puppet 6.23.0 → 6.26.0

data/spec/unit/type/service_spec.rb

@@ -158,6 +158,33 @@ describe test_title, "when validating attribute values" do
         expect(srv[:timeout]).to eq(int)
       end
     end
+
+    it "should default :timeout to 10 when provider has no default value" do
+      srv = Puppet::Type.type(:service).new(:name => "yay")
+      expect(srv[:timeout]).to eq(10)
+    end
+
+    it "should default :timeout to provider given default time when it has one" do
+      provider_class_with_timeout = Puppet::Type.type(:service).provide(:simple) do
+        has_features :configurable_timeout
+        def default_timeout
+          30
+        end
+      end
+      allow(Puppet::Type.type(:service)).to receive(:defaultprovider).and_return(provider_class_with_timeout)
+
+      srv = Puppet::Type.type(:service).new(:name => "yay")
+      expect(srv[:timeout]).to eq(30)
+    end
+
+    it "should accept string as value" do
+      srv = Puppet::Type.type(:service).new(:name => "yay", :timeout => "25")
+      expect(srv[:timeout]).to eq(25)
+    end
+
+    it "should not support values that cannot be converted to Integer such as Array" do
+      expect { Puppet::Type.type(:service).new(:name => "yay", :timeout => [25]) }.to raise_error(Puppet::Error)
+    end
   end
 
   describe "the service logon credentials" do 

data/spec/unit/type/tidy_spec.rb

@@ -280,6 +280,13 @@ describe tidy do
         @ager.tidy?(@basepath, @stat)
       end
 
+      it "should return true if the specified age is 0" do
+        @tidy[:age] = "0"
+        expect(@stat).to receive(:mtime).and_return(Time.now)
+
+        expect(@ager).to be_tidy(@basepath, @stat)
+      end
+
       it "should return false if the file is more recent than the specified age" do
         expect(@stat).to receive(:mtime).and_return(Time.now)
 

data/spec/unit/type/user_spec.rb

@@ -174,51 +174,6 @@ describe Puppet::Type.type(:user) do
     end
   end
 
-  describe "when managing the purge_ssh_keys property" do
-    context "with valid input" do
-      it "should support a :true value" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => :true) }.to_not raise_error
-      end
-
-      it "should support a :false value" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => :false) }.to_not raise_error
-      end
-
-      it "should support a String value" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => File.expand_path('home/foo/.ssh/authorized_keys')) }.to_not raise_error
-      end
-
-      it "should support an Array value" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => [File.expand_path('home/foo/.ssh/authorized_keys'),
-          File.expand_path('custom/authorized_keys')]) }.to_not raise_error
-      end
-    end
-
-    context "with faulty input" do
-      it "should raise error for relative path" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => 'home/foo/.ssh/authorized_keys') }.to raise_error(Puppet::ResourceError,
-          /Paths to keyfiles must be absolute/ )
-      end
-
-      it "should raise error for invalid type" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => :invalid) }.to raise_error(Puppet::ResourceError,
-          /purge_ssh_keys must be true, false, or an array of file names/ )
-      end
-
-      it "should raise error for array with relative path" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => ['home/foo/.ssh/authorized_keys',
-          File.expand_path('custom/authorized_keys')]) }.to raise_error(Puppet::ResourceError,
-          /Paths to keyfiles must be absolute/ )
-      end
-
-      it "should raise error for array with invalid type" do
-        expect { described_class.new(:name => 'foo', :purge_ssh_keys => [:invalid,
-          File.expand_path('custom/authorized_keys')]) }.to raise_error(Puppet::ResourceError,
-          /Each entry for purge_ssh_keys must be a string/ )
-      end
-    end
-  end
-
   describe "when managing the uid property" do
     it "should convert number-looking strings into actual numbers" do
       expect(described_class.new(:name => 'foo', :uid => '50')[:uid]).to eq(50)

data/spec/unit/type_spec.rb

@@ -1122,7 +1122,7 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
 
       before :each do
         type.provide(:default) do
-          defaultfor :operatingsystem => Facter.value(:operatingsystem)
+          defaultfor :operatingsystem => Puppet.runtime[:facter].value(:operatingsystem)
           mk_resource_methods
           class << self
             attr_accessor :params
@@ -1152,7 +1152,7 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
     context "with a default provider" do
       before :each do
         type.provide(:default) do
-          defaultfor :operatingsystem => Facter.value(:operatingsystem)
+          defaultfor :operatingsystem => Puppet.runtime[:facter].value(:operatingsystem)
           mk_resource_methods
           class << self
             attr_accessor :names

data/spec/unit/util/json_spec.rb

@@ -0,0 +1,126 @@
+# coding: utf-8
+require 'spec_helper'
+require 'puppet/util/json'
+
+describe Puppet::Util::Json do
+  include PuppetSpec::Files
+
+  shared_examples_for 'json file loader' do |load_method|
+    it 'reads a JSON file from disk' do
+      file_path = file_containing('input', JSON.dump({ "my" => "data" }))
+
+      expect(load_method.call(file_path)).to eq({ "my" => "data" })
+    end
+
+    it 'reads JSON as UTF-8' do
+      file_path = file_containing('input', JSON.dump({ "my" => "𠜎" }))
+
+      expect(load_method.call(file_path)).to eq({ "my" => "𠜎" })
+    end
+  end
+
+  context "#load" do
+    it 'raises an error if JSON is invalid' do
+      expect {
+        Puppet::Util::Json.load('{ invalid')
+      }.to raise_error(Puppet::Util::Json::ParseError, /unexpected token at '{ invalid'/)
+    end
+
+    it 'raises an error if the content is empty' do
+      expect {
+        Puppet::Util::Json.load('')
+      }.to raise_error(Puppet::Util::Json::ParseError)
+    end
+
+    it 'loads true' do
+      expect(Puppet::Util::Json.load('true')).to eq(true)
+    end
+
+    it 'loads false' do
+      expect(Puppet::Util::Json.load('false')).to eq(false)
+    end
+
+    it 'loads a numeric' do
+      expect(Puppet::Util::Json.load('42')).to eq(42)
+    end
+
+    it 'loads a string' do
+      expect(Puppet::Util::Json.load('"puppet"')).to eq('puppet')
+    end
+
+    it 'loads an array' do
+      expect(Puppet::Util::Json.load(<<~JSON)).to eq([1, 2])
+        [1, 2]
+      JSON
+    end
+
+    it 'loads a hash' do
+      expect(Puppet::Util::Json.load(<<~JSON)).to eq('a' => 1, 'b' => 2)
+        {
+          "a": 1,
+          "b": 2
+        }
+      JSON
+    end
+  end
+
+  context "load_file_if_valid" do
+    before do
+      Puppet[:log_level] = 'debug'
+    end
+
+    it_should_behave_like 'json file loader', Puppet::Util::Json.method(:load_file_if_valid)
+
+    it 'returns nil when the file is invalid JSON and debug logs about it' do
+      file_path = file_containing('input', '{ invalid')
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve JSON content .+: unexpected token at '{ invalid'/).and_call_original
+
+      expect(Puppet::Util::Json.load_file_if_valid(file_path)).to eql(nil)
+    end
+
+    it 'returns nil when the filename is illegal and debug logs about it' do
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve JSON content .+: pathname contains null byte/).and_call_original
+
+      expect(Puppet::Util::Json.load_file_if_valid("not\0allowed")).to eql(nil)
+    end
+
+    it 'returns nil when the file does not exist and debug logs about it' do
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve JSON content .+: No such file or directory/).and_call_original
+
+      expect(Puppet::Util::Json.load_file_if_valid('does/not/exist.json')).to eql(nil)
+    end
+  end
+
+  context '#load_file' do
+    it_should_behave_like 'json file loader', Puppet::Util::Json.method(:load_file)
+
+    it 'raises an error when the file is invalid JSON' do
+      file_path = file_containing('input', '{ invalid')
+
+      expect {
+        Puppet::Util::Json.load_file(file_path)
+      }.to raise_error(Puppet::Util::Json::ParseError, /unexpected token at '{ invalid'/)
+    end
+
+    it 'raises an error when the filename is illegal' do
+      expect {
+        Puppet::Util::Json.load_file("not\0allowed")
+      }.to raise_error(ArgumentError, /null byte/)
+    end
+
+    it 'raises an error when the file does not exist' do
+      expect {
+        Puppet::Util::Json.load_file('does/not/exist.json')
+      }.to raise_error(Errno::ENOENT, /No such file or directory/)
+    end
+
+    it 'writes data formatted as JSON to disk' do
+      file_path = file_containing('input', Puppet::Util::Json.dump({ "my" => "data" }))
+
+      expect(Puppet::Util::Json.load_file(file_path)).to eq({ "my" => "data" })
+    end
+  end
+end

data/spec/unit/util/logging_spec.rb

@@ -552,6 +552,7 @@ original
 
     describe 'does support debugging' do
       before :each do
+        allow(Facter).to receive(:respond_to?).with(:on_message).and_return(true)
         allow(Facter).to receive(:respond_to?).with(:debugging, any_args).and_return(true)
       end
 
@@ -568,6 +569,7 @@ original
 
     describe 'does support trace' do
       before :each do
+        allow(Facter).to receive(:respond_to?).with(:on_message)
         allow(Facter).to receive(:respond_to?).with(:trace, any_args).and_return(true)
       end
 

data/spec/unit/util/windows/sid_spec.rb

@@ -131,38 +131,73 @@ describe "Puppet::Util::Windows::SID", :if => Puppet::Util::Platform.windows? do
       expect(subject.name_to_principal(unknown_name)).to be_nil
     end
 
+    it "should print a debug message if the account does not exist" do
+      expect(Puppet).to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal(unknown_name)
+    end
+
     it "should return a Puppet::Util::Windows::SID::Principal instance for any valid sid" do
       expect(subject.name_to_principal(sid)).to be_an_instance_of(Puppet::Util::Windows::SID::Principal)
     end
 
+    it "should not print debug messages for valid sid" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal(sid)
+    end
+
+    it "should print a debug message for invalid sid" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal('S-1-5-21-INVALID-SID')
+    end
+
     it "should accept unqualified account name" do
       # NOTE: lookup by name works in localized environments only for a few instances
       # this works in French Windows, even though the account is really Syst\u00E8me
       expect(subject.name_to_principal('SYSTEM').sid).to eq(sid)
     end
 
+    it "should not print debug messages for unqualified account name" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal('SYSTEM')
+    end
+
     it "should be case-insensitive" do
       # NOTE: lookup by name works in localized environments only for a few instances
       # this works in French Windows, even though the account is really Syst\u00E8me
       expect(subject.name_to_principal('SYSTEM')).to eq(subject.name_to_principal('system'))
     end
 
+    it "should not print debug messages for wrongly cased account name" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal('system')
+    end
+
     it "should be leading and trailing whitespace-insensitive" do
       # NOTE: lookup by name works in localized environments only for a few instances
       # this works in French Windows, even though the account is really Syst\u00E8me
       expect(subject.name_to_principal('SYSTEM')).to eq(subject.name_to_principal(' SYSTEM '))
     end
 
+    it "should not print debug messages for account name with leading and trailing whitespace" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal(' SYSTEM ')
+    end
+
     it "should accept domain qualified account names" do
       # NOTE: lookup by name works in localized environments only for a few instances
       # this works in French Windows, even though the account is really AUTORITE NT\\Syst\u00E8me
       expect(subject.name_to_principal('NT AUTHORITY\SYSTEM').sid).to eq(sid)
     end
 
-    it "should print a debug message on failures" do
-      expect(Puppet).to receive(:debug).with(/Could not retrieve raw SID bytes from 'NonExistingUser'/)
-      expect(Puppet).to receive(:debug).with(/No mapping between account names and security IDs was done/)
-      subject.name_to_principal('NonExistingUser')
+    it "should not print debug messages for domain qualified account names" do
+      expect(Puppet).not_to receive(:debug).with(/Could not retrieve raw SID bytes from/)
+      expect(Puppet).not_to receive(:debug).with(/No mapping between account names and security IDs was done/)
+      subject.name_to_principal('NT AUTHORITY\SYSTEM')
     end
   end
 

data/spec/unit/util/yaml_spec.rb

@@ -1,6 +1,5 @@
 # coding: utf-8
 require 'spec_helper'
-
 require 'puppet/util/yaml'
 
 describe Puppet::Util::Yaml do
@@ -10,21 +9,21 @@ describe Puppet::Util::Yaml do
 
   shared_examples_for 'yaml file loader' do |load_method|
     it 'returns false when the file is empty' do
-      Puppet::FileSystem.touch(filename)
+      file_path = file_containing('input', '')
 
-      expect(load_method.call(filename)).to eq(false)
+      expect(load_method.call(file_path)).to eq(false)
     end
 
     it 'reads a YAML file from disk' do
-      write_file(filename, YAML.dump({ "my" => "data" }))
+      file_path = file_containing('input', YAML.dump({ "my" => "data" }))
 
-      expect(load_method.call(filename)).to eq({ "my" => "data" })
+      expect(load_method.call(file_path)).to eq({ "my" => "data" })
     end
 
     it 'reads YAML as UTF-8' do
-      write_file(filename, YAML.dump({ "my" => "𠜎" }))
+      file_path = file_containing('input', YAML.dump({ "my" => "𠜎" }))
 
-      expect(load_method.call(filename)).to eq({ "my" => "𠜎" })
+      expect(load_method.call(file_path)).to eq({ "my" => "𠜎" })
     end
   end
 
@@ -119,11 +118,11 @@ FACTS
     it_should_behave_like 'yaml file loader', Puppet::Util::Yaml.method(:safe_load_file)
 
     it 'raises an error when the file is invalid YAML' do
-      write_file(filename, '{ invalid')
+      file_path = file_containing('input', '{ invalid')
 
       expect {
-        Puppet::Util::Yaml.safe_load_file(filename)
-      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, %r[\(#{filename}\): .* at line \d+ column \d+])
+        Puppet::Util::Yaml.safe_load_file(file_path)
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, %r[\(#{file_path}\): .* at line \d+ column \d+])
     end
 
     it 'raises an error when the filename is illegal' do
@@ -139,15 +138,46 @@ FACTS
     end
   end
 
+  context "#safe_load_file_if_valid" do
+    before do
+      Puppet[:log_level] = 'debug'
+    end
+
+    it_should_behave_like 'yaml file loader', Puppet::Util::Yaml.method(:safe_load_file_if_valid)
+
+    it 'returns nil when the file is invalid YAML and debug logs about it' do
+      file_path = file_containing('input', '{ invalid')
+
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve YAML content .+ expected ',' or '}'/).and_call_original
+
+      expect(Puppet::Util::Yaml.safe_load_file_if_valid(file_path)).to eql(nil)
+    end
+
+    it 'returns nil when the filename is illegal and debug logs about it' do
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve YAML content .+: pathname contains null byte/).and_call_original
+
+      expect(Puppet::Util::Yaml.safe_load_file_if_valid("not\0allowed")).to eql(nil)
+    end
+
+    it 'returns nil when the file does not exist and debug logs about it' do
+      expect(Puppet).to receive(:debug)
+        .with(/Could not retrieve YAML content .+: No such file or directory/).and_call_original
+
+      expect(Puppet::Util::Yaml.safe_load_file_if_valid('does/not/exist.yaml')).to eql(nil)
+    end
+  end
+
   context '#load_file' do
     it_should_behave_like 'yaml file loader', Puppet::Util::Yaml.method(:load_file)
 
     it 'raises an error when the file is invalid YAML' do
-      write_file(filename, '{ invalid')
+      file_path = file_containing('input', '{ invalid')
 
       expect {
-        Puppet::Util::Yaml.load_file(filename)
-      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, %r{\(#{filename}\): .* at line \d+ column \d+})
+        Puppet::Util::Yaml.load_file(file_path)
+      }.to raise_error(Puppet::Util::Yaml::YamlLoadError, %r{\(#{file_path}\): .* at line \d+ column \d+})
     end
 
     it 'raises an error when the filename is illegal' do
@@ -163,39 +193,34 @@ FACTS
     end
 
     it 'allows return value to be overridden' do
-      Puppet::FileSystem.touch(filename)
+      file_path = file_containing('input', '')
 
-      expect(Puppet::Util::Yaml.load_file(filename, {})).to eq({})
+      expect(Puppet::Util::Yaml.load_file(file_path, {})).to eq({})
     end
 
     it 'loads arbitrary objects' do
-      write_file(filename, "--- !ruby/object {}\n")
+      file_path = file_containing('input', "--- !ruby/object {}\n")
 
-      expect(Puppet::Util::Yaml.load_file(filename, {})).to be_instance_of(Object)
+      expect(Puppet::Util::Yaml.load_file(file_path, {})).to be_instance_of(Object)
     end
 
     it 'should allow one to strip ruby tags that would otherwise not parse' do
-      write_file(filename, "---\nweirddata: !ruby/hash:Not::A::Valid::Class {}")
+     file_path = file_containing('input', "---\nweirddata: !ruby/hash:Not::A::Valid::Class {}")
 
-      expect(Puppet::Util::Yaml.load_file(filename, {}, true)).to eq({"weirddata" => {}})
+      expect(Puppet::Util::Yaml.load_file(file_path, {}, true)).to eq({"weirddata" => {}})
     end
 
     it 'should not strip non-ruby tags' do
-      write_file(filename, "---\nweirddata: !binary |-\n          e21kNX04MTE4ZGY2NmM5MTc3OTg4ZWE4Y2JiOWEzMjMyNzFkYg==")
+      file_path = file_containing('input', "---\nweirddata: !binary |-\n          e21kNX04MTE4ZGY2NmM5MTc3OTg4ZWE4Y2JiOWEzMjMyNzFkYg==")
 
-      expect(Puppet::Util::Yaml.load_file(filename, {}, true)).to eq({"weirddata" => "{md5}8118df66c9177988ea8cbb9a323271db"})
+      expect(Puppet::Util::Yaml.load_file(file_path, {}, true)).to eq({"weirddata" => "{md5}8118df66c9177988ea8cbb9a323271db"})
     end
 
     it 'writes data formatted as YAML to disk' do
-      Puppet::Util::Yaml.dump({ "my" => "data" }, filename)
-
-      expect(Puppet::Util::Yaml.load_file(filename)).to eq({ "my" => "data" })
-    end
-  end
+      file_path = file_containing('input', '')
+      Puppet::Util::Yaml.dump({ "my" => "data" }, file_path)
 
-  def write_file(name, contents)
-    File.open(name, "w:UTF-8") do |fh|
-      fh.write(contents)
+      expect(Puppet::Util::Yaml.load_file(file_path)).to eq({ "my" => "data" })
     end
   end
 end

data/tasks/generate_cert_fixtures.rake

@@ -40,6 +40,7 @@ task(:gen_cert_fixtures) do
   # 127.0.0.1.pem                     |   +- /CN=127.0.0.1 (with dns alt names)
   # tampered-cert.pem                 |   +- /CN=signed (with different public key)
   # ec.pem                            |   +- /CN=ec (with EC private key)
+  # oid.pem                           |   +- /CN=oid (with custom oid)
   #                                   |
   #                                   + /CN=Test CA Agent Subauthority
   #                                   |  |
@@ -49,7 +50,7 @@ task(:gen_cert_fixtures) do
   #
   # bad-basic-constraints.pem        /CN=Test CA (bad isCA constraint)
   #
-  # unknown-ca.pemm                  /CN=Unknown CA
+  # unknown-ca.pem                   /CN=Unknown CA
   #                                   |
   # unknown-127.0.0.1.pem             +- /CN=127.0.0.1
   #
@@ -103,6 +104,14 @@ task(:gen_cert_fixtures) do
   save(dir, '127.0.0.1.pem', signed[:cert])
   save(dir, '127.0.0.1-key.pem', signed[:private_key])
 
+  # Create an SSL cert with extensions containing custom oids
+  extensions = [
+    ['1.3.6.1.4.1.34380.1.2.1.1', OpenSSL::ASN1::UTF8String.new('somevalue'), false],
+  ]
+  oid = ca.create_cert('oid', inter[:cert], inter[:private_key], extensions: extensions)
+  save(dir, 'oid.pem', oid[:cert])
+  save(dir, 'oid-key.pem', oid[:private_key])
+
   # Create a leaf/entity key and cert for host "revoked", issued by "Test CA Subauthority"
   # and revoke the cert
   revoked = ca.create_cert('revoked', inter[:cert], inter[:private_key])

data/tasks/parallel.rake

@@ -5,9 +5,9 @@ require 'thread'
 begin
   require 'rspec'
   require 'rspec/core/formatters/helpers'
-  require 'facter'
+  require 'etc'
 rescue LoadError
-  # Don't define the task if we don't have rspec or facter present
+  # Don't define the task if we don't have rspec present
 else
   module Parallel
     module RSpec
@@ -401,7 +401,7 @@ else
       # Default group size in rspec examples
       DEFAULT_GROUP_SIZE = 1000
 
-      process_count = [(args[:process_count] || Facter.value("processorcount")).to_i, 1].max
+      process_count = [(args[:process_count] || Etc.nprocessors).to_i, 1].max
       group_size = [(args[:group_size] || DEFAULT_GROUP_SIZE).to_i, 1].max
 
       abort unless Parallel::RSpec::Parallelizer.new(process_count, group_size, color_output?, args.extras).run