puppet 7.28.0-universal-darwin → 7.29.0-universal-darwin

data/spec/unit/ssl/certificate_spec.rb

@@ -1,183 +0,0 @@
-require 'spec_helper'
-require 'puppet/certificate_factory'
-
-require 'puppet/ssl/certificate'
-
-describe Puppet::SSL::Certificate do
-  let :key do OpenSSL::PKey::RSA.new(Puppet[:keylength]) end
-
-  # Sign the provided cert so that it can be DER-decoded later
-  def sign_wrapped_cert(cert)
-    signer = Puppet::SSL::CertificateSigner.new
-    signer.sign(cert.content, key)
-  end
-
-  before do
-    @class = Puppet::SSL::Certificate
-  end
-
-  it "should only support the text format" do
-    expect(@class.supported_formats).to eq([:s])
-  end
-
-  describe "when converting from a string" do
-    it "should create a certificate instance with its name set to the certificate subject and its content set to the extracted certificate" do
-      cert = double(
-        'certificate',
-        :subject => OpenSSL::X509::Name.parse("/CN=Foo.madstop.com"),
-        :is_a? => true
-      )
-      expect(OpenSSL::X509::Certificate).to receive(:new).with("my certificate").and_return(cert)
-
-      mycert = double('sslcert')
-      expect(mycert).to receive(:content=).with(cert)
-
-      expect(@class).to receive(:new).with("Foo.madstop.com").and_return(mycert)
-
-      @class.from_s("my certificate")
-    end
-
-    it "should create multiple certificate instances when asked" do
-      cert1 = double('cert1')
-      expect(@class).to receive(:from_s).with("cert1").and_return(cert1)
-      cert2 = double('cert2')
-      expect(@class).to receive(:from_s).with("cert2").and_return(cert2)
-
-      expect(@class.from_multiple_s("cert1\n---\ncert2")).to eq([cert1, cert2])
-    end
-  end
-
-  describe "when converting to a string" do
-    before do
-      @certificate = @class.new("myname")
-    end
-
-    it "should return an empty string when it has no certificate" do
-      expect(@certificate.to_s).to eq("")
-    end
-
-    it "should convert the certificate to pem format" do
-      certificate = double('certificate', :to_pem => "pem")
-      @certificate.content = certificate
-      expect(@certificate.to_s).to eq("pem")
-    end
-
-    it "should be able to convert multiple instances to a string" do
-      cert2 = @class.new("foo")
-      expect(@certificate).to receive(:to_s).and_return("cert1")
-      expect(cert2).to receive(:to_s).and_return("cert2")
-
-      expect(@class.to_multiple_s([@certificate, cert2])).to eq("cert1\n---\ncert2")
-
-    end
-  end
-
-  describe "when managing instances" do
-    def build_cert(opts)
-      key = OpenSSL::PKey::RSA.new(Puppet[:keylength])
-      csr = Puppet::SSL::CertificateRequest.new('quux')
-      csr.generate(key, opts)
-
-      raw_cert = Puppet::CertificateFactory.build('client', csr, csr.content, 14)
-      @class.from_instance(raw_cert)
-    end
-
-    before do
-      @certificate = @class.new("myname")
-    end
-
-    it "should have a name attribute" do
-      expect(@certificate.name).to eq("myname")
-    end
-
-    it "should convert its name to a string and downcase it" do
-      expect(@class.new(:MyName).name).to eq("myname")
-    end
-
-    it "should have a content attribute" do
-      expect(@certificate).to respond_to(:content)
-    end
-
-    describe "#subject_alt_names", :unless => RUBY_PLATFORM == 'java' do
-      it "should list all alternate names when the extension is present" do
-        certificate = build_cert(:dns_alt_names => 'foo, bar,baz')
-        expect(certificate.subject_alt_names).
-          to match_array(['DNS:foo', 'DNS:bar', 'DNS:baz', 'DNS:quux'])
-      end
-
-      it "should return an empty list of names if the extension is absent" do
-        certificate = build_cert({})
-        expect(certificate.subject_alt_names).to be_empty
-      end
-    end
-
-    describe "custom extensions", :unless => RUBY_PLATFORM == 'java' do
-      it "returns extensions under the ppRegCertExt" do
-        exts = {'pp_uuid' => 'abcdfd'}
-        cert = build_cert(:extension_requests => exts)
-        sign_wrapped_cert(cert)
-        expect(cert.custom_extensions).to include('oid' => 'pp_uuid', 'value' => 'abcdfd')
-      end
-
-      it "returns extensions under the ppPrivCertExt" do
-        exts = {'1.3.6.1.4.1.34380.1.2.1' => 'x509 :('}
-        cert = build_cert(:extension_requests => exts)
-        sign_wrapped_cert(cert)
-        expect(cert.custom_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'x509 :(')
-      end
-
-      it "returns extensions under the ppAuthCertExt" do
-        exts = {'pp_auth_role' => 'taketwo'}
-        cert = build_cert(:extension_requests => exts)
-        sign_wrapped_cert(cert)
-        expect(cert.custom_extensions).to include('oid' => 'pp_auth_role', 'value' => 'taketwo')
-      end
-
-      it "doesn't return standard extensions" do
-        cert = build_cert(:dns_alt_names => 'foo')
-        expect(cert.custom_extensions).to be_empty
-      end
-    end
-
-    it "should return a nil expiration if there is no actual certificate" do
-      allow(@certificate).to receive(:content).and_return(nil)
-
-      expect(@certificate.expiration).to be_nil
-    end
-
-    it "should use the expiration of the certificate as its expiration date" do
-      cert = double('cert')
-      allow(@certificate).to receive(:content).and_return(cert)
-
-      expect(cert).to receive(:not_after).and_return("sometime")
-
-      expect(@certificate.expiration).to eq("sometime")
-    end
-
-    it "should be able to read certificates from disk" do
-      path = "/my/path"
-      expect(Puppet::FileSystem).to receive(:read).with(path, {:encoding => Encoding::ASCII}).and_return("my certificate")
-      certificate = double('certificate')
-      expect(OpenSSL::X509::Certificate).to receive(:new).with("my certificate").and_return(certificate)
-      expect(@certificate.read(path)).to equal(certificate)
-      expect(@certificate.content).to equal(certificate)
-    end
-
-    it "should have a :to_text method that it delegates to the actual key" do
-      real_certificate = double('certificate')
-      expect(real_certificate).to receive(:to_text).and_return("certificatetext")
-      @certificate.content = real_certificate
-      expect(@certificate.to_text).to eq("certificatetext")
-    end
-
-    it "should parse the old non-DER encoded extension values" do
-      cert = OpenSSL::X509::Certificate.new(File.read(my_fixture("old-style-cert-exts.pem")))
-      wrapped_cert = Puppet::SSL::Certificate.from_instance cert
-      exts = wrapped_cert.custom_extensions
-
-      expect(exts.find { |ext| ext['oid'] == 'pp_uuid'}['value']).to eq('I-AM-A-UUID')
-      expect(exts.find { |ext| ext['oid'] == 'pp_instance_id'}['value']).to eq('i_am_an_id')
-      expect(exts.find { |ext| ext['oid'] == 'pp_image_name'}['value']).to eq('i_am_an_image_name')
-    end
-  end
-end

data/spec/unit/ssl/digest_spec.rb

@@ -1,34 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/ssl/digest'
-
-describe Puppet::SSL::Digest do
-  it "defaults to sha256" do
-    digest = described_class.new(nil, 'blah')
-    expect(digest.name).to eq('SHA256')
-    expect(digest.digest.hexdigest).to eq("8b7df143d91c716ecfa5fc1730022f6b421b05cedee8fd52b1fc65a96030ad52")
-  end
-
-  describe '#name' do
-    it "prints the hashing algorithm used by the openssl digest" do
-      expect(described_class.new('SHA224', 'blah').name).to eq('SHA224')
-    end
-
-    it "upcases the hashing algorithm" do
-      expect(described_class.new('sha224', 'blah').name).to eq('SHA224')
-    end
-  end
-
-  describe '#to_hex' do
-    it "returns ':' separated upper case hex pairs" do
-      described_class.new(nil, 'blah').to_hex =~ /\A([A-Z0-9]:)+[A-Z0-9]\Z/
-    end
-  end
-
-  describe '#to_s' do
-    it "formats the digest algorithm and the digest as a string" do
-      digest = described_class.new('sha512', 'some content')
-      expect(digest.to_s).to eq("(#{digest.name}) #{digest.to_hex}")
-    end
-  end
-end

data/spec/unit/ssl/oids_spec.rb

@@ -1,73 +0,0 @@
-require 'spec_helper'
-require 'puppet/ssl/oids'
-
-describe Puppet::SSL::Oids do
-  describe "defining application OIDs" do
-
-    {
-      'puppetlabs'          => '1.3.6.1.4.1.34380',
-      'ppCertExt'           => '1.3.6.1.4.1.34380.1',
-      'ppRegCertExt'        => '1.3.6.1.4.1.34380.1.1',
-      'pp_uuid'             => '1.3.6.1.4.1.34380.1.1.1',
-      'pp_instance_id'      => '1.3.6.1.4.1.34380.1.1.2',
-      'pp_image_name'       => '1.3.6.1.4.1.34380.1.1.3',
-      'pp_preshared_key'    => '1.3.6.1.4.1.34380.1.1.4',
-      'pp_cost_center'      => '1.3.6.1.4.1.34380.1.1.5',
-      'pp_product'          => '1.3.6.1.4.1.34380.1.1.6',
-      'pp_project'          => '1.3.6.1.4.1.34380.1.1.7',
-      'pp_application'      => '1.3.6.1.4.1.34380.1.1.8',
-      'pp_service'          => '1.3.6.1.4.1.34380.1.1.9',
-      'pp_employee'         => '1.3.6.1.4.1.34380.1.1.10',
-      'pp_created_by'       => '1.3.6.1.4.1.34380.1.1.11',
-      'pp_environment'      => '1.3.6.1.4.1.34380.1.1.12',
-      'pp_role'             => '1.3.6.1.4.1.34380.1.1.13',
-      'pp_software_version' => '1.3.6.1.4.1.34380.1.1.14',
-      'pp_department'       => '1.3.6.1.4.1.34380.1.1.15',
-      'pp_cluster'          => '1.3.6.1.4.1.34380.1.1.16',
-      'pp_provisioner'      => '1.3.6.1.4.1.34380.1.1.17',
-      'pp_region'           => '1.3.6.1.4.1.34380.1.1.18',
-      'pp_datacenter'       => '1.3.6.1.4.1.34380.1.1.19',
-      'pp_zone'             => '1.3.6.1.4.1.34380.1.1.20',
-      'pp_network'          => '1.3.6.1.4.1.34380.1.1.21',
-      'pp_securitypolicy'   => '1.3.6.1.4.1.34380.1.1.22',
-      'pp_cloudplatform'    => '1.3.6.1.4.1.34380.1.1.23',
-      'pp_apptier'          => '1.3.6.1.4.1.34380.1.1.24',
-      'pp_hostname'         => '1.3.6.1.4.1.34380.1.1.25',
-      'pp_owner'            => '1.3.6.1.4.1.34380.1.1.26',
-      'ppPrivCertExt'       => '1.3.6.1.4.1.34380.1.2',
-      'ppAuthCertExt'       => '1.3.6.1.4.1.34380.1.3',
-      'pp_authorization'    => '1.3.6.1.4.1.34380.1.3.1',
-      'pp_auth_role'        => '1.3.6.1.4.1.34380.1.3.13',
-    }.each_pair do |sn, oid|
-      it "defines #{sn} as #{oid}" do
-        object_id = OpenSSL::ASN1::ObjectId.new(sn)
-        expect(object_id.oid).to eq oid
-      end
-    end
-  end
-
-  describe "checking if an OID is a subtree of another OID" do
-
-    it "can determine if an OID is contained in another OID" do
-      expect(described_class.subtree_of?('1.3.6.1', '1.3.6.1.4.1')).to be_truthy
-      expect(described_class.subtree_of?('1.3.6.1.4.1', '1.3.6.1')).to be_falsey
-    end
-
-    it "returns true if an OID is compared against itself and exclusive is false" do
-      expect(described_class.subtree_of?('1.3.6.1', '1.3.6.1', false)).to be_truthy
-    end
-
-    it "returns false if an OID is compared against itself and exclusive is true" do
-      expect(described_class.subtree_of?('1.3.6.1', '1.3.6.1', true)).to be_falsey
-    end
-
-    it "can compare OIDs defined as short names" do
-      expect(described_class.subtree_of?('IANA', '1.3.6.1.4.1')).to be_truthy
-      expect(described_class.subtree_of?('1.3.6.1', 'enterprises')).to be_truthy
-    end
-
-    it "returns false when an invalid OID shortname is passed" do
-      expect(described_class.subtree_of?('IANA', 'bananas')).to be_falsey
-    end
-  end
-end