puppet 6.16.0 → 7.0.0

data/lib/puppet/provider/package/aptitude.rb

@@ -16,7 +16,7 @@ Puppet::Type.type(:package).provide :aptitude, :parent => :apt, :source => :dpkg
     output = aptitude(*args)
 
     # Yay, stupid aptitude doesn't throw an error when the package is missing.
-    if args.include?(:install) and output =~ /Couldn't find any package/
+    if args.include?(:install) and output.to_s =~ /Couldn't find any package/
       raise Puppet::Error.new(
         _("Could not find package %{name}") % { name: self.name }
       )

data/lib/puppet/provider/package/dpkg.rb

@@ -74,7 +74,7 @@ Puppet::Type.type(:package).provide :dpkg, :parent => Puppet::Provider::Package
       elsif ['config-files', 'half-installed', 'unpacked', 'half-configured'].include?(hash[:status])
         hash[:ensure] = :absent
       end
-      hash[:mark] = :hold if hash[:desired] == 'hold'
+      hash[:mark] = hash[:desired] == 'hold' ? :hold : :none
     else
       Puppet.debug("Failed to match dpkg-query line #{line.inspect}")
     end
@@ -173,13 +173,6 @@ Puppet::Type.type(:package).provide :dpkg, :parent => Puppet::Provider::Package
     dpkg "--purge", @resource[:name]
   end
 
-  def deprecated_hold
-    if package_not_installed?
-      self.install
-    end
-    hold
-  end
-
   def hold
     Tempfile.open('puppet_dpkg_set_selection') do |tmpfile|
       tmpfile.write("#{@resource[:name]} hold\n")
@@ -196,7 +189,4 @@ Puppet::Type.type(:package).provide :dpkg, :parent => Puppet::Provider::Package
     end
   end
 
-  def package_not_installed?
-    query[:status] != "installed"
-  end
 end

data/lib/puppet/provider/package/gem.rb

@@ -14,7 +14,7 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
 
     This provider supports the `install_options` and `uninstall_options` attributes,
     which allow command-line flags to be passed to the gem command.
-    These options should be specified as an array where each element is either a 
+    These options should be specified as an array where each element is either a
     string or a hash."
 
   has_feature :versionable, :install_options, :uninstall_options, :targetable, :version_ranges
@@ -36,7 +36,11 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
   # Required by Puppet::Provider::Package::Targetable::resource_or_provider_command
 
   def self.provider_command
-    command(:gemcmd)
+    if Puppet::Util::Platform.windows?
+      Puppet::Util.withenv(PATH: windows_path_without_puppet_bin) { command(:gemcmd) }
+    else
+      command(:gemcmd)
+    end
   end
 
   # Define the default provider package command as optional when the provider is targetable.
@@ -46,6 +50,18 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
     is_optional
   end
 
+  # Having puppet/bin in PATH makes gem provider to use puppet/bin/gem
+  # This is an utility methods that reads the PATH and returns a string
+  # that contains the content of PATH but without puppet/bin dir.
+  # This is used to pass a custom PATH and execute commands in a controlled environment
+  def self.windows_path_without_puppet_bin
+    @path ||= Puppet::Util.get_env('PATH').split(File::PATH_SEPARATOR)
+                                          .reject { |dir| dir =~ /puppet\\bin$/ }
+                                          .join(File::PATH_SEPARATOR)
+  end
+
+  private_class_method :windows_path_without_puppet_bin
+
   # CommandDefiner in provider.rb creates convenience execution methods that set failonfail, combine, and optionally, environment.
   # And when a child provider defines its own command via commands() or has_command(), the provider-specific path is always returned by command().
   # But when the convenience execution method is invoked, the last convenience method to be defined is executed.
@@ -53,11 +69,17 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
   #
   # In this case, causing the puppet_gem provider to inherit the parent gem provider's convenience gemcmd() methods, with the wrong path.
 
-  def self.execute_gem_command(command, command_options)
+  def self.execute_gem_command(command, command_options, custom_environment = {})
     validate_command(command)
     cmd = [command] << command_options
 
-    execute(cmd, {:failonfail => true, :combine => true, :custom_environment => {"HOME"=>ENV["HOME"]}})
+    custom_environment = {'HOME'=>Puppet::Util.get_env('HOME')}.merge(custom_environment)
+
+    if Puppet::Util::Platform.windows?
+      custom_environment[:PATH] = windows_path_without_puppet_bin
+    end
+
+    execute(cmd, {:failonfail => true, :combine => true, :custom_environment => custom_environment})
   end
 
   def self.instances(target_command = nil)
@@ -150,7 +172,7 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
         end
       end
     end
-    
+
     begin
       # Range intersections are not supported by Gem::Requirement, so just split by comma.
       dependency = Gem::Dependency.new('', should.split(','))

data/lib/puppet/provider/package/pip.rb

@@ -4,7 +4,6 @@
 require 'puppet/util/package/version/pip'
 require 'puppet/util/package/version/range'
 require 'puppet/provider/package_targetable'
-require 'puppet/util/http_proxy'
 
 Puppet::Type.type(:package).provide :pip, :parent => ::Puppet::Provider::Package::Targetable do
 

data/lib/puppet/provider/package/pip2.rb

@@ -0,0 +1,17 @@
+# Puppet package provider for Python's `pip2` package management frontend.
+# <http://pip.pypa.io/>
+
+Puppet::Type.type(:package).provide :pip2,
+  :parent => :pip do
+
+  desc "Python packages via `pip2`.
+
+  This provider supports the `install_options` attribute, which allows command-line flags to be passed to pip2.
+  These options should be specified as an array where each element is either a string or a hash."
+
+  has_feature :installable, :uninstallable, :upgradeable, :versionable, :install_options, :targetable
+
+  def self.cmd
+    ["pip2"]
+  end
+end

data/lib/puppet/provider/package/pkg.rb

@@ -114,10 +114,6 @@ Puppet::Type.type(:package).provide :pkg, :parent => Puppet::Provider::Package d
     end).merge({:provider => self.name})
   end
 
-  def deprecated_hold
-    hold
-  end
-
   def hold
     pkg(:freeze, @resource[:name])
   end

data/lib/puppet/provider/package/portage.rb

@@ -112,7 +112,7 @@ Puppet::Type.type(:package).provide :portage, :parent => Puppet::Provider::Packa
       # do the search
       should = @resource[:ensure]
       case should
-      # The terms present, absent, purged, held, installed, latest in :ensure 
+      # The terms present, absent, purged, installed, latest in :ensure
       # resolve as Symbols, and we do not need specific package version in this case
       when true, false, Symbol
         search = @resource[:name]

data/lib/puppet/provider/package/puppet_gem.rb

@@ -5,10 +5,7 @@ Puppet::Type.type(:package).provide :puppet_gem, :parent => :gem do
   has_feature :versionable, :install_options, :uninstall_options
 
   if Puppet::Util::Platform.windows?
-    # On windows, we put our ruby ahead of anything that already
-    # existed on the system PATH. This means that we do not need to
-    # sort out the absolute path.
-    commands :gemcmd => "gem"
+    commands :gemcmd => File.join(Puppet::Util.get_env('PUPPET_DIR').to_s, 'bin', 'gem.bat')
   else
     commands :gemcmd => "/opt/puppetlabs/puppet/bin/gem"
   end
@@ -18,4 +15,9 @@ Puppet::Type.type(:package).provide :puppet_gem, :parent => :gem do
     Puppet.debug("Invalidating rubygems cache after uninstalling gem '#{resource[:name]}'")
     Puppet::Util::Autoload.gem_source.clear_paths
   end
+
+  def self.execute_gem_command(command, command_options, custom_environment = {})
+    custom_environment['PKG_CONFIG_PATH'] = '/opt/puppetlabs/puppet/lib/pkgconfig' unless Puppet::Util::Platform.windows?
+    super(command, command_options, custom_environment)
+  end
 end

data/lib/puppet/provider/package/puppetserver_gem.rb

@@ -0,0 +1,180 @@
+unless Puppet::Util::Platform.jruby_fips?
+  require 'rubygems/commands/list_command'
+end
+require 'stringio'
+require 'uri'
+
+# Ruby gems support.
+Puppet::Type.type(:package).provide :puppetserver_gem, :parent => :gem do
+  desc "Puppet Server Ruby Gem support. If a URL is passed via `source`, then
+    that URL is appended to the list of remote gem repositories which by default
+    contains rubygems.org; To ensure that only the specified source is used also
+    pass `--clear-sources` in via `install_options`; if a source is present but
+    is not a valid URL, it will be interpreted as the path to a local gem file.
+    If source is not present at all, the gem will be installed from the default
+    gem repositories."
+
+  has_feature :versionable, :install_options, :uninstall_options
+
+  confine :feature => :hocon
+  # see SERVER-2578
+  confine :fips_enabled => false
+
+  # Define the default provider package command name, as the parent 'gem' provider is targetable.
+  # Required by Puppet::Provider::Package::Targetable::resource_or_provider_command
+
+  def self.provider_command
+    command(:puppetservercmd)
+  end
+
+  # The gem command uses HOME to locate a gemrc file.
+  # CommandDefiner in provider.rb will set failonfail, combine, and environment.
+
+  has_command(:puppetservercmd, '/opt/puppetlabs/bin/puppetserver') do
+    environment(HOME: ENV['HOME'])
+  end
+
+  def self.gemlist(options)
+    command_options = ['gem', 'list']
+
+    if options[:local]
+      command_options << '--local'
+    else
+      command_options << '--remote'
+    end
+
+    if options[:source]
+      command_options << '--source' << options[:source]
+    end
+
+    if options[:justme]
+      gem_regex = '\A' + options[:justme] + '\z'
+      command_options << gem_regex
+    end
+
+    if options[:local]
+      list = execute_rubygems_list_command(gem_regex)
+    else
+      begin
+        list = puppetservercmd(command_options)
+      rescue Puppet::ExecutionFailure => detail
+        raise Puppet::Error, _("Could not list gems: %{detail}") % { detail: detail }, detail.backtrace
+      end
+    end
+
+    # When `/tmp` is mounted `noexec`, `puppetserver gem list` will output:
+    # *** LOCAL GEMS ***
+    # causing gemsplit to output:
+    # Warning: Could not match *** LOCAL GEMS ***
+    gem_list = list
+                 .lines
+                 .select { |x| x =~ /^(\S+)\s+\((.+)\)/ }
+                 .map { |set| gemsplit(set) }
+
+    if options[:justme]
+      return gem_list.shift
+    else
+      return gem_list
+    end
+  end
+
+  def install(useversion = true)
+    command_options = ['gem', 'install']
+    command_options += install_options if resource[:install_options]
+
+    command_options << '-v' << resource[:ensure] if (!resource[:ensure].is_a? Symbol) && useversion
+
+    command_options << '--no-document'
+
+    if resource[:source]
+      begin
+        uri = URI.parse(resource[:source])
+      rescue => detail
+        self.fail Puppet::Error, _("Invalid source '%{uri}': %{detail}") % { uri: uri, detail: detail }, detail
+      end
+
+      case uri.scheme
+      when nil
+        # no URI scheme => interpret the source as a local file
+        command_options << resource[:source]
+      when /file/i
+        command_options << uri.path
+      when 'puppet'
+        # we don't support puppet:// URLs (yet)
+        raise Puppet::Error.new(_('puppet:// URLs are not supported as gem sources'))
+      else
+        # interpret it as a gem repository
+        command_options << '--source' << "#{resource[:source]}" << resource[:name]
+      end
+    else
+      command_options << resource[:name]
+    end
+
+    output = puppetservercmd(command_options)
+    # Apparently, some gem versions don't exit non-0 on failure.
+    self.fail _("Could not install: %{output}") % { output: output.chomp } if output.include?('ERROR')
+  end
+
+  def uninstall
+    command_options = ['gem', 'uninstall']
+    command_options << '--executables' << '--all' << resource[:name]
+    command_options += uninstall_options if resource[:uninstall_options]
+
+    output = puppetservercmd(command_options)
+    # Apparently, some gem versions don't exit non-0 on failure.
+    self.fail _("Could not uninstall: %{output}") % { output: output.chomp } if output.include?('ERROR')
+  end
+
+  private
+
+  # The puppetserver gem cli command is very slow, since it starts a JVM.
+  #
+  # Instead, for the list subcommand (which is executed with every puppet run),
+  # use the rubygems library from puppet ruby: setting GEM_HOME and GEM_PATH
+  # to the default values, or the values in the puppetserver configuration file.
+  #
+  # The rubygems library cannot access java platform gems,
+  # for example: json (1.8.3 java)
+  # but java platform gems should not be managed by this (or any) provider.
+
+  def self.execute_rubygems_list_command(gem_regex)
+    puppetserver_default_gem_home            = '/opt/puppetlabs/server/data/puppetserver/jruby-gems'
+    puppetserver_default_vendored_jruby_gems = '/opt/puppetlabs/server/data/puppetserver/vendored-jruby-gems'
+    puppet_default_vendor_gems               = '/opt/puppetlabs/puppet/lib/ruby/vendor_gems'
+    puppetserver_default_gem_path = [puppetserver_default_gem_home, puppetserver_default_vendored_jruby_gems, puppet_default_vendor_gems].join(':')
+
+    pe_puppetserver_conf_file = '/etc/puppetlabs/puppetserver/conf.d/pe-puppet-server.conf'
+    os_puppetserver_conf_file = '/etc/puppetlabs/puppetserver/puppetserver.conf'
+    puppetserver_conf_file = Facter.value(:pe_server_version) ? pe_puppetserver_conf_file : os_puppetserver_conf_file
+    puppetserver_conf = Hocon.load(puppetserver_conf_file)
+
+    gem_env = {}
+    if puppetserver_conf.empty? || puppetserver_conf.key?('jruby-puppet') == false
+      gem_env['GEM_HOME'] = puppetserver_default_gem_home
+      gem_env['GEM_PATH'] = puppetserver_default_gem_path
+    else
+      gem_env['GEM_HOME'] = puppetserver_conf['jruby-puppet'].key?('gem-home') ? puppetserver_conf['jruby-puppet']['gem-home'] : puppetserver_default_gem_home
+      gem_env['GEM_PATH'] = puppetserver_conf['jruby-puppet'].key?('gem-path') ? puppetserver_conf['jruby-puppet']['gem-path'].join(':') : puppetserver_default_gem_path
+    end
+    gem_env['GEM_SPEC_CACHE'] = "/tmp/#{$$}"
+    Gem.paths = gem_env
+
+    sio_inn = StringIO.new
+    sio_out = StringIO.new
+    sio_err = StringIO.new
+    stream_ui = Gem::StreamUI.new(sio_inn, sio_out, sio_err, false)
+    gem_list_cmd = Gem::Commands::ListCommand.new
+    gem_list_cmd.options[:domain] = :local
+    gem_list_cmd.options[:args] = [gem_regex] if gem_regex
+    gem_list_cmd.ui = stream_ui
+    gem_list_cmd.execute
+
+    # There is no method exclude default gems from the local gem list,
+    # for example: psych (default: 2.2.2)
+    # but default gems should not be managed by this (or any) provider.
+    gem_list = sio_out.string.lines.reject { |gem| gem =~ / \(default\: / }
+    gem_list.join("\n")
+  ensure
+    Gem.clear_paths
+  end
+end

data/lib/puppet/provider/package/yum.rb

@@ -302,7 +302,7 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
     command = [command(:cmd)] + no_debug + ["-e", error_level, "-y", install_options, operation, wanted].compact
     output = execute(command)
 
-    if output =~ /^No package #{wanted} available\.$/
+    if output.to_s =~ /^No package #{wanted} available\.$/
       raise Puppet::Error, _("Could not find package %{wanted}") % { wanted: wanted }
     end
 
@@ -328,6 +328,7 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
       return "#{upd[:epoch]}:#{upd[:version]}-#{upd[:release]}"
     else
       # Yum didn't find updates, pretend the current version is the latest
+      self.debug "Yum didn't find updates, current version (#{properties[:ensure]}) is the latest"
       version = properties[:ensure]
       raise Puppet::DevError, _("Tried to get latest on a missing package") if version == :absent || version == :purged
       return version

data/lib/puppet/provider/package/zypper.rb

@@ -187,6 +187,9 @@ Puppet::Type.type(:package).provide :zypper, :parent => :rpm, :source => :rpm do
     if should.is_a?(String)
       begin
         should_version = Puppet::Util::Package::Version::Range.parse(should, Puppet::Util::Package::Version::Rpm)
+        if should_version.is_a?(RPM_VERSION_RANGE::Eq)
+          return super
+        end
       rescue Puppet::Util::Package::Version::Range::ValidationFailure, Puppet::Util::Package::Version::Rpm::ValidationFailure
         Puppet.debug("Cannot parse #{should} as a RPM version range")
         return super

data/lib/puppet/provider/service/smf.rb

@@ -5,48 +5,100 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   desc <<-EOT
     Support for Sun's new Service Management Framework.
 
-    Starting a service is effectively equivalent to enabling it, so there is
-    only support for starting and stopping services, which also enables and
-    disables them, respectively.
+    When managing the enable property, this provider will try to preserve
+    the previous ensure state per the enableable semantics. On Solaris,
+    enabling a service starts it up while disabling a service stops it. Thus,
+    there's a chance for this provider to execute two operations when managing
+    the enable property. For example, if enable is set to true and the ensure
+    state is stopped, this provider will manage the service using two operations:
+    one to enable the service which will start it up, and another to stop the
+    service (without affecting its enabled status).
 
     By specifying `manifest => "/path/to/service.xml"`, the SMF manifest will
     be imported if it does not exist.
-
   EOT
 
   defaultfor :osfamily => :solaris
 
   confine :osfamily => :solaris
 
-  commands :adm => "/usr/sbin/svcadm", :svcs => "/usr/bin/svcs"
-  commands :svccfg => "/usr/sbin/svccfg"
+  commands :adm => "/usr/sbin/svcadm",
+           :svcs => "/usr/bin/svcs",
+           :svccfg => "/usr/sbin/svccfg"
 
   has_feature :refreshable
 
-  def setupservice
-      if resource[:manifest]
-        begin
-          svcs("-l", @resource[:name])
-        rescue Puppet::ExecutionFailure
-          Puppet.notice "Importing #{@resource[:manifest]} for #{@resource[:name]}"
-          svccfg :import, resource[:manifest]
-        end
-      end
+  def self.instances
+    service_instances = svcs("-H", "-o", "state,fmri" ).split("\n")
+
+    # Puppet does not manage services in the legacy_run state, so filter those out.
+    service_instances.reject! { |line| line =~ /^legacy_run/ }
+
+    service_instances.collect! do |line|
+      state, fmri = line.split(/\s+/)
+
+      status =  case state
+                when /online/; :running
+                when /maintenance/; :maintenance
+                when /degraded/; :degraded
+                else :stopped
+                end
+      new({:name => fmri, :ensure => status})
+    end
+
+    service_instances
+  end
+
+  def initialize(*args)
+    super(*args)
+
+    # This hash contains the properties we need to sync. in our flush method.
+    #
+    # TODO (PUP-9051): Should we use @property_hash here? It seems like
+    # @property_hash should be empty by default and is something we can
+    # control so I think so?
+    @properties_to_sync = {}
+  end
+
+  def service_exists?
+    self.service_fmri
+    true
+  rescue Puppet::ExecutionFailure
+    false
+  end
+
+  def setup_service
+    return unless @resource[:manifest]
+    return if self.service_exists?
+
+    Puppet.notice("Importing #{@resource[:manifest]} for #{@resource[:name]}")
+    svccfg(:import, @resource[:manifest])
   rescue Puppet::ExecutionFailure => detail
-      raise Puppet::Error.new( "Cannot config #{self.name} to enable it: #{detail}", detail )
+    raise Puppet::Error.new( "Cannot config #{@resource[:name]} to enable it: #{detail}", detail )
   end
 
-  def self.instances
-   svcs("-H", "-o", "state,fmri" ).split("\n").select{|l| l !~ /^legacy_run/ }.collect do |line|
-     state,fmri = line.split(/\s+/)
-     status =  case state
-               when /online/; :running
-               when /maintenance/; :maintenance
-               when /degraded/; :degraded
-               else :stopped
-               end
-     new({:name => fmri, :ensure => status})
-   end
+  # Returns the service's FMRI. We fail if multiple FMRIs correspond to
+  # @resource[:name].
+  #
+  # If the service does not exist or we fail to get any FMRIs from svcs,
+  # this method will raise a Puppet::ExecutionFailure
+  def service_fmri
+    return @fmri if @fmri
+
+    # `svcs -l` is better to use because we can detect service instances
+    # that have not yet been activated or enabled (i.e. it lets us detect
+    # services that svcadm has not yet touched). `svcs -H -o fmri` is a bit
+    # more limited.
+    lines = svcs("-l", @resource[:name]).chomp.lines.to_a
+    lines.select! { |line| line =~ /^fmri/ }
+    fmris = lines.map! { |line| line.split(' ')[-1].chomp }
+    unless fmris.length == 1
+      raise Puppet::Error.new(
+        "Failed to get #{@resource[:name]}'s FMRI: The pattern '#{@resource[:name]}' matches multiple FMRIs! These are the FMRIs it matches: #{fmris.join(', ')}"
+      )
+    end
+
+    @fmri = fmris.first
   end
 
   # Returns the service's FMRI. We fail if multiple FMRIs correspond to
@@ -96,51 +148,50 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   end
 
   def enable
-    self.start
+    @properties_to_sync[:enable] = true
   end
 
   def enabled?
-    case self.status
-    when :running
-      return :true
-    else
-      return :false
-    end
+    return :false unless service_exists?
+    _property, _type, value = svccfg("-s", self.service_fmri, "listprop", "general/enabled").split(' ')
+    value == 'true' ? :true : :false
   end
 
   def disable
-    self.stop
+    @properties_to_sync[:enable] = false
   end
 
   def restartcmd
     if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemrelease), '11.2') >= 0
-      [command(:adm), :restart, "-s", @resource[:name]]
+      [command(:adm), :restart, "-s", self.service_fmri]
     else
       # Synchronous restart only supported in Solaris 11.2 and above
-      [command(:adm), :restart, @resource[:name]]
+      [command(:adm), :restart, self.service_fmri]
     end
   end
 
-  def startcmd
-    self.setupservice
-    case self.status
-    when :maintenance, :degraded
-      [command(:adm), :clear, @resource[:name]]
-    else
-      [command(:adm), :enable, "-rs", @resource[:name]]
-    end
+  def service_states
+    # Gets the current and next state of the service. We have a next state because SMF
+    # manages services asynchronously. If there is no 'next' state, svcs will put a '-'
+    # to indicate as such.
+    current_state, next_state = svcs("-H", "-o", "state,nstate", self.service_fmri).chomp.split(' ')
+
+    {
+      :current => current_state,
+      :next => next_state == "-" ? nil : next_state
+    }
   end
 
   # Wait for the service to transition into the specified state before returning.
   # This is necessary due to the asynchronous nature of SMF services.
-  # desired_state should be online, offline, disabled, or uninitialized.
+  # desired_states should include only online, offline, disabled, or uninitialized.
   # See PUP-5474 for long-term solution to this issue.
-  def wait(*desired_state)
+  def wait(*desired_states)
     Timeout.timeout(60) do
       loop do
         states = self.service_states
-        break if desired_state.include?(states[0]) && states[1] == '-'
-        sleep(1)
+        break if desired_states.include?(states[:current]) && states[:next].nil?
+        Kernel.sleep(1)
       end
     end
   rescue Timeout::Error
@@ -148,15 +199,11 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   end
 
   def start
-    # Wait for the service to actually start before returning.
-    super
-    self.wait('online')
+    @properties_to_sync[:ensure] = :running
   end
 
   def stop
-    # Wait for the service to actually stop before returning.
-    super
-    self.wait('offline', 'disabled', 'uninitialized')
+    @properties_to_sync[:ensure] = :stopped
   end
 
   def restart
@@ -165,16 +212,8 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
     self.wait('online')
   end
 
-  # Determine the current and next states of a service.
-  def service_states
-    svcs("-H", "-o", "state,nstate", @resource[:name]).chomp.split
-  end
-
   def status
-    if @resource[:status]
-      super
-      return
-    end
+    return super if @resource[:status]
 
     begin
       if supports_incomplete_services?
@@ -185,10 +224,10 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
         end
       end
 
-      # get the current state and the next state, and if the next
-      # state is set (i.e. not "-") use it for state comparison
-      states = service_states
-      state = states[1] == "-" ? states[0] : states[1]
+      # Get the current state and the next state. If there is a next state,
+      # use that for the state comparison.
+      states = self.service_states
+      state = states[:next] || states[:current]
     rescue Puppet::ExecutionFailure
       # TODO (PUP-8957): Should this be set back to INFO ?
       debug "Could not get status on service #{self.name} #{$!}"
@@ -197,10 +236,8 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
 
     case state
     when "online"
-      #self.warning "matched running #{line.inspect}"
       return :running
     when "offline", "disabled", "uninitialized"
-      #self.warning "matched stopped #{line.inspect}"
       return :stopped
     when "maintenance"
       return :maintenance
@@ -213,11 +250,92 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
       raise Puppet::Error,
         "Unmanageable state '#{state}' on service #{self.name}"
     end
+  end
 
+  # Helper that encapsulates the clear + svcadm [enable|disable]
+  # logic in one place. Makes it easy to test things out and also
+  # cleans up flush's code.
+  def maybe_clear_service_then_svcadm(cur_state, subcmd, flags)
+    # If the cur_state is maint or degraded, then we need to clear the service
+    # before we enable or disable it.
+    adm('clear', self.service_fmri) if [:maintenance, :degraded].include?(cur_state)
+    adm(subcmd, flags, self.service_fmri)
   end
 
-  def stopcmd
-    [command(:adm), :disable, "-s", @resource[:name]]
+  # The flush method is necessary for the SMF provider because syncing the enable and ensure
+  # properties are not independent operations like they are in most of our other service
+  # providers.
+  def flush
+    # We append the "_" because ensure is a Ruby keyword, and it is good to keep property
+    # variable names consistent with each other.
+    enable_, ensure_ = @properties_to_sync[:enable], @properties_to_sync[:ensure]
+
+    # All of the relevant properties are in sync., so we do not need to do
+    # anything here.
+    return if enable_.nil? and ensure_.nil?
+
+    # Set-up our service so that we know it will exist and so we can collect its fmri. Also
+    # simplifies the code. For a nonexistent service, one of enable or ensure will be true
+    # here (since we're syncing them), so we can fail early if setup_service fails.
+    setup_service
+    fmri = self.service_fmri
+
+    # Useful constants for operations involving multiple states
+    stopped = ['offline', 'disabled', 'uninitialized']
+
+    # Get the current state of the service.
+    cur_state = self.status
+
+    if enable_.nil?
+      # Only ensure needs to be syncd. The -t flag tells svcadm to temporarily
+      # enable/disable the service, where the temporary status is gone upon
+      # reboot. This is exactly what we want, because we do not want to touch
+      # the enable property.
+      if ensure_ == :stopped
+        self.maybe_clear_service_then_svcadm(cur_state, 'disable', '-st')
+        wait(*stopped)
+      else # ensure == :running
+        self.maybe_clear_service_then_svcadm(cur_state, 'enable', '-rst')
+        wait('online')
+      end
+
+      return
+    end
+
+    # Here, enable is being syncd. svcadm starts the service if we enable it, or shuts it down if we
+    # disable it. However, we want our service to be in a final state, which is either whatever the
+    # new ensured value is, or what our original state was prior to enabling it.
+    #
+    # NOTE: Even if you try to set the general/enabled property with svccfg, SMF will still
+    # try to start or shut down the service. Plus, setting general/enabled with svccfg does not
+    # enable the service's dependencies, while svcadm handles this correctly.
+    #
+    # NOTE: We're treating :running and :degraded the same. The reason is b/c an SMF managed service
+    # can only enter the :degraded state if it is online. Since disabling the service also shuts it
+    # off, we cannot set it back to the :degraded state. Thus, it is best to lump :running and :degraded
+    # into the same category to maintain a consistent postcondition on the service's final state when
+    # enabling and disabling it.
+    final_state = ensure_ || cur_state
+    final_state = :running if final_state == :degraded
+
+    if enable_
+      self.maybe_clear_service_then_svcadm(cur_state, 'enable', '-rs')
+    else
+      self.maybe_clear_service_then_svcadm(cur_state, 'disable', '-s')
+    end
+
+    # We're safe with 'whens' here since self.status already errors on any
+    # unmanageable states.
+    case final_state
+    when :running
+      adm('enable', '-rst', fmri) unless enable_
+      wait('online')
+    when :stopped
+      adm('disable', '-st', fmri) if enable_
+      wait(*stopped)
+    when :maintenance
+      adm('mark', '-I', 'maintenance', fmri)
+      wait('maintenance')
+    end
   end
 end
-