puppet 7.27.0 → 7.29.0

data/spec/lib/matchers/resource.rb

@@ -1,74 +0,0 @@
-module Matchers; module Resource
-  extend RSpec::Matchers::DSL
-
-  matcher :have_resource do |expected_resource|
-    def resource_match(expected_resource, actual_resource)
-      matched = true
-      failures = []
-
-      if actual_resource.ref != expected_resource
-        matched = false
-        failures << "expected #{expected_resource} but was #{actual_resource.ref}"
-      end
-
-      @params ||= {}
-      @params.each do |name, value|
-        case value
-        when RSpec::Matchers::DSL::Matcher
-          if !value.matches?(actual_resource[name])
-            matched = false
-            failures << "expected #{name} to match '#{value.description}' but was '#{actual_resource[name]}'"
-          end
-        else
-          if actual_resource[name] != value
-            matched = false
-            failures << "expected #{name} to be '#{value}' but was '#{actual_resource[name]}'"
-          end
-        end
-      end
-      @mismatch = failures.join("\n")
-
-      matched
-    end
-
-    match do |actual_catalog|
-      @mismatch = ""
-      if resource = actual_catalog.resource(expected_resource)
-        resource_match(expected_resource, resource)
-      else
-        @mismatch = "expected #{@actual.to_dot} to include #{expected_resource}"
-        false
-      end
-    end
-
-    chain :with_parameter do |name, value|
-      @params ||= {}
-      @params[name] = value
-    end
-
-    def failure_message
-      @mismatch
-    end
-  end
-
-
-  matcher :be_resource do |expected_resource|
-    def resource_match(expected_resource, actual_resource)
-      if actual_resource.ref == expected_resource
-        true
-      else
-        @mismatch = "expected #{expected_resource} but was #{actual_resource.ref}"
-        false
-      end
-    end
-
-    match do |actual_resource|
-      resource_match(expected_resource, actual_resource)
-    end
-
-    def failure_message
-      @mismatch
-    end
-  end
-
-end; end

data/spec/lib/puppet/certificate_factory.rb

@@ -1,218 +0,0 @@
-require 'puppet/ssl'
-
-# This class encapsulates the logic of creating and adding extensions to X509
-# certificates.
-#
-# @api private
-module Puppet::CertificateFactory
-
-  # Create a new X509 certificate and add any needed extensions to the cert.
-  #
-  # @param cert_type [Symbol] The certificate type to create, which specifies
-  #   what extensions are added to the certificate.
-  #   One of (:ca, :terminalsubca, :server, :ocsp, :client)
-  # @param csr [Puppet::SSL::CertificateRequest] The signing request associated with
-  #   the certificate being created.
-  # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
-  #   if this is a self signed certificate, or the X509 certificate of the CA if
-  #   this is a CA signed certificate.
-  # @param serial [Integer] The serial number for the given certificate, which
-  #   MUST be unique for the given CA.
-  # @param ttl [String] The duration of the validity for the given certificate.
-  #
-  # @api public
-  #
-  # @return [OpenSSL::X509::Certificate]
-  def self.build(cert_type, csr, issuer, serial, ttl = 3600)
-    # Work out if we can even build the requested type of certificate.
-    build_extensions = "build_#{cert_type}_extensions"
-    respond_to?(build_extensions) or
-      raise ArgumentError, _("%{cert_type} is an invalid certificate type!") % { cert_type: cert_type }
-
-    raise ArgumentError, _("Certificate TTL must be an integer") unless ttl.nil? || ttl.is_a?(Integer)
-
-    # set up the certificate, and start building the content.
-    cert = OpenSSL::X509::Certificate.new
-
-    cert.version    = 2 # X509v3
-    cert.subject    = csr.content.subject
-    cert.issuer     = issuer.subject
-    cert.public_key = csr.content.public_key
-    cert.serial     = serial
-
-    # Make the certificate valid as of yesterday, because so many people's
-    # clocks are out of sync.  This gives one more day of validity than people
-    # might expect, but is better than making every person who has a messed up
-    # clock fail, and better than having every cert we generate expire a day
-    # before the user expected it to when they asked for "one year".
-    cert.not_before = Time.now - (60*60*24)
-    cert.not_after  = Time.now + ttl
-
-    add_extensions_to(cert, csr, issuer, send(build_extensions))
-
-    return cert
-  end
-
-  # Add X509v3 extensions to the given certificate.
-  #
-  # @param cert [OpenSSL::X509::Certificate] The certificate to add the
-  #   extensions to.
-  # @param csr [OpenSSL::X509::Request] The CSR associated with the given
-  #   certificate, which may specify requested extensions for the given cert.
-  #   See https://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
-  # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
-  #   if this is a self signed certificate, or the X509 certificate of the CA if
-  #   this is a CA signed certificate.
-  # @param extensions [Hash<String, Array<String> | String>] The extensions to
-  #   add to the certificate, based on the certificate type being created (CA,
-  #   server, client, etc)
-  #
-  # @api private
-  #
-  # @return [void]
-  def self.add_extensions_to(cert, csr, issuer, extensions)
-    ef = OpenSSL::X509::ExtensionFactory.new
-    ef.subject_certificate = cert
-    ef.issuer_certificate  = issuer.is_a?(OpenSSL::X509::Request) ? cert : issuer
-
-    # Extract the requested extensions from the CSR.
-    requested_exts = csr.request_extensions.inject({}) do |hash, re|
-      hash[re["oid"]] = [re["value"], re["critical"]]
-      hash
-    end
-
-    # Produce our final set of extensions.  We deliberately order these to
-    # build the way we want:
-    # 1. "safe" default values, like the comment, that no one cares about.
-    # 2. request extensions, from the CSR
-    # 3. extensions based on the type we are generating
-    # 4. overrides, which we always want to have in their form
-    #
-    # This ordering *is* security-critical, but we want to allow the user
-    # enough rope to shoot themselves in the foot, if they want to ignore our
-    # advice and externally approve a CSR that sets the basicConstraints.
-    #
-    # Swapping the order of 2 and 3 would ensure that you couldn't slip a
-    # certificate through where the CA constraint was true, though, if
-    # something went wrong up there. --daniel 2011-10-11
-    defaults = { "nsComment" => "Puppet Ruby/OpenSSL Internal Certificate" }
-
-    # See https://www.openssl.org/docs/apps/x509v3_config.html
-    # for information about the special meanings of 'hash', 'keyid', 'issuer'
-    override = {
-      "subjectKeyIdentifier"   => "hash",
-      "authorityKeyIdentifier" => "keyid,issuer"
-    }
-
-    exts = [defaults, requested_exts, extensions, override].
-      inject({}) {|ret, val| ret.merge(val) }
-
-    cert.extensions = exts.map do |oid, val|
-      generate_extension(ef, oid, *val)
-    end
-  end
-  private_class_method :add_extensions_to
-
-  # Woot! We're a CA.
-  def self.build_ca_extensions
-    {
-      # This was accidentally omitted in the previous version of this code: an
-      # effort was made to add it last, but that actually managed to avoid
-      # adding it to the certificate at all.
-      #
-      # We have some sort of bug, which means that when we add it we get a
-      # complaint that the issuer keyid can't be fetched, which breaks all
-      # sorts of things in our test suite and, e.g., bootstrapping the CA.
-      #
-      # https://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
-      # conforming CA we MAY omit the field if we are self-signed, which I
-      # think gives us a pass in the specific case.
-      #
-      # It also notes that we MAY derive the ID from the subject and serial
-      # number of the issuer, or from the key ID, and we definitely have the
-      # former data, should we want to restore this...
-      #
-      # Anyway, preserving this bug means we don't risk breaking anything in
-      # the field, even though it would be nice to have. --daniel 2011-10-11
-      #
-      # "authorityKeyIdentifier" => "keyid:always,issuer:always",
-      "keyUsage"               => [%w{cRLSign keyCertSign}, true],
-      "basicConstraints"       => ["CA:TRUE", true],
-    }
-  end
-
-  # We're a terminal CA, probably not self-signed.
-  def self.build_terminalsubca_extensions
-    {
-      "keyUsage"         => [%w{cRLSign keyCertSign}, true],
-      "basicConstraints" => ["CA:TRUE,pathlen:0", true],
-    }
-  end
-
-  # We're a normal server.
-  def self.build_server_extensions
-    {
-      "keyUsage"         => [%w{digitalSignature keyEncipherment}, true],
-      "extendedKeyUsage" => [%w{serverAuth clientAuth}, true],
-      "basicConstraints" => ["CA:FALSE", true],
-    }
-  end
-
-  # Um, no idea.
-  def self.build_ocsp_extensions
-    {
-      "keyUsage"         => [%w{nonRepudiation digitalSignature}, true],
-      "extendedKeyUsage" => [%w{serverAuth OCSPSigning}, true],
-      "basicConstraints" => ["CA:FALSE", true],
-    }
-  end
-
-  # Normal client.
-  def self.build_client_extensions
-    {
-      "keyUsage"         => [%w{nonRepudiation digitalSignature keyEncipherment}, true],
-      # We don't seem to use this, but that seems much more reasonable here...
-      "extendedKeyUsage" => [%w{clientAuth emailProtection}, true],
-      "basicConstraints" => ["CA:FALSE", true],
-      "nsCertType"       => "client,email",
-    }
-  end
-
-  # Generate an extension with the given OID, value, and critical state
-  #
-  # @param oid [String] The numeric value or short name of a given OID. X509v3
-  #   extensions must be passed by short name or long name, while custom
-  #   extensions may be passed by short name, long name, oid numeric OID.
-  # @param ef [OpenSSL::X509::ExtensionFactory] The extension factory to use
-  #   when generating the extension.
-  # @param val [String, Array<String>] The extension value.
-  # @param crit [true, false] Whether the given extension is critical, defaults
-  #   to false.
-  #
-  # @return [OpenSSL::X509::Extension]
-  #
-  # @api private
-  def self.generate_extension(ef, oid, val, crit = false)
-
-    val = val.join(', ') unless val.is_a? String
-
-    # Enforce the X509v3 rules about subjectAltName being critical:
-    # specifically, it SHOULD NOT be critical if we have a subject, which we
-    # always do. --daniel 2011-10-18
-    crit = false if oid == "subjectAltName"
-
-    if Puppet::SSL::Oids.subtree_of?('id-ce', oid) or Puppet::SSL::Oids.subtree_of?('id-pkix', oid)
-      # Attempt to create a X509v3 certificate extension. Standard certificate
-      # extensions may need access to the associated subject certificate and
-      # issuing certificate, so must be created by the OpenSSL::X509::ExtensionFactory
-      # which provides that context.
-      ef.create_ext(oid, val, crit)
-    else
-      # This is not an X509v3 extension which means that the extension
-      # factory cannot generate it. We need to generate the extension
-      # manually.
-      OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(val).to_der, crit)
-    end
-  end
-  private_class_method :generate_extension
-end

data/spec/lib/puppet/face/1.0.0/huzzah.rb

@@ -1,8 +0,0 @@
-require 'puppet/face'
-Puppet::Face.define(:huzzah, '1.0.0') do
-  copyright "Puppet Inc.", 2011
-  license   "Apache 2 license; see COPYING"
-  summary "life is a thing for celebration"
-  action(:obsolete_in_core) { when_invoked { |_| "you are in obsolete core now!" } }
-  action(:call_newer) { when_invoked { |_| method_on_newer } }
-end

data/spec/lib/puppet/face/basetest.rb

@@ -1,51 +0,0 @@
-require 'puppet/face'
-
-Puppet::Face.define(:basetest, '0.0.1') do
-  copyright "Puppet Inc.", 2011
-  license   "Apache 2 license; see COPYING"
-  summary "This is just so tests don't fail"
-
-  option "--[no-]boolean"
-  option "--mandatory ARGUMENT"
-
-  action :foo do
-    option("--action")
-    when_invoked do |*args| args.length end
-  end
-
-  action :return_true do
-    summary "just returns true"
-    when_invoked do |options| true end
-  end
-
-  action :return_false do
-    summary "just returns false"
-    when_invoked do |options| false end
-  end
-
-  action :return_nil do
-    summary "just returns nil"
-    when_invoked do |options| nil end
-  end
-
-  action :raise do
-    summary "just raises an exception"
-    when_invoked do |options| raise ArgumentError, "your failure" end
-  end
-
-  action :with_s_rendering_hook do
-    summary "has a rendering hook for 's'"
-    when_invoked do |options| "this is not the hook you are looking for" end
-    when_rendering :s do |value| "you invoked the 's' rendering hook" end
-  end
-
-  action :count_args do
-    summary "return the count of arguments given"
-    when_invoked do |*args| args.length - 1 end
-  end
-
-  action :with_specific_exit_code do
-    summary "just call exit with the desired exit code"
-    when_invoked do |options| exit(5) end
-  end
-end

data/spec/lib/puppet/face/huzzah/obsolete.rb

@@ -1,6 +0,0 @@
-Puppet::Face.define(:huzzah, '1.0.0') do
-  action :obsolete do
-    summary "This is an action on version 1.0.0 of the face"
-    when_invoked do |options| options end
-  end
-end

data/spec/lib/puppet/face/huzzah.rb

@@ -1,8 +0,0 @@
-require 'puppet/face'
-Puppet::Face.define(:huzzah, '2.0.1') do
-  copyright "Puppet Inc.", 2011
-  license   "Apache 2 license; see COPYING"
-  summary "life is a thing for celebration"
-  action(:bar) { when_invoked { |options| "is where beer comes from" } }
-  action(:call_older) { when_invoked { |_| method_on_older } }
-end

data/spec/lib/puppet/face/version_matching.rb

@@ -1,12 +0,0 @@
-require 'puppet/face'
-
-# The set of versions here are used explicitly in the interface_spec; if you
-# change this you need to ensure that is still correct. --daniel 2011-04-21
-['1.0.0', '1.0.1', '1.1.0', '1.1.1', '2.0.0'].each do |version|
-  Puppet::Face.define(:version_matching, version) do
-    copyright "Puppet Inc.", 2011
-    license   "Apache 2 license; see COPYING"
-    summary "version matching face #{version}"
-    action(:version) { when_invoked { |options| version } }
-  end
-end

data/spec/lib/puppet/indirector/indirector_testing/json.rb

@@ -1,6 +0,0 @@
-require 'puppet/indirector_testing'
-require 'puppet/indirector/json'
-
-class Puppet::IndirectorTesting::JSON < Puppet::Indirector::JSON
-  desc "Testing the JSON indirector"
-end

data/spec/lib/puppet/indirector/indirector_testing/memory.rb

@@ -1,7 +0,0 @@
-require 'puppet/indirector/memory'
-
-class Puppet::IndirectorTesting::Memory < Puppet::Indirector::Memory
-  def supports_remote_requests?
-    true
-  end
-end

data/spec/lib/puppet/indirector/indirector_testing/msgpack.rb

@@ -1,6 +0,0 @@
-require 'puppet/indirector_testing'
-require 'puppet/indirector/msgpack'
-
-class Puppet::IndirectorTesting::Msgpack < Puppet::Indirector::Msgpack
-  desc "Testing the MessagePack indirector"
-end

data/spec/lib/puppet/indirector_proxy.rb

@@ -1,34 +0,0 @@
-class Puppet::IndirectorProxy
-  class ProxyId
-    attr_accessor :name
-    def initialize(name)
-      self.name = name
-    end
-  end
-
-  # We should have some way to identify if we got a valid object back with the
-  # current values, no?
-  attr_accessor :value, :proxyname
-  alias_method :name, :value
-  alias_method :name=, :value=
-  def initialize(value, proxyname)
-    self.value = value
-    self.proxyname = proxyname
-  end
-
-  def self.indirection
-    ProxyId.new("file_metadata")
-  end
-
-  def self.from_binary(raw)
-    new(raw)
-  end
-
-  def self.from_data_hash(data)
-    new(data['value'])
-  end
-
-  def to_data_hash
-    { 'value' => value }
-  end
-end

data/spec/lib/puppet/indirector_testing.rb

@@ -1,31 +0,0 @@
-require 'puppet/indirector'
-
-class Puppet::IndirectorTesting
-  extend Puppet::Indirector
-  indirects :indirector_testing
-
-  # We should have some way to identify if we got a valid object back with the
-  # current values, no?
-  attr_accessor :value
-  alias_method :name, :value
-  alias_method :name=, :value=
-  def initialize(value)
-    self.value = value
-  end
-
-  def self.from_binary(raw)
-    new(raw)
-  end
-
-  def self.from_data_hash(data)
-    new(data['value'])
-  end
-
-  def to_binary
-    value
-  end
-
-  def to_data_hash
-    { 'value' => value }
-  end
-end

data/spec/lib/puppet/test_ca.rb

@@ -1,164 +0,0 @@
-module Puppet
-  class TestCa
-
-    CERT_VALID_FROM = Time.at(0).freeze # 1969-12-31 16:00:00 -0800
-    CERT_VALID_UNTIL = (Time.now + (10 * 365 * 24 * 60 * 60)).freeze # 10 years from now
-
-    CA_EXTENSIONS = [
-      ["basicConstraints", "CA:TRUE", true],
-      ["keyUsage", "keyCertSign, cRLSign", true],
-      ["subjectKeyIdentifier", "hash", false],
-      ["nsComment", "Puppet Server Internal Certificate", false],
-      ["authorityKeyIdentifier", "keyid:always", false]
-    ].freeze
-
-    attr_reader :ca_cert, :ca_crl, :key
-
-    @serial = 0
-    def self.next_serial
-      id = @serial
-      @serial += 1
-      id
-    end
-
-    def initialize(name = 'Test CA')
-      @digest = OpenSSL::Digest::SHA256.new
-      info = create_cacert(name)
-      @key = info[:private_key]
-      @ca_cert = info[:cert]
-      @ca_crl = create_crl(@ca_cert, @key)
-    end
-
-    def create_request(name)
-      key = OpenSSL::PKey::RSA.new(2048)
-      csr = OpenSSL::X509::Request.new
-      csr.public_key = key.public_key
-      csr.subject = OpenSSL::X509::Name.new([["CN", name]])
-      csr.version = 2
-      csr.sign(key, @digest)
-      { private_key: key, csr: csr }
-    end
-
-    def create_cert(name, issuer_cert, issuer_key, opts = {})
-      key, cert = build_cert(name, issuer_cert.subject, opts)
-      ef = extension_factory_for(issuer_cert, cert)
-      if opts[:subject_alt_names]
-        ext = ef.create_extension(["subjectAltName", opts[:subject_alt_names], false])
-        cert.add_extension(ext)
-      end
-      if exts = opts[:extensions]
-        exts.each do |e|
-          cert.add_extension(OpenSSL::X509::Extension.new(*e))
-        end
-      end
-      cert.sign(issuer_key, @digest)
-      { private_key: key, cert: cert }
-    end
-
-    def create_intermediate_cert(name, issuer_cert, issuer_key)
-      key, cert = build_cert(name, issuer_cert.subject)
-      ef = extension_factory_for(issuer_cert, cert)
-      CA_EXTENSIONS.each do |ext|
-        cert.add_extension(ef.create_extension(*ext))
-      end
-      cert.sign(issuer_key, @digest)
-      { private_key: key, cert: cert }
-    end
-
-    def create_cacert(name)
-      issuer = OpenSSL::X509::Name.new([["CN", name]])
-      key, cert = build_cert(name, issuer)
-      ef = extension_factory_for(cert, cert)
-      CA_EXTENSIONS.each do |ext|
-        cert.add_extension(ef.create_extension(*ext))
-      end
-      cert.sign(key, @digest)
-      { private_key: key, cert: cert }
-    end
-
-    def create_crl(issuer_cert, issuer_key)
-      crl = OpenSSL::X509::CRL.new
-      crl.version = 1
-      crl.issuer = issuer_cert.subject
-      ef = extension_factory_for(issuer_cert)
-      crl.add_extension(
-        ef.create_extension(["authorityKeyIdentifier", "keyid:always", false]))
-      crl.add_extension(
-        OpenSSL::X509::Extension.new("crlNumber", OpenSSL::ASN1::Integer(0)))
-      crl.last_update = CERT_VALID_FROM
-      crl.next_update = CERT_VALID_UNTIL
-      crl.sign(issuer_key, @digest)
-      crl
-    end
-
-    def sign(csr, opts = {})
-      cert = OpenSSL::X509::Certificate.new
-      cert.public_key = csr.public_key
-      cert.subject = csr.subject
-      cert.issuer = @ca_cert.subject
-      cert.version = 2
-      cert.serial = self.class.next_serial
-      cert.not_before = CERT_VALID_FROM
-      cert.not_after =  CERT_VALID_UNTIL
-      ef = extension_factory_for(@ca_cert, cert)
-      if opts[:subject_alt_names]
-        ext = ef.create_extension(["subjectAltName", opts[:subject_alt_names], false])
-        cert.add_extension(ext)
-      end
-      cert.sign(@key, @digest)
-      Puppet::SSL::Certificate.from_instance(cert)
-    end
-
-    def revoke(cert, crl = @crl, issuer_key = @key)
-      revoked = OpenSSL::X509::Revoked.new
-      revoked.serial = cert.serial
-      revoked.time = Time.now
-      enum = OpenSSL::ASN1::Enumerated(OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
-      ext = OpenSSL::X509::Extension.new("CRLReason", enum)
-      revoked.add_extension(ext)
-      crl.add_revoked(revoked)
-      crl.sign(issuer_key, @digest)
-    end
-
-    def generate(name, opts)
-      info = create_request(name)
-      cert = sign(info[:csr], opts).content
-      info.merge(cert: cert)
-    end
-
-    private
-
-    def build_cert(name, issuer, opts = {})
-      key = if opts[:key_type] == :ec
-              key = OpenSSL::PKey::EC.generate('prime256v1')
-            else
-              key = OpenSSL::PKey::RSA.new(2048)
-            end
-      cert = OpenSSL::X509::Certificate.new
-      cert.public_key = if key.is_a?(OpenSSL::PKey::EC)
-                         # EC#public_key doesn't following the PKey API,
-                         # see https://github.com/ruby/openssl/issues/29
-                         point = key.public_key
-                         pubkey = OpenSSL::PKey::EC.new(point.group)
-                         pubkey.public_key = point
-                         pubkey
-                       else
-                         key.public_key
-                       end
-      cert.subject = OpenSSL::X509::Name.new([["CN", name]])
-      cert.issuer = issuer
-      cert.version = 2
-      cert.serial = self.class.next_serial
-      cert.not_before = CERT_VALID_FROM
-      cert.not_after = CERT_VALID_UNTIL
-      [key, cert]
-    end
-
-    def extension_factory_for(ca, cert = nil)
-      ef = OpenSSL::X509::ExtensionFactory.new
-      ef.issuer_certificate  = ca
-      ef.subject_certificate = cert if cert
-      ef
-    end
-  end
-end

data/spec/lib/puppet_spec/character_encoding.rb

@@ -1,12 +0,0 @@
-# A support module for testing character encoding
-module PuppetSpec::CharacterEncoding
-  def self.with_external_encoding(encoding, &blk)
-    original_encoding = Encoding.default_external
-    begin
-      Encoding.default_external = encoding
-      yield
-    ensure
-      Encoding.default_external = original_encoding
-    end
-  end
-end