puppet 6.0.5 → 6.0.7

data/man/man5/puppet.conf.5

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPETCONF" "5" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPETCONF" "5" "March 2019" "Puppet, Inc." "Puppet manual"
 \fBThis page is autogenerated; any changes will get overwritten\fR
 .
 .SH "Configuration settings"
@@ -237,16 +237,16 @@ The certificate directory\.
 Whether certificate revocation checking should be enabled, and what level of checking should be performed\.
 .
 .P
-When certificate revocation is enabled Puppet expects the contents of its CRL to be one or more PEM encoded CRLs concatenated together\. When using a cert bundle CRLs for all CAs in the chain of trust must be included in the crl file with the first CRL listed being for the root of the chain, the last being for the leaf CA\.
+When certificate revocation is enabled, Puppet expects the contents of its CRL to be one or more PEM\-encoded CRLs concatenated together\. When using a cert bundle, CRLs for all CAs in the chain of trust must be included in the crl file\. The chain should be ordered from least to most authoritative, with the first CRL listed being for the root of the chain and the last being for the leaf CA\.
 .
 .P
-When certificate_revocation is set to \'true\' or \'chain\', Puppet will ensure that each CA in the chain of trust has not been revoked by its issuing CA\.
+When certificate_revocation is set to \'true\' or \'chain\', Puppet ensures that each CA in the chain of trust has not been revoked by its issuing CA\.
 .
 .P
-When certificate_revocation is set to \'leaf\', Puppet will verify certs against the issuing CA\'s revocation list but not verify the revocation status of the issuing CA or any CA above it within the chain of trust\.
+When certificate_revocation is set to \'leaf\', Puppet verifies certs against the issuing CA\'s revocation list, but it does not verify the revocation status of the issuing CA or any CA above it within the chain of trust\.
 .
 .P
-When certificate_revocation is set to \'false\', Puppet will disable all certificate revocation checking and will not attempt to download the CRL\.
+When certificate_revocation is set to \'false\', Puppet disables all certificate revocation checking and does not attempt to download the CRL\.
 .
 .IP "\(bu" 4
 \fIDefault\fR: chain
@@ -692,6 +692,14 @@ Freezes the \'main\' class, disallowing any code to be added to it\. This essent
 .
 .IP "" 0
 .
+.SS "func3x_check"
+Causes validation of loaded legacy Ruby functions (3x API) to raise errors about illegal constructs that could cause harm or that simply does not work\. This flag is on by default\. This flag is made available so that the validation can be turned off in case the method of validation is faulty \- if encountered, please file a bug report\.
+.
+.IP "\(bu" 4
+\fIDefault\fR: true
+.
+.IP "" 0
+.
 .SS "future_features"
 Whether or not to enable all features currently being developed for future major releases of Puppet\. Should be used with caution, as in development features are experimental and can have unexpected effects\.
 .
@@ -868,7 +876,7 @@ The time to wait for data to be read from an HTTP connection\. If nothing is rea
 The HTTP User\-Agent string to send when making network requests\.
 .
 .IP "\(bu" 4
-\fIDefault\fR: Puppet/6\.0\.5 Ruby/2\.4\.1\-p111 (x86_64\-linux)
+\fIDefault\fR: Puppet/6\.0\.7 Ruby/2\.4\.1\-p111 (x86_64\-linux)
 .
 .IP "" 0
 .

data/man/man8/puppet-agent.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-AGENT" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-AGENT" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-agent\fR \- The puppet agent daemon

data/man/man8/puppet-apply.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-APPLY" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-APPLY" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-apply\fR \- Apply Puppet manifests locally

data/man/man8/puppet-catalog.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CATALOG" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-CATALOG" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-catalog\fR \- Compile, save, view, and convert catalogs\.

data/man/man8/puppet-config.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CONFIG" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-CONFIG" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-config\fR \- Interact with Puppet\'s settings\.

data/man/man8/puppet-describe.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DESCRIBE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DESCRIBE" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-describe\fR \- Display help about resource types

data/man/man8/puppet-device.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DEVICE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DEVICE" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-device\fR \- Manage remote network devices

data/man/man8/puppet-doc.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DOC" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DOC" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-doc\fR \- Generate Puppet references

data/man/man8/puppet-epp.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-EPP" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-EPP" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-epp\fR \- Interact directly with the EPP template parser/renderer\.

data/man/man8/puppet-facts.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-FACTS" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-FACTS" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-facts\fR \- Retrieve and store facts\.

data/man/man8/puppet-filebucket.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-FILEBUCKET" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-FILEBUCKET" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-filebucket\fR \- Store and retrieve files in a filebucket
@@ -67,8 +67,12 @@ Use the local filebucket\. This uses the default configuration information and t
 Use a remote filebucket\. This uses the default configuration information and the bucket located at the \'$bucketdir\' setting by default\.
 .
 .TP
+\-\-server_list
+A list of comma seperated servers; only the first entry is used for file storage\. This setting takes precidence over \fBserver\fR\.
+.
+.TP
 \-\-server
-The server to send the file to, instead of locally\.
+The server to use for file storage\. This setting is only used if \fBserver_list\fR is not set\.
 .
 .TP
 \-\-todate

data/man/man8/puppet-generate.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-GENERATE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-GENERATE" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-generate\fR \- Generates Puppet code from Ruby definitions\.

data/man/man8/puppet-help.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-HELP" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-HELP" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-help\fR \- Display Puppet help\.

data/man/man8/puppet-key.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-KEY" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-KEY" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-key\fR \- Create, save, and remove certificate keys\.

data/man/man8/puppet-lookup.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-LOOKUP" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-LOOKUP" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-lookup\fR \- Interactive Hiera lookup

data/man/man8/puppet-man.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-MAN" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-MAN" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-man\fR \- Display Puppet manual pages\.

data/man/man8/puppet-module.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-MODULE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-MODULE" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-module\fR \- Creates, installs and searches for modules on the Puppet Forge\.

data/man/man8/puppet-node.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-NODE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-NODE" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-node\fR \- View and manage node definitions\.

data/man/man8/puppet-parser.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-PARSER" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-PARSER" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-parser\fR \- Interact directly with the parser\.

data/man/man8/puppet-plugin.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-PLUGIN" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-PLUGIN" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-plugin\fR \- Interact with the Puppet plugin system\.

data/man/man8/puppet-report.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-REPORT" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-REPORT" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-report\fR \- Create, display, and submit reports\.

data/man/man8/puppet-resource.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-RESOURCE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-RESOURCE" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-resource\fR \- The resource abstraction layer shell

data/man/man8/puppet-script.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-SCRIPT" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-SCRIPT" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-script\fR \- Run a puppet manifests as a script without compiling a catalog

data/man/man8/puppet-ssl.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-SSL" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-SSL" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-ssl\fR \- Manage SSL keys and certificates for puppet SSL clients

data/man/man8/puppet-status.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-STATUS" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-STATUS" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-status\fR \- View puppet server status\.

data/man/man8/puppet.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET" "8" "January 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET" "8" "March 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\fR
@@ -25,4 +25,4 @@ Specialized:
 catalog Compile, save, view, and convert catalogs\. describe Display help about resource types device Manage remote network devices doc Generate Puppet references epp Interact directly with the EPP template parser/renderer\. facts Retrieve and store facts\. filebucket Store and retrieve files in a filebucket generate Generates Puppet code from Ruby definitions\. node View and manage node definitions\. parser Interact directly with the parser\. script Run a puppet manifests as a script without compiling a catalog ssl Manage SSL keys and certificates for puppet SSL clients
 .
 .P
-See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v6\.0\.5
+See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v6\.0\.7

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/bad_func_load2.rb

@@ -0,0 +1,11 @@
+module Puppet::Parser::Functions
+  x = newfunction(:bad_func_load2, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    "some return value"
+  end
+end
+def illegal_method_here
+end
+x

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/bad_func_load3.rb

@@ -0,0 +1,11 @@
+module Puppet::Parser::Functions
+  newfunction(:bad_func_load3, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    def bad_func_load3_illegal_method
+      "some return value from illegal method"
+    end
+    "some return value"
+  end
+end

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/bad_func_load4.rb

@@ -0,0 +1,11 @@
+module Puppet::Parser::Functions
+  newfunction(:bad_func_load4, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    def self.bad_func_load4_illegal_method
+      "some return value from illegal method"
+    end
+    "some return value"
+  end
+end

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/bad_func_load5.rb

@@ -0,0 +1,12 @@
+x = module Puppet::Parser::Functions
+  newfunction(:bad_func_load5, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    "some return value"
+  end
+end
+def self.bad_func_load5_illegal_method
+end
+# Attempt to get around problem of not returning what newfunction returns
+x

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/good_func_load.rb

@@ -0,0 +1,9 @@
+module Puppet::Parser::Functions
+  newfunction(:good_func_load, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    # This is not illegal
+    Float("3.14")
+  end
+end

data/spec/integration/provider/file/windows_spec.rb

@@ -0,0 +1,162 @@
+require 'spec_helper'
+require 'puppet_spec/compiler'
+require 'puppet_spec/files'
+
+# For some reason the provider test will not filter out on windows when using the
+# :if => Puppet.features.microsoft_windows? method of filtering the tests.
+if Puppet.features.microsoft_windows?
+  require 'puppet/util/windows'
+  describe Puppet::Type.type(:file).provider(:windows), '(integration)' do
+    include PuppetSpec::Compiler
+    include PuppetSpec::Files
+
+    def create_temp_file(owner_sid, group_sid, initial_mode)
+      tmp_file = tmpfile('filewindowsprovider')
+      File.delete(tmp_file) if File.exist?(tmp_file)
+      File.open(tmp_file, 'w') { |file| file.write("rspec test") }
+
+      # There are other tests to ensure that these methods do indeed
+      # set the owner and group.  Therefore it's ok to depend on them
+      # here
+      Puppet::Util::Windows::Security.set_owner(owner_sid, tmp_file) unless owner_sid.nil?
+      Puppet::Util::Windows::Security.set_group(group_sid, tmp_file) unless group_sid.nil?
+      # Pretend we are managing the owner and group to FORCE this mode, even if it's "bad"
+      Puppet::Util::Windows::Security.set_mode(initial_mode.to_i(8), tmp_file, true, true, true) unless initial_mode.nil?
+
+      tmp_file
+    end
+
+    def strip_sticky(value)
+      # For the purposes of these tests we don't care about the extra-ace bit in modes
+      # This function removes it
+      value & ~Puppet::Util::Windows::Security::S_IEXTRA
+    end
+
+    sids = {
+      :system => Puppet::Util::Windows::SID::LocalSystem,
+      :administrators => Puppet::Util::Windows::SID::BuiltinAdministrators,
+      :users => Puppet::Util::Windows::SID::BuiltinUsers,
+      :power_users => Puppet::Util::Windows::SID::PowerUsers,
+      :none => Puppet::Util::Windows::SID::Nobody,
+      :everyone => Puppet::Util::Windows::SID::Everyone
+    }
+
+    # Testcase Hash options
+    # create_* : These options are used when creating the initial test file
+    # create_owner (Required!)
+    # create_group (Required!)
+    # create_mode
+    #
+    # manifest_* : These options are used to craft the manifest which is applied to the test file after createion
+    # manifest_owner,
+    # manifest_group,
+    # manifest_mode (Required!)
+    #
+    # actual_* : These options are used to check the _actual_ values as opposed to the munged values from puppet
+    # actual_mode (Uses manifest_mode for checks if not set)
+
+    RSpec.shared_examples "a mungable file resource" do |testcase|
+
+      before(:each) do
+        @tmp_file = create_temp_file(sids[testcase[:create_owner]], sids[testcase[:create_group]], testcase[:create_mode])
+        raise "Could not create temporary file" if @tmp_file.nil?
+      end
+
+      after(:each) do
+        File.delete(@tmp_file) if File.exist?(@tmp_file)
+      end
+
+      context_name = "With initial owner '#{testcase[:create_owner]}' and initial group '#{testcase[:create_owner]}'"
+      context_name += " and initial mode of '#{testcase[:create_mode]}'" unless testcase[:create_mode].nil?
+      context_name += " and a mode of '#{testcase[:manifest_mode]}' in the manifest"
+      context_name += " and an owner of '#{testcase[:manifest_owner]}' in the manifest" unless testcase[:manifest_owner].nil?
+      context_name += " and a group of '#{testcase[:manifest_group]}' in the manifest" unless testcase[:manifest_group].nil?
+
+      context context_name do
+        is_idempotent = testcase[:is_idempotent].nil? || testcase[:is_idempotent]
+
+        let(:manifest) do
+          value = <<-MANIFEST
+            file { 'rspec_example':
+              ensure => present,
+              path   => '#{@tmp_file}',
+              mode   => '#{testcase[:manifest_mode]}',
+          MANIFEST
+          value += "  owner  => '#{testcase[:manifest_owner]}',\n" unless testcase[:manifest_owner].nil?
+          value += "  group  => '#{testcase[:manifest_group]}',\n" unless testcase[:manifest_group].nil?
+          value + "}"
+        end
+
+        it "should apply with no errors and have expected ACL" do
+          apply_with_error_check(manifest)
+          new_mode = strip_sticky(Puppet::Util::Windows::Security.get_mode(@tmp_file))
+          expect(new_mode.to_s(8)).to eq (testcase[:actual_mode].nil? ? testcase[:manifest_mode] : testcase[:actual_mode])
+        end
+
+        it "should be idempotent", :if => is_idempotent do
+          result = apply_with_error_check(manifest)
+          result = apply_with_error_check(manifest)
+          # Idempotent. Should be no changed resources
+          expect(result.changed?.count).to eq 0
+        end
+
+        it "should NOT be idempotent", :unless => is_idempotent do
+          result = apply_with_error_check(manifest)
+          result = apply_with_error_check(manifest)
+          result = apply_with_error_check(manifest)
+          result = apply_with_error_check(manifest)
+          # Not idempotent. Expect changed resources
+          expect(result.changed?.count).to be > 0
+        end
+      end
+    end
+
+    # These scenarios round-trip permissions and are idempotent
+    [
+      { :create_owner => :system,         :create_group => :administrators, :manifest_mode => '760' },
+      { :create_owner => :administrators, :create_group => :administrators, :manifest_mode => '660' },
+      { :create_owner => :system,         :create_group => :system,         :manifest_mode => '770' },
+    ].each do |testcase|
+      # What happens if the owner and group are not managed
+      it_behaves_like "a mungable file resource", testcase
+      # What happens if the owner is managed
+      it_behaves_like "a mungable file resource", testcase.merge({ :manifest_owner => testcase[:create_owner]})
+      # What happens if the group is managed
+      it_behaves_like "a mungable file resource", testcase.merge({ :manifest_group => testcase[:create_group]})
+      # What happens if both the owner and group are managed
+      it_behaves_like "a mungable file resource", testcase.merge({
+        :manifest_owner => testcase[:create_owner],
+        :manifest_group => testcase[:create_group]
+      })
+    end
+
+    # SYSTEM is special in that when specifying less than mode 7, the owner and/or group MUST be managed
+    # otherwise it's munged to 7 behind the scenes and is not idempotent
+    both_system_testcase = { :create_owner => :system, :create_group => :system, :manifest_mode => '660', :actual_mode => '770', :is_idempotent => false }
+    # What happens if the owner and group are not managed
+    it_behaves_like "a mungable file resource", both_system_testcase.merge({ :is_idempotent => true })
+    # What happens if the owner is managed
+    it_behaves_like "a mungable file resource", both_system_testcase.merge({ :manifest_owner => both_system_testcase[:create_owner]})
+    # What happens if the group is managed
+    it_behaves_like "a mungable file resource", both_system_testcase.merge({ :manifest_group => both_system_testcase[:create_group]})
+
+    # However when we manage SYSTEM explicitly, then the modes lower than 7 stick and the file provider
+    # assumes it's insync (i.e. idempotent)
+    it_behaves_like "a mungable file resource", both_system_testcase.merge({
+      :manifest_owner => both_system_testcase[:create_owner],
+      :manifest_group => both_system_testcase[:create_group],
+      :actual_mode    => both_system_testcase[:manifest_mode],
+      :is_idempotent  => true
+    })
+
+    # What happens if we _create_ a file that SYSTEM is a part of, and is Full Control, but the manifest says it should not be Full Control
+    # Behind the scenes the mode should be changed to 7 and be idempotent
+    [
+      { :create_owner => :system,         :create_group => :system,         :manifest_mode => '660' },
+      { :create_owner => :administrators, :create_group => :system,         :manifest_mode => '760' },
+      { :create_owner => :system,         :create_group => :administrators, :manifest_mode => '670' },
+    ].each do |testcase|
+      it_behaves_like "a mungable file resource", testcase.merge({ :create_mode => '770', :actual_mode => '770'})
+    end
+  end
+end