openvox 8.19.0

data/lib/puppet/ssl/verifier.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl'
+
+# Verify an SSL connection.
+#
+# @api private
+class Puppet::SSL::Verifier
+  FIVE_MINUTES_AS_SECONDS = 5 * 60
+
+  attr_reader :ssl_context
+
+  # Create a verifier using an `ssl_context`.
+  #
+  # @param hostname [String] FQDN of the server we're attempting to connect to
+  # @param ssl_context [Puppet::SSL::SSLContext] ssl_context containing CA certs,
+  #   CRLs, etc needed to verify the server's certificate chain
+  # @api private
+  def initialize(hostname, ssl_context)
+    @hostname = hostname
+    @ssl_context = ssl_context
+  end
+
+  # Return true if `self` is reusable with `verifier` meaning they
+  # are using the same `ssl_context`, so there's no loss of security
+  # when using a cached connection.
+  #
+  # @param verifier [Puppet::SSL::Verifier] the verifier to compare against
+  # @return [Boolean] return true if a cached connection can be used, false otherwise
+  # @api private
+  def reusable?(verifier)
+    verifier.instance_of?(self.class) &&
+      verifier.ssl_context.equal?(@ssl_context) # same object?
+  end
+
+  # Configure the `http` connection based on the current `ssl_context`.
+  #
+  # @param http [Net::HTTP] connection
+  # @api private
+  def setup_connection(http)
+    http.cert_store = @ssl_context[:store]
+    http.cert = @ssl_context[:client_cert]
+    http.key = @ssl_context[:private_key]
+    # default to VERIFY_PEER
+    http.verify_mode = if !@ssl_context[:verify_peer]
+                         OpenSSL::SSL::VERIFY_NONE
+                       else
+                         OpenSSL::SSL::VERIFY_PEER
+                       end
+    http.verify_callback = self
+  end
+
+  # This method is called if `Net::HTTP#start` raises an exception, which
+  # could be a result of an openssl error during cert verification, due
+  # to ruby's `Socket#post_connection_check`, or general SSL connection
+  # error.
+  #
+  # @param http [Net::HTTP] connection
+  # @param error [OpenSSL::SSL::SSLError] connection error
+  # @raise [Puppet::SSL::CertVerifyError] SSL connection failed due to a
+  #   verification error with the server's certificate or chain
+  # @raise [Puppet::Error] server hostname does not match certificate
+  # @raise [OpenSSL::SSL::SSLError] low-level SSL connection failure
+  # @api private
+  def handle_connection_error(http, error)
+    raise @last_error if @last_error
+
+    # ruby can pass SSL validation but fail post_connection_check
+    peer_cert = http.peer_cert
+    if peer_cert && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
+      raise Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+    else
+      raise error
+    end
+  end
+
+  # OpenSSL will call this method with the verification result for each cert in
+  # the server's chain, working from the root CA to the server's cert. If
+  # preverify_ok is `true`, then that cert passed verification. If it's `false`
+  # then the current verification error is contained in `store_context.error`.
+  # and the current cert is in `store_context.current_cert`.
+  #
+  # If this method returns `false`, then verification stops and ruby will raise
+  # an `OpenSSL::SSL::Error` with "certificate verification failed". If this
+  # method returns `true`, then verification continues.
+  #
+  # If this method ignores a verification error, such as the cert's CRL will be
+  # valid within the next 5 minutes, then this method may be called with a
+  # different verification error for the same cert.
+  #
+  # WARNING: If `store_context.error` returns `OpenSSL::X509::V_OK`, don't
+  # assume verification passed. Ruby 2.4+ implements certificate hostname
+  # checking by default, and if the cert doesn't match the hostname, then the
+  # error will be V_OK. Always use `preverify_ok` to determine if verification
+  # succeeded or not.
+  #
+  # @param preverify_ok [Boolean] if `true` the current certificate in `store_context`
+  #   was verified. Otherwise, check for the current error in `store_context.error`
+  # @param store_context [OpenSSL::X509::StoreContext] The context holding the
+  #   verification result for one certificate
+  # @return [Boolean] If `true`, continue verifying the chain, even if that means
+  #   ignoring the current verification error. If `false`, abort the connection.
+  #
+  # @api private
+  def call(preverify_ok, store_context)
+    return true if preverify_ok
+
+    peer_cert = store_context.current_cert
+
+    case store_context.error
+    when OpenSSL::X509::V_OK
+      # chain is from leaf to root, opposite of the order that `call` is invoked
+      chain_cert = store_context.chain.first
+
+      # ruby 2.4 doesn't compare certs based on value, so force to DER byte array
+      if peer_cert && chain_cert && peer_cert.to_der == chain_cert.to_der && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
+        @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+        return false
+      end
+
+    # ruby-openssl#74ef8c0cc56b840b772240f2ee2b0fc0aafa2743 now sets the
+    # store_context error when the cert is mismatched
+    when OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH
+      @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+      return false
+
+    when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
+      crl = store_context.current_crl
+      if crl && crl.last_update && crl.last_update < Time.now + FIVE_MINUTES_AS_SECONDS
+        Puppet.debug("Ignoring CRL not yet valid, current time #{Time.now.utc}, CRL last updated #{crl.last_update.utc}")
+        return true
+      end
+    end
+
+    # TRANSLATORS: `error` is an untranslated message from openssl describing why a certificate in the server's chain is invalid, and `subject` is the identity/name of the failed certificate
+    @last_error = Puppet::SSL::CertVerifyError.new(
+      _("certificate verify failed [%{error} for %{subject}]") %
+      { error: store_context.error_string, subject: peer_cert.subject.to_utf8 },
+      store_context.error, peer_cert
+    )
+    false
+  end
+end

data/lib/puppet/ssl.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# Just to make the constants work out.
+require_relative '../puppet'
+require_relative 'ssl/openssl_loader'
+
+# Responsible for bootstrapping an agent's certificate and private key, generating
+# SSLContexts for use in making HTTPS connections, and handling CSR attributes and
+# certificate extensions.
+#
+# @see Puppet::SSL::SSLProvider
+# @api private
+module Puppet::SSL
+  CA_NAME = "ca"
+
+  require_relative 'ssl/oids'
+  require_relative 'ssl/error'
+  require_relative 'ssl/ssl_context'
+  require_relative 'ssl/verifier'
+  require_relative 'ssl/ssl_provider'
+  require_relative 'ssl/state_machine'
+  require_relative 'ssl/certificate'
+  require_relative 'ssl/certificate_request'
+  require_relative 'ssl/certificate_request_attributes'
+end

data/lib/puppet/syntax_checkers/base64.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+# A syntax checker for Base64.
+# @api public
+require_relative '../../puppet/syntax_checkers'
+require 'base64'
+class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+  # Checks the text for BASE64 syntax issues and reports them to the given acceptor.
+  # This checker allows the most relaxed form of Base64, including newlines and missing padding.
+  # It also accept URLsafe input.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (e.g. 'base64', 'text/xxx+base64')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError, _("Base64 syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError, _("Base64 syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    cleaned_text = text.gsub(/[\r?\n[:blank:]]/, '')
+    begin
+      # Do a strict decode64 on text with all whitespace stripped since the non strict version
+      # simply skips all non base64 characters
+      Base64.strict_decode64(cleaned_text)
+    rescue
+      msg = if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
+              _("Base64 syntax checker: Cannot parse invalid Base64 string - padding is not correct")
+            else
+              _("Base64 syntax checker: Cannot parse invalid Base64 string - contains letters outside strict base 64 range (or whitespace)")
+            end
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_BASE64) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/epp.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# A syntax checker for JSON.
+# @api public
+require_relative '../../puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::EPP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+  # Checks the text for Puppet Language EPP syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError, _("EPP syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("EPP syntax checker: the syntax identifier must be a String, e.g. pp") unless syntax == 'epp'
+    raise ArgumentError, _("EPP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser::EvaluatingEppParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("EPP syntax checker: \"%{message}\"") % { message: e.message().slice(0, 500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_EPP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/json.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# A syntax checker for JSON.
+# @api public
+require_relative '../../puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+  # Checks the text for JSON syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (e.g. 'json', 'json-patch+json', 'xml', 'myapp+xml'
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError, _("Json syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("Json syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError, _("Json syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Util::Json.load(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("JSON syntax checker: Cannot parse invalid JSON string. \"%{message}\"") % { message: e.message().slice(0, 100).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_JSON) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/pp.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# A syntax checker for JSON.
+# @api public
+require_relative '../../puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::PP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+  # Checks the text for Puppet Language syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError, _("PP syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError, _("PP syntax checker: the syntax identifier must be a String, e.g. pp") unless syntax == 'pp'
+    raise ArgumentError, _("PP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name } unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("PP syntax checker: \"%{message}\"") % { message: e.message().slice(0, 500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues.issue(:ILLEGAL_PP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+# A name space for syntax checkers provided by Puppet.
+module Puppet::SyntaxCheckers
+end

data/lib/puppet/test/test_helper.rb

@@ -0,0 +1,251 @@
+# frozen_string_literal: true
+
+require 'tmpdir'
+require 'fileutils'
+
+module Puppet::Test
+  # This class is intended to provide an API to be used by external projects
+  #  when they are running tests that depend on puppet core.  This should
+  #  allow us to vary the implementation details of managing puppet's state
+  #  for testing, from one version of puppet to the next--without forcing
+  #  the external projects to do any of that state management or be aware of
+  #  the implementation details.
+  #
+  # For now, this consists of a few very simple signatures.  The plan is
+  #  that it should be the responsibility of the puppetlabs_spec_helper
+  #  to broker between external projects and this API; thus, if any
+  #  hacks are required (e.g. to determine whether or not a particular)
+  #  version of puppet supports this API, those hacks will be consolidated in
+  #  one place and won't need to be duplicated in every external project.
+  #
+  # This should also alleviate the anti-pattern that we've been following,
+  #  wherein each external project starts off with a copy of puppet core's
+  #  test_helper.rb and is exposed to risk of that code getting out of
+  #  sync with core.
+  #
+  # Since this class will be "library code" that ships with puppet, it does
+  #  not use API from any existing test framework such as rspec.  This should
+  #  theoretically allow it to be used with other unit test frameworks in the
+  #  future, if desired.
+  #
+  # Note that in the future this API could potentially be expanded to handle
+  #  other features such as "around_test", but we didn't see a compelling
+  #  reason to deal with that right now.
+  class TestHelper
+    # Call this method once, as early as possible, such as before loading tests
+    # that call Puppet.
+    # @return nil
+    def self.initialize
+      # This meta class instance variable is used as a guard to ensure that
+      # before_each, and after_each are only called once. This problem occurs
+      # when there are more than one puppet test infrastructure orchestrator in use.
+      # The use of both puppetabs-spec_helper, and rodjek-rspec_puppet will cause
+      # two resets of the puppet environment, and will cause problem rolling back to
+      # a known point as there is no way to differentiate where the calls are coming
+      # from. See more information in #before_each_test, and #after_each_test
+      # Note that the variable is only initialized to 0 if nil. This is important
+      # as more than one orchestrator will call initialize. A second call can not
+      # simply set it to 0 since that would potentially destroy an active guard.
+      #
+      @@reentry_count ||= 0
+
+      @environmentpath = Dir.mktmpdir('environments')
+      Dir.mkdir("#{@environmentpath}/production")
+      owner = Process.pid
+      Puppet.push_context(Puppet.base_context({
+                                                :environmentpath => @environmentpath,
+                                                :basemodulepath => "",
+                                              }), "Initial for specs")
+      Puppet::Parser::Functions.reset
+
+      ObjectSpace.define_finalizer(Puppet.lookup(:environments), proc {
+        if Process.pid == owner
+          FileUtils.rm_rf(@environmentpath)
+        end
+      })
+      Puppet::SSL::Oids.register_puppet_oids
+    end
+
+    # Call this method once, when beginning a test run--prior to running
+    #  any individual tests.
+    # @return nil
+    def self.before_all_tests
+      # The process environment is a shared, persistent resource.
+      $old_env = ENV.to_hash
+    end
+
+    # Call this method once, at the end of a test run, when no more tests
+    #  will be run.
+    # @return nil
+    def self.after_all_tests
+    end
+
+    # The name of the rollback mark used in the Puppet.context. This is what
+    # the test infrastructure returns to for each test.
+    #
+    ROLLBACK_MARK = "initial testing state"
+
+    # Call this method once per test, prior to execution of each individual test.
+    # @return nil
+    def self.before_each_test
+      # When using both rspec-puppet and puppet-rspec-helper, there are two packages trying
+      # to be helpful and orchestrate the callback sequence. We let only the first win, the
+      # second callback results in a no-op.
+      # Likewise when entering after_each_test(), a check is made to make tear down happen
+      # only once.
+      #
+      return unless @@reentry_count == 0
+
+      @@reentry_count = 1
+
+      Puppet.mark_context(ROLLBACK_MARK)
+
+      # We need to preserve the current state of all our indirection cache and
+      # terminus classes.  This is pretty important, because changes to these
+      # are global and lead to order dependencies in our testing.
+      #
+      # We go direct to the implementation because there is no safe, sane public
+      # API to manage restoration of these to their default values.  This
+      # should, once the value is proved, be moved to a standard API on the
+      # indirector.
+      #
+      # To make things worse, a number of the tests stub parts of the
+      # indirector.  These stubs have very specific expectations that what
+      # little of the public API we could use is, well, likely to explode
+      # randomly in some tests.  So, direct access.  --daniel 2011-08-30
+      $saved_indirection_state = {}
+      indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
+      indirections.each do |indirector|
+        $saved_indirection_state[indirector.name] = {
+          :@terminus_class => indirector.instance_variable_get(:@terminus_class).value,
+          :@cache_class => indirector.instance_variable_get(:@cache_class).value,
+          # dup the termini hash so termini created and registered during
+          # the test aren't stored in our saved_indirection_state
+          :@termini => indirector.instance_variable_get(:@termini).dup
+        }
+      end
+
+      # So is the load_path
+      $old_load_path = $LOAD_PATH.dup
+
+      initialize_settings_before_each()
+
+      Puppet.push_context(
+        {
+          trusted_information:
+            Puppet::Context::TrustedInformation.new('local', 'testing', {}, { "trusted_testhelper" => true }),
+          ssl_context: Puppet::SSL::SSLContext.new(cacerts: []).freeze,
+          http_session: proc { Puppet.runtime[:http].create_session }
+        },
+        "Context for specs"
+      )
+
+      # trigger `require 'facter'`
+      Puppet.runtime[:facter]
+
+      Puppet::Parser::Functions.reset
+      Puppet::Application.clear!
+      Puppet::Util::Profiler.clear
+
+      Puppet::Node::Facts.indirection.terminus_class = :memory
+      facts = Puppet::Node::Facts.new(Puppet[:node_name_value])
+      Puppet::Node::Facts.indirection.save(facts)
+
+      Puppet.clear_deprecation_warnings
+    end
+
+    # Call this method once per test, after execution of each individual test.
+    # @return nil
+    def self.after_each_test
+      # Ensure that a matching tear down only happens once per completed setup
+      # (see #before_each_test).
+      return unless @@reentry_count == 1
+
+      @@reentry_count = 0
+
+      Puppet.settings.send(:clear_everything_for_tests)
+
+      Puppet::Util::Storage.clear
+      Puppet::Util::ExecutionStub.reset
+      Puppet.runtime.clear
+
+      Puppet.clear_deprecation_warnings
+
+      # uncommenting and manipulating this can be useful when tracking down calls to deprecated code
+      # Puppet.log_deprecations_to_file("deprecations.txt", /^Puppet::Util.exec/)
+
+      # Restore the indirector configuration.  See before hook.
+      indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
+      indirections.each do |indirector|
+        $saved_indirection_state.fetch(indirector.name, {}).each do |variable, value|
+          if variable == :@termini
+            indirector.instance_variable_set(variable, value)
+          else
+            indirector.instance_variable_get(variable).value = value
+          end
+        end
+      end
+      $saved_indirection_state = nil
+
+      # Restore the global process environment.
+      ENV.replace($old_env)
+
+      # Clear all environments
+      Puppet.lookup(:environments).clear_all
+
+      # Restore the load_path late, to avoid messing with stubs from the test.
+      $LOAD_PATH.clear
+      $old_load_path.each { |x| $LOAD_PATH << x }
+
+      Puppet.rollback_context(ROLLBACK_MARK)
+    end
+
+    #########################################################################################
+    # PRIVATE METHODS (not part of the public TestHelper API--do not call these from outside
+    #  of this class!)
+    #########################################################################################
+
+    def self.app_defaults_for_tests
+      {
+        :logdir => "/dev/null",
+        :confdir => "/dev/null",
+        :publicdir => "/dev/null",
+        :codedir => "/dev/null",
+        :vardir => "/dev/null",
+        :rundir => "/dev/null",
+        :hiera_config => "/dev/null",
+      }
+    end
+    private_class_method :app_defaults_for_tests
+
+    def self.initialize_settings_before_each
+      Puppet.settings.preferred_run_mode = "user"
+      # Initialize "app defaults" settings to a good set of test values
+      Puppet.settings.initialize_app_defaults(app_defaults_for_tests)
+
+      # We don't want to depend upon the reported domain name of the
+      # machine running the tests, nor upon the DNS setup of that
+      # domain.
+      Puppet.settings[:use_srv_records] = false
+
+      # Longer keys are secure, but they sure make for some slow testing - both
+      # in terms of generating keys, and in terms of anything the next step down
+      # the line doing validation or whatever.  Most tests don't care how long
+      # or secure it is, just that it exists, so these are better and faster
+      # defaults, in testing only.
+      #
+      # I would make these even shorter, but OpenSSL doesn't support anything
+      # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
+      Puppet[:keylength] = 512
+
+      # Although we setup a testing context during initialization, some tests
+      # will end up creating their own context using the real context objects
+      # and use the setting for the environments. In order to avoid those tests
+      # having to deal with a missing environmentpath we can just set it right
+      # here.
+      Puppet[:environmentpath] = @environmentpath
+      Puppet[:environment_timeout] = 0
+    end
+    private_class_method :initialize_settings_before_each
+  end
+end

data/lib/puppet/thread_local.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+require 'concurrent'
+
+class Puppet::ThreadLocal < Concurrent::ThreadLocalVar
+end