puppet 6.16.0-universal-darwin → 6.20.0-universal-darwin

data/spec/fixtures/unit/provider/package/puppetserver_gem/gem-list-local-packages

@@ -0,0 +1,30 @@
+concurrent-ruby (1.1.5)
+
+deep_merge (1.0.1)
+
+fast_gettext (1.1.2)
+
+gettext (3.2.2)
+
+hiera-eyaml (3.2.0)
+
+highline (1.6.21)
+
+hocon (1.3.1, 1.2.5)
+
+locale (2.1.3, 2.1.2)
+
+multi_json (1.14.1)
+
+optimist (3.0.1)
+
+puppet-resource_api (1.8.13)
+
+puppetserver-ca (1.8.0)
+
+semantic_puppet (1.0.2)
+
+text (1.3.1)
+
+world_airports (1.1.3)
+

data/spec/fixtures/unit/provider/user/aix/aix_passwd_file.out

@@ -6,6 +6,10 @@ test_aix_user:
 no_password_user:
         lastupdate = another_last_update
 
+tab_password_user:
+        password  =  some_password
+        lastupdate = another_last_update
+
 daemon:
         password = *
 

data/spec/integration/application/agent_spec.rb

@@ -15,21 +15,17 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
   let(:formatter) { Puppet::Network::FormatHandler.format(:rich_data_json) }
 
   context 'server_list' do
-    before :each do
-      Puppet[:log_level] = 'debug'
-    end
-
     it "uses the first server in the list" do
       Puppet[:server_list] = '127.0.0.1'
+      Puppet[:log_level] = 'debug'
 
       server.start_server do |port|
-        Puppet[:masterport] = port
+        Puppet[:serverport] = port
         expect {
-          expect {
-            agent.command_line.args << '--test'
-            agent.run
-          }.to exit_with(0)
-        }.to output(%r{HTTP GET https://127.0.0.1:#{port}/status/v1/simple/master returned 200 OK}).to_stdout
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{HTTP GET https://127.0.0.1:#{port}/status/v1/simple/master returned 200 OK}).to_stdout
       end
     end
 
@@ -37,16 +33,17 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
       Puppet[:server_list] = "puppet.example.com,#{Puppet[:server]}"
 
       server.start_server do |port|
-        Puppet[:masterport] = port
+        Puppet[:serverport] = port
         expect {
-          expect {
-            agent.command_line.args << '--test'
-            agent.run
-          }.to exit_with(0)
-        }.to output(%r{Unable to connect to server from server_list setting: Request to https://puppet.example.com:#{port}/status/v1/simple/master failed}).to_stdout
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{Notice: Applied catalog}).to_stdout
+         .and output(%r{Unable to connect to server from server_list setting: Request to https://puppet.example.com:#{port}/status/v1/simple/master failed}).to_stderr
 
         report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
         expect(report.master_used).to eq("127.0.0.1:#{port}")
+        expect(report.server_used).to eq("127.0.0.1:#{port}")
       end
     end
 
@@ -54,40 +51,59 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
       Puppet[:server_list] = "puppet.example.com"
 
       expect {
-        expect {
-          expect {
-            agent.command_line.args << '--test'
-            agent.run
-          }.to exit_with(1)
-        }.to output(%r{Unable to connect to server from server_list setting: Could not select a functional puppet master from server_list: 'puppet.example.com'}).to_stdout
-      }.to output(/Error: Could not run Puppet configuration client: Could not select a functional puppet master from server_list: 'puppet.example.com'/).to_stderr
+        agent.command_line.args << '--test'
+        agent.run
+      }.to exit_with(1)
+       .and output(a_string_matching(%r{Unable to connect to server from server_list setting})
+       .and matching(/Error: Could not run Puppet configuration client: Could not select a functional puppet server from server_list: 'puppet.example.com'/)).to_stderr
 
       # I'd expect puppet to update the last run report even if the server_list was
       # exhausted, but it doesn't work that way currently, see PUP-6708
       expect(File).to_not be_exist(Puppet[:lastrunreport])
     end
 
-    it "omits master_used when not using server_list" do
+    it "omits server_used when not using server_list" do
+      Puppet[:log_level] = 'debug'
+
       server.start_server do |port|
-        Puppet[:masterport] = port
+        Puppet[:serverport] = port
         expect {
-          expect {
-            agent.command_line.args << '--test'
-            agent.run
-          }.to exit_with(0)
-        }.to output(%r{Resolved service 'puppet' to https://127.0.0.1:#{port}/puppet/v3}).to_stdout
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{Resolved service 'puppet' to https://127.0.0.1:#{port}/puppet/v3}).to_stdout
       end
 
       report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
       expect(report.master_used).to be_nil
+      expect(report.server_used).to be_nil
+    end
+
+    it "server_list takes precedence over server" do
+      Puppet[:server] = 'notvalid.example.com'
+      Puppet[:log_level] = 'debug'
+
+      server.start_server do |port|
+        Puppet[:server_list] = "127.0.0.1:#{port}"
+
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{Debug: Resolved service 'puppet' to https://127.0.0.1:#{port}/puppet/v3}).to_stdout
+
+        report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
+        expect(report.master_used).to eq("127.0.0.1:#{port}")
+        expect(report.server_used).to eq("127.0.0.1:#{port}")
+      end
     end
   end
 
   context 'rich data' do
-    it "applies deferred values" do
+    it "calls a deferred 4x function" do
       catalog_handler = -> (req, res) {
         catalog = compile_to_catalog(<<-MANIFEST, node)
-          notify { 'deferred':
+          notify { 'deferred4x':
             message => Deferred('join', [[1,2,3], ':'])
           }
         MANIFEST
@@ -97,13 +113,71 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
       }
 
       server.start_server(mounts: {catalog: catalog_handler}) do |port|
-        Puppet[:masterport] = port
+        Puppet[:serverport] = port
         expect {
-          expect {
-            agent.command_line.args << '--test'
-            agent.run
-          }.to exit_with(2)
-        }.to output(%r{Notice: /Stage\[main\]/Main/Notify\[deferred\]/message: defined 'message' as '1:2:3'}).to_stdout
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(%r{Notice: /Stage\[main\]/Main/Notify\[deferred4x\]/message: defined 'message' as '1:2:3'}).to_stdout
+      end
+    end
+
+    it "calls a deferred 3x function" do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          notify { 'deferred3x':
+            message => Deferred('sprintf', ['%s', 'I am deferred'])
+          }
+        MANIFEST
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(%r{Notice: /Stage\[main\]/Main/Notify\[deferred3x\]/message: defined 'message' as 'I am deferred'}).to_stdout
+      end
+    end
+
+    it "re-evaluates a deferred function in a cached catalog" do
+      Puppet[:report] = false
+      Puppet[:use_cached_catalog] = true
+      Puppet[:usecacheonfailure] = false
+
+      catalog_dir = File.join(Puppet[:client_datadir], 'catalog')
+      Puppet::FileSystem.mkpath(catalog_dir)
+      cached_catalog_path = "#{File.join(catalog_dir, Puppet[:certname])}.json"
+
+      # our catalog contains a deferred function that calls `binary_file`
+      # to read `source`. The function returns a Binary object, whose
+      # base64 value is printed to stdout
+      source = tmpfile('deferred_source')
+      catalog = File.read(my_fixture('cached_deferred_catalog.json'))
+      catalog.gsub!('__SOURCE_PATH__', source)
+      File.write(cached_catalog_path, catalog)
+
+      # verify we get a different result each time the deferred function
+      # is evaluated, and reads `source`.
+      {
+        '1234' => 'MTIzNA==',
+        '5678' => 'NTY3OA=='
+      }.each_pair do |content, base64|
+        File.write(source, content)
+
+        expect {
+          agent.command_line.args << '-t'
+          agent.run
+
+        }.to exit_with(2)
+         .and output(/Notice: #{base64}/).to_stdout
+
+        # reset state so we can run again
+        Puppet::Application.clear!
       end
     end
 
@@ -120,19 +194,40 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
       }
 
       server.start_server(mounts: {catalog: catalog_handler}) do |port|
-        Puppet[:masterport] = port
+        Puppet[:serverport] = port
         expect {
-          expect {
-            agent.command_line.args << '--test'
-            agent.run
-          }.to exit_with(2)
-        }.to output(a_string_matching(
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(a_string_matching(
           /Notice: Sensitive \[value redacted\]/
         ).and matching(
           /Notify\[sensitive\]\/message: changed \[redacted\] to \[redacted\]/
         )).to_stdout
       end
     end
+
+    it "applies binary data in a cached catalog" do
+      catalog = compile_to_catalog(<<-MANIFEST, node)
+          notify { 'some title':
+            message => Binary.new('aGk=')
+          }
+        MANIFEST
+
+      catalog_dir = File.join(Puppet[:client_datadir], 'catalog')
+      Puppet::FileSystem.mkpath(catalog_dir)
+      cached_catalog = "#{File.join(catalog_dir, Puppet[:certname])}.json"
+      File.write(cached_catalog, catalog.render(:rich_data_json))
+
+      expect {
+        Puppet[:report] = false
+        Puppet[:use_cached_catalog] = true
+        Puppet[:usecacheonfailure] = false
+        agent.command_line.args << '-t'
+        agent.run
+      }.to exit_with(2)
+       .and output(%r{defined 'message' as 'hi'}).to_stdout
+    end
   end
 
   context 'static catalogs' do
@@ -163,7 +258,7 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
       }
 
       server.start_server(mounts: {catalog: catalog_handler}) do |port|
-        Puppet[:masterport] = port
+        Puppet[:serverport] = port
         expect {
           expect {
             agent.command_line.args << '--test'
@@ -208,13 +303,12 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
       }
 
       server.start_server(mounts: mounts) do |port|
-        Puppet[:masterport] = port
+        Puppet[:serverport] = port
         expect {
-          expect {
-            agent.command_line.args << '--test'
-            agent.run
-          }.to exit_with(2)
-        }.to output(/content changed '{md5}d41d8cd98f00b204e9800998ecf8427e' to '{md5}4cf49285ae567157ebfba72bd04ccf32'/).to_stdout
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(/content changed '{md5}d41d8cd98f00b204e9800998ecf8427e' to '{md5}4cf49285ae567157ebfba72bd04ccf32'/).to_stdout
 
         # verify puppet restored binary content
         expect(File.binread(path)).to eq(binary_content)
@@ -257,7 +351,7 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
         }
 
         server.start_server(mounts: {catalog: catalog_handler}) do |puppetserver_port|
-          Puppet[:masterport] = puppetserver_port
+          Puppet[:serverport] = puppetserver_port
 
           # override path to system cacert bundle, this must be done before
           # the SSLContext is created and the call to X509::Store.set_default_paths
@@ -309,7 +403,7 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
         }
 
         server.start_server(mounts: {catalog: catalog_handler}) do |puppetserver_port|
-          Puppet[:masterport] = puppetserver_port
+          Puppet[:serverport] = puppetserver_port
 
           # override path to system cacert bundle, this must be done before
           # the SSLContext is created and the call to X509::Store.set_default_paths
@@ -325,6 +419,56 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
         end
       end
     end
+
+    it 'accepts HTTPS servers whose cert is in the external CA store' do
+      unknown_ca_cert = cert_fixture('unknown-ca.pem')
+      https = PuppetSpec::HTTPSServer.new(
+        ca_cert: unknown_ca_cert,
+        server_cert: cert_fixture('unknown-127.0.0.1.pem'),
+        server_key: key_fixture('unknown-127.0.0.1-key.pem')
+      )
+
+      # create a temp cacert bundle
+      ssl_file = tmpfile('systemstore')
+      File.write(ssl_file, unknown_ca_cert.to_pem)
+
+      response_proc = -> (req, res) {
+        res.status = 200
+        res.body = response_body
+      }
+
+      https.start_server(response_proc: response_proc) do |https_port|
+        catalog_handler = -> (req, res) {
+          catalog = compile_to_catalog(<<-MANIFEST, node)
+            file { "#{path}":
+              ensure => file,
+              backup => false,
+              checksum => sha1,
+              checksum_value => '#{digest}',
+              source => "https://127.0.0.1:#{https_port}/path/to/file"
+            }
+          MANIFEST
+
+          res.body = formatter.render(catalog)
+          res['Content-Type'] = formatter.mime
+        }
+
+        server.start_server(mounts: {catalog: catalog_handler}) do |puppetserver_port|
+          Puppet[:serverport] = puppetserver_port
+
+          # set path to external cacert bundle, this must be done before
+          # the SSLContext is created
+          Puppet[:ssl_trust_store] = ssl_file
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(2)
+           .and output(%r{https_file_source.*/ensure: created}).to_stdout
+        end
+
+        expect(File.binread(path)).to eq("from https server")
+      end
+    end
   end
 
   context 'multiple agents running' do
@@ -350,7 +494,7 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
     it "waits for other agent run to finish before starting" do
       server.start_server do |port|
         path = Puppet[:agent_catalog_run_lockfile]
-        Puppet[:masterport] = port
+        Puppet[:serverport] = port
         Puppet[:waitforlock] = 1
 
         th = Thread.new {
@@ -391,4 +535,69 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
       th.kill # kill thread so we don't wait too much
     end
   end
+
+  context 'cached catalogs' do
+    it 'falls back to a cached catalog' do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          notify { 'a message': }
+        MANIFEST
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(%r{Caching catalog for #{Puppet[:certname]}}).to_stdout
+      end
+
+      # reset state so we can run again
+      Puppet::Application.clear!
+
+      # --test above turns off `usecacheonfailure` so re-enable here
+      Puppet[:usecacheonfailure] = true
+
+      # run agent without server
+      expect {
+        agent.command_line.args << '--no-daemonize' << '--onetime' << '--server' << '127.0.0.1'
+        agent.run
+      }.to exit_with(2)
+       .and output(a_string_matching(
+         /Using cached catalog from environment 'production'/
+       ).and matching(
+         /Notify\[a message\]\/message:/
+       )).to_stdout
+       .and output(/the agent run will continue/).to_stderr
+    end
+
+    it 'preserves the old cached catalog if validation fails with the old one' do
+      catalog_handler = -> (req, res) {
+        catalog = compile_to_catalog(<<-MANIFEST, node)
+          exec { 'unqualified_command': }
+        MANIFEST
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: {catalog: catalog_handler}) do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(1)
+         .and output(/Using configured environment/).to_stdout
+         .and output(%r{Validation of Exec\[unqualified_command\] failed: 'unqualified_command' is not qualified and no path was specified}).to_stderr
+      end
+
+      # cached catalog should not be updated
+      cached_catalog = "#{File.join(Puppet[:client_datadir], 'catalog', Puppet[:certname])}.json"
+      expect(File).to_not be_exist(cached_catalog)
+    end
+  end
 end