chef 16.18.0 → 17.0.242

data/spec/unit/compliance/reporter/automate_spec.rb

@@ -1,6 +1,7 @@
 require "spec_helper"
 require "json" # For .to_json
 
+require "chef/compliance/reporter/automate"
 describe Chef::Compliance::Reporter::Automate do
   let(:reporter) { Chef::Compliance::Reporter::Automate.new(opts) }
 
@@ -264,11 +265,34 @@ describe Chef::Compliance::Reporter::Automate do
       expect(metasearch_stub).to have_been_requested
       expect(report_stub).to have_been_requested
     end
+  end
 
-    it "does not send report when entity_uuid is missing" do
+  describe "#validate_config!" do
+    it "raises CMPL004 when entity_uuid is not present" do
       opts.delete(:entity_uuid)
+      expect { reporter.validate_config! }.to raise_error(/^CMPL004/)
+    end
+
+    it "raises CMPL005 when run_id is not present" do
+      opts.delete(:run_id)
+      expect { reporter.validate_config! }.to raise_error(/^CMPL005/)
+    end
+
+    it "raises CMPL006 when data collector URL is missing" do
+      Chef::Config[:data_collector] = { token: "not_nil", server_url: nil }
       reporter = Chef::Compliance::Reporter::Automate.new(opts)
-      expect(reporter.send_report(inspec_report)).to eq(false)
+      expect { reporter.validate_config! }.to raise_error(/^CMPL006/)
+    end
+
+    it "raises CMPL006 when data collector token is missing" do
+      Chef::Config[:data_collector] = { token: nil, server_url: "not_nil" }
+      reporter = Chef::Compliance::Reporter::Automate.new(opts)
+      expect { reporter.validate_config! }.to raise_error(/^CMPL006/)
+    end
+
+    it "otherwise passes" do
+      Chef::Config[:data_collector] = { token: "not_nil", server_url: "not_nil" }
+      reporter.validate_config!
     end
   end
 

data/spec/unit/compliance/reporter/chef_server_automate_spec.rb

@@ -1,7 +1,9 @@
 require "spec_helper"
+require "chef/compliance/reporter/chef_server_automate"
 
 describe Chef::Compliance::Reporter::ChefServerAutomate do
   before do
+    # Isn't this already done globally in
     WebMock.disable_net_connect!
 
     Chef::Config[:client_key] = File.expand_path("../../../data/ssl/private_key.pem", __dir__)
@@ -174,4 +176,22 @@ describe Chef::Compliance::Reporter::ChefServerAutomate do
 
     expect(report_stub).to have_been_requested
   end
+
+  describe "#validate_config!" do
+    it "raises CMPL007 when entity_uuid is not present" do
+      opts.delete(:entity_uuid)
+      expect { reporter.validate_config! }.to raise_error(/^CMPL007/)
+    end
+
+    it "raises CMPL008 when run_id is not present" do
+      opts.delete(:run_id)
+      expect { reporter.validate_config! }.to raise_error(/^CMPL008/)
+    end
+
+    it "otherwise passes" do
+      reporter.validate_config!
+    end
+
+  end
+
 end

data/spec/unit/compliance/reporter/compliance_enforcer_spec.rb

@@ -1,4 +1,5 @@
 require "spec_helper"
+require "chef/compliance/reporter/compliance_enforcer"
 
 describe Chef::Compliance::Reporter::AuditEnforcer do
   let(:reporter) { Chef::Compliance::Reporter::AuditEnforcer.new }

data/spec/unit/compliance/runner_spec.rb

@@ -12,6 +12,12 @@ describe Chef::Compliance::Runner do
   end
 
   describe "#enabled?" do
+    context "when the node is not available" do
+      let(:runner) { described_class.new }
+      it "is false because it needs the node to answer that question" do
+        expect(runner).not_to be_enabled
+      end
+    end
 
     it "is true if the node attributes have audit profiles and the audit cookbook is not present, and the compliance mode attribute is nil" do
       node.normal["audit"]["profiles"]["ssh"] = { 'compliance': "base/ssh" }
@@ -124,7 +130,7 @@ describe Chef::Compliance::Runner do
       expect(runner.inspec_profiles).to eq(expected)
     end
 
-    it "raises an error when the profiles are in the old audit-cookbook format" do
+    it "raises a CMPL010 message when the profiles are in the old audit-cookbook format" do
       node.normal["audit"]["profiles"] = [
         {
           name: "Windows 2019 Baseline",
@@ -132,7 +138,7 @@ describe Chef::Compliance::Runner do
         },
       ]
 
-      expect { runner.inspec_profiles }.to raise_error(/profiles specified in an unrecognized format, expected a hash of hashes./)
+      expect { runner.inspec_profiles }.to raise_error(/CMPL010:/)
     end
   end
 
@@ -180,9 +186,29 @@ describe Chef::Compliance::Runner do
       end
     end
 
-    it "fails with unexpected reporter value" do
-      expect { runner.reporter("tacos") }.to raise_error(/'tacos' is not a supported reporter for Compliance Phase/)
+  end
+
+  describe "#load_and_validate! when compliance is enabled" do
+    before do
+      allow(runner).to receive(:enabled?).and_return(true)
+    end
+
+    it "raises CMPL003 when the reporter is not a supported reporter type" do
+      node.normal["audit"]["reporter"] = [ "invalid" ]
+      expect { runner.load_and_validate! }.to raise_error(/^CMPL003:/)
+    end
+    it "raises CMPL002 if the configured fetcher is not supported" do
+      node.normal["audit"]["fetcher"] = "invalid"
+      expect { runner.load_and_validate! }.to raise_error(/^CMPL002:/)
     end
+
+    it "validates configured reporters" do
+      node.normal["audit"]["reporter"] = [ "chef-automate" ]
+      reporter_double = double("reporter", validate_config!: nil)
+      expect(runner).to receive(:reporter).with("chef-automate").and_return(reporter_double)
+      runner.load_and_validate!
+    end
+
   end
 
   describe "#inspec_opts" do

data/spec/unit/cookbook_version_spec.rb

@@ -41,59 +41,7 @@ describe Chef::CookbookVersion do
     it "has empty metadata" do
       expect(cookbook_version.metadata).to eq(Chef::Cookbook::Metadata.new)
     end
-  end
-
-  describe "#recipe_yml_filenames_by_name" do
-    let(:cookbook_version) { Chef::CookbookVersion.new("mycb", "/tmp/mycb") }
-
-    def files_for_recipe(extension)
-      [
-        { name: "recipes/default.#{extension}", full_path: "/home/user/repo/cookbooks/test/recipes/default.#{extension}" },
-        { name: "recipes/other.#{extension}", full_path: "/home/user/repo/cookbooks/test/recipes/other.#{extension}" },
-      ]
-    end
-    context "and YAML files present include both a recipes/default.yml and a recipes/default.yaml" do
-      before(:each) do
-        allow(cookbook_version).to receive(:files_for).with("recipes").and_return(
-          [
-            { name: "recipes/default.yml", full_path: "/home/user/repo/cookbooks/test/recipes/default.yml" },
-            { name: "recipes/default.yaml", full_path: "/home/user/repo/cookbooks/test/recipes/default.yaml" },
-          ]
-        )
-      end
-      it "because both are valid and we can't pick, it raises an error that contains the info needed to fix the problem" do
-        expect { cookbook_version.recipe_yml_filenames_by_name }
-          .to raise_error(Chef::Exceptions::AmbiguousYAMLFile, /.*default.yml.*default.yaml.*update the cookbook to remove/)
-      end
-    end
-
-    %w{yml yaml}.each do |extension|
-
-      context "and YAML files are present including a recipes/default.#{extension}" do
-        before(:each) do
-          allow(cookbook_version).to receive(:files_for).with("recipes").and_return(files_for_recipe(extension))
-        end
-
-        context "and manifest does not include a root_files/recipe.#{extension}" do
-          it "returns all YAML recipes with a correct default of default.#{extension}" do
-            expect(cookbook_version.recipe_yml_filenames_by_name).to eq({ "default" => "/home/user/repo/cookbooks/test/recipes/default.#{extension}",
-                                                                        "other" => "/home/user/repo/cookbooks/test/recipes/other.#{extension}" })
-          end
-        end
-
-        context "and manifest also includes a root_files/recipe.#{extension}" do
-          let(:root_files) { [{ name: "root_files/recipe.#{extension}", full_path: "/home/user/repo/cookbooks/test/recipe.#{extension}" } ] }
-          before(:each) do
-            allow(cookbook_version.cookbook_manifest).to receive(:root_files).and_return(root_files)
-          end
 
-          it "returns all YAML recipes with a correct default of recipe.#{extension}" do
-            expect(cookbook_version.recipe_yml_filenames_by_name).to eq({ "default" => "/home/user/repo/cookbooks/test/recipe.#{extension}",
-                                                                         "other" => "/home/user/repo/cookbooks/test/recipes/other.#{extension}" })
-          end
-        end
-      end
-    end
   end
 
   describe "with a cookbook directory named tatft" do

data/spec/unit/data_bag_item_spec.rb

@@ -148,12 +148,7 @@ describe Chef::DataBagItem do
     end
 
     it "implements all the methods of Hash" do
-      methods = %i{rehash to_hash [] fetch []= store default
-      default= default_proc index size length
-      empty? each_value each_key each_pair each keys values
-      values_at delete delete_if reject! clear
-      invert update replace merge! merge has_key? has_value?
-      key? value?}
+      methods = Hash.public_instance_methods
       methods.each do |m|
         expect(data_bag_item).to respond_to(m)
       end

data/spec/unit/data_collector_spec.rb

@@ -142,17 +142,11 @@ describe Chef::DataCollector do
   def expect_converge_message(keys)
     keys["message_type"] = "run_converge"
     keys["message_version"] = "1.1.0"
-    # if (keys.key?("node") && !keys["node"].empty?)
-    #   expect(rest_client).to receive(:post) do |_a, hash, _b|
-    #     require 'pry'; binding.pry
-    #   end
-    # else
     expect(rest_client).to receive(:post).with(
       nil,
       hash_including(keys),
       { "Content-Type" => "application/json" }
     )
-    # end
   end
 
   def resource_has_diff(new_resource, status)
@@ -164,7 +158,7 @@ describe Chef::DataCollector do
       "after" => after_resource&.state_for_resource_reporter || {},
       "before" => before_resource&.state_for_resource_reporter || {},
       "cookbook_name" => cookbook_name,
-      "cookbook_version" => cookbook_version&.version,
+      "cookbook_version" => cookbook_version.version,
       "delta" => resource_has_diff(new_resource, status) ? new_resource.diff : "",
       "duration" => duration,
       "id" => new_resource.identity,
@@ -208,7 +202,7 @@ describe Chef::DataCollector do
     end
 
     it "has a node" do
-      expect_converge_message("node" => expected_node.is_a?(Chef::Node) ? expected_node.data_for_save : expected_node)
+      expect_converge_message("node" => expected_node)
       send_run_failed_or_completed_event
     end
 
@@ -567,29 +561,6 @@ describe Chef::DataCollector do
         it_behaves_like "sends a converge message"
       end
 
-      context "when the run contains a file resource that is up-to-date from a @recipe_files, returns nil for the version" do
-        let(:total_resource_count) { 1 }
-        let(:updated_resource_count) { 0 }
-        let(:cookbook_name) { "@recipe_files" }
-        let(:resource_record) { [ resource_record_for(new_resource, current_resource, after_resource, :create, "up-to-date", "1234") ] }
-        let(:status) { "success" }
-        let(:cookbook_version) { nil }
-
-        before do
-          allow(new_resource).to receive(:cookbook_version).and_call_original
-          events.resource_action_start(new_resource, :create)
-          events.resource_current_state_loaded(new_resource, :create, current_resource)
-          events.resource_up_to_date(new_resource, :create)
-          events.resource_after_state_loaded(new_resource, :create, after_resource)
-          new_resource.instance_variable_set(:@elapsed_time, 1.2345)
-          events.resource_completed(new_resource)
-          events.converge_complete
-          run_status.stop_clock
-        end
-
-        it_behaves_like "sends a converge message"
-      end
-
       context "when the run contains a file resource that is updated" do
         let(:total_resource_count) { 1 }
         let(:updated_resource_count) { 1 }
@@ -837,46 +808,6 @@ describe Chef::DataCollector do
         it_behaves_like "sends a converge message"
       end
 
-      context "when node attributes are block-listed" do
-        let(:status) { "success" }
-        before do
-          Chef::Config[:blocked_default_attributes] = [
-            %w{secret key_to_the_kingdom},
-          ]
-          node.default = {
-            "secret" => { "key_to_the_kingdom" => "under the flower pot to the left of the drawbridge" },
-            "publicinfo" => { "num_flower_pots" => 18 },
-          }
-        end
-
-        it "payload should exclude blocked attributes" do
-          expect(rest_client).to receive(:post) do |_addr, hash, _headers|
-            expect(hash["node"]["default"]).to eq({ "secret" => {}, "publicinfo" => { "num_flower_pots" => 18 } })
-          end
-          send_run_failed_or_completed_event
-        end
-      end
-
-      context "when node attributes are allow-listed" do
-        let(:status) { "success" }
-        before do
-          Chef::Config[:allowed_default_attributes] = [
-            %w{public entrance},
-          ]
-          node.default = {
-            "public" => { "entrance" => "is the drawbridge" },
-            "secret" => { "entrance" => "is the tunnel" },
-          }
-        end
-
-        it "payload should include only allowed attributes" do
-          expect(rest_client).to receive(:post) do |_addr, hash, _headers|
-            expect(hash["node"]["default"]).to eq({ "public" => { "entrance" => "is the drawbridge" } })
-          end
-          send_run_failed_or_completed_event
-        end
-      end
-
     end
   end
 

data/spec/unit/dsl/reboot_pending_spec.rb

@@ -51,9 +51,9 @@ describe Chef::DSL::RebootPending do
         end
       end
 
-      context "platform is ubuntu" do
+      context "platform_family is debian" do
         before do
-          allow(recipe).to receive(:platform?).with("ubuntu").and_return(true)
+          allow(recipe).to receive(:platform_family?).with("debian").and_return(true)
         end
 
         it "should return true if /var/run/reboot-required exists" do

data/spec/unit/dsl/registry_helper_spec.rb

@@ -21,7 +21,7 @@ require "spec_helper"
 
 describe Chef::Resource::RegistryKey do
 
-  before (:all) do
+  before(:all) do
     events = Chef::EventDispatch::Dispatcher.new
     node = Chef::Node.new
     node.consume_external_attrs(OHAI_SYSTEM.data, {})

data/spec/unit/lwrp_spec.rb

@@ -576,7 +576,7 @@ describe "LWRP" do
       @tmpdir = File.join(@tmpparent, "lwrp")
       Dir.mkdir(@tmpdir)
       resource_path = File.join(@tmpdir, "once.rb")
-      IO.write(resource_path, "default_action :create")
+      IO.write(resource_path, "unified_mode true\ndefault_action :create")
       @test_lwrp_class = Chef::Resource::LWRPBase.build_from_file("lwrp", resource_path, nil)
     end
 

data/spec/unit/mixin/params_validate_spec.rb

@@ -359,10 +359,11 @@ describe Chef::Mixin::ParamsValidate do
     expect(@vo.set_or_return(:test, nil, {}).object_id).to eq(value.object_id)
   end
 
-  it "should set and return a default value when the argument is nil, then return the same value" do
+  it "should set and return a default value when the argument is nil, then return a dup of the value" do
     value = "meow"
-    expect(@vo.set_or_return(:test, nil, { default: value }).object_id).to eq(value.object_id)
-    expect(@vo.set_or_return(:test, nil, {}).object_id).to eq(value.object_id)
+    expect(@vo.set_or_return(:test, nil, { default: value }).object_id).not_to eq(value.object_id)
+    expect(@vo.set_or_return(:test, nil, {}).object_id).not_to eq(value.object_id)
+    expect(@vo.set_or_return(:test, nil, {})).to eql(value)
   end
 
   it "should raise an ArgumentError when argument is nil and required is true" do

data/spec/unit/mixin/powershell_out_spec.rb

@@ -30,7 +30,7 @@ describe Chef::Mixin::PowershellOut, :windows_only do
     it "runs a command and returns the shell_out object" do
       ret = double("Mixlib::ShellOut")
       expect(object).to receive(:shell_out).with(
-        "powershell.exe #{flags} -Command \"Get-Process\"", {}
+        "powershell.exe #{flags} -Command \"Get-Process\""
       ).and_return(ret)
       expect(object.powershell_out("Get-Process")).to eql(ret)
     end
@@ -75,7 +75,7 @@ describe Chef::Mixin::PowershellOut, :windows_only do
     it "runs a command and returns the shell_out object" do
       mixlib_shellout = double("Mixlib::ShellOut")
       expect(object).to receive(:shell_out).with(
-        "powershell.exe #{flags} -Command \"Get-Process\"", {}
+        "powershell.exe #{flags} -Command \"Get-Process\""
       ).and_return(mixlib_shellout)
       expect(mixlib_shellout).to receive(:error!)
       expect(object.powershell_out!("Get-Process")).to eql(mixlib_shellout)

data/spec/unit/node/attribute_spec.rb

@@ -898,7 +898,7 @@ describe Chef::Node::Attribute do
     end
   end
 
-  describe "index" do
+  describe "index", ruby: "< 3.0.0" do
     # Hash#index is deprecated and triggers warnings.
     def silence
       old_verbose = $VERBOSE

data/spec/unit/node_spec.rb

@@ -1951,4 +1951,82 @@ describe Chef::Node do
       expect(node["foo"]["bar"]["test"]).to eql("right")
     end
   end
+
+  describe "lazy values" do
+    it "supports lazy values in attributes" do
+      node.instance_eval do
+        default["foo"]["bar"] = lazy { node["fizz"]["buzz"] }
+        default["fizz"]["buzz"] = "works"
+      end
+      expect(node["foo"]["bar"]).to eql("works")
+    end
+
+    it "lazy values maintain laziness" do
+      node.instance_eval do
+        default["foo"]["bar"] = lazy { node["fizz"]["buzz"] }
+        default["fizz"]["buzz"] = "works"
+      end
+      expect(node["foo"]["bar"]).to eql("works")
+      node.default["fizz"]["buzz"] = "still works"
+      expect(node["foo"]["bar"]).to eql("still works")
+    end
+
+    it "supports recursive lazy values in attributes" do
+      node.instance_eval do
+        default["cool"]["beans"] = lazy { node["foo"]["bar"] }
+        default["foo"]["bar"] = lazy { node["fizz"]["buzz"] }
+        default["fizz"]["buzz"] = "works"
+      end
+      expect(node["cool"]["beans"]).to eql("works")
+      node.default["fizz"]["buzz"] = "still works"
+      expect(node["cool"]["beans"]).to eql("still works")
+    end
+
+    it "supports top level lazy values in attributes" do
+      # due to the top level deep merge cache these are special cases
+      node.instance_eval do
+        default["cool"] = lazy { node["foo"] }
+        default["foo"] = lazy { node["fizz"] }
+        default["fizz"] = "works"
+      end
+      expect(node["cool"]).to eql("works")
+      node.default["fizz"] = "still works"
+      expect(node["cool"]).to eql("still works")
+    end
+
+    it "supports deep merged values in attributes" do
+      node.instance_eval do
+        override["bar"]["cool"] = lazy { node["bar"]["foo"] }
+        override["bar"]["foo"] = lazy { node["bar"]["fizz"] }
+        override["bar"]["fizz"] = "works"
+      end
+      expect(node["bar"]["cool"]).to eql("works")
+      node.override["bar"]["fizz"] = "still works"
+      expect(node["bar"]["cool"]).to eql("still works")
+    end
+
+    it "supports overridden deep merged values in attributes (deep_merge)" do
+      node.instance_eval do
+        role_override["bar"] = { "cool" => "bad", "foo" => "bad", "fizz" => "bad" }
+        force_override["bar"]["cool"] = lazy { node["bar"]["foo"] }
+        force_override["bar"]["foo"] = lazy { node["bar"]["fizz"] }
+        force_override["bar"]["fizz"] = "works"
+      end
+      expect(node["bar"]["cool"]).to eql("works")
+      node.force_override["bar"]["fizz"] = "still works"
+      expect(node["bar"]["cool"]).to eql("still works")
+    end
+
+    it "supports overridden deep merged values in attributes (hash_only_merge)" do
+      node.instance_eval do
+        default["bar"] = { "cool" => "bad", "foo" => "bad", "fizz" => "bad" }
+        override["bar"]["cool"] = lazy { node["bar"]["foo"] }
+        override["bar"]["foo"] = lazy { node["bar"]["fizz"] }
+        override["bar"]["fizz"] = "works"
+      end
+      expect(node["bar"]["cool"]).to eql("works")
+      node.override["bar"]["fizz"] = "still works"
+      expect(node["bar"]["cool"]).to eql("still works")
+    end
+  end
 end

data/spec/unit/org_group_spec.rb

@@ -0,0 +1,45 @@
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+require "chef/org"
+
+describe Chef::Org do
+  let(:org) { Chef::Org.new("myorg") }
+
+  describe "API Interactions" do
+    before(:each) do
+      Chef::Config[:chef_server_root] = "http://www.example.com"
+      @rest = double("rest")
+      allow(Chef::ServerAPI).to receive(:new).and_return(@rest)
+    end
+
+    describe "group" do
+      it "should load group data when it's not loaded." do
+        expect(@rest).to receive(:get_rest).with("organizations/myorg/groups/admins").and_return({})
+        org.group("admins")
+      end
+
+      it "should not load group data a second time when it's already loaded." do
+        expect(@rest).to receive(:get_rest)
+          .with("organizations/myorg/groups/admins")
+          .and_return({ anything: "goes" })
+          .exactly(:once)
+        admin1 = org.group("admins")
+        admin2 = org.group("admins")
+        expect(admin1).to eq admin2
+      end
+    end
+  end
+end

data/spec/unit/policy_builder/policyfile_spec.rb

@@ -206,7 +206,7 @@ describe Chef::PolicyBuilder::Policyfile do
     end
 
     before do
-      Chef::Config[:policy_document_native_api] = true
+      Chef::Config[:policy_document_native_api] = false
       Chef::Config[:deployment_group] = "example-policy-stage"
       allow(policy_builder).to receive(:api_service).and_return(api_service)
     end
@@ -214,8 +214,6 @@ describe Chef::PolicyBuilder::Policyfile do
     describe "when using compatibility mode (policy_document_native_api == false)" do
 
       before do
-        Chef::Config[:policy_document_native_api] = false
-        Chef::Config[:treat_deprecation_warnings_as_errors] = false
         Chef::Config[:deployment_group] = "example-policy-stage"
       end
 
@@ -341,10 +339,6 @@ describe Chef::PolicyBuilder::Policyfile do
       end
 
       describe "validating the Policyfile.lock" do
-        before do
-          Chef::Config[:policy_group] = "policy-stage"
-          Chef::Config[:policy_name] = "example"
-        end
 
         it "errors if the policyfile json contains any non-recipe items" do
           parsed_policyfile_json["run_list"] = ["role[foo]"]
@@ -812,10 +806,6 @@ describe Chef::PolicyBuilder::Policyfile do
         context "when using compatibility mode (policy_document_native_api == false)" do
           let(:cookbook1_url) { "cookbooks/example1/#{example1_xyz_version}" }
           let(:cookbook2_url) { "cookbooks/example2/#{example2_xyz_version}" }
-          before do
-            Chef::Config[:policy_document_native_api] = false
-            Chef::Config[:treat_deprecation_warnings_as_errors] = false
-          end
 
           context "when the cookbooks don't exist on the server" do
             include_examples "fetching cookbooks when they don't exist"