chef 15.0.300-universal-mingw32 → 15.1.36-universal-mingw32

data/lib/chef/dsl/universal.rb

@@ -1,62 +1,60 @@
-#--
-# Author:: Adam Jacob (<adam@chef.io>)
-# Author:: Christopher Walters (<cw@chef.io>)
-# Copyright:: Copyright 2008-2019, Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "platform_introspection"
-require_relative "data_query"
-require_relative "registry_helper"
-require_relative "powershell"
-require_relative "../mixin/powershell_exec"
-require_relative "../mixin/powershell_out"
-require_relative "../mixin/shell_out"
-require_relative "../mixin/lazy_module_include"
-require_relative "../mixin/train_or_shell"
-
-class Chef
-  module DSL
-    # Part of a family of DSL mixins.
-    #
-    # Chef::DSL::Recipe mixes into Recipes and LWRP Providers.
-    #   - this does not target core chef resources and providers.
-    #   - this is restricted to recipe/resource/provider context where a resource collection exists.
-    #   - cookbook authors should typically include modules into here.
-    #
-    # Chef::DSL::Core mixes into Recipes, LWRP Providers and Core Providers
-    #   - this adds cores providers on top of the Recipe DSL.
-    #   - this is restricted to recipe/resource/provider context where a resource collection exists.
-    #   - core chef authors should typically include modules into here.
-    #
-    # Chef::DSL::Universal mixes into Recipes, LWRP Resources+Providers, Core Resources+Providers, and Attributes files.
-    #   - this adds resources and attributes files.
-    #   - do not add helpers which manipulate the resource collection.
-    #   - this is for general-purpose stuff that is useful nearly everywhere.
-    #   - it also pollutes the namespace of nearly every context, watch out.
-    #
-    module Universal
-      include Chef::DSL::PlatformIntrospection
-      include Chef::DSL::DataQuery
-      include Chef::DSL::RegistryHelper
-      include Chef::DSL::Powershell
-      include Chef::Mixin::PowershellExec
-      include Chef::Mixin::PowershellOut
-      include Chef::Mixin::ShellOut
-      include Chef::Mixin::TrainOrShell
-      extend Chef::Mixin::LazyModuleInclude
-    end
-  end
-end
+#--
+# Author:: Adam Jacob (<adam@chef.io>)
+# Author:: Christopher Walters (<cw@chef.io>)
+# Copyright:: Copyright 2008-2019, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "platform_introspection"
+require_relative "data_query"
+require_relative "registry_helper"
+require_relative "powershell"
+require_relative "../mixin/powershell_exec"
+require_relative "../mixin/powershell_out"
+require_relative "../mixin/shell_out"
+require_relative "../mixin/lazy_module_include"
+
+class Chef
+  module DSL
+    # Part of a family of DSL mixins.
+    #
+    # Chef::DSL::Recipe mixes into Recipes and LWRP Providers.
+    #   - this does not target core chef resources and providers.
+    #   - this is restricted to recipe/resource/provider context where a resource collection exists.
+    #   - cookbook authors should typically include modules into here.
+    #
+    # Chef::DSL::Core mixes into Recipes, LWRP Providers and Core Providers
+    #   - this adds cores providers on top of the Recipe DSL.
+    #   - this is restricted to recipe/resource/provider context where a resource collection exists.
+    #   - core chef authors should typically include modules into here.
+    #
+    # Chef::DSL::Universal mixes into Recipes, LWRP Resources+Providers, Core Resources+Providers, and Attributes files.
+    #   - this adds resources and attributes files.
+    #   - do not add helpers which manipulate the resource collection.
+    #   - this is for general-purpose stuff that is useful nearly everywhere.
+    #   - it also pollutes the namespace of nearly every context, watch out.
+    #
+    module Universal
+      include Chef::DSL::PlatformIntrospection
+      include Chef::DSL::DataQuery
+      include Chef::DSL::RegistryHelper
+      include Chef::DSL::Powershell
+      include Chef::Mixin::PowershellExec
+      include Chef::Mixin::PowershellOut
+      include Chef::Mixin::ShellOut
+      extend Chef::Mixin::LazyModuleInclude
+    end
+  end
+end

data/lib/chef/encrypted_data_bag_item.rb

@@ -1,157 +1,158 @@
-#
-# Author:: Seth Falcon (<seth@chef.io>)
-# Copyright:: Copyright 2010-2018, Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "config"
-require_relative "data_bag_item"
-require_relative "encrypted_data_bag_item/decryptor"
-require_relative "encrypted_data_bag_item/encryptor"
-require "open-uri"
-
-# An EncryptedDataBagItem represents a read-only data bag item where
-# all values, except for the value associated with the id key, have
-# been encrypted.
-#
-# EncryptedDataBagItem can be used in recipes to decrypt data bag item
-# members.
-#
-# Data bag item values are assumed to have been encrypted using the
-# default symmetric encryption provided by Encryptor.encrypt where
-# values are converted to YAML prior to encryption.
-#
-# If the shared secret is not specified at initialization or load,
-# then the contents of the file referred to in
-# Chef::Config[:encrypted_data_bag_secret] will be used as the
-# secret.  The default path is /etc/chef/encrypted_data_bag_secret
-#
-# EncryptedDataBagItem is intended to provide a means to avoid storing
-# data bag items in the clear on the Chef server.  This provides some
-# protection against a breach of the Chef server or of Chef server
-# backup data.  Because the secret must be stored in the clear on any
-# node needing access to an EncryptedDataBagItem, this approach
-# provides no protection of data bag items from actors with access to
-# such nodes in the infrastructure.
-#
-class Chef::EncryptedDataBagItem
-  ALGORITHM = "aes-256-cbc".freeze
-  AEAD_ALGORITHM = "aes-256-gcm".freeze
-
-  #
-  # === Synopsis
-  #
-  #   EncryptedDataBagItem.new(hash, secret)
-  #
-  # === Args
-  #
-  # +enc_hash+::
-  #   The encrypted hash to be decrypted
-  # +secret+::
-  #   The raw secret key
-  #
-  # === Description
-  #
-  # Create a new encrypted data bag item for reading (decryption)
-  #
-  def initialize(enc_hash, secret)
-    @enc_hash = enc_hash
-    @secret = secret
-  end
-
-  def [](key)
-    value = @enc_hash[key]
-    if key == "id" || value.nil?
-      value
-    else
-      Decryptor.for(value, @secret).for_decrypted_item
-    end
-  end
-
-  def []=(key, value)
-    raise ArgumentError, "assignment not supported for #{self.class}"
-  end
-
-  def to_h
-    @enc_hash.keys.inject({}) { |hash, key| hash[key] = self[key]; hash }
-  end
-
-  alias_method :to_hash, :to_h
-
-  def self.encrypt_data_bag_item(plain_hash, secret)
-    plain_hash.inject({}) do |h, (key, val)|
-      h[key] = if key != "id"
-                 Encryptor.new(val, secret).for_encrypted_item
-               else
-                 val
-               end
-      h
-    end
-  end
-
-  #
-  # === Synopsis
-  #
-  #   EncryptedDataBagItem.load(data_bag, name, secret = nil)
-  #
-  # === Args
-  #
-  # +data_bag+::
-  #   The name of the data bag to fetch
-  # +name+::
-  #   The name of the data bag item to fetch
-  # +secret+::
-  #   The raw secret key. If the +secret+ is nil, the value of the file at
-  #   +Chef::Config[:encrypted_data_bag_secret]+ is loaded. See +load_secret+
-  #   for more information.
-  #
-  # === Description
-  #
-  # Loads and decrypts the data bag item with the given name.
-  #
-  def self.load(data_bag, name, secret = nil)
-    raw_hash = Chef::DataBagItem.load(data_bag, name)
-    secret ||= load_secret
-    new(raw_hash, secret)
-  end
-
-  def self.load_secret(path = nil)
-    path ||= Chef::Config[:encrypted_data_bag_secret]
-    if !path
-      raise ArgumentError, "No secret specified and no secret found at #{Chef::Config.platform_specific_path('/etc/chef/encrypted_data_bag_secret')}"
-    end
-    secret = case path
-             when /^\w+:\/\//
-               # We have a remote key
-               begin
-                 Kernel.open(path).read.strip
-               rescue Errno::ECONNREFUSED
-                 raise ArgumentError, "Remote key not available from '#{path}'"
-               rescue OpenURI::HTTPError
-                 raise ArgumentError, "Remote key not found at '#{path}'"
-               end
-             else
-               if !File.exist?(path)
-                 raise Errno::ENOENT, "file not found '#{path}'"
-               end
-               IO.read(path).strip
-             end
-    if secret.size < 1
-      raise ArgumentError, "invalid zero length secret in '#{path}'"
-    end
-    secret
-  end
-
-end
+#
+# Author:: Seth Falcon (<seth@chef.io>)
+# Copyright:: Copyright 2010-2018, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "config"
+require_relative "data_bag_item"
+require_relative "encrypted_data_bag_item/decryptor"
+require_relative "encrypted_data_bag_item/encryptor"
+require_relative "dist"
+require "open-uri"
+
+# An EncryptedDataBagItem represents a read-only data bag item where
+# all values, except for the value associated with the id key, have
+# been encrypted.
+#
+# EncryptedDataBagItem can be used in recipes to decrypt data bag item
+# members.
+#
+# Data bag item values are assumed to have been encrypted using the
+# default symmetric encryption provided by Encryptor.encrypt where
+# values are converted to YAML prior to encryption.
+#
+# If the shared secret is not specified at initialization or load,
+# then the contents of the file referred to in
+# Chef::Config[:encrypted_data_bag_secret] will be used as the
+# secret.  The default path is /etc/chef/encrypted_data_bag_secret
+#
+# EncryptedDataBagItem is intended to provide a means to avoid storing
+# data bag items in the clear on the Chef server.  This provides some
+# protection against a breach of the Chef server or of Chef server
+# backup data.  Because the secret must be stored in the clear on any
+# node needing access to an EncryptedDataBagItem, this approach
+# provides no protection of data bag items from actors with access to
+# such nodes in the infrastructure.
+#
+class Chef::EncryptedDataBagItem
+  ALGORITHM = "aes-256-cbc".freeze
+  AEAD_ALGORITHM = "aes-256-gcm".freeze
+
+  #
+  # === Synopsis
+  #
+  #   EncryptedDataBagItem.new(hash, secret)
+  #
+  # === Args
+  #
+  # +enc_hash+::
+  #   The encrypted hash to be decrypted
+  # +secret+::
+  #   The raw secret key
+  #
+  # === Description
+  #
+  # Create a new encrypted data bag item for reading (decryption)
+  #
+  def initialize(enc_hash, secret)
+    @enc_hash = enc_hash
+    @secret = secret
+  end
+
+  def [](key)
+    value = @enc_hash[key]
+    if key == "id" || value.nil?
+      value
+    else
+      Decryptor.for(value, @secret).for_decrypted_item
+    end
+  end
+
+  def []=(key, value)
+    raise ArgumentError, "assignment not supported for #{self.class}"
+  end
+
+  def to_h
+    @enc_hash.keys.inject({}) { |hash, key| hash[key] = self[key]; hash }
+  end
+
+  alias_method :to_hash, :to_h
+
+  def self.encrypt_data_bag_item(plain_hash, secret)
+    plain_hash.inject({}) do |h, (key, val)|
+      h[key] = if key != "id"
+                 Encryptor.new(val, secret).for_encrypted_item
+               else
+                 val
+               end
+      h
+    end
+  end
+
+  #
+  # === Synopsis
+  #
+  #   EncryptedDataBagItem.load(data_bag, name, secret = nil)
+  #
+  # === Args
+  #
+  # +data_bag+::
+  #   The name of the data bag to fetch
+  # +name+::
+  #   The name of the data bag item to fetch
+  # +secret+::
+  #   The raw secret key. If the +secret+ is nil, the value of the file at
+  #   +Chef::Config[:encrypted_data_bag_secret]+ is loaded. See +load_secret+
+  #   for more information.
+  #
+  # === Description
+  #
+  # Loads and decrypts the data bag item with the given name.
+  #
+  def self.load(data_bag, name, secret = nil)
+    raw_hash = Chef::DataBagItem.load(data_bag, name)
+    secret ||= load_secret
+    new(raw_hash, secret)
+  end
+
+  def self.load_secret(path = nil)
+    path ||= Chef::Config[:encrypted_data_bag_secret]
+    if !path
+      raise ArgumentError, "No secret specified and no secret found at #{Chef::Config.platform_specific_path(Chef::Dist::CONF_DIR + '/encrypted_data_bag_secret')}"
+    end
+    secret = case path
+             when /^\w+:\/\//
+               # We have a remote key
+               begin
+                 Kernel.open(path).read.strip
+               rescue Errno::ECONNREFUSED
+                 raise ArgumentError, "Remote key not available from '#{path}'"
+               rescue OpenURI::HTTPError
+                 raise ArgumentError, "Remote key not found at '#{path}'"
+               end
+             else
+               if !File.exist?(path)
+                 raise Errno::ENOENT, "file not found '#{path}'"
+               end
+               IO.read(path).strip
+             end
+    if secret.size < 1
+      raise ArgumentError, "invalid zero length secret in '#{path}'"
+    end
+    secret
+  end
+
+end

data/lib/chef/encrypted_data_bag_item/assertions.rb

@@ -1,54 +1,54 @@
-#
-# Author:: Xabier de Zuazo (<xabier@onddo.com>)
-# Copyright:: Copyright 2014-2016, Onddo Labs, SL.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "unacceptable_encrypted_data_bag_item_format"
-require_relative "unsupported_cipher"
-
-class Chef::EncryptedDataBagItem
-
-  class EncryptedDataBagRequirementsFailure < StandardError
-  end
-
-  module Assertions
-
-    def assert_format_version_acceptable!(format_version)
-      unless format_version.kind_of?(Integer) && format_version >= Chef::Config[:data_bag_decrypt_minimum_version]
-        raise UnacceptableEncryptedDataBagItemFormat,
-          "The encrypted data bag item has format version `#{format_version}', " +
-          "but the config setting 'data_bag_decrypt_minimum_version' requires version `#{Chef::Config[:data_bag_decrypt_minimum_version]}'"
-      end
-    end
-
-    def assert_valid_cipher!(requested_cipher, algorithm)
-      # In the future, chef may support configurable ciphers. For now, only
-      # aes-256-cbc and aes-256-gcm are supported.
-      unless requested_cipher == algorithm
-        raise UnsupportedCipher,
-          "Cipher '#{requested_cipher}' is not supported by this version of Chef. Available ciphers: ['#{ALGORITHM}', '#{AEAD_ALGORITHM}']"
-      end
-    end
-
-    def assert_aead_requirements_met!(algorithm)
-      unless OpenSSL::Cipher.ciphers.include?(algorithm)
-        raise EncryptedDataBagRequirementsFailure, "The used Encrypted Data Bags version requires an OpenSSL version with \"#{algorithm}\" algorithm support"
-      end
-    end
-
-  end
-
-end
+#
+# Author:: Xabier de Zuazo (<xabier@onddo.com>)
+# Copyright:: Copyright 2014-2016, Onddo Labs, SL.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "unacceptable_encrypted_data_bag_item_format"
+require_relative "unsupported_cipher"
+
+class Chef::EncryptedDataBagItem
+
+  class EncryptedDataBagRequirementsFailure < StandardError
+  end
+
+  module Assertions
+
+    def assert_format_version_acceptable!(format_version)
+      unless format_version.kind_of?(Integer) && format_version >= Chef::Config[:data_bag_decrypt_minimum_version]
+        raise UnacceptableEncryptedDataBagItemFormat,
+          "The encrypted data bag item has format version `#{format_version}', " +
+          "but the config setting 'data_bag_decrypt_minimum_version' requires version `#{Chef::Config[:data_bag_decrypt_minimum_version]}'"
+      end
+    end
+
+    def assert_valid_cipher!(requested_cipher, algorithm)
+      # In the future, chef may support configurable ciphers. For now, only
+      # aes-256-cbc and aes-256-gcm are supported.
+      unless requested_cipher == algorithm
+        raise UnsupportedCipher,
+          "Cipher '#{requested_cipher}' is not supported by this version of Chef. Available ciphers: ['#{ALGORITHM}', '#{AEAD_ALGORITHM}']"
+      end
+    end
+
+    def assert_aead_requirements_met!(algorithm)
+      unless OpenSSL::Cipher.ciphers.include?(algorithm)
+        raise EncryptedDataBagRequirementsFailure, "The used Encrypted Data Bags version requires an OpenSSL version with \"#{algorithm}\" algorithm support"
+      end
+    end
+
+  end
+
+end