puppet 6.1.0 → 6.2.0

data/man/man5/puppet.conf.5

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPETCONF" "5" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPETCONF" "5" "January 2019" "Puppet, Inc." "Puppet manual"
 \fBThis page is autogenerated; any changes will get overwritten\fR
 .
 .SH "Configuration settings"
@@ -237,16 +237,16 @@ The certificate directory\.
 Whether certificate revocation checking should be enabled, and what level of checking should be performed\.
 .
 .P
-When certificate revocation is enabled Puppet expects the contents of its CRL to be one or more PEM encoded CRLs concatenated together\. When using a cert bundle CRLs for all CAs in the chain of trust must be included in the crl file with the first CRL listed being for the root of the chain, the last being for the leaf CA\.
+When certificate revocation is enabled, Puppet expects the contents of its CRL to be one or more PEM\-encoded CRLs concatenated together\. When using a cert bundle, CRLs for all CAs in the chain of trust must be included in the crl file\. The chain should be ordered from least to most authoritative, with the first CRL listed being for the root of the chain and the last being for the leaf CA\.
 .
 .P
-When certificate_revocation is set to \'true\' or \'chain\', Puppet will ensure that each CA in the chain of trust has not been revoked by its issuing CA\.
+When certificate_revocation is set to \'true\' or \'chain\', Puppet ensures that each CA in the chain of trust has not been revoked by its issuing CA\.
 .
 .P
-When certificate_revocation is set to \'leaf\', Puppet will verify certs against the issuing CA\'s revocation list but not verify the revocation status of the issuing CA or any CA above it within the chain of trust\.
+When certificate_revocation is set to \'leaf\', Puppet verifies certs against the issuing CA\'s revocation list, but it does not verify the revocation status of the issuing CA or any CA above it within the chain of trust\.
 .
 .P
-When certificate_revocation is set to \'false\', Puppet will disable all certificate revocation checking and will not attempt to download the CRL\.
+When certificate_revocation is set to \'false\', Puppet disables all certificate revocation checking and does not attempt to download the CRL\.
 .
 .IP "\(bu" 4
 \fIDefault\fR: chain
@@ -692,6 +692,14 @@ Freezes the \'main\' class, disallowing any code to be added to it\. This essent
 .
 .IP "" 0
 .
+.SS "func3x_check"
+Causes validation of loaded legacy Ruby functions (3x API) to raise errors about illegal constructs that could cause harm or that simply does not work\. This flag is on by default\. This flag is made available so that the validation can be turned off in case the method of validation is faulty \- if encountered, please file a bug report\.
+.
+.IP "\(bu" 4
+\fIDefault\fR: true
+.
+.IP "" 0
+.
 .SS "future_features"
 Whether or not to enable all features currently being developed for future major releases of Puppet\. Should be used with caution, as in development features are experimental and can have unexpected effects\.
 .
@@ -868,7 +876,7 @@ The time to wait for data to be read from an HTTP connection\. If nothing is rea
 The HTTP User\-Agent string to send when making network requests\.
 .
 .IP "\(bu" 4
-\fIDefault\fR: Puppet/6\.1\.0 Ruby/2\.4\.1\-p111 (x86_64\-linux)
+\fIDefault\fR: Puppet/6\.2\.0 Ruby/2\.4\.1\-p111 (x86_64\-linux)
 .
 .IP "" 0
 .

data/man/man8/puppet-agent.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-AGENT" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-AGENT" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-agent\fR \- The puppet agent daemon
@@ -120,6 +120,9 @@ Where to send log messages\. Choose between \'syslog\' (the POSIX syslog service
 .IP
 A path ending with \'\.json\' will receive structured output in JSON format\. The log file will not have an ending \']\' automatically written to it due to the appending nature of logging\. It must be appended manually to make the content valid JSON\.
 .
+.IP
+A path ending with \'\.jsonl\' will receive structured output in JSON Lines format\.
+.
 .TP
 \-\-masterport
 The port on which to contact the puppet master\. (This is a Puppet setting, and can go in puppet\.conf\.)

data/man/man8/puppet-apply.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-APPLY" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-APPLY" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-apply\fR \- Apply Puppet manifests locally
@@ -60,6 +60,9 @@ See the configuration file documentation at https://puppet\.com/docs/puppet/late
 .IP
 A path ending with \'\.json\' will receive structured output in JSON format\. The log file will not have an ending \']\' automatically written to it due to the appending nature of logging\. It must be appended manually to make the content valid JSON\.
 .
+.IP
+A path ending with \'\.jsonl\' will receive structured output in JSON Lines format\.
+.
 .IP "\(bu" 4
 \-\-noop: Use \'noop\' mode where Puppet runs in a no\-op or dry\-run mode\. This is useful for seeing what changes Puppet will make without actually executing the changes\.
 .

data/man/man8/puppet-catalog.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CATALOG" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-CATALOG" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-catalog\fR \- Compile, save, view, and convert catalogs\.

data/man/man8/puppet-config.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CONFIG" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-CONFIG" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-config\fR \- Interact with Puppet\'s settings\.

data/man/man8/puppet-describe.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DESCRIBE" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DESCRIBE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-describe\fR \- Display help about resource types

data/man/man8/puppet-device.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DEVICE" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DEVICE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-device\fR \- Manage remote network devices
@@ -77,6 +77,9 @@ This option only matters for targets that do not yet have certificates and it is
 \-\-libdir
 Override the per\-device libdir with a local directory\. Specifying a libdir also disables pluginsync\. This is useful for testing\.
 .
+.IP
+A path ending with \'\.jsonl\' will receive structured output in JSON Lines format\.
+.
 .TP
 \-\-apply
 Apply a manifest against a remote target\. Target must be specified\.

data/man/man8/puppet-doc.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DOC" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DOC" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-doc\fR \- Generate Puppet references

data/man/man8/puppet-epp.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-EPP" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-EPP" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-epp\fR \- Interact directly with the EPP template parser/renderer\.

data/man/man8/puppet-facts.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-FACTS" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-FACTS" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-facts\fR \- Retrieve and store facts\.

data/man/man8/puppet-filebucket.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-FILEBUCKET" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-FILEBUCKET" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-filebucket\fR \- Store and retrieve files in a filebucket

data/man/man8/puppet-generate.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-GENERATE" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-GENERATE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-generate\fR \- Generates Puppet code from Ruby definitions\.

data/man/man8/puppet-help.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-HELP" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-HELP" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-help\fR \- Display Puppet help\.

data/man/man8/puppet-key.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-KEY" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-KEY" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-key\fR \- Create, save, and remove certificate keys\.

data/man/man8/puppet-lookup.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-LOOKUP" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-LOOKUP" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-lookup\fR \- Interactive Hiera lookup

data/man/man8/puppet-man.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-MAN" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-MAN" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-man\fR \- Display Puppet manual pages\.

data/man/man8/puppet-module.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-MODULE" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-MODULE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-module\fR \- Creates, installs and searches for modules on the Puppet Forge\.

data/man/man8/puppet-node.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-NODE" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-NODE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-node\fR \- View and manage node definitions\.

data/man/man8/puppet-parser.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-PARSER" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-PARSER" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-parser\fR \- Interact directly with the parser\.

data/man/man8/puppet-plugin.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-PLUGIN" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-PLUGIN" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-plugin\fR \- Interact with the Puppet plugin system\.

data/man/man8/puppet-report.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-REPORT" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-REPORT" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-report\fR \- Create, display, and submit reports\.

data/man/man8/puppet-resource.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-RESOURCE" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-RESOURCE" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-resource\fR \- The resource abstraction layer shell

data/man/man8/puppet-script.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-SCRIPT" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-SCRIPT" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-script\fR \- Run a puppet manifests as a script without compiling a catalog
@@ -39,6 +39,9 @@ Where to send log messages\. Choose between \'syslog\' (the POSIX syslog service
 .IP
 A path ending with \'\.json\' will receive structured output in JSON format\. The log file will not have an ending \']\' automatically written to it due to the appending nature of logging\. It must be appended manually to make the content valid JSON\.
 .
+.IP
+A path ending with \'\.jsonl\' will receive structured output in JSON Lines format\.
+.
 .TP
 \-\-noop
 Use \'noop\' mode where Puppet runs in a no\-op or dry\-run mode\. This is useful for seeing what changes Puppet will make without actually executing the changes\. Applies to tasks only\.

data/man/man8/puppet-ssl.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-SSL" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-SSL" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-ssl\fR \- Manage SSL keys and certificates for puppet SSL clients

data/man/man8/puppet-status.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-STATUS" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-STATUS" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-status\fR \- View puppet server status\.

data/man/man8/puppet.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET" "8" "December 2018" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET" "8" "January 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\fR
@@ -25,4 +25,4 @@ Specialized:
 catalog Compile, save, view, and convert catalogs\. describe Display help about resource types device Manage remote network devices doc Generate Puppet references epp Interact directly with the EPP template parser/renderer\. facts Retrieve and store facts\. filebucket Store and retrieve files in a filebucket generate Generates Puppet code from Ruby definitions\. node View and manage node definitions\. parser Interact directly with the parser\. script Run a puppet manifests as a script without compiling a catalog ssl Manage SSL keys and certificates for puppet SSL clients
 .
 .P
-See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v6\.1\.0
+See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v6\.2\.0

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/bad_func_load2.rb

@@ -0,0 +1,11 @@
+module Puppet::Parser::Functions
+  x = newfunction(:bad_func_load2, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    "some return value"
+  end
+end
+def illegal_method_here
+end
+x

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/bad_func_load3.rb

@@ -0,0 +1,11 @@
+module Puppet::Parser::Functions
+  newfunction(:bad_func_load3, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    def bad_func_load3_illegal_method
+      "some return value from illegal method"
+    end
+    "some return value"
+  end
+end

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/bad_func_load4.rb

@@ -0,0 +1,11 @@
+module Puppet::Parser::Functions
+  newfunction(:bad_func_load4, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    def self.bad_func_load4_illegal_method
+      "some return value from illegal method"
+    end
+    "some return value"
+  end
+end

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/bad_func_load5.rb

@@ -0,0 +1,12 @@
+x = module Puppet::Parser::Functions
+  newfunction(:bad_func_load5, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    "some return value"
+  end
+end
+def self.bad_func_load5_illegal_method
+end
+# Attempt to get around problem of not returning what newfunction returns
+x

data/spec/fixtures/unit/pops/loaders/loaders/mix_4x_and_3x_functions/usee/lib/puppet/parser/functions/good_func_load.rb

@@ -0,0 +1,9 @@
+module Puppet::Parser::Functions
+  newfunction(:good_func_load, :type => :rvalue, :doc => <<-EOS
+    A function using the 3x API
+  EOS
+  ) do |arguments|
+    # This is not illegal
+    Float("3.14")
+  end
+end

data/spec/unit/forge/forge_spec.rb

@@ -59,10 +59,11 @@ describe Puppet::Forge do
       it "includes any defined module_groups, ensuring to only encode them once in the URI" do
         Puppet[:module_groups] = 'base+pe'
         module_name = 'puppetlabs-acl'
+        exclusions = "readme%2Cchangelog%2Clicense%2Curi%2Cmodule%2Ctags%2Csupported%2Cfile_size%2Cdownloads%2Ccreated_at%2Cupdated_at%2Cdeleted_at"
 
         # ignores Puppet::Forge::Repository#read_response, provides response to fetch
         performs_an_http_request(ok_response) do |http|
-          encoded_uri = "/v3/releases?module=#{module_name}&sort_by=version&module_groups=base%20pe"
+          encoded_uri = "/v3/releases?module=#{module_name}&sort_by=version&exclude_fields=#{exclusions}&module_groups=base%20pe"
           http.expects(:request).with(responds_with(:path, encoded_uri))
         end
 
@@ -71,10 +72,11 @@ describe Puppet::Forge do
 
       it "single encodes the module name term in the URI" do
         module_name = "puppetlabs-#{mixed_utf8_query_param}"
+        exclusions = "readme%2Cchangelog%2Clicense%2Curi%2Cmodule%2Ctags%2Csupported%2Cfile_size%2Cdownloads%2Ccreated_at%2Cupdated_at%2Cdeleted_at"
 
         # ignores Puppet::Forge::Repository#read_response, provides response to fetch
         performs_an_http_request(ok_response) do |http|
-          encoded_uri = "/v3/releases?module=puppetlabs-#{mixed_utf8_query_param_encoded}&sort_by=version"
+          encoded_uri = "/v3/releases?module=puppetlabs-#{mixed_utf8_query_param_encoded}&sort_by=version&exclude_fields=#{exclusions}"
           http.expects(:request).with(responds_with(:path, encoded_uri))
         end
 

data/spec/unit/pops/loaders/loaders_spec.rb

@@ -423,7 +423,7 @@ describe 'loaders' do
 
   end
 
-  context 'when causing a 3x load followed by a 4x load' do
+  context 'when a 3x load takes place' do
     let(:env) { environment_for(mix_4x_and_3x_functions) }
     let(:compiler) { Puppet::Parser::Compiler.new(Puppet::Node.new("test", :environment => env)) }
     let(:scope) { compiler.topscope }
@@ -436,11 +436,73 @@ describe 'loaders' do
       Puppet.pop_context
     end
 
-    it "a 3x function with code outside body is reported as an error" do
-      expect { loader.load_typed(typed_name(:function, 'bad_func_load')) }.to raise_error(/Illegal legacy function definition/)
+    it "a function with no illegal constructs can be loaded" do
+      function = loader.load_typed(typed_name(:function, 'good_func_load')).value
+      expect(function.call(scope)).to eql(Float("3.14"))
     end
   end
 
+  context 'when a 3x load has illegal method added' do
+    let(:env) { environment_for(mix_4x_and_3x_functions) }
+    let(:compiler) { Puppet::Parser::Compiler.new(Puppet::Node.new("test", :environment => env)) }
+    let(:scope) { compiler.topscope }
+    let(:loader) { compiler.loaders.private_loader_for_module('user') }
+
+    before(:each) do
+      Puppet.push_context(:current_environment => scope.environment, :global_scope => scope, :loaders => compiler.loaders)
+    end
+    after(:each) do
+      Puppet.pop_context
+    end
+
+    it "outside function body is reported as an error" do
+      expect { loader.load_typed(typed_name(:function, 'bad_func_load')) }.to raise_error(/Illegal method definition/)
+    end
+
+    it "to self outside function body is reported as an error" do
+      expect { loader.load_typed(typed_name(:function, 'bad_func_load5')) }.to raise_error(/Illegal method definition.*'bad_func_load5_illegal_method'/)
+    end
+
+    it "outside body is reported as an error even if returning the right func_info" do
+      expect { loader.load_typed(typed_name(:function, 'bad_func_load2'))}.to raise_error(/Illegal method definition/)
+    end
+
+    it "inside function body is reported as an error" do
+      expect {
+        f = loader.load_typed(typed_name(:function, 'bad_func_load3')).value
+        f.call(scope)
+      }.to raise_error(/Illegal method definition.*'bad_func_load3_illegal_method'/)
+    end
+
+    it "to self inside function body is reported as an error" do
+      expect { 
+        f = loader.load_typed(typed_name(:function, 'bad_func_load4')).value
+        f.call(scope)
+      }.to raise_error(/Illegal method definition.*'bad_func_load4_illegal_method'/)
+    end
+  end
+
+context 'when a 3x load has illegal construct and --func3x_check is false' do
+  let(:env) { environment_for(mix_4x_and_3x_functions) }
+  let(:compiler) { Puppet::Parser::Compiler.new(Puppet::Node.new("test", :environment => env)) }
+  let(:scope) { compiler.topscope }
+  let(:loader) { compiler.loaders.private_loader_for_module('user') }
+
+  before(:each) do
+    Puppet.push_context(:current_environment => scope.environment, :global_scope => scope, :loaders => compiler.loaders)
+    Puppet[:func3x_check] = false
+  end
+  after(:each) do
+    Puppet.pop_context
+    Puppet[:func3x_check] = true
+  end
+
+  it "an illegal function is loaded" do
+      f = loader.load_typed(typed_name(:function, 'bad_func_load3')).value
+      expect(f.call(scope)).to eql("some return value")
+  end
+end
+
   context 'when causing a 3x load followed by a 4x load' do
     let(:env) { environment_for(mix_4x_and_3x_functions) }
     let(:compiler) { Puppet::Parser::Compiler.new(Puppet::Node.new("test", :environment => env)) }