puppet 6.21.1 → 6.25.0

data/lib/puppet/pops/parser/lexer2.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # The Lexer is responsible for turning source text into tokens.
 # This version is a performance enhanced lexer (in comparison to the 3.x and earlier "future parser" lexer.
 #
@@ -30,114 +31,114 @@ class Lexer2
   # The length is pre-calculated for all singleton tokens. The length is used both to signal the length of
   # the token, and to advance the scanner position (without having to advance it with a scan(regexp)).
   #
-  TOKEN_LBRACK       = [:LBRACK,       '['.freeze,   1].freeze
-  TOKEN_LISTSTART    = [:LISTSTART,    '['.freeze,   1].freeze
-  TOKEN_RBRACK       = [:RBRACK,       ']'.freeze,   1].freeze
-  TOKEN_LBRACE       = [:LBRACE,       '{'.freeze,   1].freeze
-  TOKEN_RBRACE       = [:RBRACE,       '}'.freeze,   1].freeze
-  TOKEN_SELBRACE     = [:SELBRACE,     '{'.freeze,   1].freeze
-  TOKEN_LPAREN       = [:LPAREN,       '('.freeze,   1].freeze
-  TOKEN_WSLPAREN     = [:WSLPAREN,     '('.freeze,   1].freeze
-  TOKEN_RPAREN       = [:RPAREN,       ')'.freeze,   1].freeze
-
-  TOKEN_EQUALS       = [:EQUALS,       '='.freeze,   1].freeze
-  TOKEN_APPENDS      = [:APPENDS,      '+='.freeze,  2].freeze
-  TOKEN_DELETES      = [:DELETES,      '-='.freeze,  2].freeze
-
-  TOKEN_ISEQUAL      = [:ISEQUAL,      '=='.freeze,  2].freeze
-  TOKEN_NOTEQUAL     = [:NOTEQUAL,     '!='.freeze,  2].freeze
-  TOKEN_MATCH        = [:MATCH,        '=~'.freeze,  2].freeze
-  TOKEN_NOMATCH      = [:NOMATCH,      '!~'.freeze,  2].freeze
-  TOKEN_GREATEREQUAL = [:GREATEREQUAL, '>='.freeze,  2].freeze
-  TOKEN_GREATERTHAN  = [:GREATERTHAN,  '>'.freeze,   1].freeze
-  TOKEN_LESSEQUAL    = [:LESSEQUAL,    '<='.freeze,  2].freeze
-  TOKEN_LESSTHAN     = [:LESSTHAN,     '<'.freeze,   1].freeze
-
-  TOKEN_FARROW       = [:FARROW,       '=>'.freeze,  2].freeze
-  TOKEN_PARROW       = [:PARROW,       '+>'.freeze,  2].freeze
-
-  TOKEN_LSHIFT       = [:LSHIFT,       '<<'.freeze,  2].freeze
-  TOKEN_LLCOLLECT    = [:LLCOLLECT,    '<<|'.freeze, 3].freeze
-  TOKEN_LCOLLECT     = [:LCOLLECT,     '<|'.freeze,  2].freeze
-
-  TOKEN_RSHIFT       = [:RSHIFT,       '>>'.freeze,  2].freeze
-  TOKEN_RRCOLLECT    = [:RRCOLLECT,    '|>>'.freeze, 3].freeze
-  TOKEN_RCOLLECT     = [:RCOLLECT,     '|>'.freeze,  2].freeze
-
-  TOKEN_PLUS         = [:PLUS,         '+'.freeze,   1].freeze
-  TOKEN_MINUS        = [:MINUS,        '-'.freeze,   1].freeze
-  TOKEN_DIV          = [:DIV,          '/'.freeze,   1].freeze
-  TOKEN_TIMES        = [:TIMES,        '*'.freeze,   1].freeze
-  TOKEN_MODULO       = [:MODULO,       '%'.freeze,   1].freeze
-
-  TOKEN_NOT          = [:NOT,          '!'.freeze,   1].freeze
-  TOKEN_DOT          = [:DOT,          '.'.freeze,   1].freeze
-  TOKEN_PIPE         = [:PIPE,         '|'.freeze,   1].freeze
-  TOKEN_AT           = [:AT ,          '@'.freeze,   1].freeze
-  TOKEN_ATAT         = [:ATAT ,        '@@'.freeze,  2].freeze
-  TOKEN_COLON        = [:COLON,        ':'.freeze,   1].freeze
-  TOKEN_COMMA        = [:COMMA,        ','.freeze,   1].freeze
-  TOKEN_SEMIC        = [:SEMIC,        ';'.freeze,   1].freeze
-  TOKEN_QMARK        = [:QMARK,        '?'.freeze,   1].freeze
-  TOKEN_TILDE        = [:TILDE,        '~'.freeze,   1].freeze # lexed but not an operator in Puppet
+  TOKEN_LBRACK       = [:LBRACK,       '[',   1].freeze
+  TOKEN_LISTSTART    = [:LISTSTART,    '[',   1].freeze
+  TOKEN_RBRACK       = [:RBRACK,       ']',   1].freeze
+  TOKEN_LBRACE       = [:LBRACE,       '{',   1].freeze
+  TOKEN_RBRACE       = [:RBRACE,       '}',   1].freeze
+  TOKEN_SELBRACE     = [:SELBRACE,     '{',   1].freeze
+  TOKEN_LPAREN       = [:LPAREN,       '(',   1].freeze
+  TOKEN_WSLPAREN     = [:WSLPAREN,     '(',   1].freeze
+  TOKEN_RPAREN       = [:RPAREN,       ')',   1].freeze
+
+  TOKEN_EQUALS       = [:EQUALS,       '=',   1].freeze
+  TOKEN_APPENDS      = [:APPENDS,      '+=',  2].freeze
+  TOKEN_DELETES      = [:DELETES,      '-=',  2].freeze
+
+  TOKEN_ISEQUAL      = [:ISEQUAL,      '==',  2].freeze
+  TOKEN_NOTEQUAL     = [:NOTEQUAL,     '!=',  2].freeze
+  TOKEN_MATCH        = [:MATCH,        '=~',  2].freeze
+  TOKEN_NOMATCH      = [:NOMATCH,      '!~',  2].freeze
+  TOKEN_GREATEREQUAL = [:GREATEREQUAL, '>=',  2].freeze
+  TOKEN_GREATERTHAN  = [:GREATERTHAN,  '>',   1].freeze
+  TOKEN_LESSEQUAL    = [:LESSEQUAL,    '<=',  2].freeze
+  TOKEN_LESSTHAN     = [:LESSTHAN,     '<',   1].freeze
+
+  TOKEN_FARROW       = [:FARROW,       '=>',  2].freeze
+  TOKEN_PARROW       = [:PARROW,       '+>',  2].freeze
+
+  TOKEN_LSHIFT       = [:LSHIFT,       '<<',  2].freeze
+  TOKEN_LLCOLLECT    = [:LLCOLLECT,    '<<|', 3].freeze
+  TOKEN_LCOLLECT     = [:LCOLLECT,     '<|',  2].freeze
+
+  TOKEN_RSHIFT       = [:RSHIFT,       '>>',  2].freeze
+  TOKEN_RRCOLLECT    = [:RRCOLLECT,    '|>>', 3].freeze
+  TOKEN_RCOLLECT     = [:RCOLLECT,     '|>',  2].freeze
+
+  TOKEN_PLUS         = [:PLUS,         '+',   1].freeze
+  TOKEN_MINUS        = [:MINUS,        '-',   1].freeze
+  TOKEN_DIV          = [:DIV,          '/',   1].freeze
+  TOKEN_TIMES        = [:TIMES,        '*',   1].freeze
+  TOKEN_MODULO       = [:MODULO,       '%',   1].freeze
+
+  TOKEN_NOT          = [:NOT,          '!',   1].freeze
+  TOKEN_DOT          = [:DOT,          '.',   1].freeze
+  TOKEN_PIPE         = [:PIPE,         '|',   1].freeze
+  TOKEN_AT           = [:AT ,          '@',   1].freeze
+  TOKEN_ATAT         = [:ATAT ,        '@@',  2].freeze
+  TOKEN_COLON        = [:COLON,        ':',   1].freeze
+  TOKEN_COMMA        = [:COMMA,        ',',   1].freeze
+  TOKEN_SEMIC        = [:SEMIC,        ';',   1].freeze
+  TOKEN_QMARK        = [:QMARK,        '?',   1].freeze
+  TOKEN_TILDE        = [:TILDE,        '~',   1].freeze # lexed but not an operator in Puppet
 
   TOKEN_REGEXP       = [:REGEXP,       nil,   0].freeze
 
-  TOKEN_IN_EDGE      = [:IN_EDGE,      '->'.freeze,  2].freeze
-  TOKEN_IN_EDGE_SUB  = [:IN_EDGE_SUB,  '~>'.freeze,  2].freeze
-  TOKEN_OUT_EDGE     = [:OUT_EDGE,     '<-'.freeze,  2].freeze
-  TOKEN_OUT_EDGE_SUB = [:OUT_EDGE_SUB, '<~'.freeze,  2].freeze
+  TOKEN_IN_EDGE      = [:IN_EDGE,      '->',  2].freeze
+  TOKEN_IN_EDGE_SUB  = [:IN_EDGE_SUB,  '~>',  2].freeze
+  TOKEN_OUT_EDGE     = [:OUT_EDGE,     '<-',  2].freeze
+  TOKEN_OUT_EDGE_SUB = [:OUT_EDGE_SUB, '<~',  2].freeze
 
   # Tokens that are always unique to what has been lexed
-  TOKEN_STRING         =  [:STRING, nil,          0].freeze
-  TOKEN_WORD           =  [:WORD, nil,            0].freeze
-  TOKEN_DQPRE          =  [:DQPRE,  nil,          0].freeze
-  TOKEN_DQMID          =  [:DQPRE,  nil,          0].freeze
-  TOKEN_DQPOS          =  [:DQPRE,  nil,          0].freeze
-  TOKEN_NUMBER         =  [:NUMBER, nil,          0].freeze
-  TOKEN_VARIABLE       =  [:VARIABLE, nil,        1].freeze
-  TOKEN_VARIABLE_EMPTY =  [:VARIABLE, ''.freeze,  1].freeze
+  TOKEN_STRING         = [:STRING,      nil,  0].freeze
+  TOKEN_WORD           = [:WORD,        nil,  0].freeze
+  TOKEN_DQPRE          = [:DQPRE,       nil,  0].freeze
+  TOKEN_DQMID          = [:DQPRE,       nil,  0].freeze
+  TOKEN_DQPOS          = [:DQPRE,       nil,  0].freeze
+  TOKEN_NUMBER         = [:NUMBER,      nil,  0].freeze
+  TOKEN_VARIABLE       = [:VARIABLE,    nil,  1].freeze
+  TOKEN_VARIABLE_EMPTY = [:VARIABLE,    '',   1].freeze
 
   # HEREDOC has syntax as an argument.
-  TOKEN_HEREDOC        =  [:HEREDOC, nil, 0].freeze
+  TOKEN_HEREDOC        = [:HEREDOC,     nil,  0].freeze
 
   # EPP_START is currently a marker token, may later get syntax
-  TOKEN_EPPSTART       =  [:EPP_START, nil, 0].freeze
-  TOKEN_EPPEND         =  [:EPP_END, '%>', 2].freeze
-  TOKEN_EPPEND_TRIM    =  [:EPP_END_TRIM, '-%>', 3].freeze
+  TOKEN_EPPSTART    = [:EPP_START,      nil,  0].freeze
+  TOKEN_EPPEND      = [:EPP_END,       '%>',  2].freeze
+  TOKEN_EPPEND_TRIM = [:EPP_END_TRIM, '-%>',  3].freeze
 
   # This is used for unrecognized tokens, will always be a single character. This particular instance
   # is not used, but is kept here for documentation purposes.
-  TOKEN_OTHER        = [:OTHER,  nil,  0]
+  TOKEN_OTHER = [:OTHER, nil, 0]
 
   # Keywords are all singleton tokens with pre calculated lengths.
   # Booleans are pre-calculated (rather than evaluating the strings "false" "true" repeatedly.
   #
   KEYWORDS = {
-    'case'     => [:CASE,     'case',     4],
-    'class'    => [:CLASS,    'class',    5],
-    'default'  => [:DEFAULT,  'default',  7],
-    'define'   => [:DEFINE,   'define',   6],
-    'if'       => [:IF,       'if',       2],
-    'elsif'    => [:ELSIF,    'elsif',    5],
-    'else'     => [:ELSE,     'else',     4],
-    'inherits' => [:INHERITS, 'inherits', 8],
-    'node'     => [:NODE,     'node',     4],
-    'and'      => [:AND,      'and',      3],
-    'or'       => [:OR,       'or',       2],
-    'undef'    => [:UNDEF,    'undef',    5],
-    'false'    => [:BOOLEAN,  false,      5],
-    'true'     => [:BOOLEAN,  true,       4],
-    'in'       => [:IN,       'in',       2],
-    'unless'   => [:UNLESS,   'unless',   6],
-    'function' => [:FUNCTION, 'function', 8],
-    'type'     => [:TYPE,     'type',     4],
-    'attr'     => [:ATTR,     'attr',     4],
-    'private'  => [:PRIVATE,  'private',  7],
-    'application' => [:APPLICATION, 'application',  11],
-    'consumes'    => [:CONSUMES,    'consumes',  8],
-    'produces'    => [:PRODUCES,    'produces',  8],
-    'site'        => [:SITE,        'site',  4],
+    'case'        => [:CASE,        'case',         4],
+    'class'       => [:CLASS,       'class',        5],
+    'default'     => [:DEFAULT,     'default',      7],
+    'define'      => [:DEFINE,      'define',       6],
+    'if'          => [:IF,          'if',           2],
+    'elsif'       => [:ELSIF,       'elsif',        5],
+    'else'        => [:ELSE,        'else',         4],
+    'inherits'    => [:INHERITS,    'inherits',     8],
+    'node'        => [:NODE,        'node',         4],
+    'and'         => [:AND,         'and',          3],
+    'or'          => [:OR,          'or',           2],
+    'undef'       => [:UNDEF,       'undef',        5],
+    'false'       => [:BOOLEAN,     false,          5],
+    'true'        => [:BOOLEAN,     true,           4],
+    'in'          => [:IN,          'in',           2],
+    'unless'      => [:UNLESS,      'unless',       6],
+    'function'    => [:FUNCTION,    'function',     8],
+    'type'        => [:TYPE,        'type',         4],
+    'attr'        => [:ATTR,        'attr',         4],
+    'private'     => [:PRIVATE,     'private',      7],
+    'application' => [:APPLICATION, 'application', 11],
+    'consumes'    => [:CONSUMES,    'consumes',     8],
+    'produces'    => [:PRODUCES,    'produces',     8],
+    'site'        => [:SITE,        'site',         4],
   }
 
   KEYWORDS.each {|k,v| v[1].freeze; v.freeze }

data/lib/puppet/pops/parser/slurp_support.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Puppet::Pops
 module Parser
 # This module is an integral part of the Lexer.

data/lib/puppet/pops/serialization/to_data_converter.rb

@@ -14,6 +14,8 @@ module Serialization
     # @option options [Boolean] :local_reference use local references instead of duplicating complex entries
     # @option options [Boolean] :type_by_reference `true` if Object types are converted to references rather than embedded.
     # @option options [Boolean] :symbol_as_string `true` if Symbols should be converted to strings (with type loss)
+    # @option options [Boolean] :force_symbol `false` if Symbols should not be converted (rich_data and symbol_as_string must be false)
+    # @option options [Boolean] :silence_warnings `false` if warnings should be silenced
     # @option options [String] :message_prefix String to prepend to in warnings and errors
     # @return [Data] the processed result. An object assignable to `Data`.
     #
@@ -41,6 +43,12 @@ module Serialization
       @symbol_as_string = options[:symbol_as_string]
       @symbol_as_string = false if @symbol_as_string.nil?
 
+      @force_symbol = options[:force_symbol]
+      @force_symbol = false if @force_symbol.nil?
+
+      @silence_warnings = options[:silence_warnings]
+      @silence_warnings = false if @silence_warnings.nil?
+
       @rich_data = options[:rich_data]
       @rich_data = false if @rich_data.nil?
 
@@ -92,7 +100,11 @@ module Serialization
         elsif @rich_data
           { PCORE_TYPE_KEY => PCORE_TYPE_SYMBOL, PCORE_VALUE_KEY => value.to_s }
         else
-          unknown_to_string_with_warning(value)
+          if @force_symbol
+            value
+          else
+            @silence_warnings ? unknown_to_string(value) : unknown_to_string_with_warning(value)
+          end
         end
       elsif value.instance_of?(Array)
         process(value) do
@@ -117,7 +129,11 @@ module Serialization
           { PCORE_TYPE_KEY => PCORE_TYPE_SENSITIVE, PCORE_VALUE_KEY => to_data(value.unwrap) }
         end
       else
-        unknown_to_data(value)
+        if @rich_data
+          value_to_data_hash(value)
+        else
+          @silence_warnings ? unknown_to_string(value) : unknown_to_string_with_warning(value)
+        end
       end
     end
 
@@ -191,10 +207,6 @@ module Serialization
       v
     end
 
-    def unknown_to_data(value)
-      @rich_data ? value_to_data_hash(value) : unknown_to_string_with_warning(value)
-    end
-
     def unknown_key_to_string_with_warning(value)
       str = unknown_to_string(value)
       serialization_issue(Issues::SERIALIZATION_UNKNOWN_KEY_CONVERTED_TO_STRING, :path => path_to_s, :klass => value.class, :value => str)

data/lib/puppet/pops/serialization/to_stringified_converter.rb

@@ -62,7 +62,7 @@ module Serialization
     end
 
     def to_data(value)
-      if value.is_a?(String)
+      if value.instance_of?(String)
         to_string_or_binary(value)
       elsif value.nil? || Types::PScalarDataType::DEFAULT.instance?(value)
         value

data/lib/puppet/pops/types/p_sem_ver_type.rb

@@ -95,16 +95,22 @@ class PSemVerType < PScalarType
       end
 
       def from_args(major, minor, patch, prerelease = nil, build = nil)
-        SemanticPuppet::Version.new(major, minor, patch, prerelease, build)
+        SemanticPuppet::Version.new(major, minor, patch, to_array(prerelease), to_array(build))
       end
 
       def from_hash(hash)
-        SemanticPuppet::Version.new(hash['major'], hash['minor'], hash['patch'], hash['prerelease'], hash['build'])
+        SemanticPuppet::Version.new(hash['major'], hash['minor'], hash['patch'], to_array(hash['prerelease']), to_array(hash['build']))
       end
 
       def on_error(str)
         _("The string '%{str}' cannot be converted to a SemVer") % { str: str }
       end
+
+      private
+
+      def to_array(component)
+        component ? [component] : nil
+      end
     end
   end
 

data/lib/puppet/pops/types/p_sensitive_type.rb

@@ -24,6 +24,16 @@ class PSensitiveType < PTypeWithContainedType
     def inspect
       "#<#{self}>"
     end
+
+    def hash
+      @value.hash
+    end
+
+    def ==(other)
+      other.is_a?(Sensitive) &&
+        other.hash == hash
+    end
+    alias eql? ==
   end
 
   def self.register_ptype(loader, ir)

data/lib/puppet/pops/types/type_formatter.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'puppet/concurrent/thread_local_singleton'
 
 module Puppet::Pops
@@ -22,7 +23,7 @@ class TypeFormatter
   end
 
   def initialize
-    @string_visitor = Visitor.new(nil, 'string',0,0)
+    @string_visitor = Visitor.new(nil, 'string', 0, 0)
   end
 
   def expanded
@@ -49,7 +50,7 @@ class TypeFormatter
   # @api public
   #
   def string(t)
-    @bld = ''
+    @bld = ''.dup
     append_string(t)
     @bld
   end
@@ -63,7 +64,7 @@ class TypeFormatter
   #
   # @api public
   def indented_string(t, indent = 0, indent_width = 2)
-    @bld = ''
+    @bld = ''.dup
     append_indented_string(t, indent, indent_width)
     @bld
   end

data/lib/puppet/pops/types/type_mismatch_describer.rb

@@ -640,7 +640,7 @@ module Types
           result = ["#{label} expects (#{signature_string(sig)})"]
           result.concat(error_arrays[0].map { |e| "  rejected:#{e.chop_path(0).format}" })
         else
-          result = ["#{label} expects one of:"]
+          result = ["The function #{label} was called with arguments it does not accept. It expects one of:"]
           signatures.each_with_index do |sg, index|
             result << "  (#{signature_string(sg)})"
             result.concat(error_arrays[index].map { |e| "    rejected:#{e.chop_path(0).format}" })

data/lib/puppet/pops/types/types.rb

@@ -736,7 +736,7 @@ class PScalarDataType < PScalarType
   end
 
   def instance?(o, guard = nil)
-    return o.is_a?(String) || o.is_a?(Integer) || o.is_a?(Float) || o.is_a?(TrueClass) || o.is_a?(FalseClass)
+    return o.instance_of?(String) || o.is_a?(Integer) || o.is_a?(Float) || o.is_a?(TrueClass) || o.is_a?(FalseClass)
   end
 
   DEFAULT = PScalarDataType.new

data/lib/puppet/provider/aix_object.rb

@@ -279,7 +279,7 @@ class Puppet::Provider::AixObject < Puppet::Provider
         name = object[:name]
         id = object[:attributes].delete(:id)
 
-        Hash[[[:name, name,],[:id, id]]]
+        { name: name, id: id }
       end
     end
 

data/lib/puppet/provider/exec/posix.rb

@@ -6,10 +6,22 @@ Puppet::Type.type(:exec).provide :posix, :parent => Puppet::Provider::Exec do
   defaultfor :feature => :posix
 
   desc <<-EOT
-    Executes external binaries directly, without passing through a shell or
-    performing any interpolation. This is a safer and more predictable way
-    to execute most commands, but prevents the use of globbing and shell
-    built-ins (including control logic like "for" and "if" statements).
+    Executes external binaries by invoking Ruby's `Kernel.exec`.
+    When the command is a string, it will be executed directly,
+    without a shell, if it follows these rules:
+     - no meta characters
+     - no shell reserved word and no special built-in
+
+    When the command is an Array of Strings, passed as `[cmdname, arg1, ...]`
+    it will be executed directly(the first element is taken as a command name
+    and the rest are passed as parameters to command with no shell expansion)
+    This is a safer and more predictable way to execute most commands,
+    but prevents the use of globbing and shell built-ins (including control
+    logic like "for" and "if" statements).
+
+    If the use of globbing and shell built-ins is desired, please check
+    the `shell` provider
+
   EOT
 
   # Verify that we have the executable

data/lib/puppet/provider/group/groupadd.rb

@@ -2,11 +2,14 @@ require 'puppet/provider/nameservice/objectadd'
 require 'puppet/util/libuser'
 
 Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameService::ObjectAdd do
-  desc "Group management via `groupadd` and its ilk. The default for most platforms."
+  desc "Group management via `groupadd` and its ilk. The default for most platforms.
+
+ To use the `forcelocal` parameter, you need to install the `libuser` package (providing
+  `/usr/sbin/lgroupadd` and `/usr/sbin/luseradd`)."
 
   commands :add => "groupadd", :delete => "groupdel", :modify => "groupmod"
 
-  has_feature :system_groups unless %w{HP-UX Solaris}.include? Facter.value(:operatingsystem)
+  has_feature :system_groups unless %w{HP-UX Solaris}.include? Puppet.runtime[:facter].value(:operatingsystem)
 
   verify :gid, _("GID must be an integer") do |value|
     value.is_a? Integer

data/lib/puppet/provider/package/dnfmodule.rb

@@ -93,7 +93,7 @@ Puppet::Type.type(:package).provide :dnfmodule, :parent => :dnf do
         # module has no default profile and no profile was requested, so just enable the stream
         # DNF versions prior to 4.2.8 do not need this workaround
         # see https://bugzilla.redhat.com/show_bug.cgi?id=1669527
-        if @resource[:flavor] == nil && e.message =~ /^missing groups or modules: #{Regexp.quote(@resource[:name])}$/
+        if @resource[:flavor] == nil && e.message =~ /^(?:missing|broken) groups or modules: #{Regexp.quote(@resource[:name])}$/
           enable(args)
         else
           raise

data/lib/puppet/provider/package/nim.rb

@@ -154,20 +154,25 @@ Puppet::Type.type(:package).provide :nim, :parent => :aix, :source => :aix do
   # I spent a lot of time trying to figure out a solution that didn't
   # require parsing the `nimclient -o showres` output and was unable to
   # do so.
-  self::HEADER_LINE_REGEX      = /^([^\s]+)\s+[^@]+@@(I|R):(\1)\s+[^\s]+$/
-  self::PACKAGE_LINE_REGEX     = /^.*@@(I|R):(.*)$/
-  self::RPM_PACKAGE_REGEX      = /^(.*)-(.*-\d+) \2$/
+  self::HEADER_LINE_REGEX      = /^([^\s]+)\s+[^@]+@@(I|R|S):(\1)\s+[^\s]+$/
+  self::PACKAGE_LINE_REGEX     = /^.*@@(I|R|S):(.*)$/
+  self::RPM_PACKAGE_REGEX      = /^(.*)-(.*-\d+\w*) \2$/
   self::INSTALLP_PACKAGE_REGEX = /^(.*) (.*)$/
 
   # Here is some sample output that shows what the above regexes will be up
   # against:
-  # FOR AN INSTALLP PACKAGE:
+  # FOR AN INSTALLP(bff) PACKAGE:
   #
   #    mypackage.foo                                                           ALL  @@I:mypackage.foo _all_filesets
-  #    @ 1.2.3.1  MyPackage Runtime Environment                       @@I:mypackage.foo 1.2.3.1
   #    + 1.2.3.4  MyPackage Runtime Environment                       @@I:mypackage.foo 1.2.3.4
   #    + 1.2.3.8  MyPackage Runtime Environment                       @@I:mypackage.foo 1.2.3.8
   #
+  # FOR AN INSTALLP(bff) PACKAGE with security update:
+  #
+  #    bos.net                                                                 ALL  @@S:bos.net _all_filesets
+  #    + 7.2.0.1  TCP/IP ntp Applications                             @@S:bos.net.tcp.ntp 7.2.0.1
+  #    + 7.2.0.2  TCP/IP ntp Applications                             @@S:bos.net.tcp.ntp 7.2.0.2
+  #
   # FOR AN RPM PACKAGE:
   #
   # mypackage.foo                                                                ALL  @@R:mypackage.foo _all_filesets
@@ -243,7 +248,7 @@ Puppet::Type.type(:package).provide :nim, :parent => :aix, :source => :aix do
     package_string = match.captures[1]
 
     case package_type_flag
-      when "I"
+      when "I","S"
         parse_installp_package_string(package_string)
       when "R"
         parse_rpm_package_string(package_string)

data/lib/puppet/provider/package/pip.rb

@@ -127,7 +127,7 @@ Puppet::Type.type(:package).provide :pip, :parent => ::Puppet::Provider::Package
     if self.class.compare_pip_versions(command_version, '1.5.4') == -1
       available_versions_with_old_pip.last
     else
-      available_versions_with_new_pip.last
+      available_versions_with_new_pip(command_version).last
     end
   end
 
@@ -150,15 +150,17 @@ Puppet::Type.type(:package).provide :pip, :parent => ::Puppet::Provider::Package
     if self.class.compare_pip_versions(command_version, '1.5.4') == -1
       available_versions_with_old_pip
     else
-      available_versions_with_new_pip
+      available_versions_with_new_pip(command_version)
     end
   end
 
-  def available_versions_with_new_pip
+  def available_versions_with_new_pip(command_version)
     command = resource_or_provider_command
     self.class.validate_command(command)
 
     command_and_options = [self.class.quote(command), 'install', "#{@resource[:name]}==versionplease"]
+    extra_arg = list_extra_flags(command_version)
+    command_and_options << extra_arg if extra_arg
     command_and_options << install_options if @resource[:install_options]
     execpipe command_and_options do |process|
       process.collect do |line|
@@ -329,4 +331,14 @@ Puppet::Type.type(:package).provide :pip, :parent => ::Puppet::Provider::Package
       path
     end
   end
+
+  private
+
+  def list_extra_flags(command_version)
+    klass = self.class
+    if klass.compare_pip_versions(command_version, '20.2.4') == 1 &&
+      klass.compare_pip_versions(command_version, '21.1') == -1
+      '--use-deprecated=legacy-resolver'
+    end
+  end
 end

data/lib/puppet/provider/package/pkg.rb

@@ -165,7 +165,14 @@ Puppet::Type.type(:package).provide :pkg, :parent => Puppet::Provider::Package d
         command = is == :absent ? 'install' : 'update'
         options = ['-n']
         options.concat(join_options(@resource[:install_options])) if @resource[:install_options]
-        status = exec_cmd(command(:pkg), command, *options, "#{name}@#{p[:ensure]}")[:exit]
+
+        begin
+          unhold if properties[:mark] == :hold
+          status = exec_cmd(command(:pkg), command, *options, "#{name}@#{p[:ensure]}")[:exit]
+        ensure
+          hold if properties[:mark] == :hold
+        end
+
         case status
         when 4
           # if the first installable match would cause no changes, we're in sync
@@ -225,7 +232,7 @@ Puppet::Type.type(:package).provide :pkg, :parent => Puppet::Provider::Package d
       command = 'update'
     end
     args = ['--accept']
-    if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemrelease), '11.2') >= 0
+    if Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:operatingsystemrelease), '11.2') >= 0
       args.push('--sync-actuators-timeout', '900')
     end
     args.concat(join_options(@resource[:install_options])) if @resource[:install_options]
@@ -234,7 +241,17 @@ Puppet::Type.type(:package).provide :pkg, :parent => Puppet::Provider::Package d
     end
     self.unhold if self.properties[:mark] == :hold
     begin
+      tries = 1
+      # pkg install exits with code 7 when the image is currently in use by another process and cannot be modified
       r = exec_cmd(command(:pkg), command, *args, name)
+      while r[:exit] == 7 do
+        if tries > 4
+          raise Puppet::Error, _("Pkg could not install %{name} after %{tries} tries. Aborting run") % { name: name, tries: tries }
+        end
+        sleep 2 ** tries
+        tries += 1
+        r = exec_cmd(command(:pkg), command, *args, name)
+      end
     ensure
       self.hold if @resource[:mark] == :hold
     end

data/lib/puppet/provider/package/puppetserver_gem.rb

@@ -145,7 +145,7 @@ Puppet::Type.type(:package).provide :puppetserver_gem, :parent => :gem do
 
     pe_puppetserver_conf_file = '/etc/puppetlabs/puppetserver/conf.d/pe-puppet-server.conf'
     os_puppetserver_conf_file = '/etc/puppetlabs/puppetserver/puppetserver.conf'
-    puppetserver_conf_file = Facter.value(:pe_server_version) ? pe_puppetserver_conf_file : os_puppetserver_conf_file
+    puppetserver_conf_file = Puppet.runtime[:facter].value(:pe_server_version) ? pe_puppetserver_conf_file : os_puppetserver_conf_file
     puppetserver_conf = Hocon.load(puppetserver_conf_file)
 
     gem_env = {}

data/lib/puppet/provider/package/yum.rb

@@ -298,7 +298,7 @@ defaultfor :osfamily => :redhat, :operatingsystemmajrelease => (4..7).to_a
 
     # Yum on el-4 and el-5 returns exit status 0 when trying to install a package it doesn't recognize;
     # ensure we capture output to check for errors.
-    no_debug = if Facter.value(:operatingsystemmajrelease).to_i > 5 then ["-d", "0"] else [] end
+    no_debug = if Puppet.runtime[:facter].value(:operatingsystemmajrelease).to_i > 5 then ["-d", "0"] else [] end
     command = [command(:cmd)] + no_debug + ["-e", error_level, "-y", install_options, operation, wanted].compact
     output = execute(command)
 

data/lib/puppet/provider/parsedfile.rb

@@ -280,6 +280,9 @@ class Puppet::Provider::ParsedFile < Puppet::Provider
   def self.prefetch_target(target)
     begin
       target_records = retrieve(target)
+      unless target_records
+        raise Puppet::DevError, _("Prefetching %{target} for provider %{name} returned nil") % { target: target, name: self.name }
+      end
     rescue Puppet::Util::FileType::FileReadError => detail
       if @raise_prefetch_errors
         # We will raise an error later in flush_target. This way,

data/lib/puppet/provider/service/base.rb

@@ -15,7 +15,7 @@ Puppet::Type.type(:service).provide :base, :parent => :service do
   # ported from the facter 2.x implementation, since facter 3.x
   # is dropping the fact (for which this was the only use)
   def getps
-    case Facter.value(:operatingsystem)
+    case Puppet.runtime[:facter].value(:operatingsystem)
     when 'OpenWrt'
       'ps www'
     when 'FreeBSD', 'NetBSD', 'OpenBSD', 'Darwin', 'DragonFly'