chef 10.34.6 → 11.0.0.beta.0

data/lib/chef/encrypted_data_bag_item.rb

@@ -20,6 +20,7 @@ require 'base64'
 require 'openssl'
 require 'chef/data_bag_item'
 require 'yaml'
+require 'yajl'
 require 'open-uri'
 
 # An EncryptedDataBagItem represents a read-only data bag item where
@@ -59,6 +60,78 @@ class Chef::EncryptedDataBagItem
   class UnsupportedCipher < StandardError
   end
 
+  # Implementation class for converting plaintext data bag item values to an
+  # encrypted value, including any necessary wrappers and metadata.
+  class Encryptor
+
+    attr_reader :key
+    attr_reader :plaintext_data
+
+    # Create a new Encryptor for +data+, which will be encrypted with the given
+    # +key+.
+    #
+    # === Arguments:
+    # * data: An object of any type that can be serialized to json
+    # * key: A String representing the desired passphrase
+    # * iv: The optional +iv+ parameter is intended for testing use only. When
+    # *not* supplied, Encryptor will use OpenSSL to generate a secure random
+    # IV, which is what you want.
+    def initialize(plaintext_data, key, iv=nil)
+      @plaintext_data = plaintext_data
+      @key = key
+      @iv = iv && Base64.decode64(iv)
+    end
+
+    # Returns a wrapped and encrypted version of +plaintext_data+ suitable for
+    # using as the value in an encrypted data bag item.
+    def for_encrypted_item
+      {
+        "encrypted_data" => encrypted_data,
+        "iv" => Base64.encode64(iv),
+        "version" => 1,
+        "cipher" => ALGORITHM
+      }
+    end
+
+    # Generates or returns the IV.
+    def iv
+      # Generated IV comes from OpenSSL::Cipher::Cipher#random_iv
+      # This gets generated when +openssl_encryptor+ gets created.
+      openssl_encryptor if @iv.nil?
+      @iv
+    end
+
+    # Generates (and memoizes) an OpenSSL::Cipher::Cipher object and configures
+    # it for the specified iv and encryption key.
+    def openssl_encryptor
+      @openssl_encryptor ||= begin
+        encryptor = OpenSSL::Cipher::Cipher.new(ALGORITHM)
+        encryptor.encrypt
+        @iv ||= encryptor.random_iv
+        encryptor.iv = @iv
+        encryptor.key = Digest::SHA256.digest(key)
+        encryptor
+      end
+    end
+
+    # Encrypts and Base64 encodes +serialized_data+
+    def encrypted_data
+      @encrypted_data ||= begin
+        enc_data = openssl_encryptor.update(serialized_data)
+        enc_data << openssl_encryptor.final
+        Base64.encode64(enc_data)
+      end
+    end
+
+    # Wraps the data in a single key Hash (JSON Object) and converts to JSON.
+    # The wrapper is required because we accept values (such as Integers or
+    # Strings) that do not produce valid JSON when serialized without the
+    # wrapper.
+    def serialized_data
+      Yajl::Encoder.encode(:json_wrapper => plaintext_data)
+    end
+  end
+
   #=== Decryptor
   # For backwards compatibility, Chef implements decryption/deserialization for
   # older encrypted data bag item formats in addition to the current version.
@@ -206,14 +279,10 @@ class Chef::EncryptedDataBagItem
     @enc_hash.keys.inject({}) { |hash, key| hash[key] = self[key]; hash }
   end
 
-  def self.from_plain_hash(plain_hash, secret)
-    self.new(self.encrypt_data_bag_item(plain_hash, secret), secret)
-  end
-
   def self.encrypt_data_bag_item(plain_hash, secret)
     plain_hash.inject({}) do |h, (key, val)|
       h[key] = if key != "id"
-                 self.encrypt_value(val, secret)
+                 Encryptor.new(val, secret).for_encrypted_item
                else
                  val
                end
@@ -227,10 +296,6 @@ class Chef::EncryptedDataBagItem
     self.new(raw_hash, secret)
   end
 
-  def self.encrypt_value(value, key)
-    Base64.encode64(self.cipher(:encrypt, value.to_yaml, key))
-  end
-
   def self.load_secret(path=nil)
     path = path || Chef::Config[:encrypted_data_bag_secret] || DEFAULT_SECRET_FILE
     secret = case path
@@ -255,14 +320,4 @@ class Chef::EncryptedDataBagItem
     secret
   end
 
-  protected
-
-  def self.cipher(direction, data, key)
-    cipher = OpenSSL::Cipher::Cipher.new(ALGORITHM)
-    cipher.send(direction)
-    cipher.pkcs5_keyivgen(key)
-    ans = cipher.update(data)
-    ans << cipher.final
-    ans
-  end
 end

data/lib/chef/environment.rb

@@ -22,8 +22,6 @@ require 'chef/config'
 require 'chef/mash'
 require 'chef/mixin/params_validate'
 require 'chef/mixin/from_file'
-require 'chef/couchdb'
-require 'chef/index_queue'
 require 'chef/version_constraint'
 
 class Chef
@@ -33,52 +31,15 @@ class Chef
 
     include Chef::Mixin::ParamsValidate
     include Chef::Mixin::FromFile
-    include Chef::IndexQueue::Indexable
 
     COMBINED_COOKBOOK_CONSTRAINT = /(.+)(?:[\s]+)((?:#{Chef::VersionConstraint::OPS.join('|')})(?:[\s]+).+)$/.freeze
 
-    attr_accessor :couchdb, :couchdb_rev
-    attr_reader :couchdb_id
-
-    DESIGN_DOCUMENT = {
-      "version" => 1,
-      "language" => "javascript",
-      "views" => {
-        "all" => {
-          "map" => <<-EOJS
-          function(doc) {
-            if (doc.chef_type == "environment") {
-              emit(doc.name, doc);
-            }
-          }
-          EOJS
-        },
-        "all_id" => {
-          "map" => <<-EOJS
-          function(doc) {
-            if (doc.chef_type == "environment") {
-              emit(doc.name, doc.name);
-            }
-          }
-          EOJS
-        }
-      }
-    }
-
-    def initialize(couchdb=nil)
+    def initialize
       @name = ''
       @description = ''
       @default_attributes = Mash.new
       @override_attributes = Mash.new
       @cookbook_versions = Hash.new
-      @couchdb_rev = nil
-      @couchdb_id = nil
-      @couchdb = couchdb || Chef::CouchDB.new
-    end
-
-    def couchdb_id=(value)
-      @couchdb_id = value
-      self.index_id = value
     end
 
     def chef_server_rest
@@ -113,6 +74,10 @@ class Chef
       )
     end
 
+    def default_attributes=(attrs)
+      default_attributes(attrs)
+    end
+
     def override_attributes(arg=nil)
       set_or_return(
         :override_attributes,
@@ -121,6 +86,10 @@ class Chef
       )
     end
 
+    def override_attributes=(attrs)
+      override_attributes(attrs)
+    end
+
     def cookbook_versions(arg=nil)
       set_or_return(
         :cookbook_versions,
@@ -155,7 +124,6 @@ class Chef
         "default_attributes" => @default_attributes,
         "override_attributes" => @override_attributes
       }
-      result["_rev"] = couchdb_rev if couchdb_rev
       result
     end
 
@@ -252,17 +220,9 @@ class Chef
       environment.cookbook_versions(o["cookbook_versions"])
       environment.default_attributes(o["default_attributes"])
       environment.override_attributes(o["override_attributes"])
-      environment.couchdb_rev = o["_rev"] if o.has_key?("_rev")
-      environment.couchdb_id = o["_id"] if o.has_key?("_id")
       environment
     end
 
-    def self.cdb_list(inflate=false, couchdb=nil)
-      es = (couchdb || Chef::CouchDB.new).list("environments", inflate)
-      lookup = (inflate ? "value" : "key")
-      es["rows"].collect { |e| e[lookup] }
-    end
-
     def self.list(inflate=false)
       if inflate
         response = Hash.new
@@ -275,34 +235,14 @@ class Chef
       end
     end
 
-    def self.cdb_load(name, couchdb=nil)
-      (couchdb || Chef::CouchDB.new).load("environment", name)
-    end
-
     def self.load(name)
       chef_server_rest.get_rest("environments/#{name}")
     end
 
-    def self.exists?(name, couchdb)
-      begin
-        self.cdb_load(name, couchdb)
-      rescue Chef::Exceptions::CouchDBNotFound
-        nil
-      end
-    end
-
-    def cdb_destroy
-      couchdb.delete("environment", @name, couchdb_rev)
-    end
-
     def destroy
       chef_server_rest.delete_rest("environments/#{@name}")
     end
 
-    def cdb_save
-      self.couchdb_rev = couchdb.store("environment", @name, self)["rev"]
-    end
-
     def save
       begin
         chef_server_rest.put_rest("environments/#{@name}", self)
@@ -318,106 +258,6 @@ class Chef
       self
     end
 
-    # Set up our CouchDB design document
-    def self.create_design_document(couchdb=nil)
-      (couchdb || Chef::CouchDB.new).create_design_document("environments", DESIGN_DOCUMENT)
-    end
-
-    # Loads the set of Chef::CookbookVersion objects available to a given environment
-    # === Returns
-    # Hash
-    # i.e.
-    # {
-    #   "cookbook_name" => [ Chef::CookbookVersion ... ] ## the array of CookbookVersions is sorted highest to lowest
-    # }
-    #
-    # There will be a key for every cookbook.  If no CookbookVersions
-    # are available for the specified environment the value will be an
-    # empty list.
-    #
-    def self.cdb_load_filtered_cookbook_versions(name, couchdb=nil)
-      version_constraints = cdb_load(name, couchdb).cookbook_versions.inject({}) {|res, (k,v)| res[k] = Chef::VersionConstraint.new(v); res}
-
-      # inject all cookbooks into the hash while filtering out restricted versions, then sort the individual arrays
-      cookbook_list = Chef::CookbookVersion.cdb_list(true, couchdb)
-
-      filtered_list = cookbook_list.inject({}) do |res, cookbook|
-        # FIXME: should cookbook.version return a Chef::Version?
-        version               = Chef::Version.new(cookbook.version)
-        requirement_satisfied = version_constraints.has_key?(cookbook.name) ? version_constraints[cookbook.name].include?(version) : true
-        # we want a key for every cookbook, even if no versions are available
-        res[cookbook.name] ||= []
-        res[cookbook.name] << cookbook if requirement_satisfied
-        res
-      end
-
-      sorted_list = filtered_list.inject({}) do |res, (cookbook_name, versions)|
-        res[cookbook_name] = versions.sort.reverse
-        res
-      end
-
-      sorted_list
-    end
-
-    # Like +cdb_load_filtered_cookbook_versions+, loads the set of
-    # cookbooks available in a given environment. The difference is that
-    # this method will load Chef::MinimalCookbookVersion objects that
-    # contain only the information necessary for solving a cookbook
-    # collection for a given run list. The user of this method must call
-    # Chef::MinimalCookbookVersion.load_full_versions_of() after solving
-    # the cookbook collection to get the full objects.
-    # === Returns
-    # Hash
-    # i.e.
-    # {
-    #   "cookbook_name" => [ Chef::CookbookVersion ... ] ## the array of CookbookVersions is sorted highest to lowest
-    # }
-    #
-    # There will be a key for every cookbook.  If no CookbookVersions
-    # are available for the specified environment the value will be an
-    # empty list.
-    def self.cdb_minimal_filtered_versions(name, couchdb=nil)
-      version_constraints = cdb_load(name, couchdb).cookbook_versions.inject({}) {|res, (k,v)| res[k] = Chef::VersionConstraint.new(v); res}
-
-      # inject all cookbooks into the hash while filtering out restricted versions, then sort the individual arrays
-      cookbook_list = Chef::MinimalCookbookVersion.load_all(couchdb)
-
-      filtered_list = cookbook_list.inject({}) do |res, cookbook|
-        # FIXME: should cookbook.version return a Chef::Version?
-        version               = Chef::Version.new(cookbook.version)
-        requirement_satisfied = version_constraints.has_key?(cookbook.name) ? version_constraints[cookbook.name].include?(version) : true
-        # we want a key for every cookbook, even if no versions are available
-        res[cookbook.name] ||= []
-        res[cookbook.name] << cookbook if requirement_satisfied
-        res
-      end
-
-      sorted_list = filtered_list.inject({}) do |res, (cookbook_name, versions)|
-        res[cookbook_name] = versions.sort.reverse
-        res
-      end
-
-      sorted_list
-    end
-
-    def self.cdb_load_filtered_recipe_list(name, couchdb=nil)
-      cdb_load_filtered_cookbook_versions(name, couchdb).map do |cb_name, cb|
-        if cb.empty?            # no available versions
-          []                    # empty list elided with flatten
-        else
-          latest_version = cb.first
-          latest_version.recipe_filenames_by_name.keys.map do |recipe|
-            case recipe
-            when DEFAULT
-              cb_name
-            else
-              "#{cb_name}::#{recipe}"
-            end
-          end
-        end
-      end.flatten
-    end
-
     def self.load_filtered_recipe_list(environment)
       chef_server_rest.get_rest("environments/#{environment}/recipes")
     end
@@ -443,16 +283,5 @@ class Chef
       end
     end
 
-    def self.create_default_environment(couchdb=nil)
-      couchdb = couchdb || Chef::CouchDB.new
-      begin
-        Chef::Environment.cdb_load('_default', couchdb)
-      rescue Chef::Exceptions::CouchDBNotFound
-        env = Chef::Environment.new(couchdb)
-        env.name '_default'
-        env.description 'The default Chef environment'
-        env.cdb_save
-      end
-    end
   end
 end

data/lib/chef/exceptions.rb

@@ -21,6 +21,21 @@ class Chef
   # Chef's custom exceptions are all contained within the Chef::Exceptions
   # namespace.
   class Exceptions
+
+    # Backcompat with Chef::ShellOut code:
+    require 'mixlib/shellout/exceptions'
+
+    def self.const_missing(const_name)
+      if const_name == :ShellCommandFailed
+        Chef::Log.warn("Chef::Exceptions::ShellCommandFailed is deprecated, use Mixlib::ShellOut::ShellCommandFailed")
+        called_from = caller[0..3].inject("Called from:\n") {|msg, trace_line| msg << "  #{trace_line}\n" }
+        Chef::Log.warn(called_from)
+        Mixlib::ShellOut::ShellCommandFailed
+      else
+        super
+      end
+    end
+
     class Application < RuntimeError; end
     class Cron < RuntimeError; end
     class Env < RuntimeError; end
@@ -39,7 +54,6 @@ class Chef
     class Group < RuntimeError; end
     class Link < RuntimeError; end
     class Mount < RuntimeError; end
-    class CouchDBNotFound < RuntimeError; end
     class PrivateKeyMissing < RuntimeError; end
     class CannotWritePrivateKey < RuntimeError; end
     class RoleNotFound < RuntimeError; end
@@ -60,10 +74,8 @@ class Chef
     class RequestedUIDUnavailable < RuntimeError; end
     class InvalidHomeDirectory < ArgumentError; end
     class DsclCommandFailed < RuntimeError; end
-    class PlistUtilCommandFailed < RuntimeError; end
     class UserIDNotFound < ArgumentError; end
     class GroupIDNotFound < ArgumentError; end
-    class ConflictingMembersInGroup < ArgumentError; end
     class InvalidResourceReference < RuntimeError; end
     class ResourceNotFound < RuntimeError; end
     class InvalidResourceSpecification < ArgumentError; end
@@ -82,7 +94,8 @@ class Chef
     # Thrown when Win32 API layer binds to non-existent Win32 function.  Occurs
     # when older versions of Windows don't support newer Win32 API functions.
     class Win32APIFunctionNotImplemented < NotImplementedError; end
-
+    # Attempting to run windows code on a not-windows node
+    class Win32NotWindows < RuntimeError; end
     class ObsoleteDependencySyntax < ArgumentError; end
     class InvalidDataBagPath < ArgumentError; end
 
@@ -99,13 +112,35 @@ class Chef
 
     # File operation attempted but no permissions to perform it
     class InsufficientPermissions < RuntimeError; end
-   
+
     # Ifconfig failed
     class Ifconfig < RuntimeError; end
 
-    # Backcompat with Chef::ShellOut code:
-    require 'mixlib/shellout/exceptions'
-    class ShellCommandFailed < Mixlib::ShellOut::ShellCommandFailed; end
+    # Invalid "source" parameter to a remote_file resource
+    class InvalidRemoteFileURI < ArgumentError; end
+
+    # Node::Attribute computes the merged version of of attributes
+    # and makes it read-only. Attempting to modify a read-only
+    # attribute will cause this error.
+    class ImmutableAttributeModification < NoMethodError; end
+
+    # Merged node attributes are invalidated when the component
+    # attributes are updated. Attempting to read from a stale copy
+    # of merged attributes will trigger this error.
+    class StaleAttributeRead < StandardError; end
+
+    #Registry Helper throws the following errors
+    class Win32RegArchitectureIncorrect < RuntimeError; end
+    class Win32RegHiveMissing < ArgumentError; end
+    class Win32RegKeyMissing < RuntimeError; end
+    class Win32RegValueMissing < RuntimeError; end
+    class Win32RegDataMissing < RuntimeError; end
+    class Win32RegValueExists < RuntimeError; end
+    class Win32RegNoRecursive < ArgumentError; end
+    class Win32RegTypeDoesNotExist < ArgumentError; end
+    class Win32RegBadType < ArgumentError; end
+    class Win32RegBadValueSize < ArgumentError; end
+    class Win32RegTypesMismatch < ArgumentError; end
 
     class MissingRole < RuntimeError
       NULL = Object.new
@@ -128,6 +163,49 @@ class Chef
 
 
     end
+    # Exception class for collecting multiple failures. Used when running
+    # delayed notifications so that chef can process each delayed
+    # notification even if chef client or other notifications fail.
+    class MultipleFailures < StandardError
+      def initialize(*args)
+        super
+        @all_failures = []
+      end
+
+      def message
+        base = "Multiple failures occurred:\n"
+        @all_failures.inject(base) do |message, (location, error)|
+          message << "* #{error.class} occurred in #{location}: #{error.message}\n"
+        end
+      end
+
+      def client_run_failure(exception)
+        set_backtrace(exception.backtrace)
+        @all_failures << [ "chef run", exception ]
+      end
+
+      def notification_failure(exception)
+        @all_failures << [ "delayed notification", exception ]
+      end
+
+      def raise!
+        unless empty?
+          raise self.for_raise
+        end
+      end
+
+      def empty?
+        @all_failures.empty?
+      end
+
+      def for_raise
+        if @all_failures.size == 1
+          @all_failures[0][1]
+        else
+          self
+        end
+      end
+    end
 
     class CookbookVersionSelection
 
@@ -189,13 +267,8 @@ class Chef
           result.to_json(*a)
         end
       end
-    end # CookbookVersionSelection
 
-    # When the server sends a redirect, RFC 2616 states a user-agent should
-    # not follow it with a method other than GET or HEAD, unless a specific
-    # action is taken by the user. A redirect received as response to a
-    # non-GET and non-HEAD request will thus raise an InvalidRedirect.
-    class InvalidRedirect < StandardError; end
+    end # CookbookVersionSelection
 
   end
 end