chef 12.19.36 → 14.14.25

data/lib/chef/provider/package/yum/yum_helper.py

@@ -0,0 +1,211 @@
+#!/usr/bin/env python3
+# vim: tabstop=8 expandtab shiftwidth=4 softtabstop=4
+
+#
+# NOTE: this actually needs to run under python2.4 and centos 5.x through python3 and centos 7.x
+# please manually test changes on centos5 boxes or you will almost certainly break things.
+#
+
+import sys
+import yum
+import signal
+import os
+sys.path.append(os.path.join(os.path.dirname(__file__), '..', 'simplejson'))
+try: import json
+except ImportError: import simplejson as json
+import re
+from rpmUtils.miscutils import stringToVersion,compareEVR
+from rpmUtils.arch import getBaseArch, getArchList
+
+
+try: from yum.misc import string_to_prco_tuple
+except ImportError:
+    # RHEL5 compat
+    def string_to_prco_tuple(prcoString):
+        prco_split = prcoString.split()
+        n, f, v = prco_split
+        (prco_e, prco_v, prco_r) = stringToVersion(v)
+        return (n, f, (prco_e, prco_v, prco_r))
+
+# hack to work around https://github.com/chef/chef/issues/7126
+# see https://bugzilla.redhat.com/show_bug.cgi?id=1396248
+if not hasattr(yum.packages.FakeRepository, 'compare_providers_priority'):
+    yum.packages.FakeRepository.compare_providers_priority = 99
+
+base = None
+
+def get_base():
+    global base
+    if base is None:
+        base = yum.YumBase()
+    setup_exit_handler()
+    return base
+
+def versioncompare(versions):
+    arch_list = getArchList()
+    candidate_arch1 = versions[0].split(".")[-1]
+    candidate_arch2 = versions[1].split(".")[-1]
+
+    # The first version number passed to this method is always a valid nevra (the current version)
+    # If the second version number looks like it does not contain a valid arch
+    # then we'll chop the arch component (assuming it *is* a valid one) from the first version string
+    # so we're only comparing the evr portions.
+    if (candidate_arch2 not in arch_list) and (candidate_arch1 in arch_list):
+       final_version1 = versions[0].replace("." + candidate_arch1,"")
+    else:
+       final_version1 = versions[0]
+
+    final_version2 = versions[1]
+
+    (e1, v1, r1) = stringToVersion(final_version1)
+    (e2, v2, r2) = stringToVersion(final_version2)
+
+    evr_comparison = compareEVR((e1, v1, r1), (e2, v2, r2))
+    outpipe.write("%(e)s\n" % { 'e': evr_comparison })
+    outpipe.flush()
+
+def install_only_packages(name):
+    base = get_base()
+    if name in base.conf.installonlypkgs:
+      outpipe.write('True')
+    else:
+      outpipe.write('False')
+    outpipe.flush()
+
+# python2.4 / centos5 compat
+try:
+    any
+except NameError:
+    def any(s):
+        for v in s:
+            if v:
+                return True
+        return False
+
+def query(command):
+    base = get_base()
+
+    enabled_repos = base.repos.listEnabled()
+
+    # Handle any repocontrols passed in with our options
+
+    if 'repos' in command:
+      for repo in command['repos']:
+        if 'enable' in repo:
+          base.repos.enableRepo(repo['enable'])
+        if 'disable' in repo:
+          base.repos.disableRepo(repo['disable'])
+
+    args = { 'name': command['provides'] }
+    do_nevra = False
+    if 'epoch' in command:
+        args['epoch'] = command['epoch']
+        do_nevra = True
+    if 'version' in command:
+        args['ver'] = command['version']
+        do_nevra = True
+    if 'release' in command:
+        args['rel'] = command['release']
+        do_nevra = True
+    if 'arch' in command:
+        desired_arch = command['arch']
+        args['arch'] = command['arch']
+        do_nevra = True
+    else:
+        desired_arch = getBaseArch()
+
+    obj = None
+    if command['action'] == "whatinstalled":
+        obj = base.rpmdb
+    else:
+        obj = base.pkgSack
+
+    # if we are given "name == 1.2.3" then we must use the getProvides() API.
+    #   - this means that we ignore arch and version properties when given prco tuples as a package_name
+    #   - in order to fix this, something would have to happen where getProvides was called first and
+    #     then the result was searchNevra'd.  please be extremely careful if attempting to fix that
+    #     since searchNevra does not support prco tuples.
+    if bool(re.search('\\s+', command['provides'])):
+        # handles flags (<, >, =, etc) and versions, but no wildcareds
+        # raises error for any invalid input like: 'FOO BAR BAZ' 
+        pkgs = obj.getProvides(*string_to_prco_tuple(command['provides']))
+    elif do_nevra:
+        # now if we're given version or arch properties explicitly, then we do a SearchNevra.
+        #  - this means that wildcard version in the package_name with an arch property will not work correctly
+        #  - again don't try to fix this just by pushing bugs around in the code, you would need to call
+        #    returnPackages and searchProvides and then apply the Nevra filters to those results.
+        pkgs = obj.searchNevra(**args)
+        if (command['action'] == "whatinstalled") and (not pkgs):
+          pkgs = obj.searchNevra(name=args['name'], arch=desired_arch)
+    else:
+        pats = [command['provides']]
+        pkgs = obj.returnPackages(patterns=pats)
+
+        if not pkgs:
+            # handles wildcards
+            pkgs = obj.searchProvides(command['provides'])
+
+    if not pkgs:
+        outpipe.write(command['provides'].split().pop(0)+' nil nil\n')
+        outpipe.flush()
+    else:
+        # make sure we picked the package with the highest version
+        pkgs = base.bestPackagesFromList(pkgs,single_name=True)
+        pkg = pkgs.pop(0)
+        outpipe.write("%(n)s %(e)s:%(v)s-%(r)s %(a)s\n" % { 'n': pkg.name, 'e': pkg.epoch, 'v': pkg.version, 'r': pkg.release, 'a': pkg.arch })
+        outpipe.flush()
+
+    # Reset any repos we were passed in enablerepo/disablerepo to the original state in enabled_repos
+    if 'repos' in command:
+      for repo in command['repos']:
+        if 'enable' in repo:
+          if base.repos.getRepo(repo['enable']) not in enabled_repos:
+            base.repos.disableRepo(repo['enable'])
+        if 'disable' in repo:
+          if base.repos.getRepo(repo['disable']) in enabled_repos:
+            base.repos.enableRepo(repo['disable'])
+
+# the design of this helper is that it should try to be 'brittle' and fail hard and exit in order
+# to keep process tables clean.  additional error handling should probably be added to the retry loop
+# on the ruby side.
+def exit_handler(signal, frame):
+    base.closeRpmDB()
+    sys.exit(0)
+
+def setup_exit_handler():
+    signal.signal(signal.SIGINT, exit_handler)
+    signal.signal(signal.SIGHUP, exit_handler)
+    signal.signal(signal.SIGPIPE, exit_handler)
+    signal.signal(signal.SIGQUIT, exit_handler)
+
+if len(sys.argv) < 3:
+  inpipe = sys.stdin
+  outpipe = sys.stdout
+else:
+  inpipe = os.fdopen(int(sys.argv[1]), "r")
+  outpipe = os.fdopen(int(sys.argv[2]), "w")
+
+while 1:
+    # kill self if we get orphaned (tragic)
+    ppid = os.getppid()
+    if ppid == 1:
+        sys.exit(0)
+    setup_exit_handler()
+    line = inpipe.readline()
+
+    try:
+        command = json.loads(line)
+    except ValueError, e:
+        base.closeRpmDB()
+        sys.exit(0)
+
+    if command['action'] == "whatinstalled":
+        query(command)
+    elif command['action'] == "whatavailable":
+        query(command)
+    elif command['action'] == "versioncompare":
+        versioncompare(command['versions'])
+    elif command['action'] == "installonlypkgs":
+         install_only_packages(command['package'])
+    else:
+        raise RuntimeError("bad command")

data/lib/chef/provider/package/zypper.rb

@@ -2,7 +2,7 @@
 #
 # Authors:: Adam Jacob (<adam@chef.io>)
 #           Ionuț Arțăriși (<iartarisi@suse.cz>)
-# Copyright:: Copyright 2008-2016, Chef Software, Inc.
+# Copyright:: Copyright 2008-2017, Chef Software Inc.
 #             Copyright 2013-2016, SUSE Linux GmbH
 # License:: Apache License, Version 2.0
 #
@@ -29,27 +29,27 @@ class Chef
         use_multipackage_api
 
         provides :package, platform_family: "suse"
-        provides :zypper_package, os: "linux"
+        provides :zypper_package
 
         def get_versions(package_name)
           candidate_version = current_version = nil
           is_installed = false
-          Chef::Log.debug("#{new_resource} checking zypper")
-          status = shell_out_compact_timeout!("zypper", "--non-interactive", "info", package_name)
+          logger.trace("#{new_resource} checking zypper")
+          status = shell_out!("zypper", "--non-interactive", "info", package_name)
           status.stdout.each_line do |line|
             case line
             when /^Version *: (.+) *$/
               candidate_version = $1.strip
-              Chef::Log.debug("#{new_resource} version #{candidate_version}")
-            when /^Installed *: Yes *$/
+              logger.trace("#{new_resource} version #{candidate_version}")
+            when /^Installed *: Yes.*$/ # http://rubular.com/r/9StcAMjOn6
               is_installed = true
-              Chef::Log.debug("#{new_resource} is installed")
+              logger.trace("#{new_resource} is installed")
             when /^Status *: out-of-date \(version (.+) installed\) *$/
               current_version = $1.strip
-              Chef::Log.debug("#{new_resource} out of date version #{current_version}")
+              logger.trace("#{new_resource} out of date version #{current_version}")
             end
           end
-          current_version = candidate_version if is_installed
+          current_version ||= candidate_version if is_installed
           { current_version: current_version, candidate_version: candidate_version }
         end
 
@@ -75,16 +75,22 @@ class Chef
           end
         end
 
-        def package_locked(name, version)
-          islocked = false
-          locked = shell_out_compact_timeout!("zypper", "locks")
-          locked.stdout.each_line do |line|
-            line_package = line.split("|").shift(2).last.strip
-            if line_package == name
-              islocked = true
+        def packages_all_locked?(names, versions)
+          names.all? { |n| locked_packages.include? n }
+        end
+
+        def packages_all_unlocked?(names, versions)
+          names.all? { |n| !locked_packages.include? n }
+        end
+
+        def locked_packages
+          @locked_packages ||=
+            begin
+              locked = shell_out!("zypper", "locks")
+              locked.stdout.each_line.map do |line|
+                line.split("|").shift(2).last.strip
+              end
             end
-          end
-          islocked
         end
 
         def load_current_resource
@@ -103,7 +109,7 @@ class Chef
         end
 
         def install_package(name, version)
-          zypper_package("install", "--auto-agree-with-licenses", name, version)
+          zypper_package("install", global_options, *options, "--auto-agree-with-licenses", allow_downgrade, name, version)
         end
 
         def upgrade_package(name, version)
@@ -112,19 +118,19 @@ class Chef
         end
 
         def remove_package(name, version)
-          zypper_package("remove", name, version)
+          zypper_package("remove", global_options, *options, name, version)
         end
 
         def purge_package(name, version)
-          zypper_package("remove", "--clean-deps", name, version)
+          zypper_package("remove", global_options, *options, "--clean-deps", name, version)
         end
 
         def lock_package(name, version)
-          zypper_package("addlock", name, version)
+          zypper_package("addlock", global_options, *options, name, version)
         end
 
         def unlock_package(name, version)
-          zypper_package("removelock", name, version)
+          zypper_package("removelock", global_options, *options, name, version)
         end
 
         private
@@ -135,27 +141,25 @@ class Chef
           end
         end
 
-        def zypper_package(command, *options, names, versions)
+        def zypper_package(command, global_options, *options, names, versions)
           zipped_names = zip(names, versions)
           if zypper_version < 1.0
-            shell_out_compact_timeout!("zypper", gpg_checks, command, *options, "-y", names)
+            shell_out!("zypper", global_options, gpg_checks, command, *options, "-y", names)
           else
-            shell_out_compact_timeout!("zypper", "--non-interactive", gpg_checks, command, *options, zipped_names)
+            shell_out!("zypper", global_options, "--non-interactive", gpg_checks, command, *options, zipped_names)
           end
         end
 
         def gpg_checks
-          case Chef::Config[:zypper_check_gpg]
-          when true
-            nil
-          when false
-            "--no-gpg-checks"
-          when nil
-            Chef::Log.warn("Chef::Config[:zypper_check_gpg] was not set. " \
-              "All packages will be installed without gpg signature checks. " \
-              "This is a security hazard.")
-            "--no-gpg-checks"
-          end
+          "--no-gpg-checks" unless new_resource.gpg_check
+        end
+
+        def allow_downgrade
+          "--oldpackage" if new_resource.allow_downgrade
+        end
+
+        def global_options
+          new_resource.global_options if new_resource.global_options
         end
       end
     end

data/lib/chef/provider/powershell_script.rb

@@ -23,7 +23,7 @@ class Chef
   class Provider
     class PowershellScript < Chef::Provider::WindowsScript
 
-      provides :powershell_script, os: "windows"
+      provides :powershell_script
 
       def initialize(new_resource, run_context)
         super(new_resource, run_context, ".ps1")
@@ -73,8 +73,8 @@ class Chef
       # special handling to cover common use cases.
       def add_exit_status_wrapper
         self.code = wrapper_script
-        Chef::Log.debug("powershell_script provider called with script code:\n\n#{new_resource.code}\n")
-        Chef::Log.debug("powershell_script provider will execute transformed code:\n\n#{code}\n")
+        logger.trace("powershell_script provider called with script code:\n\n#{new_resource.code}\n")
+        logger.trace("powershell_script provider will execute transformed code:\n\n#{code}\n")
       end
 
       def validate_script_syntax!
@@ -85,10 +85,10 @@ class Chef
           # in that block will still trigger a syntax error which is
           # exactly what we want here -- verify the syntax without
           # actually running the script.
-          user_code_wrapped_in_powershell_script_block = <<-EOH
-{
-  #{new_resource.code}
-}
+          user_code_wrapped_in_powershell_script_block = <<~EOH
+            {
+              #{new_resource.code}
+            }
 EOH
           user_script_file.puts user_code_wrapped_in_powershell_script_block
 
@@ -129,7 +129,7 @@ EOH
           "-NonInteractive",
           "-NoProfile",
           "-ExecutionPolicy #{execution_policy}",
-          # Powershell will hang if STDIN is redirected
+          # PowerShell will hang if STDIN is redirected
           # http://connect.microsoft.com/PowerShell/feedback/details/572313/powershell-exe-can-hang-if-stdin-is-redirected
           "-InputFormat None",
         ]
@@ -137,84 +137,84 @@ EOH
 
       # A wrapper script is used to launch user-supplied script while
       # still obtaining useful process exit codes. Unless you
-      # explicitly call exit in Powershell, the powershell.exe
+      # explicitly call exit in PowerShell, the powershell.exe
       # interpreter returns only 0 for success or 1 for failure. Since
       # we'd like to get specific exit codes from executable tools run
-      # with Powershell, we do some work using the automatic variables
+      # with PowerShell, we do some work using the automatic variables
       # $? and $LASTEXITCODE to return the process exit code of the
       # last process run in the script if it is the last command
       # executed, otherwise 0 or 1 based on whether $? is set to true
       # (success, where we return 0) or false (where we return 1).
       def wrapper_script
-        <<-EOH
-# Chef Client wrapper for powershell_script resources
-
-# In rare cases, such as when PowerShell is executed
-# as an alternate user, the new-variable cmdlet is not
-# available, so import it just in case
-if ( get-module -ListAvailable Microsoft.PowerShell.Utility )
-{
-    Import-Module Microsoft.PowerShell.Utility
-}
-
-# LASTEXITCODE can be uninitialized -- make it explictly 0
-# to avoid incorrect detection of failure (non-zero) codes
-$global:LASTEXITCODE = 0
-
-# Catch any exceptions -- without this, exceptions will result
-# In a zero return code instead of the desired non-zero code
-# that indicates a failure
-trap [Exception] {write-error ($_.Exception.Message);exit 1}
-
-# Variable state that should not be accessible to the user code
-new-variable -name interpolatedexitcode -visibility private -value $#{new_resource.convert_boolean_return}
-new-variable -name chefscriptresult -visibility private
-
-# Initialize a variable we use to capture $? inside a block
-$global:lastcmdlet = $null
-
-# Execute the user's code in a script block --
-$chefscriptresult =
-{
- #{new_resource.code}
-
- # This assignment doesn't affect the block's return value
- $global:lastcmdlet = $?
-}.invokereturnasis()
-
-# Assume failure status of 1 -- success cases
-# will have to override this
-$exitstatus = 1
-
-# If convert_boolean_return is enabled, the block's return value
-# gets precedence in determining our exit status
-if ($interpolatedexitcode -and $chefscriptresult -ne $null -and $chefscriptresult.gettype().name -eq 'boolean')
-{
-  $exitstatus = [int32](!$chefscriptresult)
-}
-elseif ($lastcmdlet)
-{
-  # Otherwise, a successful cmdlet execution defines the status
-  $exitstatus = 0
-}
-elseif ( $LASTEXITCODE -ne $null -and $LASTEXITCODE -ne 0 )
-{
-  # If the cmdlet status is failed, allow the Win32 status
-  # in $LASTEXITCODE to define exit status. This handles the case
-  # where no cmdlets, only Win32 processes have run since $?
-  # will be set to $false whenever a Win32 process returns a non-zero
-  # status.
-  $exitstatus = $LASTEXITCODE
-}
-
-# Print STDOUT for the script execution
-Write-Output $chefscriptresult
-
-# If this script is launched with -File, the process exit
-# status of PowerShell.exe will be $exitstatus. If it was
-# launched with -Command, it will be 0 if $exitstatus was 0,
-# 1 (i.e. failed) otherwise.
-exit $exitstatus
+        <<~EOH
+          # Chef Client wrapper for powershell_script resources
+
+          # In rare cases, such as when PowerShell is executed
+          # as an alternate user, the new-variable cmdlet is not
+          # available, so import it just in case
+          if ( get-module -ListAvailable Microsoft.PowerShell.Utility )
+          {
+              Import-Module Microsoft.PowerShell.Utility
+          }
+
+          # LASTEXITCODE can be uninitialized -- make it explictly 0
+          # to avoid incorrect detection of failure (non-zero) codes
+          $global:LASTEXITCODE = 0
+
+          # Catch any exceptions -- without this, exceptions will result
+          # In a zero return code instead of the desired non-zero code
+          # that indicates a failure
+          trap [Exception] {write-error ($_.Exception.Message);exit 1}
+
+          # Variable state that should not be accessible to the user code
+          new-variable -name interpolatedexitcode -visibility private -value $#{new_resource.convert_boolean_return}
+          new-variable -name chefscriptresult -visibility private
+
+          # Initialize a variable we use to capture $? inside a block
+          $global:lastcmdlet = $null
+
+          # Execute the user's code in a script block --
+          $chefscriptresult =
+          {
+           #{new_resource.code}
+
+           # This assignment doesn't affect the block's return value
+           $global:lastcmdlet = $?
+          }.invokereturnasis()
+
+          # Assume failure status of 1 -- success cases
+          # will have to override this
+          $exitstatus = 1
+
+          # If convert_boolean_return is enabled, the block's return value
+          # gets precedence in determining our exit status
+          if ($interpolatedexitcode -and $chefscriptresult -ne $null -and $chefscriptresult.gettype().name -eq 'boolean')
+          {
+            $exitstatus = [int32](!$chefscriptresult)
+          }
+          elseif ($lastcmdlet)
+          {
+            # Otherwise, a successful cmdlet execution defines the status
+            $exitstatus = 0
+          }
+          elseif ( $LASTEXITCODE -ne $null -and $LASTEXITCODE -ne 0 )
+          {
+            # If the cmdlet status is failed, allow the Win32 status
+            # in $LASTEXITCODE to define exit status. This handles the case
+            # where no cmdlets, only Win32 processes have run since $?
+            # will be set to $false whenever a Win32 process returns a non-zero
+            # status.
+            $exitstatus = $LASTEXITCODE
+          }
+
+          # Print STDOUT for the script execution
+          Write-Output $chefscriptresult
+
+          # If this script is launched with -File, the process exit
+          # status of PowerShell.exe will be $exitstatus. If it was
+          # launched with -Command, it will be 0 if $exitstatus was 0,
+          # 1 (i.e. failed) otherwise.
+          exit $exitstatus
 EOH
       end