puppet 5.3.4 → 6.29.0

data/spec/integration/provider/ssh_authorized_key_spec.rb

@@ -1,219 +0,0 @@
-#! /usr/bin/env ruby
-
-require 'spec_helper'
-require 'puppet/file_bucket/dipper'
-
-describe Puppet::Type.type(:ssh_authorized_key).provider(:parsed), '(integration)', :unless => Puppet.features.microsoft_windows? do
-  include PuppetSpec::Files
-
-  let :fake_userfile do
-    tmpfile('authorized_keys.user')
-  end
-
-  let :fake_rootfile do
-    tmpfile('authorized_keys.root')
-  end
-
-  let :sample_rsa_keys do
-    [
-      'AAAAB3NzaC1yc2EAAAADAQABAAAAgQCi18JBZOq10X3w4f67nVhO0O3s5Y1vHH4UgMSM3ZnQwbC5hjGyYSi9UULOoQQoQynI/a0I9NL423/Xk/XJVIKCHcS8q6V2Wmjd+fLNelOjxxoW6mbIytEt9rDvwgq3Mof3/m21L3t2byvegR00a+ikKbmInPmKwjeWZpexCIsHzQ==', # 1024 bit
-      'AAAAB3NzaC1yc2EAAAADAQABAAAAgQDLClyvi3CsJw5Id6khZs2/+s11qOH4Gdp6iDioDsrIp0m8kSiPr71VGyQYAfPzzvHemHS7Xg0NkG1Kc8u9tRqBQfTvz7ubq0AT/g01+4P2hQ/soFkuwlUG/HVnnaYb6N0Qp5SHWvD5vBE2nFFQVpP5GrSctPtHSjzJq/i+6LYhmQ==', # 1024 bit
-      'AAAAB3NzaC1yc2EAAAADAQABAAABAQDLygAO6txXkh9FNV8xSsBkATeqLbHzS7sFjGI3gt0Dx6q3LjyKwbhQ1RLf28kd5G6VWiXmClU/RtiPdUz8nrGuun++2mrxzrXrvpR9dq1lygLQ2wn2cI35dN5bjRMtXy3decs6HUhFo9MoNwX250rUWfdCyNPhGIp6OOfmjdy+UeLGNxq9wDx6i4bT5tVVSqVRtsEfw9+ICXchzl85QudjneVVpP+thriPZXfXA5eaGwAo/dmoKOIhUwF96gpdLqzNtrGQuxPbV80PTbGv9ZtAtTictxaDz8muXO7he9pXmchUpxUKtMFjHkL0FAZ9tRPmv3RA30sEr2fZ8+LKvnE50w0' #2048 Bit
-    ]
-  end
-
-  let :sample_dsa_keys do
-    [
-      'AAAAB3NzaC1kc3MAAACBAOPck2O8MIDSqxPSnvENt6tzRrKJ5oOhB6Nc6oEcWm+VEH1gvuxdiRqwoMgRwyEf1yUd+UAcLw3a6Jn+EtFyEBN/5WF+4Tt4xTxZ0Pfik2Wc5uqHbQ2dkmOoXiAOYPiD3JUQ1Xwm/J0CgetjitoLfzAGdCNhMqguqAuHcVJ78ZZbAAAAFQCIBKFYZ+I18I+dtgteirXh+VVEEwAAAIEAs1yvQ/wnLLrRCM660pF4kBiw3D6dJfMdCXWQpn0hZmkBQSIzZv4Wuk3giei5luxscDxNc+y3CTXtnyG4Kt1Yi2sOdvhRI3rX8tD+ejn8GHazM05l5VIo9uu4AQPIE32iV63IqgApSBbJ6vDJW91oDH0J492WdLCar4BS/KE3cRwAAACBAN0uSDyJqYLRsfYcFn4HyVf6TJxQm1IcwEt6GcJVzgjri9VtW7FqY5iBqa9B9Zdh5XXAYJ0XLsWQCcrmMHM2XGHGpA4gL9VlCJ/0QvOcXxD2uK7IXwAVUA7g4V4bw8EVnFv2Flufozhsp+4soo1xiYc5jiFVHwVlk21sMhAtKAeF' # 1024 Bit
-    ]
-  end
-
-  let :sample_lines do
-    [
-      "ssh-rsa #{sample_rsa_keys[1]} root@someotherhost",
-      "ssh-dss #{sample_dsa_keys[0]} root@anywhere",
-      "ssh-rsa #{sample_rsa_keys[2]} paul",
-      "ssh-rsa #{sample_rsa_keys[2]} dummy"
-    ]
-  end
-
-  let :dummy do
-    Puppet::Type.type(:ssh_authorized_key).new(
-      :name   => 'dummy',
-      :target => fake_userfile,
-      :user   => 'nobody',
-      :ensure => :absent
-    )
-  end
-
-  before :each do
-    File.stubs(:chown)
-    File.stubs(:chmod)
-    Puppet::Util::SUIDManager.stubs(:asuser).yields
-  end
-
-  after :each do
-    described_class.clear # Work around bug #6628
-  end
-
-  def create_fake_key(username, content)
-    filename = (username == :root ? fake_rootfile : fake_userfile )
-    File.open(filename, 'w') do |f|
-      content.each do |line|
-        f.puts line
-      end
-    end
-  end
-
-  def check_fake_key(username, expected_content)
-    filename = (username == :root ? fake_rootfile : fake_userfile )
-    content = File.readlines(filename).map(&:chomp).sort.reject{ |x| x =~ /^# HEADER:/ }
-    expect(content.join("\n")).to eq(expected_content.sort.join("\n"))
-  end
-
-  def run_in_catalog(*resources)
-    Puppet::FileBucket::Dipper.any_instance.stubs(:backup) # Don't backup to the filebucket
-    catalog = Puppet::Resource::Catalog.new
-    catalog.host_config = false
-    resources.each do |resource|
-      resource.expects(:err).never
-      catalog.add_resource(resource)
-    end
-    catalog.apply
-  end
-
-  it "should not complain about empty lines and comments" do
-    described_class.expects(:flush).never
-    sample = ['',sample_lines[0],'   ',sample_lines[1],'# just a comment','#and another']
-    create_fake_key(:user,sample)
-    run_in_catalog(dummy)
-    check_fake_key(:user, sample)
-  end
-
-  it "should keep empty lines and comments when modifying a file" do
-    create_fake_key(:user, ['',sample_lines[0],'   ',sample_lines[3],'# just a comment','#and another'])
-    run_in_catalog(dummy)
-    check_fake_key(:user, ['',sample_lines[0],'   ','# just a comment','#and another'])
-  end
-
-  describe "when managing one resource" do
-
-    describe "with ensure set to absent" do
-      let :resource do
-        Puppet::Type.type(:ssh_authorized_key).new(
-          :name     => 'root@hostname',
-          :type     => :rsa,
-          :key      => sample_rsa_keys[0],
-          :target   => fake_rootfile,
-          :user     => 'root',
-          :ensure   => :absent
-        )
-      end
-
-      it "should not modify root's keyfile if resource is currently not present" do
-        create_fake_key(:root, sample_lines)
-        run_in_catalog(resource)
-        check_fake_key(:root, sample_lines)
-      end
-
-      it "remove the key from root's keyfile if resource is currently present" do
-        create_fake_key(:root, sample_lines + ["ssh-rsa #{sample_rsa_keys[0]} root@hostname"])
-        run_in_catalog(resource)
-        check_fake_key(:root, sample_lines)
-      end
-    end
-
-    describe "when ensure is present" do
-      let :resource do
-        Puppet::Type.type(:ssh_authorized_key).new(
-          :name     => 'root@hostname',
-          :type     => :rsa,
-          :key      => sample_rsa_keys[0],
-          :target   => fake_rootfile,
-          :user     => 'root',
-          :ensure   => :present
-        )
-      end
-
-      # just a dummy so the parsedfile provider is aware
-      # of the user's authorized_keys file
-
-      it "should add the key if it is not present" do
-        create_fake_key(:root, sample_lines)
-        run_in_catalog(resource)
-        check_fake_key(:root, sample_lines + ["ssh-rsa #{sample_rsa_keys[0]} root@hostname" ])
-      end
-
-      it "should modify the type if type is out of sync" do
-        create_fake_key(:root,sample_lines + [ "ssh-dss #{sample_rsa_keys[0]} root@hostname" ])
-        run_in_catalog(resource)
-        check_fake_key(:root, sample_lines + [ "ssh-rsa #{sample_rsa_keys[0]} root@hostname" ])
-      end
-
-      it "should modify the key if key is out of sync" do
-        create_fake_key(:root,sample_lines + [ "ssh-rsa #{sample_rsa_keys[1]} root@hostname" ])
-        run_in_catalog(resource)
-        check_fake_key(:root, sample_lines + [ "ssh-rsa #{sample_rsa_keys[0]} root@hostname" ])
-      end
-
-      it "should remove the key from old file if target is out of sync" do
-        create_fake_key(:user, [ sample_lines[0], "ssh-rsa #{sample_rsa_keys[0]} root@hostname" ])
-        create_fake_key(:root, [ sample_lines[1], sample_lines[2] ])
-        run_in_catalog(resource, dummy)
-        check_fake_key(:user, [ sample_lines[0] ])
-        #check_fake_key(:root, [ sample_lines[1], sample_lines[2], "ssh-rsa #{sample_rsa_keys[0]} root@hostname" ])
-      end
-
-      it "should add the key to new file if target is out of sync" do
-        create_fake_key(:user, [ sample_lines[0], "ssh-rsa #{sample_rsa_keys[0]} root@hostname" ])
-        create_fake_key(:root, [ sample_lines[1], sample_lines[2] ])
-        run_in_catalog(resource, dummy)
-        #check_fake_key(:user, [ sample_lines[0] ])
-        check_fake_key(:root, [ sample_lines[1], sample_lines[2], "ssh-rsa #{sample_rsa_keys[0]} root@hostname" ])
-      end
-
-      it "should modify options if options are out of sync" do
-        resource[:options]=[ 'from="*.domain1,host1.domain2"', 'no-port-forwarding', 'no-pty' ]
-        create_fake_key(:root, sample_lines + [ "from=\"*.false,*.false2\",no-port-forwarding,no-pty ssh-rsa #{sample_rsa_keys[0]} root@hostname"])
-        run_in_catalog(resource)
-        check_fake_key(:root, sample_lines + [ "from=\"*.domain1,host1.domain2\",no-port-forwarding,no-pty ssh-rsa #{sample_rsa_keys[0]} root@hostname"] )
-      end
-    end
-  end
-
-  describe "when managing two resource" do
-    let :examples do
-      resources = []
-      resources << Puppet::Type.type(:ssh_authorized_key).new(
-        :name     => 'root@hostname',
-        :type     => :rsa,
-        :key      => sample_rsa_keys[0],
-        :target   => fake_rootfile,
-        :user     => 'root',
-        :ensure   => :present
-      )
-      resources << Puppet::Type.type(:ssh_authorized_key).new(
-        :name   => 'user@hostname',
-        :key    => sample_rsa_keys[1],
-        :type   => :rsa,
-        :target => fake_userfile,
-        :user   => 'nobody',
-        :ensure => :present
-      )
-      resources
-    end
-
-    describe "and both keys are absent" do
-      before :each do
-        create_fake_key(:root, sample_lines)
-        create_fake_key(:user, sample_lines)
-      end
-
-      it "should add both keys" do
-        run_in_catalog(*examples)
-        check_fake_key(:root, sample_lines + [ "ssh-rsa #{sample_rsa_keys[0]} root@hostname" ])
-        check_fake_key(:user, sample_lines + [ "ssh-rsa #{sample_rsa_keys[1]} user@hostname" ])
-      end
-    end
-  end
-end

data/spec/integration/provider/sshkey_spec.rb

@@ -1,159 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'spec_helper'
-require 'puppet/file_bucket/dipper'
-require 'puppet_spec/files'
-require 'puppet_spec/compiler'
-
-describe Puppet::Type.type(:sshkey).provider(:parsed), '(integration)',
-  :unless => Puppet.features.microsoft_windows? do
-  include PuppetSpec::Files
-  include PuppetSpec::Compiler
-
-  before :each do
-    # Don't backup to filebucket
-    Puppet::FileBucket::Dipper.any_instance.stubs(:backup)
-    # We don't want to execute anything
-    described_class.stubs(:filetype).
-      returns Puppet::Util::FileType::FileTypeFlat
-
-    @sshkey_file = tmpfile('sshkey_integration_specs')
-    FileUtils.cp(my_fixture('sample'), @sshkey_file)
-  end
-
-  after :each do
-    # sshkey provider class
-    described_class.clear
-  end
-
-  let(:type_under_test) { 'sshkey' }
-
-  describe "when managing a ssh known hosts file it..." do
-
-    let(:super_unique) { "my.super.unique.host" }
-    it "should create a new known_hosts file with mode 0644" do
-      target   = tmpfile('ssh_known_hosts')
-      manifest = "#{type_under_test} { '#{super_unique}':
-                    ensure => 'present',
-                    type   => 'rsa',
-                    key    => 'TESTKEY',
-                    target => '#{target}' }"
-      apply_with_error_check(manifest)
-      expect_file_mode(target, "644")
-    end
-
-    it "should create an SSH host key entry (ensure present)" do
-      manifest = "#{type_under_test} { '#{super_unique}':
-                    ensure => 'present',
-                    type   => 'rsa',
-                    key    => 'mykey',
-                    target => '#{@sshkey_file}' }"
-      apply_with_error_check(manifest)
-      expect(File.read(@sshkey_file)).to match(/#{super_unique}.*mykey/)
-    end
-
-    let(:sshkey_name) { 'kirby.madstop.com' }
-    it "should delete an entry for an SSH host key" do
-      manifest = "#{type_under_test} { '#{sshkey_name}':
-                    ensure => 'absent',
-                    target => '#{@sshkey_file}' }"
-      apply_with_error_check(manifest)
-      expect(File.read(@sshkey_file)).not_to match(/#{sshkey_name}.*Yqk0=/)
-    end
-
-    it "should update an entry for an SSH host key" do
-      manifest = "#{type_under_test} { '#{sshkey_name}':
-                    ensure => 'present',
-                    type   => 'rsa',
-                    key    => 'mynewshinykey',
-                    target => '#{@sshkey_file}' }"
-      apply_with_error_check(manifest)
-      expect(File.read(@sshkey_file)).to match(/#{sshkey_name}.*mynewshinykey/)
-      expect(File.read(@sshkey_file)).not_to match(/#{sshkey_name}.*Yqk0=/)
-    end
-
-    # test all key types
-    types = ["ssh-dss",     "dsa",
-             "ssh-ed25519", "ed25519",
-             "ssh-rsa",     "rsa",
-             "ecdsa-sha2-nistp256",
-             "ecdsa-sha2-nistp384",
-             "ecdsa-sha2-nistp521"]
-    # these types are treated as aliases for sshkey <ahem> type
-    #   so they are populated as the *values* below
-    aliases = {"dsa"     => "ssh-dss",
-               "ed25519" => "ssh-ed25519",
-               "rsa"     => "ssh-rsa"}
-    types.each do |type|
-      it "should update an entry with #{type} type" do
-        manifest = "#{type_under_test} { '#{sshkey_name}':
-                      ensure => 'present',
-                      type   => '#{type}',
-                      key    => 'mynewshinykey',
-                      target => '#{@sshkey_file}' }"
-
-        apply_with_error_check(manifest)
-        if aliases.has_key?(type)
-          full_type = aliases[type]
-          expect(File.read(@sshkey_file)).
-            to match(/#{sshkey_name}.*#{full_type}.*mynew/)
-        else
-          expect(File.read(@sshkey_file)).
-            to match(/#{sshkey_name}.*#{type}.*mynew/)
-        end
-      end
-    end
-
-    # test unknown key type fails
-    let(:invalid_type) { 'ssh-er0ck' }
-    it "should raise an error with an unknown type" do
-      manifest = "#{type_under_test} { '#{sshkey_name}':
-                    ensure => 'present',
-                    type   => '#{invalid_type}',
-                    key    => 'mynewshinykey',
-                    target => '#{@sshkey_file}' }"
-      expect {
-      apply_compiled_manifest(manifest)
-      }.to raise_error(Puppet::ResourceError, /Invalid value "#{invalid_type}"/)
-    end
-
-    #single host_alias
-    let(:host_alias) { 'r0ckdata.com' }
-    it "should update an entry with new host_alias" do
-      manifest = "#{type_under_test} { '#{sshkey_name}':
-                    ensure       => 'present',
-                    host_aliases => '#{host_alias}',
-                    target       => '#{@sshkey_file}' }"
-      apply_with_error_check(manifest)
-      expect(File.read(@sshkey_file)).to match(/#{sshkey_name},#{host_alias}\s/)
-      expect(File.read(@sshkey_file)).not_to match(/#{sshkey_name}\s/)
-    end
-
-    #array host_alias
-    let(:host_aliases) { "r0ckdata.com,erict.net" }
-    it "should update an entry with new host_alias" do
-      manifest = "#{type_under_test} { '#{sshkey_name}':
-                    ensure       => 'present',
-                    host_aliases => '#{host_alias}',
-                    target       => '#{@sshkey_file}' }"
-      apply_with_error_check(manifest)
-      expect(File.read(@sshkey_file)).to match(/#{sshkey_name},#{host_alias}\s/)
-      expect(File.read(@sshkey_file)).not_to match(/#{sshkey_name}\s/)
-    end
-
-    #puppet resource sshkey
-    it "should fetch an entry from resources" do
-      @resource_app = Puppet::Application[:resource]
-      @resource_app.preinit
-      @resource_app.command_line.stubs(:args).
-        returns([type_under_test, sshkey_name, "target=#{@sshkey_file}"])
-
-      @resource_app.expects(:puts).with do |args|
-        expect(args).to match(/#{sshkey_name}/)
-      end
-      @resource_app.main
-    end
-
-  end
-
-end

data/spec/integration/provider/yumrepo_spec.rb

@@ -1,130 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'spec_helper'
-require 'puppet/file_bucket/dipper'
-require 'puppet_spec/files'
-require 'puppet_spec/compiler'
-
-describe Puppet::Type.type(:yumrepo).provider(:inifile), '(integration)',
-  :unless => Puppet.features.microsoft_windows? do
-  include PuppetSpec::Files
-  include PuppetSpec::Compiler
-
-  before :each do
-    # Don't backup to filebucket
-    Puppet::FileBucket::Dipper.any_instance.stubs(:backup)
-    # We don't want to execute anything
-    described_class.stubs(:filetype).
-      returns Puppet::Util::FileType::FileTypeFlat
-
-    @yumrepo_dir  = tmpdir('yumrepo_integration_specs')
-    @yumrepo_file = tmpfile('yumrepo_file', @yumrepo_dir)
-    @yumrepo_conf_file = tmpfile('yumrepo_conf_file', @yumrepo_dir)
-    # this mocks the reposdir logic in the provider and thus won't test for
-    # issues like PUP-2916. Cover these types of issues in acceptance
-    described_class.stubs(:reposdir).returns [@yumrepo_dir]
-    described_class.stubs(:repofiles).returns [@yumrepo_conf_file]
-  end
-
-  after :each do
-    # yumrepo provider class
-    described_class.clear
-  end
-
-  let(:type_under_test) { :yumrepo }
-
-  describe 'when managing a yumrepo file it...' do
-    let(:super_creative) { 'my.super.creati.ve' }
-    let(:manifest) {
-      "#{type_under_test} { '#{super_creative}':
-                    baseurl => 'http://#{super_creative}',
-                    target  => '#{@yumrepo_file}' }"
-    }
-    let(:expected_match) { "\[#{super_creative}\]\nbaseurl=http:\/\/my\.super\.creati\.ve" }
-
-    it 'should create a new yumrepo file with mode 0644 and yumrepo entry' do
-      apply_with_error_check(manifest)
-      expect_file_mode(File.join(@yumrepo_dir, super_creative + '.repo'), "644")
-      expect(File.read(File.join(@yumrepo_dir, super_creative + '.repo'))).
-        to match(expected_match + "\n")
-    end
-
-    it 'should remove a managed yumrepo entry' do
-      apply_with_error_check(manifest)
-      manifest = "#{type_under_test} { '#{super_creative}':
-                    ensure => absent,
-                    target  => '#{@yumrepo_file}' }"
-      apply_with_error_check(manifest)
-      expect(File.read(File.join(@yumrepo_dir, super_creative + '.repo'))).
-        to be_empty
-    end
-
-    it 'should update a managed yumrepo entry' do
-      apply_with_error_check(manifest)
-      manifest = "#{type_under_test} { '#{super_creative}':
-                    baseurl => 'http://#{super_creative}.updated',
-                    target  => '#{@yumrepo_file}' }"
-      apply_with_error_check(manifest)
-      expect(File.read(File.join(@yumrepo_dir, super_creative + '.repo'))).
-        to match(expected_match + ".updated\n")
-    end
-
-    it 'should create all properties of a yumrepo entry' do
-      manifest = "#{type_under_test} { '#{super_creative}':
-                    baseurl => 'http://#{super_creative}',
-                    target  => '#{@yumrepo_file}' }"
-      apply_with_error_check(manifest)
-      expect(File.read(File.join(@yumrepo_dir, super_creative + '.repo'))).
-        to match("\[#{super_creative}\]")
-    end
-
-    # The unit-tests cover all properties
-    #   and we have to hard-code the "should" values here.
-    # Puppet::Type.type(:yumrepo).validproperties contains the full list
-    #   but we can't get the property "should" values from the yumrepo-type
-    #   without having an instance of type, which is what yumrepo defines...
-    #   Just cover the most probable used properties.
-    properties = {"bandwidth"      => "42M",
-                  "baseurl"        => "http://er0ck",
-                  "cost"           => "42",
-                  "enabled"        => "yes",
-                  "exclude"        => "er0ckSet2.0",
-                  "failovermethod" => "roundrobin",
-                  "include"        => "https://er0ck",
-                  "mirrorlist"     => "https://er0ckMirr0r.co",
-                  "priority"       => "99",
-                  "retries"        => "413189",
-                  "timeout"        => "666"
-    }
-
-    it "should create an entry with various properties" do
-      manifest = "#{type_under_test} { '#{super_creative}':
-                          target  => '#{@yumrepo_file}',\n"
-      properties.each do |property_key, property_value|
-        manifest << "#{property_key} => '#{property_value}',\n"
-      end
-      manifest << "}"
-      apply_with_error_check(manifest)
-      file_lines = File.read(File.join(@yumrepo_dir, super_creative + '.repo'))
-      properties.each do |property_key, property_value|
-        if property_value =~ /^(true|false|no|yes)$/
-          property_value = property_value.capitalize
-        end
-        expect(file_lines).to match(/^#{property_key}=#{Regexp.escape(property_value)}$/)
-      end
-    end
-
-    ##puppet resource yumrepo
-    it "should fetch the yumrepo entries from resource face" do
-      @resource_app = Puppet::Application[:resource]
-      @resource_app.preinit
-      @resource_app.command_line.stubs(:args).
-        returns([type_under_test, super_creative])
-
-      @resource_app.expects(:puts).with  do |args|
-        expect(args).to match(/#{super_creative}/)
-      end
-      @resource_app.main
-    end
-  end
-end

data/spec/integration/reference/providers_spec.rb

@@ -1,16 +0,0 @@
-#! /usr/bin/env ruby
-require 'spec_helper'
-
-require 'puppet/util/reference'
-
-reference = Puppet::Util::Reference.reference(:providers)
-
-describe reference do
-  it "should exist" do
-    expect(reference).not_to be_nil
-  end
-
-  it "should be able to be rendered as markdown" do
-    reference.to_markdown
-  end
-end

data/spec/integration/reports_spec.rb

@@ -1,14 +0,0 @@
-#! /usr/bin/env ruby
-require 'spec_helper'
-
-require 'puppet/reports'
-
-describe Puppet::Reports, " when using report types" do
-  before do
-    Puppet.settings.stubs(:use)
-  end
-
-  it "should load report types as modules" do
-    expect(Puppet::Reports.report(:store)).to be_instance_of(Module)
-  end
-end

data/spec/integration/ssl/autosign_spec.rb

@@ -1,145 +0,0 @@
-require 'spec_helper'
-
-describe "autosigning" do
-  include PuppetSpec::Files
-
-  let(:puppet_dir) { tmpdir("ca_autosigning") }
-  let(:utf8_value) { "utf8_\u06FF\u16A0\u{2070E}" }
-  let(:utf8_value_binary_string) { utf8_value.force_encoding(Encoding::BINARY) }
-  let(:csr_attributes_content) do
-    {
-      'custom_attributes' => {
-        '1.3.6.1.4.1.34380.2.0' => 'hostname.domain.com',
-        '1.3.6.1.4.1.34380.2.1' => 'my passphrase',
-        '1.3.6.1.4.1.34380.2.2' => # system IPs in hex
-          [ 0xC0A80001, # 192.168.0.1
-            0xC0A80101 ], # 192.168.1.1
-        # different UTF-8 widths
-        # 1-byte A
-        # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
-        # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
-        # 4-byte 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
-        '1.2.840.113549.1.9.7' => utf8_value,
-      },
-      'extension_requests' => {
-        'pp_uuid' => 'abcdef',
-        '1.3.6.1.4.1.34380.1.1.2' => utf8_value, # pp_instance_id
-        '1.3.6.1.4.1.34380.1.2.1' => 'some-value', # private extension
-      },
-    }
-  end
-
-  let(:host) { Puppet::SSL::Host.new }
-
-  before do
-    Puppet.settings[:confdir] = puppet_dir
-    Puppet.settings[:vardir] = puppet_dir
-
-    # This is necessary so the terminus instances don't lie around.
-    Puppet::SSL::Key.indirection.termini.clear
-  end
-
-  def write_csr_attributes(yaml)
-    File.open(Puppet.settings[:csr_attributes], 'w') do |file|
-      file.puts YAML.dump(yaml)
-    end
-  end
-
-  context "when the csr_attributes file is valid, but empty" do
-    it "generates a CSR when the file is empty" do
-      Puppet::FileSystem.touch(Puppet.settings[:csr_attributes])
-
-      host.generate_certificate_request
-    end
-
-    it "generates a CSR when the file contains whitespace" do
-      File.open(Puppet.settings[:csr_attributes], 'w') do |file|
-        file.puts "\n\n"
-      end
-
-      host.generate_certificate_request
-    end
-  end
-
-  context "when the csr_attributes file doesn't contain a YAML encoded hash" do
-    it "raises when the file contains a string" do
-      write_csr_attributes('a string')
-
-      expect {
-        host.generate_certificate_request
-      }.to raise_error(Puppet::Error, /invalid CSR attributes, expected instance of Hash, received instance of String/)
-    end
-
-    it "raises when the file contains an empty array" do
-      write_csr_attributes([])
-
-      expect {
-        host.generate_certificate_request
-      }.to raise_error(Puppet::Error, /invalid CSR attributes, expected instance of Hash, received instance of Array/)
-    end
-  end
-
-  context "with extension requests from csr_attributes file" do
-    let(:ca) { Puppet::SSL::CertificateAuthority.new }
-
-    it "generates a CSR when the csr_attributes file is an empty hash" do
-      write_csr_attributes(csr_attributes_content)
-
-      host.generate_certificate_request
-    end
-
-    context "and subjectAltName" do
-      it "raises an error if you include subjectAltName in csr_attributes" do
-        csr_attributes_content['extension_requests']['subjectAltName'] = 'foo'
-        write_csr_attributes(csr_attributes_content)
-        expect { host.generate_certificate_request }.to raise_error(Puppet::Error, /subjectAltName.*conflicts with internally used extension request/)
-      end
-
-      it "properly merges subjectAltName when in settings" do
-        Puppet.settings[:dns_alt_names] = 'althostname.nowhere'
-        write_csr_attributes(csr_attributes_content)
-        host.generate_certificate_request
-        csr = Puppet::SSL::CertificateRequest.indirection.find(host.name)
-        expect(csr.subject_alt_names).to include('DNS:althostname.nowhere')
-      end
-    end
-
-    context "without subjectAltName" do
-
-      before do
-        write_csr_attributes(csr_attributes_content)
-        host.generate_certificate_request
-      end
-
-      it "pulls extension attributes from the csr_attributes file into the certificate" do
-        csr = Puppet::SSL::CertificateRequest.indirection.find(host.name)
-        expect(csr.request_extensions).to have(3).items
-        expect(csr.request_extensions).to include('oid' => 'pp_uuid', 'value' => 'abcdef')
-        expect(csr.request_extensions).to include('oid' => 'pp_instance_id', 'value' => utf8_value_binary_string)
-        expect(csr.request_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'some-value')
-      end
-
-      it "pulls custom attributes from the csr_attributes file into the certificate" do
-        csr = Puppet::SSL::CertificateRequest.indirection.find(host.name)
-        expect(csr.custom_attributes).to have(4).items
-        expect(csr.custom_attributes).to include('oid' => 'challengePassword', 'value' => utf8_value_binary_string)
-      end
-
-      it "copies extension requests to certificate" do
-        cert = ca.sign(host.name)
-        expect(cert.custom_extensions).to include('oid' => 'pp_uuid', 'value' => 'abcdef')
-        expect(cert.custom_extensions).to include('oid' => 'pp_instance_id', 'value' => utf8_value_binary_string)
-        expect(cert.custom_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'some-value')
-      end
-
-      it "does not copy custom attributes to certificate" do
-        cert = ca.sign(host.name)
-        cert.custom_extensions.each do |ext|
-          expect(Puppet::SSL::Oids.subtree_of?('1.3.6.1.4.1.34380.2', ext['oid'])).to be_falsey
-          expect(ext['oid']).to_not eq('1.2.840.113549.1.9.7')
-        end
-      end
-    end
-
-  end
-end