chef 16.18.30 → 17.10.163

data/lib/chef/resource/homebrew_update.rb

@@ -88,7 +88,7 @@ class Chef
         end
       end
 
-      action :periodic do
+      action :periodic, description: "Run a periodic update based on the frequency property." do
         return unless macos?
 
         unless brew_up_to_date?
@@ -98,7 +98,7 @@ class Chef
         end
       end
 
-      action :update do
+      action :update, description: "Run an immediate update." do
         return unless macos?
 
         converge_by "force update new lists of packages" do

data/lib/chef/resource/hostname.rb

@@ -44,12 +44,34 @@ class Chef
           ipaddress '198.51.100.2'
         end
         ```
+
+        **Change the hostname of a Windows, Non-Domain joined node**:
+
+        ```ruby
+        hostname 'renaming a workgroup computer' do
+          hostname 'Foo'
+        end
+        ```
+
+        **Change the hostname of a Windows, Domain-joined node (new in 17.2)**:
+
+        ```ruby
+        hostname 'renaming a domain-joined computer' do
+          hostname 'Foo'
+          domain_user "Domain\\Someone"
+          domain_password 'SomePassword'
+        end
+        ```
       DOC
 
       property :hostname, String,
         description: "An optional property to set the hostname if it differs from the resource block's name.",
         name_property: true
 
+      property :fqdn, String,
+        description: "An optional property to set the fqdn if it differs from the resource block's hostname.",
+        introduced: "17.0"
+
       property :ipaddress, String,
         description: "The IP address to use when configuring the hosts file.",
         default: lazy { node["ipaddress"] }, default_description: "The node's IP address as determined by Ohai."
@@ -67,6 +89,15 @@ class Chef
         description: "Determines whether or not Windows should be reboot after changing the hostname, as this is required for the change to take effect.",
         default: true
 
+      property :domain_user, String,
+        description: "A domain account specified in the form of DOMAIN\\user used when renaming a domain-joined device",
+        introduced: "17.2"
+
+      property :domain_password, String,
+        description: "The password to accompany the domain_user parameter",
+        sensitive: true,
+        introduced: "17.2"
+
       action_class do
         def append_replacing_matching_lines(path, regex, string)
           text = IO.read(path).split("\n")
@@ -99,9 +130,11 @@ class Chef
         end
       end
 
-      action :set do
-        description "Sets the node's hostname."
+      def is_domain_joined?
+        powershell_exec!("(Get-CIMInstance -Class Win32_ComputerSystem).PartofDomain").result
+      end
 
+      action :set, description: "Sets the node's hostname." do
         if !windows?
           ohai "reload hostname" do
             plugin "hostname"
@@ -109,7 +142,7 @@ class Chef
           end
 
           # set the hostname via /bin/hostname
-          declare_resource(:execute, "set hostname to #{new_resource.hostname}") do
+          execute "set hostname to #{new_resource.hostname}" do
             command "/bin/hostname #{new_resource.hostname}"
             not_if { shell_out!("hostname").stdout.chomp == new_resource.hostname }
             notifies :reload, "ohai[reload hostname]"
@@ -117,7 +150,9 @@ class Chef
 
           # make sure node['fqdn'] resolves via /etc/hosts
           unless new_resource.ipaddress.nil?
-            newline = "#{new_resource.ipaddress} #{new_resource.hostname}"
+            newline = "#{new_resource.ipaddress}"
+            newline << " #{new_resource.fqdn}" unless new_resource.fqdn.to_s.empty?
+            newline << " #{new_resource.hostname}"
             newline << " #{new_resource.aliases.join(" ")}" if new_resource.aliases && !new_resource.aliases.empty?
             newline << " #{new_resource.hostname[/[^\.]*/]}"
             r = append_replacing_matching_lines("/etc/hosts", /^#{new_resource.ipaddress}\s+|\s+#{new_resource.hostname}\s+/, newline)
@@ -127,20 +162,20 @@ class Chef
 
           # setup the hostname to persist on a reboot
           case
-          when ::File.exist?("/usr/sbin/scutil")
+          when darwin?
             # darwin
-            declare_resource(:execute, "set HostName via scutil") do
+            execute "set HostName via scutil" do
               command "/usr/sbin/scutil --set HostName #{new_resource.hostname}"
               not_if { shell_out("/usr/sbin/scutil --get HostName").stdout.chomp == new_resource.hostname }
               notifies :reload, "ohai[reload hostname]"
             end
-            declare_resource(:execute, "set ComputerName via scutil") do
+            execute "set ComputerName via scutil" do
               command "/usr/sbin/scutil --set ComputerName  #{new_resource.hostname}"
               not_if { shell_out("/usr/sbin/scutil --get ComputerName").stdout.chomp == new_resource.hostname }
               notifies :reload, "ohai[reload hostname]"
             end
             shortname = new_resource.hostname[/[^\.]*/]
-            declare_resource(:execute, "set LocalHostName via scutil") do
+            execute "set LocalHostName via scutil" do
               command "/usr/sbin/scutil --set LocalHostName #{shortname}"
               not_if { shell_out("/usr/sbin/scutil --get LocalHostName").stdout.chomp == shortname }
               notifies :reload, "ohai[reload hostname]"
@@ -150,7 +185,7 @@ class Chef
             when ::File.exist?("/usr/bin/hostnamectl") && !docker?
               # use hostnamectl whenever we find it on linux (as systemd takes over the world)
               # this must come before other methods like /etc/hostname and /etc/sysconfig/network
-              declare_resource(:execute, "hostnamectl set-hostname #{new_resource.hostname}") do
+              execute "hostnamectl set-hostname #{new_resource.hostname}" do
                 notifies :reload, "ohai[reload hostname]"
                 not_if { shell_out!("hostnamectl status", returns: [0, 1]).stdout =~ /Static hostname:\s*#{new_resource.hostname}\s*$/ }
               end
@@ -160,7 +195,7 @@ class Chef
               # the "platform: iox_xr, platform_family: wrlinux, os: linux" platform also hits this
               # the "platform: nexus, platform_family: wrlinux, os: linux" platform also hits this
               # this is also fallback for any linux systemd host in a docker container (where /usr/bin/hostnamectl will fail)
-              declare_resource(:file, "/etc/hostname") do
+              file "/etc/hostname" do
                 atomic_update false if docker?
                 content "#{new_resource.hostname}\n"
                 owner "root"
@@ -172,7 +207,7 @@ class Chef
               append_replacing_matching_lines("/etc/sysconfig/network", /^HOSTNAME\s*=/, "HOSTNAME=#{new_resource.hostname}")
             when ::File.exist?("/etc/HOSTNAME")
               # SuSE/openSUSE uses /etc/HOSTNAME
-              declare_resource(:file, "/etc/HOSTNAME") do
+              file "/etc/HOSTNAME" do
                 content "#{new_resource.hostname}\n"
                 owner "root"
                 group node["root_group"]
@@ -180,7 +215,7 @@ class Chef
               end
             when ::File.exist?("/etc/conf.d/hostname")
               # Gentoo
-              declare_resource(:file, "/etc/conf.d/hostname") do
+              file "/etc/conf.d/hostname" do
                 content "hostname=\"#{new_resource.hostname}\"\n"
                 owner "root"
                 group node["root_group"]
@@ -196,23 +231,23 @@ class Chef
             # *BSD systems with /etc/rc.conf + /etc/myname
             append_replacing_matching_lines("/etc/rc.conf", /^\s+hostname\s+=/, "hostname=#{new_resource.hostname}")
 
-            declare_resource(:file, "/etc/myname") do
+            file "/etc/myname" do
               content "#{new_resource.hostname}\n"
               owner "root"
               group node["root_group"]
               mode "0644"
             end
           when ::File.exist?("/usr/sbin/svccfg") # solaris 5.11
-            declare_resource(:execute, "svccfg -s system/identity:node setprop config/nodename=\'#{new_resource.hostname}\'") do
+            execute "svccfg -s system/identity:node setprop config/nodename=\'#{new_resource.hostname}\'" do
               notifies :run, "execute[svcadm refresh]", :immediately
               notifies :run, "execute[svcadm restart]", :immediately
               not_if { shell_out!("svccfg -s system/identity:node listprop config/nodename").stdout.chomp =~ %r{config/nodename\s+astring\s+#{new_resource.hostname}} }
             end
-            declare_resource(:execute, "svcadm refresh") do
+            execute "svcadm refresh" do
               command "svcadm refresh system/identity:node"
               action :nothing
             end
-            declare_resource(:execute, "svcadm restart") do
+            execute "svcadm restart" do
               command "svcadm restart system/identity:node"
               action :nothing
             end
@@ -239,13 +274,24 @@ class Chef
           end
 
           unless Socket.gethostbyname(Socket.gethostname).first == new_resource.hostname
-            converge_by "set hostname to #{new_resource.hostname}" do
-              powershell_exec! <<~EOH
-                $sysInfo = Get-WmiObject -Class Win32_ComputerSystem
-                $sysInfo.Rename("#{new_resource.hostname}")
-              EOH
+            if is_domain_joined?
+              if new_resource.domain_user.nil? || new_resource.domain_password.nil?
+                raise "The `domain_user` and `domain_password` properties are required to change the hostname of a domain-connected Windows system."
+              else
+                converge_by "set hostname to #{new_resource.hostname}" do
+                  powershell_exec! <<~EOH
+                    $user = #{new_resource.domain_user}
+                    $secure_password = #{new_resource.domain_password} | Convertto-SecureString -AsPlainText -Force
+                    $Credentials = New-Object System.Management.Automation.PSCredential -Argumentlist ($user, $secure_password)
+                    Rename-Computer -NewName #{new_resource.hostname} -DomainCredential $Credentials
+                  EOH
+                end
+              end
+            else
+              converge_by "set hostname to #{new_resource.hostname}" do
+                powershell_exec!("Rename-Computer -NewName #{new_resource.hostname}")
+              end
             end
-
             # reboot because $windows
             reboot "setting hostname" do
               reason "#{ChefUtils::Dist::Infra::PRODUCT} updated system hostname"

data/lib/chef/resource/http_request.rb

@@ -34,7 +34,7 @@ class Chef
       property :url, String, identity: true,
                description: "The URL to which an HTTP request is sent."
 
-      property :headers, Hash, default: lazy { {} },
+      property :headers, Hash, default: {},
                description: "A Hash of custom headers."
 
       def initialize(name, run_context = nil)

data/lib/chef/resource/inspec_input.rb

@@ -0,0 +1,127 @@
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class InspecInput < Chef::Resource
+      provides :inspec_input
+      unified_mode true
+
+      description "Use the **inspec_input** resource to add an input to the Compliance Phase."
+      introduced "17.5"
+      examples <<~DOC
+
+      **Activate the default input in the openssh cookbook's compliance segment**:
+
+      ```ruby
+        inspec_input 'openssh' do
+          action :add
+        end
+      ```
+
+      **Activate all inputs in the openssh cookbook's compliance segment**:
+
+      ```ruby
+        inspec_input 'openssh::.*' do
+          action :add
+        end
+      ```
+
+      **Add an InSpec input to the Compliance Phase from a hash**:
+
+      ```ruby
+        inspec_input { ssh_custom_path: '/whatever2' }
+      ```
+
+      **Add an InSpec input to the Compliance Phase using the 'name' property to identify the input**:
+
+      ```ruby
+        inspec_input "setting my input" do
+          source( { ssh_custom_path: '/whatever2' })
+        end
+      ```
+
+      **Add an InSpec input to the Compliance Phase using a TOML, JSON, or YAML file**:
+
+      ```ruby
+        inspec_input "/path/to/my/input.yml"
+      ```
+
+      **Add an InSpec input to the Compliance Phase using a TOML, JSON, or YAML file, using the 'name' property**:
+
+      ```ruby
+        inspec_input "setting my input" do
+          source "/path/to/my/input.yml"
+        end
+      ```
+
+      Note that the **inspec_input** resource does not update and will not fire notifications (similar to the log resource). This is done to preserve the ability to use
+      the resource while not causing the updated resource count to be larger than zero. Since the resource does not update the state of the managed node, this behavior
+      is still consistent with the configuration management model. Instead, you should use events to observe configuration changes for the compliance phase. It is
+      possible to use the `notify_group` resource to chain notifications of the two resources, but notifications are the wrong model to use, and you should use pure ruby
+      conditionals instead. Compliance configuration should be independent of other resources and should only be conditional based on state/attributes, not other resources.
+      DOC
+
+      property :name, [ Hash, String ]
+
+      property :input, [ Hash, String ],
+        name_property: true
+
+      property :source, [ Hash, String ],
+        name_property: true
+
+      action :add, description: "Add an input to the compliance phase" do
+        if run_context.input_collection.valid?(new_resource.input)
+          include_input(new_resource.input)
+        else
+          include_input(input_hash)
+        end
+      end
+
+      action_class do
+        # If the source is nil and the input / name_property contains a file separator and is a string of a
+        # file that exists, then use that as the file (similar to the package provider automatic source property).  Otherwise
+        # just return the source.
+        #
+        # @api private
+        def source
+          @source ||= build_source
+        end
+
+        def build_source
+          return new_resource.source unless new_resource.source.nil?
+          return nil unless new_resource.input.count(::File::SEPARATOR) > 0 || (::File::ALT_SEPARATOR && new_resource.input.count(::File::ALT_SEPARATOR) > 0 )
+          return nil unless ::File.exist?(new_resource.input)
+
+          new_resource.input
+        end
+
+        def input_hash
+          case source
+          when Hash
+            source
+          when String
+            parse_file(source)
+          when nil
+            raise Chef::Exceptions::ValidationFailed, "Could not find the input #{new_resource.input} in any cookbook segment."
+          end
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/inspec_waiver.rb

@@ -0,0 +1,184 @@
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class InspecWaiver < Chef::Resource
+      provides :inspec_waiver
+      unified_mode true
+
+      description "Use the **inspec_waiver** resource to add a waiver to the Compliance Phase."
+      introduced "17.5"
+      examples <<~DOC
+      **Activate the default waiver in the openssh cookbook's compliance segment**:
+
+      ```ruby
+        inspec_waiver 'openssh' do
+          action :add
+        end
+      ```
+
+      **Activate all waivers in the openssh cookbook's compliance segment**:
+
+      ```ruby
+        inspec_waiver 'openssh::.*' do
+          action :add
+        end
+      ```
+
+      **Add an InSpec waiver to the Compliance Phase**:
+
+      ```ruby
+        inspec_waiver 'Add waiver entry for control' do
+          control 'my_inspec_control_01'
+          run_test false
+          justification "The subject of this control is not managed by #{ChefUtils::Dist::Infra::PRODUCT} on the systems in policy group \#{node['policy_group']}"
+          expiration '2022-01-01'
+          action :add
+        end
+      ```
+
+      **Add an InSpec waiver to the Compliance Phase using the 'name' property to identify the control**:
+
+      ```ruby
+        inspec_waiver 'my_inspec_control_01' do
+          justification "The subject of this control is not managed by #{ChefUtils::Dist::Infra::PRODUCT} on the systems in policy group \#{node['policy_group']}"
+          action :add
+        end
+      ```
+
+      **Add an InSpec waiver to the Compliance Phase using an arbitrary YAML, JSON, or TOML file**:
+
+      ```ruby
+        # files ending in .yml or .yaml that exist are parsed as YAML
+        inspec_waiver "/path/to/my/waiver.yml"
+
+        inspec_waiver "my-waiver-name" do
+          source "/path/to/my/waiver.yml"
+        end
+
+        # files ending in .json that exist are parsed as JSON
+        inspec_waiver "/path/to/my/waiver.json"
+
+        inspec_waiver "my-waiver-name" do
+          source "/path/to/my/waiver.json"
+        end
+
+        # files ending in .toml that exist are parsed as TOML
+        inspec_waiver "/path/to/my/waiver.toml"
+
+        inspec_waiver "my-waiver-name" do
+          source "/path/to/my/waiver.toml"
+        end
+      ```
+
+      **Add an InSpec waiver to the Compliance Phase using a hash**:
+
+      ```ruby
+        my_hash = { "ssh-01" => {
+          "expiration_date" => "2033-07-31",
+          "run" => false,
+          "justification" => "because"
+        } }
+
+        inspec_waiver "my-waiver-name" do
+          source my_hash
+        end
+      ```
+
+      Note that the **inspec_waiver** resource does not update and will not fire notifications (similar to the log resource). This is done to preserve the ability to use
+      the resource while not causing the updated resource count to be larger than zero. Since the resource does not update the state of the managed node, this behavior
+      is still consistent with the configuration management model. Instead, you should use events to observe configuration changes for the compliance phase. It is
+      possible to use the `notify_group` resource to chain notifications of the two resources, but notifications are the wrong model to use, and you should use pure ruby
+      conditionals instead. Compliance configuration should be independent of other resources and should only be conditional based on state/attributes, not other resources.
+      DOC
+
+      property :control, String,
+        name_property: true,
+        description: "The name of the control being waived"
+
+      property :expiration, String,
+        description: "The expiration date of the waiver - provided in YYYY-MM-DD format",
+        callbacks: {
+          "Expiration date should be a valid calendar date and match the following format: YYYY-MM-DD" => proc { |e|
+            re = Regexp.new("\\d{4}-\\d{2}-\\d{2}$").freeze
+            if re.match?(e)
+              Date.valid_date?(*e.split("-").map(&:to_i))
+            else
+              e.nil?
+            end
+          },
+        }
+
+      property :run_test, [true, false],
+        description: "If present and true, the control will run and be reported, but failures in it won’t make the overall run fail. If absent or false, the control will not be run."
+
+      property :justification, String,
+        description: "Can be any text you want and might include a reason for the waiver as well as who signed off on the waiver."
+
+      property :source, [ Hash, String ]
+
+      action :add, description: "Add a waiver to the compliance phase" do
+        if run_context.waiver_collection.valid?(new_resource.control)
+          include_waiver(new_resource.control)
+        else
+          include_waiver(waiver_hash)
+        end
+      end
+
+      action_class do
+        # If the source is nil and the control / name_property contains a file separator and is a string of a
+        # file that exists, then use that as the file (similar to the package provider automatic source property).  Otherwise
+        # just return the source.
+        #
+        # @api private
+        def source
+          @source ||= build_source
+        end
+
+        def build_source
+          return new_resource.source unless new_resource.source.nil?
+          return nil unless new_resource.control.count(::File::SEPARATOR) > 0 || (::File::ALT_SEPARATOR && new_resource.control.count(::File::ALT_SEPARATOR) > 0 )
+          return nil unless ::File.exist?(new_resource.control)
+
+          new_resource.control
+        end
+
+        def waiver_hash
+          case source
+          when Hash
+            source
+          when String
+            parse_file(source)
+          when nil
+            if new_resource.justification.nil? || new_resource.justification == ""
+              raise Chef::Exceptions::ValidationFailed, "Entries for an InSpec waiver must have a justification given, this parameter must have a value."
+            end
+
+            control_hash = {}
+            control_hash["expiration_date"] = new_resource.expiration.to_s unless new_resource.expiration.nil?
+            control_hash["run"] = new_resource.run_test unless new_resource.run_test.nil?
+            control_hash["justification"] = new_resource.justification.to_s
+
+            { new_resource.control => control_hash }
+          end
+        end
+      end
+    end
+  end
+end