chef 11.4.4 → 11.6.0.hotfix.1

data/lib/chef/resources.rb

@@ -18,6 +18,7 @@
 
 require 'chef/resource/apt_package'
 require 'chef/resource/bash'
+require 'chef/resource/batch'
 require 'chef/resource/breakpoint'
 require 'chef/resource/cookbook_file'
 require 'chef/resource/chef_gem'
@@ -49,6 +50,7 @@ require 'chef/resource/package'
 require 'chef/resource/pacman_package'
 require 'chef/resource/perl'
 require 'chef/resource/portage_package'
+require 'chef/resource/powershell_script'
 require 'chef/resource/python'
 require 'chef/resource/registry_key'
 require 'chef/resource/remote_directory'

data/lib/chef/rest.rb

@@ -31,8 +31,7 @@ require 'chef/monkey_patches/string'
 require 'chef/monkey_patches/net_http'
 require 'chef/config'
 require 'chef/exceptions'
-require 'chef/platform'
-
+require 'chef/platform/query_helpers'
 
 class Chef
   # == Chef::REST
@@ -84,6 +83,10 @@ class Chef
       @raw_key
     end
 
+    def last_response
+      @last_response
+    end
+
     # Send an HTTP GET request to the path
     #
     # Using this method to +fetch+ a file is considered deprecated.
@@ -164,6 +167,7 @@ class Chef
       retriable_rest_request(method, url, body, headers) do |rest_request|
         begin
           response = rest_request.call {|r| r.read_body}
+          @last_response = response
 
           Chef::Log.debug("---- HTTP Status and Header Data: ----")
           Chef::Log.debug("HTTP #{response.http_version} #{response.code} #{response.msg}")
@@ -185,7 +189,11 @@ class Chef
           elsif response.kind_of?(Net::HTTPNotModified) # Must be tested before Net::HTTPRedirection because it's subclass.
             false
           elsif redirect_location = redirected_to(response)
-            follow_redirect {api_request(:GET, create_url(redirect_location))}
+            if [:GET, :HEAD].include?(method)
+              follow_redirect {api_request(method, create_url(redirect_location))}
+            else
+              raise Exceptions::InvalidRedirect, "#{method} request was redirected from #{url} to #{redirect_location}. Only GET and HEAD support redirects."
+            end
           else
             # have to decompress the body before making an exception for it. But the body could be nil.
             response.body.replace(response_body) if response.body.respond_to?(:replace)
@@ -248,6 +256,7 @@ class Chef
               tempfile = stream_to_tempfile(url, r)
             end
           end
+          @last_response = response
           if response.kind_of?(Net::HTTPSuccess)
             tempfile
           elsif redirect_location = redirected_to(response)
@@ -364,7 +373,7 @@ class Chef
     def stream_to_tempfile(url, response)
       tf = Tempfile.open("chef-rest")
       if Chef::Platform.windows?
-        tf.binmode #required for binary files on Windows platforms
+        tf.binmode # required for binary files on Windows platforms
       end
       Chef::Log.debug("Streaming download from #{url.to_s} to tempfile #{tf.path}")
       # Stolen from http://www.ruby-forum.com/topic/166423

data/lib/chef/rest/rest_request.rb

@@ -220,7 +220,11 @@ class Chef
 
         @http_request.body = request_body if (request_body && @http_request.request_body_permitted?)
         # Optionally handle HTTP Basic Authentication
-        @http_request.basic_auth(url.user, url.password) if url.user
+        if url.user
+          user = URI.unescape(url.user)
+          password = URI.unescape(url.password) if url.password
+          @http_request.basic_auth(user, password)
+        end
         @http_request[USER_AGENT] = self.class.user_agent
       end
 

data/lib/chef/run_context/cookbook_compiler.rb

@@ -259,11 +259,11 @@ class Chef
         cookbook_collection[cookbook].segment_filenames(segment).sort
       end
 
-      # Yields the name of each cookbook depended on by +cookbook_name+ in
-      # lexical sort order.
+      # Yields the name, as a symbol, of each cookbook depended on by 
+      # +cookbook_name+ in lexical sort order.
       def each_cookbook_dep(cookbook_name, &block)
         cookbook = cookbook_collection[cookbook_name]
-        cookbook.metadata.dependencies.keys.sort.each(&block)
+        cookbook.metadata.dependencies.keys.sort.map{|x| x.to_sym}.each(&block)
       end
 
       # Given a +recipe_name+, finds the file associated with the recipe.

data/lib/chef/run_list/run_list_expansion.rb

@@ -173,7 +173,7 @@ class Chef
     class RunListExpansionFromAPI < RunListExpansion
 
       def rest
-        @rest ||= (source || Chef::REST.new(Chef::Config[:role_url]))
+        @rest ||= (source || Chef::REST.new(Chef::Config[:chef_server_url]))
       end
 
       def fetch_role(name, included_by)

data/lib/chef/run_lock.rb

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 require 'chef/mixin/create_path'
+require 'fcntl'
 
 class Chef
 
@@ -55,10 +56,15 @@ class Chef
       # ensure the runlock_file path exists
       create_path(File.dirname(runlock_file))
       @runlock = File.open(runlock_file,'w+')
+      # if we support FD_CLOEXEC (linux, !windows), then use it.
+      # NB: ruby-2.0.0-p195 sets FD_CLOEXEC by default, but not ruby-1.8.7/1.9.3
+      if Fcntl.const_defined?('F_SETFD') && Fcntl.const_defined?('FD_CLOEXEC')
+        runlock.fcntl(Fcntl::F_SETFD, runlock.fcntl(Fcntl::F_GETFD, 0) | Fcntl::FD_CLOEXEC)
+      end
       unless runlock.flock(File::LOCK_EX|File::LOCK_NB)
         # Another chef client running...
         runpid = runlock.read.strip.chomp
-        Chef::Log.info("Chef client #{runpid} is running, will wait for it to finish and then run.")
+        Chef::Log.warn("Chef client #{runpid} is running, will wait for it to finish and then run.")
         runlock.flock(File::LOCK_EX)
       end
       # We grabbed the run lock.  Save the pid.

data/lib/chef/runner.rb

@@ -22,7 +22,6 @@ require 'chef/exceptions'
 require 'chef/mixin/params_validate'
 require 'chef/node'
 require 'chef/resource_collection'
-require 'chef/platform'
 
 class Chef
   # == Chef::Runner

data/lib/chef/scan_access_control.rb

@@ -127,7 +127,12 @@ class Chef
     end
 
     def stat
-      @stat ||= @new_resource.instance_of?(Chef::Resource::Link) ? ::File.lstat(@new_resource.path) : ::File.stat(@new_resource.path)
+      @stat ||= if @new_resource.instance_of?(Chef::Resource::Link)
+        ::File.lstat(@new_resource.path)
+      else
+        realpath = ::File.realpath(@new_resource.path)
+        ::File.stat(realpath)
+      end
     end
   end
 end

data/lib/chef/search/query.rb

@@ -31,7 +31,7 @@ class Chef
       attr_accessor :rest
 
       def initialize(url=nil)
-        @rest = Chef::REST.new(url ||Chef::Config[:search_url])
+        @rest = Chef::REST.new(url ||Chef::Config[:chef_server_url])
       end
 
       # Search Solr for objects of a given type, for a given query. If you give
@@ -53,7 +53,7 @@ class Chef
       end
 
       def list_indexes
-        response = @rest.get_rest("search")
+        @rest.get_rest("search")
       end
 
       private

data/lib/chef/shell/shell_session.rb

@@ -204,8 +204,8 @@ module Shell
       Chef::Cookbook::FileVendor.on_create { |manifest| Chef::Cookbook::RemoteFileVendor.new(manifest, Chef::REST.new(Chef::Config[:server_url])) }
       cookbook_hash = @client.sync_cookbooks
       cookbook_collection = Chef::CookbookCollection.new(cookbook_hash)
-      @run_context = Chef::RunContext.new(node, cookbook_collection, @events) 
-      @run_context.load(Chef::RunList::RunListExpansionFromAPI.new("_default", []))
+      @run_context = Chef::RunContext.new(node, cookbook_collection, @events)
+      @run_context.load(@node.run_list.expand(@node.chef_environment))
       @run_status.run_context = run_context
     end
 

data/lib/chef/util/backup.rb

@@ -0,0 +1,84 @@
+#
+# Author:: Lamont Granquist (<lamont@opscode.com>)
+# Copyright:: Copyright (c) 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+class Chef
+  class Util
+    class Backup
+      attr_reader :new_resource
+      attr_accessor :path
+
+      def initialize(new_resource, path = nil)
+        @new_resource = new_resource
+        @path = path.nil? ? new_resource.path : path
+      end
+
+      def backup!
+        if @new_resource.backup != false && @new_resource.backup > 0 && ::File.exist?(path)
+          do_backup
+          # Clean up after the number of backups
+          slice_number = @new_resource.backup
+          backup_files = sorted_backup_files
+          if backup_files.length >= @new_resource.backup
+            remainder = backup_files.slice(slice_number..-1)
+            remainder.each do |backup_to_delete|
+              delete_backup(backup_to_delete)
+            end
+          end
+        end
+      end
+
+      private
+
+      def backup_filename
+        @backup_filename ||= begin
+          time = Time.now
+          savetime = time.strftime("%Y%m%d%H%M%S")
+          backup_filename = "#{path}.chef-#{savetime}"
+          backup_filename = backup_filename.sub(/^([A-Za-z]:)/, "") #strip drive letter on Windows
+        end
+      end
+
+      def prefix
+        # if :file_backup_path is nil, we fallback to the old behavior of
+        # keeping the backup in the same directory. We also need to to_s it
+        # so we don't get a type error around implicit to_str conversions.
+        @prefix ||= Chef::Config[:file_backup_path].to_s
+      end
+
+      def backup_path
+        @backup_path ||= ::File.join(prefix, backup_filename)
+      end
+
+      def do_backup
+        FileUtils.mkdir_p(::File.dirname(backup_path)) if Chef::Config[:file_backup_path]
+        FileUtils.cp(path, backup_path, :preserve => true)
+        Chef::Log.info("#{@new_resource} backed up to #{backup_path}")
+      end
+
+      def delete_backup(backup_file)
+        FileUtils.rm(backup_file)
+        Chef::Log.info("#{@new_resource} removed backup at #{backup_file}")
+      end
+
+      def sorted_backup_files
+        Dir[::File.join(prefix, ".#{path}.chef-*")].sort { |a,b| b <=> a }
+      end
+    end
+  end
+end
+

data/lib/chef/util/diff.rb

@@ -0,0 +1,145 @@
+# Author:: Lamont Granquist (<lamont@opscode.com>)
+# Copyright:: Copyright (c) 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'chef/mixin/shell_out'
+
+class Chef
+  class Util
+    class Diff
+      include Chef::Mixin::ShellOut
+
+      # @todo: to_a, to_s, to_json, inspect defs, accessors for @diff and @error
+      # @todo: move coercion to UTF-8 into to_json
+      # @todo: replace shellout to diff -u with diff-lcs gem
+
+      def for_output
+        # formatted output to a terminal uses arrays of strings and returns error strings
+        @diff.nil? ? [ @error ] : @diff
+      end
+
+      def for_reporting
+        # caller needs to ensure that new files aren't posted to resource reporting
+        return nil if @diff.nil?
+        @diff.join("\\n")
+      end
+
+      def use_tempfile_if_missing(file)
+        tempfile = nil
+        unless File.exists?(file)
+          Chef::Log.debug("file #{file} does not exist to diff against, using empty tempfile")
+          tempfile = Tempfile.new("chef-diff")
+          file = tempfile.path
+        end
+        yield file
+        unless tempfile.nil?
+          tempfile.close
+          tempfile.unlink
+        end
+      end
+
+      def diff(old_file, new_file)
+        use_tempfile_if_missing(old_file) do |old_file|
+          use_tempfile_if_missing(new_file) do |new_file|
+            @error = do_diff(old_file, new_file)
+          end
+        end
+      end
+
+      private
+
+      def do_diff(old_file, new_file)
+        if Chef::Config[:diff_disabled]
+          return "(diff output suppressed by config)"
+        end
+
+        diff_filesize_threshold = Chef::Config[:diff_filesize_threshold]
+        diff_output_threshold = Chef::Config[:diff_output_threshold]
+
+        if ::File.size(old_file) > diff_filesize_threshold || ::File.size(new_file) > diff_filesize_threshold
+          return "(file sizes exceed #{diff_filesize_threshold} bytes, diff output suppressed)"
+        end
+
+        # MacOSX(BSD?) diff will *sometimes* happily spit out nasty binary diffs
+        return "(current file is binary, diff output suppressed)" if is_binary?(old_file)
+        return "(new content is binary, diff output suppressed)" if is_binary?(new_file)
+
+        begin
+          # -u: Unified diff format
+          # LC_ALL: in ruby 1.9 we want to set nil which is a magic option to mixlib-shellout to
+          #         pass through the LC_ALL locale.  in ruby 1.8 we force to 7-bit 'C' locale
+          #         (which is the mixlib-shellout default for all rubies all the time).
+          Chef::Log.debug("running: diff -u #{old_file} #{new_file}")
+          locale = ( Object.const_defined? :Encoding ) ? nil : 'C'
+          result = shell_out("diff -u #{old_file} #{new_file}", :env => {'LC_ALL' => locale})
+
+        rescue Exception => e
+          # Should *not* receive this, but in some circumstances it seems that
+          # an exception can be thrown even using shell_out instead of shell_out!
+          return "Could not determine diff. Error: #{e.message}"
+        end
+
+        # diff will set a non-zero return code even when there's
+        # valid stdout results, if it encounters something unexpected
+        # So as long as we have output, we'll show it.
+        #
+        # Also on some platforms (Solaris) diff outputs a single line
+        # when there are no differences found. Look for this line
+        # before analyzing diff output.
+        if !result.stdout.empty? && result.stdout != "No differences encountered\n"
+          if result.stdout.length > diff_output_threshold
+            return "(long diff of over #{diff_output_threshold} characters, diff output suppressed)"
+          else
+            diff_str = result.stdout
+            if  Object.const_defined? :Encoding  # ruby >= 1.9
+              if ( diff_str.encoding == Encoding::ASCII_8BIT &&
+                diff_str.encoding != Encoding.default_external &&
+                RUBY_VERSION.to_f < 2.0 )
+                # @todo mixlib-shellout under ruby 1.9 hands back an ASCII-8BIT encoded string, which needs to
+                # be fixed to the default external encoding -- this should be moved into mixlib-shellout
+                diff_str = diff_str.force_encoding(Encoding.default_external)
+              end
+              diff_str.encode!('UTF-8', :invalid => :replace, :undef => :replace, :replace => '?')
+            end
+            @diff = diff_str.split("\n")
+            @diff.delete("\")
+            return "(diff available)"
+          end
+        elsif !result.stderr.empty?
+          return "Could not determine diff. Error: #{result.stderr}"
+        else
+          return "(no diff)"
+        end
+      end
+
+      def is_binary?(path)
+        File.open(path) do |file|
+          # XXX: this slurps into RAM, but we should have already checked our diff has a reasonable size
+          buff = file.read
+          buff = "" if buff.nil?
+          begin
+            return buff !~ /\A[\s[:print:]]*\z/m
+          rescue ArgumentError => e
+            return true if e.message =~ /invalid byte sequence/
+            raise
+          end
+        end
+      end
+
+    end
+  end
+end
+

data/lib/chef/util/file_edit.rb

@@ -33,7 +33,7 @@ class Chef
         @file_edited = false
 
         raise ArgumentError, "File doesn't exist" unless File.exist? @original_pathname
-        raise ArgumentError, "File is blank" unless (@contents = File.new(@original_pathname).readlines).length > 0
+        @contents = File.new(@original_pathname).readlines
       end
 
       #search the file line by line and match each line with the given regex

data/lib/chef/util/selinux.rb

@@ -0,0 +1,100 @@
+#
+# Author:: Sean O'Meara
+# Author:: Kevin Keane
+# Author:: Lamont Granquist (<lamont@opscode.com>)
+#
+# Copyright:: Copyright (c) 2011 Opscode, Inc.
+# Copyright:: Copyright (c) 2013, North County Tech Center, LLC
+#
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'chef/mixin/shell_out'
+
+class Chef
+  class Util
+    #
+    # IMPORTANT: We assume that selinux utilities are installed on an
+    # selinux enabled server. Provisioning an selinux enabled server
+    # without selinux utilities is not supported.
+    #
+    module Selinux
+
+      include Chef::Mixin::ShellOut
+
+      # We want to initialize below variables once during a
+      # chef-client run therefore they are class variables.
+      @@selinux_enabled = nil
+      @@restorecon_path = nil
+      @@selinuxenabled_path = nil
+
+      def selinux_enabled?
+        @@selinux_enabled = check_selinux_enabled? if @@selinux_enabled.nil?
+        @@selinux_enabled
+      end
+
+      def restore_security_context(file_path, recursive = false)
+        if restorecon_path
+          restorecon_command = recursive ? "#{restorecon_path} -R -r" : "#{restorecon_path} -R"
+          restorecon_command += " #{file_path}"
+          Chef::Log.debug("Restoring selinux security content with #{restorecon_command}")
+          shell_out!(restorecon_command)
+        else
+          Chef::Log.warn "Can not find 'restorecon' on the system. Skipping selinux security context restore."
+        end
+      end
+
+      private
+
+      def restorecon_path
+        @@restorecon_path = which("restorecon") if @@restorecon_path.nil?
+        @@restorecon_path
+      end
+
+      def selinuxenabled_path
+        @@selinuxenabled_path = which("selinuxenabled") if @@selinuxenabled_path.nil?
+        @@selinuxenabled_path
+      end
+
+      def which(cmd)
+        paths = ENV['PATH'].split(File::PATH_SEPARATOR) + [ '/bin', '/usr/bin', '/sbin', '/usr/sbin' ]
+        paths.each do |path|
+          filename = File.join(path, cmd)
+          return filename if File.executable?(filename)
+        end
+        false
+      end
+
+      def check_selinux_enabled?
+        if selinuxenabled_path
+          cmd = shell_out!(selinuxenabled_path, :returns => [0,1])
+          case cmd.exitstatus
+          when 1
+            return false
+          when 0
+            return true
+          else
+            raise RuntimeError, "Unknown exit code from command #{selinuxenabled_path}: #{cmd.exitstatus}"
+          end
+        else
+          # We assume selinux is not enabled if selinux utils are not
+          # installed.
+          return false
+        end
+      end
+
+    end
+  end
+end
+