chef 16.4.38 → 16.7.61

data/lib/chef/resource/windows_user_privilege.rb

@@ -23,52 +23,6 @@ class Chef
     class WindowsUserPrivilege < Chef::Resource
       unified_mode true
 
-      privilege_opts = %w{SeTrustedCredManAccessPrivilege
-                          SeNetworkLogonRight
-                          SeTcbPrivilege
-                          SeMachineAccountPrivilege
-                          SeIncreaseQuotaPrivilege
-                          SeInteractiveLogonRight
-                          SeRemoteInteractiveLogonRight
-                          SeBackupPrivilege
-                          SeChangeNotifyPrivilege
-                          SeSystemtimePrivilege
-                          SeTimeZonePrivilege
-                          SeCreatePagefilePrivilege
-                          SeCreateTokenPrivilege
-                          SeCreateGlobalPrivilege
-                          SeCreatePermanentPrivilege
-                          SeCreateSymbolicLinkPrivilege
-                          SeDebugPrivilege
-                          SeDenyNetworkLogonRight
-                          SeDenyBatchLogonRight
-                          SeDenyServiceLogonRight
-                          SeDenyInteractiveLogonRight
-                          SeDenyRemoteInteractiveLogonRight
-                          SeEnableDelegationPrivilege
-                          SeRemoteShutdownPrivilege
-                          SeAuditPrivilege
-                          SeImpersonatePrivilege
-                          SeIncreaseWorkingSetPrivilege
-                          SeIncreaseBasePriorityPrivilege
-                          SeLoadDriverPrivilege
-                          SeLockMemoryPrivilege
-                          SeBatchLogonRight
-                          SeServiceLogonRight
-                          SeSecurityPrivilege
-                          SeRelabelPrivilege
-                          SeSystemEnvironmentPrivilege
-                          SeManageVolumePrivilege
-                          SeProfileSingleProcessPrivilege
-                          SeSystemProfilePrivilege
-                          SeUndockPrivilege
-                          SeAssignPrimaryTokenPrivilege
-                          SeRestorePrivilege
-                          SeShutdownPrivilege
-                          SeSyncAgentPrivilege
-                          SeTakeOwnershipPrivilege
-                        }
-
       provides :windows_user_privilege
       description "The windows_user_privilege resource allows to add and set principal (User/Group) to the specified privilege.\n Ref: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment"
 
@@ -125,22 +79,67 @@ class Chef
       ```
       DOC
 
+      PRIVILEGE_OPTS = %w{ SeAssignPrimaryTokenPrivilege
+                           SeAuditPrivilege
+                           SeBackupPrivilege
+                           SeBatchLogonRight
+                           SeChangeNotifyPrivilege
+                           SeCreateGlobalPrivilege
+                           SeCreatePagefilePrivilege
+                           SeCreatePermanentPrivilege
+                           SeCreateSymbolicLinkPrivilege
+                           SeCreateTokenPrivilege
+                           SeDebugPrivilege
+                           SeDenyBatchLogonRight
+                           SeDenyInteractiveLogonRight
+                           SeDenyNetworkLogonRight
+                           SeDenyRemoteInteractiveLogonRight
+                           SeDenyServiceLogonRight
+                           SeEnableDelegationPrivilege
+                           SeImpersonatePrivilege
+                           SeIncreaseBasePriorityPrivilege
+                           SeIncreaseQuotaPrivilege
+                           SeIncreaseWorkingSetPrivilege
+                           SeInteractiveLogonRight
+                           SeLoadDriverPrivilege
+                           SeLockMemoryPrivilege
+                           SeMachineAccountPrivilege
+                           SeManageVolumePrivilege
+                           SeNetworkLogonRight
+                           SeProfileSingleProcessPrivilege
+                           SeRelabelPrivilege
+                           SeRemoteInteractiveLogonRight
+                           SeRemoteShutdownPrivilege
+                           SeRestorePrivilege
+                           SeSecurityPrivilege
+                           SeServiceLogonRight
+                           SeShutdownPrivilege
+                           SeSyncAgentPrivilege
+                           SeSystemEnvironmentPrivilege
+                           SeSystemProfilePrivilege
+                           SeSystemtimePrivilege
+                           SeTakeOwnershipPrivilege
+                           SeTcbPrivilege
+                           SeTimeZonePrivilege
+                           SeTrustedCredManAccessPrivilege
+                           SeUndockPrivilege
+                          }.freeze
+
       property :principal, String,
         description: "An optional property to add the user to the given privilege. Use only with add and remove action.",
         name_property: true
 
-      property :users, Array,
-        description: "An optional property to set the privilege for given users. Use only with set action."
+      property :users, [Array, String],
+        description: "An optional property to set the privilege for given users. Use only with set action.",
+        coerce: proc { |v| Array(v) }
 
       property :privilege, [Array, String],
-        description: "Privilege to set for users.",
+        description: "One or more privileges to set for users.",
         required: true,
-        coerce: proc { |v| v.is_a?(String) ? Array[v] : v },
+        coerce: proc { |v| Array(v) },
         callbacks: {
-           "Option privilege must include any of the: #{privilege_opts}" => lambda { |v|
-             (privilege_opts & v).size == v.size
-           },
-         }
+          "Privilege property restricted to the following values: #{PRIVILEGE_OPTS}" => lambda { |n| (n - PRIVILEGE_OPTS).empty? },
+        }
 
       load_current_value do |new_resource|
         if new_resource.principal && (new_resource.action.include?(:add) || new_resource.action.include?(:remove))

data/lib/chef/resource/windows_workgroup.rb

@@ -16,11 +16,13 @@
 #
 
 require_relative "../resource"
-require_relative "../dist"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 
 class Chef
   class Resource
     class WindowsWorkgroup < Chef::Resource
+      unified_mode true
+
       provides :windows_workgroup
 
       description "Use the **windows_workgroup** resource to join or change the workgroup of a Windows host."
@@ -59,8 +61,8 @@ class Chef
 
       property :reboot, Symbol,
         equal_to: %i{never request_reboot reboot_now},
-        validation_message: "The reboot property accepts :immediate (reboot as soon as the resource completes), :delayed (reboot once the #{Chef::Dist::PRODUCT} run completes), and :never (Don't reboot)",
-        description: "Controls the system reboot behavior post workgroup joining. Reboot immediately, after the #{Chef::Dist::PRODUCT} run completes, or never. Note that a reboot is necessary for changes to take effect.",
+        validation_message: "The reboot property accepts :immediate (reboot as soon as the resource completes), :delayed (reboot once the #{ChefUtils::Dist::Infra::PRODUCT} run completes), and :never (Don't reboot)",
+        description: "Controls the system reboot behavior post workgroup joining. Reboot immediately, after the #{ChefUtils::Dist::Infra::PRODUCT} run completes, or never. Note that a reboot is necessary for changes to take effect.",
         coerce: proc { |x| clarify_reboot(x) },
         default: :immediate, desired_state: false
 
@@ -90,8 +92,8 @@ class Chef
 
         unless workgroup_member?
           converge_by("join workstation workgroup #{new_resource.workgroup_name}") do
-            ps_run = powershell_out(join_command)
-            raise "Failed to join the workgroup #{new_resource.workgroup_name}: #{ps_run.stderr}}" if ps_run.error?
+            ps_run = powershell_exec(join_command)
+            raise "Failed to join the workgroup #{new_resource.workgroup_name}: #{ps_run.errors}}" if ps_run.error?
 
             unless new_resource.reboot == :never
               reboot "Reboot to join workgroup #{new_resource.workgroup_name}" do
@@ -117,10 +119,10 @@ class Chef
 
         # @return [Boolean] is the node a member of the workgroup specified in the resource
         def workgroup_member?
-          node_workgroup = powershell_out!("(Get-WmiObject -Class Win32_ComputerSystem).Workgroup")
+          node_workgroup = powershell_exec!("(Get-WmiObject -Class Win32_ComputerSystem).Workgroup")
           raise "Failed to determine if system already a member of workgroup #{new_resource.workgroup_name}" if node_workgroup.error?
 
-          node_workgroup.stdout.downcase.strip == new_resource.workgroup_name.downcase
+          String(node_workgroup.result).downcase.strip == new_resource.workgroup_name.downcase
         end
       end
     end

data/lib/chef/resource/yum_package.rb

@@ -17,7 +17,7 @@
 #
 
 require_relative "package"
-require_relative "../dist"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 
 class Chef
   class Resource
@@ -135,7 +135,7 @@ class Chef
         coerce: proc { |x| x.is_a?(Array) ? x.to_a : x }
 
       property :flush_cache, Hash,
-        description: "Flush the in-memory cache before or after a Yum operation that installs, upgrades, or removes a package. Accepts a Hash in the form: { :before => true/false, :after => true/false } or an Array in the form [ :before, :after ].\nYum automatically synchronizes remote metadata to a local cache. The #{Chef::Dist::CLIENT} creates a copy of the local cache, and then stores it in-memory during the #{Chef::Dist::CLIENT} run. The in-memory cache allows packages to be installed during the #{Chef::Dist::CLIENT} run without the need to continue synchronizing the remote metadata to the local cache while the #{Chef::Dist::CLIENT} run is in-progress.",
+        description: "Flush the in-memory cache before or after a Yum operation that installs, upgrades, or removes a package. Accepts a Hash in the form: { :before => true/false, :after => true/false } or an Array in the form [ :before, :after ].\nYum automatically synchronizes remote metadata to a local cache. The #{ChefUtils::Dist::Infra::CLIENT} creates a copy of the local cache, and then stores it in-memory during the #{ChefUtils::Dist::Infra::CLIENT} run. The in-memory cache allows packages to be installed during the #{ChefUtils::Dist::Infra::CLIENT} run without the need to continue synchronizing the remote metadata to the local cache while the #{ChefUtils::Dist::Infra::CLIENT} run is in-progress.",
         default: { before: false, after: false },
         coerce: proc { |v|
           if v.is_a?(Hash)

data/lib/chef/resource/yum_repository.rb

@@ -37,7 +37,7 @@ class Chef
         gpgkey 'http://artifacts.ourco.org/pub/yum/RPM-GPG-KEY-OURCO-8'
         action :create
       end
-      ```ruby
+      ```
 
       **Delete a repository**:
 

data/lib/chef/resource_collection/resource_set.rb

@@ -123,11 +123,7 @@ class Chef
       # * Chef::Exceptions::InvalidResourceSpecification for all invalid input.
       def validate_lookup_spec!(query_object)
         case query_object
-          when Chef::Resource
-            true
-          when SINGLE_RESOURCE_MATCH, MULTIPLE_RESOURCE_MATCH, NAMELESS_RESOURCE_MATCH
-            true
-          when Hash
+          when Chef::Resource, SINGLE_RESOURCE_MATCH, MULTIPLE_RESOURCE_MATCH, NAMELESS_RESOURCE_MATCH, Hash
             true
           when String
             raise Chef::Exceptions::InvalidResourceSpecification,

data/lib/chef/resource_inspector.rb

@@ -23,94 +23,96 @@ require_relative "node"
 require_relative "resources"
 require_relative "json_compat"
 
-module ResourceInspector
-  def self.get_default(default)
-    if default.is_a?(Chef::DelayedEvaluator)
-      # ideally we'd get the block we pass to `lazy`, but the best we can do
-      # is to get the source location, which then results in reparsing the source
-      # code for the resource ourselves and just no
-      "lazy default"
-    else
-      default.is_a?(Symbol) ? default.inspect : default # inspect properly returns symbols
+class Chef
+  module ResourceInspector
+    def self.get_default(default)
+      if default.is_a?(Chef::DelayedEvaluator)
+        # ideally we'd get the block we pass to `lazy`, but the best we can do
+        # is to get the source location, which then results in reparsing the source
+        # code for the resource ourselves and just no
+        "lazy default"
+      else
+        default.is_a?(Symbol) ? default.inspect : default # inspect properly returns symbols
+      end
     end
-  end
 
-  def self.extract_resource(resource, complete = false)
-    data = {}
-    data[:description] = resource.description
-    # data[:deprecated] = resource.deprecated || false
-    data[:default_action] = resource.default_action
-    data[:actions] = resource.allowed_actions
-    data[:examples] = resource.examples
-    data[:introduced] = resource.introduced
-    data[:preview] = resource.preview_resource
+    def self.extract_resource(resource, complete = false)
+      data = {}
+      data[:description] = resource.description
+      # data[:deprecated] = resource.deprecated || false
+      data[:default_action] = resource.default_action
+      data[:actions] = resource.allowed_actions
+      data[:examples] = resource.examples
+      data[:introduced] = resource.introduced
+      data[:preview] = resource.preview_resource
 
-    properties = unless complete
-                   resource.properties.reject { |_, k| k.options[:declared_in] == Chef::Resource || k.options[:skip_docs] }
-                 else
-                   resource.properties.reject { |_, k| k.options[:skip_docs] }
-                 end
+      properties = unless complete
+                     resource.properties.reject { |_, k| k.options[:declared_in] == Chef::Resource || k.options[:skip_docs] }
+                   else
+                     resource.properties.reject { |_, k| k.options[:skip_docs] }
+                   end
 
-    data[:properties] = properties.each_with_object([]) do |(n, k), acc|
-      opts = k.options
-      acc << { name: n, description: opts[:description],
-               introduced: opts[:introduced], is: opts[:is],
-               deprecated: opts[:deprecated] || false,
-               required: opts[:required] || false,
-               default: opts[:default_description] || get_default(opts[:default]),
-               name_property: opts[:name_property] || false,
-               equal_to: sort_equal_to(opts[:equal_to]) }
+      data[:properties] = properties.each_with_object([]) do |(n, k), acc|
+        opts = k.options
+        acc << { name: n, description: opts[:description],
+                 introduced: opts[:introduced], is: opts[:is],
+                 deprecated: opts[:deprecated] || false,
+                 required: opts[:required] || false,
+                 default: opts[:default_description] || get_default(opts[:default]),
+                 name_property: opts[:name_property] || false,
+                 equal_to: sort_equal_to(opts[:equal_to]) }
+      end
+      data
     end
-    data
-  end
 
-  def self.sort_equal_to(equal_to)
-    Array(equal_to).sort.map(&:inspect)
-  rescue ArgumentError
-    Array(equal_to).map(&:inspect)
-  end
+    def self.sort_equal_to(equal_to)
+      Array(equal_to).sort.map(&:inspect)
+    rescue ArgumentError
+      Array(equal_to).map(&:inspect)
+    end
 
-  def self.extract_cookbook(path, complete)
-    path = File.expand_path(path)
-    dir, name = File.split(path)
-    Chef::Cookbook::FileVendor.fetch_from_disk(path)
-    loader = Chef::CookbookLoader.new(dir)
-    cookbook = loader.load_cookbook(name)
-    resources = cookbook.files_for(:resources)
+    def self.extract_cookbook(path, complete)
+      path = File.expand_path(path)
+      dir, name = File.split(path)
+      Chef::Cookbook::FileVendor.fetch_from_disk(path)
+      loader = Chef::CookbookLoader.new(dir)
+      cookbook = loader.load_cookbook(name)
+      resources = cookbook.files_for(:resources)
 
-    resources.each_with_object({}) do |r, res|
-      pth = r["full_path"]
-      cur = Chef::Resource::LWRPBase.build_from_file(name, pth, Chef::RunContext.new(Chef::Node.new, nil, nil))
-      res[cur.resource_name] = extract_resource(cur, complete)
+      resources.each_with_object({}) do |r, res|
+        pth = r["full_path"]
+        cur = Chef::Resource::LWRPBase.build_from_file(name, pth, Chef::RunContext.new(Chef::Node.new, nil, nil))
+        res[cur.resource_name] = extract_resource(cur, complete)
+      end
     end
-  end
 
-  # If we're given no resources, dump all of Chef's built ins
-  # otherwise, if we have a path then extract all the resources from the cookbook
-  # or else do a list of built in resources
-  #
-  # @param arguments [Array, String] One of more paths to a cookbook or a resource file to inspect
-  # @param complete [TrueClass, FalseClass] Whether to show properties defined in the base Resource class
-  # @return [String] JSON formatting of all resources
-  def self.inspect(arguments = [], complete: false)
-    output = if arguments.empty?
-               ObjectSpace.each_object(Class).select { |k| k < Chef::Resource }.each_with_object({}) { |klass, acc| acc[klass.resource_name] = extract_resource(klass) }
-             else
-               Array(arguments).each_with_object({}) do |arg, acc|
-                 if File.directory?(arg)
-                   extract_cookbook(arg, complete).each { |k, v| acc[k] = v }
-                 else
-                   r = Chef::ResourceResolver.resolve(arg.to_sym)
-                   acc[r.resource_name] = extract_resource(r, complete)
+    # If we're given no resources, dump all of Chef's built ins
+    # otherwise, if we have a path then extract all the resources from the cookbook
+    # or else do a list of built in resources
+    #
+    # @param arguments [Array, String] One of more paths to a cookbook or a resource file to inspect
+    # @param complete [TrueClass, FalseClass] Whether to show properties defined in the base Resource class
+    # @return [String] JSON formatting of all resources
+    def self.inspect(arguments = [], complete: false)
+      output = if arguments.empty?
+                 ObjectSpace.each_object(Class).select { |k| k < Chef::Resource }.each_with_object({}) { |klass, acc| acc[klass.resource_name] = extract_resource(klass) }
+               else
+                 Array(arguments).each_with_object({}) do |arg, acc|
+                   if File.directory?(arg)
+                     extract_cookbook(arg, complete).each { |k, v| acc[k] = v }
+                   else
+                     r = Chef::ResourceResolver.resolve(arg.to_sym)
+                     acc[r.resource_name] = extract_resource(r, complete)
+                   end
                  end
                end
-             end
 
-    Chef::JSONCompat.to_json_pretty(output)
-  end
+      Chef::JSONCompat.to_json_pretty(output)
+    end
 
-  def self.start
-    puts inspect(ARGV, complete: true)
-  end
+    def self.start
+      puts inspect(ARGV, complete: true)
+    end
 
+  end
 end

data/lib/chef/resource_reporter.rb

@@ -19,8 +19,6 @@
 # limitations under the License.
 #
 
-require "uri" unless defined?(URI)
-require "securerandom" unless defined?(SecureRandom)
 require_relative "event_dispatch/base"
 
 class Chef

data/lib/chef/resources.rb

@@ -27,9 +27,12 @@ require_relative "resource/batch"
 require_relative "resource/breakpoint"
 require_relative "resource/build_essential"
 require_relative "resource/cookbook_file"
+require_relative "resource/chef_client_config"
 require_relative "resource/chef_client_cron"
+require_relative "resource/chef_client_launchd"
 require_relative "resource/chef_client_scheduled_task"
 require_relative "resource/chef_client_systemd_timer"
+require_relative "resource/chef_client_trusted_certificate"
 require_relative "resource/chef_gem"
 require_relative "resource/chef_handler"
 require_relative "resource/chef_sleep"
@@ -167,4 +170,4 @@ require_relative "resource/windows_uac"
 require_relative "resource/windows_workgroup"
 require_relative "resource/timezone"
 require_relative "resource/windows_user_privilege"
-require_relative "resource/windows_security_policy"
+require_relative "resource/windows_security_policy"

data/lib/chef/run_context.rb

@@ -28,7 +28,7 @@ require_relative "event_dispatch/events_output_stream"
 require_relative "train_transport"
 require_relative "exceptions"
 require "forwardable" unless defined?(Forwardable)
-require "set" unless defined?(Set)
+autoload :Set, "set"
 
 class Chef
 
@@ -627,7 +627,7 @@ class Chef
     # @return [Train::Plugins::Transport] The child class for our train transport.
     #
     def transport
-      @transport ||= Chef::TrainTransport.build_transport(logger)
+      @transport ||= Chef::TrainTransport.new(logger).build_transport
     end
 
     # Remote connection object from Train

data/lib/chef/run_context/cookbook_compiler.rb

@@ -16,7 +16,7 @@
 # limitations under the License.
 #
 
-require "set" unless defined?(Set)
+autoload :Set, "set"
 require_relative "../log"
 require_relative "../recipe"
 require_relative "../resource/lwrp_base"

data/lib/chef/run_lock.rb

@@ -23,7 +23,7 @@ end
 require_relative "config"
 require_relative "exceptions"
 require "timeout" unless defined?(Timeout)
-require_relative "dist"
+require "chef-utils" unless defined?(ChefUtils::CANARY)
 
 class Chef
 
@@ -96,7 +96,7 @@ class Chef
     # Waits until acquiring the system-wide lock.
     #
     def wait
-      Chef::Log.warn("#{Chef::Dist::PRODUCT} #{runpid} is running, will wait for it to finish and then run.")
+      Chef::Log.warn("#{ChefUtils::Dist::Infra::PRODUCT} #{runpid} is running, will wait for it to finish and then run.")
       if ChefUtils.windows?
         mutex.wait
       else
@@ -173,7 +173,7 @@ class Chef
     # Mutex name is case-sensitive contrary to other things in
     # windows. "\" is the only invalid character.
     def acquire_win32_mutex
-      @mutex = Chef::ReservedNames::Win32::Mutex.new("Global\\#{runlock_file.gsub(/[\\]/, "/").downcase}")
+      @mutex = Chef::ReservedNames::Win32::Mutex.new("Global\\#{runlock_file.tr('\\', "/").downcase}")
       mutex.test
     end