puppet 4.1.0 → 4.10.0

data/spec/unit/ssl/configuration_spec.rb

@@ -9,6 +9,13 @@ describe Puppet::SSL::Configuration do
 
   let(:ssl_server_ca_auth) { "/path/to/certs/ssl_server_ca_auth.pem" }
 
+  # different UTF-8 widths
+  # 1-byte A
+  # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
+  # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
+  # 4-byte 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
+  let (:mixed_utf8) { "A\u06FF\u16A0\u{2070E}" } # Aۿᚠ𠜎
+
   it "should require the localcacert argument" do
     expect { subject }.to raise_error ArgumentError
   end
@@ -44,8 +51,7 @@ describe Puppet::SSL::Configuration do
     end
 
     it "#ca_auth_certificates returns an Array<OpenSSL::X509::Certificate>" do
-      subject.stubs(:read_file).returns(master_ca_pem + root_ca_pem)
-
+      Puppet::FileSystem.expects(:read).with(subject.ca_auth_file, :encoding => Encoding::UTF_8).returns(master_ca_pem + root_ca_pem)
       certs = subject.ca_auth_certificates
       certs.each { |cert| expect(cert).to be_a_kind_of OpenSSL::X509::Certificate }
     end
@@ -67,6 +73,7 @@ describe Puppet::SSL::Configuration do
   # certificates.  It is signed by the Root CA.
   def master_ca_pem
     @master_ca_pem ||= <<-AUTH_BUNDLE
+# Master CA #{mixed_utf8}
 -----BEGIN CERTIFICATE-----
 MIICljCCAf+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
 IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
@@ -89,6 +96,7 @@ l1k75xLLIcrlsDYo3999KOSSchH2K7bLT7TuQ2okdP6FHWmeWmudewlu
   # This is the Root CA
   def root_ca_pem
     @root_ca_pem ||= <<-LOCALCACERT
+# Root CA #{mixed_utf8}
 -----BEGIN CERTIFICATE-----
 MIICYDCCAcmgAwIBAgIJALf2Pk2HvtBzMA0GCSqGSIb3DQEBBQUAMEkxEDAOBgNV
 BAMMB1Jvb3QgQ0ExGjAYBgNVBAsMEVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQK
@@ -111,6 +119,7 @@ rPsNU/Tx19jHC87oXlmAePLI4IaUHXrWb7CRbY9TEcPdmj1R
   # signed by the Root CA.
   def agent_ca_pem
     @agent_ca_pem ||= <<-AGENT_CA
+# Agent CA #{mixed_utf8}
 -----BEGIN CERTIFICATE-----
 MIIClTCCAf6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
 IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs

data/spec/unit/ssl/host_spec.rb

@@ -422,7 +422,7 @@ describe Puppet::SSL::Host do
       @key.stubs(:generate)
       Puppet::SSL::Key.indirection.expects(:save).raises "eh"
 
-      expect { @host.generate_key }.to raise_error
+      expect { @host.generate_key }.to raise_error(RuntimeError)
       expect(@host.key).to be_nil
     end
 
@@ -496,7 +496,7 @@ describe Puppet::SSL::Host do
       Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
       terminus.expects(:save).with { |req| req.instance == @request && req.key == "myname" }.raises "eh"
 
-      expect { @host.generate_certificate_request }.to raise_error
+      expect { @host.generate_certificate_request }.to raise_error(RuntimeError)
 
       expect(@host.instance_eval { @certificate_request }).to be_nil
     end
@@ -649,7 +649,7 @@ describe Puppet::SSL::Host do
       it "should use the CA to sign its certificate request if it does not have a certificate" do
         @host.expects(:certificate).returns nil
 
-        @ca.expects(:sign).with(@host.name, true)
+        @ca.expects(:sign).with(@host.name, {allow_dns_alt_names: true})
 
         @host.generate
       end

data/spec/unit/ssl/inventory_spec.rb

@@ -5,6 +5,14 @@ require 'puppet/ssl/inventory'
 
 describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? do
   let(:cert_inventory) { File.expand_path("/inven/tory") }
+
+  # different UTF-8 widths
+  # 1-byte A
+  # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
+  # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
+  # 4-byte ܎ - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
+  let (:mixed_utf8) { "A\u06FF\u16A0\u{2070E}" } # Aۿᚠ܎
+
   before do
     @class = Puppet::SSL::Inventory
   end
@@ -56,7 +64,7 @@ describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? d
     describe "and adding a certificate" do
 
       it "should use the Settings to write to the file" do
-        Puppet.settings.setting(:cert_inventory).expects(:open).with("a")
+        Puppet.settings.setting(:cert_inventory).expects(:open).with('a:UTF-8')
 
         @inventory.add(@cert)
       end
@@ -66,7 +74,7 @@ describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? d
         cert.content = @cert
 
         fh = StringIO.new
-        Puppet.settings.setting(:cert_inventory).expects(:open).with("a").yields(fh)
+        Puppet.settings.setting(:cert_inventory).expects(:open).with('a:UTF-8').yields(fh)
 
         @inventory.expects(:format).with(@cert).returns "myformat"
 
@@ -74,6 +82,22 @@ describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? d
 
         expect(fh.string).to eq("myformat")
       end
+
+      it "can use UTF-8 in the CN per RFC 5280" do
+        cert = Puppet::SSL::Certificate.new("mycert")
+        cert.content = stub 'cert',
+          :serial => 1,
+          :not_before => Time.now,
+          :not_after => Time.now,
+          :subject => "/CN=#{mixed_utf8}"
+
+        fh = StringIO.new
+        Puppet.settings.setting(:cert_inventory).expects(:open).with('a:UTF-8').yields(fh)
+
+        @inventory.add(cert)
+
+        expect(fh.string).to match(/\/CN=#{mixed_utf8}/)
+      end
     end
 
     describe "and formatting a certificate" do
@@ -118,7 +142,7 @@ describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? d
       end
 
       it "should return the all the serial numbers from the lines matching the provided name" do
-        File.expects(:readlines).with(cert_inventory).returns ["0x00f blah blah /CN=me\n", "0x001 blah blah /CN=you\n", "0x002 blah blah /CN=me\n"]
+        File.expects(:readlines).with(cert_inventory, :encoding => Encoding::UTF_8).returns ["0x00f blah blah /CN=me\n", "0x001 blah blah /CN=you\n", "0x002 blah blah /CN=me\n"]
 
         expect(@inventory.serials("me")).to eq([15, 2])
       end

data/spec/unit/ssl/key_spec.rb

@@ -63,7 +63,7 @@ describe Puppet::SSL::Key do
 
     it "should be able to read keys from disk" do
       path = "/my/path"
-      File.expects(:read).with(path).returns("my key")
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
       key = mock 'key'
       OpenSSL::PKey::RSA.expects(:new).returns(key)
       expect(@key.read(path)).to equal(key)
@@ -76,9 +76,9 @@ describe Puppet::SSL::Key do
 
       path = "/my/path"
 
-      File.stubs(:read).with(path).returns("my key")
+      Puppet::FileSystem.stubs(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
       OpenSSL::PKey::RSA.expects(:new).with("my key", nil).returns(mock('key'))
-      File.expects(:read).with("/path/to/password").never
+      Puppet::FileSystem.expects(:read).with("/path/to/password", :encoding => Encoding::BINARY).never
 
       @key.read(path)
     end
@@ -88,8 +88,8 @@ describe Puppet::SSL::Key do
       @key.password_file = "/path/to/password"
 
       path = "/my/path"
-      File.expects(:read).with(path).returns("my key")
-      File.expects(:read).with("/path/to/password").returns("my password")
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
+      Puppet::FileSystem.expects(:read).with("/path/to/password", :encoding => Encoding::BINARY).returns("my password")
 
       key = mock 'key'
       OpenSSL::PKey::RSA.expects(:new).with("my key", "my password").returns(key)
@@ -155,7 +155,7 @@ describe Puppet::SSL::Key do
     describe "with a password file set" do
       it "should return a nil password if the password file does not exist" do
         Puppet::FileSystem.expects(:exist?).with("/path/to/pass").returns false
-        File.expects(:read).with("/path/to/pass").never
+        Puppet::FileSystem.expects(:read).with("/path/to/pass", :encoding => Encoding::BINARY).never
 
         @instance.password_file = "/path/to/pass"
 
@@ -164,7 +164,7 @@ describe Puppet::SSL::Key do
 
       it "should return the contents of the password file as its password" do
         Puppet::FileSystem.expects(:exist?).with("/path/to/pass").returns true
-        File.expects(:read).with("/path/to/pass").returns "my password"
+        Puppet::FileSystem.expects(:read).with("/path/to/pass", :encoding => Encoding::BINARY).returns "my password"
 
         @instance.password_file = "/path/to/pass"
 

data/spec/unit/ssl/oids_spec.rb

@@ -12,20 +12,31 @@ describe Puppet::SSL::Oids do
       'pp_instance_id'      => '1.3.6.1.4.1.34380.1.1.2',
       'pp_image_name'       => '1.3.6.1.4.1.34380.1.1.3',
       'pp_preshared_key'    => '1.3.6.1.4.1.34380.1.1.4',
-      'pp_cost_center'      => "1.3.6.1.4.1.34380.1.1.5",
-      'pp_product'          => "1.3.6.1.4.1.34380.1.1.6",
-      'pp_project'          => "1.3.6.1.4.1.34380.1.1.7",
-      'pp_application'      => "1.3.6.1.4.1.34380.1.1.8",
-      'pp_service'          => "1.3.6.1.4.1.34380.1.1.9",
-      'pp_employee'         => "1.3.6.1.4.1.34380.1.1.10",
-      'pp_created_by'       => "1.3.6.1.4.1.34380.1.1.11",
-      'pp_environment'      => "1.3.6.1.4.1.34380.1.1.12",
-      'pp_role'             => "1.3.6.1.4.1.34380.1.1.13",
-      'pp_software_version' => "1.3.6.1.4.1.34380.1.1.14",
-      'pp_department'       => "1.3.6.1.4.1.34380.1.1.15",
-      'pp_cluster'          => "1.3.6.1.4.1.34380.1.1.16",
-      'pp_provisioner'      => "1.3.6.1.4.1.34380.1.1.17",
+      'pp_cost_center'      => '1.3.6.1.4.1.34380.1.1.5',
+      'pp_product'          => '1.3.6.1.4.1.34380.1.1.6',
+      'pp_project'          => '1.3.6.1.4.1.34380.1.1.7',
+      'pp_application'      => '1.3.6.1.4.1.34380.1.1.8',
+      'pp_service'          => '1.3.6.1.4.1.34380.1.1.9',
+      'pp_employee'         => '1.3.6.1.4.1.34380.1.1.10',
+      'pp_created_by'       => '1.3.6.1.4.1.34380.1.1.11',
+      'pp_environment'      => '1.3.6.1.4.1.34380.1.1.12',
+      'pp_role'             => '1.3.6.1.4.1.34380.1.1.13',
+      'pp_software_version' => '1.3.6.1.4.1.34380.1.1.14',
+      'pp_department'       => '1.3.6.1.4.1.34380.1.1.15',
+      'pp_cluster'          => '1.3.6.1.4.1.34380.1.1.16',
+      'pp_provisioner'      => '1.3.6.1.4.1.34380.1.1.17',
+      'pp_region'           => '1.3.6.1.4.1.34380.1.1.18',
+      'pp_datacenter'       => '1.3.6.1.4.1.34380.1.1.19',
+      'pp_zone'             => '1.3.6.1.4.1.34380.1.1.20',
+      'pp_network'          => '1.3.6.1.4.1.34380.1.1.21',
+      'pp_securitypolicy'   => '1.3.6.1.4.1.34380.1.1.22',
+      'pp_cloudplatform'    => '1.3.6.1.4.1.34380.1.1.23',
+      'pp_apptier'          => '1.3.6.1.4.1.34380.1.1.24',
+      'pp_hostname'         => '1.3.6.1.4.1.34380.1.1.25',
       'ppPrivCertExt'       => '1.3.6.1.4.1.34380.1.2',
+      'ppAuthCertExt'       => '1.3.6.1.4.1.34380.1.3',
+      'pp_authorization'    => '1.3.6.1.4.1.34380.1.3.1',
+      'pp_auth_role'        => '1.3.6.1.4.1.34380.1.3.13',
     }.each_pair do |sn, oid|
       it "defines #{sn} as #{oid}" do
         object_id = OpenSSL::ASN1::ObjectId.new(sn)

data/spec/unit/transaction/additional_resource_generator_spec.rb

@@ -12,46 +12,103 @@ describe Puppet::Transaction::AdditionalResourceGenerator do
   include Matchers::Resource
 
   let(:prioritizer) { Puppet::Graph::SequentialPrioritizer.new }
+  let(:env) { Puppet::Node::Environment.create(:testing, []) }
+  let(:node) { Puppet::Node.new('test', :environment => env) }
+  let(:loaders) { Puppet::Pops::Loaders.new(env) }
+
+  around :each do |example|
+    Puppet::Parser::Compiler.any_instance.stubs(:loaders).returns(loaders)
+    Puppet.override(:loaders => loaders, :current_environment => env) do
+      Puppet::Type.newtype(:generator) do
+        include PuppetSpec::Compiler
+
+        newparam(:name) do
+          isnamevar
+        end
+
+        newparam(:kind) do
+          defaultto :eval_generate
+          newvalues(:eval_generate, :generate)
+        end
+
+        newparam(:code)
+
+        def respond_to?(method_name)
+          method_name == self[:kind] || super
+        end
+
+        def eval_generate
+          eval_code
+        end
+
+        def generate
+          eval_code
+        end
+
+        def eval_code
+          if self[:code]
+            compile_to_ral(self[:code]).resources.select { |r| r.ref =~ /Notify/ }
+          else
+            []
+          end
+        end
+      end
 
-  def find_vertex(graph, type, title)
-    graph.vertices.find {|v| v.type == type and v.title == title}
-  end
+      Puppet::Type.newtype(:autorequire) do
+        newparam(:name) do
+          isnamevar
+        end
 
-  Puppet::Type.newtype(:generator) do
-    include PuppetSpec::Compiler
+        autorequire(:notify) do
+          self[:name]
+        end
+      end
 
-    newparam(:name) do
-      isnamevar
-    end
+      Puppet::Type.newtype(:gen_auto) do
+        newparam(:name) do
+          isnamevar
+        end
 
-    newparam(:kind) do
-      defaultto :eval_generate
-      newvalues(:eval_generate, :generate)
-    end
+        newparam(:eval_after) do
+        end
 
-    newparam(:code)
+        def generate()
+          [ Puppet::Type.type(:autorequire).new(:name => self[:eval_after]) ]
+        end
+      end
 
-    def respond_to?(method_name)
-      method_name == self[:kind] || super
-    end
+      Puppet::Type.newtype(:empty) do
+        newparam(:name) do
+          isnamevar
+        end
+      end
 
-    def eval_generate
-      eval_code
-    end
+      Puppet::Type.newtype(:gen_empty) do
+        newparam(:name) do
+          isnamevar
+        end
 
-    def generate
-      eval_code
-    end
+        newparam(:eval_after) do
+        end
 
-    def eval_code
-      if self[:code]
-        compile_to_ral(self[:code]).resources.select { |r| r.ref =~ /Notify/ }
-      else
-        []
+        def generate()
+          [ Puppet::Type.type(:empty).new(:name => self[:eval_after], :require => "Notify[#{self[:eval_after]}]") ]
+        end
       end
+
+      example.run
+
+      Puppet::Type.rmtype(:gen_empty)
+      Puppet::Type.rmtype(:eval_after)
+      Puppet::Type.rmtype(:autorequire)
+      Puppet::Type.rmtype(:generator)
     end
   end
 
+  def find_vertex(graph, type, title)
+    graph.vertices.find {|v| v.type == type and v.title == title}
+  end
+
   context "when applying eval_generate" do
     it "should add the generated resources to the catalog" do
       catalog = compile_to_ral(<<-MANIFEST)
@@ -125,6 +182,17 @@ describe Puppet::Transaction::AdditionalResourceGenerator do
         'Generator[thing]', 'Whit[completed_thing]')
     end
 
+    it "should tag the sentinel with the tags of the resource" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        generator { thing:
+          code => 'notify { hello: }',
+          tag  => 'foo',
+        }
+      MANIFEST
+      whit = find_vertex(graph, :whit, "completed_thing")
+      expect(whit.tags).to be_superset(['thing', 'foo', 'generator'].to_set)
+    end
+
     it "should contain the generated resources in the same container as the generator" do
       catalog = compile_to_ral(<<-MANIFEST)
         class container {
@@ -242,6 +310,20 @@ describe Puppet::Transaction::AdditionalResourceGenerator do
         include_in_order("Notify[before]", "Generator[thing]", "Notify[hello]", "Notify[third]", "Notify[after]"))
     end
 
+    it "sets resources_failed_to_generate to true if resource#eval_generate raises an exception" do
+
+      catalog = compile_to_ral(<<-MANIFEST)
+        notify { 'hello': }
+      MANIFEST
+
+      catalog.resource("Notify[hello]").stubs(:eval_generate).raises(RuntimeError)
+      relationship_graph = relationship_graph_for(catalog)
+      generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, relationship_graph, prioritizer)
+      generator.eval_generate(catalog.resource("Notify[hello]"))
+
+      expect(generator.resources_failed_to_generate).to be_truthy
+    end
+
     def relationships_after_eval_generating(manifest, resource_to_generate)
       catalog = compile_to_ral(manifest)
       relationship_graph = relationship_graph_for(catalog)
@@ -368,13 +450,60 @@ describe Puppet::Transaction::AdditionalResourceGenerator do
                          "Notify[after]"))
     end
 
-    def relationships_after_generating(manifest, resource_to_generate)
-      catalog = compile_to_ral(manifest)
+    it "runs autorequire on the generated resource" do
+      graph = relationships_after_generating(<<-MANIFEST, 'Gen_auto[thing]')
+        gen_auto { thing:
+          eval_after => hello,
+        }
+
+        notify { hello: }
+        notify { goodbye: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Gen_auto[thing]",
+                         "Notify[hello]",
+                         "Autorequire[hello]",
+                         "Notify[goodbye]"))
+    end
+
+    it "evaluates metaparameters on the generated resource" do
+      graph = relationships_after_generating(<<-MANIFEST, 'Gen_empty[thing]')
+        gen_empty { thing:
+          eval_after => hello,
+        }
+
+        notify { hello: }
+        notify { goodbye: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Gen_empty[thing]",
+                         "Notify[hello]",
+                         "Empty[hello]",
+                         "Notify[goodbye]"))
+    end
+
+    it "sets resources_failed_to_generate to true if resource#generate raises an exception" do
+
+      catalog = compile_to_ral(<<-MANIFEST)
+        user { 'foo':
+          ensure => present,
+        }
+      MANIFEST
+
+      catalog.resource("User[foo]").stubs(:generate).raises(RuntimeError)
       relationship_graph = relationship_graph_for(catalog)
+      generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, relationship_graph, prioritizer)
+      generator.generate_additional_resources(catalog.resource("User[foo]"))
 
-      generate_resources_in(catalog, relationship_graph, resource_to_generate)
+      expect(generator.resources_failed_to_generate).to be_truthy
+    end
 
-      relationship_graph
+    def relationships_after_generating(manifest, resource_to_generate)
+      catalog = compile_to_ral(manifest)
+      generate_resources_in(catalog, nil, resource_to_generate)
+      relationship_graph_for(catalog)
     end
 
     def generate_resources_in(catalog, relationship_graph, resource_to_generate)

data/spec/unit/transaction/event_spec.rb

@@ -128,7 +128,9 @@ describe Puppet::Transaction::Event do
                                              :desired_value => 7, :historical_value => 'Brazil',
                                              :message => "Help I'm trapped in a spec test",
                                              :name => :mode_changed, :previous_value => 6, :property => :mode,
-                                             :status => 'success')
+                                             :status => 'success',
+                                             :redacted => false,
+                                             :corrective_change => false)
       expect(event.to_yaml_properties).to match_array(Puppet::Transaction::Event::YAML_ATTRIBUTES)
     end
   end

data/spec/unit/transaction/persistence_spec.rb

@@ -0,0 +1,178 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+require 'yaml'
+require 'fileutils'
+require 'puppet/transaction/persistence'
+
+describe Puppet::Transaction::Persistence do
+  include PuppetSpec::Files
+
+  before(:each) do
+    @basepath = File.expand_path("/somepath")
+  end
+
+  describe "when loading from file" do
+    before do
+      Puppet.settings.stubs(:use).returns(true)
+    end
+
+    describe "when the file/directory does not exist" do
+      before(:each) do
+        @path = tmpfile('storage_test')
+      end
+
+      it "should not fail to load" do
+        expect(Puppet::FileSystem.exist?(@path)).to be_falsey
+        Puppet[:statedir] = @path
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+        Puppet[:transactionstorefile] = @path
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+      end
+    end
+
+    describe "when the file/directory exists" do
+      before(:each) do
+        @tmpfile = tmpfile('storage_test')
+        Puppet[:transactionstorefile] = @tmpfile
+      end
+
+      def write_state_file(contents)
+        File.open(@tmpfile, 'w') { |f| f.write(contents) }
+      end
+
+      it "should overwrite its internal state if load() is called" do
+        resource = "Foo[bar]"
+        property = "my"
+        value = "something"
+
+        Puppet.expects(:err).never
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.set_system_value(resource, property, value)
+
+        persistence.load
+
+        expect(persistence.get_system_value(resource, property)).to eq(nil)
+      end
+
+      it "should restore its internal state if the file contains valid YAML" do
+        test_yaml = {"resources"=>{"a"=>"b"}}
+        write_state_file(test_yaml.to_yaml)
+
+        Puppet.expects(:err).never
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+
+        expect(persistence.data).to eq(test_yaml)
+      end
+
+      it "should initialize with a clear internal state if the file does not contain valid YAML" do
+        write_state_file('{ invalid')
+
+        Puppet.expects(:err).with(regexp_matches(/Transaction store file .* is corrupt/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+
+        expect(persistence.data).to eq({})
+      end
+
+      it "should initialize with a clear internal state if the file does not contain a hash of data" do
+        write_state_file("not_a_hash")
+
+        Puppet.expects(:err).with(regexp_matches(/Transaction store file .* is valid YAML but not returning a hash/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+
+        expect(persistence.data).to eq({})
+      end
+
+      it "should raise an error if the file does not contain valid YAML and cannot be renamed" do
+        write_state_file('{ invalid')
+
+        File.expects(:rename).raises(SystemCallError)
+
+        Puppet.expects(:err).with(regexp_matches(/Transaction store file .* is corrupt/))
+        Puppet.expects(:err).with(regexp_matches(/Unable to rename/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        expect { persistence.load }.to raise_error(Puppet::Error, /Could not rename/)
+      end
+
+      it "should attempt to rename the file if the file is corrupted" do
+        write_state_file('{ invalid')
+
+        File.expects(:rename).at_least_once
+
+        Puppet.expects(:err).with(regexp_matches(/Transaction store file .* is corrupt/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+      end
+
+      it "should fail gracefully on load() if the file is not a regular file" do
+        FileUtils.rm_f(@tmpfile)
+        Dir.mkdir(@tmpfile)
+
+        Puppet.expects(:warning).with(regexp_matches(/Transaction store file .* is not a file/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+      end
+    end
+  end
+
+  describe "when storing to the file" do
+    before(:each) do
+      @tmpfile = tmpfile('persistence_test')
+      @saved = Puppet[:transactionstorefile]
+      Puppet[:transactionstorefile] = @tmpfile
+    end
+
+    it "should create the file if it does not exist" do
+      expect(Puppet::FileSystem.exist?(Puppet[:transactionstorefile])).to be_falsey
+
+      persistence = Puppet::Transaction::Persistence.new
+      persistence.save
+
+      expect(Puppet::FileSystem.exist?(Puppet[:transactionstorefile])).to be_truthy
+    end
+
+    it "should raise an exception if the file is not a regular file" do
+      Dir.mkdir(Puppet[:transactionstorefile])
+      persistence = Puppet::Transaction::Persistence.new
+
+      if Puppet.features.microsoft_windows?
+        expect do
+          persistence.save
+        end.to raise_error do |error|
+          expect(error).to be_a(Puppet::Util::Windows::Error)
+          expect(error.code).to eq(5) # ERROR_ACCESS_DENIED
+        end
+      else
+        expect { persistence.save }.to raise_error(Errno::EISDIR, /Is a directory/)
+      end
+
+      Dir.rmdir(Puppet[:transactionstorefile])
+    end
+
+    it "should load the same information that it saves" do
+      resource = "File[/tmp/foo]"
+      property = "content"
+      value = "foo"
+
+      persistence = Puppet::Transaction::Persistence.new
+      persistence.set_system_value(resource, property, value)
+
+      persistence.save
+      persistence.load
+
+      expect(persistence.get_system_value(resource, property)).to eq(value)
+    end
+  end
+end