puppet 6.23.0 → 7.0.0

data/spec/integration/util/windows/monkey_patches/process_spec.rb

@@ -0,0 +1,231 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'Process', if: Puppet::Util::Platform.windows? do
+  describe '.create' do
+    context 'with common flags' do
+      it do
+        Process.create(
+          app_name: 'cmd.exe /c echo 123',
+          creation_flags: 0x00000008,
+          process_inherit: false,
+          thread_inherit: false,
+          cwd: 'C:\\'
+        )
+      end
+
+      context 'when FFI call fails' do
+        before do
+          allow(Process).to receive(:CreateProcessW).and_return(false)
+        end
+
+        it 'raises SystemCallError' do
+          expect do
+            Process.create(
+              app_name: 'cmd.exe /c echo 123',
+              creation_flags: 0x00000008
+            )
+          end.to raise_error(SystemCallError)
+        end
+      end
+    end
+
+    context 'with logon' do
+      context 'without password' do
+        it 'raises error' do
+          expect do
+            Process.create(
+              app_name: 'cmd.exe /c echo 123',
+              creation_flags: 0x00000008,
+              with_logon: 'test'
+            )
+          end.to raise_error(ArgumentError, 'password must be specified if with_logon is used')
+        end
+      end
+
+      context 'with common flags' do
+        before do
+          allow(Process).to receive(:CreateProcessWithLogonW).and_return(true)
+        end
+
+        it do
+          Process.create(
+            app_name: 'cmd.exe /c echo 123',
+            creation_flags: 0x00000008,
+            process_inherit: false,
+            thread_inherit: false,
+            with_logon: 'test',
+            password: 'password',
+            cwd: 'C:\\'
+          )
+        end
+
+        context 'when FFI call fails' do
+          before do
+            allow(Process).to receive(:CreateProcessWithLogonW).and_return(false)
+          end
+
+          it 'raises SystemCallError' do
+            expect do
+              Process.create(
+                app_name: 'cmd.exe /c echo 123',
+                creation_flags: 0x00000008,
+                with_logon: 'test',
+                password: 'password'
+              )
+            end.to raise_error(SystemCallError)
+          end
+        end
+      end
+    end
+
+    describe 'validations' do
+      context 'when args is not a hash' do
+        it 'raises TypeError' do
+          expect do
+            Process.create('test')
+          end.to raise_error(TypeError, 'hash keyword arguments expected')
+        end
+      end
+
+      context 'when args key is invalid' do
+        it 'raises ArgumentError' do
+          expect do
+            Process.create(invalid_key: 'test')
+          end.to raise_error(ArgumentError, "invalid key 'invalid_key'")
+        end
+      end
+
+      context 'when startup_info is invalid' do
+        it 'raises ArgumentError' do
+          expect do
+            Process.create(startup_info: { invalid_key: 'test' })
+          end.to raise_error(ArgumentError, "invalid startup_info key 'invalid_key'")
+        end
+      end
+
+      context 'when app_name and command_line are missing' do
+        it 'raises ArgumentError' do
+          expect do
+            Process.create(creation_flags: 0)
+          end.to raise_error(ArgumentError, 'command_line or app_name must be specified')
+        end
+      end
+
+      context 'when executable is not found' do
+        it 'raises Errno::ENOENT' do
+          expect do
+            Process.create(app_name: 'non_existent')
+          end.to raise_error(Errno::ENOENT)
+        end
+      end
+    end
+
+    context 'when environment is not specified' do
+      it 'passes local environment' do
+        stdout_read, stdout_write = IO.pipe
+        ENV['TEST_ENV'] = 'B'
+
+        Process.create(
+          app_name: 'cmd.exe /c echo %TEST_ENV%',
+          creation_flags: 0x00000008,
+          startup_info: { stdout: stdout_write }
+        )
+
+        stdout_write.close
+        expect(stdout_read.read.chomp).to eql('B')
+      end
+    end
+
+    context 'when environment is specified' do
+      it 'does not pass local environment' do
+        stdout_read, stdout_write = IO.pipe
+        ENV['TEST_ENV'] = 'B'
+
+        Process.create(
+          app_name: 'cmd.exe /c echo %TEST_ENV%',
+          creation_flags: 0x00000008,
+          environment: '',
+          startup_info: { stdout: stdout_write }
+        )
+
+        stdout_write.close
+        expect(stdout_read.read.chomp).to eql('%TEST_ENV%')
+      end
+
+      it 'supports :environment as a string' do
+        stdout_read, stdout_write = IO.pipe
+
+        Process.create(
+          app_name: 'cmd.exe /c echo %A% %B%',
+          creation_flags: 0x00000008,
+          environment: 'A=C;B=D',
+          startup_info: { stdout: stdout_write }
+        )
+
+        stdout_write.close
+        expect(stdout_read.read.chomp).to eql('C D')
+      end
+
+      it 'supports :environment as a string' do
+        stdout_read, stdout_write = IO.pipe
+
+        Process.create(
+          app_name: 'cmd.exe /c echo %A% %C%',
+          creation_flags: 0x00000008,
+          environment: ['A=B;X;', 'C=;D;Y'],
+          startup_info: { stdout: stdout_write }
+        )
+
+        stdout_write.close
+        expect(stdout_read.read.chomp).to eql('B;X; ;D;Y')
+      end
+    end
+  end
+
+  describe '.setpriority' do
+    let(:priority) { Process::BELOW_NORMAL_PRIORITY_CLASS }
+
+    context 'when success' do
+      it 'returns 0' do
+        expect(Process.setpriority(0, Process.pid, priority)).to eql(0)
+      end
+
+      it 'treats an int argument of zero as the current process' do
+        expect(Process.setpriority(0, 0, priority)).to eql(0)
+      end
+    end
+
+    context 'when invalid arguments are sent' do
+      it 'raises TypeError' do
+        expect {
+          Process.setpriority('test', 0, priority)
+        }.to raise_error(TypeError)
+      end
+    end
+
+    context 'when process is not found' do
+      before do
+        allow(Process).to receive(:OpenProcess).and_return(0)
+      end
+      it 'raises SystemCallError' do
+        expect {
+          Process.setpriority(0, 0, priority)
+        }.to raise_error(SystemCallError)
+      end
+    end
+
+    context 'when priority is not set' do
+      before do
+        allow(Process).to receive(:SetPriorityClass).and_return(false)
+      end
+
+      it 'raises SystemCallError' do
+        expect {
+          Process.setpriority(0, 0, priority)
+        }.to raise_error(SystemCallError)
+      end
+    end
+  end
+end

data/spec/integration/util/windows/principal_spec.rb

@@ -7,7 +7,6 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet::Util::Platform.wi
   let (:system_bytes) { [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] }
   let (:null_sid_bytes) { [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] }
   let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
-  let (:all_application_packages_bytes) { [1, 2, 0, 0, 0, 0, 0, 15, 2, 0, 0, 0, 1, 0, 0, 0] }
   let (:computer_sid) { Puppet::Util::Windows::SID.name_to_principal(Puppet::Util::Windows::ADSI.computer_name) }
   # BUILTIN is localized on German Windows, but not French
   # looking this up like this dilutes the values of the tests as we're comparing two mechanisms
@@ -122,26 +121,6 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet::Util::Platform.wi
       expect(principal.to_s).to eq(builtin_localized)
     end
 
-    it "should always sanitize the account name first" do
-      expect(Puppet::Util::Windows::SID::Principal).to receive(:sanitize_account_name).with('NT AUTHORITY\\SYSTEM').and_call_original
-      Puppet::Util::Windows::SID::Principal.lookup_account_name('NT AUTHORITY\\SYSTEM')
-    end
-
-    it "should be able to create an instance from an account name prefixed by APPLICATION PACKAGE AUTHORITY" do
-      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES')
-      expect(principal.account).to eq('ALL APPLICATION PACKAGES')
-      expect(principal.sid_bytes).to eq(all_application_packages_bytes)
-      expect(principal.sid).to eq('S-1-15-2-1')
-      expect(principal.domain).to eq('APPLICATION PACKAGE AUTHORITY')
-      expect(principal.domain_account).to eq('APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES')
-      expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
-      expect(principal.to_s).to eq('APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES')
-    end
-
-    it "should fail without proper account name sanitization when it is prefixed by APPLICATION PACKAGE AUTHORITY" do
-      given_account_name = 'APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES'
-      expect { Puppet::Util::Windows::SID::Principal.lookup_account_name(nil, false, given_account_name) }.to raise_error(Puppet::Util::Windows::Error, /No mapping between account names and security IDs was done./)
-    end
   end
 
   describe ".lookup_account_sid" do

data/spec/integration/util/windows/registry_spec.rb

@@ -146,6 +146,16 @@ describe Puppet::Util::Windows::Registry do
         utf_8_bytes = ENDASH_UTF_8 + TM_UTF_8
         utf_8_str = utf_8_bytes.pack('c*').force_encoding(Encoding::UTF_8)
 
+        # this problematic Ruby codepath triggers a conversion of UTF-16LE to
+        # a local codepage which can totally break when that codepage has no
+        # conversion from the given UTF-16LE characters to local codepage
+        # a prime example is that IBM437 has no conversion from a Unicode en-dash
+        expect(Win32::Registry).not_to receive(:export_string)
+
+        # also, expect that we're using our variants of keys / values, not Rubys
+        expect(Win32::Registry).not_to receive(:each_key)
+        expect(Win32::Registry).not_to receive(:each_value)
+
         hklm.create("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_ALL_ACCESS | regsam) do |reg|
           reg.write("#{guid}", Win32::Registry::REG_SZ, utf_16_str)
 
@@ -263,12 +273,6 @@ describe Puppet::Util::Windows::Registry do
           type: Win32::Registry::REG_EXPAND_SZ,
           value: "\0\0\0reg expand string",
           expected_value: ""
-        },
-        {
-          name: 'REG_EXPAND_SZ_2',
-          type: Win32::Registry::REG_EXPAND_SZ,
-          value: "1\x002\x003\x004\x00\x00\x00\x90\xD8UoY".force_encoding("UTF-16LE"),
-          expected_value: "1234"
         }
       ].each do |pair|
         it 'reads up to the first wide null' do

data/spec/integration/util/windows/security_spec.rb

@@ -822,7 +822,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet::Util::Platform.window
     end
 
     describe "locked files" do
-      let (:explorer) { File.join(Dir::WINDOWS, "explorer.exe") }
+      let (:explorer) { File.join(ENV['SystemRoot'], "explorer.exe") }
 
       it "should get the owner" do
         expect(winsec.get_owner(explorer)).to match(/^S-1-5-/)

data/spec/lib/matchers/include.rb

@@ -0,0 +1,27 @@
+module Matchers; module Include
+  extend RSpec::Matchers::DSL
+
+  matcher :include_in_any_order do |*matchers|
+    match do |enumerable|
+      @not_matched = []
+      expected_as_array.each do |matcher|
+        if enumerable.empty?
+          break
+        end
+
+        if found = enumerable.find { |elem| matcher.matches?(elem) }
+          enumerable = enumerable.reject { |elem| elem == found }
+        else
+          @not_matched << matcher
+        end
+      end
+
+
+      @not_matched.empty? && enumerable.empty?
+    end
+
+    failure_message do |enumerable|
+      "did not match #{@not_matched.collect(&:description).join(', ')} in #{enumerable.inspect}: <#{@not_matched.collect(&:failure_message).join('>, <')}>"
+    end
+  end
+end; end

data/spec/lib/matchers/include_spec.rb

@@ -0,0 +1,32 @@
+require 'spec_helper'
+require 'matchers/include'
+
+describe "include matchers" do
+  include Matchers::Include
+
+  context :include_in_any_order do
+    it "matches an empty list" do
+      expect([]).to include_in_any_order()
+    end
+
+    it "matches a list with a single element" do
+      expect([1]).to include_in_any_order(eq(1))
+    end
+
+    it "does not match when an expected element is missing" do
+      expect([1]).to_not include_in_any_order(eq(2))
+    end
+
+    it "matches a list with 2 elements in a different order from the expectation" do
+      expect([1, 2]).to include_in_any_order(eq(2), eq(1))
+    end
+
+    it "does not match when there are more than just the expected elements" do
+      expect([1, 2]).to_not include_in_any_order(eq(1))
+    end
+
+    it "matches multiple, equal elements when there are multiple, equal exepectations" do
+      expect([1, 1]).to include_in_any_order(eq(1), eq(1))
+    end
+  end
+end

data/spec/lib/puppet/test_ca.rb

@@ -30,7 +30,7 @@ module Puppet
     end
 
     def create_request(name)
-      key = OpenSSL::PKey::RSA.new(2048)
+      key = OpenSSL::PKey::RSA.new(1024)
       csr = OpenSSL::X509::Request.new
       csr.public_key = key.public_key
       csr.subject = OpenSSL::X509::Name.new([["CN", name]])
@@ -127,7 +127,7 @@ module Puppet
       key = if opts[:key_type] == :ec
               key = OpenSSL::PKey::EC.generate('prime256v1')
             else
-              key = OpenSSL::PKey::RSA.new(2048)
+              key = OpenSSL::PKey::RSA.new(1024)
             end
       cert = OpenSSL::X509::Certificate.new
       cert.public_key = if key.is_a?(OpenSSL::PKey::EC)

data/spec/lib/puppet_spec/puppetserver.rb

@@ -103,7 +103,7 @@ class PuppetSpec::Puppetserver
   end
 
   def register_mounts(mounts: {})
-    register_mount('/status/v1/simple/master', proc { |req, res|  }, nil)
+    register_mount('/status/v1/simple/server', proc { |req, res|  }, nil)
     register_mount('/puppet/v3/node', mounts[:node], NodeServlet)
     register_mount('/puppet/v3/catalog', mounts[:catalog], CatalogServlet)
     register_mount('/puppet/v3/file_metadatas', mounts[:file_metadatas], FileMetadatasServlet)

data/spec/lib/puppet_spec/settings.rb

@@ -11,6 +11,7 @@ module PuppetSpec::Settings
     :confdir      => { :type => :directory, :default => "test", :desc => "confdir" },
     :codedir      => { :type => :directory, :default => "test", :desc => "codedir" },
     :vardir       => { :type => :directory, :default => "test", :desc => "vardir" },
+    :publicdir    => { :type => :directory, :default => "test", :desc => "publicdir" },
     :rundir       => { :type => :directory, :default => "test", :desc => "rundir" },
   }.freeze
 

data/spec/spec_helper.rb

@@ -84,7 +84,10 @@ RSpec.configure do |config|
   config.filter_run_when_matching :focus
 
   config.mock_with :rspec do |mocks|
-    mocks.verify_partial_doubles = true
+    # We really should have this on, but it breaks a _lot_ of tests. We'll
+    # need to go through and fix those tests first before it can be enabled
+    # for real.
+    mocks.verify_partial_doubles = false
   end
 
   tmpdir = Puppet::FileSystem.expand_path(Dir.mktmpdir("rspecrun"))
@@ -145,6 +148,7 @@ RSpec.configure do |config|
 
     base = PuppetSpec::Files.tmpdir('tmp_settings')
     Puppet[:vardir] = File.join(base, 'var')
+    Puppet[:publicdir] = File.join(base, 'public')
     Puppet[:confdir] = File.join(base, 'etc')
     Puppet[:codedir] = File.join(base, 'code')
     Puppet[:logdir] = "$vardir/log"
@@ -152,6 +156,7 @@ RSpec.configure do |config|
     Puppet[:hiera_config] = File.join(base, 'hiera')
 
     FileUtils.mkdir_p Puppet[:statedir]
+    FileUtils.mkdir_p Puppet[:publicdir]
 
     Puppet::Test::TestHelper.before_each_test()
   end
@@ -160,20 +165,10 @@ RSpec.configure do |config|
   PUPPET_FACTER_2_GCE_URL = %r{^http://metadata/computeMetadata/v1(beta1)?}.freeze
   PUPPET_FACTER_3_GCE_URL = "http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=json".freeze
 
-  # Facter azure metadata endpoint
-  PUPPET_FACTER_AZ_URL = "http://169.254.169.254/metadata/instance?api-version=2020-09-01"
-
-  # Facter EC2 endpoint
-  PUPPET_FACTER_EC2_METADATA_URL = 'http://169.254.169.254/latest/meta-data/'
-  PUPPET_FACTER_EC2_USERDATA_URL = 'http://169.254.169.254/latest/user-data/'
-
   config.around :each do |example|
-    # Ignore requests from Facter to external services
+    # Ignore requests from Facter GCE fact in Travis
     stub_request(:get, PUPPET_FACTER_2_GCE_URL)
     stub_request(:get, PUPPET_FACTER_3_GCE_URL)
-    stub_request(:get, PUPPET_FACTER_AZ_URL)
-    stub_request(:get, PUPPET_FACTER_EC2_METADATA_URL)
-    stub_request(:get, PUPPET_FACTER_EC2_USERDATA_URL)
 
     # Enable VCR if the example is tagged with `:vcr` metadata.
     if example.metadata[:vcr]