puppet 6.16.0 → 7.0.0

data/spec/unit/configurer/plugin_handler_spec.rb

@@ -19,30 +19,68 @@ describe Puppet::Configurer::PluginHandler do
       end
     end
 
-    it "downloads plugins, facts, and locales" do
-      times_called = 0
-      allow_any_instance_of(Puppet::Configurer::Downloader).to receive(:evaluate) { times_called += 1 }.and_return([])
+    context "when i18n is enabled" do
+      before :each do
+        Puppet[:disable_i18n] = false
+      end
 
-      pluginhandler.download_plugins(environment)
-      expect(times_called).to eq(3)
-    end
+      it "downloads plugins, facts, and locales" do
+        times_called = 0
+        allow_any_instance_of(Puppet::Configurer::Downloader).to receive(:evaluate) { times_called += 1 }.and_return([])
 
-    it "returns downloaded plugin, fact, and locale filenames" do
-      times_called = 0
-      allow_any_instance_of(Puppet::Configurer::Downloader).to receive(:evaluate) do
-        times_called += 1
+        pluginhandler.download_plugins(environment)
+        expect(times_called).to eq(3)
+      end
 
-        if times_called == 1
-          %w[/a]
-        elsif times_called == 2
-          %w[/b]
-        else
-          %w[/c]
+      it "returns downloaded plugin, fact, and locale filenames" do
+        times_called = 0
+        allow_any_instance_of(Puppet::Configurer::Downloader).to receive(:evaluate) do
+          times_called += 1
+
+          if times_called == 1
+            %w[/a]
+          elsif times_called == 2
+            %w[/b]
+          else
+            %w[/c]
+          end
         end
+
+        expect(pluginhandler.download_plugins(environment)).to match_array(%w[/a /b /c])
+        expect(times_called).to eq(3)
+      end
+    end
+
+    context "when i18n is disabled" do
+      before :each do
+        Puppet[:disable_i18n] = true
+      end
+
+      it "downloads plugins, facts, but no locales" do
+        times_called = 0
+        allow_any_instance_of(Puppet::Configurer::Downloader).to receive(:evaluate) { times_called += 1 }.and_return([])
+
+        pluginhandler.download_plugins(environment)
+        expect(times_called).to eq(2)
       end
 
-      expect(pluginhandler.download_plugins(environment)).to match_array(%w[/a /b /c])
-      expect(times_called).to eq(3)
+      it "returns downloaded plugin, fact, and locale filenames" do
+        times_called = 0
+        allow_any_instance_of(Puppet::Configurer::Downloader).to receive(:evaluate) do
+          times_called += 1
+
+          if times_called == 1
+            %w[/a]
+          elsif times_called == 2
+            %w[/b]
+          else
+            %w[/c]
+          end
+        end
+
+        expect(pluginhandler.download_plugins(environment)).to match_array(%w[/a /b])
+        expect(times_called).to eq(2)
+      end
     end
   end
 

data/spec/unit/configurer_spec.rb

@@ -1,6 +1,5 @@
 require 'spec_helper'
 require 'puppet/configurer'
-require 'webmock/rspec'
 
 describe Puppet::Configurer do
   before do
@@ -85,6 +84,44 @@ describe Puppet::Configurer do
       expect(configurer.run).to eq(0)
     end
 
+    it "fails the run if pluginsync fails when usecacheonfailure is false" do
+      Puppet[:ignore_plugin_errors] = false
+
+      # --test implies these, set them so we don't fall back to a cached catalog
+      Puppet[:use_cached_catalog] = false
+      Puppet[:usecacheonfailure] = false
+
+      body = "{\"message\":\"Not Found: Could not find environment 'fasdfad'\",\"issue_kind\":\"RUNTIME_ERROR\"}"
+      stub_request(:get, %r{/puppet/v3/file_metadatas/pluginfacts}).to_return(
+        status: 404, body: body, headers: {'Content-Type' => 'application/json'}
+      )
+      stub_request(:get, %r{/puppet/v3/file_metadata/pluginfacts}).to_return(
+        status: 404, body: body, headers: {'Content-Type' => 'application/json'}
+      )
+
+      configurer.run(pluginsync: true)
+
+      expect(@logs).to include(an_object_having_attributes(level: :err, message: %r{Failed to apply catalog: Failed to retrieve pluginfacts: Could not retrieve information from environment production source\(s\) puppet:///pluginfacts}))
+    end
+
+    it "applies a cached catalog if pluginsync fails when usecacheonfailure is true" do
+      Puppet[:ignore_plugin_errors] = false
+
+      Puppet[:use_cached_catalog] = false
+      Puppet[:usecacheonfailure] = true
+
+      body = "{\"message\":\"Not Found: Could not find environment 'fasdfad'\",\"issue_kind\":\"RUNTIME_ERROR\"}"
+      stub_request(:get, %r{/puppet/v3/file_metadatas/pluginfacts}).to_return(
+        status: 404, body: body, headers: {'Content-Type' => 'application/json'}
+      )
+      stub_request(:get, %r{/puppet/v3/file_metadata/pluginfacts}).to_return(
+        status: 404, body: body, headers: {'Content-Type' => 'application/json'}
+      )
+
+      expect(configurer.run(pluginsync: true, :report => report)).to eq(0)
+      expect(report.cached_catalog_status).to eq('on_failure')
+    end
+
     it "applies a cached catalog when it can't connect to the master" do
       error = Errno::ECONNREFUSED.new('Connection refused - connect(2)')
 
@@ -96,7 +133,8 @@ describe Puppet::Configurer do
     end
 
     it "should initialize a transaction report if one is not provided" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
+      # host and settings catalogs each create a report...
+      expect(Puppet::Transaction::Report).to receive(:new).and_return(report).twice
 
       configurer.run
     end
@@ -192,22 +230,21 @@ describe Puppet::Configurer do
     end
 
     it "should remove the report as a log destination when the run is finished" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
-
-      configurer.run
+      configurer.run(report: report)
 
       expect(Puppet::Util::Log.destinations).not_to include(report)
     end
 
-    it "should return the report exit_status as the result of the run" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
-      expect(report).to receive(:exit_status).and_return(1234)
+    it "should return an exit status of 2 due to the notify resource 'changing'" do
+      cat = Puppet::Resource::Catalog.new("tester", Puppet::Node::Environment.remote(Puppet[:environment].to_sym))
+      cat.add_resource(Puppet::Type.type(:notify).new(:name => 'something changed'))
 
-      expect(configurer.run).to eq(1234)
+      expect(configurer.run(catalog: cat, report: report)).to eq(2)
     end
 
     it "should return nil if catalog application fails" do
-      expect_any_instance_of(Puppet::Resource::Catalog).to receive(:apply).and_raise(Puppet::Error, 'One or more resource dependency cycles detected in graph')
+      expect(catalog).to receive(:apply).and_raise(Puppet::Error, 'One or more resource dependency cycles detected in graph')
+
       expect(configurer.run(catalog: catalog, report: report)).to be_nil
     end
 
@@ -222,34 +259,28 @@ describe Puppet::Configurer do
     end
 
     it "should include the pre-run command failure in the report" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
-
       Puppet.settings[:prerun_command] = "/my/command"
       expect(Puppet::Util::Execution).to receive(:execute).with(["/my/command"]).and_raise(Puppet::ExecutionFailure, "Failed")
 
-      expect(configurer.run).to be_nil
+      expect(configurer.run(report: report)).to be_nil
       expect(report.logs.find { |x| x.message =~ /Could not run command from prerun_command/ }).to be
     end
 
     it "should send the transaction report even if the post-run command fails" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
-
       Puppet.settings[:postrun_command] = "/my/command"
       expect(Puppet::Util::Execution).to receive(:execute).with(["/my/command"]).and_raise(Puppet::ExecutionFailure, "Failed")
       expect(configurer).to receive(:send_report).with(report)
 
-      expect(configurer.run).to be_nil
+      expect(configurer.run(report: report)).to be_nil
     end
 
     it "should include the post-run command failure in the report" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
-
       Puppet.settings[:postrun_command] = "/my/command"
       expect(Puppet::Util::Execution).to receive(:execute).with(["/my/command"]).and_raise(Puppet::ExecutionFailure, "Failed")
 
       expect(report).to receive(:<<) { |log, _| expect(log.message).to match(/Could not run command from postrun_command/) }.at_least(:once)
 
-      expect(configurer.run).to be_nil
+      expect(configurer.run(report: report)).to be_nil
     end
 
     it "should execute post-run command even if the pre-run command fails" do
@@ -262,34 +293,28 @@ describe Puppet::Configurer do
     end
 
     it "should finalize the report" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
-
       expect(report).to receive(:finalize_report)
-      configurer.run
+      configurer.run(report: report)
     end
 
     it "should not apply the catalog if the pre-run command fails" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
-
       Puppet.settings[:prerun_command] = "/my/command"
       expect(Puppet::Util::Execution).to receive(:execute).with(["/my/command"]).and_raise(Puppet::ExecutionFailure, "Failed")
 
       expect_any_instance_of(Puppet::Resource::Catalog).not_to receive(:apply)
       expect(configurer).to receive(:send_report)
 
-      expect(configurer.run).to be_nil
+      expect(configurer.run(report: report)).to be_nil
     end
 
     it "should apply the catalog, send the report, and return nil if the post-run command fails" do
-      expect(Puppet::Transaction::Report).to receive(:new).and_return(report)
-
       Puppet.settings[:postrun_command] = "/my/command"
       expect(Puppet::Util::Execution).to receive(:execute).with(["/my/command"]).and_raise(Puppet::ExecutionFailure, "Failed")
 
       expect_any_instance_of(Puppet::Resource::Catalog).to receive(:apply)
       expect(configurer).to receive(:send_report)
 
-      expect(configurer.run).to be_nil
+      expect(configurer.run(report: report)).to be_nil
     end
 
     it 'includes total time metrics in the report after successfully applying the catalog' do
@@ -359,7 +384,7 @@ describe Puppet::Configurer do
 
     it "sets the checksum_type query param to the default supported_checksum_types in a catalog request" do
       expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything,
-        hash_including(checksum_type: 'md5.sha256.sha384.sha512.sha224'))
+        hash_including(checksum_type: 'sha256.sha384.sha512.sha224.md5'))
       configurer.run
     end
 
@@ -546,6 +571,15 @@ describe Puppet::Configurer do
     end
   end
 
+  def expects_pluginsync
+    metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":420,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
+    stub_request(:get, %r{/puppet/v3/file_metadatas/(plugins|locales)}).to_return(status: 200, body: metadata, headers: {'Content-Type' => 'application/json'})
+
+    # response retains owner/group/mode due to source_permissions => use
+    facts_metadata = "[{\"path\":\"/etc/puppetlabs/code\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":500,\"group\":500,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-07-10 14:00:00 -0700\"},\"type\":\"directory\",\"destination\":null}]"
+    stub_request(:get, %r{/puppet/v3/file_metadatas/pluginfacts}).to_return(status: 200, body: facts_metadata, headers: {'Content-Type' => 'application/json'})
+  end
+
   def expects_new_catalog_only(catalog)
     expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true)).and_return(catalog)
     expect(Puppet::Resource::Catalog.indirection).not_to receive(:find).with(anything, hash_including(ignore_terminus: true))
@@ -562,6 +596,7 @@ describe Puppet::Configurer do
   end
 
   def expects_fallback_to_new_catalog(catalog)
+    expects_pluginsync
     expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_terminus: true)).and_return(nil)
     expect(Puppet::Resource::Catalog.indirection).to receive(:find).with(anything, hash_including(ignore_cache: true)).and_return(catalog)
   end
@@ -598,7 +633,6 @@ describe Puppet::Configurer do
       it "should make a node request and pluginsync when a cached catalog cannot be retrieved" do
         expect(Puppet::Node.indirection).to receive(:find).and_return(nil)
         expects_fallback_to_new_catalog(catalog)
-        expect(configurer).to receive(:download_plugins)
 
         configurer.run
       end
@@ -623,6 +657,8 @@ describe Puppet::Configurer do
       end
 
       it "should pluginsync and compile a new catalog if none is found in the cache" do
+        Puppet[:ignore_plugin_errors] = true
+
         expects_fallback_to_new_catalog(catalog)
         stub_request(:get, %r{/puppet/v3/file_metadatas?/plugins}).to_return(:status => 404)
         stub_request(:get, %r{/puppet/v3/file_metadatas?/pluginfacts}).to_return(:status => 404)
@@ -634,8 +670,11 @@ describe Puppet::Configurer do
       end
 
       it "should not attempt to retrieve a cached catalog again if the first attempt failed" do
+        Puppet[:ignore_plugin_errors] = true
+
         expect(Puppet::Node.indirection).to receive(:find).and_return(nil)
         expects_neither_new_or_cached_catalog
+        expects_pluginsync
 
         # after failing to use a cached catalog, we'll need to pluginsync before getting
         # a new catalog, which also fails.
@@ -656,8 +695,7 @@ describe Puppet::Configurer do
       end
 
       it "applies the catalog passed as options when the catalog cache terminus is not set" do
-        stub_request(:get, %r{/puppet/v3/file_metadatas?/plugins}).to_return(:status => 404)
-        stub_request(:get, %r{/puppet/v3/file_metadatas?/pluginfacts}).to_return(:status => 404)
+        expects_pluginsync
 
         catalog.add_resource(Puppet::Resource.new('notify', 'from apply'))
         configurer.run(catalog: catalog.to_ral)
@@ -1005,35 +1043,49 @@ describe Puppet::Configurer do
     it "should select a server when it receives 200 OK response" do
       Puppet.settings[:server_list] = ["myserver:123"]
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: 200)
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 200)
 
       options = {}
       configurer.run(options)
-      expect(options[:report].master_used).to eq('myserver:123')
+      expect(options[:report].server_used).to eq('myserver:123')
     end
 
-    it "should report when a server is unavailable" do
+    it "should report when usecacheonfailure is false and server is unavailable" do
       Puppet.settings[:server_list] = ["myserver:123"]
+      Puppet[:usecacheonfailure] = false
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: [500, "Internal Server Error"])
-
-      allow(Puppet).to receive(:debug)
-      expect(Puppet).to receive(:debug).with("Puppet server myserver:123 is unavailable: 500 Internal Server Error")
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: [500, "Internal Server Error"])
 
       expect {
         configurer.run
-      }.to raise_error(Puppet::Error, /Could not select a functional puppet master from server_list:/)
+      }.to raise_error(Puppet::Error, /Could not select a functional puppet server from server_list:/)
+
+      expect(@logs).to include(an_object_having_attributes(level: :err, message: /Puppet server myserver:123 is unavailable: 500 Internal Server Error/))
     end
 
     it "should error when no servers in 'server_list' are reachable" do
       Puppet.settings[:server_list] = "myserver:123,someotherservername"
+      Puppet[:usecacheonfailure] = false
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: 400)
-      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/master').to_return(status: 400)
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 400)
+      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/server').to_return(status: 400)
 
       expect{
         configurer.run
-      }.to raise_error(Puppet::Error, /Could not select a functional puppet master from server_list: 'myserver:123,someotherservername'/)
+      }.to raise_error(Puppet::Error, /Could not select a functional puppet server from server_list: 'myserver:123,someotherservername'/)
+    end
+
+    it "should not error when usecacheonfailure is true and no servers in 'server_list' are reachable" do
+      Puppet.settings[:server_list] = "myserver:123,someotherservername"
+      Puppet[:usecacheonfailure] = true
+
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 400)
+      stub_request(:get, 'https://someotherservername:8140/status/v1/simple/server').to_return(status: 400)
+
+      options = {}
+
+      expect(configurer.run(options)).to eq(0)
+      expect(options[:report].server_used).to be_nil
     end
 
     it "should not make multiple node requests when the server is found" do
@@ -1042,7 +1094,7 @@ describe Puppet::Configurer do
       Puppet::Node.indirection.terminus_class = :rest
       Puppet::Resource::Catalog.indirection.terminus_class = :rest
 
-      stub_request(:get, 'https://myserver:123/status/v1/simple/master').to_return(status: 200)
+      stub_request(:get, 'https://myserver:123/status/v1/simple/server').to_return(status: 200)
       stub_request(:post, %r{https://myserver:123/puppet/v3/catalog}).to_return(status: 200)
       node_request = stub_request(:get, %r{https://myserver:123/puppet/v3/node/}).to_return(status: 200)
 

data/spec/unit/confine_spec.rb

@@ -54,10 +54,11 @@ describe Puppet::Confine do
     end
 
     it "should log failing confines with the label and message" do
+      Puppet[:log_level] = 'debug'
       allow(@confine).to receive(:pass?).and_return(false)
       expect(@confine).to receive(:message).and_return("My message")
       expect(@confine).to receive(:label).and_return("Mylabel")
-      expect(Puppet).to receive(:debug).with("Mylabel: My message")
+      expect(Puppet).to receive(:debug) { |&b| expect(b.call).to eq("Mylabel: My message") }
       @confine.valid?
     end
   end

data/spec/unit/context/trusted_information_spec.rb

@@ -4,11 +4,7 @@ require 'puppet/certificate_factory'
 require 'puppet/context/trusted_information'
 
 describe Puppet::Context::TrustedInformation, :unless => RUBY_PLATFORM == 'java' do
-  let(:key) do
-    key = Puppet::SSL::Key.new("myname")
-    key.generate
-    key
-  end
+  let(:key) { OpenSSL::PKey::RSA.new(Puppet[:keylength]) }
 
   let(:csr) do
     csr = Puppet::SSL::CertificateRequest.new("csr")
@@ -26,7 +22,7 @@ describe Puppet::Context::TrustedInformation, :unless => RUBY_PLATFORM == 'java'
 
     # The cert must be signed so that it can be successfully be DER-decoded later
     signer = Puppet::SSL::CertificateSigner.new
-    signer.sign(cert.content, key.content)
+    signer.sign(cert.content, key)
     cert
   end
 
@@ -41,8 +37,12 @@ describe Puppet::Context::TrustedInformation, :unless => RUBY_PLATFORM == 'java'
   }
 
   def allow_external_trusted_data(certname, data)
-    Puppet[:trusted_external_command] = '/usr/bin/generate_data.sh'
-    allow(Puppet::Util::Execution).to receive(:execute).with(['/usr/bin/generate_data.sh', certname], anything).and_return(JSON.dump(data))
+    command = 'generate_data.sh'
+    Puppet[:trusted_external_command] = command
+    # The expand_path bit is necessary b/c :trusted_external_command is a
+    # file_or_directory setting, and file_or_directory settings automatically
+    # expand the given path.
+    allow(Puppet::Util::Execution).to receive(:execute).with([File.expand_path(command), certname], anything).and_return(JSON.dump(data))
   end
 
   it "defaults external to an empty hash" do
@@ -99,9 +99,11 @@ describe Puppet::Context::TrustedInformation, :unless => RUBY_PLATFORM == 'java'
     end
 
     it 'only runs the trusted external command the first time it is invoked' do
-      Puppet[:trusted_external_command] = '/usr/bin/generate_data.sh'
+      command = 'generate_data.sh'
+      Puppet[:trusted_external_command] = command
 
-      expect(Puppet::Util::Execution).to receive(:execute).with(['/usr/bin/generate_data.sh', 'cert name'], anything).and_return(JSON.dump(external_data)).once
+      # See allow_external_trusted_data to understand why expand_path is necessary
+      expect(Puppet::Util::Execution).to receive(:execute).with([File.expand_path(command), 'cert name'], anything).and_return(JSON.dump(external_data)).once
 
       trusted = Puppet::Context::TrustedInformation.remote(true, 'cert name', cert)
       trusted.external