chef 16.18.30 → 17.10.163

data/lib/chef/provider/systemd_unit.rb

@@ -22,6 +22,7 @@ require_relative "../resource/file"
 require_relative "../resource/file/verification/systemd_unit"
 require "iniparse"
 require "shellwords" unless defined?(Shellwords)
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 
 class Chef
   class Provider
@@ -55,7 +56,27 @@ class Chef
         end
       end
 
-      action :create do
+      def systemd_unit_status
+        @systemd_unit_status ||= begin
+          # Collect all the status information for a unit and return it at once
+          # This may fail if we are managing a template unit (e.g. with '@'), in which case
+          # we just ignore the error because unit status is irrelevant in that case
+          s = shell_out(*systemctl_cmd, "show", "-p", "UnitFileState", "-p", "ActiveState", new_resource.unit_name, **systemctl_opts)
+          # e.g. /bin/systemctl --system show -p UnitFileState -p ActiveState syslog.socket
+          # Returns something like:
+          # ActiveState=inactive
+          # UnitFileState=static
+          status = {}
+          s.stdout.each_line do |line|
+            k, v = line.strip.split("=")
+            status[k] = v
+          end
+
+          status
+        end
+      end
+
+      action :create, description: "Create a systemd unit file, if it does not already exist." do
         if current_resource.content != new_resource.to_ini
           converge_by("creating unit: #{new_resource.unit_name}") do
             manage_unit_file(:create)
@@ -64,7 +85,7 @@ class Chef
         end
       end
 
-      action :delete do
+      action :delete, description: "Delete a systemd unit file, if it exists." do
         if ::File.exist?(unit_path)
           converge_by("deleting unit: #{new_resource.unit_name}") do
             manage_unit_file(:delete)
@@ -73,24 +94,24 @@ class Chef
         end
       end
 
-      action :preset do
+      action :preset, description: "Restore the preset '`enable`/`disable`' configuration for a systemd unit. *New in #{ChefUtils::Dist::Infra::PRODUCT} 14.0.*" do
         converge_by("restoring enable/disable preset configuration for unit: #{new_resource.unit_name}") do
           systemctl_execute!(:preset, new_resource.unit_name)
         end
       end
 
-      action :revert do
+      action :revert, description: "Revert to a vendor's version of a systemd unit file. *New in #{ChefUtils::Dist::Infra::PRODUCT} 14.0.*" do
         converge_by("reverting to vendor version of unit: #{new_resource.unit_name}") do
           systemctl_execute!(:revert, new_resource.unit_name)
         end
       end
 
-      action :enable do
+      action :enable, description: "Ensure the unit will be started after the next system boot." do
         if current_resource.static
-          logger.trace("#{new_resource.unit_name} is a static unit, enabling is a NOP.")
+          logger.debug("#{new_resource.unit_name} is a static unit, enabling is a NOP.")
         end
         if current_resource.indirect
-          logger.trace("#{new_resource.unit_name} is an indirect unit, enabling is a NOP.")
+          logger.debug("#{new_resource.unit_name} is an indirect unit, enabling is a NOP.")
         end
 
         unless current_resource.enabled || current_resource.static || current_resource.indirect
@@ -101,13 +122,13 @@ class Chef
         end
       end
 
-      action :disable do
+      action :disable, description: "Ensure the unit will not be started after the next system boot." do
         if current_resource.static
-          logger.trace("#{new_resource.unit_name} is a static unit, disabling is a NOP.")
+          logger.debug("#{new_resource.unit_name} is a static unit, disabling is a NOP.")
         end
 
         if current_resource.indirect
-          logger.trace("#{new_resource.unit_name} is an indirect unit, enabling is a NOP.")
+          logger.debug("#{new_resource.unit_name} is an indirect unit, enabling is a NOP.")
         end
 
         if current_resource.enabled && !current_resource.static && !current_resource.indirect
@@ -118,14 +139,14 @@ class Chef
         end
       end
 
-      action :reenable do
+      action :reenable, description: "Reenable a unit file. *New in #{ChefUtils::Dist::Infra::PRODUCT} 14.0.*" do
         converge_by("reenabling unit: #{new_resource.unit_name}") do
           systemctl_execute!(:reenable, new_resource.unit_name)
           logger.info("#{new_resource} reenabled")
         end
       end
 
-      action :mask do
+      action :mask, description: "Ensure the unit will not start, even to satisfy dependencies." do
         unless current_resource.masked
           converge_by("masking unit: #{new_resource.unit_name}") do
             systemctl_execute!(:mask, new_resource.unit_name)
@@ -134,7 +155,7 @@ class Chef
         end
       end
 
-      action :unmask do
+      action :unmask, description: "Stop the unit from being masked and cause it to start as specified." do
         if current_resource.masked
           converge_by("unmasking unit: #{new_resource.unit_name}") do
             systemctl_execute!(:unmask, new_resource.unit_name)
@@ -143,7 +164,7 @@ class Chef
         end
       end
 
-      action :start do
+      action :start, description: "Start a systemd unit." do
         unless current_resource.active
           converge_by("starting unit: #{new_resource.unit_name}") do
             systemctl_execute!(:start, new_resource.unit_name, default_env: false)
@@ -152,7 +173,7 @@ class Chef
         end
       end
 
-      action :stop do
+      action :stop, description: "Stop a running systemd unit." do
         if current_resource.active
           converge_by("stopping unit: #{new_resource.unit_name}") do
             systemctl_execute!(:stop, new_resource.unit_name, default_env: false)
@@ -161,39 +182,39 @@ class Chef
         end
       end
 
-      action :restart do
+      action :restart, description: "Restart a systemd unit." do
         converge_by("restarting unit: #{new_resource.unit_name}") do
           systemctl_execute!(:restart, new_resource.unit_name, default_env: false)
           logger.info("#{new_resource} restarted")
         end
       end
 
-      action :reload do
+      action :reload, description: "Reload the configuration file for a systemd unit." do
         if current_resource.active
           converge_by("reloading unit: #{new_resource.unit_name}") do
             systemctl_execute!(:reload, new_resource.unit_name, default_env: false)
             logger.info("#{new_resource} reloaded")
           end
         else
-          logger.trace("#{new_resource.unit_name} is not active, skipping reload.")
+          logger.debug("#{new_resource.unit_name} is not active, skipping reload.")
         end
       end
 
-      action :try_restart do
+      action :try_restart, description: "Try to restart a systemd unit if the unit is running." do
         converge_by("try-restarting unit: #{new_resource.unit_name}") do
           systemctl_execute!("try-restart", new_resource.unit_name, default_env: false)
           logger.info("#{new_resource} try-restarted")
         end
       end
 
-      action :reload_or_restart do
+      action :reload_or_restart, description: "For systemd units that are services, this action reloads the configuration of the service without restarting, if possible; otherwise, it will restart the service so the new configuration is applied." do
         converge_by("reload-or-restarting unit: #{new_resource.unit_name}") do
           systemctl_execute!("reload-or-restart", new_resource.unit_name, default_env: false)
           logger.info("#{new_resource} reload-or-restarted")
         end
       end
 
-      action :reload_or_try_restart do
+      action :reload_or_try_restart, description: "For systemd units that are services, this action reloads the configuration of the service without restarting, if possible; otherwise, it will try to restart the service so the new configuration is applied." do
         converge_by("reload-or-try-restarting unit: #{new_resource.unit_name}") do
           systemctl_execute!("reload-or-try-restart", new_resource.unit_name, default_env: false)
           logger.info("#{new_resource} reload-or-try-restarted")
@@ -201,23 +222,29 @@ class Chef
       end
 
       def active?
-        systemctl_execute("is-active", new_resource.unit_name).exitstatus == 0
+        # Note: "activating" is not active (as with type=notify or a oneshot)
+        systemd_unit_status["ActiveState"] == "active"
       end
 
       def enabled?
-        systemctl_execute("is-enabled", new_resource.unit_name).exitstatus == 0
+        # See https://github.com/systemd/systemd/blob/master/src/systemctl/systemctl-is-enabled.c
+        # Note: enabled-runtime is excluded because this is volatile, and the state of enabled-runtime
+        # specifically means that the service is not enabled
+        %w{enabled static generated alias indirect}.include?(systemd_unit_status["UnitFileState"])
       end
 
       def masked?
-        systemctl_execute("status", new_resource.unit_name).stdout.include?("masked")
+        # Note: masked-runtime is excluded, because runtime is volatile, and
+        # because masked-runtime is not masked.
+        systemd_unit_status["UnitFileState"] == "masked"
       end
 
       def static?
-        systemctl_execute("is-enabled", new_resource.unit_name).stdout.include?("static")
+        systemd_unit_status["UnitFileState"] == "static"
       end
 
       def indirect?
-        systemctl_execute("is-enabled", new_resource.unit_name).stdout.include?("indirect")
+        systemd_unit_status["UnitFileState"] == "indirect"
       end
 
       private

data/lib/chef/provider/template/content.rb

@@ -29,9 +29,7 @@ class Chef
         include Chef::Mixin::Template
 
         def template_location
-          @template_file_cache_location ||= begin
-            template_finder.find(new_resource.source, local: new_resource.local, cookbook: new_resource.cookbook)
-          end
+          @template_file_cache_location ||= template_finder.find(new_resource.source, local: new_resource.local, cookbook: new_resource.cookbook)
         end
 
         private
@@ -84,9 +82,7 @@ class Chef
         end
 
         def template_finder
-          @template_finder ||= begin
-            TemplateFinder.new(run_context, new_resource.cookbook_name, run_context.node)
-          end
+          @template_finder ||= TemplateFinder.new(run_context, new_resource.cookbook_name, run_context.node)
         end
       end
     end

data/lib/chef/provider/template.rb

@@ -39,7 +39,7 @@ class Chef
         super
 
         requirements.assert(:create, :create_if_missing) do |a|
-          a.assertion { ::File.exists?(content.template_location) }
+          a.assertion { ::File.exist?(content.template_location) }
           a.failure_message "Template source #{content.template_location} could not be found."
           a.whyrun "Template source #{content.template_location} does not exist. Assuming it would have been created."
           a.block_action!

data/lib/chef/provider/user/dscl.rb

@@ -438,7 +438,7 @@ in 'password', with the associated 'salt' and 'iterations'.")
         #
         def locked?
           if authentication_authority
-            !!(authentication_authority =~ /DisabledUser/ )
+            !!(authentication_authority.include?("DisabledUser"))
           else
             false
           end

data/lib/chef/provider/user/mac.rb

@@ -28,14 +28,13 @@ class Chef
   class Provider
     class User
       # A macOS user provider that is compatible with default TCC restrictions
-      # in macOS 10.14. See resource/user/mac_user.rb for complete description
-      # of the mac_user resource and how it differs from the dscl resource used
-      # on previous platforms.
+      # in macOS 10.14+. See resource/user/mac_user.rb for complete description
+      # of the mac_user resource
       class MacUser < Chef::Provider::User
         include Chef::Mixin::Which
 
         provides :mac_user
-        provides :user, os: "darwin", platform_version: ">= 10.14"
+        provides :user, os: "darwin"
 
         attr_reader :user_plist, :admin_group_plist
 
@@ -50,11 +49,11 @@ class Chef
             current_resource.uid(user_plist[:uid][0])
             current_resource.gid(user_plist[:gid][0])
             current_resource.home(user_plist[:home][0])
-            current_resource.shell(user_plist[:shell][0])
+            current_resource.shell(user_plist[:shell]&.first) # use &.first since shell can be nil
             current_resource.comment(user_plist[:comment][0])
 
             if user_plist[:is_hidden]
-              current_resource.hidden(user_plist[:is_hidden][0] == "1" ? true : false)
+              current_resource.hidden(user_plist[:is_hidden]&.first == "1" ? true : false) # when not hidden the value seems to be nil so &.first to handle that
             end
 
             shadow_hash = user_plist[:shadow_hash]
@@ -340,7 +339,7 @@ class Chef
         end
 
         def locked?
-          user_plist[:auth_authority].any? { |tag| tag == ";DisabledUser;" }
+          user_plist[:auth_authority].any?(";DisabledUser;")
         rescue
           false
         end
@@ -394,27 +393,25 @@ class Chef
         # associated group resource. If a group exists we'll modify it, otherwise
         # create it.
         def user_group_info
-          @user_group_info ||= begin
-            if new_resource.gid.is_a?(String)
-              begin
-                g = Etc.getgrnam(new_resource.gid)
-                [g.name, g.gid.to_s, :modify]
-              rescue
-                [new_resource.gid, nil, :create]
-              end
-            else
-              begin
-                g = Etc.getgrgid(new_resource.gid)
-                [g.name, g.gid.to_s, :modify]
-              rescue
-                [g.username, nil, :create]
-              end
-            end
-          end
+          @user_group_info ||= if new_resource.gid.is_a?(String)
+                                 begin
+                                   g = Etc.getgrnam(new_resource.gid)
+                                   [g.name, g.gid.to_s, :modify]
+                                 rescue
+                                   [new_resource.gid, nil, :create]
+                                 end
+                               else
+                                 begin
+                                   g = Etc.getgrgid(new_resource.gid)
+                                   [g.name, g.gid.to_s, :modify]
+                                 rescue
+                                   [g.username, nil, :create]
+                                 end
+                               end
         end
 
         def secure_token_enabled?
-          user_plist[:auth_authority].any? { |tag| tag == ";SecureToken;" }
+          user_plist[:auth_authority].any?(";SecureToken;")
         rescue
           false
         end
@@ -508,7 +505,7 @@ class Chef
         end
 
         def admin_user?
-          admin_group_plist[:group_members].any? { |mem| mem == user_plist[:guid][0] }
+          admin_group_plist[:group_members].any?(user_plist[:guid][0])
         rescue
           false
         end

data/lib/chef/provider/user/pw.rb

@@ -97,7 +97,7 @@ class Chef
             command = "pw usermod #{new_resource.username} -H 0"
             shell_out!(command, input: new_resource.password.to_s)
           else
-            logger.trace("#{new_resource} no change needed to password")
+            logger.debug("#{new_resource} no change needed to password")
           end
         end
       end

data/lib/chef/provider/user/windows.rb

@@ -62,7 +62,7 @@ class Chef
         # <false>:: If the users are identical
         def compare_user
           @change_desc = []
-          unless @net_user.validate_credentials(new_resource.password)
+          if new_resource.password && !@net_user.validate_credentials(new_resource.password)
             @change_desc << "update password"
           end
 
@@ -78,11 +78,11 @@ class Chef
         end
 
         def create_user
-          @net_user.add(set_options)
+          @net_user.add(**set_options)
         end
 
         def manage_user
-          @net_user.update(set_options)
+          @net_user.update(**set_options)
         end
 
         def remove_user

data/lib/chef/provider/user.rb

@@ -117,7 +117,11 @@ class Chef
           new_val = new_resource.send(user_attrib)
           cur_val = current_resource.send(user_attrib)
           if !new_val.nil? && new_val.to_s != cur_val.to_s
-            @change_desc << "change #{user_attrib} from #{cur_val} to #{new_val}"
+            if user_attrib.to_s == "password" && new_resource.sensitive
+              @change_desc << "change #{user_attrib} from ******** to ********"
+            else
+              @change_desc << "change #{user_attrib} from #{cur_val} to #{new_val}"
+            end
           end
         end
 
@@ -172,7 +176,7 @@ class Chef
             logger.info("#{new_resource} locked")
           end
         else
-          logger.trace("#{new_resource} already locked - nothing to do")
+          logger.debug("#{new_resource} already locked - nothing to do")
         end
       end
 
@@ -183,7 +187,7 @@ class Chef
             logger.info("#{new_resource} unlocked")
           end
         else
-          logger.trace("#{new_resource} already unlocked - nothing to do")
+          logger.debug("#{new_resource} already unlocked - nothing to do")
         end
       end
 

data/lib/chef/provider/windows_script.rb

@@ -83,7 +83,7 @@ class Chef
         username = new_resource.user
 
         if new_resource.domain
-          username = new_resource.domain + '\\' + new_resource.user
+          username = new_resource.domain + "\\" + new_resource.user
         end
 
         # Create an ACE that allows the alternate user read access to the script

data/lib/chef/provider/yum_repository.rb

@@ -17,7 +17,6 @@
 #
 
 require_relative "../resource"
-require_relative "../dsl/declare_resource"
 require_relative "../mixin/which"
 require_relative "noop"
 
@@ -32,8 +31,8 @@ class Chef
 
       def load_current_resource; end
 
-      action :create do
-        declare_resource(:template, ::File.join(new_resource.reposdir, "#{new_resource.repositoryid}.repo")) do
+      action :create, description: "Create a repository based on the properties." do
+        template ::File.join(new_resource.reposdir, "#{new_resource.repositoryid}.repo") do
           if template_available?(new_resource.source)
             source new_resource.source
           else
@@ -46,72 +45,57 @@ class Chef
           if new_resource.make_cache
             notifies :run, "execute[yum clean metadata #{new_resource.repositoryid}]", :immediately if new_resource.clean_metadata || new_resource.clean_headers
             notifies :run, "execute[yum-makecache-#{new_resource.repositoryid}]", :immediately
-            notifies :create, "ruby_block[package-cache-reload-#{new_resource.repositoryid}]", :immediately
+            notifies :flush_cache, "package[package-cache-reload-#{new_resource.repositoryid}]", :immediately
           end
         end
 
-        declare_resource(:execute, "yum clean metadata #{new_resource.repositoryid}") do
-          command "yum clean metadata --disablerepo=* --enablerepo=#{new_resource.repositoryid}"
-          action :nothing
-        end
+        # avoid extra logging if make_cache property isn't set
+        if new_resource.make_cache
+          execute "yum clean metadata #{new_resource.repositoryid}" do
+            command "yum clean metadata --disablerepo=* --enablerepo=#{new_resource.repositoryid}"
+            action :nothing
+          end
 
-        # get the metadata for this repo only
-        declare_resource(:execute, "yum-makecache-#{new_resource.repositoryid}") do
-          command "yum -q -y makecache --disablerepo=* --enablerepo=#{new_resource.repositoryid}"
-          action :nothing
-          only_if { new_resource.enabled }
-        end
+          # get the metadata for this repo only
+          execute "yum-makecache-#{new_resource.repositoryid}" do
+            command "yum -q -y makecache --disablerepo=* --enablerepo=#{new_resource.repositoryid}"
+            action :nothing
+            only_if { new_resource.enabled }
+          end
 
-        # reload internal Chef yum/dnf cache
-        declare_resource(:ruby_block, "package-cache-reload-#{new_resource.repositoryid}") do
-          if ( platform?("fedora") && node["platform_version"].to_i >= 22 ) ||
-              ( platform_family?("rhel") && node["platform_version"].to_i >= 8 )
-            block { Chef::Provider::Package::Dnf::PythonHelper.instance.restart }
-          else
-            block { Chef::Provider::Package::Yum::YumCache.instance.reload }
+          package "package-cache-reload-#{new_resource.repositoryid}" do
+            action :nothing
           end
-          action :nothing
         end
       end
 
-      action :delete do
+      action :delete, description: "Remove a repository." do
         # clean the repo cache first
-        declare_resource(:execute, "yum clean all #{new_resource.repositoryid}") do
+        execute "yum clean all #{new_resource.repositoryid}" do
           command "yum clean all --disablerepo=* --enablerepo=#{new_resource.repositoryid}"
           only_if "yum repolist all | grep -P '^#{new_resource.repositoryid}([ \t]|$)'"
         end
 
-        declare_resource(:file, ::File.join(new_resource.reposdir, "#{new_resource.repositoryid}.repo")) do
+        file ::File.join(new_resource.reposdir, "#{new_resource.repositoryid}.repo") do
           action :delete
-          notifies :create, "ruby_block[package-cache-reload-#{new_resource.repositoryid}]", :immediately
+          notifies :flush_cache, "package[package-cache-reload-#{new_resource.repositoryid}]", :immediately
         end
 
-        declare_resource(:ruby_block, "package-cache-reload-#{new_resource.repositoryid}") do
-          if ( platform?("fedora") && node["platform_version"].to_i >= 22 ) ||
-              ( platform_family?("rhel") && node["platform_version"].to_i >= 8 )
-            block { Chef::Provider::Package::Dnf::PythonHelper.instance.restart }
-          else
-            block { Chef::Provider::Package::Yum::YumCache.instance.reload }
-          end
+        package "package-cache-reload-#{new_resource.repositoryid}" do
           action :nothing
         end
       end
 
-      action :makecache do
-        declare_resource(:execute, "yum-makecache-#{new_resource.repositoryid}") do
+      action :makecache, description: "Force the creation of the repository cache. This is also done automatically when a repository is updated." do
+        execute "yum-makecache-#{new_resource.repositoryid}" do
           command "yum -q -y makecache --disablerepo=* --enablerepo=#{new_resource.repositoryid}"
           action :run
           only_if { new_resource.enabled }
+          notifies :flush_cache, "package[package-cache-reload-#{new_resource.repositoryid}]", :immediately
         end
 
-        declare_resource(:ruby_block, "package-cache-reload-#{new_resource.repositoryid}") do
-          if ( platform?("fedora") && node["platform_version"].to_i >= 22 ) ||
-              ( platform_family?("rhel") && node["platform_version"].to_i >= 8 )
-            block { Chef::Provider::Package::Dnf::PythonHelper.instance.restart }
-          else
-            block { Chef::Provider::Package::Yum::YumCache.instance.reload }
-          end
-          action :run
+        package "package-cache-reload-#{new_resource.repositoryid}" do
+          action :nothing
         end
       end