chef 12.0.0.alpha.2-x86-mingw32 → 12.0.0.rc.0-x86-mingw32

data/spec/unit/knife/data_bag_secret_options_spec.rb

@@ -0,0 +1,165 @@
+#
+# Author:: Tyler Ball (<tball@opscode.com>)
+# Copyright:: Copyright (c) 2009-2014 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'spec_helper'
+require 'chef/knife'
+require 'chef/config'
+require 'tempfile'
+
+class ExampleDataBagCommand < Chef::Knife
+  include Chef::Knife::DataBagSecretOptions
+end
+
+describe Chef::Knife::DataBagSecretOptions do
+  let(:example_db) do
+    k = ExampleDataBagCommand.new
+    allow(k.ui).to receive(:stdout).and_return(stdout)
+    k
+  end
+
+  let(:stdout) { StringIO.new }
+
+  let(:secret) { "abc123SECRET" }
+  let(:secret_file) do
+    sfile = Tempfile.new("encrypted_data_bag_secret")
+    sfile.puts(secret)
+    sfile.flush
+    sfile
+  end
+
+  after do
+    secret_file.close
+    secret_file.unlink
+  end
+
+  describe "#validate_secrets" do
+
+    it "throws an error when provided with both --secret and --secret-file on the CL" do
+      Chef::Config[:knife][:cl_secret_file] = secret_file.path
+      Chef::Config[:knife][:cl_secret] = secret
+      expect(example_db).to receive(:exit).with(1)
+      expect(example_db.ui).to receive(:fatal).with("Please specify only one of --secret, --secret-file")
+
+      example_db.validate_secrets
+    end
+
+    it "throws an error when provided with `secret` and `secret_file` in knife.rb" do
+      Chef::Config[:knife][:secret_file] = secret_file.path
+      Chef::Config[:knife][:secret] = secret
+      expect(example_db).to receive(:exit).with(1)
+      expect(example_db.ui).to receive(:fatal).with("Please specify only one of 'secret' or 'secret_file' in your config file")
+
+      example_db.validate_secrets
+    end
+
+  end
+
+  describe "#read_secret" do
+
+    it "returns the secret first" do
+      Chef::Config[:knife][:cl_secret] = secret
+      expect(example_db).to receive(:config).and_return({ :secret => secret })
+      expect(example_db.read_secret).to eq(secret)
+    end
+
+    it "returns the secret_file only if secret does not exist" do
+      Chef::Config[:knife][:cl_secret_file] = secret_file.path
+      expect(example_db).to receive(:config).and_return({ :secret_file => secret_file.path })
+      expect(Chef::EncryptedDataBagItem).to receive(:load_secret).with(secret_file.path).and_return("secret file contents")
+      expect(example_db.read_secret).to eq("secret file contents")
+    end
+
+    it "returns the secret from the knife.rb config" do
+      Chef::Config[:knife][:secret_file] = secret_file.path
+      Chef::Config[:knife][:secret] = secret
+      expect(example_db.read_secret).to eq(secret)
+    end
+
+    it "returns the secret_file from the knife.rb config only if the secret does not exist" do
+      Chef::Config[:knife][:secret_file] = secret_file.path
+      expect(Chef::EncryptedDataBagItem).to receive(:load_secret).with(secret_file.path).and_return("secret file contents")
+      expect(example_db.read_secret).to eq("secret file contents")
+    end
+
+  end
+
+  describe "#encryption_secret_provided?" do
+
+    it "returns true if the secret is passed on the CL" do
+      Chef::Config[:knife][:cl_secret] = secret
+      expect(example_db.encryption_secret_provided?).to eq(true)
+    end
+
+    it "returns true if the secret_file is passed on the CL" do
+      Chef::Config[:knife][:cl_secret_file] = secret_file.path
+      expect(example_db.encryption_secret_provided?).to eq(true)
+    end
+
+    it "returns true if --encrypt is passed on the CL and :secret is in config" do
+      expect(example_db).to receive(:config).and_return({ :encrypt => true })
+      Chef::Config[:knife][:secret] = secret
+      expect(example_db.encryption_secret_provided?).to eq(true)
+    end
+
+    it "returns true if --encrypt is passed on the CL and :secret_file is in config" do
+      expect(example_db).to receive(:config).and_return({ :encrypt => true })
+      Chef::Config[:knife][:secret_file] = secret_file.path
+      expect(example_db.encryption_secret_provided?).to eq(true)
+    end
+
+    it "throws an error if --encrypt is passed and there is not :secret or :secret_file in the config" do
+      expect(example_db).to receive(:config).and_return({ :encrypt => true })
+      expect(example_db).to receive(:exit).with(1)
+      expect(example_db.ui).to receive(:fatal).with("No secret or secret_file specified in config, unable to encrypt item.")
+      example_db.encryption_secret_provided?
+    end
+
+    it "returns false if no secret is passed" do
+      expect(example_db).to receive(:config).and_return({})
+      expect(example_db.encryption_secret_provided?).to eq(false)
+    end
+
+    it "returns false if --encrypt is not provided and :secret is in the config" do
+      expect(example_db).to receive(:config).and_return({})
+      Chef::Config[:knife][:secret] = secret
+      expect(example_db.encryption_secret_provided?).to eq(false)
+    end
+
+    it "returns false if --encrypt is not provided and :secret_file is in the config" do
+      expect(example_db).to receive(:config).and_return({})
+      Chef::Config[:knife][:secret_file] = secret_file.path
+      expect(example_db.encryption_secret_provided?).to eq(false)
+    end
+
+    it "returns true if --encrypt is not provided, :secret is in the config and need_encrypt_flag is false" do
+      Chef::Config[:knife][:secret] = secret
+      expect(example_db.encryption_secret_provided_ignore_encrypt_flag?).to eq(true)
+    end
+
+    it "returns true if --encrypt is not provided, :secret_file is in the config and need_encrypt_flag is false" do
+      Chef::Config[:knife][:secret_file] = secret_file.path
+      expect(example_db.encryption_secret_provided_ignore_encrypt_flag?).to eq(true)
+    end
+
+    it "returns false if --encrypt is not provided and need_encrypt_flag is false" do
+      expect(example_db.encryption_secret_provided_ignore_encrypt_flag?).to eq(false)
+    end
+
+  end
+
+end

data/spec/unit/knife/data_bag_show_spec.rb

@@ -25,97 +25,99 @@ require 'chef/json_compat'
 require 'tempfile'
 
 describe Chef::Knife::DataBagShow do
+
   before do
-    Chef::Config[:node_name]  = "webmonkey.example.com"
-    @knife = Chef::Knife::DataBagShow.new
-    @knife.config[:format] = 'json'
-    @rest = double("Chef::REST")
-    allow(@knife).to receive(:rest).and_return(@rest)
-    @stdout = StringIO.new
-    allow(@knife.ui).to receive(:stdout).and_return(@stdout)
+    Chef::Config[:node_name] = "webmonkey.example.com"
+    knife.name_args = [bag_name, item_name]
+    allow(knife).to receive(:config).and_return(config)
   end
 
-
-  it "prints the ids of the data bag items when given a bag name" do
-    @knife.instance_variable_set(:@name_args, ['bag_o_data'])
-    data_bag_contents = { "baz"=>"http://localhost:4000/data/bag_o_data/baz",
-      "qux"=>"http://localhost:4000/data/bag_o_data/qux"}
-    expect(Chef::DataBag).to receive(:load).and_return(data_bag_contents)
-    expected = %q|[
-  "baz",
-  "qux"
-]|
-    @knife.run
-    expect(@stdout.string.strip).to eq(expected)
+  let(:knife) do
+    k = Chef::Knife::DataBagShow.new
+    allow(k).to receive(:rest).and_return(rest)
+    allow(k.ui).to receive(:stdout).and_return(stdout)
+    k
   end
 
-  it "prints the contents of the data bag item when given a bag and item name" do
-    @knife.instance_variable_set(:@name_args, ['bag_o_data', 'an_item'])
-    data_item = Chef::DataBagItem.new.tap {|item| item.raw_data = {"id" => "an_item", "zsh" => "victory_through_tabbing"}}
+  let(:rest) { double("Chef::REST") }
+  let(:stdout) { StringIO.new }
 
-    expect(Chef::DataBagItem).to receive(:load).with('bag_o_data', 'an_item').and_return(data_item)
-
-    @knife.run
-    expect(Chef::JSONCompat.from_json(@stdout.string)).to eq(data_item.raw_data)
-  end
+  let(:bag_name) { "sudoing_admins" }
+  let(:item_name) { "ME" }
 
-  it "should pretty print the data bag contents" do
-    @knife.instance_variable_set(:@name_args, ['bag_o_data', 'an_item'])
-    data_item = Chef::DataBagItem.new.tap {|item| item.raw_data = {"id" => "an_item", "zsh" => "victory_through_tabbing"}}
+  let(:data_bag_contents) { { "id" => "id", "baz"=>"http://localhost:4000/data/bag_o_data/baz",
+                        "qux"=>"http://localhost:4000/data/bag_o_data/qux"} }
+  let(:enc_hash) {Chef::EncryptedDataBagItem.encrypt_data_bag_item(data_bag_contents, secret)}
+  let(:data_bag) {Chef::DataBagItem.from_hash(data_bag_contents)}
+  let(:data_bag_with_encoded_hash) { Chef::DataBagItem.from_hash(enc_hash) }
+  let(:enc_data_bag) { Chef::EncryptedDataBagItem.new(enc_hash, secret) }
 
-    expect(Chef::DataBagItem).to receive(:load).with('bag_o_data', 'an_item').and_return(data_item)
+  let(:secret) { "abc123SECRET" }
+  #
+  # let(:raw_hash)  {{ "login_name" => "alphaomega", "id" => item_name }}
+  #
+  let(:config) { {format: "json"} }
 
-    @knife.run
-    expect(@stdout.string).to eql("{\n  \"id\": \"an_item\",\n  \"zsh\": \"victory_through_tabbing\"\n}\n")
-  end
+  context "Data bag to show is encrypted" do
+    before do
+      allow(knife).to receive(:encrypted?).and_return(true)
+    end
 
-  describe "encrypted data bag items" do
-    before(:each) do
-      @secret = "abc123SECRET"
-      @plain_data = {
-        "id" => "item_name",
-        "greeting" => "hello",
-        "nested" => { "a1" => [1, 2, 3], "a2" => { "b1" => true }}
-      }
-      @enc_data = Chef::EncryptedDataBagItem.encrypt_data_bag_item(@plain_data,
-                                                                   @secret)
-      @knife.instance_variable_set(:@name_args, ['bag_name', 'item_name'])
-
-      @secret_file = Tempfile.new("encrypted_data_bag_secret_file_test")
-      @secret_file.puts(@secret)
-      @secret_file.flush
+    it "decrypts and displays the encrypted data bag when the secret is provided" do
+      expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(true)
+      expect(knife).to receive(:read_secret).and_return(secret)
+      expect(Chef::DataBagItem).to receive(:load).with(bag_name, item_name).and_return(data_bag_with_encoded_hash)
+      expect(knife.ui).to receive(:info).with("Encrypted data bag detected, decrypting with provided secret.")
+      expect(Chef::EncryptedDataBagItem).to receive(:load).with(bag_name, item_name, secret).and_return(enc_data_bag)
+
+      expected = %q|baz: http://localhost:4000/data/bag_o_data/baz
+id:  id
+qux: http://localhost:4000/data/bag_o_data/qux|
+      knife.run
+      expect(stdout.string.strip).to eq(expected)
     end
 
-    after do
-      @secret_file.close
-      @secret_file.unlink
+    it "displays the encrypted data bag when the secret is not provided" do
+      expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(false)
+      expect(Chef::DataBagItem).to receive(:load).with(bag_name, item_name).and_return(data_bag_with_encoded_hash)
+      expect(knife.ui).to receive(:warn).with("Encrypted data bag detected, but no secret provided for decoding.  Displaying encrypted data.")
+
+      knife.run
+      expect(stdout.string.strip).to include("baz", "qux", "cipher")
     end
+  end
 
-    it "prints the decrypted contents of an item when given --secret" do
-      allow(@knife).to receive(:config).and_return({:secret => @secret})
-      expect(Chef::EncryptedDataBagItem).to receive(:load).
-        with('bag_name', 'item_name', @secret).
-        and_return(Chef::EncryptedDataBagItem.new(@enc_data, @secret))
-      @knife.run
-      expect(Chef::JSONCompat.from_json(@stdout.string)).to eq(@plain_data)
+  context "Data bag to show is not encrypted" do
+    before do
+      allow(knife).to receive(:encrypted?).and_return(false)
+      expect(knife).to receive(:read_secret).exactly(0).times
     end
 
-    it "prints the decrypted contents of an item when given --secret_file" do
-      allow(@knife).to receive(:config).and_return({:secret_file => @secret_file.path})
-      expect(Chef::EncryptedDataBagItem).to receive(:load).
-        with('bag_name', 'item_name', @secret).
-        and_return(Chef::EncryptedDataBagItem.new(@enc_data, @secret))
-      @knife.run
-      expect(Chef::JSONCompat.from_json(@stdout.string)).to eq(@plain_data)
+    it "displays the data bag" do
+      expect(Chef::DataBagItem).to receive(:load).with(bag_name, item_name).and_return(data_bag)
+      expect(knife.ui).to receive(:info).with("Unencrypted data bag detected, ignoring any provided secret options.")
+
+      expected = %q|baz: http://localhost:4000/data/bag_o_data/baz
+id:  id
+qux: http://localhost:4000/data/bag_o_data/qux|
+      knife.run
+      expect(stdout.string.strip).to eq(expected)
     end
   end
 
-  describe "command line parsing" do
-    it "prints help if given no arguments" do
-      @knife.instance_variable_set(:@name_args, [])
-      expect { @knife.run }.to raise_error(SystemExit)
-      expect(@stdout.string).to match(/^knife data bag show BAG \[ITEM\] \(options\)/)
-    end
+  it "displays the list of items in the data bag when only one @name_arg is provided" do
+    knife.name_args = [bag_name]
+    expect(Chef::DataBag).to receive(:load).with(bag_name).and_return({})
+
+    knife.run
+    expect(stdout.string.strip).to eq("")
+  end
+
+  it "raises an error when no @name_args are provided" do
+    knife.name_args = []
+
+    expect {knife.run}.to exit_with_code(1)
+    expect(stdout.string).to start_with("knife data bag show BAG [ITEM] (options)")
   end
 
 end

data/spec/unit/knife/environment_from_file_spec.rb

@@ -23,6 +23,7 @@ Chef::Knife::EnvironmentFromFile.load_deps
 
 describe Chef::Knife::EnvironmentFromFile do
   before(:each) do
+    Chef::Platform.stub(:windows?) { false }
     @knife = Chef::Knife::EnvironmentFromFile.new
     @stdout = StringIO.new
     @knife.ui.stub(:stdout).and_return(@stdout)
@@ -57,8 +58,8 @@ describe Chef::Knife::EnvironmentFromFile do
       end
 
       it "loads all environments with -a" do
-        File.stub(:expand_path).with("./environments/*.{json,rb}").and_return("/tmp/environments")
-        Dir.stub(:glob).with("/tmp/environments").and_return(["spec.rb", "apple.rb"])
+        File.stub(:expand_path).with("./environments/").and_return("/tmp/environments")
+        Dir.stub(:glob).with("/tmp/environments/*.{json,rb}").and_return(["spec.rb", "apple.rb"])
         @knife.name_args = []
         @knife.stub(:config).and_return({:all => true})
         @environment.should_receive(:save).twice

data/spec/unit/knife/ssl_check_spec.rb

@@ -95,6 +95,49 @@ E
     end
   end
 
+  describe "verifying trusted certificate X509 properties" do
+    let(:name_args) { %w{https://foo.example.com:8443} }
+
+    let(:trusted_certs_dir) { File.join(CHEF_SPEC_DATA, "trusted_certs") }
+    let(:trusted_cert_file) { File.join(trusted_certs_dir, "example.crt") }
+
+    let(:store) { OpenSSL::X509::Store.new }
+    let(:certificate) { OpenSSL::X509::Certificate.new(IO.read(trusted_cert_file)) }
+
+    before do
+      Chef::Config[:trusted_certs_dir] = trusted_certs_dir
+      ssl_check.stub(:trusted_certificates).and_return([trusted_cert_file])
+      store.stub(:add_cert).with(certificate)
+      OpenSSL::X509::Store.stub(:new).and_return(store)
+      OpenSSL::X509::Certificate.stub(:new).with(IO.read(trusted_cert_file)).and_return(certificate)
+      ssl_check.stub(:verify_cert).and_return(true)
+      ssl_check.stub(:verify_cert_host).and_return(true)
+    end
+
+    context "when the trusted certificates have valid X509 properties" do
+      before do
+        store.stub(:verify).with(certificate).and_return(true)
+      end
+
+      it "does not generate any X509 warnings" do
+        expect(ssl_check.ui).not_to receive(:warn).with(/There are invalid certificates in your trusted_certs_dir/)
+        ssl_check.run
+      end
+    end
+
+    context "when the trusted certificates have invalid X509 properties" do
+      before do
+        store.stub(:verify).with(certificate).and_return(false)
+        store.stub(:error_string).and_return("unable to get local issuer certificate")
+      end
+
+      it "generates a warning message with invalid certificate file names" do
+        expect(ssl_check.ui).to receive(:warn).with(/#{trusted_cert_file}: unable to get local issuer certificate/)
+        ssl_check.run
+      end
+    end
+  end
+
   describe "verifying the remote certificate" do
     let(:name_args) { %w{https://foo.example.com:8443} }
 
@@ -117,6 +160,7 @@ E
     context "when the remote host's certificate is valid" do
 
       before do
+        ssl_check.should_receive(:verify_X509).and_return(true) # X509 valid certs (no warn)
         ssl_socket.should_receive(:connect) # no error
         ssl_socket.should_receive(:post_connection_check).with("foo.example.com") # no error
       end
@@ -148,6 +192,7 @@ E
 
       context "when the certificate's CN does not match the hostname" do
         before do
+          ssl_check.should_receive(:verify_X509).and_return(true) # X509 valid certs
           ssl_socket.should_receive(:connect) # no error
           ssl_socket.should_receive(:post_connection_check).
             with("foo.example.com").
@@ -167,6 +212,7 @@ E
 
       context "when the cert is not signed by any trusted authority" do
         before do
+          ssl_check.should_receive(:verify_X509).and_return(true) # X509 valid certs
           ssl_socket.should_receive(:connect).
             and_raise(OpenSSL::SSL::SSLError)
           ssl_socket_for_debug.should_receive(:connect)
@@ -184,4 +230,3 @@ E
   end
 
 end
-

data/spec/unit/knife/status_spec.rb

@@ -17,7 +17,6 @@
 #
 
 require 'spec_helper'
-require 'highline'
 
 describe Chef::Knife::Status do
   before(:each) do
@@ -30,7 +29,7 @@ describe Chef::Knife::Status do
     Chef::Search::Query.stub(:new).and_return(query)
     @knife  = Chef::Knife::Status.new
     @stdout = StringIO.new
-    @knife.stub(:highline).and_return(HighLine.new(StringIO.new, @stdout))
+    @knife.ui.stub(:stdout).and_return(@stdout)
   end
 
   describe "run" do