chef 16.13.16-universal-mingw32 → 17.3.48-universal-mingw32

data/lib/chef/resource/windows_user_privilege.rb

@@ -147,7 +147,7 @@ class Chef
         end
       end
 
-      action :add do
+      action :add, description: "Add a user privilege." do
         ([*new_resource.privilege] - [*current_resource.privilege]).each do |user_right|
           converge_by("adding user '#{new_resource.principal}' privilege #{user_right}") do
             Chef::ReservedNames::Win32::Security.add_account_right(new_resource.principal, user_right)
@@ -155,7 +155,7 @@ class Chef
         end
       end
 
-      action :set do
+      action :set, description: "Set the privileges that are listed in the `privilege` property for only the users listed in the `users` property." do
         if new_resource.users.nil? || new_resource.users.empty?
           raise Chef::Exceptions::ValidationFailed, "Users are required property with set action."
         end
@@ -190,7 +190,7 @@ class Chef
         end
       end
 
-      action :clear do
+      action :clear, description: "Clear all user privileges" do
         new_resource.privilege.each do |privilege|
           accounts = Chef::ReservedNames::Win32::Security.get_account_with_user_rights(privilege)
 
@@ -204,7 +204,7 @@ class Chef
         end
       end
 
-      action :remove do
+      action :remove, description: "Remove a user privilege" do
         curr_res_privilege = current_resource.privilege
         missing_res_privileges = (new_resource.privilege - curr_res_privilege)
 

data/lib/chef/resource/windows_workgroup.rb

@@ -30,13 +30,13 @@ class Chef
       examples <<~DOC
       **Join a workgroup**:
 
-      ``` ruby
+      ```ruby
       windows_workgroup 'myworkgroup'
       ```
 
       **Join a workgroup using a specific user**:
 
-      ``` ruby
+      ```ruby
       windows_workgroup 'myworkgroup' do
         user 'Administrator'
         password 'passw0rd'
@@ -87,8 +87,7 @@ class Chef
       property :sensitive, [TrueClass, FalseClass],
         default: true, desired_state: false
 
-      action :join do
-        description "Update the workgroup."
+      action :join, description: "Update the workgroup." do
 
         unless workgroup_member?
           converge_by("join workstation workgroup #{new_resource.workgroup_name}") do

data/lib/chef/resource/yum_package.rb

@@ -35,32 +35,32 @@ class Chef
       examples <<~DOC
         **Install an exact version**:
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm = 10.35.58-8.el8'
         ```
 
         **Install a minimum version**:
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm >= 10.35.58-8.el8'
         ```
 
         **Install a minimum version using the default action**:
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm'
         ```
 
         **Install a version without worrying about the exact release**:
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm-10.35*'
         ```
 
 
         **To install a package**:
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm' do
           action :install
         end
@@ -68,13 +68,13 @@ class Chef
 
         **To install a partial minimum version**:
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm >= 10'
         ```
 
         **To install a specific architecture**:
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm' do
           arch 'i386'
         end
@@ -82,13 +82,13 @@ class Chef
 
         or:
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm.x86_64'
         ```
 
         **To install a specific version-release**
 
-        ``` ruby
+        ```ruby
         yum_package 'netpbm' do
           version '10.35.58-8.el8'
         end
@@ -101,7 +101,7 @@ class Chef
         to dump the in-memory Yum cache, and then use the repository immediately
         to ensure that the correct package is installed:
 
-        ``` ruby
+        ```ruby
         cookbook_file '/etc/yum.repos.d/custom.repo' do
           source 'custom'
           mode '0755'

data/lib/chef/resource/zypper_package.rb

@@ -30,7 +30,7 @@ class Chef
       examples <<~DOC
         **Install a package using package manager:**
 
-        ``` ruby
+        ```ruby
         zypper_package 'name of package' do
           action :install
         end
@@ -38,7 +38,7 @@ class Chef
 
         **Install a package using local file:**
 
-        ``` ruby
+        ```ruby
         zypper_package 'jwhois' do
           action :install
           source '/path/to/jwhois.rpm'
@@ -47,10 +47,10 @@ class Chef
 
         **Install without using recommend packages as a dependency:**
 
-        ``` ruby
+        ```ruby
         package 'apache2' do
           options '--no-recommends'
-          end
+        end
         ```
       DOC
 

data/lib/chef/resource/zypper_repository.rb

@@ -24,21 +24,37 @@ class Chef
       unified_mode true
 
       provides(:zypper_repository) { true }
-      provides(:zypper_repo) { true }
+      provides(:zypper_repo) { true } # legacy cookbook compatibility
 
       description "Use the **zypper_repository** resource to create Zypper package repositories on SUSE Enterprise Linux and openSUSE systems. This resource maintains full compatibility with the **zypper_repository** resource in the existing **zypper** cookbook."
       introduced "13.3"
       examples <<~DOC
         **Add the Apache repo on openSUSE Leap 15**:
 
-        ``` ruby
+        ```ruby
         zypper_repository 'apache' do
           baseurl 'http://download.opensuse.org/repositories/Apache'
-          path '/openSUSE_Leap_15.0'
-            type 'rpm-md'
+          path '/openSUSE_Leap_15.2'
+          type 'rpm-md'
           priority '100'
         end
         ```
+
+        **Remove the repo named 'apache'**:
+
+        ```ruby
+        zypper_repository 'apache' do
+          action :delete
+        end
+        ```
+
+        **Refresh the repo named 'apache'**:
+
+        ```ruby
+        zypper_repository 'apache' do
+          action :refresh
+        end
+        ```
       DOC
 
       property :repo_name, String,
@@ -66,8 +82,10 @@ class Chef
         description: "Determines whether or not to perform a GPG signature check on the repository.",
         default: true
 
-      property :gpgkey, String,
-        description: "The location of the repository key to be imported."
+      property :gpgkey, [String, Array],
+        description: "The location of the repository key(s) to be imported.",
+        coerce: proc { |v| Array(v) },
+        default: []
 
       property :baseurl, String,
         description: "The base URL for the Zypper repository, such as `http://download.opensuse.org`."
@@ -95,10 +113,12 @@ class Chef
         default: true
 
       property :source, String,
-        description: "The name of the template for the repository file. Only necessary if you're not using the built in template."
+        description: "The name of the template for the repository file. Only necessary if you're using a custom template for the repository file."
 
       property :cookbook, String,
-        description: "The cookbook to source the repository template file from. Only necessary if you're not using the built in template.",
+        description: "The cookbook to source the repository template file from. Only necessary if you're using a custom template for the repository file.",
+        default: lazy { cookbook_name },
+        default_description: "The cookbook containing the resource",
         desired_state: false
 
       property :gpgautoimportkeys, [TrueClass, FalseClass],

data/lib/chef/resource_builder.rb

@@ -29,9 +29,10 @@ class Chef
     attr_reader :recipe_name
     attr_reader :enclosing_provider
     attr_reader :resource
+    attr_reader :new_resource
 
     # FIXME (ruby-2.1 syntax): most of these are mandatory
-    def initialize(type: nil, name: nil, created_at: nil, params: nil, run_context: nil, cookbook_name: nil, recipe_name: nil, enclosing_provider: nil)
+    def initialize(type: nil, name: nil, created_at: nil, params: nil, run_context: nil, cookbook_name: nil, recipe_name: nil, enclosing_provider: nil, new_resource: nil)
       @type               = type
       @name               = name
       @created_at         = created_at
@@ -40,6 +41,7 @@ class Chef
       @cookbook_name      = cookbook_name
       @recipe_name        = recipe_name
       @enclosing_provider = enclosing_provider
+      @new_resource       = new_resource
     end
 
     def build(&block)
@@ -64,7 +66,11 @@ class Chef
       if block_given?
         resource.resource_initializing = true
         begin
-          resource.instance_eval(&block)
+          if new_resource.nil?
+            resource.instance_exec(&block)
+          else
+            resource.instance_exec(new_resource, &block)
+          end
         ensure
           resource.resource_initializing = false
         end

data/lib/chef/resource_reporter.rb

@@ -135,7 +135,6 @@ class Chef
 
     def action_collection_registration(action_collection)
       @action_collection = action_collection
-      action_collection.register(self) if reporting_enabled?
     end
 
     def post_reporting_data

data/lib/chef/resources.rb

@@ -58,6 +58,14 @@ require_relative "resource/ips_package"
 require_relative "resource/gem_package"
 require_relative "resource/scm/git"
 require_relative "resource/group"
+require_relative "resource/habitat/habitat_package"
+require_relative "resource/habitat/habitat_sup"
+require_relative "resource/habitat/habitat_sup_systemd"
+require_relative "resource/habitat/habitat_sup_windows"
+require_relative "resource/habitat_config"
+require_relative "resource/habitat_install"
+require_relative "resource/habitat_service"
+require_relative "resource/habitat_user_toml"
 require_relative "resource/http_request"
 require_relative "resource/hostname"
 require_relative "resource/homebrew_cask"
@@ -65,6 +73,7 @@ require_relative "resource/homebrew_package"
 require_relative "resource/homebrew_tap"
 require_relative "resource/homebrew_update"
 require_relative "resource/ifconfig"
+require_relative "resource/inspec_waiver_file_entry"
 require_relative "resource/kernel_module"
 require_relative "resource/ksh"
 require_relative "resource/launchd"
@@ -125,7 +134,6 @@ require_relative "resource/smartos_package"
 require_relative "resource/template"
 require_relative "resource/user"
 require_relative "resource/user/aix_user"
-require_relative "resource/user/dscl_user"
 require_relative "resource/user/linux_user"
 require_relative "resource/user/mac_user"
 require_relative "resource/user/pw_user"
@@ -148,6 +156,8 @@ require_relative "resource/windows_ad_join"
 require_relative "resource/windows_audit_policy"
 require_relative "resource/windows_auto_run"
 require_relative "resource/windows_certificate"
+require_relative "resource/windows_defender"
+require_relative "resource/windows_defender_exclusion"
 require_relative "resource/windows_dfs_folder"
 require_relative "resource/windows_dfs_namespace"
 require_relative "resource/windows_dfs_server"
@@ -167,7 +177,8 @@ require_relative "resource/windows_share"
 require_relative "resource/windows_shortcut"
 require_relative "resource/windows_task"
 require_relative "resource/windows_uac"
+require_relative "resource/windows_update_settings"
 require_relative "resource/windows_workgroup"
 require_relative "resource/timezone"
 require_relative "resource/windows_user_privilege"
-require_relative "resource/windows_security_policy"
+require_relative "resource/windows_security_policy"

data/lib/chef/run_lock.rb

@@ -173,7 +173,7 @@ class Chef
     # Mutex name is case-sensitive contrary to other things in
     # windows. "\" is the only invalid character.
     def acquire_win32_mutex
-      @mutex = Chef::ReservedNames::Win32::Mutex.new("Global\\#{runlock_file.tr('\\', "/").downcase}")
+      @mutex = Chef::ReservedNames::Win32::Mutex.new("Global\\#{runlock_file.tr("\\", "/").downcase}")
       mutex.test
     end
 

data/lib/chef/runner.rb

@@ -70,7 +70,7 @@ class Chef
         end
       end
 
-      # Actually run the action for releases
+      # Run the action on the resource.
       resource.run_action(action, notification_type, notifying_resource)
 
       # Execute any immediate and queue up any delayed notifications

data/lib/chef/secret_fetcher.rb

@@ -0,0 +1,54 @@
+#
+# Author:: Marc Paradise (<marc@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "exceptions"
+
+class Chef
+  class SecretFetcher
+
+    SECRET_FETCHERS = %i{example aws_secrets_manager azure_key_vault}.freeze
+
+    # Returns a configured and validated instance
+    # of a [Chef::SecretFetcher::Base]  for the given
+    # service and configuration.
+    #
+    # @param service [Symbol] the identifier for the service that will support this request. Must be in
+    #                         SECRET_FETCHERS
+    # @param config [Hash] configuration that the secrets service requires
+    def self.for_service(service, config)
+      fetcher = case service
+                when :example
+                  require_relative "secret_fetcher/example"
+                  Chef::SecretFetcher::Example.new(config)
+                when :aws_secrets_manager
+                  require_relative "secret_fetcher/aws_secrets_manager"
+                  Chef::SecretFetcher::AWSSecretsManager.new(config)
+                when :azure_key_vault
+                  require_relative "secret_fetcher/azure_key_vault"
+                  Chef::SecretFetcher::AzureKeyVault.new(config)
+                when nil, ""
+                  raise Chef::Exceptions::Secret::MissingFetcher.new(SECRET_FETCHERS)
+                else
+                  raise Chef::Exceptions::Secret::InvalidFetcherService.new("Unsupported secret service: #{service}", SECRET_FETCHERS)
+                end
+      fetcher.validate!
+      fetcher
+    end
+  end
+end
+

data/lib/chef/secret_fetcher/aws_secrets_manager.rb

@@ -0,0 +1,53 @@
+#
+# Author:: Marc Paradise (<marc@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "base"
+require "aws-sdk-secretsmanager"
+
+class Chef
+  # == Chef::SecretFetcher::AWSSecretsManager
+  # A fetcher that fetches a secret from AWS Secrets Manager
+  # In this initial iteration it defaults to authentication via instance profile.
+  # It is possible to pass options that configure it to use alternative credentials.
+  # This implementation supports fetching with version.
+  #
+  # NOTE: This does not yet support automatic retries, which the AWS client does by default.
+  #
+  # For configuration options see https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/SecretsManager/Client.html#initialize-instance_method
+  #
+  # Note that ~/.aws default and environment-based configurations are supported by default in the
+  # ruby SDK.
+  #
+  # Usage Example:
+  #
+  # fetcher = SecretFetcher.for_service(:aws_secrets_manager, { region: "us-east-1" })
+  # fetcher.fetch("secretkey1", "v1")
+  class SecretFetcher
+    class AWSSecretsManager < Base
+      # @param identifier [String] the secret_id
+      # @param version [String] the secret version. Not usd at this time
+      # @return Aws::SecretsManager::Types::GetSecretValueResponse
+      def do_fetch(identifier, version)
+        client = Aws::SecretsManager::Client.new(config)
+        result = client.get_secret_value(secret_id: identifier, version_stage: version)
+        # These fields are mutually exclusive
+        result.secret_string || result.secret_binary
+      end
+    end
+  end
+end