chef 15.2.20 → 15.3.14

data/spec/functional/resource/user/mac_user_spec.rb

@@ -0,0 +1,207 @@
+#
+# Copyright:: Copyright 2019, Chef Software, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+require "chef/mixin/shell_out"
+
+metadata = {
+  macos_1014: true,
+  requires_root: true,
+}
+
+describe "Chef::Resource::User with Chef::Provider::User::MacUser provider", metadata do
+  include Chef::Mixin::ShellOut
+
+  def clean_user
+    shell_out!("/usr/bin/dscl . -delete '/Users/#{username}'")
+  rescue Mixlib::ShellOut::ShellCommandFailed
+      # Raised when the user is already cleaned
+  end
+
+  def ensure_file_cache_path_exists
+    path = Chef::Config["file_cache_path"]
+    FileUtils.mkdir_p(path) unless File.directory?(path)
+  end
+
+  def user_should_exist
+    expect(shell_out("/usr/bin/dscl . -read /Users/#{username}").error?).to be(false)
+  end
+
+  def check_password(pass)
+    # In order to test the password we use dscl passwd command since
+    # that's the only command that gets the user password from CLI.
+    expect(shell_out("dscl . -passwd /Users/greatchef #{pass} new_password").exitstatus).to eq(0)
+    # Now reset the password back
+    expect(shell_out("dscl . -passwd /Users/greatchef new_password #{pass}").exitstatus).to eq(0)
+  end
+
+  let(:node) do
+    n = Chef::Node.new
+    n.consume_external_attrs(OHAI_SYSTEM.data.dup, {})
+    n
+  end
+
+  let(:events) do
+    Chef::EventDispatch::Dispatcher.new
+  end
+
+  let(:run_context) do
+    Chef::RunContext.new(node, {}, events)
+  end
+
+  let(:username) do
+    "greatchef"
+  end
+
+  let(:uid) { nil }
+  let(:gid) { 20 }
+  let(:home) { nil }
+  let(:manage_home) { false }
+  let(:password) { "XXXYYYZZZ" }
+  let(:comment) { "Great Chef" }
+  let(:shell) { "/bin/bash" }
+  let(:salt) { nil }
+  let(:iterations) { nil }
+
+  let(:user_resource) do
+    r = Chef::Resource::User::MacUser.new("TEST USER RESOURCE", run_context)
+    r.username(username)
+    r.uid(uid)
+    r.gid(gid)
+    r.home(home)
+    r.shell(shell)
+    r.comment(comment)
+    r.manage_home(manage_home)
+    r.password(password)
+    r.salt(salt)
+    r.iterations(iterations)
+    r
+  end
+
+  before do
+    clean_user
+    ensure_file_cache_path_exists
+  end
+
+  after(:each) do
+    clean_user
+  end
+
+  describe "action :create" do
+    it "should create the user" do
+      user_resource.run_action(:create)
+      user_should_exist
+      check_password(password)
+    end
+  end
+
+  describe "when user exists" do
+    before do
+      existing_resource = user_resource.dup
+      existing_resource.run_action(:create)
+      user_should_exist
+    end
+
+    describe "when password is updated" do
+      it "should update the password of the user" do
+        user_resource.password("mykitchen")
+        user_resource.run_action(:create)
+        check_password("mykitchen")
+      end
+    end
+  end
+
+  describe "when password is being set via shadow hash" do
+    let(:password) do
+      "c734b6e4787c3727bb35e29fdd92b97c\
+1de12df509577a045728255ec7c6c5f5\
+c18efa05ed02b682ffa7ebc05119900e\
+b1d4880833aa7a190afc13e2bf0936b8\
+20123e8c98f0f9bcac2a629d9163caac\
+9464a8c234f3919082400b4f939bb77b\
+c5adbbac718b7eb99463a7b679571e0f\
+1c9fef2ef08d0b9e9c2bcf644eed2ffc"
+    end
+
+    let(:iterations) { 25000 }
+    let(:salt) { "9e2e7d5ee473b496fd24cf0bbfcaedfcb291ee21740e570d1e917e874f8788ca" }
+
+    it "action :create should create the user" do
+      user_resource.run_action(:create)
+      user_should_exist
+      check_password("soawesome")
+    end
+
+    describe "when user exists" do
+      before do
+        existing_resource = user_resource.dup
+        existing_resource.run_action(:create)
+        user_should_exist
+      end
+
+      describe "when password is updated" do
+        describe "without salt" do
+          let(:salt) { nil }
+
+          it "it sets the password" do
+            user_resource.password("mykitchen")
+            user_resource.run_action(:create)
+            check_password("mykitchen")
+          end
+        end
+
+        describe "with salt and plaintext password" do
+          it "raises Chef::Exceptions::User" do
+            expect do
+              user_resource.password("notasha512")
+              user_resource.run_action(:create)
+            end.to raise_error(Chef::Exceptions::User)
+          end
+        end
+      end
+    end
+  end
+
+  describe "when a user is member of some groups" do
+    let(:groups) { %w{staff operator} }
+
+    before do
+      existing_resource = user_resource.dup
+      existing_resource.run_action(:create)
+
+      groups.each do |group|
+        shell_out!("/usr/bin/dscl . -append '/Groups/#{group}' GroupMembership #{username}")
+      end
+    end
+
+    after do
+      groups.each do |group|
+        # Do not raise an error when user is correctly removed
+        shell_out("/usr/bin/dscl . -delete '/Groups/#{group}' GroupMembership #{username}")
+      end
+    end
+
+    it ":remove action removes the user from the groups and deletes the user" do
+      user_resource.run_action(:remove)
+      groups.each do |group|
+        # Do not raise an error when group is empty
+        expect(shell_out("dscl . read /Groups/staff GroupMembership").stdout).not_to include(group)
+      end
+    end
+  end
+
+end

data/spec/integration/client/client_spec.rb

@@ -369,6 +369,28 @@ describe "chef-client" do
     end
   end
 
+  when_the_repository "has a cookbook that outputs some node attributes" do
+    before do
+      file "cookbooks/x/recipes/default.rb", <<~'EOM'
+        puts "COOKBOOKS: #{node[:cookbooks]}"
+      EOM
+      file "cookbooks/x/metadata.rb", <<~EOM
+        name 'x'
+        version '0.0.1'
+      EOM
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+      EOM
+    end
+
+    it "should have a cookbook attribute" do
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" -o 'x::default' --no-fork", cwd: chef_dir)
+      result.error!
+      expect(result.stdout).to include('COOKBOOKS: {"x"=>{"version"=>"0.0.1"}}')
+    end
+  end
+
   when_the_repository "has a cookbook that should fail chef_version checks" do
     before do
       file "cookbooks/x/recipes/default.rb", ""

data/spec/integration/knife/raw_spec.rb

@@ -19,11 +19,11 @@ require "support/shared/integration/integration_helper"
 require "support/shared/context/config"
 require "chef/knife/raw"
 require "chef/knife/show"
+require "tiny_server"
 
 describe "knife raw", :workstation do
   include IntegrationSupport
   include KnifeSupport
-  include AppServerSupport
 
   include_context "default config options"
 
@@ -185,19 +185,29 @@ describe "knife raw", :workstation do
     end
 
     context "When a server returns raw json" do
-      before :each do
-        Chef::Config.chef_server_url = "http://localhost:9018"
-        app = lambda do |env|
-          [200, { "Content-Type" => "application/json" }, ['{ "x": "y", "a": "b" }'] ]
+      def start_tiny_server(server_opts = {})
+        @server = TinyServer::Manager.new(server_opts)
+        @server.start
+        @api = TinyServer::API.instance
+        @api.clear
+
+        @api.get("/blah", 200, nil, { "Content-Type" => "application/json" }) do
+          '{ "x": "y", "a": "b" }'
         end
-        @raw_server_thread = start_app_server(app, 9018)
+      end
+
+      def stop_tiny_server
+        @server.stop
+        @server = @api = nil
+      end
+
+      before :each do
+        Chef::Config.chef_server_url = "http://localhost:9000"
+        start_tiny_server
       end
 
       after :each do
-        if @raw_server_thread
-          @raw_server_thread.kill
-          @raw_server_thread.join(30)
-        end
+        stop_tiny_server
       end
 
       it "knife raw /blah returns the prettified json" do
@@ -217,19 +227,29 @@ describe "knife raw", :workstation do
     end
 
     context "When a server returns text" do
-      before :each do
-        Chef::Config.chef_server_url = "http://localhost:9018"
-        app = lambda do |env|
-          [200, { "Content-Type" => "text" }, ['{ "x": "y", "a": "b" }'] ]
+      def start_tiny_server(server_opts = {})
+        @server = TinyServer::Manager.new(server_opts)
+        @server.start
+        @api = TinyServer::API.instance
+        @api.clear
+
+        @api.get("/blah", 200, nil, { "Content-Type" => "text" }) do
+          '{ "x": "y", "a": "b" }'
         end
-        @raw_server_thread = start_app_server(app, 9018)
+      end
+
+      def stop_tiny_server
+        @server.stop
+        @server = @api = nil
+      end
+
+      before :each do
+        Chef::Config.chef_server_url = "http://localhost:9000"
+        start_tiny_server
       end
 
       after :each do
-        if @raw_server_thread
-          @raw_server_thread.kill
-          @raw_server_thread.join(30)
-        end
+        stop_tiny_server
       end
 
       it "knife raw /blah returns the raw text" do

data/spec/integration/knife/redirection_spec.rb

@@ -1,6 +1,6 @@
 #
 # Author:: John Keiser (<jkeiser@chef.io>)
-# Copyright:: Copyright 2013-2018, Chef Software Inc.
+# Copyright:: Copyright 2013-2019, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,6 +15,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+require "tiny_server"
 require "support/shared/integration/integration_helper"
 require "support/shared/context/config"
 require "chef/knife/list"
@@ -22,7 +23,21 @@ require "chef/knife/list"
 describe "redirection", :workstation do
   include IntegrationSupport
   include KnifeSupport
-  include AppServerSupport
+
+  def start_tiny_server(real_chef_server_url, server_opts = {})
+    @server = TinyServer::Manager.new(server_opts)
+    @server.start
+    @api = TinyServer::API.instance
+    @api.clear
+
+    @api.get("/roles", 302, nil, { "Content-Type" => "text", "Location" => "#{real_chef_server_url}/roles" }) do
+    end
+  end
+
+  def stop_tiny_server
+    @server.stop
+    @server = @api = nil
+  end
 
   include_context "default config options"
 
@@ -30,20 +45,14 @@ describe "redirection", :workstation do
     before { role "x", {} }
 
     context "and another server redirects to it with 302" do
-      before :each do
+      before(:each) do
         real_chef_server_url = Chef::Config.chef_server_url
-        Chef::Config.chef_server_url = "http://localhost:9018"
-        app = lambda do |env|
-          [302, { "Content-Type" => "text", "Location" => "#{real_chef_server_url}#{env["PATH_INFO"]}" }, ["302 found"] ]
-        end
-        @redirector_server_thread = start_app_server(app, 9018)
+        Chef::Config.chef_server_url = "http://localhost:9000"
+        start_tiny_server(real_chef_server_url)
       end
 
-      after :each do
-        if @redirector_thread
-          @redirector_thread.kill
-          @redirector_thread.join(30)
-        end
+      after(:each) do
+        stop_tiny_server
       end
 
       it "knife list /roles returns the role" do

data/spec/integration/knife/serve_spec.rb

@@ -1,6 +1,6 @@
 #
 # Author:: John Keiser (<jkeiser@chef.io>)
-# Copyright:: Copyright 2013-2016, Chef Software Inc.
+# Copyright:: Copyright 2013-2019, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -22,7 +22,6 @@ require "chef/server_api"
 describe "knife serve", :workstation do
   include IntegrationSupport
   include KnifeSupport
-  include AppServerSupport
 
   def with_knife_serve
     exception = nil

data/spec/integration/recipes/unified_mode_spec.rb

@@ -0,0 +1,876 @@
+require "support/shared/integration/integration_helper"
+require "chef/mixin/shell_out"
+
+describe "Unified Mode" do
+  include IntegrationSupport
+  include Chef::Mixin::ShellOut
+
+  let(:chef_dir) { File.expand_path("../../../../bin", __FILE__) }
+
+  let(:chef_client) { "bundle exec chef-client --minimal-ohai" }
+
+  when_the_repository "has a cookbook with a unified_mode resource with a delayed notification from the second block to the first block" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              action :nothing
+            end
+            var = "bar"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+              notifies :run, "ruby_block[first block]", :delayed
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # the "second block" runs first after "bar" is set
+      expect(result.stdout).to include("second: bar")
+      # then the "first block" runs after "baz" in the delayed phase
+      expect(result.stdout).to include("first: baz")
+      # nothing else should fire
+      expect(result.stdout).not_to include("first: foo")
+      expect(result.stdout).not_to include("first: bar")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified_mode resource with a delayed notification from the first block to the second block" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              notifies :run, "ruby_block[second block]", :delayed
+            end
+            var = "bar"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+              action :nothing
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default' -l debug", cwd: chef_dir)
+      # the first block should fire first
+      expect(result.stdout).to include("first: foo")
+      # the second block should fire in delayed phase
+      expect(result.stdout).to include("second: baz")
+      # nothing else should fire
+      expect(result.stdout).not_to include("first: bar")
+      expect(result.stdout).not_to include("first: baz")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: bar")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified_mode resource with an immediate notification from the second block to the first block" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              action :nothing
+            end
+            var = "bar"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+              notifies :run, "ruby_block[first block]", :immediate
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # the second resource should fire first when it is parsed
+      expect(result.stdout).to include("second: bar")
+      # the first resource should then immediately fire
+      expect(result.stdout).to include("first: bar")
+      # no other resources should fire
+      expect(result.stdout).not_to include("second: baz")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("first: foo")
+      expect(result.stdout).not_to include("first: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified_mode resource with an immediate notification from the first block to the second block" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              notifies :run, "ruby_block[second block]", :immediate
+            end
+            var = "bar"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+              action :nothing
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default' -l debug", cwd: chef_dir)
+      # both blocks should run when they're declared
+      expect(result.stdout).to include("first: foo")
+      expect(result.stdout).to include("second: bar")
+      # nothing else should run
+      expect(result.stdout).not_to include("first: bar")
+      expect(result.stdout).not_to include("first: baz")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified_mode resource with an immediate notification from the first block to a block that does not exist" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              notifies :run, "ruby_block[second block]", :immediate
+            end
+            var = "bar"
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should fail the run" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # both blocks should run when they're declared
+      expect(result.stdout).to include("first: foo")
+      # nothing else should run
+      expect(result.stdout).not_to include("second: bar")
+      expect(result.stdout).not_to include("first: bar")
+      expect(result.stdout).not_to include("first: baz")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: baz")
+      expect(result.stdout).to include("Chef::Exceptions::ResourceNotFound")
+      expect(result.error?).to be true
+    end
+  end
+
+  when_the_repository "has a cookbook with a normal resource with an delayed notification with global resource unified mode on" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          resource_name :unified_mode
+          provides :unified_mode
+
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+              action :nothing
+            end
+            var = "bar"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              notifies :run, "ruby_block[second block]", :delayed
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        resource_unified_mode_default true
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # the "first block" resource runs before the assignment to baz in compile time
+      expect(result.stdout).to include("first: bar")
+      # we should not run the "first block" at compile time
+      expect(result.stdout).not_to include("first: baz")
+      # (and certainly should run it this early)
+      expect(result.stdout).not_to include("first: foo")
+      # the delayed notification should still fire and run after everything else
+      expect(result.stdout).to include("second: baz")
+      # the action :nothing should suppress any other running of the second block
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: bar")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a normal resource with an immediate notification with global resource unified mode on" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+              action :nothing
+            end
+            var = "bar"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              notifies :run, "ruby_block[second block]", :immediate
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        resource_unified_mode_default true
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # the "first block" resource runs before the assignment to baz in compile time
+      expect(result.stdout).to include("first: bar")
+      # we should not run the "first block" at compile time
+      expect(result.stdout).not_to include("first: baz")
+      # (and certainly should run it this early)
+      expect(result.stdout).not_to include("first: foo")
+      # the immediate notifiation fires immediately
+      expect(result.stdout).to include("second: bar")
+      # the action :nothing should suppress any other running of the second block
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified resource with an immediate subscribes from the second resource to the first" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+            end
+            var = "bar"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+              subscribes :run, "ruby_block[first block]", :immediate
+              action :nothing
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # the first resource fires
+      expect(result.stdout).to include("first: foo")
+      # the second resource fires when it is parsed
+      expect(result.stdout).to include("second: bar")
+      # no other actions should run
+      expect(result.stdout).not_to include("first: bar")
+      expect(result.stdout).not_to include("first: baz")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified resource with an immediate subscribes from the first resource to the second" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              subscribes :run, "ruby_block[second block]", :immediate
+              action :nothing
+            end
+            var = "bar"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # the second resource fires first after bar is set
+      expect(result.stdout).to include("second: bar")
+      # the first resource then has its immediate subscribes fire at that location
+      expect(result.stdout).to include("first: bar")
+      # no other actions should run
+      expect(result.stdout).not_to include("first: baz")
+      expect(result.stdout).not_to include("first: foo")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified resource with an delayed subscribes from the second resource to the first" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+            end
+            var = "bar"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+              subscribes :run, "ruby_block[first block]", :delayed
+              action :nothing
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # the first resource fires as it is parsed
+      expect(result.stdout).to include("first: foo")
+      # the second resource then fires in the delayed notifications phase
+      expect(result.stdout).to include("second: baz")
+      # no other actions should run
+      expect(result.stdout).not_to include("first: bar")
+      expect(result.stdout).not_to include("first: baz")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: bar")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified resource with an delayed subscribes from the first resource to the second" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "first block" do
+              block do
+                puts "\nfirst: \#\{var\}"
+              end
+              subscribes :run, "ruby_block[second block]", :delayed
+              action :nothing
+            end
+            var = "bar"
+            ruby_block "second block" do
+              block do
+                puts "\nsecond: \#\{var\}"
+              end
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # the second resource fires first after bar is set
+      expect(result.stdout).to include("second: bar")
+      # the first resource then fires in the delayed notifications phase
+      expect(result.stdout).to include("first: baz")
+      # no other actions should run
+      expect(result.stdout).not_to include("first: foo")
+      expect(result.stdout).not_to include("first: bar")
+      expect(result.stdout).not_to include("second: foo")
+      expect(result.stdout).not_to include("second: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified resource with a correct before notification" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "notified block" do
+              block do
+                puts "\nnotified: \#\{var\}"
+              end
+              action :nothing
+            end
+            var = "bar"
+            whyrun_safe_ruby_block "notifying block" do
+              block do
+                puts "\nnotifying: \#\{var\}"
+              end
+              notifies :run, "ruby_block[notified block]", :before
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      expect(result.stdout.scan(/notifying: bar/).length).to eql(2)
+      expect(result.stdout).to include("Would execute the whyrun_safe_ruby_block notifying block")
+      expect(result.stdout).to include("notified: bar")
+      # no other actions should run
+      expect(result.stdout).not_to include("notified: foo")
+      expect(result.stdout).not_to include("notified: baz")
+      expect(result.stdout).not_to include("notifying: foo")
+      expect(result.stdout).not_to include("notifying: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified resource with a correct before subscribes" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            ruby_block "notified block" do
+              block do
+                puts "\nnotified: \#\{var\}"
+              end
+              subscribes :run, "whyrun_safe_ruby_block[notifying block]", :before
+              action :nothing
+            end
+            var = "bar"
+            whyrun_safe_ruby_block "notifying block" do
+              block do
+                puts "\nnotifying: \#\{var\}"
+              end
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should complete with success" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      expect(result.stdout.scan(/notifying: bar/).length).to eql(2)
+      expect(result.stdout).to include("Would execute the whyrun_safe_ruby_block notifying block")
+      expect(result.stdout).to include("notified: bar")
+      # no other actions should run
+      expect(result.stdout).not_to include("notified: foo")
+      expect(result.stdout).not_to include("notified: baz")
+      expect(result.stdout).not_to include("notifying: foo")
+      expect(result.stdout).not_to include("notifying: baz")
+      result.error!
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified resource with a broken/reversed before notification" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            whyrun_safe_ruby_block "notifying block" do
+              block do
+                puts "\nnotifying: \#\{var\}"
+              end
+              notifies :run, "ruby_block[notified block]", :before
+            end
+            var = "bar"
+            ruby_block "notified block" do
+              block do
+                puts "\nnotified: \#\{var\}"
+              end
+              action :nothing
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should fail the run" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default' -l debug", cwd: chef_dir)
+      # this doesn't work and we can't tell the difference between it and if we were trying to do a correct :before notification but typo'd the name
+      # so Chef::Exceptions::ResourceNotFound is the best we can do
+      expect(result.stdout).to include("Chef::Exceptions::ResourceNotFound")
+      expect(result.error?).to be true
+    end
+  end
+
+  when_the_repository "has a cookbook with a unified resource with a broken/reversed before subscribes" do
+    before do
+      directory "cookbooks/x" do
+
+        file "resources/unified_mode.rb", <<-EOM
+          unified_mode true
+          resource_name :unified_mode
+          provides :unified_mode
+          action :doit do
+            klass = new_resource.class
+            var = "foo"
+            whyrun_safe_ruby_block "notifying block" do
+              block do
+                puts "\nnotifying: \#\{var\}"
+              end
+            end
+            var = "bar"
+            ruby_block "notified block" do
+              block do
+                puts "\nnotified: \#\{var\}"
+              end
+              subscribes :run, "whyrun_safe_ruby_block[notifying block]", :before
+              action :nothing
+            end
+            var = "baz"
+          end
+        EOM
+
+        file "recipes/default.rb", <<-EOM
+          unified_mode "whatever"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "should fail the run" do
+      file "config/client.rb", <<~EOM
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # this fires first normally before the error
+      expect(result.stdout).to include("notifying: foo")
+      # everything else does not run
+      expect(result.stdout).not_to include("notified: foo")
+      expect(result.stdout).not_to include("notified: bar")
+      expect(result.stdout).not_to include("notified: baz")
+      expect(result.stdout).not_to include("notifying: bar")
+      expect(result.stdout).not_to include("notifying: baz")
+      expect(result.stdout).to include("Chef::Exceptions::UnifiedModeBeforeSubscriptionEarlierResource")
+      expect(result.error?).to be true
+    end
+  end
+
+  when_the_repository "has global resource unified mode on" do
+    before do
+      directory "cookbooks/x" do
+
+        file "recipes/default.rb", <<-EOM
+          var = "foo"
+          ruby_block "first block" do
+            block do
+              puts "\nfirst: \#\{var\}"
+            end
+          end
+          var = "bar"
+        EOM
+
+      end # directory 'cookbooks/x'
+    end
+
+    it "recipes should still have a compile/converge mode" do
+      file "config/client.rb", <<~EOM
+        resource_unified_mode_default true
+        local_mode true
+        cookbook_path "#{path_to("cookbooks")}"
+        log_level :warn
+      EOM
+
+      result = shell_out("#{chef_client} -c \"#{path_to("config/client.rb")}\" --no-color -F doc -o 'x::default'", cwd: chef_dir)
+      # in recipe mode we should still run normally with a compile/converge mode
+      expect(result.stdout).to include("first: bar")
+      expect(result.stdout).not_to include("first: foo")
+      result.error!
+    end
+  end
+end