beaker-puppet 4.4.1 → 4.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f0348cca254c27334c26c725d3f4a85f8e1478ee9cc0f2225e5926191dbf2ad
-  data.tar.gz: 80b547283b224d79124c4da2d64ac80d2e7f7e1f5771bb3b894b60dfac6e807b
+  metadata.gz: c7e6d038ac57aef64b353df0164ffc60deaa271b12ac273484e9b3af2ef15008
+  data.tar.gz: 4b79a68287b4b82c9fa322c8020e31c54cac11d5aee4dbd37c470eb0bd655a6c
 SHA512:
-  metadata.gz: f46087026e865f7e5cb5b92c10fc9f2d63622461506912d3d4d871cc4e1753a5ee259335e1f34eb2ee8ab2e855c7c9a3bb6a17d00db617bdff3d0eb5bb88d44f
-  data.tar.gz: 1eb888543c65046ad3e562eb765099c087433309b14df31ba45b53d544f3776a32daf92e237d89d9352a5289ddc74e6b738d20c295bb371601214c54864794c7
+  metadata.gz: 63f4933b686b1d43dc520575b752f4f4267e97a3b8646debc04707a6efd04405d366aa6da5d5fbee2ad1eafc97dcb669e8e0fae3121448c149f253f0491ccbed
+  data.tar.gz: 339bcc300c9ee16b5157cceb6fa933d95f57062738a5153dec963a64a91d7b39b42d502d86046d00e2e6c48bcf4d7db9c6682ab69abfe7941fa3bc060fcc8f27

data/CHANGELOG.md

@@ -1,12 +1,19 @@
 # Changelog
 
-All notable changes to this project will be documented in this file.
+## [4.4.2](https://github.com/puppetlabs/beaker-puppet/tree/4.4.2) (2026-08-12)
 
-## [4.4.1](https://github.com/puppetlabs/beaker-puppet/tree/4.4.1) (2026-03-19)
+[Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/4.4.1...4.4.2)
+
+**Fixed bugs:**
+
+- \(PE-45697\) Fall back to the ssl check when PuppetDB's cleartext status port is unavailable [\#278](https://github.com/puppetlabs/beaker-puppet/pull/278) ([jonathannewman](https://github.com/jonathannewman))
+- \(maint\) Update GitHubSig to current GitHub RSA host key [\#277](https://github.com/puppetlabs/beaker-puppet/pull/277) ([Magisus](https://github.com/Magisus))
+
+## [4.4.1](https://github.com/puppetlabs/beaker-puppet/tree/4.4.1) (2026-03-20)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/4.4.0...4.4.1)
 
-**Merged pull requests:**
+**Fixed bugs:**
 
 - \(PA-8312\) Skip gem source add for Solaris & AIX [\#274](https://github.com/puppetlabs/beaker-puppet/pull/274) ([cthorn42](https://github.com/cthorn42))
 
@@ -14,10 +21,6 @@ All notable changes to this project will be documented in this file.
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/4.3.0...4.4.0)
 
-**Merged pull requests:**
-
-- beaker: Allow 7.x [\#272](https://github.com/puppetlabs/beaker-puppet/pull/272) ([bastelfreak](https://github.com/bastelfreak))
-
 ## [4.3.0](https://github.com/puppetlabs/beaker-puppet/tree/4.3.0) (2026-01-06)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/4.2.0...4.3.0)
@@ -31,10 +34,6 @@ All notable changes to this project will be documented in this file.
 
 - Drop inifile dependency [\#206](https://github.com/puppetlabs/beaker-puppet/issues/206)
 
-**Merged pull requests:**
-
--  \(maint\) Update tests [\#268](https://github.com/puppetlabs/beaker-puppet/pull/268) ([mhashizume](https://github.com/mhashizume))
-
 ## [4.2.0](https://github.com/puppetlabs/beaker-puppet/tree/4.2.0) (2025-01-17)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/4.1.1...4.2.0)
@@ -63,8 +62,6 @@ All notable changes to this project will be documented in this file.
 
 - Add support for Ubuntu 24.04 [\#257](https://github.com/puppetlabs/beaker-puppet/pull/257) ([joshcooper](https://github.com/joshcooper))
 
-**Merged pull requests:**
-
 ## [4.0.0](https://github.com/puppetlabs/beaker-puppet/tree/4.0.0) (2024-05-29)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/2.1.0...4.0.0)
@@ -74,6 +71,7 @@ All notable changes to this project will be documented in this file.
 - Add support for Beaker 6 [\#255](https://github.com/puppetlabs/beaker-puppet/pull/255) ([mhashizume](https://github.com/mhashizume))
 - Remove unsupported network platforms [\#254](https://github.com/puppetlabs/beaker-puppet/pull/254) ([mhashizume](https://github.com/mhashizume))
 
+## [2.1.0](https://github.com/puppetlabs/beaker-puppet/tree/2.1.0) (2024-03-19)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/3.0.1...2.1.0)
 
@@ -111,17 +109,6 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- Release prep [\#248](https://github.com/puppetlabs/beaker-puppet/pull/248) ([mhashizume](https://github.com/mhashizume))
-- Update excluded label to "maintenance" [\#247](https://github.com/puppetlabs/beaker-puppet/pull/247) ([mhashizume](https://github.com/mhashizume))
-- Add changelog generator configuration file [\#246](https://github.com/puppetlabs/beaker-puppet/pull/246) ([mhashizume](https://github.com/mhashizume))
-- Update release-prep script [\#245](https://github.com/puppetlabs/beaker-puppet/pull/245) ([mhashizume](https://github.com/mhashizume))
-- Update branch for github workflow testing [\#244](https://github.com/puppetlabs/beaker-puppet/pull/244) ([tvpartytonight](https://github.com/tvpartytonight))
-- Add release prep script [\#243](https://github.com/puppetlabs/beaker-puppet/pull/243) ([mhashizume](https://github.com/mhashizume))
-- Move to Puppet release GitHub Actions [\#242](https://github.com/puppetlabs/beaker-puppet/pull/242) ([mhashizume](https://github.com/mhashizume))
-- README: remove obsolete transfer notice, update badges [\#241](https://github.com/puppetlabs/beaker-puppet/pull/241) ([kenyon](https://github.com/kenyon))
-- Add Unicorn to CODEONWERS [\#235](https://github.com/puppetlabs/beaker-puppet/pull/235) ([cthorn42](https://github.com/cthorn42))
-- Update CODEOWNERS [\#234](https://github.com/puppetlabs/beaker-puppet/pull/234) ([cthorn42](https://github.com/cthorn42))
-- rubocop: Update to voxpupuli-rubocop 2.1.0 [\#230](https://github.com/puppetlabs/beaker-puppet/pull/230) ([bastelfreak](https://github.com/bastelfreak))
 - Bump actions/checkout from 3 to 4 [\#227](https://github.com/puppetlabs/beaker-puppet/pull/227) ([dependabot[bot]](https://github.com/apps/dependabot))
 - Update voxpupuli-rubocop requirement from ~\> 1.2 to ~\> 2.0 [\#226](https://github.com/puppetlabs/beaker-puppet/pull/226) ([dependabot[bot]](https://github.com/apps/dependabot))
 
@@ -146,14 +133,12 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- release 2.0.0 [\#224](https://github.com/puppetlabs/beaker-puppet/pull/224) ([bastelfreak](https://github.com/bastelfreak))
 - Update fakefs requirement from \>= 0.6, \< 2.0 to \>= 0.6, \< 3.0 [\#222](https://github.com/puppetlabs/beaker-puppet/pull/222) ([dependabot[bot]](https://github.com/apps/dependabot))
 - rubocop: fix layout cops [\#221](https://github.com/puppetlabs/beaker-puppet/pull/221) ([bastelfreak](https://github.com/bastelfreak))
 - rubocop: fix style violations [\#220](https://github.com/puppetlabs/beaker-puppet/pull/220) ([bastelfreak](https://github.com/bastelfreak))
 - CI: Build gems with strictness and verbosity & dependencies: Add version constraints [\#219](https://github.com/puppetlabs/beaker-puppet/pull/219) ([bastelfreak](https://github.com/bastelfreak))
 - CI: apply Vox Pupuli best practices [\#217](https://github.com/puppetlabs/beaker-puppet/pull/217) ([bastelfreak](https://github.com/bastelfreak))
 - Drop in-parallel dependency [\#214](https://github.com/puppetlabs/beaker-puppet/pull/214) ([ekohl](https://github.com/ekohl))
-- Update in-parallel requirement from ~\> 0.1 to \>= 0.1, \< 2.0 [\#213](https://github.com/puppetlabs/beaker-puppet/pull/213) ([dependabot[bot]](https://github.com/apps/dependabot))
 - Bump actions/checkout from 2 to 3 [\#211](https://github.com/puppetlabs/beaker-puppet/pull/211) ([dependabot[bot]](https://github.com/apps/dependabot))
 - tests: Always set the platform as a Beaker::Platform instance [\#209](https://github.com/puppetlabs/beaker-puppet/pull/209) ([ekohl](https://github.com/ekohl))
 - dependabot: check for github actions [\#208](https://github.com/puppetlabs/beaker-puppet/pull/208) ([bastelfreak](https://github.com/bastelfreak))
@@ -172,7 +157,6 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- Release 1.29.0 [\#203](https://github.com/puppetlabs/beaker-puppet/pull/203) ([yachub](https://github.com/yachub))
 - \(maint\) Uses RFC 5737 IP space in example [\#200](https://github.com/puppetlabs/beaker-puppet/pull/200) ([mhashizume](https://github.com/mhashizume))
 
 ## [1.28.0](https://github.com/puppetlabs/beaker-puppet/tree/1.28.0) (2022-09-08)
@@ -183,10 +167,6 @@ All notable changes to this project will be documented in this file.
 
 - \(PA-4552\) Create ci:test:setup step for iterative workflow [\#194](https://github.com/puppetlabs/beaker-puppet/pull/194) ([joshcooper](https://github.com/joshcooper))
 
-**Merged pull requests:**
-
-- Release 1.28.0 [\#201](https://github.com/puppetlabs/beaker-puppet/pull/201) ([joshcooper](https://github.com/joshcooper))
-
 ## [1.27.0](https://github.com/puppetlabs/beaker-puppet/tree/1.27.0) (2022-08-31)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/1.26.3...1.27.0)
@@ -221,7 +201,6 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- Release 1.26.2 [\#192](https://github.com/puppetlabs/beaker-puppet/pull/192) ([joshcooper](https://github.com/joshcooper))
 - \(PA-4178\) Only clear and add non-default gem sources [\#190](https://github.com/puppetlabs/beaker-puppet/pull/190) ([joshcooper](https://github.com/joshcooper))
 
 ## [1.26.1](https://github.com/puppetlabs/beaker-puppet/tree/1.26.1) (2022-03-24)
@@ -238,8 +217,6 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- Release 1.26.1 [\#189](https://github.com/puppetlabs/beaker-puppet/pull/189) ([mhashizume](https://github.com/mhashizume))
-- Release 1.26.0 [\#187](https://github.com/puppetlabs/beaker-puppet/pull/187) ([mhashizume](https://github.com/mhashizume))
 - \(PA-4332\) Changes download links to HTTPS [\#185](https://github.com/puppetlabs/beaker-puppet/pull/185) ([mhashizume](https://github.com/mhashizume))
 
 ## [1.26.0](https://github.com/puppetlabs/beaker-puppet/tree/1.26.0) (2022-03-23)
@@ -258,10 +235,6 @@ All notable changes to this project will be documented in this file.
 
 - \(PA-4331\) Fix the logic to only run on older solaris versions [\#183](https://github.com/puppetlabs/beaker-puppet/pull/183) ([cthorn42](https://github.com/cthorn42))
 
-**Merged pull requests:**
-
-- Release 1.25.0 [\#184](https://github.com/puppetlabs/beaker-puppet/pull/184) ([bastelfreak](https://github.com/bastelfreak))
-
 ## [1.24.0](https://github.com/puppetlabs/beaker-puppet/tree/1.24.0) (2022-03-04)
 
 [Full Changelog](https://github.com/puppetlabs/beaker-puppet/compare/1.23.0...1.24.0)
@@ -272,11 +245,9 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- Release 1.24.0 [\#181](https://github.com/puppetlabs/beaker-puppet/pull/181) ([bastelfreak](https://github.com/bastelfreak))
 - gemspec: fix typo in Apache-2.0 license [\#180](https://github.com/puppetlabs/beaker-puppet/pull/180) ([bastelfreak](https://github.com/bastelfreak))
 - Add Ruby 3.1 to CI [\#179](https://github.com/puppetlabs/beaker-puppet/pull/179) ([bastelfreak](https://github.com/bastelfreak))
 - Depend on Ruby 2.4 or newer in gemspec [\#178](https://github.com/puppetlabs/beaker-puppet/pull/178) ([bastelfreak](https://github.com/bastelfreak))
-- Release 1.23.0 [\#175](https://github.com/puppetlabs/beaker-puppet/pull/175) ([cthorn42](https://github.com/cthorn42))
 
 ## [1.23.0](https://github.com/puppetlabs/beaker-puppet/tree/1.23.0) (2022-02-23)
 
@@ -297,7 +268,6 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- Release 1.22.2 [\#171](https://github.com/puppetlabs/beaker-puppet/pull/171) ([bastelfreak](https://github.com/bastelfreak))
 - Fix install\_puppet\_on on el8 [\#170](https://github.com/puppetlabs/beaker-puppet/pull/170) ([gcampbell12](https://github.com/gcampbell12))
 
 ## [1.22.1](https://github.com/puppetlabs/beaker-puppet/tree/1.22.1) (2021-08-19)
@@ -306,7 +276,6 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- Prep for 1.22.1 release [\#169](https://github.com/puppetlabs/beaker-puppet/pull/169) ([tvpartytonight](https://github.com/tvpartytonight))
 - Revert "Use the built-in Resolv::IPv4::Regex" [\#168](https://github.com/puppetlabs/beaker-puppet/pull/168) ([kenyon](https://github.com/kenyon))
 
 ## [1.22.0](https://github.com/puppetlabs/beaker-puppet/tree/1.22.0) (2021-08-17)
@@ -320,10 +289,8 @@ All notable changes to this project will be documented in this file.
 
 **Merged pull requests:**
 
-- Regenerate v1.22 changelog [\#167](https://github.com/puppetlabs/beaker-puppet/pull/167) ([bastelfreak](https://github.com/bastelfreak))
 - Remove mentions of Beaker 3 [\#165](https://github.com/puppetlabs/beaker-puppet/pull/165) ([ekohl](https://github.com/ekohl))
 - Use the built-in Resolv::IPv4::Regex [\#164](https://github.com/puppetlabs/beaker-puppet/pull/164) ([ekohl](https://github.com/ekohl))
-- release 1.22.0 [\#163](https://github.com/puppetlabs/beaker-puppet/pull/163) ([bastelfreak](https://github.com/bastelfreak))
 - Implement codecov; update README.md [\#162](https://github.com/puppetlabs/beaker-puppet/pull/162) ([bastelfreak](https://github.com/bastelfreak))
 - Add both GPG keys when installing repos on SLES [\#157](https://github.com/puppetlabs/beaker-puppet/pull/157) ([GabrielNagy](https://github.com/GabrielNagy))
 
@@ -335,16 +302,10 @@ All notable changes to this project will be documented in this file.
 
 - Fix Arch Linux support [\#154](https://github.com/puppetlabs/beaker-puppet/pull/154) ([bastelfreak](https://github.com/bastelfreak))
 
-**Closed issues:**
-
-- Useless 'PATH' string prepended to PATH environment variable [\#151](https://github.com/puppetlabs/beaker-puppet/issues/151)
-
 **Merged pull requests:**
 
 - \(\#151\) Remove useless 'PATH' string from system PATH [\#152](https://github.com/puppetlabs/beaker-puppet/pull/152) ([silug](https://github.com/silug))
-- Release 1.21.0 with proper changelog [\#150](https://github.com/puppetlabs/beaker-puppet/pull/150) ([bastelfreak](https://github.com/bastelfreak))
 - \(maint\) replace use of deprecated method `get_puppet_collection` [\#149](https://github.com/puppetlabs/beaker-puppet/pull/149) ([ciprianbadescu](https://github.com/ciprianbadescu))
-- Convert workflow to Github Actions [\#148](https://github.com/puppetlabs/beaker-puppet/pull/148) ([ekohl](https://github.com/ekohl))
 - \(maint\) Make latest the latest stable instead of nightly [\#147](https://github.com/puppetlabs/beaker-puppet/pull/147) ([GabrielNagy](https://github.com/GabrielNagy))
 - \(maint\) Remove deprecated gem install flags [\#146](https://github.com/puppetlabs/beaker-puppet/pull/146) ([gimmyxd](https://github.com/gimmyxd))
 - \(maint\) redhat-8-arm64 builds access check [\#145](https://github.com/puppetlabs/beaker-puppet/pull/145) ([ciprianbadescu](https://github.com/ciprianbadescu))

data/lib/beaker-puppet/helpers/puppet_helpers.rb

@@ -662,11 +662,40 @@ module Beaker
             endpoint = 'status/v1/services/puppetdb-status'
             expected_regex = '\"state\" \{0,\}: \{0,\}\"running\"'
           end
-          retry_on(host,
-                   "curl -m 1 http://localhost:#{nonssl_port}/#{endpoint} | grep '#{expected_regex}'",
-                   { max_retries: 120 })
-          curl_with_retries('start puppetdb (ssl)',
-                            host, "https://#{host.node_name}:#{ssl_port}", [35, 60])
+          # The ssl status port is always enabled and is the check this method
+          # ultimately reports the result of, so use it as the primary
+          # liveness gate. Checking the nonssl port FIRST (as this method used
+          # to) meant every host with it disabled -- the default for fresh
+          # installs as of PE-45384/PE-44906 (SECVULN-1792) -- burned through
+          # 120 failed retries (~2 minutes, at retry_on's default 1s
+          # retry_interval) before ever reaching the check that actually
+          # matters (PE-45697).
+          result = curl_with_retries('start puppetdb (ssl)',
+                                     host, "https://#{host.node_name}:#{ssl_port}", [35, 60])
+
+          # Now that ssl liveness is already confirmed, the nonssl check is
+          # just a quick, best-effort secondary confirmation: a small retry
+          # budget is enough, and its absence -- by design, on a host with
+          # the cleartext listener disabled -- shouldn't fail this method.
+          nonssl_status_command = "curl -m 1 http://localhost:#{nonssl_port}/#{endpoint} | grep '#{expected_regex}'"
+          begin
+            retry_on(host, nonssl_status_command, { max_retries: 5 })
+          rescue RuntimeError => e
+            # Only treat this as the known "exhausted all retries" failure
+            # retry_on itself raises for THIS command (a plain RuntimeError
+            # with this exact templated message, see beaker's
+            # Beaker::DSL::Helpers::HostHelpers#retry_on) -- not any other
+            # RuntimeError, or a same-shaped error for a different command,
+            # that might surface from deeper in the retry loop (e.g. an
+            # SSH/connection error from the underlying on() call). Re-raise
+            # anything else unrecognized rather than silently reclassifying
+            # it below (PE-45697).
+            raise unless e.message == "Command `#{nonssl_status_command}` failed."
+
+            logger.warn("sleep_until_puppetdb_started: nonssl status check on port #{nonssl_port} did not succeed (#{e.message}), but ssl status check already confirmed puppetdb is running")
+          end
+
+          result
         end
 
         # Waits until a successful curl check has happened against puppetserver

data/lib/beaker-puppet/install_utils/foss_utils.rb

@@ -29,7 +29,7 @@ module Beaker
         GitURI = %r{^(git|https?|file)://|^git@|^gitmirror@}
 
         # Github's ssh signature for cloning via ssh
-        GitHubSig = 'github.com,207.97.227.239 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=='
+        GitHubSig = 'github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=' # rubocop:disable Layout/LineLength
 
         # Merge given options with our default options in a consistent way
         # This will remove any nil values so that we always have a set default.

data/lib/beaker-puppet/version.rb

@@ -1,3 +1,3 @@
 module BeakerPuppet
-  VERSION = '4.4.1'
+  VERSION = '4.4.2'
 end

data/spec/beaker-puppet/helpers/puppet_helpers_spec.rb

@@ -1034,35 +1034,80 @@ describe ClassMixedWithDSLHelpers do
       allow(subject).to receive(:version_is_less).and_return(true)
     end
 
-    it 'uses the default ports if none given' do
+    it 'uses the default ports if none given, checking ssl before nonssl' do
       host = hosts[0]
-      expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
       expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
+      expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
       subject.sleep_until_puppetdb_started(host)
     end
 
     it 'allows setting the nonssl_port' do
       host = hosts[0]
-      expect(subject).to receive(:retry_on).with(anything, /8084/, anything).once.ordered
       expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
+      expect(subject).to receive(:retry_on).with(anything, /8084/, anything).once.ordered
 
       subject.sleep_until_puppetdb_started(host, 8084)
     end
 
     it 'allows setting the ssl_port' do
       host = hosts[0]
-      expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
       expect(subject).to receive(:curl_with_retries).with(anything, anything, /8085/, anything).once.ordered
+      expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
 
       subject.sleep_until_puppetdb_started(host, nil, 8085)
     end
 
+    context 'when the cleartext status port never responds (e.g. disabled by default)' do
+      it 'swallows the failure once ssl liveness is already confirmed' do
+        host = hosts[0]
+        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
+        expect(subject).to receive(:retry_on).with(anything, anything, { max_retries: 5 }).once.ordered do |_host, command, _opts|
+          raise "Command `#{command}` failed."
+        end
+
+        expect { subject.sleep_until_puppetdb_started(host) }.not_to raise_error
+      end
+    end
+
+    context 'when the ssl check itself fails' do
+      it 'raises without ever attempting the nonssl check' do
+        host = hosts[0]
+        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once
+                                                      .and_raise('Command `curl -m 1 https://.../` failed.')
+        expect(subject).not_to receive(:retry_on)
+
+        expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/https/)
+      end
+    end
+
+    context 'when retry_on raises a RuntimeError unrelated to exhausted retries' do
+      it 'propagates the error rather than treating it as a disabled port' do
+        host = hosts[0]
+        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
+        expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
+                                             .and_raise('Host unreachable: no route to host')
+
+        expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/Host unreachable/)
+      end
+    end
+
+    context 'when retry_on raises a RuntimeError formatted like the templated failure but for a different command' do
+      it 'propagates the error rather than treating it as a disabled port' do
+        host = hosts[0]
+        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
+        expect(subject).to receive(:retry_on).with(anything, /8080/, anything).once.ordered
+                                             .and_raise('Command `some other command` failed.')
+
+        expect { subject.sleep_until_puppetdb_started(host) }.to raise_error(/some other command/)
+      end
+    end
+
     context 'when pe_ver is less than 2016.1.0' do
       it 'uses the version endpoint' do
         host = hosts[0]
         host['pe_ver'] = '2015.3.3'
-        expect(subject).to receive(:retry_on).with(anything, %r{pdb/meta/v1/version}, anything).once.ordered
         expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
+        expect(subject).to receive(:retry_on).with(anything, %r{pdb/meta/v1/version}, anything).once.ordered
 
         expect(subject).to receive(:version_is_less).with(host['pe_ver'], '2016.1.0').and_return(true)
         subject.sleep_until_puppetdb_started(host)
@@ -1073,9 +1118,9 @@ describe ClassMixedWithDSLHelpers do
       it 'uses the status endpoint' do
         host = hosts[0]
         host['pe_ver'] = '2016.1.0'
+        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
         expect(subject).to receive(:retry_on).with(anything, %r{status/v1/services/puppetdb-status},
                                                    anything).once.ordered
-        expect(subject).to receive(:curl_with_retries).with(anything, anything, /8081/, anything).once.ordered
 
         expect(subject).to receive(:version_is_less).with(host['pe_ver'], '2016.1.0').and_return(false)
         subject.sleep_until_puppetdb_started(host)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: beaker-puppet
 version: !ruby/object:Gem::Version
-  version: 4.4.1
+  version: 4.4.2
 platform: ruby
 authors:
 - Vox Pupuli
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-20 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fakefs