puppet 6.25.1 → 6.28.0

data/spec/unit/functions/versioncmp_spec.rb

@@ -19,16 +19,52 @@ describe "the versioncmp function" do
   let(:type_parser) { Puppet::Pops::Types::TypeParser.singleton }
 
   it 'should raise an Error if there is less than 2 arguments' do
-    expect { versioncmp('a,b') }.to raise_error(/expects 2 arguments, got 1/)
+    expect { versioncmp('a,b') }.to raise_error(/expects between 2 and 3 arguments, got 1/)
   end
 
-  it 'should raise an Error if there is more than 2 arguments' do
-    expect { versioncmp('a,b','foo', 'bar') }.to raise_error(/expects 2 arguments, got 3/)
+  it 'should raise an Error if there is more than 3 arguments' do
+    expect { versioncmp('a,b','foo', false, 'bar') }.to raise_error(/expects between 2 and 3 arguments, got 4/)
   end
 
   it "should call Puppet::Util::Package.versioncmp (included in scope)" do
-    expect(Puppet::Util::Package).to receive(:versioncmp).with('1.2', '1.3').and_return(-1)
+    expect(Puppet::Util::Package).to receive(:versioncmp).with('1.2', '1.3', false).and_return(-1)
 
     expect(versioncmp('1.2', '1.3')).to eq(-1)
   end
+
+  context "when ignore_trailing_zeroes is true" do
+    it "should equate versions with 2 elements and dots but with unnecessary zero" do
+      expect(versioncmp("10.1.0", "10.1", true)).to eq(0)
+    end
+
+    it "should equate versions with 1 element and dot but with unnecessary zero" do
+      expect(versioncmp("11.0", "11", true)).to eq(0)
+    end
+
+    it "should equate versions with 1 element and dot but with unnecessary zeros" do
+      expect(versioncmp("11.00", "11", true)).to eq(0)
+    end
+
+    it "should equate versions with dots and iregular zeroes" do
+      expect(versioncmp("11.0.00", "11", true)).to eq(0)
+    end
+
+    it "should equate versions with dashes" do
+      expect(versioncmp("10.1-0", "10.1.0-0", true)).to eq(0)
+    end
+
+    it "should compare versions with dashes after normalization" do
+      expect(versioncmp("10.1-1", "10.1.0-0", true)).to eq(1)
+    end
+
+    it "should not normalize versions if zeros are not trailing" do
+      expect(versioncmp("1.1", "1.0.1", true)).to eq(1)
+    end
+  end
+
+  context "when ignore_trailing_zeroes is false" do
+    it "should not equate versions if zeros are not trailing" do
+      expect(versioncmp("1.1", "1.0.1")).to eq(1)
+    end
+  end
 end

data/spec/unit/http/client_spec.rb

@@ -120,6 +120,24 @@ describe Puppet::HTTP::Client do
 
       client.close
     end
+
+    it 'reloads the default ssl context' do
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier.ssl_context).to_not equal(puppet_context)
+      end
+
+      client.close
+      client.connect(uri)
+    end
+
+    it 'reloads the default system ssl context' do
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier.ssl_context).to_not equal(system_context)
+      end
+
+      client.close
+      client.connect(uri, options: {include_system_store: true})
+    end
   end
 
   context "for GET requests" do

data/spec/unit/node_spec.rb

@@ -40,6 +40,12 @@ describe Puppet::Node do
         expect(node.environment.name).to eq(:bar)
       end
 
+      it "sets environment_name with the correct environment name" do
+        node = Puppet::Node.new("foo")
+        node.environment = Puppet::Node::Environment.remote('www123')
+        expect(node.environment_name).to eq(:www123)
+      end
+
       it "allows its environment to be set by parameters after initialization" do
         node = Puppet::Node.new("foo")
         node.parameters["environment"] = :bar

data/spec/unit/pops/parser/parse_containers_spec.rb

@@ -106,7 +106,7 @@ describe "egrammar parsing containers" do
 
     context 'it should allow keywords as attribute names' do
       ['and', 'case', 'class', 'default', 'define', 'else', 'elsif', 'if', 'in', 'inherits', 'node', 'or',
-        'undef', 'unless', 'type', 'attr', 'function', 'private'].each do |keyword|
+        'undef', 'unless', 'type', 'attr', 'function', 'private', 'plan', 'apply'].each do |keyword|
         it "such as #{keyword}" do
           expect { parse("class x ($#{keyword}){} class { x: #{keyword} => 1 }") }.to_not raise_error
         end
@@ -178,7 +178,7 @@ describe "egrammar parsing containers" do
 
     context 'it should allow keywords as attribute names' do
       ['and', 'case', 'class', 'default', 'define', 'else', 'elsif', 'if', 'in', 'inherits', 'node', 'or',
-        'undef', 'unless', 'type', 'attr', 'function', 'private'].each do |keyword|
+        'undef', 'unless', 'type', 'attr', 'function', 'private', 'plan', 'apply'].each do |keyword|
         it "such as #{keyword}" do
           expect {parse("define x ($#{keyword}){} x { y: #{keyword} => 1 }")}.to_not raise_error
         end

data/spec/unit/pops/serialization/to_from_hr_spec.rb

@@ -559,29 +559,6 @@ module Serialization
         expect(warnings).to eql(["['key'] contains the special value default. It will be converted to the String 'default'"])
       end
     end
-    context 'and force_symbol set to true' do
-      let(:to_converter) { ToDataConverter.new(:rich_data => false, :force_symbol => true) }
-
-      it 'A Hash with Symbol values is converted to hash with Symbol values' do
-        val = { 'one' => :one, 'two' => :two }
-        Puppet::Util::Log.with_destination(Puppet::Test::LogCollector.new(logs)) do
-
-          # write and read methods does not work here as we cannot force Symbols in Json.
-          # and a hash with symbol values cannot be an instance of Types::TypeFactory.data.
-          # Using YAML for this instead
-          io.reopen
-          value = to_converter.convert(val)
-          io << [value].to_yaml
-          io.rewind
-
-          val2 = from_converter.convert(YAML::load(io.read)[0])
-
-          expect(val2).to be_a(Hash)
-          expect(val2).to eql({ 'one' => :one, 'two' => :two })
-        end
-        expect(warnings).to be_empty
-      end
-    end
   end
 
   context 'with rich_data is set to true' do
@@ -655,41 +632,6 @@ module Serialization
       end.to raise_error(/Cannot create a Pcore::TimestampType from a (Fixnum|Integer)/)
     end
   end
-
-  context 'when data is unknown' do
-    let(:to_converter) { ToDataConverter.new(:message_prefix => 'Test Hash') }
-    let(:logs) { [] }
-    let(:warnings) { logs.select { |log| log.level == :warning }.map { |log| log.message } }
-    let(:val) { Class.new }
-
-    context 'and :silence_warnings undefined or set to false' do
-      it 'convert the unknown data to string with warnings' do
-        Puppet::Util::Log.with_destination(Puppet::Test::LogCollector.new(logs)) do
-          write(val)
-          val2 = read
-          expect(val2).to be_a(String)
-          expect(val2).to match(/Class/)
-        end
-        expect(warnings).to eql([
-          "Test Hash contains a #{val.class} value. It will be converted to the String '#{val.to_s}'"])
-      end
-    end
-
-    context 'and :silence_warnings undefined or set to true' do
-      let(:to_converter) { ToDataConverter.new(:message_prefix => 'Test Hash', :silence_warnings => true) }
-
-      it 'convert the unknown data to string without warnings if silence_warnings set to true' do
-        val = Class.new
-        Puppet::Util::Log.with_destination(Puppet::Test::LogCollector.new(logs)) do
-          write(val)
-          val2 = read
-          expect(val2).to be_a(String)
-          expect(val2).to match(/Class/)
-        end
-        expect(warnings).to be_empty
-      end
-    end
-  end
 end
 end
 end

data/spec/unit/pops/validator/validator_spec.rb

@@ -432,6 +432,11 @@ describe "validating 4x" do
         expect(acceptor.error_count).to eql(0)
       end
 
+      it 'allows apply to be used as a resource attribute name' do
+        acceptor = validate(parse('apply("foo.example.com") { sometype { "resourcetitle": apply => "applyvalue" } }'))
+        expect(acceptor.error_count).to eql(0)
+      end
+
       it 'accepts multiple arguments' do
         acceptor = validate(parse('apply(["foo.example.com"], { "other" => "args" }) { }'))
         expect(acceptor.error_count).to eql(0)

data/spec/unit/provider/package/puppetserver_gem_spec.rb

@@ -105,9 +105,9 @@ describe Puppet::Type.type(:package).provider(:puppetserver_gem) do
 
   describe ".gemlist" do
     context "listing installed packages" do
-      it "uses the puppet rubygems library to list local gems" do
+      it "uses the puppet_gem provider_command to list local gems" do
         expected = { name: 'world_airports', provider: :puppetserver_gem, ensure: ['1.1.3'] }
-        expect(described_class).to receive(:execute_rubygems_list_command).with(nil).and_return(File.read(my_fixture('gem-list-local-packages')))
+        expect(described_class).to receive(:execute_rubygems_list_command).with(['gem', 'list', '--local']).and_return(File.read(my_fixture('gem-list-local-packages')))
         expect(described_class.gemlist({ local: true })).to include(expected)
       end
     end

data/spec/unit/provider/package/windows/exe_package_spec.rb

@@ -1,5 +1,6 @@
 require 'spec_helper'
 require 'puppet/provider/package/windows/exe_package'
+require 'puppet/provider/package/windows'
 
 describe Puppet::Provider::Package::Windows::ExePackage do
   let (:name)        { 'Git version 1.7.11' }
@@ -71,10 +72,26 @@ describe Puppet::Provider::Package::Windows::ExePackage do
 
   context '#install_command' do
     it 'should install using the source' do
+      allow(Puppet::FileSystem).to receive(:exist?).with(source).and_return(true)
       cmd = described_class.install_command({:source => source})
 
       expect(cmd).to eq(source)
     end
+
+    it 'should raise error when URI is invalid' do
+      web_source = 'https://www.t e s t.test/test.exe'
+
+      expect do
+        described_class.install_command({:source => web_source, :name => name})
+      end.to raise_error(Puppet::Error, /Error when installing #{name}:/)
+    end
+
+    it 'should download package from source file before installing', if: Puppet::Util::Platform.windows? do
+      web_source = 'https://www.test.test/test.exe'
+      stub_request(:get, web_source).to_return(status: 200, body: 'package binaries')
+      cmd = described_class.install_command({:source => web_source})
+      expect(File.read(cmd)).to eq('package binaries')
+    end
   end
 
   context '#uninstall_command' do

data/spec/unit/provider/service/gentoo_spec.rb

@@ -10,8 +10,8 @@ describe 'Puppet::Type::Service::Provider::Gentoo',
 
   before :each do
     allow(Puppet::Type.type(:service)).to receive(:defaultprovider).and_return(provider_class)
-    allow(FileTest).to receive(:file?).with('/sbin/rc-update').and_return(true)
-    allow(FileTest).to receive(:executable?).with('/sbin/rc-update').and_return(true)
+    allow(Puppet::FileSystem).to receive(:file?).with('/sbin/rc-update').and_return(true)
+    allow(Puppet::FileSystem).to receive(:executable?).with('/sbin/rc-update').and_return(true)
     allow(Facter).to receive(:value).with(:operatingsystem).and_return('Gentoo')
     allow(Facter).to receive(:value).with(:osfamily).and_return('Gentoo')
 
@@ -52,13 +52,14 @@ describe 'Puppet::Type::Service::Provider::Gentoo',
     end
 
     it "should get a list of services from /etc/init.d but exclude helper scripts" do
-      expect(FileTest).to receive(:directory?).with('/etc/init.d').and_return(true)
+      allow(Puppet::FileSystem).to receive(:directory?).and_call_original
+      allow(Puppet::FileSystem).to receive(:directory?).with('/etc/init.d').and_return(true)
       expect(Dir).to receive(:entries).with('/etc/init.d').and_return(initscripts)
       (initscripts - helperscripts).each do |script|
-        expect(FileTest).to receive(:executable?).with("/etc/init.d/#{script}").and_return(true)
+        expect(Puppet::FileSystem).to receive(:executable?).with("/etc/init.d/#{script}").and_return(true)
       end
       helperscripts.each do |script|
-        expect(FileTest).not_to receive(:executable?).with("/etc/init.d/#{script}")
+        expect(Puppet::FileSystem).not_to receive(:executable?).with("/etc/init.d/#{script}")
       end
 
       allow(Puppet::FileSystem).to receive(:symlink?).and_return(false)

data/spec/unit/provider/service/init_spec.rb

@@ -85,14 +85,20 @@ describe 'Puppet::Type::Service::Provider::Init',
       @services = ['one', 'two', 'three', 'four', 'umountfs']
       allow(Dir).to receive(:entries).and_call_original
       allow(Dir).to receive(:entries).with('tmp').and_return(@services)
-      expect(FileTest).to receive(:directory?).with('tmp').and_return(true)
-      allow(FileTest).to receive(:executable?).and_return(true)
+      allow(Puppet::FileSystem).to receive(:directory?).and_call_original
+      allow(Puppet::FileSystem).to receive(:directory?).with('tmp').and_return(true)
+      allow(Puppet::FileSystem).to receive(:executable?).and_return(true)
     end
 
     it "should return instances for all services" do
       expect(provider_class.instances.map(&:name)).to eq(@services)
     end
 
+    it "should omit directories from the service list" do
+      expect(Puppet::FileSystem).to receive(:directory?).with('tmp/four').and_return(true)
+      expect(provider_class.instances.map(&:name)).to eq(@services - ['four'])
+    end
+
     it "should omit an array of services from exclude list" do
       exclude = ['two', 'four']
       expect(provider_class.get_services(provider_class.defpath, exclude).map(&:name)).to eq(@services - exclude)
@@ -140,9 +146,9 @@ describe 'Puppet::Type::Service::Provider::Init',
 
   describe "when checking valid paths" do
     it "should discard paths that do not exist" do
-      expect(File).to receive(:directory?).with(paths[0]).and_return(false)
+      expect(Puppet::FileSystem).to receive(:directory?).with(paths[0]).and_return(false)
       expect(Puppet::FileSystem).to receive(:exist?).with(paths[0]).and_return(false)
-      expect(File).to receive(:directory?).with(paths[1]).and_return(true)
+      expect(Puppet::FileSystem).to receive(:directory?).with(paths[1]).and_return(true)
 
       expect(provider.paths).to eq([paths[1]])
     end
@@ -150,7 +156,7 @@ describe 'Puppet::Type::Service::Provider::Init',
     it "should discard paths that are not directories" do
       paths.each do |path|
         expect(Puppet::FileSystem).to receive(:exist?).with(path).and_return(true)
-        expect(File).to receive(:directory?).with(path).and_return(false)
+        expect(Puppet::FileSystem).to receive(:directory?).with(path).and_return(false)
       end
       expect(provider.paths).to be_empty
     end
@@ -158,7 +164,7 @@ describe 'Puppet::Type::Service::Provider::Init',
 
   describe "when searching for the init script" do
     before :each do
-      paths.each {|path| expect(File).to receive(:directory?).with(path).and_return(true) }
+      paths.each {|path| expect(Puppet::FileSystem).to receive(:directory?).with(path).and_return(true) }
     end
 
     it "should be able to find the init script in the service path" do
@@ -191,9 +197,9 @@ describe 'Puppet::Type::Service::Provider::Init',
 
   describe "if the init script is present" do
     before :each do
-      allow(File).to receive(:directory?).and_call_original
-      allow(File).to receive(:directory?).with("/service/path").and_return(true)
-      allow(File).to receive(:directory?).with("/alt/service/path").and_return(true)
+      allow(Puppet::FileSystem).to receive(:directory?).and_call_original
+      allow(Puppet::FileSystem).to receive(:directory?).with("/service/path").and_return(true)
+      allow(Puppet::FileSystem).to receive(:directory?).with("/alt/service/path").and_return(true)
       allow(Puppet::FileSystem).to receive(:exist?).with("/service/path/myservice").and_return(true)
     end
 

data/spec/unit/provider/service/openwrt_spec.rb

@@ -2,63 +2,56 @@ require 'spec_helper'
 
 describe 'Puppet::Type::Service::Provider::Openwrt',
          unless: Puppet::Util::Platform.windows? || Puppet::Util::Platform.jruby? do
+
   let(:provider_class) { Puppet::Type.type(:service).provider(:openwrt) }
 
   let(:resource) do
-    resource = double('resource')
-    allow(resource).to receive(:[]).and_return(nil)
-    allow(resource).to receive(:[]).with(:name).and_return("myservice")
-    allow(resource).to receive(:[]).with(:path).and_return(["/etc/init.d"])
-
-    resource
+    Puppet::Type.type(:service).new(
+      :name       => 'myservice',
+      :path       => '/etc/init.d',
+      :hasrestart => true,
+    )
   end
 
   let(:provider) do
     provider = provider_class.new
-    allow(provider).to receive(:get).with(:hasstatus).and_return(false)
-
+    provider.resource = resource
     provider
   end
 
   before :each do
-    allow(resource).to receive(:provider).and_return(provider)
-    provider.resource = resource
-
-    allow(FileTest).to receive(:file?).with('/etc/rc.common').and_return(true)
-    allow(FileTest).to receive(:executable?).with('/etc/rc.common').and_return(true)
+    resource.provider = provider
 
     # All OpenWrt tests operate on the init script directly. It must exist.
-    allow(File).to receive(:directory?).and_call_original
-    allow(File).to receive(:directory?).with('/etc/init.d').and_return(true)
+    allow(Puppet::FileSystem).to receive(:directory?).and_call_original
+    allow(Puppet::FileSystem).to receive(:directory?).with('/etc/init.d').and_return(true)
 
     allow(Puppet::FileSystem).to receive(:exist?).with('/etc/init.d/myservice').and_return(true)
-    allow(FileTest).to receive(:file?).and_call_original
-    allow(FileTest).to receive(:file?).with('/etc/init.d/myservice').and_return(true)
-    allow(FileTest).to receive(:executable?).with('/etc/init.d/myservice').and_return(true)
+    allow(Puppet::FileSystem).to receive(:file?).and_call_original
+    allow(Puppet::FileSystem).to receive(:file?).with('/etc/init.d/myservice').and_return(true)
+    allow(Puppet::FileSystem).to receive(:executable?).with('/etc/init.d/myservice').and_return(true)
   end
 
-  operatingsystem = 'openwrt'
-  it "should be the default provider on #{operatingsystem}" do
-    expect(Facter).to receive(:value).with(:operatingsystem).and_return(operatingsystem)
+  it "should be the default provider on 'openwrt'" do
+    expect(Facter).to receive(:value).with(:operatingsystem).and_return('openwrt')
     expect(provider_class.default?).to be_truthy
   end
 
   # test self.instances
   describe "when getting all service instances" do
-    let(:services) {['dnsmasq', 'dropbear', 'firewall', 'led', 'puppet', 'uhttpd' ]}
+    let(:services) { ['dnsmasq', 'dropbear', 'firewall', 'led', 'puppet', 'uhttpd' ] }
 
     before :each do
       allow(Dir).to receive(:entries).and_call_original
       allow(Dir).to receive(:entries).with('/etc/init.d').and_return(services)
-      allow(FileTest).to receive(:directory?).and_return(true)
-      allow(FileTest).to receive(:executable?).and_return(true)
+      allow(Puppet::FileSystem).to receive(:executable?).and_return(true)
     end
 
     it "should return instances for all services" do
       services.each do |inst|
         expect(provider_class).to receive(:new).with(hash_including(:name => inst, :path => '/etc/init.d')).and_return("#{inst}_instance")
       end
-      results = services.collect {|x| "#{x}_instance"}
+      results = services.collect { |x| "#{x}_instance"}
       expect(provider_class.instances).to eq(results)
     end
   end
@@ -82,14 +75,13 @@ describe 'Puppet::Type::Service::Provider::Openwrt',
 
     describe "when running #{method}" do
       it "should use any provided explicit command" do
-        allow(resource).to receive(:[]).with(method).and_return("/user/specified/command")
-        expect(provider).to receive(:execute).with(["/user/specified/command"], any_args)
+        resource[method] = '/user/specified/command'
+        expect(provider).to receive(:execute).with(['/user/specified/command'], any_args)
         provider.send(method)
       end
 
       it "should execute the init script with #{method} when no explicit command is provided" do
-        allow(resource).to receive(:[]).with("has#{method}".intern).and_return(:true)
-        expect(provider).to receive(:execute).with(['/etc/init.d/myservice', method ], any_args)
+        expect(provider).to receive(:execute).with(['/etc/init.d/myservice', method], any_args)
         provider.send(method)
       end
     end

data/spec/unit/provider/service/redhat_spec.rb

@@ -50,8 +50,9 @@ describe 'Puppet::Type::Service::Provider::Redhat',
       @services = ['one', 'two', 'three', 'four', 'kudzu', 'functions', 'halt', 'killall', 'single', 'linuxconf', 'boot', 'reboot']
       @not_services = ['functions', 'halt', 'killall', 'single', 'linuxconf', 'reboot', 'boot']
       allow(Dir).to receive(:entries).and_return(@services)
-      allow(FileTest).to receive(:directory?).and_return(true)
-      allow(FileTest).to receive(:executable?).and_return(true)
+      allow(Puppet::FileSystem).to receive(:directory?).and_call_original
+      allow(Puppet::FileSystem).to receive(:directory?).with('/etc/init.d').and_return(true)
+      allow(Puppet::FileSystem).to receive(:executable?).and_return(true)
     end
 
     it "should return instances for all services" do

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -113,12 +113,21 @@ describe Puppet::SSL::SSLProvider do
       }.to raise_error(/can't modify frozen/)
     end
 
-    it 'trusts system ca store' do
+    it 'trusts system ca store by default' do
       expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
 
       subject.create_system_context(cacerts: [])
     end
 
+    it 'trusts an external ca store' do
+      path = tmpfile('system_cacerts')
+      File.write(path, cert_fixture('ca.pem').to_pem)
+
+      expect_any_instance_of(OpenSSL::X509::Store).to receive(:add_file).with(path)
+
+      subject.create_system_context(cacerts: [], path: path)
+    end
+
     it 'verifies peer' do
       sslctx = subject.create_system_context(cacerts: [])
       expect(sslctx.verify_peer).to eq(true)
@@ -135,6 +144,47 @@ describe Puppet::SSL::SSLProvider do
       expect(sslctx.private_key).to be_nil
     end
 
+    it 'includes the client cert and private key when requested' do
+      Puppet[:hostcert] = fixtures('ssl/signed.pem')
+      Puppet[:hostprivkey] = fixtures('ssl/signed-key.pem')
+      sslctx = subject.create_system_context(cacerts: [], include_client_cert: true)
+      expect(sslctx.client_cert).to be_an(OpenSSL::X509::Certificate)
+      expect(sslctx.private_key).to be_an(OpenSSL::PKey::RSA)
+    end
+
+    it 'ignores non-existent client cert and private key when requested' do
+      Puppet[:certname] = 'doesnotexist'
+      sslctx = subject.create_system_context(cacerts: [], include_client_cert: true)
+      expect(sslctx.client_cert).to be_nil
+      expect(sslctx.private_key).to be_nil
+    end
+
+    it 'warns if the client cert does not exist' do
+      Puppet[:certname] = 'missingcert'
+      Puppet[:hostprivkey] = fixtures('ssl/signed-key.pem')
+
+      expect(Puppet).to receive(:warning).with("Client certificate for 'missingcert' does not exist")
+      subject.create_system_context(cacerts: [], include_client_cert: true)
+    end
+
+    it 'warns if the private key does not exist' do
+      Puppet[:certname] = 'missingkey'
+      Puppet[:hostcert] = fixtures('ssl/signed.pem')
+
+      expect(Puppet).to receive(:warning).with("Private key for 'missingkey' does not exist")
+      subject.create_system_context(cacerts: [], include_client_cert: true)
+    end
+
+    it 'raises if client cert and private key are mismatched' do
+      Puppet[:hostcert] = fixtures('ssl/signed.pem')
+      Puppet[:hostprivkey] = fixtures('ssl/127.0.0.1-key.pem')
+
+      expect {
+        subject.create_system_context(cacerts: [], include_client_cert: true)
+      }.to raise_error(Puppet::SSL::SSLError,
+        "The certificate for 'CN=signed' does not match its private key")
+    end
+
     it 'trusts additional system certs' do
       path = tmpfile('system_cacerts')
       File.write(path, cert_fixture('ca.pem').to_pem)
@@ -448,6 +498,18 @@ describe Puppet::SSL::SSLProvider do
       sslctx = subject.create_context(**config)
       expect(sslctx.verify_peer).to eq(true)
     end
+
+    it 'does not trust the system ca store by default' do
+      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths).never
+
+      subject.create_context(**config)
+    end
+
+    it 'trusts the system ca store' do
+      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
+
+      subject.create_context(**config.merge(include_system_store: true))
+    end
   end
 
   context 'when loading an ssl context' do
@@ -528,6 +590,18 @@ describe Puppet::SSL::SSLProvider do
         subject.load_context(password: 'wrongpassword')
       }.to raise_error(Puppet::SSL::SSLError, /Failed to load private key for host 'signed': Could not parse PKey/)
     end
+
+    it 'does not trust the system ca store by default' do
+      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths).never
+
+      subject.load_context
+    end
+
+    it 'trusts the system ca store' do
+      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
+
+      subject.load_context(include_system_store: true)
+    end
   end
 
   context 'when verifying requests' do

data/spec/unit/ssl/state_machine_spec.rb

@@ -27,6 +27,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   let(:refused_message) { %r{Connection refused|No connection could be made because the target machine actively refused it} }
 
   before(:each) do
+    Puppet[:daemonize] = false
     Puppet[:ssl_lockfile] = tmpfile('ssllock')
     allow(Kernel).to receive(:sleep)
   end

data/spec/unit/transaction/persistence_spec.rb

@@ -138,6 +138,57 @@ describe Puppet::Transaction::Persistence do
         persistence = Puppet::Transaction::Persistence.new
         expect(persistence.load.dig("File[/tmp/audit]", "parameters", "mtime", "system_value")).to contain_exactly(be_a(Time))
       end
+
+      it 'should load Regexp' do
+        write_state_file(<<~END)
+          system_value:
+            - !ruby/regexp /regexp/
+        END
+
+        persistence = Puppet::Transaction::Persistence.new
+        expect(persistence.load.dig("system_value")).to contain_exactly(be_a(Regexp))
+      end
+
+      it 'should load semantic puppet version' do
+        write_state_file(<<~END)
+          system_value:
+            - !ruby/object:SemanticPuppet::Version
+              major: 1
+              minor: 0
+              patch: 0
+              prerelease: 
+              build: 
+        END
+
+        persistence = Puppet::Transaction::Persistence.new
+        expect(persistence.load.dig("system_value")).to contain_exactly(be_a(SemanticPuppet::Version))
+      end
+
+      it 'should load puppet time related objects' do
+        write_state_file(<<~END)
+          system_value:
+            - !ruby/object:Puppet::Pops::Time::Timestamp
+              nsecs: 1638316135955087259
+            - !ruby/object:Puppet::Pops::Time::TimeData
+              nsecs: 1495789430910161286
+            - !ruby/object:Puppet::Pops::Time::Timespan
+              nsecs: 1495789430910161286
+        END
+
+        persistence = Puppet::Transaction::Persistence.new
+        expect(persistence.load.dig("system_value")).to contain_exactly(be_a(Puppet::Pops::Time::Timestamp), be_a(Puppet::Pops::Time::TimeData), be_a(Puppet::Pops::Time::Timespan))
+      end
+
+      it 'should load binary objects' do
+        write_state_file(<<~END)
+          system_value:
+            - !ruby/object:Puppet::Pops::Types::PBinaryType::Binary
+              binary_buffer: ''
+        END
+
+        persistence = Puppet::Transaction::Persistence.new
+        expect(persistence.load.dig("system_value")).to contain_exactly(be_a(Puppet::Pops::Types::PBinaryType::Binary))
+      end
     end
   end