puppet 7.34.0 → 8.0.1

data/spec/integration/network/http/api/indirected_routes_spec.rb

@@ -0,0 +1,60 @@
+require 'spec_helper'
+require 'puppet/network/http'
+require 'puppet/network/http/api/indirected_routes'
+require 'puppet/indirector_proxy'
+require 'puppet_spec/files'
+require 'puppet_spec/network'
+require 'puppet/util/json'
+require 'puppet/file_serving/content'
+require 'puppet/file_serving/metadata'
+
+describe Puppet::Network::HTTP::API::IndirectedRoutes do
+  include PuppetSpec::Files
+  include PuppetSpec::Network
+  include_context 'with supported checksum types'
+
+  describe "when running the master application" do
+    before :each do
+      Puppet::FileServing::Content.indirection.terminus_class = :file_server
+      Puppet::FileServing::Metadata.indirection.terminus_class = :file_server
+
+      Puppet::FileBucket::File.indirection.terminus_class = :file
+    end
+
+    describe "using Puppet API to request file metadata" do
+      let(:handler) { Puppet::Network::HTTP::API::IndirectedRoutes.new }
+      let(:response) { Puppet::Network::HTTP::MemoryResponse.new }
+
+      with_checksum_types 'file_content', 'lib/files/file.rb' do
+        before :each do
+          Puppet.settings[:modulepath] = env_path
+        end
+
+        it "should find the file metadata with expected checksum" do
+          request = a_request_that_finds(Puppet::IndirectorProxy.new("modules/lib/file.rb", "file_metadata"),
+                                         {:accept_header => 'unknown, application/json'},
+                                         {:environment => 'production', :checksum_type => checksum_type})
+          handler.call(request, response)
+          resp = Puppet::Util::Json.load(response.body)
+
+          expect(resp['checksum']['type']).to eq(checksum_type)
+          expect(checksum_valid(checksum_type, checksum, resp['checksum']['value'])).to be_truthy
+        end
+
+        it "should search for the file metadata with expected checksum" do
+          request = a_request_that_searches(Puppet::IndirectorProxy.new("modules/lib", "file_metadata"),
+                                            {:accept_header => 'unknown, application/json'},
+                                            {:environment => 'production', :checksum_type => checksum_type, :recurse => 'yes'})
+          handler.call(request, response)
+          resp = Puppet::Util::Json.load(response.body)
+
+          expect(resp.length).to eq(2)
+          file = resp.find {|x| x['relative_path'] == 'file.rb'}
+
+          expect(file['checksum']['type']).to eq(checksum_type)
+          expect(checksum_valid(checksum_type, checksum, file['checksum']['value'])).to be_truthy
+        end
+      end
+    end
+  end
+end

data/spec/integration/network/http_pool_spec.rb

@@ -0,0 +1,275 @@
+require 'spec_helper'
+require 'puppet_spec/https'
+require 'puppet_spec/files'
+require 'puppet/network/http_pool'
+
+describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
+
+  before :all do
+    WebMock.disable!
+  end
+
+  after :all do
+    WebMock.enable!
+  end
+
+  before :each do
+    # make sure we don't take too long
+    Puppet[:http_connect_timeout] = '5s'
+  end
+
+  let(:hostname) { '127.0.0.1' }
+  let(:wrong_hostname) { 'localhost' }
+  let(:server) { PuppetSpec::HTTPSServer.new }
+
+  context "when calling deprecated HttpPool methods" do
+    before(:each) do
+      ssldir = tmpdir('http_pool')
+      Puppet[:ssldir] = ssldir
+      Puppet.settings.use(:main, :ssl)
+
+      File.write(Puppet[:localcacert], server.ca_cert.to_pem)
+      File.write(Puppet[:hostcrl], server.ca_crl.to_pem)
+      File.write(Puppet[:hostcert], server.server_cert.to_pem)
+      File.write(Puppet[:hostprivkey], server.server_key.to_pem)
+    end
+
+    def connection(host, port)
+      Puppet::Network::HttpPool.http_instance(host, port, use_ssl: true)
+    end
+
+    shared_examples_for 'HTTPS client' do
+      it "connects over SSL" do
+        server.start_server do |port|
+          http = connection(hostname, port)
+          res = http.get('/')
+          expect(res.code).to eq('200')
+        end
+      end
+
+      it "raises if the server's cert doesn't match the hostname we connected to" do
+        server.start_server do |port|
+          http = connection(wrong_hostname, port)
+          expect {
+            http.get('/')
+          }.to raise_error { |err|
+            expect(err).to be_instance_of(Puppet::SSL::CertMismatchError)
+            expect(err.message).to match(/\AServer hostname '#{wrong_hostname}' did not match server certificate; expected one of (.+)/)
+
+            md = err.message.match(/expected one of (.+)/)
+            expect(md[1].split(', ')).to contain_exactly('127.0.0.1', 'DNS:127.0.0.1', 'DNS:127.0.0.2')
+          }
+        end
+      end
+
+      it "raises if the server's CA is unknown" do
+        # File must exist and by not empty so DefaultValidator doesn't
+        # downgrade to VERIFY_NONE, so use a different CA that didn't
+        # issue the server's cert
+        capath = tmpfile('empty')
+        File.write(capath, cert_fixture('netlock-arany-utf8.pem'))
+        Puppet[:localcacert] = capath
+        Puppet[:certificate_revocation] = false
+
+        server.start_server do |port|
+          http = connection(hostname, port)
+          expect {
+            http.get('/')
+          }.to raise_error(Puppet::Error,
+                           %r{certificate verify failed.* .self.signed certificate in certificate chain for CN=Test CA.})
+        end
+      end
+
+      it "detects when the server has closed the connection and reconnects" do
+        server.start_server do |port|
+          http = connection(hostname, port)
+
+          expect(http.request_get('/')).to be_a(Net::HTTPSuccess)
+          expect(http.request_get('/')).to be_a(Net::HTTPSuccess)
+        end
+      end
+    end
+
+    context "when using persistent HTTPS connections" do
+      around :each do |example|
+        begin
+          example.run
+        ensure
+          Puppet.runtime[:http].close
+        end
+      end
+
+      include_examples 'HTTPS client'
+    end
+
+    shared_examples_for "an HttpPool connection" do |klass, legacy_api|
+      before :each do
+        Puppet::Network::HttpPool.http_client_class = klass
+      end
+
+      it "connects using the scheme, host and port from the http instance preserving the URL path and query" do
+        request_line = nil
+
+        response_proc = -> (req, res) {
+          request_line = req.request_line
+        }
+
+        server.start_server(response_proc: response_proc) do |port|
+          http = Puppet::Network::HttpPool.http_instance(hostname, port, true)
+          path  = "http://bogus.example.com:443/foo?q=a"
+          http.get(path)
+
+          if legacy_api
+            # The old API uses 'absolute-form' and passes the bogus hostname
+            # which isn't the host we connected to.
+            expect(request_line).to eq("GET http://bogus.example.com:443/foo?q=a HTTP/1.1\r\n")
+          else
+            expect(request_line).to eq("GET /foo?q=a HTTP/1.1\r\n")
+          end
+        end
+      end
+
+      it "requires the caller to URL encode the path and query when using absolute form" do
+        request_line = nil
+
+        response_proc = -> (req, res) {
+          request_line = req.request_line
+        }
+
+        server.start_server(response_proc: response_proc) do |port|
+          http = Puppet::Network::HttpPool.http_instance(hostname, port, true)
+          params = { 'key' => 'a value' }
+          encoded_url = "https://#{hostname}:#{port}/foo%20bar?q=#{Puppet::Util.uri_query_encode(params.to_json)}"
+          http.get(encoded_url)
+
+          if legacy_api
+            expect(request_line).to eq("GET #{encoded_url} HTTP/1.1\r\n")
+          else
+            expect(request_line).to eq("GET /foo%20bar?q=%7B%22key%22%3A%22a%20value%22%7D HTTP/1.1\r\n")
+          end
+        end
+      end
+
+      it "requires the caller to URL encode the path and query when using a path" do
+        request_line = nil
+
+        response_proc = -> (req, res) {
+          request_line = req.request_line
+        }
+
+        server.start_server(response_proc: response_proc) do |port|
+          http = Puppet::Network::HttpPool.http_instance(hostname, port, true)
+          params = { 'key' => 'a value' }
+          http.get("/foo%20bar?q=#{Puppet::Util.uri_query_encode(params.to_json)}")
+
+          expect(request_line).to eq("GET /foo%20bar?q=%7B%22key%22%3A%22a%20value%22%7D HTTP/1.1\r\n")
+        end
+      end
+    end
+
+    describe Puppet::Network::HTTP::Connection do
+      it_behaves_like "an HttpPool connection", described_class, false
+    end
+  end
+
+  context "when calling HttpPool.connection method" do
+    let(:ssl) { Puppet::SSL::SSLProvider.new }
+    let(:ssl_context) { ssl.create_root_context(cacerts: [server.ca_cert], crls: [server.ca_crl]) }
+
+    def connection(host, port, ssl_context:)
+      Puppet::Network::HttpPool.connection(host, port, ssl_context: ssl_context)
+    end
+
+    # Configure the server's SSLContext to require a client certificate. The `client_ca`
+    # setting allows the server to advertise which client CAs it will accept.
+    def require_client_certs(ctx)
+      ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER|OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
+      ctx.client_ca = [cert_fixture('ca.pem')]
+    end
+
+    it "connects over SSL" do
+      server.start_server do |port|
+        http = connection(hostname, port, ssl_context: ssl_context)
+        res = http.get('/')
+        expect(res.code).to eq('200')
+      end
+    end
+
+    it "raises if the server's cert doesn't match the hostname we connected to" do
+      server.start_server do |port|
+        http = connection(wrong_hostname, port, ssl_context: ssl_context)
+        expect {
+          http.get('/')
+        }.to raise_error { |err|
+          expect(err).to be_instance_of(Puppet::SSL::CertMismatchError)
+          expect(err.message).to match(/\AServer hostname '#{wrong_hostname}' did not match server certificate; expected one of (.+)/)
+
+          md = err.message.match(/expected one of (.+)/)
+          expect(md[1].split(', ')).to contain_exactly('127.0.0.1', 'DNS:127.0.0.1', 'DNS:127.0.0.2')
+        }
+      end
+    end
+
+    it "raises if the server's CA is unknown" do
+      server.start_server do |port|
+        ssl_context = ssl.create_root_context(cacerts: [cert_fixture('netlock-arany-utf8.pem')],
+                                              crls: [server.ca_crl])
+        http = Puppet::Network::HttpPool.connection(hostname, port, ssl_context: ssl_context)
+        expect {
+          http.get('/')
+        }.to raise_error(Puppet::Error,
+                         %r{certificate verify failed.* .self.signed certificate in certificate chain for CN=Test CA.})
+      end
+    end
+
+    it "warns when client has an incomplete client cert chain" do
+      expect(Puppet).to receive(:warning).with("The issuer 'CN=Test CA Agent Subauthority' of certificate 'CN=pluto' cannot be found locally")
+
+      pluto = cert_fixture('pluto.pem')
+
+      ssl_context = ssl.create_context(
+        cacerts: [server.ca_cert], crls: [server.ca_crl],
+        client_cert: pluto, private_key: key_fixture('pluto-key.pem')
+      )
+
+      # verify client has incomplete chain
+      expect(ssl_context.client_chain.map(&:to_der)).to eq([pluto.to_der])
+
+      # force server to require (not request) client certs
+      ctx_proc = -> (ctx) {
+        require_client_certs(ctx)
+
+        # server needs to trust the client's intermediate CA to complete the client's chain
+        ctx.cert_store.add_cert(cert_fixture('intermediate-agent.pem'))
+      }
+
+      server.start_server(ctx_proc: ctx_proc) do |port|
+        http = Puppet::Network::HttpPool.connection(hostname, port, ssl_context: ssl_context)
+        res = http.get('/')
+        expect(res.code).to eq('200')
+      end
+    end
+
+    it "sends a complete client cert chain" do
+      pluto = cert_fixture('pluto.pem')
+      client_ca = cert_fixture('intermediate-agent.pem')
+
+      ssl_context = ssl.create_context(
+        cacerts: [server.ca_cert, client_ca],
+        crls: [server.ca_crl, crl_fixture('intermediate-agent-crl.pem')],
+        client_cert: pluto,
+        private_key: key_fixture('pluto-key.pem')
+      )
+
+      # verify client has complete chain from leaf to root
+      expect(ssl_context.client_chain.map(&:to_der)).to eq([pluto, client_ca, server.ca_cert].map(&:to_der))
+
+      server.start_server(ctx_proc: method(:require_client_certs)) do |port|
+        http = Puppet::Network::HttpPool.connection(hostname, port, ssl_context: ssl_context)
+        res = http.get('/')
+        expect(res.code).to eq('200')
+      end
+    end
+  end
+end

data/spec/integration/node/environment_spec.rb

@@ -0,0 +1,170 @@
+require 'spec_helper'
+
+require 'puppet_spec/files'
+require 'puppet_spec/scope'
+require 'matchers/resource'
+
+describe Puppet::Node::Environment do
+  include PuppetSpec::Files
+  include Matchers::Resource
+
+  def a_module_in(name, dir)
+    Dir.mkdir(dir)
+    moddir = File.join(dir, name)
+    Dir.mkdir(moddir)
+    moddir
+  end
+
+  it "should be able to return each module from its environment with the environment, name, and path set correctly" do
+    base = tmpfile("env_modules")
+    Dir.mkdir(base)
+
+    dirs = []
+    mods = {}
+    %w{1 2}.each do |num|
+      dir = File.join(base, "dir#{num}")
+      dirs << dir
+
+      mods["mod#{num}"] = a_module_in("mod#{num}", dir)
+    end
+
+    environment = Puppet::Node::Environment.create(:foo, dirs)
+
+    environment.modules.each do |mod|
+      expect(mod.environment).to eq(environment)
+      expect(mod.path).to eq(mods[mod.name])
+    end
+  end
+
+  it "should expand 8.3 paths on Windows when creating an environment",
+    :if => Puppet::Util::Platform.windows? do
+
+    # asking for short names only works on paths that exist
+    base = Puppet::Util::Windows::File.get_short_pathname(tmpdir("env_modules"))
+    parent_modules_dir = File.join(base, 'testmoduledir')
+
+    # make sure the paths have ~ in them, indicating unexpanded 8.3 paths
+    expect(parent_modules_dir).to match(/~/)
+
+    module_dir = a_module_in('testmodule', parent_modules_dir)
+
+    # create the environment with unexpanded 8.3 paths
+    environment = Puppet::Node::Environment.create(:foo, [parent_modules_dir])
+
+    # and expect fully expanded paths inside the environment
+    # necessary for comparing module paths internally by the parser
+    expect(environment.modulepath).to eq([Puppet::FileSystem.expand_path(parent_modules_dir)])
+    expect(environment.modules.first.path).to eq(Puppet::FileSystem.expand_path(module_dir))
+  end
+
+  it "should not yield the same module from different module paths" do
+    base = tmpfile("env_modules")
+    Dir.mkdir(base)
+
+    dirs = []
+    %w{1 2}.each do |num|
+      dir = File.join(base, "dir#{num}")
+      dirs << dir
+
+      a_module_in("mod", dir)
+    end
+
+    environment = Puppet::Node::Environment.create(:foo, dirs)
+
+    mods = environment.modules
+    expect(mods.length).to eq(1)
+    expect(mods[0].path).to eq(File.join(base, "dir1", "mod"))
+  end
+
+  it "should not yield a module with the same name as a defined Bolt project" do
+    project_path = File.join(tmpfile('project'), 'bolt_project')
+    FileUtils.mkdir_p(project_path)
+    project = Struct.new("Project", :name, :path, :load_as_module?).new('project', project_path, true)
+
+    Puppet.override(bolt_project: project) do
+      base = tmpfile("base")
+      FileUtils.mkdir_p([File.join(base, 'project'), File.join(base, 'other')])
+      environment = Puppet::Node::Environment.create(:env, [base])
+      mods = environment.modules
+      expect(mods.length).to eq(2)
+      expect(mods.map(&:path)).to eq([project_path, File.join(base, 'other')])
+    end
+  end
+
+  shared_examples_for "the environment's initial import" do |settings|
+    it "a manifest referring to a directory invokes parsing of all its files in sorted order" do
+      settings.each do |name, value|
+        Puppet[name] = value
+      end
+
+      # fixture has three files 00_a.pp, 01_b.pp, and 02_c.pp. The 'b' file
+      # depends on 'a' being evaluated first. The 'c' file is empty (to ensure
+      # empty things do not break the directory import).
+      #
+      dirname = my_fixture('sitedir')
+
+      # Set the manifest to the directory to make it parse and combine them when compiling
+      node = Puppet::Node.new('testnode',
+                              :environment => Puppet::Node::Environment.create(:testing, [], dirname))
+
+      catalog = Puppet::Parser::Compiler.compile(node)
+
+      expect(catalog).to have_resource('Class[A]')
+      expect(catalog).to have_resource('Class[B]')
+      expect(catalog).to have_resource('Notify[variables]').with_parameter(:message, "a: 10, b: 10")
+    end
+  end
+
+  shared_examples_for "the environment's initial import in 4x" do |settings|
+    it "a manifest referring to a directory invokes recursive parsing of all its files in sorted order" do
+      settings.each do |name, value|
+        Puppet[name] = value
+      end
+
+      # fixture has three files 00_a.pp, 01_b.pp, and 02_c.pp. The 'b' file
+      # depends on 'a' being evaluated first. The 'c' file is empty (to ensure
+      # empty things do not break the directory import).
+      #
+      dirname = my_fixture('sitedir2')
+
+      # Set the manifest to the directory to make it parse and combine them when compiling
+      node = Puppet::Node.new('testnode',
+                              :environment => Puppet::Node::Environment.create(:testing, [], dirname))
+
+      catalog = Puppet::Parser::Compiler.compile(node)
+
+      expect(catalog).to have_resource('Class[A]')
+      expect(catalog).to have_resource('Class[B]')
+      expect(catalog).to have_resource('Notify[variables]').with_parameter(:message, "a: 10, b: 10 c: 20")
+    end
+  end
+
+  describe 'using 4x parser' do
+    it_behaves_like "the environment's initial import",
+      # fixture uses variables that are set in a particular order (this ensures
+      # that files are parsed and combined in the right order or an error will
+      # be raised if 'b' is evaluated before 'a').
+      :strict_variables => true
+  end
+
+  describe 'using 4x parser' do
+    it_behaves_like "the environment's initial import in 4x",
+      # fixture uses variables that are set in a particular order (this ensures
+      # that files are parsed and combined in the right order or an error will
+      # be raised if 'b' is evaluated before 'a').
+      :strict_variables => true
+  end
+
+  describe "#extralibs on Windows", :if => Puppet::Util::Platform.windows? do
+
+    describe "with UTF8 characters in PUPPETLIB" do
+      let(:rune_utf8) { "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7" }
+
+      before { Puppet::Util::Windows::Process.set_environment_variable('PUPPETLIB', rune_utf8) }
+
+      it "should use UTF8 characters in PUPPETLIB environment variable" do
+        expect(Puppet::Node::Environment.extralibs()).to eq([rune_utf8])
+      end
+    end
+  end
+end

data/spec/integration/node/facts_spec.rb

@@ -0,0 +1,40 @@
+require 'spec_helper'
+
+describe Puppet::Node::Facts do
+  describe "when using the indirector" do
+    it "should expire any cached node instances when it is saved" do
+      allow(Puppet::Node::Facts.indirection).to receive(:terminus_class).and_return(:yaml)
+
+      expect(Puppet::Node::Facts.indirection.terminus(:yaml)).to equal(Puppet::Node::Facts.indirection.terminus(:yaml))
+      terminus = Puppet::Node::Facts.indirection.terminus(:yaml)
+      allow(terminus).to receive(:save)
+
+      expect(Puppet::Node.indirection).to receive(:expire).with("me", be_a(Hash).or(be_nil))
+
+      facts = Puppet::Node::Facts.new("me")
+      Puppet::Node::Facts.indirection.save(facts)
+    end
+
+    it "should be able to delegate to the :yaml terminus" do
+      allow(Puppet::Node::Facts.indirection).to receive(:terminus_class).and_return(:yaml)
+
+      # Load now, before we stub the exists? method.
+      terminus = Puppet::Node::Facts.indirection.terminus(:yaml)
+
+      expect(terminus).to receive(:path).with("me").and_return("/my/yaml/file")
+      expect(Puppet::FileSystem).to receive(:exist?).with("/my/yaml/file").and_return(false)
+
+      expect(Puppet::Node::Facts.indirection.find("me")).to be_nil
+    end
+
+    it "should be able to delegate to the :facter terminus" do
+      allow(Puppet::Node::Facts.indirection).to receive(:terminus_class).and_return(:facter)
+
+      expect(Facter).to receive(:resolve).and_return({1 => 2})
+      facts = Puppet::Node::Facts.new("me")
+      expect(Puppet::Node::Facts).to receive(:new).with("me", {1 => 2}).and_return(facts)
+
+      expect(Puppet::Node::Facts.indirection.find("me")).to equal(facts)
+    end
+  end
+end

data/spec/integration/node_spec.rb

@@ -0,0 +1,77 @@
+require 'spec_helper'
+
+require 'puppet/node'
+
+describe Puppet::Node do
+  describe "when delegating indirection calls" do
+    before do
+      Puppet::Node.indirection.reset_terminus_class
+      Puppet::Node.indirection.cache_class = nil
+
+      @name = "me"
+      @node = Puppet::Node.new(@name)
+    end
+
+    it "should be able to use the yaml terminus" do
+      allow(Puppet::Node.indirection).to receive(:terminus_class).and_return(:yaml)
+
+      # Load now, before we stub the exists? method.
+      terminus = Puppet::Node.indirection.terminus(:yaml)
+
+      expect(terminus).to receive(:path).with(@name).and_return("/my/yaml/file")
+
+      expect(Puppet::FileSystem).to receive(:exist?).with("/my/yaml/file").and_return(false)
+      expect(Puppet::Node.indirection.find(@name)).to be_nil
+    end
+
+    it "should be able to use the plain terminus" do
+      allow(Puppet::Node.indirection).to receive(:terminus_class).and_return(:plain)
+
+      # Load now, before we stub the exists? method.
+      Puppet::Node.indirection.terminus(:plain)
+
+      expect(Puppet::Node).to receive(:new).with(@name).and_return(@node)
+
+      expect(Puppet::Node.indirection.find(@name)).to equal(@node)
+    end
+
+    describe "and using the memory terminus" do
+      before do
+        @name = "me"
+        @terminus = Puppet::Node.indirection.terminus(:memory)
+        allow(Puppet::Node.indirection).to receive(:terminus).and_return(@terminus)
+        @node = Puppet::Node.new(@name)
+      end
+
+      after do
+        @terminus.instance_variable_set(:@instances, {})
+      end
+
+      it "should find no nodes by default" do
+        expect(Puppet::Node.indirection.find(@name)).to be_nil
+      end
+
+      it "should be able to find nodes that were previously saved" do
+        Puppet::Node.indirection.save(@node)
+        expect(Puppet::Node.indirection.find(@name)).to equal(@node)
+      end
+
+      it "should replace existing saved nodes when a new node with the same name is saved" do
+        Puppet::Node.indirection.save(@node)
+        two = Puppet::Node.new(@name)
+        Puppet::Node.indirection.save(two)
+        expect(Puppet::Node.indirection.find(@name)).to equal(two)
+      end
+
+      it "should be able to remove previously saved nodes" do
+        Puppet::Node.indirection.save(@node)
+        Puppet::Node.indirection.destroy(@node.name)
+        expect(Puppet::Node.indirection.find(@name)).to be_nil
+      end
+
+      it "should fail when asked to destroy a node that does not exist" do
+        expect { Puppet::Node.indirection.destroy(@node) }.to raise_error(ArgumentError)
+      end
+    end
+  end
+end

data/spec/integration/parser/catalog_spec.rb

@@ -0,0 +1,68 @@
+require 'spec_helper'
+require 'matchers/include_in_order'
+require 'puppet_spec/compiler'
+require 'puppet/indirector/catalog/compiler'
+
+describe "A catalog" do
+  include PuppetSpec::Compiler
+
+  context "when compiled" do
+    let(:env) { Puppet::Node::Environment.create(:testing, []) }
+    let(:node) { Puppet::Node.new('test', :environment => env) }
+    let(:loaders) { Puppet::Pops::Loaders.new(env) }
+
+    before(:each) do
+      Puppet.push_context({:loaders => loaders, :current_environment => env})
+      allow_any_instance_of(Puppet::Parser::Compiler).to receive(:loaders).and_return(loaders)
+    end
+
+    after(:each) do
+      Puppet.pop_context()
+    end
+
+    context "when transmitted to the agent" do
+      it "preserves the order in which the resources are added to the catalog" do
+        resources_in_declaration_order = ["Class[First]",
+                                          "Second[position]",
+                                          "Class[Third]",
+                                          "Fourth[position]"]
+
+        master_catalog, agent_catalog = master_and_agent_catalogs_for(<<-EOM)
+          define fourth() { }
+          class third { }
+
+          define second() {
+            fourth { "position": }
+          }
+
+          class first {
+            second { "position": }
+            class { "third": }
+          }
+
+          include first
+        EOM
+
+        expect(resources_in(master_catalog)).
+          to include_in_order(*resources_in_declaration_order)
+        expect(resources_in(agent_catalog)).
+          to include_in_order(*resources_in_declaration_order)
+      end
+    end
+  end
+
+  def master_catalog_for(manifest)
+    Puppet::Resource::Catalog::Compiler.new.filter(compile_to_catalog(manifest, node))
+  end
+
+  def master_and_agent_catalogs_for(manifest)
+    compiler = Puppet::Resource::Catalog::Compiler.new
+    master_catalog = compiler.filter(compile_to_catalog(manifest, node))
+    agent_catalog = Puppet::Resource::Catalog.convert_from(:json, master_catalog.render(:json))
+    [master_catalog, agent_catalog]
+  end
+
+  def resources_in(catalog)
+    catalog.resources.map(&:ref)
+  end
+end