chef 17.9.52-universal-mingw32 → 17.10.68-universal-mingw32

data/spec/functional/resource/windows_certificate_spec.rb

@@ -56,10 +56,34 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
   let(:store) { "Chef-Functional-Test" }
   let(:store_name) { "MY" }
   let(:store_location) { "LocalMachine" }
-  let(:download_cert_url) { "https://testingchef.blob.core.windows.net/files/test.cer" }
+  let(:test_cert_body) do
+    <<~CERT
+-----BEGIN CERTIFICATE-----
+MIIDQTCCAimgAwIBAgIQX3zqNCJbsKlEvzCz3Z9aNDANBgkqhkiG9w0BAQsFADAh
+MR8wHQYDVQQDDBZ3d3cuZHVtbXljaGVmdGVzdHMuY29tMCAXDTIwMDMwNTEwMjcw
+NVoYDzIxMjAwMzA1MTAzNzA2WjAhMR8wHQYDVQQDDBZ3d3cuZHVtbXljaGVmdGVz
+dHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuYKDb6woWIH
+HPPOrcVpgJFVxbkjgk+tsYwbIiqR9jtRaKE6nM/awOgn9/dFF4k8KB8Em0sUx7Vq
+J3YhK2N2cAacgP2Frqqf5znpNBBOg968RoZzGx0EiXFvLsqC4y8ggApWTbMXPRk4
+1a7GlpUpSqI3y5cLeEbzwGQKu8I1I+v7P2fTlnJPHarM7sBbL8bieukkFHYu78iV
+u1wpKOCCfs5DTmJu8WN+z1Mar9vyrWMBlt2wBBgNHPz5mcXUzJHTzaI/D9RGgBgF
+V0IkNqISx/IzR62jjj2g6MgTH4G/0mM6O5sxduM4yGmWZNZpVzh0yMLgH619MZlj
+SMQIN3U/SQIDAQABo3MwcTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB
+BQUHAwIGCCsGAQUFBwMBMCEGA1UdEQQaMBiCFnd3dy5kdW1teWNoZWZ0ZXN0cy5j
+b20wHQYDVR0OBBYEFHwS3gs03m6RcpR+66u4OqGiZdYnMA0GCSqGSIb3DQEBCwUA
+A4IBAQCFHqMjHUfBZahIsKHQIcFCbC1NFh1ZHlJKZzrRBRwRzX19OttHGMyLpDd6
+tM9Ac6LLR8S4QIWg+HF3IrkN+vfTRDZAccj+tIwBRstmdsEz/rAJ79Vb/00mXZQx
+0FPiBDR3hE7On2oo24DU8kJP3v6TrunwtIomVGqrrkwZzvxqyW+WJMB2shGNFw5J
+mKYBiiXsHl4Bi7V4zhXssrLp877sqpNLeXloXBmAlT39SwQTP9ImZaV5R6udqlvo
+Gfgm5PH/WeK6MV3n5ik0v1rS0LwR2o82WlIB6a4iSEbzY3qSLsWOwt8o5QjAVzCR
+tNdbdS3U8nrG73iA2clmF57ARQWC
+-----END CERTIFICATE-----
+    CERT
+  end
   let(:cert_output_path) { ::File.join(Chef::Config[:file_cache_path], "output.cer") }
   let(:pfx_output_path) { ::File.join(Chef::Config[:file_cache_path], "output.pfx") }
   let(:key_output_path) { ::File.join(Chef::Config[:file_cache_path], "output.key") }
+  let(:download_cert_url) { "https://testingchef.blob.core.windows.net/files/test.cer" }
   let(:cer_path) { File.join(CHEF_SPEC_DATA, "windows_certificates", "test.cer") }
   let(:base64_path) { File.join(CHEF_SPEC_DATA, "windows_certificates", "base64_test.cer") }
   let(:pem_path) { File.join(CHEF_SPEC_DATA, "windows_certificates", "test.pem") }
@@ -89,7 +113,9 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
 
   end
 
-  after { delete_store }
+  after do
+    delete_store
+  end
 
   describe "action: create" do
     it "starts with no certificates" do
@@ -126,6 +152,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
     end
 
     it "can add a certificate from a valid url" do
+      stub_request(:get, download_cert_url).to_return(body: test_cert_body)
       resource.source = download_cert_url
       resource.run_action(:create)
 
@@ -195,7 +222,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
       create_store
     end
     it "fails with no certificates in the store" do
-      expect(Chef::Log).to receive(:info).with("Certificate not found")
+      expect(Chef::Log).to receive(:info).with("Certificate not valid")
 
       resource.source = tests_thumbprint
       resource.run_action(:verify)
@@ -219,7 +246,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
       end
 
       it "fails with an invalid thumbprint" do
-        expect(Chef::Log).to receive(:info).with("Certificate not found")
+        expect(Chef::Log).to receive(:info).with("Certificate not valid")
 
         resource.source = others_thumbprint
         resource.run_action(:verify)
@@ -253,7 +280,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
       end
 
       it "fails with an invalid thumbprint" do
-        expect(Chef::Log).to receive(:info).with("Certificate not found")
+        expect(Chef::Log).to receive(:info).with("Certificate not valid")
 
         resource.source = others_thumbprint
         resource.run_action(:verify)
@@ -265,11 +292,11 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
 
   describe "action: fetch" do
     context "with no certificate in the store" do
-      it "throws an error with no certificates in the store" do
-        expect(Chef::Log).not_to receive(:info)
+      it "logs a debug error with no certificates in the store" do
+        expect(Chef::Log).to receive(:debug).with("Certificate Not Found")
         resource.source = others_thumbprint
         resource.output_path = cert_output_path
-        expect { resource.run_action :fetch }.to raise_error(ArgumentError)
+        resource.run_action(:fetch)
       end
     end
 
@@ -288,7 +315,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
       end
 
       it "fails with an invalid thumbprint" do
-        expect(Chef::Log).not_to receive(:info)
+        expect(Chef::Log).to receive(:debug).with("Certificate Not Found")
 
         resource.source = others_thumbprint
 
@@ -296,7 +323,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
           path = File.join(dir, "test.pem")
 
           resource.output_path = path
-          expect { resource.run_action :fetch }.to raise_error(ArgumentError)
+          resource.run_action(:fetch)
         end
 
       end
@@ -340,9 +367,10 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
   end
 
   describe "action: delete" do
-    it "throws an argument error when attempting to delete a certificate that doesn't exist" do
+    it "logs an error when attempting to delete a certificate that doesn't exist" do
+      expect(Chef::Log).to receive(:debug).with("Certificate Not Found")
       resource.source = tests_thumbprint
-      expect { resource.run_action :delete }.to raise_error(ArgumentError)
+      resource.run_action(:delete)
     end
 
     it "deletes an existing certificate while leaving other certificates alone" do
@@ -360,7 +388,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
       expect(certificate_count).to eq(1)
       expect(resource).to be_updated_by_last_action
 
-      expect { resource.run_action :delete }.to raise_error(ArgumentError)
+      expect { resource.run_action :delete }.not_to raise_error
       expect(certificate_count).to eq(1)
       expect(resource).not_to be_updated_by_last_action
 

data/spec/functional/resource/windows_font_spec.rb

@@ -18,7 +18,7 @@
 
 require "spec_helper"
 
-describe Chef::Resource::WindowsFont, :windows_only do
+describe Chef::Resource::WindowsFont, :windows_only, :broken do # these tests hang on Chef-16 and Chef-17 in the verify-pipline.
   let(:resource_name) { "Playmaker.ttf" }
   let(:resource_source) { "https://www.wfonts.com/download/data/2020/05/06/playmaker/Playmaker.ttf" }
 

data/spec/functional/resource/windows_pagefile_spec.rb

@@ -40,13 +40,32 @@ describe Chef::Resource::WindowsPagefile, :windows_only do
     new_resource
   end
 
+  def set_automatic_managed_to_false
+    powershell_code = <<~EOH
+      $computersys = Get-WmiObject Win32_ComputerSystem -EnableAllPrivileges;
+      $computersys.AutomaticManagedPagefile = $False;
+      $computersys.Put();
+    EOH
+    powershell_exec!(powershell_code)
+  end
+
+  def set_automatic_managed_to_true
+    powershell_code = <<~EOH
+      $computersys = Get-WmiObject Win32_ComputerSystem -EnableAllPrivileges;
+      $computersys.AutomaticManagedPagefile = $True;
+      $computersys.Put();
+    EOH
+    powershell_exec!(powershell_code)
+  end
+
   describe "Setting Up Pagefile Management" do
     context "Disable Automatic Management" do
-      it "Disables Automatic Management" do
+      it "Verifies Automatic Management is Disabled" do
+        set_automatic_managed_to_false
         subject.path c_path
         subject.automatic_managed false
         subject.run_action(:set)
-        expect(subject).to be_updated_by_last_action
+        expect(subject).not_to be_updated_by_last_action
       end
 
       it "Enable Automatic Management " do
@@ -55,6 +74,14 @@ describe Chef::Resource::WindowsPagefile, :windows_only do
         subject.run_action(:set)
         expect(subject).to be_updated_by_last_action
       end
+
+      it "Disables Automatic Management" do
+        set_automatic_managed_to_true
+        subject.path c_path
+        subject.automatic_managed false
+        subject.run_action(:set)
+        expect(subject).to be_updated_by_last_action
+      end
     end
   end
 
@@ -69,8 +96,8 @@ describe Chef::Resource::WindowsPagefile, :windows_only do
     context "Update a pagefile" do
       it "Changes a pagefile to use custom sizes" do
         subject.path c_path
-        subject.initial_size 20000
-        subject.maximum_size 80000
+        subject.initial_size 128
+        subject.maximum_size 512
         subject.run_action(:set)
         expect(subject).to be_updated_by_last_action
       end

data/spec/functional/resource/yum_package_spec.rb

@@ -754,6 +754,21 @@ describe Chef::Resource::YumPackage, :requires_root, external: exclude_test do
           action :install
         end.should_not_be_updated
       end
+
+      it "works with constraints in the version property" do
+        flush_cache
+        yum_package "chef_rpm" do
+          version ">= 1.10"
+          options default_options
+          action :install
+        end.should_be_updated
+        expect_matching_installed_version("^chef_rpm-1.10-1.#{pkg_arch}$")
+        yum_package "chef_rpm" do
+          version ">= 1.10"
+          options default_options
+          action :install
+        end.should_not_be_updated
+      end
     end
 
     context "with source arguments" do

data/spec/functional/shell_spec.rb

@@ -80,6 +80,12 @@ describe Shell do
       # so hide the require here
 
       require "pty"
+
+      # FIXME this is temporary... Solaris envs have TERM set to unknown
+      # and the value isn't propagating from the build environment TERM
+      # variable
+      ENV["TERM"] = "vt100" if ["", "unknown"].include?(ENV["TERM"].to_s)
+
       config = File.expand_path("shef-config.rb", CHEF_SPEC_DATA)
       reader, writer, pid = PTY.spawn("bundle exec chef-shell --no-multiline --no-singleline --no-colorize -c #{config} #{options}")
       read_until(reader, "chef (#{Chef::VERSION})>")

data/spec/unit/client_spec.rb

@@ -311,14 +311,17 @@ describe Chef::Client do
   describe "eol release warning" do
     it "warns when running an EOL release" do
       stub_const("Chef::VERSION", 15)
-      allow(Time).to receive(:now).and_return(Time.new(2021, 5, 1, 5))
-      expect(logger).to receive(:warn).with(/This release of.*became end of life \(EOL\) on May 1st 2021/)
+      # added a call to client because Time.now gets invoked multiple times during instantiation. Don't mock Time until after client initialized
+      client
+      expect(Time).to receive(:now).and_return(Time.new(2021, 5, 1, 5))
+      allow(client).to receive(:eol_override).and_return(false)
+      expect(logger).to receive(:warn).with("This release of Chef Infra Client became end of life (EOL) on May 01, 2021. Please update to a supported release to receive new features, bug fixes, and security updates.")
       client.warn_if_eol
     end
 
     it "does not warn when running an non-EOL release" do
       stub_const("Chef::VERSION", 15)
-      allow(Time).to receive(:now).and_return(Time.new(2021, 4, 31))
+      allow(Time).to receive(:now).and_return(Time.new(2021, 4, 30))
       expect(logger).to_not receive(:warn).with(/became end of life/)
       client.warn_if_eol
     end

data/spec/unit/daemon_spec.rb

@@ -170,11 +170,7 @@ describe Chef::Daemon do
 
       it "should log an appropriate error message and fail miserably" do
         allow(Process).to receive(:initgroups).and_raise(Errno::EPERM)
-        error = "Operation not permitted"
-        if RUBY_PLATFORM.match("solaris2") || RUBY_PLATFORM.match("aix")
-          error = "Not owner"
-        end
-        expect(Chef::Application).to receive(:fatal!).with("Permission denied when trying to change 999:999 to 501:20. #{error}")
+        expect(Chef::Application).to receive(:fatal!).with(/Permission denied when trying to change 999:999 to 501:20/)
         Chef::Daemon._change_privilege(testuser)
       end
     end

data/spec/unit/dsl/secret_spec.rb

@@ -17,11 +17,14 @@
 #
 
 require "spec_helper"
+require "chef/exceptions"
 require "chef/dsl/secret"
 require "chef/secret_fetcher/base"
+
 class SecretDSLTester
   include Chef::DSL::Secret
-  # Because DSL is invoked in the context of a recipe,
+
+  # Because DSL is invoked in the context of a recipe or attribute file
   # we expect run_context to always be available when SecretFetcher::Base
   # requests it - making it safe to mock here
   def run_context
@@ -37,35 +40,136 @@ end
 
 describe Chef::DSL::Secret do
   let(:dsl) { SecretDSLTester.new }
-  it "responds to 'secret'" do
-    expect(dsl.respond_to?(:secret)).to eq true
+  let(:run_context) { Chef::RunContext.new(Chef::Node.new, {}, Chef::EventDispatch::Dispatcher.new) }
+
+  before do
+    allow(dsl).to receive(:run_context).and_return(run_context)
   end
 
-  it "uses SecretFetcher.for_service to find the fetcher" do
-    substitute_fetcher = SecretFetcherImpl.new({}, nil)
-    expect(Chef::SecretFetcher).to receive(:for_service).with(:example, {}, nil).and_return(substitute_fetcher)
-    expect(substitute_fetcher).to receive(:fetch).with("key1", nil)
-    dsl.secret(name: "key1", service: :example, config: {})
+  %w{
+      secret
+      default_secret_service
+      default_secret_config
+      with_secret_service
+      with_secret_config
+    }.each do |m|
+      it "responds to ##{m}" do
+        expect(dsl.respond_to?(m)).to eq true
+      end
+    end
+
+  describe "#default_secret_service" do
+    let(:service) { :hashi_vault }
+
+    it "persists the service passed in as an argument" do
+      expect(dsl.default_secret_service).to eq(nil)
+      dsl.default_secret_service(service)
+      expect(dsl.default_secret_service).to eq(service)
+    end
+
+    it "returns run_context.default_secret_service value when no argument is given" do
+      run_context.default_secret_service = :my_thing
+      expect(dsl.default_secret_service).to eq(:my_thing)
+    end
+
+    it "raises exception when service given is not valid" do
+      stub_const("Chef::SecretFetcher::SECRET_FETCHERS", %i{service_a service_b})
+      expect { dsl.default_secret_service(:unknown_service) }.to raise_error(Chef::Exceptions::Secret::InvalidFetcherService)
+    end
   end
 
-  it "resolves a secret when using the example fetcher" do
-    secret_value = dsl.secret(name: "test1", service: :example, config: { "test1" => "secret value" })
-    expect(secret_value).to eq "secret value"
+  describe "#with_secret_config" do
+    let(:service) { :hashi_vault }
+
+    it "sets the service for the scope of the block only" do
+      expect(dsl.default_secret_service).to eq(nil)
+      dsl.with_secret_service(service) do
+        expect(dsl.default_secret_service).to eq(service)
+      end
+      expect(dsl.default_secret_service).to eq(nil)
+    end
+
+    it "raises exception when block is not given" do
+      expect { dsl.with_secret_service(service) }.to raise_error(ArgumentError)
+    end
   end
 
-  context "when used within a resource" do
-    let(:run_context) {
-      Chef::RunContext.new(Chef::Node.new,
-                           Chef::CookbookCollection.new(Chef::CookbookLoader.new(File.join(CHEF_SPEC_DATA, "cookbooks"))),
-                           Chef::EventDispatch::Dispatcher.new)
-    }
-
-    it "marks that resource as 'sensitive'" do
-      recipe = Chef::Recipe.new("secrets", "test", run_context)
-      recipe.zen_master "secret_test" do
-        peace secret(name: "test1", service: :example, config: { "test1" => true })
+  describe "#default_secret_config" do
+    let(:config) { { my_key: "value" } }
+
+    it "persists the config passed in as argument" do
+      expect(dsl.default_secret_config).to eq({})
+      dsl.default_secret_config(**config)
+      expect(dsl.default_secret_config).to eq(config)
+    end
+
+    it "returns run_context.default_secret_config value when no argument is given" do
+      run_context.default_secret_config = { my_thing: "that" }
+      expect(dsl.default_secret_config).to eq({ my_thing: "that" })
+    end
+  end
+
+  describe "#with_secret_config" do
+    let(:config) { { my_key: "value" } }
+
+    it "sets the config for the scope of the block only" do
+      expect(dsl.default_secret_config).to eq({})
+      dsl.with_secret_config(**config) do
+        expect(dsl.default_secret_config).to eq(config)
       end
-      expect(run_context.resource_collection.lookup("zen_master[secret_test]").sensitive).to eql(true)
+      expect(dsl.default_secret_config).to eq({})
+    end
+
+    it "raises exception when block is not given" do
+      expect { dsl.with_secret_config(**config) }.to raise_error(ArgumentError)
+    end
+  end
+
+  describe "#secret" do
+    it "uses SecretFetcher.for_service to find the fetcher" do
+      substitute_fetcher = SecretFetcherImpl.new({}, nil)
+      expect(Chef::SecretFetcher).to receive(:for_service).with(:example, {}, run_context).and_return(substitute_fetcher)
+      expect(substitute_fetcher).to receive(:fetch).with("key1", nil)
+      dsl.secret(name: "key1", service: :example, config: {})
+    end
+
+    it "resolves a secret when using the example fetcher" do
+      secret_value = dsl.secret(name: "test1", service: :example, config: { "test1" => "secret value" })
+      expect(secret_value).to eq "secret value"
+    end
+
+    context "when used within a resource" do
+      let(:run_context) {
+        Chef::RunContext.new(Chef::Node.new,
+                             Chef::CookbookCollection.new(Chef::CookbookLoader.new(File.join(CHEF_SPEC_DATA, "cookbooks"))),
+                             Chef::EventDispatch::Dispatcher.new)
+      }
+
+      it "marks that resource as 'sensitive'" do
+        recipe = Chef::Recipe.new("secrets", "test", run_context)
+        recipe.zen_master "secret_test" do
+          peace secret(name: "test1", service: :example, config: { "test1" => true })
+        end
+        expect(run_context.resource_collection.lookup("zen_master[secret_test]").sensitive).to eql(true)
+      end
+    end
+
+    it "passes default service to SecretFetcher.for_service" do
+      service = :example
+      dsl.default_secret_service(service)
+      substitute_fetcher = SecretFetcherImpl.new({}, nil)
+      expect(Chef::SecretFetcher).to receive(:for_service).with(service, {}, run_context).and_return(substitute_fetcher)
+      allow(substitute_fetcher).to receive(:fetch).with("key1", nil)
+      dsl.secret(name: "key1")
+    end
+
+    it "passes default config to SecretFetcher.for_service" do
+      config = { my_config: "value" }
+      dsl.default_secret_config(**config)
+      substitute_fetcher = SecretFetcherImpl.new({}, nil)
+      expect(Chef::SecretFetcher).to receive(:for_service).with(:example, config, run_context).and_return(substitute_fetcher)
+      allow(substitute_fetcher).to receive(:fetch).with("key1", nil)
+      dsl.secret(name: "key1", service: :example)
     end
   end
 end

data/spec/unit/mixin/checksum_spec.rb

@@ -51,4 +51,32 @@ describe Chef::Mixin::Checksum do
     end
   end
 
+  describe "checksum_match?" do
+    context "when checksum cases match" do
+      it "returns true" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", "u7ghbxikk3i9blsimmy2y2ionmxx")).to be true
+      end
+    end
+
+    context "when one checksum is uppercase and other is lowercase" do
+      it "returns true" do
+        expect(@checksum_user.checksum_match?("U7GHBXIKK3I9BLSIMMY2Y2IONMXX", "u7ghbxikk3i9blsimmy2y2ionmxx")).to be true
+      end
+    end
+
+    context "when checksums do not match" do
+      it "returns false" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", "09ee9c8cc70501763563bcf9c218")).to be false
+      end
+    end
+
+    context "when checksum is nil" do
+      it "returns false" do
+        expect(@checksum_user.checksum_match?("u7ghbxikk3i9blsimmy2y2ionmxx", nil)).to be false
+        expect(@checksum_user.checksum_match?(nil, "09ee9c8cc70501763563bcf9c218")).to be false
+        expect(@checksum_user.checksum_match?(nil, nil)).to be false
+      end
+    end
+  end
+
 end

data/spec/unit/provider/package/rubygems_spec.rb

@@ -143,7 +143,7 @@ describe Chef::Provider::Package::Rubygems::CurrentGemEnvironment do
         .to_return(status: 200, body: File.binread(File.join(CHEF_SPEC_DATA, "rubygems.org", "sexp_processor-4.15.1.gemspec.rz")))
 
       dep = Gem::Dependency.new("sexp_processor", ">= 0")
-      expect(@gem_env.candidate_version_from_remote(dep, "https://rubygems2.org")).to be_kind_of(Gem::Version)
+      expect(@gem_env.candidate_version_from_remote(dep, "https://rubygems2.org")).to be_nil
     end
   end
 

data/spec/unit/resource/chef_client_config_spec.rb

@@ -134,4 +134,12 @@ describe Chef::Resource::ChefClientConfig do
       expect(provider.format_handler([{ "class" => "Foo", "arguments" => ["'one'", "two", "three"] }])).to eql(["Foo.new('one',two,three)"])
     end
   end
+
+  describe "rubygems_url property" do
+    it "accepts nil, a single URL, or an array of URLs" do
+      expect { resource.rubygems_url(nil) }.not_to raise_error
+      expect { resource.rubygems_url("https://rubygems.internal.example.com") }.not_to raise_error
+      expect { resource.rubygems_url(["https://rubygems.east.example.com", "https://rubygems.west.example.com"]) }.not_to raise_error
+    end
+  end
 end

data/spec/unit/run_context_spec.rb

@@ -53,6 +53,22 @@ describe Chef::RunContext do
     expect(run_context.node).to eq(node)
   end
 
+  it "responds to #default_secret_service" do
+    expect(run_context).to respond_to(:default_secret_service)
+  end
+
+  it "responds to #default_secret_config" do
+    expect(run_context).to respond_to(:default_secret_config)
+  end
+
+  it "#default_secret_service defaults to nil" do
+    expect(run_context.default_secret_service).to eq(nil)
+  end
+
+  it "#default_secret_config defaults to {}" do
+    expect(run_context.default_secret_config).to eq({})
+  end
+
   it "loads up node[:cookbooks]" do
     expect(run_context.node[:cookbooks]).to eql(
       {