puppet 4.5.3-x64-mingw32 → 4.6.1-x64-mingw32

data/spec/unit/ssl/host_spec.rb

@@ -649,7 +649,7 @@ describe Puppet::SSL::Host do
       it "should use the CA to sign its certificate request if it does not have a certificate" do
         @host.expects(:certificate).returns nil
 
-        @ca.expects(:sign).with(@host.name, true)
+        @ca.expects(:sign).with(@host.name, {allow_dns_alt_names: true})
 
         @host.generate
       end

data/spec/unit/ssl/oids_spec.rb

@@ -12,28 +12,31 @@ describe Puppet::SSL::Oids do
       'pp_instance_id'      => '1.3.6.1.4.1.34380.1.1.2',
       'pp_image_name'       => '1.3.6.1.4.1.34380.1.1.3',
       'pp_preshared_key'    => '1.3.6.1.4.1.34380.1.1.4',
-      'pp_cost_center'      => "1.3.6.1.4.1.34380.1.1.5",
-      'pp_product'          => "1.3.6.1.4.1.34380.1.1.6",
-      'pp_project'          => "1.3.6.1.4.1.34380.1.1.7",
-      'pp_application'      => "1.3.6.1.4.1.34380.1.1.8",
-      'pp_service'          => "1.3.6.1.4.1.34380.1.1.9",
-      'pp_employee'         => "1.3.6.1.4.1.34380.1.1.10",
-      'pp_created_by'       => "1.3.6.1.4.1.34380.1.1.11",
-      'pp_environment'      => "1.3.6.1.4.1.34380.1.1.12",
-      'pp_role'             => "1.3.6.1.4.1.34380.1.1.13",
-      'pp_software_version' => "1.3.6.1.4.1.34380.1.1.14",
-      'pp_department'       => "1.3.6.1.4.1.34380.1.1.15",
-      'pp_cluster'          => "1.3.6.1.4.1.34380.1.1.16",
-      'pp_provisioner'      => "1.3.6.1.4.1.34380.1.1.17",
-      'pp_region'           => "1.3.6.1.4.1.34380.1.1.18",
-      'pp_datacenter'       => "1.3.6.1.4.1.34380.1.1.19",
-      'pp_zone'             => "1.3.6.1.4.1.34380.1.1.20",
-      'pp_network'          => "1.3.6.1.4.1.34380.1.1.21",
-      'pp_securitypolicy'   => "1.3.6.1.4.1.34380.1.1.22",
-      'pp_cloudplatform'    => "1.3.6.1.4.1.34380.1.1.23",
-      'pp_apptier'          => "1.3.6.1.4.1.34380.1.1.24",
-      'pp_hostname'         => "1.3.6.1.4.1.34380.1.1.25",
+      'pp_cost_center'      => '1.3.6.1.4.1.34380.1.1.5',
+      'pp_product'          => '1.3.6.1.4.1.34380.1.1.6',
+      'pp_project'          => '1.3.6.1.4.1.34380.1.1.7',
+      'pp_application'      => '1.3.6.1.4.1.34380.1.1.8',
+      'pp_service'          => '1.3.6.1.4.1.34380.1.1.9',
+      'pp_employee'         => '1.3.6.1.4.1.34380.1.1.10',
+      'pp_created_by'       => '1.3.6.1.4.1.34380.1.1.11',
+      'pp_environment'      => '1.3.6.1.4.1.34380.1.1.12',
+      'pp_role'             => '1.3.6.1.4.1.34380.1.1.13',
+      'pp_software_version' => '1.3.6.1.4.1.34380.1.1.14',
+      'pp_department'       => '1.3.6.1.4.1.34380.1.1.15',
+      'pp_cluster'          => '1.3.6.1.4.1.34380.1.1.16',
+      'pp_provisioner'      => '1.3.6.1.4.1.34380.1.1.17',
+      'pp_region'           => '1.3.6.1.4.1.34380.1.1.18',
+      'pp_datacenter'       => '1.3.6.1.4.1.34380.1.1.19',
+      'pp_zone'             => '1.3.6.1.4.1.34380.1.1.20',
+      'pp_network'          => '1.3.6.1.4.1.34380.1.1.21',
+      'pp_securitypolicy'   => '1.3.6.1.4.1.34380.1.1.22',
+      'pp_cloudplatform'    => '1.3.6.1.4.1.34380.1.1.23',
+      'pp_apptier'          => '1.3.6.1.4.1.34380.1.1.24',
+      'pp_hostname'         => '1.3.6.1.4.1.34380.1.1.25',
       'ppPrivCertExt'       => '1.3.6.1.4.1.34380.1.2',
+      'ppAuthCertExt'       => '1.3.6.1.4.1.34380.1.3',
+      'pp_authorization'    => '1.3.6.1.4.1.34380.1.3.1',
+      'pp_auth_role'        => '1.3.6.1.4.1.34380.1.3.13',
     }.each_pair do |sn, oid|
       it "defines #{sn} as #{oid}" do
         object_id = OpenSSL::ASN1::ObjectId.new(sn)

data/spec/unit/transaction/event_spec.rb

@@ -128,7 +128,9 @@ describe Puppet::Transaction::Event do
                                              :desired_value => 7, :historical_value => 'Brazil',
                                              :message => "Help I'm trapped in a spec test",
                                              :name => :mode_changed, :previous_value => 6, :property => :mode,
-                                             :status => 'success')
+                                             :status => 'success',
+                                             :redacted => false,
+                                             :corrective_change => false)
       expect(event.to_yaml_properties).to match_array(Puppet::Transaction::Event::YAML_ATTRIBUTES)
     end
   end

data/spec/unit/transaction/persistence_spec.rb

@@ -0,0 +1,173 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+require 'yaml'
+require 'fileutils'
+require 'puppet/transaction/persistence'
+
+describe Puppet::Transaction::Persistence do
+  include PuppetSpec::Files
+
+  before(:each) do
+    @basepath = File.expand_path("/somepath")
+  end
+
+  describe "when loading from file" do
+    before do
+      Puppet.settings.stubs(:use).returns(true)
+    end
+
+    describe "when the file/directory does not exist" do
+      before(:each) do
+        @path = tmpfile('storage_test')
+      end
+
+      it "should not fail to load" do
+        expect(Puppet::FileSystem.exist?(@path)).to be_falsey
+        Puppet[:statedir] = @path
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+        Puppet[:transactionstorefile] = @path
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+      end
+    end
+
+    describe "when the file/directory exists" do
+      before(:each) do
+        @tmpfile = tmpfile('storage_test')
+        Puppet[:transactionstorefile] = @tmpfile
+      end
+
+      def write_state_file(contents)
+        File.open(@tmpfile, 'w') { |f| f.write(contents) }
+      end
+
+      it "should overwrite its internal state if load() is called" do
+        resource = "Foo[bar]"
+        property = "my"
+        value = "something"
+
+        Puppet.expects(:err).never
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.set_system_value(resource, property, value)
+
+        persistence.load
+
+        expect(persistence.get_system_value(resource, property)).to eq(nil)
+      end
+
+      it "should restore its internal state if the file contains valid YAML" do
+        test_yaml = {"resources"=>{"a"=>"b"}}
+        write_state_file(test_yaml.to_yaml)
+
+        Puppet.expects(:err).never
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+
+        expect(persistence.data).to eq(test_yaml)
+      end
+
+      it "should initialize with a clear internal state if the file does not contain valid YAML" do
+        write_state_file('{ invalid')
+
+        Puppet.expects(:err).with(regexp_matches(/Transaction store file .* is corrupt/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+
+        expect(persistence.data).to eq({})
+      end
+
+      it "should initialize with a clear internal state if the file does not contain a hash of data" do
+        write_state_file("not_a_hash")
+
+        Puppet.expects(:err).with(regexp_matches(/Transaction store file .* is valid YAML but not returning a hash/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+
+        expect(persistence.data).to eq({})
+      end
+
+      it "should raise an error if the file does not contain valid YAML and cannot be renamed" do
+        write_state_file('{ invalid')
+
+        File.expects(:rename).raises(SystemCallError)
+
+        Puppet.expects(:err).with(regexp_matches(/Transaction store file .* is corrupt/))
+        Puppet.expects(:err).with(regexp_matches(/Unable to rename/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        expect { persistence.load }.to raise_error(Puppet::Error, /Could not rename/)
+      end
+
+      it "should attempt to rename the file if the file is corrupted" do
+        write_state_file('{ invalid')
+
+        File.expects(:rename).at_least_once
+
+        Puppet.expects(:err).with(regexp_matches(/Transaction store file .* is corrupt/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+      end
+
+      it "should fail gracefully on load() if the file is not a regular file" do
+        FileUtils.rm_f(@tmpfile)
+        Dir.mkdir(@tmpfile)
+
+        Puppet.expects(:warning).with(regexp_matches(/Transaction store file .* is not a file/))
+
+        persistence = Puppet::Transaction::Persistence.new
+        persistence.load
+      end
+    end
+  end
+
+  describe "when storing to the file" do
+    before(:each) do
+      @tmpfile = tmpfile('persistence_test')
+      @saved = Puppet[:transactionstorefile]
+      Puppet[:transactionstorefile] = @tmpfile
+    end
+
+    it "should create the file if it does not exist" do
+      expect(Puppet::FileSystem.exist?(Puppet[:transactionstorefile])).to be_falsey
+
+      persistence = Puppet::Transaction::Persistence.new
+      persistence.save
+
+      expect(Puppet::FileSystem.exist?(Puppet[:transactionstorefile])).to be_truthy
+    end
+
+    it "should raise an exception if the file is not a regular file" do
+      Dir.mkdir(Puppet[:transactionstorefile])
+      persistence = Puppet::Transaction::Persistence.new
+
+      if Puppet.features.microsoft_windows?
+        expect { persistence.save }.to raise_error(Puppet::Util::Windows::Error, /Access is denied/)
+      else
+        expect { persistence.save }.to raise_error(Errno::EISDIR, /Is a directory/)
+      end
+
+      Dir.rmdir(Puppet[:transactionstorefile])
+    end
+
+    it "should load the same information that it saves" do
+      resource = "File[/tmp/foo]"
+      property = "content"
+      value = "foo"
+
+      persistence = Puppet::Transaction::Persistence.new
+      persistence.set_system_value(resource, property, value)
+
+      persistence.save
+      persistence.load
+
+      expect(persistence.get_system_value(resource, property)).to eq(value)
+    end
+  end
+end

data/spec/unit/transaction/report_spec.rb

@@ -70,6 +70,24 @@ describe Puppet::Transaction::Report do
     expect(report.cached_catalog_status).to eq("explicitly_requested")
   end
 
+  it "should set noop to true if Puppet[:noop] is true" do
+    Puppet[:noop] = true
+    report = Puppet::Transaction::Report.new("apply")
+    expect(report.noop).to be_truthy
+  end
+
+  it "should set noop to false if Puppet[:noop] is false" do
+    Puppet[:noop] = false
+    report = Puppet::Transaction::Report.new("apply")
+    expect(report.noop).to be_falsey
+  end
+
+  it "should set noop to false if Puppet[:noop] is unset" do
+    Puppet[:noop] = nil
+    report = Puppet::Transaction::Report.new("apply")
+    expect(report.noop).to be_falsey
+  end
+
   it "should take 'environment' as an argument" do
     expect(Puppet::Transaction::Report.new("inspect", "some configuration version", "some environment").environment).to eq("some environment")
   end
@@ -218,7 +236,6 @@ describe Puppet::Transaction::Report do
       end
     end
 
-
     [:time, :resources, :changes, :events].each do |type|
       it "should add #{type} metrics" do
         @report.finalize_report
@@ -334,6 +351,50 @@ describe Puppet::Transaction::Report do
         end
       end
     end
+
+    describe "for noop events" do
+      it "should have 'noop_pending == false' when no events are available" do
+        add_statuses(3)
+        @report.finalize_report
+        expect(@report.noop_pending).to be_falsey
+      end
+
+      it "should have 'noop_pending == false' when no 'noop' events are available" do
+        add_statuses(3) do |status|
+          ['success', 'audit'].each do |status_name|
+            event = Puppet::Transaction::Event.new
+            event.status = status_name
+            status.add_event(event)
+          end
+        end
+        @report.finalize_report
+        expect(@report.noop_pending).to be_falsey
+      end
+
+      it "should have 'noop_pending == true' when 'noop' events are available" do
+        add_statuses(3) do |status|
+          ['success', 'audit', 'noop'].each do |status_name|
+            event = Puppet::Transaction::Event.new
+            event.status = status_name
+            status.add_event(event)
+          end
+        end
+        @report.finalize_report
+        expect(@report.noop_pending).to be_truthy
+      end
+
+      it "should have 'noop_pending == true' when 'noop' and 'failure' events are available" do
+        add_statuses(3) do |status|
+          ['success', 'failure', 'audit', 'noop'].each do |status_name|
+            event = Puppet::Transaction::Event.new
+            event.status = status_name
+            status.add_event(event)
+          end
+        end
+        @report.finalize_report
+        expect(@report.noop_pending).to be_truthy
+      end
+    end
   end
 
   describe "when producing a summary" do
@@ -509,6 +570,7 @@ describe Puppet::Transaction::Report do
     report.code_id = "some code id"
     report.catalog_uuid = "some catalog uuid"
     report.cached_catalog_status = "not_used"
+    report.master_used = "test:000"
     report.add_resource_status(status)
     report.finalize_report
     report
@@ -525,6 +587,7 @@ describe Puppet::Transaction::Report do
     report.code_id = "some code id"
     report.catalog_uuid = "some catalog uuid"
     report.cached_catalog_status = "not_used"
+    report.master_used = "test:000"
     report.add_resource_status(status)
     report.finalize_report
     report

data/spec/unit/transaction/resource_harness_spec.rb

@@ -418,6 +418,97 @@ describe Puppet::Transaction::ResourceHarness do
     end
   end
 
+  describe "handling sensitive properties" do
+    describe 'when syncing' do
+      let(:test_file) do
+        tmpfile('foo').tap do |path|
+          File.open(path, 'w') { |fh| fh.write("goodbye world") }
+        end
+      end
+
+      let(:resource) do
+        Puppet::Type.type(:file).new(:path => test_file, :backup => false, :content => "hello world").tap do |r|
+          r.parameter(:content).sensitive = true
+        end
+      end
+
+      it "redacts event messages for sensitive properties" do
+        status = @harness.evaluate(resource)
+        sync_event = status.events[0]
+        expect(sync_event.message).to eq 'changed [redacted] to [redacted]'
+      end
+
+      it "redacts event contents for sensitive properties" do
+        status = @harness.evaluate(resource)
+        sync_event = status.events[0]
+        expect(sync_event.previous_value).to eq '[redacted]'
+        expect(sync_event.desired_value).to eq '[redacted]'
+      end
+
+      it "redacts event messages for sensitive properties when simulating noop changes" do
+        resource[:noop] = true
+        status = @harness.evaluate(resource)
+        sync_event = status.events[0]
+        expect(sync_event.message).to eq 'current_value [redacted], should be [redacted] (noop)'
+      end
+
+      describe 'auditing' do
+        before do
+          resource[:audit] = ['content']
+        end
+
+        it "redacts notices when a parameter is newly audited" do
+          resource.property(:content).expects(:notice).with("audit change: newly-recorded value [redacted]")
+          @harness.evaluate(resource)
+        end
+
+        it "redacts event messages for sensitive properties" do
+          Puppet::Util::Storage.stubs(:cache).with(resource).returns({:content => "historical world"})
+          status = @harness.evaluate(resource)
+          sync_event = status.events[0]
+          expect(sync_event.message).to eq 'changed [redacted] to [redacted] (previously recorded value was [redacted])'
+        end
+
+        it "redacts audit event messages for sensitive properties when simulating noop changes" do
+          Puppet::Util::Storage.stubs(:cache).with(resource).returns({:content => "historical world"})
+          resource[:noop] = true
+          status = @harness.evaluate(resource)
+          sync_event = status.events[0]
+          expect(sync_event.message).to eq 'current_value [redacted], should be [redacted] (noop) (previously recorded value was [redacted])'
+        end
+
+        it "redacts event contents for sensitive properties" do
+          Puppet::Util::Storage.stubs(:cache).with(resource).returns({:content => "historical world"})
+          status = @harness.evaluate(resource)
+          sync_event = status.events[0]
+          expect(sync_event.historical_value).to eq '[redacted]'
+        end
+      end
+    end
+
+    describe 'handling errors' do
+      it "redacts event messages generated when syncing a param raises a StandardError" do
+        stub_provider = make_stub_provider
+        resource = stub_provider.new :name => 'name', :bar => 1
+        resource.parameter(:bar).sensitive = true
+        status = @harness.evaluate(resource)
+
+        error_event = status.events[0]
+        expect(error_event.message).to eq "change from [redacted] to [redacted] failed: bar"
+      end
+
+      it "redacts event messages generated when syncing a param raises an Exception" do
+        stub_provider = make_stub_provider
+        resource = stub_provider.new :name => 'name', :baz => 1
+        resource.parameter(:baz).sensitive = true
+
+        expect { @harness.evaluate(resource) }.to raise_error(Exception, 'baz')
+
+        expect(@logs.first.message).to eq "change from [redacted] to [redacted] failed: baz"
+      end
+    end
+  end
+
   describe "when finding the schedule" do
     before do
       @catalog = Puppet::Resource::Catalog.new

data/spec/unit/type/file/content_spec.rb

@@ -184,25 +184,30 @@ describe Puppet::Type.type(:file).attrclass(:content), :uses_checksums => true d
           expect(content.respond_to?("diff")).to eq(false)
         end
 
-        [true, false].product([true, false]).each do |cfg, param|
-          describe "and Puppet[:show_diff] is #{cfg} and show_diff => #{param}" do
+        describe "showing the diff" do
+          it "doesn't show the diff when #show_diff? is false" do
+            content.expects(:show_diff?).returns false
+            content.expects(:diff).never
+            expect(content).not_to be_safe_insync("other content")
+          end
+
+          describe "and #show_diff? is true" do
             before do
-              Puppet[:show_diff] = cfg
-              resource.stubs(:show_diff?).returns param
+              content.expects(:show_diff?).returns true
               resource[:loglevel] = "debug"
             end
 
-            if cfg and param
-              it "should display a diff" do
-                content.expects(:diff).returns("my diff").once
-                content.expects(:debug).with("\nmy diff").once
-                expect(content).not_to be_safe_insync("other content")
-              end
-            else
-              it "should not display a diff" do
-                content.expects(:diff).never
-                expect(content).not_to be_safe_insync("other content")
-              end
+            it "prints the diff" do
+              content.expects(:diff).returns("my diff").once
+              content.expects(:debug).with("\nmy diff").once
+              expect(content).not_to be_safe_insync("other content")
+            end
+
+            it "redacts the diff when the property is sensitive" do
+              content.sensitive = true
+              content.expects(:diff).returns("my diff").never
+              content.expects(:debug).with("[diff redacted]").once
+              expect(content).not_to be_safe_insync("other content")
             end
           end
         end
@@ -308,6 +313,33 @@ describe Puppet::Type.type(:file).attrclass(:content), :uses_checksums => true d
     end
   end
 
+  describe "determining if a diff should be shown" do
+    let(:content) { described_class.new(:resource => resource) }
+
+    before do
+      Puppet[:show_diff] = true
+      resource[:show_diff] = true
+    end
+
+    it "is true if there are changes and the global and per-resource show_diff settings are true" do
+      expect(content.show_diff?(true)).to be_truthy
+    end
+
+    it "is false if there are no changes" do
+      expect(content.show_diff?(false)).to be_falsey
+    end
+
+    it "is false if show_diff is globally disabled" do
+      Puppet[:show_diff] = false
+      expect(content.show_diff?(false)).to be_falsey
+    end
+
+    it "is false if show_diff is disabled on the resource" do
+      resource[:show_diff] = false
+      expect(content.show_diff?(false)).to be_falsey
+    end
+  end
+
   describe "when changing the content" do
     let(:content) { described_class.new(:resource => resource) }