puppet 5.0.0 → 6.0.0

data/spec/unit/settings_spec.rb

@@ -104,7 +104,6 @@ describe Puppet::Settings do
     end
 
     it "should fail if the app defaults hash is missing any required values" do
-      incomplete_default_values = default_values.reject { |key, _| key == :confdir }
       expect {
         @settings.initialize_app_defaults(default_values.reject { |key, _| key == :confdir })
       }.to raise_error(Puppet::Settings::SettingsError)
@@ -556,7 +555,8 @@ describe Puppet::Settings do
           :two    => { :default => "$one TWO", :desc => "b"},
           :three  => { :default => "$one $two THREE", :desc => "c"},
           :four   => { :default => "$two $three FOUR", :desc => "d"},
-          :five   => { :default => nil, :desc => "e" }
+          :five   => { :default => nil, :desc => "e" },
+          :code   => { :default => "", :desc => "my code"}
       Puppet::FileSystem.stubs(:exist?).returns true
     end
 
@@ -612,6 +612,13 @@ describe Puppet::Settings do
       expect(@settings[:two]).to eq("one TWO")
     end
 
+    it "should not interpolate the value of the :code setting" do
+      @code = @settings.setting(:code)
+      @code.expects(:munge).never
+
+      expect(@settings[:code]).to eq("")
+    end
+
     it "should have a run_mode that defaults to user" do
       expect(@settings.preferred_run_mode).to eq(:user)
     end
@@ -658,7 +665,6 @@ describe Puppet::Settings do
 
     it "should not return values outside of its search path" do
       text = "[other]\none = oval\n"
-      file = "/some/file"
       @settings.stubs(:read_file).returns(text)
       @settings.send(:parse_config_files)
       expect(@settings[:one]).to eq("ONE")
@@ -938,7 +944,6 @@ describe Puppet::Settings do
     end
 
     it "does not require the value for a setting without a hook to resolve during global setup" do
-      hook_invoked = false
       @settings.define_settings :section, :can_cause_problems  => {:desc => '' }
 
       @settings.define_settings(:main,
@@ -1308,7 +1313,7 @@ describe Puppet::Settings do
       @settings.to_catalog
     end
 
-    describe "on Microsoft Windows", :if => Puppet.features.microsoft_windows? do
+    describe "on Microsoft Windows", :if => Puppet::Util::Platform.windows? do
       before :each do
         Puppet.features.stubs(:root?).returns true
 
@@ -1354,6 +1359,49 @@ describe Puppet::Settings do
         expect(catalog.resource_keys).to include(["File", "#{envdir}/production"])
       end
 
+      it 'adds the creation of the production directory when not run as root' do
+        envdir = "#{tmpenv}/custom_envpath"
+        envpath = "#{envdir}#{File::PATH_SEPARATOR}/some/other/envdir"
+        @settings[:environmentpath] = envpath
+        Dir.mkdir(envdir)
+        Puppet.features.stubs(:root?).returns false
+        catalog = @settings.to_catalog
+        resource = catalog.resource('File', File.join(envdir, 'production'))
+        expect(resource[:mode]).to eq('0750')
+        expect(resource[:owner]).to be_nil
+        expect(resource[:group]).to be_nil
+      end
+
+      it 'adds the creation of the production directory with service owner and group information when available' do
+        envdir = "#{tmpenv}/custom_envpath"
+        envpath = "#{envdir}#{File::PATH_SEPARATOR}/some/other/envdir"
+        @settings[:environmentpath] = envpath
+        Dir.mkdir(envdir)
+        Puppet.features.stubs(:root?).returns true
+        @settings.stubs(:service_user_available?).returns true
+        @settings.stubs(:service_group_available?).returns true
+        catalog = @settings.to_catalog
+        resource = catalog.resource('File', File.join(envdir, 'production'))
+        expect(resource[:mode]).to eq('0750')
+        expect(resource[:owner]).to eq('puppet')
+        expect(resource[:group]).to eq('puppet')
+      end
+
+      it 'adds the creation of the production directory without service owner and group when not available' do
+        envdir = "#{tmpenv}/custom_envpath"
+        envpath = "#{envdir}#{File::PATH_SEPARATOR}/some/other/envdir"
+        @settings[:environmentpath] = envpath
+        Dir.mkdir(envdir)
+        Puppet.features.stubs(:root?).returns true
+        @settings.stubs(:service_user_available?).returns false
+        @settings.stubs(:service_group_available?).returns false
+        catalog = @settings.to_catalog
+        resource = catalog.resource('File', File.join(envdir, 'production'))
+        expect(resource[:mode]).to eq('0750')
+        expect(resource[:owner]).to be_nil
+        expect(resource[:group]).to be_nil
+      end
+
       it "handles a non-existent environmentpath" do
         catalog = @settings.to_catalog
         expect(catalog.resource_keys).to be_empty
@@ -1377,7 +1425,7 @@ describe Puppet::Settings do
       before :all do
         # when this spec is run in isolation to build a settings catalog
         # it will not be able to autorequire and load types for the first time
-        # on Windows with microsoft_windows? stubbed to false, because
+        # on Windows with windows? stubbed to false, because
         # Puppet::Util.path_to_uri is called to generate a URI to load code
         # and it manipulates the path based on OS
         # so instead we forcefully "prime" the cached types
@@ -1389,7 +1437,7 @@ describe Puppet::Settings do
       before do
         Puppet.features.stubs(:root?).returns true
         # stubbed to false, as Windows catalogs don't add users / groups
-        Puppet.features.stubs(:microsoft_windows?).returns false
+        Puppet::Util::Platform.stubs(:windows?).returns false
 
         @settings.define_settings :foo,
             :mkusers => { :type => :boolean, :default => true, :desc => "e" },
@@ -1432,6 +1480,8 @@ describe Puppet::Settings do
 
       it "should not add users or groups to the catalog if :mkusers is a valid setting but is disabled" do
         @settings[:mkusers] = false
+        @settings.stubs(:service_user_available?).returns(false)
+        @settings.stubs(:service_group_available?).returns(false)
 
         catalog = @settings.to_catalog
         expect(catalog.resource(:user, "suser")).to be_nil

data/spec/unit/ssl/certificate_request_attributes_spec.rb

@@ -3,12 +3,14 @@ require 'spec_helper'
 require 'puppet/ssl/certificate_request_attributes'
 
 describe Puppet::SSL::CertificateRequestAttributes do
+  include PuppetSpec::Files
 
   let(:expected) do
     {
       "custom_attributes" => {
         "1.3.6.1.4.1.34380.2.2"=>[3232235521, 3232235777], # system IPs in hex
         "1.3.6.1.4.1.34380.2.0"=>"hostname.domain.com",
+        "1.3.6.1.4.1.34380.1.1.3"=>:node_image_name,
         # different UTF-8 widths
         # 1-byte A
         # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
@@ -19,7 +21,7 @@ describe Puppet::SSL::CertificateRequestAttributes do
     }
   end
   let(:csr_attributes_hash) { expected.dup }
-  let(:csr_attributes_path) { '/some/where/csr_attributes.yaml' }
+  let(:csr_attributes_path) { tmpfile('csr_attributes.yaml') }
   let(:csr_attributes) { Puppet::SSL::CertificateRequestAttributes.new(csr_attributes_path) }
 
   it "initializes with a path" do
@@ -28,13 +30,13 @@ describe Puppet::SSL::CertificateRequestAttributes do
 
   describe "loading" do
     it "returns nil when loading from a non-existent file" do
-      expect(csr_attributes.load).to be_falsey
+      nonexistent = Puppet::SSL::CertificateRequestAttributes.new('/does/not/exist.yaml')
+      expect(nonexistent.load).to be_falsey
     end
 
     context "with an available attributes file" do
       before do
-        Puppet::FileSystem.expects(:exist?).with(csr_attributes_path).returns(true)
-        Puppet::Util::Yaml.expects(:load_file).with(csr_attributes_path, {}).returns(csr_attributes_hash)
+        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
       end
 
       it "loads csr attributes from a file when the file is present" do
@@ -47,20 +49,31 @@ describe Puppet::SSL::CertificateRequestAttributes do
       end
 
       it "returns an empty hash if custom_attributes points to nil" do
-        csr_attributes_hash["custom_attributes"] = nil
+        Puppet::Util::Yaml.dump({'custom_attributes' => nil }, csr_attributes_path)
         csr_attributes.load
         expect(csr_attributes.custom_attributes).to eq({})
       end
 
       it "returns an empty hash if custom_attributes key is not present" do
-        csr_attributes_hash.delete("custom_attributes")
+        Puppet::Util::Yaml.dump({}, csr_attributes_path)
         csr_attributes.load
         expect(csr_attributes.custom_attributes).to eq({})
       end
 
-      it "raise a Puppet::Error if an unexpected root key is defined" do
+      it "raises a Puppet::Error if an unexpected root key is defined" do
         csr_attributes_hash['unintentional'] = 'data'
-        expect { csr_attributes.load }.to raise_error(Puppet::Error, /unexpected attributes.*unintentional/)
+        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
+        expect {
+          csr_attributes.load
+        }.to raise_error(Puppet::Error, /unexpected attributes.*unintentional/)
+      end
+
+      it "raises a Puppet::Util::Yaml::YamlLoadError if an unexpected ruby object is present" do
+        csr_attributes_hash['custom_attributes']['whoops'] = Object.new
+        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
+        expect {
+          csr_attributes.load
+        }.to raise_error(Puppet::Util::Yaml::YamlLoadError, /Tried to load unspecified class: Object/)
       end
     end
   end

data/spec/unit/ssl/certificate_request_spec.rb

@@ -71,7 +71,7 @@ describe Puppet::SSL::CertificateRequest do
       expect(request.to_s).to eq("")
     end
 
-    it "should convert the request to pem format when converted to a string" do
+    it "should convert the request to pem format when converted to a string", :unless => RUBY_PLATFORM == 'java' do
       request.generate(key)
       expect(request.to_s).to eq(request.content.to_pem)
     end
@@ -84,7 +84,7 @@ describe Puppet::SSL::CertificateRequest do
     end
   end
 
-  describe "when generating" do
+  describe "when generating", :unless => RUBY_PLATFORM == 'java' do
     it "should use the content of the provided key if the key is a Puppet::SSL::Key instance" do
       request.generate(key)
       expect(request.content.verify(key.content.public_key)).to be_truthy
@@ -95,12 +95,6 @@ describe Puppet::SSL::CertificateRequest do
       expect(request.content.subject).to eq OpenSSL::X509::Name.new([['CN', key.name]])
     end
 
-    it "should set the CN to the :ca_name setting when the CSR is for a CA" do
-      Puppet[:ca_name] = "mycertname"
-      request = described_class.new(Puppet::SSL::CA_NAME).generate(key)
-      expect(request.subject).to eq OpenSSL::X509::Name.new([['CN', Puppet[:ca_name]]])
-    end
-
     it "should set the version to 0" do
       request.generate(key)
       expect(request.content.version).to eq(0)
@@ -177,6 +171,17 @@ describe Puppet::SSL::CertificateRequest do
       end
     end
 
+    context "with DNS and IP SAN specified" do
+      before :each do
+        Puppet[:dns_alt_names] = ""
+      end
+
+      it "should return the subjectAltName values" do
+        request.generate(key, :dns_alt_names => 'DNS:foo, bar, IP:172.16.254.1')
+        expect(request.subject_alt_names).to match_array(["DNS:bar", "DNS:foo", "DNS:myname", "IP Address:172.16.254.1"])
+      end
+    end
+
     context "with custom CSR attributes" do
 
       it "adds attributes with single values" do
@@ -335,46 +340,62 @@ describe Puppet::SSL::CertificateRequest do
       expect(csr.verify(key.content)).to be_truthy
     end
 
-    it "should raise an error if neither SHA256 nor SHA1 are available" do
+    # Attempts to use SHA512 and SHA384 for signing certificates don't seem to work
+    # So commenting it out till it is sorted out
+    # The problem seems to be with the ability to sign a CSR when using either of
+    # these hash algorithms
+
+#    it "should use SHA512 to sign the csr when SHA256 and SHA1 aren't available" do
+#      csr = OpenSSL::X509::Request.new
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA512").returns(true)
+#      signer = Puppet::SSL::CertificateSigner.new
+#      signer.sign(csr, key.content)
+#      expect(csr.verify(key.content)).to be_truthy
+#    end
+
+#    it "should use SHA384 to sign the csr when SHA256/SHA1/SHA512 aren't available" do
+#      csr = OpenSSL::X509::Request.new
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA512").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA384").returns(true)
+#      signer = Puppet::SSL::CertificateSigner.new
+#      signer.sign(csr, key.content)
+#      expect(csr.verify(key.content)).to be_truthy
+#    end
+
+    it "should use SHA224 to sign the csr when SHA256/SHA1/SHA512/SHA384 aren't available" do
       csr = OpenSSL::X509::Request.new
       OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
       OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA512").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA384").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA224").returns(true)
+      signer = Puppet::SSL::CertificateSigner.new
+      signer.sign(csr, key.content)
+      expect(csr.verify(key.content)).to be_truthy
+    end
+
+    it "should raise an error if neither SHA256/SHA1/SHA512/SHA384/SHA224 are available" do
+      OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA512").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA384").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA224").returns(false)
       expect {
-        signer = Puppet::SSL::CertificateSigner.new
+        Puppet::SSL::CertificateSigner.new
       }.to raise_error(Puppet::Error)
     end
   end
 
-  describe "when a CSR is saved" do
-    describe "and a CA is available" do
-      it "should save the CSR and trigger autosigning" do
-        ca = mock 'ca', :autosign
-        Puppet::SSL::CertificateAuthority.expects(:instance).returns ca
-
-        csr = Puppet::SSL::CertificateRequest.new("me")
-        terminus = mock 'terminus'
-        terminus.stubs(:validate)
-        Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
-        terminus.expects(:save).with { |request| request.instance == csr && request.key == "me" }
-
-        Puppet::SSL::CertificateRequest.indirection.save(csr)
-      end
-    end
-
-    describe "and a CA is not available" do
-      it "should save the CSR" do
-        Puppet::SSL::CertificateAuthority.expects(:instance).returns nil
-
-        csr = Puppet::SSL::CertificateRequest.new("me")
-        terminus = mock 'terminus'
-        terminus.stubs(:validate)
-        Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
-        terminus.expects(:save).with { |request| request.instance == csr && request.key == "me" }
-
-        Puppet::SSL::CertificateRequest.indirection.save(csr)
-      end
-    end
-
-
+  it "should save the CSR" do
+    csr = Puppet::SSL::CertificateRequest.new("me")
+    terminus = mock 'terminus'
+    terminus.stubs(:validate)
+    Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
+    terminus.expects(:save).with { |request| request.instance == csr && request.key == "me" }
+    Puppet::SSL::CertificateRequest.indirection.save(csr)
   end
 end

data/spec/unit/ssl/certificate_spec.rb

@@ -1,5 +1,6 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
+require 'puppet/certificate_factory'
 
 require 'puppet/ssl/certificate'
 
@@ -16,10 +17,6 @@ describe Puppet::SSL::Certificate do
     @class = Puppet::SSL::Certificate
   end
 
-  after do
-    @class.instance_variable_set("@ca_location", nil)
-  end
-
   it "should be extended with the Indirector module" do
     expect(@class.singleton_class).to be_include(Puppet::Indirector)
   end
@@ -90,7 +87,7 @@ describe Puppet::SSL::Certificate do
       csr = Puppet::SSL::CertificateRequest.new('quux')
       csr.generate(key, opts)
 
-      raw_cert = Puppet::SSL::CertificateFactory.build('client', csr, csr.content, 14)
+      raw_cert = Puppet::CertificateFactory.build('client', csr, csr.content, 14)
       @class.from_instance(raw_cert)
     end
 
@@ -110,7 +107,7 @@ describe Puppet::SSL::Certificate do
       expect(@certificate).to respond_to(:content)
     end
 
-    describe "#subject_alt_names" do
+    describe "#subject_alt_names", :unless => RUBY_PLATFORM == 'java' do
       it "should list all alternate names when the extension is present" do
         certificate = build_cert(:dns_alt_names => 'foo, bar,baz')
         expect(certificate.subject_alt_names).
@@ -123,7 +120,7 @@ describe Puppet::SSL::Certificate do
       end
     end
 
-    describe "custom extensions" do
+    describe "custom extensions", :unless => RUBY_PLATFORM == 'java' do
       it "returns extensions under the ppRegCertExt" do
         exts = {'pp_uuid' => 'abcdfd'}
         cert = build_cert(:extension_requests => exts)