chef 17.6.15-universal-mingw32 → 17.8.25-universal-mingw32

data/lib/chef/resource/windows_dfs_namespace.rb

@@ -38,7 +38,7 @@ class Chef
 
       property :full_users, Array,
         description: "Determines which users should have full access to the share.",
-        default: ['BUILTIN\\administrators']
+        default: ["BUILTIN\\administrators"]
 
       property :change_users, Array,
         description: "Determines which users should have change access to the share.",
@@ -50,7 +50,7 @@ class Chef
 
       property :root, String,
         description: "The root from which to create the DFS tree. Defaults to C:\\DFSRoots.",
-        default: 'C:\\DFSRoots'
+        default: "C:\\DFSRoots"
 
       action :create, description: "Creates the dfs namespace on the server." do
         directory file_path do

data/lib/chef/resource/windows_feature_powershell.rb

@@ -100,8 +100,8 @@ class Chef
             install_command << " -Source \"#{new_resource.source}\"" if new_resource.source
             install_command << " -IncludeManagementTools" if new_resource.management_tools
 
-            cmd = powershell_out!(install_command, timeout: new_resource.timeout)
-            Chef::Log.info(cmd.stdout)
+            cmd = powershell_exec!(install_command, timeout: new_resource.timeout)
+            Chef::Log.info(cmd.result)
 
             reload_cached_powershell_data # Reload cached powershell feature state
           end
@@ -115,8 +115,8 @@ class Chef
 
         unless features_to_remove.empty?
           converge_by("remove Windows feature#{"s" if features_to_remove.count > 1} #{features_to_remove.join(",")}") do
-            cmd = powershell_out!("Uninstall-WindowsFeature #{features_to_remove.join(",")}", timeout: new_resource.timeout)
-            Chef::Log.info(cmd.stdout)
+            cmd = powershell_exec!("Uninstall-WindowsFeature #{features_to_remove.join(",")}", timeout: new_resource.timeout)
+            Chef::Log.info(cmd.result)
 
             reload_cached_powershell_data # Reload cached powershell feature state
           end
@@ -132,8 +132,8 @@ class Chef
 
         unless features_to_delete.empty?
           converge_by("delete Windows feature#{"s" if features_to_delete.count > 1} #{features_to_delete.join(",")} from the image") do
-            cmd = powershell_out!("Uninstall-WindowsFeature #{features_to_delete.join(",")} -Remove", timeout: new_resource.timeout)
-            Chef::Log.info(cmd.stdout)
+            cmd = powershell_exec!("Uninstall-WindowsFeature #{features_to_delete.join(",")} -Remove", timeout: new_resource.timeout)
+            Chef::Log.info(cmd.result)
 
             reload_cached_powershell_data # Reload cached powershell feature state
           end
@@ -215,7 +215,7 @@ class Chef
         # fetch the list of available feature names and state in JSON and parse the JSON
         def parsed_feature_list
           # Grab raw feature information from WindowsFeature
-          raw_list_of_features = powershell_out!("Get-WindowsFeature | Select-Object -Property Name,InstallState | ConvertTo-Json -Compress", timeout: new_resource.timeout).stdout
+          raw_list_of_features = powershell_exec!("Get-WindowsFeature | Select-Object -Property Name,InstallState", timeout: new_resource.timeout).result
 
           Chef::JSONCompat.from_json(raw_list_of_features)
         end

data/lib/chef/resource/windows_update_settings.rb

@@ -145,7 +145,7 @@ class Chef
       action :set, description: "Set Windows Update settings." do
         actual_day = convert_day(new_resource.scheduled_install_day)
 
-        registry_key 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate' do
+        registry_key "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate" do
           recursive true
           values [{
             name: "DisableOSUpgrade",
@@ -180,7 +180,7 @@ class Chef
           action :create
         end
 
-        registry_key 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer' do
+        registry_key "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" do
           recursive true
           values [{
             name: "NoWindowsUpdate",
@@ -190,7 +190,7 @@ class Chef
           action :create
         end
 
-        registry_key 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU' do
+        registry_key "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU" do
           recursive true
           values [{
             name: "AUOptions",

data/lib/chef/resource.rb

@@ -454,7 +454,7 @@ class Chef
     # @param arg [String] The umask to apply while converging the resource.
     # @return [Boolean] The umask to apply while converging the resource.
     #
-    property :umask, String,
+    property :umask, [String, Integer],
       desired_state: false,
       introduced: "16.2",
       description: "Set a umask to be used for the duration of converging the resource. Defaults to `nil`, which means to use the system umask. Unsupported on Windows because Windows lacks a direct equivalent to UNIX's umask."
@@ -1508,7 +1508,7 @@ class Chef
     # @return Chef::CookbookVersion The cookbook in which this Resource was defined.
     #
     def cookbook_version
-      if cookbook_name
+      if cookbook_name && cookbook_name != "@recipe_files"
         run_context.cookbook_collection[cookbook_name]
       end
     end

data/lib/chef/resource_reporter.rb

@@ -41,7 +41,7 @@ class Chef
       as_hash["result"] = action_record.action.to_s
       if new_resource.cookbook_name
         as_hash["cookbook_name"] = new_resource.cookbook_name
-        as_hash["cookbook_version"] = new_resource.cookbook_version.version
+        as_hash["cookbook_version"] = new_resource.cookbook_version&.version
       end
 
       as_hash

data/lib/chef/secret_fetcher/azure_key_vault.rb

@@ -1,4 +1,6 @@
 require_relative "base"
+require_relative "../exceptions"
+require "uri" unless defined?(URI)
 
 class Chef
   class SecretFetcher
@@ -14,13 +16,19 @@ class Chef
     #
     # @example
     #
-    # fetcher = SecretFetcher.for_service(:azure_key_vault, { vault: "my_vault" }, run_context )
+    # fetcher = SecretFetcher.for_service(:azure_key_vault, { vault: "my_vault" }, run_context)
     # fetcher.fetch("secretkey1", "v1")
     #
     # @example
     #
-    # fetcher = SecretFetcher.for_service(:azure_key_vault, {}, run_context )
+    # fetcher = SecretFetcher.for_service(:azure_key_vault, {}, run_context)
     # fetcher.fetch("my_vault/secretkey1", "v1")
+    #
+    # @example
+    #
+    # fetcher = SecretFetcher.for_service(:azure_key_vault, { client_id: "540d76b6-7f76-456c-b68b-ccae4dc9d99d" }, run_context)
+    # fetcher.fetch("my_vault/secretkey1", "v1")
+    #
     class AzureKeyVault < Base
 
       def do_fetch(name, version)
@@ -48,6 +56,12 @@ class Chef
         end
       end
 
+      def validate!
+        raise Chef::Exceptions::Secret::ConfigurationInvalid, "You may only specify one (these are mutually exclusive): :object_id, :client_id, or :mi_res_id" if [object_id, client_id, mi_res_id].select { |x| !x.nil? }.length > 1
+      end
+
+      private
+
       # Determine the vault name and secret name from the provided name.
       # If it is not in the provided name in the form "vault_name/secret_name"
       # it will determine the vault name from `config[:vault]`.
@@ -63,16 +77,56 @@ class Chef
         end
       end
 
+      def api_version
+        "2018-02-01"
+      end
+
+      def resource
+        "https://vault.azure.net"
+      end
+
+      def object_id
+        config[:object_id]
+      end
+
+      def client_id
+        config[:client_id]
+      end
+
+      def mi_res_id
+        config[:mi_res_id]
+      end
+
+      def token_query
+        @token_query ||= begin
+          p = {}
+          p["api-version"] = api_version
+          p["resource"] = resource
+          p["object_id"] = object_id if object_id
+          p["client_id"] = client_id if client_id
+          p["mi_res_id"] = mi_res_id if mi_res_id
+          URI.encode_www_form(p)
+        end
+      end
+
       def fetch_token
-        token_uri = URI.parse("http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net")
+        token_uri = URI.parse("http://169.254.169.254/metadata/identity/oauth2/token")
+        token_uri.query = token_query
         http = Net::HTTP.new(token_uri.host, token_uri.port)
         response = http.get(token_uri, { "Metadata" => "true" })
-        body = JSON.parse(response.body)
-        body["access_token"]
+
+        case response
+        when Net::HTTPSuccess
+          body = JSON.parse(response.body)
+          body["access_token"]
+        when Net::HTTPBadRequest
+          body = JSON.parse(response.body)
+          raise Chef::Exceptions::Secret::Azure::IdentityNotFound if body["error_description"] =~ /identity not found/i
+        else
+          body = JSON.parse(response.body)
+          body["access_token"]
+        end
       end
     end
   end
 end
-
-
-

data/lib/chef/secret_fetcher.rb

@@ -58,4 +58,3 @@ class Chef
     end
   end
 end
-

data/lib/chef/version.rb

@@ -23,7 +23,7 @@ require_relative "version_string"
 
 class Chef
   CHEF_ROOT = File.expand_path("..", __dir__)
-  VERSION = Chef::VersionString.new("17.6.15")
+  VERSION = Chef::VersionString.new("17.8.25")
 end
 
 #

data/spec/functional/dsl/reboot_pending_spec.rb

@@ -39,8 +39,8 @@ describe Chef::DSL::RebootPending, :windows_only do
     let(:reg_key) { nil }
     let(:original_set) { false }
 
-    describe 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations' do
-      let(:reg_key) { 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager' }
+    describe "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\PendingFileRenameOperations" do
+      let(:reg_key) { "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }
       let(:original_set) { registry.value_exists?(reg_key, { name: "PendingFileRenameOperations" }) }
 
       it "returns true if the registry value exists" do
@@ -78,7 +78,7 @@ describe Chef::DSL::RebootPending, :windows_only do
 
     describe "when there is nothing to indicate a reboot is pending" do
       it "should return false" do
-        skip "reboot pending" if registry_value_exists?('HKLM\SYSTEM\CurrentControlSet\Control\Session Manager', { name: "PendingFileRenameOperations" }) ||
+        skip "reboot pending" if registry_value_exists?("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager", { name: "PendingFileRenameOperations" }) ||
           registry_key_exists?('HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired') ||
           registry_key_exists?('HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending')
         expect(recipe.reboot_pending?).to be_falsey

data/spec/functional/dsl/registry_helper_spec.rb

@@ -24,7 +24,7 @@ describe Chef::Resource::RegistryKey, :windows_only do
   before(:all) do
     ::Win32::Registry::HKEY_CURRENT_USER.create "Software\\Root"
     ::Win32::Registry::HKEY_CURRENT_USER.create "Software\\Root\\Branch"
-    ::Win32::Registry::HKEY_CURRENT_USER.open('Software\\Root', Win32::Registry::KEY_ALL_ACCESS) do |reg|
+    ::Win32::Registry::HKEY_CURRENT_USER.open("Software\\Root", Win32::Registry::KEY_ALL_ACCESS) do |reg|
       reg["RootType1", Win32::Registry::REG_SZ] = "fibrous"
       reg.write("Roots", Win32::Registry::REG_MULTI_SZ, ["strong roots", "healthy tree"])
     end

data/spec/functional/resource/dnf_package_spec.rb

@@ -455,7 +455,7 @@ describe Chef::Resource::DnfPackage, :requires_root, external: exclude_test do
     end
 
     context "downgrades" do
-      it "downgrades the package when allow_downgrade" do
+      it "downgrades the package when allow_downgrade is true" do
         flush_cache
         preinstall("chef_rpm-1.10-1.#{pkg_arch}.rpm")
         dnf_package "chef_rpm" do
@@ -470,6 +470,18 @@ describe Chef::Resource::DnfPackage, :requires_root, external: exclude_test do
           action :install
         end.should_not_be_updated
       end
+
+      it "does not downgrade the package when allow_downgrade is false" do
+        flush_cache
+        preinstall("chef_rpm-1.10-1.#{pkg_arch}.rpm")
+        dnf_package "chef_rpm" do
+          options default_options
+          allow_downgrade false
+          version "1.2-1"
+          action :install
+        end.should_not_be_updated
+        expect(shell_out("rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' chef_rpm").stdout.chomp).to match("^chef_rpm-1.10-1.#{pkg_arch}$")
+      end
     end
 
     context "with arches", :intel_64bit do
@@ -763,6 +775,17 @@ describe Chef::Resource::DnfPackage, :requires_root, external: exclude_test do
         end.should_not_be_updated
       end
 
+      it "downgrade on a local file with allow_downgrade false does not downgrade" do
+        preinstall("chef_rpm-1.10-1.#{pkg_arch}.rpm")
+        dnf_package "#{CHEF_SPEC_ASSETS}/yumrepo/chef_rpm-1.2-1.#{pkg_arch}.rpm" do
+          options default_options
+          allow_downgrade false
+          version "1.2-1"
+          action :install
+        end.should_not_be_updated
+        expect(shell_out("rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' chef_rpm").stdout.chomp).to match("^chef_rpm-1.10-1.#{pkg_arch}$")
+      end
+
       it "does not downgrade the package with :install" do
         preinstall("chef_rpm-1.10-1.#{pkg_arch}.rpm")
         dnf_package "#{CHEF_SPEC_ASSETS}/yumrepo/chef_rpm-1.2-1.#{pkg_arch}.rpm" do
@@ -1027,25 +1050,6 @@ describe Chef::Resource::DnfPackage, :requires_root, external: exclude_test do
           action :install
         end.should_not_be_updated
       end
-
-      it "throws a deprecation warning with allow_downgrade" do
-        Chef::Config[:treat_deprecation_warnings_as_errors] = false
-        expect(Chef).to receive(:deprecated).at_least(:once).with(:dnf_package_allow_downgrade, /^the allow_downgrade property on the dnf_package provider is not used/)
-        preinstall("chef_rpm-1.10-1.#{pkg_arch}.rpm")
-        dnf_package "chef_rpm" do
-          options default_options
-          version "1.2"
-          allow_downgrade true
-          action :install
-        end.should_be_updated
-        expect(shell_out("rpm -q chef_rpm").stdout.chomp).to match("^chef_rpm-1.2-1.#{pkg_arch}")
-        dnf_package "chef_rpm" do
-          options default_options
-          version "1.2"
-          allow_downgrade true
-          action :install
-        end.should_not_be_updated
-      end
     end
 
     context "with source arguments" do
@@ -1092,6 +1096,16 @@ describe Chef::Resource::DnfPackage, :requires_root, external: exclude_test do
         end.should_not_be_updated
       end
 
+      it "does not downgrade the package when allow_downgrade is false" do
+        preinstall("chef_rpm-1.10-1.#{pkg_arch}.rpm")
+        dnf_package "#{CHEF_SPEC_ASSETS}/yumrepo/chef_rpm-1.2-1.#{pkg_arch}.rpm" do
+          options default_options
+          allow_downgrade false
+          action :upgrade
+        end.should_not_be_updated
+        expect(shell_out("rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' chef_rpm").stdout.chomp).to match("^chef_rpm-1.10-1.#{pkg_arch}$")
+      end
+
       it "upgrades the package" do
         preinstall("chef_rpm-1.2-1.#{pkg_arch}.rpm")
         dnf_package "#{CHEF_SPEC_ASSETS}/yumrepo/chef_rpm-1.10-1.#{pkg_arch}.rpm" do

data/spec/functional/resource/dpkg_package_spec.rb

@@ -184,6 +184,22 @@ describe Chef::Resource::DpkgPackage, :requires_root, :debian_family_only, arch:
       dpkg_package.run_action(action)
       expect(dpkg_package).to be_updated_by_last_action
     end
+
+    it "should not allow downgrade a package" do
+      dpkg_package.allow_downgrade false
+      shell_out!("dpkg -i #{test1_1}")
+      set_dpkg_package_name test1_0
+      dpkg_package.run_action(action)
+      expect(dpkg_package).not_to be_updated_by_last_action
+    end
+
+    it "should allow downgrade a package" do
+      dpkg_package.allow_downgrade true
+      shell_out!("dpkg -i #{test1_1}")
+      set_dpkg_package_name test1_0
+      dpkg_package.run_action(action)
+      expect(dpkg_package).to be_updated_by_last_action
+    end
   end
 
   shared_examples_for "common behavior for remove or purge" do

data/spec/functional/resource/dsc_script_spec.rb

@@ -85,7 +85,7 @@ describe Chef::Resource::DscScript, :windows_powershell_dsc_only, :ruby64_only d
   let(:dsc_test_resource_base) do
     Chef::Resource::DscScript.new(dsc_test_resource_name, dsc_test_run_context)
   end
-  let(:test_registry_key) { 'HKEY_LOCAL_MACHINE\Software\Chef\Spec\Functional\Resource\dsc_script_spec' }
+  let(:test_registry_key) { "HKEY_LOCAL_MACHINE\\Software\\Chef\\Spec\\Functional\\Resource\\dsc_script_spec" }
   let(:test_registry_value) { "Registration" }
   let(:test_registry_data1) { "LL927" }
   let(:test_registry_data2) { "LL928" }
@@ -394,7 +394,7 @@ describe Chef::Resource::DscScript, :windows_powershell_dsc_only, :ruby64_only d
       dsc_test_run_context.node.consume_external_attrs(OHAI_SYSTEM.data, {})
     end
 
-    let(:configuration_data_path) { 'C:\\configurationdata.psd1' }
+    let(:configuration_data_path) { "C:\\configurationdata.psd1" }
 
     let(:self_signed_cert_path) do
       File.join(CHEF_SPEC_DATA, "dsc_lcm.pfx")

data/spec/functional/resource/macos_userdefaults_spec.rb

@@ -0,0 +1,139 @@
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+require "spec_helper"
+
+describe Chef::Resource::MacosUserDefaults, :macos_only do
+  def create_resource
+    node = Chef::Node.new
+    events = Chef::EventDispatch::Dispatcher.new
+    run_context = Chef::RunContext.new(node, {}, events)
+    resource = Chef::Resource::MacosUserDefaults.new("test", run_context)
+    resource
+  end
+
+  let(:resource) do
+    create_resource
+  end
+
+  context "has a default value" do
+    it ":macos_userdefaults for resource name" do
+      expect(resource.name).to eq("test")
+    end
+
+    it "NSGlobalDomain for the domain property" do
+      expect(resource.domain).to eq("NSGlobalDomain")
+    end
+
+    it "nil for the host property" do
+      expect(resource.host).to be_nil
+    end
+
+    it "nil for the user property" do
+      expect(resource.user).to be_nil
+    end
+
+    it ":write for resource action" do
+      expect(resource.action).to eq([:write])
+    end
+  end
+
+  it "supports :write, :delete actions" do
+    expect { resource.action :write }.not_to raise_error
+    expect { resource.action :delete }.not_to raise_error
+  end
+
+  context "can process expected data" do
+    it "set array values" do
+      resource.domain "/Library/Preferences/ManagedInstalls"
+      resource.key "TestArrayValues"
+      resource.value [ "/Library/Managed Installs/fake.log", "/Library/Managed Installs/also_fake.log"]
+      resource.run_action(:write)
+      expect(resource.get_preference resource).to eq([ "/Library/Managed Installs/fake.log", "/Library/Managed Installs/also_fake.log"])
+    end
+
+    it "set dictionary value" do
+      resource.domain "/Library/Preferences/ManagedInstalls"
+      resource.key "TestDictionaryValues"
+      resource.value "User": "/Library/Managed Installs/way_fake.log"
+      resource.run_action(:write)
+      expect(resource.get_preference resource).to eq("User" => "/Library/Managed Installs/way_fake.log")
+    end
+
+    it "set array of dictionaries" do
+      resource.domain "/Library/Preferences/ManagedInstalls"
+      resource.key "TestArrayWithDictionary"
+      resource.value [ { "User": "/Library/Managed Installs/way_fake.log" } ]
+      resource.run_action(:write)
+      expect(resource.get_preference resource).to eq([ { "User" => "/Library/Managed Installs/way_fake.log" } ])
+    end
+
+    it "set boolean for preference value" do
+      resource.domain "/Library/Preferences/ManagedInstalls"
+      resource.key "TestBooleanValue"
+      resource.value true
+      resource.run_action(:write)
+      expect(resource.get_preference resource).to eq(true)
+    end
+
+    it "sets value to global domain when domain is not passed" do
+      resource.key "TestKey"
+      resource.value 1
+      resource.run_action(:write)
+      expect(resource.get_preference resource).to eq(1)
+    end
+
+    it "short domain names" do
+      resource.domain "com.apple.dock"
+      resource.key "titlesize"
+      resource.value "20"
+      resource.run_action(:write)
+      expect(resource.get_preference resource).to eq("20")
+    end
+  end
+
+  it "we can delete a preference with full path" do
+    resource.domain "/Library/Preferences/ManagedInstalls"
+    resource.key "TestKey"
+    expect { resource.run_action(:delete) }. to_not raise_error
+  end
+
+  it "we can delete a preference with short name" do
+    resource.domain "com.apple.dock"
+    resource.key "titlesize"
+    expect { resource.run_action(:delete) }. to_not raise_error
+  end
+
+  context "resource can process FFI::Pointer type" do
+    it "for host property" do
+      resource.domain "/Library/Preferences/ManagedInstalls"
+      resource.key "TestDictionaryValues"
+      resource.value "User": "/Library/Managed Installs/way_fake.log"
+      resource.host :current
+      resource.run_action(:write)
+      expect { resource.run_action(:write) }. to_not raise_error
+    end
+
+    it "for user property" do
+      resource.domain "/Library/Preferences/ManagedInstalls"
+      resource.key "TestDictionaryValues"
+      resource.value "User": "/Library/Managed Installs/way_fake.log"
+      resource.user :current
+      resource.run_action(:write)
+      expect { resource.run_action(:write) }. to_not raise_error
+    end
+  end
+end