puppet 6.14.0 → 6.15.0

data/spec/fixtures/ssl/unknown-ca.pem

@@ -0,0 +1,59 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 0 (0x0)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Unknown CA
+        Validity
+            Not Before: Jan  1 00:00:00 1970 GMT
+            Not After : Mar 10 06:54:16 2030 GMT
+        Subject: CN=Unknown CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (1024 bit)
+                Modulus:
+                    00:c1:5e:5d:26:ae:73:17:5a:70:37:ac:42:25:ca:
+                    05:10:86:17:23:6c:28:84:48:2a:4a:d4:b0:3a:2a:
+                    d8:33:ae:58:67:6f:9b:4f:a6:b4:87:b1:ec:37:00:
+                    69:8d:d5:cf:71:8a:96:e1:4a:f8:c8:81:36:f9:43:
+                    ad:d8:d6:76:83:27:99:a4:48:17:c2:ef:9c:22:40:
+                    4b:c6:58:21:88:e5:1d:37:79:4e:ba:31:e6:52:ec:
+                    8c:23:ed:d6:ce:3b:58:ad:82:c7:ae:28:47:d4:e7:
+                    cc:31:ac:78:c9:02:87:d0:b1:91:09:f6:1e:9a:c3:
+                    4f:f6:5a:fe:a2:21:0e:c0:95
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                E9:58:70:FE:F1:C1:AA:5A:70:7A:C1:02:11:1D:9A:F4:60:4F:70:76
+            Netscape Comment: 
+                Puppet Server Internal Certificate
+            X509v3 Authority Key Identifier: 
+                keyid:E9:58:70:FE:F1:C1:AA:5A:70:7A:C1:02:11:1D:9A:F4:60:4F:70:76
+
+    Signature Algorithm: sha256WithRSAEncryption
+         00:45:89:e8:68:a7:50:8c:92:84:3c:c4:e6:10:00:29:27:99:
+         c6:82:aa:aa:b5:0b:ef:97:58:bc:bb:e6:e7:93:7c:a7:ea:e5:
+         9a:61:1d:e3:4f:3f:f9:ac:c4:96:14:a5:1f:77:a6:01:dc:08:
+         15:9c:3f:66:29:92:80:49:e9:db:d9:22:fb:c3:86:bf:40:ab:
+         46:bf:c5:47:bb:c8:89:df:d4:ca:36:f5:08:c4:08:c6:0b:d6:
+         9e:8a:86:41:1e:7e:6f:a9:75:ef:8a:94:a9:fd:1a:9b:0f:55:
+         3a:55:e5:04:82:71:c3:47:78:62:8e:07:ed:dc:4e:ac:f9:33:
+         7b:27
+-----BEGIN CERTIFICATE-----
+MIICODCCAaGgAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDDApVbmtu
+b3duIENBMB4XDTcwMDEwMTAwMDAwMFoXDTMwMDMxMDA2NTQxNlowFTETMBEGA1UE
+AwwKVW5rbm93biBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwV5dJq5z
+F1pwN6xCJcoFEIYXI2wohEgqStSwOirYM65YZ2+bT6a0h7HsNwBpjdXPcYqW4Ur4
+yIE2+UOt2NZ2gyeZpEgXwu+cIkBLxlghiOUdN3lOujHmUuyMI+3WzjtYrYLHrihH
+1OfMMax4yQKH0LGRCfYemsNP9lr+oiEOwJUCAwEAAaOBlzCBlDAPBgNVHRMBAf8E
+BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU6Vhw/vHBqlpwesECER2a
+9GBPcHYwMQYJYIZIAYb4QgENBCQWIlB1cHBldCBTZXJ2ZXIgSW50ZXJuYWwgQ2Vy
+dGlmaWNhdGUwHwYDVR0jBBgwFoAU6Vhw/vHBqlpwesECER2a9GBPcHYwDQYJKoZI
+hvcNAQELBQADgYEAAEWJ6GinUIyShDzE5hAAKSeZxoKqqrUL75dYvLvm55N8p+rl
+mmEd408/+azElhSlH3emAdwIFZw/ZimSgEnp29ki+8OGv0CrRr/FR7vIid/Uyjb1
+CMQIxgvWnoqGQR5+b6l174qUqf0amw9VOlXlBIJxw0d4Yo4H7dxOrPkzeyc=
+-----END CERTIFICATE-----

data/spec/fixtures/unit/provider/package/dnfmodule/{dnf-module-list-installed.txt → dnf-module-list-enabled.txt}

@@ -1,10 +1,12 @@
 localmirror-appstream
 Name         Stream       Profiles                                  Summary                                                            
+389-ds       1.4 [e]                                                389 Directory Server (base)                                           
 gimp         2.8 [d][e]   common [d], devel [i]                     gimp module                                                        
 mariadb      10.3 [d][e]  client [i], server [d], galera            MariaDB Module                                                     
 nodejs       10 [d][e]    common [d], development, minimal [i], s2i Javascript runtime                                                 
 perl         5.26 [d][e]  common [d], minimal [i]                   Practical Extraction and Report Language                           
 postgresql   10 [d][e]    client, server [d] [i]                    PostgreSQL server and client module                                
+ruby         2.5 [d][e]   common [d]                                An interpreter of object-oriented scripting language                  
 rust-toolset rhel8 [d][e] common [d] [i]                            Rust                                                               
 subversion   1.10 [d][e]  common [d], server [i]                    Apache Subversion                                                  
 

data/spec/fixtures/unit/provider/package/pkgng/pkg.version

@@ -1,3 +1,5 @@
 shells/bash-completion             <   needs updating (index has 2.1_3)
 ftp/curl                           <   needs updating (index has 7.33.0_2)
 shells/zsh                         <   needs updating (index has 5.0.4)
+sysutils/orphan                    ?   orphaned: sysutils/orphan
+sysutils/broken                    !   Comparison failed

data/spec/fixtures/unit/provider/package/yum/yum-check-update-subscription-manager.txt

@@ -0,0 +1,9 @@
+Loaded plugins: product-id, search-disabled-repos, subscription-manager
+
+This system is not registered with an entitlement server. You can use subscription-manager to register on.
+
+curl.i686                               7.32.0-10.fc20           updates
+curl.x86_64                             7.32.0-10.fc20           updates
+gawk.i686                               4.1.0-3.fc20             updates
+dhclient.i686                           12:4.1.1-38.P1.fc20      updates
+java-1.8.0-openjdk.x86_64               1:1.8.0.131-2.b11.el7_3  updates

data/spec/fixtures/unit/provider/service/systemd/list_unit_files_services

@@ -5,3 +5,12 @@ autovt@.service                             disabled
 avahi-daemon.service                        enabled
 blk-availability.service                    disabled
 brandbot.service                            static
+apparmor.service                            bad
+udev.service                                enabled-runtime
+ufw.service                                 linked
+umountfs.service                            linked-runtime
+umountnfs.service                           masked
+umountroot.service                          masked-runtime
+urandom.service                             indirect
+user@.service                               generated
+uuidd.service                               transient

data/spec/integration/application/agent_spec.rb

@@ -0,0 +1,329 @@
+require 'spec_helper'
+require 'puppet_spec/files'
+require 'puppet_spec/puppetserver'
+require 'puppet_spec/compiler'
+require 'puppet_spec/https'
+
+describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
+  include PuppetSpec::Compiler
+  include_context "https client"
+
+  let(:server) { PuppetSpec::Puppetserver.new }
+  let(:agent) { Puppet::Application[:agent] }
+  let(:node) { Puppet::Node.new(Puppet[:certname], environment: 'production')}
+  let(:formatter) { Puppet::Network::FormatHandler.format(:rich_data_json) }
+
+  context 'server_list' do
+    before :each do
+      Puppet[:log_level] = 'debug'
+    end
+
+    it "uses the first server in the list" do
+      Puppet[:server_list] = '127.0.0.1'
+
+      server.start_server do |port|
+        Puppet[:masterport] = port
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(0)
+        }.to output(%r{HTTP GET https://127.0.0.1:#{port}/status/v1/simple/master returned 200 OK}).to_stdout
+      end
+    end
+
+    it "falls back, recording the first viable server in the report" do
+      Puppet[:server_list] = "puppet.example.com,#{Puppet[:server]}"
+
+      server.start_server do |port|
+        Puppet[:masterport] = port
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(0)
+        }.to output(%r{Unable to connect to server from server_list setting: Request to https://puppet.example.com:#{port}/status/v1/simple/master failed}).to_stdout
+
+        report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
+        expect(report.master_used).to eq("127.0.0.1:#{port}")
+      end
+    end
+
+    it "doesn't write a report if no servers could be contacted" do
+      Puppet[:server_list] = "puppet.example.com"
+
+      expect {
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(1)
+        }.to output(%r{Unable to connect to server from server_list setting: Could not select a functional puppet master from server_list: 'puppet.example.com'}).to_stdout
+      }.to output(/Error: Could not run Puppet configuration client: Could not select a functional puppet master from server_list: 'puppet.example.com'/).to_stderr
+
+      # I'd expect puppet to update the last run report even if the server_list was
+      # exhausted, but it doesn't work that way currently, see PUP-6708
+      expect(File).to_not be_exist(Puppet[:lastrunreport])
+    end
+
+    it "omits master_used when not using server_list" do
+      server.start_server do |port|
+        Puppet[:masterport] = port
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(0)
+        }.to output(%r{Resolved service 'puppet' to https://127.0.0.1:#{port}/puppet/v3}).to_stdout
+      end
+
+      report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
+      expect(report.master_used).to be_nil
+    end
+  end
+
+  context 'rich data' do
+    it "applies deferred values" do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          notify { 'deferred':
+            message => Deferred('join', [[1,2,3], ':'])
+          }
+        MANIFEST
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:masterport] = port
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(2)
+        }.to output(%r{Notice: /Stage\[main\]/Main/Notify\[deferred\]/message: defined 'message' as '1:2:3'}).to_stdout
+      end
+    end
+
+    it "redacts sensitive values" do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          notify { 'sensitive':
+            message => Sensitive('supersecret')
+          }
+        MANIFEST
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:masterport] = port
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(2)
+        }.to output(a_string_matching(
+          /Notice: Sensitive \[value redacted\]/
+        ).and matching(
+          /Notify\[sensitive\]\/message: changed \[redacted\] to \[redacted\]/
+        )).to_stdout
+      end
+    end
+  end
+
+  context 'static catalogs' do
+    let(:path) { tmpfile('file') }
+    let(:metadata) { Puppet::FileServing::Metadata.new(path) }
+    let(:source) { "puppet:///modules/foo/foo.txt" }
+
+    before :each do
+      Puppet::FileSystem.touch(path)
+
+      metadata.collect
+      metadata.source = source
+      metadata.content_uri = "puppet:///modules/foo/files/foo.txt"
+    end
+
+    it 'uses inline file metadata to determine the file is insync' do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          file { "#{path}":
+            ensure => file,
+            source => "#{source}"
+          }
+        MANIFEST
+        catalog.metadata = { path => metadata }
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:masterport] = port
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(0)
+        }.to_not output(/content changed/).to_stdout
+      end
+    end
+
+    it 'retrieves file content using the content_uri from the inlined file metadata' do
+      # create file with binary content
+      binary_content = "\xC0\xFF".force_encoding('binary')
+      File.binwrite(path, binary_content)
+
+      # recollect metadata
+      metadata.collect
+
+      # overwrite local file so it is no longer in sync
+      File.binwrite(path, "")
+
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          file { "#{path}":
+            ensure => file,
+            source => "#{source}",
+          }
+        MANIFEST
+        catalog.metadata = { path => metadata }
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      static_file_content_handler = -> (req, res) {
+        res.body = binary_content
+        res['Content-Type'] = 'application/octet-stream'
+      }
+
+      mounts = {
+        catalog: catalog_handler,
+        static_file_content: static_file_content_handler
+      }
+
+      server.start_server(mounts: mounts) do |port|
+        Puppet[:masterport] = port
+        expect {
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(2)
+        }.to output(/content changed '{md5}d41d8cd98f00b204e9800998ecf8427e' to '{md5}4cf49285ae567157ebfba72bd04ccf32'/).to_stdout
+
+        # verify puppet restored binary content
+        expect(File.binread(path)).to eq(binary_content)
+      end
+    end
+  end
+
+  context 'https file sources' do
+    let(:path) { tmpfile('https_file_source') }
+    let(:response_body) { "from https server" }
+    let(:digest) { Digest::SHA1.hexdigest(response_body) }
+
+    it 'rejects HTTPS servers whose root cert is not in the system CA store' do
+      unknown_ca_cert = cert_fixture('unknown-ca.pem')
+      https = PuppetSpec::HTTPSServer.new(
+        ca_cert: unknown_ca_cert,
+        server_cert: cert_fixture('unknown-127.0.0.1.pem'),
+        server_key: key_fixture('unknown-127.0.0.1-key.pem')
+      )
+
+      # create a temp cacert bundle
+      ssl_file = tmpfile('systemstore')
+      # add CA cert that is neither the puppet CA nor unknown CA
+      File.write(ssl_file, cert_fixture('netlock-arany-utf8.pem').to_pem)
+
+      https.start_server do |https_port|
+        catalog_handler = -> (req, res) {
+          catalog = compile_to_catalog(<<-MANIFEST, node)
+            file { "#{path}":
+              ensure => file,
+              backup => false,
+              checksum => sha1,
+              checksum_value => '#{digest}',
+              source => "https://127.0.0.1:#{https_port}/path/to/file"
+            }
+          MANIFEST
+
+          res.body = formatter.render(catalog)
+          res['Content-Type'] = formatter.mime
+        }
+
+        server.start_server(mounts: {catalog: catalog_handler}) do |puppetserver_port|
+          Puppet[:masterport] = puppetserver_port
+
+          # override path to system cacert bundle, this must be done before
+          # the SSLContext is created and the call to X509::Store.set_default_paths
+          Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+            expect {
+              agent.command_line.args << '--test'
+              agent.run
+            }.to exit_with(4)
+             .and output(/Notice: Applied catalog/).to_stdout
+             .and output(%r{Error: Could not retrieve file metadata for https://127.0.0.1:#{https_port}/path/to/file: .* certificate verify failed}).to_stderr
+          end
+
+          expect(File).to_not be_exist(path)
+        end
+      end
+    end
+
+    it 'accepts HTTPS servers whose cert is in the system CA store' do
+      unknown_ca_cert = cert_fixture('unknown-ca.pem')
+      https = PuppetSpec::HTTPSServer.new(
+        ca_cert: unknown_ca_cert,
+        server_cert: cert_fixture('unknown-127.0.0.1.pem'),
+        server_key: key_fixture('unknown-127.0.0.1-key.pem')
+      )
+
+      # create a temp cacert bundle
+      ssl_file = tmpfile('systemstore')
+      File.write(ssl_file, unknown_ca_cert.to_pem)
+
+      response_proc = -> (req, res) {
+        res.status = 200
+        res.body = response_body
+      }
+
+      https.start_server(response_proc: response_proc) do |https_port|
+        catalog_handler = -> (req, res) {
+          catalog = compile_to_catalog(<<-MANIFEST, node)
+            file { "#{path}":
+              ensure => file,
+              backup => false,
+              checksum => sha1,
+              checksum_value => '#{digest}',
+              source => "https://127.0.0.1:#{https_port}/path/to/file"
+            }
+          MANIFEST
+
+          res.body = formatter.render(catalog)
+          res['Content-Type'] = formatter.mime
+        }
+
+        server.start_server(mounts: {catalog: catalog_handler}) do |puppetserver_port|
+          Puppet[:masterport] = puppetserver_port
+
+          # override path to system cacert bundle, this must be done before
+          # the SSLContext is created and the call to X509::Store.set_default_paths
+          Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+            expect {
+                agent.command_line.args << '--test'
+                agent.run
+            }.to exit_with(2)
+             .and output(%r{https_file_source.*/ensure: created}).to_stdout
+          end
+
+          expect(File.binread(path)).to eq("from https server")
+        end
+      end
+    end
+  end
+end

data/spec/integration/application/apply_spec.rb

@@ -1,8 +1,9 @@
 require 'spec_helper'
 require 'puppet_spec/files'
 require 'puppet_spec/compiler'
+require 'puppet_spec/https'
 
-describe "apply" do
+describe "apply", unless: Puppet::Util::Platform.jruby? do
   include PuppetSpec::Files
 
   before :each do
@@ -257,7 +258,7 @@ end
     expect(@logs.map(&:to_s)).to include(/{environment =>.*/)
   end
 
-  it "applies a given file even when an ENC is configured", :unless => Puppet::Util::Platform.windows? || RUBY_PLATFORM == 'java' do
+  it "applies a given file even when an ENC is configured", :unless => Puppet::Util::Platform.windows? || Puppet::Util::Platform.jruby? do
     manifest = file_containing("manifest.pp", "notice('specific manifest applied')")
     enc = script_containing('enc_script',
       :windows => '@echo classes: []' + "\n" + '@echo environment: special',
@@ -378,7 +379,7 @@ end
     # External node script execution will fail, likely due to the tampering
     # with the basic file descriptors.
     # Workaround: Define a log destination and merely inspect logs.
-    context "with an ENC", :unless => RUBY_PLATFORM == 'java' do
+    context "with an ENC" do
       let(:logdest) { tmpfile('logdest') }
       let(:args) { ['-e', execute, '--logdest', logdest ] }
       let(:enc) do
@@ -534,4 +535,132 @@ class amod::bad_type {
       end
     end
   end
+
+  context 'puppet file sources' do
+    let(:env_name) { 'dev' }
+    let(:env_dir) { File.join(Puppet[:environmentpath], env_name) }
+    let(:env) { Puppet::Node::Environment.create(env_name.to_sym, [File.join(env_dir, 'modules')]) }
+    let(:node) { Puppet::Node.new(Puppet[:certname], environment: environment) }
+    let(:apply) { Puppet::Application[:apply] }
+
+    before :each do
+      Puppet[:environment] = env_name
+      Puppet::FileSystem.mkpath(env_dir)
+    end
+
+    it "recursively copies a directory from a module" do
+      dir = File.join(env.full_modulepath, 'amod', 'files', 'dir1', 'dir2')
+      Puppet::FileSystem.mkpath(dir)
+      File.write(File.join(dir, 'file'), 'content from the module')
+
+      base_dir = tmpdir('apply_spec_base')
+      manifest = file_containing("manifest.pp", <<-MANIFEST)
+        file { "#{base_dir}/dir1":
+          ensure  => file,
+          source  => "puppet:///modules/amod/dir1",
+          recurse => true,
+        }
+      MANIFEST
+
+      expect {
+        apply.command_line.args << manifest
+         apply.run
+      }.to exit_with(0)
+       .and output(a_string_matching(
+         /dir1\]\/ensure: created/
+      ).and matching(
+         /dir1\/dir2\]\/ensure: created/
+      ).and matching(
+         /dir1\/dir2\/file\]\/ensure: defined content as '{md5}51f37efb13c3a1e486106f90db6490a5'/
+      )).to_stdout
+
+      dest_file = File.join(base_dir, 'dir1', 'dir2', 'file')
+      expect(File.read(dest_file)).to eq("content from the module")
+    end
+  end
+
+  context 'http report processor' do
+    include_context 'https client'
+
+    before :each do
+      Puppet[:reports] = 'http'
+    end
+
+    let(:apply) { Puppet::Application[:apply] }
+    let(:unknown_server) do
+      unknown_ca_cert = cert_fixture('unknown-ca.pem')
+      PuppetSpec::HTTPSServer.new(
+        ca_cert: unknown_ca_cert,
+        server_cert: cert_fixture('unknown-127.0.0.1.pem'),
+        server_key: key_fixture('unknown-127.0.0.1-key.pem')
+      )
+    end
+
+    it 'submits a report via reporturl' do
+      report = nil
+
+      response_proc = -> (req, res) {
+        report = Puppet::Transaction::Report.convert_from(:yaml, req.body)
+      }
+
+      https = PuppetSpec::HTTPSServer.new
+      https.start_server(response_proc: response_proc) do |https_port|
+        Puppet[:reporturl] = "https://127.0.0.1:#{https_port}/reports/upload"
+
+        expect {
+          apply.command_line.args = ['-e', 'notify { "hi": }']
+          apply.run
+        }.to exit_with(0)
+         .and output(/Applied catalog/).to_stdout
+
+        expect(report).to be_a(Puppet::Transaction::Report)
+        expect(report.resource_statuses['Notify[hi]']).to be_a(Puppet::Resource::Status)
+      end
+    end
+
+    it 'rejects an HTTPS report server whose root cert is not the puppet CA' do
+      unknown_server.start_server do |https_port|
+        Puppet[:reporturl] = "https://127.0.0.1:#{https_port}/reports/upload"
+
+        # processing the report happens after the transaction is finished,
+        # so we expect exit code 0, with a later failure on stderr
+        expect {
+          apply.command_line.args = ['-e', 'notify { "hi": }']
+          apply.run
+        }.to exit_with(0)
+         .and output(/Applied catalog/).to_stdout
+         .and output(/Report processor failed: certificate verify failed \[self signed certificate in certificate chain for CN=Unknown CA\]/).to_stderr
+      end
+    end
+
+    it 'accepts an HTTPS report servers whose cert is in the system CA store' do
+      Puppet[:report_include_system_store] = true
+      report = nil
+
+      response_proc = -> (req, res) {
+        report = Puppet::Transaction::Report.convert_from(:yaml, req.body)
+      }
+
+      # create a temp cacert bundle
+      ssl_file = tmpfile('systemstore')
+      File.write(ssl_file, unknown_server.ca_cert.to_pem)
+
+      unknown_server.start_server(response_proc: response_proc) do |https_port|
+        Puppet[:reporturl] = "https://127.0.0.1:#{https_port}/reports/upload"
+
+        # override path to system cacert bundle, this must be done before
+        # the SSLContext is created and the call to X509::Store.set_default_paths
+        Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+          expect {
+            apply.command_line.args = ['-e', 'notify { "hi": }']
+            apply.run
+          }.to exit_with(0)
+           .and output(/Applied catalog/).to_stdout
+        end
+
+        expect(report).to be_a(Puppet::Transaction::Report)
+        expect(report.resource_statuses['Notify[hi]']).to be_a(Puppet::Resource::Status)
+      end
+    end
+  end
 end