puppet 6.8.1 → 6.9.0

data/lib/puppet/ssl/base.rb

@@ -1,4 +1,4 @@
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 require 'puppet/ssl'
 require 'puppet/ssl/digest'
 require 'puppet/util/ssl'

data/lib/puppet/ssl/openssl_loader.rb

@@ -0,0 +1,28 @@
+require 'puppet/util/platform'
+
+# This file should be required instead of writing `require 'openssl'`
+# or any library that loads openssl like `net/https`. This allows the
+# core Puppet code to load correctly in JRuby environments that do not
+# have a functioning openssl (eg a FIPS enabled one).
+
+unless Puppet::Util::Platform.jruby_fips?
+  require 'openssl'
+  require 'net/https'
+else
+  # Even in JRuby we need to define the constants that are wrapped in
+  # Indirections: Puppet::SSL::{Key, Certificate, CertificateRequest}
+  module OpenSSL
+    module PKey
+      class RSA; end
+    end
+
+    module X509
+      class Request; end
+      class Certificate; end
+    end
+  end
+
+  Puppet::SSL::Certificate.indirection.terminus = :none
+  Puppet::SSL::CertificateRequest.indirection.terminus = :none
+  Puppet::SSL::Key.indirection.terminus = :none
+end

data/lib/puppet/ssl/validator.rb

@@ -1,4 +1,4 @@
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 
 # API for certificate verification
 #

data/lib/puppet/ssl/validator/default_validator.rb

@@ -1,4 +1,4 @@
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 require 'puppet/ssl'
 
 # Perform peer certificate verification against the known CA.

data/lib/puppet/ssl/validator/no_validator.rb

@@ -1,4 +1,4 @@
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 require 'puppet/ssl'
 
 # Performs no SSL verification

data/lib/puppet/thread_local.rb

@@ -0,0 +1,7 @@
+require 'concurrent'
+
+# We want to use the pure Ruby implementation even on JRuby. If we use the Java
+# implementation of ThreadLocal, we end up leaking references to JRuby instances
+# and preventing them from being garbage collected.
+class Puppet::ThreadLocal < Concurrent::RubyThreadLocalVar
+end

data/lib/puppet/type/exec.rb

@@ -464,9 +464,13 @@ module Puppet
           return false
         end
 
-        output.split(/\n/).each { |line|
-          self.debug(line)
-        }
+        if sensitive
+          self.debug("[output redacted]")
+        else
+          output.split(/\n/).each { |line|
+            self.debug(line)
+          }
+        end
 
         status.exitstatus != 0
       end
@@ -516,9 +520,13 @@ module Puppet
           return false
         end
 
-        output.split(/\n/).each { |line|
-          self.debug(line)
-        }
+        if sensitive
+          self.debug("[output redacted]")
+        else
+          output.split(/\n/).each { |line|
+            self.debug(line)
+          }
+        end
 
         status.exitstatus == 0
       end

data/lib/puppet/type/group.rb

@@ -24,7 +24,7 @@ module Puppet
 
     feature :libuser,
       "Allows local groups to be managed on systems that also use some other
-       remote NSS method of managing accounts."
+       remote Name Switch Service (NSS) method of managing accounts."
 
     ensurable do
       desc "Create or remove the group."
@@ -216,7 +216,9 @@ module Puppet
              :required_features => :libuser,
              :parent => Puppet::Parameter::Boolean) do
       desc "Forces the management of local accounts when accounts are also
-            being managed by some other NSS"
+            being managed by some other Name Switch Service (NSS).
+            
+            This option relies on your operating system's implementation of `luser*` commands, such as `luseradd` , `lgroupadd`, and `lusermod`. The `forcelocal` option could behave unpredictably in some circumstances. If the tools it depends on are not available, it might have no effect at all."
       defaultto false
     end
 

data/lib/puppet/type/package.rb

@@ -1,3 +1,4 @@
+# coding: utf-8
 # Define the different packaging systems.  Each package system is implemented
 # in a module, which then gets used to individually extend each package object.
 # This allows packages to exist on the same machine using different packaging
@@ -56,6 +57,7 @@ module Puppet
         a user or another package. Held is considered a superset of
         installed.",
       :methods => [:hold]
+    feature :install_only, "The provider accepts options to only install packages never update (kernels, etc.)"
     feature :install_options, "The provider accepts options to be
       passed to the installer command."
     feature :uninstall_options, "The provider accepts options to be
@@ -487,6 +489,14 @@ module Puppet
         which type of package you want."
     end
 
+    newparam(:install_only, :boolean => false, :parent => Puppet::Parameter::Boolean, :required_features => :install_only) do
+      desc <<-EOT
+        It should be set for packages that should only ever be installed,
+        never updated. Kernels in particular fall into this category.
+      EOT
+      defaultto false
+    end
+
     newparam(:install_options, :parent => Puppet::Parameter::PackageOptions, :required_features => :install_options) do
       desc <<-EOT
         An array of additional options to pass when installing a package. These

data/lib/puppet/type/user.rb

@@ -53,7 +53,7 @@ module Puppet
 
     feature :libuser,
       "Allows local users to be managed on systems that also use some other
-       remote NSS method of managing accounts."
+       remote Name Service Switch (NSS) method of managing accounts."
 
     feature :manages_shell,
       "The provider allows for setting shell and validates if possible"
@@ -690,7 +690,9 @@ module Puppet
             :required_features => :libuser,
             :parent => Puppet::Parameter::Boolean) do
       desc "Forces the management of local accounts when accounts are also
-            being managed by some other NSS"
+            being managed by some other Name Service Switch (NSS).
+            
+            This option relies on your operating system's implementation of `luser*` commands, such as `luseradd` , and `lgroupadd`, `lusermod`. The `forcelocal` option could behave unpredictably in some circumstances. If the tools it depends on are not available, it might have no effect at all."
       defaultto false
     end
 

data/lib/puppet/util/checksums.rb

@@ -139,7 +139,7 @@ module Puppet::Util::Checksums
 
   # Calculate a checksum using Digest::SHA224.
   def sha224(content)
-    require 'openssl'
+    require 'puppet/ssl/openssl_loader'
     OpenSSL::Digest::SHA224.new.hexdigest(content)
   end
 
@@ -148,14 +148,14 @@ module Puppet::Util::Checksums
   end
 
   def sha224_file(filename, lite = false)
-    require 'openssl'
+    require 'puppet/ssl/openssl_loader'
 
     digest = OpenSSL::Digest::SHA224.new
     checksum_file(digest, filename,  lite)
   end
 
   def sha224_stream(lite = false, &block)
-    require 'openssl'
+    require 'puppet/ssl/openssl_loader'
     digest = OpenSSL::Digest::SHA224.new
     checksum_stream(digest, block, lite)
   end

data/lib/puppet/util/http_proxy.rb

@@ -1,16 +1,18 @@
 require 'uri'
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 require 'puppet/network/http'
 
 module Puppet::Util::HttpProxy
   def self.proxy(uri)
-    if self.no_proxy?(uri)
-      proxy_class = Net::HTTP::Proxy(nil)
+    if http_proxy_host && !no_proxy?(uri)
+      Net::HTTP.new(uri.host, uri.port, self.http_proxy_host, self.http_proxy_port, self.http_proxy_user, self.http_proxy_password)
     else
-      proxy_class = Net::HTTP::Proxy(self.http_proxy_host, self.http_proxy_port, self.http_proxy_user, self.http_proxy_password)
+      http = Net::HTTP.new(uri.host, uri.port, nil, nil, nil, nil)
+      # Net::HTTP defaults the proxy port even though we said not to
+      # use one. Set it to nil so caller is not surprised
+      http.proxy_port = nil
+      http
     end
-
-    return proxy_class.new(uri.host, uri.port)
   end
 
   def self.http_proxy_env

data/lib/puppet/util/monkey_patches.rb

@@ -1,3 +1,5 @@
+require 'puppet/util/platform'
+
 module Puppet::Util::MonkeyPatches
 end
 
@@ -28,34 +30,34 @@ class Object
 end
 
 # (#19151) Reject all SSLv2 ciphers and handshakes
-require 'openssl'
-class OpenSSL::SSL::SSLContext
-  if DEFAULT_PARAMS[:options]
-    DEFAULT_PARAMS[:options] |= OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
-  else
-    DEFAULT_PARAMS[:options] = OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
-  end
-  if DEFAULT_PARAMS[:ciphers]
-    DEFAULT_PARAMS[:ciphers] << ':!SSLv2'
-  end
+require 'puppet/ssl/openssl_loader'
+unless Puppet::Util::Platform.jruby_fips?
+  class OpenSSL::SSL::SSLContext
+    if DEFAULT_PARAMS[:options]
+      DEFAULT_PARAMS[:options] |= OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
+    else
+      DEFAULT_PARAMS[:options] = OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
+    end
+    if DEFAULT_PARAMS[:ciphers]
+      DEFAULT_PARAMS[:ciphers] << ':!SSLv2'
+    end
 
-  alias __original_initialize initialize
-  private :__original_initialize
+    alias __original_initialize initialize
+    private :__original_initialize
 
-  def initialize(*args)
-    __original_initialize(*args)
-    params = {
-      :options => DEFAULT_PARAMS[:options],
-      :ciphers => DEFAULT_PARAMS[:ciphers],
-    }
-    set_params(params)
+    def initialize(*args)
+      __original_initialize(*args)
+      params = {
+        :options => DEFAULT_PARAMS[:options],
+        :ciphers => DEFAULT_PARAMS[:ciphers],
+      }
+      set_params(params)
+    end
   end
 end
 
-require 'puppet/util/platform'
 if Puppet::Util::Platform.windows?
   require 'puppet/util/windows'
-  require 'openssl'
 
   class OpenSSL::X509::Store
     @puppet_certs_loaded = false
@@ -80,38 +82,42 @@ if Puppet::Util::Platform.windows?
   end
 end
 
-unless OpenSSL::X509::Name.instance_methods.include?(:to_utf8)
-  class OpenSSL::X509::Name
-    # https://github.com/openssl/openssl/blob/OpenSSL_1_1_0j/include/openssl/asn1.h#L362
-    ASN1_STRFLGS_ESC_MSB = 4
-
-    FLAGS = if RUBY_PLATFORM == 'java'
-              OpenSSL::X509::Name::RFC2253
-            else
-              OpenSSL::X509::Name::RFC2253 & ~ASN1_STRFLGS_ESC_MSB
-            end
-
-    def to_utf8
-      # https://github.com/ruby/ruby/blob/v2_5_5/ext/openssl/ossl_x509name.c#L317
-      str = to_s(FLAGS)
-      str.force_encoding(Encoding::UTF_8)
+unless Puppet::Util::Platform.jruby_fips?
+  unless OpenSSL::X509::Name.instance_methods.include?(:to_utf8)
+    class OpenSSL::X509::Name
+      # https://github.com/openssl/openssl/blob/OpenSSL_1_1_0j/include/openssl/asn1.h#L362
+      ASN1_STRFLGS_ESC_MSB = 4
+
+      FLAGS = if RUBY_PLATFORM == 'java'
+                OpenSSL::X509::Name::RFC2253
+              else
+                OpenSSL::X509::Name::RFC2253 & ~ASN1_STRFLGS_ESC_MSB
+              end
+
+      def to_utf8
+        # https://github.com/ruby/ruby/blob/v2_5_5/ext/openssl/ossl_x509name.c#L317
+        str = to_s(FLAGS)
+        str.force_encoding(Encoding::UTF_8)
+      end
     end
   end
 end
 
-unless OpenSSL::PKey::EC.instance_methods.include?(:private?)
-  class OpenSSL::PKey::EC
-    # Added in ruby 2.4.0 in https://github.com/ruby/ruby/commit/7c971e61f04
-    alias :private? :private_key?
+unless Puppet::Util::Platform.jruby_fips?
+  unless OpenSSL::PKey::EC.instance_methods.include?(:private?)
+    class OpenSSL::PKey::EC
+      # Added in ruby 2.4.0 in https://github.com/ruby/ruby/commit/7c971e61f04
+      alias :private? :private_key?
+    end
   end
-end
 
-unless OpenSSL::PKey::EC.singleton_methods.include?(:generate)
-  class OpenSSL::PKey::EC
-    # Added in ruby 2.4.0 in https://github.com/ruby/ruby/commit/85500b66342
-    def self.generate(string)
-      ec = OpenSSL::PKey::EC.new(string)
-      ec.generate_key
+  unless OpenSSL::PKey::EC.singleton_methods.include?(:generate)
+    class OpenSSL::PKey::EC
+      # Added in ruby 2.4.0 in https://github.com/ruby/ruby/commit/85500b66342
+      def self.generate(string)
+        ec = OpenSSL::PKey::EC.new(string)
+        ec.generate_key
+      end
     end
   end
 end

data/lib/puppet/util/platform.rb

@@ -33,6 +33,22 @@ module Puppet
       def self.jruby?
         RUBY_PLATFORM == 'java'
       end
+
+      def jruby_fips?
+        @@jruby_fips ||= if RUBY_PLATFORM == 'java'
+                           require 'java'
+
+                           begin
+                             require 'openssl'
+                             false
+                           rescue LoadError
+                             true
+                           end
+                         else
+                           false
+                         end
+      end
+      module_function :jruby_fips?
     end
   end
 end

data/lib/puppet/util/ssl.rb

@@ -1,4 +1,4 @@
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 
 ##
 # SSL is a private module with class methods that help work with x.509

data/lib/puppet/util/windows/root_certs.rb

@@ -1,5 +1,5 @@
 require 'puppet/util/windows'
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 require 'ffi'
 
 # Represents a collection of trusted root certificates.

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '6.8.1'
+  PUPPETVERSION = '6.9.0'
 
   ##
   # version is a public API method intended to always provide a fast and

data/lib/puppet/x509.rb

@@ -1,5 +1,5 @@
 require 'puppet'
-require 'openssl'
+require 'puppet/ssl/openssl_loader'
 
 module Puppet::X509 # :nodoc:
   require 'puppet/x509/pem_store'

data/locales/puppet.pot

@@ -6,11 +6,11 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Puppet automation framework 6.7.1-42-gc60d6aa\n"
+"Project-Id-Version: Puppet automation framework 6.8.0-57-g2e8956b\n"
 "\n"
 "Report-Msgid-Bugs-To: https://tickets.puppetlabs.com\n"
-"POT-Creation-Date: 2019-07-25 21:35+0000\n"
-"PO-Revision-Date: 2019-07-25 21:35+0000\n"
+"POT-Creation-Date: 2019-09-04 21:04+0000\n"
+"PO-Revision-Date: 2019-09-04 21:04+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
@@ -264,31 +264,31 @@ msgstr ""
 msgid "%{file} does not exist, cannot apply"
 msgstr ""
 
-#: ../lib/puppet/application/device.rb:253
+#: ../lib/puppet/application/device.rb:254
 msgid "Target device / certificate '%{target}' not found in %{config}"
 msgstr ""
 
-#: ../lib/puppet/application/device.rb:255
+#: ../lib/puppet/application/device.rb:256
 msgid "No device found in %{config}"
 msgstr ""
 
-#: ../lib/puppet/application/device.rb:306
+#: ../lib/puppet/application/device.rb:315
 msgid "retrieving resource: %{resource} from %{target} at %{scheme}%{url_host}%{port}%{url_path}"
 msgstr ""
 
-#: ../lib/puppet/application/device.rb:321
+#: ../lib/puppet/application/device.rb:330
 msgid "retrieving facts from %{target} at %{scheme}%{url_host}%{port}%{url_path}"
 msgstr ""
 
-#: ../lib/puppet/application/device.rb:344
+#: ../lib/puppet/application/device.rb:353
 msgid "starting applying configuration to %{target} at %{scheme}%{url_host}%{port}%{url_path}"
 msgstr ""
 
-#: ../lib/puppet/application/device.rb:381 ../lib/puppet/application/resource.rb:196
+#: ../lib/puppet/application/device.rb:391 ../lib/puppet/application/resource.rb:196
 msgid "You must specify the type to display"
 msgstr ""
 
-#: ../lib/puppet/application/device.rb:382 ../lib/puppet/application/resource.rb:197
+#: ../lib/puppet/application/device.rb:392 ../lib/puppet/application/resource.rb:197
 msgid "Could not find type %{type}"
 msgstr ""
 
@@ -641,24 +641,20 @@ msgstr ""
 msgid "Could not retrieve local facts: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/context.rb:41
-msgid "Attempted to pop, but already at root of the context stack."
-msgstr ""
-
-#: ../lib/puppet/context.rb:55
-msgid "Unable to lookup '%{name}'"
+#: ../lib/puppet/context.rb:77
+msgid "Mark for '%{name}' already exists"
 msgstr ""
 
-#: ../lib/puppet/context.rb:80
-msgid "no '%{name}' in ignores %{ignores} at top of %{stack}"
+#: ../lib/puppet/context.rb:92
+msgid "Unknown mark '%{name}'"
 msgstr ""
 
-#: ../lib/puppet/context.rb:93
-msgid "Mark for '%{name}' already exists"
+#: ../lib/puppet/context.rb:111 ../lib/puppet/context.rb:169
+msgid "Unable to lookup '%{name}'"
 msgstr ""
 
-#: ../lib/puppet/context.rb:107
-msgid "Unknown mark '%{name}'"
+#: ../lib/puppet/context.rb:120
+msgid "Attempted to pop, but already at root of the context stack."
 msgstr ""
 
 #: ../lib/puppet/context/trusted_information.rb:48
@@ -708,19 +704,19 @@ msgid "Convert custom terminus to hiera 5 API."
 msgstr ""
 
 #. TRANSLATORS 'environment_data_provider' is a setting and should not be translated
-#: ../lib/puppet/defaults.rb:672
+#: ../lib/puppet/defaults.rb:676
 msgid "Setting 'environment_data_provider' is deprecated."
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:753
+#: ../lib/puppet/defaults.rb:757
 msgid "Certificate names must be lower case"
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:934
+#: ../lib/puppet/defaults.rb:938
 msgid "Setting 'ssl_client_ca_auth' is deprecated."
 msgstr ""
 
-#: ../lib/puppet/defaults.rb:1013 ../lib/puppet/settings/enum_setting.rb:13 ../lib/puppet/settings/symbolic_enum_setting.rb:14
+#: ../lib/puppet/defaults.rb:1017 ../lib/puppet/settings/enum_setting.rb:13 ../lib/puppet/settings/symbolic_enum_setting.rb:14
 msgid "Invalid value '%{value}' for parameter %{name}. Allowed values are '%{allowed_values}'"
 msgstr ""
 
@@ -1463,11 +1459,11 @@ msgid ""
 "      the files downloaded, which will be empty if none were retrieved.\n"
 msgstr ""
 
-#: ../lib/puppet/face/plugin.rb:50
+#: ../lib/puppet/face/plugin.rb:57
 msgid "No plugins downloaded."
 msgstr ""
 
-#: ../lib/puppet/face/plugin.rb:52
+#: ../lib/puppet/face/plugin.rb:59
 msgid "Downloaded these plugins: %{plugins}"
 msgstr ""
 
@@ -2346,8 +2342,12 @@ msgstr ""
 msgid "Could not find node '%{name}'; cannot compile"
 msgstr ""
 
-#: ../lib/puppet/indirector/catalog/compiler.rb:410
-msgid "Could not retrieve fact %{fact}"
+#: ../lib/puppet/indirector/catalog/compiler.rb:416
+msgid "Could not retrieve fact servername"
+msgstr ""
+
+#: ../lib/puppet/indirector/catalog/compiler.rb:425
+msgid "Could not retrieve either serverip or serverip6 fact"
 msgstr ""
 
 #: ../lib/puppet/indirector/catalog/json.rb:13
@@ -3235,8 +3235,8 @@ msgstr ""
 msgid "Searching %{host} ..."
 msgstr ""
 
-#: ../lib/puppet/module_tool/applications/uninstaller.rb:19
-msgid "Module uninstall is prohibited in FIPS mode."
+#: ../lib/puppet/module_tool/applications/uninstaller.rb:92
+msgid "Either the `--ignore_changes` or `--force` argument must be specified to uninstall modules when running in FIPS mode."
 msgstr ""
 
 #: ../lib/puppet/module_tool/applications/unpacker.rb:49
@@ -3955,12 +3955,12 @@ msgid "Missing required Accept header"
 msgstr ""
 
 #. TRANSLATORS 'ssl_context' is an argument and should not be translated
-#: ../lib/puppet/network/http_pool.rb:79
+#: ../lib/puppet/network/http_pool.rb:80
 msgid "An ssl_context is required when connecting to 'https://%{host}:%{port}'"
 msgstr ""
 
 #. TRANSLATORS 'ssl_context' is an argument and should not be translated
-#: ../lib/puppet/network/http_pool.rb:87
+#: ../lib/puppet/network/http_pool.rb:88
 msgid "An ssl_context is unnecessary when connecting to 'http://%{host}:%{port}' and will be ignored"
 msgstr ""
 
@@ -5822,64 +5822,64 @@ msgstr ""
 msgid "Recursive lookup detected in [%{name_stack}]"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:101
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:108
 msgid "Invalid data type in lookup_options for key '%{key}' could not parse '%{source}', error: '%{msg}"
 msgstr ""
 
 #. TRANSLATORS 'lookup_options', 'convert_to' and args_string variable should not be translated,
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:109
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:116
 msgid "Applying convert_to lookup_option with arguments %{args}"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:112
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:119
 msgid "The convert_to lookup_option for key '%{key}' raised error: %{msg}"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:142
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:149
 msgid "Lookup of key '%{key}' failed: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:288
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:295
 msgid "value of %{opts} must be a hash"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:295
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:302
 msgid "all %{opts} patterns must match a key starting with module name '%{module_name}'"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:299
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:306
 msgid "all %{opts} keys must start with module name '%{module_name}'"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:424
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:431
 msgid "Defining \"data_provider\": \"%{name}\" in metadata.json is deprecated. It is ignored since a '%{config}' with version >= 5 is present"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:434
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:441
 msgid "Defining \"data_provider\": \"%{name}\" in metadata.json is deprecated."
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:435 ../lib/puppet/pops/lookup/lookup_adapter.rb:489
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:442 ../lib/puppet/pops/lookup/lookup_adapter.rb:496
 msgid "A '%{hiera_config}' file should be used instead"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:449
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:456
 msgid "Environment '%{env}', cannot find module_data_provider '%{provider}'"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:473
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:480
 msgid "Defining environment_data_provider='%{provider_name}' in environment.conf is deprecated"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:477
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:484
 msgid "The environment_data_provider='%{provider_name}' setting is ignored since '%{config_path}' version >= 5"
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:488
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:495
 msgid "Defining environment_data_provider='%{provider_name}' in environment.conf is deprecated."
 msgstr ""
 
-#: ../lib/puppet/pops/lookup/lookup_adapter.rb:504
+#: ../lib/puppet/pops/lookup/lookup_adapter.rb:511
 msgid "Environment '%{env}', cannot find environment_data_provider '%{provider}'"
 msgstr ""
 
@@ -6439,11 +6439,11 @@ msgstr ""
 msgid "aix.object_info(): Could not find %{resource}[%{name}]"
 msgstr ""
 
-#: ../lib/puppet/provider/aix_object.rb:469 ../lib/puppet/provider/nameservice.rb:181 ../lib/puppet/provider/nameservice/directoryservice.rb:425
+#: ../lib/puppet/provider/aix_object.rb:469 ../lib/puppet/provider/nameservice.rb:182 ../lib/puppet/provider/nameservice/directoryservice.rb:425
 msgid "Could not create %{resource} %{name}: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/provider/aix_object.rb:481 ../lib/puppet/provider/nameservice.rb:195
+#: ../lib/puppet/provider/aix_object.rb:481 ../lib/puppet/provider/nameservice.rb:196
 msgid "Could not delete %{resource} %{name}: %{detail}"
 msgstr ""
 
@@ -6479,23 +6479,23 @@ msgstr ""
 msgid "'%{exe}' is not executable"
 msgstr ""
 
-#: ../lib/puppet/provider/file/posix.rb:67
+#: ../lib/puppet/provider/file/posix.rb:72
 msgid "Apparently using negative UID (%{currentvalue}) on a platform that does not consistently handle them"
 msgstr ""
 
-#: ../lib/puppet/provider/file/posix.rb:85 ../lib/puppet/provider/file/windows.rb:46
+#: ../lib/puppet/provider/file/posix.rb:90 ../lib/puppet/provider/file/windows.rb:46
 msgid "Failed to set owner to '%{should}': %{detail}"
 msgstr ""
 
-#: ../lib/puppet/provider/file/posix.rb:99
+#: ../lib/puppet/provider/file/posix.rb:104
 msgid "Apparently using negative GID (%{currentvalue}) on a platform that does not consistently handle them"
 msgstr ""
 
-#: ../lib/puppet/provider/file/posix.rb:117 ../lib/puppet/provider/file/windows.rb:59
+#: ../lib/puppet/provider/file/posix.rb:122 ../lib/puppet/provider/file/windows.rb:59
 msgid "Failed to set group to '%{should}': %{detail}"
 msgstr ""
 
-#: ../lib/puppet/provider/file/posix.rb:134 ../lib/puppet/provider/file/windows.rb:78
+#: ../lib/puppet/provider/file/posix.rb:139 ../lib/puppet/provider/file/windows.rb:78
 msgid "failed to set mode %{mode} on %{path}: %{message}"
 msgstr ""
 
@@ -6549,15 +6549,15 @@ msgstr ""
 msgid "already exists"
 msgstr ""
 
-#: ../lib/puppet/provider/nameservice.rb:187
+#: ../lib/puppet/provider/nameservice.rb:188
 msgid "already absent"
 msgstr ""
 
-#: ../lib/puppet/provider/nameservice.rb:281
+#: ../lib/puppet/provider/nameservice.rb:282
 msgid "Nameservice command must be an array"
 msgstr ""
 
-#: ../lib/puppet/provider/nameservice.rb:285 ../lib/puppet/provider/nameservice/directoryservice.rb:340 ../lib/puppet/provider/nameservice/directoryservice.rb:369
+#: ../lib/puppet/provider/nameservice.rb:287 ../lib/puppet/provider/nameservice/directoryservice.rb:340 ../lib/puppet/provider/nameservice/directoryservice.rb:369
 msgid "Could not set %{param} on %{resource}[%{name}]: %{detail}"
 msgstr ""
 
@@ -6619,7 +6619,7 @@ msgstr ""
 msgid "Could not list installed Packages: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/provider/package/aix.rb:141 ../lib/puppet/provider/package/yum.rb:248
+#: ../lib/puppet/provider/package/aix.rb:141 ../lib/puppet/provider/package/yum.rb:252
 msgid "Tried to get latest on a missing package"
 msgstr ""
 
@@ -6651,7 +6651,7 @@ msgstr ""
 msgid "No responsefile specified or non existent, not preseeding anything"
 msgstr ""
 
-#: ../lib/puppet/provider/package/aptitude.rb:21 ../lib/puppet/provider/package/ports.rb:20 ../lib/puppet/provider/package/portupgrade.rb:94 ../lib/puppet/provider/package/portupgrade.rb:152 ../lib/puppet/provider/package/rug.rb:28 ../lib/puppet/provider/package/up2date.rb:17 ../lib/puppet/provider/package/yum.rb:229 ../lib/puppet/provider/package/zypper.rb:109
+#: ../lib/puppet/provider/package/aptitude.rb:21 ../lib/puppet/provider/package/ports.rb:20 ../lib/puppet/provider/package/portupgrade.rb:94 ../lib/puppet/provider/package/portupgrade.rb:152 ../lib/puppet/provider/package/rug.rb:28 ../lib/puppet/provider/package/up2date.rb:17 ../lib/puppet/provider/package/yum.rb:232 ../lib/puppet/provider/package/zypper.rb:109
 msgid "Could not find package %{name}"
 msgstr ""
 
@@ -6913,11 +6913,11 @@ msgstr ""
 msgid "portversion.latest() - fatal error with portversion: %{output}"
 msgstr ""
 
-#: ../lib/puppet/provider/package/rpm.rb:90
+#: ../lib/puppet/provider/package/rpm.rb:89
 msgid "Failed to list packages"
 msgstr ""
 
-#: ../lib/puppet/provider/package/rpm.rb:131 ../lib/puppet/provider/package/rpm.rb:144
+#: ../lib/puppet/provider/package/rpm.rb:128 ../lib/puppet/provider/package/rpm.rb:141
 msgid "RPMs must specify a package source"
 msgstr ""
 
@@ -6974,11 +6974,11 @@ msgstr ""
 msgid "Failed to parse package name and architecture from '%{pkgname}'"
 msgstr ""
 
-#: ../lib/puppet/provider/package/yum.rb:223
+#: ../lib/puppet/provider/package/yum.rb:226
 msgid "Could not find package %{wanted}"
 msgstr ""
 
-#: ../lib/puppet/provider/package/yum.rb:234
+#: ../lib/puppet/provider/package/yum.rb:237
 msgid "Failed to update to version %{should}, got version %{version} instead"
 msgstr ""
 
@@ -7644,7 +7644,7 @@ msgstr ""
 msgid "%{name} has not declared what class it wraps"
 msgstr ""
 
-#: ../lib/puppet/ssl/base.rb:32 ../lib/puppet/x509/cert_provider.rb:340
+#: ../lib/puppet/ssl/base.rb:32 ../lib/puppet/x509/cert_provider.rb:338
 msgid "Certname %{name} must not contain unprintable or non-ASCII characters"
 msgstr ""
 
@@ -8317,19 +8317,19 @@ msgstr ""
 msgid "You cannot add relationships without a catalog"
 msgstr ""
 
-#: ../lib/puppet/type.rb:2482
+#: ../lib/puppet/type.rb:2481
 msgid "Unable to mark '%{name}' as sensitive: %{name} is a parameter and not a property, and cannot be automatically redacted."
 msgstr ""
 
-#: ../lib/puppet/type.rb:2485
+#: ../lib/puppet/type.rb:2484
 msgid "Unable to mark '%{name}' as sensitive: the property itself was not assigned a value."
 msgstr ""
 
-#: ../lib/puppet/type.rb:2487
+#: ../lib/puppet/type.rb:2486
 msgid "Unable to mark '%{name}' as sensitive: the property itself is not defined on %{type}."
 msgstr ""
 
-#: ../lib/puppet/type.rb:2545
+#: ../lib/puppet/type.rb:2544
 msgid "Could not set %{attribute} on %{class_name}: %{detail}"
 msgstr ""
 
@@ -8555,15 +8555,15 @@ msgstr ""
 msgid "Invalid GID %{gid}"
 msgstr ""
 
-#: ../lib/puppet/type/package.rb:116 ../lib/puppet/type/package.rb:130
+#: ../lib/puppet/type/package.rb:118 ../lib/puppet/type/package.rb:132
 msgid "Could not update: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/type/package.rb:165
+#: ../lib/puppet/type/package.rb:167
 msgid "Could not get latest version: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/type/package.rb:265
+#: ../lib/puppet/type/package.rb:267
 msgid "Name must be a String not %{klass}"
 msgstr ""
 
@@ -8720,31 +8720,31 @@ msgstr ""
 msgid "Profile names must be provided as an array, not a comma-separated list"
 msgstr ""
 
-#: ../lib/puppet/type/user.rb:700
+#: ../lib/puppet/type/user.rb:702
 msgid "Ssh_authorized_key type is not available. Cannot purge SSH keys."
 msgstr ""
 
-#: ../lib/puppet/type/user.rb:738
+#: ../lib/puppet/type/user.rb:740
 msgid "Each entry for purge_ssh_keys must be a string, not a %{klass}"
 msgstr ""
 
-#: ../lib/puppet/type/user.rb:741
+#: ../lib/puppet/type/user.rb:743
 msgid "Paths to keyfiles must be absolute, not %{entry}"
 msgstr ""
 
-#: ../lib/puppet/type/user.rb:745
+#: ../lib/puppet/type/user.rb:747
 msgid "purge_ssh_keys must be true, false, or an array of file names, not %{value}"
 msgstr ""
 
-#: ../lib/puppet/type/user.rb:757
+#: ../lib/puppet/type/user.rb:759
 msgid "purge_ssh_keys can only be true for users with a defined home directory"
 msgstr ""
 
-#: ../lib/puppet/type/user.rb:764
+#: ../lib/puppet/type/user.rb:766
 msgid "purge_ssh_keys value '%{value}' meta character ~ or %{home_placeholder} only allowed for users with a defined home directory"
 msgstr ""
 
-#: ../lib/puppet/type/user.rb:779
+#: ../lib/puppet/type/user.rb:781
 msgid "Class name must be provided."
 msgstr ""
 
@@ -9123,23 +9123,23 @@ msgstr ""
 msgid "%{klass} failed with error %{error_type}: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/util/execution.rb:195
+#: ../lib/puppet/util/execution.rb:196
 msgid "Working directory %{cwd} does not exist!"
 msgstr ""
 
-#: ../lib/puppet/util/execution.rb:287
+#: ../lib/puppet/util/execution.rb:288
 msgid "Could not get output"
 msgstr ""
 
-#: ../lib/puppet/util/execution.rb:296
+#: ../lib/puppet/util/execution.rb:297
 msgid "Execution of '%{str}' returned %{exit_status}: %{output}"
 msgstr ""
 
-#: ../lib/puppet/util/execution.rb:373
+#: ../lib/puppet/util/execution.rb:374
 msgid "Could not execute posix command: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/util/execution.rb:421
+#: ../lib/puppet/util/execution.rb:422
 msgid "Waiting for output; will sleep %{time_to_sleep} seconds"
 msgstr ""
 
@@ -9251,7 +9251,7 @@ msgstr ""
 msgid "Could not write crontab for %{path}: %{detail}"
 msgstr ""
 
-#: ../lib/puppet/util/http_proxy.rb:207
+#: ../lib/puppet/util/http_proxy.rb:221
 msgid "Too many HTTP redirections for %{uri}"
 msgstr ""
 
@@ -9503,31 +9503,31 @@ msgstr ""
 msgid "Caught exception %{klass}:%{error} retrying"
 msgstr ""
 
-#: ../lib/puppet/util/selinux.rb:67
+#: ../lib/puppet/util/selinux.rb:71
 msgid "Invalid context to parse: %{context}"
 msgstr ""
 
-#: ../lib/puppet/util/selinux.rb:79
+#: ../lib/puppet/util/selinux.rb:83
 msgid "Invalid SELinux parameter type"
 msgstr ""
 
-#: ../lib/puppet/util/selinux.rb:100
+#: ../lib/puppet/util/selinux.rb:104
 msgid "Can't set SELinux context on file unless the file already has some kind of context"
 msgstr ""
 
-#: ../lib/puppet/util/selinux.rb:114
+#: ../lib/puppet/util/selinux.rb:118
 msgid "set_selinux_context component must be one of :seluser, :selrole, :seltype, or :selrange"
 msgstr ""
 
-#: ../lib/puppet/util/selinux.rb:125
+#: ../lib/puppet/util/selinux.rb:129
 msgid "Failed to set SELinux context %{context} on %{file}"
 msgstr ""
 
-#: ../lib/puppet/util/selinux.rb:176
+#: ../lib/puppet/util/selinux.rb:180
 msgid "Could not open SELinux category translation file %{path}."
 msgstr ""
 
-#: ../lib/puppet/util/selinux.rb:244
+#: ../lib/puppet/util/selinux.rb:248
 msgid "got a relative path in SELinux find_fs: %{path}"
 msgstr ""
 
@@ -9812,72 +9812,72 @@ msgid "Failed to get volume information"
 msgstr ""
 
 #. TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-#: ../lib/puppet/util/windows/security.rb:337
+#: ../lib/puppet/util/windows/security.rb:339
 msgid "Setting control rights for %{path} owner SYSTEM to less than Full Control rights. Setting SYSTEM rights to less than Full Control may have unintented consequences for operations on this file"
 msgstr ""
 
 #. TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-#: ../lib/puppet/util/windows/security.rb:340
+#: ../lib/puppet/util/windows/security.rb:342
 msgid "%{path} owner and group both set to user SYSTEM, but group is not managed directly: SYSTEM user rights will be set to FullControl by group"
 msgstr ""
 
 #. TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-#: ../lib/puppet/util/windows/security.rb:343
+#: ../lib/puppet/util/windows/security.rb:345
 msgid "An attempt to set mode %{mode} on item %{path} would result in the owner, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control"
 msgstr ""
 
 #. TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-#: ../lib/puppet/util/windows/security.rb:353
+#: ../lib/puppet/util/windows/security.rb:355
 msgid "Setting control rights for %{path} group SYSTEM to less than Full Control rights. Setting SYSTEM rights to less than Full Control may have unintented consequences for operations on this file"
 msgstr ""
 
 #. TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-#: ../lib/puppet/util/windows/security.rb:356
+#: ../lib/puppet/util/windows/security.rb:358
 msgid "%{path} owner and group both set to user SYSTEM, but owner is not managed directly: SYSTEM user rights will be set to FullControl by owner"
 msgstr ""
 
 #. TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-#: ../lib/puppet/util/windows/security.rb:359
+#: ../lib/puppet/util/windows/security.rb:361
 msgid "An attempt to set mode %{mode} on item %{path} would result in the group, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:430 ../lib/puppet/util/windows/security.rb:447 ../lib/puppet/util/windows/sid.rb:154 ../lib/puppet/util/windows/sid.rb:216 ../lib/puppet/util/windows/user.rb:43
+#: ../lib/puppet/util/windows/security.rb:432 ../lib/puppet/util/windows/security.rb:449 ../lib/puppet/util/windows/sid.rb:155 ../lib/puppet/util/windows/sid.rb:217 ../lib/puppet/util/windows/user.rb:43
 msgid "Invalid SID"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:434 ../lib/puppet/util/windows/security.rb:451
+#: ../lib/puppet/util/windows/security.rb:436 ../lib/puppet/util/windows/security.rb:453
 msgid "Failed to add access control entry"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:462 ../lib/puppet/util/windows/security.rb:644
+#: ../lib/puppet/util/windows/security.rb:464 ../lib/puppet/util/windows/security.rb:646
 msgid "Invalid DACL"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:485
+#: ../lib/puppet/util/windows/security.rb:487
 msgid "Unsupported access control entry type: 0x%{type}"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:519
+#: ../lib/puppet/util/windows/security.rb:521
 msgid "Failed to open '%{path}'"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:566
+#: ../lib/puppet/util/windows/security.rb:568
 msgid "Failed to adjust process privileges"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:596
+#: ../lib/puppet/util/windows/security.rb:598
 msgid "Failed to get security information"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:607
+#: ../lib/puppet/util/windows/security.rb:609
 msgid "Failed to get security descriptor control"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:640
+#: ../lib/puppet/util/windows/security.rb:642
 msgid "Failed to initialize ACL"
 msgstr ""
 
-#: ../lib/puppet/util/windows/security.rb:679
+#: ../lib/puppet/util/windows/security.rb:681
 msgid "Failed to set security information"
 msgstr ""
 
@@ -9993,19 +9993,19 @@ msgstr ""
 msgid "Timed out while waiting for the pending transition from %{pending_state} to %{final_state} to finish. The current state is %{current_state}."
 msgstr ""
 
-#: ../lib/puppet/util/windows/sid.rb:93
+#: ../lib/puppet/util/windows/sid.rb:94
 msgid "Octet string must be an array of bytes"
 msgstr ""
 
-#: ../lib/puppet/util/windows/sid.rb:160
+#: ../lib/puppet/util/windows/sid.rb:161
 msgid "Failed to convert binary SID"
 msgstr ""
 
-#: ../lib/puppet/util/windows/sid.rb:165
+#: ../lib/puppet/util/windows/sid.rb:166
 msgid "ConvertSidToStringSidW failed to allocate buffer for sid"
 msgstr ""
 
-#: ../lib/puppet/util/windows/sid.rb:185
+#: ../lib/puppet/util/windows/sid.rb:186
 msgid "Failed to convert string SID: %{string_sid}"
 msgstr ""
 
@@ -10079,26 +10079,26 @@ msgstr ""
 msgid "Failed to load private key for '%{name}'"
 msgstr ""
 
-#: ../lib/puppet/x509/cert_provider.rb:233
+#: ../lib/puppet/x509/cert_provider.rb:231
 msgid "Failed to save client certificate for '%{name}'"
 msgstr ""
 
-#: ../lib/puppet/x509/cert_provider.rb:248
+#: ../lib/puppet/x509/cert_provider.rb:246
 msgid "The client certificate is missing from '%{path}'"
 msgstr ""
 
-#: ../lib/puppet/x509/cert_provider.rb:252
+#: ../lib/puppet/x509/cert_provider.rb:250
 msgid "Failed to load client certificate for '%{name}'"
 msgstr ""
 
-#: ../lib/puppet/x509/cert_provider.rb:298
+#: ../lib/puppet/x509/cert_provider.rb:296
 msgid "Failed to save certificate request for '%{name}'"
 msgstr ""
 
-#: ../lib/puppet/x509/cert_provider.rb:313
+#: ../lib/puppet/x509/cert_provider.rb:311
 msgid "Failed to load certificate request for '%{name}'"
 msgstr ""
 
-#: ../lib/puppet/x509/cert_provider.rb:324
+#: ../lib/puppet/x509/cert_provider.rb:322
 msgid "Failed to delete certificate request for '%{name}'"
 msgstr ""