chef-config 18.3.0 → 19.3.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4eb9cf6e54784c6960ec4f0ed42aca3c398067aef6d0cbaac6b15c5cba59c656
-  data.tar.gz: cf37fd7bd622d9d01d05bfdc53d8773a9c7f4b4614e035a0ccf8af04c95b6e3d
+  metadata.gz: 2b694ef61ad31b8917bea150e4327931d313d2e930417744dbb6b6ff4150e571
+  data.tar.gz: b60d0ccd47adfa4e046ffe14d2bd21f5965ea991b0f5bdd426cff0f336cecba1
 SHA512:
-  metadata.gz: f2a005c3e964ffdf3e7e66da38b376b23fe26a0e7d0b19ef231f8740d371d7db3528fe54ebfc7c958793388736d40ca94c08e57497e3b3e96223fd45f51e3458
-  data.tar.gz: ba3a02ad1c923f7c3d5912de6f3b8f6d3bbb70df0ab94c7ff4a79015b0f2b858848689bef5b6948c71adc7f56f594cd3cb82f49fdab3c2997b2b545104265e36
+  metadata.gz: 21d1abd0ac079d9e9b78c1d967a18a95c73bb8f0c03bd161fdba41b655d590dbaec0194bd7d5bd641bcacfc34ca51497c08113e2296902bc9a97c0cd54a79892
+  data.tar.gz: 6e600ea85ccaa3140566b71b4068a81e50290e18140dce57e57a1af1c19fc64d3e68d20c573b04303a91a33388d029af7713d3ed7396918b3db46c13c3f87dbc

data/chef-config.gemspec

@@ -29,7 +29,8 @@ Gem::Specification.new do |spec|
   spec.add_dependency "mixlib-config", ">= 2.2.12", "< 4.0"
   spec.add_dependency "fuzzyurl"
   spec.add_dependency "addressable"
-  spec.add_dependency "tomlrb", "~> 1.2"
+  spec.add_dependency "tomlrb", ">= 1.2", "< 3.0"
+  spec.add_dependency "racc"
 
   spec.files = %w{Rakefile LICENSE} + Dir.glob("*.gemspec") +
     Dir.glob("{lib,spec}/**/*", File::FNM_DOTMATCH).reject { |f| File.directory?(f) }

data/lib/chef-config/config.rb

@@ -4,7 +4,7 @@
 # Author:: AJ Christensen (<aj@chef.io>)
 # Author:: Mark Mzyk (<mmzyk@chef.io>)
 # Author:: Kyle Goodwin (<kgoodwin@primerevenue.com>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -97,8 +97,11 @@ module ChefConfig
     # @return [String] the platform-specific path
     #
     def self.var_chef_dir(windows: ChefUtils.windows?)
-      path = windows ? c_chef_dir : PathHelper.join("/var", ChefUtils::Dist::Infra::DIR_SUFFIX, windows: windows)
-      PathHelper.cleanpath(path, windows: windows)
+      @var_chef_dir ||= {}
+      @var_chef_dir[windows] ||= begin
+        path = windows ? c_chef_dir : PathHelper.join("/var", ChefUtils::Dist::Infra::DIR_SUFFIX, windows: windows)
+        PathHelper.cleanpath(path, windows: windows)
+      end
     end
 
     # On *nix, /var, on Windows C:\
@@ -107,8 +110,11 @@ module ChefConfig
     # @return [String] the platform-specific path
     #
     def self.var_root_dir(windows: ChefUtils.windows?)
-      path = windows ? "C:\\" : "/var"
-      PathHelper.cleanpath(path, windows: windows)
+      @var_root_dir ||= {}
+      @var_root_dir[windows] ||= begin
+        path = windows ? "C:\\" : "/var"
+        PathHelper.cleanpath(path, windows: windows)
+      end
     end
 
     # On windows, C:/chef/
@@ -415,7 +421,14 @@ module ChefConfig
     # If your `file_cache_path` resides on a NFS (or non-flock()-supporting
     # fs), it's recommended to set this to something like
     # '/tmp/chef-client-running.pid'
-    default(:lockfile) { PathHelper.join(file_cache_path, "#{ChefUtils::Dist::Infra::CLIENT}-running.pid") }
+    # In Target Mode, the node name will be used as a prefix to allow
+    # parallel execution of Chef against different targets
+    default(:lockfile) do
+      prefix = ""
+      prefix = "#{ChefConfig::Config.node_name}-" if ChefConfig::Config.target_mode?
+
+      PathHelper.join(file_cache_path, "#{prefix}#{ChefUtils::Dist::Infra::CLIENT}-running.pid")
+    end
 
     ## Daemonization Settings ##
     # What user should Chef run as?
@@ -471,6 +484,14 @@ module ChefConfig
     # toggle info level log items that can create a lot of output
     default :verbose_logging, true
     default :node_name, nil
+
+    # When target mode is active, these hold the operator's original Chef Server
+    # identity so that API auth uses the admin credentials rather than the
+    # target node name.  Set in Chef::Application::Client#reconfigure before
+    # target_mode.enabled is flipped to true.
+    default :api_client_name, nil
+    default :api_client_key, nil
+
     default :diff_disabled,           false
     default :diff_filesize_threshold, 10000000
     default :diff_output_threshold,   1000000
@@ -911,7 +932,11 @@ module ChefConfig
     default :profile, nil
 
     default :chef_guid_path do
-      PathHelper.join(config_dir, "#{ChefUtils::Dist::Infra::SHORT}_guid")
+      if target_mode?
+        PathHelper.join(config_dir, target_mode.host, "#{ChefUtils::Dist::Infra::SHORT}_guid")
+      else
+        PathHelper.join(config_dir, "#{ChefUtils::Dist::Infra::SHORT}_guid")
+      end
     end
 
     default :chef_guid, nil
@@ -1047,16 +1072,6 @@ module ChefConfig
     default :blocked_normal_attributes, nil
     default :blocked_override_attributes, nil
 
-    # deprecated config options that will be removed in Chef Infra Client 18
-    default :automatic_attribute_blacklist, nil
-    default :default_attribute_blacklist, nil
-    default :normal_attribute_blacklist, nil
-    default :override_attribute_blacklist, nil
-    default :automatic_attribute_whitelist, nil
-    default :default_attribute_whitelist, nil
-    default :normal_attribute_whitelist, nil
-    default :override_attribute_whitelist, nil
-
     # Pull down all the rubygems versions from rubygems and cache them the first time we do a gem_package or
     # chef_gem install.  This is memory-expensive and will grow without bounds, but will reduce network
     # round trips.
@@ -1205,7 +1220,7 @@ module ChefConfig
                 end
               end
 
-      return proxy unless fuzzy_hostname_match_any?(host, ENV["no_proxy"])
+      proxy unless fuzzy_hostname_match_any?(host, ENV["no_proxy"])
     end
 
     # Chef requires an English-language UTF-8 locale to function properly.  We attempt
@@ -1299,7 +1314,9 @@ module ChefConfig
     # sure Chef runs do not crash.
     # @api private
     def self.enable_fips_mode
+      # Enable FIPS mode in OpenSSL.
       OpenSSL.fips_mode = true
+
       require "digest" unless defined?(Digest)
       require "digest/sha1" unless defined?(Digest::SHA1)
       require "digest/md5" unless defined?(Digest::MD5)
@@ -1307,8 +1324,6 @@ module ChefConfig
       # amount of log spam and warnings.
       Digest.send(:remove_const, "SHA1") if Digest.const_defined?(:SHA1)
       Digest.const_set(:SHA1, OpenSSL::Digest::SHA1)
-      OpenSSL::Digest.send(:remove_const, "MD5") if OpenSSL::Digest.const_defined?(:MD5)
-      OpenSSL::Digest.const_set(:MD5, Digest::MD5)
       ChefConfig.logger.debug "FIPS mode is enabled."
     end
   end

data/lib/chef-config/exceptions.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -23,5 +23,8 @@ module ChefConfig
   class ConfigurationError < ArgumentError; end
   class InvalidPath < StandardError; end
   class UnparsableConfigOption < StandardError; end
+  class NoCredentialsFound < StandardError; end
 
+  class UnsupportedSecretsProvider < ConfigurationError; end
+  class UnresolvedSecret < ConfigurationError; end
 end

data/lib/chef-config/fips.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Matt Wrock (<matt@mattwrock.com>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef-config/logger.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef-config/mixin/credentials.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -26,6 +26,8 @@ module ChefConfig
     # @since 13.7
     # @api internal
     module Credentials
+      attr_reader :credentials_config
+
       # Compute the active credentials profile name.
       #
       # The lookup order is argument (from --profile), environment variable
@@ -54,6 +56,11 @@ module ChefConfig
       # @since 14.4
       # @return [String]
       def credentials_file_path
+        return Chef::Config[:credentials] if defined?(Chef::Config) && Chef::Config.key?(:credentials)
+
+        env_file = ENV["CHEF_CREDENTIALS_FILE"]
+        return env_file if env_file && File.file?(env_file)
+
         PathHelper.home(ChefUtils::Dist::Infra::USER_CONF_DIR, "credentials").freeze
       end
 
@@ -68,7 +75,7 @@ module ChefConfig
         return nil unless File.file?(credentials_file)
 
         begin
-          Tomlrb.load_file(credentials_file)
+          @credentials_config = Tomlrb.load_file(credentials_file)
         rescue => e
           # TOML's error messages are mostly rubbish, so we'll just give a generic one
           message = "Unable to parse Credentials file: #{credentials_file}\n"
@@ -85,17 +92,129 @@ module ChefConfig
       # @return [void]
       def load_credentials(profile = nil)
         profile = credentials_profile(profile)
-        cred_config = parse_credentials_file
-        return if cred_config.nil? # No credentials, nothing to do here.
 
-        if cred_config[profile].nil?
+        parse_credentials_file
+        return if credentials_config.nil? # No credentials, nothing to do here.
+
+        if credentials_config[profile].nil?
           # Unknown profile name. For "default" just silently ignore, otherwise
           # raise an error.
           return if profile == "default"
 
           raise ChefConfig::ConfigurationError, "Profile #{profile} doesn't exist. Please add it to #{credentials_file_path}."
         end
-        apply_credentials(cred_config[profile], profile)
+
+        resolve_secrets(profile)
+
+        apply_credentials(credentials_config[profile], profile)
+      end
+
+      GLOBAL_CONFIG_HASHES = %w{ default_secrets_provider }.freeze
+
+      # Extract global (non-profile) settings from credentials file.
+      #
+      # @since 19.1
+      # @return [Hash]
+      def global_options
+        globals = credentials_config.filter { |_, v| v.is_a? String }
+        globals.merge! credentials_config.filter { |k, _| GLOBAL_CONFIG_HASHES.include? k }
+      end
+
+      SUPPORTED_SECRETS_PROVIDERS = %w{ hashicorp-vault }.freeze
+
+      # Resolve all secrets in a credentials file
+      #
+      # @since 19.1
+      # @param profile [String] Profile to resolve secrets in.
+      # @return [Hash]
+      def resolve_secrets(profile)
+        return unless credentials_config
+        raise NoCredentialsFound.new("No credentials found for profile '#{profile}'") unless credentials_config[profile]
+
+        secrets = credentials_config[profile].filter { |k, v| v.is_a?(Hash) && v.keys.include?("secret") }
+        return if secrets.empty?
+
+        secrets.each do |option, secrets_config|
+          unless valid_secrets_provider?(secrets_config)
+            raise UnsupportedSecretsProvider.new("Unsupported credentials secrets provider on '#{option}' for profile '#{profile}'")
+          end
+
+          secrets_config.merge!(default_secrets_provider)
+
+          logger.debug("Resolving credentials secret '#{option}' for profile '#{profile}'")
+          begin
+            resolved_value = resolve_secret(secrets_config)
+          ensure
+            raise UnresolvedSecret.new("Could not resolve secret '#{option}' for profile '#{profile}'") if resolved_value.nil?
+          end
+
+          credentials_config[profile][option] = resolved_value
+        end
+      end
+
+      # Check, if referenced secrets provider is supported.
+      #
+      # @since 19.1
+      # @param secrets_config [Hash] Parsed contents of a secret in a profile.
+      # @return [true, false]
+      def valid_secrets_provider?(secrets_config)
+        provider_config = secrets_config["secrets_provider"] || default_secrets_provider
+        provider = provider_config["name"]
+
+        provider && SUPPORTED_SECRETS_PROVIDERS.include?(provider)
+      end
+
+      def default_secrets_provider
+        global_options["default_secrets_provider"]
+      end
+
+      # Resolve a specific secret.
+      #
+      # To be replaced later by a Train-like framework to support multiple backends.
+      #
+      # @since 19.1
+      # @param secrets_config [Hash] Parsed contents of a secret in a profile.
+      # @return [String]
+      def resolve_secret(secrets_config)
+        resolve_secret_hashicorp(secrets_config)
+      end
+
+      # Resolver logic for Hashicorp Vault.
+      #
+      # Local lazy loading of Gems which are not part of chef-config or chef-utils,
+      # but chef itself to be switched by a unified secrets mechanism for credentials
+      # and Chef DSL later. Showstopper mitigation for 19 GA.
+      #
+      # @since 19.1
+      # @param secrets_config [Hash] Parsed contents of a secret in a profile.
+      # @return [String]
+      def resolve_secret_hashicorp(secrets_config)
+        vault_config = secrets_config.transform_keys(&:to_sym)
+        vault_config[:address] = vault_config[:endpoint]
+
+        # Lazy require due to Gem being part of Chef and rarely used functionality
+        require "vault" unless defined? Vault
+        @vault ||= Vault::Client.new(vault_config)
+
+        secret = secrets_config["secret"]
+        engine = vault_config[:engine] || "secret"
+        engine_type = vault_config[:engine_type] || "kv2"
+        secret_value = case engine_type
+                       when "kv", "kv1"
+                         @vault.logical.read("#{engine_type}/#{secret}")
+                       when "kv2"
+                         @vault.kv(engine).read(secret)&.data
+                       else
+                         raise UnsupportedSecretsProvider.new("No support for secrets engine #{engine_type}")
+                       end
+
+        # Always JSON for Hashicorp Vault, but this is future compatible to other providers
+        if secret_value.is_a?(Hash)
+          require "jmespath" unless defined? ::JMESPath
+          ::JMESPath.search(secrets_config["field"], secret_value)
+        else
+          secret_value
+        end
       end
     end
   end

data/lib/chef-config/mixin/dot_d.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef-config/mixin/fuzzy_hostname_matcher.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -42,6 +42,11 @@ module ChefConfig
         # Do greedy matching by adding wildcard if it is not specified
         match = "*" + match unless match.start_with?("*")
         Fuzzyurl.matches?(Fuzzyurl.mask(hostname: match), hostname)
+      rescue ArgumentError
+        # Fuzzyurl cannot parse certain URL formats, notably IPv6 addresses
+        # (bare, bracketed, or embedded in URLs). When parsing fails, the URL
+        # cannot match a no_proxy pattern, so return false.
+        false
       end
 
     end

data/lib/chef-config/mixin/train_transport.rb

@@ -1,5 +1,5 @@
 # Author:: Bryan McLellan <btm@loftninjas.org>
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -36,15 +36,17 @@ module ChefConfig
       #
       def load_credentials(profile)
         # Tomlrb.load_file returns a hash with keys as strings
-        credentials = parse_credentials_file
-        if contains_split_fqdn?(credentials, profile)
+        credentials_config = parse_credentials_file
+        if contains_split_fqdn?(credentials_config, profile)
           logger.warn("Credentials file #{credentials_file_path} contains target '#{profile}' as a Hash, expected a string.")
           logger.warn("Hostnames must be surrounded by single quotes, e.g. ['host.example.org']")
         end
 
+        resolve_secrets(profile)
+
         # host names must be specified in credentials file as ['foo.example.org'] with quotes
-        if !credentials.nil? && !credentials[profile].nil?
-          credentials[profile].transform_keys(&:to_sym) # return symbolized keys to match Train.options()
+        if !credentials_config.nil? && !credentials_config[profile].nil?
+          credentials_config[profile].transform_keys(&:to_sym) # return symbolized keys to match Train.options()
         else
           nil
         end
@@ -59,6 +61,8 @@ module ChefConfig
       # This will be a common mistake so we should catch it
       #
       def contains_split_fqdn?(hash, fqdn)
+        return unless fqdn.include?(".")
+
         fqdn.split(".").reduce(hash) do |h, k|
           v = h[k]
           if Hash === v
@@ -74,21 +78,25 @@ module ChefConfig
       #
       # Credentials file preference:
       #
-      # 1) target_mode.credentials_file
-      # 2) /etc/chef/TARGET_MODE_HOST/credentials
-      # 3) #credentials_file_path from parent ($HOME/.chef/credentials)
+      # 1) environment variable CHEF_CREDENTIALS_FILE
+      # 2) target_mode.credentials_file
+      # 3) /etc/chef/TARGET_MODE_HOST/credentials
+      # 4) user configuration ($HOME/.chef/target_credentials)
       #
       def credentials_file_path
         tm_config = config.target_mode
         profile = tm_config.host
 
+        env_file = ENV["CHEF_CREDENTIALS_FILE"]
         credentials_file =
-          if tm_config.credentials_file && File.exist?(tm_config.credentials_file)
+          if env_file && File.exist?(env_file)
+            env_file
+          elsif tm_config.credentials_file && File.exist?(tm_config.credentials_file)
             tm_config.credentials_file
           elsif File.exist?(config.platform_specific_path("#{ChefConfig::Config.etc_chef_dir}/#{profile}/credentials"))
             config.platform_specific_path("#{ChefConfig::Config.etc_chef_dir}/#{profile}/credentials")
           else
-            super
+            PathHelper.home(ChefUtils::Dist::Infra::USER_CONF_DIR, "target_credentials").freeze
           end
 
         raise ArgumentError, "No credentials file found for target '#{profile}'" unless credentials_file
@@ -112,7 +120,7 @@ module ChefConfig
         # Load the credentials file, and place any valid settings into the train configuration
         credentials = load_credentials(tm_config.host)
 
-        protocol = credentials[:transport_protocol] || tm_config.protocol
+        protocol = credentials&.dig(:transport_protocol) || tm_config.protocol
         train_config = tm_config.to_hash.select { |k| Train.options(protocol).key?(k) }
         logger.trace("Using target mode options from #{ChefUtils::Dist::Infra::PRODUCT} config file: #{train_config.keys.join(", ")}") if train_config
 

data/lib/chef-config/path_helper.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Bryan McLellan <btm@loftninjas.org>
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -57,13 +57,16 @@ module ChefConfig
 
     def self.join(*args, windows: ChefUtils.windows?)
       path_separator_regex = Regexp.escape(windows ? "#{File::SEPARATOR}#{BACKSLASH}" : File::SEPARATOR)
-      trailing_slashes_regex = /[#{path_separator_regex}]+$/.freeze
-      leading_slashes_regex = /^[#{path_separator_regex}]+/.freeze
+      trailing_slashes_regex = /[#{path_separator_regex}]+$/
+      leading_slashes_regex = /^[#{path_separator_regex}]+/
+      separator = path_separator(windows: windows)
 
-      args.flatten.inject do |joined_path, component|
+      args.flatten!
+      args.inject do |joined_path, component|
         joined_path = joined_path.sub(trailing_slashes_regex, "")
         component = component.sub(leading_slashes_regex, "")
-        joined_path + "#{path_separator(windows: windows)}#{component}"
+        joined_path << "#{separator}#{component}"
+        joined_path
       end
     end
 
@@ -149,11 +152,12 @@ module ChefConfig
       path = Pathname.new(path).cleanpath.to_s
       if windows
         # ensure all forward slashes are backslashes
-        path.gsub(File::SEPARATOR, path_separator(windows: windows))
+        path.gsub!(File::SEPARATOR, path_separator(windows: windows))
       else
         # ensure all backslashes are forward slashes
-        path.gsub(BACKSLASH, File::SEPARATOR)
+        path.gsub!(BACKSLASH, File::SEPARATOR)
       end
+      path
     end
 
     # This is not just escaping for something like use in Regexps, or in globs.  For the former
@@ -248,7 +252,7 @@ module ChefConfig
       paths << ENV[@@per_tool_home_environment] if defined?(@@per_tool_home_environment) && @@per_tool_home_environment && ENV[@@per_tool_home_environment]
       paths << ENV["CHEF_HOME"] if ENV["CHEF_HOME"]
       if windows
-        # By default, Ruby uses the the following environment variables to determine Dir.home:
+        # By default, Ruby uses the following environment variables to determine Dir.home:
         # HOME
         # HOMEDRIVE HOMEPATH
         # USERPROFILE

data/lib/chef-config/version.rb

@@ -1,4 +1,4 @@
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,5 +15,5 @@
 
 module ChefConfig
   CHEFCONFIG_ROOT = File.expand_path("..", __dir__)
-  VERSION = "18.3.0".freeze
+  VERSION = "19.3.15".freeze
 end

data/lib/chef-config/windows.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef-config/workstation_config_loader.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef-config.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/spec/unit/config_spec.rb

@@ -1,7 +1,7 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
 # Author:: Kyle Goodwin (<kgoodwin@primerevenue.com>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -22,8 +22,13 @@ require "chef-config/config"
 require "date" unless defined?(Date)
 
 RSpec.describe ChefConfig::Config do
+  let(:target_mode_host) { "fluffy.kittens.org".freeze }
+
   before(:each) do
     ChefConfig::Config.reset
+    ChefConfig::Config.instance_variable_set(:@var_chef_dir, nil)
+    ChefConfig::Config.instance_variable_set(:@etc_chef_dir, nil)
+    ChefConfig::Config.instance_variable_set(:@var_root_dir, nil)
 
     # By default, treat deprecation warnings as errors in tests.
     ChefConfig::Config.treat_deprecation_warnings_as_errors(true)
@@ -243,16 +248,18 @@ RSpec.describe ChefConfig::Config do
     end
 
     context "on windows", :windows_only do
-      it "var_chef_dir is C:\\chef" do
-        expect(ChefConfig::Config.var_chef_dir).to eql("C:\\#{dirname}")
+      let(:windows_drive) { ChefConfig::Config.windows_installation_drive || "C:" }
+
+      it "var_chef_dir is on the windows installation drive" do
+        expect(ChefConfig::Config.var_chef_dir).to eql("#{windows_drive}\\#{dirname}")
       end
 
       it "var_root_dir is C:\\" do
         expect(ChefConfig::Config.var_root_dir).to eql("C:\\")
       end
 
-      it "etc_chef_dir is C:\\chef" do
-        expect(ChefConfig::Config.etc_chef_dir).to eql("C:\\#{dirname}")
+      it "etc_chef_dir is on the windows installation drive" do
+        expect(ChefConfig::Config.etc_chef_dir).to eql("#{windows_drive}\\#{dirname}")
       end
     end
 
@@ -271,16 +278,18 @@ RSpec.describe ChefConfig::Config do
     end
 
     context "when forced to windows" do
-      it "var_chef_dir is C:\\chef" do
-        expect(ChefConfig::Config.var_chef_dir(windows: true)).to eql("C:\\#{dirname}")
+      let(:windows_drive) { ChefConfig::Config.windows_installation_drive || "C:" }
+
+      it "var_chef_dir is on the windows installation drive" do
+        expect(ChefConfig::Config.var_chef_dir(windows: true)).to eql("#{windows_drive}\\#{dirname}")
       end
 
       it "var_root_dir is C:\\" do
         expect(ChefConfig::Config.var_root_dir(windows: true)).to eql("C:\\")
       end
 
-      it "etc_chef_dir is C:\\chef" do
-        expect(ChefConfig::Config.etc_chef_dir(windows: true)).to eql("C:\\#{dirname}")
+      it "etc_chef_dir is on the windows installation drive" do
+        expect(ChefConfig::Config.etc_chef_dir(windows: true)).to eql("#{windows_drive}\\#{dirname}")
       end
     end
 
@@ -379,8 +388,6 @@ RSpec.describe ChefConfig::Config do
           end
 
           context "when target mode is enabled" do
-            let(:target_mode_host) { "fluffy.kittens.org" }
-
             before do
               ChefConfig::Config.target_mode.enabled = true
               ChefConfig::Config.target_mode.host = target_mode_host
@@ -400,6 +407,25 @@ RSpec.describe ChefConfig::Config do
           end
         end
 
+        describe "ChefConfig::Config[:chef_guid_path]" do
+          it "sets the default path to the chef guid" do
+            expected_path = ChefConfig::PathHelper.join(ChefConfig::Config.config_dir, "chef_guid")
+            expect(ChefConfig::Config.chef_guid_path).to eq(expected_path)
+          end
+
+          context "when target mode is enabled" do
+            before do
+              ChefConfig::Config.target_mode.enabled = true
+              ChefConfig::Config.target_mode.host = target_mode_host
+            end
+
+            it "sets the default path to the chef guid with the target host name" do
+              expected_path = ChefConfig::PathHelper.join(ChefConfig::Config.config_dir, target_mode_host, "chef_guid")
+              expect(ChefConfig::Config.chef_guid_path).to eq(expected_path)
+            end
+          end
+        end
+
         describe "ChefConfig::Config[:fips]" do
           let(:fips_enabled) { false }
 
@@ -495,7 +521,6 @@ RSpec.describe ChefConfig::Config do
         end
 
         describe "ChefConfig::Config[:cache_path]" do
-          let(:target_mode_host) { "fluffy.kittens.org" }
           let(:target_mode_primary_cache_path) { ChefUtils.windows? ? "#{primary_cache_path}\\#{target_mode_host}" : "#{primary_cache_path}/#{target_mode_host}" }
           let(:target_mode_secondary_cache_path) { ChefUtils.windows? ? "#{secondary_cache_path}\\#{target_mode_host}" : "#{secondary_cache_path}/#{target_mode_host}" }
 
@@ -710,9 +735,9 @@ RSpec.describe ChefConfig::Config do
 
         end
 
-        # On Windows, we'll detect an omnibus build and set this to the
+        # On Windows, we'll detect embedded install and set this to the
         # cacert.pem included in the package, but it's nil if you're on Windows
-        # w/o omnibus (e.g., doing development on Windows, custom build, etc.)
+        # w/o embedded install (e.g., doing development on Windows, custom build, etc.)
         unless is_windows
           it "ChefConfig::Config[:ssl_ca_file] defaults to nil" do
             expect(ChefConfig::Config[:ssl_ca_file]).to be_nil
@@ -842,7 +867,7 @@ RSpec.describe ChefConfig::Config do
           describe "finding the windows embedded dir" do
             let(:default_config_location) { "c:/opscode/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.6.0/lib/chef/config.rb" }
             let(:alternate_install_location) { "c:/my/alternate/install/place/chef/embedded/lib/ruby/gems/1.9.1/gems/chef-11.6.0/lib/chef/config.rb" }
-            let(:non_omnibus_location) { "c:/my/dev/stuff/lib/ruby/gems/1.9.1/gems/chef-11.6.0/lib/chef/config.rb" }
+            let(:non_package_location) { "c:/my/dev/stuff/lib/ruby/gems/1.9.1/gems/chef-11.6.0/lib/chef/config.rb" }
 
             let(:default_ca_file) { "c:/opscode/chef/embedded/ssl/certs/cacert.pem" }
 
@@ -856,8 +881,8 @@ RSpec.describe ChefConfig::Config do
               expect(ChefConfig::Config.embedded_dir).to eq("c:/my/alternate/install/place/chef/embedded")
             end
 
-            it "doesn't error when not in an omnibus install" do
-              allow(ChefConfig::Config).to receive(:_this_file).and_return(non_omnibus_location)
+            it "doesn't error when not in an package install" do
+              allow(ChefConfig::Config).to receive(:_this_file).and_return(non_package_location)
               expect(ChefConfig::Config.embedded_dir).to be_nil
             end
 

data/spec/unit/credentials_spec.rb

@@ -0,0 +1,181 @@
+#
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+require "chef-config/config"
+require "chef-config/mixin/credentials"
+
+module Vault
+  class Client; end
+end
+
+RSpec.describe ChefConfig::Mixin::Credentials do
+
+  let(:test_class) { Class.new { include ChefConfig::Mixin::Credentials } }
+  subject(:test_obj) { test_class.new }
+
+  describe "#credentials_profile" do
+    context "when an explicit profile is given" do
+      it "passes it through" do
+        expect(test_obj.credentials_profile("webserver")).to eq("webserver")
+      end
+    end
+
+    context "when an environment variable is set" do
+      before(:all) do
+        @original_env = ENV.to_hash
+      end
+
+      after(:all) do
+        ENV.clear
+        ENV.update(@original_env)
+      end
+
+      before(:each) do
+        ENV["CHEF_PROFILE"] = "acme-server"
+      end
+
+      it "picks the profile correctly" do
+        expect(test_obj.credentials_profile).to eq("acme-server")
+      end
+    end
+
+    context "when no profile is given" do
+      it "picks the default one" do
+        expect(test_obj.credentials_profile).to eq("default")
+      end
+    end
+  end
+
+  describe "#resolve_secrets" do
+    context "when no credentials were loaded" do
+      it "returns" do
+        allow(test_obj).to receive(:credentials_config).and_return(nil)
+        expect(test_obj.resolve_secrets("dummy")).to eq(nil)
+      end
+    end
+
+    context "when credentials do not contain specified profile" do
+      it "raises an error" do
+        allow(test_obj).to receive(:credentials_config).and_return({ "webserver" => {} })
+        expect { test_obj.resolve_secrets("dummy") }.to raise_error(ChefConfig::NoCredentialsFound, /No credentials found for profile/)
+      end
+    end
+
+    context "when no secrets were referenced in profile" do
+      it "returns" do
+        allow(test_obj).to receive(:credentials_config).and_return({ "webserver2" => {} })
+        expect(test_obj.resolve_secrets("webserver2")).to eq(nil)
+      end
+    end
+  end
+
+  describe "#valid_secrets_provider?" do
+    context "when global, valid configuration was provided" do
+      let(:global_options) { { "default_secrets_provider" => { "name" => "hashicorp-vault", "endpoint" => "https://198.51.100.5:8200", "token" => "hvs.1234567890" } } }
+      let(:secrets_config) { { "secret" => "/chef/sudo_password", "field" => "password" } }
+
+      it "returns true" do
+        allow(test_obj).to receive(:global_options).and_return(global_options)
+        expect(test_obj.valid_secrets_provider?(secrets_config)).to be(true)
+      end
+    end
+
+    context "when global, invalid configuration was provided" do
+      let(:global_options) { { "default_secrets_provider" => { "name" => "hashicorp-consul" } } }
+      let(:secrets_config) { { "secret" => "/chef/sudo_password", "field" => "password" } }
+
+      it "returns false" do
+        allow(test_obj).to receive(:global_options).and_return(global_options)
+        expect(test_obj.valid_secrets_provider?(secrets_config)).to be(false)
+      end
+    end
+
+    context "when global, invalid configuration is overridden with a correct value" do
+      let(:global_options) { { "default_secrets_provider" => { "name" => "hashicorp-consul" } } }
+      let(:secrets_config) { { "secrets_provider" => { "name" => "hashicorp-vault" }, "secret" => "/chef/sudo_password", "field" => "password" } }
+
+      it "returns false" do
+        allow(test_obj).to receive(:global_options).and_return(global_options)
+        expect(test_obj.valid_secrets_provider?(secrets_config)).to be(true)
+      end
+    end
+  end
+
+  describe "#resolve_secret" do
+    before do
+      allow(test_obj).to receive(:global_options).and_return(global_options)
+
+      # Simulate "vault" gem
+      allow(test_obj).to receive(:require).with("vault")
+      vault_double = double("Vault::Client")
+      allow(vault_double).to receive_message_chain("logical.read") { secrets_result }
+      allow(vault_double).to receive_message_chain("kv.read.data") { secrets_result }
+      test_obj.instance_variable_set(:@vault, vault_double)
+
+      # Simulate "jmespath" gem
+      allow(test_obj).to receive(:require).with("jmespath")
+      jmespath_double = double("JMESPath")
+      allow(jmespath_double).to receive_message_chain("search") { search_for = secrets_config["field"]; secrets_result[search_for] }
+      stub_const("::JMESPath", jmespath_double)
+    end
+
+    context "without default secrets provider being set" do
+      let(:global_options) {}
+
+      context "for a secret of type string" do
+        let(:secrets_result) { "secret" }
+        let(:secrets_config) { { "secrets_provider" => { "name" => "hashicorp-vault" }, "secret" => "/chef/sudo_password" } }
+
+        it "returns the complete value" do
+          expect(test_obj.resolve_secret(secrets_config)).to eq("secret")
+        end
+      end
+
+      context "for a secret of type hash" do
+        let(:secrets_result) { { "password" => "secret" } }
+        let(:secrets_config) { { "secrets_provider" => { "name" => "hashicorp-vault", "endpoint" => "https://198.51.100.5:8200", "token" => "hvs.1234567890" }, "secret" => "/chef/sudo_password", "field" => "password" } }
+
+        it "returns the correct subkey" do
+          expect(test_obj.resolve_secret(secrets_config)).to eq("secret")
+        end
+      end
+    end
+
+    context "with default secrets provider being set" do
+      let(:global_options) { { "default_secrets_provider" => { "name" => "hashicorp-vault", "endpoint" => "https://198.51.100.5:8200", "token" => "hvs.1234567890" } } }
+
+      context "for a secret of type string" do
+        let(:secrets_result) { "secret" }
+        let(:secrets_config) { { "secret" => "/chef/sudo_password" } }
+
+        it "returns the complete value" do
+          expect(test_obj.resolve_secret(secrets_config)).to eq("secret")
+        end
+      end
+
+      context "for a secret of type hash" do
+        let(:secrets_result) { { "password" => "secret" } }
+        let(:secrets_config) { { "secret" => "/chef/sudo_password", "field" => "password" } }
+
+        it "returns the correct subkey" do
+          expect(test_obj.resolve_secret(secrets_config)).to eq("secret")
+        end
+      end
+    end
+  end
+end

data/spec/unit/fips_spec.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Matt Wrock (<matt@mattwrock.com>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/spec/unit/fuzzy_hostname_matcher_spec.rb

@@ -0,0 +1,70 @@
+#
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require "spec_helper"
+require "chef-config/mixin/fuzzy_hostname_matcher"
+
+RSpec.describe ChefConfig::Mixin::FuzzyHostnameMatcher do
+  let(:matcher) do
+    Class.new { include ChefConfig::Mixin::FuzzyHostnameMatcher }.new
+  end
+
+  describe "#fuzzy_hostname_match?" do
+    it "matches a hostname with a wildcard pattern" do
+      expect(matcher.fuzzy_hostname_match?("foo.example.com", "example.com")).to be true
+    end
+
+    it "does not match unrelated hostnames" do
+      expect(matcher.fuzzy_hostname_match?("foo.example.com", "other.com")).to be false
+    end
+
+    it "returns false for bare IPv6 addresses instead of raising" do
+      expect(matcher.fuzzy_hostname_match?("2001:db8::1", "example.com")).to be false
+    end
+
+    it "returns false for bracketed IPv6 addresses instead of raising" do
+      expect(matcher.fuzzy_hostname_match?("[2001:db8::1]", "example.com")).to be false
+    end
+
+    it "returns false for IPv6 URLs instead of raising" do
+      expect(matcher.fuzzy_hostname_match?("https://[2001:db8::1]/path", "example.com")).to be false
+    end
+  end
+
+  describe "#fuzzy_hostname_match_any?" do
+    it "returns false when hostname is nil" do
+      expect(matcher.fuzzy_hostname_match_any?(nil, "example.com")).to be false
+    end
+
+    it "returns false when matches is nil" do
+      expect(matcher.fuzzy_hostname_match_any?("foo.example.com", nil)).to be false
+    end
+
+    it "matches against comma-separated patterns" do
+      expect(matcher.fuzzy_hostname_match_any?("foo.example.com", "other.com, example.com")).to be true
+    end
+
+    it "returns false for IPv6 URLs with hostname no_proxy patterns" do
+      ipv6_url = "https://[2001:db8:abcd:ef01::1]/organizations/o3"
+      no_proxy = "gateway.example.net,internal.example.com"
+      expect(matcher.fuzzy_hostname_match_any?(ipv6_url, no_proxy)).to be false
+    end
+
+    it "returns false for bare IPv6 with hostname no_proxy patterns" do
+      expect(matcher.fuzzy_hostname_match_any?("2001:db8::1", "example.com,other.net")).to be false
+    end
+  end
+end

data/spec/unit/path_helper_spec.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Bryan McLellan <btm@loftninjas.org>
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/spec/unit/workstation_config_loader_spec.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -480,11 +480,10 @@ RSpec.describe ChefConfig::WorkstationConfigLoader do
             node_name = 'barney'
             client_key = "barney_rubble.pem"
             chef_server_url = "https://api.chef.io/organizations/bedrock"
-            knife = {
-              secret_file = "/home/barney/.chef/encrypted_data_bag_secret.pem"
-            }
+
             [default.knife]
             ssh_user = "knife_ssh_user"
+            secret_file = "/home/barney/.chef/encrypted_data_bag_secret.pem"
           EOH
           content
         end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: chef-config
 version: !ruby/object:Gem::Version
-  version: 18.3.0
+  version: 19.3.15
 platform: ruby
 authors:
 - Adam Jacob
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-utils
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 18.3.0
+        version: 19.3.15
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 18.3.0
+        version: 19.3.15
 - !ruby/object:Gem::Dependency
   name: mixlib-shellout
   requirement: !ruby/object:Gem::Requirement
@@ -96,17 +95,36 @@ dependencies:
   name: tomlrb
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.2'
-description: 
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: racc
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 email:
 - adam@chef.io
 executables: []
@@ -131,7 +149,9 @@ files:
 - lib/chef-config/workstation_config_loader.rb
 - spec/spec_helper.rb
 - spec/unit/config_spec.rb
+- spec/unit/credentials_spec.rb
 - spec/unit/fips_spec.rb
+- spec/unit/fuzzy_hostname_matcher_spec.rb
 - spec/unit/path_helper_spec.rb
 - spec/unit/workstation_config_loader_spec.rb
 homepage: https://github.com/chef/chef
@@ -143,7 +163,6 @@ metadata:
   documentation_uri: https://github.com/chef/chef/tree/main/chef-config/README.md
   homepage_uri: https://github.com/chef/chef/tree/main/chef-config
   source_code_uri: https://github.com/chef/chef/tree/main/chef-config
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -158,8 +177,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Chef Infra's default configuration and config loading library
 test_files: []