puppet 6.14.0 → 6.15.0

data/spec/integration/application/filebucket_spec.rb

@@ -0,0 +1,190 @@
+require 'spec_helper'
+require 'puppet/face'
+require 'puppet_spec/puppetserver'
+require 'puppet_spec/files'
+
+describe "puppet filebucket", unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
+  include_context "https client"
+
+  let(:server) { PuppetSpec::Puppetserver.new }
+  let(:filebucket) { Puppet::Application[:filebucket] }
+  let(:backup_file) { tmpfile('backup_file') }
+
+  before :each do
+    Puppet[:log_level] = 'debug'
+  end
+
+  it "backs up files to the filebucket server" do
+    File.binwrite(backup_file, 'some random text')
+    md5 = Digest::MD5.file(backup_file).to_s
+
+    server.start_server do |port|
+      Puppet[:masterport] = port
+      expect {
+        filebucket.command_line.args << 'backup'
+        filebucket.command_line.args << backup_file
+        filebucket.run
+      }.to output(a_string_matching(
+        %r{Debug: HTTP HEAD https:\/\/127.0.0.1:#{port}\/puppet\/v3\/file_bucket_file\/md5\/#{md5}\/#{File.realpath(backup_file)}\?environment\=production returned 404 Not Found}
+      ).and matching(
+        %r{Debug: HTTP PUT https:\/\/127.0.0.1:#{port}\/puppet\/v3\/file_bucket_file\/md5\/#{md5}\/#{File.realpath(backup_file)}\?environment\=production returned 200 OK}
+      ).and matching(
+        %r{#{backup_file}: #{md5}}
+      )).to_stdout
+    end
+  end
+
+  it "doesn't attempt to back up file that already exists on the filebucket server" do
+    file_exists_handler = -> (req, res) {
+        res.status = 200
+    }
+
+    File.binwrite(backup_file, 'some random text')
+    md5 = Digest::MD5.file(backup_file).to_s
+
+    server.start_server(mounts: {filebucket: file_exists_handler}) do |port|
+      Puppet[:masterport] = port
+      expect {
+        filebucket.command_line.args << 'backup'
+        filebucket.command_line.args << backup_file
+        filebucket.run
+      }.to output(a_string_matching(
+        %r{Debug: HTTP HEAD https:\/\/127.0.0.1:#{port}\/puppet\/v3\/file_bucket_file\/md5\/#{md5}\/#{File.realpath(backup_file)}\?environment\=production returned 200 OK}
+      ).and matching(
+        %r{#{backup_file}: #{md5}}
+      )).to_stdout
+    end
+  end
+
+  it "downloads files from the filebucket server" do
+    get_handler = -> (req, res) {
+      res['Content-Type'] = 'application/octet-stream'
+      res.body = 'something to store'
+    }
+
+    server.start_server(mounts: {filebucket: get_handler}) do |port|
+      Puppet[:masterport] = port
+      expect {
+        filebucket.command_line.args << 'get'
+        filebucket.command_line.args << 'fac251367c9e083c6b1f0f3181'
+        filebucket.run
+      }.to output(a_string_matching(
+        %r{Debug: HTTP GET https:\/\/127.0.0.1:#{port}\/puppet\/v3\/file_bucket_file\/md5\/fac251367c9e083c6b1f0f3181\?environment\=production returned 200 OK}
+      ).and matching(
+        %r{something to store}
+       )).to_stdout
+    end
+  end
+
+  context 'diff', unless: Puppet::Util::Platform.windows? || Puppet::Util::Platform.jruby? do
+    context 'using a remote bucket' do
+      it 'outputs a diff between a local and remote file' do
+        File.binwrite(backup_file, "bar\nbaz")
+
+        get_handler = -> (req, res) {
+          res['Content-Type'] = 'application/octet-stream'
+          res.body = 'foo'
+        }
+
+        server.start_server(mounts: {filebucket: get_handler}) do |port|
+          Puppet[:masterport] = port
+          expect {
+            filebucket.command_line.args += ['diff', 'fac251367c9e083c6b1f0f3181', backup_file, '--remote']
+            filebucket.run
+          }.to output(a_string_matching(
+            /[-<] ?foo/
+          ).and matching(
+            /[+>] ?bar/
+          ).and matching(
+            /[+>] ?baz/
+          )).to_stdout
+        end
+      end
+
+      it 'outputs a diff between two remote files' do
+        get_handler = -> (req, res) {
+          res['Content-Type'] = 'application/octet-stream'
+          res.body = <<~END
+          --- /opt/puppetlabs/server/data/puppetserver/bucket/d/3/b/0/7/3/8/4/d3b07384d113edec49eaa6238ad5ff00/contents\t2020-04-06 21:25:24.892367570 +0000
+          +++ /opt/puppetlabs/server/data/puppetserver/bucket/9/9/b/9/9/9/2/0/99b999207e287afffc86c053e5693247/contents\t2020-04-06 21:26:13.603398063 +0000
+          @@ -1 +1,2 @@
+          -foo
+          +bar
+          +baz
+          END
+        }
+
+        server.start_server(mounts: {filebucket: get_handler}) do |port|
+          Puppet[:masterport] = port
+          expect {
+            filebucket.command_line.args += ['diff', 'd3b07384d113edec49eaa6238ad5ff00', "99b999207e287afffc86c053e5693247", '--remote']
+            filebucket.run
+          }.to output(a_string_matching(
+            /[-<] ?foo/
+          ).and matching(
+            /[+>] ?bar/
+          ).and matching(
+            /[+>] ?baz/
+          )).to_stdout
+        end
+      end
+    end
+
+    context 'using a local bucket' do
+      let(:filea) {
+        f = tmpfile('filea')
+        File.binwrite(f, 'foo')
+        f
+      }
+      let(:fileb) {
+        f = tmpfile('fileb')
+        File.binwrite(f, "bar\nbaz")
+        f
+      }
+      let(:checksuma) { Digest::MD5.file(filea).to_s }
+      let(:checksumb) { Digest::MD5.file(fileb).to_s }
+
+      it 'compares to files stored in a local bucket' do
+        expect {
+          filebucket.command_line.args = ['backup', filea, '--local']
+          filebucket.run
+        }.to output(/#{filea}: #{checksuma}/).to_stdout
+
+        expect{
+          filebucket.command_line.args = ['backup', fileb, '--local']
+          filebucket.run
+        }.to output(/#{fileb}: #{checksumb}\n/).to_stdout
+
+        expect {
+          filebucket.command_line.args = ['diff', checksuma, checksumb, '--local']
+          filebucket.run
+        }.to output(a_string_matching(
+          /[-<] ?foo/
+        ).and matching(
+          /[+>] ?bar/
+        ).and matching(
+          /[+>] ?baz/
+        )).to_stdout
+      end
+
+      it 'compares a file on the filesystem and a file stored in a local bucket' do
+        expect {
+          filebucket.command_line.args = ['backup', filea, '--local']
+          filebucket.run
+        }.to output(/#{filea}: #{checksuma}/).to_stdout
+
+        expect {
+          filebucket.command_line.args = ['diff', checksuma, fileb, '--local']
+          filebucket.run
+        }.to output(a_string_matching(
+          /[-<] ?foo/
+        ).and matching(
+          /[+>] ?bar/
+        ).and matching(
+          /[+>] ?baz/
+        )).to_stdout
+      end
+    end
+  end
+end

data/spec/integration/application/plugin_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+require 'puppet/face'
+require 'puppet_spec/puppetserver'
+
+describe "puppet plugin" do
+  include_context "https client"
+
+  let(:server) { PuppetSpec::Puppetserver.new }
+  let(:plugin) { Puppet::Application[:plugin] }
+  let(:response_body) { "[{\"path\":\"/etc/puppetlabs/code/environments/production/modules\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-03-06 20:14:25 UTC\"},\"type\":\"directory\",\"destination\":null}]" }
+
+  it "downloads from plugins, pluginsfacts and locales mounts" do
+    current_version_handler = -> (req, res) {
+      res['X-Puppet-Version'] = Puppet.version
+      res['Content-Type'] = 'application/json'
+      res.body = response_body
+    }
+
+    server.start_server(mounts: {file_metadatas: current_version_handler}) do |port|
+      Puppet[:masterport] = port
+      expect {
+        plugin.command_line.args << 'download'
+        plugin.run
+      }.to exit_with(0)
+       .and output(matching(
+         "Downloaded these plugins: #{Regexp.escape(Puppet[:pluginfactdest])}, #{Regexp.escape(Puppet[:plugindest])}, #{Regexp.escape(Puppet[:localedest])}"
+       )).to_stdout
+    end
+  end
+
+  it "downloads from plugins and pluginsfacts from older puppetservers" do
+    no_locales_handler = -> (req, res) {
+      res['X-Puppet-Version'] = '5.3.3' # locales mount was added in 5.3.4
+      res['Content-Type'] = 'application/json'
+      res.body = response_body
+    }
+
+    server.start_server(mounts: {file_metadatas: no_locales_handler}) do |port|
+      Puppet[:masterport] = port
+      expect {
+        plugin.command_line.args << 'download'
+        plugin.run
+      }.to exit_with(0)
+       .and output(matching(
+         "Downloaded these plugins: #{Regexp.escape(Puppet[:pluginfactdest])}, #{Regexp.escape(Puppet[:plugindest])}"
+       )).to_stdout
+    end
+  end
+
+end

data/spec/integration/http/client_spec.rb

@@ -4,31 +4,17 @@ require 'puppet_spec/files'
 
 describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
   include PuppetSpec::Files
+  include_context "https client"
 
-  before :all do
-    WebMock.disable!
-  end
-
-  after :all do
-    WebMock.enable!
-  end
-
-  before :each do
-    # make sure we don't take too long
-    Puppet[:http_connect_timeout] = '5s'
-  end
-
-  let(:hostname) { '127.0.0.1' }
   let(:wrong_hostname) { 'localhost' }
-  let(:server) { PuppetSpec::HTTPSServer.new }
   let(:client) { Puppet::HTTP::Client.new }
   let(:ssl_provider) { Puppet::SSL::SSLProvider.new }
-  let(:root_context) { ssl_provider.create_root_context(cacerts: [server.ca_cert], crls: [server.ca_crl]) }
+  let(:root_context) { ssl_provider.create_root_context(cacerts: [https_server.ca_cert], crls: [https_server.ca_crl]) }
 
   context "when verifying an HTTPS server" do
     it "connects over SSL" do
-      server.start_server do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+      https_server.start_server do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
         expect(res).to be_success
       end
     end
@@ -41,14 +27,14 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
       port = tcps.connect_address.ip_port
 
       expect {
-        client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+        client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
       }.to raise_error(Puppet::HTTP::ConnectionError, %r{^Request to https://127.0.0.1:#{port} timed out connect operation after .* seconds})
     end
 
     it "raises if the server's cert doesn't match the hostname we connected to" do
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://#{wrong_hostname}:#{port}"), ssl_context: root_context)
+          client.get(URI("https://#{wrong_hostname}:#{port}"), options: {ssl_context: root_context})
         }.to raise_error { |err|
           expect(err).to be_instance_of(Puppet::SSL::CertMismatchError)
           expect(err.message).to match(/Server hostname '#{wrong_hostname}' did not match server certificate; expected one of (.+)/)
@@ -63,9 +49,9 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
       wrong_ca = cert_fixture('netlock-arany-utf8.pem')
       alt_context = ssl_provider.create_root_context(cacerts: [wrong_ca], revocation: false)
 
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://127.0.0.1:#{port}"), ssl_context: alt_context)
+          client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: alt_context})
         }.to raise_error(Puppet::SSL::CertVerifyError,
                          %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
       end
@@ -73,8 +59,8 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
     it "prints TLS protocol and ciphersuite in debug" do
       Puppet[:log_level] = 'debug'
-      server.start_server do |port|
-        client.get(URI("https://127.0.0.1:#{port}"), ssl_context: root_context)
+      https_server.start_server do |port|
+        client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
         # TLS version string can be TLSv1 or TLSv1.[1-3], but not TLSv1.0
         expect(@logs).to include(
           an_object_having_attributes(level: :debug, message: /Using TLSv1(\.[1-3])? with cipher .*/),
@@ -93,12 +79,12 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
     it "mutually authenticates the connection" do
       client_context = ssl_provider.create_context(
-        cacerts: [server.ca_cert], crls: [server.ca_crl],
-        client_cert: server.server_cert, private_key: server.server_key
+        cacerts: [https_server.ca_cert], crls: [https_server.ca_crl],
+        client_cert: https_server.server_cert, private_key: https_server.server_key
       )
 
-      server.start_server(ctx_proc: ctx_proc) do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: client_context)
+      https_server.start_server(ctx_proc: ctx_proc) do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: client_context})
         expect(res).to be_success
       end
     end
@@ -106,10 +92,10 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
   context "with a system trust store" do
     it "connects when the client trusts the server's CA" do
-      system_context = ssl_provider.create_system_context(cacerts: [server.ca_cert])
+      system_context = ssl_provider.create_system_context(cacerts: [https_server.ca_cert])
 
-      server.start_server do |port|
-        res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+      https_server.start_server do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
         expect(res).to be_success
       end
     end
@@ -117,14 +103,14 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
     it "connects when the server's CA is in the system store" do
       # create a temp cacert bundle
       ssl_file = tmpfile('systemstore')
-      File.write(ssl_file, server.ca_cert)
+      File.write(ssl_file, https_server.ca_cert)
 
       # override path to system cacert bundle, this must be done before
       # the SSLContext is created and the call to X509::Store.set_default_paths
       Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
         system_context = ssl_provider.create_system_context(cacerts: [])
-        server.start_server do |port|
-          res = client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+        https_server.start_server do |port|
+          res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
           expect(res).to be_success
         end
       end
@@ -133,9 +119,9 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
     it "raises if the server's CA is not in the context or system store" do
       system_context = ssl_provider.create_system_context(cacerts: [cert_fixture('netlock-arany-utf8.pem')])
 
-      server.start_server do |port|
+      https_server.start_server do |port|
         expect {
-          client.get(URI("https://127.0.0.1:#{port}"), ssl_context: system_context)
+          client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
         }.to raise_error(Puppet::SSL::CertVerifyError,
                          %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
       end
@@ -144,11 +130,19 @@ describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
 
   context 'persistent connections' do
     it "detects when the server has closed the connection and reconnects" do
-      server.start_server do |port|
+      Puppet[:http_debug] = true
+
+      https_server.start_server do |port|
         uri = URI("https://127.0.0.1:#{port}")
+        kwargs = {headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: root_context}}
 
-        expect(client.get(uri, ssl_context: root_context)).to be_success
-        expect(client.get(uri, ssl_context: root_context)).to be_success
+        expect {
+          expect(client.post(uri, '', **kwargs)).to be_success
+          # the server closes its connection after each request, so posting
+          # again will force ruby to detect that the remote side closed the
+          # connection, and reconnect
+          expect(client.post(uri, '', **kwargs)).to be_success
+        }.to output(/Conn close because of EOF/).to_stderr
       end
     end
   end

data/spec/integration/indirector/report/yaml.rb

@@ -0,0 +1,83 @@
+require 'spec_helper'
+
+require 'puppet/transaction/report'
+require 'puppet/indirector/report/yaml'
+
+describe Puppet::Transaction::Report::Yaml do
+  describe '#save' do
+    subject(:indirection) { described_class.indirection }
+
+    let(:request) { described_class.new }
+    let(:certname) { 'ziggy' }
+    let(:report) do
+      report = Puppet::Transaction::Report.new
+      report.host = certname
+      report
+    end
+    let(:file) { request.path(:me) }
+
+    before do
+      indirection.terminus_class = :yaml
+    end
+
+    it 'is saves a report' do
+      indirection.save(report)
+    end
+
+    it 'saves the instance of the report as YAML to disk' do
+      indirection.save(report)
+      content = Puppet::Util::Yaml.safe_load_file(
+        Puppet[:lastrunreport], [Puppet::Transaction::Report]
+      )
+      expect(content.host).to eq(certname)
+    end
+
+    it 'allows mode overwrite' do
+      Puppet.settings.setting(:lastrunreport).mode = '0644'
+      indirection.save(report)
+
+      if Puppet::Util::Platform.windows?
+        require 'puppet/util/windows/security'
+        mode = Puppet::Util::Windows::Security.get_mode(file)
+      else
+        mode = Puppet::FileSystem.stat(file).mode
+      end
+
+      expect(mode & 07777).to eq(0644)
+    end
+
+    context 'when mode is invalid' do
+      before do
+        Puppet.settings.setting(:lastrunreport).mode = '9999'
+      end
+
+      after do
+        Puppet.settings.setting(:lastrunreport).mode = '0644'
+      end
+
+      it 'raises Puppet::DevError ' do
+        expect{
+          indirection.save(report)
+        }.to raise_error(Puppet::DevError, "replace_file mode: 9999 is invalid")
+      end
+    end
+
+    context 'when repport is invalid' do
+      it 'logs error' do
+        expect(Puppet).to receive(:send_log).with(:err, /Could not save yaml ziggy: can't dump anonymous class/)
+
+        report.configuration_version = Class.new
+        indirection.save(report)
+      end
+    end
+
+    context 'when report cannot be saved' do
+      it 'raises Errno::EISDIR' do
+        FileUtils.mkdir_p(file)
+        expect {
+          indirection.save(report)
+         }.to raise_error(Errno::EISDIR, /last_run_report.yaml/)
+      end
+    end
+  end
+end