puppet 7.24.0 → 8.1.0

data/spec/unit/resource/catalog_spec.rb

@@ -13,9 +13,9 @@ describe Puppet::Resource::Catalog, "when compiling" do
     allow(Puppet::Util::Storage).to receive(:store)
   end
 
-  it "should support json, pson, dot, yaml" do
-    # msgpack is optional, so using include instead of eq
-    expect(Puppet::Resource::Catalog.supported_formats).to include(:json, :pson, :dot, :yaml)
+  it "should support json, dot, yaml" do
+    # msgpack and pson are optional, so using include instead of eq
+    expect(Puppet::Resource::Catalog.supported_formats).to include(:json, :dot, :yaml)
   end
 
   # audit only resources are unmanaged
@@ -965,7 +965,8 @@ describe Puppet::Resource::Catalog, "when converting a resource catalog to json"
 
     context 'and rich_data is disabled' do
       before(:each) do
-        Puppet[:rich_data] = false
+        Puppet[:rich_data] = false 
+        Puppet[:strict] = :warning # do not want to stub out behavior in tests
       end
 
       let(:catalog_w_regexp)  { compile_to_catalog("notify {'foo': message => /[a-z]+/ }") }
@@ -1032,6 +1033,14 @@ describe Puppet::Resource::Catalog, "when converting a resource catalog to json"
         expect(message['a']).to eql(nil)
         expect(message['b']).to eql(10)
       end
+
+      it 'should raise an error by default when trying to convert parameter with rich data' do
+        Puppet[:strict] = :error
+        expect {
+          catalog = compile_to_catalog("notify {'foo': message => Timestamp('2016-09-15T08:32:16.123 UTC') }")
+          Puppet::Resource::Catalog.from_data_hash(JSON.parse(catalog.to_json)) 
+        }.to raise_error(/Evaluation Error: Notify\[foo\]\['message'\] contains a Puppet::Pops::Time::Timestamp value. It will be converted to the String '2016-09-15T08:32:16.123000000 UTC'/)
+      end
     end
   end
 end

data/spec/unit/ssl/certificate_request_spec.rb

@@ -198,7 +198,7 @@ describe Puppet::SSL::CertificateRequest do
 
         expect do
           request.generate(key, :csr_attributes => csr_attributes)
-        end.to raise_error Puppet::Error, /Cannot create CSR with attribute thats\.no\.moon: first num too large/
+        end.to raise_error Puppet::Error, /Cannot create CSR with attribute thats\.no\.moon: /
       end
 
       it "should support old non-DER encoded extensions" do
@@ -271,7 +271,7 @@ describe Puppet::SSL::CertificateRequest do
         exts = {"thats.no.moon" => "death star"}
         expect do
           request.generate(key, :extension_requests => exts)
-        end.to raise_error Puppet::Error, /Cannot create CSR with extension request thats\.no\.moon.*: first num too large/
+        end.to raise_error Puppet::Error, /Cannot create CSR with extension request thats\.no\.moon.*: /
       end
     end
 
@@ -313,6 +313,7 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should use SHA1 to sign the csr when SHA256 isn't available" do
       csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(true)
       signer = Puppet::SSL::CertificateSigner.new
@@ -323,6 +324,7 @@ describe Puppet::SSL::CertificateRequest do
     it "should use SHA512 to sign the csr when SHA256 and SHA1 aren't available" do
       key = OpenSSL::PKey::RSA.new(2048)
       csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(true)
@@ -334,6 +336,7 @@ describe Puppet::SSL::CertificateRequest do
     it "should use SHA384 to sign the csr when SHA256/SHA1/SHA512 aren't available" do
       key = OpenSSL::PKey::RSA.new(2048)
       csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)
@@ -345,6 +348,7 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should use SHA224 to sign the csr when SHA256/SHA1/SHA512/SHA384 aren't available" do
       csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -299,6 +299,7 @@ describe Puppet::SSL::SSLProvider do
     end
 
     it 'raises if client cert signature is invalid' do
+      client_cert.public_key = wrong_key.public_key
       client_cert.sign(wrong_key, OpenSSL::Digest::SHA256.new)
       expect {
         subject.create_context(**config.merge(client_cert: client_cert))
@@ -339,6 +340,7 @@ describe Puppet::SSL::SSLProvider do
 
     it 'raises if intermediate CA signature is invalid' do
       int = global_cacerts.last
+      int.public_key = wrong_key.public_key if Puppet::Util::Platform.jruby?
       int.sign(wrong_key, OpenSSL::Digest::SHA256.new)
 
       expect {
@@ -459,10 +461,13 @@ describe Puppet::SSL::SSLProvider do
     it "raises if root CA's isCA basic constraint is false", unless: Puppet::Util::Platform.jruby? || OpenSSL::OPENSSL_VERSION_NUMBER < 0x10100000 do
       certs = [cert_fixture('bad-basic-constraints.pem'), cert_fixture('intermediate.pem')]
 
+      # openssl 3 returns 79
+      # define X509_V_ERR_NO_ISSUER_PUBLIC_KEY                 24
+      # define X509_V_ERR_INVALID_CA                           79
       expect {
         subject.create_context(**config.merge(cacerts: certs, crls: [], revocation: false))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Certificate 'CN=Test CA' failed verification (24): invalid CA certificate")
+                       /Certificate 'CN=Test CA' failed verification \((24|79)\): invalid CA certificate/)
     end
 
     # OpenSSL < 1.1 does not verify basicConstraints
@@ -472,7 +477,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(**config.merge(cacerts: certs, crls: [], revocation: false))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Certificate 'CN=Test CA Subauthority' failed verification (24): invalid CA certificate")
+                       /Certificate 'CN=Test CA Subauthority' failed verification \((24|79)\): invalid CA certificate/)
     end
 
     it 'accepts CA certs in any order' do

data/spec/unit/ssl/state_machine_spec.rb

@@ -30,6 +30,9 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     Puppet[:daemonize] = false
     Puppet[:ssl_lockfile] = tmpfile('ssllock')
     allow(Kernel).to receive(:sleep)
+    future = Time.now + (5 * 60)
+    allow_any_instance_of(Puppet::X509::CertProvider).to receive(:crl_last_update).and_return(future)
+    allow_any_instance_of(Puppet::X509::CertProvider).to receive(:ca_last_update).and_return(future)
   end
 
   def expected_digest(name, content)
@@ -395,6 +398,16 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       expect(File).to_not exist(Puppet[:localcacert])
     end
 
+    it 'skips CA refresh if it has not expired' do
+      Puppet[:ca_refresh_interval] = '1y'
+      Puppet::FileSystem.touch(Puppet[:localcacert], mtime: Time.now)
+
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(cacerts)
+
+      # we're expecting a net/http request to never be made
+      state.next_state
+    end
+
     context 'when verifying CA cert bundle' do
       before :each do
         allow(cert_provider).to receive(:load_cacerts).and_return(nil)
@@ -435,6 +448,61 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         expect(st.message).to eq("CA bundle with digest (SHA256) #{fingerprint} did not match expected digest WR:ON:G!")
       end
     end
+
+    context 'when refreshing a CA bundle' do
+      before :each do
+        Puppet[:ca_refresh_interval] = '1s'
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(cacerts)
+
+        yesterday = Time.now - (24 * 60 * 60)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:ca_last_update).and_return(yesterday)
+      end
+
+      let(:new_ca_bundle) do
+        # add 'unknown' cert to the bundle
+        [cacert, cert_fixture('intermediate.pem'), cert_fixture('unknown-ca.pem')].map(&:to_pem)
+      end
+
+      it 'uses the local CA if it has not been modified' do
+        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 304)
+
+        expect(state.next_state.ssl_context.cacerts).to eq(cacerts)
+      end
+
+      it 'uses the local CA if refreshing fails in HTTP layer' do
+        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 503)
+
+        expect(state.next_state.ssl_context.cacerts).to eq(cacerts)
+      end
+
+      it 'uses the local CA if refreshing fails in TCP layer' do
+        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_raise(Errno::ECONNREFUSED)
+
+        expect(state.next_state.ssl_context.cacerts).to eq(cacerts)
+      end
+
+      it 'uses the updated crl for the future requests' do
+        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: new_ca_bundle.join)
+
+        expect(state.next_state.ssl_context.cacerts.map(&:to_pem)).to eq(new_ca_bundle)
+      end
+
+      it 'updates the `last_update` time' do
+        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: new_ca_bundle.join)
+
+        expect_any_instance_of(Puppet::X509::CertProvider).to receive(:ca_last_update=).with(be_within(60).of(Time.now))
+
+        state.next_state
+      end
+
+      it 'forces the NeedCRLs to refresh' do
+        stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: new_ca_bundle.join)
+
+        st = state.next_state
+        expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCRLs)
+        expect(st.force_crl_refresh).to eq(true)
+      end
+    end
   end
 
   context 'NeedCRLs' do
@@ -526,18 +594,13 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       expect(File).to_not exist(Puppet[:hostcrl])
     end
 
-    it 'skips CRL refresh by default' do
-      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
-
-      state.next_state
-    end
-
     it 'skips CRL refresh if it has not expired' do
       Puppet[:crl_refresh_interval] = '1y'
       Puppet::FileSystem.touch(Puppet[:hostcrl], mtime: Time.now)
 
       allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
 
+      # we're expecting a net/http request to never be made
       state.next_state
     end
 

data/spec/unit/test/test_helper_spec.rb

@@ -4,14 +4,14 @@ describe "TestHelper" do
   context "#after_each_test" do
     it "restores the original environment" do
       varname = 'test_helper_spec-test_variable'
-      Puppet::Util.set_env(varname, "\u16A0")
+      ENV[varname] = "\u16A0"
 
-      expect(Puppet::Util.get_env(varname)).to eq("\u16A0")
+      expect(ENV[varname]).to eq("\u16A0")
 
       # Prematurely trigger the after_each_test method
       Puppet::Test::TestHelper.after_each_test
 
-      expect(Puppet::Util::get_env(varname)).to be_nil
+      expect(ENV[varname]).to be_nil
     end
   end
-end
+end

data/spec/unit/transaction/report_spec.rb

@@ -138,14 +138,46 @@ describe Puppet::Transaction::Report do
   end
 
   describe "when exclude_unchanged_resources is true" do
+    let(:test_dir) { tmpdir('unchanged_resources') }
+    let(:test_dir2) { tmpdir('unchanged_resources') }
+    let(:test_file) { tmpfile('some_path')}
+    it 'should still list "changed" resource statuses but remove "unchanged"' do
+      transaction = apply_compiled_manifest(<<-END)
+        notify { "hi": } ~>
+        exec { "/bin/this_command_does_not_exist":
+          command => "#{make_absolute('/bin/this_command_does_not_exist')}",
+          refreshonly => true,
+        }
+        file { '#{test_dir}':
+          ensure => directory
+        }
+        file { 'failing_file':
+          path => '#{test_dir2}',
+          ensure => file
+        }
+        file { 'skipped_file':
+          path => '#{test_file}',
+          require => File[failing_file]
+        }
+      END
+      rs = transaction.report.to_data_hash['resource_statuses']
+      expect(rs["Notify[hi]"]['out_of_sync']).to be true
+      expect(rs["Exec[/bin/this_command_does_not_exist]"]['failed_to_restart']).to be true
+      expect(rs["File[failing_file]"]['failed']).to be true
+      expect(rs["File[skipped_file]"]['skipped']).to be true
+      expect(rs).to_not have_key(["File[#{test_dir}]"])
+    end
+  end
+
+  describe"when exclude_unchanged_resources is false" do
     before do
-      Puppet[:exclude_unchanged_resources] = true
+      Puppet[:exclude_unchanged_resources] = false
     end
 
     let(:test_dir) { tmpdir('unchanged_resources') }
     let(:test_dir2) { tmpdir('unchanged_resources') }
     let(:test_file) { tmpfile('some_path')}
-    it 'should still list "changed" resource statuses but remove "unchanged"' do
+    it 'should list all resource statuses' do
       transaction = apply_compiled_manifest(<<-END)
         notify { "hi": } ~>
         exec { "/bin/this_command_does_not_exist":
@@ -169,7 +201,7 @@ describe Puppet::Transaction::Report do
       expect(rs["Exec[/bin/this_command_does_not_exist]"]['failed_to_restart']).to be true
       expect(rs["File[failing_file]"]['failed']).to be true
       expect(rs["File[skipped_file]"]['skipped']).to be true
-      expect(rs).to_not have_key(["File[#{test_dir}]"])
+      expect(rs["File[#{test_dir}]"]['changed']).to be false
     end
   end
 
@@ -578,9 +610,9 @@ Version:
     expect(Puppet::Transaction::Report.default_format).to eq(:json)
   end
 
-  it "supports both json, pson and yaml" do
-    # msgpack is optional, so using include instead of eq
-    expect(Puppet::Transaction::Report.supported_formats).to include(:json, :pson, :yaml)
+  it "supports both json and yaml" do
+    # msgpack and pson are optional, so using include instead of eq
+    expect(Puppet::Transaction::Report.supported_formats).to include(:json, :yaml)
   end
 
   context 'can make a round trip through' do
@@ -590,7 +622,7 @@ Version:
 
     after(:each) { Puppet.pop_context }
 
-    it 'pson' do
+    it 'pson', if: Puppet.features.pson? do
       report = generate_report
 
       tripped = Puppet::Transaction::Report.convert_from(:pson, report.render)

data/spec/unit/type/package_spec.rb

@@ -370,9 +370,9 @@ describe Puppet::Type.type(:package) do
   it "should select dnf over yum for dnf supported fedora versions" do
     dnf = Puppet::Type.type(:package).provider(:dnf)
     yum = Puppet::Type.type(:package).provider(:yum)
-    allow(Facter).to receive(:value).with(:osfamily).and_return(:redhat)
-    allow(Facter).to receive(:value).with(:operatingsystem).and_return(:fedora)
-    allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return("22")
+    allow(Facter).to receive(:value).with('os.family').and_return(:redhat)
+    allow(Facter).to receive(:value).with('os.name').and_return(:fedora)
+    allow(Facter).to receive(:value).with('os.release.major').and_return("22")
 
     expect(dnf.specificity).to be > yum.specificity
   end

data/spec/unit/type/resources_spec.rb

@@ -124,8 +124,8 @@ describe resources do
       context "on #{os}" do
         before :each do
           allow(Facter).to receive(:value).with(:kernel).and_return(os)
-          allow(Facter).to receive(:value).with(:operatingsystem).and_return(os)
-          allow(Facter).to receive(:value).with(:osfamily).and_return(os)
+          allow(Facter).to receive(:value).with('os.name').and_return(os)
+          allow(Facter).to receive(:value).with('os.family').and_return(os)
           allow(Puppet::FileSystem).to receive(:exist?).with('/etc/login.defs').and_return(false)
           @res = Puppet::Type.type(:resources).new :name => :user, :purge => true, :unless_system_user => true
           @res.catalog = Puppet::Resource::Catalog.new

data/spec/unit/type_spec.rb

@@ -1142,7 +1142,7 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
 
       before :each do
         type.provide(:default) do
-          defaultfor :operatingsystem => Puppet.runtime[:facter].value(:operatingsystem)
+          defaultfor 'os.name' => Puppet.runtime[:facter].value('os.name')
           mk_resource_methods
           class << self
             attr_accessor :params
@@ -1172,7 +1172,7 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
     context "with a default provider" do
       before :each do
         type.provide(:default) do
-          defaultfor :operatingsystem => Puppet.runtime[:facter].value(:operatingsystem)
+          defaultfor 'os.name' => Puppet.runtime[:facter].value('os.name')
           mk_resource_methods
           class << self
             attr_accessor :names

data/spec/unit/util/json_lockfile_spec.rb

@@ -16,7 +16,7 @@ describe Puppet::Util::JsonLockfile do
       data = { "foo" => "foofoo", "bar" => "barbar" }
       @lock.lock(data)
 
-      expect(PSON.parse(File.read(@lockfile))).to eq(data)
+      expect(JSON.parse(File.read(@lockfile))).to eq(data)
     end
   end
 

data/spec/unit/util/monkey_patches_spec.rb

@@ -29,21 +29,10 @@ describe Symbol do
 end
 
 describe OpenSSL::SSL::SSLContext do
-  it 'disables SSLv2 via the SSLContext#options bitmask' do
-    expect(subject.options & OpenSSL::SSL::OP_NO_SSLv2).to eq(OpenSSL::SSL::OP_NO_SSLv2)
-  end
-
   it 'disables SSLv3 via the SSLContext#options bitmask' do
     expect(subject.options & OpenSSL::SSL::OP_NO_SSLv3).to eq(OpenSSL::SSL::OP_NO_SSLv3)
   end
 
-  it 'explicitly disable SSLv2 ciphers using the ! prefix so they cannot be re-added' do
-    cipher_str = OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]
-    if cipher_str
-      expect(cipher_str.split(':')).to include('!SSLv2')
-    end
-  end
-
   it 'does not exclude SSLv3 ciphers shared with TLSv1' do
     cipher_str = OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]
     if cipher_str
@@ -55,13 +44,6 @@ describe OpenSSL::SSL::SSLContext do
     expect_any_instance_of(described_class).to receive(:set_params)
     subject
   end
-
-  it 'has no ciphers with version SSLv2 enabled' do
-    ciphers = subject.ciphers.select do |name, version, bits, alg_bits|
-      /SSLv2/.match(version)
-    end
-    expect(ciphers).to be_empty
-  end
 end
 
 

data/spec/unit/util/run_mode_spec.rb

@@ -171,30 +171,6 @@ describe Puppet::Util::RunMode do
         end
       end
     end
-
-    describe "#without_env internal helper with UTF8 characters" do
-      let(:varname) { "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7" }
-      let(:rune_utf8) { "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7" }
-
-      before do
-        Puppet::Util::Windows::Process.set_environment_variable(varname, rune_utf8)
-      end
-
-      it "removes environment variables within the block with UTF8 name" do
-        without_env(varname) do
-          expect(ENV[varname]).to be(nil)
-        end
-      end
-
-      it "restores UTF8 characters in environment variable values" do
-        without_env(varname) do
-          Puppet::Util::Windows::Process.set_environment_variable(varname, 'bad value')
-        end
-
-        envhash = Puppet::Util::Windows::Process.get_environment_strings
-        expect(envhash[varname]).to eq(rune_utf8)
-      end
-    end
   end
 
   def as_root
@@ -206,12 +182,4 @@ describe Puppet::Util::RunMode do
     allow(Puppet.features).to receive(:root?).and_return(false)
     yield
   end
-
-  def without_env(name, &block)
-    saved = Puppet::Util.get_env(name)
-    Puppet::Util.set_env(name, nil)
-    yield
-  ensure
-    Puppet::Util.set_env(name, saved)
-  end
 end