puppet 6.11.1 → 6.16.0

data/spec/unit/provider/package/zypper_spec.rb

@@ -176,6 +176,19 @@ describe Puppet::Type.type(:package).provider(:zypper) do
       @provider.install
     end
 
+    it "should install the package with --no-gpg-checks" do
+      allow(@resource).to receive(:[]).with(:name).and_return("php5")
+      allow(@resource).to receive(:[]).with(:install_options).and_return(['--no-gpg-checks', {'-p' => '/vagrant/files/localrepo/'}])
+      allow(@resource).to receive(:should).with(:ensure).and_return("5.4.10-4.5.6")
+      allow(@resource).to receive(:allow_virtual?).and_return(false)
+      allow(@provider).to receive(:zypper_version).and_return("1.2.8")
+
+      expect(@provider).to receive(:zypper).with('--quiet', '--no-gpg-checks', :install,
+        '--auto-agree-with-licenses', '--no-confirm', '-p=/vagrant/files/localrepo/', 'php5-5.4.10-4.5.6')
+      expect(@provider).to receive(:query).and_return("php5 0 5.4.10 4.5.6 x86_64")
+      @provider.install
+    end
+
     it "should install package with hash install options" do
       allow(@resource).to receive(:[]).with(:name).and_return('vim')
       allow(@resource).to receive(:[]).with(:install_options).and_return([{ '--a' => 'foo', '--b' => '"quoted bar"' }])
@@ -226,4 +239,75 @@ describe Puppet::Type.type(:package).provider(:zypper) do
       @provider.uninstall
     end
   end
+
+  context 'when installing with VersionRange' do
+    let(:search_output) { File.read(my_fixture('zypper-search-uninstalled.out')) }
+
+    before(:each) do
+      allow(@resource).to receive(:[]).with(:name).and_return('vim')
+      allow(@resource).to receive(:allow_virtual?).and_return(false)
+      allow(@provider).to receive(:zypper_version).and_return('1.0.2')
+
+      expect(@provider).to receive(:zypper).with('search', '--match-exact', '--type', 'package', '--uninstalled-only', '-s', 'vim')
+                                           .and_return(search_output)
+    end
+
+    it 'does install the package if version is available' do
+      expect(@resource).to receive(:should).with(:ensure).and_return('>1.0')
+
+      expect(@provider).to receive(:zypper).with('--quiet', :install, '--auto-agree-with-licenses', '--no-confirm', 'vim-1.0.20040813-19.9')
+      expect(@provider).to receive(:query).and_return('vim 0 1.0.20040813 19.9 x86_64')
+
+      @provider.install
+    end
+
+    it 'does consider range as version if version in range is not available' do
+      allow(@resource).to receive(:should).with(:ensure).and_return('>2.0')
+
+      expect(@provider).to receive(:zypper).with('--quiet', :install, '--auto-agree-with-licenses', '--no-confirm', 'vim->2.0')
+                             .and_raise(Puppet::ExecutionFailure.new('My Error'))
+
+      expect { @provider.install }.to raise_error(Puppet::ExecutionFailure, 'My Error')
+    end
+  end
+
+  describe 'insync?' do
+    subject { @provider.insync?('1.19-2') }
+
+    context 'when versions are matching' do
+      before { allow(@resource).to receive(:[]).with(:ensure).and_return('1.19-2') }
+
+      it { is_expected.to be true }
+    end
+
+    context 'when version are not matching' do
+      before { allow(@resource).to receive(:[]).with(:ensure).and_return('1.19-3') }
+
+      it { is_expected.to be false }
+    end
+
+    context 'when version is in gt range' do
+      before { allow(@resource).to receive(:[]).with(:ensure).and_return('>1.19-0') }
+
+      it { is_expected.to be true }
+    end
+
+    context 'when version is not in gt range' do
+      before { allow(@resource).to receive(:[]).with(:ensure).and_return('>1.19-2') }
+
+      it { is_expected.to be false }
+    end
+
+    context 'when version is in min-max range' do
+      before { allow(@resource).to receive(:[]).with(:ensure).and_return('>1.19-0 <1.19-3') }
+
+      it { is_expected.to be true }
+    end
+
+    context 'when version is not in min-max range' do
+      before { allow(@resource).to receive(:[]).with(:ensure).and_return('>1.19-0 <1.19-2') }
+
+      it { is_expected.to be false }
+    end
+  end
 end

data/spec/unit/provider/package_targetable_spec.rb

@@ -0,0 +1,60 @@
+require 'spec_helper'
+require 'puppet'
+require 'puppet/provider/package_targetable'
+require 'puppet/provider/package/gem'
+
+describe Puppet::Provider::Package::Targetable do
+  let(:provider) { Puppet::Type.type(:package).provider(:gem) }
+  let(:command)  { '/opt/bin/gem' }
+
+  describe "when prefetching" do
+    context "with a package without a command attribute" do
+      let(:resource) { Puppet::Type.type(:package).new(:name => 'noo', :provider => 'gem', :ensure => :present) }
+      let(:catalog)  { Puppet::Resource::Catalog.new }
+      let(:instance) { provider.new(resource) }
+      let(:packages) { { 'noo' => resource } }
+
+      it "should pass a command to the instances method of the provider" do
+        catalog.add_resource(resource)
+        expect(provider).to receive(:instances).with(nil).and_return([instance])
+        expect(provider.prefetch(packages)).to eq([nil]) # prefetch arbitrarily returns the array of commands for a provider in the catalog
+      end
+    end
+
+    context "with a package with a command attribute" do
+      let(:resource) { Puppet::Type.type(:package).new(:name => 'noo', :provider => 'gem', :ensure => :present) }
+      let(:resource_targeted) { Puppet::Type.type(:package).new(:name => 'yes', :provider => 'gem', :command => command, :ensure => :present) }
+      let(:catalog)  { Puppet::Resource::Catalog.new }
+      let(:instance) { provider.new(resource) }
+      let(:instance_targeted) { provider.new(resource_targeted) }
+      let(:packages) { { 'noo' => resource, 'yes' => resource_targeted } }
+
+      it "should pass the command to the instances method of the provider" do
+        catalog.add_resource(resource)
+        catalog.add_resource(resource_targeted)
+        expect(provider).to receive(:instances).with(nil).and_return([instance])
+        expect(provider).to receive(:instances).with(command).and_return([instance_targeted]).once
+        expect(provider.prefetch(packages)).to eq([nil, command]) # prefetch arbitrarily returns the array of commands for a provider in the catalog
+      end
+    end
+  end
+
+  describe "when validating a command" do
+    context "with no command" do
+      it "report not functional" do
+        expect { provider.validate_command(nil) }.to raise_error(Puppet::Error, "Provider gem package command is not functional on this host")
+      end
+    end
+    context "with a missing command" do
+      it "report does not exist" do
+        expect { provider.validate_command(command) }.to raise_error(Puppet::Error, "Provider gem package command '#{command}' does not exist on this host")
+      end
+    end
+    context "with an existing command" do
+      it "validates" do
+        allow(File).to receive(:file?).with(command).and_return(true)
+        expect { provider.validate_command(command) }.not_to raise_error
+      end
+    end
+  end
+end

data/spec/unit/provider/service/init_spec.rb

@@ -150,6 +150,7 @@ describe 'Puppet::Type::Service::Provider::Init', unless: Puppet::Util::Platform
 
   describe "if the init script is present" do
     before :each do
+      allow(File).to receive(:directory?).and_call_original
       allow(File).to receive(:directory?).with("/service/path").and_return(true)
       allow(File).to receive(:directory?).with("/alt/service/path").and_return(true)
       allow(Puppet::FileSystem).to receive(:exist?).with("/service/path/myservice").and_return(true)

data/spec/unit/provider/service/openbsd_spec.rb

@@ -12,6 +12,15 @@ describe 'Puppet::Type::Service::Provider::Openbsd',
     allow(FileTest).to receive(:executable?).with('/usr/sbin/rcctl').and_return(true)
   end
 
+  # `execute` and `texecute` start a new process, consequently setting $CHILD_STATUS to a Process::Status instance,
+  # but because they are mocked, an external process is never executed and $CHILD_STATUS remain nil.
+  # In order to execute some parts of the code under test and to mock $CHILD_STATUS, we need this variable to be a
+  # Process::Status instance. We can achieve this by starting a process that does nothing (exit 0). By doing this,
+  # $CHILD_STATUS will be initialised with a instance of Process::Status and we will be able to mock it.
+  before(:all) do
+    `exit 0`
+  end
+
   context "#instances" do
     it "should have an instances method" do
       expect(provider_class).to respond_to :instances

data/spec/unit/provider/service/openwrt_spec.rb

@@ -28,6 +28,7 @@ describe 'Puppet::Type::Service::Provider::Openwrt',
     allow(FileTest).to receive(:executable?).with('/etc/rc.common').and_return(true)
 
     # All OpenWrt tests operate on the init script directly. It must exist.
+    allow(File).to receive(:directory?).and_call_original
     allow(File).to receive(:directory?).with('/etc/init.d').and_return(true)
 
     allow(Puppet::FileSystem).to receive(:exist?).with('/etc/init.d/myservice').and_return(true)

data/spec/unit/provider/service/redhat_spec.rb

@@ -4,6 +4,15 @@ describe 'Puppet::Type::Service::Provider::Redhat',
          if: Puppet.features.posix? && !Puppet::Util::Platform.jruby?do
   let(:provider_class) { Puppet::Type.type(:service).provider(:redhat) }
 
+  # `execute` and `texecute` start a new process, consequently setting $CHILD_STATUS to a Process::Status instance,
+  # but because they are mocked, an external process is never executed and $CHILD_STATUS remain nil.
+  # In order to execute some parts of the code under test and to mock $CHILD_STATUS, we need this variable to be a
+  # Process::Status instance. We can achieve this by starting a process that does nothing (exit 0). By doing this,
+  # $CHILD_STATUS will be initialised with a instance of Process::Status and we will be able to mock it.
+  before(:all) do
+    `exit 0`
+  end
+
   before :each do
     @class = Puppet::Type.type(:service).provider(:redhat)
     @resource = double('resource')

data/spec/unit/provider/service/systemd_spec.rb

@@ -13,6 +13,15 @@ describe 'Puppet::Type::Service::Provider::Systemd', unless: Puppet::Util::Platf
     allow(provider_class).to receive(:which).with('systemctl').and_return('/bin/systemctl')
   end
 
+  # `execute` and `texecute` start a new process, consequently setting $CHILD_STATUS to a Process::Status instance,
+  # but because they are mocked, an external process is never executed and $CHILD_STATUS remain nil.
+  # In order to execute some parts of the code under test and to mock $CHILD_STATUS, we need this variable to be a
+  # Process::Status instance. We can achieve this by starting a process that does nothing (exit 0). By doing this,
+  # $CHILD_STATUS will be initialised with a instance of Process::Status and we will be able to mock it.
+  before(:all) do
+    `exit 0`
+  end
+
   let :provider do
     provider_class.new(:name => 'sshd.service')
   end
@@ -187,8 +196,18 @@ describe 'Puppet::Type::Service::Provider::Systemd', unless: Puppet::Util::Platf
         autovt@.service
         avahi-daemon.service
         blk-availability.service
+        apparmor.service
+        umountnfs.service
+        urandom.service
+        brandbot.service
       })
     end
+
+    it "should print a debug message when a service with the state `bad` is found" do
+      expect(provider_class).to receive(:systemctl).with('list-unit-files', '--type', 'service', '--full', '--all', '--no-pager').and_return(File.read(my_fixture('list_unit_files_services')))
+      expect(Puppet).to receive(:debug).with("apparmor.service marked as bad by `systemctl`. It is recommended to be further checked.")
+      provider_class.instances
+    end
   end
 
   describe "#start" do
@@ -269,43 +288,43 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
   describe "#enabled?" do
     it "should return :true if the service is enabled" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).and_return("enabled\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("enabled\n", 0))
       expect(provider.enabled?).to eq(:true)
     end
 
     it "should return :true if the service is static" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','--', 'sshd.service'], :failonfail => false).and_return("static\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("static\n", 0))
       expect(provider.enabled?).to eq(:true)
     end
 
     it "should return :false if the service is disabled" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).and_return("disabled\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("disabled\n", 1))
       expect(provider.enabled?).to eq(:false)
     end
 
     it "should return :false if the service is indirect" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).and_return("indirect\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("indirect\n", 0))
       expect(provider.enabled?).to eq(:false)
     end
 
     it "should return :false if the service is masked and the resource is attempting to be disabled" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :enable => false))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).and_return("masked\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("masked\n", 1))
       expect(provider.enabled?).to eq(:false)
     end
 
     it "should return :mask if the service is masked and the resource is attempting to be masked" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :enable => 'mask'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).and_return("masked\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("masked\n", 1))
       expect(provider.enabled?).to eq(:mask)
     end
   end
@@ -428,6 +447,67 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
     end
   end
 
+  describe "#insync_enabled?" do
+    let(:provider) do
+      provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :enable => false))
+    end
+
+    before do
+      allow(provider).to receive(:cached_enabled?).and_return({ output: service_state, exitcode: 0 })
+    end
+
+    context 'when service state is static' do
+      let(:service_state) { 'static' }
+
+      it 'is always enabled_insync even if current value is the same as expected' do
+        expect(provider).to be_enabled_insync(:false)
+      end
+
+      it 'is always enabled_insync even if current value is not the same as expected' do
+        expect(provider).to be_enabled_insync(:true)
+      end
+
+      it 'logs a debug messsage' do
+        expect(Puppet).to receive(:debug).with("Unable to enable or disable static service sshd.service")
+        provider.enabled_insync?(:true)
+      end
+    end
+
+    context 'when service state is indirect' do
+      let(:service_state) { 'indirect' }
+
+      it 'is always enabled_insync even if current value is the same as expected' do
+        expect(provider).to be_enabled_insync(:false)
+      end
+
+      it 'is always enabled_insync even if current value is not the same as expected' do
+        expect(provider).to be_enabled_insync(:true)
+      end
+
+      it 'logs a debug messsage' do
+        expect(Puppet).to receive(:debug).with("Service sshd.service is in 'indirect' state and cannot be enabled/disabled")
+        provider.enabled_insync?(:true)
+      end
+    end
+
+    context 'when service state is enabled' do
+      let(:service_state) { 'enabled' }
+
+      it 'is enabled_insync if current value is the same as expected' do
+        expect(provider).to be_enabled_insync(:false)
+      end
+
+      it 'is not enabled_insync if current value is not the same as expected' do
+        expect(provider).not_to be_enabled_insync(:true)
+      end
+
+      it 'logs no debug messsage' do
+        expect(Puppet).not_to receive(:debug)
+        provider.enabled_insync?(:true)
+      end
+    end
+  end
+
   describe "#get_start_link_count" do
     it "should strip the '.service' from the search if present in the resource name" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))

data/spec/unit/provider/user/directoryservice_spec.rb

@@ -196,6 +196,17 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     }
   end
 
+  let (:dsimport_preamble) do
+    '0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData'
+  end
+
+  let (:dsimport_contents) do
+    <<-DSIMPORT
+#{dsimport_preamble}
+#{username}:#{Base64.strict_encode64(sha512_embedded_bplist)}
+    DSIMPORT
+  end
+
   # The below represents output of 'dscl -plist . readall /Users' converted to
   # a native Ruby hash if only one user were installed on the system.
   # This lets us check the behavior of all the methods necessary to return a
@@ -960,6 +971,24 @@ end
     end
   end
 
+  describe '#set_shadow_hash_data' do
+    let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
+
+    it 'should flush the plist data to disk on OS X < 10.15' do
+      allow(provider.class).to receive(:get_os_version).and_return('10.12')
+
+      expect(provider).to receive(:write_users_plist_to_disk)
+      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
+    end
+
+    it 'should flush the plist data a temporary file on OS X >= 10.15' do
+      allow(provider.class).to receive(:get_os_version).and_return('10.15')
+
+      expect(provider).to receive(:write_and_import_shadow_hash_data)
+      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
+    end
+  end
+
   describe '#set_salted_pbkdf2' do
     let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
     let(:entropy_shadow_hash_data) do
@@ -1011,6 +1040,18 @@ end
     end
   end
 
+  describe '#write_and_import_shadow_hash_data' do
+    it 'should save the passed plist to a temporary file and import it' do
+      tmpfile = double('tempfile', :path => "/tmp/dsimport_#{username}", :flush => nil)
+      allow(Tempfile).to receive(:create).and_yield(tmpfile)
+      allow(provider).to receive(:dscl).with('.', 'delete', user_path, 'ShadowHashData')
+
+      expect(tmpfile).to receive(:write).with(dsimport_contents)
+      expect(provider).to receive(:dsimport).with(tmpfile.path, '/Local/Default', 'M')
+      provider.write_and_import_shadow_hash_data(sha512_embedded_bplist)
+    end
+  end
+
   describe '#merge_attribute_with_dscl' do
     it 'should raise an error if a dscl command raises an error' do
       expect(provider).to receive(:dscl).with('.', '-merge', user_path, 'GeneratedUID', 'GUID').and_raise(Puppet::ExecutionFailure, 'boom')

data/spec/unit/provider/user/hpux_spec.rb

@@ -58,14 +58,14 @@ describe Puppet::Type.type(:user).provider(:hpuxuseradd),
     it "should add modprpw to modifycmd if Trusted System" do
       allow(resource).to receive(:allowdupe?).and_return(true)
       expect(provider).to receive(:exec_getprpw).with('root','-m uid').and_return('uid=0')
-      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-u', 1000, '-o', 'testuser', '-F', ';', '/usr/lbin/modprpw', '-v', '-l', 'testuser'], hash_including(custom_environment: {}))
+      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-F', '-u', 1000, '-o', 'testuser', ';', '/usr/lbin/modprpw', '-v', '-l', 'testuser'], hash_including(custom_environment: {}))
       provider.uid = 1000
     end
 
     it "should not add modprpw if not Trusted System" do
       allow(resource).to receive(:allowdupe?).and_return(true)
       expect(provider).to receive(:exec_getprpw).with('root','-m uid').and_return('System is not trusted')
-      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-u', 1000, '-o', 'testuser', '-F'], hash_including(custom_environment: {}))
+      expect(provider).to receive(:execute).with(['/usr/sam/lbin/usermod.sam', '-F', '-u', 1000, '-o', 'testuser'], hash_including(custom_environment: {}))
       provider.uid = 1000
     end
   end

data/spec/unit/provider/user/useradd_spec.rb

@@ -124,7 +124,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
 
     describe "on systems with the libuser and forcelocal=true" do
       before do
-         described_class.has_feature :libuser
+         described_class.has_feature :manages_local_users_and_groups
          resource[:forcelocal] = true
       end
 
@@ -188,7 +188,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
 
   describe 'when modifying the password' do
     before do
-      described_class.has_feature :libuser
+      described_class.has_feature :manages_local_users_and_groups
       described_class.has_feature :manages_passwords
       #Setting any resource value here initializes needed variables and methods in the resource and provider
       #Setting a password value here initializes the existence and management of the password parameter itself
@@ -210,7 +210,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
   describe '#modify' do
     describe "on systems with the libuser and forcelocal=false" do
       before do
-         described_class.has_feature :libuser
+         described_class.has_feature :manages_local_users_and_groups
          resource[:forcelocal] = false
       end
 
@@ -315,16 +315,24 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '', 'myuser'], hash_including(custom_environment: {}))
       provider.expiry = :absent
     end
+
+    it "should use -e with -1 when the expiry property is removed on SLES11" do
+      allow(Facter).to receive(:value).with(:operatingsystem).and_return('SLES')
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return('11')
+      resource[:expiry] = :absent
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', -1, 'myuser'], hash_including(custom_environment: {}))
+      provider.expiry = :absent
+    end
   end
 
   describe "#comment" do
-    before { described_class.has_feature :libuser }
+    before { described_class.has_feature :manages_local_users_and_groups }
 
     let(:content) { "myuser:x:x:x:local comment:x:x" }
 
     it "should return the local comment string when forcelocal is true" do
       resource[:forcelocal] = true
-      allow(File).to receive(:open).with('/etc/passwd').and_yield(content)
+      allow(File).to receive(:read).with('/etc/passwd').and_return(content)
       expect(provider.comment).to eq('local comment')
     end
 
@@ -337,7 +345,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
   end
 
   describe "#finduser" do
-    before { allow(File).to receive(:open).with('/etc/passwd').and_yield(content) }
+    before { allow(File).to receive(:read).with('/etc/passwd').and_return(content) }
 
     let(:content) { "sample_account:sample_password:sample_uid:sample_gid:sample_gecos:sample_directory:sample_shell" }
     let(:output) do
@@ -361,6 +369,11 @@ describe Puppet::Type.type(:user).provider(:useradd) do
     it "returns false when specified key/value pair is not found" do
       expect(provider.finduser(:account, 'invalid_account')).to eq(false)
     end
+
+    it "reads the user file only once per resource" do
+      expect(File).to receive(:read).with('/etc/passwd').once
+      5.times { provider.finduser(:account, 'sample_account') }
+    end
   end
 
   describe "#check_allow_dup" do
@@ -696,7 +709,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
 
     describe "on systems with the libuser and forcelocal=false" do
       before do
-         described_class.has_feature :libuser
+         described_class.has_feature :manages_local_users_and_groups
          resource[:forcelocal] = false
       end
 
@@ -708,7 +721,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
 
     describe "on systems with the libuser and forcelocal=true" do
       before do
-         described_class.has_feature :libuser
+         described_class.has_feature :manages_local_users_and_groups
          resource[:forcelocal] = true
       end