puppet 6.21.1 → 6.22.1

data/lib/puppet/file_system/windows.rb

@@ -128,6 +128,8 @@ class Puppet::FileSystem::Windows < Puppet::FileSystem::Posix
     end
 
     current_sid = Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name)
+    current_sid = Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_sam_compatible_user_name) unless current_sid
+
     dacl = case mode
            when 0644
              dacl = secure_dacl(current_sid)

data/lib/puppet/functions/partition.rb

@@ -5,13 +5,21 @@
 Puppet::Functions.create_function(:partition) do
   # @param collection A collection of things to partition.
   # @example Partition array of empty strings, results in e.g. [[''], [b, c]]
+  #   ```puppet
   #   ['', b, c].partition |$s| { $s.empty }
+  #   ```
   # @example Partition array of strings using index, results in e.g. [['', 'ab'], ['b']]
+  #   ```puppet
   #   ['', b, ab].partition |$i, $s| { $i == 2 or $s.empty }
+  #   ```
   # @example Partition hash of strings by key-value pair, results in e.g. [[['b', []]], [['a', [1, 2]]]]
+  #   ```puppet
   #   { a => [1, 2], b => [] }.partition |$kv| { $kv[1].empty }
+  #   ```
   # @example Partition hash of strings by key and value, results in e.g. [[['b', []]], [['a', [1, 2]]]]
+  #   ```puppet
   #   { a => [1, 2], b => [] }.partition |$k, $v| { $v.empty }
+  #   ```
   dispatch :partition_1 do
     required_param 'Collection', :collection
     block_param 'Callable[1,1]', :block

data/lib/puppet/indirector/facts/facter.rb

@@ -32,8 +32,14 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
     # Initialize core Puppet facts, such as puppetversion
     Puppet.initialize_facts
 
-    result = Puppet::Node::Facts.new(request.key, Facter.to_hash)
-    result.add_local_facts
+    result = if request.options[:resolve_options]
+               raise(Puppet::Error, _("puppet facts show requires version 4.0.40 or greater of Facter.")) unless Facter.respond_to?(:resolve)
+               find_with_options(request)
+             else
+               Puppet::Node::Facts.new(request.key, Facter.to_hash)
+             end
+
+    result.add_local_facts unless request.options[:resolve_options]
     result.sanitize
     result
   end
@@ -61,7 +67,7 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
 
       true
     end
-
+    dirs << request.options[:custom_dir] if request.options[:custom_dir]
     Facter.search(*dirs)
   end
 
@@ -83,6 +89,21 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
       dirs << dir
     end
 
+    dirs << request.options[:external_dir] if request.options[:external_dir]
     Facter.search_external dirs
   end
+
+  private
+
+  def find_with_options(request)
+    options = request.options
+    options_for_facter = String.new
+    options_for_facter += options[:user_query].join(' ')
+    options_for_facter += " --config #{options[:config_file]}" if options[:config_file]
+    options_for_facter += " --show-legacy" if options[:show_legacy]
+    options_for_facter += " --no-block" if options[:no_block] == false
+    options_for_facter += " --no-cache" if options[:no_cache] == false
+
+    Puppet::Node::Facts.new(request.key, Facter.resolve(options_for_facter))
+  end
 end

data/lib/puppet/network/formats.rb

@@ -183,6 +183,73 @@ Puppet::Network::FormatHandler.create(:console,
   end
 end
 
+Puppet::Network::FormatHandler.create(:flat,
+                                      :mime   => 'text/x-flat-text',
+                                      :weight => 0) do
+
+  def flatten_hash(hash)
+    hash.each_with_object({}) do |(k, v), h|
+      if v.is_a? Hash
+        flatten_hash(v).map do |h_k, h_v|
+          h["#{k}.#{h_k}"] = h_v
+        end
+      elsif v.is_a? Array
+        v.each_with_index do |el, i|
+          if el.is_a? Hash
+            flatten_hash(el).map do |el_k, el_v|
+              h["#{k}.#{i}.#{el_k}"] = el_v
+            end
+          else
+            h["#{k}.#{i}"] = el
+          end
+        end
+      else
+        h[k] = v
+      end
+    end
+  end
+
+  def flatten_array(array)
+    a={}
+    array.each_with_index do |el, i|
+      if el.is_a? Hash
+        flatten_hash(el).map do |el_k, el_v|
+          a["#{i}.#{el_k}"] = el_v
+        end
+      else
+        a["#{i}"] = el
+      end
+    end
+    a
+  end
+
+  def construct_output(data)
+    output = ''
+    data.each do |key, value|
+      output << "#{key}=#{value}"
+      output << "\n"
+    end
+    output
+  end
+
+  def render(datum)
+    return datum if datum.is_a?(String) || datum.is_a?(Numeric)
+    # Simple hash
+    if datum.is_a?(Hash)
+      data = flatten_hash(datum)
+      return construct_output(data)
+    elsif datum.is_a?(Array)
+      data = flatten_array(datum)
+      return construct_output(data)
+    end
+    Puppet::Util::Json.dump(datum, :pretty => true, :quirks_mode => true)
+  end
+  def render_multiple(data)
+    data.collect(&:render).join("\n")
+  end
+end
+
+
 Puppet::Network::FormatHandler.create(:rich_data_json, mime: 'application/vnd.puppet.rich+json', charset: Encoding::UTF_8, weight: 30) do
   def intern(klass, text)
     Puppet.override({:rich_data => true}) do

data/lib/puppet/network/http/factory.rb

@@ -27,6 +27,10 @@ class Puppet::Network::HTTP::Factory
 
     http = Puppet::Util::HttpProxy.proxy(URI(site.addr))
     http.use_ssl = site.use_ssl?
+    if site.use_ssl?
+      http.min_version = OpenSSL::SSL::TLS1_VERSION if http.respond_to?(:min_version)
+      http.ciphers = Puppet[:ciphers]
+    end
     http.read_timeout = Puppet[:http_read_timeout]
     http.open_timeout = Puppet[:http_connect_timeout]
     http.keep_alive_timeout = KEEP_ALIVE_TIMEOUT if http.respond_to?(:keep_alive_timeout=)

data/lib/puppet/provider/package/dnfmodule.rb

@@ -93,7 +93,7 @@ Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
         # module has no default profile and no profile was requested, so just enable the stream
         # DNF versions prior to 4.2.8 do not need this workaround
         # see https://bugzilla.redhat.com/show_bug.cgi?id=1669527
-        if @resource[:flavor] == nil && e.message =~ /^missing groups or modules: #{Regexp.quote(@resource[:name])}$/
+        if @resource[:flavor] == nil && e.message =~ /^(?:missing|broken) groups or modules: #{Regexp.quote(@resource[:name])}$/
           enable(args)
         else
           raise

data/lib/puppet/provider/service/systemd.rb

@@ -30,7 +30,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def self.instances
     i = []
     output = systemctl('list-unit-files', '--type', 'service', '--full', '--all',  '--no-pager')
-    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad|static)\s*$/i).each do |m|
+    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad|static)\s*([^-]\S+)?\s*$/i).each do |m|
       Puppet.debug("#{m[0]} marked as bad by `systemctl`. It is recommended to be further checked.") if m[1] == "bad"
       i << new(:name => m[0])
     end

data/lib/puppet/provider/user/useradd.rb

@@ -135,7 +135,7 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
 
     Puppet::FileSystem.each_line(group_file) do |line|
       data = line.chomp.split(':')
-      if data.last.split(',').include?(user)
+      if !data.empty? && data.last.split(',').include?(user)
         @groups_of[user] << data.first
       end
     end

data/lib/puppet/settings/environment_conf.rb

@@ -29,6 +29,7 @@ class Puppet::Settings::EnvironmentConf
       section = config.sections[:main]
     rescue Errno::ENOENT
       # environment.conf is an optional file
+      Puppet.debug { "Path to #{path_to_env} does not exist, using default environment.conf" }
     end
 
     new(path_to_env, section, global_module_path)

data/lib/puppet/util/fact_dif.rb

@@ -1,15 +1,24 @@
 require 'json'
 
 class FactDif
-  def initialize(old_output, new_output, exclude_list = [])
-    @c_facter = JSON.parse(old_output)['values']
-    @next_facter = JSON.parse(new_output)['values']
+  def initialize(old_output, new_output, exclude_list, save_structured)
+    @c_facter = JSON.parse(old_output)
+    @next_facter = JSON.parse(new_output)
     @exclude_list = exclude_list
+    @save_structured = save_structured
+    @flat_diff = []
     @diff = {}
   end
 
   def difs
-    search_hash(@c_facter, [])
+    search_hash(((@c_facter.to_a - @next_facter.to_a) | (@next_facter.to_a - @c_facter.to_a)).to_h)
+
+    @flat_diff.sort_by { |a| a[0] }.each do |pair|
+      fact_path = pair[0]
+      value = pair[1]
+      compare(fact_path, value, @c_facter)
+      compare(fact_path, value, @next_facter)
+    end
 
     @diff
   end
@@ -28,29 +37,39 @@ class FactDif
         path.pop
       end
     else
-      compare(path, sh)
+      @flat_diff.push([path.dup, sh])
     end
   end
 
-  def compare(fact_path, old_value)
-    new_value = @next_facter.dig(*fact_path)
-    if different?(new_value, old_value) && !excluded?(fact_path.join('.'))
-      @diff[fact_path.join('.')] = { new_value: new_value, old_value: old_value }
+  def compare(fact_path, given_value, compared_hash)
+    compared_value = compared_hash.dig(*fact_path)
+    if different?(compared_value, given_value) && !excluded?(fact_path.join('.'))
+      fact_path = fact_path.map{|f| f.to_s.include?('.') ? "\"#{f}\"" : f}.join('.') unless @save_structured
+      if compared_hash == @c_facter
+        bury(*fact_path, { :new_value => given_value, :old_value => compared_value }, @diff)
+      else
+        bury(*fact_path, { :new_value => compared_value, :old_value => given_value }, @diff)
+      end
+    end
+  end
+
+  def bury(*paths, value, hash)
+    if paths.count > 1
+      path = paths.shift
+      hash[path] = Hash.new unless hash.key?(path)
+      bury(*paths, value, hash[path])
+    else
+      hash[*paths] = value
     end
   end
 
   def different?(new, old)
-    if old.is_a?(String) && new.is_a?(String)
+    if old.is_a?(String) && new.is_a?(String) && (old.include?(',') || new.include?(','))
       old_values = old.split(',')
       new_values = new.split(',')
 
-      diff = old_values - new_values
-      # also add new entries only available in Facter 4
-      diff.concat(new_values - old_values)
-
-      return true if diff.any?
-
-      return false
+      diff = (old_values - new_values) | (new_values - old_values)
+      return diff.size.positive?
     end
 
     old != new

data/lib/puppet/util/monkey_patches.rb

@@ -32,6 +32,13 @@ end
 # (#19151) Reject all SSLv2 ciphers and handshakes
 require 'puppet/ssl/openssl_loader'
 unless Puppet::Util::Platform.jruby_fips?
+  unless defined?(OpenSSL::SSL::TLS1_VERSION)
+    module OpenSSL::SSL
+      # see https://github.com/ruby/ruby/commit/609103dbb5fb182eec12f052226c43e39b907682#diff-09f822c26289f5347111795ca22ed7ed1cfadd6ebd28f987991d1d414eef565aR2755-R2759
+      OpenSSL::SSL::TLS1_VERSION = 0x301
+    end
+  end
+
   class OpenSSL::SSL::SSLContext
     if DEFAULT_PARAMS[:options]
       DEFAULT_PARAMS[:options] |= OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3

data/lib/puppet/util/windows/adsi.rb

@@ -504,6 +504,43 @@ module Puppet::Util::Windows::ADSI
       user_name
     end
 
+    # https://docs.microsoft.com/en-us/windows/win32/api/secext/ne-secext-extended_name_format
+    NameUnknown           = 0
+    NameFullyQualifiedDN  = 1
+    NameSamCompatible     = 2
+    NameDisplay           = 3
+    NameUniqueId          = 6
+    NameCanonical         = 7
+    NameUserPrincipal     = 8
+    NameCanonicalEx       = 9
+    NameServicePrincipal  = 10
+    NameDnsDomain         = 12
+    NameGivenName         = 13
+    NameSurname           = 14
+
+    def self.current_user_name_with_format(format)
+      user_name = ''
+      max_length = 1024
+
+      FFI::MemoryPointer.new(:lpwstr, max_length * 2 + 1) do |buffer|
+        FFI::MemoryPointer.new(:dword, 1) do |buffer_size|
+          buffer_size.write_dword(max_length + 1)
+
+          if GetUserNameExW(format.to_i, buffer, buffer_size) == FFI::WIN32_FALSE
+            raise Puppet::Util::Windows::Error.new(_("Failed to get user name"), FFI.errno)
+          end
+
+          user_name = buffer.read_wide_string(buffer_size.read_dword).chomp
+        end
+      end
+
+      user_name
+    end
+
+    def self.current_sam_compatible_user_name
+      current_user_name_with_format(NameSamCompatible)
+    end
+
     def self.current_user_sid
       Puppet::Util::Windows::SID.name_to_principal(current_user_name)
     end
@@ -518,6 +555,15 @@ module Puppet::Util::Windows::ADSI
     ffi_lib :advapi32
     attach_function_private :GetUserNameW,
       [:lpwstr, :lpdword], :win32_bool
+
+    # https://docs.microsoft.com/en-us/windows/win32/api/secext/nf-secext-getusernameexa
+    # BOOLEAN SEC_ENTRY GetUserNameExA(
+    #   EXTENDED_NAME_FORMAT NameFormat,
+    #   LPSTR                lpNameBuffer,
+    #   PULONG               nSize
+    # );type
+    ffi_lib :secur32
+    attach_function_private :GetUserNameExW, [:uint16, :lpwstr, :pointer], :win32_bool
   end
 
   class UserProfile

data/lib/puppet/util/windows/api_types.rb

@@ -19,7 +19,7 @@ module Puppet::Util::Windows::APITypes
 
   class ::FFI::Pointer
     NULL_HANDLE = 0
-    WCHAR_NULL = "\0\0".encode('UTF-16LE').freeze
+    WCHAR_NULL = "\0\0".force_encoding('UTF-16LE').freeze
 
     def self.from_string_to_wide_string(str, &block)
       str = Puppet::Util::Windows::String.wide_string(str)

data/lib/puppet/util/windows/principal.rb

@@ -44,7 +44,8 @@ module Puppet::Util::Windows::SID
     ERROR_INVALID_PARAMETER   = 87
     ERROR_INSUFFICIENT_BUFFER = 122
 
-    def self.lookup_account_name(system_name = nil, account_name)
+    def self.lookup_account_name(system_name = nil, sanitize = true, account_name)
+      account_name = sanitize_account_name(account_name) if sanitize
       system_name_ptr = FFI::Pointer::NULL
       begin
         if system_name
@@ -146,6 +147,13 @@ module Puppet::Util::Windows::SID
       end
     end
 
+    # Sanitize the given account name for lookup to avoid known issues
+    def self.sanitize_account_name(account_name)
+      return account_name unless account_name.start_with?('APPLICATION PACKAGE AUTHORITY\\')
+      account_name.split('\\').last
+    end
+    private_class_method :sanitize_account_name
+
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379601(v=vs.85).aspx
@@ -191,4 +199,3 @@ module Puppet::Util::Windows::SID
       [:lpcwstr, :pointer, :lpwstr, :lpdword, :lpwstr, :lpdword, :pointer], :win32_bool
   end
 end
-

data/lib/puppet/util/windows/sid.rb

@@ -74,11 +74,13 @@ module Puppet::Util::Windows
         string_to_sid_ptr(name) do |sid_ptr|
           raw_sid_bytes = sid_ptr.read_array_of_uchar(get_length_sid(sid_ptr))
         end
-      rescue
+      rescue => e
+        Puppet.debug("Could not retrieve raw SID bytes from '#{name}': #{e.message}")
       end
 
       raw_sid_bytes ? Principal.lookup_account_sid(raw_sid_bytes) : Principal.lookup_account_name(name)
-    rescue
+    rescue => e
+      Puppet.debug("#{e.message}")
       (allow_unresolved && raw_sid_bytes) ? unresolved_principal(name, raw_sid_bytes) : nil
     end
     module_function :name_to_principal

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '6.21.1'
+  PUPPETVERSION = '6.22.1'
 
   ##
   # version is a public API method intended to always provide a fast and

data/locales/puppet.pot

@@ -6,11 +6,11 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Puppet automation framework 6.19.1-133-gcc65fe8151\n"
+"Project-Id-Version: Puppet automation framework 6.21.1-62-g86a9c83c34\n"
 "\n"
 "Report-Msgid-Bugs-To: https://tickets.puppetlabs.com\n"
-"POT-Creation-Date: 2021-01-14 12:33+0000\n"
-"PO-Revision-Date: 2021-01-14 12:33+0000\n"
+"POT-Creation-Date: 2021-04-08 09:48+0000\n"
+"PO-Revision-Date: 2021-04-08 09:48+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
@@ -450,59 +450,59 @@ msgstr ""
 msgid "Manage SSL keys and certificates for puppet SSL clients"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:103
+#: ../lib/puppet/application/ssl.rb:106
 msgid "An action must be specified."
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:126 ../lib/puppet/application/ssl.rb:133
+#: ../lib/puppet/application/ssl.rb:129 ../lib/puppet/application/ssl.rb:136
 msgid "The certificate for '%{name}' has not yet been signed"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:144
+#: ../lib/puppet/application/ssl.rb:147
 msgid "Completed SSL initialization"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:146
+#: ../lib/puppet/application/ssl.rb:151
 msgid "Unknown action '%{action}'"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:154 ../lib/puppet/ssl/state_machine.rb:180
+#: ../lib/puppet/application/ssl.rb:165 ../lib/puppet/ssl/state_machine.rb:180
 msgid "Creating a new EC SSL key for %{name} using curve %{curve}"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:157 ../lib/puppet/ssl/key.rb:26
+#: ../lib/puppet/application/ssl.rb:168 ../lib/puppet/ssl/key.rb:26
 msgid "Creating a new SSL key for %{name}"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:167
+#: ../lib/puppet/application/ssl.rb:178
 msgid "Submitted certificate request for '%{name}' to %{url}"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:170
+#: ../lib/puppet/application/ssl.rb:181
 msgid "Could not submit certificate request for '%{name}' to %{url} due to a conflict on the server"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:172 ../lib/puppet/application/ssl.rb:175
+#: ../lib/puppet/application/ssl.rb:183 ../lib/puppet/application/ssl.rb:186
 msgid "Failed to submit certificate request: %{message}"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:183
+#: ../lib/puppet/application/ssl.rb:194
 msgid "Downloading certificate '%{name}' from %{url}"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:187
+#: ../lib/puppet/application/ssl.rb:198
 msgid "Downloaded certificate '%{name}' with fingerprint %{fingerprint}"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:200 ../lib/puppet/application/ssl.rb:203
+#: ../lib/puppet/application/ssl.rb:211 ../lib/puppet/application/ssl.rb:214
 msgid "Failed to download certificate: %{message}"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:232 ../lib/puppet/application/ssl.rb:235
+#: ../lib/puppet/application/ssl.rb:243 ../lib/puppet/application/ssl.rb:246
 msgid "Failed to connect to the CA to determine if certificate %{certname} has been cleaned"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:239
+#: ../lib/puppet/application/ssl.rb:250
 msgid ""
 "The certificate %{certname} must be cleaned from the CA first. To fix this,\n"
 "run the following commands on the CA:\n"
@@ -510,7 +510,7 @@ msgid ""
 "  puppet ssl clean\n"
 msgstr ""
 
-#: ../lib/puppet/application/ssl.rb:262
+#: ../lib/puppet/application/ssl.rb:273
 msgid "Removed %{label} %{path}"
 msgstr ""
 
@@ -587,44 +587,44 @@ msgstr ""
 msgid "Local environment: '%{local_env}' doesn't match server specified environment '%{catalog_env}', restarting agent run with environment '%{catalog_env}'"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:426
+#: ../lib/puppet/configurer.rb:436
 msgid "Failed to apply catalog: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:455 ../lib/puppet/http/resolver/server_list.rb:67
+#: ../lib/puppet/configurer.rb:465 ../lib/puppet/http/resolver/server_list.rb:67
 msgid "Puppet server %{host}:%{port} is unavailable: %{code} %{reason}"
 msgstr ""
 
 #. TRANSLATORS 'server_list' is the name of a setting and should not be translated
-#: ../lib/puppet/configurer.rb:459 ../lib/puppet/http/resolver/server_list.rb:70
+#: ../lib/puppet/configurer.rb:469 ../lib/puppet/http/resolver/server_list.rb:70
 msgid "Unable to connect to server from server_list setting: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:470 ../lib/puppet/face/report.rb:47
+#: ../lib/puppet/configurer.rb:480 ../lib/puppet/face/report.rb:47
 msgid "Could not send report: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:479
+#: ../lib/puppet/configurer.rb:489
 msgid "Could not save last run local report: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:498
+#: ../lib/puppet/configurer.rb:508
 msgid "Uploading facts for %{node} to %{server}"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:506
+#: ../lib/puppet/configurer.rb:516
 msgid "Failed to submit facts: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:521
+#: ../lib/puppet/configurer.rb:531
 msgid "Could not run command from %{setting}: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:539
+#: ../lib/puppet/configurer.rb:549
 msgid "Could not retrieve catalog from cache: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/configurer.rb:560
+#: ../lib/puppet/configurer.rb:570
 msgid "Could not retrieve catalog from remote server: %{detail}"
 msgstr ""
 
@@ -692,47 +692,47 @@ msgstr ""
 msgid "a data type can only have one implementation"
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:179
+#: ../lib/puppet/defaults.rb:191
 msgid "Cannot disable unrecognized warning types '%{invalid}'."
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:180
+#: ../lib/puppet/defaults.rb:192
 msgid "Valid values are '%{values}'."
 msgstr ""
 
 #. TRANSLATORS 'data_binding_terminus' is a setting and should not be translated
-#: ../lib/puppet/defaults.rb:547
+#: ../lib/puppet/defaults.rb:559
 msgid "Setting 'data_binding_terminus' is deprecated."
 msgstr ""
 
 #. TRANSLATORS 'hiera' should not be translated
-#: ../lib/puppet/defaults.rb:549
+#: ../lib/puppet/defaults.rb:561
 msgid "Convert custom terminus to hiera 5 API."
 msgstr ""
 
 #. TRANSLATORS 'environment_data_provider' is a setting and should not be translated
-#: ../lib/puppet/defaults.rb:762
+#: ../lib/puppet/defaults.rb:774
 msgid "Setting 'environment_data_provider' is deprecated."
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:847
+#: ../lib/puppet/defaults.rb:859
 msgid "Certificate names must be lower case"
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:1042
+#: ../lib/puppet/defaults.rb:1054
 msgid "Setting 'ssl_client_ca_auth' is deprecated."
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:1121 ../lib/puppet/settings/enum_setting.rb:13 ../lib/puppet/settings/symbolic_enum_setting.rb:14
+#: ../lib/puppet/defaults.rb:1141 ../lib/puppet/settings/enum_setting.rb:13 ../lib/puppet/settings/symbolic_enum_setting.rb:14
 msgid "Invalid value '%{value}' for parameter %{name}. Allowed values are '%{allowed_values}'"
 msgstr ""
 
 #. TRANSLATORS 'pluginsync' is a setting and should not be translated
-#: ../lib/puppet/defaults.rb:1995
+#: ../lib/puppet/defaults.rb:2015
 msgid "Setting 'pluginsync' is deprecated."
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:2230
+#: ../lib/puppet/defaults.rb:2250
 msgid "The 'func3x_check' setting is deprecated and will be removed in a future release."
 msgstr ""
 
@@ -778,7 +778,7 @@ msgstr ""
 msgid "no matching resources found"
 msgstr ""
 
-#: ../lib/puppet/face/config.rb:7 ../lib/puppet/face/epp.rb:8 ../lib/puppet/face/facts.rb:30 ../lib/puppet/face/generate.rb:7 ../lib/puppet/face/help.rb:9 ../lib/puppet/face/key.rb:5 ../lib/puppet/face/man.rb:8 ../lib/puppet/face/module.rb:9 ../lib/puppet/face/node.rb:4 ../lib/puppet/face/parser.rb:6 ../lib/puppet/face/plugin.rb:6 ../lib/puppet/face/report.rb:5 ../lib/puppet/face/resource.rb:5 ../lib/puppet/face/status.rb:5
+#: ../lib/puppet/face/config.rb:7 ../lib/puppet/face/epp.rb:8 ../lib/puppet/face/facts.rb:22 ../lib/puppet/face/generate.rb:7 ../lib/puppet/face/help.rb:9 ../lib/puppet/face/key.rb:5 ../lib/puppet/face/man.rb:8 ../lib/puppet/face/module.rb:9 ../lib/puppet/face/node.rb:4 ../lib/puppet/face/parser.rb:6 ../lib/puppet/face/plugin.rb:6 ../lib/puppet/face/report.rb:5 ../lib/puppet/face/resource.rb:5 ../lib/puppet/face/status.rb:5
 msgid "Apache 2 license; see COPYING"
 msgstr ""
 
@@ -1015,34 +1015,86 @@ msgstr ""
 msgid "--values option must evaluate to a Hash or undef, got: '%{values_class}'"
 msgstr ""
 
-#: ../lib/puppet/face/facts.rb:32
+#: ../lib/puppet/face/facts.rb:24
 msgid "Retrieve and store facts."
 msgstr ""
 
-#: ../lib/puppet/face/facts.rb:40
+#: ../lib/puppet/face/facts.rb:32
 msgid "Retrieve a node's facts."
 msgstr ""
 
-#: ../lib/puppet/face/facts.rb:41
+#: ../lib/puppet/face/facts.rb:33
 msgid "[<node_certname>]"
 msgstr ""
 
-#: ../lib/puppet/face/facts.rb:64
+#: ../lib/puppet/face/facts.rb:56
 msgid "Upload local facts to the puppet master."
 msgstr ""
 
-#: ../lib/puppet/face/facts.rb:106
+#: ../lib/puppet/face/facts.rb:98
 msgid "Uploading facts for '%{node}' to '%{server}'"
 msgstr ""
 
-#: ../lib/puppet/face/facts.rb:116
+#: ../lib/puppet/face/facts.rb:108
 msgid "Compare Facter 3 output with Facter 4 output"
 msgstr ""
 
-#: ../lib/puppet/face/facts.rb:145
+#: ../lib/puppet/face/facts.rb:122
+msgid "Render the different facts as structured."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:125
+msgid "<regex>"
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:126
+msgid "Regex used to exclude specific facts from diff."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:151
 msgid "Already using Facter 4. To use `puppet facts diff` remove facterng from the .conf file or run `puppet config set facterng false`."
 msgstr ""
 
+#: ../lib/puppet/face/facts.rb:167
+msgid "Retrieve current node's facts."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:168
+msgid "[<facts>]"
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:183 ../lib/puppet/face/facts.rb:188 ../lib/puppet/face/facts.rb:193 ../lib/puppet/face/module/changes.rb:21
+msgid "<path>"
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:185
+msgid "The location of the config file for Facter."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:190
+msgid "The path to a directory that contains custom facts."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:195
+msgid "The path to a directory that contains external facts."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:199
+msgid "Disable fact blocking mechanism."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:203
+msgid "Disable fact caching mechanism."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:207
+msgid "Show legacy facts when querying all facts."
+msgstr ""
+
+#: ../lib/puppet/face/facts.rb:211
+msgid "Show only the value when the action is called with a single query"
+msgstr ""
+
 #: ../lib/puppet/face/generate.rb:9
 msgid "Generates Puppet code from Ruby definitions."
 msgstr ""
@@ -1206,10 +1258,6 @@ msgstr ""
 msgid "Array of strings representing paths of modified files."
 msgstr ""
 
-#: ../lib/puppet/face/module/changes.rb:21
-msgid "<path>"
-msgstr ""
-
 #: ../lib/puppet/face/module/changes.rb:27
 msgid "Could not find a valid module at %{path}"
 msgstr ""
@@ -1844,11 +1892,11 @@ msgstr ""
 msgid "%{dest} already exists and the :force option was not specified"
 msgstr ""
 
-#: ../lib/puppet/file_system/windows.rb:202
+#: ../lib/puppet/file_system/windows.rb:204
 msgid "This version of Windows does not support symlinks.  Windows Vista / 2008 or higher is required."
 msgstr ""
 
-#: ../lib/puppet/file_system/windows.rb:207
+#: ../lib/puppet/file_system/windows.rb:209
 msgid "The current user does not have the necessary permission to manage symlinks."
 msgstr ""
 
@@ -2546,7 +2594,11 @@ msgstr ""
 msgid "You cannot save facts to the code store; it is only used for getting facts from Facter"
 msgstr ""
 
-#: ../lib/puppet/indirector/facts/facter.rb:56
+#: ../lib/puppet/indirector/facts/facter.rb:36
+msgid "puppet facts show requires version 4.0.40 or greater of Facter."
+msgstr ""
+
+#: ../lib/puppet/indirector/facts/facter.rb:62
 msgid "Loading facts"
 msgstr ""
 
@@ -2999,8 +3051,8 @@ msgstr ""
 msgid "Option %{option} conflicts with existing option %{conflict} on %{face}"
 msgstr ""
 
-#. TRANSLATORS 'Puppet.settings' references to the Puppet settings options and should not be translated
 #. TRANSLATORS 'Puppet.settings' should not be translated
+#. TRANSLATORS 'Puppet.settings' references to the Puppet settings options and should not be translated
 #: ../lib/puppet/interface/action.rb:315 ../lib/puppet/interface/option_manager.rb:14
 msgid "Global option %{option} does not exist in Puppet.settings"
 msgstr ""
@@ -6824,26 +6876,30 @@ msgstr ""
 msgid "Mac OS X packages must specify a package source"
 msgstr ""
 
-#: ../lib/puppet/provider/package/apt.rb:85
+#: ../lib/puppet/provider/package/apt.rb:89
 msgid "/etc/apt/sources.list contains a cdrom source; not installing.  Use 'allowcdrom' to override this failure."
 msgstr ""
 
-#: ../lib/puppet/provider/package/apt.rb:167 ../lib/puppet/provider/package/fink.rb:55
+#: ../lib/puppet/provider/package/apt.rb:172 ../lib/puppet/provider/package/aptitude.rb:21 ../lib/puppet/provider/package/ports.rb:20 ../lib/puppet/provider/package/portupgrade.rb:94 ../lib/puppet/provider/package/portupgrade.rb:152 ../lib/puppet/provider/package/rug.rb:28 ../lib/puppet/provider/package/up2date.rb:17 ../lib/puppet/provider/package/yum.rb:312 ../lib/puppet/provider/package/zypper.rb:146
+msgid "Could not find package %{name}"
+msgstr ""
+
+#: ../lib/puppet/provider/package/apt.rb:176 ../lib/puppet/provider/package/yum.rb:317
+msgid "Failed to update to version %{should}, got version %{version} instead"
+msgstr ""
+
+#: ../lib/puppet/provider/package/apt.rb:189 ../lib/puppet/provider/package/fink.rb:55
 msgid "Could not find latest version"
 msgstr ""
 
-#: ../lib/puppet/provider/package/apt.rb:178 ../lib/puppet/provider/package/fink.rb:66
+#: ../lib/puppet/provider/package/apt.rb:200 ../lib/puppet/provider/package/fink.rb:66
 msgid "Preseeding %{response} to debconf-set-selections"
 msgstr ""
 
-#: ../lib/puppet/provider/package/apt.rb:182 ../lib/puppet/provider/package/fink.rb:70
+#: ../lib/puppet/provider/package/apt.rb:204 ../lib/puppet/provider/package/fink.rb:70
 msgid "No responsefile specified or non existent, not preseeding anything"
 msgstr ""
 
-#: ../lib/puppet/provider/package/aptitude.rb:21 ../lib/puppet/provider/package/ports.rb:20 ../lib/puppet/provider/package/portupgrade.rb:94 ../lib/puppet/provider/package/portupgrade.rb:152 ../lib/puppet/provider/package/rug.rb:28 ../lib/puppet/provider/package/up2date.rb:17 ../lib/puppet/provider/package/yum.rb:312 ../lib/puppet/provider/package/zypper.rb:146
-msgid "Could not find package %{name}"
-msgstr ""
-
 #: ../lib/puppet/provider/package/aptrpm.rb:53
 msgid "Could not match version '%{version}'"
 msgstr ""
@@ -7179,10 +7235,6 @@ msgstr ""
 msgid "Could not find package %{wanted}"
 msgstr ""
 
-#: ../lib/puppet/provider/package/yum.rb:317
-msgid "Failed to update to version %{should}, got version %{version} instead"
-msgstr ""
-
 #: ../lib/puppet/provider/package_targetable.rb:56
 msgid "Provider %{name} package command is not functional on this host"
 msgstr ""
@@ -7694,24 +7746,24 @@ msgstr ""
 msgid "Setting %{name} is deprecated in puppet.conf."
 msgstr ""
 
-#: ../lib/puppet/settings.rb:1435
+#: ../lib/puppet/settings.rb:1445
 msgid "Error converting value for param '%{name}': %{detail}"
 msgstr ""
 
-#: ../lib/puppet/settings.rb:1459
+#: ../lib/puppet/settings.rb:1469
 msgid "Could not find value for %{expression}"
 msgstr ""
 
 #. TRANSLATORS '$environment' is a Puppet specific variable and should not be translated
-#: ../lib/puppet/settings.rb:1469
+#: ../lib/puppet/settings.rb:1479
 msgid "You cannot interpolate $environment within '%{setting_name}' when using directory environments."
 msgstr ""
 
-#: ../lib/puppet/settings.rb:1470
+#: ../lib/puppet/settings.rb:1480
 msgid "Its value will remain %{value}."
 msgstr ""
 
-#: ../lib/puppet/settings.rb:1501
+#: ../lib/puppet/settings.rb:1511
 msgid "Attempt to assign a value to unknown setting %{name}"
 msgstr ""
 
@@ -7805,19 +7857,19 @@ msgid "Invalid duration format '%{value}' for parameter: %{name}"
 msgstr ""
 
 #. TRANSLATORS 'disable_per_environment_manifest' is a setting and 'environment.conf' is a file name and should not be translated
-#: ../lib/puppet/settings/environment_conf.rb:69
+#: ../lib/puppet/settings/environment_conf.rb:70
 msgid "The 'disable_per_environment_manifest' setting is true, but the environment located at %{path_to_env} has a manifest setting in its environment.conf of '%{environment_conf}' which does not match the default_manifest setting '%{puppet_conf}'."
 msgstr ""
 
-#: ../lib/puppet/settings/environment_conf.rb:71
+#: ../lib/puppet/settings/environment_conf.rb:72
 msgid "If this environment is expecting to find modules in '%{environment_conf}', they will not be available!"
 msgstr ""
 
-#: ../lib/puppet/settings/environment_conf.rb:141
+#: ../lib/puppet/settings/environment_conf.rb:142
 msgid "Invalid sections in environment.conf at '%{path_to_conf_file}'. Environment conf may not have sections. The following sections are being ignored: '%{sections}'"
 msgstr ""
 
-#: ../lib/puppet/settings/environment_conf.rb:153
+#: ../lib/puppet/settings/environment_conf.rb:154
 msgid "Invalid settings in environment.conf at '%{path_to_conf_file}'. The following unknown setting(s) are being ignored: %{ignored_settings}"
 msgstr ""
 
@@ -9912,15 +9964,15 @@ msgstr ""
 msgid "Unrecognized ADS UserFlags: %{unrecognized_flags}"
 msgstr ""
 
-#: ../lib/puppet/util/windows/adsi.rb:497
+#: ../lib/puppet/util/windows/adsi.rb:497 ../lib/puppet/util/windows/adsi.rb:530
 msgid "Failed to get user name"
 msgstr ""
 
-#: ../lib/puppet/util/windows/adsi.rb:534
+#: ../lib/puppet/util/windows/adsi.rb:580
 msgid "Cannot delete user profile for '%{sid}' prior to Vista SP1"
 msgstr ""
 
-#: ../lib/puppet/util/windows/adsi.rb:552
+#: ../lib/puppet/util/windows/adsi.rb:598
 msgid "Cannot create group if user '%{name}' exists."
 msgstr ""
 
@@ -9983,20 +10035,20 @@ msgstr ""
 msgid "Failed to call GetLongPathName"
 msgstr ""
 
-#: ../lib/puppet/util/windows/principal.rb:67 ../lib/puppet/util/windows/principal.rb:74
+#: ../lib/puppet/util/windows/principal.rb:68 ../lib/puppet/util/windows/principal.rb:75
 msgid "Failed to call LookupAccountNameW with account: %{account_name}"
 msgstr ""
 
 #. TRANSLATORS `lookup_account_sid` is a variable name and should not be translated
-#: ../lib/puppet/util/windows/principal.rb:97
+#: ../lib/puppet/util/windows/principal.rb:98
 msgid "Byte array for lookup_account_sid must not be nil and must be at least 1 byte long"
 msgstr ""
 
-#: ../lib/puppet/util/windows/principal.rb:114
+#: ../lib/puppet/util/windows/principal.rb:115
 msgid "Byte array for lookup_account_sid is invalid: %{sid_bytes}"
 msgstr ""
 
-#: ../lib/puppet/util/windows/principal.rb:122 ../lib/puppet/util/windows/principal.rb:129
+#: ../lib/puppet/util/windows/principal.rb:123 ../lib/puppet/util/windows/principal.rb:130
 msgid "Failed to call LookupAccountSidW with bytes: %{sid_bytes}"
 msgstr ""
 
@@ -10106,7 +10158,7 @@ msgstr ""
 msgid "An attempt to set mode %{mode} on item %{path} would result in the group, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:433 ../lib/puppet/util/windows/security.rb:450 ../lib/puppet/util/windows/sid.rb:155 ../lib/puppet/util/windows/sid.rb:217 ../lib/puppet/util/windows/user.rb:59
+#: ../lib/puppet/util/windows/security.rb:433 ../lib/puppet/util/windows/security.rb:450 ../lib/puppet/util/windows/sid.rb:157 ../lib/puppet/util/windows/sid.rb:219 ../lib/puppet/util/windows/user.rb:59
 msgid "Invalid SID"
 msgstr ""
 
@@ -10262,19 +10314,19 @@ msgstr ""
 msgid "Timed out while waiting for the pending transition from %{pending_state} to %{final_state} to finish. The current state is %{current_state}."
 msgstr ""
 
-#: ../lib/puppet/util/windows/sid.rb:94
+#: ../lib/puppet/util/windows/sid.rb:96
 msgid "Octet string must be an array of bytes"
 msgstr ""
 
-#: ../lib/puppet/util/windows/sid.rb:161
+#: ../lib/puppet/util/windows/sid.rb:163
 msgid "Failed to convert binary SID"
 msgstr ""
 
-#: ../lib/puppet/util/windows/sid.rb:166
+#: ../lib/puppet/util/windows/sid.rb:168
 msgid "ConvertSidToStringSidW failed to allocate buffer for sid"
 msgstr ""
 
-#: ../lib/puppet/util/windows/sid.rb:186
+#: ../lib/puppet/util/windows/sid.rb:188
 msgid "Failed to convert string SID: %{string_sid}"
 msgstr ""