puppet 7.7.0-universal-darwin → 7.11.0-universal-darwin

data/spec/unit/provider/package/pip2_spec.rb

@@ -26,7 +26,7 @@ describe Puppet::Type.type(:package).provider(:pip2) do
     end
 
     context 'when is defaultfor' do
-      let(:os) { Facter.value(:operatingsystem) }
+      let(:os) { Puppet.runtime[:facter].value(:operatingsystem) }
       subject do
         described_class.defaultfor(operatingsystem: os)
         described_class.specificity

data/spec/unit/provider/package/pip3_spec.rb

@@ -26,7 +26,7 @@ describe Puppet::Type.type(:package).provider(:pip3) do
     end
 
     context 'when is defaultfor' do
-      let(:os) { Facter.value(:operatingsystem) }
+      let(:os) { Puppet.runtime[:facter].value(:operatingsystem) }
       subject do
         described_class.defaultfor(operatingsystem: os)
         described_class.specificity

data/spec/unit/provider/package/pip_spec.rb

@@ -266,6 +266,43 @@ describe Puppet::Type.type(:package).provider(:pip) do
       let(:pip_version) { '1.5.4' }
       let(:pip_path) { '/fake/bin/pip' }
 
+      context "with pip version >= 20.3 and < 21.1" do
+        let(:pip_version) { '20.3.1' }
+        let(:pip_path) { '/fake/bin/pip' }
+
+        it "should use legacy-resolver argument" do
+          p = StringIO.new(
+            <<-EOS
+            Collecting real-package==versionplease
+              Could not find a version that satisfies the requirement real-package==versionplease (from versions: 1.1.3, 1.0, 1.9b1)
+            No matching distribution found for real-package==versionplease
+            EOS
+          )
+          expect(Puppet::Util::Execution).to receive(:execpipe).with(["/fake/bin/pip", "install", "real_package==versionplease",
+            "--use-deprecated=legacy-resolver"]).and_yield(p).once
+          @resource[:name] = "real_package"
+          @provider.latest
+        end
+      end
+
+      context "with pip version >= 21.1" do
+        let(:pip_version) { '21.1' }
+        let(:pip_path) { '/fake/bin/pip' }
+
+        it "should not use legacy-resolver argument" do
+          p = StringIO.new(
+            <<-EOS
+            Collecting real-package==versionplease
+              Could not find a version that satisfies the requirement real-package==versionplease (from versions: 1.1.3, 1.0, 1.9b1)
+            No matching distribution found for real-package==versionplease
+            EOS
+          )
+          expect(Puppet::Util::Execution).to receive(:execpipe).with(["/fake/bin/pip", "install", "real_package==versionplease"]).and_yield(p).once
+          @resource[:name] = "real_package"
+          @provider.latest
+        end
+      end
+
       it "should find a version number for real_package" do
         p = StringIO.new(
           <<-EOS
@@ -456,7 +493,7 @@ describe Puppet::Type.type(:package).provider(:pip) do
     end
 
     context 'when is defaultfor' do
-      let(:os) { Facter.value(:operatingsystem) }
+      let(:os) { Puppet.runtime[:facter].value(:operatingsystem) }
       subject do
         described_class.defaultfor(operatingsystem: os)
         described_class.specificity

data/spec/unit/provider/package/pkg_spec.rb

@@ -342,14 +342,17 @@ describe Puppet::Type.type(:package).provider(:pkg), unless: Puppet::Util::Platf
             resource[:ensure] = '1.0-0.151006'
             is = :absent
             expect(provider).to receive(:query).with(no_args).and_return({:ensure => is})
-            expect(provider).to receive(:properties).and_return({:mark => :hold})
+            expect(provider).to receive(:properties).and_return({:mark => :hold}).exactly(3).times
+
+            expect(described_class).to receive(:pkg)
+              .with(:freeze, 'dummy')
             expect(described_class).to receive(:pkg)
               .with(:list, '-Hvfa', 'dummy@1.0-0.151006')
               .and_return(Puppet::Util::Execution::ProcessOutput.new(File.read(my_fixture('dummy_implicit_version')), 0))
             expect(Puppet::Util::Execution).to receive(:execute)
               .with(['/bin/pkg', 'install', '-n', 'dummy@1.0,5.11-0.151006:20140220T084443Z'], {:failonfail => false, :combine => true})
               .and_return(Puppet::Util::Execution::ProcessOutput.new('', 0))
-            expect(provider).to receive(:unhold).with(no_args)
+            expect(provider).to receive(:unhold).with(no_args).twice
             expect(Puppet::Util::Execution).to receive(:execute)
               .with(['/bin/pkg', 'install', *hash[:flags], 'dummy@1.0,5.11-0.151006:20140220T084443Z'], {:failonfail => false, :combine => true})
               .and_return(Puppet::Util::Execution::ProcessOutput.new('', 0))
@@ -361,12 +364,17 @@ describe Puppet::Type.type(:package).provider(:pkg), unless: Puppet::Util::Platf
             resource[:ensure] = '1.0-0.151006'
             is = '1.0,5.11-0.151006:20140219T191204Z'
             expect(provider).to receive(:query).with(no_args).and_return({:ensure => is})
-            expect(provider).to receive(:properties).and_return({:mark => :hold})
-            expect(described_class).to receive(:pkg).with(:list, '-Hvfa', 'dummy@1.0-0.151006').and_return(File.read(my_fixture('dummy_implicit_version')))
+            expect(provider).to receive(:properties).and_return({:mark => :hold}).exactly(3).times
+
+            expect(described_class).to receive(:pkg)
+              .with(:freeze, 'dummy')
+            expect(described_class).to receive(:pkg)
+              .with(:list, '-Hvfa', 'dummy@1.0-0.151006')
+              .and_return(File.read(my_fixture('dummy_implicit_version')))
             expect(Puppet::Util::Execution).to receive(:execute)
               .with(['/bin/pkg', 'update', '-n', 'dummy@1.0,5.11-0.151006:20140220T084443Z'], {:failonfail => false, :combine => true})
               .and_return(Puppet::Util::Execution::ProcessOutput.new('', 0))
-            expect(provider).to receive(:unhold).with(no_args)
+            expect(provider).to receive(:unhold).with(no_args).twice
             expect(Puppet::Util::Execution).to receive(:execute)
               .with(['/bin/pkg', 'update', *hash[:flags], 'dummy@1.0,5.11-0.151006:20140220T084443Z'], {:failonfail => false, :combine => true})
               .and_return(Puppet::Util::Execution::ProcessOutput.new('', 0))
@@ -381,6 +389,9 @@ describe Puppet::Type.type(:package).provider(:pkg), unless: Puppet::Util::Platf
             expect(described_class).to receive(:pkg)
               .with(:list, '-Hvfa', 'dummy@1.0-0.151006')
               .and_return(Puppet::Util::Execution::ProcessOutput.new(File.read(my_fixture('dummy_implicit_version')), 0))
+            expect(Puppet::Util::Execution).to receive(:execute)
+              .with(['/bin/pkg', 'list', '-Hv', 'dummy'], {:failonfail => false, :combine => true})
+              .and_return(Puppet::Util::Execution::ProcessOutput.new(File.read(my_fixture('dummy_implicit_version')), 0))
             expect(Puppet::Util::Execution).to receive(:execute)
               .with(['/bin/pkg', 'update', '-n', 'dummy@1.0,5.11-0.151006:20140220T084443Z'], {:failonfail => false, :combine => true})
               .and_return(Puppet::Util::Execution::ProcessOutput.new('', 4))
@@ -395,6 +406,9 @@ describe Puppet::Type.type(:package).provider(:pkg), unless: Puppet::Util::Platf
             expect(described_class).to receive(:pkg)
               .with(:list, '-Hvfa', 'dummy@1.0-0.151006')
               .and_return(Puppet::Util::Execution::ProcessOutput.new(File.read(my_fixture('dummy_implicit_version')), 0))
+            expect(Puppet::Util::Execution).to receive(:execute)
+              .with(['/bin/pkg', 'list', '-Hv', 'dummy'], {:failonfail => false, :combine => true})
+              .and_return(Puppet::Util::Execution::ProcessOutput.new(File.read(my_fixture('dummy_implicit_version')), 0))
             expect(Puppet::Util::Execution).to receive(:execute)
               .with(['/bin/pkg', 'install', '-n', 'dummy@1.0,5.11-0.151006:20140220T084443Z'], {:failonfail => false, :combine => true})
               .and_return(Puppet::Util::Execution::ProcessOutput.new('', 0))

data/spec/unit/provider/package/puppet_gem_spec.rb

@@ -118,7 +118,7 @@ describe Puppet::Type.type(:package).provider(:puppet_gem) do
     end
 
     context 'when is defaultfor' do
-      let(:os) { Facter.value(:operatingsystem) }
+      let(:os) { Puppet.runtime[:facter].value(:operatingsystem) }
       subject do
         described_class.defaultfor(operatingsystem: os)
         described_class.specificity

data/spec/unit/provider/package/puppetserver_gem_spec.rb

@@ -127,7 +127,7 @@ describe Puppet::Type.type(:package).provider(:puppetserver_gem) do
     end
 
     context 'when is defaultfor' do
-      let(:os) {  Facter.value(:operatingsystem) }
+      let(:os) {  Puppet.runtime[:facter].value(:operatingsystem) }
       subject do
         described_class.defaultfor(operatingsystem: os)
         described_class.specificity

data/spec/unit/provider/package/windows/exe_package_spec.rb

@@ -1,5 +1,6 @@
 require 'spec_helper'
 require 'puppet/provider/package/windows/exe_package'
+require 'puppet/provider/package/windows'
 
 describe Puppet::Provider::Package::Windows::ExePackage do
   let (:name)        { 'Git version 1.7.11' }
@@ -71,10 +72,26 @@ describe Puppet::Provider::Package::Windows::ExePackage do
 
   context '#install_command' do
     it 'should install using the source' do
+      allow(Puppet::FileSystem).to receive(:exist?).with(source).and_return(true)
       cmd = described_class.install_command({:source => source})
 
       expect(cmd).to eq(source)
     end
+
+    it 'should raise error when URI is invalid' do
+      web_source = 'https://www.t e s t.test/test.exe'
+
+      expect do
+        described_class.install_command({:source => web_source, :name => name})
+      end.to raise_error(Puppet::Error, /Error when installing #{name}:/)
+    end
+
+    it 'should download package from source file before installing', if: Puppet::Util::Platform.windows? do
+      web_source = 'https://www.test.test/test.exe'
+      stub_request(:get, web_source).to_return(status: 200, body: 'package binaries')
+      cmd = described_class.install_command({:source => web_source})
+      expect(File.read(cmd)).to eq('package binaries')
+    end
   end
 
   context '#uninstall_command' do

data/spec/unit/provider/parsedfile_spec.rb

@@ -79,6 +79,16 @@ describe Puppet::Provider::ParsedFile do
 
       provider.instances
     end
+
+    it "should raise if parsing returns nil" do
+      expect(provider).to receive(:targets).and_return(%w{/one})
+      expect_any_instance_of(Puppet::Util::FileType::FileTypeFlat).to receive(:read).and_return('a=b')
+      expect(provider).to receive(:parse).and_return(nil)
+
+      expect {
+        provider.instances
+      }.to raise_error(Puppet::DevError, %r{Prefetching /one for provider parsedfile_provider returned nil})
+    end
   end
 
   describe "when matching resources to existing records" do

data/spec/unit/provider/service/freebsd_spec.rb

@@ -82,7 +82,7 @@ OUTPUT
     allow(Puppet::FileSystem).to receive(:exist?).with('/etc/rc.conf').and_return(true)
     allow(File).to receive(:read).with('/etc/rc.conf').and_return("openntpd_enable=\"NO\"\nntpd_enable=\"NO\"\n")
     fh = double('fh')
-    allow(File).to receive(:open).with('/etc/rc.conf', File::WRONLY).and_yield(fh)
+    allow(Puppet::FileSystem).to receive(:replace_file).with('/etc/rc.conf').and_yield(fh)
     expect(fh).to receive(:<<).with("openntpd_enable=\"NO\"\nntpd_enable=\"YES\"\n")
     allow(Puppet::FileSystem).to receive(:exist?).with('/etc/rc.conf.local').and_return(false)
     allow(Puppet::FileSystem).to receive(:exist?).with('/etc/rc.conf.d/ntpd').and_return(false)

data/spec/unit/provider/service/launchd_spec.rb

@@ -325,6 +325,7 @@ describe 'Puppet::Type::Service::Provider::Launchd',
           'LimitLoadToSessionType' => 'Aqua'
         }
       end
+      let(:plist_without_label_not_hash) { 'just a string' }
       let(:busted_plist_path) { '/Library/LaunchAgents/org.busted.plist' }
       let(:binary_plist_path) { '/Library/LaunchAgents/org.binary.plist' }
 
@@ -336,6 +337,16 @@ describe 'Puppet::Type::Service::Provider::Launchd',
         expect(Puppet).to receive(:debug).with("The #{busted_plist_path} plist does not contain a 'label' key; Puppet is skipping it")
         provider.make_label_to_path_map
       end
+
+      it "it should warn that the malformed plist in question is being skipped" do
+        expect(provider).to receive(:launchd_paths).and_return(['/Library/LaunchAgents'])
+        expect(provider).to receive(:return_globbed_list_of_file_paths).with('/Library/LaunchAgents').and_return([busted_plist_path])
+        expect(plistlib).to receive(:read_plist_file).with(busted_plist_path).and_return(plist_without_label_not_hash)
+        expect(Puppet).to receive(:debug).with("Reading launchd plist #{busted_plist_path}")
+        expect(Puppet).to receive(:debug).with("The #{busted_plist_path} plist does not contain a 'label' key; Puppet is skipping it")
+        provider.make_label_to_path_map
+      end
+
     end
 
     it "should return the cached value when available" do

data/spec/unit/provider/service/systemd_spec.rb

@@ -29,7 +29,7 @@ describe 'Puppet::Type::Service::Provider::Systemd',
     end
   end
 
-  [7, 8].each do |ver|
+  [7, 8, 9].each do |ver|
     it "should be the default provider on rhel#{ver}" do
       allow(Facter).to receive(:value).with(:osfamily).and_return(:redhat)
       allow(Facter).to receive(:value).with(:operatingsystem).and_return(:redhat)
@@ -362,6 +362,9 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
   describe "#mask" do
     it "should run systemctl to disable and mask a service" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
+      expect(provider).to receive(:execute).
+                            with(['/bin/systemctl','cat', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("# /lib/systemd/system/sshd.service\n...", 0))
       # :disable is the only call in the provider that uses a symbol instead of
       # a string.
       # This should be made consistent in the future and all tests updated.
@@ -369,6 +372,15 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
       expect(provider).to receive(:systemctl).with(:mask, '--', 'sshd.service')
       provider.mask
     end
+
+    it "masks a service that doesn't exist" do
+      provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'doesnotexist.service'))
+      expect(provider).to receive(:execute).
+                            with(['/bin/systemctl','cat', '--', 'doesnotexist.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("No files found for doesnotexist.service.\n", 1))
+      expect(provider).to receive(:systemctl).with(:mask, '--', 'doesnotexist.service')
+      provider.mask
+    end
   end
 
   # Note: systemd provider does not care about hasstatus or a custom status

data/spec/unit/provider/user/aix_spec.rb

@@ -217,4 +217,104 @@ describe 'Puppet::Type::User::Provider::Aix' do
       provider.create
     end
   end
+
+  describe '#list_all_homes' do
+    it "should return empty array and output debug on failure" do
+      allow(Puppet::Util::Execution).to receive(:execute).and_raise(Puppet::ExecutionFailure, 'Execution failed')
+      expect(Puppet).to receive(:debug).with('Could not list home of all users: Execution failed')
+      expect(provider.list_all_homes).to eql({})
+    end
+  end
+
+  describe '#delete' do
+    before(:each) do
+      allow(File).to receive(:realpath).and_call_original
+      allow(FileUtils).to receive(:remove_entry_secure).and_call_original
+
+      allow(provider.resource).to receive(:should).with(anything).and_return(nil)
+      allow(provider).to receive(:home).and_return(Dir.tmpdir)
+      allow(provider).to receive(:execute).and_return(nil)
+      allow(provider).to receive(:object_info).and_return(nil)
+      allow(FileUtils).to receive(:remove_entry_secure).with(Dir.tmpdir, true).and_return(nil)
+    end
+
+    context 'with managehome true' do
+      before(:each) do
+        allow(provider.resource).to receive(:managehome?).and_return(true)
+        allow(provider).to receive(:list_all_homes).and_return([])
+      end
+
+      it 'should delete the user without error' do
+        expect{ provider.delete }.not_to raise_error
+      end
+
+      it "should not remove home when relative" do
+        allow(provider).to receive(:home).and_return('relative_path')
+
+        expect(Puppet).to receive(:debug).with(/Please make sure the path is not relative, symlink or '\/'./)
+        provider.delete
+      end
+
+      it "should not remove home when '/'" do
+        allow(provider).to receive(:home).and_return('/')
+
+        expect(Puppet).to receive(:debug).with(/Please make sure the path is not relative, symlink or '\/'./)
+        provider.delete
+      end
+
+      it "should not remove home when symlink" do
+        allow(Puppet::FileSystem).to receive(:symlink?).with(Dir.tmpdir).and_return(true)
+
+        expect(Puppet).to receive(:debug).with(/Please make sure the path is not relative, symlink or '\/'./)
+        provider.delete
+      end
+
+      it "should not remove home when other users would be affected" do
+        allow(provider).to receive(:home).and_return('/special')
+        allow(File).to receive(:realpath).with('/special').and_return('/special')
+        allow(Puppet::Util).to receive(:absolute_path?).with('/special').and_return(true)
+        allow(provider).to receive(:list_all_homes).and_return([{:name => 'other_user', :home => '/special/other_user'}])
+
+        expect(Puppet).to receive(:debug).with(/it would remove the home directory '\/special\/other_user' of user 'other_user' also./)
+        provider.delete
+      end
+
+      it 'should remove homedir' do
+        expect(FileUtils).to receive(:remove_entry_secure).with(Dir.tmpdir, true)
+        provider.delete
+      end
+    end
+
+    context 'with managehome false' do
+      before(:each) do
+        allow(provider.resource).to receive(:managehome?).and_return(false)
+      end
+
+      it 'should delete the user without error' do
+        expect{ provider.delete }.not_to raise_error
+      end
+
+      it 'should not remove homedir' do
+        expect(FileUtils).not_to receive(:remove_entry_secure).with(Dir.tmpdir, true)
+      end
+
+      it 'should not print manage home debug messages' do
+        expect(Puppet).not_to receive(:debug).with(/Please make sure the path is not relative, symlink or '\/'./)
+        expect(Puppet).not_to receive(:debug).with(/it would remove the home directory '\/special\/other_user' of user 'other_user' also./)
+
+        provider.delete
+      end
+    end
+  end
+
+  describe '#deletecmd' do
+    it 'uses the -p flag when removing the user' do
+      allow(provider.class).to receive(:command).with(:delete).and_return('delete')
+      allow(provider).to receive(:ia_module_args).and_return(['ia_module_args'])
+
+      expect(provider.deletecmd).to eql(
+        ['delete', '-p', 'ia_module_args', provider.resource.name]
+      )
+    end
+  end
 end

data/spec/unit/provider/user/directoryservice_spec.rb

@@ -925,28 +925,75 @@ end
       }
     end
 
-    it 'should call set_salted_sha512 on 10.7 when given a salted-SHA512 password hash' do
-      expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-      expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(sha512_shadowhashdata)
-      expect(provider.class).to receive(:get_os_version).and_return('10.7')
-      expect(provider).to receive(:set_salted_sha512).with(sample_users_plist, sha512_shadowhashdata, sha512_password_hash)
-      provider.write_password_to_users_plist(sha512_password_hash)
+    before do
+      allow(provider).to receive(:merge_attribute_with_dscl).with('Users', username, 'AuthenticationAuthority', any_args)
     end
 
-    it 'should call set_salted_pbkdf2 on 10.8 when given a PBKDF2 password hash' do
-      expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-      expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
-      expect(provider.class).to receive(:get_os_version).and_return('10.8')
-      expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
-      provider.write_password_to_users_plist(pbkdf2_password_hash)
+    describe 'when on macOS 11 (Big Sur) or greater' do
+      before do
+        allow(provider.class).to receive(:get_os_version).and_return('11.0.0')
+      end
+
+      it 'should add salted_sha512_pbkdf2 AuthenticationAuthority key if missing' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(true)
+
+        expect(Puppet).to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
+
+      it 'should not add salted_sha512_pbkdf2 AuthenticationAuthority key if not missing' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
+
+        expect(Puppet).not_to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
     end
 
-    it "should delete the SALTED-SHA512 key in the shadow_hash_data hash if it exists on a 10.8 system and write_password_to_users_plist has been called to set the user's password" do
-      expect(provider).to receive(:get_users_plist).and_return('users_plist')
-      expect(provider).to receive(:get_shadow_hash_data).with('users_plist').and_return(sha512_shadowhashdata)
-      expect(provider.class).to receive(:get_os_version).and_return('10.8')
-      expect(provider).to receive(:set_salted_pbkdf2).with('users_plist', {}, 'entropy', pbkdf2_password_hash)
-      provider.write_password_to_users_plist(pbkdf2_password_hash)
+    describe 'when on macOS version lower than 11' do
+      before do
+        allow(provider.class).to receive(:get_os_version)
+        allow(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
+      end
+
+      it 'should not add salted_sha512_pbkdf2 AuthenticationAuthority' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
+
+        expect(Puppet).not_to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
+
+      it 'should call set_salted_sha512 on 10.7 when given a salted-SHA512 password hash' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(sha512_shadowhashdata)
+        expect(provider.class).to receive(:get_os_version).and_return('10.7')
+        expect(provider).to receive(:set_salted_sha512).with(sample_users_plist, sha512_shadowhashdata, sha512_password_hash)
+        provider.write_password_to_users_plist(sha512_password_hash)
+      end
+
+      it 'should call set_salted_pbkdf2 on 10.8 when given a PBKDF2 password hash' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+        expect(provider.class).to receive(:get_os_version).and_return('10.8')
+        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
+
+      it "should delete the SALTED-SHA512 key in the shadow_hash_data hash if it exists on a 10.8 system and write_password_to_users_plist has been called to set the user's password" do
+        expect(provider).to receive(:get_users_plist).and_return('users_plist')
+        expect(provider).to receive(:get_shadow_hash_data).with('users_plist').and_return(sha512_shadowhashdata)
+        expect(provider.class).to receive(:get_os_version).and_return('10.8')
+        expect(provider).to receive(:set_salted_pbkdf2).with('users_plist', {}, 'entropy', pbkdf2_password_hash)
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
     end
   end
 
@@ -974,16 +1021,7 @@ end
   describe '#set_shadow_hash_data' do
     let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
 
-    it 'should flush the plist data to disk on OS X < 10.15' do
-      allow(provider.class).to receive(:get_os_version).and_return('10.12')
-
-      expect(provider).to receive(:write_users_plist_to_disk)
-      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
-    end
-
-    it 'should flush the plist data a temporary file on OS X >= 10.15' do
-      allow(provider.class).to receive(:get_os_version).and_return('10.15')
-
+    it 'should flush the plist data to a temporary file' do
       expect(provider).to receive(:write_and_import_shadow_hash_data)
       provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
     end
@@ -1033,13 +1071,6 @@ end
     end
   end
 
-  describe '#write_users_plist_to_disk' do
-    it 'should save the passed plist to disk and convert it to a binary plist' do
-      expect(Puppet::Util::Plist).to receive(:write_plist_file).with(user_plist_xml, "#{users_plist_dir}/nonexistent_user.plist", :binary)
-      provider.write_users_plist_to_disk(user_plist_xml)
-    end
-  end
-
   describe '#write_and_import_shadow_hash_data' do
     it 'should save the passed plist to a temporary file and import it' do
       tmpfile = double('tempfile', :path => "/tmp/dsimport_#{username}", :flush => nil)
@@ -1111,7 +1142,7 @@ end
       provider.class.instance_variable_set(:@os_version, nil) if provider.class.instance_variable_defined? :@os_version
     end
 
-    it 'should call Facter.value(:macosx_productversion_major) ONLY ONCE no matter how ' +
+    it 'should call Puppet.runtime[:facter].value(:macosx_productversion_major) ONLY ONCE no matter how ' +
        'many times get_os_version() is called' do
       expect(Facter).to receive(:value).with(:macosx_productversion_major).once.and_return('10.8')
       expect(provider.class.get_os_version).to eq('10.8')
@@ -1203,6 +1234,7 @@ end
     before :each do
       allow(provider.class).to receive(:get_all_users).and_return(all_users_hash)
       allow(provider.class).to receive(:get_list_of_groups).and_return(group_plist_hash_guid)
+      allow(provider).to receive(:merge_attribute_with_dscl).with('Users', username, 'AuthenticationAuthority', any_args)
       provider.class.prefetch({})
     end