puppet 6.12.0-universal-darwin → 6.17.0-universal-darwin

data/spec/integration/defaults_spec.rb

@@ -130,8 +130,7 @@ describe "Puppet defaults" do
       Puppet::Util.withenv( {"PATH" => path }, :windows) do
         Puppet.settings[:path] = "none" # this causes it to ignore the setting
 
-        envhash = Puppet::Util::Windows::Process.get_environment_strings
-        expect(envhash['Path']).to eq(path)
+        expect(Puppet::Util.get_env('Path')).to eq(path)
       end
     end
   end

data/spec/integration/http/client_spec.rb

@@ -4,31 +4,17 @@ require 'puppet_spec/files'
 
 describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
   include PuppetSpec::Files
+  include_context "https client"
 
-  before :all do
-    WebMock.disable!
-  end
-
-  after :all do
-    WebMock.enable!
-  end
-
-  before :each do
-    # make sure we don't take too long
-    Puppet[:http_connect_timeout] = '5s'
-  end
-
-  let(:hostname) { '127.0.0.1' }
   let(:wrong_hostname) { 'localhost' }
-  let(:server) { PuppetSpec::HTTPSServer.new }
   let(:client) { Puppet::HTTP::Client.new }
   let(:ssl_provider) { Puppet::SSL::SSLProvider.new }
-  let(:root_context) { ssl_provider.create_root_context(cacerts: [server.ca_cert], crls: [server.ca_crl]) }
+  let(:root_context) { ssl_provider.create_root_context(cacerts: [https_server.ca_cert], crls: [https_server.ca_crl]) }
 
   context "when verifying an HTTPS server" do
     it "connects over SSL" do
-      server.start_server do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+      https_server.start_server do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
         expect(res).to be_success
       end
     end
@@ -41,14 +27,14 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
       port = tcps.connect_address.ip_port
 
       expect {
-        client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+        client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
       }.to raise_error(Puppet::HTTP::ConnectionError, %r{^Request to https://127.0.0.1:#{port} timed out connect operation after .* seconds})
     end
 
     it "raises if the server's cert doesn't match the hostname we connected to" do
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://#{wrong_hostname}:#{port}"), ssl_context: root_context)
+          client.get(URI("https://#{wrong_hostname}:#{port}"), options: {ssl_context: root_context})
         }.to raise_error { |err|
           expect(err).to be_instance_of(Puppet::SSL::CertMismatchError)
           expect(err.message).to match(/Server hostname '#{wrong_hostname}' did not match server certificate; expected one of (.+)/)
@@ -63,9 +49,9 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
       wrong_ca = cert_fixture('netlock-arany-utf8.pem')
       alt_context = ssl_provider.create_root_context(cacerts: [wrong_ca], revocation: false)
 
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://127.0.0.1:#{port}"), ssl_context: alt_context)
+          client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: alt_context})
         }.to raise_error(Puppet::SSL::CertVerifyError,
                          %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
       end
@@ -73,8 +59,8 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
     it "prints TLS protocol and ciphersuite in debug" do
       Puppet[:log_level] = 'debug'
-      server.start_server do |port|
-        client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+      https_server.start_server do |port|
+        client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
         # TLS version string can be TLSv1 or TLSv1.[1-3], but not TLSv1.0
         expect(@logs).to include(
           an_object_having_attributes(level: :debug, message: /Using TLSv1(\.[1-3])? with cipher .*/),
@@ -93,12 +79,12 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
     it "mutually authenticates the connection" do
       client_context = ssl_provider.create_context(
-        cacerts: [server.ca_cert], crls: [server.ca_crl],
-        client_cert: server.server_cert, private_key: server.server_key
+        cacerts: [https_server.ca_cert], crls: [https_server.ca_crl],
+        client_cert: https_server.server_cert, private_key: https_server.server_key
       )
 
-      server.start_server(ctx_proc: ctx_proc) do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: client_context)
+      https_server.start_server(ctx_proc: ctx_proc) do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: client_context})
         expect(res).to be_success
       end
     end
@@ -106,10 +92,10 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
   context "with a system trust store" do
     it "connects when the client trusts the server's CA" do
-      system_context = ssl_provider.create_system_context(cacerts: [server.ca_cert])
+      system_context = ssl_provider.create_system_context(cacerts: [https_server.ca_cert])
 
-      server.start_server do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+      https_server.start_server do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
         expect(res).to be_success
       end
     end
@@ -117,14 +103,14 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
     it "connects when the server's CA is in the system store" do
       # create a temp cacert bundle
       ssl_file = tmpfile('systemstore')
-      File.write(ssl_file, server.ca_cert)
+      File.write(ssl_file, https_server.ca_cert)
 
       # override path to system cacert bundle, this must be done before
       # the SSLContext is created and the call to X509::Store.set_default_paths
       Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
         system_context = ssl_provider.create_system_context(cacerts: [])
-        server.start_server do |port|
-          res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+        https_server.start_server do |port|
+          res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
           expect(res).to be_success
         end
       end
@@ -133,12 +119,36 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
     it "raises if the server's CA is not in the context or system store" do
       system_context = ssl_provider.create_system_context(cacerts: [cert_fixture('netlock-arany-utf8.pem')])
 
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+          client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
         }.to raise_error(Puppet::SSL::CertVerifyError,
                          %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
       end
     end
   end
+
+  context 'persistent connections' do
+    it "detects when the server has closed the connection and reconnects" do
+      Puppet[:http_debug] = true
+
+      # advertise that we support keep-alive, but we don't really
+      response_proc = -> (req, res) {
+        res['Connection'] = 'Keep-Alive'
+      }
+
+      https_server.start_server(response_proc: response_proc) do |port|
+        uri = URI("https://127.0.0.1:#{port}")
+        kwargs = {headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: root_context}}
+
+        expect {
+          expect(client.post(uri, '', **kwargs)).to be_success
+          # the server closes its connection after each request, so posting
+          # again will force ruby to detect that the remote side closed the
+          # connection, and reconnect
+          expect(client.post(uri, '', **kwargs)).to be_success
+        }.to output(/Conn close because of EOF/).to_stderr
+      end
+    end
+  end
 end

data/spec/integration/indirector/facts/facter_spec.rb

@@ -7,6 +7,10 @@ describe Puppet::Node::Facts::Facter do
   include PuppetSpec::Files
   include PuppetSpec::Compiler
 
+  before :each do
+    Puppet::Node::Facts.indirection.terminus_class = :facter
+  end
+
   it "preserves case in fact values" do
     Facter.add(:downcase_test) do
       setcode do

data/spec/integration/indirector/report/yaml.rb

@@ -0,0 +1,83 @@
+require 'spec_helper'
+
+require 'puppet/transaction/report'
+require 'puppet/indirector/report/yaml'
+
+describe Puppet::Transaction::Report::Yaml do
+  describe '#save' do
+    subject(:indirection) { described_class.indirection }
+
+    let(:request) { described_class.new }
+    let(:certname) { 'ziggy' }
+    let(:report) do
+      report = Puppet::Transaction::Report.new
+      report.host = certname
+      report
+    end
+    let(:file) { request.path(:me) }
+
+    before do
+      indirection.terminus_class = :yaml
+    end
+
+    it 'is saves a report' do
+      indirection.save(report)
+    end
+
+    it 'saves the instance of the report as YAML to disk' do
+      indirection.save(report)
+      content = Puppet::Util::Yaml.safe_load_file(
+        Puppet[:lastrunreport], [Puppet::Transaction::Report]
+      )
+      expect(content.host).to eq(certname)
+    end
+
+    it 'allows mode overwrite' do
+      Puppet.settings.setting(:lastrunreport).mode = '0644'
+      indirection.save(report)
+
+      if Puppet::Util::Platform.windows?
+        require 'puppet/util/windows/security'
+        mode = Puppet::Util::Windows::Security.get_mode(file)
+      else
+        mode = Puppet::FileSystem.stat(file).mode
+      end
+
+      expect(mode & 07777).to eq(0644)
+    end
+
+    context 'when mode is invalid' do
+      before do
+        Puppet.settings.setting(:lastrunreport).mode = '9999'
+      end
+
+      after do
+        Puppet.settings.setting(:lastrunreport).mode = '0644'
+      end
+
+      it 'raises Puppet::DevError ' do
+        expect{
+          indirection.save(report)
+        }.to raise_error(Puppet::DevError, "replace_file mode: 9999 is invalid")
+      end
+    end
+
+    context 'when repport is invalid' do
+      it 'logs error' do
+        expect(Puppet).to receive(:send_log).with(:err, /Could not save yaml ziggy: can't dump anonymous class/)
+
+        report.configuration_version = Class.new
+        indirection.save(report)
+      end
+    end
+
+    context 'when report cannot be saved' do
+      it 'raises Errno::EISDIR' do
+        FileUtils.mkdir_p(file)
+        expect {
+          indirection.save(report)
+         }.to raise_error(Errno::EISDIR, /last_run_report.yaml/)
+      end
+    end
+  end
+end

data/spec/integration/module_tool/forge_spec.rb

@@ -4,21 +4,8 @@ require 'puppet_spec/https'
 
 describe Puppet::Forge, unless: Puppet::Util::Platform.jruby? do
   include PuppetSpec::Files
+  include_context "https client"
 
-  before :all do
-    WebMock.disable!
-  end
-
-  after :all do
-    WebMock.enable!
-  end
-
-  before :each do
-    # make sure we don't take too long
-    Puppet[:http_connect_timeout] = '5s'
-  end
-
-  let(:hostname) { '127.0.0.1' }
   let(:wrong_hostname) { 'localhost' }
   let(:server) { PuppetSpec::HTTPSServer.new }
   let(:ssl_provider) { Puppet::SSL::SSLProvider.new }
@@ -41,7 +28,7 @@ describe Puppet::Forge, unless: Puppet::Util::Platform.jruby? do
     # override path to system cacert bundle, this must be done before
     # the SSLContext is created and the call to X509::Store.set_default_paths
     Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
-      response_proc = -> res {
+      response_proc = -> (req, res) {
         res.status = 200
         res.body = release_response
       }

data/spec/integration/network/http_pool_spec.rb

@@ -24,14 +24,6 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
   let(:server) { PuppetSpec::HTTPSServer.new }
 
   context "when calling deprecated HttpPool methods" do
-    let(:ssl_host) {
-      # use server's cert/key as the client cert/key
-      host = Puppet::SSL::Host.new
-      host.key = Puppet::SSL::Key.from_instance(server.server_key, host.name)
-      host.certificate = Puppet::SSL::Certificate.from_instance(server.server_cert, host.name)
-      host
-    }
-
     before(:each) do
       ssldir = tmpdir('http_pool')
       Puppet[:ssldir] = ssldir
@@ -43,16 +35,6 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
       File.write(Puppet[:hostprivkey], server.server_key.to_pem)
     end
 
-    # Can't use `around(:each)` because it will cause ssl_host to be
-    # created outside of any rspec example, and $confdir won't be set
-    before(:each) do
-      Puppet.push_context(ssl_host: ssl_host)
-    end
-
-    after (:each) do
-      Puppet.pop_context
-    end
-
     def connection(host, port)
       Puppet::Network::HttpPool.http_instance(host, port, use_ssl: true)
     end
@@ -98,8 +80,26 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
                            %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
         end
       end
-    end
 
+      it "doesn't generate a Puppet::SSL::Host deprecation warning" do
+        server.start_server do |port|
+          http = connection(hostname, port)
+          res = http.get('/')
+          expect(res.code).to eq('200')
+        end
+
+        expect(@logs).to eq([])
+      end
+
+      it "detects when the server has closed the connection and reconnects" do
+        server.start_server do |port|
+          http = connection(hostname, port)
+
+          expect(http.request_get('/')).to be_a(Net::HTTPSuccess)
+          expect(http.request_get('/')).to be_a(Net::HTTPSuccess)
+        end
+      end
+    end
 
     context "when using single use HTTPS connections" do
       include_examples 'HTTPS client'
@@ -107,7 +107,7 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
 
     context "when using persistent HTTPS connections" do
       around :each do |example|
-        pool = Puppet::Network::HTTP::Pool.new
+        pool = Puppet::Network::HTTP::Pool.new(15)
         Puppet.override(:http_pool => pool) do
           example.run
         end
@@ -116,6 +116,79 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
 
       include_examples 'HTTPS client'
     end
+
+    shared_examples_for "an HttpPool connection" do |klass, legacy_api|
+      before :each do
+        Puppet::Network::HttpPool.http_client_class = klass
+      end
+
+      it "connects using the scheme, host and port from the http instance preserving the URL path and query" do
+        request_line = nil
+
+        response_proc = -> (req, res) {
+          request_line = req.request_line
+        }
+
+        server.start_server(response_proc: response_proc) do |port|
+          http = Puppet::Network::HttpPool.http_instance(hostname, port, true)
+          path  = "http://bogus.example.com:443/foo?q=a"
+          http.get(path)
+
+          if legacy_api
+            # The old API uses 'absolute-form' and passes the bogus hostname
+            # which isn't the host we connected to.
+            expect(request_line).to eq("GET http://bogus.example.com:443/foo?q=a HTTP/1.1\r\n")
+          else
+            expect(request_line).to eq("GET /foo?q=a HTTP/1.1\r\n")
+          end
+        end
+      end
+
+      it "requires the caller to URL encode the path and query when using absolute form" do
+        request_line = nil
+
+        response_proc = -> (req, res) {
+          request_line = req.request_line
+        }
+
+        server.start_server(response_proc: response_proc) do |port|
+          http = Puppet::Network::HttpPool.http_instance(hostname, port, true)
+          params = { 'key' => 'a value' }
+          encoded_url = "https://#{hostname}:#{port}/foo%20bar?q=#{Puppet::Util.uri_query_encode(params.to_json)}"
+          http.get(encoded_url)
+
+          if legacy_api
+            expect(request_line).to eq("GET #{encoded_url} HTTP/1.1\r\n")
+          else
+            expect(request_line).to eq("GET /foo%20bar?q=%7B%22key%22%3A%22a%20value%22%7D HTTP/1.1\r\n")
+          end
+        end
+      end
+
+      it "requires the caller to URL encode the path and query when using a path" do
+        request_line = nil
+
+        response_proc = -> (req, res) {
+          request_line = req.request_line
+        }
+
+        server.start_server(response_proc: response_proc) do |port|
+          http = Puppet::Network::HttpPool.http_instance(hostname, port, true)
+          params = { 'key' => 'a value' }
+          http.get("/foo%20bar?q=#{Puppet::Util.uri_query_encode(params.to_json)}")
+
+          expect(request_line).to eq("GET /foo%20bar?q=%7B%22key%22%3A%22a%20value%22%7D HTTP/1.1\r\n")
+        end
+      end
+    end
+
+    describe Puppet::Network::HTTP::Connection do
+      it_behaves_like "an HttpPool connection", described_class, true
+    end
+
+    describe Puppet::Network::HTTP::ConnectionAdapter do
+      it_behaves_like "an HttpPool connection", described_class, false
+    end
   end
 
   context "when calling HttpPool.connection method" do

data/spec/integration/node/environment_spec.rb

@@ -76,6 +76,21 @@ describe Puppet::Node::Environment do
     expect(mods[0].path).to eq(File.join(base, "dir1", "mod"))
   end
 
+  it "should not yield a module with the same name as a defined Bolt project" do
+    project_path = File.join(tmpfile('project'), 'bolt_project')
+    FileUtils.mkdir_p(project_path)
+    project = Struct.new("Project", :name, :path).new('project', project_path)
+
+    Puppet.override(bolt_project: project) do
+      base = tmpfile("base")
+      FileUtils.mkdir_p([File.join(base, 'project'), File.join(base, 'other')])
+      environment = Puppet::Node::Environment.create(:env, [base])
+      mods = environment.modules
+      expect(mods.length).to eq(2)
+      expect(mods.map(&:path)).to eq([project_path, File.join(base, 'other')])
+    end
+  end
+
   shared_examples_for "the environment's initial import" do |settings|
     it "a manifest referring to a directory invokes parsing of all its files in sorted order" do
       settings.each do |name, value|