chef 18.10.17 → 19.1.164

data/lib/chef/secret_fetcher/hashi_vault.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Marc Paradise (<marc@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,6 +18,15 @@
 
 require_relative "base"
 require "aws-sdk-core" # Support for aws instance profile auth
+
+# The vault gem mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS as it loads.
+# Ruby 3.4 can ship that hash frozen (seen on Windows builds), so duplicate it
+# before requiring vault to avoid a FrozenError during load.
+if defined?(OpenSSL::SSL::SSLContext::DEFAULT_PARAMS) && OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.frozen?
+  mutable_defaults = OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.dup
+  OpenSSL::SSL::SSLContext.const_set(:DEFAULT_PARAMS, mutable_defaults)
+end
+
 require "vault"
 class Chef
   class SecretFetcher

data/lib/chef/secret_fetcher.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Marc Paradise (<marc@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/server_api.rb

@@ -1,6 +1,6 @@
 #
 # Author:: John Keiser (<jkeiser@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/server_api_versions.rb

@@ -1,5 +1,5 @@
 #--
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/shell/ext.rb

@@ -239,9 +239,9 @@ module Shell
 
       desc "returns an object to control a paused #{ChefUtils::Dist::Infra::PRODUCT} run"
       subcommands resume: "resume the #{ChefUtils::Dist::Infra::PRODUCT} run",
-        step: "run only the next resource",
-        skip_back: "move back in the run list",
-        skip_forward: "move forward in the run list"
+                  step: "run only the next resource",
+                  skip_back: "move back in the run list",
+                  skip_forward: "move forward in the run list"
       def chef_run
         Shell.session.resource_collection.iterator
       end
@@ -393,17 +393,17 @@ module Shell
           This will strip the admin privileges from any client named after borat.
       E
       subcommands all: "list all api clients",
-        show: "load an api client by name",
-        search: "search for API clients",
-        transform: "edit all api clients via a code block and save them"
+                  show: "load an api client by name",
+                  search: "search for API clients",
+                  transform: "edit all api clients via a code block and save them"
       def clients
         @clients ||= Shell::ModelWrapper.new(Chef::ApiClient, :client)
       end
 
       desc "Find and edit cookbooks"
       subcommands all: "list all cookbooks",
-        show: "load a cookbook by name",
-        transform: "edit all cookbooks via a code block and save them"
+                  show: "load a cookbook by name",
+                  transform: "edit all cookbooks via a code block and save them"
       def cookbooks
         @cookbooks ||= Shell::ModelWrapper.new(Chef::CookbookVersion)
       end
@@ -455,9 +455,9 @@ module Shell
           This will assign the attribute to every node with a FQDN matching the regex.
       E
       subcommands all: "list all nodes",
-        show: "load a node by name",
-        search: "search for nodes",
-        transform: "edit all nodes via a code block and save them"
+                  show: "load a node by name",
+                  search: "search for nodes",
+                  transform: "edit all nodes via a code block and save them"
       def nodes
         @nodes ||= Shell::ModelWrapper.new(Chef::Node)
       end
@@ -477,9 +477,9 @@ module Shell
           See the help for +nodes+ for more information about the subcommands.
       E
       subcommands all: "list all roles",
-        show: "load a role by name",
-        search: "search for roles",
-        transform: "edit all roles via a code block and save them"
+                  show: "load a role by name",
+                  search: "search for roles",
+                  transform: "edit all roles via a code block and save them"
       def roles
         @roles ||= Shell::ModelWrapper.new(Chef::Role)
       end
@@ -503,9 +503,9 @@ module Shell
 
       E
       subcommands all: "list all items in the data bag",
-        show: "load a data bag item by id",
-        search: "search for items in the data bag",
-        transform: "edit all items via a code block and save them"
+                  show: "load a data bag item by id",
+                  search: "search for items in the data bag",
+                  transform: "edit all items via a code block and save them"
       def databags(databag_name)
         @named_databags_wrappers ||= {}
         @named_databags_wrappers[databag_name] ||= Shell::NamedDataBagWrapper.new(databag_name)
@@ -526,9 +526,9 @@ module Shell
           See the help for +nodes+ for more information about the subcommands.
       E
       subcommands all: "list all environments",
-        show: "load an environment by name",
-        search: "search for environments",
-        transform: "edit all environments via a code block and save them"
+                  show: "load an environment by name",
+                  search: "search for environments",
+                  transform: "edit all environments via a code block and save them"
       def environments
         @environments ||= Shell::ModelWrapper.new(Chef::Environment)
       end

data/lib/chef/shell/model_wrapper.rb

@@ -1,6 +1,6 @@
 #--
 # Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/shell/shell_session.rb

@@ -2,7 +2,7 @@
 # Author:: Daniel DeLeo (<dan@kallistec.com>)
 # Author:: Tim Hinderliter (<tim@chef.io>)
 # Copyright:: Copyright 2009-2016, Daniel DeLeo
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -268,7 +268,7 @@ module Shell
 
     def register
       @rest = Chef::ServerAPI.new(Chef::Config[:chef_server_url], client_name: Chef::Config[:node_name],
-        signing_key_filename: Chef::Config[:client_key])
+                                                                  signing_key_filename: Chef::Config[:client_key])
     end
 
   end

data/lib/chef/shell.rb

@@ -38,6 +38,8 @@ require_relative "workstation_config_loader"
 require_relative "shell/ext"
 require_relative "json_compat"
 require_relative "util/path_helper"
+require "chef-licensing/cli_flags/mixlib_cli"
+require_relative "licensing"
 
 # = Shell
 # Shell is Chef in an IRB session. Shell can interact with a Chef server via the
@@ -57,17 +59,19 @@ module Shell
   def self.start
     setup_logger
 
-    # @ALIASES was removed from irb in v1.13.0, but chef-shell can still be run in contexts that
-    # use the Ruby 3.1.x default of irb v1.4.1
-    if IRB::ExtendCommandBundle.instance_variables.include? :@ALIASES
-      # FUGLY HACK: irb gives us no other choice.
-      irb_help = [:help, :irb_help, IRB::ExtendCommandBundle::NO_OVERRIDE]
-      IRB::ExtendCommandBundle.instance_variable_get(:@ALIASES).delete(irb_help)
-    end
+    IRB::Command.register(
+      :help,
+      proc { Shell::Options.print_help }
+    )
 
     parse_opts
     Chef::Config[:shell_config] = options.config
 
+    if ChefUtils::Dist::Infra::SHELL == "chef-shell"
+      Chef::Licensing.fetch_and_persist
+      Chef::Licensing.check_software_entitlement!
+    end
+
     # HACK: this duplicates the functions of IRB.start, but we have to do it
     # to get access to the main object before irb starts.
     ::IRB.setup(nil)
@@ -140,7 +144,7 @@ module Shell
       # remove this clause for any Chef version that has upgraded to ruby >= 3.3.0
       if RUBY_VERSION >= "3.3.0"
         conf.prompt_c       = "#{ChefUtils::Dist::Infra::EXEC}#{leader(m)} > "
-        conf.prompt_n       = "#{ChefUtils::Dist::Infra::EXEC}#{leader(m)} ?> "
+        # prompt_n deprecation warnings as of 3.4.x
         conf.prompt_s       = "#{ChefUtils::Dist::Infra::EXEC}#{leader(m)}%l> "
       else
         # there's a bug if you use a left arrow and the alternative prompts
@@ -227,6 +231,7 @@ module Shell
   class Options
     include Mixlib::CLI
     include ChefConfig::Mixin::DotD
+    include ChefLicensing::CLIFlags::MixlibCLI
 
     def self.footer(text = nil)
       @footer = text if text
@@ -337,12 +342,29 @@ module Shell
       description: "Use cached cookbooks without overwriting local differences from the server",
       boolean: false
 
+    if ChefUtils::Dist::Infra::SHELL == "chef-shell"
+      option :license_add,
+             long: "--license-add",
+             description: "Add a license key to the license pool.",
+             boolean: true,
+             proc: lambda { |v| Chef::Licensing.license_add },
+             exit: 0
+
+      option :license_list,
+             long: "--license-list",
+             description: "List all license keys in the license pool.",
+             boolean: true,
+             proc: lambda { |v| Chef::Licensing.license_list },
+             exit: 0
+    end
+
     def self.print_help
       instance = new
       instance.parse_options([])
       puts instance.opt_parser
       puts
       puts footer
+      puts Chef::Licensing.licensing_help if ChefUtils::Dist::Infra::SHELL == "chef-shell"
       puts
       exit 1
     end

data/lib/chef/target_io/dir.rb

@@ -0,0 +1,12 @@
+module TargetIO
+  class Dir
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("Dir::%s(%s)", m.to_s, args.join(", "))
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::Dir : ::Dir
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/etc.rb

@@ -0,0 +1,16 @@
+module TargetIO
+  class Etc
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("Etc::%s(%s)", m.to_s, args.join(", "))
+
+        if ChefConfig::Config.target_mode? && !Chef.run_context.transport_connection.os.unix?
+          raise "Etc support only on Unix, this is " + Chef.run_context.transport_connection.platform.title
+        end
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::Etc : ::Etc
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/file.rb

@@ -0,0 +1,12 @@
+module TargetIO
+  class File
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("File::%s(%s)", m.to_s, args.join(", "))
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::File : ::File
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/fileutils.rb

@@ -0,0 +1,12 @@
+module TargetIO
+  class FileUtils
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("FileUtils::%s(%s)", m.to_s, args.join(", "))
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::FileUtils : ::FileUtils
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/http.rb

@@ -0,0 +1,35 @@
+require "forwardable" unless defined?(Forwardable)
+
+require_relative "../http/simple"
+require_relative "../json_compat"
+require_relative "train/http"
+
+module TargetIO
+  class HTTP
+    extend Forwardable
+    def_delegators :@http_class, :get, :head, :patch, :post, :put, :delete
+
+    # Only for Chef::Provider::RemoteFile::HTTP
+    def_delegators :@http_class, :streaming_request, :streaming_request_with_progress, :last_response
+
+    def initialize(url, http_client_opts = {})
+      if ::ChefConfig::Config.target_mode?
+        @http_class = TargetIO::TrainCompat::HTTP.new(url, http_client_opts)
+      else
+        @http_class = Chef::HTTP::Simple.new(url, http_client_opts)
+      end
+    end
+
+    class SimpleJSON
+      def initialize(url, http_client_opts = {})
+        @http_class = TargetIO::HTTP.new(url, http_client_opts)
+      end
+
+      def get(path, headers = {})
+        response = @http_class.get(path, headers)
+
+        Chef::JSONCompat.from_json(response)
+      end
+    end
+  end
+end

data/lib/chef/target_io/io.rb

@@ -0,0 +1,12 @@
+module TargetIO
+  class IO
+    class << self
+      def method_missing(m, *args, **kwargs, &block)
+        Chef::Log.debug format("IO::%s(%s)", m.to_s, args.join(", "))
+
+        backend = ChefConfig::Config.target_mode? ? TrainCompat::IO : ::IO
+        backend.send(m, *args, **kwargs, &block)
+      end
+    end
+  end
+end

data/lib/chef/target_io/shadow.rb

@@ -0,0 +1,44 @@
+module TargetIO
+  module Shadow
+    # sp_namp - pointer to null-terminated user name.
+    # sp_pwdp - pointer to null-terminated password.
+    # sp_lstchg - days  since  Jan  1,  1970 password was last
+    #             changed.
+    # sp_min - days before which password may not be changed.
+    # sp_max - days after which password must be changed.
+    # sp_warn - days before password is to expire that  user  is
+    #           warned of pending password expiration.
+    # sp_inact  -  days  after  password expires that account is
+    #              considered inactive and disabled.
+    # sp_expire - days since Jan 1, 1970 when  account  will  be
+    #             disabled
+    # sp_loginclass - pointer to null-terminated user login class.
+    Entry = Struct.new(
+      :sp_namp,
+      :sp_pwdp,
+      :sp_lstchg,
+      :sp_min,
+      :sp_max,
+      :sp_warn,
+      :sp_inact,
+      :sp_expire,
+      :sp_loginclass
+    )
+
+    class Passwd
+      class << self
+
+        def method_missing(m, *args, **kwargs, &block)
+          Chef::Log.debug format("Shadow::Passwd::%s(%s)", m.to_s, args.join(", "))
+
+          if ChefConfig::Config.target_mode? && !Chef.run_context.transport_connection.os.unix?
+            raise "Shadow support only on Unix, this is " + Chef.run_context.transport_connection.platform.title
+          end
+
+          backend = ChefConfig::Config.target_mode? ? TrainCompat::Shadow::Passwd : ::Shadow::Passwd
+          backend.send(m, *args, **kwargs, &block)
+        end
+      end
+    end
+  end
+end

data/lib/chef/target_io/support.rb

@@ -0,0 +1,73 @@
+require "tempfile" unless defined?(::Tempfile)
+
+module TargetIO
+  module Support
+    # "sudo" based connections need a staging area for file reading/writing
+    def read_file(filename)
+      accessible_file = filename
+
+      if sudo?
+        accessible_file = staging_file(filename)
+        ::TargetIO::FileUtils.cp(filename, accessible_file)
+      end
+
+      content = transport_connection.file(accessible_file).content
+
+      clean_staging(accessible_file) if sudo?
+
+      content
+    end
+
+    def write_file(remote_file, content)
+      tempfile = ::Tempfile.new
+      tempfile.write(tempfile, content)
+      tempfile.close
+
+      upload(tempfile.path, remote_file)
+      tempfile.unlink
+
+      remote_file
+    end
+
+    def upload(local_file, remote_file)
+      accessible_file = remote_file
+      accessible_file = staging_file(remote_file) if sudo?
+
+      transport_connection.upload(local_file, accessible_file)
+
+      if sudo?
+        ::TargetIO::FileUtils.mv(accessible_file, remote_file)
+        clean_staging(accessible_file)
+      end
+    end
+
+    def staging_file(filename)
+      staging_dir = ::TargetIO::Dir.mktmpdir(filename)
+      ::File.join(staging_dir, ::File.basename(filename))
+    end
+
+    def clean_staging(filename)
+      ::TargetIO::FileUtils.rm(filename)
+
+      staging_dir = ::File.dirname(filename)
+      ::TargetIO::FileUtils.rmdir(staging_dir)
+    rescue Errno::ENOENT
+    end
+
+    def run_command(cmd)
+      transport_connection.run_command(cmd)
+    end
+
+    def sudo?
+      transport_connection.transport_options[:sudo]
+    end
+
+    def remote_user
+      transport_connection.transport_options[:user]
+    end
+
+    def transport_connection
+      Chef.run_context&.transport_connection
+    end
+  end
+end

data/lib/chef/target_io/train/dir.rb

@@ -0,0 +1,86 @@
+require_relative "file"
+require_relative "fileutils"
+
+require_relative "../support"
+
+module TargetIO
+  module TrainCompat
+    class Dir
+      class << self
+        include TargetIO::Support
+
+        def [](*patterns, base: ".", sort: true)
+          Dir.glob(patterns, 0, base, sort)
+        end
+
+        def delete(dir_name)
+          ::TargetIO::FileUtils.rm_rf(dir_name)
+        end
+
+        def directory?(dir_name)
+          ::TargetIO::File.directory? dir_name
+        end
+
+        def entries(dirname)
+          cmd = "ls -1a #{dirname}"
+          output = run_command(cmd).stdout
+          output.split("\n")
+        end
+
+        def glob(pattern, flags = 0, base: ".", sort: true)
+          raise "Dir.glob flags not supported except FNM_DOTMATCH" unless [0, ::File::FNM_DOTMATCH].include? flags
+
+          pattern  = Array(pattern)
+          matchdot = flags || ::File::FNM_DOTMATCH ? "dotglob" : ""
+
+          cmd += <<-BASH4
+            shopt -s globstar #{matchdot}
+            cd #{base}
+            for f in #{pattern.join(" ")}; do
+              printf '%s\n' "$f";
+            done
+          BASH4
+
+          output = run_command(cmd).stdout
+          files  = output.split("\n")
+          files.sort! if sort
+
+          files
+        end
+
+        def mkdir(dir_name, mode = nil)
+          ::TargetIO::FileUtils.mkdir(dir_name)
+          ::TargetIO::FileUtils.chmod(dir_name, mode) if mode
+        end
+
+        # Borrowed and adapted from Ruby's Dir::tmpdir and Dir::mktmpdir
+        def mktmpdir(prefix_suffix = nil, *rest, **options)
+          prefix, suffix = ::File.basename(prefix_suffix || "d")
+          random = (::Random.urandom(4).unpack1("L") % 36**6).to_s(36)
+
+          t = Time.now.strftime("%Y%m%d%s")
+          path = "#{prefix}#{t}-#{$$}-#{random}" + "#{suffix || ""}"
+          path = ::File.join(tmpdir, path)
+
+          ::TargetIO::FileUtils.mkdir(path)
+          ::TargetIO::FileUtils.chmod(0700, path)
+          ::TargetIO::FileUtils.chown(remote_user, nil, path) if sudo?
+
+          at_exit do
+            ::TargetIO::FileUtils.rm_rf(path)
+          end
+
+          path
+        end
+
+        def tmpdir
+          ::Dir.tmpdir
+        end
+
+        def unlink(dir_name)
+          ::TargetIO::FileUtils.rmdir(dir_name)
+        end
+      end
+    end
+  end
+end

data/lib/chef/target_io/train/etc.rb

@@ -0,0 +1,108 @@
+require_relative "file"
+
+module TargetIO
+  module TrainCompat
+    class Etc
+      @@cache = {}
+
+      class << self
+        def getpwnam(name)
+          __getpw { |entry| entry["user"] == name }
+        end
+
+        def getpwuid(uid)
+          __getpw { |entry| entry["uid"] == uid.to_i }
+        end
+
+        def getgrnam(name)
+          __getgr { |entry| entry["name"] == name }
+        end
+
+        def getgrgid(gid)
+          __getgr { |entry| entry["gid"] == gid.to_i }
+        end
+
+        def __getpw(&block)
+          content = ::TargetIO::File.read("/etc/passwd")
+          entries = __parse_passwd(content)
+          data    = entries.detect(&block)
+          raise ArgumentError unless data
+
+          ::Etc::Passwd.new(
+            data["user"],
+            data["password"],
+            data["uid"].to_i,
+            data["gid"].to_i,
+            data["desc"],
+            data["home"],
+            data["shell"]
+          )
+        end
+
+        # Parse /etc/passwd files.
+        # Courtesy of InSpec
+        #
+        # @param [String] content the raw content of /etc/passwd
+        # @return [Array] Collection of passwd entries
+        def __parse_passwd(content)
+          content.to_s.split("\n").map do |line|
+            next if line[0] == "#"
+
+            __parse_passwd_line(line)
+          end.compact
+        end
+
+        # Parse a line of /etc/passwd
+        #
+        # @param [String] line a line of /etc/passwd
+        # @return [Hash] Map of entries in this line
+        def __parse_passwd_line(line)
+          x = line.split(":")
+          {
+            # rubocop:disable Layout/AlignHash
+            "user"     => x.at(0),
+            "password" => x.at(1),
+            "uid"      => x.at(2),
+            "gid"      => x.at(3),
+            "desc"     => x.at(4),
+            "home"     => x.at(5),
+            "shell"    => x.at(6),
+          }
+        end
+
+        def __getgr(&block)
+          content = ::TargetIO::File.read("/etc/group")
+          entries = __parse_group(content)
+          data    = entries.detect(&block)
+          raise ArgumentError unless data
+
+          ::Etc::Group.new(
+            data["name"],
+            data["password"],
+            data["gid"].to_i,
+            String(data["mem"]).split(",")
+          )
+        end
+
+        def __parse_group(content)
+          content.to_s.split("\n").map do |line|
+            next if line[0] == "#"
+
+            __parse_group_line(line)
+          end.compact
+        end
+
+        def __parse_group_line(line)
+          x = line.split(":")
+          {
+            # rubocop:disable Layout/AlignHash
+            "name"     => x.at(0),
+            "password" => x.at(1),
+            "gid"      => x.at(2),
+            "mem"      => x.at(3),
+          }
+        end
+      end
+    end
+  end
+end