puppet 6.25.1-universal-darwin → 7.0.0-universal-darwin

data/spec/unit/settings/port_setting_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+require 'puppet/settings'
+require 'puppet/settings/port_setting'
+
+describe Puppet::Settings::PortSetting do
+  let(:setting) { described_class.new(:settings => double('settings'), :desc => "test") }
+
+  it "is of type :port" do
+    expect(setting.type).to eq(:port)
+  end
+
+  describe "when munging the setting" do
+    it "returns the same value if given a valid port as integer" do
+      expect(setting.munge(5)).to eq(5)
+    end
+
+    it "returns an integer if given valid port as string" do
+      expect(setting.munge('12')).to eq(12)
+    end
+
+    it "raises if given a negative port number" do
+      expect { setting.munge('-5') }.to raise_error(Puppet::Settings::ValidationError)
+    end
+
+    it "raises if the port number is too high" do
+      expect { setting.munge(65536) }.to raise_error(Puppet::Settings::ValidationError)
+    end
+
+  end
+end

data/spec/unit/settings/priority_setting_spec.rb

@@ -52,10 +52,10 @@ describe Puppet::Settings::PrioritySetting do
     describe "on a Windows-like platform it", :if => Puppet::Util::Platform.windows? do
       it "parses high, normal, low, and idle priorities" do
         {
-          'high'   => Puppet::Util::Windows::Process::HIGH_PRIORITY_CLASS,
-          'normal' => Puppet::Util::Windows::Process::NORMAL_PRIORITY_CLASS,
-          'low'    => Puppet::Util::Windows::Process::BELOW_NORMAL_PRIORITY_CLASS,
-          'idle'   => Puppet::Util::Windows::Process::IDLE_PRIORITY_CLASS
+          'high'   => Puppet::FFI::Windows::Constants::HIGH_PRIORITY_CLASS,
+          'normal' => Puppet::FFI::Windows::Constants::NORMAL_PRIORITY_CLASS,
+          'low'    => Puppet::FFI::Windows::Constants::BELOW_NORMAL_PRIORITY_CLASS,
+          'idle'   => Puppet::FFI::Windows::Constants::IDLE_PRIORITY_CLASS
         }.each do |value, converted_value|
           expect(setting.munge(value)).to eq(converted_value)
         end

data/spec/unit/settings_spec.rb

@@ -29,17 +29,6 @@ describe Puppet::Settings do
     end
   end
 
-  def stub_config_with(content)
-    allow(Puppet.features).to receive(:root?).and_return(false)
-    expect(Puppet::FileSystem).to receive(:exist?).
-      with(user_config_file_default_location).
-      and_return(true).ordered
-    expect(@settings).to receive(:read_file).
-      with(user_config_file_default_location).
-      and_return(content).ordered
-    @settings.send(:parse_config_files)
-  end
-
   describe "when specifying defaults" do
     before do
       @settings = Puppet::Settings.new
@@ -275,31 +264,23 @@ describe Puppet::Settings do
       expect(@settings[:myval]).to eq("")
     end
 
-    it "should retrieve numeric settings from the CLI" do
+    it "should flag string settings from the CLI" do
       @settings.handlearg("--myval", "12")
-      expect(@settings.set_by_cli(:myval)).to eq(12)
-      expect(@settings.set_by_cli?(:myval)).to be true
-    end
-
-    it "should retrieve string settings from the CLI" do
-      @settings.handlearg("--myval", "something")
-      expect(@settings.set_by_cli(:myval)).to eq("something")
-      expect(@settings.set_by_cli?(:myval)).to be true
+      expect(@settings.set_by_cli?(:myval)).to be_truthy
     end
 
-    it "should retrieve bool settings from the CLI" do
+    it "should flag bool settings from the CLI" do
       @settings.handlearg("--bool")
-      expect(@settings.set_by_cli(:bool)).to be true
-      expect(@settings.set_by_cli?(:bool)).to be true
+      expect(@settings.set_by_cli?(:bool)).to be_truthy
     end
 
-    it "should not retrieve settings set in memory as from CLI" do
+    it "should not flag settings memory as from CLI" do
       @settings[:myval] = "12"
-      expect(@settings.set_by_cli?(:myval)).to be false
+      expect(@settings.set_by_cli?(:myval)).to be_falsey
     end
 
     it "should find no configured settings by default" do
-      expect(@settings.set_by_config?(:myval)).to be false
+      expect(@settings.set_by_config?(:myval)).to be_falsey
     end
 
     it "should identify configured settings in memory" do
@@ -323,66 +304,64 @@ describe Puppet::Settings do
       expect(@settings.set_by_config?(:manifest, Puppet[:environment])).to be_truthy
     end
 
-    context "when handling puppet.conf" do
-      describe "#set_by_config?" do
-        it "should identify configured settings from the preferred run mode" do
-          stub_config_with(<<~CONFIG)
-          [#{@settings.preferred_run_mode}]
-          myval = foo
-          CONFIG
+    it "should identify configured settings from the preferred run mode" do
+      user_config_text = "[#{@settings.preferred_run_mode}]\nmyval = foo"
 
-          expect(@settings.set_by_config?(:myval)).to be_truthy
-        end
+      allow(Puppet.features).to receive(:root?).and_return(false)
+      expect(Puppet::FileSystem).to receive(:exist?).
+        with(user_config_file_default_location).
+        and_return(true).ordered
+      expect(@settings).to receive(:read_file).
+        with(user_config_file_default_location).
+        and_return(user_config_text).ordered
 
-        it "should identify configured settings from the specified run mode" do
-          stub_config_with(<<~CONFIG)
-          [server]
-          myval = foo
-          CONFIG
+      @settings.send(:parse_config_files)
+      expect(@settings.set_by_config?(:myval)).to be_truthy
+    end
 
-          expect(@settings.set_by_config?(:myval, nil, :server)).to be_truthy
-        end
+    it "should identify configured settings from the specified run mode" do
+      user_config_text = "[server]\nmyval = foo"
 
-        it "should not identify configured settings from an unspecified run mode" do
-          stub_config_with(<<~CONFIG)
-          [zaz]
-          myval = foo
-          CONFIG
+      allow(Puppet.features).to receive(:root?).and_return(false)
+      expect(Puppet::FileSystem).to receive(:exist?).
+        with(user_config_file_default_location).
+        and_return(true).ordered
+      expect(@settings).to receive(:read_file).
+        with(user_config_file_default_location).
+        and_return(user_config_text).ordered
 
-          expect(@settings.set_by_config?(:myval)).to be_falsey
-        end
+      @settings.send(:parse_config_files)
+      expect(@settings.set_by_config?(:myval, nil, :server)).to be_truthy
+    end
 
-        it "should identify configured settings from the main section" do
-          stub_config_with(<<~CONFIG)
-          [main]
-          myval = foo
-          CONFIG
+    it "should not identify configured settings from an unspecified run mode" do
+      user_config_text = "[zaz]\nmyval = foo"
 
-          expect(@settings.set_by_config?(:myval)).to be_truthy
-        end
-      end
+      allow(Puppet.features).to receive(:root?).and_return(false)
+      expect(Puppet::FileSystem).to receive(:exist?).
+        with(user_config_file_default_location).
+        and_return(true).ordered
+      expect(@settings).to receive(:read_file).
+        with(user_config_file_default_location).
+        and_return(user_config_text).ordered
 
-      describe "#set_in_section" do
-        it "should retrieve configured settings from the specified section" do
-          stub_config_with(<<~CONFIG)
-          [agent]
-          myval = foo
-          CONFIG
+      @settings.send(:parse_config_files)
+      expect(@settings.set_by_config?(:myval)).to be_falsey
+    end
 
-          expect(@settings.set_in_section(:myval, :agent)).to eq("foo")
-          expect(@settings.set_in_section?(:myval, :agent)).to be true
-        end
+    it "should identify configured settings from the main section" do
+      user_config_text = "[main]\nmyval = foo"
 
-        it "should not retrieve configured settings from a different section" do
-          stub_config_with(<<~CONFIG)
-          [main]
-          myval = foo
-          CONFIG
+      allow(Puppet.features).to receive(:root?).and_return(false)
+      expect(Puppet::FileSystem).to receive(:exist?).
+        with(user_config_file_default_location).
+        and_return(true).ordered
+      expect(@settings).to receive(:read_file).
+        with(user_config_file_default_location).
+        and_return(user_config_text).ordered
 
-          expect(@settings.set_in_section(:myval, :agent)).to be nil
-          expect(@settings.set_in_section?(:myval, :agent)).to be false
-        end
-      end
+      @settings.send(:parse_config_files)
+      expect(@settings.set_by_config?(:myval)).to be_truthy
     end
 
     it "should clear the cache when setting getopt-specific values" do
@@ -1109,7 +1088,7 @@ describe Puppet::Settings do
       before(:each) do
         @settings.define_settings :main, PuppetSpec::Settings::TEST_APP_DEFAULT_DEFINITIONS
         @settings.define_settings :server, :masterport => { :desc => "a", :default => 1000 }
-        @settings.define_settings :server, :serverport => { :type => :alias, :alias_for => :masterport }
+        @settings.define_settings :server, :serverport => { :desc => "a", :default => 1000 }
         @settings.define_settings :server, :ca_port => { :desc => "a", :default => "$serverport" }
         @settings.define_settings :server, :report_port => { :desc => "a", :default => "$serverport" }
 
@@ -1131,10 +1110,9 @@ describe Puppet::Settings do
       "
         end
 
-        it { expect(@settings[:serverport]).to eq(444) }
-        it { expect(@settings[:ca_port]).to eq("444") }
-        it { expect(@settings[:report_port]).to eq("444") }
-        it { expect(@settings[:masterport]).to eq(445) }
+        it { expect(@settings[:serverport]).to eq(445) }
+        it { expect(@settings[:ca_port]).to eq("445") }
+        it { expect(@settings[:report_port]).to eq("445") }
       end
 
       context 'with serverport and masterport in main' do
@@ -1148,7 +1126,6 @@ describe Puppet::Settings do
         it { expect(@settings[:serverport]).to eq(445) }
         it { expect(@settings[:ca_port]).to eq("445") }
         it { expect(@settings[:report_port]).to eq("445") }
-        it { expect(@settings[:masterport]).to eq(444) }
       end
 
       context 'with serverport and masterport in agent' do
@@ -1162,7 +1139,6 @@ describe Puppet::Settings do
         it { expect(@settings[:serverport]).to eq(445) }
         it { expect(@settings[:ca_port]).to eq("445") }
         it { expect(@settings[:report_port]).to eq("445") }
-        it { expect(@settings[:masterport]).to eq(444) }
       end
 
       context 'with both serverport and masterport in main and agent' do
@@ -1179,7 +1155,6 @@ describe Puppet::Settings do
         it { expect(@settings[:serverport]).to eq(445) }
         it { expect(@settings[:ca_port]).to eq("445") }
         it { expect(@settings[:report_port]).to eq("445") }
-        it { expect(@settings[:masterport]).to eq(444) }
       end
 
       context 'with serverport in agent and masterport in main' do
@@ -1194,7 +1169,6 @@ describe Puppet::Settings do
         it { expect(@settings[:serverport]).to eq(444) }
         it { expect(@settings[:ca_port]).to eq("444") }
         it { expect(@settings[:report_port]).to eq("444") }
-        it { expect(@settings[:masterport]).to eq(445) }
       end
 
       context 'with masterport in main' do
@@ -1207,7 +1181,6 @@ describe Puppet::Settings do
         it { expect(@settings[:serverport]).to eq(445) }
         it { expect(@settings[:ca_port]).to eq("445") }
         it { expect(@settings[:report_port]).to eq("445") }
-        it { expect(@settings[:masterport]).to eq(445) }
       end
 
       context 'with masterport in agent' do
@@ -1220,7 +1193,6 @@ describe Puppet::Settings do
         it { expect(@settings[:serverport]).to eq(445) }
         it { expect(@settings[:ca_port]).to eq("445") }
         it { expect(@settings[:report_port]).to eq("445") }
-        it { expect(@settings[:masterport]).to eq(445) }
       end
 
       context 'with serverport in agent' do
@@ -1231,7 +1203,7 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(445) }
-        it { expect(@settings[:masterport]).to eq(1000) }
+        it { expect(@settings[:masterport]).to eq(445) }
         it { expect(@settings[:ca_port]).to eq("445") }
         it { expect(@settings[:report_port]).to eq("445") }
       end
@@ -1244,7 +1216,7 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(445) }
-        it { expect(@settings[:masterport]).to eq(1000) }
+        it { expect(@settings[:masterport]).to eq(445) }
         it { expect(@settings[:ca_port]).to eq("445") }
         it { expect(@settings[:report_port]).to eq("445") }
       end
@@ -2012,6 +1984,23 @@ describe Puppet::Settings do
     end
   end
 
+  describe 'when settings_catalog is disabled' do
+    let(:settings) { Puppet::Settings.new }
+    before do
+      allow(Puppet).to receive(:[]).with(:settings_catalog).and_return(false)
+    end
+
+    it 'does not compile and apply settings catalog' do
+      expect(settings).not_to receive(:to_catalog)
+      settings.use(:main)
+    end
+
+    it 'logs a message that settings catalog is skipped' do
+      expect(Puppet).to receive(:debug).with('Skipping settings catalog for sections main')
+      settings.use(:main)
+    end
+  end
+
   describe "when dealing with printing configs" do
     before do
       @settings = Puppet::Settings.new
@@ -2141,7 +2130,7 @@ describe Puppet::Settings do
     end
 
     def a_user_type_for(username)
-      user = double('user', 'suitable?': true, to_s: "User[#{username}]")
+      user = double('user')
       expect(Puppet::Type.type(:user)).to receive(:new).with(hash_including(name: username)).and_return(user)
       user
     end
@@ -2174,16 +2163,6 @@ describe Puppet::Settings do
 
       expect(settings).to be_service_user_available
     end
-
-    it "raises if the user is not suitable" do
-      settings[:user] = "foo"
-
-      expect(a_user_type_for("foo")).to receive(:suitable?).and_return(false)
-
-      expect {
-        settings.service_user_available?
-      }.to raise_error(Puppet::Error, /Cannot manage owner permissions, because the provider for 'User\[foo\]' is not functional/)
-    end
   end
 
   describe "when determining if the service group is available" do
@@ -2194,7 +2173,7 @@ describe Puppet::Settings do
     end
 
     def a_group_type_for(groupname)
-      group = double('group', 'suitable?': true, to_s: "Group[#{groupname}]")
+      group = double('group')
       expect(Puppet::Type.type(:group)).to receive(:new).with(hash_including(name: groupname)).and_return(group)
       group
     end
@@ -2227,16 +2206,6 @@ describe Puppet::Settings do
 
       expect(settings).to be_service_group_available
     end
-
-    it "raises if the group is not suitable" do
-      settings[:group] = "foo"
-
-      expect(a_group_type_for("foo")).to receive(:suitable?).and_return(false)
-
-      expect {
-        settings.service_group_available?
-      }.to raise_error(Puppet::Error, /Cannot manage group permissions, because the provider for 'Group\[foo\]' is not functional/)
-    end
   end
 
   describe "when dealing with command-line options" do

data/spec/unit/ssl/base_spec.rb

@@ -38,15 +38,15 @@ describe Puppet::SSL::Certificate do
 
   describe "when determining a name from a certificate subject" do
     it "should extract only the CN and not any other components" do
-      subject = double('sub')
-      expect(Puppet::Util::SSL).to receive(:cn_from_subject).with(subject).and_return('host.domain.com')
-      expect(@class.name_from_subject(subject)).to eq('host.domain.com')
+      name = OpenSSL::X509::Name.parse('/CN=host.domain.com/L=Portland/ST=Oregon')
+      expect(@class.name_from_subject(name)).to eq('host.domain.com')
     end
   end
 
   describe "when initializing wrapped class from a file with #read" do
     it "should open the file with ASCII encoding" do
       path = '/foo/bar/cert'
+      allow(Puppet::SSL::Base).to receive(:valid_certname).and_return(true)
       expect(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("bar")
       @base.read(path)
     end
@@ -89,4 +89,38 @@ describe Puppet::SSL::Certificate do
       }.to raise_error(Puppet::Error, "Unknown signature algorithm 'nonsense'")
     end
   end
+
+  describe "when getting a CN from a subject" do
+    def parse(dn)
+      OpenSSL::X509::Name.parse(dn)
+    end
+
+    def cn_from(subject)
+      @class.name_from_subject(subject)
+    end
+
+    it "should correctly parse a subject containing only a CN" do
+      subj = parse('/CN=foo')
+      expect(cn_from(subj)).to eq('foo')
+    end
+
+    it "should correctly parse a subject containing other components" do
+      subj = parse('/CN=Root CA/OU=Server Operations/O=Example Org')
+      expect(cn_from(subj)).to eq('Root CA')
+    end
+
+    it "should correctly parse a subject containing other components with CN not first" do
+      subj = parse('/emailAddress=foo@bar.com/CN=foo.bar.com/O=Example Org')
+      expect(cn_from(subj)).to eq('foo.bar.com')
+    end
+
+    it "should return nil for a subject with no CN" do
+      subj = parse('/OU=Server Operations/O=Example Org')
+      expect(cn_from(subj)).to eq(nil)
+    end
+
+    it "should return nil for a bare string" do
+      expect(cn_from("/CN=foo")).to eq(nil)
+    end
+  end
 end

data/spec/unit/ssl/certificate_request_spec.rb

@@ -1,23 +1,10 @@
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_request'
-require 'puppet/ssl/key'
 
 describe Puppet::SSL::CertificateRequest do
   let(:request) { described_class.new("myname") }
-  let(:key) {
-    k = Puppet::SSL::Key.new("myname")
-    k.generate
-    k
-  }
-
-  it "should be extended with the Indirector module" do
-    expect(described_class.singleton_class).to be_include(Puppet::Indirector)
-  end
-
-  it "should indirect certificate_request" do
-    expect(described_class.indirection.name).to eq(:certificate_request)
-  end
+  let(:key) { OpenSSL::PKey::RSA.new(Puppet[:keylength]) }
 
   it "should use any provided name as its name" do
     expect(described_class.new("myname").name).to eq("myname")
@@ -83,14 +70,9 @@ describe Puppet::SSL::CertificateRequest do
   end
 
   describe "when generating", :unless => RUBY_PLATFORM == 'java' do
-    it "should use the content of the provided key if the key is a Puppet::SSL::Key instance" do
+    it "should verify the CSR using the public key associated with the private key" do
       request.generate(key)
-      expect(request.content.verify(key.content.public_key)).to be_truthy
-    end
-
-    it "should set the subject to [CN, name]" do
-      request.generate(key)
-      expect(request.content.subject).to eq OpenSSL::X509::Name.new([['CN', key.name]])
+      expect(request.content.verify(key.public_key)).to be_truthy
     end
 
     it "should set the version to 0" do
@@ -101,7 +83,7 @@ describe Puppet::SSL::CertificateRequest do
     it "should set the public key to the provided key's public key" do
       request.generate(key)
       # The openssl bindings do not define equality on keys so we use to_s
-      expect(request.content.public_key.to_s).to eq(key.content.public_key.to_s)
+      expect(request.content.public_key.to_s).to eq(key.public_key.to_s)
     end
 
     context "without subjectAltName / dns_alt_names" do
@@ -295,20 +277,20 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should sign the csr with the provided key" do
       request.generate(key)
-      expect(request.content.verify(key.content.public_key)).to be_truthy
+      expect(request.content.verify(key.public_key)).to be_truthy
     end
 
     it "should verify the generated request using the public key" do
       # Stupid keys don't have a competent == method.
       expect_any_instance_of(OpenSSL::X509::Request).to receive(:verify) do |public_key|
-        public_key.to_s == key.content.public_key.to_s
+        public_key.to_s == key.public_key.to_s
       end.and_return(true)
       request.generate(key)
     end
 
     it "should fail if verification fails" do
       expect_any_instance_of(OpenSSL::X509::Request).to receive(:verify) do |public_key|
-        public_key.to_s == key.content.public_key.to_s
+        public_key.to_s == key.public_key.to_s
       end.and_return(false)
 
       expect do
@@ -334,12 +316,15 @@ describe Puppet::SSL::CertificateRequest do
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(true)
       signer = Puppet::SSL::CertificateSigner.new
-      signer.sign(csr, key.content)
-      expect(csr.verify(key.content)).to be_truthy
+      signer.sign(csr, key)
+      expect(csr.verify(key)).to be_truthy
     end
 
-    it "should use SHA512 to sign the csr when SHA256 and SHA1 aren't available" do
-      key = OpenSSL::PKey::RSA.new(2048)
+    # Attempts to use SHA512 and SHA384 for signing certificates don't seem to work
+    # So commenting it out till it is sorted out
+    # The problem seems to be with the ability to sign a CSR when using either of
+    # these hash algorithms
+    pending "should use SHA512 to sign the csr when SHA256 and SHA1 aren't available" do
       csr = OpenSSL::X509::Request.new
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
@@ -349,8 +334,11 @@ describe Puppet::SSL::CertificateRequest do
       expect(csr.verify(key)).to be_truthy
     end
 
-    it "should use SHA384 to sign the csr when SHA256/SHA1/SHA512 aren't available" do
-      key = OpenSSL::PKey::RSA.new(2048)
+    # Attempts to use SHA512 and SHA384 for signing certificates don't seem to work
+    # So commenting it out till it is sorted out
+    # The problem seems to be with the ability to sign a CSR when using either of
+    # these hash algorithms
+    pending "should use SHA384 to sign the csr when SHA256/SHA1/SHA512 aren't available" do
       csr = OpenSSL::X509::Request.new
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
@@ -369,8 +357,8 @@ describe Puppet::SSL::CertificateRequest do
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA384").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA224").and_return(true)
       signer = Puppet::SSL::CertificateSigner.new
-      signer.sign(csr, key.content)
-      expect(csr.verify(key.content)).to be_truthy
+      signer.sign(csr, key)
+      expect(csr.verify(key)).to be_truthy
     end
 
     it "should raise an error if neither SHA256/SHA1/SHA512/SHA384/SHA224 are available" do
@@ -384,16 +372,4 @@ describe Puppet::SSL::CertificateRequest do
       }.to raise_error(Puppet::Error)
     end
   end
-
-  it "should save the CSR" do
-    csr = Puppet::SSL::CertificateRequest.new("me")
-    terminus = double('terminus')
-    allow(terminus).to receive(:validate)
-    expect(Puppet::SSL::CertificateRequest.indirection).to receive(:prepare).and_return(terminus)
-    expect(terminus).to receive(:save) do |request|
-      expect(request.instance).to eq(csr)
-      expect(request.key).to eq("me")
-    end
-    Puppet::SSL::CertificateRequest.indirection.save(csr)
-  end
 end

data/spec/unit/ssl/certificate_spec.rb

@@ -4,7 +4,7 @@ require 'puppet/certificate_factory'
 require 'puppet/ssl/certificate'
 
 describe Puppet::SSL::Certificate do
-  let :key do Puppet::SSL::Key.new("test.localdomain").generate end
+  let :key do OpenSSL::PKey::RSA.new(Puppet[:keylength]) end
 
   # Sign the provided cert so that it can be DER-decoded later
   def sign_wrapped_cert(cert)
@@ -16,14 +16,6 @@ describe Puppet::SSL::Certificate do
     @class = Puppet::SSL::Certificate
   end
 
-  it "should be extended with the Indirector module" do
-    expect(@class.singleton_class).to be_include(Puppet::Indirector)
-  end
-
-  it "should indirect certificate" do
-    expect(@class.indirection.name).to eq(:certificate)
-  end
-
   it "should only support the text format" do
     expect(@class.supported_formats).to eq([:s])
   end
@@ -82,8 +74,7 @@ describe Puppet::SSL::Certificate do
 
   describe "when managing instances" do
     def build_cert(opts)
-      key = Puppet::SSL::Key.new('quux')
-      key.generate
+      key = OpenSSL::PKey::RSA.new(Puppet[:keylength])
       csr = Puppet::SSL::CertificateRequest.new('quux')
       csr.generate(key, opts)
 

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -271,11 +271,8 @@ describe Puppet::SSL::SSLProvider do
     end
 
     # This option is only available in openssl 1.1
-    # OpenSSL 1.1.1h no longer reports expired root CAs when using "verify".
-    # This regression was fixed in 1.1.1i, so only skip this test if we're on
-    # the affected version.
-    # See: https://github.com/openssl/openssl/pull/13585
-    if Puppet::Util::Package.versioncmp(OpenSSL::OPENSSL_LIBRARY_VERSION.split[1], '1.1.1h') != 0
+    # TODO PUP-10689 behavior changed in openssl 1.1.1h
+    if Puppet::Util::Package.versioncmp(OpenSSL::OPENSSL_LIBRARY_VERSION.split[1], '1.1.1h') < 0
       it 'raises if root cert signature is invalid', if: defined?(OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE) do
         ca = global_cacerts.first
         ca.sign(wrong_key, OpenSSL::Digest::SHA256.new)