puppet 6.14.0-universal-darwin → 6.19.0-universal-darwin

data/spec/fixtures/unit/forge/bacula-releases.json

@@ -0,0 +1,128 @@
+{
+  "pagination": {
+    "limit": 20,
+    "offset": 0,
+    "first": "/v3/releases?module=puppetlabs-bacula&sort_by=version&exclude_fields=readme%2Cchangelog%2Clicense%2Curi%2Cmodule%2Ctags%2Csupported%2Cfile_size%2Cdownloads%2Ccreated_at%2Cupdated_at%2Cdeleted_at&limit=20&offset=0",
+    "previous": null,
+    "current": "/v3/releases?module=puppetlabs-bacula&sort_by=version&exclude_fields=readme%2Cchangelog%2Clicense%2Curi%2Cmodule%2Ctags%2Csupported%2Cfile_size%2Cdownloads%2Ccreated_at%2Cupdated_at%2Cdeleted_at&limit=20&offset=0",
+    "next": null,
+    "total": 2
+  },
+  "results": [
+    {
+      "slug": "puppetlabs-bacula-0.0.2",
+      "version": "0.0.2",
+      "metadata": {
+        "description": "This module manages Bacula, a complete backup solution",
+        "source": "http://github.com/puppetlabs/puppetlabs-bacula",
+        "checksums": {
+          "templates/client_config.erb": "5d4005eda5ace78fd90a8cb6dcb388bd",
+          "spec/spec_helper.rb": "ca19ec4f451ebc7fdb035b52eae6e909",
+          "templates/bacula-fd.conf.erb": "344fff616e138fbf8cd150f4bab8125d",
+          "CHANGELOG": "a20043858790de6086b9b30c36806cd2",
+          "manifests/config/validate.pp": "7d2f9f7cffb2bd1d221eb699ea55f246",
+          "LICENSE": "26ce13c80c7a8493533c65c32dc29f09",
+          "manifests/director.pp": "36f34f749314634173b6a47b92a58421",
+          "manifests/config/client.pp": "5d25cbfd94be2829d9d530673cd2307f",
+          "lib/puppet/parser/functions/generate_clients.rb": "e09d77f88d18ec3e59bbe7bae4a48036",
+          "manifests/common.pp": "67391e5560ee7fc97d873ab5c3e2f84c",
+          "manifests/client.pp": "42e9255711d0a6abed6ab8deafb1248c",
+          "manifests/console.pp": "4cf8ac2f96f9268e2a3d70ed777797b7",
+          "README.md": "13d0f1119d510e41c539cbc3825a4f82",
+          "templates/bacula-sd.conf.erb": "df7987695bf1dd18bb789a2673b2cd95",
+          "manifests/config.pp": "624a225f85f907e7db5cf717561953f3",
+          "tests/init.pp": "b95d199119d5e592df7e1580bf23fe06",
+          "templates/bconsole.conf.erb": "ba5e1ef7d320a48bde6e403dc956952a",
+          "manifests/bat.pp": "3743bddf0197b4110e54a8e297e927e8",
+          "manifests/storage.pp": "84f4ec1413df4fdec7288c18d6ba2897",
+          "templates/bacula-dir.conf.erb": "5ab5aa263cf318ebf65c6b52a0726647",
+          "metadata.json": "d34d0b70aba36510fbc2df4e667479ef",
+          "spec/spec.opts": "a600ded995d948e393fbe2320ba8e51c",
+          "Modulefile": "63f93af605871a69211cd3f79ac62582",
+          "manifests/init.pp": "fafac38161dd69f4b7e452cf910812f4"
+        },
+        "summary": "This module manages a bacula infrastructure",
+        "author": "Puppet Labs",
+        "dependencies": [
+
+        ],
+        "project_page": "http://github.com/puppetlabs/puppetlabs-bacula",
+        "types": [
+
+        ],
+        "license": "Apache",
+        "version": "0.0.2",
+        "name": "puppetlabs-bacula"
+      },
+      "pdk": false,
+      "validation_score": 22,
+      "file_uri": "/v3/files/puppetlabs-bacula-0.0.2.tar.gz",
+      "file_md5": "6cd7b8a3ec788e4ddbd06ae59be45d7a",
+      "file_sha256": "4cea5bae3c2b3dbe236bdc87ab9caa4f6d41943d1bf81651b2c0e08205910cdd",
+      "reference": null,
+      "tasks": [
+
+      ],
+      "plans": [
+
+      ],
+      "deleted_for": null
+    },
+    {
+      "slug": "puppetlabs-bacula-0.0.1",
+      "version": "0.0.1",
+      "metadata": {
+        "description": "This module manages Bacula, a complete backup solution",
+        "source": "http://github.com/puppetlabs/puppetlabs-bacula",
+        "checksums": {
+          "spec/spec_helper.rb": "ca19ec4f451ebc7fdb035b52eae6e909",
+          "templates/bacula-fd.conf.erb": "344fff616e138fbf8cd150f4bab8125d",
+          "CHANGELOG": "28c8a36d149971979b867491203b5fef",
+          "manifests/config/validate.pp": "e74d9dfbf4814d455a2c4a27ac516571",
+          "LICENSE": "26ce13c80c7a8493533c65c32dc29f09",
+          "manifests/director.pp": "bec6d5b6b8befca9640edb8bdb8b5b10",
+          "manifests/common.pp": "9c037f51fd8b70c4bed0ceeb55f93ffb",
+          "manifests/client.pp": "42e9255711d0a6abed6ab8deafb1248c",
+          "manifests/console.pp": "1ee546361e47c0bc43299b3b62baa925",
+          "README.md": "470c6e1e9b4d877bcfdc88d751de8d19",
+          "templates/bacula-sd.conf.erb": "df7987695bf1dd18bb789a2673b2cd95",
+          "manifests/config.pp": "4410fadc6d82543e0b19039e3365fd3a",
+          "tests/init.pp": "b95d199119d5e592df7e1580bf23fe06",
+          "templates/bconsole.conf.erb": "ba5e1ef7d320a48bde6e403dc956952a",
+          "manifests/bat.pp": "3743bddf0197b4110e54a8e297e927e8",
+          "manifests/storage.pp": "13eadb4376a07d095d1ee13e8ff60846",
+          "templates/bacula-dir.conf.erb": "c0b1b57660cf965bcff7e5fda547ee03",
+          "metadata.json": "d34d0b70aba36510fbc2df4e667479ef",
+          "spec/spec.opts": "a600ded995d948e393fbe2320ba8e51c",
+          "Modulefile": "082b764ac91831266b7cbda75f79c199",
+          "manifests/init.pp": "6b9d2e9ca0a06c1a318837307fadcc70"
+        },
+        "summary": "This module manages a bacula infrastructure",
+        "author": "Puppet Labs",
+        "dependencies": [
+
+        ],
+        "project_page": "http://github.com/puppetlabs/puppetlabs-bacula",
+        "types": [
+
+        ],
+        "license": "Apache",
+        "version": "0.0.1",
+        "name": "puppetlabs-bacula"
+      },
+      "pdk": false,
+      "validation_score": 38,
+      "file_uri": "/v3/files/puppetlabs-bacula-0.0.1.tar.gz",
+      "file_md5": "c29882cf29eff17f18dcb74cc544c200",
+      "file_sha256": "7a68af4ab6e413a1cb3ec1694ddc3956138aa4c34d97abbe61a50947d0b12069",
+      "reference": null,
+      "tasks": [
+
+      ],
+      "plans": [
+
+      ],
+      "deleted_for": null
+    }
+  ]
+}

data/spec/fixtures/unit/provider/package/dnfmodule/{dnf-module-list-installed.txt → dnf-module-list.txt}

@@ -1,11 +1,19 @@
 localmirror-appstream
 Name         Stream       Profiles                                  Summary                                                            
+389-ds       1.4 [e]                                                389 Directory Server (base)                                           
 gimp         2.8 [d][e]   common [d], devel [i]                     gimp module                                                        
 mariadb      10.3 [d][e]  client [i], server [d], galera            MariaDB Module                                                     
 nodejs       10 [d][e]    common [d], development, minimal [i], s2i Javascript runtime                                                 
 perl         5.26 [d][e]  common [d], minimal [i]                   Practical Extraction and Report Language                           
 postgresql   10 [d][e]    client, server [d] [i]                    PostgreSQL server and client module                                
+ruby         2.5 [d][e]   common [d]                                An interpreter of object-oriented scripting language                  
 rust-toolset rhel8 [d][e] common [d] [i]                            Rust                                                               
 subversion   1.10 [d][e]  common [d], server [i]                    Apache Subversion                                                  
+scala        2.10 [d]     common [d]                                A hybrid functional/object-oriented language for the JVM
+squid        4 [d]        common [d]                                Squid - Optimising Web Delivery
+subversion   1.10 [d]     common [d], server                        Apache Subversion
+swig         3.0 [d][x]   common [d], complete                      Connects C/C++/Objective C to some high-level programming languages
+varnish      6 [d]        common [d]                                Varnish HTTP cache
+virt         rhel [d][x]  common [d]                                Virtualization module
 
 Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

data/spec/fixtures/unit/provider/package/pkgng/pkg.version

@@ -1,3 +1,5 @@
 shells/bash-completion             <   needs updating (index has 2.1_3)
 ftp/curl                           <   needs updating (index has 7.33.0_2)
 shells/zsh                         <   needs updating (index has 5.0.4)
+sysutils/orphan                    ?   orphaned: sysutils/orphan
+sysutils/broken                    !   Comparison failed

data/spec/fixtures/unit/provider/package/puppetserver_gem/gem-list-local-packages

@@ -0,0 +1,30 @@
+concurrent-ruby (1.1.5)
+
+deep_merge (1.0.1)
+
+fast_gettext (1.1.2)
+
+gettext (3.2.2)
+
+hiera-eyaml (3.2.0)
+
+highline (1.6.21)
+
+hocon (1.3.1, 1.2.5)
+
+locale (2.1.3, 2.1.2)
+
+multi_json (1.14.1)
+
+optimist (3.0.1)
+
+puppet-resource_api (1.8.13)
+
+puppetserver-ca (1.8.0)
+
+semantic_puppet (1.0.2)
+
+text (1.3.1)
+
+world_airports (1.1.3)
+

data/spec/fixtures/unit/provider/package/yum/yum-check-update-subscription-manager.txt

@@ -0,0 +1,9 @@
+Loaded plugins: product-id, search-disabled-repos, subscription-manager
+
+This system is not registered with an entitlement server. You can use subscription-manager to register on.
+
+curl.i686                               7.32.0-10.fc20           updates
+curl.x86_64                             7.32.0-10.fc20           updates
+gawk.i686                               4.1.0-3.fc20             updates
+dhclient.i686                           12:4.1.1-38.P1.fc20      updates
+java-1.8.0-openjdk.x86_64               1:1.8.0.131-2.b11.el7_3  updates

data/spec/fixtures/unit/provider/package/zypper/zypper-search-uninstalled.out

@@ -0,0 +1,13 @@
+Refreshing service 'spacewalk'.
+Problem retrieving the repository index file for service 'spacewalk':
+[|] This client is not registered to any spacewalk server.
+
+Skipping service 'spacewalk' because of the above error.
+Loading repository data...
+Reading installed packages...
+
+S | Name    | Type    | Version           | Arch   | Repository                                      
+--+---------+---------+-------------------+--------+-------------------------------------------------
+  | vim     | package | 1.0.20040813-19.9 | noarch | localmirror-os                                  
+  | vim     | package | 1.0.20040813-19.9 | noarch | localmirror-os                                  
+  | vim     | package | 1.0.20040813-19.9 | noarch | SUSE-Linux-Enterprise-Server-11-SP4 11.4.4-1.109

data/spec/fixtures/unit/provider/service/systemd/list_unit_files_services

@@ -5,3 +5,12 @@ autovt@.service                             disabled
 avahi-daemon.service                        enabled
 blk-availability.service                    disabled
 brandbot.service                            static
+apparmor.service                            bad
+udev.service                                enabled-runtime
+ufw.service                                 linked
+umountfs.service                            linked-runtime
+umountnfs.service                           masked
+umountroot.service                          masked-runtime
+urandom.service                             indirect
+user@.service                               generated
+uuidd.service                               transient

data/spec/integration/application/agent_spec.rb

@@ -0,0 +1,479 @@
+require 'spec_helper'
+require 'puppet_spec/files'
+require 'puppet_spec/puppetserver'
+require 'puppet_spec/compiler'
+require 'puppet_spec/https'
+
+describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
+  include PuppetSpec::Compiler
+  include_context "https client"
+
+  let(:server) { PuppetSpec::Puppetserver.new }
+  let(:agent) { Puppet::Application[:agent] }
+  let(:node) { Puppet::Node.new(Puppet[:certname], environment: 'production')}
+  let(:formatter) { Puppet::Network::FormatHandler.format(:rich_data_json) }
+
+  context 'server_list' do
+    it "uses the first server in the list" do
+      Puppet[:server_list] = '127.0.0.1'
+      Puppet[:log_level] = 'debug'
+
+      server.start_server do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{HTTP GET https://127.0.0.1:#{port}/status/v1/simple/master returned 200 OK}).to_stdout
+      end
+    end
+
+    it "falls back, recording the first viable server in the report" do
+      Puppet[:server_list] = "puppet.example.com,#{Puppet[:server]}"
+
+      server.start_server do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{Notice: Applied catalog}).to_stdout
+         .and output(%r{Unable to connect to server from server_list setting: Request to https://puppet.example.com:#{port}/status/v1/simple/master failed}).to_stderr
+
+        report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
+        expect(report.master_used).to eq("127.0.0.1:#{port}")
+        expect(report.server_used).to eq("127.0.0.1:#{port}")
+      end
+    end
+
+    it "doesn't write a report if no servers could be contacted" do
+      Puppet[:server_list] = "puppet.example.com"
+
+      expect {
+        agent.command_line.args << '--test'
+        agent.run
+      }.to exit_with(1)
+       .and output(a_string_matching(%r{Unable to connect to server from server_list setting})
+       .and matching(/Error: Could not run Puppet configuration client: Could not select a functional puppet server from server_list: 'puppet.example.com'/)).to_stderr
+
+      # I'd expect puppet to update the last run report even if the server_list was
+      # exhausted, but it doesn't work that way currently, see PUP-6708
+      expect(File).to_not be_exist(Puppet[:lastrunreport])
+    end
+
+    it "omits server_used when not using server_list" do
+      Puppet[:log_level] = 'debug'
+
+      server.start_server do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{Resolved service 'puppet' to https://127.0.0.1:#{port}/puppet/v3}).to_stdout
+      end
+
+      report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
+      expect(report.master_used).to be_nil
+      expect(report.server_used).to be_nil
+    end
+
+    it "server_list takes precedence over server" do
+      Puppet[:server] = 'notvalid.example.com'
+      Puppet[:log_level] = 'debug'
+
+      server.start_server do |port|
+        Puppet[:server_list] = "127.0.0.1:#{port}"
+
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{Debug: Resolved service 'puppet' to https://127.0.0.1:#{port}/puppet/v3}).to_stdout
+
+        report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
+        expect(report.master_used).to eq("127.0.0.1:#{port}")
+        expect(report.server_used).to eq("127.0.0.1:#{port}")
+      end
+    end
+  end
+
+  context 'rich data' do
+    it "applies deferred values" do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          notify { 'deferred':
+            message => Deferred('join', [[1,2,3], ':'])
+          }
+        MANIFEST
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(%r{Notice: /Stage\[main\]/Main/Notify\[deferred\]/message: defined 'message' as '1:2:3'}).to_stdout
+      end
+    end
+
+    it "redacts sensitive values" do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          notify { 'sensitive':
+            message => Sensitive('supersecret')
+          }
+        MANIFEST
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(a_string_matching(
+          /Notice: Sensitive \[value redacted\]/
+        ).and matching(
+          /Notify\[sensitive\]\/message: changed \[redacted\] to \[redacted\]/
+        )).to_stdout
+      end
+    end
+
+    it "applies binary data in a cached catalog" do
+      catalog = compile_to_catalog(<<-MANIFEST, node)
+          notify { 'some title':
+            message => Binary.new('aGk=')
+          }
+        MANIFEST
+
+      catalog_dir = File.join(Puppet[:client_datadir], 'catalog')
+      Puppet::FileSystem.mkpath(catalog_dir)
+      cached_catalog = "#{File.join(catalog_dir, Puppet[:certname])}.json"
+      File.write(cached_catalog, catalog.render(:rich_data_json))
+
+      expect {
+        Puppet[:report] = false
+        Puppet[:use_cached_catalog] = true
+        Puppet[:usecacheonfailure] = false
+        agent.command_line.args << '-t'
+        agent.run
+      }.to exit_with(2)
+       .and output(%r{defined 'message' as 'hi'}).to_stdout
+    end
+  end
+
+  context 'static catalogs' do
+    let(:path) { tmpfile('file') }
+    let(:metadata) { Puppet::FileServing::Metadata.new(path) }
+    let(:source) { "puppet:///modules/foo/foo.txt" }
+
+    before :each do
+      Puppet::FileSystem.touch(path)
+
+      metadata.collect
+      metadata.source = source
+      metadata.content_uri = "puppet:///modules/foo/files/foo.txt"
+    end
+
+    it 'uses inline file metadata to determine the file is insync' do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          file { "#{path}":
+            ensure => file,
+            source => "#{source}"
+          }
+        MANIFEST
+        catalog.metadata = { path => metadata }
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:serverport] = port
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(0)
+        }.to_not output(/content changed/).to_stdout
+      end
+    end
+
+    it 'retrieves file content using the content_uri from the inlined file metadata' do
+      # create file with binary content
+      binary_content = "\xC0\xFF".force_encoding('binary')
+      File.binwrite(path, binary_content)
+
+      # recollect metadata
+      metadata.collect
+
+      # overwrite local file so it is no longer in sync
+      File.binwrite(path, "")
+
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          file { "#{path}":
+            ensure => file,
+            source => "#{source}",
+          }
+        MANIFEST
+        catalog.metadata = { path => metadata }
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      static_file_content_handler = -> (req, res) {
+        res.body = binary_content
+        res['Content-Type'] = 'application/octet-stream'
+      }
+
+      mounts = {
+        catalog: catalog_handler,
+        static_file_content: static_file_content_handler
+      }
+
+      server.start_server(mounts: mounts) do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(/content changed '{md5}d41d8cd98f00b204e9800998ecf8427e' to '{md5}4cf49285ae567157ebfba72bd04ccf32'/).to_stdout
+
+        # verify puppet restored binary content
+        expect(File.binread(path)).to eq(binary_content)
+      end
+    end
+  end
+
+  context 'https file sources' do
+    let(:path) { tmpfile('https_file_source') }
+    let(:response_body) { "from https server" }
+    let(:digest) { Digest::SHA1.hexdigest(response_body) }
+
+    it 'rejects HTTPS servers whose root cert is not in the system CA store' do
+      unknown_ca_cert = cert_fixture('unknown-ca.pem')
+      https = PuppetSpec::HTTPSServer.new(
+        ca_cert: unknown_ca_cert,
+        server_cert: cert_fixture('unknown-127.0.0.1.pem'),
+        server_key: key_fixture('unknown-127.0.0.1-key.pem')
+      )
+
+      # create a temp cacert bundle
+      ssl_file = tmpfile('systemstore')
+      # add CA cert that is neither the puppet CA nor unknown CA
+      File.write(ssl_file, cert_fixture('netlock-arany-utf8.pem').to_pem)
+
+      https.start_server do |https_port|
+        catalog_handler = -> (req, res) {
+          catalog = compile_to_catalog(<<-MANIFEST, node)
+            file { "#{path}":
+              ensure => file,
+              backup => false,
+              checksum => sha1,
+              checksum_value => '#{digest}',
+              source => "https://127.0.0.1:#{https_port}/path/to/file"
+            }
+          MANIFEST
+
+          res.body = formatter.render(catalog)
+          res['Content-Type'] = formatter.mime
+        }
+
+        server.start_server(mounts: {catalog: catalog_handler}) do |puppetserver_port|
+          Puppet[:serverport] = puppetserver_port
+
+          # override path to system cacert bundle, this must be done before
+          # the SSLContext is created and the call to X509::Store.set_default_paths
+          Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+            expect {
+              agent.command_line.args << '--test'
+              agent.run
+            }.to exit_with(4)
+             .and output(/Notice: Applied catalog/).to_stdout
+             .and output(%r{Error: Could not retrieve file metadata for https://127.0.0.1:#{https_port}/path/to/file: certificate verify failed}).to_stderr
+          end
+
+          expect(File).to_not be_exist(path)
+        end
+      end
+    end
+
+    it 'accepts HTTPS servers whose cert is in the system CA store' do
+      unknown_ca_cert = cert_fixture('unknown-ca.pem')
+      https = PuppetSpec::HTTPSServer.new(
+        ca_cert: unknown_ca_cert,
+        server_cert: cert_fixture('unknown-127.0.0.1.pem'),
+        server_key: key_fixture('unknown-127.0.0.1-key.pem')
+      )
+
+      # create a temp cacert bundle
+      ssl_file = tmpfile('systemstore')
+      File.write(ssl_file, unknown_ca_cert.to_pem)
+
+      response_proc = -> (req, res) {
+        res.status = 200
+        res.body = response_body
+      }
+
+      https.start_server(response_proc: response_proc) do |https_port|
+        catalog_handler = -> (req, res) {
+          catalog = compile_to_catalog(<<-MANIFEST, node)
+            file { "#{path}":
+              ensure => file,
+              backup => false,
+              checksum => sha1,
+              checksum_value => '#{digest}',
+              source => "https://127.0.0.1:#{https_port}/path/to/file"
+            }
+          MANIFEST
+
+          res.body = formatter.render(catalog)
+          res['Content-Type'] = formatter.mime
+        }
+
+        server.start_server(mounts: {catalog: catalog_handler}) do |puppetserver_port|
+          Puppet[:serverport] = puppetserver_port
+
+          # override path to system cacert bundle, this must be done before
+          # the SSLContext is created and the call to X509::Store.set_default_paths
+          Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+            expect {
+                agent.command_line.args << '--test'
+                agent.run
+            }.to exit_with(2)
+             .and output(%r{https_file_source.*/ensure: created}).to_stdout
+          end
+
+          expect(File.binread(path)).to eq("from https server")
+        end
+      end
+    end
+
+    it 'accepts HTTPS servers whose cert is in the external CA store' do
+      unknown_ca_cert = cert_fixture('unknown-ca.pem')
+      https = PuppetSpec::HTTPSServer.new(
+        ca_cert: unknown_ca_cert,
+        server_cert: cert_fixture('unknown-127.0.0.1.pem'),
+        server_key: key_fixture('unknown-127.0.0.1-key.pem')
+      )
+
+      # create a temp cacert bundle
+      ssl_file = tmpfile('systemstore')
+      File.write(ssl_file, unknown_ca_cert.to_pem)
+
+      response_proc = -> (req, res) {
+        res.status = 200
+        res.body = response_body
+      }
+
+      https.start_server(response_proc: response_proc) do |https_port|
+        catalog_handler = -> (req, res) {
+          catalog = compile_to_catalog(<<-MANIFEST, node)
+            file { "#{path}":
+              ensure => file,
+              backup => false,
+              checksum => sha1,
+              checksum_value => '#{digest}',
+              source => "https://127.0.0.1:#{https_port}/path/to/file"
+            }
+          MANIFEST
+
+          res.body = formatter.render(catalog)
+          res['Content-Type'] = formatter.mime
+        }
+
+        server.start_server(mounts: {catalog: catalog_handler}) do |puppetserver_port|
+          Puppet[:serverport] = puppetserver_port
+
+          # set path to external cacert bundle, this must be done before
+          # the SSLContext is created
+          Puppet[:ssl_trust_store] = ssl_file
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(2)
+           .and output(%r{https_file_source.*/ensure: created}).to_stdout
+        end
+
+        expect(File.binread(path)).to eq("from https server")
+      end
+    end
+  end
+
+  context 'multiple agents running' do
+    it "exits if an agent is already running" do
+      path = Puppet[:agent_catalog_run_lockfile]
+
+      th = Thread.new {
+        %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(2)"}
+      }
+
+      until File.exists?(path) && File.size(path) > 0 do
+        sleep 0.1
+      end
+
+      expect {
+        agent.command_line.args << '--test'
+        agent.run
+      }.to exit_with(1).and output(/Run of Puppet configuration client already in progress; skipping/).to_stdout
+
+      th.kill # kill thread so we don't wait too much
+    end
+
+    it "waits for other agent run to finish before starting" do
+      server.start_server do |port|
+        path = Puppet[:agent_catalog_run_lockfile]
+        Puppet[:serverport] = port
+        Puppet[:waitforlock] = 1
+
+        th = Thread.new {
+          %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(2)"}
+        }
+
+        until File.exists?(path) && File.size(path) > 0 do
+          sleep 0.1
+        end
+
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0).and output(/Info: Will try again in #{Puppet[:waitforlock]} seconds./).to_stdout
+
+        th.kill # kill thread so we don't wait too much
+      end
+    end
+
+    it "exits if maxwaitforlock is exceeded" do
+      path = Puppet[:agent_catalog_run_lockfile]
+      Puppet[:waitforlock] = 1
+      Puppet[:maxwaitforlock] = 0
+
+      th = Thread.new {
+        %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(2)"}
+      }
+
+      until File.exists?(path) && File.size(path) > 0 do
+        sleep 0.1
+      end
+
+      expect {
+        agent.command_line.args << '--test'
+        agent.run
+      }.to exit_with(1).and output(/Exiting now because the maxwaitforlock timeout has been exceeded./).to_stdout
+
+      th.kill # kill thread so we don't wait too much
+    end
+  end
+end