chef 16.18.0 → 16.18.30

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a65b4755816a9d5a1920b8f73627c07a6fadb7bc0d1f1132507ac3f547f289c8
-  data.tar.gz: 50671c4259fc3d44a1794ba13759bea7c317129615c027272b9905947cc238dd
+  metadata.gz: c6482b24a4eb52181a9743c685ad7cde514a5b55d90ef41aea9758f99e442886
+  data.tar.gz: e4a0fb750927ef05607baaec55f4760a14cadcd59e465950ec43cdf31c1cac94
 SHA512:
-  metadata.gz: eaaeb74c2d30b9bd21c8e777dc696730570a2901e60507feb65953324cff90cc4e7f1fb182f77a6bfdb02a238e05a709b872777fbe5aed062030fa5d9133a67d
-  data.tar.gz: 287087f0edecb64d7feeae4dddff412d26ec3579ad6e3eeaad33ab0a4b1e2d3d1b32eb9f31ac85f13e42e78e6c23f019e5f09dd34220ef92e90e31dd89d15817
+  metadata.gz: 505644901501305a4aac09c186b9dcac0019f7d71dc1c0343f942501fdb769716e416dcc7fc10df42b871e6072dccdc4e342336c746f7ced7d89d34d260d0e1d
+  data.tar.gz: bf4fd87c204998756c798eb32e72cdd7ca6338dad9d61396cf076d530478d9e949f675d0ba3a6a88912ef4f1b7cc19eb6bea8f402a4bdae34aecac4c0d27c0b3

data/Gemfile

@@ -3,6 +3,9 @@ source "https://rubygems.org"
 # 1.15+ is required for M1 mac builds
 gem "ffi", ">=1.15"
 
+# Nwed to file a bug with rest-client. In the meantime, we can use this until they accept the update.
+gem "rest-client", git: "https://github.com/chef/rest-client", branch: "jfm/ucrt_update1"
+
 # Note we do not use the gemspec DSL which restricts to the
 # gemspec for the current platform and filters out other platforms
 # during a bundle lock operation. We actually want dependencies from
@@ -15,6 +18,10 @@ gem "ohai", git: "https://github.com/chef/ohai.git", branch: "16-stable"
 gem "chef-utils", path: File.expand_path("chef-utils", __dir__) if File.exist?(File.expand_path("chef-utils", __dir__))
 gem "chef-config", path: File.expand_path("chef-config", __dir__) if File.exist?(File.expand_path("chef-config", __dir__))
 
+# gems below are added here for Chef-16 compat. Their modern versions don't support Ruby 2.6
+gem "semverse", "= 3.0.0"
+gem "train-core", "= 3.2"
+
 if File.exist?(File.expand_path("chef-bin", __dir__))
   # bundling in a git checkout
   gem "chef-bin", path: File.expand_path("chef-bin", __dir__)
@@ -23,7 +30,8 @@ else
   gem "chef-bin" # rubocop:disable Bundler/DuplicatedGem
 end
 
-gem "cheffish", ">= 14"
+# gem "cheffish", ">= 14"
+gem "cheffish", "= 16.0.26"
 
 gem "chef-telemetry", ">=1.0.8" # 1.0.8 removes the http dep
 
@@ -39,7 +47,8 @@ group(:omnibus_package, :pry) do
   # some work is ongoing? https://github.com/deivid-rodriguez/pry-byebug/issues/343
   gem "pry", "= 0.13.0"
   # byebug does not install on freebsd on ruby 3.0
-  gem "pry-byebug" unless RUBY_PLATFORM =~ /freebsd/i
+  # This is the last version compatible for ruby2.6, which is used at linting step
+  gem "pry-byebug", "~> 3.9.0" unless RUBY_PLATFORM =~ /freebsd/i
   gem "pry-stack_explorer"
 end
 

data/chef-universal-mingw32.gemspec

@@ -15,6 +15,7 @@ gemspec.add_dependency "wmi-lite", "~> 1.0"
 gemspec.add_dependency "win32-taskscheduler", "~> 2.0"
 gemspec.add_dependency "iso8601", ">= 0.12.1", "< 0.14" # validate 0.14 when it comes out
 gemspec.add_dependency "win32-certstore", "~> 0.5.0" # 0.5+ required for specifying user vs. system store
+gemspec.add_dependency "chef-powershell", "~> 1.0.12"
 gemspec.extensions << "ext/win32-eventlog/Rakefile"
 gemspec.files += Dir.glob("{distro,ext}/**/*")
 

data/chef.gemspec

@@ -26,7 +26,7 @@ Gem::Specification.new do |s|
 
   s.add_dependency "chef-config", "= #{Chef::VERSION}"
   s.add_dependency "chef-utils", "= #{Chef::VERSION}"
-  s.add_dependency "train-core", "~> 3.2", ">= 3.2.28" # 3.2.28 fixes sudo prompts. See https://github.com/chef/chef/pull/9635
+  # s.add_dependency "train-core", "~> 3.2", ">= 3.2.28" # 3.2.28 fixes sudo prompts. See https://github.com/chef/chef/pull/9635
   s.add_dependency "train-winrm", ">= 0.2.5"
 
   s.add_dependency "license-acceptance", ">= 1.0.5", "< 3"
@@ -38,7 +38,8 @@ Gem::Specification.new do |s|
   s.add_dependency "ohai", "~> 16.0"
   s.add_dependency "inspec-core", "~> 4.23"
 
-  s.add_dependency "ffi", ">= 1.9.25"
+  # s.add_dependency "ffi", ">= 1.9.25"
+  s.add_dependency "ffi", ">= 1.15"
   s.add_dependency "ffi-yajl", "~> 2.2"
   s.add_dependency "net-ssh", ">= 5.1", "< 7"
   s.add_dependency "net-ssh-multi", "~> 1.2", ">= 1.2.1"

data/lib/chef/mixin/checksum.rb

@@ -31,6 +31,12 @@ class Chef
 
         checksum.slice(0, 6)
       end
+
+      def checksum_match?(ref_checksum, diff_checksum)
+        return false if ref_checksum.nil? || diff_checksum.nil?
+
+        ref_checksum.casecmp?(diff_checksum)
+      end
     end
   end
 end

data/lib/chef/mixin/powershell_exec.rb

@@ -15,8 +15,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-require_relative "../powershell"
-require_relative "../pwsh"
+# Powershell is being run using chef-powershell gem. The code resides at https://github.com/chef/chef-powershell-shim
 
 # The powershell_exec mixin provides in-process access to the PowerShell engine.
 #
@@ -95,33 +94,15 @@ require_relative "../pwsh"
 #   credentials of the user running Chef Client are used.
 #
 
+if ChefUtils.windows?
+  require "chef-powershell"
+end
+
 class Chef
   module Mixin
     module PowershellExec
-      # Run a command under PowerShell via a managed (.NET) API.
-      #
-      # Requires: .NET Framework 4.0 or higher on the target machine.
-      #
-      # @param script [String] script to run
-      # @param interpreter [Symbol] the interpreter type, `:powershell` or `:pwsh`
-      # @return [Chef::PowerShell] output
-      def powershell_exec(script, interpreter = :powershell)
-        case interpreter
-        when :powershell
-          Chef::PowerShell.new(script)
-        when :pwsh
-          Chef::Pwsh.new(script)
-        else
-          raise ArgumentError, "Expected interpreter of :powershell or :pwsh"
-        end
-      end
-
-      # The same as the #powershell_exec method except this will raise
-      # Chef::PowerShell::CommandFailed if the command fails
-      def powershell_exec!(script, interpreter = :powershell)
-        cmd = powershell_exec(script, interpreter)
-        cmd.error!
-        cmd
+      if ChefUtils.windows?
+        include ChefPowerShell::ChefPowerShellModule::PowerShellExec
       end
     end
   end

data/lib/chef/platform/query_helpers.rb

@@ -58,8 +58,8 @@ class Chef
       end
 
       def dsc_refresh_mode_disabled?(node)
-        require_relative "../powershell"
-        exec = Chef::PowerShell.new("Get-DscLocalConfigurationManager")
+        require "chef-powershell"
+        exec = ChefPowerShell::PowerShell.new("Get-DscLocalConfigurationManager")
         exec.error!
         exec.result["RefreshMode"] == "Disabled"
       end

data/lib/chef/provider/cron.rb

@@ -88,7 +88,11 @@ class Chef
 
       def cron_different?
         CRON_ATTRIBUTES.any? do |cron_var|
-          new_resource.send(cron_var) != current_resource.send(cron_var)
+          if new_resource.send(cron_var).class == current_resource.send(cron_var).class
+            new_resource.send(cron_var) != current_resource.send(cron_var)
+          else
+            new_resource.send(cron_var).to_s != current_resource.send(cron_var).to_s
+          end
         end
       end
 

data/lib/chef/provider/file.rb

@@ -334,7 +334,7 @@ class Chef
       end
 
       def do_validate_content
-        if new_resource.checksum && tempfile && ( new_resource.checksum != tempfile_checksum )
+        if new_resource.checksum && tempfile && !checksum_match?(new_resource.checksum, tempfile_checksum)
           raise Chef::Exceptions::ChecksumMismatch.new(short_cksum(new_resource.checksum), short_cksum(tempfile_checksum))
         end
 
@@ -448,7 +448,7 @@ class Chef
 
       def contents_changed?
         logger.trace "calculating checksum of #{tempfile.path} to compare with #{current_resource.checksum}"
-        tempfile_checksum != current_resource.checksum
+        !checksum_match?(tempfile_checksum, current_resource.checksum)
       end
 
       def tempfile

data/lib/chef/provider/package/windows.rb

@@ -38,7 +38,7 @@ class Chef
         def define_resource_requirements
           if new_resource.checksum
             requirements.assert(:install) do |a|
-              a.assertion { new_resource.checksum == checksum(source_location) }
+              a.assertion { checksum_match?(new_resource.checksum, checksum(source_location)) }
               a.failure_message Chef::Exceptions::Package, "Checksum on resource (#{short_cksum(new_resource.checksum)}) does not match checksum on content (#{short_cksum(source_location)})"
             end
           end

data/lib/chef/provider/package/yum/yum_helper.py

@@ -155,16 +155,6 @@ def query(command):
         outpipe.write("%(n)s %(e)s:%(v)s-%(r)s %(a)s\n" % { 'n': pkg.name, 'e': pkg.epoch, 'v': pkg.version, 'r': pkg.release, 'a': pkg.arch })
         outpipe.flush()
 
-    # Reset any repos we were passed in enablerepo/disablerepo to the original state in enabled_repos
-    if 'repos' in command:
-      for repo in command['repos']:
-        if 'enable' in repo:
-          if base.repos.getRepo(repo['enable']) not in enabled_repos:
-            base.repos.disableRepo(repo['enable'])
-        if 'disable' in repo:
-          if base.repos.getRepo(repo['disable']) in enabled_repos:
-            base.repos.enableRepo(repo['disable'])
-
 # the design of this helper is that it should try to be 'brittle' and fail hard and exit in order
 # to keep process tables clean.  additional error handling should probably be added to the retry loop
 # on the ruby side.

data/lib/chef/resource/locale.rb

@@ -115,7 +115,7 @@ class Chef
 
           requirements.assert(:all_actions) do |a|
             # RHEL/CentOS type platforms don't have locale-gen
-            a.assertion { shell_out("locale-gen") }
+            a.assertion { which("locale-gen") }
             a.failure_message(Chef::Exceptions::ProviderNotFound, "The locale resource requires the locale-gen tool")
           end
         end

data/lib/chef/resource/rhsm_register.rb

@@ -93,12 +93,17 @@ class Chef
           end
         end
 
+        package flush_package_cache_name do
+          action :nothing
+        end
+
         execute "Register to RHSM" do
           sensitive new_resource.sensitive
           command register_command
           default_env true
           action :run
           not_if { registered_with_rhsm? } unless new_resource.force
+          notifies :flush_cache, "package[#{flush_package_cache_name}]", :immediately
         end
 
         if new_resource.install_katello_agent && !new_resource.satellite_host.nil?
@@ -109,11 +114,16 @@ class Chef
       action :unregister do
         description "Unregister the node from RHSM."
 
+        package flush_package_cache_name do
+          action :nothing
+        end
+
         execute "Unregister from RHSM" do
           command "subscription-manager unregister"
           default_env true
           action :run
           only_if { registered_with_rhsm? }
+          notifies :flush_cache, "package[#{flush_package_cache_name}]", :immediately
           notifies :run, "execute[Clean RHSM Config]", :immediately
         end
 
@@ -125,6 +135,13 @@ class Chef
       end
 
       action_class do
+        #
+        # @return [String]
+        #
+        def flush_package_cache_name
+          "rhsm_register-#{new_resource.name}-flush_cache"
+        end
+
         #
         # @return [Symbol] dnf_package or yum_package depending on OS release
         #

data/lib/chef/resource/windows_user_privilege.rb

@@ -24,7 +24,7 @@ class Chef
       unified_mode true
 
       provides :windows_user_privilege
-      description "The windows_user_privilege resource allows to add and set principal (User/Group) to the specified privilege.\n Ref: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment"
+      description "The windows_user_privilege resource allows to add a privilege to a principal or (User/Group).\n Ref: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment"
 
       introduced "16.0"
 
@@ -39,23 +39,32 @@ class Chef
       end
       ```
 
-      **Add the SeDenyRemoteInteractiveLogonRight Privilege to the Builtin Guests and Local Accounts User Groups**:
+      **Provide only the Builtin Guests and Administrator Groups with the SeCreatePageFile Privilege**:
+
+      ```ruby
+      windows_user_privilege 'Create Pagefile' do
+        privilege      'SeCreatePagefilePrivilege'
+        users          ['BUILTIN\\Guests', 'BUILTIN\\Administrators']
+        action         :set
+      end
+      ```
+
+      **Add the SeDenyRemoteInteractiveLogonRight Privilege to the 'Remote interactive logon' principal**:
 
       ```ruby
       windows_user_privilege 'Remote interactive logon' do
         privilege      'SeDenyRemoteInteractiveLogonRight'
-        users          ['Builtin\\Guests', 'NT AUTHORITY\\Local Account']
         action         :add
       end
       ```
 
-      **Provide only the Builtin Guests and Administrator Groups with the SeCreatePageFile Privilege**:
+      **Add to the Builtin Guests Group the SeCreatePageFile Privilege**:
 
       ```ruby
-      windows_user_privilege 'Create Pagefile' do
+      windows_user_privilege 'Guests add Create Pagefile' do
+        principal      'BUILTIN\\Guests'
         privilege      'SeCreatePagefilePrivilege'
-        users          ['BUILTIN\\Guests', 'BUILTIN\\Administrators']
-        action         :set
+        action         :add
       end
       ```
 
@@ -90,6 +99,7 @@ class Chef
                            SeCreateSymbolicLinkPrivilege
                            SeCreateTokenPrivilege
                            SeDebugPrivilege
+                           SeDelegateSessionUserImpersonatePrivilege
                            SeDenyBatchLogonRight
                            SeDenyInteractiveLogonRight
                            SeDenyNetworkLogonRight
@@ -126,20 +136,20 @@ class Chef
                           }.freeze
 
       property :principal, String,
-        description: "An optional property to add the user to the given privilege. Use only with add and remove action.",
-        name_property: true
+               description: "An optional property to add the privilege for given principal. Use only with add and remove action. Principal can either be a User/Group or one of special identities found here Ref: https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/special-identities",
+               name_property: true
 
       property :users, [Array, String],
-        description: "An optional property to set the privilege for given users. Use only with set action.",
-        coerce: proc { |v| Array(v) }
+               description: "An optional property to set the privilege for given users. Use only with set action.",
+               coerce: proc { |v| Array(v) }
 
       property :privilege, [Array, String],
-        description: "One or more privileges to set for users.",
-        required: true,
-        coerce: proc { |v| Array(v) },
-        callbacks: {
-          "Privilege property restricted to the following values: #{PRIVILEGE_OPTS}" => lambda { |n| (n - PRIVILEGE_OPTS).empty? },
-        }, identity: true
+               description: "One or more privileges to set for principal or users/groups. For more information on what each privilege does Ref: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment",
+               required: true,
+               coerce: proc { |v| Array(v) },
+               callbacks: {
+                 "Privilege property restricted to the following values: #{PRIVILEGE_OPTS}" => lambda { |n| (n - PRIVILEGE_OPTS).empty? },
+               }, identity: true
 
       load_current_value do |new_resource|
         if new_resource.principal && (new_resource.action.include?(:add) || new_resource.action.include?(:remove))
@@ -147,15 +157,15 @@ class Chef
         end
       end
 
-      action :add do
-        ([*new_resource.privilege] - [*current_resource.privilege]).each do |user_right|
-          converge_by("adding user '#{new_resource.principal}' privilege #{user_right}") do
-            Chef::ReservedNames::Win32::Security.add_account_right(new_resource.principal, user_right)
+      action :add, description: "Add a privileges to a principal." do
+        ([*new_resource.privilege] - [*current_resource.privilege]).each do |principal_right|
+          converge_by("adding principal '#{new_resource.principal}' privilege #{principal_right}") do
+            Chef::ReservedNames::Win32::Security.add_account_right(new_resource.principal, principal_right)
           end
         end
       end
 
-      action :set do
+      action :set, description: "Set the privileges that are listed in the `privilege` property for only the users listed in the `users` property. All other users not listed with given privilege will be have the privilege removed." do
         if new_resource.users.nil? || new_resource.users.empty?
           raise Chef::Exceptions::ValidationFailed, "Users are required property with set action."
         end
@@ -190,7 +200,7 @@ class Chef
         end
       end
 
-      action :clear do
+      action :clear, description: "Clear all user privileges" do
         new_resource.privilege.each do |privilege|
           accounts = Chef::ReservedNames::Win32::Security.get_account_with_user_rights(privilege)
 
@@ -204,7 +214,7 @@ class Chef
         end
       end
 
-      action :remove do
+      action :remove, description: "Remove a principal privilege" do
         curr_res_privilege = current_resource.privilege
         missing_res_privileges = (new_resource.privilege - curr_res_privilege)
 
@@ -212,9 +222,9 @@ class Chef
           Chef::Log.info("User \'#{new_resource.principal}\' for Privilege: #{missing_res_privileges.join(", ")} not found. Nothing to remove.")
         end
 
-        (new_resource.privilege - missing_res_privileges).each do |user_right|
-          converge_by("removing user #{new_resource.principal} from privilege #{user_right}") do
-            Chef::ReservedNames::Win32::Security.remove_account_right(new_resource.principal, user_right)
+        (new_resource.privilege - missing_res_privileges).each do |principal_right|
+          converge_by("removing principal #{new_resource.principal} from privilege #{principal_right}") do
+            Chef::ReservedNames::Win32::Security.remove_account_right(new_resource.principal, principal_right)
           end
         end
       end

data/lib/chef/version.rb

@@ -23,7 +23,7 @@ require_relative "version_string"
 
 class Chef
   CHEF_ROOT = File.expand_path("..", __dir__)
-  VERSION = Chef::VersionString.new("16.18.0")
+  VERSION = Chef::VersionString.new("16.18.30")
 end
 
 #

data/lib/chef/win32/version.rb

@@ -51,7 +51,8 @@ class Chef
       WIN_VERSIONS = {
         "Windows Server 2022" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION && build_number >= 20348 } },
         "Windows Server 2019" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION && build_number >= 17763 && build_number < 20348 } },
-        "Windows 10" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
+        "Windows 11" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION && build_number >= 22000 } },
+        "Windows 10" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION && build_number >= 19044 && build_number < 22000 } },
         "Windows Server 2016" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION && build_number <= 14393 } },
         "Windows 8.1" => { major: 6, minor: 3, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
         "Windows Server 2012 R2" => { major: 6, minor: 3, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION } },

data/spec/functional/assets/yumrepo-empty/repodata/repomd.xml

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<repomd xmlns="http://linux.duke.edu/metadata/repo" xmlns:rpm="http://linux.duke.edu/metadata/rpm">
+ <revision>1667508211</revision>
+<data type="filelists">
+  <checksum type="sha256">401dc19bda88c82c403423fb835844d64345f7e95f5b9835888189c03834cc93</checksum>
+  <open-checksum type="sha256">bf9808b81cb2dbc54b4b8e35adc584ddcaa73bd81f7088d73bf7dbbada961310</open-checksum>
+  <location href="repodata/401dc-filelists.xml.gz"/>
+  <timestamp>1667508211</timestamp>
+  <size>123</size>
+  <open-size>125</open-size>
+</data>
+<data type="primary">
+  <checksum type="sha256">dabe2ce5481d23de1f4f52bdcfee0f9af98316c9e0de2ce8123adeefa0dd08b9</checksum>
+  <open-checksum type="sha256">e1e2ffd2fb1ee76f87b70750d00ca5677a252b397ab6c2389137a0c33e7b359f</open-checksum>
+  <location href="repodata/dabe2-primary.xml.gz"/>
+  <timestamp>1667508211</timestamp>
+  <size>134</size>
+  <open-size>167</open-size>
+</data>
+<data type="primary_db">
+  <checksum type="sha256">5dc1e6e73c84803f059bb3065e684e56adfc289a7e398946574d79dac6643945</checksum>
+  <open-checksum type="sha256">f0d550414e8f2e960e82e704549364299ca9e3e8664ad4faffd208262c3b6d12</open-checksum>
+  <location href="repodata/5dc1e-primary.sqlite.bz2"/>
+  <timestamp>1667508211</timestamp>
+  <database_version>10</database_version>
+  <size>1131</size>
+  <open-size>21504</open-size>
+</data>
+<data type="other_db">
+  <checksum type="sha256">7c36572015e075add2b38b900837bcdbb8a504130ddff49b2351a7fc0affa3d4</checksum>
+  <open-checksum type="sha256">4de0fe7c5dd2674849a7c63c326e42f33af0a0f46219bc6dd59f51dfa2ac8c68</open-checksum>
+  <location href="repodata/7c365-other.sqlite.bz2"/>
+  <timestamp>1667508211</timestamp>
+  <database_version>10</database_version>
+  <size>575</size>
+  <open-size>6144</open-size>
+</data>
+<data type="other">
+  <checksum type="sha256">6bf9672d0862e8ef8b8ff05a2fd0208a922b1f5978e6589d87944c88259cb670</checksum>
+  <open-checksum type="sha256">e0ed5e0054194df036cf09c1a911e15bf2a4e7f26f2a788b6f47d53e80717ccc</open-checksum>
+  <location href="repodata/6bf96-other.xml.gz"/>
+  <timestamp>1667508211</timestamp>
+  <size>123</size>
+  <open-size>121</open-size>
+</data>
+<data type="filelists_db">
+  <checksum type="sha256">01a3b489a465bcac22a43492163df43451dc6ce47d27f66de289756b91635523</checksum>
+  <open-checksum type="sha256">c4211f57bdcbb142c9f93a6d32401539f775eb6a670ab7a423e13f435ce94689</open-checksum>
+  <location href="repodata/01a3b-filelists.sqlite.bz2"/>
+  <timestamp>1667508211</timestamp>
+  <database_version>10</database_version>
+  <size>586</size>
+  <open-size>7168</open-size>
+</data>
+</repomd>

data/spec/functional/resource/dsc_script_spec.rb

@@ -263,7 +263,7 @@ describe Chef::Resource::DscScript, :windows_powershell_dsc_only, :ruby64_only d
         dsc_test_resource.cwd(dsc_environment_fail_etc_directory)
         expect {
           dsc_test_resource.run_action(:run)
-        }.to raise_error(Chef::PowerShell::CommandFailed, /#{exception_message_signature}/)
+        }.to raise_error(ChefPowerShell::PowerShellExceptions::PowerShellCommandFailed, /#{exception_message_signature}/)
       end
     end
   end

data/spec/functional/resource/windows_font_spec.rb

@@ -18,7 +18,8 @@
 
 require "spec_helper"
 
-describe Chef::Resource::WindowsFont, :windows_only do
+# these tests hang on Buildkite on Chef 16 Verify pipeline
+describe Chef::Resource::WindowsFont, :windows_only, :broken do
   let(:resource_name) { "Playmaker.ttf" }
   let(:resource_source) { "https://www.wfonts.com/download/data/2020/05/06/playmaker/Playmaker.ttf" }
 

data/spec/functional/resource/yum_package_spec.rb

@@ -50,6 +50,12 @@ describe Chef::Resource::YumPackage, :requires_root, external: exclude_test do
         baseurl=file://#{CHEF_SPEC_ASSETS}/yumrepo
         enable=1
         gpgcheck=0
+        [chef-yum-empty]
+        name=Chef DNF spec empty repo
+        baseurl=file://#{CHEF_SPEC_ASSETS}/yumrepo-empty
+        enable=1
+        gpgcheck=0
+
       EOF
     end
     shell_out!("rpm -qa --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | grep chef_rpm | xargs -r rpm -e")
@@ -633,6 +639,12 @@ describe Chef::Resource::YumPackage, :requires_root, external: exclude_test do
         expect(shell_out("rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' chef_rpm").stdout.chomp).to match("^chef_rpm-1.10-1.#{pkg_arch}$")
       end
 
+      it "should work to disable a repo" do
+        flush_cache
+        yum_package.options("--disablerepo=chef-yum-localtesting --enablerepo=chef-yum-empty")
+        expect { yum_package.run_action(:install) }.to raise_error(Chef::Exceptions::Package, /No candidate version available/)
+      end
+
       it "when an idempotent install action is run, does not leave repos disabled" do
         flush_cache
         # this is a bit tricky -- we need this action to be idempotent, so that it doesn't recycle any

data/spec/functional/shell_spec.rb

@@ -80,6 +80,11 @@ describe Shell do
       # so hide the require here
 
       require "pty"
+
+      # FIXME this is temporary... Solaris envs have TERM set to unknown
+      # and the value isn't propagating from the build environment TERM
+      # variable
+      ENV["TERM"] = "vt100" if ["", "unknown"].include?(ENV["TERM"].to_s)
       config = File.expand_path("shef-config.rb", CHEF_SPEC_DATA)
       reader, writer, pid = PTY.spawn("bundle exec chef-shell --no-multiline --no-singleline --no-colorize -c #{config} #{options}")
       read_until(reader, "chef (#{Chef::VERSION})>")

data/spec/integration/client/fips_spec.rb

@@ -0,0 +1,21 @@
+require "spec_helper"
+
+describe "chef-client fips" do
+  def enable_fips
+    OpenSSL.fips_mode = true
+  end
+
+  # All tests assume fips mode is off at present
+  after { OpenSSL.fips_mode = false }
+
+  # For non-FIPS OSes/builds of Ruby, enabling FIPS should error
+  example "Error enabling fips_mode if FIPS not linked", fips_mode: false do
+    expect { enable_fips }.to raise_error(OpenSSL::OpenSSLError)
+  end
+
+  # For FIPS OSes/builds of Ruby, enabling FIPS should not error
+  example "Do not error enabling fips_mode if FIPS linked", fips_mode: true do
+    expect { enable_fips }.not_to raise_error
+  end
+end
+

data/spec/spec_helper.rb

@@ -139,6 +139,10 @@ RSpec.configure do |config|
 
   config.filter_run_excluding skip_buildkite: true if ENV["BUILDKITE"]
 
+  config.filter_run_excluding fips_mode: !fips_mode_build? unless opensuse?
+  # RubyDistros OpenSUSE docker images have a broken fips
+  config.filter_run_excluding :fips_mode if opensuse?
+
   config.filter_run_excluding windows_only: true unless windows?
   config.filter_run_excluding not_supported_on_windows: true if windows?
   config.filter_run_excluding not_supported_on_macos: true if macos?

data/spec/support/platform_helpers.rb

@@ -226,6 +226,10 @@ def fips?
   ENV["CHEF_FIPS"] == "1"
 end
 
+def fips_mode_build?
+  OpenSSL::OPENSSL_FIPS
+end
+
 class HttpHelper
   extend Ohai::Mixin::HttpHelper
   def self.logger

data/spec/unit/daemon_spec.rb

@@ -170,11 +170,7 @@ describe Chef::Daemon do
 
       it "should log an appropriate error message and fail miserably" do
         allow(Process).to receive(:initgroups).and_raise(Errno::EPERM)
-        error = "Operation not permitted"
-        if RUBY_PLATFORM.match("solaris2") || RUBY_PLATFORM.match("aix")
-          error = "Not owner"
-        end
-        expect(Chef::Application).to receive(:fatal!).with("Permission denied when trying to change 999:999 to 501:20. #{error}")
+        expect(Chef::Application).to receive(:fatal!).with(/Permission denied when trying to change 999:999 to 501:20/)
         Chef::Daemon._change_privilege(testuser)
       end
     end

data/spec/unit/mixin/checksum_spec.rb

@@ -51,4 +51,32 @@ describe Chef::Mixin::Checksum do
     end
   end
 
+  describe "checksum_match?" do
+    context "when checksum cases match" do
+      it "returns true" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", "u7ghbxikk3i9blsimmy2y2ionmxx")).to be true
+      end
+    end
+
+    context "when one checksum is uppercase and other is lowercase" do
+      it "returns true" do
+        expect(@checksum_user.checksum_match?("U7GHBXIKK3I9BLSIMMY2Y2IONMXX", "u7ghbxikk3i9blsimmy2y2ionmxx")).to be true
+      end
+    end
+
+    context "when checksums do not match" do
+      it "returns false" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", "09ee9c8cc70501763563bcf9c218")).to be false
+      end
+    end
+
+    context "when checksum is nil" do
+      it "returns false" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", nil)).to be false
+        expect(@checksum_user.checksum_match?(nil, "09ee9c8cc70501763563bcf9c218")).to be false
+        expect(@checksum_user.checksum_match?(nil, nil)).to be false
+      end
+    end
+  end
+
 end

data/spec/unit/mixin/powershell_exec_spec.rb

@@ -25,8 +25,8 @@ describe Chef::Mixin::PowershellExec, :windows_only do
 
   describe "#powershell_exec" do
     context "not specifying an interpreter" do
-      it "runs a basic command and returns a Chef::PowerShell object" do
-        expect(object.powershell_exec("$PSVersionTable")).to be_kind_of(Chef::PowerShell)
+      it "runs a basic command and returns a ChefPowerShell::PowerShell object" do
+        expect(object.powershell_exec("$PSVersionTable")).to be_kind_of(ChefPowerShell::PowerShell)
       end
 
       it "uses less than version 6" do
@@ -36,8 +36,8 @@ describe Chef::Mixin::PowershellExec, :windows_only do
     end
 
     context "using pwsh interpreter" do
-      it "runs a basic command and returns a Chef::PowerShell object" do
-        expect(object.powershell_exec("$PSVersionTable", :pwsh)).to be_kind_of(Chef::Pwsh)
+      it "runs a basic command and returns a ChefPowerShell::Pwsh object" do
+        expect(object.powershell_exec("$PSVersionTable", :pwsh)).to be_kind_of(ChefPowerShell::Pwsh)
       end
 
       it "uses greater than version 6" do
@@ -47,8 +47,8 @@ describe Chef::Mixin::PowershellExec, :windows_only do
     end
 
     context "using powershell interpreter" do
-      it "runs a basic command and returns a Chef::PowerShell object" do
-        expect(object.powershell_exec("$PSVersionTable", :powershell)).to be_kind_of(Chef::PowerShell)
+      it "runs a basic command and returns a ChefPowerShell::PowerShell object" do
+        expect(object.powershell_exec("$PSVersionTable", :powershell)).to be_kind_of(ChefPowerShell::PowerShell)
       end
 
       it "uses less than version 6" do
@@ -75,12 +75,12 @@ describe Chef::Mixin::PowershellExec, :windows_only do
   end
 
   describe "#powershell_exec!" do
-    it "runs a basic command and returns a Chef::PowerShell object" do
-      expect(object.powershell_exec!("$PSVersionTable")).to be_kind_of(Chef::PowerShell)
+    it "runs a basic command and returns a ChefPowerShell::PowerShell object" do
+      expect(object.powershell_exec!("$PSVersionTable")).to be_kind_of(ChefPowerShell::PowerShell)
     end
 
     it "raises an error if the command fails" do
-      expect { object.powershell_exec!("this-should-error") }.to raise_error(Chef::PowerShell::CommandFailed)
+      expect { object.powershell_exec!("this-should-error") }.to raise_error(ChefPowerShell::PowerShellExceptions::PowerShellCommandFailed)
     end
 
     it "raises an error if the interpreter is invalid" do

data/spec/unit/platform/query_helpers_spec.rb

@@ -18,7 +18,7 @@
 
 require "spec_helper"
 
-describe "Chef::Platform#supports_dsc_invoke_resource?" do
+describe "Chef::Platform#supports_dsc_invoke_resource?", :windows_only do
   it "returns false if powershell is not present" do
     node = Chef::Node.new
     expect(Chef::Platform.supports_dsc_invoke_resource?(node)).to be_falsey
@@ -39,12 +39,12 @@ describe "Chef::Platform#supports_dsc_invoke_resource?" do
   end
 end
 
-describe "Chef::Platform#dsc_refresh_mode_disabled?" do
+describe "Chef::Platform#dsc_refresh_mode_disabled?", :windows_only do
   let(:node) { instance_double("Chef::Node") }
-  let(:powershell) { instance_double("Chef::PowerShell") }
+  let(:powershell) { instance_double("ChefPowerShell::PowerShell") }
 
   it "returns true when RefreshMode is Disabled" do
-    expect(Chef::PowerShell).to receive(:new)
+    expect(ChefPowerShell::PowerShell).to receive(:new)
       .with("Get-DscLocalConfigurationManager")
       .and_return(powershell)
     expect(powershell).to receive(:error!)
@@ -53,7 +53,7 @@ describe "Chef::Platform#dsc_refresh_mode_disabled?" do
   end
 
   it "returns false when RefreshMode is not Disabled" do
-    expect(Chef::PowerShell).to receive(:new)
+    expect(ChefPowerShell::PowerShell).to receive(:new)
       .with("Get-DscLocalConfigurationManager")
       .and_return(powershell)
     expect(powershell).to receive(:error!)

data/spec/unit/provider/cron_spec.rb

@@ -724,6 +724,40 @@ describe Chef::Provider::Cron do
         end
       end
 
+      context "when integers are provided to the resource to express time values" do
+        it "should not report any difference" do
+          @new_resource.minute(1)
+          @new_resource.hour(1)
+          @new_resource.day(1)
+          @new_resource.month(1)
+          @new_resource.weekday(1)
+          allow(@provider).to receive(:read_crontab).and_return(<<~CRONTAB)
+            # Chef Name: cronhole some stuff
+            1 1 1 1 1 /bin/true
+          CRONTAB
+
+          @provider.run_action(:create)
+          expect(@new_resource).not_to be_updated_by_last_action
+        end
+      end
+
+      context "when strings are provided to the resource to express time values" do
+        it "should not report any difference" do
+          @new_resource.minute("1")
+          @new_resource.hour("1")
+          @new_resource.day("1")
+          @new_resource.month("1")
+          @new_resource.weekday("1")
+          allow(@provider).to receive(:read_crontab).and_return(<<~CRONTAB)
+            # Chef Name: cronhole some stuff
+            1 1 1 1 1 /bin/true
+          CRONTAB
+
+          @provider.run_action(:create)
+          expect(@new_resource).not_to be_updated_by_last_action
+        end
+      end
+
       context "when environment variable is used" do
         before :each do
           @provider.cron_exists = true

data/spec/unit/util/dsc/local_configuration_manager_spec.rb

@@ -50,7 +50,7 @@ describe Chef::Util::DSC::LocalConfigurationManager do
   end
 
   let(:powershell) do
-    double("Chef::PowerShell", errors: lcm_errors, error?: !lcm_errors.empty?, result: lcm_result)
+    double("ChefPowerShell::PowerShell", errors: lcm_errors, error?: !lcm_errors.empty?, result: lcm_result)
   end
 
   describe "test_configuration method invocation" do
@@ -185,7 +185,7 @@ describe Chef::Util::DSC::LocalConfigurationManager do
     context "when invalid dsc script is given" do
       it "raises exception" do
         configuration_document = "invalid-config"
-        expect { lcm.send(:run_configuration_cmdlet, configuration_document, true) }.to raise_error(Chef::PowerShell::CommandFailed)
+        expect { lcm.send(:run_configuration_cmdlet, configuration_document, true) }.to raise_error(ChefPowerShell::PowerShellExceptions::PowerShellCommandFailed)
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chef
 version: !ruby/object:Gem::Version
-  version: 16.18.0
+  version: 16.18.30
 platform: ruby
 authors:
 - Adam Jacob
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-28 00:00:00.000000000 Z
+date: 2023-02-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: chef-config
@@ -16,48 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.18.0
+        version: 16.18.30
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.18.0
+        version: 16.18.30
 - !ruby/object:Gem::Dependency
   name: chef-utils
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.18.0
+        version: 16.18.30
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.18.0
-- !ruby/object:Gem::Dependency
-  name: train-core
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.2'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 3.2.28
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.2'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 3.2.28
+        version: 16.18.30
 - !ruby/object:Gem::Dependency
   name: train-winrm
   requirement: !ruby/object:Gem::Requirement
@@ -226,14 +206,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.9.25
+        version: '1.15'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.9.25
+        version: '1.15'
 - !ruby/object:Gem::Dependency
   name: ffi-yajl
   requirement: !ruby/object:Gem::Requirement
@@ -1907,6 +1887,13 @@ files:
 - spec/functional/assets/mytest-1.0-1.noarch.rpm
 - spec/functional/assets/mytest-2.0-1.noarch.rpm
 - spec/functional/assets/testchefsubsys
+- spec/functional/assets/yumrepo-empty/repodata/01a3b-filelists.sqlite.bz2
+- spec/functional/assets/yumrepo-empty/repodata/401dc-filelists.xml.gz
+- spec/functional/assets/yumrepo-empty/repodata/5dc1e-primary.sqlite.bz2
+- spec/functional/assets/yumrepo-empty/repodata/6bf96-other.xml.gz
+- spec/functional/assets/yumrepo-empty/repodata/7c365-other.sqlite.bz2
+- spec/functional/assets/yumrepo-empty/repodata/dabe2-primary.xml.gz
+- spec/functional/assets/yumrepo-empty/repodata/repomd.xml
 - spec/functional/assets/yumrepo/chef_rpm-1.10-1.aarch64.rpm
 - spec/functional/assets/yumrepo/chef_rpm-1.10-1.i686.rpm
 - spec/functional/assets/yumrepo/chef_rpm-1.10-1.ppc64.rpm
@@ -1921,12 +1908,6 @@ files:
 - spec/functional/assets/yumrepo/chef_rpm-1.2-1.s390x.rpm
 - spec/functional/assets/yumrepo/chef_rpm-1.2-1.src.rpm
 - spec/functional/assets/yumrepo/chef_rpm-1.2-1.x86_64.rpm
-- spec/functional/assets/yumrepo/repodata/4632d67cb92636e7575d911c24f0e04d3505a944e97c483abe0c3e73a7c62d33-filelists.sqlite.bz2
-- spec/functional/assets/yumrepo/repodata/74599b793e54d877323837d2d81a1c3c594c44e4335f9528234bb490f7b9b439-other.xml.gz
-- spec/functional/assets/yumrepo/repodata/a845d418f919d2115ab95a56b2c76f6825ad0d0bede49181a55c04f58995d057-primary.sqlite.bz2
-- spec/functional/assets/yumrepo/repodata/af9b7cf9ef23bd7b43068d74a460f3b5d06753d638e58e4a0c9edc35bfb9cdc4-other.sqlite.bz2
-- spec/functional/assets/yumrepo/repodata/bdb4f5f1492a3b9532f22c43110a81500dd744f23da0aec5c33b2a41317c737d-filelists.xml.gz
-- spec/functional/assets/yumrepo/repodata/c10d1d34ce99e02f12ec96ef68360543ab1bb7c3cb81a4a2bf78df7d8597e9df-primary.xml.gz
 - spec/functional/assets/yumrepo/repodata/filelists.xml.gz
 - spec/functional/assets/yumrepo/repodata/other.xml.gz
 - spec/functional/assets/yumrepo/repodata/primary.xml.gz
@@ -2030,6 +2011,7 @@ files:
 - spec/functional/win32/versions_spec.rb
 - spec/integration/client/client_spec.rb
 - spec/integration/client/exit_code_spec.rb
+- spec/integration/client/fips_spec.rb
 - spec/integration/client/ipv6_spec.rb
 - spec/integration/compliance/compliance_spec.rb
 - spec/integration/knife/chef_fs_data_store_spec.rb