puppet 6.24.0-x64-mingw32 → 7.0.0-x64-mingw32
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of puppet might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CODEOWNERS +16 -2
- data/CONTRIBUTING.md +5 -5
- data/Gemfile +1 -3
- data/Gemfile.lock +35 -47
- data/README.md +5 -5
- data/conf/fileserver.conf +5 -10
- data/ext/build_defaults.yaml +1 -1
- data/ext/osx/file_mapping.yaml +0 -5
- data/ext/osx/puppet.plist +0 -2
- data/ext/project_data.yaml +1 -15
- data/ext/redhat/puppet.spec.erb +0 -1
- data/ext/windows/service/daemon.rb +6 -5
- data/install.rb +21 -17
- data/lib/puppet.rb +14 -23
- data/lib/puppet/application.rb +178 -108
- data/lib/puppet/application/agent.rb +4 -12
- data/lib/puppet/application/apply.rb +2 -4
- data/lib/puppet/application/device.rb +100 -106
- data/lib/puppet/application/filebucket.rb +13 -10
- data/lib/puppet/application/resource.rb +3 -17
- data/lib/puppet/application/script.rb +0 -2
- data/lib/puppet/application/ssl.rb +1 -13
- data/lib/puppet/application_support.rb +0 -7
- data/lib/puppet/configurer.rb +30 -45
- data/lib/puppet/configurer/downloader.rb +1 -2
- data/lib/puppet/configurer/plugin_handler.rb +21 -19
- data/lib/puppet/defaults.rb +100 -192
- data/lib/puppet/environments.rb +60 -84
- data/lib/puppet/face/facts.rb +5 -103
- data/lib/puppet/face/help.rb +1 -1
- data/lib/puppet/face/help/action.erb +0 -1
- data/lib/puppet/face/help/face.erb +0 -1
- data/lib/puppet/face/node/clean.rb +0 -11
- data/lib/puppet/face/plugin.rb +5 -8
- data/lib/puppet/ffi/windows.rb +12 -0
- data/lib/puppet/ffi/windows/api_types.rb +311 -0
- data/lib/puppet/ffi/windows/constants.rb +404 -0
- data/lib/puppet/ffi/windows/functions.rb +628 -0
- data/lib/puppet/ffi/windows/structs.rb +338 -0
- data/lib/puppet/file_serving/configuration.rb +0 -5
- data/lib/puppet/file_serving/configuration/parser.rb +3 -32
- data/lib/puppet/file_serving/fileset.rb +2 -14
- data/lib/puppet/file_serving/http_metadata.rb +1 -1
- data/lib/puppet/file_serving/mount.rb +1 -2
- data/lib/puppet/file_system/file_impl.rb +1 -1
- data/lib/puppet/file_system/memory_file.rb +1 -8
- data/lib/puppet/file_system/windows.rb +2 -4
- data/lib/puppet/forge.rb +3 -3
- data/lib/puppet/forge/repository.rb +0 -1
- data/lib/puppet/functions/all.rb +1 -1
- data/lib/puppet/functions/camelcase.rb +1 -1
- data/lib/puppet/functions/capitalize.rb +2 -2
- data/lib/puppet/functions/downcase.rb +2 -2
- data/lib/puppet/functions/empty.rb +0 -8
- data/lib/puppet/functions/get.rb +5 -5
- data/lib/puppet/functions/group_by.rb +5 -13
- data/lib/puppet/functions/lest.rb +1 -1
- data/lib/puppet/functions/new.rb +100 -100
- data/lib/puppet/functions/partition.rb +4 -12
- data/lib/puppet/functions/require.rb +5 -5
- data/lib/puppet/functions/sort.rb +3 -3
- data/lib/puppet/functions/strftime.rb +0 -1
- data/lib/puppet/functions/tree_each.rb +9 -7
- data/lib/puppet/functions/type.rb +4 -4
- data/lib/puppet/functions/unwrap.rb +2 -17
- data/lib/puppet/functions/upcase.rb +2 -2
- data/lib/puppet/generate/models/type/type.rb +4 -1
- data/lib/puppet/http.rb +22 -13
- data/lib/puppet/http/client.rb +164 -114
- data/lib/puppet/{network/resolver.rb → http/dns.rb} +2 -2
- data/lib/puppet/http/errors.rb +16 -0
- data/lib/puppet/http/external_client.rb +5 -7
- data/lib/puppet/{network/http → http}/factory.rb +8 -15
- data/lib/puppet/{network/http → http}/pool.rb +61 -26
- data/lib/puppet/{network/http/session.rb → http/pool_entry.rb} +2 -3
- data/lib/puppet/http/proxy.rb +137 -0
- data/lib/puppet/http/redirector.rb +4 -12
- data/lib/puppet/http/resolver.rb +5 -15
- data/lib/puppet/http/resolver/server_list.rb +10 -25
- data/lib/puppet/http/resolver/settings.rb +4 -7
- data/lib/puppet/http/resolver/srv.rb +7 -11
- data/lib/puppet/http/response.rb +36 -54
- data/lib/puppet/http/response_converter.rb +24 -0
- data/lib/puppet/http/response_net_http.rb +42 -0
- data/lib/puppet/http/retry_after_handler.rb +4 -13
- data/lib/puppet/http/service.rb +12 -26
- data/lib/puppet/http/service/ca.rb +11 -22
- data/lib/puppet/http/service/compiler.rb +22 -138
- data/lib/puppet/http/service/file_server.rb +19 -29
- data/lib/puppet/http/service/puppetserver.rb +26 -12
- data/lib/puppet/http/service/report.rb +8 -10
- data/lib/puppet/http/session.rb +11 -20
- data/lib/puppet/{network/http → http}/site.rb +1 -2
- data/lib/puppet/indirector/catalog/compiler.rb +0 -1
- data/lib/puppet/indirector/catalog/rest.rb +2 -4
- data/lib/puppet/indirector/facts/rest.rb +3 -22
- data/lib/puppet/indirector/file_bucket_file/rest.rb +3 -9
- data/lib/puppet/indirector/file_content/rest.rb +2 -6
- data/lib/puppet/indirector/file_metadata/rest.rb +3 -10
- data/lib/puppet/indirector/file_server.rb +1 -8
- data/lib/puppet/indirector/generic_http.rb +0 -11
- data/lib/puppet/indirector/node/rest.rb +2 -4
- data/lib/puppet/indirector/report/rest.rb +3 -8
- data/lib/puppet/indirector/request.rb +0 -101
- data/lib/puppet/indirector/resource/ral.rb +1 -6
- data/lib/puppet/indirector/rest.rb +12 -263
- data/lib/puppet/interface/documentation.rb +0 -1
- data/lib/puppet/module_tool/applications.rb +0 -1
- data/lib/puppet/module_tool/applications/installer.rb +2 -52
- data/lib/puppet/module_tool/errors/shared.rb +2 -34
- data/lib/puppet/network/authconfig.rb +2 -96
- data/lib/puppet/network/authorization.rb +13 -35
- data/lib/puppet/network/formats.rb +0 -67
- data/lib/puppet/network/http.rb +3 -3
- data/lib/puppet/network/http/api/indirected_routes.rb +2 -20
- data/lib/puppet/network/http/api/master/v3.rb +11 -13
- data/lib/puppet/network/http/connection.rb +247 -316
- data/lib/puppet/network/http/handler.rb +0 -1
- data/lib/puppet/network/http_pool.rb +16 -34
- data/lib/puppet/node.rb +1 -30
- data/lib/puppet/pal/json_catalog_encoder.rb +4 -0
- data/lib/puppet/pal/pal_impl.rb +3 -1
- data/lib/puppet/parser/ast/leaf.rb +2 -3
- data/lib/puppet/parser/ast/pops_bridge.rb +0 -38
- data/lib/puppet/parser/compiler.rb +0 -198
- data/lib/puppet/parser/compiler/catalog_validator/relationship_validator.rb +14 -39
- data/lib/puppet/parser/functions/fqdn_rand.rb +6 -14
- data/lib/puppet/parser/resource.rb +0 -69
- data/lib/puppet/parser/templatewrapper.rb +1 -1
- data/lib/puppet/pops/evaluator/deferred_resolver.rb +3 -5
- data/lib/puppet/pops/evaluator/evaluator_impl.rb +0 -5
- data/lib/puppet/pops/evaluator/runtime3_resource_support.rb +3 -3
- data/lib/puppet/pops/evaluator/runtime3_support.rb +1 -1
- data/lib/puppet/pops/issues.rb +0 -5
- data/lib/puppet/pops/loader/ruby_legacy_function_instantiator.rb +6 -8
- data/lib/puppet/pops/model/ast.pp +0 -42
- data/lib/puppet/pops/model/ast.rb +0 -290
- data/lib/puppet/pops/model/ast_transformer.rb +1 -1
- data/lib/puppet/pops/model/factory.rb +0 -45
- data/lib/puppet/pops/model/model_label_provider.rb +0 -5
- data/lib/puppet/pops/model/model_tree_dumper.rb +0 -22
- data/lib/puppet/pops/model/pn_transformer.rb +0 -16
- data/lib/puppet/pops/parser/egrammar.ra +0 -56
- data/lib/puppet/pops/parser/eparser.rb +1520 -1712
- data/lib/puppet/pops/parser/lexer2.rb +4 -4
- data/lib/puppet/pops/parser/parser_support.rb +0 -5
- data/lib/puppet/pops/resource/resource_type_impl.rb +2 -24
- data/lib/puppet/pops/types/p_sem_ver_type.rb +2 -8
- data/lib/puppet/pops/types/p_sensitive_type.rb +0 -10
- data/lib/puppet/pops/types/type_calculator.rb +0 -7
- data/lib/puppet/pops/types/type_mismatch_describer.rb +1 -1
- data/lib/puppet/pops/types/type_parser.rb +0 -4
- data/lib/puppet/pops/types/types.rb +0 -1
- data/lib/puppet/pops/validation/checker4_0.rb +9 -37
- data/lib/puppet/pops/validation/tasks_checker.rb +0 -12
- data/lib/puppet/pops/validation/validator_factory_4_0.rb +1 -2
- data/lib/puppet/property/list.rb +1 -1
- data/lib/puppet/provider.rb +0 -13
- data/lib/puppet/provider/exec/posix.rb +4 -16
- data/lib/puppet/provider/group/groupadd.rb +8 -13
- data/lib/puppet/provider/nameservice.rb +0 -18
- data/lib/puppet/provider/package/apt.rb +2 -34
- data/lib/puppet/provider/package/aptitude.rb +0 -6
- data/lib/puppet/provider/package/dnfmodule.rb +1 -1
- data/lib/puppet/provider/package/dpkg.rb +0 -10
- data/lib/puppet/provider/package/gem.rb +23 -3
- data/lib/puppet/provider/package/nim.rb +6 -11
- data/lib/puppet/provider/package/pip.rb +3 -16
- data/lib/puppet/provider/package/pkg.rb +0 -4
- data/lib/puppet/provider/package/portage.rb +1 -1
- data/lib/puppet/provider/package/puppet_gem.rb +1 -4
- data/lib/puppet/provider/parsedfile.rb +0 -3
- data/lib/puppet/provider/service/debian.rb +0 -2
- data/lib/puppet/provider/service/smf.rb +191 -73
- data/lib/puppet/provider/service/systemd.rb +4 -14
- data/lib/puppet/provider/service/windows.rb +0 -38
- data/lib/puppet/provider/user/aix.rb +2 -2
- data/lib/puppet/provider/user/directoryservice.rb +10 -33
- data/lib/puppet/provider/user/useradd.rb +8 -62
- data/lib/puppet/reference/configuration.rb +8 -7
- data/lib/puppet/reference/indirection.rb +1 -1
- data/lib/puppet/resource.rb +1 -89
- data/lib/puppet/resource/catalog.rb +1 -14
- data/lib/puppet/resource/type.rb +3 -119
- data/lib/puppet/resource/type_collection.rb +3 -48
- data/lib/puppet/runtime.rb +1 -2
- data/lib/puppet/settings.rb +80 -96
- data/lib/puppet/settings/environment_conf.rb +0 -1
- data/lib/puppet/settings/integer_setting.rb +17 -0
- data/lib/puppet/settings/port_setting.rb +15 -0
- data/lib/puppet/settings/priority_setting.rb +5 -4
- data/lib/puppet/ssl.rb +10 -6
- data/lib/puppet/ssl/base.rb +3 -5
- data/lib/puppet/ssl/certificate.rb +0 -6
- data/lib/puppet/ssl/certificate_request.rb +1 -12
- data/lib/puppet/ssl/certificate_signer.rb +6 -0
- data/lib/puppet/ssl/oids.rb +3 -1
- data/lib/puppet/ssl/ssl_provider.rb +17 -0
- data/lib/puppet/ssl/state_machine.rb +3 -1
- data/lib/puppet/ssl/verifier.rb +2 -0
- data/lib/puppet/test/test_helper.rb +1 -3
- data/lib/puppet/transaction.rb +1 -7
- data/lib/puppet/transaction/additional_resource_generator.rb +1 -1
- data/lib/puppet/transaction/report.rb +2 -4
- data/lib/puppet/type.rb +0 -76
- data/lib/puppet/type/exec.rb +3 -16
- data/lib/puppet/type/file.rb +6 -26
- data/lib/puppet/type/file/checksum.rb +1 -1
- data/lib/puppet/type/file/mode.rb +0 -6
- data/lib/puppet/type/file/selcontext.rb +1 -1
- data/lib/puppet/type/file/source.rb +1 -1
- data/lib/puppet/type/filebucket.rb +3 -3
- data/lib/puppet/type/package.rb +8 -16
- data/lib/puppet/type/service.rb +38 -18
- data/lib/puppet/type/tidy.rb +3 -22
- data/lib/puppet/type/user.rb +20 -38
- data/lib/puppet/util/autoload.rb +8 -1
- data/lib/puppet/util/execution.rb +0 -11
- data/lib/puppet/util/http_proxy.rb +2 -215
- data/lib/puppet/util/monkey_patches.rb +0 -53
- data/lib/puppet/util/posix.rb +5 -54
- data/lib/puppet/util/rdoc.rb +0 -7
- data/lib/puppet/util/retry_action.rb +1 -1
- data/lib/puppet/util/run_mode.rb +9 -1
- data/lib/puppet/util/selinux.rb +4 -30
- data/lib/puppet/util/symbolic_file_mode.rb +17 -29
- data/lib/puppet/util/windows.rb +3 -8
- data/lib/puppet/util/windows/adsi.rb +0 -46
- data/lib/puppet/util/windows/daemon.rb +360 -0
- data/lib/puppet/util/windows/error.rb +1 -0
- data/lib/puppet/util/windows/eventlog.rb +4 -9
- data/lib/puppet/util/windows/file.rb +8 -242
- data/lib/puppet/util/windows/monkey_patches/process.rb +414 -0
- data/lib/puppet/util/windows/principal.rb +2 -9
- data/lib/puppet/util/windows/process.rb +4 -226
- data/lib/puppet/util/windows/service.rb +9 -460
- data/lib/puppet/util/windows/sid.rb +2 -6
- data/lib/puppet/util/windows/string.rb +12 -13
- data/lib/puppet/util/yaml.rb +0 -22
- data/lib/puppet/vendor/require_vendored.rb +0 -1
- data/lib/puppet/version.rb +1 -1
- data/lib/puppet/x509.rb +5 -1
- data/lib/puppet/x509/cert_provider.rb +29 -1
- data/locales/puppet.pot +722 -1527
- data/man/man5/puppet.conf.5 +266 -354
- data/man/man8/puppet-agent.8 +2 -2
- data/man/man8/puppet-apply.8 +2 -2
- data/man/man8/puppet-catalog.8 +9 -9
- data/man/man8/puppet-config.8 +1 -1
- data/man/man8/puppet-describe.8 +1 -1
- data/man/man8/puppet-device.8 +2 -2
- data/man/man8/puppet-doc.8 +1 -1
- data/man/man8/puppet-epp.8 +1 -1
- data/man/man8/puppet-facts.8 +8 -51
- data/man/man8/puppet-filebucket.8 +4 -4
- data/man/man8/puppet-generate.8 +1 -1
- data/man/man8/puppet-help.8 +1 -1
- data/man/man8/puppet-lookup.8 +1 -1
- data/man/man8/puppet-module.8 +1 -58
- data/man/man8/puppet-node.8 +5 -5
- data/man/man8/puppet-parser.8 +1 -1
- data/man/man8/puppet-plugin.8 +1 -1
- data/man/man8/puppet-report.8 +5 -5
- data/man/man8/puppet-resource.8 +1 -1
- data/man/man8/puppet-script.8 +2 -2
- data/man/man8/puppet-ssl.8 +1 -5
- data/man/man8/puppet.8 +2 -2
- data/spec/fixtures/ssl/127.0.0.1-key.pem +57 -107
- data/spec/fixtures/ssl/127.0.0.1.pem +31 -52
- data/spec/fixtures/ssl/bad-basic-constraints.pem +35 -57
- data/spec/fixtures/ssl/bad-int-basic-constraints.pem +35 -57
- data/spec/fixtures/ssl/ca.pem +35 -57
- data/spec/fixtures/ssl/crl.pem +18 -28
- data/spec/fixtures/ssl/ec-key.pem +11 -11
- data/spec/fixtures/ssl/ec.pem +24 -33
- data/spec/fixtures/ssl/encrypted-ec-key.pem +12 -12
- data/spec/fixtures/ssl/encrypted-key.pem +58 -108
- data/spec/fixtures/ssl/intermediate-agent-crl.pem +19 -28
- data/spec/fixtures/ssl/intermediate-agent.pem +36 -57
- data/spec/fixtures/ssl/intermediate-crl.pem +21 -31
- data/spec/fixtures/ssl/intermediate.pem +36 -57
- data/spec/fixtures/ssl/pluto-key.pem +57 -107
- data/spec/fixtures/ssl/pluto.pem +30 -52
- data/spec/fixtures/ssl/request-key.pem +57 -107
- data/spec/fixtures/ssl/request.pem +26 -47
- data/spec/fixtures/ssl/revoked-key.pem +57 -107
- data/spec/fixtures/ssl/revoked.pem +30 -52
- data/spec/fixtures/ssl/signed-key.pem +57 -107
- data/spec/fixtures/ssl/signed.pem +30 -52
- data/spec/fixtures/ssl/tampered-cert.pem +30 -52
- data/spec/fixtures/ssl/tampered-csr.pem +26 -47
- data/spec/fixtures/ssl/unknown-127.0.0.1-key.pem +57 -107
- data/spec/fixtures/ssl/unknown-127.0.0.1.pem +29 -50
- data/spec/fixtures/ssl/unknown-ca-key.pem +57 -107
- data/spec/fixtures/ssl/unknown-ca.pem +33 -55
- data/spec/fixtures/unit/provider/service/smf/{svcs.out → svcs_instances.out} +0 -0
- data/spec/fixtures/unit/provider/user/aix/aix_passwd_file.out +0 -4
- data/spec/integration/application/agent_spec.rb +27 -171
- data/spec/integration/application/apply_spec.rb +1 -20
- data/spec/integration/application/filebucket_spec.rb +16 -27
- data/spec/integration/application/help_spec.rb +2 -0
- data/spec/integration/application/module_spec.rb +0 -21
- data/spec/integration/application/plugin_spec.rb +24 -2
- data/spec/integration/defaults_spec.rb +14 -3
- data/spec/integration/environments/settings_interpolation_spec.rb +4 -0
- data/spec/integration/http/client_spec.rb +0 -12
- data/spec/integration/indirector/direct_file_server_spec.rb +3 -1
- data/spec/integration/indirector/facts/facter_spec.rb +36 -90
- data/spec/integration/network/http_pool_spec.rb +3 -21
- data/spec/integration/parser/catalog_spec.rb +0 -38
- data/spec/integration/parser/node_spec.rb +0 -9
- data/spec/integration/parser/pcore_resource_spec.rb +0 -37
- data/spec/integration/resource/type_collection_spec.rb +6 -2
- data/spec/integration/transaction_spec.rb +9 -4
- data/spec/integration/type/exec_spec.rb +45 -70
- data/spec/integration/type/file_spec.rb +5 -4
- data/spec/integration/util/windows/adsi_spec.rb +1 -21
- data/spec/integration/util/windows/monkey_patches/process_spec.rb +231 -0
- data/spec/integration/util/windows/principal_spec.rb +0 -21
- data/spec/integration/util/windows/registry_spec.rb +10 -6
- data/spec/integration/util/windows/security_spec.rb +1 -1
- data/spec/lib/matchers/include.rb +27 -0
- data/spec/lib/matchers/include_spec.rb +32 -0
- data/spec/lib/puppet/test_ca.rb +2 -7
- data/spec/lib/puppet_spec/puppetserver.rb +1 -1
- data/spec/lib/puppet_spec/settings.rb +1 -1
- data/spec/spec_helper.rb +7 -12
- data/spec/unit/agent_spec.rb +6 -10
- data/spec/unit/application/agent_spec.rb +3 -7
- data/spec/unit/application/facts_spec.rb +12 -456
- data/spec/unit/application/filebucket_spec.rb +43 -39
- data/spec/unit/application/ssl_spec.rb +2 -25
- data/spec/unit/application_spec.rb +9 -51
- data/spec/unit/certificate_factory_spec.rb +1 -1
- data/spec/unit/configurer/downloader_spec.rb +6 -8
- data/spec/unit/configurer/plugin_handler_spec.rb +56 -18
- data/spec/unit/configurer_spec.rb +12 -32
- data/spec/unit/confine/feature_spec.rb +1 -1
- data/spec/unit/confine_spec.rb +2 -8
- data/spec/unit/context/trusted_information_spec.rb +2 -6
- data/spec/unit/defaults_spec.rb +68 -54
- data/spec/unit/environments_spec.rb +68 -259
- data/spec/unit/face/node_spec.rb +11 -0
- data/spec/unit/face/plugin_spec.rb +73 -33
- data/spec/unit/file_bucket/file_spec.rb +1 -1
- data/spec/unit/file_serving/configuration/parser_spec.rb +15 -18
- data/spec/unit/file_serving/configuration_spec.rb +6 -12
- data/spec/unit/file_serving/fileset_spec.rb +0 -60
- data/spec/unit/file_serving/metadata_spec.rb +3 -3
- data/spec/unit/file_serving/terminus_helper_spec.rb +4 -11
- data/spec/unit/file_system_spec.rb +0 -15
- data/spec/unit/forge/module_release_spec.rb +7 -2
- data/spec/unit/functions/assert_type_spec.rb +1 -1
- data/spec/unit/functions/camelcase_spec.rb +1 -1
- data/spec/unit/functions/capitalize_spec.rb +1 -1
- data/spec/unit/functions/downcase_spec.rb +1 -1
- data/spec/unit/functions/empty_spec.rb +0 -10
- data/spec/unit/functions/unwrap_spec.rb +0 -8
- data/spec/unit/functions/upcase_spec.rb +1 -1
- data/spec/unit/functions4_spec.rb +2 -2
- data/spec/unit/gettext/config_spec.rb +0 -12
- data/spec/unit/http/client_spec.rb +7 -8
- data/spec/unit/{network/resolver_spec.rb → http/dns_spec.rb} +3 -3
- data/spec/unit/http/external_client_spec.rb +4 -4
- data/spec/unit/{network/http → http}/factory_spec.rb +5 -30
- data/spec/unit/{network/http/session_spec.rb → http/pool_entry_spec.rb} +3 -3
- data/spec/unit/{network/http → http}/pool_spec.rb +12 -17
- data/spec/unit/{util/http_proxy_spec.rb → http/proxy_spec.rb} +2 -69
- data/spec/unit/http/resolver_spec.rb +13 -13
- data/spec/unit/http/service/compiler_spec.rb +0 -185
- data/spec/unit/http/service/file_server_spec.rb +3 -3
- data/spec/unit/http/service/puppetserver_spec.rb +34 -4
- data/spec/unit/http/service_spec.rb +0 -1
- data/spec/unit/http/session_spec.rb +16 -14
- data/spec/unit/{network/http → http}/site_spec.rb +3 -3
- data/spec/unit/indirector/catalog/compiler_spec.rb +10 -14
- data/spec/unit/indirector/face_spec.rb +1 -0
- data/spec/unit/indirector/facts/facter_spec.rb +3 -0
- data/spec/unit/indirector/file_bucket_file/file_spec.rb +5 -3
- data/spec/unit/indirector/file_bucket_file/selector_spec.rb +8 -26
- data/spec/unit/indirector/file_content/rest_spec.rb +0 -4
- data/spec/unit/indirector/file_metadata/rest_spec.rb +0 -4
- data/spec/unit/indirector/file_server_spec.rb +1 -15
- data/spec/unit/indirector/indirection_spec.rb +12 -8
- data/spec/unit/indirector/report/rest_spec.rb +2 -17
- data/spec/unit/indirector/request_spec.rb +0 -264
- data/spec/unit/indirector/resource/ral_spec.rb +75 -40
- data/spec/unit/indirector/rest_spec.rb +98 -752
- data/spec/unit/indirector_spec.rb +2 -2
- data/spec/unit/module_tool/applications/installer_spec.rb +0 -78
- data/spec/unit/network/authconfig_spec.rb +2 -129
- data/spec/unit/network/authorization_spec.rb +2 -55
- data/spec/unit/network/formats_spec.rb +4 -45
- data/spec/unit/network/http/api/indirected_routes_spec.rb +5 -92
- data/spec/unit/network/http/api/master/v3_spec.rb +28 -7
- data/spec/unit/network/http/api_spec.rb +10 -0
- data/spec/unit/network/http/connection_spec.rb +19 -41
- data/spec/unit/network/http/handler_spec.rb +0 -1
- data/spec/unit/network/http_pool_spec.rb +0 -4
- data/spec/unit/node/environment_spec.rb +33 -21
- data/spec/unit/node_spec.rb +2 -54
- data/spec/unit/parser/compiler_spec.rb +19 -3
- data/spec/unit/parser/functions/create_resources_spec.rb +2 -20
- data/spec/unit/parser/functions/fqdn_rand_spec.rb +1 -15
- data/spec/unit/parser/resource_spec.rb +8 -14
- data/spec/unit/parser/templatewrapper_spec.rb +5 -16
- data/spec/unit/pops/evaluator/evaluating_parser_spec.rb +4 -7
- data/spec/unit/pops/loaders/loaders_spec.rb +6 -21
- data/spec/unit/pops/parser/parse_application_spec.rb +4 -22
- data/spec/unit/pops/parser/parse_basic_expressions_spec.rb +0 -1
- data/spec/unit/pops/parser/parse_capabilities_spec.rb +8 -21
- data/spec/unit/pops/parser/parse_site_spec.rb +20 -24
- data/spec/unit/pops/resource/resource_type_impl_spec.rb +0 -71
- data/spec/unit/pops/serialization/to_from_hr_spec.rb +1 -1
- data/spec/unit/pops/types/p_sem_ver_type_spec.rb +0 -18
- data/spec/unit/pops/types/p_sensitive_type_spec.rb +0 -18
- data/spec/unit/pops/types/type_calculator_spec.rb +6 -6
- data/spec/unit/pops/types/type_factory_spec.rb +1 -1
- data/spec/unit/pops/validator/validator_spec.rb +61 -46
- data/spec/unit/pops/visitor_spec.rb +1 -1
- data/spec/unit/property_spec.rb +0 -1
- data/spec/unit/provider/group/groupadd_spec.rb +2 -5
- data/spec/unit/provider/nameservice_spec.rb +64 -122
- data/spec/unit/provider/package/apt_spec.rb +23 -28
- data/spec/unit/provider/package/aptitude_spec.rb +1 -1
- data/spec/unit/provider/package/base_spec.rb +5 -6
- data/spec/unit/provider/package/dnfmodule_spec.rb +1 -10
- data/spec/unit/provider/package/dpkg_spec.rb +0 -48
- data/spec/unit/provider/package/gem_spec.rb +32 -0
- data/spec/unit/provider/package/nim_spec.rb +0 -42
- data/spec/unit/provider/package/pacman_spec.rb +12 -18
- data/spec/unit/provider/package/pip_spec.rb +11 -43
- data/spec/unit/provider/package/pkgdmg_spec.rb +4 -0
- data/spec/unit/provider/package/puppet_gem_spec.rb +3 -2
- data/spec/unit/provider/parsedfile_spec.rb +0 -10
- data/spec/unit/provider/service/init_spec.rb +0 -1
- data/spec/unit/provider/service/openwrt_spec.rb +1 -3
- data/spec/unit/provider/service/smf_spec.rb +401 -165
- data/spec/unit/provider/service/systemd_spec.rb +8 -53
- data/spec/unit/provider/service/windows_spec.rb +0 -203
- data/spec/unit/provider/user/aix_spec.rb +0 -5
- data/spec/unit/provider/user/directoryservice_spec.rb +35 -67
- data/spec/unit/provider/user/hpux_spec.rb +1 -1
- data/spec/unit/provider/user/pw_spec.rb +0 -2
- data/spec/unit/provider/user/useradd_spec.rb +3 -71
- data/spec/unit/provider_spec.rb +8 -18
- data/spec/unit/resource/catalog_spec.rb +1 -1
- data/spec/unit/resource/type_collection_spec.rb +2 -22
- data/spec/unit/resource/type_spec.rb +1 -1
- data/spec/unit/resource_spec.rb +10 -67
- data/spec/unit/settings/http_extra_headers_spec.rb +2 -4
- data/spec/unit/settings/integer_setting_spec.rb +42 -0
- data/spec/unit/settings/port_setting_spec.rb +31 -0
- data/spec/unit/settings/priority_setting_spec.rb +4 -4
- data/spec/unit/settings_spec.rb +79 -110
- data/spec/unit/ssl/base_spec.rb +37 -3
- data/spec/unit/ssl/certificate_request_spec.rb +15 -45
- data/spec/unit/ssl/certificate_spec.rb +2 -11
- data/spec/unit/ssl/ssl_provider_spec.rb +2 -5
- data/spec/unit/ssl/state_machine_spec.rb +5 -20
- data/spec/unit/ssl/verifier_spec.rb +0 -21
- data/spec/unit/transaction/additional_resource_generator_spec.rb +9 -3
- data/spec/unit/transaction/event_manager_spec.rb +11 -14
- data/spec/unit/transaction/report_spec.rb +0 -2
- data/spec/unit/transaction/resource_harness_spec.rb +2 -2
- data/spec/unit/transaction_spec.rb +55 -96
- data/spec/unit/type/exec_spec.rb +29 -76
- data/spec/unit/type/file/checksum_spec.rb +6 -6
- data/spec/unit/type/file/content_spec.rb +2 -1
- data/spec/unit/type/file/ensure_spec.rb +1 -1
- data/spec/unit/type/file/mode_spec.rb +1 -1
- data/spec/unit/type/file/selinux_spec.rb +5 -3
- data/spec/unit/type/file/source_spec.rb +4 -5
- data/spec/unit/type/file_spec.rb +18 -6
- data/spec/unit/type/group_spec.rb +6 -13
- data/spec/unit/type/package_spec.rb +1 -1
- data/spec/unit/type/resources_spec.rb +7 -7
- data/spec/unit/type/service_spec.rb +189 -60
- data/spec/unit/type/tidy_spec.rb +8 -24
- data/spec/unit/type/user_spec.rb +0 -45
- data/spec/unit/type_spec.rb +22 -2
- data/spec/unit/util/at_fork_spec.rb +2 -2
- data/spec/unit/util/autoload_spec.rb +1 -5
- data/spec/unit/util/backups_spec.rb +2 -3
- data/spec/unit/util/execution_spec.rb +11 -44
- data/spec/unit/util/inifile_spec.rb +14 -6
- data/spec/unit/util/log_spec.rb +7 -8
- data/spec/unit/util/logging_spec.rb +3 -3
- data/spec/unit/util/monkey_patches_spec.rb +0 -6
- data/spec/unit/util/posix_spec.rb +15 -363
- data/spec/unit/util/run_mode_spec.rb +21 -121
- data/spec/unit/util/selinux_spec.rb +68 -163
- data/spec/unit/util/storage_spec.rb +1 -3
- data/spec/unit/util/suidmanager_spec.rb +41 -44
- data/spec/unit/util/windows/sid_spec.rb +0 -41
- data/spec/unit/util/windows/string_spec.rb +1 -3
- data/spec/unit/util/yaml_spec.rb +0 -54
- data/spec/unit/util_spec.rb +6 -31
- data/tasks/generate_cert_fixtures.rake +3 -12
- metadata +45 -253
- data/conf/auth.conf +0 -150
- data/lib/puppet/application/cert.rb +0 -76
- data/lib/puppet/application/key.rb +0 -4
- data/lib/puppet/application/man.rb +0 -4
- data/lib/puppet/application/status.rb +0 -4
- data/lib/puppet/face/key.rb +0 -16
- data/lib/puppet/face/man.rb +0 -145
- data/lib/puppet/face/module/build.rb +0 -14
- data/lib/puppet/face/module/generate.rb +0 -14
- data/lib/puppet/face/module/search.rb +0 -103
- data/lib/puppet/face/status.rb +0 -51
- data/lib/puppet/ffi/posix.rb +0 -10
- data/lib/puppet/ffi/posix/constants.rb +0 -14
- data/lib/puppet/ffi/posix/functions.rb +0 -24
- data/lib/puppet/indirector/certificate/file.rb +0 -9
- data/lib/puppet/indirector/certificate/rest.rb +0 -18
- data/lib/puppet/indirector/certificate_request/file.rb +0 -9
- data/lib/puppet/indirector/certificate_request/memory.rb +0 -7
- data/lib/puppet/indirector/certificate_request/rest.rb +0 -11
- data/lib/puppet/indirector/file_content/http.rb +0 -22
- data/lib/puppet/indirector/key/file.rb +0 -46
- data/lib/puppet/indirector/key/memory.rb +0 -7
- data/lib/puppet/indirector/ssl_file.rb +0 -162
- data/lib/puppet/indirector/status.rb +0 -3
- data/lib/puppet/indirector/status/local.rb +0 -12
- data/lib/puppet/indirector/status/rest.rb +0 -27
- data/lib/puppet/module_tool/applications/searcher.rb +0 -29
- data/lib/puppet/network/auth_config_parser.rb +0 -90
- data/lib/puppet/network/authstore.rb +0 -283
- data/lib/puppet/network/http/api/master/v3/authorization.rb +0 -18
- data/lib/puppet/network/http/api/master/v3/environment.rb +0 -88
- data/lib/puppet/network/http/base_pool.rb +0 -36
- data/lib/puppet/network/http/compression.rb +0 -127
- data/lib/puppet/network/http/connection_adapter.rb +0 -184
- data/lib/puppet/network/http/nocache_pool.rb +0 -28
- data/lib/puppet/network/rest_controller.rb +0 -2
- data/lib/puppet/network/rights.rb +0 -210
- data/lib/puppet/parser/compiler/catalog_validator/env_relationship_validator.rb +0 -66
- data/lib/puppet/parser/compiler/catalog_validator/site_validator.rb +0 -22
- data/lib/puppet/parser/environment_compiler.rb +0 -202
- data/lib/puppet/pops/types/enumeration.rb +0 -16
- data/lib/puppet/resource/capability_finder.rb +0 -154
- data/lib/puppet/rest/errors.rb +0 -15
- data/lib/puppet/rest/response.rb +0 -35
- data/lib/puppet/rest/route.rb +0 -85
- data/lib/puppet/rest/routes.rb +0 -135
- data/lib/puppet/settings/alias_setting.rb +0 -37
- data/lib/puppet/ssl/host.rb +0 -505
- data/lib/puppet/ssl/key.rb +0 -61
- data/lib/puppet/ssl/validator.rb +0 -61
- data/lib/puppet/ssl/validator/default_validator.rb +0 -209
- data/lib/puppet/ssl/validator/no_validator.rb +0 -22
- data/lib/puppet/ssl/verifier_adapter.rb +0 -58
- data/lib/puppet/status.rb +0 -40
- data/lib/puppet/util/connection.rb +0 -88
- data/lib/puppet/util/fact_dif.rb +0 -81
- data/lib/puppet/util/ssl.rb +0 -83
- data/lib/puppet/util/windows/api_types.rb +0 -309
- data/lib/puppet/util/windows/monkey_patches/dir.rb +0 -40
- data/lib/puppet/vendor/load_pathspec.rb +0 -1
- data/lib/puppet/vendor/pathspec/CHANGELOG.md +0 -2
- data/lib/puppet/vendor/pathspec/LICENSE +0 -201
- data/lib/puppet/vendor/pathspec/PUPPET_README.md +0 -6
- data/lib/puppet/vendor/pathspec/README.md +0 -53
- data/lib/puppet/vendor/pathspec/lib/pathspec.rb +0 -122
- data/lib/puppet/vendor/pathspec/lib/pathspec/gitignorespec.rb +0 -275
- data/lib/puppet/vendor/pathspec/lib/pathspec/regexspec.rb +0 -17
- data/lib/puppet/vendor/pathspec/lib/pathspec/spec.rb +0 -14
- data/man/man8/puppet-key.8 +0 -126
- data/man/man8/puppet-man.8 +0 -76
- data/man/man8/puppet-status.8 +0 -108
- data/spec/fixtures/integration/application/agent/cached_deferred_catalog.json +0 -91
- data/spec/fixtures/ssl/oid-key.pem +0 -117
- data/spec/fixtures/ssl/oid.pem +0 -69
- data/spec/fixtures/ssl/trusted_oid_mapping.yaml +0 -5
- data/spec/fixtures/unit/provider/service/systemd/list_unit_files_services_vendor_preset +0 -9
- data/spec/integration/application/resource_spec.rb +0 -64
- data/spec/integration/application/ssl_spec.rb +0 -20
- data/spec/integration/network/authconfig_spec.rb +0 -256
- data/spec/integration/util/windows/monkey_patches/dir_spec.rb +0 -11
- data/spec/unit/application/man_spec.rb +0 -52
- data/spec/unit/capability_spec.rb +0 -414
- data/spec/unit/face/key_spec.rb +0 -9
- data/spec/unit/face/module/search_spec.rb +0 -231
- data/spec/unit/face/status_spec.rb +0 -9
- data/spec/unit/indirector/certificate/file_spec.rb +0 -14
- data/spec/unit/indirector/certificate/rest_spec.rb +0 -61
- data/spec/unit/indirector/certificate_request/file_spec.rb +0 -14
- data/spec/unit/indirector/certificate_request/rest_spec.rb +0 -25
- data/spec/unit/indirector/key/file_spec.rb +0 -78
- data/spec/unit/indirector/ssl_file_spec.rb +0 -305
- data/spec/unit/indirector/status/local_spec.rb +0 -10
- data/spec/unit/indirector/status/rest_spec.rb +0 -50
- data/spec/unit/module_tool/applications/searcher_spec.rb +0 -38
- data/spec/unit/network/auth_config_parser_spec.rb +0 -115
- data/spec/unit/network/authstore_spec.rb +0 -422
- data/spec/unit/network/http/api/master/v3/authorization_spec.rb +0 -57
- data/spec/unit/network/http/api/master/v3/environment_spec.rb +0 -185
- data/spec/unit/network/http/compression_spec.rb +0 -240
- data/spec/unit/network/http/nocache_pool_spec.rb +0 -64
- data/spec/unit/network/http_spec.rb +0 -9
- data/spec/unit/network/rights_spec.rb +0 -439
- data/spec/unit/parser/environment_compiler_spec.rb +0 -730
- data/spec/unit/pops/evaluator/deferred_resolver_spec.rb +0 -20
- data/spec/unit/pops/types/enumeration_spec.rb +0 -51
- data/spec/unit/resource/capability_finder_spec.rb +0 -148
- data/spec/unit/rest/route_spec.rb +0 -132
- data/spec/unit/ssl/host_spec.rb +0 -645
- data/spec/unit/ssl/key_spec.rb +0 -173
- data/spec/unit/ssl/validator_spec.rb +0 -278
- data/spec/unit/status_spec.rb +0 -45
- data/spec/unit/util/ssl_spec.rb +0 -91
@@ -1,20 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
require 'puppet_spec/compiler'
|
3
|
-
|
4
|
-
describe Puppet::Pops::Evaluator::DeferredResolver do
|
5
|
-
include PuppetSpec::Compiler
|
6
|
-
|
7
|
-
let(:environment) { Puppet::Node::Environment.create(:testing, []) }
|
8
|
-
let(:facts) { Puppet::Node::Facts.new('node.example.com') }
|
9
|
-
|
10
|
-
it 'resolves deferred values in a catalog' do
|
11
|
-
catalog = compile_to_catalog(<<~END)
|
12
|
-
notify { "deferred":
|
13
|
-
message => Deferred("join", [[1,2,3], ":"])
|
14
|
-
}
|
15
|
-
END
|
16
|
-
described_class.resolve_and_replace(facts, catalog)
|
17
|
-
|
18
|
-
expect(catalog.resource(:notify, 'deferred')[:message]).to eq('1:2:3')
|
19
|
-
end
|
20
|
-
end
|
@@ -1,51 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
require 'puppet/pops'
|
3
|
-
|
4
|
-
module Puppet::Pops::Types
|
5
|
-
describe 'The enumeration support' do
|
6
|
-
it 'produces an enumerator for Array' do
|
7
|
-
expect(Enumeration.enumerator([1,2,3]).respond_to?(:next)).to eql(true)
|
8
|
-
end
|
9
|
-
|
10
|
-
it 'produces an enumerator for Hash' do
|
11
|
-
expect(Enumeration.enumerator({:a=>1}).respond_to?(:next)).to eql(true)
|
12
|
-
end
|
13
|
-
|
14
|
-
it 'produces a char enumerator for String' do
|
15
|
-
enum = Enumeration.enumerator("abc")
|
16
|
-
expect(enum.respond_to?(:next)).to eql(true)
|
17
|
-
expect(enum.next).to eql('a')
|
18
|
-
end
|
19
|
-
|
20
|
-
it 'produces an enumerator for integer times' do
|
21
|
-
enum = Enumeration.enumerator(2)
|
22
|
-
expect(enum.next).to eql(0)
|
23
|
-
expect(enum.next).to eql(1)
|
24
|
-
expect{enum.next}.to raise_error(StopIteration)
|
25
|
-
end
|
26
|
-
|
27
|
-
it 'produces an enumerator for Integer range' do
|
28
|
-
range = TypeFactory.range(1,2)
|
29
|
-
enum = Enumeration.enumerator(range)
|
30
|
-
expect(enum.next).to eql(1)
|
31
|
-
expect(enum.next).to eql(2)
|
32
|
-
expect{enum.next}.to raise_error(StopIteration)
|
33
|
-
end
|
34
|
-
|
35
|
-
it 'does not produce an enumerator for infinite Integer range' do
|
36
|
-
range = TypeFactory.range(1,:default)
|
37
|
-
enum = Enumeration.enumerator(range)
|
38
|
-
expect(enum).to be_nil
|
39
|
-
range = TypeFactory.range(:default,2)
|
40
|
-
enum = Enumeration.enumerator(range)
|
41
|
-
expect(enum).to be_nil
|
42
|
-
end
|
43
|
-
|
44
|
-
[3.14, /.*/, true, false, nil, :something].each do |x|
|
45
|
-
it "does not produce an enumerator for object of type #{x.class}" do
|
46
|
-
enum = Enumeration.enumerator(x)
|
47
|
-
expect(enum).to be_nil
|
48
|
-
end
|
49
|
-
end
|
50
|
-
end
|
51
|
-
end
|
@@ -1,148 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
require_relative '../pops/parser/parser_rspec_helper'
|
3
|
-
require 'puppet/resource/capability_finder'
|
4
|
-
|
5
|
-
describe Puppet::Resource::CapabilityFinder do
|
6
|
-
context 'when PuppetDB is not configured' do
|
7
|
-
it 'should error' do
|
8
|
-
expect(Puppet::Util).to receive(:const_defined?).with('Puppetdb').and_return(false)
|
9
|
-
expect { Puppet::Resource::CapabilityFinder.find('production', nil, nil) }.to raise_error(/PuppetDB is not available/)
|
10
|
-
end
|
11
|
-
end
|
12
|
-
|
13
|
-
context 'when PuppetDB is configured' do
|
14
|
-
before(:each) do
|
15
|
-
allow_any_instance_of(Puppet::Parser::Compiler).to receive(:loaders).and_return(loaders)
|
16
|
-
Puppet.push_context({:loaders => loaders, :current_environment => env})
|
17
|
-
if mock_pdb
|
18
|
-
module Puppet::Util::Puppetdb
|
19
|
-
def query_puppetdb(query); end
|
20
|
-
module_function :query_puppetdb
|
21
|
-
|
22
|
-
class Http
|
23
|
-
def self.action(url); end
|
24
|
-
end
|
25
|
-
end
|
26
|
-
end
|
27
|
-
make_cap_type
|
28
|
-
end
|
29
|
-
|
30
|
-
after(:each) do
|
31
|
-
Puppet::Util.send(:remove_const, 'Puppetdb') if mock_pdb
|
32
|
-
Puppet::Type.rmtype(:cap)
|
33
|
-
Puppet.pop_context()
|
34
|
-
end
|
35
|
-
|
36
|
-
let(:mock_pdb) { !Puppet::Util.const_defined?('Puppetdb') }
|
37
|
-
let(:env) { Puppet::Node::Environment.create(:testing, []) }
|
38
|
-
let(:loaders) { Puppet::Pops::Loaders.new(env) }
|
39
|
-
|
40
|
-
let(:response_body) { [{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}}] }
|
41
|
-
let(:response) { double('response', :body => response_body.to_json) }
|
42
|
-
|
43
|
-
def make_cap_type
|
44
|
-
Puppet::Type.newtype :cap, :is_capability => true do
|
45
|
-
newparam :name
|
46
|
-
newparam :host
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
describe "when query_puppetdb method is available" do
|
51
|
-
it 'should call use the query_puppetdb method if available' do
|
52
|
-
expect(Puppet::Util::Puppetdb).to receive(:query_puppetdb).and_return(response_body)
|
53
|
-
expect(Puppet::Util::Puppetdb::Http).not_to receive(:action)
|
54
|
-
|
55
|
-
result = Puppet::Resource::CapabilityFinder.find('production', nil, Puppet::Resource.new('Cap', 'cap'))
|
56
|
-
expect(result['host']).to eq('ahost')
|
57
|
-
end
|
58
|
-
end
|
59
|
-
|
60
|
-
describe "when query_puppetdb method is unavailable" do
|
61
|
-
before :each do
|
62
|
-
allow(Puppet::Util::Puppetdb).to receive(:respond_to?).with(:query_puppetdb).and_return(false)
|
63
|
-
end
|
64
|
-
|
65
|
-
it 'should call Puppet::Util::PuppetDB::Http.action' do
|
66
|
-
expect(Puppet::Util::Puppetdb::Http).to receive(:action).and_return(response)
|
67
|
-
result = Puppet::Resource::CapabilityFinder.find('production', nil, Puppet::Resource.new('Cap', 'cap'))
|
68
|
-
expect(result['host']).to eq('ahost')
|
69
|
-
end
|
70
|
-
end
|
71
|
-
|
72
|
-
describe '#find' do
|
73
|
-
let(:capability) { Puppet::Resource.new('Cap', 'cap') }
|
74
|
-
let(:code_id) { 'b59e5df0578ef411f773ee6c33d8073c50e7b8fe' }
|
75
|
-
|
76
|
-
it 'should search for the resource without including code_id or environment' do
|
77
|
-
resources = [{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}}]
|
78
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
|
79
|
-
|
80
|
-
result = Puppet::Resource::CapabilityFinder.find('production', code_id, Puppet::Resource.new('Cap', 'cap'))
|
81
|
-
expect(result['host']).to eq('ahost')
|
82
|
-
end
|
83
|
-
|
84
|
-
it 'should return nil if no resource is found' do
|
85
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return([])
|
86
|
-
|
87
|
-
result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
|
88
|
-
expect(result).to be_nil
|
89
|
-
end
|
90
|
-
|
91
|
-
describe 'when multiple results are returned for different environments' do
|
92
|
-
let(:resources) do
|
93
|
-
[{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}, "tags"=>["producer:production"]},
|
94
|
-
{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"bhost"}, "tags"=>["producer:other_env"]}]
|
95
|
-
end
|
96
|
-
|
97
|
-
before :each do
|
98
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
|
99
|
-
end
|
100
|
-
|
101
|
-
it 'should return the resource matching environment' do
|
102
|
-
result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
|
103
|
-
expect(result['host']).to eq('ahost')
|
104
|
-
end
|
105
|
-
|
106
|
-
it 'should return nil if no resource matches environment' do
|
107
|
-
result = Puppet::Resource::CapabilityFinder.find('bad_env', code_id, capability)
|
108
|
-
expect(result).to be_nil
|
109
|
-
end
|
110
|
-
end
|
111
|
-
|
112
|
-
describe 'when multiple results are returned for the same environment' do
|
113
|
-
let(:resources) do
|
114
|
-
[{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}, "tags"=>["producer:production"]},
|
115
|
-
{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"bhost"}, "tags"=>["producer:production"]}]
|
116
|
-
end
|
117
|
-
|
118
|
-
before :each do
|
119
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
|
120
|
-
end
|
121
|
-
|
122
|
-
it 'should return the resource matching code_id' do
|
123
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return([{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"chost"}}])
|
124
|
-
|
125
|
-
result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
|
126
|
-
expect(result['host']).to eq('chost')
|
127
|
-
end
|
128
|
-
|
129
|
-
it 'should fail if no resource matches code_id' do
|
130
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return([])
|
131
|
-
|
132
|
-
expect { Puppet::Resource::CapabilityFinder.find('production', code_id, capability) }.to raise_error(Puppet::Error, /expected exactly one resource but got 2/)
|
133
|
-
end
|
134
|
-
|
135
|
-
it 'should fail if multiple resources match code_id' do
|
136
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return(resources)
|
137
|
-
|
138
|
-
expect { Puppet::Resource::CapabilityFinder.find('production', code_id, capability) }.to raise_error(Puppet::DevError, /expected exactly one resource but got 2/)
|
139
|
-
end
|
140
|
-
|
141
|
-
it 'should fail if no code_id was specified' do
|
142
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', nil, capability).and_return(resources)
|
143
|
-
expect { Puppet::Resource::CapabilityFinder.find('production', nil, capability) }.to raise_error(Puppet::DevError, /expected exactly one resource but got 2/)
|
144
|
-
end
|
145
|
-
end
|
146
|
-
end
|
147
|
-
end
|
148
|
-
end
|
@@ -1,132 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
require 'puppet/rest/route'
|
4
|
-
|
5
|
-
describe Puppet::Rest::Route do
|
6
|
-
describe '#with_base_url'do
|
7
|
-
let(:dns_resolver) { double('dns resolver') }
|
8
|
-
|
9
|
-
context 'when not using SRV records' do
|
10
|
-
before :each do
|
11
|
-
Puppet.settings[:use_srv_records] = false
|
12
|
-
end
|
13
|
-
|
14
|
-
it "yields a base URL with the values from the specified settings" do
|
15
|
-
Puppet[:ca_server] = 'testserver'
|
16
|
-
Puppet[:ca_port] = 555
|
17
|
-
ca_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/',
|
18
|
-
server_setting: :ca_server,
|
19
|
-
port_setting: :ca_port,
|
20
|
-
srv_service: :test_service)
|
21
|
-
count = 0
|
22
|
-
rval = ca_route.with_base_url(dns_resolver) do |url|
|
23
|
-
count += 1
|
24
|
-
expect(url.to_s).to eq('https://testserver:555/fakeapi/v1/')
|
25
|
-
'Block return value'
|
26
|
-
end
|
27
|
-
expect(count).to eq(1)
|
28
|
-
expect(rval).to eq('Block return value')
|
29
|
-
end
|
30
|
-
|
31
|
-
it "yields a base URL with Puppet's configured server and port when no defaults are specified" do
|
32
|
-
Puppet[:server] = 'configured.net'
|
33
|
-
Puppet[:serverport] = 8140
|
34
|
-
fallback_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/')
|
35
|
-
count = 0
|
36
|
-
rval = fallback_route.with_base_url(dns_resolver) do |url|
|
37
|
-
count += 1
|
38
|
-
expect(url.to_s).to eq('https://configured.net:8140/fakeapi/v1/')
|
39
|
-
'Block return value'
|
40
|
-
end
|
41
|
-
expect(count).to eq(1)
|
42
|
-
expect(rval).to eq('Block return value')
|
43
|
-
end
|
44
|
-
|
45
|
-
it 'yields the first entry in the server list when server_list is in use' do
|
46
|
-
Puppet[:server_list] = [['one.net', 111], ['two.net', 222]]
|
47
|
-
fallback_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/')
|
48
|
-
count = 0
|
49
|
-
rval = fallback_route.with_base_url(dns_resolver) do |url|
|
50
|
-
count += 1
|
51
|
-
expect(url.to_s).to eq('https://one.net:111/fakeapi/v1/')
|
52
|
-
'Block return value'
|
53
|
-
end
|
54
|
-
expect(count).to eq(1)
|
55
|
-
expect(rval).to eq('Block return value')
|
56
|
-
end
|
57
|
-
|
58
|
-
it 'falls back to :server and :serverport if nil is passed' do
|
59
|
-
Puppet[:server] = 'one.net'
|
60
|
-
Puppet[:serverport] = 111
|
61
|
-
nil_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/',
|
62
|
-
server_setting: nil,
|
63
|
-
port_setting: nil)
|
64
|
-
count = 0
|
65
|
-
rval = nil_route.with_base_url(dns_resolver) do |url|
|
66
|
-
count += 1
|
67
|
-
expect(url.to_s).to eq('https://one.net:111/fakeapi/v1/')
|
68
|
-
'Block return value'
|
69
|
-
end
|
70
|
-
expect(count).to eq(1)
|
71
|
-
expect(rval).to eq('Block return value')
|
72
|
-
end
|
73
|
-
end
|
74
|
-
|
75
|
-
context 'when using SRV records' do
|
76
|
-
context "when SRV returns servers" do
|
77
|
-
let(:route) { Puppet::Rest::Route.new(api: '/fakeapi/v1/',
|
78
|
-
srv_service: :test_service) }
|
79
|
-
|
80
|
-
before :each do
|
81
|
-
Puppet.settings[:use_srv_records] = true
|
82
|
-
Puppet.settings[:srv_domain] = 'example.com'
|
83
|
-
|
84
|
-
@dns_mock = double('dns')
|
85
|
-
expect(Resolv::DNS).to receive(:new).and_return(@dns_mock)
|
86
|
-
|
87
|
-
@port = 7502
|
88
|
-
@target = 'example.com'
|
89
|
-
record = Resolv::DNS::Resource::IN::SRV.new(0, 0, @port, @target)
|
90
|
-
record.instance_variable_set(:@ttl, 10)
|
91
|
-
@srv_records = [record]
|
92
|
-
|
93
|
-
expect(@dns_mock).to receive(:getresources).
|
94
|
-
with("_x-puppet-test_service._tcp.example.com", Resolv::DNS::Resource::IN::SRV).
|
95
|
-
and_return(@srv_records)
|
96
|
-
end
|
97
|
-
|
98
|
-
it "yields a URL using the server and port from the SRV record" do
|
99
|
-
count = 0
|
100
|
-
rval = route.with_base_url(Puppet::Network::Resolver.new) do |url|
|
101
|
-
count += 1
|
102
|
-
expect(url.to_s).to eq('https://example.com:7502/fakeapi/v1/')
|
103
|
-
'Block return value'
|
104
|
-
end
|
105
|
-
expect(count).to eq(1)
|
106
|
-
|
107
|
-
expect(rval).to eq('Block return value')
|
108
|
-
end
|
109
|
-
|
110
|
-
it "should fall back to the default server when the block raises a SystemCallError" do
|
111
|
-
Puppet[:server] = "testserver"
|
112
|
-
Puppet[:serverport] = 555
|
113
|
-
|
114
|
-
count = 0
|
115
|
-
rval = route.with_base_url(Puppet::Network::Resolver.new) do |url|
|
116
|
-
count += 1
|
117
|
-
if url.to_s =~ /example.com/ then
|
118
|
-
raise SystemCallError, "example failure"
|
119
|
-
else
|
120
|
-
expect(url.to_s).to eq('https://testserver:555/fakeapi/v1/')
|
121
|
-
end
|
122
|
-
|
123
|
-
'Block return value'
|
124
|
-
end
|
125
|
-
|
126
|
-
expect(count).to eq(2)
|
127
|
-
expect(rval).to eq('Block return value')
|
128
|
-
end
|
129
|
-
end
|
130
|
-
end
|
131
|
-
end
|
132
|
-
end
|
data/spec/unit/ssl/host_spec.rb
DELETED
@@ -1,645 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
require 'puppet/test_ca'
|
3
|
-
|
4
|
-
require 'puppet/ssl/host'
|
5
|
-
require 'matchers/json'
|
6
|
-
require 'puppet_spec/ssl'
|
7
|
-
require 'puppet/rest/routes'
|
8
|
-
|
9
|
-
def base_json_comparison(result, json_hash)
|
10
|
-
expect(result["fingerprint"]).to eq(json_hash["fingerprint"])
|
11
|
-
expect(result["name"]).to eq(json_hash["name"])
|
12
|
-
expect(result["state"]).to eq(json_hash["desired_state"])
|
13
|
-
end
|
14
|
-
|
15
|
-
describe Puppet::SSL::Host, if: !Puppet::Util::Platform.jruby? do
|
16
|
-
include JSONMatchers
|
17
|
-
include PuppetSpec::Files
|
18
|
-
|
19
|
-
before do
|
20
|
-
# Get a safe temporary file
|
21
|
-
dir = tmpdir("ssl_host_testing")
|
22
|
-
Puppet.settings[:confdir] = dir
|
23
|
-
Puppet.settings[:vardir] = dir
|
24
|
-
Puppet.settings.use :main, :ssl
|
25
|
-
|
26
|
-
@host = Puppet::SSL::Host.new("myname")
|
27
|
-
end
|
28
|
-
|
29
|
-
after do
|
30
|
-
# Cleaned out any cached localhost instance.
|
31
|
-
Puppet::SSL::Host.reset
|
32
|
-
end
|
33
|
-
|
34
|
-
it "should use any provided name as its name" do
|
35
|
-
expect(@host.name).to eq("myname")
|
36
|
-
end
|
37
|
-
|
38
|
-
it "should retrieve its public key from its private key" do
|
39
|
-
realkey = double('realkey')
|
40
|
-
key = double('key', :content => realkey)
|
41
|
-
allow(Puppet::SSL::Key.indirection).to receive(:find).and_return(key)
|
42
|
-
pubkey = double('public_key')
|
43
|
-
expect(realkey).to receive(:public_key).and_return(pubkey)
|
44
|
-
|
45
|
-
expect(@host.public_key).to equal(pubkey)
|
46
|
-
end
|
47
|
-
|
48
|
-
describe 'localhost' do
|
49
|
-
before(:each) do
|
50
|
-
allow_any_instance_of(Puppet::SSL::Host).to receive(:certificate).and_return(nil)
|
51
|
-
allow_any_instance_of(Puppet::SSL::Host).to receive(:generate)
|
52
|
-
end
|
53
|
-
|
54
|
-
it "is deprecated" do
|
55
|
-
Puppet::SSL::Host.localhost
|
56
|
-
|
57
|
-
expect(@logs).to include(an_object_having_attributes(message: /Puppet::SSL::Host is deprecated/))
|
58
|
-
end
|
59
|
-
|
60
|
-
it "should allow to reset localhost" do
|
61
|
-
previous_host = Puppet::SSL::Host.localhost
|
62
|
-
Puppet::SSL::Host.reset
|
63
|
-
expect(Puppet::SSL::Host.localhost).not_to eq(previous_host)
|
64
|
-
end
|
65
|
-
|
66
|
-
it "should generate the certificate for the localhost instance if no certificate is available" do
|
67
|
-
host = double('host', :key => nil)
|
68
|
-
expect(Puppet::SSL::Host).to receive(:new).and_return(host)
|
69
|
-
|
70
|
-
expect(host).to receive(:certificate).and_return(nil)
|
71
|
-
expect(host).to receive(:generate)
|
72
|
-
|
73
|
-
expect(Puppet::SSL::Host.localhost).to equal(host)
|
74
|
-
end
|
75
|
-
|
76
|
-
it "should always read the key for the localhost instance in from disk" do
|
77
|
-
host = double('host', :certificate => "eh")
|
78
|
-
expect(host).to receive(:key)
|
79
|
-
expect(Puppet::SSL::Host).to receive(:new).and_return(host)
|
80
|
-
|
81
|
-
Puppet::SSL::Host.localhost
|
82
|
-
end
|
83
|
-
|
84
|
-
it "should cache the localhost instance" do
|
85
|
-
host = double('host', :certificate => "eh", :key => 'foo')
|
86
|
-
expect(Puppet::SSL::Host).to receive(:new).once.and_return(host)
|
87
|
-
expect(Puppet::SSL::Host.localhost).to eq(Puppet::SSL::Host.localhost)
|
88
|
-
end
|
89
|
-
end
|
90
|
-
|
91
|
-
context "with dns_alt_names" do
|
92
|
-
before :each do
|
93
|
-
@key = double('key content')
|
94
|
-
key = double('key', :generate => true, :content => @key)
|
95
|
-
allow(Puppet::SSL::Key).to receive(:new).and_return(key)
|
96
|
-
allow(Puppet::SSL::Key.indirection).to receive(:save).with(key)
|
97
|
-
|
98
|
-
@cr = double('certificate request', :render => "csr pem")
|
99
|
-
allow(Puppet::SSL::CertificateRequest).to receive(:new).and_return(@cr)
|
100
|
-
allow_any_instance_of(Puppet::SSL::Host).to receive(:submit_certificate_request)
|
101
|
-
end
|
102
|
-
|
103
|
-
describe "explicitly specified" do
|
104
|
-
before :each do
|
105
|
-
Puppet[:dns_alt_names] = 'one, two'
|
106
|
-
end
|
107
|
-
|
108
|
-
it "should not include subjectAltName if not the local node" do
|
109
|
-
expect(@cr).to receive(:generate).with(@key, {})
|
110
|
-
|
111
|
-
Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate_certificate_request
|
112
|
-
end
|
113
|
-
|
114
|
-
it "should include subjectAltName if the local node" do
|
115
|
-
expect(@cr).to receive(:generate).with(@key, { :dns_alt_names => 'one, two' })
|
116
|
-
|
117
|
-
Puppet::SSL::Host.new(Puppet[:certname]).generate_certificate_request
|
118
|
-
end
|
119
|
-
end
|
120
|
-
end
|
121
|
-
|
122
|
-
it "should be able to verify its certificate matches its key" do
|
123
|
-
expect(Puppet::SSL::Host.new("foo")).to respond_to(:validate_certificate_with_key)
|
124
|
-
end
|
125
|
-
|
126
|
-
it "should consider the certificate invalid if it cannot find a key" do
|
127
|
-
host = Puppet::SSL::Host.new("foo")
|
128
|
-
certificate = double('cert', :fingerprint => 'DEADBEEF')
|
129
|
-
expect(host).to receive(:key).and_return(nil)
|
130
|
-
expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, "No private key with which to validate certificate with fingerprint: DEADBEEF")
|
131
|
-
end
|
132
|
-
|
133
|
-
it "should consider the certificate invalid if it cannot find a certificate" do
|
134
|
-
host = Puppet::SSL::Host.new("foo")
|
135
|
-
expect(host).not_to receive(:key)
|
136
|
-
expect { host.validate_certificate_with_key(nil) }.to raise_error(Puppet::Error, "No certificate to validate.")
|
137
|
-
end
|
138
|
-
|
139
|
-
it "should consider the certificate invalid if the SSL certificate's key verification fails" do
|
140
|
-
host = Puppet::SSL::Host.new("foo")
|
141
|
-
key = double('key', :content => "private_key")
|
142
|
-
sslcert = double('sslcert')
|
143
|
-
certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
|
144
|
-
allow(host).to receive(:key).and_return(key)
|
145
|
-
expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
|
146
|
-
expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /DEADBEEF/)
|
147
|
-
end
|
148
|
-
|
149
|
-
it "should consider the certificate valid if the SSL certificate's key verification succeeds" do
|
150
|
-
host = Puppet::SSL::Host.new("foo")
|
151
|
-
key = double('key', :content => "private_key")
|
152
|
-
sslcert = double('sslcert')
|
153
|
-
certificate = double('cert', :content => sslcert)
|
154
|
-
allow(host).to receive(:key).and_return(key)
|
155
|
-
expect(sslcert).to receive(:check_private_key).with("private_key").and_return(true)
|
156
|
-
expect{ host.validate_certificate_with_key(certificate) }.not_to raise_error
|
157
|
-
end
|
158
|
-
|
159
|
-
it "should output agent-specific commands when validation fails" do
|
160
|
-
host = Puppet::SSL::Host.new("foo")
|
161
|
-
key = double('key', :content => "private_key")
|
162
|
-
sslcert = double('sslcert')
|
163
|
-
certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
|
164
|
-
allow(host).to receive(:key).and_return(key)
|
165
|
-
expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
|
166
|
-
expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /puppet ssl clean \n/)
|
167
|
-
end
|
168
|
-
|
169
|
-
it "should output device-specific commands when validation fails" do
|
170
|
-
Puppet[:certname] = "device.example.com"
|
171
|
-
host = Puppet::SSL::Host.new("device.example.com", true)
|
172
|
-
key = double('key', :content => "private_key")
|
173
|
-
sslcert = double('sslcert')
|
174
|
-
certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
|
175
|
-
allow(host).to receive(:key).and_return(key)
|
176
|
-
expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
|
177
|
-
expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /puppet ssl clean --target device.example.com/)
|
178
|
-
end
|
179
|
-
|
180
|
-
describe "when initializing" do
|
181
|
-
it "should default its name to the :certname setting" do
|
182
|
-
Puppet[:certname] = "myname"
|
183
|
-
|
184
|
-
expect(Puppet::SSL::Host.new.name).to eq("myname")
|
185
|
-
end
|
186
|
-
|
187
|
-
it "should downcase a passed in name" do
|
188
|
-
expect(Puppet::SSL::Host.new("Host.Domain.Com").name).to eq("host.domain.com")
|
189
|
-
end
|
190
|
-
end
|
191
|
-
|
192
|
-
describe "when managing its private key" do
|
193
|
-
before do
|
194
|
-
@realkey = "mykey"
|
195
|
-
@key = Puppet::SSL::Key.new("mykey")
|
196
|
-
@key.content = @realkey
|
197
|
-
end
|
198
|
-
|
199
|
-
it "should return nil if the key is not set and cannot be found" do
|
200
|
-
expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(nil)
|
201
|
-
expect(@host.key).to be_nil
|
202
|
-
end
|
203
|
-
|
204
|
-
it "should find the key in the Key class and return the Puppet instance" do
|
205
|
-
expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(@key)
|
206
|
-
expect(@host.key).to equal(@key)
|
207
|
-
end
|
208
|
-
|
209
|
-
it "should be able to generate and save a new key" do
|
210
|
-
expect(Puppet::SSL::Key).to receive(:new).with("myname").and_return(@key)
|
211
|
-
|
212
|
-
expect(@key).to receive(:generate)
|
213
|
-
expect(Puppet::SSL::Key.indirection).to receive(:save)
|
214
|
-
|
215
|
-
expect(@host.generate_key).to be_truthy
|
216
|
-
expect(@host.key).to equal(@key)
|
217
|
-
end
|
218
|
-
|
219
|
-
it "should not retain keys that could not be saved" do
|
220
|
-
expect(Puppet::SSL::Key).to receive(:new).with("myname").and_return(@key)
|
221
|
-
|
222
|
-
expect(@key).to receive(:generate)
|
223
|
-
expect(Puppet::SSL::Key.indirection).to receive(:save).and_raise("eh")
|
224
|
-
|
225
|
-
expect { @host.generate_key }.to raise_error(RuntimeError)
|
226
|
-
expect(@host.key).to be_nil
|
227
|
-
end
|
228
|
-
|
229
|
-
it "should return any previously found key without requerying" do
|
230
|
-
expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(@key).once
|
231
|
-
expect(@host.key).to equal(@key)
|
232
|
-
expect(@host.key).to equal(@key)
|
233
|
-
end
|
234
|
-
end
|
235
|
-
|
236
|
-
describe "when managing its certificate request" do
|
237
|
-
before(:all) do
|
238
|
-
@pki = PuppetSpec::SSL.create_chained_pki
|
239
|
-
end
|
240
|
-
|
241
|
-
before(:each) do
|
242
|
-
Puppet[:requestdir] = tmpdir('requests')
|
243
|
-
end
|
244
|
-
|
245
|
-
let(:key) { Puppet::SSL::Key.from_s(@pki[:leaf_key].to_s, @host.name) }
|
246
|
-
|
247
|
-
it "should generate a new key when generating the cert request if no key exists" do
|
248
|
-
expect(@host).to receive(:key).exactly(2).times.and_return(nil, key)
|
249
|
-
expect(@host).to receive(:generate_key).and_return(key)
|
250
|
-
|
251
|
-
allow(@host).to receive(:submit_certificate_request)
|
252
|
-
|
253
|
-
@host.generate_certificate_request
|
254
|
-
expect(Puppet::FileSystem.exist?(File.join(Puppet[:requestdir], "#{@host.name}.pem"))).to be true
|
255
|
-
end
|
256
|
-
|
257
|
-
it "should be able to generate and save a new request using the private key" do
|
258
|
-
allow(@host).to receive(:key).and_return(key)
|
259
|
-
allow(@host).to receive(:submit_certificate_request)
|
260
|
-
|
261
|
-
expect(@host.generate_certificate_request).to be_truthy
|
262
|
-
expect(Puppet::FileSystem.exist?(File.join(Puppet[:requestdir], "#{@host.name}.pem"))).to be true
|
263
|
-
end
|
264
|
-
|
265
|
-
it "should send a new request to the CA for signing" do
|
266
|
-
allow(@host).to receive(:ssl_store).and_return(double("ssl store"))
|
267
|
-
allow(@host).to receive(:key).and_return(key)
|
268
|
-
request = double("request")
|
269
|
-
allow(request).to receive(:generate)
|
270
|
-
expect(request).to receive(:render).and_return("my request").twice
|
271
|
-
expect(Puppet::SSL::CertificateRequest).to receive(:new).and_return(request)
|
272
|
-
|
273
|
-
expect(Puppet::Rest::Routes).to receive(:put_certificate_request)
|
274
|
-
.with("my request", @host.name, anything)
|
275
|
-
.and_return(nil)
|
276
|
-
|
277
|
-
expect(@host.generate_certificate_request).to be true
|
278
|
-
end
|
279
|
-
|
280
|
-
it "should return any previously found request without requerying" do
|
281
|
-
request = double("request")
|
282
|
-
expect(@host).to receive(:load_certificate_request_from_file).and_return(request).once
|
283
|
-
|
284
|
-
expect(@host.certificate_request).to equal(request)
|
285
|
-
expect(@host.certificate_request).to equal(request)
|
286
|
-
end
|
287
|
-
|
288
|
-
it "should not keep its certificate request in memory if the request cannot be saved" do
|
289
|
-
allow(@host).to receive(:key).and_return(key)
|
290
|
-
allow(@host).to receive(:submit_certificate_request)
|
291
|
-
expect(Puppet::Util).to receive(:replace_file).and_raise(RuntimeError)
|
292
|
-
|
293
|
-
expect { @host.generate_certificate_request }.to raise_error(RuntimeError)
|
294
|
-
|
295
|
-
expect(@host.instance_eval { @certificate_request }).to be_nil
|
296
|
-
end
|
297
|
-
end
|
298
|
-
|
299
|
-
describe "when managing its certificate" do
|
300
|
-
before(:all) do
|
301
|
-
@pki = PuppetSpec::SSL.create_chained_pki
|
302
|
-
end
|
303
|
-
|
304
|
-
before(:each) do
|
305
|
-
Puppet[:certdir] = tmpdir('certs')
|
306
|
-
allow(@host).to receive(:key).and_return(double("key"))
|
307
|
-
allow(@host).to receive(:validate_certificate_with_key)
|
308
|
-
allow(@host).to receive(:ssl_store).and_return(double("ssl store"))
|
309
|
-
end
|
310
|
-
|
311
|
-
let(:ca_cert_response) { @pki[:ca_bundle] }
|
312
|
-
let(:crl_response) { @pki[:crl_chain] }
|
313
|
-
let(:host_cert_response) { @pki[:unrevoked_leaf_node_cert] }
|
314
|
-
|
315
|
-
it "should find the CA certificate and save it to disk" do
|
316
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
317
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
318
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 404)
|
319
|
-
|
320
|
-
@host.certificate
|
321
|
-
actual_ca_bundle = Puppet::FileSystem.read(Puppet[:localcacert])
|
322
|
-
expect(actual_ca_bundle).to match(/BEGIN CERTIFICATE.*END CERTIFICATE.*BEGIN CERTIFICATE/m)
|
323
|
-
end
|
324
|
-
|
325
|
-
it "should raise if it cannot find a CA certificate" do
|
326
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 404)
|
327
|
-
|
328
|
-
expect(@host).not_to receive(:get_host_certificate)
|
329
|
-
|
330
|
-
expect {
|
331
|
-
@host.certificate
|
332
|
-
}.to raise_error(Puppet::Error, /CA certificate is missing from the server/)
|
333
|
-
end
|
334
|
-
|
335
|
-
it "should find the key if it does not have one" do
|
336
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
337
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
338
|
-
|
339
|
-
expect(@host).to receive(:get_host_certificate).and_return(nil)
|
340
|
-
expect(@host).to receive(:key).and_return(double("key"))
|
341
|
-
@host.certificate
|
342
|
-
end
|
343
|
-
|
344
|
-
it "should generate the key if one cannot be found" do
|
345
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
346
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
347
|
-
|
348
|
-
expect(@host).to receive(:get_host_certificate).and_return(nil)
|
349
|
-
expect(@host).to receive(:key).and_return(nil)
|
350
|
-
expect(@host).to receive(:generate_key)
|
351
|
-
@host.certificate
|
352
|
-
end
|
353
|
-
|
354
|
-
it "should find the host certificate, write it to file, and return the Puppet certificate instance" do
|
355
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
356
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
357
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 200, body: host_cert_response.to_pem)
|
358
|
-
|
359
|
-
expected_cert = Puppet::SSL::Certificate.from_s(@pki[:unrevoked_leaf_node_cert])
|
360
|
-
actual_cert = @host.certificate
|
361
|
-
expect(actual_cert).to be_a(Puppet::SSL::Certificate)
|
362
|
-
expect(actual_cert.to_s).to eq(expected_cert.to_s)
|
363
|
-
host_cert_from_file = Puppet::FileSystem.read(File.join(Puppet[:certdir], "#{@host.name}.pem"))
|
364
|
-
expect(host_cert_from_file).to eq(expected_cert.to_s)
|
365
|
-
end
|
366
|
-
|
367
|
-
it "should return any previously found certificate" do
|
368
|
-
cert = double('cert')
|
369
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
370
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
371
|
-
expect(@host).to receive(:get_host_certificate).and_return(cert).once
|
372
|
-
|
373
|
-
expect(@host.certificate).to equal(cert)
|
374
|
-
expect(@host.certificate).to equal(cert)
|
375
|
-
end
|
376
|
-
|
377
|
-
context 'invalid certificates' do
|
378
|
-
it "should raise if the CA certificate downloaded from CA is invalid" do
|
379
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: 'garbage')
|
380
|
-
|
381
|
-
expect { @host.certificate }.to raise_error(OpenSSL::X509::CertificateError, /Failed to parse CA certificates as PEM/)
|
382
|
-
end
|
383
|
-
|
384
|
-
it "should warn if the host certificate downloaded from CA is invalid" do
|
385
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
386
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
387
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 200, body: 'garbage')
|
388
|
-
|
389
|
-
expect { @host.certificate }.to raise_error(Puppet::Error, /did not contain a valid certificate for #{@host.name}/)
|
390
|
-
end
|
391
|
-
|
392
|
-
it 'should warn if the CA certificate loaded from disk is invalid' do
|
393
|
-
Puppet::FileSystem.open(Puppet[:localcacert], nil, "w:ASCII") do |f|
|
394
|
-
f.puts 'garbage'
|
395
|
-
end
|
396
|
-
expect { @host.certificate }.to raise_error(OpenSSL::X509::CertificateError, /Failed to parse CA certificates as PEM/)
|
397
|
-
end
|
398
|
-
|
399
|
-
it 'should warn if the host certificate loaded from disk in invalid' do
|
400
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
401
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
402
|
-
|
403
|
-
Puppet::FileSystem.open(File.join(Puppet[:certdir], "#{@host.name}.pem"), nil, "w:ASCII") do |f|
|
404
|
-
f.puts 'garbage'
|
405
|
-
end
|
406
|
-
expect { @host.certificate }.to raise_error(Puppet::Error, /The certificate.*invalid/)
|
407
|
-
end
|
408
|
-
end
|
409
|
-
end
|
410
|
-
|
411
|
-
it "should have a method for generating all necessary files" do
|
412
|
-
expect(Puppet::SSL::Host.new("me")).to respond_to(:generate)
|
413
|
-
end
|
414
|
-
|
415
|
-
describe "when generating files" do
|
416
|
-
before do
|
417
|
-
@host = Puppet::SSL::Host.new("me")
|
418
|
-
allow(@host).to receive(:generate_key)
|
419
|
-
allow(@host).to receive(:generate_certificate_request)
|
420
|
-
allow(@host).to receive(:certificate_request)
|
421
|
-
allow(@host).to receive(:certificate)
|
422
|
-
end
|
423
|
-
|
424
|
-
it "should generate a key if one is not present" do
|
425
|
-
allow(@host).to receive(:key).and_return nil
|
426
|
-
expect(@host).to receive(:generate_key)
|
427
|
-
|
428
|
-
@host.generate
|
429
|
-
end
|
430
|
-
|
431
|
-
it "should generate a certificate request if one is not present" do
|
432
|
-
expect(@host).to receive(:certificate_request).and_return nil
|
433
|
-
expect(@host).to receive(:generate_certificate_request)
|
434
|
-
|
435
|
-
@host.generate
|
436
|
-
end
|
437
|
-
end
|
438
|
-
|
439
|
-
it "should have a method for creating an SSL store" do
|
440
|
-
expect(Puppet::SSL::Host.new("me")).to respond_to(:ssl_store)
|
441
|
-
end
|
442
|
-
|
443
|
-
describe "when creating an SSL store" do
|
444
|
-
before do
|
445
|
-
Puppet[:localcacert] = "ssl_host_testing"
|
446
|
-
end
|
447
|
-
|
448
|
-
it "should accept a purpose" do
|
449
|
-
store = double('store', :add_file => nil)
|
450
|
-
expect(OpenSSL::X509::Store).to receive(:new).and_return(store)
|
451
|
-
expect(store).to receive(:purpose=).with(OpenSSL::X509::PURPOSE_SSL_SERVER)
|
452
|
-
host = Puppet::SSL::Host.new("me")
|
453
|
-
host.crl_usage = false
|
454
|
-
|
455
|
-
host.ssl_store(OpenSSL::X509::PURPOSE_SSL_SERVER)
|
456
|
-
end
|
457
|
-
|
458
|
-
context "and the CRL is not on disk" do
|
459
|
-
before do
|
460
|
-
@pki = PuppetSpec::SSL.create_chained_pki
|
461
|
-
@revoked_cert = @pki[:revoked_root_node_cert]
|
462
|
-
localcacert = Puppet.settings[:localcacert]
|
463
|
-
Puppet::Util.replace_file(localcacert, 0644) {|f| f.write @pki[:ca_bundle] }
|
464
|
-
end
|
465
|
-
|
466
|
-
after do
|
467
|
-
Puppet::FileSystem.unlink(Puppet.settings[:localcacert])
|
468
|
-
Puppet::FileSystem.unlink(Puppet.settings[:hostcrl])
|
469
|
-
end
|
470
|
-
|
471
|
-
it "retrieves it from the server" do
|
472
|
-
expect(Puppet::Rest::Routes).to receive(:get_crls)
|
473
|
-
.with(Puppet::SSL::CA_NAME, anything)
|
474
|
-
.and_return(@pki[:crl_chain])
|
475
|
-
|
476
|
-
@host.ssl_store
|
477
|
-
expect(Puppet::FileSystem.read(Puppet.settings[:hostcrl], :encoding => Encoding::UTF_8)).to eq(@pki[:crl_chain])
|
478
|
-
end
|
479
|
-
end
|
480
|
-
|
481
|
-
describe "and a CRL is available" do
|
482
|
-
before do
|
483
|
-
pki = PuppetSpec::SSL.create_chained_pki
|
484
|
-
|
485
|
-
@revoked_cert_from_self_signed_root = pki[:revoked_root_node_cert]
|
486
|
-
@revoked_cert_from_ca_with_untrusted_chain = pki[:revoked_leaf_node_cert]
|
487
|
-
@unrevoked_cert_from_self_signed_root = pki[:unrevoked_root_node_cert]
|
488
|
-
@unrevoked_cert_from_revoked_ca = pki[:unrevoked_int_node_cert]
|
489
|
-
@unrevoked_cert_from_ca_with_untrusted_chain = pki[:unrevoked_leaf_node_cert]
|
490
|
-
|
491
|
-
localcacert = Puppet.settings[:localcacert]
|
492
|
-
hostcrl = Puppet.settings[:hostcrl]
|
493
|
-
|
494
|
-
Puppet::Util.replace_file(localcacert, 0644) {|f| f.write pki[:ca_bundle] }
|
495
|
-
Puppet::Util.replace_file(hostcrl, 0644) {|f| f.write pki[:crl_chain] }
|
496
|
-
end
|
497
|
-
|
498
|
-
after do
|
499
|
-
Puppet::FileSystem.unlink(Puppet.settings[:localcacert])
|
500
|
-
Puppet::FileSystem.unlink(Puppet.settings[:hostcrl])
|
501
|
-
end
|
502
|
-
|
503
|
-
[true, :chain].each do |crl_setting|
|
504
|
-
describe "and 'certificate_revocation' is #{crl_setting}" do
|
505
|
-
before do
|
506
|
-
@host = Puppet::SSL::Host.new(crl_setting.to_s)
|
507
|
-
@host.crl_usage = crl_setting
|
508
|
-
end
|
509
|
-
|
510
|
-
it "should verify unrevoked certs" do
|
511
|
-
expect(
|
512
|
-
@host.ssl_store.verify(@unrevoked_cert_from_self_signed_root)
|
513
|
-
).to be true
|
514
|
-
end
|
515
|
-
|
516
|
-
it "should not verify revoked certs" do
|
517
|
-
[@revoked_cert_from_self_signed_root,
|
518
|
-
@revoked_cert_from_ca_with_untrusted_chain,
|
519
|
-
@unrevoked_cert_from_revoked_ca,
|
520
|
-
@unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
|
521
|
-
expect(@host.ssl_store.verify(cert)).to be false
|
522
|
-
end
|
523
|
-
end
|
524
|
-
end
|
525
|
-
end
|
526
|
-
|
527
|
-
describe "and 'certificate_revocation' is leaf" do
|
528
|
-
before do
|
529
|
-
@host = Puppet::SSL::Host.new("leaf")
|
530
|
-
@host.crl_usage = :leaf
|
531
|
-
end
|
532
|
-
|
533
|
-
it "should verify unrevoked certs regardless of signing CA's revocation status" do
|
534
|
-
[@unrevoked_cert_from_self_signed_root,
|
535
|
-
@unrevoked_cert_from_revoked_ca,
|
536
|
-
@unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
|
537
|
-
expect(@host.ssl_store.verify(cert)).to be true
|
538
|
-
end
|
539
|
-
end
|
540
|
-
|
541
|
-
it "should not verify certs revoked by their signing CA" do
|
542
|
-
[@revoked_cert_from_self_signed_root,
|
543
|
-
@revoked_cert_from_ca_with_untrusted_chain].each do |cert|
|
544
|
-
expect(@host.ssl_store.verify(cert)).to be false
|
545
|
-
end
|
546
|
-
end
|
547
|
-
end
|
548
|
-
|
549
|
-
describe "and 'certificate_revocation' is false" do
|
550
|
-
before do
|
551
|
-
@host = Puppet::SSL::Host.new("host")
|
552
|
-
@host.crl_usage = false
|
553
|
-
end
|
554
|
-
|
555
|
-
it "should verify valid certs regardless of revocation status" do
|
556
|
-
[@revoked_cert_from_self_signed_root,
|
557
|
-
@revoked_cert_from_ca_with_untrusted_chain,
|
558
|
-
@unrevoked_cert_from_self_signed_root,
|
559
|
-
@unrevoked_cert_from_revoked_ca,
|
560
|
-
@unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
|
561
|
-
expect(@host.ssl_store.verify(cert)).to be true
|
562
|
-
end
|
563
|
-
end
|
564
|
-
end
|
565
|
-
end
|
566
|
-
end
|
567
|
-
|
568
|
-
describe "when waiting for a cert" do
|
569
|
-
before do
|
570
|
-
@host = Puppet::SSL::Host.new("me")
|
571
|
-
end
|
572
|
-
|
573
|
-
it "should generate its certificate request and attempt to read the certificate again if no certificate is found" do
|
574
|
-
expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
|
575
|
-
expect(@host).to receive(:generate)
|
576
|
-
@host.wait_for_cert(1)
|
577
|
-
end
|
578
|
-
|
579
|
-
it "should catch and log errors during CSR saving" do
|
580
|
-
expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
|
581
|
-
times_generate_called = 0
|
582
|
-
expect(@host).to receive(:generate) do
|
583
|
-
times_generate_called += 1
|
584
|
-
raise RuntimeError if times_generate_called == 1
|
585
|
-
nil
|
586
|
-
end
|
587
|
-
allow(@host).to receive(:sleep)
|
588
|
-
@host.wait_for_cert(1)
|
589
|
-
end
|
590
|
-
|
591
|
-
it "should sleep and retry after failures saving the CSR if waitforcert is enabled" do
|
592
|
-
expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
|
593
|
-
times_generate_called = 0
|
594
|
-
expect(@host).to receive(:generate) do
|
595
|
-
times_generate_called += 1
|
596
|
-
raise RuntimeError if times_generate_called == 1
|
597
|
-
nil
|
598
|
-
end
|
599
|
-
expect(@host).to receive(:sleep).with(1)
|
600
|
-
@host.wait_for_cert(1)
|
601
|
-
end
|
602
|
-
|
603
|
-
it "should exit after failures saving the CSR of waitforcert is disabled" do
|
604
|
-
expect(@host).to receive(:certificate).and_return(nil)
|
605
|
-
expect(@host).to receive(:generate).and_raise(RuntimeError)
|
606
|
-
expect(@host).to receive(:puts)
|
607
|
-
expect { @host.wait_for_cert(0) }.to exit_with 1
|
608
|
-
end
|
609
|
-
|
610
|
-
it "should exit if the wait time is 0 and it can neither find nor retrieve a certificate" do
|
611
|
-
allow(@host).to receive(:certificate).and_return(nil)
|
612
|
-
expect(@host).to receive(:generate)
|
613
|
-
expect(@host).to receive(:puts)
|
614
|
-
expect { @host.wait_for_cert(0) }.to exit_with 1
|
615
|
-
end
|
616
|
-
|
617
|
-
it "should sleep for the specified amount of time if no certificate is found after generating its certificate request" do
|
618
|
-
expect(@host).to receive(:certificate).exactly(3).times().and_return(nil, nil, "foo")
|
619
|
-
expect(@host).to receive(:generate)
|
620
|
-
|
621
|
-
expect(@host).to receive(:sleep).with(1)
|
622
|
-
|
623
|
-
@host.wait_for_cert(1)
|
624
|
-
end
|
625
|
-
|
626
|
-
it "should catch and log exceptions during certificate retrieval" do
|
627
|
-
times_certificate_called = 0
|
628
|
-
expect(@host).to receive(:certificate) do
|
629
|
-
times_certificate_called += 1
|
630
|
-
if times_certificate_called == 1
|
631
|
-
return nil
|
632
|
-
elsif times_certificate_called == 2
|
633
|
-
raise RuntimeError
|
634
|
-
end
|
635
|
-
"foo"
|
636
|
-
end.exactly(3).times()
|
637
|
-
allow(@host).to receive(:generate)
|
638
|
-
allow(@host).to receive(:sleep)
|
639
|
-
|
640
|
-
expect(Puppet).to receive(:log_exception).at_least(:once)
|
641
|
-
|
642
|
-
@host.wait_for_cert(1)
|
643
|
-
end
|
644
|
-
end
|
645
|
-
end
|