puppet 5.3.4 → 6.29.0

data/spec/lib/puppet/test_ca.rb

@@ -0,0 +1,164 @@
+module Puppet
+  class TestCa
+
+    CERT_VALID_FROM = Time.at(0).freeze # 1969-12-31 16:00:00 -0800
+    CERT_VALID_UNTIL = (Time.now + (10 * 365 * 24 * 60 * 60)).freeze # 10 years from now
+
+    CA_EXTENSIONS = [
+      ["basicConstraints", "CA:TRUE", true],
+      ["keyUsage", "keyCertSign, cRLSign", true],
+      ["subjectKeyIdentifier", "hash", false],
+      ["nsComment", "Puppet Server Internal Certificate", false],
+      ["authorityKeyIdentifier", "keyid:always", false]
+    ].freeze
+
+    attr_reader :ca_cert, :ca_crl, :key
+
+    @serial = 0
+    def self.next_serial
+      id = @serial
+      @serial += 1
+      id
+    end
+
+    def initialize(name = 'Test CA')
+      @digest = OpenSSL::Digest::SHA256.new
+      info = create_cacert(name)
+      @key = info[:private_key]
+      @ca_cert = info[:cert]
+      @ca_crl = create_crl(@ca_cert, @key)
+    end
+
+    def create_request(name)
+      key = OpenSSL::PKey::RSA.new(2048)
+      csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
+      csr.subject = OpenSSL::X509::Name.new([["CN", name]])
+      csr.version = 2
+      csr.sign(key, @digest)
+      { private_key: key, csr: csr }
+    end
+
+    def create_cert(name, issuer_cert, issuer_key, opts = {})
+      key, cert = build_cert(name, issuer_cert.subject, opts)
+      ef = extension_factory_for(issuer_cert, cert)
+      if opts[:subject_alt_names]
+        ext = ef.create_extension(["subjectAltName", opts[:subject_alt_names], false])
+        cert.add_extension(ext)
+      end
+      if exts = opts[:extensions]
+        exts.each do |e|
+          cert.add_extension(OpenSSL::X509::Extension.new(*e))
+        end
+      end
+      cert.sign(issuer_key, @digest)
+      { private_key: key, cert: cert }
+    end
+
+    def create_intermediate_cert(name, issuer_cert, issuer_key)
+      key, cert = build_cert(name, issuer_cert.subject)
+      ef = extension_factory_for(issuer_cert, cert)
+      CA_EXTENSIONS.each do |ext|
+        cert.add_extension(ef.create_extension(*ext))
+      end
+      cert.sign(issuer_key, @digest)
+      { private_key: key, cert: cert }
+    end
+
+    def create_cacert(name)
+      issuer = OpenSSL::X509::Name.new([["CN", name]])
+      key, cert = build_cert(name, issuer)
+      ef = extension_factory_for(cert, cert)
+      CA_EXTENSIONS.each do |ext|
+        cert.add_extension(ef.create_extension(*ext))
+      end
+      cert.sign(key, @digest)
+      { private_key: key, cert: cert }
+    end
+
+    def create_crl(issuer_cert, issuer_key)
+      crl = OpenSSL::X509::CRL.new
+      crl.version = 1
+      crl.issuer = issuer_cert.subject
+      ef = extension_factory_for(issuer_cert)
+      crl.add_extension(
+        ef.create_extension(["authorityKeyIdentifier", "keyid:always", false]))
+      crl.add_extension(
+        OpenSSL::X509::Extension.new("crlNumber", OpenSSL::ASN1::Integer(0)))
+      crl.last_update = CERT_VALID_FROM
+      crl.next_update = CERT_VALID_UNTIL
+      crl.sign(issuer_key, @digest)
+      crl
+    end
+
+    def sign(csr, opts = {})
+      cert = OpenSSL::X509::Certificate.new
+      cert.public_key = csr.public_key
+      cert.subject = csr.subject
+      cert.issuer = @ca_cert.subject
+      cert.version = 2
+      cert.serial = self.class.next_serial
+      cert.not_before = CERT_VALID_FROM
+      cert.not_after =  CERT_VALID_UNTIL
+      ef = extension_factory_for(@ca_cert, cert)
+      if opts[:subject_alt_names]
+        ext = ef.create_extension(["subjectAltName", opts[:subject_alt_names], false])
+        cert.add_extension(ext)
+      end
+      cert.sign(@key, @digest)
+      Puppet::SSL::Certificate.from_instance(cert)
+    end
+
+    def revoke(cert, crl = @crl, issuer_key = @key)
+      revoked = OpenSSL::X509::Revoked.new
+      revoked.serial = cert.serial
+      revoked.time = Time.now
+      enum = OpenSSL::ASN1::Enumerated(OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
+      ext = OpenSSL::X509::Extension.new("CRLReason", enum)
+      revoked.add_extension(ext)
+      crl.add_revoked(revoked)
+      crl.sign(issuer_key, @digest)
+    end
+
+    def generate(name, opts)
+      info = create_request(name)
+      cert = sign(info[:csr], opts).content
+      info.merge(cert: cert)
+    end
+
+    private
+
+    def build_cert(name, issuer, opts = {})
+      key = if opts[:key_type] == :ec
+              key = OpenSSL::PKey::EC.generate('prime256v1')
+            else
+              key = OpenSSL::PKey::RSA.new(2048)
+            end
+      cert = OpenSSL::X509::Certificate.new
+      cert.public_key = if key.is_a?(OpenSSL::PKey::EC)
+                         # EC#public_key doesn't following the PKey API,
+                         # see https://github.com/ruby/openssl/issues/29
+                         point = key.public_key
+                         pubkey = OpenSSL::PKey::EC.new(point.group)
+                         pubkey.public_key = point
+                         pubkey
+                       else
+                         key.public_key
+                       end
+      cert.subject = OpenSSL::X509::Name.new([["CN", name]])
+      cert.issuer = issuer
+      cert.version = 2
+      cert.serial = self.class.next_serial
+      cert.not_before = CERT_VALID_FROM
+      cert.not_after = CERT_VALID_UNTIL
+      [key, cert]
+    end
+
+    def extension_factory_for(ca, cert = nil)
+      ef = OpenSSL::X509::ExtensionFactory.new
+      ef.issuer_certificate  = ca
+      ef.subject_certificate = cert if cert
+      ef
+    end
+  end
+end

data/spec/lib/puppet_spec/compiler.rb

@@ -44,7 +44,7 @@ module PuppetSpec::Compiler
 
   def apply_with_error_check(manifest)
     apply_compiled_manifest(manifest) do |res|
-      res.expects(:err).never
+      expect(res).not_to receive(:err)
     end
   end
 
@@ -82,4 +82,31 @@ module PuppetSpec::Compiler
       end
     end
   end
+
+  # Compiles a catalog, and if source is given evaluates it and returns its result.
+  # The catalog is returned if no source is given.
+  # Topscope variables are set before compilation
+  # Uses a created node 'testnode' if none is given.
+  # (Parameters given by name)
+  #
+  def evaluate(code: 'undef', source: nil, node: Puppet::Node.new('testnode'), variables: {})
+    source_location = caller[0]
+    Puppet[:code] = code
+    compiler = Puppet::Parser::Compiler.new(node)
+    unless variables.empty?
+      scope = compiler.topscope
+      variables.each {|k,v| scope.setvar(k, v) }
+    end
+
+    if source.nil?
+      compiler.compile
+      # see lib/puppet/indirector/catalog/compiler.rb#filter
+      return compiler.filter { |r| r.virtual? }
+    end
+
+    # evaluate given source is the context of the compiled state and return its result
+    compiler.compile do |catalog |
+      Puppet::Pops::Parser::EvaluatingParser.singleton.evaluate_string(compiler.topscope, source, source_location)
+    end
+  end
 end

data/spec/lib/puppet_spec/files.rb

@@ -9,7 +9,6 @@ module PuppetSpec::Files
     $global_tempfiles ||= []
     while path = $global_tempfiles.pop do
       begin
-        Dir.unstub(:entries)
         FileUtils.rm_rf path, :secure => true
       rescue Errno::ENOENT
         # nothing to do
@@ -17,36 +16,31 @@ module PuppetSpec::Files
     end
   end
 
-  def make_absolute(path) PuppetSpec::Files.make_absolute(path) end
-  def self.make_absolute(path)
+  module_function
+
+  def make_absolute(path)
     path = File.expand_path(path)
-    path[0] = 'c' if Puppet.features.microsoft_windows?
+    path[0] = 'c' if Puppet::Util::Platform.windows?
     path
   end
 
-  def tmpfile(name, dir = nil) PuppetSpec::Files.tmpfile(name, dir) end
-  def self.tmpfile(name, dir = nil)
-    # Generate a temporary file, just for the name...
-    source = dir ? Tempfile.new(name, dir) : Tempfile.new(name)
-    path = Puppet::FileSystem.expand_path(source.path.encode(Encoding::UTF_8))
-    source.close!
-
+  def tmpfile(name, dir = nil)
+    dir ||= Dir.tmpdir
+    path = Puppet::FileSystem.expand_path(make_tmpname(name, nil).encode(Encoding::UTF_8), dir)
     record_tmp(File.expand_path(path))
 
     path
   end
 
-  def file_containing(name, contents) PuppetSpec::Files.file_containing(name, contents) end
-  def self.file_containing(name, contents)
+  def file_containing(name, contents)
     file = tmpfile(name)
     File.open(file, 'wb') { |f| f.write(contents) }
     file
   end
 
-  def script_containing(name, contents) PuppetSpec::Files.script_containing(name, contents) end
-  def self.script_containing(name, contents)
+  def script_containing(name, contents)
     file = tmpfile(name)
-    if Puppet.features.microsoft_windows?
+    if Puppet::Util::Platform.windows?
       file += '.bat'
       text = contents[:windows]
     else
@@ -57,8 +51,7 @@ module PuppetSpec::Files
     file
   end
 
-  def tmpdir(name) PuppetSpec::Files.tmpdir(name) end
-  def self.tmpdir(name)
+  def tmpdir(name)
     dir = Puppet::FileSystem.expand_path(Dir.mktmpdir(name).encode!(Encoding::UTF_8))
 
     record_tmp(dir)
@@ -66,13 +59,24 @@ module PuppetSpec::Files
     dir
   end
 
-  def dir_containing(name, contents_hash) PuppetSpec::Files.dir_containing(name, contents_hash) end
-  def self.dir_containing(name, contents_hash)
+  # Copied from ruby 2.4 source
+  def make_tmpname((prefix, suffix), n)
+    prefix = (String.try_convert(prefix) or
+              raise ArgumentError, "unexpected prefix: #{prefix.inspect}")
+    suffix &&= (String.try_convert(suffix) or
+                raise ArgumentError, "unexpected suffix: #{suffix.inspect}")
+    t = Time.now.strftime("%Y%m%d")
+    path = "#{prefix}#{t}-#{$$}-#{rand(0x100000000).to_s(36)}".dup
+    path << "-#{n}" if n
+    path << suffix if suffix
+    path
+  end
+
+  def dir_containing(name, contents_hash)
     dir_contained_in(tmpdir(name), contents_hash)
   end
 
-  def dir_contained_in(dir, contents_hash) PuppetSpec::Files.dir_contained_in(dir, contents_hash) end
-  def self.dir_contained_in(dir, contents_hash)
+  def dir_contained_in(dir, contents_hash)
     contents_hash.each do |k,v|
       if v.is_a?(Hash)
         Dir.mkdir(tmp = File.join(dir,k))
@@ -85,7 +89,7 @@ module PuppetSpec::Files
     dir
   end
 
-  def self.record_tmp(tmp)
+  def record_tmp(tmp)
     # ...record it for cleanup,
     $global_tempfiles ||= []
     $global_tempfiles << tmp
@@ -93,7 +97,7 @@ module PuppetSpec::Files
 
   def expect_file_mode(file, mode)
     actual_mode = "%o" % Puppet::FileSystem.stat(file).mode
-    target_mode = if Puppet.features.microsoft_windows?
+    target_mode = if Puppet::Util::Platform.windows?
       mode
     else
       "10" + "%04i" % mode.to_i

data/spec/lib/puppet_spec/fixtures.rb

@@ -25,4 +25,28 @@ module PuppetSpec::Fixtures
     block_given? and files.each do |file| yield file end
     files
   end
+
+  def pem_content(name)
+    File.read(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', name), encoding: 'UTF-8')
+  end
+
+  def cert_fixture(name)
+    OpenSSL::X509::Certificate.new(pem_content(name))
+  end
+
+  def crl_fixture(name)
+    OpenSSL::X509::CRL.new(pem_content(name))
+  end
+
+  def key_fixture(name)
+    OpenSSL::PKey::RSA.new(pem_content(name))
+  end
+
+  def ec_key_fixture(name)
+    OpenSSL::PKey::EC.new(pem_content(name))
+  end
+
+  def request_fixture(name)
+    OpenSSL::X509::Request.new(pem_content(name))
+  end
 end

data/spec/lib/puppet_spec/https.rb

@@ -0,0 +1,95 @@
+require 'spec_helper'
+require 'webrick'
+
+class PuppetSpec::HTTPSServer
+  include PuppetSpec::Fixtures
+
+  attr_reader :ca_cert, :ca_crl, :server_cert, :server_key
+
+  def initialize(ca_cert: nil, ca_crl: nil, server_key: nil, server_cert: nil)
+    @ca_cert = ca_cert || cert_fixture('ca.pem')
+    @ca_crl = ca_crl || crl_fixture('crl.pem')
+    @server_key = server_key || key_fixture('127.0.0.1-key.pem')
+    @server_cert = server_cert || cert_fixture('127.0.0.1.pem')
+    @config = WEBrick::Config::HTTP.dup
+  end
+
+  def handle_request(ctx, ssl, response_proc)
+    req = WEBrick::HTTPRequest.new(@config)
+    req.parse(ssl)
+
+    # always drain request body
+    req.body
+
+    res = WEBrick::HTTPResponse.new(@config)
+    res.status = 200
+    res.body = 'OK'
+    # The server explicitly closes the connection after handling it,
+    # so explicitly tell the client we're not going to keep it open.
+    # Without this, ruby will add `Connection: Keep-Alive`, which
+    # confuses the client when it tries to reuse the half-closed
+    # connection.
+    res['Connection'] = 'close'
+    response_proc.call(req, res) if response_proc
+
+    res.send_response(ssl)
+  end
+
+  def start_server(ctx_proc: nil, response_proc: nil, &block)
+    errors = []
+
+    IO.pipe {|stop_pipe_r, stop_pipe_w|
+      store = OpenSSL::X509::Store.new
+      Array(@ca_cert).each { |c| store.add_cert(c) }
+      store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
+      ctx = OpenSSL::SSL::SSLContext.new
+      ctx.cert_store = store
+      ctx.cert = @server_cert
+      ctx.key = @server_key
+      ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      ctx_proc.call(ctx) if ctx_proc
+
+      Socket.do_not_reverse_lookup = true
+      tcps = TCPServer.new("127.0.0.1", 0)
+      begin
+        port = tcps.connect_address.ip_port
+        begin
+          server_thread = Thread.new do
+            begin
+              ssls = OpenSSL::SSL::SSLServer.new(tcps, ctx)
+              ssls.start_immediately = true
+
+              loop do
+                readable, = IO.select([ssls, stop_pipe_r])
+                break if readable.include?(stop_pipe_r)
+
+                ssl = ssls.accept
+                begin
+                  handle_request(ctx, ssl, response_proc)
+                ensure
+                  ssl.close
+                end
+              end
+            rescue => e
+              # uncomment this line if something goes wrong
+              # puts "SERVER #{e.message}"
+              errors << e
+            end
+          end
+
+          begin
+            yield port
+          ensure
+            stop_pipe_w.close
+          end
+        ensure
+          server_thread.join
+        end
+      ensure
+        tcps.close
+      end
+    }
+
+    errors
+  end
+end

data/spec/lib/puppet_spec/language.rb

@@ -9,50 +9,49 @@ module PuppetSpec::Language
     expectations.each do |manifest, resources|
       it "evaluates #{manifest} to produce #{resources}" do
         begin
-        case resources
-        when String
-          node = Puppet::Node.new('specification')
-          Puppet[:code] = manifest
-          compiler = Puppet::Parser::Compiler.new(node)
-          evaluator = Puppet::Pops::Parser::EvaluatingParser.new()
+          case resources
+          when String
+            node = Puppet::Node.new('specification')
+            Puppet[:code] = manifest
+            compiler = Puppet::Parser::Compiler.new(node)
+            evaluator = Puppet::Pops::Parser::EvaluatingParser.new()
 
-          # see lib/puppet/indirector/catalog/compiler.rb#filter
-          catalog = compiler.compile.filter { |r| r.virtual? }
+            # see lib/puppet/indirector/catalog/compiler.rb#filter
+            catalog = compiler.compile.filter { |r| r.virtual? }
 
-          compiler.send(:instance_variable_set, :@catalog, catalog)
+            compiler.send(:instance_variable_set, :@catalog, catalog)
 
-          Puppet.override(:loaders => compiler.loaders) do
-            expect(evaluator.evaluate_string(compiler.topscope, resources)).to eq(true)
-          end
-        when Array
-          catalog = PuppetSpec::Compiler.compile_to_catalog(manifest)
+            Puppet.override(:loaders => compiler.loaders) do
+              expect(evaluator.evaluate_string(compiler.topscope, resources)).to eq(true)
+            end
+          when Array
+            catalog = PuppetSpec::Compiler.compile_to_catalog(manifest)
 
-          if resources.empty?
-            base_resources = ["Class[Settings]", "Class[main]", "Stage[main]"]
-            expect(catalog.resources.collect(&:ref) - base_resources).to eq([])
-          else
-            resources.each do |reference|
-              if reference.is_a?(Array)
-                matcher = Matchers::Resource.have_resource(reference[0])
-                reference[1].each do |name, value|
-                  matcher = matcher.with_parameter(name, value)
+            if resources.empty?
+              base_resources = ["Class[Settings]", "Class[main]", "Stage[main]"]
+              expect(catalog.resources.collect(&:ref) - base_resources).to eq([])
+            else
+              resources.each do |reference|
+                if reference.is_a?(Array)
+                  matcher = Matchers::Resource.have_resource(reference[0])
+                  reference[1].each do |name, value|
+                    matcher = matcher.with_parameter(name, value)
+                  end
+                else
+                  matcher = Matchers::Resource.have_resource(reference)
                 end
-              else
-                matcher = Matchers::Resource.have_resource(reference)
-              end
 
-              expect(catalog).to matcher
+                expect(catalog).to matcher
+              end
             end
+          else
+            raise "Unsupported creates specification: #{resources.inspect}"
           end
-        else
-          raise "Unsupported creates specification: #{resources.inspect}"
+        rescue  Puppet::Error, RSpec::Expectations::ExpectationNotMetError => e
+          # provide the backtrace from the caller, or it is close to impossible to find some originators
+          e.set_backtrace(calledFrom)
+          raise
         end
-      rescue  Puppet::Error, RSpec::Expectations::ExpectationNotMetError => e
-        # provide the backtrace from the caller, or it is close to impossible to find some originators
-        e.set_backtrace(calledFrom)
-        raise
-      end
-
       end
     end
   end

data/spec/lib/puppet_spec/matchers.rb

@@ -1,18 +1,5 @@
 require 'stringio'
 
-########################################################################
-# Backward compatibility for Jenkins outdated environment.
-module RSpec
-  module Matchers
-    module BlockAliases
-      alias_method :to,     :should      unless method_defined? :to
-      alias_method :to_not, :should_not  unless method_defined? :to_not
-      alias_method :not_to, :should_not  unless method_defined? :not_to
-    end
-  end
-end
-
-
 ########################################################################
 # Custom matchers...
 RSpec::Matchers.define :have_matching_element do |expected|
@@ -54,86 +41,6 @@ RSpec::Matchers.define :exit_with do |expected|
   end
 end
 
-
-RSpec::Matchers.define :have_printed do |expected|
-
-  case expected
-  when String, Regexp, Proc
-    expected = expected
-  else
-    expected = expected.to_s
-  end
-
-  chain :and_exit_with do |code|
-    @expected_exit_code = code
-  end
-
-  define_method :matches_exit_code? do |actual|
-    @expected_exit_code.nil? || @expected_exit_code == actual
-  end
-
-  define_method :matches_output? do |actual|
-    return false unless actual
-    case expected
-      when String
-        actual.include?(expected)
-      when Regexp
-        expected.match(actual)
-      when Proc
-        expected.call(actual)
-      else
-        raise ArgumentError, "No idea how to match a #{actual.class.name}"
-    end
-  end
-
-  match do |block|
-    $stderr = $stdout = StringIO.new
-    $stdout.set_encoding('UTF-8') if $stdout.respond_to?(:set_encoding)
-
-    begin
-      block.call
-    rescue SystemExit => e
-      raise unless @expected_exit_code
-      @actual_exit_code = e.status
-    ensure
-      $stdout.rewind
-      @actual = $stdout.read
-
-      $stdout = STDOUT
-      $stderr = STDERR
-    end
-
-    matches_output?(@actual) && matches_exit_code?(@actual_exit_code)
-  end
-
-  supports_block_expectations
-
-  failure_message do |actual|
-    if actual.nil? then
-      "expected #{expected.inspect}, but nothing was printed"
-    else
-      if !@expected_exit_code.nil? && matches_output?(actual)
-        "expected exit with code #{@expected_exit_code} but " +
-          (@actual_exit_code.nil? ? " exit was not called" : "exited with #{@actual_exit_code} instead")
-      else
-        "expected #{expected.inspect} to be printed; got:\n#{actual}"
-      end
-    end
-  end
-
-  failure_message_when_negated do |actual|
-    if @expected_exit_code && matches_exit_code?(@actual_exit_code)
-      "expected exit code to not be #{@actual_exit_code}"
-    else
-      "expected #{expected.inspect} to not be printed; got:\n#{actual}"
-    end
-  end
-
-  description do
-    "expect #{expected.inspect} to be printed" + (@expected_exit_code.nil ? '' : " with exit code #{@expected_exit_code}")
-  end
-end
-
 RSpec::Matchers.define :equal_attributes_of do |expected|
   match do |actual|
     actual.instance_variables.all? do |attr|

data/spec/lib/puppet_spec/module_tool/shared_functions.rb

@@ -1,4 +1,4 @@
-require 'json'
+require 'puppet/util/json'
 
 module PuppetSpec
   module ModuleTool
@@ -15,13 +15,13 @@ module PuppetSpec
         moddir = File.join(options[:into], name)
         FileUtils.mkdir_p(moddir)
         File.open(File.join(moddir, 'metadata.json'), 'w') do |file|
-          file.puts(JSON.generate(release.metadata))
+          file.puts(Puppet::Util::Json.dump(release.metadata))
         end
       end
 
       def mark_changed(path)
         app = Puppet::ModuleTool::Applications::Checksummer
-        app.stubs(:run).with(path).returns(['README'])
+        allow(app).to receive(:run).with(path).and_return(['README'])
       end
 
       def graph_should_include(name, options)