puppet 5.5.16 → 5.5.21

data/spec/unit/provider/service/windows_spec.rb

@@ -148,6 +148,11 @@ describe Puppet::Type.type(:service).provider(:windows), :if => Puppet.features.
       expect(provider.enabled?).to eq(:manual)
     end
 
+    it "should report a service with a startup type of delayed as delayed" do
+      expect(service_util).to receive(:service_start_type).with(name).and_return(:SERVICE_DELAYED_AUTO_START)
+      expect(provider.enabled?).to eq(:delayed)
+    end
+
     it "should report a service with a startup type of disabled as false" do
       expect(service_util).to receive(:service_start_type).with(name).and_return(:SERVICE_DISABLED)
       expect(provider.enabled?).to eq(:false)
@@ -213,4 +218,19 @@ describe Puppet::Type.type(:service).provider(:windows), :if => Puppet.features.
       }.to raise_error(Puppet::Error, /Cannot enable #{name}/)
     end
   end
+
+  describe "#delayed_start" do
+    it "should set service start type to Service_Config_Delayed_Auto_Start (delayed) when delayed" do
+      expect(service_util).to receive(:set_startup_mode).with(name, :SERVICE_AUTO_START, true)
+      provider.delayed_start
+    end
+
+    it "raises an error if set_startup_mode fails" do
+      expect(service_util).to receive(:set_startup_mode).with(name, :SERVICE_AUTO_START, true).and_raise(Puppet::Error.new('foobar'))
+
+      expect {
+        provider.delayed_start
+      }.to raise_error(Puppet::Error, /Cannot enable #{name}/)
+    end
+  end
 end

data/spec/unit/provider/user/directoryservice_spec.rb

@@ -196,6 +196,17 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     }
   end
 
+  let (:dsimport_preamble) do
+    '0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData'
+  end
+
+  let (:dsimport_contents) do
+    <<-DSIMPORT
+#{dsimport_preamble}
+#{username}:#{Base64.strict_encode64(sha512_embedded_bplist)}
+    DSIMPORT
+  end
+
   # The below represents output of 'dscl -plist . readall /Users' converted to
   # a native Ruby hash if only one user were installed on the system.
   # This lets us check the behavior of all the methods necessary to return a
@@ -960,6 +971,24 @@ end
     end
   end
 
+  describe '#set_shadow_hash_data' do
+    let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
+
+    it 'should flush the plist data to disk on OS X < 10.15' do
+      allow(provider.class).to receive(:get_os_version).and_return('10.12')
+
+      expect(provider).to receive(:write_users_plist_to_disk)
+      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
+    end
+
+    it 'should flush the plist data a temporary file on OS X >= 10.15' do
+      allow(provider.class).to receive(:get_os_version).and_return('10.15')
+
+      expect(provider).to receive(:write_and_import_shadow_hash_data)
+      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
+    end
+  end
+
   describe '#set_salted_pbkdf2' do
     let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
     let(:entropy_shadow_hash_data) do
@@ -1011,6 +1040,18 @@ end
     end
   end
 
+  describe '#write_and_import_shadow_hash_data' do
+    it 'should save the passed plist to a temporary file and import it' do
+      tmpfile = double('tempfile', :path => "/tmp/dsimport_#{username}", :flush => nil)
+      allow(Tempfile).to receive(:create).and_yield(tmpfile)
+      allow(provider).to receive(:dscl).with('.', 'delete', user_path, 'ShadowHashData')
+
+      expect(tmpfile).to receive(:write).with(dsimport_contents)
+      expect(provider).to receive(:dsimport).with(tmpfile.path, '/Local/Default', 'M')
+      provider.write_and_import_shadow_hash_data(sha512_embedded_bplist)
+    end
+  end
+
   describe '#merge_attribute_with_dscl' do
     it 'should raise an error if a dscl command raises an error' do
       expect(provider).to receive(:dscl).with('.', '-merge', user_path, 'GeneratedUID', 'GUID').and_raise(Puppet::ExecutionFailure, 'boom')

data/spec/unit/provider/user/hpux_spec.rb

@@ -56,14 +56,14 @@ describe Puppet::Type.type(:user).provider(:hpuxuseradd), :unless => Puppet.feat
     it "should add modprpw to modifycmd if Trusted System" do
       allow(resource).to receive(:allowdupe?).and_return(true)
       expect(provider).to receive(:exec_getprpw).with('root','-m uid').and_return('uid=0')
-      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-u', 1000, '-o', 'testuser', '-F', ';', '/usr/lbin/modprpw', '-v', '-l', 'testuser'], hash_including(custom_environment: {}))
+      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-F', '-u', 1000, '-o', 'testuser', ';', '/usr/lbin/modprpw', '-v', '-l', 'testuser'], hash_including(custom_environment: {}))
       provider.uid = 1000
     end
 
     it "should not add modprpw if not Trusted System" do
       allow(resource).to receive(:allowdupe?).and_return(true)
       expect(provider).to receive(:exec_getprpw).with('root','-m uid').and_return('System is not trusted')
-      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-u', 1000, '-o', 'testuser', '-F'], hash_including(custom_environment: {}))
+      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-F', '-u', 1000, '-o', 'testuser'], hash_including(custom_environment: {}))
       provider.uid = 1000
     end
   end

data/spec/unit/provider/user/openbsd_spec.rb

@@ -45,6 +45,7 @@ describe Puppet::Type.type(:user).provider(:openbsd) do
   describe "#addcmd" do
     it "should return an array with the full command and expiry as MM/DD/YY" do
       allow(Facter).to receive(:value).with(:osfamily).and_return('OpenBSD')
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
       resource[:expiry] = "1997-06-01"
       expect(provider.addcmd).to eq(['/usr/sbin/useradd', '-e', 'June 01 1997', 'myuser'])
     end

data/spec/unit/provider/user/pw_spec.rb

@@ -1,4 +1,5 @@
 require 'spec_helper'
+require 'open3'
 
 RSpec::Matchers.define_negated_matcher :excluding, :include
 
@@ -81,6 +82,23 @@ describe Puppet::Type.type(:user).provider(:pw) do
       provider.create
     end
 
+    it "should call execute with sensitive true when the password property is set" do
+      Puppet::Util::Log.level = :debug
+      resource[:password] = "abc123"
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: true))
+      popen = double("popen", :puts => nil, :close => nil)
+      expect(Open3).to receive(:popen3).and_return(popen)
+      expect(popen).to receive(:puts).with("abc123")
+      provider.create
+      expect(@logs).not_to be_any {|log| log.level == :debug and log.message =~ /abc123/}
+    end
+
+    it "should call execute with sensitive false when a non-sensitive property is set" do
+      resource[:managehome] = true
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: false))
+      provider.create
+    end
+
     it "should use -s with the correct argument when the shell property is set" do
       resource[:shell] = "/bin/sh"
       expect(provider).to receive(:execute).with(include("-s").and(include("/bin/sh")), kind_of(Hash))
@@ -209,5 +227,24 @@ describe Puppet::Type.type(:user).provider(:pw) do
       expect(provider).to receive(:execute).with(include("-u").and(include(54321)), hash_including(custom_environment: {}))
       provider.uid = 54321
     end
+
+    it "should print a debug message with sensitive data redacted when the password property is set" do
+      Puppet::Util::Log.level = :debug
+      resource[:password] = "*"
+      popen = double("popen", :puts => nil, :close => nil)
+      expect(Open3).to receive(:popen3).and_return(popen)
+      expect(popen).to receive(:puts).with("abc123")
+      provider.password = "abc123"
+
+      expect(@logs).not_to be_any {|log| log.level == :debug and log.message =~ /abc123/}
+     end
+
+    it "should call execute with sensitive false when a non-sensitive property is set" do
+      Puppet::Util::Log.level = :debug
+      resource[:home] = "/home/testuser"
+      resource[:managehome] = true
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: false))
+      provider.home = "/newhome/testuser"
+    end
   end
 end

data/spec/unit/provider/user/useradd_spec.rb

@@ -44,29 +44,54 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       allow(provider).to receive(:exists?).and_return(false)
     end
 
-    it "should add -g when no gid is specified and group already exists" do
-      allow(Puppet::Util).to receive(:gid).and_return(true)
+    it "should not redact the command from debug logs if there is no password" do
+      described_class.has_feature :manages_passwords
       resource[:ensure] = :present
-      expect(provider).to receive(:execute).with(include('-g'), kind_of(Hash))
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: false))
       provider.create
     end
 
-    it "should use -G to set groups" do
-      allow(Facter).to receive(:value).with(:osfamily).and_return('Not RedHat')
-      resource[:ensure] = :present
-      resource[:groups] = ['group1', 'group2']
-      expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', 'myuser'], kind_of(Hash))
+    it "should redact the command from debug logs if there is a password" do
+      described_class.has_feature :manages_passwords
+      resource2 = Puppet::Type.type(:user).new(
+        :name       => 'myuser',
+        :password   => 'a pass word',
+        :managehome => :false,
+        :system     => :false,
+        :provider   => provider,
+      )
+      resource2[:ensure] = :present
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: true))
       provider.create
     end
 
-    it "should use -G to set groups without -M on RedHat" do
-      allow(Facter).to receive(:value).with(:osfamily).and_return('RedHat')
+    it "should add -g when no gid is specified and group already exists" do
+      allow(Puppet::Util).to receive(:gid).and_return(true)
       resource[:ensure] = :present
-      resource[:groups] = ['group1', 'group2']
-      expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', '-M', 'myuser'], kind_of(Hash))
+      expect(provider).to receive(:execute).with(include('-g'), kind_of(Hash))
       provider.create
     end
 
+    context "when setting groups" do
+      it "uses -G to set groups" do
+        allow(Facter).to receive(:value).with(:osfamily).and_return('Solaris')
+        allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
+        resource[:ensure] = :present
+        resource[:groups] = ['group1', 'group2']
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', 'myuser'], kind_of(Hash))
+        provider.create
+      end
+
+      it "uses -G to set groups with -M on supported systems" do
+        allow(Facter).to receive(:value).with(:osfamily).and_return('RedHat')
+        allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
+        resource[:ensure] = :present
+        resource[:groups] = ['group1', 'group2']
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', '-M', 'myuser'], kind_of(Hash))
+        provider.create
+      end
+    end
+
     it "should add -o when allowdupe is enabled and the user is being created" do
       resource[:allowdupe] = true
       expect(provider).to receive(:execute).with(include('-o'), kind_of(Hash))
@@ -165,6 +190,27 @@ describe Puppet::Type.type(:user).provider(:useradd) do
     end
   end
 
+  describe 'when modifying the password' do
+    before do
+      described_class.has_feature :libuser
+      described_class.has_feature :manages_passwords
+      #Setting any resource value here initializes needed variables and methods in the resource and provider
+      #Setting a password value here initializes the existence and management of the password parameter itself
+      #Otherwise, this value would not need to be initialized for the test
+      resource[:password] = ''
+    end
+
+    it "should not call execute with sensitive if non-sensitive data is changed" do
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: false))
+      provider.home = 'foo/bar'
+    end
+
+    it "should call execute with sensitive if sensitive data is changed" do
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: true))
+      provider.password = 'bird bird bird'
+    end
+  end
+
   describe '#modify' do
     describe "on systems with the libuser and forcelocal=false" do
       before do
@@ -273,6 +319,65 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '', 'myuser'], hash_including(custom_environment: {}))
       provider.expiry = :absent
     end
+
+    it "should use -e with -1 when the expiry property is removed on SLES11" do
+      allow(Facter).to receive(:value).with(:operatingsystem).and_return('SLES')
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return('11')
+      resource[:expiry] = :absent
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', -1, 'myuser'], hash_including(custom_environment: {}))
+      provider.expiry = :absent
+    end
+  end
+
+  describe "#comment" do
+    before { described_class.has_feature :libuser }
+
+    let(:content) { "myuser:x:x:x:local comment:x:x" }
+
+    it "should return the local comment string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(File).to receive(:read).with('/etc/passwd').and_return(content)
+      expect(provider.comment).to eq('local comment')
+    end
+
+    it "should fall back to nameservice comment string when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:comment).and_return('remote comment')
+      expect(provider).not_to receive(:localcomment)
+      expect(provider.comment).to eq('remote comment')
+    end
+  end
+
+  describe "#finduser" do
+    before { allow(File).to receive(:read).with('/etc/passwd').and_return(content) }
+
+    let(:content) { "sample_account:sample_password:sample_uid:sample_gid:sample_gecos:sample_directory:sample_shell" }
+    let(:output) do
+      {
+        account: 'sample_account',
+        password: 'sample_password',
+        uid: 'sample_uid',
+        gid: 'sample_gid',
+        gecos: 'sample_gecos',
+        directory: 'sample_directory',
+        shell: 'sample_shell',
+      }
+    end
+
+    [:account, :password, :uid, :gid, :gecos, :directory, :shell].each do |key|
+      it "finds an user by #{key} when asked" do
+        expect(provider.finduser(key, "sample_#{key}")).to eq(output)
+      end
+    end
+
+    it "returns false when specified key/value pair is not found" do
+      expect(provider.finduser(:account, 'invalid_account')).to eq(false)
+    end
+
+    it "reads the user file only once per resource" do
+      expect(File).to receive(:read).with('/etc/passwd').once
+      5.times { provider.finduser(:account, 'sample_account') }
+    end
   end
 
   describe "#check_allow_dup" do
@@ -328,15 +433,17 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       provider.delete
     end
 
-    it "should use -M flag if home is not managed and on Redhat" do
+    it "should use -M flag if home is not managed on a supported system" do
       allow(Facter).to receive(:value).with(:osfamily).and_return("RedHat")
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
       resource[:managehome] = :false
       expect(provider).to receive(:execute).with(include('-M'), kind_of(Hash))
       provider.create
     end
 
-    it "should not use -M flag if home is not managed and not on Redhat" do
-      allow(Facter).to receive(:value).with(:osfamily).and_return("not RedHat")
+    it "should not use -M flag if home is not managed on an unsupported system" do
+      allow(Facter).to receive(:value).with(:osfamily).and_return("Suse")
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return("11")
       resource[:managehome] = :false
       expect(provider).to receive(:execute).with(excluding('-M'), kind_of(Hash))
       provider.create

data/spec/unit/provider/user/windows_adsi_spec.rb

@@ -78,9 +78,9 @@ describe Puppet::Type.type(:user).provider(:windows_adsi), :if => Puppet.feature
     let(:group3) { double(:account => 'group3', :domain => '.', :sid => 'group3sid') }
 
     before :each do
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group1').and_return(group1)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group2').and_return(group2)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group3').and_return(group3)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group1', any_args).and_return(group1)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group2', any_args).and_return(group2)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group3', any_args).and_return(group3)
     end
 
     it "should return true for same lists of members" do

data/spec/unit/puppet_pal_2pec.rb

@@ -714,6 +714,9 @@ describe 'Puppet Pal' do
 
       context 'facts are supported such that' do
         it 'they are obtained if they are not given' do
+          facts = Puppet::Node::Facts.new(Puppet[:certname], 'puppetversion' => Puppet.version)
+          Puppet::Node::Facts.indirection.save(facts)
+
           testing_env_dir # creates the structure
           result = Puppet::Pal.in_tmp_environment('pal_env', modulepath: modulepath ) do |ctx|
             ctx.with_script_compiler {|c| c.evaluate_string("$facts =~ Hash and $facts[puppetversion] == '#{Puppet.version}'") }

data/spec/unit/resource_spec.rb

@@ -747,7 +747,8 @@ describe Puppet::Resource do
       @resource = Puppet::Resource.new("one::two", "/my/file",
         :parameters => {
           :noop => true,
-          :foo => %w{one two},
+          :foo => [:one, "two"],
+          :bar => 'a\'b',
           :ensure => 'present',
         }
       )
@@ -757,10 +758,34 @@ describe Puppet::Resource do
       expect(@resource.to_hierayaml).to eq <<-HEREDOC.gsub(/^\s{8}/, '')
           /my/file:
             ensure: 'present'
+            bar   : 'a\\'b'
             foo   : ['one', 'two']
             noop  : true
       HEREDOC
     end
+
+    it "should convert some types to String" do
+      expect(@resource.to_hiera_hash).to eq(
+        "/my/file" => {
+          'ensure' => "present",
+          'bar'    => "a'b",
+          'foo'    => ["one", "two"],
+          'noop'   => true
+        }
+      )
+    end
+
+    it "accepts symbolic titles" do
+      res = Puppet::Resource.new(:file, "/my/file", :parameters => { 'ensure' => "present" })
+
+      expect(res.to_hiera_hash.keys).to eq(["/my/file"])
+    end
+
+    it "emits an empty parameters hash" do
+      res = Puppet::Resource.new(:file, "/my/file")
+
+      expect(res.to_hiera_hash).to eq({"/my/file" => {}})
+    end
   end
   describe "when converting to json" do
     # LAK:NOTE For all of these tests, we convert back to the resource so we can

data/spec/unit/ssl/certificate_authority_spec.rb

@@ -876,9 +876,8 @@ describe Puppet::SSL::CertificateAuthority do
         @ca.verify("me")
       end
 
-      it "should set the store purpose to OpenSSL::X509::PURPOSE_SSL_CLIENT" do
-        Puppet[:cacert] = cacert
-        expect(@store).to receive(:add_file).with(cacert)
+      it "should set the store purpose to OpenSSL::X509::PURPOSE_ANY" do
+        expect(@store).to receive(:purpose=).with OpenSSL::X509::PURPOSE_ANY
 
         @ca.verify("me")
       end

data/spec/unit/ssl/certificate_spec.rb

@@ -138,6 +138,13 @@ describe Puppet::SSL::Certificate do
         expect(cert.custom_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'x509 :(')
       end
 
+      it "returns extensions under the ppAuthCertExt" do
+        exts = {'pp_auth_role' => 'taketwo'}
+        cert = build_cert(:extension_requests => exts)
+        sign_wrapped_cert(cert)
+        expect(cert.custom_extensions).to include('oid' => 'pp_auth_role', 'value' => 'taketwo')
+      end
+
       it "doesn't return standard extensions" do
         cert = build_cert(:dns_alt_names => 'foo')
         expect(cert.custom_extensions).to be_empty