puppet 5.3.4 → 6.29.0

data/spec/integration/type/package_spec.rb

@@ -1,4 +1,3 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 
 describe Puppet::Type.type(:package), "when choosing a default package provider" do
@@ -10,7 +9,7 @@ describe Puppet::Type.type(:package), "when choosing a default package provider"
   def provider_name(os)
     case os
     when 'Solaris'
-      if Puppet::Util::Package.versioncmp(Facter.value(:kernelrelease), '5.11') >= 0
+      if Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:kernelrelease), '5.11') >= 0
         :pkg
       else
         :sun
@@ -22,19 +21,19 @@ describe Puppet::Type.type(:package), "when choosing a default package provider"
     when 'Darwin'
       :pkgdmg
     when 'RedHat'
-      if ['2.1', '3', '4'].include?(Facter.value(:lsbdistrelease))
+      if ['2.1', '3', '4'].include?(Puppet.runtime[:facter].value(:lsbdistrelease))
         :up2date
       else
         :yum
       end
     when 'Fedora'
-      if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemmajrelease), '22') >= 0
+      if Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:operatingsystemmajrelease), '22') >= 0
         :dnf
       else
         :yum
       end
     when 'Suse'
-      if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemmajrelease), '10') >= 0
+      if Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:operatingsystemmajrelease), '10') >= 0
         :zypper
       else
         :rug
@@ -55,8 +54,8 @@ describe Puppet::Type.type(:package), "when choosing a default package provider"
   end
 
   it "should choose the correct provider each platform" do
-    unless default_provider = provider_name(Facter.value(:operatingsystem))
-      pending("No default provider specified in this test for #{Facter.value(:operatingsystem)}")
+    unless default_provider = provider_name(Puppet.runtime[:facter].value(:operatingsystem))
+      pending("No default provider specified in this test for #{Puppet.runtime[:facter].value(:operatingsystem)}")
     end
     expect(Puppet::Type.type(:package).defaultprovider.name).to eq(default_provider)
   end
@@ -64,8 +63,8 @@ end
 
 describe Puppet::Type.type(:package), "when packages with the same name are sourced" do
   before :each do
-    Process.stubs(:euid).returns 0
-    @provider = stub(
+    allow(Process).to receive(:euid).and_return(0)
+    @provider = double(
       'provider',
       :class           => Puppet::Type.type(:package).defaultprovider,
       :clear           => nil,
@@ -73,8 +72,8 @@ describe Puppet::Type.type(:package), "when packages with the same name are sour
       :name            => :mock,
       :validate_source => nil
     )
-    Puppet::Type.type(:package).defaultprovider.stubs(:new).returns(@provider)
-    Puppet::Type.type(:package).defaultprovider.stubs(:instances).returns([])
+    allow(Puppet::Type.type(:package).defaultprovider).to receive(:new).and_return(@provider)
+    allow(Puppet::Type.type(:package).defaultprovider).to receive(:instances).and_return([])
     @package = Puppet::Type.type(:package).new(:name => "yay", :ensure => :present)
 
     @catalog = Puppet::Resource::Catalog.new
@@ -101,11 +100,11 @@ describe Puppet::Type.type(:package), "when packages with the same name are sour
       provider_name = Puppet::Type.type(:package).defaultprovider.name
       expect {
         @catalog.add_resource(@alt_package)
-      }.to raise_error ArgumentError, "Cannot alias Package[gem-yay] to [\"yay\", :#{provider_name}]; resource [\"Package\", \"yay\", :#{provider_name}] already declared"
+      }.to raise_error ArgumentError, "Cannot alias Package[gem-yay] to [nil, \"yay\", :#{provider_name}]; resource [\"Package\", nil, \"yay\", :#{provider_name}] already declared"
     end
   end
 
-  describe "from multiple providers" do
+  describe "from multiple providers", unless: Puppet::Util::Platform.jruby? do
     provider_class = Puppet::Type.type(:package).provider(:gem)
 
     before :each do
@@ -117,18 +116,18 @@ describe Puppet::Type.type(:package), "when packages with the same name are sour
     describe "when it should be present" do
       [:present, :latest, "1.0"].each do |state|
         it "should do nothing if it is #{state.to_s}" do
-          @provider.expects(:properties).returns(:ensure => state).at_least_once
-          @alt_provider.expects(:properties).returns(:ensure => state).at_least_once
+          expect(@provider).to receive(:properties).and_return(:ensure => state).at_least(:once)
+          expect(@alt_provider).to receive(:properties).and_return(:ensure => state).at_least(:once)
           @catalog.apply
         end
       end
 
       [:purged, :absent].each do |state|
         it "should install if it is #{state.to_s}" do
-          @provider.stubs(:properties).returns(:ensure => state)
-          @provider.expects(:install)
-          @alt_provider.stubs(:properties).returns(:ensure => state)
-          @alt_provider.expects(:install)
+          allow(@provider).to receive(:properties).and_return(:ensure => state)
+          expect(@provider).to receive(:install)
+          allow(@alt_provider).to receive(:properties).and_return(:ensure => state)
+          expect(@alt_provider).to receive(:install)
           @catalog.apply
         end
       end
@@ -137,18 +136,17 @@ describe Puppet::Type.type(:package), "when packages with the same name are sour
 end
 
 describe Puppet::Type.type(:package), 'logging package state transitions' do
-
   let(:catalog) { Puppet::Resource::Catalog.new }
-  let(:provider) { stub('provider', :class => Puppet::Type.type(:package).defaultprovider, :clear => nil, :validate_source => nil) }
+  let(:provider) { double('provider', :class => Puppet::Type.type(:package).defaultprovider, :clear => nil, :validate_source => nil) }
 
   before :each do
-    Process.stubs(:euid).returns 0
-    provider.stubs(:satisfies?).with([:purgeable]).returns(true)
-    provider.class.stubs(:instances).returns([])
-    provider.stubs(:install).returns nil
-    provider.stubs(:uninstall).returns nil
-    provider.stubs(:purge).returns nil
-    Puppet::Type.type(:package).defaultprovider.stubs(:new).returns(provider)
+    allow(Process).to receive(:euid).and_return(0)
+    allow(provider).to receive(:satisfies?).with([:purgeable]).and_return(true)
+    allow(provider.class).to receive(:instances).and_return([])
+    allow(provider).to receive(:install).and_return(nil)
+    allow(provider).to receive(:uninstall).and_return(nil)
+    allow(provider).to receive(:purge).and_return(nil)
+    allow(Puppet::Type.type(:package).defaultprovider).to receive(:new).and_return(provider)
   end
 
   after :each do
@@ -179,9 +177,8 @@ describe Puppet::Type.type(:package), 'logging package state transitions' do
 
   states.each do |old, new_states|
     describe "#{old} package" do
-
       before :each do
-        provider.stubs(:properties).returns(:ensure => old)
+        allow(provider).to receive(:properties).and_return(:ensure => old)
       end
 
       new_states.each do |new, status|
@@ -201,4 +198,3 @@ describe Puppet::Type.type(:package), 'logging package state transitions' do
     end
   end
 end
-

data/spec/integration/type/tidy_spec.rb

@@ -1,4 +1,3 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet_spec/compiler'
@@ -10,7 +9,7 @@ describe Puppet::Type.type(:tidy) do
   include PuppetSpec::Compiler
 
   before do
-    Puppet::Util::Storage.stubs(:store)
+    allow(Puppet::Util::Storage).to receive(:store)
   end
 
   it "should be able to recursively remove directories" do

data/spec/integration/type_spec.rb

@@ -1,4 +1,3 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/type'
@@ -21,8 +20,7 @@ describe Puppet::Type do
 
   it "should not lose its provider parameter when it is reloaded" do
     type = Puppet::Type.newtype(:reload_test_type)
-
-    provider = type.provide(:test_provider)
+    type.provide(:test_provider)
 
     # reload it
     type = Puppet::Type.newtype(:reload_test_type)

data/spec/integration/util/autoload_spec.rb

@@ -1,4 +1,3 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/util/autoload'
@@ -24,6 +23,8 @@ require 'puppet_spec/files'
 describe Puppet::Util::Autoload do
   include PuppetSpec::Files
 
+  let(:env) { Puppet::Node::Environment.create(:foo, []) }
+
   def with_file(name, *path)
     path = File.join(*path)
     # Now create a file to load
@@ -49,13 +50,13 @@ describe Puppet::Util::Autoload do
   end
 
   it "should not fail when asked to load a missing file" do
-    expect(Puppet::Util::Autoload.new("foo", "bar").load(:eh)).to be_falsey
+    expect(Puppet::Util::Autoload.new("foo", "bar").load(:eh, env)).to be_falsey
   end
 
   it "should load and return true when it successfully loads a file" do
     with_loader("foo", "bar") { |dir,loader|
       with_file(:mything, dir, "mything.rb") {
-        expect(loader.load(:mything)).to be_truthy
+        expect(loader.load(:mything, env)).to be_truthy
         expect(loader.class).to be_loaded("bar/mything")
         expect(AutoloadIntegrator).to be_thing(:mything)
       }
@@ -65,7 +66,7 @@ describe Puppet::Util::Autoload do
   it "should consider a file loaded when asked for the name without an extension" do
     with_loader("foo", "bar") { |dir,loader|
       with_file(:noext, dir, "noext.rb") {
-        loader.load(:noext)
+        loader.load(:noext, env)
         expect(loader.class).to be_loaded("bar/noext")
       }
     }
@@ -74,7 +75,7 @@ describe Puppet::Util::Autoload do
   it "should consider a file loaded when asked for the name with an extension" do
     with_loader("foo", "bar") { |dir,loader|
       with_file(:noext, dir, "withext.rb") {
-        loader.load(:withext)
+        loader.load(:withext, env)
         expect(loader.class).to be_loaded("bar/withext.rb")
       }
     }
@@ -82,7 +83,7 @@ describe Puppet::Util::Autoload do
 
   it "should be able to load files directly from modules" do
     ## modulepath can't be used until after app settings are initialized, so we need to simulate that:
-    Puppet.settings.expects(:app_defaults_initialized?).returns(true).at_least_once
+    expect(Puppet.settings).to receive(:app_defaults_initialized?).and_return(true).at_least(:once)
 
     modulepath = tmpfile("autoload_module_testing")
     libdir = File.join(modulepath, "mymod", "lib", "foo")
@@ -90,10 +91,11 @@ describe Puppet::Util::Autoload do
 
     file = File.join(libdir, "plugin.rb")
 
-    Puppet.override(:environments => Puppet::Environments::Static.new(Puppet::Node::Environment.create(:production, [modulepath]))) do
+    env = Puppet::Node::Environment.create(:production, [modulepath])
+    Puppet.override(:environments => Puppet::Environments::Static.new(env)) do
       with_loader("foo", "foo") do |dir, loader|
         with_file(:plugin, file.split("/")) do
-          loader.load(:plugin)
+          loader.load(:plugin, env)
           expect(loader.class).to be_loaded("foo/plugin.rb")
         end
       end

data/spec/integration/util/execution_spec.rb

@@ -1,16 +1,16 @@
 require 'spec_helper'
 
-describe Puppet::Util::Execution do
+describe Puppet::Util::Execution, unless: Puppet::Util::Platform.jruby? do
   include PuppetSpec::Files
 
   describe "#execpipe" do
-    it "should set LANG to C avoid localized output", :if => !Puppet.features.microsoft_windows? do
+    it "should set LANG to C avoid localized output", :if => !Puppet::Util::Platform.windows? do
       out = ""
       Puppet::Util::Execution.execpipe('echo $LANG'){ |line| out << line.read.chomp }
       expect(out).to eq("C")
     end
 
-    it "should set LC_ALL to C avoid localized output", :if => !Puppet.features.microsoft_windows? do
+    it "should set LC_ALL to C avoid localized output", :if => !Puppet::Util::Platform.windows? do
       out = ""
       Puppet::Util::Execution.execpipe('echo $LC_ALL'){ |line| out << line.read.chomp }
       expect(out).to eq("C")
@@ -25,7 +25,56 @@ describe Puppet::Util::Execution do
     end
   end
 
-  describe "#execute (non-Windows)", :if => !Puppet.features.microsoft_windows? do
+  describe "#execute" do
+    if Puppet::Util::Platform.windows?
+      let(:argv) { ["cmd", "/c", "echo", 123] }
+    else
+      let(:argv) { ["echo", 123] }
+    end
+
+    it 'stringifies sensitive arguments when given an array containing integers' do
+      result = Puppet::Util::Execution.execute(argv, sensitive: true)
+      expect(result.to_s.strip).to eq("123")
+      expect(result.exitstatus).to eq(0)
+    end
+
+    it 'redacts sensitive arguments when given an array' do
+      Puppet[:log_level] = :debug
+      Puppet::Util::Execution.execute(argv, sensitive: true)
+      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'"))
+    end
+
+    it 'redacts sensitive arguments when given a string' do
+      Puppet[:log_level] = :debug
+      str = argv.map(&:to_s).join(' ')
+      Puppet::Util::Execution.execute(str, sensitive: true)
+      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'"))
+    end
+
+    it "allows stdout and stderr to share a file" do
+      command = "ruby -e '(1..10).each {|i| (i%2==0) ? $stdout.puts(i) : $stderr.puts(i)}'"
+
+      expect(Puppet::Util::Execution.execute(command, :combine => true).split).to match_array([*'1'..'10'])
+    end
+
+    it "returns output and set $CHILD_STATUS" do
+      command = "ruby -e 'puts \"foo\"; exit 42'"
+
+      output = Puppet::Util::Execution.execute(command, {:failonfail => false})
+
+      expect(output).to eq("foo\n")
+      expect($CHILD_STATUS.exitstatus).to eq(42)
+    end
+
+    it "raises an error if non-zero exit status is returned" do
+      command = "ruby -e 'exit 43'"
+
+      expect { Puppet::Util::Execution.execute(command) }.to raise_error(Puppet::ExecutionFailure, /Execution of '#{command}' returned 43: /)
+      expect($CHILD_STATUS.exitstatus).to eq(43)
+    end
+  end
+
+  describe "#execute (non-Windows)", :if => !Puppet::Util::Platform.windows? do
     it "should execute basic shell command" do
       result = Puppet::Util::Execution.execute("ls /tmp", :failonfail => true)
       expect(result.exitstatus).to eq(0)
@@ -33,7 +82,7 @@ describe Puppet::Util::Execution do
     end
   end
 
-  describe "#execute (Windows)", :if => Puppet.features.microsoft_windows? do
+  describe "#execute (Windows)", :if => Puppet::Util::Platform.windows? do
     let(:utf8text) do
       # Japanese Lorem Ipsum snippet
       "utf8testfile" + [227, 131, 171, 227, 131, 147, 227, 131, 179, 227, 131, 132, 227,

data/spec/integration/util/rdoc/parser_spec.rb

@@ -1,8 +1,7 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/util/rdoc'
 
-describe "RDoc::Parser", :unless => Puppet.features.microsoft_windows? do
+describe "RDoc::Parser", :unless => Puppet::Util::Platform.windows? do
   require 'puppet_spec/files'
   include PuppetSpec::Files
 
@@ -92,7 +91,7 @@ end
         File.join(modules_dir, 'a_module', 'lib', 'facter', 'a_fact.rb'),
         <<-EOF
 # The a_fact fact comment
-Facter.add("a_fact") do
+Puppet.runtime[:facter].add("a_fact") do
 end
         EOF
       ],
@@ -141,22 +140,21 @@ end
     Puppet::Util::RDoc.rdoc(doc_dir, [modules_dir, manifests_dir])
   end
 
-  module RdocTesters
-    def has_plugin_rdoc(module_name, type, name)
-      file_exists_and_matches_content(plugin_path(module_name, type, name), /The .*?#{name}.*?\s*#{type} comment/m, /Type.*?#{type}/m)
+  describe "rdoc2 support" do
+    def module_path(module_name)
+      "#{doc_dir}/#{module_name}.html"
     end
-  end
 
-  shared_examples_for :an_rdoc_site do
-    # PUP-3274 / PUP-3638 not sure if this should be kept or not - it is now broken
-#    it "documents the __site__ module" do
-#      has_module_rdoc("__site__")
-#    end
+    def plugin_path(module_name, type, name)
+      "#{doc_dir}/#{module_name}/__#{type}s__.html"
+    end
 
-    # PUP-3274 / PUP-3638 not sure if this should be kept or not - it is now broken
-#    it "documents the a_module module" do
-#      has_module_rdoc("a_module", /The .*?a_module.*? .*?README.*?docs/m)
-#    end
+    def has_plugin_rdoc(module_name, type, name)
+      file_exists_and_matches_content(
+        plugin_path(module_name, type, name),
+        /The .*?#{name}.*?\s*#{type} comment/m, /Type.*?#{type}/m
+      )
+    end
 
     it "documents the a_module::a_plugin type" do
       has_plugin_rdoc("a_module", :type, 'a_plugin')
@@ -170,13 +168,4 @@ end
       has_plugin_rdoc("a_module", :fact, 'a_fact')
     end
   end
-
-  describe "rdoc2 support" do
-    def module_path(module_name); "#{doc_dir}/#{module_name}.html" end
-    def plugin_path(module_name, type, name); "#{doc_dir}/#{module_name}/__#{type}s__.html" end
-
-    include RdocTesters
-
-    it_behaves_like :an_rdoc_site
-  end
 end

data/spec/integration/util/settings_spec.rb

@@ -1,4 +1,3 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet_spec/files'
@@ -30,6 +29,7 @@ describe Puppet::Settings do
   end
 
   it "should make its directories with the correct modes" do
+    Puppet[:manage_internal_file_permissions] = true
     define_settings(:main,
         :maindir => {
             :default => tmpfile("main"),
@@ -70,7 +70,7 @@ environment=#{rune_utf8}
     expect(settings[:environment]).to eq(rune_utf8)
   end
 
-  it "reparses configuration if configuration file is touched", :if => !Puppet.features.microsoft_windows? do
+  it "reparses configuration if configuration file is touched", :if => !Puppet::Util::Platform.windows? do
     config = tmpfile("config")
     define_settings(:main,
       :config => {

data/spec/integration/util/windows/adsi_spec.rb

@@ -1,9 +1,8 @@
-#!/usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/util/windows'
 
 describe Puppet::Util::Windows::ADSI::User,
-  :if => Puppet.features.microsoft_windows? do
+  :if => Puppet::Util::Platform.windows? do
 
   describe ".initialize" do
     it "cannot reference BUILTIN accounts like SYSTEM due to WinNT moniker limitations" do
@@ -13,7 +12,7 @@ describe Puppet::Util::Windows::ADSI::User,
       #     HRESULT error code:0x800708ad
       #           The user name could not be found.
       # Matching on error code alone is sufficient
-      expect { system.native_user }.to raise_error(/0x800708ad/)
+      expect { system.native_object }.to raise_error(/0x800708ad/)
     end
   end
 
@@ -34,8 +33,8 @@ describe Puppet::Util::Windows::ADSI::User,
 
   describe '.[]' do
     it 'should return string attributes as UTF-8' do
-      administrator = Puppet::Util::Windows::ADSI::User.new('Administrator')
-      expect(administrator['Description'].encoding).to eq(Encoding::UTF_8)
+      user = Puppet::Util::Windows::ADSI::User.new('Guest')
+      expect(user['Description'].encoding).to eq(Encoding::UTF_8)
     end
   end
 
@@ -56,10 +55,28 @@ describe Puppet::Util::Windows::ADSI::User,
       end
     end
   end
+
+  describe '.current_user_name_with_format' do
+    context 'when desired format is NameSamCompatible' do
+      it 'should get the same user name as the current_user_name method but fully qualified' do
+        user_name = Puppet::Util::Windows::ADSI::User.current_user_name
+        fully_qualified_user_name = Puppet::Util::Windows::ADSI::User.current_sam_compatible_user_name
+
+        expect(fully_qualified_user_name).to match(/^.+\\#{user_name}$/)
+      end
+
+      it 'should have the same SID as with the current_user_name method' do
+        user_name = Puppet::Util::Windows::ADSI::User.current_user_name
+        fully_qualified_user_name = Puppet::Util::Windows::ADSI::User.current_sam_compatible_user_name
+
+        expect(Puppet::Util::Windows::SID.name_to_sid(user_name)).to eq(Puppet::Util::Windows::SID.name_to_sid(fully_qualified_user_name))
+      end
+    end
+  end
 end
 
 describe Puppet::Util::Windows::ADSI::Group,
-  :if => Puppet.features.microsoft_windows? do
+  :if => Puppet::Util::Platform.windows? do
 
   let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
   let (:administrators_principal) { Puppet::Util::Windows::SID::Principal.lookup_account_sid(administrator_bytes) }
@@ -70,7 +87,6 @@ describe Puppet::Util::Windows::ADSI::Group,
         original_codepage = Encoding.default_external
         Encoding.default_external = Encoding::CP850 # Western Europe
 
-
         Puppet::Util::Windows::ADSI::Group.each do |group|
           expect(group.name.encoding).to be(Encoding::UTF_8)
         end
@@ -81,6 +97,98 @@ describe Puppet::Util::Windows::ADSI::Group,
   end
 
   describe '.members' do
+    it 'should return a list of members resolvable with Puppet::Util::Windows::ADSI::Group.name_sid_hash' do
+      temp_groupname = "g#{SecureRandom.uuid}"
+      temp_username  = "u#{SecureRandom.uuid}"[0..12]
+      # From https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements
+      specials = "~!@#$%^&*_-+=`|\(){}[]:;\"'<>,.?/"
+      temp_password = "p#{SecureRandom.uuid[0..7]}-#{SecureRandom.uuid.upcase[0..7]}-#{specials[rand(specials.length)]}"
+
+      # select a virtual account that requires an authority to be able to resolve to SID
+      # the Dhcp service is chosen for no particular reason aside from it's a service available on all Windows versions
+      dhcp_virtualaccount = Puppet::Util::Windows::SID.name_to_principal('NT SERVICE\Dhcp')
+
+      # adding :SidTypeGroup as a group member will cause error in IAdsUser::Add
+      # adding :SidTypeDomain (such as S-1-5-80 / NT SERVICE or computer name) won't error
+      #   but also won't be returned as a group member
+      # uncertain how to obtain :SidTypeComputer (perhaps AD? the local machine is :SidTypeDomain)
+      users = [
+        # Use sid_to_name to get localized names of SIDs - BUILTIN, SYSTEM, NT AUTHORITY, Everyone are all localized
+        # :SidTypeWellKnownGroup
+        # SYSTEM is prefixed with the NT Authority authority, resolveable with or without authority
+        { :sid => 'S-1-5-18', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-5-18') },
+        # Everyone is not prefixed with an authority, resolveable with or without NT AUTHORITY authority
+        { :sid => 'S-1-1-0', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-1-0') },
+        # Dhcp service account is prefixed with NT SERVICE authority, requires authority to resolve SID
+        # behavior is similar to IIS APPPOOL\DefaultAppPool
+        { :sid => dhcp_virtualaccount.sid, :name => dhcp_virtualaccount.domain_account },
+
+        # :SidTypeAlias with authority component
+        # Administrators group is prefixed with BUILTIN authority, can be resolved with or without authority
+        { :sid => 'S-1-5-32-544', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-5-32-544') },
+      ]
+
+      begin
+        # :SidTypeUser as user on localhost, can be resolved with or without authority prefix
+        user = Puppet::Util::Windows::ADSI::User.create(temp_username)
+        # appveyor sometimes requires a password
+        user.password = temp_password
+        user.commit()
+        users.push({ :sid => user.sid.sid, :name => Puppet::Util::Windows::ADSI.computer_name + '\\' + temp_username })
+
+        # create a test group and add above 5 members by SID
+        group = described_class.create(temp_groupname)
+        group.commit()
+        group.set_members(users.map { |u| u[:sid]} )
+
+        # most importantly make sure that all name are convertible to SIDs
+        expect { described_class.name_sid_hash(group.members) }.to_not raise_error
+
+        # also verify the names returned are as expected
+        expected_usernames = users.map { |u| u[:name] }
+        expect(group.members.map(&:domain_account)).to eq(expected_usernames)
+      ensure
+        described_class.delete(temp_groupname) if described_class.exists?(temp_groupname)
+        Puppet::Util::Windows::ADSI::User.delete(temp_username) if Puppet::Util::Windows::ADSI::User.exists?(temp_username)
+      end
+    end
+
+    it 'should return a list of Principal objects even with unresolvable SIDs' do
+      members = [
+        # NULL SID is not localized
+        double('WIN32OLE', {
+          :objectSID => [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+          :Name => 'NULL SID',
+          :ole_respond_to? => true,
+        }),
+        # unresolvable SID is a different story altogether
+        double('WIN32OLE', {
+          # completely valid SID, but Name is just a stringified version
+          :objectSID => [1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 5, 113, 65, 218, 15, 127, 9, 57, 219, 4, 84, 126, 88, 4, 0, 0],
+          :Name => 'S-1-5-21-3661721861-956923663-2119435483-1112',
+          :ole_respond_to? => true,
+        })
+      ]
+
+      admins_name = Puppet::Util::Windows::SID.sid_to_name('S-1-5-32-544')
+      admins = Puppet::Util::Windows::ADSI::Group.new(admins_name)
+
+      # touch the native_object member to have it lazily loaded, so COM objects can be stubbed
+      admins.native_object
+      without_partial_double_verification do
+        allow(admins.native_object).to receive(:Members).and_return(members)
+      end
+
+      # well-known NULL SID
+      expect(admins.members[0].sid).to eq('S-1-0-0')
+      expect(admins.members[0].account_type).to eq(:SidTypeWellKnownGroup)
+
+      # unresolvable SID
+      expect(admins.members[1].sid).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
+      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
+      expect(admins.members[1].account_type).to eq(:SidTypeUnknown)
+    end
+
     it 'should return a list of members with UTF-8 names' do
       begin
         original_codepage = Encoding.default_external
@@ -88,7 +196,7 @@ describe Puppet::Util::Windows::ADSI::Group,
 
         # lookup by English name Administrators is not OK on localized Windows
         admins = Puppet::Util::Windows::ADSI::Group.new(administrators_principal.account)
-        admins.members.each do |name|
+        admins.members.map(&:domain_account).each do |name|
           expect(name.encoding).to be(Encoding::UTF_8)
         end
       ensure

data/spec/integration/util/windows/monkey_patches/dir_spec.rb

@@ -0,0 +1,11 @@
+require 'spec_helper'
+
+describe Dir, :if => Puppet::Util::Platform.windows? do
+  it "should always have the PERSONAL constant defined" do
+    expect(described_class).to be_const_defined(:PERSONAL)
+  end
+
+  it "should not raise any errors when accessing the PERSONAL constant" do
+    expect { described_class::PERSONAL }.not_to raise_error
+  end
+end