puppet 5.5.16-x64-mingw32 → 5.5.21-x64-mingw32

data/spec/fixtures/unit/provider/package/dnfmodule/dnf-module-list.txt

@@ -0,0 +1,19 @@
+localmirror-appstream
+Name         Stream       Profiles                                  Summary                                                            
+389-ds       1.4 [e]                                                389 Directory Server (base)                                           
+gimp         2.8 [d][e]   common [d], devel [i]                     gimp module                                                        
+mariadb      10.3 [d][e]  client [i], server [d], galera            MariaDB Module                                                     
+nodejs       10 [d][e]    common [d], development, minimal [i], s2i Javascript runtime                                                 
+perl         5.26 [d][e]  common [d], minimal [i]                   Practical Extraction and Report Language                           
+postgresql   10 [d][e]    client, server [d] [i]                    PostgreSQL server and client module                                
+ruby         2.5 [d][e]   common [d]                                An interpreter of object-oriented scripting language                  
+rust-toolset rhel8 [d][e] common [d] [i]                            Rust                                                               
+subversion   1.10 [d][e]  common [d], server [i]                    Apache Subversion                                                  
+scala        2.10 [d]     common [d]                                A hybrid functional/object-oriented language for the JVM
+squid        4 [d]        common [d]                                Squid - Optimising Web Delivery
+subversion   1.10 [d]     common [d], server                        Apache Subversion
+swig         3.0 [d][x]   common [d], complete                      Connects C/C++/Objective C to some high-level programming languages
+varnish      6 [d]        common [d]                                Varnish HTTP cache
+virt         rhel [d][x]  common [d]                                Virtualization module
+
+Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

data/spec/fixtures/unit/provider/package/pkgng/pkg.version

@@ -1,3 +1,5 @@
 shells/bash-completion             <   needs updating (index has 2.1_3)
 ftp/curl                           <   needs updating (index has 7.33.0_2)
 shells/zsh                         <   needs updating (index has 5.0.4)
+sysutils/orphan                    ?   orphaned: sysutils/orphan
+sysutils/broken                    !   Comparison failed

data/spec/fixtures/unit/provider/package/yum/yum-check-update-subscription-manager.txt

@@ -0,0 +1,9 @@
+Loaded plugins: product-id, search-disabled-repos, subscription-manager
+
+This system is not registered with an entitlement server. You can use subscription-manager to register on.
+
+curl.i686                               7.32.0-10.fc20           updates
+curl.x86_64                             7.32.0-10.fc20           updates
+gawk.i686                               4.1.0-3.fc20             updates
+dhclient.i686                           12:4.1.1-38.P1.fc20      updates
+java-1.8.0-openjdk.x86_64               1:1.8.0.131-2.b11.el7_3  updates

data/spec/fixtures/unit/provider/service/systemd/list_unit_files_services

@@ -5,3 +5,12 @@ autovt@.service                             disabled
 avahi-daemon.service                        enabled
 blk-availability.service                    disabled
 brandbot.service                            static
+apparmor.service                            bad
+udev.service                                enabled-runtime
+ufw.service                                 linked
+umountfs.service                            linked-runtime
+umountnfs.service                           masked
+umountroot.service                          masked-runtime
+urandom.service                             indirect
+user@.service                               generated
+uuidd.service                               transient

data/spec/integration/configurer_spec.rb

@@ -62,5 +62,57 @@ describe Puppet::Configurer do
       expect(summary["time"]).to be_key("notify")
       expect(summary["time"]["last_run"]).to be_between(t1, t2)
     end
+
+    describe 'resubmitting facts' do
+      context 'when resubmit_facts is set to false' do
+        it 'should not send data' do
+          expect(@configurer).to receive(:resubmit_facts).never
+
+          @configurer.run(catalog: @catalog)
+        end
+      end
+
+      context 'when resubmit_facts is set to true' do
+        let(:test_facts) { Puppet::Node::Facts.new('configurer.test') }
+        let(:fact_rest_terminus) { Puppet::Node::Facts.indirection.terminus(:rest) }
+
+        before(:each) do
+          Puppet[:resubmit_facts] = true
+
+          allow(@configurer).to receive(:find_facts).and_return(test_facts)
+          allow(fact_rest_terminus).to receive(:save)
+        end
+
+        it 'sends fact data using the rest terminus' do
+          expect(fact_rest_terminus).to receive(:save)
+
+          @configurer.run(catalog: @catalog)
+        end
+
+        it 'logs errors that occur during fact generation' do
+          allow(@configurer).to receive(:find_facts).and_raise('error generating facts')
+          expect(Puppet).to receive(:log_exception).with(instance_of(RuntimeError),
+                                                         /^Failed to submit facts/)
+
+          @configurer.run(catalog: @catalog)
+        end
+
+        it 'logs errors that occur during fact submission' do
+          allow(fact_rest_terminus).to receive(:save).and_raise('error sending facts')
+          expect(Puppet).to receive(:log_exception).with(instance_of(RuntimeError),
+                                                         /^Failed to submit facts/)
+
+          @configurer.run(catalog: @catalog)
+        end
+
+        it 'records time spent resubmitting facts' do
+          report = Puppet::Transaction::Report.new
+
+          @configurer.run(catalog: @catalog, report: report)
+
+          expect(report.metrics['time'].values).to include(["resubmit_facts", anything, Numeric])
+        end
+      end
+    end
   end
 end

data/spec/integration/defaults_spec.rb

@@ -130,8 +130,7 @@ describe "Puppet defaults" do
       Puppet::Util.withenv( {"PATH" => path }, :windows) do
         Puppet.settings[:path] = "none" # this causes it to ignore the setting
 
-        envhash = Puppet::Util::Windows::Process.get_environment_strings
-        expect(envhash['Path']).to eq(path)
+        expect(Puppet::Util.get_env('Path')).to eq(path)
       end
     end
   end

data/spec/integration/indirector/facts/facter_spec.rb

@@ -8,6 +8,10 @@ describe Puppet::Node::Facts::Facter do
   include PuppetSpec::Files
   include PuppetSpec::Compiler
 
+  before :each do
+    Puppet::Node::Facts.indirection.terminus_class = :facter
+  end
+
   it "preserves case in fact values" do
     Facter.add(:downcase_test) do
       setcode do

data/spec/integration/parser/compiler_spec.rb

@@ -841,6 +841,17 @@ describe Puppet::Parser::Compiler do
           MANIFEST
         end.to raise_error(/Foo\[bar\]:\s+parameter 'a' expects a value for key 'd'\s+parameter 'a' unrecognized key 'c'/m)
       end
+
+      it 'handles Sensitive type in resource array' do
+        catalog = compile_to_catalog(<<-MANIFEST)
+          define foo(Sensitive[String] $password) {
+            notify{ "${title}": message => "${password}" }
+          }
+          foo { ['testA', 'testB']: password =>Sensitive('some password') }
+        MANIFEST
+        expect(catalog).to have_resource("Notify[testA]").with_parameter(:message, 'Sensitive [value redacted]')
+        expect(catalog).to have_resource("Notify[testB]").with_parameter(:message, 'Sensitive [value redacted]')
+      end
     end
 
     context 'when using typed parameters in class' do

data/spec/integration/provider/service/systemd_spec.rb

@@ -3,16 +3,19 @@ require 'spec_helper'
 describe Puppet::Type.type(:service).provider(:systemd), '(integration)' do
   # TODO: Unfortunately there does not seem a way to stub the executable
   #       checks in the systemd provider because they happen at load time.
-  it "should be considered suitable if /bin/systemctl is present", :if => File.executable?('/bin/systemctl') do
+
+  it "should be considered suitable if /proc/1/comm is present and contains 'systemd'",
+    :if => File.exist?('/proc/1/comm') && Puppet::FileSystem.read('/proc/1/comm').include?('systemd') do
     expect(described_class).to be_suitable
   end
 
-  it "should be considered suitable if /usr/bin/systemctl is present", :if => File.executable?('/usr/bin/systemctl')  do
-    expect(described_class).to be_suitable
+  it "should not be considered suitable if /proc/1/comm is present it does not contain 'systemd'",
+    :if => File.exist?('/proc/1/comm') && !Puppet::FileSystem.read('/proc/1/comm').include?('systemd') do
+    expect(described_class).not_to be_suitable
   end
 
-  it "should not be cosidered suitable if systemctl is absent",
-    :unless => (File.executable?('/bin/systemctl') or File.executable?('/usr/bin/systemctl')) do
+  it "should not be considered suitable if /proc/1/comm is absent",
+    :if => !File.exist?('/proc/1/comm') do
     expect(described_class).not_to be_suitable
   end
 end

data/spec/integration/type/file_spec.rb

@@ -21,6 +21,13 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
     File.join(parent, 'file_testing')
   end
 
+  let(:path_protected) do
+    # we create a file inside windows protected folders (C:\Windows, C:\Windows\system32, etc)
+    # the file will also be removed after the tests
+    parent = 'C:\Windows'
+    File.join(parent, 'file_testing')
+  end
+
   let(:dir) do
     # we create a directory first so backups of :path that are stored in
     # the same directory will also be removed after the tests
@@ -268,6 +275,27 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
           expect(get_mode(path) & 07777).to eq(0666)
         end
 
+        context "file is in protected windows directory", :if => Puppet.features.microsoft_windows? do
+          after { FileUtils.rm(path_protected) }
+
+          it "should set and get the correct mode for files inside protected windows folders" do
+            catalog.add_resource described_class.new(:path => path_protected, :ensure => :file, :mode => '0640')
+            catalog.apply
+  
+            expect(get_mode(path_protected) & 07777).to eq(0640)
+          end
+
+          it "should not change resource's status inside protected windows folders if mode is the same" do
+            FileUtils.touch(path_protected)
+            set_mode(0644, path_protected)
+            catalog.add_resource described_class.new(:path => path_protected, :ensure => :file, :mode => '0644')
+            result = catalog.apply
+            status = result.report.resource_statuses["File[#{path_protected}]"]
+            expect(status).not_to be_failed
+            expect(status).not_to be_changed
+          end
+        end
+        
         it "should not set executable bits when replacing an executable directory (#10365)" do
           pending("bug #10365")
 

data/spec/integration/type/notify_spec.rb

@@ -0,0 +1,46 @@
+require 'spec_helper'
+require 'puppet_spec/compiler'
+
+describe Puppet::Type.type(:notify) do
+  include PuppetSpec::Compiler
+
+  it "logs the title at notice level" do
+    apply_compiled_manifest(<<-MANIFEST)
+      notify { 'hi': }
+    MANIFEST
+
+    expect(@logs).to include(an_object_having_attributes(level: :notice, message: 'hi'))
+  end
+
+  it "logs the message property" do
+    apply_compiled_manifest(<<-MANIFEST)
+      notify { 'title':
+        message => 'hello'
+      }
+    MANIFEST
+
+    expect(@logs).to include(an_object_having_attributes(level: :notice, message: "defined 'message' as 'hello'"))
+  end
+
+  it "redacts sensitive message properties" do
+    apply_compiled_manifest(<<-MANIFEST)
+      $message = Sensitive('secret')
+      notify { 'notify1':
+        message => $message
+      }
+    MANIFEST
+
+    expect(@logs).to include(an_object_having_attributes(level: :notice, message: 'changed [redacted] to [redacted]'))
+  end
+
+  it "redacts sensitive interpolated message properties" do
+    apply_compiled_manifest(<<-MANIFEST)
+      $message = Sensitive('secret')
+      notify { 'notify2':
+        message => "${message}"
+      }
+    MANIFEST
+
+    expect(@logs).to include(an_object_having_attributes(level: :notice, message: "defined 'message' as 'Sensitive [value redacted]'"))
+  end
+end

data/spec/integration/util/execution_spec.rb

@@ -25,6 +25,33 @@ describe Puppet::Util::Execution do
     end
   end
 
+  describe "#execute" do
+    if Puppet::Util::Platform.windows?
+      let(:argv) { ["cmd", "/c", "echo", 123] }
+    else
+      let(:argv) { ["echo", 123] }
+    end
+
+    it 'stringifies sensitive arguments when given an array containing integers' do
+      result = Puppet::Util::Execution.execute(argv, sensitive: true)
+      expect(result.to_s.strip).to eq("123")
+      expect(result.exitstatus).to eq(0)
+    end
+
+    it 'redacts sensitive arguments when given an array' do
+      Puppet[:log_level] = :debug
+      Puppet::Util::Execution.execute(argv, sensitive: true)
+      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'"))
+    end
+
+    it 'redacts sensitive arguments when given a string' do
+      Puppet[:log_level] = :debug
+      str = argv.map(&:to_s).join(' ')
+      Puppet::Util::Execution.execute(str, sensitive: true)
+      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'"))
+    end
+  end
+
   describe "#execute (non-Windows)", :if => !Puppet.features.microsoft_windows? do
     it "should execute basic shell command" do
       result = Puppet::Util::Execution.execute("ls /tmp", :failonfail => true)

data/spec/integration/util/windows/adsi_spec.rb

@@ -82,6 +82,9 @@ describe Puppet::Util::Windows::ADSI::Group,
     it 'should return a list of members resolvable with Puppet::Util::Windows::ADSI::Group.name_sid_hash' do
       temp_groupname = "g#{SecureRandom.uuid}"
       temp_username  = "u#{SecureRandom.uuid}"[0..12]
+      # From https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements
+      specials = "~!@#$%^&*_-+=`|\(){}[]:;\"'<>,.?/"
+      temp_password = "p#{SecureRandom.uuid[0..7]}-#{SecureRandom.uuid.upcase[0..7]}-#{specials[rand(specials.length)]}"
 
       # select a virtual account that requires an authority to be able to resolve to SID
       # the Dhcp service is chosen for no particular reason aside from it's a service available on all Windows versions
@@ -110,6 +113,8 @@ describe Puppet::Util::Windows::ADSI::Group,
       begin
         # :SidTypeUser as user on localhost, can be resolved with or without authority prefix
         user = Puppet::Util::Windows::ADSI::User.create(temp_username)
+        # appveyor sometimes requires a password
+        user.password = temp_password
         user.commit()
         users.push({ :sid => user.sid.sid, :name => Puppet::Util::Windows::ADSI.computer_name + '\\' + temp_username })
 
@@ -160,7 +165,7 @@ describe Puppet::Util::Windows::ADSI::Group,
 
       # unresolvable SID
       expect(admins.members[1].sid).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
-      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112 (unresolvable)')
+      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
       expect(admins.members[1].account_type).to eq(:SidTypeUnknown)
     end
 

data/spec/integration/util/windows/registry_spec.rb

@@ -259,23 +259,23 @@ describe Puppet::Util::Windows::Registry do
         {
           name: 'REG_SZ',
           type: Win32::Registry::REG_SZ,
-          value: "reg sz\u0000 string",
-          expected_value: "reg sz  string"
+          value: "reg sz\u0000\u0000 string",
+          expected_value: "reg sz"
         },
         {
           name: 'REG_SZ_2',
           type: Win32::Registry::REG_SZ,
-          value: "reg sz\x00 string",
-          expected_value: "reg sz  string"
+          value: "reg sz 2\x00\x00 string",
+          expected_value: "reg sz 2"
         },
         {
           name: 'REG_EXPAND_SZ',
           type: Win32::Registry::REG_EXPAND_SZ,
-          value: "\0reg expand string",
-          expected_value: " reg expand string"
+          value: "\0\0\0reg expand string",
+          expected_value: ""
         }
       ].each do |pair|
-        it 'replaces null bytes with spaces' do
+        it 'reads up to the first wide null' do
           hklm.create("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_ALL_ACCESS) do |reg|
             reg.write(value_name, pair[:type], pair[:value])
           end

data/spec/unit/agent_spec.rb

@@ -185,31 +185,26 @@ describe Puppet::Agent do
 
         # So we don't actually try to hit the filesystem.
         allow(@agent).to receive(:lock).and_yield
-
-        allow(Kernel).to receive(:fork)
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => 0)])
-        allow(@agent).to receive(:exit)
       end
 
       it "should run the agent in a forked process" do
         client = AgentTestClient.new
         expect(AgentTestClient).to receive(:new).and_return(client)
 
-        expect(client).to receive(:run)
+        expect(client).to receive(:run).and_return(0)
 
         expect(Kernel).to receive(:fork).and_yield
-        @agent.run
+        expect { @agent.run }.to exit_with(0)
       end
 
       it "should exit child process if child exit" do
         client = AgentTestClient.new
         expect(AgentTestClient).to receive(:new).and_return(client)
 
-        expect(client).to receive(:run).and_raise(SystemExit)
+        expect(client).to receive(:run).and_raise(SystemExit.new(-1))
 
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(-1)
-        @agent.run
+        expect { @agent.run }.to exit_with(-1)
       end
 
       it 'should exit with 1 if an exception is raised' do
@@ -219,31 +214,44 @@ describe Puppet::Agent do
         expect(client).to receive(:run).and_raise(StandardError)
 
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(1)
-        @agent.run
+        expect { @agent.run }.to exit_with(1)
       end
 
-      it "should re-raise exit happening in the child" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => -1)])
-        expect { @agent.run }.to raise_error(SystemExit)
+      it 'should exit with 254 if NoMemoryError exception is raised' do
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+
+        expect(client).to receive(:run).and_raise(NoMemoryError)
+
+        expect(Kernel).to receive(:fork).and_yield
+        expect { @agent.run }.to exit_with(254)
       end
 
-      it "should re-raise NoMoreMemory happening in the child" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => -2)])
-        expect { @agent.run }.to raise_error(NoMemoryError)
+      it "should return the block exit code as the child exit code" do
+        expect(Kernel).to receive(:fork).and_yield
+        expect {
+          @agent.run_in_fork {
+            777
+          }
+        }.to exit_with(777)
       end
 
-      it "should return the child exit code" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => 777)])
-        expect(@agent.run).to eq(777)
+      it "should return `1` exit code if the block returns `nil`" do
+        expect(Kernel).to receive(:fork).and_yield
+        expect {
+          @agent.run_in_fork {
+            nil
+          }
+        }.to exit_with(1)
       end
 
-      it "should return the block exit code as the child exit code" do
+      it "should return `1` exit code if the block returns `false`" do
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(777)
-        @agent.run_in_fork {
-          777
-        }
+        expect {
+          @agent.run_in_fork {
+            false
+          }
+        }.to exit_with(1)
       end
     end
 
@@ -283,7 +291,7 @@ describe Puppet::Agent do
         expect(client).not_to receive(:handling)
         expect(Puppet).to receive(:log_exception).with(be_an_instance_of(Puppet::Agent::RunTimeoutError), anything)
 
-        expect(@agent.run).to eq(1)
+        expect(@agent.run).to eq(nil)
       end
     end
   end