puppet 5.5.17-universal-darwin → 5.5.22-universal-darwin

data/spec/unit/provider/user/directoryservice_spec.rb

@@ -196,6 +196,17 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     }
   end
 
+  let (:dsimport_preamble) do
+    '0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData'
+  end
+
+  let (:dsimport_contents) do
+    <<-DSIMPORT
+#{dsimport_preamble}
+#{username}:#{Base64.strict_encode64(sha512_embedded_bplist)}
+    DSIMPORT
+  end
+
   # The below represents output of 'dscl -plist . readall /Users' converted to
   # a native Ruby hash if only one user were installed on the system.
   # This lets us check the behavior of all the methods necessary to return a
@@ -960,6 +971,24 @@ end
     end
   end
 
+  describe '#set_shadow_hash_data' do
+    let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
+
+    it 'should flush the plist data to disk on OS X < 10.15' do
+      allow(provider.class).to receive(:get_os_version).and_return('10.12')
+
+      expect(provider).to receive(:write_users_plist_to_disk)
+      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
+    end
+
+    it 'should flush the plist data a temporary file on OS X >= 10.15' do
+      allow(provider.class).to receive(:get_os_version).and_return('10.15')
+
+      expect(provider).to receive(:write_and_import_shadow_hash_data)
+      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
+    end
+  end
+
   describe '#set_salted_pbkdf2' do
     let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
     let(:entropy_shadow_hash_data) do
@@ -1011,6 +1040,18 @@ end
     end
   end
 
+  describe '#write_and_import_shadow_hash_data' do
+    it 'should save the passed plist to a temporary file and import it' do
+      tmpfile = double('tempfile', :path => "/tmp/dsimport_#{username}", :flush => nil)
+      allow(Tempfile).to receive(:create).and_yield(tmpfile)
+      allow(provider).to receive(:dscl).with('.', 'delete', user_path, 'ShadowHashData')
+
+      expect(tmpfile).to receive(:write).with(dsimport_contents)
+      expect(provider).to receive(:dsimport).with(tmpfile.path, '/Local/Default', 'M')
+      provider.write_and_import_shadow_hash_data(sha512_embedded_bplist)
+    end
+  end
+
   describe '#merge_attribute_with_dscl' do
     it 'should raise an error if a dscl command raises an error' do
       expect(provider).to receive(:dscl).with('.', '-merge', user_path, 'GeneratedUID', 'GUID').and_raise(Puppet::ExecutionFailure, 'boom')

data/spec/unit/provider/user/hpux_spec.rb

@@ -56,14 +56,14 @@ describe Puppet::Type.type(:user).provider(:hpuxuseradd), :unless => Puppet.feat
     it "should add modprpw to modifycmd if Trusted System" do
       allow(resource).to receive(:allowdupe?).and_return(true)
       expect(provider).to receive(:exec_getprpw).with('root','-m uid').and_return('uid=0')
-      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-u', 1000, '-o', 'testuser', '-F', ';', '/usr/lbin/modprpw', '-v', '-l', 'testuser'], hash_including(custom_environment: {}))
+      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-F', '-u', 1000, '-o', 'testuser', ';', '/usr/lbin/modprpw', '-v', '-l', 'testuser'], hash_including(custom_environment: {}))
       provider.uid = 1000
     end
 
     it "should not add modprpw if not Trusted System" do
       allow(resource).to receive(:allowdupe?).and_return(true)
       expect(provider).to receive(:exec_getprpw).with('root','-m uid').and_return('System is not trusted')
-      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-u', 1000, '-o', 'testuser', '-F'], hash_including(custom_environment: {}))
+      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-F', '-u', 1000, '-o', 'testuser'], hash_including(custom_environment: {}))
       provider.uid = 1000
     end
   end

data/spec/unit/provider/user/openbsd_spec.rb

@@ -45,6 +45,7 @@ describe Puppet::Type.type(:user).provider(:openbsd) do
   describe "#addcmd" do
     it "should return an array with the full command and expiry as MM/DD/YY" do
       allow(Facter).to receive(:value).with(:osfamily).and_return('OpenBSD')
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
       resource[:expiry] = "1997-06-01"
       expect(provider.addcmd).to eq(['/usr/sbin/useradd', '-e', 'June 01 1997', 'myuser'])
     end

data/spec/unit/provider/user/useradd_spec.rb

@@ -72,20 +72,24 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       provider.create
     end
 
-    it "should use -G to set groups" do
-      allow(Facter).to receive(:value).with(:osfamily).and_return('Not RedHat')
-      resource[:ensure] = :present
-      resource[:groups] = ['group1', 'group2']
-      expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', 'myuser'], kind_of(Hash))
-      provider.create
-    end
+    context "when setting groups" do
+      it "uses -G to set groups" do
+        allow(Facter).to receive(:value).with(:osfamily).and_return('Solaris')
+        allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
+        resource[:ensure] = :present
+        resource[:groups] = ['group1', 'group2']
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', 'myuser'], kind_of(Hash))
+        provider.create
+      end
 
-    it "should use -G to set groups without -M on RedHat" do
-      allow(Facter).to receive(:value).with(:osfamily).and_return('RedHat')
-      resource[:ensure] = :present
-      resource[:groups] = ['group1', 'group2']
-      expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', '-M', 'myuser'], kind_of(Hash))
-      provider.create
+      it "uses -G to set groups with -M on supported systems" do
+        allow(Facter).to receive(:value).with(:osfamily).and_return('RedHat')
+        allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
+        resource[:ensure] = :present
+        resource[:groups] = ['group1', 'group2']
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', '-M', 'myuser'], kind_of(Hash))
+        provider.create
+      end
     end
 
     it "should add -o when allowdupe is enabled and the user is being created" do
@@ -315,6 +319,65 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '', 'myuser'], hash_including(custom_environment: {}))
       provider.expiry = :absent
     end
+
+    it "should use -e with -1 when the expiry property is removed on SLES11" do
+      allow(Facter).to receive(:value).with(:operatingsystem).and_return('SLES')
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return('11')
+      resource[:expiry] = :absent
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', -1, 'myuser'], hash_including(custom_environment: {}))
+      provider.expiry = :absent
+    end
+  end
+
+  describe "#comment" do
+    before { described_class.has_feature :libuser }
+
+    let(:content) { "myuser:x:x:x:local comment:x:x" }
+
+    it "should return the local comment string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(File).to receive(:read).with('/etc/passwd').and_return(content)
+      expect(provider.comment).to eq('local comment')
+    end
+
+    it "should fall back to nameservice comment string when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:comment).and_return('remote comment')
+      expect(provider).not_to receive(:localcomment)
+      expect(provider.comment).to eq('remote comment')
+    end
+  end
+
+  describe "#finduser" do
+    before { allow(File).to receive(:read).with('/etc/passwd').and_return(content) }
+
+    let(:content) { "sample_account:sample_password:sample_uid:sample_gid:sample_gecos:sample_directory:sample_shell" }
+    let(:output) do
+      {
+        account: 'sample_account',
+        password: 'sample_password',
+        uid: 'sample_uid',
+        gid: 'sample_gid',
+        gecos: 'sample_gecos',
+        directory: 'sample_directory',
+        shell: 'sample_shell',
+      }
+    end
+
+    [:account, :password, :uid, :gid, :gecos, :directory, :shell].each do |key|
+      it "finds an user by #{key} when asked" do
+        expect(provider.finduser(key, "sample_#{key}")).to eq(output)
+      end
+    end
+
+    it "returns false when specified key/value pair is not found" do
+      expect(provider.finduser(:account, 'invalid_account')).to eq(false)
+    end
+
+    it "reads the user file only once per resource" do
+      expect(File).to receive(:read).with('/etc/passwd').once
+      5.times { provider.finduser(:account, 'sample_account') }
+    end
   end
 
   describe "#check_allow_dup" do
@@ -370,15 +433,17 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       provider.delete
     end
 
-    it "should use -M flag if home is not managed and on Redhat" do
+    it "should use -M flag if home is not managed on a supported system" do
       allow(Facter).to receive(:value).with(:osfamily).and_return("RedHat")
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
       resource[:managehome] = :false
       expect(provider).to receive(:execute).with(include('-M'), kind_of(Hash))
       provider.create
     end
 
-    it "should not use -M flag if home is not managed and not on Redhat" do
-      allow(Facter).to receive(:value).with(:osfamily).and_return("not RedHat")
+    it "should not use -M flag if home is not managed on an unsupported system" do
+      allow(Facter).to receive(:value).with(:osfamily).and_return("Suse")
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return("11")
       resource[:managehome] = :false
       expect(provider).to receive(:execute).with(excluding('-M'), kind_of(Hash))
       provider.create

data/spec/unit/provider/user/windows_adsi_spec.rb

@@ -78,9 +78,9 @@ describe Puppet::Type.type(:user).provider(:windows_adsi), :if => Puppet.feature
     let(:group3) { double(:account => 'group3', :domain => '.', :sid => 'group3sid') }
 
     before :each do
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group1').and_return(group1)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group2').and_return(group2)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group3').and_return(group3)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group1', any_args).and_return(group1)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group2', any_args).and_return(group2)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('group3', any_args).and_return(group3)
     end
 
     it "should return true for same lists of members" do

data/spec/unit/puppet_pal_2pec.rb

@@ -714,6 +714,9 @@ describe 'Puppet Pal' do
 
       context 'facts are supported such that' do
         it 'they are obtained if they are not given' do
+          facts = Puppet::Node::Facts.new(Puppet[:certname], 'puppetversion' => Puppet.version)
+          Puppet::Node::Facts.indirection.save(facts)
+
           testing_env_dir # creates the structure
           result = Puppet::Pal.in_tmp_environment('pal_env', modulepath: modulepath ) do |ctx|
             ctx.with_script_compiler {|c| c.evaluate_string("$facts =~ Hash and $facts[puppetversion] == '#{Puppet.version}'") }

data/spec/unit/ssl/certificate_authority_spec.rb

@@ -876,9 +876,8 @@ describe Puppet::SSL::CertificateAuthority do
         @ca.verify("me")
       end
 
-      it "should set the store purpose to OpenSSL::X509::PURPOSE_SSL_CLIENT" do
-        Puppet[:cacert] = cacert
-        expect(@store).to receive(:add_file).with(cacert)
+      it "should set the store purpose to OpenSSL::X509::PURPOSE_ANY" do
+        expect(@store).to receive(:purpose=).with OpenSSL::X509::PURPOSE_ANY
 
         @ca.verify("me")
       end

data/spec/unit/ssl/certificate_spec.rb

@@ -138,6 +138,13 @@ describe Puppet::SSL::Certificate do
         expect(cert.custom_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'x509 :(')
       end
 
+      it "returns extensions under the ppAuthCertExt" do
+        exts = {'pp_auth_role' => 'taketwo'}
+        cert = build_cert(:extension_requests => exts)
+        sign_wrapped_cert(cert)
+        expect(cert.custom_extensions).to include('oid' => 'pp_auth_role', 'value' => 'taketwo')
+      end
+
       it "doesn't return standard extensions" do
         cert = build_cert(:dns_alt_names => 'foo')
         expect(cert.custom_extensions).to be_empty

data/spec/unit/ssl/host_spec.rb

@@ -158,6 +158,7 @@ describe Puppet::SSL::Host do
 
       it "should not include defaults if we can't resolve our fqdn" do
         allow(Puppet::SSL::CertificateAuthority).to receive(:ca?).and_return(true)
+        allow(Facter).to receive(:value).and_call_original
         allow(Facter).to receive(:value).with(:fqdn).and_return(nil)
 
         expect(@cr).to receive(:generate).with(@key, {})
@@ -167,6 +168,7 @@ describe Puppet::SSL::Host do
 
       it "should provide defaults if we're bootstrapping the local master" do
         allow(Puppet::SSL::CertificateAuthority).to receive(:ca?).and_return(true)
+        allow(Facter).to receive(:value).and_call_original
         allow(Facter).to receive(:value).with(:fqdn).and_return('web.foo.com')
         allow(Facter).to receive(:value).with(:domain).and_return('foo.com')
 

data/spec/unit/test/test_helper_spec.rb

@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe "TestHelper" do
+  context "#after_each_test" do
+    it "restores the original environment" do
+      varname = 'test_helper_spec-test_variable'
+      Puppet::Util.set_env(varname, "\u16A0")
+
+      expect(Puppet::Util.get_env(varname)).to eq("\u16A0")
+
+      # Prematurely trigger the after_each_test method
+      Puppet::Test::TestHelper.after_each_test
+
+      expect(Puppet::Util::get_env(varname)).to be_nil
+    end
+  end
+end

data/spec/unit/type/exec_spec.rb

@@ -150,16 +150,13 @@ RSpec.describe Puppet::Type.type(:exec) do
         end
       end
 
-      it "should redact the command on failure" do
+      it "should redact the sensitive command on failure" do
         output = "output1\noutput2\n"
         expect { exec_tester('false', 1, :output => output, :logoutput => :on_failure, :sensitive_parameters => [:command]).refresh }.
             to raise_error(Puppet::Error, /^\[command redacted\] returned 1 instead of/)
 
-        output.split("\n").each do |line|
-          log = @logs.shift
-          expect(log.level).to eq(:err)
-          expect(log.message).to eq(line)
-        end
+        expect(@logs).to include(an_object_having_attributes(level: :err, message: '[output redacted]'))
+        expect(@logs).to_not include(an_object_having_attributes(message: /output1|output2/))
       end
 
       it "should log the output on failure when returns is specified as an array" do
@@ -177,7 +174,7 @@ RSpec.describe Puppet::Type.type(:exec) do
         end
       end
 
-      it "should redact the command on failure when returns is specified as an array" do
+      it "should redact the sensitive command on failure when returns is specified as an array" do
         output = "output1\noutput2\n"
 
         expect {
@@ -185,11 +182,8 @@ RSpec.describe Puppet::Type.type(:exec) do
                       :logoutput => :on_failure, :sensitive_parameters => [:command]).refresh
         }.to raise_error(Puppet::Error, /^\[command redacted\] returned 1 instead of/)
 
-        output.split("\n").each do |line|
-          log = @logs.shift
-          expect(log.level).to eq(:err)
-          expect(log.message).to eq(line)
-        end
+        expect(@logs).to include(an_object_having_attributes(level: :err, message: '[output redacted]'))
+        expect(@logs).to_not include(an_object_having_attributes(message: /output1|output2/))
       end
 
       it "shouldn't log the output on success" do

data/spec/unit/type/file/content_spec.rb

@@ -200,15 +200,21 @@ describe Puppet::Type.type(:file).attrclass(:content), :uses_checksums => true d
             end
 
             it "prints the diff" do
-              expect(content).to receive(:diff).and_return("my diff").once
-              expect(content).to receive(:debug).with("\nmy diff").once
+              expect(content).to receive(:diff).and_return("my diff")
+              expect(content).to receive(:debug).with("\nmy diff")
+              expect(content).not_to be_safe_insync("other content")
+            end
+
+            it "prints binary file notice if diff is not valid encoding" do
+              expect(content).to receive(:diff).and_return("\xc7\xd1\xfc\x84")
+              expect(content).to receive(:debug).with(/\nBinary files #{filename} and .* differ/)
               expect(content).not_to be_safe_insync("other content")
             end
 
             it "redacts the diff when the property is sensitive" do
               content.sensitive = true
               expect(content).not_to receive(:diff)
-              expect(content).to receive(:debug).with("[diff redacted]").once
+              expect(content).to receive(:debug).with("[diff redacted]")
               expect(content).not_to be_safe_insync("other content")
             end
           end

data/spec/unit/type/file_spec.rb

@@ -477,6 +477,9 @@ describe Puppet::Type.type(:file) do
   end
 
   describe "#recurse" do
+    let(:name) { 'bar' }
+    let(:child) { double('puppet_type_file') }
+
     before do
       file[:recurse] = true
       @metadata = Puppet::FileServing::Metadata
@@ -485,8 +488,9 @@ describe Puppet::Type.type(:file) do
     describe "and a source is set" do
       it "should pass the already-discovered resources to recurse_remote" do
         file[:source] = File.expand_path(__FILE__)
-        allow(file).to receive(:recurse_local).and_return(:foo => "bar")
-        expect(file).to receive(:recurse_remote).with(:foo => "bar").and_return([])
+        allow(child).to receive(:[]).with(:path).and_return(name)
+        allow(file).to receive(:recurse_local).and_return(name => child)
+        expect(file).to receive(:recurse_remote).with(name => child).and_return([])
         file.recurse
       end
     end
@@ -494,8 +498,9 @@ describe Puppet::Type.type(:file) do
     describe "and a target is set" do
       it "should use recurse_link" do
         file[:target] = File.expand_path(__FILE__)
-        allow(file).to receive(:recurse_local).and_return(:foo => "bar")
-        expect(file).to receive(:recurse_link).with(:foo => "bar").and_return([])
+        allow(child).to receive(:[]).with(:path).and_return(name)
+        allow(file).to receive(:recurse_local).and_return(name => child)
+        expect(file).to receive(:recurse_link).with(name => child).and_return([])
         file.recurse
       end
     end

data/spec/unit/type/package_spec.rb

@@ -30,6 +30,10 @@ describe Puppet::Type.type(:package) do
     expect(Puppet::Type.type(:package).provider_feature(:versionable)).not_to be_nil
   end
 
+  it "should have a :supports_flavors feature" do
+    expect(Puppet::Type.type(:package).provider_feature(:supports_flavors)).not_to be_nil
+  end
+
   it "should have a :package_settings feature that requires :package_settings_insync?, :package_settings and :package_settings=" do
     expect(Puppet::Type.type(:package).provider_feature(:package_settings).methods).to eq([:package_settings_insync?, :package_settings, :package_settings=])
   end
@@ -53,6 +57,10 @@ describe Puppet::Type.type(:package) do
     it "should have a package_settings property" do
       expect(Puppet::Type.type(:package).attrtype(:package_settings)).to eq(:property)
     end
+
+    it "should have a flavor property" do
+      expect(Puppet::Type.type(:package).attrtype(:flavor)).to eq(:property)
+    end
   end
 
   describe "when validating attribute values" do

data/spec/unit/type/selboolean_spec.rb

@@ -24,12 +24,10 @@ describe Puppet::Type.type(:selboolean), "when validating values" do
     allow(@provider_class).to receive(:new).and_return(@provider)
   end
 
-  it "should support :on as a value to :value" do
-    Puppet::Type.type(:selboolean).new(:name => "yay", :value => :on)
-  end
-
-  it "should support :off as a value to :value" do
-    Puppet::Type.type(:selboolean).new(:name => "yay", :value => :off)
+  [:on, :off, :true, :false, true, false].each do |val|
+    it "should support #{val.inspect} as a value to :value" do
+      Puppet::Type.type(:selboolean).new(:name => "yay", :value => val)
+    end
   end
 
   it "should support :true as a value to :persistent" do

data/spec/unit/type/service_spec.rb

@@ -234,20 +234,21 @@ describe Puppet::Type.type(:service), "when changing the host" do
     @service.property(:enable).sync
   end
 
-  it "should always consider the enable state of a static service to be in sync" do
+  it "should let superclass implementation resolve insyncness when provider does not respond to the 'enabled_insync?' method" do
     allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
-    expect(@service.provider).to receive(:cached_enabled?).and_return('static')
-    @service[:enable] = false
-    expect(Puppet).to receive(:debug).with("Unable to enable or disable static service yay")
+    @service[:enable] = true
+    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?).and_return(false)
+
     expect(@service.property(:enable).insync?(:true)).to eq(true)
   end
 
-  it "should determine insyncness normally when the service is not static" do
+  it "insyncness should be resolved by provider instead of superclass implementation when provider responds to the 'enabled_insync?' method" do
     allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
-    expect(@service.provider).to receive(:cached_enabled?).and_return('true')
     @service[:enable] = true
-    expect(Puppet).not_to receive(:debug)
-    expect(@service.property(:enable).insync?(:true)).to eq(true)
+    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?).and_return(true)
+    allow(@service.provider).to receive(:enabled_insync?).and_return(false)
+
+    expect(@service.property(:enable).insync?(:true)).to eq(false)
   end
 
   it "should sync the service's enable state when changing the state of :ensure if :enable is being managed" do