puppet 4.0.0 → 4.9.1

data/spec/unit/transaction/resource_harness_spec.rb

@@ -418,50 +418,94 @@ describe Puppet::Transaction::ResourceHarness do
     end
   end
 
-  describe "when applying changes" do
-    it "should not apply changes if allow_changes?() returns false" do
-      test_file = tmpfile('foo')
-      resource = Puppet::Type.type(:file).new :path => test_file, :backup => false, :ensure => :file
-      resource.expects(:err).never # make sure no exceptions get swallowed
-      @harness.expects(:allow_changes?).with(resource).returns false
-      status = @harness.evaluate(resource)
-      expect(Puppet::FileSystem.exist?(test_file)).to eq(false)
-    end
-  end
+  describe "handling sensitive properties" do
+    describe 'when syncing' do
+      let(:test_file) do
+        tmpfile('foo').tap do |path|
+          File.open(path, 'w') { |fh| fh.write("goodbye world") }
+        end
+      end
 
-  describe "when determining whether the resource can be changed" do
-    before do
-      @resource.stubs(:purging?).returns true
-      @resource.stubs(:deleting?).returns true
-    end
+      let(:resource) do
+        Puppet::Type.type(:file).new(:path => test_file, :backup => false, :content => "hello world").tap do |r|
+          r.parameter(:content).sensitive = true
+        end
+      end
 
-    it "should be true if the resource is not being purged" do
-      @resource.expects(:purging?).returns false
-      expect(@harness).to be_allow_changes(@resource)
-    end
+      it "redacts event messages for sensitive properties" do
+        status = @harness.evaluate(resource)
+        sync_event = status.events[0]
+        expect(sync_event.message).to eq 'changed [redacted] to [redacted]'
+      end
 
-    it "should be true if the resource is not being deleted" do
-      @resource.expects(:deleting?).returns false
-      expect(@harness).to be_allow_changes(@resource)
-    end
+      it "redacts event contents for sensitive properties" do
+        status = @harness.evaluate(resource)
+        sync_event = status.events[0]
+        expect(sync_event.previous_value).to eq '[redacted]'
+        expect(sync_event.desired_value).to eq '[redacted]'
+      end
 
-    it "should be true if the resource has no dependents" do
-      @harness.relationship_graph.expects(:dependents).with(@resource).returns []
-      expect(@harness).to be_allow_changes(@resource)
-    end
+      it "redacts event messages for sensitive properties when simulating noop changes" do
+        resource[:noop] = true
+        status = @harness.evaluate(resource)
+        sync_event = status.events[0]
+        expect(sync_event.message).to eq 'current_value [redacted], should be [redacted] (noop)'
+      end
 
-    it "should be true if all dependents are being deleted" do
-      dep = stub 'dependent', :deleting? => true
-      @harness.relationship_graph.expects(:dependents).with(@resource).returns [dep]
-      @resource.expects(:purging?).returns true
-      expect(@harness).to be_allow_changes(@resource)
+      describe 'auditing' do
+        before do
+          resource[:audit] = ['content']
+        end
+
+        it "redacts notices when a parameter is newly audited" do
+          resource.property(:content).expects(:notice).with("audit change: newly-recorded value [redacted]")
+          @harness.evaluate(resource)
+        end
+
+        it "redacts event messages for sensitive properties" do
+          Puppet::Util::Storage.stubs(:cache).with(resource).returns({:content => "historical world"})
+          status = @harness.evaluate(resource)
+          sync_event = status.events[0]
+          expect(sync_event.message).to eq 'changed [redacted] to [redacted] (previously recorded value was [redacted])'
+        end
+
+        it "redacts audit event messages for sensitive properties when simulating noop changes" do
+          Puppet::Util::Storage.stubs(:cache).with(resource).returns({:content => "historical world"})
+          resource[:noop] = true
+          status = @harness.evaluate(resource)
+          sync_event = status.events[0]
+          expect(sync_event.message).to eq 'current_value [redacted], should be [redacted] (noop) (previously recorded value was [redacted])'
+        end
+
+        it "redacts event contents for sensitive properties" do
+          Puppet::Util::Storage.stubs(:cache).with(resource).returns({:content => "historical world"})
+          status = @harness.evaluate(resource)
+          sync_event = status.events[0]
+          expect(sync_event.historical_value).to eq '[redacted]'
+        end
+      end
     end
 
-    it "should be false if the resource's dependents are not being deleted" do
-      dep = stub 'dependent', :deleting? => false, :ref => "myres"
-      @resource.expects(:warning)
-      @harness.relationship_graph.expects(:dependents).with(@resource).returns [dep]
-      expect(@harness).not_to be_allow_changes(@resource)
+    describe 'handling errors' do
+      it "redacts event messages generated when syncing a param raises a StandardError" do
+        stub_provider = make_stub_provider
+        resource = stub_provider.new :name => 'name', :bar => 1
+        resource.parameter(:bar).sensitive = true
+        status = @harness.evaluate(resource)
+
+        error_event = status.events[0]
+        expect(error_event.message).to eq "change from [redacted] to [redacted] failed: bar"
+      end
+
+      it "redacts event messages generated when syncing a param raises an Exception" do
+        stub_provider = make_stub_provider
+        resource = stub_provider.new :name => 'name', :baz => 1
+        resource.parameter(:baz).sensitive = true
+
+        expect { @harness.evaluate(resource) }.to raise_error(Exception, 'baz')
+
+        expect(@logs.first.message).to eq "change from [redacted] to [redacted] failed: baz"
+      end
     end
   end
 

data/spec/unit/transaction_spec.rb

@@ -327,6 +327,44 @@ describe Puppet::Transaction do
     end
   end
 
+  describe "after resource traversal" do
+    let(:catalog) { Puppet::Resource::Catalog.new }
+    let(:prioritizer) { Puppet::Graph::RandomPrioritizer.new }
+    let(:report) { Puppet::Transaction::Report.new("apply") }
+    let(:transaction) { Puppet::Transaction.new(catalog, report, prioritizer) }
+    let(:generator) { Puppet::Transaction::AdditionalResourceGenerator.new(catalog, nil, prioritizer) }
+
+    before :each do
+      generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, nil, prioritizer)
+      Puppet::Transaction::AdditionalResourceGenerator.stubs(:new).returns(generator)
+    end
+
+    it "should should query the generator for whether resources failed to generate" do
+      relationship_graph = Puppet::Graph::RelationshipGraph.new(prioritizer)
+      catalog.stubs(:relationship_graph).returns(relationship_graph)
+
+      sequence = sequence(:traverse_first)
+      relationship_graph.expects(:traverse).in_sequence(sequence)
+      generator.expects(:resources_failed_to_generate).in_sequence(sequence)
+
+      transaction.evaluate
+    end
+
+    it "should report that resources failed to generate" do
+      generator.expects(:resources_failed_to_generate).returns(true)
+      report.expects(:resources_failed_to_generate=).with(true)
+
+      transaction.evaluate
+    end
+
+    it "should not report that resources failed to generate if none did" do
+      generator.expects(:resources_failed_to_generate).returns(false)
+      report.expects(:resources_failed_to_generate=).never
+
+      transaction.evaluate
+    end
+  end
+
   describe "when performing pre-run checks" do
     let(:resource) { Puppet::Type.type(:notify).new(:title => "spec") }
     let(:transaction) { transaction_with_resource(resource) }
@@ -365,6 +403,11 @@ describe Puppet::Transaction do
       expect(@transaction).to be_skip(@resource)
     end
 
+    it "should skip resources tagged with the skip tags" do
+      @transaction.stubs(:skip_tags?).returns(true)
+      expect(@transaction).to be_skip(@resource)
+    end
+
     it "should skip unscheduled resources" do
       @transaction.stubs(:scheduled?).returns(false)
       expect(@transaction).to be_skip(@resource)
@@ -721,6 +764,13 @@ describe Puppet::Transaction, " when determining tags" do
     expect(@transaction).to be_tagged("one::two")
   end
 
+  it "should tag one::two only as 'one::two' and not 'one', 'two', and 'one::two'" do
+    @transaction.tags = "one::two"
+    expect(@transaction).to be_tagged("one::two")
+    expect(@transaction).to_not be_tagged("one")
+    expect(@transaction).to_not be_tagged("two")
+  end
+
   it "should accept a comma-delimited string" do
     @transaction.tags = "one, two"
     expect(@transaction).to be_tagged("one")

data/spec/unit/type/exec_spec.rb

@@ -396,16 +396,24 @@ describe Puppet::Type.type(:exec) do
         end
       end
 
-      it "should fail if timeout is exceeded" do
-        ruby_path = Puppet::Util::Execution.ruby_path()
+      describe 'when timeout is exceeded' do
+        subject do
+          ruby_path = Puppet::Util::Execution.ruby_path()
+          Puppet::Type.type(:exec).new(:name => "#{ruby_path} -e 'sleep 1'", :timeout => '0.1')
+        end
 
-        ## Leaving this commented version in here because it fails on windows, due to what appears to be
-        ##  an assumption about hash iteration order in lib/puppet/type.rb#hash2resource, where
-        ##  resource[]= will overwrite the namevar with ":name" if the iteration is in the wrong order
-        #sleep_exec = Puppet::Type.type(:exec).new(:name => 'exec_spec sleep command', :command => "#{ruby_path} -e 'sleep 0.02'", :timeout => '0.01')
-        sleep_exec = Puppet::Type.type(:exec).new(:name => "#{ruby_path} -e 'sleep 0.02'", :timeout => '0.01')
+        context 'on POSIX', :unless => Puppet.features.microsoft_windows? do
+          it 'sends a SIGTERM and raises a Puppet::Error' do
+            Process.expects(:kill).at_least_once
+            expect { subject.refresh }.to raise_error Puppet::Error, "Command exceeded timeout"
+          end
+        end
 
-        expect { sleep_exec.refresh }.to raise_error Puppet::Error, "Command exceeded timeout"
+        context 'on Windows', :if => Puppet.features.microsoft_windows? do
+          it 'raises a Puppet::Error' do
+            expect { subject.refresh }.to raise_error Puppet::Error, "Command exceeded timeout"
+          end
+        end
       end
 
       it "should convert timeout to a float" do

data/spec/unit/type/file/checksum_spec.rb

@@ -76,4 +76,10 @@ describe checksum do
       expect(sum).to eq("something")
     end
   end
+
+  it 'should use values allowed by the supported_checksum_types setting' do
+    values = checksum.value_collection.values.reject {|v| v == :none}.map {|v| v.to_s}
+    Puppet.settings[:supported_checksum_types] = values
+    expect(Puppet.settings[:supported_checksum_types]).to eq(values)
+  end
 end

data/spec/unit/type/file/checksum_value_spec.rb

@@ -0,0 +1,286 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+describe Puppet::Type.type(:file).attrclass(:checksum_value), :uses_checksums => true do
+  include PuppetSpec::Files
+  include_context 'with supported checksum types'
+
+  let(:path) { tmpfile('foo_bar') }
+  let(:source_file) { file_containing('temp_foo', 'nothing at all') }
+  let(:environment) { Puppet::Node::Environment.create(:testing, []) }
+  let(:catalog) { Puppet::Resource::Catalog.new(:test, environment) }
+  let(:resource) { Puppet::Type.type(:file).new(:path => path, :catalog => catalog) }
+
+  it "should be a property" do
+    expect(described_class.superclass).to eq(Puppet::Property)
+  end
+
+  describe "when retrieving the current checksum_value" do
+    let(:checksum_value) { described_class.new(:resource => resource) }
+
+    it "should not compute a checksum if source is absent" do
+      resource.expects(:stat).never
+      expect(checksum_value.retrieve).to be_nil
+    end
+
+    describe "when using a source" do
+      before do
+        resource[:source] = source_file
+      end
+
+      it "should return :absent if the target does not exist" do
+        resource.expects(:stat).returns nil
+
+        expect(checksum_value.retrieve).to eq(:absent)
+      end
+
+      it "should not manage content on directories" do
+        stat = mock 'stat', :ftype => "directory"
+        resource.expects(:stat).returns stat
+
+        expect(checksum_value.retrieve).to be_nil
+      end
+
+      it "should not manage content on links" do
+        stat = mock 'stat', :ftype => "link"
+        resource.expects(:stat).returns stat
+
+        expect(checksum_value.retrieve).to be_nil
+      end
+
+      it "should always return the checksum as a string" do
+        resource[:checksum] = :mtime
+
+        stat = mock 'stat', :ftype => "file"
+        resource.expects(:stat).returns stat
+
+        time = Time.now
+        resource.parameter(:checksum).expects(:mtime_file).with(resource[:path]).returns time
+
+        expect(checksum_value.retrieve).to eq(time.to_s)
+      end
+    end
+
+    with_digest_algorithms do
+      it "should return the checksum of the target if it exists and is a normal file" do
+        stat = mock 'stat', :ftype => "file"
+        resource.expects(:stat).returns stat
+        resource.parameter(:checksum).expects("#{digest_algorithm}_file".intern).with(resource[:path]).returns "mysum"
+        resource[:source] = source_file
+
+        expect(checksum_value.retrieve).to eq("mysum")
+      end
+    end
+  end
+
+  describe "when testing whether the checksum_value is in sync" do
+    let(:checksum_value) { described_class.new(:resource => resource) }
+
+    before do
+      resource[:ensure] = :file
+    end
+
+    it "should return true if source is not specified" do
+      checksum_value.should = "foo"
+      expect(checksum_value).to be_safe_insync("whatever")
+    end
+
+    describe "when a source is provided" do
+      before do
+        resource[:source] = source_file
+      end
+
+      with_digest_algorithms do
+        before(:each) do
+          resource[:checksum] = digest_algorithm
+        end
+
+        it "should return true if the resource shouldn't be a regular file" do
+          resource.expects(:should_be_file?).returns false
+          checksum_value.should = "foo"
+          expect(checksum_value).to be_safe_insync("whatever")
+        end
+
+        it "should return false if the current checksum_value is :absent" do
+          checksum_value.should = "foo"
+          expect(checksum_value).not_to be_safe_insync(:absent)
+        end
+
+        it "should return false if the file should be a file but is not present" do
+          resource.expects(:should_be_file?).returns true
+          checksum_value.should = "foo"
+
+          expect(checksum_value).not_to be_safe_insync(:absent)
+        end
+
+        describe "and the file exists" do
+          before do
+            resource.stubs(:stat).returns mock("stat")
+            checksum_value.should = "somechecksum"
+          end
+
+          it "should return false if the current checksum_value is different from the desired checksum_value" do
+            expect(checksum_value).not_to be_safe_insync("otherchecksum")
+          end
+
+          it "should return true if the current checksum_value is the same as the desired checksum_value" do
+            expect(checksum_value).to be_safe_insync("somechecksum")
+          end
+
+          it "should include the diff module" do
+            expect(checksum_value.respond_to?("diff")).to eq(false)
+          end
+
+          [true, false].product([true, false]).each do |cfg, param|
+            describe "and Puppet[:show_diff] is #{cfg} and show_diff => #{param}" do
+              before do
+                Puppet[:show_diff] = cfg
+                resource.stubs(:show_diff?).returns param
+                resource[:loglevel] = "debug"
+              end
+
+              if cfg and param
+                it "should display a diff" do
+                  checksum_value.expects(:diff).returns("my diff").once
+                  checksum_value.expects(:debug).with("\nmy diff").once
+                  expect(checksum_value).not_to be_safe_insync("otherchecksum")
+                end
+              else
+                it "should not display a diff" do
+                  checksum_value.expects(:diff).never
+                  expect(checksum_value).not_to be_safe_insync("otherchecksum")
+                end
+              end
+            end
+          end
+        end
+      end
+
+      let(:saved_time) { Time.now }
+      [:ctime, :mtime].each do |time_stat|
+        [["older", -1, false], ["same", 0, true], ["newer", 1, true]].each do
+          |compare, target_time, success|
+          describe "with #{compare} target #{time_stat} compared to source" do
+            before do
+              resource[:checksum] = time_stat
+              checksum_value.should = saved_time.to_s
+            end
+
+            it "should return #{success}" do
+              if success
+                expect(checksum_value).to be_safe_insync((saved_time+target_time).to_s)
+              else
+                expect(checksum_value).not_to be_safe_insync((saved_time+target_time).to_s)
+              end
+            end
+          end
+        end
+
+        describe "with #{time_stat}" do
+          before do
+            resource[:checksum] = time_stat
+          end
+
+          it "should not be insync if trying to create it" do
+            checksum_value.should = saved_time.to_s
+            expect(checksum_value).not_to be_safe_insync(:absent)
+          end
+
+          it "should raise an error if checksum_value is not a checksum" do
+            checksum_value.should = "some content"
+            expect {
+              checksum_value.safe_insync?(saved_time.to_s)
+            }.to raise_error(/Resource with checksum_type #{time_stat} didn't contain a date in/)
+          end
+
+          it "should not be insync even if checksum_value is the absent symbol" do
+            checksum_value.should = :absent
+            expect(checksum_value).not_to be_safe_insync(:absent)
+          end
+        end
+      end
+
+      describe "and :replace is false" do
+        before do
+          resource.stubs(:replace?).returns false
+        end
+
+        it "should be insync if the file exists and the checksum_value is different" do
+          resource.stubs(:stat).returns mock('stat')
+
+          expect(checksum_value).to be_safe_insync("whatever")
+        end
+
+        it "should be insync if the file exists and the checksum_value is right" do
+          resource.stubs(:stat).returns mock('stat')
+
+          expect(checksum_value).to be_safe_insync("something")
+        end
+
+        it "should not be insync if the file does not exist" do
+          checksum_value.should = "foo"
+          expect(checksum_value).not_to be_safe_insync(:absent)
+        end
+      end
+    end
+  end
+
+  describe "when testing whether the checksum_value is initialized in the resource and in sync" do
+    CHECKSUM_TYPES_TO_TRY.each do |checksum_type, checksum|
+      describe "sync with checksum type #{checksum_type} and the file exists" do
+        before do
+          @new_resource = Puppet::Type.type(:file).new :ensure => :file, :path => path, :catalog => catalog,
+            :checksum_value => checksum, :checksum => checksum_type, :source => source_file
+          @new_resource.stubs(:stat).returns mock('stat')
+        end
+
+        it "should return false if the current checksum_value is different from the desired checksum_value" do
+          expect(@new_resource.parameters[:checksum_value]).not_to be_safe_insync("abcdef")
+        end
+
+        it "should return true if the current checksum_value is the same as the desired checksum_value" do
+          expect(@new_resource.parameters[:checksum_value]).to be_safe_insync(checksum)
+        end
+      end
+    end
+  end
+
+  describe "when changing the checksum_value" do
+    let(:checksum_value) { described_class.new(:resource => resource) }
+
+    before do
+      resource.stubs(:[]).with(:path).returns "/boo"
+      resource.stubs(:stat).returns "eh"
+    end
+
+    it "should raise if source is absent" do
+      resource.expects(:write).never
+
+      expect { checksum_value.sync }.to raise_error "checksum_value#sync should not be called without a source parameter"
+    end
+
+    describe "when using a source" do
+      before do
+        resource[:source] = source_file
+      end
+
+      it "should use the file's :write method to write the checksum_value" do
+        resource.expects(:write).with(resource.parameter(:source))
+
+        checksum_value.sync
+      end
+
+      it "should return :file_changed if the file already existed" do
+        resource.expects(:stat).returns "something"
+        resource.stubs(:write)
+        expect(checksum_value.sync).to eq(:file_changed)
+      end
+
+      it "should return :file_created if the file did not exist" do
+        resource.expects(:stat).returns nil
+        resource.stubs(:write)
+        expect(checksum_value.sync).to eq(:file_created)
+      end
+    end
+  end
+end