chef 12.0.0.alpha.1 → 12.0.0.alpha.2

data/lib/chef/config_fetcher.rb

@@ -7,11 +7,9 @@ class Chef
   class ConfigFetcher
 
     attr_reader :config_location
-    attr_reader :config_file_jail
 
-    def initialize(config_location, config_file_jail=nil)
+    def initialize(config_location)
       @config_location = config_location
-      @config_file_jail = config_file_jail
     end
 
     def fetch_json
@@ -48,24 +46,11 @@ class Chef
     def config_missing?
       return false if remote_config?
 
-      # Check if the config file exists, and check if it is underneath the config file jail
-      begin
-        real_config_file = Pathname.new(config_location).realpath.to_s
-      rescue Errno::ENOENT
-        return true
-      end
-
-      # If realpath succeeded, the file exists
-      return false if !config_file_jail
-
-      begin
-        real_jail = Pathname.new(config_file_jail).realpath.to_s
-      rescue Errno::ENOENT
-        Chef::Log.warn("Config file jail #{config_file_jail} does not exist: will not load any config file.")
-        return true
-      end
-
-      !Chef::ChefFS::PathUtils.descendant_of?(real_config_file, real_jail)
+      # Check if the config file exists
+      Pathname.new(config_location).realpath.to_s
+      false
+    rescue Errno::ENOENT
+      return true
     end
 
     def http

data/lib/chef/dsl/data_query.rb

@@ -53,14 +53,60 @@ class Chef
         raise
       end
 
-      def data_bag_item(bag, item)
+      def data_bag_item(bag, item, secret=nil)
         DataBag.validate_name!(bag.to_s)
         DataBagItem.validate_id!(item)
-        DataBagItem.load(bag, item)
+
+        item = DataBagItem.load(bag, item)
+        if encrypted?(item.raw_data)
+          Log.debug("Data bag item looks encrypted: #{bag.inspect} #{item.inspect}")
+
+          # Try to load the data bag item secret, if secret is not provided.
+          # Chef::EncryptedDataBagItem.load_secret may throw a variety of errors.
+          begin
+            secret ||= EncryptedDataBagItem.load_secret
+            item = EncryptedDataBagItem.new(item.raw_data, secret)
+          rescue Exception
+            Log.error("Failed to load secret for encrypted data bag item: #{bag.inspect} #{item.inspect}")
+            raise
+          end
+        end
+        
+        item
       rescue Exception
         Log.error("Failed to load data bag item: #{bag.inspect} #{item.inspect}")
         raise
       end
+
+      private
+
+      # Tries to autodetect if the item's raw hash appears to be encrypted.
+      def encrypted?(raw_data)
+        data = raw_data.reject { |k, _| k == "id" } # Remove the "id" key.
+        # Assume hashes containing only the "id" key are not encrypted.
+        # Otherwise, remove the keys that don't appear to be encrypted and compare
+        # the result with the hash. If some entry has been removed, then some entry
+        # doesn't appear to be encrypted and we assume the entire hash is not encrypted.
+        data.empty? ? false : data.reject { |_, v| !looks_like_encrypted?(v) } == data
+      end
+
+      # Checks if data looks like it has been encrypted by
+      # Chef::EncryptedDataBagItem::Encryptor::VersionXEncryptor. Returns
+      # true only when there is an exact match between the VersionXEncryptor
+      # keys and the hash's keys.
+      def looks_like_encrypted?(data)
+        return false unless data.is_a?(Hash) && data.has_key?("version")
+        case data["version"]
+        when 1
+          Chef::EncryptedDataBagItem::Encryptor::Version1Encryptor.encryptor_keys.sort == data.keys.sort
+        when 2
+          Chef::EncryptedDataBagItem::Encryptor::Version2Encryptor.encryptor_keys.sort == data.keys.sort
+        when 3
+          Chef::EncryptedDataBagItem::Encryptor::Version3Encryptor.encryptor_keys.sort == data.keys.sort
+        else
+          false # version means something else... assume not encrypted.
+        end
+      end
     end
   end
 end
@@ -68,4 +114,3 @@ end
 # **DEPRECATED**
 # This used to be part of chef/mixin/language. Load the file to activate the deprecation code.
 require 'chef/mixin/language'
-

data/lib/chef/dsl/platform_introspection.rb

@@ -50,8 +50,12 @@ class Chef
 
         def value_for_node(node)
           platform, version = node[:platform].to_s, node[:platform_version].to_s
+          # Check if we match a version constraint via Chef::VersionConstraint and Chef::Version::Platform
+          matched_value = match_versions(node)
           if @values.key?(platform) && @values[platform].key?(version)
             @values[platform][version]
+          elsif matched_value
+            matched_value
           elsif @values.key?(platform) && @values[platform].key?("default")
             @values[platform]["default"]
           elsif @values.key?("default")
@@ -63,6 +67,44 @@ class Chef
 
         private
 
+        def match_versions(node)
+          begin
+            platform, version = node[:platform].to_s, node[:platform_version].to_s
+            return nil unless @values.key?(platform)
+            node_version = Chef::Version::Platform.new(version)
+            key_matches = []
+            keys = @values[platform].keys
+            keys.each do |k|
+              begin
+                if Chef::VersionConstraint.new(k).include?(node_version)
+                  key_matches << k
+                end
+              rescue Chef::Exceptions::InvalidVersionConstraint => e
+                Chef::Log.debug "Caught InvalidVersionConstraint. This means that a key in value_for_platform cannot be interpreted as a Chef::VersionConstraint."
+                Chef::Log.debug(e)
+              end
+            end
+            return @values[platform][version] if key_matches.include?(version)
+            case key_matches.length
+            when 0
+              return nil
+            when 1
+              return @values[platform][key_matches.first]
+            else
+              raise "Multiple matches detected for #{platform} with values #{@values}. The matches are: #{key_matches}"
+            end
+          rescue Chef::Exceptions::InvalidCookbookVersion => e
+            # Lets not break because someone passes a weird string like 'default' :)
+            Chef::Log.debug(e)
+            Chef::Log.debug "InvalidCookbookVersion exceptions are common and expected here: the generic constraint matcher attempted to match something which is not a constraint. Moving on to next version or constraint"
+            return nil
+          rescue Chef::Exceptions::InvalidPlatformVersion => e
+            Chef::Log.debug "Caught InvalidPlatformVersion, this means that Chef::Version::Platform does not know how to turn #{node_version} into an x.y.z format"
+            Chef::Log.debug(e)
+            return nil
+          end
+        end
+
         def set(platforms, value)
           if platforms.to_s == 'default'
             @values["default"] = value

data/lib/chef/dsl/reboot_pending.rb

@@ -27,10 +27,13 @@ class Chef
       include Chef::DSL::PlatformIntrospection
 
       # Returns true if the system needs a reboot or is expected to reboot
-      # Raises UnsupportedPlatform if this functionality isn't provided yet
+      # Note that we will silently miss any other platform-specific reboot notices besides Windows+Ubuntu.
       def reboot_pending?
 
-        if platform?("windows")
+        # don't break when used as a mixin in contexts without #node (e.g. specs).
+        if self.respond_to?(:node, true) && node.run_context.reboot_requested?
+          true
+        elsif platform?("windows")
           # PendingFileRenameOperations contains pairs (REG_MULTI_SZ) of filenames that cannot be updated
           # due to a file being in use (usually a temporary file and a system file)
           # \??\c:\temp\test.sys!\??\c:\winnt\system32\test.sys
@@ -53,7 +56,7 @@ class Chef
           # This should work for Debian as well if update-notifier-common happens to be installed. We need an API for that.
           File.exists?('/var/run/reboot-required')
         else
-          raise Chef::Exceptions::UnsupportedPlatform.new(node[:platform])
+          false
         end
       end
     end

data/lib/chef/encrypted_data_bag_item.rb

@@ -128,7 +128,7 @@ class Chef::EncryptedDataBagItem
   def self.load_secret(path=nil)
     path ||= Chef::Config[:encrypted_data_bag_secret]
     if !path
-      raise ArgumentError, "No secret specified to load_secret and no secret found at #{Chef::Config.platform_specific_path('/etc/chef/encrypted_data_bag_secret')}"
+      raise ArgumentError, "No secret specified and no secret found at #{Chef::Config.platform_specific_path('/etc/chef/encrypted_data_bag_secret')}"
     end
     secret = case path
              when /^\w+:\/\//

data/lib/chef/encrypted_data_bag_item/encryptor.rb

@@ -125,6 +125,10 @@ class Chef::EncryptedDataBagItem
       def serialized_data
         FFI_Yajl::Encoder.encode(:json_wrapper => plaintext_data)
       end
+
+      def self.encryptor_keys
+        %w( encrypted_data iv version cipher )
+      end
     end
 
     class Version2Encryptor < Version1Encryptor
@@ -149,6 +153,10 @@ class Chef::EncryptedDataBagItem
           Base64.encode64(raw_hmac)
         end
       end
+
+      def self.encryptor_keys
+        super + %w( hmac )
+      end
     end
 
     class Version3Encryptor < Version1Encryptor
@@ -207,6 +215,10 @@ class Chef::EncryptedDataBagItem
         end
       end
 
+      def self.encryptor_keys
+        super + %w( auth_tag )
+      end
+
     end
 
   end

data/lib/chef/exceptions.rb

@@ -347,5 +347,7 @@ class Chef
       class EncodeError < RuntimeError; end
       class ParseError < RuntimeError; end
     end
+
+    class InvalidSearchQuery < ArgumentError; end
   end
 end

data/lib/chef/http/basic_client.rb

@@ -71,6 +71,20 @@ class Chef
           end
           Chef::Log.debug("---- End HTTP Status/Header Data ----")
 
+          # For non-400's, log the request and response bodies
+          if !response.code || !response.code.start_with?('2')
+            if response.body
+              Chef::Log.debug("---- HTTP Response Body ----")
+              Chef::Log.debug(response.body)
+              Chef::Log.debug("---- End HTTP Response Body -----")
+            end
+            if req_body
+              Chef::Log.debug("---- HTTP Request Body ----")
+              Chef::Log.debug(req_body)
+              Chef::Log.debug("---- End HTTP Request Body ----")
+            end
+          end
+
           yield response if block_given?
           # http_client.request may not have the return signature we want, so
           # force the issue:

data/lib/chef/http/json_output.rb

@@ -26,6 +26,9 @@ class Chef
     # Middleware that takes an HTTP response, parses it as JSON if possible.
     class JSONOutput
 
+      attr_accessor :raw_output
+      attr_accessor :inflate_json_class
+
       def initialize(opts={})
         @raw_output = opts[:raw_output]
         @inflate_json_class = opts[:inflate_json_class]
@@ -44,10 +47,12 @@ class Chef
         # needed to keep conditional get stuff working correctly.
         return [http_response, rest_request, return_value] if return_value == false
         if http_response['content-type'] =~ /json/
-          if @raw_output
+          if http_response.body.nil?
+            return_value = nil
+          elsif raw_output
             return_value = http_response.body.to_s
           else
-            if @inflate_json_class
+            if inflate_json_class
               return_value = Chef::JSONCompat.from_json(http_response.body.chomp)
             else
               return_value = Chef::JSONCompat.parse(http_response.body.chomp)

data/lib/chef/knife.rb

@@ -20,7 +20,7 @@
 require 'forwardable'
 require 'chef/version'
 require 'mixlib/cli'
-require 'chef/config_fetcher'
+require 'chef/workstation_config_loader'
 require 'chef/mixin/convert_to_class_name'
 require 'chef/mixin/path_sanity'
 require 'chef/knife/core/subcommand_loader'
@@ -159,6 +159,27 @@ class Chef
       end
     end
 
+    # Shared with subclasses
+    @@chef_config_dir = nil
+
+    def self.load_config(explicit_config_file)
+      config_loader = WorkstationConfigLoader.new(explicit_config_file, Chef::Log)
+      Chef::Log.debug("Using configuration from #{config_loader.config_location}")
+      config_loader.load
+
+      ui.warn("No knife configuration file found") if config_loader.no_config_found?
+      @@chef_config_dir = config_loader.chef_config_dir
+
+      config_loader
+    rescue Exceptions::ConfigurationError => e
+      ui.error(ui.color("CONFIGURATION ERROR:", :red) + e.message)
+      exit 1
+    end
+
+    def self.chef_config_dir
+      @@chef_config_dir
+    end
+
     # Run knife for the given +args+ (ARGV), adding +options+ to the list of
     # CLI options that the subcommand knows how to handle.
     # ===Arguments
@@ -166,6 +187,16 @@ class Chef
     # options::: A Mixlib::CLI option parser hash. These +options+ are how
     # subcommands know about global knife CLI options
     def self.run(args, options={})
+      # Fallback debug logging. Normally the logger isn't configured until we
+      # read the config, but this means any logging that happens before the
+      # config file is read may be lost. If the KNIFE_DEBUG variable is set, we
+      # setup the logger for debug logging to stderr immediately to catch info
+      # from early in the setup process.
+      if ENV['KNIFE_DEBUG']
+        Chef::Log.init($stderr)
+        Chef::Log.level(:debug)
+      end
+
       load_commands
       subcommand_class = subcommand_class_from(args)
       subcommand_class.options = options.merge!(subcommand_class.options)
@@ -239,40 +270,12 @@ class Chef
       exit 10
     end
 
-    def self.working_directory
-      a = if Chef::Platform.windows?
-            ENV['CD']
-          else
-            ENV['PWD']
-          end || Dir.pwd
-
-      a
-    end
-
     def self.reset_config_path!
       @@chef_config_dir = nil
     end
 
     reset_config_path!
 
-
-    # search upward from current_dir until .chef directory is found
-    def self.chef_config_dir
-      if @@chef_config_dir.nil? # share this with subclasses
-        @@chef_config_dir = false
-        full_path = working_directory.split(File::SEPARATOR)
-        (full_path.length - 1).downto(0) do |i|
-          candidate_directory = File.join(full_path[0..i] + [".chef" ])
-          if File.exist?(candidate_directory) && File.directory?(candidate_directory)
-            @@chef_config_dir = candidate_directory
-            break
-          end
-        end
-      end
-      @@chef_config_dir
-    end
-
-
     public
 
     # Create a new instance of the current class configured for the given
@@ -322,39 +325,6 @@ class Chef
       config_file_settings
     end
 
-    def self.config_fetcher(candidate_config)
-      Chef::ConfigFetcher.new(candidate_config, Chef::Config.config_file_jail)
-    end
-
-    def self.locate_config_file
-      candidate_configs = []
-
-      # Look for $KNIFE_HOME/knife.rb (allow multiple knives config on same machine)
-      if ENV['KNIFE_HOME']
-        candidate_configs << File.join(ENV['KNIFE_HOME'], 'knife.rb')
-      end
-      # Look for $PWD/knife.rb
-      if Dir.pwd
-        candidate_configs << File.join(Dir.pwd, 'knife.rb')
-      end
-      # Look for $UPWARD/.chef/knife.rb
-      if chef_config_dir
-        candidate_configs << File.join(chef_config_dir, 'knife.rb')
-      end
-      # Look for $HOME/.chef/knife.rb
-      if ENV['HOME']
-        candidate_configs << File.join(ENV['HOME'], '.chef', 'knife.rb')
-      end
-
-      candidate_configs.each do | candidate_config |
-        fetcher = config_fetcher(candidate_config)
-        if !fetcher.config_missing?
-          return candidate_config
-        end
-      end
-      return nil
-    end
-
     # Apply Config in this order:
     # defaults from mixlib-cli
     # settings from config file, via Chef::Config[:knife]
@@ -386,6 +356,8 @@ class Chef
         Chef::Config[:log_level] = :debug
       end
 
+      Chef::Config[:log_level] = :debug if ENV['KNIFE_DEBUG']
+
       Chef::Config[:node_name]         = config[:node_name]       if config[:node_name]
       Chef::Config[:client_key]        = config[:client_key]      if config[:client_key]
       Chef::Config[:chef_server_url]   = config[:chef_server_url] if config[:chef_server_url]
@@ -416,70 +388,13 @@ class Chef
     end
 
     def configure_chef
-      if !config[:config_file]
-        located_config_file = self.class.locate_config_file
-        config[:config_file] = located_config_file if located_config_file
-      end
-
-      # Don't try to load a knife.rb if it wasn't specified.
-      if config[:config_file]
-        Chef::Config.config_file = config[:config_file]
-        fetcher = Chef::ConfigFetcher.new(config[:config_file], Chef::Config.config_file_jail)
-        if fetcher.config_missing?
-          ui.error("Specified config file #{config[:config_file]} does not exist#{Chef::Config.config_file_jail ? " or is not under config file jail #{Chef::Config.config_file_jail}" : ""}!")
-          exit 1
-        end
-        Chef::Log.debug("Using configuration from #{config[:config_file]}")
-        read_config(fetcher.read_config, config[:config_file])
-      else
-        # ...but do log a message if no config was found.
-        Chef::Config[:color] = config[:color]
-        ui.warn("No knife configuration file found")
-      end
+      config_loader = self.class.load_config(config[:config_file])
+      config[:config_file] = config_loader.config_location
 
       merge_configs
       apply_computed_config
     end
 
-    def read_config(config_content, config_file_path)
-      Chef::Config.from_string(config_content, config_file_path)
-    rescue SyntaxError => e
-      ui.error "You have invalid ruby syntax in your config file #{config_file_path}"
-      ui.info(ui.color(e.message, :red))
-      if file_line = e.message[/#{Regexp.escape(config_file_path)}:[\d]+/]
-        line = file_line[/:([\d]+)$/, 1].to_i
-        highlight_config_error(config_file_path, line)
-      end
-      exit 1
-    rescue Exception => e
-      ui.error "You have an error in your config file #{config_file_path}"
-      ui.info "#{e.class.name}: #{e.message}"
-      filtered_trace = e.backtrace.grep(/#{Regexp.escape(config_file_path)}/)
-      filtered_trace.each {|line| ui.msg("  " + ui.color(line, :red))}
-      if !filtered_trace.empty?
-        line_nr = filtered_trace.first[/#{Regexp.escape(config_file_path)}:([\d]+)/, 1]
-        highlight_config_error(config_file_path, line_nr.to_i)
-      end
-
-      exit 1
-    end
-
-    def highlight_config_error(file, line)
-      config_file_lines = []
-      IO.readlines(file).each_with_index {|l, i| config_file_lines << "#{(i + 1).to_s.rjust(3)}: #{l.chomp}"}
-      if line == 1
-        lines = config_file_lines[0..3]
-        lines[0] = ui.color(lines[0], :red)
-      else
-        lines = config_file_lines[Range.new(line - 2, line)]
-        lines[1] = ui.color(lines[1], :red)
-      end
-      ui.msg ""
-      ui.msg ui.color("     # #{file}", :white)
-      lines.each {|l| ui.msg(l)}
-      ui.msg ""
-    end
-
     def show_usage
       stdout.puts("USAGE: " + self.opt_parser.to_s)
     end