puppet 6.28.0-universal-darwin → 7.0.0-universal-darwin

data/lib/puppet/provider/service/smf.rb

@@ -5,48 +5,100 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   desc <<-EOT
     Support for Sun's new Service Management Framework.
 
-    Starting a service is effectively equivalent to enabling it, so there is
-    only support for starting and stopping services, which also enables and
-    disables them, respectively.
+    When managing the enable property, this provider will try to preserve
+    the previous ensure state per the enableable semantics. On Solaris,
+    enabling a service starts it up while disabling a service stops it. Thus,
+    there's a chance for this provider to execute two operations when managing
+    the enable property. For example, if enable is set to true and the ensure
+    state is stopped, this provider will manage the service using two operations:
+    one to enable the service which will start it up, and another to stop the
+    service (without affecting its enabled status).
 
     By specifying `manifest => "/path/to/service.xml"`, the SMF manifest will
     be imported if it does not exist.
-
   EOT
 
   defaultfor :osfamily => :solaris
 
   confine :osfamily => :solaris
 
-  commands :adm => "/usr/sbin/svcadm", :svcs => "/usr/bin/svcs"
-  commands :svccfg => "/usr/sbin/svccfg"
+  commands :adm => "/usr/sbin/svcadm",
+           :svcs => "/usr/bin/svcs",
+           :svccfg => "/usr/sbin/svccfg"
 
   has_feature :refreshable
 
-  def setupservice
-      if resource[:manifest]
-        begin
-          svcs("-l", @resource[:name])
-        rescue Puppet::ExecutionFailure
-          Puppet.notice "Importing #{@resource[:manifest]} for #{@resource[:name]}"
-          svccfg :import, resource[:manifest]
-        end
-      end
+  def self.instances
+    service_instances = svcs("-H", "-o", "state,fmri" ).split("\n")
+
+    # Puppet does not manage services in the legacy_run state, so filter those out.
+    service_instances.reject! { |line| line =~ /^legacy_run/ }
+
+    service_instances.collect! do |line|
+      state, fmri = line.split(/\s+/)
+
+      status =  case state
+                when /online/; :running
+                when /maintenance/; :maintenance
+                when /degraded/; :degraded
+                else :stopped
+                end
+      new({:name => fmri, :ensure => status})
+    end
+
+    service_instances
+  end
+
+  def initialize(*args)
+    super(*args)
+
+    # This hash contains the properties we need to sync. in our flush method.
+    #
+    # TODO (PUP-9051): Should we use @property_hash here? It seems like
+    # @property_hash should be empty by default and is something we can
+    # control so I think so?
+    @properties_to_sync = {}
+  end
+
+  def service_exists?
+    self.service_fmri
+    true
+  rescue Puppet::ExecutionFailure
+    false
+  end
+
+  def setup_service
+    return unless @resource[:manifest]
+    return if self.service_exists?
+
+    Puppet.notice("Importing #{@resource[:manifest]} for #{@resource[:name]}")
+    svccfg(:import, @resource[:manifest])
   rescue Puppet::ExecutionFailure => detail
-      raise Puppet::Error.new( "Cannot config #{self.name} to enable it: #{detail}", detail )
+    raise Puppet::Error.new( "Cannot config #{@resource[:name]} to enable it: #{detail}", detail )
   end
 
-  def self.instances
-   svcs("-H", "-o", "state,fmri" ).split("\n").select{|l| l !~ /^legacy_run/ }.collect do |line|
-     state,fmri = line.split(/\s+/)
-     status =  case state
-               when /online/; :running
-               when /maintenance/; :maintenance
-               when /degraded/; :degraded
-               else :stopped
-               end
-     new({:name => fmri, :ensure => status})
-   end
+  # Returns the service's FMRI. We fail if multiple FMRIs correspond to
+  # @resource[:name].
+  #
+  # If the service does not exist or we fail to get any FMRIs from svcs,
+  # this method will raise a Puppet::ExecutionFailure
+  def service_fmri
+    return @fmri if @fmri
+
+    # `svcs -l` is better to use because we can detect service instances
+    # that have not yet been activated or enabled (i.e. it lets us detect
+    # services that svcadm has not yet touched). `svcs -H -o fmri` is a bit
+    # more limited.
+    lines = svcs("-l", @resource[:name]).chomp.lines.to_a
+    lines.select! { |line| line =~ /^fmri/ }
+    fmris = lines.map! { |line| line.split(' ')[-1].chomp }
+    unless fmris.length == 1
+      raise Puppet::Error.new(
+        "Failed to get #{@resource[:name]}'s FMRI: The pattern '#{@resource[:name]}' matches multiple FMRIs! These are the FMRIs it matches: #{fmris.join(', ')}"
+      )
+    end
+
+    @fmri = fmris.first
   end
 
   # Returns the service's FMRI. We fail if multiple FMRIs correspond to
@@ -73,14 +125,14 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
 
   # Returns true if the provider supports incomplete services.
   def supports_incomplete_services?
-    Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:operatingsystemrelease), '11.1') >= 0
+    Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemrelease), '11.1') >= 0
   end
 
   # Returns true if the service is complete. A complete service is a service that
   # has the general/complete property defined.
   def complete_service?
     unless supports_incomplete_services?
-      raise Puppet::Error, _("Cannot query if the %{service} service is complete: The concept of complete/incomplete services was introduced in Solaris 11.1. You are on a Solaris %{release} machine.") % { service: @resource[:name], release: Puppet.runtime[:facter].value(:operatingsystemrelease) }
+      raise Puppet::Error, _("Cannot query if the %{service} service is complete: The concept of complete/incomplete services was introduced in Solaris 11.1. You are on a Solaris %{release} machine.") % { service: @resource[:name], release: Facter.value(:operatingsystemrelease) }
     end
 
     return @complete_service if @complete_service
@@ -96,51 +148,50 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   end
 
   def enable
-    self.start
+    @properties_to_sync[:enable] = true
   end
 
   def enabled?
-    case self.status
-    when :running
-      return :true
-    else
-      return :false
-    end
+    return :false unless service_exists?
+    _property, _type, value = svccfg("-s", self.service_fmri, "listprop", "general/enabled").split(' ')
+    value == 'true' ? :true : :false
   end
 
   def disable
-    self.stop
+    @properties_to_sync[:enable] = false
   end
 
   def restartcmd
-    if Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:operatingsystemrelease), '11.2') >= 0
-      [command(:adm), :restart, "-s", @resource[:name]]
+    if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemrelease), '11.2') >= 0
+      [command(:adm), :restart, "-s", self.service_fmri]
     else
       # Synchronous restart only supported in Solaris 11.2 and above
-      [command(:adm), :restart, @resource[:name]]
+      [command(:adm), :restart, self.service_fmri]
     end
   end
 
-  def startcmd
-    self.setupservice
-    case self.status
-    when :maintenance, :degraded
-      [command(:adm), :clear, @resource[:name]]
-    else
-      [command(:adm), :enable, "-rs", @resource[:name]]
-    end
+  def service_states
+    # Gets the current and next state of the service. We have a next state because SMF
+    # manages services asynchronously. If there is no 'next' state, svcs will put a '-'
+    # to indicate as such.
+    current_state, next_state = svcs("-H", "-o", "state,nstate", self.service_fmri).chomp.split(' ')
+
+    {
+      :current => current_state,
+      :next => next_state == "-" ? nil : next_state
+    }
   end
 
   # Wait for the service to transition into the specified state before returning.
   # This is necessary due to the asynchronous nature of SMF services.
-  # desired_state should be online, offline, disabled, or uninitialized.
+  # desired_states should include only online, offline, disabled, or uninitialized.
   # See PUP-5474 for long-term solution to this issue.
-  def wait(*desired_state)
+  def wait(*desired_states)
     Timeout.timeout(60) do
       loop do
         states = self.service_states
-        break if desired_state.include?(states[0]) && states[1] == '-'
-        sleep(1)
+        break if desired_states.include?(states[:current]) && states[:next].nil?
+        Kernel.sleep(1)
       end
     end
   rescue Timeout::Error
@@ -148,15 +199,11 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
   end
 
   def start
-    # Wait for the service to actually start before returning.
-    super
-    self.wait('online')
+    @properties_to_sync[:ensure] = :running
   end
 
   def stop
-    # Wait for the service to actually stop before returning.
-    super
-    self.wait('offline', 'disabled', 'uninitialized')
+    @properties_to_sync[:ensure] = :stopped
   end
 
   def restart
@@ -165,16 +212,8 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
     self.wait('online')
   end
 
-  # Determine the current and next states of a service.
-  def service_states
-    svcs("-H", "-o", "state,nstate", @resource[:name]).chomp.split
-  end
-
   def status
-    if @resource[:status]
-      super
-      return
-    end
+    return super if @resource[:status]
 
     begin
       if supports_incomplete_services?
@@ -185,10 +224,10 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
         end
       end
 
-      # get the current state and the next state, and if the next
-      # state is set (i.e. not "-") use it for state comparison
-      states = service_states
-      state = states[1] == "-" ? states[0] : states[1]
+      # Get the current state and the next state. If there is a next state,
+      # use that for the state comparison.
+      states = self.service_states
+      state = states[:next] || states[:current]
     rescue Puppet::ExecutionFailure
       # TODO (PUP-8957): Should this be set back to INFO ?
       debug "Could not get status on service #{self.name} #{$!}"
@@ -197,10 +236,8 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
 
     case state
     when "online"
-      #self.warning "matched running #{line.inspect}"
       return :running
     when "offline", "disabled", "uninitialized"
-      #self.warning "matched stopped #{line.inspect}"
       return :stopped
     when "maintenance"
       return :maintenance
@@ -213,11 +250,92 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
       raise Puppet::Error,
         "Unmanageable state '#{state}' on service #{self.name}"
     end
+  end
 
+  # Helper that encapsulates the clear + svcadm [enable|disable]
+  # logic in one place. Makes it easy to test things out and also
+  # cleans up flush's code.
+  def maybe_clear_service_then_svcadm(cur_state, subcmd, flags)
+    # If the cur_state is maint or degraded, then we need to clear the service
+    # before we enable or disable it.
+    adm('clear', self.service_fmri) if [:maintenance, :degraded].include?(cur_state)
+    adm(subcmd, flags, self.service_fmri)
   end
 
-  def stopcmd
-    [command(:adm), :disable, "-s", @resource[:name]]
+  # The flush method is necessary for the SMF provider because syncing the enable and ensure
+  # properties are not independent operations like they are in most of our other service
+  # providers.
+  def flush
+    # We append the "_" because ensure is a Ruby keyword, and it is good to keep property
+    # variable names consistent with each other.
+    enable_, ensure_ = @properties_to_sync[:enable], @properties_to_sync[:ensure]
+
+    # All of the relevant properties are in sync., so we do not need to do
+    # anything here.
+    return if enable_.nil? and ensure_.nil?
+
+    # Set-up our service so that we know it will exist and so we can collect its fmri. Also
+    # simplifies the code. For a nonexistent service, one of enable or ensure will be true
+    # here (since we're syncing them), so we can fail early if setup_service fails.
+    setup_service
+    fmri = self.service_fmri
+
+    # Useful constants for operations involving multiple states
+    stopped = ['offline', 'disabled', 'uninitialized']
+
+    # Get the current state of the service.
+    cur_state = self.status
+
+    if enable_.nil?
+      # Only ensure needs to be syncd. The -t flag tells svcadm to temporarily
+      # enable/disable the service, where the temporary status is gone upon
+      # reboot. This is exactly what we want, because we do not want to touch
+      # the enable property.
+      if ensure_ == :stopped
+        self.maybe_clear_service_then_svcadm(cur_state, 'disable', '-st')
+        wait(*stopped)
+      else # ensure == :running
+        self.maybe_clear_service_then_svcadm(cur_state, 'enable', '-rst')
+        wait('online')
+      end
+
+      return
+    end
+
+    # Here, enable is being syncd. svcadm starts the service if we enable it, or shuts it down if we
+    # disable it. However, we want our service to be in a final state, which is either whatever the
+    # new ensured value is, or what our original state was prior to enabling it.
+    #
+    # NOTE: Even if you try to set the general/enabled property with svccfg, SMF will still
+    # try to start or shut down the service. Plus, setting general/enabled with svccfg does not
+    # enable the service's dependencies, while svcadm handles this correctly.
+    #
+    # NOTE: We're treating :running and :degraded the same. The reason is b/c an SMF managed service
+    # can only enter the :degraded state if it is online. Since disabling the service also shuts it
+    # off, we cannot set it back to the :degraded state. Thus, it is best to lump :running and :degraded
+    # into the same category to maintain a consistent postcondition on the service's final state when
+    # enabling and disabling it.
+    final_state = ensure_ || cur_state
+    final_state = :running if final_state == :degraded
+
+    if enable_
+      self.maybe_clear_service_then_svcadm(cur_state, 'enable', '-rs')
+    else
+      self.maybe_clear_service_then_svcadm(cur_state, 'disable', '-s')
+    end
+
+    # We're safe with 'whens' here since self.status already errors on any
+    # unmanageable states.
+    case final_state
+    when :running
+      adm('enable', '-rst', fmri) unless enable_
+      wait('online')
+    when :stopped
+      adm('disable', '-st', fmri) if enable_
+      wait(*stopped)
+    when :maintenance
+      adm('mark', '-I', 'maintenance', fmri)
+      wait('maintenance')
+    end
   end
 end
-

data/lib/puppet/provider/service/systemd.rb

@@ -14,7 +14,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   confine :true => Puppet::FileSystem.exist?('/proc/1/comm') && Puppet::FileSystem.read('/proc/1/comm').include?('systemd')
 
   defaultfor :osfamily => [:archlinux]
-  defaultfor :osfamily => :redhat, :operatingsystemmajrelease => ["7", "8", "9"]
+  defaultfor :osfamily => :redhat, :operatingsystemmajrelease => ["7", "8"]
   defaultfor :osfamily => :redhat, :operatingsystem => :fedora
   defaultfor :osfamily => :suse
   defaultfor :osfamily => :coreos
@@ -30,7 +30,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def self.instances
     i = []
     output = systemctl('list-unit-files', '--type', 'service', '--full', '--all',  '--no-pager')
-    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad|static)\s*([^-]\S+)?\s*$/i).each do |m|
+    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad|static)\s*$/i).each do |m|
       Puppet.debug("#{m[0]} marked as bad by `systemctl`. It is recommended to be further checked.") if m[1] == "bad"
       i << new(:name => m[0])
     end
@@ -45,13 +45,8 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def enabled_insync?(current)
     case cached_enabled?[:output]
     when 'static'
-      # masking static services is OK, but enabling/disabling them is not
-      if @resource[:enable] == :mask
-        current == @resource[:enable]
-      else
-        Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
-        return true
-      end
+      Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
+      return true
     when 'indirect'
       Puppet.debug("Service #{@resource[:name]} is in 'indirect' state and cannot be enabled/disabled")
       return true
@@ -110,7 +105,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
     # The indirect state indicates that the unit is not enabled.
     return :false if output == 'indirect'
     return :true if (code == 0)
-    if (output.empty?) && (code > 0) && (Puppet.runtime[:facter].value(:osfamily).casecmp('debian').zero?)
+    if (output.empty?) && (code > 0) && (Facter.value(:osfamily).casecmp('debian').zero?)
       ret = debian_enabled?
       return ret if ret
     end
@@ -164,15 +159,10 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   end
 
   def mask
-    disable if exist?
+    self.disable
     systemctl_change_enable(:mask)
   end
 
-  def exist?
-    result = execute([command(:systemctl), 'cat', '--', @resource[:name]], :failonfail => false)
-    result.exitstatus == 0
-  end
-
   def unmask
     systemctl_change_enable(:unmask)
   end

data/lib/puppet/provider/service/upstart.rb

@@ -10,10 +10,10 @@ Puppet::Type.type(:service).provide :upstart, :parent => :debian do
   "
 
   confine :any => [
-    Puppet.runtime[:facter].value(:operatingsystem) == 'Ubuntu',
-    (Puppet.runtime[:facter].value(:osfamily) == 'RedHat' and Puppet.runtime[:facter].value(:operatingsystemrelease) =~ /^6\./),
-    (Puppet.runtime[:facter].value(:operatingsystem) == 'Amazon' and Puppet.runtime[:facter].value(:operatingsystemmajrelease) =~ /\d{4}/),
-    Puppet.runtime[:facter].value(:operatingsystem) == 'LinuxMint',
+    Facter.value(:operatingsystem) == 'Ubuntu',
+    (Facter.value(:osfamily) == 'RedHat' and Facter.value(:operatingsystemrelease) =~ /^6\./),
+    (Facter.value(:operatingsystem) == 'Amazon' and Facter.value(:operatingsystemmajrelease) =~ /\d{4}/),
+    Facter.value(:operatingsystem) == 'LinuxMint',
   ]
 
   defaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["10.04", "12.04", "14.04", "14.10"]
@@ -57,7 +57,7 @@ Puppet::Type.type(:service).provide :upstart, :parent => :debian do
 
   def self.excludes
     excludes = super
-    if Puppet.runtime[:facter].value(:osfamily) == 'RedHat'
+    if Facter.value(:osfamily) == 'RedHat'
       # Puppet cannot deal with services that have instances, so we have to
       # ignore these services using instances on redhat based systems.
       excludes += %w[serial tty]

data/lib/puppet/provider/service/windows.rb

@@ -128,55 +128,17 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
     services
   end
 
-  def logonaccount_insync?(current)
-    @normalized_logon_account ||= normalize_logonaccount
-    @resource[:logonaccount] = @normalized_logon_account
-
-    insync = @resource[:logonaccount] == current
-    self.logonpassword = @resource[:logonpassword] if insync
-    insync
-  end
-
   def logonaccount
     return unless Puppet::Util::Windows::Service.exists?(@resource[:name])
     Puppet::Util::Windows::Service.logon_account(@resource[:name])
   end
 
   def logonaccount=(value)
-    validate_logon_credentials
     Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {logon_account: value, logon_password: @resource[:logonpassword]})
     restart if @resource[:ensure] == :running && [:running, :paused].include?(status)
   end
 
   def logonpassword=(value)
-    validate_logon_credentials
     Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {logon_password: value})
   end
-
-  private
-
-  def normalize_logonaccount
-    logon_account = @resource[:logonaccount].sub(/^\.\\/, "#{Puppet::Util::Windows::ADSI.computer_name}\\")
-    return 'LocalSystem' if Puppet::Util::Windows::User::localsystem?(logon_account)
-
-    @logonaccount_information ||= Puppet::Util::Windows::SID.name_to_principal(logon_account)
-    return logon_account unless @logonaccount_information
-    return ".\\#{@logonaccount_information.account}" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name
-    @logonaccount_information.domain_account
-  end
-
-  def validate_logon_credentials
-    unless Puppet::Util::Windows::User::localsystem?(@normalized_logon_account)
-      raise Puppet::Error.new("\"#{@normalized_logon_account}\" is not a valid account") unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)
-
-      user_rights = Puppet::Util::Windows::User::get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User::default_system_account?(@normalized_logon_account)
-      raise Puppet::Error.new("\"#{@normalized_logon_account}\" has the 'Log On As A Service' right set to denied.") if user_rights =~ /SeDenyServiceLogonRight/
-      raise Puppet::Error.new("\"#{@normalized_logon_account}\" is missing the 'Log On As A Service' right.") unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/
-    end
-
-    is_a_predefined_local_account = Puppet::Util::Windows::User::default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'
-    account_info = @normalized_logon_account.split("\\")
-    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account
-    raise Puppet::Error.new("The given password is invalid for user '#{@normalized_logon_account}'.") unless is_a_predefined_local_account || able_to_logon
-  end
 end

data/lib/puppet/provider/user/aix.rb

@@ -178,7 +178,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
       # does not have a password.
       break if line =~ /^\S+:$/
 
-      match_obj = /password\s+=\s+(\S+)/.match(line)
+      match_obj = /password = (\S+)/.match(line)
     end
     return :absent unless match_obj
 
@@ -211,7 +211,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
       tempfile = Tempfile.new("puppet_#{user}_pw", :encoding => Encoding::ASCII)
       tempfile << "#{user}:#{value}\n"
       tempfile.close()
-
+  
       # Options '-e', '-c', use encrypted password and clear flags
       # Must receive "user:enc_password" as input
       # command, arguments = {:failonfail => true, :combine => true}
@@ -265,50 +265,6 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
     end
   end
 
-  # Lists all instances of the given object, taking in an optional set
-  # of ia_module arguments. Returns an array of hashes, each hash
-  # having the schema
-  #   {
-  #     :name => <object_name>
-  #     :home => <object_home>
-  #   }
-  def list_all_homes(ia_module_args = [])
-    cmd = [command(:list), '-c', *ia_module_args, '-a', 'home', 'ALL']
-    parse_aix_objects(execute(cmd)).to_a.map do |object|
-      name = object[:name]
-      home = object[:attributes].delete(:home)
-
-      { name: name, home: home }
-    end
-  rescue => e
-    Puppet.debug("Could not list home of all users: #{e.message}")
-    {}
-  end
-
-  # Deletes this instance resource
-  def delete
-    homedir = home
-    super
-    return unless @resource.managehome?
-
-    if !Puppet::Util.absolute_path?(homedir) || File.realpath(homedir) == '/' || Puppet::FileSystem.symlink?(homedir)
-      Puppet.debug("Can not remove home directory '#{homedir}' of user '#{@resource[:name]}'. Please make sure the path is not relative, symlink or '/'.")
-      return
-    end
-
-    affected_home = list_all_homes.find { |info| info[:home].start_with?(File.realpath(homedir)) }
-    if affected_home
-      Puppet.debug("Can not remove home directory '#{homedir}' of user '#{@resource[:name]}' as it would remove the home directory '#{affected_home[:home]}' of user '#{affected_home[:name]}' also.")
-      return
-    end
-
-    FileUtils.remove_entry_secure(homedir, true)
-  end
-
-  def deletecmd
-    [self.class.command(:delete), '-p'] + ia_module_args + [@resource[:name]]
-  end
-
   # UNSUPPORTED
   #- **profile_membership**
   #    Whether specified roles should be treated as the only roles
@@ -358,4 +314,5 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   #    be treated as the minimum membership list.  Valid values are
   #    `inclusive`, `minimum`.
   # UNSUPPORTED
+
 end