puppet 6.15.0-universal-darwin → 6.19.1-universal-darwin

data/lib/puppet/provider/service/systemd.rb

@@ -30,7 +30,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def self.instances
     i = []
     output = systemctl('list-unit-files', '--type', 'service', '--full', '--all',  '--no-pager')
-    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad)\s*$/i).each do |m|
+    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad|static)\s*$/i).each do |m|
       Puppet.debug("#{m[0]} marked as bad by `systemctl`. It is recommended to be further checked.") if m[1] == "bad"
       i << new(:name => m[0])
     end
@@ -39,6 +39,22 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
     return []
   end
 
+  # Static services cannot be enabled or disabled manually. Indirect services 
+  # should not be enabled or disabled due to limitations in systemd (see 
+  # https://github.com/systemd/systemd/issues/6681).
+  def enabled_insync?(current)
+    case cached_enabled?[:output]
+    when 'static'
+      Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
+      return true
+    when 'indirect'
+      Puppet.debug("Service #{@resource[:name]} is in 'indirect' state and cannot be enabled/disabled")
+      return true
+    else
+      current == @resource[:enable]
+    end
+  end
+
   # This helper ensures that the enable state cache is always reset
   # after a systemctl enable operation. A particular service state is not guaranteed
   # after such an operation, so the cache must be emptied to prevent inconsistencies
@@ -70,12 +86,13 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def cached_enabled?
     return @cached_enabled if @cached_enabled
     cmd = [command(:systemctl), 'is-enabled', '--', @resource[:name]]
-    @cached_enabled = execute(cmd, :failonfail => false).strip
+    result = execute(cmd, :failonfail => false)
+    @cached_enabled = { output: result.chomp, exitcode: result.exitstatus }
   end
 
   def enabled?
-    output = cached_enabled?
-    code = $CHILD_STATUS.exitstatus
+    output = cached_enabled?[:output]
+    code = cached_enabled?[:exitcode]
 
     # The masked state is equivalent to the disabled state in terms of
     # comparison so we only care to check if it is masked if we want to keep

data/lib/puppet/provider/service/windows.rb

@@ -14,29 +14,28 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
   defaultfor :operatingsystem => :windows
   confine    :operatingsystem => :windows
 
-  has_feature :refreshable
-  has_feature :configurable_timeout
+  has_feature :refreshable, :configurable_timeout, :manages_logon_credentials
 
   def enable
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_AUTO_START )
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {startup_type: :SERVICE_AUTO_START})
   rescue => detail
     raise Puppet::Error.new(_("Cannot enable %{resource_name}, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
 
   def disable
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_DISABLED )
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {startup_type: :SERVICE_DISABLED})
   rescue => detail
     raise Puppet::Error.new(_("Cannot disable %{resource_name}, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
 
   def manual_start
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_DEMAND_START )
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {startup_type: :SERVICE_DEMAND_START})
   rescue => detail
     raise Puppet::Error.new(_("Cannot enable %{resource_name} for manual start, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
 
   def delayed_start
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_AUTO_START, true )
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {startup_type: :SERVICE_AUTO_START, delayed: true})
   rescue => detail
     raise Puppet::Error.new(_("Cannot enable %{resource_name} for delayed start, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
@@ -110,7 +109,10 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
         raise Puppet::Error.new(_("Unknown service state '%{current_state}' for service '%{resource_name}'") % { current_state: current_state, resource_name: @resource[:name] })
     end
     debug("Service #{@resource[:name]} is #{current_state}")
-    return state
+    state
+  rescue => detail
+    Puppet.warning("Status for service #{@resource[:name]} could not be retrieved: #{detail}")
+    :stopped
   end
 
   def default_timeout
@@ -125,4 +127,18 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
     end
     services
   end
+
+  def logonaccount
+    return unless Puppet::Util::Windows::Service.exists?(@resource[:name])
+    Puppet::Util::Windows::Service.logon_account(@resource[:name])
+  end
+
+  def logonaccount=(value)
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {logon_account: value, logon_password: @resource[:logonpassword]})
+    restart if @resource[:ensure] == :running && [:running, :paused].include?(status)
+  end
+
+  def logonpassword=(value)
+    Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {logon_password: value})
+  end
 end

data/lib/puppet/provider/user/aix.rb

@@ -288,7 +288,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   # UNSUPPORTED
   #- **roles**
   #    The roles the user has.  Multiple roles should be
-  #    specified as an array.  Requires features manages_solaris_rbac.
+  #    specified as an array.  Requires features manages_roles.
   # UNSUPPORTED
   #- **key_membership**
   #    Whether specified key value pairs should be treated as the only

data/lib/puppet/provider/user/user_role_add.rb

@@ -33,7 +33,7 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
     set("shell", value)
   end
 
-  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords, :manages_password_age, :manages_shell
+  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_roles, :manages_passwords, :manages_password_age, :manages_shell
 
   def check_valid_shell
     unless File.exist?(@resource.should(:shell))

data/lib/puppet/provider/user/useradd.rb

@@ -21,7 +21,11 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
   options :expiry, :method => :sp_expire,
     :munge => proc { |value|
       if value == :absent
-        ''
+        if Facter.value(:operatingsystem)=='SLES' && Facter.value(:operatingsystemmajrelease) == "11"
+          -1
+        else
+          ''
+        end
       else
         case Facter.value(:operatingsystem)
         when 'Solaris'
@@ -134,10 +138,17 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
 
   def check_manage_home
     cmd = []
-    if @resource.managehome? && (!@resource.forcelocal?)
-      cmd << "-m"
-    elsif (!@resource.managehome?) && Facter.value(:osfamily) == 'RedHat'
-      cmd << "-M"
+    if @resource.managehome?
+      # libuser does not implement the -m flag
+      cmd << "-m" unless @resource.forcelocal?
+    else
+      osfamily = Facter.value(:osfamily)
+      osversion = Facter.value(:operatingsystemmajrelease).to_i
+      # SLES 11 uses pwdutils instead of shadow, which does not have -M
+      # Solaris and OpenBSD use different useradd flavors
+      unless osfamily =~ /Solaris|OpenBSD/ || osfamily == 'Suse' && osversion <= 11
+        cmd << "-M"
+      end
     end
     cmd
   end

data/lib/puppet/provider/user/windows_adsi.rb

@@ -6,7 +6,7 @@ Puppet::Type.type(:user).provide :windows_adsi do
   defaultfor :operatingsystem => :windows
   confine    :operatingsystem => :windows
 
-  has_features :manages_homedir, :manages_passwords
+  has_features :manages_homedir, :manages_passwords, :manages_roles
 
   def initialize(value={})
     super(value)
@@ -17,6 +17,23 @@ Puppet::Type.type(:user).provide :windows_adsi do
     @user ||= Puppet::Util::Windows::ADSI::User.new(@resource[:name])
   end
 
+  def roles
+    Puppet::Util::Windows::User::get_rights(@resource[:name])
+  end
+
+  def roles=(value)
+    current = roles.split(',')
+    should  = value.split(',')
+
+    add_list = should - current
+    Puppet::Util::Windows::User::set_rights(@resource[:name], add_list) unless add_list.empty?
+
+    if @resource[:role_membership] == :inclusive
+      remove_list = current - should
+      Puppet::Util::Windows::User::remove_rights(@resource[:name], remove_list) unless remove_list.empty?
+    end
+  end
+
   def groups
     @groups ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(user.groups)
     @groups.keys

data/lib/puppet/reports/http.rb

@@ -25,12 +25,16 @@ Puppet::Reports.register_report(:http) do
       :include_system_store => Puppet[:report_include_system_store],
     }
 
+    # Puppet's http client implementation accepts userinfo in the URL
+    # but puppetserver's does not. So pass credentials explicitly.
     if url.user && url.password
-      options[:user] = url.user
-      options[:password] = url.password
+      options[:basic_auth] = {
+        user: url.user,
+        password: url.password
+      }
     end
 
-    client = Puppet.runtime['http']
+    client = Puppet.runtime[:http]
     client.post(url, self.to_yaml, headers: headers, options: options) do |response|
       unless response.success?
         Puppet.err _("Unable to submit report to %{url} [%{code}] %{message}") % { url: Puppet[:reporturl].to_s, code: response.code, message: response.reason }

data/lib/puppet/resource.rb

@@ -628,7 +628,8 @@ class Puppet::Resource
   def self.extract_type_and_title(argtype, argtitle)
     if (argtype.nil? || argtype == :component || argtype == :whit) &&
           argtitle =~ /^([^\[\]]+)\[(.+)\]$/m                  then [ $1,                 $2            ]
-    elsif argtitle.nil? && argtype =~ /^([^\[\]]+)\[(.+)\]$/m  then [ $1,                 $2            ]
+    elsif argtitle.nil? && argtype.is_a?(String) &&
+          argtype =~ /^([^\[\]]+)\[(.+)\]$/m                   then [ $1,                 $2            ]
     elsif argtitle                                             then [ argtype,            argtitle      ]
     elsif argtype.is_a?(Puppet::Type)                          then [ argtype.class.name, argtype.title ]
     else  raise ArgumentError, _("No title provided and %{type} is not a valid resource reference") % { type: argtype.inspect }

data/lib/puppet/resource/type.rb

@@ -11,6 +11,7 @@ class Puppet::Resource::Type
   include Puppet::Util::Warnings
   include Puppet::Util::Errors
 
+  # @deprecated application orchestration will be removed in puppet 7 (capability_mapping, application, site)
   RESOURCE_KINDS = [:hostclass, :node, :definition, :capability_mapping, :application, :site]
 
   # Map the names used in our documentation to the names used internally
@@ -33,7 +34,7 @@ class Puppet::Resource::Type
   DOUBLE_COLON = '::'.freeze
   EMPTY_ARRAY = [].freeze
 
-  attr_accessor :file, :line, :doc, :code, :parent, :resource_type_collection
+  attr_accessor :file, :line, :doc, :code, :parent, :resource_type_collection, :override
   attr_reader :namespace, :arguments, :behaves_like, :module_name
 
   # The attributes 'produces' and 'consumes' are arrays of the blueprints
@@ -62,6 +63,7 @@ class Puppet::Resource::Type
   # Are we a child of the passed class?  Do a recursive search up our
   # parentage tree to figure it out.
   def child_of?(klass)
+    return true if override
     return false unless parent
 
     return(klass == parent_type ? true : parent_type.child_of?(klass))
@@ -69,6 +71,8 @@ class Puppet::Resource::Type
 
   # Evaluate the resources produced by the given resource. These resources are
   # evaluated in a separate but identical scope from the rest of the resource.
+  #
+  # @deprecated application orchestration will be removed in puppet 7
   def evaluate_produces(resource, scope)
     # Only defined types and classes can produce capabilities
     return unless definition? || hostclass?
@@ -161,19 +165,23 @@ class Puppet::Resource::Type
     @module_name = options[:module_name]
   end
 
+  # @deprecated application orchestration will be removed in puppet 7
   def produces
     @produces || EMPTY_ARRAY
   end
 
+  # @deprecated application orchestration will be removed in puppet 7
   def consumes
     @consumes || EMPTY_ARRAY
   end
 
+  # @deprecated application orchestration will be removed in puppet 7
   def add_produces(blueprint)
     @produces ||= []
     @produces << blueprint
   end
 
+  # @deprecated application orchestration will be removed in puppet 7
   def add_consumes(blueprint)
     @consumes ||= []
     @consumes << blueprint
@@ -235,6 +243,7 @@ class Puppet::Resource::Type
     when :node
       :node
     when :site
+      # @deprecated application orchestration will be removed in puppet 7
       :site
     end
 

data/lib/puppet/rest/route.rb

@@ -14,11 +14,11 @@ module Puppet::Rest
     #                 construction
     # @param [Symbol] server_setting the setting to check for special
     #                 server configuration
-    # @param [Symbol] port_setting the setting to check for speical
+    # @param [Symbol] port_setting the setting to check for special
     #                  port configuration
     # @param [Symbol] srv_service the name of the service when using SRV
     #                 records
-    def initialize(api:, server_setting: :server, port_setting: :masterport, srv_service: :puppet)
+    def initialize(api:, server_setting: :server, port_setting: :serverport, srv_service: :puppet)
       @api = api
       @default_server = Puppet::Util::Connection.determine_server(server_setting)
       @default_port = Puppet::Util::Connection.determine_port(port_setting, server_setting)

data/lib/puppet/runtime.rb

@@ -1,16 +1,32 @@
 require 'puppet/http'
 require 'singleton'
 
+# Provides access to runtime implementations.
+#
+# @api private
 class Puppet::Runtime
   include Singleton
 
   def initialize
     @runtime_services = {
-      'http' => proc { Puppet::HTTP::Client.new }
+      http: proc do
+        klass = Puppet::Network::HttpPool.http_client_class
+        if klass == Puppet::Network::HTTP::Connection ||
+           klass == Puppet::Network::HTTP::ConnectionAdapter
+          Puppet::HTTP::Client.new
+        else
+          Puppet::HTTP::ExternalClient.new(klass)
+        end
+      end
     }
   end
   private :initialize
 
+  # Get a runtime implementation.
+  #
+  # @param name [Symbol] the name of the implementation
+  # @return [Object] the runtime implementation
+  # @api private
   def [](name)
     service = @runtime_services[name]
     raise ArgumentError, "Unknown service #{name}" unless service
@@ -22,11 +38,18 @@ class Puppet::Runtime
     end
   end
 
+  # Register a runtime implementation.
+  #
+  # @param name [Symbol] the name of the implementation
+  # @param impl [Object] the runtime implementation
+  # @api private
   def []=(name, impl)
     @runtime_services[name] = impl
   end
 
-  # for testing
+  # Clears all implementations. This is used for testing.
+  #
+  # @api private
   def clear
     initialize
   end

data/lib/puppet/settings.rb

@@ -44,7 +44,7 @@ class Puppet::Settings
   REQUIRED_APP_SETTINGS = [:logdir, :confdir, :vardir, :codedir]
 
   # The acceptable sections of the puppet.conf configuration file.
-  ALLOWED_SECTION_NAMES = ['main', 'master', 'agent', 'user'].freeze
+  ALLOWED_SECTION_NAMES = ['main', 'server', 'master', 'agent', 'user'].freeze
 
   NONE = 'none'.freeze
 
@@ -330,7 +330,7 @@ class Puppet::Settings
     end
 
     option_parser.on('--run_mode',
-                     "The effective 'run mode' of the application: master, agent, or user.",
+                     "The effective 'run mode' of the application: server, agent, or user.",
                      :REQUIRED) do |arg|
       Puppet.settings.preferred_run_mode = arg
     end
@@ -385,6 +385,19 @@ class Puppet::Settings
     call_hooks_deferred_to_application_initialization
     issue_deprecations
 
+    run_mode = Puppet::Util::RunMode[self.preferred_run_mode]
+    if run_mode.agent? || run_mode.server?
+      if self.set_in_section?(:masterport, run_mode.name) && !self.set_in_section?(:serverport, run_mode.name)
+        self[:serverport] = self[:masterport]
+      elsif self.set_by_config?(:masterport) && !self.set_by_config?(:serverport)
+        self[:serverport] = self[:masterport]
+      elsif self.set_in_section?(:serverport, run_mode.name) && !self.set_in_section?(:masterport, run_mode.name)
+        self[:masterport] = self[:serverport]
+      elsif self.set_by_config?(:serverport) && !self.set_by_config?(:masterport)
+        self[:masterport] = self[:serverport]
+      end
+    end
+
     REQUIRED_APP_SETTINGS.each do |key|
       create_ancestors(Puppet[key])
     end
@@ -564,7 +577,7 @@ class Puppet::Settings
   # @api private
   def preferred_run_mode=(mode)
     mode = mode.to_s.downcase.intern
-    raise ValidationError, "Invalid run mode '#{mode}'" unless [:master, :agent, :user].include?(mode)
+    raise ValidationError, "Invalid run mode '#{mode}'" unless [:server, :master, :agent, :user].include?(mode)
     @preferred_run_mode_name = mode
     # Changing the run mode has far-reaching consequences. Flush any cached
     # settings so they will be re-generated.
@@ -659,7 +672,7 @@ class Puppet::Settings
     if explicit_config_file?
       return self[:config]
     else
-      return File.join(Puppet::Util::RunMode[:master].conf_dir, config_file_name)
+      return File.join(Puppet::Util::RunMode[:server].conf_dir, config_file_name)
     end
   end
   private :main_config_file
@@ -829,7 +842,16 @@ class Puppet::Settings
       SearchPathElement.new(:cli, :values),
     ]
     searchpath << SearchPathElement.new(environment.intern, :environment) if environment
-    searchpath << SearchPathElement.new(run_mode, :section) if run_mode
+
+    if run_mode
+      if [:master, :server].include?(run_mode)
+        searchpath << SearchPathElement.new(:server, :section)
+        searchpath << SearchPathElement.new(:master, :section)
+      else
+        searchpath << SearchPathElement.new(run_mode, :section)
+      end
+    end
+
     searchpath << SearchPathElement.new(:main, :section)
   end
 
@@ -907,6 +929,16 @@ class Puppet::Settings
     end
   end
 
+  # Allow later inspection to determine if the setting was set by user
+  # config, rather than a default setting.
+  def set_in_section?(param, section)
+    param = param.to_sym
+    vals = searchpath_values(SearchPathElement.new(section, :section))
+    if vals
+      vals.lookup(param)
+    end
+  end
+
   # Patches the value for a param in a section.
   # This method is required to support the use case of unifying --dns-alt-names and
   # --dns_alt_names in the certificate face. Ideally this should be cleaned up.
@@ -1053,12 +1085,17 @@ Generated on #{Time.now}.
   # Create the necessary objects to use a section.  This is idempotent;
   # you can 'use' a section as many times as you want.
   def use(*sections)
+    Puppet.warning(":master section deprecated in favor of :server section") if sections.include?(:master)
+
+    # add :server if sections include :master or :master if sections include :server
+    sections |= [:master, :server] if (sections & [:master, :server]).any?
+
     sections = sections.collect { |s| s.to_sym }
     sections = sections.reject { |s| @used.include?(s) }
 
     return if sections.empty?
 
-    Puppet.debug("Applying settings catalog for sections #{sections.join(', ')}")
+    Puppet.debug { "Applying settings catalog for sections #{sections.join(', ')}" }
 
     begin
       catalog = to_catalog(*sections).to_ral