puppet 5.5.22-universal-darwin → 6.0.0-universal-darwin

data/spec/integration/util_spec.rb

@@ -1,9 +1,11 @@
+#!/usr/bin/env ruby
+
 require 'spec_helper'
 
 describe Puppet::Util do
   include PuppetSpec::Files
 
-  describe "#execute" do
+  describe "#execute", unless: Puppet::Util::Platform.jruby? do
     it "should properly allow stdout and stderr to share a file" do
       command = "ruby -e '(1..10).each {|i| (i%2==0) ? $stdout.puts(i) : $stderr.puts(i)}'"
 
@@ -27,7 +29,7 @@ describe Puppet::Util do
     end
   end
 
-  describe "#replace_file on Windows", :if => Puppet.features.microsoft_windows? do
+  describe "#replace_file on Windows", :if => Puppet::Util::Platform.windows? do
     it "replace_file should preserve original ACEs from existing replaced file on Windows" do
 
       file = tmpfile("somefile")
@@ -107,17 +109,17 @@ describe Puppet::Util do
     end
   end
 
-  describe "#which on Windows", :if => Puppet.features.microsoft_windows? do
+  describe "#which on Windows", :if => Puppet::Util::Platform.windows? do
     let (:rune_utf8) { "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7" }
     let (:filename) { 'foo.exe' }
     let (:filepath) { File.expand_path('C:\\' + rune_utf8 + '\\' + filename) }
 
     before :each do
-      allow(FileTest).to receive(:file?).and_return(false)
-      allow(FileTest).to receive(:file?).with(filepath).and_return(true)
+      FileTest.stubs(:file?).returns false
+      FileTest.stubs(:file?).with(filepath).returns true
 
-      allow(FileTest).to receive(:executable?).and_return(false)
-      allow(FileTest).to receive(:executable?).with(filepath).and_return(true)
+      FileTest.stubs(:executable?).returns false
+      FileTest.stubs(:executable?).with(filepath).returns true
     end
 
     it "should be able to use UTF8 characters in the path" do
@@ -127,4 +129,5 @@ describe Puppet::Util do
       end
     end
   end
+
 end

data/spec/lib/matchers/json.rb

@@ -101,31 +101,25 @@ module JSONMatchers
     end
   end
 
-  if !Puppet.features.microsoft_windows?
-    require 'puppet/util/json'
-    require 'json-schema'
+  require 'puppet/util/json'
+  require 'json-schema'
 
-    class SchemaMatcher
-      JSON_META_SCHEMA = Puppet::Util::Json.load(File.read('api/schemas/json-meta-schema.json'))
+  class SchemaMatcher
+    JSON_META_SCHEMA = Puppet::Util::Json.load(File.read('api/schemas/json-meta-schema.json'))
 
-      def initialize(schema)
-        @schema = schema
-      end
+    def initialize(schema)
+      @schema = schema
+    end
 
-      def matches?(json)
-        JSON::Validator.validate!(JSON_META_SCHEMA, @schema)
-        JSON::Validator.validate!(@schema, json)
-      end
+    def matches?(json)
+      JSON::Validator.validate!(JSON_META_SCHEMA, @schema)
+      JSON::Validator.validate!(@schema, json)
     end
   end
 
   def validate_against(schema_file)
-    if Puppet.features.microsoft_windows?
-      pending("Schema checks cannot be done on windows because of json-schema problems")
-    else
-      schema = Puppet::Util::Json.load(File.read(schema_file))
-      SchemaMatcher.new(schema)
-    end
+    schema = Puppet::Util::Json.load(File.read(schema_file))
+    SchemaMatcher.new(schema)
   end
 
   def set_json_attribute(*attributes)

data/{lib/puppet/ssl → spec/lib/puppet}/certificate_factory.rb

@@ -4,7 +4,7 @@ require 'puppet/ssl'
 # certificates.
 #
 # @api private
-module Puppet::SSL::CertificateFactory
+module Puppet::CertificateFactory
 
   # Create a new X509 certificate and add any needed extensions to the cert.
   #
@@ -19,16 +19,15 @@ module Puppet::SSL::CertificateFactory
   # @param serial [Integer] The serial number for the given certificate, which
   #   MUST be unique for the given CA.
   # @param ttl [String] The duration of the validity for the given certificate.
-  #   defaults to Puppet[:ca_ttl]
   #
   # @api public
   #
   # @return [OpenSSL::X509::Certificate]
-  def self.build(cert_type, csr, issuer, serial, ttl = nil)
+  def self.build(cert_type, csr, issuer, serial, ttl = 3600)
     # Work out if we can even build the requested type of certificate.
-    build_extensions = "build_#{cert_type}_extensions"
+    build_extensions = "build_#{cert_type.to_s}_extensions"
     respond_to?(build_extensions) or
-      raise ArgumentError, _("%{cert_type} is an invalid certificate type!") % { cert_type: cert_type }
+      raise ArgumentError, _("%{cert_type} is an invalid certificate type!") % { cert_type: cert_type.to_s }
 
     raise ArgumentError, _("Certificate TTL must be an integer") unless ttl.nil? || ttl.is_a?(Integer)
 
@@ -47,7 +46,7 @@ module Puppet::SSL::CertificateFactory
     # clock fail, and better than having every cert we generate expire a day
     # before the user expected it to when they asked for "one year".
     cert.not_before = Time.now - (60*60*24)
-    cert.not_after  = Time.now + (ttl || Puppet[:ca_ttl])
+    cert.not_after  = Time.now + ttl
 
     add_extensions_to(cert, csr, issuer, send(build_extensions))
 

data/spec/lib/puppet/test_ca.rb

@@ -0,0 +1,109 @@
+module Puppet
+  class TestCa
+
+    CERT_VALID_FROM = (Time.now - (60*60*24)).freeze
+    CERT_VALID_UNTIL = (Time.now + 600)
+
+    CA_EXTENSIONS = [
+      ["basicConstraints", "CA:TRUE", true],
+      ["keyUsage", "keyCertSign, cRLSign", true],
+      ["subjectKeyIdentifier", "hash", false],
+      ["nsComment", "Puppet Server Internal Certificate", false],
+      ["authorityKeyIdentifier", "keyid:always", false]
+    ].freeze
+
+    attr_reader :ca_cert, :ca_crl
+
+    def initialize
+      @digest = OpenSSL::Digest::SHA256.new
+      @key = OpenSSL::PKey::RSA.new(1024)
+      @ca_cert = self_signed_ca
+      @ca_crl = create_crl
+    end
+
+    def sign(csr, opts = {})
+      cert = OpenSSL::X509::Certificate.new
+      cert.public_key = csr.public_key
+      cert.subject = csr.subject
+      cert.issuer = @ca_cert.subject
+      cert.version = 2
+      cert.serial = 1
+      cert.not_before = CERT_VALID_FROM
+      cert.not_after =  CERT_VALID_UNTIL
+      ef = extension_factory_for(@ca_cert, cert)
+      if opts[:subject_alt_names]
+        ext = ef.create_extension(["subjectAltName", opts[:subject_alt_names], false])
+        cert.add_extension(ext)
+      end
+      cert.sign(@key, @digest)
+      Puppet::SSL::Certificate.from_instance(cert)
+    end
+
+    def revoke(cert)
+      revoked = OpenSSL::X509::Revoked.new
+      revoked.serial = cert.serial
+      revoked.time = Time.now
+      enum = OpenSSL::ASN1::Enumerated(OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
+      ext = OpenSSL::X509::Extension.new("CRLReason", enum)
+      revoked.add_extensions(ext)
+      @crl.add_revoked(revoked)
+    end
+
+    def generate(name, opts)
+      host_key = OpenSSL::PKey::RSA.new(1024)
+      csr = create_csr(name, host_key)
+      sign(csr, opts)
+    end
+
+    private
+
+    def create_csr(name, key)
+      csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
+      csr.subject = OpenSSL::X509::Name.new([["CN", name]])
+      csr.version = 2
+      csr.sign(key, @digest)
+      csr
+    end
+
+    def self_signed_ca
+      cert = OpenSSL::X509::Certificate.new
+      cert.public_key = @key.public_key
+      cert.subject = OpenSSL::X509::Name.new([["CN", "Test CA"]])
+      cert.issuer = cert.subject
+      cert.version = 2
+      cert.serial = 1
+      cert.not_before = CERT_VALID_FROM
+      cert.not_after  = CERT_VALID_UNTIL
+      ef = extension_factory_for(cert, cert)
+      CA_EXTENSIONS.each do |ext|
+        extension = ef.create_extension(*ext)
+        cert.add_extension(extension)
+      end
+      cert.sign(@key, @digest)
+      cert
+    end
+
+    def create_crl
+      crl = OpenSSL::X509::CRL.new
+      crl.version = 1
+      crl.issuer = @ca_cert.subject
+      ef = extension_factory_for(@ca_cert)
+      crl.add_extension(
+        ef.create_extension(["authorityKeyIdentifier", "keyid:always", false]))
+      crl.add_extension(
+        OpenSSL::X509::Extension.new("crlNumber", OpenSSL::ASN1::Integer(0)))
+      crl.last_update = CERT_VALID_FROM
+      crl.next_update = CERT_VALID_UNTIL
+      crl.sign(@key, @digest)
+      crl
+    end
+
+    def extension_factory_for(ca, cert = nil)
+      ef = OpenSSL::X509::ExtensionFactory.new
+      ef.issuer_certificate  = ca
+      ef.subject_certificate = cert if cert
+      ef
+    end
+  end
+end

data/spec/lib/puppet_spec/compiler.rb

@@ -44,7 +44,7 @@ module PuppetSpec::Compiler
 
   def apply_with_error_check(manifest)
     apply_compiled_manifest(manifest) do |res|
-      expect(res).not_to receive(:err)
+      res.expects(:err).never
     end
   end
 
@@ -82,4 +82,31 @@ module PuppetSpec::Compiler
       end
     end
   end
+
+  # Compiles a catalog, and if source is given evaluates it and returns its result.
+  # The catalog is returned if no source is given.
+  # Topscope variables are set before compilation
+  # Uses a created node 'testnode' if none is given.
+  # (Parameters given by name)
+  #
+  def evaluate(code: 'undef', source: nil, node: Puppet::Node.new('testnode'), variables: {})
+    source_location = caller[0]
+    Puppet[:code] = code
+    compiler = Puppet::Parser::Compiler.new(node)
+    unless variables.empty?
+      scope = compiler.topscope
+      variables.each {|k,v| scope.setvar(k, v) }
+    end
+
+    if source.nil?
+      compiler.compile
+      # see lib/puppet/indirector/catalog/compiler.rb#filter
+      return compiler.filter { |r| r.virtual? }
+    end
+
+    # evaluate given source is the context of the compiled state and return its result
+    compiler.compile do |catalog |
+      Puppet::Pops::Parser::EvaluatingParser.singleton.evaluate_string(compiler.topscope, source, source_location)
+    end
+  end
 end

data/spec/lib/puppet_spec/files.rb

@@ -9,6 +9,7 @@ module PuppetSpec::Files
     $global_tempfiles ||= []
     while path = $global_tempfiles.pop do
       begin
+        Dir.unstub(:entries)
         FileUtils.rm_rf path, :secure => true
       rescue Errno::ENOENT
         # nothing to do
@@ -16,36 +17,31 @@ module PuppetSpec::Files
     end
   end
 
-  def make_absolute(path) PuppetSpec::Files.make_absolute(path) end
-  def self.make_absolute(path)
+  module_function
+
+  def make_absolute(path)
     path = File.expand_path(path)
-    path[0] = 'c' if Puppet.features.microsoft_windows?
+    path[0] = 'c' if Puppet::Util::Platform.windows?
     path
   end
 
-  def tmpfile(name, dir = nil) PuppetSpec::Files.tmpfile(name, dir) end
-  def self.tmpfile(name, dir = nil)
-    # Generate a temporary file, just for the name...
-    source = dir ? Tempfile.new(name, dir) : Tempfile.new(name)
-    path = Puppet::FileSystem.expand_path(source.path.encode(Encoding::UTF_8))
-    source.close!
-
+  def tmpfile(name, dir = nil)
+    dir ||= Dir.tmpdir
+    path = Puppet::FileSystem.expand_path(make_tmpname(name, nil).encode(Encoding::UTF_8), dir)
     record_tmp(File.expand_path(path))
 
     path
   end
 
-  def file_containing(name, contents) PuppetSpec::Files.file_containing(name, contents) end
-  def self.file_containing(name, contents)
+  def file_containing(name, contents)
     file = tmpfile(name)
     File.open(file, 'wb') { |f| f.write(contents) }
     file
   end
 
-  def script_containing(name, contents) PuppetSpec::Files.script_containing(name, contents) end
-  def self.script_containing(name, contents)
+  def script_containing(name, contents)
     file = tmpfile(name)
-    if Puppet.features.microsoft_windows?
+    if Puppet::Util::Platform.windows?
       file += '.bat'
       text = contents[:windows]
     else
@@ -56,8 +52,7 @@ module PuppetSpec::Files
     file
   end
 
-  def tmpdir(name) PuppetSpec::Files.tmpdir(name) end
-  def self.tmpdir(name)
+  def tmpdir(name)
     dir = Puppet::FileSystem.expand_path(Dir.mktmpdir(name).encode!(Encoding::UTF_8))
 
     record_tmp(dir)
@@ -65,13 +60,24 @@ module PuppetSpec::Files
     dir
   end
 
-  def dir_containing(name, contents_hash) PuppetSpec::Files.dir_containing(name, contents_hash) end
-  def self.dir_containing(name, contents_hash)
+  # Copied from ruby 2.4 source
+  def make_tmpname((prefix, suffix), n)
+    prefix = (String.try_convert(prefix) or
+              raise ArgumentError, "unexpected prefix: #{prefix.inspect}")
+    suffix &&= (String.try_convert(suffix) or
+                raise ArgumentError, "unexpected suffix: #{suffix.inspect}")
+    t = Time.now.strftime("%Y%m%d")
+    path = "#{prefix}#{t}-#{$$}-#{rand(0x100000000).to_s(36)}".dup
+    path << "-#{n}" if n
+    path << suffix if suffix
+    path
+  end
+
+  def dir_containing(name, contents_hash)
     dir_contained_in(tmpdir(name), contents_hash)
   end
 
-  def dir_contained_in(dir, contents_hash) PuppetSpec::Files.dir_contained_in(dir, contents_hash) end
-  def self.dir_contained_in(dir, contents_hash)
+  def dir_contained_in(dir, contents_hash)
     contents_hash.each do |k,v|
       if v.is_a?(Hash)
         Dir.mkdir(tmp = File.join(dir,k))
@@ -84,7 +90,7 @@ module PuppetSpec::Files
     dir
   end
 
-  def self.record_tmp(tmp)
+  def record_tmp(tmp)
     # ...record it for cleanup,
     $global_tempfiles ||= []
     $global_tempfiles << tmp
@@ -92,7 +98,7 @@ module PuppetSpec::Files
 
   def expect_file_mode(file, mode)
     actual_mode = "%o" % Puppet::FileSystem.stat(file).mode
-    target_mode = if Puppet.features.microsoft_windows?
+    target_mode = if Puppet::Util::Platform.windows?
       mode
     else
       "10" + "%04i" % mode.to_i

data/spec/lib/puppet_spec/module_tool/shared_functions.rb

@@ -21,7 +21,7 @@ module PuppetSpec
 
       def mark_changed(path)
         app = Puppet::ModuleTool::Applications::Checksummer
-        allow(app).to receive(:run).with(path).and_return(['README'])
+        app.stubs(:run).with(path).returns(['README'])
       end
 
       def graph_should_include(name, options)

data/spec/lib/puppet_spec/modules.rb

@@ -25,11 +25,21 @@ module PuppetSpec::Modules
         FileUtils.mkdir_p(tasks_dir)
         tasks.each do |task_files|
           task_files.each do |task_file|
-            FileUtils.touch(File.join(tasks_dir, task_file))
+            if task_file.is_a?(String)
+              # default content to acceptable metadata
+              task_file = { :name => task_file, :content => "{}" }
+            end
+            File.write(File.join(tasks_dir, task_file[:name]), task_file[:content])
           end
         end
       end
 
+      (options[:files] || {}).each do |fname, content|
+        path = File.join(module_dir, fname)
+        FileUtils.mkdir_p(File.dirname(path))
+        File.write(path, content)
+      end
+
       Puppet::Module.new(name, module_dir, environment)
     end
 

data/spec/lib/puppet_spec/scope.rb

@@ -1,3 +1,4 @@
+
 module PuppetSpec::Scope
   # Initialize a new scope suitable for testing.
   #
@@ -10,4 +11,4 @@ module PuppetSpec::Scope
     scope
   end
 
-end
+end

data/spec/lib/puppet_spec/ssl.rb

@@ -0,0 +1,265 @@
+require 'openssl'
+
+module PuppetSpec
+  module SSL
+
+    PRIVATE_KEY_LENGTH = 2048
+    FIVE_YEARS = 5 * 365 * 24 * 60 * 60
+    CA_EXTENSIONS = [
+      ["basicConstraints", "CA:TRUE", true],
+      ["keyUsage", "keyCertSign, cRLSign", true],
+      ["subjectKeyIdentifier", "hash", false],
+      ["authorityKeyIdentifier", "keyid:always", false]
+    ]
+    NODE_EXTENSIONS = [
+      ["keyUsage", "digitalSignature", true],
+      ["subjectKeyIdentifier", "hash", false]
+    ]
+    DEFAULT_SIGNING_DIGEST = OpenSSL::Digest::SHA256.new
+    DEFAULT_REVOCATION_REASON = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE
+    ROOT_CA_NAME = "/CN=root-ca-\u{2070E}"
+    REVOKED_INT_CA_NAME = "/CN=revoked-int-ca-\u16A0"
+    INT_CA_NAME = "/CN=unrevoked-int-ca\u06FF\u16A0\u{2070E}"
+    LEAF_CA_NAME = "/CN=leaf-ca-\u06FF"
+    EXPLANATORY_TEXT = <<-EOT
+# Root Issuer: #{ROOT_CA_NAME}
+# Intermediate Issuer: #{INT_CA_NAME}
+# Leaf Issuer: #{LEAF_CA_NAME}
+EOT
+
+
+    def self.create_private_key(length = PRIVATE_KEY_LENGTH)
+      OpenSSL::PKey::RSA.new(length)
+    end
+
+    def self.self_signed_ca(key, name)
+      cert = OpenSSL::X509::Certificate.new
+
+      cert.public_key = key.public_key
+      cert.subject = OpenSSL::X509::Name.parse(name)
+      cert.issuer = cert.subject
+      cert.version = 2
+      cert.serial = rand(2**128)
+
+      not_before = just_now
+      cert.not_before = not_before
+      cert.not_after = not_before + FIVE_YEARS
+
+      ext_factory = extension_factory_for(cert, cert)
+      CA_EXTENSIONS.each do |ext|
+        extension = ext_factory.create_extension(*ext)
+        cert.add_extension(extension)
+      end
+
+      cert.sign(key, DEFAULT_SIGNING_DIGEST)
+
+      cert
+    end
+
+    def self.create_csr(key, name)
+      csr = OpenSSL::X509::Request.new
+
+      csr.public_key = key.public_key
+      csr.subject = OpenSSL::X509::Name.parse(name)
+      csr.version = 2
+      csr.sign(key, DEFAULT_SIGNING_DIGEST)
+
+      csr
+    end
+
+    def self.sign(ca_key, ca_cert, csr, extensions = NODE_EXTENSIONS)
+      cert = OpenSSL::X509::Certificate.new
+
+      cert.public_key = csr.public_key
+      cert.subject = csr.subject
+      cert.issuer = ca_cert.subject
+      cert.version = 2
+      cert.serial = rand(2**128)
+
+      not_before = just_now
+      cert.not_before = not_before
+      cert.not_after = not_before + FIVE_YEARS
+
+      ext_factory = extension_factory_for(ca_cert, cert)
+      extensions.each do |ext|
+        extension = ext_factory.create_extension(*ext)
+        cert.add_extension(extension)
+      end
+
+      cert.sign(ca_key, DEFAULT_SIGNING_DIGEST)
+
+      cert
+    end
+
+    def self.create_crl_for(ca_cert, ca_key)
+      crl = OpenSSL::X509::CRL.new
+      crl.version = 1
+      crl.issuer = ca_cert.subject
+
+      ef = extension_factory_for(ca_cert)
+      crl.add_extension(
+        ef.create_extension(["authorityKeyIdentifier", "keyid:always", false]))
+      crl.add_extension(
+        OpenSSL::X509::Extension.new("crlNumber", OpenSSL::ASN1::Integer(0)))
+
+      not_before = just_now
+      crl.last_update = not_before
+      crl.next_update = not_before + FIVE_YEARS
+      crl.sign(ca_key, DEFAULT_SIGNING_DIGEST)
+
+      crl
+    end
+
+    def self.revoke(serial, crl, ca_key)
+      revoked = OpenSSL::X509::Revoked.new
+      revoked.serial = serial
+      revoked.time = Time.now
+      revoked.add_extension(
+        OpenSSL::X509::Extension.new("CRLReason",
+                                     OpenSSL::ASN1::Enumerated(DEFAULT_REVOCATION_REASON)))
+
+      crl.add_revoked(revoked)
+      extensions = crl.extensions.group_by{|e| e.oid == 'crlNumber' }
+      crl_number = extensions[true].first
+      unchanged_exts = extensions[false]
+
+      next_crl_number = crl_number.value.to_i + 1
+      new_crl_number_ext = OpenSSL::X509::Extension.new("crlNumber",
+                                                        OpenSSL::ASN1::Integer(next_crl_number))
+
+      crl.extensions = unchanged_exts + [new_crl_number_ext]
+      crl.sign(ca_key, DEFAULT_SIGNING_DIGEST)
+
+      crl
+    end
+
+    # Creates a self-signed root ca, then signs two node certs, revoking one of them.
+    # Creates an intermediate CA and one node cert off of it.
+    # Creates a second intermediate CA and one node cert off if it.
+    # Creates a leaf CA off of the intermediate CA, then signs two node certs revoking one of them.
+    # Revokes an intermediate CA.
+    # Returns the ca bundle, crl chain, and all the node certs
+    #
+    #            -----
+    #           /     \
+    #          /       \
+    #          | root  +-------------------o------------------o
+    #          \  CA   /                   |                  |
+    #           \     /                    |                  |
+    #            --+--                     |                  |
+    #              |                       |                  |
+    #              |                       |                  |
+    #              |                       |                  |
+    #              |                     --+--              --+--
+    # +---------+  |   +---------+      /     \            /     \
+    # | revoked |  |   |         |     /revoked\          /       \
+    # |   node  +--o---+   node  |     |  int  |          | int   |
+    # |         |      |         |     \  CA   /          \  CA   /
+    # +---------+      +---------+      \     /            \     /
+    #                                    --+--              --+--
+    #                                      |                  |
+    #                                      |                  |
+    #                                      |                  |
+    #                                    --+--                |
+    #                                   /     \           +---+-----+
+    #                                  /       \          |         |
+    #                                  | leaf  |          |  node   |
+    #                                  \  CA   /          |         |
+    #                                   \     /           +---------+
+    #                                    --+--
+    #                                      |
+    #                                      |
+    #                         +---------+  |  +----------+
+    #                         | revoked |  |  |          |
+    #                         |   node  +--o--+  node    |
+    #                         |         |     |          |
+    #                         +---------+     +----------+
+    def self.create_chained_pki
+      root_key = create_private_key
+      root_cert = self_signed_ca(root_key, ROOT_CA_NAME)
+      root_crl = create_crl_for(root_cert, root_key)
+
+      unrevoked_root_node_key = create_private_key
+      unrevoked_root_node_csr = create_csr(unrevoked_root_node_key, "/CN=unrevoked-root-node")
+      unrevoked_root_node_cert = sign(root_key, root_cert, unrevoked_root_node_csr)
+
+      revoked_root_node_key = create_private_key
+      revoked_root_node_csr = create_csr(revoked_root_node_key, "/CN=revoked-root-node")
+      revoked_root_node_cert = sign(root_key, root_cert, revoked_root_node_csr)
+
+      revoke(revoked_root_node_cert.serial, root_crl, root_key)
+
+      revoked_int_key = create_private_key
+      revoked_int_csr = create_csr(revoked_int_key, REVOKED_INT_CA_NAME)
+      revoked_int_cert = sign(root_key, root_cert, revoked_int_csr, CA_EXTENSIONS)
+      revoked_int_crl = create_crl_for(revoked_int_cert, revoked_int_key)
+
+      int_key = create_private_key
+      int_csr = create_csr(int_key, INT_CA_NAME)
+      int_cert = sign(root_key, root_cert, int_csr, CA_EXTENSIONS)
+
+      int_node_key = create_private_key
+      int_node_csr = create_csr(int_node_key, "/CN=unrevoked-int-node")
+      int_node_cert = sign(int_key, int_cert, int_node_csr)
+
+      unrevoked_int_node_key = create_private_key
+      unrevoked_int_node_csr = create_csr(unrevoked_int_node_key, "/CN=unrevoked-int-node")
+      unrevoked_int_node_cert = sign(revoked_int_key, revoked_int_cert, unrevoked_int_node_csr)
+
+      leaf_key = create_private_key
+      leaf_csr = create_csr(leaf_key, LEAF_CA_NAME)
+      leaf_cert = sign(revoked_int_key, revoked_int_cert, leaf_csr, CA_EXTENSIONS)
+      leaf_crl = create_crl_for(leaf_cert, leaf_key)
+
+      revoke(revoked_int_cert.serial, root_crl, root_key)
+
+      unrevoked_leaf_node_key = create_private_key
+      unrevoked_leaf_node_csr = create_csr(unrevoked_leaf_node_key, "/CN=unrevoked-leaf-node")
+      unrevoked_leaf_node_cert = sign(leaf_key, leaf_cert, unrevoked_leaf_node_csr)
+
+      revoked_leaf_node_key = create_private_key
+      revoked_leaf_node_csr = create_csr(revoked_leaf_node_key, "/CN=revoked-leaf-node")
+      revoked_leaf_node_cert = sign(leaf_key, leaf_cert, revoked_leaf_node_csr)
+
+      revoke(revoked_leaf_node_cert.serial, leaf_crl, leaf_key)
+
+
+      ca_bundle = bundle(root_cert, revoked_int_cert, leaf_cert)
+      crl_chain = bundle(root_crl, revoked_int_crl, leaf_crl)
+
+      {
+        :root_cert => root_cert,
+        :int_cert => int_cert,
+        :int_node_cert => int_node_cert,
+        :leaf_cert => leaf_cert,
+        :leaf_key => leaf_key,
+        :revoked_root_node_cert => revoked_root_node_cert,
+        :revoked_int_cert => revoked_int_cert,
+        :revoked_leaf_node_cert => revoked_leaf_node_cert,
+        :unrevoked_root_node_cert => unrevoked_root_node_cert,
+        :unrevoked_int_node_cert  => unrevoked_int_node_cert,
+        :unrevoked_leaf_node_cert => unrevoked_leaf_node_cert,
+        :ca_bundle => ca_bundle,
+        :crl_chain => crl_chain,
+      }
+    end
+
+   private
+
+    def self.just_now
+      Time.now - 1
+    end
+
+    def self.extension_factory_for(ca, cert = nil)
+      ef = OpenSSL::X509::ExtensionFactory.new
+      ef.issuer_certificate  = ca
+      ef.subject_certificate = cert if cert
+
+      ef
+    end
+
+    def self.bundle(*items)
+      items.map {|i| EXPLANATORY_TEXT + i.to_pem }.join("\n")
+    end
+  end
+end