puppet 7.6.1-universal-darwin → 7.10.0-universal-darwin

data/spec/fixtures/ssl/unknown-ca.pem

@@ -6,21 +6,30 @@ Certificate:
         Issuer: CN=Unknown CA
         Validity
             Not Before: Jan  1 00:00:00 1970 GMT
-            Not After : Mar 10 06:54:16 2030 GMT
+            Not After : Jun 15 01:19:37 2031 GMT
         Subject: CN=Unknown CA
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
-                RSA Public-Key: (1024 bit)
+                RSA Public-Key: (2048 bit)
                 Modulus:
-                    00:c1:5e:5d:26:ae:73:17:5a:70:37:ac:42:25:ca:
-                    05:10:86:17:23:6c:28:84:48:2a:4a:d4:b0:3a:2a:
-                    d8:33:ae:58:67:6f:9b:4f:a6:b4:87:b1:ec:37:00:
-                    69:8d:d5:cf:71:8a:96:e1:4a:f8:c8:81:36:f9:43:
-                    ad:d8:d6:76:83:27:99:a4:48:17:c2:ef:9c:22:40:
-                    4b:c6:58:21:88:e5:1d:37:79:4e:ba:31:e6:52:ec:
-                    8c:23:ed:d6:ce:3b:58:ad:82:c7:ae:28:47:d4:e7:
-                    cc:31:ac:78:c9:02:87:d0:b1:91:09:f6:1e:9a:c3:
-                    4f:f6:5a:fe:a2:21:0e:c0:95
+                    00:b4:79:b0:16:e7:9b:22:20:17:4b:36:87:eb:38:
+                    03:1f:df:88:00:1b:37:40:5e:1f:1d:89:1f:3e:f4:
+                    fa:69:90:9c:d8:68:df:c8:71:07:07:4e:01:1d:f0:
+                    a8:9a:67:94:af:47:f2:b8:60:f5:ca:fb:bb:ac:7c:
+                    23:58:59:bc:95:b0:ad:b2:c7:a0:28:e1:4f:1e:c4:
+                    ef:5f:2b:a3:4e:f2:6a:95:c8:4f:f5:af:bc:fa:36:
+                    10:f9:a9:62:7a:04:d5:01:cd:9b:ba:97:32:4c:99:
+                    e5:88:fc:05:84:34:f5:4a:f2:f1:ec:04:c7:c7:63:
+                    28:eb:9e:ee:91:cd:95:8b:60:9e:5f:51:a1:2b:5a:
+                    cd:02:b2:a7:52:6c:d1:8a:ab:b1:c4:52:cd:10:ce:
+                    9e:56:24:6c:63:84:2c:15:6c:c0:62:ea:c2:d9:04:
+                    88:e2:e2:0f:ff:ce:87:51:eb:77:50:83:33:1c:c7:
+                    88:5b:08:d4:3a:22:2f:13:a6:89:f7:4b:a0:2e:30:
+                    c1:12:7a:bb:37:1f:aa:87:56:44:2f:5a:63:4b:b2:
+                    36:f6:29:5e:b8:67:52:6f:63:2a:ad:3d:c3:a5:45:
+                    af:97:e9:85:9e:76:1e:51:9c:68:36:58:32:ad:cf:
+                    3e:4d:f0:92:e2:ad:d6:f0:e1:5d:af:08:ca:2a:82:
+                    0e:a3
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -28,32 +37,45 @@ Certificate:
             X509v3 Key Usage: critical
                 Certificate Sign, CRL Sign
             X509v3 Subject Key Identifier: 
-                E9:58:70:FE:F1:C1:AA:5A:70:7A:C1:02:11:1D:9A:F4:60:4F:70:76
+                D0:CD:40:49:88:F6:74:BB:B4:D7:05:37:74:33:B1:C2:27:73:81:CB
             Netscape Comment: 
                 Puppet Server Internal Certificate
             X509v3 Authority Key Identifier: 
-                keyid:E9:58:70:FE:F1:C1:AA:5A:70:7A:C1:02:11:1D:9A:F4:60:4F:70:76
+                keyid:D0:CD:40:49:88:F6:74:BB:B4:D7:05:37:74:33:B1:C2:27:73:81:CB
 
     Signature Algorithm: sha256WithRSAEncryption
-         00:45:89:e8:68:a7:50:8c:92:84:3c:c4:e6:10:00:29:27:99:
-         c6:82:aa:aa:b5:0b:ef:97:58:bc:bb:e6:e7:93:7c:a7:ea:e5:
-         9a:61:1d:e3:4f:3f:f9:ac:c4:96:14:a5:1f:77:a6:01:dc:08:
-         15:9c:3f:66:29:92:80:49:e9:db:d9:22:fb:c3:86:bf:40:ab:
-         46:bf:c5:47:bb:c8:89:df:d4:ca:36:f5:08:c4:08:c6:0b:d6:
-         9e:8a:86:41:1e:7e:6f:a9:75:ef:8a:94:a9:fd:1a:9b:0f:55:
-         3a:55:e5:04:82:71:c3:47:78:62:8e:07:ed:dc:4e:ac:f9:33:
-         7b:27
+         51:79:86:29:27:07:e5:fc:59:83:2d:15:ae:5f:c4:bc:0a:71:
+         2c:71:74:20:14:ce:47:8f:cf:79:03:76:bd:df:c9:e9:7f:12:
+         b2:4e:5a:c5:4f:e1:0b:c3:17:44:92:37:af:10:08:75:9a:d9:
+         c5:0d:66:e9:24:2b:ec:00:aa:de:2f:ce:df:04:fa:49:d9:bd:
+         bd:5e:7b:e4:e7:1e:9e:20:d3:85:70:b4:95:b5:1d:2e:fa:0c:
+         b4:47:5a:38:ec:b0:bd:7e:34:5f:4d:9d:1f:81:81:8a:6c:a6:
+         94:fb:f8:41:d6:a3:e4:64:3a:b7:12:4f:9e:4e:60:4a:12:a9:
+         d1:87:a5:a8:31:91:16:96:50:73:87:64:46:f1:f2:f9:99:80:
+         a2:89:e9:99:57:48:8a:56:08:d7:8d:a9:1d:69:7c:8f:73:e5:
+         53:2d:28:ee:70:d7:f8:fe:41:25:3e:4c:6c:de:31:3f:9e:7d:
+         c4:f0:67:e9:fc:a3:02:c7:39:19:f5:6f:59:6a:ca:bb:8c:c8:
+         e6:01:43:ad:95:67:3f:c0:d6:35:18:b1:6e:9f:e1:ce:c7:be:
+         35:f0:7b:65:e7:79:82:c3:b6:f7:48:28:98:d0:5c:3c:97:f3:
+         69:b3:5e:c3:a0:c5:82:02:6f:20:d0:1b:cd:43:b0:85:7e:4f:
+         71:b9:f3:8f
 -----BEGIN CERTIFICATE-----
-MIICODCCAaGgAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDDApVbmtu
-b3duIENBMB4XDTcwMDEwMTAwMDAwMFoXDTMwMDMxMDA2NTQxNlowFTETMBEGA1UE
-AwwKVW5rbm93biBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwV5dJq5z
-F1pwN6xCJcoFEIYXI2wohEgqStSwOirYM65YZ2+bT6a0h7HsNwBpjdXPcYqW4Ur4
-yIE2+UOt2NZ2gyeZpEgXwu+cIkBLxlghiOUdN3lOujHmUuyMI+3WzjtYrYLHrihH
-1OfMMax4yQKH0LGRCfYemsNP9lr+oiEOwJUCAwEAAaOBlzCBlDAPBgNVHRMBAf8E
-BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU6Vhw/vHBqlpwesECER2a
-9GBPcHYwMQYJYIZIAYb4QgENBCQWIlB1cHBldCBTZXJ2ZXIgSW50ZXJuYWwgQ2Vy
-dGlmaWNhdGUwHwYDVR0jBBgwFoAU6Vhw/vHBqlpwesECER2a9GBPcHYwDQYJKoZI
-hvcNAQELBQADgYEAAEWJ6GinUIyShDzE5hAAKSeZxoKqqrUL75dYvLvm55N8p+rl
-mmEd408/+azElhSlH3emAdwIFZw/ZimSgEnp29ki+8OGv0CrRr/FR7vIid/Uyjb1
-CMQIxgvWnoqGQR5+b6l174qUqf0amw9VOlXlBIJxw0d4Yo4H7dxOrPkzeyc=
+MIIDPTCCAiWgAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDDApVbmtu
+b3duIENBMB4XDTcwMDEwMTAwMDAwMFoXDTMxMDYxNTAxMTkzN1owFTETMBEGA1UE
+AwwKVW5rbm93biBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALR5
+sBbnmyIgF0s2h+s4Ax/fiAAbN0BeHx2JHz70+mmQnNho38hxBwdOAR3wqJpnlK9H
+8rhg9cr7u6x8I1hZvJWwrbLHoCjhTx7E718ro07yapXIT/WvvPo2EPmpYnoE1QHN
+m7qXMkyZ5Yj8BYQ09Ury8ewEx8djKOue7pHNlYtgnl9RoStazQKyp1Js0YqrscRS
+zRDOnlYkbGOELBVswGLqwtkEiOLiD//Oh1Hrd1CDMxzHiFsI1DoiLxOmifdLoC4w
+wRJ6uzcfqodWRC9aY0uyNvYpXrhnUm9jKq09w6VFr5fphZ52HlGcaDZYMq3PPk3w
+kuKt1vDhXa8IyiqCDqMCAwEAAaOBlzCBlDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud
+DwEB/wQEAwIBBjAdBgNVHQ4EFgQU0M1ASYj2dLu01wU3dDOxwidzgcswMQYJYIZI
+AYb4QgENBCQWIlB1cHBldCBTZXJ2ZXIgSW50ZXJuYWwgQ2VydGlmaWNhdGUwHwYD
+VR0jBBgwFoAU0M1ASYj2dLu01wU3dDOxwidzgcswDQYJKoZIhvcNAQELBQADggEB
+AFF5hiknB+X8WYMtFa5fxLwKcSxxdCAUzkePz3kDdr3fyel/ErJOWsVP4QvDF0SS
+N68QCHWa2cUNZukkK+wAqt4vzt8E+knZvb1ee+TnHp4g04VwtJW1HS76DLRHWjjs
+sL1+NF9NnR+BgYpsppT7+EHWo+RkOrcST55OYEoSqdGHpagxkRaWUHOHZEbx8vmZ
+gKKJ6ZlXSIpWCNeNqR1pfI9z5VMtKO5w1/j+QSU+TGzeMT+efcTwZ+n8owLHORn1
+b1lqyruMyOYBQ62VZz/A1jUYsW6f4c7HvjXwe2XneYLDtvdIKJjQXDyX82mzXsOg
+xYICbyDQG81DsIV+T3G5848=
 -----END CERTIFICATE-----

data/spec/integration/application/agent_spec.rb

@@ -469,83 +469,64 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
   end
 
   context 'multiple agents running' do
-    it "exits if an agent is already running" do
+    def with_another_agent_running(&block)
       path = Puppet[:agent_catalog_run_lockfile]
 
       th = Thread.new {
-        %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(20)"}
+        %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(5)"}
       }
 
+      # ensure file is written before yielding
       until File.exists?(path) && File.size(path) > 0 do
         sleep 0.1
       end
 
-      expect {
-        agent.command_line.args << '--test'
-        agent.run
-      }.to exit_with(1).and output(/Run of Puppet configuration client already in progress; skipping/).to_stdout
+      begin
+        yield
+      ensure
+        th.kill # kill thread so we don't wait too much
+      end
+    end
 
-      th.kill # kill thread so we don't wait too much
+    it "exits if an agent is already running" do
+      with_another_agent_running do
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(1).and output(/Run of Puppet configuration client already in progress; skipping/).to_stdout
+      end
     end
 
     it "waits for other agent run to finish before starting" do
       server.start_server do |port|
-        script = tmpfile('wait_for_log_entry')
-        logdest = tmpfile('agent_log')
-        path = Puppet[:agent_catalog_run_lockfile]
         Puppet[:serverport] = port
         Puppet[:waitforlock] = 1
 
-        th = Thread.new {
-          File.write(script, <<~SCRIPT)
-            $0 = 'puppet'
-            # lock pidfile
-            File.write('#{path}', Process.pid)
-            # wait for foreground agent to fail once
-            until File.exists?("#{logdest}") && File.readlines("#{logdest}").grep(/Will try again/).any? do
-              sleep 0.1
-            end
-          SCRIPT
-          %x{ruby '#{script}'}
-        }
+        with_another_agent_running do
+          expect {
+            agent.command_line.args << '--test'
+            agent.run
+          }.to exit_with(0)
+           .and output(a_string_matching(
+             /Info: Will try again in #{Puppet[:waitforlock]} seconds/
+           ).and matching(
+             /Applied catalog/
+           )).to_stdout
 
-        until File.exists?(path) && File.size(path) > 0 do
-          sleep 0.1
         end
-
-        expect {
-          agent.command_line.args << '--test' << '--logdest' << logdest << '--logdest' << 'console'
-          agent.run
-        }.to exit_with(0)
-         .and output(a_string_matching(
-          /Info: Will try again in #{Puppet[:waitforlock]} seconds/
-        ).and matching(
-          /Applied catalog/
-        )).to_stdout
-
-        th.kill # kill thread so we don't wait too much
       end
     end
 
     it "exits if maxwaitforlock is exceeded" do
-      path = Puppet[:agent_catalog_run_lockfile]
       Puppet[:waitforlock] = 1
       Puppet[:maxwaitforlock] = 0
 
-      th = Thread.new {
-        %x{ruby -e "$0 = 'puppet'; File.write('#{path}', Process.pid); sleep(20)"}
-      }
-
-      until File.exists?(path) && File.size(path) > 0 do
-        sleep 0.1
+      with_another_agent_running do
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(1).and output(/Exiting now because the maxwaitforlock timeout has been exceeded./).to_stdout
       end
-
-      expect {
-        agent.command_line.args << '--test'
-        agent.run
-      }.to exit_with(1).and output(/Exiting now because the maxwaitforlock timeout has been exceeded./).to_stdout
-
-      th.kill # kill thread so we don't wait too much
     end
   end
 
@@ -585,7 +566,7 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
        ).and matching(
          /Notify\[a message\]\/message:/
        )).to_stdout
-       .and output(/the agent run will continue/).to_stderr
+       .and output(/No more routes to fileserver/).to_stderr
     end
 
     it 'preserves the old cached catalog if validation fails with the old one' do
@@ -604,7 +585,7 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
           agent.command_line.args << '--test'
           agent.run
         }.to exit_with(1)
-         .and output(/Using configured environment/).to_stdout
+         .and output(%r{Retrieving plugin}).to_stdout
          .and output(%r{Validation of Exec\[unqualified_command\] failed: 'unqualified_command' is not qualified and no path was specified}).to_stderr
       end
 
@@ -646,4 +627,73 @@ describe "puppet agent", unless: Puppet::Util::Platform.jruby? do
       end
     end
   end
+
+  context "environment convergence" do
+    it "switches to 'newenv' environment and retries the run" do
+      first_run = true
+      libdir = File.join(my_fixture_dir, 'lib')
+
+      # we have to use the :facter terminus to reliably test that pluginsynced
+      # facts are included in the catalog request
+      Puppet::Node::Facts.indirection.terminus_class = :facter
+
+      mounts = {}
+
+      # During the first run, only return metadata for the top-level directory.
+      # During the second run, include metadata for all of the 'lib' fixtures
+      # due to the `recurse` option.
+      mounts[:file_metadatas] = -> (req, res) {
+        request = Puppet::FileServing::Metadata.indirection.request(
+          :search, libdir, nil, recurse: !first_run
+        )
+        data = Puppet::FileServing::Metadata.indirection.terminus(:file).search(request)
+        res.body = formatter.render(data)
+        res['Content-Type'] = formatter.mime
+      }
+
+      mounts[:file_content] = -> (req, res) {
+        request = Puppet::FileServing::Content.indirection.request(
+          :find, File.join(libdir, 'facter', 'agent_spec_role.rb'), nil
+        )
+        content = Puppet::FileServing::Content.indirection.terminus(:file).find(request)
+        res.body = content.content
+        res['Content-Length'] = content.content.length
+        res['Content-Type'] = 'application/octet-stream'
+      }
+
+      # During the first run, return an empty catalog referring to the newenv.
+      # During the second run, compile a catalog that depends on a fact that
+      # only exists in the second environment. If the fact is missing/empty,
+      # then compilation will fail since resources can't have an empty title.
+      mounts[:catalog] = -> (req, res) {
+        node = Puppet::Node.new('test')
+
+        code = if first_run
+                 first_run = false
+                 ''
+               else
+                 data = CGI.unescape(req.query['facts'])
+                 facts = Puppet::Node::Facts.convert_from('json', data)
+                 node.fact_merge(facts)
+                 'notify { $facts["agent_spec_role"]: }'
+               end
+
+        catalog = compile_to_catalog(code, node)
+        catalog.environment = 'newenv'
+
+        res.body = formatter.render(catalog)
+        res['Content-Type'] = formatter.mime
+      }
+
+      server.start_server(mounts: mounts) do |port|
+        Puppet[:serverport] = port
+        expect {
+          agent.command_line.args << '--test'
+          agent.run
+        }.to exit_with(2)
+         .and output(a_string_matching(%r{Notice: Local environment: 'production' doesn't match server specified environment 'newenv', restarting agent run with environment 'newenv'})
+         .and matching(%r{defined 'message' as 'web'})).to_stdout
+      end
+    end
+  end
 end

data/spec/integration/application/filebucket_spec.rb

@@ -18,6 +18,11 @@ describe "puppet filebucket", unless: Puppet::Util::Platform.jruby? do
     File.binwrite(backup_file, text)
   end
 
+  after :each do
+    # mute debug messages generated during `after :each` blocks
+    Puppet::Util::Log.close_all
+  end
+
   it "backs up to and restores from the local filebucket" do
     filebucket.command_line.args = ['backup', backup_file, '--local']
     expect {
@@ -126,6 +131,17 @@ describe "puppet filebucket", unless: Puppet::Util::Platform.jruby? do
     end
   end
 
+  it "lists the local filebucket even if the environment doesn't exist locally" do
+    Puppet[:environment] = 'doesnotexist'
+    Puppet::FileSystem.mkpath(Puppet[:clientbucketdir])
+
+    filebucket.command_line.args = ['backup', '--local', backup_file]
+    expect {
+      result = filebucket.run
+      expect(result).to eq([backup_file])
+    }.to output(/Computing checksum on file/).to_stdout
+  end
+
   context 'diff', unless: Puppet::Util::Platform.windows? || Puppet::Util::Platform.jruby? do
     context 'using a remote bucket' do
       it 'outputs a diff between a local and remote file' do

data/spec/integration/application/module_spec.rb

@@ -65,4 +65,25 @@ describe 'puppet module', unless: Puppet::Util::Platform.jruby? do
        .and output(%r{Unable to verify the SSL certificate}).to_stderr
     end
   end
+
+  it 'prints the complete URL it tried to connect to' do
+    response_proc = -> (req, res) { res.status = 404 }
+
+    # create a temp cacert bundle
+    ssl_file = tmpfile('systemstore')
+    File.write(ssl_file, server.ca_cert)
+
+    Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+      server.start_server(response_proc: response_proc) do |port|
+        Puppet[:module_repository] = "https://127.0.0.1:#{port}/bogus_test/puppet"
+
+        expect {
+          app.command_line.args = ['install', 'puppetlabs-bacula']
+          app.run
+        }.to exit_with(1)
+         .and output(%r{Notice: Downloading from https://127.0.0.1:#{port}}).to_stdout
+         .and output(%r{https://127.0.0.1:#{port}/bogus_test/puppet/v3/releases}).to_stderr
+      end
+    end
+  end
 end

data/spec/integration/application/resource_spec.rb

@@ -0,0 +1,64 @@
+require 'spec_helper'
+require 'puppet_spec/files'
+
+describe "puppet resource", unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
+
+  let(:resource) { Puppet::Application[:resource] }
+
+  context 'when given an invalid environment' do
+    before { Puppet[:environment] = 'badenv' }
+
+    it 'falls back to the default environment' do
+      Puppet[:log_level] = 'debug'
+
+      expect {
+        resource.run
+      }.to exit_with(1)
+       .and output(/Debug: Specified environment 'badenv' does not exist on the filesystem, defaulting to 'production'/).to_stdout
+       .and output(/Error: Could not run: You must specify the type to display/).to_stderr
+    end
+
+    it 'lists resources' do
+      resource.command_line.args = ['file', Puppet[:confdir]]
+
+      expect {
+        resource.run
+      }.to output(/file { '#{Puppet[:confdir]}':/).to_stdout
+    end
+
+    it 'lists types from the default environment' do
+      modulepath = File.join(Puppet[:codedir], 'modules', 'test', 'lib', 'puppet', 'type')
+      FileUtils.mkdir_p(modulepath)
+      File.write(File.join(modulepath, 'test.rb'), 'Puppet::Type.newtype(:test)')
+      resource.command_line.args = ['--types']
+
+      expect {
+        resource.run
+      }.to exit_with(0).and output(/test/).to_stdout
+    end
+  end
+
+
+  context 'when handling file and tidy types' do
+    let!(:dir) { dir_containing('testdir', 'testfile' => 'contents') }
+
+    it 'does not raise when generating file resources' do
+      resource.command_line.args = ['file', dir, 'ensure=directory', 'recurse=true']
+
+      expect {
+        resource.run
+      }.to output(/ensure.+=> 'directory'/).to_stdout
+    end
+
+    it 'correctly cleans up a given path' do
+      resource.command_line.args = ['tidy', dir, 'rmdirs=true', 'recurse=true']
+
+      expect {
+        resource.run
+      }.to output(/Notice: \/File\[#{dir}\]\/ensure: removed/).to_stdout
+
+      expect(Puppet::FileSystem.exist?(dir)).to be false
+    end
+  end
+end

data/spec/integration/application/ssl_spec.rb

@@ -0,0 +1,20 @@
+require 'spec_helper'
+
+describe "puppet ssl", unless: Puppet::Util::Platform.jruby? do
+  context "print" do
+    it 'translates custom oids to their long name' do
+      basedir = File.expand_path("#{__FILE__}/../../../fixtures/ssl")
+      # registering custom oids changes global state, so shell out
+      output =
+        %x{puppet ssl show \
+           --certname oid \
+           --localcacert #{basedir}/ca.pem \
+           --hostcrl #{basedir}/crl.pem \
+           --hostprivkey #{basedir}/oid-key.pem \
+           --hostcert #{basedir}/oid.pem \
+           --trusted_oid_mapping_file #{basedir}/trusted_oid_mapping.yaml 2>&1
+        }
+      expect(output).to match(/Long name:/)
+    end
+  end
+end