puppet 7.3.0 → 7.7.0

data/spec/unit/file_bucket/dipper_spec.rb

@@ -225,7 +225,7 @@ describe Puppet::FileBucket::Dipper, :uses_checksums => true do
         # Modify mtime of the second file to be an hour ago
         onehourago = Time.now - onehour
         bucketed_paths_file = Dir.glob("#{file_bucket}/**/#{checksum}/paths")
-        FileUtils.touch(bucketed_paths_file, :mtime => onehourago)
+        FileUtils.touch(bucketed_paths_file, mtime: onehourago)
         expected_list2 = /#{checksum} \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} #{real_path}\n/
 
         now = Time.now

data/spec/unit/file_serving/fileset_spec.rb

@@ -46,6 +46,13 @@ describe Puppet::FileServing::Fileset do
       expect(set.recurselimit).to eq(3)
     end
 
+    it "accepts a 'max_files' option" do
+      expect(Puppet::FileSystem).to receive(:lstat).with(somefile).and_return(double('stat'))
+      set = Puppet::FileServing::Fileset.new(somefile, :recurselimit => 3, :max_files => 100)
+      expect(set.recurselimit).to eq(3)
+      expect(set.max_files).to eq(100)
+    end
+
     it "accepts an 'ignore' option" do
       expect(Puppet::FileSystem).to receive(:lstat).with(somefile).and_return(double('stat'))
       set = Puppet::FileServing::Fileset.new(somefile, :ignore => ".svn")
@@ -160,6 +167,29 @@ describe Puppet::FileServing::Fileset do
       end
     end
 
+    def mock_big_dir_structure(path, stat_method = :lstat)
+      allow(Puppet::FileSystem).to receive(stat_method).with(path).and_return(@dirstat)
+
+      # Keep track of the files we're stubbing.
+      @files = %w{.}
+
+      top_names = (1..10).map {|i| "dir_#{i}" }
+      sub_names = (1..100).map {|i| "file__#{i}" }
+
+      allow(Dir).to receive(:entries).with(path, encoding: Encoding::UTF_8).and_return(top_names)
+      top_names.each do |subdir|
+        @files << subdir # relative path
+        subpath = File.join(path, subdir)
+        allow(Puppet::FileSystem).to receive(stat_method).with(subpath).and_return(@dirstat)
+        allow(Dir).to receive(:entries).with(subpath, encoding: Encoding::UTF_8).and_return(sub_names)
+        sub_names.each do |file|
+          @files << File.join(subdir, file) # relative path
+          subfile_path = File.join(subpath, file)
+          allow(Puppet::FileSystem).to receive(stat_method).with(subfile_path).and_return(@filestat)
+        end
+      end
+    end
+
     def setup_mocks_for_dir(mock_dir, base_path)
       path = File.join(base_path, mock_dir.name)
       allow(Puppet::FileSystem).to receive(:lstat).with(path).and_return(MockStat.new(path, true))
@@ -258,6 +288,36 @@ describe Puppet::FileServing::Fileset do
       expect(@fileset.files.find { |file| file.include?("0") }).to be_nil
     end
 
+    it "raises exception if number of files is greater than :max_files" do
+      mock_dir_structure(@path)
+      @fileset.recurse = true
+      @fileset.max_files = 22
+      expect { @fileset.files }.to raise_error(Puppet::Error, "The directory '#{@path}' contains 28 entries, which exceeds the limit of 22 specified by the max_files parameter for this resource. The limit may be increased, but be aware that large number of file resources can result in excessive resource consumption and degraded performance. Consider using an alternate method to manage large directory trees")
+    end
+
+    it "logs a warning if number of files is greater than soft max_files limit of 1000" do
+      mock_big_dir_structure(@path)
+      @fileset.recurse = true
+      expect(Puppet).to receive(:warning).with("The directory '#{@path}' contains 1010 entries, which exceeds the default soft limit 1000 and may cause excessive resource consumption and degraded performance. To remove this warning set a value for `max_files` parameter or consider using an alternate method to manage large directory trees")
+      expect { @fileset.files }.to_not raise_error
+    end
+
+    it "does not emit a warning if max_files is -1" do
+      mock_big_dir_structure(@path)
+      @fileset.recurse = true
+      @fileset.max_files = -1
+      expect(Puppet).to receive(:warning).never
+      @fileset.files
+    end
+
+    it "does not emit a warning if max_files is `-1`(string)" do
+      mock_big_dir_structure(@path)
+      @fileset.recurse = true
+      @fileset.max_files = '-1'
+      expect(Puppet).to receive(:warning).never
+      @fileset.files
+    end
+
     it "ignores files that match a pattern given as a boolean" do
       mock_dir_structure(@path)
       @fileset.recurse = true

data/spec/unit/file_system_spec.rb

@@ -999,6 +999,15 @@ describe "Puppet::FileSystem" do
             Puppet::FileSystem.replace_file(dest, 0755) { |_| }
           }.to raise_error(ArgumentError, /Only modes 0644, 0640, 0660, and 0440 are allowed/)
         end
+
+        it 'falls back to fully qualified user name when sid retrieval fails' do
+          current_user_sid = Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name)
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with(Puppet::Util::Windows::ADSI::User.current_user_name).and_return(nil, current_user_sid)
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with(Puppet::Util::Windows::ADSI::User.current_sam_compatible_user_name).and_call_original
+
+          Puppet::FileSystem.replace_file(dest, 0644) { |f| f.write(content) }
+          expects_public_file(dest)
+        end
       end
     end
 

data/spec/unit/gettext/config_spec.rb

@@ -27,6 +27,18 @@ describe Puppet::GettextConfig do
     Puppet::GettextConfig.delete_all_text_domains
   end
 
+  # These tests assume gettext is enabled, but it will be disabled when the
+  # first time the `Puppet[:disable_i18n]` setting is resolved
+  around(:each) do |example|
+    disabled = Puppet::GettextConfig.instance_variable_get(:@gettext_disabled)
+    Puppet::GettextConfig.instance_variable_set(:@gettext_disabled, false)
+    begin
+      example.run
+    ensure
+      Puppet::GettextConfig.instance_variable_set(:@gettext_disabled, disabled)
+    end
+  end
+
   describe 'setting and getting the locale' do
     it 'should return "en" when gettext is unavailable' do
       allow(Puppet::GettextConfig).to receive(:gettext_loaded?).and_return(false)

data/spec/unit/http/factory_spec.rb

@@ -138,4 +138,23 @@ describe Puppet::HTTP::Factory do
       expect(conn.local_host).to eq('127.0.0.1')
     end
   end
+
+  context 'tls' do
+    it "sets the minimum version to TLS 1.0", if: RUBY_VERSION.to_f >= 2.5 do
+      conn = create_connection(site)
+      expect(conn.min_version).to eq(OpenSSL::SSL::TLS1_VERSION)
+    end
+
+    it "defaults to ciphersuites providing 128 bits of security or greater" do
+      conn = create_connection(site)
+      expect(conn.ciphers).to eq("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256")
+    end
+
+    it "can be restricted to TLSv1.3 ciphers" do
+      tls13_ciphers = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
+      Puppet[:ciphers] = tls13_ciphers
+      conn = create_connection(site)
+      expect(conn.ciphers).to eq(tls13_ciphers)
+    end
+  end
 end

data/spec/unit/http/service/compiler_spec.rb

@@ -1,3 +1,4 @@
+
 # coding: utf-8
 require 'spec_helper'
 require 'puppet/http'
@@ -257,6 +258,128 @@ describe Puppet::HTTP::Service::Compiler do
     end
   end
 
+  context 'when posting for a v4 catalog' do
+    let(:uri) {"https://compiler.example.com:8140/puppet/v4/catalog"}
+    let(:persistence) {{ facts: true, catalog: true }}
+    let(:facts) {{ 'foo' => 'bar' }}
+    let(:trusted_facts) {{}}
+    let(:uuid) { "ec3d2844-b236-4287-b0ad-632fbb4d1ff0" }
+    let(:job_id) { "1" }
+    let(:payload) {{
+      environment: environment,
+      persistence: persistence,
+      facts: facts,
+      trusted_facts: trusted_facts,
+      transaction_uuid: uuid,
+      job_id: job_id,
+      options: {
+        prefer_requested_environment: false,
+        capture_logs: false
+      }
+    }}
+    let(:serialized_catalog) {{ 'catalog' => catalog.to_data_hash }.to_json}
+    let(:catalog_response) {{ body: serialized_catalog, headers: {'Content-Type' => formatter.mime }}}
+
+    it 'includes default HTTP headers' do
+      stub_request(:post, uri).with do |request|
+        expect(request.headers).to include({'X-Puppet-Version' => /./, 'User-Agent' => /./})
+        expect(request.headers).to_not include('X-Puppet-Profiling')
+      end.to_return(**catalog_response)
+
+      subject.post_catalog4(certname, **payload)
+    end
+
+    it 'defaults the server and port based on settings' do
+      Puppet[:server] = 'compiler2.example.com'
+      Puppet[:serverport] = 8141
+
+      stub_request(:post, "https://compiler2.example.com:8141/puppet/v4/catalog")
+        .to_return(**catalog_response)
+
+      subject.post_catalog4(certname, **payload)
+    end
+
+    it 'includes puppet headers set via the :http_extra_headers and :profile settings' do
+      stub_request(:post, uri).with(headers: {'Example-Header' => 'real-thing', 'another' => 'thing', 'X-Puppet-Profiling' => 'true'}).
+        to_return(**catalog_response)
+
+      Puppet[:http_extra_headers] = 'Example-Header:real-thing,another:thing'
+      Puppet[:profile] = true
+
+      subject.post_catalog4(certname, **payload)
+    end
+
+    it 'returns a deserialized catalog' do
+      stub_request(:post, uri)
+        .to_return(**catalog_response)
+
+      _, cat, _ = subject.post_catalog4(certname, **payload)
+      expect(cat).to be_a(Puppet::Resource::Catalog)
+      expect(cat.name).to eq(certname)
+    end
+
+    it 'returns the request response' do
+      stub_request(:post, uri)
+        .to_return(**catalog_response)
+
+      resp, _, _ = subject.post_catalog4(certname, **payload)
+      expect(resp).to be_a(Puppet::HTTP::Response)
+    end
+
+    it 'raises a response error if unsuccessful' do
+      stub_request(:post, uri)
+        .to_return(status: [500, "Server Error"])
+
+      expect {
+        subject.post_catalog4(certname, **payload)
+      }.to raise_error do |err|
+        expect(err).to be_an_instance_of(Puppet::HTTP::ResponseError)
+        expect(err.message).to eq('Server Error')
+        expect(err.response.code).to eq(500)
+      end
+    end
+
+    it 'raises a response error when server response is not JSON' do
+      stub_request(:post, uri)
+        .to_return(body: "this isn't valid JSON", headers: {'Content-Type' => 'application/json'})
+
+      expect {
+        subject.post_catalog4(certname, **payload)
+      }.to raise_error do |err|
+        expect(err).to be_an_instance_of(Puppet::HTTP::SerializationError)
+        expect(err.message).to match(/Failed to deserialize catalog from puppetserver response/)
+      end
+    end
+
+    it 'raises a response error when server response a JSON serialized catalog' do
+      stub_request(:post, uri)
+        .to_return(body: {oops: 'bad response data'}.to_json, headers: {'Content-Type' => 'application/json'})
+
+      expect {
+        subject.post_catalog4(certname, **payload)
+      }.to raise_error do |err|
+        expect(err).to be_an_instance_of(Puppet::HTTP::SerializationError)
+        expect(err.message).to match(/Failed to deserialize catalog from puppetserver response/)
+      end
+    end
+
+    it 'raises ArgumentError when the `persistence` hash does not contain required keys' do
+      payload[:persistence].delete(:facts)
+      expect { subject.post_catalog4(certname, **payload) }.to raise_error do |err|
+        expect(err).to be_an_instance_of(ArgumentError)
+        expect(err.message).to match(/The 'persistence' hash is missing the keys: facts/)
+      end
+    end
+
+    it 'raises ArgumentError when `facts` are not a Hash' do
+      payload[:facts] = Puppet::Node::Facts.new(certname)
+      expect { subject.post_catalog4(certname, **payload) }.to raise_error do |err|
+        expect(err).to be_an_instance_of(ArgumentError)
+        expect(err.message).to match(/Facts must be a Hash not a Puppet::Node::Facts/)
+      end
+    end
+  end
+
   context 'when getting a node' do
     let(:uri) { %r{/puppet/v3/node/ziggy} }
     let(:node_response) { { body: formatter.render(node), headers: {'Content-Type' => formatter.mime } } }

data/spec/unit/indirector/catalog/compiler_spec.rb

@@ -909,9 +909,10 @@ describe Puppet::Resource::Catalog::Compiler do
         it "inlines child metadata" do
           catalog = compile_to_catalog(<<-MANIFEST, node)
             file { '#{path}':
-              ensure  => directory,
-              recurse => true,
-              source  => '#{source_dir}'
+              ensure    => directory,
+              recurse   => true,
+              source    => '#{source_dir}',
+              max_files => 1234,
             }
           MANIFEST
 
@@ -925,6 +926,7 @@ describe Puppet::Resource::Catalog::Compiler do
             :source_permissions => :ignore,
             :recurse            => true,
             :recurselimit       => nil,
+            :max_files          => 1234,
             :ignore             => nil,
           }
           expect(Puppet::FileServing::Metadata.indirection).to receive(:search).with(source_dir, options).and_return([metadata, child_metadata])
@@ -938,14 +940,15 @@ describe Puppet::Resource::Catalog::Compiler do
         it "uses resource parameters when inlining metadata" do
           catalog = compile_to_catalog(<<-MANIFEST, node)
             file { '#{path}':
-              ensure  => directory,
-              recurse => true,
-              source  => '#{source_dir}',
-              checksum => sha256,
+              ensure             => directory,
+              recurse            => true,
+              source             => '#{source_dir}',
+              checksum           => sha256,
               source_permissions => use_when_creating,
-              recurselimit => 2,
-              ignore => 'foo.+',
-              links => follow,
+              recurselimit       => 2,
+              max_files          => 4321,
+              ignore             => 'foo.+',
+              links              => follow,
             }
           MANIFEST
 
@@ -956,6 +959,7 @@ describe Puppet::Resource::Catalog::Compiler do
             :source_permissions => :use_when_creating,
             :recurse            => true,
             :recurselimit       => 2,
+            :max_files          => 4321,
             :ignore             => 'foo.+',
           }
           expect(Puppet::FileServing::Metadata.indirection).to receive(:search).with(source_dir, options).and_return([metadata, child_metadata])

data/spec/unit/indirector/facts/facter_spec.rb

@@ -182,6 +182,15 @@ describe Puppet::Node::Facts::Facter do
       end
     end
 
+    context 'when --timing flag is present' do
+      let(:options) { { resolve_options: true, user_query: ["os", "timezone"], timing: true } }
+
+      it 'calls Facter.resolve with --timing' do
+        expect(Facter).to receive(:resolve).with("os timezone --timing")
+        @facter.find(@request)
+      end
+    end
+
     describe 'when Facter version is lower than 4.0.40' do
       before :each do
         allow(Facter).to receive(:respond_to?).and_return(false)

data/spec/unit/module_spec.rb

@@ -478,7 +478,7 @@ describe Puppet::Module do
     end
   end
 
-  [:plugins, :pluginfacts, :templates, :files, :manifests].each do |filetype|
+  [:plugins, :pluginfacts, :templates, :files, :manifests, :scripts].each do |filetype|
     case filetype
       when :plugins
         dirname = "lib"

data/spec/unit/network/http/api/master_spec.rb

@@ -0,0 +1,38 @@
+# Tests the backwards compatibility of our master -> server changes
+# in the HTTP API
+# This may be removed in Puppet 8
+require 'spec_helper'
+
+require 'puppet/network/http'
+require 'puppet_spec/network'
+
+describe Puppet::Network::HTTP::API::Master::V3 do
+  include PuppetSpec::Network
+
+  let(:response) { Puppet::Network::HTTP::MemoryResponse.new }
+  let(:server_url_prefix) { "#{Puppet::Network::HTTP::MASTER_URL_PREFIX}/v3" }
+  let(:server_routes) {
+    Puppet::Network::HTTP::Route.
+        path(Regexp.new("#{Puppet::Network::HTTP::MASTER_URL_PREFIX}/")).
+        any.
+        chain(Puppet::Network::HTTP::API::Master::V3.routes)
+  }
+
+  # simulate puppetserver registering its authconfigloader class
+  around :each do |example|
+    Puppet::Network::Authorization.authconfigloader_class = Object
+    begin
+      example.run
+    ensure
+      Puppet::Network::Authorization.authconfigloader_class = nil
+    end
+  end
+
+  it "mounts the environments endpoint" do
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{server_url_prefix}/environments")
+    server_routes.process(request, response)
+
+    expect(response.code).to eq(200)
+  end
+end
+

data/spec/unit/network/http/api/{master → server}/v3/environments_spec.rb

@@ -4,12 +4,12 @@ require 'puppet/node/environment'
 require 'puppet/network/http'
 require 'matchers/json'
 
-describe Puppet::Network::HTTP::API::Master::V3::Environments do
+describe Puppet::Network::HTTP::API::Server::V3::Environments do
   include JSONMatchers
 
   let(:environment) { Puppet::Node::Environment.create(:production, ["/first", "/second"], '/manifests') }
   let(:loader) { Puppet::Environments::Static.new(environment) }
-  let(:handler) { Puppet::Network::HTTP::API::Master::V3::Environments.new(loader) }
+  let(:handler) { Puppet::Network::HTTP::API::Server::V3::Environments.new(loader) }
   let(:request) { Puppet::Network::HTTP::Request.from_hash(:headers => { 'accept' => 'application/json' }) }
   let(:response) { Puppet::Network::HTTP::MemoryResponse.new }
 

data/spec/unit/network/http/api/{master → server}/v3_spec.rb

@@ -3,16 +3,16 @@ require 'spec_helper'
 require 'puppet/network/http'
 require 'puppet_spec/network'
 
-describe Puppet::Network::HTTP::API::Master::V3 do
+describe Puppet::Network::HTTP::API::Server::V3 do
   include PuppetSpec::Network
 
   let(:response) { Puppet::Network::HTTP::MemoryResponse.new }
-  let(:master_url_prefix) { "#{Puppet::Network::HTTP::MASTER_URL_PREFIX}/v3" }
-  let(:master_routes) {
+  let(:server_url_prefix) { "#{Puppet::Network::HTTP::SERVER_URL_PREFIX}/v3" }
+  let(:server_routes) {
     Puppet::Network::HTTP::Route.
-        path(Regexp.new("#{Puppet::Network::HTTP::MASTER_URL_PREFIX}/")).
+        path(Regexp.new("#{Puppet::Network::HTTP::SERVER_URL_PREFIX}/")).
         any.
-        chain(Puppet::Network::HTTP::API::Master::V3.routes)
+        chain(Puppet::Network::HTTP::API::Server::V3.routes)
   }
 
   # simulate puppetserver registering its authconfigloader class
@@ -26,53 +26,53 @@ describe Puppet::Network::HTTP::API::Master::V3 do
   end
 
   it "mounts the environments endpoint" do
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environments")
-    master_routes.process(request, response)
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{server_url_prefix}/environments")
+    server_routes.process(request, response)
 
     expect(response.code).to eq(200)
   end
 
   it "matches only complete routes" do
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/foo/environments")
-    expect { master_routes.process(request, response) }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotFoundError)
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{server_url_prefix}/foo/environments")
+    expect { server_routes.process(request, response) }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotFoundError)
 
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/foo/environment/production")
-    expect { master_routes.process(request, response) }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotFoundError)
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{server_url_prefix}/foo/environment/production")
+    expect { server_routes.process(request, response) }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotFoundError)
   end
 
   it "mounts indirected routes" do
     request = Puppet::Network::HTTP::Request.
-        from_hash(:path => "#{master_url_prefix}/node/foo",
+        from_hash(:path => "#{server_url_prefix}/node/foo",
                   :params => {:environment => "production"},
                   :headers => {"accept" => "application/json"})
-    master_routes.process(request, response)
+    server_routes.process(request, response)
 
     expect(response.code).to eq(200)
   end
 
   it "responds to unknown paths by raising not_found_error" do
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/unknown")
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{server_url_prefix}/unknown")
 
     expect {
-      master_routes.process(request, response)
+      server_routes.process(request, response)
     }.to raise_error(not_found_error)
   end
 
   it "checks authorization for indirected routes" do
     Puppet::Network::Authorization.authconfigloader_class = nil
 
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/catalog/foo")
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{server_url_prefix}/catalog/foo")
     expect {
-      master_routes.process(request, response)
+      server_routes.process(request, response)
     }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, %r{Not Authorized: Forbidden request: /puppet/v3/catalog/foo \(method GET\)})
   end
 
   it "checks authorization for environments" do
     Puppet::Network::Authorization.authconfigloader_class = nil
 
-    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{master_url_prefix}/environments")
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "#{server_url_prefix}/environments")
     expect {
-      master_routes.process(request, response)
+      server_routes.process(request, response)
     }.to raise_error(Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, %r{Not Authorized: Forbidden request: /puppet/v3/environments \(method GET\)})
   end
 end