puppet 4.1.0 → 5.0.0

data/spec/unit/indirector/catalog/json_spec.rb

@@ -1,12 +1,61 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
+require 'puppet_spec/files'
 require 'puppet/resource/catalog'
 require 'puppet/indirector/catalog/json'
 
 describe Puppet::Resource::Catalog::Json do
-  # This is it for local functionality: we don't *do* anything else.
+  include PuppetSpec::Files
+
+  # This is it for local functionality
   it "should be registered with the catalog store indirection" do
     expect(Puppet::Resource::Catalog.indirection.terminus(:json)).
       to be_an_instance_of described_class
   end
+
+  describe "when handling requests" do
+    let(:binary) { "\xC0\xFF".force_encoding(Encoding::BINARY) }
+    let(:key)    { 'foo' }
+    let(:file)   { subject.path(key) }
+    let(:catalog) do
+      catalog = Puppet::Resource::Catalog.new(key, Puppet::Node::Environment.create(:testing, []))
+      catalog.add_resource(Puppet::Resource.new(:file, '/tmp/a_file', :parameters => { :content => binary }))
+      catalog
+    end
+
+    before :each do
+      Puppet.run_mode.stubs(:master?).returns(true)
+      Puppet[:server_datadir] = tmpdir('jsondir')
+      FileUtils.mkdir_p(File.join(Puppet[:server_datadir], 'indirector_testing'))
+    end
+
+    it 'saves a catalog containing binary content' do
+      request = subject.indirection.request(:save, key, catalog)
+
+      subject.save(request)
+    end
+
+    it 'finds a catalog containing binary content' do
+      request = subject.indirection.request(:save, key, catalog)
+      subject.save(request)
+
+      request = subject.indirection.request(:find, key, nil)
+      parsed_catalog = subject.find(request)
+
+      content = parsed_catalog.resource(:file, '/tmp/a_file')[:content]
+      expect(content.bytes.to_a).to eq(binary.bytes.to_a)
+    end
+
+    it 'searches for catalogs contains binary content' do
+      request = subject.indirection.request(:save, key, catalog)
+      subject.save(request)
+
+      request = subject.indirection.request(:search, '*', nil)
+      parsed_catalogs = subject.search(request)
+
+      expect(parsed_catalogs.size).to eq(1)
+      content = parsed_catalogs.first.resource(:file, '/tmp/a_file')[:content]
+      expect(content.bytes.to_a).to eq(binary.bytes.to_a)
+    end
+  end
 end

data/spec/unit/indirector/data_binding/none_spec.rb

@@ -20,9 +20,9 @@ describe Puppet::DataBinding::None do
   end
 
   describe "the behavior of the find method" do
-    it "should just return nil" do
+    it "should just throw :no_such_key" do
       data_binding = Puppet::DataBinding::None.new
-      expect(data_binding.find('fake_request')).to be_nil
+      expect { data_binding.find('fake_request') }.to throw_symbol(:no_such_key)
     end
   end
 end

data/spec/unit/indirector/face_spec.rb

@@ -40,16 +40,24 @@ describe Puppet::Indirector::Face do
   end
 
   [:find, :search, :save, :destroy].each do |method|
+    def params(method, options)
+      if method == :save
+        [nil, options]
+      else
+        [options]
+      end
+    end
+
     it "should define a '#{method}' action" do
       expect(Puppet::Indirector::Face).to be_action(method)
     end
 
     it "should call the indirection method with options when the '#{method}' action is invoked" do
-      subject.indirection.expects(method).with(:test, {})
+      subject.indirection.expects(method).with(:test, *params(method, {}))
       subject.send(method, :test)
     end
     it "should forward passed options" do
-      subject.indirection.expects(method).with(:test, {'one'=>'1'})
+      subject.indirection.expects(method).with(:test, *params(method, {'one'=>'1'}))
       subject.send(method, :test, :extra => {'one'=>'1'})
     end
   end

data/spec/unit/indirector/facts/facter_spec.rb

@@ -43,30 +43,22 @@ describe Puppet::Node::Facts::Facter do
       @facter.find(@request)
     end
 
-    it 'should add the puppetversion fact' do
+    it 'should add the puppetversion and agent_specified_environment facts' do
       reset = sequence 'reset'
       Facter.expects(:reset).in_sequence(reset)
       Facter.expects(:add).with(:puppetversion)
+      Facter.expects(:add).with(:agent_specified_environment)
       @facter.find(@request)
     end
 
-    it 'should include external facts when feature is present' do
+    it 'should include external facts' do
       reset = sequence 'reset'
-      Puppet.features.stubs(:external_facts?).returns true
       Facter.expects(:reset).in_sequence(reset)
       Puppet::Node::Facts::Facter.expects(:setup_external_search_paths).in_sequence(reset)
       Puppet::Node::Facts::Facter.expects(:setup_search_paths).in_sequence(reset)
       @facter.find(@request)
     end
 
-    it 'should not include external facts when feature is not present' do
-      reset = sequence 'reset'
-      Puppet.features.stubs(:external_facts?).returns false
-      Facter.expects(:reset).in_sequence(reset)
-      Puppet::Node::Facts::Facter.expects(:setup_search_paths).in_sequence(reset)
-      @facter.find(@request)
-    end
-
     it "should return a Facts instance" do
       expect(@facter.find(@request)).to be_instance_of(Puppet::Node::Facts)
     end
@@ -139,7 +131,7 @@ describe Puppet::Node::Facts::Facter do
     end
   end
 
-  describe 'when setting up external search paths', :if => Puppet.features.external_facts? do
+  describe 'when setting up external search paths' do
     let(:pluginfactdest) { File.expand_path 'plugin/dest' }
     let(:modulepath) { File.expand_path 'module/foo' }
     let(:modulefactsd) { File.expand_path 'module/foo/facts.d'  }

data/spec/unit/indirector/file_bucket_file/file_spec.rb

@@ -41,7 +41,7 @@ describe Puppet::FileBucketFile::File, :uses_checksums => true do
       end
 
       it "fails if the contents collide with existing contents" do
-        # This is the shortest known MD5 collision. See http://eprint.iacr.org/2010/643.pdf
+        # This is the shortest known MD5 collision. See https://eprint.iacr.org/2010/643.pdf
         first_contents = [0x6165300e,0x87a79a55,0xf7c60bd0,0x34febd0b,
                           0x6503cf04,0x854f709e,0xfb0fc034,0x874c9c65,
                           0x2f94cc40,0x15a12deb,0x5c15f4a3,0x490786bb,
@@ -52,11 +52,42 @@ describe Puppet::FileBucketFile::File, :uses_checksums => true do
                               0x2f94cc40,0x15a12deb,0xdc15f4a3,0x490786bb,
                               0x6d658673,0xa4341f7d,0x8fd75920,0xefd18d5a].pack("I" * 16)
 
-        save_bucket_file(first_contents, "/foo/bar")
+        checksum_value = save_bucket_file(first_contents, "/foo/bar")
 
+        # We expect Puppet to log an error with the path to the file
+        Puppet.expects(:err).with(regexp_matches(/Unable to verify existing FileBucket backup at '#{Puppet[:bucketdir]}.*#{checksum_value}\/contents'/))
+
+        # But the exception should not contain it
         expect do
           save_bucket_file(collision_contents, "/foo/bar")
-        end.to raise_error(Puppet::FileBucket::BucketError, /Got passed new contents/)
+        end.to raise_error(Puppet::FileBucket::BucketError, /\AExisting backup and new file have different content but same checksum, {md5}#{checksum_value}\. Verify existing backup and remove if incorrect\.\Z/)
+      end
+
+      # See PUP-1334
+      context "when the contents file exists but is corrupted and does not match the expected checksum" do
+        let(:original_contents) { "a file that will get corrupted" }
+        let(:bucket_file) { Puppet::FileBucket::File.new(original_contents) }
+        let(:contents_file) { "#{Puppet[:bucketdir]}/8/e/6/4/f/8/5/d/8e64f85dd54a412f65edabcafe44d491/contents" }
+
+        before(:each) do
+          # Ensure we're starting with a clean slate - no pre-existing backup
+          Puppet::FileSystem.unlink(contents_file) if Puppet::FileSystem.exist?(contents_file)
+          # Create initial "correct" backup
+          Puppet::FileBucket::File.indirection.save(bucket_file)
+          # Modify the contents file so that it no longer matches the SHA, simulating a corrupt backup
+          Puppet::FileSystem.unlink(contents_file) # bucket_files are read-only
+          Puppet::Util.replace_file(contents_file, 0600) { |fh| fh.puts "now with corrupted content" }
+        end
+
+        it "issues a warning that the backup will be overwritten" do
+          Puppet.expects(:warning).with(regexp_matches(/Existing backup does not match its expected sum, #{bucket_file.checksum}/))
+          Puppet::FileBucket::File.indirection.save(bucket_file)
+        end
+
+        it "overwrites the existing contents file (backup)" do
+          Puppet::FileBucket::File.indirection.save(bucket_file)
+          expect(Puppet::FileSystem.read(contents_file)).to eq(original_contents)
+        end
       end
 
       describe "when supplying a path" do
@@ -109,6 +140,57 @@ describe Puppet::FileBucketFile::File, :uses_checksums => true do
         let(:not_bucketed_plaintext) { "other stuff" }
         let(:not_bucketed_checksum) { digest(not_bucketed_plaintext) }
 
+        describe "when listing the filebucket" do
+          it "should return false/nil when the bucket is empty" do
+            expect(Puppet::FileBucket::File.indirection.find("#{digest_algorithm}/#{not_bucketed_checksum}/foo/bar", :list_all => true)).to eq(nil)
+          end
+
+          it "raises when the request is remote" do
+            Puppet[:bucketdir] = tmpdir('bucket')
+
+            request = Puppet::Indirector::Request.new(:file_bucket_file, :find, "#{digest_algorithm}/#{checksum}/foo/bar", nil, :list_all => true)
+            request.node = 'client.example.com'
+
+            expect {
+              Puppet::FileBucketFile::File.new.find(request)
+            }.to raise_error(Puppet::Error, "Listing remote file buckets is not allowed")
+          end
+
+          it "should return the list of bucketed files in a human readable way" do
+            checksum1 = save_bucket_file("I'm the contents of a file", '/foo/bar1')
+            checksum2 = save_bucket_file("I'm the contents of another file", '/foo/bar2')
+            checksum3 = save_bucket_file("I'm the modified content of a existing file", '/foo/bar1')
+
+            # Use the first checksum as we know it's stored in the bucket
+            find_result = Puppet::FileBucket::File.indirection.find("#{digest_algorithm}/#{checksum1}/foo/bar1", :list_all => true)
+
+            # The list is sort order from date and file name, so first and third checksums come before the second
+            date_pattern = '\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}'
+            expect(find_result.to_s).to match(Regexp.new("^(#{checksum1}|#{checksum3}) #{date_pattern} foo/bar1\\n(#{checksum3}|#{checksum1}) #{date_pattern} foo/bar1\\n#{checksum2} #{date_pattern} foo/bar2\\n$"))
+          end
+
+          it "should fail in an informative way when provided dates are not in the right format" do
+            contents = "I'm the contents of a file"
+            save_bucket_file(contents, '/foo/bar1')
+            expect {
+              Puppet::FileBucket::File.indirection.find(
+                "#{digest_algorithm}/#{not_bucketed_checksum}/foo/bar",
+                :list_all => true,
+                :todate => "0:0:0 1-1-1970",
+                :fromdate => "WEIRD"
+              )
+            }.to raise_error(Puppet::Error, /fromdate/)
+            expect {
+              Puppet::FileBucket::File.indirection.find(
+                "#{digest_algorithm}/#{not_bucketed_checksum}/foo/bar",
+                :list_all => true,
+                :todate => "WEIRD",
+                :fromdate => Time.now
+              )
+            }.to raise_error(Puppet::Error, /todate/)
+          end
+        end
+
         describe "when supplying a path" do
           it "should return false/nil if the file isn't bucketed" do
             expect(Puppet::FileBucket::File.indirection.head("#{digest_algorithm}/#{not_bucketed_checksum}/foo/bar")).to eq(false)
@@ -177,7 +259,7 @@ describe Puppet::FileBucketFile::File, :uses_checksums => true do
           checksum2 = save_bucket_file("foo\nbiz\nbaz")
 
           diff = Puppet::FileBucket::File.indirection.find("#{digest_algorithm}/#{checksum1}", :diff_with => checksum2)
-          expect(diff).to eq("2c2\n< bar\n---\n> biz\n")
+          expect(diff).to include("-bar\n+biz\n")
         end
 
         it "should raise an exception if the hash to diff against isn't found" do

data/spec/unit/indirector/file_server_spec.rb

@@ -249,6 +249,7 @@ describe Puppet::Indirector::FileServer do
       @configuration.stubs(:split_path).with(@request).returns([@mount, "rel/path"])
       @request.stubs(:node).returns("mynode")
       @request.stubs(:ip).returns("myip")
+      @mount.stubs(:name).returns "myname"
       @mount.stubs(:allowed?).with("mynode", "myip").returns "something"
     end
 
@@ -274,8 +275,22 @@ describe Puppet::Indirector::FileServer do
       expect(@file_server).not_to be_authorized(@request)
     end
 
-    it "should return the results of asking the mount whether the node and IP are authorized" do
-      expect(@file_server.authorized?(@request)).to eq("something")
+    it "should return true when no auth directives are defined for the mount point" do
+      @mount.stubs(:empty?).returns true
+      @mount.stubs(:globalallow?).returns nil
+      expect(@file_server).to be_authorized(@request)
+    end
+
+    it "should return true when a global allow directive is defined for the mount point" do
+      @mount.stubs(:empty?).returns false
+      @mount.stubs(:globalallow?).returns true
+      expect(@file_server).to be_authorized(@request)
+    end
+
+    it "should return false when a non-global allow directive is defined for the mount point" do
+      @mount.stubs(:empty?).returns false
+      @mount.stubs(:globalallow?).returns false
+      expect(@file_server).not_to be_authorized(@request)
     end
   end
 end

data/spec/unit/indirector/indirection_spec.rb

@@ -14,42 +14,7 @@ shared_examples_for "Indirection Delegator" do
     @indirection.send(@method, "mystuff", :one => :two)
   end
 
-  it "should let the :select_terminus method choose the terminus using the created request if the :select_terminus method is available" do
-    # Define the method, so our respond_to? hook matches.
-    class << @indirection
-      def select_terminus(request)
-      end
-    end
-
-    request = Puppet::Indirector::Request.new(:indirection, :find, "me", nil)
-
-    @indirection.stubs(:request).returns request
-
-    @indirection.expects(:select_terminus).with(request).returns :test_terminus
-
-    @indirection.stubs(:check_authorization)
-    @terminus.expects(@method)
-
-    @indirection.send(@method, "me")
-  end
-
-  it "should fail if the :select_terminus hook does not return a terminus name" do
-    # Define the method, so our respond_to? hook matches.
-    class << @indirection
-      def select_terminus(request)
-      end
-    end
-
-    request = Puppet::Indirector::Request.new(:indirection, :find, "me", nil)
-
-    @indirection.stubs(:request).returns request
-
-    @indirection.expects(:select_terminus).with(request).returns nil
-
-    expect { @indirection.send(@method, "me") }.to raise_error(ArgumentError)
-  end
-
-  it "should choose the terminus returned by the :terminus_class method if no :select_terminus method is available" do
+  it "should choose the terminus returned by the :terminus_class" do
     @indirection.expects(:terminus_class).returns :test_terminus
 
     @terminus.expects(@method)
@@ -115,7 +80,7 @@ describe Puppet::Indirector::Indirection do
   describe "when initializing" do
     # (LAK) I've no idea how to test this, really.
     it "should store a reference to itself before it consumes its options" do
-      expect { @indirection = Puppet::Indirector::Indirection.new(Object.new, :testingness, :not_valid_option) }.to raise_error
+      expect { @indirection = Puppet::Indirector::Indirection.new(Object.new, :testingness, :not_valid_option) }.to raise_error(NoMethodError, /undefined method/)
       expect(Puppet::Indirector::Indirection.instance(:testingness)).to be_instance_of(Puppet::Indirector::Indirection)
       Puppet::Indirector::Indirection.instance(:testingness).delete
     end
@@ -393,6 +358,17 @@ describe Puppet::Indirector::Indirection do
 
           @indirection.find("/my/key")
         end
+
+        it "should fail if saving to the cache fails but log the exception" do
+          @cache.stubs(:find).returns nil
+
+          @terminus.stubs(:find).returns(@instance)
+          @cache.stubs(:save).raises RuntimeError
+
+          Puppet.expects(:log_exception)
+
+          expect { @indirection.find("/my/key") }.to raise_error RuntimeError
+        end
       end
     end
 
@@ -509,7 +485,7 @@ describe Puppet::Indirector::Indirection do
 
           @cache.expects(:save).never
           @terminus.expects(:save).raises "eh"
-          expect { @indirection.save(@instance) }.to raise_error
+          expect { @indirection.save(@instance) }.to raise_error(RuntimeError, /eh/)
         end
       end
     end

data/spec/unit/indirector/json_spec.rb

@@ -60,7 +60,7 @@ describe Puppet::Indirector::JSON do
 
     def with_content(text)
       FileUtils.mkdir_p(File.dirname(file))
-      File.open(file, 'w') {|f| f.puts text }
+      File.binwrite(file, text)
       yield if block_given?
     end
 
@@ -77,11 +77,11 @@ describe Puppet::Indirector::JSON do
       end
 
       it "raises a descriptive error when the file can't be read" do
-        with_content(model.new('foo').to_pson) do
+        with_content(model.new('foo').to_json) do
           # I don't like this, but there isn't a credible alternative that
           # also works on Windows, so a stub it is. At least the expectation
           # will fail if the implementation changes. Sorry to the next dev.
-          File.expects(:read).with(file).raises(Errno::EPERM)
+          Puppet::FileSystem.expects(:read).with(file, anything).raises(Errno::EPERM)
           expect { subject.find(request) }.
             to raise_error Puppet::Error, /Could not read JSON/
         end
@@ -94,8 +94,18 @@ describe Puppet::Indirector::JSON do
         end
       end
 
+      it "raises if the content contains binary" do
+        binary = "\xC0\xFF".force_encoding(Encoding::BINARY)
+
+        with_content(binary) do
+          expect {
+            subject.find(request)
+          }.to raise_error Puppet::Error, /Could not parse JSON data/
+        end
+      end
+
       it "should return an instance of the indirected object when valid" do
-        with_content(model.new(1).to_pson) do
+        with_content(model.new(1).to_json) do
           instance = subject.find(request)
           expect(instance).to be_an_instance_of model
           expect(instance.value).to eq(1)
@@ -160,8 +170,8 @@ describe Puppet::Indirector::JSON do
     end
 
     def create_file(name, value = 12)
-      File.open(subject.path(name, ''), 'w') do |f|
-        f.puts Puppet::IndirectorTesting.new(value).to_pson
+      File.open(subject.path(name, ''), 'wb') do |f|
+        f.puts Puppet::IndirectorTesting.new(value).to_json
       end
     end
 
@@ -188,5 +198,16 @@ describe Puppet::Indirector::JSON do
       create_file('foo.json~', 'foo-backup')
       expect(subject.search(request('f*')).map(&:value)).to eq(['foo-json'])
     end
+
+    it "raises if the content contains binary" do
+      binary = "\xC0\xFF".force_encoding(Encoding::BINARY)
+
+      File.binwrite(subject.path('foo.json', ''), "foo-json")
+      File.binwrite(subject.path("foo#{binary}.bin", ''), "foo-binary")
+
+      expect {
+        subject.search(request('*'))
+      }.to raise_error Puppet::Error, /Could not parse JSON data/
+    end
   end
 end

data/spec/unit/indirector/key/file_spec.rb

@@ -66,7 +66,7 @@ describe Puppet::SSL::Key::File do
     it "should save the public key when saving the private key" do
       fh = StringIO.new
 
-      Puppet.settings.setting(:publickeydir).expects(:open_file).with(@public_key_path, 'w').yields fh
+      Puppet.settings.setting(:publickeydir).expects(:open_file).with(@public_key_path, 'w:ASCII').yields fh
       Puppet.settings.setting(:privatekeydir).stubs(:open_file)
       @public_key.expects(:to_pem).returns "my pem"
 

data/spec/unit/indirector/msgpack_spec.rb

@@ -76,12 +76,22 @@ describe Puppet::Indirector::Msgpack, :if => Puppet.features.msgpack? do
         expect(subject.find(request)).to be_nil
       end
 
+      it "can load a UTF-8 file from disk" do
+        rune_utf8 = "\u16A0\u16C7\u16BB" # ᚠᛇᚻ
+
+        with_content(model.new(rune_utf8).to_msgpack) do
+          instance = subject.find(request)
+          expect(instance).to be_an_instance_of model
+          expect(instance.value).to eq(rune_utf8)
+        end
+      end
+
       it "raises a descriptive error when the file can't be read" do
         with_content(model.new('foo').to_msgpack) do
           # I don't like this, but there isn't a credible alternative that
           # also works on Windows, so a stub it is. At least the expectation
           # will fail if the implementation changes. Sorry to the next dev.
-          File.expects(:read).with(file).raises(Errno::EPERM)
+          Puppet::FileSystem.expects(:read).with(file, {:encoding => 'utf-8'}).raises(Errno::EPERM)
           expect { subject.find(request) }.
             to raise_error Puppet::Error, /Could not read MessagePack/
         end

data/spec/unit/indirector/node/exec_spec.rb

@@ -26,7 +26,7 @@ describe Puppet::Node::Exec do
   describe "when handling the results of the command" do
     let(:testing_env) { Puppet::Node::Environment.create(:testing, []) }
     let(:other_env) { Puppet::Node::Environment.create(:other, []) }
-
+    let(:request) { Puppet::Indirector::Request.new(:node, :find, @name, nil) }
     before do
       @name = "yay"
       @node = Puppet::Node.new(@name)
@@ -38,8 +38,6 @@ describe Puppet::Node::Exec do
       @searcher.meta_def(:execute) do |command, arguments|
         return YAML.dump(result)
       end
-
-      @request = Puppet::Indirector::Request.new(:node, :find, @name, nil)
     end
 
     around do |example|
@@ -52,35 +50,37 @@ describe Puppet::Node::Exec do
 
     it "should translate the YAML into a Node instance" do
       # Use an empty hash
-      expect(@searcher.find(@request)).to equal(@node)
+      expect(@searcher.find(request)).to equal(@node)
     end
 
     it "should set the resulting parameters as the node parameters" do
       @result[:parameters] = {"a" => "b", "c" => "d"}
-      @searcher.find(@request)
+      @searcher.find(request)
       expect(@node.parameters).to eq({"a" => "b", "c" => "d"})
     end
 
     it "should set the resulting classes as the node classes" do
       @result[:classes] = %w{one two}
-      @searcher.find(@request)
+      @searcher.find(request)
       expect(@node.classes).to eq([ 'one', 'two' ])
     end
 
-    it "should merge the node's facts with its parameters" do
-      @node.expects(:fact_merge)
-      @searcher.find(@request)
+    it "should merge facts from the request if supplied" do
+      facts = Puppet::Node::Facts.new('test', 'foo' => 'bar')
+      request.options[:facts] = facts
+      @node.expects(:fact_merge).with(facts)
+      @searcher.find(request)
     end
 
     it "should set the node's environment if one is provided" do
       @result[:environment] = "testing"
-      @searcher.find(@request)
+      @searcher.find(request)
       expect(@node.environment.name).to eq(:testing)
     end
 
     it "should set the node's environment based on the request if not otherwise provided" do
-      @request.environment = "other"
-      @searcher.find(@request)
+      request.environment = "other"
+      @searcher.find(request)
       expect(@node.environment.name).to eq(:other)
     end
   end