~ /berry$/ }
 # $filtered_data = {blueberry => 1, raspberry => 2}
+~~~
 
 When the first argument is an array and the lambda has two parameters, Puppet passes the
 array's indexes (enumerated from 0) in the first parameter and its values in the second

data/lib/puppet/parser/resource.rb

@@ -338,10 +338,11 @@ class Puppet::Parser::Resource < Puppet::Resource
   end
 
   def replace_sensitive_data
-    parameters.each_pair do |name, param|
+    parameters.keys.each do |name|
+      param = parameters[name]
       if param.value.is_a?(Puppet::Pops::Types::PSensitiveType::Sensitive)
         @sensitive_parameters << name
-        param.value = param.value.unwrap
+        parameters[name] = Puppet::Parser::Resource::Param.from_param(param, param.value.unwrap)
       end
     end
   end