puppet 6.16.0-x64-mingw32 → 6.20.0-x64-mingw32

data/lib/puppet/type/file/checksum.rb

@@ -9,7 +9,7 @@ Puppet::Type.type(:file).newparam(:checksum) do
 
     The default checksum type is md5."
 
-  newvalues "md5", "md5lite", "sha224", "sha256", "sha256lite", "sha384", "sha512", "mtime", "ctime", "none"
+  newvalues(*Puppet::Util::Checksums.known_checksum_types)
 
   defaultto do
     Puppet[:digest_algorithm].to_sym
@@ -23,18 +23,18 @@ Puppet::Type.type(:file).newparam(:checksum) do
 
   def sum(content)
     content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
-    type = digest_algorithm()
+    type = digest_algorithm
     "{#{type}}" + send(type, content)
   end
 
   def sum_file(path)
-    type = digest_algorithm()
+    type = digest_algorithm
     method = type.to_s + "_file"
     "{#{type}}" + send(method, path).to_s
   end
 
   def sum_stream(&block)
-    type = digest_algorithm()
+    type = digest_algorithm
     method = type.to_s + "_stream"
     checksum = send(method, &block)
     "{#{type}}#{checksum}"

data/lib/puppet/type/file/source.rb

@@ -23,7 +23,7 @@ module Puppet
       * Fully qualified paths to locally available files (including files on NFS
       shares or Windows mapped drives).
       * `file:` URIs, which behave the same as local file paths.
-      * `http:` URIs, which point to files served by common web servers.
+      * `http(s):` URIs, which point to files served by common web servers.
 
       The normal form of a `puppet:` URI is:
 
@@ -44,11 +44,26 @@ module Puppet
       because HTTP servers do not transfer any metadata that translates to
       ownership or permission details.
 
-      The `http` source uses the server `Content-MD5` header as a checksum to
-      determine if the remote file has changed. If the server response does not
-      include that header, Puppet defaults to using the `Last-Modified` header.
-      Puppet will update the local file if the header is newer than the modified
-      time (mtime) of the local file.
+      Puppet determines if file content is synchronized by computing a checksum
+      for the local file and comparing it against the `checksum_value`
+      parameter. If the `checksum_value` parameter is not specified for
+      `puppet` and `file` sources, Puppet computes a checksum based on its
+      `Puppet[:digest_algorithm]`. For `http(s)` sources, Puppet uses the
+      first HTTP header it recognizes out of the following list:
+      `X-Checksum-Sha256`, `X-Checksum-Sha1`, `X-Checksum-Md5` or `Content-MD5`.
+      If the server response does not include one of these headers, Puppet
+      defaults to using the `Last-Modified` header. Puppet updates the local
+      file if the header is newer than the modified time (mtime) of the local
+      file.
+
+      _HTTP_ URIs can include a user information component so that Puppet can
+      retrieve file metadata and content from HTTP servers that require HTTP Basic
+      authentication. For example `https://<user>:<pass>@<server>:<port>/path/to/file.`
+
+      When connecting to _HTTPS_ servers, Puppet trusts CA certificates in the
+      puppet-agent certificate bundle and the Puppet CA. You can configure Puppet
+      to trust additional CA certificates using the `Puppet[:ssl_trust_store]`
+      setting.
 
       Multiple `source` values can be specified as an array, and Puppet will
       use the first source that exists. This can be used to serve different
@@ -98,8 +113,8 @@ module Puppet
           # Ruby 1.9.3 and earlier have a URI bug in URI
           # to_s returns an ASCII string despite UTF-8 fragments
           # since its escaped its safe to universally call encode
-          # URI.unescape always returns strings in the original encoding
-          URI.unescape(uri_string.encode(Encoding::UTF_8))
+          # Puppet::Util.uri_unescape always returns strings in the original encoding
+          Puppet::Util.uri_unescape(uri_string.encode(Encoding::UTF_8))
         else
           source
         end
@@ -210,7 +225,7 @@ module Puppet
     end
 
     def port
-      (uri and uri.port) or Puppet.settings[:masterport]
+      (uri and uri.port) or Puppet.settings[:serverport]
     end
 
     def uri
@@ -278,7 +293,7 @@ module Puppet
       api = session.route_to(:fileserver, url: url)
 
       api.get_static_file_content(
-        path: URI.unescape(url.path),
+        path: Puppet::Util.uri_unescape(url.path),
         environment: resource.catalog.environment_instance.to_s,
         code_id: resource.catalog.code_id,
         &block
@@ -290,7 +305,7 @@ module Puppet
       api = session.route_to(:fileserver, url: url)
 
       api.get_file_content(
-        path: URI.unescape(url.path),
+        path: Puppet::Util.uri_unescape(url.path),
         environment: resource.catalog.environment_instance.to_s,
         &block
       )
@@ -307,7 +322,12 @@ module Puppet
 
     def chunk_file_from_source(&block)
       if uri.scheme =~ /^https?/
-        get_from_http_source(uri, &block)
+        # Historically puppet has not encoded the http(s) source URL before parsing
+        # it, for example, if the path contains spaces, then it must be URL encoded
+        # as %20 in the manifest. Puppet behaves the same when retrieving file
+        # metadata via http(s), see Puppet::Indirector::FileMetadata::Http#find.
+        url = URI.parse(metadata.source)
+        get_from_http_source(url, &block)
       elsif metadata.content_uri
         content_url = URI.parse(Puppet::Util.uri_encode(metadata.content_uri))
         get_from_content_uri_source(content_url, &block)

data/lib/puppet/type/filebucket.rb

@@ -57,7 +57,7 @@ module Puppet
         This setting is _only_ consulted if the `path` attribute is set to `false`.
 
         If this attribute is not specified, the first entry in the `server_list`
-        configuration setting is used, followed by the value of the `masterport`
+        configuration setting is used, followed by the value of the `serverport`
         setting if `server_list` is not set."
     end
 

data/lib/puppet/type/notify.rb

@@ -4,12 +4,12 @@
 
 module Puppet
   Type.newtype(:notify) do
-    @doc = "Sends an arbitrary message to the agent run-time log. It's important to note that the notify resource type is not idempotent. As a result, notifications are shown as a change on every Puppet run."
+    @doc = "Sends an arbitrary message, specified as a string, to the agent run-time log. It's important to note that the notify resource type is not idempotent. As a result, notifications are shown as a change on every Puppet run."
 
     apply_to_all
 
     newproperty(:message, :idempotent => false) do
-      desc "The message to be sent to the log."
+      desc "The message to be sent to the log. Note that the value specified must be a string."
       def sync
         message = @sensitive ? 'Sensitive [value redacted]' : self.should
         case @resource["withpath"]

data/lib/puppet/type/service.rb

@@ -47,6 +47,8 @@ module Puppet
 
     feature :configurable_timeout, "The provider can specify a minumum timeout for syncing service properties"
 
+    feature :manages_logon_credentials, "The provider can specify the logon credentials used for a service"
+
     newproperty(:enable, :required_features => :enableable) do
       desc "Whether a service should be enabled to start at boot.
         This property behaves differently depending on the platform;
@@ -116,6 +118,12 @@ module Puppet
       end
 
       def sync
+        property = @resource.property(:logonaccount)
+        if property
+          val = property.retrieve
+          property.sync unless property.safe_insync?(val)
+        end
+
         event = super()
 
         property = @resource.property(:enable)
@@ -128,6 +136,51 @@ module Puppet
       end
     end
 
+    newproperty(:logonaccount, :required_features => :manages_logon_credentials) do
+      desc "Specify an account for service logon"
+
+      munge do |value|
+        return value unless Puppet::Util::Platform.windows?
+        return 'LocalSystem' if Puppet::Util::Windows::User::localsystem?(value)
+
+        value.sub!(/^\.\\/, "#{Puppet::Util::Windows::ADSI.computer_name}\\")
+        user_information = Puppet::Util::Windows::SID.name_to_principal(value)
+        raise Puppet::Error.new("\"#{value}\" is not a valid account") unless user_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(user_information.account_type)
+
+        user_rights = Puppet::Util::Windows::User::get_rights(user_information.domain_account) unless Puppet::Util::Windows::User::default_system_account?(value)
+        raise Puppet::Error.new("\"#{user_information.domain_account}\" has the 'Log On As A Service' right set to denied.") if user_rights =~ /SeDenyServiceLogonRight/
+        raise Puppet::Error.new("\"#{user_information.domain_account}\" is missing the 'Log On As A Service' right.") unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/
+
+        if user_information.domain == Puppet::Util::Windows::ADSI.computer_name
+          ".\\#{user_information.account}"
+        else
+          user_information.domain_account
+        end
+      end
+    end
+
+    newparam(:logonpassword, :required_features => :manages_logon_credentials) do
+      desc "Specify a password for service logon. Default value is an empty string (when logonaccount is specified)."
+
+      validate do |value|
+        raise Puppet::Error.new(_"The 'logonaccount' parameter is mandatory when setting 'logonpassword'.") unless @resource[:logonaccount]
+        raise ArgumentError, _("Passwords cannot include ':'") if value.is_a?(String) and value.include?(":")
+        return unless Puppet::Util::Platform.windows?
+
+        is_a_predefined_local_account = Puppet::Util::Windows::User::default_system_account?(@resource[:logonaccount]) || @resource[:logonaccount] == 'LocalSystem'
+
+        account_info = @resource[:logonaccount].split("\\")
+        able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], value, account_info[0]) unless is_a_predefined_local_account
+
+        raise Puppet::Error.new("The given password is invalid for user '#{@resource[:logonaccount]}'.") unless is_a_predefined_local_account || able_to_logon
+
+        provider.logonpassword=(value)
+      end
+
+      sensitive true
+      defaultto { @resource[:logonaccount] ? "" : nil }
+    end
+
     newproperty(:flags, :required_features => :flaggable) do
       desc "Specify a string of flags to pass to the startup script."
     end

data/lib/puppet/type/user.rb

@@ -40,7 +40,10 @@ module Puppet
        implement PBKDF2 passwords with salt properties."
 
     feature :manages_solaris_rbac,
-      "The provider can manage roles and normal users"
+      "The provider can manage normal users"
+
+    feature :manages_roles,
+      "The provider can manage roles"
 
     feature :manages_expiry,
       "The provider can manage the expiry date for a user."
@@ -97,6 +100,18 @@ module Puppet
           return :absent
         end
       end
+
+      def sync
+        event = super
+
+        property = @resource.property(:roles)
+        if property
+          val = property.retrieve
+          property.sync unless property.safe_insync?(val)
+        end
+
+        event
+      end
     end
 
     newproperty(:home) do
@@ -493,7 +508,7 @@ module Puppet
       provider.exists?
     end
 
-    newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
+    newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_roles) do
       desc "The roles the user has.  Multiple roles should be
         specified as an array."
 
@@ -520,7 +535,7 @@ module Puppet
       end
 
       reqs
-    end
+    end unless Puppet::Util::Platform.windows?
 
     newparam(:role_membership) do
       desc "Whether specified roles should be considered the **complete list**

data/lib/puppet/util.rb

@@ -27,7 +27,7 @@ module Util
   extend Puppet::Util::SymbolicFileMode
 
   def default_env
-    Puppet::Util::Platform.windows? ?
+    Puppet.features.microsoft_windows? ?
       :windows :
       :posix
   end
@@ -296,6 +296,11 @@ module Util
   AbsolutePathWindows = %r!^(?:(?:[A-Z]:#{slash})|(?:#{slash}#{slash}#{label}#{slash}#{label})|(?:#{slash}#{slash}\?#{slash}#{label}))!io
   AbsolutePathPosix   = %r!^/!
   def absolute_path?(path, platform=nil)
+    unless path.is_a?(String)
+      Puppet.warning("Cannot check if #{path} is an absolute path because it is a '#{path.class}' and not a String'")
+      return false
+    end
+
     # Ruby only sets File::ALT_SEPARATOR on Windows and the Ruby standard
     # library uses that to test what platform it's on.  Normally in Puppet we
     # would use Puppet.features.microsoft_windows?, but this method needs to
@@ -356,7 +361,7 @@ module Util
 
     # CGI.unescape doesn't handle space rules properly in uri paths
     # URI.unescape does, but returns strings in their original encoding
-    path = URI.unescape(uri.path.encode(Encoding::UTF_8))
+    path = uri_unescape(uri.path.encode(Encoding::UTF_8))
 
     if Puppet::Util::Platform.windows? && uri.scheme == 'file'
       if uri.host && !uri.host.empty?
@@ -460,7 +465,18 @@ module Util
     # + should be left unencoded
     # URI::parse and URI::Generic.build don't like paths encoded with CGI.escape
     # URI.escape does not change / to %2F and : to %3A like CGI.escape
-    encoded += URI.escape(parts[:path]) unless parts[:path].nil?
+    #
+    # URI.escape is obsolete in Ruby 2.7. Ignore this error until we're able to
+    # switch to a different escape mechanism. If this is JRuby, we can't mask
+    # the error message, because this isn't thread safe. JRuby shouldn't be
+    # using Ruby 2.7 or raising the warning anyway.
+    orig_verbose = $VERBOSE
+    $VERBOSE = nil unless Puppet::Util::Platform.jruby?
+    begin
+      encoded += URI.escape(parts[:path]) unless parts[:path].nil?
+    ensure
+      $VERBOSE = orig_verbose unless Puppet::Util::Platform.jruby?
+    end
 
     # each query parameter
     if !parts[:query].nil?
@@ -479,6 +495,15 @@ module Util
   end
   module_function :uri_encode
 
+  def uri_unescape(path)
+    orig_verbose = $VERBOSE
+    $VERBOSE = nil unless Puppet::Util::Platform.jruby?
+    return URI.unescape(path)
+  ensure
+    $VERBOSE = orig_verbose unless Puppet::Util::Platform.jruby?
+  end
+  module_function :uri_unescape
+
   def safe_posix_fork(stdin=$stdin, stdout=$stdout, stderr=$stderr, &block)
     child_pid = Kernel.fork do
       STDIN.reopen(stdin)
@@ -734,6 +759,19 @@ module Util
     Random.new(seed).rand(max)
   end
   module_function :deterministic_rand_int
+
+  # Executes a block of code, wrapped around Facter.load_external(false) and
+  # Facter.load_external(true) which will cause Facter to not evaluate external facts.
+  def skip_external_facts
+    return yield unless Facter.respond_to? :load_external
+    begin
+      Facter.load_external(false)
+      yield
+    ensure
+      Facter.load_external(true)
+    end
+  end
+  module_function :skip_external_facts
 end
 end
 

data/lib/puppet/util/autoload.rb

@@ -10,6 +10,14 @@ require 'puppet/concurrent/synchronized'
 # @api private
 class Puppet::Util::ModuleDirectoriesAdapter < Puppet::Pops::Adaptable::Adapter
   attr_accessor :directories
+
+  def self.create_adapter(env)
+    adapter = super(env)
+    adapter.directories = env.modulepath.flat_map do |dir|
+      Dir.glob(File.join(dir, '*', 'lib'))
+    end
+    adapter
+  end
 end
 
 # Autoload paths, either based on names or all at once.
@@ -119,13 +127,7 @@ class Puppet::Util::Autoload
     def module_directories(env)
       raise ArgumentError, "Autoloader requires an environment" unless env
 
-      Puppet::Util::ModuleDirectoriesAdapter.adapt(env) do |a|
-        a.directories ||= env.modulepath.collect do |dir|
-          Dir.entries(dir).reject { |f| f =~ /^\./ }.collect { |f| File.join(dir, f, "lib") }
-        end.flatten.find_all do |d|
-          FileTest.directory?(d)
-        end
-      end.directories
+      Puppet::Util::ModuleDirectoriesAdapter.adapt(env).directories
     end
 
     # @api private
@@ -164,14 +166,7 @@ class Puppet::Util::Autoload
     # Normalize a path. This converts ALT_SEPARATOR to SEPARATOR on Windows
     # and eliminates unnecessary parts of a path.
     def cleanpath(path)
-      # There are two cases here because cleanpath does not handle absolute
-      # paths correctly on windows (c:\ and c:/ are treated as distinct) but
-      # we don't want to convert relative paths to absolute
-      if Puppet::Util.absolute_path?(path)
-        File.expand_path(path)
-      else
-        Pathname.new(path).cleanpath.to_s
-      end
+      Pathname.new(path).cleanpath.to_s
     end
   end
 

data/lib/puppet/util/character_encoding.rb

@@ -19,8 +19,9 @@ module Puppet::Util::CharacterEncoding
       begin
         if original_encoding == Encoding::UTF_8
           if !string_copy.valid_encoding?
-            Puppet.debug(_("%{value} is already labeled as UTF-8 but this encoding is invalid. It cannot be transcoded by Puppet.") %
-              { value: string.dump })
+            Puppet.debug {
+              _("%{value} is already labeled as UTF-8 but this encoding is invalid. It cannot be transcoded by Puppet.") % { value: string.dump }
+            }
           end
           # String is already valid UTF-8 - noop
           return string_copy
@@ -40,8 +41,9 @@ module Puppet::Util::CharacterEncoding
         # Catch both our own self-determined failure to transcode as well as any
         # error on ruby's part, ie Encoding::UndefinedConversionError on a
         # failure to encode!.
-        Puppet.debug(_("%{error}: %{value} cannot be transcoded by Puppet.") %
-          { error: detail.inspect, value: string.dump })
+        Puppet.debug {
+          _("%{error}: %{value} cannot be transcoded by Puppet.") % { error: detail.inspect, value: string.dump }
+        }
         return string_copy
       end
     end
@@ -67,7 +69,9 @@ module Puppet::Util::CharacterEncoding
       if string_copy.force_encoding(Encoding::UTF_8).valid_encoding?
         return string_copy
       else
-        Puppet.debug(_("%{value} is not valid UTF-8 and result of overriding encoding would be invalid.") % { value: string.dump })
+        Puppet.debug {
+          _("%{value} is not valid UTF-8 and result of overriding encoding would be invalid.") % { value: string.dump }
+        }
         # Set copy back to its original encoding before returning
         return string_copy.force_encoding(original_encoding)
       end

data/lib/puppet/util/checksums.rb

@@ -7,11 +7,26 @@ require 'time'
 module Puppet::Util::Checksums
   module_function
 
+  KNOWN_CHECKSUMS = [
+    :sha256, :sha256lite,
+    :md5, :md5lite,
+    :sha1, :sha1lite,
+    :sha512,
+    :sha384,
+    :sha224,
+    :mtime, :ctime, :none
+  ].freeze
+
   # It's not a good idea to use some of these in some contexts: for example, I
   # wouldn't try bucketing a file using the :none checksum type.
   def known_checksum_types
-    [:sha256, :sha256lite, :md5, :md5lite, :sha1, :sha1lite, :sha512, :sha384, :sha224, 
-      :mtime, :ctime, :none]
+    KNOWN_CHECKSUMS
+  end
+
+  def valid_checksum?(type, value)
+    !!send("#{type}?", value)
+  rescue NoMethodError
+    false
   end
 
   class FakeChecksum
@@ -223,7 +238,7 @@ module Puppet::Util::Checksums
 
   # Return the :mtime timestamp of a file.
   def mtime_file(filename)
-    Puppet::FileSystem.stat(filename).send(:mtime)
+    Puppet::FileSystem.stat(filename).mtime
   end
 
   # by definition this doesn't exist
@@ -293,7 +308,7 @@ module Puppet::Util::Checksums
 
   # Return the :ctime of a file.
   def ctime_file(filename)
-    Puppet::FileSystem.stat(filename).send(:ctime)
+    Puppet::FileSystem.stat(filename).ctime
   end
 
   def ctime_stream(&block)