chef 16.18.30 → 17.0.242

data/lib/chef/mixin/powershell_exec.rb

@@ -15,7 +15,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Powershell is being run using chef-powershell gem. The code resides at https://github.com/chef/chef-powershell-shim
+require_relative "../powershell"
+require_relative "../pwsh"
 
 # The powershell_exec mixin provides in-process access to the PowerShell engine.
 #
@@ -94,15 +95,33 @@
 #   credentials of the user running Chef Client are used.
 #
 
-if ChefUtils.windows?
-  require "chef-powershell"
-end
-
 class Chef
   module Mixin
     module PowershellExec
-      if ChefUtils.windows?
-        include ChefPowerShell::ChefPowerShellModule::PowerShellExec
+      # Run a command under PowerShell via a managed (.NET) API.
+      #
+      # Requires: .NET Framework 4.0 or higher on the target machine.
+      #
+      # @param script [String] script to run
+      # @param interpreter [Symbol] the interpreter type, `:powershell` or `:pwsh`
+      # @return [Chef::PowerShell] output
+      def powershell_exec(script, interpreter = :powershell)
+        case interpreter
+        when :powershell
+          Chef::PowerShell.new(script)
+        when :pwsh
+          Chef::Pwsh.new(script)
+        else
+          raise ArgumentError, "Expected interpreter of :powershell or :pwsh"
+        end
+      end
+
+      # The same as the #powershell_exec method except this will raise
+      # Chef::PowerShell::CommandFailed if the command fails
+      def powershell_exec!(script, interpreter = :powershell)
+        cmd = powershell_exec(script, interpreter)
+        cmd.error!
+        cmd
       end
     end
   end

data/lib/chef/node/attribute.rb

@@ -158,8 +158,10 @@ class Chef
       }.freeze
 
       ENUM_METHODS.each do |delegated_method|
-        define_method(delegated_method) do |*args, &block|
-          merged_attributes.send(delegated_method, *args, &block)
+        if Hash.public_method_defined?(delegated_method)
+          define_method(delegated_method) do |*args, &block|
+            merged_attributes.send(delegated_method, *args, &block)
+          end
         end
       end
 
@@ -450,34 +452,17 @@ class Chef
       # method-style access to attributes (has to come after the prepended ImmutablizeHash)
 
       def read(*path)
-        if path[0].nil?
-          Chef::Log.warn "Calling node.read() without any path argument is very slow, probably a bug, and should be avoided"
-          merged_attributes.read(*path) # re-merges everything, slow edge case
-        else
-          self[path[0]] unless path[0].nil? # force deep_merge_cache key construction if necessary
-          deep_merge_cache.read(*path)
-        end
+        merged_attributes.read(*path)
       end
 
       alias :dig :read
 
       def read!(*path)
-        if path[0].nil?
-          Chef::Log.warn "Calling node.read!() without any path argument is very slow, probably a bug, and should be avoided"
-          merged_attributes.read!(*path) # re-merges everything, slow edge case
-        else
-          self[path[0]] unless path[0].nil? # force deep_merge_cache key construction if necessary
-          deep_merge_cache.read!(*path)
-        end
+        merged_attributes.read!(*path)
       end
 
       def exist?(*path)
-        if path[0].nil?
-          true
-        else
-          self[path[0]] unless path[0].nil? # force deep_merge_cache key construction if necessary
-          deep_merge_cache.exist?(*path)
-        end
+        merged_attributes.exist?(*path)
       end
 
       def write(level, *args, &block)
@@ -613,7 +598,7 @@ class Chef
           merge_with.each do |key, merge_with_value|
             value =
               if merge_onto.key?(key)
-                deep_merge!(safe_dup(merge_onto[key]), merge_with_value)
+                deep_merge!(safe_dup(merge_onto.internal_get(key)), merge_with_value)
               else
                 merge_with_value
               end
@@ -649,7 +634,7 @@ class Chef
           merge_with.each do |key, merge_with_value|
             value =
               if merge_onto.key?(key)
-                hash_only_merge!(safe_dup(merge_onto[key]), merge_with_value)
+                hash_only_merge!(safe_dup(merge_onto.internal_get(key)), merge_with_value)
               else
                 merge_with_value
               end

data/lib/chef/node/immutable_collections.rb

@@ -19,6 +19,7 @@ require_relative "common_api"
 require_relative "mixin/state_tracking"
 require_relative "mixin/immutablize_array"
 require_relative "mixin/immutablize_hash"
+require_relative "../delayed_evaluator"
 
 class Chef
   class Node
@@ -109,6 +110,12 @@ class Chef
         key
       end
 
+      def [](*args)
+        value = super
+        value = value.call while value.is_a?(::Chef::DelayedEvaluator)
+        value
+      end
+
       prepend Chef::Node::Mixin::StateTracking
       prepend Chef::Node::Mixin::ImmutablizeArray
     end
@@ -187,6 +194,12 @@ class Chef
         e
       end
 
+      def [](*args)
+        value = super
+        value = value.call while value.is_a?(::Chef::DelayedEvaluator)
+        value
+      end
+
       prepend Chef::Node::Mixin::StateTracking
       prepend Chef::Node::Mixin::ImmutablizeHash
     end

data/lib/chef/node/mixin/deep_merge_cache.rb

@@ -15,6 +15,8 @@
 # limitations under the License.
 #
 
+require_relative "../../delayed_evaluator"
+
 class Chef
   class Node
     module Mixin
@@ -28,7 +30,7 @@ class Chef
           @merged_attributes = nil
           @combined_override = nil
           @combined_default = nil
-          @deep_merge_cache = Chef::Node::ImmutableMash.new
+          @deep_merge_cache = {}
         end
 
         # Invalidate a key in the deep_merge_cache.  If called with nil, or no arg, this will invalidate
@@ -37,22 +39,24 @@ class Chef
         # must invalidate the entire cache and re-deep-merge the entire node object.
         def reset_cache(path = nil)
           if path.nil?
-            deep_merge_cache.regular_clear
+            deep_merge_cache.clear
           else
-            deep_merge_cache.regular_delete(path.to_s)
+            deep_merge_cache.delete(path.to_s)
           end
         end
 
         alias :reset :reset_cache
 
         def [](key)
-          if deep_merge_cache.key?(key.to_s)
-            # return the cache of the deep merged values by top-level key
-            deep_merge_cache[key.to_s]
-          else
-            # save all the work of computing node[key]
-            deep_merge_cache.internal_set(key.to_s, merged_attributes(key))
-          end
+          ret = if deep_merge_cache.key?(key.to_s)
+                  # return the cache of the deep merged values by top-level key
+                  deep_merge_cache[key.to_s]
+                else
+                  # save all the work of computing node[key]
+                  deep_merge_cache[key.to_s] = merged_attributes(key)
+                end
+          ret = ret.call while ret.is_a?(::Chef::DelayedEvaluator)
+          ret
         end
 
       end

data/lib/chef/node.rb

@@ -687,25 +687,6 @@ class Chef
       name <=> other.name
     end
 
-    # Returns hash of node data with attributes based on whitelist/blacklist rules.
-    def data_for_save
-      data = for_json
-      %w{automatic default normal override}.each do |level|
-        allowlist = allowlist_or_whitelist_config(level)
-        unless allowlist.nil? # nil => save everything
-          logger.info("Allowing #{level} node attributes for save.")
-          data[level] = Chef::AttributeAllowlist.filter(data[level], allowlist)
-        end
-
-        blocklist = blocklist_or_blacklist_config(level)
-        unless blocklist.nil? # nil => remove nothing
-          logger.info("Blocking #{level} node attributes for save")
-          data[level] = Chef::AttributeBlocklist.filter(data[level], blocklist)
-        end
-      end
-      data
-    end
-
     private
 
     def save_without_policyfile_attrs
@@ -731,7 +712,7 @@ class Chef
     # @param [String] level the attribute level
     def allowlist_or_whitelist_config(level)
       if Chef::Config["#{level}_attribute_whitelist".to_sym]
-        Chef.deprecated(:attribute_whitelist_configuration, "Attribute whitelist configurations have been deprecated. Use the allowed_LEVEL_attribute configs instead")
+        Chef.deprecated(:attribute_blacklist_configuration, "Attribute whitelist configurations have been deprecated. Use the allowed_LEVEL_attribute configs instead")
         Chef::Config["#{level}_attribute_whitelist".to_sym]
       else
         Chef::Config["allowed_#{level}_attributes".to_sym]
@@ -751,6 +732,24 @@ class Chef
       end
     end
 
+    def data_for_save
+      data = for_json
+      %w{automatic default normal override}.each do |level|
+        allowlist = allowlist_or_whitelist_config(level)
+        unless allowlist.nil? # nil => save everything
+          logger.info("Allowing #{level} node attributes for save.")
+          data[level] = Chef::AttributeAllowlist.filter(data[level], allowlist)
+        end
+
+        blocklist = blocklist_or_blacklist_config(level)
+        unless blocklist.nil? # nil => remove nothing
+          logger.info("Blocking #{level} node attributes for save")
+          data[level] = Chef::AttributeBlocklist.filter(data[level], blocklist)
+        end
+      end
+      data
+    end
+
     # Returns a UUID that uniquely identifies this node for reporting reasons.
     #
     # The node is read in from disk if it exists, or it's generated if it does

data/lib/chef/org.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Steven Danna (steve@chef.io)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) Chef Software Inc
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -19,9 +19,10 @@
 require_relative "json_compat"
 require_relative "mixin/params_validate"
 require_relative "server_api"
+require_relative "group"
 
 class Chef
-  class Org
+  class Org < Group
 
     include Chef::Mixin::ParamsValidate
 

data/lib/chef/platform/query_helpers.rb

@@ -58,8 +58,8 @@ class Chef
       end
 
       def dsc_refresh_mode_disabled?(node)
-        require "chef-powershell"
-        exec = ChefPowerShell::PowerShell.new("Get-DscLocalConfigurationManager")
+        require_relative "../powershell"
+        exec = Chef::PowerShell.new("Get-DscLocalConfigurationManager")
         exec.error!
         exec.result["RefreshMode"] == "Disabled"
       end

data/lib/chef/policy_builder/policyfile.rb

@@ -148,11 +148,6 @@ class Chef
         # consume_external_attrs may add items to the run_list. Save the
         # expanded run_list, which we will pass to the server later to
         # determine which versions of cookbooks to use.
-
-        unless Chef::Config[:policy_document_native_api]
-          Chef.deprecated(:policyfile_compat_mode, "The chef-server 11 policyfile compat mode is deprecated, please set policy_document_native_api to true in your config")
-        end
-
         node.reset_defaults_and_overrides
 
         node.consume_external_attrs(ohai_data, json_attribs)

data/lib/chef/property.rb

@@ -412,6 +412,7 @@ class Chef
             # Otherwise, we have to validate it now.
             value = input_to_stored_value(resource, default, is_default: true)
           end
+          value = deep_dup(value)
           value = stored_value_to_output(resource, value)
 
           # If the value is mutable (non-frozen), we set it on the instance
@@ -748,5 +749,22 @@ class Chef
 
       result
     end
+
+    # recursively dup the value
+    def deep_dup(value)
+      return value if value.is_a?(DelayedEvaluator)
+
+      visitor = lambda do |obj|
+        obj = obj.dup rescue obj
+        case obj
+        when Hash
+          obj.each { |k, v| obj[k] = visitor.call(v) }
+        when Array
+          obj.each_with_index { |v, i| obj[i] = visitor.call(v) }
+        end
+        obj
+      end
+      visitor.call(value)
+    end
   end
 end

data/lib/chef/provider/cron.rb

@@ -88,11 +88,7 @@ class Chef
 
       def cron_different?
         CRON_ATTRIBUTES.any? do |cron_var|
-          if new_resource.send(cron_var).class == current_resource.send(cron_var).class
-            new_resource.send(cron_var) != current_resource.send(cron_var)
-          else
-            new_resource.send(cron_var).to_s != current_resource.send(cron_var).to_s
-          end
+          new_resource.send(cron_var) != current_resource.send(cron_var)
         end
       end
 
@@ -105,7 +101,7 @@ class Chef
 
         if @cron_exists
           unless cron_different?
-            logger.trace("Skipping existing cron entry '#{new_resource.name}'")
+            logger.debug("#{new_resource}: Skipping existing cron entry")
             return
           end
           read_crontab.each_line do |line|

data/lib/chef/provider/execute.rb

@@ -27,7 +27,7 @@ class Chef
 
       provides :execute, target_mode: true
 
-      def_delegators :new_resource, :command, :returns, :environment, :user, :domain, :password, :group, :cwd, :umask, :creates, :elevated, :default_env, :timeout, :input
+      def_delegators :new_resource, :command, :returns, :environment, :user, :domain, :password, :group, :cwd, :umask, :creates, :elevated, :default_env, :timeout, :input, :login
 
       def load_current_resource
         current_resource = Chef::Resource::Execute.new(new_resource.name)
@@ -92,6 +92,7 @@ class Chef
         opts[:cwd]         = cwd if cwd
         opts[:umask]       = umask if umask
         opts[:input]       = input if input
+        opts[:login]       = login if login
         opts[:default_env] = default_env
         opts[:log_level]   = :info
         opts[:log_tag]     = new_resource.to_s

data/lib/chef/provider/file.rb

@@ -152,7 +152,7 @@ class Chef
         unless ::File.exist?(new_resource.path)
           action_create
         else
-          logger.trace("#{new_resource} exists at #{new_resource.path} taking no action.")
+          logger.debug("#{new_resource} exists at #{new_resource.path} taking no action.")
         end
       end
 
@@ -334,7 +334,7 @@ class Chef
       end
 
       def do_validate_content
-        if new_resource.checksum && tempfile && !checksum_match?(new_resource.checksum, tempfile_checksum)
+        if new_resource.checksum && tempfile && ( new_resource.checksum != tempfile_checksum )
           raise Chef::Exceptions::ChecksumMismatch.new(short_cksum(new_resource.checksum), short_cksum(tempfile_checksum))
         end
 
@@ -448,7 +448,7 @@ class Chef
 
       def contents_changed?
         logger.trace "calculating checksum of #{tempfile.path} to compare with #{current_resource.checksum}"
-        !checksum_match?(tempfile_checksum, current_resource.checksum)
+        tempfile_checksum != current_resource.checksum
       end
 
       def tempfile

data/lib/chef/provider/git.rb

@@ -94,7 +94,7 @@ class Chef
           enable_submodules
           add_remotes
         else
-          logger.trace "#{new_resource} checkout destination #{cwd} already exists or is a non-empty directory"
+          logger.debug "#{new_resource} checkout destination #{cwd} already exists or is a non-empty directory"
         end
       end
 
@@ -281,12 +281,10 @@ class Chef
 
       def target_revision
         @target_revision ||=
-          begin
-            if sha_hash?(new_resource.revision)
-              @target_revision = new_resource.revision
-            else
-              @target_revision = remote_resolve_reference
-            end
+          if sha_hash?(new_resource.revision)
+            @target_revision = new_resource.revision
+          else
+            @target_revision = remote_resolve_reference
           end
       end
 

data/lib/chef/provider/group/dscl.rb

@@ -158,7 +158,7 @@ class Chef
           if new_resource.group_name && (current_resource.group_name != new_resource.group_name)
             dscl_create_group
           end
-          if new_resource.gid && (current_resource.gid != new_resource.gid.to_s)
+          if new_resource.gid && (current_resource.gid != new_resource.gid)
             set_gid
           end
           if new_resource.members || new_resource.excluded_members

data/lib/chef/provider/group/groupadd.rb

@@ -67,7 +67,7 @@ class Chef
                 members_to_be_added << member unless current_resource.members.include?(member)
               end
               members_to_be_added.each do |member|
-                logger.trace("#{new_resource} appending member #{member} to group #{new_resource.group_name}")
+                logger.debug("#{new_resource} appending member #{member} to group #{new_resource.group_name}")
                 add_member(member)
               end
             end
@@ -79,13 +79,13 @@ class Chef
               end
 
               members_to_be_removed.each do |member|
-                logger.trace("#{new_resource} removing member #{member} from group #{new_resource.group_name}")
+                logger.debug("#{new_resource} removing member #{member} from group #{new_resource.group_name}")
                 remove_member(member)
               end
             end
           else
             members_description = new_resource.members.empty? ? "none" : new_resource.members.join(", ")
-            logger.trace("#{new_resource} setting group members to: #{members_description}")
+            logger.debug("#{new_resource} setting group members to: #{members_description}")
             set_members(new_resource.members)
           end
         end

data/lib/chef/provider/group/groupmod.rb

@@ -66,13 +66,13 @@ class Chef
               end
             end
 
-            logger.trace("#{new_resource} not changing group members, the group has no members to add") if members_to_be_added.empty?
+            logger.debug("#{new_resource} not changing group members, the group has no members to add") if members_to_be_added.empty?
 
             add_group_members(members_to_be_added)
           else
             # We are resetting the members of a group so use the same trick
             reset_group_membership
-            logger.trace("#{new_resource} setting group members to: none") if new_resource.members.empty?
+            logger.debug("#{new_resource} setting group members to: none") if new_resource.members.empty?
             add_group_members(new_resource.members)
           end
         end
@@ -84,7 +84,7 @@ class Chef
 
         # Adds a list of usernames to the group using `user mod`
         def add_group_members(members)
-          logger.trace("#{new_resource} adding members #{members.join(", ")}") unless members.empty?
+          logger.debug("#{new_resource} adding members #{members.join(", ")}") unless members.empty?
           members.each do |user|
             shell_out!("user", "mod", "-G", new_resource.group_name, user)
           end

data/lib/chef/provider/group/pw.rb

@@ -44,7 +44,7 @@ class Chef
             # new or existing group. Because pw groupadd does not support the -m
             # and -d options used by manage_group, we treat group creation as a
             # special case and use -M.
-            logger.trace("#{new_resource} setting group members: #{new_resource.members.join(",")}")
+            logger.debug("#{new_resource} setting group members: #{new_resource.members.join(",")}")
             command += [ "-M", new_resource.members.join(",") ]
           end
 
@@ -119,12 +119,12 @@ class Chef
           end
 
           unless members_to_be_added.empty?
-            logger.trace("#{new_resource} adding group members: #{members_to_be_added.join(",")}")
+            logger.debug("#{new_resource} adding group members: #{members_to_be_added.join(",")}")
             opts << [ "-m", members_to_be_added.join(",") ]
           end
 
           unless members_to_be_removed.empty?
-            logger.trace("#{new_resource} removing group members: #{members_to_be_removed.join(",")}")
+            logger.debug("#{new_resource} removing group members: #{members_to_be_removed.join(",")}")
             opts << [ "-d", members_to_be_removed.join(",") ]
           end
 

data/lib/chef/provider/ifconfig.rb

@@ -205,7 +205,7 @@ class Chef
             logger.info("#{new_resource} deleted")
           end
         else
-          logger.trace("#{new_resource} does not exist - nothing to do")
+          logger.debug("#{new_resource} does not exist - nothing to do")
         end
         delete_config
       end
@@ -220,7 +220,7 @@ class Chef
             logger.info("#{new_resource} disabled")
           end
         else
-          logger.trace("#{new_resource} does not exist - nothing to do")
+          logger.debug("#{new_resource} does not exist - nothing to do")
         end
       end
 

data/lib/chef/provider/link.rb

@@ -106,7 +106,7 @@ class Chef
           if new_resource.link_type == :symbolic
             converge_by("create symlink at #{new_resource.target_file} to #{new_resource.to}") do
               file_class.symlink(canonicalize(new_resource.to), new_resource.target_file)
-              logger.trace("#{new_resource} created #{new_resource.link_type} link from #{new_resource.target_file} -> #{new_resource.to}")
+              logger.debug("#{new_resource} created #{new_resource.link_type} link from #{new_resource.target_file} -> #{new_resource.to}")
               logger.info("#{new_resource} created")
               # file_class.symlink will create the link with default access controls.
               # This means that the access controls of the file could be different
@@ -118,7 +118,7 @@ class Chef
           elsif new_resource.link_type == :hard
             converge_by("create hard link at #{new_resource.target_file} to #{new_resource.to}") do
               file_class.link(new_resource.to, new_resource.target_file)
-              logger.trace("#{new_resource} created #{new_resource.link_type} link from #{new_resource.target_file} -> #{new_resource.to}")
+              logger.debug("#{new_resource} created #{new_resource.link_type} link from #{new_resource.target_file} -> #{new_resource.to}")
               logger.info("#{new_resource} created")
             end
           end

data/lib/chef/provider/mount/aix.rb

@@ -140,7 +140,7 @@ class Chef
             shell_out!(command)
             logger.trace("#{@new_resource} is mounted at #{@new_resource.mount_point}")
           else
-            logger.trace("#{@new_resource} is already mounted at #{@new_resource.mount_point}")
+            logger.debug("#{@new_resource} is already mounted at #{@new_resource.mount_point}")
           end
         end
 
@@ -154,7 +154,7 @@ class Chef
 
         def enable_fs
           if @current_resource.enabled && mount_options_unchanged?
-            logger.trace("#{@new_resource} is already enabled - nothing to do")
+            logger.debug("#{@new_resource} is already enabled - nothing to do")
             return nil
           end
 
@@ -211,7 +211,7 @@ class Chef
               contents.each { |line| fstab.puts line }
             end
           else
-            logger.trace("#{@new_resource} is not enabled - nothing to do")
+            logger.debug("#{@new_resource} is not enabled - nothing to do")
           end
         end
 

data/lib/chef/provider/mount/mount.rb

@@ -120,7 +120,7 @@ class Chef
             shell_out!(*command)
             logger.trace("#{@new_resource} is mounted at #{@new_resource.mount_point}")
           else
-            logger.trace("#{@new_resource} is already mounted at #{@new_resource.mount_point}")
+            logger.debug("#{@new_resource} is already mounted at #{@new_resource.mount_point}")
           end
         end
 
@@ -129,7 +129,7 @@ class Chef
             shell_out!("umount", @new_resource.mount_point)
             logger.trace("#{@new_resource} is no longer mounted at #{@new_resource.mount_point}")
           else
-            logger.trace("#{@new_resource} is not mounted at #{@new_resource.mount_point}")
+            logger.debug("#{@new_resource} is not mounted at #{@new_resource.mount_point}")
           end
         end
 
@@ -147,7 +147,7 @@ class Chef
             sleep 1
             mount_fs
           else
-            logger.trace("#{@new_resource} is not mounted at #{@new_resource.mount_point} - nothing to do")
+            logger.debug("#{@new_resource} is not mounted at #{@new_resource.mount_point} - nothing to do")
           end
         end
 
@@ -158,7 +158,7 @@ class Chef
 
         def enable_fs
           if @current_resource.enabled && mount_options_unchanged? && device_unchanged?
-            logger.trace("#{@new_resource} is already enabled - nothing to do")
+            logger.debug("#{@new_resource} is already enabled - nothing to do")
             return nil
           end
 
@@ -272,7 +272,7 @@ class Chef
               contents.reverse_each { |line| fstab.puts line }
             end
           else
-            logger.trace("#{@new_resource} is not enabled - nothing to do")
+            logger.debug("#{@new_resource} is not enabled - nothing to do")
           end
         end
 

data/lib/chef/provider/mount/windows.rb

@@ -67,7 +67,7 @@ class Chef
                        password: @new_resource.password)
             logger.trace("#{@new_resource} is mounted at #{@new_resource.mount_point}")
           else
-            logger.trace("#{@new_resource} is already mounted at #{@new_resource.mount_point}")
+            logger.debug("#{@new_resource} is already mounted at #{@new_resource.mount_point}")
           end
         end