chef 16.18.30 → 17.10.163

data/lib/chef/compliance/waiver.rb

@@ -0,0 +1,115 @@
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "yaml"
+
+class Chef
+  module Compliance
+    #
+    # Chef object that represents a single waiver file in the compliance
+    # segment of a cookbook
+    #
+    class Waiver
+      # @return [Boolean] if the waiver has been enabled
+      attr_reader :enabled
+
+      # @return [String] The name of the cookbook that the waiver is in
+      attr_reader :cookbook_name
+
+      # @return [String] The full path on the host to the waiver yml file
+      attr_reader :path
+
+      # @return [String] the pathname in the cookbook
+      attr_reader :pathname
+
+      # @api private
+      attr_reader :data
+
+      # Event dispatcher for this run.
+      #
+      # @return [Chef::EventDispatch::Dispatcher]
+      #
+      attr_accessor :events
+
+      def initialize(events, data, path, cookbook_name)
+        @events = events
+        @data = data
+        @cookbook_name = cookbook_name
+        @path = path
+        @pathname = File.basename(path, File.extname(path)) unless path.nil?
+        disable!
+      end
+
+      # @return [Boolean] if the waiver has been enabled
+      #
+      def enabled?
+        !!@enabled
+      end
+
+      # Set the waiver to being enabled
+      #
+      def enable!
+        events.compliance_waiver_enabled(self)
+        @enabled = true
+      end
+
+      # Set the waiver as being disabled
+      #
+      def disable!
+        @enabled = false
+      end
+
+      # Render the waiver in a way that it can be consumed by inspec
+      #
+      def inspec_data
+        data
+      end
+
+      HIDDEN_IVARS = [ :@events ].freeze
+
+      # Omit the event object from error output
+      #
+      def inspect
+        ivar_string = (instance_variables.map(&:to_sym) - HIDDEN_IVARS).map do |ivar|
+          "#{ivar}=#{instance_variable_get(ivar).inspect}"
+        end.join(", ")
+        "#<#{self.class}:#{object_id} #{ivar_string}>"
+      end
+
+      # Helper to construct a waiver object from a hash.  Since the path and
+      # cookbook_name are required this is probably not externally useful.
+      #
+      def self.from_hash(events, hash, path = nil, cookbook_name = nil)
+        new(events, hash, path, cookbook_name)
+      end
+
+      # Helper to construct a waiver object from a yaml string.  Since the path
+      # and cookbook_name are required this is probably not externally useful.
+      #
+      def self.from_yaml(events, string, path = nil, cookbook_name = nil)
+        from_hash(events, YAML.load(string), path, cookbook_name)
+      end
+
+      # @param filename [String] full path to the yml file in the cookbook
+      # @param cookbook_name [String] cookbook that the waiver is in
+      #
+      def self.from_file(events, filename, cookbook_name = nil)
+        from_yaml(events, IO.read(filename), filename, cookbook_name)
+      end
+    end
+  end
+end

data/lib/chef/compliance/waiver_collection.rb

@@ -0,0 +1,143 @@
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "waiver"
+
+class Chef
+  module Compliance
+    class WaiverCollection < Array
+
+      # Event dispatcher for this run.
+      #
+      # @return [Chef::EventDispatch::Dispatcher]
+      #
+      attr_reader :events
+
+      def initialize(events)
+        @events = events
+      end
+
+      # Add a waiver to the waiver collection.  The cookbook_name needs to be determined by the
+      # caller and is used in the `include_waiver` API to match on.  The path should be the complete
+      # path on the host of the yml file, including the filename.
+      #
+      # @param path [String]
+      # @param cookbook_name [String]
+      #
+      def from_file(filename, cookbook_name)
+        new_waiver = Waiver.from_file(events, filename, cookbook_name)
+        self << new_waiver
+        events&.compliance_waiver_loaded(new_waiver)
+      end
+
+      # Add a waiver from a raw hash.  This waiver will be enabled by default.
+      #
+      # @param path [String]
+      # @param cookbook_name [String]
+      #
+      def from_hash(hash)
+        new_waiver = Waiver.from_hash(events, hash)
+        new_waiver.enable!
+        self << new_waiver
+      end
+
+      # @return [Array<Waiver>] inspec waivers which are enabled in a form suitable to pass to inspec
+      #
+      def inspec_data
+        select(&:enabled?).each_with_object({}) { |waiver, hash| hash.merge!(waiver.inspec_data) }
+      end
+
+      # DSL method to enable waiver files.  This matches on the filename of the waiver file.
+      # If the specific waiver is omitted then it uses the default waiver. The string
+      # supports regular expression matching.
+      #
+      # @example Specific waiver file in a cookbook
+      #
+      # include_waiver "acme_cookbook::ssh-001"
+      #
+      # @example The compliance/waiver/default.rb waiver file in a cookbook
+      #
+      # include_waiver "acme_cookbook"
+      #
+      # @example Every waiver file in a cookbook
+      #
+      # include_waiver "acme_cookbook::.*"
+      #
+      # @example Matching waivers by regexp in a cookbook
+      #
+      # include_waiver "acme_cookbook::ssh.*"
+      #
+      # @example Matching waivers by regexp in any cookbook in the cookbook collection
+      #
+      # include_waiver ".*::ssh.*"
+      #
+      # @example Adding an arbitrary hash of data (not from any file in a cookbook)
+      #
+      # include_waiver({ "ssh-01" => {
+      #   "expiration_date" => "2033-07-31",
+      #   "run" => false,
+      #   "justification" => "the reason it is waived",
+      # } })
+      #
+      def include_waiver(arg)
+        raise "include_waiver was given a nil value" if arg.nil?
+
+        # if we're given a hash argument just shove it in the collection
+        if arg.is_a?(Hash)
+          from_hash(arg)
+          return
+        end
+
+        matching_waivers!(arg).each(&:enable!)
+      end
+
+      def valid?(arg)
+        !matching_waivers(arg).empty?
+      end
+
+      HIDDEN_IVARS = [ :@events ].freeze
+
+      # Omit the event object from error output
+      #
+      def inspect
+        ivar_string = (instance_variables.map(&:to_sym) - HIDDEN_IVARS).map do |ivar|
+          "#{ivar}=#{instance_variable_get(ivar).inspect}"
+        end.join(", ")
+        "#<#{self.class}:#{object_id} #{ivar_string}>"
+      end
+
+      private
+
+      def matching_waivers(arg, should_raise: false)
+        (cookbook_name, waiver_name) = arg.split("::")
+
+        waiver_name = "default" if waiver_name.nil?
+
+        waivers = select { |waiver| /^#{cookbook_name}$/.match?(waiver.cookbook_name) && /^#{waiver_name}$/.match?(waiver.pathname) }
+
+        if waivers.empty? && should_raise
+          raise "No inspec waivers matching '#{waiver_name}' found in cookbooks matching '#{cookbook_name}'"
+        end
+
+        waivers
+      end
+
+      def matching_waivers!(arg)
+        matching_waivers(arg, should_raise: true)
+      end
+    end
+  end
+end

data/lib/chef/cookbook/cookbook_version_loader.rb

@@ -160,13 +160,13 @@ class Chef
       def metadata_filenames
         return @metadata_filenames unless @metadata_filenames.empty?
 
-        if File.exists?(File.join(cookbook_path, UPLOADED_COOKBOOK_VERSION_FILE))
+        if File.exist?(File.join(cookbook_path, UPLOADED_COOKBOOK_VERSION_FILE))
           @uploaded_cookbook_version_file = File.join(cookbook_path, UPLOADED_COOKBOOK_VERSION_FILE)
         end
 
-        if File.exists?(File.join(cookbook_path, "metadata.json"))
+        if File.exist?(File.join(cookbook_path, "metadata.json"))
           @metadata_filenames << File.join(cookbook_path, "metadata.json")
-        elsif File.exists?(File.join(cookbook_path, "metadata.rb"))
+        elsif File.exist?(File.join(cookbook_path, "metadata.rb"))
           @metadata_filenames << File.join(cookbook_path, "metadata.rb")
         elsif uploaded_cookbook_version_file
           @metadata_filenames << uploaded_cookbook_version_file

data/lib/chef/cookbook/synchronizer.rb

@@ -143,11 +143,9 @@ class Chef
     end
 
     def files_remaining_by_cookbook
-      @files_remaining_by_cookbook ||= begin
-        files_by_cookbook.inject({}) do |memo, (cookbook, files)|
-          memo[cookbook] = files.size
-          memo
-        end
+      @files_remaining_by_cookbook ||= files_by_cookbook.inject({}) do |memo, (cookbook, files)|
+        memo[cookbook] = files.size
+        memo
       end
     end
 

data/lib/chef/cookbook/syntax_check.rb

@@ -113,7 +113,7 @@ class Chef
       end
 
       def remove_uninteresting_ruby_files(file_list)
-        file_list.reject { |f| f =~ %r{#{Regexp.quote(cookbook_path)}/(files|templates)/} }
+        file_list.grep_v(%r{#{Regexp.quote(cookbook_path)}/(files|templates)/})
       end
 
       def ruby_files

data/lib/chef/cookbook_loader.rb

@@ -195,10 +195,8 @@ class Chef
 
     def all_files_in_repo_paths
       @all_files_in_repo_paths ||=
-        begin
-          repo_paths.inject([]) do |all_children, repo_path|
-            all_children + Dir[File.join(Chef::Util::PathHelper.escape_glob_dir(repo_path), "*")]
-          end
+        repo_paths.inject([]) do |all_children, repo_path|
+          all_children + Dir[File.join(Chef::Util::PathHelper.escape_glob_dir(repo_path), "*")]
         end
     end
 

data/lib/chef/cookbook_uploader.rb

@@ -1,7 +1,6 @@
 
 autoload :Set, "set"
 require_relative "exceptions"
-require_relative "knife/cookbook_metadata"
 require_relative "digester"
 require_relative "cookbook_manifest"
 require_relative "cookbook_version"
@@ -120,7 +119,7 @@ class Chef
         # but we need the base64 encoding for the content-md5
         # header
         checksum64 = Base64.encode64([checksum].pack("H*")).strip
-        file_contents = File.open(file, "rb", &:read)
+        file_contents = File.binread(file)
 
         # Custom headers. 'content-type' disables JSON serialization of the request body.
         headers = { "content-type" => "application/x-binary", "content-md5" => checksum64, "accept" => "application/json" }

data/lib/chef/cookbook_version.rb

@@ -598,7 +598,7 @@ class Chef
         filename = record[:name]
         base_dup_name = File.join(File.dirname(filename), File.basename(filename, File.extname(filename)))
         yml_files.each do |other|
-          if other[:name] =~ /#{(File.extname(filename) == ".yml") ? "#{base_dup_name}.yaml" : "#{base_dup_name}.yml"}$/
+          if /#{(File.extname(filename) == ".yml") ? "#{base_dup_name}.yaml" : "#{base_dup_name}.yml"}$/.match?(other[:name])
             raise Chef::Exceptions::AmbiguousYAMLFile.new("Cookbook #{name}@#{version} contains ambiguous files: #{filename} and #{other[:name]}. Please update the cookbook to remove the incorrect file.")
           end
         end

data/lib/chef/data_bag_item.rb

@@ -44,8 +44,17 @@ class Chef
       end
     end
 
-    # Define all Hash's instance methods as delegating to @raw_data
-    def_delegators(:@raw_data, *(Hash.instance_methods - Object.instance_methods))
+    # delegate missing methods to the @raw_data Hash
+    def method_missing(method_name, *arguments, &block)
+      @raw_data.send(method_name, *arguments, &block)
+    rescue
+      # throw more sensible errors back at the user
+      super
+    end
+
+    def respond_to_missing?(method_name, include_private = false)
+      @raw_data.respond_to?(method_name, include_private) || super
+    end
 
     attr_reader :raw_data
 

data/lib/chef/data_collector.rb

@@ -104,7 +104,6 @@ class Chef
       #
       def action_collection_registration(action_collection)
         @action_collection = action_collection
-        action_collection.register(self)
       end
 
       # - Creates and writes our NodeUUID back to the node object

data/lib/chef/delayed_evaluator.rb

@@ -17,5 +17,9 @@
 
 class Chef
   class DelayedEvaluator < Proc
+    def dup
+      # super returns a "Proc" (which seems buggy) so re-wrap it
+      self.class.new(&super) # rubocop:disable Layout/SpaceAroundKeyword
+    end
   end
 end

data/lib/chef/deprecated.rb

@@ -251,14 +251,18 @@ class Chef
       target 32
     end
 
-    class PolicyfileCompatMode < Base
-      target 35
+    class UnifiedMode < Base
+      target 33
     end
 
     class AttributeWhitelistConfiguration < Base
       target 34
     end
 
+    class PolicyfileCompatMode < Base
+      target 35
+    end
+
     class Generic < Base
       def url
         "https://docs.chef.io/chef_deprecations_client/"

data/lib/chef/dsl/chef_vault.rb

@@ -32,8 +32,8 @@ class Chef
       # actually a Chef Vault item. This is controlled via
       # +node['chef-vault']['databag_fallback']+.
       # @example
-      # item = chef_vault_item('secrets', 'bacon')
-      # log 'Yeah buddy!' if item['_default']['type']
+      #   item = chef_vault_item('secrets', 'bacon')
+      #   log 'Yeah buddy!' if item['_default']['type']
       # @param [String] bag Name of the data bag to load from.
       # @param [String] id Identifier of the data bag item to load.
       def chef_vault_item(bag, id)
@@ -51,8 +51,8 @@ class Chef
       # the items, so this method strips out the keys for users so that they
       # don't have to do it in their recipes.
       # @example
-      # ids = chef_vault('secrets')
-      # log 'Yeah buddy!' if ids[0] == 'bacon'
+      #   ids = chef_vault('secrets')
+      #   log 'Yeah buddy!' if ids[0] == 'bacon'
       # @param [String] bag Name of the data bag to load from.
       # @return [Array]
       def chef_vault(bag)
@@ -68,8 +68,8 @@ class Chef
       # This allows for easy access to current environment secrets inside
       # of an item.
       # @example
-      # item = chef_vault_item_for_environment('secrets', 'bacon')
-      # log 'Yeah buddy!' if item['type'] == 'applewood_smoked'
+      #   item = chef_vault_item_for_environment('secrets', 'bacon')
+      #   log 'Yeah buddy!' if item['type'] == 'applewood_smoked'
       # @param [String] bag Name of the data bag to load from.
       # @param [String] id Identifier of the data bag item to load.
       # @return [Hash]

data/lib/chef/{knife/group_list.rb → dsl/compliance.rb}

@@ -1,6 +1,4 @@
 #
-# Author:: Seth Falcon (<seth@chef.io>)
-# Author:: Jeremiah Snapp (<jeremiah@chef.io>)
 # Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
@@ -17,26 +15,23 @@
 # limitations under the License.
 #
 
-require_relative "../knife"
-
 class Chef
-  class Knife
-    class GroupList < Chef::Knife
-      category "group"
-      banner "knife group list"
+  module DSL
+    module Compliance
 
-      deps do
-        require_relative "acl_base"
-        include Chef::Knife::AclBase
+      # @see Chef::Compliance::ProfileCollection#include_profile
+      def include_profile(*args)
+        run_context.profile_collection.include_profile(*args)
       end
 
-      def run
-        groups = rest.get_rest("groups").keys.sort
-        ui.output(remove_usags(groups))
+      # @see Chef::Compliance::WaiverCollection#include_waiver
+      def include_waiver(*args)
+        run_context.waiver_collection.include_waiver(*args)
       end
 
-      def remove_usags(groups)
-        groups.select { |gname| !is_usag?(gname) }
+      # @see Chef::Compliance::inputCollection#include_input
+      def include_input(*args)
+        run_context.input_collection.include_input(*args)
       end
     end
   end

data/lib/chef/dsl/declare_resource.rb

@@ -156,15 +156,7 @@ class Chef
       def edit_resource(type, name, created_at: nil, run_context: self.run_context, &resource_attrs_block)
         edit_resource!(type, name, created_at: created_at, run_context: run_context, &resource_attrs_block)
       rescue Chef::Exceptions::ResourceNotFound
-        resource = declare_resource(type, name, created_at: created_at, run_context: run_context)
-        if resource_attrs_block
-          if defined?(new_resource)
-            resource.instance_exec(new_resource, &resource_attrs_block)
-          else
-            resource.instance_exec(&resource_attrs_block)
-          end
-        end
-        resource
+        declare_resource(type, name, created_at: created_at, run_context: run_context, &resource_attrs_block)
       end
 
       # Find existing resources by searching the list of existing resources.  Possible
@@ -306,6 +298,8 @@ class Chef
 
         enclosing_provider ||= self if is_a?(Chef::Provider)
 
+        nr = new_resource if defined?(new_resource)
+
         Chef::ResourceBuilder.new(
           type:                type,
           name:                name,
@@ -314,7 +308,8 @@ class Chef
           run_context:         run_context,
           cookbook_name:       cookbook_name,
           recipe_name:         recipe_name,
-          enclosing_provider:  enclosing_provider
+          enclosing_provider:  enclosing_provider,
+          new_resource:        nr
         ).build(&resource_attrs_block)
       end
 

data/lib/chef/{knife/client_show.rb → dsl/reader_helpers.rb}

@@ -1,5 +1,4 @@
 #
-# Author:: Adam Jacob (<adam@chef.io>)
 # Copyright:: Copyright (c) Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
@@ -14,35 +13,39 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-#
 
-require_relative "../knife"
+autoload :TOML, "tomlrb"
+require_relative "../json_compat"
+autoload :YAML, "yaml"
 
 class Chef
-  class Knife
-    class ClientShow < Knife
-
-      include Knife::Core::MultiAttributeReturnOption
-
-      deps do
-        require_relative "../api_client_v1"
+  module DSL
+    module ReaderHelpers
+
+      def parse_file(filename)
+        case File.extname(filename)
+        when ".toml"
+          parse_toml(filename)
+        when ".yaml", ".yml"
+          parse_yaml(filename)
+        when ".json"
+          parse_json(filename)
+        end
       end
 
-      banner "knife client show CLIENT (options)"
-
-      def run
-        @client_name = @name_args[0]
+      def parse_json(filename)
+        JSONCompat.parse(IO.read(filename))
+      end
 
-        if @client_name.nil?
-          show_usage
-          ui.fatal("You must specify a client name")
-          exit 1
-        end
+      def parse_toml(filename)
+        Tomlrb.load_file(filename)
+      end
 
-        client = Chef::ApiClientV1.load(@client_name)
-        output(format_for_display(client))
+      def parse_yaml(filename)
+        YAML.load(IO.read(filename))
       end
 
+      extend self
     end
   end
 end

data/lib/chef/dsl/reboot_pending.rb

@@ -37,7 +37,7 @@ class Chef
           # due to a file being in use (usually a temporary file and a system file)
           # \??\c:\temp\test.sys!\??\c:\winnt\system32\test.sys
           # http://technet.microsoft.com/en-us/library/cc960241.aspx
-          registry_value_exists?('HKLM\SYSTEM\CurrentControlSet\Control\Session Manager', { name: "PendingFileRenameOperations" }) ||
+          registry_value_exists?("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager", { name: "PendingFileRenameOperations" }) ||
 
             # RebootRequired key contains Update IDs with a value of 1 if they require a reboot.
             # The existence of RebootRequired alone is sufficient on my Windows 8.1 workstation in Windows Update
@@ -45,8 +45,7 @@ class Chef
 
             # Vista + Server 2008 and newer may have reboots pending from CBS
             registry_key_exists?('HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending')
-        elsif platform?("ubuntu")
-          # This should work for Debian as well if update-notifier-common happens to be installed. We need an API for that.
+        elsif platform_family?("debian")
           File.exist?("/var/run/reboot-required")
         else
           false

data/lib/chef/dsl/recipe.rb

@@ -18,12 +18,13 @@
 #
 
 require_relative "../exceptions"
-require_relative "resources"
+require_relative "compliance"
+require_relative "declare_resource"
 require_relative "definitions"
 require_relative "include_recipe"
 require_relative "reboot_pending"
+require_relative "resources"
 require_relative "universal"
-require_relative "declare_resource"
 require_relative "../mixin/notifying_block"
 require_relative "../mixin/lazy_module_include"
 
@@ -42,6 +43,7 @@ class Chef
     #   - it also pollutes the namespace of nearly every context, watch out.
     #
     module Recipe
+      include Chef::DSL::Compliance
       include Chef::DSL::Universal
       include Chef::DSL::DeclareResource
       include Chef::Mixin::NotifyingBlock