puppet 5.5.22 → 6.0.0

data/spec/integration/type/nagios_spec.rb

@@ -1,69 +0,0 @@
-require 'spec_helper'
-require 'puppet/file_bucket/dipper'
-
-describe "Nagios file creation" do
-  include PuppetSpec::Files
-
-  let(:initial_mode) { 0600 }
-
-  before :each do
-    FileUtils.touch(target_file)
-    Puppet::FileSystem.chmod(initial_mode, target_file)
-    allow_any_instance_of(Puppet::FileBucket::Dipper).to receive(:backup) # Don't backup to filebucket
-  end
-
-  let :target_file do
-    tmpfile('nagios_integration_specs')
-  end
-
-  # Copied from the crontab integration spec.
-  #
-  # @todo This should probably live in the PuppetSpec module instead then.
-  def run_in_catalog(*resources)
-    catalog = Puppet::Resource::Catalog.new
-    catalog.host_config = false
-    resources.each do |resource|
-      expect(resource).not_to receive(:err)
-      catalog.add_resource(resource)
-    end
-
-    # the resources are not properly contained and generated resources
-    # will end up with dangling edges without this stubbing:
-    allow(catalog).to receive(:container_of).and_return(resources[0])
-    catalog.apply
-  end
-
-  context "when creating a nagios config file" do
-    context "which is not managed" do
-      it "should choose the file mode if requested" do
-        resource = Puppet::Type.type(:nagios_host).new(
-          :name   => 'spechost',
-          :use    => 'spectemplate',
-          :ensure => 'present',
-          :target => target_file,
-          :mode   => '0640'
-        )
-        run_in_catalog(resource)
-        expect_file_mode(target_file, "640")
-      end
-    end
-
-    context "which is managed" do
-      it "should not override the mode" do
-        file_res = Puppet::Type.type(:file).new(
-          :name   => target_file,
-          :ensure => :present
-        )
-        nag_res = Puppet::Type.type(:nagios_host).new(
-          :name   => 'spechost',
-          :use    => 'spectemplate',
-          :ensure => :present,
-          :target => target_file,
-          :mode   => '0640'
-        )
-        run_in_catalog(file_res, nag_res)
-        expect_file_mode(target_file, initial_mode.to_s(8))
-      end
-    end
-  end
-end

data/spec/integration/type/notify_spec.rb

@@ -1,46 +0,0 @@
-require 'spec_helper'
-require 'puppet_spec/compiler'
-
-describe Puppet::Type.type(:notify) do
-  include PuppetSpec::Compiler
-
-  it "logs the title at notice level" do
-    apply_compiled_manifest(<<-MANIFEST)
-      notify { 'hi': }
-    MANIFEST
-
-    expect(@logs).to include(an_object_having_attributes(level: :notice, message: 'hi'))
-  end
-
-  it "logs the message property" do
-    apply_compiled_manifest(<<-MANIFEST)
-      notify { 'title':
-        message => 'hello'
-      }
-    MANIFEST
-
-    expect(@logs).to include(an_object_having_attributes(level: :notice, message: "defined 'message' as 'hello'"))
-  end
-
-  it "redacts sensitive message properties" do
-    apply_compiled_manifest(<<-MANIFEST)
-      $message = Sensitive('secret')
-      notify { 'notify1':
-        message => $message
-      }
-    MANIFEST
-
-    expect(@logs).to include(an_object_having_attributes(level: :notice, message: 'changed [redacted] to [redacted]'))
-  end
-
-  it "redacts sensitive interpolated message properties" do
-    apply_compiled_manifest(<<-MANIFEST)
-      $message = Sensitive('secret')
-      notify { 'notify2':
-        message => "${message}"
-      }
-    MANIFEST
-
-    expect(@logs).to include(an_object_having_attributes(level: :notice, message: "defined 'message' as 'Sensitive [value redacted]'"))
-  end
-end

data/spec/integration/type/user_spec.rb

@@ -1,63 +0,0 @@
-require 'spec_helper'
-require 'puppet_spec/files'
-require 'puppet_spec/compiler'
-
-describe Puppet::Type.type(:user), '(integration)', :unless => Puppet.features.microsoft_windows? do
-  include PuppetSpec::Files
-  include PuppetSpec::Compiler
-
-  context "when set to purge ssh keys from a file" do
-    # different UTF-8 widths
-    # 1-byte A
-    # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
-    # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
-    # 4-byte 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
-    let (:mixed_utf8) { "A\u06FF\u16A0\u{2070E}" } # Aۿᚠ𠜎
-
-    let(:tempfile) do
-      file_containing('user_spec', <<-EOF)
-        # comment #{mixed_utf8}
-        ssh-rsa KEY-DATA key-name
-        ssh-rsa KEY-DATA key name
-        EOF
-    end
-    # must use an existing user, or the generated key resource
-    # will fail on account of an invalid user for the key
-    # - root should be a safe default
-    let(:manifest) { "user { 'root': purge_ssh_keys => '#{tempfile}' }" }
-
-    it "should purge authorized ssh keys" do
-      apply_compiled_manifest(manifest)
-      expect(File.read(tempfile, :encoding => Encoding::UTF_8)).not_to match(/key-name/)
-    end
-
-    it "should purge keys with spaces in the comment string" do
-      apply_compiled_manifest(manifest)
-      expect(File.read(tempfile, :encoding => Encoding::UTF_8)).not_to match(/key name/)
-    end
-
-    context "with other prefetching resources evaluated first" do
-      let(:manifest) { "host { 'test': before => User[root] } user { 'root': purge_ssh_keys => '#{tempfile}' }" }
-
-      it "should purge authorized ssh keys" do
-        apply_compiled_manifest(manifest)
-        expect(File.read(tempfile, :encoding => Encoding::UTF_8)).not_to match(/key-name/)
-      end
-    end
-
-    context "with multiple unnamed keys" do
-      let(:tempfile) do
-        file_containing('user_spec', <<-EOF)
-          # comment #{mixed_utf8}
-          ssh-rsa KEY-DATA1
-          ssh-rsa KEY-DATA2
-          EOF
-      end
-
-      it "should purge authorized ssh keys" do
-        apply_compiled_manifest(manifest)
-        expect(File.read(tempfile, :encoding => Encoding::UTF_8)).not_to match(/KEY-DATA/)
-      end
-    end
-  end
-end

data/spec/lib/puppet_spec/https.rb

@@ -1,166 +0,0 @@
-require 'spec_helper'
-require 'webrick'
-
-class PuppetSpec::HTTPSServer
-  attr_reader :ca_cert, :ca_crl, :server_cert, :server_key
-
-  def initialize
-    @ca_cert = OpenSSL::X509::Certificate.new(CA_CERT)
-    @ca_crl = OpenSSL::X509::CRL.new(CRL)
-    @server_key = OpenSSL::PKey::RSA.new(SERVER_KEY)
-    @server_cert = OpenSSL::X509::Certificate.new(SERVER_CERT)
-    @config = WEBrick::Config::HTTP.dup
-  end
-
-  def handle_request(ctx, ssl)
-    req = WEBrick::HTTPRequest.new(@config)
-    req.parse(ssl)
-
-    res = WEBrick::HTTPResponse.new(@config)
-    res.status = 200
-    res.body = 'OK'
-    res.send_response(ssl)
-  end
-
-  def start_server(&block)
-    errors = []
-
-    IO.pipe {|stop_pipe_r, stop_pipe_w|
-      store = OpenSSL::X509::Store.new
-      store.add_cert(@ca_cert)
-      store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
-      ctx = OpenSSL::SSL::SSLContext.new
-      ctx.cert_store = store
-      ctx.cert = @server_cert
-      ctx.key = @server_key
-      ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
-
-      Socket.do_not_reverse_lookup = true
-      tcps = TCPServer.new("127.0.0.1", 0)
-      begin
-        port = tcps.connect_address.ip_port
-        begin
-          server_thread = Thread.new do
-            begin
-              ssls = OpenSSL::SSL::SSLServer.new(tcps, ctx)
-              ssls.start_immediately = true
-
-              loop do
-                readable, = IO.select([ssls, stop_pipe_r])
-                break if readable.include? stop_pipe_r
-
-                ssl = ssls.accept
-                begin
-                  handle_request(ctx, ssl)
-                ensure
-                  ssl.close
-                end
-              end
-            rescue => e
-              # uncomment this line if something goes wrong
-              # puts "SERVER #{e.message}"
-              errors << e
-            end
-          end
-
-          begin
-            yield port
-          ensure
-            stop_pipe_w.close
-          end
-        ensure
-          server_thread.join
-        end
-      ensure
-        tcps.close
-      end
-    }
-
-    errors
-  end
-
-CA_CERT = <<END
------BEGIN CERTIFICATE-----
-MIICMjCCAZugAwIBAgIBADANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0
-IENBMB4XDTcwMDEwMTAwMDAwMFoXDTI5MDMwMTIxMzgxMVowEjEQMA4GA1UEAwwH
-VGVzdCBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvPbXy4tgmUZsLx39
-Q7/Fuo5cOVk9yNzwMN4000jZQjAC8DQKXSDkbJ/6MmaiRo+VgwWlEIRVttYjrXF/
-YPKZowbEIaggc9uK96+HLiGiZ0H6rNM7DYsJiCX4OzJ91SOx9qsyJbyNxLbf+IP0
-961sTQhsRaqLn8vsn8Mv9I87eHsCAwEAAaOBlzCBlDAPBgNVHRMBAf8EBTADAQH/
-MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUlJ+BUoL64NmMn+IAgiLokQqr0zcw
-MQYJYIZIAYb4QgENBCQWIlB1cHBldCBTZXJ2ZXIgSW50ZXJuYWwgQ2VydGlmaWNh
-dGUwHwYDVR0jBBgwFoAUlJ+BUoL64NmMn+IAgiLokQqr0zcwDQYJKoZIhvcNAQEL
-BQADgYEAbIca4hMdGmQvLOnNIQJ+PaMsIQ9ZT6dr+NCvIf1Ass1dEr0qRy7tpyP0
-scgYmnIrOHDoe+ecyvEuG1oDb/6wLCGzD4OJXRsOzqsSCZJ31HkmDircQGpd+XbR
-BxqltBWaWmSBH+e64Himc1HbHRq5xb8JFRMK9dSqiF3DrREMN/A=
------END CERTIFICATE-----
-END
-
-CRL = <<END
------BEGIN X509 CRL-----
-MIIBCjB1AgEBMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNVBAMMB1Rlc3QgQ0EXDTcw
-MDEwMTAwMDAwMFoXDTI5MDMwMTIxMzgxMVqgLzAtMB8GA1UdIwQYMBaAFJSfgVKC
-+uDZjJ/iAIIi6JEKq9M3MAoGA1UdFAQDAgEAMA0GCSqGSIb3DQEBCwUAA4GBAK/r
-2fz+PGgDzu85Od5Tp6jH+3Ons5WURxZzpfveGcG5fgRIG274E5Q1z+Aoj9KW/J5V
-6FPbuoVEpykTicKKQaALHfryOEaLqIbTPu+94AivOx9RxzHhYPrblvjuDkmVf+fp
-O3/6YKoeOom3FP/ftKdcsx7tGXy8UxCMUaBGVb5J
------END X509 CRL-----
-END
-
-SERVER_CERT = <<END
------BEGIN CERTIFICATE-----
-MIIBvzCCASigAwIBAgIBAzANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0
-IENBMB4XDTcwMDEwMTAwMDAwMFoXDTI5MDMwMTIxMzgxMVowFDESMBAGA1UEAwwJ
-MTI3LjAuMC4xMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRTWFUYiB9TnI/
-ByjHHWnjnA02ieuczgAgI5CzrlrQCbCiogmsyvLmcKp4zJFVPTC6eG6Xy4sXANcn
-g44l5gr3wcSzYctukk05HSbbdoBK5jjAzMT6al9l4mQdVXmv6dIkPFq27rIEaJTu
-pOPaLn+mq64o2+lhTLLESOxygzOlWQIDAQABoyMwITAfBgNVHREEGDAWggkxMjcu
-MC4wLjGCCTEyNy4wLjAuMjANBgkqhkiG9w0BAQsFAAOBgQCNdGVATsyhgfNHe4K8
-19Bi80kA6bvrNQ+6dOwNA3bfpOXog3MU+T5+Sv1tlHl7lL+fnTHZkfRzcQhA10Fw
-YdAxLDyDcY4PzgQcWSw7Lu74TLucfzcR+s+MYHAy8XXP002kjCBrSoSMiQPtXF7P
-f/MQaTCXjA8BP6Ldw4wdlODR5A==
------END CERTIFICATE-----
-END
-
-SERVER_KEY = <<END
------BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDRTWFUYiB9TnI/ByjHHWnjnA02ieuczgAgI5CzrlrQCbCiogms
-yvLmcKp4zJFVPTC6eG6Xy4sXANcng44l5gr3wcSzYctukk05HSbbdoBK5jjAzMT6
-al9l4mQdVXmv6dIkPFq27rIEaJTupOPaLn+mq64o2+lhTLLESOxygzOlWQIDAQAB
-AoGAYbM9O6aSg+uaaNFut4ODajvt7wdydD+0z0vKwBUjTvk2+rOo0H/r4qW07a6Q
-KLnnhSOyfCkHRDWgOVGviQFZHHVptrxiMA6oiyWUL/CuKjGdDQi+Q1xnuEPh0qEz
-Q5ELkY1amDFS0pQV0LkDOweF4rc57haJcgRFxOz2HQJKeAECQQD0csJ4/sTq7lsg
-ebIFn0kKL/k99H53rUH3XlrnGo9CnVChLe6K9J/4smp98MCre0eSgc9ahNs2c4Fs
-ZpcgT8mVAkEA2zFwDhSXkkcWGmfk2Q/pfj/0OqLcIGTYkvi3sc2uirHb93VOLlvj
-ClM2XwRWeeeiEW+Ev5bLmHVGuK55+h/jtQJAfwTatJB9ti2gwGE79dvs0hRXiK/w
-vzMSIf2vcoLEijLAYOBDIYU3Ur0yxLpDA1gNur0lB74dQlAGolM0mB+deQJBAKBf
-RYsnydY+qI9dYHToTYAPrtOQANq6rjKqQ0yWHpRfmX8ulqsYk78kLu3KMLM0pMF5
-BHlhDUlY1QuerKQy3NkCQENWVz2NfnrrcgXUMHBojONcP3mkkOUocO4Ezm4GAgXO
-L55O+hAtuLYdxmuNPNhT2eyOsJ/pmPntS2k/rp39Hf4=
------END RSA PRIVATE KEY-----
-END
-
-UNKNOWN_CA = <<END
------BEGIN CERTIFICATE-----
-MIIEFTCCAv2gAwIBAgIGSUEs5AAQMA0GCSqGSIb3DQEBCwUAMIGnMQswCQYDVQQGEwJIVTERMA8G
-A1UEBwwIQnVkYXBlc3QxFTATBgNVBAoMDE5ldExvY2sgS2Z0LjE3MDUGA1UECwwuVGFuw7pzw610
-dsOhbnlraWFkw7NrIChDZXJ0aWZpY2F0aW9uIFNlcnZpY2VzKTE1MDMGA1UEAwwsTmV0TG9jayBB
-cmFueSAoQ2xhc3MgR29sZCkgRsWRdGFuw7pzw610dsOhbnkwHhcNMDgxMjExMTUwODIxWhcNMjgx
-MjA2MTUwODIxWjCBpzELMAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxO
-ZXRMb2NrIEtmdC4xNzA1BgNVBAsMLlRhbsO6c8OtdHbDoW55a2lhZMOzayAoQ2VydGlmaWNhdGlv
-biBTZXJ2aWNlcykxNTAzBgNVBAMMLE5ldExvY2sgQXJhbnkgKENsYXNzIEdvbGQpIEbFkXRhbsO6
-c8OtdHbDoW55MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxCRec75LbRTDofTjl5Bu
-0jBFHjzuZ9lk4BqKf8owyoPjIMHj9DrTlF8afFttvzBPhCf2nx9JvMaZCpDyD/V/Q4Q3Y1GLeqVw
-/HpYzY6b7cNGbIRwXdrzAZAj/E4wqX7hJ2Pn7WQ8oLjJM2P+FpD/sLj916jAwJRDC7bVWaaeVtAk
-H3B5r9s5VA1lddkVQZQBr17s9o3x/61k/iCa11zr/qYfCGSji3ZVrR47KGAuhyXoqq8fxmRGILdw
-fzzeSNuWU7c5d+Qa4scWhHaXWy+7GRWF+GmF9ZmnqfI0p6m2pgP8b4Y9VHx2BJtr+UBdADTHLpl1
-neWIA6pN+APSQnbAGwIDAKiLo0UwQzASBgNVHRMBAf8ECDAGAQH/AgEEMA4GA1UdDwEB/wQEAwIB
-BjAdBgNVHQ4EFgQUzPpnk/C2uNClwB7zU/2MU9+D15YwDQYJKoZIhvcNAQELBQADggEBAKt/7hwW
-qZw8UQCgwBEIBaeZ5m8BiFRhbvG5GK1Krf6BQCOUL/t1fC8oS2IkgYIL9WHxHG64YTjrgfpioTta
-YtOUZcTh5m2C+C8lcLIhJsFyUR+MLMOEkMNaj7rP9KdlpeuY0fsFskZ1FSNqb4VjMIDw1Z4fKRzC
-bLBQWV2QWzuoDTDPv31/zvGdg73JRm4gpvlhUbohL3u+pRVjodSVh/GeufOJ8z2FuLjbvrW5Kfna
-NwUASZQDhETnv0Mxz3WLJdH0pmT1kvarBes96aULNmLazAZfNou2XjG4Kvte9nHfRCaexOYNkbQu
-dZWAUWpLMKawYqGT8ZvYzsRjdT9ZR7E=
------END CERTIFICATE-----
-END
-end

data/spec/unit/application/cert_spec.rb

@@ -1,272 +0,0 @@
-require 'spec_helper'
-require 'puppet/application/cert'
-
-describe Puppet::Application::Cert => true do
-  before :each do
-    @cert_app = Puppet::Application[:cert]
-    allow(Puppet::Util::Log).to receive(:newdestination)
-  end
-
-  it "should operate in master run_mode" do
-    expect(@cert_app.class.run_mode.name).to equal(:master)
-  end
-
-  it "should declare a main command" do
-    expect(@cert_app).to respond_to(:main)
-  end
-
-  Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject{ |m| m == :destroy }.each do |method|
-    it "should declare option --#{method}" do
-      expect(@cert_app).to respond_to("handle_#{method}".to_sym)
-    end
-  end
-
-  it "should set log level to info with the --verbose option" do
-    @cert_app.handle_verbose(0)
-    expect(Puppet::Log.level).to eq(:info)
-  end
-
-  it "should set log level to debug with the --debug option" do
-    @cert_app.handle_debug(0)
-    expect(Puppet::Log.level).to eq(:debug)
-  end
-
-  it "should set the fingerprint digest with the --digest option" do
-    @cert_app.handle_digest(:digest)
-    expect(@cert_app.digest).to eq(:digest)
-  end
-
-  it "should set cert_mode to :destroy for --clean" do
-    @cert_app.handle_clean(0)
-    expect(@cert_app.subcommand).to eq(:destroy)
-  end
-
-  it "should set all to true for --all" do
-    @cert_app.handle_all(0)
-    expect(@cert_app.all).to be_truthy
-  end
-
-  it "should set signed to true for --signed" do
-    @cert_app.handle_signed(0)
-    expect(@cert_app.signed).to be_truthy
-  end
-
-  it "should set human to true for --human-readable" do
-    @cert_app.handle_human_readable(0)
-    expect(@cert_app.options[:format]).to be :human
-  end
-
-  it "should set machine to true for --machine-readable" do
-    @cert_app.handle_machine_readable(0)
-    expect(@cert_app.options[:format]).to be :machine
-  end
-
-  it "should set interactive to true for --interactive" do
-    @cert_app.handle_interactive(0)
-    expect(@cert_app.options[:interactive]).to be_truthy
-  end
-
-  it "should set yes to true for --assume-yes" do
-    @cert_app.handle_assume_yes(0)
-    expect(@cert_app.options[:yes]).to be_truthy
-  end
-
-  Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject { |m| m == :destroy }.each do |method|
-    it "should set cert_mode to #{method} with option --#{method}" do
-      @cert_app.send("handle_#{method}".to_sym, nil)
-
-      expect(@cert_app.subcommand).to eq(method)
-    end
-  end
-
-  describe "during setup" do
-
-    before :each do
-      allow(Puppet::Log).to receive(:newdestination)
-      allow(Puppet::SSL::Host).to receive(:ca_location=)
-      allow(Puppet::SSL::CertificateAuthority).to receive(:new)
-    end
-
-    it "should set console as the log destination" do
-      expect(Puppet::Log).to receive(:newdestination).with(:console)
-
-      @cert_app.setup
-    end
-
-    it "should print puppet config if asked to in Puppet config" do
-      allow(Puppet.settings).to receive(:print_configs?).and_return(true)
-      expect(Puppet.settings).to receive(:print_configs).and_return(true)
-      expect { @cert_app.setup }.to exit_with 0
-    end
-
-    it "should exit after printing puppet config if asked to in Puppet config" do
-      allow(Puppet.settings).to receive(:print_configs?).and_return(true)
-      expect { @cert_app.setup }.to exit_with 1
-    end
-
-    it "should set the CA location to 'only'" do
-      expect(Puppet::SSL::Host).to receive(:ca_location=).with(:only)
-
-      @cert_app.setup
-    end
-
-    it "should create a new certificate authority" do
-      expect(Puppet::SSL::CertificateAuthority).to receive(:new)
-
-      @cert_app.setup
-    end
-
-    it "should set the ca_location to :local if the cert_mode is generate" do
-      @cert_app.subcommand = 'generate'
-      expect(Puppet::SSL::Host).to receive(:ca_location=).with(:local)
-      @cert_app.setup
-    end
-
-    it "should set the ca_location to :local if the cert_mode is destroy" do
-      @cert_app.subcommand = 'destroy'
-      expect(Puppet::SSL::Host).to receive(:ca_location=).with(:local)
-      @cert_app.setup
-    end
-
-    it "should set the ca_location to :only if the cert_mode is print" do
-      @cert_app.subcommand = 'print'
-      expect(Puppet::SSL::Host).to receive(:ca_location=).with(:only)
-      @cert_app.setup
-    end
-  end
-
-  describe "when running" do
-    before :each do
-      @cert_app.all = false
-      @ca = double('ca', :waiting? => ['unsigned-node'])
-      @cert_app.ca = @ca
-      allow(@cert_app.command_line).to receive(:args).and_return([])
-      @iface = double('iface', apply: nil)
-      allow(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).and_return(@iface)
-    end
-
-    it "should delegate to the CertificateAuthority" do
-      expect(@iface).to receive(:apply)
-
-      @cert_app.main
-    end
-
-    it "should delegate with :all if option --all was given" do
-      @cert_app.handle_all(0)
-
-      expect(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).with(anything, hash_including(to: :all)).and_return(@iface)
-
-      @cert_app.main
-    end
-
-    it "should delegate to ca.apply with the hosts given on command line" do
-      allow(@cert_app.command_line).to receive(:args).and_return(["host"])
-
-      expect(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).with(anything, hash_including(to: ["host"])).and_return(@iface)
-
-      @cert_app.main
-    end
-
-    it "should send the currently set digest" do
-      allow(@cert_app.command_line).to receive(:args).and_return(["host"])
-      @cert_app.handle_digest(:digest)
-
-      expect(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).with(anything, hash_including(digest: :digest)).and_return(@iface)
-
-      @cert_app.main
-    end
-
-    it "should revoke cert if cert_mode is clean" do
-      @cert_app.subcommand = :destroy
-      allow(@cert_app.command_line).to receive(:args).and_return(["host"])
-
-      expect(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).with(:revoke, anything).and_return(@iface)
-      expect(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).with(:destroy, anything).and_return(@iface)
-
-      @cert_app.main
-    end
-
-    it "should not revoke cert if node does not have a signed certificate" do
-      @cert_app.subcommand = :destroy
-      allow(@cert_app.command_line).to receive(:args).and_return(["unsigned-node"])
-
-      allow(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).and_call_original
-      expect(Puppet::SSL::CertificateAuthority::Interface).not_to receive(:new).with(:revoke, anything)
-      expect(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).with(:destroy, {:to => ['unsigned-node'], :digest => nil}).and_return(@iface)
-
-      @cert_app.main
-    end
-
-    it "should only revoke signed certificate and destroy certificate signing requests" do
-      @cert_app.subcommand = :destroy
-      allow(@cert_app.command_line).to receive(:args).and_return(["host","unsigned-node"])
-
-      expect(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).with(:revoke, hash_including(to: ["host"])).and_return(@iface)
-      expect(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).with(:destroy, hash_including(to: ["host", "unsigned-node"])).and_return(@iface)
-
-      @cert_app.main
-    end
-
-    it "should refuse to destroy all certificates" do
-      @cert_app.subcommand = :destroy
-      @cert_app.all = true
-
-      allow(Puppet::SSL::CertificateAuthority::Interface).to receive(:new).and_call_original
-      expect(Puppet::SSL::CertificateAuthority::Interface).not_to receive(:new)
-
-      expect(Puppet).to receive(:log_exception) {|e| expect(e.message).to eq("Refusing to destroy all certs, provide an explicit list of certs to destroy")}
-
-      expect { @cert_app.main }.to exit_with(24)
-    end
-  end
-
-  describe "when identifying subcommands" do
-    before :each do
-      @cert_app.all = false
-      @ca = double('ca')
-      @cert_app.ca = @ca
-    end
-
-    %w{list revoke generate sign print verify fingerprint}.each do |cmd|
-      short = cmd[0,1]
-      [cmd, "--#{cmd}", "-#{short}"].each do |option|
-        # In our command line '-v' was eaten by 'verbose', so we can't consume
-        # it here; this is a special case from our otherwise standard
-        # processing. --daniel 2011-02-22
-        next if option == "-v"
-
-        it "should recognise '#{option}'" do
-          args = [option, "fun.example.com"]
-
-          allow(@cert_app.command_line).to receive(:args).and_return(args)
-          @cert_app.parse_options
-          expect(@cert_app.subcommand).to eq(cmd.to_sym)
-
-          expect(args).to eq(["fun.example.com"])
-        end
-      end
-    end
-
-    %w{clean --clean -c}.each do |ugly|
-      it "should recognise the '#{ugly}' option as destroy" do
-        args = [ugly, "fun.example.com"]
-
-        allow(@cert_app.command_line).to receive(:args).and_return(args)
-        @cert_app.parse_options
-        expect(@cert_app.subcommand).to eq(:destroy)
-
-        expect(args).to eq(["fun.example.com"])
-      end
-    end
-
-    it "should print help and exit if there is no subcommand" do
-      args = []
-      allow(@cert_app.command_line).to receive(:args).and_return(args)
-      allow(@cert_app).to receive(:help).and_return("I called for help!")
-      expect(@cert_app).to receive(:puts).with("I called for help!")
-
-      expect { @cert_app.parse_options }.to exit_with 0
-      expect(@cert_app.subcommand).to be_nil
-    end
-  end
-end