puppet 6.11.1 → 6.16.0

data/spec/unit/ssl/oids_spec.rb

@@ -33,6 +33,7 @@ describe Puppet::SSL::Oids do
       'pp_cloudplatform'    => '1.3.6.1.4.1.34380.1.1.23',
       'pp_apptier'          => '1.3.6.1.4.1.34380.1.1.24',
       'pp_hostname'         => '1.3.6.1.4.1.34380.1.1.25',
+      'pp_owner'            => '1.3.6.1.4.1.34380.1.1.26',
       'ppPrivCertExt'       => '1.3.6.1.4.1.34380.1.2',
       'ppAuthCertExt'       => '1.3.6.1.4.1.34380.1.3',
       'pp_authorization'    => '1.3.6.1.4.1.34380.1.3.1',

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -73,6 +73,67 @@ describe Puppet::SSL::SSLProvider do
         sslctx.verify_peer = false
       }.to raise_error(/can't modify frozen/)
     end
+
+    it 'verifies peer' do
+      sslctx = subject.create_root_context(config)
+      expect(sslctx.verify_peer).to eq(true)
+    end
+  end
+
+  context 'when creating a system ssl context' do
+    it 'accepts empty list of CA certs' do
+      sslctx = subject.create_system_context(cacerts: [])
+      expect(sslctx.cacerts).to eq([])
+    end
+
+    it 'accepts valid root certs' do
+      certs = [cert_fixture('ca.pem')]
+      sslctx = subject.create_system_context(cacerts: certs)
+      expect(sslctx.cacerts).to eq(certs)
+    end
+
+    it 'accepts valid intermediate certs' do
+      certs = [cert_fixture('ca.pem'), cert_fixture('intermediate.pem')]
+      sslctx = subject.create_system_context(cacerts: certs)
+      expect(sslctx.cacerts).to eq(certs)
+    end
+
+    it 'accepts expired CA certs' do
+      expired = [cert_fixture('ca.pem'), cert_fixture('intermediate.pem')]
+      expired.each { |x509| x509.not_after = Time.at(0) }
+
+      sslctx = subject.create_system_context(cacerts: expired)
+      expect(sslctx.cacerts).to eq(expired)
+    end
+
+    it 'raises if the frozen context is modified' do
+      sslctx = subject.create_system_context(cacerts: [])
+      expect {
+        sslctx.verify_peer = false
+      }.to raise_error(/can't modify frozen/)
+    end
+
+    it 'trusts system ca store' do
+      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
+
+      subject.create_system_context(cacerts: [])
+    end
+
+    it 'verifies peer' do
+      sslctx = subject.create_system_context(cacerts: [])
+      expect(sslctx.verify_peer).to eq(true)
+    end
+
+    it 'disable revocation' do
+      sslctx = subject.create_system_context(cacerts: [])
+      expect(sslctx.revocation).to eq(false)
+    end
+
+    it 'sets client cert and private key to nil' do
+      sslctx = subject.create_system_context(cacerts: [])
+      expect(sslctx.client_cert).to be_nil
+      expect(sslctx.private_key).to be_nil
+    end
   end
 
   context 'when creating an ssl context with crls' do
@@ -99,6 +160,11 @@ describe Puppet::SSL::SSLProvider do
       sslctx = subject.create_root_context(config.merge(crls: expired))
       expect(sslctx.crls).to eq(expired)
     end
+
+    it 'verifies peer' do
+      sslctx = subject.create_root_context(config)
+      expect(sslctx.verify_peer).to eq(true)
+    end
   end
 
   context 'when creating an ssl context with client certs' do
@@ -345,6 +411,11 @@ describe Puppet::SSL::SSLProvider do
         sslctx.verify_peer = false
       }.to raise_error(/can't modify frozen/)
     end
+
+    it 'verifies peer' do
+      sslctx = subject.create_context(config)
+      expect(sslctx.verify_peer).to eq(true)
+    end
   end
 
   context 'when loading an ssl context' do

data/spec/unit/ssl/state_machine_spec.rb

@@ -197,7 +197,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   end
 
   context 'when locking' do
-    let(:lockfile) { double('ssllockfile') }
+    let(:lockfile) { Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile]) }
     let(:machine) { described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider, lockfile: lockfile) }
 
     # lockfile is deleted before `ensure_ca_certificates` returns, so
@@ -210,7 +210,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it 'locks the file prior to running the state machine and unlocks when done' do
-      expect(lockfile).to receive(:lock).and_return(true).ordered
+      expect(lockfile).to receive(:lock).and_call_original.ordered
       expect(cert_provider).to receive(:load_cacerts).and_return(cacerts).ordered
       expect(cert_provider).to receive(:load_crls).and_return(crls).ordered
       expect(lockfile).to receive(:unlock).ordered
@@ -228,13 +228,6 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       expect(File).to_not be_exist(Puppet[:ssl_lockfile])
     end
 
-    it 'raises an exception when locking fails' do
-      allow(lockfile).to receive(:lock).and_return(false)
-      expect {
-        machine.ensure_ca_certificates
-      }.to raise_error(Puppet::Error, /Another puppet instance is already running; exiting/)
-    end
-
     it 'acquires an empty lockfile' do
       Puppet::FileSystem.touch(Puppet[:ssl_lockfile])
 
@@ -262,6 +255,57 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider)
       machine.ensure_ca_certificates
     end
+
+    context 'and another puppet process is running' do
+      let(:now) { Time.now }
+      let(:future) { now + (5 * 60)} # 5 mins in the future
+
+      before :each do
+        allow(lockfile).to receive(:lock).and_return(false)
+      end
+
+      it 'raises a puppet exception' do
+        expect {
+          machine.ensure_ca_certificates
+        }.to raise_error(Puppet::Error, /Another puppet instance is already running and the waitforlock setting is set to 0; exiting/)
+      end
+
+      it 'sleeps and retries successfully' do
+        machine = described_class.new(lockfile: lockfile, cert_provider: cert_provider, waitforlock: 1, maxwaitforlock: 10)
+        allow(cert_provider).to receive(:load_cacerts).and_return(cacerts)
+        allow(cert_provider).to receive(:load_crls).and_return(crls)
+        allow(Time).to receive(:now).and_return(now, future)
+
+        expect(Kernel).to receive(:sleep).with(1)
+        expect(Puppet).to receive(:info).with("Another puppet instance is already running; waiting for it to finish")
+        expect(Puppet).to receive(:info).with("Will try again in 1 seconds.")
+
+        allow(lockfile).to receive(:lock).and_return(false, true)
+
+        expect(machine.ensure_ca_certificates).to be_an_instance_of(Puppet::SSL::SSLContext)
+      end
+
+      it 'sleeps and retries unsuccessfully until the deadline is exceeded' do
+        machine = described_class.new(lockfile: lockfile, waitforlock: 1, maxwaitforlock: 10)
+        allow(Time).to receive(:now).and_return(now, future)
+
+        expect(Kernel).to receive(:sleep).with(1)
+        expect(Puppet).to receive(:info).with("Another puppet instance is already running; waiting for it to finish")
+        expect(Puppet).to receive(:info).with("Will try again in 1 seconds.")
+
+        allow(lockfile).to receive(:lock).and_return(false)
+        expect {
+          machine.ensure_ca_certificates
+        }.to raise_error(Puppet::Error, /Another puppet instance is already running and the maxwaitforlock timeout has been exceeded; exiting/)
+      end
+
+      it 'defaults the waitlock deadline to 60 seconds' do
+        allow(Time).to receive(:now).and_return(now)
+
+        machine = described_class.new
+        expect(machine.waitlock_deadline).to eq(now.to_i + 60)
+      end
+    end
   end
 
   context 'NeedCACerts' do
@@ -837,7 +881,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         }.to output(/Exiting now because the waitforcert setting is set to 0./).to_stdout
       end
 
-      it 'sleeps and transitions to NeedCACerts' do
+      it 'sleeps and transitions to NeedLock' do
         machine = described_class.new(waitforcert: 15)
 
         state = Puppet::SSL::StateMachine::Wait.new(machine)
@@ -845,10 +889,10 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         expect(Puppet).to receive(:info).with(/Will try again in 15 seconds./)
 
-        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedLock)
       end
 
-      it 'sleeps and transitions to NeedCACerts when maxwaitforcert is set' do
+      it 'sleeps and transitions to NeedLock when maxwaitforcert is set' do
         machine = described_class.new(waitforcert: 15, maxwaitforcert: 30)
 
         state = Puppet::SSL::StateMachine::Wait.new(machine)
@@ -856,7 +900,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         expect(Puppet).to receive(:info).with(/Will try again in 15 seconds./)
 
-        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedLock)
       end
 
       it 'waits indefinitely by default' do
@@ -877,6 +921,48 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
           }.to exit_with(1)
         }.to output(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(.*\). Exiting now because the maxwaitforcert timeout has been exceeded./).to_stdout
       end
+
+      it 'closes the pool before sleeping' do
+        machine = described_class.new(waitforcert: 15)
+
+        state = Puppet::SSL::StateMachine::Wait.new(machine)
+        expect(Puppet.runtime[:http].pool).to receive(:close).and_call_original
+        expect(Kernel).to receive(:sleep).with(15).ordered
+
+        state.next_state
+      end
+
+      it 'releases the lock while sleeping' do
+        lockfile = Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile])
+        machine = described_class.new(lockfile: lockfile)
+        state = Puppet::SSL::StateMachine::Wait.new(machine)
+
+        # pidlock should be unlocked while sleeping
+        allow(Kernel).to receive(:sleep) do
+          expect(lockfile).to_not be_locked
+        end
+
+        # lock before running the state
+        lockfile.lock
+        state.next_state
+      end
+    end
+
+    context 'in state NeedLock' do
+      let(:ssl_context) { Puppet::SSL::SSLContext.new(cacerts: []) }
+      let(:lockfile) { Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile]) }
+      let(:machine) { described_class.new(lockfile: lockfile) }
+      let(:state) { Puppet::SSL::StateMachine::NeedLock.new(machine) }
+
+      it 'acquires the lock and transitions to NeedCACerts' do
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(lockfile).to be_locked
+      end
+
+      it 'transitions to LockFailure if it fails to acquire the lock' do
+        expect(lockfile).to receive(:lock).and_return(false)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::LockFailure)
+      end
     end
   end
 end

data/spec/unit/transaction/persistence_spec.rb

@@ -146,16 +146,7 @@ describe Puppet::Transaction::Persistence do
       Dir.mkdir(Puppet[:transactionstorefile])
       persistence = Puppet::Transaction::Persistence.new
 
-      if Puppet::Util::Platform.windows?
-        expect do
-          persistence.save
-        end.to raise_error do |error|
-          expect(error).to be_a(Puppet::Util::Windows::Error)
-          expect(error.code).to eq(5) # ERROR_ACCESS_DENIED
-        end
-      else
-        expect { persistence.save }.to raise_error(Errno::EISDIR, /Is a directory/)
-      end
+      expect { persistence.save }.to raise_error(Errno::EISDIR, /Is a directory/)
 
       Dir.rmdir(Puppet[:transactionstorefile])
     end

data/spec/unit/transaction/report_spec.rb

@@ -39,6 +39,10 @@ describe Puppet::Transaction::Report do
     expect(Puppet::Transaction::Report.new('cv', 'env', 'tid', 'some job id').job_id).to eq('some job id')
   end
 
+  it "should take a 'start_time' as an argument" do
+    expect(Puppet::Transaction::Report.new('cv', 'env', 'tid', 'some job id', 'my start time').time).to eq('my start time')
+  end
+
   it "should be able to set configuration_version" do
     report = Puppet::Transaction::Report.new
     report.configuration_version = "some version"

data/spec/unit/transaction_spec.rb

@@ -3,7 +3,6 @@ require 'matchers/include_in_order'
 require 'puppet_spec/compiler'
 
 require 'puppet/transaction'
-require 'puppet/type/notify'
 require 'fileutils'
 
 describe Puppet::Transaction do
@@ -967,6 +966,51 @@ describe Puppet::Transaction do
       expect(times_send_log_with_skipping_called).to eq(3)
     end
   end
+
+  describe "failed dependency is depended on multiple times" do
+    it "notifies and warns the failed class dependency once" do
+      Puppet.settings[:merge_dependency_warnings] = true
+
+      command_string = File.expand_path('/my/command')
+      allow(Puppet::Util::Execution).to receive(:execute).with([command_string]).and_raise(Puppet::ExecutionFailure, "Failed")
+
+      # Exec['exec1'] is outside of a class, so it's warning is not subject to being coalesced.
+      times_send_log_with_skipping_called = 0
+      allow_any_instance_of(Puppet::Type::Exec).to receive(:send_log) {times_send_log_with_skipping_called += 1; nil}.with(:warning, "Skipping because of failed dependencies")
+
+      # Class['declared_class'] depends upon Class['required_class'] which contains a resource with a failure.
+      times_send_log_with_class_dependency_called = 0
+      allow_any_instance_of(Puppet::Type).to receive(:send_log) {times_send_log_with_class_dependency_called += 1; nil}.with(:notice, "Class dependency Exec[exec2] has failures: true")
+      times_send_log_with_class_skipping_called = 0
+      allow_any_instance_of(Puppet::Type).to receive(:send_log) {times_send_log_with_class_skipping_called += 1; nil}.with(:warning, "Skipping resources in class because of failed class dependencies")
+
+      apply_compiled_manifest(<<-MANIFEST)
+        class required_class {
+          exec { 'exec2':
+            command => '#{command_string}'
+          }
+        }
+        class declared_class {
+          require required_class
+          exec { 'exec3':
+            command => '#{command_string}'
+          }
+          exec { 'exec4':
+            command => '#{command_string}'
+          }
+        }
+        exec { 'exec1':
+          command => '#{command_string}',
+          require => Exec['exec2']
+        }
+        include declared_class
+      MANIFEST
+
+      expect(times_send_log_with_skipping_called).to eq(1)
+      expect(times_send_log_with_class_dependency_called).to eq(1)
+      expect(times_send_log_with_class_skipping_called).to eq(1)
+    end
+  end
 end
 
 describe Puppet::Transaction, " when determining tags" do

data/spec/unit/type/file/content_spec.rb

@@ -200,15 +200,21 @@ describe Puppet::Type.type(:file).attrclass(:content), :uses_checksums => true d
             end
 
             it "prints the diff" do
-              expect(content).to receive(:diff).and_return("my diff").once
-              expect(content).to receive(:debug).with("\nmy diff").once
+              expect(content).to receive(:diff).and_return("my diff")
+              expect(content).to receive(:debug).with("\nmy diff")
+              expect(content).not_to be_safe_insync("other content")
+            end
+
+            it "prints binary file notice if diff is not valid encoding" do
+              expect(content).to receive(:diff).and_return("\xc7\xd1\xfc\x84")
+              expect(content).to receive(:debug).with(/\nBinary files #{filename} and .* differ/)
               expect(content).not_to be_safe_insync("other content")
             end
 
             it "redacts the diff when the property is sensitive" do
               content.sensitive = true
               expect(content).not_to receive(:diff)
-              expect(content).to receive(:debug).with("[diff redacted]").once
+              expect(content).to receive(:debug).with("[diff redacted]")
               expect(content).not_to be_safe_insync("other content")
             end
           end

data/spec/unit/type/file/ensure_spec.rb

@@ -1,7 +1,6 @@
 require 'spec_helper'
-require 'puppet/type/file/ensure'
 
-describe Puppet::Type::File::Ensure do
+describe Puppet::Type.type(:file).attrclass(:ensure) do
   include PuppetSpec::Files
 
   let(:path) { tmpfile('file_ensure') }

data/spec/unit/type/file/source_spec.rb

@@ -533,20 +533,54 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
   describe "when writing" do
     describe "as puppet apply" do
       let(:source_content) { "source file content\r\n"*10 }
+      let(:modulepath) { File.join(Puppet[:environmentpath], 'testing', 'modules') }
+      let(:env) { Puppet::Node::Environment.create(:testing, [modulepath]) }
+      let(:catalog) { Puppet::Resource::Catalog.new(:test, env) }
+
       before do
         Puppet[:default_file_terminus] = "file_server"
-        resource[:source] = file_containing('apply', source_content)
       end
 
       it "should copy content from the source to the file" do
+        resource = Puppet::Type.type(:file).new(path: filename, catalog: catalog, source: file_containing('apply', source_content))
         source = resource.parameter(:source)
         resource.write(source)
 
         expect(Puppet::FileSystem.binread(filename)).to eq(source_content)
       end
 
+      it 'should use the in-process fileserver if source starts with puppet:///' do
+        path = File.join(modulepath, 'mymodule', 'files', 'path')
+        Puppet::FileSystem.dir_mkpath(path)
+        File.open(path, 'wb') { |f| f.write(source_content) }
+        resource = Puppet::Type.type(:file).new(path: filename, catalog: catalog, source: 'puppet:///modules/mymodule/path')
+
+        source = resource.parameter(:source)
+        resource.write(source)
+
+        expect(Puppet::FileSystem.binread(filename)).to eq(source_content)
+      end
+
+      it 'follows symlinks when retrieving content from the in-process fileserver' do
+        # create a 'link' that points to 'target' in the 'mymodule' module
+        link = File.join(modulepath, 'mymodule', 'files', 'link')
+        target = File.join(modulepath, 'mymodule', 'files', 'target')
+        Puppet::FileSystem.dir_mkpath(target)
+        File.open(target, 'wb') { |f| f.write(source_content) }
+        Puppet::FileSystem.symlink(target, link)
+        resource = Puppet::Type.type(:file).new(path: filename, catalog: catalog, source: 'puppet:///modules/mymodule/link')
+
+        source = resource.parameter(:source)
+        resource.write(source)
+
+        # 'filename' should be a file containing the contents of the followed link
+        expect(Puppet::FileSystem.binread(filename)).to eq(source_content)
+      end
+
       with_digest_algorithms do
         it "should return the checksum computed" do
+          resource = Puppet::Type.type(:file).new(path: filename, catalog: catalog, source: file_containing('apply', source_content))
+
           File.open(filename, 'wb') do |file|
             source = resource.parameter(:source)
             resource[:checksum] = digest_algorithm
@@ -583,53 +617,73 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
 
     describe 'from remote source' do
       let(:source_content) { "source file content\n"*10 }
-      let(:source) { resource.newattr(:source) }
-      let(:response) { double('response', :[] => nil, :body => nil, :message => nil) }
-      let(:conn) { double('connection') }
+      let(:source) {
+        attr = resource.newattr(:source)
+        attr.metadata = metadata
+        attr
+      }
+      let(:metadata) {
+        Puppet::FileServing::Metadata.new(
+          '/modules/:module/foo',
+          {
+            'type' => 'file',
+            'source' => 'puppet:///modules/:module/foo'
+          }
+        )
+      }
 
       before do
         resource[:backup] = false
-
-        expectation = receive(:read_body)
-        source_content.lines.each { |line| expectation = expectation.and_yield(line) }
-        allow(response).to expectation
-        allow(conn).to receive(:request_get).and_yield(response)
       end
 
       it 'should use an explicit fileserver if source starts with puppet://' do
-        allow(response).to receive(:code).and_return('200')
-        allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet://somehostname/test/foo', :ftype => 'file', :content_uri => nil))
-        expect(Puppet::Network::HttpPool).to receive(:connection).with('somehostname', 8140, anything).and_return(conn)
+        metadata.source = "puppet://somehostname:8140/modules/:module/foo"
+
+        stub_request(:get, %r{https://somehostname:8140/puppet/v3/file_content/modules/:module/foo})
+          .to_return(status: 200, body: metadata.to_json, headers: { 'Content-Type' => 'application/json' })
 
         resource.write(source)
       end
 
       it 'should use the default fileserver if source starts with puppet:///' do
-        allow(response).to receive(:code).and_return('200')
-        allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet:///test/foo', :ftype => 'file', :content_uri => nil))
-        expect(Puppet::Network::HttpPool).to receive(:connection).with(Puppet[:server], 8140, anything).and_return(conn)
+        stub_request(:get, %r{https://#{Puppet[:server]}:8140/puppet/v3/file_content/modules/:module/foo})
+          .to_return(status: 200, body: metadata.to_json, headers: { 'Content-Type' => 'application/json' })
 
         resource.write(source)
       end
 
       it 'should percent encode reserved characters' do
-        allow(response).to receive(:code).and_return('200')
-        allow(Puppet::Network::HttpPool).to receive(:connection).and_return(conn)
-        allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet:///test/foo bar', :ftype => 'file', :content_uri => nil))
+        metadata.source = 'puppet:///modules/:module/foo bar'
 
-        expect(conn).to receive(:request_get).with("#{Puppet::Network::HTTP::MASTER_URL_PREFIX}/v3/file_content/test/foo%20bar?environment=myenv&", anything).and_yield(response)
+        stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo%20bar})
+          .to_return(status: 200, body: metadata.to_json, headers: { 'Content-Type' => 'application/json' })
 
         resource.write(source)
       end
 
       it 'should request binary content' do
-        allow(response).to receive(:code).and_return('200')
-        allow(Puppet::Network::HttpPool).to receive(:connection).and_return(conn)
-        allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet:///test/foo bar', :ftype => 'file', :content_uri => nil))
+        stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo}) do |request|
+          expect(request.headers).to include({'Accept' => 'application/octet-stream'})
+        end.to_return(status: 200, body: '', headers: { 'Content-Type' => 'application/octet-stream' })
 
-        expect(conn).to receive(:request_get) do |_, options|
-          expect(options).to include('Accept' => 'application/octet-stream')
-        end.and_yield(response)
+        resource.write(source)
+      end
+
+      it "should request file content from the catalog's environment" do
+        Puppet[:environment] = 'doesntexist'
+
+        stub_request(:get, %r{/puppet/v3/file_content})
+          .with(query: hash_including("environment" => "myenv"))
+          .to_return(status: 200, body: '', headers: { 'Content-Type' => 'application/octet-stream' })
+
+        resource.write(source)
+      end
+
+      it 'should request static file content' do
+        metadata.content_uri = "puppet://#{Puppet[:server]}:8140/path/to/file"
+
+        stub_request(:get, %r{/puppet/v3/static_file_content/path/to/file})
+          .to_return(status: 200, body: '', headers: { 'Content-Type' => 'application/octet-stream' })
 
         resource.write(source)
       end
@@ -639,26 +693,23 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
           File.open(filename, 'w') {|f| f.write "initial file content"}
         end
 
-        before(:each) do
-          allow(Puppet::Network::HttpPool).to receive(:connection).and_return(conn)
-          allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet:///test/foo', :ftype => 'file', :content_uri => nil))
-        end
-
         it 'should not write anything if source is not found' do
-          allow(response).to receive(:code).and_return('404')
+          stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo}).to_return(status: 404)
 
-          expect { resource.write(source) }.to raise_error(Net::HTTPError, /404/)
+          expect { resource.write(source) }.to raise_error(Net::HTTPError, /Error 404 on SERVER:/)
           expect(File.read(filename)).to eq('initial file content')
         end
 
         it 'should raise an HTTP error in case of server error' do
-          allow(response).to receive(:code).and_return('500')
+          stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo}).to_return(status: 500)
 
-          expect { resource.write(source) }.to raise_error(Net::HTTPError, /500/)
+          expect { resource.write(source) }.to raise_error(Net::HTTPError, /Error 500 on SERVER/)
         end
 
         context 'and the request was successful' do
-          before(:each) { allow(response).to receive(:code).and_return('200') }
+          before do
+            stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo}).to_return(status: 200, body: source_content)
+          end
 
           it 'should write the contents to the file' do
             resource.write(source)