puppet 5.5.17 → 5.5.22

data/spec/fixtures/integration/provider/mailalias/aliases/test1

@@ -26,6 +26,7 @@ decode:     root
 # Other tests
 anothertest: "|/path/to/rt-mailgate --queue 'another test' --action correspond --url http://my.com/"
 test: "|/path/to/rt-mailgate --queue 'test' --action correspond --url http://my.com/"
+test_with_commas_inside_command: "|/path/to/rt-mailgate --queue 'test' --action correspond --url http://my.com/ --project proj1,proj2"
 
 # Included file
 incfile: :include: /tmp/somefile

data/spec/fixtures/unit/provider/package/dnfmodule/dnf-module-list.txt

@@ -0,0 +1,19 @@
+localmirror-appstream
+Name         Stream       Profiles                                  Summary                                                            
+389-ds       1.4 [e]                                                389 Directory Server (base)                                           
+gimp         2.8 [d][e]   common [d], devel [i]                     gimp module                                                        
+mariadb      10.3 [d][e]  client [i], server [d], galera            MariaDB Module                                                     
+nodejs       10 [d][e]    common [d], development, minimal [i], s2i Javascript runtime                                                 
+perl         5.26 [d][e]  common [d], minimal [i]                   Practical Extraction and Report Language                           
+postgresql   10 [d][e]    client, server [d] [i]                    PostgreSQL server and client module                                
+ruby         2.5 [d][e]   common [d]                                An interpreter of object-oriented scripting language                  
+rust-toolset rhel8 [d][e] common [d] [i]                            Rust                                                               
+subversion   1.10 [d][e]  common [d], server [i]                    Apache Subversion                                                  
+scala        2.10 [d]     common [d]                                A hybrid functional/object-oriented language for the JVM
+squid        4 [d]        common [d]                                Squid - Optimising Web Delivery
+subversion   1.10 [d]     common [d], server                        Apache Subversion
+swig         3.0 [d][x]   common [d], complete                      Connects C/C++/Objective C to some high-level programming languages
+varnish      6 [d]        common [d]                                Varnish HTTP cache
+virt         rhel [d][x]  common [d]                                Virtualization module
+
+Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

data/spec/fixtures/unit/provider/package/pkgng/pkg.version

@@ -1,3 +1,5 @@
 shells/bash-completion             <   needs updating (index has 2.1_3)
 ftp/curl                           <   needs updating (index has 7.33.0_2)
 shells/zsh                         <   needs updating (index has 5.0.4)
+sysutils/orphan                    ?   orphaned: sysutils/orphan
+sysutils/broken                    !   Comparison failed

data/spec/fixtures/unit/provider/package/yum/yum-check-update-subscription-manager.txt

@@ -0,0 +1,9 @@
+Loaded plugins: product-id, search-disabled-repos, subscription-manager
+
+This system is not registered with an entitlement server. You can use subscription-manager to register on.
+
+curl.i686                               7.32.0-10.fc20           updates
+curl.x86_64                             7.32.0-10.fc20           updates
+gawk.i686                               4.1.0-3.fc20             updates
+dhclient.i686                           12:4.1.1-38.P1.fc20      updates
+java-1.8.0-openjdk.x86_64               1:1.8.0.131-2.b11.el7_3  updates

data/spec/fixtures/unit/provider/service/systemd/list_unit_files_services

@@ -5,3 +5,12 @@ autovt@.service                             disabled
 avahi-daemon.service                        enabled
 blk-availability.service                    disabled
 brandbot.service                            static
+apparmor.service                            bad
+udev.service                                enabled-runtime
+ufw.service                                 linked
+umountfs.service                            linked-runtime
+umountnfs.service                           masked
+umountroot.service                          masked-runtime
+urandom.service                             indirect
+user@.service                               generated
+uuidd.service                               transient

data/spec/integration/configurer_spec.rb

@@ -62,5 +62,71 @@ describe Puppet::Configurer do
       expect(summary["time"]).to be_key("notify")
       expect(summary["time"]["last_run"]).to be_between(t1, t2)
     end
+
+    it "applies a cached catalog if pluginsync fails when usecacheonfailure is true" do
+      Puppet[:ignore_plugin_errors] = false
+
+      Puppet[:use_cached_catalog] = false
+      Puppet[:usecacheonfailure] = true
+
+      report = Puppet::Transaction::Report.new
+      expect_any_instance_of(Puppet::Configurer::Downloader).to receive(:evaluate).and_raise(Puppet::Error, 'Failed to retrieve: some file')
+      expect(Puppet::Resource::Catalog.indirection).to receive(:find).and_return(@catalog)
+
+      @configurer.run(pluginsync: true, report: report)
+      expect(report.cached_catalog_status).to eq('on_failure')
+    end
+
+    describe 'resubmitting facts' do
+      context 'when resubmit_facts is set to false' do
+        it 'should not send data' do
+          expect(@configurer).to receive(:resubmit_facts).never
+
+          @configurer.run(catalog: @catalog)
+        end
+      end
+
+      context 'when resubmit_facts is set to true' do
+        let(:test_facts) { Puppet::Node::Facts.new('configurer.test') }
+        let(:fact_rest_terminus) { Puppet::Node::Facts.indirection.terminus(:rest) }
+
+        before(:each) do
+          Puppet[:resubmit_facts] = true
+
+          allow(@configurer).to receive(:find_facts).and_return(test_facts)
+          allow(fact_rest_terminus).to receive(:save)
+        end
+
+        it 'sends fact data using the rest terminus' do
+          expect(fact_rest_terminus).to receive(:save)
+
+          @configurer.run(catalog: @catalog)
+        end
+
+        it 'logs errors that occur during fact generation' do
+          allow(@configurer).to receive(:find_facts).and_raise('error generating facts')
+          expect(Puppet).to receive(:log_exception).with(instance_of(RuntimeError),
+                                                         /^Failed to submit facts/)
+
+          @configurer.run(catalog: @catalog)
+        end
+
+        it 'logs errors that occur during fact submission' do
+          allow(fact_rest_terminus).to receive(:save).and_raise('error sending facts')
+          expect(Puppet).to receive(:log_exception).with(instance_of(RuntimeError),
+                                                         /^Failed to submit facts/)
+
+          @configurer.run(catalog: @catalog)
+        end
+
+        it 'records time spent resubmitting facts' do
+          report = Puppet::Transaction::Report.new
+
+          @configurer.run(catalog: @catalog, report: report)
+
+          expect(report.metrics['time'].values).to include(["resubmit_facts", anything, Numeric])
+        end
+      end
+    end
   end
 end

data/spec/integration/data_binding_spec.rb

@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 require 'puppet_spec/compiler'
+require 'puppet/indirector/data_binding/hiera'
 
 describe "Data binding" do
   include PuppetSpec::Files

data/spec/integration/defaults_spec.rb

@@ -130,8 +130,7 @@ describe "Puppet defaults" do
       Puppet::Util.withenv( {"PATH" => path }, :windows) do
         Puppet.settings[:path] = "none" # this causes it to ignore the setting
 
-        envhash = Puppet::Util::Windows::Process.get_environment_strings
-        expect(envhash['Path']).to eq(path)
+        expect(Puppet::Util.get_env('Path')).to eq(path)
       end
     end
   end

data/spec/integration/faces/plugin_spec.rb

@@ -1,59 +1,41 @@
 require 'spec_helper'
-require 'puppet/face'
-require 'puppet/file_serving/metadata'
-require 'puppet/file_serving/content'
-require 'puppet/indirector/memory'
+require 'webmock/rspec'
 
-module PuppetFaceIntegrationSpecs
 describe "Puppet plugin face" do
-  INDIRECTORS = [
-    Puppet::Indirector::FileMetadata,
-    Puppet::Indirector::FileContent,
-  ]
+  before :each do
+    metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":420,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
+    stub_request(:get, %r{/puppet/v3/file_metadatas/(plugins|locales)}).to_return(status: 200, body: metadata, headers: {'Content-Type' => 'application/json'})
 
-  INDIRECTED_CLASSES = [
-    Puppet::FileServing::Metadata,
-    Puppet::FileServing::Content,
-    Puppet::Node::Facts,
-  ]
-
-  INDIRECTORS.each do |indirector|
-    class indirector::Memory < Puppet::Indirector::Memory
-      def find(request)
-        model.new('/dev/null', { 'type' => 'directory' })
-      end
-    end
+    # response retains owner/group/mode due to source_permissions => use
+    facts_metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":500,\"group\":500,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
+    stub_request(:get, %r{/puppet/v3/file_metadatas/pluginfacts}).to_return(status: 200, body: facts_metadata, headers: {'Content-Type' => 'application/json'})
   end
 
-  before do
-    FileUtils.mkdir(File.join(Puppet[:vardir], 'lib'))
-    FileUtils.mkdir(File.join(Puppet[:vardir], 'facts.d'))
-    FileUtils.mkdir(File.join(Puppet[:vardir], 'locales'))
-    @termini_classes = {}
-    INDIRECTED_CLASSES.each do |indirected|
-      @termini_classes[indirected] = indirected.indirection.terminus_class
-      indirected.indirection.terminus_class = :memory
-    end
-  end
+  it "processes a download request resulting in no changes" do
+    # /opt/puppetlabs/puppet/cache/facts.d will be created based on our umask.
+    # If the mode on disk is not 0755, then the mode from the metadata response
+    # (493 => 0755) will be applied, resulting in "plugins were downloaded"
+    # message. Enforce a umask so the results are consistent.
+    Puppet::FileSystem.mkpath(Puppet[:pluginfactdest])
+    Puppet::FileSystem.chmod(0755, Puppet[:pluginfactdest])
 
-  after do
-    INDIRECTED_CLASSES.each do |indirected|
-      indirected.indirection.terminus_class = @termini_classes[indirected]
-      indirected.indirection.termini.clear
-    end
+    app = Puppet::Application[:plugin]
+    app.command_line.args << 'download'
+    expect {
+      app.run
+    }.to exit_with(0)
+      .and output(/No plugins downloaded/).to_stdout
   end
 
-  def init_cli_args_and_apply_app(args = ["download"])
-    Puppet::Application.find(:plugin).new(double('command_line', :subcommand_name => :plugin, :args => args))
-  end
+  it "updates the facts.d mode", unless: Puppet::Util::Platform.windows? do
+    Puppet::FileSystem.mkpath(Puppet[:pluginfactdest])
+    Puppet::FileSystem.chmod(0775, Puppet[:pluginfactdest])
 
-  it "processes a download request" do
-    app = init_cli_args_and_apply_app
-    expect do
-      expect {
-        app.run
-      }.to exit_with(0)
-    end.to have_printed(/No plugins downloaded/)
+    app = Puppet::Application[:plugin]
+    app.command_line.args << 'download'
+    expect {
+      app.run
+    }.to exit_with(0)
+     .and output(/Downloaded these plugins: .*facts\.d/).to_stdout
   end
 end
-end

data/spec/integration/indirector/facts/facter_spec.rb

@@ -8,6 +8,10 @@ describe Puppet::Node::Facts::Facter do
   include PuppetSpec::Files
   include PuppetSpec::Compiler
 
+  before :each do
+    Puppet::Node::Facts.indirection.terminus_class = :facter
+  end
+
   it "preserves case in fact values" do
     Facter.add(:downcase_test) do
       setcode do

data/spec/integration/parser/compiler_spec.rb

@@ -841,6 +841,17 @@ describe Puppet::Parser::Compiler do
           MANIFEST
         end.to raise_error(/Foo\[bar\]:\s+parameter 'a' expects a value for key 'd'\s+parameter 'a' unrecognized key 'c'/m)
       end
+
+      it 'handles Sensitive type in resource array' do
+        catalog = compile_to_catalog(<<-MANIFEST)
+          define foo(Sensitive[String] $password) {
+            notify{ "${title}": message => "${password}" }
+          }
+          foo { ['testA', 'testB']: password =>Sensitive('some password') }
+        MANIFEST
+        expect(catalog).to have_resource("Notify[testA]").with_parameter(:message, 'Sensitive [value redacted]')
+        expect(catalog).to have_resource("Notify[testB]").with_parameter(:message, 'Sensitive [value redacted]')
+      end
     end
 
     context 'when using typed parameters in class' do

data/spec/integration/type/notify_spec.rb

@@ -0,0 +1,46 @@
+require 'spec_helper'
+require 'puppet_spec/compiler'
+
+describe Puppet::Type.type(:notify) do
+  include PuppetSpec::Compiler
+
+  it "logs the title at notice level" do
+    apply_compiled_manifest(<<-MANIFEST)
+      notify { 'hi': }
+    MANIFEST
+
+    expect(@logs).to include(an_object_having_attributes(level: :notice, message: 'hi'))
+  end
+
+  it "logs the message property" do
+    apply_compiled_manifest(<<-MANIFEST)
+      notify { 'title':
+        message => 'hello'
+      }
+    MANIFEST
+
+    expect(@logs).to include(an_object_having_attributes(level: :notice, message: "defined 'message' as 'hello'"))
+  end
+
+  it "redacts sensitive message properties" do
+    apply_compiled_manifest(<<-MANIFEST)
+      $message = Sensitive('secret')
+      notify { 'notify1':
+        message => $message
+      }
+    MANIFEST
+
+    expect(@logs).to include(an_object_having_attributes(level: :notice, message: 'changed [redacted] to [redacted]'))
+  end
+
+  it "redacts sensitive interpolated message properties" do
+    apply_compiled_manifest(<<-MANIFEST)
+      $message = Sensitive('secret')
+      notify { 'notify2':
+        message => "${message}"
+      }
+    MANIFEST
+
+    expect(@logs).to include(an_object_having_attributes(level: :notice, message: "defined 'message' as 'Sensitive [value redacted]'"))
+  end
+end

data/spec/integration/util/windows/adsi_spec.rb

@@ -82,6 +82,9 @@ describe Puppet::Util::Windows::ADSI::Group,
     it 'should return a list of members resolvable with Puppet::Util::Windows::ADSI::Group.name_sid_hash' do
       temp_groupname = "g#{SecureRandom.uuid}"
       temp_username  = "u#{SecureRandom.uuid}"[0..12]
+      # From https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements
+      specials = "~!@#$%^&*_-+=`|\(){}[]:;\"'<>,.?/"
+      temp_password = "p#{SecureRandom.uuid[0..7]}-#{SecureRandom.uuid.upcase[0..7]}-#{specials[rand(specials.length)]}"
 
       # select a virtual account that requires an authority to be able to resolve to SID
       # the Dhcp service is chosen for no particular reason aside from it's a service available on all Windows versions
@@ -110,6 +113,8 @@ describe Puppet::Util::Windows::ADSI::Group,
       begin
         # :SidTypeUser as user on localhost, can be resolved with or without authority prefix
         user = Puppet::Util::Windows::ADSI::User.create(temp_username)
+        # appveyor sometimes requires a password
+        user.password = temp_password
         user.commit()
         users.push({ :sid => user.sid.sid, :name => Puppet::Util::Windows::ADSI.computer_name + '\\' + temp_username })
 
@@ -160,7 +165,7 @@ describe Puppet::Util::Windows::ADSI::Group,
 
       # unresolvable SID
       expect(admins.members[1].sid).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
-      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112 (unresolvable)')
+      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
       expect(admins.members[1].account_type).to eq(:SidTypeUnknown)
     end
 

data/spec/integration/util/windows/registry_spec.rb

@@ -259,23 +259,23 @@ describe Puppet::Util::Windows::Registry do
         {
           name: 'REG_SZ',
           type: Win32::Registry::REG_SZ,
-          value: "reg sz\u0000 string",
-          expected_value: "reg sz  string"
+          value: "reg sz\u0000\u0000 string",
+          expected_value: "reg sz"
         },
         {
           name: 'REG_SZ_2',
           type: Win32::Registry::REG_SZ,
-          value: "reg sz\x00 string",
-          expected_value: "reg sz  string"
+          value: "reg sz 2\x00\x00 string",
+          expected_value: "reg sz 2"
         },
         {
           name: 'REG_EXPAND_SZ',
           type: Win32::Registry::REG_EXPAND_SZ,
-          value: "\0reg expand string",
-          expected_value: " reg expand string"
+          value: "\0\0\0reg expand string",
+          expected_value: ""
         }
       ].each do |pair|
-        it 'replaces null bytes with spaces' do
+        it 'reads up to the first wide null' do
           hklm.create("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_ALL_ACCESS) do |reg|
             reg.write(value_name, pair[:type], pair[:value])
           end

data/spec/shared_contexts/types_setup.rb

@@ -187,6 +187,8 @@ shared_context 'types_setup' do
     result << Puppet::Pops::Types::PURIType
     result << Puppet::Pops::Types::PTupleType.new([tf.rich_data])
     result << Puppet::Pops::Types::PObjectType
+    result << Puppet::Pops::Types::PTypeType
+    result << Puppet::Pops::Types::PTypeSetType
     result
   end
   def rich_data_compatible_types

data/spec/unit/agent_spec.rb

@@ -185,31 +185,26 @@ describe Puppet::Agent do
 
         # So we don't actually try to hit the filesystem.
         allow(@agent).to receive(:lock).and_yield
-
-        allow(Kernel).to receive(:fork)
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => 0)])
-        allow(@agent).to receive(:exit)
       end
 
       it "should run the agent in a forked process" do
         client = AgentTestClient.new
         expect(AgentTestClient).to receive(:new).and_return(client)
 
-        expect(client).to receive(:run)
+        expect(client).to receive(:run).and_return(0)
 
         expect(Kernel).to receive(:fork).and_yield
-        @agent.run
+        expect { @agent.run }.to exit_with(0)
       end
 
       it "should exit child process if child exit" do
         client = AgentTestClient.new
         expect(AgentTestClient).to receive(:new).and_return(client)
 
-        expect(client).to receive(:run).and_raise(SystemExit)
+        expect(client).to receive(:run).and_raise(SystemExit.new(-1))
 
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(-1)
-        @agent.run
+        expect { @agent.run }.to exit_with(-1)
       end
 
       it 'should exit with 1 if an exception is raised' do
@@ -219,31 +214,44 @@ describe Puppet::Agent do
         expect(client).to receive(:run).and_raise(StandardError)
 
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(1)
-        @agent.run
+        expect { @agent.run }.to exit_with(1)
       end
 
-      it "should re-raise exit happening in the child" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => -1)])
-        expect { @agent.run }.to raise_error(SystemExit)
+      it 'should exit with 254 if NoMemoryError exception is raised' do
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+
+        expect(client).to receive(:run).and_raise(NoMemoryError)
+
+        expect(Kernel).to receive(:fork).and_yield
+        expect { @agent.run }.to exit_with(254)
       end
 
-      it "should re-raise NoMoreMemory happening in the child" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => -2)])
-        expect { @agent.run }.to raise_error(NoMemoryError)
+      it "should return the block exit code as the child exit code" do
+        expect(Kernel).to receive(:fork).and_yield
+        expect {
+          @agent.run_in_fork {
+            777
+          }
+        }.to exit_with(777)
       end
 
-      it "should return the child exit code" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => 777)])
-        expect(@agent.run).to eq(777)
+      it "should return `1` exit code if the block returns `nil`" do
+        expect(Kernel).to receive(:fork).and_yield
+        expect {
+          @agent.run_in_fork {
+            nil
+          }
+        }.to exit_with(1)
       end
 
-      it "should return the block exit code as the child exit code" do
+      it "should return `1` exit code if the block returns `false`" do
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(777)
-        @agent.run_in_fork {
-          777
-        }
+        expect {
+          @agent.run_in_fork {
+            false
+          }
+        }.to exit_with(1)
       end
     end
 
@@ -283,7 +291,7 @@ describe Puppet::Agent do
         expect(client).not_to receive(:handling)
         expect(Puppet).to receive(:log_exception).with(be_an_instance_of(Puppet::Agent::RunTimeoutError), anything)
 
-        expect(@agent.run).to eq(1)
+        expect(@agent.run).to eq(nil)
       end
     end
   end