chef 16.1.16 → 16.18.30

data/spec/unit/compliance/reporter/chef_server_automate_spec.rb

@@ -0,0 +1,177 @@
+require "spec_helper"
+
+describe Chef::Compliance::Reporter::ChefServerAutomate do
+  before do
+    WebMock.disable_net_connect!
+
+    Chef::Config[:client_key] = File.expand_path("../../../data/ssl/private_key.pem", __dir__)
+    Chef::Config[:node_name] = "spec-node"
+  end
+
+  let(:reporter) { Chef::Compliance::Reporter::ChefServerAutomate.new(opts) }
+
+  let(:opts) do
+    {
+      entity_uuid: "aaaaaaaa-709a-475d-bef5-zzzzzzzzzzzz",
+      run_id: "3f0536f7-3361-4bca-ae53-b45118dceb5d",
+      node_info: {
+        node: "chef-client.solo",
+        environment: "My Prod Env",
+        roles: %w{base_linux apache_linux},
+        recipes: ["some_cookbook::some_recipe", "some_cookbook"],
+        policy_name: "test_policy_name",
+        policy_group: "test_policy_group",
+        chef_tags: ["mylinux", "my.tag", "some=tag"],
+        organization_name: "test_org",
+        source_fqdn: "api.chef.io",
+        ipaddress: "192.168.56.33",
+        fqdn: "lb1.prod.example.com",
+      },
+      url: "https://chef.server/data_collector",
+      control_results_limit: 2,
+      timestamp: Time.parse("2016-07-19T19:19:19+01:00"),
+    }
+  end
+
+  let(:inspec_report) do
+    {
+      "version": "1.2.1",
+      "profiles":
+      [{ "name": "tmp_compliance_profile",
+         "title": "/tmp Compliance Profile",
+         "summary": "An Example Compliance Profile",
+         "sha256": "7bd598e369970002fc6f2d16d5b988027d58b044ac3fa30ae5fc1b8492e215cd",
+         "version": "0.1.1",
+         "maintainer": "Nathen Harvey <nharvey@chef.io>",
+         "license": "Apache 2.0 License",
+         "copyright": "Nathen Harvey <nharvey@chef.io>",
+         "supports": [],
+         "controls":
+         [{ "title": "A /tmp directory must exist",
+            "desc": "A /tmp directory must exist",
+            "impact": 0.3,
+            "refs": [],
+            "tags": {},
+            "code": "control 'tmp-1.0' do\n  impact 0.3\n  title 'A /tmp directory must exist'\n  desc 'A /tmp directory must exist'\n  describe file '/tmp' do\n    it { should be_directory }\n  end\nend\n",
+            "source_location": { "ref": "/Users/vjeffrey/code/delivery/insights/data_generator/chef-client/cache/cookbooks/test-cookbook/recipes/../files/default/compliance_profiles/tmp_compliance_profile/controls/tmp.rb", "line": 3 },
+            "id": "tmp-1.0",
+            "results": [
+              { "status": "passed", "code_desc": "File /tmp should be directory", "run_time": 0.002312, "start_time": "2016-10-19 11:09:43 -0400" },
+            ],
+          },
+          { "title": "/tmp directory is owned by the root user",
+            "desc": "The /tmp directory must be owned by the root user",
+            "impact": 0.3,
+            "refs": [{ "url": "https://pages.chef.io/rs/255-VFB-268/images/compliance-at-velocity2015.pdf", "ref": "Compliance Whitepaper" }],
+            "tags": { "production": nil, "development": nil, "identifier": "value", "remediation": "https://github.com/chef-cookbooks/audit" },
+            "code": "control 'tmp-1.1' do\n  impact 0.3\n  title '/tmp directory is owned by the root user'\n  desc 'The /tmp directory must be owned by the root user'\n  tag 'production','development'\n  tag identifier: 'value'\n  tag remediation: 'https://github.com/chef-cookbooks/audit'\n  ref 'Compliance Whitepaper', url: 'https://pages.chef.io/rs/255-VFB-268/images/compliance-at-velocity2015.pdf'\n  describe file '/tmp' do\n    it { should be_owned_by 'root' }\n  end\nend\n",
+            "source_location": { "ref": "/Users/vjeffrey/code/delivery/insights/data_generator/chef-client/cache/cookbooks/test-cookbook/recipes/../files/default/compliance_profiles/tmp_compliance_profile/controls/tmp.rb", "line": 12 },
+            "id": "tmp-1.1",
+            "results": [
+              { "status": "passed", "code_desc": 'File /tmp should be owned by "root"', "run_time": 1.228845, "start_time": "2016-10-19 11:09:43 -0400" },
+              { "status": "skipped", "code_desc": 'File /tmp should be owned by "root"', "run_time": 1.228845, "start_time": "2016-10-19 11:09:43 -0400" },
+              { "status": "failed", "code_desc": "File /etc/hosts is expected to be directory", "run_time": 1.228845, "start_time": "2016-10-19 11:09:43 -0400", "message": "expected `File /etc/hosts.directory?` to return true, got false" },
+            ],
+          },
+        ],
+         "groups": [{ "title": "/tmp Compliance Profile", "controls": ["tmp-1.0", "tmp-1.1"], "id": "controls/tmp.rb" }],
+         "attributes": [{ "name": "syslog_pkg", "options": { "default": "rsyslog", "description": "syslog package..." } }] }],
+      "other_checks": [],
+      "statistics": { "duration": 0.032332 },
+    }
+  end
+
+  let(:enriched_report) do
+    {
+      "version": "1.2.1",
+      "profiles": [
+        {
+          "name": "tmp_compliance_profile",
+          "title": "/tmp Compliance Profile",
+          "summary": "An Example Compliance Profile",
+          "sha256": "7bd598e369970002fc6f2d16d5b988027d58b044ac3fa30ae5fc1b8492e215cd",
+          "version": "0.1.1",
+          "maintainer": "Nathen Harvey <nharvey@chef.io>",
+          "license": "Apache 2.0 License",
+          "copyright": "Nathen Harvey <nharvey@chef.io>",
+          "supports": [],
+          "controls": [
+            {
+              "title": "A /tmp directory must exist",
+              "desc": "A /tmp directory must exist",
+              "impact": 0.3,
+              "refs": [],
+              "tags": {},
+              "code":
+              "control 'tmp-1.0' do\n  impact 0.3\n  title 'A /tmp directory must exist'\n  desc 'A /tmp directory must exist'\n  describe file '/tmp' do\n    it { should be_directory }\n  end\nend\n",
+              "source_location": { "ref": "/Users/vjeffrey/code/delivery/insights/data_generator/chef-client/cache/cookbooks/test-cookbook/recipes/../files/default/compliance_profiles/tmp_compliance_profile/controls/tmp.rb", "line": 3 },
+              "id": "tmp-1.0",
+              "results": [{ "status": "passed", "code_desc": "File /tmp should be directory", "run_time": 0.002312, "start_time": "2016-10-19 11:09:43 -0400" }],
+            },
+            {
+              "title": "/tmp directory is owned by the root user",
+              "desc": "The /tmp directory must be owned by the root user",
+              "impact": 0.3,
+              "refs": [{ "url": "https://pages.chef.io/rs/255-VFB-268/images/compliance-at-velocity2015.pdf", "ref": "Compliance Whitepaper" }],
+              "tags": { "production": nil, "development": nil, "identifier": "value", "remediation": "https://github.com/chef-cookbooks/audit" },
+              "code": "control 'tmp-1.1' do\n  impact 0.3\n  title '/tmp directory is owned by the root user'\n  desc 'The /tmp directory must be owned by the root user'\n  tag 'production','development'\n  tag identifier: 'value'\n  tag remediation: 'https://github.com/chef-cookbooks/audit'\n  ref 'Compliance Whitepaper', url: 'https://pages.chef.io/rs/255-VFB-268/images/compliance-at-velocity2015.pdf'\n  describe file '/tmp' do\n    it { should be_owned_by 'root' }\n  end\nend\n",
+              "source_location": { "ref": "/Users/vjeffrey/code/delivery/insights/data_generator/chef-client/cache/cookbooks/test-cookbook/recipes/../files/default/compliance_profiles/tmp_compliance_profile/controls/tmp.rb", "line": 12 },
+              "id": "tmp-1.1",
+              "results": [
+                { "status": "failed", "code_desc": "File /etc/hosts is expected to be directory", "run_time": 1.228845, "start_time": "2016-10-19 11:09:43 -0400", "message": "expected `File /etc/hosts.directory?` to return true, got false" },
+                { "status": "skipped", "code_desc": 'File /tmp should be owned by "root"', "run_time": 1.228845, "start_time": "2016-10-19 11:09:43 -0400" },
+              ],
+              "removed_results_counts": { "failed": 0, "skipped": 0, "passed": 1 },
+            },
+          ],
+          "groups": [{ "title": "/tmp Compliance Profile", "controls": ["tmp-1.0", "tmp-1.1"], "id": "controls/tmp.rb" }],
+          "attributes": [{ "name": "syslog_pkg", "options": { "default": "rsyslog", "description": "syslog package..." } }],
+        },
+      ],
+      "other_checks": [],
+      "statistics": { "duration": 0.032332 },
+      "type": "inspec_report",
+      "node_name": "chef-client.solo",
+      "end_time": "2016-07-19T18:19:19Z",
+      "node_uuid": "aaaaaaaa-709a-475d-bef5-zzzzzzzzzzzz",
+      "environment": "My Prod Env",
+      "roles": %w{base_linux apache_linux},
+      "recipes": ["some_cookbook::some_recipe", "some_cookbook"],
+      "report_uuid": "3f0536f7-3361-4bca-ae53-b45118dceb5d",
+      "source_fqdn": "api.chef.io",
+      "organization_name": "test_org",
+      "policy_group": "test_policy_group",
+      "policy_name": "test_policy_name",
+      "chef_tags": ["mylinux", "my.tag", "some=tag"],
+      "ipaddress": "192.168.56.33",
+      "fqdn": "lb1.prod.example.com",
+    }
+  end
+
+  it "sends report successfully" do
+    # TODO: Had to change 'X-Ops-Server-Api-Version' from 1 to 2, is that correct?
+    report_stub = stub_request(:post, "https://chef.server/data_collector")
+      .with(
+        body: enriched_report,
+        headers: {
+          "X-Chef-Version" => Chef::VERSION,
+          "X-Ops-Authorization-1" => /.+/,
+          "X-Ops-Authorization-2" => /.+/,
+          "X-Ops-Authorization-3" => /.+/,
+          "X-Ops-Authorization-4" => /.+/,
+          "X-Ops-Authorization-5" => /.+/,
+          "X-Ops-Authorization-6" => /.+/,
+          "X-Ops-Content-Hash" => "yfck5nQDcRWta06u45Q+J463LYY=",
+          "X-Ops-Server-Api-Version" => "2",
+          "X-Ops-Sign" => "algorithm=sha1;version=1.1;",
+          "X-Ops-Timestamp" => /.+/,
+          "X-Ops-Userid" => "spec-node",
+          "X-Remote-Request-Id" => /.+/,
+        }
+      ).to_return(status: 200)
+
+    expect(reporter.send_report(inspec_report)).to eq(true)
+
+    expect(report_stub).to have_been_requested
+  end
+end

data/spec/unit/compliance/reporter/compliance_enforcer_spec.rb

@@ -0,0 +1,48 @@
+require "spec_helper"
+
+describe Chef::Compliance::Reporter::AuditEnforcer do
+  let(:reporter) { Chef::Compliance::Reporter::AuditEnforcer.new }
+
+  it "does not raise error for a successful InSpec report" do
+    report = {
+      "profiles": [
+        {
+          "controls": [
+            { "id": "c1", "results": [{ "status": "passed" }] },
+            { "id": "c2", "results": [{ "status": "passed" }] },
+          ],
+        },
+      ],
+    }
+
+    expect(reporter.send_report(report)).to eq(true)
+  end
+
+  it "does not raise error for an InSpec report with no controls" do
+    report = { "profiles": [{ "name": "empty" }] }
+
+    expect(reporter.send_report(report)).to eq(true)
+  end
+
+  it "does not raise error for an InSpec report with controls but no results" do
+    report = { "profiles": [{ "controls": [{ "id": "empty" }] }] }
+    expect(reporter.send_report(report)).to eq(true)
+  end
+
+  it "raises an error for a failed InSpec report" do
+    report = {
+      "profiles": [
+        {
+          "controls": [
+            { "id": "c1", "results": [{ "status": "passed" }] },
+            { "id": "c2", "results": [{ "status": "failed" }] },
+          ],
+        },
+      ],
+    }
+
+    expect {
+      reporter.send_report(report)
+    }.to raise_error(Chef::Compliance::Reporter::AuditEnforcer::ControlFailure, "Audit c2 has failed. Aborting chef-client run.")
+  end
+end

data/spec/unit/compliance/runner_spec.rb

@@ -0,0 +1,215 @@
+require "spec_helper"
+
+describe Chef::Compliance::Runner do
+  let(:logger) { double(:logger).as_null_object }
+  let(:node) { Chef::Node.new(logger: logger) }
+
+  let(:runner) do
+    described_class.new.tap do |r|
+      r.node = node
+      r.run_id = "my_run_id"
+    end
+  end
+
+  describe "#enabled?" do
+
+    it "is true if the node attributes have audit profiles and the audit cookbook is not present, and the compliance mode attribute is nil" do
+      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
+      node.normal["audit"]["compliance_phase"] = nil
+
+      expect(runner).to be_enabled
+    end
+
+    it "is true if the node attributes have audit profiles and the audit cookbook is not present, and the compliance mode attribute is true" do
+      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
+      node.normal["audit"]["compliance_phase"] = true
+
+      expect(runner).to be_enabled
+    end
+
+    it "is false if the node attributes have audit profiles and the audit cookbook is not present, and the compliance mode attribute is false" do
+      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
+      node.normal["audit"]["compliance_phase"] = false
+
+      expect(runner).not_to be_enabled
+    end
+
+    it "is false if the node attributes have audit profiles and the audit cookbook is present, and the complince mode attribute is nil" do
+      stub_const("::Reporter::ChefAutomate", true)
+      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
+      node.normal["audit"]["compliance_phase"] = nil
+
+      expect(runner).not_to be_enabled
+    end
+
+    it "is true if the node attributes have audit profiles and the audit cookbook is present, and the complince mode attribute is true" do
+      stub_const("::Reporter::ChefAutomate", true)
+      node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
+      node.normal["audit"]["compliance_phase"] = true
+
+      expect(runner).to be_enabled
+    end
+
+    it "is false if the node attributes do not have audit profiles and the audit cookbook is not present, and the complince mode attribute is nil" do
+      node.normal["audit"]["profiles"] = {}
+      node.normal["audit"]["compliance_phase"] = nil
+
+      expect(runner).not_to be_enabled
+    end
+
+    it "is false if the node attributes do not have audit profiles and the audit cookbook is present, and the complince mode attribute is nil" do
+      stub_const("::Reporter::ChefAutomate", true)
+      node.automatic["recipes"] = %w{ audit::default fancy_cookbook::fanciness tacobell::nachos }
+      node.normal["audit"]["compliance_phase"] = nil
+
+      expect(runner).not_to be_enabled
+    end
+
+    it "is false if the node attributes do not have audit attributes and the audit cookbook is not present, and the complince mode attribute is nil" do
+      node.automatic["recipes"] = %w{ fancy_cookbook::fanciness tacobell::nachos }
+      node.normal["audit"]["compliance_phase"] = nil
+
+      expect(runner).not_to be_enabled
+    end
+
+    it "is true if the node attributes do not have audit profiles and the audit cookbook is not present, and the complince mode attribute is true" do
+      node.normal["audit"]["profiles"] = {}
+      node.normal["audit"]["compliance_phase"] = true
+
+      expect(runner).to be_enabled
+    end
+
+    it "is true if the node attributes do not have audit profiles and the audit cookbook is present, and the complince mode attribute is true" do
+      stub_const("::Reporter::ChefAutomate", true)
+      node.automatic["recipes"] = %w{ audit::default fancy_cookbook::fanciness tacobell::nachos }
+      node.normal["audit"]["compliance_phase"] = true
+
+      expect(runner).to be_enabled
+    end
+
+    it "is true if the node attributes do not have audit attributes and the audit cookbook is not present, and the complince mode attribute is true" do
+      node.automatic["recipes"] = %w{ fancy_cookbook::fanciness tacobell::nachos }
+      node.normal["audit"]["compliance_phase"] = true
+      expect(runner).to be_enabled
+    end
+  end
+
+  describe "#inspec_profiles" do
+    it "returns an empty list with no profiles defined" do
+      expect(runner.inspec_profiles).to eq([])
+    end
+
+    it "converts from the attribute format to the format Inspec expects" do
+      node.normal["audit"]["profiles"]["linux-baseline"] = {
+        'compliance': "user/linux-baseline",
+        'version': "2.1.0",
+      }
+
+      node.normal["audit"]["profiles"]["ssh"] = {
+        'supermarket': "hardening/ssh-hardening",
+      }
+
+      expected = [
+        {
+          compliance: "user/linux-baseline",
+          name: "linux-baseline",
+          version: "2.1.0",
+        },
+        {
+          name: "ssh",
+          supermarket: "hardening/ssh-hardening",
+        },
+      ]
+
+      expect(runner.inspec_profiles).to eq(expected)
+    end
+
+    it "raises an error when the profiles are in the old audit-cookbook format" do
+      node.normal["audit"]["profiles"] = [
+        {
+          name: "Windows 2019 Baseline",
+          compliance: "admin/windows-2019-baseline",
+        },
+      ]
+
+      expect { runner.inspec_profiles }.to raise_error(/profiles specified in an unrecognized format, expected a hash of hashes./)
+    end
+  end
+
+  describe "#warn_for_deprecated_config_values!" do
+    it "logs a warning when deprecated config values are present" do
+      node.normal["audit"]["owner"] = "my_org"
+      node.normal["audit"]["inspec_version"] = "90210"
+
+      expect(logger).to receive(:warn).with(/config values 'inspec_version', 'owner' are not supported/)
+
+      runner.warn_for_deprecated_config_values!
+    end
+
+    it "does not log a warning with no deprecated config values" do
+      node.normal["audit"]["profiles"]["linux-baseline"] = {
+        'compliance': "user/linux-baseline",
+        'version': "2.1.0",
+      }
+
+      expect(logger).not_to receive(:warn)
+
+      runner.warn_for_deprecated_config_values!
+    end
+  end
+
+  describe "#reporter" do
+    context "chef-server-automate reporter" do
+      it "uses the correct URL when 'server' attribute is set" do
+        Chef::Config[:chef_server_url] = "https://chef_config_url.example.com/my_org"
+        node.normal["audit"]["server"] = "https://server_attribute_url.example.com/application/sub_application"
+
+        reporter = runner.reporter("chef-server-automate")
+
+        expect(reporter).to be_kind_of(Chef::Compliance::Reporter::ChefServerAutomate)
+        expect(reporter.url).to eq(URI("https://server_attribute_url.example.com/application/sub_application/organizations/my_org/data-collector"))
+      end
+
+      it "falls back to chef_server_url for URL when 'server' attribute is not set" do
+        Chef::Config[:chef_server_url] = "https://chef_config_url.example.com/my_org"
+
+        reporter = runner.reporter("chef-server-automate")
+
+        expect(reporter).to be_kind_of(Chef::Compliance::Reporter::ChefServerAutomate)
+        expect(reporter.url).to eq(URI("https://chef_config_url.example.com/organizations/my_org/data-collector"))
+      end
+    end
+
+    it "fails with unexpected reporter value" do
+      expect { runner.reporter("tacos") }.to raise_error(/'tacos' is not a supported reporter for Compliance Phase/)
+    end
+  end
+
+  describe "#inspec_opts" do
+    it "does not include chef_node in inputs by default" do
+      node.normal["audit"]["attributes"] = {
+        "tacos" => "lunch",
+        "nachos" => "dinner",
+      }
+
+      inputs = runner.inspec_opts[:inputs]
+
+      expect(inputs["tacos"]).to eq("lunch")
+      expect(inputs.key?("chef_node")).to eq(false)
+    end
+
+    it "includes chef_node in inputs with chef_node_attribute_enabled set" do
+      node.normal["audit"]["chef_node_attribute_enabled"] = true
+      node.normal["audit"]["attributes"] = {
+        "tacos" => "lunch",
+        "nachos" => "dinner",
+      }
+
+      inputs = runner.inspec_opts[:inputs]
+
+      expect(inputs["tacos"]).to eq("lunch")
+      expect(inputs["chef_node"]["audit"]["reporter"]).to eq("json-file")
+      expect(inputs["chef_node"]["chef_environment"]).to eq("_default")
+    end
+  end
+end

data/spec/unit/cookbook/gem_installer_spec.rb

@@ -95,7 +95,8 @@ describe Chef::Cookbook::GemInstaller do
 
   it "skip metadata installation when Chef::Config[:skip_gem_metadata_installation] is set to true" do
     Chef::Config[:skip_gem_metadata_installation] = true
-    expect(gem_installer.install).to_not receive(:shell_out!)
+    expect(gem_installer).to_not receive(:shell_out!)
+    expect(gem_installer.install).to be_nil
   end
 
   it "install metadata when Chef::Config[:skip_gem_metadata_installation] is not true" do

data/spec/unit/cookbook/synchronizer_spec.rb

@@ -1,7 +1,7 @@
 require "spec_helper"
 require "chef/cookbook/synchronizer"
 require "chef/cookbook_version"
-require "chef/dist"
+require "chef-utils/dist"
 
 describe Chef::CookbookCacheCleaner do
   describe "when cleaning up unused cookbook components" do
@@ -50,7 +50,7 @@ describe Chef::CookbookCacheCleaner do
       cleaner.cleanup_file_cache
     end
 
-    it "does not remove anything on #{Chef::Dist::SOLOEXEC}" do
+    it "does not remove anything on #{ChefUtils::Dist::Solo::EXEC}" do
       Chef::Config[:solo_legacy_mode] = true
       allow(cleaner.cache).to receive(:find).and_return(%w{cookbooks/valid1/recipes/default.rb cookbooks/valid2/recipes/default.rb})
       expect(cleaner.cache).not_to receive(:delete)
@@ -217,6 +217,8 @@ describe Chef::CookbookSynchronizer do
       path: "/tmp/cookbook_a_template_default_tempfile")
   end
 
+  let(:root) { windows? ? "C:/file-cache/cookbooks/cookbook_a" : "/file-cache/cookbooks/cookbook_a" }
+
   def setup_common_files_missing_expectations
     # Files are not in the cache:
     expect(file_cache).to receive(:key?)
@@ -234,7 +236,7 @@ describe Chef::CookbookSynchronizer do
       .with("/tmp/cookbook_a_recipes_default_rb", "cookbooks/cookbook_a/recipes/default.rb")
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/recipes/default.rb", false)
-      .and_return("/file-cache/cookbooks/cookbook_a/recipes/default.rb")
+      .and_return("#{root}/recipes/default.rb")
 
     # Fetch and copy default.rb attribute file
     expect(server_api).to receive(:streaming_request)
@@ -244,7 +246,7 @@ describe Chef::CookbookSynchronizer do
       .with("/tmp/cookbook_a_attributes_default_rb", "cookbooks/cookbook_a/attributes/default.rb")
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/attributes/default.rb", false)
-      .and_return("/file-cache/cookbooks/cookbook_a/attributes/default.rb")
+      .and_return("#{root}/attributes/default.rb")
   end
 
   def setup_no_lazy_files_and_templates_missing_expectations
@@ -262,7 +264,7 @@ describe Chef::CookbookSynchronizer do
       .with("/tmp/cookbook_a_file_default_tempfile", "cookbooks/cookbook_a/files/default/megaman.conf")
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/files/default/megaman.conf", false)
-      .and_return("/file-cache/cookbooks/cookbook_a/default/megaman.conf")
+      .and_return("#{root}/default/megaman.conf")
 
     expect(server_api).to receive(:streaming_request)
       .with("http://chef.example.com/ffffff")
@@ -271,7 +273,7 @@ describe Chef::CookbookSynchronizer do
       .with("/tmp/cookbook_a_template_default_tempfile", "cookbooks/cookbook_a/templates/default/apache2.conf.erb")
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/templates/default/apache2.conf.erb", false)
-      .and_return("/file-cache/cookbooks/cookbook_a/templates/default/apache2.conf.erb")
+      .and_return("#{root}/templates/default/apache2.conf.erb")
   end
 
   def setup_common_files_chksum_mismatch_expectations
@@ -292,11 +294,11 @@ describe Chef::CookbookSynchronizer do
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/recipes/default.rb", false)
       .twice
-      .and_return("/file-cache/cookbooks/cookbook_a/recipes/default.rb")
+      .and_return("#{root}/recipes/default.rb")
 
     # Current file has fff000, want abc123
     expect(Chef::CookbookVersion).to receive(:checksum_cookbook_file)
-      .with("/file-cache/cookbooks/cookbook_a/recipes/default.rb")
+      .with("#{root}/recipes/default.rb")
       .and_return("fff000").at_least(:once)
 
     # Fetch and copy default.rb attribute file
@@ -308,11 +310,11 @@ describe Chef::CookbookSynchronizer do
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/attributes/default.rb", false)
       .twice
-      .and_return("/file-cache/cookbooks/cookbook_a/attributes/default.rb")
+      .and_return("#{root}/attributes/default.rb")
 
     # Current file has fff000, want abc456
     expect(Chef::CookbookVersion).to receive(:checksum_cookbook_file)
-      .with("/file-cache/cookbooks/cookbook_a/attributes/default.rb")
+      .with("#{root}/attributes/default.rb")
       .and_return("fff000").at_least(:once)
   end
 
@@ -334,7 +336,7 @@ describe Chef::CookbookSynchronizer do
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/files/default/megaman.conf", false)
       .twice
-      .and_return("/file-cache/cookbooks/cookbook_a/default/megaman.conf")
+      .and_return("#{root}/default/megaman.conf")
 
     # Fetch and copy apache2.conf template
     expect(server_api).to receive(:streaming_request)
@@ -345,16 +347,16 @@ describe Chef::CookbookSynchronizer do
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/templates/default/apache2.conf.erb", false)
       .twice
-      .and_return("/file-cache/cookbooks/cookbook_a/templates/default/apache2.conf.erb")
+      .and_return("#{root}/templates/default/apache2.conf.erb")
 
     # Current file has fff000
     expect(Chef::CookbookVersion).to receive(:checksum_cookbook_file)
-      .with("/file-cache/cookbooks/cookbook_a/default/megaman.conf")
+      .with("#{root}/default/megaman.conf")
       .and_return("fff000")
 
     # Current file has fff000
     expect(Chef::CookbookVersion).to receive(:checksum_cookbook_file)
-      .with("/file-cache/cookbooks/cookbook_a/templates/default/apache2.conf.erb")
+      .with("#{root}/templates/default/apache2.conf.erb")
       .and_return("fff000")
   end
 
@@ -369,23 +371,23 @@ describe Chef::CookbookSynchronizer do
 
     # Current file has abc123, want abc123
     expect(Chef::CookbookVersion).to receive(:checksum_cookbook_file)
-      .with("/file-cache/cookbooks/cookbook_a/recipes/default.rb")
+      .with("#{root}/recipes/default.rb")
       .and_return("abc123").at_least(:once)
 
     # Current file has abc456, want abc456
     expect(Chef::CookbookVersion).to receive(:checksum_cookbook_file)
-      .with("/file-cache/cookbooks/cookbook_a/attributes/default.rb")
+      .with("#{root}/attributes/default.rb")
       .and_return("abc456").at_least(:once)
 
     # :load called twice
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/recipes/default.rb", false)
       .twice
-      .and_return("/file-cache/cookbooks/cookbook_a/recipes/default.rb")
+      .and_return("#{root}/recipes/default.rb")
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/attributes/default.rb", false)
       .twice
-      .and_return("/file-cache/cookbooks/cookbook_a/attributes/default.rb")
+      .and_return("#{root}/attributes/default.rb")
   end
 
   def setup_no_lazy_files_and_templates_present_expectations
@@ -399,23 +401,23 @@ describe Chef::CookbookSynchronizer do
 
     # Current file has abc124, want abc124
     expect(Chef::CookbookVersion).to receive(:checksum_cookbook_file)
-      .with("/file-cache/cookbooks/cookbook_a/default/megaman.conf")
+      .with("#{root}/default/megaman.conf")
       .and_return("abc124")
 
     # Current file has abc125, want abc125
     expect(Chef::CookbookVersion).to receive(:checksum_cookbook_file)
-      .with("/file-cache/cookbooks/cookbook_a/templates/default/apache2.conf.erb")
+      .with("#{root}/templates/default/apache2.conf.erb")
       .and_return("abc125")
 
     # :load called twice
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/files/default/megaman.conf", false)
       .twice
-      .and_return("/file-cache/cookbooks/cookbook_a/default/megaman.conf")
+      .and_return("#{root}/default/megaman.conf")
     expect(file_cache).to receive(:load)
       .with("cookbooks/cookbook_a/templates/default/apache2.conf.erb", false)
       .twice
-      .and_return("/file-cache/cookbooks/cookbook_a/templates/default/apache2.conf.erb")
+      .and_return("#{root}/templates/default/apache2.conf.erb")
   end
 
   describe "#server_api" do
@@ -535,19 +537,19 @@ describe Chef::CookbookSynchronizer do
         expect(file_cache).to receive(:load)
           .with("cookbooks/cookbook_a/recipes/default.rb", false)
           .once
-          .and_return("/file-cache/cookbooks/cookbook_a/recipes/default.rb")
+          .and_return("#{root}/recipes/default.rb")
         expect(file_cache).to receive(:load)
           .with("cookbooks/cookbook_a/attributes/default.rb", false)
           .once
-          .and_return("/file-cache/cookbooks/cookbook_a/attributes/default.rb")
+          .and_return("#{root}/attributes/default.rb")
         expect(file_cache).to receive(:load)
           .with("cookbooks/cookbook_a/templates/default/apache2.conf.erb", false)
           .once
-          .and_return("/file-cache/cookbooks/cookbook_a/templates/default/apache2.conf.erb")
+          .and_return("#{root}/templates/default/apache2.conf.erb")
         expect(file_cache).to receive(:load)
           .with("cookbooks/cookbook_a/files/default/megaman.conf", false)
           .once
-          .and_return("/file-cache/cookbooks/cookbook_a/files/default/megaman.conf")
+          .and_return("#{root}/files/default/megaman.conf")
         expect(Chef::Log).to receive(:warn)
           .with("skipping cookbook synchronization! DO NOT LEAVE THIS ENABLED IN PRODUCTION!!!")
           .once