puppet 8.5.1 → 8.6.0

data/lib/puppet/util/windows/security.rb

@@ -74,21 +74,21 @@ module Puppet::Util::Windows::Security
   extend FFI::Library
 
   # file modes
-  S_IRUSR = 0000400
-  S_IRGRP = 0000040
-  S_IROTH = 0000004
-  S_IWUSR = 0000200
-  S_IWGRP = 0000020
-  S_IWOTH = 0000002
-  S_IXUSR = 0000100
-  S_IXGRP = 0000010
-  S_IXOTH = 0000001
-  S_IRWXU = 0000700
-  S_IRWXG = 0000070
-  S_IRWXO = 0000007
-  S_ISVTX = 0001000
-  S_IEXTRA = 02000000 # represents an extra ace
-  S_ISYSTEM_MISSING = 04000000
+  S_IRUSR = 0o000400
+  S_IRGRP = 0o000040
+  S_IROTH = 0o000004
+  S_IWUSR = 0o000200
+  S_IWGRP = 0o000020
+  S_IWOTH = 0o000002
+  S_IXUSR = 0o000100
+  S_IXGRP = 0o000010
+  S_IXOTH = 0o000001
+  S_IRWXU = 0o000700
+  S_IRWXG = 0o000070
+  S_IRWXO = 0o000007
+  S_ISVTX = 0o001000
+  S_IEXTRA = 0o2000000 # represents an extra ace
+  S_ISYSTEM_MISSING = 0o4000000
 
   # constants that are missing from Windows::Security
   PROTECTED_DACL_SECURITY_INFORMATION   = 0x80000000
@@ -167,13 +167,13 @@ module Puppet::Util::Windows::Security
     supported = false
     root = Pathname.new(path).enum_for(:ascend).to_a.last.to_s
     # 'A trailing backslash is required'
-    root = "#{root}\\" unless root =~ /[\/\\]$/
+    root = "#{root}\\" unless root =~ %r{[/\\]$}
 
     FFI::MemoryPointer.new(:pointer, 1) do |flags_ptr|
       if GetVolumeInformationW(wide_string(root), FFI::Pointer::NULL, 0,
                                FFI::Pointer::NULL, FFI::Pointer::NULL,
                                flags_ptr, FFI::Pointer::NULL, 0) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Failed to get volume information"))
+        raise Puppet::Util::Windows::Error, _("Failed to get volume information")
       end
 
       supported = flags_ptr.read_dword & FILE_PERSISTENT_ACLS == FILE_PERSISTENT_ACLS
@@ -314,10 +314,10 @@ module Puppet::Util::Windows::Security
 
     # With a mode value of '7' for group / other, the value must then include
     # additional perms beyond STANDARD_RIGHTS_READ to allow DACL modification
-    if ((mode & S_IRWXG) == S_IRWXG)
+    if (mode & S_IRWXG) == S_IRWXG
       group_allow |= FILE::DELETE | FILE::WRITE_DAC | FILE::WRITE_OWNER
     end
-    if ((mode & S_IRWXO) == S_IRWXO)
+    if (mode & S_IRWXO) == S_IRWXO
       other_allow |= FILE::DELETE | FILE::WRITE_DAC | FILE::WRITE_OWNER
     end
 
@@ -433,11 +433,11 @@ module Puppet::Util::Windows::Security
 
     Puppet::Util::Windows::SID.string_to_sid_ptr(sid) do |sid_ptr|
       if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
+        raise Puppet::Util::Windows::Error, _("Invalid SID")
       end
 
       if AddAccessAllowedAceEx(acl, ACL_REVISION, inherit, mask, sid_ptr) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Failed to add access control entry"))
+        raise Puppet::Util::Windows::Error, _("Failed to add access control entry")
       end
     end
 
@@ -450,11 +450,11 @@ module Puppet::Util::Windows::Security
 
     Puppet::Util::Windows::SID.string_to_sid_ptr(sid) do |sid_ptr|
       if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
+        raise Puppet::Util::Windows::Error, _("Invalid SID")
       end
 
       if AddAccessDeniedAceEx(acl, ACL_REVISION, inherit, mask, sid_ptr) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Failed to add access control entry"))
+        raise Puppet::Util::Windows::Error, _("Failed to add access control entry")
       end
     end
 
@@ -465,7 +465,7 @@ module Puppet::Util::Windows::Security
   def parse_dacl(dacl_ptr)
     # REMIND: need to handle NULL DACL
     if IsValidAcl(dacl_ptr) == FFI::WIN32_FALSE
-      raise Puppet::Util::Windows::Error.new(_("Invalid DACL"))
+      raise Puppet::Util::Windows::Error, _("Invalid DACL")
     end
 
     dacl_struct = ACL.new(dacl_ptr)
@@ -522,7 +522,7 @@ module Puppet::Util::Windows::Security
     ) # template
 
     if handle == Puppet::Util::Windows::File::INVALID_HANDLE_VALUE
-      raise Puppet::Util::Windows::Error.new(_("Failed to open '%{path}'") % { path: path })
+      raise Puppet::Util::Windows::Error, _("Failed to open '%{path}'") % { path: path }
     end
 
     begin
@@ -569,7 +569,7 @@ module Puppet::Util::Windows::Security
             if AdjustTokenPrivileges(token, FFI::WIN32_FALSE,
                                      token_privileges, token_privileges.size,
                                      FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL) == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new(_("Failed to adjust process privileges"))
+              raise Puppet::Util::Windows::Error, _("Failed to adjust process privileges")
             end
           end
         end
@@ -599,7 +599,7 @@ module Puppet::Util::Windows::Security
                   FFI::Pointer::NULL, # sacl
                   sd_ptr_ptr
                 ) # sec desc
-                raise Puppet::Util::Windows::Error.new(_("Failed to get security information")) if rv != FFI::ERROR_SUCCESS
+                raise Puppet::Util::Windows::Error, _("Failed to get security information") if rv != FFI::ERROR_SUCCESS
 
                 # these 2 convenience params are not freed since they point inside sd_ptr
                 owner = Puppet::Util::Windows::SID.sid_ptr_to_string(owner_sid_ptr_ptr.get_pointer(0))
@@ -609,7 +609,7 @@ module Puppet::Util::Windows::Security
                   FFI::MemoryPointer.new(:dword, 1) do |revision|
                     sd_ptr_ptr.read_win32_local_pointer do |sd_ptr|
                       if GetSecurityDescriptorControl(sd_ptr, control, revision) == FFI::WIN32_FALSE
-                        raise Puppet::Util::Windows::Error.new(_("Failed to get security descriptor control"))
+                        raise Puppet::Util::Windows::Error, _("Failed to get security descriptor control")
                       end
 
                       protect = (control.read_word & SE_DACL_PROTECTED) == SE_DACL_PROTECTED
@@ -642,11 +642,11 @@ module Puppet::Util::Windows::Security
   def set_security_descriptor(path, sd)
     FFI::MemoryPointer.new(:byte, get_max_generic_acl_size(sd.dacl.count)) do |acl_ptr|
       if InitializeAcl(acl_ptr, acl_ptr.size, ACL_REVISION) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Failed to initialize ACL"))
+        raise Puppet::Util::Windows::Error, _("Failed to initialize ACL")
       end
 
       if IsValidAcl(acl_ptr) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid DACL"))
+        raise Puppet::Util::Windows::Error, _("Invalid DACL")
       end
 
       with_privilege(SE_BACKUP_NAME) do
@@ -681,7 +681,7 @@ module Puppet::Util::Windows::Security
                                      FFI::MemoryPointer::NULL)
 
                 if rv != FFI::ERROR_SUCCESS
-                  raise Puppet::Util::Windows::Error.new(_("Failed to set security information"))
+                  raise Puppet::Util::Windows::Error, _("Failed to set security information")
                 end
               end
             end

data/lib/puppet/util/windows/service.rb

@@ -111,7 +111,7 @@ module Puppet::Util::Windows
         end
       end
       if state.nil?
-        raise Puppet::Error.new(_("Unknown Service state '%{current_state}' for '%{service_name}'") % { current_state: state.to_s, service_name: service_name })
+        raise Puppet::Error, _("Unknown Service state '%{current_state}' for '%{service_name}'") % { current_state: state.to_s, service_name: service_name }
       end
 
       state
@@ -139,7 +139,7 @@ module Puppet::Util::Windows
         end
       end
       if start_type.nil?
-        raise Puppet::Error.new(_("Unknown start type '%{start_type}' for '%{service_name}'") % { start_type: start_type.to_s, service_name: service_name })
+        raise Puppet::Error, _("Unknown start type '%{start_type}' for '%{service_name}'") % { start_type: start_type.to_s, service_name: service_name }
       end
 
       start_type
@@ -190,7 +190,7 @@ module Puppet::Util::Windows
           FFI::Pointer::NULL        # lpDisplayName
         )
         if success == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to update service configuration"))
+          raise Puppet::Util::Windows::Error, _("Failed to update service configuration")
         end
       end
 
@@ -255,7 +255,7 @@ module Puppet::Util::Windows
                   FFI::Pointer::NULL
                 )
                 if success == FFI::WIN32_FALSE
-                  raise Puppet::Util::Windows::Error.new(_("Failed to fetch services"))
+                  raise Puppet::Util::Windows::Error, _("Failed to fetch services")
                 end
 
                 # Now that the buffer is populated with services
@@ -305,7 +305,7 @@ module Puppet::Util::Windows
         result = nil
         open_scm(scm_access) do |scm|
           service = OpenServiceW(scm, wide_string(service_name), service_access)
-          raise Puppet::Util::Windows::Error.new(_("Failed to open a handle to the service")) if service == FFI::Pointer::NULL_HANDLE
+          raise Puppet::Util::Windows::Error, _("Failed to open a handle to the service") if service == FFI::Pointer::NULL_HANDLE
 
           result = yield service
         end
@@ -323,7 +323,7 @@ module Puppet::Util::Windows
       # @param [Integer] scm_access code corresponding to the access type requested for the scm
       def open_scm(scm_access, &block)
         scm = OpenSCManagerW(FFI::Pointer::NULL, FFI::Pointer::NULL, scm_access)
-        raise Puppet::Util::Windows::Error.new(_("Failed to open a handle to the service control manager")) if scm == FFI::Pointer::NULL_HANDLE
+        raise Puppet::Util::Windows::Error, _("Failed to open a handle to the service control manager") if scm == FFI::Pointer::NULL_HANDLE
 
         yield scm
       ensure
@@ -439,7 +439,7 @@ module Puppet::Util::Windows
               bytes_pointer
             )
             if success == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new(_("Service query failed"))
+              raise Puppet::Util::Windows::Error, _("Service query failed")
             end
 
             yield status
@@ -476,7 +476,7 @@ module Puppet::Util::Windows
               bytes_pointer
             )
             if success == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new(_("Service query failed"))
+              raise Puppet::Util::Windows::Error, _("Service query failed")
             end
 
             yield config
@@ -520,7 +520,7 @@ module Puppet::Util::Windows
               bytes_pointer
             )
             if success == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new(_("Service query for %{parameter_name} failed") % { parameter_name: SERVICE_CONFIG_TYPES[info_level] })
+              raise Puppet::Util::Windows::Error, _("Service query for %{parameter_name} failed") % { parameter_name: SERVICE_CONFIG_TYPES[info_level] }
             end
 
             yield config
@@ -541,10 +541,10 @@ module Puppet::Util::Windows
           success = ChangeServiceConfig2W(
             service,
             change, # dwInfoLevel
-            value,  # lpInfo
+            value # lpInfo
           )
           if success == FFI::WIN32_FALSE
-            raise Puppet::Util.windows::Error.new(_("Failed to update service %{change} configuration") % { change: change })
+            raise Puppet::Util.windows::Error, _("Failed to update service %{change} configuration") % { change: change }
           end
         end
       end

data/lib/puppet/util/windows/sid.rb

@@ -86,7 +86,7 @@ module Puppet::Util::Windows
 
       raw_sid_bytes ? Principal.lookup_account_sid(raw_sid_bytes) : Principal.lookup_account_name(name)
     rescue => e
-      Puppet.debug("#{e.message}")
+      Puppet.debug(e.message.to_s)
       (allow_unresolved && raw_sid_bytes) ? unresolved_principal(name, raw_sid_bytes) : nil
     end
     module_function :name_to_principal
@@ -99,7 +99,7 @@ module Puppet::Util::Windows
     # This method returns a SID::Principal with the account, domain, SID, etc
     def octet_string_to_principal(bytes)
       if !bytes || !bytes.respond_to?('pack') || bytes.empty?
-        raise Puppet::Util::Windows::Error.new(_("Octet string must be an array of bytes"))
+        raise Puppet::Util::Windows::Error, _("Octet string must be an array of bytes")
       end
 
       Principal.lookup_account_sid(bytes)
@@ -116,7 +116,7 @@ module Puppet::Util::Windows
     def ads_to_principal(ads_object)
       if !ads_object || !ads_object.respond_to?(:ole_respond_to?) ||
          !ads_object.ole_respond_to?(:objectSID) || !ads_object.ole_respond_to?(:Name)
-        raise Puppet::Error.new("ads_object must be an IAdsUser or IAdsGroup instance")
+        raise Puppet::Error, "ads_object must be an IAdsUser or IAdsGroup instance"
       end
 
       octet_string_to_principal(ads_object.objectSID)
@@ -160,18 +160,18 @@ module Puppet::Util::Windows
     # Convert a SID pointer to a SID string, e.g. "S-1-5-32-544".
     def sid_ptr_to_string(psid)
       if !psid.is_a?(FFI::Pointer) || IsValidSid(psid) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
+        raise Puppet::Util::Windows::Error, _("Invalid SID")
       end
 
       sid_string = nil
       FFI::MemoryPointer.new(:pointer, 1) do |buffer_ptr|
         if ConvertSidToStringSidW(psid, buffer_ptr) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to convert binary SID"))
+          raise Puppet::Util::Windows::Error, _("Failed to convert binary SID")
         end
 
         buffer_ptr.read_win32_local_pointer do |wide_string_ptr|
           if wide_string_ptr.null?
-            raise Puppet::Error.new(_("ConvertSidToStringSidW failed to allocate buffer for sid"))
+            raise Puppet::Error, _("ConvertSidToStringSidW failed to allocate buffer for sid")
           end
 
           sid_string = wide_string_ptr.read_arbitrary_wide_string_up_to(MAXIMUM_SID_STRING_LENGTH)
@@ -190,7 +190,7 @@ module Puppet::Util::Windows
       FFI::MemoryPointer.from_string_to_wide_string(string_sid) do |lpcwstr|
         FFI::MemoryPointer.new(:pointer, 1) do |sid_ptr_ptr|
           if ConvertStringSidToSidW(lpcwstr, sid_ptr_ptr) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(_("Failed to convert string SID: %{string_sid}") % { string_sid: string_sid })
+            raise Puppet::Util::Windows::Error, _("Failed to convert string SID: %{string_sid}") % { string_sid: string_sid }
           end
 
           sid_ptr_ptr.read_win32_local_pointer do |sid_ptr|
@@ -221,7 +221,7 @@ module Puppet::Util::Windows
     def get_length_sid(sid_ptr)
       # MSDN states IsValidSid should be called on pointer first
       if !sid_ptr.is_a?(FFI::Pointer) || IsValidSid(sid_ptr) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
+        raise Puppet::Util::Windows::Error, _("Invalid SID")
       end
 
       GetLengthSid(sid_ptr)

data/lib/puppet/util/windows/user.rb

@@ -13,7 +13,7 @@ module Puppet::Util::Windows::User
 
     # if Vista or later, check for unrestricted process token
     elevated_supported = Puppet::Util::Windows::Process.supports_elevated_security?
-    return elevated_supported ? Puppet::Util::Windows::Process.elevated_security? : true
+    elevated_supported ? Puppet::Util::Windows::Process.elevated_security? : true
   end
   module_function :admin?
 
@@ -52,17 +52,17 @@ module Puppet::Util::Windows::User
         size_pointer.write_uint32(SECURITY_MAX_SID_SIZE)
 
         if CreateWellKnownSid(:WinBuiltinAdministratorsSid, FFI::Pointer::NULL, sid_pointer, size_pointer) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to create administrators SID"))
+          raise Puppet::Util::Windows::Error, _("Failed to create administrators SID")
         end
       end
 
       if IsValidSid(sid_pointer) == FFI::WIN32_FALSE
-        raise Puppet::Util::Windows::Error.new(_("Invalid SID"))
+        raise Puppet::Util::Windows::Error, _("Invalid SID")
       end
 
       FFI::MemoryPointer.new(:win32_bool, 1) do |ismember_pointer|
         if CheckTokenMembership(FFI::Pointer::NULL_HANDLE, sid_pointer, ismember_pointer) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to check membership"))
+          raise Puppet::Util::Windows::Error, _("Failed to check membership")
         end
 
         # Is administrators SID enabled in calling thread's access token?
@@ -75,18 +75,16 @@ module Puppet::Util::Windows::User
   module_function :check_token_membership
 
   def password_is?(name, password, domain = '.')
-    begin
-      logon_user(name, password, domain) { |token| }
-    rescue Puppet::Util::Windows::Error => detail
-      authenticated_error_codes = Set[
-        ERROR_ACCOUNT_RESTRICTION,
-        ERROR_INVALID_LOGON_HOURS,
-        ERROR_INVALID_WORKSTATION,
-        ERROR_ACCOUNT_DISABLED,
-      ]
-
-      return authenticated_error_codes.include?(detail.code)
-    end
+    logon_user(name, password, domain) { |token| }
+  rescue Puppet::Util::Windows::Error => detail
+    authenticated_error_codes = Set[
+      ERROR_ACCOUNT_RESTRICTION,
+      ERROR_INVALID_LOGON_HOURS,
+      ERROR_INVALID_WORKSTATION,
+      ERROR_ACCOUNT_DISABLED,
+    ]
+
+    authenticated_error_codes.include?(detail.code)
   end
   module_function :password_is?
 
@@ -101,7 +99,7 @@ module Puppet::Util::Windows::User
         # try logon using network else try logon using interactive mode
         if logon_user_by_logon_type(name, domain, password, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
           if logon_user_by_logon_type(name, domain, password, fLOGON32_LOGON_INTERACTIVE, fLOGON32_PROVIDER_DEFAULT, token_pointer) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(_("Failed to logon user %{name}") % { name: name.inspect })
+            raise Puppet::Util::Windows::Error, _("Failed to logon user %{name}") % { name: name.inspect }
           end
         end
 
@@ -132,13 +130,13 @@ module Puppet::Util::Windows::User
 
         # Load the profile. Since it doesn't exist, it will be created
         if LoadUserProfileW(token, pi.pointer) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to load user profile %{user}") % { user: user.inspect })
+          raise Puppet::Util::Windows::Error, _("Failed to load user profile %{user}") % { user: user.inspect }
         end
 
         Puppet.debug("Loaded profile for #{user}")
 
         if UnloadUserProfile(token, pi[:hProfile]) == FFI::WIN32_FALSE
-          raise Puppet::Util::Windows::Error.new(_("Failed to unload user profile %{user}") % { user: user.inspect })
+          raise Puppet::Util::Windows::Error, _("Failed to unload user profile %{user}") % { user: user.inspect }
         end
       end
     end
@@ -260,7 +258,7 @@ module Puppet::Util::Windows::User
                      "The RPC server is unavailable or given domain name is invalid."
                    end
 
-    raise Puppet::Error.new("Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'. #{error_reason}" % error_code)
+    raise Puppet::Error, "Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'. #{error_reason}" % error_code
   end
   private_class_method :check_lsa_nt_status_and_raise_failures
 

data/lib/puppet/util/yaml.rb

@@ -60,7 +60,7 @@ module Puppet::Util::Yaml
   end
 
   def self.dump(structure, filename)
-    Puppet::FileSystem.replace_file(filename, 0660) do |fh|
+    Puppet::FileSystem.replace_file(filename, 0o660) do |fh|
       YAML.dump(structure, fh)
     end
   end

data/lib/puppet/util.rb

@@ -190,7 +190,7 @@ module Util
         yield
       }
       object.send(level, msg % { seconds: "%0.2f" % seconds })
-      return seconds
+      seconds
     else
       yield
     end
@@ -211,33 +211,31 @@ module Util
       exts = ENV.fetch('PATHEXT', nil)
       exts = exts ? exts.split(File::PATH_SEPARATOR) : %w[.COM .EXE .BAT .CMD]
       ENV.fetch('PATH').split(File::PATH_SEPARATOR).each do |dir|
-        begin
-          dest = File.expand_path(File.join(dir, bin))
-        rescue ArgumentError => e
-          # if the user's PATH contains a literal tilde (~) character and HOME is not set, we may get
-          # an ArgumentError here.  Let's check to see if that is the case; if not, re-raise whatever error
-          # was thrown.
-          if e.to_s =~ /HOME/ and (ENV['HOME'].nil? || ENV.fetch('HOME', nil) == "")
-            # if we get here they have a tilde in their PATH.  We'll issue a single warning about this and then
-            # ignore this path element and carry on with our lives.
-            # TRANSLATORS PATH and HOME are environment variables and should not be translated
-            Puppet::Util::Warnings.warnonce(_("PATH contains a ~ character, and HOME is not set; ignoring PATH element '%{dir}'.") % { dir: dir })
-          elsif e.to_s =~ /doesn't exist|can't find user/
-            # ...otherwise, we just skip the non-existent entry, and do nothing.
-            # TRANSLATORS PATH is an environment variable and should not be translated
-            Puppet::Util::Warnings.warnonce(_("Couldn't expand PATH containing a ~ character; ignoring PATH element '%{dir}'.") % { dir: dir })
-          else
-            raise
-          end
+        dest = File.expand_path(File.join(dir, bin))
+      rescue ArgumentError => e
+        # if the user's PATH contains a literal tilde (~) character and HOME is not set, we may get
+        # an ArgumentError here.  Let's check to see if that is the case; if not, re-raise whatever error
+        # was thrown.
+        if e.to_s =~ /HOME/ and (ENV['HOME'].nil? || ENV.fetch('HOME', nil) == "")
+          # if we get here they have a tilde in their PATH.  We'll issue a single warning about this and then
+          # ignore this path element and carry on with our lives.
+          # TRANSLATORS PATH and HOME are environment variables and should not be translated
+          Puppet::Util::Warnings.warnonce(_("PATH contains a ~ character, and HOME is not set; ignoring PATH element '%{dir}'.") % { dir: dir })
+        elsif e.to_s =~ /doesn't exist|can't find user/
+          # ...otherwise, we just skip the non-existent entry, and do nothing.
+          # TRANSLATORS PATH is an environment variable and should not be translated
+          Puppet::Util::Warnings.warnonce(_("Couldn't expand PATH containing a ~ character; ignoring PATH element '%{dir}'.") % { dir: dir })
         else
-          if Puppet::Util::Platform.windows? && File.extname(dest).empty?
-            exts.each do |ext|
-              destext = File.expand_path(dest + ext)
-              return destext if FileTest.file? destext and FileTest.executable? destext
-            end
+          raise
+        end
+      else
+        if Puppet::Util::Platform.windows? && File.extname(dest).empty?
+          exts.each do |ext|
+            destext = File.expand_path(dest + ext)
+            return destext if FileTest.file? destext and FileTest.executable? destext
           end
-          return dest if FileTest.file? dest and FileTest.executable? dest
         end
+        return dest if FileTest.file? dest and FileTest.executable? dest
       end
     end
     nil
@@ -250,8 +248,8 @@ module Util
   # Escape once for the string literal, and once for the regex.
   slash = '[\\\\/]'
   label = '[^\\\\/]+'
-  AbsolutePathWindows = %r!^(?:(?:[A-Z]:#{slash})|(?:#{slash}#{slash}#{label}#{slash}#{label})|(?:#{slash}#{slash}\?#{slash}#{label}))!io
-  AbsolutePathPosix   = %r!^/!
+  AbsolutePathWindows = /^(?:(?:[A-Z]:#{slash})|(?:#{slash}#{slash}#{label}#{slash}#{label})|(?:#{slash}#{slash}\?#{slash}#{label}))/io
+  AbsolutePathPosix   = %r{^/}
   def absolute_path?(path, platform = nil)
     unless path.is_a?(String)
       Puppet.warning("Cannot check if #{path} is an absolute path because it is a '#{path.class}' and not a String'")
@@ -288,11 +286,11 @@ module Util
     if Puppet::Util::Platform.windows?
       path = path.tr('\\', '/')
 
-      unc = /^\/\/([^\/]+)(\/.+)/.match(path)
+      unc = %r{^//([^/]+)(/.+)}.match(path)
       if unc
         params[:host] = unc[1]
         path = unc[2]
-      elsif path =~ /^[a-z]:\//i
+      elsif path =~ %r{^[a-z]:/}i
         path = '/' + path
       end
     end
@@ -324,7 +322,7 @@ module Util
       if uri.host && !uri.host.empty?
         path = "//#{uri.host}" + path # UNC
       else
-        path.sub!(/^\//, '')
+        path.sub!(%r{^/}, '')
       end
     end
 
@@ -332,7 +330,7 @@ module Util
   end
   module_function :uri_to_path
 
-  RFC_3986_URI_REGEX = /^(?<scheme>(?:[^:\/?#]+):)?(?<authority>\/\/(?:[^\/?#]*))?(?<path>[^?#]*)(?:\?(?<query>[^#]*))?(?:#(?<fragment>.*))?$/
+  RFC_3986_URI_REGEX = %r{^(?<scheme>(?:[^:/?#]+):)?(?<authority>//(?:[^/?#]*))?(?<path>[^?#]*)(?:\?(?<query>[^#]*))?(?:#(?<fragment>.*))?$}
 
   # Percent-encodes a URI query parameter per RFC3986 - https://tools.ietf.org/html/rfc3986
   #
@@ -407,7 +405,7 @@ module Util
   #   query will encode + as %2B and space as %20
   #   fragment behaves like query
   def uri_encode(path, opts = { :allow_fragment => false })
-    raise ArgumentError.new(_('path may not be nil')) if path.nil?
+    raise ArgumentError, _('path may not be nil') if path.nil?
 
     encoded = ''.dup
 
@@ -425,7 +423,7 @@ module Util
     encoded += rfc2396_escape(parts[:path]) unless parts[:path].nil?
 
     # each query parameter
-    if !parts[:query].nil?
+    unless parts[:query].nil?
       query_string = parts[:query].split('&').map do |pair|
         # can optionally be separated by an =
         pair.split('=').map do |v|
@@ -465,12 +463,12 @@ module Util
   def uri_unescape(str)
     enc = str.encoding
     enc = Encoding::UTF_8 if enc == Encoding::US_ASCII
-    str.gsub(ESCAPED) { [$&[1, 2]].pack('H2').force_encoding(enc) }
+    str.gsub(ESCAPED) { [::Regexp.last_match(0)[1, 2]].pack('H2').force_encoding(enc) }
   end
   module_function :uri_unescape
 
   def safe_posix_fork(stdin = $stdin, stdout = $stdout, stderr = $stderr, &block)
-    child_pid = Kernel.fork do
+    Kernel.fork do
       STDIN.reopen(stdin)
       STDOUT.reopen(stdout)
       STDERR.reopen(stderr)
@@ -482,16 +480,25 @@ module Util
       begin
         Dir.foreach('/proc/self/fd') do |f|
           if f != '.' && f != '..' && f.to_i >= 3
-            IO.new(f.to_i).close rescue nil
+            begin
+              IO.new(f.to_i).close
+            rescue
+              nil
+            end
           end
         end
       rescue Errno::ENOENT, Errno::ENOTDIR # /proc/self/fd not found, /proc/self not a dir
-        3.upto(256) { |fd| IO.new(fd).close rescue nil }
+        3.upto(256) { |fd|
+          begin
+            IO.new(fd).close
+          rescue
+            nil
+          end
+        }
       end
 
       block.call if block
     end
-    child_pid
   end
   module_function :safe_posix_fork
 
@@ -507,11 +514,9 @@ module Util
 
   # Just benchmark, with no logging.
   def thinmark
-    seconds = Benchmark.realtime {
+    Benchmark.realtime {
       yield
     }
-
-    seconds
   end
 
   module_function :thinmark
@@ -545,7 +550,11 @@ module Util
   def self.resolve_stackframe(frame)
     _, path, rest = /^(.*):(\d+.*)$/.match(frame).to_a
     if path
-      path = Pathname(path).realpath rescue path
+      path = begin
+        Pathname(path).realpath
+      rescue
+        path
+      end
       "#{path}:#{rest}"
     else
       frame
@@ -579,7 +588,7 @@ module Util
   # The staging_location is a location to render the temporary file before
   # moving the file to it's final location.
 
-  DEFAULT_POSIX_MODE = 0644
+  DEFAULT_POSIX_MODE = 0o644
   DEFAULT_WINDOWS_MODE = nil
 
   def replace_file(file, default_mode, staging_location: nil, validate_callback: nil, &block)
@@ -608,7 +617,7 @@ module Util
       end
 
       effective_mode =
-        if !Puppet::Util::Platform.windows?
+        unless Puppet::Util::Platform.windows?
           # Grab the current file mode, and fall back to the defaults.
 
           if Puppet::FileSystem.exist?(file)
@@ -626,7 +635,7 @@ module Util
       if effective_mode
         # We only care about the bottom four slots, which make the real mode,
         # and not the rest of the platform stat call fluff and stuff.
-        tempfile.chmod(effective_mode & 07777)
+        tempfile.chmod(effective_mode & 0o7777)
       end
 
       # Now, make sure the data (which includes the mode) is safe on disk.
@@ -651,7 +660,7 @@ module Util
 
       if Puppet::Util::Platform.windows?
         # Windows ReplaceFile needs a file to exist, so touch handles this
-        if !Puppet::FileSystem.exist?(file)
+        unless Puppet::FileSystem.exist?(file)
           Puppet::FileSystem.touch(file)
           if mode
             Puppet::Util::Windows::Security.set_mode(mode, Puppet::FileSystem.path_string(file))