puppet 6.22.1 → 6.25.1

data/spec/fixtures/ssl/unknown-ca-key.pem

@@ -1,67 +1,117 @@
-RSA Private-Key: (1024 bit, 2 primes)
+RSA Private-Key: (2048 bit, 2 primes)
 modulus:
-    00:c1:5e:5d:26:ae:73:17:5a:70:37:ac:42:25:ca:
-    05:10:86:17:23:6c:28:84:48:2a:4a:d4:b0:3a:2a:
-    d8:33:ae:58:67:6f:9b:4f:a6:b4:87:b1:ec:37:00:
-    69:8d:d5:cf:71:8a:96:e1:4a:f8:c8:81:36:f9:43:
-    ad:d8:d6:76:83:27:99:a4:48:17:c2:ef:9c:22:40:
-    4b:c6:58:21:88:e5:1d:37:79:4e:ba:31:e6:52:ec:
-    8c:23:ed:d6:ce:3b:58:ad:82:c7:ae:28:47:d4:e7:
-    cc:31:ac:78:c9:02:87:d0:b1:91:09:f6:1e:9a:c3:
-    4f:f6:5a:fe:a2:21:0e:c0:95
+    00:b4:79:b0:16:e7:9b:22:20:17:4b:36:87:eb:38:
+    03:1f:df:88:00:1b:37:40:5e:1f:1d:89:1f:3e:f4:
+    fa:69:90:9c:d8:68:df:c8:71:07:07:4e:01:1d:f0:
+    a8:9a:67:94:af:47:f2:b8:60:f5:ca:fb:bb:ac:7c:
+    23:58:59:bc:95:b0:ad:b2:c7:a0:28:e1:4f:1e:c4:
+    ef:5f:2b:a3:4e:f2:6a:95:c8:4f:f5:af:bc:fa:36:
+    10:f9:a9:62:7a:04:d5:01:cd:9b:ba:97:32:4c:99:
+    e5:88:fc:05:84:34:f5:4a:f2:f1:ec:04:c7:c7:63:
+    28:eb:9e:ee:91:cd:95:8b:60:9e:5f:51:a1:2b:5a:
+    cd:02:b2:a7:52:6c:d1:8a:ab:b1:c4:52:cd:10:ce:
+    9e:56:24:6c:63:84:2c:15:6c:c0:62:ea:c2:d9:04:
+    88:e2:e2:0f:ff:ce:87:51:eb:77:50:83:33:1c:c7:
+    88:5b:08:d4:3a:22:2f:13:a6:89:f7:4b:a0:2e:30:
+    c1:12:7a:bb:37:1f:aa:87:56:44:2f:5a:63:4b:b2:
+    36:f6:29:5e:b8:67:52:6f:63:2a:ad:3d:c3:a5:45:
+    af:97:e9:85:9e:76:1e:51:9c:68:36:58:32:ad:cf:
+    3e:4d:f0:92:e2:ad:d6:f0:e1:5d:af:08:ca:2a:82:
+    0e:a3
 publicExponent: 65537 (0x10001)
 privateExponent:
-    60:5b:b7:ab:98:ee:fd:4a:31:f5:6c:3f:a2:39:23:
-    80:f2:71:01:53:da:74:e0:c9:42:74:ee:44:6e:29:
-    42:c7:b4:82:06:d9:ac:3d:74:64:d2:42:d5:bd:bc:
-    db:d3:1a:06:88:7b:5b:55:52:d8:07:9b:ef:66:cc:
-    70:eb:9e:2e:2b:7e:c1:34:84:9a:83:34:b2:70:c6:
-    59:72:60:a0:f4:f5:d9:f2:76:ae:bf:7d:23:35:ee:
-    ad:b1:2d:c1:fe:05:7d:5b:7f:2c:da:87:ec:6e:b0:
-    a3:08:c9:bd:e5:30:a4:c2:6e:6e:50:c0:5e:31:f6:
-    33:ef:86:57:64:45:b7:c1
+    00:9b:ce:8e:a2:47:93:5b:b3:be:c8:75:2c:84:7a:
+    97:df:f5:78:11:37:6d:cc:c9:35:2d:a7:8a:ed:2c:
+    4b:df:c5:34:53:74:be:f5:e9:f6:7a:6c:f2:73:e9:
+    a7:75:9d:c4:f4:4a:36:16:cd:c6:85:56:2c:a0:ed:
+    8f:0a:20:76:b9:f8:8d:0c:d2:60:c7:ca:34:27:49:
+    37:aa:bf:1e:be:f2:73:e8:19:c6:46:42:50:f0:e6:
+    aa:63:0f:c3:ef:b9:aa:37:63:4d:75:9a:40:97:77:
+    29:7d:c8:ad:ee:84:55:dc:3d:bf:73:d6:70:af:07:
+    41:75:a1:81:2f:29:00:59:11:3e:98:49:12:ec:e9:
+    9d:ca:ca:71:1e:bc:2f:9f:13:9c:5c:01:54:6d:69:
+    6b:85:6f:2a:2f:96:a5:38:37:e3:0c:7d:9f:6c:12:
+    a4:13:1b:bf:cb:35:16:88:a6:c6:47:6f:0b:61:22:
+    c2:de:00:7a:b1:70:f6:1e:01:99:70:87:1d:23:21:
+    0f:bf:41:59:16:75:40:8e:7c:50:73:bb:ce:17:7c:
+    07:ec:f2:83:12:95:4e:6a:ac:79:89:8f:32:58:61:
+    af:55:df:30:1d:3a:d1:f3:fa:ee:74:27:73:62:f8:
+    c4:e2:b2:e3:a5:64:e4:6b:4b:86:13:44:00:3d:51:
+    45:d9
 prime1:
-    00:e1:d6:07:8c:c6:4d:90:fa:d6:40:9a:1f:e5:34:
-    50:16:72:9f:5b:83:c1:60:d5:73:39:c2:c6:ec:3a:
-    ed:24:fe:aa:5d:16:14:ba:85:a4:7d:5a:94:e8:63:
-    f9:dd:25:a8:2c:6b:ca:7c:43:c7:a9:92:ae:35:5c:
-    85:47:9e:51:e9
+    00:da:9b:01:67:9b:20:66:3b:69:da:ce:9e:ac:fa:
+    03:84:8e:da:fb:04:8d:9b:f0:ff:c9:55:a4:26:c4:
+    b8:e3:1c:47:7d:fb:f5:2e:f6:50:22:75:63:ac:b7:
+    2d:f0:d5:75:0f:04:d5:e6:ee:75:9c:15:9f:e4:5c:
+    76:2c:0b:df:7f:9d:5f:16:3a:8a:82:36:6b:c9:fc:
+    49:e1:83:fe:cf:85:e1:fc:80:60:06:33:b2:e6:54:
+    6c:ba:29:6e:e4:3a:ee:d7:e6:0a:d6:bd:27:5d:40:
+    e0:89:97:89:2a:3e:cf:a5:ec:ae:5f:db:df:3e:e8:
+    c4:b0:9a:77:96:4d:a1:5e:5d
 prime2:
-    00:db:32:2e:59:ea:22:83:ce:d3:d5:7b:cb:b9:81:
-    b9:c2:4e:5b:08:ab:8f:66:21:34:55:61:50:57:02:
-    5e:d2:d9:09:8d:39:81:85:cd:4c:08:f3:b1:1a:b5:
-    b4:0c:3b:77:5e:c1:e0:95:f1:98:c6:f5:58:88:42:
-    50:b0:c3:41:cd
+    00:d3:58:ea:f8:aa:9b:e0:95:aa:81:27:f4:1a:5e:
+    ae:60:bf:0f:37:be:b8:64:78:d4:ce:47:7e:21:82:
+    49:a7:f6:ff:15:62:1c:87:e8:c2:d5:d2:9b:d2:21:
+    87:36:36:66:bc:03:23:8f:5e:09:2b:4f:a2:8a:7f:
+    ea:c8:ea:fb:21:54:4a:ba:b8:14:74:59:50:fa:31:
+    cf:31:c3:22:32:4a:db:05:b6:3c:f5:9f:6b:cd:3c:
+    6b:1b:48:b0:b5:13:5d:c7:b6:13:4e:09:85:e2:db:
+    38:ac:ee:27:42:d8:49:47:9e:0c:59:95:97:e7:c2:
+    78:0a:65:c9:ee:29:e8:50:ff
 exponent1:
-    00:b2:c8:27:4d:f0:a6:f3:41:40:60:00:23:83:e5:
-    f8:08:ed:50:ee:b7:cd:5d:05:5d:a4:ba:67:94:17:
-    ca:28:e1:5a:a9:3a:93:ca:5d:86:2c:9e:8b:07:b6:
-    2d:d6:3e:bb:75:ff:17:5b:6c:a5:21:bf:37:1e:93:
-    52:07:b2:74:11
+    50:f7:12:19:1e:72:6c:8a:da:d4:e8:ac:0a:62:fb:
+    04:90:a8:78:4a:22:6c:bc:60:f0:5f:e0:d1:5f:11:
+    1f:44:ad:11:f3:4c:c7:1d:01:67:11:d5:5d:f5:e6:
+    75:09:8a:36:8a:d2:f2:9a:25:43:2f:1b:2e:48:34:
+    98:71:b9:50:99:a7:cb:22:d9:84:0a:c5:f7:64:92:
+    b4:8c:df:c6:5a:ce:ed:67:5a:a9:51:62:94:3e:76:
+    9a:a8:97:e2:be:15:12:2f:a8:9a:0a:2a:d7:36:1d:
+    33:b8:c5:5b:b9:31:cd:41:90:ff:fd:fe:7c:5d:57:
+    e4:15:01:ef:d0:46:d1:1d
 exponent2:
-    63:f3:51:e7:76:38:1e:da:65:05:e7:d9:51:d1:b1:
-    9e:c4:94:06:34:14:c3:81:48:97:d6:34:08:38:f0:
-    7c:3c:b3:7a:4e:4a:9d:74:ab:c3:39:3b:fc:ed:f6:
-    17:cd:d5:f4:c3:7b:61:64:35:42:24:06:26:bb:f6:
-    87:63:c1:d1
+    00:91:f0:d9:b8:c2:df:06:b3:72:dc:e3:00:fd:e0:
+    99:9b:76:f3:84:33:ef:d2:79:59:c1:e3:be:66:57:
+    38:93:82:cc:dc:30:36:b1:66:fa:7b:7a:86:5d:11:
+    07:f4:58:96:92:87:bc:5b:78:bc:ee:2a:7c:7c:15:
+    1e:c4:84:f6:cb:2a:10:bc:64:f6:c2:ed:16:2c:de:
+    8e:4b:b7:8a:7a:9e:14:26:1a:94:77:ac:11:5d:d4:
+    b5:c5:4e:69:af:70:63:16:d0:54:fe:53:37:1f:d2:
+    ef:8d:02:9b:1b:de:8c:a3:a6:b0:b2:7f:c9:38:a1:
+    a2:10:d3:ff:1f:b5:d2:95:73
 coefficient:
-    00:8a:5b:12:c8:57:3c:1e:95:32:eb:5e:e3:92:50:
-    2c:7b:6a:02:a4:18:48:30:cc:23:9f:79:91:dd:56:
-    e8:ae:f7:93:47:ed:a6:26:35:6b:aa:7c:2c:f2:36:
-    01:33:f3:0f:df:50:c9:c8:0a:e7:6e:ec:ba:54:a0:
-    8d:0f:09:40:fd
+    00:bb:0a:77:ec:98:3c:fe:92:2b:66:06:7a:2a:80:
+    a6:41:bb:d8:60:7e:fa:90:41:f3:4d:e4:4e:95:1e:
+    48:19:33:49:9a:24:09:6c:17:98:ce:72:09:ad:96:
+    43:3a:16:6c:16:cd:38:39:13:58:3e:dc:89:98:08:
+    38:d3:e5:d8:c1:34:8c:71:a9:88:a1:79:23:af:ad:
+    94:04:7a:ca:20:82:76:af:84:2a:43:c4:d6:96:b0:
+    c8:f7:e6:be:4c:e8:d8:7c:bb:79:7a:c8:d9:32:72:
+    81:63:9f:2c:45:33:e3:6a:6a:42:3d:d6:19:b4:0d:
+    0d:15:1b:44:67:47:ef:b6:2e
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDBXl0mrnMXWnA3rEIlygUQhhcjbCiESCpK1LA6Ktgzrlhnb5tP
-prSHsew3AGmN1c9xipbhSvjIgTb5Q63Y1naDJ5mkSBfC75wiQEvGWCGI5R03eU66
-MeZS7Iwj7dbOO1itgseuKEfU58wxrHjJAofQsZEJ9h6aw0/2Wv6iIQ7AlQIDAQAB
-AoGAYFu3q5ju/Uox9Ww/ojkjgPJxAVPadODJQnTuRG4pQse0ggbZrD10ZNJC1b28
-29MaBoh7W1VS2Aeb72bMcOueLit+wTSEmoM0snDGWXJgoPT12fJ2rr99IzXurbEt
-wf4FfVt/LNqH7G6wowjJveUwpMJublDAXjH2M++GV2RFt8ECQQDh1geMxk2Q+tZA
-mh/lNFAWcp9bg8Fg1XM5wsbsOu0k/qpdFhS6haR9WpToY/ndJagsa8p8Q8epkq41
-XIVHnlHpAkEA2zIuWeoig87T1XvLuYG5wk5bCKuPZiE0VWFQVwJe0tkJjTmBhc1M
-CPOxGrW0DDt3XsHglfGYxvVYiEJQsMNBzQJBALLIJ03wpvNBQGAAI4Pl+AjtUO63
-zV0FXaS6Z5QXyijhWqk6k8pdhiyeiwe2LdY+u3X/F1tspSG/Nx6TUgeydBECQGPz
-Ued2OB7aZQXn2VHRsZ7ElAY0FMOBSJfWNAg48Hw8s3pOSp10q8M5O/zt9hfN1fTD
-e2FkNUIkBia79odjwdECQQCKWxLIVzwelTLrXuOSUCx7agKkGEgwzCOfeZHdVuiu
-95NH7aYmNWuqfCzyNgEz8w/fUMnICudu7LpUoI0PCUD9
+MIIEpQIBAAKCAQEAtHmwFuebIiAXSzaH6zgDH9+IABs3QF4fHYkfPvT6aZCc2Gjf
+yHEHB04BHfCommeUr0fyuGD1yvu7rHwjWFm8lbCtssegKOFPHsTvXyujTvJqlchP
+9a+8+jYQ+aliegTVAc2bupcyTJnliPwFhDT1SvLx7ATHx2Mo657ukc2Vi2CeX1Gh
+K1rNArKnUmzRiquxxFLNEM6eViRsY4QsFWzAYurC2QSI4uIP/86HUet3UIMzHMeI
+WwjUOiIvE6aJ90ugLjDBEnq7Nx+qh1ZEL1pjS7I29ileuGdSb2MqrT3DpUWvl+mF
+nnYeUZxoNlgyrc8+TfCS4q3W8OFdrwjKKoIOowIDAQABAoIBAQCbzo6iR5Nbs77I
+dSyEepff9XgRN23MyTUtp4rtLEvfxTRTdL716fZ6bPJz6ad1ncT0SjYWzcaFViyg
+7Y8KIHa5+I0M0mDHyjQnSTeqvx6+8nPoGcZGQlDw5qpjD8Pvuao3Y011mkCXdyl9
+yK3uhFXcPb9z1nCvB0F1oYEvKQBZET6YSRLs6Z3KynEevC+fE5xcAVRtaWuFbyov
+lqU4N+MMfZ9sEqQTG7/LNRaIpsZHbwthIsLeAHqxcPYeAZlwhx0jIQ+/QVkWdUCO
+fFBzu84XfAfs8oMSlU5qrHmJjzJYYa9V3zAdOtHz+u50J3Ni+MTisuOlZORrS4YT
+RAA9UUXZAoGBANqbAWebIGY7adrOnqz6A4SO2vsEjZvw/8lVpCbEuOMcR3379S72
+UCJ1Y6y3LfDVdQ8E1ebudZwVn+RcdiwL33+dXxY6ioI2a8n8SeGD/s+F4fyAYAYz
+suZUbLopbuQ67tfmCta9J11A4ImXiSo+z6Xsrl/b3z7oxLCad5ZNoV5dAoGBANNY
+6viqm+CVqoEn9BpermC/Dze+uGR41M5HfiGCSaf2/xViHIfowtXSm9IhhzY2ZrwD
+I49eCStPoop/6sjq+yFUSrq4FHRZUPoxzzHDIjJK2wW2PPWfa808axtIsLUTXce2
+E04JheLbOKzuJ0LYSUeeDFmVl+fCeAplye4p6FD/AoGAUPcSGR5ybIra1OisCmL7
+BJCoeEoibLxg8F/g0V8RH0StEfNMxx0BZxHVXfXmdQmKNorS8polQy8bLkg0mHG5
+UJmnyyLZhArF92SStIzfxlrO7WdaqVFilD52mqiX4r4VEi+omgoq1zYdM7jFW7kx
+zUGQ//3+fF1X5BUB79BG0R0CgYEAkfDZuMLfBrNy3OMA/eCZm3bzhDPv0nlZweO+
+Zlc4k4LM3DA2sWb6e3qGXREH9FiWkoe8W3i87ip8fBUexIT2yyoQvGT2wu0WLN6O
+S7eKep4UJhqUd6wRXdS1xU5pr3BjFtBU/lM3H9LvjQKbG96Mo6awsn/JOKGiENP/
+H7XSlXMCgYEAuwp37Jg8/pIrZgZ6KoCmQbvYYH76kEHzTeROlR5IGTNJmiQJbBeY
+znIJrZZDOhZsFs04ORNYPtyJmAg40+XYwTSMcamIoXkjr62UBHrKIIJ2r4QqQ8TW
+lrDI9+a+TOjYfLt5esjZMnKBY58sRTPjampCPdYZtA0NFRtEZ0fvti4=
 -----END RSA PRIVATE KEY-----

data/spec/fixtures/ssl/unknown-ca.pem

@@ -6,21 +6,30 @@ Certificate:
         Issuer: CN=Unknown CA
         Validity
             Not Before: Jan  1 00:00:00 1970 GMT
-            Not After : Mar 10 06:54:16 2030 GMT
+            Not After : Jun 15 01:19:37 2031 GMT
         Subject: CN=Unknown CA
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
-                RSA Public-Key: (1024 bit)
+                RSA Public-Key: (2048 bit)
                 Modulus:
-                    00:c1:5e:5d:26:ae:73:17:5a:70:37:ac:42:25:ca:
-                    05:10:86:17:23:6c:28:84:48:2a:4a:d4:b0:3a:2a:
-                    d8:33:ae:58:67:6f:9b:4f:a6:b4:87:b1:ec:37:00:
-                    69:8d:d5:cf:71:8a:96:e1:4a:f8:c8:81:36:f9:43:
-                    ad:d8:d6:76:83:27:99:a4:48:17:c2:ef:9c:22:40:
-                    4b:c6:58:21:88:e5:1d:37:79:4e:ba:31:e6:52:ec:
-                    8c:23:ed:d6:ce:3b:58:ad:82:c7:ae:28:47:d4:e7:
-                    cc:31:ac:78:c9:02:87:d0:b1:91:09:f6:1e:9a:c3:
-                    4f:f6:5a:fe:a2:21:0e:c0:95
+                    00:b4:79:b0:16:e7:9b:22:20:17:4b:36:87:eb:38:
+                    03:1f:df:88:00:1b:37:40:5e:1f:1d:89:1f:3e:f4:
+                    fa:69:90:9c:d8:68:df:c8:71:07:07:4e:01:1d:f0:
+                    a8:9a:67:94:af:47:f2:b8:60:f5:ca:fb:bb:ac:7c:
+                    23:58:59:bc:95:b0:ad:b2:c7:a0:28:e1:4f:1e:c4:
+                    ef:5f:2b:a3:4e:f2:6a:95:c8:4f:f5:af:bc:fa:36:
+                    10:f9:a9:62:7a:04:d5:01:cd:9b:ba:97:32:4c:99:
+                    e5:88:fc:05:84:34:f5:4a:f2:f1:ec:04:c7:c7:63:
+                    28:eb:9e:ee:91:cd:95:8b:60:9e:5f:51:a1:2b:5a:
+                    cd:02:b2:a7:52:6c:d1:8a:ab:b1:c4:52:cd:10:ce:
+                    9e:56:24:6c:63:84:2c:15:6c:c0:62:ea:c2:d9:04:
+                    88:e2:e2:0f:ff:ce:87:51:eb:77:50:83:33:1c:c7:
+                    88:5b:08:d4:3a:22:2f:13:a6:89:f7:4b:a0:2e:30:
+                    c1:12:7a:bb:37:1f:aa:87:56:44:2f:5a:63:4b:b2:
+                    36:f6:29:5e:b8:67:52:6f:63:2a:ad:3d:c3:a5:45:
+                    af:97:e9:85:9e:76:1e:51:9c:68:36:58:32:ad:cf:
+                    3e:4d:f0:92:e2:ad:d6:f0:e1:5d:af:08:ca:2a:82:
+                    0e:a3
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -28,32 +37,45 @@ Certificate:
             X509v3 Key Usage: critical
                 Certificate Sign, CRL Sign
             X509v3 Subject Key Identifier: 
-                E9:58:70:FE:F1:C1:AA:5A:70:7A:C1:02:11:1D:9A:F4:60:4F:70:76
+                D0:CD:40:49:88:F6:74:BB:B4:D7:05:37:74:33:B1:C2:27:73:81:CB
             Netscape Comment: 
                 Puppet Server Internal Certificate
             X509v3 Authority Key Identifier: 
-                keyid:E9:58:70:FE:F1:C1:AA:5A:70:7A:C1:02:11:1D:9A:F4:60:4F:70:76
+                keyid:D0:CD:40:49:88:F6:74:BB:B4:D7:05:37:74:33:B1:C2:27:73:81:CB
 
     Signature Algorithm: sha256WithRSAEncryption
-         00:45:89:e8:68:a7:50:8c:92:84:3c:c4:e6:10:00:29:27:99:
-         c6:82:aa:aa:b5:0b:ef:97:58:bc:bb:e6:e7:93:7c:a7:ea:e5:
-         9a:61:1d:e3:4f:3f:f9:ac:c4:96:14:a5:1f:77:a6:01:dc:08:
-         15:9c:3f:66:29:92:80:49:e9:db:d9:22:fb:c3:86:bf:40:ab:
-         46:bf:c5:47:bb:c8:89:df:d4:ca:36:f5:08:c4:08:c6:0b:d6:
-         9e:8a:86:41:1e:7e:6f:a9:75:ef:8a:94:a9:fd:1a:9b:0f:55:
-         3a:55:e5:04:82:71:c3:47:78:62:8e:07:ed:dc:4e:ac:f9:33:
-         7b:27
+         51:79:86:29:27:07:e5:fc:59:83:2d:15:ae:5f:c4:bc:0a:71:
+         2c:71:74:20:14:ce:47:8f:cf:79:03:76:bd:df:c9:e9:7f:12:
+         b2:4e:5a:c5:4f:e1:0b:c3:17:44:92:37:af:10:08:75:9a:d9:
+         c5:0d:66:e9:24:2b:ec:00:aa:de:2f:ce:df:04:fa:49:d9:bd:
+         bd:5e:7b:e4:e7:1e:9e:20:d3:85:70:b4:95:b5:1d:2e:fa:0c:
+         b4:47:5a:38:ec:b0:bd:7e:34:5f:4d:9d:1f:81:81:8a:6c:a6:
+         94:fb:f8:41:d6:a3:e4:64:3a:b7:12:4f:9e:4e:60:4a:12:a9:
+         d1:87:a5:a8:31:91:16:96:50:73:87:64:46:f1:f2:f9:99:80:
+         a2:89:e9:99:57:48:8a:56:08:d7:8d:a9:1d:69:7c:8f:73:e5:
+         53:2d:28:ee:70:d7:f8:fe:41:25:3e:4c:6c:de:31:3f:9e:7d:
+         c4:f0:67:e9:fc:a3:02:c7:39:19:f5:6f:59:6a:ca:bb:8c:c8:
+         e6:01:43:ad:95:67:3f:c0:d6:35:18:b1:6e:9f:e1:ce:c7:be:
+         35:f0:7b:65:e7:79:82:c3:b6:f7:48:28:98:d0:5c:3c:97:f3:
+         69:b3:5e:c3:a0:c5:82:02:6f:20:d0:1b:cd:43:b0:85:7e:4f:
+         71:b9:f3:8f
 -----BEGIN CERTIFICATE-----
-MIICODCCAaGgAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDDApVbmtu
-b3duIENBMB4XDTcwMDEwMTAwMDAwMFoXDTMwMDMxMDA2NTQxNlowFTETMBEGA1UE
-AwwKVW5rbm93biBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwV5dJq5z
-F1pwN6xCJcoFEIYXI2wohEgqStSwOirYM65YZ2+bT6a0h7HsNwBpjdXPcYqW4Ur4
-yIE2+UOt2NZ2gyeZpEgXwu+cIkBLxlghiOUdN3lOujHmUuyMI+3WzjtYrYLHrihH
-1OfMMax4yQKH0LGRCfYemsNP9lr+oiEOwJUCAwEAAaOBlzCBlDAPBgNVHRMBAf8E
-BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU6Vhw/vHBqlpwesECER2a
-9GBPcHYwMQYJYIZIAYb4QgENBCQWIlB1cHBldCBTZXJ2ZXIgSW50ZXJuYWwgQ2Vy
-dGlmaWNhdGUwHwYDVR0jBBgwFoAU6Vhw/vHBqlpwesECER2a9GBPcHYwDQYJKoZI
-hvcNAQELBQADgYEAAEWJ6GinUIyShDzE5hAAKSeZxoKqqrUL75dYvLvm55N8p+rl
-mmEd408/+azElhSlH3emAdwIFZw/ZimSgEnp29ki+8OGv0CrRr/FR7vIid/Uyjb1
-CMQIxgvWnoqGQR5+b6l174qUqf0amw9VOlXlBIJxw0d4Yo4H7dxOrPkzeyc=
+MIIDPTCCAiWgAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDDApVbmtu
+b3duIENBMB4XDTcwMDEwMTAwMDAwMFoXDTMxMDYxNTAxMTkzN1owFTETMBEGA1UE
+AwwKVW5rbm93biBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALR5
+sBbnmyIgF0s2h+s4Ax/fiAAbN0BeHx2JHz70+mmQnNho38hxBwdOAR3wqJpnlK9H
+8rhg9cr7u6x8I1hZvJWwrbLHoCjhTx7E718ro07yapXIT/WvvPo2EPmpYnoE1QHN
+m7qXMkyZ5Yj8BYQ09Ury8ewEx8djKOue7pHNlYtgnl9RoStazQKyp1Js0YqrscRS
+zRDOnlYkbGOELBVswGLqwtkEiOLiD//Oh1Hrd1CDMxzHiFsI1DoiLxOmifdLoC4w
+wRJ6uzcfqodWRC9aY0uyNvYpXrhnUm9jKq09w6VFr5fphZ52HlGcaDZYMq3PPk3w
+kuKt1vDhXa8IyiqCDqMCAwEAAaOBlzCBlDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud
+DwEB/wQEAwIBBjAdBgNVHQ4EFgQU0M1ASYj2dLu01wU3dDOxwidzgcswMQYJYIZI
+AYb4QgENBCQWIlB1cHBldCBTZXJ2ZXIgSW50ZXJuYWwgQ2VydGlmaWNhdGUwHwYD
+VR0jBBgwFoAU0M1ASYj2dLu01wU3dDOxwidzgcswDQYJKoZIhvcNAQELBQADggEB
+AFF5hiknB+X8WYMtFa5fxLwKcSxxdCAUzkePz3kDdr3fyel/ErJOWsVP4QvDF0SS
+N68QCHWa2cUNZukkK+wAqt4vzt8E+knZvb1ee+TnHp4g04VwtJW1HS76DLRHWjjs
+sL1+NF9NnR+BgYpsppT7+EHWo+RkOrcST55OYEoSqdGHpagxkRaWUHOHZEbx8vmZ
+gKKJ6ZlXSIpWCNeNqR1pfI9z5VMtKO5w1/j+QSU+TGzeMT+efcTwZ+n8owLHORn1
+b1lqyruMyOYBQ62VZz/A1jUYsW6f4c7HvjXwe2XneYLDtvdIKJjQXDyX82mzXsOg
+xYICbyDQG81DsIV+T3G5848=
 -----END CERTIFICATE-----

data/spec/integration/application/agent_spec.rb

@@ -472,67 +472,58 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
   end
 
   context 'multiple agents running' do
-    it "exits if an agent is already running" do
+    def with_another_agent_running(&block)
       path = Puppet[:agent_catalog_run_lockfile]
 
       th = Thread.new {
-        %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(2)"}
+        %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(5)"}
       }
 
+      # ensure file is written before yielding
       until File.exists?(path) && File.size(path) > 0 do
         sleep 0.1
       end
 
-      expect {
-        agent.command_line.args << '--test'
-        agent.run
-      }.to exit_with(1).and output(/Run of Puppet configuration client already in progress; skipping/).to_stdout
+      begin
+        yield
+      ensure
+        th.kill # kill thread so we don't wait too much
+      end
+    end
 
-      th.kill # kill thread so we don't wait too much
+    it "exits if an agent is already running" do
+      with_another_agent_running do
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(1).and output(/Run of Puppet configuration client already in progress; skipping/).to_stdout
+      end
     end
 
     it "waits for other agent run to finish before starting" do
       server.start_server do |port|
-        path = Puppet[:agent_catalog_run_lockfile]
         Puppet[:serverport] = port
         Puppet[:waitforlock] = 1
 
-        th = Thread.new {
-          %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(2)"}
-        }
-
-        until File.exists?(path) && File.size(path) > 0 do
-          sleep 0.1
+        with_another_agent_running do
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(0).and output(/Info: Will try again in #{Puppet[:waitforlock]} seconds./).to_stdout
         end
-
-        expect {
-          agent.command_line.args << '--test'
-          agent.run
-        }.to exit_with(0).and output(/Info: Will try again in #{Puppet[:waitforlock]} seconds./).to_stdout
-
-        th.kill # kill thread so we don't wait too much
       end
     end
 
     it "exits if maxwaitforlock is exceeded" do
-      path = Puppet[:agent_catalog_run_lockfile]
       Puppet[:waitforlock] = 1
       Puppet[:maxwaitforlock] = 0
 
-      th = Thread.new {
-        %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(2)"}
-      }
-
-      until File.exists?(path) && File.size(path) > 0 do
-        sleep 0.1
+      with_another_agent_running do
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(1).and output(/Exiting now because the maxwaitforlock timeout has been exceeded./).to_stdout
       end
-
-      expect {
-        agent.command_line.args << '--test'
-        agent.run
-      }.to exit_with(1).and output(/Exiting now because the maxwaitforlock timeout has been exceeded./).to_stdout
-
-      th.kill # kill thread so we don't wait too much
     end
   end
 
@@ -572,7 +563,7 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
        ).and matching(
          /Notify\[a message\]\/message:/
        )).to_stdout
-       .and output(/the agent run will continue/).to_stderr
+       .and output(/Could not retrieve catalog from remote server/).to_stderr
     end
 
     it 'preserves the old cached catalog if validation fails with the old one' do
@@ -591,7 +582,7 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
           agent.command_line.args << '--test'
           agent.run
         }.to exit_with(1)
-         .and output(/Using configured environment/).to_stdout
+         .and output(%r{Retrieving plugin}).to_stdout
          .and output(%r{Validation of Exec\[unqualified_command\] failed: 'unqualified_command' is not qualified and no path was specified}).to_stderr
       end
 
@@ -632,5 +623,118 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
         expect(report.metrics).to_not be_empty
       end
     end
+
+    it "caches a report even if the REST request fails" do
+      server.start_server do |port|
+        Puppet[:serverport] = port
+        Puppet[:report_port] = "-1"
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(%r{Applied catalog}).to_stdout
+         .and output(%r{Could not send report}).to_stderr
+
+        report = Puppet::Transaction::Report.convert_from(:yaml, File.read(Puppet[:lastrunreport]))
+        expect(report).to be
+      end
+    end
+  end
+
+  context "environment convergence" do
+    it "falls back to making a node request if the last server-specified environment cannot be loaded" do
+      mounts = {}
+      mounts[:node] = -> (req, res) {
+        node = Puppet::Node.new('test', environment: Puppet::Node::Environment.remote('doesnotexistonagent'))
+        res.body = formatter.render(node)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: mounts) do |port|
+        Puppet[:serverport] = port
+        Puppet[:log_level] = 'debug'
+
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(a_string_matching(%r{Debug: Requesting environment from the server})).to_stdout
+
+        Puppet::Application.clear!
+
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(0)
+         .and output(a_string_matching(%r{Debug: Successfully loaded last environment from the lastrunfile})).to_stdout
+      end
+    end
+
+    it "switches to 'newenv' environment and retries the run" do
+      first_run = true
+      libdir = File.join(my_fixture_dir, 'lib')
+
+      # we have to use the :facter terminus to reliably test that pluginsynced
+      # facts are included in the catalog request
+      Puppet::Node::Facts.indirection.terminus_class = :facter
+
+      mounts = {}
+
+      # During the first run, only return metadata for the top-level directory.
+      # During the second run, include metadata for all of the 'lib' fixtures
+      # due to the `recurse` option.
+      mounts[:file_metadatas] = -> (req, res) {
+        request = Puppet::FileServing::Metadata.indirection.request(
+          :search, libdir, nil, recurse: !first_run
+        )
+        data = Puppet::FileServing::Metadata.indirection.terminus(:file).search(request)
+        res.body = formatter.render(data)
+        res['Content-Type'] = formatter.mime
+      }
+
+      mounts[:file_content] = -> (req, res) {
+        request = Puppet::FileServing::Content.indirection.request(
+          :find, File.join(libdir, 'facter', 'agent_spec_role.rb'), nil
+        )
+        content = Puppet::FileServing::Content.indirection.terminus(:file).find(request)
+        res.body = content.content
+        res['Content-Length'] = content.content.length
+        res['Content-Type'] = 'application/octet-stream'
+      }
+
+      # During the first run, return an empty catalog referring to the newenv.
+      # During the second run, compile a catalog that depends on a fact that
+      # only exists in the second environment. If the fact is missing/empty,
+      # then compilation will fail since resources can't have an empty title.
+      mounts[:catalog] = -> (req, res) {
+        node = Puppet::Node.new('test')
+
+        code = if first_run
+                 first_run = false
+                 ''
+               else
+                 data = CGI.unescape(req.query['facts'])
+                 facts = Puppet::Node::Facts.convert_from('json', data)
+                 node.fact_merge(facts)
+                 'notify { $facts["agent_spec_role"]: }'
+               end
+
+        catalog = compile_to_catalog(code, node)
+        catalog.environment = 'newenv'
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: mounts) do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(a_string_matching(%r{Notice: Local environment: 'production' doesn't match server specified environment 'newenv', restarting agent run with environment 'newenv'})
+         .and matching(%r{defined 'message' as 'web'})).to_stdout
+      end
+    end
   end
 end

data/spec/integration/application/filebucket_spec.rb

@@ -18,6 +18,11 @@ describe "puppet filebucket", unless: Puppet::Util::Platform.jruby? do
     File.binwrite(backup_file, text)
   end
 
+  after :each do
+    # mute debug messages generated during `after :each` blocks
+    Puppet::Util::Log.close_all
+  end
+
   it "backs up to and restores from the local filebucket" do
     filebucket.command_line.args = ['backup', backup_file, '--local']
     expect {
@@ -126,6 +131,17 @@ describe "puppet filebucket", unless: Puppet::Util::Platform.jruby? do
     end
   end
 
+  it "lists the local filebucket even if the environment doesn't exist locally" do
+    Puppet[:environment] = 'doesnotexist'
+    Puppet::FileSystem.mkpath(Puppet[:clientbucketdir])
+
+    filebucket.command_line.args = ['backup', '--local', backup_file]
+    expect {
+      result = filebucket.run
+      expect(result).to eq([backup_file])
+    }.to output(/Computing checksum on file/).to_stdout
+  end
+
   context 'diff', unless: Puppet::Util::Platform.windows? || Puppet::Util::Platform.jruby? do
     context 'using a remote bucket' do
       it 'outputs a diff between a local and remote file' do

data/spec/integration/application/module_spec.rb

@@ -65,4 +65,25 @@ describe 'puppet module', unless: Puppet::Util::Platform.jruby? do
        .and output(%r{Unable to verify the SSL certificate}).to_stderr
     end
   end
+
+  it 'prints the complete URL it tried to connect to' do
+    response_proc = -> (req, res) { res.status = 404 }
+
+    # create a temp cacert bundle
+    ssl_file = tmpfile('systemstore')
+    File.write(ssl_file, server.ca_cert)
+
+    Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+      server.start_server(response_proc: response_proc) do |port|
+        Puppet[:module_repository] = "https://127.0.0.1:#{port}/bogus_test/puppet"
+
+        expect {
+          app.command_line.args = ['install', 'puppetlabs-bacula']
+          app.run
+        }.to exit_with(1)
+         .and output(%r{Notice: Downloading from https://127.0.0.1:#{port}}).to_stdout
+         .and output(%r{https://127.0.0.1:#{port}/bogus_test/puppet/v3/releases}).to_stderr
+      end
+    end
+  end
 end