puppetlabs/puppet-server — pull request #193 by nwolfe (2014-09-25 23:34:56+00:00)
Title: (PE-6012) HTTP client should use :localcacert

When we create the SSL context for Ruby Puppet to use for outgoing
requests, we need to be using the :localcacert instead of the :cacert
because :cacert doesn't necessarily live on the master, and even
then they might be different.

----

I had a bit of a tough time finding a meaningful way to test this change. It seems as if this code is only used by Ruby Puppet when it's making an outgoing request (like to PuppetDB), so I didn't quite know how we could test this with a unit test. It seems like an acceptance test might be ideal?

I also tried to instantiate the SSL context and then use the various getters off it to test that it is using the correct CA certificate, but that information isn't easily accessible (if at all). There's probably a way to call some business methods on the context, but I didn't know if it was going to be worth all the setup.

Either way, this test actually mimics the scenario that the yellow team discovered this bug in, where the :localcacert exists on disk but the :cacert doesn't.