puppet 4.2.2 → 4.2.3

data/CONTRIBUTING.md

@@ -106,7 +106,7 @@ a ticket number.
 
 # Additional Resources
 
-* [Puppet Labs community guildelines](http://docs.puppetlabs.com/community/community_guidelines.html)
+* [Puppet Labs community guidelines](http://docs.puppetlabs.com/community/community_guidelines.html)
 * [Bug tracker (Jira)](http://tickets.puppetlabs.com)
 * [Contributor License Agreement](http://links.puppetlabs.com/cla)
 * [General GitHub documentation](http://help.github.com/)

data/Gemfile

@@ -62,12 +62,7 @@ group(:extra) do
   gem "net-ssh", '~> 2.1', :require => false
   gem "puppetlabs_spec_helper", :require => false
   gem "tzinfo", :require => false
-  case RUBY_PLATFORM
-  when 'java'
-    gem "msgpack-jruby", :require => false
-  else
-    gem "msgpack", :require => false
-  end
+  gem "msgpack", :require => false
 end
 
 require 'yaml'

data/ext/redhat/client.init

@@ -18,8 +18,10 @@ export PATH
 
 [ -f /etc/sysconfig/puppet ] && . /etc/sysconfig/puppet
 lockfile=/var/lock/subsys/puppet
-pidfile=/var/run/puppetlabs/agent.pid
+piddir=/var/run/puppetlabs
+pidfile=${piddir}/agent.pid
 puppetd=/opt/puppetlabs/puppet/bin/puppet
+pid=$(cat $pidfile 2> /dev/null)
 RETVAL=0
 
 PUPPET_OPTS="agent "
@@ -29,6 +31,7 @@ PUPPET_OPTS="agent "
 if status | grep -q -- '-p' 2>/dev/null; then
     daemonopts="--pidfile $pidfile"
     pidopts="-p $pidfile"
+    USEINITFUNCTIONS=true
 fi
 
 # Figure out if the system just booted. Let's assume
@@ -38,6 +41,7 @@ fi
 
 start() {
     echo -n $"Starting puppet agent: "
+    mkdir -p $piddir
     daemon $daemonopts $puppetd ${PUPPET_OPTS} ${PUPPET_EXTRA_OPTS}
     RETVAL=$?
     echo
@@ -47,16 +51,33 @@ start() {
 
 stop() {
     echo -n $"Stopping puppet agent: "
-    killproc $pidopts $puppetd
-    RETVAL=$?
+    if [ "$USEINITFUNCTIONS" = "true" ]; then
+      killproc $pidopts $puppetd
+      RETVAL=$?
+    else
+      if [ -n "${pid}" ]; then
+        kill -TERM $pid >/dev/null 2>&1
+        RETVAL=$?
+      fi
+    fi
     echo
     [ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile}
+    return $RETVAL
 }
 
 reload() {
     echo -n $"Restarting puppet agent: "
-    killproc $pidopts $puppetd -HUP
-    RETVAL=$?
+    if [ "$USEINITFUNCTIONS" = "true" ]; then
+      killproc $pidopts $puppetd -HUP
+      RETVAL=$?
+    else
+      if [ -n "${pid}" ]; then
+        kill -HUP $pid >/dev/null 2>&1
+        RETVAL=$?
+      else
+        RETVAL=0
+      fi
+    fi
     echo
     return $RETVAL
 }
@@ -67,9 +88,33 @@ restart() {
 }
 
 rh_status() {
-    status $pidopts $puppetd
-    RETVAL=$?
-    return $RETVAL
+    base=puppet
+    if [ "$USEINITFUNCTIONS" = "true" ]; then
+      status $pidopts $puppetd
+      RETVAL=$?
+      return $RETVAL
+    else
+      if [ -n "${pid}" ]; then
+        if `ps -p $pid | grep $pid > /dev/null 2>&1`; then
+          echo "${base} (pid ${pid}) is running..."
+          RETVAL=0
+          return $RETVAL
+        fi
+      fi
+      if [ -f "${pidfile}" ] ; then
+        echo "${base} dead but pid file exists"
+        RETVAL=1
+        return $RETVAL
+      fi
+      if [ -f "${lockfile}" ]; then
+        echo "${base} dead but subsys locked"
+        RETVAL=2
+        return $RETVAL
+      fi
+      echo "${base} is stopped"
+      RETVAL=3
+      return $RETVAL
+    fi
 }
 
 rh_status_q() {

data/ext/suse/client.init

@@ -73,7 +73,7 @@ case "$1" in
                 rc_exit
             fi
         fi
-        startproc -f -w -p "${pidfile}" "${puppetd}" "${PUPPET_OPTS}" "${PUPPET_EXTRA_OPTS}" && touch "${lockfile}"
+        startproc -f -w -p "${pidfile}" "${puppetd}" "${PUPPET_OPTS}" ${PUPPET_EXTRA_OPTS} && touch "${lockfile}"
         # Remember status and be verbose
         rc_status -v
         ;;
@@ -104,22 +104,9 @@ case "$1" in
         # Remember status and be quiet
         rc_status
         ;;
-    force-reload)
-        ## Signal the daemon to reload its config. Most daemons
-        ## do this on signal 1 (SIGHUP).
-        ## If it does not support it, restart.
-
-        echo -n "Reload service puppet"
-        ## if it supports it:
-        killproc -HUP -p "${pidfile}" "${puppetd}"
-        rc_status -v
-        ;;
-    reload)
-        ## Like force-reload, but if daemon does not support
-        ## signalling, do nothing (!)
-
-        # If it supports signalling:
-        echo -n "Reload puppet services."
+    reload|force-reload)
+        # Reload the service by sending the HUP signal
+        echo -n "Reloading puppet service: "
         killproc -HUP -p "${pidfile}" "${puppetd}"
         rc_status -v
         ;;
@@ -145,7 +132,7 @@ case "$1" in
         ;;
     once)
         shift
-        $puppetd "${PUPPET_OPTS}" --onetime "${PUPPET_EXTRA_OPTS}" $@
+        $puppetd "${PUPPET_OPTS}" --onetime ${PUPPET_EXTRA_OPTS} $@
         ;;
     *)
         echo "Usage: $0 {start|stop|status|try-restart|condrestart|restart|force-reload|reload|once}"

data/lib/puppet/application/agent.rb

@@ -118,14 +118,14 @@ go into the background, attempt to get a signed certificate, and retrieve
 and apply its configuration every 30 minutes.
 
 Some flags are meant specifically for interactive use -- in particular,
-'test', 'tags' or 'fingerprint' are useful. 'test' enables verbose
-logging, causes the daemon to stay in the foreground, exits if the
-server's configuration is invalid (this happens if, for instance, you've
-left a syntax error on the server), and exits after running the
-configuration once (rather than hanging around as a long-running
-process).
-
-'tags' allows you to specify what portions of a configuration you want
+'test', 'tags' and 'fingerprint' are useful.
+
+'--test' does a single run in the foreground with verbose logging, then exits.
+It will also exit if it can't get a valid catalog. The exit code after running
+with '--test' is 0 if the catalog was successfully applied, and 1 if the run
+either failed or wasn't attempted (due to another run already in progress).
+
+'--tags' allows you to specify what portions of a configuration you want
 to apply. Puppet elements are tagged with all of the class or definition
 names that contain them, and you can use the 'tags' flag to specify one
 of these names, causing only configuration elements contained within
@@ -136,7 +136,7 @@ class, and call puppet with '--tags ntpd', which would only apply that
 small portion of the configuration during your testing, rather than
 applying the whole thing.
 
-'fingerprint' is a one-time flag. In this mode 'puppet agent' will run
+'--fingerprint' is a one-time flag. In this mode 'puppet agent' will run
 once and display on the console (and in the log) the current certificate
 (or certificate request) fingerprint. Providing the '--digest' option
 allows to use a different digest algorithm to generate the fingerprint.
@@ -181,14 +181,14 @@ generated by running puppet agent with '--genconfig'.
   Enable full debugging.
 
 * --detailed-exitcodes:
-  Provide extra information about the run via exit codes; only works if
-  '--onetime' is also specified. If enabled, 'puppet agent' will use the
+  Provide extra information about the run via exit codes; only works if '--test'
+  or '--onetime' is also specified. If enabled, 'puppet agent' will use the
   following exit codes:
 
   0: The run succeeded with no changes or failures; the system was already in
   the desired state.
 
-  1: The run failed.
+  1: The run failed, or wasn't attempted due to another run already in progress.
 
   2: The run succeeded, and some resources were changed.
 

data/lib/puppet/application/master.rb

@@ -198,7 +198,8 @@ Copyright (c) 2012 Puppet Labs, LLC Licensed under the Apache 2.0 License
           exit(39)
         end
       else
-        raise Puppet::Error.new("Could not change user to #{Puppet[:user]}. User does not exist and is required to continue.")
+        Puppet.err("Could not change user to #{Puppet[:user]}. User does not exist and is required to continue.")
+        exit(74)
       end
     end
 

data/lib/puppet/environments.rb

@@ -38,6 +38,9 @@ module Puppet::Environments
         raise EnvironmentNotFound, name
       end
     end
+
+    def clear_all
+    end
   end
 
   # @!macro [new] loader_search_paths
@@ -193,12 +196,13 @@ module Puppet::Environments
     def create_environment(name)
       env_symbol = name.intern
       setting_values = Puppet.settings.values(env_symbol, Puppet.settings.preferred_run_mode)
-      Puppet::Node::Environment.create(
+      env = Puppet::Node::Environment.create(
         env_symbol,
         Puppet::Node::Environment.split_path(setting_values.interpolate(:modulepath)),
         setting_values.interpolate(:manifest),
         setting_values.interpolate(:config_version)
       )
+      env
     end
 
     def valid_directory?(envdir)
@@ -257,6 +261,9 @@ module Puppet::Environments
       nil
     end
 
+    def clear_all
+      @loaders.each {|loader| loader.clear_all}
+    end
   end
 
   class Cached
@@ -356,6 +363,7 @@ module Puppet::Environments
     # Clears all cached environments.
     # (The intention is that this could be used from a MANUAL cache eviction command (TBD)
     def clear_all()
+      super
       @cache = {}
       @expirations.clear
       @next_expiration = END_OF_TIME

data/lib/puppet/functions/filter.rb

@@ -55,14 +55,14 @@ Puppet::Functions.create_function(:filter) do
   end
 
   def filter_Hash_1(hash)
-    result = hash.select {|x, y| yield([x, y]) }
+    result = hash.select {|x, y| yield([x, y]) == true }
     # Ruby 1.8.7 returns Array
     result = Hash[result] unless result.is_a? Hash
     result
   end
 
   def filter_Hash_2(hash)
-    result = hash.select {|x, y| yield(x, y) }
+    result = hash.select {|x, y| yield(x, y) == true }
     # Ruby 1.8.7 returns Array
     result = Hash[result] unless result.is_a? Hash
     result

data/lib/puppet/indirector/indirection.rb

@@ -196,7 +196,12 @@ class Puppet::Indirector::Indirection
         result.expiration ||= self.expiration if result.respond_to?(:expiration)
         if cache?
           Puppet.info "Caching #{self.name} for #{request.key}"
-          cache.save request(:save, key, result, options)
+          begin
+            cache.save request(:save, key, result, options)
+          rescue => detail
+            Puppet.log_exception(detail)
+            raise detail
+          end
         end
 
         filtered = result

data/lib/puppet/provider/package/nim.rb

@@ -87,7 +87,7 @@ Puppet::Type.type(:package).provide :nim, :parent => :aix, :source => :aix do
       version = nil
       showres_command << "'#{Regexp.escape(pkg)}'"
     end
-    output = Puppet::Util.execute(showres_command)
+    output = Puppet::Util::Execution.execute(showres_command)
 
 
     if (version_specified)

data/lib/puppet/settings/file_setting.rb

@@ -219,15 +219,16 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
     Puppet::Util::SUIDManager.asuser(*chown) do
       # Update the umask to make non-executable files
       Puppet::Util.withumask(File.umask ^ 0111) do
-        mode = case mode.class
-                 when String
-                   mode.to_i(8)
-                 when NilClass
-                   0640
-                 else
-                   mode
-                 end
-        yield mode
+        yielded_value = case self.mode
+                        when String
+                          self.mode.to_i(8)
+                        when NilClass
+                          0640
+                        else
+                          self.mode
+                        end
+
+        yield yielded_value
       end
     end
   end

data/lib/puppet/transaction.rb

@@ -372,6 +372,10 @@ class Puppet::Transaction
     not resource.tagged?(*tags)
   end
 
+  def split_qualified_tags?
+    false
+  end
+
   # These two methods are only made public to enable the existing spec tests to run
   # under rspec 3 (apparently rspec 2 didn't enforce access controls?). Please do not
   # treat these as part of a public API.

data/lib/puppet/util/tagging.rb

@@ -18,8 +18,10 @@ module Puppet::Util::Tagging
       if @tags.add?(name)
         # not seen before, so now we test if it is valid
         if name =~ ValidTagRegex
+          if split_qualified_tags?
           # avoid adding twice by first testing if the string contains '::'
-          @tags.merge(name.split('::')) if name.include?('::')
+            @tags.merge(name.split('::')) if name.include?('::')
+          end
         else
           @tags.delete(name)
           fail(Puppet::ParseError, "Invalid tag '#{name}'")
@@ -106,6 +108,10 @@ module Puppet::Util::Tagging
 
   private
 
+  def split_qualified_tags?
+    true
+  end
+
   def new_tags
     Puppet::Util::TagSet.new
   end

data/lib/puppet/util/windows/adsi.rb

@@ -214,8 +214,11 @@ module Puppet::Util::Windows::ADSI
     end
 
     def password=(password)
-      native_user.SetPassword(password)
-      commit
+      if !password.nil?
+        native_user.SetPassword(password)
+        commit
+      end
+
       fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
       add_flag("UserFlags", fADS_UF_DONT_EXPIRE_PASSWD)
     end

data/lib/puppet/version.rb

@@ -7,7 +7,7 @@
 
 
 module Puppet
-  PUPPETVERSION = '4.2.2'
+  PUPPETVERSION = '4.2.3'
 
   ##
   # version is a public API method intended to always provide a fast and

data/spec/unit/application/master_spec.rb

@@ -333,8 +333,8 @@ describe Puppet::Application::Master, :unless => Puppet.features.microsoft_windo
         it "should exit and log an error if running as root and the puppet user does not exist" do
           Puppet.features.stubs(:root?).returns true
           a_user_type_for("puppet").expects(:exists?).returns false
-
-          expect { @master.main }.to raise_error(Puppet::Error, /Could not change user to puppet\. User does not exist and is required to continue\./)
+          Puppet.expects(:err).with('Could not change user to puppet. User does not exist and is required to continue.')
+          expect { @master.main }.to exit_with 74
         end
       end
 

data/spec/unit/functions/filter_spec.rb

@@ -122,6 +122,24 @@ describe 'the filter method' do
     expect(catalog).to have_resource("File[/file_blueb]").with_parameter(:ensure, 'present')
   end
 
+  it 'filters on an array will not include elements for which the block returns truthy but not true' do
+    catalog = compile_to_catalog(<<-MANIFEST)
+      $r = [1, 2, 3].filter |$v| { $v } == []
+      notify { "eval_${$r}": }
+    MANIFEST
+
+    expect(catalog).to have_resource('Notify[eval_true]')
+  end
+
+  it 'filters on a hash will not include elements for which the block returns truthy but not true' do
+    catalog = compile_to_catalog(<<-MANIFEST)
+      $r = {a => 1, b => 2, c => 3}.filter |$k, $v| { $v } == {}
+      notify { "eval_${$r}": }
+    MANIFEST
+
+    expect(catalog).to have_resource('Notify[eval_true]')
+  end
+
   it_should_behave_like 'all iterative functions argument checks', 'filter'
   it_should_behave_like 'all iterative functions hash handling', 'filter'
 end

data/spec/unit/indirector/indirection_spec.rb

@@ -393,6 +393,17 @@ describe Puppet::Indirector::Indirection do
 
           @indirection.find("/my/key")
         end
+
+        it "should fail if saving to the cache fails but log the exception" do
+          @cache.stubs(:find).returns nil
+
+          @terminus.stubs(:find).returns(@instance)
+          @cache.stubs(:save).raises RuntimeError
+
+          Puppet.expects(:log_exception)
+
+          expect { @indirection.find("/my/key") }.to raise_error
+        end
       end
     end
 

data/spec/unit/provider/package/nim_spec.rb

@@ -50,7 +50,7 @@ END
     it "should install a package" do
 
       @resource.stubs(:should).with(:ensure).returns(:installed)
-      Puppet::Util.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo'").returns(bff_showres_output)
+      Puppet::Util::Execution.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo'").returns(bff_showres_output)
       @provider.expects(:nimclient).with("-o", "cust", "-a", "installp_flags=acgwXY", "-a", "lpp_source=mysource", "-a", "filesets=mypackage.foo 1.2.3.8")
       @provider.install
     end
@@ -61,7 +61,7 @@ END
         nimclient_showres_output = ""
 
         @resource.stubs(:should).with(:ensure).returns("1.2.3.4")
-        Puppet::Util.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\.4'").returns(nimclient_showres_output)
+        Puppet::Util::Execution.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\.4'").returns(nimclient_showres_output)
         expect {
           @provider.install
         }.to raise_error(Puppet::Error, "Unable to find package 'mypackage.foo' with version '1.2.3.4' on lpp_source 'mysource'")
@@ -71,7 +71,7 @@ END
         nimclient_sequence = sequence('nimclient')
 
         @resource.stubs(:should).with(:ensure).returns("1.2.3.4")
-        Puppet::Util.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\.4'").returns(bff_showres_output).in_sequence(nimclient_sequence)
+        Puppet::Util::Execution.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\.4'").returns(bff_showres_output).in_sequence(nimclient_sequence)
         @provider.expects(:nimclient).with("-o", "cust", "-a", "installp_flags=acgwXY", "-a", "lpp_source=mysource", "-a", "filesets=mypackage.foo 1.2.3.4").in_sequence(nimclient_sequence)
         @provider.install
       end
@@ -125,7 +125,7 @@ mypackage.foo              1.2.3.1         Already superseded by 1.2.3.4
 OUTPUT
 
         @resource.stubs(:should).with(:ensure).returns("1.2.3.1")
-        Puppet::Util.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\.1'").returns(bff_showres_output).in_sequence(nimclient_sequence)
+        Puppet::Util::Execution.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\.1'").returns(bff_showres_output).in_sequence(nimclient_sequence)
         @provider.expects(:nimclient).with("-o", "cust", "-a", "installp_flags=acgwXY", "-a", "lpp_source=mysource", "-a", "filesets=mypackage.foo 1.2.3.1").in_sequence(nimclient_sequence).returns(install_output)
 
         expect { @provider.install }.to raise_error(Puppet::Error, "NIM package provider is unable to downgrade packages")
@@ -136,7 +136,7 @@ OUTPUT
         nimclient_sequence = sequence('nimclient')
 
         @resource.stubs(:should).with(:ensure).returns("1.2.3-4")
-        Puppet::Util.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\-4'").returns(rpm_showres_output).in_sequence(nimclient_sequence)
+        Puppet::Util::Execution.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\-4'").returns(rpm_showres_output).in_sequence(nimclient_sequence)
         @provider.expects(:nimclient).with("-o", "cust", "-a", "installp_flags=acgwXY", "-a", "lpp_source=mysource", "-a", "filesets=mypackage.foo-1.2.3-4").in_sequence(nimclient_sequence)
         @provider.install
       end
@@ -163,7 +163,7 @@ mypackage.foo-1.2.3-1 is superseded by mypackage.foo-1.2.3-4
 OUTPUT
 
       @resource.stubs(:should).with(:ensure).returns("1.2.3-1")
-      Puppet::Util.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\-1'").returns(rpm_showres_output).in_sequence(nimclient_sequence)
+      Puppet::Util::Execution.expects(:execute).with("/usr/sbin/nimclient -o showres -a resource=mysource |/usr/bin/grep -p -E 'mypackage\\.foo( |-)1\\.2\\.3\\-1'").returns(rpm_showres_output).in_sequence(nimclient_sequence)
       @provider.expects(:nimclient).with("-o", "cust", "-a", "installp_flags=acgwXY", "-a", "lpp_source=mysource", "-a", "filesets=mypackage.foo-1.2.3-1").in_sequence(nimclient_sequence).returns(install_output)
 
       expect { @provider.install }.to raise_error(Puppet::Error, "NIM package provider is unable to downgrade packages")

data/spec/unit/provider/user/windows_adsi_spec.rb

@@ -232,7 +232,8 @@ describe Puppet::Type.type(:user).provider(:windows_adsi), :if => Puppet.feature
       resource[:name] = 'DOMAIN\testdomainuser'
       Puppet::Util::Windows::ADSI::Group.expects(:exists?).with(resource[:name]).returns(false)
       connection.expects(:Create)
-      connection.expects(:SetPassword)
+      connection.expects(:Get).with('UserFlags')
+      connection.expects(:Put).with('UserFlags', true)
       connection.expects(:SetInfo).raises( WIN32OLERuntimeError.new("(in OLE method `SetInfo': )\n    OLE error code:8007089A in Active Directory\n      The specified username is invalid.\r\n\n    HRESULT error code:0x80020009\n      Exception occurred."))
 
       expect{ provider.create }.to raise_error(

data/spec/unit/settings/file_setting_spec.rb

@@ -295,4 +295,35 @@ describe Puppet::Settings::FileSetting do
       expect(filesetting.munge(':memory:')).to eq(':memory:')
     end
   end
+
+  context "when opening", :unless => Puppet.features.microsoft_windows? do
+    let(:path) do
+      tmpfile('file_setting_spec')
+    end
+
+    let(:setting) do
+      settings = mock("settings", :value => path)
+      FileSetting.new(:name => :mysetting, :desc => "creates a file", :settings => settings)
+    end
+
+    it "creates a file with mode 0640" do
+      setting.mode = '0640'
+
+      expect(File).to_not be_exist(path)
+      setting.open('w')
+
+      expect(File).to be_exist(path)
+      expect(Puppet::FileSystem.stat(path).mode & 0777).to eq(0640)
+    end
+
+    it "preserves the mode of an existing file" do
+      setting.mode = '0640'
+
+      Puppet::FileSystem.touch(path)
+      Puppet::FileSystem.chmod(0644, path)
+      setting.open('w')
+
+      expect(Puppet::FileSystem.stat(path).mode & 0777).to eq(0644)
+    end
+  end
 end

data/spec/unit/transaction_spec.rb

@@ -721,6 +721,13 @@ describe Puppet::Transaction, " when determining tags" do
     expect(@transaction).to be_tagged("one::two")
   end
 
+  it "should tag one::two only as 'one::two' and not 'one', 'two', and 'one::two'" do
+    @transaction.tags = "one::two"
+    expect(@transaction).to be_tagged("one::two")
+    expect(@transaction).to_not be_tagged("one")
+    expect(@transaction).to_not be_tagged("two")
+  end
+
   it "should accept a comma-delimited string" do
     @transaction.tags = "one, two"
     expect(@transaction).to be_tagged("one")

data/spec/unit/util/windows/adsi_spec.rb

@@ -183,6 +183,19 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         user.password = 'pwd'
       end
 
+       it "should be able manage a user without a password" do
+        adsi_user.expects(:SetPassword).with('pwd').never
+        adsi_user.expects(:SetInfo).at_least_once
+
+        flagname = "UserFlags"
+        fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
+
+        adsi_user.expects(:Get).with(flagname).returns(0)
+        adsi_user.expects(:Put).with(flagname, fADS_UF_DONT_EXPIRE_PASSWD)
+
+        user.password = nil
+      end
+
       it "should generate the correct URI" do
         Puppet::Util::Windows::SID.stubs(:octet_string_to_sid_object).returns(sid)
         expect(user.uri).to eq("WinNT://testcomputername/#{username},user")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: puppet
 version: !ruby/object:Gem::Version
-  version: 4.2.2
+  version: 4.2.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-10 00:00:00.000000000 Z
+date: 2015-10-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter