puppet 5.5.22-universal-darwin → 6.0.0-universal-darwin

data/spec/unit/ssl/base_spec.rb

@@ -1,3 +1,4 @@
+#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/ssl/certificate'
@@ -14,23 +15,23 @@ describe Puppet::SSL::Certificate do
 
   describe "when creating new instances" do
     it "should fail if given an object that is not an instance of the wrapped class" do
-      obj = double('obj', :is_a? => false)
+      obj = stub 'obj', :is_a? => false
       expect { @class.from_instance(obj) }.to raise_error(ArgumentError)
     end
 
     it "should fail if a name is not supplied and can't be determined from the object" do
-      obj = double('obj', :is_a? => true)
+      obj = stub 'obj', :is_a? => true
       expect { @class.from_instance(obj) }.to raise_error(ArgumentError)
     end
 
     it "should determine the name from the object if it has a subject" do
-      obj = double('obj', :is_a? => true, :subject => '/CN=foo')
+      obj = stub 'obj', :is_a? => true, :subject => '/CN=foo'
 
-      inst = double('base')
-      expect(inst).to receive(:content=).with(obj)
+      inst = stub 'base'
+      inst.expects(:content=).with(obj)
 
-      expect(@class).to receive(:new).with('foo').and_return(inst)
-      expect(@class).to receive(:name_from_subject).with('/CN=foo').and_return('foo')
+      @class.expects(:new).with('foo').returns inst
+      @class.expects(:name_from_subject).with('/CN=foo').returns('foo')
 
       expect(@class.from_instance(obj)).to eq(inst)
     end
@@ -38,8 +39,8 @@ describe Puppet::SSL::Certificate do
 
   describe "when determining a name from a certificate subject" do
     it "should extract only the CN and not any other components" do
-      subject = double('sub')
-      expect(Puppet::Util::SSL).to receive(:cn_from_subject).with(subject).and_return('host.domain.com')
+      subject = stub 'sub'
+      Puppet::Util::SSL.expects(:cn_from_subject).with(subject).returns 'host.domain.com'
       expect(@class.name_from_subject(subject)).to eq('host.domain.com')
     end
   end
@@ -47,14 +48,14 @@ describe Puppet::SSL::Certificate do
   describe "when initializing wrapped class from a file with #read" do
     it "should open the file with ASCII encoding" do
       path = '/foo/bar/cert'
-      allow(Puppet::SSL::Base).to receive(:valid_certname).and_return(true)
-      expect(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("bar")
+      Puppet::SSL::Base.stubs(:valid_certname).returns(true)
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("bar")
       @base.read(path)
     end
   end
 
   describe "#digest_algorithm" do
-    let(:content) { double('content') }
+    let(:content) { stub 'content' }
     let(:base) {
       b = Puppet::SSL::Base.new('base')
       b.content = content
@@ -78,13 +79,13 @@ describe Puppet::SSL::Certificate do
       'dsaWithSHA1' => 'sha1',
     }.each do |signature, digest|
       it "returns '#{digest}' for signature algorithm '#{signature}'" do
-        allow(content).to receive(:signature_algorithm).and_return(signature)
+        content.stubs(:signature_algorithm).returns(signature)
         expect(base.digest_algorithm).to eq(digest)
       end
     end
 
     it "raises an error on an unknown signature algorithm" do
-      allow(content).to receive(:signature_algorithm).and_return("nonsense")
+      content.stubs(:signature_algorithm).returns("nonsense")
       expect {
         base.digest_algorithm
       }.to raise_error(Puppet::Error, "Unknown signature algorithm 'nonsense'")

data/spec/unit/ssl/certificate_request_attributes_spec.rb

@@ -3,11 +3,14 @@ require 'spec_helper'
 require 'puppet/ssl/certificate_request_attributes'
 
 describe Puppet::SSL::CertificateRequestAttributes do
+  include PuppetSpec::Files
+
   let(:expected) do
     {
       "custom_attributes" => {
         "1.3.6.1.4.1.34380.2.2"=>[3232235521, 3232235777], # system IPs in hex
         "1.3.6.1.4.1.34380.2.0"=>"hostname.domain.com",
+        "1.3.6.1.4.1.34380.1.1.3"=>:node_image_name,
         # different UTF-8 widths
         # 1-byte A
         # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
@@ -18,7 +21,7 @@ describe Puppet::SSL::CertificateRequestAttributes do
     }
   end
   let(:csr_attributes_hash) { expected.dup }
-  let(:csr_attributes_path) { '/some/where/csr_attributes.yaml' }
+  let(:csr_attributes_path) { tmpfile('csr_attributes.yaml') }
   let(:csr_attributes) { Puppet::SSL::CertificateRequestAttributes.new(csr_attributes_path) }
 
   it "initializes with a path" do
@@ -27,13 +30,13 @@ describe Puppet::SSL::CertificateRequestAttributes do
 
   describe "loading" do
     it "returns nil when loading from a non-existent file" do
-      expect(csr_attributes.load).to be_falsey
+      nonexistent = Puppet::SSL::CertificateRequestAttributes.new('/does/not/exist.yaml')
+      expect(nonexistent.load).to be_falsey
     end
 
     context "with an available attributes file" do
       before do
-        expect(Puppet::FileSystem).to receive(:exist?).with(csr_attributes_path).and_return(true)
-        expect(Puppet::Util::Yaml).to receive(:load_file).with(csr_attributes_path, {}).and_return(csr_attributes_hash)
+        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
       end
 
       it "loads csr attributes from a file when the file is present" do
@@ -46,20 +49,31 @@ describe Puppet::SSL::CertificateRequestAttributes do
       end
 
       it "returns an empty hash if custom_attributes points to nil" do
-        csr_attributes_hash["custom_attributes"] = nil
+        Puppet::Util::Yaml.dump({'custom_attributes' => nil }, csr_attributes_path)
         csr_attributes.load
         expect(csr_attributes.custom_attributes).to eq({})
       end
 
       it "returns an empty hash if custom_attributes key is not present" do
-        csr_attributes_hash.delete("custom_attributes")
+        Puppet::Util::Yaml.dump({}, csr_attributes_path)
         csr_attributes.load
         expect(csr_attributes.custom_attributes).to eq({})
       end
 
-      it "raise a Puppet::Error if an unexpected root key is defined" do
+      it "raises a Puppet::Error if an unexpected root key is defined" do
         csr_attributes_hash['unintentional'] = 'data'
-        expect { csr_attributes.load }.to raise_error(Puppet::Error, /unexpected attributes.*unintentional/)
+        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
+        expect {
+          csr_attributes.load
+        }.to raise_error(Puppet::Error, /unexpected attributes.*unintentional/)
+      end
+
+      it "raises a Puppet::Util::Yaml::YamlLoadError if an unexpected ruby object is present" do
+        csr_attributes_hash['custom_attributes']['whoops'] = Object.new
+        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
+        expect {
+          csr_attributes.load
+        }.to raise_error(Puppet::Util::Yaml::YamlLoadError, /Tried to load unspecified class: Object/)
       end
     end
   end

data/spec/unit/ssl/certificate_request_spec.rb

@@ -1,3 +1,4 @@
+#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_request'
@@ -11,6 +12,7 @@ describe Puppet::SSL::CertificateRequest do
     k
   }
 
+
   it "should be extended with the Indirector module" do
     expect(described_class.singleton_class).to be_include(Puppet::Indirector)
   end
@@ -29,15 +31,15 @@ describe Puppet::SSL::CertificateRequest do
 
   describe "when converting from a string" do
     it "should create a CSR instance with its name set to the CSR subject and its content set to the extracted CSR" do
-      csr = double('csr',
+      csr = stub 'csr',
         :subject => OpenSSL::X509::Name.parse("/CN=Foo.madstop.com"),
-        :is_a? => true)
-      expect(OpenSSL::X509::Request).to receive(:new).with("my csr").and_return(csr)
+        :is_a? => true
+      OpenSSL::X509::Request.expects(:new).with("my csr").returns(csr)
 
-      mycsr = double('sslcsr')
-      expect(mycsr).to receive(:content=).with(csr)
+      mycsr = stub 'sslcsr'
+      mycsr.expects(:content=).with(csr)
 
-      expect(described_class).to receive(:new).with("Foo.madstop.com").and_return(mycsr)
+      described_class.expects(:new).with("Foo.madstop.com").returns mycsr
 
       described_class.from_s("my csr")
     end
@@ -58,9 +60,9 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should be able to read requests from disk" do
       path = "/my/path"
-      expect(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("my request")
-      my_req = double('request')
-      expect(OpenSSL::X509::Request).to receive(:new).with("my request").and_return(my_req)
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my request")
+      my_req = mock 'request'
+      OpenSSL::X509::Request.expects(:new).with("my request").returns(my_req)
       expect(request.read(path)).to equal(my_req)
       expect(request.content).to equal(my_req)
     end
@@ -69,20 +71,20 @@ describe Puppet::SSL::CertificateRequest do
       expect(request.to_s).to eq("")
     end
 
-    it "should convert the request to pem format when converted to a string" do
+    it "should convert the request to pem format when converted to a string", :unless => RUBY_PLATFORM == 'java' do
       request.generate(key)
       expect(request.to_s).to eq(request.content.to_pem)
     end
 
     it "should have a :to_text method that it delegates to the actual key" do
-      real_request = double('request')
-      expect(real_request).to receive(:to_text).and_return("requesttext")
+      real_request = mock 'request'
+      real_request.expects(:to_text).returns "requesttext"
       request.content = real_request
       expect(request.to_text).to eq("requesttext")
     end
   end
 
-  describe "when generating" do
+  describe "when generating", :unless => RUBY_PLATFORM == 'java' do
     it "should use the content of the provided key if the key is a Puppet::SSL::Key instance" do
       request.generate(key)
       expect(request.content.verify(key.content.public_key)).to be_truthy
@@ -93,12 +95,6 @@ describe Puppet::SSL::CertificateRequest do
       expect(request.content.subject).to eq OpenSSL::X509::Name.new([['CN', key.name]])
     end
 
-    it "should set the CN to the :ca_name setting when the CSR is for a CA" do
-      Puppet[:ca_name] = "mycertname"
-      request = described_class.new(Puppet::SSL::CA_NAME).generate(key)
-      expect(request.subject).to eq OpenSSL::X509::Name.new([['CN', Puppet[:ca_name]]])
-    end
-
     it "should set the version to 0" do
       request.generate(key)
       expect(request.content.version).to eq(0)
@@ -306,26 +302,26 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should verify the generated request using the public key" do
       # Stupid keys don't have a competent == method.
-      expect_any_instance_of(OpenSSL::X509::Request).to receive(:verify) do |public_key|
+      OpenSSL::X509::Request.any_instance.expects(:verify).with { |public_key|
         public_key.to_s == key.content.public_key.to_s
-      end.and_return(true)
+      }.returns true
       request.generate(key)
     end
 
     it "should fail if verification fails" do
-      expect_any_instance_of(OpenSSL::X509::Request).to receive(:verify) do |public_key|
+      OpenSSL::X509::Request.any_instance.expects(:verify).with { |public_key|
         public_key.to_s == key.content.public_key.to_s
-      end.and_return(false)
+      }.returns false
 
-      expect do
+      expect {
         request.generate(key)
-      end.to raise_error(Puppet::Error, /CSR sign verification failed/)
+      }.to raise_error(Puppet::Error, /CSR sign verification failed/)
     end
 
     it "should log the fingerprint" do
-      allow_any_instance_of(Puppet::SSL::Digest).to receive(:to_hex).and_return("FINGERPRINT")
-      allow(Puppet).to receive(:info)
-      expect(Puppet).to receive(:info).with(/FINGERPRINT/)
+      Puppet::SSL::Digest.any_instance.stubs(:to_hex).returns("FINGERPRINT")
+      Puppet.stubs(:info)
+      Puppet.expects(:info).with { |s| s =~ /FINGERPRINT/ }
       request.generate(key)
     end
 
@@ -337,8 +333,8 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should use SHA1 to sign the csr when SHA256 isn't available" do
       csr = OpenSSL::X509::Request.new
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(true)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(true)
       signer = Puppet::SSL::CertificateSigner.new
       signer.sign(csr, key.content)
       expect(csr.verify(key.content)).to be_truthy
@@ -348,83 +344,58 @@ describe Puppet::SSL::CertificateRequest do
     # So commenting it out till it is sorted out
     # The problem seems to be with the ability to sign a CSR when using either of
     # these hash algorithms
-    pending "should use SHA512 to sign the csr when SHA256 and SHA1 aren't available" do
-      csr = OpenSSL::X509::Request.new
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(true)
-      signer = Puppet::SSL::CertificateSigner.new
-      signer.sign(csr, key.content)
-      expect(csr.verify(key.content)).to be_truthy
-    end
 
-    # Attempts to use SHA512 and SHA384 for signing certificates don't seem to work
-    # So commenting it out till it is sorted out
-    # The problem seems to be with the ability to sign a CSR when using either of
-    # these hash algorithms
-    pending "should use SHA384 to sign the csr when SHA256/SHA1/SHA512 aren't available" do
-      csr = OpenSSL::X509::Request.new
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA384").and_return(true)
-      signer = Puppet::SSL::CertificateSigner.new
-      signer.sign(csr, key.content)
-      expect(csr.verify(key.content)).to be_truthy
-    end
+#    it "should use SHA512 to sign the csr when SHA256 and SHA1 aren't available" do
+#      csr = OpenSSL::X509::Request.new
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA512").returns(true)
+#      signer = Puppet::SSL::CertificateSigner.new
+#      signer.sign(csr, key.content)
+#      expect(csr.verify(key.content)).to be_truthy
+#    end
+
+#    it "should use SHA384 to sign the csr when SHA256/SHA1/SHA512 aren't available" do
+#      csr = OpenSSL::X509::Request.new
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA512").returns(false)
+#      OpenSSL::Digest.expects(:const_defined?).with("SHA384").returns(true)
+#      signer = Puppet::SSL::CertificateSigner.new
+#      signer.sign(csr, key.content)
+#      expect(csr.verify(key.content)).to be_truthy
+#    end
 
     it "should use SHA224 to sign the csr when SHA256/SHA1/SHA512/SHA384 aren't available" do
       csr = OpenSSL::X509::Request.new
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA384").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA224").and_return(true)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA512").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA384").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA224").returns(true)
       signer = Puppet::SSL::CertificateSigner.new
       signer.sign(csr, key.content)
       expect(csr.verify(key.content)).to be_truthy
     end
 
     it "should raise an error if neither SHA256/SHA1/SHA512/SHA384/SHA224 are available" do
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA384").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA224").and_return(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA256").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA1").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA512").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA384").returns(false)
+      OpenSSL::Digest.expects(:const_defined?).with("SHA224").returns(false)
       expect {
         Puppet::SSL::CertificateSigner.new
       }.to raise_error(Puppet::Error)
     end
   end
 
-  describe "when a CSR is saved" do
-    describe "and a CA is available" do
-      it "should save the CSR and trigger autosigning" do
-        ca = double('ca', autosign: nil)
-        expect(Puppet::SSL::CertificateAuthority).to receive(:instance).and_return(ca)
-
-        csr = Puppet::SSL::CertificateRequest.new("me")
-        terminus = double('terminus')
-        allow(terminus).to receive(:validate)
-        expect(Puppet::SSL::CertificateRequest.indirection).to receive(:prepare).and_return(terminus)
-        expect(terminus).to receive(:save) { |request| request.instance == csr && request.key == "me" }
-
-        Puppet::SSL::CertificateRequest.indirection.save(csr)
-      end
-    end
-
-    describe "and a CA is not available" do
-      it "should save the CSR" do
-        expect(Puppet::SSL::CertificateAuthority).to receive(:instance).and_return(nil)
-
-        csr = Puppet::SSL::CertificateRequest.new("me")
-        terminus = double('terminus')
-        allow(terminus).to receive(:validate)
-        expect(Puppet::SSL::CertificateRequest.indirection).to receive(:prepare).and_return(terminus)
-        expect(terminus).to receive(:save) { |request| request.instance == csr && request.key == "me" }
-
-        Puppet::SSL::CertificateRequest.indirection.save(csr)
-      end
-    end
+  it "should save the CSR" do
+    csr = Puppet::SSL::CertificateRequest.new("me")
+    terminus = mock 'terminus'
+    terminus.stubs(:validate)
+    Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
+    terminus.expects(:save).with { |request| request.instance == csr && request.key == "me" }
+    Puppet::SSL::CertificateRequest.indirection.save(csr)
   end
 end

data/spec/unit/ssl/certificate_spec.rb

@@ -1,4 +1,6 @@
+#! /usr/bin/env ruby
 require 'spec_helper'
+require 'puppet/certificate_factory'
 
 require 'puppet/ssl/certificate'
 
@@ -15,10 +17,6 @@ describe Puppet::SSL::Certificate do
     @class = Puppet::SSL::Certificate
   end
 
-  after do
-    @class.instance_variable_set("@ca_location", nil)
-  end
-
   it "should be extended with the Indirector module" do
     expect(@class.singleton_class).to be_include(Puppet::Indirector)
   end
@@ -33,26 +31,24 @@ describe Puppet::SSL::Certificate do
 
   describe "when converting from a string" do
     it "should create a certificate instance with its name set to the certificate subject and its content set to the extracted certificate" do
-      cert = double(
-        'certificate',
+      cert = stub 'certificate',
         :subject => OpenSSL::X509::Name.parse("/CN=Foo.madstop.com"),
         :is_a? => true
-      )
-      expect(OpenSSL::X509::Certificate).to receive(:new).with("my certificate").and_return(cert)
+      OpenSSL::X509::Certificate.expects(:new).with("my certificate").returns(cert)
 
-      mycert = double('sslcert')
-      expect(mycert).to receive(:content=).with(cert)
+      mycert = stub 'sslcert'
+      mycert.expects(:content=).with(cert)
 
-      expect(@class).to receive(:new).with("Foo.madstop.com").and_return(mycert)
+      @class.expects(:new).with("Foo.madstop.com").returns mycert
 
       @class.from_s("my certificate")
     end
 
     it "should create multiple certificate instances when asked" do
-      cert1 = double('cert1')
-      expect(@class).to receive(:from_s).with("cert1").and_return(cert1)
-      cert2 = double('cert2')
-      expect(@class).to receive(:from_s).with("cert2").and_return(cert2)
+      cert1 = stub 'cert1'
+      @class.expects(:from_s).with("cert1").returns cert1
+      cert2 = stub 'cert2'
+      @class.expects(:from_s).with("cert2").returns cert2
 
       expect(@class.from_multiple_s("cert1\n---\ncert2")).to eq([cert1, cert2])
     end
@@ -68,15 +64,15 @@ describe Puppet::SSL::Certificate do
     end
 
     it "should convert the certificate to pem format" do
-      certificate = double('certificate', :to_pem => "pem")
+      certificate = mock 'certificate', :to_pem => "pem"
       @certificate.content = certificate
       expect(@certificate.to_s).to eq("pem")
     end
 
     it "should be able to convert multiple instances to a string" do
       cert2 = @class.new("foo")
-      expect(@certificate).to receive(:to_s).and_return("cert1")
-      expect(cert2).to receive(:to_s).and_return("cert2")
+      @certificate.expects(:to_s).returns "cert1"
+      cert2.expects(:to_s).returns "cert2"
 
       expect(@class.to_multiple_s([@certificate, cert2])).to eq("cert1\n---\ncert2")
 
@@ -84,13 +80,14 @@ describe Puppet::SSL::Certificate do
   end
 
   describe "when managing instances" do
+
     def build_cert(opts)
       key = Puppet::SSL::Key.new('quux')
       key.generate
       csr = Puppet::SSL::CertificateRequest.new('quux')
       csr.generate(key, opts)
 
-      raw_cert = Puppet::SSL::CertificateFactory.build('client', csr, csr.content, 14)
+      raw_cert = Puppet::CertificateFactory.build('client', csr, csr.content, 14)
       @class.from_instance(raw_cert)
     end
 
@@ -110,7 +107,7 @@ describe Puppet::SSL::Certificate do
       expect(@certificate).to respond_to(:content)
     end
 
-    describe "#subject_alt_names" do
+    describe "#subject_alt_names", :unless => RUBY_PLATFORM == 'java' do
       it "should list all alternate names when the extension is present" do
         certificate = build_cert(:dns_alt_names => 'foo, bar,baz')
         expect(certificate.subject_alt_names).
@@ -123,7 +120,7 @@ describe Puppet::SSL::Certificate do
       end
     end
 
-    describe "custom extensions" do
+    describe "custom extensions", :unless => RUBY_PLATFORM == 'java' do
       it "returns extensions under the ppRegCertExt" do
         exts = {'pp_uuid' => 'abcdfd'}
         cert = build_cert(:extension_requests => exts)
@@ -138,46 +135,40 @@ describe Puppet::SSL::Certificate do
         expect(cert.custom_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'x509 :(')
       end
 
-      it "returns extensions under the ppAuthCertExt" do
-        exts = {'pp_auth_role' => 'taketwo'}
-        cert = build_cert(:extension_requests => exts)
-        sign_wrapped_cert(cert)
-        expect(cert.custom_extensions).to include('oid' => 'pp_auth_role', 'value' => 'taketwo')
-      end
-
       it "doesn't return standard extensions" do
         cert = build_cert(:dns_alt_names => 'foo')
         expect(cert.custom_extensions).to be_empty
       end
+
     end
 
     it "should return a nil expiration if there is no actual certificate" do
-      allow(@certificate).to receive(:content).and_return(nil)
+      @certificate.stubs(:content).returns nil
 
       expect(@certificate.expiration).to be_nil
     end
 
     it "should use the expiration of the certificate as its expiration date" do
-      cert = double('cert')
-      allow(@certificate).to receive(:content).and_return(cert)
+      cert = stub 'cert'
+      @certificate.stubs(:content).returns cert
 
-      expect(cert).to receive(:not_after).and_return("sometime")
+      cert.expects(:not_after).returns "sometime"
 
       expect(@certificate.expiration).to eq("sometime")
     end
 
     it "should be able to read certificates from disk" do
       path = "/my/path"
-      expect(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("my certificate")
-      certificate = double('certificate')
-      expect(OpenSSL::X509::Certificate).to receive(:new).with("my certificate").and_return(certificate)
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my certificate")
+      certificate = mock 'certificate'
+      OpenSSL::X509::Certificate.expects(:new).with("my certificate").returns(certificate)
       expect(@certificate.read(path)).to equal(certificate)
       expect(@certificate.content).to equal(certificate)
     end
 
     it "should have a :to_text method that it delegates to the actual key" do
-      real_certificate = double('certificate')
-      expect(real_certificate).to receive(:to_text).and_return("certificatetext")
+      real_certificate = mock 'certificate'
+      real_certificate.expects(:to_text).returns "certificatetext"
       @certificate.content = real_certificate
       expect(@certificate.to_text).to eq("certificatetext")
     end
@@ -191,5 +182,6 @@ describe Puppet::SSL::Certificate do
       expect(exts.find { |ext| ext['oid'] == 'pp_instance_id'}['value']).to eq('i_am_an_id')
       expect(exts.find { |ext| ext['oid'] == 'pp_image_name'}['value']).to eq('i_am_an_image_name')
     end
+
   end
 end