aws-codedeploy-agent 0.0.2 → 0.0.3

data/lib/instance_agent/plugins/codedeploy/onpremise_config.rb

@@ -0,0 +1,42 @@
+module InstanceAgent
+  module Plugins
+    module CodeDeployPlugin
+      class OnPremisesConfig
+        def self.configure
+          file_path = InstanceAgent::Config.config[:on_premises_config_file]
+          file_config = nil
+          if File.exists?(file_path) && File.readable?(file_path)
+            begin
+              file_config = YAML.load(File.read(file_path)).symbolize_keys
+            rescue
+              log(:error, "Invalid on premises config file")
+              raise "Invalid on premises config file"
+            end
+          else
+            log(:info, "On Premises config file does not exist or not readable")
+          end
+          if file_config
+            if file_config[:region]
+              ENV['AWS_REGION'] = file_config[:region]
+            end
+            if file_config[:aws_access_key_id]
+              ENV['AWS_ACCESS_KEY'] = file_config[:aws_access_key_id]
+            end
+            if file_config[:aws_secret_access_key]
+              ENV['AWS_SECRET_KEY'] = file_config[:aws_secret_access_key]
+            end
+            if file_config[:iam_user_arn]
+              ENV['AWS_HOST_IDENTIFIER'] = file_config[:iam_user_arn]
+            end
+          end
+        end
+
+        def self.log(severity, message)
+          raise ArgumentError, "Unknown severity #{severity.inspect}" unless InstanceAgent::Log::SEVERITIES.include?(severity.to_s)
+          InstanceAgent::Log.send(severity.to_sym, "#{message}")
+        end
+
+      end
+    end
+  end
+end

data/lib/instance_agent/plugins/codedeploy/register_plugin.rb

@@ -0,0 +1,17 @@
+require_relative 'command_poller'
+require_relative 'command_executor'
+require_relative 'deployment_specification'
+require_relative 'application_specification/application_specification'
+require_relative 'application_specification/file_info'
+require_relative 'application_specification/script_info'
+require_relative 'application_specification/linux_permission_info'
+require_relative 'application_specification/mode_info'
+require_relative 'application_specification/acl_info'
+require_relative 'application_specification/ace_info'
+require_relative 'application_specification/context_info'
+require_relative 'application_specification/range_info'
+require_relative 'installer'
+require_relative 'install_instruction'
+require_relative 'codedeploy_control'
+require_relative 'hook_executor'
+require_relative 'onpremise_config'

data/lib/instance_agent/runner/child.rb

@@ -4,16 +4,31 @@ require 'process_manager/child'
 module InstanceAgent
   module Runner
     class Child < ProcessManager::Daemon::Child
-      AGENTS = {
-        0 => InstanceAgent::CodeDeployPlugin::CommandPoller
-      }
 
       attr_accessor :runner
 
+      def load_plugins(plugins)
+        ProcessManager::Log.debug("Registering Plugins: #{plugins.inspect}.")
+        plugins.each do |plugin|
+          plugin_dir = File.expand_path("../plugins/#{plugin}/register_plugin", File.dirname(__FILE__))
+          ProcessManager::Log.debug("Loading plugin #{plugin} from #{plugin_dir}")
+          begin
+            require plugin_dir
+          rescue LoadError => e
+            ProcessManager::Log.error("Plugin #{plugin} could not be loaded: #{e.message}.")
+            raise
+          end
+        end
+        registered_plugins = InstanceAgent::Agent::Base.plugins
+        ProcessManager::Log.debug("Registered Plugins: #{registered_plugins.inspect}.")
+        Hash[registered_plugins.map.with_index { |value, index| [index, value] }]
+      end
+
       def prepare_run
+        @plugins ||= load_plugins(ProcessManager::Config.config[:plugins] || ["codedeploy"])
         validate_index
         with_error_handling do
-          @runner = AGENTS[index].runner
+          @runner = @plugins[index].runner
           ProcessManager.set_program_name(description)
         end
       end
@@ -33,7 +48,7 @@ module InstanceAgent
       end
 
       def validate_index
-        raise ArgumentError, "Invalid index #{index.inspect}: only 0-2 possible" unless AGENTS.keys.include?(index)
+        raise ArgumentError, "Invalid index #{index.inspect}" unless @plugins.keys.include?(index)
       end
 
       def with_error_handling

data/lib/instance_agent/runner/master.rb

@@ -1,7 +1,5 @@
 # encoding: UTF-8
 require 'process_manager/master'
-require 'instance_agent/codedeploy_plugin/request_helper'
-require 'instance_agent/codedeploy_plugin/codedeploy_control'
 require 'instance_metadata'
 
 module InstanceAgent
@@ -22,18 +20,6 @@ module InstanceAgent
         ProcessManager::Config.config[:program_name]
       end
 
-      def validate_ssl_config
-        if !InstanceMetadata.instance_id.blank?
-          region = InstanceMetadata.region
-          request_helper = InstanceAgent::CodeDeployPlugin::RequestHelper.new(:deploy_control_client => InstanceAgent::CodeDeployPlugin::CodeDeployControl.new(:region => region))
-
-          if (errors = request_helper.verify_clients_configuration)
-            errors.each{|error| ProcessManager::Log.error("Stopping CodeDeploy agent. " + error)}
-          end
-          self.class.abort unless errors.empty?
-        end
-      end
-
       def self.log_file
         File.join(ProcessManager::Config.config[:log_dir], "#{ProcessManager::Config.config[:program_name]}.log")
       end
@@ -72,7 +58,7 @@ module InstanceAgent
       end
 
       def kill_children(sig)
-        children.each do |index, child_pid|
+	    children.each do |index, child_pid|
           begin
             Process.kill(sig, child_pid)
           rescue Errno::ESRCH
@@ -96,6 +82,7 @@ module InstanceAgent
             end
           end
         end
+
       end
       
     end

data/lib/instance_metadata.rb

@@ -38,8 +38,8 @@ class InstanceMetadata
     Net::HTTP.start(IP_ADDRESS, PORT) do |http|
       response = http.get(path)
       if response.code.to_i != 200
-        InstanceAgent::Log.send(:debug, "HTTP error from metadata service, code #{reponse.code}")
-        raise "HTTP error from metadata service, code #{reponse.code}"
+        InstanceAgent::Log.send(:debug, "HTTP error from metadata service, code #{response.code}")
+        raise "HTTP error from metadata service, code #{response.code}"
       end
       return response.body
     end

data/test/certificate_helper.rb

@@ -10,7 +10,7 @@ class CertificateHelper
     ca_chain_file = generate_ca_chain()
 
     ENV['AWS_REGION'] = 'us-east-1'
-    InstanceAgent::CodeDeployPlugin::DeploymentSpecification.init_cert_store(ca_chain_file)
+    InstanceAgent::Plugins::CodeDeployPlugin::DeploymentSpecification.init_cert_store(ca_chain_file)
   end
 
   def generate_root()

data/test/helpers/instance_agent_helper.rb

@@ -1,5 +1,6 @@
 # require the code
 require 'instance_agent'
+require 'instance_agent/plugins/codedeploy/register_plugin'
 
 class InstanceAgentTestCase < Test::Unit::TestCase
   include ActiveSupport::Testing::Assertions

data/test/instance_agent/agent/base_test.rb

@@ -24,26 +24,39 @@ class InstanceAgentBaseTest < InstanceAgentTestCase
     end
 
     context 'rescues exceptions when running perform' do
+      setup do
+        @base.stubs(:log).with { |v1, v2| v1.eql?(:debug) }
+      end
+
       should 'rescue Aws::Errors::MissingCredentialsError' do
         @base.stubs(:perform).raises Aws::Errors::MissingCredentialsError
-        @base.expects(:sleep).with 0
+        @base.expects(:sleep).with(9)
         @base.expects(:log).with(:error, "Missing credentials - please check if this instance was started with an IAM instance profile")
         assert_nothing_raised(Aws::Errors::MissingCredentialsError) { @base.run }
       end
 
       should 'rescue Aws::Errors::ServiceError' do
         @base.stubs(:perform).raises Aws::Errors::ServiceError.new(nil, "http error")
-        @base.expects(:sleep).with(0)
+        @base.expects(:sleep).with(9)
         @base.expects(:log).with { |v1, v2| v1.eql?(:error) && v2 =~ /Cannot reach InstanceService/ }
         assert_nothing_raised(Aws::Errors::ServiceError) { @base.run }
       end
 
       should 'rescue all other types of exception' do
         @base.stubs(:perform).raises Exception
-        @base.expects(:sleep).with(0)
+        @base.expects(:sleep).with(9)
         @base.expects(:log).with { |v1, v2| v1.eql?(:error) && v2 =~ /Error during perform/ }
         assert_nothing_raised(Exception) { @base.run }
       end
+      
+      should 'back off on repeated exceptions' do
+        @base.stubs(:perform).raises Exception
+        @base.expects(:sleep).with(9)
+        @base.expects(:sleep).with(12)
+        @base.expects(:log).twice.with { |v1, v2| v1.eql?(:error) && v2 =~ /Error during perform/ }
+        assert_nothing_raised(Exception) { @base.run }
+        assert_nothing_raised(Exception) { @base.run }
+      end
     end
   end
 end

data/test/instance_agent/config_test.rb

@@ -26,7 +26,8 @@ class InstanceAgentConfigTest < InstanceAgentTestCase
         :instance_service_port => nil,
         :wait_between_runs => 30,
         :wait_after_error => 30,
-        :codedeploy_test_profile => 'prod'
+        :codedeploy_test_profile => 'prod',
+        :on_premises_config_file => '/etc/codedeploy-agent/conf/codedeploy.onpremises.yml'
       }, InstanceAgent::Config.config)
     end
 

data/test/instance_agent/plugins/codedeploy/application_specification_test.rb

@@ -0,0 +1,1713 @@
+require 'test_helper'
+require 'ostruct'
+require 'yaml'
+
+module InstanceAgent
+  module Plugins
+    module CodeDeployPlugin
+      module ApplicationSpecification
+        class ApplicationSpecificationTest < InstanceAgentTestCase
+          context 'The Application Specification' do
+            setup do
+              @test_revision_id = 'bar'
+            end
+
+            private
+
+            def make_app_spec
+              ApplicationSpecification.new(YAML.load(@app_spec_string), {:revision_id => @test_revision_id})
+            end
+
+            context "With missing version" do
+              setup do
+                @app_spec_string = <<-END
+              os: linux
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('unsupported version: ',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With invalid version" do
+              setup do
+                @app_spec_string = <<-END
+              version: invalid
+              os: linux
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('unsupported version: invalid',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With missing os" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('unsupported os: ',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With invalid os" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: unsupported
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('unsupported os: unsupported',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With no hooks or files" do
+              setup do
+                @app_spec_string = "version: 0.0\nos: linux\n"
+              end
+              should "Return an empty hooks hash" do
+                app_spec = make_app_spec
+                assert_equal({}, app_spec.hooks)
+              end
+              should "Return an empty files array" do
+                app_spec = make_app_spec
+                assert_equal([], app_spec.files)
+              end
+            end
+
+            context "With a single complete hook" do
+              setup do
+                #A single test script with all parameters
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              hooks:
+                test_hook:
+                  - location: test_location_1
+                    runas: foo
+                    timeout: 30
+                END
+              end
+              should "Return a collection containing test script 1" do
+                app_spec = make_app_spec
+                assert_not_equal nil, app_spec.hooks
+                assert_equal ['test_location_1'] , app_spec.hooks["test_hook"].map(&:location)
+                assert_equal ['foo'] , app_spec.hooks["test_hook"].map(&:runas)
+                assert_equal [30] , app_spec.hooks["test_hook"].map(&:timeout)
+              end
+            end
+
+            context "With two complete hooks" do
+              setup do
+                #A pair of test scripts with all parameters
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              hooks:
+                test_hook:
+                  - location: test_location_1
+                    runas: foo
+                    timeout: 30
+                  - location: test_location_2
+                    runas: foo2
+                    timeout: 30
+                END
+              end
+
+              should "Return a collection containing test script 1 and test script 2" do
+                app_spec = make_app_spec
+                assert_not_equal nil, app_spec.hooks
+                assert_equal ['test_location_1', 'test_location_2'] , app_spec.hooks["test_hook"].map(&:location)
+              end
+            end
+
+            context "With partial hooks (just a runas)" do
+              setup do
+                #A test script with just a location
+                #A test script with location and runas
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              hooks:
+                test_hook:
+                  - location: test_location
+                  - location: test_location_lr
+                    runas: foo3
+                END
+              end
+
+              should "Return a collection containing the two scripts in order" do
+                app_spec = make_app_spec()
+                assert_not_equal nil, app_spec.hooks
+                assert_equal [nil, 'foo3'] , app_spec.hooks["test_hook"].map(&:runas)
+              end
+            end
+
+            context "With partial hooks (just a timeout)" do
+              setup do
+                #A test script with just a location
+                #A test script with location and timeout
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              hooks:
+                test_hook:
+                  - location: test_location
+                  - location: test_location_lt
+                    timeout: 30
+                END
+              end
+
+              should "Return a collection containing the two scripts in order" do
+                app_spec = make_app_spec()
+                assert_not_equal nil, app_spec.hooks
+                assert_equal [3600, 30] , app_spec.hooks["test_hook"].map(&:timeout)
+              end
+            end
+
+            context "With missing location data" do
+              setup do
+                #A test script without a location
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              hooks:
+                test_hook:
+                  - timeout: 30
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('script provided without a location value',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With non numerical timeout data" do
+              setup do
+                #A test script with bad timeout data
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              hooks:
+                test_hook:
+                  - location: test_location
+                    timeout: foo
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('Timeout needs to be an integer greater than 0',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "App spec has a file mapping" do
+              context "file map contains a single file" do
+                setup do
+                  @app_spec_string = <<-END
+                version: 0.0
+                os: linux
+                files:
+                  - source: test_source
+                    destination: test_destination
+                  END
+                end
+
+                should "return a hash containing the file mapping objects" do
+                  app_spec = make_app_spec
+                  assert_not_equal nil, app_spec.files
+                  assert_equal ['test_source'] , app_spec.files.map(&:source)
+                  assert_equal ['test_destination'] , app_spec.files.map(&:destination)
+                end
+              end
+
+              context "file map contains multiple files" do
+                setup do
+                  @app_spec_string = <<-END
+                version: 0.0
+                os: linux
+                files:
+                  - source: test_source
+                    destination: test_destination
+                  - source: test_source_2
+                    destination: test_destination_2
+                  END
+                end
+
+                should  "return a hash containing the file mapping objects" do
+                  app_spec = make_app_spec
+                  assert_not_equal nil, app_spec.files
+                  assert_equal ['test_source', 'test_source_2'] , app_spec.files.map(&:source)
+                  assert_equal ['test_destination','test_destination_2'] , app_spec.files.map(&:destination)
+                end
+              end
+
+              context "file map is missing a destination" do
+                setup do
+                  @app_spec_string = <<-END
+                version: 0.0
+                os: linux
+                files:
+                  - source: test_source
+                  END
+                end
+
+                should  "raise and AppSpecValidationException" do
+                  assert_raised_with_message('File needs to have a destination',AppSpecValidationException) do
+                    make_app_spec()
+                  end
+                end
+              end
+
+              context "file map is missing a source" do
+                setup do
+                  @app_spec_string = <<-END
+                version: 0.0
+                os: linux
+                files:
+                  - destination: test_destination
+                  END
+                end
+
+                should  "raise and AppSpecValidationException" do
+                  assert_raised_with_message('File needs to have a source',AppSpecValidationException) do
+                    make_app_spec()
+                  end
+                end
+              end
+            end
+
+            context "With permission without object set" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - pattern: test
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('permission provided without a object value',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission pattern of **" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: '/'
+                  pattern: '**'
+                END
+              end
+
+              should "match all objects" do
+                app_spec = make_app_spec()
+                assert_equal '**', app_spec.permissions[0].pattern
+              end
+            end
+
+            context "With multiple permissions" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: '/'
+                - object: test
+                - object: more
+                END
+              end
+
+              should "match all objects" do
+                app_spec = make_app_spec()
+                assert_equal 3, app_spec.permissions.length
+                assert_equal '/', app_spec.permissions[0].object
+                assert_equal "test", app_spec.permissions[1].object
+                assert_equal "more", app_spec.permissions[2].object
+              end
+            end
+
+            context "With permissions with pattern" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: '/'
+                  pattern: 'glob'
+                END
+              end
+
+              should "raise when validated as file permission" do
+                app_spec = make_app_spec()
+                assert_raised_with_message('Attempt to use pattern glob when assigning permissions to file /',AppSpecValidationException) do
+                  app_spec.permissions[0].validate_file_permission
+                end
+              end
+            end
+
+            context "With permissions with except" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: '/'
+                  except:
+                    - 'glob'
+                END
+              end
+
+              should "raise when validated as file permission" do
+                app_spec = make_app_spec()
+                assert_raised_with_message('Attempt to use except ["glob"] when assigning permissions to file /',AppSpecValidationException) do
+                  app_spec.permissions[0].validate_file_permission
+                end
+              end
+            end
+
+            context "With permissions" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: '/'
+                END
+              end
+
+              should "not raise when validated as file permission" do
+                app_spec = make_app_spec()
+                assert_nothing_raised do
+                  app_spec.permissions[0].validate_file_permission
+                end
+              end
+            end
+
+            context "With permissions with pattern without file type" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: '/'
+                  pattern: 'glob'
+                  type:
+                    - "directory"
+                END
+              end
+
+              should "not raise when validated as file permission" do
+                app_spec = make_app_spec()
+                assert_nothing_raised do
+                  app_spec.permissions[0].validate_file_permission
+                end
+              end
+            end
+
+            context "With permissions with acl without default ace" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: '/'
+                  acls:
+                    - 'user:name:rwx'
+                END
+              end
+
+              should "be able to validate as a file acl" do
+                app_spec = make_app_spec()
+                assert_nothing_raised do
+                  app_spec.permissions[0].validate_file_acl("test")
+                end
+              end
+            end
+
+            context "With permissions with acl with default ace" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: '/'
+                  acls:
+                    - 'd:user:name:rwx'
+                END
+              end
+
+              should "be able to validate as a file acl" do
+                app_spec = make_app_spec()
+                assert_raised_with_message('Attempt to set default acl default:user:name:rwx on file test',RuntimeError) do
+                  app_spec.permissions[0].validate_file_acl("test")
+                end
+              end
+            end
+
+            context "With valid permission object" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test'
+                  pattern: 'prefix*'
+                  except: ['*ReadMe', '*.tmp']
+                  type: ['file']
+                  owner: 'bob'
+                  group: 'dev'
+                  mode: 6763
+                  acls:
+                    - 'u:henry:7'
+                    - 'd:g:manager:rw'
+                  context:
+                    name: 'user_u'
+                    type: 'unconfined_t'
+                    range: 's3-s5:c0.c7,c13'
+                END
+              end
+
+              should "match pattern when appropriate" do
+                app_spec = make_app_spec()
+                permission = app_spec.permissions[0]
+
+                assert permission.matches_pattern?(File.expand_path("test/prefix")), "Should match test/prefix for pattern"
+                assert permission.matches_pattern?(File.expand_path("test/prefix_matches")), "Should match test/prefix_matches for pattern"
+                assert !permission.matches_pattern?(File.expand_path("test/prefix/does_not_match")), "Should not match test/prefix/does_not_match for pattern"
+                assert !permission.matches_pattern?(File.expand_path("testprefix/")), "Should not match testprefix/ for pattern"
+                assert !permission.matches_pattern?(File.expand_path("tst/prefix")), "Should not match tst/prefix for pattern"
+                assert !permission.matches_pattern?(File.expand_path("test/not_prefix")), "Should not match test/not_prefix for pattern"
+              end
+
+              should "match except when appropriate" do
+                app_spec = make_app_spec()
+                permission = app_spec.permissions[0]
+
+                assert permission.matches_except?(File.expand_path("test/this.tmp")), "Should match test/this.tmp for except"
+                assert permission.matches_except?(File.expand_path("test/this_ReadMe")), "Should match test/this_ReadMe for except"
+                assert !permission.matches_except?(File.expand_path("test/prefix/does_not_match.tmp")), "Should not match test/prefix/does_not_match.tmp for except"
+                assert !permission.matches_except?(File.expand_path("testprefix/")), "Should not match testprefix/ for except"
+                assert !permission.matches_except?(File.expand_path("tst/prefix")), "Should not match tst/prefix for except"
+                assert !permission.matches_except?(File.expand_path("test/not_match")), "Should not match test/not_match for except"
+              end
+
+              should "set fields correctly" do
+                app_spec = make_app_spec()
+                permission = app_spec.permissions[0]
+                assert_equal 'test', permission.object
+                assert_equal 'prefix*', permission.pattern
+                assert_equal ['*ReadMe', '*.tmp'], permission.except
+                assert_equal ['file'], permission.type
+                assert_equal 'bob', permission.owner
+                assert_equal 'dev', permission.group
+
+                mode = permission.mode
+                assert_equal '6763', mode.mode
+                assert_equal '3', mode.world
+                assert_equal false, mode.world_readable
+                assert_equal true, mode.world_writable
+                assert_equal true, mode.world_executable
+                assert_equal '6', mode.group
+                assert_equal true, mode.group_readable
+                assert_equal true, mode.group_writable
+                assert_equal false, mode.group_executable
+                assert_equal '7', mode.owner
+                assert_equal true, mode.owner_readable
+                assert_equal true, mode.owner_writable
+                assert_equal true, mode.owner_executable
+                assert_equal true, mode.setuid
+                assert_equal true, mode.setgid
+                assert_equal false, mode.sticky
+
+                acl = permission.acls
+                assert_equal 2, acl.aces.length
+                ace = acl.aces[0]
+                assert_equal false, ace.default
+                assert_equal 'user', ace.type
+                assert_equal 'henry', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[1]
+                assert_equal true, ace.default
+                assert_equal 'group', ace.type
+                assert_equal 'manager', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal false, ace.execute
+
+                context = permission.context
+                assert_equal 'user_u', context.user
+                assert_equal nil, context.role
+                assert_equal 'unconfined_t', context.type
+
+                range = context.range
+                assert_equal 3, range.low_sensitivity
+                assert_equal 5, range.high_sensitivity
+
+                categories = range.categories
+                assert_equal 9, categories.length
+                [(0..7).to_a,13].flatten!.each do |category|
+                  assert_equal true, categories.include?(category), "Unable to find expected category #{category}"
+                end
+              end
+            end
+
+            context "With permission with acl with ace with too few parts" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - '7'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid acl entry 7',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with acl with ace with too many parts" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'd:u:bob:7:rwx'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid acl entry d:u:bob:7:rwx',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with acl with ace with invalid first part" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'invalid:u:bob:7:rwx'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid acl entry invalid:u:bob:7:rwx',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with acl with ace with invalid second part" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'd:invalid:bob:7:rwx'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid acl entry d:invalid:bob:7:rwx',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with acl with ace with default as first and second part" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'd:d:bob:7:rwx'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid acl entry d:d:bob:7:rwx',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with acl with ace with mask with name" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'mask:name:rwx'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid acl entry mask:name:rwx',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with acl with ace with other with name" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'd:other:name:rwx'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid acl entry d:other:name:rwx',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with acl with ace with invalid permission character" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'user:bob:rwxd'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('unrecognized permission character d in user:bob:rwxd',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with acl with valid ace with 4 parts" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'd:u:bob:rwx'
+                    - 'default:g:dev:rw'
+                END
+              end
+
+              should "generate correct fields" do
+                app_spec = make_app_spec()
+
+                acl = app_spec.permissions[0].acls
+                assert_equal 2, acl.aces.length
+
+                ace = acl.aces[0]
+                assert_equal true, ace.default
+                assert_equal 'user', ace.type
+                assert_equal 'bob', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[1]
+                assert_equal true, ace.default
+                assert_equal 'group', ace.type
+                assert_equal 'dev', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal false, ace.execute
+              end
+            end
+
+            context "With permission with acl with valid ace with 3 parts" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'd:bob:rwx'
+                    - 'default::rw'
+                    - 'm::7'
+                    - 'mask::7'
+                    - 'g:dev:7'
+                    - 'group:dev:7'
+                    - 'u:bob:7'
+                    - 'user:bob:7'
+                    - 'u:mask:7'
+                    - 'u:other:7'
+                END
+              end
+
+              should "generate correct fields" do
+                app_spec = make_app_spec()
+
+                acl = app_spec.permissions[0].acls
+                assert_equal 10, acl.aces.length
+
+                ace = acl.aces[0]
+                assert_equal true, ace.default
+                assert_equal 'user', ace.type
+                assert_equal 'bob', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[1]
+                assert_equal true, ace.default
+                assert_equal 'user', ace.type
+                assert_equal '', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal false, ace.execute
+
+                ace = acl.aces[2]
+                assert_equal false, ace.default
+                assert_equal 'mask', ace.type
+                assert_equal '', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[3]
+                assert_equal false, ace.default
+                assert_equal 'mask', ace.type
+                assert_equal '', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[4]
+                assert_equal false, ace.default
+                assert_equal 'group', ace.type
+                assert_equal 'dev', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[5]
+                assert_equal false, ace.default
+                assert_equal 'group', ace.type
+                assert_equal 'dev', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[6]
+                assert_equal false, ace.default
+                assert_equal 'user', ace.type
+                assert_equal 'bob', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[7]
+                assert_equal false, ace.default
+                assert_equal 'user', ace.type
+                assert_equal 'bob', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[8]
+                assert_equal false, ace.default
+                assert_equal 'user', ace.type
+                assert_equal 'mask', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[9]
+                assert_equal false, ace.default
+                assert_equal 'user', ace.type
+                assert_equal 'other', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+              end
+            end
+
+            context "With permission with acl with valid ace with 2 parts" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'bob:0'
+                    - 'm:7'
+                    - 'mask:'
+                END
+              end
+
+              should "generate correct fields" do
+                app_spec = make_app_spec()
+
+                acl = app_spec.permissions[0].acls
+                assert_equal 3, acl.aces.length
+
+                ace = acl.aces[0]
+                assert_equal false, ace.default
+                assert_equal 'user', ace.type
+                assert_equal 'bob', ace.name
+                assert_equal false, ace.read
+                assert_equal false, ace.write
+                assert_equal false, ace.execute
+
+                ace = acl.aces[1]
+                assert_equal false, ace.default
+                assert_equal 'mask', ace.type
+                assert_equal '', ace.name
+                assert_equal true, ace.read
+                assert_equal true, ace.write
+                assert_equal true, ace.execute
+
+                ace = acl.aces[2]
+                assert_equal false, ace.default
+                assert_equal 'mask', ace.type
+                assert_equal '', ace.name
+                assert_equal false, ace.read
+                assert_equal false, ace.write
+                assert_equal false, ace.execute
+              end
+            end
+
+            context "With permission with context with invalid sensitivity range" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's3-s2:c0'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid sensitivity range in s3-s2:c0',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with missing sensitivity range part" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's3-:c0'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid range part s3-',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With single sensitivity" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    type: 'type'
+                    range: 's5'
+                END
+              end
+
+              should "generate correct fields" do
+                app_spec = make_app_spec()
+
+                assert_equal 5, app_spec.permissions[0].context.range.low_sensitivity
+                assert_equal 5, app_spec.permissions[0].context.range.high_sensitivity
+                assert_equal nil, app_spec.permissions[0].context.range.categories
+              end
+            end
+
+            context "With permission with context with missing sensitivity" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: ':c0'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid range part :c0',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with missing sensitivity value" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid sensitivity s',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with negative sensitivity value" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0-s-1'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid sensitivity s-1',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with invalid sensitivity" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 'sd3'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid sensitivity sd3',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with invalid sensitivity 2" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 'd3'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid sensitivity d3',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with invalid category range" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:c2.c1'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid category range c2.c1',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with missing category range part" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:c2.'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid range part c2.',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With valid category" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    type: 'type'
+                    range: 's0:c0.c1,c15,c7.c9'
+                END
+              end
+
+              should "generate correct fields" do
+                app_spec = make_app_spec()
+
+                categories = app_spec.permissions[0].context.range.categories
+                assert_equal 6, categories.length
+                [(0..1).to_a, (7..9).to_a, 15].flatten!.each do |category|
+                  assert_equal true, categories.include?(category), "Unable to find expected category #{category}"
+                end
+              end
+            end
+
+            context "With permission with context with missing category" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid range part s0:',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with missing category value" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:c'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid category c',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with negative category value" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:c-1'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid category c-1',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with category value above 1023" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:c1024'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid category c1024',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context without type" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message("invalid context type required {\"name\"=>\"name\"}",AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with invalid category" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:cd3'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid category cd3',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with invalid category 2" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:d3'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid category d3',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with context with duplicate categories" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  context:
+                    name: 'name'
+                    type: 'type'
+                    range: 's0:c0.c2,c1'
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('duplicate categories',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with mode with 5 digits" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  mode: 12345
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('permission mode length incorrect: 12345',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with mode with 2 digits" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  mode: 12
+                END
+              end
+
+              should "fill in needed zeros" do
+                app_spec = make_app_spec()
+
+                mode = app_spec.permissions[0].mode
+                assert_equal '012', mode.mode
+                assert_equal '2', mode.world
+                assert_equal false, mode.world_readable
+                assert_equal true, mode.world_writable
+                assert_equal false, mode.world_executable
+                assert_equal '1', mode.group
+                assert_equal false, mode.group_readable
+                assert_equal false, mode.group_writable
+                assert_equal true, mode.group_executable
+                assert_equal '0', mode.owner
+                assert_equal false, mode.owner_readable
+                assert_equal false, mode.owner_writable
+                assert_equal false, mode.owner_executable
+                assert_equal false, mode.setuid
+                assert_equal false, mode.setgid
+                assert_equal false, mode.sticky
+              end
+            end
+
+            context "With permission with mode with invalid char" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  mode: 12a
+                END
+              end
+
+              should "raise an exception" do
+                assert_raised_with_message('invalid character a in permission mode 12a',AppSpecValidationException) do
+                  make_app_spec()
+                end
+              end
+            end
+
+            context "With permission with valid modes" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  mode: 7777
+                - object: 'test1/'
+                  mode: 0000
+                - object: 'test2/'
+                  mode: 777
+                END
+              end
+
+              should "generate correct fields" do
+                app_spec = make_app_spec()
+
+                mode = app_spec.permissions[0].mode
+                assert_equal '7777', mode.mode
+                assert_equal '7', mode.world
+                assert_equal true, mode.world_readable
+                assert_equal true, mode.world_writable
+                assert_equal true, mode.world_executable
+                assert_equal '7', mode.group
+                assert_equal true, mode.group_readable
+                assert_equal true, mode.group_writable
+                assert_equal true, mode.group_executable
+                assert_equal '7', mode.owner
+                assert_equal true, mode.owner_readable
+                assert_equal true, mode.owner_writable
+                assert_equal true, mode.owner_executable
+                assert_equal true, mode.setuid
+                assert_equal true, mode.setgid
+                assert_equal true, mode.sticky
+
+                mode = app_spec.permissions[1].mode
+                assert_equal '000', mode.mode
+                assert_equal '0', mode.world
+                assert_equal false, mode.world_readable
+                assert_equal false, mode.world_writable
+                assert_equal false, mode.world_executable
+                assert_equal '0', mode.group
+                assert_equal false, mode.group_readable
+                assert_equal false, mode.group_writable
+                assert_equal false, mode.group_executable
+                assert_equal '0', mode.owner
+                assert_equal false, mode.owner_readable
+                assert_equal false, mode.owner_writable
+                assert_equal false, mode.owner_executable
+                assert_equal false, mode.setuid
+                assert_equal false, mode.setgid
+                assert_equal false, mode.sticky
+
+                mode = app_spec.permissions[2].mode
+                assert_equal '777', mode.mode
+                assert_equal '7', mode.world
+                assert_equal true, mode.world_readable
+                assert_equal true, mode.world_writable
+                assert_equal true, mode.world_executable
+                assert_equal '7', mode.group
+                assert_equal true, mode.group_readable
+                assert_equal true, mode.group_writable
+                assert_equal true, mode.group_executable
+                assert_equal '7', mode.owner
+                assert_equal true, mode.owner_readable
+                assert_equal true, mode.owner_writable
+                assert_equal true, mode.owner_executable
+                assert_equal false, mode.setuid
+                assert_equal false, mode.setgid
+                assert_equal false, mode.sticky
+              end
+            end
+
+            context "When acl is present" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls: []
+                END
+                app_spec = make_app_spec()
+                @acl = app_spec.permissions[0].acls
+              end
+
+              should "be able to add and clear additional aces" do
+                @acl.add_ace("d:henry:4")
+                @acl.clear_additional
+              end
+
+              should "be able to get an empty acl" do
+                assert_equal [], @acl.get_acl
+              end
+
+              should "be able to get added aces in the acl" do
+                @acl.add_ace("d:henry:4")
+                assert_equal 1, @acl.get_acl.length
+                @acl.clear_additional
+              end
+
+              should "not be able to get a default ace" do
+                assert_equal nil, @acl.get_default_ace
+              end
+
+              should "be able to get an added default ace" do
+                @acl.add_ace("d:henry:4")
+                assert_not_nil @acl.get_default_ace
+                @acl.clear_additional
+              end
+
+              should "not be able to get a default group ace" do
+                assert_equal nil, @acl.get_default_group_ace
+              end
+
+              should "be able to get an added default group ace" do
+                @acl.add_ace("d:g::4")
+                assert_not_nil @acl.get_default_group_ace
+                @acl.clear_additional
+              end
+
+              should "not have a base named ace" do
+                assert !@acl.has_base_named?
+              end
+
+              should "have a base named ace when added" do
+                @acl.add_ace("bob:4")
+                assert @acl.has_base_named?
+                @acl.clear_additional
+              end
+
+              should "not have a base mask ace" do
+                assert !@acl.has_base_mask?
+              end
+
+              should "have a base mask ace when added" do
+                @acl.add_ace("m:4")
+                assert @acl.has_base_mask?
+                @acl.clear_additional
+              end
+
+              should "not have a default ace" do
+                assert !@acl.has_default?
+              end
+
+              should "have a default ace when added" do
+                @acl.add_ace("d:bob:4")
+                assert @acl.has_default?
+                @acl.clear_additional
+              end
+
+              should "not have a default user ace" do
+                assert !@acl.has_default_user?
+              end
+
+              should "have a default user ace when added" do
+                @acl.add_ace("d::4")
+                assert @acl.has_default_user?
+                @acl.clear_additional
+              end
+
+              should "not have a default group ace" do
+                assert !@acl.has_default_group?
+              end
+
+              should "have a default group ace when added" do
+                @acl.add_ace("d:g::4")
+                assert @acl.has_default_group?
+                @acl.clear_additional
+              end
+
+              should "not have a default other ace" do
+                assert !@acl.has_default_other?
+              end
+
+              should "have a default other ace when added" do
+                @acl.add_ace("d:o:4")
+                assert @acl.has_default_other?
+                @acl.clear_additional
+              end
+
+              should "not have a default named ace" do
+                assert !@acl.has_default_named?
+              end
+
+              should "have a default named ace when added" do
+                @acl.add_ace("d:bob:4")
+                assert @acl.has_default_named?
+                @acl.clear_additional
+              end
+
+              should "not have a default mask ace" do
+                assert !@acl.has_default_mask?
+              end
+
+              should "have a default mask ace when added" do
+                @acl.add_ace("d:m:4")
+                assert @acl.has_default_mask?
+                @acl.clear_additional
+              end
+            end
+
+            context "When acl is present with existing aces" do
+              setup do
+                @app_spec_string = <<-END
+              version: 0.0
+              os: linux
+              permissions:
+                - object: 'test/'
+                  acls:
+                    - 'bob:6'
+                    - 'm:6'
+                    - 'd:bob:0'
+                    - 'd::3'
+                    - 'd:g::4'
+                    - 'd:o:3'
+                    - 'd:m:7'
+                END
+                app_spec = make_app_spec()
+                @acl = app_spec.permissions[0].acls
+              end
+
+              should "be able to get the acl" do
+                assert_equal 7, @acl.get_acl.length
+              end
+
+              should "be able to get default ace" do
+                assert_not_nil @acl.get_default_ace
+              end
+
+              should "be able to get default group ace" do
+                assert_not_nil @acl.get_default_group_ace
+              end
+
+              should "have base named ace" do
+                assert_not_nil @acl.has_base_named?
+              end
+
+              should "have base mask ace" do
+                assert_not_nil @acl.has_base_mask?
+              end
+
+              should "have default ace" do
+                assert_not_nil @acl.has_default?
+              end
+
+              should "have default user ace" do
+                assert_not_nil @acl.has_default_user?
+              end
+
+              should "have default group ace" do
+                assert_not_nil @acl.has_default_group?
+              end
+
+              should "have default other ace" do
+                assert_not_nil @acl.has_default_other?
+              end
+
+              should "have default named ace" do
+                assert_not_nil @acl.has_default_named?
+              end
+
+              should "have default mask ace" do
+                assert_not_nil @acl.has_default_mask?
+              end
+            end
+          end
+
+          context "With a ContextInfo" do
+            should "with a simple range" do
+              info = InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::ContextInfo.new({"type"=>"type","range"=>"s3"})
+              assert_equal "s3", info.range.get_range
+            end
+
+            should "with a complex range" do
+              info = InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::ContextInfo.new({"type"=>"type","range"=>"s3-s7:c5,c8.c10,c17"})
+              assert_equal "s3-s7:c5,c8.c10,c17", info.range.get_range
+            end
+          end
+
+          context "With a ACEInfo" do
+            should "not raise if made internal with base entries" do
+              assert_nothing_raised do
+                InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::AceInfo.new("u::7", true)
+                InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::AceInfo.new("g::7", true)
+                InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::AceInfo.new("o::7", true)
+              end
+            end
+
+            should "raise when not internal and has base user" do
+              assert_raised_with_message("use mode to set the base acl entry u::7",AppSpecValidationException) do
+                InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::AceInfo.new("u::7")
+              end
+            end
+
+            should "raise when not internal and has base group" do
+              assert_raised_with_message("use mode to set the base acl entry g::7",AppSpecValidationException) do
+                InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::AceInfo.new("g::7")
+              end
+            end
+
+            should "raise when not internal and has base other" do
+              assert_raised_with_message("use mode to set the base acl entry o:7",AppSpecValidationException) do
+                InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::AceInfo.new("o:7")
+              end
+            end
+
+            should "be able to get the ace" do
+              assert_equal("default:user:bob:rwx", InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::AceInfo.new("d:u:bob:7").get_ace)
+              assert_equal("mask::---", InstanceAgent::Plugins::CodeDeployPlugin::ApplicationSpecification::AceInfo.new("m:0").get_ace)
+            end
+          end
+        end
+      end
+    end
+  end
+end