puppet 6.13.0 → 6.18.0

data/spec/integration/application/plugin_spec.rb

@@ -0,0 +1,123 @@
+require 'spec_helper'
+require 'puppet/face'
+require 'puppet_spec/puppetserver'
+
+describe "puppet plugin" do
+  include_context "https client"
+
+  let(:server) { PuppetSpec::Puppetserver.new }
+  let(:plugin) { Puppet::Application[:plugin] }
+  let(:response_body) { "[{\"path\":\"/etc/puppetlabs/code/environments/production/modules\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-03-06 20:14:25 UTC\"},\"type\":\"directory\",\"destination\":null}]" }
+
+  it "downloads from plugins, pluginsfacts and locales mounts" do
+    current_version_handler = -> (req, res) {
+      res['X-Puppet-Version'] = Puppet.version
+      res['Content-Type'] = 'application/json'
+      res.body = response_body
+    }
+
+    server.start_server(mounts: {file_metadatas: current_version_handler}) do |port|
+      Puppet[:masterport] = port
+      expect {
+        plugin.command_line.args << 'download'
+        plugin.run
+      }.to exit_with(0)
+       .and output(matching(
+         "Downloaded these plugins: #{Regexp.escape(Puppet[:pluginfactdest])}, #{Regexp.escape(Puppet[:plugindest])}, #{Regexp.escape(Puppet[:localedest])}"
+       )).to_stdout
+    end
+  end
+
+  it "downloads from plugins and pluginsfacts from older puppetservers" do
+    no_locales_handler = -> (req, res) {
+      res['X-Puppet-Version'] = '5.3.3' # locales mount was added in 5.3.4
+      res['Content-Type'] = 'application/json'
+      res.body = response_body
+    }
+
+    server.start_server(mounts: {file_metadatas: no_locales_handler}) do |port|
+      Puppet[:masterport] = port
+      expect {
+        plugin.command_line.args << 'download'
+        plugin.run
+      }.to exit_with(0)
+       .and output(matching(
+         "Downloaded these plugins: #{Regexp.escape(Puppet[:pluginfactdest])}, #{Regexp.escape(Puppet[:plugindest])}"
+       )).to_stdout
+    end
+  end
+
+  it "downloads from an environment that doesn't exist locally" do
+    requested_environment = nil
+
+    current_version_handler = -> (req, res) {
+      res['X-Puppet-Version'] = Puppet.version
+      res['Content-Type'] = 'application/json'
+      res.body = response_body
+      requested_environment = req.query['environment']
+    }
+
+    server.start_server(mounts: {file_metadatas: current_version_handler}) do |port|
+      Puppet[:environment] = 'doesnotexistontheagent'
+      Puppet[:masterport] = port
+      expect {
+        plugin.command_line.args << 'download'
+        plugin.run
+      }.to exit_with(0)
+       .and output(matching("Downloaded these plugins")).to_stdout
+
+      expect(requested_environment).to eq('doesnotexistontheagent')
+    end
+  end
+
+  context "pluginsync for external facts uses source permissions to preserve fact executable-ness" do
+    before :all do
+      WebMock.enable!
+    end
+
+    after :all do
+      WebMock.disable!
+    end
+
+    before :each do
+      metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":420,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
+      stub_request(:get, %r{/puppet/v3/file_metadatas/(plugins|locales)}).to_return(status: 200, body: metadata, headers: {'Content-Type' => 'application/json'})
+
+      # response retains owner/group/mode due to source_permissions => use
+      facts_metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":500,\"group\":500,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
+      stub_request(:get, %r{/puppet/v3/file_metadatas/pluginfacts}).to_return(status: 200, body: facts_metadata, headers: {'Content-Type' => 'application/json'})
+    end
+
+    it "processes a download request resulting in no changes" do
+      # Create these so there are no changes
+      Puppet::FileSystem.mkpath(Puppet[:plugindest])
+      Puppet::FileSystem.mkpath(Puppet[:localedest])
+
+      # /opt/puppetlabs/puppet/cache/facts.d will be created based on our umask.
+      # If the mode on disk is not 0755, then the mode from the metadata response
+      # (493 => 0755) will be applied, resulting in "plugins were downloaded"
+      # message. Enforce a umask so the results are consistent.
+      Puppet::FileSystem.mkpath(Puppet[:pluginfactdest])
+      Puppet::FileSystem.chmod(0755, Puppet[:pluginfactdest])
+
+      app = Puppet::Application[:plugin]
+      app.command_line.args << 'download'
+      expect {
+        app.run
+      }.to exit_with(0)
+       .and output(/No plugins downloaded/).to_stdout
+    end
+
+    it "updates the facts.d mode", unless: Puppet::Util::Platform.windows? do
+      Puppet::FileSystem.mkpath(Puppet[:pluginfactdest])
+      Puppet::FileSystem.chmod(0775, Puppet[:pluginfactdest])
+
+      app = Puppet::Application[:plugin]
+      app.command_line.args << 'download'
+      expect {
+        app.run
+      }.to exit_with(0)
+       .and output(/Downloaded these plugins: .*facts\.d/).to_stdout
+    end
+  end
+end

data/spec/integration/data_binding_spec.rb

@@ -2,6 +2,7 @@ require 'spec_helper'
 require 'puppet/indirector/hiera'
 
 require 'puppet_spec/compiler'
+require 'puppet/indirector/data_binding/hiera'
 
 describe "Data binding" do
   include PuppetSpec::Files
@@ -140,6 +141,71 @@ describe "Data binding" do
     end
   end
 
+  context "with plan_hierarchy key" do
+    context "using Hiera 5" do
+      let(:hiera_config) { <<~CONF  }
+      ---
+      version: 5
+      plan_hierarchy:
+        - path: global
+          name: Common
+      CONF
+
+      it "ignores plan_hierarchy outside of a Bolt plan" do
+        configure_hiera_for_plan_hierarchy(data, hiera_config)
+
+        create_manifest_in_module("testing", "binding.pp",
+                                  <<-MANIFEST)
+      class testing::binding($value) {}
+        MANIFEST
+
+        expect { compile_to_catalog("include testing::binding") }
+          .to raise_error(/Class\[Testing::Binding\]: expects a value for parameter 'value'/)
+      end
+    end
+
+    context "with invalid data" do
+      let(:hiera_config) { <<~CONF  }
+      ---
+      version: 5
+      plan_hierarchy:
+        - pop: the question
+      CONF
+
+      it "raises a validation error" do
+        configure_hiera_for_plan_hierarchy(data, hiera_config)
+
+        create_manifest_in_module("testing", "binding.pp",
+                                  <<-MANIFEST)
+      class testing::binding($value) {}
+        MANIFEST
+
+        expect { compile_to_catalog("include testing::binding") }
+          .to raise_error(/entry 'plan_hierarchy' index 0 unrecognized key 'pop'/)
+      end
+    end
+
+    context "with Hiera 3" do
+      let(:hiera_config) { <<~CONF  }
+      ---
+      plan_hierarchy: ['global']
+      CONF
+
+      it "errors with plan_hierarchy key" do
+        configure_hiera_for_plan_hierarchy(data, hiera_config)
+
+        create_manifest_in_module("testing", "binding.pp",
+                                  <<-MANIFEST)
+      class testing::binding($value) {}
+        MANIFEST
+
+        expect { compile_to_catalog("include testing::binding") }
+          .to raise_error(/unrecognized key 'plan_hierarchy'/)
+
+      end
+    end
+  end
+
 
   def configure_hiera_for_one_tier(data)
     hiera_config_file = tmpfile("hiera.yaml")
@@ -163,6 +229,22 @@ describe "Data binding" do
     Puppet[:hiera_config] = hiera_config_file
   end
 
+  def configure_hiera_for_plan_hierarchy(data, config)
+    hiera_config_file = tmpfile("hiera.yaml")
+
+    File.open(hiera_config_file, 'w:UTF-8') do |f|
+      f.write(config)
+    end
+
+    data.each do | file, contents |
+      File.open(File.join(dir, "#{file}.yaml"), 'w:UTF-8') do |f|
+        f.write(YAML.dump(contents))
+      end
+    end
+
+    Puppet[:hiera_config] = hiera_config_file
+  end
+
   def configure_hiera_for_two_tier(data)
     hiera_config_file = tmpfile("hiera.yaml")
 

data/spec/integration/defaults_spec.rb

@@ -130,8 +130,7 @@ describe "Puppet defaults" do
       Puppet::Util.withenv( {"PATH" => path }, :windows) do
         Puppet.settings[:path] = "none" # this causes it to ignore the setting
 
-        envhash = Puppet::Util::Windows::Process.get_environment_strings
-        expect(envhash['Path']).to eq(path)
+        expect(Puppet::Util.get_env('Path')).to eq(path)
       end
     end
   end

data/spec/integration/directory_environments_spec.rb

@@ -2,11 +2,7 @@ require 'spec_helper'
 
 describe "directory environments" do
   let(:args) { ['--configprint', 'modulepath', '--environment', 'direnv'] }
-  let(:puppet) do
-    app = Puppet::Application[:apply]
-    allow(app).to receive(:command_line).and_return(double('command_line', :args => []))
-    app
-  end
+  let(:puppet) { Puppet::Application[:apply] }
 
   context "with a single directory environmentpath" do
     before(:each) do
@@ -17,17 +13,19 @@ describe "directory environments" do
 
     it "config prints the environments modulepath" do
       Puppet.settings.initialize_global_settings(args)
-      expect do
-        expect { puppet.run }.to exit_with(0)
-      end.to have_printed('/direnv/modules')
+      expect {
+        puppet.run
+      }.to exit_with(0)
+       .and output(%r{/direnv/modules}).to_stdout
     end
 
     it "config prints the cli --modulepath despite environment" do
       args << '--modulepath' << '/completely/different'
       Puppet.settings.initialize_global_settings(args)
-      expect do
-        expect { puppet.run }.to exit_with(0)
-      end.to have_printed('/completely/different')
+      expect {
+        puppet.run
+      }.to exit_with(0)
+       .and output(%r{/completely/different}).to_stdout
     end
 
     it 'given an 8.3 style path on Windows, will config print an expanded path',
@@ -41,9 +39,10 @@ describe "directory environments" do
       expect(Puppet[:environmentpath]).to match(/~/)
 
       Puppet.settings.initialize_global_settings(args)
-      expect do
-        expect { puppet.run }.to exit_with(0)
-      end.to have_printed(expanded)
+      expect {
+        puppet.run
+      }.to exit_with(0)
+       .and output(a_string_matching(expanded)).to_stdout
     end
   end
 
@@ -59,9 +58,10 @@ describe "directory environments" do
 
     it "config prints a directory environment modulepath" do
       Puppet.settings.initialize_global_settings(args)
-      expect do
-        expect { puppet.run }.to exit_with(0)
-      end.to have_printed('otherdirenv/modules')
+      expect {
+        puppet.run
+      }.to exit_with(0)
+       .and output(%r{otherdirenv/modules}).to_stdout
     end
   end
 end

data/spec/integration/http/client_spec.rb

@@ -4,31 +4,17 @@ require 'puppet_spec/files'
 
 describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
   include PuppetSpec::Files
+  include_context "https client"
 
-  before :all do
-    WebMock.disable!
-  end
-
-  after :all do
-    WebMock.enable!
-  end
-
-  before :each do
-    # make sure we don't take too long
-    Puppet[:http_connect_timeout] = '5s'
-  end
-
-  let(:hostname) { '127.0.0.1' }
   let(:wrong_hostname) { 'localhost' }
-  let(:server) { PuppetSpec::HTTPSServer.new }
   let(:client) { Puppet::HTTP::Client.new }
   let(:ssl_provider) { Puppet::SSL::SSLProvider.new }
-  let(:root_context) { ssl_provider.create_root_context(cacerts: [server.ca_cert], crls: [server.ca_crl]) }
+  let(:root_context) { ssl_provider.create_root_context(cacerts: [https_server.ca_cert], crls: [https_server.ca_crl]) }
 
   context "when verifying an HTTPS server" do
     it "connects over SSL" do
-      server.start_server do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+      https_server.start_server do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
         expect(res).to be_success
       end
     end
@@ -41,14 +27,14 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
       port = tcps.connect_address.ip_port
 
       expect {
-        client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+        client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
       }.to raise_error(Puppet::HTTP::ConnectionError, %r{^Request to https://127.0.0.1:#{port} timed out connect operation after .* seconds})
     end
 
     it "raises if the server's cert doesn't match the hostname we connected to" do
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://#{wrong_hostname}:#{port}"), ssl_context: root_context)
+          client.get(URI("https://#{wrong_hostname}:#{port}"), options: {ssl_context: root_context})
         }.to raise_error { |err|
           expect(err).to be_instance_of(Puppet::SSL::CertMismatchError)
           expect(err.message).to match(/Server hostname '#{wrong_hostname}' did not match server certificate; expected one of (.+)/)
@@ -63,9 +49,9 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
       wrong_ca = cert_fixture('netlock-arany-utf8.pem')
       alt_context = ssl_provider.create_root_context(cacerts: [wrong_ca], revocation: false)
 
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://127.0.0.1:#{port}"), ssl_context: alt_context)
+          client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: alt_context})
         }.to raise_error(Puppet::SSL::CertVerifyError,
                          %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
       end
@@ -73,8 +59,8 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
     it "prints TLS protocol and ciphersuite in debug" do
       Puppet[:log_level] = 'debug'
-      server.start_server do |port|
-        client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+      https_server.start_server do |port|
+        client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
         # TLS version string can be TLSv1 or TLSv1.[1-3], but not TLSv1.0
         expect(@logs).to include(
           an_object_having_attributes(level: :debug, message: /Using TLSv1(\.[1-3])? with cipher .*/),
@@ -93,12 +79,12 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
     it "mutually authenticates the connection" do
       client_context = ssl_provider.create_context(
-        cacerts: [server.ca_cert], crls: [server.ca_crl],
-        client_cert: server.server_cert, private_key: server.server_key
+        cacerts: [https_server.ca_cert], crls: [https_server.ca_crl],
+        client_cert: https_server.server_cert, private_key: https_server.server_key
       )
 
-      server.start_server(ctx_proc: ctx_proc) do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: client_context)
+      https_server.start_server(ctx_proc: ctx_proc) do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: client_context})
         expect(res).to be_success
       end
     end
@@ -106,10 +92,10 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
   context "with a system trust store" do
     it "connects when the client trusts the server's CA" do
-      system_context = ssl_provider.create_system_context(cacerts: [server.ca_cert])
+      system_context = ssl_provider.create_system_context(cacerts: [https_server.ca_cert])
 
-      server.start_server do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+      https_server.start_server do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
         expect(res).to be_success
       end
     end
@@ -117,14 +103,14 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
     it "connects when the server's CA is in the system store" do
       # create a temp cacert bundle
       ssl_file = tmpfile('systemstore')
-      File.write(ssl_file, server.ca_cert)
+      File.write(ssl_file, https_server.ca_cert)
 
       # override path to system cacert bundle, this must be done before
       # the SSLContext is created and the call to X509::Store.set_default_paths
       Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
         system_context = ssl_provider.create_system_context(cacerts: [])
-        server.start_server do |port|
-          res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+        https_server.start_server do |port|
+          res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
           expect(res).to be_success
         end
       end
@@ -133,12 +119,36 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
     it "raises if the server's CA is not in the context or system store" do
       system_context = ssl_provider.create_system_context(cacerts: [cert_fixture('netlock-arany-utf8.pem')])
 
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+          client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
         }.to raise_error(Puppet::SSL::CertVerifyError,
                          %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
       end
     end
   end
+
+  context 'persistent connections' do
+    it "detects when the server has closed the connection and reconnects" do
+      Puppet[:http_debug] = true
+
+      # advertise that we support keep-alive, but we don't really
+      response_proc = -> (req, res) {
+        res['Connection'] = 'Keep-Alive'
+      }
+
+      https_server.start_server(response_proc: response_proc) do |port|
+        uri = URI("https://127.0.0.1:#{port}")
+        kwargs = {headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: root_context}}
+
+        expect {
+          expect(client.post(uri, '', **kwargs)).to be_success
+          # the server closes its connection after each request, so posting
+          # again will force ruby to detect that the remote side closed the
+          # connection, and reconnect
+          expect(client.post(uri, '', **kwargs)).to be_success
+        }.to output(/Conn close because of EOF/).to_stderr
+      end
+    end
+  end
 end