puppet 6.4.5-universal-darwin → 6.5.0-universal-darwin

data/lib/puppet/util/command_line/trollop.rb

@@ -215,7 +215,7 @@ class Parser
     opts[:type] = opts[:type] || type_from_default || :flag
 
     ## fill in :long
-    opts[:long] = opts[:long] ? opts[:long].to_s : name.to_s.tr("_", "-")
+    opts[:long] = opts[:long] ? opts[:long].to_s : name.to_s.gsub("_", "-")
     opts[:long] =
       case opts[:long]
       when /^--([^-].*)$/

data/lib/puppet/util/execution.rb

@@ -162,16 +162,15 @@ module Puppet::Util::Execution
 
     options = default_options.merge(options)
 
-    if command.is_a?(Array)
+    if options[:sensitive]
+      command_str = '[redacted]'
+    elsif command.is_a?(Array)
       command = command.flatten.map(&:to_s)
       command_str = command.join(" ")
     elsif command.is_a?(String)
       command_str = command
     end
 
-    # do this after processing 'command' array or string
-    command_str = '[redacted]' if options[:sensitive]
-
     user_log_s = ''
     if options[:uid]
       user_log_s << " uid=#{options[:uid]}"

data/lib/puppet/util/http_proxy.rb

@@ -4,15 +4,13 @@ require 'puppet/network/http'
 
 module Puppet::Util::HttpProxy
   def self.proxy(uri)
-    if http_proxy_host && !no_proxy?(uri)
-      Net::HTTP.new(uri.host, uri.port, self.http_proxy_host, self.http_proxy_port, self.http_proxy_user, self.http_proxy_password)
+    if self.no_proxy?(uri)
+      proxy_class = Net::HTTP::Proxy(nil)
     else
-      http = Net::HTTP.new(uri.host, uri.port, nil, nil, nil, nil)
-      # Net::HTTP defaults the proxy port even though we said not to
-      # use one. Set it to nil so caller is not surprised
-      http.proxy_port = nil if http.respond_to?(:proxy_port=)
-      http
+      proxy_class = Net::HTTP::Proxy(self.http_proxy_host, self.http_proxy_port, self.http_proxy_user, self.http_proxy_password)
     end
+
+    return proxy_class.new(uri.host, uri.port)
   end
 
   def self.http_proxy_env
@@ -35,7 +33,7 @@ module Puppet::Util::HttpProxy
   #   .example.com
   # We'll accommodate both here.
   def self.no_proxy?(dest)
-    unless no_proxy = self.no_proxy
+    unless no_proxy_env = ENV["no_proxy"] || ENV["NO_PROXY"]
       return false
     end
 
@@ -47,10 +45,18 @@ module Puppet::Util::HttpProxy
       end
     end
 
-    no_proxy.split(/\s*,\s*/).each do |d|
+    no_proxy_env.split(/\s*,\s*/).each do |d|
       host, port = d.split(':')
       host = Regexp.escape(host).gsub('\*', '.*')
 
+      #If the host of this no_proxy value starts with '.', this entry is
+      #a domain level entry. Don't pin the regex to the beginning of the entry.
+      #If it does not start with a '.' then it is a host specific entry and
+      #should be matched to the destination starting at the beginning.
+      unless host =~ /^\\\./
+        host = "^#{host}"
+      end
+
       #If this no_proxy entry specifies a port, we want to match it against
       #the destination port.  Otherwise just match hosts.
       if port
@@ -121,20 +127,6 @@ module Puppet::Util::HttpProxy
     return Puppet.settings[:http_proxy_password]
   end
 
-  def self.no_proxy
-    no_proxy_env = ENV["no_proxy"] || ENV["NO_PROXY"]
-
-    if no_proxy_env
-      return no_proxy_env
-    end
-
-    if Puppet.settings[:no_proxy] == 'none'
-      return nil
-    end
-
-    return Puppet.settings[:no_proxy]
-  end
-
   # Return a Net::HTTP::Proxy object.
   #
   # This method optionally configures SSL correctly if the URI scheme is
@@ -186,10 +178,10 @@ module Puppet::Util::HttpProxy
 
       headers = { 'Accept' => '*/*', 'User-Agent' => Puppet[:http_user_agent] }
       if Puppet.features.zlib?
-        headers["Accept-Encoding"] = Puppet::Network::HTTP::Compression::ACCEPT_ENCODING
+        headers.merge!({"Accept-Encoding" => Puppet::Network::HTTP::Compression::ACCEPT_ENCODING})
       end
 
-      response = proxy.send(:head, current_uri, headers)
+      response = proxy.send(:head, current_uri.path, headers)
       Puppet.debug("HTTP HEAD request to #{current_uri} returned #{response.code} #{response.message}")
 
       if [301, 302, 307].include?(response.code.to_i)
@@ -200,9 +192,9 @@ module Puppet::Util::HttpProxy
 
       if method != :head
         if block_given?
-          response = proxy.send("request_#{method}".to_sym, current_uri, headers, &block)
+          response = proxy.send("request_#{method}".to_sym, current_uri.path, headers, &block)
         else
-          response = proxy.send(method, current_uri, headers)
+          response = proxy.send(method, current_uri.path, headers)
         end
 
         Puppet.debug("HTTP #{method.to_s.upcase} request to #{current_uri} returned #{response.code} #{response.message}")

data/lib/puppet/util/log.rb

@@ -175,7 +175,7 @@ class Puppet::Util::Log
     # We only select the last 10 callers in the stack to avoid being spammy
     message = _("Received a Log attribute with invalid encoding:%{log_message}") %
         { log_message: Puppet::Util::CharacterEncoding.convert_to_utf_8(str.dump)}
-    message += '\n' + _("Backtrace:\n%{backtrace}") % { backtrace: caller(1, 10).join("\n") }
+    message += '\n' + _("Backtrace:\n%{backtrace}") % { backtrace: caller[0..10].join("\n") }
     message
   end
   private_class_method :coerce_string
@@ -392,7 +392,7 @@ class Puppet::Util::Log
   end
 
   def to_report
-    "#{time} #{source} (#{level}): #{self}"
+    "#{time} #{source} (#{level}): #{to_s}"
   end
 
   def to_s

data/lib/puppet/util/log/destinations.rb

@@ -34,7 +34,7 @@ Puppet::Util::Log.newdesttype :syslog do
       end
     else
       msg.to_s.split("\n").each do |line|
-        @syslog.send(msg.level, "(%s) %s" % [msg.source.to_s.delete("%"),
+        @syslog.send(msg.level, "(%s) %s" % [msg.source.to_s.gsub("%", ""),
             line.gsub("%", '%%')
           ]
         )
@@ -78,7 +78,7 @@ Puppet::Util::Log.newdesttype :file do
 
     # create the log file, if it doesn't already exist
     need_array_start = false
-    file_exists = Puppet::FileSystem.exist?(path)
+    file_exists = File.exists?(path)
     if @json == 1
       need_array_start = true
       if file_exists

data/lib/puppet/util/logging.rb

@@ -48,13 +48,12 @@ module Logging
   #    wish to log a message at all; in this case it is likely that you are only calling this method in order
   #    to take advantage of the backtrace logging.
   def log_exception(exception, message = :default, options = {})
+    trace = Puppet[:trace] || options[:trace]
     level = options[:level] || :err
-    combined_trace = Puppet[:trace] || options[:trace]
-    puppet_trace = Puppet[:puppet_trace] || options[:puppet_trace]
-
     if message == :default && exception.is_a?(Puppet::ParseErrorWithIssue)
       # Retain all detailed info and keep plain message and stacktrace separate
-      backtrace = build_exception_trace(exception, combined_trace, puppet_trace)
+      backtrace = []
+      build_exception_trace(backtrace, exception, trace)
       Puppet::Util::Log.create({
           :level => level,
           :source => log_source,
@@ -68,27 +67,28 @@ module Logging
           :node => exception.node
         }.merge(log_metadata))
     else
-      send_log(level, format_exception(exception, message, combined_trace, puppet_trace))
+      send_log(level, format_exception(exception, message, trace))
     end
   end
 
-  def build_exception_trace(exception, combined_trace = true, puppet_trace = false)
-    built_trace = format_backtrace(exception, combined_trace, puppet_trace)
-
+  def build_exception_trace(arr, exception, trace = true)
+    if trace and exception.backtrace
+      exception.backtrace.each do |line|
+        arr << line =~ /^(.+):(\d+.*)$/ ? ("#{Pathname($1).realpath}:#{$2}" rescue line) : line
+      end
+    end
     if exception.respond_to?(:original)
       original =  exception.original
       unless original.nil?
-        built_trace << _('Wrapped exception:')
-        built_trace << original.message
-        built_trace += build_exception_trace(original, combined_trace, puppet_trace)
+        arr << _('Wrapped exception:')
+        arr << original.message
+        build_exception_trace(arr, original, trace)
       end
     end
-
-    built_trace
   end
   private :build_exception_trace
 
-  def format_exception(exception, message = :default, combined_trace = true, puppet_trace = false)
+  def format_exception(exception, message = :default, trace = true)
     arr = []
     case message
     when :default
@@ -99,28 +99,16 @@ module Logging
       arr << message
     end
 
-    arr += format_backtrace(exception, combined_trace, puppet_trace)
-
+    if trace and exception.backtrace
+      arr << Puppet::Util.pretty_backtrace(exception.backtrace)
+    end
     if exception.respond_to?(:original) and exception.original
       arr << _("Wrapped exception:")
-      arr << format_exception(exception.original, :default, combined_trace, puppet_trace)
+      arr << format_exception(exception.original, :default, trace)
     end
-
     arr.flatten.join("\n")
   end
 
-  def format_backtrace(exception, combined_trace, puppet_trace)
-    puppetstack = exception.respond_to?(:puppetstack) ? exception.puppetstack : []
-
-    if combined_trace and exception.backtrace
-      Puppet::Util.format_backtrace_array(exception.backtrace, puppetstack)
-    elsif puppet_trace && !puppetstack.empty?
-      Puppet::Util.format_backtrace_array(puppetstack)
-    else
-      []
-    end
-  end
-
   def log_and_raise(exception, message)
     log_exception(exception, message)
     raise exception, message + "\n" + exception.to_s, exception.backtrace
@@ -206,9 +194,9 @@ module Logging
     # let's find the offending line;  we need to jump back up the stack a few steps to find the method that called
     #  the deprecated method
     if Puppet[:trace]
-      caller(3)
+      caller()[2..-1]
     else
-      [caller(3, 1).first]
+      [caller()[2]]
     end
   end
 

data/lib/puppet/util/metric.rb

@@ -54,11 +54,11 @@ class Puppet::Util::Metric
   end
 
   def values
-    @values.sort_by { |a| a[1] }
+    @values.sort { |a, b| a[1] <=> b[1] }
   end
 
   # Convert a name into a label.
   def self.labelize(name)
-    name.to_s.capitalize.tr("_", " ")
+    name.to_s.capitalize.gsub("_", " ")
   end
 end

data/lib/puppet/util/monkey_patches.rb

@@ -99,6 +99,39 @@ unless OpenSSL::X509::Name.instance_methods.include?(:to_utf8)
   end
 end
 
+if RUBY_VERSION =~ /^2\.3/
+  module OpenSSL::PKey
+    alias __original_read read
+    def read(*args)
+      __original_read(*args)
+    rescue ArgumentError => e
+      # ruby <= 2.3 raises ArgumentError if it can't decrypt
+      # passphrase protected private keys, fixed in 2.4.0
+      # see https://bugs.ruby-lang.org/issues/11774
+      raise OpenSSL::PKey::PKeyError, e.message
+    end
+    module_function :read
+    module_function :__original_read
+  end
+end
+
+unless OpenSSL::PKey::EC.instance_methods.include?(:private?)
+  class OpenSSL::PKey::EC
+    # Added in ruby 2.4.0 in https://github.com/ruby/ruby/commit/7c971e61f04
+    alias :private? :private_key?
+  end
+end
+
+unless OpenSSL::PKey::EC.singleton_methods.include?(:generate)
+  class OpenSSL::PKey::EC
+    # Added in ruby 2.4.0 in https://github.com/ruby/ruby/commit/85500b66342
+    def self.generate(string)
+      ec = OpenSSL::PKey::EC.new(string)
+      ec.generate_key
+    end
+  end
+end
+
 # The Enumerable#uniq method was added in Ruby 2.4.0 (https://bugs.ruby-lang.org/issues/11090)
 # This is a backport to earlier Ruby versions.
 #

data/lib/puppet/util/pidlock.rb

@@ -62,13 +62,12 @@ class Puppet::Util::Pidlock
     # POSIX and Windows platforms (PUP-9247).
     if Puppet.features.posix?
       procname = Puppet::Util::Execution.execute(["ps", "-p", lock_pid, "-o", "comm="]).strip
-      args     = Puppet::Util::Execution.execute(["ps", "-p", lock_pid, "-o", "args="]).strip
-      @lockfile.unlock unless procname =~ /ruby/ && args =~ /puppet/ || procname =~ /puppet(-.*)?$/
+      @lockfile.unlock unless procname =~ /puppet(-.*)?$/
     elsif Puppet.features.microsoft_windows?
       # On Windows, we're checking if the filesystem path name of the running
       # process is our vendored ruby:
       exe_path = Puppet::Util::Windows::Process::get_process_image_name_by_pid(lock_pid)
-      @lockfile.unlock unless exe_path =~ /\\bin\\ruby.exe$/
+      @lockfile.unlock unless exe_path =~ /Puppet\\puppet\\bin\\ruby.exe/
     end
   end
   private :clear_if_stale

data/lib/puppet/util/provider_features.rb

@@ -78,7 +78,7 @@ module Puppet::Util::ProviderFeatures
     str = ""
     @features ||= {}
     return nil if @features.empty?
-    names = @features.keys.sort_by(&:to_s)
+    names = @features.keys.sort { |a,b| a.to_s <=> b.to_s }
     names.each do |name|
       doc = @features[name].docs.gsub(/\n\s+/, " ")
       str << "- *#{name}*: #{doc}\n"
@@ -127,7 +127,9 @@ module Puppet::Util::ProviderFeatures
       # Create a method that will list all functional features.
       @feature_module.send(:define_method, :features) do
         return false unless defined?(features)
-        features.keys.find_all { |n| feature?(n) }.sort_by(&:to_s)
+        features.keys.find_all { |n| feature?(n) }.sort { |a,b|
+          a.to_s <=> b.to_s
+        }
       end
 
       # Create a method that will determine if a provided list of

data/lib/puppet/util/rdoc.rb

@@ -31,7 +31,7 @@ module Puppet::Util::RDoc
     # uses relative_path_from that will generate errors when the slashes don't
     # properly match.  This is a workaround for that issue.
     if Puppet::Util::Platform.windows? && RDoc::VERSION !~ /^[0-3]\./
-      options += [ "--root", Dir.pwd.tr('\\', '/')]
+      options += [ "--root", Dir.pwd.gsub(/\\/, '/')]
     end
     options += files
 

data/lib/puppet/util/reference.rb

@@ -58,7 +58,7 @@ class Puppet::Util::Reference
 
   def self.references(environment)
     instance_loader(:reference).loadall(environment)
-    loaded_instances(:reference).sort_by(&:to_s)
+    loaded_instances(:reference).sort { |a,b| a.to_s <=> b.to_s }
   end
 
   attr_accessor :page, :depth, :header, :title, :dynamic

data/lib/puppet/util/resource_template.rb

@@ -53,7 +53,7 @@ class Puppet::Util::ResourceTemplate
 
   def set_resource_variables
     @resource.to_hash.each do |param, value|
-      var = "@#{param}"
+      var = "@#{param.to_s}"
       instance_variable_set(var, value)
     end
   end

data/lib/puppet/util/selinux.rb

@@ -13,7 +13,7 @@ require 'pathname'
 
 module Puppet::Util::SELinux
 
-  def self.selinux_support?
+  def selinux_support?
     return false unless defined?(Selinux)
     if Selinux.is_selinux_enabled == 1
       return true
@@ -21,10 +21,6 @@ module Puppet::Util::SELinux
     false
   end
 
-  def selinux_support?
-    Puppet::Util::SELinux.selinux_support?
-  end
-
   # Retrieve and return the full context of the file.  If we don't have
   # SELinux support or if the SELinux call fails then return nil.
   def get_selinux_current_context(file)
@@ -206,9 +202,7 @@ module Puppet::Util::SELinux
         # If possible we use read_nonblock in a loop rather than read to work-
         # a linux kernel bug.  See ticket #1963 for details.
         mountfh = File.open("/proc/mounts")
-        loop do
-          mounts += mountfh.read_nonblock(1024)
-        end
+        mounts += mountfh.read_nonblock(1024) while true
       else
         # Otherwise we shell out and let cat do it for us
         mountfh = IO.popen("/bin/cat /proc/mounts")

data/lib/puppet/util/skip_tags.rb

@@ -6,4 +6,8 @@ class Puppet::Util::SkipTags
   def initialize(stags)
     self.tags = stags unless defined?(@tags)
   end
+
+  def split_qualified_tags?
+    false
+  end
 end

data/lib/puppet/util/windows/adsi.rb

@@ -1,23 +1,6 @@
 module Puppet::Util::Windows::ADSI
   require 'ffi'
 
-  # https://docs.microsoft.com/en-us/windows/win32/api/dsrole/ne-dsrole-dsrole_machine_role
-  STANDALONE_WORKSTATION = 0
-  MEMBER_WORKSTATION = 1
-  STANDALONE_SERVER = 2
-  MEMBER_SERVER = 3
-  BACKUP_DOMAIN_CONTROLLER = 4
-  PRIMARY_DOMAIN_CONTROLLER = 5
-
-  DOMAIN_ROLES = {
-    STANDALONE_WORKSTATION => :STANDALONE_WORKSTATION,
-    MEMBER_WORKSTATION => :MEMBER_WORKSTATION,
-    STANDALONE_SERVER => :STANDALONE_SERVER,
-    MEMBER_SERVER => :MEMBER_SERVER,
-    BACKUP_DOMAIN_CONTROLLER => :BACKUP_DOMAIN_CONTROLLER,
-    PRIMARY_DOMAIN_CONTROLLER => :PRIMARY_DOMAIN_CONTROLLER,
-  }
-
   class << self
     extend FFI::Library
 
@@ -111,14 +94,6 @@ module Puppet::Util::Windows::ADSI
       wmi_connection.execquery(query)
     end
 
-    def domain_role
-      unless @domain_role
-        query_result = Puppet::Util::Windows::ADSI.execquery('select DomainRole from Win32_ComputerSystem').to_enum.first
-        @domain_role = DOMAIN_ROLES[query_result.DomainRole] if query_result
-      end
-      @domain_role
-    end
-
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
@@ -201,12 +176,7 @@ module Puppet::Util::Windows::ADSI
         well_known = false
         if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
           # Examples of SidType include SidTypeUser, SidTypeGroup
-          if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
-            # Check if we're getting back a local user when domain-joined
-            return true unless [:MEMBER_WORKSTATION, :MEMBER_SERVER].include?(Puppet::Util::Windows::ADSI.domain_role)
-            # The resource domain and the computer name are not always case-matching
-            return sid.domain.casecmp(Puppet::Util::Windows::ADSI.computer_name) == 0
-          end
+          return true if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
 
           # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
           # so try to resolve it
@@ -416,23 +386,23 @@ module Puppet::Util::Windows::ADSI
       ADS_UF_SCRIPT:                                 0x0001,
       ADS_UF_ACCOUNTDISABLE:                         0x0002,
       ADS_UF_HOMEDIR_REQUIRED:                       0x0008,
-      ADS_UF_LOCKOUT:                                0x0010,
-      ADS_UF_PASSWD_NOTREQD:                         0x0020,
-      ADS_UF_PASSWD_CANT_CHANGE:                     0x0040,
-      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:        0x0080,
-      ADS_UF_TEMP_DUPLICATE_ACCOUNT:                 0x0100,
-      ADS_UF_NORMAL_ACCOUNT:                         0x0200,
-      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT:              0x0800,
-      ADS_UF_WORKSTATION_TRUST_ACCOUNT:              0x1000,
-      ADS_UF_SERVER_TRUST_ACCOUNT:                   0x2000,
-      ADS_UF_DONT_EXPIRE_PASSWD:                     0x10000,
-      ADS_UF_MNS_LOGON_ACCOUNT:                      0x20000,
-      ADS_UF_SMARTCARD_REQUIRED:                     0x40000,
-      ADS_UF_TRUSTED_FOR_DELEGATION:                 0x80000,
-      ADS_UF_NOT_DELEGATED:                          0x100000,
-      ADS_UF_USE_DES_KEY_ONLY:                       0x200000,
-      ADS_UF_DONT_REQUIRE_PREAUTH:                   0x400000,
-      ADS_UF_PASSWORD_EXPIRED:                       0x800000,
+      ADS_UF_LOCKOUT:                                0x0010,                          
+      ADS_UF_PASSWD_NOTREQD:                         0x0020,                   
+      ADS_UF_PASSWD_CANT_CHANGE:                     0x0040,               
+      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:        0x0080,       
+      ADS_UF_TEMP_DUPLICATE_ACCOUNT:                 0x0100,           
+      ADS_UF_NORMAL_ACCOUNT:                         0x0200,                   
+      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT:              0x0800,        
+      ADS_UF_WORKSTATION_TRUST_ACCOUNT:              0x1000,        
+      ADS_UF_SERVER_TRUST_ACCOUNT:                   0x2000,             
+      ADS_UF_DONT_EXPIRE_PASSWD:                     0x10000,            
+      ADS_UF_MNS_LOGON_ACCOUNT:                      0x20000,               
+      ADS_UF_SMARTCARD_REQUIRED:                     0x40000,              
+      ADS_UF_TRUSTED_FOR_DELEGATION:                 0x80000,          
+      ADS_UF_NOT_DELEGATED:                          0x100000,                  
+      ADS_UF_USE_DES_KEY_ONLY:                       0x200000,               
+      ADS_UF_DONT_REQUIRE_PREAUTH:                   0x400000,               
+      ADS_UF_PASSWORD_EXPIRED:                       0x800000,               
       ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: 0x1000000
     }