chef 16.4.41-universal-mingw32 → 16.8.9-universal-mingw32

data/spec/support/shared/functional/securable_resource.rb

@@ -242,48 +242,100 @@ shared_examples_for "a securable resource with existing target" do
     include_context "use Windows permissions"
 
     describe "when setting owner" do
-      before do
-        resource.owner(SID.admin_account_name)
-        resource.run_action(:create)
-      end
+      context "with user name" do
+        before do
+          resource.owner(SID.admin_account_name)
+          resource.run_action(:create)
+        end
 
-      it "should set the owner" do
-        expect(descriptor.owner).to eq(SID.Administrator)
+        it "should set the owner" do
+          expect(descriptor.owner).to eq(SID.Administrator)
+        end
+
+        it "is marked as updated only if changes are made" do
+          expect(resource.updated_by_last_action?).to eq(expect_updated?)
+        end
       end
 
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      context "with SID" do
+        before do
+          resource.owner(SID.Administrator.to_s)
+          resource.run_action(:create)
+        end
+
+        it "should set the owner" do
+          expect(descriptor.owner).to eq(SID.Administrator)
+        end
+
+        it "is marked as updated only if changes are made" do
+          expect(resource.updated_by_last_action?).to eq(expect_updated?)
+        end
       end
     end
 
     describe "when setting group" do
-      before do
-        resource.group("Administrators")
-        resource.run_action(:create)
-      end
+      context "with group name" do
+        before do
+          resource.group("Administrators")
+          resource.run_action(:create)
+        end
+
+        it "should set the group" do
+          expect(descriptor.group).to eq(SID.Administrators)
+        end
 
-      it "should set the group" do
-        expect(descriptor.group).to eq(SID.Administrators)
+        it "is marked as updated only if changes are made" do
+          expect(resource.updated_by_last_action?).to eq(expect_updated?)
+        end
       end
 
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      context "with group SID" do
+        before do
+          resource.group(SID.Administrators.to_s)
+          resource.run_action(:create)
+        end
+
+        it "should set the group" do
+          expect(descriptor.group).to eq(SID.Administrators)
+        end
+
+        it "is marked as updated only if changes are made" do
+          expect(resource.updated_by_last_action?).to eq(expect_updated?)
+        end
       end
     end
 
     describe "when setting rights and deny_rights" do
-      before do
-        resource.deny_rights(:modify, "Guest")
-        resource.rights(:read, "Guest")
-        resource.run_action(:create)
-      end
+      context "with user name" do
+        before do
+          resource.deny_rights(:modify, "Guest")
+          resource.rights(:read, "Guest")
+          resource.run_action(:create)
+        end
 
-      it "should set the rights and deny_rights" do
-        expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_modify_perms) + allowed_acl(SID.Guest, expected_read_perms))
+        it "should set the rights and deny_rights" do
+          expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_modify_perms) + allowed_acl(SID.Guest, expected_read_perms))
+        end
+
+        it "is marked as updated only if changes are made" do
+          expect(resource.updated_by_last_action?).to eq(expect_updated?)
+        end
       end
 
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      context "with SID" do
+        before do
+          resource.deny_rights(:modify, SID.Guest.to_s)
+          resource.rights(:read, SID.Guest.to_s)
+          resource.run_action(:create)
+        end
+
+        it "should set the rights and deny_rights" do
+          expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_modify_perms) + allowed_acl(SID.Guest, expected_read_perms))
+        end
+
+        it "is marked as updated only if changes are made" do
+          expect(resource.updated_by_last_action?).to eq(expect_updated?)
+        end
       end
     end
   end
@@ -302,12 +354,18 @@ shared_examples_for "a securable resource without existing target" do
       expect(descriptor.owner).to eq(SID.default_security_object_owner)
     end
 
-    it "sets owner when owner is specified" do
+    it "sets owner when owner is specified by name" do
       resource.owner "Guest"
       resource.run_action(:create)
       expect(descriptor.owner).to eq(SID.Guest)
     end
 
+    it "sets owner when owner is specified by SID" do
+      resource.owner SID.Guest.to_s
+      resource.run_action(:create)
+      expect(descriptor.owner).to eq(SID.Guest)
+    end
+
     it "fails to set owner when owner has invalid characters" do
       expect { resource.owner 'Lance "The Nose" Glindenberry III' }.to raise_error(Chef::Exceptions::ValidationFailed)
     end
@@ -339,12 +397,18 @@ shared_examples_for "a securable resource without existing target" do
       expect(descriptor.group).to eq(SID.default_security_object_group)
     end
 
-    it "sets group when group is specified" do
+    it "sets group when group is specified by name" do
       resource.group "Everyone"
       resource.run_action(:create)
       expect(descriptor.group).to eq(SID.Everyone)
     end
 
+    it "sets group when group is specified by SID" do
+      resource.group SID.Everyone.to_s
+      resource.run_action(:create)
+      expect(descriptor.group).to eq(SID.Everyone)
+    end
+
     it "fails to set group when group has invalid characters" do
       expect { resource.group 'Lance "The Nose" Glindenberry III' }.to raise_error(Chef::Exceptions::ValidationFailed)
     end
@@ -406,6 +470,17 @@ shared_examples_for "a securable resource without existing target" do
             allowed_acl(SID.Guest, expected_modify_perms)
           )
         end
+
+        it "multiple rights with SID" do
+          resource.rights(:read, SID.Everyone.to_s)
+          resource.rights(:modify, SID.Guest.to_s)
+          resource.run_action(:create)
+
+          expect(explicit_aces).to eq(
+            allowed_acl(SID.Everyone, expected_read_perms) +
+            allowed_acl(SID.Guest, expected_modify_perms)
+          )
+        end
       end
     end
 
@@ -443,6 +518,12 @@ shared_examples_for "a securable resource without existing target" do
           expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_full_control_perms))
         end
 
+        it "using SID" do
+          resource.deny_rights(:full_control, SID.Guest.to_s)
+          resource.run_action(:create)
+          expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_full_control_perms))
+        end
+
         it "deny_rights ahead of rights" do
           resource.rights(:read, "Everyone")
           resource.deny_rights(:modify, "Guest")

data/spec/support/shared/functional/win32_service.rb

@@ -42,7 +42,7 @@ shared_context "using Win32::Service" do
       service_name: "spec-service",
       service_display_name: "Spec Test Service",
       service_description: "Service for testing Chef::Application::WindowsServiceManager.",
-      service_file_path: File.expand_path(File.join(File.dirname(__FILE__), "../../platforms/win32/spec_service.rb")),
+      service_file_path: File.expand_path(File.join(__dir__, "../../platforms/win32/spec_service.rb")),
       delayed_start: true,
     }
   end

data/spec/support/shared/unit/application_dot_d.rb

@@ -33,14 +33,16 @@ shared_examples_for "an application that loads a dot d" do
     # make sure that we are correctly globbing.
     let(:client_d_dir) do
       Chef::Util::PathHelper.cleanpath(
-        File.join(File.dirname(__FILE__), "../../../data/client.d_00")
+        File.join(__dir__, "../../../data/client.d_00")
       )
     end
 
     it "loads the configuration in order" do
+      etc_chef_client_rb = Chef::Config.platform_specific_path("#{ChefConfig::Config.etc_chef_dir}/client.rb")
       expect(IO).to receive(:read).with(Pathname.new("#{client_d_dir}/00-foo.rb").cleanpath.to_s).and_return("foo 0")
       expect(IO).to receive(:read).with(Pathname.new("#{client_d_dir}/01-bar.rb").cleanpath.to_s).and_return("bar 0")
       expect(IO).to receive(:read).with(Pathname.new("#{client_d_dir}/02-strings.rb").cleanpath.to_s).and_return("strings 0")
+      allow(app).to receive(:apply_config).with("", etc_chef_client_rb) # for chef-client managed nodes running this spec
       expect(app).to receive(:apply_config).with("foo 0", Pathname.new("#{client_d_dir}/00-foo.rb").cleanpath.to_s).and_call_original.ordered
       expect(app).to receive(:apply_config).with("bar 0", Pathname.new("#{client_d_dir}/01-bar.rb").cleanpath.to_s).and_call_original.ordered
       expect(app).to receive(:apply_config).with("strings 0", Pathname.new("#{client_d_dir}/02-strings.rb").cleanpath.to_s).and_call_original.ordered
@@ -51,7 +53,7 @@ shared_examples_for "an application that loads a dot d" do
   context "when client_d_dir is set to a directory without configuration" do
     let(:client_d_dir) do
       Chef::Util::PathHelper.cleanpath(
-        File.join(File.dirname(__FILE__), "../../data/client.d_01")
+        File.join(__dir__, "../../data/client.d_01")
       )
     end
 
@@ -69,7 +71,7 @@ shared_examples_for "an application that loads a dot d" do
     # foo.rb as a directory should be ignored
     let(:client_d_dir) do
       Chef::Util::PathHelper.cleanpath(
-        File.join(File.dirname(__FILE__), "../../data/client.d_02")
+        File.join(__dir__, "../../data/client.d_02")
       )
     end
 

data/spec/support/shared/unit/knife_shared.rb

@@ -33,7 +33,7 @@ shared_examples_for "mandatory field missing" do
 
     it "prints a relevant error message" do
       expect { knife.run }.to raise_error(SystemExit)
-      expect(stderr.string).to match /You must specify a #{fieldname}/
+      expect(stderr.string).to match(/You must specify a #{fieldname}/)
     end
   end
 end

data/spec/support/shared/unit/script_resource.rb

@@ -47,16 +47,16 @@ shared_examples_for "a script resource" do
   end
 
   describe "when executing guards" do
-    it "inherits exactly the :cwd, :environment, :group, :path, :user, and :umask attributes from a parent resource class" do
+    it "inherits exactly the :cwd, :domain, :environment, :group, :password, :path, :user, and :umask attributes from a parent resource class" do
       inherited_difference = Chef::Resource::Script.guard_inherited_attributes -
-        %i{cwd environment group path user umask}
+        %i{cwd domain environment group password path user umask}
 
       expect(inherited_difference).to eq([])
     end
 
     it "when guard_interpreter is set to the default value, the guard command string should be evaluated by command execution and not through a resource" do
       expect_any_instance_of(Chef::Resource::Conditional).not_to receive(:evaluate_block)
-      expect_any_instance_of(Chef::GuardInterpreter::ResourceGuardInterpreter).not_to receive(:evaluate_action)
+      expect_any_instance_of(Chef::GuardInterpreter::ResourceGuardInterpreter).not_to receive(:evaluate)
       expect_any_instance_of(Chef::GuardInterpreter::DefaultGuardInterpreter).to receive(:evaluate).and_return(true)
       script_resource.only_if "echo hi"
       expect(script_resource.should_skip?(:run)).to eq(nil)
@@ -65,7 +65,7 @@ shared_examples_for "a script resource" do
     it "when a valid guard_interpreter resource is specified, a block should be used to evaluate the guard" do
       expect_any_instance_of(Chef::Resource::Conditional).not_to receive(:evaluate_block)
       expect_any_instance_of(Chef::GuardInterpreter::DefaultGuardInterpreter).not_to receive(:evaluate)
-      expect_any_instance_of(Chef::GuardInterpreter::ResourceGuardInterpreter).to receive(:evaluate_action).and_return(true)
+      expect_any_instance_of(Chef::GuardInterpreter::ResourceGuardInterpreter).to receive(:evaluate).and_return(true)
       script_resource.guard_interpreter :script
       script_resource.only_if "echo hi"
       expect(script_resource.should_skip?(:run)).to eq(nil)

data/spec/support/shared/unit/windows_script_resource.rb

@@ -35,7 +35,7 @@ shared_examples_for "a Windows script resource" do
     end
 
     it "should use a resource to evaluate the guard when guard_interpreter is not specified" do
-      expect_any_instance_of(Chef::GuardInterpreter::ResourceGuardInterpreter).to receive(:evaluate_action).and_return(true)
+      expect_any_instance_of(Chef::GuardInterpreter::ResourceGuardInterpreter).to receive(:evaluate).and_return(true)
       expect_any_instance_of(Chef::GuardInterpreter::DefaultGuardInterpreter).not_to receive(:evaluate)
       windows_script_resource.only_if "echo hi"
       expect(windows_script_resource.should_skip?(:run)).to eq(nil)

data/spec/tiny_server.rb

@@ -19,7 +19,6 @@
 require "webrick"
 require "webrick/https"
 require "rack"
-require "thread"
 require "singleton"
 require "open-uri"
 require "chef/config"

data/spec/unit/application/client_spec.rb

@@ -192,7 +192,7 @@ describe Chef::Application::Client, "reconfigure" do
 
       context "with an empty value" do
         it "should terminate with message" do
-          expect(Chef::Application).to receive(:fatal!).with('Unparsable config option ""').and_raise("so ded")
+          expect(Chef::Application).to receive(:fatal!).with('Unparsable config option ""', ChefConfig::ConfigurationError.new).and_raise("so ded")
           ARGV.replace(["--config-option", ""])
           expect { app.reconfigure }.to raise_error "so ded"
         end
@@ -200,7 +200,7 @@ describe Chef::Application::Client, "reconfigure" do
 
       context "with an invalid value" do
         it "should terminate with message" do
-          expect(Chef::Application).to receive(:fatal!).with('Unparsable config option "asdf"').and_raise("so ded")
+          expect(Chef::Application).to receive(:fatal!).with('Unparsable config option "asdf"', ChefConfig::ConfigurationError.new).and_raise("so ded")
           ARGV.replace(["--config-option", "asdf"])
           expect { app.reconfigure }.to raise_error "so ded"
         end

data/spec/unit/application/exit_code_spec.rb

@@ -61,6 +61,10 @@ describe Chef::Application::ExitCode do
       expect(valid_rfc_exit_codes.include?(41)).to eq(true)
     end
 
+    it "validates a CONFIG_FAILURE return code of 43" do
+      expect(valid_rfc_exit_codes.include?(43)).to eq(true)
+    end
+
     it "validates a CLIENT_UPGRADED return code of 213" do
       expect(valid_rfc_exit_codes.include?(213)).to eq(true)
     end
@@ -113,6 +117,12 @@ describe Chef::Application::ExitCode do
       expect(exit_codes.normalize_exit_code(runtime_error)).to eq(37)
     end
 
+    it "returns CONFIG_FAILURE when a configuration exception is specified" do
+      config_error = Chef::Exceptions::ConfigurationError.new("BOOM")
+      runtime_error = Chef::Exceptions::RunFailedWrappingError.new(config_error)
+      expect(exit_codes.normalize_exit_code(runtime_error)).to eq(43)
+    end
+
     it "returns CLIENT_UPGRADED when the client was upgraded during converge" do
       client_upgraded_error = Chef::Exceptions::ClientUpgraded.new("BOOM")
       runtime_error = Chef::Exceptions::RunFailedWrappingError.new(client_upgraded_error)

data/spec/unit/application_spec.rb

@@ -491,16 +491,14 @@ describe Chef::Application do
 
   describe "configuration errors" do
     before do
-      expect(Process).to receive(:exit)
+      allow(Process).to receive(:exit).and_return(true)
     end
 
     def raises_informative_fatals_on_configure_chef
       config_file_regexp = Regexp.new @app.config[:config_file]
-      expect(Chef::Log).to receive(:fatal)
-        .with(/Configuration error/)
-      expect(Chef::Log).to receive(:fatal)
-        .with(config_file_regexp)
-        .at_least(1).times
+      expect(Chef::Log).to receive(:fatal).with(/Configuration error/)
+      expect(Chef::Log).to receive(:fatal).with(config_file_regexp)
+      expect(Process).to receive(:exit).with(43).and_return(true)
       @app.configure_chef
     end
 

data/spec/unit/chef_fs/config_spec.rb

@@ -18,7 +18,7 @@
 
 require "spec_helper"
 require "chef/exceptions"
-require "lib/chef/chef_fs/config.rb"
+require "lib/chef/chef_fs/config"
 
 describe Chef::ChefFS::Config do
   describe "initialize" do

data/spec/unit/chef_fs/data_handler/data_bag_item_data_handler.rb

@@ -17,7 +17,7 @@
 #
 
 require "spec_helper"
-require "lib/chef/chef_fs/data_handler/data_bag_item_data_handler.rb"
+require "lib/chef/chef_fs/data_handler/data_bag_item_data_handler"
 
 class TestDataBag < Mash
   attr_accessor :name

data/spec/unit/chef_fs/parallelizer_spec.rb

@@ -1,7 +1,11 @@
 require "spec_helper"
 require "chef/chef_fs/parallelizer"
 
-describe Chef::ChefFS::Parallelizer do
+# FIXME: these are disabled on MacOS due to timing issues in our anka build cluster
+# these issues should be fixed and the tests should be re-eenabled.  If we are getting
+# omnibus test phases on mac tests which are reasonable and not ~3 hours long, then the
+# condition to avoid this testing on macs can be deleted
+describe Chef::ChefFS::Parallelizer, :not_supported_on_macos do
   before :each do
     @start_time = Time.now
   end

data/spec/unit/chef_fs/path_util_spec.rb

@@ -61,7 +61,7 @@ describe Chef::ChefFS::PathUtils do
   end
 
   context "invoking realest_path" do
-    let(:good_path) { File.dirname(__FILE__) }
+    let(:good_path) { __dir__ }
     let(:parent_path) { File.dirname(good_path) }
 
     it "handles paths with no wildcards or globs" do

data/spec/unit/client_spec.rb

@@ -129,6 +129,7 @@ shared_context "a client run" do
     expect(client.events).to receive(:register).with(instance_of(Chef::DataCollector::Reporter))
     expect(client.events).to receive(:register).with(instance_of(Chef::ResourceReporter))
     expect(client.events).to receive(:register).with(instance_of(Chef::ActionCollection))
+    expect(client.events).to receive(:register).with(instance_of(Chef::Compliance::Runner))
   end
 
   def stub_for_node_load
@@ -801,4 +802,20 @@ describe Chef::Client do
       allow_any_instance_of(Chef::RunLock).to receive(:save_pid).and_raise(NoMethodError)
     end
   end
+
+  describe "deprecated enforce_path_sanity" do
+    include_context "a client run"
+    include_context "converge completed"
+
+    it "print a warning, when enforce_path_sanity is passed" do
+      Chef::Config[:enforce_path_sanity] = true
+      expect(logger).to receive(:warn).with("`enforce_path_sanity` is deprecated, please use `enforce_default_paths` instead!")
+      client.run
+    end
+
+    it "should not print a warning, when enforce_path_sanity is not passed" do
+      expect(logger).not_to receive(:warn).with("`enforce_path_sanity` is deprecated, please use `enforce_default_paths` instead!")
+      client.run
+    end
+  end
 end

data/spec/unit/compliance/fetcher/automate_spec.rb

@@ -0,0 +1,134 @@
+require "spec_helper"
+require "chef/compliance/fetcher/automate"
+
+describe Chef::Compliance::Fetcher::Automate do
+  describe ".resolve" do
+    before do
+      Chef::Config[:data_collector] = {
+        server_url: "https://automate.test/data_collector",
+        token: token,
+      }
+    end
+
+    let(:token) { "fake_token" }
+
+    context "when target is a string" do
+      it "should resolve a compliance URL" do
+        res = Chef::Compliance::Fetcher::Automate.resolve("compliance://namespace/profile_name")
+
+        expect(res).to be_kind_of(Chef::Compliance::Fetcher::Automate)
+        expected = "https://automate.test/compliance/profiles/namespace/profile_name/tar"
+        expect(res.target).to eq(expected)
+      end
+
+      it "raises an exception with no data collector token" do
+        Chef::Config[:data_collector].delete(:token)
+
+        expect {
+          Chef::Compliance::Fetcher::Automate.resolve("compliance://namespace/profile_name")
+        }.to raise_error(/No data-collector token set/)
+      end
+
+      it "includes the data collector token" do
+        expect(Chef::Compliance::Fetcher::Automate).to receive(:new).with(
+          "https://automate.test/compliance/profiles/namespace/profile_name/tar",
+          hash_including("token" => token)
+        ).and_call_original
+
+        res = Chef::Compliance::Fetcher::Automate.resolve("compliance://namespace/profile_name")
+
+        expect(res).to be_kind_of(Chef::Compliance::Fetcher::Automate)
+        expected = "https://automate.test/compliance/profiles/namespace/profile_name/tar"
+        expect(res.target).to eq(expected)
+      end
+
+      it "returns nil with a non-compliance URL" do
+        res = Chef::Compliance::Fetcher::Automate.resolve("http://github.com/chef-cookbooks/audit")
+
+        expect(res).to eq(nil)
+      end
+    end
+
+    context "when target is a hash" do
+      it "should resolve a target with a version" do
+        res = Chef::Compliance::Fetcher::Automate.resolve(
+          compliance: "namespace/profile_name",
+          version: "1.2.3"
+        )
+
+        expect(res).to be_kind_of(Chef::Compliance::Fetcher::Automate)
+        expected = "https://automate.test/compliance/profiles/namespace/profile_name/version/1.2.3/tar"
+        expect(res.target).to eq(expected)
+      end
+
+      it "should resolve a target without a version" do
+        res = Chef::Compliance::Fetcher::Automate.resolve(
+          compliance: "namespace/profile_name"
+        )
+
+        expect(res).to be_kind_of(Chef::Compliance::Fetcher::Automate)
+        expected = "https://automate.test/compliance/profiles/namespace/profile_name/tar"
+        expect(res.target).to eq(expected)
+      end
+
+      it "uses url key when present" do
+        res = Chef::Compliance::Fetcher::Automate.resolve(
+          compliance: "namespace/profile_name",
+          version: "1.2.3",
+          url: "https://profile.server.test/profiles/profile_name/1.2.3"
+        )
+
+        expect(res).to be_kind_of(Chef::Compliance::Fetcher::Automate)
+        expected = "https://profile.server.test/profiles/profile_name/1.2.3"
+        expect(res.target).to eq(expected)
+      end
+
+      it "does not include token in the config when url key is present" do
+        expect(Chef::Compliance::Fetcher::Automate).to receive(:new).with(
+          "https://profile.server.test/profiles/profile_name/1.2.3",
+          hash_including("token" => nil)
+        ).and_call_original
+
+        res = Chef::Compliance::Fetcher::Automate.resolve(
+          compliance: "namespace/profile_name",
+          version: "1.2.3",
+          url: "https://profile.server.test/profiles/profile_name/1.2.3"
+        )
+
+        expect(res).to be_kind_of(Chef::Compliance::Fetcher::Automate)
+        expected = "https://profile.server.test/profiles/profile_name/1.2.3"
+        expect(res.target).to eq(expected)
+      end
+
+      it "raises an exception with no data collector token" do
+        Chef::Config[:data_collector].delete(:token)
+
+        expect {
+          Chef::Compliance::Fetcher::Automate.resolve(compliance: "namespace/profile_name")
+        }.to raise_error(Inspec::FetcherFailure, /No data-collector token set/)
+      end
+
+      it "includes the data collector token" do
+        expect(Chef::Compliance::Fetcher::Automate).to receive(:new).with(
+          "https://automate.test/compliance/profiles/namespace/profile_name/tar",
+          hash_including("token" => token)
+        ).and_call_original
+
+        res = Chef::Compliance::Fetcher::Automate.resolve(compliance: "namespace/profile_name")
+
+        expect(res).to be_kind_of(Chef::Compliance::Fetcher::Automate)
+        expected = "https://automate.test/compliance/profiles/namespace/profile_name/tar"
+        expect(res.target).to eq(expected)
+      end
+
+      it "returns nil with a non-profile Hash" do
+        res = Chef::Compliance::Fetcher::Automate.resolve(
+          profile: "namespace/profile_name",
+          version: "1.2.3"
+        )
+
+        expect(res).to eq(nil)
+      end
+    end
+  end
+end