chef 14.15.6 → 18.1.0

data/lib/chef/mixin/convert_to_class_name.rb

@@ -1,7 +1,7 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
 # Author:: Christopher Walters (<cw@chef.io>)
-# Copyright:: Copyright 2008-2016, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -25,7 +25,7 @@ class Chef
       def convert_to_class_name(str)
         str = normalize_snake_case_name(str)
         rname = nil
-        regexp = %r{^(.+?)(_(.+))?$}
+        regexp = /^(.+?)(_(.+))?$/
 
         mn = str.match(regexp)
         if mn
@@ -66,61 +66,6 @@ class Chef
         str = base.to_s + (file_base == "default" ? "" : "_#{file_base}")
         normalize_snake_case_name(str)
       end
-
-      # Copied from rails activesupport.  In ruby >= 2.0 const_get will just do this, so this can
-      # be deprecated and removed.
-      #
-      # MIT LICENSE is here: https://github.com/rails/rails/blob/master/activesupport/MIT-LICENSE
-
-      # Tries to find a constant with the name specified in the argument string.
-      #
-      #   'Module'.constantize     # => Module
-      #   'Test::Unit'.constantize # => Test::Unit
-      #
-      # The name is assumed to be the one of a top-level constant, no matter
-      # whether it starts with "::" or not. No lexical context is taken into
-      # account:
-      #
-      #   C = 'outside'
-      #   module M
-      #     C = 'inside'
-      #     C               # => 'inside'
-      #     'C'.constantize # => 'outside', same as ::C
-      #   end
-      #
-      # NameError is raised when the name is not in CamelCase or the constant is
-      # unknown.
-      def constantize(camel_cased_word)
-        names = camel_cased_word.split("::")
-
-        # Trigger a built-in NameError exception including the ill-formed constant in the message.
-        Object.const_get(camel_cased_word) if names.empty?
-
-        # Remove the first blank element in case of '::ClassName' notation.
-        names.shift if names.size > 1 && names.first.empty?
-
-        names.inject(Object) do |constant, name|
-          if constant == Object
-            constant.const_get(name)
-          else
-            candidate = constant.const_get(name)
-            next candidate if constant.const_defined?(name, false)
-            next candidate unless Object.const_defined?(name)
-
-            # Go down the ancestors to check if it is owned directly. The check
-            # stops when we reach Object or the end of ancestors tree.
-            constant = constant.ancestors.inject do |const, ancestor|
-              break const    if ancestor == Object
-              break ancestor if ancestor.const_defined?(name, false)
-              const
-            end
-
-            # owner is in Object, so raise
-            constant.const_get(name, false)
-          end
-        end
-      end
-
     end
   end
 end

data/lib/chef/mixin/create_path.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
-# Copyright:: Copyright 2008-2016, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -29,11 +29,11 @@ class Chef
       # === Returns
       # The created file_path.
       def create_path(file_path)
-        unless file_path.kind_of?(String) || file_path.kind_of?(Array)
+        unless file_path.is_a?(String) || file_path.is_a?(Array)
           raise ArgumentError, "file_path must be a string or an array!"
         end
 
-        if file_path.kind_of?(String)
+        if file_path.is_a?(String)
           file_path = File.expand_path(file_path).split(File::SEPARATOR)
           file_path.shift if file_path[0] == ""
           # Check if path starts with a separator or drive letter (Windows)
@@ -53,14 +53,14 @@ class Chef
       private
 
       def create_dir(path)
-          # When doing multithreaded downloads into the file cache, the following
-          # interleaving raises an error here:
-          #
-          # thread1                                     thread2
-          # File.directory?(create_path) <- false
-          #                                             File.directory?(create_path) <- false
-          #                                             Dir.mkdir(create_path)
-          # Dir.mkdir(create_path) <- raises Errno::EEXIST
+        # When doing multithreaded downloads into the file cache, the following
+        # interleaving raises an error here:
+        #
+        # thread1                                     thread2
+        # File.directory?(create_path) <- false
+        #                                             File.directory?(create_path) <- false
+        #                                             Dir.mkdir(create_path)
+        # Dir.mkdir(create_path) <- raises Errno::EEXIST
         Chef::Log.trace("Creating directory #{path}")
         Dir.mkdir(path)
       rescue Errno::EEXIST

data/lib/chef/mixin/deep_merge.rb

@@ -1,7 +1,7 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
 # Author:: Steve Midgley (http://www.misuse.org/science)
-# Copyright:: Copyright 2009-2016, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # Copyright:: Copyright 2008-2016, Steve Midgley
 # License:: Apache License, Version 2.0
 #
@@ -19,50 +19,65 @@
 
 class Chef
   module Mixin
-    # == Chef::Mixin::DeepMerge
     # Implements a deep merging algorithm for nested data structures.
-    # ==== Notice:
-    #   This code was originally imported from deep_merge by Steve Midgley.
-    #   deep_merge is available under the MIT license from
-    #   http://trac.misuse.org/science/wiki/DeepMerge
+    #
+    # This code was originally imported from deep_merge by Steve Midgley.
+    # deep_merge is available under the MIT license from
+    # http://trac.misuse.org/science/wiki/DeepMerge
+    #
+    # Note that this is not considered a public interface.  It is technically
+    # public and has been used and we cannot break the API, but continued
+    # external use is discouraged.  We are unlikely to change the shape of
+    # the API and break anyone, but this code does not serve the purposes of
+    # cookbook authors and customers.  It is intended only for the purposes
+    # of the internal use in the chef-client codebase.  We do not accept
+    # pull requests to extend the functionality of this algorithm.  Users
+    # who find this does nearly what they want, should copy and paste the
+    # algorithm and tune to their needs.  We will not maintain any additional
+    # use cases.
+    #
+    # "It is what it is, and if it isn't what you want, you need to build
+    # that yourself"
+    #
+    # @api private
+    #
     module DeepMerge
 
       extend self
 
+      # @api private
       def merge(first, second)
-        first  = Mash.new(first)  unless first.kind_of?(Mash)
-        second = Mash.new(second) unless second.kind_of?(Mash)
+        first  = Mash.new(first)  unless first.is_a?(Mash)
+        second = Mash.new(second) unless second.is_a?(Mash)
 
         DeepMerge.deep_merge(second, first)
       end
 
       class InvalidParameter < StandardError; end
 
-      # Deep Merge core documentation.
       # deep_merge! method permits merging of arbitrary child elements. The two top level
       # elements must be hashes. These hashes can contain unlimited (to stack limit) levels
       # of child elements. These child elements to not have to be of the same types.
       # Where child elements are of the same type, deep_merge will attempt to merge them together.
       # Where child elements are not of the same type, deep_merge will skip or optionally overwrite
       # the destination element with the contents of the source element at that level.
+      #
       # So if you have two hashes like this:
+      #
       #   source = {:x => [1,2,3], :y => 2}
       #   dest =   {:x => [4,5,'6'], :y => [7,8,9]}
       #   dest.deep_merge!(source)
       #   Results: {:x => [1,2,3,4,5,'6'], :y => 2}
+      #
       # By default, "deep_merge!" will overwrite any unmergeables and merge everything else.
       # To avoid this, use "deep_merge" (no bang/exclamation mark)
+      #
+      # @api private
+      #
       def deep_merge!(source, dest)
-        # if dest doesn't exist, then simply copy source to it
-        if dest.nil?
-          dest = source; return dest
-        end
-
         case source
-        when nil
-          dest
         when Hash
-          if dest.kind_of?(Hash)
+          if dest.is_a?(Hash)
             source.each do |src_key, src_value|
               if dest.key?(src_key)
                 dest[src_key] = deep_merge!(src_value, dest[src_key])
@@ -74,7 +89,7 @@ class Chef
             dest = source
           end
         when Array
-          if dest.kind_of?(Array)
+          if dest.is_a?(Array)
             dest |= source
           else
             dest = source
@@ -87,10 +102,12 @@ class Chef
         dest
       end # deep_merge!
 
+      # @api private
       def hash_only_merge(merge_onto, merge_with)
         hash_only_merge!(safe_dup(merge_onto), safe_dup(merge_with))
       end
 
+      # @api private
       def safe_dup(thing)
         thing.dup
       rescue TypeError
@@ -101,9 +118,12 @@ class Chef
       # `merge_onto` is the object that will "lose" in case of conflict.
       # `merge_with` is the object whose values will replace `merge_onto`s
       # values when there is a conflict.
+      #
+      # @api private
+      #
       def hash_only_merge!(merge_onto, merge_with)
         # If there are two Hashes, recursively merge.
-        if merge_onto.kind_of?(Hash) && merge_with.kind_of?(Hash)
+        if merge_onto.is_a?(Hash) && merge_with.is_a?(Hash)
           merge_with.each do |key, merge_with_value|
             value =
               if merge_onto.key?(key)
@@ -120,17 +140,14 @@ class Chef
             end
           end
           merge_onto
-
-        # If merge_with is nil, don't replace merge_onto
-        elsif merge_with.nil?
-          merge_onto
-
         # In all other cases, replace merge_onto with merge_with
         else
           merge_with
         end
       end
 
+      # @api private
+      #
       def deep_merge(source, dest)
         deep_merge!(safe_dup(source), safe_dup(dest))
       end

data/lib/chef/{resource/user/dscl_user.rb → mixin/default_paths.rb}

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright 2016-2017, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,16 +15,17 @@
 # limitations under the License.
 #
 
-require "chef/resource/user"
+require "chef-utils/dsl/default_paths" unless defined?(ChefUtils::DSL::DefaultPaths)
 
 class Chef
-  class Resource
-    class User
-      class DsclUser < Chef::Resource::User
-        resource_name :dscl_user
+  module Mixin
+    module DefaultPaths
+      include ChefUtils::DSL::DefaultPaths
 
-        provides :dscl_user
-        provides :user, os: "darwin"
+      def enforce_default_paths(env = ENV)
+        if Chef::Config[:enforce_default_paths] || Chef::Config[:enforce_path_sanity]
+          env["PATH"] = default_paths(env)
+        end
       end
     end
   end

data/lib/chef/mixin/deprecation.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright 2010-2016, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/mixin/enforce_ownership_and_permissions.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Seth Chisamore (<schisamo@chef.io>)
-# Copyright:: Copyright 2011-2016, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,7 +16,7 @@
 # limitations under the License.
 #
 
-require "chef/file_access_control"
+require_relative "../file_access_control"
 
 class Chef
   module Mixin

data/lib/chef/mixin/file_class.rb

@@ -2,7 +2,7 @@
 # Author:: Mark Mzyk <mmzyk@chef.io>
 # Author:: Seth Chisamore <schisamo@chef.io>
 # Author:: Bryan McLellan <btm@chef.io>
-# Copyright:: Copyright 2011-2016, Chef Software, Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -23,8 +23,8 @@ class Chef
     module FileClass
 
       def file_class
-        @host_os_file ||= if Chef::Platform.windows?
-                            require "chef/win32/file"
+        @host_os_file ||= if ChefUtils.windows?
+                            require_relative "../win32/file"
                             Chef::ReservedNames::Win32::File
                           else
                             ::File

data/lib/chef/mixin/from_file.rb

@@ -1,7 +1,7 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
 # Author:: Christopher Walters (<cw@chef.io>)
-# Copyright:: Copyright 2008-2016, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -30,7 +30,7 @@ class Chef
       # Raises an IOError if the file cannot be found, or is not readable.
       def from_file(filename)
         self.source_file = filename
-        if File.exists?(filename) && File.readable?(filename)
+        if File.file?(filename) && File.readable?(filename)
           instance_eval(IO.read(filename), filename, 1)
         else
           raise IOError, "Cannot open or read #{filename}!"
@@ -43,7 +43,7 @@ class Chef
       # Raises an IOError if the file cannot be found, or is not readable.
       def class_from_file(filename)
         self.source_file = filename
-        if File.exists?(filename) && File.readable?(filename)
+        if File.file?(filename) && File.readable?(filename)
           class_eval(IO.read(filename), filename, 1)
         else
           raise IOError, "Cannot open or read #{filename}!"

data/lib/chef/mixin/get_source_from_package.rb

@@ -1,5 +1,5 @@
 # Author:: Lamont Granquist (<lamont@chef.io>)
-# Copyright:: Copyright 2008-2016, Chef Software, Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -35,9 +35,10 @@ class Chef
       def initialize(new_resource, run_context)
         super
         return if new_resource.package_name.is_a?(Array)
+
         # if we're passed something that looks like a filesystem path, with no source, use it
         #  - require at least one '/' in the path to avoid gem_package "foo" breaking if a file named 'foo' exists in the cwd
-        if new_resource.source.nil? && new_resource.package_name.match(/#{::File::SEPARATOR}/) && ::File.exist?(new_resource.package_name)
+        if new_resource.source.nil? && new_resource.package_name.include?(::File::SEPARATOR) && ::File.exist?(new_resource.package_name)
           Chef::Log.trace("No package source specified, but #{new_resource.package_name} exists on the filesystem, copying to package source")
           new_resource.source(new_resource.package_name)
         end

data/lib/chef/mixin/homebrew_user.rb

@@ -2,8 +2,8 @@
 # Author:: Joshua Timberman (<joshua@chef.io>)
 # Author:: Graeme Mathieson (<mathie@woss.name>)
 #
-# Copyright 2011-2016, Chef Software Inc.
-# Copyright 2014-2016, Chef Software, Inc <legal@chef.io>
+# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,8 +22,8 @@
 # This lives here in Chef::Mixin because Chef's namespacing makes it
 # awkward to use modules elsewhere (e.g., chef/provider/package/homebrew/owner)
 
-require "chef/mixin/shell_out"
-require "etc"
+require_relative "shell_out"
+require "etc" unless defined?(Etc)
 
 class Chef
   module Mixin
@@ -40,6 +40,7 @@ class Chef
         # They could provide us a user name or a UID
         if provided_user
           return provided_user if provided_user.is_a? Integer
+
           return Etc.getpwnam(provided_user).uid
         end
 
@@ -67,7 +68,7 @@ class Chef
           owner = ::File.stat(brew_path).uid
         else
           raise Chef::Exceptions::CannotDetermineHomebrewOwner,
-                'Could not find the "brew" executable in /usr/local/bin or anywhere on the path.'
+            'Could not find the "brew" executable in /usr/local/bin or anywhere on the path.'
         end
 
         Chef::Log.debug "Found Homebrew owner #{Etc.getpwuid(owner).name}; executing `brew` commands as them"

data/lib/chef/mixin/lazy_module_include.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright 2011-2016, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/mixin/notifying_block.rb

@@ -1,6 +1,6 @@
 #--
 # Author:: Lamont Granquist <lamont@chef.io>
-# Copyright:: Copyright 2010-2016, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/mixin/openssl_helper.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright 2013-2018, Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,15 +14,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+autoload :OpenSSL, "openssl"
 
 class Chef
   module Mixin
     # various helpers for use with openssl. Currently used by the openssl_* resources
     module OpenSSLHelper
-      def self.included(_base)
-        require "openssl" unless defined?(::OpenSSL)
-      end
-
       # determine the key filename from the cert filename
       # @param [String] cert_filename the path to the certfile
       # @return [String] the path to the keyfile
@@ -46,6 +43,7 @@ class Chef
         # Check if the dhparam.pem file exists
         # Verify the dhparam.pem file contains a key
         return false unless ::File.exist?(dhparam_pem_path)
+
         dhparam = ::OpenSSL::PKey::DH.new File.read(dhparam_pem_path)
         dhparam.params_ok?
       end
@@ -157,7 +155,8 @@ class Chef
       # @return [OpenSSL::PKey::DH]
       def gen_ec_priv_key(curve)
         raise TypeError, "curve must be a string" unless curve.is_a?(String)
-        raise ArgumentError, "Specified curve is not available on this system" unless curve == "prime256v1" || curve == "secp384r1" || curve == "secp521r1"
+        raise ArgumentError, "Specified curve is not available on this system" unless %w{prime256v1 secp384r1 secp521r1}.include?(curve)
+
         ::OpenSSL::PKey::EC.new(curve).generate_key
       end
 
@@ -216,7 +215,7 @@ class Chef
         # Chef 12 backward compatibility
         ::OpenSSL::PKey::EC.send(:alias_method, :private?, :private_key?)
 
-        request.sign(key, ::OpenSSL::Digest::SHA256.new)
+        request.sign(key, ::OpenSSL::Digest.new("SHA256"))
         request
       end
 
@@ -262,7 +261,7 @@ class Chef
         cert = ::OpenSSL::X509::Certificate.new
         ef = ::OpenSSL::X509::ExtensionFactory.new
 
-        cert.serial = gen_serial()
+        cert.serial = gen_serial
         cert.version = 2
         cert.subject = request.subject
         cert.public_key = request.public_key
@@ -275,18 +274,21 @@ class Chef
           extension << ef.create_extension("basicConstraints", "CA:TRUE", true)
         else
           raise TypeError, "info['issuer'] must be a Ruby OpenSSL::X509::Certificate object" unless info["issuer"].is_a?(::OpenSSL::X509::Certificate)
+
           cert.issuer = info["issuer"].subject
           ef.issuer_certificate = info["issuer"]
         end
         ef.subject_certificate = cert
-        ef.config = ::OpenSSL::Config.load(::OpenSSL::Config::DEFAULT_CONFIG_FILE)
+        if openssl_config = __openssl_config
+          ef.config = openssl_config
+        end
 
         cert.extensions = extension
         cert.add_extension ef.create_extension("subjectKeyIdentifier", "hash")
         cert.add_extension ef.create_extension("authorityKeyIdentifier",
-                                               "keyid:always,issuer:always")
+          "keyid:always,issuer:always")
 
-        cert.sign(key, ::OpenSSL::Digest::SHA256.new)
+        cert.sign(key, ::OpenSSL::Digest.new("SHA256"))
         cert
       end
 
@@ -310,13 +312,15 @@ class Chef
         crl.last_update = Time.now
         crl.next_update = Time.now + 3600 * 24 * info["validity"]
 
-        ef.config = ::OpenSSL::Config.load(::OpenSSL::Config::DEFAULT_CONFIG_FILE)
+        if openssl_config = __openssl_config
+          ef.config = openssl_config
+        end
         ef.issuer_certificate = info["issuer"]
 
         crl.add_extension ::OpenSSL::X509::Extension.new("crlNumber", ::OpenSSL::ASN1::Integer(1))
         crl.add_extension ef.create_extension("authorityKeyIdentifier",
-                                              "keyid:always,issuer:always")
-        crl.sign(ca_private_key, ::OpenSSL::Digest::SHA256.new)
+          "keyid:always,issuer:always")
+        crl.sign(ca_private_key, ::OpenSSL::Digest.new("SHA256"))
         crl
       end
 
@@ -325,6 +329,7 @@ class Chef
       # @return [Integer]
       def get_next_crl_number(crl)
         raise TypeError, "crl must be a Ruby OpenSSL::X509::CRL object" unless crl.is_a?(::OpenSSL::X509::CRL)
+
         crlnum = 1
         crl.extensions.each do |e|
           crlnum = e.value if e.oid == "crlNumber"
@@ -333,13 +338,13 @@ class Chef
       end
 
       # add a serial given in the crl given
-      # @param [Hash] revoke_info serial to revoke & revokation reason
+      # @param [Hash] revoke_info serial to revoke & revocation reason
       # @param [OpenSSL::X509::CRL] crl X509 CRL
       # @param [OpenSSL::PKey::EC, OpenSSL::PKey::RSA] ca_private_key private key from the CA
       # @param [Hash] info issuer & validity
       # @return [OpenSSL::X509::CRL]
       def revoke_x509_crl(revoke_info, crl, ca_private_key, info)
-        raise TypeError, "revoke_info must be a Ruby Hash oject" unless revoke_info.is_a?(Hash)
+        raise TypeError, "revoke_info must be a Ruby Hash object" unless revoke_info.is_a?(Hash)
         raise TypeError, "crl must be a Ruby OpenSSL::X509::CRL object" unless crl.is_a?(::OpenSSL::X509::CRL)
         raise TypeError, "ca_private_key must be a Ruby OpenSSL::PKey::EC object or a Ruby OpenSSL::PKey::RSA object" unless ca_private_key.is_a?(::OpenSSL::PKey::EC) || ca_private_key.is_a?(::OpenSSL::PKey::RSA)
         raise TypeError, "info must be a Ruby Hash" unless info.is_a?(Hash)
@@ -361,12 +366,11 @@ class Chef
         revoked.time = Time.now
 
         ext = ::OpenSSL::X509::Extension.new("CRLReason",
-               ::OpenSSL::ASN1::Enumerated(revoke_info["reason"]))
+          ::OpenSSL::ASN1::Enumerated(revoke_info["reason"]))
         revoked.add_extension(ext)
         crl.add_revoked(revoked)
 
-        crl = renew_x509_crl(crl, ca_private_key, info)
-        crl
+        renew_x509_crl(crl, ca_private_key, info)
       end
 
       # renew a X509 crl given
@@ -387,16 +391,58 @@ class Chef
         crl.next_update = crl.last_update + 3600 * 24 * info["validity"]
 
         ef = ::OpenSSL::X509::ExtensionFactory.new
-        ef.config = ::OpenSSL::Config.load(::OpenSSL::Config::DEFAULT_CONFIG_FILE)
+        if openssl_config = __openssl_config
+          ef.config = openssl_config
+        end
         ef.issuer_certificate = info["issuer"]
 
         crl.extensions = [ ::OpenSSL::X509::Extension.new("crlNumber",
-                   ::OpenSSL::ASN1::Integer(get_next_crl_number(crl)))]
+          ::OpenSSL::ASN1::Integer(get_next_crl_number(crl)))]
         crl.add_extension ef.create_extension("authorityKeyIdentifier",
-                                              "keyid:always,issuer:always")
-        crl.sign(ca_private_key, ::OpenSSL::Digest::SHA256.new)
+          "keyid:always,issuer:always")
+        crl.sign(ca_private_key, ::OpenSSL::Digest.new("SHA256"))
         crl
       end
+
+      # Return true if a certificate need to be renewed (or doesn't exist) according to the number
+      # of days before expiration given
+      # @param [string] cert_file path of the cert file or cert content
+      # @param [integer] renew_before_expiry number of days before expiration
+      # @return [true, false]
+      def cert_need_renewal?(cert_file, renew_before_expiry)
+        resp = true
+        cert_content = ::File.exist?(cert_file) ? File.read(cert_file) : cert_file
+        begin
+          cert = OpenSSL::X509::Certificate.new cert_content
+        rescue ::OpenSSL::X509::CertificateError
+          return resp
+        end
+
+        unless cert.not_after <= Time.now + 3600 * 24 * renew_before_expiry
+          resp = false
+        end
+
+        resp
+      end
+
+      alias_method :cert_need_renewall?, :cert_need_renewal?
+
+      private
+
+      def __openssl_config
+        path = if File.exist?(::OpenSSL::Config::DEFAULT_CONFIG_FILE)
+                 OpenSSL::Config::DEFAULT_CONFIG_FILE
+               else
+                 Dir[File.join(RbConfig::CONFIG["prefix"], "**", "openssl.cnf")].first
+               end
+
+        if File.exist?(path)
+          ::OpenSSL::Config.load(path)
+        else
+          Chef::Log.warn("Couldn't find OpenSSL config file")
+          nil
+        end
+      end
     end
   end
 end