puppet 6.7.2 → 6.8.0

data/man/man5/puppet.conf.5

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPETCONF" "5" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPETCONF" "5" "August 2019" "Puppet, Inc." "Puppet manual"
 \fBThis page is autogenerated; any changes will get overwritten\fR
 .
 .SH "Configuration settings"
@@ -453,6 +453,14 @@ Boolean; whether to generate the default schedule resources\. Setting this to fa
 .
 .IP "" 0
 .
+.SS "deviceconfdir"
+The root directory of devices\' $confdir\.
+.
+.IP "\(bu" 4
+\fIDefault\fR: $confdir/devices
+.
+.IP "" 0
+.
 .SS "deviceconfig"
 Path to the device config file for puppet device\.
 .
@@ -592,7 +600,7 @@ You should change this setting once your Puppet deployment is doing non\-trivial
 We recommend setting this to \fBunlimited\fR and explicitly refreshing your Puppet master as part of your code deployment process\.
 .
 .IP "\(bu" 4
-With Puppet Server, you should refresh environments by calling the \fBenvironment\-cache\fR API endpoint\. See the docs for the Puppet Server administrative API\.
+With Puppet Server, you should refresh environments by calling the \fBenvironment\-cache\fR API endpoint\. See the docs for the Puppet Server administrative API \fIhttps://puppet\.com/docs/puppetserver/latest/admin\-api/v1/environment\-cache\.html\fR\.
 .
 .IP "" 0
 .
@@ -896,7 +904,7 @@ The time to wait for data to be read from an HTTP connection\. If nothing is rea
 The HTTP User\-Agent string to send when making network requests\.
 .
 .IP "\(bu" 4
-\fIDefault\fR: Puppet/6\.7\.0 Ruby/2\.4\.1\-p111 (x86_64\-linux)
+\fIDefault\fR: Puppet/6\.8\.0 Ruby/2\.4\.1\-p111 (x86_64\-linux)
 .
 .IP "" 0
 .
@@ -1229,6 +1237,14 @@ The short name for the EC curve used to generate the EC private key\. Valid valu
 .
 .IP "" 0
 .
+.SS "no_proxy"
+List of domain names that should not go through \fBhttp_proxy_host\fR\. Environment variable no_proxy or NO_PROXY will override this value\.
+.
+.IP "\(bu" 4
+\fIDefault\fR: localhost, 127\.0\.0\.1
+.
+.IP "" 0
+.
 .SS "node_cache_terminus"
 How to store cached nodes\. Valid values are (none), \'json\', \'msgpack\', or \'yaml\'\.
 .
@@ -1700,7 +1716,7 @@ A lock file to indicate that the ssl bootstrap process is currently in progress\
 .IP "" 0
 .
 .SS "ssl_server_ca_auth"
-Certificate authorities who issue client certificates\. SSL clients will not be considered authentic unless they possess a certificate issued by an authority listed in this file\. If this setting has no value then the Puppet master\'s CA certificate (localcacert) will be used\.
+The setting is deprecated and has no effect\. Ensure all root and intermediate certificate authorities used to issue client certificates are contained in the server\'s \fBcacert\fR file on the server\.
 .
 .TP
 \fIDefault\fR:

data/man/man8/puppet-agent.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-AGENT" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-AGENT" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-agent\fR \- The puppet agent daemon
@@ -22,19 +22,36 @@ This is the main puppet client\. Its job is to retrieve the local machine\'s con
 Once the client has a signed certificate, it will retrieve its configuration and apply it\.
 .
 .SH "USAGE NOTES"
-\'puppet agent\' does its best to find a compromise between interactive use and daemon use\. Run with no arguments and no configuration, it will go into the background, attempt to get a signed certificate, and retrieve and apply its configuration every 30 minutes\.
+\'puppet agent\' does its best to find a compromise between interactive use and daemon use\. If you run it with no arguments and no configuration, it goes into the background, attempts to get a signed certificate, and retrieves and applies its configuration every 30 minutes\.
 .
 .P
-Some flags are meant specifically for interactive use \-\- in particular, \'test\', \'tags\' and \'fingerprint\' are useful\.
+Some flags are meant specifically for interactive use \-\-\- in particular, \'test\', \'tags\' and \'fingerprint\' are useful\.
 .
 .P
-\'\-\-test\' does a single run in the foreground with verbose logging, then exits\. It will also exit if it can\'t get a valid catalog\. The exit code after running with \'\-\-test\' is 0 if the catalog was successfully applied, and 1 if the run either failed or wasn\'t attempted (due to another run already in progress)\.
+\'\-\-test\' runs once in the foreground with verbose logging, then exits\. It also exits if it can\'t get a valid catalog\. \fB\-\-test\fR includes the \'\-\-detailed\-exitcodes\' option by default and exits with one of the following exit codes:
+.
+.IP "\(bu" 4
+0: The run succeeded with no changes or failures; the system was already in the desired state\.
+.
+.IP "\(bu" 4
+1: The run failed, or wasn\'t attempted due to another run already in progress\.
+.
+.IP "\(bu" 4
+2: The run succeeded, and some resources were changed\.
+.
+.IP "\(bu" 4
+4: The run succeeded, and some resources failed\.
+.
+.IP "\(bu" 4
+6: The run succeeded, and included both changes and failures\.
+.
+.IP "" 0
 .
 .P
-\'\-\-tags\' allows you to specify what portions of a configuration you want to apply\. Puppet elements are tagged with all of the class or definition names that contain them, and you can use the \'tags\' flag to specify one of these names, causing only configuration elements contained within that class or definition to be applied\. This is very useful when you are testing new configurations \-\- for instance, if you are just starting to manage \'ntpd\', you would put all of the new elements into an \'ntpd\' class, and call puppet with \'\-\-tags ntpd\', which would only apply that small portion of the configuration during your testing, rather than applying the whole thing\.
+\'\-\-tags\' allows you to specify what portions of a configuration you want to apply\. Puppet elements are tagged with all of the class or definition names that contain them, and you can use the \'tags\' flag to specify one of these names, causing only configuration elements contained within that class or definition to be applied\. This is very useful when you are testing new configurations \-\-\- for instance, if you are just starting to manage \'ntpd\', you would put all of the new elements into an \'ntpd\' class, and call puppet with \'\-\-tags ntpd\', which would only apply that small portion of the configuration during your testing, rather than applying the whole thing\.
 .
 .P
-\'\-\-fingerprint\' is a one\-time flag\. In this mode \'puppet agent\' will run once and display on the console (and in the log) the current certificate (or certificate request) fingerprint\. Providing the \'\-\-digest\' option allows to use a different digest algorithm to generate the fingerprint\. The main use is to verify that before signing a certificate request on the master, the certificate request the master received is the same as the one the client sent (to prevent against man\-in\-the\-middle attacks when signing certificates)\.
+\'\-\-fingerprint\' is a one\-time flag\. In this mode \'puppet agent\' runs once and displays on the console (and in the log) the current certificate (or certificate request) fingerprint\. Providing the \'\-\-digest\' option allows to use a different digest algorithm to generate the fingerprint\. The main use is to verify that before signing a certificate request on the master, the certificate request the master received is the same as the one the client sent (to prevent against man\-in\-the\-middle attacks when signing certificates)\.
 .
 .SH "OPTIONS"
 Note that any Puppet setting that\'s valid in the configuration file is also a valid long argument\. For example, \'server\' is a valid setting, so you can specify \'\-\-server \fIservername\fR\' as an argument\. Boolean settings translate into \'\-\-setting\' and \'\-\-no\-setting\' pairs\.
@@ -60,7 +77,7 @@ Enable full debugging\.
 .
 .TP
 \-\-detailed\-exitcodes
-Provide extra information about the run via exit codes; only works if \'\-\-test\' or \'\-\-onetime\' is also specified\. If enabled, \'puppet agent\' will use the following exit codes:
+Provide extra information about the run via exit codes; works only if \'\-\-test\' or \'\-\-onetime\' is also specified\. If enabled, \'puppet agent\' uses the following exit codes:
 .
 .IP
 0: The run succeeded with no changes or failures; the system was already in the desired state\.

data/man/man8/puppet-apply.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-APPLY" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-APPLY" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-apply\fR \- Apply Puppet manifests locally

data/man/man8/puppet-catalog.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CATALOG" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-CATALOG" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-catalog\fR \- Compile, save, view, and convert catalogs\.

data/man/man8/puppet-config.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-CONFIG" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-CONFIG" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-config\fR \- Interact with Puppet\'s settings\.

data/man/man8/puppet-describe.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DESCRIBE" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DESCRIBE" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-describe\fR \- Display help about resource types

data/man/man8/puppet-device.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DEVICE" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DEVICE" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-device\fR \- Manage remote network devices

data/man/man8/puppet-doc.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-DOC" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-DOC" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-doc\fR \- Generate Puppet references

data/man/man8/puppet-epp.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-EPP" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-EPP" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-epp\fR \- Interact directly with the EPP template parser/renderer\.

data/man/man8/puppet-facts.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-FACTS" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-FACTS" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-facts\fR \- Retrieve and store facts\.

data/man/man8/puppet-filebucket.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-FILEBUCKET" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-FILEBUCKET" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-filebucket\fR \- Store and retrieve files in a filebucket

data/man/man8/puppet-generate.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-GENERATE" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-GENERATE" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-generate\fR \- Generates Puppet code from Ruby definitions\.

data/man/man8/puppet-help.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-HELP" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-HELP" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-help\fR \- Display Puppet help\.

data/man/man8/puppet-key.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-KEY" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-KEY" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-key\fR \- Create, save, and remove certificate keys\.

data/man/man8/puppet-lookup.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "LOOKUP" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "LOOKUP" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBlookup\fR \- Interactive Hiera lookup

data/man/man8/puppet-man.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-MAN" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-MAN" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-man\fR \- Display Puppet manual pages\.

data/man/man8/puppet-module.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-MODULE" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-MODULE" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-module\fR \- Creates, installs and searches for modules on the Puppet Forge\.

data/man/man8/puppet-node.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-NODE" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-NODE" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-node\fR \- View and manage node definitions\.

data/man/man8/puppet-parser.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-PARSER" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-PARSER" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-parser\fR \- Interact directly with the parser\.

data/man/man8/puppet-plugin.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-PLUGIN" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-PLUGIN" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-plugin\fR \- Interact with the Puppet plugin system\.

data/man/man8/puppet-report.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-REPORT" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-REPORT" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-report\fR \- Create, display, and submit reports\.

data/man/man8/puppet-resource.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-RESOURCE" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-RESOURCE" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-resource\fR \- The resource abstraction layer shell

data/man/man8/puppet-script.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-SCRIPT" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-SCRIPT" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-script\fR \- Run a puppet manifests as a script without compiling a catalog

data/man/man8/puppet-ssl.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-SSL" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-SSL" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-ssl\fR \- Manage SSL keys and certificates for puppet SSL clients

data/man/man8/puppet-status.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-STATUS" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET\-STATUS" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-status\fR \- View puppet server status\.

data/man/man8/puppet.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET" "8" "July 2019" "Puppet, Inc." "Puppet manual"
+.TH "PUPPET" "8" "August 2019" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\fR
@@ -25,4 +25,4 @@ Specialized:
 catalog Compile, save, view, and convert catalogs\. describe Display help about resource types device Manage remote network devices doc Generate Puppet references epp Interact directly with the EPP template parser/renderer\. facts Retrieve and store facts\. filebucket Store and retrieve files in a filebucket generate Generates Puppet code from Ruby definitions\. node View and manage node definitions\. parser Interact directly with the parser\. script Run a puppet manifests as a script without compiling a catalog ssl Manage SSL keys and certificates for puppet SSL clients
 .
 .P
-See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v6\.7\.0
+See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v6\.8\.0

data/spec/integration/provider/service/systemd_spec.rb

@@ -7,16 +7,18 @@ describe test_title, unless: Puppet::Util::Platform.jruby? do
 
   # TODO: Unfortunately there does not seem a way to stub the executable
   #       checks in the systemd provider because they happen at load time.
-  it "should be considered suitable if /bin/systemctl is present", :if => File.executable?('/bin/systemctl') do
+  it "should be considered suitable if /proc/1/exe is present and points to 'systemd'",
+    :if => File.exist?('/proc/1/exe') && Puppet::FileSystem.readlink('/proc/1/exe').include?('systemd') do
     expect(provider_class).to be_suitable
   end
 
-  it "should be considered suitable if /usr/bin/systemctl is present", :if => File.executable?('/usr/bin/systemctl')  do
-    expect(provider_class).to be_suitable
+  it "should not be considered suitable if /proc/1/exe is present it does not point to 'systemd'",
+    :if => File.exist?('/proc/1/exe') && !Puppet::FileSystem.readlink('/proc/1/exe').include?('systemd') do
+    expect(provider_class).not_to be_suitable
   end
 
-  it "should not be cosidered suitable if systemctl is absent",
-    :unless => (File.executable?('/bin/systemctl') or File.executable?('/usr/bin/systemctl')) do
+  it "should not be considered suitable if /proc/1/exe is absent",
+    :if => !File.exist?('/proc/1/exe') do
     expect(provider_class).not_to be_suitable
   end
 end

data/spec/integration/type/file_spec.rb

@@ -21,6 +21,13 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
     File.join(parent, 'file_testing')
   end
 
+  let(:path_protected) do
+    # we create a file inside windows protected folders (C:\Windows, C:\Windows\system32, etc)
+    # the file will also be removed after the tests
+    parent = 'C:\Windows'
+    File.join(parent, 'file_testing')
+  end
+
   let(:dir) do
     # we create a directory first so backups of :path that are stored in
     # the same directory will also be removed after the tests
@@ -268,6 +275,27 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
           expect(get_mode(path) & 07777).to eq(0666)
         end
 
+        context "file is in protected windows directory", :if => Puppet.features.microsoft_windows? do
+          after { FileUtils.rm(path_protected) }
+
+          it "should set and get the correct mode for files inside protected windows folders" do
+            catalog.add_resource described_class.new(:path => path_protected, :ensure => :file, :mode => '0640')
+            catalog.apply
+  
+            expect(get_mode(path_protected) & 07777).to eq(0640)
+          end
+
+          it "should not change resource's status inside protected windows folders if mode is the same" do
+            FileUtils.touch(path_protected)
+            set_mode(0644, path_protected)
+            catalog.add_resource described_class.new(:path => path_protected, :ensure => :file, :mode => '0644')
+            result = catalog.apply
+            status = result.report.resource_statuses["File[#{path_protected}]"]
+            expect(status).not_to be_failed
+            expect(status).not_to be_changed
+          end
+        end
+        
         it "should not set executable bits when replacing an executable directory (#10365)" do
           pending("bug #10365")
 

data/spec/unit/application/device_spec.rb

@@ -370,9 +370,19 @@ describe Puppet::Application::Device do
         allow(configurer).to receive(:run)
         allow(Puppet::Configurer).to receive(:new).and_return(configurer)
 
+        allow(Puppet::FileSystem).to receive(:exist?)
+        allow(Puppet::FileSystem).to receive(:symlink)
+        allow(Puppet::FileSystem).to receive(:dir_mkpath).and_return(true)
+        allow(Puppet::FileSystem).to receive(:dir_exist?).and_return(true)
+
         allow(plugin_handler).to receive(:download_plugins)
       end
 
+      it "sets ssldir relative to the global confdir" do
+        expect(Puppet).to receive(:[]=).with(:ssldir, make_absolute("/dummy/devices/device1/ssl"))
+        expect { device.main }.to exit_with 1
+      end
+
       it "sets vardir to the device vardir" do
         expect(Puppet).to receive(:[]=).with(:vardir, make_absolute("/dummy/devices/device1"))
         expect { device.main }.to exit_with 1
@@ -390,6 +400,22 @@ describe Puppet::Application::Device do
       end
 
       context 'with --target=device1' do
+        it "symlinks the ssl directory if it doesn't exist" do
+          allow(device.options).to receive(:[]).with(:target).and_return('device1')
+          allow(Puppet::FileSystem).to receive(:exist?).and_return(false)
+
+          expect(Puppet::FileSystem).to receive(:symlink).with(Puppet[:ssldir], File.join(Puppet[:confdir], 'ssl')).and_return(true)
+          expect { device.main }.to exit_with 1
+        end
+
+        it "creates the device confdir under the global confdir" do
+          allow(device.options).to receive(:[]).with(:target).and_return('device1')
+          allow(Puppet::FileSystem).to receive(:dir_exist?).and_return(false)
+
+          expect(Puppet::FileSystem).to receive(:dir_mkpath).with(Puppet[:ssldir]).and_return(true)
+          expect { device.main }.to exit_with 1
+        end
+
         it "manages the specified target" do
           allow(device.options).to receive(:[]).with(:target).and_return('device1')