puppet 3.8.7 → 4.0.0.rc1

data/spec/unit/ssl/base_spec.rb

@@ -16,12 +16,12 @@ describe Puppet::SSL::Certificate do
   describe "when creating new instances" do
     it "should fail if given an object that is not an instance of the wrapped class" do
       obj = stub 'obj', :is_a? => false
-      lambda { @class.from_instance(obj) }.should raise_error(ArgumentError)
+      expect { @class.from_instance(obj) }.to raise_error(ArgumentError)
     end
 
     it "should fail if a name is not supplied and can't be determined from the object" do
       obj = stub 'obj', :is_a? => true
-      lambda { @class.from_instance(obj) }.should raise_error(ArgumentError)
+      expect { @class.from_instance(obj) }.to raise_error(ArgumentError)
     end
 
     it "should determine the name from the object if it has a subject" do
@@ -33,7 +33,7 @@ describe Puppet::SSL::Certificate do
       @class.expects(:new).with('foo').returns inst
       @class.expects(:name_from_subject).with('/CN=foo').returns('foo')
 
-      @class.from_instance(obj).should == inst
+      expect(@class.from_instance(obj)).to eq(inst)
     end
   end
 
@@ -41,7 +41,7 @@ describe Puppet::SSL::Certificate do
     it "should extract only the CN and not any other components" do
       subject = stub 'sub'
       Puppet::Util::SSL.expects(:cn_from_subject).with(subject).returns 'host.domain.com'
-      @class.name_from_subject(subject).should == 'host.domain.com'
+      expect(@class.name_from_subject(subject)).to eq('host.domain.com')
     end
   end
 
@@ -71,7 +71,7 @@ describe Puppet::SSL::Certificate do
     }.each do |signature, digest|
       it "returns '#{digest}' for signature algorithm '#{signature}'" do
         content.stubs(:signature_algorithm).returns(signature)
-        base.digest_algorithm.should == digest
+        expect(base.digest_algorithm).to eq(digest)
       end
     end
 

data/spec/unit/ssl/certificate_authority/autosign_command_spec.rb

@@ -10,13 +10,13 @@ describe Puppet::SSL::CertificateAuthority::AutosignCommand do
   it "returns true if the command succeeded" do
     executes_the_command_resulting_in(0)
 
-    decider.allowed?(csr).should == true
+    expect(decider.allowed?(csr)).to eq(true)
   end
 
   it "returns false if the command failed" do
     executes_the_command_resulting_in(1)
 
-    decider.allowed?(csr).should == false
+    expect(decider.allowed?(csr)).to eq(false)
   end
 
   def executes_the_command_resulting_in(exitstatus)

data/spec/unit/ssl/certificate_authority/interface_spec.rb

@@ -25,6 +25,33 @@ shared_examples_for "a normal interface method" do
   end
 end
 
+shared_examples_for "a destructive interface method" do
+  it "calls the method on the CA for each host specified if an array was provided" do
+    @ca.expects(@method).with("host1")
+    @ca.expects(@method).with("host2")
+
+    @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, :to => %w{host1 host2})
+
+    @applier.apply(@ca)
+  end
+
+  it "raises an error if :all was provided" do
+    @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, :to => :all)
+
+    expect {
+      @applier.apply(@ca)
+    }.to raise_error(ArgumentError, /Refusing to #{@method} all certs/)
+  end
+
+  it "raises an error if :signed was provided" do
+    @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, :to => :signed)
+
+    expect {
+      @applier.apply(@ca)
+    }.to raise_error(ArgumentError, /Refusing to #{@method} all signed certs/)
+  end
+end
+
 describe Puppet::SSL::CertificateAuthority::Interface do
   before do
     @class = Puppet::SSL::CertificateAuthority::Interface
@@ -32,17 +59,17 @@ describe Puppet::SSL::CertificateAuthority::Interface do
   describe "when initializing" do
     it "should set its method using its settor" do
       instance = @class.new(:generate, :to => :all)
-      instance.method.should == :generate
+      expect(instance.method).to eq(:generate)
     end
 
     it "should set its subjects using the settor" do
       instance = @class.new(:generate, :to => :all)
-      instance.subjects.should == :all
+      expect(instance.subjects).to eq(:all)
     end
 
     it "should set the digest if given" do
       interface = @class.new(:generate, :to => :all, :digest => :digest)
-      interface.digest.should == :digest
+      expect(interface.digest).to eq(:digest)
     end
   end
 
@@ -51,11 +78,11 @@ describe Puppet::SSL::CertificateAuthority::Interface do
       instance = @class.new(:generate, :to => :all)
       instance.method = :list
 
-      instance.method.should == :list
+      expect(instance.method).to eq(:list)
     end
 
     it "should fail if the method isn't a member of the INTERFACE_METHODS array" do
-      lambda { @class.new(:thing, :to => :all) }.should raise_error(ArgumentError, /Invalid method thing to apply/)
+      expect { @class.new(:thing, :to => :all) }.to raise_error(ArgumentError, /Invalid method thing to apply/)
     end
   end
 
@@ -64,16 +91,16 @@ describe Puppet::SSL::CertificateAuthority::Interface do
       instance = @class.new(:generate, :to => :all)
       instance.subjects = :signed
 
-      instance.subjects.should == :signed
+      expect(instance.subjects).to eq(:signed)
     end
 
     it "should fail if the subjects setting isn't :all or an array" do
-      lambda { @class.new(:generate, :to => "other") }.should raise_error(ArgumentError, /Subjects must be an array or :all; not other/)
+      expect { @class.new(:generate, :to => "other") }.to raise_error(ArgumentError, /Subjects must be an array or :all; not other/)
     end
   end
 
   it "should have a method for triggering the application" do
-    @class.new(:generate, :to => :all).should respond_to(:apply)
+    expect(@class.new(:generate, :to => :all)).to respond_to(:apply)
   end
 
   describe "when applying" do
@@ -85,14 +112,14 @@ describe Puppet::SSL::CertificateAuthority::Interface do
     describe "with an empty array specified and the method is not list" do
       it "should fail" do
         @applier = @class.new(:sign, :to => [])
-        lambda { @applier.apply(@ca) }.should raise_error(ArgumentError)
+        expect { @applier.apply(@ca) }.to raise_error(ArgumentError)
       end
     end
 
     describe ":generate" do
       it "should fail if :all was specified" do
         @applier = @class.new(:generate, :to => :all)
-        lambda { @applier.apply(@ca) }.should raise_error(ArgumentError)
+        expect { @applier.apply(@ca) }.to raise_error(ArgumentError)
       end
 
       it "should call :generate on the CA for each host specified" do
@@ -120,12 +147,12 @@ describe Puppet::SSL::CertificateAuthority::Interface do
 
     describe ":destroy" do
       before { @method = :destroy }
-      it_should_behave_like "a normal interface method"
+      it_should_behave_like "a destructive interface method"
     end
 
     describe ":revoke" do
       before { @method = :revoke }
-      it_should_behave_like "a normal interface method"
+      it_should_behave_like "a destructive interface method"
     end
 
     describe ":sign" do
@@ -166,7 +193,7 @@ describe Puppet::SSL::CertificateAuthority::Interface do
           @ca.stubs(:waiting?).returns([])
 
           @applier = @class.new(:sign, :to => :all)
-          lambda { @applier.apply(@ca) }.should raise_error(Puppet::SSL::CertificateAuthority::Interface::InterfaceError)
+          expect { @applier.apply(@ca) }.to raise_error(Puppet::SSL::CertificateAuthority::Interface::InterfaceError)
         end
       end
     end

data/spec/unit/ssl/certificate_authority_spec.rb

@@ -19,7 +19,7 @@ describe Puppet::SSL::CertificateAuthority do
   end
 
   it "should have a class method for returning a singleton instance" do
-    Puppet::SSL::CertificateAuthority.should respond_to(:instance)
+    expect(Puppet::SSL::CertificateAuthority).to respond_to(:instance)
   end
 
   describe "when finding an existing instance" do
@@ -33,11 +33,11 @@ describe Puppet::SSL::CertificateAuthority do
       end
 
       it "should return an instance" do
-        Puppet::SSL::CertificateAuthority.instance.should equal(@ca)
+        expect(Puppet::SSL::CertificateAuthority.instance).to equal(@ca)
       end
 
       it "should always return the same instance" do
-        Puppet::SSL::CertificateAuthority.instance.should equal(Puppet::SSL::CertificateAuthority.instance)
+        expect(Puppet::SSL::CertificateAuthority.instance).to equal(Puppet::SSL::CertificateAuthority.instance)
       end
     end
 
@@ -48,7 +48,7 @@ describe Puppet::SSL::CertificateAuthority do
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
-        Puppet::SSL::CertificateAuthority.instance.should be_nil
+        expect(Puppet::SSL::CertificateAuthority.instance).to be_nil
       end
     end
 
@@ -59,7 +59,7 @@ describe Puppet::SSL::CertificateAuthority do
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
-        Puppet::SSL::CertificateAuthority.instance.should be_nil
+        expect(Puppet::SSL::CertificateAuthority.instance).to be_nil
       end
     end
   end
@@ -74,7 +74,7 @@ describe Puppet::SSL::CertificateAuthority do
     it "should always set its name to the value of :certname" do
       Puppet[:certname] = "ca_testing"
 
-      Puppet::SSL::CertificateAuthority.new.name.should == "ca_testing"
+      expect(Puppet::SSL::CertificateAuthority.new.name).to eq("ca_testing")
     end
 
     it "should create an SSL::Host instance whose name is the 'ca_name'" do
@@ -130,7 +130,7 @@ describe Puppet::SSL::CertificateAuthority do
     it "should return any found CRL instance" do
       crl = mock 'crl'
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns crl
-      @ca.crl.should equal(crl)
+      expect(@ca.crl).to equal(crl)
     end
 
     it "should create, generate, and save a new CRL instance of no CRL can be found" do
@@ -142,7 +142,7 @@ describe Puppet::SSL::CertificateAuthority do
       crl.expects(:generate).with(@ca.host.certificate.content, @ca.host.key.content)
       Puppet::SSL::CertificateRevocationList.indirection.expects(:save).with(crl)
 
-      @ca.crl.should equal(crl)
+      expect(@ca.crl).to equal(crl)
     end
   end
 
@@ -261,28 +261,28 @@ describe Puppet::SSL::CertificateAuthority do
 
       it "should use a certificate type of :ca" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
-          args[0].should == :ca
+          expect(args[0]).to eq(:ca)
         end.returns @cert.content
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the provided CSR as the CSR" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
-          args[1].should == @request
+          expect(args[1]).to eq(@request)
         end.returns @cert.content
         @ca.sign(@name, :ca, @request)
       end
 
       it "should use the provided CSR's content as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
-          args[2].subject.to_s.should == "/CN=myhost"
+          expect(args[2].subject.to_s).to eq("/CN=myhost")
         end.returns @cert.content
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
-          args[3].should == @serial
+          expect(args[3]).to eq(@serial)
         end.returns @cert.content
         @ca.sign(@name, :ca, @request)
       end
@@ -586,7 +586,7 @@ describe Puppet::SSL::CertificateAuthority do
       @ca.stubs(:next_serial).returns @serial
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
-      @ca.sign(@name).should equal(@cert)
+      expect(@ca.sign(@name)).to equal(@cert)
     end
 
     it "should add the certificate to its inventory" do
@@ -599,7 +599,7 @@ describe Puppet::SSL::CertificateAuthority do
     end
 
     it "should have a method for triggering autosigning of available CSRs" do
-      @ca.should respond_to(:autosign)
+      expect(@ca).to respond_to(:autosign)
     end
 
     describe "when autosigning certificates" do
@@ -727,7 +727,7 @@ describe Puppet::SSL::CertificateAuthority do
       req2 = stub 'req2', :name => "two"
       Puppet::SSL::CertificateRequest.indirection.expects(:search).with("*").returns [req1, req2]
 
-      @ca.waiting?.should == %w{one two}
+      expect(@ca.waiting?).to eq(%w{one two})
     end
 
     it "should delegate removing hosts to the Host class" do
@@ -737,33 +737,33 @@ describe Puppet::SSL::CertificateAuthority do
     end
 
     it "should be able to verify certificates" do
-      @ca.should respond_to(:verify)
+      expect(@ca).to respond_to(:verify)
     end
 
     it "should list certificates as the sorted list of all existing signed certificates" do
       cert1 = stub 'cert1', :name => "cert1"
       cert2 = stub 'cert2', :name => "cert2"
       Puppet::SSL::Certificate.indirection.expects(:search).with("*").returns [cert1, cert2]
-      @ca.list.should == %w{cert1 cert2}
+      expect(@ca.list).to eq(%w{cert1 cert2})
     end
 
     it "should list the full certificates" do
       cert1 = stub 'cert1', :name => "cert1"
       cert2 = stub 'cert2', :name => "cert2"
       Puppet::SSL::Certificate.indirection.expects(:search).with("*").returns [cert1, cert2]
-      @ca.list_certificates.should == [cert1, cert2]
+      expect(@ca.list_certificates).to eq([cert1, cert2])
     end
 
     describe "and printing certificates" do
       it "should return nil if the certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
-        @ca.print("myhost").should be_nil
+        expect(@ca.print("myhost")).to be_nil
       end
 
       it "should print certificates by calling :to_text on the host's certificate" do
         cert1 = stub 'cert1', :name => "cert1", :to_text => "mytext"
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns cert1
-        @ca.print("myhost").should == "mytext"
+        expect(@ca.print("myhost")).to eq("mytext")
       end
     end
 
@@ -873,7 +873,7 @@ describe Puppet::SSL::CertificateAuthority do
 
           @store.expects(:verify).with("mycert").returns false
 
-          @ca.certificate_is_alive?(@cert).should be_false
+          expect(@ca.certificate_is_alive?(@cert)).to be_falsey
         end
 
         it "should return true if verification passes" do
@@ -881,7 +881,7 @@ describe Puppet::SSL::CertificateAuthority do
 
           @store.expects(:verify).with("mycert").returns true
 
-          @ca.certificate_is_alive?(@cert).should be_true
+          expect(@ca.certificate_is_alive?(@cert)).to be_truthy
         end
 
         it "should used a cached instance of the x509 store" do
@@ -994,7 +994,7 @@ describe Puppet::SSL::CertificateAuthority do
     end
 
     it "should be able to generate a complete new SSL host" do
-      @ca.should respond_to(:generate)
+      expect(@ca).to respond_to(:generate)
     end
   end
 end

data/spec/unit/ssl/certificate_factory_spec.rb

@@ -21,38 +21,39 @@ describe Puppet::SSL::CertificateFactory do
 
   describe "when generating the certificate" do
     it "should return a new X509 certificate" do
-      subject.build(:server, csr, issuer, serial).should_not ==
+      expect(subject.build(:server, csr, issuer, serial)).not_to eq(
         subject.build(:server, csr, issuer, serial)
+      )
     end
 
     it "should set the certificate's version to 2" do
-      subject.build(:server, csr, issuer, serial).version.should == 2
+      expect(subject.build(:server, csr, issuer, serial).version).to eq(2)
     end
 
     it "should set the certificate's subject to the CSR's subject" do
       cert = subject.build(:server, csr, issuer, serial)
-      cert.subject.should eql x509_name
+      expect(cert.subject).to eql x509_name
     end
 
     it "should set the certificate's issuer to the Issuer's subject" do
       cert = subject.build(:server, csr, issuer, serial)
-      cert.issuer.should eql issuer.subject
+      expect(cert.issuer).to eql issuer.subject
     end
 
     it "should set the certificate's public key to the CSR's public key" do
       cert = subject.build(:server, csr, issuer, serial)
-      cert.public_key.should be_public
-      cert.public_key.to_s.should == csr.content.public_key.to_s
+      expect(cert.public_key).to be_public
+      expect(cert.public_key.to_s).to eq(csr.content.public_key.to_s)
     end
 
     it "should set the certificate's serial number to the provided serial number" do
       cert = subject.build(:server, csr, issuer, serial)
-      cert.serial.should == serial
+      expect(cert.serial).to eq(serial)
     end
 
     it "should have 24 hours grace on the start of the cert" do
       cert = subject.build(:server, csr, issuer, serial)
-      cert.not_before.should be_within(30).of(Time.now - 24*60*60)
+      expect(cert.not_before).to be_within(30).of(Time.now - 24*60*60)
     end
 
     it "should set the default TTL of the certificate to the `ca_ttl` setting" do
@@ -60,7 +61,7 @@ describe Puppet::SSL::CertificateFactory do
       now = Time.now.utc
       Time.expects(:now).at_least_once.returns(now)
       cert = subject.build(:server, csr, issuer, serial)
-      cert.not_after.to_i.should == now.to_i + 12
+      expect(cert.not_after.to_i).to eq(now.to_i + 12)
     end
 
     it "should not allow a non-integer TTL" do
@@ -73,30 +74,35 @@ describe Puppet::SSL::CertificateFactory do
       now = Time.now.utc
       Time.expects(:now).at_least_once.returns(now)
       cert = subject.build(:server, csr, issuer, serial, 12)
-      cert.not_after.to_i.should == now.to_i + 12
+      expect(cert.not_after.to_i).to eq(now.to_i + 12)
     end
 
     it "should adds an extension for the nsComment" do
       cert = subject.build(:server, csr, issuer, serial)
-      cert.extensions.map {|x| x.to_h }.find {|x| x["oid"] == "nsComment" }.should ==
+      expect(cert.extensions.map {|x| x.to_h }.find {|x| x["oid"] == "nsComment" }).to eq(
         { "oid"      => "nsComment",
-          "value"    => "Puppet Ruby/OpenSSL Internal Certificate",
+          # Note that this output is due to a bug in OpenSSL::X509::Extensions
+          # where the values of some extensions are not properly decoded
+          "value"    => ".(Puppet Ruby/OpenSSL Internal Certificate",
           "critical" => false }
+      )
     end
 
     it "should add an extension for the subjectKeyIdentifer" do
       cert = subject.build(:server, csr, issuer, serial)
       ef = OpenSSL::X509::ExtensionFactory.new(issuer, cert)
-      cert.extensions.map { |x| x.to_h }.find {|x| x["oid"] == "subjectKeyIdentifier" }.should ==
+      expect(cert.extensions.map { |x| x.to_h }.find {|x| x["oid"] == "subjectKeyIdentifier" }).to eq(
         ef.create_extension("subjectKeyIdentifier", "hash", false).to_h
+      )
     end
 
 
     it "should add an extension for the authorityKeyIdentifer" do
       cert = subject.build(:server, csr, issuer, serial)
       ef = OpenSSL::X509::ExtensionFactory.new(issuer, cert)
-      cert.extensions.map { |x| x.to_h }.find {|x| x["oid"] == "authorityKeyIdentifier" }.should ==
+      expect(cert.extensions.map { |x| x.to_h }.find {|x| x["oid"] == "authorityKeyIdentifier" }).to eq(
         ef.create_extension("authorityKeyIdentifier", "keyid:always", false).to_h
+      )
     end
 
     # See #2848 for why we are doing this: we need to make sure that
@@ -105,10 +111,10 @@ describe Puppet::SSL::CertificateFactory do
     it "should not add subjectAltNames from dns_alt_names" do
       Puppet[:dns_alt_names] = 'one, two'
       # Verify the CSR still has no extReq, just in case...
-      csr.request_extensions.should == []
+      expect(csr.request_extensions).to eq([])
       cert = subject.build(:server, csr, issuer, serial)
 
-      cert.extensions.find {|x| x.oid == 'subjectAltName' }.should be_nil
+      expect(cert.extensions.find {|x| x.oid == 'subjectAltName' }).to be_nil
     end
 
     it "should add subjectAltName when the CSR requests them" do
@@ -119,14 +125,14 @@ describe Puppet::SSL::CertificateFactory do
       csr = Puppet::SSL::CertificateRequest.new(name)
       csr.generate(key, :dns_alt_names => expect.join(', '))
 
-      csr.request_extensions.should_not be_nil
-      csr.subject_alt_names.should =~ expect.map{|x| "DNS:#{x}"}
+      expect(csr.request_extensions).not_to be_nil
+      expect(csr.subject_alt_names).to match_array(expect.map{|x| "DNS:#{x}"})
 
       cert = subject.build(:server, csr, issuer, serial)
       san = cert.extensions.find {|x| x.oid == 'subjectAltName' }
-      san.should_not be_nil
+      expect(san).not_to be_nil
       expect.each do |name|
-        san.value.should =~ /DNS:#{name}\b/i
+        expect(san.value).to match(/DNS:#{name}\b/i)
       end
     end
 
@@ -141,11 +147,18 @@ describe Puppet::SSL::CertificateFactory do
 
       cert = subject.build(:client, csr, issuer, serial)
 
-      priv_ext = cert.extensions.find {|ext| ext.oid == '1.3.6.1.4.1.34380.1.2.1'}
-      uuid_ext = cert.extensions.find {|ext| ext.oid == 'pp_uuid'}
+      # The cert must be signed before being later DER-decoding
+      signer = Puppet::SSL::CertificateSigner.new
+      signer.sign(cert, key)
+      wrapped_cert = Puppet::SSL::Certificate.from_instance cert
 
-      expect(priv_ext.value).to eq 'some-value'
-      expect(uuid_ext.value).to eq 'some-uuid'
+      priv_ext = wrapped_cert.custom_extensions.find {|ext| ext['oid'] == '1.3.6.1.4.1.34380.1.2.1'}
+      uuid_ext = wrapped_cert.custom_extensions.find {|ext| ext['oid'] == 'pp_uuid'}
+
+      # The expected results should be DER encoded, the Puppet cert wrapper will turn
+      # these into normal strings.
+      expect(priv_ext['value']).to eq 'some-value'
+      expect(uuid_ext['value']).to eq 'some-uuid'
     end
 
     # Can't check the CA here, since that requires way more infrastructure
@@ -160,8 +173,8 @@ describe Puppet::SSL::CertificateFactory do
       it "should set basicConstraints for #{name} #{value.inspect}" do
         cert = subject.build(name, csr, issuer, serial)
         bc = cert.extensions.find {|x| x.oid == 'basicConstraints' }
-        bc.should be
-        bc.value.split(/\s*,\s*/).should =~ Array(value)
+        expect(bc).to be
+        expect(bc.value.split(/\s*,\s*/)).to match_array(Array(value))
       end
     end
   end