puppet 6.20.0-x64-mingw32 → 7.0.0-x64-mingw32

data/lib/puppet/pops/parser/lexer2.rb

@@ -134,10 +134,10 @@ class Lexer2
     'type'     => [:TYPE,     'type',     4],
     'attr'     => [:ATTR,     'attr',     4],
     'private'  => [:PRIVATE,  'private',  7],
-    'application' => [:APPLICATION, 'application',  11],
-    'consumes'    => [:CONSUMES,    'consumes',  8],
-    'produces'    => [:PRODUCES,    'produces',  8],
-    'site'        => [:SITE,        'site',  4],
+    'application' => [:APPLICATION, 'application',  11], # reserved
+    'consumes'    => [:CONSUMES,    'consumes',  8], # reserved
+    'produces'    => [:PRODUCES,    'produces',  8], # reserved
+    'site'        => [:SITE,        'site',  4], # reserved
   }
 
   KEYWORDS.each {|k,v| v[1].freeze; v.freeze }

data/lib/puppet/pops/parser/parser_support.rb

@@ -178,11 +178,6 @@ class Parser
     definition
   end
 
-  def add_mapping(produces)
-    # The actual handling of mappings happens in PopsBridge
-    add_definition(produces)
-  end
-
   # Transforms an array of expressions containing literal name expressions to calls if followed by an
   # expression, or expression list
   #

data/lib/puppet/pops/resource/resource_type_impl.rb

@@ -87,9 +87,7 @@ class ResourceTypeImpl
     :subscribe,
     :before,
     :notify,
-    :stage,
-    :export,
-    :consume
+    :stage
     ].freeze
 
   # Speed up lookup
@@ -107,7 +105,7 @@ class ResourceTypeImpl
     @parameters = parameters
     @title_patterns_hash = title_patterns_hash
     @isomorphic = isomorphic
-    @capability = capability
+    # ignore capability parameter
 
     # Compute attributes hash
     # Compute key_names (possibly compound key if there are multiple name vars).
@@ -175,10 +173,6 @@ class ResourceTypeImpl
     false
   end
 
-  def is_capability?
-    @capability
-  end
-
   # Answers if the parameter name is a parameter/attribute of this type
   # This is part of the Puppet::Type API
   # Check if used when compiling (it is triggered in an apply)
@@ -243,22 +237,6 @@ class ResourceTypeImpl
     #       Param.
   end
 
-  #######################
-  # UNSUPPORTED STUFF
-  #######################
-
-  # Applications are not supported
-  #
-  # @deprecated application orchestration will be removed in puppet 7
-  def application?
-    false
-  end
-
-  ############################
-  # DON'T KNOW YET
-  ############################
-
-
   ##################################################
   # NEVER CALLED COMPILE SIDE FOR A COMPILATION
   ##################################################

data/lib/puppet/pops/types/type_calculator.rb

@@ -181,13 +181,6 @@ class TypeCalculator
     t.is_a?(PAnyType) ? t.assignable?(t2) : false
   end
 
-  # Returns an iterable if the t represents something that can be iterated
-  def enumerable(t)
-    #TRANSLATOR 'TypeCalculator.enumerable' and 'iterable' are methods and should not be translated
-    Puppet.deprecation_warning(_('TypeCalculator.enumerable is deprecated. Use iterable'))
-    iterable(t)
-  end
-
   # Returns an iterable if the t represents something that can be iterated
   def iterable(t)
     # Create an iterable on the type if possible

data/lib/puppet/pops/types/type_parser.rb

@@ -94,10 +94,6 @@ class TypeParser
     interpret_any(o.text_expr, context)
   end
 
-  def interpret_SubLocatedExpression(o, context)
-    interpret_any(o.expr, context)
-  end
-
   # @api private
   def interpret_QualifiedName(o, context)
     o.value

data/lib/puppet/pops/types/types.rb

@@ -1,5 +1,4 @@
 require_relative 'iterable'
-require_relative 'enumeration'
 require_relative 'recursion_guard'
 require_relative 'type_acceptor'
 require_relative 'type_asserter'

data/lib/puppet/pops/validation/checker4_0.rb

@@ -199,11 +199,6 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     end
   end
 
-  def check_Application(o)
-    check_NamedDefinition(o)
-    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
-  end
-
   def check_AssignmentExpression(o)
     case o.operator
     when '='
@@ -241,7 +236,6 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     case p
     when Model::AbstractResource
     when Model::CollectExpression
-    when Model::CapabilityMapping
       acceptor.accept(Issues::UNSUPPORTED_OPERATOR_IN_CONTEXT, p, :operator=>'* =>')
     else
       # protect against just testing a snippet that has no parent, error message will be a bit strange
@@ -300,33 +294,6 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     end
   end
 
-  def check_CapabilityMapping(o)
-    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
-    ok =
-    case o.component
-    when Model::QualifiedReference
-      name = o.component.cased_value
-      acceptor.accept(Issues::ILLEGAL_CLASSREF, o.component, {:name=>name}) unless name =~ Patterns::CLASSREF_EXT
-      true
-    when Model::AccessExpression
-      keys = o.component.keys
-      expr = o.component.left_expr
-      if expr.is_a?(Model::QualifiedReference) && keys.size == 1
-        key = keys[0]
-        key.is_a?(Model::LiteralString) || key.is_a?(Model::QualifiedName) || key.is_a?(Model::QualifiedReference)
-      else
-        false
-      end
-    else
-      false
-    end
-    acceptor.accept(Issues::ILLEGAL_EXPRESSION, o.component, :feature=>'capability mapping', :container => o) unless ok
-
-    if o.capability !~ Patterns::CLASSREF_EXT
-      acceptor.accept(Issues::ILLEGAL_CLASSREF, o, {:name=>o.capability})
-    end
-  end
-
   def check_EppExpression(o)
     p = container
     if p.is_a?(Model::LambdaExpression)
@@ -403,6 +370,15 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     'regexp' => true,
     'pattern' => true,
     'runtime' => true,
+    'init' => true,
+    'object' => true,
+    'sensitive' => true,
+    'semver' => true,
+    'semverrange' => true,
+    'string' => true,
+    'timestamp' => true,
+    'timespan' => true,
+    'typeset' => true,
   }
 
   FUTURE_RESERVED_WORDS = {
@@ -875,10 +851,6 @@ class Checker4_0 < Evaluator::LiteralEvaluator
     rvalue(o.matching_expr)
   end
 
-  def check_SiteDefinition(o)
-    acceptor.accept(Issues::DEPRECATED_APP_ORCHESTRATION, o, {:klass => o})
-  end
-
   def check_UnaryExpression(o)
     rvalue(o.expr)
   end

data/lib/puppet/pops/validation/tasks_checker.rb

@@ -13,14 +13,6 @@ class TasksChecker < Checker4_0
     end
   end
 
-  def check_Application(o)
-    illegalTasksExpression(o)
-  end
-
-  def check_CapabilityMapping(o)
-    illegalTasksExpression(o)
-  end
-
   def check_CollectExpression(o)
     # Only virtual resource queries are allowed in apply blocks, not exported
     # resource queries
@@ -83,10 +75,6 @@ class TasksChecker < Checker4_0
     illegalTasksExpression(o)
   end
 
-  def check_SiteDefinition(o)
-    illegalTasksExpression(o)
-  end
-
   def check_ApplyExpression(o)
     if in_ApplyExpression?
       acceptor.accept(Issues::EXPRESSION_NOT_SUPPORTED_WHEN_COMPILING, o, {:klass => o})

data/lib/puppet/pops/validation/validator_factory_4_0.rb

@@ -31,12 +31,11 @@ class ValidatorFactory_4_0 < Factory
     p[Issues::RT_NO_STORECONFIGS]             = Puppet[:storeconfigs] ? :ignore : :warning
 
     p[Issues::FUTURE_RESERVED_WORD]           = :deprecation
-    p[Issues::DEPRECATED_APP_ORCHESTRATION]   = :deprecation
 
     p[Issues::DUPLICATE_KEY]                  = Puppet[:strict] == :off ? :ignore : Puppet[:strict]
     p[Issues::NAME_WITH_HYPHEN]               = :error
     p[Issues::EMPTY_RESOURCE_SPECIALIZATION]  = :ignore
-    p[Issues::CLASS_NOT_VIRTUALIZABLE]        = Puppet[:strict] == :off ? :warning : Puppet[:strict]
+    p[Issues::CLASS_NOT_VIRTUALIZABLE]        = :error
     p
   end
 end

data/lib/puppet/provider.rb

@@ -117,19 +117,6 @@ class Puppet::Provider
     Puppet::Util::Execution.execpipe(*args, &block)
   end
 
-  # Convenience methods - see class method with the same name.
-  # @return (see self.execfail)
-  # @deprecated
-  def execfail(*args)
-    Puppet::Util::Execution.execfail(*args)
-  end
-
-  # (see Puppet::Util::Execution.execfail)
-  # @deprecated
-  def self.execfail(*args)
-    Puppet::Util::Execution.execfail(*args)
-  end
-
   # Returns the absolute path to the executable for the command referenced by the given name.
   # @raise [Puppet::DevError] if the name does not reference an existing command.
   # @return [String] the absolute path to the found executable for the command

data/lib/puppet/provider/nameservice.rb

@@ -54,24 +54,6 @@ class Puppet::Provider::NameService < Puppet::Provider
       end
     end
 
-    # List everything out by name.  Abstracted a bit so that it works
-    # for both users and groups.
-    def listbyname
-      Puppet.deprecation_warning(_("listbyname is deprecated and will be removed in a future release of Puppet. Please use `self.instances` to obtain a list of users."))
-      names = []
-      Puppet::Etc.send("set#{section()}ent")
-      begin
-        while ent = Puppet::Etc.send("get#{section()}ent") #rubocop:disable Lint/AssignmentInCondition
-          names << ent.name
-          yield ent.name if block_given?
-        end
-      ensure
-        Puppet::Etc.send("end#{section()}ent")
-      end
-
-      names
-    end
-
     def resource_type=(resource_type)
       super
       @resource_type.validproperties.each do |prop|

data/lib/puppet/provider/package/apt.rb

@@ -51,10 +51,6 @@ Puppet::Type.type(:package).provide :apt, :parent => :dpkg, :source => :dpkg do
     @property_flush = {}
   end
 
-  def mark
-    @property_flush[:mark]
-  end
-
   def mark=(value)
     @property_flush[:mark] = value
   end

data/lib/puppet/provider/package/dpkg.rb

@@ -173,13 +173,6 @@ Puppet::Type.type(:package).provide :dpkg, :parent => Puppet::Provider::Package
     dpkg "--purge", @resource[:name]
   end
 
-  def deprecated_hold
-    if package_not_installed?
-      self.install
-    end
-    hold
-  end
-
   def hold
     Tempfile.open('puppet_dpkg_set_selection') do |tmpfile|
       tmpfile.write("#{@resource[:name]} hold\n")
@@ -196,7 +189,4 @@ Puppet::Type.type(:package).provide :dpkg, :parent => Puppet::Provider::Package
     end
   end
 
-  def package_not_installed?
-    query[:status] != "installed"
-  end
 end

data/lib/puppet/provider/package/gem.rb

@@ -14,7 +14,7 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
 
     This provider supports the `install_options` and `uninstall_options` attributes,
     which allow command-line flags to be passed to the gem command.
-    These options should be specified as an array where each element is either a 
+    These options should be specified as an array where each element is either a
     string or a hash."
 
   has_feature :versionable, :install_options, :uninstall_options, :targetable, :version_ranges
@@ -36,7 +36,11 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
   # Required by Puppet::Provider::Package::Targetable::resource_or_provider_command
 
   def self.provider_command
-    command(:gemcmd)
+    if Puppet::Util::Platform.windows?
+      Puppet::Util.withenv(PATH: windows_path_without_puppet_bin) { command(:gemcmd) }
+    else
+      command(:gemcmd)
+    end
   end
 
   # Define the default provider package command as optional when the provider is targetable.
@@ -46,6 +50,18 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
     is_optional
   end
 
+  # Having puppet/bin in PATH makes gem provider to use puppet/bin/gem
+  # This is an utility methods that reads the PATH and returns a string
+  # that contains the content of PATH but without puppet/bin dir.
+  # This is used to pass a custom PATH and execute commands in a controlled environment
+  def self.windows_path_without_puppet_bin
+    @path ||= Puppet::Util.get_env('PATH').split(File::PATH_SEPARATOR)
+                                          .reject { |dir| dir =~ /puppet\\bin$/ }
+                                          .join(File::PATH_SEPARATOR)
+  end
+
+  private_class_method :windows_path_without_puppet_bin
+
   # CommandDefiner in provider.rb creates convenience execution methods that set failonfail, combine, and optionally, environment.
   # And when a child provider defines its own command via commands() or has_command(), the provider-specific path is always returned by command().
   # But when the convenience execution method is invoked, the last convenience method to be defined is executed.
@@ -59,6 +75,10 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
 
     custom_environment = {'HOME'=>Puppet::Util.get_env('HOME')}.merge(custom_environment)
 
+    if Puppet::Util::Platform.windows?
+      custom_environment[:PATH] = windows_path_without_puppet_bin
+    end
+
     execute(cmd, {:failonfail => true, :combine => true, :custom_environment => custom_environment})
   end
 
@@ -152,7 +172,7 @@ Puppet::Type.type(:package).provide :gem, :parent => Puppet::Provider::Package::
         end
       end
     end
-    
+
     begin
       # Range intersections are not supported by Gem::Requirement, so just split by comma.
       dependency = Gem::Dependency.new('', should.split(','))

data/lib/puppet/provider/package/pip.rb

@@ -4,7 +4,6 @@
 require 'puppet/util/package/version/pip'
 require 'puppet/util/package/version/range'
 require 'puppet/provider/package_targetable'
-require 'puppet/util/http_proxy'
 
 Puppet::Type.type(:package).provide :pip, :parent => ::Puppet::Provider::Package::Targetable do
 

data/lib/puppet/provider/package/pkg.rb

@@ -114,10 +114,6 @@ Puppet::Type.type(:package).provide :pkg, :parent => Puppet::Provider::Package d
     end).merge({:provider => self.name})
   end
 
-  def deprecated_hold
-    hold
-  end
-
   def hold
     pkg(:freeze, @resource[:name])
   end

data/lib/puppet/provider/package/portage.rb

@@ -112,7 +112,7 @@ Puppet::Type.type(:package).provide :portage, :parent => Puppet::Provider::Packa
       # do the search
       should = @resource[:ensure]
       case should
-      # The terms present, absent, purged, held, installed, latest in :ensure 
+      # The terms present, absent, purged, installed, latest in :ensure
       # resolve as Symbols, and we do not need specific package version in this case
       when true, false, Symbol
         search = @resource[:name]

data/lib/puppet/provider/package/puppet_gem.rb

@@ -5,10 +5,7 @@ Puppet::Type.type(:package).provide :puppet_gem, :parent => :gem do
   has_feature :versionable, :install_options, :uninstall_options
 
   if Puppet::Util::Platform.windows?
-    # On windows, we put our ruby ahead of anything that already
-    # existed on the system PATH. This means that we do not need to
-    # sort out the absolute path.
-    commands :gemcmd => "gem"
+    commands :gemcmd => File.join(Puppet::Util.get_env('PUPPET_DIR').to_s, 'bin', 'gem.bat')
   else
     commands :gemcmd => "/opt/puppetlabs/puppet/bin/gem"
   end

data/lib/puppet/provider/service/smf.rb

@@ -5,48 +5,100 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   desc <<-EOT
     Support for Sun's new Service Management Framework.
 
-    Starting a service is effectively equivalent to enabling it, so there is
-    only support for starting and stopping services, which also enables and
-    disables them, respectively.
+    When managing the enable property, this provider will try to preserve
+    the previous ensure state per the enableable semantics. On Solaris,
+    enabling a service starts it up while disabling a service stops it. Thus,
+    there's a chance for this provider to execute two operations when managing
+    the enable property. For example, if enable is set to true and the ensure
+    state is stopped, this provider will manage the service using two operations:
+    one to enable the service which will start it up, and another to stop the
+    service (without affecting its enabled status).
 
     By specifying `manifest => "/path/to/service.xml"`, the SMF manifest will
     be imported if it does not exist.
-
   EOT
 
   defaultfor :osfamily => :solaris
 
   confine :osfamily => :solaris
 
-  commands :adm => "/usr/sbin/svcadm", :svcs => "/usr/bin/svcs"
-  commands :svccfg => "/usr/sbin/svccfg"
+  commands :adm => "/usr/sbin/svcadm",
+           :svcs => "/usr/bin/svcs",
+           :svccfg => "/usr/sbin/svccfg"
 
   has_feature :refreshable
 
-  def setupservice
-      if resource[:manifest]
-        begin
-          svcs("-l", @resource[:name])
-        rescue Puppet::ExecutionFailure
-          Puppet.notice "Importing #{@resource[:manifest]} for #{@resource[:name]}"
-          svccfg :import, resource[:manifest]
-        end
-      end
+  def self.instances
+    service_instances = svcs("-H", "-o", "state,fmri" ).split("\n")
+
+    # Puppet does not manage services in the legacy_run state, so filter those out.
+    service_instances.reject! { |line| line =~ /^legacy_run/ }
+
+    service_instances.collect! do |line|
+      state, fmri = line.split(/\s+/)
+
+      status =  case state
+                when /online/; :running
+                when /maintenance/; :maintenance
+                when /degraded/; :degraded
+                else :stopped
+                end
+      new({:name => fmri, :ensure => status})
+    end
+
+    service_instances
+  end
+
+  def initialize(*args)
+    super(*args)
+
+    # This hash contains the properties we need to sync. in our flush method.
+    #
+    # TODO (PUP-9051): Should we use @property_hash here? It seems like
+    # @property_hash should be empty by default and is something we can
+    # control so I think so?
+    @properties_to_sync = {}
+  end
+
+  def service_exists?
+    self.service_fmri
+    true
+  rescue Puppet::ExecutionFailure
+    false
+  end
+
+  def setup_service
+    return unless @resource[:manifest]
+    return if self.service_exists?
+
+    Puppet.notice("Importing #{@resource[:manifest]} for #{@resource[:name]}")
+    svccfg(:import, @resource[:manifest])
   rescue Puppet::ExecutionFailure => detail
-      raise Puppet::Error.new( "Cannot config #{self.name} to enable it: #{detail}", detail )
+    raise Puppet::Error.new( "Cannot config #{@resource[:name]} to enable it: #{detail}", detail )
   end
 
-  def self.instances
-   svcs("-H", "-o", "state,fmri" ).split("\n").select{|l| l !~ /^legacy_run/ }.collect do |line|
-     state,fmri = line.split(/\s+/)
-     status =  case state
-               when /online/; :running
-               when /maintenance/; :maintenance
-               when /degraded/; :degraded
-               else :stopped
-               end
-     new({:name => fmri, :ensure => status})
-   end
+  # Returns the service's FMRI. We fail if multiple FMRIs correspond to
+  # @resource[:name].
+  #
+  # If the service does not exist or we fail to get any FMRIs from svcs,
+  # this method will raise a Puppet::ExecutionFailure
+  def service_fmri
+    return @fmri if @fmri
+
+    # `svcs -l` is better to use because we can detect service instances
+    # that have not yet been activated or enabled (i.e. it lets us detect
+    # services that svcadm has not yet touched). `svcs -H -o fmri` is a bit
+    # more limited.
+    lines = svcs("-l", @resource[:name]).chomp.lines.to_a
+    lines.select! { |line| line =~ /^fmri/ }
+    fmris = lines.map! { |line| line.split(' ')[-1].chomp }
+    unless fmris.length == 1
+      raise Puppet::Error.new(
+        "Failed to get #{@resource[:name]}'s FMRI: The pattern '#{@resource[:name]}' matches multiple FMRIs! These are the FMRIs it matches: #{fmris.join(', ')}"
+      )
+    end
+
+    @fmri = fmris.first
   end
 
   # Returns the service's FMRI. We fail if multiple FMRIs correspond to
@@ -96,51 +148,50 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   end
 
   def enable
-    self.start
+    @properties_to_sync[:enable] = true
   end
 
   def enabled?
-    case self.status
-    when :running
-      return :true
-    else
-      return :false
-    end
+    return :false unless service_exists?
+    _property, _type, value = svccfg("-s", self.service_fmri, "listprop", "general/enabled").split(' ')
+    value == 'true' ? :true : :false
   end
 
   def disable
-    self.stop
+    @properties_to_sync[:enable] = false
   end
 
   def restartcmd
     if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemrelease), '11.2') >= 0
-      [command(:adm), :restart, "-s", @resource[:name]]
+      [command(:adm), :restart, "-s", self.service_fmri]
     else
       # Synchronous restart only supported in Solaris 11.2 and above
-      [command(:adm), :restart, @resource[:name]]
+      [command(:adm), :restart, self.service_fmri]
     end
   end
 
-  def startcmd
-    self.setupservice
-    case self.status
-    when :maintenance, :degraded
-      [command(:adm), :clear, @resource[:name]]
-    else
-      [command(:adm), :enable, "-rs", @resource[:name]]
-    end
+  def service_states
+    # Gets the current and next state of the service. We have a next state because SMF
+    # manages services asynchronously. If there is no 'next' state, svcs will put a '-'
+    # to indicate as such.
+    current_state, next_state = svcs("-H", "-o", "state,nstate", self.service_fmri).chomp.split(' ')
+
+    {
+      :current => current_state,
+      :next => next_state == "-" ? nil : next_state
+    }
   end
 
   # Wait for the service to transition into the specified state before returning.
   # This is necessary due to the asynchronous nature of SMF services.
-  # desired_state should be online, offline, disabled, or uninitialized.
+  # desired_states should include only online, offline, disabled, or uninitialized.
   # See PUP-5474 for long-term solution to this issue.
-  def wait(*desired_state)
+  def wait(*desired_states)
     Timeout.timeout(60) do
       loop do
         states = self.service_states
-        break if desired_state.include?(states[0]) && states[1] == '-'
-        sleep(1)
+        break if desired_states.include?(states[:current]) && states[:next].nil?
+        Kernel.sleep(1)
       end
     end
   rescue Timeout::Error
@@ -148,15 +199,11 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   end
 
   def start
-    # Wait for the service to actually start before returning.
-    super
-    self.wait('online')
+    @properties_to_sync[:ensure] = :running
   end
 
   def stop
-    # Wait for the service to actually stop before returning.
-    super
-    self.wait('offline', 'disabled', 'uninitialized')
+    @properties_to_sync[:ensure] = :stopped
   end
 
   def restart
@@ -165,16 +212,8 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
     self.wait('online')
   end
 
-  # Determine the current and next states of a service.
-  def service_states
-    svcs("-H", "-o", "state,nstate", @resource[:name]).chomp.split
-  end
-
   def status
-    if @resource[:status]
-      super
-      return
-    end
+    return super if @resource[:status]
 
     begin
       if supports_incomplete_services?
@@ -185,10 +224,10 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
         end
       end
 
-      # get the current state and the next state, and if the next
-      # state is set (i.e. not "-") use it for state comparison
-      states = service_states
-      state = states[1] == "-" ? states[0] : states[1]
+      # Get the current state and the next state. If there is a next state,
+      # use that for the state comparison.
+      states = self.service_states
+      state = states[:next] || states[:current]
     rescue Puppet::ExecutionFailure
       # TODO (PUP-8957): Should this be set back to INFO ?
       debug "Could not get status on service #{self.name} #{$!}"
@@ -197,10 +236,8 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
 
     case state
     when "online"
-      #self.warning "matched running #{line.inspect}"
       return :running
     when "offline", "disabled", "uninitialized"
-      #self.warning "matched stopped #{line.inspect}"
       return :stopped
     when "maintenance"
       return :maintenance
@@ -213,11 +250,92 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
       raise Puppet::Error,
         "Unmanageable state '#{state}' on service #{self.name}"
     end
+  end
 
+  # Helper that encapsulates the clear + svcadm [enable|disable]
+  # logic in one place. Makes it easy to test things out and also
+  # cleans up flush's code.
+  def maybe_clear_service_then_svcadm(cur_state, subcmd, flags)
+    # If the cur_state is maint or degraded, then we need to clear the service
+    # before we enable or disable it.
+    adm('clear', self.service_fmri) if [:maintenance, :degraded].include?(cur_state)
+    adm(subcmd, flags, self.service_fmri)
   end
 
-  def stopcmd
-    [command(:adm), :disable, "-s", @resource[:name]]
+  # The flush method is necessary for the SMF provider because syncing the enable and ensure
+  # properties are not independent operations like they are in most of our other service
+  # providers.
+  def flush
+    # We append the "_" because ensure is a Ruby keyword, and it is good to keep property
+    # variable names consistent with each other.
+    enable_, ensure_ = @properties_to_sync[:enable], @properties_to_sync[:ensure]
+
+    # All of the relevant properties are in sync., so we do not need to do
+    # anything here.
+    return if enable_.nil? and ensure_.nil?
+
+    # Set-up our service so that we know it will exist and so we can collect its fmri. Also
+    # simplifies the code. For a nonexistent service, one of enable or ensure will be true
+    # here (since we're syncing them), so we can fail early if setup_service fails.
+    setup_service
+    fmri = self.service_fmri
+
+    # Useful constants for operations involving multiple states
+    stopped = ['offline', 'disabled', 'uninitialized']
+
+    # Get the current state of the service.
+    cur_state = self.status
+
+    if enable_.nil?
+      # Only ensure needs to be syncd. The -t flag tells svcadm to temporarily
+      # enable/disable the service, where the temporary status is gone upon
+      # reboot. This is exactly what we want, because we do not want to touch
+      # the enable property.
+      if ensure_ == :stopped
+        self.maybe_clear_service_then_svcadm(cur_state, 'disable', '-st')
+        wait(*stopped)
+      else # ensure == :running
+        self.maybe_clear_service_then_svcadm(cur_state, 'enable', '-rst')
+        wait('online')
+      end
+
+      return
+    end
+
+    # Here, enable is being syncd. svcadm starts the service if we enable it, or shuts it down if we
+    # disable it. However, we want our service to be in a final state, which is either whatever the
+    # new ensured value is, or what our original state was prior to enabling it.
+    #
+    # NOTE: Even if you try to set the general/enabled property with svccfg, SMF will still
+    # try to start or shut down the service. Plus, setting general/enabled with svccfg does not
+    # enable the service's dependencies, while svcadm handles this correctly.
+    #
+    # NOTE: We're treating :running and :degraded the same. The reason is b/c an SMF managed service
+    # can only enter the :degraded state if it is online. Since disabling the service also shuts it
+    # off, we cannot set it back to the :degraded state. Thus, it is best to lump :running and :degraded
+    # into the same category to maintain a consistent postcondition on the service's final state when
+    # enabling and disabling it.
+    final_state = ensure_ || cur_state
+    final_state = :running if final_state == :degraded
+
+    if enable_
+      self.maybe_clear_service_then_svcadm(cur_state, 'enable', '-rs')
+    else
+      self.maybe_clear_service_then_svcadm(cur_state, 'disable', '-s')
+    end
+
+    # We're safe with 'whens' here since self.status already errors on any
+    # unmanageable states.
+    case final_state
+    when :running
+      adm('enable', '-rst', fmri) unless enable_
+      wait('online')
+    when :stopped
+      adm('disable', '-st', fmri) if enable_
+      wait(*stopped)
+    when :maintenance
+      adm('mark', '-I', 'maintenance', fmri)
+      wait('maintenance')
+    end
   end
 end
-