chef 11.4.4 → 11.6.0.hotfix.1

data/spec/support/shared/integration/knife_support.rb

@@ -0,0 +1,171 @@
+#
+# Author:: John Keiser (<jkeiser@opscode.com>)
+# Copyright:: Copyright (c) 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'chef/config'
+require 'chef/knife'
+require 'chef/application/knife'
+require 'logger'
+require 'chef/log'
+
+module KnifeSupport
+  DEBUG = ENV['DEBUG']
+  def knife(*args, &block)
+    # Allow knife('role from file roles/blah.json') rather than requiring the
+    # arguments to be split like knife('role', 'from', 'file', 'roles/blah.json')
+    # If any argument will have actual spaces in it, the long form is required.
+    # (Since knife commands always start with the command name, and command
+    # names with spaces are always multiple args, this is safe.)
+    if args.length == 1
+      args = args[0].split(/\s+/)
+    end
+
+    # Make output stable
+    Chef::Config[:concurrency] = 1
+
+    # Work on machines where we can't access /var
+    checksums_cache_dir = Dir.mktmpdir('checksums') do |checksums_cache_dir|
+      old_cache_options = Chef::Config[:cache_options]
+      Chef::Config[:cache_options] = {
+        :path => checksums_cache_dir,
+        :skip_expires => true
+      }
+
+      # This is Chef::Knife.run without load_commands--we'll load stuff
+      # ourselves, thank you very much
+      stdout = StringIO.new
+      stderr = StringIO.new
+      old_loggers = Chef::Log.loggers
+      old_log_level = Chef::Log.level
+      begin
+        puts "knife: #{args.join(' ')}" if DEBUG
+        subcommand_class = Chef::Knife.subcommand_class_from(args)
+        subcommand_class.options = Chef::Application::Knife.options.merge(subcommand_class.options)
+        subcommand_class.load_deps
+        instance = subcommand_class.new(args)
+
+        # Capture stdout/stderr
+        instance.ui = Chef::Knife::UI.new(stdout, stderr, STDIN, {})
+
+        # Don't print stuff
+        Chef::Config[:verbosity] = ( DEBUG ? 2 : 0 )
+        instance.config[:config_file] = File.join(CHEF_SPEC_DATA, "null_config.rb")
+
+
+        # Configure chef with a (mostly) blank knife.rb
+        # We set a global and then mutate it in our stub knife.rb so we can be
+        # extra sure that we're not loading someone's real knife.rb and then
+        # running test scenarios against a real chef server. If things don't
+        # smell right, abort.
+
+        $__KNIFE_INTEGRATION_FAILSAFE_CHECK = "ole"
+        instance.configure_chef
+
+        unless $__KNIFE_INTEGRATION_FAILSAFE_CHECK == "ole ole"
+          raise Exception, "Potential misconfiguration of integration tests detected. Aborting test."
+        end
+
+        logger = Logger.new(stderr)
+        logger.formatter = proc { |severity, datetime, progname, msg| "#{severity}: #{msg}\n" }
+        Chef::Log.use_log_devices([logger])
+        Chef::Log.level = ( DEBUG ? :debug : :warn )
+        Chef::Log::Formatter.show_time = false
+
+        instance.run
+
+        exit_code = 0
+
+      # This is how rspec catches exit()
+      rescue SystemExit => e
+        exit_code = e.status
+      ensure
+        Chef::Log.use_log_devices(old_loggers)
+        Chef::Log.level = old_log_level
+        Chef::Config[:cache_options] = old_cache_options
+      end
+
+      KnifeResult.new(stdout.string, stderr.string, exit_code)
+    end
+  end
+
+  private
+
+  class KnifeResult
+    def initialize(stdout, stderr, exit_code)
+      @stdout = stdout
+      @stderr = stderr
+      @exit_code = exit_code
+    end
+
+    attr_reader :stdout
+    attr_reader :stderr
+    attr_reader :exit_code
+
+    def should_fail(*args)
+      expected = {}
+      args.each do |arg|
+        if arg.is_a?(Hash)
+          expected.merge!(arg)
+        elsif arg.is_a?(Integer)
+          expected[:exit_code] = arg
+        else
+          expected[:stderr] = arg
+        end
+      end
+      expected[:exit_code] = 1 if !expected[:exit_code]
+      should_result_in(expected)
+    end
+
+    def should_succeed(*args)
+      expected = {}
+      args.each do |arg|
+        if arg.is_a?(Hash)
+          expected.merge!(arg)
+        else
+          expected[:stdout] = arg
+        end
+      end
+      should_result_in(expected)
+    end
+
+    private
+
+    def should_result_in(expected)
+      expected[:stdout] = '' if !expected[:stdout]
+      expected[:stderr] = '' if !expected[:stderr]
+      expected[:exit_code] = 0 if !expected[:exit_code]
+      # TODO make this go away
+      stderr_actual = @stderr.sub(/^WARNING: No knife configuration file found\n/, '')
+
+      if expected[:stderr].is_a?(Regexp)
+        stderr_actual.should =~ expected[:stderr]
+      else
+        stderr_actual.should == expected[:stderr]
+      end
+      stdout_actual = @stdout
+      if Chef::Platform.windows?
+        stderr_actual = stderr_actual.gsub("\r\n", "\n")
+        stdout_actual = stdout_actual.gsub("\r\n", "\n")
+      end
+      @exit_code.should == expected[:exit_code]
+      if expected[:stdout].is_a?(Regexp)
+        stdout_actual.should =~ expected[:stdout]
+      else
+        stdout_actual.should == expected[:stdout]
+      end
+    end
+  end
+end

data/spec/support/shared/unit/execute_resource.rb

@@ -0,0 +1,125 @@
+#
+# Author:: Adam Jacob (<adam@opscode.com>)
+# Author:: Tyler Cloke (<tyler@opscode.com>)
+# Copyright:: Copyright (c) 2008 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'spec_helper'
+
+shared_examples_for "an execute resource" do
+
+  before(:each) do
+    @resource = execute_resource
+  end
+
+  it "should create a new Chef::Resource::Execute" do
+    @resource.should be_a_kind_of(Chef::Resource)
+    @resource.should be_a_kind_of(Chef::Resource::Execute)
+  end
+
+  it "should set the command to the first argument to new" do
+    @resource.command.should eql(resource_instance_name)
+  end
+
+  it "should accept an array on instantiation, too" do
+    resource = Chef::Resource::Execute.new(%w{something else})
+    resource.should be_a_kind_of(Chef::Resource)
+    resource.should be_a_kind_of(Chef::Resource::Execute)
+    resource.command.should eql(%w{something else})
+  end
+
+  it "should accept a string for the command to run" do
+    @resource.command "something"
+    @resource.command.should eql("something")
+  end
+
+  it "should accept an array for the command to run" do
+    @resource.command %w{something else}
+    @resource.command.should eql(%w{something else})
+  end
+
+  it "should accept a string for the cwd" do
+    @resource.cwd "something"
+    @resource.cwd.should eql("something")
+  end
+
+  it "should accept a hash for the environment" do
+    test_hash = { :one => :two }
+    @resource.environment(test_hash)
+    @resource.environment.should eql(test_hash)
+  end
+
+  it "allows the environment to be specified with #env" do
+    @resource.should respond_to(:env)
+  end
+
+  it "should accept a string for the group" do
+    @resource.group "something"
+    @resource.group.should eql("something")
+  end
+
+  it "should accept an integer for the group" do
+    @resource.group 1
+    @resource.group.should eql(1)
+  end
+
+  it "should accept an array for the execution path" do
+    @resource.path ["woot"]
+    @resource.path.should eql(["woot"])
+  end
+
+  it "should accept an integer for the return code" do
+    @resource.returns 1
+    @resource.returns.should eql(1)
+  end
+
+  it "should accept an integer for the timeout" do
+    @resource.timeout 1
+    @resource.timeout.should eql(1)
+  end
+
+  it "should accept a string for the user" do
+    @resource.user "something"
+    @resource.user.should eql("something")
+  end
+
+  it "should accept an integer for the user" do
+    @resource.user 1
+    @resource.user.should eql(1)
+  end
+
+  it "should accept a string for creates" do
+    @resource.creates "something"
+    @resource.creates.should eql("something")
+  end
+
+  describe "when it has cwd, environment, group, path, return value, and a user" do
+    before do
+      @resource.command("grep")
+      @resource.cwd("/tmp/")
+      @resource.environment({ :one => :two })
+      @resource.group("legos")
+      @resource.path(["/var/local/"])
+      @resource.returns(1)
+      @resource.user("root")
+    end
+
+    it "returns the command as its identity" do
+      @resource.identity.should == "grep"
+    end
+  end
+end
+

data/spec/support/shared/unit/file_system_support.rb

@@ -17,56 +17,16 @@
 #
 
 require 'chef/chef_fs/file_system'
-require 'chef/chef_fs/file_system/base_fs_dir'
-require 'chef/chef_fs/file_system/base_fs_object'
+require 'chef/chef_fs/file_system/memory_root'
+require 'chef/chef_fs/file_system/memory_dir'
+require 'chef/chef_fs/file_system/memory_file'
 
 module FileSystemSupport
-  class MemoryFile < Chef::ChefFS::FileSystem::BaseFSObject
-    def initialize(name, parent, value)
-      super(name, parent)
-      @value = value
-    end
-    def read
-      return @value
-    end
-  end
-
-  class MemoryDir < Chef::ChefFS::FileSystem::BaseFSDir
-    def initialize(name, parent)
-      super(name, parent)
-      @children = []
-    end
-    attr_reader :children
-    def child(name)
-      @children.select { |child| child.name == name }.first || Chef::ChefFS::FileSystem::NonexistentFSObject.new(name, self)
-    end
-    def add_child(child)
-      @children.push(child)
-    end
-    def can_have_child?(name, is_dir)
-      root.cannot_be_in_regex ? (name !~ root.cannot_be_in_regex) : true
-    end
-  end
-
-  class MemoryRoot < MemoryDir
-    def initialize(pretty_name, cannot_be_in_regex = nil)
-      super('', nil)
-      @pretty_name = pretty_name
-      @cannot_be_in_regex = cannot_be_in_regex
-    end
-
-    attr_reader :cannot_be_in_regex
-
-    def path_for_printing
-      @pretty_name
-    end
-  end
-
   def memory_fs(pretty_name, value, cannot_be_in_regex = nil)
     if !value.is_a?(Hash)
       raise "memory_fs() must take a Hash"
     end
-    dir = MemoryRoot.new(pretty_name, cannot_be_in_regex)
+    dir = Chef::ChefFS::FileSystem::MemoryRoot.new(pretty_name, cannot_be_in_regex)
     value.each do |key, child|
       dir.add_child(memory_fs_value(child, key.to_s, dir))
     end
@@ -75,13 +35,13 @@ module FileSystemSupport
 
   def memory_fs_value(value, name = '', parent = nil)
     if value.is_a?(Hash)
-      dir = MemoryDir.new(name, parent)
+      dir = Chef::ChefFS::FileSystem::MemoryDir.new(name, parent)
       value.each do |key, child|
         dir.add_child(memory_fs_value(child, key.to_s, dir))
       end
       dir
     else
-      MemoryFile.new(name, parent, value || "#{name}\n")
+      Chef::ChefFS::FileSystem::MemoryFile.new(name, parent, value || "#{name}\n")
     end
   end
 
@@ -94,7 +54,7 @@ module FileSystemSupport
   end
 
   def no_blocking_calls_allowed
-    [ MemoryFile, MemoryDir ].each do |c|
+    [ Chef::ChefFS::FileSystem::MemoryFile, Chef::ChefFS::FileSystem::MemoryDir ].each do |c|
       [ :children, :exists?, :read ].each do |m|
         c.any_instance.stub(m).and_raise("#{m.to_s} should not be called")
       end
@@ -103,7 +63,7 @@ module FileSystemSupport
 
   def list_should_yield_paths(fs, pattern_str, *expected_paths)
     result_paths = []
-    Chef::ChefFS::FileSystem.list(fs, pattern(pattern_str)) { |result| result_paths << result.path }
+    Chef::ChefFS::FileSystem.list(fs, pattern(pattern_str)).each { |result| result_paths << result.path }
     result_paths.should =~ expected_paths
   end
 end

data/spec/support/shared/unit/provider/file.rb

@@ -0,0 +1,609 @@
+#
+# Author:: Lamont Granquist (<lamont@opscode.com>)
+# Copyright:: Copyright (c) 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'spec_helper'
+require 'tmpdir'
+if windows?
+  require 'chef/win32/file'
+end
+
+# Filesystem stubs
+def file_symlink_class
+  if windows?
+    Chef::ReservedNames::Win32::File
+  else
+    File
+  end
+end
+
+def normalized_path
+  File.expand_path(resource_path)
+end
+
+def setup_normal_file
+  File.stub!(:exists?).with(resource_path).and_return(true)
+  File.stub!(:directory?).with(resource_path).and_return(false)
+  File.stub!(:directory?).with(enclosing_directory).and_return(true)
+  File.stub!(:writable?).with(resource_path).and_return(true)
+  file_symlink_class.stub!(:symlink?).with(resource_path).and_return(false)
+  file_symlink_class.stub!(:symlink?).with(normalized_path).and_return(false)
+end
+
+def setup_missing_file
+  File.stub!(:exists?).with(resource_path).and_return(false)
+  File.stub!(:directory?).with(resource_path).and_return(false)
+  File.stub!(:directory?).with(enclosing_directory).and_return(true)
+  File.stub!(:writable?).with(resource_path).and_return(false)
+  file_symlink_class.stub!(:symlink?).with(resource_path).and_return(false)
+end
+
+def setup_symlink
+  File.stub!(:exists?).with(resource_path).and_return(true)
+  File.stub!(:directory?).with(normalized_path).and_return(false)
+  File.stub!(:directory?).with(enclosing_directory).and_return(true)
+  File.stub!(:writable?).with(resource_path).and_return(true)
+  file_symlink_class.stub!(:symlink?).with(resource_path).and_return(true)
+  file_symlink_class.stub!(:symlink?).with(normalized_path).and_return(true)
+end
+
+def setup_unwritable_file
+  File.stub!(:exists?).with(resource_path).and_return(true)
+  File.stub!(:directory?).with(resource_path).and_return(false)
+  File.stub!(:directory?).with(enclosing_directory).and_return(true)
+  File.stub!(:writable?).with(resource_path).and_return(false)
+  file_symlink_class.stub!(:symlink?).with(resource_path).and_return(false)
+end
+
+def setup_missing_enclosing_directory
+  File.stub!(:exists?).with(resource_path).and_return(false)
+  File.stub!(:directory?).with(resource_path).and_return(false)
+  File.stub!(:directory?).with(enclosing_directory).and_return(false)
+  File.stub!(:writable?).with(resource_path).and_return(false)
+  file_symlink_class.stub!(:symlink?).with(resource_path).and_return(false)
+end
+
+shared_examples_for Chef::Provider::File do
+
+  it "should return a #{described_class}" do
+    provider.should be_a_kind_of(described_class)
+  end
+
+  it "should store the resource passed to new as new_resource" do
+    provider.new_resource.should eql(resource)
+  end
+
+  it "should store the node passed to new as node" do
+    provider.node.should eql(node)
+  end
+
+  context "when loading the current resource" do
+
+    context "when running load_current_resource and the file exists" do
+      before do
+        setup_normal_file
+        provider.load_current_resource
+      end
+
+      it "should load a current resource based on the one specified at construction" do
+        provider.current_resource.should be_a_kind_of(Chef::Resource::File)
+      end
+
+      it "the loaded current_resource name should be the same as the resource name" do
+        provider.current_resource.name.should eql(resource.name)
+      end
+
+      it "the loaded current_resource path should be the same as the resoure path" do
+        provider.current_resource.path.should eql(resource.path)
+      end
+
+      it "the loaded current_resource content should be nil" do
+        provider.current_resource.content.should eql(nil)
+      end
+    end
+
+    context "when running load_current_resource and the file does not exist" do
+      before do
+        setup_missing_file
+        provider.load_current_resource
+      end
+
+      it "the current_resource should be a Chef::Resource::File" do
+        provider.current_resource.should be_a_kind_of(Chef::Resource::File)
+      end
+
+      it "the current_resource name should be the same as the resource name" do
+        provider.current_resource.name.should eql(resource.name)
+      end
+
+      it "the current_resource path should be the same as the resource path" do
+        provider.current_resource.path.should eql(resource.path)
+      end
+
+      it "the loaded current_resource content should be nil" do
+        provider.current_resource.content.should eql(nil)
+      end
+    end
+
+    context "examining file security metadata on Unix with a file that exists" do
+      before do
+        # fake that we're on unix even if we're on windows
+        Chef::Platform.stub!(:windows?).and_return(false)
+        # mock up the filesystem to behave like unix
+        setup_normal_file
+        stat_struct = mock("::File.stat", :mode => 0600, :uid => 0, :gid => 0, :mtime => 10000)
+        resource_real_path = File.realpath(resource.path)
+        File.should_receive(:stat).with(resource_real_path).at_least(:once).and_return(stat_struct)
+        Etc.stub!(:getgrgid).with(0).and_return(mock("Group Ent", :name => "wheel"))
+        Etc.stub!(:getpwuid).with(0).and_return(mock("User Ent", :name => "root"))
+      end
+
+      context "when the new_resource does not specify any state" do
+        before do
+          provider.load_current_resource
+        end
+
+        it "should load the permissions into the current_resource" do
+          provider.current_resource.mode.should == "0600"
+          provider.current_resource.owner.should == "root"
+          provider.current_resource.group.should == "wheel"
+        end
+
+        it "should not set the new_resource permissions" do
+          provider.new_resource.group.should be_nil
+          provider.new_resource.owner.should be_nil
+          provider.new_resource.mode.should be_nil
+        end
+      end
+
+      context "when the new_resource explicitly specifies resource state as numbers" do
+        before do
+          resource.owner(1)
+          resource.group(1)
+          resource.mode(0644)
+          provider.load_current_resource
+        end
+
+        it "should load the permissions into the current_resource as numbers" do
+          # Mode is always loaded as string for reporting purposes.
+          provider.current_resource.mode.should == "0600"
+          provider.current_resource.owner.should == 0
+          provider.current_resource.group.should == 0
+        end
+
+        it "should not set the new_resource permissions" do
+          provider.new_resource.group.should == 1
+          provider.new_resource.owner.should == 1
+          provider.new_resource.mode.should == 0644
+        end
+      end
+
+      context "when the new_resource explicitly specifies resource state as symbols" do
+        before do
+          resource.owner("macklemore")
+          resource.group("seattlehiphop")
+          resource.mode("0321")
+          provider.load_current_resource
+        end
+
+        it "should load the permissions into the current_resource as symbols" do
+          provider.current_resource.mode.should == "0600"
+          provider.current_resource.owner.should == "root"
+          provider.current_resource.group.should == "wheel"
+        end
+
+        it "should not set the new_resource permissions" do
+          provider.new_resource.group.should == "seattlehiphop"
+          provider.new_resource.owner.should == "macklemore"
+          provider.new_resource.mode.should == "0321"
+        end
+      end
+
+    end
+
+    context "examining file security metadata on Unix with a file that does not exist" do
+      before do
+        # fake that we're on unix even if we're on windows
+        Chef::Platform.stub!(:windows?).and_return(false)
+        setup_missing_file
+      end
+
+      context "when the new_resource does not specify any state" do
+        before do
+          provider.load_current_resource
+        end
+
+        it "the current_resource permissions should be nil" do
+          provider.current_resource.mode.should be_nil
+          provider.current_resource.owner.should be_nil
+          provider.current_resource.group.should be_nil
+        end
+
+        it "should not set the new_resource permissions" do
+          provider.new_resource.group.should be_nil
+          provider.new_resource.owner.should be_nil
+          provider.new_resource.mode.should be_nil
+        end
+      end
+
+      context "when the new_resource explicitly specifies resource state" do
+        before do
+          resource.owner(63945)
+          resource.group(51948)
+          resource.mode(0123)
+          provider.load_current_resource
+        end
+
+        it "the current_resource permissions should be nil" do
+          provider.current_resource.mode.should be_nil
+          provider.current_resource.owner.should be_nil
+          provider.current_resource.group.should be_nil
+        end
+
+        it "should not set the new_resource permissions" do
+          provider.new_resource.group.should == 51948
+          provider.new_resource.owner.should == 63945
+          provider.new_resource.mode.should == 0123
+        end
+      end
+    end
+  end
+
+  context "when loading the new_resource after the run" do
+
+    before do
+      # fake that we're on unix even if we're on windows
+      Chef::Platform.stub!(:windows?).and_return(false)
+      # mock up the filesystem to behave like unix
+      setup_normal_file
+      stat_struct = mock("::File.stat", :mode => 0600, :uid => 0, :gid => 0, :mtime => 10000)
+      resource_real_path = File.realpath(resource.path)
+      File.stub!(:stat).with(resource_real_path).and_return(stat_struct)
+      Etc.stub!(:getgrgid).with(0).and_return(mock("Group Ent", :name => "wheel"))
+      Etc.stub!(:getpwuid).with(0).and_return(mock("User Ent", :name => "root"))
+      provider.send(:load_resource_attributes_from_file, resource)
+    end
+
+    it "new_resource should record the new permission information" do
+      provider.new_resource.group.should == "wheel"
+      provider.new_resource.owner.should == "root"
+      provider.new_resource.mode.should == "0600"
+    end
+  end
+
+  context "when reporting security metadata on windows" do
+    it "records the file owner" do
+      pending
+    end
+
+    it "records rights for each user in the ACL" do
+      pending
+    end
+
+    it "records deny_rights for each user in the ACL" do
+      pending
+    end
+  end
+
+  context "define_resource_requirements" do
+    context "when the enclosing directory does not exist" do
+      before { setup_missing_enclosing_directory }
+
+      [:create, :create_if_missing, :touch].each do |action|
+        context "action #{action}" do
+          it "raises EnclosingDirectoryDoesNotExist" do
+            lambda {provider.run_action(action)}.should raise_error(Chef::Exceptions::EnclosingDirectoryDoesNotExist)
+          end
+
+          it "does not raise an exception in why-run mode" do
+            Chef::Config[:why_run] = true
+            lambda {provider.run_action(action)}.should_not raise_error(Chef::Exceptions::EnclosingDirectoryDoesNotExist)
+            Chef::Config[:why_run] = false
+          end
+        end
+      end
+    end
+
+    context "when the file exists but is not deletable" do
+      before { setup_unwritable_file }
+
+      it "action delete raises InsufficientPermissions" do
+        lambda {provider.run_action(:delete)}.should raise_error(Chef::Exceptions::InsufficientPermissions)
+      end
+
+      it "action delete also raises InsufficientPermissions in why-run mode" do
+        Chef::Config[:why_run] = true
+        lambda {provider.run_action(:delete)}.should raise_error(Chef::Exceptions::InsufficientPermissions)
+        Chef::Config[:why_run] = false
+      end
+    end
+  end
+
+  context "action create" do
+    it "should create the file, update its contents and then set the acls on the file"  do
+      setup_missing_file
+      provider.should_receive(:do_create_file)
+      provider.should_receive(:do_contents_changes)
+      provider.should_receive(:do_acl_changes)
+      provider.should_receive(:load_resource_attributes_from_file)
+      provider.run_action(:create)
+    end
+
+    context "do_create_file" do
+      context "when the file exists" do
+        before { setup_normal_file }
+        it "should not create the file" do
+          provider.deployment_strategy.should_not_receive(:create).with(resource_path)
+          provider.send(:do_create_file)
+          provider.send(:file_created?).should == false
+        end
+      end
+      context "when the file does not exist" do
+        before { setup_missing_file }
+        it "should create the file" do
+          provider.deployment_strategy.should_receive(:create).with(resource_path)
+          provider.send(:do_create_file)
+          provider.send(:file_created?).should == true
+        end
+      end
+    end
+
+    context "do_contents_changes" do
+      context "when there is content to deploy" do
+        before do
+          setup_normal_file
+          provider.load_current_resource
+          tempfile = double('Tempfile', :path => "/tmp/foo-bar-baz")
+          content.stub!(:tempfile).and_return(tempfile)
+          File.should_receive(:exists?).with("/tmp/foo-bar-baz").and_return(true)
+          tempfile.should_receive(:unlink).once
+        end
+
+        context "when the contents have changed" do
+          let(:tempfile_path) { "/tmp/foo-bar-baz" }
+          let(:tempfile_sha256) { "42971f0ddce0cb20cf7660a123ffa1a1543beb2f1e7cd9d65858764a27f3201d" }
+          let(:diff_for_reporting) { "+++\n---\n+foo\n-bar\n" }
+          before do
+            provider.stub!(:contents_changed?).and_return(true)
+            diff = double('Diff', :for_output => ['+++','---','+foo','-bar'],
+                                  :for_reporting => diff_for_reporting )
+            diff.stub!(:diff).with(resource_path, tempfile_path).and_return(true)
+            provider.should_receive(:diff).at_least(:once).and_return(diff)
+            provider.should_receive(:checksum).with(tempfile_path).and_return(tempfile_sha256)
+            provider.should_receive(:checksum).with(resource_path).and_return(tempfile_sha256)
+            provider.deployment_strategy.should_receive(:deploy).with(tempfile_path, normalized_path)
+          end
+          context "when the file was created" do
+            before { provider.should_receive(:file_created?).at_least(:once).and_return(true) }
+            it "does not backup the file and does not produce a diff for reporting" do
+              provider.should_not_receive(:do_backup)
+              provider.send(:do_contents_changes)
+              resource.diff.should be_nil
+            end
+          end
+          context "when the file was not created" do
+            before { provider.should_receive(:file_created?).at_least(:once).and_return(false) }
+            it "backs up the file and produces a diff for reporting" do
+              provider.should_receive(:do_backup)
+              provider.send(:do_contents_changes)
+              resource.diff.should == diff_for_reporting
+            end
+          end
+        end
+
+        it "does nothing when the contents have not changed"  do
+          provider.stub!(:contents_changed?).and_return(false)
+          provider.should_not_receive(:diff)
+          provider.send(:do_contents_changes)
+        end
+      end
+
+      it "does nothing when there is no content to deploy (tempfile returned from contents is nil)" do
+        provider.send(:content).should_receive(:tempfile).at_least(:once).and_return(nil)
+        provider.should_not_receive(:diff)
+        lambda{ provider.send(:do_contents_changes) }.should_not raise_error
+      end
+
+      it "raises an exception when the content object returns a tempfile with a nil path" do
+        tempfile = double('Tempfile', :path => nil)
+        provider.send(:content).should_receive(:tempfile).at_least(:once).and_return(tempfile)
+        lambda{ provider.send(:do_contents_changes) }.should raise_error
+      end
+
+      it "raises an exception when the content object returns a tempfile that does not exist" do
+        tempfile = double('Tempfile', :path => "/tmp/foo-bar-baz")
+        provider.send(:content).should_receive(:tempfile).at_least(:once).and_return(tempfile)
+        File.should_receive(:exists?).with("/tmp/foo-bar-baz").and_return(false)
+        lambda{ provider.send(:do_contents_changes) }.should raise_error
+      end
+    end
+
+    context "do_acl_changes" do
+      it "needs tests" do
+        pending
+      end
+    end
+
+    context "do_selinux" do
+      context "when resource is updated" do
+        before do
+          setup_normal_file
+          provider.load_current_resource
+          provider.stub!(:resource_updated?).and_return(true)
+        end
+
+        it "should check for selinux_enabled? by default" do
+          provider.should_receive(:selinux_enabled?)
+          provider.send(:do_selinux)
+        end
+
+        context "when selinux fixup is enabled in the config" do
+          before do
+            @original_selinux_fixup = Chef::Config[:enable_selinux_file_permission_fixup]
+            Chef::Config[:enable_selinux_file_permission_fixup] = true
+          end
+
+          after do
+            Chef::Config[:enable_selinux_file_permission_fixup] = @original_selinux_fixup
+          end
+
+          context "when selinux is enabled on the system" do
+            before do
+              provider.should_receive(:selinux_enabled?).and_return(true)
+            end
+
+            it "restores security context on the file" do
+              provider.should_receive(:restore_security_context).with(normalized_path, false)
+              provider.send(:do_selinux)
+            end
+
+            it "restores security context recursively when told so" do
+              provider.should_receive(:restore_security_context).with(normalized_path, true)
+              provider.send(:do_selinux, true)
+            end
+          end
+
+          context "when selinux is disabled on the system" do
+            before do
+              provider.should_receive(:selinux_enabled?).and_return(false)
+            end
+
+            it "should not restore security context" do
+              provider.should_not_receive(:restore_security_context)
+              provider.send(:do_selinux)
+            end
+          end
+        end
+
+        context "when selinux fixup is disabled in the config" do
+          before do
+            @original_selinux_fixup = Chef::Config[:enable_selinux_file_permission_fixup]
+            Chef::Config[:enable_selinux_file_permission_fixup] = false
+          end
+
+          after do
+            Chef::Config[:enable_selinux_file_permission_fixup] = @original_selinux_fixup
+          end
+
+          it "should not check for selinux_enabled?" do
+            provider.should_not_receive(:selinux_enabled?)
+            provider.send(:do_selinux)
+          end
+        end
+      end
+
+      context "when resource is not updated" do
+        before do
+          provider.stub!(:resource_updated?).and_return(false)
+        end
+
+        it "should not check for selinux_enabled?" do
+          provider.should_not_receive(:selinux_enabled?)
+          provider.send(:do_selinux)
+        end
+      end
+    end
+
+  end
+
+  context "action delete" do
+    context "when the file exists" do
+      context "when the file is writable" do
+        context "when the file is not a symlink" do
+          before { setup_normal_file }
+          it "should backup and delete the file and be updated by the last action" do
+            provider.should_receive(:do_backup).at_least(:once).and_return(true)
+            File.should_receive(:delete).with(resource_path).and_return(true)
+            provider.run_action(:delete)
+            resource.should be_updated_by_last_action
+          end
+        end
+        context "when the file is a symlink" do
+          before { setup_symlink }
+          it "should not backup the symlink" do
+            provider.should_not_receive(:do_backup)
+            File.should_receive(:delete).with(resource_path).and_return(true)
+            provider.run_action(:delete)
+            resource.should be_updated_by_last_action
+          end
+        end
+      end
+      context "when the file is not writable" do
+        before { setup_unwritable_file }
+        it "should not try to backup or delete the file, and should not be updated by last action" do
+          provider.should_not_receive(:do_backup)
+          File.should_not_receive(:delete)
+          lambda { provider.run_action(:delete) }.should raise_error()
+          resource.should_not be_updated_by_last_action
+        end
+      end
+    end
+
+    context "when the file does not exist" do
+      before { setup_missing_file }
+
+      it "should not try to backup or delete the file, and should not be updated by last action" do
+        provider.should_not_receive(:do_backup)
+        File.should_not_receive(:delete)
+        lambda { provider.run_action(:delete) }.should_not raise_error()
+        resource.should_not be_updated_by_last_action
+      end
+    end
+  end
+
+  context "action touch" do
+    context "when the file does not exist" do
+      before { setup_missing_file }
+      it "should update the atime/mtime on action_touch" do
+        File.should_receive(:utime).once
+        provider.should_receive(:action_create)
+        provider.run_action(:touch)
+        resource.should be_updated_by_last_action
+      end
+    end
+    context "when the file exists" do
+      before { setup_normal_file }
+      it "should update the atime/mtime on action_touch" do
+        File.should_receive(:utime).once
+        provider.should_receive(:action_create)
+        provider.run_action(:touch)
+        resource.should be_updated_by_last_action
+      end
+    end
+  end
+
+  context "action create_if_missing" do
+    context "when the file does not exist" do
+      before { setup_missing_file }
+      it "should call action_create" do
+        provider.should_receive(:action_create)
+        provider.run_action(:create_if_missing)
+      end
+    end
+
+    context "when the file exists" do
+      before { setup_normal_file }
+      it "should not call action_create" do
+        provider.should_not_receive(:action_create)
+        provider.run_action(:create_if_missing)
+      end
+    end
+
+  end
+
+end
+