puppet 6.29.0 → 7.0.0

data/spec/unit/network/http/api_spec.rb

@@ -70,6 +70,16 @@ describe Puppet::Network::HTTP::API do
     end
 
     describe "when processing master routes" do
+      # simulate puppetserver registering its authconfigloader class
+      around :each do |example|
+        Puppet::Network::Authorization.authconfigloader_class = Object
+        begin
+          example.run
+        ensure
+          Puppet::Network::Authorization.authconfigloader_class = nil
+        end
+      end
+
       it "responds to v3 indirector requests" do
         req = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_prefix}/v3/node/foo",
                                                        :params => {:environment => "production"},

data/spec/unit/network/http/connection_spec.rb

@@ -1,6 +1,5 @@
 require 'spec_helper'
 require 'puppet/network/http/connection'
-require 'puppet/network/http/connection_adapter'
 require 'puppet/test_ca'
 
 describe Puppet::Network::HTTP::Connection do
@@ -10,21 +9,23 @@ describe Puppet::Network::HTTP::Connection do
   let(:url) { "https://#{host}:#{port}#{path}" }
   let(:params) { { 'key' => 'a value' } }
   let(:encoded_url_with_params) { "#{url}?%7B%22key%22:%22a%20value%22%7D" }
+  let(:ssl_context) { Puppet::SSL::SSLProvider.new.create_system_context(cacerts: []) }
+  let(:verifier) { Puppet::SSL::Verifier.new(host, ssl_context) }
 
-  shared_examples_for "an HTTP connection" do |klass, legacy_api|
-    subject { klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator) }
+  shared_examples_for "an HTTP connection" do |klass|
+    subject { klass.new(host, port, :verifier => verifier) }
 
     context "when providing HTTP connections" do
       context "when initializing http instances" do
         it "should return an http instance created with the passed host and port" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
           expect(conn.address).to eq(host)
           expect(conn.port).to eq(port)
         end
 
         it "should enable ssl on the http instance by default" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
           expect(conn).to be_use_ssl
         end
@@ -36,21 +37,21 @@ describe Puppet::Network::HTTP::Connection do
         end
 
         it "can enable ssl using an option" do
-          conn = klass.new(host, port, :use_ssl => true, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :use_ssl => true, :verifier => verifier)
 
           expect(conn).to be_use_ssl
         end
 
         it "ignores the ':verify' option when ssl is disabled" do
-          conn = klass.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :use_ssl => false, :verifier => verifier)
 
           expect(conn.verifier).to be_nil
         end
 
         it "wraps the validator in an adapter" do
-          conn = klass.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+          conn = klass.new(host, port, :verifier => verifier)
 
-          expect(conn.verifier).to be_a_kind_of(Puppet::SSL::VerifierAdapter)
+          expect(conn.verifier).to be_a(Puppet::SSL::Verifier)
         end
 
         it "should raise Puppet::Error when invalid options are specified" do
@@ -66,9 +67,9 @@ describe Puppet::Network::HTTP::Connection do
 
         it "raises if the wrong verifier class is specified" do
           expect {
-            klass.new(host, port, :verifier => Puppet::SSL::Validator.default_validator)
+            klass.new(host, port, :verifier => Object.new)
           }.to raise_error(ArgumentError,
-                           "Expected an instance of Puppet::SSL::Verifier but was passed a Puppet::SSL::Validator::DefaultValidator")
+                           "Expected an instance of Puppet::SSL::Verifier but was passed a Object")
         end
       end
     end
@@ -306,8 +307,6 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it 'defaults content-type to application/x-www-form-urlencoded' do
-        skip("Net::HTTP sends a default content-type header, but it's not visible to webmock") if legacy_api
-
         stub_request(:put, url).with(headers: {'Content-Type' => 'application/x-www-form-urlencoded'})
 
         subject.put(path, '')
@@ -362,8 +361,6 @@ describe Puppet::Network::HTTP::Connection do
       end
 
       it 'defaults content-type to application/x-www-form-urlencoded' do
-        skip("Net::HTTP sends a default content-type header, but it's not visible to webmock") if legacy_api
-
         stub_request(:post, url).with(headers: {'Content-Type' => 'application/x-www-form-urlencoded'})
 
         subject.post(path, "")
@@ -425,7 +422,7 @@ describe Puppet::Network::HTTP::Connection do
 
       def create_connection(options = {})
         options[:use_ssl] = false
-        options[:verify] = Puppet::SSL::Validator.no_validator
+        options[:verifier] = verifier
         subject.new(host, port, options)
       end
 
@@ -474,15 +471,9 @@ describe Puppet::Network::HTTP::Connection do
       it 'raises an exception when the location header is missing' do
         stub_request(:get, "http://me.example.com:8140/").to_return(status: 302)
 
-        if legacy_api
-          expect {
-            create_connection.get('/')
-          }.to raise_error(URI::InvalidURIError, /bad URI/)
-        else
-          expect {
+        expect {
             create_connection.get('/')
           }.to raise_error(Puppet::HTTP::ProtocolError, /Location response header is missing/)
-        end
       end
     end
 
@@ -503,14 +494,9 @@ describe Puppet::Network::HTTP::Connection do
       it "should return a 503 response if Retry-After is not convertible to an Integer or RFC 2822 Date" do
         retry_after('foo')
 
-        if legacy_api
-          result = subject.get('/foo')
-          expect(result.code).to eq("503")
-        else
-          expect {
-            subject.get('/foo')
-          }.to raise_error(Puppet::HTTP::ProtocolError, /Failed to parse Retry-After header 'foo'/)
-        end
+        expect {
+          subject.get('/foo')
+        }.to raise_error(Puppet::HTTP::ProtocolError, /Failed to parse Retry-After header 'foo'/)
       end
 
       it "should close the connection before sleeping" do
@@ -525,11 +511,7 @@ describe Puppet::Network::HTTP::Connection do
         allow(http1).to receive(:started?).and_return(true)
 
         # The "with_connection" method is required to yield started connections
-        pool = if legacy_api
-                 Puppet.lookup(:http_pool)
-               else
-                 Puppet.runtime[:http].pool
-               end
+        pool = Puppet.runtime[:http].pool
 
         allow(pool).to receive(:with_connection).and_yield(http1).and_yield(http2)
 
@@ -649,10 +631,6 @@ describe Puppet::Network::HTTP::Connection do
   end
 
   describe Puppet::Network::HTTP::Connection do
-    it_behaves_like "an HTTP connection", described_class, true
-  end
-
-  describe Puppet::Network::HTTP::ConnectionAdapter do
-    it_behaves_like "an HTTP connection", described_class, false
+    it_behaves_like "an HTTP connection", described_class
   end
 end

data/spec/unit/network/http/handler_spec.rb

@@ -2,7 +2,6 @@ require 'spec_helper'
 
 require 'puppet_spec/handler'
 require 'puppet/indirector_testing'
-require 'puppet/network/authorization'
 require 'puppet/network/http'
 
 describe Puppet::Network::HTTP::Handler do

data/spec/unit/network/http_pool_spec.rb

@@ -69,10 +69,6 @@ describe Puppet::Network::HttpPool do
       expect(Puppet::Network::HttpPool.http_instance("me", 54321, true)).to be_use_ssl
     end
 
-    it 'has an http_ssl_instance method' do
-      expect(Puppet::Network::HttpPool.http_ssl_instance("me", 54321)).to be_use_ssl
-    end
-
     context "when calling 'connection'" do
       it 'requires an ssl_context' do
         expect {

data/spec/unit/node/environment_spec.rb

@@ -526,34 +526,46 @@ describe Puppet::Node::Environment do
   end
 
   describe "managing module translations" do
-    it "creates a new text domain the first time we try to use the text domain" do
-      expect(Puppet::GettextConfig).to receive(:reset_text_domain).with(env.name)
-      expect(Puppet::ModuleTranslations).to receive(:load_from_modulepath)
-      expect(Puppet::GettextConfig).to receive(:clear_text_domain)
+    context "when i18n is enabled" do
+      before(:each) do
+        Puppet[:disable_i18n] = false
+      end
 
-      env.with_text_domain do; end
-    end
+      it "yields block results" do
+        ran = false
+        expect(env.with_text_domain { ran = true; :result }).to eq(:result)
+        expect(ran).to eq(true)
+      end
 
-    it "uses the existing text domain once it has been created" do
-      env.with_text_domain do; end
+      it "creates a new text domain the first time we try to use the text domain" do
+        expect(Puppet::GettextConfig).to receive(:reset_text_domain).with(env.name)
+        expect(Puppet::ModuleTranslations).to receive(:load_from_modulepath)
+        expect(Puppet::GettextConfig).to receive(:clear_text_domain)
 
-      expect(Puppet::GettextConfig).to receive(:use_text_domain).with(env.name)
-      env.with_text_domain do; end
-    end
+        env.with_text_domain do; end
+      end
 
-    it "yields block results" do
-      ran = false
-      expect(env.with_text_domain { ran = true; :result }).to eq(:result)
-      expect(ran).to eq(true)
+      it "uses the existing text domain once it has been created" do
+        env.with_text_domain do; end
+
+        expect(Puppet::GettextConfig).to receive(:use_text_domain).with(env.name)
+        env.with_text_domain do; end
+      end
     end
 
-    it "yields block results when i18n is disabled" do
-      Puppet[:disable_i18n] = true
+    context "when i18n is disabled" do
+      it "yields block results" do
+        ran = false
+        expect(env.with_text_domain { ran = true; :result }).to eq(:result)
+        expect(ran).to eq(true)
+      end
+
+      it "does not create a new text domain the first time we try to use the text domain" do
+        expect(Puppet::GettextConfig).not_to receive(:reset_text_domain)
+        expect(Puppet::ModuleTranslations).not_to receive(:load_from_modulepath)
 
-      ran = false
-      expect(env.with_text_domain { ran = true; :result }).to eq(:result)
-      expect(ran).to eq(true)
+        env.with_text_domain do; end
+      end
     end
   end
-
 end

data/spec/unit/node_spec.rb

@@ -40,12 +40,6 @@ describe Puppet::Node do
         expect(node.environment.name).to eq(:bar)
       end
 
-      it "sets environment_name with the correct environment name" do
-        node = Puppet::Node.new("foo")
-        node.environment = Puppet::Node::Environment.remote('www123')
-        expect(node.environment_name).to eq(:www123)
-      end
-
       it "allows its environment to be set by parameters after initialization" do
         node = Puppet::Node.new("foo")
         node.parameters["environment"] = :bar
@@ -423,64 +417,12 @@ end
 
 describe Puppet::Node, "when generating the list of names to search through" do
   before do
-    Puppet[:strict_hostname_checking] = false
     @node = Puppet::Node.new("foo.domain.com",
                              :parameters => {"hostname" => "yay", "domain" => "domain.com"})
   end
 
-  it "returns an array of names" do
+  it "returns an array of one name" do
     expect(@node.names).to be_instance_of(Array)
-  end
-
-  describe "and the node name is fully qualified" do
-    it "contains an entry for each part of the node name" do
-      expect(@node.names).to include("foo.domain.com")
-      expect(@node.names).to include("foo.domain")
-      expect(@node.names).to include("foo")
-    end
-  end
-
-  it "includes the node's fqdn" do
-    expect(@node.names).to include("yay.domain.com")
-  end
-
-  it "combines and include the node's hostname and domain if no fqdn is available" do
-    expect(@node.names).to include("yay.domain.com")
-  end
-
-  it "contains an entry for each name available by stripping a segment of the fqdn" do
-    @node.parameters["fqdn"] = "foo.deep.sub.domain.com"
-    expect(@node.names).to include("foo.deep.sub.domain")
-    expect(@node.names).to include("foo.deep.sub")
-  end
-
-  describe "and :node_name is set to 'cert'" do
-    before do
-      Puppet[:node_name] = "cert"
-    end
-
-    it "uses the passed-in key as the first value" do
-      expect(@node.names[0]).to eq("foo.domain.com")
-    end
-
-    describe "and strict hostname checking is enabled" do
-      before do
-        Puppet[:strict_hostname_checking] = true
-      end
-
-      it "only uses the passed-in key" do
-        expect(@node.names).to eq(["foo.domain.com"])
-      end
-    end
-  end
-
-  describe "and :node_name is set to 'facter'" do
-    before do
-      Puppet[:node_name] = "facter"
-    end
-
-    it "uses the node's 'hostname' fact as the first value" do
-      expect(@node.names[0]).to eq("yay")
-    end
+    expect(@node.names).to eq ["foo.domain.com"]
   end
 end

data/spec/unit/parser/compiler_spec.rb

@@ -240,9 +240,20 @@ describe Puppet::Parser::Compiler do
   end
 
   describe "when compiling" do
+    def compile_methods
+      [:set_node_parameters, :evaluate_main, :evaluate_ast_node, :evaluate_node_classes, :evaluate_generators, :fail_on_unevaluated,
+        :finish, :store, :extract, :evaluate_relationships]
+    end
+
+    # Stub all of the main compile methods except the ones we're specifically interested in.
+    def compile_stub(*except)
+      (compile_methods - except).each { |m| allow(@compiler).to receive(m) }
+    end
+
     it "should set node parameters as variables in the top scope" do
       params = {"a" => "b", "c" => "d"}
       allow(@node).to receive(:parameters).and_return(params)
+      compile_stub(:set_node_parameters)
       @compiler.compile
       expect(@compiler.topscope['a']).to eq("b")
       expect(@compiler.topscope['c']).to eq("d")
@@ -251,11 +262,13 @@ describe Puppet::Parser::Compiler do
     it "should set node parameters that are of Symbol type as String variables in the top scope" do
       params = {"a" => :b}
       allow(@node).to receive(:parameters).and_return(params)
+      compile_stub(:set_node_parameters)
       @compiler.compile
       expect(@compiler.topscope['a']).to eq("b")
     end
 
     it "should set the node's environment as a string variable in top scope" do
+      compile_stub(:set_node_parameters)
       @node.merge({'wat' => 'this is how the sausage is made'})
       @compiler.compile
       expect(@compiler.topscope['environment']).to eq("testing")
@@ -263,6 +276,7 @@ describe Puppet::Parser::Compiler do
     end
 
     it "sets the environment based on node.environment instead of the parameters" do
+      compile_stub(:set_node_parameters)
       @node.parameters['environment'] = "Not actually #{@node.environment.name}"
 
       @compiler.compile
@@ -272,21 +286,23 @@ describe Puppet::Parser::Compiler do
     it "should set the client and server versions on the catalog" do
       params = {"clientversion" => "2", "serverversion" => "3"}
       allow(@node).to receive(:parameters).and_return(params)
+      compile_stub(:set_node_parameters)
       @compiler.compile
       expect(@compiler.catalog.client_version).to eq("2")
       expect(@compiler.catalog.server_version).to eq("3")
     end
 
     it "should evaluate the main class if it exists" do
+      compile_stub(:evaluate_main)
       main_class = @known_resource_types.add Puppet::Resource::Type.new(:hostclass, "")
-      @compiler.topscope.source = main_class
-
       expect(main_class).to receive(:evaluate_code).with(be_a(Puppet::Parser::Resource))
+      expect(@compiler.topscope).to receive(:source=).with(main_class)
 
       @compiler.compile
     end
 
     it "should create a new, empty 'main' if no main class exists" do
+      compile_stub(:evaluate_main)
       @compiler.compile
       expect(@known_resource_types.find_hostclass("")).to be_instance_of(Puppet::Resource::Type)
     end
@@ -309,7 +325,7 @@ describe Puppet::Parser::Compiler do
       @compiler.add_collection(colls[0])
       @compiler.add_collection(colls[1])
 
-      allow(@compiler).to receive(:fail_on_unevaluated)
+      compile_stub(:evaluate_generators)
       @compiler.compile
     end
 

data/spec/unit/parser/functions/create_resources_spec.rb

@@ -257,31 +257,13 @@ describe 'function for dynamically creating resources' do
       expect(catalog.resource(:class, "bar")).not_to be_nil
     end
 
-    [:off, :warning].each do | strictness |
-      it "should warn if strict = #{strictness} and class is exported" do
-        Puppet[:strict] = strictness
-        collect_notices('class test{} create_resources("@@class", {test => {}})')
-        expect(warnings).to include(/Classes are not virtualizable/)
-      end
-    end
-
-    it 'should error if strict = error and class is exported' do
-      Puppet[:strict] = :error
+    it 'should error if class is exported' do
       expect{
         compile_to_catalog('class test{} create_resources("@@class", {test => {}})')
       }.to raise_error(/Classes are not virtualizable/)
     end
 
-    [:off, :warning].each do | strictness |
-      it "should warn if strict = #{strictness} and class is virtual" do
-        Puppet[:strict] = strictness
-        collect_notices('class test{} create_resources("@class", {test => {}})')
-        expect(warnings).to include(/Classes are not virtualizable/)
-      end
-    end
-
-    it 'should error if strict = error and class is virtual' do
-      Puppet[:strict] = :error
+    it 'should error if class is virtual' do
       expect{
         compile_to_catalog('class test{} create_resources("@class", {test => {}})')
       }.to raise_error(/Classes are not virtualizable/)

data/spec/unit/parser/functions/fqdn_rand_spec.rb

@@ -61,26 +61,12 @@ describe "the fqdn_rand function" do
     expect(fqdn_rand(5000, :extra_identifier => ['expensive job 33'])).to eql(2389)
   end
 
-  it "returns the same value if only host differs by case" do
-    val1 = fqdn_rand(1000000000, :host => "host.example.com", :extra_identifier => [nil, true])
-    val2 = fqdn_rand(1000000000, :host => "HOST.example.com", :extra_identifier => [nil, true])
-
-    expect(val1).to eql(val2)
-  end
-
-  it "returns the same value if only host differs by case and an initial seed is given" do
-    val1 = fqdn_rand(1000000000, :host => "host.example.com", :extra_identifier => ['a seed', true])
-    val2 = fqdn_rand(1000000000, :host => "HOST.example.com", :extra_identifier => ['a seed', true])
-
-    expect(val1).to eql(val2)
-  end
-
   def fqdn_rand(max, args = {})
     host = args[:host] || '127.0.0.1'
     extra = args[:extra_identifier] || []
 
     scope = create_test_scope_for_node('localhost')
-    scope.compiler.topscope['fqdn'] = host.freeze
+    allow(scope).to receive(:[]).with("::fqdn").and_return(host)
 
     scope.function_fqdn_rand([max] + extra)
   end

data/spec/unit/parser/resource_spec.rb

@@ -418,27 +418,22 @@ describe Puppet::Parser::Resource do
   end
 
   describe "when merging overrides" do
-    def resource_type(name)
-      double(name, :child_of? => false)
-    end
-
     before do
-      @source = resource_type("source1")
+      @source = "source1"
       @resource = mkresource :source => @source
       @override = mkresource :source => @source
     end
 
     it "should fail when the override was not created by a parent class" do
-      @override.source = resource_type("source2")
-      expect(@override.source).to receive(:child_of?).with(@source).and_return(false)
+      @override.source = "source2"
+      expect(@override.source).to receive(:child_of?).with("source1").and_return(false)
       expect { @resource.merge(@override) }.to raise_error(Puppet::ParseError)
     end
 
     it "should succeed when the override was created in the current scope" do
-      @source3 = resource_type("source3")
-      @resource.source = @source3
+      @resource.source = "source3"
       @override.source = @resource.source
-      expect(@override.source).not_to receive(:child_of?).with(@source3)
+      expect(@override.source).not_to receive(:child_of?).with("source3")
       params = {:a => :b, :c => :d}
       expect(@override).to receive(:parameters).and_return(params)
       expect(@resource).to receive(:override_parameter).with(:b)
@@ -447,10 +442,9 @@ describe Puppet::Parser::Resource do
     end
 
     it "should succeed when a parent class created the override" do
-      @source3 = resource_type("source3")
-      @resource.source = @source3
-      @override.source = resource_type("source4")
-      expect(@override.source).to receive(:child_of?).with(@source3).and_return(true)
+      @resource.source = "source3"
+      @override.source = "source4"
+      expect(@override.source).to receive(:child_of?).with("source3").and_return(true)
       params = {:a => :b, :c => :d}
       expect(@override).to receive(:parameters).and_return(params)
       expect(@resource).to receive(:override_parameter).with(:b)

data/spec/unit/parser/templatewrapper_spec.rb

@@ -2,8 +2,6 @@ require 'spec_helper'
 require 'puppet/parser/templatewrapper'
 
 describe Puppet::Parser::TemplateWrapper do
-  include PuppetSpec::Files
-
   let(:known_resource_types) { Puppet::Resource::TypeCollection.new("env") }
   let(:scope) do
     compiler = Puppet::Parser::Compiler.new(Puppet::Node.new("mynode"))
@@ -43,13 +41,6 @@ describe Puppet::Parser::TemplateWrapper do
     expect(tw.result).to eq(full_file_name)
   end
 
-  it "ignores a leading BOM" do
-    full_file_name = given_a_template_file("bom_template", "\uFEFF<%= file %>")
-
-    tw.file = "bom_template"
-    expect(tw.result).to eq(full_file_name)
-  end
-
   it "evaluates a given string as a template" do
     expect(tw.result("template contents")).to eql("template contents")
   end
@@ -66,10 +57,9 @@ describe Puppet::Parser::TemplateWrapper do
     expect(tw.all_tags).to eq(["tag1","tag2"])
   end
 
-  it "raises not implemented error" do
-    expect {
-      tw.tags
-    }.to raise_error(NotImplementedError, /Call 'all_tags' instead/)
+  it "provides the tags defined in the current scope with #tags" do
+    expect(scope).to receive(:tags).and_return(["tag1", "tag2"])
+    expect(tw.tags).to eq(["tag1","tag2"])
   end
 
   it "raises error on access to removed in-scope variables via method calls" do
@@ -99,12 +89,11 @@ describe Puppet::Parser::TemplateWrapper do
   end
 
   def given_a_template_file(name, contents)
-    full_name = tmpfile("template_#{name}")
-    File.binwrite(full_name, contents)
-
+    full_name = "/full/path/to/#{name}"
     allow(Puppet::Parser::Files).to receive(:find_template).
       with(name, anything()).
       and_return(full_name)
+    allow(Puppet::FileSystem).to receive(:read_preserve_line_endings).with(full_name).and_return(contents)
 
     full_name
   end

data/spec/unit/pops/evaluator/evaluating_parser_spec.rb

@@ -818,14 +818,11 @@ describe 'Puppet::Pops::Evaluator::EvaluatorImpl' do
       end
     end
 
-    # Integer for >= 2.4.0, otherwise Fixnum
-    int_class_name = 0.class.name
-
     # Errors when wrong number/type of keys are used
     {
-      "Array[0]"                    => "Array-Type[] arguments must be types. Got #{int_class_name}",
-      "Hash[0]"                     => "Hash-Type[] arguments must be types. Got #{int_class_name}",
-      "Hash[Integer, 0]"            => "Hash-Type[] arguments must be types. Got #{int_class_name}",
+      "Array[0]"                    => "Array-Type[] arguments must be types. Got Integer",
+      "Hash[0]"                     => "Hash-Type[] arguments must be types. Got Integer",
+      "Hash[Integer, 0]"            => "Hash-Type[] arguments must be types. Got Integer",
       "Array[Integer,1,2,3]"        => 'Array-Type[] accepts 1 to 3 arguments. Got 4',
       "Array[Integer,String]"       => "A Type's size constraint arguments must be a single Integer type, or 1-2 integers (or default). Got a String-Type",
       "Hash[Integer,String, 1,2,3]" => 'Hash-Type[] accepts 2 to 4 arguments. Got 5',
@@ -833,7 +830,7 @@ describe 'Puppet::Pops::Evaluator::EvaluatorImpl' do
       "'abc'[1.0]"                  => "A substring operation does not accept a Float as a character index. Expected an Integer",
       "'abc'[1, x]"                 => "A substring operation does not accept a String as a character index. Expected an Integer",
       "'abc'[1,2,3]"                => "String supports [] with one or two arguments. Got 3",
-      "NotUndef[0]"                 => "NotUndef-Type[] argument must be a Type or a String. Got #{int_class_name}",
+      "NotUndef[0]"                 => "NotUndef-Type[] argument must be a Type or a String. Got Integer",
       "NotUndef[a,b]"               => 'NotUndef-Type[] accepts 0 to 1 arguments. Got 2',
       "Resource[0]"                 => 'First argument to Resource[] must be a resource type or a String. Got Integer',
       "Resource[a, 0]"              => 'Error creating type specialization of a Resource-Type, Cannot use Integer where a resource title String is expected',

data/spec/unit/pops/loaders/loaders_spec.rb

@@ -575,27 +575,6 @@ describe 'loaders' do
     end
   end
 
-context 'when a 3x load has illegal construct and --func3x_check is false' do
-  let(:env) { environment_for(mix_4x_and_3x_functions) }
-  let(:compiler) { Puppet::Parser::Compiler.new(Puppet::Node.new("test", :environment => env)) }
-  let(:scope) { compiler.topscope }
-  let(:loader) { compiler.loaders.private_loader_for_module('user') }
-
-  before(:each) do
-    Puppet.push_context(:current_environment => scope.environment, :global_scope => scope, :loaders => compiler.loaders)
-    Puppet[:func3x_check] = false
-  end
-  after(:each) do
-    Puppet.pop_context
-    Puppet[:func3x_check] = true
-  end
-
-  it "an illegal function is loaded" do
-      f = loader.load_typed(typed_name(:function, 'bad_func_load3')).value
-      expect(f.call(scope)).to eql("some return value")
-  end
-end
-
   context 'when causing a 3x load followed by a 4x load' do
     let(:env) { environment_for(mix_4x_and_3x_functions) }
     let(:compiler) { Puppet::Parser::Compiler.new(Puppet::Node.new("test", :environment => env)) }
@@ -623,6 +602,12 @@ end
       function = loader.load_typed(typed_name(:function, 'callee_ws')).value
       expect(function.call(scope, 'passed in scope')).to eql("usee::callee_ws() got 'value'")
     end
+
+    it "an illegal function is loaded" do
+      expect {
+        loader.load_typed(typed_name(:function, 'bad_func_load3')).value
+      }.to raise_error(SecurityError, /Illegal method definition of method 'bad_func_load3_illegal_method' on line 8 in legacy function/)
+    end
   end
 
   context 'loading' do