puppet 6.19.0 → 7.3.0

data/spec/unit/pops/types/enumeration_spec.rb

@@ -1,51 +0,0 @@
-require 'spec_helper'
-require 'puppet/pops'
-
-module Puppet::Pops::Types
-describe 'The enumeration support' do
-  it 'produces an enumerator for Array' do
-  expect(Enumeration.enumerator([1,2,3]).respond_to?(:next)).to eql(true)
-  end
-
-  it 'produces an enumerator for Hash' do
-    expect(Enumeration.enumerator({:a=>1}).respond_to?(:next)).to eql(true)
-  end
-
-  it 'produces a char enumerator for String' do
-    enum = Enumeration.enumerator("abc")
-    expect(enum.respond_to?(:next)).to eql(true)
-    expect(enum.next).to eql('a')
-  end
-
-  it 'produces an enumerator for integer times' do
-    enum = Enumeration.enumerator(2)
-    expect(enum.next).to eql(0)
-    expect(enum.next).to eql(1)
-    expect{enum.next}.to raise_error(StopIteration)
-  end
-
-  it 'produces an enumerator for Integer range' do
-    range = TypeFactory.range(1,2)
-    enum = Enumeration.enumerator(range)
-    expect(enum.next).to eql(1)
-    expect(enum.next).to eql(2)
-    expect{enum.next}.to raise_error(StopIteration)
-  end
-
-  it 'does not produce an enumerator for infinite Integer range' do
-    range = TypeFactory.range(1,:default)
-    enum = Enumeration.enumerator(range)
-    expect(enum).to be_nil
-    range = TypeFactory.range(:default,2)
-    enum = Enumeration.enumerator(range)
-    expect(enum).to be_nil
-  end
-
-  [3.14, /.*/, true, false, nil, :something].each do |x|
-    it "does not produce an enumerator for object of type #{x.class}" do
-      enum = Enumeration.enumerator(x)
-      expect(enum).to be_nil
-    end
-  end
-end
-end

data/spec/unit/resource/capability_finder_spec.rb

@@ -1,143 +0,0 @@
-require 'spec_helper'
-require_relative '../pops/parser/parser_rspec_helper'
-require 'puppet/resource/capability_finder'
-
-describe Puppet::Resource::CapabilityFinder do
-  context 'when PuppetDB is not configured' do
-    it 'should error' do
-      expect(Puppet::Util).to receive(:const_defined?).with('Puppetdb').and_return(false)
-      expect { Puppet::Resource::CapabilityFinder.find('production', nil, nil) }.to raise_error(/PuppetDB is not available/)
-    end
-  end
-
-  context 'when PuppetDB is configured' do
-    before(:each) do
-      allow_any_instance_of(Puppet::Parser::Compiler).to receive(:loaders).and_return(loaders)
-      Puppet.push_context({:loaders => loaders, :current_environment => env})
-      if mock_pdb
-        module Puppet::Util::Puppetdb
-          class Http; end
-        end
-      end
-      make_cap_type
-    end
-
-    after(:each) do
-      Puppet::Util.send(:remove_const, 'Puppetdb') if mock_pdb
-      Puppet::Type.rmtype(:cap)
-      Puppet.pop_context()
-    end
-
-    let(:mock_pdb) { !Puppet::Util.const_defined?('Puppetdb') }
-    let(:env) { Puppet::Node::Environment.create(:testing, []) }
-    let(:loaders) { Puppet::Pops::Loaders.new(env) }
-
-    let(:response_body) { [{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}}] }
-    let(:response) { double('response', :body => response_body.to_json) }
-
-    def make_cap_type
-      Puppet::Type.newtype :cap, :is_capability => true do
-        newparam :name
-        newparam :host
-      end
-    end
-
-    describe "when query_puppetdb method is available" do
-      it 'should call use the query_puppetdb method if available' do
-        expect(Puppet::Util::Puppetdb).to receive(:query_puppetdb).and_return(response_body)
-        expect(Puppet::Util::Puppetdb::Http).not_to receive(:action)
-
-        result = Puppet::Resource::CapabilityFinder.find('production', nil, Puppet::Resource.new('Cap', 'cap'))
-        expect(result['host']).to eq('ahost')
-      end
-    end
-
-    describe "when query_puppetdb method is unavailable" do
-      before :each do
-        allow(Puppet::Util::Puppetdb).to receive(:respond_to?).with(:query_puppetdb).and_return(false)
-      end
-
-      it 'should call Puppet::Util::PuppetDB::Http.action' do
-        expect(Puppet::Util::Puppetdb::Http).to receive(:action).and_return(response)
-        result = Puppet::Resource::CapabilityFinder.find('production', nil, Puppet::Resource.new('Cap', 'cap'))
-        expect(result['host']).to eq('ahost')
-      end
-    end
-
-    describe '#find' do
-      let(:capability) { Puppet::Resource.new('Cap', 'cap') }
-      let(:code_id) { 'b59e5df0578ef411f773ee6c33d8073c50e7b8fe' }
-
-      it 'should search for the resource without including code_id or environment' do
-        resources = [{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}}]
-        allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
-
-        result = Puppet::Resource::CapabilityFinder.find('production', code_id, Puppet::Resource.new('Cap', 'cap'))
-        expect(result['host']).to eq('ahost')
-      end
-
-      it 'should return nil if no resource is found' do
-        allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return([])
-
-        result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
-        expect(result).to be_nil
-      end
-
-      describe 'when multiple results are returned for different environments' do
-        let(:resources) do
-          [{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}, "tags"=>["producer:production"]},
-           {"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"bhost"}, "tags"=>["producer:other_env"]}]
-        end
-
-        before :each do
-          allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
-        end
-
-        it 'should return the resource matching environment' do
-          result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
-          expect(result['host']).to eq('ahost')
-        end
-
-        it 'should return nil if no resource matches environment' do
-          result = Puppet::Resource::CapabilityFinder.find('bad_env', code_id, capability)
-          expect(result).to be_nil
-        end
-      end
-
-      describe 'when multiple results are returned for the same environment' do
-        let(:resources) do
-          [{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}, "tags"=>["producer:production"]},
-           {"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"bhost"}, "tags"=>["producer:production"]}]
-        end
-
-        before :each do
-          allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
-        end
-
-        it 'should return the resource matching code_id' do
-          allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return([{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"chost"}}])
-
-          result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
-          expect(result['host']).to eq('chost')
-        end
-
-        it 'should fail if no resource matches code_id' do
-          allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return([])
-
-          expect { Puppet::Resource::CapabilityFinder.find('production', code_id, capability) }.to raise_error(Puppet::Error, /expected exactly one resource but got 2/)
-        end
-
-        it 'should fail if multiple resources match code_id' do
-          allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return(resources)
-
-          expect { Puppet::Resource::CapabilityFinder.find('production', code_id, capability) }.to raise_error(Puppet::DevError, /expected exactly one resource but got 2/)
-        end
-
-        it 'should fail if no code_id was specified' do
-          allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', nil, capability).and_return(resources)
-          expect { Puppet::Resource::CapabilityFinder.find('production', nil, capability) }.to raise_error(Puppet::DevError, /expected exactly one resource but got 2/)
-        end
-      end
-    end
-  end
-end

data/spec/unit/rest/route_spec.rb

@@ -1,132 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/rest/route'
-
-describe Puppet::Rest::Route do
-  describe '#with_base_url'do
-    let(:dns_resolver) { double('dns resolver') }
-
-    context 'when not using SRV records' do
-      before :each do
-        Puppet.settings[:use_srv_records] = false
-      end
-
-      it "yields a base URL with the values from the specified settings" do
-        Puppet[:ca_server] = 'testserver'
-        Puppet[:ca_port] = 555
-        ca_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/',
-                                           server_setting: :ca_server,
-                                           port_setting: :ca_port,
-                                           srv_service: :test_service)
-        count = 0
-        rval = ca_route.with_base_url(dns_resolver) do |url|
-          count += 1
-          expect(url.to_s).to eq('https://testserver:555/fakeapi/v1/')
-          'Block return value'
-        end
-        expect(count).to eq(1)
-        expect(rval).to eq('Block return value')
-      end
-
-      it "yields a base URL with Puppet's configured server and port when no defaults are specified" do
-        Puppet[:server] = 'configured.net'
-        Puppet[:serverport] = 8140
-        fallback_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/')
-        count = 0
-        rval = fallback_route.with_base_url(dns_resolver) do |url|
-          count += 1
-          expect(url.to_s).to eq('https://configured.net:8140/fakeapi/v1/')
-          'Block return value'
-        end
-        expect(count).to eq(1)
-        expect(rval).to eq('Block return value')
-      end
-
-      it 'yields the first entry in the server list when server_list is in use' do
-        Puppet[:server_list] = [['one.net', 111], ['two.net', 222]]
-        fallback_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/')
-        count = 0
-        rval = fallback_route.with_base_url(dns_resolver) do |url|
-          count += 1
-          expect(url.to_s).to eq('https://one.net:111/fakeapi/v1/')
-          'Block return value'
-        end
-        expect(count).to eq(1)
-        expect(rval).to eq('Block return value')
-      end
-
-      it 'falls back to :server and :serverport if nil is passed' do
-        Puppet[:server] = 'one.net'
-        Puppet[:serverport] = 111
-        nil_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/',
-                                            server_setting: nil,
-                                            port_setting: nil)
-        count = 0
-        rval = nil_route.with_base_url(dns_resolver) do |url|
-          count += 1
-          expect(url.to_s).to eq('https://one.net:111/fakeapi/v1/')
-          'Block return value'
-        end
-        expect(count).to eq(1)
-        expect(rval).to eq('Block return value')
-      end
-    end
-
-    context 'when using SRV records' do
-      context "when SRV returns servers" do
-        let(:route) { Puppet::Rest::Route.new(api: '/fakeapi/v1/',
-                                              srv_service: :test_service) }
-
-        before :each do
-          Puppet.settings[:use_srv_records] = true
-          Puppet.settings[:srv_domain]      = 'example.com'
-
-          @dns_mock = double('dns')
-          expect(Resolv::DNS).to receive(:new).and_return(@dns_mock)
-
-          @port = 7502
-          @target = 'example.com'
-          record = Resolv::DNS::Resource::IN::SRV.new(0, 0, @port, @target)
-          record.instance_variable_set(:@ttl, 10)
-          @srv_records = [record]
-
-          expect(@dns_mock).to receive(:getresources).
-            with("_x-puppet-test_service._tcp.example.com", Resolv::DNS::Resource::IN::SRV).
-            and_return(@srv_records)
-        end
-
-        it "yields a URL using the server and port from the SRV record" do
-          count = 0
-          rval = route.with_base_url(Puppet::Network::Resolver.new) do |url|
-            count += 1
-            expect(url.to_s).to eq('https://example.com:7502/fakeapi/v1/')
-            'Block return value'
-          end
-          expect(count).to eq(1)
-
-          expect(rval).to eq('Block return value')
-        end
-
-        it "should fall back to the default server when the block raises a SystemCallError" do
-          Puppet[:server] = "testserver"
-          Puppet[:serverport] = 555
-
-          count = 0
-          rval = route.with_base_url(Puppet::Network::Resolver.new) do |url|
-            count += 1
-            if url.to_s =~ /example.com/ then
-              raise SystemCallError, "example failure"
-            else
-              expect(url.to_s).to eq('https://testserver:555/fakeapi/v1/')
-            end
-
-            'Block return value'
-          end
-
-          expect(count).to eq(2)
-          expect(rval).to eq('Block return value')
-        end
-      end
-    end
-  end
-end

data/spec/unit/ssl/host_spec.rb

@@ -1,650 +0,0 @@
-require 'spec_helper'
-require 'puppet/test_ca'
-
-require 'puppet/ssl/host'
-require 'matchers/json'
-require 'puppet_spec/ssl'
-require 'puppet/rest/routes'
-
-def base_json_comparison(result, json_hash)
-  expect(result["fingerprint"]).to eq(json_hash["fingerprint"])
-  expect(result["name"]).to        eq(json_hash["name"])
-  expect(result["state"]).to       eq(json_hash["desired_state"])
-end
-
-describe Puppet::SSL::Host, if: !Puppet::Util::Platform.jruby? do
-  include JSONMatchers
-  include PuppetSpec::Files
-
-  before do
-    # Get a safe temporary file
-    dir = tmpdir("ssl_host_testing")
-    Puppet.settings[:confdir] = dir
-    Puppet.settings[:vardir] = dir
-    Puppet.settings.use :main, :ssl
-
-    @host = Puppet::SSL::Host.new("myname")
-  end
-
-  after do
-    # Cleaned out any cached localhost instance.
-    Puppet::SSL::Host.reset
-  end
-
-  it "should use any provided name as its name" do
-    expect(@host.name).to eq("myname")
-  end
-
-  it "should retrieve its public key from its private key" do
-    realkey = double('realkey')
-    key = double('key', :content => realkey)
-    allow(Puppet::SSL::Key.indirection).to receive(:find).and_return(key)
-    pubkey = double('public_key')
-    expect(realkey).to receive(:public_key).and_return(pubkey)
-
-    expect(@host.public_key).to equal(pubkey)
-  end
-
-  describe 'localhost' do
-    before(:each) do
-      allow_any_instance_of(Puppet::SSL::Host).to receive(:certificate).and_return(nil)
-      allow_any_instance_of(Puppet::SSL::Host).to receive(:generate)
-    end
-
-    it "is deprecated" do
-      Puppet::SSL::Host.localhost
-
-      expect(@logs).to include(an_object_having_attributes(message: /Puppet::SSL::Host is deprecated/))
-    end
-
-    it "should allow to reset localhost" do
-      previous_host = Puppet::SSL::Host.localhost
-      Puppet::SSL::Host.reset
-      expect(Puppet::SSL::Host.localhost).not_to eq(previous_host)
-    end
-
-    it "should generate the certificate for the localhost instance if no certificate is available" do
-      host = double('host', :key => nil)
-      expect(Puppet::SSL::Host).to receive(:new).and_return(host)
-
-      expect(host).to receive(:certificate).and_return(nil)
-      expect(host).to receive(:generate)
-
-      expect(Puppet::SSL::Host.localhost).to equal(host)
-    end
-
-    it "should always read the key for the localhost instance in from disk" do
-      host = double('host', :certificate => "eh")
-      expect(host).to receive(:key)
-      expect(Puppet::SSL::Host).to receive(:new).and_return(host)
-
-      Puppet::SSL::Host.localhost
-    end
-
-    it "should cache the localhost instance" do
-      host = double('host', :certificate => "eh", :key => 'foo')
-      expect(Puppet::SSL::Host).to receive(:new).once.and_return(host)
-      expect(Puppet::SSL::Host.localhost).to eq(Puppet::SSL::Host.localhost)
-    end
-  end
-
-  context "with dns_alt_names" do
-    before :each do
-      @key = double('key content')
-      key = double('key', :generate => true, :content => @key)
-      allow(Puppet::SSL::Key).to receive(:new).and_return(key)
-      allow(Puppet::SSL::Key.indirection).to receive(:save).with(key)
-
-      @cr = double('certificate request', :render => "csr pem")
-      allow(Puppet::SSL::CertificateRequest).to receive(:new).and_return(@cr)
-      allow_any_instance_of(Puppet::SSL::Host).to receive(:submit_certificate_request)
-    end
-
-    describe "explicitly specified" do
-      before :each do
-        Puppet[:dns_alt_names] = 'one, two'
-      end
-
-      it "should not include subjectAltName if not the local node" do
-        expect(@cr).to receive(:generate).with(@key, {})
-
-        Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate_certificate_request
-      end
-
-      it "should include subjectAltName if the local node" do
-        expect(@cr).to receive(:generate).with(@key, { :dns_alt_names => 'one, two' })
-
-        Puppet::SSL::Host.new(Puppet[:certname]).generate_certificate_request
-      end
-    end
-  end
-
-  it "should be able to verify its certificate matches its key" do
-    expect(Puppet::SSL::Host.new("foo")).to respond_to(:validate_certificate_with_key)
-  end
-
-  it "should consider the certificate invalid if it cannot find a key" do
-    host = Puppet::SSL::Host.new("foo")
-    certificate = double('cert', :fingerprint => 'DEADBEEF')
-    expect(host).to receive(:key).and_return(nil)
-    expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, "No private key with which to validate certificate with fingerprint: DEADBEEF")
-  end
-
-  it "should consider the certificate invalid if it cannot find a certificate" do
-    host = Puppet::SSL::Host.new("foo")
-    expect(host).not_to receive(:key)
-    expect { host.validate_certificate_with_key(nil) }.to raise_error(Puppet::Error, "No certificate to validate.")
-  end
-
-  it "should consider the certificate invalid if the SSL certificate's key verification fails" do
-    host = Puppet::SSL::Host.new("foo")
-    key = double('key', :content => "private_key")
-    sslcert = double('sslcert')
-    certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
-    allow(host).to receive(:key).and_return(key)
-    expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
-    expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /DEADBEEF/)
-  end
-
-  it "should consider the certificate valid if the SSL certificate's key verification succeeds" do
-    host = Puppet::SSL::Host.new("foo")
-    key = double('key', :content => "private_key")
-    sslcert = double('sslcert')
-    certificate = double('cert', :content => sslcert)
-    allow(host).to receive(:key).and_return(key)
-    expect(sslcert).to receive(:check_private_key).with("private_key").and_return(true)
-    expect{ host.validate_certificate_with_key(certificate) }.not_to raise_error
-  end
-
-  it "should output agent-specific commands when validation fails" do
-    host = Puppet::SSL::Host.new("foo")
-    key = double('key', :content => "private_key")
-    sslcert = double('sslcert')
-    certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
-    allow(host).to receive(:key).and_return(key)
-    expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
-    expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /puppet ssl clean \n/)
-  end
-
-  it "should output device-specific commands when validation fails" do
-    Puppet[:certname] = "device.example.com"
-    host = Puppet::SSL::Host.new("device.example.com", true)
-    key = double('key', :content => "private_key")
-    sslcert = double('sslcert')
-    certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
-    allow(host).to receive(:key).and_return(key)
-    expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
-    expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /puppet ssl clean --target device.example.com/)
-  end
-
-  describe "when initializing" do
-    it "should default its name to the :certname setting" do
-      Puppet[:certname] = "myname"
-
-      expect(Puppet::SSL::Host.new.name).to eq("myname")
-    end
-
-    it "should downcase a passed in name" do
-      expect(Puppet::SSL::Host.new("Host.Domain.Com").name).to eq("host.domain.com")
-    end
-  end
-
-  describe "when managing its private key" do
-    before do
-      @realkey = "mykey"
-      @key = Puppet::SSL::Key.new("mykey")
-      @key.content = @realkey
-    end
-
-    it "should return nil if the key is not set and cannot be found" do
-      expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(nil)
-      expect(@host.key).to be_nil
-    end
-
-    it "should find the key in the Key class and return the Puppet instance" do
-      expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(@key)
-      expect(@host.key).to equal(@key)
-    end
-
-    it "should be able to generate and save a new key" do
-      expect(Puppet::SSL::Key).to receive(:new).with("myname").and_return(@key)
-
-      expect(@key).to receive(:generate)
-      expect(Puppet::SSL::Key.indirection).to receive(:save)
-
-      expect(@host.generate_key).to be_truthy
-      expect(@host.key).to equal(@key)
-    end
-
-    it "should not retain keys that could not be saved" do
-      expect(Puppet::SSL::Key).to receive(:new).with("myname").and_return(@key)
-
-      expect(@key).to receive(:generate)
-      expect(Puppet::SSL::Key.indirection).to receive(:save).and_raise("eh")
-
-      expect { @host.generate_key }.to raise_error(RuntimeError)
-      expect(@host.key).to be_nil
-    end
-
-    it "should return any previously found key without requerying" do
-      expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(@key).once
-      expect(@host.key).to equal(@key)
-      expect(@host.key).to equal(@key)
-    end
-  end
-
-  describe "when managing its certificate request" do
-    before(:all) do
-      @pki = PuppetSpec::SSL.create_chained_pki
-    end
-
-    before(:each) do
-      Puppet[:requestdir] = tmpdir('requests')
-    end
-
-    let(:key) { Puppet::SSL::Key.from_s(@pki[:leaf_key].to_s, @host.name) }
-
-    it "should generate a new key when generating the cert request if no key exists" do
-      expect(@host).to receive(:key).exactly(2).times.and_return(nil, key)
-      expect(@host).to receive(:generate_key).and_return(key)
-
-      allow(@host).to receive(:submit_certificate_request)
-
-      @host.generate_certificate_request
-      expect(Puppet::FileSystem.exist?(File.join(Puppet[:requestdir], "#{@host.name}.pem"))).to be true
-    end
-
-    it "should be able to generate and save a new request using the private key" do
-      allow(@host).to receive(:key).and_return(key)
-      allow(@host).to receive(:submit_certificate_request)
-
-      expect(@host.generate_certificate_request).to be_truthy
-      expect(Puppet::FileSystem.exist?(File.join(Puppet[:requestdir], "#{@host.name}.pem"))).to be true
-    end
-
-    it "should send a new request to the CA for signing" do
-      @http = double("http")
-      allow(@host).to receive(:http_client).and_return(@http)
-      allow(@host).to receive(:ssl_store).and_return(double("ssl store"))
-      allow(@host).to receive(:key).and_return(key)
-      request = double("request")
-      allow(request).to receive(:generate)
-      expect(request).to receive(:render).and_return("my request").twice
-      expect(Puppet::SSL::CertificateRequest).to receive(:new).and_return(request)
-
-      expect(Puppet::Rest::Routes).to receive(:put_certificate_request)
-        .with("my request", @host.name, anything)
-        .and_return(nil)
-
-      expect(@host.generate_certificate_request).to be true
-    end
-
-    it "should return any previously found request without requerying" do
-      request = double("request")
-      expect(@host).to receive(:load_certificate_request_from_file).and_return(request).once
-
-      expect(@host.certificate_request).to equal(request)
-      expect(@host.certificate_request).to equal(request)
-    end
-
-    it "should not keep its certificate request in memory if the request cannot be saved" do
-      allow(@host).to receive(:key).and_return(key)
-      allow(@host).to receive(:submit_certificate_request)
-      expect(Puppet::Util).to receive(:replace_file).and_raise(RuntimeError)
-
-      expect { @host.generate_certificate_request }.to raise_error(RuntimeError)
-
-      expect(@host.instance_eval { @certificate_request }).to be_nil
-    end
-  end
-
-  describe "when managing its certificate" do
-    before(:all) do
-      @pki = PuppetSpec::SSL.create_chained_pki
-    end
-
-    before(:each) do
-      Puppet[:certdir] = tmpdir('certs')
-      allow(@host).to receive(:key).and_return(double("key"))
-      allow(@host).to receive(:validate_certificate_with_key)
-      allow(@host).to receive(:http_client).and_return(@http)
-      allow(@host).to receive(:ssl_store).and_return(double("ssl store"))
-    end
-
-    let(:ca_cert_response) { @pki[:ca_bundle] }
-    let(:crl_response) { @pki[:crl_chain] }
-    let(:host_cert_response) { @pki[:unrevoked_leaf_node_cert] }
-
-    it "should find the CA certificate and save it to disk" do
-      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
-      stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
-      stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 404)
-
-      @host.certificate
-      actual_ca_bundle = Puppet::FileSystem.read(Puppet[:localcacert])
-      expect(actual_ca_bundle).to match(/BEGIN CERTIFICATE.*END CERTIFICATE.*BEGIN CERTIFICATE/m)
-    end
-
-    it "should raise if it cannot find a CA certificate" do
-      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 404)
-
-      expect(@host).not_to receive(:get_host_certificate)
-
-      expect {
-        @host.certificate
-      }.to raise_error(Puppet::Error, /CA certificate is missing from the server/)
-    end
-
-    it "should find the key if it does not have one" do
-      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
-      stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
-
-      expect(@host).to receive(:get_host_certificate).and_return(nil)
-      expect(@host).to receive(:key).and_return(double("key"))
-      @host.certificate
-    end
-
-    it "should generate the key if one cannot be found" do
-      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
-      stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
-
-      expect(@host).to receive(:get_host_certificate).and_return(nil)
-      expect(@host).to receive(:key).and_return(nil)
-      expect(@host).to receive(:generate_key)
-      @host.certificate
-    end
-
-    it "should find the host certificate, write it to file, and return the Puppet certificate instance" do
-      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
-      stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
-      stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 200, body: host_cert_response.to_pem)
-
-      expected_cert = Puppet::SSL::Certificate.from_s(@pki[:unrevoked_leaf_node_cert])
-      actual_cert = @host.certificate
-      expect(actual_cert).to be_a(Puppet::SSL::Certificate)
-      expect(actual_cert.to_s).to eq(expected_cert.to_s)
-      host_cert_from_file = Puppet::FileSystem.read(File.join(Puppet[:certdir], "#{@host.name}.pem"))
-      expect(host_cert_from_file).to eq(expected_cert.to_s)
-    end
-
-    it "should return any previously found certificate" do
-      cert = double('cert')
-      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
-      stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
-      expect(@host).to receive(:get_host_certificate).and_return(cert).once
-
-      expect(@host.certificate).to equal(cert)
-      expect(@host.certificate).to equal(cert)
-    end
-
-    context 'invalid certificates' do
-      it "should raise if the CA certificate downloaded from CA is invalid" do
-        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: 'garbage')
-
-        expect { @host.certificate }.to raise_error(OpenSSL::X509::CertificateError, /Failed to parse CA certificates as PEM/)
-      end
-
-      it "should warn if the host certificate downloaded from CA is invalid" do
-        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
-        stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
-        stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 200, body: 'garbage')
-
-        expect { @host.certificate }.to raise_error(Puppet::Error, /did not contain a valid certificate for #{@host.name}/)
-      end
-
-      it 'should warn if the CA certificate loaded from disk is invalid' do
-        Puppet::FileSystem.open(Puppet[:localcacert], nil, "w:ASCII") do |f|
-          f.puts 'garbage'
-        end
-        expect { @host.certificate }.to raise_error(OpenSSL::X509::CertificateError, /Failed to parse CA certificates as PEM/)
-      end
-
-      it 'should warn if the host certificate loaded from disk in invalid' do
-        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
-        stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
-
-        Puppet::FileSystem.open(File.join(Puppet[:certdir], "#{@host.name}.pem"), nil, "w:ASCII") do |f|
-          f.puts 'garbage'
-        end
-        expect { @host.certificate }.to raise_error(Puppet::Error, /The certificate.*invalid/)
-      end
-    end
-  end
-
-  it "should have a method for generating all necessary files" do
-    expect(Puppet::SSL::Host.new("me")).to respond_to(:generate)
-  end
-
-  describe "when generating files" do
-    before do
-      @host = Puppet::SSL::Host.new("me")
-      allow(@host).to receive(:generate_key)
-      allow(@host).to receive(:generate_certificate_request)
-      allow(@host).to receive(:certificate_request)
-      allow(@host).to receive(:certificate)
-    end
-
-    it "should generate a key if one is not present" do
-      allow(@host).to receive(:key).and_return nil
-      expect(@host).to receive(:generate_key)
-
-      @host.generate
-    end
-
-    it "should generate a certificate request if one is not present" do
-      expect(@host).to receive(:certificate_request).and_return nil
-      expect(@host).to receive(:generate_certificate_request)
-
-      @host.generate
-    end
-  end
-
-  it "should have a method for creating an SSL store" do
-    expect(Puppet::SSL::Host.new("me")).to respond_to(:ssl_store)
-  end
-
-  describe "when creating an SSL store" do
-    before do
-      Puppet[:localcacert] = "ssl_host_testing"
-    end
-
-    it "should accept a purpose" do
-      store = double('store', :add_file => nil)
-      expect(OpenSSL::X509::Store).to receive(:new).and_return(store)
-      expect(store).to receive(:purpose=).with(OpenSSL::X509::PURPOSE_SSL_SERVER)
-      host = Puppet::SSL::Host.new("me")
-      host.crl_usage = false
-
-      host.ssl_store(OpenSSL::X509::PURPOSE_SSL_SERVER)
-    end
-
-    context "and the CRL is not on disk" do
-      before do
-        @pki = PuppetSpec::SSL.create_chained_pki
-        @revoked_cert = @pki[:revoked_root_node_cert]
-        localcacert = Puppet.settings[:localcacert]
-        Puppet::Util.replace_file(localcacert, 0644) {|f| f.write @pki[:ca_bundle] }
-        @http = double('http')
-        allow(@host).to receive(:http_client).and_return(@http)
-      end
-
-      after do
-        Puppet::FileSystem.unlink(Puppet.settings[:localcacert])
-        Puppet::FileSystem.unlink(Puppet.settings[:hostcrl])
-      end
-
-      it "retrieves it from the server" do
-        expect(Puppet::Rest::Routes).to receive(:get_crls)
-          .with(Puppet::SSL::CA_NAME, anything)
-          .and_return(@pki[:crl_chain])
-
-        @host.ssl_store
-        expect(Puppet::FileSystem.read(Puppet.settings[:hostcrl], :encoding => Encoding::UTF_8)).to eq(@pki[:crl_chain])
-      end
-    end
-
-    describe "and a CRL is available" do
-      before do
-        pki = PuppetSpec::SSL.create_chained_pki
-
-        @revoked_cert_from_self_signed_root          = pki[:revoked_root_node_cert]
-        @revoked_cert_from_ca_with_untrusted_chain   = pki[:revoked_leaf_node_cert]
-        @unrevoked_cert_from_self_signed_root        = pki[:unrevoked_root_node_cert]
-        @unrevoked_cert_from_revoked_ca              = pki[:unrevoked_int_node_cert]
-        @unrevoked_cert_from_ca_with_untrusted_chain = pki[:unrevoked_leaf_node_cert]
-
-        localcacert = Puppet.settings[:localcacert]
-        hostcrl     = Puppet.settings[:hostcrl]
-
-        Puppet::Util.replace_file(localcacert, 0644) {|f| f.write pki[:ca_bundle] }
-        Puppet::Util.replace_file(hostcrl, 0644)     {|f| f.write pki[:crl_chain] }
-      end
-
-      after do
-        Puppet::FileSystem.unlink(Puppet.settings[:localcacert])
-        Puppet::FileSystem.unlink(Puppet.settings[:hostcrl])
-      end
-
-      [true, :chain].each do |crl_setting|
-        describe "and 'certificate_revocation' is #{crl_setting}" do
-          before do
-            @host = Puppet::SSL::Host.new(crl_setting.to_s)
-            @host.crl_usage = crl_setting
-          end
-
-          it "should verify unrevoked certs" do
-            expect(
-              @host.ssl_store.verify(@unrevoked_cert_from_self_signed_root)
-            ).to be true
-          end
-
-          it "should not verify revoked certs" do
-            [@revoked_cert_from_self_signed_root,
-             @revoked_cert_from_ca_with_untrusted_chain,
-             @unrevoked_cert_from_revoked_ca,
-             @unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
-              expect(@host.ssl_store.verify(cert)).to be false
-            end
-          end
-        end
-      end
-
-      describe "and 'certificate_revocation' is leaf" do
-        before do
-          @host = Puppet::SSL::Host.new("leaf")
-          @host.crl_usage = :leaf
-        end
-
-        it "should verify unrevoked certs regardless of signing CA's revocation status" do
-          [@unrevoked_cert_from_self_signed_root,
-           @unrevoked_cert_from_revoked_ca,
-           @unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
-            expect(@host.ssl_store.verify(cert)).to be true
-          end
-        end
-
-        it "should not verify certs revoked by their signing CA" do
-          [@revoked_cert_from_self_signed_root,
-           @revoked_cert_from_ca_with_untrusted_chain].each do |cert|
-            expect(@host.ssl_store.verify(cert)).to be false
-          end
-        end
-      end
-
-      describe "and 'certificate_revocation' is false" do
-        before do
-          @host = Puppet::SSL::Host.new("host")
-          @host.crl_usage = false
-        end
-
-        it "should verify valid certs regardless of revocation status" do
-          [@revoked_cert_from_self_signed_root,
-           @revoked_cert_from_ca_with_untrusted_chain,
-           @unrevoked_cert_from_self_signed_root,
-           @unrevoked_cert_from_revoked_ca,
-           @unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
-            expect(@host.ssl_store.verify(cert)).to be true
-          end
-        end
-      end
-    end
-  end
-
-  describe "when waiting for a cert" do
-    before do
-      @host = Puppet::SSL::Host.new("me")
-    end
-
-    it "should generate its certificate request and attempt to read the certificate again if no certificate is found" do
-      expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
-      expect(@host).to receive(:generate)
-      @host.wait_for_cert(1)
-    end
-
-    it "should catch and log errors during CSR saving" do
-      expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
-      times_generate_called = 0
-      expect(@host).to receive(:generate) do
-        times_generate_called += 1
-        raise RuntimeError if times_generate_called == 1
-        nil
-      end
-      allow(@host).to receive(:sleep)
-      @host.wait_for_cert(1)
-    end
-
-    it "should sleep and retry after failures saving the CSR if waitforcert is enabled" do
-      expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
-      times_generate_called = 0
-      expect(@host).to receive(:generate) do
-        times_generate_called += 1
-        raise RuntimeError if times_generate_called == 1
-        nil
-      end
-      expect(@host).to receive(:sleep).with(1)
-      @host.wait_for_cert(1)
-    end
-
-    it "should exit after failures saving the CSR of waitforcert is disabled" do
-      expect(@host).to receive(:certificate).and_return(nil)
-      expect(@host).to receive(:generate).and_raise(RuntimeError)
-      expect(@host).to receive(:puts)
-      expect { @host.wait_for_cert(0) }.to exit_with 1
-    end
-
-    it "should exit if the wait time is 0 and it can neither find nor retrieve a certificate" do
-      allow(@host).to receive(:certificate).and_return(nil)
-      expect(@host).to receive(:generate)
-      expect(@host).to receive(:puts)
-      expect { @host.wait_for_cert(0) }.to exit_with 1
-    end
-
-    it "should sleep for the specified amount of time if no certificate is found after generating its certificate request" do
-      expect(@host).to receive(:certificate).exactly(3).times().and_return(nil, nil, "foo")
-      expect(@host).to receive(:generate)
-
-      expect(@host).to receive(:sleep).with(1)
-
-      @host.wait_for_cert(1)
-    end
-
-    it "should catch and log exceptions during certificate retrieval" do
-      times_certificate_called = 0
-      expect(@host).to receive(:certificate) do
-        times_certificate_called += 1
-        if times_certificate_called == 1
-          return nil
-        elsif times_certificate_called == 2
-          raise RuntimeError
-        end
-        "foo"
-      end.exactly(3).times()
-      allow(@host).to receive(:generate)
-      allow(@host).to receive(:sleep)
-
-      expect(Puppet).to receive(:log_exception).at_least(:once)
-
-      @host.wait_for_cert(1)
-    end
-  end
-end