puppet 5.5.16 → 5.5.21

data/spec/unit/test/test_helper_spec.rb

@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe "TestHelper" do
+  context "#after_each_test" do
+    it "restores the original environment" do
+      varname = 'test_helper_spec-test_variable'
+      Puppet::Util.set_env(varname, "\u16A0")
+
+      expect(Puppet::Util.get_env(varname)).to eq("\u16A0")
+
+      # Prematurely trigger the after_each_test method
+      Puppet::Test::TestHelper.after_each_test
+
+      expect(Puppet::Util::get_env(varname)).to be_nil
+    end
+  end
+end

data/spec/unit/transaction_spec.rb

@@ -778,6 +778,24 @@ describe Puppet::Transaction do
 
       transaction.evaluate
     end
+
+    it "should call Selinux.matchpathcon_fini in case Selinux is enabled ", :if => Puppet.features.posix? do
+      unless defined?(Selinux)
+        module Selinux
+          def self.is_selinux_enabled
+            true
+          end
+        end
+      end
+
+      resource = Puppet::Type.type(:file).new(:path => make_absolute("/tmp/foo"))
+      transaction = transaction_with_resource(resource)
+
+      expect(Selinux).to receive(:matchpathcon_fini)
+      expect(Puppet::Util::SELinux).to receive(:selinux_support?).and_return(true)
+
+      transaction.evaluate
+    end
   end
 
   describe 'when checking application run state' do

data/spec/unit/type/exec_spec.rb

@@ -150,16 +150,13 @@ RSpec.describe Puppet::Type.type(:exec) do
         end
       end
 
-      it "should redact the command on failure" do
+      it "should redact the sensitive command on failure" do
         output = "output1\noutput2\n"
         expect { exec_tester('false', 1, :output => output, :logoutput => :on_failure, :sensitive_parameters => [:command]).refresh }.
             to raise_error(Puppet::Error, /^\[command redacted\] returned 1 instead of/)
 
-        output.split("\n").each do |line|
-          log = @logs.shift
-          expect(log.level).to eq(:err)
-          expect(log.message).to eq(line)
-        end
+        expect(@logs).to include(an_object_having_attributes(level: :err, message: '[output redacted]'))
+        expect(@logs).to_not include(an_object_having_attributes(message: /output1|output2/))
       end
 
       it "should log the output on failure when returns is specified as an array" do
@@ -177,7 +174,7 @@ RSpec.describe Puppet::Type.type(:exec) do
         end
       end
 
-      it "should redact the command on failure when returns is specified as an array" do
+      it "should redact the sensitive command on failure when returns is specified as an array" do
         output = "output1\noutput2\n"
 
         expect {
@@ -185,11 +182,8 @@ RSpec.describe Puppet::Type.type(:exec) do
                       :logoutput => :on_failure, :sensitive_parameters => [:command]).refresh
         }.to raise_error(Puppet::Error, /^\[command redacted\] returned 1 instead of/)
 
-        output.split("\n").each do |line|
-          log = @logs.shift
-          expect(log.level).to eq(:err)
-          expect(log.message).to eq(line)
-        end
+        expect(@logs).to include(an_object_having_attributes(level: :err, message: '[output redacted]'))
+        expect(@logs).to_not include(an_object_having_attributes(message: /output1|output2/))
       end
 
       it "shouldn't log the output on success" do
@@ -755,6 +749,15 @@ RSpec.describe Puppet::Type.type(:exec) do
           expect(@test.check_all_attributes).to eq(true)
           expect(@logs.shift.message).to eq("test output")
         end
+
+        it "should not emit output to debug if sensitive is true" do
+          Puppet::Util::Log.level = :debug
+          @test[param] = @fail
+          allow(@test.parameters[param]).to receive(:sensitive).and_return(true)
+          expect(@test.check_all_attributes).to eq(true)
+          expect(@logs).not_to include(an_object_having_attributes(level: :debug, message: "test output"))
+          expect(@logs).to include(an_object_having_attributes(level: :debug, message: "[output redacted]"))
+        end
       end
     end
   end

data/spec/unit/type/file/content_spec.rb

@@ -200,15 +200,21 @@ describe Puppet::Type.type(:file).attrclass(:content), :uses_checksums => true d
             end
 
             it "prints the diff" do
-              expect(content).to receive(:diff).and_return("my diff").once
-              expect(content).to receive(:debug).with("\nmy diff").once
+              expect(content).to receive(:diff).and_return("my diff")
+              expect(content).to receive(:debug).with("\nmy diff")
+              expect(content).not_to be_safe_insync("other content")
+            end
+
+            it "prints binary file notice if diff is not valid encoding" do
+              expect(content).to receive(:diff).and_return("\xc7\xd1\xfc\x84")
+              expect(content).to receive(:debug).with(/\nBinary files #{filename} and .* differ/)
               expect(content).not_to be_safe_insync("other content")
             end
 
             it "redacts the diff when the property is sensitive" do
               content.sensitive = true
               expect(content).not_to receive(:diff)
-              expect(content).to receive(:debug).with("[diff redacted]").once
+              expect(content).to receive(:debug).with("[diff redacted]")
               expect(content).not_to be_safe_insync("other content")
             end
           end

data/spec/unit/type/file/source_spec.rb

@@ -34,11 +34,11 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
     it "should fail if the set values are not URLs" do
       expect(URI).to receive(:parse).with('foo').and_raise(RuntimeError)
 
-      expect(lambda { resource[:source] = %w{foo} }).to raise_error(Puppet::Error)
+      expect { resource[:source] = %w{foo} }.to raise_error(Puppet::Error)
     end
 
     it "should fail if the URI is not a local file, file URI, or puppet URI" do
-      expect(lambda { resource[:source] = %w{ftp://foo/bar} }).to raise_error(Puppet::Error, /Cannot use URLs of type 'ftp' as source for fileserving/)
+      expect { resource[:source] = %w{ftp://foo/bar} }.to raise_error(Puppet::Error, /Cannot use URLs of type 'ftp' as source for fileserving/)
     end
 
     it "should strip trailing forward slashes", :unless => Puppet.features.microsoft_windows? do
@@ -61,11 +61,11 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
     end
 
     it "should reject relative URI sources" do
-      expect(lambda { resource[:source] = 'foo/bar' }).to raise_error(Puppet::Error)
+      expect { resource[:source] = 'foo/bar' }.to raise_error(Puppet::Error)
     end
 
     it "should reject opaque sources" do
-      expect(lambda { resource[:source] = 'mailto:foo@com' }).to raise_error(Puppet::Error)
+      expect { resource[:source] = 'mailto:foo@com' }.to raise_error(Puppet::Error)
     end
 
     it "should accept URI authority component" do

data/spec/unit/type/file_spec.rb

@@ -477,6 +477,9 @@ describe Puppet::Type.type(:file) do
   end
 
   describe "#recurse" do
+    let(:name) { 'bar' }
+    let(:child) { double('puppet_type_file') }
+
     before do
       file[:recurse] = true
       @metadata = Puppet::FileServing::Metadata
@@ -485,8 +488,9 @@ describe Puppet::Type.type(:file) do
     describe "and a source is set" do
       it "should pass the already-discovered resources to recurse_remote" do
         file[:source] = File.expand_path(__FILE__)
-        allow(file).to receive(:recurse_local).and_return(:foo => "bar")
-        expect(file).to receive(:recurse_remote).with(:foo => "bar").and_return([])
+        allow(child).to receive(:[]).with(:path).and_return(name)
+        allow(file).to receive(:recurse_local).and_return(name => child)
+        expect(file).to receive(:recurse_remote).with(name => child).and_return([])
         file.recurse
       end
     end
@@ -494,8 +498,9 @@ describe Puppet::Type.type(:file) do
     describe "and a target is set" do
       it "should use recurse_link" do
         file[:target] = File.expand_path(__FILE__)
-        allow(file).to receive(:recurse_local).and_return(:foo => "bar")
-        expect(file).to receive(:recurse_link).with(:foo => "bar").and_return([])
+        allow(child).to receive(:[]).with(:path).and_return(name)
+        allow(file).to receive(:recurse_local).and_return(name => child)
+        expect(file).to receive(:recurse_link).with(name => child).and_return([])
         file.recurse
       end
     end

data/spec/unit/type/package_spec.rb

@@ -30,6 +30,10 @@ describe Puppet::Type.type(:package) do
     expect(Puppet::Type.type(:package).provider_feature(:versionable)).not_to be_nil
   end
 
+  it "should have a :supports_flavors feature" do
+    expect(Puppet::Type.type(:package).provider_feature(:supports_flavors)).not_to be_nil
+  end
+
   it "should have a :package_settings feature that requires :package_settings_insync?, :package_settings and :package_settings=" do
     expect(Puppet::Type.type(:package).provider_feature(:package_settings).methods).to eq([:package_settings_insync?, :package_settings, :package_settings=])
   end
@@ -53,6 +57,10 @@ describe Puppet::Type.type(:package) do
     it "should have a package_settings property" do
       expect(Puppet::Type.type(:package).attrtype(:package_settings)).to eq(:property)
     end
+
+    it "should have a flavor property" do
+      expect(Puppet::Type.type(:package).attrtype(:flavor)).to eq(:property)
+    end
   end
 
   describe "when validating attribute values" do

data/spec/unit/type/schedule_spec.rb

@@ -446,7 +446,9 @@ describe Puppet::Type.type(:schedule) do
 
     it "should fail if the periodmatch is 'number'" do
       @schedule[:periodmatch] = :number
-      expect(proc { @schedule[:repeat] = 2 }).to raise_error(Puppet::Error)
+      expect {
+        @schedule[:repeat] = 2
+      }.to raise_error(Puppet::Error)
     end
 
     it "should match if the previous run was further away than the distance divided by the repeat" do

data/spec/unit/type/selboolean_spec.rb

@@ -24,12 +24,10 @@ describe Puppet::Type.type(:selboolean), "when validating values" do
     allow(@provider_class).to receive(:new).and_return(@provider)
   end
 
-  it "should support :on as a value to :value" do
-    Puppet::Type.type(:selboolean).new(:name => "yay", :value => :on)
-  end
-
-  it "should support :off as a value to :value" do
-    Puppet::Type.type(:selboolean).new(:name => "yay", :value => :off)
+  [:on, :off, :true, :false, true, false].each do |val|
+    it "should support #{val.inspect} as a value to :value" do
+      Puppet::Type.type(:selboolean).new(:name => "yay", :value => val)
+    end
   end
 
   it "should support :true as a value to :persistent" do

data/spec/unit/type/service_spec.rb

@@ -75,6 +75,13 @@ describe Puppet::Type.type(:service), "when validating attribute values" do
       expect(srv.should(:enable)).to eq(:manual)
     end
 
+    it "should support :delayed as a value on Windows" do
+      allow(Puppet.features).to receive(:microsoft_windows?).and_return(true)
+
+      srv = Puppet::Type.type(:service).new(:name => "yay", :enable => :delayed)
+      expect(srv.should(:enable)).to eq(:delayed)
+    end
+
     it "should not support :manual as a value when not on Windows" do
       allow(Puppet.features).to receive(:microsoft_windows?).and_return(false)
 
@@ -83,6 +90,15 @@ describe Puppet::Type.type(:service), "when validating attribute values" do
         /Setting enable to manual is only supported on Microsoft Windows\./
       )
     end
+
+    it "should not support :delayed as a value when not on Windows" do
+      allow(Puppet.features).to receive(:microsoft_windows?).and_return(false)
+
+      expect { Puppet::Type.type(:service).new(:name => "yay", :enable => :delayed) }.to raise_error(
+        Puppet::Error,
+        /Setting enable to delayed is only supported on Microsoft Windows\./
+      )
+    end
   end
 
   it "should support :true as a value to :hasstatus" do
@@ -218,20 +234,21 @@ describe Puppet::Type.type(:service), "when changing the host" do
     @service.property(:enable).sync
   end
 
-  it "should always consider the enable state of a static service to be in sync" do
+  it "should let superclass implementation resolve insyncness when provider does not respond to the 'enabled_insync?' method" do
     allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
-    expect(@service.provider).to receive(:cached_enabled?).and_return('static')
-    @service[:enable] = false
-    expect(Puppet).to receive(:debug).with("Unable to enable or disable static service yay")
+    @service[:enable] = true
+    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?).and_return(false)
+
     expect(@service.property(:enable).insync?(:true)).to eq(true)
   end
 
-  it "should determine insyncness normally when the service is not static" do
+  it "insyncness should be resolved by provider instead of superclass implementation when provider responds to the 'enabled_insync?' method" do
     allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
-    expect(@service.provider).to receive(:cached_enabled?).and_return('true')
     @service[:enable] = true
-    expect(Puppet).not_to receive(:debug)
-    expect(@service.property(:enable).insync?(:true)).to eq(true)
+    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?).and_return(true)
+    allow(@service.provider).to receive(:enabled_insync?).and_return(false)
+
+    expect(@service.property(:enable).insync?(:true)).to eq(false)
   end
 
   it "should sync the service's enable state when changing the state of :ensure if :enable is being managed" do

data/spec/unit/type/user_spec.rb

@@ -1,4 +1,4 @@
-# encoding: UTF-8
+# encoding: utf-8
 require 'spec_helper'
 
 describe Puppet::Type.type(:user) do
@@ -323,24 +323,24 @@ describe Puppet::Type.type(:user) do
   end
 
   describe "when managing passwords" do
-    before do
-      @password = described_class.new(:name => 'foo', :password => 'mypass').parameter(:password)
-    end
+    let(:transaction) { Puppet::Transaction.new(Puppet::Resource::Catalog.new, nil, nil) }
+    let(:harness) { Puppet::Transaction::ResourceHarness.new(transaction) }
+    let(:provider) { @provider_class.new(:name => 'foo', :ensure => :present) }
+    let(:resource) { described_class.new(:name => 'foo', :ensure => :present, :password => 'top secret', :provider => provider) }
 
     it "should not include the password in the change log when adding the password" do
-      expect(@password.change_to_s(:absent, "mypass")).not_to be_include("mypass")
+      status = harness.evaluate(resource)
+      sync_event = status.events[0]
+      expect(sync_event.message).not_to include('top secret')
+      expect(sync_event.message).to eql('changed [redacted] to [redacted]')
     end
 
     it "should not include the password in the change log when changing the password" do
-      expect(@password.change_to_s("other", "mypass")).not_to be_include("mypass")
-    end
-
-    it "should redact the password when displaying the old value" do
-      expect(@password.is_to_s("currentpassword")).to match(/^\[old password hash redacted\]$/)
-    end
-
-    it "should redact the password when displaying the new value" do
-      expect(@password.should_to_s("newpassword")).to match(/^\[new password hash redacted\]$/)
+      resource[:password] = 'super extra classified'
+      status = harness.evaluate(resource)
+      sync_event = status.events[0]
+      expect(sync_event.message).not_to include('super extra classified')
+      expect(sync_event.message).to eql('changed [redacted] to [redacted]')
     end
 
     it "should fail if a ':' is included in the password" do
@@ -484,22 +484,20 @@ describe Puppet::Type.type(:user) do
     end
 
     context "with no home directory specified" do
-      it "should not accept true" do
-        expect {
-          described_class.new(:name => "a", :purge_ssh_keys => true)
-        }.to raise_error(Puppet::Error, /purge_ssh_keys can only be true for users with a defined home directory/)
+      before(:each) do
+        allow(Dir).to receive(:home).with('a').and_return('/home/a')
       end
 
-      it "should not accept the ~ wildcard" do
-        expect {
-          described_class.new(:name => "a", :purge_ssh_keys => "~/keys")
-        }.to raise_error(Puppet::Error, /meta character ~ or %h only allowed for users with a defined home directory/)
+      it "should accept true" do
+        described_class.new(:name => "a", :purge_ssh_keys => true)
       end
 
-      it "should not accept the %h wildcard" do
-        expect {
-          described_class.new(:name => "a", :purge_ssh_keys => "%h/keys")
-        }.to raise_error(Puppet::Error, /meta character ~ or %h only allowed for users with a defined home directory/)
+      it "should accept the ~ wildcard" do
+        described_class.new(:name => "a", :purge_ssh_keys => "~/keys")
+      end
+
+      it "should accept the %h wildcard" do
+        described_class.new(:name => "a", :purge_ssh_keys => "%h/keys")
       end
     end
 
@@ -508,6 +506,10 @@ describe Puppet::Type.type(:user) do
         [ "/dev/null", "/tmp/keyfile" ].map { |path| File.expand_path(path) }
       end
 
+      before(:each) do
+        allow(Dir).to receive(:home).with('test').and_return('/home/test')
+      end
+
       subject do
         res = described_class.new(:name => "test", :purge_ssh_keys => paths)
         res.catalog = Puppet::Resource::Catalog.new
@@ -534,6 +536,10 @@ describe Puppet::Type.type(:user) do
         res
       end
 
+      before(:each) do
+        allow(Dir).to receive(:home).with('test_user_name').and_return('/home/test_user_name')
+      end
+
       context "when purging is disabled" do
         let(:purge_param) { false }
 

data/spec/unit/type/yumrepo_spec.rb

@@ -329,6 +329,36 @@ describe Puppet::Type.type(:yumrepo) do
 
     describe "proxy_password" do
       it_behaves_like "a yumrepo parameter that can be absent", :proxy_password
+
+      context "for password information in the logs" do
+        let(:transaction) { Puppet::Transaction.new(Puppet::Resource::Catalog.new, nil, nil) }
+        let(:harness) { Puppet::Transaction::ResourceHarness.new(transaction) }
+        let(:provider_class) { described_class.provide(:simple) do
+          mk_resource_methods
+          def create; end
+          def delete; end
+          def exists?; get(:ensure) != :absent; end
+          def flush; end
+          def self.instances; []; end
+        end
+        }
+        let(:provider) { provider_class.new(:name => 'foo', :ensure => :present) }
+        let(:resource) { described_class.new(:name => 'puppetlabs', :proxy_password => 'top secret', :provider => provider) }
+
+        it "redacts on creation" do
+          status = harness.evaluate(resource)
+          sync_event = status.events[0]
+          expect(sync_event.message).to eq 'changed [redacted] to [redacted]'
+        end
+
+        it "redacts on update" do
+          harness.evaluate(resource)
+          resource[:proxy_password] = 'super classified'
+          status = harness.evaluate(resource)
+          sync_event = status.events[0]
+          expect(sync_event.message).to eq 'changed [redacted] to [redacted]'
+        end
+      end
     end
 
     describe "s3_enabled" do

data/spec/unit/type_spec.rb

@@ -735,6 +735,46 @@ describe Puppet::Type, :unless => Puppet.features.microsoft_windows? do
     end
   end
 
+  describe "#set_sensitive_parameters" do
+    let(:sensitive_type) do
+      Puppet::Type.newtype(:sensitive_test) do
+        newparam(:name) { isnamevar }
+        newproperty(:secret) do
+          newvalues(/.*/)
+          sensitive true
+        end
+        newproperty(:transparency) do
+          newvalues(/.*/)
+          sensitive false
+        end
+        newproperty(:things) { newvalues(/.*/) }
+      end
+    end
+
+    it "should mark properties as sensitive" do
+      resource = sensitive_type.new(:name => 'foo', :secret => 'uber classified')
+      expect(resource.parameters[:secret].sensitive).to be true
+    end
+
+    it "should not have a sensitive flag when not set" do
+      resource = sensitive_type.new(:name => 'foo', :things => '1337')
+      expect(resource.parameters[:things].sensitive).to be_nil
+    end
+
+    it "should define things as not sensitive" do
+      resource = sensitive_type.new(:name => 'foo', :transparency => 'public knowledge')
+      expect(resource.parameters[:transparency].sensitive).to be false
+    end
+
+    it "should honor when sensitivity is set in a manifest" do
+      resource = sensitive_type.new(:name => 'foo',
+                                    :transparency => Puppet::Pops::Types::PSensitiveType::Sensitive.new('top secret'),
+                                    :sensitive_parameters => [:transparency]
+                                    )
+      expect(resource.parameters[:transparency].sensitive).to be true
+    end
+  end
+
   describe "when #finish is called on a type" do
     let(:post_hook_type) do
       Puppet::Type.newtype(:finish_test) do