chef 16.17.51-universal-mingw32 → 16.18.30-universal-mingw32

data/lib/chef/node/attribute.rb

@@ -450,17 +450,34 @@ class Chef
       # method-style access to attributes (has to come after the prepended ImmutablizeHash)
 
       def read(*path)
-        merged_attributes.read(*path)
+        if path[0].nil?
+          Chef::Log.warn "Calling node.read() without any path argument is very slow, probably a bug, and should be avoided"
+          merged_attributes.read(*path) # re-merges everything, slow edge case
+        else
+          self[path[0]] unless path[0].nil? # force deep_merge_cache key construction if necessary
+          deep_merge_cache.read(*path)
+        end
       end
 
       alias :dig :read
 
       def read!(*path)
-        merged_attributes.read!(*path)
+        if path[0].nil?
+          Chef::Log.warn "Calling node.read!() without any path argument is very slow, probably a bug, and should be avoided"
+          merged_attributes.read!(*path) # re-merges everything, slow edge case
+        else
+          self[path[0]] unless path[0].nil? # force deep_merge_cache key construction if necessary
+          deep_merge_cache.read!(*path)
+        end
       end
 
       def exist?(*path)
-        merged_attributes.exist?(*path)
+        if path[0].nil?
+          true
+        else
+          self[path[0]] unless path[0].nil? # force deep_merge_cache key construction if necessary
+          deep_merge_cache.exist?(*path)
+        end
       end
 
       def write(level, *args, &block)

data/lib/chef/node/mixin/deep_merge_cache.rb

@@ -28,7 +28,7 @@ class Chef
           @merged_attributes = nil
           @combined_override = nil
           @combined_default = nil
-          @deep_merge_cache = {}
+          @deep_merge_cache = Chef::Node::ImmutableMash.new
         end
 
         # Invalidate a key in the deep_merge_cache.  If called with nil, or no arg, this will invalidate
@@ -37,9 +37,9 @@ class Chef
         # must invalidate the entire cache and re-deep-merge the entire node object.
         def reset_cache(path = nil)
           if path.nil?
-            deep_merge_cache.clear
+            deep_merge_cache.regular_clear
           else
-            deep_merge_cache.delete(path.to_s)
+            deep_merge_cache.regular_delete(path.to_s)
           end
         end
 
@@ -51,7 +51,7 @@ class Chef
             deep_merge_cache[key.to_s]
           else
             # save all the work of computing node[key]
-            deep_merge_cache[key.to_s] = merged_attributes(key)
+            deep_merge_cache.internal_set(key.to_s, merged_attributes(key))
           end
         end
 

data/lib/chef/platform/query_helpers.rb

@@ -58,8 +58,8 @@ class Chef
       end
 
       def dsc_refresh_mode_disabled?(node)
-        require_relative "../powershell"
-        exec = Chef::PowerShell.new("Get-DscLocalConfigurationManager")
+        require "chef-powershell"
+        exec = ChefPowerShell::PowerShell.new("Get-DscLocalConfigurationManager")
         exec.error!
         exec.result["RefreshMode"] == "Disabled"
       end

data/lib/chef/provider/cron.rb

@@ -88,7 +88,11 @@ class Chef
 
       def cron_different?
         CRON_ATTRIBUTES.any? do |cron_var|
-          new_resource.send(cron_var) != current_resource.send(cron_var)
+          if new_resource.send(cron_var).class == current_resource.send(cron_var).class
+            new_resource.send(cron_var) != current_resource.send(cron_var)
+          else
+            new_resource.send(cron_var).to_s != current_resource.send(cron_var).to_s
+          end
         end
       end
 

data/lib/chef/provider/file.rb

@@ -334,7 +334,7 @@ class Chef
       end
 
       def do_validate_content
-        if new_resource.checksum && tempfile && ( new_resource.checksum != tempfile_checksum )
+        if new_resource.checksum && tempfile && !checksum_match?(new_resource.checksum, tempfile_checksum)
           raise Chef::Exceptions::ChecksumMismatch.new(short_cksum(new_resource.checksum), short_cksum(tempfile_checksum))
         end
 
@@ -448,7 +448,7 @@ class Chef
 
       def contents_changed?
         logger.trace "calculating checksum of #{tempfile.path} to compare with #{current_resource.checksum}"
-        tempfile_checksum != current_resource.checksum
+        !checksum_match?(tempfile_checksum, current_resource.checksum)
       end
 
       def tempfile

data/lib/chef/provider/package/windows.rb

@@ -38,7 +38,7 @@ class Chef
         def define_resource_requirements
           if new_resource.checksum
             requirements.assert(:install) do |a|
-              a.assertion { new_resource.checksum == checksum(source_location) }
+              a.assertion { checksum_match?(new_resource.checksum, checksum(source_location)) }
               a.failure_message Chef::Exceptions::Package, "Checksum on resource (#{short_cksum(new_resource.checksum)}) does not match checksum on content (#{short_cksum(source_location)})"
             end
           end

data/lib/chef/provider/package/yum/yum_helper.py

@@ -155,16 +155,6 @@ def query(command):
         outpipe.write("%(n)s %(e)s:%(v)s-%(r)s %(a)s\n" % { 'n': pkg.name, 'e': pkg.epoch, 'v': pkg.version, 'r': pkg.release, 'a': pkg.arch })
         outpipe.flush()
 
-    # Reset any repos we were passed in enablerepo/disablerepo to the original state in enabled_repos
-    if 'repos' in command:
-      for repo in command['repos']:
-        if 'enable' in repo:
-          if base.repos.getRepo(repo['enable']) not in enabled_repos:
-            base.repos.disableRepo(repo['enable'])
-        if 'disable' in repo:
-          if base.repos.getRepo(repo['disable']) in enabled_repos:
-            base.repos.enableRepo(repo['disable'])
-
 # the design of this helper is that it should try to be 'brittle' and fail hard and exit in order
 # to keep process tables clean.  additional error handling should probably be added to the retry loop
 # on the ruby side.

data/lib/chef/resource/locale.rb

@@ -115,7 +115,7 @@ class Chef
 
           requirements.assert(:all_actions) do |a|
             # RHEL/CentOS type platforms don't have locale-gen
-            a.assertion { shell_out("locale-gen") }
+            a.assertion { which("locale-gen") }
             a.failure_message(Chef::Exceptions::ProviderNotFound, "The locale resource requires the locale-gen tool")
           end
         end

data/lib/chef/resource/rhsm_register.rb

@@ -93,12 +93,17 @@ class Chef
           end
         end
 
+        package flush_package_cache_name do
+          action :nothing
+        end
+
         execute "Register to RHSM" do
           sensitive new_resource.sensitive
           command register_command
           default_env true
           action :run
           not_if { registered_with_rhsm? } unless new_resource.force
+          notifies :flush_cache, "package[#{flush_package_cache_name}]", :immediately
         end
 
         if new_resource.install_katello_agent && !new_resource.satellite_host.nil?
@@ -109,11 +114,16 @@ class Chef
       action :unregister do
         description "Unregister the node from RHSM."
 
+        package flush_package_cache_name do
+          action :nothing
+        end
+
         execute "Unregister from RHSM" do
           command "subscription-manager unregister"
           default_env true
           action :run
           only_if { registered_with_rhsm? }
+          notifies :flush_cache, "package[#{flush_package_cache_name}]", :immediately
           notifies :run, "execute[Clean RHSM Config]", :immediately
         end
 
@@ -125,6 +135,13 @@ class Chef
       end
 
       action_class do
+        #
+        # @return [String]
+        #
+        def flush_package_cache_name
+          "rhsm_register-#{new_resource.name}-flush_cache"
+        end
+
         #
         # @return [Symbol] dnf_package or yum_package depending on OS release
         #

data/lib/chef/resource/support/client.erb

@@ -13,8 +13,6 @@
       @minimal_ohai
       @named_run_list
       @no_proxy
-      @ohai_disabled_plugins
-      @ohai_optional_plugins
       @pid_file
       @policy_group
       @policy_name

data/lib/chef/resource/windows_user_privilege.rb

@@ -24,7 +24,7 @@ class Chef
       unified_mode true
 
       provides :windows_user_privilege
-      description "The windows_user_privilege resource allows to add and set principal (User/Group) to the specified privilege.\n Ref: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment"
+      description "The windows_user_privilege resource allows to add a privilege to a principal or (User/Group).\n Ref: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment"
 
       introduced "16.0"
 
@@ -39,23 +39,32 @@ class Chef
       end
       ```
 
-      **Add the SeDenyRemoteInteractiveLogonRight Privilege to the Builtin Guests and Local Accounts User Groups**:
+      **Provide only the Builtin Guests and Administrator Groups with the SeCreatePageFile Privilege**:
+
+      ```ruby
+      windows_user_privilege 'Create Pagefile' do
+        privilege      'SeCreatePagefilePrivilege'
+        users          ['BUILTIN\\Guests', 'BUILTIN\\Administrators']
+        action         :set
+      end
+      ```
+
+      **Add the SeDenyRemoteInteractiveLogonRight Privilege to the 'Remote interactive logon' principal**:
 
       ```ruby
       windows_user_privilege 'Remote interactive logon' do
         privilege      'SeDenyRemoteInteractiveLogonRight'
-        users          ['Builtin\\Guests', 'NT AUTHORITY\\Local Account']
         action         :add
       end
       ```
 
-      **Provide only the Builtin Guests and Administrator Groups with the SeCreatePageFile Privilege**:
+      **Add to the Builtin Guests Group the SeCreatePageFile Privilege**:
 
       ```ruby
-      windows_user_privilege 'Create Pagefile' do
+      windows_user_privilege 'Guests add Create Pagefile' do
+        principal      'BUILTIN\\Guests'
         privilege      'SeCreatePagefilePrivilege'
-        users          ['BUILTIN\\Guests', 'BUILTIN\\Administrators']
-        action         :set
+        action         :add
       end
       ```
 
@@ -90,6 +99,7 @@ class Chef
                            SeCreateSymbolicLinkPrivilege
                            SeCreateTokenPrivilege
                            SeDebugPrivilege
+                           SeDelegateSessionUserImpersonatePrivilege
                            SeDenyBatchLogonRight
                            SeDenyInteractiveLogonRight
                            SeDenyNetworkLogonRight
@@ -126,20 +136,20 @@ class Chef
                           }.freeze
 
       property :principal, String,
-        description: "An optional property to add the user to the given privilege. Use only with add and remove action.",
-        name_property: true
+               description: "An optional property to add the privilege for given principal. Use only with add and remove action. Principal can either be a User/Group or one of special identities found here Ref: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/special-identities",
+               name_property: true
 
       property :users, [Array, String],
-        description: "An optional property to set the privilege for given users. Use only with set action.",
-        coerce: proc { |v| Array(v) }
+               description: "An optional property to set the privilege for given users. Use only with set action.",
+               coerce: proc { |v| Array(v) }
 
       property :privilege, [Array, String],
-        description: "One or more privileges to set for users.",
-        required: true,
-        coerce: proc { |v| Array(v) },
-        callbacks: {
-          "Privilege property restricted to the following values: #{PRIVILEGE_OPTS}" => lambda { |n| (n - PRIVILEGE_OPTS).empty? },
-        }, identity: true
+               description: "One or more privileges to set for principal or users/groups. For more information on what each privilege does Ref: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment",
+               required: true,
+               coerce: proc { |v| Array(v) },
+               callbacks: {
+                 "Privilege property restricted to the following values: #{PRIVILEGE_OPTS}" => lambda { |n| (n - PRIVILEGE_OPTS).empty? },
+               }, identity: true
 
       load_current_value do |new_resource|
         if new_resource.principal && (new_resource.action.include?(:add) || new_resource.action.include?(:remove))
@@ -147,15 +157,15 @@ class Chef
         end
       end
 
-      action :add do
-        ([*new_resource.privilege] - [*current_resource.privilege]).each do |user_right|
-          converge_by("adding user '#{new_resource.principal}' privilege #{user_right}") do
-            Chef::ReservedNames::Win32::Security.add_account_right(new_resource.principal, user_right)
+      action :add, description: "Add a privileges to a principal." do
+        ([*new_resource.privilege] - [*current_resource.privilege]).each do |principal_right|
+          converge_by("adding principal '#{new_resource.principal}' privilege #{principal_right}") do
+            Chef::ReservedNames::Win32::Security.add_account_right(new_resource.principal, principal_right)
           end
         end
       end
 
-      action :set do
+      action :set, description: "Set the privileges that are listed in the `privilege` property for only the users listed in the `users` property. All other users not listed with given privilege will be have the privilege removed." do
         if new_resource.users.nil? || new_resource.users.empty?
           raise Chef::Exceptions::ValidationFailed, "Users are required property with set action."
         end
@@ -190,7 +200,7 @@ class Chef
         end
       end
 
-      action :clear do
+      action :clear, description: "Clear all user privileges" do
         new_resource.privilege.each do |privilege|
           accounts = Chef::ReservedNames::Win32::Security.get_account_with_user_rights(privilege)
 
@@ -204,7 +214,7 @@ class Chef
         end
       end
 
-      action :remove do
+      action :remove, description: "Remove a principal privilege" do
         curr_res_privilege = current_resource.privilege
         missing_res_privileges = (new_resource.privilege - curr_res_privilege)
 
@@ -212,9 +222,9 @@ class Chef
           Chef::Log.info("User \'#{new_resource.principal}\' for Privilege: #{missing_res_privileges.join(", ")} not found. Nothing to remove.")
         end
 
-        (new_resource.privilege - missing_res_privileges).each do |user_right|
-          converge_by("removing user #{new_resource.principal} from privilege #{user_right}") do
-            Chef::ReservedNames::Win32::Security.remove_account_right(new_resource.principal, user_right)
+        (new_resource.privilege - missing_res_privileges).each do |principal_right|
+          converge_by("removing principal #{new_resource.principal} from privilege #{principal_right}") do
+            Chef::ReservedNames::Win32::Security.remove_account_right(new_resource.principal, principal_right)
           end
         end
       end

data/lib/chef/version.rb

@@ -23,7 +23,7 @@ require_relative "version_string"
 
 class Chef
   CHEF_ROOT = File.expand_path("..", __dir__)
-  VERSION = Chef::VersionString.new("16.17.51")
+  VERSION = Chef::VersionString.new("16.18.30")
 end
 
 #

data/lib/chef/win32/version.rb

@@ -51,7 +51,8 @@ class Chef
       WIN_VERSIONS = {
         "Windows Server 2022" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION && build_number >= 20348 } },
         "Windows Server 2019" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION && build_number >= 17763 && build_number < 20348 } },
-        "Windows 10" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
+        "Windows 11" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION && build_number >= 22000 } },
+        "Windows 10" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION && build_number >= 19044 && build_number < 22000 } },
         "Windows Server 2016" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION && build_number <= 14393 } },
         "Windows 8.1" => { major: 6, minor: 3, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
         "Windows Server 2012 R2" => { major: 6, minor: 3, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION } },

data/spec/functional/assets/yumrepo-empty/repodata/repomd.xml

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<repomd xmlns="http://linux.duke.edu/metadata/repo" xmlns:rpm="http://linux.duke.edu/metadata/rpm">
+ <revision>1667508211</revision>
+<data type="filelists">
+  <checksum type="sha256">401dc19bda88c82c403423fb835844d64345f7e95f5b9835888189c03834cc93</checksum>
+  <open-checksum type="sha256">bf9808b81cb2dbc54b4b8e35adc584ddcaa73bd81f7088d73bf7dbbada961310</open-checksum>
+  <location href="repodata/401dc-filelists.xml.gz"/>
+  <timestamp>1667508211</timestamp>
+  <size>123</size>
+  <open-size>125</open-size>
+</data>
+<data type="primary">
+  <checksum type="sha256">dabe2ce5481d23de1f4f52bdcfee0f9af98316c9e0de2ce8123adeefa0dd08b9</checksum>
+  <open-checksum type="sha256">e1e2ffd2fb1ee76f87b70750d00ca5677a252b397ab6c2389137a0c33e7b359f</open-checksum>
+  <location href="repodata/dabe2-primary.xml.gz"/>
+  <timestamp>1667508211</timestamp>
+  <size>134</size>
+  <open-size>167</open-size>
+</data>
+<data type="primary_db">
+  <checksum type="sha256">5dc1e6e73c84803f059bb3065e684e56adfc289a7e398946574d79dac6643945</checksum>
+  <open-checksum type="sha256">f0d550414e8f2e960e82e704549364299ca9e3e8664ad4faffd208262c3b6d12</open-checksum>
+  <location href="repodata/5dc1e-primary.sqlite.bz2"/>
+  <timestamp>1667508211</timestamp>
+  <database_version>10</database_version>
+  <size>1131</size>
+  <open-size>21504</open-size>
+</data>
+<data type="other_db">
+  <checksum type="sha256">7c36572015e075add2b38b900837bcdbb8a504130ddff49b2351a7fc0affa3d4</checksum>
+  <open-checksum type="sha256">4de0fe7c5dd2674849a7c63c326e42f33af0a0f46219bc6dd59f51dfa2ac8c68</open-checksum>
+  <location href="repodata/7c365-other.sqlite.bz2"/>
+  <timestamp>1667508211</timestamp>
+  <database_version>10</database_version>
+  <size>575</size>
+  <open-size>6144</open-size>
+</data>
+<data type="other">
+  <checksum type="sha256">6bf9672d0862e8ef8b8ff05a2fd0208a922b1f5978e6589d87944c88259cb670</checksum>
+  <open-checksum type="sha256">e0ed5e0054194df036cf09c1a911e15bf2a4e7f26f2a788b6f47d53e80717ccc</open-checksum>
+  <location href="repodata/6bf96-other.xml.gz"/>
+  <timestamp>1667508211</timestamp>
+  <size>123</size>
+  <open-size>121</open-size>
+</data>
+<data type="filelists_db">
+  <checksum type="sha256">01a3b489a465bcac22a43492163df43451dc6ce47d27f66de289756b91635523</checksum>
+  <open-checksum type="sha256">c4211f57bdcbb142c9f93a6d32401539f775eb6a670ab7a423e13f435ce94689</open-checksum>
+  <location href="repodata/01a3b-filelists.sqlite.bz2"/>
+  <timestamp>1667508211</timestamp>
+  <database_version>10</database_version>
+  <size>586</size>
+  <open-size>7168</open-size>
+</data>
+</repomd>

data/spec/functional/resource/chocolatey_package_spec.rb

@@ -41,6 +41,10 @@ describe Chef::Resource::ChocolateyPackage, :windows_only, :choco_installed do
     provider
   end
 
+  before(:all) do
+    ENV["Path"] = ENV.delete("Path")
+  end
+
   context "installing a package" do
     after { remove_package }
 

data/spec/functional/resource/dsc_script_spec.rb

@@ -263,7 +263,7 @@ describe Chef::Resource::DscScript, :windows_powershell_dsc_only, :ruby64_only d
         dsc_test_resource.cwd(dsc_environment_fail_etc_directory)
         expect {
           dsc_test_resource.run_action(:run)
-        }.to raise_error(Chef::PowerShell::CommandFailed, /#{exception_message_signature}/)
+        }.to raise_error(ChefPowerShell::PowerShellExceptions::PowerShellCommandFailed, /#{exception_message_signature}/)
       end
     end
   end

data/spec/functional/resource/windows_font_spec.rb

@@ -18,7 +18,8 @@
 
 require "spec_helper"
 
-describe Chef::Resource::WindowsFont, :windows_only do
+# these tests hang on Buildkite on Chef 16 Verify pipeline
+describe Chef::Resource::WindowsFont, :windows_only, :broken do
   let(:resource_name) { "Playmaker.ttf" }
   let(:resource_source) { "https://www.wfonts.com/download/data/2020/05/06/playmaker/Playmaker.ttf" }
 

data/spec/functional/resource/yum_package_spec.rb

@@ -50,6 +50,12 @@ describe Chef::Resource::YumPackage, :requires_root, external: exclude_test do
         baseurl=file://#{CHEF_SPEC_ASSETS}/yumrepo
         enable=1
         gpgcheck=0
+        [chef-yum-empty]
+        name=Chef DNF spec empty repo
+        baseurl=file://#{CHEF_SPEC_ASSETS}/yumrepo-empty
+        enable=1
+        gpgcheck=0
+
       EOF
     end
     shell_out!("rpm -qa --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | grep chef_rpm | xargs -r rpm -e")
@@ -633,6 +639,12 @@ describe Chef::Resource::YumPackage, :requires_root, external: exclude_test do
         expect(shell_out("rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' chef_rpm").stdout.chomp).to match("^chef_rpm-1.10-1.#{pkg_arch}$")
       end
 
+      it "should work to disable a repo" do
+        flush_cache
+        yum_package.options("--disablerepo=chef-yum-localtesting --enablerepo=chef-yum-empty")
+        expect { yum_package.run_action(:install) }.to raise_error(Chef::Exceptions::Package, /No candidate version available/)
+      end
+
       it "when an idempotent install action is run, does not leave repos disabled" do
         flush_cache
         # this is a bit tricky -- we need this action to be idempotent, so that it doesn't recycle any

data/spec/functional/shell_spec.rb

@@ -80,6 +80,11 @@ describe Shell do
       # so hide the require here
 
       require "pty"
+
+      # FIXME this is temporary... Solaris envs have TERM set to unknown
+      # and the value isn't propagating from the build environment TERM
+      # variable
+      ENV["TERM"] = "vt100" if ["", "unknown"].include?(ENV["TERM"].to_s)
       config = File.expand_path("shef-config.rb", CHEF_SPEC_DATA)
       reader, writer, pid = PTY.spawn("bundle exec chef-shell --no-multiline --no-singleline --no-colorize -c #{config} #{options}")
       read_until(reader, "chef (#{Chef::VERSION})>")

data/spec/integration/client/fips_spec.rb

@@ -0,0 +1,21 @@
+require "spec_helper"
+
+describe "chef-client fips" do
+  def enable_fips
+    OpenSSL.fips_mode = true
+  end
+
+  # All tests assume fips mode is off at present
+  after { OpenSSL.fips_mode = false }
+
+  # For non-FIPS OSes/builds of Ruby, enabling FIPS should error
+  example "Error enabling fips_mode if FIPS not linked", fips_mode: false do
+    expect { enable_fips }.to raise_error(OpenSSL::OpenSSLError)
+  end
+
+  # For FIPS OSes/builds of Ruby, enabling FIPS should not error
+  example "Do not error enabling fips_mode if FIPS linked", fips_mode: true do
+    expect { enable_fips }.not_to raise_error
+  end
+end
+

data/spec/spec_helper.rb

@@ -139,6 +139,10 @@ RSpec.configure do |config|
 
   config.filter_run_excluding skip_buildkite: true if ENV["BUILDKITE"]
 
+  config.filter_run_excluding fips_mode: !fips_mode_build? unless opensuse?
+  # RubyDistros OpenSUSE docker images have a broken fips
+  config.filter_run_excluding :fips_mode if opensuse?
+
   config.filter_run_excluding windows_only: true unless windows?
   config.filter_run_excluding not_supported_on_windows: true if windows?
   config.filter_run_excluding not_supported_on_macos: true if macos?

data/spec/support/platform_helpers.rb

@@ -226,6 +226,10 @@ def fips?
   ENV["CHEF_FIPS"] == "1"
 end
 
+def fips_mode_build?
+  OpenSSL::OPENSSL_FIPS
+end
+
 class HttpHelper
   extend Ohai::Mixin::HttpHelper
   def self.logger

data/spec/unit/client_spec.rb

@@ -310,14 +310,14 @@ describe Chef::Client do
 
   describe "eol release warning" do
     it "warns when running an EOL release" do
-      stub_const("Chef::VERSION", 15)
-      allow(Time).to receive(:now).and_return(Time.new(2021, 5, 1, 5))
-      expect(logger).to receive(:warn).with(/This release of.*became end of life \(EOL\) on May 1st 2021/)
+      stub_const("Chef::VERSION", 16)
+      allow(Time).to receive(:now).and_return(Time.new(2022, 11, 30, 5))
+      expect(logger).to receive(:warn).with("This release of #{ChefUtils::Dist::Infra::PRODUCT} became end of life (EOL) on November 30th 2022. Please update to a supported release to receive new features, bug fixes, and security updates.")
       client.warn_if_eol
     end
 
     it "does not warn when running an non-EOL release" do
-      stub_const("Chef::VERSION", 15)
+      stub_const("Chef::VERSION", 16)
       allow(Time).to receive(:now).and_return(Time.new(2021, 4, 31))
       expect(logger).to_not receive(:warn).with(/became end of life/)
       client.warn_if_eol

data/spec/unit/daemon_spec.rb

@@ -170,11 +170,7 @@ describe Chef::Daemon do
 
       it "should log an appropriate error message and fail miserably" do
         allow(Process).to receive(:initgroups).and_raise(Errno::EPERM)
-        error = "Operation not permitted"
-        if RUBY_PLATFORM.match("solaris2") || RUBY_PLATFORM.match("aix")
-          error = "Not owner"
-        end
-        expect(Chef::Application).to receive(:fatal!).with("Permission denied when trying to change 999:999 to 501:20. #{error}")
+        expect(Chef::Application).to receive(:fatal!).with(/Permission denied when trying to change 999:999 to 501:20/)
         Chef::Daemon._change_privilege(testuser)
       end
     end

data/spec/unit/mixin/checksum_spec.rb

@@ -51,4 +51,32 @@ describe Chef::Mixin::Checksum do
     end
   end
 
+  describe "checksum_match?" do
+    context "when checksum cases match" do
+      it "returns true" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", "u7ghbxikk3i9blsimmy2y2ionmxx")).to be true
+      end
+    end
+
+    context "when one checksum is uppercase and other is lowercase" do
+      it "returns true" do
+        expect(@checksum_user.checksum_match?("U7GHBXIKK3I9BLSIMMY2Y2IONMXX", "u7ghbxikk3i9blsimmy2y2ionmxx")).to be true
+      end
+    end
+
+    context "when checksums do not match" do
+      it "returns false" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", "09ee9c8cc70501763563bcf9c218")).to be false
+      end
+    end
+
+    context "when checksum is nil" do
+      it "returns false" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", nil)).to be false
+        expect(@checksum_user.checksum_match?(nil, "09ee9c8cc70501763563bcf9c218")).to be false
+        expect(@checksum_user.checksum_match?(nil, nil)).to be false
+      end
+    end
+  end
+
 end