puppet 6.25.1 → 7.0.0

data/lib/puppet/provider/user/directoryservice.rb

@@ -159,7 +159,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   end
 
   def self.get_os_version
-    @os_version ||= Puppet.runtime[:facter].value(:macosx_productversion_major)
+    @os_version ||= Facter.value(:macosx_productversion_major)
   end
 
   # Use dscl to retrieve an array of hashes containing attributes about all
@@ -435,7 +435,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   ['home', 'uid', 'gid', 'comment', 'shell'].each do |setter_method|
     define_method("#{setter_method}=") do |value|
       if @property_hash[setter_method.intern]
-        if %w(home uid).include?(setter_method)
+        if self.class.get_os_version.split('.').last.to_i >= 14 && %w(home uid).include?(setter_method)
           raise Puppet::Error, "OS X version #{self.class.get_os_version} does not allow changing #{setter_method} using puppet"
         end
         begin
@@ -536,14 +536,6 @@ Puppet::Type.type(:user).provide :directoryservice do
       if (shadow_hash_data.class == Hash) && (shadow_hash_data.has_key?('SALTED-SHA512'))
         shadow_hash_data.delete('SALTED-SHA512')
       end
-
-      # Starting with macOS 11 Big Sur, the AuthenticationAuthority field
-      # could be missing entirely and without it the managed user cannot log in
-      if needs_sha512_pbkdf2_authentication_authority_to_be_added?(users_plist)
-        Puppet.debug("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user '#{@resource.name}'")
-        merge_attribute_with_dscl('Users', @resource.name, 'AuthenticationAuthority', ERB::Util.html_escape(SHA512_PBKDF2_AUTHENTICATION_AUTHORITY))
-      end
-
       set_salted_pbkdf2(users_plist, shadow_hash_data, 'entropy', value)
     end
   end
@@ -570,17 +562,6 @@ Puppet::Type.type(:user).provide :directoryservice do
     end
   end
 
-  # This method will check if authentication_authority key of a user's plist
-  # needs SALTED_SHA512_PBKDF2 to be added. This is a valid case for macOS 11 (Big Sur)
-  # where users created with `dscl` started to have this field missing
-  def needs_sha512_pbkdf2_authentication_authority_to_be_added?(users_plist)
-    authority = users_plist['authentication_authority']
-    return false if Puppet::Util::Package.versioncmp(self.class.get_os_version, '11.0.0') < 0 && authority && authority.include?(SHA512_PBKDF2_AUTHENTICATION_AUTHORITY)
-
-    Puppet.debug("User '#{@resource.name}' is missing the 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash")
-    true
-  end
-
   # This method will embed the binary plist data comprising the user's
   # password hash (and Salt/Iterations value if the OS is 10.8 or greater)
   # into the ShadowHashData key of the user's plist.
@@ -591,7 +572,11 @@ Puppet::Type.type(:user).provide :directoryservice do
     else
       users_plist['ShadowHashData'] = [binary_plist]
     end
-    write_and_import_shadow_hash_data(users_plist['ShadowHashData'].first)
+    if Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.15') < 0
+      write_users_plist_to_disk(users_plist)
+    else
+      write_and_import_shadow_hash_data(users_plist['ShadowHashData'].first)
+    end
   end
 
   # This method writes the ShadowHashData plist in a temporary file,
@@ -667,17 +652,9 @@ Puppet::Type.type(:user).provide :directoryservice do
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
-  # This is a simple wrapper method for writing values to a file.
-  def write_to_file(filename, value)
-    Puppet.deprecation_warning("Puppet::Type.type(:user).provider(:directoryservice).write_to_file is deprecated and will be removed in Puppet 5.")
-    begin
-      File.open(filename, 'w') { |f| f.write(value)}
-    rescue Errno::EACCES => detail
-      raise Puppet::Error, "Could not write to file #{filename}: #{detail}", detail.backtrace
-    end
+  # This method will accept a plist in XML format, save it to disk, convert
+  # the plist to a binary format, and flush the dscl cache.
+  def write_users_plist_to_disk(users_plist)
+    Puppet::Util::Plist.write_plist_file(users_plist, "#{users_plist_dir}/#{@resource.name}.plist", :binary)
   end
-
-  private
-
-  SHA512_PBKDF2_AUTHENTICATION_AUTHORITY = ';ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2>'
 end

data/lib/puppet/provider/user/useradd.rb

@@ -7,12 +7,9 @@ require 'puppet/error'
 Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameService::ObjectAdd do
   desc "User management via `useradd` and its ilk.  Note that you will need to
     install Ruby's shadow password library (often known as `ruby-libshadow`)
-    if you wish to manage user passwords.
+    if you wish to manage user passwords."
 
-    To use the `forcelocal` parameter, you need to install the `libuser` package (providing
-    `/usr/sbin/lgroupadd` and `/usr/sbin/luseradd`)."
-
-  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage", :chpasswd  => "chpasswd"
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage"
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos
@@ -24,13 +21,13 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
   options :expiry, :method => :sp_expire,
     :munge => proc { |value|
       if value == :absent
-        if Puppet.runtime[:facter].value(:operatingsystem)=='SLES' && Puppet.runtime[:facter].value(:operatingsystemmajrelease) == "11"
+        if Facter.value(:operatingsystem)=='SLES' && Facter.value(:operatingsystemmajrelease) == "11"
           -1
         else
           ''
         end
       else
-        case Puppet.runtime[:facter].value(:operatingsystem)
+        case Facter.value(:operatingsystem)
         when 'Solaris'
           # Solaris uses %m/%d/%Y for useradd/usermod
           expiry_year, expiry_month, expiry_day = value.split('-')
@@ -62,47 +59,23 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
      get(:uid)
   end
 
-  def gid
-     return localgid if @resource.forcelocal?
-     get(:gid)
-  end
-
   def comment
      return localcomment if @resource.forcelocal?
      get(:comment)
   end
 
-  def shell
-    return localshell if @resource.forcelocal?
-    get(:shell)
-  end
-
-  def home
-    return localhome if @resource.forcelocal?
-    get(:home)
-  end
-
-  def groups
-     return localgroups if @resource.forcelocal?
-     super
-  end
-
   def finduser(key, value)
-    passwd_file = '/etc/passwd'
+    passwd_file = "/etc/passwd"
     passwd_keys = [:account, :password, :uid, :gid, :gecos, :directory, :shell]
-
-    unless @users
-      unless Puppet::FileSystem.exist?(passwd_file)
-        raise Puppet::Error.new("Forcelocal set for user resource '#{resource[:name]}', but #{passwd_file} does not exist")
-      end
-
-      @users = []
-      Puppet::FileSystem.each_line(passwd_file) do |line|
-        user = line.chomp.split(':')
-        @users << Hash[passwd_keys.zip(user)]
+    index = passwd_keys.index(key)
+    @passwd_content ||= File.read(passwd_file)
+    @passwd_content.each_line do |line|
+      user = line.split(":")
+      if user[index] == value
+        return Hash[passwd_keys.zip(user)]
       end
     end
-    @users.find { |param| param[key] == value } || false
+    false
   end
 
   def local_username
@@ -115,98 +88,16 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     false
   end
 
-  def localgid
-    user = finduser(:account, resource[:name])
-    if user
-      begin
-        return Integer(user[:gid])
-      rescue ArgumentError
-        Puppet.debug("Non-numeric GID found in /etc/passwd for user #{resource[:name]}")
-        return user[:gid]
-      end
-    end
-    false
-  end
-
   def localcomment
     user = finduser(:account, resource[:name])
     user[:gecos]
   end
 
-  def localshell
-    user = finduser(:account, resource[:name])
-    user[:shell]
-  end
-
-  def localhome
-    user = finduser(:account, resource[:name])
-    user[:directory]
-  end
-
-  def localgroups
-    @groups_of ||= {}
-    group_file = '/etc/group'
-    user = resource[:name]
-
-    return @groups_of[user] if @groups_of[user]
-
-    @groups_of[user] = []
-
-    unless Puppet::FileSystem.exist?(group_file)
-      raise Puppet::Error.new("Forcelocal set for user resource '#{user}', but #{group_file} does not exist")
-    end
-
-    Puppet::FileSystem.each_line(group_file) do |line|
-      data = line.chomp.split(':')
-      if !data.empty? && data.last.split(',').include?(user)
-        @groups_of[user] << data.first
-      end
-    end
-
-    @groups_of[user]
-  end
-
   def shell=(value)
     check_valid_shell
     set(:shell, value)
   end
 
-  def groups=(value)
-    set(:groups, value)
-  end
-
-  def password=(value)
-    user = @resource[:name]
-    tempfile = Tempfile.new('puppet', :encoding => Encoding::UTF_8)
-    begin
-      # Puppet execute does not support strings as input, only files.
-      # The password is expected to be in an encrypted format given -e is specified:
-      tempfile << "#{user}:#{value}\n"
-      tempfile.flush
-
-      # Options '-e' use encrypted password
-      # Must receive "user:enc_password" as input
-      # command, arguments = {:failonfail => true, :combine => true}
-      cmd = [command(:chpasswd), '-e']
-      execute_options = {
-        :failonfail => false,
-        :combine => true,
-        :stdinfile => tempfile.path,
-        :sensitive => has_sensitive_data?
-      }
-      output = execute(cmd, execute_options)
-
-    rescue => detail
-      tempfile.close
-      tempfile.delete
-      raise Puppet::Error, "Could not set password on #{@resource.class.name}[#{@resource.name}]: #{detail}", detail.backtrace
-    end
-
-    # chpasswd can return 1, even on success (at least on AIX 6.1); empty output
-    # indicates success
-    raise Puppet::ExecutionFailure, "chpasswd said #{output}" if output != ''
-  end
-
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
   end
@@ -216,7 +107,7 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
   end
 
   has_features :manages_homedir, :allows_duplicates, :manages_expiry
-  has_features :system_users unless %w{HP-UX Solaris}.include? Puppet.runtime[:facter].value(:operatingsystem)
+  has_features :system_users unless %w{HP-UX Solaris}.include? Facter.value(:operatingsystem)
 
   has_features :manages_passwords, :manages_password_age if Puppet.features.libshadow?
   has_features :manages_shell
@@ -251,8 +142,8 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
       # libuser does not implement the -m flag
       cmd << "-m" unless @resource.forcelocal?
     else
-      osfamily = Puppet.runtime[:facter].value(:osfamily)
-      osversion = Puppet.runtime[:facter].value(:operatingsystemmajrelease).to_i
+      osfamily = Facter.value(:osfamily)
+      osversion = Facter.value(:operatingsystemmajrelease).to_i
       # SLES 11 uses pwdutils instead of shadow, which does not have -M
       # Solaris and OpenBSD use different useradd flavors
       unless osfamily =~ /Solaris|OpenBSD/ || osfamily == 'Suse' && osversion <= 11
@@ -270,15 +161,13 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     end
   end
 
-  # Add properties and flags but skipping password related properties due to
-  # security risks
   def add_properties
     cmd = []
     # validproperties is a list of properties in undefined order
     # sort them to have a predictable command line in tests
     Puppet::Type.type(:user).validproperties.sort.each do |property|
       value = get_value_for_property(property)
-      next if value.nil? || property == :password
+      next if value.nil?
       # the value needs to be quoted, mostly because -c might
       # have spaces in it
       cmd << flag(property) << munge(property, value)
@@ -350,7 +239,7 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
       cmd = [command(:delete)]
     end
     # Solaris `userdel -r` will fail if the homedir does not exist.
-    if @resource.managehome? && (('Solaris' != Puppet.runtime[:facter].value(:operatingsystem)) || Dir.exist?(Dir.home(@resource[:name])))
+    if @resource.managehome? && (('Solaris' != Facter.value(:operatingsystem)) || Dir.exist?(Dir.home(@resource[:name])))
       cmd << '-r'
     end
     cmd << @resource[:name]
@@ -388,12 +277,13 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     if @resource[:shell]
       check_valid_shell
     end
-    super
-    if @resource.forcelocal?
-      set(:groups, @resource[:groups]) if self.groups?
-      set(:expiry, @resource[:expiry]) if @resource[:expiry]
-    end
-    set(:password, @resource[:password]) if @resource[:password]
+     super
+     if @resource.forcelocal? && self.groups?
+       set(:groups, @resource[:groups])
+     end
+     if @resource.forcelocal? && @resource[:expiry]
+       set(:expiry, @resource[:expiry])
+     end
   end
 
   def groups?

data/lib/puppet/provider.rb

@@ -117,19 +117,6 @@ class Puppet::Provider
     Puppet::Util::Execution.execpipe(*args, &block)
   end
 
-  # Convenience methods - see class method with the same name.
-  # @return (see self.execfail)
-  # @deprecated
-  def execfail(*args)
-    Puppet::Util::Execution.execfail(*args)
-  end
-
-  # (see Puppet::Util::Execution.execfail)
-  # @deprecated
-  def self.execfail(*args)
-    Puppet::Util::Execution.execfail(*args)
-  end
-
   # Returns the absolute path to the executable for the command referenced by the given name.
   # @raise [Puppet::DevError] if the name does not reference an existing command.
   # @return [String] the absolute path to the found executable for the command
@@ -302,7 +289,7 @@ class Puppet::Provider
   #   values. Given one or more Regexp instances, fact is compared via the basic
   #   pattern-matching operator.
   def self.fact_match(fact, values)
-    fact_val = Puppet.runtime[:facter].value(fact).to_s.downcase
+    fact_val = Facter.value(fact).to_s.downcase
     if fact_val.empty?
       return false
     else

data/lib/puppet/reference/configuration.rb

@@ -24,6 +24,8 @@ config = Puppet::Util::Reference.newreference(:configuration, :depth => 1, :doc
     val = object.default
     if name.to_s == 'vardir'
       val = 'Unix/Linux: /opt/puppetlabs/puppet/cache -- Windows: C:\ProgramData\PuppetLabs\puppet\cache -- Non-root user: ~/.puppetlabs/opt/puppet/cache'
+    elsif name.to_s == 'publicdir'
+      val = 'Unix/Linux: /opt/puppetlabs/puppet/public -- Windows: C:\ProgramData\PuppetLabs\puppet\public -- Non-root user: ~/.puppetlabs/opt/puppet/public'
     elsif name.to_s == 'confdir'
       val = 'Unix/Linux: /etc/puppetlabs/puppet -- Windows: C:\ProgramData\PuppetLabs\puppet\etc -- Non-root user: ~/.puppetlabs/etc/puppet'
     elsif name.to_s == 'codedir'
@@ -41,7 +43,7 @@ config = Puppet::Util::Reference.newreference(:configuration, :depth => 1, :doc
     # Leave out the section information; it was apparently confusing people.
     #str << "- **Section**: #{object.section}\n"
     unless val == ""
-      str << "- *Default*: `#{val}`\n"
+      str << "- *Default*: #{val}\n"
     end
     str << "\n"
   end
@@ -55,12 +57,11 @@ config.header = <<EOT
 * Each of these settings can be specified in `puppet.conf` or on the
   command line.
 * Puppet Enterprise (PE) and open source Puppet share the configuration settings
-  documented here. However, PE defaults differ from open source defaults for some 
-  settings, such as `node_terminus`, `storeconfigs`, `always_retry_plugins`, 
-  `disable18n`, `environment_timeout` (when Code Manager is enabled), and the 
-  Puppet Server JRuby `max-active-instances` setting. To verify PE configuration 
-  defaults, check the `puppet.conf` or `pe-puppet-server.conf` file after 
-  installation.
+  that are documented here. However, PE defaults for some settings differ from
+  the open source Puppet defaults. Some examples of settings that have different
+  PE defaults include `disable18n`, `environment_timeout`, `always_retry_plugins`,
+  and the Puppet Server JRuby `max-active-instances` setting. To verify PE
+  configuration defaults, check the `puppet.conf` file after installation.
 * When using boolean settings on the command line, use `--setting` and
   `--no-setting` instead of `--setting (true|false)`. (Using `--setting false`
   results in "Error: Could not parse application options: needless argument".)

data/lib/puppet/reference/indirection.rb

@@ -46,7 +46,7 @@ An indirector has five methods, which are mapped into HTTP verbs for the REST in
 
 These methods are available via the `indirection` class method on the indirected classes.  For example:
 
-    foo_cert = Puppet::SSL::Certificate.indirection.find('foo.example.com')
+    node = Puppet::Node.indirection.find('foo.example.com')
 
 At startup, each indirection is configured with a terminus.
 In most cases, this is the default terminus defined by the indirected class, but it can be overridden by the application or face, or overridden with the `route_file` configuration.

data/lib/puppet/reference/providers.rb

@@ -15,7 +15,7 @@ providers = Puppet::Util::Reference.newreference :providers, :title => "Provider
   # Throw some facts in there, so we know where the report is from.
   ["Ruby Version", "Puppet Version", "Operating System", "Operating System Release"].each do |label|
     name = label.gsub(/\s+/, '')
-    value = Puppet.runtime[:facter].value(name)
+    value = Facter.value(name)
     ret << option(label, value)
   end
   ret << "\n"
@@ -61,7 +61,7 @@ providers = Puppet::Util::Reference.newreference :providers, :title => "Provider
               if Puppet.settings.valid?(name)
                 details << _("  - Setting %{name} (currently %{value}) not in list %{facts}\n") % { name: name, value: Puppet.settings.value(name).inspect, facts: facts.join(", ") }
               else
-                details << _("  - Fact %{name} (currently %{value}) not in list %{facts}\n") % { name: name, value: Puppet.runtime[:facter].value(name).inspect, facts: facts.join(", ") }
+                details << _("  - Fact %{name} (currently %{value}) not in list %{facts}\n") % { name: name, value: Facter.value(name).inspect, facts: facts.join(", ") }
               end
             end
           when :true

data/lib/puppet/resource/catalog.rb

@@ -5,8 +5,6 @@ require 'puppet/util/tagging'
 require 'puppet/graph'
 require 'securerandom'
 
-require 'puppet/resource/capability_finder'
-
 # This class models a node catalog.  It is the thing meant to be passed
 # from server to client, and it contains all of the information in the
 # catalog, including the resources and the relationships between them.
@@ -315,7 +313,7 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
     super()
     @name = name
     @catalog_uuid = SecureRandom.uuid
-    @catalog_format = 2
+    @catalog_format = 1
     @metadata = {}
     @recursive_metadata = {}
     @classes = []
@@ -382,23 +380,12 @@ class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
     result = @resource_table[title_key]
     if result.nil?
       # an instance has to be created in order to construct the unique key used when
-      # searching for aliases, or nothing is found as it is needed by the CapabilityFinder.
+      # searching for aliases
       res = Puppet::Resource.new(type, title, { :environment => @environment_instance })
 
       # Must check with uniqueness key because of aliases or if resource transforms title in title
       # to attribute mappings.
       result = @resource_table[[type_name, res.uniqueness_key].flatten]
-
-      if result.nil?
-        resource_type = res.resource_type
-        if resource_type && resource_type.is_capability?
-          # @todo lutter 2015-03-10: this assumes that it is legal to just
-          # mention a capability resource in code and have it automatically
-          # made available, even if the current component does not require it
-          result = Puppet::Resource::CapabilityFinder.find(environment, code_id, res)
-          add_resource(result) if result
-        end
-      end
     end
     result
   end

data/lib/puppet/resource/type.rb

@@ -11,16 +11,13 @@ class Puppet::Resource::Type
   include Puppet::Util::Warnings
   include Puppet::Util::Errors
 
-  # @deprecated application orchestration will be removed in puppet 7 (capability_mapping, application, site)
-  RESOURCE_KINDS = [:hostclass, :node, :definition, :capability_mapping, :application, :site]
+  RESOURCE_KINDS = [:hostclass, :node, :definition]
 
   # Map the names used in our documentation to the names used internally
   RESOURCE_KINDS_TO_EXTERNAL_NAMES = {
       :hostclass => "class",
       :node => "node",
-      :definition => "defined_type",
-      :application => "application",
-      :site => 'site'
+      :definition => "defined_type"
   }
   RESOURCE_EXTERNAL_NAMES_TO_KINDS = RESOURCE_KINDS_TO_EXTERNAL_NAMES.invert
 
@@ -37,15 +34,6 @@ class Puppet::Resource::Type
   attr_accessor :file, :line, :doc, :code, :parent, :resource_type_collection, :override
   attr_reader :namespace, :arguments, :behaves_like, :module_name
 
-  # The attributes 'produces' and 'consumes' are arrays of the blueprints
-  # of capabilities this type can produce/consume. The entries in the array
-  # are a fairly direct representation of what goes into produces/consumes
-  # clauses. Each entry is a hash with attributes
-  #   :capability  - the type name of the capres produced/consumed
-  #   :mappings    - a hash of attribute_name => Expression
-  # These two attributes are populated in
-  # PopsBridge::instantiate_CapabilityMapping
-
   # Map from argument (aka parameter) names to Puppet Type
   # @return [Hash<Symbol, Puppet::Pops::Types::PAnyType] map from name to type
   #
@@ -69,53 +57,6 @@ class Puppet::Resource::Type
     return(klass == parent_type ? true : parent_type.child_of?(klass))
   end
 
-  # Evaluate the resources produced by the given resource. These resources are
-  # evaluated in a separate but identical scope from the rest of the resource.
-  #
-  # @deprecated application orchestration will be removed in puppet 7
-  def evaluate_produces(resource, scope)
-    # Only defined types and classes can produce capabilities
-    return unless definition? || hostclass?
-
-    resource.export.map do |ex|
-      # Assert that the ref really is a resource reference
-      raise Puppet::Error, _("Invalid export in %{reference}: %{ex} is not a resource") % { reference: resource.ref, ex: ex } unless ex.is_a?(Puppet::Resource)
-      raise Puppet::Error, _("Invalid export in %{reference}: %{ex} is not a capability resource") % { reference: resource.ref, ex: ex } if ex.resource_type.nil? || !ex.resource_type.is_capability?
-
-      blueprint = produces.find { |pr| pr[:capability] == ex.type }
-      if blueprint.nil?
-        raise Puppet::ParseError, _("Resource type %{res_type} does not produce %{ex_type}") % { res_type: resource.type, ex_type: ex.type }
-      end
-      t = ex.type
-      t = Puppet::Pops::Evaluator::Runtime3ResourceSupport.find_resource_type(scope, t) unless t == 'class' || t == 'node'
-      produced_resource = Puppet::Parser::Resource.new(t, ex.title, :scope => scope, :source => self)
-
-      produced_resource.resource_type.parameters.each do |name|
-        next if name == :name
-
-        expr = blueprint[:mappings][name.to_s]
-        if expr
-          produced_resource[name] = expr.safeevaluate(scope)
-        else
-          produced_resource[name] = scope[name.to_s]
-        end
-      end
-      # Tag the produced resource so we can later distinguish it from
-      # copies of the resource that wind up in the catalogs of nodes that
-      # use this resource. We tag the resource with producer:<environment>,
-      # meaning produced resources need to be unique within their
-      # environment
-      # @todo lutter 2014-11-13: we would really like to use a dedicated
-      # metadata field to indicate the producer of a resource, but that
-      # requires changes to PuppetDB and its API; so for now, we just use
-      # tagging
-      produced_resource.tag("producer:#{scope.catalog.environment}")
-      scope.catalog.add_resource(produced_resource)
-      produced_resource[:require] = resource.ref
-      produced_resource
-    end
-  end
-
   # Now evaluate the code associated with this class or definition.
   def evaluate_code(resource)
 
@@ -129,8 +70,6 @@ class Puppet::Resource::Type
 
     resource.add_edge_to_stage
 
-    evaluate_produces(resource, scope)
-
     if code
       if @match # Only bother setting up the ephemeral scope if there are match variables to add into it
         scope.with_guarded_scope do
@@ -165,28 +104,6 @@ class Puppet::Resource::Type
     @module_name = options[:module_name]
   end
 
-  # @deprecated application orchestration will be removed in puppet 7
-  def produces
-    @produces || EMPTY_ARRAY
-  end
-
-  # @deprecated application orchestration will be removed in puppet 7
-  def consumes
-    @consumes || EMPTY_ARRAY
-  end
-
-  # @deprecated application orchestration will be removed in puppet 7
-  def add_produces(blueprint)
-    @produces ||= []
-    @produces << blueprint
-  end
-
-  # @deprecated application orchestration will be removed in puppet 7
-  def add_consumes(blueprint)
-    @consumes ||= []
-    @consumes << blueprint
-  end
-
   # This is only used for node names, and really only when the node name
   # is a regexp.
   def match(string)
@@ -242,9 +159,6 @@ class Puppet::Resource::Type
       :class
     when :node
       :node
-    when :site
-      # @deprecated application orchestration will be removed in puppet 7
-      :site
     end
 
     # Do nothing if the resource already exists; this makes sure we don't
@@ -289,21 +203,6 @@ class Puppet::Resource::Type
     @name.is_a?(Regexp)
   end
 
-  # @deprecated Not used by Puppet
-  # @api private
-  def assign_parameter_values(parameters, resource)
-    Puppet.deprecation_warning(_('The method Puppet::Resource::Type.assign_parameter_values is deprecated and will be removed in the next major release of Puppet.'))
-
-    return unless parameters
-
-    # It'd be nice to assign default parameter values here,
-    # but we can't because they often rely on local variables
-    # created during set_resource_parameters.
-    parameters.each do |name, value|
-      resource.set_parameter name, value
-    end
-  end
-
   def parent_type(scope = nil)
     return nil unless parent
 
@@ -326,7 +225,6 @@ class Puppet::Resource::Type
     caller_name = resource[:caller_module_name] || scope.parent_module_name
     scope[CALLER_MODULE_NAME] = caller_name unless caller_name.nil?
 
-    resource.add_parameters_from_consume
     inject_external_parameters(resource, scope)
 
     if @type == :hostclass
@@ -389,7 +287,7 @@ class Puppet::Resource::Type
   private :assign_defaults
 
   def validate_resource_hash(resource, resource_hash)
-    Puppet::Pops::Types::TypeMismatchDescriber.validate_parameters(resource.to_s, parameter_struct, resource_hash, resource.is_unevaluated_consumer?)
+    Puppet::Pops::Types::TypeMismatchDescriber.validate_parameters(resource.to_s, parameter_struct, resource_hash, false)
   end
   private :validate_resource_hash
 
@@ -444,14 +342,6 @@ class Puppet::Resource::Type
     end
   end
 
-  # Returns boolean true if an instance of this type is a capability. This
-  # implementation always returns false. This "duck-typing" interface is
-  # shared among other classes and makes it easier to detect capabilities
-  # when they are intermixed with non capability instances.
-  def is_capability?
-    false
-  end
-
   private
 
   def convert_from_ast(name)
@@ -516,12 +406,6 @@ class Puppet::Resource::Type
     type_factory = Puppet::Pops::Types::TypeFactory
     members = { type_factory.optional(type_factory.string(NAME)) =>  type_factory.any }
 
-    if application?
-      resource_type = type_factory.type_type(type_factory.resource)
-      members[type_factory.string(NODES)] = type_factory.hash_of(type_factory.variant(
-          resource_type, type_factory.array_of(resource_type)), type_factory.type_type(type_factory.resource('node')))
-    end
-
     Puppet::Type.eachmetaparam do |name|
       # TODO: Once meta parameters are typed, this should change to reflect that type
       members[name.to_s] = type_factory.any