chef 16.5.77-universal-mingw32 → 16.10.8-universal-mingw32

data/lib/chef/environment.rb

@@ -35,7 +35,7 @@ class Chef
     include Chef::Mixin::ParamsValidate
     include Chef::Mixin::FromFile
 
-    COMBINED_COOKBOOK_CONSTRAINT = /(.+)(?:[\s]+)((?:#{Chef::VersionConstraint::OPS.join('|')})(?:[\s]+).+)$/.freeze
+    COMBINED_COOKBOOK_CONSTRAINT = /(.+)(?:\s+)((?:#{Chef::VersionConstraint::OPS.join('|')})(?:\s+).+)$/.freeze
 
     def initialize(chef_server_rest: nil)
       @name = ""

data/lib/chef/exceptions.rb

@@ -84,11 +84,13 @@ class Chef
     class InvalidPrivateKey < ArgumentError; end
     class MissingKeyAttribute < ArgumentError; end
     class KeyCommandInputError < ArgumentError; end
+
     class BootstrapCommandInputError < ArgumentError
       def initialize
         super "You cannot pass both --json-attributes and --json-attribute-file. Please pass one or none."
       end
     end
+
     class InvalidKeyArgument < ArgumentError; end
     class InvalidKeyAttribute < ArgumentError; end
     class InvalidUserAttribute < ArgumentError; end
@@ -195,6 +197,7 @@ class Chef
     class IllegalVersionConstraint < NotImplementedError; end # rubocop:disable Lint/InheritException
 
     class MetadataNotValid < StandardError; end
+
     class MetadataNotFound < StandardError
       attr_reader :install_path
       attr_reader :cookbook_name
@@ -283,6 +286,7 @@ class Chef
       end
 
     end
+
     # Exception class for collecting multiple failures. Used when running
     # delayed notifications so that chef can process each delayed
     # notification even if chef client or other notifications fail.
@@ -451,7 +455,7 @@ class Chef
       attr_reader :wrapped_errors
 
       def initialize(*errors)
-        errors = errors.select { |e| !e.nil? }
+        errors = errors.compact
         output = "Found #{errors.size} errors, they are stored in the backtrace"
         @wrapped_errors = errors
         super output

data/lib/chef/file_access_control/windows.rb

@@ -33,7 +33,7 @@ class Chef
       module ClassMethods
         # We want to mix these in as class methods
         def writable?(path)
-          ::File.exists?(path) && Chef::ReservedNames::Win32::File.file_access_check(
+          ::File.exist?(path) && Chef::ReservedNames::Win32::File.file_access_check(
             path, Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_WRITE
           )
         end
@@ -136,7 +136,7 @@ class Chef
       end
 
       def should_update_dacl?
-        return true unless ::File.exists?(file) || ::File.symlink?(file)
+        return true unless ::File.exist?(file) || ::File.symlink?(file)
 
         dacl = target_dacl
         existing_dacl = existing_descriptor.dacl
@@ -170,7 +170,7 @@ class Chef
       end
 
       def should_update_group?
-        return true unless ::File.exists?(file) || ::File.symlink?(file)
+        return true unless ::File.exist?(file) || ::File.symlink?(file)
 
         (group = target_group) && (group != existing_descriptor.group)
       end
@@ -190,7 +190,7 @@ class Chef
       end
 
       def should_update_owner?
-        return true unless ::File.exists?(file) || ::File.symlink?(file)
+        return true unless ::File.exist?(file) || ::File.symlink?(file)
 
         (owner = target_owner) && (owner != existing_descriptor.owner)
       end
@@ -255,10 +255,7 @@ class Chef
             flags |= CONTAINER_INHERIT_ACE
           when :objects_only
             flags |= OBJECT_INHERIT_ACE
-          when true
-            flags |= CONTAINER_INHERIT_ACE
-            flags |= OBJECT_INHERIT_ACE
-          when nil
+          when true, nil
             flags |= CONTAINER_INHERIT_ACE
             flags |= OBJECT_INHERIT_ACE
           end

data/lib/chef/file_cache.rb

@@ -79,7 +79,7 @@ class Chef
 
         file_path_array = File.split(path)
         file_name = file_path_array.pop
-        if File.exists?(file) && File.writable?(file)
+        if File.exist?(file) && File.writable?(file)
           FileUtils.mv(
             file,
             File.join(create_cache_path(File.join(file_path_array), true), file_name)
@@ -112,7 +112,7 @@ class Chef
           }
         )
         cache_path = create_cache_path(path, false)
-        raise Chef::Exceptions::FileNotFound, "Cannot find #{cache_path} for #{path}!" unless File.exists?(cache_path)
+        raise Chef::Exceptions::FileNotFound, "Cannot find #{cache_path} for #{path}!" unless File.exist?(cache_path)
 
         if read
           File.read(cache_path)
@@ -139,7 +139,7 @@ class Chef
           }
         )
         cache_path = create_cache_path(path, false)
-        if File.exists?(cache_path)
+        if File.exist?(cache_path)
           File.unlink(cache_path)
         end
         true
@@ -186,7 +186,7 @@ class Chef
           }
         )
         full_path = create_cache_path(path, false)
-        if File.exists?(full_path)
+        if File.exist?(full_path)
           true
         else
           false

data/lib/chef/formatters/error_inspectors/compile_error_inspector.rb

@@ -115,14 +115,14 @@ class Chef
 
         def culprit_line
           @culprit_line ||= begin
-            line_number = culprit_backtrace_entry[/^(?:.\:)?[^:]+:([\d]+)/, 1].to_i
+            line_number = culprit_backtrace_entry[/^(?:.\:)?[^:]+:(\d+)/, 1].to_i
             Chef::Log.trace("Line number of compile error: '#{line_number}'")
             line_number
           end
         end
 
         def culprit_file
-          @culprit_file ||= culprit_backtrace_entry[/^((?:.\:)?[^:]+):([\d]+)/, 1]
+          @culprit_file ||= culprit_backtrace_entry[/^((?:.\:)?[^:]+):(\d+)/, 1]
         end
 
         def filtered_bt

data/lib/chef/formatters/error_inspectors/resource_failure_inspector.rb

@@ -66,7 +66,7 @@ class Chef
 
           @snippet ||= begin
             if (file = parse_source) && (line = parse_line(file))
-              return nil unless ::File.exists?(file)
+              return nil unless ::File.exist?(file)
 
               lines = IO.readlines(file)
 
@@ -79,8 +79,8 @@ class Chef
               loop do
 
                 # low rent parser. try to gracefully handle nested blocks in resources
-                nesting += 1 if /[\s]+do[\s]*/.match?(lines[current_line])
-                nesting -= 1 if /end[\s]*$/.match?(lines[current_line])
+                nesting += 1 if /\s+do\s*/.match?(lines[current_line])
+                nesting -= 1 if /end\s*$/.match?(lines[current_line])
 
                 relevant_lines << format_line(current_line, lines[current_line])
 
@@ -114,11 +114,11 @@ class Chef
         end
 
         def parse_source
-          resource.source_line[/^(([\w]:)?[^:]+):([\d]+)/, 1]
+          resource.source_line[/^((\w:)?[^:]+):(\d+)/, 1]
         end
 
         def parse_line(source)
-          resource.source_line[/^#{Regexp.escape(source)}:([\d]+)/, 1].to_i
+          resource.source_line[/^#{Regexp.escape(source)}:(\d+)/, 1].to_i
         end
 
       end

data/lib/chef/guard_interpreter/resource_guard_interpreter.rb

@@ -20,19 +20,30 @@ require_relative "../guard_interpreter"
 
 class Chef
   class GuardInterpreter
-    class ResourceGuardInterpreter < DefaultGuardInterpreter
-
+    class ResourceGuardInterpreter
       def initialize(parent_resource, command, opts)
-        super(command, opts)
+        @command = command
+        @opts = opts
+
         @parent_resource = parent_resource
         @resource = get_interpreter_resource(parent_resource)
       end
 
+      # This class used to inherit from DefaultGuardInterpreter and it responds
+      # to #output, so leave this in for potential backwards compatibility.
+      def output
+        nil
+      end
+
       def evaluate
         # Add attributes inherited from the parent class
         # to the resource
         merge_inherited_attributes
 
+        @opts.each do |attribute, value|
+          @resource.send(attribute, value)
+        end
+
         # Only execute and script resources and use guard attributes.
         # The command to be executed on them are passed via different attributes.
         # Script resources use code attribute and execute resources use
@@ -42,9 +53,9 @@ class Chef
         # We need to make sure we check for Script first because any resource
         # that can get to here is an Execute resource.
         if @resource.is_a? Chef::Resource::Script
-          block_attributes = @command_opts.merge({ code: @command })
+          @resource.code @command
         else
-          block_attributes = @command_opts.merge({ command: @command })
+          @resource.command @command
         end
 
         # Handles cases like powershell_script where default
@@ -53,33 +64,24 @@ class Chef
         # the one attribute that causes this changes its default to be
         # the same after some period to prepare for deprecation
         if @resource.class.respond_to?(:get_default_attributes)
-          block_attributes = @resource.class.send(:get_default_attributes, @command_opts).merge(block_attributes)
+          @resource.class.send(:get_default_attributes).each do |attribute, value|
+            @resource.send(attribute, value)
+          end
         end
 
-        resource_block = block_from_attributes(block_attributes)
-        evaluate_action(nil, &resource_block)
-      end
-
-      protected
-
-      def evaluate_action(action = nil, &block)
-        @resource.instance_eval(&block)
-
-        run_action = action || @resource.action
-
         begin
           # Coerce to an array to be safe. This could happen with a legacy
           # resource or something overriding the default_action code in a
           # subclass.
-          Array(run_action).each { |action_to_run| @resource.run_action(action_to_run) }
-          resource_updated = @resource.updated
+          Array(@resource.action).each { |action_to_run| @resource.run_action(action_to_run) }
+          @resource.updated
         rescue Mixlib::ShellOut::ShellCommandFailed
-          resource_updated = nil
+          nil
         end
-
-        resource_updated
       end
 
+      private
+
       def get_interpreter_resource(parent_resource)
         if parent_resource.nil? || parent_resource.node.nil?
           raise ArgumentError, "Node for guard resource parent must not be nil"
@@ -106,14 +108,6 @@ class Chef
         interpreter_resource
       end
 
-      def block_from_attributes(attributes)
-        Proc.new do
-          attributes.each_key do |attribute_name|
-            send(attribute_name, attributes[attribute_name]) if respond_to?(attribute_name)
-          end
-        end
-      end
-
       def merge_inherited_attributes
         inherited_attributes = []
 
@@ -121,15 +115,10 @@ class Chef
           inherited_attributes = @parent_resource.class.send(:guard_inherited_attributes)
         end
 
-        if inherited_attributes && !inherited_attributes.empty?
-          inherited_attributes.each do |attribute|
-            if @parent_resource.respond_to?(attribute) && @resource.respond_to?(attribute)
-              parent_value = @parent_resource.send(attribute)
-              child_value = @resource.send(attribute)
-              if parent_value || child_value
-                @resource.send(attribute, parent_value)
-              end
-            end
+        inherited_attributes.each do |attribute|
+          if @parent_resource.respond_to?(attribute) && @resource.respond_to?(attribute)
+            parent_value = @parent_resource.send(attribute)
+            @resource.send(attribute, parent_value)
           end
         end
       end

data/lib/chef/handler/json_file.rb

@@ -51,7 +51,7 @@ class Chef
       end
 
       def build_report_dir
-        unless File.exists?(config[:path])
+        unless File.exist?(config[:path])
           FileUtils.mkdir_p(config[:path])
           File.chmod(00700, config[:path])
         end

data/lib/chef/http/basic_client.rb

@@ -22,7 +22,7 @@
 #
 autoload :URI, "uri"
 module Net
-  autoload :HTTP, File.expand_path("../monkey_patches/net_http", __dir__)
+  autoload :HTTP, "net/http"
 end
 require_relative "ssl_policies"
 require_relative "http_request"

data/lib/chef/http/http_request.rb

@@ -23,7 +23,7 @@
 autoload :URI, "uri"
 autoload :CGI, "cgi"
 module Net
-  autoload :HTTP, File.expand_path("../monkey_patches/net_http", __dir__)
+  autoload :HTTP, "net/http"
 end
 require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 

data/lib/chef/http/socketless_chef_zero_client.rb

@@ -46,7 +46,7 @@
 require "chef_zero/server"
 require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 module Net
-  autoload :HTTPResponse, File.expand_path("../monkey_patches/net_http", __dir__)
+  autoload :HTTPResponse, "net/http"
 end
 
 class Chef

data/lib/chef/http/ssl_policies.rb

@@ -70,6 +70,12 @@ class Chef
           end
 
           http_client.ca_file = config[:ssl_ca_file]
+        elsif ENV["SSL_CERT_FILE"]
+          unless ::File.exist?(ENV["SSL_CERT_FILE"])
+            raise Chef::Exceptions::ConfigurationError, "The configured ssl_ca_file #{ENV["SSL_CERT_FILE"]} does not exist"
+          end
+
+          http_client.ca_file = ENV["SSL_CERT_FILE"]
         end
       end
 
@@ -79,28 +85,41 @@ class Chef
           http_client.cert_store.set_default_paths
         end
         if config.trusted_certs_dir
-          certs = Dir.glob(File.join(Chef::Util::PathHelper.escape_glob_dir(config.trusted_certs_dir), "*.{crt,pem}"))
+          certs = Dir.glob(::File.join(Chef::Util::PathHelper.escape_glob_dir(config.trusted_certs_dir), "*.{crt,pem}"))
           certs.each do |cert_file|
-            cert = OpenSSL::X509::Certificate.new(File.read(cert_file))
+            cert = begin
+              OpenSSL::X509::Certificate.new(::File.binread(cert_file))
+                   rescue OpenSSL::X509::CertificateError => e
+                     raise Chef::Exceptions::ConfigurationError, "Error reading cert file '#{cert_file}', original error '#{e.class}: #{e.message}'"
+            end
             add_trusted_cert(cert)
           end
         end
       end
 
       def set_client_credentials
-        if config[:ssl_client_cert] || config[:ssl_client_key]
-          unless config[:ssl_client_cert] && config[:ssl_client_key]
-            raise Chef::Exceptions::ConfigurationError, "You must configure ssl_client_cert and ssl_client_key together"
-          end
-          unless ::File.exists?(config[:ssl_client_cert])
-            raise Chef::Exceptions::ConfigurationError, "The configured ssl_client_cert #{config[:ssl_client_cert]} does not exist"
-          end
-          unless ::File.exists?(config[:ssl_client_key])
-            raise Chef::Exceptions::ConfigurationError, "The configured ssl_client_key #{config[:ssl_client_key]} does not exist"
-          end
+        return unless config[:ssl_client_cert] || config[:ssl_client_key]
+
+        unless config[:ssl_client_cert] && config[:ssl_client_key]
+          raise Chef::Exceptions::ConfigurationError, "You must configure ssl_client_cert and ssl_client_key together"
+        end
+        unless ::File.exists?(config[:ssl_client_cert])
+          raise Chef::Exceptions::ConfigurationError, "The configured ssl_client_cert #{config[:ssl_client_cert]} does not exist"
+        end
+        unless ::File.exists?(config[:ssl_client_key])
+          raise Chef::Exceptions::ConfigurationError, "The configured ssl_client_key #{config[:ssl_client_key]} does not exist"
+        end
+
+        begin
+          http_client.cert = OpenSSL::X509::Certificate.new(::File.binread(config[:ssl_client_cert]))
+        rescue OpenSSL::X509::CertificateError => e
+          raise Chef::Exceptions::ConfigurationError, "Error reading cert file '#{config[:ssl_client_cert]}', original error '#{e.class}: #{e.message}'"
+        end
 
-          http_client.cert = OpenSSL::X509::Certificate.new(::File.read(config[:ssl_client_cert]))
-          http_client.key = OpenSSL::PKey::RSA.new(::File.read(config[:ssl_client_key]))
+        begin
+          http_client.key = OpenSSL::PKey::RSA.new(::File.binread(config[:ssl_client_key]))
+        rescue OpenSSL::PKey::RSAError => e
+          raise Chef::Exceptions::ConfigurationError, "Error reading key file '#{config[:ssl_client_key]}', original error '#{e.class}: #{e.message}'"
         end
       end
 

data/lib/chef/http.rb

@@ -25,8 +25,8 @@ require "tempfile" unless defined?(Tempfile)
 autoload :OpenSSL, "openssl"
 autoload :URI, "uri"
 module Net
-  autoload :HTTP, File.expand_path("monkey_patches/net_http", __dir__)
-  autoload :HTTPClientException, File.expand_path("monkey_patches/net_http", __dir__)
+  autoload :HTTP, "net/http"
+  autoload :HTTPClientException, "net/http"
 end
 require_relative "http/basic_client"
 require_relative "config"
@@ -165,10 +165,6 @@ class Chef
       end
     rescue Exception => exception
       log_failed_request(response, return_value) unless response.nil?
-
-      if exception.respond_to?(:chef_rest_request=)
-        exception.chef_rest_request = rest_request
-      end
       raise
     end
 
@@ -204,9 +200,6 @@ class Chef
       end
     rescue Exception => e
       log_failed_request(response, return_value) unless response.nil?
-      if e.respond_to?(:chef_rest_request=)
-        e.chef_rest_request = rest_request
-      end
       raise
     end
 
@@ -260,9 +253,6 @@ class Chef
       end
     rescue Exception => e
       log_failed_request(response, return_value) unless response.nil?
-      if e.respond_to?(:chef_rest_request=)
-        e.chef_rest_request = rest_request
-      end
       raise
     end
 

data/lib/chef/json_compat.rb

@@ -24,18 +24,15 @@ require "json" unless defined?(JSON)
 
 class Chef
   class JSONCompat
-    JSON_MAX_NESTING = 1000
 
     class <<self
 
-      # API to use to avoid create_additions
       def parse(source, opts = {})
         FFI_Yajl::Parser.parse(source, opts)
       rescue FFI_Yajl::ParseError => e
         raise Chef::Exceptions::JSON::ParseError, e.message
       end
 
-      # Just call the JSON gem's parse method with a modified :max_nesting field
       def from_json(source, opts = {})
         obj = parse(source, opts)
 
@@ -56,10 +53,8 @@ class Chef
       end
 
       def to_json_pretty(obj, opts = nil)
-        opts ||= {}
-        options_map = {}
-        options_map[:pretty] = true
-        options_map[:indent] = opts[:indent] if opts.key?(:indent)
+        options_map = { pretty: true }
+        options_map[:indent] = opts[:indent] if opts.respond_to?(:key?) && opts.key?(:indent)
         to_json(obj, options_map).chomp
       end
 

data/lib/chef/key.rb

@@ -46,7 +46,7 @@ class Chef
       # Actor that the key is for, either a client or a user.
       @actor = actor
 
-      unless actor_field_name == "user" || actor_field_name == "client"
+      unless %w{user client}.include?(actor_field_name)
         raise Chef::Exceptions::InvalidKeyArgument, "the second argument to initialize must be either 'user' or 'client'"
       end
 

data/lib/chef/knife/bootstrap/templates/windows-chef-client-msi.erb

@@ -230,9 +230,9 @@ echo Writing validation key...
 echo Validation key written.
 @echo on
 
-<% if @config[:secret] -%>
+<% if secret -%>
 > <%= bootstrap_directory %>\encrypted_data_bag_secret (
- <%= secret %>
+ <%= encrypted_data_bag_secret %>
 )
 <% end -%>
 

data/lib/chef/knife/bootstrap/train_connector.rb

@@ -285,7 +285,7 @@ class Chef
           # Train.unpack_target_from_uri only works for complete URIs in
           # form of proto://[user[:pass]@]host[:port]/
           # So we'll add the protocol prefix if it's not supplied.
-          uri_to_check = if URI.regexp.match(uri)
+          uri_to_check = if URI::DEFAULT_PARSER.make_regexp.match(uri)
                            uri
                          else
                            "#{default_protocol}://#{uri}"

data/lib/chef/knife/bootstrap.rb

@@ -217,6 +217,16 @@ class Chef
         description: "Execute the bootstrap via sudo with password.",
         boolean: false
 
+      # runtime - su user
+      option :su_user,
+        long: "--su-user NAME",
+        description: "The su - USER name to perform bootstrap command using a non-root user."
+
+      # runtime - su user password
+      option :su_password,
+        long: "--su-password PASSWORD",
+        description: "The su USER password for authentication."
+
       # runtime - client_builder
       option :chef_node_name,
         short: "-N NAME",
@@ -330,7 +340,7 @@ class Chef
         long: "--bootstrap-vault-item VAULT_ITEM",
         description: 'A single vault and item to update as "vault:item".',
         proc: Proc.new { |i, accumulator|
-          (vault, item) = i.split(/:/)
+          (vault, item) = i.split(":")
           accumulator ||= {}
           accumulator[vault] ||= []
           accumulator[vault].push(item)
@@ -407,6 +417,7 @@ class Chef
       deps do
         require "erubis" unless defined?(Erubis)
 
+        require "net/ssh" unless defined?(Net::SSH)
         require_relative "../json_compat"
         require_relative "../util/path_helper"
         require_relative "bootstrap/chef_vault_handler"
@@ -590,13 +601,31 @@ class Chef
       def perform_bootstrap(remote_bootstrap_script_path)
         ui.info("Bootstrapping #{ui.color(server_name, :bold)}")
         cmd = bootstrap_command(remote_bootstrap_script_path)
-        r = connection.run_command(cmd) do |data|
+        bootstrap_run_command(cmd)
+      end
+
+      # Actual bootstrap command to be run on the node.
+      # Handles recursive calls if su USER failed to authenticate.
+      def bootstrap_run_command(cmd)
+        r = connection.run_command(cmd) do |data, channel|
           ui.msg("#{ui.color(" [#{connection.hostname}]", :cyan)} #{data}")
+          channel.send_data("#{config[:su_password] || config[:connection_password]}\n") if data.match?("Password:")
         end
+
         if r.exit_status != 0
           ui.error("The following error occurred on #{server_name}:")
-          ui.error(r.stderr)
-          exit 1
+          ui.error("#{r.stdout} #{r.stderr}".strip)
+          exit(r.exit_status)
+        end
+      rescue Train::UserError => e
+        limit ||= 0
+        if e.reason == :bad_su_user_password && limit < 3
+          limit += 1
+          ui.warn("Failed to authenticate su - #{config[:su_user]} to #{server_name}")
+          config[:su_password] = ui.ask("Enter password for su - #{config[:su_user]}@#{server_name}:", echo: false)
+          retry
+        else
+          raise
         end
       end
 
@@ -1081,7 +1110,17 @@ class Chef
         if connection.windows?
           "cmd.exe /C #{remote_path}"
         else
-          "sh #{remote_path}"
+          cmd = "sh #{remote_path}"
+
+          if config[:su_user]
+            # su - USER is subject to required an interactive console
+            # Otherwise, it will raise: su: must be run from a terminal
+            set_transport_options(pty: true)
+            cmd = "su - #{config[:su_user]} -c '#{cmd}'"
+            cmd = "sudo " << cmd if config[:use_sudo]
+          end
+
+          cmd
         end
       end
 
@@ -1136,6 +1175,18 @@ class Chef
 
         timeout.to_i
       end
+
+      # Train::Transports::SSH::Connection#transport_options
+      # Append the options to connection transport_options
+      #
+      # @param opts [Hash] the opts to be added to connection transport_options.
+      # @return [Hash] transport_options if the opts contains any option to be set.
+      #
+      def set_transport_options(opts)
+        return unless opts.is_a?(Hash) || !opts.empty?
+
+        connection&.connection&.transport_options&.merge! opts
+      end
     end
   end
 end

data/lib/chef/knife/config_show.rb

@@ -79,7 +79,7 @@ class Chef
               end
             else
               # It's a dotted path string.
-              filter_parts = filter.split(/\./)
+              filter_parts = filter.split(".")
               extract = lambda do |memo, filter_part|
                 memo.is_a?(Hash) ? memo[filter_part.to_sym] : nil
               end

data/lib/chef/knife/core/cookbook_scm_repo.rb

@@ -22,7 +22,7 @@ class Chef
   class Knife
     class CookbookSCMRepo
 
-      DIRTY_REPO = /^[\s]+M/.freeze
+      DIRTY_REPO = /^\s+M/.freeze
 
       include Chef::Mixin::ShellOut