chef 12.0.0.alpha.0 → 12.0.0.alpha.1

data/lib/chef/encrypted_data_bag_item/encryptor.rb

@@ -22,6 +22,8 @@ require 'openssl'
 require 'ffi_yajl'
 require 'chef/encrypted_data_bag_item'
 require 'chef/encrypted_data_bag_item/unsupported_encrypted_data_bag_item_format'
+require 'chef/encrypted_data_bag_item/encryption_failure'
+require 'chef/encrypted_data_bag_item/assertions'
 
 class Chef::EncryptedDataBagItem
 
@@ -40,9 +42,11 @@ class Chef::EncryptedDataBagItem
         Version1Encryptor.new(value, secret, iv)
       when 2
         Version2Encryptor.new(value, secret, iv)
+      when 3
+        Version3Encryptor.new(value, secret, iv)
       else
         raise UnsupportedEncryptedDataBagItemFormat,
-          "Invalid encrypted data bag format version `#{format_version}'. Supported versions are '1', '2'"
+          "Invalid encrypted data bag format version `#{format_version}'. Supported versions are '1', '2', '3'"
       end
     end
 
@@ -50,6 +54,8 @@ class Chef::EncryptedDataBagItem
       attr_reader :key
       attr_reader :plaintext_data
 
+      include Chef::EncryptedDataBagItem::Assertions
+
       # Create a new Encryptor for +data+, which will be encrypted with the given
       # +key+.
       #
@@ -65,6 +71,11 @@ class Chef::EncryptedDataBagItem
         @iv = iv && Base64.decode64(iv)
       end
 
+      # Returns the used encryption algorithm
+      def algorithm
+        ALGORITHM
+      end
+
       # Returns a wrapped and encrypted version of +plaintext_data+ suitable for
       # using as the value in an encrypted data bag item.
       def for_encrypted_item
@@ -72,27 +83,28 @@ class Chef::EncryptedDataBagItem
           "encrypted_data" => encrypted_data,
           "iv" => Base64.encode64(iv),
           "version" => 1,
-          "cipher" => ALGORITHM
+          "cipher" => algorithm
         }
       end
 
       # Generates or returns the IV.
       def iv
-        # Generated IV comes from OpenSSL::Cipher::Cipher#random_iv
+        # Generated IV comes from OpenSSL::Cipher#random_iv
         # This gets generated when +openssl_encryptor+ gets created.
         openssl_encryptor if @iv.nil?
         @iv
       end
 
-      # Generates (and memoizes) an OpenSSL::Cipher::Cipher object and configures
+      # Generates (and memoizes) an OpenSSL::Cipher object and configures
       # it for the specified iv and encryption key.
       def openssl_encryptor
         @openssl_encryptor ||= begin
-          encryptor = OpenSSL::Cipher::Cipher.new(ALGORITHM)
+          encryptor = OpenSSL::Cipher.new(algorithm)
           encryptor.encrypt
+          # We must set key before iv: https://bugs.ruby-lang.org/issues/8221
+          encryptor.key = OpenSSL::Digest::SHA256.digest(key)
           @iv ||= encryptor.random_iv
           encryptor.iv = @iv
-          encryptor.key = Digest::SHA256.digest(key)
           encryptor
         end
       end
@@ -125,18 +137,77 @@ class Chef::EncryptedDataBagItem
           "hmac" => hmac,
           "iv" => Base64.encode64(iv),
           "version" => 2,
-          "cipher" => ALGORITHM
+          "cipher" => algorithm
         }
       end
 
       # Generates an HMAC-SHA2-256 of the encrypted data (encrypt-then-mac)
       def hmac
         @hmac ||= begin
-          digest = OpenSSL::Digest::Digest.new("sha256")
+          digest = OpenSSL::Digest.new("sha256")
           raw_hmac = OpenSSL::HMAC.digest(digest, key, encrypted_data)
           Base64.encode64(raw_hmac)
         end
       end
     end
+
+    class Version3Encryptor < Version1Encryptor
+      include Chef::EncryptedDataBagItem::Assertions
+
+      def initialize(plaintext_data, key, iv=nil)
+        super
+        assert_aead_requirements_met!(algorithm)
+        @auth_tag = nil
+      end
+
+      # Returns a wrapped and encrypted version of +plaintext_data+ suitable for
+      # using as the value in an encrypted data bag item.
+      def for_encrypted_item
+        {
+          "encrypted_data" => encrypted_data,
+          "iv" => Base64.encode64(iv),
+          "auth_tag" => Base64.encode64(auth_tag),
+          "version" => 3,
+          "cipher" => algorithm
+        }
+      end
+
+      # Returns the used encryption algorithm
+      def algorithm
+        AEAD_ALGORITHM
+      end
+
+      # Returns a wrapped and encrypted version of +plaintext_data+ suitable for
+      # Returns the auth_tag.
+      def auth_tag
+        # Generated auth_tag comes from OpenSSL::Cipher#auth_tag
+        # This must be generated after the data is encrypted
+        if @auth_tag.nil?
+          raise EncryptionFailure, "Internal Error: GCM authentication tag read before encryption"
+        end
+        @auth_tag
+      end
+
+      # Generates (and memoizes) an OpenSSL::Cipher object and configures
+      # it for the specified iv and encryption key using AEAD
+      def openssl_encryptor
+        @openssl_encryptor ||= begin
+          encryptor = super
+          encryptor.auth_data = ''
+          encryptor
+        end
+      end
+
+      # Encrypts, Base64 encodes +serialized_data+ and gets the authentication tag
+      def encrypted_data
+        @encrypted_data ||= begin
+          enc_data_b64 = super
+          @auth_tag = openssl_encryptor.auth_tag
+          enc_data_b64
+        end
+      end
+
+    end
+
   end
 end

data/lib/chef/environment.rb

@@ -129,7 +129,7 @@ class Chef
     end
 
     def to_json(*a)
-      to_hash.to_json(*a)
+      Chef::JSONCompat.to_json(to_hash, *a)
     end
 
     def update_from!(o)
@@ -140,7 +140,6 @@ class Chef
       self
     end
 
-
     def update_attributes_from_params(params)
       unless params[:default_attributes].nil? || params[:default_attributes].size == 0
         default_attributes(Chef::JSONCompat.from_json(params[:default_attributes]))
@@ -213,7 +212,6 @@ class Chef
       end
     end
 
-
     def self.json_create(o)
       environment = new
       environment.name(o["name"])

data/lib/chef/exceptions.rb

@@ -83,6 +83,7 @@ class Chef
     class RequestedUIDUnavailable < RuntimeError; end
     class InvalidHomeDirectory < ArgumentError; end
     class DsclCommandFailed < RuntimeError; end
+    class PlistUtilCommandFailed < RuntimeError; end
     class UserIDNotFound < ArgumentError; end
     class GroupIDNotFound < ArgumentError; end
     class ConflictingMembersInGroup < ArgumentError; end
@@ -115,6 +116,7 @@ class Chef
     class Win32ArchitectureIncorrect < RuntimeError; end
     class ObsoleteDependencySyntax < ArgumentError; end
     class InvalidDataBagPath < ArgumentError; end
+    class DuplicateDataBagItem < RuntimeError; end
 
     # A different version of a cookbook was added to a
     # VersionedRecipeList than the one already there.
@@ -131,6 +133,8 @@ class Chef
     # Version constraints are not allowed in chef-solo
     class IllegalVersionConstraint < NotImplementedError; end
 
+    class MetadataNotValid < StandardError; end
+
     # File operation attempted but no permissions to perform it
     class InsufficientPermissions < RuntimeError; end
 
@@ -194,7 +198,6 @@ class Chef
         end
       end
 
-
     end
     # Exception class for collecting multiple failures. Used when running
     # delayed notifications so that chef can process each delayed
@@ -262,7 +265,7 @@ class Chef
             "non_existent_cookbooks" => non_existent_cookbooks,
             "cookbooks_with_no_versions" => cookbooks_with_no_matching_versions
           }
-          result.to_json(*a)
+          Chef::JSONCompat.to_json(result, *a)
         end
       end
 
@@ -297,7 +300,7 @@ class Chef
             "non_existent_cookbooks" => non_existent_cookbooks,
             "most_constrained_cookbooks" => most_constrained_cookbooks
           }
-          result.to_json(*a)
+          Chef::JSONCompat.to_json(result, *a)
         end
       end
 
@@ -331,6 +334,18 @@ class Chef
       end
     end
 
+    class ChecksumMismatch < RuntimeError
+      def initialize(res_cksum, cont_cksum)
+        super "Checksum on resource (#{res_cksum}) does not match checksum on content (#{cont_cksum})"
+      end
+    end
+
     class BadProxyURI < RuntimeError; end
+
+    # Raised by Chef::JSONCompat
+    class JSON
+      class EncodeError < RuntimeError; end
+      class ParseError < RuntimeError; end
+    end
   end
 end

data/lib/chef/formatters/base.rb

@@ -93,6 +93,13 @@ class Chef
 
       def indent_by(amount)
         @output.indent += amount
+        if @output.indent < 0
+          # This is left commented out for now.  We need to uncomment it and fix at least one bug in
+          # the formatter, and then leave this line uncommented in the future.
+          #Chef::Log.warn "Internal Formatter Error -- Attempt to indent by negative number of spaces"
+          @output.indent = 0
+        end
+        @output.indent
       end
 
       # Input: a Formatters::ErrorDescription object.

data/lib/chef/formatters/error_inspectors/cookbook_resolve_error_inspector.rb

@@ -56,7 +56,7 @@ class Chef
             # * could be no read on the node
             error_description.section("Authorization Error",<<-E)
 This client is not authorized to read some of the information required to
-access its coobooks (HTTP 403).
+access its cookbooks (HTTP 403).
 
 To access its cookbooks, a client needs to be able to read its environment and
 all of the cookbooks in its expanded run list.

data/lib/chef/handler/json_file.rb

@@ -58,7 +58,6 @@ class Chef
         end
       end
 
-
     end
   end
 end

data/lib/chef/http/json_output.rb

@@ -50,7 +50,7 @@ class Chef
             if @inflate_json_class
               return_value = Chef::JSONCompat.from_json(http_response.body.chomp)
             else
-              return_value = Chef::JSONCompat.from_json(http_response.body.chomp, :create_additions => false)
+              return_value = Chef::JSONCompat.parse(http_response.body.chomp)
             end
           end
           [http_response, rest_request, return_value]

data/lib/chef/json_compat.rb

@@ -18,7 +18,9 @@
 # Wrapper class for interacting with JSON.
 
 require 'ffi_yajl'
+require 'json'
 require 'ffi_yajl/json_gem'  # XXX: parts of chef require JSON gem's Hash#to_json monkeypatch
+require 'chef/exceptions'
 
 class Chef
   class JSONCompat
@@ -40,15 +42,24 @@ class Chef
 
     class <<self
 
+      # API to use to avoid create_addtions
+      def parse(source, opts = {})
+        begin
+          FFI_Yajl::Parser.parse(source, opts)
+        rescue FFI_Yajl::ParseError => e
+          raise Chef::Exceptions::JSON::ParseError, e.message
+        end
+      end
+
       # Just call the JSON gem's parse method with a modified :max_nesting field
       def from_json(source, opts = {})
-        obj = ::FFI_Yajl::Parser.parse(source)
+        obj = parse(source, opts)
 
         # JSON gem requires top level object to be a Hash or Array (otherwise
         # you get the "must contain two octets" error). Yajl doesn't impose the
         # same limitation. For compatibility, we re-impose this condition.
         unless obj.kind_of?(Hash) or obj.kind_of?(Array)
-          raise JSON::ParserError, "Top level JSON object must be a Hash or Array. (actual: #{obj.class})"
+          raise Chef::Exceptions::JSON::ParseError, "Top level JSON object must be a Hash or Array. (actual: #{obj.class})"
         end
 
         # The old default in the json gem (which we are mimicing because we
@@ -88,14 +99,21 @@ class Chef
       end
 
       def to_json(obj, opts = nil)
-        obj.to_json(opts)
+        begin
+          FFI_Yajl::Encoder.encode(obj, opts)
+        rescue FFI_Yajl::EncodeError => e
+          raise Chef::Exceptions::JSON::EncodeError, e.message
+        end
       end
 
       def to_json_pretty(obj, opts = nil)
-        ::JSON.pretty_generate(obj, opts)
+        opts ||= {}
+        options_map = {}
+        options_map[:pretty] = true
+        options_map[:indent] = opts[:indent] if opts.has_key?(:indent)
+        to_json(obj, options_map).chomp
       end
 
-
       # Map +json_class+ to a Class object. We use a +case+ instead of a Hash
       # assigned to a constant because otherwise this file could not be loaded
       # until all the constants were defined, which means you'd have to load
@@ -130,7 +148,7 @@ class Chef
         when /^Chef::Resource/
           Chef::Resource.find_subclass_by_name(json_class)
         else
-          raise JSON::ParserError, "Unsupported `json_class` type '#{json_class}'"
+          raise Chef::Exceptions::JSON::ParseError, "Unsupported `json_class` type '#{json_class}'"
         end
       end
 

data/lib/chef/knife/bootstrap.rb

@@ -126,7 +126,7 @@ class Chef
         :short => "-j JSON_ATTRIBS",
         :long => "--json-attributes",
         :description => "A JSON string to be added to the first run of chef-client",
-        :proc => lambda { |o| JSON.parse(o) },
+        :proc => lambda { |o| Chef::JSONCompat.parse(o) },
         :default => {}
 
       option :host_key_verify,
@@ -141,7 +141,7 @@ class Chef
         :proc => Proc.new { |h|
           Chef::Config[:knife][:hints] ||= Hash.new
           name, path = h.split("=")
-          Chef::Config[:knife][:hints][name] = path ? JSON.parse(::File.read(path)) : Hash.new  }
+          Chef::Config[:knife][:hints][name] = path ? Chef::JSONCompat.parse(::File.read(path)) : Hash.new  }
 
       option :secret,
         :short => "-s SECRET",

data/lib/chef/knife/client_delete.rb

@@ -47,7 +47,7 @@ class Chef
           object = Chef::ApiClient.load(@client_name)
           if object.validator
             unless config[:delete_validators]
-              ui.fatal("You must specify --force to delete the validator client #{@client_name}")
+              ui.fatal("You must specify --delete-validators to delete the validator client #{@client_name}")
               exit 2
             end
           end

data/lib/chef/knife/cookbook_site_download.rb

@@ -58,7 +58,7 @@ class Chef
 
       private
       def cookbooks_api_url
-        'http://cookbooks.opscode.com/api/v1/cookbooks'
+        'https://supermarket.getchef.com/api/v1/cookbooks'
       end
 
       def current_cookbook_data

data/lib/chef/knife/cookbook_site_list.rb

@@ -41,7 +41,7 @@ class Chef
       end
 
       def get_cookbook_list(items=10, start=0, cookbook_collection={})
-        cookbooks_url = "http://cookbooks.opscode.com/api/v1/cookbooks?items=#{items}&start=#{start}"
+        cookbooks_url = "https://supermarket.getchef.com/api/v1/cookbooks?items=#{items}&start=#{start}"
         cr = noauth_rest.get_rest(cookbooks_url)
         cr["items"].each do |cookbook|
           cookbook_collection[cookbook["cookbook_name"]] = cookbook

data/lib/chef/knife/cookbook_site_search.rb

@@ -29,7 +29,7 @@ class Chef
       end
 
       def search_cookbook(query, items=10, start=0, cookbook_collection={})
-        cookbooks_url = "http://cookbooks.opscode.com/api/v1/search?q=#{query}&items=#{items}&start=#{start}"
+        cookbooks_url = "https://supermarket.getchef.com/api/v1/search?q=#{query}&items=#{items}&start=#{start}"
         cr = noauth_rest.get_rest(cookbooks_url)
         cr["items"].each do |cookbook|
           cookbook_collection[cookbook["cookbook_name"]] = cookbook

data/lib/chef/knife/cookbook_site_share.rb

@@ -85,9 +85,9 @@ class Chef
       end
 
       def do_upload(cookbook_filename, cookbook_category, user_id, user_secret_filename)
-         uri = "http://cookbooks.opscode.com/api/v1/cookbooks"
+         uri = "https://supermarket.getchef.com/api/v1/cookbooks"
 
-         category_string = { 'category'=>cookbook_category }.to_json
+         category_string = Chef::JSONCompat.to_json({ 'category'=>cookbook_category })
 
          http_resp = Chef::CookbookSiteStreamingUploader.post(uri, user_id, user_secret_filename, {
            :tarball => File.open(cookbook_filename),

data/lib/chef/knife/cookbook_site_show.rb

@@ -31,14 +31,14 @@ class Chef
       def get_cookbook_data
         case @name_args.length
         when 1
-          noauth_rest.get_rest("http://cookbooks.opscode.com/api/v1/cookbooks/#{@name_args[0]}")
+          noauth_rest.get_rest("https://supermarket.getchef.com/api/v1/cookbooks/#{@name_args[0]}")
         when 2
-          noauth_rest.get_rest("http://cookbooks.opscode.com/api/v1/cookbooks/#{@name_args[0]}/versions/#{name_args[1].gsub('.', '_')}")
+          noauth_rest.get_rest("https://supermarket.getchef.com/api/v1/cookbooks/#{@name_args[0]}/versions/#{name_args[1].gsub('.', '_')}")
         end
       end
 
       def get_cookbook_list(items=10, start=0, cookbook_collection={})
-        cookbooks_url = "http://cookbooks.opscode.com/api/v1/cookbooks?items=#{items}&start=#{start}"
+        cookbooks_url = "https://supermarket.getchef.com/api/v1/cookbooks?items=#{items}&start=#{start}"
         cr = noauth_rest.get_rest(cookbooks_url)
         cr["items"].each do |cookbook|
           cookbook_collection[cookbook["cookbook_name"]] = cookbook