puppet 5.3.4 → 6.29.0

data/spec/unit/forge/module_release_spec.rb

@@ -3,8 +3,11 @@ require 'spec_helper'
 require 'puppet/forge'
 require 'net/http'
 require 'puppet/module_tool'
+require 'puppet_spec/files'
 
 describe Puppet::Forge::ModuleRelease do
+  include PuppetSpec::Files
+
   let(:agent) { "Test/1.0" }
   let(:repository) { Puppet::Forge::Repository.new('http://fake.com', agent) }
   let(:ssl_repository) { Puppet::Forge::Repository.new('https://fake.com', agent) }
@@ -15,76 +18,52 @@ describe Puppet::Forge::ModuleRelease do
   let(:module_full_name) { "#{module_author}-#{module_name}" }
   let(:module_full_name_versioned) { "#{module_full_name}-#{module_version}" }
   let(:module_md5) { "bbf919d7ee9d278d2facf39c25578bf8" }
+  let(:module_sha256) { "b4c6f15cec64a9fe16ef0d291e2598fc84f381bc59f0e67198d61706fafedae4" }
   let(:uri) { " "}
   let(:release) { Puppet::Forge::ModuleRelease.new(ssl_repository, JSON.parse(release_json)) }
 
-  let(:mock_file) {
-    mock_io = StringIO.new
-    mock_io.stubs(:path).returns('/dev/null')
-    mock_io
-  }
+  let(:mock_file) { double('file', path: '/dev/null') }
+  let(:mock_dir) { tmpdir('dir') }
 
-  let(:mock_dir) { '/tmp' }
+  let(:destination) { tmpfile('forge_module_release') }
 
   shared_examples 'a module release' do
     def mock_digest_file_with_md5(md5)
-      Digest::MD5.stubs(:file).returns(stub(:hexdigest => md5))
-    end
-
-    describe '#prepare' do
-      before :each do
-        release.stubs(:tmpfile).returns(mock_file)
-        release.stubs(:tmpdir).returns(mock_dir)
-      end
-
-      it 'should call sub methods with correct params' do
-        release.expects(:download).with("/#{api_version}/files/#{module_full_name_versioned}.tar.gz", mock_file)
-        release.expects(:validate_checksum).with(mock_file, module_md5)
-        release.expects(:unpack).with(mock_file, mock_dir)
-
-        release.prepare
-      end
+      allow(Digest::MD5).to receive(:file).and_return(double(:hexdigest => md5))
     end
 
     describe '#tmpfile' do
       it 'should be opened in binary mode' do
-        Puppet::Forge::Cache.stubs(:base_path).returns(Dir.tmpdir)
+        allow(Puppet::Forge::Cache).to receive(:base_path).and_return(Dir.tmpdir)
         expect(release.send(:tmpfile).binmode?).to be_truthy
       end
     end
 
     describe '#download' do
-      it 'should call make_http_request with correct params' do
-        # valid URI comes from file_uri in JSON blob above
-        ssl_repository.expects(:make_http_request).with("/#{api_version}/files/#{module_full_name_versioned}.tar.gz", mock_file).returns(stub(:body => '{}', :code => '200'))
+      it 'should download a file' do
+        stub_request(:get, "https://fake.com/#{api_version}/files/#{module_full_name_versioned}.tar.gz").to_return(status: 200, body: '{}')
 
-        release.send(:download, "/#{api_version}/files/#{module_full_name_versioned}.tar.gz", mock_file)
-      end
+        File.open(destination, 'wb') do |fh|
+          release.send(:download, "/#{api_version}/files/#{module_full_name_versioned}.tar.gz", fh)
+        end
 
-      it 'should raise a response error when it receives an error from forge' do
-        ssl_repository.stubs(:make_http_request).returns(stub(:body => '{"errors": ["error"]}', :code => '500', :message => 'server error'))
-        expect { release.send(:download, "/some/path", mock_file)}. to raise_error Puppet::Forge::Errors::ResponseError
+        expect(File.read(destination)).to eq("{}")
       end
-    end
 
-    describe '#verify_checksum' do
-      it 'passes md5 check when valid' do
-        # valid hash comes from file_md5 in JSON blob above
-        mock_digest_file_with_md5(module_md5)
-
-        release.send(:validate_checksum, mock_file, module_md5)
-      end
-
-      it 'fails md5 check when invalid' do
-        mock_digest_file_with_md5('ffffffffffffffffffffffffffffffff')
-
-        expect { release.send(:validate_checksum, mock_file, module_md5) }.to raise_error(RuntimeError, /did not match expected checksum/)
+      it 'should raise a response error when it receives an error from forge' do
+        stub_request(:get, "https://fake.com/some/path").to_return(
+          status: [500, 'server error'],
+          body: '{"error":"invalid module"}'
+        )
+        expect {
+          release.send(:download, "/some/path", StringIO.new)
+        }.to raise_error Puppet::Forge::Errors::ResponseError
       end
     end
 
     describe '#unpack' do
       it 'should call unpacker with correct params' do
-        Puppet::ModuleTool::Applications::Unpacker.expects(:unpack).with(mock_file.path, mock_dir).returns(true)
+        expect(Puppet::ModuleTool::Applications::Unpacker).to receive(:unpack).with(mock_file.path, mock_dir).and_return(true)
 
         release.send(:unpack, mock_file, mock_dir)
       end
@@ -111,7 +90,7 @@ describe Puppet::Forge::ModuleRelease do
         "checksums": { },
         "version": "#{module_version}",
         "description": "Standard Library for Puppet Modules",
-        "source": "git://github.com/puppetlabs/puppetlabs-stdlib.git",
+        "source": "https://github.com/puppetlabs/puppetlabs-stdlib",
         "project_page": "https://github.com/puppetlabs/puppetlabs-stdlib",
         "summary": "Puppet Module Standard Library",
         "dependencies": [
@@ -130,6 +109,7 @@ describe Puppet::Forge::ModuleRelease do
       "file_uri": "/#{api_version}/files/#{module_full_name_versioned}.tar.gz",
       "file_size": 67586,
       "file_md5": "#{module_md5}",
+      "file_sha256": "#{module_sha256}",
       "downloads": 610751,
       "readme": "",
       "changelog": "",
@@ -142,6 +122,66 @@ describe Puppet::Forge::ModuleRelease do
     end
 
     it_behaves_like 'a module release'
+
+    context 'when verifying checksums' do
+      let(:json) { JSON.parse(release_json) }
+
+      def mock_release(json)
+        release = Puppet::Forge::ModuleRelease.new(ssl_repository, json)
+        allow(release).to receive(:tmpfile).and_return(mock_file)
+        allow(release).to receive(:tmpdir).and_return(mock_dir)
+        allow(release).to receive(:download).with("/#{api_version}/files/#{module_full_name_versioned}.tar.gz", mock_file)
+        allow(release).to receive(:unpack)
+        release
+      end
+
+      it 'verifies using SHA256' do
+        expect(Digest::SHA256).to receive(:file).and_return(double(:hexdigest => module_sha256))
+
+        release = mock_release(json)
+        release.prepare
+      end
+
+      it 'rejects an invalid release with SHA256' do
+        expect(Digest::SHA256).to receive(:file).and_return(double(:hexdigest => 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'))
+
+        release = mock_release(json)
+        expect {
+          release.prepare
+        }.to raise_error(RuntimeError, /did not match expected checksum/)
+      end
+
+      context 'when `file_sha256` is missing' do
+        before(:each) do
+          json.delete('file_sha256')
+        end
+
+        it 'verifies using MD5 if `file_sha256` is missing' do
+          expect(Digest::MD5).to receive(:file).and_return(double(:hexdigest => module_md5))
+
+          release = mock_release(json)
+          release.prepare
+        end
+
+        it 'rejects an invalid release with MD5' do
+          expect(Digest::MD5).to receive(:file).and_return(double(:hexdigest => 'ffffffffffffffffffffffffffffffff'))
+
+          release = mock_release(json)
+          expect {
+            release.prepare
+          }.to raise_error(RuntimeError, /did not match expected checksum/)
+        end
+
+        it 'raises if FIPS is enabled' do
+          allow(Facter).to receive(:value).with(:fips_enabled).and_return(true)
+
+          release = mock_release(json)
+          expect {
+            release.prepare
+          }.to raise_error(/Module install using MD5 is prohibited in FIPS mode./)
+        end
+      end
+    end
   end
 
   context 'forge module with no dependencies field' do
@@ -164,7 +204,7 @@ describe Puppet::Forge::ModuleRelease do
         "checksums": { },
         "version": "#{module_version}",
         "description": "Standard Library for Puppet Modules",
-        "source": "git://github.com/puppetlabs/puppetlabs-stdlib.git",
+        "source": "https://github.com/puppetlabs/puppetlabs-stdlib",
         "project_page": "https://github.com/puppetlabs/puppetlabs-stdlib",
         "summary": "Puppet Module Standard Library",
         "author": "#{module_author}",
@@ -180,6 +220,7 @@ describe Puppet::Forge::ModuleRelease do
       "file_uri": "/#{api_version}/files/#{module_full_name_versioned}.tar.gz",
       "file_size": 67586,
       "file_md5": "#{module_md5}",
+      "file_sha256": "#{module_sha256}",
       "downloads": 610751,
       "readme": "",
       "changelog": "",
@@ -208,11 +249,83 @@ describe Puppet::Forge::ModuleRelease do
       },
       "file_uri": "/#{api_version}/files/#{module_full_name_versioned}.tar.gz",
       "file_size": 67586,
-      "file_md5": "#{module_md5}"
+      "file_md5": "#{module_md5}",
+      "file_sha256": "#{module_sha256}"
+    }
+    }
+    end
+
+    it_behaves_like 'a module release'
+  end
+
+  context 'deprecated forge module' do
+    let(:release_json) do %Q{
+    {
+      "uri": "/#{api_version}/releases/#{module_full_name_versioned}",
+      "module": {
+        "uri": "/#{api_version}/modules/#{module_full_name}",
+        "name": "#{module_name}",
+        "deprecated_at": "2017-10-10 10:21:32 -0700",
+        "owner": {
+          "uri": "/#{api_version}/users/#{module_author}",
+          "username": "#{module_author}",
+          "gravatar_id": "fdd009b7c1ec96e088b389f773e87aec"
+        }
+      },
+      "version": "#{module_version}",
+      "metadata": {
+        "types": [ ],
+        "license": "Apache 2.0",
+        "checksums": { },
+        "version": "#{module_version}",
+        "description": "Standard Library for Puppet Modules",
+        "source": "https://github.com/puppetlabs/puppetlabs-stdlib",
+        "project_page": "https://github.com/puppetlabs/puppetlabs-stdlib",
+        "summary": "Puppet Module Standard Library",
+        "dependencies": [
+
+        ],
+        "author": "#{module_author}",
+        "name": "#{module_full_name}"
+      },
+      "tags": [
+        "puppetlabs",
+        "library",
+        "stdlib",
+        "standard",
+        "stages"
+      ],
+      "file_uri": "/#{api_version}/files/#{module_full_name_versioned}.tar.gz",
+      "file_size": 67586,
+      "file_md5": "#{module_md5}",
+      "file_sha256": "#{module_sha256}",
+      "downloads": 610751,
+      "readme": "",
+      "changelog": "",
+      "license": "",
+      "created_at": "2013-05-13 08:31:19 -0700",
+      "updated_at": "2013-05-13 08:31:19 -0700",
+      "deleted_at": null
     }
     }
     end
 
     it_behaves_like 'a module release'
+
+    describe '#prepare' do
+      before :each do
+        allow(release).to receive(:tmpfile).and_return(mock_file)
+        allow(release).to receive(:tmpdir).and_return(mock_dir)
+        allow(release).to receive(:download)
+        allow(release).to receive(:validate_checksum)
+        allow(release).to receive(:unpack)
+      end
+
+      it 'should emit warning about module deprecation' do
+        expect(Puppet).to receive(:warning).with(/#{Regexp.escape(module_full_name)}.*deprecated/i)
+
+        release.prepare
+      end
+    end
   end
 end

data/spec/unit/forge/repository_spec.rb

@@ -13,11 +13,10 @@ describe Puppet::Forge::Repository do
   end
   let(:agent) { "Test/1.0" }
   let(:repository) { Puppet::Forge::Repository.new('http://fake.com', agent) }
-  let(:ssl_repository) { Puppet::Forge::Repository.new('https://fake.com', agent) }
 
   it "retrieve accesses the cache" do
     path = '/module/foo.tar.gz'
-    repository.cache.expects(:retrieve)
+    expect(repository.cache).to receive(:retrieve)
 
     repository.retrieve(path)
   end
@@ -28,224 +27,128 @@ describe Puppet::Forge::Repository do
     uri  = [ host, path ].join('')
 
     repository = Puppet::Forge::Repository.new(host, agent)
-    repository.cache.expects(:retrieve).with(uri)
+    expect(repository.cache).to receive(:retrieve).with(uri)
 
     repository.retrieve(path)
   end
 
   describe "making a request" do
-    before :each do
-      proxy_settings_of("proxy", 1234)
-    end
+    let(:uri) { "http://fake.com/the_path" }
 
-    it "returns the result object from the request" do
-      result = "#{Object.new}"
+    it "returns the response object from the request" do
+      stub_request(:get, uri)
 
-      performs_an_http_request result do |http|
-        http.expects(:request).with(responds_with(:path, "the_path"))
-      end
+      expect(repository.make_http_request("/the_path")).to be_a_kind_of(Puppet::HTTP::Response)
+    end
 
-      expect(repository.make_http_request("the_path")).to eq(result)
+    it "requires path to have a leading slash" do
+      expect {
+        repository.make_http_request("the_path")
+      }.to raise_error(ArgumentError, 'Path must start with forward slash')
     end
 
     it "merges forge URI and path specified" do
-      result = "#{Object.new}"
-
-      performs_an_http_request result do |http|
-        http.expects(:request).with(responds_with(:path, "/test/the_path/"))
-      end
+      stub_request(:get, "http://fake.com/test/the_path/")
 
       repository = Puppet::Forge::Repository.new('http://fake.com/test', agent)
-      expect(repository.make_http_request("/the_path/")).to eq(result)
+      repository.make_http_request("/the_path/")
     end
 
     it "handles trailing slashes when merging URI and path" do
-      result = "#{Object.new}"
-
-      performs_an_http_request result do |http|
-        http.expects(:request).with(responds_with(:path, "/test/the_path"))
-      end
+      stub_request(:get, "http://fake.com/test/the_path")
 
       repository = Puppet::Forge::Repository.new('http://fake.com/test/', agent)
-      expect(repository.make_http_request("/the_path")).to eq(result)
-    end
-
-    it 'returns the result object from a request with ssl' do
-      result = "#{Object.new}"
-      performs_an_https_request result do |http|
-        http.expects(:request).with(responds_with(:path, "the_path"))
-      end
-
-      expect(ssl_repository.make_http_request("the_path")).to eq(result)
-    end
-
-    it 'return a valid exception when there is an SSL verification problem' do
-      performs_an_https_request "#{Object.new}" do |http|
-        http.expects(:request).with(responds_with(:path, "the_path")).raises OpenSSL::SSL::SSLError.new("certificate verify failed")
-      end
-
-      expect { ssl_repository.make_http_request("the_path") }.to raise_error Puppet::Forge::Errors::SSLVerifyError, 'Unable to verify the SSL certificate at https://fake.com'
+      repository.make_http_request("/the_path")
     end
 
     it 'return a valid exception when there is a communication problem' do
-      performs_an_http_request "#{Object.new}" do |http|
-        http.expects(:request).with(responds_with(:path, "the_path")).raises SocketError
-      end
+      stub_request(:get, uri).to_raise(SocketError.new('getaddrinfo: Name or service not known'))
 
-      expect { repository.make_http_request("the_path") }.
-        to raise_error Puppet::Forge::Errors::CommunicationError,
-        'Unable to connect to the server at http://fake.com. Detail: SocketError.'
+      expect {
+        repository.make_http_request("/the_path")
+      }.to raise_error(Puppet::Forge::Errors::CommunicationError,
+                       %r{Unable to connect to the server at http://fake.com. Detail: Request to http://fake.com/the_path failed after .* seconds: getaddrinfo: Name or service not known.})
     end
 
     it "sets the user agent for the request" do
-      path = 'the_path'
-
-      request = repository.get_request_object(path)
+      stub_request(:get, uri).with do |request|
+        expect(request.headers['User-Agent']).to match(/#{agent} #{Regexp.escape(Puppet[:http_user_agent])}/)
+      end
 
-      expect(request['User-Agent']).to match(/\b#{agent}\b/)
-      expect(request['User-Agent']).to match(/\bPuppet\b/)
-      expect(request['User-Agent']).to match(/\bRuby\b/)
+      repository.make_http_request("/the_path")
     end
 
-    it "Does not set Authorization header by default" do
-      Puppet.features.stubs(:pe_license?).returns(false)
+    it "does not set Authorization header by default" do
+      allow(Puppet.features).to receive(:pe_license?).and_return(false)
       Puppet[:forge_authorization] = nil
-      request = repository.get_request_object("the_path")
-      expect(request['Authorization']).to eq(nil)
-    end
 
-    it "Sets Authorization header from config" do
-      token = 'bearer some token'
-      Puppet[:forge_authorization] = token
-      request = repository.get_request_object("the_path")
-      expect(request['Authorization']).to eq(token)
-    end
-
-    it "encodes the received URI" do
-      unescaped_uri = "héllo world !! ç à"
-      performs_an_http_request do |http|
-        http.expects(:request).with(responds_with(:path, Puppet::Util.uri_encode(unescaped_uri)))
+      stub_request(:get, uri).with do |request|
+        expect(request.headers).to_not include('Authorization')
       end
 
-      repository.make_http_request(unescaped_uri)
+      repository.make_http_request("/the_path")
     end
 
-    def performs_an_http_request(result = nil, &block)
-      proxy_args = ["proxy", 1234, nil, nil]
-      mock_proxy(80, proxy_args, result, &block)
-    end
-
-    def performs_an_https_request(result = nil, &block)
-      proxy_args = ["proxy", 1234, nil, nil]
-      proxy = mock_proxy(443, proxy_args, result, &block)
-      proxy.expects(:use_ssl=).with(true)
-      proxy.expects(:cert_store=)
-      proxy.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
-    end
+    it "sets Authorization header from config" do
+      token = 'bearer some token'
+      Puppet[:forge_authorization] = token
 
-  end
+      stub_request(:get, uri).with(headers: {'Authorization' => token})
 
-  describe "making a request against an authentiated proxy" do
-    before :each do
-      authenticated_proxy_settings_of("proxy", 1234, 'user1', 'password')
+      repository.make_http_request("/the_path")
     end
 
-    it "returns the result object from the request" do
-      result = "#{Object.new}"
+    it "sets Authorization header from PE license" do
+      allow(Puppet.features).to receive(:pe_license?).and_return(true)
+      stub_const("PELicense", double(load_license_key: double(authorization_token: "opensesame")))
 
-      performs_an_authenticated_http_request result do |http|
-        http.expects(:request).with(responds_with(:path, "the_path"))
-      end
+      stub_request(:get, uri).with(headers: {'Authorization' => "opensesame"})
 
-      expect(repository.make_http_request("the_path")).to eq(result)
+      repository.make_http_request("/the_path")
     end
 
-    it 'returns the result object from a request with ssl' do
-      result = "#{Object.new}"
-      performs_an_authenticated_https_request result do |http|
-        http.expects(:request).with(responds_with(:path, "the_path"))
-      end
+    it "sets basic authentication if there isn't forge authorization or PE license" do
+      stub_request(:get, uri).with(basic_auth: ['user1', 'password'])
 
-      expect(ssl_repository.make_http_request("the_path")).to eq(result)
+      repository = Puppet::Forge::Repository.new('http://user1:password@fake.com', agent)
+      repository.make_http_request("/the_path")
     end
 
-    it 'return a valid exception when there is an SSL verification problem' do
-      performs_an_authenticated_https_request "#{Object.new}" do |http|
-        http.expects(:request).with(responds_with(:path, "the_path")).raises OpenSSL::SSL::SSLError.new("certificate verify failed")
-      end
+    it "omits basic authentication if there is a forge authorization" do
+      token = 'bearer some token'
+      Puppet[:forge_authorization] = token
+      stub_request(:get, uri).with(headers: {'Authorization' => token})
 
-      expect { ssl_repository.make_http_request("the_path") }.to raise_error Puppet::Forge::Errors::SSLVerifyError, 'Unable to verify the SSL certificate at https://fake.com'
+      repository = Puppet::Forge::Repository.new('http://user1:password@fake.com', agent)
+      repository.make_http_request("/the_path")
     end
 
-    it 'return a valid exception when there is a communication problem' do
-      performs_an_authenticated_http_request "#{Object.new}" do |http|
-        http.expects(:request).with(responds_with(:path, "the_path")).raises SocketError
-      end
+    it "encodes the URI path" do
+      stub_request(:get, "http://fake.com/h%C3%A9llo%20world%20!!%20%C3%A7%20%C3%A0")
 
-      expect { repository.make_http_request("the_path") }.
-        to raise_error Puppet::Forge::Errors::CommunicationError,
-        'Unable to connect to the server at http://fake.com. Detail: SocketError.'
+      repository.make_http_request("/héllo world !! ç à")
     end
 
-    it "sets the user agent for the request" do
-      path = 'the_path'
+    it "connects via proxy" do
+      Puppet[:http_proxy_host] = 'proxy'
+      Puppet[:http_proxy_port] = 1234
 
-      request = repository.get_request_object(path)
+      stub_request(:get, uri)
+      expect(Net::HTTP).to receive(:new).with(anything, anything, 'proxy', 1234, nil, nil).and_call_original
 
-      expect(request['User-Agent']).to match(/\b#{agent}\b/)
-      expect(request['User-Agent']).to match(/\bPuppet\b/)
-      expect(request['User-Agent']).to match(/\bRuby\b/)
+      repository.make_http_request("/the_path")
     end
 
-    it "encodes the received URI" do
-      unescaped_uri = "héllo world !! ç à"
-      performs_an_authenticated_http_request do |http|
-        http.expects(:request).with(responds_with(:path, Puppet::Util.uri_encode(unescaped_uri)))
-      end
+    it "connects via authenticating proxy" do
+      Puppet[:http_proxy_host] = 'proxy'
+      Puppet[:http_proxy_port] = 1234
+      Puppet[:http_proxy_user] = 'user1'
+      Puppet[:http_proxy_password] = 'password'
 
-      repository.make_http_request(unescaped_uri)
-    end
+      stub_request(:get, uri)
+      expect(Net::HTTP).to receive(:new).with(anything, anything, 'proxy', 1234, "user1", "password").and_call_original
 
-    def performs_an_authenticated_http_request(result = nil, &block)
-      proxy_args = ["proxy", 1234, 'user1', 'password']
-      mock_proxy(80, proxy_args, result, &block)
+      repository.make_http_request("/the_path")
     end
-
-    def performs_an_authenticated_https_request(result = nil, &block)
-      proxy_args = ["proxy", 1234, 'user1', 'password']
-      proxy = mock_proxy(443, proxy_args, result, &block)
-      proxy.expects(:use_ssl=).with(true)
-      proxy.expects(:cert_store=)
-      proxy.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
-    end
-  end
-
-  def proxy_settings_of(host, port)
-    Puppet[:http_proxy_host] = host
-    Puppet[:http_proxy_port] = port
-  end
-
-  def authenticated_proxy_settings_of(host, port, user, password)
-    Puppet[:http_proxy_host] = host
-    Puppet[:http_proxy_port] = port
-    Puppet[:http_proxy_user] = user
-    Puppet[:http_proxy_password] = password
-  end
-
-  def mock_proxy(port, proxy_args, result, &block)
-    http = mock("http client")
-    proxy = mock("http proxy")
-    proxy_class = mock("http proxy class")
-
-    Net::HTTP.expects(:Proxy).with(*proxy_args).returns(proxy_class)
-    proxy_class.expects(:new).with("fake.com", port).returns(proxy)
-
-    proxy.expects(:open_timeout=)
-    proxy.expects(:read_timeout=)
-
-    proxy.expects(:start).yields(http).returns(result)
-    yield http
-
-    proxy
   end
 end