chef 16.1.16 → 16.18.30

data/lib/chef/chef_fs/file_system/repository/chef_repository_file_system_root_dir.rb

@@ -109,23 +109,23 @@ class Chef
               child = root_dir.create_child(name, file_contents)
             else
               child_paths[name].each do |path|
-                begin
-                  ::FileUtils.mkdir_p(path)
-                  ::FileUtils.chmod(0700, path)
-                  if ChefUtils.windows?
-                    all_mask = Chef::ReservedNames::Win32::API::Security::GENERIC_ALL
-                    administrators = Chef::ReservedNames::Win32::Security::SID.Administrators
-                    owner = Chef::ReservedNames::Win32::Security::SID.default_security_object_owner
-                    dacl = Chef::ReservedNames::Win32::Security::ACL.create([
-                      Chef::ReservedNames::Win32::Security::ACE.access_allowed(owner, all_mask),
-                      Chef::ReservedNames::Win32::Security::ACE.access_allowed(administrators, all_mask),
-                    ])
-                    so = Chef::ReservedNames::Win32::Security::SecurableObject.new(path)
-                    so.owner = owner
-                    so.set_dacl(dacl, false)
-                  end
-                rescue Errno::EEXIST
+
+                ::FileUtils.mkdir_p(path)
+                ::FileUtils.chmod(0700, path)
+                if ChefUtils.windows?
+                  all_mask = Chef::ReservedNames::Win32::API::Security::GENERIC_ALL
+                  administrators = Chef::ReservedNames::Win32::Security::SID.Administrators
+                  owner = Chef::ReservedNames::Win32::Security::SID.default_security_object_owner
+                  dacl = Chef::ReservedNames::Win32::Security::ACL.create([
+                    Chef::ReservedNames::Win32::Security::ACE.access_allowed(owner, all_mask),
+                    Chef::ReservedNames::Win32::Security::ACE.access_allowed(administrators, all_mask),
+                  ])
+                  so = Chef::ReservedNames::Win32::Security::SecurableObject.new(path)
+                  so.owner = owner
+                  so.set_dacl(dacl, false)
                 end
+              rescue Errno::EEXIST
+
               end
               child = make_child_entry(name)
             end
@@ -161,7 +161,7 @@ class Chef
           # members.json and org.json may be found.
           #
           def root_dir
-            existing_paths = root_paths.select { |path| File.exists?(path) }
+            existing_paths = root_paths.select { |path| File.exist?(path) }
             if existing_paths.size > 0
               MultiplexedDir.new(existing_paths.map do |path|
                 dir = FileSystemEntry.new(name, parent, path)
@@ -184,7 +184,7 @@ class Chef
               return root_dir.child(name)
             end
 
-            paths = (child_paths[name] || []).select { |path| File.exists?(path) }
+            paths = (child_paths[name] || []).select { |path| File.exist?(path) }
             if paths.size == 0
               return NonexistentFSObject.new(name, self)
             end

data/lib/chef/chef_fs/file_system/repository/directory.rb

@@ -151,7 +151,7 @@ class Chef
           end
 
           def exists?
-            File.exists?(file_path)
+            File.exist?(file_path)
           end
 
           protected

data/lib/chef/chef_fs/file_system/repository/file_system_entry.rb

@@ -122,7 +122,7 @@ class Chef
           end
 
           def exists?
-            File.exists?(file_path) && (parent.nil? || parent.can_have_child?(name, dir?))
+            File.exist?(file_path) && (parent.nil? || parent.can_have_child?(name, dir?))
           end
 
           def read

data/lib/chef/chef_fs/knife.rb

@@ -18,7 +18,7 @@
 
 require_relative "../knife"
 require "pathname" unless defined?(Pathname)
-require_relative "../dist"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 
 class Chef
   module ChefFS
@@ -49,7 +49,7 @@ class Chef
 
       option :chef_repo_path,
         long: "--chef-repo-path PATH",
-        description: "Overrides the location of #{Chef::Dist::PRODUCT} repo. Default is specified by chef_repo_path in the config"
+        description: "Overrides the location of #{ChefUtils::Dist::Infra::PRODUCT} repo. Default is specified by chef_repo_path in the config"
 
       option :concurrency,
         long: "--concurrency THREADS",

data/lib/chef/chef_fs/parallelizer/parallel_enumerable.rb

@@ -145,7 +145,7 @@ class Chef
 
         def each_with_exceptions_unordered
           if @each_running
-            raise "each() called on parallel enumerable twice simultaneously!  Bad mojo"
+            raise "each() called on parallel enumerable twice simultaneously! Bad mojo"
           end
 
           @each_running = true

data/lib/chef/chef_fs/parallelizer.rb

@@ -1,4 +1,3 @@
-require "thread"
 require_relative "parallelizer/parallel_enumerable"
 
 class Chef

data/lib/chef/chef_fs/path_utils.rb

@@ -118,7 +118,7 @@ class Chef
 
         if ancestor.length == path.length
           ""
-        elsif path[ancestor.length, 1] =~ /#{PathUtils.regexp_path_separator}/
+        elsif /#{PathUtils.regexp_path_separator}/.match?(path[ancestor.length, 1])
           path[ancestor.length + 1..-1]
         else
           nil

data/lib/chef/client.rb

@@ -20,7 +20,7 @@
 
 require_relative "config"
 require_relative "mixin/params_validate"
-require "chef-utils/dsl/path_sanity" unless defined?(ChefUtils::DSL::PathSanity)
+require "chef-utils/dsl/default_paths" unless defined?(ChefUtils::DSL::DefaultPaths)
 require_relative "log"
 require_relative "deprecated"
 require_relative "server_api"
@@ -29,7 +29,7 @@ require_relative "api_client/registration"
 require_relative "node"
 require_relative "role"
 require_relative "file_cache"
-require_relative "run_context"
+Chef.autoload :RunContext, File.expand_path("run_context", __dir__)
 require_relative "runner"
 require_relative "run_status"
 require_relative "cookbook/cookbook_collection"
@@ -48,16 +48,17 @@ require_relative "action_collection"
 require_relative "resource_reporter"
 require_relative "data_collector"
 require_relative "run_lock"
-require_relative "policy_builder"
+Chef.autoload :PolicyBuilder, File.expand_path("policy_builder", __dir__)
 require_relative "request_id"
 require_relative "platform/rebooter"
 require_relative "mixin/deprecation"
 require "chef-utils" unless defined?(ChefUtils::CANARY)
 require "ohai" unless defined?(Ohai::System)
-require "rbconfig"
-require_relative "dist"
+require "rbconfig" unless defined?(RbConfig)
 require "forwardable" unless defined?(Forwardable)
 
+require_relative "compliance/runner"
+
 class Chef
   # == Chef::Client
   # The main object in a Chef run. Preps a Chef::Node and Chef::RunContext,
@@ -236,6 +237,7 @@ class Chef
 
         events.register(Chef::DataCollector::Reporter.new(events))
         events.register(Chef::ActionCollection.new(events))
+        events.register(Chef::Compliance::Runner.new)
 
         run_status.run_id = request_id = Chef::RequestID.instance.request_id
 
@@ -244,19 +246,15 @@ class Chef
         run_status.run_context = run_context
 
         events.run_start(Chef::VERSION, run_status)
-
-        logger.info("*** #{Chef::Dist::PRODUCT} #{Chef::VERSION} ***")
+        logger.info("*** #{ChefUtils::Dist::Infra::PRODUCT} #{Chef::VERSION} ***")
         logger.info("Platform: #{RUBY_PLATFORM}")
-        logger.info "#{Chef::Dist::CLIENT.capitalize} pid: #{Process.pid}"
+        logger.info "#{ChefUtils::Dist::Infra::CLIENT.capitalize} pid: #{Process.pid}"
         logger.info "Targeting node: #{Chef::Config.target_mode.host}" if Chef::Config.target_mode?
-        logger.debug("#{Chef::Dist::CLIENT.capitalize} request_id: #{request_id}")
-        ENV["PATH"] = ChefUtils::DSL::PathSanity.sanitized_path if Chef::Config[:enforce_path_sanity]
+        logger.debug("#{ChefUtils::Dist::Infra::CLIENT.capitalize} request_id: #{request_id}")
+        logger.warn("`enforce_path_sanity` is deprecated, please use `enforce_default_paths` instead!") if Chef::Config[:enforce_path_sanity]
+        ENV["PATH"] = ChefUtils::DSL::DefaultPaths.default_paths if Chef::Config[:enforce_default_paths] || Chef::Config[:enforce_path_sanity]
 
-        if Chef::Config.target_mode?
-          get_ohai_data_remotely
-        else
-          run_ohai
-        end
+        run_ohai
 
         unless Chef::Config[:solo_legacy_mode]
           register
@@ -273,7 +271,7 @@ class Chef
         build_node
 
         run_status.start_clock
-        logger.info("Starting #{Chef::Dist::PRODUCT} Run for #{node.name}")
+        logger.info("Starting #{ChefUtils::Dist::Infra::PRODUCT} Run for #{node.name}")
         run_started
 
         do_windows_admin_check
@@ -288,7 +286,7 @@ class Chef
         converge_and_save(run_context)
 
         run_status.stop_clock
-        logger.info("#{Chef::Dist::PRODUCT} Run complete in #{run_status.elapsed_time} seconds")
+        logger.info("#{ChefUtils::Dist::Infra::PRODUCT} Run complete in #{run_status.elapsed_time} seconds")
         run_completed_successfully
         events.run_completed(node, run_status)
 
@@ -329,12 +327,12 @@ class Chef
     def warn_if_eol
       require_relative "version"
 
-      # We make a release every year so take the version you're on + 2006 and you get
+      # We make a release every year so take the version you're on + 2007 and you get
       # the year it goes EOL
       eol_year = 2006 + Gem::Version.new(Chef::VERSION).segments.first
 
-      if Time.now > Time.new(eol_year, 5, 01)
-        logger.warn("This release of #{Chef::Dist::PRODUCT} became end of life (EOL) on May 1st #{eol_year}. Please update to a supported release to receive new features, bug fixes, and security updates.")
+      if Time.now > Time.new(eol_year, 11, 30)
+        logger.warn("This release of #{ChefUtils::Dist::Infra::PRODUCT} became end of life (EOL) on November 30th #{eol_year}. Please update to a supported release to receive new features, bug fixes, and security updates.")
       end
     end
 
@@ -343,7 +341,7 @@ class Chef
       formatters_for_run.map do |formatter_name, output_path|
         if output_path.nil?
           Chef::Formatters.new(formatter_name, STDOUT_FD, STDERR_FD)
-        else
+        elsif output_path.is_a?(String)
           io = File.open(output_path, "a+")
           io.sync = true
           Chef::Formatters.new(formatter_name, io, io)
@@ -576,32 +574,6 @@ class Chef
       end
     end
 
-    #
-    # Populate the minimal ohai attributes defined in #run_ohai with data train collects.
-    #
-    # Eventually ohai may support colleciton of data.
-    #
-    def get_ohai_data_remotely
-      ohai.data[:fqdn] = if transport_connection.respond_to?(:hostname)
-                           transport_connection.hostname
-                         else
-                           Chef::Config[:target_mode][:host]
-                         end
-      if transport_connection.respond_to?(:os)
-        ohai.data[:platform] = transport_connection.os.name
-        ohai.data[:platform_version] = transport_connection.os.release
-        ohai.data[:os] = transport_connection.os.family_hierarchy[1]
-        ohai.data[:platform_family] = transport_connection.os.family
-      end
-      # train does not collect these specifically
-      # ohai.data[:machinename] = nil
-      # ohai.data[:hostname] = nil
-      # ohai.data[:os_version] = nil # kernel version
-
-      ohai.data[:ohai_time] = Time.now.to_f
-      events.ohai_completed(node)
-    end
-
     #
     # Run ohai plugins.  Runs all ohai plugins unless minimal_ohai is specified.
     #
@@ -614,6 +586,7 @@ class Chef
     #
     def run_ohai
       filter = Chef::Config[:minimal_ohai] ? %w{fqdn machinename hostname platform platform_version ohai_time os os_version init_package} : nil
+      ohai.transport_connection = transport_connection if Chef::Config.target_mode?
       ohai.all_plugins(filter)
       events.ohai_completed(node)
     end
@@ -707,16 +680,16 @@ class Chef
     #
     def converge(run_context)
       catch(:end_client_run_early) do
-        begin
-          events.converge_start(run_context)
-          logger.debug("Converging node #{node_name}")
-          @runner = Chef::Runner.new(run_context)
-          @runner.converge
-          events.converge_complete
-        rescue Exception => e
-          events.converge_failed(e)
-          raise e
-        end
+
+        events.converge_start(run_context)
+        logger.debug("Converging node #{node_name}")
+        @runner = Chef::Runner.new(run_context)
+        @runner.converge
+        events.converge_complete
+      rescue Exception => e
+        events.converge_failed(e)
+        raise e
+
       end
     end
 
@@ -763,7 +736,7 @@ class Chef
         logger.trace("Checking for administrator privileges....")
 
         if !has_admin_privileges?
-          message = "#{Chef::Dist::CLIENT} doesn't have administrator privileges on node #{node_name}."
+          message = "#{ChefUtils::Dist::Infra::CLIENT} doesn't have administrator privileges on node #{node_name}."
           if Chef::Config[:fatal_windows_admin_check]
             logger.fatal(message)
             logger.fatal("fatal_windows_admin_check is set to TRUE.")
@@ -772,7 +745,7 @@ class Chef
             logger.warn("#{message} This might cause unexpected resource failures.")
           end
         else
-          logger.trace("#{Chef::Dist::CLIENT} has administrator privileges on node #{node_name}.")
+          logger.trace("#{ChefUtils::Dist::Infra::CLIENT} has administrator privileges on node #{node_name}.")
         end
       end
     end

data/lib/chef/compliance/default_attributes.rb

@@ -0,0 +1,97 @@
+# Author:: Stephan Renatus <srenatus@chef.io>
+# Copyright:: Copyright (c) Chef Software Inc. <legal@chef.io>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require "chef/node/attribute_collections" # for VividMash
+require "chef/util/path_helper"
+
+class Chef
+  module Compliance
+    DEFAULT_ATTRIBUTES = Chef::Node::VividMash.new(
+      # If enabled, a cache is built for all backend calls. This should only be
+      # disabled if you are expecting unique results from the same backend call.
+      # Under the covers, this controls :command and :file caching on Chef InSpec's
+      # Train connection.
+      "inspec_backend_cache" => true,
+
+      # Controls what is done with the resulting report after the Chef InSpec run.
+      # Accepts a single string value or an array of multiple values.
+      # Accepted values: 'chef-server-automate', 'chef-automate', 'json-file', 'audit-enforcer'
+      "reporter" => "json-file",
+
+      # Controls if Chef InSpec profiles should be fetched from Chef Automate or Chef Infra Server
+      # in addition to the default fetch locations provided by Chef Inspec.
+      # Accepted values: nil, 'chef-server', 'chef-automate'
+      "fetcher" => nil,
+
+      # Allow for connections to HTTPS endpoints using self-signed ssl certificates.
+      "insecure" => nil,
+
+      # Controls verbosity of Chef InSpec runner.
+      "quiet" => true,
+
+      # Chef Inspec Compliance profiles to be used for scan of node.
+      # See README.md for details
+      "profiles" => {},
+
+      # Extra inputs passed to Chef InSpec to allow finer-grained control over behavior.
+      # These are mapped to Chef InSpec's inputs, but are named attributes here for legacy reasons.
+      # See Chef Inspec's documentation for more information: https://docs.chef.io/inspec/inputs/
+      "attributes" => {},
+
+      # A string path or an array of paths to Chef InSpec waiver files.
+      # See Chef Inspec's documentation for more information: https://docs.chef.io/inspec/waivers/
+      "waiver_file" => nil,
+
+      "json_file" => {
+        # The location on disk that Chef InSpec's json reports are saved to when using the
+        # 'json-file' reporter. Defaults to:
+        # <chef_cache_path>/compliance_reports/compliance-<timestamp>.json
+        "location" => Chef::Util::PathHelper.join(
+          Chef::Config[:cache_path],
+          "compliance_reports",
+          Time.now.utc.strftime("compliance-%Y%m%d%H%M%S.json")
+        ),
+      },
+
+      # Control results that have a `run_time` below this limit will
+      # be stripped of the `start_time` and `run_time` fields to
+      # reduce the size of the reports being sent to Chef Automate.
+      "run_time_limit" => 1.0,
+
+      # A control result message that exceeds this character limit will be truncated.
+      # This helps keep reports to a reasonable size. On rare occasions, we've seen messages exceeding 9 MB in size,
+      # causing the report to not be ingested in the backend because of the 4 MB report size rpc limitation.
+      # Chef InSpec will append this text at the end of any truncated messages: `[Truncated to 10000 characters]`
+      "result_message_limit" => 10000,
+
+      # When a Chef InSpec resource throws an exception, results will contain a short error message and a
+      # detailed ruby stacktrace of the error. This attribute instructs Chef InSpec not to include the detailed stacktrace in order
+      # to keep the overall report to a manageable size.
+      "result_include_backtrace" => false,
+
+      # The array of results per control will be truncated at this limit to avoid large reports that cannot be
+      # processed by Chef Automate. A summary of removed results will be sent with each impacted control.
+      "control_results_limit" => 50,
+
+      # If enabled, a hash representation of the Chef Infra node object will be sent to Chef InSpec in an input
+      # named `chef_node`.
+      "chef_node_attribute_enabled" => false,
+
+      # Should the built-in compliance phase run. True and false force the behavior. Nil does magic based on if you have
+      # profiles defined but do not have the audit cookbook enabled.
+      "compliance_phase" => false
+    )
+  end
+end

data/lib/chef/compliance/fetcher/automate.rb

@@ -0,0 +1,80 @@
+require "uri" unless defined?(URI)
+require "plugins/inspec-compliance/lib/inspec-compliance"
+
+class Chef
+  module Compliance
+    module Fetcher
+      class Automate < ::InspecPlugins::Compliance::Fetcher
+        name "chef-automate"
+
+        # Positions this fetcher before Chef InSpec's `compliance` fetcher.
+        # Only load this file if you want to use Compliance Phase in Chef Solo with Chef Automate.
+        priority 502
+
+        CONFIG = {
+          "insecure" => true,
+          "token" => nil,
+          "server_type" => "automate",
+          "automate" => {
+            "ent" => "default",
+            "token_type" => "dctoken",
+          },
+        }.freeze
+
+        def self.resolve(target)
+          uri = get_target_uri(target)
+          return nil if uri.nil?
+
+          config = CONFIG.dup
+
+          # we have detailed information available in our lockfile, no need to ask the server
+          if target.respond_to?(:key?) && target.key?(:url)
+            profile_fetch_url = target[:url]
+          else
+            # verifies that the target e.g base/ssh exists
+            profile = sanitize_profile_name(uri)
+            owner, id = profile.split("/")
+            profile_path = if target.respond_to?(:key?) && target.key?(:version)
+                             "/compliance/profiles/#{owner}/#{id}/version/#{target[:version]}/tar"
+                           else
+                             "/compliance/profiles/#{owner}/#{id}/tar"
+                           end
+
+            url = URI(Chef::Config[:data_collector][:server_url])
+            url.path = profile_path
+            profile_fetch_url = url.to_s
+
+            config["token"] = Chef::Config[:data_collector][:token]
+
+            if config["token"].nil?
+              raise Inspec::FetcherFailure,
+                "No data-collector token set, which is required by the chef-automate fetcher. " \
+                "Set the `data_collector.token` configuration parameter in your client.rb " \
+                'or use the "chef-server-automate" reporter which does not require any ' \
+                "data-collector settings and uses #{ChefUtils::Dist::Server::PRODUCT} to fetch profiles."
+            end
+          end
+
+          new(profile_fetch_url, config)
+        rescue URI::Error => _e
+          nil
+        end
+
+        # returns a parsed url for `admin/profile` or `compliance://admin/profile`
+        # TODO: remove in future, copied from inspec to support older versions of inspec
+        def self.sanitize_profile_name(profile)
+          uri = if URI(profile).scheme == "compliance"
+                  URI(profile)
+                else
+                  URI("compliance://#{profile}")
+                end
+          uri.to_s.sub(%r{^compliance:\/\/}, "")
+        end
+
+        def to_s
+          "#{ChefUtils::Dist::Automate::PRODUCT} for #{ChefUtils::Dist::Solo::PRODUCT} Fetcher"
+        end
+      end
+    end
+  end
+end

data/lib/chef/compliance/fetcher/chef_server.rb

@@ -0,0 +1,134 @@
+require "uri" unless defined?(URI)
+require "plugins/inspec-compliance/lib/inspec-compliance"
+
+# This class implements an InSpec fetcher for Chef Server. The implementation
+# is based on the Chef Compliance fetcher and only adapts the calls to redirect
+# the requests via Chef Server.
+#
+# This implementation depends on chef-client runtime, therefore it is only executable
+# inside of a chef-client run
+
+class Chef
+  module Compliance
+    module Fetcher
+      class ChefServer < ::InspecPlugins::Compliance::Fetcher
+        name "chef-server"
+
+        # it positions itself before `compliance` fetcher
+        # only load it, if the Chef Server is integrated with Chef Compliance
+        priority 501
+
+        CONFIG = { "insecure" => true }.freeze
+
+        # Accepts URLs to compliance profiles in one of two forms:
+        # * a String URL with a compliance scheme, like "compliance://namespace/profile_name"
+        # * a Hash with a key of `compliance` and a value like "compliance/profile_name" and optionally a `version` key with a String value
+        def self.resolve(target)
+          profile_uri = get_target_uri(target)
+          return nil if profile_uri.nil?
+
+          organization = Chef::Config[:chef_server_url].split("/").last
+          owner = profile_uri.user ? "#{profile_uri.user}@#{profile_uri.host}" : profile_uri.host
+          version = target[:version] if target.respond_to?(:key?)
+
+          path_parts = [""]
+          path_parts << "compliance" if chef_server_reporter? || chef_server_fetcher?
+          path_parts << "organizations"
+          path_parts << organization
+          path_parts << "owners"
+          path_parts << owner
+          path_parts << "compliance"
+          path_parts << profile_uri.path
+          path_parts << "version/#{version}" if version
+          path_parts << "tar"
+
+          target_url = URI(Chef::Config[:chef_server_url])
+          target_url.path = File.join(path_parts)
+          Chef::Log.info("Fetching profile from: #{target_url}")
+
+          new(target_url, CONFIG)
+        rescue URI::Error => _e
+          nil
+        end
+
+        #
+        # We want to save compliance: in the lockfile rather than url: to
+        # make sure we go back through the ComplianceAPI handling.
+        #
+        def resolved_source
+          { compliance: chef_server_url }
+        end
+
+        # Downloads archive to temporary file using a Chef::ServerAPI
+        # client so that Chef Server's header-based authentication can be
+        # used.
+        def download_archive_to_temp
+          return @temp_archive_path unless @temp_archive_path.nil?
+
+          rest = Chef::ServerAPI.new(@target, Chef::Config.merge(ssl_verify_mode: :verify_none))
+          archive = with_http_rescue do
+            rest.streaming_request(@target)
+          end
+          @archive_type = ".tar.gz"
+
+          if archive.nil?
+            path = @target.respond_to?(:path) ? @target.path : path
+            raise Inspec::FetcherFailure, "Unable to find requested profile on path: '#{path}' on the #{ChefUtils::Dist::Automate::PRODUCT} system."
+          end
+
+          Inspec::Log.debug("Archive stored at temporary location: #{archive.path}")
+          @temp_archive_path = archive.path
+        end
+
+        def with_http_rescue
+          response = yield
+          if response.respond_to?(:code)
+            # handle non 200 error codes, they are not raised as Net::HTTPClientException
+            handle_http_error_code(response.code) if response.code.to_i >= 300
+          end
+          response
+        rescue Net::HTTPClientException => e
+          Chef::Log.error e
+          handle_http_error_code(e.response.code)
+        end
+
+        def handle_http_error_code(code)
+          case code
+          when /401|403/
+            Chef::Log.error "Auth issue: see the Compliance Phase troubleshooting documentation (http://docs.chef.io/chef_compliance_phase/#troubleshooting)."
+          when /404/
+            Chef::Log.error "Object does not exist on remote server."
+          when /413/
+            Chef::Log.error "You most likely hit the erchef request size in #{ChefUtils::Dist::Server::PRODUCT} that defaults to ~2MB. To increase this limit see the Compliance Phase troubleshooting documentation (http://docs.chef.io/chef_compliance_phase/#troubleshooting) or the Chef Infra Server configuration documentation (https://docs.chef.io/server/config_rb_server/)"
+          when /429/
+            Chef::Log.error "This error typically means the data sent was larger than #{ChefUtils::Dist::Automate::PRODUCT}'s limit (4 MB). Run InSpec locally to identify any controls producing large diffs."
+          end
+          msg = "Received HTTP error #{code}"
+          Chef::Log.error msg
+          raise Inspec::FetcherFailure, msg
+        end
+
+        def to_s
+          "#{ChefUtils::Dist::Server::PRODUCT}/Compliance Profile Loader"
+        end
+
+        CHEF_SERVER_REPORTERS = %w{chef-server chef-server-compliance chef-server-visibility chef-server-automate}.freeze
+        def self.chef_server_reporter?
+          (Array(Chef.node.attributes["audit"]["reporter"]) & CHEF_SERVER_REPORTERS).any?
+        end
+
+        CHEF_SERVER_FETCHERS = %w{chef-server chef-server-compliance chef-server-visibility chef-server-automate}.freeze
+        def self.chef_server_fetcher?
+          CHEF_SERVER_FETCHERS.include?(Chef.node.attributes["audit"]["fetcher"])
+        end
+
+        private
+
+        def chef_server_url
+          m = %r{^#{@config['server']}/owners/(?<owner>[^/]+)/compliance/(?<id>[^/]+)/tar$}.match(@target)
+          "#{m[:owner]}/#{m[:id]}"
+        end
+      end
+    end
+  end
+end