puppet 6.21.1 → 6.25.0

data/spec/integration/transaction/report_spec.rb

@@ -48,7 +48,7 @@ describe Puppet::Transaction::Report do
       expect(Puppet::Transaction::Report.indirection).to receive(:save) do |report, x|
         last_run_report = report
         true
-      end.twice
+      end.exactly(4)
 
       Puppet[:report] = true
       Puppet[:noop] = noop1

data/spec/integration/type/exec_spec.rb

@@ -7,70 +7,95 @@ describe Puppet::Type.type(:exec), unless: Puppet::Util::Platform.jruby? do
 
   let(:catalog) { Puppet::Resource::Catalog.new }
   let(:path) { tmpfile('exec_provider') }
-  let(:command) { "ruby -e 'File.open(\"#{path}\", \"w\") { |f| f.print \"foo\" }'" }
 
   before :each do
     catalog.host_config = false
   end
 
-  it "should execute the command" do
-    exec = described_class.new :command => command, :path => ENV['PATH']
+  shared_examples_for 'a valid exec resource' do
+    it "should execute the command" do
+      exec = described_class.new :command => command, :path => ENV['PATH']
 
-    catalog.add_resource exec
-    catalog.apply
+      catalog.add_resource exec
+      catalog.apply
 
-    expect(File.read(path)).to eq('foo')
-  end
+      expect(File.read(path)).to eq('foo')
+    end
 
-  it "should not execute the command if onlyif returns non-zero" do
-    exec = described_class.new(
-      :command => command,
-      :onlyif => "ruby -e 'exit 44'",
-      :path => ENV['PATH']
-    )
+    it "should not execute the command if onlyif returns non-zero" do
+      exec = described_class.new(
+        :command => command,
+        :onlyif => "ruby -e 'exit 44'",
+        :path => ENV['PATH']
+      )
 
-    catalog.add_resource exec
-    catalog.apply
+      catalog.add_resource exec
+      catalog.apply
 
-    expect(Puppet::FileSystem.exist?(path)).to be_falsey
-  end
+      expect(Puppet::FileSystem.exist?(path)).to be_falsey
+    end
 
-  it "should execute the command if onlyif returns zero" do
-    exec = described_class.new(
-      :command => command,
-      :onlyif => "ruby -e 'exit 0'",
-      :path => ENV['PATH']
-    )
+    it "should execute the command if onlyif returns zero" do
+      exec = described_class.new(
+        :command => command,
+        :onlyif => "ruby -e 'exit 0'",
+        :path => ENV['PATH']
+      )
 
-    catalog.add_resource exec
-    catalog.apply
+      catalog.add_resource exec
+      catalog.apply
 
-    expect(File.read(path)).to eq('foo')
-  end
+      expect(File.read(path)).to eq('foo')
+    end
+
+    it "should execute the command if unless returns non-zero" do
+      exec = described_class.new(
+        :command => command,
+        :unless => "ruby -e 'exit 45'",
+        :path => ENV['PATH']
+      )
+
+      catalog.add_resource exec
+      catalog.apply
+
+      expect(File.read(path)).to eq('foo')
+    end
 
-  it "should execute the command if unless returns non-zero" do
-    exec = described_class.new(
-      :command => command,
-      :unless => "ruby -e 'exit 45'",
-      :path => ENV['PATH']
-    )
+    it "should not execute the command if unless returns zero" do
+      exec = described_class.new(
+        :command => command,
+        :unless => "ruby -e 'exit 0'",
+        :path => ENV['PATH']
+      )
 
-    catalog.add_resource exec
-    catalog.apply
+      catalog.add_resource exec
+      catalog.apply
 
-    expect(File.read(path)).to eq('foo')
+      expect(Puppet::FileSystem.exist?(path)).to be_falsey
+    end
   end
 
-  it "should not execute the command if unless returns zero" do
-    exec = described_class.new(
-      :command => command,
-      :unless => "ruby -e 'exit 0'",
-      :path => ENV['PATH']
-    )
+  context 'when command is a string' do
+    let(:command) { "ruby -e 'File.open(\"#{path}\", \"w\") { |f| f.print \"foo\" }'" }
+
+    it_behaves_like 'a valid exec resource'
+  end
+
+  context 'when command is an array' do
+    let(:command) { ['ruby', '-e', "File.open(\"#{path}\", \"w\") { |f| f.print \"foo\" }"] }
+
+    it_behaves_like 'a valid exec resource'
+
+    context 'when is invalid' do
+      let(:command) { [ "ruby -e 'puts 1'" ] }
 
-    catalog.add_resource exec
-    catalog.apply
+      it 'logs error' do
+        exec = described_class.new :command => command, :path => ENV['PATH']
+        catalog.add_resource exec
+        logs = catalog.apply.report.logs
 
-    expect(Puppet::FileSystem.exist?(path)).to be_falsey
+        expect(logs[0].message).to eql("Could not find command 'ruby -e 'puts 1''")
+      end
+    end
   end
 end

data/spec/integration/type/file_spec.rb

@@ -1709,11 +1709,11 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
 
   describe "when using validate_cmd" do
     test_cmd = '/bin/test'
-    if Facter.value(:osfamily) == 'Debian'
+    if Puppet.runtime[:facter].value(:osfamily) == 'Debian'
       test_cmd = '/usr/bin/test'
     end
 
-    if Facter.value(:operatingsystem) == 'Darwin'
+    if Puppet.runtime[:facter].value(:operatingsystem) == 'Darwin'
       stat_cmd = "stat -f '%Lp'"
     else
       stat_cmd = "stat --format=%a"

data/spec/integration/type/package_spec.rb

@@ -9,7 +9,7 @@ describe Puppet::Type.type(:package), "when choosing a default package provider"
   def provider_name(os)
     case os
     when 'Solaris'
-      if Puppet::Util::Package.versioncmp(Facter.value(:kernelrelease), '5.11') >= 0
+      if Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:kernelrelease), '5.11') >= 0
         :pkg
       else
         :sun
@@ -21,19 +21,19 @@ describe Puppet::Type.type(:package), "when choosing a default package provider"
     when 'Darwin'
       :pkgdmg
     when 'RedHat'
-      if ['2.1', '3', '4'].include?(Facter.value(:lsbdistrelease))
+      if ['2.1', '3', '4'].include?(Puppet.runtime[:facter].value(:lsbdistrelease))
         :up2date
       else
         :yum
       end
     when 'Fedora'
-      if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemmajrelease), '22') >= 0
+      if Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:operatingsystemmajrelease), '22') >= 0
         :dnf
       else
         :yum
       end
     when 'Suse'
-      if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemmajrelease), '10') >= 0
+      if Puppet::Util::Package.versioncmp(Puppet.runtime[:facter].value(:operatingsystemmajrelease), '10') >= 0
         :zypper
       else
         :rug
@@ -54,8 +54,8 @@ describe Puppet::Type.type(:package), "when choosing a default package provider"
   end
 
   it "should choose the correct provider each platform" do
-    unless default_provider = provider_name(Facter.value(:operatingsystem))
-      pending("No default provider specified in this test for #{Facter.value(:operatingsystem)}")
+    unless default_provider = provider_name(Puppet.runtime[:facter].value(:operatingsystem))
+      pending("No default provider specified in this test for #{Puppet.runtime[:facter].value(:operatingsystem)}")
     end
     expect(Puppet::Type.type(:package).defaultprovider.name).to eq(default_provider)
   end

data/spec/integration/util/rdoc/parser_spec.rb

@@ -91,7 +91,7 @@ end
         File.join(modules_dir, 'a_module', 'lib', 'facter', 'a_fact.rb'),
         <<-EOF
 # The a_fact fact comment
-Facter.add("a_fact") do
+Puppet.runtime[:facter].add("a_fact") do
 end
         EOF
       ],

data/spec/integration/util/windows/adsi_spec.rb

@@ -55,6 +55,24 @@ describe Puppet::Util::Windows::ADSI::User,
       end
     end
   end
+
+  describe '.current_user_name_with_format' do
+    context 'when desired format is NameSamCompatible' do
+      it 'should get the same user name as the current_user_name method but fully qualified' do
+        user_name = Puppet::Util::Windows::ADSI::User.current_user_name
+        fully_qualified_user_name = Puppet::Util::Windows::ADSI::User.current_sam_compatible_user_name
+
+        expect(fully_qualified_user_name).to match(/^.+\\#{user_name}$/)
+      end
+
+      it 'should have the same SID as with the current_user_name method' do
+        user_name = Puppet::Util::Windows::ADSI::User.current_user_name
+        fully_qualified_user_name = Puppet::Util::Windows::ADSI::User.current_sam_compatible_user_name
+
+        expect(Puppet::Util::Windows::SID.name_to_sid(user_name)).to eq(Puppet::Util::Windows::SID.name_to_sid(fully_qualified_user_name))
+      end
+    end
+  end
 end
 
 describe Puppet::Util::Windows::ADSI::Group,

data/spec/integration/util/windows/principal_spec.rb

@@ -7,6 +7,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet::Util::Platform.wi
   let (:system_bytes) { [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] }
   let (:null_sid_bytes) { [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] }
   let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
+  let (:all_application_packages_bytes) { [1, 2, 0, 0, 0, 0, 0, 15, 2, 0, 0, 0, 1, 0, 0, 0] }
   let (:computer_sid) { Puppet::Util::Windows::SID.name_to_principal(Puppet::Util::Windows::ADSI.computer_name) }
   # BUILTIN is localized on German Windows, but not French
   # looking this up like this dilutes the values of the tests as we're comparing two mechanisms
@@ -121,6 +122,26 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet::Util::Platform.wi
       expect(principal.to_s).to eq(builtin_localized)
     end
 
+    it "should always sanitize the account name first" do
+      expect(Puppet::Util::Windows::SID::Principal).to receive(:sanitize_account_name).with('NT AUTHORITY\\SYSTEM').and_call_original
+      Puppet::Util::Windows::SID::Principal.lookup_account_name('NT AUTHORITY\\SYSTEM')
+    end
+
+    it "should be able to create an instance from an account name prefixed by APPLICATION PACKAGE AUTHORITY" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES')
+      expect(principal.account).to eq('ALL APPLICATION PACKAGES')
+      expect(principal.sid_bytes).to eq(all_application_packages_bytes)
+      expect(principal.sid).to eq('S-1-15-2-1')
+      expect(principal.domain).to eq('APPLICATION PACKAGE AUTHORITY')
+      expect(principal.domain_account).to eq('APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES')
+      expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
+      expect(principal.to_s).to eq('APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES')
+    end
+
+    it "should fail without proper account name sanitization when it is prefixed by APPLICATION PACKAGE AUTHORITY" do
+      given_account_name = 'APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES'
+      expect { Puppet::Util::Windows::SID::Principal.lookup_account_name(nil, false, given_account_name) }.to raise_error(Puppet::Util::Windows::Error, /No mapping between account names and security IDs was done./)
+    end
   end
 
   describe ".lookup_account_sid" do

data/spec/integration/util/windows/process_spec.rb

@@ -1,22 +1,14 @@
 require 'spec_helper'
-require 'facter'
 
 describe "Puppet::Util::Windows::Process", :if => Puppet::Util::Platform.windows?  do
   describe "as an admin" do
-    it "should have the SeCreateSymbolicLinkPrivilege necessary to create symlinks on Vista / 2008+",
-      :if => Facter.value(:kernelmajversion).to_f >= 6.0 && Puppet::Util::Platform.windows? do
+    it "should have the SeCreateSymbolicLinkPrivilege necessary to create symlinks" do
       # this is a bit of a lame duck test since it requires running user to be admin
       # a better integration test would create a new user with the privilege and verify
       expect(Puppet::Util::Windows::User).to be_admin
       expect(Puppet::Util::Windows::Process.process_privilege_symlink?).to be_truthy
     end
 
-    it "should not have the SeCreateSymbolicLinkPrivilege necessary to create symlinks on 2003 and earlier",
-      :if => Facter.value(:kernelmajversion).to_f < 6.0 && Puppet::Util::Platform.windows? do
-      expect(Puppet::Util::Windows::User).to be_admin
-      expect(Puppet::Util::Windows::Process.process_privilege_symlink?).to be_falsey
-    end
-
     it "should be able to lookup a standard Windows process privilege" do
       Puppet::Util::Windows::Process.lookup_privilege_value('SeShutdownPrivilege') do |luid|
         expect(luid).not_to be_nil

data/spec/integration/util/windows/registry_spec.rb

@@ -263,6 +263,12 @@ describe Puppet::Util::Windows::Registry do
           type: Win32::Registry::REG_EXPAND_SZ,
           value: "\0\0\0reg expand string",
           expected_value: ""
+        },
+        {
+          name: 'REG_EXPAND_SZ_2',
+          type: Win32::Registry::REG_EXPAND_SZ,
+          value: "1\x002\x003\x004\x00\x00\x00\x90\xD8UoY".force_encoding("UTF-16LE"),
+          expected_value: "1234"
         }
       ].each do |pair|
         it 'reads up to the first wide null' do

data/spec/lib/puppet/test_ca.rb

@@ -30,7 +30,7 @@ module Puppet
     end
 
     def create_request(name)
-      key = OpenSSL::PKey::RSA.new(1024)
+      key = OpenSSL::PKey::RSA.new(2048)
       csr = OpenSSL::X509::Request.new
       csr.public_key = key.public_key
       csr.subject = OpenSSL::X509::Name.new([["CN", name]])
@@ -46,6 +46,11 @@ module Puppet
         ext = ef.create_extension(["subjectAltName", opts[:subject_alt_names], false])
         cert.add_extension(ext)
       end
+      if exts = opts[:extensions]
+        exts.each do |e|
+          cert.add_extension(OpenSSL::X509::Extension.new(*e))
+        end
+      end
       cert.sign(issuer_key, @digest)
       { private_key: key, cert: cert }
     end
@@ -127,7 +132,7 @@ module Puppet
       key = if opts[:key_type] == :ec
               key = OpenSSL::PKey::EC.generate('prime256v1')
             else
-              key = OpenSSL::PKey::RSA.new(1024)
+              key = OpenSSL::PKey::RSA.new(2048)
             end
       cert = OpenSSL::X509::Certificate.new
       cert.public_key = if key.is_a?(OpenSSL::PKey::EC)

data/spec/lib/puppet_spec/modules.rb

@@ -36,7 +36,7 @@ module PuppetSpec::Modules
         end
       end
 
-      if plans = options[:plans]
+      if (plans = options[:plans])
         plans_dir = File.join(module_dir, 'plans')
         FileUtils.mkdir_p(plans_dir)
         plans.each do |plan_file|
@@ -48,6 +48,17 @@ module PuppetSpec::Modules
         end
       end
 
+      if (scripts = options[:scripts])
+        scripts_dir = File.join(module_dir, 'scripts')
+        FileUtils.mkdir_p(scripts_dir)
+        scripts.each do |script_file|
+          if script_file.is_a?(String)
+            script_file = { :name => script_file, :content => "" }
+          end
+          File.write(File.join(scripts_dir, script_file[:name]), script_file[:content])
+        end
+      end
+
       (options[:files] || {}).each do |fname, content|
         path = File.join(module_dir, fname)
         FileUtils.mkdir_p(File.dirname(path))
@@ -61,7 +72,7 @@ module PuppetSpec::Modules
       module_dir = File.join(dir, name)
       FileUtils.mkdir_p(module_dir)
 
-      if metadata = options[:metadata]
+      if (metadata = options[:metadata])
         File.open(File.join(module_dir, 'metadata.json'), 'w') do |f|
           f.write(metadata.to_json)
         end

data/spec/lib/puppet_spec/puppetserver.rb

@@ -31,6 +31,19 @@ class PuppetSpec::Puppetserver
     end
   end
 
+  class FileMetadataServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      response['Content-Type'] = 'application/json'
+      response.body = "{\"path\":\"/etc/puppetlabs/code/environments/production/modules\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-03-06 20:14:25 UTC\"},\"type\":\"directory\",\"destination\":null}"
+    end
+  end
+
+  class FileContentServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      response.status = 404
+    end
+  end
+
   class ReportServlet < WEBrick::HTTPServlet::AbstractServlet
     def do_PUT request, response
       response['Content-Type'] = 'application/json'
@@ -106,7 +119,9 @@ class PuppetSpec::Puppetserver
     register_mount('/status/v1/simple/master', proc { |req, res|  }, nil)
     register_mount('/puppet/v3/node', mounts[:node], NodeServlet)
     register_mount('/puppet/v3/catalog', mounts[:catalog], CatalogServlet)
+    register_mount('/puppet/v3/file_metadata', mounts[:file_metadata], FileMetadataServlet)
     register_mount('/puppet/v3/file_metadatas', mounts[:file_metadatas], FileMetadatasServlet)
+    register_mount('/puppet/v3/file_content', mounts[:file_content], FileContentServlet)
     register_mount('/puppet/v3/static_file_content', mounts[:static_file_content], StaticFileContentServlet)
     register_mount('/puppet/v3/report', mounts[:report], ReportServlet)
     register_mount('/puppet/v3/file_bucket_file', mounts[:filebucket], FilebucketServlet)

data/spec/lib/puppet_spec/settings.rb

@@ -20,6 +20,7 @@ module PuppetSpec::Settings
   end.freeze
 
   def set_puppet_conf(confdir, settings)
+    FileUtils.mkdir_p(confdir)
     write_file(File.join(confdir, "puppet.conf"), settings)
   end
 

data/spec/shared_behaviours/documentation_on_faces.rb

@@ -176,8 +176,6 @@ shared_examples_for "documentation on faces" do
       subject.license = "foo"
       expect(subject.license).to eq("foo")
     end
-
-    it "should accept symbols to specify existing licenses..."
   end
 
   describe "#copyright" do

data/spec/shared_contexts/l10n.rb

@@ -0,0 +1,27 @@
+require 'spec_helper'
+
+RSpec.shared_context('l10n') do |locale|
+  before :all do
+    @old_locale = Locale.current
+    Locale.current = locale
+    Puppet::GettextConfig.setup_locale
+
+    # overwrite stubs with real implementation
+    ::Object.send(:remove_method, :_)
+    ::Object.send(:remove_method, :n_)
+    class ::Object
+      include FastGettext::Translation
+    end
+  end
+
+  after :all do
+    Locale.current = @old_locale
+
+    # restore stubs
+    load File.expand_path(File.join(__dir__, '../../lib/puppet/gettext/stubs.rb'))
+  end
+
+  before :each do
+    Puppet[:disable_i18n] = false
+  end
+end

data/spec/spec_helper.rb

@@ -68,16 +68,7 @@ VCR.turn_off!
 RSpec.configure do |config|
   include PuppetSpec::Fixtures
 
-  # Examples or groups can selectively tag themselves as broken.
-  # For example;
-  #
-  # rbv = "#{RUBY_VERSION}-p#{RbConfig::CONFIG['PATCHLEVEL']}"
-  # describe "mostly working", :broken => false unless rbv == "1.9.3-p327" do
-  #  it "parses a valid IP" do
-  #    IPAddr.new("::2:3:4:5:6:7:8")
-  #  end
-  # end
-  exclude_filters = {:broken => true}
+  exclude_filters = {}
   exclude_filters[:benchmark] = true unless ENV['BENCHMARK']
   config.filter_run_excluding exclude_filters
 
@@ -160,10 +151,20 @@ RSpec.configure do |config|
   PUPPET_FACTER_2_GCE_URL = %r{^http://metadata/computeMetadata/v1(beta1)?}.freeze
   PUPPET_FACTER_3_GCE_URL = "http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=json".freeze
 
+  # Facter azure metadata endpoint
+  PUPPET_FACTER_AZ_URL = "http://169.254.169.254/metadata/instance?api-version=2020-09-01"
+
+  # Facter EC2 endpoint
+  PUPPET_FACTER_EC2_METADATA_URL = 'http://169.254.169.254/latest/meta-data/'
+  PUPPET_FACTER_EC2_USERDATA_URL = 'http://169.254.169.254/latest/user-data/'
+
   config.around :each do |example|
-    # Ignore requests from Facter GCE fact in Travis
+    # Ignore requests from Facter to external services
     stub_request(:get, PUPPET_FACTER_2_GCE_URL)
     stub_request(:get, PUPPET_FACTER_3_GCE_URL)
+    stub_request(:get, PUPPET_FACTER_AZ_URL)
+    stub_request(:get, PUPPET_FACTER_EC2_METADATA_URL)
+    stub_request(:get, PUPPET_FACTER_EC2_USERDATA_URL)
 
     # Enable VCR if the example is tagged with `:vcr` metadata.
     if example.metadata[:vcr]

data/spec/unit/application/agent_spec.rb

@@ -546,11 +546,16 @@ describe Puppet::Application::Agent do
         @puppetd.options[:digest] = :MD5
       end
 
+      def expected_fingerprint(name, x509)
+        digest = OpenSSL::Digest.new(name).hexdigest(x509.to_der)
+        digest.scan(/../).join(':').upcase
+      end
+
       it "should fingerprint the certificate if it exists" do
         cert = cert_fixture('signed.pem')
         allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_return(cert)
 
-        expect(@puppetd).to receive(:puts).with('(MD5) E2:BA:9A:EF:20:A8:7D:10:8D:82:9A:61:5D:FD:5B:33')
+        expect(@puppetd).to receive(:puts).with("(MD5) #{expected_fingerprint('md5', cert)}")
 
         @puppetd.fingerprint
       end
@@ -560,7 +565,7 @@ describe Puppet::Application::Agent do
         allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_return(nil)
         allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_request).and_return(request)
 
-        expect(@puppetd).to receive(:puts).with('(MD5) B8:4C:FB:31:AE:17:86:E3:AD:53:97:CA:F6:3C:4A:CB')
+        expect(@puppetd).to receive(:puts).with("(MD5) #{expected_fingerprint('md5', request)}")
 
         @puppetd.fingerprint
       end