puppet 3.8.7 → 4.0.0.rc1

data/spec/unit/ssl/certificate_request_attributes_spec.rb

@@ -22,7 +22,7 @@ describe Puppet::SSL::CertificateRequestAttributes do
 
   describe "loading" do
     it "returns nil when loading from a non-existent file" do
-      expect(csr_attributes.load).to be_false
+      expect(csr_attributes.load).to be_falsey
     end
 
     context "with an available attributes file" do
@@ -32,7 +32,7 @@ describe Puppet::SSL::CertificateRequestAttributes do
       end
 
       it "loads csr attributes from a file when the file is present" do
-        expect(csr_attributes.load).to be_true
+        expect(csr_attributes.load).to be_truthy
       end
 
       it "exposes custom_attributes" do

data/spec/unit/ssl/certificate_request_spec.rb

@@ -14,19 +14,19 @@ describe Puppet::SSL::CertificateRequest do
 
 
   it "should be extended with the Indirector module" do
-    described_class.singleton_class.should be_include(Puppet::Indirector)
+    expect(described_class.singleton_class).to be_include(Puppet::Indirector)
   end
 
   it "should indirect certificate_request" do
-    described_class.indirection.name.should == :certificate_request
+    expect(described_class.indirection.name).to eq(:certificate_request)
   end
 
   it "should use any provided name as its name" do
-    described_class.new("myname").name.should == "myname"
+    expect(described_class.new("myname").name).to eq("myname")
   end
 
   it "should only support the text format" do
-    described_class.supported_formats.should == [:s]
+    expect(described_class.supported_formats).to eq([:s])
   end
 
   describe "when converting from a string" do
@@ -47,15 +47,15 @@ describe Puppet::SSL::CertificateRequest do
 
   describe "when managing instances" do
     it "should have a name attribute" do
-      request.name.should == "myname"
+      expect(request.name).to eq("myname")
     end
 
     it "should downcase its name" do
-      described_class.new("MyName").name.should == "myname"
+      expect(described_class.new("MyName").name).to eq("myname")
     end
 
     it "should have a content attribute" do
-      request.should respond_to(:content)
+      expect(request).to respond_to(:content)
     end
 
     it "should be able to read requests from disk" do
@@ -63,54 +63,54 @@ describe Puppet::SSL::CertificateRequest do
       File.expects(:read).with(path).returns("my request")
       my_req = mock 'request'
       OpenSSL::X509::Request.expects(:new).with("my request").returns(my_req)
-      request.read(path).should equal(my_req)
-      request.content.should equal(my_req)
+      expect(request.read(path)).to equal(my_req)
+      expect(request.content).to equal(my_req)
     end
 
     it "should return an empty string when converted to a string with no request" do
-      request.to_s.should == ""
+      expect(request.to_s).to eq("")
     end
 
     it "should convert the request to pem format when converted to a string" do
       request.generate(key)
-      request.to_s.should == request.content.to_pem
+      expect(request.to_s).to eq(request.content.to_pem)
     end
 
     it "should have a :to_text method that it delegates to the actual key" do
       real_request = mock 'request'
       real_request.expects(:to_text).returns "requesttext"
       request.content = real_request
-      request.to_text.should == "requesttext"
+      expect(request.to_text).to eq("requesttext")
     end
   end
 
   describe "when generating" do
     it "should use the content of the provided key if the key is a Puppet::SSL::Key instance" do
       request.generate(key)
-      request.content.verify(key.content.public_key).should be_true
+      expect(request.content.verify(key.content.public_key)).to be_truthy
     end
 
     it "should set the subject to [CN, name]" do
       request.generate(key)
       # OpenSSL::X509::Name only implements equality as `eql?`
-      request.content.subject.should eql OpenSSL::X509::Name.new([['CN', key.name]])
+      expect(request.content.subject).to eql OpenSSL::X509::Name.new([['CN', key.name]])
     end
 
     it "should set the CN to the :ca_name setting when the CSR is for a CA" do
       Puppet[:ca_name] = "mycertname"
       request = described_class.new(Puppet::SSL::CA_NAME).generate(key)
-      request.subject.should eql OpenSSL::X509::Name.new([['CN', Puppet[:ca_name]]])
+      expect(request.subject).to eql OpenSSL::X509::Name.new([['CN', Puppet[:ca_name]]])
     end
 
     it "should set the version to 0" do
       request.generate(key)
-      request.content.version.should == 0
+      expect(request.content.version).to eq(0)
     end
 
     it "should set the public key to the provided key's public key" do
       request.generate(key)
       # The openssl bindings do not define equality on keys so we use to_s
-      request.content.public_key.to_s.should == key.content.public_key.to_s
+      expect(request.content.public_key.to_s).to eq(key.content.public_key.to_s)
     end
 
     context "without subjectAltName / dns_alt_names" do
@@ -121,14 +121,14 @@ describe Puppet::SSL::CertificateRequest do
       ["extreq", "msExtReq"].each do |name|
         it "should not add any #{name} attribute" do
           request.generate(key)
-          request.content.attributes.find do |attr|
+          expect(request.content.attributes.find do |attr|
             attr.oid == name
-          end.should_not be
+          end).not_to be
         end
 
         it "should return no subjectAltNames" do
           request.generate(key)
-          request.subject_alt_names.should be_empty
+          expect(request.subject_alt_names).to be_empty
         end
       end
     end
@@ -141,14 +141,14 @@ describe Puppet::SSL::CertificateRequest do
       ["extreq", "msExtReq"].each do |name|
         it "should not add any #{name} attribute" do
           request.generate(key)
-          request.content.attributes.find do |attr|
+          expect(request.content.attributes.find do |attr|
             attr.oid == name
-          end.should_not be
+          end).not_to be
         end
 
         it "should return no subjectAltNames" do
           request.generate(key)
-          request.subject_alt_names.should be_empty
+          expect(request.subject_alt_names).to be_empty
         end
       end
     end
@@ -164,17 +164,17 @@ describe Puppet::SSL::CertificateRequest do
           attr.oid == 'extReq'
         end
 
-        extReq.should be
+        expect(extReq).to be
         extReq.value.value.all? do |x|
           x.value.all? do |y|
-            y.value[0].value.should == "subjectAltName"
+            expect(y.value[0].value).to eq("subjectAltName")
           end
         end
       end
 
       it "should return the subjectAltName values" do
         request.generate(key, :dns_alt_names => 'one,two')
-        request.subject_alt_names.should =~ ["DNS:myname", "DNS:one", "DNS:two"]
+        expect(request.subject_alt_names).to match_array(["DNS:myname", "DNS:one", "DNS:two"])
       end
     end
 
@@ -189,8 +189,8 @@ describe Puppet::SSL::CertificateRequest do
         request.generate(key, :csr_attributes => csr_attributes)
 
         attrs = request.custom_attributes
-        attrs.should include({'oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'CSR specific info'})
-        attrs.should include({'oid' => '1.3.6.1.4.1.34380.1.2.2', 'value' => 'more CSR specific info'})
+        expect(attrs).to include({'oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'CSR specific info'})
+        expect(attrs).to include({'oid' => '1.3.6.1.4.1.34380.1.2.2', 'value' => 'more CSR specific info'})
       end
 
       ['extReq', '1.2.840.113549.1.9.14'].each do |oid|
@@ -216,6 +216,16 @@ describe Puppet::SSL::CertificateRequest do
           request.generate(key, :csr_attributes => csr_attributes)
         end.to raise_error Puppet::Error, /Cannot create CSR with attribute thats\.no\.moon: first num too large/
       end
+
+      it "should support old non-DER encoded extensions" do
+        csr = OpenSSL::X509::Request.new(File.read(my_fixture("old-style-cert-request.pem")))
+        wrapped_csr = Puppet::SSL::CertificateRequest.from_instance csr
+        exts = wrapped_csr.request_extensions()
+
+        expect(exts.find { |ext| ext['oid'] == 'pp_uuid' }['value']).to eq('I-AM-A-UUID')
+        expect(exts.find { |ext| ext['oid'] == 'pp_instance_id' }['value']).to eq('i_am_an_id')
+        expect(exts.find { |ext| ext['oid'] == 'pp_image_name' }['value']).to eq('i_am_an_image_name')
+      end
     end
 
     context "with extension requests" do
@@ -230,7 +240,7 @@ describe Puppet::SSL::CertificateRequest do
         request.generate(key, :extension_requests => extension_data)
 
         exts = request.content.attributes.select { |attr| attr.oid = 'extReq' }
-        exts.length.should == 1
+        expect(exts.length).to eq(1)
       end
 
       it "adds an extension for each entry in the extension request structure" do
@@ -238,14 +248,14 @@ describe Puppet::SSL::CertificateRequest do
 
         exts = request.request_extensions
 
-        exts.should include('oid' => '1.3.6.1.4.1.34380.1.1.31415', 'value' => 'pi')
-        exts.should include('oid' => '1.3.6.1.4.1.34380.1.1.2718', 'value' => 'e')
+        expect(exts).to include('oid' => '1.3.6.1.4.1.34380.1.1.31415', 'value' => 'pi')
+        expect(exts).to include('oid' => '1.3.6.1.4.1.34380.1.1.2718', 'value' => 'e')
       end
 
       it "defines the extensions as non-critical" do
         request.generate(key, :extension_requests => extension_data)
         request.request_extensions.each do |ext|
-          ext['critical'].should be_false
+          expect(ext['critical']).to be_falsey
         end
       end
 
@@ -266,11 +276,11 @@ describe Puppet::SSL::CertificateRequest do
                          :extension_requests => extension_data)
         exts = request.request_extensions
 
-        exts.should include('oid' => '1.3.6.1.4.1.34380.1.1.31415', 'value' => 'pi')
-        exts.should include('oid' => '1.3.6.1.4.1.34380.1.1.2718', 'value' => 'e')
-        exts.should include('oid' => 'subjectAltName', 'value' => 'DNS:first.tld, DNS:myname, DNS:second.tld')
+        expect(exts).to include('oid' => '1.3.6.1.4.1.34380.1.1.31415', 'value' => 'pi')
+        expect(exts).to include('oid' => '1.3.6.1.4.1.34380.1.1.2718', 'value' => 'e')
+        expect(exts).to include('oid' => 'subjectAltName', 'value' => 'DNS:first.tld, DNS:myname, DNS:second.tld')
 
-        request.subject_alt_names.should eq ['DNS:first.tld', 'DNS:myname', 'DNS:second.tld']
+        expect(request.subject_alt_names).to eq ['DNS:first.tld', 'DNS:myname', 'DNS:second.tld']
       end
 
       it "raises an error if the OID could not be created" do
@@ -283,7 +293,7 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should sign the csr with the provided key" do
       request.generate(key)
-      request.content.verify(key.content.public_key).should be_true
+      expect(request.content.verify(key.content.public_key)).to be_truthy
     end
 
     it "should verify the generated request using the public key" do
@@ -313,8 +323,8 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should return the generated request" do
       generated = request.generate(key)
-      generated.should be_a(OpenSSL::X509::Request)
-      generated.should be(request.content)
+      expect(generated).to be_a(OpenSSL::X509::Request)
+      expect(generated).to be(request.content)
     end
 
     it "should use SHA1 to sign the csr when SHA256 isn't available" do
@@ -323,7 +333,7 @@ describe Puppet::SSL::CertificateRequest do
       OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(true)
       signer = Puppet::SSL::CertificateSigner.new
       signer.sign(csr, key.content)
-      csr.verify(key.content).should be_true
+      expect(csr.verify(key.content)).to be_truthy
     end
 
     it "should raise an error if neither SHA256 nor SHA1 are available" do
@@ -365,5 +375,7 @@ describe Puppet::SSL::CertificateRequest do
         Puppet::SSL::CertificateRequest.indirection.save(csr)
       end
     end
+
+
   end
 end

data/spec/unit/ssl/certificate_revocation_list_spec.rb

@@ -48,7 +48,7 @@ describe Puppet::SSL::CertificateRevocationList do
   end
 
   it "should only support the text format" do
-    @class.supported_formats.should == [:s]
+    expect(@class.supported_formats).to eq([:s])
   end
 
   describe "when converting from a string" do
@@ -67,11 +67,11 @@ describe Puppet::SSL::CertificateRevocationList do
     end
 
     it "should always use 'crl' for its name" do
-      @crl.name.should == "crl"
+      expect(@crl.name).to eq("crl")
     end
 
     it "should have a content attribute" do
-      @crl.should respond_to(:content)
+      expect(@crl).to respond_to(:content)
     end
   end
 
@@ -81,15 +81,15 @@ describe Puppet::SSL::CertificateRevocationList do
     end
 
     it "should set its issuer to the subject of the passed certificate" do
-      @crl.generate(@cert, @key).issuer.to_s.should == @cert.subject.to_s
+      expect(@crl.generate(@cert, @key).issuer.to_s).to eq(@cert.subject.to_s)
     end
 
     it "should set its version to 1" do
-      @crl.generate(@cert, @key).version.should == 1
+      expect(@crl.generate(@cert, @key).version).to eq(1)
     end
 
     it "should create an instance of OpenSSL::X509::CRL" do
-      @crl.generate(@cert, @key).should be_an_instance_of(OpenSSL::X509::CRL)
+      expect(@crl.generate(@cert, @key)).to be_an_instance_of(OpenSSL::X509::CRL)
     end
 
     it "should add an extension for the CRL number" do
@@ -107,25 +107,25 @@ describe Puppet::SSL::CertificateRevocationList do
     it "returns the last update time in UTC" do
       # http://tools.ietf.org/html/rfc5280#section-5.1.2.4
       thisUpdate = @crl.generate(@cert, @key).last_update
-      thisUpdate.should be_utc
+      expect(thisUpdate).to be_utc
       expects_time_close_to_now(thisUpdate)
     end
 
     it "returns the next update time in UTC 5 years from now" do
       # http://tools.ietf.org/html/rfc5280#section-5.1.2.5
       nextUpdate = @crl.generate(@cert, @key).next_update
-      nextUpdate.should be_utc
+      expect(nextUpdate).to be_utc
       expects_time_close_to_five_years(nextUpdate)
     end
 
     it "should verify using the CA public_key" do
-      @crl.generate(@cert, @key).verify(@key.public_key).should be_true
+      expect(@crl.generate(@cert, @key).verify(@key.public_key)).to be_truthy
     end
 
     it "should set the content to the generated crl" do
       # this test shouldn't be needed since we test the return of generate() which should be the content field
       @crl.generate(@cert, @key)
-      @crl.content.should be_an_instance_of(OpenSSL::X509::CRL)
+      expect(@crl.content).to be_an_instance_of(OpenSSL::X509::CRL)
     end
   end
 

data/spec/unit/ssl/certificate_spec.rb

@@ -4,6 +4,14 @@ require 'spec_helper'
 require 'puppet/ssl/certificate'
 
 describe Puppet::SSL::Certificate do
+  let :key do Puppet::SSL::Key.new("test.localdomain").generate end
+
+  # Sign the provided cert so that it can be DER-decoded later
+  def sign_wrapped_cert(cert)
+    signer = Puppet::SSL::CertificateSigner.new
+    signer.sign(cert.content, key)
+  end
+
   before do
     @class = Puppet::SSL::Certificate
   end
@@ -13,15 +21,15 @@ describe Puppet::SSL::Certificate do
   end
 
   it "should be extended with the Indirector module" do
-    @class.singleton_class.should be_include(Puppet::Indirector)
+    expect(@class.singleton_class).to be_include(Puppet::Indirector)
   end
 
   it "should indirect certificate" do
-    @class.indirection.name.should == :certificate
+    expect(@class.indirection.name).to eq(:certificate)
   end
 
   it "should only support the text format" do
-    @class.supported_formats.should == [:s]
+    expect(@class.supported_formats).to eq([:s])
   end
 
   describe "when converting from a string" do
@@ -45,7 +53,7 @@ describe Puppet::SSL::Certificate do
       cert2 = stub 'cert2'
       @class.expects(:from_s).with("cert2").returns cert2
 
-      @class.from_multiple_s("cert1\n---\ncert2").should == [cert1, cert2]
+      expect(@class.from_multiple_s("cert1\n---\ncert2")).to eq([cert1, cert2])
     end
   end
 
@@ -55,13 +63,13 @@ describe Puppet::SSL::Certificate do
     end
 
     it "should return an empty string when it has no certificate" do
-      @certificate.to_s.should == ""
+      expect(@certificate.to_s).to eq("")
     end
 
     it "should convert the certificate to pem format" do
       certificate = mock 'certificate', :to_pem => "pem"
       @certificate.content = certificate
-      @certificate.to_s.should == "pem"
+      expect(@certificate.to_s).to eq("pem")
     end
 
     it "should be able to convert multiple instances to a string" do
@@ -69,7 +77,7 @@ describe Puppet::SSL::Certificate do
       @certificate.expects(:to_s).returns "cert1"
       cert2.expects(:to_s).returns "cert2"
 
-      @class.to_multiple_s([@certificate, cert2]).should == "cert1\n---\ncert2"
+      expect(@class.to_multiple_s([@certificate, cert2])).to eq("cert1\n---\ncert2")
 
     end
   end
@@ -91,27 +99,27 @@ describe Puppet::SSL::Certificate do
     end
 
     it "should have a name attribute" do
-      @certificate.name.should == "myname"
+      expect(@certificate.name).to eq("myname")
     end
 
     it "should convert its name to a string and downcase it" do
-      @class.new(:MyName).name.should == "myname"
+      expect(@class.new(:MyName).name).to eq("myname")
     end
 
     it "should have a content attribute" do
-      @certificate.should respond_to(:content)
+      expect(@certificate).to respond_to(:content)
     end
 
     describe "#subject_alt_names" do
       it "should list all alternate names when the extension is present" do
         certificate = build_cert(:dns_alt_names => 'foo, bar,baz')
-        certificate.subject_alt_names.
-          should =~ ['DNS:foo', 'DNS:bar', 'DNS:baz', 'DNS:quux']
+        expect(certificate.subject_alt_names).
+          to match_array(['DNS:foo', 'DNS:bar', 'DNS:baz', 'DNS:quux'])
       end
 
       it "should return an empty list of names if the extension is absent" do
         certificate = build_cert({})
-        certificate.subject_alt_names.should be_empty
+        expect(certificate.subject_alt_names).to be_empty
       end
     end
 
@@ -119,12 +127,14 @@ describe Puppet::SSL::Certificate do
       it "returns extensions under the ppRegCertExt" do
         exts = {'pp_uuid' => 'abcdfd'}
         cert = build_cert(:extension_requests => exts)
+        sign_wrapped_cert(cert)
         expect(cert.custom_extensions).to include('oid' => 'pp_uuid', 'value' => 'abcdfd')
       end
 
       it "returns extensions under the ppPrivCertExt" do
         exts = {'1.3.6.1.4.1.34380.1.2.1' => 'x509 :('}
         cert = build_cert(:extension_requests => exts)
+        sign_wrapped_cert(cert)
         expect(cert.custom_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'x509 :(')
       end
 
@@ -138,7 +148,7 @@ describe Puppet::SSL::Certificate do
     it "should return a nil expiration if there is no actual certificate" do
       @certificate.stubs(:content).returns nil
 
-      @certificate.expiration.should be_nil
+      expect(@certificate.expiration).to be_nil
     end
 
     it "should use the expiration of the certificate as its expiration date" do
@@ -147,7 +157,7 @@ describe Puppet::SSL::Certificate do
 
       cert.expects(:not_after).returns "sometime"
 
-      @certificate.expiration.should == "sometime"
+      expect(@certificate.expiration).to eq("sometime")
     end
 
     it "should be able to read certificates from disk" do
@@ -155,39 +165,26 @@ describe Puppet::SSL::Certificate do
       File.expects(:read).with(path).returns("my certificate")
       certificate = mock 'certificate'
       OpenSSL::X509::Certificate.expects(:new).with("my certificate").returns(certificate)
-      @certificate.read(path).should equal(certificate)
-      @certificate.content.should equal(certificate)
+      expect(@certificate.read(path)).to equal(certificate)
+      expect(@certificate.content).to equal(certificate)
     end
 
     it "should have a :to_text method that it delegates to the actual key" do
       real_certificate = mock 'certificate'
       real_certificate.expects(:to_text).returns "certificatetext"
       @certificate.content = real_certificate
-      @certificate.to_text.should == "certificatetext"
-    end
-  end
-
-  describe "when checking if the certificate's expiration is approaching" do
-    before do
-      @days = 24*60*60
-      @certificate = @class.new("myname")
-      @certificate.stubs(:expiration).returns(Time.now.utc() + 30*@days)
+      expect(@certificate.to_text).to eq("certificatetext")
     end
 
-    it "should be true if the expiration is within the given interval from now" do
-      @certificate.near_expiration?(31*@days).should be_true
-    end
+    it "should parse the old non-DER encoded extension values" do
+      cert = OpenSSL::X509::Certificate.new(File.read(my_fixture("old-style-cert-exts.pem")))
+      wrapped_cert = Puppet::SSL::Certificate.from_instance cert
+      exts = wrapped_cert.custom_extensions
 
-    it "should be false if there is no expiration" do
-      @certificate.stubs(:expiration).returns(nil)
-      @certificate.near_expiration?.should be_false
+      expect(exts.find { |ext| ext['oid'] == 'pp_uuid'}['value']).to eq('I-AM-A-UUID')
+      expect(exts.find { |ext| ext['oid'] == 'pp_instance_id'}['value']).to eq('i_am_an_id')
+      expect(exts.find { |ext| ext['oid'] == 'pp_image_name'}['value']).to eq('i_am_an_image_name')
     end
 
-    it "should default to using the `certificate_expire_warning` setting as the interval" do
-      Puppet[:certificate_expire_warning] = 31*@days
-      @certificate.near_expiration?.should be_true
-      Puppet[:certificate_expire_warning] = 29*@days
-      @certificate.near_expiration?.should be_false
-    end
   end
 end