puppet 7.15.0-x64-mingw32 → 7.18.0-x64-mingw32
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile.lock +75 -14
- data/ext/systemd/puppet.service +1 -1
- data/lib/puppet/agent.rb +47 -11
- data/lib/puppet/application/agent.rb +3 -13
- data/lib/puppet/application/apply.rb +2 -2
- data/lib/puppet/configurer.rb +1 -1
- data/lib/puppet/defaults.rb +11 -1
- data/lib/puppet/http/client.rb +22 -2
- data/lib/puppet/info_service/task_information_service.rb +1 -1
- data/lib/puppet/module/task.rb +5 -1
- data/lib/puppet/parameter.rb +19 -4
- data/lib/puppet/pops/evaluator/deferred_resolver.rb +46 -6
- data/lib/puppet/pops/functions/dispatcher.rb +10 -6
- data/lib/puppet/pops/loader/ruby_legacy_function_instantiator.rb +7 -6
- data/lib/puppet/pops/types/type_mismatch_describer.rb +22 -1
- data/lib/puppet/provider/package/puppetserver_gem.rb +7 -16
- data/lib/puppet/provider/package/yum.rb +8 -3
- data/lib/puppet/provider/user/directoryservice.rb +15 -8
- data/lib/puppet/ssl/ssl_provider.rb +75 -19
- data/lib/puppet/ssl/state_machine.rb +13 -17
- data/lib/puppet/transaction.rb +22 -0
- data/lib/puppet/type/user.rb +3 -0
- data/lib/puppet/type.rb +20 -3
- data/lib/puppet/version.rb +1 -1
- data/lib/puppet.rb +1 -14
- data/man/man5/puppet.conf.5 +11 -3
- data/man/man8/puppet-agent.8 +2 -2
- data/man/man8/puppet-apply.8 +1 -1
- data/man/man8/puppet-catalog.8 +1 -1
- data/man/man8/puppet-config.8 +1 -1
- data/man/man8/puppet-describe.8 +1 -1
- data/man/man8/puppet-device.8 +1 -1
- data/man/man8/puppet-doc.8 +1 -1
- data/man/man8/puppet-epp.8 +1 -1
- data/man/man8/puppet-facts.8 +1 -1
- data/man/man8/puppet-filebucket.8 +1 -1
- data/man/man8/puppet-generate.8 +1 -1
- data/man/man8/puppet-help.8 +1 -1
- data/man/man8/puppet-lookup.8 +1 -1
- data/man/man8/puppet-module.8 +1 -1
- data/man/man8/puppet-node.8 +1 -1
- data/man/man8/puppet-parser.8 +1 -1
- data/man/man8/puppet-plugin.8 +1 -1
- data/man/man8/puppet-report.8 +1 -1
- data/man/man8/puppet-resource.8 +1 -1
- data/man/man8/puppet-script.8 +1 -1
- data/man/man8/puppet-ssl.8 +1 -1
- data/man/man8/puppet.8 +2 -2
- data/spec/integration/application/agent_spec.rb +157 -0
- data/spec/integration/application/apply_spec.rb +74 -0
- data/spec/integration/http/client_spec.rb +51 -4
- data/spec/lib/puppet_spec/https.rb +1 -1
- data/spec/lib/puppet_spec/puppetserver.rb +39 -2
- data/spec/unit/agent_spec.rb +28 -2
- data/spec/unit/application/agent_spec.rb +26 -16
- data/spec/unit/daemon_spec.rb +2 -11
- data/spec/unit/http/client_spec.rb +18 -0
- data/spec/unit/info_service_spec.rb +11 -3
- data/spec/unit/pops/evaluator/deferred_resolver_spec.rb +26 -0
- data/spec/unit/pops/loaders/loaders_spec.rb +1 -1
- data/spec/unit/pops/types/type_mismatch_describer_spec.rb +167 -1
- data/spec/unit/provider/package/puppetserver_gem_spec.rb +2 -2
- data/spec/unit/provider/user/directoryservice_spec.rb +1 -1
- data/spec/unit/ssl/ssl_provider_spec.rb +75 -1
- data/spec/unit/ssl/state_machine_spec.rb +1 -0
- data/spec/unit/task_spec.rb +56 -13
- data/tasks/generate_cert_fixtures.rake +5 -4
- metadata +2 -2
data/spec/unit/agent_spec.rb
CHANGED
@@ -36,6 +36,10 @@ describe Puppet::Agent do
|
|
36
36
|
end
|
37
37
|
end
|
38
38
|
end
|
39
|
+
|
40
|
+
ssl_context = Puppet::SSL::SSLContext.new
|
41
|
+
machine = instance_double("Puppet::SSL::StateMachine", ensure_client_certificate: ssl_context)
|
42
|
+
allow(Puppet::SSL::StateMachine).to receive(:new).and_return(machine)
|
39
43
|
end
|
40
44
|
|
41
45
|
after do
|
@@ -97,6 +101,8 @@ describe Puppet::Agent do
|
|
97
101
|
end
|
98
102
|
|
99
103
|
it "should splay" do
|
104
|
+
Puppet[:splay] = true
|
105
|
+
|
100
106
|
expect(@agent).to receive(:splay)
|
101
107
|
|
102
108
|
@agent.run
|
@@ -179,6 +185,26 @@ describe Puppet::Agent do
|
|
179
185
|
expect(@agent.run).to eq(:result)
|
180
186
|
end
|
181
187
|
|
188
|
+
it "should check if it's disabled after splaying and log a message" do
|
189
|
+
Puppet[:splay] = true
|
190
|
+
Puppet[:splaylimit] = '5s'
|
191
|
+
Puppet[:onetime] = true
|
192
|
+
|
193
|
+
expect(@agent).to receive(:disabled?).and_return(false, true)
|
194
|
+
|
195
|
+
allow(Puppet).to receive(:notice).and_call_original
|
196
|
+
expect(Puppet).to receive(:notice).with(/Skipping run of .*; administratively disabled.*/)
|
197
|
+
@agent.run
|
198
|
+
end
|
199
|
+
|
200
|
+
it "should check if it's disabled after acquiring the lock and log a message" do
|
201
|
+
expect(@agent).to receive(:disabled?).and_return(false, true)
|
202
|
+
|
203
|
+
allow(Puppet).to receive(:notice).and_call_original
|
204
|
+
expect(Puppet).to receive(:notice).with(/Skipping run of .*; administratively disabled.*/)
|
205
|
+
@agent.run
|
206
|
+
end
|
207
|
+
|
182
208
|
describe "and a puppet agent is already running" do
|
183
209
|
before(:each) do
|
184
210
|
allow_any_instance_of(Object).to receive(:sleep)
|
@@ -195,7 +221,7 @@ describe Puppet::Agent do
|
|
195
221
|
@agent.run
|
196
222
|
end
|
197
223
|
|
198
|
-
it "should inform that a run is already in
|
224
|
+
it "should inform that a run is already in progress and try to run every X seconds if waitforlock is used" do
|
199
225
|
# so the locked file exists
|
200
226
|
allow(File).to receive(:file?).and_return(true)
|
201
227
|
# so we don't have to wait again for the run to exit (default maxwaitforcert is 60)
|
@@ -224,7 +250,7 @@ describe Puppet::Agent do
|
|
224
250
|
@agent.run
|
225
251
|
end
|
226
252
|
end
|
227
|
-
|
253
|
+
|
228
254
|
describe "when should_fork is true", :if => Puppet.features.posix? && RUBY_PLATFORM != 'java' do
|
229
255
|
before do
|
230
256
|
@agent = Puppet::Agent.new(AgentTestClient, true)
|
@@ -4,6 +4,11 @@ require 'puppet/agent'
|
|
4
4
|
require 'puppet/application/agent'
|
5
5
|
require 'puppet/daemon'
|
6
6
|
|
7
|
+
class TestAgentClientClass
|
8
|
+
def initialize(transaction_uuid = nil, job_id = nil); end
|
9
|
+
def run(options = {}); end
|
10
|
+
end
|
11
|
+
|
7
12
|
describe Puppet::Application::Agent do
|
8
13
|
include PuppetSpec::Files
|
9
14
|
|
@@ -12,13 +17,20 @@ describe Puppet::Application::Agent do
|
|
12
17
|
before :each do
|
13
18
|
@puppetd = Puppet::Application[:agent]
|
14
19
|
|
15
|
-
@
|
20
|
+
@client = TestAgentClientClass.new
|
21
|
+
allow(TestAgentClientClass).to receive(:new).and_return(@client)
|
22
|
+
|
23
|
+
@agent = Puppet::Agent.new(TestAgentClientClass, false)
|
16
24
|
allow(Puppet::Agent).to receive(:new).and_return(@agent)
|
17
25
|
|
18
|
-
|
26
|
+
Puppet[:pidfile] = tmpfile('pidfile')
|
27
|
+
@daemon = Puppet::Daemon.new(@agent, Puppet::Util::Pidlock.new(Puppet[:pidfile]))
|
19
28
|
allow(@daemon).to receive(:daemonize)
|
20
|
-
allow(@daemon).to receive(:start)
|
21
29
|
allow(@daemon).to receive(:stop)
|
30
|
+
# simulate one run so we don't infinite looptwo runs of the agent, then return so we don't infinite loop
|
31
|
+
allow(@daemon).to receive(:run_event_loop) do
|
32
|
+
@agent.run(splay: false)
|
33
|
+
end
|
22
34
|
allow(Puppet::Daemon).to receive(:new).and_return(@daemon)
|
23
35
|
Puppet[:daemonize] = false
|
24
36
|
|
@@ -92,10 +104,6 @@ describe Puppet::Application::Agent do
|
|
92
104
|
end
|
93
105
|
|
94
106
|
describe "when handling options" do
|
95
|
-
before do
|
96
|
-
allow(@puppetd.command_line).to receive(:args).and_return([])
|
97
|
-
end
|
98
|
-
|
99
107
|
[:enable, :debug, :fqdn, :test, :verbose, :digest].each do |option|
|
100
108
|
it "should declare handle_#{option} method" do
|
101
109
|
expect(@puppetd).to respond_to("handle_#{option}".to_sym)
|
@@ -127,32 +135,34 @@ describe Puppet::Application::Agent do
|
|
127
135
|
end
|
128
136
|
|
129
137
|
it "should set waitforcert to 0 with --onetime and if --waitforcert wasn't given" do
|
130
|
-
allow(@
|
138
|
+
allow(@client).to receive(:run).and_return(2)
|
131
139
|
Puppet[:onetime] = true
|
132
140
|
|
133
|
-
expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 0).and_return(machine)
|
141
|
+
expect(Puppet::SSL::StateMachine).to receive(:new).with(hash_including(waitforcert: 0)).and_return(machine)
|
134
142
|
|
135
143
|
expect { execute_agent }.to exit_with 0
|
136
144
|
end
|
137
145
|
|
138
146
|
it "should use supplied waitforcert when --onetime is specified" do
|
139
|
-
allow(@
|
147
|
+
allow(@client).to receive(:run).and_return(2)
|
140
148
|
Puppet[:onetime] = true
|
141
149
|
@puppetd.handle_waitforcert(60)
|
142
150
|
|
143
|
-
expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 60).and_return(machine)
|
151
|
+
expect(Puppet::SSL::StateMachine).to receive(:new).with(hash_including(waitforcert: 60)).and_return(machine)
|
144
152
|
|
145
153
|
expect { execute_agent }.to exit_with 0
|
146
154
|
end
|
147
155
|
|
148
156
|
it "should use a default value for waitforcert when --onetime and --waitforcert are not specified" do
|
149
|
-
|
157
|
+
allow(@client).to receive(:run).and_return(2)
|
158
|
+
|
159
|
+
expect(Puppet::SSL::StateMachine).to receive(:new).with(hash_including(waitforcert: 120)).and_return(machine)
|
150
160
|
|
151
161
|
execute_agent
|
152
162
|
end
|
153
163
|
|
154
164
|
it "should register ssl OIDs" do
|
155
|
-
expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 120).and_return(
|
165
|
+
expect(Puppet::SSL::StateMachine).to receive(:new).with(hash_including(waitforcert: 120)).and_return(machine)
|
156
166
|
expect(Puppet::SSL::Oids).to receive(:register_puppet_oids)
|
157
167
|
|
158
168
|
execute_agent
|
@@ -161,7 +171,7 @@ describe Puppet::Application::Agent do
|
|
161
171
|
it "should use the waitforcert setting when checking for a signed certificate" do
|
162
172
|
Puppet[:waitforcert] = 10
|
163
173
|
|
164
|
-
expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 10).and_return(machine)
|
174
|
+
expect(Puppet::SSL::StateMachine).to receive(:new).with(hash_including(waitforcert: 10)).and_return(machine)
|
165
175
|
|
166
176
|
execute_agent
|
167
177
|
end
|
@@ -413,9 +423,9 @@ describe Puppet::Application::Agent do
|
|
413
423
|
end
|
414
424
|
|
415
425
|
it "should wait for a certificate" do
|
416
|
-
|
426
|
+
Puppet[:waitforcert] = 123
|
417
427
|
|
418
|
-
expect(Puppet::SSL::StateMachine).to receive(:new).with(waitforcert: 123).and_return(machine)
|
428
|
+
expect(Puppet::SSL::StateMachine).to receive(:new).with(hash_including(waitforcert: 123)).and_return(machine)
|
419
429
|
|
420
430
|
execute_agent
|
421
431
|
end
|
data/spec/unit/daemon_spec.rb
CHANGED
@@ -1,6 +1,7 @@
|
|
1
1
|
require 'spec_helper'
|
2
2
|
require 'puppet/daemon'
|
3
3
|
require 'puppet/agent'
|
4
|
+
require 'puppet/configurer'
|
4
5
|
|
5
6
|
def without_warnings
|
6
7
|
flag = $VERBOSE
|
@@ -9,12 +10,6 @@ def without_warnings
|
|
9
10
|
$VERBOSE = flag
|
10
11
|
end
|
11
12
|
|
12
|
-
class TestClient
|
13
|
-
def lockfile_path
|
14
|
-
"/dev/null"
|
15
|
-
end
|
16
|
-
end
|
17
|
-
|
18
13
|
describe Puppet::Daemon, :unless => Puppet::Util::Platform.windows? do
|
19
14
|
include PuppetSpec::Files
|
20
15
|
|
@@ -26,7 +21,7 @@ describe Puppet::Daemon, :unless => Puppet::Util::Platform.windows? do
|
|
26
21
|
end
|
27
22
|
end
|
28
23
|
|
29
|
-
let(:agent) { Puppet::Agent.new(
|
24
|
+
let(:agent) { Puppet::Agent.new(Puppet::Configurer, false) }
|
30
25
|
let(:server) { double("Server", :start => nil, :wait_for_shutdown => nil) }
|
31
26
|
|
32
27
|
let(:pidfile) { double("PidFile", :lock => true, :unlock => true, :file_path => 'fake.pid') }
|
@@ -131,10 +126,6 @@ describe Puppet::Daemon, :unless => Puppet::Util::Platform.windows? do
|
|
131
126
|
end
|
132
127
|
|
133
128
|
describe "when reloading" do
|
134
|
-
it "should do nothing if no agent is configured" do
|
135
|
-
daemon.reload
|
136
|
-
end
|
137
|
-
|
138
129
|
it "should do nothing if the agent is running" do
|
139
130
|
expect(agent).to receive(:run).with({:splay => false}).and_raise(Puppet::LockError, 'Failed to aquire lock')
|
140
131
|
expect(Puppet).to receive(:notice).with('Not triggering already-running agent')
|
@@ -120,6 +120,24 @@ describe Puppet::HTTP::Client do
|
|
120
120
|
|
121
121
|
client.close
|
122
122
|
end
|
123
|
+
|
124
|
+
it 'reloads the default ssl context' do
|
125
|
+
expect(client.pool).to receive(:with_connection) do |_, verifier|
|
126
|
+
expect(verifier.ssl_context).to_not equal(puppet_context)
|
127
|
+
end
|
128
|
+
|
129
|
+
client.close
|
130
|
+
client.connect(uri)
|
131
|
+
end
|
132
|
+
|
133
|
+
it 'reloads the default system ssl context' do
|
134
|
+
expect(client.pool).to receive(:with_connection) do |_, verifier|
|
135
|
+
expect(verifier.ssl_context).to_not equal(system_context)
|
136
|
+
end
|
137
|
+
|
138
|
+
client.close
|
139
|
+
client.connect(uri, options: {include_system_store: true})
|
140
|
+
end
|
123
141
|
end
|
124
142
|
|
125
143
|
context "for GET requests" do
|
@@ -11,6 +11,9 @@ describe "Puppet::InfoService" do
|
|
11
11
|
|
12
12
|
context 'task information service' do
|
13
13
|
let(:mod_name) { 'test1' }
|
14
|
+
let(:metadata) {
|
15
|
+
{ "private" => true,
|
16
|
+
"description" => "a task that does a thing" } }
|
14
17
|
let(:task_name) { "#{mod_name}::thingtask" }
|
15
18
|
let(:modpath) { tmpdir('modpath') }
|
16
19
|
let(:env_name) { 'testing' }
|
@@ -20,8 +23,13 @@ describe "Puppet::InfoService" do
|
|
20
23
|
context 'tasks_per_environment method' do
|
21
24
|
it "returns task data for the tasks in an environment" do
|
22
25
|
Puppet.override(:environments => env_loader) do
|
23
|
-
PuppetSpec::Modules.create(mod_name, modpath, {:environment => env,
|
24
|
-
|
26
|
+
PuppetSpec::Modules.create(mod_name, modpath, {:environment => env,
|
27
|
+
:tasks => [['thingtask',
|
28
|
+
{:name => 'thingtask.json',
|
29
|
+
:content => metadata.to_json}]]})
|
30
|
+
expect(Puppet::InfoService.tasks_per_environment(env_name)).to eq([{:name => task_name,
|
31
|
+
:module => {:name => mod_name},
|
32
|
+
:metadata => metadata} ])
|
25
33
|
end
|
26
34
|
end
|
27
35
|
|
@@ -207,7 +215,7 @@ describe "Puppet::InfoService" do
|
|
207
215
|
end
|
208
216
|
end
|
209
217
|
end
|
210
|
-
|
218
|
+
|
211
219
|
context 'plan information service' do
|
212
220
|
let(:mod_name) { 'test1' }
|
213
221
|
let(:plan_name) { "#{mod_name}::thingplan" }
|
@@ -17,4 +17,30 @@ describe Puppet::Pops::Evaluator::DeferredResolver do
|
|
17
17
|
|
18
18
|
expect(catalog.resource(:notify, 'deferred')[:message]).to eq('1:2:3')
|
19
19
|
end
|
20
|
+
|
21
|
+
it 'lazily resolves deferred values in a catalog' do
|
22
|
+
catalog = compile_to_catalog(<<~END)
|
23
|
+
notify { "deferred":
|
24
|
+
message => Deferred("join", [[1,2,3], ":"])
|
25
|
+
}
|
26
|
+
END
|
27
|
+
described_class.resolve_and_replace(facts, catalog, environment, false)
|
28
|
+
|
29
|
+
deferred = catalog.resource(:notify, 'deferred')[:message]
|
30
|
+
expect(deferred.resolve).to eq('1:2:3')
|
31
|
+
end
|
32
|
+
|
33
|
+
it 'lazily resolves nested deferred values in a catalog' do
|
34
|
+
catalog = compile_to_catalog(<<~END)
|
35
|
+
$args = Deferred("inline_epp", ["<%= 'a,b,c' %>"])
|
36
|
+
notify { "deferred":
|
37
|
+
message => Deferred("split", [$args, ","])
|
38
|
+
}
|
39
|
+
END
|
40
|
+
described_class.resolve_and_replace(facts, catalog, environment, false)
|
41
|
+
|
42
|
+
deferred = catalog.resource(:notify, 'deferred')[:message]
|
43
|
+
expect(deferred.resolve).to eq(["a", "b", "c"])
|
44
|
+
end
|
45
|
+
|
20
46
|
end
|
@@ -606,7 +606,7 @@ describe 'loaders' do
|
|
606
606
|
it "an illegal function is loaded" do
|
607
607
|
expect {
|
608
608
|
loader.load_typed(typed_name(:function, 'bad_func_load3')).value
|
609
|
-
}.to raise_error(SecurityError, /Illegal method definition of method 'bad_func_load3_illegal_method' on line 8 in legacy function/)
|
609
|
+
}.to raise_error(SecurityError, /Illegal method definition of method 'bad_func_load3_illegal_method' in source .*bad_func_load3.rb on line 8 in legacy function/)
|
610
610
|
end
|
611
611
|
end
|
612
612
|
|
@@ -1,12 +1,178 @@
|
|
1
1
|
require 'spec_helper'
|
2
2
|
require 'puppet/pops'
|
3
3
|
require 'puppet_spec/compiler'
|
4
|
+
require 'puppet_spec/files'
|
5
|
+
require 'puppet/loaders'
|
4
6
|
|
5
7
|
module Puppet::Pops
|
6
8
|
module Types
|
7
9
|
|
8
10
|
describe 'the type mismatch describer' do
|
9
|
-
include PuppetSpec::Compiler
|
11
|
+
include PuppetSpec::Compiler, PuppetSpec::Files
|
12
|
+
|
13
|
+
context 'with deferred functions' do
|
14
|
+
let(:env_name) { 'spec' }
|
15
|
+
let(:code_dir) { Puppet[:environmentpath] }
|
16
|
+
let(:env_dir) { File.join(code_dir, env_name) }
|
17
|
+
let(:env) { Puppet::Node::Environment.create(env_name.to_sym, [File.join(populated_code_dir, env_name, 'modules')]) }
|
18
|
+
let(:node) { Puppet::Node.new('fooname', environment: env) }
|
19
|
+
let(:populated_code_dir) do
|
20
|
+
dir_contained_in(code_dir, env_name => env_content)
|
21
|
+
PuppetSpec::Files.record_tmp(env_dir)
|
22
|
+
code_dir
|
23
|
+
end
|
24
|
+
|
25
|
+
let(:env_content) {
|
26
|
+
{
|
27
|
+
'lib' => {
|
28
|
+
'puppet' => {
|
29
|
+
'functions' => {
|
30
|
+
'string_return.rb' => <<-RUBY.unindent,
|
31
|
+
Puppet::Functions.create_function(:string_return) do
|
32
|
+
dispatch :string_return do
|
33
|
+
param 'String', :arg1
|
34
|
+
return_type 'String'
|
35
|
+
end
|
36
|
+
def string_return(arg1)
|
37
|
+
arg1
|
38
|
+
end
|
39
|
+
end
|
40
|
+
RUBY
|
41
|
+
'variant_return.rb' => <<-RUBY.unindent,
|
42
|
+
Puppet::Functions.create_function(:variant_return) do
|
43
|
+
dispatch :variant_return do
|
44
|
+
param 'String', :arg1
|
45
|
+
return_type 'Variant[Integer,Float]'
|
46
|
+
end
|
47
|
+
def variant_return(arg1)
|
48
|
+
arg1
|
49
|
+
end
|
50
|
+
end
|
51
|
+
RUBY
|
52
|
+
'no_return.rb' => <<-RUBY.unindent,
|
53
|
+
Puppet::Functions.create_function(:no_return) do
|
54
|
+
dispatch :no_return do
|
55
|
+
param 'String', :arg1
|
56
|
+
end
|
57
|
+
def variant_return(arg1)
|
58
|
+
arg1
|
59
|
+
end
|
60
|
+
end
|
61
|
+
RUBY
|
62
|
+
}
|
63
|
+
}
|
64
|
+
}
|
65
|
+
}
|
66
|
+
}
|
67
|
+
|
68
|
+
before(:each) do
|
69
|
+
Puppet.push_context(:loaders => Puppet::Pops::Loaders.new(env))
|
70
|
+
end
|
71
|
+
|
72
|
+
after(:each) do
|
73
|
+
Puppet.pop_context
|
74
|
+
end
|
75
|
+
|
76
|
+
it 'will compile when the parameter type matches the function return_type' do
|
77
|
+
code = <<-CODE
|
78
|
+
$d = Deferred("string_return", ['/a/non/existing/path'])
|
79
|
+
class testclass(String $classparam) {
|
80
|
+
}
|
81
|
+
class { 'testclass':
|
82
|
+
classparam => $d
|
83
|
+
}
|
84
|
+
CODE
|
85
|
+
expect { eval_and_collect_notices(code, node) }.to_not raise_error
|
86
|
+
end
|
87
|
+
|
88
|
+
it "will compile when a Variant parameter's types matches the return type" do
|
89
|
+
code = <<-CODE
|
90
|
+
$d = Deferred("string_return", ['/a/non/existing/path'])
|
91
|
+
class testclass(Variant[String, Float] $classparam) {
|
92
|
+
}
|
93
|
+
class { 'testclass':
|
94
|
+
classparam => $d
|
95
|
+
}
|
96
|
+
CODE
|
97
|
+
expect { eval_and_collect_notices(code, node) }.to_not raise_error
|
98
|
+
end
|
99
|
+
|
100
|
+
it "will compile with a union of a Variant parameters' types and Variant return types" do
|
101
|
+
code = <<-CODE
|
102
|
+
$d = Deferred("variant_return", ['/a/non/existing/path'])
|
103
|
+
class testclass(Variant[Any,Float] $classparam) {
|
104
|
+
}
|
105
|
+
class { 'testclass':
|
106
|
+
classparam => $d
|
107
|
+
}
|
108
|
+
CODE
|
109
|
+
expect { eval_and_collect_notices(code, node) }.to_not raise_error
|
110
|
+
end
|
111
|
+
|
112
|
+
it 'will warn when there is no defined return_type for the function definition' do
|
113
|
+
code = <<-CODE
|
114
|
+
$d = Deferred("no_return", ['/a/non/existing/path'])
|
115
|
+
class testclass(Variant[String,Boolean] $classparam) {
|
116
|
+
}
|
117
|
+
class { 'testclass':
|
118
|
+
classparam => $d
|
119
|
+
}
|
120
|
+
CODE
|
121
|
+
expect(Puppet).to receive(:warn_once).with(anything, anything, /.+function no_return has no return_type/).at_least(:once)
|
122
|
+
expect { eval_and_collect_notices(code, node) }.to_not raise_error
|
123
|
+
end
|
124
|
+
|
125
|
+
it 'will report a mismatch between a deferred function return type and class parameter value' do
|
126
|
+
code = <<-CODE
|
127
|
+
$d = Deferred("string_return", ['/a/non/existing/path'])
|
128
|
+
class testclass(Integer $classparam) {
|
129
|
+
}
|
130
|
+
class { 'testclass':
|
131
|
+
classparam => $d
|
132
|
+
}
|
133
|
+
CODE
|
134
|
+
expect { eval_and_collect_notices(code, node) }.to raise_error(Puppet::Error, /.+'classparam' expects an Integer value, got String/)
|
135
|
+
end
|
136
|
+
|
137
|
+
it 'will report an argument error when no matching arity is found' do
|
138
|
+
code = <<-CODE
|
139
|
+
$d = Deferred("string_return", ['/a/non/existing/path', 'second-invalid-arg'])
|
140
|
+
class testclass(Integer $classparam) {
|
141
|
+
}
|
142
|
+
class { 'testclass':
|
143
|
+
classparam => $d
|
144
|
+
}
|
145
|
+
CODE
|
146
|
+
expect { eval_and_collect_notices(code,node) }.to raise_error(Puppet::Error, /.+ No matching arity found for string_return/)
|
147
|
+
end
|
148
|
+
|
149
|
+
it 'will error with no matching Variant class parameters and return_type' do
|
150
|
+
code = <<-CODE
|
151
|
+
$d = Deferred("string_return", ['/a/non/existing/path'])
|
152
|
+
class testclass(Variant[Integer,Float] $classparam) {
|
153
|
+
}
|
154
|
+
class { 'testclass':
|
155
|
+
classparam => $d
|
156
|
+
}
|
157
|
+
CODE
|
158
|
+
expect { eval_and_collect_notices(code,node) }.to raise_error(Puppet::Error, /.+'classparam' expects a value of type Integer or Float, got String/)
|
159
|
+
end
|
160
|
+
|
161
|
+
# This test exposes a shortcoming in the #message function for Puppet::Pops::Type::TypeMismatch
|
162
|
+
# where the `actual` is not introspected for the list of Variant types, so the error message
|
163
|
+
# shows that the list of expected types does not match Variant, instead of a list of actual types.
|
164
|
+
it 'will error with no matching Variant class parameters and Variant return_type' do
|
165
|
+
code = <<-CODE
|
166
|
+
$d = Deferred("variant_return", ['/a/non/existing/path'])
|
167
|
+
class testclass(Variant[String,Boolean] $classparam) {
|
168
|
+
}
|
169
|
+
class { 'testclass':
|
170
|
+
classparam => $d
|
171
|
+
}
|
172
|
+
CODE
|
173
|
+
expect { eval_and_collect_notices(code, node) }.to raise_error(Puppet::Error, /.+'classparam' expects a value of type String or Boolean, got Variant/)
|
174
|
+
end
|
175
|
+
end
|
10
176
|
|
11
177
|
it 'will report a mismatch between a hash and a struct with details' do
|
12
178
|
code = <<-CODE
|
@@ -105,9 +105,9 @@ describe Puppet::Type.type(:package).provider(:puppetserver_gem) do
|
|
105
105
|
|
106
106
|
describe ".gemlist" do
|
107
107
|
context "listing installed packages" do
|
108
|
-
it "uses the
|
108
|
+
it "uses the puppet_gem provider_command to list local gems" do
|
109
109
|
expected = { name: 'world_airports', provider: :puppetserver_gem, ensure: ['1.1.3'] }
|
110
|
-
expect(described_class).to receive(:execute_rubygems_list_command).with(
|
110
|
+
expect(described_class).to receive(:execute_rubygems_list_command).with(['gem', 'list', '--local']).and_return(File.read(my_fixture('gem-list-local-packages')))
|
111
111
|
expect(described_class.gemlist({ local: true })).to include(expected)
|
112
112
|
end
|
113
113
|
end
|
@@ -840,7 +840,7 @@ end
|
|
840
840
|
expect(provider.class.get_salted_sha512_pbkdf2('iterations', pbkdf2_embedded_bplist_hash)).to be_a(Integer)
|
841
841
|
end
|
842
842
|
it "should raise an error if a field other than 'entropy', 'salt', or 'iterations' is passed" do
|
843
|
-
expect { provider.class.get_salted_sha512_pbkdf2('othervalue', pbkdf2_embedded_bplist_hash) }.to raise_error(Puppet::Error, /Puppet has tried to read an incorrect value from the SALTED-SHA512-PBKDF2 hash. Acceptable fields are 'salt', 'entropy', or 'iterations'/)
|
843
|
+
expect { provider.class.get_salted_sha512_pbkdf2('othervalue', pbkdf2_embedded_bplist_hash, 'test_user') }.to raise_error(Puppet::Error, /Puppet has tried to read an incorrect value from the user test_user in the SALTED-SHA512-PBKDF2 hash. Acceptable fields are 'salt', 'entropy', or 'iterations'/)
|
844
844
|
end
|
845
845
|
end
|
846
846
|
|
@@ -113,12 +113,21 @@ describe Puppet::SSL::SSLProvider do
|
|
113
113
|
}.to raise_error(/can't modify frozen/)
|
114
114
|
end
|
115
115
|
|
116
|
-
it 'trusts system ca store' do
|
116
|
+
it 'trusts system ca store by default' do
|
117
117
|
expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
|
118
118
|
|
119
119
|
subject.create_system_context(cacerts: [])
|
120
120
|
end
|
121
121
|
|
122
|
+
it 'trusts an external ca store' do
|
123
|
+
path = tmpfile('system_cacerts')
|
124
|
+
File.write(path, cert_fixture('ca.pem').to_pem)
|
125
|
+
|
126
|
+
expect_any_instance_of(OpenSSL::X509::Store).to receive(:add_file).with(path)
|
127
|
+
|
128
|
+
subject.create_system_context(cacerts: [], path: path)
|
129
|
+
end
|
130
|
+
|
122
131
|
it 'verifies peer' do
|
123
132
|
sslctx = subject.create_system_context(cacerts: [])
|
124
133
|
expect(sslctx.verify_peer).to eq(true)
|
@@ -135,6 +144,47 @@ describe Puppet::SSL::SSLProvider do
|
|
135
144
|
expect(sslctx.private_key).to be_nil
|
136
145
|
end
|
137
146
|
|
147
|
+
it 'includes the client cert and private key when requested' do
|
148
|
+
Puppet[:hostcert] = fixtures('ssl/signed.pem')
|
149
|
+
Puppet[:hostprivkey] = fixtures('ssl/signed-key.pem')
|
150
|
+
sslctx = subject.create_system_context(cacerts: [], include_client_cert: true)
|
151
|
+
expect(sslctx.client_cert).to be_an(OpenSSL::X509::Certificate)
|
152
|
+
expect(sslctx.private_key).to be_an(OpenSSL::PKey::RSA)
|
153
|
+
end
|
154
|
+
|
155
|
+
it 'ignores non-existent client cert and private key when requested' do
|
156
|
+
Puppet[:certname] = 'doesnotexist'
|
157
|
+
sslctx = subject.create_system_context(cacerts: [], include_client_cert: true)
|
158
|
+
expect(sslctx.client_cert).to be_nil
|
159
|
+
expect(sslctx.private_key).to be_nil
|
160
|
+
end
|
161
|
+
|
162
|
+
it 'warns if the client cert does not exist' do
|
163
|
+
Puppet[:certname] = 'missingcert'
|
164
|
+
Puppet[:hostprivkey] = fixtures('ssl/signed-key.pem')
|
165
|
+
|
166
|
+
expect(Puppet).to receive(:warning).with("Client certificate for 'missingcert' does not exist")
|
167
|
+
subject.create_system_context(cacerts: [], include_client_cert: true)
|
168
|
+
end
|
169
|
+
|
170
|
+
it 'warns if the private key does not exist' do
|
171
|
+
Puppet[:certname] = 'missingkey'
|
172
|
+
Puppet[:hostcert] = fixtures('ssl/signed.pem')
|
173
|
+
|
174
|
+
expect(Puppet).to receive(:warning).with("Private key for 'missingkey' does not exist")
|
175
|
+
subject.create_system_context(cacerts: [], include_client_cert: true)
|
176
|
+
end
|
177
|
+
|
178
|
+
it 'raises if client cert and private key are mismatched' do
|
179
|
+
Puppet[:hostcert] = fixtures('ssl/signed.pem')
|
180
|
+
Puppet[:hostprivkey] = fixtures('ssl/127.0.0.1-key.pem')
|
181
|
+
|
182
|
+
expect {
|
183
|
+
subject.create_system_context(cacerts: [], include_client_cert: true)
|
184
|
+
}.to raise_error(Puppet::SSL::SSLError,
|
185
|
+
"The certificate for 'CN=signed' does not match its private key")
|
186
|
+
end
|
187
|
+
|
138
188
|
it 'trusts additional system certs' do
|
139
189
|
path = tmpfile('system_cacerts')
|
140
190
|
File.write(path, cert_fixture('ca.pem').to_pem)
|
@@ -448,6 +498,18 @@ describe Puppet::SSL::SSLProvider do
|
|
448
498
|
sslctx = subject.create_context(**config)
|
449
499
|
expect(sslctx.verify_peer).to eq(true)
|
450
500
|
end
|
501
|
+
|
502
|
+
it 'does not trust the system ca store by default' do
|
503
|
+
expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths).never
|
504
|
+
|
505
|
+
subject.create_context(**config)
|
506
|
+
end
|
507
|
+
|
508
|
+
it 'trusts the system ca store' do
|
509
|
+
expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
|
510
|
+
|
511
|
+
subject.create_context(**config.merge(include_system_store: true))
|
512
|
+
end
|
451
513
|
end
|
452
514
|
|
453
515
|
context 'when loading an ssl context' do
|
@@ -530,6 +592,18 @@ describe Puppet::SSL::SSLProvider do
|
|
530
592
|
}.to raise_error(Puppet::SSL::SSLError, /Failed to load private key for host 'signed': Could not parse PKey/)
|
531
593
|
end
|
532
594
|
end
|
595
|
+
|
596
|
+
it 'does not trust the system ca store by default' do
|
597
|
+
expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths).never
|
598
|
+
|
599
|
+
subject.load_context
|
600
|
+
end
|
601
|
+
|
602
|
+
it 'trusts the system ca store' do
|
603
|
+
expect_any_instance_of(OpenSSL::X509::Store).to receive(:set_default_paths)
|
604
|
+
|
605
|
+
subject.load_context(include_system_store: true)
|
606
|
+
end
|
533
607
|
end
|
534
608
|
|
535
609
|
context 'when verifying requests' do
|
@@ -27,6 +27,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
|
|
27
27
|
let(:refused_message) { %r{Connection refused|No connection could be made because the target machine actively refused it} }
|
28
28
|
|
29
29
|
before(:each) do
|
30
|
+
Puppet[:daemonize] = false
|
30
31
|
Puppet[:ssl_lockfile] = tmpfile('ssllock')
|
31
32
|
allow(Kernel).to receive(:sleep)
|
32
33
|
end
|