puppet 5.4.0 → 5.5.0

data/spec/integration/parser/pcore_resource_spec.rb

@@ -227,7 +227,7 @@ describe 'when pcore described resources types are in use' do
       pending "assertion of parameter types not yet implemented"
       genface.types
       expect {
-      catalog = compile_to_catalog(<<-MANIFEST)
+      compile_to_catalog(<<-MANIFEST)
         test2 { 'b':
           color => 'white is not a color'
         }
@@ -237,7 +237,7 @@ describe 'when pcore described resources types are in use' do
   end
 
   def find_resource_type(scope, name)
-    t1 = Puppet::Pops::Evaluator::Runtime3ResourceSupport.find_resource_type(scope, name)
+    Puppet::Pops::Evaluator::Runtime3ResourceSupport.find_resource_type(scope, name)
   end
 
   def generate_and_in_a_compilers_context(&block)

data/spec/integration/parser/scope_spec.rb

@@ -20,7 +20,7 @@ describe "Two step scoping for variables" do
   describe "using unsupported operators" do
     it "issues an error for +=" do
       expect do
-        catalog = compile_to_catalog(<<-MANIFEST)
+        compile_to_catalog(<<-MANIFEST)
               $var = ["top_msg"]
               node default {
                 $var += ["override"]
@@ -31,7 +31,7 @@ describe "Two step scoping for variables" do
 
     it "issues an error for -=" do
       expect do
-        catalog = compile_to_catalog(<<-MANIFEST)
+        compile_to_catalog(<<-MANIFEST)
               $var = ["top_msg"]
               node default {
                 $var -= ["top_msg"]

data/spec/integration/ssl/certificate_authority_spec.rb

@@ -36,7 +36,7 @@ describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft
 
   describe "when signing certificates" do
     it "should save the signed certificate" do
-      host = certificate_request_for("luke.madstop.com")
+      certificate_request_for("luke.madstop.com")
 
       ca.sign("luke.madstop.com")
 
@@ -44,8 +44,8 @@ describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft
     end
 
     it "should be able to sign multiple certificates" do
-      host = certificate_request_for("luke.madstop.com")
-      other = certificate_request_for("other.madstop.com")
+      certificate_request_for("luke.madstop.com")
+      certificate_request_for("other.madstop.com")
 
       ca.sign("luke.madstop.com")
       ca.sign("other.madstop.com")
@@ -55,7 +55,7 @@ describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft
     end
 
     it "should save the signed certificate to the :signeddir" do
-      host = certificate_request_for("luke.madstop.com")
+      certificate_request_for("luke.madstop.com")
 
       ca.sign("luke.madstop.com")
 
@@ -64,16 +64,16 @@ describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft
     end
 
     it "should save valid certificates" do
-      host = certificate_request_for("luke.madstop.com")
+      certificate_request_for("luke.madstop.com")
 
       ca.sign("luke.madstop.com")
 
-      unless ssl = Puppet::Util::which('openssl')
+      unless Puppet::Util::which('openssl')
         pending "No ssl available"
       else
         ca_cert = Puppet[:cacert]
         client_cert = File.join(Puppet[:signeddir], "luke.madstop.com.pem")
-        output = %x{openssl verify -CAfile #{ca_cert} #{client_cert}}
+        %x{openssl verify -CAfile #{ca_cert} #{client_cert}}
         expect($CHILD_STATUS).to eq(0)
       end
     end

data/spec/integration/ssl/certificate_revocation_list_spec.rb

@@ -24,7 +24,7 @@ describe Puppet::SSL::CertificateRevocationList do
   }
 
   it "should be able to read in written out CRLs with no revoked certificates" do
-    ca = Puppet::SSL::CertificateAuthority.new
+    Puppet::SSL::CertificateAuthority.new
 
     raise "CRL not created" unless Puppet::FileSystem.exist?(Puppet[:hostcrl])
 

data/spec/integration/ssl/key_spec.rb

@@ -84,7 +84,7 @@ describe Puppet::SSL::Key do
       # note incorrect password is an error
       expect do
         Puppet::FileSystem.open(pem_path, nil, 'r:ASCII') do |f|
-          reloaded_key = OpenSSL::PKey::RSA.new(f.read, 'invalid_password')
+          OpenSSL::PKey::RSA.new(f.read, 'invalid_password')
         end
       end.to raise_error(OpenSSL::PKey::RSAError)
 

data/spec/integration/transaction/report_spec.rb

@@ -87,7 +87,7 @@ describe Puppet::Transaction::Report do
     end
 
     def get_cc_count(report)
-      cc = report.metrics["resources"].values.each do |v|
+      report.metrics["resources"].values.each do |v|
         if v[0] == "corrective_change"
           return v[2]
         end
@@ -298,8 +298,8 @@ describe Puppet::Transaction::Report do
                                                            :content => "mystuff1"),
                               Puppet::Type.type(:file).new(:title => file,
                                                            :content => "mystuff2")) do
-          File.open(file, 'w') do |file|
-            file.write "some content"
+          File.open(file, 'w') do |f|
+            f.write "some content"
           end
         end
 

data/spec/integration/transaction_spec.rb

@@ -146,7 +146,6 @@ describe Puppet::Transaction do
   # Verify that one component requiring another causes the contained
   # resources in the requiring component to get refreshed.
   it "should propagate events from a contained resource through its container to its dependent container's contained resources" do
-    transaction = nil
     file = Puppet::Type.type(:file).new :path => tmpfile("event_propagation"), :ensure => :present
     execfile = File.join(tmpdir("exec_event"), "exectestingness2")
     exec = Puppet::Type.type(:exec).new :command => touch(execfile), :path => ENV['PATH']

data/spec/integration/type/file_spec.rb

@@ -292,13 +292,14 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
             Puppet::FileSystem.symlink(link_target, link)
           end
 
-          it "should not set the executable bit on the link nor the target" do
+          it "should not set the executable bit on the link target" do
             catalog.add_resource described_class.new(:path => link, :ensure => :link, :mode => '0666', :target => link_target, :links => :manage)
 
             catalog.apply
 
-            (Puppet::FileSystem.stat(link).mode & 07777) == 0666
-            (Puppet::FileSystem.lstat(link_target).mode & 07777) == 0444
+            expected_target_permissions = Puppet::Util::Platform.windows? ? 0700 : 0444
+
+            expect(Puppet::FileSystem.stat(link_target).mode & 07777).to eq(expected_target_permissions)
           end
 
           it "should ignore dangling symlinks (#6856)" do
@@ -541,8 +542,6 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
         File.open(dest1, "w") { |f| f.puts "whatever" }
         Puppet::FileSystem.symlink(dest1, link)
 
-        d = filebucket_digest.call(File.read(file[:path]))
-
         catalog.apply
 
         expect(Puppet::FileSystem.readlink(link)).to eq(dest2)
@@ -662,13 +661,13 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
       catalog.apply
 
       expect(@dirs).not_to be_empty
-      @dirs.each do |path|
-        expect(get_mode(path) & 007777).to eq(0755)
+      @dirs.each do |dir|
+        expect(get_mode(dir) & 007777).to eq(0755)
       end
 
       expect(@files).not_to be_empty
-      @files.each do |path|
-        expect(get_mode(path) & 007777).to eq(0644)
+      @files.each do |dir|
+        expect(get_mode(dir) & 007777).to eq(0644)
       end
     end
 
@@ -1030,8 +1029,8 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
     before do
       source = tmpdir("generating_in_catalog_source")
 
-      s1 = file_in_dir_with_contents(source, "one", "uno")
-      s2 = file_in_dir_with_contents(source, "two", "dos")
+      file_in_dir_with_contents(source, "one", "uno")
+      file_in_dir_with_contents(source, "two", "dos")
 
       @file = described_class.new(
         :name => path,

data/spec/integration/type_spec.rb

@@ -21,8 +21,7 @@ describe Puppet::Type do
 
   it "should not lose its provider parameter when it is reloaded" do
     type = Puppet::Type.newtype(:reload_test_type)
-
-    provider = type.provide(:test_provider)
+    type.provide(:test_provider)
 
     # reload it
     type = Puppet::Type.newtype(:reload_test_type)

data/spec/integration/util/windows/adsi_spec.rb

@@ -81,6 +81,91 @@ describe Puppet::Util::Windows::ADSI::Group,
   end
 
   describe '.members' do
+    it 'should return a list of members resolvable with Puppet::Util::Windows::ADSI::Group.name_sid_hash' do
+      temp_groupname = "g#{SecureRandom.uuid}"
+      temp_username  = "u#{SecureRandom.uuid}"[0..12]
+
+      # select a virtual account that requires an authority to be able to resolve to SID
+      # the Dhcp service is chosen for no particular reason aside from it's a service available on all Windows versions
+      dhcp_virtualaccount = Puppet::Util::Windows::SID.name_to_principal('NT SERVICE\Dhcp')
+
+      # adding :SidTypeGroup as a group member will cause error in IAdsUser::Add
+      # adding :SidTypeDomain (such as S-1-5-80 / NT SERVICE or computer name) won't error
+      #   but also won't be returned as a group member
+      # uncertain how to obtain :SidTypeComputer (perhaps AD? the local machine is :SidTypeDomain)
+      users = [
+        # Use sid_to_name to get localized names of SIDs - BUILTIN, SYSTEM, NT AUTHORITY, Everyone are all localized
+        # :SidTypeWellKnownGroup
+        # SYSTEM is prefixed with the NT Authority authority, resolveable with or without authority
+        { :sid => 'S-1-5-18', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-5-18') },
+        # Everyone is not prefixed with an authority, resolveable with or without NT AUTHORITY authority
+        { :sid => 'S-1-1-0', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-1-0') },
+        # Dhcp service account is prefixed with NT SERVICE authority, requires authority to resolve SID
+        # behavior is similar to IIS APPPOOL\DefaultAppPool
+        { :sid => dhcp_virtualaccount.sid, :name => dhcp_virtualaccount.domain_account },
+
+        # :SidTypeAlias with authority component
+        # Administrators group is prefixed with BUILTIN authority, can be resolved with or without authority
+        { :sid => 'S-1-5-32-544', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-5-32-544') },
+      ]
+
+      begin
+        # :SidTypeUser as user on localhost, can be resolved with or without authority prefix
+        user = Puppet::Util::Windows::ADSI::User.create(temp_username)
+        user.commit()
+        users.push({ :sid => user.sid.sid, :name => Puppet::Util::Windows::ADSI.computer_name + '\\' + temp_username })
+
+        # create a test group and add above 5 members by SID
+        group = described_class.create(temp_groupname)
+        group.commit()
+        group.set_members(users.map { |u| u[:sid]} )
+
+        # most importantly make sure that all name are convertible to SIDs
+        expect { described_class.name_sid_hash(group.members) }.to_not raise_error
+
+        # also verify the names returned are as expected
+        expected_usernames = users.map { |u| u[:name] }
+        expect(group.members.map(&:domain_account)).to eq(expected_usernames)
+      ensure
+        described_class.delete(temp_groupname) if described_class.exists?(temp_groupname)
+        Puppet::Util::Windows::ADSI::User.delete(temp_username) if Puppet::Util::Windows::ADSI::User.exists?(temp_username)
+      end
+    end
+
+    it 'should return a list of Principal objects even with unresolvable SIDs' do
+      members = [
+        # NULL SID is not localized
+        stub('WIN32OLE', {
+          :objectSID => [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+          :Name => 'NULL SID',
+          :ole_respond_to? => true,
+        }),
+        # unresolvable SID is a different story altogether
+        stub('WIN32OLE', {
+          # completely valid SID, but Name is just a stringified version
+          :objectSID => [1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 5, 113, 65, 218, 15, 127, 9, 57, 219, 4, 84, 126, 88, 4, 0, 0],
+          :Name => 'S-1-5-21-3661721861-956923663-2119435483-1112',
+          :ole_respond_to? => true,
+        })
+      ]
+
+      admins_name = Puppet::Util::Windows::SID.sid_to_name('S-1-5-32-544')
+      admins = Puppet::Util::Windows::ADSI::Group.new(admins_name)
+
+      # touch the native_group member to have it lazily loaded, so COM objects can be stubbed
+      admins.native_group
+      admins.native_group.stubs(:Members).returns(members)
+
+      # well-known NULL SID
+      expect(admins.members[0].sid).to eq('S-1-0-0')
+      expect(admins.members[0].account_type).to eq(:SidTypeWellKnownGroup)
+
+      # unresolvable SID
+      expect(admins.members[1].sid).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
+      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112 (unresolvable)')
+      expect(admins.members[1].account_type).to eq(:SidTypeUnknown)
+    end
+
     it 'should return a list of members with UTF-8 names' do
       begin
         original_codepage = Encoding.default_external
@@ -88,7 +173,7 @@ describe Puppet::Util::Windows::ADSI::Group,
 
         # lookup by English name Administrators is not OK on localized Windows
         admins = Puppet::Util::Windows::ADSI::Group.new(administrators_principal.account)
-        admins.members.each do |name|
+        admins.members.map(&:domain_account).each do |name|
           expect(name.encoding).to be(Encoding::UTF_8)
         end
       ensure

data/spec/integration/util/windows/principal_spec.rb

@@ -6,9 +6,9 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
 
   let (:current_user_sid) { Puppet::Util::Windows::ADSI::User.current_user_sid }
   let (:system_bytes) { [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] }
-  let (:null_sid_bytes) { bytes = [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] }
+  let (:null_sid_bytes) { [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] }
   let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
-  let (:computer_sid) { Puppet::Util::Windows::SID.name_to_sid_object(Puppet::Util::Windows::ADSI.computer_name) }
+  let (:computer_sid) { Puppet::Util::Windows::SID.name_to_principal(Puppet::Util::Windows::ADSI.computer_name) }
   # BUILTIN is localized on German Windows, but not French
   # looking this up like this dilutes the values of the tests as we're comparing two mechanisms
   # for returning the same values, rather than to a known good
@@ -23,6 +23,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq('')
       expect(principal.domain_account).to eq('NULL SID')
       expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
+      expect(principal.to_s).to eq('NULL SID')
     end
 
     it "should create an instance from a well-known account prefixed with NT AUTHORITY" do
@@ -39,6 +40,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
         expect(principal.account).to eq('SYSTEM')
         expect(principal.domain).to eq('NT AUTHORITY')
         expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
+        expect(principal.to_s).to eq('NT AUTHORITY\\SYSTEM')
       end
 
       # Windows API LookupAccountSid behaves differently if current user is SYSTEM
@@ -87,6 +89,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(domain)
       expect(principal.domain_account).to eq(qualified_name)
       expect(principal.account_type).to eq(:SidTypeAlias)
+      expect(principal.to_s).to eq(qualified_name)
     end
 
     it "should raise an error when trying to lookup an account that doesn't exist" do
@@ -106,6 +109,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
 
     it "should return a BUILTIN domain principal for BUILTIN account names" do
@@ -115,6 +119,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
 
   end
@@ -135,6 +140,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(computer_sid.domain)
       expect(principal.domain_account).to eq(guest_name)
       expect(principal.account_type).to eq(:SidTypeUser)
+      expect(principal.to_s).to eq(guest_name)
     end
 
     it "should create an instance from a well-known group SID" do
@@ -145,6 +151,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq('')
       expect(principal.domain_account).to eq('NULL SID')
       expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
+      expect(principal.to_s).to eq('NULL SID')
     end
 
     it "should create an instance from a well-known BUILTIN Alias SID" do
@@ -160,6 +167,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(domain)
       expect(principal.domain_account).to eq(qualified_name)
       expect(principal.account_type).to eq(:SidTypeAlias)
+      expect(principal.to_s).to eq(qualified_name)
     end
 
     it "should raise an error when trying to lookup nil" do
@@ -214,6 +222,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
   end
 

data/spec/integration/util/windows/security_spec.rb

@@ -734,11 +734,11 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       let (:explorer) { File.join(Dir::WINDOWS, "explorer.exe") }
 
       it "should get the owner" do
-        expect(winsec.get_owner(explorer)).to match /^S-1-5-/
+        expect(winsec.get_owner(explorer)).to match(/^S-1-5-/)
       end
 
       it "should get the group" do
-        expect(winsec.get_group(explorer)).to match /^S-1-5-/
+        expect(winsec.get_group(explorer)).to match(/^S-1-5-/)
       end
 
       it "should get the mode" do

data/spec/lib/matchers/json.rb

@@ -9,7 +9,7 @@ module JSONMatchers
     end
 
     def json(instance)
-      JSON.parse(instance.to_json)
+      Puppet::Util::Json.load(instance.to_json)
     end
 
     def attr_value(attrs, instance)
@@ -102,11 +102,11 @@ module JSONMatchers
   end
 
   if !Puppet.features.microsoft_windows?
-    require 'json'
+    require 'puppet/util/json'
     require 'json-schema'
 
     class SchemaMatcher
-      JSON_META_SCHEMA = JSON.parse(File.read('api/schemas/json-meta-schema.json'))
+      JSON_META_SCHEMA = Puppet::Util::Json.load(File.read('api/schemas/json-meta-schema.json'))
 
       def initialize(schema)
         @schema = schema
@@ -123,7 +123,7 @@ module JSONMatchers
     if Puppet.features.microsoft_windows?
       pending("Schema checks cannot be done on windows because of json-schema problems")
     else
-      schema = JSON.parse(File.read(schema_file))
+      schema = Puppet::Util::Json.load(File.read(schema_file))
       SchemaMatcher.new(schema)
     end
   end

data/spec/lib/puppet_spec/language.rb

@@ -9,50 +9,49 @@ module PuppetSpec::Language
     expectations.each do |manifest, resources|
       it "evaluates #{manifest} to produce #{resources}" do
         begin
-        case resources
-        when String
-          node = Puppet::Node.new('specification')
-          Puppet[:code] = manifest
-          compiler = Puppet::Parser::Compiler.new(node)
-          evaluator = Puppet::Pops::Parser::EvaluatingParser.new()
+          case resources
+          when String
+            node = Puppet::Node.new('specification')
+            Puppet[:code] = manifest
+            compiler = Puppet::Parser::Compiler.new(node)
+            evaluator = Puppet::Pops::Parser::EvaluatingParser.new()
 
-          # see lib/puppet/indirector/catalog/compiler.rb#filter
-          catalog = compiler.compile.filter { |r| r.virtual? }
+            # see lib/puppet/indirector/catalog/compiler.rb#filter
+            catalog = compiler.compile.filter { |r| r.virtual? }
 
-          compiler.send(:instance_variable_set, :@catalog, catalog)
+            compiler.send(:instance_variable_set, :@catalog, catalog)
 
-          Puppet.override(:loaders => compiler.loaders) do
-            expect(evaluator.evaluate_string(compiler.topscope, resources)).to eq(true)
-          end
-        when Array
-          catalog = PuppetSpec::Compiler.compile_to_catalog(manifest)
+            Puppet.override(:loaders => compiler.loaders) do
+              expect(evaluator.evaluate_string(compiler.topscope, resources)).to eq(true)
+            end
+          when Array
+            catalog = PuppetSpec::Compiler.compile_to_catalog(manifest)
 
-          if resources.empty?
-            base_resources = ["Class[Settings]", "Class[main]", "Stage[main]"]
-            expect(catalog.resources.collect(&:ref) - base_resources).to eq([])
-          else
-            resources.each do |reference|
-              if reference.is_a?(Array)
-                matcher = Matchers::Resource.have_resource(reference[0])
-                reference[1].each do |name, value|
-                  matcher = matcher.with_parameter(name, value)
+            if resources.empty?
+              base_resources = ["Class[Settings]", "Class[main]", "Stage[main]"]
+              expect(catalog.resources.collect(&:ref) - base_resources).to eq([])
+            else
+              resources.each do |reference|
+                if reference.is_a?(Array)
+                  matcher = Matchers::Resource.have_resource(reference[0])
+                  reference[1].each do |name, value|
+                    matcher = matcher.with_parameter(name, value)
+                  end
+                else
+                  matcher = Matchers::Resource.have_resource(reference)
                 end
-              else
-                matcher = Matchers::Resource.have_resource(reference)
-              end
 
-              expect(catalog).to matcher
+                expect(catalog).to matcher
+              end
             end
+          else
+            raise "Unsupported creates specification: #{resources.inspect}"
           end
-        else
-          raise "Unsupported creates specification: #{resources.inspect}"
+        rescue  Puppet::Error, RSpec::Expectations::ExpectationNotMetError => e
+          # provide the backtrace from the caller, or it is close to impossible to find some originators
+          e.set_backtrace(calledFrom)
+          raise
         end
-      rescue  Puppet::Error, RSpec::Expectations::ExpectationNotMetError => e
-        # provide the backtrace from the caller, or it is close to impossible to find some originators
-        e.set_backtrace(calledFrom)
-        raise
-      end
-
       end
     end
   end