puppet 6.0.0 → 6.1.0

data/spec/integration/util/windows/security_spec.rb

@@ -285,10 +285,11 @@ describe "Puppet::Util::Windows::Security", :if => Puppet::Util::Platform.window
                     # access mask, and back to mode without loss of information
                     # (provided the owner and group are not the same)
                     next if ((u & g) != g) or ((g & o) != o)
-
-                    mode = (s << 9 | u << 6 | g << 3 | o << 0)
-                    winsec.set_mode(mode, path)
-                    expect(winsec.get_mode(path).to_s(8)).to eq(mode.to_s(8))
+                    applied_mode  = (s << 9 | u << 6 | g << 3 | o << 0)
+                    # SYSTEM must always be Full Control (7)
+                    expected_mode = (s << 9 | u << 6 | 7 << 3 | o << 0)
+                    winsec.set_mode(applied_mode, path)
+                    expect(winsec.get_mode(path).to_s(8)).to eq(expected_mode.to_s(8))
                   end
                 end
               end
@@ -634,9 +635,11 @@ describe "Puppet::Util::Windows::Security", :if => Puppet::Util::Platform.window
                   # access mask, and back to mode without loss of information
                   # (provided the owner and group are the same)
                   next if ((ug & o) != o)
-                  mode = (s << 9 | ug << 6 | ug << 3 | o << 0)
-                  winsec.set_mode(mode, path)
-                  expect(winsec.get_mode(path).to_s(8)).to eq(mode.to_s(8))
+                  applied_mode  = (s << 9 | ug << 6 | ug << 3 | o << 0)
+                  # SYSTEM must always be Full Control (7)
+                  expected_mode = (s << 9 | 7 << 6 | 7 << 3 | o << 0)
+                  winsec.set_mode(applied_mode, path)
+                  expect(winsec.get_mode(path).to_s(8)).to eq(expected_mode.to_s(8))
                 end
               end
             end

data/spec/integration/util/windows/user_spec.rb

@@ -6,54 +6,74 @@ describe "Puppet::Util::Windows::User", :if => Puppet::Util::Platform.windows? d
   describe "2003 without UAC" do
     before :each do
       Puppet::Util::Windows::Process.stubs(:windows_major_version).returns(5)
+      Puppet::Util::Windows::Process.stubs(:supports_elevated_security?).returns(false)
     end
 
     it "should be an admin if user's token contains the Administrators SID" do
       Puppet::Util::Windows::User.expects(:check_token_membership).returns(true)
-      Puppet::Util::Windows::Process.expects(:elevated_security?).never
 
       expect(Puppet::Util::Windows::User).to be_admin
     end
 
     it "should not be an admin if user's token doesn't contain the Administrators SID" do
       Puppet::Util::Windows::User.expects(:check_token_membership).returns(false)
-      Puppet::Util::Windows::Process.expects(:elevated_security?).never
 
       expect(Puppet::Util::Windows::User).not_to be_admin
     end
 
     it "should raise an exception if we can't check token membership" do
       Puppet::Util::Windows::User.expects(:check_token_membership).raises(Puppet::Util::Windows::Error, "Access denied.")
-      Puppet::Util::Windows::Process.expects(:elevated_security?).never
 
       expect { Puppet::Util::Windows::User.admin? }.to raise_error(Puppet::Util::Windows::Error, /Access denied./)
     end
   end
 
-  describe "2008 with UAC" do
+  context "2008 with UAC" do
     before :each do
       Puppet::Util::Windows::Process.stubs(:windows_major_version).returns(6)
+      Puppet::Util::Windows::Process.stubs(:supports_elevated_security?).returns(true)
     end
 
-    it "should be an admin if user is running with elevated privileges" do
-      Puppet::Util::Windows::Process.stubs(:elevated_security?).returns(true)
-      Puppet::Util::Windows::User.expects(:check_token_membership).never
+    describe "in local administrators group" do
+      before :each do
+        Puppet::Util::Windows::User.stubs(:check_token_membership).returns(true)
+      end
 
-      expect(Puppet::Util::Windows::User).to be_admin
-    end
+      it "should be an admin if user is running with elevated privileges" do
+        Puppet::Util::Windows::Process.stubs(:elevated_security?).returns(true)
 
-    it "should not be an admin if user is not running with elevated privileges" do
-      Puppet::Util::Windows::Process.stubs(:elevated_security?).returns(false)
-      Puppet::Util::Windows::User.expects(:check_token_membership).never
+        expect(Puppet::Util::Windows::User).to be_admin
+      end
 
-      expect(Puppet::Util::Windows::User).not_to be_admin
+      it "should not be an admin if user is not running with elevated privileges" do
+        Puppet::Util::Windows::Process.stubs(:elevated_security?).returns(false)
+
+        expect(Puppet::Util::Windows::User).not_to be_admin
+      end
+
+      it "should raise an exception if the process fails to open the process token" do
+        Puppet::Util::Windows::Process.stubs(:elevated_security?).raises(Puppet::Util::Windows::Error, "Access denied.")
+
+        expect { Puppet::Util::Windows::User.admin? }.to raise_error(Puppet::Util::Windows::Error, /Access denied./)
+      end
     end
 
-    it "should raise an exception if the process fails to open the process token" do
-      Puppet::Util::Windows::Process.stubs(:elevated_security?).raises(Puppet::Util::Windows::Error, "Access denied.")
-      Puppet::Util::Windows::User.expects(:check_token_membership).never
+    describe "not in local administrators group" do
+      before :each do
+        Puppet::Util::Windows::User.stubs(:check_token_membership).returns(false)
+      end
+
+      it "should not be an admin if user is running with elevated privileges" do
+        Puppet::Util::Windows::Process.stubs(:elevated_security?).returns(true)
 
-      expect { Puppet::Util::Windows::User.admin? }.to raise_error(Puppet::Util::Windows::Error, /Access denied./)
+        expect(Puppet::Util::Windows::User).not_to be_admin
+      end
+
+      it "should not be an admin if user is not running with elevated privileges" do
+        Puppet::Util::Windows::Process.stubs(:elevated_security?).returns(false)
+
+        expect(Puppet::Util::Windows::User).not_to be_admin
+      end
     end
   end
 

data/spec/lib/puppet/test_ca.rb

@@ -52,7 +52,7 @@ module Puppet
     def generate(name, opts)
       host_key = OpenSSL::PKey::RSA.new(1024)
       csr = create_csr(name, host_key)
-      sign(csr, opts)
+      { private_key: host_key, csr: csr, cert: sign(csr, opts).content }
     end
 
     private

data/spec/spec_helper.rb

@@ -5,7 +5,7 @@
 dir = File.expand_path(File.dirname(__FILE__))
 $LOAD_PATH.unshift File.join(dir, 'lib')
 
-# Don't want puppet getting the command line arguments for rake or autotest
+# Don't want puppet getting the command line arguments for rake
 ARGV.clear
 
 begin

data/spec/unit/agent_spec.rb

@@ -138,7 +138,7 @@ describe Puppet::Agent do
 
     it "should not fail if a client class instance cannot be created" do
       AgentTestClient.expects(:new).raises "eh"
-      Puppet.expects(:err)
+      Puppet.expects(:log_exception)
       @agent.run
     end
 
@@ -146,7 +146,7 @@ describe Puppet::Agent do
       client = AgentTestClient.new
       AgentTestClient.expects(:new).returns client
       client.expects(:run).raises "eh"
-      Puppet.expects(:err)
+      Puppet.expects(:log_exception)
       @agent.run
     end
 

data/spec/unit/application/apply_spec.rb

@@ -7,6 +7,8 @@ require 'puppet/configurer'
 require 'fileutils'
 
 describe Puppet::Application::Apply do
+  include PuppetSpec::Files
+
   before :each do
     @apply = Puppet::Application[:apply]
     Puppet::Util::Log.stubs(:newdestination)
@@ -91,6 +93,13 @@ describe Puppet::Application::Apply do
       @apply.setup
     end
 
+    it "sets the log destination if logdest is provided via settings" do
+      Puppet::Log.expects(:newdestination).with("set_via_config")
+      Puppet[:logdest] = "set_via_config"
+
+      @apply.setup
+    end
+
     it "should set INT trap" do
       Signal.expects(:trap).with(:INT)
 
@@ -172,8 +181,6 @@ describe Puppet::Application::Apply do
     end
 
     describe "the main command" do
-      include PuppetSpec::Files
-
       before :each do
         Puppet[:prerun_command] = ''
         Puppet[:postrun_command] = ''
@@ -279,6 +286,11 @@ describe Puppet::Application::Apply do
         expect { @apply.main }.to exit_with 0
       end
 
+      it 'should called the DeferredResolver to resolve any Deferred values' do
+        Puppet::Pops::Evaluator::DeferredResolver.expects(:resolve_and_replace).with(any_parameters)
+        expect { @apply.main }.to exit_with 0
+      end
+
       it 'should make the Puppet::Pops::Loaders available when applying the compiled catalog' do
         Puppet::Resource::Catalog.indirection.expects(:find).returns(@catalog)
         @apply.expects(:apply_catalog).with(@catalog) do
@@ -475,6 +487,47 @@ describe Puppet::Application::Apply do
         end
         expect { @apply.apply }.not_to raise_error
       end
+
+      it "should call the DeferredResolver to resolve Deferred values" do
+        @apply.options[:catalog] = temporary_catalog
+        Puppet::Resource::Catalog.stubs(:default_format).returns :rot13_piglatin
+        catalog = Puppet::Resource::Catalog.new("testing", Puppet::Node::Environment::NONE)
+        Puppet::Resource::Catalog.stubs(:convert_from).with(:rot13_piglatin,'"something"').returns(catalog)
+        Puppet::Pops::Evaluator::DeferredResolver.expects(:resolve_and_replace).with(any_parameters)
+        @apply.apply
+      end
+    end
+  end
+
+  describe "when really executing" do
+    let(:testfile) { tmpfile('secret_file_name') }
+    let(:resourcefile) { tmpfile('resourcefile') }
+    let(:classfile) { tmpfile('classfile') }
+
+    it "should not expose sensitive data in the relationship file" do
+      @apply.options[:code] = <<-CODE
+        $secret = Sensitive('cat #{testfile}')
+
+        exec { 'do it':
+          command => $secret,
+          path    => '/bin/'
+        }
+      CODE
+
+      @apply.options[:write_catalog_summary] = true
+
+      Puppet.settings[:resourcefile] = resourcefile
+      Puppet.settings[:classfile] = classfile
+
+      #We don't actually need the resource to do anything, we are using it's properties in other parts of the workflow.
+      Puppet::Util::Execution.stubs(:execute)
+
+      expect { @apply.main }.to exit_with 0
+
+      result = File.read(resourcefile)
+
+      expect(result).not_to match(/secret_file_name/)
+      expect(result).to match(/do it/)
     end
   end
 

data/spec/unit/application/device_spec.rb

@@ -75,25 +75,25 @@ describe Puppet::Application::Device do
     it "should set waitforcert to 0 with --onetime and if --waitforcert wasn't given" do
       Puppet[:onetime] = true
       Puppet::SSL::Host.any_instance.expects(:wait_for_cert).with(0)
-      @device.setup_host
+      @device.setup_host('device.example.com')
     end
 
     it "should use supplied waitforcert when --onetime is specified" do
       Puppet[:onetime] = true
       @device.handle_waitforcert(60)
       Puppet::SSL::Host.any_instance.expects(:wait_for_cert).with(60)
-      @device.setup_host
+      @device.setup_host('device.example.com')
     end
 
     it "should use a default value for waitforcert when --onetime and --waitforcert are not specified" do
       Puppet::SSL::Host.any_instance.expects(:wait_for_cert).with(120)
-      @device.setup_host
+      @device.setup_host('device.example.com')
     end
 
     it "should use the waitforcert setting when checking for a signed certificate" do
       Puppet[:waitforcert] = 10
       Puppet::SSL::Host.any_instance.expects(:wait_for_cert).with(10)
-      @device.setup_host
+      @device.setup_host('device.example.com')
     end
 
     it "should set the log destination with --logdest" do
@@ -271,14 +271,14 @@ describe Puppet::Application::Device do
 
     it "should create a new ssl host" do
       Puppet::SSL::Host.expects(:new).returns(@host)
-      @device.setup_host
+      @device.setup_host('device.example.com')
     end
 
     it "should wait for a certificate" do
       @device.options.stubs(:[]).with(:waitforcert).returns(123)
       @host.expects(:wait_for_cert).with(123)
 
-      @device.setup_host
+      @device.setup_host('device.example.com')
     end
   end
 
@@ -292,6 +292,7 @@ describe Puppet::Application::Device do
       @device.options.stubs(:[]).with(:facts).returns(false)
       @device.options.stubs(:[]).with(:resource).returns(false)
       @device.options.stubs(:[]).with(:to_yaml).returns(false)
+      @device.options.stubs(:[]).with(:libdir).returns(nil)
       @device.options.stubs(:[]).with(:client)
       @device.command_line.stubs(:args).returns([])
       Puppet::Util::NetworkDevice::Config.stubs(:devices).returns({})
@@ -497,7 +498,9 @@ describe Puppet::Application::Device do
         expect { @device.main }.to exit_with 1
       end
 
-      it "should print the device url scheme, host, and port" do
+      it "should retrieve plugins and print the device url scheme, host, and port" do
+        Puppet.stubs(:info)
+        Puppet.expects(:info).with "Retrieving pluginfacts"
         Puppet.expects(:info).with "starting applying configuration to device1 at ssh://testhost"
         Puppet.expects(:info).with "starting applying configuration to device2 at https://testhost:443/some/path"
         expect { @device.main }.to exit_with 1

data/spec/unit/application/face_base_spec.rb

@@ -416,7 +416,7 @@ EOT
       # it, but this helps us fail if that slips up and all. --daniel 2011-04-27
       Puppet::Face[:help, :current].expects(:help).never
 
-      Puppet.expects(:err).with("Could not parse application options: I don't know how to render 'interpretive-dance'")
+      Puppet.expects(:send_log).with(:err, "Could not parse application options: I don't know how to render 'interpretive-dance'")
 
       expect { app.run }.to exit_with(1)
     end

data/spec/unit/application/lookup_spec.rb

@@ -13,7 +13,8 @@ describe Puppet::Application::Lookup do
     ensure
       $stdout = saved_stdout
     end
-    capture.string.strip
+    # Drop end of line and an optional yaml end of document
+    capture.string.gsub(/\n(\.\.\.\n)?\Z/m, '')
   end
 
   context "when running with incorrect command line options" do