chef 18.10.17 → 18.11.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea642da5a95174bc30b1f2010f05945c9a7847e1082f88c415bf5d9807f39227
-  data.tar.gz: 0edf60effa635270d37059fd3e315d77cd97f852fce7547569fae96b13ccaf4c
+  metadata.gz: bf0beb126b5eeb735670c67b48e79aae54a6ba25760f99babf2468fe6ff78437
+  data.tar.gz: 99033f783a17e8870ccfc0f20ef3489cfed936f2882d7030beaf0d78971e8a85
 SHA512:
-  metadata.gz: 29095f460f5a93f61dfc67cb21a76bdedd4ceb154a347583424b1d07d7f23e707cafd6a28677d81b2d9753eed323fc78ae8474027d86fb3fee9f7d3910560997
-  data.tar.gz: f1f1869359071735d971e79faa2f2a5a0ab11ddad463c278ae1ff47a0b80db4e1c202d71ff7e10b7c6a761e45cb1c79b958ae3bbd0f02dec8901240c178cffa2
+  metadata.gz: c3e593233b5da46f034602581455a9ee6d32eaf77a1bbcedc91fb17d5826081c139480192887fdb3804cda29862383fe46fa74bae56af7947096d0adc42493e8
+  data.tar.gz: d80743280c5469a1c869fe02cce993d0649fdfecf6a3ca8a66892465b5b3239aba64378579c659800122aeb408745efd11712ff6dddb46b75d92ac000a36dc30

data/Gemfile

@@ -7,7 +7,7 @@ gem "ohai", git: "https://github.com/chef/ohai.git", branch: "18-stable"
 # Nwed to file a bug with rest-client. In the meantime, we can use this until they accept the update.
 gem "rest-client", git: "https://github.com/chef/rest-client", branch: "jfm/ucrt_update1"
 
-gem "ffi", ">= 1.15.5", "<= 1.17.0"
+gem "ffi", ">= 1.15.5", "<= 1.18.0"
 gem "chef-utils", path: File.expand_path("chef-utils", __dir__) if File.exist?(File.expand_path("chef-utils", __dir__))
 gem "chef-config", path: File.expand_path("chef-config", __dir__) if File.exist?(File.expand_path("chef-config", __dir__))
 
@@ -31,15 +31,19 @@ group(:omnibus_package) do
   gem "rb-readline"
   gem "chef-vault"
 
-  gem "inspec-core-bin", ">= 5", "< 6"
+  gem "inspec-core-bin", "~> 5.24", "< 6"
 end
 
 group(:omnibus_package, :pry) do
   # Locked because pry-byebug is broken with 13+.
   # some work is ongoing? https://github.com/deivid-rodriguez/pry-byebug/issues/343
-  gem "pry", "= 0.13.0"
-  # byebug does not install on freebsd on ruby 3.0
-  gem "pry-byebug" unless RUBY_PLATFORM.match?(/freebsd/i)
+  gem "pry", "0.15.2"
+  # byebug does not install on freebsd on ruby 3.0; byebug >= 12 requires ruby >= 3.1
+  # which is incompatible with the AIX omnibus toolchain (ruby 3.0.3)
+  unless RUBY_PLATFORM.match?(/freebsd|aix/i)
+    gem "byebug", "< 13"
+    gem "pry-byebug", "< 3.12"
+  end
   gem "pry-stack_explorer"
 end
 
@@ -60,7 +64,7 @@ group(:development, :test) do
   gem "rake", ">= 12.3.3"
   gem "rspec"
   gem "webmock"
-  gem "crack", "< 0.4.6" # due to https://github.com/jnunemaker/crack/pull/75
+  gem "crack", "< 1.0.2" # due to https://github.com/jnunemaker/crack/pull/75
   gem "fauxhai-ng" # for chef-utils gem
 end
 
@@ -70,4 +74,8 @@ instance_eval(ENV["GEMFILE_MOD"]) if ENV["GEMFILE_MOD"]
 
 # If you want to load debugging tools into the bundle exec sandbox,
 # add these additional dependencies into Gemfile.local
-eval_gemfile("./Gemfile.local") if File.exist?("./Gemfile.local")
+#
+# But doing eval_gemfile("./Gemfile.local") breaks dependabot, so a
+# bit of indirection here
+local_gemfile = File.join(__dir__, "Gemfile.local")
+eval(File.read(local_gemfile)) if File.exist?(local_gemfile)

data/README.md

@@ -1,5 +1,4 @@
 # Chef Infra
-[![Code Climate](https://codeclimate.com/github/chef/chef.svg)](https://codeclimate.com/github/chef/chef)
 [![Build Status](https://badge.buildkite.com/c82093430ceec7d27af05febb9dcafe3aa331fff9d74c0ab9d.svg?branch=main)](https://buildkite.com/chef-oss/chef-chef-main-verify)
 [![Gem Version](https://badge.fury.io/rb/chef.svg)](https://badge.fury.io/rb/chef)
 [![](https://img.shields.io/badge/Release%20Policy-Cadence%20Release-brightgreen.svg)](https://github.com/chef/chef/blob/main/docs/dev/design_documents/client_release_cadence.md)

data/chef-universal-mingw-ucrt.gemspec

@@ -1,4 +1,6 @@
-gemspec = instance_eval(File.read(File.expand_path("chef.gemspec", __dir__)))
+# rubocop:disable Chef/Ruby/GemspecLicense
+# License is in the included gemspec.
+gemspec = Gem::Specification.load(File.expand_path("chef.gemspec", __dir__))
 
 gemspec.platform = Gem::Platform.new(%w{universal mingw-ucrt})
 
@@ -6,7 +8,7 @@ gemspec.add_dependency "win32-api", "~> 1.10.0"
 gemspec.add_dependency "win32-event", "~> 0.6.1"
 # TODO: Relax this pin and make the necessary updaets. The issue originally
 # leading to this pin has been fixed in 0.6.5.
-gemspec.add_dependency "win32-eventlog", "0.6.3"
+gemspec.add_dependency "win32-eventlog", "0.6.7"
 gemspec.add_dependency "win32-mmap", "~> 0.4.1"
 gemspec.add_dependency "win32-mutex", "~> 0.4.2"
 gemspec.add_dependency "win32-process", "~> 0.9"

data/chef.gemspec

@@ -25,10 +25,11 @@ Gem::Specification.new do |s|
   s.email = "adam@chef.io"
   s.homepage = "https://www.chef.io"
 
+  # help dependabot by specifying a default. If the default is in
+  # the 'else', dependabot misses it and falls back to a very old ruby
+  s.required_ruby_version = ">= 3.1.0"
   if RUBY_PLATFORM =~ /aix/
     s.required_ruby_version = ">= 3.0.3"
-  else
-    s.required_ruby_version = ">= 3.1.0"
   end
 
   s.add_dependency "chef-config", "= #{Chef::VERSION}"
@@ -47,35 +48,37 @@ Gem::Specification.new do |s|
 
   # AIX Gemfile.aix.lock uses this, but currently a manual process
   if RUBY_PLATFORM.include?("aix") || ENV["GENERATE_AIX"] == "true"
-    s.add_dependency "inspec-core", ">= 5", "<= 5.22.80"
+    s.add_dependency "inspec-core", ">= 5", "< 8"
   else
-    s.add_dependency "inspec-core", ">= 5", "< 6"
+    s.add_dependency "inspec-core", ">= 5", "< 8"
   end
 
   s.add_dependency "ffi", ">= 1.15.5", "<= 1.16.3"
-  s.add_dependency "ffi-yajl", "~> 2.2"
+  s.add_dependency "ffi-yajl", ">= 2.2", "< 4.0"
   s.add_dependency "net-sftp", ">= 2.1.2", "< 5.0" # remote_file resource
   s.add_dependency "net-ftp" # remote_file resource
   s.add_dependency "erubis", "~> 2.7" # template resource / cookbook syntax check
-  s.add_dependency "diff-lcs", ">= 1.2.4", "!= 1.4.0", "< 1.6.0" # 1.4 breaks output. Used in lib/chef/util/diff
+  s.add_dependency "diff-lcs", ">= 1.2.4", "!= 1.4.0", "< 2.1.0" # 1.4 breaks output. Used in lib/chef/util/diff
   s.add_dependency "ffi-libarchive", "~> 1.0", ">= 1.0.3" # archive_file resource
-  s.add_dependency "chef-zero", ">= 15.0.21", "< 15.2"
+  s.add_dependency "chef-zero", "~> 15.1.11"
   s.add_dependency "chef-vault" # chef-vault resources and helpers
 
   s.add_dependency "plist", "~> 3.2" # launchd, dscl/mac user, macos_userdefaults, osx_profile and plist resources
   s.add_dependency "iniparse", "~> 1.4" # systemd_unit resource
   s.add_dependency "addressable"
   s.add_dependency "syslog-logger", "~> 1.6"
-  s.add_dependency "uuidtools", ">= 2.1.5", "< 3.0" # osx_profile resource
-  s.add_dependency "unf_ext", "~> 0.0.8.2" # older platforms
-  s.add_dependency "uri", "~> 1.0.4" # This is used by net-http. We are forcing a version to get past a CVE in 1.0.2
+  s.add_dependency "uuidtools", ">= 2.1.5", "< 4.0" # osx_profile resource
+  s.add_dependency "unf_ext", ">= 0.0.8.2", "< 0.0.10.0" # older platforms
+  s.add_dependency "uri", ">= 1.0.4", "< 1.2.0" # This is used by net-http. We are forcing a version to get past a CVE in 1.0.2
   s.add_dependency "corefoundation", "~> 0.3.4" # macos_userdefaults resource
 
   s.add_dependency "proxifier2", "~> 1.1"
 
-  s.add_dependency "aws-sdk-s3", "~> 1.91" # s3 recipe-url support
+  # 1.219 depends (transitively) on bigdecimal 4.1.2 which dodesn't compile
+  # on CentOS7
+  s.add_dependency "aws-sdk-s3", ">= 1.218.0", "< 1.219.0"
   s.add_dependency "aws-sdk-secretsmanager", "~> 1.46"
-  s.add_dependency "vault", "~> 0.18.2" # hashi vault official client gem
+  s.add_dependency "vault", ">= 0.18.2", "< 0.21.0" # hashi vault official client gem
 
   s.bindir = "bin"
   s.executables = %w{ }

data/lib/chef/compliance/runner.rb

@@ -72,14 +72,32 @@ class Chef
         logger.debug("#{self.class}##{__method__}: enabling Compliance Phase")
 
         report_with_interval
+        @compliance_phase_completed = true
       end
 
-      def run_failed(_exception, _run_status)
+      def run_failed(exception, _run_status)
         # If the run has failed because our own validation of compliance
         # phase configuration has failed, we don't want to submit a report
         # because we're still not configured correctly.
         return unless enabled? && @validation_passed
 
+        # A reboot exception is not a real failure — it is an expected outcome
+        # when a reboot resource fires :reboot_now.  In that case run_completed
+        # has already executed the Compliance Phase, so running it again here
+        # would produce a duplicate scan (and the second scan may be killed by
+        # the pending reboot).
+        if exception.is_a?(Chef::Exceptions::Reboot)
+          logger.debug("#{self.class}##{__method__}: skipping Compliance Phase because a reboot was requested")
+          return
+        end
+
+        # Guard against any other code path that might trigger both run_completed
+        # and run_failed in the same client run.
+        if @compliance_phase_completed
+          logger.debug("#{self.class}##{__method__}: skipping Compliance Phase because it has already run in this client run")
+          return
+        end
+
         logger.debug("#{self.class}##{__method__}: enabling Compliance Phase")
 
         report_with_interval

data/lib/chef/dsl/rest_resource.rb

@@ -20,56 +20,263 @@ require "chef/constants" unless defined?(NOT_PASSED)
 class Chef
   module DSL
     module RestResource
+      private
+
+      def inherited_accessor(name)
+        superclass.public_send(name) if superclass.respond_to?(name)
+      end
+
+      public
+
+      # Define property mapping between resource properties and JSON API fields
+      #
+      # Maps resource properties to their corresponding locations in the JSON
+      # API payload. Supports both simple 1:1 mappings and complex transformations.
+      #
+      # @param rest_property_map [Hash, Array, NOT_PASSED] The property mapping configuration
+      #   - Hash: Keys are property symbols, values are JMESPath strings or symbol references
+      #   - Array: Simple 1:1 mapping (property name matches JSON field name)
+      #   - NOT_PASSED: Acts as getter, returns current mapping
+      #
+      # @return [Hash] The current property mapping
+      #
+      # @example Simple 1:1 mapping
+      #   rest_property_map [:username, :email, :role]
+      #   # Equivalent to: { username: 'username', email: 'email', role: 'role' }
+      #
+      # @example Nested JSON paths
+      #   rest_property_map({
+      #     username: 'user.name',
+      #     email: 'user.contact.email',
+      #     role: 'permissions.role'
+      #   })
+      #
+      # @example Custom mapping functions
+      #   rest_property_map({
+      #     username: 'username',
+      #     tags: :tags_mapping  # Calls tags_from_json and tags_to_json methods
+      #   })
+      #
+      # @see #json_to_property Method that uses this mapping to extract values
+      # @see #property_to_json Method that uses this mapping to create JSON
       def rest_property_map(rest_property_map = NOT_PASSED)
-        if rest_property_map != NOT_PASSED
+        unless rest_property_map.equal?(NOT_PASSED)
           rest_property_map = rest_property_map.to_h { |k| [k.to_sym, k] } if rest_property_map.is_a? Array
 
           @rest_property_map = rest_property_map
         end
-        @rest_property_map
+        @rest_property_map || inherited_accessor(:rest_property_map)
       end
 
-      # URL to collection
+      # Define the REST API collection URL
+      #
+      # Sets the base URL for the collection of resources. This URL is used for:
+      # - GET requests to list all resources
+      # - POST requests to create new resources
+      #
+      # @param rest_api_collection [String, NOT_PASSED] The collection URL path
+      #   - String: Must be an absolute path starting with '/'
+      #   - NOT_PASSED: Acts as getter, returns current collection URL
+      #
+      # @return [String] The current collection URL
+      #
+      # @raise [ArgumentError] If the path doesn't start with '/'
+      #
+      # @example
+      #   rest_api_collection '/api/v1/users'
+      #   # GET  /api/v1/users      # List all users
+      #   # POST /api/v1/users      # Create new user
       def rest_api_collection(rest_api_collection = NOT_PASSED)
-        if rest_api_collection != NOT_PASSED
+        unless rest_api_collection.equal?(NOT_PASSED)
           raise ArgumentError, "You must pass an absolute path to rest_api_collection" unless rest_api_collection.start_with? "/"
 
           @rest_api_collection = rest_api_collection
         end
 
-        @rest_api_collection
+        @rest_api_collection || inherited_accessor(:rest_api_collection)
       end
 
-      # RFC6570-Templated URL to document
+      # Define the REST API document URL with RFC 6570 template support
+      #
+      # Sets the URL pattern for individual resource documents. The URL can include
+      # RFC 6570 URI templates that will be expanded using property values. This URL
+      # is used for:
+      # - GET requests to retrieve a specific resource
+      # - PATCH/PUT requests to update a resource
+      # - DELETE requests to remove a resource
+      #
+      # @param rest_api_document [String, NOT_PASSED] The document URL pattern
+      #   - String: Must be an absolute path starting with '/'
+      #   - Can include RFC 6570 templates like {property_name}
+      #   - NOT_PASSED: Acts as getter, returns current document URL
+      #
+      # @param first_element_only [Boolean] If true and API returns array, extract first element only
+      #
+      # @return [String] The current document URL pattern
+      #
+      # @raise [ArgumentError] If the path doesn't start with '/'
+      #
+      # @example Path-based URL
+      #   rest_api_document '/api/v1/users/{username}'
+      #   # With username='john':
+      #   # GET    /api/v1/users/john
+      #   # PATCH  /api/v1/users/john
+      #   # DELETE /api/v1/users/john
+      #
+      # @example Query-based URL
+      #   rest_api_document '/api/v1/users?name={username}&email={email}'
+      #   # With username='john', email='john@example.com':
+      #   # GET /api/v1/users?name=john&email=john@example.com
+      #
+      # @example With first_element_only
+      #   rest_api_document '/api/v1/users?name={username}', first_element_only: true
+      #   # API returns: [{"name": "john", ...}]
+      #   # Resource sees: {"name": "john", ...}
+      #
+      # @see https://tools.ietf.org/html/rfc6570 RFC 6570 URI Template specification
       def rest_api_document(rest_api_document = NOT_PASSED, first_element_only: false)
-        if rest_api_document != NOT_PASSED
+        unless rest_api_document.equal?(NOT_PASSED)
           raise ArgumentError, "You must pass an absolute path to rest_api_document" unless rest_api_document.start_with? "/"
 
           @rest_api_document = rest_api_document
           @rest_api_document_first_element_only = first_element_only
         end
-        @rest_api_document
+        @rest_api_document ||
+          inherited_accessor(:rest_api_document) ||
+          (rest_api_collection && rest_identity_property ? "#{rest_api_collection}/{#{rest_identity_property}}" : nil)
       end
 
-      # Explicit REST document identity mapping
+      # Define explicit identity mapping for resource identification
+      #
+      # Explicitly specifies which JSON fields and resource properties uniquely
+      # identify a resource. Use this when automatic identity inference from the
+      # document URL is insufficient or when dealing with composite keys.
+      #
+      # If not specified, the identity is automatically inferred from RFC 6570
+      # templates in the document URL.
+      #
+      # @param rest_identity_map [Hash, NOT_PASSED] Mapping of JSON paths to properties
+      #   - Hash: Keys are JMESPath-like strings, values are property symbols
+      #   - NOT_PASSED: Acts as getter, returns current identity mapping
+      #
+      # @return [Hash, nil] The current identity mapping or nil if using auto-inference
+      #
+      # @example Simple identity
+      #   property :username, String, identity: true
+      #   rest_identity_map({ 'username' => :username })
+      #
+      # @example Composite identity
+      #   property :name, String
+      #   property :namespace, String
+      #
+      #   rest_identity_map({
+      #     'name' => :name,
+      #     'namespace' => :namespace
+      #   })
+      #
+      # @example Nested identity fields
+      #   property :user_id, String
+      #   property :org_id, String
+      #
+      #   rest_identity_map({
+      #     'user.id' => :user_id,
+      #     'organization.id' => :org_id
+      #   })
       def rest_identity_map(rest_identity_map = NOT_PASSED)
-        @rest_identity_map = rest_identity_map if rest_identity_map != NOT_PASSED
-        @rest_identity_map
+        @rest_identity_map = rest_identity_map unless rest_identity_map.equal?(NOT_PASSED)
+        @rest_identity_map || inherited_accessor(:rest_identity_map)
       end
 
-      # Mark up properties for POST only, not PATCH/PUT
+      # Declare properties that should only be sent during resource creation
+      #
+      # Specifies which properties should only be included in POST (create) requests
+      # and excluded from PATCH/PUT (update) requests. This is useful for properties
+      # that can only be set during initial creation or would cause errors if
+      # included in updates.
+      #
+      # @param rest_post_only_properties [Symbol, Array<Symbol>, NOT_PASSED] Properties to mark
+      #   - Symbol: Single property name
+      #   - Array<Symbol>: Multiple property names
+      #   - NOT_PASSED: Acts as getter, returns current post-only properties
+      #
+      # @return [Array<Symbol>] Current list of post-only properties (empty array if none)
+      #
+      # @example Single property
+      #   property :password, String, sensitive: true
+      #   property :username, String
+      #
+      #   rest_post_only_properties :password
+      #   # Password only sent when creating user, not when updating
+      #
+      # @example Multiple properties
+      #   property :password, String, sensitive: true
+      #   property :initial_role, String
+      #   property :username, String
+      #
+      #   rest_post_only_properties [:password, :initial_role]
+      #
+      # @example Common use cases
+      #   # Passwords that can't be updated via API
+      #   rest_post_only_properties :admin_password
+      #
+      #   # Resource size that can't be changed after creation
+      #   rest_post_only_properties :disk_size_gb
+      #
+      #   # Initialization parameters
+      #   rest_post_only_properties [:template_id, :source_snapshot]
       def rest_post_only_properties(rest_post_only_properties = NOT_PASSED)
-        if rest_post_only_properties != NOT_PASSED
+        unless rest_post_only_properties.equal?(NOT_PASSED)
           @rest_post_only_properties = Array(rest_post_only_properties).map(&:to_sym)
         end
-        @rest_post_only_properties || []
+        @rest_post_only_properties || inherited_accessor(:rest_post_only_properties) || []
       end
 
       def rest_api_document_first_element_only(rest_api_document_first_element_only = NOT_PASSED)
-        if rest_api_document_first_element_only != NOT_PASSED
+        unless rest_api_document_first_element_only.equal?(NOT_PASSED)
           @rest_api_document_first_element_only = rest_api_document_first_element_only
         end
-        @rest_api_document_first_element_only
+        @rest_api_document_first_element_only || inherited_accessor(:rest_api_document_first_element_only)
+      end
+
+      # Define the base URL for the REST API
+      #
+      # Sets the base endpoint URL that is prepended to all collection and document
+      # URLs. This allows resource definitions to be self-contained without requiring
+      # the Train transport endpoint to be pre-configured.
+      #
+      # @param rest_api_endpoint [String, NOT_PASSED] The base URL of the REST API
+      #   - NOT_PASSED: Acts as getter, returns current endpoint URL
+      #
+      # @return [String, nil] The current endpoint URL
+      #
+      # @example
+      #   rest_api_endpoint "https://api.example.com"
+      #   rest_api_collection "/api/v1/users"
+      #   # GET https://api.example.com/api/v1/users
+      def rest_api_endpoint(rest_api_endpoint = NOT_PASSED)
+        @rest_api_endpoint = rest_api_endpoint unless rest_api_endpoint.equal?(NOT_PASSED)
+        @rest_api_endpoint || inherited_accessor(:rest_api_endpoint)
+      end
+
+      # Declare the property that uniquely identifies a resource in the REST API
+      #
+      # Sets the identity property for the resource and auto-generates the document
+      # URL as "#{rest_api_collection}/{property}" when no explicit rest_api_document
+      # is provided. This is a convenience alternative to setting rest_api_document
+      # manually.
+      #
+      # @param property [Symbol, NOT_PASSED] The property name used as the resource identifier
+      #   - NOT_PASSED: Acts as getter, returns current identity property
+      #
+      # @return [Symbol, nil] The current identity property name
+      #
+      # @example
+      #   rest_api_collection "/api/v1/users"
+      #   rest_identity_property :username
+      #   # Auto-generates rest_api_document as "/api/v1/users/{username}"
+      def rest_identity_property(property = NOT_PASSED)
+        @rest_identity_property = property unless property.equal?(NOT_PASSED)
+        @rest_identity_property || inherited_accessor(:rest_identity_property)
       end
 
     end

data/lib/chef/formatters/error_description.rb

@@ -59,10 +59,17 @@ class Chef
 
       private
 
+      MAX_DISPLAY_TEXT_LENGTH = 10_000
+
       def display_section(heading, text, out)
         out.puts heading
         out.puts "-" * heading.size
-        out.puts text
+        if text.is_a?(String) && text.length > MAX_DISPLAY_TEXT_LENGTH
+          out.puts text[0, MAX_DISPLAY_TEXT_LENGTH]
+          out.puts "\n... [truncated #{text.length - MAX_DISPLAY_TEXT_LENGTH} characters of output]"
+        else
+          out.puts text
+        end
         out.puts "\n"
       end
 

data/lib/chef/http/authenticator.rb

@@ -150,8 +150,9 @@ class Chef
 
         if !!results
           @raw_key = results
-        elsif key_file == nil? && raw_key == nil?
+        elsif key_file.nil? && raw_key.nil?
           puts "\nNo key detected\n"
+          return
         elsif !!key_file
           @raw_key = IO.read(key_file).strip
         elsif !!raw_key
@@ -305,14 +306,26 @@ class Chef
 
           if !!check_certstore_for_key(client_name)
             ps_blob = powershell_exec!(get_the_key_ps(client_name, password)).result
+            # ps_blob can be false when the PowerShell Catch block fires (e.g. cert export
+            # race condition or temporary store lock). Guard before calling Hash#[] to
+            # avoid NoMethodError: undefined method `[]' for false:FalseClass.
+            return false unless ps_blob.is_a?(Hash) && ps_blob["PSPath"]
+
             file_path = ps_blob["PSPath"].split("::")[1]
-            pkcs = OpenSSL::PKCS12.new(File.binread(file_path), password)
+
+            # Use begin/ensure to guarantee the unique temp file is deleted even if
+            # File.binread or OpenSSL::PKCS12.new raises an exception, preventing
+            # orphaned PFX files on disk.
+            begin
+              pkcs = OpenSSL::PKCS12.new(File.binread(file_path), password)
+            ensure
+              File.delete(file_path) if File.exist?(file_path)
+            end
 
             # We check the pfx we just extracted the private key from
             # if that cert is expiring in 7 days or less we generate a new pfx/p12 object
             # then we post the new public key from that to the client endpoint on
             # chef server.
-            File.delete(file_path)
             key_expiring = is_certificate_expiring?(pkcs)
             if key_expiring
               powershell_exec!(delete_old_key_ps(client_name))
@@ -338,7 +351,7 @@ class Chef
           Try {
             $my_pwd = ConvertTo-SecureString -String "#{password}" -Force -AsPlainText;
             $cert = Get-ChildItem -path cert:\\#{store}\\My -Recurse | Where-Object { $_.Subject -match "chef-#{client_name}$" } -ErrorAction Stop;
-            $tempfile = [System.IO.Path]::GetTempPath() + "export_pfx.pfx";
+            $tempfile = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), [System.IO.Path]::GetRandomFileName() + ".pfx");
             Export-PfxCertificate -Cert $cert -Password $my_pwd -FilePath $tempfile;
           }
           Catch {

data/lib/chef/mixin/template.rb

@@ -93,6 +93,12 @@ class Chef
           @_extension_modules = []
         end
 
+        # Provide a compact inspect so exception messages do not dump the full
+        # template context, including node attributes and secrets.
+        def inspect
+          "#<#{self.class} template_name=#{@template_name.inspect} cookbook_name=#{@cookbook_name.inspect}>"
+        end
+
         ###
         # USER FACING API
         ###
@@ -220,8 +226,15 @@ class Chef
           @original_exception, @template, @context, @options = original_exception, template, context, options
         end
 
+        MAX_MESSAGE_LENGTH = 10_000
+
         def message
-          @original_exception.message
+          msg = @original_exception.message
+          if msg.length > MAX_MESSAGE_LENGTH
+            msg[0, MAX_MESSAGE_LENGTH] + "\n... [truncated #{msg.length - MAX_MESSAGE_LENGTH} characters]"
+          else
+            msg
+          end
         end
 
         def line_number
@@ -258,7 +271,16 @@ class Chef
         end
 
         def to_s
-          "\n\n#{self.class} (#{message}) #{source_location}:\n\n" +
+          location_parts = []
+          if @context.respond_to?(:cookbook_name) && @context.cookbook_name
+            location_parts << "cookbook: #{@context.cookbook_name}"
+          end
+          if @context.respond_to?(:template_name) && @context.template_name
+            location_parts << "template: #{@context.template_name}"
+          end
+          location_hint = location_parts.empty? ? "" : " (#{location_parts.join(", ")})"
+
+          "\n\n#{self.class} (#{message}) #{source_location}#{location_hint}:\n\n" +
             "#{source_listing}\n\n  #{original_exception.backtrace.join("\n  ")}\n\n"
         end
       end