puppet 7.30.0-universal-darwin → 7.32.1-universal-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 37bf26e67e0a3e30bd6fbff29ee6594bb3e9ff234db1ae5db74458ff63d201c9
-  data.tar.gz: 7d6e603b2fdf0f6da6c4e2d43db5538e6594a4c2470e482ec958da074115ebdd
+  metadata.gz: 0264e0bde4a8f343146df9af4acb53b61cd2812431cb2d5d64cb1bd4b5896646
+  data.tar.gz: 35693bf5376876b0ba8cf99fc13fd383954e268eeb6f44231a878349f54b404a
 SHA512:
-  metadata.gz: 925a7e85ebbe7ad8ad80637f9a934896a0bb700761f91c60533d7c57b29df96cc29261decc471f9e058f02d9c7f86a525179d00da0f91716b3533df58ab31614
-  data.tar.gz: ffdd7f4c4ab5d92cd9792e0909e014ed0dde7a43ad46ed412df5d2fb7fe16c25ed9d204f725e6b055cccff51b7448a7f5c8b07da3db79b47ffea97a39b551e2a
+  metadata.gz: 9b4f36520b91272ce6b5592b000b46ac2a966937a4108c256d16efe2481e68b2e6a242537a61a35c259a9ea84ff78dca8220e1a8b917dde0d3aae0f16f9d3af2
+  data.tar.gz: 00b27aa8015db9927505455e4ca18cc16c70c2de40f4f10a0c78a7c51e1c8caee32be0cb244292c3c3650c3c2020b8bfdcd5cf252944e8500feb03654c999dbe

data/Gemfile

@@ -12,7 +12,11 @@ def location_for(place, fake_version = nil)
   end
 end
 
-# override .gemspec deps - may issue warning depending on Bundler version
+# Make sure these gem requirements are in sync with the gempspec. Specifically,
+# the runtime_dependencies in puppet.gemspec match the runtime dependencies here
+# (like semantic_puppet and puppet-resource_api)
+
+# override .gemspec deps for facter & hiera - may issue warning depending on Bundler version
 gem "facter", *location_for(ENV['FACTER_LOCATION']) if ENV.has_key?('FACTER_LOCATION')
 gem "hiera", *location_for(ENV['HIERA_LOCATION']) if ENV.has_key?('HIERA_LOCATION')
 gem "semantic_puppet", *location_for(ENV['SEMANTIC_PUPPET_LOCATION'] || ["~> 1.0"])
@@ -32,10 +36,12 @@ group(:features) do
   # requires native ldap headers/libs
   # gem 'ruby-ldap', '~> 0.9', require: false, platforms: [:ruby]
   gem 'puppetserver-ca', '~> 2.0', require: false
+  gem 'CFPropertyList', '~> 2.2', require: false
 end
 
 group(:test) do
-  gem "ffi", '1.15.5', require: false
+  # 1.16.0 - 1.16.2 are broken on Windows
+  gem 'ffi', '>= 1.15.5', '< 1.17.0', '!= 1.16.0', '!= 1.16.1', '!= 1.16.2', require: false
   gem "json-schema", "~> 2.0", require: false
   gem "rake", *location_for(ENV['RAKE_LOCATION'] || '~> 13.0')
   gem "rspec", "~> 3.1", require: false

data/Gemfile.lock

@@ -1,15 +1,15 @@
 PATH
   remote: .
   specs:
-    puppet (7.30.0)
-      CFPropertyList (~> 2.2)
+    puppet (7.32.1)
       concurrent-ruby (~> 1.0)
       deep_merge (~> 1.0)
-      facter (>= 2.4.0, < 5)
+      facter (> 2.0.1, < 5)
       fast_gettext (>= 1.1, < 3)
       hiera (>= 3.2.1, < 4)
       locale (~> 2.1)
-      multi_json (~> 1.13)
+      multi_json (~> 1.10)
+      puppet-resource_api (~> 1.5)
       scanf (~> 1.0)
       semantic_puppet (~> 1.0)
 
@@ -17,16 +17,14 @@ GEM
   remote: https://artifactory.delivery.puppetlabs.net/artifactory/api/gems/rubygems/
   specs:
     CFPropertyList (2.3.6)
-    addressable (2.8.6)
-      public_suffix (>= 2.0.2, < 6.0)
-    apt_stage_artifacts (0.11.0)
-      docopt
+    addressable (2.8.7)
+      public_suffix (>= 2.0.2, < 7.0)
     artifactory (3.0.17)
     ast (2.4.2)
     base64 (0.2.0)
-    bigdecimal (3.1.7)
+    bigdecimal (3.1.8)
     coderay (1.1.3)
-    concurrent-ruby (1.2.3)
+    concurrent-ruby (1.3.3)
     crack (1.0.0)
       bigdecimal
       rexml
@@ -37,16 +35,16 @@ GEM
     digest-crc (0.6.5)
       rake (>= 12.0.0, < 14.0.0)
     docopt (0.6.1)
-    facter (4.6.1)
+    facter (4.8.0)
       hocon (~> 1.3)
-      thor (>= 1.0.1, < 2.0)
-    faraday (2.8.1)
-      base64
-      faraday-net_http (>= 2.0, < 3.1)
-      ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.2)
+      thor (>= 1.0.1, < 1.3)
+    faraday (2.10.0)
+      faraday-net_http (>= 2.0, < 3.2)
+      logger
+    faraday-net_http (3.1.1)
+      net-http
     fast_gettext (1.1.2)
-    ffi (1.15.5)
+    ffi (1.16.3)
     gettext (3.2.9)
       locale (>= 2.0.5)
       text (>= 1.3.0)
@@ -54,7 +52,7 @@ GEM
       fast_gettext (~> 1.1.0)
       gettext (>= 3.0.2, < 3.3.0)
       locale
-    google-apis-core (0.14.1)
+    google-apis-core (0.15.0)
       addressable (~> 2.5, >= 2.5.1)
       googleauth (~> 1.9)
       httpclient (>= 2.8.1, < 3.a)
@@ -62,22 +60,22 @@ GEM
       representable (~> 3.0)
       retriable (>= 2.0, < 4.a)
       rexml
-    google-apis-iamcredentials_v1 (0.20.0)
-      google-apis-core (>= 0.14.0, < 2.a)
-    google-apis-storage_v1 (0.37.0)
-      google-apis-core (>= 0.14.0, < 2.a)
+    google-apis-iamcredentials_v1 (0.21.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.40.0)
+      google-apis-core (>= 0.15.0, < 2.a)
     google-cloud-core (1.7.0)
       google-cloud-env (>= 1.0, < 3.a)
       google-cloud-errors (~> 1.0)
     google-cloud-env (2.1.1)
       faraday (>= 1.0, < 3.a)
     google-cloud-errors (1.4.0)
-    google-cloud-storage (1.49.0)
+    google-cloud-storage (1.52.0)
       addressable (~> 2.8)
       digest-crc (~> 0.4)
       google-apis-core (~> 0.13)
       google-apis-iamcredentials_v1 (~> 0.18)
-      google-apis-storage_v1 (~> 0.33)
+      google-apis-storage_v1 (~> 0.38)
       google-cloud-core (~> 1.6)
       googleauth (~> 1.9)
       mini_mime (~> 1.0)
@@ -90,43 +88,45 @@ GEM
       signet (>= 0.16, < 2.a)
     hashdiff (1.1.0)
     hiera (3.12.0)
-    hiera-eyaml (3.4.0)
-      highline
-      optimist
+    hiera-eyaml (4.1.0)
+      highline (~> 2.1)
+      optimist (~> 3.1)
     highline (2.1.0)
     hocon (1.4.0)
     hpricot (0.8.6)
     httpclient (2.8.3)
     json-schema (2.8.1)
       addressable (>= 2.4)
-    jwt (2.8.1)
+    jwt (2.8.2)
       base64
     locale (2.1.4)
-    memory_profiler (1.0.1)
-    method_source (1.0.0)
+    logger (1.6.0)
+    memory_profiler (1.0.2)
+    method_source (1.1.0)
     mini_mime (1.1.5)
     minitar (0.9)
     msgpack (1.7.2)
     multi_json (1.15.0)
     mustache (1.1.1)
+    net-http (0.4.1)
+      uri
     optimist (3.1.0)
     os (1.1.4)
-    packaging (0.118.0)
-      apt_stage_artifacts
+    packaging (0.120.0)
       artifactory (~> 3)
       csv (>= 3.1.5)
       google-cloud-storage
       googleauth
       rake (>= 12.3)
       release-metrics
-    parallel (1.24.0)
-    parser (3.3.0.5)
+    parallel (1.25.1)
+    parser (3.3.4.0)
       ast (~> 2.4.1)
       racc
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    public_suffix (5.0.5)
+    public_suffix (6.0.1)
     puppet-resource_api (1.9.0)
       hocon (>= 1.0)
     puppetserver-ca (2.7.0)
@@ -136,7 +136,7 @@ GEM
     rake (13.2.1)
     rdiscount (2.2.7.3)
     rdoc (6.3.4.1)
-    regexp_parser (2.9.0)
+    regexp_parser (2.9.2)
     release-metrics (1.1.0)
       csv
       docopt
@@ -145,7 +145,8 @@ GEM
       trailblazer-option (>= 0.1.1, < 0.2.0)
       uber (< 0.2.0)
     retriable (3.1.2)
-    rexml (3.2.6)
+    rexml (3.3.2)
+      strscan
     ronn (0.7.3)
       hpricot (>= 0.8.2)
       mustache (>= 0.7.0)
@@ -156,13 +157,13 @@ GEM
       rspec-mocks (~> 3.13.0)
     rspec-core (3.13.0)
       rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.0)
+    rspec-expectations (3.13.1)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-its (1.3.0)
       rspec-core (>= 3.0.0)
       rspec-expectations (>= 3.0.0)
-    rspec-mocks (3.13.0)
+    rspec-mocks (3.13.1)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.1)
@@ -175,13 +176,12 @@ GEM
       rubocop-ast (>= 1.17.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.31.2)
-      parser (>= 3.3.0.4)
+    rubocop-ast (1.31.3)
+      parser (>= 3.3.1.0)
     rubocop-i18n (3.0.0)
       rubocop (~> 1.0)
-    ruby-prof (1.6.3)
+    ruby-prof (1.7.0)
     ruby-progressbar (1.13.0)
-    ruby2_keywords (0.0.5)
     scanf (1.0.0)
     semantic_puppet (1.1.0)
     signet (0.19.0)
@@ -189,24 +189,28 @@ GEM
       faraday (>= 0.17.5, < 3.a)
       jwt (>= 1.5, < 3.0)
       multi_json (~> 1.10)
+    strscan (3.1.0)
     text (1.3.1)
-    thor (1.3.1)
+    thor (1.2.2)
     trailblazer-option (0.1.2)
     uber (0.1.0)
     unicode-display_width (2.5.0)
+    uri (0.13.0)
     vcr (5.1.0)
-    webmock (3.23.0)
+    webmock (3.23.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
+    webrick (1.8.1)
     yard (0.9.36)
 
 PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
+  CFPropertyList (~> 2.2)
   diff-lcs (~> 1.3)
-  ffi (= 1.15.5)
+  ffi (>= 1.15.5, < 1.17.0, != 1.16.2, != 1.16.1, != 1.16.0)
   gettext-setup (~> 0.28)
   hiera-eyaml
   hocon (~> 1.0)
@@ -232,6 +236,7 @@ DEPENDENCIES
   semantic_puppet (~> 1.0)
   vcr (~> 5.0)
   webmock (~> 3.0)
+  webrick (~> 1.7)
   yard
 
 BUNDLED WITH

data/Rakefile

@@ -45,6 +45,47 @@ task :default do
   sh %{rake -T}
 end
 
+namespace :pl_ci do
+  desc 'Build puppet gems'
+  task :gem_build, [:gemspec] do |t, args|
+    args.with_defaults(gemspec: 'puppet.gemspec')
+    stdout, stderr, status = Open3.capture3(<<~END)
+      gem build #{args.gemspec} --platform x86-mingw32 && \
+      gem build #{args.gemspec} --platform x64-mingw32 && \
+      gem build #{args.gemspec} --platform universal-darwin && \
+      gem build #{args.gemspec}
+    END
+    if !status.exitstatus.zero?
+      puts "Error building #{args.gemspec}\n#{stdout} \n#{stderr}"
+      exit(1)
+    else
+      puts stdout
+    end
+  end
+
+  desc 'build the nightly puppet gems'
+  task :nightly_gem_build do
+    # this is taken from `rake package:nightly_gem`
+    extended_dot_version = %x{git describe --tags --dirty --abbrev=7}.chomp.tr('-', '.')
+
+    # we must create tempfile in the same directory as puppetg.gemspec, since
+    # it uses __dir__ to determine which files to include
+    require 'tempfile'
+    Tempfile.create('gemspec', __dir__) do |dst|
+      File.open('puppet.gemspec', 'r') do |src|
+        src.readlines.each do |line|
+          if line.match?(/version\s*=\s*['"][0-9.]+['"]/)
+            line = "spec.version = '#{extended_dot_version}'"
+          end
+          dst.puts line
+        end
+      end
+      dst.flush
+      Rake::Task['pl_ci:gem_build'].invoke(dst.path)
+    end
+  end
+end
+
 task :spec do
   ENV["LOG_SPEC_ORDER"] = "true"
   sh %{rspec #{ENV['TEST'] || ENV['TESTS'] || 'spec'}}

data/ext/project_data.yaml

@@ -1,54 +1,8 @@
 ---
 project: 'puppet'
-author: 'Puppet Labs'
-email: 'info@puppetlabs.com'
-homepage: 'https://github.com/puppetlabs/puppet'
-summary: 'Puppet, an automated configuration management tool'
-description: 'Puppet, an automated configuration management tool'
-version_file: 'lib/puppet/version.rb'
-# files and gem_files are space separated lists
-files: '[A-Z]* install.rb bin lib conf man examples ext tasks locales'
-# Make sure these gem requirements are in sync with the gemspec and Gemfile
-gem_files: '[A-Z]* install.rb bin lib conf man examples ext tasks locales'
-gem_test_files:
-gem_executables: 'puppet'
-gem_default_executables: 'puppet'
-gem_license: 'Apache-2.0'
-gem_forge_project: 'puppet'
-gem_required_ruby_version: '>= 2.5.0'
-gem_required_rubygems_version: '> 1.3.1'
-gem_runtime_dependencies:
-  facter: ['> 2.0.1', '< 5']
-  hiera: ['>= 3.2.1', '< 4']
-  semantic_puppet: '~> 1.0'
-  fast_gettext: ['>= 1.1', '< 3']
-  locale: '~> 2.1'
-  multi_json: '~> 1.10'
-  puppet-resource_api: '~>1.5'
-  concurrent-ruby: "~> 1.0"
-  deep_merge: '~> 1.0'
-  scanf: '~> 1.0'
 gem_rdoc_options:
   - --title
   - "Puppet - Configuration Management"
   - --main
   - README.md
   - --line-numbers
-gem_platform_dependencies:
-  universal-darwin:
-    gem_runtime_dependencies:
-      CFPropertyList: '~> 2.2'
-  x86-mingw32:
-    gem_runtime_dependencies:
-      ffi: '1.15.5'
-      minitar: '~> 0.9'
-  x64-mingw32:
-    gem_runtime_dependencies:
-      ffi: '1.15.5'
-      minitar: '~> 0.9'
-bundle_platforms:
-  universal-darwin: all
-  x86-mingw32: mingw
-  x64-mingw32: x64_mingw
-pre_tasks:
-  'package:apple': 'cfpropertylist'

data/ext/windows/service/daemon.rb

@@ -159,12 +159,19 @@ class WindowsDaemon < Puppet::Util::Windows::Daemon
     end
   end
 
+  # Parses runinterval.
+  #
+  # @param puppet_path [String] The file path for the Puppet executable.
+  # @return runinterval [Integer] How often to do a Puppet run, in seconds.
   def parse_runinterval(puppet_path)
     begin
-      runinterval = %x{ #{puppet_path} config --section agent --log_level notice print runinterval }.to_i
-      if runinterval == 0
+      runinterval = %x(#{puppet_path} config --section agent --log_level notice print runinterval).chomp
+      if runinterval == ''
         runinterval = 1800
         log_err("Failed to determine runinterval, defaulting to #{runinterval} seconds")
+      else
+        # Use Kernel#Integer because to_i will return 0 with non-numeric strings.
+        runinterval = Integer(runinterval)
       end
     rescue Exception => e
       log_exception(e)

data/lib/puppet/application/lookup.rb

@@ -1,6 +1,7 @@
 require_relative '../../puppet/application'
 require_relative '../../puppet/pops'
 require_relative '../../puppet/node'
+require_relative '../../puppet/node/server_facts'
 require_relative '../../puppet/parser/compiler'
 
 class Puppet::Application::Lookup < Puppet::Application
@@ -406,6 +407,7 @@ Copyright (c) 2015 Puppet Inc., LLC Licensed under the Apache 2.0 License
       node.add_extra_facts(given_facts) if given_facts
     end
     node.environment = Puppet[:environment] if Puppet.settings.set_by_cli?(:environment)
+    node.add_server_facts(Puppet::Node::ServerFacts.load)
     Puppet[:code] = 'undef' unless options[:compile]
     compiler = Puppet::Parser::Compiler.new(node)
     if options[:node]

data/lib/puppet/file_serving/http_metadata.rb

@@ -51,7 +51,9 @@ class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
   def collect
     # Prefer the checksum_type from the indirector request options
     # but fall back to the alternative otherwise
-    [ @checksum_type, :sha256, :sha1, :md5, :mtime ].each do |type|
+    [@checksum_type, :sha256, :sha1, :md5, :mtime].each do |type|
+      next if type == :md5 && Puppet::Util::Platform.fips_enabled?
+
       @checksum_type = type
       @checksum = @checksums[type]
       break if @checksum

data/lib/puppet/indirector/catalog/compiler.rb

@@ -1,5 +1,6 @@
 require_relative '../../../puppet/environments'
 require_relative '../../../puppet/node'
+require_relative '../../../puppet/node/server_facts'
 require_relative '../../../puppet/resource/catalog'
 require_relative '../../../puppet/indirector/code'
 require_relative '../../../puppet/util/profiler'
@@ -425,41 +426,6 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
   #
   # See also set_server_facts in Puppet::Server::Compiler in puppetserver.
   def set_server_facts
-    @server_facts = {}
-
-    # Add our server Puppet Enterprise version, if available.
-    pe_version_file = '/opt/puppetlabs/server/pe_version'
-    if File.readable?(pe_version_file) and !File.zero?(pe_version_file)
-      @server_facts['pe_serverversion'] = File.read(pe_version_file).chomp
-    end
-
-    # Add our server version to the fact list
-    @server_facts["serverversion"] = Puppet.version.to_s
-
-    # And then add the server name and IP
-    {"servername" => "fqdn",
-      "serverip"  => "ipaddress",
-      "serverip6" => "ipaddress6"
-    }.each do |var, fact|
-      value = Puppet.runtime[:facter].value(fact)
-      if !value.nil?
-        @server_facts[var] = value
-      end
-    end
-
-    if @server_facts["servername"].nil?
-      host = Puppet.runtime[:facter].value(:hostname)
-      if host.nil?
-        Puppet.warning _("Could not retrieve fact servername")
-      elsif domain = Puppet.runtime[:facter].value(:domain) #rubocop:disable Lint/AssignmentInCondition
-        @server_facts["servername"] = [host, domain].join(".")
-      else
-        @server_facts["servername"] = host
-      end
-    end
-
-    if @server_facts["serverip"].nil? && @server_facts["serverip6"].nil?
-      Puppet.warning _("Could not retrieve either serverip or serverip6 fact")
-    end
+    @server_facts = Puppet::Node::ServerFacts.load
   end
 end

data/lib/puppet/node/environment.rb

@@ -591,12 +591,11 @@ class Puppet::Node::Environment
       if file == NO_MANIFEST
         empty_parse_result
       elsif File.directory?(file)
-        # JRuby does not properly perform Dir.glob operations with wildcards, (see PUP-11788 and https://github.com/jruby/jruby/issues/7836).
         # We sort the results because Dir.glob order is inconsistent in Ruby < 3 (see PUP-10115).
-        parse_results = Puppet::FileSystem::PathPattern.absolute(File.join(file, '**/*')).glob.select {|globbed_file| globbed_file.end_with?('.pp')}.sort.map do | file_to_parse |
-                          parser.file = file_to_parse
-                          parser.parse
-                        end
+        parse_results = Puppet::FileSystem::PathPattern.absolute(File.join(file, '**/*.pp')).glob.sort.map do | file_to_parse |
+          parser.file = file_to_parse
+          parser.parse
+        end
         # Use a parser type specific merger to concatenate the results
         Puppet::Parser::AST::Hostclass.new('', :code => Puppet::Parser::ParserFactory.code_merger.concatenate(parse_results))
       else

data/lib/puppet/node/server_facts.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+class Puppet::Node::ServerFacts
+  def self.load
+    server_facts = {}
+
+    # Add our server Puppet Enterprise version, if available.
+    pe_version_file = '/opt/puppetlabs/server/pe_version'
+    if File.readable?(pe_version_file) and !File.zero?(pe_version_file)
+      server_facts['pe_serverversion'] = File.read(pe_version_file).chomp
+    end
+
+    # Add our server version to the fact list
+    server_facts["serverversion"] = Puppet.version.to_s
+
+    # And then add the server name and IP
+    {"servername" => "fqdn",
+      "serverip"  => "ipaddress",
+      "serverip6" => "ipaddress6"}.each do |var, fact|
+      value = Puppet.runtime[:facter].value(fact)
+      if !value.nil?
+        server_facts[var] = value
+      end
+    end
+
+    if server_facts["servername"].nil?
+      host = Puppet.runtime[:facter].value(:hostname)
+      if host.nil?
+        Puppet.warning _("Could not retrieve fact servername")
+      elsif domain = Puppet.runtime[:facter].value(:domain) #rubocop:disable Lint/AssignmentInCondition
+        server_facts["servername"] = [host, domain].join(".")
+      else
+        server_facts["servername"] = host
+      end
+    end
+
+    if server_facts["serverip"].nil? && server_facts["serverip6"].nil?
+      Puppet.warning _("Could not retrieve either serverip or serverip6 fact")
+    end
+
+    server_facts
+  end
+end

data/lib/puppet/pops/evaluator/deferred_resolver.rb

@@ -88,16 +88,25 @@ class DeferredResolver
       overrides = {}
       r.parameters.each_pair do |k, v|
         resolved = resolve(v)
-        # If the value is instance of Sensitive - assign the unwrapped value
-        # and mark it as sensitive if not already marked
-        #
-        if resolved.is_a?(Puppet::Pops::Types::PSensitiveType::Sensitive)
+        case resolved
+        when Puppet::Pops::Types::PSensitiveType::Sensitive
+          # If the resolved value is instance of Sensitive - assign the unwrapped value
+          # and mark it as sensitive if not already marked
+          #
           resolved = resolved.unwrap
           mark_sensitive_parameters(r, k)
-        # If the value is a DeferredValue and it has an argument of type PSensitiveType, mark it as sensitive
-        # The DeferredValue.resolve method will unwrap it during catalog application
-        elsif resolved.is_a?(Puppet::Pops::Evaluator::DeferredValue)
-          if v.arguments.any? {|arg| arg.is_a?(Puppet::Pops::Types::PSensitiveType)}
+
+        when Puppet::Pops::Evaluator::DeferredValue
+          # If the resolved value is a DeferredValue and it has an argument of type
+          # PSensitiveType, mark it as sensitive. Since DeferredValues can nest,
+          # we must walk all arguments, e.g. the DeferredValue may call the `epp`
+          # function, where one of its arguments is a DeferredValue to call the
+          # `vault:lookup` function.
+          #
+          # The DeferredValue.resolve method will unwrap the sensitive during
+          # catalog application
+          #
+          if contains_sensitive_args?(v)
             mark_sensitive_parameters(r, k)
           end
         end
@@ -107,6 +116,33 @@ class DeferredResolver
     end
   end
 
+  # Return true if x contains an argument that is an instance of PSensitiveType:
+  #
+  #   Deferred('new', [Sensitive, 'password'])
+  #
+  # Or an instance of PSensitiveType::Sensitive:
+  #
+  #   Deferred('join', [['a', Sensitive('b')], ':'])
+  #
+  # Since deferred values can nest, descend into Arrays and Hash keys and values,
+  # short-circuiting when the first occurrence is found.
+  #
+  def contains_sensitive_args?(x)
+    case x
+    when @deferred_class
+      contains_sensitive_args?(x.arguments)
+    when Array
+      x.any? { |v| contains_sensitive_args?(v) }
+    when Hash
+      x.any? { |k, v| contains_sensitive_args?(k) || contains_sensitive_args?(v) }
+    when Puppet::Pops::Types::PSensitiveType, Puppet::Pops::Types::PSensitiveType::Sensitive
+      true
+    else
+      false
+    end
+  end
+  private :contains_sensitive_args?
+
   def mark_sensitive_parameters(r, k)
     unless r.sensitive_parameters.include?(k.to_sym)
       r.sensitive_parameters = (r.sensitive_parameters + [k.to_sym]).freeze

data/lib/puppet/provider/group/groupadd.rb

@@ -15,11 +15,20 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     value.is_a? Integer
   end
 
-  optional_commands :localadd => "lgroupadd", :localdelete => "lgroupdel", :localmodify => "lgroupmod"
-
-  has_feature :manages_local_users_and_groups, :manages_members if Puppet.features.libuser?
-
-  options :members, :flag => '-M', :method => :mem
+  optional_commands :localadd => "lgroupadd", :localdelete => "lgroupdel", :localmodify => "lgroupmod", :purgemember => "usermod"
+
+  has_feature :manages_local_users_and_groups if Puppet.features.libuser?
+  has_feature :manages_members if Puppet.features.libuser? ||
+                                  (Puppet.runtime[:facter].value('os.name') == "Fedora" &&
+                                  Puppet.runtime[:facter].value('os.release.major').to_i >= 40)
+
+  # Libuser's modify command 'lgroupmod' requires '-M' flag for member additions.
+  # 'groupmod' command requires the '-aU' flags for it.
+  if Puppet.features.libuser?
+    options :members, :flag => '-M', :method => :mem
+  else
+    options :members, :flag => '-aU', :method => :mem
+  end
 
   def exists?
     return !!localgid if @resource.forcelocal?
@@ -58,7 +67,8 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
   end
 
   def addcmd
-    if @resource.forcelocal?
+    # The localadd command (lgroupadd) must only be called when libuser is supported.
+    if Puppet.features.libuser? && @resource.forcelocal?
       cmd = [command(:localadd)]
       @custom_environment = Puppet::Util::Libuser.getenv
     else
@@ -86,7 +96,8 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
   end
 
   def modifycmd(param, value)
-    if @resource.forcelocal? || @resource[:members]
+    # The localmodify command (lgroupmod) must only be called when libuser is supported.
+    if Puppet.features.libuser? && (@resource.forcelocal? || @resource[:members])
       cmd = [command(:localmodify)]
       @custom_environment = Puppet::Util::Libuser.getenv
     else
@@ -109,7 +120,8 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
   end
 
   def deletecmd
-    if @resource.forcelocal?
+    # The localdelete command (lgroupdel) must only be called when libuser is supported.
+    if Puppet.features.libuser? && @resource.forcelocal?
       @custom_environment = Puppet::Util::Libuser.getenv
       [command(:localdelete), @resource[:name]]
     else
@@ -127,7 +139,16 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
   end
 
   def purge_members
-    localmodify('-m', members_to_s(members), @resource.name)
+    # The groupadd provider doesn't have the ability currently to remove members from a group, libuser does.
+    # Use libuser's lgroupmod command to achieve purging members if libuser is supported.
+    # Otherwise use the 'usermod' command.
+    if Puppet.features.libuser?
+      localmodify('-m', members_to_s(members), @resource.name)
+    else
+      members.each do |member|
+        purgemember('-rG', @resource.name, member)
+      end
+    end
   end
 
   private

data/lib/puppet/util/windows/daemon.rb

@@ -188,25 +188,6 @@ module Puppet::Util::Windows
       end
     end
 
-    ThreadProc = FFI::Function.new(:ulong,[:pointer]) do |lpParameter|
-      ste = FFI::MemoryPointer.new(SERVICE_TABLE_ENTRYW, 2)
-
-      s = SERVICE_TABLE_ENTRYW.new(ste[0])
-      s[:lpServiceName] = FFI::MemoryPointer.from_string('')
-      s[:lpServiceProc] = lpParameter
-
-      s = SERVICE_TABLE_ENTRYW.new(ste[1])
-      s[:lpServiceName] = nil
-      s[:lpServiceProc] = nil
-
-      # No service to step, no service handle, no ruby exceptions, just terminate the thread..
-      if !StartServiceCtrlDispatcherW(ste)
-        return 1
-      end
-
-      return 0
-    end
-
     # This is a shortcut for Daemon.new + Daemon#mainloop.
     #
     def self.mainloop
@@ -256,26 +237,28 @@ module Puppet::Util::Windows
         raise SystemCallError.new('CreateEvent', FFI.errno)
       end
 
-      hThread = CreateThread(nil, 0, ThreadProc, Service_Main, 0, nil)
+      hThread = Thread.new do
+        ste = FFI::MemoryPointer.new(SERVICE_TABLE_ENTRYW, 2)
 
-      if hThread == 0
-        raise SystemCallError.new('CreateThread', FFI.errno)
-      end
+        s = SERVICE_TABLE_ENTRYW.new(ste[0])
+        s[:lpServiceName] = FFI::MemoryPointer.from_string("")
+        s[:lpServiceProc] = Service_Main
 
-      events = FFI::MemoryPointer.new(:pointer, 2)
-      events.put_pointer(0, FFI::Pointer.new(hThread))
-      events.put_pointer(FFI::Pointer.size, FFI::Pointer.new(@@hStartEvent))
+        s = SERVICE_TABLE_ENTRYW.new(ste[1])
+        s[:lpServiceName] = nil
+        s[:lpServiceProc] = nil
 
-      while ((index = WaitForMultipleObjects(2, events, 0, 1000)) == WAIT_TIMEOUT) do
+        # No service to step, no service handle, no ruby exceptions, just terminate the thread..
+        StartServiceCtrlDispatcherW(ste)
       end
 
-      if index == WAIT_FAILED
-        raise SystemCallError.new('WaitForMultipleObjects', FFI.errno)
+      while (index = WaitForSingleObject(@@hStartEvent, 1000)) == WAIT_TIMEOUT
+        # The thread exited, so the show is off.
+        raise "Service_Main thread exited abnormally" unless hThread.alive?
       end
 
-      # The thread exited, so the show is off.
-      if index == WAIT_OBJECT_0
-        raise "Service_Main thread exited abnormally"
+      if index == WAIT_FAILED
+        raise SystemCallError.new("WaitForSingleObject", FFI.errno)
       end
 
       thr = Thread.new do

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '7.30.0'
+  PUPPETVERSION = '7.32.1'
 
   ##
   # version is a public API method intended to always provide a fast and

data/man/man5/puppet.conf.5

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPETCONF" "5" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPETCONF" "5" "July 2024" "Puppet, Inc." "Puppet manual"
 \fBThis page is autogenerated; any changes will get overwritten\fR
 .
 .SH "Configuration settings"
@@ -945,7 +945,7 @@ The time to wait for data to be read from an HTTP connection\. If nothing is rea
 The HTTP User\-Agent string to send when making network requests\.
 .
 .IP "\(bu" 4
-\fIDefault\fR: \fBPuppet/7\.30\.0 Ruby/2\.7\.5\-p203 (x86_64\-linux)\fR
+\fIDefault\fR: \fBPuppet/7\.32\.0 Ruby/3\.1\.1\-p18 (x86_64\-linux)\fR
 .
 .IP "" 0
 .

data/man/man8/puppet-agent.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-AGENT" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-AGENT" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-agent\fR \- The puppet agent daemon

data/man/man8/puppet-apply.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-APPLY" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-APPLY" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-apply\fR \- Apply Puppet manifests locally

data/man/man8/puppet-catalog.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CATALOG" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-CATALOG" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-catalog\fR \- Compile, save, view, and convert catalogs\.

data/man/man8/puppet-config.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CONFIG" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-CONFIG" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-config\fR \- Interact with Puppet\'s settings\.

data/man/man8/puppet-describe.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DESCRIBE" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DESCRIBE" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-describe\fR \- Display help about resource types

data/man/man8/puppet-device.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DEVICE" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DEVICE" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-device\fR \- Manage remote network devices

data/man/man8/puppet-doc.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DOC" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DOC" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-doc\fR \- Generate Puppet references

data/man/man8/puppet-epp.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-EPP" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-EPP" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-epp\fR \- Interact directly with the EPP template parser/renderer\.

data/man/man8/puppet-facts.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-FACTS" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-FACTS" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-facts\fR \- Retrieve and store facts\.

data/man/man8/puppet-filebucket.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-FILEBUCKET" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-FILEBUCKET" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-filebucket\fR \- Store and retrieve files in a filebucket

data/man/man8/puppet-generate.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-GENERATE" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-GENERATE" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-generate\fR \- Generates Puppet code from Ruby definitions\.

data/man/man8/puppet-help.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-HELP" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-HELP" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-help\fR \- Display Puppet help\.

data/man/man8/puppet-lookup.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-LOOKUP" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-LOOKUP" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-lookup\fR \- Interactive Hiera lookup

data/man/man8/puppet-module.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-MODULE" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-MODULE" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-module\fR \- Creates, installs and searches for modules on the Puppet Forge\.

data/man/man8/puppet-node.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-NODE" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-NODE" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-node\fR \- View and manage node definitions\.

data/man/man8/puppet-parser.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-PARSER" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-PARSER" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-parser\fR \- Interact directly with the parser\.

data/man/man8/puppet-plugin.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-PLUGIN" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-PLUGIN" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-plugin\fR \- Interact with the Puppet plugin system\.

data/man/man8/puppet-report.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-REPORT" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-REPORT" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-report\fR \- Create, display, and submit reports\.

data/man/man8/puppet-resource.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-RESOURCE" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-RESOURCE" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-resource\fR \- The resource abstraction layer shell

data/man/man8/puppet-script.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-SCRIPT" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-SCRIPT" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-script\fR \- Run a puppet manifests as a script without compiling a catalog

data/man/man8/puppet-ssl.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-SSL" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-SSL" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-ssl\fR \- Manage SSL keys and certificates for puppet SSL clients

data/man/man8/puppet.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET" "8" "April 2024" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET" "8" "July 2024" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\fR
@@ -25,4 +25,4 @@ Specialized:
 catalog Compile, save, view, and convert catalogs\. describe Display help about resource types device Manage remote network devices doc Generate Puppet references epp Interact directly with the EPP template parser/renderer\. facts Retrieve and store facts\. filebucket Store and retrieve files in a filebucket generate Generates Puppet code from Ruby definitions\. node View and manage node definitions\. parser Interact directly with the parser\. plugin Interact with the Puppet plugin system\. script Run a puppet manifests as a script without compiling a catalog ssl Manage SSL keys and certificates for puppet SSL clients
 .
 .P
-See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v7\.30\.0
+See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v7\.32\.0

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppet
 version: !ruby/object:Gem::Version
-  version: 7.30.0
+  version: 7.32.1
 platform: universal-darwin
 authors:
 - Puppet Labs
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-04-09 00:00:00.000000000 Z
+date: 2012-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter
@@ -182,7 +182,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.2'
-description: Puppet, an automated configuration management tool
+description: |
+  Puppet, an automated administrative engine for your Linux, Unix, and Windows systems, performs administrative tasks
+  (such as adding users, installing packages, and updating server configurations) based on a centralized specification.
 email: info@puppetlabs.com
 executables:
 - puppet
@@ -663,6 +665,7 @@ files:
 - lib/puppet/node.rb
 - lib/puppet/node/environment.rb
 - lib/puppet/node/facts.rb
+- lib/puppet/node/server_facts.rb
 - lib/puppet/pal/catalog_compiler.rb
 - lib/puppet/pal/compiler.rb
 - lib/puppet/pal/function_signature.rb
@@ -1298,7 +1301,6 @@ files:
 - man/man8/puppet-ssl.8
 - man/man8/puppet.8
 - tasks/benchmark.rake
-- tasks/cfpropertylist.rake
 - tasks/ci.rake
 - tasks/generate_ast_model.rake
 - tasks/generate_cert_fixtures.rake
@@ -1316,7 +1318,7 @@ rdoc_options:
 - "--title"
 - Puppet - Configuration Management
 - "--main"
-- README.md
+- README
 - "--line-numbers"
 require_paths:
 - lib

data/tasks/cfpropertylist.rake

@@ -1,15 +0,0 @@
-task 'cfpropertylist' do
-  if defined? Pkg::Config and Pkg::Config.project_root
-    cfp_version = "2.3.5"
-    libdir = File.join(Pkg::Config.project_root, "lib")
-    source = "https://github.com/ckruse/CFPropertyList/archive/cfpropertylist-#{cfp_version}.tar.gz"
-    target_dir = Pkg::Util::File.mktemp
-    target = File.join(target_dir, "cfpropertylist")
-    Pkg::Util::Net.fetch_uri(source, target)
-    Pkg::Util::File.untar_into(target, target_dir, "--strip-components 1")
-    mv(Dir.glob("#{File.join(target_dir, "lib")}/cfpropertylist*"), libdir)
-    mv(Dir.glob("#{target_dir}/{LICENSE,README,THANKS}"), File.join(libdir, "cfpropertylist"))
-  else
-    warn "It looks like the packaging tasks have not been loaded. You'll need to `rake package:bootstrap` before using this task"
-  end
-end