chef 11.4.4 → 11.6.0.hotfix.1

data/lib/chef/file_content_management/deploy/mv_unix.rb

@@ -0,0 +1,77 @@
+#
+# Author:: Lamont Granquist (<lamont@opscode.com>)
+# Copyright:: Copyright (c) 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+class Chef
+  class FileContentManagement
+    class Deploy
+      #
+      # PURPOSE: this strategy is atomic, and attempts to preserve file modes
+      #
+      # NOTE: there is no preserve flag to FileUtils.mv, and we want to preserve the dst file
+      #       modes rather than the src file modes (preserve = true is what mv does already, we
+      #       would like preserve = false which is tricky).
+      #
+      class MvUnix
+        def create(file)
+          # this is very simple, but it ensures that ownership and file modes take
+          # good defaults, in particular mode needs to obey umask on create
+          Chef::Log.debug("touching #{file} to create it")
+          FileUtils.touch(file)
+        end
+
+        def deploy(src, dst)
+          # we are only responsible for content so restore the dst files perms
+          Chef::Log.debug("reading modes from #{dst} file")
+          stat = ::File.stat(dst)
+          mode = stat.mode & 07777
+          uid  = stat.uid
+          gid  = stat.gid
+
+          Chef::Log.debug("applying mode = #{mode.to_s(8)}, uid = #{uid}, gid = #{gid} to #{src}")
+
+          # i own the inode, so should be able to at least chmod it
+          ::File.chmod(mode, src)
+
+          # we may be running as non-root in which case because we are doing an mv we cannot preserve
+          # the file modes.  after the mv we have a different inode and if we don't have rights to
+          # chown/chgrp on the inode then we can't fix the ownership.
+          #
+          # in the case where i'm running chef-solo on my homedir as myself and some root-shell
+          # work has caused dotfiles of mine to change to root-owned, i'm fine with this not being
+          # exceptional, and i think most use cases will consider this to not be exceptional, and
+          # the right thing is to fix the ownership of the file to the user running the commmand
+          # (which requires write perms to the directory, or mv will throw an exception)
+          begin
+            ::File.chown(uid, nil, src)
+          rescue Errno::EPERM
+            Chef::Log.warn("Could not set uid = #{uid} on #{src}, file modes not preserved")
+          end
+          begin
+            ::File.chown(nil, gid, src)
+          rescue Errno::EPERM
+            Chef::Log.warn("Could not set gid = #{gid} on #{src}, file modes not preserved")
+          end
+
+          Chef::Log.debug("moving temporary file #{src} into place at #{dst}")
+          FileUtils.mv(src, dst)
+        end
+      end
+    end
+  end
+end
+

data/lib/chef/file_content_management/deploy/mv_windows.rb

@@ -0,0 +1,95 @@
+#
+# Author:: Lamont Granquist (<lamont@opscode.com>)
+# Copyright:: Copyright (c) 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# We update the contents of the file, using mv for atomicity, while maintaining all the
+# ACL information on the dst file.
+#
+
+require 'chef/platform/query_helpers'
+if Chef::Platform.windows?
+  require 'chef/win32/security'
+end
+
+class Chef
+  class FileContentManagement
+    class Deploy
+      class MvWindows
+
+        Security = Chef::ReservedNames::Win32::Security
+        ACL = Security::ACL
+
+        def create(file)
+          Chef::Log.debug("touching #{file} to create it")
+          FileUtils.touch(file)
+        end
+
+        def deploy(src, dst)
+          #
+          # At the time of deploy ACLs are correctly configured on the
+          # dst. This would be a simple atomic move operations in
+          # windows was not converting inherited ACLs of src to
+          # non-inherited ACLs in certain cases.See:
+          # http://blogs.msdn.com/b/oldnewthing/archive/2006/08/24/717181.aspx
+          #
+
+          #
+          # First cache the ACLs of dst file
+          #
+
+          dst_so = Security::SecurableObject.new(dst)
+          begin
+            # get the sd with the SACL
+            dst_sd = dst_so.security_descriptor(true)
+          rescue Chef::Exceptions::Win32APIError
+            # Catch and raise if the user is not elevated enough.
+            # At this point we can't configure the file as expected so
+            # we're failing action on the resource.
+            raise Chef::Exceptions::WindowsNotAdmin, "can not get the security information for '#{dst}' due to missing Administrator privilages."
+          end
+
+          if dst_sd.dacl_present?
+            apply_dacl = ACL.create(dst_sd.dacl.select { |ace| !ace.inherited? })
+          end
+
+          if dst_sd.sacl_present?
+            apply_sacl = ACL.create(dst_sd.sacl.select { |ace| !ace.inherited? })
+          end
+
+          #
+          # Then deploy the file
+          #
+
+          FileUtils.mv(src, dst)
+
+          #
+          # Then apply the cached acls to the new dst file
+          #
+
+          dst_so = Security::SecurableObject.new(dst)
+          dst_so.group = dst_sd.group
+          dst_so.owner = dst_sd.owner
+          dst_so.set_dacl(apply_dacl, dst_sd.dacl_inherits?) if dst_sd.dacl_present?
+          dst_so.set_sacl(apply_sacl, dst_sd.sacl_inherits?) if dst_sd.sacl_present?
+
+        end
+      end
+    end
+  end
+end
+

data/lib/chef/file_content_management/tempfile.rb

@@ -0,0 +1,61 @@
+#
+# Author:: Lamont Granquist (<lamont@opscode.com>)
+# Copyright:: Copyright (c) 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "tempfile"
+
+class Chef
+  class FileContentManagement
+    class Tempfile
+
+      attr_reader :new_resource
+
+      def initialize(new_resource)
+        @new_resource = new_resource
+      end
+
+      def tempfile
+        @tempfile ||= tempfile_open
+      end
+
+      private
+
+      def tempfile_open
+        tf = ::Tempfile.open(tempfile_basename, tempfile_dirname)
+        # We always process the tempfile in binmode so that we
+        # preserve the line endings of the content.
+        tf.binmode
+        tf
+      end
+
+      #
+      # These are important for windows to get permissions right, and may
+      # be useful for SELinux and other ACL approaches.  Please use them
+      # as the arguments to Tempfile.new() consistently.
+      #
+      def tempfile_basename
+        basename = ::File.basename(@new_resource.name)
+        basename.insert 0, "." unless Chef::Platform.windows?  # dotfile if we're not on windows
+        basename
+      end
+
+      def tempfile_dirname
+        Chef::Config[:file_staging_uses_destdir] ? ::File.dirname(@new_resource.path) : Dir::tmpdir
+      end
+    end
+  end
+end

data/lib/chef/formatters/doc.rb

@@ -162,7 +162,7 @@ class Chef
       # Called when a resource action has been skipped b/c of a conditional
       def resource_skipped(resource, action, conditional)
         # TODO: more info about conditional
-        puts " (skipped due to #{conditional.positivity})"
+        puts " (skipped due to #{conditional.short_description})"
       end
 
       # Called after #load_current_resource has run.

data/lib/chef/formatters/error_descriptor.rb

@@ -31,7 +31,7 @@ class Chef
       end
 
       def section(heading, text)
-        @sections << [heading, text]
+        @sections << {heading => text}
       end
 
       def display(out)
@@ -40,7 +40,9 @@ class Chef
         out.puts "=" * 80
         out.puts "\n"
         sections.each do |section|
-          display_section(section, out)
+          section.each do |heading, text|
+            display_section(heading, text, out)
+          end
         end
       end
 
@@ -53,8 +55,7 @@ class Chef
 
       private
 
-      def display_section(section, out)
-        heading, text = section
+      def display_section(heading, text, out)
         out.puts heading
         out.puts "-" * heading.size
         out.puts text

data/lib/chef/formatters/error_inspectors/cookbook_resolve_error_inspector.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -80,6 +80,9 @@ E
         def describe_412_error(error_description)
           explanation = ""
           error_reasons = extract_412_error_message
+
+          # Prepare the error message if there is detailed information
+          # about individual cookbooks.
           if !error_reasons.respond_to?(:key?)
             explanation << error_reasons.to_s
           else
@@ -99,7 +102,24 @@ E
             end
           end
 
-          error_description.section("Missing Cookbooks:", explanation)
+          if !explanation.empty?
+            error_description.section("Missing Cookbooks:", explanation)
+          else
+            # If we don't have any cookbook details print a more
+            # generic error message.
+            if error_reasons.respond_to?(:key?) && error_reasons["message"]
+              explanation << "Error message: #{error_reasons["message"]}\n"
+            end
+
+            explanation << <<EOM
+You might be able to resolve this issue with:
+  1-) Removing cookbook versions that depend on deleted cookbooks.
+  2-) Removing unused cookbook versions.
+  3-) Pinning exact cookbook versions using environments.
+EOM
+            error_description.section("Cookbook dependency resolution error:", explanation)
+          end
+
           error_description.section("Expanded Run List:", expanded_run_list_ul)
         end
 

data/lib/chef/formatters/error_inspectors/registration_error_inspector.rb

@@ -40,6 +40,10 @@ readable by chef-client.
 E
             error_description.section("Relevant Config Settings:",<<-E)
 validation_key "#{api_key}"
+E
+          when Chef::Exceptions::InvalidRedirect
+            error_description.section("Invalid Redirect:",<<-E)
+Change your server location in client.rb to the server's FQDN to avoid unwanted redirections.
 E
           else
             "#{exception.class.name}: #{exception.message}"

data/lib/chef/json_compat.rb

@@ -27,6 +27,7 @@ class Chef
     JSON_CLASS = "json_class".freeze
 
     CHEF_APICLIENT          = "Chef::ApiClient".freeze
+    CHEF_CHECKSUM           = "Chef::Checksum".freeze
     CHEF_COOKBOOKVERSION    = "Chef::CookbookVersion".freeze
     CHEF_DATABAG            = "Chef::DataBag".freeze
     CHEF_DATABAGITEM        = "Chef::DataBagItem".freeze
@@ -114,6 +115,8 @@ class Chef
         case json_class
         when CHEF_APICLIENT
           Chef::ApiClient
+        when CHEF_CHECKSUM
+          Chef::Checksum
         when CHEF_COOKBOOKVERSION
           Chef::CookbookVersion
         when CHEF_DATABAG

data/lib/chef/knife.rb

@@ -150,7 +150,7 @@ class Chef
       commands_to_show.sort.each do |category, commands|
         next if category =~ /deprecated/i
         msg "** #{category.upcase} COMMANDS **"
-        commands.each do |command|
+        commands.sort.each do |command|
           msg subcommands[command].banner if subcommands[command]
         end
         msg
@@ -201,12 +201,18 @@ class Chef
       subcommand_class || subcommand_not_found!(args)
     end
 
+    def self.dependency_loaders
+      @dependency_loaders ||= []
+    end
+
     def self.deps(&block)
-      @dependency_loader = block
+      dependency_loaders << block
     end
 
     def self.load_deps
-      @dependency_loader && @dependency_loader.call
+      dependency_loaders.each do |dep_loader|
+        dep_loader.call
+      end
     end
 
     private
@@ -481,6 +487,9 @@ class Chef
       when Chef::Exceptions::PrivateKeyMissing
         ui.error "Your private key could not be loaded from #{api_key}"
         ui.info  "Check your configuration file and ensure that your private key is readable"
+      when Chef::Exceptions::InvalidRedirect
+        ui.error "Invalid Redirect: #{e.message}"
+        ui.info  "Change your server location in knife.rb to the server's FQDN to avoid unwanted redirections."
       else
         ui.error "#{e.class.name}: #{e.message}"
       end

data/lib/chef/knife/bootstrap.rb

@@ -59,6 +59,12 @@ class Chef
         :description => "The ssh gateway",
         :proc => Proc.new { |key| Chef::Config[:knife][:ssh_gateway] = key }
 
+      option :forward_agent,
+        :short => "-A",
+        :long => "--forward-agent",
+        :description => "Enable SSH agent forwarding",
+        :boolean => true
+
       option :identity_file,
         :short => "-i IDENTITY_FILE",
         :long => "--identity-file IDENTITY_FILE",
@@ -94,6 +100,11 @@ class Chef
         :description => "Execute the bootstrap via sudo",
         :boolean => true
 
+      option :use_sudo_password,
+        :long => "--use-sudo-password",
+        :description => "Execute the bootstrap via sudo with password",
+        :boolean => false
+
       option :template_file,
         :long => "--template-file TEMPLATE",
         :description => "Full path to location of template to use",
@@ -127,6 +138,15 @@ class Chef
           name, path = h.split("=")
           Chef::Config[:knife][:hints][name] = path ? JSON.parse(::File.read(path)) : Hash.new  }
 
+      option :secret,
+        :short => "-s SECRET",
+        :long  => "--secret ",
+        :description => "The secret key to use to encrypt data bag item values"
+
+      option :secret_file,
+        :long => "--secret-file SECRET_FILE",
+        :description => "A file containing the secret key to use to encrypt data bag item values"
+
       def find_template(template=nil)
         # Are we bootstrapping using an already shipped template?
         if config[:template_file]
@@ -166,11 +186,12 @@ class Chef
 
       def run
         validate_name_args!
+        warn_chef_config_secret_key
         @template_file = find_template(config[:bootstrap_template])
         @node_name = Array(@name_args).first
         # back compat--templates may use this setting:
         config[:server_name] = @node_name
-        
+
         $stdout.sync = true
 
         ui.info("Bootstrapping Chef on #{ui.color(@node_name, :bold)}")
@@ -204,6 +225,7 @@ class Chef
         ssh.config[:ssh_password] = config[:ssh_password]
         ssh.config[:ssh_port] = Chef::Config[:knife][:ssh_port] || config[:ssh_port]
         ssh.config[:ssh_gateway] = Chef::Config[:knife][:ssh_gateway] || config[:ssh_gateway]
+        ssh.config[:forward_agent] = Chef::Config[:knife][:forward_agent] || config[:forward_agent]
         ssh.config[:identity_file] = Chef::Config[:knife][:identity_file] || config[:identity_file]
         ssh.config[:manual] = true
         ssh.config[:host_key_verify] = Chef::Config[:knife][:host_key_verify] || config[:host_key_verify]
@@ -222,12 +244,34 @@ class Chef
         command = render_template(read_template)
 
         if config[:use_sudo]
-          command = "sudo #{command}"
+          command = config[:use_sudo_password] ? "echo #{config[:ssh_password]} | sudo -S #{command}" : "sudo #{command}"
         end
 
         command
       end
 
+      def warn_chef_config_secret_key
+        unless Chef::Config[:encrypted_data_bag_secret].nil?
+          ui.warn "* " * 40
+          ui.warn(<<-WARNING)
+Specifying the encrypted data bag secret key using an 'encrypted_data_bag_secret'
+entry in 'knife.rb' is deprecated. Please see CHEF-4011 for more details. You
+can supress this warning and still distribute the secret key to all bootstrapped
+machines by adding the following to your 'knife.rb' file:
+
+  knife[:secret_file] = "/path/to/your/secret"
+
+If you would like to selectively distribute a secret key during bootstrap
+please use the '--secret' or '--secret-file' options of this command instead.
+
+#{ui.color('IMPORTANT:', :red, :bold)} In a future version of Chef, this
+behavior will be removed and any 'encrypted_data_bag_secret' entries in
+'knife.rb' will be ignored completely.
+WARNING
+          ui.warn "* " * 40
+        end
+      end
+
     end
   end
 end