puppet 6.12.0-x64-mingw32 → 6.17.0-x64-mingw32

data/spec/unit/face/module/search_spec.rb

@@ -211,4 +211,21 @@ describe "puppet module search" do
       end
     end
   end
+
+  it "should include a deprecation warning" do
+    stub_request(:get, "https://forgeapi.puppet.com/v3/modules?query=puppetlabs-apache").to_return(status: 200, body: [answers: [], result: :success])
+
+    subject.search("puppetlabs-apache")
+
+    expect(@logs).to include(an_object_having_attributes(level: :warning, message: /This action has been deprecated. Please use the Puppet Forge to search for modules./))
+  end
+
+  it "omits the warning when deprecations are disabled" do
+    stub_request(:get, "https://forgeapi.puppet.com/v3/modules?query=puppetlabs-apache").to_return(status: 200, body: [answers: [], result: :success])
+
+    Puppet[:disable_warnings] = 'deprecations'
+    subject.search("puppetlabs-apache")
+
+    expect(@logs).not_to include(an_object_having_attributes(level: :warning))
+  end
 end

data/spec/unit/face/plugin_spec.rb

@@ -10,9 +10,10 @@ describe Puppet::Face[:plugin, :current] do
   end
 
   context "download" do
-    before :each do
-      #Server_agent version needs to be at 5.3.4 in order to mount locales
-      Puppet.push_context({:server_agent_version => "5.3.4"})
+    around do |example|
+      Puppet.override(server_agent_version: "5.3.4") do
+        example.run
+      end
     end
 
     it "downloads plugins, external facts, and locales" do
@@ -61,9 +62,10 @@ describe Puppet::Face[:plugin, :current] do
   end
 
   context "download when server_agent_version is 5.3.3" do
-    before :each do
-      #Server_agent version needs to be at 5.3.4 in order to mount locales
-      Puppet.push_context({:server_agent_version => "5.3.3"})
+    around do |example|
+      Puppet.override(server_agent_version: "5.3.3") do
+        example.run
+      end
     end
 
     it "downloads plugins, and external facts, but not locales" do
@@ -87,10 +89,10 @@ describe Puppet::Face[:plugin, :current] do
   end
 
   context "download when server_agent_version is blank" do
-    before :each do
-      #Server_agent version needs to be at 5.3.4 in order to mount locales
-      #A blank version will default to 0.0
-      Puppet.push_context({:server_agent_version => ""})
+    around do |example|
+      Puppet.override(server_agent_version: "") do
+        example.run
+      end
     end
 
     it "downloads plugins, and external facts, but not locales" do

data/spec/unit/file_serving/http_metadata_spec.rb

@@ -30,11 +30,6 @@ describe Puppet::FileServing::HttpMetadata do
     end
 
     context "with no Last-Modified or Content-MD5 header from the server" do
-      before do
-        allow(http_response).to receive(:[]).with('last-modified').and_return(nil)
-        allow(http_response).to receive(:[]).with('content-md5').and_return(nil)
-      end
-
       it "should use :mtime as the checksum type, based on current time" do
         # Stringifying Time.now does some rounding; do so here so we don't end up with a time
         # that's greater than the stringified version returned by collect.
@@ -51,13 +46,9 @@ describe Puppet::FileServing::HttpMetadata do
     context "with a Last-Modified header from the server" do
       let(:time) { Time.now.utc }
 
-      before do
-        allow(http_response).to receive(:[]).with('content-md5').and_return(nil)
-      end
-
       it "should use :mtime as the checksum type, based on Last-Modified" do
         # HTTP uses "GMT" not "UTC"
-        allow(http_response).to receive(:[]).with('last-modified').and_return(time.strftime("%a, %d %b %Y %T GMT"))
+        http_response.add_field('last-modified', time.strftime("%a, %d %b %Y %T GMT"))
         metadata = described_class.new(http_response)
         metadata.collect
         expect( metadata.checksum_type ).to eq :mtime
@@ -70,16 +61,48 @@ describe Puppet::FileServing::HttpMetadata do
       let(:base64) { Digest::MD5.new.base64digest input }
       let(:hex) { Digest::MD5.new.hexdigest input }
 
-      before do
-        allow(http_response).to receive(:[]).with('last-modified').and_return(nil)
-        allow(http_response).to receive(:[]).with('content-md5').and_return(base64)
+      it "should use the md5 checksum" do
+        http_response.add_field('content-md5', base64)
+        metadata = described_class.new(http_response)
+        metadata.collect
+        expect( metadata.checksum_type ).to eq :md5
+        expect( metadata.checksum ).to eq "{md5}#{hex}"
       end
+    end
+
+    context "with X-Checksum-Md5" do
+      let(:md5) { "c58989e9740a748de4f5054286faf99b" }
 
       it "should use the md5 checksum" do
+        http_response.add_field('X-Checksum-Md5', md5)
         metadata = described_class.new(http_response)
         metadata.collect
         expect( metadata.checksum_type ).to eq :md5
-        expect( metadata.checksum ).to eq "{md5}#{hex}"
+        expect( metadata.checksum ).to eq "{md5}#{md5}"
+      end
+    end
+
+    context "with X-Checksum-Sha1" do
+      let(:sha1) { "01e4d15746f4274b84d740a93e04b9fd2882e3ea" }
+
+      it "should use the SHA1 checksum" do
+        http_response.add_field('X-Checksum-Sha1', sha1)
+        metadata = described_class.new(http_response)
+        metadata.collect
+        expect( metadata.checksum_type ).to eq :sha1
+        expect( metadata.checksum ).to eq "{sha1}#{sha1}"
+      end
+    end
+
+    context "with X-Checksum-Sha256" do
+      let(:sha256) { "a3eda98259c30e1e75039c2123670c18105e1c46efb672e42ca0e4cbe77b002a" }
+
+      it "should use the SHA256 checksum" do
+        http_response.add_field('X-Checksum-Sha256', sha256)
+        metadata = described_class.new(http_response)
+        metadata.collect
+        expect( metadata.checksum_type ).to eq :sha256
+        expect( metadata.checksum ).to eq "{sha256}#{sha256}"
       end
     end
   end

data/spec/unit/file_serving/terminus_selector_spec.rb

@@ -3,62 +3,81 @@ require 'spec_helper'
 require 'puppet/file_serving/terminus_selector'
 
 describe Puppet::FileServing::TerminusSelector do
-  before do
-    @object = Object.new
-    @object.extend(Puppet::FileServing::TerminusSelector)
+  class TestSelector
+    include Puppet::FileServing::TerminusSelector
+  end
 
-    @request = double('request', :key => "mymod/myfile", :options => {:node => "whatever"}, :server => nil, :protocol => nil)
+  def create_request(key)
+    Puppet::Indirector::Request.new(:indirection_name, :find, key, nil, {node: 'whatever'})
   end
 
+  subject { TestSelector.new }
+
   describe "when being used to select termini" do
     it "should return :file if the request key is fully qualified" do
-      expect(@request).to receive(:key).and_return(File.expand_path('/foo'))
-      expect(@object.select(@request)).to eq(:file)
+      request = create_request(File.expand_path('/foo'))
+
+      expect(subject.select(request)).to eq(:file)
+    end
+
+    it "should return :file_server if the request key is relative" do
+      request = create_request('modules/my_module/path/to_file')
+
+      expect(subject.select(request)).to eq(:file_server)
     end
 
     it "should return :file if the URI protocol is set to 'file'" do
-      expect(@request).to receive(:protocol).and_return("file")
-      expect(@object.select(@request)).to eq(:file)
+      request = create_request(Puppet::Util.path_to_uri(File.expand_path("/foo")).to_s)
+
+      expect(subject.select(request)).to eq(:file)
     end
 
     it "should return :http if the URI protocol is set to 'http'" do
-      expect(@request).to receive(:protocol).and_return("http")
-      expect(@object.select(@request)).to eq :http
+      request = create_request("http://www.example.com")
+
+      expect(subject.select(request)).to eq(:http)
     end
 
     it "should return :http if the URI protocol is set to 'https'" do
-      expect(@request).to receive(:protocol).and_return("https")
-      expect(@object.select(@request)).to eq :http
+      request = create_request("https://www.example.com")
+
+      expect(subject.select(request)).to eq(:http)
+    end
+
+    it "should return :http if the path starts with a double slash" do
+      request = create_request("https://www.example.com//index.html")
+
+      expect(subject.select(request)).to eq(:http)
     end
 
     it "should fail when a protocol other than :puppet, :http(s) or :file is used" do
-      allow(@request).to receive(:protocol).and_return("ftp")
-      expect { @object.select(@request) }.to raise_error(ArgumentError)
+      request = create_request("ftp://ftp.example.com")
+
+      expect {
+        subject.select(request)
+      }.to raise_error(ArgumentError, /URI protocol 'ftp' is not currently supported for file serving/)
     end
 
     describe "and the protocol is 'puppet'" do
-      before do
-        allow(@request).to receive(:protocol).and_return("puppet")
-      end
-
       it "should choose :rest when a server is specified" do
-        allow(@request).to receive(:protocol).and_return("puppet")
-        expect(@request).to receive(:server).and_return("foo")
-        expect(@object.select(@request)).to eq(:rest)
+        request = create_request("puppet://puppetserver.example.com")
+
+        expect(subject.select(request)).to eq(:rest)
       end
 
       # This is so a given file location works when bootstrapping with no server.
       it "should choose :rest when default_file_terminus is rest" do
-        allow(@request).to receive(:protocol).and_return("puppet")
         Puppet[:server] = 'localhost'
-        expect(@object.select(@request)).to eq(:rest)
+        request = create_request("puppet:///plugins")
+
+        expect(subject.select(request)).to eq(:rest)
       end
 
       it "should choose :file_server when default_file_terminus is file_server and no server is specified on the request" do
-        expect(@request).to receive(:protocol).and_return("puppet")
-        expect(@request).to receive(:server).and_return(nil)
         Puppet[:default_file_terminus] = 'file_server'
-        expect(@object.select(@request)).to eq(:file_server)
+        request = create_request("puppet:///plugins")
+
+        expect(subject.select(request)).to eq(:file_server)
       end
     end
   end

data/spec/unit/file_system/uniquefile_spec.rb

@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Puppet::FileSystem::Uniquefile do
+  include PuppetSpec::Files
+
   it "makes the name of the file available" do
     Puppet::FileSystem::Uniquefile.open_tmp('foo') do |file|
       expect(file.path).to match(/foo/)
@@ -73,6 +75,15 @@ describe Puppet::FileSystem::Uniquefile do
     Puppet::FileSystem::Uniquefile.open_tmp('foo') { |tmp| }
   end
 
+  it "reports when a parent directory does not exist" do
+    dir = tmpdir('uniquefile')
+    lock = File.join(dir, 'path', 'to', 'lock')
+
+    expect {
+      Puppet::FileSystem::Uniquefile.open_tmp(lock) { |tmp| }
+    }.to raise_error(Errno::ENOENT, %r{No such file or directory - A directory component in .* does not exist or is a dangling symbolic link})
+  end
+
   context "Ruby 1.9.3 Tempfile tests" do
     # the remaining tests in this file are ported directly from the ruby 1.9.3 source,
     # since most of this file was ported from there

data/spec/unit/file_system_spec.rb

@@ -970,6 +970,16 @@ describe "Puppet::FileSystem" do
           mode = Puppet::FileSystem.stat(dest).mode
           expect(mode & 07777).to eq(0400)
         end
+
+        it 'preserves file ownership' do
+          allow(Puppet::FileSystem).to receive(:lstat)
+            .with(Puppet::FileSystem.pathname(dest))
+            .and_return(double(uid: 1, gid: 2))
+
+          expect(FileUtils).to receive(:chown).with(1, 2, /#{dest}/)
+
+          Puppet::FileSystem.replace_file(dest, 0644) { |f| f.write(content) }
+        end
       end
 
       context 'on windows', if: Puppet::Util::Platform.windows? do
@@ -988,7 +998,7 @@ describe "Puppet::FileSystem" do
         it 'rejects unsupported modes' do
           expect {
             Puppet::FileSystem.replace_file(dest, 0755) { |_| }
-          }.to raise_error(ArgumentError, /Only modes 0644, 0640 and 0600 are allowed/)
+          }.to raise_error(ArgumentError, /Only modes 0644, 0640, 0660, and 0440 are allowed/)
         end
       end
     end
@@ -1065,12 +1075,26 @@ describe "Puppet::FileSystem" do
           end
         end
 
-        it 'applies the specified mode' do
+        it 'applies 0644 mode' do
           Puppet::FileSystem.replace_file(dest, 0644) { |f| f.write(content) }
 
           expects_public_file(dest)
         end
 
+        [0660, 0640, 0600, 0440].each do |mode|
+          it "applies #{mode} mode" do
+            Puppet::FileSystem.replace_file(dest, mode) { |f| f.write(content) }
+            current_sid = Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name)
+            sd = Puppet::Util::Windows::Security.get_security_descriptor(dest)
+
+            expect(sd.dacl).to contain_exactly(
+              an_object_having_attributes(sid: Puppet::Util::Windows::SID::LocalSystem, mask: 0x1f01ff),
+              an_object_having_attributes(sid: Puppet::Util::Windows::SID::BuiltinAdministrators, mask: 0x1f01ff),
+              an_object_having_attributes(sid: current_sid, mask: 0x1f01ff),
+            )
+          end
+        end
+
         it 'raises Errno::EACCES if access is denied' do
           allow(Puppet::Util::Windows::Security).to receive(:get_security_descriptor).and_raise(Puppet::Util::Windows::Error.new('access denied', 5))
 

data/spec/unit/functions/lookup_spec.rb

@@ -3082,6 +3082,19 @@ describe "The lookup function" do
 
       let(:env_data) { data_files }
 
+      context 'with unencryptable eyaml' do
+        let(:data_files) do
+          {
+            'common.eyaml' => <<-YAML.unindent
+              key_with_invalid_eyaml: ENC[PKCS7,INVALID]
+              YAML
+          }
+        end
+
+        it 'fails and reports error with ENC value, key being looked up and filename' do
+          expect { lookup('key_with_invalid_eyaml') }.to raise_error(Puppet::DataBinding::LookupError, /hiera-eyaml backend error decrypting ENC\[PKCS7,INVALID\] when looking up key_with_invalid_eyaml in .*common\.eyaml\. Error was/)
+        end
+      end
       context 'and a module using eyaml with different options' do
 
         let(:private_module_key) do

data/spec/unit/http/client_spec.rb

@@ -4,7 +4,9 @@ require 'puppet/http'
 
 describe Puppet::HTTP::Client do
   let(:uri) { URI.parse('https://www.example.com') }
-  let(:client) { described_class.new }
+  let(:puppet_context) { Puppet::SSL::SSLContext.new }
+  let(:system_context) { Puppet::SSL::SSLContext.new }
+  let(:client) { described_class.new(ssl_context: puppet_context, system_ssl_context: system_context) }
   let(:credentials) { ['user', 'pass'] }
 
   it 'creates unique sessions' do
@@ -45,6 +47,46 @@ describe Puppet::HTTP::Client do
         client.connect(uri)
       }.to raise_error(Puppet::HTTP::ConnectionError, %r{^Request to https://www.example.com timed out connect operation after .* seconds})
     end
+
+    it 'connects using the default ssl context' do
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier.ssl_context).to equal(puppet_context)
+      end
+
+      client.connect(uri)
+    end
+
+    it 'connects using a specified ssl context' do
+      other_context = Puppet::SSL::SSLContext.new
+
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier.ssl_context).to equal(other_context)
+      end
+
+      client.connect(uri, options: {ssl_context: other_context})
+    end
+
+    it 'connects using the system store' do
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier.ssl_context).to equal(system_context)
+      end
+
+      client.connect(uri, options: {include_system_store: true})
+    end
+
+    it 'does not create a verifier for HTTP connections' do
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier).to be_nil
+      end
+
+      client.connect(URI.parse('http://www.example.com'))
+    end
+
+    it 'raises an HTTPError if both are specified' do
+      expect {
+        client.connect(uri, options: {ssl_context: puppet_context, include_system_store: true})
+      }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+    end
   end
 
   context 'after connecting' do
@@ -75,10 +117,8 @@ describe Puppet::HTTP::Client do
 
   context "when closing" do
     it "closes all connections in the pool" do
-      pool = double('pool')
-      expect(pool).to receive(:close)
+      expect(client.pool).to receive(:close)
 
-      client = described_class.new(pool: pool)
       client.close
     end
   end
@@ -99,6 +139,12 @@ describe Puppet::HTTP::Client do
       client.get(uri, params: {:foo => "bar=baz"})
     end
 
+    it "fails if a user passes in an invalid param type" do
+      environment = Puppet::Node::Environment.create(:testing, [])
+
+      expect{client.get(uri, params: {environment: environment})}.to raise_error(Puppet::HTTP::SerializationError, /HTTP REST queries cannot handle values of type/)
+    end
+
     it "merges custom headers with default ones" do
       stub_request(:get, uri).with(headers: { 'X-Foo' => 'Bar', 'X-Puppet-Version' => /./, 'User-Agent' => /./ })
 
@@ -132,6 +178,28 @@ describe Puppet::HTTP::Client do
 
       expect(io.string).to eq("abc")
     end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:get, uri).to_return(body: "abc")
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.get(uri, options: {ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:get, uri).to_return(body: "abc")
+
+        client.get(uri, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.get(uri, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
+    end
   end
 
   context "for HEAD requests" do
@@ -167,6 +235,28 @@ describe Puppet::HTTP::Client do
 
       expect(client.head(uri).body).to eq("abc")
     end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:head, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.head(uri, options: {ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:head, uri)
+
+        client.head(uri, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.head(uri, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
+    end
   end
 
   context "for PUT requests" do
@@ -176,25 +266,25 @@ describe Puppet::HTTP::Client do
         expect(request.headers).to_not include('X-Puppet-Profiling')
       end
 
-      client.put(uri, content_type: 'text/plain', body: "")
+      client.put(uri, "", headers: {'Content-Type' => 'text/plain'})
     end
 
     it "stringifies keys and encodes values in the query" do
       stub_request(:put, "https://www.example.com").with(query: "foo=bar%3Dbaz")
 
-      client.put(uri, params: {:foo => "bar=baz"}, content_type: 'text/plain', body: "")
+      client.put(uri, "", params: {:foo => "bar=baz"}, headers: {'Content-Type' => 'text/plain'})
     end
 
     it "includes custom headers" do
       stub_request(:put, "https://www.example.com").with(headers: { 'X-Foo' => 'Bar' })
 
-      client.put(uri, headers: {'X-Foo' => 'Bar'}, content_type: 'text/plain', body: "")
+      client.put(uri, "", headers: {'X-Foo' => 'Bar', 'Content-Type' => 'text/plain'})
     end
 
     it "returns the response" do
       stub_request(:put, uri)
 
-      response = client.put(uri, content_type: 'text/plain', body: "")
+      response = client.put(uri, "", headers: {'Content-Type' => 'text/plain'})
       expect(response).to be_an_instance_of(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
@@ -203,7 +293,41 @@ describe Puppet::HTTP::Client do
     it "sets content-length and content-type for the body" do
       stub_request(:put, uri).with(headers: {"Content-Length" => "5", "Content-Type" => "text/plain"})
 
-      client.put(uri, content_type: 'text/plain', body: "hello")
+      client.put(uri, "hello", headers: {'Content-Type' => 'text/plain'})
+    end
+
+     it 'raises an ArgumentError if `body` is missing' do
+       expect {
+         client.put(uri, nil, headers: {'Content-Type' => 'text/plain'})
+       }.to raise_error(ArgumentError, /'put' requires a string 'body' argument/)
+     end
+
+     it 'raises an ArgumentError if `content_type` is missing from the headers hash' do
+       expect {
+         client.put(uri, '')
+       }.to raise_error(ArgumentError, /'put' requires a 'content-type' header/)
+     end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:put, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.put(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:put, uri)
+
+        client.put(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.put(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
     end
   end
 
@@ -211,25 +335,25 @@ describe Puppet::HTTP::Client do
     it "includes default HTTP headers" do
       stub_request(:post, uri).with(headers: {'X-Puppet-Version' => /./, 'User-Agent' => /./})
 
-      client.post(uri, content_type: 'text/plain', body: "")
+      client.post(uri, "", headers: {'Content-Type' => 'text/plain'})
     end
 
     it "stringifies keys and encodes values in the query" do
       stub_request(:post, "https://www.example.com").with(query: "foo=bar%3Dbaz")
 
-      client.post(uri, params: {:foo => "bar=baz"}, content_type: 'text/plain', body: "")
+      client.post(uri, "", params: {:foo => "bar=baz"}, headers: {'Content-Type' => 'text/plain'})
     end
 
     it "includes custom headers" do
       stub_request(:post, "https://www.example.com").with(headers: { 'X-Foo' => 'Bar' })
 
-      client.post(uri, headers: {'X-Foo' => 'Bar'}, content_type: 'text/plain', body: "")
+      client.post(uri, "", headers: {'X-Foo' => 'Bar', 'Content-Type' => 'text/plain'})
     end
 
     it "returns the response" do
       stub_request(:post, uri)
 
-      response = client.post(uri, content_type: 'text/plain', body: "")
+      response = client.post(uri, "", headers: {'Content-Type' => 'text/plain'})
       expect(response).to be_an_instance_of(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
@@ -238,14 +362,14 @@ describe Puppet::HTTP::Client do
     it "sets content-length and content-type for the body" do
       stub_request(:post, uri).with(headers: {"Content-Length" => "5", "Content-Type" => "text/plain"})
 
-      client.post(uri, content_type: 'text/plain', body: "hello")
+      client.post(uri, "hello", headers: {'Content-Type' => 'text/plain'})
     end
 
     it "streams the response body when a block is given" do
       stub_request(:post, uri).to_return(body: "abc")
 
       io = StringIO.new
-      client.post(uri, content_type: 'text/plain', body: "") do |response|
+      client.post(uri, "", headers: {'Content-Type' => 'text/plain'}) do |response|
         response.read_body do |data|
           io.write(data)
         end
@@ -253,6 +377,40 @@ describe Puppet::HTTP::Client do
 
       expect(io.string).to eq("abc")
     end
+
+    it 'raises an ArgumentError if `body` is missing' do
+      expect {
+        client.post(uri, nil, headers: {'Content-Type' => 'text/plain'})
+      }.to raise_error(ArgumentError, /'post' requires a string 'body' argument/)
+    end
+
+    it 'raises an ArgumentError if `content_type` is missing from the headers hash' do
+      expect {
+        client.post(uri, "")
+      }.to raise_error(ArgumentError, /'post' requires a 'content-type' header/)
+    end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:post, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {body: "", ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:post, uri)
+
+        client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
+    end
   end
 
   context "for DELETE requests" do
@@ -288,44 +446,80 @@ describe Puppet::HTTP::Client do
 
       expect(client.delete(uri).body).to eq("abc")
     end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:delete, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.delete(uri, options: {ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:delete, uri)
+
+        client.delete(uri, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.delete(uri, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
+    end
   end
 
   context "Basic Auth" do
     it "submits credentials for GET requests" do
       stub_request(:get, uri).with(basic_auth: credentials)
 
-      client.get(uri, user: 'user', password: 'pass')
+      client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
     end
 
     it "submits credentials for PUT requests" do
       stub_request(:put, uri).with(basic_auth: credentials)
 
-      client.put(uri, content_type: 'text/plain', body: "hello", user: 'user', password: 'pass')
+      client.put(uri, "hello", headers: {'Content-Type' => 'text/plain'}, options: {basic_auth: {user: 'user', password: 'pass'}})
     end
 
     it "returns response containing access denied" do
       stub_request(:get, uri).with(basic_auth: credentials).to_return(status: [403, "Ye Shall Not Pass"])
 
-      response = client.get(uri, user: 'user', password: 'pass')
+      response = client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
       expect(response.code).to eq(403)
       expect(response.reason).to eq("Ye Shall Not Pass")
       expect(response).to_not be_success
     end
 
-    it 'omits basic auth if user is nil' do
+    it 'includes basic auth if user is nil' do
       stub_request(:get, uri).with do |req|
-        expect(req.headers).to_not include('Authorization')
+        expect(req.headers).to include('Authorization')
       end
 
-      client.get(uri, user: nil, password: 'pass')
+      client.get(uri, options: {basic_auth: {user: nil, password: 'pass'}})
     end
 
-    it 'omits basic auth if password is nil' do
+    it 'includes basic auth if password is nil' do
       stub_request(:get, uri).with do |req|
-        expect(req.headers).to_not include('Authorization')
+        expect(req.headers).to include('Authorization')
       end
 
-      client.get(uri, user: 'user', password: nil)
+      client.get(uri, options: {basic_auth: {user: 'user', password: nil}})
+    end
+
+    it 'observes userinfo in the URL' do
+      stub_request(:get, uri).with(basic_auth: credentials)
+
+      client.get(URI("https://user:pass@www.example.com"))
+    end
+
+    it 'prefers explicit basic_auth credentials' do
+      uri = URI("https://ignored_user:ignored_pass@www.example.com")
+
+      stub_request(:get, "https://www.example.com").with(basic_auth: credentials)
+
+      client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
     end
   end
 
@@ -351,14 +545,45 @@ describe Puppet::HTTP::Client do
       stub_request(:put, start_url).to_return(redirect_to(url: bar_url))
       stub_request(:put, bar_url).to_return(status: 200)
 
-      response = client.put(start_url, body: "", content_type: 'text/plain')
+      response = client.put(start_url, "", headers: {'Content-Type' => 'text/plain'})
+      expect(response).to be_success
+    end
+
+    it "updates the Host header from the Location host and port" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: other_host))
+      stub_request(:get, other_host).with(headers: { 'Host' => 'other.example.com:8140' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
+      expect(response).to be_success
+    end
+
+    it "omits the default HTTPS port from the Host header" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: "https://other.example.com/qux"))
+      stub_request(:get, "https://other.example.com/qux").with(headers: { 'Host' => 'other.example.com' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
+      expect(response).to be_success
+    end
+
+    it "omits the default HTTP port from the Host header" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: "http://other.example.com/qux"))
+      stub_request(:get, "http://other.example.com/qux").with(headers: { 'Host' => 'other.example.com' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
       expect(response).to be_success
     end
 
-    it "preserves query parameters" do
-      query = { 'debug' => true }
-      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: bar_url))
-      stub_request(:get, bar_url).with(query: query).to_return(status: 200)
+    it "applies query parameters from the location header" do
+      query = { 'redirected' => false }
+
+      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: "#{bar_url}?redirected=true"))
+      stub_request(:get, bar_url).with(query: {'redirected' => 'true'}).to_return(status: 200)
 
       response = client.get(start_url, params: query)
       expect(response).to be_success
@@ -377,7 +602,7 @@ describe Puppet::HTTP::Client do
       stub_request(:get, start_url).with(basic_auth: credentials).to_return(redirect_to(url: bar_url))
       stub_request(:get, bar_url).with(basic_auth: credentials).to_return(status: 200)
 
-      client.get(start_url, user: 'user', password: 'pass')
+      client.get(start_url, options: {basic_auth: {user: 'user', password: 'pass'}})
     end
 
     it "redirects given a relative location" do
@@ -389,22 +614,33 @@ describe Puppet::HTTP::Client do
       expect(response).to be_success
     end
 
-    it "preserves query parameters given a relative location" do
+    it "applies query parameters from the location header" do
       relative_url = "/people.html"
-      query = { 'debug' => true }
-      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: relative_url))
-      stub_request(:get, "https://www.example.com:8140/people.html").with(query: query).to_return(status: 200)
+      query = { 'redirected' => false }
+      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: "#{relative_url}?redirected=true"))
+      stub_request(:get, "https://www.example.com:8140/people.html").with(query: {'redirected' => 'true'}).to_return(status: 200)
 
       response = client.get(start_url, params: query)
       expect(response).to be_success
     end
 
+    it "removes dot segments from a relative location" do
+      # from https://tools.ietf.org/html/rfc3986#section-5.4.2
+      base_url = URI("http://a/b/c/d;p?q")
+      relative_url = "../../../../g"
+      stub_request(:get, base_url).to_return(redirect_to(url: relative_url))
+      stub_request(:get, "http://a/g").to_return(status: 200)
+
+      response = client.get(base_url)
+      expect(response).to be_success
+    end
+
     it "preserves request body for each request" do
       data = 'some data'
       stub_request(:put, start_url).with(body: data).to_return(redirect_to(url: bar_url))
       stub_request(:put, bar_url).with(body: data).to_return(status: 200)
 
-      response = client.put(start_url, body: data, content_type: 'text/plain')
+      response = client.put(start_url, data, headers: {'Content-Type' => 'text/plain'})
       expect(response).to be_success
     end
 
@@ -533,6 +769,32 @@ describe Puppet::HTTP::Client do
       }.to raise_error(Puppet::HTTP::ProtocolError, /Failed to parse Retry-After header 'foo' as an integer or RFC 2822 date/)
     end
 
+    it "should close the connection before sleeping" do
+      retry_after('42')
+
+      site = Puppet::Network::HTTP::Site.from_uri(uri)
+
+      http1 = Net::HTTP.new(site.host, site.port)
+      http1.use_ssl = true
+      allow(http1).to receive(:started?).and_return(true)
+
+      http2 = Net::HTTP.new(site.host, site.port)
+      http2.use_ssl = true
+      allow(http2).to receive(:started?).and_return(true)
+
+
+      pool = Puppet::Network::HTTP::Pool.new(15)
+      client = Puppet::HTTP::Client.new(pool: pool)
+
+      # The "with_connection" method is required to yield started connections
+      allow(pool).to receive(:with_connection).and_yield(http1).and_yield(http2)
+
+      expect(http1).to receive(:finish).ordered
+      expect(::Kernel).to receive(:sleep).with(42).ordered
+
+      client.get(uri)
+    end
+
     it "should sleep and retry if Retry-After is an Integer" do
       retry_after('42')
 
@@ -569,4 +831,34 @@ describe Puppet::HTTP::Client do
       client.get(uri)
     end
   end
+
+  context "persistent connections" do
+    before :each do
+      stub_request(:get, uri)
+    end
+
+    it 'defaults keepalive to http_keepalive_timeout' do
+      expect(client.pool.keepalive_timeout).to eq(Puppet[:http_keepalive_timeout])
+    end
+
+    it 'reuses a cached connection' do
+      allow(Puppet).to receive(:debug)
+      expect(Puppet).to receive(:debug).with(/^Creating new connection/)
+      expect(Puppet).to receive(:debug).with(/^Using cached connection/)
+
+      client.get(uri)
+      client.get(uri)
+    end
+
+    it 'can be disabled' do
+      Puppet[:http_keepalive_timeout] = 0
+
+      allow(Puppet).to receive(:debug)
+      expect(Puppet).to receive(:debug).with(/^Creating new connection/).twice
+      expect(Puppet).to receive(:debug).with(/^Using cached connection/).never
+
+      client.get(uri)
+      client.get(uri)
+    end
+  end
 end