Merge pull request #507 from mmrobins/ticket/2.7.x/fix_module_spec_for_windows

Ticket/2.7.x/fix module spec for windows
Merge pull request #498 from daniel-pittman/bug/2.7.x/6663-increase-default-key-length

Bug/2.7.x/6663 increase default key length
Prior to this commit we hard coded paths in two tests that depended on
our CI system directory structure. This made it hard to use our
acceptance suite without also including the exact same setup. It also
increased the cost of maintaining our CI setup.

This uses a path relative to the test itself (the file that it SCPs
should always be in the same directory as the test itself)

Signed-off-by: Justin Stoller <justin@puppetlabs.com>
(#11408) Allow POSIX paths for files served to Windows agents

Previously, Windows agents would fail during fact and plugin sync. The
agent would retrieve the remote file metadata and attempt to set the
metadata's path based on the path of the file as it exists on the
remote system. Since the remote system is typically a POSIX puppet
master, our `Puppet::Util.absolute_path?` path check would fail on
Windows.

To complicate matters, the path of the "remote" file can in fact be a
Windows-style path, such as when using puppet apply and a modulepath
that refers to the local filesystem.

This commit changes the `Puppet::FileServing::Base#path=` method to
allow both POSIX and Windows style paths on Windows hosts, but only
allows POSIX style paths on POSIX hosts, since we don't support
running puppet master on Windows.
(#11408) Skip default file permissions for sync'ed files on Windows

Previously the pluginsync acceptance test fails on Windows because we
were trying to guess the appropriate default user and group to create
sync'ed files as, and guessing wrong.

When using cygwin and ssh with publickey authentication, the cygwin
sshd server, running as `cyg_server` creates a token to impersonate
the ssh client, `Administrator` in my case, and starts a shell process
using the token. The new process runs as the authenticated user,
`Administrator`, but calls to `GetUserName` (which the sys-admin gem
calls), returns `cyg_server`. See "method 1: create a token from
scratch"[1].

As a result, puppet was setting the $vardir/lib directory owner to
`cyg_server`, group nobody, and mode 0755, which meant puppet running
as `Administrator` couldn't download (write) files into the directory.

The real issue, though is that we shouldn't be trying to guess what
the default owner/group for newly created files/directories that are
plugin sync'ed. This is because the default DACL varies across OS
(2003, 2008, ...) and user (Administrator vs SYSTEM).

This commit just omits the owner and group parameters from downloaded
file resources on Windows, so that they get created with the default
owner and group. The POSIX behavior is unchanged, using the
Process.uid/gid.

[1] http://cygwin.com/cygwin-ug-net/ntsec.html
(#11408): Don't add execute bit to newly created files on Windows

Previously, if a directory was executable for owner or group, then any
file created at a later time in the directory would have its execute
bit set. For example, if a directory's mode is set to 0750, then any
file created in the directory at a later time would have the same
mode.

This causes the file mode to change unnecessarily across puppet
runs. For example, when puppet starts for the first time, it creates a
$vardir/certs directory that is executable. During the same run, it
writes out its signed cert, which is now executable. The second time
puppet runs, it sees that the mode is out-of-sync, it should be 0644,
and changes the mode.

If the same scenario occurs to a service's configuration file, then
puppet could bounce the service unnecessarily.

This commit creates two sets of inherit-only access control entries on
the parent directory. One set applies the same permissions from the
parent directory to its subdirectories (containers) at creation time. The other set
masks off the execute bit for its files (objects) at creation time.

Note puppet always has FULL_CONTROL (which includes FILE_EXECUTE) for
files it creates, so this commit does not prevent puppet from being
able to execute content that it downloads. It only prevents group and
other from having execute permission by default.

In order to grant execute permission to group and other on a file that
puppet manages, you must explicitly specify the appropriate mode in
the file's resource.
Merge branch 'ticket/2.7.x/11408-remote-recursion' into 2.7.x

* ticket/2.7.x/11408-remote-recursion:
  (#11408): Don't add execute bit to newly created files on Windows
  (#11408) Skip default file permissions for sync'ed files on Windows
  (#11408) Allow POSIX paths for files served to Windows agents
Typo: "Seperated" -> "separated"

A surprisingly widespread typo! This commit changes all instances of
"seperated" in description strings to "separated."
Merge pull request #458 from daniel-pittman/bug/2.7.x/12405-remove-old-storeconfig-cleaner

Bug/2.7.x/12405 remove old storeconfig cleaner
Merge pull request #514 from nfagerlund/typo/2.7.x/seperated

* 'typo/2.7.x/seperated' of git://github.com/nfagerlund/puppet:
  Typo: "Seperated" -> "separated"
(#12464) Avoid unnecessarily reloading facts when node_name_fact is not set

In fixing #8341 we reduced the caching of facts, leading to a performance
regression in puppet apply. Puppet apply loaded facts twice, first to look up
the fact for node_name_fact, and then a second time under the new node name
given by node_name_fact. This optimizes the common case where node_name_fact
is not set so that facts are only looked up once.

Reported in #12310.
(#12310) Remove process_name instrumentation listener

This was causing a performance regression in 2.7.10. Removing it for now, to
be added back later when the issue is fixed.
(#12296) Test cycle detection on real Puppet::Type instances.

We have found a couple of places where the behaviour of the items tested, and
the behaviour of the real system, differ - because the tests were run over
simpler objects than the real Puppet::Type instances we work on in the field.

This moves from testing on fake things to testing on the real deal, which
gives us a much more solid basis to trust the tests.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#12296) Make `Puppet::Type` ordered.

Type instances have a reasonable natural order, which allows us to make them
Comparable.  This, in turn, makes any interaction where ordering is of
interest easier to deal with.

This implementation uses the string form of the resource as the basis for
comparison, which is a reasonable starting point from existing definitions of
ordering over resource instances.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#12296) Now that `Puppet::Type` is ordered, use that.

This eliminates the proxy sorting in the graph library, which was working
around the fact that Puppet::Type was not able to be ordered out of the box.

That makes the whole process significantly more robust.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Make `Puppet::Provider` ordered.

Like types, our providers have a natural internal order.  Exposing that allows
us to eliminate proxy sorting everywhere that it is done, and have more
uniform treatment of our types.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Use natural ordering of Puppet::Provider.

The module tool used to generate and sort by a proxy key for providers, when
detailing their content.  Instead, this can use the natural ordering of
providers previously introduced.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#12296) Acceptance test for cycle detection in graphs.

This adds a simple acceptance test that validates we detect and report cycles
in a catalog as we compile and try to execute it.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#2927) Acceptance test for symbolic file modes.

This adds an acceptance test that validates that symbolic file modes are
functional on all our platforms, as expected.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Property Spec cleanup: extract new subclass to let method.

We need a shiny, new subclass of Puppet::Property every test, because we
modify class level things - and so we would pollute the tests if we touched
the same class object.

This extracts the logic around that to a let method, making the lifecycle
easier to follow by eliminating a member variable.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>