puppet 7.27.0-x64-mingw32 → 8.0.1-x64-mingw32

data/spec/unit/resource/catalog_spec.rb

@@ -13,9 +13,9 @@ describe Puppet::Resource::Catalog, "when compiling" do
     allow(Puppet::Util::Storage).to receive(:store)
   end
 
-  it "should support json, pson, dot, yaml" do
-    # msgpack is optional, so using include instead of eq
-    expect(Puppet::Resource::Catalog.supported_formats).to include(:json, :pson, :dot, :yaml)
+  it "should support json, dot, yaml" do
+    # msgpack and pson are optional, so using include instead of eq
+    expect(Puppet::Resource::Catalog.supported_formats).to include(:json, :dot, :yaml)
   end
 
   # audit only resources are unmanaged
@@ -965,7 +965,8 @@ describe Puppet::Resource::Catalog, "when converting a resource catalog to json"
 
     context 'and rich_data is disabled' do
       before(:each) do
-        Puppet[:rich_data] = false
+        Puppet[:rich_data] = false 
+        Puppet[:strict] = :warning # do not want to stub out behavior in tests
       end
 
       let(:catalog_w_regexp)  { compile_to_catalog("notify {'foo': message => /[a-z]+/ }") }
@@ -1032,6 +1033,14 @@ describe Puppet::Resource::Catalog, "when converting a resource catalog to json"
         expect(message['a']).to eql(nil)
         expect(message['b']).to eql(10)
       end
+
+      it 'should raise an error by default when trying to convert parameter with rich data' do
+        Puppet[:strict] = :error
+        expect {
+          catalog = compile_to_catalog("notify {'foo': message => Timestamp('2016-09-15T08:32:16.123 UTC') }")
+          Puppet::Resource::Catalog.from_data_hash(JSON.parse(catalog.to_json)) 
+        }.to raise_error(/Evaluation Error: Notify\[foo\]\['message'\] contains a Puppet::Pops::Time::Timestamp value. It will be converted to the String '2016-09-15T08:32:16.123000000 UTC'/)
+      end
     end
   end
 end

data/spec/unit/ssl/certificate_request_spec.rb

@@ -198,7 +198,7 @@ describe Puppet::SSL::CertificateRequest do
 
         expect do
           request.generate(key, :csr_attributes => csr_attributes)
-        end.to raise_error Puppet::Error, /Cannot create CSR with attribute thats\.no\.moon: first num too large/
+        end.to raise_error Puppet::Error, /Cannot create CSR with attribute thats\.no\.moon: /
       end
 
       it "should support old non-DER encoded extensions" do
@@ -271,7 +271,7 @@ describe Puppet::SSL::CertificateRequest do
         exts = {"thats.no.moon" => "death star"}
         expect do
           request.generate(key, :extension_requests => exts)
-        end.to raise_error Puppet::Error, /Cannot create CSR with extension request thats\.no\.moon.*: first num too large/
+        end.to raise_error Puppet::Error, /Cannot create CSR with extension request thats\.no\.moon.*: /
       end
     end
 
@@ -313,6 +313,7 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should use SHA1 to sign the csr when SHA256 isn't available" do
       csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(true)
       signer = Puppet::SSL::CertificateSigner.new
@@ -323,6 +324,7 @@ describe Puppet::SSL::CertificateRequest do
     it "should use SHA512 to sign the csr when SHA256 and SHA1 aren't available" do
       key = OpenSSL::PKey::RSA.new(2048)
       csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(true)
@@ -334,6 +336,7 @@ describe Puppet::SSL::CertificateRequest do
     it "should use SHA384 to sign the csr when SHA256/SHA1/SHA512 aren't available" do
       key = OpenSSL::PKey::RSA.new(2048)
       csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)
@@ -345,6 +348,7 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should use SHA224 to sign the csr when SHA256/SHA1/SHA512/SHA384 aren't available" do
       csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
       expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -298,7 +298,8 @@ describe Puppet::SSL::SSLProvider do
       ).to eq(['CN=signed', 'CN=Test CA Subauthority', 'CN=Test CA'])
     end
 
-    it 'raises if client cert signature is invalid', unless: Puppet::Util::Platform.jruby? && RUBY_VERSION.to_f >= 2.6 do
+    it 'raises if client cert signature is invalid' do
+      client_cert.public_key = wrong_key.public_key
       client_cert.sign(wrong_key, OpenSSL::Digest::SHA256.new)
       expect {
         subject.create_context(**config.merge(client_cert: client_cert))
@@ -337,8 +338,9 @@ describe Puppet::SSL::SSLProvider do
       end
     end
 
-    it 'raises if intermediate CA signature is invalid', unless: Puppet::Util::Platform.jruby? && RUBY_VERSION.to_f >= 2.6 do
+    it 'raises if intermediate CA signature is invalid' do
       int = global_cacerts.last
+      int.public_key = wrong_key.public_key if Puppet::Util::Platform.jruby?
       int.sign(wrong_key, OpenSSL::Digest::SHA256.new)
 
       expect {
@@ -459,10 +461,13 @@ describe Puppet::SSL::SSLProvider do
     it "raises if root CA's isCA basic constraint is false", unless: Puppet::Util::Platform.jruby? || OpenSSL::OPENSSL_VERSION_NUMBER < 0x10100000 do
       certs = [cert_fixture('bad-basic-constraints.pem'), cert_fixture('intermediate.pem')]
 
+      # openssl 3 returns 79
+      # define X509_V_ERR_NO_ISSUER_PUBLIC_KEY                 24
+      # define X509_V_ERR_INVALID_CA                           79
       expect {
         subject.create_context(**config.merge(cacerts: certs, crls: [], revocation: false))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Certificate 'CN=Test CA' failed verification (24): invalid CA certificate")
+                       /Certificate 'CN=Test CA' failed verification \((24|79)\): invalid CA certificate/)
     end
 
     # OpenSSL < 1.1 does not verify basicConstraints
@@ -472,7 +477,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(**config.merge(cacerts: certs, crls: [], revocation: false))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Certificate 'CN=Test CA Subauthority' failed verification (24): invalid CA certificate")
+                       /Certificate 'CN=Test CA Subauthority' failed verification \((24|79)\): invalid CA certificate/)
     end
 
     it 'accepts CA certs in any order' do

data/spec/unit/ssl/state_machine_spec.rb

@@ -30,6 +30,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     Puppet[:daemonize] = false
     Puppet[:ssl_lockfile] = tmpfile('ssllock')
     allow(Kernel).to receive(:sleep)
+    allow_any_instance_of(Puppet::X509::CertProvider).to receive(:crl_last_update).and_return(Time.now + (5 * 60))
   end
 
   def expected_digest(name, content)
@@ -526,12 +527,6 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       expect(File).to_not exist(Puppet[:hostcrl])
     end
 
-    it 'skips CRL refresh by default' do
-      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
-
-      state.next_state
-    end
-
     it 'skips CRL refresh if it has not expired' do
       Puppet[:crl_refresh_interval] = '1y'
       Puppet::FileSystem.touch(Puppet[:hostcrl], mtime: Time.now)

data/spec/unit/test/test_helper_spec.rb

@@ -4,14 +4,14 @@ describe "TestHelper" do
   context "#after_each_test" do
     it "restores the original environment" do
       varname = 'test_helper_spec-test_variable'
-      Puppet::Util.set_env(varname, "\u16A0")
+      ENV[varname] = "\u16A0"
 
-      expect(Puppet::Util.get_env(varname)).to eq("\u16A0")
+      expect(ENV[varname]).to eq("\u16A0")
 
       # Prematurely trigger the after_each_test method
       Puppet::Test::TestHelper.after_each_test
 
-      expect(Puppet::Util::get_env(varname)).to be_nil
+      expect(ENV[varname]).to be_nil
     end
   end
-end
+end

data/spec/unit/transaction/report_spec.rb

@@ -138,14 +138,46 @@ describe Puppet::Transaction::Report do
   end
 
   describe "when exclude_unchanged_resources is true" do
+    let(:test_dir) { tmpdir('unchanged_resources') }
+    let(:test_dir2) { tmpdir('unchanged_resources') }
+    let(:test_file) { tmpfile('some_path')}
+    it 'should still list "changed" resource statuses but remove "unchanged"' do
+      transaction = apply_compiled_manifest(<<-END)
+        notify { "hi": } ~>
+        exec { "/bin/this_command_does_not_exist":
+          command => "#{make_absolute('/bin/this_command_does_not_exist')}",
+          refreshonly => true,
+        }
+        file { '#{test_dir}':
+          ensure => directory
+        }
+        file { 'failing_file':
+          path => '#{test_dir2}',
+          ensure => file
+        }
+        file { 'skipped_file':
+          path => '#{test_file}',
+          require => File[failing_file]
+        }
+      END
+      rs = transaction.report.to_data_hash['resource_statuses']
+      expect(rs["Notify[hi]"]['out_of_sync']).to be true
+      expect(rs["Exec[/bin/this_command_does_not_exist]"]['failed_to_restart']).to be true
+      expect(rs["File[failing_file]"]['failed']).to be true
+      expect(rs["File[skipped_file]"]['skipped']).to be true
+      expect(rs).to_not have_key(["File[#{test_dir}]"])
+    end
+  end
+
+  describe"when exclude_unchanged_resources is false" do
     before do
-      Puppet[:exclude_unchanged_resources] = true
+      Puppet[:exclude_unchanged_resources] = false
     end
 
     let(:test_dir) { tmpdir('unchanged_resources') }
     let(:test_dir2) { tmpdir('unchanged_resources') }
     let(:test_file) { tmpfile('some_path')}
-    it 'should still list "changed" resource statuses but remove "unchanged"' do
+    it 'should list all resource statuses' do
       transaction = apply_compiled_manifest(<<-END)
         notify { "hi": } ~>
         exec { "/bin/this_command_does_not_exist":
@@ -169,7 +201,7 @@ describe Puppet::Transaction::Report do
       expect(rs["Exec[/bin/this_command_does_not_exist]"]['failed_to_restart']).to be true
       expect(rs["File[failing_file]"]['failed']).to be true
       expect(rs["File[skipped_file]"]['skipped']).to be true
-      expect(rs).to_not have_key(["File[#{test_dir}]"])
+      expect(rs["File[#{test_dir}]"]['changed']).to be false
     end
   end
 
@@ -578,9 +610,9 @@ Version:
     expect(Puppet::Transaction::Report.default_format).to eq(:json)
   end
 
-  it "supports both json, pson and yaml" do
-    # msgpack is optional, so using include instead of eq
-    expect(Puppet::Transaction::Report.supported_formats).to include(:json, :pson, :yaml)
+  it "supports both json and yaml" do
+    # msgpack and pson are optional, so using include instead of eq
+    expect(Puppet::Transaction::Report.supported_formats).to include(:json, :yaml)
   end
 
   context 'can make a round trip through' do
@@ -590,7 +622,7 @@ Version:
 
     after(:each) { Puppet.pop_context }
 
-    it 'pson' do
+    it 'pson', if: Puppet.features.pson? do
       report = generate_report
 
       tripped = Puppet::Transaction::Report.convert_from(:pson, report.render)

data/spec/unit/type/package_spec.rb

@@ -370,9 +370,9 @@ describe Puppet::Type.type(:package) do
   it "should select dnf over yum for dnf supported fedora versions" do
     dnf = Puppet::Type.type(:package).provider(:dnf)
     yum = Puppet::Type.type(:package).provider(:yum)
-    allow(Facter).to receive(:value).with(:osfamily).and_return(:redhat)
-    allow(Facter).to receive(:value).with(:operatingsystem).and_return(:fedora)
-    allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return("22")
+    allow(Facter).to receive(:value).with('os.family').and_return(:redhat)
+    allow(Facter).to receive(:value).with('os.name').and_return(:fedora)
+    allow(Facter).to receive(:value).with('os.release.major').and_return("22")
 
     expect(dnf.specificity).to be > yum.specificity
   end

data/spec/unit/type/resources_spec.rb

@@ -124,8 +124,8 @@ describe resources do
       context "on #{os}" do
         before :each do
           allow(Facter).to receive(:value).with(:kernel).and_return(os)
-          allow(Facter).to receive(:value).with(:operatingsystem).and_return(os)
-          allow(Facter).to receive(:value).with(:osfamily).and_return(os)
+          allow(Facter).to receive(:value).with('os.name').and_return(os)
+          allow(Facter).to receive(:value).with('os.family').and_return(os)
           allow(Puppet::FileSystem).to receive(:exist?).with('/etc/login.defs').and_return(false)
           @res = Puppet::Type.type(:resources).new :name => :user, :purge => true, :unless_system_user => true
           @res.catalog = Puppet::Resource::Catalog.new

data/spec/unit/type_spec.rb

@@ -1142,7 +1142,7 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
 
       before :each do
         type.provide(:default) do
-          defaultfor :operatingsystem => Puppet.runtime[:facter].value(:operatingsystem)
+          defaultfor 'os.name' => Puppet.runtime[:facter].value('os.name')
           mk_resource_methods
           class << self
             attr_accessor :params
@@ -1172,7 +1172,7 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
     context "with a default provider" do
       before :each do
         type.provide(:default) do
-          defaultfor :operatingsystem => Puppet.runtime[:facter].value(:operatingsystem)
+          defaultfor 'os.name' => Puppet.runtime[:facter].value('os.name')
           mk_resource_methods
           class << self
             attr_accessor :names

data/spec/unit/util/execution_spec.rb

@@ -29,7 +29,6 @@ describe Puppet::Util::Execution, if: !Puppet::Util::Platform.jruby? do
         allow(FFI::WIN32).to receive(:CloseHandle).with(thread_handle)
       else
         allow(Process).to receive(:waitpid2).with(pid, Process::WNOHANG).and_return(nil, [pid, double('child_status', :exitstatus => exitstatus)])
-        allow(Process).to receive(:waitpid2).with(pid, 0).and_return(nil, [pid, double('child_status', :exitstatus => exitstatus)])
         allow(Process).to receive(:waitpid2).with(pid).and_return([pid, double('child_status', :exitstatus => exitstatus)])
       end
     end

data/spec/unit/util/json_lockfile_spec.rb

@@ -16,7 +16,7 @@ describe Puppet::Util::JsonLockfile do
       data = { "foo" => "foofoo", "bar" => "barbar" }
       @lock.lock(data)
 
-      expect(PSON.parse(File.read(@lockfile))).to eq(data)
+      expect(JSON.parse(File.read(@lockfile))).to eq(data)
     end
   end
 

data/spec/unit/util/monkey_patches_spec.rb

@@ -29,21 +29,10 @@ describe Symbol do
 end
 
 describe OpenSSL::SSL::SSLContext do
-  it 'disables SSLv2 via the SSLContext#options bitmask' do
-    expect(subject.options & OpenSSL::SSL::OP_NO_SSLv2).to eq(OpenSSL::SSL::OP_NO_SSLv2)
-  end
-
   it 'disables SSLv3 via the SSLContext#options bitmask' do
     expect(subject.options & OpenSSL::SSL::OP_NO_SSLv3).to eq(OpenSSL::SSL::OP_NO_SSLv3)
   end
 
-  it 'explicitly disable SSLv2 ciphers using the ! prefix so they cannot be re-added' do
-    cipher_str = OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]
-    if cipher_str
-      expect(cipher_str.split(':')).to include('!SSLv2')
-    end
-  end
-
   it 'does not exclude SSLv3 ciphers shared with TLSv1' do
     cipher_str = OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]
     if cipher_str
@@ -55,13 +44,6 @@ describe OpenSSL::SSL::SSLContext do
     expect_any_instance_of(described_class).to receive(:set_params)
     subject
   end
-
-  it 'has no ciphers with version SSLv2 enabled' do
-    ciphers = subject.ciphers.select do |name, version, bits, alg_bits|
-      /SSLv2/.match(version)
-    end
-    expect(ciphers).to be_empty
-  end
 end
 
 

data/spec/unit/util/run_mode_spec.rb

@@ -171,30 +171,6 @@ describe Puppet::Util::RunMode do
         end
       end
     end
-
-    describe "#without_env internal helper with UTF8 characters" do
-      let(:varname) { "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7" }
-      let(:rune_utf8) { "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7" }
-
-      before do
-        Puppet::Util::Windows::Process.set_environment_variable(varname, rune_utf8)
-      end
-
-      it "removes environment variables within the block with UTF8 name" do
-        without_env(varname) do
-          expect(ENV[varname]).to be(nil)
-        end
-      end
-
-      it "restores UTF8 characters in environment variable values" do
-        without_env(varname) do
-          Puppet::Util::Windows::Process.set_environment_variable(varname, 'bad value')
-        end
-
-        envhash = Puppet::Util::Windows::Process.get_environment_strings
-        expect(envhash[varname]).to eq(rune_utf8)
-      end
-    end
   end
 
   def as_root
@@ -206,12 +182,4 @@ describe Puppet::Util::RunMode do
     allow(Puppet.features).to receive(:root?).and_return(false)
     yield
   end
-
-  def without_env(name, &block)
-    saved = Puppet::Util.get_env(name)
-    Puppet::Util.set_env(name, nil)
-    yield
-  ensure
-    Puppet::Util.set_env(name, saved)
-  end
 end

data/spec/unit/util/windows/adsi_spec.rb

@@ -95,31 +95,6 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet::Util::Platform.windows? do
     end
   end
 
-  describe '.get_sids' do
-    it 'returns an array of SIDs given two an array of ADSI children' do
-      child1 = double('child1', name: 'Administrator', sid: 'S-1-5-21-3882680660-671291151-3888264257-500')
-      child2 = double('child2', name: 'Guest', sid: 'S-1-5-21-3882680660-671291151-3888264257-501')
-      allow(Puppet::Util::Windows::SID).to receive(:ads_to_principal).with(child1).and_return('Administrator')
-      allow(Puppet::Util::Windows::SID).to receive(:ads_to_principal).with(child2).and_return('Guest')
-      sids = Puppet::Util::Windows::ADSI::ADSIObject.get_sids([child1, child2])
-      expect(sids).to eq(['Administrator', 'Guest'])
-    end
-
-    it 'returns an array of SIDs given an ADSI child and ads_to_principal returning domain failure' do
-      child = double('child1', name: 'Administrator', sid: 'S-1-5-21-3882680660-671291151-3888264257-500')
-      allow(Puppet::Util::Windows::SID).to receive(:ads_to_principal).with(child).and_raise(Puppet::Util::Windows::Error.new('', Puppet::Util::Windows::SID::ERROR_TRUSTED_DOMAIN_FAILURE))
-      sids = Puppet::Util::Windows::ADSI::ADSIObject.get_sids([child])
-      expect(sids[0]).to eq(Puppet::Util::Windows::SID::Principal.new(child.name, child.sid, child.name, nil, :SidTypeUnknown))
-    end
-
-    it 'returns an array of SIDs given an ADSI child and ads_to_principal returning relationship failure' do
-      child = double('child1', name: 'Administrator', sid: 'S-1-5-21-3882680660-671291151-3888264257-500')
-      allow(Puppet::Util::Windows::SID).to receive(:ads_to_principal).with(child).and_raise(Puppet::Util::Windows::Error.new('', Puppet::Util::Windows::SID::ERROR_TRUSTED_RELATIONSHIP_FAILURE))
-      sids = Puppet::Util::Windows::ADSI::ADSIObject.get_sids([child])
-      expect(sids[0]).to eq(Puppet::Util::Windows::SID::Principal.new(child.name, child.sid, child.name, nil, :SidTypeUnknown))
-    end
-  end
-
   describe Puppet::Util::Windows::ADSI::User do
     let(:username)  { 'testuser' }
     let(:domain)    { 'DOMAIN' }

data/spec/unit/util_spec.rb

@@ -65,10 +65,62 @@ describe Puppet::Util do
       end
       expect(ENV["FOO"]).to eq(nil)
     end
+
+    it "accepts symbolic keys" do
+      Puppet::Util.withenv(:FOO => "bar") do
+        expect(ENV["FOO"]).to eq("bar")
+      end
+    end
+
+    it "coerces invalid keys to strings" do
+      Puppet::Util.withenv(12345678 => "bar") do
+        expect(ENV["12345678"]).to eq("bar")
+      end
+    end
+
+    it "rejects keys with leading equals" do
+      expect {
+        Puppet::Util.withenv("=foo" => "bar") {}
+      }.to raise_error(Errno::EINVAL, /Invalid argument/)
+    end
+
+    it "includes keys with unicode replacement characters" do
+      Puppet::Util.withenv("foo\uFFFD" => "bar") do
+        expect(ENV).to be_include("foo\uFFFD")
+      end
+    end
+
+    it "accepts a unicode key" do
+      key = "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7"
+
+      Puppet::Util.withenv(key => "bar") do
+        expect(ENV[key]).to eq("bar")
+      end
+    end
+
+    it "accepts a unicode value" do
+      value = "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7"
+
+      Puppet::Util.withenv("runes" => value) do
+        expect(ENV["runes"]).to eq(value)
+      end
+    end
+
+    it "rejects a non-string value" do
+      expect {
+        Puppet::Util.withenv("reject" => 123) {}
+      }.to raise_error(TypeError, /no implicit conversion of Integer into String/)
+    end
+
+    it "accepts a nil value" do
+      Puppet::Util.withenv("foo" => nil) do
+        expect(ENV["foo"]).to eq(nil)
+      end
+    end
   end
 
   describe "#withenv on POSIX", :unless => Puppet::Util::Platform.windows? do
-    it "should preserve case" do
+    it "compares keys case sensitively" do
       # start with lower case key,
       env_key = SecureRandom.uuid.downcase
 
@@ -77,7 +129,7 @@ describe Puppet::Util do
         ENV[env_key] = original_value
         new_value = 'goodbye'
 
-        Puppet::Util.withenv({env_key.upcase => new_value}, :posix) do
+        Puppet::Util.withenv(env_key.upcase => new_value) do
           expect(ENV[env_key]).to eq(original_value)
           expect(ENV[env_key.upcase]).to eq(new_value)
         end
@@ -93,7 +145,7 @@ describe Puppet::Util do
   describe "#withenv on Windows", :if => Puppet::Util::Platform.windows? do
     let(:process) { Puppet::Util::Windows::Process }
 
-    it "should ignore case" do
+    it "compares keys case-insensitively" do
       # start with lower case key, ensuring string is not entirely numeric
       env_key = SecureRandom.uuid.downcase + 'a'
 
@@ -102,7 +154,7 @@ describe Puppet::Util do
         ENV[env_key] = original_value
         new_value = 'goodbye'
 
-        Puppet::Util.withenv({env_key.upcase => new_value}, :windows) do
+        Puppet::Util.withenv(env_key.upcase => new_value) do
           expect(ENV[env_key]).to eq(new_value)
           expect(ENV[env_key.upcase]).to eq(new_value)
         end
@@ -122,7 +174,7 @@ describe Puppet::Util do
       utf_8_value = utf_8_key + 'value'
       codepage_key = utf_8_key.dup.force_encoding(Encoding.default_external)
 
-      Puppet::Util.withenv({utf_8_key => utf_8_value}, :windows) do
+      Puppet::Util.withenv(utf_8_key => utf_8_value) do
         # the true Windows environment APIs see the variables correctly
         expect(process.get_environment_strings[utf_8_key]).to eq(utf_8_value)
 
@@ -136,52 +188,6 @@ describe Puppet::Util do
       expect(process.get_environment_strings[utf_8_key]).to eq(nil)
     end
 
-    # document buggy Ruby behavior here for https://bugs.ruby-lang.org/issues/8822
-    # Ruby retrieves / stores ENV names in the current codepage
-    # when these tests no longer pass, Ruby has fixed its bugs and workarounds can be removed
-
-    # In 2.3, the behavior is mostly correct when external codepage is 65001 / UTF-8
-    it "works around Ruby bug 8822 (which fails to preserve UTF-8 properly when accessing ENV) (Ruby >= 2.3.x) ",
-      :if => Puppet::Util::Platform.windows? && RUBY_VERSION.to_f < 3 do
-
-      withenv_utf8 do |utf_8_key, utf_8_value, codepage_key|
-        # Ruby 2.3 fixes access by the original UTF-8 key, and behaves differently than 2.1
-        # keying by local codepage will work only when the UTF-8 can be converted to local codepage
-        # the key selected for this test contains characters unavailable to a local codepage, hence doesn't work
-
-        # On Japanese Windows (Code Page 932) this test resolves as true.
-        # otherwise the key selected for this test contains characters
-        # unavailable to a local codepage, hence doesn't work
-        # HACK: tech debt to replace once PUP-7019 is understood
-        should_be_found = (Encoding.default_external == Encoding::CP932)
-        expect(ENV.key?(codepage_key)).to eq(should_be_found)
-        expect(ENV.key?(utf_8_key)).to eq(true)
-
-        # Ruby's ENV.keys has slightly different behavior than ENV.key?(key), and 2.3 differs from 2.1
-        # (codepage_key / utf_8_key have same bytes for the sake of searching)
-        found = ENV.keys.find { |k| k.bytes == codepage_key.bytes }
-
-        # the keys collection in 2.3 does not have a string with the correct bytes!
-        # a corrupt version of the key exists with the bytes [225, 154, 160] replaced with [63]!
-        expect(found).to be_nil
-
-        # given the key is corrupted, include? cannot be used to find it in either UTF-8 or codepage encoding
-        expect(ENV.keys.include?(codepage_key)).to eq(false)
-        expect(ENV.keys.include?(utf_8_key)).to eq(false)
-
-        # The value stored at the UTF-8 key is a corrupted current codepage string and won't match UTF-8 value
-        # again the bytes [225, 154, 160] have irreversibly been changed to [63]!
-        env_value = ENV[utf_8_key]
-        expect(env_value).to_not eq(utf_8_value)
-        expect(env_value.encoding).to_not eq(Encoding::UTF_8)
-
-        # the ENV value returned will be in the local codepage which may or may not be able to be
-        # encoded to UTF8.  Our test UTF8 data is not convertible to non-Unicode codepages
-        converted_value = ENV[utf_8_key].dup.force_encoding(Encoding::UTF_8)
-        expect(converted_value).to_not eq(utf_8_value)
-      end
-    end
-
     it "should preseve existing environment and should not corrupt UTF-8 environment variables" do
       env_var_name = SecureRandom.uuid
       utf_8_bytes = [225, 154, 160] # rune ᚠ
@@ -195,7 +201,7 @@ describe Puppet::Util do
         process.set_environment_variable(env_var_name, utf_8_str)
 
         original_keys = process.get_environment_strings.keys.to_a
-        Puppet::Util.withenv({}, :windows) { }
+        Puppet::Util.withenv({}) { }
 
         env = process.get_environment_strings
 
@@ -700,8 +706,8 @@ describe Puppet::Util do
       end
 
       it "should walk the search PATH returning the first executable" do
-        allow(Puppet::Util).to receive(:get_env).with('PATH').and_return(File.expand_path('/bin'))
-        allow(Puppet::Util).to receive(:get_env).with('PATHEXT').and_return(nil)
+        allow(ENV).to receive(:[]).with('PATH').and_return(File.expand_path('/bin'))
+        allow(ENV).to receive(:[]).with('PATHEXT').and_return(nil)
 
         expect(Puppet::Util.which('foo')).to eq(path)
       end
@@ -717,8 +723,8 @@ describe Puppet::Util do
 
       describe "when a file extension is specified" do
         it "should walk each directory in PATH ignoring PATHEXT" do
-          allow(Puppet::Util).to receive(:get_env).with('PATH').and_return(%w[/bar /bin].map{|dir| File.expand_path(dir)}.join(File::PATH_SEPARATOR))
-          allow(Puppet::Util).to receive(:get_env).with('PATHEXT').and_return('.FOOBAR')
+          allow(ENV).to receive(:[]).with('PATH').and_return(%w[/bar /bin].map{|dir| File.expand_path(dir)}.join(File::PATH_SEPARATOR))
+          allow(ENV).to receive(:[]).with('PATHEXT').and_return('.FOOBAR')
 
           expect(FileTest).to receive(:file?).with(File.join(File.expand_path('/bar'), 'foo.CMD')).and_return(false)
 
@@ -729,8 +735,8 @@ describe Puppet::Util do
       describe "when a file extension is not specified" do
         it "should walk each extension in PATHEXT until an executable is found" do
           bar = File.expand_path('/bar')
-          allow(Puppet::Util).to receive(:get_env).with('PATH').and_return("#{bar}#{File::PATH_SEPARATOR}#{base}")
-          allow(Puppet::Util).to receive(:get_env).with('PATHEXT').and_return(".EXE#{File::PATH_SEPARATOR}.CMD")
+          allow(ENV).to receive(:[]).with('PATH').and_return("#{bar}#{File::PATH_SEPARATOR}#{base}")
+          allow(ENV).to receive(:[]).with('PATHEXT').and_return(".EXE#{File::PATH_SEPARATOR}.CMD")
 
           expect(FileTest).to receive(:file?).ordered().with(File.join(bar, 'foo.EXE')).and_return(false)
           expect(FileTest).to receive(:file?).ordered().with(File.join(bar, 'foo.CMD')).and_return(false)
@@ -741,8 +747,8 @@ describe Puppet::Util do
         end
 
         it "should walk the default extension path if the environment variable is not defined" do
-          allow(Puppet::Util).to receive(:get_env).with('PATH').and_return(base)
-          allow(Puppet::Util).to receive(:get_env).with('PATHEXT').and_return(nil)
+          allow(ENV).to receive(:[]).with('PATH').and_return(base)
+          allow(ENV).to receive(:[]).with('PATHEXT').and_return(nil)
 
           %w[.COM .EXE .BAT].each do |ext|
             expect(FileTest).to receive(:file?).ordered().with(File.join(base, "foo#{ext}")).and_return(false)
@@ -753,8 +759,8 @@ describe Puppet::Util do
         end
 
         it "should fall back if no extension matches" do
-          allow(Puppet::Util).to receive(:get_env).with('PATH').and_return(base)
-          allow(Puppet::Util).to receive(:get_env).with('PATHEXT').and_return(".EXE")
+          allow(ENV).to receive(:[]).with('PATH').and_return(base)
+          allow(ENV).to receive(:[]).with('PATHEXT').and_return(".EXE")
 
           allow(FileTest).to receive(:file?).with(File.join(base, 'foo.EXE')).and_return(false)
           allow(FileTest).to receive(:file?).with(File.join(base, 'foo')).and_return(true)