puppet 6.7.2 → 6.8.0

data/spec/unit/face/facts_spec.rb

@@ -45,6 +45,15 @@ CONF
       subject.upload
     end
 
+    it "passes the current environment" do
+      env = Puppet::Node::Environment.remote('qa')
+      expect(model.indirection).to receive(:save).with(anything, nil, :environment => env)
+
+      Puppet.override(:current_environment => env) do
+        subject.upload
+      end
+    end
+
     it "uses settings from the agent section of puppet.conf" do
       expect(facter_terminus).to receive(:find).with(have_attributes(key: 'puppet.node.test')).and_return(test_data)
 

data/spec/unit/face/parser_spec.rb

@@ -105,13 +105,25 @@ describe Puppet::Face[:parser, :current] do
       end
     end
 
-    it "validates the contents of STDIN when no files given and STDIN is not a tty" do
-      from_a_piped_input_of("{ invalid =>")
+    context "when no files given and STDIN is not a tty" do
+      it "validates the contents of STDIN" do
+        from_a_piped_input_of("{ invalid =>")
 
-      Puppet.override(:current_environment => Puppet::Node::Environment.create(:special, [])) do
-        parse_errors = parser.validate()
+        Puppet.override(:current_environment => Puppet::Node::Environment.create(:special, [])) do
+          parse_errors = parser.validate()
+
+          expect(parse_errors['STDIN']).to be_a_kind_of(Puppet::ParseErrorWithIssue)
+        end
+      end
 
-        expect(parse_errors['STDIN']).to be_a_kind_of(Puppet::ParseErrorWithIssue)
+      it "runs error free when contents of STDIN is valid" do
+        from_a_piped_input_of("notify { valid: }")
+
+        Puppet.override(:current_environment => Puppet::Node::Environment.create(:special, [])) do
+          parse_errors = parser.validate()
+
+          expect(parse_errors).to be_empty
+        end
       end
     end
 

data/spec/unit/forge/module_release_spec.rb

@@ -15,6 +15,7 @@ describe Puppet::Forge::ModuleRelease do
   let(:module_full_name) { "#{module_author}-#{module_name}" }
   let(:module_full_name_versioned) { "#{module_full_name}-#{module_version}" }
   let(:module_md5) { "bbf919d7ee9d278d2facf39c25578bf8" }
+  let(:module_sha256) { "b4c6f15cec64a9fe16ef0d291e2598fc84f381bc59f0e67198d61706fafedae4" }
   let(:uri) { " "}
   let(:release) { Puppet::Forge::ModuleRelease.new(ssl_repository, JSON.parse(release_json)) }
 
@@ -31,21 +32,6 @@ describe Puppet::Forge::ModuleRelease do
       allow(Digest::MD5).to receive(:file).and_return(double(:hexdigest => md5))
     end
 
-    describe '#prepare' do
-      before :each do
-        allow(release).to receive(:tmpfile).and_return(mock_file)
-        allow(release).to receive(:tmpdir).and_return(mock_dir)
-      end
-
-      it 'should call sub methods with correct params' do
-        expect(release).to receive(:download).with("/#{api_version}/files/#{module_full_name_versioned}.tar.gz", mock_file)
-        expect(release).to receive(:validate_checksum).with(mock_file, module_md5)
-        expect(release).to receive(:unpack).with(mock_file, mock_dir)
-
-        release.prepare
-      end
-    end
-
     describe '#tmpfile' do
       it 'should be opened in binary mode' do
         allow(Puppet::Forge::Cache).to receive(:base_path).and_return(Dir.tmpdir)
@@ -67,21 +53,6 @@ describe Puppet::Forge::ModuleRelease do
       end
     end
 
-    describe '#verify_checksum' do
-      it 'passes md5 check when valid' do
-        # valid hash comes from file_md5 in JSON blob above
-        mock_digest_file_with_md5(module_md5)
-
-        release.send(:validate_checksum, mock_file, module_md5)
-      end
-
-      it 'fails md5 check when invalid' do
-        mock_digest_file_with_md5('ffffffffffffffffffffffffffffffff')
-
-        expect { release.send(:validate_checksum, mock_file, module_md5) }.to raise_error(RuntimeError, /did not match expected checksum/)
-      end
-    end
-
     describe '#unpack' do
       it 'should call unpacker with correct params' do
         expect(Puppet::ModuleTool::Applications::Unpacker).to receive(:unpack).with(mock_file.path, mock_dir).and_return(true)
@@ -130,6 +101,7 @@ describe Puppet::Forge::ModuleRelease do
       "file_uri": "/#{api_version}/files/#{module_full_name_versioned}.tar.gz",
       "file_size": 67586,
       "file_md5": "#{module_md5}",
+      "file_sha256": "#{module_sha256}",
       "downloads": 610751,
       "readme": "",
       "changelog": "",
@@ -142,6 +114,66 @@ describe Puppet::Forge::ModuleRelease do
     end
 
     it_behaves_like 'a module release'
+
+    context 'when verifying checksums' do
+      let(:json) { JSON.parse(release_json) }
+
+      def mock_release(json)
+        release = Puppet::Forge::ModuleRelease.new(ssl_repository, json)
+        allow(release).to receive(:tmpfile).and_return(mock_file)
+        allow(release).to receive(:tmpdir).and_return(mock_dir)
+        allow(release).to receive(:download).with("/#{api_version}/files/#{module_full_name_versioned}.tar.gz", mock_file)
+        allow(release).to receive(:unpack)
+        release
+      end
+
+      it 'verifies using SHA256' do
+        expect(Digest::SHA256).to receive(:file).and_return(double(:hexdigest => module_sha256))
+
+        release = mock_release(json)
+        release.prepare
+      end
+
+      it 'rejects an invalid release with SHA256' do
+        expect(Digest::SHA256).to receive(:file).and_return(double(:hexdigest => 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'))
+
+        release = mock_release(json)
+        expect {
+          release.prepare
+        }.to raise_error(RuntimeError, /did not match expected checksum/)
+      end
+
+      context 'when `file_sha256` is missing' do
+        before(:each) do
+          json.delete('file_sha256')
+        end
+
+        it 'verifies using MD5 if `file_sha256` is missing' do
+          expect(Digest::MD5).to receive(:file).and_return(double(:hexdigest => module_md5))
+
+          release = mock_release(json)
+          release.prepare
+        end
+
+        it 'rejects an invalid release with MD5' do
+          expect(Digest::MD5).to receive(:file).and_return(double(:hexdigest => 'ffffffffffffffffffffffffffffffff'))
+
+          release = mock_release(json)
+          expect {
+            release.prepare
+          }.to raise_error(RuntimeError, /did not match expected checksum/)
+        end
+
+        it 'raises if FIPS is enabled' do
+          allow(Facter).to receive(:value).with(:fips_enabled).and_return(true)
+
+          release = mock_release(json)
+          expect {
+            release.prepare
+          }.to raise_error(/Module install using MD5 is prohibited in FIPS mode./)
+        end
+      end
+    end
   end
 
   context 'forge module with no dependencies field' do
@@ -180,6 +212,7 @@ describe Puppet::Forge::ModuleRelease do
       "file_uri": "/#{api_version}/files/#{module_full_name_versioned}.tar.gz",
       "file_size": 67586,
       "file_md5": "#{module_md5}",
+      "file_sha256": "#{module_sha256}",
       "downloads": 610751,
       "readme": "",
       "changelog": "",
@@ -208,7 +241,8 @@ describe Puppet::Forge::ModuleRelease do
       },
       "file_uri": "/#{api_version}/files/#{module_full_name_versioned}.tar.gz",
       "file_size": 67586,
-      "file_md5": "#{module_md5}"
+      "file_md5": "#{module_md5}",
+      "file_sha256": "#{module_sha256}"
     }
     }
     end
@@ -256,6 +290,7 @@ describe Puppet::Forge::ModuleRelease do
       "file_uri": "/#{api_version}/files/#{module_full_name_versioned}.tar.gz",
       "file_size": 67586,
       "file_md5": "#{module_md5}",
+      "file_sha256": "#{module_sha256}",
       "downloads": 610751,
       "readme": "",
       "changelog": "",

data/spec/unit/module_tool/applications/installer_spec.rb

@@ -365,14 +365,5 @@ describe Puppet::ModuleTool::Applications::Installer, :unless => RUBY_PLATFORM =
         end
       end
     end
-
-    context 'when in FIPS mode...' do
-      it 'module installer refuses to run' do
-        allow(Facter).to receive(:value).with(:fips_enabled).and_return(true)
-        expect {application.run}.to raise_error(/Module install is prohibited in FIPS mode./)
-      end 
-    end
-
   end
-
 end

data/spec/unit/network/http/factory_spec.rb

@@ -43,10 +43,11 @@ describe Puppet::Network::HTTP::Factory do
   context "proxy settings" do
     let(:proxy_host) { 'myhost' }
     let(:proxy_port) { 432 }
+    let(:proxy_user) { 'mo' }
+    let(:proxy_pass) { 'password' }
 
-    it "should not set a proxy if the value is 'none'" do
+    it "should not set a proxy if the http_proxy_host setting is 'none'" do
       Puppet[:http_proxy_host] = 'none'
-      expect(Puppet::Util::HttpProxy).to receive(:no_proxy?).and_return(false)
       conn = create_connection(site)
 
       expect(conn.proxy_address).to be_nil
@@ -55,7 +56,18 @@ describe Puppet::Network::HTTP::Factory do
     it 'should not set a proxy if a no_proxy env var matches the destination' do
       Puppet[:http_proxy_host] = proxy_host
       Puppet[:http_proxy_port] = proxy_port
-      expect(Puppet::Util::HttpProxy).to receive(:no_proxy?).and_return(true)
+      Puppet::Util.withenv('NO_PROXY' => site.host) do
+        conn = create_connection(site)
+
+        expect(conn.proxy_address).to be_nil
+        expect(conn.proxy_port).to be_nil
+      end
+    end
+
+    it 'should not set a proxy if the no_proxy setting matches the destination' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      Puppet[:no_proxy] = site.host
       conn = create_connection(site)
 
       expect(conn.proxy_address).to be_nil
@@ -64,7 +76,6 @@ describe Puppet::Network::HTTP::Factory do
 
     it 'sets proxy_address' do
       Puppet[:http_proxy_host] = proxy_host
-      expect(Puppet::Util::HttpProxy).to receive(:no_proxy?).and_return(false)
       conn = create_connection(site)
 
       expect(conn.proxy_address).to eq(proxy_host)
@@ -73,11 +84,22 @@ describe Puppet::Network::HTTP::Factory do
     it 'sets proxy address and port' do
       Puppet[:http_proxy_host] = proxy_host
       Puppet[:http_proxy_port] = proxy_port
-      expect(Puppet::Util::HttpProxy).to receive(:no_proxy?).and_return(false)
       conn = create_connection(site)
 
       expect(conn.proxy_port).to eq(proxy_port)
     end
+
+    it 'sets proxy user and password' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      Puppet[:http_proxy_user] = proxy_user
+      Puppet[:http_proxy_password] = proxy_pass
+
+      conn = create_connection(site)
+
+      expect(conn.proxy_user).to eq(proxy_user)
+      expect(conn.proxy_pass).to eq(proxy_pass)
+    end
   end
 
   context 'socket timeouts' do

data/spec/unit/provider/package/dpkg_spec.rb

@@ -8,6 +8,7 @@ describe Puppet::Type.type(:package).provider(:dpkg) do
   let(:vim_installed_output) { "install ok installed vim 2:7.3.547-6ubuntu5\n" }
   let(:all_installed_io) { StringIO.new([bash_installed_output, vim_installed_output].join) }
   let(:args) { ['-W', '--showformat', %Q{'${Status} ${Package} ${Version}\\n'}] }
+  let(:args_with_provides) { ['/bin/dpkg-query','-W', '--showformat', %Q{'${Status} ${Package} ${Version} [${Provides}]\\n'}]}
   let(:execute_options) do
     {:failonfail => true, :combine => true, :custom_environment => {}}
   end
@@ -31,7 +32,6 @@ describe Puppet::Type.type(:package).provider(:dpkg) do
 
       installed = double('bash')
       expect(described_class).to receive(:new).with(:ensure => "4.2-5ubuntu3", :error => "ok", :desired => "install", :name => "bash", :status => "installed", :provider => :dpkg).and_return(installed)
-
       expect(described_class.instances).to eq([installed])
     end
 
@@ -68,31 +68,59 @@ describe Puppet::Type.type(:package).provider(:dpkg) do
       expect(Puppet::Util::Execution).to receive(:execute).with(query_args, execute_options).and_return(Puppet::Util::Execution::ProcessOutput.new(output, 0))
     end
 
+    def dpkg_query_execution_with_multiple_args_returns(output, *args)
+      args.each do |arg|
+        expect(Puppet::Util::Execution).to receive(:execute).with(arg, execute_options).ordered.and_return(Puppet::Util::Execution::ProcessOutput.new(output, 0))
+      end
+    end
+
     before do
       allow(Puppet::Util).to receive(:which).with('/usr/bin/dpkg-query').and_return(dpkgquery_path)
+      allow(resource).to receive(:allow_virtual?).and_return(false)
     end
 
     it "considers the package purged if dpkg-query fails" do
       allow(Puppet::Util::Execution).to receive(:execute).with(query_args, execute_options).and_raise(Puppet::ExecutionFailure.new("eh"))
+      expect(provider.query[:ensure]).to eq(:purged)
+    end
 
+    it "considers the package purged if dpkg-query fails  with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      allow(Puppet::Util::Execution).to receive(:execute).with(args_with_provides, execute_options).and_raise(Puppet::ExecutionFailure.new("eh"))
       expect(provider.query[:ensure]).to eq(:purged)
     end
 
     it "returns a hash of the found package status for an installed package" do
       dpkg_query_execution_returns(bash_installed_output)
+      expect(provider.query).to eq({:ensure => "4.2-5ubuntu3", :error => "ok", :desired => "install", :name => "bash", :status => "installed", :provider => :dpkg})
+    end
 
+    it "returns a hash of the found package status for an installed package with allo_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      dpkg_query_execution_with_multiple_args_returns(bash_installed_output,args_with_provides,query_args)
       expect(provider.query).to eq({:ensure => "4.2-5ubuntu3", :error => "ok", :desired => "install", :name => "bash", :status => "installed", :provider => :dpkg})
     end
 
     it "considers the package absent if the dpkg-query result cannot be interpreted" do
+      allow(resource).to receive(:allow_virtual?).and_return(false)
       dpkg_query_execution_returns('some-bad-data')
+      expect(provider.query[:ensure]).to eq(:absent)
+    end
 
+    it "considers the package absent if the dpkg-query result cannot be interpreted  with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      dpkg_query_execution_with_multiple_args_returns('some-bad-data',args_with_provides,query_args)
       expect(provider.query[:ensure]).to eq(:absent)
     end
 
     it "fails if an error is discovered" do
       dpkg_query_execution_returns(bash_installed_output.gsub("ok","error"))
+      expect { provider.query }.to raise_error(Puppet::Error)
+    end
 
+    it "fails if an error is discovered with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      dpkg_query_execution_with_multiple_args_returns(bash_installed_output.gsub("ok","error"),args_with_provides,query_args)
       expect { provider.query }.to raise_error(Puppet::Error)
     end
 
@@ -100,35 +128,74 @@ describe Puppet::Type.type(:package).provider(:dpkg) do
       not_installed_bash = bash_installed_output.gsub("installed", "not-installed")
       not_installed_bash.gsub!(bash_version, "")
       dpkg_query_execution_returns(not_installed_bash)
+      expect(provider.query[:ensure]).to eq(:purged)
+    end
 
+    it "considers the package purged if it is marked 'not-installed' with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      not_installed_bash = bash_installed_output.gsub("installed", "not-installed")
+      not_installed_bash.gsub!(bash_version, "")
+      dpkg_query_execution_with_multiple_args_returns(not_installed_bash,args_with_provides,query_args)
       expect(provider.query[:ensure]).to eq(:purged)
     end
 
+
     it "considers the package absent if it is marked 'config-files'" do
       dpkg_query_execution_returns(bash_installed_output.gsub("installed","config-files"))
       expect(provider.query[:ensure]).to eq(:absent)
     end
 
+    it "considers the package absent if it is marked 'config-files' with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      dpkg_query_execution_with_multiple_args_returns(bash_installed_output.gsub("installed","config-files"),args_with_provides,query_args)
+      expect(provider.query[:ensure]).to eq(:absent)
+    end
+
     it "considers the package absent if it is marked 'half-installed'" do
       dpkg_query_execution_returns(bash_installed_output.gsub("installed","half-installed"))
       expect(provider.query[:ensure]).to eq(:absent)
     end
 
+    it "considers the package absent if it is marked 'half-installed' with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      dpkg_query_execution_with_multiple_args_returns(bash_installed_output.gsub("installed","half-installed"),args_with_provides,query_args)
+      expect(provider.query[:ensure]).to eq(:absent)
+    end
+
     it "considers the package absent if it is marked 'unpacked'" do
       dpkg_query_execution_returns(bash_installed_output.gsub("installed","unpacked"))
       expect(provider.query[:ensure]).to eq(:absent)
     end
 
+
+    it "considers the package absent if it is marked 'unpacked' with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      dpkg_query_execution_with_multiple_args_returns(bash_installed_output.gsub("installed","unpacked"),args_with_provides,query_args)
+      expect(provider.query[:ensure]).to eq(:absent)
+    end
+
     it "considers the package absent if it is marked 'half-configured'" do
       dpkg_query_execution_returns(bash_installed_output.gsub("installed","half-configured"))
       expect(provider.query[:ensure]).to eq(:absent)
     end
 
+    it "considers the package absent if it is marked 'half-configured' with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      dpkg_query_execution_with_multiple_args_returns(bash_installed_output.gsub("installed","half-configured"),args_with_provides,query_args)      
+      expect(provider.query[:ensure]).to eq(:absent)
+    end
+
     it "considers the package held if its state is 'hold'" do
       dpkg_query_execution_returns(bash_installed_output.gsub("install","hold"))
       expect(provider.query[:ensure]).to eq(:held)
     end
 
+    it "considers the package held if its state is 'hold' with allow_virtual enabled" do
+      allow(resource).to receive(:allow_virtual?).and_return(true)
+      dpkg_query_execution_with_multiple_args_returns(bash_installed_output.gsub("install","hold"),args_with_provides,query_args)
+      expect(provider.query[:ensure]).to eq(:held)
+    end
+
     context "parsing tests" do
       let(:resource_name) { 'name' }
       let(:package_hash) do
@@ -144,6 +211,7 @@ describe Puppet::Type.type(:package).provider(:dpkg) do
       let(:package_not_found_hash) do
         {:ensure => :purged, :status => 'missing', :name => resource_name, :error => 'ok'}
       end
+      let(:output) {'an unexpected dpkg msg with an exit code of 0'}
 
       def parser_test(dpkg_output_string, gold_hash, number_of_debug_logs = 0)
         dpkg_query_execution_returns(dpkg_output_string)
@@ -157,20 +225,33 @@ describe Puppet::Type.type(:package).provider(:dpkg) do
         no_ensure = 'desired ok status name '
         parser_test(no_ensure, package_hash.merge(:ensure => ''))
       end
+      it "provides debug logging of unparsable lines with allow_virtual enabled" do
+        allow(resource).to receive(:allow_virtual?).and_return(true)
+        dpkg_query_execution_with_multiple_args_returns(output, args_with_provides, query_args)
+        expect(Puppet).not_to receive(:warning)
+        expect(Puppet).to receive(:debug).exactly(1).times
+        expect(provider.query).to eq(package_not_found_hash.merge(:ensure => :absent))
+      end
+      
 
       it "provides debug logging of unparsable lines" do
         parser_test('an unexpected dpkg msg with an exit code of 0', package_not_found_hash.merge(:ensure => :absent), 1)
       end
+      
+      it "does not log if execution returns with non-zero exit code with allow_virtual enabled" do
+        allow(resource).to receive(:allow_virtual?).and_return(true)
+        expect(Puppet::Util::Execution).to receive(:execute).with(args_with_provides, execute_options).ordered.and_raise(Puppet::ExecutionFailure.new("failed"))
+        expect(Puppet).not_to receive(:debug)
+        expect(provider.query).to eq(package_not_found_hash)
+      end
 
       it "does not log if execution returns with non-zero exit code" do
         expect(Puppet::Util::Execution).to receive(:execute).with(query_args, execute_options).and_raise(Puppet::ExecutionFailure.new("failed"))
         expect(Puppet).not_to receive(:debug)
-
         expect(provider.query).to eq(package_not_found_hash)
       end
     end
   end
-
   context "when installing" do
     before do
       allow(resource).to receive(:[]).with(:source).and_return("mypkg")
@@ -292,4 +373,3 @@ describe Puppet::Type.type(:package).provider(:dpkg) do
     expect {provider.package_not_installed?("")}.to raise_error(ArgumentError,"Package name is nil or empty")
   end
 end
-