puppet 7.31.0-universal-darwin → 8.0.1-universal-darwin

data/spec/unit/application/resource_spec.rb

@@ -0,0 +1,229 @@
+require 'spec_helper'
+
+require 'puppet/application/resource'
+require 'puppet_spec/character_encoding'
+
+describe Puppet::Application::Resource do
+  include PuppetSpec::Files
+
+  before :each do
+    @resource_app = Puppet::Application[:resource]
+    allow(Puppet::Util::Log).to receive(:newdestination)
+  end
+
+  describe "in preinit" do
+    it "should include provider parameter by default" do
+      @resource_app.preinit
+      expect(@resource_app.extra_params).to eq([:provider])
+    end
+  end
+
+  describe "when handling options" do
+    [:debug, :verbose, :edit].each do |option|
+      it "should store argument value when calling handle_#{option}" do
+        expect(@resource_app.options).to receive(:[]=).with(option, 'arg')
+        @resource_app.send("handle_#{option}".to_sym, 'arg')
+      end
+    end
+
+    it "should load a display all types with types option" do
+      type1 = double('type1', :name => :type1)
+      type2 = double('type2', :name => :type2)
+      allow(Puppet::Type).to receive(:loadall)
+      allow(Puppet::Type).to receive(:eachtype).and_yield(type1).and_yield(type2)
+      expect(@resource_app).to receive(:puts).with(['type1','type2'])
+      expect { @resource_app.handle_types(nil) }.to exit_with 0
+    end
+
+    it "should add param to extra_params list" do
+      @resource_app.extra_params = [ :param1 ]
+      @resource_app.handle_param("whatever")
+
+      expect(@resource_app.extra_params).to eq([ :param1, :whatever ])
+    end
+
+    it "should get a parameter in the printed data if extra_params are passed" do
+      tty  = double("tty",  :tty? => true )
+      path = tmpfile('testfile')
+      command_line = Puppet::Util::CommandLine.new("puppet", [ 'resource', 'file', path ], tty )
+      allow(@resource_app).to receive(:command_line).and_return(command_line)
+
+      # provider is a parameter that should always be available
+      @resource_app.extra_params = [ :provider ]
+
+      expect {
+        @resource_app.main
+      }.to output(/provider\s+=>/).to_stdout
+    end
+  end
+
+  describe "during setup" do
+    before :each do
+      allow(Puppet::Log).to receive(:newdestination)
+    end
+
+    it "should set console as the log destination" do
+      expect(Puppet::Log).to receive(:newdestination).with(:console)
+
+      @resource_app.setup
+    end
+
+    it "should set log level to debug if --debug was passed" do
+      allow(@resource_app.options).to receive(:[]).with(:debug).and_return(true)
+      @resource_app.setup
+      expect(Puppet::Log.level).to eq(:debug)
+    end
+
+    it "should set log level to info if --verbose was passed" do
+      allow(@resource_app.options).to receive(:[]).with(:debug).and_return(false)
+      allow(@resource_app.options).to receive(:[]).with(:verbose).and_return(true)
+      @resource_app.setup
+      expect(Puppet::Log.level).to eq(:info)
+    end
+  end
+
+  describe "when running" do
+    before :each do
+      @type = double('type', :properties => [])
+      allow(@resource_app.command_line).to receive(:args).and_return(['mytype'])
+      allow(Puppet::Type).to receive(:type).and_return(@type)
+
+      @res = double("resource")
+      allow(@res).to receive(:prune_parameters).and_return(@res)
+      allow(@res).to receive(:to_manifest).and_return("resource")
+      @report = double("report")
+
+      allow(@resource_app).to receive(:puts)
+    end
+
+    it "should raise an error if no type is given" do
+      allow(@resource_app.command_line).to receive(:args).and_return([])
+      expect { @resource_app.main }.to raise_error(RuntimeError, "You must specify the type to display")
+    end
+
+    it "should raise an error if the type is not found" do
+      allow(Puppet::Type).to receive(:type).and_return(nil)
+
+      expect { @resource_app.main }.to raise_error(RuntimeError, 'Could not find type mytype')
+    end
+
+    it "should search for resources" do
+      expect(Puppet::Resource.indirection).to receive(:search).with('mytype/', {}).and_return([])
+      @resource_app.main
+    end
+
+    it "should describe the given resource" do
+      allow(@resource_app.command_line).to receive(:args).and_return(['type','name'])
+      expect(Puppet::Resource.indirection).to receive(:find).with('type/name').and_return(@res)
+      @resource_app.main
+    end
+
+    it "should add given parameters to the object" do
+      allow(@resource_app.command_line).to receive(:args).and_return(['type','name','param=temp'])
+
+      expect(Puppet::Resource.indirection).to receive(:save).with(@res, 'type/name').and_return([@res, @report])
+      expect(Puppet::Resource).to receive(:new).with('type', 'name', {:parameters => {'param' => 'temp'}}).and_return(@res)
+
+      @resource_app.main
+    end
+  end
+
+  describe "when printing output" do
+    Puppet::Type.newtype(:stringify) do
+      ensurable
+      newparam(:name, isnamevar: true)
+      newproperty(:string)
+    end
+
+    Puppet::Type.type(:stringify).provide(:stringify) do
+      def exists?
+        true
+      end
+
+      def string
+        Puppet::Util::Execution::ProcessOutput.new('test', 0)
+      end
+    end
+    
+    it "should not emit puppet class tags when printing yaml when strict mode is off" do
+      Puppet[:strict] = :warning
+
+      @resource_app.options[:to_yaml] = true
+      allow(@resource_app.command_line).to receive(:args).and_return(['stringify', 'hello', 'ensure=present', 'string=asd'])
+      expect(@resource_app).to receive(:puts).with(<<~YAML)
+      ---
+      stringify:
+        hello:
+          ensure: present
+          string: test
+      YAML
+      expect { @resource_app.main }.not_to raise_error
+    end
+
+    it "should raise an error when printing yaml by default" do
+      @resource_app.options[:to_yaml] = true
+      allow(@resource_app.command_line).to receive(:args).and_return(['stringify', 'hello', 'ensure=present', 'string=asd'])
+      expect { @resource_app.main }.to raise_error( Puppet::PreformattedError,
+        /Stringify\[hello\]\['string'\] contains a Puppet::Util::Execution::ProcessOutput value. It will be converted to the String 'test'/)
+    end
+
+    it "should ensure all values to be printed are in the external encoding" do
+      resources = [
+        Puppet::Type.type(:user).new(:name => "\u2603".force_encoding(Encoding::UTF_8)).to_resource,
+        Puppet::Type.type(:user).new(:name => "Jos\xE9".force_encoding(Encoding::ISO_8859_1)).to_resource
+      ]
+      expect(Puppet::Resource.indirection).to receive(:search).with('user/', {}).and_return(resources)
+      allow(@resource_app.command_line).to receive(:args).and_return(['user'])
+
+      # All of our output should be in external encoding
+      expect(@resource_app).to receive(:puts) { |args| expect(args.encoding).to eq(Encoding::ISO_8859_1) }
+
+      # This would raise an error if we weren't handling it
+      PuppetSpec::CharacterEncoding.with_external_encoding(Encoding::ISO_8859_1) do
+        expect { @resource_app.main }.not_to raise_error
+      end
+    end
+  end
+
+  describe "when handling file type" do
+    before :each do
+      allow(Facter).to receive(:loadfacts)
+      @resource_app.preinit
+    end
+
+    it "should raise an exception if no file specified" do
+      allow(@resource_app.command_line).to receive(:args).and_return(['file'])
+
+      expect { @resource_app.main }.to raise_error(RuntimeError, /Listing all file instances is not supported/)
+    end
+
+    it "should output a file resource when given a file path" do
+      path = File.expand_path('/etc')
+      res = Puppet::Type.type(:file).new(:path => path).to_resource
+      expect(Puppet::Resource.indirection).to receive(:find).and_return(res)
+
+      allow(@resource_app.command_line).to receive(:args).and_return(['file', path])
+      expect(@resource_app).to receive(:puts).with(/file \{ '#{Regexp.escape(path)}'/m)
+
+      @resource_app.main
+    end
+  end
+
+  describe 'when handling a custom type' do
+    it 'the Puppet::Pops::Loaders instance is available' do
+      Puppet::Type.newtype(:testing) do
+        newparam(:name) do
+          isnamevar
+        end
+        def self.instances
+          fail('Loader not found') unless Puppet::Pops::Loaders.find_loader(nil).is_a?(Puppet::Pops::Loader::Loader)
+          @instances ||= [new(:name => name)]
+        end
+      end
+
+      allow(@resource_app.command_line).to receive(:args).and_return(['testing', 'hello'])
+      expect(@resource_app).to receive(:puts).with("testing { 'hello':\n}")
+      expect { @resource_app.main }.not_to raise_error
+    end
+  end
+end

data/spec/unit/application/ssl_spec.rb

@@ -0,0 +1,458 @@
+require 'spec_helper'
+require 'puppet/application/ssl'
+require 'openssl'
+require 'puppet/test_ca'
+
+describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
+
+  let(:ssl) do
+    app = Puppet::Application[:ssl]
+    app.options[:verbose] = true
+    app.setup_logs
+    app
+  end
+  let(:name) { 'ssl-client' }
+
+  before :all do
+    @ca = Puppet::TestCa.new
+    @ca_cert = @ca.ca_cert
+    @crl = @ca.ca_crl
+    @host = @ca.generate('ssl-client', {})
+  end
+
+  before do
+    Puppet.settings.use(:main)
+    Puppet[:certname] = name
+    Puppet[:vardir] = tmpdir("ssl_testing")
+
+    # Host assumes ca cert and crl are present
+    File.write(Puppet[:localcacert], @ca_cert.to_pem)
+    File.write(Puppet[:hostcrl], @crl.to_pem)
+
+    # Setup our ssl client
+    File.write(Puppet[:hostprivkey], @host[:private_key].to_pem)
+    File.write(Puppet[:hostpubkey], @host[:private_key].public_key.to_pem)
+  end
+
+  def expects_command_to_pass(expected_output = nil)
+    expect {
+      ssl.run_command
+    }.to output(expected_output).to_stdout
+  end
+
+  def expects_command_to_fail(message)
+    expect {
+      expect {
+        ssl.run_command
+      }.to raise_error(Puppet::Error, message)
+    }.to output(/.*/).to_stdout
+  end
+
+  shared_examples_for 'an ssl action' do
+    it 'downloads the CA bundle first when missing' do
+      File.delete(Puppet[:localcacert])
+      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: @ca.ca_cert.to_pem)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_pass
+
+      expect(File.read(Puppet[:localcacert])).to eq(@ca.ca_cert.to_pem)
+    end
+
+    it 'downloads the CRL bundle first when missing' do
+      File.delete(Puppet[:hostcrl])
+      stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: @crl.to_pem)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_pass
+
+      expect(File.read(Puppet[:hostcrl])).to eq(@crl.to_pem)
+    end
+  end
+
+  it 'uses the agent run mode' do
+    # make sure the ssl app resolves certname, server, etc
+    # the same way the agent application does
+    expect(ssl.class.run_mode.name).to eq(:agent)
+  end
+
+  context 'when generating help' do
+    it 'prints a message when an unknown action is specified' do
+      ssl.command_line.args << 'whoops'
+
+      expects_command_to_fail(/Unknown action 'whoops'/)
+    end
+
+    it 'prints a message requiring an action to be specified' do
+      expects_command_to_fail(/An action must be specified/)
+    end
+  end
+
+  context 'when submitting a CSR' do
+    let(:csr_path) { Puppet[:hostcsr] }
+
+    before do
+      ssl.command_line.args << 'submit_request'
+    end
+
+    it_behaves_like 'an ssl action'
+
+    it 'generates an RSA private key' do
+      File.unlink(Puppet[:hostprivkey])
+
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
+    end
+
+    it 'generates an EC private key' do
+      Puppet[:key_type] = 'ec'
+      File.unlink(Puppet[:hostprivkey])
+
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
+    end
+
+    it 'registers OIDs' do
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expect(Puppet::SSL::Oids).to receive(:register_puppet_oids)
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
+    end
+
+    it 'submits the CSR and saves it locally' do
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
+
+      expect(Puppet::FileSystem).to be_exist(csr_path)
+    end
+
+    it 'detects when a CSR with the same public key has already been submitted' do
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_pass
+    end
+
+    it 'downloads the certificate when autosigning is enabled' do
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_pass(%r{Submitted certificate request for '#{name}' to https://.*})
+
+      expect(Puppet::FileSystem).to be_exist(Puppet[:hostcert])
+      expect(Puppet::FileSystem).to_not be_exist(csr_path)
+    end
+
+    it 'accepts dns alt names' do
+      Puppet[:dns_alt_names] = 'majortom'
+
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_pass
+
+      csr = Puppet::SSL::CertificateRequest.new(name)
+      csr.read(csr_path)
+      expect(csr.subject_alt_names).to include('DNS:majortom')
+    end
+  end
+
+  context 'when downloading a certificate' do
+    before do
+      ssl.command_line.args << 'download_cert'
+    end
+
+    it_behaves_like 'an ssl action'
+
+    it 'downloads a new cert' do
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_pass(%r{Downloaded certificate '#{name}' with fingerprint .*})
+
+      expect(File.read(Puppet[:hostcert])).to eq(@host[:cert].to_pem)
+    end
+
+    it 'overwrites an existing cert' do
+      File.write(Puppet[:hostcert], "existing certificate")
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_pass(%r{Downloaded certificate '#{name}' with fingerprint .*})
+
+      expect(File.read(Puppet[:hostcert])).to eq(@host[:cert].to_pem)
+    end
+
+    it "reports an error if the downloaded cert's public key doesn't match our private key" do
+      File.write(Puppet[:hostcert], "existing cert")
+
+      # generate a new host key, whose public key doesn't match the cert
+      private_key = OpenSSL::PKey::RSA.new(512)
+      File.write(Puppet[:hostprivkey], private_key.to_pem)
+      File.write(Puppet[:hostpubkey], private_key.public_key.to_pem)
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_fail(
+        %r{^Failed to download certificate: The certificate for 'CN=ssl-client' does not match its private key}
+      )
+    end
+
+    it "prints a message if there isn't a cert to download" do
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_fail(/The certificate for '#{name}' has not yet been signed/)
+    end
+  end
+
+  context 'when verifying' do
+    before do
+      ssl.command_line.args << 'verify'
+
+      File.write(Puppet[:hostcert], @host[:cert].to_pem)
+    end
+
+    it 'reports if the key is missing' do
+      File.delete(Puppet[:hostprivkey])
+
+      expects_command_to_fail(/The private key is missing from/)
+    end
+
+    it 'reports if the cert is missing' do
+      File.delete(Puppet[:hostcert])
+
+      expects_command_to_fail(/The client certificate is missing from/)
+    end
+
+    it 'reports if the key and cert are mismatched' do
+      # generate new keys
+      private_key = OpenSSL::PKey::RSA.new(512)
+      public_key = private_key.public_key
+      File.write(Puppet[:hostprivkey], private_key.to_pem)
+      File.write(Puppet[:hostpubkey], public_key.to_pem)
+
+      expects_command_to_fail(%r{The certificate for 'CN=ssl-client' does not match its private key})
+    end
+
+    it 'reports if the cert verification fails' do
+      # generate a new CA to force an error
+      new_ca = Puppet::TestCa.new
+      File.write(Puppet[:localcacert], new_ca.ca_cert.to_pem)
+
+      # and CRL for that CA
+      File.write(Puppet[:hostcrl], new_ca.ca_crl.to_pem)
+
+      expects_command_to_fail(%r{Invalid signature for certificate 'CN=ssl-client'})
+    end
+
+    it 'reports when verification succeeds' do
+      expects_command_to_pass(%r{Verified client certificate 'CN=ssl-client' fingerprint})
+    end
+
+    it 'reports when verification succeeds with a password protected private key' do
+      FileUtils.cp(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'encrypted-key.pem'), Puppet[:hostprivkey])
+      FileUtils.cp(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'signed.pem'), Puppet[:hostcert])
+
+      # To verify the client cert we need the root and intermediate certs and crls.
+      # We don't need to do this with `ssl-client` cert above, because it is issued
+      # directly from the generated TestCa above.
+      File.open(Puppet[:localcacert], 'w') do |f|
+        f.write(File.read(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'ca.pem')))
+        f.write(File.read(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'intermediate.pem')))
+      end
+
+      File.open(Puppet[:hostcrl], 'w') do |f|
+        f.write(File.read(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'crl.pem')))
+        f.write(File.read(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'intermediate-crl.pem')))
+      end
+
+      Puppet[:passfile] = file_containing('passfile', '74695716c8b6')
+
+      expects_command_to_pass(%r{Verified client certificate 'CN=signed' fingerprint})
+    end
+
+    it 'reports if the private key password is incorrect' do
+      FileUtils.cp(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'encrypted-key.pem'), Puppet[:hostprivkey])
+      FileUtils.cp(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'signed.pem'), Puppet[:hostcert])
+
+      Puppet[:passfile] = file_containing('passfile', 'wrongpassword')
+
+      expects_command_to_fail(/Failed to load private key for host 'ssl-client'/)
+    end
+  end
+
+  context 'when cleaning' do
+    before do
+      ssl.command_line.args << 'clean'
+    end
+
+    it 'deletes the hostcert' do
+      File.write(Puppet[:hostcert], @host[:cert].to_pem)
+
+      expects_command_to_pass(%r{Removed certificate #{Puppet[:cert]}})
+    end
+
+    it 'deletes the private key' do
+      File.write(Puppet[:hostprivkey], @host[:private_key].to_pem)
+
+      expects_command_to_pass(%r{Removed private key #{Puppet[:hostprivkey]}})
+    end
+
+    it 'deletes the public key' do
+      File.write(Puppet[:hostpubkey], @host[:private_key].public_key.to_pem)
+
+      expects_command_to_pass(%r{Removed public key #{Puppet[:hostpubkey]}})
+    end
+
+    it 'deletes the request' do
+      path = Puppet[:hostcsr]
+      File.write(path, @host[:csr].to_pem)
+
+      expects_command_to_pass(%r{Removed certificate request #{path}})
+    end
+
+    it 'deletes the passfile' do
+      FileUtils.touch(Puppet[:passfile])
+
+      expects_command_to_pass(%r{Removed private key password file #{Puppet[:passfile]}})
+    end
+
+    it 'skips files that do not exist' do
+      File.delete(Puppet[:hostprivkey])
+
+      expect {
+        ssl.run_command
+      }.to_not output(%r{Removed private key #{Puppet[:hostprivkey]}}).to_stdout
+    end
+
+    it "raises if we fail to retrieve server's cert that we're about to clean" do
+      Puppet[:certname] = name
+      Puppet[:server] = name
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_raise(Errno::ECONNREFUSED)
+
+      expects_command_to_fail(%r{Failed to connect to the CA to determine if certificate #{name} has been cleaned})
+    end
+
+    context 'when deleting local CA' do
+      before do
+        ssl.command_line.args << '--localca'
+        ssl.parse_options
+      end
+
+      it 'deletes the local CA cert' do
+        File.write(Puppet[:localcacert], @ca_cert.to_pem)
+
+        expects_command_to_pass(%r{Removed local CA certificate #{Puppet[:localcacert]}})
+      end
+
+      it 'deletes the local CRL' do
+        File.write(Puppet[:hostcrl], @crl.to_pem)
+
+        expects_command_to_pass(%r{Removed local CRL #{Puppet[:hostcrl]}})
+      end
+    end
+
+    context 'on the puppetserver host' do
+      before :each do
+        Puppet[:certname] = 'puppetserver'
+        Puppet[:server] = 'puppetserver'
+      end
+
+      it "prints an error when the CA is local and the CA has not cleaned its cert" do
+        stub_request(:get, %r{puppet-ca/v1/certificate/puppetserver}).to_return(status: 200, body: @host[:cert].to_pem)
+
+        expects_command_to_fail(%r{The certificate puppetserver must be cleaned from the CA first})
+      end
+
+      it "cleans the cert when the CA is local and the CA has already cleaned its cert" do
+        File.write(Puppet[:hostcert], @host[:cert].to_pem)
+
+        stub_request(:get, %r{puppet-ca/v1/certificate/puppetserver}).to_return(status: 404)
+
+        expects_command_to_pass(%r{Removed certificate .*puppetserver.pem})
+      end
+
+      it "cleans the cert when run on a puppetserver that isn't the CA" do
+        File.write(Puppet[:hostcert], @host[:cert].to_pem)
+
+        Puppet[:ca_server] = 'caserver'
+
+        expects_command_to_pass(%r{Removed certificate .*puppetserver.pem})
+      end
+    end
+
+    context 'when cleaning a device' do
+      before do
+        ssl.command_line.args = ['clean', '--target', 'device.example.com']
+        ssl.parse_options
+      end
+
+      it 'deletes the device certificate' do
+        device_cert_path = File.join(Puppet[:devicedir], 'device.example.com', 'ssl', 'certs')
+        device_cert_file = File.join(device_cert_path, 'device.example.com.pem')
+        FileUtils.mkdir_p(device_cert_path)
+        File.write(device_cert_file, 'device.example.com')
+        expects_command_to_pass(%r{Removed certificate #{device_cert_file}})
+     end
+    end
+  end
+
+  context 'when bootstrapping' do
+    before do
+      ssl.command_line.args << 'bootstrap'
+    end
+
+    it 'registers the OIDs' do
+      expect_any_instance_of(Puppet::SSL::StateMachine).to receive(:ensure_client_certificate).and_return(
+        double('ssl_context')
+      )
+      expect(Puppet::SSL::Oids).to receive(:register_puppet_oids)
+      expects_command_to_pass
+    end
+
+    it 'returns an SSLContext with the loaded CA certs, CRLs, private key and client cert' do
+      expect_any_instance_of(Puppet::SSL::StateMachine).to receive(:ensure_client_certificate).and_return(
+        double('ssl_context')
+      )
+
+      expects_command_to_pass
+    end
+  end
+
+  context 'when showing' do
+    before do
+      ssl.command_line.args << 'show'
+      File.write(Puppet[:hostcert], @host[:cert].to_pem)
+    end
+
+    it 'reports if the key is missing' do
+      File.delete(Puppet[:hostprivkey])
+
+      expects_command_to_fail(/The private key is missing from/)
+    end
+
+    it 'reports if the cert is missing' do
+      File.delete(Puppet[:hostcert])
+
+      expects_command_to_fail(/The client certificate is missing from/)
+    end
+
+    it 'prints certificate information' do
+      expects_command_to_pass(@host[:cert].to_text)
+    end
+  end
+end