Merge branch 'puppetlabs:main' into main

Author: asusk7m550

.github/workflows/ci.yml

@@ -16,6 +16,4 @@ jobs:
   Acceptance:
     needs: Spec
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_acceptance.yml@main"
-    with:
-      runs_on: "ubuntu-24.04"
     secrets: "inherit"

.github/workflows/nightly.yml

@@ -15,6 +15,4 @@ jobs:
   Acceptance:
     needs: Spec
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_acceptance.yml@main"
-    with:
-      runs_on: "ubuntu-24.04"
     secrets: "inherit"

.puppet-lint.rc

@@ -1,3 +1,11 @@
+--fail-on-warnings
 --relative
+--no-80chars-check
+--no-140chars-check
+--no-class_inherits_from_params_class-check
+--no-autoloader_layout-check
+--no-documentation-check
+--no-single_quote_string_with_variables-check
+--ignore-paths=.vendor/**/*.pp,.bundle/**/*.pp,pkg/**/*.pp,spec/**/*.pp,tests/**/*.pp,types/**/*.pp,vendor/**/*.pp
 --no-anchor_resource-check
 --no-params_empty_string_assignment-check

.rubocop.yml

@@ -5,7 +5,7 @@ require:
 AllCops:
   NewCops: enable
   DisplayCopNames: true
-  TargetRubyVersion: '2.6'
+  TargetRubyVersion: 3.1
   Include:
   - "**/*.rb"
   Exclude:

CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org).
 
+## [v10.6.1](https://github.com/puppetlabs/puppetlabs-postgresql/tree/v10.6.1) - 2025-12-26
+
+[Full Changelog](https://github.com/puppetlabs/puppetlabs-postgresql/compare/v10.6.0...v10.6.1)
+
+### Fixed
+
+- Replace systemctl `status` with systemctl `is-active` [#1652](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1652) ([bastelfreak](https://github.com/bastelfreak))
+- Don't use type alias in `postgresql_password` parameter [#1611](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1611) ([figless](https://github.com/figless))
+
+## [v10.6.0](https://github.com/puppetlabs/puppetlabs-postgresql/tree/v10.6.0) - 2025-10-13
+
+[Full Changelog](https://github.com/puppetlabs/puppetlabs-postgresql/compare/v10.5.0...v10.6.0)
+
+### Added
+
+- Allow puppetlabs/apt 11.x & puppet/systemd 9.x [#1645](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1645) ([kenyon](https://github.com/kenyon))
+- Add support for Debian 13 (trixie) [#1638](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1638) ([trefzer](https://github.com/trefzer))
+- Role: Add support for valid_until [#1624](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1624) ([mooreandrew](https://github.com/mooreandrew))
+
+### Fixed
+
+- Debian 11: Use correct package name for python bindings  [#1647](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1647) ([bastelfreak](https://github.com/bastelfreak))
+- Unbreak Debian support with custom encoding [#1564](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1564) ([smortex](https://github.com/smortex))
+
+### Other
+
+- (CAT-2296) Update github runner image to ubuntu-24.04 [#1636](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1636) ([shubhamshinde360](https://github.com/shubhamshinde360))
+
 ## [v10.5.0](https://github.com/puppetlabs/puppetlabs-postgresql/tree/v10.5.0) - 2025-01-07
 
 [Full Changelog](https://github.com/puppetlabs/puppetlabs-postgresql/compare/v10.4.0...v10.5.0)
@@ -352,7 +380,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) a
 
 ### Fixed
 
-- Do not add version component to repo definition [#1282](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1282) ([weastur](https://github.com/weastur))
+- Do not add version component to repo definition [#1282](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1282) ([psapezhka](https://github.com/psapezhka))
 - (MODULES-8700) Autorequire the service in postgresql_psql [#1276](https://github.com/puppetlabs/puppetlabs-postgresql/pull/1276) ([ekohl](https://github.com/ekohl))
 
 ## [v7.2.0](https://github.com/puppetlabs/puppetlabs-postgresql/tree/v7.2.0) - 2021-05-24

Gemfile

@@ -14,22 +14,22 @@ def location_for(place_or_version, fake_version = nil)
 end
 
 group :development do
-  gem "json", '= 2.1.0',                         require: false if Gem::Requirement.create(['>= 2.5.0', '< 2.7.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
-  gem "json", '= 2.3.0',                         require: false if Gem::Requirement.create(['>= 2.7.0', '< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
-  gem "json", '= 2.5.1',                         require: false if Gem::Requirement.create(['>= 3.0.0', '< 3.0.5']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "json", '= 2.6.1',                         require: false if Gem::Requirement.create(['>= 3.1.0', '< 3.1.3']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "json", '= 2.6.3',                         require: false if Gem::Requirement.create(['>= 3.2.0', '< 4.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "racc", '~> 1.4.0',                        require: false if Gem::Requirement.create(['>= 2.7.0', '< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "deep_merge", '~> 1.2.2',                  require: false
   gem "voxpupuli-puppet-lint-plugins", '~> 5.0', require: false
-  gem "facterdb", '~> 1.18',                      require: false
+  gem "facterdb", '~> 2.1',                      require: false if Gem::Requirement.create(['< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
+  gem "facterdb", '~> 3.0',                      require: false if Gem::Requirement.create(['>= 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "metadata-json-lint", '~> 4.0',            require: false
-  gem "rspec-puppet-facts", '~> 2.0',            require: false
+  gem "json-schema", '< 5.1.1',                  require: false
+  gem "rspec-puppet-facts", '~> 4.0',            require: false if Gem::Requirement.create(['< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
+  gem "rspec-puppet-facts", '~> 5.0',            require: false if Gem::Requirement.create(['>= 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "dependency_checker", '~> 1.0.0',          require: false
   gem "parallel_tests", '= 3.12.1',              require: false
   gem "pry", '~> 0.10',                          require: false
   gem "simplecov-console", '~> 0.9',             require: false
-  gem "puppet-debugger", '~> 1.0',               require: false
+  gem "puppet-debugger", '~> 1.6',               require: false
   gem "rubocop", '~> 1.50.0',                    require: false
   gem "rubocop-performance", '= 1.16.0',         require: false
   gem "rubocop-rspec", '= 2.19.0',               require: false
@@ -38,26 +38,32 @@ group :development do
 end
 group :development, :release_prep do
   gem "puppet-strings", '~> 4.0',         require: false
-  gem "puppetlabs_spec_helper", '~> 7.0', require: false
+  gem "puppetlabs_spec_helper", '~> 8.0', require: false
+  gem "puppet-blacksmith", '~> 7.0',      require: false
 end
 group :system_tests do
-  gem "puppet_litmus", '~> 1.0',   require: false, platforms: [:ruby, :x64_mingw]
+  gem "puppet_litmus", '~> 2.0',   require: false, platforms: [:ruby, :x64_mingw] if !ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
+  gem "puppet_litmus", '~> 1.0',   require: false, platforms: [:ruby, :x64_mingw] if ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
   gem "CFPropertyList", '< 3.0.7', require: false, platforms: [:mswin, :mingw, :x64_mingw]
   gem "serverspec", '~> 2.41',     require: false
 end
 
-puppet_version = ENV['PUPPET_GEM_VERSION']
-facter_version = ENV['FACTER_GEM_VERSION']
-hiera_version = ENV['HIERA_GEM_VERSION']
 
 gems = {}
+puppet_version = ENV.fetch('PUPPET_GEM_VERSION', nil)
+facter_version = ENV.fetch('FACTER_GEM_VERSION', nil)
+hiera_version = ENV.fetch('HIERA_GEM_VERSION', nil)
 
-gems['puppet'] = location_for(puppet_version)
-
-# If facter or hiera versions have been specified via the environment
-# variables
+# If PUPPET_FORGE_TOKEN is set then use authenticated source for both puppet and facter, since facter is a transitive dependency of puppet
+# Otherwise, do as before and use location_for to fetch gems from the default source
+if !ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
+  gems['puppet'] = ['~> 8.11', { require: false, source: 'https://rubygems-puppetcore.puppet.com' }]
+  gems['facter'] = ['~> 4.11', { require: false, source: 'https://rubygems-puppetcore.puppet.com' }]
+else
+  gems['puppet'] = location_for(puppet_version)
+  gems['facter'] = location_for(facter_version) if facter_version
+end
 
-gems['facter'] = location_for(facter_version) if facter_version
 gems['hiera'] = location_for(hiera_version) if hiera_version
 
 gems.each do |gem_name, gem_params|

REFERENCE.md

@@ -1006,7 +1006,7 @@ Default value: `$postgresql::params::service_reload`
 
 ##### <a name="-postgresql--server--service_status"></a>`service_status`
 
-Data type: `Optional[String[1]]`
+Data type: `Optional[Variant[Array[String[1]],String[1]]]`
 
 Overrides the default status check command for your PostgreSQL service.
 
@@ -3677,6 +3677,7 @@ The following parameters are available in the `postgresql::server::role` defined
 * [`inherit`](#-postgresql--server--role--inherit)
 * [`superuser`](#-postgresql--server--role--superuser)
 * [`replication`](#-postgresql--server--role--replication)
+* [`valid_until`](#-postgresql--server--role--valid_until)
 * [`connection_limit`](#-postgresql--server--role--connection_limit)
 * [`username`](#-postgresql--server--role--username)
 * [`connect_settings`](#-postgresql--server--role--connect_settings)
@@ -3769,6 +3770,14 @@ Provides provides replication capabilities for this role if set to true.
 
 Default value: `false`
 
+##### <a name="-postgresql--server--role--valid_until"></a>`valid_until`
+
+Data type: `Optional[String[1]]`
+
+Specifies whether to set a valid until date for the role.
+
+Default value: `undef`
+
 ##### <a name="-postgresql--server--role--connection_limit"></a>`connection_limit`
 
 Data type: `String[1]`
@@ -4733,7 +4742,7 @@ Type: Ruby 4.x API
 
 This function returns the postgresql password hash from the clear text username / password
 
-#### `postgresql::postgresql_password(Variant[String[1], Integer] $username, Variant[String[1], Sensitive[String[1]], Integer] $password, Optional[Boolean] $sensitive, Optional[Optional[Postgresql::Pg_password_encryption]] $hash, Optional[Optional[Variant[String[1], Integer]]] $salt)`
+#### `postgresql::postgresql_password(Variant[String[1], Integer] $username, Variant[String[1], Sensitive[String[1]], Integer] $password, Optional[Boolean] $sensitive, Optional[Optional[Enum["md5", "scram-sha-256"]]] $hash, Optional[Optional[Variant[String[1], Integer]]] $salt)`
 
 The postgresql::postgresql_password function.
 
@@ -4759,7 +4768,7 @@ If the Postgresql-Passwordhash should be of Datatype Sensitive[String]
 
 ##### `hash`
 
-Data type: `Optional[Optional[Postgresql::Pg_password_encryption]]`
+Data type: `Optional[Optional[Enum["md5", "scram-sha-256"]]]`
 
 Set type for password hash
 
@@ -4880,7 +4889,8 @@ Alias of `Hash[String[1], Postgresql::Pg_hba_rule]`
 
 ### <a name="Postgresql--Pg_password_encryption"></a>`Postgresql::Pg_password_encryption`
 
-the supported password_encryption
+Note that this Enum is also defined in:
+lib/puppet/functions/postgresql/postgresql_password.rb
 
 Alias of `Enum['md5', 'scram-sha-256']`
 

Rakefile

@@ -9,3 +9,11 @@ require 'puppet-strings/tasks' if Gem.loaded_specs.key? 'puppet-strings'
 PuppetLint.configuration.send('disable_relative')
 PuppetLint.configuration.send('disable_anchor_resource')
 PuppetLint.configuration.send('disable_params_empty_string_assignment')
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.send('disable_140chars')
+PuppetLint.configuration.send('disable_class_inherits_from_params_class')
+PuppetLint.configuration.send('disable_autoloader_layout')
+PuppetLint.configuration.send('disable_documentation')
+PuppetLint.configuration.send('disable_single_quote_string_with_variables')
+PuppetLint.configuration.fail_on_warnings = true
+PuppetLint.configuration.ignore_paths = [".vendor/**/*.pp", ".bundle/**/*.pp", "pkg/**/*.pp", "spec/**/*.pp", "tests/**/*.pp", "types/**/*.pp", "vendor/**/*.pp"]

lib/puppet/functions/postgresql/postgresql_password.rb

@@ -24,7 +24,8 @@
     required_param 'Variant[String[1], Integer]', :username
     required_param 'Variant[String[1], Sensitive[String[1]], Integer]', :password
     optional_param 'Boolean', :sensitive
-    optional_param 'Optional[Postgresql::Pg_password_encryption]', :hash
+    # The following Enum is also defined in `types/pg_password_encryption.pp` but type alias can't be used in Deferred functions.
+    optional_param 'Optional[Enum["md5", "scram-sha-256"]]', :hash
     optional_param 'Optional[Variant[String[1], Integer]]', :salt
     return_type 'Variant[String, Sensitive[String]]'
   end
@@ -65,7 +66,7 @@ def pg_sha256(password, salt)
   def digest_key(password, salt)
     OpenSSL::KDF.pbkdf2_hmac(
       password,
-      salt: salt,
+      salt:,
       iterations: 4096,
       length: 32,
       hash: OpenSSL::Digest.new('SHA256'),

lib/puppet/provider/postgresql_conf/ruby.rb

@@ -29,7 +29,7 @@ def parse_config
                 else
                   matches[:value].delete("'")
                 end
-        attributes_hash = { line_number: line_number, key: matches[:key], ensure: 'present', value: value, comment: matches[:comment] }
+        attributes_hash = { line_number:, key: matches[:key], ensure: 'present', value:, comment: matches[:comment] }
         active_settings.push(attributes_hash)
       end
     end
@@ -80,7 +80,7 @@ def exists?
 
   # remove resource if exists and is set to absent
   def destroy
-    entry_regex = %r{#{resource[:key]}.*=.*#{resource[:value]}}
+    entry_regex = %r{^\s*#{resource[:key]}\s*=}
     lines = File.readlines(resource[:target])
 
     lines.delete_if do |entry|