puppet 5.0.0 → 6.0.0

data/spec/unit/application/face_base_spec.rb

@@ -343,7 +343,7 @@ describe Puppet::Application::FaceBase do
 
       it "should render a non-trivially-keyed Hash with using pretty printed JSON" do
         hash = { [1,2] => 3, [2,3] => 5, [3,4] => 7 }
-        expect(app.render(hash, {})).to eq(JSON.pretty_generate(hash).chomp)
+        expect(app.render(hash, {})).to eq(Puppet::Util::Json.dump(hash, :pretty => true).chomp)
       end
 
       it "should render a {String,Numeric}-keyed Hash into a table" do
@@ -356,7 +356,7 @@ describe Puppet::Application::FaceBase do
         expect(app.render(hash, {})).to eq <<EOT
 5      5
 6.0    6
-four   #{object.to_json.chomp}
+four   #{Puppet::Util::Json.dump(object).chomp}
 one    1
 three  {}
 two    []

data/spec/unit/application/filebucket_spec.rb

@@ -93,7 +93,8 @@ describe Puppet::Application::Filebucket do
       end
 
       it "should create a client with the default bucket if none passed" do
-        Puppet[:bucketdir] = path
+        Puppet[:clientbucketdir] = path
+        Puppet[:bucketdir] = path + "2"
 
         Puppet::FileBucket::Dipper.expects(:new).with { |h| h[:Path] == path }
 
@@ -111,17 +112,30 @@ describe Puppet::Application::Filebucket do
     end
 
     describe "with remote bucket" do
-
       it "should create a remote Client to the configured server" do
         Puppet[:server] = "puppet.reductivelabs.com"
-
         Puppet::FileBucket::Dipper.expects(:new).with { |h| h[:Server] == "puppet.reductivelabs.com" }
+        @filebucket.setup
+      end
 
+      it "should default to the first server_list entry if set" do
+        Puppet[:server_list] = "foo,bar,baz"
+        Puppet::FileBucket::Dipper.expects(:new).with { |h| h[:Server] == "foo" }
         @filebucket.setup
       end
 
-    end
+      it "should fall back to server if server_list is empty" do
+        Puppet[:server_list] = ""
+        Puppet::FileBucket::Dipper.expects(:new).with { |h| h[:Server] == "puppet" }
+        @filebucket.setup
+      end
 
+      it "should take both the server and port specified in server_list" do
+        Puppet[:server_list] = "foo:632,bar:6215,baz:351"
+        Puppet::FileBucket::Dipper.expects(:new).with({ :Server => "foo", :Port => "632" })
+        @filebucket.setup
+      end
+    end
   end
 
   describe "when running" do

data/spec/unit/application/lookup_spec.rb

@@ -59,7 +59,7 @@ describe Puppet::Application::Lookup do
       lookup.command_line.stubs(:args).returns(['atton', 'kreia'])
       lookup.stubs(:generate_scope).yields('scope')
 
-      expected_merge = { "strategy" => "deep", "sort_merge_arrays" => false, "merge_hash_arrays" => true }
+      expected_merge = { "strategy" => "deep", "sort_merged_arrays" => false, "merge_hash_arrays" => true }
 
       (Puppet::Pops::Lookup).expects(:lookup).with(['atton', 'kreia'], nil, nil, false, expected_merge, anything).returns('rand')
 
@@ -71,25 +71,26 @@ describe Puppet::Application::Lookup do
       it "accepts --merge #{opt}" do
         lookup.options[:node] = 'dantooine.local'
         lookup.options[:merge] = opt
+        lookup.options[:render_as] = :s
         lookup.command_line.stubs(:args).returns(['atton', 'kreia'])
         lookup.stubs(:generate_scope).yields('scope')
         Puppet::Pops::Lookup.stubs(:lookup).returns('rand')
-        expect(run_lookup(lookup)).to eql("--- rand\n...")
+        expect(run_lookup(lookup)).to eql("rand")
       end
     end
 
     it "prints the value found by lookup" do
       lookup.options[:node] = 'dantooine.local'
+      lookup.options[:render_as] = :s
       lookup.command_line.stubs(:args).returns(['atton', 'kreia'])
       lookup.stubs(:generate_scope).yields('scope')
 
       Puppet::Pops::Lookup.stubs(:lookup).returns('rand')
 
-      expect(run_lookup(lookup)).to eql("--- rand\n...")
+      expect(run_lookup(lookup)).to eql("rand")
     end
   end
 
-
   context 'when given a valid configuration' do
     let (:lookup) { Puppet::Application[:lookup] }
 
@@ -461,7 +462,7 @@ Searching for "a"
       lookup.options[:render_as] = :yaml
       lookup.command_line.stubs(:args).returns(['a'])
       output = run_lookup(lookup)
-      expect(YAML.load(output)).to eq(expected_yaml_hash)
+      expect(Puppet::Util::Yaml.safe_load(output, [Symbol])).to eq(expected_yaml_hash)
     end
 
     it 'can produce a json explanation' do
@@ -498,17 +499,51 @@ Searching for "a"
     end
 
     context 'the global scope' do
+      include PuppetSpec::Files
+
       it "is unaffected by global variables unless '--compile' is used" do
         lookup.options[:node] = node
+        lookup.options[:render_as] = :s
         lookup.command_line.stubs(:args).returns(['c'])
-        expect(run_lookup(lookup)).to eql("--- This is\n...")
+        expect(run_lookup(lookup)).to eql("This is")
       end
 
       it "is affected by global variables when '--compile' is used" do
         lookup.options[:node] = node
         lookup.options[:compile] = true
+        lookup.options[:render_as] = :s
+        lookup.command_line.stubs(:args).returns(['c'])
+        expect(run_lookup(lookup)).to eql("This is C from site.pp")
+      end
+
+      it 'receives extra facts in top scope' do
+        file_path = tmpdir('lookup_spec')
+        filename = File.join(file_path, "facts.yaml")
+        File.open(filename, "w+") { |f| f.write(<<-YAML.unindent) }
+          ---
+          cx: ' C from facts'
+          YAML
+
+        lookup.options[:node] = node
+        lookup.options[:fact_file] = filename
+        lookup.options[:render_as] = :s
         lookup.command_line.stubs(:args).returns(['c'])
-        expect(run_lookup(lookup)).to eql("--- This is C from site.pp\n...")
+        expect(run_lookup(lookup)).to eql("This is C from facts")
+      end
+
+      it 'receives extra facts in the facts hash' do
+        file_path = tmpdir('lookup_spec')
+        filename = File.join(file_path, "facts.yaml")
+        File.open(filename, "w+") { |f| f.write(<<-YAML.unindent) }
+          ---
+          cx: ' G from facts'
+        YAML
+
+        lookup.options[:node] = node
+        lookup.options[:fact_file] = filename
+        lookup.options[:render_as] = :s
+        lookup.command_line.stubs(:args).returns(['g'])
+        expect(run_lookup(lookup)).to eql("This is G from facts in facts hash")
       end
     end
 
@@ -518,14 +553,16 @@ Searching for "a"
       it "works OK in the absense of '--compile'" do
         lookup.options[:node] = node
         lookup.command_line.stubs(:args).returns(['c'])
-        expect(run_lookup(lookup)).to eql("--- This is C from data.pp\n...")
+        lookup.options[:render_as] = :s
+        expect(run_lookup(lookup)).to eql("This is C from data.pp")
       end
 
       it "global scope is affected by global variables when '--compile' is used" do
         lookup.options[:node] = node
         lookup.options[:compile] = true
+        lookup.options[:render_as] = :s
         lookup.command_line.stubs(:args).returns(['c'])
-        expect(run_lookup(lookup)).to eql("--- This is C from site.pp\n...")
+        expect(run_lookup(lookup)).to eql("This is C from site.pp")
       end
     end
   end

data/spec/unit/application/ssl_spec.rb

@@ -0,0 +1,322 @@
+require 'spec_helper'
+require 'puppet/application/ssl'
+require 'webmock/rspec'
+require 'openssl'
+
+describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
+  let(:ssl) { Puppet::Application[:ssl] }
+  let(:name) { 'ssl-client' }
+
+  def generate_cert(name, issuer = nil, issuer_key = nil)
+    # generate CA key pair
+    private_key = OpenSSL::PKey::RSA.new(512)
+    public_key = private_key.public_key
+
+    # generate CSR
+    csr = OpenSSL::X509::Request.new
+    csr.version = 0
+    csr.subject = OpenSSL::X509::Name.new([["CN", name]])
+    csr.public_key = public_key
+    csr.sign(private_key, OpenSSL::Digest::SHA256.new)
+
+    # is it self-signed?
+    issuer ||= csr.subject
+    issuer_key ||= private_key
+
+    # issue cert
+    cert = OpenSSL::X509::Certificate.new
+    cert.version    = 2 # X509v3
+    cert.subject    = csr.subject
+    cert.issuer     = issuer
+    cert.public_key = csr.public_key
+    cert.serial     = 1
+    cert.not_before = Time.now - (60*60*24)
+    cert.not_after  = Time.now + (60*60*24)
+
+    # Ugly hack, but we need to make sure the CA cert has the proper
+    # X509v3 Basic Constraints to be a valid CA certificate.
+    if name == 'ca'
+      extension_factory = OpenSSL::X509::ExtensionFactory.new
+      extension_factory.subject_certificate = cert
+      extension_factory.issuer_certificate = cert
+
+      extensions = {
+        "keyUsage"         => [%w{cRLSign keyCertSign}, true],
+        "basicConstraints" => ["CA:TRUE", true],
+      }
+
+      cert.extensions = extensions.map do |oid, (val, crit)|
+        val = val.join(', ') unless val.is_a? String
+
+        if Puppet::SSL::Oids.subtree_of?('id-ce', oid) or Puppet::SSL::Oids.subtree_of?('id-pkix', oid)
+          # Attempt to create a X509v3 certificate extension. Standard certificate
+          # extensions may need access to the associated subject certificate and
+          # issuing certificate, so must be created by the OpenSSL::X509::ExtensionFactory
+          # which provides that context.
+          extension_factory.create_ext(oid, val, crit)
+        else
+          # This is not an X509v3 extension which means that the extension
+          # factory cannot generate it. We need to generate the extension
+          # manually.
+          OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(val).to_der, crit)
+        end
+      end
+    end
+
+    cert.sign(issuer_key, OpenSSL::Digest::SHA256.new)
+
+    {:private_key => private_key, :csr => csr, :cert => cert}
+  end
+
+  def generate_crl(name, issuer, issuer_key)
+    crl = OpenSSL::X509::CRL.new
+    crl.version = 1
+    crl.issuer = issuer
+    crl.last_update = Time.now - (60*60*24)
+    crl.next_update =  Time.now + (60*60*24)
+    crl.extensions = [OpenSSL::X509::Extension.new('crlNumber', OpenSSL::ASN1::Integer(0))]
+    crl.sign(issuer_key, OpenSSL::Digest::SHA256.new)
+
+    crl
+  end
+
+  before :all do
+    @ca = generate_cert('ca')
+    @crl = generate_crl('ca', @ca[:cert].subject, @ca[:private_key])
+    @host = generate_cert('ssl-client', @ca[:cert].subject, @ca[:private_key])
+  end
+
+  before do
+    WebMock.disable_net_connect!
+
+    Puppet.settings.use(:main)
+    Puppet[:certname] = name
+
+    # Host assumes ca cert and crl are present
+    File.open(Puppet[:localcacert], 'w') { |f| f.write(@ca[:cert].to_pem) }
+    File.open(Puppet[:hostcrl], 'w') { |f| f.write(@crl.to_pem) }
+
+    # Setup our ssl client
+    File.open(Puppet[:hostprivkey], 'w') { |f| f.write(@host[:private_key].to_pem) }
+    File.open(Puppet[:hostpubkey], 'w') { |f| f.write(@host[:private_key].public_key.to_pem) }
+  end
+
+  def expects_command_to_output(expected_message = nil, code = 0)
+    expect {
+      expect {
+        ssl.run_command
+      }.to exit_with(code)
+    }.to output(expected_message).to_stdout
+  end
+
+  shared_examples_for 'an ssl action' do
+    it 'downloads the CA bundle first when missing' do
+      File.delete(Puppet[:localcacert])
+      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: @ca[:cert].to_pem)
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output
+
+      expect(File.read(Puppet[:localcacert])).to eq(@ca[:cert].to_pem)
+    end
+
+    it 'downloads the CRL bundle first when missing' do
+      File.delete(Puppet[:hostcrl])
+      stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: @crl.to_pem)
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output
+
+      expect(File.read(Puppet[:hostcrl])).to eq(@crl.to_pem)
+    end
+  end
+
+  context 'when generating help' do
+    it 'prints usage when no arguments are specified' do
+      ssl.command_line.args << 'whoops'
+
+      expects_command_to_output(/Unknown action 'whoops'/, 1)
+    end
+
+    it 'rejects unknown actions' do
+      expects_command_to_output(/^puppet-ssl.*SYNOPSIS/m, 1)
+    end
+  end
+
+  context 'when submitting a CSR' do
+    let(:csr_path) { File.join(Puppet[:requestdir], "#{name}.pem") }
+
+    before do
+      ssl.command_line.args << 'submit_request'
+    end
+
+    it_behaves_like 'an ssl action'
+
+    it 'submits the CSR and saves it locally' do
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+
+      expect(Puppet::FileSystem).to be_exist(csr_path)
+    end
+
+    it 'detects when a CSR with the same public key has already been submitted' do
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200, body: @host[:csr].to_pem)
+      #  we skip :put
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output
+    end
+
+    it "warns if the local CSR doesn't match the local public key, and submits a new CSR" do
+      # write out the local CSR
+      File.open(csr_path, 'w') { |f| f.write(@host[:csr].to_pem) }
+
+      # generate a new host key, whose public key doesn't match
+      private_key = OpenSSL::PKey::RSA.new(512)
+      public_key = private_key.public_key
+      File.open(Puppet[:hostprivkey], 'w') { |f| f.write(private_key.to_pem) }
+      File.open(Puppet[:hostpubkey], 'w') { |f| f.write(public_key.to_pem) }
+
+      # expect CSR to contain the new pub key
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).with do |request|
+        sent_pem = OpenSSL::X509::Request.new(request.body).public_key.to_pem
+        expect(sent_pem).to eq(public_key.to_pem)
+      end.to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      Puppet.stubs(:warning) # ignore unrelated warnings
+      Puppet.expects(:warning).with("The local CSR does not match the agent's public key. Generating a new CSR.")
+      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+    end
+
+    it 'downloads the certificate when autosigning is enabled' do
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+
+      expect(Puppet::FileSystem).to be_exist(Puppet[:hostcert])
+    end
+
+    it 'accepts dns alt names' do
+      Puppet[:dns_alt_names] = 'majortom'
+
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output
+
+      csr = Puppet::SSL::CertificateRequest.new(name)
+      csr.read(csr_path)
+      expect(csr.subject_alt_names).to include('DNS:majortom')
+    end
+  end
+
+  context 'when downloading a certificate' do
+    before do
+      ssl.command_line.args << 'download_cert'
+    end
+
+    it_behaves_like 'an ssl action'
+
+    it 'downloads a new cert' do
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_output(%r{Downloaded certificate '#{name}' with fingerprint .*})
+
+      expect(File.read(Puppet[:hostcert])).to eq(@host[:cert].to_pem)
+    end
+
+    it 'overwrites an existing cert' do
+      File.open(Puppet[:hostcert], 'w') { |f| f.write "existing certificate" }
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_output(%r{Downloaded certificate '#{name}' with fingerprint .*})
+
+      expect(File.read(Puppet[:hostcert])).to eq(@host[:cert].to_pem)
+    end
+
+    it "reports an error if the downloaded cert's public key doesn't match our private key" do
+      File.open(Puppet[:hostcert], 'w') { |f| f.write "existing cert" }
+
+      # generate a new host key, whose public key doesn't match the cert
+      private_key = OpenSSL::PKey::RSA.new(512)
+      File.open(Puppet[:hostprivkey], 'w') { |f| f.write(private_key.to_pem) }
+      File.open(Puppet[:hostpubkey], 'w') { |f| f.write(private_key.public_key.to_pem) }
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_output(%r{^Failed to download certificate: The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root?}, 1)
+    end
+
+    it "prints a message if there isn't a cert to download" do
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output(/No certificate for '#{name}' on CA/)
+    end
+  end
+
+  context 'when verifying' do
+    before do
+      ssl.command_line.args << 'verify'
+
+      File.open(Puppet[:hostcert], 'w') { |f| f.write(@host[:cert].to_pem) }
+    end
+
+    it 'reports if the key is missing' do
+      File.delete(Puppet[:hostprivkey])
+
+      expects_command_to_output(/The host's private key is missing/, 1)
+    end
+
+    it 'reports if the cert is missing' do
+      File.delete(Puppet[:hostcert])
+
+      expects_command_to_output(/The host's certificate is missing/, 1)
+    end
+
+    it 'reports if the key and cert are mismatched' do
+      # generate new keys
+      private_key = OpenSSL::PKey::RSA.new(512)
+      public_key = private_key.public_key
+      File.open(Puppet[:hostprivkey], 'w') { |f| f.write(private_key.to_pem) }
+      File.open(Puppet[:hostpubkey], 'w') { |f| f.write(public_key.to_pem) }
+
+      expects_command_to_output(/The host's key does not match the certificate/, 1)
+    end
+
+    it 'reports if the cert verification fails' do
+      # generate a new CA to force an error
+      ca = generate_cert('ca')
+      File.open(Puppet[:localcacert], 'w') { |f| f.write(ca[:cert].to_pem) }
+
+      # and CRL for that CA
+      crl = generate_crl('ca', ca[:cert].subject, ca[:private_key])
+      File.open(Puppet[:hostcrl], 'w') { |f| f.write(crl.to_pem) }
+
+      expects_command_to_output(/Failed to verify certificate '#{name}': certificate signature failure \(7\)/, 1)
+    end
+
+    it 'reports when verification succeeds' do
+      OpenSSL::X509::Store.any_instance.stubs(:verify).returns(true)
+
+      expects_command_to_output(/Verified certificate '#{name}'/, 0)
+    end
+  end
+end

data/spec/unit/application_spec.rb

@@ -76,16 +76,40 @@ describe Puppet::Application do
     end
 
     it 'should find applications from multiple paths' do
-      Puppet::Util::Autoload.expects(:files_to_load).with('puppet/application').returns(%w{ /a/foo.rb /b/bar.rb })
+      Puppet::Util::Autoload.expects(:files_to_load).with(
+        'puppet/application',
+        is_a(Puppet::Node::Environment)
+      ).returns(%w{ /a/foo.rb /b/bar.rb })
 
       expect(Puppet::Application.available_application_names).to match_array(%w{ foo bar })
     end
 
     it 'should return unique application names' do
-      Puppet::Util::Autoload.expects(:files_to_load).with('puppet/application').returns(%w{ /a/foo.rb /b/foo.rb })
+      Puppet::Util::Autoload.expects(:files_to_load).with(
+        'puppet/application',
+        is_a(Puppet::Node::Environment)
+      ).returns(%w{ /a/foo.rb /b/foo.rb })
 
       expect(Puppet::Application.available_application_names).to eq(%w{ foo })
     end
+
+    it 'finds the application using the configured environment' do
+      Puppet[:environment] = 'production'
+      Puppet::Util::Autoload.expects(:files_to_load).with do |_, env|
+        expect(env.name).to eq(:production)
+      end.returns(%w{ /a/foo.rb })
+
+      expect(Puppet::Application.available_application_names).to eq(%w{ foo })
+    end
+
+    it "falls back to the current environment if the configured environment doesn't exist" do
+      Puppet[:environment] = 'doesnotexist'
+      Puppet::Util::Autoload.expects(:files_to_load).with do |_, env|
+        expect(env.name).to eq(:'*root*')
+      end.returns(%w[a/foo.rb])
+
+      expect(Puppet::Application.available_application_names).to eq(%w[foo])
+    end
   end
 
   describe ".run_mode" do
@@ -99,6 +123,24 @@ describe Puppet::Application do
     end
   end
 
+  describe ".environment_mode" do
+    it "should default to :local" do
+      expect(@appclass.get_environment_mode).to eq(:local)
+    end
+
+    it "should set and get a value" do
+      @appclass.environment_mode :remote
+      expect(@appclass.get_environment_mode).to eq(:remote)
+    end
+
+    it "should error if given a random symbol" do
+      expect{@appclass.environment_mode :foo}.to raise_error(/Invalid environment mode/)
+    end
+
+    it "should error if given a string" do
+      expect{@appclass.environment_mode 'local'}.to raise_error(/Invalid environment mode/)
+    end
+  end
 
 
   # These tests may look a little weird and repetative in its current state;
@@ -277,7 +319,7 @@ describe Puppet::Application do
       end
     end
 
-    describe 'on POSIX systems', :if => Puppet.features.posix? do
+    describe 'on POSIX systems', :if => (Puppet.features.posix? && RUBY_PLATFORM != 'java') do
       it 'should signal process with HUP after block if restart requested during block execution' do
         Timeout::timeout(3) do  # if the signal doesn't fire, this causes failure.
 
@@ -462,7 +504,7 @@ describe Puppet::Application do
         ROUTES
       end
 
-      expect { @app.configure_indirector_routes }.to raise_error(Psych::SyntaxError, /mapping values are not allowed in this context/)
+      expect { @app.configure_indirector_routes }.to raise_error(Puppet::Error, /mapping values are not allowed/)
     end
   end
 

data/spec/unit/capability_spec.rb

@@ -8,18 +8,20 @@ describe 'Capability types' do
   let(:node) { Puppet::Node.new('test', :environment => env) }
   let(:loaders) { Puppet::Pops::Loaders.new(env) }
 
-  around :each do |example|
+  before(:each) do
     Puppet::Parser::Compiler.any_instance.stubs(:loaders).returns(loaders)
-    Puppet.override(:loaders => loaders, :current_environment => env) do
-      Puppet::Type.newtype :cap, :is_capability => true do
-        newparam :name
-        newparam :host
-      end
-      example.run
-      Puppet::Type.rmtype(:cap)
+    Puppet.push_context({:loaders => loaders, :current_environment => env})
+    Puppet::Type.newtype :cap, :is_capability => true do
+      newparam :name
+      newparam :host
     end
   end
 
+  after(:each) do
+    Puppet::Type.rmtype(:cap)
+    Puppet.pop_context()
+  end
+
   context 'annotations' do
     it "adds a blueprint for a produced resource" do
       catalog = compile_to_catalog(<<-MANIFEST, node)
@@ -391,7 +393,7 @@ test { one: hostname => "ahost", export => Cap[two] }
   end
 
   context 'and aliased resources' do
-    let(:drive) { Puppet.features.microsoft_windows? ? 'C:' : '' }
+    let(:drive) { Puppet::Util::Platform.windows? ? 'C:' : '' }
     let(:code) { <<-PUPPET }
       $dir='#{drive}/tmp/test'
       $same_dir='#{drive}/tmp/test/'

data/spec/unit/{ssl/certificate_factory_spec.rb → certificate_factory_spec.rb}

@@ -1,9 +1,10 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
+require 'puppet/test_ca'
 
-require 'puppet/ssl/certificate_factory'
+require 'puppet/certificate_factory'
 
-describe Puppet::SSL::CertificateFactory do
+describe Puppet::CertificateFactory, :unless => RUBY_PLATFORM == 'java' do
   let :serial    do OpenSSL::BN.new('12') end
   let :name      do "example.local" end
   let :x509_name do OpenSSL::X509::Name.new([['CN', name]]) end
@@ -13,17 +14,15 @@ describe Puppet::SSL::CertificateFactory do
     csr.generate(key)
     csr
   end
-  let :issuer do
-    cert = Puppet::SSL::CertificateAuthority.new
-    cert.generate_ca_certificate
-    cert.host.certificate.content
-  end
+  let(:issuer) { Puppet::TestCa.new.ca_cert }
 
   describe "when generating the certificate" do
     it "should return a new X509 certificate" do
-      expect(subject.build(:server, csr, issuer, serial)).not_to eq(
-        subject.build(:server, csr, issuer, serial)
-      )
+      a = subject.build(:server, csr, issuer, serial)
+      b = subject.build(:server, csr, issuer, serial)
+      # The two instances are equal in every aspect except that they are 
+      # different instances - they are `==`, but not hash `eql?`
+      expect(a).not_to eql(b)
     end
 
     it "should set the certificate's version to 2" do
@@ -56,14 +55,6 @@ describe Puppet::SSL::CertificateFactory do
       expect(cert.not_before).to be_within(30).of(Time.now - 24*60*60)
     end
 
-    it "should set the default TTL of the certificate to the `ca_ttl` setting" do
-      Puppet[:ca_ttl] = 12
-      now = Time.now.utc
-      Time.expects(:now).at_least_once.returns(now)
-      cert = subject.build(:server, csr, issuer, serial)
-      expect(cert.not_after.to_i).to eq(now.to_i + 12)
-    end
-
     it "should not allow a non-integer TTL" do
       [ 'foo', 1.2, Time.now, true ].each do |ttl|
         expect { subject.build(:server, csr, issuer, serial, ttl) }.to raise_error(ArgumentError)