puppet 6.12.0-x64-mingw32 → 6.17.0-x64-mingw32

data/spec/unit/ssl/state_machine_spec.rb

@@ -197,7 +197,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   end
 
   context 'when locking' do
-    let(:lockfile) { double('ssllockfile') }
+    let(:lockfile) { Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile]) }
     let(:machine) { described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider, lockfile: lockfile) }
 
     # lockfile is deleted before `ensure_ca_certificates` returns, so
@@ -210,7 +210,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it 'locks the file prior to running the state machine and unlocks when done' do
-      expect(lockfile).to receive(:lock).and_return(true).ordered
+      expect(lockfile).to receive(:lock).and_call_original.ordered
       expect(cert_provider).to receive(:load_cacerts).and_return(cacerts).ordered
       expect(cert_provider).to receive(:load_crls).and_return(crls).ordered
       expect(lockfile).to receive(:unlock).ordered
@@ -228,13 +228,6 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       expect(File).to_not be_exist(Puppet[:ssl_lockfile])
     end
 
-    it 'raises an exception when locking fails' do
-      allow(lockfile).to receive(:lock).and_return(false)
-      expect {
-        machine.ensure_ca_certificates
-      }.to raise_error(Puppet::Error, /Another puppet instance is already running; exiting/)
-    end
-
     it 'acquires an empty lockfile' do
       Puppet::FileSystem.touch(Puppet[:ssl_lockfile])
 
@@ -262,6 +255,57 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider)
       machine.ensure_ca_certificates
     end
+
+    context 'and another puppet process is running' do
+      let(:now) { Time.now }
+      let(:future) { now + (5 * 60)} # 5 mins in the future
+
+      before :each do
+        allow(lockfile).to receive(:lock).and_return(false)
+      end
+
+      it 'raises a puppet exception' do
+        expect {
+          machine.ensure_ca_certificates
+        }.to raise_error(Puppet::Error, /Another puppet instance is already running and the waitforlock setting is set to 0; exiting/)
+      end
+
+      it 'sleeps and retries successfully' do
+        machine = described_class.new(lockfile: lockfile, cert_provider: cert_provider, waitforlock: 1, maxwaitforlock: 10)
+        allow(cert_provider).to receive(:load_cacerts).and_return(cacerts)
+        allow(cert_provider).to receive(:load_crls).and_return(crls)
+        allow(Time).to receive(:now).and_return(now, future)
+
+        expect(Kernel).to receive(:sleep).with(1)
+        expect(Puppet).to receive(:info).with("Another puppet instance is already running; waiting for it to finish")
+        expect(Puppet).to receive(:info).with("Will try again in 1 seconds.")
+
+        allow(lockfile).to receive(:lock).and_return(false, true)
+
+        expect(machine.ensure_ca_certificates).to be_an_instance_of(Puppet::SSL::SSLContext)
+      end
+
+      it 'sleeps and retries unsuccessfully until the deadline is exceeded' do
+        machine = described_class.new(lockfile: lockfile, waitforlock: 1, maxwaitforlock: 10)
+        allow(Time).to receive(:now).and_return(now, future)
+
+        expect(Kernel).to receive(:sleep).with(1)
+        expect(Puppet).to receive(:info).with("Another puppet instance is already running; waiting for it to finish")
+        expect(Puppet).to receive(:info).with("Will try again in 1 seconds.")
+
+        allow(lockfile).to receive(:lock).and_return(false)
+        expect {
+          machine.ensure_ca_certificates
+        }.to raise_error(Puppet::Error, /Another puppet instance is already running and the maxwaitforlock timeout has been exceeded; exiting/)
+      end
+
+      it 'defaults the waitlock deadline to 60 seconds' do
+        allow(Time).to receive(:now).and_return(now)
+
+        machine = described_class.new
+        expect(machine.waitlock_deadline).to eq(now.to_i + 60)
+      end
+    end
   end
 
   context 'NeedCACerts' do
@@ -837,7 +881,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         }.to output(/Exiting now because the waitforcert setting is set to 0./).to_stdout
       end
 
-      it 'sleeps and transitions to NeedCACerts' do
+      it 'sleeps and transitions to NeedLock' do
         machine = described_class.new(waitforcert: 15)
 
         state = Puppet::SSL::StateMachine::Wait.new(machine)
@@ -845,10 +889,10 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         expect(Puppet).to receive(:info).with(/Will try again in 15 seconds./)
 
-        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedLock)
       end
 
-      it 'sleeps and transitions to NeedCACerts when maxwaitforcert is set' do
+      it 'sleeps and transitions to NeedLock when maxwaitforcert is set' do
         machine = described_class.new(waitforcert: 15, maxwaitforcert: 30)
 
         state = Puppet::SSL::StateMachine::Wait.new(machine)
@@ -856,7 +900,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         expect(Puppet).to receive(:info).with(/Will try again in 15 seconds./)
 
-        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedLock)
       end
 
       it 'waits indefinitely by default' do
@@ -877,6 +921,48 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
           }.to exit_with(1)
         }.to output(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(.*\). Exiting now because the maxwaitforcert timeout has been exceeded./).to_stdout
       end
+
+      it 'closes the pool before sleeping' do
+        machine = described_class.new(waitforcert: 15)
+
+        state = Puppet::SSL::StateMachine::Wait.new(machine)
+        expect(Puppet.runtime[:http].pool).to receive(:close).and_call_original
+        expect(Kernel).to receive(:sleep).with(15).ordered
+
+        state.next_state
+      end
+
+      it 'releases the lock while sleeping' do
+        lockfile = Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile])
+        machine = described_class.new(lockfile: lockfile)
+        state = Puppet::SSL::StateMachine::Wait.new(machine)
+
+        # pidlock should be unlocked while sleeping
+        allow(Kernel).to receive(:sleep) do
+          expect(lockfile).to_not be_locked
+        end
+
+        # lock before running the state
+        lockfile.lock
+        state.next_state
+      end
+    end
+
+    context 'in state NeedLock' do
+      let(:ssl_context) { Puppet::SSL::SSLContext.new(cacerts: []) }
+      let(:lockfile) { Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile]) }
+      let(:machine) { described_class.new(lockfile: lockfile) }
+      let(:state) { Puppet::SSL::StateMachine::NeedLock.new(machine) }
+
+      it 'acquires the lock and transitions to NeedCACerts' do
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(lockfile).to be_locked
+      end
+
+      it 'transitions to LockFailure if it fails to acquire the lock' do
+        expect(lockfile).to receive(:lock).and_return(false)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::LockFailure)
+      end
     end
   end
 end

data/spec/unit/test/test_helper_spec.rb

@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe "TestHelper" do
+  context "#after_each_test" do
+    it "restores the original environment" do
+      varname = 'test_helper_spec-test_variable'
+      Puppet::Util.set_env(varname, "\u16A0")
+
+      expect(Puppet::Util.get_env(varname)).to eq("\u16A0")
+
+      # Prematurely trigger the after_each_test method
+      Puppet::Test::TestHelper.after_each_test
+
+      expect(Puppet::Util::get_env(varname)).to be_nil
+    end
+  end
+end

data/spec/unit/transaction/persistence_spec.rb

@@ -146,16 +146,7 @@ describe Puppet::Transaction::Persistence do
       Dir.mkdir(Puppet[:transactionstorefile])
       persistence = Puppet::Transaction::Persistence.new
 
-      if Puppet::Util::Platform.windows?
-        expect do
-          persistence.save
-        end.to raise_error do |error|
-          expect(error).to be_a(Puppet::Util::Windows::Error)
-          expect(error.code).to eq(5) # ERROR_ACCESS_DENIED
-        end
-      else
-        expect { persistence.save }.to raise_error(Errno::EISDIR, /Is a directory/)
-      end
+      expect { persistence.save }.to raise_error(Errno::EISDIR, /Is a directory/)
 
       Dir.rmdir(Puppet[:transactionstorefile])
     end

data/spec/unit/transaction/report_spec.rb

@@ -39,6 +39,10 @@ describe Puppet::Transaction::Report do
     expect(Puppet::Transaction::Report.new('cv', 'env', 'tid', 'some job id').job_id).to eq('some job id')
   end
 
+  it "should take a 'start_time' as an argument" do
+    expect(Puppet::Transaction::Report.new('cv', 'env', 'tid', 'some job id', 'my start time').time).to eq('my start time')
+  end
+
   it "should be able to set configuration_version" do
     report = Puppet::Transaction::Report.new
     report.configuration_version = "some version"
@@ -659,7 +663,7 @@ Version:
       :status => stringifier.convert('success'),
     }
 
-    event = Puppet::Transaction::Event.new(event_hash)
+    event = Puppet::Transaction::Event.new(**event_hash)
 
     status = Puppet::Resource::Status.new(Puppet::Type.type(:notify).new(:title => "a resource"))
     status.changed = true

data/spec/unit/transaction_spec.rb

@@ -3,8 +3,6 @@ require 'matchers/include_in_order'
 require 'puppet_spec/compiler'
 
 require 'puppet/transaction'
-require 'puppet/type/exec'
-require 'puppet/type/notify'
 require 'fileutils'
 
 describe Puppet::Transaction do

data/spec/unit/type/file/ensure_spec.rb

@@ -1,7 +1,6 @@
 require 'spec_helper'
-require 'puppet/type/file/ensure'
 
-describe Puppet::Type::File::Ensure do
+describe Puppet::Type.type(:file).attrclass(:ensure) do
   include PuppetSpec::Files
 
   let(:path) { tmpfile('file_ensure') }

data/spec/unit/type/file/source_spec.rb

@@ -22,8 +22,8 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
     @foobar = make_absolute("/foo/bar baz")
     @feebooz = make_absolute("/fee/booz baz")
 
-    @foobar_uri  = URI.unescape(Puppet::Util.path_to_uri(@foobar).to_s)
-    @feebooz_uri = URI.unescape(Puppet::Util.path_to_uri(@feebooz).to_s)
+    @foobar_uri  = Puppet::Util.uri_unescape(Puppet::Util.path_to_uri(@foobar).to_s)
+    @feebooz_uri = Puppet::Util.uri_unescape(Puppet::Util.path_to_uri(@feebooz).to_s)
   end
 
   it "should be a subclass of Parameter" do
@@ -82,7 +82,7 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
   describe "#munge" do
     it "should prefix file scheme to absolute paths" do
       resource[:source] = filename
-      expect(resource[:source]).to eq([URI.unescape(Puppet::Util.path_to_uri(filename).to_s)])
+      expect(resource[:source]).to eq([Puppet::Util.uri_unescape(Puppet::Util.path_to_uri(filename).to_s)])
     end
 
     %w[file puppet].each do |scheme|
@@ -533,20 +533,54 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
   describe "when writing" do
     describe "as puppet apply" do
       let(:source_content) { "source file content\r\n"*10 }
+      let(:modulepath) { File.join(Puppet[:environmentpath], 'testing', 'modules') }
+      let(:env) { Puppet::Node::Environment.create(:testing, [modulepath]) }
+      let(:catalog) { Puppet::Resource::Catalog.new(:test, env) }
+
       before do
         Puppet[:default_file_terminus] = "file_server"
-        resource[:source] = file_containing('apply', source_content)
       end
 
       it "should copy content from the source to the file" do
+        resource = Puppet::Type.type(:file).new(path: filename, catalog: catalog, source: file_containing('apply', source_content))
         source = resource.parameter(:source)
         resource.write(source)
 
         expect(Puppet::FileSystem.binread(filename)).to eq(source_content)
       end
 
+      it 'should use the in-process fileserver if source starts with puppet:///' do
+        path = File.join(modulepath, 'mymodule', 'files', 'path')
+        Puppet::FileSystem.dir_mkpath(path)
+        File.open(path, 'wb') { |f| f.write(source_content) }
+        resource = Puppet::Type.type(:file).new(path: filename, catalog: catalog, source: 'puppet:///modules/mymodule/path')
+
+        source = resource.parameter(:source)
+        resource.write(source)
+
+        expect(Puppet::FileSystem.binread(filename)).to eq(source_content)
+      end
+
+      it 'follows symlinks when retrieving content from the in-process fileserver' do
+        # create a 'link' that points to 'target' in the 'mymodule' module
+        link = File.join(modulepath, 'mymodule', 'files', 'link')
+        target = File.join(modulepath, 'mymodule', 'files', 'target')
+        Puppet::FileSystem.dir_mkpath(target)
+        File.open(target, 'wb') { |f| f.write(source_content) }
+        Puppet::FileSystem.symlink(target, link)
+        resource = Puppet::Type.type(:file).new(path: filename, catalog: catalog, source: 'puppet:///modules/mymodule/link')
+
+        source = resource.parameter(:source)
+        resource.write(source)
+
+        # 'filename' should be a file containing the contents of the followed link
+        expect(Puppet::FileSystem.binread(filename)).to eq(source_content)
+      end
+
       with_digest_algorithms do
         it "should return the checksum computed" do
+          resource = Puppet::Type.type(:file).new(path: filename, catalog: catalog, source: file_containing('apply', source_content))
+
           File.open(filename, 'wb') do |file|
             source = resource.parameter(:source)
             resource[:checksum] = digest_algorithm
@@ -583,53 +617,73 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
 
     describe 'from remote source' do
       let(:source_content) { "source file content\n"*10 }
-      let(:source) { resource.newattr(:source) }
-      let(:response) { double('response', :[] => nil, :body => nil, :message => nil) }
-      let(:conn) { double('connection') }
+      let(:source) {
+        attr = resource.newattr(:source)
+        attr.metadata = metadata
+        attr
+      }
+      let(:metadata) {
+        Puppet::FileServing::Metadata.new(
+          '/modules/:module/foo',
+          {
+            'type' => 'file',
+            'source' => 'puppet:///modules/:module/foo'
+          }
+        )
+      }
 
       before do
         resource[:backup] = false
-
-        expectation = receive(:read_body)
-        source_content.lines.each { |line| expectation = expectation.and_yield(line) }
-        allow(response).to expectation
-        allow(conn).to receive(:request_get).and_yield(response)
       end
 
       it 'should use an explicit fileserver if source starts with puppet://' do
-        allow(response).to receive(:code).and_return('200')
-        allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet://somehostname/test/foo', :ftype => 'file', :content_uri => nil))
-        expect(Puppet::Network::HttpPool).to receive(:connection).with('somehostname', 8140, anything).and_return(conn)
+        metadata.source = "puppet://somehostname:8140/modules/:module/foo"
+
+        stub_request(:get, %r{https://somehostname:8140/puppet/v3/file_content/modules/:module/foo})
+          .to_return(status: 200, body: metadata.to_json, headers: { 'Content-Type' => 'application/json' })
 
         resource.write(source)
       end
 
       it 'should use the default fileserver if source starts with puppet:///' do
-        allow(response).to receive(:code).and_return('200')
-        allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet:///test/foo', :ftype => 'file', :content_uri => nil))
-        expect(Puppet::Network::HttpPool).to receive(:connection).with(Puppet[:server], 8140, anything).and_return(conn)
+        stub_request(:get, %r{https://#{Puppet[:server]}:8140/puppet/v3/file_content/modules/:module/foo})
+          .to_return(status: 200, body: metadata.to_json, headers: { 'Content-Type' => 'application/json' })
 
         resource.write(source)
       end
 
       it 'should percent encode reserved characters' do
-        allow(response).to receive(:code).and_return('200')
-        allow(Puppet::Network::HttpPool).to receive(:connection).and_return(conn)
-        allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet:///test/foo bar', :ftype => 'file', :content_uri => nil))
+        metadata.source = 'puppet:///modules/:module/foo bar'
 
-        expect(conn).to receive(:request_get).with("#{Puppet::Network::HTTP::MASTER_URL_PREFIX}/v3/file_content/test/foo%20bar?environment=myenv&", anything).and_yield(response)
+        stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo%20bar})
+          .to_return(status: 200, body: metadata.to_json, headers: { 'Content-Type' => 'application/json' })
 
         resource.write(source)
       end
 
       it 'should request binary content' do
-        allow(response).to receive(:code).and_return('200')
-        allow(Puppet::Network::HttpPool).to receive(:connection).and_return(conn)
-        allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet:///test/foo bar', :ftype => 'file', :content_uri => nil))
+        stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo}) do |request|
+          expect(request.headers).to include({'Accept' => 'application/octet-stream'})
+        end.to_return(status: 200, body: '', headers: { 'Content-Type' => 'application/octet-stream' })
 
-        expect(conn).to receive(:request_get) do |_, options|
-          expect(options).to include('Accept' => 'application/octet-stream')
-        end.and_yield(response)
+        resource.write(source)
+      end
+
+      it "should request file content from the catalog's environment" do
+        Puppet[:environment] = 'doesntexist'
+
+        stub_request(:get, %r{/puppet/v3/file_content})
+          .with(query: hash_including("environment" => "myenv"))
+          .to_return(status: 200, body: '', headers: { 'Content-Type' => 'application/octet-stream' })
+
+        resource.write(source)
+      end
+
+      it 'should request static file content' do
+        metadata.content_uri = "puppet://#{Puppet[:server]}:8140/path/to/file"
+
+        stub_request(:get, %r{/puppet/v3/static_file_content/path/to/file})
+          .to_return(status: 200, body: '', headers: { 'Content-Type' => 'application/octet-stream' })
 
         resource.write(source)
       end
@@ -639,26 +693,23 @@ describe Puppet::Type.type(:file).attrclass(:source), :uses_checksums => true do
           File.open(filename, 'w') {|f| f.write "initial file content"}
         end
 
-        before(:each) do
-          allow(Puppet::Network::HttpPool).to receive(:connection).and_return(conn)
-          allow(source).to receive(:metadata).and_return(double('metadata', :source => 'puppet:///test/foo', :ftype => 'file', :content_uri => nil))
-        end
-
         it 'should not write anything if source is not found' do
-          allow(response).to receive(:code).and_return('404')
+          stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo}).to_return(status: 404)
 
-          expect { resource.write(source) }.to raise_error(Net::HTTPError, /404/)
+          expect { resource.write(source) }.to raise_error(Net::HTTPError, /Error 404 on SERVER:/)
           expect(File.read(filename)).to eq('initial file content')
         end
 
         it 'should raise an HTTP error in case of server error' do
-          allow(response).to receive(:code).and_return('500')
+          stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo}).to_return(status: 500)
 
-          expect { resource.write(source) }.to raise_error(Net::HTTPError, /500/)
+          expect { resource.write(source) }.to raise_error(Net::HTTPError, /Error 500 on SERVER/)
         end
 
         context 'and the request was successful' do
-          before(:each) { allow(response).to receive(:code).and_return('200') }
+          before do
+            stub_request(:get, %r{/puppet/v3/file_content/modules/:module/foo}).to_return(status: 200, body: source_content)
+          end
 
           it 'should write the contents to the file' do
             resource.write(source)

data/spec/unit/type/file_spec.rb

@@ -3,6 +3,34 @@ require 'spec_helper'
 describe Puppet::Type.type(:file) do
   include PuppetSpec::Files
 
+  # precomputed checksum values for FILE_CONTENT
+  FILE_CONTENT = 'file content'.freeze
+  CHECKSUM_VALUES = {
+    md5: 'd10b4c3ff123b26dc068d43a8bef2d23',
+    md5lite: 'd10b4c3ff123b26dc068d43a8bef2d23',
+    sha256: 'e0ac3601005dfa1864f5392aabaf7d898b1b5bab854f1acb4491bcd806b76b0c',
+    sha256lite: 'e0ac3601005dfa1864f5392aabaf7d898b1b5bab854f1acb4491bcd806b76b0c',
+    sha1: '87758871f598e1a3b4679953589ae2f57a0bb43c',
+    sha1lite: '87758871f598e1a3b4679953589ae2f57a0bb43c',
+    sha224: '2aefaaa5f4d8f17f82f3e1bb407e190cede9aa1311fa4533ce505531',
+    sha384: '61c7783501ebd90233650357fefbe5a141b7618f907b8f043bbaa92c0f610c785a641ddd479fa81d650cd86e29aa6858',
+    sha512: '2fb1877301854ac92dd518018f97407a0a88bb696bfef0a51e9efbd39917353500009e15bd72c3f0e4bf690115870bfab926565d5ad97269d922dbbb41261221',
+    mtime: 'Jan 26 13:59:49 2016',
+    ctime: 'Jan 26 13:59:49 2016'
+  }.freeze
+
+  INVALID_CHECKSUM_VALUES = {
+    md5: '00000000000000000000000000000000',
+    md5lite: '00000000000000000000000000000000',
+    sha256: '0000000000000000000000000000000000000000000000000000000000000000',
+    sha256lite: '0000000000000000000000000000000000000000000000000000000000000000',
+    sha1: '0000000000000000000000000000000000000000',
+    sha1lite: '0000000000000000000000000000000000000000',
+    sha224: '00000000000000000000000000000000000000000000000000000000',
+    sha384: '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',
+    sha512: '00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
+  }.freeze
+
   let(:path) { tmpfile('file_testing') }
   let(:file) { described_class.new(:path => path, :catalog => catalog) }
   let(:provider) { file.provider }
@@ -791,7 +819,7 @@ describe Puppet::Type.type(:file) do
       let(:sources) do
         h = {}
         %w{/a /b /c /d}.each do |key|
-          h[key] = URI.unescape(Puppet::Util.path_to_uri(File.expand_path(key)).to_s)
+          h[key] = Puppet::Util.uri_unescape(Puppet::Util.path_to_uri(File.expand_path(key)).to_s)
         end
         h
       end
@@ -1108,38 +1136,6 @@ describe Puppet::Type.type(:file) do
   end
 
   describe "#write" do
-    describe "when validating the checksum" do
-      before { allow(file).to receive(:validate_checksum?).and_return(true) }
-
-      it "should fail if the checksum parameter and content checksums do not match" do
-        checksum = double('checksum_parameter',  :sum => 'checksum_b', :sum_file => 'checksum_b')
-        allow(file).to receive(:parameter).with(:checksum).and_return(checksum)
-        allow(file).to receive(:parameter).with(:source).and_return(nil)
-
-
-        property = double('content_property', :actual_content => "something", :length => "something".length, :write => 'checksum_a')
-        allow(file).to receive(:property).with(:content).and_return(property)
-
-        expect { file.write property }.to raise_error(Puppet::Error) end
-    end
-
-    describe "when not validating the checksum" do
-      before do
-        allow(file).to receive(:validate_checksum?).and_return(false)
-      end
-
-      it "should not fail if the checksum property and content checksums do not match" do
-        checksum = double('checksum_parameter',  :sum => 'checksum_b')
-        allow(file).to receive(:parameter).with(:checksum).and_return(checksum)
-        allow(file).to receive(:parameter).with(:source).and_return(nil)
-
-        property = double('content_property', :actual_content => "something", :length => "something".length, :write => 'checksum_a')
-        allow(file).to receive(:property).with(:content).and_return(property)
-
-        expect { file.write property }.to_not raise_error
-      end
-    end
-
     describe "when resource mode is supplied" do
       before do
         allow(file).to receive(:property_fix)
@@ -1191,7 +1187,7 @@ describe Puppet::Type.type(:file) do
     describe "when resource mode is not supplied" do
       context "and content is supplied" do
         it "should default to 0644 mode" do
-          file = described_class.new(:path => path, :content => "file content")
+          file = described_class.new(:path => path, :content => FILE_CONTENT)
 
           file.write file.parameter(:content)
 
@@ -1214,35 +1210,6 @@ describe Puppet::Type.type(:file) do
     end
   end
 
-  describe "#fail_if_checksum_is_wrong" do
-    it "should fail if the checksum of the file doesn't match the expected one" do
-      expect do
-        allow(file.parameter(:checksum)).to receive(:sum_file).and_return('wrong!!')
-        file.instance_eval do
-          fail_if_checksum_is_wrong(self[:path], 'anything!')
-        end
-      end.to raise_error(Puppet::Error, /File written to disk did not match checksum/)
-    end
-
-    it "should not fail if the checksum is correct" do
-      expect do
-        allow(file.parameter(:checksum)).to receive(:sum_file).and_return('anything!')
-        file.instance_eval do
-          fail_if_checksum_is_wrong(self[:path], 'anything!')
-        end
-      end.not_to raise_error
-    end
-
-    it "should not fail if the checksum is absent" do
-      expect do
-        allow(file.parameter(:checksum)).to receive(:sum_file).and_return(nil)
-        file.instance_eval do
-          fail_if_checksum_is_wrong(self[:path], 'anything!')
-        end
-      end.not_to raise_error
-    end
-  end
-
   describe "#write_temporary_file?" do
     it "should be true if the file has specified content" do
       file[:content] = 'some content'
@@ -1462,7 +1429,7 @@ describe Puppet::Type.type(:file) do
       expect(Puppet::FileServing::Metadata.indirection).to receive(:find).with(source, anything).and_return(metadata)
 
       uri = file.parameters[:source].uri
-      expect(URI.unescape(uri.path)).to eq(filename)
+      expect(Puppet::Util.uri_unescape(uri.path)).to eq(filename)
       expect(uri.path.encoding).to eq(Encoding::UTF_8)
     end
 
@@ -1486,29 +1453,16 @@ describe Puppet::Type.type(:file) do
       expect_any_instance_of(Puppet::Indirector::FileMetadata::Rest).to receive(:find).with(request_key(filename[1..-1])).and_return(metadata)
 
       uri = file.parameters[:source].uri
-      expect(URI.unescape(uri.path)).to eq(filename)
+      expect(Puppet::Util.uri_unescape(uri.path)).to eq(filename)
       expect(uri.path.encoding).to eq(Encoding::UTF_8)
     end
   end
 
   describe "when using source" do
+    let(:source) { tmpfile('file_source') }
+
     before do
-      file[:source] = File.expand_path('/one')
-      # Contents of an empty file generate the below hash values
-      # in case you need to add support for additional algorithms in future
-      @checksum_values = {
-        :md5 => 'd41d8cd98f00b204e9800998ecf8427e',
-        :md5lite => 'd41d8cd98f00b204e9800998ecf8427e',
-        :sha256 => 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-        :sha256lite => 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-        :sha1 => 'da39a3ee5e6b4b0d3255bfef95601890afd80709',
-        :sha1lite => 'da39a3ee5e6b4b0d3255bfef95601890afd80709',
-        :sha224 => 'd14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f',
-        :sha384 => '38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b',
-        :sha512 => 'cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e',
-        :mtime => 'Jan 26 13:59:49 2016',
-        :ctime => 'Jan 26 13:59:49 2016'
-      }
+      file[:source] = source
     end
 
     Puppet::Type::File::ParameterChecksum.value_collection.values.reject {|v| v == :none}.each do |checksum_type|
@@ -1527,9 +1481,51 @@ describe Puppet::Type.type(:file) do
         end
 
         it 'should validate a valid checksum_value' do
-          file[:checksum_value] = @checksum_values[checksum_type]
+          file[:checksum_value] = CHECKSUM_VALUES[checksum_type]
           expect { file.validate }.to_not raise_error
         end
+
+        it 'fails if the checksum_value parameter and written file do not match' do
+          skip if checksum_type =~ /^(ctime|mtime)/
+
+          File.write(source, FILE_CONTENT)
+          file[:checksum_value] = INVALID_CHECKSUM_VALUES[checksum_type]
+
+          expect {
+            file.property(:checksum_value).sync
+          }.to raise_error(Puppet::Error, /File written to disk did not match desired checksum/)
+
+          expect(Puppet::FileSystem).to_not be_exist(file[:path])
+        end
+
+        it 'fails if the checksum_value parameter does not match, but the metadata does' do
+          skip if checksum_type =~ /^(ctime|mtime)/
+
+          File.write(source, FILE_CONTENT)
+          file[:checksum_value] = INVALID_CHECKSUM_VALUES[checksum_type]
+          allow(file.parameter(:source).metadata).to receive(:checksum).and_return(file[:checksum_value])
+
+          expect {
+            file.property(:checksum_value).sync
+          }.to raise_error(Puppet::Error, /File written to disk did not match desired checksum/)
+
+          expect(Puppet::FileSystem).to_not be_exist(file[:path])
+        end
+
+        it 'replaces a file from a source when the checksum matches' do
+          File.write(source, FILE_CONTENT)
+          file[:checksum_value] = CHECKSUM_VALUES[checksum_type]
+
+          file.property(:checksum_value).sync
+          checksum = file.parameter(:checksum).sum_file(file[:path])
+
+          if checksum_type =~ /^(ctime|mtime)/
+            # file on disk ctime/mtime will be later than expected time
+            expect(checksum).to match(/{#{checksum_type}}/)
+          else
+            expect(checksum).to eq("{#{checksum_type}}#{file[:checksum_value]}")
+          end
+        end
       end
     end
 
@@ -1591,19 +1587,8 @@ describe Puppet::Type.type(:file) do
   end
 
   describe "when using content" do
-    before do
-      file[:content] = 'file contents'
-      @checksum_values = {
-        :md5 => 'd41d8cd98f00b204e9800998ecf8427e',
-        :md5lite => 'd41d8cd98f00b204e9800998ecf8427e',
-        :sha256 => 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-        :sha256lite => 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-        :sha1 => 'da39a3ee5e6b4b0d3255bfef95601890afd80709',
-        :sha1lite => 'da39a3ee5e6b4b0d3255bfef95601890afd80709',
-        :sha224 => 'd14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f',
-        :sha384 => '38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b',
-        :sha512 => 'cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e',
-      }
+    before :each do
+      file[:content] = FILE_CONTENT
     end
 
     (Puppet::Type::File::ParameterChecksum.value_collection.values - SOURCE_ONLY_CHECKSUMS).each do |checksum_type|
@@ -1622,9 +1607,43 @@ describe Puppet::Type.type(:file) do
         end
 
         it 'should validate a valid checksum_value' do
-          file[:checksum_value] = @checksum_values[checksum_type]
+          file[:checksum_value] = CHECKSUM_VALUES[checksum_type]
           expect { file.validate }.to_not raise_error
         end
+
+        it 'fails if the checksum_value parameter and written file do not match' do
+          file[:checksum_value] = INVALID_CHECKSUM_VALUES[checksum_type]
+
+          expect {
+            file.property(:content).sync
+          }.to raise_error(Puppet::Error, /File written to disk did not match desired checksum/)
+
+          expect(Puppet::FileSystem).to_not be_exist(file[:path])
+        end
+
+        it 'fails if the calculated checksum for the content and written file do not match' do
+          allow(file.parameter(:checksum)).to receive(:sum).and_return(INVALID_CHECKSUM_VALUES[checksum_type])
+
+          expect {
+            file.property(:content).sync
+          }.to raise_error(Puppet::Error, /File written to disk did not match desired checksum/)
+
+          expect(Puppet::FileSystem).to_not be_exist(file[:path])
+        end
+
+        it 'replaces a file from content when the checksum matches' do
+          file[:checksum_value] = CHECKSUM_VALUES[checksum_type]
+
+          file.property(:content).sync
+          checksum = file.parameter(:checksum).sum_file(file[:path])
+
+          if checksum_type =~ /^(ctime|mtime)/
+            # file on disk ctime/mtime will be later than expected time
+            expect(checksum).to match(/{#{checksum_type}}/)
+          else
+            expect(checksum).to eq("{#{checksum_type}}#{file[:checksum_value]}")
+          end
+        end
       end
     end
 
@@ -1657,6 +1676,13 @@ describe Puppet::Type.type(:file) do
       file[:checksum_value] = ''
       expect { file.validate }.to_not raise_error
     end
+
+    it 'writes a file' do
+      file[:ensure] = :file
+      file.property(:ensure).sync
+
+      expect(file.parameter(:checksum).sum_file(file[:path])).to eq('{none}')
+    end
   end
 
   describe "when auditing" do