puppet 6.29.0 → 7.0.0

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -113,21 +113,12 @@ describe Puppet::SSL::SSLProvider do
       }.to raise_error(/can't modify frozen/)
     end
 
-    it 'trusts system ca store by default' do
+    it 'trusts system ca store' do
       expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
 
       subject.create_system_context(cacerts: [])
     end
 
-    it 'trusts an external ca store' do
-      path = tmpfile('system_cacerts')
-      File.write(path, cert_fixture('ca.pem').to_pem)
-
-      expect_any_instance_of(OpenSSL::X509::Store).to receive(:add_file).with(path)
-
-      subject.create_system_context(cacerts: [], path: path)
-    end
-
     it 'verifies peer' do
       sslctx = subject.create_system_context(cacerts: [])
       expect(sslctx.verify_peer).to eq(true)
@@ -144,47 +135,6 @@ describe Puppet::SSL::SSLProvider do
       expect(sslctx.private_key).to be_nil
     end
 
-    it 'includes the client cert and private key when requested' do
-      Puppet[:hostcert] = fixtures('ssl/signed.pem')
-      Puppet[:hostprivkey] = fixtures('ssl/signed-key.pem')
-      sslctx = subject.create_system_context(cacerts: [], include_client_cert: true)
-      expect(sslctx.client_cert).to be_an(OpenSSL::X509::Certificate)
-      expect(sslctx.private_key).to be_an(OpenSSL::PKey::RSA)
-    end
-
-    it 'ignores non-existent client cert and private key when requested' do
-      Puppet[:certname] = 'doesnotexist'
-      sslctx = subject.create_system_context(cacerts: [], include_client_cert: true)
-      expect(sslctx.client_cert).to be_nil
-      expect(sslctx.private_key).to be_nil
-    end
-
-    it 'warns if the client cert does not exist' do
-      Puppet[:certname] = 'missingcert'
-      Puppet[:hostprivkey] = fixtures('ssl/signed-key.pem')
-
-      expect(Puppet).to receive(:warning).with("Client certificate for 'missingcert' does not exist")
-      subject.create_system_context(cacerts: [], include_client_cert: true)
-    end
-
-    it 'warns if the private key does not exist' do
-      Puppet[:certname] = 'missingkey'
-      Puppet[:hostcert] = fixtures('ssl/signed.pem')
-
-      expect(Puppet).to receive(:warning).with("Private key for 'missingkey' does not exist")
-      subject.create_system_context(cacerts: [], include_client_cert: true)
-    end
-
-    it 'raises if client cert and private key are mismatched' do
-      Puppet[:hostcert] = fixtures('ssl/signed.pem')
-      Puppet[:hostprivkey] = fixtures('ssl/127.0.0.1-key.pem')
-
-      expect {
-        subject.create_system_context(cacerts: [], include_client_cert: true)
-      }.to raise_error(Puppet::SSL::SSLError,
-        "The certificate for 'CN=signed' does not match its private key")
-    end
-
     it 'trusts additional system certs' do
       path = tmpfile('system_cacerts')
       File.write(path, cert_fixture('ca.pem').to_pem)
@@ -321,11 +271,8 @@ describe Puppet::SSL::SSLProvider do
     end
 
     # This option is only available in openssl 1.1
-    # OpenSSL 1.1.1h no longer reports expired root CAs when using "verify".
-    # This regression was fixed in 1.1.1i, so only skip this test if we're on
-    # the affected version.
-    # See: https://github.com/openssl/openssl/pull/13585
-    if Puppet::Util::Package.versioncmp(OpenSSL::OPENSSL_LIBRARY_VERSION.split[1], '1.1.1h') != 0
+    # TODO PUP-10689 behavior changed in openssl 1.1.1h
+    if Puppet::Util::Package.versioncmp(OpenSSL::OPENSSL_LIBRARY_VERSION.split[1], '1.1.1h') < 0
       it 'raises if root cert signature is invalid', if: defined?(OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE) do
         ca = global_cacerts.first
         ca.sign(wrong_key, OpenSSL::Digest::SHA256.new)
@@ -498,18 +445,6 @@ describe Puppet::SSL::SSLProvider do
       sslctx = subject.create_context(**config)
       expect(sslctx.verify_peer).to eq(true)
     end
-
-    it 'does not trust the system ca store by default' do
-      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths).never
-
-      subject.create_context(**config)
-    end
-
-    it 'trusts the system ca store' do
-      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
-
-      subject.create_context(**config.merge(include_system_store: true))
-    end
   end
 
   context 'when loading an ssl context' do
@@ -590,18 +525,6 @@ describe Puppet::SSL::SSLProvider do
         subject.load_context(password: 'wrongpassword')
       }.to raise_error(Puppet::SSL::SSLError, /Failed to load private key for host 'signed': Could not parse PKey/)
     end
-
-    it 'does not trust the system ca store by default' do
-      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths).never
-
-      subject.load_context
-    end
-
-    it 'trusts the system ca store' do
-      expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
-
-      subject.load_context(include_system_store: true)
-    end
   end
 
   context 'when verifying requests' do

data/spec/unit/ssl/state_machine_spec.rb

@@ -27,19 +27,10 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   let(:refused_message) { %r{Connection refused|No connection could be made because the target machine actively refused it} }
 
   before(:each) do
-    Puppet[:daemonize] = false
     Puppet[:ssl_lockfile] = tmpfile('ssllock')
     allow(Kernel).to receive(:sleep)
   end
 
-  def expected_digest(name, content)
-    OpenSSL::Digest.new(name).hexdigest(content)
-  end
-
-  def to_fingerprint(digest)
-    digest.scan(/../).join(':').upcase
-  end
-
   context 'when passing keyword arguments' do
     it "accepts digest" do
       expect(described_class.new(digest: 'SHA512').digest).to eq('SHA512')
@@ -404,35 +395,29 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
       it 'verifies CA cert bundle if a ca_fingerprint is given case-insensitively' do
         Puppet[:log_level] = :info
-
-        digest = expected_digest('SHA256', cacert_pem)
-        fingerprint = to_fingerprint(digest)
-        machine = described_class.new(digest: 'SHA256', ca_fingerprint: digest.downcase)
+        machine = described_class.new(digest: 'SHA256', ca_fingerprint: 'caacf69bbbcdad9dbcda92dd2da3608b639d1aea4c314d6cc6823cdb32d8e0f8')
         state = Puppet::SSL::StateMachine::NeedCACerts.new(machine)
         state.next_state
 
-        expect(@logs).to include(an_object_having_attributes(message: "Verified CA bundle with digest (SHA256) #{fingerprint}"))
+        expect(@logs).to include(an_object_having_attributes(message: "Verified CA bundle with digest (SHA256) CA:AC:F6:9B:BB:CD:AD:9D:BC:DA:92:DD:2D:A3:60:8B:63:9D:1A:EA:4C:31:4D:6C:C6:82:3C:DB:32:D8:E0:F8"))
       end
 
       it 'verifies CA cert bundle using non-default fingerprint' do
         Puppet[:log_level] = :info
-
-        digest = expected_digest('SHA512', cacert_pem)
-        machine = described_class.new(digest: 'SHA512', ca_fingerprint: digest)
+        machine = described_class.new(digest: 'SHA512', ca_fingerprint: '3c9d1482b878913ad95c9631feac5090cb05c6eab9496178d6fd5c14a023da3b1a8650a3cbaac516d9a48caf0b0742e1ed7eebf55105c024c74834a45056a9d9')
         state = Puppet::SSL::StateMachine::NeedCACerts.new(machine)
         state.next_state
 
-        expect(@logs).to include(an_object_having_attributes(message: "Verified CA bundle with digest (SHA512) #{to_fingerprint(digest)}"))
+        expect(@logs).to include(an_object_having_attributes(message: "Verified CA bundle with digest (SHA512) 3C:9D:14:82:B8:78:91:3A:D9:5C:96:31:FE:AC:50:90:CB:05:C6:EA:B9:49:61:78:D6:FD:5C:14:A0:23:DA:3B:1A:86:50:A3:CB:AA:C5:16:D9:A4:8C:AF:0B:07:42:E1:ED:7E:EB:F5:51:05:C0:24:C7:48:34:A4:50:56:A9:D9"))
       end
 
       it 'returns an error if verification fails' do
         machine = described_class.new(digest: 'SHA256', ca_fingerprint: 'wrong!')
         state = Puppet::SSL::StateMachine::NeedCACerts.new(machine)
 
-        fingerprint = to_fingerprint(expected_digest('SHA256', cacert_pem))
         st = state.next_state
         expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-        expect(st.message).to eq("CA bundle with digest (SHA256) #{fingerprint} did not match expected digest WR:ON:G!")
+        expect(st.message).to eq("CA bundle with digest (SHA256) CA:AC:F6:9B:BB:CD:AD:9D:BC:DA:92:DD:2D:A3:60:8B:63:9D:1A:EA:4C:31:4D:6C:C6:82:3C:DB:32:D8:E0:F8 did not match expected digest WR:ON:G!")
       end
     end
   end
@@ -520,7 +505,6 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       Puppet[:certificate_revocation] = false
 
       expect(cert_provider).not_to receive(:load_crls)
-      expect(Puppet::Rest::Routes).not_to receive(:get_crls)
 
       state.next_state
 

data/spec/unit/ssl/verifier_spec.rb

@@ -6,7 +6,6 @@ describe Puppet::SSL::Verifier do
   let(:host) { 'example.com' }
   let(:http) { Net::HTTP.new(host) }
   let(:verifier) { described_class.new(host, ssl_context) }
-  let(:adapter) { Puppet::SSL::VerifierAdapter.new(Puppet::SSL::Validator::DefaultValidator.new) }
 
   context '#reusable?' do
     it 'Verifiers with the same ssl_context are reusable' do
@@ -16,26 +15,6 @@ describe Puppet::SSL::Verifier do
     it 'Verifiers with different ssl_contexts are not reusable' do
       expect(verifier).to_not be_reusable(described_class.new(host, Puppet::SSL::SSLContext.new))
     end
-
-    it 'Verifier is not reusable with VerifierAdapter' do
-      expect(verifier).to_not be_reusable(adapter)
-    end
-
-    it 'VerifierAdapter is not reusable with Verifier' do
-      expect(adapter).to_not be_reusable(verifier)
-    end
-
-    it 'VerifierAdapters with the same class of Validator are reusable' do
-      expect(
-        adapter
-      ).to be_reusable(Puppet::SSL::VerifierAdapter.new(Puppet::SSL::Validator::DefaultValidator.new))
-    end
-
-    it 'VerifierAdapters with different classes of Validators are not reusable' do
-      expect(
-        adapter
-      ).to_not be_reusable(Puppet::SSL::VerifierAdapter.new(Puppet::SSL::Validator::NoValidator.new))
-    end
   end
 
   context '#setup_connection' do

data/spec/unit/transaction/additional_resource_generator_spec.rb

@@ -33,6 +33,10 @@ describe Puppet::Transaction::AdditionalResourceGenerator do
 
       newparam(:code)
 
+      def respond_to?(method_name)
+        method_name == self[:kind] || super
+      end
+
       def eval_generate
         eval_code
       end
@@ -93,6 +97,8 @@ describe Puppet::Transaction::AdditionalResourceGenerator do
     end
   end
 
+
+
   after(:each) do
     Puppet::Type.rmtype(:gen_empty)
     Puppet::Type.rmtype(:eval_after)
@@ -308,13 +314,13 @@ describe Puppet::Transaction::AdditionalResourceGenerator do
 
     it "sets resources_failed_to_generate to true if resource#eval_generate raises an exception" do
       catalog = compile_to_ral(<<-MANIFEST)
-        generator { thing: }
+        notify { 'hello': }
       MANIFEST
 
-      allow(catalog.resource("Generator[thing]")).to receive(:eval_generate).and_raise(RuntimeError)
+      allow(catalog.resource("Notify[hello]")).to receive(:eval_generate).and_raise(RuntimeError)
       relationship_graph = relationship_graph_for(catalog)
       generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, relationship_graph, prioritizer)
-      generator.eval_generate(catalog.resource("Generator[thing]"))
+      generator.eval_generate(catalog.resource("Notify[hello]"))
 
       expect(generator.resources_failed_to_generate).to be_truthy
     end

data/spec/unit/transaction/event_manager_spec.rb

@@ -152,9 +152,6 @@ describe Puppet::Transaction::EventManager do
 
       @resource = Puppet::Type.type(:file).new :path => make_absolute("/my/file")
       @event = Puppet::Transaction::Event.new(:name => :event, :resource => @resource)
-
-      @resource.class.send(:define_method, :callback1) {}
-      @resource.class.send(:define_method, :callback2) {}
     end
 
     it "should call the required callback once for each set of associated events" do
@@ -181,7 +178,7 @@ describe Puppet::Transaction::EventManager do
 
       allow(@resource).to receive(:callback1)
 
-      @manager.process_events(@resource)
+      @manager.process_events(@resource) #x
 
       expect(@transaction.resource_status(@resource).events.length).to eq(1)
     end
@@ -214,11 +211,9 @@ describe Puppet::Transaction::EventManager do
         @event2 = Puppet::Transaction::Event.new(:name => :event, :resource => @resource)
         @event2.status = "success"
         expect(@manager).to receive(:queued_events).with(@resource).and_yield(:callback1, [@event, @event2])
-        @resource.class.send(:define_method, :callback1) {}
       end
 
       it "should call the callback" do
-
         expect(@resource).to receive(:callback1)
 
         @manager.process_events(@resource)
@@ -230,7 +225,6 @@ describe Puppet::Transaction::EventManager do
         allow(@event).to receive(:status).and_return("noop")
         allow(@resource).to receive(:event).and_return(Puppet::Transaction::Event.new)
         expect(@manager).to receive(:queued_events).with(@resource).and_yield(:callback1, [@event])
-        @resource.class.send(:define_method, :callback1) {}
       end
 
       it "should log" do
@@ -260,7 +254,6 @@ describe Puppet::Transaction::EventManager do
         allow(@resource).to receive(:event).and_return(Puppet::Transaction::Event.new)
         allow(@resource).to receive(:noop?).and_return(true)
         expect(@manager).to receive(:queued_events).with(@resource).and_yield(:callback1, [@event])
-        @resource.class.send(:define_method, :callback1) {}
       end
 
       it "should log" do
@@ -286,7 +279,7 @@ describe Puppet::Transaction::EventManager do
 
     describe "and the callback fails" do
       before do
-        @resource.class.send(:define_method, :callback1) { raise "a failure" }
+        expect(@resource).to receive(:callback1).and_raise("a failure")
 
         expect(@manager).to receive(:queued_events).and_yield(:callback1, [@event])
       end
@@ -330,12 +323,16 @@ describe Puppet::Transaction::EventManager do
 
   describe "when queueing then processing events for a given resource" do
     before do
-      @catalog = Puppet::Resource::Catalog.new
-      @target = Puppet::Type.type(:exec).new(name: 'target', path: ENV['PATH'])
-      @resource = Puppet::Type.type(:exec).new(name: 'resource', path: ENV['PATH'], notify: @target)
-      @catalog.add_resource(@resource, @target)
+      @transaction = Puppet::Transaction.new(Puppet::Resource::Catalog.new, nil, nil)
+      @manager = Puppet::Transaction::EventManager.new(@transaction)
 
-      @manager = Puppet::Transaction::EventManager.new(Puppet::Transaction.new(@catalog, nil, nil))
+      @resource = Puppet::Type.type(:file).new :path => make_absolute("/my/file")
+      @target = Puppet::Type.type(:file).new :path => make_absolute("/your/file")
+
+      @graph = allow('graph')
+      allow(@graph).to receive(:matching_edges).and_return([])
+      allow(@graph).to receive(:matching_edges).with(anything, @resource).and_return([double('edge', :target => @target, :callback => :refresh)])
+      allow(@manager).to receive(:relationship_graph).and_return(@graph)
 
       @event  = Puppet::Transaction::Event.new(:name => :notify, :resource => @target)
       @event2 = Puppet::Transaction::Event.new(:name => :service_start, :resource => @target, :invalidate_refreshes => true)

data/spec/unit/transaction/persistence_spec.rb

@@ -138,57 +138,6 @@ describe Puppet::Transaction::Persistence do
         persistence = Puppet::Transaction::Persistence.new
         expect(persistence.load.dig("File[/tmp/audit]", "parameters", "mtime", "system_value")).to contain_exactly(be_a(Time))
       end
-
-      it 'should load Regexp' do
-        write_state_file(<<~END)
-          system_value:
-            - !ruby/regexp /regexp/
-        END
-
-        persistence = Puppet::Transaction::Persistence.new
-        expect(persistence.load.dig("system_value")).to contain_exactly(be_a(Regexp))
-      end
-
-      it 'should load semantic puppet version' do
-        write_state_file(<<~END)
-          system_value:
-            - !ruby/object:SemanticPuppet::Version
-              major: 1
-              minor: 0
-              patch: 0
-              prerelease: 
-              build: 
-        END
-
-        persistence = Puppet::Transaction::Persistence.new
-        expect(persistence.load.dig("system_value")).to contain_exactly(be_a(SemanticPuppet::Version))
-      end
-
-      it 'should load puppet time related objects' do
-        write_state_file(<<~END)
-          system_value:
-            - !ruby/object:Puppet::Pops::Time::Timestamp
-              nsecs: 1638316135955087259
-            - !ruby/object:Puppet::Pops::Time::TimeData
-              nsecs: 1495789430910161286
-            - !ruby/object:Puppet::Pops::Time::Timespan
-              nsecs: 1495789430910161286
-        END
-
-        persistence = Puppet::Transaction::Persistence.new
-        expect(persistence.load.dig("system_value")).to contain_exactly(be_a(Puppet::Pops::Time::Timestamp), be_a(Puppet::Pops::Time::TimeData), be_a(Puppet::Pops::Time::Timespan))
-      end
-
-      it 'should load binary objects' do
-        write_state_file(<<~END)
-          system_value:
-            - !ruby/object:Puppet::Pops::Types::PBinaryType::Binary
-              binary_buffer: ''
-        END
-
-        persistence = Puppet::Transaction::Persistence.new
-        expect(persistence.load.dig("system_value")).to contain_exactly(be_a(Puppet::Pops::Types::PBinaryType::Binary))
-      end
     end
   end
 

data/spec/unit/transaction/report_spec.rb

@@ -675,7 +675,6 @@ Version:
     report.code_id = "some code id"
     report.catalog_uuid = "some catalog uuid"
     report.cached_catalog_status = "not_used"
-    report.master_used = "test:000"
     report.server_used = "test:000"
     report.add_resource_status(status)
     report.transaction_completed = true
@@ -694,7 +693,6 @@ Version:
     report.code_id = "some code id"
     report.catalog_uuid = "some catalog uuid"
     report.cached_catalog_status = "not_used"
-    report.master_used = "test:000"
     report.server_used = "test:000"
     report.add_resource_status(status)
     report.transaction_completed = true

data/spec/unit/transaction/resource_harness_spec.rb

@@ -612,14 +612,14 @@ describe Puppet::Transaction::ResourceHarness do
       allow_any_instance_of(Puppet::Transaction::Event).to receive(:corrective_change).and_return(true)
       status = @harness.evaluate(resource)
       sync_event = status.events[0]
-      expect(sync_event.message).to match(/content changed '{md5}[0-9a-f]+' to '{md5}[0-9a-f]+' \(corrective\)/)
+      expect(sync_event.message).to match(/content changed '{sha256}[0-9a-f]+' to '{sha256}[0-9a-f]+' \(corrective\)/)
     end
 
     it "contains no modifier when intentional change" do
       allow_any_instance_of(Puppet::Transaction::Event).to receive(:corrective_change).and_return(false)
       status = @harness.evaluate(resource)
       sync_event = status.events[0]
-      expect(sync_event.message).to match(/content changed '{md5}[0-9a-f]+' to '{md5}[0-9a-f]+'$/)
+      expect(sync_event.message).to match(/content changed '{sha256}[0-9a-f]+' to '{sha256}[0-9a-f]+'$/)
     end
   end
 end

data/spec/unit/transaction_spec.rb

@@ -20,19 +20,6 @@ describe Puppet::Transaction do
     transaction
   end
 
-  before(:all) do
-    Puppet::Type.newtype(:transaction_generator) do
-      newparam(:name) { isnamevar }
-
-      def generate
-      end
-    end
-  end
-
-  after(:all) do
-    Puppet::Type.rmtype(:transaction_generator)
-  end
-
   before do
     @basepath = make_absolute("/what/ever")
     @transaction = Puppet::Transaction.new(Puppet::Resource::Catalog.new, nil, Puppet::Graph::SequentialPrioritizer.new)
@@ -336,9 +323,9 @@ describe Puppet::Transaction do
   describe "when generating resources before traversal" do
     let(:catalog) { Puppet::Resource::Catalog.new }
     let(:transaction) { Puppet::Transaction.new(catalog, nil, Puppet::Graph::SequentialPrioritizer.new) }
-    let(:generator) { Puppet::Type.type(:transaction_generator).new :title => "generator" }
+    let(:generator) { Puppet::Type.type(:notify).new :title => "generator" }
     let(:generated) do
-      %w[a b c].map { |name| Puppet::Type.type(:transaction_generator).new(:name => name) }
+      %w[a b c].map { |name| Puppet::Type.type(:notify).new(:name => name) }
     end
 
     before :each do
@@ -611,115 +598,81 @@ describe Puppet::Transaction do
       transaction.prefetch_if_necessary(resource)
     end
 
-    it "should not rescue SystemExit without future_features flag" do
-      Puppet.settings[:future_features] = false
-      expect(resource.provider.class).to receive(:prefetch).and_raise(SystemExit, "SystemMessage")
-      expect { transaction.prefetch_if_necessary(resource) }.to raise_error(SystemExit, "SystemMessage")
-    end
-
-    it "should not rescue SystemExit with future_features flag" do
-      Puppet.settings[:future_features] = true
+    it "should not rescue SystemExit" do
       expect(resource.provider.class).to receive(:prefetch).and_raise(SystemExit, "SystemMessage")
       expect { transaction.prefetch_if_necessary(resource) }.to raise_error(SystemExit, "SystemMessage")
     end
 
-    it "should rescue LoadError without future_features flag" do
-      Puppet.settings[:future_features] = false
-      expect(resource.provider.class).to receive(:prefetch).and_raise(LoadError, "LoadMessage")
-      expect { transaction.prefetch_if_necessary(resource) }.not_to raise_error
-    end
-
-    it "should rescue LoadError with future_features flag" do
-      Puppet.settings[:future_features] = true
+    it "should mark resources as failed when prefetching raises LoadError" do
       expect(resource.provider.class).to receive(:prefetch).and_raise(LoadError, "LoadMessage")
-      expect { transaction.prefetch_if_necessary(resource) }.not_to raise_error
+      transaction.prefetch_if_necessary(resource)
+      expect(transaction.prefetched_providers[:package][:pkgng]).to be_truthy
     end
 
-    describe "and prefetching fails" do
+    describe "and prefetching raises Puppet::Error" do
       before :each do
         expect(resource.provider.class).to receive(:prefetch).and_raise(Puppet::Error, "message")
       end
 
-      context "without future_features flag" do
-        before :each do
-          Puppet.settings[:future_features] = false
-        end
-
-        it "should not rescue prefetch executions" do
-          expect { transaction.prefetch_if_necessary(resource) }.to raise_error(Puppet::Error)
-        end
+      it "should rescue prefetch executions" do
+        transaction.prefetch_if_necessary(resource)
 
-        it "should log the exception during prefetch" do
-          expect(Puppet).to receive(:log_exception).with(anything, "Could not prefetch package provider 'pkgng': message")
-          expect { transaction.prefetch_if_necessary(resource) }.to raise_error(Puppet::Error, "message")
-        end
+        expect(transaction.prefetched_providers[:package][:pkgng]).to be_truthy
       end
 
-      context "with future_features flag" do
-        before :each do
-          Puppet.settings[:future_features] = true
-        end
+      it "should mark resources as failed", :unless => RUBY_PLATFORM == 'java' do
+        transaction.evaluate
 
-        it "should rescue prefetch executions" do
-          transaction.prefetch_if_necessary(resource)
+        expect(transaction.resource_status(resource).failed?).to be_truthy
+      end
 
-          expect(transaction.prefetched_providers[:package][:pkgng]).to be_truthy
-        end
+      it "should mark a provider that has failed prefetch" do
+        transaction.prefetch_if_necessary(resource)
 
-        it "should mark resources as failed", :unless => RUBY_PLATFORM == 'java' do
-          transaction.evaluate
+        expect(transaction.prefetch_failed_providers[:package][:pkgng]).to be_truthy
+      end
 
-          expect(transaction.resource_status(resource).failed?).to be_truthy
+      describe "and new resources are generated" do
+        let(:generator) { Puppet::Type.type(:notify).new :title => "generator" }
+        let(:generated) do
+          %w[a b c].map { |name| Puppet::Type.type(:package).new :title => "foo", :name => name, :provider => :apt }
         end
 
-        it "should mark a provider that has failed prefetch" do
-          transaction.prefetch_if_necessary(resource)
-
-          expect(transaction.prefetch_failed_providers[:package][:pkgng]).to be_truthy
+        before :each do
+          catalog.add_resource generator
+          allow(generator).to receive(:generate).and_return(generated)
+          allow(catalog).to receive(:container_of).and_return(generator)
         end
 
-        describe "and new resources are generated" do
-          let(:generator) { Puppet::Type.type(:transaction_generator).new :title => "generator" }
-          let(:generated) do
-            %w[a b c].map { |name| Puppet::Type.type(:package).new :title => "foo", :name => name, :provider => :apt }
-          end
-
-          before :each do
-            catalog.add_resource generator
-            allow(generator).to receive(:generate).and_return(generated)
-            allow(catalog).to receive(:container_of).and_return(generator)
-          end
-
-          it "should not evaluate resources with a failed provider, even if the prefetch is rescued" do
-            #Only the generator resource should be applied, all the other resources are failed, and skipped.
-            catalog.remove_resource resource2
-            expect(transaction).to receive(:apply).once
+        it "should not evaluate resources with a failed provider, even if the prefetch is rescued" do
+          #Only the generator resource should be applied, all the other resources are failed, and skipped.
+          catalog.remove_resource resource2
+          expect(transaction).to receive(:apply).once
 
-            transaction.evaluate
-          end
+          transaction.evaluate
+        end
 
-          it "should not fail other resources added after the failing resource", :unless => RUBY_PLATFORM == 'java' do
-            new_resource = Puppet::Type.type(:notify).new :name => "baz"
-            catalog.add_resource(new_resource)
+        it "should not fail other resources added after the failing resource", :unless => RUBY_PLATFORM == 'java' do
+          new_resource = Puppet::Type.type(:notify).new :name => "baz"
+          catalog.add_resource(new_resource)
 
-            transaction.evaluate
+          transaction.evaluate
 
-            expect(transaction.resource_status(new_resource).failed?).to be_falsey
-          end
+          expect(transaction.resource_status(new_resource).failed?).to be_falsey
+        end
 
-          it "should fail other resources that require the failing resource" do
-            new_resource = Puppet::Type.type(:notify).new(:name => "baz", :require => resource)
-            catalog.add_resource(new_resource)
+        it "should fail other resources that require the failing resource" do
+          new_resource = Puppet::Type.type(:notify).new(:name => "baz", :require => resource)
+          catalog.add_resource(new_resource)
 
-            catalog.remove_resource resource2
-            expect(transaction).to receive(:apply).once
+          catalog.remove_resource resource2
+          expect(transaction).to receive(:apply).once
 
-            transaction.evaluate
+          transaction.evaluate
 
-            expect(transaction.resource_status(resource).failed?).to be_truthy
-            expect(transaction.resource_status(new_resource).dependency_failed?).to be_truthy
-            expect(transaction.skip?(new_resource)).to be_truthy
-          end
+          expect(transaction.resource_status(resource).failed?).to be_truthy
+          expect(transaction.resource_status(new_resource).dependency_failed?).to be_truthy
+          expect(transaction.skip?(new_resource)).to be_truthy
         end
       end
     end
@@ -793,8 +746,13 @@ describe Puppet::Transaction do
     end
 
     it "should call Selinux.matchpathcon_fini in case Selinux is enabled ", :if => Puppet.features.posix? do
-      selinux = double('selinux', is_selinux_enabled: true, matchpathcon_fini: nil)
-      stub_const('Selinux', selinux)
+      unless defined?(Selinux)
+        module Selinux
+          def self.is_selinux_enabled
+            true
+          end
+        end
+      end
 
       resource = Puppet::Type.type(:file).new(:path => make_absolute("/tmp/foo"))
       transaction = transaction_with_resource(resource)
@@ -836,6 +794,7 @@ describe Puppet::Transaction do
       before do
         @resource = Puppet::Type.type(:notify).new :title => "foobar"
         @catalog.add_resource @resource
+        allow(@transaction).to receive(:add_dynamically_generated_resources)
       end
 
       it 'should stop processing if :stop_processing? is true' do