(PUP-11846) Handle unprocessed, deferred sensitive

[m0dular]

Prior to this commit, evaluating a deferred resource that includes a Sensitive value would fail during munging. This commit marks these resources as sensitive and unwraps them during catalog application.

[natemccurdy]

Looks like this does solve the problem from PUP-11846.

~/src/puppetlabs/puppet [PUP-11846 ?2]$ cat reproduce-PUP-11846.pp                                                                                                                     $secret = Deferred('new', [Sensitive, "hello world\n"])
file { '/tmp/test.txt':
  ensure  => 'file',
  content => $secret,
}

 ~/src/puppetlabs/puppet  PUP-11846 ?2  be puppet apply reproduce-PUP-11846.pp
Notice: Compiled catalog for adot.local in environment production in 0.02 seconds
Notice: Applied catalog in 0.01 seconds

 ~/src/puppetlabs/puppet  PUP-11846 ?2  git co main
Switched to branch 'main'
Your branch is up to date with 'origin/main'.
 ~/src/puppetlabs/puppet  main ?2  bundle install >/dev/null && bundle update >/dev/null
 ~/src/puppetlabs/puppet  main ?2  be puppet apply reproduce-PUP-11846.pp
Notice: Compiled catalog for adot.local in environment production in 0.01 seconds
Error: Failed to apply catalog: Munging failed for value #<Sensitive [value redacted]> in class content: no implicit conversion of Puppet::Pops::Types::PSensitiveType::Sensitive into String

[natemccurdy]

@m0dular Thanks for the patch. Do you think you'd be able to add spec tests for this?

[joshcooper]

Ah I'm working on specs, so don't worry about that part.

[joshcooper]

One tricky issue is deferred values can nest like:

puppet/spec/unit/pops/evaluator/deferred_resolver_spec.rb

Lines 35 to 38 in c4c07ee

	$args = Deferred("inline_epp", ["<%= 'a,b,c' %>"])
	notify { "deferred":
	message => Deferred("split", [$args, ","])
	}

puppet/spec/unit/functions/call_spec.rb

Lines 115 to 118 in c4c07ee

	function my_split(Hash $hashy, Array[Sensitive] $sensy) { split($hashy['key'][0], $sensy[0].unwrap |$x| {$x}) }
	$d = Deferred('my_split', [ {'key' => [Deferred('test::abc')]}, [Sensitive(Deferred('test::dash'))]])
	$a = $d.call()
	notify { $a[0]: }

I think this will approach will still work (?) as the resolve_futures method is called recursively with each DeferredValue and if any of them have PSensitiveType arguments, then the overall parameter will be marked as sensitive (but only marked once). But I'd like to write a test to confirm that happens.

[joshcooper]

I rebased the PR onto 7.x and added tests. This will also get merged to puppet#main automatically.

[joshcooper]

Have to close and reopen to rekick GH actions with the correct matrix