chef 16.5.64 → 16.8.14

data/lib/chef/node_map.rb

@@ -225,13 +225,13 @@ class Chef
 
       if attribute == :platform_family
         # If any blocklist value matches, we don't match
-        return false if blocklist.any? { |v| v[1..-1] == value || platform_family_query_helper?(node, v[1..-1]) }
+        return false if blocklist.any? { |v| v[1..] == value || platform_family_query_helper?(node, v[1..]) }
 
         # If the allowlist is empty, or anything matches, we match.
         allowlist.empty? || allowlist.any? { |v| v == :all || v == value || platform_family_query_helper?(node, v) }
       else
         # If any blocklist value matches, we don't match
-        return false if blocklist.any? { |v| v[1..-1] == value }
+        return false if blocklist.any? { |v| v[1..] == value }
 
         # If the allowlist is empty, or anything matches, we match.
         allowlist.empty? || allowlist.any? { |v| v == :all || v == value }

data/lib/chef/platform/query_helpers.rb

@@ -58,10 +58,10 @@ class Chef
       end
 
       def dsc_refresh_mode_disabled?(node)
-        require_relative "../util/powershell/cmdlet"
-        cmdlet = Chef::Util::Powershell::Cmdlet.new(node, "Get-DscLocalConfigurationManager", :object)
-        metadata = cmdlet.run!.return_value
-        metadata["RefreshMode"] == "Disabled"
+        require_relative "../powershell"
+        exec = Chef::PowerShell.new("Get-DscLocalConfigurationManager")
+        exec.error!
+        exec.result["RefreshMode"] == "Disabled"
       end
 
       def supported_powershell_version?(node, version_string)

data/lib/chef/policy_builder/dynamic.rb

@@ -23,6 +23,8 @@ require_relative "../run_context"
 require_relative "../config"
 require_relative "../node"
 require_relative "../exceptions"
+require_relative "expand_node_object"
+require_relative "policyfile"
 
 class Chef
   module PolicyBuilder

data/lib/chef/powershell.rb

@@ -24,6 +24,7 @@ class Chef
 
     attr_reader :result
     attr_reader :errors
+    attr_reader :verbose
 
     # Run a command under PowerShell via FFI
     # This implementation requires the managed dll and native wrapper to be in the library search
@@ -34,8 +35,12 @@ class Chef
     # @param script [String] script to run
     # @return [Object] output
     def initialize(script)
-      raise "Chef::PowerShell can only be used on the Windows platform." unless RUBY_PLATFORM.match?(/mswin|mingw32|windows/)
-
+      # This Powershell DLL source lives here: https://github.com/chef/chef-powershell-shim
+      # Every merge into that repo triggers a Habitat build and promotion. Running
+      # the rake :update_chef_exec_dll task in this (chef/chef) repo will pull down
+      # the built packages and copy the binaries to distro/ruby_bin_folder. Bundle install
+      # ensures that the correct architecture binaries are installed into the path.
+      @dll ||= "Chef.PowerShell.Wrapper.dll"
       exec(script)
     end
 
@@ -59,15 +64,16 @@ class Chef
       raise Chef::PowerShell::CommandFailed, "Unexpected exit in PowerShell command: #{@errors}" if error?
     end
 
-    private
+    protected
 
     def exec(script)
-      FFI.ffi_lib "Chef.PowerShell.Wrapper.dll"
+      FFI.ffi_lib @dll
       FFI.attach_function :execute_powershell, :ExecuteScript, [:string], :pointer
       execution = FFI.execute_powershell(script).read_utf16string
       hashed_outcome = Chef::JSONCompat.parse(execution)
       @result = Chef::JSONCompat.parse(hashed_outcome["result"])
       @errors = hashed_outcome["errors"]
+      @verbose = hashed_outcome["verbose"]
     end
   end
 end

data/lib/chef/property.rb

@@ -559,7 +559,7 @@ class Chef
       if modified_options.key?(:name_property) ||
           modified_options.key?(:name_attribute) ||
           modified_options.key?(:default)
-        options = options.reject { |k, v| k == :name_attribute || k == :name_property || k == :default }
+        options = options.reject { |k, v| %i{name_attribute name_property default}.include?(k) }
       end
       self.class.new(**options.merge(modified_options))
     end

data/lib/chef/provider.rb

@@ -88,7 +88,7 @@ class Chef
     def self.use(partial)
       dirname = ::File.dirname(partial)
       basename = ::File.basename(partial, ".rb")
-      basename = basename[1..-1] if basename.start_with?("_")
+      basename = basename[1..] if basename.start_with?("_")
       class_eval IO.read(::File.expand_path("#{dirname}/_#{basename}.rb", ::File.dirname(caller_locations.first.absolute_path)))
     end
 

data/lib/chef/provider/cron.rb

@@ -112,13 +112,7 @@ class Chef
             when ENV_PATTERN
               crontab << line unless cron_found
               next
-            when SPECIAL_PATTERN
-              if cron_found
-                cron_found = false
-                crontab << newcron
-                next
-              end
-            when CRON_PATTERN
+            when SPECIAL_PATTERN, CRON_PATTERN
               if cron_found
                 cron_found = false
                 crontab << newcron
@@ -163,12 +157,7 @@ class Chef
               next
             when ENV_PATTERN
               next if cron_found
-            when SPECIAL_PATTERN
-              if cron_found
-                cron_found = false
-                next
-              end
-            when CRON_PATTERN
+            when SPECIAL_PATTERN, CRON_PATTERN
               if cron_found
                 cron_found = false
                 next

data/lib/chef/provider/dsc_resource.rb

@@ -15,7 +15,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-require_relative "../util/powershell/cmdlet"
+require "timeout" unless defined?(Timeout)
+require_relative "../mixin/powershell_exec"
 require_relative "../util/dsc/local_configuration_manager"
 require_relative "../mixin/powershell_type_coercions"
 require_relative "../util/dsc/resource_store"
@@ -130,27 +131,27 @@ class Chef
       def test_resource
         result = invoke_resource(:test)
         add_dsc_verbose_log(result)
-        return_dsc_resource_result(result, "InDesiredState")
+        result.result["InDesiredState"]
       end
 
       def set_resource
         result = invoke_resource(:set)
         add_dsc_verbose_log(result)
-        create_reboot_resource if return_dsc_resource_result(result, "RebootRequired")
-        result.return_value
+        create_reboot_resource if result.result["RebootRequired"]
+        result
       end
 
       def add_dsc_verbose_log(result)
         # We really want this information from the verbose stream,
         # however in some versions of WMF, Invoke-DscResource is not correctly
         # writing to that stream and instead just dumping to stdout
-        verbose_output = result.stream(:verbose)
-        verbose_output = result.stdout if verbose_output.empty?
+        verbose_output = result.verbose.join("\n")
+        verbose_output = result.result if verbose_output.empty?
 
         if @converge_description.nil? || @converge_description.empty?
           @converge_description = verbose_output
         else
-          @converge_description << "\n"
+          @converge_description << "\n\n"
           @converge_description << verbose_output
         end
       end
@@ -159,26 +160,13 @@ class Chef
         @module_version.nil? ? module_name : "@{ModuleName='#{module_name}';ModuleVersion='#{@module_version}'}"
       end
 
-      def invoke_resource(method, output_format = :object)
+      def invoke_resource(method)
         properties = translate_type(new_resource.properties)
         switches = "-Method #{method} -Name #{new_resource.resource}"\
                    " -Property #{properties} -Module #{module_info_object} -Verbose"
-        cmdlet = Chef::Util::Powershell::Cmdlet.new(
-          node,
-          "Invoke-DscResource #{switches}",
-          output_format
-        )
-        cmdlet.run!({}, { timeout: new_resource.timeout })
-      end
-
-      def return_dsc_resource_result(result, property_name)
-        if result.return_value.is_a?(Array)
-          # WMF Feb 2015 Preview
-          result.return_value[0][property_name]
-        else
-          # WMF April 2015 Preview
-          result.return_value[property_name]
-        end
+        Timeout.timeout(new_resource.timeout) {
+          powershell_exec!("Invoke-DscResource #{switches}")
+        }
       end
 
       def create_reboot_resource

data/lib/chef/provider/dsc_script.rb

@@ -16,7 +16,6 @@
 # limitations under the License.
 #
 
-require_relative "../util/powershell/cmdlet"
 require_relative "../util/dsc/configuration_generator"
 require_relative "../util/dsc/local_configuration_manager"
 require_relative "../util/path_helper"
@@ -32,11 +31,11 @@ class Chef
         @dsc_resource = dsc_resource
         @resource_converged = false
         @operations = {
-          set: Proc.new do |config_manager, document, shellout_flags|
-            config_manager.set_configuration(document, shellout_flags)
+          set: Proc.new do |config_manager, document|
+            config_manager.set_configuration(document)
           end,
-          test: Proc.new do |config_manager, document, shellout_flags|
-            config_manager.test_configuration(document, shellout_flags)
+          test: Proc.new do |config_manager, document|
+            config_manager.test_configuration(document)
           end }
       end
 
@@ -85,20 +84,23 @@ class Chef
 
         config_manager = Chef::Util::DSC::LocalConfigurationManager.new(@run_context.node, config_directory)
 
-        shellout_flags = {
-          cwd: @dsc_resource.cwd,
-          environment: @dsc_resource.environment,
-          timeout: @dsc_resource.timeout,
-        }
+        cwd = @dsc_resource.cwd || Dir.pwd
+        original_env = ENV.to_hash
 
         begin
-          configuration_document = generate_configuration_document(config_directory, configuration_flags)
-          @operations[operation].call(config_manager, configuration_document, shellout_flags)
+          ENV.update(@dsc_resource.environment) if @dsc_resource.environment
+          Dir.chdir(cwd) do
+            Timeout.timeout(@dsc_resource.timeout) do
+              configuration_document = generate_configuration_document(config_directory, configuration_flags)
+              @operations[operation].call(config_manager, configuration_document)
+            end
+          end
         rescue Exception => e
           logger.error("DSC operation failed: #{e.message}")
           raise e
         ensure
           ::FileUtils.rm_rf(config_directory)
+          ENV.replace(original_env)
         end
       end
 
@@ -112,20 +114,14 @@ class Chef
       end
 
       def generate_configuration_document(config_directory, configuration_flags)
-        shellout_flags = {
-          cwd: @dsc_resource.cwd,
-          environment: @dsc_resource.environment,
-          timeout: @dsc_resource.timeout,
-        }
-
         generator = Chef::Util::DSC::ConfigurationGenerator.new(@run_context.node, config_directory)
 
         if @dsc_resource.command
-          generator.configuration_document_from_script_path(@dsc_resource.command, configuration_name, configuration_flags, shellout_flags)
+          generator.configuration_document_from_script_path(@dsc_resource.command, configuration_name, configuration_flags)
         else
           # If code is also not provided, we mimic what the other script resources do (execute nothing)
           logger.warn("Neither code or command were provided for dsc_resource[#{@dsc_resource.name}].") unless @dsc_resource.code
-          generator.configuration_document_from_script_code(@dsc_resource.code || "", configuration_flags, @dsc_resource.imports, shellout_flags)
+          generator.configuration_document_from_script_code(@dsc_resource.code || "", configuration_flags, @dsc_resource.imports)
         end
       end
 

data/lib/chef/provider/file.rb

@@ -31,7 +31,7 @@ require_relative "../util/backup"
 require_relative "../util/diff"
 require_relative "../util/selinux"
 require_relative "../file_content_management/deploy"
-require "chef-utils" unless defined?(ChefUtils)
+require "chef-utils" unless defined?(ChefUtils::CANARY)
 
 # The Tao of File Providers:
 #  - the content provider must always return a tempfile that we can delete/mv

data/lib/chef/provider/git.rb

@@ -68,9 +68,9 @@ class Chef
           a.assertion { !(new_resource.revision =~ %r{^origin/}) }
           a.failure_message Chef::Exceptions::InvalidRemoteGitReference,
             "Deploying remote branches is not supported. " +
-            "Specify the remote branch as a local branch for " +
-            "the git repository you're deploying from " +
-            "(ie: '#{new_resource.revision.gsub("origin/", "")}' rather than '#{new_resource.revision}')."
+              "Specify the remote branch as a local branch for " +
+              "the git repository you're deploying from " +
+              "(ie: '#{new_resource.revision.gsub("origin/", "")}' rather than '#{new_resource.revision}')."
         end
 
         requirements.assert(:all_actions) do |a|
@@ -80,8 +80,8 @@ class Chef
           a.assertion { !target_revision.nil? }
           a.failure_message Chef::Exceptions::UnresolvableGitReference,
             "Unable to parse SHA reference for '#{new_resource.revision}' in repository '#{new_resource.repository}'. " +
-            "Verify your (case-sensitive) repository URL and revision.\n" +
-            "`git ls-remote '#{new_resource.repository}' '#{rev_search_pattern}'` output: #{@resolved_reference}"
+              "Verify your (case-sensitive) repository URL and revision.\n" +
+              "`git ls-remote '#{new_resource.repository}' '#{rev_search_pattern}'` output: #{@resolved_reference}"
         end
       end
 

data/lib/chef/provider/group.rb

@@ -78,7 +78,7 @@ class Chef
       # <false>:: If a change is not required
       def compare_group
         @change_desc = [ ]
-        if new_resource.gid.to_s != current_resource.gid.to_s
+        unless group_gid_match?
           @change_desc << "change gid #{current_resource.gid} to #{new_resource.gid}"
         end
 
@@ -103,13 +103,21 @@ class Chef
           unless members_to_be_removed.empty?
             @change_desc << "remove existing member(s): #{members_to_be_removed.join(", ")}"
           end
-        elsif new_resource.members != current_resource.members
-          @change_desc << "replace group members with new list of members"
+        elsif !group_members_match?
+          @change_desc << "replace group members with new list of members: #{new_resource.members.join(", ")}"
         end
 
         !@change_desc.empty?
       end
 
+      def group_gid_match?
+        new_resource.gid.to_s == current_resource.gid.to_s
+      end
+
+      def group_members_match?
+        [new_resource.members].flatten.sort == [current_resource.members].flatten.sort
+      end
+
       def has_current_group_member?(member)
         current_resource.members.include?(member)
       end
@@ -131,7 +139,7 @@ class Chef
           if compare_group
             converge_by(["alter group #{new_resource.group_name}"] + change_desc) do
               manage_group
-              logger.info("#{new_resource} altered")
+              logger.info("#{new_resource} altered: #{change_desc.join(", ")}")
             end
           end
         end
@@ -151,7 +159,7 @@ class Chef
 
         converge_by(["manage group #{new_resource.group_name}"] + change_desc) do
           manage_group
-          logger.info("#{new_resource} managed")
+          logger.info("#{new_resource} managed: #{change_desc.join(", ")}")
         end
       end
 
@@ -160,7 +168,7 @@ class Chef
 
         converge_by(["modify group #{new_resource.group_name}"] + change_desc) do
           manage_group
-          logger.info("#{new_resource} modified")
+          logger.info("#{new_resource} modified: #{change_desc.join(", ")}")
         end
       end
 

data/lib/chef/provider/group/windows.rb

@@ -33,6 +33,17 @@ class Chef
           @net_group = Chef::Util::Windows::NetGroup.new(new_resource.group_name)
         end
 
+        def group_members_match?
+          sorted_members_sids = new_resource.members.map { |x| lookup_account_name(x) }.sort
+          sorted_current_sids = current_resource.members.sort
+          Chef::Log.debug("#{new_resource.name}: current_members: #{sorted_current_sids} vs new_members #{sorted_members_sids}")
+          sorted_members_sids == sorted_current_sids
+        end
+
+        def group_gid_match?
+          true
+        end
+
         def load_current_resource
           @current_resource = Chef::Resource::Group.new(new_resource.name)
           current_resource.group_name(new_resource.group_name)
@@ -74,7 +85,7 @@ class Chef
               members_to_be_removed << member if has_current_group_member?(member)
             end
             @net_group.local_delete_members(members_to_be_removed) unless members_to_be_removed.empty?
-          else
+          elsif !group_members_match?
             @net_group.local_set_members(new_resource.members)
           end
           @net_group.local_group_set_info(new_resource.comment) if new_resource.comment

data/lib/chef/provider/ifconfig.rb

@@ -126,18 +126,18 @@ class Chef
               elsif line.match(addr_regex)[3] == ""
                 @int_name = line.match(addr_regex)[1]
                 @interfaces[@int_name] = {}
-                @interfaces[@int_name]["mtu"] = (line =~ /mtu (\S+)/ ? Regexp.last_match(1) : "nil") if line =~ /mtu/ && @interfaces[@int_name]["mtu"].nil?
+                @interfaces[@int_name]["mtu"] = (line =~ /mtu (\S+)/ ? Regexp.last_match(1) : "nil") if line.include?("mtu") && @interfaces[@int_name]["mtu"].nil?
               else
                 @int_name = "#{line.match(addr_regex)[1]}:#{line.match(addr_regex)[3]}"
                 @interfaces[@int_name] = {}
-                @interfaces[@int_name]["mtu"] = (line =~ /mtu (\S+)/ ? Regexp.last_match(1) : "nil") if line =~ /mtu/ && @interfaces[@int_name]["mtu"].nil?
+                @interfaces[@int_name]["mtu"] = (line =~ /mtu (\S+)/ ? Regexp.last_match(1) : "nil") if line.include?("mtu") && @interfaces[@int_name]["mtu"].nil?
               end
             else
-              @interfaces[@int_name]["inet_addr"] = (line =~ /inet (\S+)/ ? Regexp.last_match(1) : "nil") if line =~ /inet/ && @interfaces[@int_name]["inet_addr"].nil?
-              @interfaces[@int_name]["bcast"] = (line =~ /broadcast (\S+)/ ? Regexp.last_match(1) : "nil") if line =~ /broadcast/ && @interfaces[@int_name]["bcast"].nil?
-              @interfaces[@int_name]["mask"] = (line =~ /netmask (\S+)/ ? Regexp.last_match(1) : "nil") if line =~ /netmask/ && @interfaces[@int_name]["mask"].nil?
-              @interfaces[@int_name]["hwaddr"] = (line =~ /ether (\S+)/ ? Regexp.last_match(1) : "nil") if line =~ /ether/ && @interfaces[@int_name]["hwaddr"].nil?
-              @interfaces[@int_name]["metric"] = (line =~ /Metric:(\S+)/ ? Regexp.last_match(1) : "nil") if line =~ /Metric:/ && @interfaces[@int_name]["metric"].nil?
+              @interfaces[@int_name]["inet_addr"] = (line =~ /inet (\S+)/ ? Regexp.last_match(1) : "nil") if line.include?("inet") && @interfaces[@int_name]["inet_addr"].nil?
+              @interfaces[@int_name]["bcast"] = (line =~ /broadcast (\S+)/ ? Regexp.last_match(1) : "nil") if line.include?("broadcast") && @interfaces[@int_name]["bcast"].nil?
+              @interfaces[@int_name]["mask"] = (line =~ /netmask (\S+)/ ? Regexp.last_match(1) : "nil") if line.include?("netmask") && @interfaces[@int_name]["mask"].nil?
+              @interfaces[@int_name]["hwaddr"] = (line =~ /ether (\S+)/ ? Regexp.last_match(1) : "nil") if line.include?("ether") && @interfaces[@int_name]["hwaddr"].nil?
+              @interfaces[@int_name]["metric"] = (line =~ /Metric:(\S+)/ ? Regexp.last_match(1) : "nil") if line.include?("Metric:") && @interfaces[@int_name]["metric"].nil?
             end
 
             next unless @interfaces.key?(new_resource.device)
@@ -236,7 +236,7 @@ class Chef
         return unless can_generate_config?
 
         b = binding
-        template = ::ERB.new(@config_template)
+        template = ::ERB.new(@config_template, nil, "-")
         config = resource_for_config(@config_path)
         config.content(template.result(b))
         config.run_action(:create)

data/lib/chef/provider/ifconfig/debian.rb

@@ -23,8 +23,7 @@ class Chef
   class Provider
     class Ifconfig
       class Debian < Chef::Provider::Ifconfig
-        provides :ifconfig, platform: %w{ubuntu}, platform_version: ">= 11.10"
-        provides :ifconfig, platform: %w{debian}, platform_version: ">= 7.0"
+        provides :ifconfig, platform_family: %w{debian}
 
         INTERFACES_FILE = "/etc/network/interfaces".freeze
         INTERFACES_DOT_D_DIR = "/etc/network/interfaces.d".freeze
@@ -32,25 +31,43 @@ class Chef
         def initialize(new_resource, run_context)
           super(new_resource, run_context)
           @config_template = %{
-<% if new_resource.device %>
-<% if new_resource.onboot == "yes" %>auto <%= new_resource.device %><% end %>
+<% if new_resource.device -%>
+<% if new_resource.onboot == "yes" -%>
+auto <%= new_resource.device %>
+<% end -%>
 <% case new_resource.bootproto
-   when "dhcp" %>
+   when "dhcp" -%>
 iface <%= new_resource.device %> <%= new_resource.family %> dhcp
-<% when "bootp" %>
+<% when "bootp" -%>
 iface <%= new_resource.device %> <%= new_resource.family %> bootp
-<% else %>
+<% else -%>
 iface <%= new_resource.device %> <%= new_resource.family %> static
-    <% if new_resource.target %>address <%= new_resource.target %><% end %>
-    <% if new_resource.mask %>netmask <%= new_resource.mask %><% end %>
-    <% if new_resource.network %>network <%= new_resource.network %><% end %>
-    <% if new_resource.bcast %>broadcast <%= new_resource.bcast %><% end %>
-    <% if new_resource.metric %>metric <%= new_resource.metric %><% end %>
-    <% if new_resource.hwaddr %>hwaddress <%= new_resource.hwaddr %><% end %>
-    <% if new_resource.mtu %>mtu <%= new_resource.mtu %><% end %>
-    <% if new_resource.gateway %>gateway <%= new_resource.gateway %><% end %>
-<% end %>
-<% end %>
+    <% if new_resource.target -%>
+    address <%= new_resource.target %>
+    <% end -%>
+    <% if new_resource.mask -%>
+    netmask <%= new_resource.mask %>
+    <% end -%>
+    <% if new_resource.network -%>
+    network <%= new_resource.network %>
+    <% end -%>
+    <% if new_resource.bcast -%>
+    broadcast <%= new_resource.bcast %>
+    <% end -%>
+    <% if new_resource.metric -%>
+    metric <%= new_resource.metric %>
+    <% end -%>
+    <% if new_resource.hwaddr -%>
+    hwaddress <%= new_resource.hwaddr %>
+    <% end -%>
+    <% if new_resource.mtu -%>
+    mtu <%= new_resource.mtu %>
+    <% end -%>
+    <% if new_resource.gateway -%>
+    gateway <%= new_resource.gateway %>
+    <% end -%>
+<% end -%>
+<% end -%>
           }
           @config_path = "#{INTERFACES_DOT_D_DIR}/ifcfg-#{new_resource.device}"
         end
@@ -63,13 +80,12 @@ iface <%= new_resource.device %> <%= new_resource.family %> static
         protected
 
         def enforce_interfaces_dot_d_sanity
-          # on ubuntu 18.04 there's no interfaces file and it uses interfaces.d by default
+          # on ubuntu 18.04+ there's no interfaces file and it uses interfaces.d by default
           return if ::File.directory?(INTERFACES_DOT_D_DIR) && !::File.exist?(INTERFACES_FILE)
 
-          # create /etc/network/interfaces.d via dir resource (to get reporting, etc)
-          dir = Chef::Resource::Directory.new(INTERFACES_DOT_D_DIR, run_context)
-          dir.run_action(:create)
-          new_resource.updated_by_last_action(true) if dir.updated_by_last_action?
+          # create /etc/network/interfaces.d via dir if it's missing
+          directory INTERFACES_DOT_D_DIR
+
           # roll our own file_edit resource, this will not get reported until we have a file_edit resource
           interfaces_dot_d_for_regexp = INTERFACES_DOT_D_DIR.gsub(/\./, '\.') # escape dots for the regexp
           regexp = %r{^\s*source\s+#{interfaces_dot_d_for_regexp}/\*\s*$}