puppet 6.4.5-universal-darwin → 6.5.0-universal-darwin

data/spec/integration/configurer_spec.rb

@@ -59,57 +59,5 @@ describe Puppet::Configurer do
       expect(summary["time"]).to be_key("notify")
       expect(summary["time"]["last_run"]).to be_between(t1, t2)
     end
-
-    describe 'resubmitting facts' do
-      context 'when resubmit_facts is set to false' do
-        it 'should not send data' do
-          expect(@configurer).to receive(:resubmit_facts).never
-
-          @configurer.run(catalog: @catalog)
-        end
-      end
-
-      context 'when resubmit_facts is set to true' do
-        let(:test_facts) { Puppet::Node::Facts.new('configurer.test') }
-        let(:fact_rest_terminus) { Puppet::Node::Facts.indirection.terminus(:rest) }
-
-        before(:each) do
-          Puppet[:resubmit_facts] = true
-
-          allow(@configurer).to receive(:find_facts).and_return(test_facts)
-          allow(fact_rest_terminus).to receive(:save)
-        end
-
-        it 'sends fact data using the rest terminus' do
-          expect(fact_rest_terminus).to receive(:save)
-
-          @configurer.run(catalog: @catalog)
-        end
-
-        it 'logs errors that occur during fact generation' do
-          allow(@configurer).to receive(:find_facts).and_raise('error generating facts')
-          expect(Puppet).to receive(:log_exception).with(instance_of(RuntimeError),
-                                                         /^Failed to submit facts/)
-
-          @configurer.run(catalog: @catalog)
-        end
-
-        it 'logs errors that occur during fact submission' do
-          allow(fact_rest_terminus).to receive(:save).and_raise('error sending facts')
-          expect(Puppet).to receive(:log_exception).with(instance_of(RuntimeError),
-                                                         /^Failed to submit facts/)
-
-          @configurer.run(catalog: @catalog)
-        end
-
-        it 'records time spent resubmitting facts' do
-          report = Puppet::Transaction::Report.new
-
-          @configurer.run(catalog: @catalog, report: report)
-
-          expect(report.metrics['time'].values).to include(["resubmit_facts", anything, Numeric])
-        end
-      end
-    end
   end
 end

data/spec/integration/provider/service/init_spec.rb

@@ -8,6 +8,7 @@ describe test_title, unless: Puppet::Util::Platform.jruby? do
   describe "when running on FreeBSD" do
     before :each do
       allow(Facter).to receive(:value).with(:operatingsystem).and_return('FreeBSD')
+      allow(Facter).to receive(:value).with(:osfamily).and_return('FreeBSD')
     end
 
     it "should set its default path to include /etc/rc.d and /usr/local/etc/rc.d" do

data/spec/integration/provider/service/systemd_spec.rb

@@ -7,19 +7,16 @@ describe test_title, unless: Puppet::Util::Platform.jruby? do
 
   # TODO: Unfortunately there does not seem a way to stub the executable
   #       checks in the systemd provider because they happen at load time.
-
-  it "should be considered suitable if /proc/1/comm is present and contains 'systemd'",
-    :if => File.exist?('/proc/1/comm') && Puppet::FileSystem.read('/proc/1/comm').include?('systemd') do
+  it "should be considered suitable if /bin/systemctl is present", :if => File.executable?('/bin/systemctl') do
     expect(provider_class).to be_suitable
   end
 
-  it "should not be considered suitable if /proc/1/comm is present it does not contain 'systemd'",
-    :if => File.exist?('/proc/1/comm') && !Puppet::FileSystem.read('/proc/1/comm').include?('systemd') do
-    expect(provider_class).not_to be_suitable
+  it "should be considered suitable if /usr/bin/systemctl is present", :if => File.executable?('/usr/bin/systemctl')  do
+    expect(provider_class).to be_suitable
   end
 
-  it "should not be considered suitable if /proc/1/comm is absent",
-    :if => !File.exist?('/proc/1/comm') do
+  it "should not be cosidered suitable if systemctl is absent",
+    :unless => (File.executable?('/bin/systemctl') or File.executable?('/usr/bin/systemctl')) do
     expect(provider_class).not_to be_suitable
   end
 end

data/spec/integration/type/file_spec.rb

@@ -21,13 +21,6 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
     File.join(parent, 'file_testing')
   end
 
-  let(:path_protected) do
-    # we create a file inside windows protected folders (C:\Windows, C:\Windows\system32, etc)
-    # the file will also be removed after the tests
-    parent = 'C:\Windows'
-    File.join(parent, 'file_testing')
-  end
-
   let(:dir) do
     # we create a directory first so backups of :path that are stored in
     # the same directory will also be removed after the tests
@@ -275,27 +268,6 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
           expect(get_mode(path) & 07777).to eq(0666)
         end
 
-        context "file is in protected windows directory", :if => Puppet.features.microsoft_windows? do
-          after { FileUtils.rm(path_protected) }
-
-          it "should set and get the correct mode for files inside protected windows folders" do
-            catalog.add_resource described_class.new(:path => path_protected, :ensure => :file, :mode => '0640')
-            catalog.apply
-  
-            expect(get_mode(path_protected) & 07777).to eq(0640)
-          end
-
-          it "should not change resource's status inside protected windows folders if mode is the same" do
-            FileUtils.touch(path_protected)
-            set_mode(0644, path_protected)
-            catalog.add_resource described_class.new(:path => path_protected, :ensure => :file, :mode => '0644')
-            result = catalog.apply
-            status = result.report.resource_statuses["File[#{path_protected}]"]
-            expect(status).not_to be_failed
-            expect(status).not_to be_changed
-          end
-        end
-        
         it "should not set executable bits when replacing an executable directory (#10365)" do
           pending("bug #10365")
 
@@ -1708,6 +1680,44 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
   end
 
   describe "when using validate_cmd" do
+    test_cmd = '/bin/test'
+    if Facter.value(:osfamily) == 'Debian'
+      test_cmd = '/usr/bin/test'
+    end
+
+    if Facter.value(:operatingsystem) == 'Darwin'
+      stat_cmd = "stat -f '%Lp'"
+    else
+      stat_cmd = "stat --format=%a"
+    end
+
+    it "sets the default mode of the temporary file to '0644'", :unless => Puppet::Util::Platform.windows? || Puppet::Util::Platform.jruby? do
+      catalog.add_resource(described_class.new(:path => path, :content => "foo",
+                                               :validate_replacement => '^',
+                                               :validate_cmd => %Q{
+                                               echo "The permissions of the file ($(#{stat_cmd} ^)) should equal 644";
+                                               #{test_cmd} "644" == "$(#{stat_cmd} ^)"
+                                               }))
+      report = catalog.apply.report
+      expect(report.resource_statuses["File[#{path}]"].events.first.message).to match(/defined content as '{md5}/)
+      expect(report.resource_statuses["File[#{path}]"]).not_to be_failed
+      expect(Puppet::FileSystem.exist?(path)).to be_truthy
+    end
+
+    it "should change the permissions of the temp file to match the final file permissions", :unless => Puppet::Util::Platform.windows? || Puppet::Util::Platform.jruby?do
+      catalog.add_resource(described_class.new(:path => path, :content => "foo",
+                                               :mode => '0555',
+                                               :validate_replacement => '^',
+                                               :validate_cmd => %Q{
+                                               echo "The permissions of the file ($(#{stat_cmd} ^)) should equal 555";
+                                               #{test_cmd} "555" == "$(#{stat_cmd} ^)"
+                                               }))
+      report = catalog.apply.report
+      expect(report.resource_statuses["File[#{path}]"].events.first.message).to match(/defined content as '{md5}/)
+      expect(report.resource_statuses["File[#{path}]"]).not_to be_failed
+      expect(Puppet::FileSystem.exist?(path)).to be_truthy
+    end
+
     it "should fail the file resource if command fails" do
       catalog.add_resource(described_class.new(:path => path, :content => "foo", :validate_cmd => "/usr/bin/env false"))
       expect(Puppet::Util::Execution).to receive(:execute).with("/usr/bin/env false", {:combine => true, :failonfail => true}).and_raise(Puppet::ExecutionFailure, "Failed")

data/spec/integration/util/execution_spec.rb

@@ -25,33 +25,6 @@ describe Puppet::Util::Execution, unless: Puppet::Util::Platform.jruby? do
     end
   end
 
-  describe "#execute" do
-    if Puppet::Util::Platform.windows?
-      let(:argv) { ["cmd", "/c", "echo", 123] }
-    else
-      let(:argv) { ["echo", 123] }
-    end
-
-    it 'stringifies sensitive arguments when given an array containing integers' do
-      result = Puppet::Util::Execution.execute(argv, sensitive: true)
-      expect(result.to_s.strip).to eq("123")
-      expect(result.exitstatus).to eq(0)
-    end
-
-    it 'redacts sensitive arguments when given an array' do
-      Puppet[:log_level] = :debug
-      Puppet::Util::Execution.execute(argv, sensitive: true)
-      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'"))
-    end
-
-    it 'redacts sensitive arguments when given a string' do
-      Puppet[:log_level] = :debug
-      str = argv.map(&:to_s).join(' ')
-      Puppet::Util::Execution.execute(str, sensitive: true)
-      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'"))
-    end
-  end
-
   describe "#execute (non-Windows)", :if => !Puppet::Util::Platform.windows? do
     it "should execute basic shell command" do
       result = Puppet::Util::Execution.execute("ls /tmp", :failonfail => true)

data/spec/lib/puppet/certificate_factory.rb

@@ -25,9 +25,9 @@ module Puppet::CertificateFactory
   # @return [OpenSSL::X509::Certificate]
   def self.build(cert_type, csr, issuer, serial, ttl = 3600)
     # Work out if we can even build the requested type of certificate.
-    build_extensions = "build_#{cert_type}_extensions"
+    build_extensions = "build_#{cert_type.to_s}_extensions"
     respond_to?(build_extensions) or
-      raise ArgumentError, _("%{cert_type} is an invalid certificate type!") % { cert_type: cert_type }
+      raise ArgumentError, _("%{cert_type} is an invalid certificate type!") % { cert_type: cert_type.to_s }
 
     raise ArgumentError, _("Certificate TTL must be an integer") unless ttl.nil? || ttl.is_a?(Integer)
 

data/spec/lib/puppet/test_ca.rb

@@ -40,7 +40,7 @@ module Puppet
     end
 
     def create_cert(name, issuer_cert, issuer_key, opts = {})
-      key, cert = build_cert(name, issuer_cert.subject)
+      key, cert = build_cert(name, issuer_cert.subject, opts)
       ef = extension_factory_for(issuer_cert, cert)
       if opts[:subject_alt_names]
         ext = ef.create_extension(["subjectAltName", opts[:subject_alt_names], false])
@@ -123,10 +123,23 @@ module Puppet
 
     private
 
-    def build_cert(name, issuer)
-      key = OpenSSL::PKey::RSA.new(1024)
+    def build_cert(name, issuer, opts = {})
+      key = if opts[:key_type] == :ec
+              key = OpenSSL::PKey::EC.generate('prime256v1')
+            else
+              key = OpenSSL::PKey::RSA.new(1024)
+            end
       cert = OpenSSL::X509::Certificate.new
-      cert.public_key = key.public_key
+      cert.public_key = if key.is_a?(OpenSSL::PKey::EC)
+                         # EC#public_key doesn't following the PKey API,
+                         # see https://github.com/ruby/openssl/issues/29
+                         point = key.public_key
+                         pubkey = OpenSSL::PKey::EC.new(point.group)
+                         pubkey.public_key = point
+                         pubkey
+                       else
+                         key.public_key
+                       end
       cert.subject = OpenSSL::X509::Name.new([["CN", name]])
       cert.issuer = issuer
       cert.version = 2

data/spec/lib/puppet_spec/fixtures.rb

@@ -42,6 +42,10 @@ module PuppetSpec::Fixtures
     OpenSSL::PKey::RSA.new(pem_content(name))
   end
 
+  def ec_key_fixture(name)
+    OpenSSL::PKey::EC.new(pem_content(name))
+  end
+
   def request_fixture(name)
     OpenSSL::X509::Request.new(pem_content(name))
   end

data/spec/spec_helper.rb

@@ -54,19 +54,13 @@ Pathname.glob("#{dir}/shared_examples/**/*.rb") do |behaviour|
   require behaviour.relative_path_from(Pathname.new(dir))
 end
 
-require 'webmock/rspec'
 require 'vcr'
 VCR.configure do |vcr|
   vcr.cassette_library_dir = File.expand_path('vcr/cassettes', PuppetSpec::FIXTURE_DIR)
   vcr.hook_into :webmock
   vcr.configure_rspec_metadata!
-  # Uncomment next line to debug vcr
-  # vcr.debug_logger = $stderr
 end
 
-# Disable VCR by default
-VCR.turn_off!
-
 RSpec.configure do |config|
   include PuppetSpec::Fixtures
 
@@ -161,28 +155,6 @@ RSpec.configure do |config|
     Puppet::Test::TestHelper.before_each_test()
   end
 
-  # Facter 2 uses two versions of the GCE API, so match using regex
-  PUPPET_FACTER_2_GCE_URL = %r{^http://metadata/computeMetadata/v1(beta1)?}.freeze
-  PUPPET_FACTER_3_GCE_URL = "http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=json".freeze
-
-  config.around :each do |example|
-    # Ignore requests from Facter GCE fact in Travis
-    stub_request(:get, PUPPET_FACTER_2_GCE_URL)
-    stub_request(:get, PUPPET_FACTER_3_GCE_URL)
-
-    # Enable VCR if the example is tagged with `:vcr` metadata.
-    if example.metadata[:vcr]
-      VCR.turn_on!
-      begin
-        example.run
-      ensure
-        VCR.turn_off!
-      end
-    else
-      example.run
-    end
-  end
-
   config.after :each do
     Puppet::Test::TestHelper.after_each_test()
 

data/spec/unit/application/agent_spec.rb

@@ -7,8 +7,6 @@ require 'puppet/daemon'
 describe Puppet::Application::Agent do
   include PuppetSpec::Files
 
-  let(:machine) { double(ensure_client_certificate: nil) }
-
   before :each do
     @puppetd = Puppet::Application[:agent]
 
@@ -29,8 +27,9 @@ describe Puppet::Application::Agent do
     allow(Puppet::Node.indirection).to receive(:cache_class=)
     allow(Puppet::Node::Facts.indirection).to receive(:terminus_class=)
 
+    expect($stderr).not_to receive(:puts)
+
     allow(Puppet.settings).to receive(:use)
-    allow(Puppet::SSL::StateMachine).to receive(:new).and_return(machine)
   end
 
   it "should operate in agent run_mode" do
@@ -126,7 +125,7 @@ describe Puppet::Application::Agent do
       allow(@agent).to receive(:run).and_return(2)
       Puppet[:onetime] = true
 
-      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 0).and_return(machine)
+      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 0).and_return(double(ensure_client_certificate: nil))
 
       expect { execute_agent }.to exit_with 0
     end
@@ -136,20 +135,13 @@ describe Puppet::Application::Agent do
       Puppet[:onetime] = true
       @puppetd.handle_waitforcert(60)
 
-      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 60).and_return(machine)
+      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 60).and_return(double(ensure_client_certificate: nil))
 
       expect { execute_agent }.to exit_with 0
     end
 
     it "should use a default value for waitforcert when --onetime and --waitforcert are not specified" do
-      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 120).and_return(machine)
-
-      execute_agent
-    end
-
-    it "should register ssl OIDs" do
       expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 120).and_return(double(ensure_client_certificate: nil))
-      expect(Puppet::SSL::Oids).to receive(:register_puppet_oids)
 
       execute_agent
     end
@@ -157,7 +149,7 @@ describe Puppet::Application::Agent do
     it "should use the waitforcert setting when checking for a signed certificate" do
       Puppet[:waitforcert] = 10
 
-      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 10).and_return(machine)
+      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 10).and_return(double(ensure_client_certificate: nil))
 
       execute_agent
     end
@@ -394,6 +386,8 @@ describe Puppet::Application::Agent do
     it "should inform the daemon about our agent if :client is set to 'true'" do
       @puppetd.options[:client] = true
 
+      allow(Puppet::SSL::StateMachine).to receive(:new).and_return(double(ensure_client_certificate: nil))
+
       execute_agent
 
       expect(@daemon.agent).to eq(@agent)
@@ -404,6 +398,8 @@ describe Puppet::Application::Agent do
       Puppet[:daemonize] = true
       allow(Signal).to receive(:trap)
 
+      allow(Puppet::SSL::StateMachine).to receive(:new).and_return(double(ensure_client_certificate: nil))
+
       expect(@daemon).to receive(:daemonize)
 
       execute_agent
@@ -412,7 +408,22 @@ describe Puppet::Application::Agent do
     it "should wait for a certificate" do
       @puppetd.options[:waitforcert] = 123
 
-      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 123).and_return(machine)
+      expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 123).and_return(double(ensure_client_certificate: nil))
+
+      execute_agent
+    end
+
+    it "should not wait for a certificate in fingerprint mode" do
+      @puppetd.options[:fingerprint] = true
+      @puppetd.options[:waitforcert] = 123
+      @puppetd.options[:digest] = 'MD5'
+
+      certificate = double('certificate')
+      allow(certificate).to receive(:to_der).and_return('ABCDE')
+      ssl_context = double('ssl_context', client_cert: certificate)
+      allow(Puppet::SSL::StateMachine).to receive(:new).with(onetime: true).and_return(double(ensure_client_certificate: ssl_context))
+
+      expect(@puppetd).to receive(:puts).with('(MD5) 2E:CD:DE:39:59:05:1D:91:3F:61:B1:45:79:EA:13:6D')
 
       execute_agent
     end
@@ -467,6 +478,7 @@ describe Puppet::Application::Agent do
 
     it "should dispatch to onetime if --onetime is used" do
       Puppet[:onetime] = true
+      allow(Puppet::SSL::StateMachine).to receive(:new).and_return(double(ensure_client_certificate: nil))
 
       expect(@puppetd).to receive(:onetime)
 
@@ -475,6 +487,7 @@ describe Puppet::Application::Agent do
 
     it "should dispatch to main if --onetime and --fingerprint are not used" do
       Puppet[:onetime] = false
+      allow(Puppet::SSL::StateMachine).to receive(:new).and_return(double(ensure_client_certificate: nil))
 
       expect(@puppetd).to receive(:main)
 
@@ -488,7 +501,7 @@ describe Puppet::Application::Agent do
         @puppetd.options[:client] = :client
         @puppetd.options[:detailed_exitcodes] = false
 
-
+        allow(Puppet::SSL::StateMachine).to receive(:new).and_return(double(ensure_client_certificate: nil))
       end
 
       it "should setup traps" do
@@ -539,54 +552,26 @@ describe Puppet::Application::Agent do
 
     describe "with --fingerprint" do
       before :each do
+        @cert = double('cert')
         @puppetd.options[:fingerprint] = true
         @puppetd.options[:digest] = :MD5
       end
 
       it "should fingerprint the certificate if it exists" do
-        cert = cert_fixture('signed.pem')
-        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_return(cert)
-
-        expect(@puppetd).to receive(:puts).with('(MD5) A6:00:3E:C1:DF:CF:E8:44:A6:4F:8D:92:E8:B2:D9:47')
-
-        @puppetd.fingerprint
-      end
-
-      it "should fingerprint the request if it exists" do
-        request = request_fixture('request.pem')
-        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_return(nil)
-        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_request).and_return(request)
+        allow(@cert).to receive(:to_der).and_return('ABCDE')
+        ssl_context = double('ssl_context', client_cert: @cert)
+        allow(Puppet::SSL::StateMachine).to receive(:new).with(onetime: true).and_return(double(ensure_client_certificate: ssl_context))
 
-        expect(@puppetd).to receive(:puts).with('(MD5) 04:D0:69:23:32:2F:48:77:FE:2F:F2:0C:4E:90:BE:AC')
+        expect(@puppetd).to receive(:puts).with('(MD5) 2E:CD:DE:39:59:05:1D:91:3F:61:B1:45:79:EA:13:6D')
 
         @puppetd.fingerprint
       end
-
-      it "should print an error to stderr if neither exist" do
-        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_return(nil)
-        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_request).and_return(nil)
-
-        expect {
-          expect {
-            @puppetd.fingerprint
-          }.to exit_with(1)
-        }.to output(/Fingerprint asked but neither the certificate, nor the certificate request have been issued/).to_stderr
-      end
-
-      it "should log an error if an exception occurs" do
-        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_raise(Puppet::Error, "Invalid PEM")
-
-        expect {
-          @puppetd.fingerprint
-        }.to exit_with(1)
-
-        expect(@logs).to include(an_object_having_attributes(message: /Failed to generate fingerprint: Invalid PEM/))
-      end
     end
 
     describe "without --onetime and --fingerprint" do
       before :each do
         allow(Puppet).to receive(:notice)
+        allow(Puppet::SSL::StateMachine).to receive(:new).and_return(double(ensure_client_certificate: nil))
       end
 
       it "should start our daemon" do
@@ -597,24 +582,6 @@ describe Puppet::Application::Agent do
     end
   end
 
-  describe "when starting in daemon mode on non-windows", :unless => Puppet.features.microsoft_windows? do
-    before :each do
-      allow(Puppet).to receive(:notice)
-      Puppet[:daemonize] = true
-    end
-
-    it "should not print config in default mode" do
-      execute_agent
-      expect(@logs).to be_empty
-    end
-
-    it "should print config in debug mode" do
-      @puppetd.options[:debug] = true
-      execute_agent
-      expect(@logs).to include(an_object_having_attributes(level: :debug, message: /agent_catalog_run_lockfile=/))
-    end
-  end
-
   def execute_agent
     @puppetd.setup
     @puppetd.run_command