puppet 5.0.0 → 6.0.0

data/spec/unit/ssl/key_spec.rb

@@ -20,22 +20,7 @@ describe Puppet::SSL::Key do
     expect(@class.supported_formats).to eq([:s])
   end
 
-  it "should have a method for determining whether it's a CA key" do
-    expect(@class.new("test")).to respond_to(:ca?)
-  end
-
-  it "should consider itself a ca key if its name matches the CA_NAME" do
-    expect(@class.new(Puppet::SSL::Host.ca_name)).to be_ca
-  end
-
   describe "when initializing" do
-    it "should set its password file to the :capass if it's a CA key" do
-      Puppet[:capass] = File.expand_path("/ca/pass")
-
-      key = Puppet::SSL::Key.new(Puppet::SSL::Host.ca_name)
-      expect(key.password_file).to eq(Puppet[:capass])
-    end
-
     it "should downcase its name" do
       expect(@class.new("MyName").name).to eq("myname")
     end

data/spec/unit/ssl/validator_spec.rb

@@ -1,15 +1,19 @@
 require 'spec_helper'
 require 'puppet/ssl'
+require 'puppet_spec/ssl'
 
-describe Puppet::SSL::Validator::DefaultValidator do
+describe Puppet::SSL::Validator::DefaultValidator, unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
   let(:ssl_context) do
     mock('OpenSSL::X509::StoreContext')
   end
 
-  let(:ssl_configuration) do
-    Puppet::SSL::Configuration.new(
-      Puppet[:localcacert],
-      :ca_auth_file  => Puppet[:ssl_client_ca_auth])
+  before(:all) do
+    @pki = PuppetSpec::SSL.create_chained_pki
+  end
+
+  let(:ca_path) do
+    Puppet[:ssl_client_ca_auth] || Puppet[:localcacert]
   end
 
   let(:ssl_host) do
@@ -20,14 +24,11 @@ describe Puppet::SSL::Validator::DefaultValidator do
   end
 
   subject do
-    described_class.new(ssl_configuration,
-                        ssl_host)
+    described_class.new(ca_path)
   end
 
   before :each do
-    ssl_configuration.stubs(:read_file).
-      with(Puppet[:localcacert]).
-      returns(root_ca)
+    subject.stubs(:read_file).returns(@pki[:root_cert].to_s)
   end
 
   describe '#call' do
@@ -38,7 +39,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
 
     context 'When pre-verification is not OK' do
       context 'and the ssl_context is in an error state' do
-        let(:root_subject) { OpenSSL::X509::Certificate.new(root_ca).subject.to_s }
+        let(:root_subject) { @pki[:root_cert].subject.to_s }
         let(:code) { OpenSSL::X509::V_ERR_INVALID_CA }
 
         it 'rejects the connection' do
@@ -145,9 +146,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
 
       context 'and the chain is invalid' do
         before :each do
-          ssl_configuration.stubs(:read_file).
-            with(Puppet[:localcacert]).
-            returns(agent_ca)
+          subject.stubs(:read_file).returns(@pki[:unrevoked_leaf_node_cert])
         end
 
         it 'is true for each CA certificate in the chain' do
@@ -187,31 +186,31 @@ describe Puppet::SSL::Validator::DefaultValidator do
       connection = mock('Net::HTTP')
 
       connection.expects(:cert_store=).with(ssl_host.ssl_store)
-      connection.expects(:ca_file=).with(ssl_configuration.ca_auth_file)
+      connection.expects(:ca_file=).with(ca_path)
       connection.expects(:cert=).with(ssl_host.certificate.content)
       connection.expects(:key=).with(ssl_host.key.content)
       connection.expects(:verify_callback=).with(subject)
       connection.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
 
-      subject.setup_connection(connection)
+      subject.setup_connection(connection, ssl_host)
     end
 
-    it 'does not perform verification if certificate files are missing' do
-      subject.stubs(:ssl_certificates_are_present?).returns(false)
-      connection = mock('Net::HTTP')
+    context 'when no file path is found' do
+
+      it 'does not perform verification if certificate files are missing' do
+        subject.stubs(:ssl_certificates_are_present?).returns(false)
+        connection = mock('Net::HTTP')
 
-      connection.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_NONE)
+        connection.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_NONE)
 
-      subject.setup_connection(connection)
+        subject.setup_connection(connection, ssl_host)
+      end
     end
   end
 
   describe '#valid_peer?' do
     before :each do
-      peer_certs = cert_chain_in_callback_order.map do |c|
-        Puppet::SSL::Certificate.from_instance(c)
-      end
-      subject.instance_variable_set(:@peer_certs, peer_certs)
+      subject.instance_variable_set(:@peer_certs, cert_chain_in_callback_order)
     end
 
     context 'when the peer presents a valid chain' do
@@ -243,149 +242,31 @@ describe Puppet::SSL::Validator::DefaultValidator do
   describe '#has_authz_peer_cert' do
     context 'when the Root CA is listed as authorized' do
       it 'returns true when the SSL cert is issued by the Master CA' do
-        expect(subject.has_authz_peer_cert(cert_chain, [root_ca_cert])).to be_truthy
+        expect(subject.has_authz_peer_cert(cert_chain, [@pki[:root_cert]])).to be_truthy
       end
 
-      it 'returns true when the SSL cert is issued by the Agent CA' do
-        expect(subject.has_authz_peer_cert(cert_chain_agent_ca, [root_ca_cert])).to be_truthy
+      it 'returns true when the SSL cert is issued by the alternate CA' do
+        expect(subject.has_authz_peer_cert(cert_chain_alternate, [@pki[:root_cert]])).to be_truthy
       end
     end
 
-    context 'when the Master CA is listed as authorized' do
-      it 'returns false when the SSL cert is issued by the Master CA' do
-        expect(subject.has_authz_peer_cert(cert_chain, [master_ca_cert])).to be_truthy
+    context 'when one intermediate CA is listed as authorized' do
+      it 'returns true when the SSL cert is issued by the same intermediate CA' do
+        expect(subject.has_authz_peer_cert(cert_chain, [@pki[:int_cert]])).to be_truthy
       end
 
-      it 'returns true when the SSL cert is issued by the Agent CA' do
-        expect(subject.has_authz_peer_cert(cert_chain_agent_ca, [master_ca_cert])).to be_falsey
+      it 'returns false when the SSL cert is issued by a different intermediate CA' do
+        expect(subject.has_authz_peer_cert(cert_chain_alternate, [@pki[:int_cert]])).to be_falsey
       end
     end
-
-    context 'when the Agent CA is listed as authorized' do
-      it 'returns true when the SSL cert is issued by the Master CA' do
-        expect(subject.has_authz_peer_cert(cert_chain, [agent_ca_cert])).to be_falsey
-      end
-
-      it 'returns true when the SSL cert is issued by the Agent CA' do
-        expect(subject.has_authz_peer_cert(cert_chain_agent_ca, [agent_ca_cert])).to be_truthy
-      end
-    end
-  end
-
-  def root_ca
-    <<-ROOT_CA
------BEGIN CERTIFICATE-----
-MIICYDCCAcmgAwIBAgIJALf2Pk2HvtBzMA0GCSqGSIb3DQEBBQUAMEkxEDAOBgNV
-BAMMB1Jvb3QgQ0ExGjAYBgNVBAsMEVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQK
-DBBFeGFtcGxlIE9yZywgTExDMB4XDTEzMDMzMDA1NTA0OFoXDTMzMDMyNTA1NTA0
-OFowSTEQMA4GA1UEAwwHUm9vdCBDQTEaMBgGA1UECwwRU2VydmVyIE9wZXJhdGlv
-bnMxGTAXBgNVBAoMEEV4YW1wbGUgT3JnLCBMTEMwgZ8wDQYJKoZIhvcNAQEBBQAD
-gY0AMIGJAoGBAMGSpafR4lboYOPfPJC1wVHHl0gD49ZVRjOlJ9jidEUjBdFXK6SA
-S1tecDv2G4tM1ANmfMKjZl0m+KaZ8O2oq0g6kxkq1Mg0eSNvlnEyehjmTLRzHC2i
-a0biH2wMtCLzfAoXDKy4GPlciBPE9mup5I8Kien5s91t92tc7K8AJ8oBAgMBAAGj
-UDBOMB0GA1UdDgQWBBQwTdZqjjXOIFK2hOM0bcOrnhQw2jAfBgNVHSMEGDAWgBQw
-TdZqjjXOIFK2hOM0bcOrnhQw2jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA
-A4GBACs8EZRrzgzAlcKC1Tz8GYlNHQg0XhpbEDm+p2mOV//PuDD190O+UBpWxo9Q
-rrkkx8En0wXQZJf6iH3hwewwHLOq5yXZKbJN+SmvJvRNL95Yhyy08Y9N65tJveE7
-rPsNU/Tx19jHC87oXlmAePLI4IaUHXrWb7CRbY9TEcPdmj1R
------END CERTIFICATE-----
-    ROOT_CA
-  end
-
-  def master_ca
-    <<-MASTER_CA
------BEGIN CERTIFICATE-----
-MIICljCCAf+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
-IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
-ZSBPcmcsIExMQzAeFw0xMzAzMzAwNTUwNDhaFw0zMzAzMjUwNTUwNDhaMH4xJDAi
-BgNVBAMTG0ludGVybWVkaWF0ZSBDQSAobWFzdGVyLWNhKTEfMB0GCSqGSIb3DQEJ
-ARYQdGVzdEBleGFtcGxlLm9yZzEZMBcGA1UEChMQRXhhbXBsZSBPcmcsIExMQzEa
-MBgGA1UECxMRU2VydmVyIE9wZXJhdGlvbnMwXDANBgkqhkiG9w0BAQEFAANLADBI
-AkEAvo/az3oR69SP92jGnUHMJLEyyD1Ui1BZ/rUABJcQTRQqn3RqtlfYePWZnUaZ
-srKbXRS4q0w5Vqf1kx5w3q5tIwIDAQABo4GcMIGZMHkGA1UdIwRyMHCAFDBN1mqO
-Nc4gUraE4zRtw6ueFDDaoU2kSzBJMRAwDgYDVQQDDAdSb290IENBMRowGAYDVQQL
-DBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBsZSBPcmcsIExMQ4IJ
-ALf2Pk2HvtBzMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3
-DQEBBQUAA4GBACRfa1YPS7RQUuhYovGgV0VYqxuATC7WwdIRihVh5FceSXKgSIbz
-BKmOBAy/KixEhpnHTbkpaJ0d9ITkvjMTmj3M5YMahKaQA5niVPckQPecMMd6jg9U
-l1k75xLLIcrlsDYo3999KOSSchH2K7bLT7TuQ2okdP6FHWmeWmudewlu
------END CERTIFICATE-----
-    MASTER_CA
-  end
-
-  def agent_ca
-    <<-AGENT_CA
------BEGIN CERTIFICATE-----
-MIIClTCCAf6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
-IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
-ZSBPcmcsIExMQzAeFw0xMzAzMzAwNTUwNDhaFw0zMzAzMjUwNTUwNDhaMH0xIzAh
-BgNVBAMTGkludGVybWVkaWF0ZSBDQSAoYWdlbnQtY2EpMR8wHQYJKoZIhvcNAQkB
-FhB0ZXN0QGV4YW1wbGUub3JnMRkwFwYDVQQKExBFeGFtcGxlIE9yZywgTExDMRow
-GAYDVQQLExFTZXJ2ZXIgT3BlcmF0aW9uczBcMA0GCSqGSIb3DQEBAQUAA0sAMEgC
-QQDkEj/Msmi4hJImxP5+ocixMTHuYC1M1E2p4QcuzOkZYrfHf+5hJMcahfYhLiXU
-jHBredOXhgSisHh6CLSb/rKzAgMBAAGjgZwwgZkweQYDVR0jBHIwcIAUME3Wao41
-ziBStoTjNG3Dq54UMNqhTaRLMEkxEDAOBgNVBAMMB1Jvb3QgQ0ExGjAYBgNVBAsM
-EVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQKDBBFeGFtcGxlIE9yZywgTExDggkA
-t/Y+TYe+0HMwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcN
-AQEFBQADgYEAujSj9rxIxJHEuuYXb15L30yxs9Tdvy4OCLiKdjvs9Z7gG8Pbutls
-ooCwyYAkmzKVs/8cYjZJnvJrPEW1gFwqX7Xknp85Cfrl+/pQEPYq5sZVa5BIm9tI
-0EvlDax/Hd28jI6Bgq5fsTECNl9GDGknCy7vwRZem0h+hI56lzR3pYE=
------END CERTIFICATE-----
-    AGENT_CA
-  end
-
-  # Signed by the master CA (Good)
-  def master_issued_by_master_ca
-<<-GOOD_SSL_CERT
------BEGIN CERTIFICATE-----
-MIICZzCCAhGgAwIBAgIBATANBgkqhkiG9w0BAQUFADB+MSQwIgYDVQQDExtJbnRl
-cm1lZGlhdGUgQ0EgKG1hc3Rlci1jYSkxHzAdBgkqhkiG9w0BCQEWEHRlc3RAZXhh
-bXBsZS5vcmcxGTAXBgNVBAoTEEV4YW1wbGUgT3JnLCBMTEMxGjAYBgNVBAsTEVNl
-cnZlciBPcGVyYXRpb25zMB4XDTEzMDMzMDA1NTA0OFoXDTMzMDMyNTA1NTA0OFow
-HjEcMBoGA1UEAwwTbWFzdGVyMS5leGFtcGxlLm9yZzBcMA0GCSqGSIb3DQEBAQUA
-A0sAMEgCQQDACW8fryVZH0dC7vYUASonVBKYcILnKN2O9QX7RenZGN1TWek9LQxr
-yQFDyp7WJ8jUw6nENGniLU8J+QSSxryjAgMBAAGjgdkwgdYwWwYDVR0jBFQwUqFN
-pEswSTEQMA4GA1UEAwwHUm9vdCBDQTEaMBgGA1UECwwRU2VydmVyIE9wZXJhdGlv
-bnMxGTAXBgNVBAoMEEV4YW1wbGUgT3JnLCBMTEOCAQIwDAYDVR0TAQH/BAIwADAL
-BgNVHQ8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMD0GA1Ud
-EQQ2MDSCE21hc3RlcjEuZXhhbXBsZS5vcmeCB21hc3RlcjGCBnB1cHBldIIMcHVw
-cGV0bWFzdGVyMA0GCSqGSIb3DQEBBQUAA0EAo8PvgLrah6jQVs6YCBxOTn13PDip
-fVbcRsFd0dtIr00N61bCqr6Fa0aRwy424gh6bVJTNmk2zoaH7r025dZRhw==
------END CERTIFICATE-----
-GOOD_SSL_CERT
-  end
-
-  # Signed by the agent CA, not the master CA (Rogue)
-  def master_issued_by_agent_ca
-<<-BAD_SSL_CERT
------BEGIN CERTIFICATE-----
-MIICZjCCAhCgAwIBAgIBBDANBgkqhkiG9w0BAQUFADB9MSMwIQYDVQQDExpJbnRl
-cm1lZGlhdGUgQ0EgKGFnZW50LWNhKTEfMB0GCSqGSIb3DQEJARYQdGVzdEBleGFt
-cGxlLm9yZzEZMBcGA1UEChMQRXhhbXBsZSBPcmcsIExMQzEaMBgGA1UECxMRU2Vy
-dmVyIE9wZXJhdGlvbnMwHhcNMTMwMzMwMDU1MDQ4WhcNMzMwMzI1MDU1MDQ4WjAe
-MRwwGgYDVQQDDBNtYXN0ZXIxLmV4YW1wbGUub3JnMFwwDQYJKoZIhvcNAQEBBQAD
-SwAwSAJBAPnCDnryLLXWepGLqsdBWlytfeakE/yijM8GlE/yT0SbpJInIhJR1N1A
-0RskriHrxTU5qQEhd0RIja7K5o4NYksCAwEAAaOB2TCB1jBbBgNVHSMEVDBSoU2k
-SzBJMRAwDgYDVQQDDAdSb290IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9u
-czEZMBcGA1UECgwQRXhhbXBsZSBPcmcsIExMQ4IBATAMBgNVHRMBAf8EAjAAMAsG
-A1UdDwQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPQYDVR0R
-BDYwNIITbWFzdGVyMS5leGFtcGxlLm9yZ4IHbWFzdGVyMYIGcHVwcGV0ggxwdXBw
-ZXRtYXN0ZXIwDQYJKoZIhvcNAQEFBQADQQA841IzHLlnn4RIJ0/BOZ/16iWC1dNr
-jV9bELC5OxeMNSsVXbFNeTHwbHEYjDg5dQ6eUkxPdBSMWBeQwe2Mw+xG
------END CERTIFICATE-----
-BAD_SSL_CERT
   end
 
   def cert_chain
-    [ master_issued_by_master_ca, master_ca, root_ca ].map do |pem|
-      OpenSSL::X509::Certificate.new(pem)
-    end
+    [@pki[:int_node_cert], @pki[:int_cert], @pki[:root_cert]]
   end
 
-  def cert_chain_agent_ca
-    [ master_issued_by_agent_ca, agent_ca, root_ca ].map do |pem|
-      OpenSSL::X509::Certificate.new(pem)
-    end
+  def cert_chain_alternate
+    [@pki[:unrevoked_leaf_node_cert], @pki[:leaf_cert], @pki[:revoked_int_cert], @pki[:root_cert]]
   end
 
   def cert_chain_in_callback_order
@@ -397,22 +278,10 @@ BAD_SSL_CERT
   end
 
   let :expected_authz_error_msg do
-    authz_ca_certs = ssl_configuration.ca_auth_certificates
+    authz_ca_certs = subject.decode_cert_bundle(subject.read_file)
     msg = authz_error_prefix
     msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject}.join(', ')}  "
     msg << "Peer Chain: #{cert_chain.collect {|c| c.subject}.join(' => ')}"
     msg
   end
-
-  let :root_ca_cert do
-    OpenSSL::X509::Certificate.new(root_ca)
-  end
-
-  let :master_ca_cert do
-    OpenSSL::X509::Certificate.new(master_ca)
-  end
-
-  let :agent_ca_cert do
-    OpenSSL::X509::Certificate.new(agent_ca)
-  end
 end

data/spec/unit/task_spec.rb

@@ -0,0 +1,247 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+require 'puppet_spec/files'
+require 'puppet_spec/modules'
+require 'puppet/module/task'
+
+describe Puppet::Module::Task do
+  include PuppetSpec::Files
+
+  let(:modpath) { tmpdir('task_modpath') }
+  let(:mymodpath) { File.join(modpath, 'mymod') }
+  let(:othermodpath) { File.join(modpath, 'othermod') }
+  let(:mymod) { Puppet::Module.new('mymod', mymodpath, nil) }
+  let(:othermod) { Puppet::Module.new('othermod', othermodpath, nil) }
+  let(:tasks_path) { File.join(mymodpath, 'tasks') }
+  let(:other_tasks_path) { File.join(othermodpath, 'tasks') }
+  let(:tasks_glob) { File.join(mymodpath, 'tasks', '*') }
+
+  it "cannot construct tasks with illegal names" do
+    expect { Puppet::Module::Task.new(mymod, "iLegal", []) }
+      .to raise_error(Puppet::Module::Task::InvalidName,
+                      "Task names must start with a lowercase letter and be composed of only lowercase letters, numbers, and underscores")
+  end
+
+  it "constructs tasks as expected when every task has a metadata file with the same name (besides extension)" do
+    task_files = %w{task1.json task1 task2.json task2.exe task3.json task3.sh}.map { |bn| "#{tasks_path}/#{bn}" }
+    Dir.expects(:glob).with(tasks_glob).returns(task_files)
+    tasks = Puppet::Module::Task.tasks_in_module(mymod)
+    Puppet::Module::Task.any_instance.stubs(:metadata).returns({})
+
+    expect(tasks.count).to eq(3)
+    expect(tasks.map{|t| t.name}).to eq(%w{mymod::task1 mymod::task2 mymod::task3})
+    expect(tasks.map{|t| t.metadata_file}).to eq(["#{tasks_path}/task1.json",
+                                                  "#{tasks_path}/task2.json",
+                                                  "#{tasks_path}/task3.json"])
+    expect(tasks.map{|t| t.files.map { |f| f["path"] } }).to eq([["#{tasks_path}/task1"],
+                                                                 ["#{tasks_path}/task2.exe"],
+                                                                 ["#{tasks_path}/task3.sh"]])
+    expect(tasks.map{|t| t.files.map { |f| f["name"] } }).to eq([["task1"],
+                                                                 ["task2.exe"],
+                                                                 ["task3.sh"]])
+
+    tasks.map{|t| t.metadata_file}.each do |metadata_file|
+      expect(metadata_file).to eq(File.absolute_path(metadata_file))
+    end
+
+    tasks.map{|t| t.files}.each do |file_data|
+      path = file_data[0]['path']
+      expect(path).to eq(File.absolute_path(path))
+    end
+  end
+
+  it "constructs tasks as expected when some tasks don't have a metadata file" do
+    task_files = %w{task1 task2.exe task3.json task3.sh}.map { |bn| "#{tasks_path}/#{bn}" }
+    Dir.expects(:glob).with(tasks_glob).returns(task_files)
+    Puppet::Module::Task.any_instance.stubs(:metadata).returns({})
+    tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+    expect(tasks.count).to eq(3)
+    expect(tasks.map{|t| t.name}).to eq(%w{mymod::task1 mymod::task2 mymod::task3})
+    expect(tasks.map{|t| t.metadata_file}).to eq([nil, nil, "#{tasks_path}/task3.json"])
+    expect(tasks.map{|t| t.files.map { |f| f["path"] } }).to eq([["#{tasks_path}/task1"],
+                                          ["#{tasks_path}/task2.exe"],
+                                          ["#{tasks_path}/task3.sh"]])
+  end
+
+  it "constructs a task as expected when a task has implementations" do
+    task_files = %w{task1.elf task1.sh task1.json}.map { |bn| "#{tasks_path}/#{bn}" }
+    Dir.expects(:glob).with(tasks_glob).returns(task_files)
+    tasks = Puppet::Module::Task.tasks_in_module(mymod)
+    Puppet::Module::Task.any_instance.stubs(:metadata).returns({'implementations' =>
+    [{"name" => "task1.sh"}]})
+
+    expect(tasks.count).to eq(1)
+    expect(tasks.map{|t| t.name}).to eq(%w{mymod::task1})
+    expect(tasks.map{|t| t.metadata_file}).to eq(["#{tasks_path}/task1.json"])
+    expect(tasks.map{|t| t.files.map{ |f| f["path"] } }).to eq([["#{tasks_path}/task1.sh"]])
+  end
+
+  it "constructs a task as expected when a task has files" do
+    og_files = %w{task1.sh task1.json}.map { |bn| "#{tasks_path}/#{bn}" }
+    Dir.expects(:glob).with(tasks_glob).returns(og_files)
+    File.expects(:exist?).with(any_parameters).returns(true).at_least(1)
+
+    Puppet::Module.expects(:find).with(othermod.name, "production").returns(othermod).at_least(1)
+    short_files = %w{other_task.sh other_task.json task_2.sh}.map { |bn| "#{othermod.name}/tasks/#{bn}" }
+    long_files = %w{other_task.sh other_task.json task_2.sh}.map { |bn| "#{other_tasks_path}/#{bn}" }
+    tasks = Puppet::Module::Task.tasks_in_module(mymod)
+    Puppet::Module::Task.any_instance.stubs(:metadata).returns({'files' => short_files})
+
+    expect(tasks.count).to eq(1)
+    expect(tasks.map{|t| t.files.map{ |f| f["path"] } }).to eq([["#{tasks_path}/task1.sh"] + long_files])
+  end
+
+  it "fails to load a task if its metadata specifies a non-existent file" do
+    og_files = %w{task1.sh task1.json}.map { |bn| "#{tasks_path}/#{bn}" }
+    Dir.stubs(:glob).with(tasks_glob).returns(og_files)
+    File.stubs(:exist?).with(any_parameters).returns(true)
+
+    Puppet::Module.expects(:find).with(othermod.name, "production").returns(nil).at_least(1)
+    tasks = Puppet::Module::Task.tasks_in_module(mymod)
+    Puppet::Module::Task.any_instance.stubs(:metadata).returns({'files' => ["#{othermod.name}/files/test"]})
+
+    expect { tasks.first.files }.to raise_error(Puppet::Module::Task::InvalidMetadata, /Could not find module #{othermod.name} containing task file test/)
+  end
+
+  it "finds files whose names (besides extensions) are valid task names" do
+    Dir.expects(:glob).with(tasks_glob).returns(%w{task task_1 xx_t_a_s_k_2_xx})
+    tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+    expect(tasks.count).to eq(3)
+    expect(tasks.map{|t| t.name}).to eq(%w{mymod::task mymod::task_1 mymod::xx_t_a_s_k_2_xx})
+  end
+
+  it "ignores files that have names (besides extensions) that are not valid task names" do
+    Dir.expects(:glob).with(tasks_glob).returns(%w{.nottask.exe .wat !runme _task 2task2furious def_a_task_PSYCH Fake_task not-a-task realtask})
+    tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+    expect(tasks.count).to eq(1)
+    expect(tasks.map{|t| t.name}).to eq(%w{mymod::realtask})
+  end
+
+  it "ignores files that have names ending in .conf and .md" do
+    Dir.expects(:glob).with(tasks_glob).returns(%w{ginuwine_task task.conf readme.md other_task.md})
+    tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+    expect(tasks.count).to eq(1)
+    expect(tasks.map{|t| t.name}).to eq(%w{mymod::ginuwine_task})
+  end
+
+  it "gives the 'init' task a name that is just the module's name" do
+    expect(Puppet::Module::Task.new(mymod, 'init', ["#{tasks_path}/init.sh"]).name).to eq('mymod')
+  end
+
+  describe :metadata do
+    it "loads metadata for a task" do
+      metadata  = {'desciption': 'some info'}
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.exe task1.json})
+      Puppet::Module::Task.any_instance.stubs(:read_metadata).returns(metadata)
+
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+      expect(tasks.count).to eq(1)
+      expect(tasks[0].metadata).to eq(metadata)
+    end
+
+    it 'returns nil for metadata if no file is present' do
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.exe})
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+      expect(tasks.count).to eq(1)
+      expect(tasks[0].metadata).to be_nil
+    end
+
+    it 'raises InvalidMetadata if the json metadata is invalid' do
+      FileUtils.mkdir_p(tasks_path)
+      File.open(File.join(tasks_path, 'task.json'), 'w') { |f| f.write '{ "whoops"' }
+      FileUtils.touch(File.join(tasks_path, 'task'))
+
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+      expect(tasks.count).to eq(1)
+
+      expect {
+        tasks[0].metadata
+      }.to raise_error(Puppet::Module::Task::InvalidMetadata, /whoops/)
+    end
+  end
+
+  describe :validate do
+    it "validates when there is no metadata" do
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.exe})
+
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+      expect(tasks.count).to eq(1)
+      expect(tasks[0].validate).to eq(true)
+    end
+
+    it "validates when an implementation isn't used" do
+      metadata  = {'desciption' => 'some info',
+        'implementations' => [ {"name" => "task1.exe"}, ] }
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.exe task1.sh task1.json})
+      Puppet::Module::Task.any_instance.stubs(:read_metadata).returns(metadata)
+
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+      expect(tasks.count).to eq(1)
+      expect(tasks[0].validate).to be(true)
+    end
+
+    it "validates when an implementation is another task" do
+      metadata  = {'desciption' => 'some info',
+                   'implementations' => [ {"name" => "task2.sh"}, ] }
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.exe task2.sh task1.json})
+      Puppet::Module::Task.any_instance.stubs(:read_metadata).returns(metadata)
+
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+
+      expect(tasks.count).to eq(2)
+      expect(tasks.map(&:validate)).to eq([true, true])
+    end
+
+    it "fails validation when there is no metadata and multiple task files" do
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.elf task1.exe task1.json task2.ps1 task2.sh})
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+      Puppet::Module::Task.any_instance.stubs(:metadata).returns({})
+
+      tasks.each do |task|
+        expect {task.validate}.to raise_error(Puppet::Module::Task::InvalidTask)
+      end
+    end
+
+    it "fails validation when an implementation references a non-existant file" do
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.elf task1.exe task1.json})
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+      Puppet::Module::Task.any_instance.stubs(:metadata).returns({'implementations' => [ { 'name' => 'task1.sh' } ] })
+
+      tasks.each do |task|
+        expect {task.validate}.to raise_error(Puppet::Module::Task::InvalidTask)
+      end
+    end
+
+    it 'fails validation when there is metadata but no executable' do
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.json task2.sh})
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+      Puppet::Module::Task.any_instance.stubs(:metadata).returns({})
+
+      expect { tasks.find { |t| t.name == 'mymod::task1' }.validate }.to raise_error(Puppet::Module::Task::InvalidTask)
+    end
+
+    it 'fails validation when the implementations are not an array' do
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.json task2.sh})
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+      Puppet::Module::Task.any_instance.stubs(:metadata).returns({"implemenations" => {}})
+
+      expect { tasks.find { |t| t.name == 'mymod::task1' }.validate }.to raise_error(Puppet::Module::Task::InvalidTask)
+    end
+
+    it 'fails validation when the implementation is json' do
+      Dir.expects(:glob).with(tasks_glob).returns(%w{task1.json task1.sh})
+      tasks = Puppet::Module::Task.tasks_in_module(mymod)
+      Puppet::Module::Task.any_instance.stubs(:metadata).returns({'implementations' => [ { 'name' => 'task1.json' } ] })
+
+      expect { tasks.find { |t| t.name == 'mymod::task1' }.validate }.to raise_error(Puppet::Module::Task::InvalidTask)
+    end
+  end
+end