puppet 6.0.0 → 6.1.0

data/spec/unit/application/ssl_spec.rb

@@ -2,88 +2,24 @@ require 'spec_helper'
 require 'puppet/application/ssl'
 require 'webmock/rspec'
 require 'openssl'
+require 'puppet/test_ca'
 
 describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
-  let(:ssl) { Puppet::Application[:ssl] }
-  let(:name) { 'ssl-client' }
-
-  def generate_cert(name, issuer = nil, issuer_key = nil)
-    # generate CA key pair
-    private_key = OpenSSL::PKey::RSA.new(512)
-    public_key = private_key.public_key
-
-    # generate CSR
-    csr = OpenSSL::X509::Request.new
-    csr.version = 0
-    csr.subject = OpenSSL::X509::Name.new([["CN", name]])
-    csr.public_key = public_key
-    csr.sign(private_key, OpenSSL::Digest::SHA256.new)
-
-    # is it self-signed?
-    issuer ||= csr.subject
-    issuer_key ||= private_key
-
-    # issue cert
-    cert = OpenSSL::X509::Certificate.new
-    cert.version    = 2 # X509v3
-    cert.subject    = csr.subject
-    cert.issuer     = issuer
-    cert.public_key = csr.public_key
-    cert.serial     = 1
-    cert.not_before = Time.now - (60*60*24)
-    cert.not_after  = Time.now + (60*60*24)
-
-    # Ugly hack, but we need to make sure the CA cert has the proper
-    # X509v3 Basic Constraints to be a valid CA certificate.
-    if name == 'ca'
-      extension_factory = OpenSSL::X509::ExtensionFactory.new
-      extension_factory.subject_certificate = cert
-      extension_factory.issuer_certificate = cert
-
-      extensions = {
-        "keyUsage"         => [%w{cRLSign keyCertSign}, true],
-        "basicConstraints" => ["CA:TRUE", true],
-      }
-
-      cert.extensions = extensions.map do |oid, (val, crit)|
-        val = val.join(', ') unless val.is_a? String
-
-        if Puppet::SSL::Oids.subtree_of?('id-ce', oid) or Puppet::SSL::Oids.subtree_of?('id-pkix', oid)
-          # Attempt to create a X509v3 certificate extension. Standard certificate
-          # extensions may need access to the associated subject certificate and
-          # issuing certificate, so must be created by the OpenSSL::X509::ExtensionFactory
-          # which provides that context.
-          extension_factory.create_ext(oid, val, crit)
-        else
-          # This is not an X509v3 extension which means that the extension
-          # factory cannot generate it. We need to generate the extension
-          # manually.
-          OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(val).to_der, crit)
-        end
-      end
-    end
-
-    cert.sign(issuer_key, OpenSSL::Digest::SHA256.new)
+  include PuppetSpec::Files
 
-    {:private_key => private_key, :csr => csr, :cert => cert}
-  end
-
-  def generate_crl(name, issuer, issuer_key)
-    crl = OpenSSL::X509::CRL.new
-    crl.version = 1
-    crl.issuer = issuer
-    crl.last_update = Time.now - (60*60*24)
-    crl.next_update =  Time.now + (60*60*24)
-    crl.extensions = [OpenSSL::X509::Extension.new('crlNumber', OpenSSL::ASN1::Integer(0))]
-    crl.sign(issuer_key, OpenSSL::Digest::SHA256.new)
-
-    crl
+  let(:ssl) do
+    app = Puppet::Application[:ssl]
+    app.options[:verbose] = true
+    app.setup_logs
+    app
   end
+  let(:name) { 'ssl-client' }
 
   before :all do
-    @ca = generate_cert('ca')
-    @crl = generate_crl('ca', @ca[:cert].subject, @ca[:private_key])
-    @host = generate_cert('ssl-client', @ca[:cert].subject, @ca[:private_key])
+    @ca = Puppet::TestCa.new
+    @ca_cert = @ca.ca_cert
+    @crl = @ca.ca_crl
+    @host = @ca.generate('ssl-client', {})
   end
 
   before do
@@ -91,9 +27,10 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
 
     Puppet.settings.use(:main)
     Puppet[:certname] = name
+    Puppet[:vardir] = tmpdir("ssl_testing")
 
     # Host assumes ca cert and crl are present
-    File.open(Puppet[:localcacert], 'w') { |f| f.write(@ca[:cert].to_pem) }
+    File.open(Puppet[:localcacert], 'w') { |f| f.write(@ca_cert.to_pem) }
     File.open(Puppet[:hostcrl], 'w') { |f| f.write(@crl.to_pem) }
 
     # Setup our ssl client
@@ -101,25 +38,31 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
     File.open(Puppet[:hostpubkey], 'w') { |f| f.write(@host[:private_key].public_key.to_pem) }
   end
 
-  def expects_command_to_output(expected_message = nil, code = 0)
+  def expects_command_to_pass(expected_output = nil)
+    expect {
+      ssl.run_command
+    }.to have_printed(expected_output)
+  end
+
+  def expects_command_to_fail(message)
     expect {
       expect {
         ssl.run_command
-      }.to exit_with(code)
-    }.to output(expected_message).to_stdout
+      }.to raise_error(Puppet::Error, message)
+    }.to have_printed(/.*/) # ignore output
   end
 
   shared_examples_for 'an ssl action' do
     it 'downloads the CA bundle first when missing' do
       File.delete(Puppet[:localcacert])
-      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: @ca[:cert].to_pem)
+      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: @ca.ca_cert.to_pem)
       stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
       stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
-      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
 
-      expects_command_to_output
+      expects_command_to_pass
 
-      expect(File.read(Puppet[:localcacert])).to eq(@ca[:cert].to_pem)
+      expect(File.read(Puppet[:localcacert])).to eq(@ca.ca_cert.to_pem)
     end
 
     it 'downloads the CRL bundle first when missing' do
@@ -127,23 +70,29 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
       stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: @crl.to_pem)
       stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
       stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
-      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
 
-      expects_command_to_output
+      expects_command_to_pass
 
       expect(File.read(Puppet[:hostcrl])).to eq(@crl.to_pem)
     end
   end
 
+  it 'uses the agent run mode' do
+    # make sure the ssl app resolves certname, server, etc
+    # the same way the agent application does
+    expect(ssl.class.run_mode.name).to eq(:agent)
+  end
+
   context 'when generating help' do
-    it 'prints usage when no arguments are specified' do
+    it 'prints a message when an unknown action is specified' do
       ssl.command_line.args << 'whoops'
 
-      expects_command_to_output(/Unknown action 'whoops'/, 1)
+      expects_command_to_fail(/Unknown action 'whoops'/)
     end
 
-    it 'rejects unknown actions' do
-      expects_command_to_output(/^puppet-ssl.*SYNOPSIS/m, 1)
+    it 'prints a message requiring an action to be specified' do
+      expects_command_to_fail(/An action must be specified/)
     end
   end
 
@@ -161,7 +110,7 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
       stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
 
-      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
 
       expect(Puppet::FileSystem).to be_exist(csr_path)
     end
@@ -171,13 +120,13 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
       stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
 
-      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
 
       stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200, body: @host[:csr].to_pem)
       #  we skip :put
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
 
-      expects_command_to_output
+      expects_command_to_pass
     end
 
     it "warns if the local CSR doesn't match the local public key, and submits a new CSR" do
@@ -199,7 +148,7 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
 
       Puppet.stubs(:warning) # ignore unrelated warnings
       Puppet.expects(:warning).with("The local CSR does not match the agent's public key. Generating a new CSR.")
-      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
     end
 
     it 'downloads the certificate when autosigning is enabled' do
@@ -207,7 +156,7 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
       stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
 
-      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
 
       expect(Puppet::FileSystem).to be_exist(Puppet[:hostcert])
     end
@@ -219,7 +168,7 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
       stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
 
-      expects_command_to_output
+      expects_command_to_pass
 
       csr = Puppet::SSL::CertificateRequest.new(name)
       csr.read(csr_path)
@@ -237,7 +186,7 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
     it 'downloads a new cert' do
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
 
-      expects_command_to_output(%r{Downloaded certificate '#{name}' with fingerprint .*})
+      expects_command_to_pass(%r{Downloaded certificate '#{name}' with fingerprint .*})
 
       expect(File.read(Puppet[:hostcert])).to eq(@host[:cert].to_pem)
     end
@@ -247,7 +196,7 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
 
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
 
-      expects_command_to_output(%r{Downloaded certificate '#{name}' with fingerprint .*})
+      expects_command_to_pass(%r{Downloaded certificate '#{name}' with fingerprint .*})
 
       expect(File.read(Puppet[:hostcert])).to eq(@host[:cert].to_pem)
     end
@@ -262,13 +211,15 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
 
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
 
-      expects_command_to_output(%r{^Failed to download certificate: The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root?}, 1)
+      expects_command_to_fail(
+        %r{^Failed to download certificate: The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root?}
+      )
     end
 
     it "prints a message if there isn't a cert to download" do
       stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
 
-      expects_command_to_output(/No certificate for '#{name}' on CA/)
+      expects_command_to_fail(/The certificate for '#{name}' has not yet been signed/)
     end
   end
 
@@ -282,13 +233,13 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
     it 'reports if the key is missing' do
       File.delete(Puppet[:hostprivkey])
 
-      expects_command_to_output(/The host's private key is missing/, 1)
+      expects_command_to_fail(/The host's private key is missing/)
     end
 
     it 'reports if the cert is missing' do
       File.delete(Puppet[:hostcert])
 
-      expects_command_to_output(/The host's certificate is missing/, 1)
+      expects_command_to_fail(/The host's certificate is missing/)
     end
 
     it 'reports if the key and cert are mismatched' do
@@ -298,25 +249,143 @@ describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
       File.open(Puppet[:hostprivkey], 'w') { |f| f.write(private_key.to_pem) }
       File.open(Puppet[:hostpubkey], 'w') { |f| f.write(public_key.to_pem) }
 
-      expects_command_to_output(/The host's key does not match the certificate/, 1)
+      expects_command_to_fail(/The host's key does not match the certificate/)
     end
 
     it 'reports if the cert verification fails' do
       # generate a new CA to force an error
-      ca = generate_cert('ca')
-      File.open(Puppet[:localcacert], 'w') { |f| f.write(ca[:cert].to_pem) }
+      new_ca = Puppet::TestCa.new
+      File.open(Puppet[:localcacert], 'w') { |f| f.write(new_ca.ca_cert.to_pem) }
 
       # and CRL for that CA
-      crl = generate_crl('ca', ca[:cert].subject, ca[:private_key])
-      File.open(Puppet[:hostcrl], 'w') { |f| f.write(crl.to_pem) }
+      File.open(Puppet[:hostcrl], 'w') { |f| f.write(new_ca.ca_crl.to_pem) }
 
-      expects_command_to_output(/Failed to verify certificate '#{name}': certificate signature failure \(7\)/, 1)
+      expects_command_to_fail(
+        /Failed to verify certificate '#{name}': certificate signature failure \(7\)/
+      )
     end
 
     it 'reports when verification succeeds' do
       OpenSSL::X509::Store.any_instance.stubs(:verify).returns(true)
 
-      expects_command_to_output(/Verified certificate '#{name}'/, 0)
+      expects_command_to_pass(/Verified certificate '#{name}'/)
+    end
+  end
+
+  context 'when cleaning' do
+    before do
+      ssl.command_line.args << 'clean'
+    end
+
+    it 'deletes the hostcert' do
+      File.open(Puppet[:hostcert], 'w') { |f| f.write(@host[:cert].to_pem) }
+
+      expects_command_to_pass(%r{Removed certificate #{Puppet[:cert]}})
+    end
+
+    it 'deletes the private key' do
+      File.open(Puppet[:hostprivkey], 'w') { |f| f.write(@host[:private_key].to_pem) }
+
+      expects_command_to_pass(%r{Removed private key #{Puppet[:hostprivkey]}})
+    end
+
+    it 'deletes the public key' do
+      File.open(Puppet[:hostpubkey], 'w') { |f| f.write(@host[:private_key].public_key.to_pem) }
+
+      expects_command_to_pass(%r{Removed public key #{Puppet[:hostpubkey]}})
+    end
+
+    it 'deletes the request' do
+      path = File.join(Puppet[:requestdir], "#{Puppet[:certname]}.pem")
+      File.open(path, 'w') { |f| f.write(@host[:csr].to_pem) }
+
+      expects_command_to_pass(%r{Removed certificate request #{path}})
+    end
+
+    it 'deletes the passfile' do
+      File.open(Puppet[:passfile], 'w') { |_| }
+
+      expects_command_to_pass(%r{Removed private key password file #{Puppet[:passfile]}})
     end
+
+    it 'skips files that do not exist' do
+      File.delete(Puppet[:hostprivkey])
+
+      expect {
+        ssl.run_command
+      }.to_not output(%r{Removed private key #{Puppet[:hostprivkey]}}).to_stdout
+    end
+
+    it "raises if we fail to retrieve server's cert that we're about to clean" do
+      Puppet[:certname] = name
+      Puppet[:server] = name
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_raise(Errno::ECONNREFUSED)
+
+      expects_command_to_fail(%r{Failed to connect to the CA to determine if certificate #{name} has been cleaned})
+    end
+
+    context 'when deleting local CA' do
+      before do
+        ssl.command_line.args << '--localca'
+        ssl.parse_options
+      end
+
+      it 'deletes the local CA cert' do
+        File.open(Puppet[:localcacert], 'w') { |f| f.write(@ca_cert.to_pem) }
+
+        expects_command_to_pass(%r{Removed local CA certificate #{Puppet[:localcacert]}})
+      end
+
+      it 'deletes the local CRL' do
+        File.open(Puppet[:hostcrl], 'w') { |f| f.write(@crl.to_pem) }
+
+        expects_command_to_pass(%r{Removed local CRL #{Puppet[:hostcrl]}})
+      end
+    end
+
+    context 'on the puppetserver host' do
+      before :each do
+        Puppet[:certname] = 'puppetserver'
+        Puppet[:server] = 'puppetserver'
+      end
+
+      it "prints an error when the CA is local and the CA has not cleaned its cert" do
+        stub_request(:get, %r{puppet-ca/v1/certificate/puppetserver}).to_return(status: 200, body: @host[:cert].to_pem)
+
+        expects_command_to_fail(%r{The certificate puppetserver must be cleaned from the CA first})
+      end
+
+      it "cleans the cert when the CA is local and the CA has already cleaned its cert" do
+        File.open(Puppet[:hostcert], 'w') { |f| f.write(@host[:cert].to_pem) }
+
+        stub_request(:get, %r{puppet-ca/v1/certificate/puppetserver}).to_return(status: 404)
+
+        expects_command_to_pass(%r{Removed certificate .*puppetserver.pem})
+      end
+
+      it "cleans the cert when run on a puppetserver that isn't the CA" do
+        File.open(Puppet[:hostcert], 'w') { |f| f.write(@host[:cert].to_pem) }
+
+        Puppet[:ca_server] = 'caserver'
+
+        expects_command_to_pass(%r{Removed certificate .*puppetserver.pem})
+      end
+    end
+
+    context 'when cleaning a device' do
+      before do
+        ssl.command_line.args = ['clean', '--target', 'device.example.com']
+        ssl.parse_options
+      end
+
+      it 'deletes the device certificate' do
+        device_cert_path = File.join(Puppet[:devicedir], 'device.example.com', 'ssl', 'certs')
+        device_cert_file = File.join(device_cert_path, 'device.example.com.pem')
+        FileUtils.mkdir_p(device_cert_path)
+        File.open(device_cert_file, 'w') { |f| f.write('device.example.com') }
+        expects_command_to_pass(%r{Removed certificate #{device_cert_file}})
+     end
+  end
   end
 end

data/spec/unit/application_spec.rb

@@ -33,7 +33,7 @@ describe Puppet::Application do
   describe "application defaults" do
     it "should fail if required app default values are missing" do
       @app.stubs(:app_defaults).returns({ :foo => 'bar' })
-      Puppet.expects(:err).with(regexp_matches(/missing required app default setting/))
+      Puppet.expects(:send_log).with(:err, regexp_matches(/missing required app default setting/))
       expect {
         @app.run
       }.to exit_with(1)
@@ -55,10 +55,10 @@ describe Puppet::Application do
     end
 
     it "should error if it can't find a class" do
-      Puppet.expects(:err).with do |value|
-        value =~ /Unable to find application 'ThisShallNeverEverEverExist'/ and
-          value =~ /puppet\/application\/thisshallneverevereverexist/ and
-          value =~ /no such file to load|cannot load such file/
+      Puppet.expects(:send_log).with do |_level, message|
+        message =~ /Unable to find application 'ThisShallNeverEverEverExist'/ and
+          message =~ /puppet\/application\/thisshallneverevereverexist/ and
+          message =~ /no such file to load|cannot load such file/
       end
 
       expect {
@@ -422,7 +422,6 @@ describe Puppet::Application do
   end
 
   describe "when calling default setup" do
-
     before :each do
       @app.options.stubs(:[])
     end
@@ -443,6 +442,14 @@ describe Puppet::Application do
 
       @app.setup
     end
+  
+    it "sets the log destination if provided via settings" do
+      @app.options.unstub(:[])
+      Puppet[:logdest] = "set_via_config"
+      Puppet::Util::Log.expects(:newdestination).with("set_via_config")
+
+      @app.setup
+    end
 
     it "does not downgrade the loglevel when --verbose is specified" do
       Puppet[:log_level] = :debug
@@ -553,19 +560,19 @@ describe Puppet::Application do
     end
 
     it "should warn and exit if no command can be called" do
-      Puppet.expects(:err)
+      Puppet.expects(:send_log).with(:err, "Could not run: No valid command or main")
       expect { @app.run }.to exit_with 1
     end
 
     it "should raise an error if dispatch returns no command" do
       @app.stubs(:get_command).returns(nil)
-      Puppet.expects(:err)
+      Puppet.expects(:send_log).with(:err, "Could not run: No valid command or main")
       expect { @app.run }.to exit_with 1
     end
 
     it "should raise an error if dispatch returns an invalid command" do
       @app.stubs(:get_command).returns(:this_function_doesnt_exist)
-      Puppet.expects(:err)
+      Puppet.expects(:send_log).with(:err, "Could not run: No valid command or main")
       expect { @app.run }.to exit_with 1
     end
   end
@@ -652,7 +659,6 @@ describe Puppet::Application do
   end
 
   describe "#handle_logdest_arg" do
-
     let(:test_arg) { "arg_test_logdest" }
 
     it "should log an exception that is raised" do
@@ -672,6 +678,18 @@ describe Puppet::Application do
       @app.handle_logdest_arg(test_arg)
       expect(@app.options[:setdest]).to be_truthy
     end
-  end
 
+    it "does not set the log destination if setdest is true" do
+      Puppet::Util::Log.expects(:newdestination).never
+      @app.options[:setdest] = true
+
+      @app.handle_logdest_arg(test_arg)
+    end
+
+    it "does not set the log destination if arg is nil" do
+      Puppet::Util::Log.expects(:newdestination).never
+
+      @app.handle_logdest_arg(nil)
+    end
+  end
 end

data/spec/unit/configurer/downloader_spec.rb

@@ -222,7 +222,7 @@ describe Puppet::Configurer::Downloader do
     end
 
     it "should catch and log exceptions" do
-      Puppet.expects(:err)
+      Puppet.expects(:log_exception)
       # The downloader creates a new catalog for each apply, and really the only object
       # that it is possible to stub for the purpose of generating a puppet error
       Puppet::Resource::Catalog.any_instance.stubs(:apply).raises(Puppet::Error, "testing")

data/spec/unit/configurer_spec.rb

@@ -551,8 +551,8 @@ describe Puppet::Configurer do
 
       Puppet::Transaction::Report.indirection.expects(:save).raises("whatever")
 
-      Puppet.expects(:err)
-      expect { @configurer.send_report(@report) }.not_to raise_error
+      Puppet.expects(:send_log).with(:err, 'Could not send report: whatever')
+      @configurer.send_report(@report)
     end
   end
 
@@ -590,8 +590,8 @@ describe Puppet::Configurer do
 
       Puppet::Util.expects(:replace_file).yields(fh)
 
-      Puppet.expects(:err)
-      expect { @configurer.save_last_run_summary(@report) }.to_not raise_error
+      Puppet.expects(:send_log).with(:err, 'Could not save last run local report: failed to do print')
+      @configurer.save_last_run_summary(@report)
     end
 
     it "should create the last run file with the correct mode" do
@@ -609,7 +609,7 @@ describe Puppet::Configurer do
 
     it "should report invalid last run file permissions" do
       Puppet.settings.setting(:lastrunfile).expects(:mode).returns('892')
-      Puppet.expects(:err).with(regexp_matches(/Could not save last run local report.*892 is invalid/))
+      Puppet.expects(:send_log).with(:err, regexp_matches(/Could not save last run local report.*892 is invalid/))
       @configurer.save_last_run_summary(@report)
     end
   end
@@ -1019,6 +1019,17 @@ describe Puppet::Configurer do
       expect(options[:report].master_used).to eq('myserver:123')
     end
 
+    it "queries the simple status for the 'master' service" do
+      Puppet.settings[:server_list] = ["myserver:123"]
+      response = Net::HTTPOK.new(nil, 200, 'OK')
+      http = mock('request')
+      http.expects(:get).with('/status/v1/simple/master').returns(response)
+      Puppet::Network::HttpPool.stubs(:http_ssl_instance).with('myserver', '123').returns(http)
+      @agent.stubs(:run_internal)
+
+      @agent.run
+    end
+
     it "should report when a server is unavailable" do
       Puppet.settings[:server_list] = ["myserver:123"]
       response = Net::HTTPInternalServerError.new(nil, 500, 'Internal Server Error')

data/spec/unit/etc_spec.rb

@@ -412,6 +412,31 @@ describe Puppet::Etc, :if => !Puppet::Util::Platform.windows? do
     end
   end
 
+  describe :group do
+    it 'should return the next group struct if a block is not provided' do
+      Puppet::Etc.expects(:getgrent).returns(ascii_group_struct)
+
+      expect(Puppet::Etc.group).to eql(ascii_group_struct)
+    end
+
+    it 'should iterate over the available groups if a block is provided' do
+      expected_groups = [
+        utf_8_group_struct,
+        euc_kr_group_struct,
+        ascii_group_struct
+      ]
+      Puppet::Etc.stubs(:getgrent).returns(*(expected_groups + [nil]))
+
+      Puppet::Etc.expects(:setgrent)
+      Puppet::Etc.expects(:endgrent)
+
+      actual_groups = []
+      Puppet::Etc.group { |group| actual_groups << group }
+
+      expect(actual_groups).to eql(expected_groups)
+    end
+  end
+
   describe "endgrent" do
     it "should call Etc.getgrent" do
       Etc.expects(:getgrent)

data/spec/unit/face/node_spec.rb

@@ -2,8 +2,6 @@
 require 'spec_helper'
 require 'puppet/face'
 
-require 'puppetserver/ca/cli'
-
 describe Puppet::Face[:node, '0.0.1'] do
   describe '#cleanup' do
     it "should clean everything" do
@@ -90,7 +88,7 @@ describe Puppet::Face[:node, '0.0.1'] do
         end
       end
 
-      describe "when cleaning certificate" do
+      describe "when cleaning certificate", :if => Puppet.features.puppetserver_ca? do
         it "should call the CA CLI gem's clean action" do
           Puppetserver::Ca::Action::Clean.any_instance.expects(:run).with({ 'certnames' => ['hostname'] }).returns(0)
           subject.clean_cert('hostname')

data/spec/unit/face/parser_spec.rb

@@ -35,6 +35,21 @@ describe Puppet::Face[:parser, :current] do
         expect { parser.validate(manifest) }.to exit_with(1)
       end
 
+      it "validates static heredoc with specified syntax" do
+        manifest = file_containing('site.pp', "@(EOT:pp)
+          { invalid =>
+          EOT
+        ")
+        expect { parser.validate(manifest) }.to exit_with(1)
+      end
+
+      it "does not validates dynamic heredoc with specified syntax" do
+        manifest = file_containing('site.pp', "@(\"EOT\":pp)
+        {invalid => ${1+1}
+        EOT")
+        expect { parser.validate(manifest) }.to_not exit_with(1)
+      end
+
       it "runs error free when there are no validation errors" do
         expect {
             manifest = file_containing('site.pp', "notify { valid: }")