(#10354) added delete command to fix missing userdel flag in useradd provider
Fixes for #10915 and #11200 - user provider for AIX

The user provider on AIX fails to set the password for local users
using chpasswd.

This commit includes the code in ticket #11200 suggested by Josh
Cooper. It works in my environment (AIX 5.3 + 6.1).

chpasswd can also return 1 even on success; it's not clear if this is
by design, as the manpage doesn't mention it. The lack of output from
chpasswd indicates success; if there's a problem it dumps output to
stderr/stdout.
(#13880) Add openrc service provider for Gentoo and Funtoo

Gentoo uses openrc (at least since baselayout-2) to
start/stop/enable/disable services. This can be done with the following
commands

    /bin/rc-status   - show runlevels
    /sbin/rc-service - start/stop a service
    /sbin/rc-update  - enable/disable a service

The openrc provider was written as a replacement for the current gentoo
provider. The gentoo provider does just use the openrc commands to
enable/disable a service but it still calls the initscripts directly to
start a stop service. The gentoo provider does also have problems with
long service names (#5197).

The reason why this is a seperate provider: #5197 states that the
rc-service command was probably introduced when gentoo upgraded from
baselayout-1 to baselayout-2 (I wasn't really able to verify this)
so the openrc provider will not work on all gentoo systems.

It is also notable that the new openrc provider does not put any confines
on operatingsystem so the service provider may also be used on other
systems that use openrc (like the Gentoo fork "Funtoo")
(#13880) Add openrc spec - service with extreme long name

The old gentoo provider has some problems handling services with really
long names (#5197).

Add a tests to check the correct behaviour of the openrc provider. The
fake rc-status output was captured after creating a fake initscript in
/etc/init.d with a really long name
(#14599) Handle ENOTDIR in file type

If a file resource is used with a path where a component of path is not
a directory, the stat systemcall can raise the error Errno::ENOTDIR
which was not handled by the file type.

This can lead to the following error (if e.g /tmp/xx is a normal file)

    err: /Stage[main]//File[/tmp/xx/yy/zz/1]: Could not evaluate: Not a
    directory - /tmp/xx/yy/zz/1

Catch the error and return nil in the stat method like we do for absent
files or file where we do not have the permission to stat.

Puppet will still raise errors when trying to create such a file of
course like

    err: /Stage[main]//File[/etc/fstab/foo]/ensure: change from absent to
    file failed: Could not set 'file on ensure: Not a directory -
    /etc/fstab/foo at line

But something like

    puppet apply -ve 'file { "/etc/fstab/foo": ensure => absent}'

will now work without errors because `/etc/fstab/foo` is indeed absent.
(#14860) Fix puppet cert exit status on failures

Without this patch applied the following command errors out but does not
correctly set the exit status:

    puppet cert generate foo.bar.com --dns_alt_names foo,foo.bar.com

The error returned is:

    err: Could not call generate: CSR 'pe-internal-broker-test'
      contains subject alternative names (DNS:pe-centos6, \
      DNS:pe-centos6.puppetlabs.vm, DNS:pe-internal-broker-test, \
      DNS:stomp), which are disallowed. Use `puppet cert \
      --allow-dns-alt-names sign pe-internal-broker-test` to sign this \
      request.

However, the exit status is 0.

This is a problem because we need to easily detect if certificate
generation from the command line failed or succeeded.  The most natural
and expected way to check this is by looking at the exit status.

The root cause of the problem is that
Puppet::SSL::CertificateAuthority::InterFace#apply incorrectly catches
and masks the exception raised by the generate method because it simply
logs an error with Puppet.err and continues along happily.

This patch fixes the problem by re-raising the error produced by
generate, allowing the application controller to catch the error
appropriately and exit with the non-zero exit status.
(#14531) Change default ensure value from symlink to link

If ensure on a file resource is omitted, puppet will set the should value
to :symlink in the initialize method of the file type but the ensure property
does not use :symlink but :link to identify a link.

As a result, puppet will always treat a resource with a specific target
property but no ensure property as out of sync:

    file { '/tmp/a':
      target => '/tmp/b',
    }

When puppet now calls sync on the ensure property, the fileresource
(`/tmp/a`) is removed first (method `remove_existing`) but we do not
execute the block passed to `newvalue(:link)` to recreate it. Because
there is no `newvalue(:symlink)` block, we instead run the block in
`newvalue(/./)` which is just a dummy and does nothing at all. As a
result puppet will *always* say it created something while in fact
making sure that the resource is *removed*.

Change the default ensure value from :symlink to :link if target is
set.
(#14600) Fix cleanup of tempfiles in file_spec

The file integration test uses temporary files that will be removed
after each test. A few tests however use the backup functionality of the
file resource type and these backups were not removed.

Create a temporary directory where the dummyfile is placed. This way the
spec helper will remove the whole directory after each test including
every backup of the dummyfile that might have been created during the
testrun.
(#15398) fix typo in Scope#number? float detection regex

This allowed incorrect numbers (like 2:.34) to be recognized as
floats (with an incorrect value).

Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
Don't allow resource titles which aren't strings

It was possible to create resources whose titles weren't strings, by
using a variable containing a hash, or the result of a function which
doesn't return a string. This can cause problems resolving relationships
when the stringified version of the title differs between master and
agent.

Now we will only accept primitives, and will stringify them. That is:
string, symbol, number, boolean. Arrays or nested arrays will still be
flattened and used to create multiple resources. Any other value (for
instance: a hash) will cause a parse error.
Avoid circular requirement in FileMetadata indirection
Try again to avoid circular dependency in file indirections

Requiring the model at the end of the file seems the best approach for now.
Implement Symbol#intern when it is missing.

In order to reduce use of `Puppet::Util#symbolize` in the code - which is
called some 90,000 times in a real-world run - being able to intern a symbol
is convenient.

This is a simple implementation: it just returns itself.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Merge remote-tracking branch 'upstream/2.7.x' into 2.7rc
Use `intern` rather than `symbolize` in Puppet::Type

The cost of symbolize is ~ 50 percent higher than the cost of intern, when
applied to either a string or a symbol.  Given this is called some 90,000
times in my real world test run, that adds up to a non-zero amount of
wasted time.

Sadly, this only works out at 0.15 seconds real time reduction, but it is
better than nothing - and takes out 85,000 extra calls.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Eliminate `symbolize` everywhere, and remove it.

The whole `symbolize` API was confusing and complex: because it didn't do any
type enforcement, just passed through arbitrary data, we had very unclear API
in a whole pile of places.

This replaces that method entirely with a more rigid definition: we intern in
a bunch of places, add the occasional clear failure mode, and then delete the
original definition.

This eliminates one point of complexity from the codebase.

(These other uses have no notable performance penalty, just code complexity
 and clarity issues.)

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
zaml: statically determine the to_ascii8bit implementation.

Instead of asking every single string the same question, "do you respond to
`encoding`", we can just figure that out once and choose an implementation
based on the result - since it is a static test on the same class every time.

This saves ~ 0.1 second of runtime, which is small but cheap.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
zaml: rework strings for correctness and speed

This changes the implementation of string output in the ZAML encoder.  On my
test that delivers around a fifty percent reduction in output time, from 4.11
to 1.89 seconds on my test of ~ 35,000 output strings.

It also adds a bunch of tests to validate the correctness of binary output
handling, and some test inputs derived from various security related UTF-8
encoding problems to validate that (sadly) we pass them through as
binary data.

Optimally we would treat binary and text input as distinct in the parser and
compiler of Puppet, then only allow legal UTF-8 in strings - but that is not
the world in which we live.

It finally fixes a bug in the binary output along the way - which, thankfully,
nobody actually seems to have run into since I introduced it in ea0dd1483fc2.

Because the Ruby BASE64 encoder will split lines at the 60 character mark, a
long binary input would end up with embedded newlines in places that were not
legal for YAML.

Instead of just emitting that, we run through the string encoder over the
transformed data, which leads to a solid output format that works entirely
as expected.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
zaml: add whitespace for readability.

The ZAML code has very little whitespace, leading to a difficult to read set
of code.  This just adds a little whitespace, with no behaviour change, to
improve that before I start hacking directly on that code.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
zaml: avoid calling emit when we don't have anything to output

The `nl` method allowed an additional string to be output after the newline;
this is seldom used, and the default implementation resulted in emitting an
empty string.

We can just skip that, for a minor win in function call count.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>