chef 16.13.16-universal-mingw32 → 17.3.48-universal-mingw32

data/lib/chef/dsl/universal.rb

@@ -22,6 +22,9 @@ require_relative "data_query"
 require_relative "chef_vault"
 require_relative "registry_helper"
 require_relative "powershell"
+require_relative "secret"
+require_relative "render_helpers"
+require_relative "toml"
 require_relative "../mixin/powershell_exec"
 require_relative "../mixin/powershell_out"
 require_relative "../mixin/shell_out"
@@ -47,6 +50,8 @@ class Chef
       include Chef::DSL::ChefVault
       include Chef::DSL::RegistryHelper
       include Chef::DSL::Powershell
+      include Chef::DSL::RenderHelpers
+      include Chef::DSL::Secret
       include Chef::Mixin::PowershellExec
       include Chef::Mixin::PowershellOut
       include Chef::Mixin::ShellOut

data/lib/chef/event_dispatch/base.rb

@@ -221,7 +221,8 @@ class Chef
       # Called before convergence starts
       def converge_start(run_context); end
 
-      # Callback hook for handlers to register their interest in the action_collection
+      # Callback hook for handlers to grab a reference to the action_collection
+      # (sent before compiling cookbooks, consumers can also find it off the run_context.action_collection)
       def action_collection_registration(action_collection); end
 
       # Called when the converge phase is finished.

data/lib/chef/exceptions.rb

@@ -174,6 +174,9 @@ class Chef
     class CannotDetermineWindowsInstallerType < Package; end
     class NoWindowsPackageSource < Package; end
 
+    # for example, if both recipes/default.yml, recipes/default.yaml are present
+    class AmbiguousYAMLFile < RuntimeError; end
+
     # Can not create staging file during file deployment
     class FileContentStagingError < RuntimeError
       def initialize(errors)
@@ -287,6 +290,28 @@ class Chef
 
     end
 
+    class Secret
+      class RetrievalError < RuntimeError; end
+      class ConfigurationInvalid < RuntimeError; end
+      class FetchFailed < RuntimeError; end
+      class MissingSecretName < RuntimeError; end
+      class InvalidSecretName < RuntimeError; end
+
+      class InvalidFetcherService < RuntimeError
+        def initialize(given, fetcher_service_names)
+          super("#{given} is not a supported secrets service.  Supported services are: :#{fetcher_service_names.join(" :")}")
+        end
+      end
+
+      class MissingFetcher < RuntimeError
+        def initialize(fetcher_service_names)
+          super("No secret service provided. Supported services are: :#{fetcher_service_names.join(" :")}")
+        end
+      end
+
+      class MissingVaultName < RuntimeError; end
+    end
+
     # Exception class for collecting multiple failures. Used when running
     # delayed notifications so that chef can process each delayed
     # notification even if chef client or other notifications fail.

data/lib/chef/formatters/doc.rb

@@ -56,7 +56,8 @@ class Chef
         # Print out deprecations.
         unless deprecations.empty?
           puts_line ""
-          puts_line "Deprecated features used!"
+          puts_line "Deprecation warnings that must be addressed before upgrading to Chef Infra #{Chef::VERSION.to_i + 1}:"
+          puts_line ""
           deprecations.each do |message, details|
             locations = details[:locations]
             if locations.size == 1

data/lib/chef/formatters/error_inspectors/resource_failure_inspector.rb

@@ -64,36 +64,34 @@ class Chef
         def recipe_snippet
           return nil if dynamic_resource?
 
-          @snippet ||= begin
-            if (file = parse_source) && (line = parse_line(file))
-              return nil unless ::File.exist?(file)
+          @snippet ||= if (file = parse_source) && (line = parse_line(file))
+                         return nil unless ::File.exist?(file)
 
-              lines = IO.readlines(file)
+                         lines = IO.readlines(file)
 
-              relevant_lines = ["# In #{file}\n\n"]
+                         relevant_lines = ["# In #{file}\n\n"]
 
-              current_line = line - 1
-              current_line = 0 if current_line < 0
-              nesting = 0
+                         current_line = line - 1
+                         current_line = 0 if current_line < 0
+                         nesting = 0
 
-              loop do
+                         loop do
 
-                # low rent parser. try to gracefully handle nested blocks in resources
-                nesting += 1 if /\s+do\s*/.match?(lines[current_line])
-                nesting -= 1 if /end\s*$/.match?(lines[current_line])
+                           # low rent parser. try to gracefully handle nested blocks in resources
+                           nesting += 1 if /\s+do\s*/.match?(lines[current_line])
+                           nesting -= 1 if /end\s*$/.match?(lines[current_line])
 
-                relevant_lines << format_line(current_line, lines[current_line])
+                           relevant_lines << format_line(current_line, lines[current_line])
 
-                break if lines[current_line + 1].nil?
-                break if current_line >= (line + 50)
-                break if nesting <= 0
+                           break if lines[current_line + 1].nil?
+                           break if current_line >= (line + 50)
+                           break if nesting <= 0
 
-                current_line += 1
-              end
-              relevant_lines << format_line(current_line + 1, lines[current_line + 1]) if lines[current_line + 1]
-              relevant_lines.join("")
-            end
-          end
+                           current_line += 1
+                         end
+                         relevant_lines << format_line(current_line + 1, lines[current_line + 1]) if lines[current_line + 1]
+                         relevant_lines.join("")
+                       end
         end
 
         def dynamic_resource?

data/lib/chef/group.rb

@@ -0,0 +1,75 @@
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "org"
+
+class Chef
+  class Group
+
+    def group(groupname)
+      @group ||= {}
+      @group[groupname] ||= chef_rest.get_rest "organizations/#{name}/groups/#{groupname}"
+    end
+
+    def user_member_of_group?(username, groupname)
+      group = group(groupname)
+      group["actors"].include? username
+    end
+
+    def add_user_to_group(groupname, username)
+      group = group(groupname)
+      body_hash = {
+        groupname: "#{groupname}",
+        actors: {
+          "users" => group["actors"].concat([username]),
+          "groups" => group["groups"],
+        },
+      }
+      chef_rest.put_rest "organizations/#{name}/groups/#{groupname}", body_hash
+    end
+
+    def remove_user_from_group(groupname, username)
+      group = group(groupname)
+      group["actors"].delete(username)
+      body_hash = {
+        groupname: "#{groupname}",
+        actors: {
+          "users" => group["actors"],
+          "groups" => group["groups"],
+        },
+      }
+      chef_rest.put_rest "organizations/#{name}/groups/#{groupname}", body_hash
+    end
+
+    def actor_delete_would_leave_admins_empty?
+      admins = group("admins")
+      if admins["groups"].empty?
+        # exclude 'pivotal' but don't mutate the group since we're caching it
+        if admins["actors"].include? "pivotal"
+          admins["actors"].length <= 2
+        else
+          admins["actors"].length <= 1
+        end
+      else
+        # We don't check recursively. If the admins group contains a group,
+        # and the user is the only member of that group,
+        # we'll still turn up a 'safe to delete'.
+        false
+      end
+    end
+  end
+end

data/lib/chef/handler.rb

@@ -55,6 +55,12 @@ class Chef
   #
   class Handler
 
+    # FIXME: Chef::Handler should probably inherit from EventDispatch::Base
+    # and should wire up to those events rather than the "notifications" system
+    # which is hanging off of Chef::Client.  Those "notifications" could then be
+    # deprecated in favor of events, and this class could become decoupled from
+    # the Chef::Client object.
+
     def self.handler_for(*args)
       if args.include?(:start)
         Chef::Config[:start_handlers] ||= []
@@ -207,17 +213,45 @@ class Chef
     # The Chef::Node for this client run
     def_delegator :@run_status, :node
 
-    ##
-    # :method: all_resources
+    # @return Array<Chef::Resource> all resources other than unprocessed
     #
-    # An Array containing all resources in the chef run's resource_collection
-    def_delegator :@run_status, :all_resources
+    def all_resources
+      @all_resources ||= action_collection&.filtered_collection(unprocessed: false)&.resources || []
+    end
 
-    ##
-    # :method: updated_resources
+    # @return Array<Chef::Resource> all updated resources
+    #
+    def updated_resources
+      @updated_resources ||= action_collection&.filtered_collection(up_to_date: false, skipped: false, failed: false, unprocessed: false)&.resources || []
+    end
+
+    # @return Array<Chef::Resource> all up_to_date resources
+    #
+    def up_to_date_resources
+      @up_to_date_resources ||= action_collection&.filtered_collection(updated: false, skipped: false, failed: false, unprocessed: false)&.resources || []
+    end
+
+    # @return Array<Chef::Resource> all failed resources
     #
-    # An Array containing all resources that were updated during the chef run
-    def_delegator :@run_status, :updated_resources
+    def failed_resources
+      @failed_resources ||= action_collection&.filtered_collection(updated: false, up_to_date: false, skipped: false, unprocessed: false)&.resources || []
+    end
+
+    # @return Array<Chef::Resource> all skipped resources
+    #
+    def skipped_resources
+      @skipped_resources ||= action_collection&.filtered_collection(updated: false, up_to_date: false, failed: false, unprocessed: false)&.resources || []
+    end
+
+    # Unprocessed resources are those which are left over in the outer recipe context when a run fails.
+    # Sub-resources of unprocessed resourced are impossible to capture because they would require processing
+    # the outer resource.
+    #
+    # @return Array<Chef::Resource> all unprocessed resources
+    #
+    def unprocessed_resources
+      @unprocessed_resources ||= action_collection&.filtered_collection(updated: false, up_to_date: false, failed: false, skipped: false)&.resources || []
+    end
 
     ##
     # :method: success?
@@ -232,6 +266,10 @@ class Chef
     # Did the chef run fail? True if the chef run raised an uncaught exception
     def_delegator :@run_status, :failed?
 
+    def action_collection
+      @run_status.run_context.action_collection
+    end
+
     # The main entry point for report handling. Subclasses should override this
     # method with their own report handling logic.
     def report; end

data/lib/chef/handler/slow_report.rb

@@ -0,0 +1,66 @@
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../handler"
+require "tty/table" unless defined?(TTY::Table)
+
+class Chef
+  class Handler
+    class SlowReport < ::Chef::Handler
+      attr_accessor :amount
+
+      def initialize(amount)
+        @amount = Integer(amount) rescue nil
+        @amount ||= 10
+      end
+
+      def report
+        if count == 0
+          puts "\nNo resources to profile\n\n"
+          return
+        end
+
+        top = all_records.sort_by(&:elapsed_time).last(amount).reverse
+        data = top.map { |r| [ r.new_resource.to_s, r.elapsed_time, r.action, r.new_resource.cookbook_name, r.new_resource.recipe_name, stripped_source_line(r.new_resource) ] }
+        puts "\nTop #{count} slowest #{count == 1 ? "resource" : "resources"}:\n\n"
+        table = TTY::Table.new(%w{resource elapsed_time action cookbook recipe source}, data)
+        rendered = table.render do |renderer|
+          renderer.border do
+            mid          "-"
+            mid_mid      " "
+          end
+        end
+        puts rendered
+        puts "\n"
+      end
+
+      def all_records
+        @all_records ||= action_collection&.filtered_collection(unprocessed: false) || []
+      end
+
+      def count
+        num = all_resources.count
+        num > amount ? amount : num
+      end
+
+      def stripped_source_line(resource)
+        # strip the leading path off of the source line
+        resource.source_line&.gsub(%r{.*/cookbooks/}, "")&.gsub(%r{.*/chef-[0-9\.]+/}, "")
+      end
+    end
+  end
+end

data/lib/chef/json_compat.rb

@@ -25,7 +25,7 @@ require "json" unless defined?(JSON)
 class Chef
   class JSONCompat
 
-    class <<self
+    class << self
 
       def parse(source, opts = {})
         FFI_Yajl::Parser.parse(source, opts)

data/lib/chef/mixin/get_source_from_package.rb

@@ -38,7 +38,7 @@ class Chef
 
         # if we're passed something that looks like a filesystem path, with no source, use it
         #  - require at least one '/' in the path to avoid gem_package "foo" breaking if a file named 'foo' exists in the cwd
-        if new_resource.source.nil? && new_resource.package_name.match(/#{::File::SEPARATOR}/) && ::File.exist?(new_resource.package_name)
+        if new_resource.source.nil? && new_resource.package_name.include?(::File::SEPARATOR) && ::File.exist?(new_resource.package_name)
           Chef::Log.trace("No package source specified, but #{new_resource.package_name} exists on the filesystem, copying to package source")
           new_resource.source(new_resource.package_name)
         end

data/lib/chef/node.rb

@@ -687,6 +687,25 @@ class Chef
       name <=> other.name
     end
 
+    # Returns hash of node data with attributes based on whitelist/blacklist rules.
+    def data_for_save
+      data = for_json
+      %w{automatic default normal override}.each do |level|
+        allowlist = allowlist_or_whitelist_config(level)
+        unless allowlist.nil? # nil => save everything
+          logger.info("Allowing #{level} node attributes for save.")
+          data[level] = Chef::AttributeAllowlist.filter(data[level], allowlist)
+        end
+
+        blocklist = blocklist_or_blacklist_config(level)
+        unless blocklist.nil? # nil => remove nothing
+          logger.info("Blocking #{level} node attributes for save")
+          data[level] = Chef::AttributeBlocklist.filter(data[level], blocklist)
+        end
+      end
+      data
+    end
+
     private
 
     def save_without_policyfile_attrs
@@ -712,7 +731,7 @@ class Chef
     # @param [String] level the attribute level
     def allowlist_or_whitelist_config(level)
       if Chef::Config["#{level}_attribute_whitelist".to_sym]
-        Chef.deprecated(:attribute_blacklist_configuration, "Attribute whitelist configurations have been deprecated. Use the allowed_LEVEL_attribute configs instead")
+        Chef.deprecated(:attribute_whitelist_configuration, "Attribute whitelist configurations have been deprecated. Use the allowed_LEVEL_attribute configs instead")
         Chef::Config["#{level}_attribute_whitelist".to_sym]
       else
         Chef::Config["allowed_#{level}_attributes".to_sym]
@@ -732,24 +751,6 @@ class Chef
       end
     end
 
-    def data_for_save
-      data = for_json
-      %w{automatic default normal override}.each do |level|
-        allowlist = allowlist_or_whitelist_config(level)
-        unless allowlist.nil? # nil => save everything
-          logger.info("Allowing #{level} node attributes for save.")
-          data[level] = Chef::AttributeAllowlist.filter(data[level], allowlist)
-        end
-
-        blocklist = blocklist_or_blacklist_config(level)
-        unless blocklist.nil? # nil => remove nothing
-          logger.info("Blocking #{level} node attributes for save")
-          data[level] = Chef::AttributeBlocklist.filter(data[level], blocklist)
-        end
-      end
-      data
-    end
-
     # Returns a UUID that uniquely identifies this node for reporting reasons.
     #
     # The node is read in from disk if it exists, or it's generated if it does
@@ -761,7 +762,7 @@ class Chef
       path = File.expand_path(Chef::Config[:chef_guid_path])
       dir = File.dirname(path)
 
-      unless File.exists?(path)
+      unless File.exist?(path)
         FileUtils.mkdir_p(dir)
         File.write(path, SecureRandom.uuid)
       end