chef 15.17.4 → 16.0.257

data/lib/chef/knife/environment_compare.rb

@@ -81,7 +81,7 @@ class Chef
 
       def constraint_list(environments)
         constraints = {}
-        environments.each do |env, url| # rubocop:disable Style/HashEachMethods
+        environments.each do |env, url| # rubocop:disable Performance/HashEachMethods
           # Because you cannot modify the default environment I filter it out here.
           unless env == "_default"
             envdata = Chef::Environment.load(env)

data/lib/chef/knife/exec.rb

@@ -76,7 +76,7 @@ class Chef::Knife::Exec < Chef::Knife
   def find_script(x)
     # Try to find a script. First try expanding the path given.
     script = File.expand_path(x)
-    return script if File.exist?(script)
+    return script if File.exists?(script)
 
     # Failing that, try searching the script path. If we can't find
     # anything, fail gracefully.
@@ -86,7 +86,7 @@ class Chef::Knife::Exec < Chef::Knife
       path = File.expand_path(path)
       test = File.join(path, x)
       Chef::Log.trace("Testing: #{test}")
-      if File.exist?(test)
+      if File.exists?(test)
         script = test
         Chef::Log.trace("Found: #{test}")
         return script

data/lib/chef/knife/group_add.rb

@@ -0,0 +1,55 @@
+#
+# Author:: Seth Falcon (<seth@chef.io>)
+# Author:: Jeremiah Snapp (<jeremiah@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../knife"
+
+class Chef
+  class Knife
+    class GroupAdd < Chef::Knife
+      category "group"
+      banner "knife group add MEMBER_TYPE MEMBER_NAME GROUP_NAME"
+
+      deps do
+        require_relative "acl_base"
+        include Chef::Knife::AclBase
+      end
+
+      def run
+        member_type, member_name, group_name = name_args
+
+        if name_args.length != 3
+          show_usage
+          ui.fatal "You must specify member type [client|group|user], member name and group name"
+          exit 1
+        end
+
+        validate_member_name!(group_name)
+        validate_member_type!(member_type)
+        validate_member_name!(member_name)
+
+        if group_name.downcase == "users"
+          ui.fatal "knife group can not manage members of Chef Infra Server's 'users' group, which contains all users."
+          exit 1
+        end
+
+        add_to_group!(member_type, member_name, group_name)
+      end
+    end
+  end
+end

data/lib/chef/knife/{cookbook_site_download.rb → group_create.rb}

@@ -1,5 +1,6 @@
 #
-# Author:: Adam Jacob (<adam@chef.io>)
+# Author:: Seth Falcon (<seth@chef.io>)
+# Author:: Jeremiah Snapp (<jeremiah@chef.io>)
 # Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
@@ -17,24 +18,32 @@
 #
 
 require_relative "../knife"
-require_relative "supermarket_download"
-require_relative "../dist"
 
 class Chef
   class Knife
-    class CookbookSiteDownload < Knife::SupermarketDownload
+    class GroupCreate < Chef::Knife
+      category "group"
+      banner "knife group create GROUP_NAME"
 
-      # Handle the subclassing (knife doesn't do this :()
-      dependency_loaders.concat(superclass.dependency_loaders)
-
-      banner "knife cookbook site download COOKBOOK [VERSION] (options)"
-      category "deprecated"
+      deps do
+        require_relative "acl_base"
+        include Chef::Knife::AclBase
+      end
 
       def run
-        Chef::Log.warn("knife cookbook site download has been deprecated in favor of knife supermarket download. In #{Chef::Dist::PRODUCT} 16 (April 2020) this will result in an error!")
-        super
-      end
+        group_name = name_args[0]
 
+        if name_args.length != 1
+          show_usage
+          ui.fatal "You must specify group name"
+          exit 1
+        end
+
+        validate_member_name!(group_name)
+
+        ui.msg "Creating '#{group_name}' group"
+        rest.post_rest("groups", { groupname: group_name })
+      end
     end
   end
 end

data/lib/chef/knife/group_destroy.rb

@@ -0,0 +1,53 @@
+#
+# Author:: Christopher Maier (<cm@chef.io>)
+# Author:: Jeremiah Snapp (<jeremiah@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../knife"
+
+class Chef
+  class Knife
+    class GroupDestroy < Chef::Knife
+      category "group"
+      banner "knife group destroy GROUP_NAME"
+
+      deps do
+        require_relative "acl_base"
+        include Chef::Knife::AclBase
+      end
+
+      def run
+        group_name = name_args[0]
+
+        if name_args.length != 1
+          show_usage
+          ui.fatal "You must specify group name"
+          exit 1
+        end
+
+        validate_member_name!(group_name)
+
+        if %w{admins billing-admins clients users}.include?(group_name.downcase)
+          ui.fatal "The '#{group_name}' group is a special group that cannot not be destroyed"
+          exit 1
+        end
+        ui.msg "Destroying '#{group_name}' group"
+        rest.delete_rest("groups/#{group_name}")
+      end
+    end
+  end
+end

data/lib/chef/knife/{cookbook_site_list.rb → group_list.rb}

@@ -1,5 +1,6 @@
 #
-# Author:: Adam Jacob (<adam@chef.io>)
+# Author:: Seth Falcon (<seth@chef.io>)
+# Author:: Jeremiah Snapp (<jeremiah@chef.io>)
 # Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
@@ -17,24 +18,26 @@
 #
 
 require_relative "../knife"
-require_relative "supermarket_list"
-require_relative "../dist"
 
 class Chef
   class Knife
-    class CookbookSiteList < Knife::SupermarketList
+    class GroupList < Chef::Knife
+      category "group"
+      banner "knife group list"
 
-      # Handle the subclassing (knife doesn't do this :()
-      dependency_loaders.concat(superclass.dependency_loaders)
-
-      banner "knife cookbook site list (options)"
-      category "deprecated"
+      deps do
+        require_relative "acl_base"
+        include Chef::Knife::AclBase
+      end
 
       def run
-        Chef::Log.warn("knife cookbook site list has been deprecated in favor of knife supermarket list. In #{Chef::Dist::PRODUCT} 16 (April 2020) this will result in an error!")
-        super
+        groups = rest.get_rest("groups").keys.sort
+        ui.output(remove_usags(groups))
       end
 
+      def remove_usags(groups)
+        groups.select { |gname| !is_usag?(gname) }
+      end
     end
   end
 end

data/lib/chef/knife/group_remove.rb

@@ -0,0 +1,56 @@
+#
+# Author:: Seth Falcon (<seth@chef.io>)
+# Author:: Jeremiah Snapp (<jeremiah@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../knife"
+
+class Chef
+  class Knife
+    class GroupRemove < Chef::Knife
+      category "group"
+      banner "knife group remove MEMBER_TYPE MEMBER_NAME GROUP_NAME"
+
+      deps do
+        require_relative "acl_base"
+        include Chef::Knife::AclBase
+      end
+
+      def run
+        member_type, member_name, group_name = name_args
+
+        if name_args.length != 3
+          show_usage
+          ui.fatal "You must specify member type [client|group|user], member name and group name"
+          exit 1
+        end
+
+        validate_member_name!(group_name)
+        validate_member_type!(member_type)
+        validate_member_name!(member_name)
+
+        if group_name.downcase == "users"
+          ui.fatal "knife-acl can not manage members of the Users group"
+          ui.fatal "please read knife-acl's README.md for more information"
+          exit 1
+        end
+
+        remove_from_group!(member_type, member_name, group_name)
+      end
+    end
+  end
+end

data/lib/chef/knife/{cookbook_site_install.rb → group_show.rb}

@@ -1,5 +1,6 @@
 #
-# Author:: Adam Jacob (<adam@chef.io>)
+# Author:: Seth Falcon (<seth@chef.io>)
+# Author:: Jeremiah Snapp (<jeremiah@chef.io>)
 # Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
@@ -17,24 +18,32 @@
 #
 
 require_relative "../knife"
-require_relative "supermarket_install"
-require_relative "../dist"
 
 class Chef
   class Knife
-    class CookbookSiteInstall < Knife::SupermarketInstall
+    class GroupShow < Chef::Knife
+      category "group"
+      banner "knife group show GROUP_NAME"
 
-      # Handle the subclassing (knife doesn't do this :()
-      dependency_loaders.concat(superclass.dependency_loaders)
-
-      banner "knife cookbook site install COOKBOOK [VERSION] (options)"
-      category "deprecated"
+      deps do
+        require_relative "acl_base"
+        include Chef::Knife::AclBase
+      end
 
       def run
-        Chef::Log.warn("knife cookbook site install has been deprecated in favor of knife supermarket install. In #{Chef::Dist::PRODUCT} 16 (April 2020) this will result in an error!")
-        super
-      end
+        group_name = name_args[0]
 
+        if name_args.length != 1
+          show_usage
+          ui.fatal "You must specify group name"
+          exit 1
+        end
+
+        validate_member_name!(group_name)
+
+        group = rest.get_rest("groups/#{group_name}")
+        ui.output group
+      end
     end
   end
 end

data/lib/chef/knife/list.rb

@@ -90,7 +90,7 @@ class Chef
 
         # Flatten out directory results if necessary
         if config[:flat]
-          dir_results.each do |result, children| # rubocop:disable Style/HashEachMethods
+          dir_results.each do |result, children| # rubocop:disable Performance/HashEachMethods
             results += children
           end
           dir_results = []

data/lib/chef/knife/ssh.rb

@@ -66,7 +66,7 @@ class Chef
         long: "--ssh-user USERNAME",
         description: "The ssh username."
 
-      option :ssh_password_ng,
+      option :ssh_password,
         short: "-P [PASSWORD]",
         long: "--ssh-password [PASSWORD]",
         description: "The ssh password - will prompt if flag is specified but no password is given.",
@@ -79,20 +79,20 @@ class Chef
         short: "-p PORT",
         long: "--ssh-port PORT",
         description: "The ssh port.",
-        proc: Proc.new { |key| Chef::Config[:knife][:ssh_port] = key.strip }
+        proc: Proc.new { |key| key.strip }
 
       option :ssh_timeout,
         short: "-t SECONDS",
         long: "--ssh-timeout SECONDS",
         description: "The ssh connection timeout.",
-        proc: Proc.new { |key| Chef::Config[:knife][:ssh_timeout] = key.strip.to_i },
+        proc: Proc.new { |key| key.strip.to_i },
         default: 120
 
       option :ssh_gateway,
         short: "-G GATEWAY",
         long: "--ssh-gateway GATEWAY",
         description: "The ssh gateway.",
-        proc: Proc.new { |key| Chef::Config[:knife][:ssh_gateway] = key.strip }
+        proc: Proc.new { |key| key.strip }
 
       option :ssh_gateway_identity,
         long: "--ssh-gateway-identity SSH_GATEWAY_IDENTITY",
@@ -125,7 +125,7 @@ class Chef
       option :duplicated_fqdns,
         long: "--duplicated-fqdns",
         description: "Behavior if FQDNs are duplicated, ignored by default.",
-        proc: Proc.new { |key| Chef::Config[:knife][:duplicated_fqdns] = key.strip.to_sym },
+        proc: Proc.new { |key| key.strip.to_sym },
         default: :ignore
 
       option :tmux_split,
@@ -149,7 +149,6 @@ class Chef
       end
 
       def configure_gateway
-        config[:ssh_gateway] ||= Chef::Config[:knife][:ssh_gateway]
         if config[:ssh_gateway]
           gw_host, gw_user = config[:ssh_gateway].split("@").reverse
           gw_host, gw_port = gw_host.split(":")
@@ -273,7 +272,6 @@ class Chef
       def session_options(host, port, user = nil, gateway: false)
         ssh_config = Net::SSH.configuration_for(host, true)
         {}.tap do |opts|
-          # Chef::Config[:knife][:ssh_user] is parsed in #configure_user and written to config[:ssh_user]
           opts[:user] = user || config[:ssh_user] || ssh_config[:user]
           if !gateway && config[:ssh_identity_file]
             opts[:keys] = File.expand_path(config[:ssh_identity_file])
@@ -298,10 +296,6 @@ class Chef
             opts[:keepalive] = true
             opts[:keepalive_interval] = ssh_config[:keepalive_interval]
           end
-          # maintain support for legacy key types / ciphers / key exchange algorithms.
-          # most importantly this adds back support for DSS host keys
-          # See https://github.com/net-ssh/net-ssh/pull/709
-          opts[:append_all_supported_algorithms] = true
         end
       end
 
@@ -312,10 +306,8 @@ class Chef
           Chef::Log.debug("Adding #{host}")
           session_opts = session_options(host, ssh_port, gateway: false)
           # Handle port overrides for the main connection.
-          session_opts[:port] = Chef::Config[:knife][:ssh_port] if Chef::Config[:knife][:ssh_port]
           session_opts[:port] = config[:ssh_port] if config[:ssh_port]
           # Handle connection timeout
-          session_opts[:timeout] = Chef::Config[:knife][:ssh_timeout] if Chef::Config[:knife][:ssh_timeout]
           session_opts[:timeout] = config[:ssh_timeout] if config[:ssh_timeout]
           # Handle session prefix
           session_opts[:properties] = { prefix: prefix }
@@ -362,21 +354,11 @@ class Chef
         subsession ||= session
         command = fixup_sudo(command)
         command.force_encoding("binary") if command.respond_to?(:force_encoding)
-        begin
-          open_session(subsession, command)
-        rescue => e
-          open_session(subsession, command, true)
-        end
-      end
-
-      def open_session(subsession, command, pty = false)
-        stderr = ""
-        exit_status = 0
         subsession.open_channel do |chan|
           if config[:on_error] && exit_status != 0
             chan.close
           else
-            chan.request_pty if pty
+            chan.request_pty
             chan.exec command do |ch, success|
               raise ArgumentError, "Cannot execute #{command}" unless success
 
@@ -387,11 +369,6 @@ class Chef
                   ichannel.send_data("#{get_password}\n")
                 end
               end
-
-              ch.on_extended_data do |_, _type, data|
-                stderr += data
-              end
-
               ch.on_request "exit-status" do |ichannel, data|
                 exit_status = [exit_status, data.read_long].max
               end
@@ -576,37 +553,22 @@ class Chef
                              Chef::Config[:knife][:ssh_user])
       end
 
-      # This is a bit overly complicated because of the way we want knife ssh to work with -P causing a password prompt for
-      # the user, but we have to be conscious that this code gets included in knife bootstrap and knife * server create as
-      # well.  We want to change the semantics so that the default is false and 'nil' means -P without an argument on the
-      # command line.  But the other utilities expect nil to be the default and we can't prompt in that case. So we effectively
-      # use ssh_password_ng to determine if we're coming from knife ssh or from the other utilities.  The other utilities can
-      # also be patched to use ssh_password_ng easily as long they follow the convention that the default is false.
       def configure_password
-        if config.key?(:ssh_password_ng) && config[:ssh_password_ng].nil?
-          # If the parameter is called on the command line with no value
-          # it will set :ssh_password_ng = nil
-          # This is where we want to trigger a prompt for password
+        if config.key?(:ssh_password) && config[:ssh_password].nil?
+          # if we have an actual nil that means someone called "--ssh-password" with no value, so we prompt for a password
           config[:ssh_password] = get_password
         else
-          # if ssh_password_ng is false then it has not been set at all, and we may be in knife ec2 and still
-          # using an old config[:ssh_password].  this is backwards compatibility.  all knife cloud plugins should
-          # be updated to use ssh_password_ng with a default of false and ssh_password should be retired, (but
-          # we'll still need to use the ssh_password out of knife.rb if we find that).
-          ssh_password = config.key?(:ssh_password_ng) ? config[:ssh_password_ng] : config[:ssh_password]
-          # Otherwise, the password has either been specified on the command line,
-          # in knife.rb, or key based auth will be attempted
-          config[:ssh_password] = get_stripped_unfrozen_value(ssh_password ||
-                             Chef::Config[:knife][:ssh_password])
+          # the false default of ssh_password results in a nil here
+          config[:ssh_password] = get_stripped_unfrozen_value(config[:ssh_password])
         end
       end
 
       def configure_ssh_identity_file
-        config[:ssh_identity_file] = get_stripped_unfrozen_value(config[:ssh_identity_file] || Chef::Config[:knife][:ssh_identity_file])
+        config[:ssh_identity_file] = get_stripped_unfrozen_value(config[:ssh_identity_file])
       end
 
       def configure_ssh_gateway_identity
-        config[:ssh_gateway_identity] = get_stripped_unfrozen_value(config[:ssh_gateway_identity] || Chef::Config[:knife][:ssh_gateway_identity])
+        config[:ssh_gateway_identity] = get_stripped_unfrozen_value(config[:ssh_gateway_identity])
       end
 
       def run