puppet 3.8.7 → 4.0.0.rc1

data/spec/integration/type/package_spec.rb

@@ -8,21 +8,120 @@ describe Puppet::Type.type(:package), "when choosing a default package provider"
   end
 
   def provider_name(os)
-    if Facter.value(:operatingsystem) == 'Solaris' && Puppet::Util::Package.versioncmp(Facter.value(:kernelrelease), '5.11') >= 0
-      :pkg
-    else
-      {"Ubuntu" => :apt, "Debian" => :apt, "Darwin" => :pkgdmg, "RedHat" => :up2date, "Fedora" => :yum, "FreeBSD" => :ports, "OpenBSD" => :openbsd, "Solaris" => :sun, "DragonFly" => :pkgin, "OpenWrt" => :opkg}[os]
+    case os
+    when 'Solaris'
+      if Puppet::Util::Package.versioncmp(Facter.value(:kernelrelease), '5.11') >= 0
+        :pkg
+      else
+        :sun
+      end
+    when 'Ubuntu'
+      :apt
+    when 'Debian'
+      :apt
+    when 'Darwin'
+      :pkgdmg
+    when 'RedHat'
+      if ['2.1', '3', '4'].include?(Facter.value(:lsbdistrelease))
+        :up2date
+      else
+        :yum
+      end
+    when 'Fedora'
+      :yum
+    when 'FreeBSD'
+      :ports
+    when 'OpenBSD'
+      :openbsd
+    when 'DragonFly'
+      :pkgin
+    when 'OpenWrt'
+      :opkg
     end
   end
 
   it "should have a default provider" do
-    Puppet::Type.type(:package).defaultprovider.should_not be_nil
+    expect(Puppet::Type.type(:package).defaultprovider).not_to be_nil
   end
 
   it "should choose the correct provider each platform" do
     unless default_provider = provider_name(Facter.value(:operatingsystem))
       pending("No default provider specified in this test for #{Facter.value(:operatingsystem)}")
     end
-    Puppet::Type.type(:package).defaultprovider.name.should == default_provider
+    expect(Puppet::Type.type(:package).defaultprovider.name).to eq(default_provider)
   end
 end
+
+describe Puppet::Type.type(:package), "when packages with the same name are sourced" do
+  before :each do
+    @provider = stub(
+      'provider',
+      :class           => Puppet::Type.type(:package).defaultprovider,
+      :clear           => nil,
+      :satisfies?      => true,
+      :name            => :mock,
+      :validate_source => nil
+    )
+    Puppet::Type.type(:package).defaultprovider.stubs(:new).returns(@provider)
+    Puppet::Type.type(:package).defaultprovider.stubs(:instances).returns([])
+    @package = Puppet::Type.type(:package).new(:name => "yay", :ensure => :present)
+
+    @catalog = Puppet::Resource::Catalog.new
+    @catalog.add_resource(@package)
+  end
+
+  describe "with same title" do
+    before {
+      @alt_package = Puppet::Type.type(:package).new(:name => "yay", :ensure => :present)
+    }
+    it "should give an error" do
+      expect {
+        @catalog.add_resource(@alt_package)
+      }.to raise_error Puppet::Resource::Catalog::DuplicateResourceError, 'Duplicate declaration: Package[yay] is already declared; cannot redeclare'
+    end
+  end
+
+  describe "with different title" do
+    before :each do
+      @alt_package = Puppet::Type.type(:package).new(:name => "yay", :title => "gem-yay", :ensure => :present)
+    end
+
+    it "should give an error" do
+      provider_name = Puppet::Type.type(:package).defaultprovider.name
+      expect {
+        @catalog.add_resource(@alt_package)
+      }.to raise_error ArgumentError, "Cannot alias Package[gem-yay] to [\"yay\", :#{provider_name}]; resource [\"Package\", \"yay\", :#{provider_name}] already declared"
+    end
+  end
+
+  describe "from multiple providers" do
+    provider_class = Puppet::Type.type(:package).provider(:gem)
+
+    before :each do
+      @alt_provider = provider_class.new
+      @alt_package = Puppet::Type.type(:package).new(:name => "yay", :title => "gem-yay", :provider => @alt_provider, :ensure => :present)
+      @catalog.add_resource(@alt_package)
+    end
+
+    describe "when it should be present" do
+      [:present, :latest, "1.0"].each do |state|
+        it "should do nothing if it is #{state.to_s}" do
+          @provider.expects(:properties).returns(:ensure => state).at_least_once
+          @alt_provider.expects(:properties).returns(:ensure => state).at_least_once
+          @catalog.apply
+        end
+      end
+
+      [:purged, :absent].each do |state|
+        it "should install if it is #{state.to_s}" do
+          @provider.stubs(:properties).returns(:ensure => state)
+          @provider.expects(:install)
+          @alt_provider.stubs(:properties).returns(:ensure => state)
+          @alt_provider.expects(:install)
+          @catalog.apply
+        end
+      end
+    end
+  end
+end
+

data/spec/integration/type/tidy_spec.rb

@@ -29,6 +29,6 @@ describe Puppet::Type.type(:tidy) do
 
     catalog.apply
 
-    Puppet::FileSystem.symlink?(link).should be_false
+    expect(Puppet::FileSystem.symlink?(link)).to be_falsey
   end
 end

data/spec/integration/type/user_spec.rb

@@ -22,12 +22,12 @@ describe Puppet::Type.type(:user), '(integration)', :unless => Puppet.features.m
 
     it "should purge authorized ssh keys" do
       apply_compiled_manifest(manifest)
-      File.read(tempfile).should_not =~ /key-name/
+      expect(File.read(tempfile)).not_to match(/key-name/)
     end
 
     it "should purge keys with spaces in the comment string" do
       apply_compiled_manifest(manifest)
-      File.read(tempfile).should_not =~ /key name/
+      expect(File.read(tempfile)).not_to match(/key name/)
     end
 
     context "with other prefetching resources evaluated first" do
@@ -35,7 +35,7 @@ describe Puppet::Type.type(:user), '(integration)', :unless => Puppet.features.m
 
       it "should purge authorized ssh keys" do
         apply_compiled_manifest(manifest)
-        File.read(tempfile).should_not =~ /key-name/
+        expect(File.read(tempfile)).not_to match(/key-name/)
       end
     end
 
@@ -50,7 +50,7 @@ describe Puppet::Type.type(:user), '(integration)', :unless => Puppet.features.m
 
       it "should purge authorized ssh keys" do
         apply_compiled_manifest(manifest)
-        File.read(tempfile).should_not =~ /KEY-DATA/
+        expect(File.read(tempfile)).not_to match(/KEY-DATA/)
       end
     end
   end

data/spec/integration/type_spec.rb

@@ -16,7 +16,7 @@ describe Puppet::Type do
       newparam(:name) {}
     end
 
-    type.provider(:myprovider).should equal(provider)
+    expect(type.provider(:myprovider)).to equal(provider)
   end
 
   it "should not lose its provider parameter when it is reloaded" do
@@ -27,6 +27,6 @@ describe Puppet::Type do
     # reload it
     type = Puppet::Type.newtype(:reload_test_type)
 
-    type.parameters.should include(:provider)
+    expect(type.parameters).to include(:provider)
   end
 end

data/spec/integration/util/autoload_spec.rb

@@ -48,21 +48,16 @@ describe Puppet::Util::Autoload do
     AutoloadIntegrator.clear
   end
 
-  it "should make instances available by the loading class" do
-    loader = Puppet::Util::Autoload.new("foo", "bar")
-    Puppet::Util::Autoload["foo"].should == loader
-  end
-
   it "should not fail when asked to load a missing file" do
-    Puppet::Util::Autoload.new("foo", "bar").load(:eh).should be_false
+    expect(Puppet::Util::Autoload.new("foo", "bar").load(:eh)).to be_falsey
   end
 
   it "should load and return true when it successfully loads a file" do
     with_loader("foo", "bar") { |dir,loader|
       with_file(:mything, dir, "mything.rb") {
-        loader.load(:mything).should be_true
-        loader.class.should be_loaded("bar/mything")
-        AutoloadIntegrator.should be_thing(:mything)
+        expect(loader.load(:mything)).to be_truthy
+        expect(loader.class).to be_loaded("bar/mything")
+        expect(AutoloadIntegrator).to be_thing(:mything)
       }
     }
   end
@@ -71,7 +66,7 @@ describe Puppet::Util::Autoload do
     with_loader("foo", "bar") { |dir,loader|
       with_file(:noext, dir, "noext.rb") {
         loader.load(:noext)
-        loader.class.should be_loaded("bar/noext")
+        expect(loader.class).to be_loaded("bar/noext")
       }
     }
   end
@@ -80,7 +75,7 @@ describe Puppet::Util::Autoload do
     with_loader("foo", "bar") { |dir,loader|
       with_file(:noext, dir, "withext.rb") {
         loader.load(:withext)
-        loader.class.should be_loaded("bar/withext.rb")
+        expect(loader.class).to be_loaded("bar/withext.rb")
       }
     }
   end
@@ -99,7 +94,7 @@ describe Puppet::Util::Autoload do
       with_loader("foo", "foo") do |dir, loader|
         with_file(:plugin, file.split("/")) do
           loader.load(:plugin)
-          loader.class.should be_loaded("foo/plugin.rb")
+          expect(loader.class).to be_loaded("foo/plugin.rb")
         end
       end
     end

data/spec/integration/util/rdoc/parser_spec.rb

@@ -113,18 +113,18 @@ end
   end
 
   def file_exists_and_matches_content(file, *content_patterns)
-    Puppet::FileSystem.exist?(file).should(be_true, "Cannot find #{file}")
+    expect(Puppet::FileSystem.exist?(file)).to(be_truthy, "Cannot find #{file}")
     content_patterns.each do |pattern|
       content = File.read(file)
-      content.should match(pattern)
+      expect(content).to match(pattern)
     end
   end
 
   def some_file_exists_with_matching_content(glob, *content_patterns)
-    Dir.glob(glob).select do |f|
+    expect(Dir.glob(glob).select do |f|
       contents = File.read(f)
       content_patterns.all? { |p| p.match(contents) }
-    end.should_not(be_empty, "Could not match #{content_patterns} in any of the files found in #{glob}")
+    end).not_to(be_empty, "Could not match #{content_patterns} in any of the files found in #{glob}")
   end
 
   around(:each) do |example|
@@ -142,51 +142,21 @@ end
   end
 
   module RdocTesters
-    def has_module_rdoc(module_name, *other_test_patterns)
-      file_exists_and_matches_content(module_path(module_name), /Module:? +#{module_name}/i, *other_test_patterns)
-    end
-
-    def has_node_rdoc(module_name, node_name, *other_test_patterns)
-      file_exists_and_matches_content(node_path(module_name, node_name), /#{node_name}/, /node comment/, *other_test_patterns)
-    end
-
-    def has_defined_type(module_name, type_name)
-      file_exists_and_matches_content(module_path(module_name), /#{type_name}.*?\(\s*\)/m, "The .*?#{type_name}.*? type comment")
-    end
-
-    def has_class_rdoc(module_name, class_name, *other_test_patterns)
-      file_exists_and_matches_content(class_path(module_name, class_name), /#{class_name}.*? class comment/, *other_test_patterns)
-    end
-
     def has_plugin_rdoc(module_name, type, name)
       file_exists_and_matches_content(plugin_path(module_name, type, name), /The .*?#{name}.*?\s*#{type} comment/m, /Type.*?#{type}/m)
     end
   end
 
   shared_examples_for :an_rdoc_site do
-    it "documents the __site__ module" do
-      has_module_rdoc("__site__")
-    end
-
-    it "documents the __site__::test class" do
-      has_class_rdoc("__site__", "test")
-    end
+    # PUP-3274 / PUP-3638 not sure if this should be kept or not - it is now broken
+#    it "documents the __site__ module" do
+#      has_module_rdoc("__site__")
+#    end
 
-    it "documents the __site__::foo node" do
-      has_node_rdoc("__site__", "foo")
-    end
-
-    it "documents the a_module module" do
-      has_module_rdoc("a_module", /The .*?a_module.*? .*?README.*?docs/m)
-    end
-
-    it "documents the a_module::a_module class" do
-      has_class_rdoc("a_module", "a_module")
-    end
-
-    it "documents the a_module::a_type defined type" do
-      has_defined_type("a_module", "a_type")
-    end
+    # PUP-3274 / PUP-3638 not sure if this should be kept or not - it is now broken
+#    it "documents the a_module module" do
+#      has_module_rdoc("a_module", /The .*?a_module.*? .*?README.*?docs/m)
+#    end
 
     it "documents the a_module::a_plugin type" do
       has_plugin_rdoc("a_module", :type, 'a_plugin')
@@ -199,66 +169,10 @@ end
     it "documents the a_module::a_fact fact" do
       has_plugin_rdoc("a_module", :fact, 'a_fact')
     end
-
-    it "documents included classes" do
-      has_class_rdoc("__site__", "includes_another", /Included.*?another/m)
-    end
-  end
-
-  shared_examples_for :an_rdoc1_site do
-    it "documents required classes" do
-      has_class_rdoc("__site__", "requires_another", /Required Classes.*?another/m)
-    end
-
-    it "documents realized resources" do
-      has_node_rdoc("__site__", "foo", /Realized Resources.*?Notify\[virtual\]/m)
-    end
-
-    it "documents global variables" do
-      has_node_rdoc("__site__", "foo", /Global Variables.*?a_var.*?=.*?var_value/m)
-    end
-
-    describe "when document_all is true" do
-      let(:document_all) { true }
-
-      it "documents virtual resource declarations" do
-        has_class_rdoc("__site__", "test", /Resources.*?Notify\[virtual\]/m, /The virtual resource comment/)
-      end
-
-      it "documents resources" do
-        has_class_rdoc("__site__", "test", /Resources.*?Notify\[a_notify_resource\]/m, /message => "a_notify_resource message"/, /The a_notify_resource comment/)
-      end
-    end
-  end
-
-  describe "rdoc1 support", :if => Puppet.features.rdoc1? do
-    def module_path(module_name); "#{doc_dir}/classes/#{module_name}.html" end
-    def node_path(module_name, node_name);  "#{doc_dir}/nodes/**/*.html" end
-    def class_path(module_name, class_name); "#{doc_dir}/classes/#{module_name}/#{class_name}.html" end
-    def plugin_path(module_name, type, name); "#{doc_dir}/plugins/#{name}.html" end
-
-    include RdocTesters
-
-    def has_node_rdoc(module_name, node_name, *other_test_patterns)
-      some_file_exists_with_matching_content(node_path(module_name, node_name), /#{node_name}/, /node comment/, *other_test_patterns)
-    end
-
-    it_behaves_like :an_rdoc_site
-    it_behaves_like :an_rdoc1_site
-
-    it "references nodes and classes in the __site__ module" do
-      file_exists_and_matches_content("#{doc_dir}/classes/__site__.html", /Node.*__site__::foo/, /Class.*__site__::test/)
-    end
-
-    it "references functions, facts, and type plugins in the a_module module" do
-      file_exists_and_matches_content("#{doc_dir}/classes/a_module.html", /a_function/, /a_fact/, /a_plugin/, /Class.*a_module::a_module/)
-    end
   end
 
-  describe "rdoc2 support", :if => !Puppet.features.rdoc1? do
+  describe "rdoc2 support" do
     def module_path(module_name); "#{doc_dir}/#{module_name}.html" end
-    def node_path(module_name, node_name);  "#{doc_dir}/#{module_name}/__nodes__/#{node_name}.html" end
-    def class_path(module_name, class_name); "#{doc_dir}/#{module_name}/#{class_name}.html" end
     def plugin_path(module_name, type, name); "#{doc_dir}/#{module_name}/__#{type}s__.html" end
 
     include RdocTesters

data/spec/integration/util/settings_spec.rb

@@ -26,7 +26,7 @@ describe Puppet::Settings do
     )
     settings.use(:main)
 
-    expect(File.directory?(settings[:maindir])).to be_true
+    expect(File.directory?(settings[:maindir])).to be_truthy
   end
 
   it "should make its directories with the correct modes" do

data/spec/integration/util/windows/process_spec.rb

@@ -9,20 +9,20 @@ describe "Puppet::Util::Windows::Process", :if => Puppet.features.microsoft_wind
       :if => Facter.value(:kernelmajversion).to_f >= 6.0 && Puppet.features.microsoft_windows? do
       # this is a bit of a lame duck test since it requires running user to be admin
       # a better integration test would create a new user with the privilege and verify
-      Puppet::Util::Windows::User.should be_admin
-      Puppet::Util::Windows::Process.process_privilege_symlink?.should be_true
+      expect(Puppet::Util::Windows::User).to be_admin
+      expect(Puppet::Util::Windows::Process.process_privilege_symlink?).to be_truthy
     end
 
     it "should not have the SeCreateSymbolicLinkPrivilege necessary to create symlinks on 2003 and earlier",
       :if => Facter.value(:kernelmajversion).to_f < 6.0 && Puppet.features.microsoft_windows? do
-      Puppet::Util::Windows::User.should be_admin
-      Puppet::Util::Windows::Process.process_privilege_symlink?.should be_false
+      expect(Puppet::Util::Windows::User).to be_admin
+      expect(Puppet::Util::Windows::Process.process_privilege_symlink?).to be_falsey
     end
 
     it "should be able to lookup a standard Windows process privilege" do
       Puppet::Util::Windows::Process.lookup_privilege_value('SeShutdownPrivilege') do |luid|
-        luid.should_not be_nil
-        luid.should be_instance_of(Puppet::Util::Windows::Process::LUID)
+        expect(luid).not_to be_nil
+        expect(luid).to be_instance_of(Puppet::Util::Windows::Process::LUID)
       end
     end
 

data/spec/integration/util/windows/security_spec.rb

@@ -15,6 +15,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
     @sids = {
       :current_user => Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name),
       :system => Win32::Security::SID::LocalSystem,
+      :admin => Puppet::Util::Windows::SID.name_to_sid("Administrator"),
       :administrators => Win32::Security::SID::BuiltinAdministrators,
       :guest => Puppet::Util::Windows::SID.name_to_sid("Guest"),
       :users => Win32::Security::SID::BuiltinUsers,
@@ -70,7 +71,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       winsec.set_group(sids[:current_user], path)
       winsec.set_mode(0700, path)
 
-      lambda { check_delete(path) }.should raise_error(Errno::EACCES)
+      expect { check_delete(path) }.to raise_error(Errno::EACCES)
     end
 
     it "should deny group" do
@@ -78,7 +79,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       winsec.set_group(sids[:current_user], path)
       winsec.set_mode(0700, path)
 
-      lambda { check_delete(path) }.should raise_error(Errno::EACCES)
+      expect { check_delete(path) }.to raise_error(Errno::EACCES)
     end
 
     it "should deny other" do
@@ -86,7 +87,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       winsec.set_group(sids[:current_user], path)
       winsec.set_mode(0700, path)
 
-      lambda { check_delete(path) }.should raise_error(Errno::EACCES)
+      expect { check_delete(path) }.to raise_error(Errno::EACCES)
     end
   end
 
@@ -96,7 +97,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         it "should return nil #{p}" do
           winsec.stubs(:supports_acl?).returns false
 
-          winsec.send("get_#{p}", path).should be_nil
+          expect(winsec.send("get_#{p}", path)).to be_nil
         end
       end
     end
@@ -115,7 +116,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         describe "#supports_acl?" do
           %w[c:/ c:\\ c:/windows/system32 \\\\localhost\\C$ \\\\127.0.0.1\\C$\\foo].each do |path|
             it "should accept #{path}" do
-              winsec.should be_supports_acl(path)
+              expect(winsec).to be_supports_acl(path)
             end
           end
 
@@ -132,17 +133,17 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           end
 
           it "should raise an exception when setting to a different user" do
-            lambda { winsec.set_owner(sids[:guest], path) }.should raise_error(Puppet::Error, /This security ID may not be assigned as the owner of this object./)
+            expect { winsec.set_owner(sids[:guest], path) }.to raise_error(Puppet::Error, /This security ID may not be assigned as the owner of this object./)
           end
         end
 
         describe "#owner" do
           it "it should not be empty" do
-            winsec.get_owner(path).should_not be_empty
+            expect(winsec.get_owner(path)).not_to be_empty
           end
 
           it "should raise an exception if an invalid path is provided" do
-            lambda { winsec.get_owner("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
+            expect { winsec.get_owner("c:\\doesnotexist.txt") }.to raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
@@ -160,32 +161,32 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
         describe "#group" do
           it "should not be empty" do
-            winsec.get_group(path).should_not be_empty
+            expect(winsec.get_group(path)).not_to be_empty
           end
 
           it "should raise an exception if an invalid path is provided" do
-            lambda { winsec.get_group("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
+            expect { winsec.get_group("c:\\doesnotexist.txt") }.to raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
         it "should preserve inherited full control for SYSTEM when setting owner and group" do
           # new file has SYSTEM
           system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
-          system_aces.should_not be_empty
+          expect(system_aces).not_to be_empty
 
           # when running under SYSTEM account, multiple ACEs come back
           # so we only care that we have at least one of these
-          system_aces.any? do |ace|
+          expect(system_aces.any? do |ace|
             ace.mask == klass::FILE_ALL_ACCESS
-          end.should be_true
+          end).to be_truthy
 
           # changing the owner/group will no longer make the SD protected
           winsec.set_group(sids[:power_users], path)
           winsec.set_owner(sids[:administrators], path)
 
-          system_aces.find do |ace|
+          expect(system_aces.find do |ace|
             ace.mask == klass::FILE_ALL_ACCESS && ace.inherited?
-          end.should_not be_nil
+          end).not_to be_nil
         end
 
         describe "#mode=" do
@@ -210,7 +211,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
                     mode = (s << 9 | u << 6 | g << 3 | o << 0)
                     winsec.set_mode(mode, path)
-                    winsec.get_mode(path).to_s(8).should == mode.to_s(8)
+                    expect(winsec.get_mode(path).to_s(8)).to eq(mode.to_s(8))
                   end
                 end
               end
@@ -220,13 +221,13 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           it "should preserve full control for SYSTEM when setting mode" do
             # new file has SYSTEM
             system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
-            system_aces.should_not be_empty
+            expect(system_aces).not_to be_empty
 
             # when running under SYSTEM account, multiple ACEs come back
             # so we only care that we have at least one of these
-            system_aces.any? do |ace|
+            expect(system_aces.any? do |ace|
               ace.mask == klass::FILE_ALL_ACCESS
-            end.should be_true
+            end).to be_truthy
 
             # changing the mode will make the SD protected
             winsec.set_group(sids[:none], path)
@@ -235,39 +236,22 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             # and should have a non-inherited SYSTEM ACE(s)
             system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
             system_aces.each do |ace|
-              ace.mask.should == klass::FILE_ALL_ACCESS && ! ace.inherited?
-            end
-
-            if Puppet::FileSystem.directory?(path)
-              system_aces.each do |ace|
-                ace.object_inherit?.should be_true
-                ace.container_inherit?.should be_true
-              end
-
-              # it's critically important that this file be default created
-              # and that this file not have it's owner / group / mode set by winsec
-              nested_file = File.join(path, 'nested_file')
-              File.new(nested_file, 'w').close
-
-              system_aces = winsec.get_aces_for_path_by_sid(nested_file, sids[:system])
-              # even when SYSTEM is the owner (in CI), there should be an inherited SYSTEM
-              system_aces.any? do |ace|
-                ace.mask == klass::FILE_ALL_ACCESS && ace.inherited?
-              end.should be_true
+              expect(ace.mask).to eq(klass::FILE_ALL_ACCESS)
+              expect(ace).not_to be_inherited
             end
           end
 
           describe "for modes that require deny aces" do
             it "should map everyone to group and owner" do
               winsec.set_mode(0426, path)
-              winsec.get_mode(path).to_s(8).should == "666"
+              expect(winsec.get_mode(path).to_s(8)).to eq("666")
             end
 
             it "should combine user and group modes when owner and group sids are equal" do
               winsec.set_group(winsec.get_owner(path), path)
 
               winsec.set_mode(0410, path)
-              winsec.get_mode(path).to_s(8).should == "550"
+              expect(winsec.get_mode(path).to_s(8)).to eq("550")
             end
           end
 
@@ -276,30 +260,30 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
               winsec.set_group(sids[:none], path)
               winsec.set_mode(0600, path)
               Puppet::Util::Windows::File.add_attributes(path, klass::FILE_ATTRIBUTE_READONLY)
-              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should be_nonzero
+              expect(Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).to be_nonzero
             end
 
             it "should make them writable if any sid has write permission" do
               winsec.set_mode(WindowsSecurityTester::S_IWUSR, path)
-              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should == 0
+              expect(Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).to eq(0)
             end
 
             it "should leave them read-only if no sid has write permission and should allow full access for SYSTEM" do
               winsec.set_mode(WindowsSecurityTester::S_IRUSR | WindowsSecurityTester::S_IXGRP, path)
-              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should be_nonzero
+              expect(Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).to be_nonzero
 
               system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
 
               # when running under SYSTEM account, and set_group / set_owner hasn't been called
               # SYSTEM full access will be restored
-              system_aces.any? do |ace|
+              expect(system_aces.any? do |ace|
                 ace.mask == klass::FILE_ALL_ACCESS
-              end.should be_true
+              end).to be_truthy
             end
           end
 
           it "should raise an exception if an invalid path is provided" do
-            lambda { winsec.set_mode(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
+            expect { winsec.set_mode(sids[:guest], "c:\\doesnotexist.txt") }.to raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
@@ -312,7 +296,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             winsec.set_security_descriptor(path, sd)
 
             mode = winsec.get_mode(path)
-            (mode & WindowsSecurityTester::S_IEXTRA).should == WindowsSecurityTester::S_IEXTRA
+            expect(mode & WindowsSecurityTester::S_IEXTRA).to eq(WindowsSecurityTester::S_IEXTRA)
           end
 
           it "should return deny aces" do
@@ -321,9 +305,9 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             winsec.set_security_descriptor(path, sd)
 
             guest_aces = winsec.get_aces_for_path_by_sid(path, sids[:guest])
-            guest_aces.find do |ace|
+            expect(guest_aces.find do |ace|
               ace.type == Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
-            end.should_not be_nil
+            end).not_to be_nil
           end
 
           it "should skip inherit-only ace" do
@@ -339,11 +323,11 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             )
             winsec.set_security_descriptor(path, sd)
 
-            (winsec.get_mode(path) & WindowsSecurityTester::S_IRWXO).should == 0
+            expect(winsec.get_mode(path) & WindowsSecurityTester::S_IRWXO).to eq(0)
           end
 
           it "should raise an exception if an invalid path is provided" do
-            lambda { winsec.get_mode("c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
+            expect { winsec.get_mode("c:\\doesnotexist.txt") }.to raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
@@ -354,7 +338,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             mode = winsec.get_mode(path)
             [ WindowsSecurityTester::S_IEXTRA,
               WindowsSecurityTester::S_ISYSTEM_MISSING ].each do |flag|
-              (mode & flag).should_not == flag
+              expect(mode & flag).not_to eq(flag)
             end
           end
 
@@ -380,19 +364,19 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
             # unprotect child, it should inherit from parent
             winsec.set_mode(WindowsSecurityTester::S_IRWXU, path, false)
-            (winsec.get_mode(path) & WindowsSecurityTester::S_IEXTRA).should == WindowsSecurityTester::S_IEXTRA
+            expect(winsec.get_mode(path) & WindowsSecurityTester::S_IEXTRA).to eq(WindowsSecurityTester::S_IEXTRA)
           end
         end
       end
 
-      describe "for an administrator", :if => Puppet.features.root? do
+      describe "for an administrator", :if => (Puppet.features.root? && Puppet.features.microsoft_windows?) do
         before :each do
           is_dir = Puppet::FileSystem.directory?(path)
           winsec.set_mode(WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG, path)
           set_group_depending_on_current_user(path)
           winsec.set_owner(sids[:guest], path)
           expected_error = RUBY_VERSION =~ /^2\./ && is_dir ? Errno::EISDIR : Errno::EACCES
-          lambda { File.open(path, 'r') }.should raise_error(expected_error)
+          expect { File.open(path, 'r') }.to raise_error(expected_error)
         end
 
         after :each do
@@ -403,44 +387,34 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         end
 
         describe "#owner=" do
-          it "should accept the guest sid" do
-            winsec.set_owner(sids[:guest], path)
-            expect(winsec.get_owner(path)).to eq(sids[:guest])
-          end
-
           it "should accept a user sid" do
-            winsec.set_owner(sids[:current_user], path)
-            winsec.get_owner(path).should == sids[:current_user]
+            winsec.set_owner(sids[:admin], path)
+            expect(winsec.get_owner(path)).to eq(sids[:admin])
           end
 
           it "should accept a group sid" do
             winsec.set_owner(sids[:power_users], path)
-            winsec.get_owner(path).should == sids[:power_users]
+            expect(winsec.get_owner(path)).to eq(sids[:power_users])
           end
 
           it "should raise an exception if an invalid sid is provided" do
-            lambda { winsec.set_owner("foobar", path) }.should raise_error(Puppet::Error, /Failed to convert string SID/)
+            expect { winsec.set_owner("foobar", path) }.to raise_error(Puppet::Error, /Failed to convert string SID/)
           end
 
           it "should raise an exception if an invalid path is provided" do
-            lambda { winsec.set_owner(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
+            expect { winsec.set_owner(sids[:guest], "c:\\doesnotexist.txt") }.to raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
         describe "#group=" do
-          it "should accept the test group" do
-            winsec.set_group(sids[:guest], path)
-            expect(winsec.get_group(path)).to eq(sids[:guest])
-          end
-
           it "should accept a group sid" do
             winsec.set_group(sids[:power_users], path)
-            winsec.get_group(path).should == sids[:power_users]
+            expect(winsec.get_group(path)).to eq(sids[:power_users])
           end
 
           it "should accept a user sid" do
-            winsec.set_group(sids[:current_user], path)
-            winsec.get_group(path).should == sids[:current_user]
+            winsec.set_group(sids[:admin], path)
+            expect(winsec.get_group(path)).to eq(sids[:admin])
           end
 
           it "should combine owner and group rights when they are the same sid" do
@@ -448,21 +422,21 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             winsec.set_group(sids[:power_users], path)
             winsec.set_mode(0610, path)
 
-            winsec.get_owner(path).should == sids[:power_users]
-            winsec.get_group(path).should == sids[:power_users]
+            expect(winsec.get_owner(path)).to eq(sids[:power_users])
+            expect(winsec.get_group(path)).to eq(sids[:power_users])
             # note group execute permission added to user ace, and then group rwx value
             # reflected to match
 
             # Exclude missing system ace, since that's not relevant
-            (winsec.get_mode(path) & 0777).to_s(8).should == "770"
+            expect((winsec.get_mode(path) & 0777).to_s(8)).to eq("770")
           end
 
           it "should raise an exception if an invalid sid is provided" do
-            lambda { winsec.set_group("foobar", path) }.should raise_error(Puppet::Error, /Failed to convert string SID/)
+            expect { winsec.set_group("foobar", path) }.to raise_error(Puppet::Error, /Failed to convert string SID/)
           end
 
           it "should raise an exception if an invalid path is provided" do
-            lambda { winsec.set_group(sids[:guest], "c:\\doesnotexist.txt") }.should raise_error(Puppet::Error, /The system cannot find the file specified./)
+            expect { winsec.set_group(sids[:guest], "c:\\doesnotexist.txt") }.to raise_error(Puppet::Error, /The system cannot find the file specified./)
           end
         end
 
@@ -484,8 +458,8 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
               Puppet::Util::Windows::ADSI::User.delete(user.name)
             end
 
-            winsec.get_owner(path).should == sid
-            winsec.get_mode(path).should == WindowsSecurityTester::S_IRWXU
+            expect(winsec.get_owner(path)).to eq(sid)
+            expect(winsec.get_mode(path)).to eq(WindowsSecurityTester::S_IRWXU)
           end
 
           it "should retrieve the group sid" do
@@ -499,8 +473,8 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             ensure
               Puppet::Util::Windows::ADSI::Group.delete(group.name)
             end
-            winsec.get_group(path).should == sid
-            winsec.get_mode(path).should == WindowsSecurityTester::S_IRWXG
+            expect(winsec.get_group(path)).to eq(sid)
+            expect(winsec.get_mode(path)).to eq(WindowsSecurityTester::S_IRWXG)
           end
         end
 
@@ -512,7 +486,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, [], protect)
             winsec.set_security_descriptor(path, new_sd)
 
-            winsec.get_mode(path).should == WindowsSecurityTester::S_ISYSTEM_MISSING
+            expect(winsec.get_mode(path)).to eq(WindowsSecurityTester::S_ISYSTEM_MISSING)
           end
 
           # REMIND: ruby crashes when trying to set a NULL DACL
@@ -563,7 +537,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
                 winsec.set_group(sids[:current_user], path)
                 winsec.set_mode(0700, path)
 
-                lambda { check_delete(path) }.should raise_error(Errno::EACCES)
+                expect { check_delete(path) }.to raise_error(Errno::EACCES)
               end
 
               it "should deny other" do
@@ -575,7 +549,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
                 winsec.set_group(sids[:current_user], path)
                 winsec.set_mode(0700, path)
 
-                lambda { check_delete(path) }.should raise_error(Errno::EACCES)
+                expect { check_delete(path) }.to raise_error(Errno::EACCES)
               end
             end
 
@@ -669,19 +643,19 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         if (mode & WindowsSecurityTester::S_IRUSR).nonzero?
           check_read(path)
         else
-          lambda { check_read(path) }.should raise_error(Errno::EACCES)
+          expect { check_read(path) }.to raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IWUSR).nonzero?
           check_write(path)
         else
-          lambda { check_write(path) }.should raise_error(Errno::EACCES)
+          expect { check_write(path) }.to raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IXUSR).nonzero?
-          lambda { check_execute(path) }.should raise_error(Errno::ENOEXEC)
+          expect { check_execute(path) }.to raise_error(Errno::ENOEXEC)
         else
-          lambda { check_execute(path) }.should raise_error(Errno::EACCES)
+          expect { check_execute(path) }.to raise_error(Errno::EACCES)
         end
       end
 
@@ -706,15 +680,15 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       let (:explorer) { File.join(Dir::WINDOWS, "explorer.exe") }
 
       it "should get the owner" do
-        winsec.get_owner(explorer).should match /^S-1-5-/
+        expect(winsec.get_owner(explorer)).to match /^S-1-5-/
       end
 
       it "should get the group" do
-        winsec.get_group(explorer).should match /^S-1-5-/
+        expect(winsec.get_group(explorer)).to match /^S-1-5-/
       end
 
       it "should get the mode" do
-        winsec.get_mode(explorer).should == (WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG | WindowsSecurityTester::S_IEXTRA)
+        expect(winsec.get_mode(explorer)).to eq(WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG | WindowsSecurityTester::S_IEXTRA)
       end
     end
   end
@@ -740,19 +714,19 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         if (mode & WindowsSecurityTester::S_IRUSR).nonzero?
           check_read(path)
         else
-          lambda { check_read(path) }.should raise_error(Errno::EACCES)
+          expect { check_read(path) }.to raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IWUSR).nonzero?
           check_write(path)
         else
-          lambda { check_write(path) }.should raise_error(Errno::EACCES)
+          expect { check_write(path) }.to raise_error(Errno::EACCES)
         end
 
         if (mode & WindowsSecurityTester::S_IXUSR).nonzero?
           check_execute(path)
         else
-          lambda { check_execute(path) }.should raise_error(Errno::EACCES)
+          expect { check_execute(path) }.to raise_error(Errno::EACCES)
         end
       end
 
@@ -786,7 +760,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
         [newfile, newdir].each do |p|
           mode = winsec.get_mode(p)
-          (mode & 07777).to_s(8).should == mode640.to_s(8)
+          expect((mode & 07777).to_s(8)).to eq(mode640.to_s(8))
         end
       end
     end
@@ -811,13 +785,13 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       winsec.set_security_descriptor(path, sd)
 
       aces = winsec.get_security_descriptor(path).dacl.to_a
-      aces.map(&:sid).should == sids_in_dacl
-      aces.map(&:mask).all? { |mask| mask == read_execute }.should be_true
+      expect(aces.map(&:sid)).to eq(sids_in_dacl)
+      expect(aces.map(&:mask).all? { |mask| mask == read_execute }).to be_truthy
     end
 
     it "changes the sid for all aces that were assigned to the old owner" do
       sd = winsec.get_security_descriptor(path)
-      sd.owner.should_not == sids[:guest]
+      expect(sd.owner).not_to eq(sids[:guest])
 
       sd.dacl.allow(sd.owner, read_execute)
       sd.dacl.allow(sd.owner, synchronize)
@@ -829,7 +803,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       aces = dacl.find_all { |ace| ace.sid == sids[:guest] }
       # only non-inherited aces will be reassigned to guest, so
       # make sure we find at least the two we added
-      aces.size.should >= 2
+      expect(aces.size).to be >= 2
     end
 
     it "preserves INHERIT_ONLY_ACEs" do
@@ -849,9 +823,9 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       winsec.set_owner(sids[:guest], dir)
 
       sd = winsec.get_security_descriptor(dir)
-      sd.dacl.find do |ace|
+      expect(sd.dacl.find do |ace|
         ace.sid == sids[:guest] && ace.inherit_only?
-      end.should_not be_nil
+      end).not_to be_nil
     end
 
     it "allows deny ACEs with inheritance" do
@@ -866,9 +840,9 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       winsec.set_security_descriptor(dir, sd)
 
       sd = winsec.get_security_descriptor(dir)
-      sd.dacl.find do |ace|
+      expect(sd.dacl.find do |ace|
         ace.sid == sids[:guest] && ace.flags != 0
-      end.should_not be_nil
+      end).not_to be_nil
     end
 
     context "when managing mode" do
@@ -884,7 +858,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         # make sure it's gone
         dacl = winsec.get_security_descriptor(path).dacl
         aces = dacl.find_all { |ace| ace.sid == sids[:guest] }
-        aces.should be_empty
+        expect(aces).to be_empty
       end
     end
   end