From b4ffec7c021025ced31343a70ab42d31922aff79 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Thu, 6 Aug 2026 10:41:48 -0500 Subject: [PATCH 1/4] Migrate lookup acceptance tests to Hiera 5 data providers PRs #384/#385 removed the deprecated data_binding_terminus and environment_data_provider settings and the metadata.json data_provider key, as accepted in the OpenVox 9 deprecation review. Two acceptance tests still configured environment and module data through those removed mechanisms and began failing on all platforms once 9.0.0 beta packages were built (acceptance-pipelines run 31098859281). Migrate the fixtures the same way #385 migrated the in-repo spec fixtures: - tests/lookup/lookup.rb: bind the environment and module data functions through hiera.yaml (version 5, v4_data_hash) at the environment root and module roots; drop the data_provider key from metadata.json. - tests/parser_functions/puppet_lookup_cmd.rb: env2/env3 (function providers) get env-level hiera.yaml v5 with v4_data_hash: environment::data; env4 (none) gets an explicit empty hierarchy, since environments always have a data layer under Hiera 5; production/env1 keep their still-supported v4 env hiera.yaml. mod2/mod3 (function) get module hiera.yaml v5 with v4_data_hash; mod4 (none) loses its hiera.yaml entirely so the module layer is absent, preserving the not-found behavior the assertions expect. The inert environment_data_provider lines and all 20 metadata.json data_provider keys are removed. One --explain assertion is updated because the environment data provider section now always appears in explain output (previously absent under provider none). Verified on a local beaker rig (single almalinux 9 primary running openvox-agent 9.0.0~beta2 and openvox-server 9.0.0~beta4, the versions from the failing pipeline run): both pipeline failures reproduced exactly with the pristine tests, and both tests pass with this change. All lookup *value* expectations are unchanged -- the loader picks the same function implementations the v4 providers did (ruby when both ruby and puppet-language exist, e.g. env2/mod2; puppet-language when only it exists, e.g. env3/mod3) and the v4_data_hash backend even preserves the Deprecated API function explain wording the test asserts. Note for rerunning on persistent hosts: the puppet_lookup_cmd teardown removes node1/node2 SSL keys but not the CA-signed certs, so back-to-back runs against the same CA need a puppetserver ca clean first. Fresh pipeline VMs are unaffected. Signed-off-by: Steven Pritchard Co-authored-by: Claude Fable 5 --- acceptance/tests/lookup/lookup.rb | 33 +++- .../parser_functions/puppet_lookup_cmd.rb | 169 ++++++++---------- 2 files changed, 98 insertions(+), 104 deletions(-) diff --git a/acceptance/tests/lookup/lookup.rb b/acceptance/tests/lookup/lookup.rb index ca1ec8892c..a10652d311 100644 --- a/acceptance/tests/lookup/lookup.rb +++ b/acceptance/tests/lookup/lookup.rb @@ -98,12 +98,23 @@ def mod_manifest_metadata_json(module_name = nil, testdir) "project_page": null, "issues_url": null, "dependencies": [ - ], - "data_provider": "function" + ] } ', mode => "0644", } + # Hiera 5 module layer: bind the module data function + # (replaces the removed metadata.json "data_provider" key) + file { '#{testdir}/environments/production/modules/#{module_name}/hiera.yaml': + ensure => file, + content => '--- +version: 5 +hierarchy: + - name: "Module data function" + v4_data_hash: #{module_name}::data +', + mode => "0644", + } file { '#{testdir}/environments/production/modules/#{module_name}/lib/puppet/bindings': ensure => absent, force => true, @@ -202,14 +213,24 @@ def mod_manifest_metadata_json(module_name = nil, testdir) ensure => file, content => ' environment_timeout = 0 - # for this environment, provide our own function to supply data to lookup - # implies a ruby function in /lib/puppet/functions/environment/data.rb - # named environment::data() - environment_data_provider = "function" ', mode => "0640", } +# Hiera 5 environment layer: bind the environment data function +# (replaces the removed environment_data_provider setting; the function +# lives in /lib/puppet/functions/environment/data.rb) +file { '#{testdir}/environments/production/hiera.yaml': + ensure => file, + content => '--- +version: 5 +hierarchy: + - name: "Environment data function" + v4_data_hash: environment::data +', + mode => "0640", +} + # the function to provide data for this environment file { '#{testdir}/environments/production/lib/puppet/functions/environment/data.rb': ensure => file, diff --git a/acceptance/tests/parser_functions/puppet_lookup_cmd.rb b/acceptance/tests/parser_functions/puppet_lookup_cmd.rb index 049da39255..5ab7dcba57 100644 --- a/acceptance/tests/parser_functions/puppet_lookup_cmd.rb +++ b/acceptance/tests/parser_functions/puppet_lookup_cmd.rb @@ -354,7 +354,6 @@ ensure => file, mode => "0644", content => 'environment_timeout = 0 -environment_data_provider = "hiera" ', } @@ -362,7 +361,6 @@ ensure => file, mode => "0644", content => 'environment_timeout = 0 -environment_data_provider = "function" ', } @@ -370,7 +368,6 @@ ensure => file, mode => "0644", content => 'environment_timeout = 0 -environment_data_provider = "function" ', } @@ -378,7 +375,6 @@ ensure => file, mode => "0644", content => 'environment_timeout = 0 -environment_data_provider = "none" ', } @@ -422,7 +418,10 @@ ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Environment data function" + v4_data_hash: environment::data ', } @@ -440,7 +439,10 @@ ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Environment data function" + v4_data_hash: environment::data ', } @@ -458,7 +460,8 @@ ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: [] ', } @@ -629,7 +632,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod2::data ', } @@ -648,7 +654,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod3::data ', } @@ -663,14 +672,6 @@ def data() ', } -file { '#{@coderoot}/environments/production/modules/mod4/hiera.yaml': - ensure => file, - mode => "0644", - content => '--- - version: 4 -', -} - file { '#{@coderoot}/environments/production/modules/mod4/data/common.yaml': ensure => file, mode => "0644", @@ -704,7 +705,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod2::data ', } @@ -722,7 +726,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod3::data ', } @@ -736,14 +743,6 @@ def data() ', } -file { '#{@coderoot}/environments/env1/modules/mod4/hiera.yaml': - ensure => file, - mode => "0644", - content => '--- - version: 4 -', -} - file { '#{@coderoot}/environments/env1/modules/mod4/data/common.yaml': ensure => file, mode => "0644", @@ -776,7 +775,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod2::data ', } @@ -794,7 +796,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod3::data ', } @@ -808,14 +813,6 @@ def data() ', } -file { '#{@coderoot}/environments/env2/modules/mod4/hiera.yaml': - ensure => file, - mode => "0644", - content => '--- - version: 4 -', -} - file { '#{@coderoot}/environments/env2/modules/mod4/data/common.yaml': ensure => file, mode => "0644", @@ -848,7 +845,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod2::data ', } @@ -866,7 +866,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod3::data ', } @@ -880,14 +883,6 @@ def data() ', } -file { '#{@coderoot}/environments/env3/modules/mod4/hiera.yaml': - ensure => file, - mode => "0644", - content => '--- - version: 4 -', -} - file { '#{@coderoot}/environments/env3/modules/mod4/data/common.yaml': ensure => file, mode => "0644", @@ -920,7 +915,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod2::data ', } @@ -938,7 +936,10 @@ def data() ensure => file, mode => "0644", content => '--- - version: 4 + version: 5 + hierarchy: + - name: "Module data function" + v4_data_hash: mod3::data ', } @@ -952,14 +953,6 @@ def data() ', } -file { '#{@coderoot}/environments/env4/modules/mod4/hiera.yaml': - ensure => file, - mode => "0644", - content => '--- - version: 4 -', -} - file { '#{@coderoot}/environments/env4/modules/mod4/data/common.yaml': ensure => file, mode => "0644", @@ -1712,8 +1705,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "hiera" + "dependencies": [] } ', } @@ -1730,8 +1722,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -1748,8 +1739,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -1766,8 +1756,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "none" + "dependencies": [] } ', } @@ -1784,8 +1773,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "hiera" + "dependencies": [] } ', } @@ -1802,8 +1790,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -1820,8 +1807,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -1838,8 +1824,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "none" + "dependencies": [] } ', } @@ -1856,8 +1841,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "hiera" + "dependencies": [] } ', } @@ -1874,8 +1858,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -1892,8 +1875,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -1910,8 +1892,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "none" + "dependencies": [] } ', } @@ -1928,8 +1909,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "hiera" + "dependencies": [] } ', } @@ -1946,8 +1926,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -1964,8 +1943,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -1982,8 +1960,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "none" + "dependencies": [] } ', } @@ -2000,8 +1977,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "hiera" + "dependencies": [] } ', } @@ -2018,8 +1994,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -2036,8 +2011,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "function" + "dependencies": [] } ', } @@ -2054,8 +2028,7 @@ def data() "source": "", "project_page": null, "issues_url": null, - "dependencies": [], - "data_provider": "none" + "dependencies": [] } ', } @@ -2498,7 +2471,7 @@ def data() rxe4m1 = on(master, puppet('lookup', '--explain', '--environment env4', 'mod1::module_key')) result = rxe4m1.stdout assert_match( - /Global Data Provider.*\s*Using.*\s*Hier.*\s*Path.*\s*Orig.*\s*No such key.*\s*Module.*Data Provider.*\s*Using.*\s*Hier.*common\"\s*Path.*\s*Orig.*\s*Found key.*module-env4-mod1-hiera/, + /Global Data Provider.*\s*Using.*\s*Hier.*\s*Path.*\s*Orig.*\s*No such key.*\s*Environment Data Provider.*\s*Using.*\s*No such key.*\s*Module.*Data Provider.*\s*Using.*\s*Hier.*common\"\s*Path.*\s*Orig.*\s*Found key.*module-env4-mod1-hiera/, result, "environment env4 mod1::module_key lookup failed." ) From 58869545c7d9fbd5026c0afd94e95e79d4d0189f Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Thu, 6 Aug 2026 12:35:23 -0500 Subject: [PATCH 2/4] Compare facterversion against installed facter in acceptance test ensure_puppet_facts_can_use_facter.rb asserted that the facterversion fact reported a major version of at most 5. Hardcoding the major version breaks on every openfact major bump -- openfact 6.0.0 shipped in openvox-agent 9.0.0~beta2 made the test fail on all 11 platforms in acceptance run 31098859281 (openvox-agent suite). Compare the fact against the output of facter --version on the agent instead, which expresses what the test actually cares about (puppet facts uses the bundled facter) and survives future major bumps. Verified on a local beaker rig against openvox-agent 9.0.0~beta2 (openfact 6.0.0): the unmodified test fails with the same Minitest assertion as the pipeline; with this change it passes. Signed-off-by: Steven Pritchard Co-authored-by: Claude Fable 5 --- .../tests/ensure_puppet_facts_can_use_facter.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/packaging/acceptance/tests/ensure_puppet_facts_can_use_facter.rb b/packaging/acceptance/tests/ensure_puppet_facts_can_use_facter.rb index c35fae509e..99f20c54c8 100644 --- a/packaging/acceptance/tests/ensure_puppet_facts_can_use_facter.rb +++ b/packaging/acceptance/tests/ensure_puppet_facts_can_use_facter.rb @@ -4,9 +4,14 @@ agents.each do |agent| step 'test puppet facts with correct facter version' do + # Compare against the installed facter rather than a hardcoded major + # version, which broke on every openfact major bump (4 -> 5 -> 6). + installed_version = on(agent, facter('--version'), :acceptable_exit_codes => [0]).stdout.strip on(agent, puppet('facts'), :acceptable_exit_codes => [0]) do |result| - facter_major_version = Integer(JSON.parse(result.stdout)["facterversion"].split('.').first) - assert(5 >= facter_major_version, "wrong facter version") + facterversion = JSON.parse(result.stdout)["facterversion"] + assert_equal(installed_version, facterversion, + "puppet facts reported facterversion #{facterversion.inspect}, " \ + "but the installed facter is #{installed_version.inspect}") end end From 6ce29988f466e29a19cc51f4791e4f183da46369 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Thu, 6 Aug 2026 13:17:04 -0500 Subject: [PATCH 3/4] Request report storage explicitly in cached-catalog drift test openvox#583 changed the default of the reports setting from store to none, so the server now accepts report submissions and hands them to no processors. cached_catalog_remediate_local_drift.rb asserted that a submitted report appears under the server reportdir while relying on the old default, and began failing on all platforms in acceptance run 31098859281 (openvox suite, shard:group4). Diagnosis on a local rig confirmed the agent PUT succeeds (200 in the server access log) while nothing is stored. Set reports = store and a test-owned reportdir in master_opts, matching the pattern the other report-checking acceptance tests (reports/submission.rb, reports/cached_catalog_status_in_report.rb, direct_puppet/catalog_uuid_correlates_catalogs_with_reports.rb) already use -- this test was the only one relying on the default. Also fix the reversed assert_equal argument order in the two report-count assertions so failure messages report expected and actual correctly, and clean up the reportdir in teardown. Verified on a local beaker rig against openvox-agent 9.0.0~beta2 and openvox-server 9.0.0~beta4: the unmodified test reproduces the pipeline failure; with this change it passes. Note for release notes: the reports=none default change itself is user-visible (report YAML consumers must now set reports=store) and should be called out in the 9.0 release notes. Signed-off-by: Steven Pritchard Co-authored-by: Claude Fable 5 --- .../cached_catalog_remediate_local_drift.rb | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/acceptance/tests/direct_puppet/cached_catalog_remediate_local_drift.rb b/acceptance/tests/direct_puppet/cached_catalog_remediate_local_drift.rb index 6acdcb4ffb..a4b8b7cbd7 100644 --- a/acceptance/tests/direct_puppet/cached_catalog_remediate_local_drift.rb +++ b/acceptance/tests/direct_puppet/cached_catalog_remediate_local_drift.rb @@ -14,10 +14,17 @@ basedir = master.tmpdir(File.basename(__FILE__, '.*')) module_dir = "#{basedir}/environments/production/modules" + master_reportdir = create_tmpdir_for_user(master, 'reportdir') master_opts = { 'main' => { 'environmentpath' => "#{basedir}/environments" + }, + # The server no longer stores reports by default (reports = none); + # request storage explicitly like the other report-checking tests do. + 'master' => { + 'reportdir' => master_reportdir, + 'reports' => 'store' } } @@ -28,6 +35,7 @@ teardown do cleanup_puppetserver_code_id_scripts(master, basedir) on master, "rm -rf #{basedir}" + on master, "rm -rf #{master_reportdir}" agents.each do |agent| on(agent, puppet('config print lastrunfile')) do |command_result| @@ -96,9 +104,9 @@ # sends a report. step "Remove existing reports from server reports directory" - on(master, "rm -rf /opt/puppetlabs/server/data/puppetserver/reports/#{agent.node_name}/*") - r = on(master, "ls /opt/puppetlabs/server/data/puppetserver/reports/#{agent.node_name} | wc -l").stdout.chomp - assert_equal(r, '0', "reports directory should be empty!") + on(master, "rm -rf #{master_reportdir}/#{agent.node_name}/*") + r = on(master, "ls #{master_reportdir}/#{agent.node_name} 2>/dev/null | wc -l").stdout.chomp + assert_equal('0', r, "reports directory should be empty!") step "Verify puppet run without drift does not make file request from server" r = on(agent, puppet("agent", @@ -113,8 +121,8 @@ assert_equal(r, "", "Fail: Did agent try to contact server?") step "Verify report was delivered to server" - r = on(master, "ls /opt/puppetlabs/server/data/puppetserver/reports/#{agent.node_name} | wc -l").stdout.chomp - assert_equal(r, '1', "Reports directory should have one file") + r = on(master, "ls #{master_reportdir}/#{agent.node_name} | wc -l").stdout.chomp + assert_equal('1', r, "Reports directory should have one file") step "agent: #{agent}: Remove the test file to simulate drift" on(agent, "rm -rf #{agent_test_file_path}") From 337a918faa5d5db7d32eec5d6c70fa9541fbf347 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Fri, 7 Aug 2026 08:46:12 -0500 Subject: [PATCH 4/4] Update filebucket content acceptance tests for literal checksum semantics openvox#170 removed the implicit filebucket retrieval for file content values that look like checksums; such content is now always managed literally. Two acceptance tests still exercised the removed behavior and fail on all platforms (acceptance run 31157133263, openvox suite shard:group3; also present but masked behind the lookup failures in run 31098859281): - ticket_6541_invalid_filebucket_files.rb asserted that checksum-like content never overwrites the target and that a well-formed checksum retrieves bucket content. Rewritten as a regression test for the new semantics: checksum-like content -- malformed or well-formed -- is written literally, which is exactly the capability whose absence motivated the removal. - resource/file/content_attribute.rb ended with a checksum-from-filebucket scenario; that block is removed with a comment pointing at the rewritten test. The raw-content, checksum-type, and illegal-timestamp coverage is unchanged. Verified on a local beaker rig against openvox-agent 9.0.0~beta2: both tests reproduce the pipeline failures unmodified and pass with this change. Signed-off-by: Steven Pritchard Co-authored-by: Claude Fable 5 --- .../tests/resource/file/content_attribute.rb | 35 ++-------- .../ticket_6541_invalid_filebucket_files.rb | 68 +++++++++---------- 2 files changed, 38 insertions(+), 65 deletions(-) diff --git a/acceptance/tests/resource/file/content_attribute.rb b/acceptance/tests/resource/file/content_attribute.rb index 8a190a3e11..3264d0c076 100644 --- a/acceptance/tests/resource/file/content_attribute.rb +++ b/acceptance/tests/resource/file/content_attribute.rb @@ -46,34 +46,9 @@ step "Ensure the test environment is clean" on(agent, "rm -f #{target}") - step "Content Attribute: using a checksum from filebucket" - on(agent, "echo 'This is the checksum file contents' > #{target}") - - step "Backup file into the filebucket" - on(agent, puppet_filebucket("backup --local #{target}")) - - step "Modify file to force apply to retrieve file from local clientbucket" - on(agent, "echo 'This is the modified file contents' > #{target}") - - dir = agent.puppet('user')['clientbucketdir'] - - sha256_manifest = %Q| - filebucket { 'local': - path => '#{dir}', - } - - file { '#{target}': - ensure => present, - content => '{sha256}3b9238769b033b48073267b8baea00fa51c598dc14081da51f2e510c37c46a28', - backup => local, - } - | - - step "Applying Manifest on Agent" - apply_manifest_on agent, sha256_manifest - - step "Validate filebucket checksum file contents" - on(agent, "cat #{target}") do |result| - assert_match(/This is the checksum file content/, result.stdout, "File content not matched on #{agent}") unless agent['locale'] == 'ja' - end + # The "checksum from filebucket" scenario was removed along with the + # implicit filebucket retrieval for checksum-like content values + # (openvox#170); content is now always managed literally. See + # ticket_6541_invalid_filebucket_files.rb for coverage of the literal + # behavior. end diff --git a/acceptance/tests/ticket_6541_invalid_filebucket_files.rb b/acceptance/tests/ticket_6541_invalid_filebucket_files.rb index 256d5de571..16c54faaf8 100644 --- a/acceptance/tests/ticket_6541_invalid_filebucket_files.rb +++ b/acceptance/tests/ticket_6541_invalid_filebucket_files.rb @@ -1,42 +1,40 @@ -test_name "#6541: file type truncates target when filebucket cannot retrieve hash" +test_name "#6541: checksum-like file content is managed literally" do tag 'audit:high', 'audit:integration', # file type and file bucket interop - 'audit:refactor', # look into combining with ticket_4622_filebucket_diff_test.rb - # Use block style `test_run` 'shard:group3' # For splitting out groups of tests for slow test runners -agents.each do |agent| - target=agent.tmpfile('6541-target') - - on(agent, "rm -rf \"#{agent.puppet['vardir']}/*bucket\"") - - step "write zero length file" - manifest = "file { '#{target}': content => '' }" - apply_manifest_on(agent, manifest) - - step "overwrite file, causing zero-length file to be backed up" - manifest = "file { '#{target}': content => 'some text', backup => 'puppet' }" - apply_manifest_on(agent, manifest) - - test_name "verify invalid hashes should not change the file" - - manifest = "file { '#{target}': content => '{sha256}notahash' }" - - apply_manifest_on(agent, manifest) do |result| - refute_match(/content changed/, result.stdout, "#{agent}: shouldn't have overwrote the file") - end - - test_name "verify valid but unbucketed hashes should not change the file" - manifest = "file { '#{target}': content => '{md5}13ad7345d56b566a4408ffdcd877bc78' }" - apply_manifest_on(agent, manifest) do |result| - refute_match(/content changed/, result.stdout, "#{agent}: shouldn't have overwrote the file") - end - - test_name "verify that an empty file can be retrieved from the filebucket" - manifest = "file { '#{target}': content => '{sha256}e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', backup => 'puppet' }" - - apply_manifest_on(agent, manifest) do |result| - assert_match(/content changed '\{sha256\}b94f6f125c79e3a5ffaa826f584c10d52ada669e6762051b826b55776d05aed2' to '\{sha256\}e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'/, result.stdout, "#{agent}: shouldn't have overwrote the file") + # Historically, a content value that looked like a checksum + # ('{sha256}...', '{md5}...') triggered implicit filebucket retrieval, + # which made it impossible to manage a file whose literal content looks + # like a checksum, and truncated the target when the bucket could not + # supply the hash (the original #6541). That behavior was removed in + # OpenVox 9 (openvox#170): content is now always literal. + + agents.each do |agent| + target = agent.tmpfile('6541-target') + + step "write initial file content" do + manifest = "file { '#{target}': content => 'some text' }" + apply_manifest_on(agent, manifest) + end + + step "checksum-like content that is not a valid hash is written literally" do + manifest = "file { '#{target}': content => '{sha256}notahash' }" + apply_manifest_on(agent, manifest) + on(agent, "cat #{target}") do |result| + assert_equal('{sha256}notahash', result.stdout, "#{agent}: expected the literal content to be written") + end + end + + step "well-formed checksum content is also written literally, not resolved from a bucket" do + manifest = "file { '#{target}': content => '{sha256}e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', backup => 'puppet' }" + apply_manifest_on(agent, manifest) + on(agent, "cat #{target}") do |result| + assert_equal('{sha256}e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', + result.stdout, + "#{agent}: expected the literal checksum string, not filebucket content") + end + end end end